LayoutTests/fast/forms/onformdata-navigate-crash.html - external/github.com/WebKit/webkit - Git at Google

 <script>
   testRunner?.dumpAsText();
   function runTest() {
     form.requestSubmit();
   }
 </script>
 <body onload=runTest()>
   <form id="form" onformdata="navigation.navigate('http://foo/bar');">
   PASS if no crash.
 </body>
	<script>
	testRunner?.dumpAsText();
	function runTest() {
	form.requestSubmit();
	}
	</script>
	<body onload=runTest()>
	<form id="form" onformdata="navigation.navigate('http://foo/bar');">
	PASS if no crash.
	</body>