Always set the serialized state object for history navigations.

ios/web/web_state/ui/crw_web_controller.mm

 // Copyright 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #import "ios/web/web_state/ui/crw_web_controller.h"
 
 #import <objc/runtime.h>
 #include <cmath>
 
 #include "base/ios/block_types.h"
@@ skipping 1248 matching lines @@
 
 - (NSString*)javascriptToReplaceWebViewURL:(const GURL&)url
                            stateObjectJSON:(NSString*)stateObject {
   std::string outURL;
   base::EscapeJSONString(url.spec(), true, &outURL);
   return
       [NSString stringWithFormat:@"__gCrWeb.replaceWebViewURL(%@, %@);",
                                  base::SysUTF8ToNSString(outURL), stateObject];
 }
 
-- (void)finishPushStateNavigationToURL:(const GURL&)url
-                       withStateObject:(NSString*)stateObject {
+- (void)setPushedOrReplacedURL:(const GURL&)url
+                   stateObject:(NSString*)stateObject {
   // TODO(stuartmorgan): Make CRWSessionController manage this internally (or
   // remove it; it's not clear this matches other platforms' behavior).
   _webStateImpl->GetNavigationManagerImpl().OnNavigationItemCommitted();
 
   NSString* replaceWebViewUrlJS =
       [self javascriptToReplaceWebViewURL:url stateObjectJSON:stateObject];
   std::string outState;
   base::EscapeJSONString(base::SysNSStringToUTF8(stateObject), true, &outState);
   NSString* popstateJS =
       [NSString stringWithFormat:@"__gCrWeb.dispatchPopstateEvent(%@);",
@@ skipping 475 matching lines @@
   [self restoreStateFromHistory];
   _webStateImpl->OnPageLoaded(currentURL, loadSuccess);
   _webStateImpl->SetIsLoading(false);
   // Inform the embedder the load completed.
   [_delegate webDidFinishWithURL:currentURL loadSuccess:loadSuccess];
 }
 
 - (void)finishHistoryNavigationFromEntry:(CRWSessionEntry*)fromEntry {
   [_delegate webWillFinishHistoryNavigationFromEntry:fromEntry];
 
-  // Check if toEntry was created by a JavaScript window.history.pushState()
-  // call from fromEntry. If it was, don't load the URL. Instead update
-  // UIWebView's URL and dispatch a popstate event.
-  if ([_webStateImpl->GetNavigationManagerImpl().GetSessionController()
+  // If the current entry has a serialized state object, inject its state into
+  // the web view.
+  web::NavigationItemImpl* currentItem =
+      self.currentSessionEntry.navigationItemImpl;
+  NSString* state = currentItem->GetSerializedStateObject();
+  if (state.length)
+    [self setPushedOrReplacedURL:currentItem->GetURL() stateObject:state];
+  // Only load the new URL if the current entry was not created by a JavaScript
+  // window.history.pushState() call from |fromEntry|.
+  if (![_webStateImpl->GetNavigationManagerImpl().GetSessionController()
           isPushStateNavigationBetweenEntry:fromEntry
                                    andEntry:self.currentSessionEntry]) {
-    NSString* state = [self currentSessionEntry]
-                          .navigationItemImpl->GetSerializedStateObject();
-    [self finishPushStateNavigationToURL:[self currentNavigationURL]
-                         withStateObject:state];
-  } else {
     web::NavigationItem* currentItem =
         _webStateImpl->GetNavigationManagerImpl().GetVisibleItem();
     GURL endURL = [self URLForHistoryNavigationFromItem:fromEntry.navigationItem
                                                  toItem:currentItem];
     ui::PageTransition transition = ui::PageTransitionFromInt(
         ui::PAGE_TRANSITION_RELOAD | ui::PAGE_TRANSITION_FORWARD_BACK);
 
     web::WebLoadParams params(endURL);
     if (currentItem) {
       params.referrer = currentItem->GetReferrer();
@@ skipping 2013 matching lines @@
   if (!_externalRequest || !_externalRequest->window_name)
     return @"";
   return _externalRequest->window_name;
 }
 
 - (void)resetExternalRequest {
   _externalRequest.reset();
 }
 
 @end