Check for equality of the URL's origin in replaceState/pushState

third_party/WebKit/LayoutTests/http/tests/navigation/pushstate-whitelisted-denied.html

Index: third_party/WebKit/LayoutTests/http/tests/navigation/pushstate-whitelisted-denied.html
diff --git a/third_party/WebKit/LayoutTests/http/tests/navigation/pushstate-whitelisted-denied.html b/third_party/WebKit/LayoutTests/http/tests/navigation/pushstate-whitelisted-denied.html
new file mode 100644
index 0000000000000000000000000000000000000000..ad2f707b46960b68d03d47d0bfbb44c250110873
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/http/tests/navigation/pushstate-whitelisted-denied.html
@@ -0,0 +1,18 @@
+<script src="../resources/testharness.js"></script>
+<script src="../resources/testharnessreport.js"></script>
+<script>
+test(function () {
+    testRunner.addOriginAccessWhitelistEntry(location.origin, location.protocol, '', false);
+}, 'testRunner.addOriginAccessWhitelistEntry is required for this test');
+
+test(function () {
+    // http://username@password:localhost:8000/... should be blocked.
+    var otherOrigin = new URL(document.URL);
+    otherOrigin.port = otherOrigin.port ? otherOrigin.port ^ 0xFFFF : 1337;
+    otherOrigin = otherOrigin.href;
+
+    assert_throws('SecurityError', function () {
+        history.pushState(null, null, otherOrigin);
+    });
+}, 'pushState to origin with different port should fail with SecurityError (even with whitelisted origins)');
+</script>