diff --git a/core/lib/Drupal/Core/Form/FormBuilder.php b/core/lib/Drupal/Core/Form/FormBuilder.php
index 649e96c..a9ae1bd 100644
--- a/core/lib/Drupal/Core/Form/FormBuilder.php
+++ b/core/lib/Drupal/Core/Form/FormBuilder.php
@@ -1049,8 +1049,15 @@ public function doBuildForm($form_id, &$element, FormStateInterface &$form_state
 
   /**
    * Helper function to normalize the different callable formats.
+   *
+   * @param callable $value_callable
+   *   The callable to be checked.
+   *
+   * @return bool
+   *   TRUE if the callable is safe even if the CSRF token is invalid, FALSE
+   *   otherwise.
    */
-  protected function valueCallableIsSafe($value_callable) {
+  protected function valueCallableIsSafe(callable $value_callable) {
     // The same static class method callable may be formatted in two array and
     // two string forms:
     // ['\Classname', 'methodname']
diff --git a/core/tests/Drupal/Tests/Core/Form/FormBuilderTest.php b/core/tests/Drupal/Tests/Core/Form/FormBuilderTest.php
index 1c62433..86b1fcb 100644
--- a/core/tests/Drupal/Tests/Core/Form/FormBuilderTest.php
+++ b/core/tests/Drupal/Tests/Core/Form/FormBuilderTest.php
@@ -713,10 +713,6 @@ public function providerTestValueCallableIsSafe() {
       ['\Drupal\Core\Render\Element\Token', 'valueCallback'],
       TRUE,
     ];
-    $data['nonexistent'] = [
-      'Foo::bar',
-      FALSE,
-    ];
     $data['closure'] = [
       function () {},
       FALSE,