Fix Blink commit type for subframes after initial about:blank load.

Source/core/loader/FrameLoader.cpp

 /*
  * Copyright (C) 2006, 2007, 2008, 2009, 2010, 2011 Apple Inc. All rights reserved.
  * Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)
  * Copyright (C) 2008, 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
  * Copyright (C) 2008 Alp Toker <alp@atoker.com>
  * Copyright (C) Research In Motion Limited 2009. All rights reserved.
  * Copyright (C) 2011 Kris Jordan <krisjordan@gmail.com>
  * Copyright (C) 2011 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ skipping 657 matching lines @@
         return FrameLoadTypeRedirectWithLockedBackForwardList;
     if (!request.originDocument() && request.resourceRequest().url() == m_documentLoader->urlForHistory())
         return FrameLoadTypeSame;
     if (request.substituteData().failingURL() == m_documentLoader->urlForHistory() && m_loadType == FrameLoadTypeReload)
         return FrameLoadTypeReload;
     return FrameLoadTypeStandard;
 }
 
 bool FrameLoader::prepareRequestForThisFrame(FrameLoadRequest& request)
 {
+    // From the HTML5 spec for location.assign():

[Charlie Reis, 2015/06/09 07:14:18]

I'm moving this rule from NavigationScheduler::mustLockBackForwardList and not
the rest, since the other parts don't work at this point in the timeline.  (They
depend on whether a load is in progress, which is always true here for this
request, regardless of what the state was at the start of the request.)

+    //  "If the browsing context's session history contains only one Document,
+    //   and that was the about:blank Document created when the browsing context
+    //   was created, then the navigation must be done with replacement enabled."
+    if (!m_stateMachine.committedMultipleRealLoads()

[Nate Chapin, 2015/06/09 18:25:33]

Should this be a case in determineFrameLoadType()?

[Charlie Reis, 2015/06/11 16:43:48]

Yes, that seems reasonable.  Done.

+        && equalIgnoringCase(m_frame->document()->url(), blankURL())) {
+        request.setLockBackForwardList(true);
+    }
+
     // If no origin Document* was specified, skip remaining security checks and assume the caller has fully initialized the FrameLoadRequest.
     if (!request.originDocument())
         return true;
 
     KURL url = request.resourceRequest().url();
     if (m_frame->script().executeScriptIfJavaScriptURL(url))
         return false;
 
     if (!request.originDocument()->securityOrigin()->canDisplay(url)) {
         reportLocalLoadFailed(m_frame, url.elidedString());
@@ skipping 756 matching lines @@
     // FIXME: We need a way to propagate insecure requests policy flags to
     // out-of-process frames. For now, we'll always use default behavior.
     if (!parentFrame->isLocalFrame())
         return nullptr;
 
     ASSERT(toLocalFrame(parentFrame)->document());
     return toLocalFrame(parentFrame)->document()->insecureNavigationsToUpgrade();
 }
 
 } // namespace blink