The history.pushState/replaceState should check for minimum arity exception.

LayoutTests/fast/history/replacestate-nocrash.html

Index: LayoutTests/fast/history/replacestate-nocrash.html
diff --git a/LayoutTests/fast/history/replacestate-nocrash.html b/LayoutTests/fast/history/replacestate-nocrash.html
index 5c85e709d51e3984921e581876069b153a3cecbe..7cb5dbe6d253c9fe4a8d2b9529e3e51aa601a1f5 100644
--- a/LayoutTests/fast/history/replacestate-nocrash.html
+++ b/LayoutTests/fast/history/replacestate-nocrash.html
@@ -5,8 +5,8 @@ Test passes if it does not crash.
 if (window.testRunner)
     testRunner.dumpAsText();
 
-Object.prototype.__defineSetter__("foo",function(){history.replaceState("")});
-history.replaceState({foo:1,zzz:Array(1<<22).join("a")});
+Object.prototype.__defineSetter__("foo",function(){history.replaceState("", "")});

[vivekg, 2015/03/18 12:36:57]

nit: Format the above code as:

Object.prototype.__defineSetter__('foo', function() {
    history.replaceState('', '')
});
history.replaceState({foo:1, zzz:Array(1<<22).join('a')}, '');

[Abhijeet Kandalkar Slow, 2015/03/18 12:42:32]

Done.

+history.replaceState({foo:1,zzz:Array(1<<22).join("a")}, "");
 history.state.length;
 </script>
 </html>