Fix Blink commit type for subframes after initial about:blank load.

Source/web/WebLocalFrameImpl.cpp

Index: Source/web/WebLocalFrameImpl.cpp
diff --git a/Source/web/WebLocalFrameImpl.cpp b/Source/web/WebLocalFrameImpl.cpp
index ab13d530431e1dd3f53ade03028c7b33ef594a4f..b331d646191b25c87551737f749177fef9c86d54 100644
--- a/Source/web/WebLocalFrameImpl.cpp
+++ b/Source/web/WebLocalFrameImpl.cpp
@@ -1948,10 +1948,12 @@ void WebLocalFrameImpl::loadJavaScriptURL(const KURL& url)
 
 static void ensureFrameLoaderHasCommitted(FrameLoader& frameLoader)
 {
-    if (frameLoader.stateMachine()->committedFirstRealDocumentLoad())
+    // Internally, Blink uses CommittedMultipleRealLoads to track whether the
+    // next commit should create a new history item or not. Ensure we have
+    // reached that state.
+    if (frameLoader.stateMachine()->committedMultipleRealLoads())
         return;
-    frameLoader.stateMachine()->advanceTo(frameLoader.client()->backForwardLength() > 1 ?
-        FrameLoaderStateMachine::CommittedMultipleRealLoads : FrameLoaderStateMachine::CommittedFirstRealLoad);
+    frameLoader.stateMachine()->advanceTo(FrameLoaderStateMachine::CommittedMultipleRealLoads);
 }
 
 void WebLocalFrameImpl::initializeToReplaceRemoteFrame(WebRemoteFrame* oldWebFrame, const WebString& name, WebSandboxFlags flags)