<body> <script> if (window.testRunner) testRunner.dumpAsText(); </script> This test passes if it doesn't crash. Note: You might need to reload this test many times (or run the test under valgrind / ASAN) to see a crash. <span> <span> <video src="javascript:" onloadstart> <form id="tjbvp"></form> </video> </span> </span> <keygen form="woujt"> </body>