<!DOCTYPE html>
<html>
Test passes if it does not crash.
<script>
if (window.testRunner)
    testRunner.dumpAsText();

Object.prototype.__defineSetter__("foo",function(){history.replaceState("", "")});
history.replaceState({foo:1,zzz:"a".repeat(1<<22)}, "");
history.state.length;
</script>
</html>
