<!DOCTYPE html>
<html>
Test passes if it does not crash.
<script>
if (window.testRunner)
    testRunner.dumpAsText();

Object.prototype.__defineSetter__("foo",function(){history.replaceState("")});
history.replaceState({foo:1,zzz:Array(1<<22).join("a")});
history.state.length;
</script>
</html>