[Nav Experiment] Update NavigationItem URL for location.replace.

location.replace changes the URL of WKBackForwardListItem. Update the
URL of NavigationItem to that of the host WKBackForwardListItem upon
access. It's done this way because location.replace cannot be reliably
distinguished from normal navigations in either WKNavigationDelegate
callback or URL KVO.

This fixes NavigationTestCase/testWindowLocationReplaceAndChangeHash.

Bug: 807428
Cq-Include-Trybots: master.tryserver.chromium.mac:ios-simulator-cronet;master.tryserver.chromium.mac:ios-simulator-full-configs
Change-Id: Iaef4ed5efd788283050b43a3b4e988311ec9cf76
Reviewed-on: https://chromium-review.googlesource.com/894490
Commit-Queue: Danyao Wang <danyao@chromium.org>
Reviewed-by: Eugene But <eugenebut@chromium.org>
Cr-Commit-Position: refs/heads/master@{#533315}

ios/web/navigation/navigation_manager_impl_unittest.mm

@@ -2389,14 +2389,20 @@ TEST_P(NavigationManagerTest, UpdateCurrentItemForReplaceState) {
   [mock_wk_list_ setCurrentURL:@"http://www.url.com/0"];
   navigation_manager()->CommitPendingItem();
 
-  // Replace current item again and check history size and fields.
+  // Note that it is important this reference is taken before calling
+  // UpdateCurrentItemForReplaceState() because NavigationItem getter always
+  // rewrites NavigationItem URL to match WKBackForwardListItem.URL, which
+  // unfortunatelly due to the way the mock object is set up in this test,
+  // cannot be rewritten to the replaced URL. This is not a problem in real
+  // world because WKBackForwardListItem.URL would already be updated to the
+  // replace URL by WKWebView when UpdateCurrentItemForReplaceState() is called.
+  auto* last_committed_item = static_cast<NavigationItemImpl*>(
+      navigation_manager()->GetLastCommittedItem());
   GURL replace_page_url2("http://www.url.com/replace2");
   navigation_manager()->UpdateCurrentItemForReplaceState(replace_page_url2,
                                                          nil);
 
   EXPECT_EQ(1, navigation_manager()->GetItemCount());
-  auto* last_committed_item = static_cast<NavigationItemImpl*>(
-      navigation_manager()->GetLastCommittedItem());
   EXPECT_EQ(replace_page_url2, last_committed_item->GetURL());
   EXPECT_FALSE(last_committed_item->IsCreatedFromPushState());
   EXPECT_NSEQ(nil, last_committed_item->GetSerializedStateObject());

ios/web/navigation/wk_based_navigation_manager_impl.mm

@@ -40,9 +40,21 @@ void SetNavigationItemInWKItem(WKBackForwardListItem* wk_item,
 
 web::NavigationItemImpl* GetNavigationItemFromWKItem(
     WKBackForwardListItem* wk_item) {
-  return wk_item ? [[CRWNavigationItemHolder
-                       holderForBackForwardListItem:wk_item] navigationItem]
-                 : nullptr;
+  if (!wk_item)
+    return nullptr;
+
+  // Fix URL: this is specifically for the location.replace case. WebKit has
+  // updated the wk_item.URL. Update NavigationItem::GetURL() here so all
+  // clients of web layer (e.g. omnibox) will get the updated URL.
+  web::NavigationItemImpl* item = [[CRWNavigationItemHolder
+      holderForBackForwardListItem:wk_item] navigationItem];
+  GURL wk_url = net::GURLWithNSURL(wk_item.URL);
+  if (item && item->GetURL() != wk_url &&
+      !web::placeholder_navigation_util::IsPlaceholderUrl(wk_url) &&
+      !web::IsRestoreSessionUrl(wk_url)) {
+    item->SetURL(wk_url);
+  }
+  return item;
 }
 
 }  // namespace