The history.pushState/replaceState should check for minimum arity exception.

Source/bindings/core/v8/custom/V8HistoryCustom.cpp

Index: Source/bindings/core/v8/custom/V8HistoryCustom.cpp
diff --git a/Source/bindings/core/v8/custom/V8HistoryCustom.cpp b/Source/bindings/core/v8/custom/V8HistoryCustom.cpp
index d6c99e308391d3837c73bbca45b6ee586527e908..85cdfdb3c382d9bcf4c7f64012ccb9d83182d3f4 100644
--- a/Source/bindings/core/v8/custom/V8HistoryCustom.cpp
+++ b/Source/bindings/core/v8/custom/V8HistoryCustom.cpp
@@ -63,6 +63,13 @@ void V8History::stateAttributeGetterCustom(const v8::PropertyCallbackInfo<v8::Va
 void V8History::pushStateMethodCustom(const v8::FunctionCallbackInfo<v8::Value>& info)
 {
     ExceptionState exceptionState(ExceptionState::ExecutionContext, "pushState", "History", info.Holder(), info.GetIsolate());
+
+    if (UNLIKELY(info.Length() < 2)) {
+        setMinimumArityTypeError(exceptionState, 2, info.Length());
+        exceptionState.throwIfNeeded();
+        return;
+    }
+
     RefPtr<SerializedScriptValue> historyState = SerializedScriptValueFactory::instance().create(info[0], 0, 0, exceptionState, info.GetIsolate());
     if (exceptionState.throwIfNeeded())
         return;
@@ -79,6 +86,13 @@ void V8History::pushStateMethodCustom(const v8::FunctionCallbackInfo<v8::Value>&
 void V8History::replaceStateMethodCustom(const v8::FunctionCallbackInfo<v8::Value>& info)
 {
     ExceptionState exceptionState(ExceptionState::ExecutionContext, "replaceState", "History", info.Holder(), info.GetIsolate());
+
+    if (UNLIKELY(info.Length() < 2)) {
+        setMinimumArityTypeError(exceptionState, 2, info.Length());
+        exceptionState.throwIfNeeded();
+        return;
+    }
+
     RefPtr<SerializedScriptValue> historyState = SerializedScriptValueFactory::instance().create(info[0], 0, 0, exceptionState, info.GetIsolate());
     if (exceptionState.throwIfNeeded())
         return;