chromium/third_party/blink/web_tests/fast/xpath/xpath-empty-string.html

<html>
<head>
    <script>
        function runTests() {
            if (window.testRunner)
                testRunner.dumpAsText();

            document.evaluate("//a[@id='']", document);
        }
    </script>
</head>
<body onload="runTests()">
    This tests that parsing an XPath expression that contains an empty string literal doesn't segfault.<br>
    SUCCESS: Didn't crash!
</body>
</html>