GitLab

The injected versions of pushState and replaceState synchronously call
the built-in version of these functions, and then send a message to
Chrome's process. After receiving this message, Chrome injects script
to perform a replaceState with the same state and URL. Since this happens
asynchronously, it will incorrectly clobber changes to history state that
have happened since the original call to pushState or replaceState.

These extra calls to replaceState are also unnecessary, since the injected
functions already call the built-in equivalents.

A previous attempt (https://crrev.com/c/1514060) at removing this logic only
did so for pushState, leading to a bug (crbug.com/949305) when a page does:
replaceState(someState, someTitle, "#replace");
pushState(someOtherState, someOtherTitle, "#push");

Because replaceState still had the extra asynchronous call, the actual
sequence that was excecuted was:
replaceState(someState, someTitle, "#replace");
pushState(someOtherState, someOtherTitle, "#push");
// A bit later:
replaceState(someState, someTitle, "#replace");

This effectively erased the pushState.

This CL removes the extra calls from both pushState and replaceState, and
adds test coverage for back-to-back calls to replaceState followed by
pushState and vice-versa.

This also fixes subtests in the following two Web Platform Tests that currently
fail in Chrome but pass in Safari:
html/browsers/history/the-history-interface/history_pushstate_url.html
html/browsers/browsing-the-web/history-traversal/persisted-user-state-restoration/scroll-restoration-fragment-scrolling-samedoc.html

Bug: 769945
Change-Id: I34b51a0a91def67cbe85ef16761497a293f1b497
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1867308
Commit-Queue: Ali Juma <ajuma@chromium.org>
Reviewed-by: Eugene But <eugenebut@chromium.org>
Cr-Commit-Position: refs/heads/master@{#707796}