The history.pushState/replaceState should check for minimum arity exception.

Source/bindings/core/v8/custom/V8HistoryCustom.cpp

Index: Source/bindings/core/v8/custom/V8HistoryCustom.cpp
diff --git a/Source/bindings/core/v8/custom/V8HistoryCustom.cpp b/Source/bindings/core/v8/custom/V8HistoryCustom.cpp
index d6c99e308391d3837c73bbca45b6ee586527e908..59412ab2156930c50daaec25f5600e8318a96a42 100644
--- a/Source/bindings/core/v8/custom/V8HistoryCustom.cpp
+++ b/Source/bindings/core/v8/custom/V8HistoryCustom.cpp
@@ -63,6 +63,13 @@ void V8History::stateAttributeGetterCustom(const v8::PropertyCallbackInfo<v8::Va
 void V8History::pushStateMethodCustom(const v8::FunctionCallbackInfo<v8::Value>& info)
 {
     ExceptionState exceptionState(ExceptionState::ExecutionContext, "pushState", "History", info.Holder(), info.GetIsolate());
+
+    if (info.Length() < 2) {
+        exceptionState.throwTypeError("Not enough arguments to History.pushState.");
+        exceptionState.throwIfNeeded();
+        return;
+    }
+
     RefPtr<SerializedScriptValue> historyState = SerializedScriptValueFactory::instance().create(info[0], 0, 0, exceptionState, info.GetIsolate());
     if (exceptionState.throwIfNeeded())
         return;
@@ -79,6 +86,13 @@ void V8History::pushStateMethodCustom(const v8::FunctionCallbackInfo<v8::Value>&
 void V8History::replaceStateMethodCustom(const v8::FunctionCallbackInfo<v8::Value>& info)
 {
     ExceptionState exceptionState(ExceptionState::ExecutionContext, "replaceState", "History", info.Holder(), info.GetIsolate());
+
+    if (info.Length() < 2) {
+        exceptionState.throwTypeError("Not enough arguments to History.replaceState.");
+        exceptionState.throwIfNeeded();
+        return;
+    }
+
     RefPtr<SerializedScriptValue> historyState = SerializedScriptValueFactory::instance().create(info[0], 0, 0, exceptionState, info.GetIsolate());
     if (exceptionState.throwIfNeeded())
         return;