It seems to be an issue in the parser that garbage is sent to XPath::Step ctor instead of correct Axis ids.
Created attachment 12941 [details]
I have a fix for this issue (which is caused by a missing break in a switch statement in Parser::lex()), but my test case still doesn't work correctly. WebKit and Firefox/Opera seem to have different ideas about what a root node is (in Firefox, it's the document element, while in WebKit, it's the Document itself).
Going to investigate this further.
Created attachment 12960 [details]
Comment on attachment 12960 [details]
Committed revision 19425.