| <!DOCTYPE html> | |
| <html> | |
| Test passes if it does not crash. | |
| <script> | |
| if (window.testRunner) | |
| testRunner.dumpAsText(); | |
| Object.prototype.__defineSetter__('foo', function() { | |
| history.replaceState('', '') | |
| }); | |
| history.replaceState({foo:1, zzz:Array(1<<22).join('a')}, ''); | |
| history.state.length; | |
| </script> | |
| </html> |