Add chromium-side support for history.{push,replace}State.

webkit/tools/layout_tests/test_expectations.txt

 // This file consists of lines with specifications of what
 // to expect from layout test cases. The test cases can be directories
 // in which case the expectations apply to all test cases in that
 // directory and any subdirectory. The format of the file is along the
 // lines of:
 //
 // fast/js/fixme.js = FAIL
 // fast/js/flaky.js = FAIL PASS
 // fast/js/crash.js = CRASH TIMEOUT FAIL PASS
 //
@@ skipping 2380 matching lines @@
 // New failures from WebKit r51577
 BUG29164 WIN LINUX MAC : fast/frames/sandboxed-iframe-plugins.html = TEXT
 
 // New failures from WebKit merge 51581:51584
 BUG29167 MAC DEBUG : fast/dom/replaceChild.html = IMAGE PASS
 
 // Failure from WebKit merge 51607:51613 (51608 is the cause)
 BUG29239 : fast/css/variables/misplaced-import-test.html = FAIL
 
 // Failures from WebKit merge 51642:51681
-// Skip these tests since they all timeout and add ~1 minute to cycle time!
-BUG29393 SKIP DEFER : fast/loader/stateobjects = TIMEOUT
-// Asserts in DEBUG, will continue until we implement pushState.
-BUG29393 SKIP : fast/loader/document-with-fragment-url-3.html = CRASH
+BUG29393 : fast/loader/stateobjects/pushstate-object-types.html = TEXT
+BUG29393 : fast/loader/stateobjects/state-api-on-detached-frame-crash.html = TEXT
 
 BUG29944 WIN : websocket/tests/unicode.html = TEXT PASS
 
 // Failures introduced by USE_NEW_BUILDER in Skia.
 BUG33287 WIN LINUX : fast/canvas/set-colors.html = TEXT
 
 // Failures from WebKit merge 51711:51724
 BUG32003 : fast/js/string-property-deletion.html = TEXT
 BUG31998 LINUX : svg/carto.net/selectionlist.svg = IMAGE PASS
 BUG31997 DEBUG WIN : fast/body-propagation/overflow/004-xhtml.xhtml = IMAGE+TEXT PASS
@@ skipping 346 matching lines @@
 BUG37540 MAC SKIP : inspector/console-dir.html = CRASH TEXT PASS
 
 BUG37710 MAC SKIP : media/video-src-change.html = CRASH PASS 
 
 // WebKit roll 55654 -> 55670
 BUG_JIANLI :  http/tests/local/send-sliced-dragged-file.html = FAIL
 
 // WebKit roll 55670 -> 55674
 BUG37684 SKIP : http/tests/cookies/third-party-cookie-relaxing.html = FAIL
 
-// WebKit roll r55683 -> r55709
-BUG29393 : http/tests/loading/state-object-security-exception.html = TEXT
-
 // Bugs that went unreported when we upstreamed run_webkit_tests
 BUG37896 MAC LINUX : fast/backgrounds/animated-svg-as-background.html = IMAGE
 // New test, added http://trac.webkit.org/changeset/55737
 BUG37896 : fast/events/remove-child-onscroll.html = TIMEOUT
 // This one may be an actual regression! Started being flaky after
 // http://trac.webkit.org/log/?verbose=on&rev=55742&stop_rev=55710
 BUG37896 : fast/events/standalone-image-drag-to-editable.html = IMAGE+TEXT
 // Caused by http://trac.webkit.org/changeset/55549/
 BUG37896 : fast/loader/document-with-fragment-url-4.html = TIMEOUT
 // New test, added http://trac.webkit.org/changeset/55546
@@ skipping 58 matching lines @@
 BUG38389 WIN LINUX : editing/pasteboard/smart-paste-005.html = TEXT
 
 BUG38392 : plugins/resize-from-plugin.html = TEXT
 
 // Chromium r41818 makes these flaky.
 BUG38397 : websocket/tests/url-with-credential.html = TEXT PASS
 BUG38397 : websocket/tests/url-with-empty-query.html = TEXT PASS
 BUG38397 : websocket/tests/url-with-query-for-no-query.html = TEXT PASS
 BUG38397 : websocket/tests/url-with-query.html = TEXT PASS
 BUG38397 : websocket/tests/websocket-pending-activity.html = TIMEOUT PASS