Codebase Browser
chromium
Go to App

chromium/third_party/blink/web_tests/fast/events/set-attribute-listener-window-onerror-crash.html 

<!DOCTYPE html>
<html>
<body>
Test passes if it does not crash.
<script>
if (window.testRunner)
    testRunner.dumpAsText();

function errorHandler() {
    document.body.setAttribute("onclick", "var x=;");
}

window.onerror = errorHandler;
document.body.setAttribute("onclick", "var x=;");
document.body.onclick;
</script>
</html>