Always set the serialized state object for history navigations.

ios/web/web_state/ui/crw_web_controller.mm

 // Copyright 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #import "ios/web/web_state/ui/crw_web_controller.h"
 
 #import <objc/runtime.h>
 #include <cmath>
 
 #include "base/ios/block_types.h"
@@ skipping 314 matching lines @@
 - (void)setNativeControllerWebUsageEnabled:(BOOL)webUsageEnabled;
 // Evaluates the supplied JavaScript in the web view. Calls |handler| with
 // results of the evaluation (which may be nil if the implementing object has no
 // way to run the evaluation or the evaluation returns a nil value) or an
 // NSError if there is an error. The |handler| can be nil.
 - (void)evaluateJavaScript:(NSString*)script
          JSONResultHandler:(void (^)(scoped_ptr<base::Value>, NSError*))handler;
 // Generates the JavaScript string used to update the UIWebView's URL so that it
 // matches the URL displayed in the omnibox and sets window.history.state to
 // stateObject. Needed for history.pushState() and history.replaceState().
-- (NSString*)javascriptToReplaceWebViewURL:(const GURL&)url
+- (NSString*)javascriptToReplaceWebViewURL:(const GURL&)URL
                            stateObjectJSON:(NSString*)stateObject;
+// Injects JavaScript into the web view to update the URL to |URL|, to set
+// window.history.state to |stateObject|, and to trigger a popstate() event.
+// Upon the scripts completion, resets |urlOnStartLoading_| and
+// |_lastRegisteredRequestURL| to |URL|.  This is necessary so that sites that
+// depend on URL params/fragments continue to work correctly and that checks for
+// the URL don't incorrectly trigger |-pageChanged| calls.
+- (void)setPushedOrReplacedURL:(const GURL&)URL
+                   stateObject:(NSString*)stateObject;
 - (BOOL)isLoaded;
 // Called by NSNotificationCenter upon orientation changes.
 - (void)orientationDidChange;
 // Queries the web view for the user-scalable meta tag and calls
 // |-applyPageDisplayState:userScalable:| with the result.
 - (void)applyPageDisplayState:(const web::PageDisplayState&)displayState;
 // Restores state of the web view's scroll view from |scrollState|.
 // |isUserScalable| represents the value of user-scalable meta tag.
 - (void)applyPageDisplayState:(const web::PageDisplayState&)displayState
                  userScalable:(BOOL)isUserScalable;
@@ skipping 910 matching lines @@
         _webStateImpl->GetCacheMode());
   } else if (preferCache) {
     _webStateImpl->GetRequestTracker()->SetCacheModeFromUIThread(
         net::RequestTracker::CACHE_HISTORY);
   }
   _webStateImpl->SetIsLoading(true);
   [_delegate webDidAddPendingURL];
   _webStateImpl->OnProvisionalNavigationStarted(requestURL);
 }
 
-- (NSString*)javascriptToReplaceWebViewURL:(const GURL&)url
+- (NSString*)javascriptToReplaceWebViewURL:(const GURL&)URL
                            stateObjectJSON:(NSString*)stateObject {
   std::string outURL;
-  base::EscapeJSONString(url.spec(), true, &outURL);
+  base::EscapeJSONString(URL.spec(), true, &outURL);
   return
       [NSString stringWithFormat:@"__gCrWeb.replaceWebViewURL(%@, %@);",
                                  base::SysUTF8ToNSString(outURL), stateObject];
 }
 
-- (void)finishPushStateNavigationToURL:(const GURL&)url
-                       withStateObject:(NSString*)stateObject {
+- (void)setPushedOrReplacedURL:(const GURL&)URL
+                   stateObject:(NSString*)stateObject {
   // TODO(stuartmorgan): Make CRWSessionController manage this internally (or
   // remove it; it's not clear this matches other platforms' behavior).
   _webStateImpl->GetNavigationManagerImpl().OnNavigationItemCommitted();
 
   NSString* replaceWebViewUrlJS =
-      [self javascriptToReplaceWebViewURL:url stateObjectJSON:stateObject];
+      [self javascriptToReplaceWebViewURL:URL stateObjectJSON:stateObject];
   std::string outState;
   base::EscapeJSONString(base::SysNSStringToUTF8(stateObject), true, &outState);
   NSString* popstateJS =
       [NSString stringWithFormat:@"__gCrWeb.dispatchPopstateEvent(%@);",
                                  base::SysUTF8ToNSString(outState)];
   NSString* combinedJS =
       [NSString stringWithFormat:@"%@%@", replaceWebViewUrlJS, popstateJS];
-  GURL urlCopy(url);
+  GURL urlCopy(URL);
   base::WeakNSObject<CRWWebController> weakSelf(self);
   [self evaluateJavaScript:combinedJS
        stringResultHandler:^(NSString*, NSError*) {
          if (!weakSelf || weakSelf.get()->_isBeingDestroyed)
            return;
          base::scoped_nsobject<CRWWebController> strongSelf([weakSelf retain]);
          strongSelf.get()->_URLOnStartLoading = urlCopy;
          strongSelf.get()->_lastRegisteredRequestURL = urlCopy;
        }];
 }
@@ skipping 465 matching lines @@
   [self restoreStateFromHistory];
   _webStateImpl->OnPageLoaded(currentURL, loadSuccess);
   _webStateImpl->SetIsLoading(false);
   // Inform the embedder the load completed.
   [_delegate webDidFinishWithURL:currentURL loadSuccess:loadSuccess];
 }
 
 - (void)finishHistoryNavigationFromEntry:(CRWSessionEntry*)fromEntry {
   [_delegate webWillFinishHistoryNavigationFromEntry:fromEntry];
 
-  // Check if toEntry was created by a JavaScript window.history.pushState()
-  // call from fromEntry. If it was, don't load the URL. Instead update
-  // UIWebView's URL and dispatch a popstate event.
-  if ([_webStateImpl->GetNavigationManagerImpl().GetSessionController()
+  // If the current entry has a serialized state object, inject its state into
+  // the web view.
+  web::NavigationItemImpl* currentItem =
+      self.currentSessionEntry.navigationItemImpl;
+  NSString* state = currentItem->GetSerializedStateObject();
+  if (state.length)
+    [self setPushedOrReplacedURL:currentItem->GetURL() stateObject:state];
+  // Only load the new URL if the current entry was not created by a JavaScript
+  // window.history.pushState() call from |fromEntry|.
+  if (![_webStateImpl->GetNavigationManagerImpl().GetSessionController()
           isPushStateNavigationBetweenEntry:fromEntry
                                    andEntry:self.currentSessionEntry]) {
-    NSString* state = [self currentSessionEntry]
-                          .navigationItemImpl->GetSerializedStateObject();
-    [self finishPushStateNavigationToURL:[self currentNavigationURL]
-                         withStateObject:state];
-  } else {
     web::NavigationItem* currentItem =
         _webStateImpl->GetNavigationManagerImpl().GetVisibleItem();
     GURL endURL = [self URLForHistoryNavigationFromItem:fromEntry.navigationItem
                                                  toItem:currentItem];
     ui::PageTransition transition = ui::PageTransitionFromInt(
         ui::PAGE_TRANSITION_RELOAD | ui::PAGE_TRANSITION_FORWARD_BACK);
 
     web::WebLoadParams params(endURL);
     if (currentItem) {
       params.referrer = currentItem->GetReferrer();
@@ skipping 2013 matching lines @@
   if (!_externalRequest || !_externalRequest->window_name)
     return @"";
   return _externalRequest->window_name;
 }
 
 - (void)resetExternalRequest {
   _externalRequest.reset();
 }
 
 @end