chromium/third_party/blink/web_tests/fast/dom/inline-event-attributes-crash.html

<!DOCTYPE html>
<script src="../../resources/js-test.js"></script>
<script>

description('Tests that malformed code in event handler attributes does not cause a crash');

function dispatchClick(element)
{
    var clickEvent = document.createEvent('MouseEvent');
    clickEvent.initMouseEvent('click', true, false, window, 0, 0, 0, 0, 0, false, false, false, false, 0, null);
    element.dispatchEvent(clickEvent);
}

// Ignore errors due to the syntax error in the attribute.
window.onerror = function() {
    return true;
};

var div = document.createElement('div');
div.setAttribute('onclick', 'return 42; }(); var x = {');
dispatchClick(div);

testPassed('Did not crash');

</script>