<!DOCTYPE html>
<html>
<body>
Test passes if it doesn't crash (may require libgmalloc and repeating) and this line gets erased.
<script>
if (window.testRunner) {
    testRunner.dumpAsText();
    testRunner.waitUntilDone();
}
var iterationsLeft = 2;
function test()
{
    if (--iterationsLeft) {
        frames[0].history.go(0);
    } else {
        document.body.textContent = frames[0].document.body.textContent;
        if (window.testRunner)
            testRunner.notifyDone();
    }
}
</script>
<iframe onload="test()"></iframe>
</body>
</html>