Fix Blink commit type for subframes after initial about:blank load.

Source/web/WebLocalFrameImpl.cpp

 /*
  * Copyright (C) 2009 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 1930 matching lines @@
     v8::Local<v8::Value> result = frame()->script().executeScriptInMainWorldAndReturnValue(ScriptSourceCode(script));
     if (result.IsEmpty() || !result->IsString())
         return;
     String scriptResult = toCoreString(v8::Local<v8::String>::Cast(result));
     if (!frame()->navigationScheduler().locationChangePending())
         frame()->loader().replaceDocumentWhileExecutingJavaScriptURL(scriptResult, ownerDocument.get());
 }
 
 static void ensureFrameLoaderHasCommitted(FrameLoader& frameLoader)
 {
-    if (frameLoader.stateMachine()->committedFirstRealDocumentLoad())
+    if (frameLoader.stateMachine()->committedMultipleRealLoads())
         return;
-    frameLoader.stateMachine()->advanceTo(frameLoader.client()->backForwardLength() > 1 ?
-        FrameLoaderStateMachine::CommittedMultipleRealLoads : FrameLoaderStateMachine::CommittedFirstRealLoad);
+    frameLoader.stateMachine()->advanceTo(FrameLoaderStateMachine::CommittedMultipleRealLoads);

[Charlie Reis, 2015/06/09 07:14:18]

After looking at how Blink uses these states, I think we might want to always
use CommittedMultipleRealLoads here.

Confusingly, Blink uses CommittedFirstRealLoad for the initial about:blank
document in an iframe.  The check that I've moved from NavigationScheduler
(which dictates whether the next commit creates a new history item or not) uses
CommittedMultipleRealLoads, which is the state you're in after leaving
about:blank, even if you only have 1 item in history (i.e., the real page that
replaced about:blank).

[Nate Chapin, 2015/06/09 18:25:33]

CommittedMultipleRealLoads isn't used for a whole lot, if you have a better way
to do the location.assign() special case, I'm happy to remove it.

[Charlie Reis, 2015/06/11 16:43:48]

Oh, I see; it was introduced in https://codereview.chromium.org/76653002/ in
November 2013.

The part that I found confusing was that the about:blank page counted as
"CommittedFirstRealLoad" (as opposed to something like
DisplayingInitialEmptyDocumentPostCommit, which used to exist but was removed in
https://codereview.chromium.org/22891017 in August 2013).  From the name, I
would have expected the first non-about:blank page to count as the
"CommittedFirstRealLoad."

I'm not terribly concerned about fixing that here, though, now that we seem to
have come to a mostly sane situation.  Ok if we fix this and later consider
improvements to CommittedMultipleRealLoads?

 }
 
 void WebLocalFrameImpl::initializeToReplaceRemoteFrame(WebRemoteFrame* oldWebFrame, const WebString& name, WebSandboxFlags flags)
 {
     Frame* oldFrame = toCoreFrame(oldWebFrame);
     // Note: this *always* temporarily sets a frame owner, even for main frames!
     // When a core Frame is created with no owner, it attempts to set itself as
     // the main frame of the Page. However, this is a provisional frame, and may
     // disappear, so Page::m_mainFrame can't be updated just yet.
     OwnPtrWillBeRawPtr<FrameOwner> tempOwner = RemoteBridgeFrameOwner::create(nullptr, SandboxNone);
@@ skipping 147 matching lines @@
 {
     m_frameWidget = frameWidget;
 }
 
 WebFrameWidgetImpl* WebLocalFrameImpl::frameWidget() const
 {
     return m_frameWidget;
 }
 
 } // namespace blink