<!DOCTYPE HTML>
<html>
<body onload="test();">
<script>
  function test() {
    // Test that calling pushState() with a state object which calls
    // history.back() doesn't crash. We need to make sure that there's at least
    // one entry in the history before we do anything else.
    history.pushState(null, "");

    x = {};
    x.toJSON = { history.back(); return "{a:1}"; };
    history.pushState(x, "");
  }
</script>
</body>
</html>