blob: 640cc8584e3793e366bfa6ef51643e1c74e8c47b (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
|
<!DOCTYPE html>
<html>
Test passes if it does not crash.
<script>
if (window.testRunner)
testRunner.dumpAsText();
Object.prototype.__defineSetter__('foo', function() {
history.replaceState('', '')
});
history.replaceState({foo:1, zzz:Array(1<<22).join('a')}, '');
history.state.length;
</script>
</html>
|
