diff --git a/core/lib/Drupal/Core/Form/FormBuilder.php b/core/lib/Drupal/Core/Form/FormBuilder.php
index cf9ef25..e6150c2 100644
--- a/core/lib/Drupal/Core/Form/FormBuilder.php
+++ b/core/lib/Drupal/Core/Form/FormBuilder.php
@@ -1034,14 +1034,14 @@ public function doBuildForm($form_id, &$element, FormStateInterface &$form_state
    */
   protected function valueCallableIsSafe($value_callable) {
     // The same static class method callable may be formatted in two array and
-    //  two string forms:
+    // two string forms:
     // ['\Classname', 'methodname']
     // ['Classname', 'methodname']
     // '\Classname::methodname'
     // 'Classname::methodname'
-    // The third parameter of is_callable() is set to a string form, but we
-    // still have to normalize further by stripping a leading '\'.
     if (is_callable($value_callable, FALSE, $callable_name)) {
+      // The third parameter of is_callable() is set to a string form, but we
+      // still have to normalize further by stripping a leading '\'.
       return in_array(ltrim($callable_name, '\\'), $this->safeCoreValueCallables);
     }
     return FALSE;
diff --git a/core/tests/Drupal/Tests/Core/Form/FormBuilderTest.php b/core/tests/Drupal/Tests/Core/Form/FormBuilderTest.php
index 11f66ef..9c6d727 100644
--- a/core/tests/Drupal/Tests/Core/Form/FormBuilderTest.php
+++ b/core/tests/Drupal/Tests/Core/Form/FormBuilderTest.php
@@ -12,6 +12,7 @@
 use Drupal\Core\Access\AccessResultForbidden;
 use Drupal\Core\DependencyInjection\ContainerInjectionInterface;
 use Drupal\Core\Form\EnforcedResponseException;
+use Drupal\Core\Form\FormBuilder;
 use Drupal\Core\Form\FormBuilderInterface;
 use Drupal\Core\Form\FormInterface;
 use Drupal\Core\Form\FormState;
@@ -681,6 +682,47 @@ public function providerTestChildAccessInheritance() {
     return $data;
   }
 
+  /**
+   * @covers ::valueCallableIsSafe
+   *
+   * @dataProvider providerTestValueCallableIsSafe
+   */
+  public function testValueCallableIsSafe($callback, $expected) {
+    $method = new \ReflectionMethod(FormBuilder::class, 'valueCallableIsSafe');
+    $method->setAccessible(true);
+    $is_safe = $method->invoke($this->formBuilder, $callback);
+    $this->assertSame($expected, $is_safe);
+  }
+
+  public function providerTestValueCallableIsSafe() {
+    $data = [];
+    $data['string_no_slash'] = [
+      'Drupal\Core\Render\Element\Token::valueCallback',
+      TRUE,
+    ];
+    $data['string_with_slash'] = [
+      '\Drupal\Core\Render\Element\Token::valueCallback',
+      TRUE,
+    ];
+    $data['array_no_slash'] = [
+      ['Drupal\Core\Render\Element\Token', 'valueCallback'],
+      TRUE,
+    ];
+    $data['array_with_slash'] = [
+      ['\Drupal\Core\Render\Element\Token', 'valueCallback'],
+      TRUE,
+    ];
+    $data['nonexistent'] = [
+      'Foo::bar',
+      FALSE,
+    ];
+    $data['closure'] = [
+      function () {},
+      FALSE,
+    ];
+    return $data;
+  }
+
 }
 
 class TestForm implements FormInterface {