Characters allowed to break double quotes

1

1

1

<form id="test" action="aaa$[chr]onsubmit=alert(1)><input/type='submit'>

var form = document.getElementById("test");
if (typeof form.onsubmit === 'function') {
log(String.fromCharCode($[i]))
  }