Allow <iframe src="javascript:''"> to commit synchronously.

https://crrev.com/624035 made all javascript url navigations async.
Some sites appear to depend on "javascript:''" behaving like
"about:blank" and committing synchronously.

The spec doesn't say anything about this, but given the real-world
breakage, I'm inclined to consider this a very narrow partial revert
of https://crrev.com/624035 while we figure out whether this is a spec
oversight or a case where we just need to encourage libraries to update.

Bug: 923585
Change-Id: Ia030d0a06b5d8f20df319916a1a02297d916e4db
Reviewed-on: https://chromium-review.googlesource.com/c/1435821
Commit-Queue: Nate Chapin <japhet@chromium.org>
Reviewed-by: Dmitry Gozman <dgozman@chromium.org>
Cr-Commit-Position: refs/heads/master@{#626261}

third_party/blink/renderer/core/dom/document.cc

@@ -7871,6 +7871,18 @@ void Document::ProcessJavaScriptUrl(
   if (frame_->Loader().StateMachine()->IsDisplayingInitialEmptyDocument())
     load_event_progress_ = kLoadEventNotRun;
   frame_->Loader().Progress().ProgressStarted();
+  // Some sites appear to depend on javascript:'' synchronously populating an
+  // iframe, similar to about:blank. See https://crbug.com/923585
+  // TODO(japhet): The spec doesn't say anything about ever loading JS urls
+  // synchronously. It's unclear whether the problem is that JS url navigation
+  // has to be sync in certain situations, or if these are just legacy websites
+  // assuming non-spec-compliant behavior. Either way, this special case seems
+  // hacky.
+  if (frame_->Loader().StateMachine()->IsDisplayingInitialEmptyDocument() &&
+      (url == "javascript:''" || url == "javascript:\"\"")) {
+    ExecuteJavaScriptUrl(url, disposition);
+    return;
+  }
   javascript_url_task_handle_ = PostCancellableTask(
       *GetTaskRunner(TaskType::kNetworking), FROM_HERE,
       WTF::Bind(&Document::ExecuteJavaScriptUrl, WrapWeakPersistent(this), url,