Revert "Remove all non-DocumentLoader uses of LocalDOMWindow::InstallNewDocument"

This reverts commit 46c7d082.

Reason for revert: https://bugs.chromium.org/p/chromium/issues/detail?id=1090597#c4

Original change's description:
> Remove all non-DocumentLoader uses of LocalDOMWindow::InstallNewDocument
> 
> LocalFrame::ForceSynchronousDocumentInstall and a few unit tests
> manually replace the Document of a LocalDOMWindow. They can be switched
> to go through the static-response navigation commit path relatively
> easily. This establishes the rule that only DocumentLoader is allowed
> to create a LocalDOMWindow or replace its Document.
> 
> Bug: 1029822
> Change-Id: I84b37f35be5387556999f9bc24f7ba5fa74b4ff8
> Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2222776
> Commit-Queue: Nate Chapin <japhet@chromium.org>
> Reviewed-by: Kentaro Hara <haraken@chromium.org>
> Reviewed-by: Daniel Cheng <dcheng@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#773720}

TBR=dcheng@chromium.org,haraken@chromium.org,japhet@chromium.org

# Not skipping CQ checks because original CL landed > 1 day ago.

Bug: 1029822
Change-Id: I58b897f7bb5327765c86f907a5179bb76fcccf34
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2229104Reviewed-by: Nate Chapin <japhet@chromium.org>
Reviewed-by: Daniel Cheng <dcheng@chromium.org>
Reviewed-by: Kentaro Hara <haraken@chromium.org>
Commit-Queue: Nate Chapin <japhet@chromium.org>
Cr-Commit-Position: refs/heads/master@{#774775}

third_party/blink/renderer/core/frame/local_dom_window.h

@@ -156,8 +156,6 @@ class CORE_EXPORT LocalDOMWindow final : public DOMWindow,
   void CountUse(mojom::WebFeature feature) final;
   void CountDeprecation(mojom::WebFeature feature) final;
 
-  // Initialize and install a Document for navigation. Should only be used by
-  // DocumentLoader.
   Document* InstallNewDocument(const DocumentInit&);
 
   // EventTarget overrides:

third_party/blink/renderer/core/frame/local_frame.cc

@@ -1673,12 +1673,30 @@ void LocalFrame::ForceSynchronousDocumentInstall(
     scoped_refptr<SharedBuffer> data) {
   CHECK(loader_.StateMachine()->IsDisplayingInitialEmptyDocument());
   DCHECK(!Client()->IsLocalFrameClientImpl());
-  auto params = std::make_unique<WebNavigationParams>();
-  WebNavigationParams::FillStaticResponse(
-      params.get(), mime_type, "UTF-8",
-      base::make_span(data->Data(), data->size()));
-  loader_.CommitNavigation(std::move(params), nullptr,
-                           CommitReason::kForcedSync);
+
+  // Any Document requires Shutdown() before detach, even the initial empty
+  // document.
+  GetDocument()->Shutdown();
+
+  DomWindow()->InstallNewDocument(
+      DocumentInit::Create()
+          .WithDocumentLoader(loader_.GetDocumentLoader(),
+                              MakeGarbageCollected<ContentSecurityPolicy>())
+          .WithTypeFrom(mime_type));
+  loader_.StateMachine()->AdvanceTo(
+      FrameLoaderStateMachine::kCommittedFirstRealLoad);
+
+  GetDocument()->OpenForNavigation(kForceSynchronousParsing, mime_type,
+                                   AtomicString("UTF-8"));
+  for (const auto& segment : *data)
+    GetDocument()->Parser()->AppendBytes(segment.data(), segment.size());
+  GetDocument()->Parser()->Finish();
+
+  // Upon loading of SVGImages, log PageVisits in UseCounter.
+  // Do not track PageVisits for inspector, web page popups, and validation
+  // message overlays (the other callers of this method).
+  if (GetDocument()->IsSVGDocument())
+    loader_.GetDocumentLoader()->GetUseCounterHelper().DidCommitLoad(this);
 }
 
 bool LocalFrame::IsProvisional() const {

third_party/blink/renderer/core/loader/document_loader.cc

@@ -1823,7 +1823,6 @@ void DocumentLoader::CreateParserPostCommit() {
           ? kAllowDeferredParsing
           : kAllowAsynchronousParsing;
   if (IsJavaScriptURLOrXSLTCommit() ||
-      commit_reason_ == CommitReason::kForcedSync ||
       !Document::ThreadedParsingEnabledForTesting()) {
     parsing_policy = kForceSynchronousParsing;
   }

third_party/blink/renderer/core/loader/frame_loader.cc

@@ -1197,13 +1197,7 @@ void FrameLoader::CommitDocumentLoader(
   if (commit_reason != CommitReason::kInitialization) {
     // Note: this must be called after DispatchDidCommitLoad() for
     // metrics to be correctly sent to the browser process.
-    // kForcedSync is used in two broad cases: internal UI (inspector, web page
-    // popups, and validation message overlays) and svg images. Don't track
-    // page visits for the internal UI cases.
-    bool is_internal_ui = commit_reason == CommitReason::kForcedSync &&
-                          document_loader_->MimeType() != "image/svg+xml";
-    if (!is_internal_ui)
-      document_loader_->GetUseCounterHelper().DidCommitLoad(frame_);
+    document_loader_->GetUseCounterHelper().DidCommitLoad(frame_);
   }
   if (document_loader_->LoadType() == WebFrameLoadType::kBackForward) {
     if (Page* page = frame_->GetPage())

third_party/blink/renderer/core/loader/frame_loader_types.h

@@ -90,8 +90,6 @@ enum class CommitReason {
   kJavascriptUrl,
   // Committing a replacement document from XSLT.
   kXSLT,
-  // Used to populate certain internal-implementation frames (e.g., overlays).
-  kForcedSync,
   // All other navigations.
   kRegular
 };