Reland "[Nav Experiment] Update NavigationItem URL for location.replace."

This is a reland of 295cd31f.

Original change's description:
> [Nav Experiment] Update NavigationItem URL for location.replace.
> 
> location.replace changes the URL of WKBackForwardListItem. Update the
> URL of NavigationItem to that of the host WKBackForwardListItem upon
> access. It's done this way because location.replace cannot be reliably
> distinguished from normal navigations in either WKNavigationDelegate
> callback or URL KVO.
> 
> This fixes NavigationTestCase/testWindowLocationReplaceAndChangeHash.
> 
> Bug: 807428
> Cq-Include-Trybots: master.tryserver.chromium.mac:ios-simulator-cronet;master.tryserver.chromium.mac:ios-simulator-full-configs
> Change-Id: Iaef4ed5efd788283050b43a3b4e988311ec9cf76
> Reviewed-on: https://chromium-review.googlesource.com/894490
> Commit-Queue: Danyao Wang <danyao@chromium.org>
> Reviewed-by: Eugene But <eugenebut@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#533315}

Bug: 807428
Change-Id: I2f237fe6a03b38592eccf1adedcf8c5679552201
Cq-Include-Trybots: master.tryserver.chromium.mac:ios-simulator-cronet;master.tryserver.chromium.mac:ios-simulator-full-configs
Reviewed-on: https://chromium-review.googlesource.com/900103
Commit-Queue: Danyao Wang <danyao@chromium.org>
Reviewed-by: Eugene But <eugenebut@chromium.org>
Cr-Commit-Position: refs/heads/master@{#534818}

ios/web/navigation/wk_based_navigation_manager_impl.mm

@@ -40,9 +40,11 @@ void SetNavigationItemInWKItem(WKBackForwardListItem* wk_item,
 
 web::NavigationItemImpl* GetNavigationItemFromWKItem(
     WKBackForwardListItem* wk_item) {
-  return wk_item ? [[CRWNavigationItemHolder
-                       holderForBackForwardListItem:wk_item] navigationItem]
-                 : nullptr;
+  if (!wk_item)
+    return nullptr;
+
+  return [[CRWNavigationItemHolder holderForBackForwardListItem:wk_item]
+      navigationItem];
 }
 
 }  // namespace

ios/web/web_state/ui/crw_web_controller.mm

@@ -38,6 +38,7 @@
 #import "ios/net/http_response_headers_util.h"
 #include "ios/web/history_state_util.h"
 #import "ios/web/interstitials/web_interstitial_impl.h"
+#import "ios/web/navigation/crw_navigation_item_holder.h"
 #import "ios/web/navigation/crw_session_controller.h"
 #import "ios/web/navigation/navigation_item_impl.h"
 #import "ios/web/navigation/navigation_manager_impl.h"
@@ -5061,6 +5062,28 @@ registerLoadRequestForURL:(const GURL&)requestURL
   if (![_webView isLoading]) {
     if (_documentURL == URL)
       return;
+
+    // At this point, _webView, _webView.backForwardList.currentItem and its
+    // associated NavigationItem should all have the same URL, except in two
+    // edge cases:
+    // 1. location.replace that only changes hash: WebKit updates _webView.URL
+    //    and currentItem.URL, and NavigationItem URL must be synced.
+    // 2. location.replace to about: URL: a WebKit bug causes only _webView.URL,
+    //    but not currentItem.URL to be updated. NavigationItem URL should be
+    //    synced to _webView.URL.
+    // This needs to be done before |URLDidChangeWithoutDocumentChange| so any
+    // WebStateObserver callbacks will see the updated URL.
+    // TODO(crbug.com/809287) use currentItem.URL instead of _webView.URL to
+    // update NavigationItem URL.
+    if (web::GetWebClient()->IsSlimNavigationManagerEnabled()) {
+      const GURL webViewURL = net::GURLWithNSURL(_webView.URL);
+      web::NavigationItem* currentItem = [[CRWNavigationItemHolder
+          holderForBackForwardListItem:_webView.backForwardList.currentItem]
+          navigationItem];
+      if (currentItem && webViewURL != currentItem->GetURL())
+        currentItem->SetURL(webViewURL);
+    }
+
     [self URLDidChangeWithoutDocumentChange:URL];
   } else if ([self isKVOChangePotentialSameDocumentNavigationToURL:URL]) {
     WKNavigation* navigation = [_navigationStates lastAddedNavigation];