Fix Blink commit type for subframes after initial about:blank load.

Source/web/WebLocalFrameImpl.cpp

 /*
  * Copyright (C) 2009 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 1930 matching lines @@
     v8::Local<v8::Value> result = frame()->script().executeScriptInMainWorldAndReturnValue(ScriptSourceCode(script));
     if (result.IsEmpty() || !result->IsString())
         return;
     String scriptResult = toCoreString(v8::Local<v8::String>::Cast(result));
     if (!frame()->navigationScheduler().locationChangePending())
         frame()->loader().replaceDocumentWhileExecutingJavaScriptURL(scriptResult, ownerDocument.get());
 }
 
 static void ensureFrameLoaderHasCommitted(FrameLoader& frameLoader)
 {
-    if (frameLoader.stateMachine()->committedFirstRealDocumentLoad())
+    // Internally, Blink uses CommittedMultipleRealLoads to track whether the
+    // next commit should create a new history item or not. Ensure we have
+    // reached that state.
+    if (frameLoader.stateMachine()->committedMultipleRealLoads())
         return;
-    frameLoader.stateMachine()->advanceTo(frameLoader.client()->backForwardLength() > 1 ?
-        FrameLoaderStateMachine::CommittedMultipleRealLoads : FrameLoaderStateMachine::CommittedFirstRealLoad);
+    frameLoader.stateMachine()->advanceTo(FrameLoaderStateMachine::CommittedMultipleRealLoads);
 }
 
 void WebLocalFrameImpl::initializeToReplaceRemoteFrame(WebRemoteFrame* oldWebFrame, const WebString& name, WebSandboxFlags flags)
 {
     Frame* oldFrame = toCoreFrame(oldWebFrame);
     // Note: this *always* temporarily sets a frame owner, even for main frames!
     // When a core Frame is created with no owner, it attempts to set itself as
     // the main frame of the Page. However, this is a provisional frame, and may
     // disappear, so Page::m_mainFrame can't be updated just yet.
     OwnPtrWillBeRawPtr<FrameOwner> tempOwner = RemoteBridgeFrameOwner::create(nullptr, SandboxNone);
@@ skipping 147 matching lines @@
 {
     m_frameWidget = frameWidget;
 }
 
 WebFrameWidgetImpl* WebLocalFrameImpl::frameWidget() const
 {
     return m_frameWidget;
 }
 
 } // namespace blink