[ios] Don't preload when restored webState's aren't showing the new URL.

Due to some security workarounds inside ios/web, sometimes a restored
webState may mark new navigations as renderer initiated instead of browser
initiated.  This is somewhat an edge case, but it will manifest as the
omnibox not updated until the new webState commits.  As these navigations
are uncommitted, and make the omnibox (or NTP) look strange, simply drop
them.  See crbug.com/1010765 for the relevant security bug.

Bug: 1020497
Change-Id: I3fbc80bf1671654989f38b92a874e20631ff6ae6
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1894470
Commit-Queue: Justin Cohen <justincohen@chromium.org>
Auto-Submit: Justin Cohen <justincohen@chromium.org>
Reviewed-by: Eugene But <eugenebut@chromium.org>
Cr-Commit-Position: refs/heads/master@{#711985}

ios/chrome/browser/prerender/prerender_service.mm

@@ -62,6 +62,19 @@ bool PrerenderService::MaybeLoadPrerenderedURL(
     return false;
   }
 
+  // Due to some security workarounds inside ios/web, sometimes a restored
+  // webState may mark new navigations as renderer initiated instead of browser
+  // initiated. As a result 'visible url' of preloaded web state will be
+  // 'last committed  url', and not 'url typed by the user'. As these
+  // navigations are uncommitted, and make the omnibox (or NTP) look strange,
+  // simply drop them.  See crbug.com/1020497 for the strange UI, and
+  // crbug.com/1010765 for the triggering security fixes.
+  if (web_state_list->GetActiveWebState()->GetVisibleURL() ==
+      new_web_state->GetVisibleURL()) {
+    CancelPrerender();
+    return false;
+  }
+
   DCHECK_NE(WebStateList::kInvalidIndex, web_state_list->active_index());
 
   web::NavigationManager* active_navigation_manager =