LayoutTests/fast/forms/textarea-default-value-crash.html - external/github.com/WebKit/webkit - Git at Google

 <script>
 function load() {
     if (window.testRunner)
         testRunner.dumpAsText();

     var textarea = document.createElement("textarea");
     textarea.defaultValue = String.fromCharCode(13);
 }
 </script>
 <body onload=load()>
 <div>PASS if this doesn't crash.</div>
	<script>
	function load() {
	if (window.testRunner)
	testRunner.dumpAsText();

	var textarea = document.createElement("textarea");
	textarea.defaultValue = String.fromCharCode(13);
	}
	</script>
	<body onload=load()>
	<div>PASS if this doesn't crash.</div>