Keep original pushState() method for use in JS overwrite

ios/web/web_state/js/resources/core.js

Index: ios/web/web_state/js/resources/core.js
diff --git a/ios/web/web_state/js/resources/core.js b/ios/web/web_state/js/resources/core.js
index 4e68df0bea8cf909d1235a8fbf3ede537da6f463..a323f56125a5688430190b0cb952d83c254e51a1 100644
--- a/ios/web/web_state/js/resources/core.js
+++ b/ios/web/web_state/js/resources/core.js
@@ -375,9 +375,10 @@ goog.require('__crWeb.message');
     }, 0);
   };
 
-  // Keep the original replaceState() method. It's needed to update UIWebView's
-  // URL and window.history.state property during history navigations that don't
-  // cause a page load.
+  // Keep the original pushState() and replaceState() methods. It's needed to
+  // update the web view's URL and window.history.state property during history
+  // navigations that don't cause a page load.
+  var originalWindowHistoryPushState = window.history.pushState;
   var originalWindowHistoryReplaceState = window.history.replaceState;
   __gCrWeb['replaceWebViewURL'] = function(url, stateObject) {
     originalWindowHistoryReplaceState.call(history, stateObject, '', url);
@@ -401,7 +402,7 @@ goog.require('__crWeb.message');
         typeof(stateObject) == 'undefined' ? '' :
             __gCrWeb.common.JSONStringify(stateObject);
     pageUrl = pageUrl || window.location.href;
-    originalWindowHistoryReplaceState.call(history, stateObject, '', pageUrl);
+    originalWindowHistoryPushState.call(history, stateObject, '', pageUrl);

[Eugene But (OOO till 7-30), 2016/01/04 20:52:30]

I think you want to pass pageTitle as well, otherwise WKWebView's title may be
incorrect. Same is probably true for |replaceState|.

[Jackie Quinn, 2016/01/04 21:16:58]

Done.

     invokeOnHost_({'command': 'window.history.didPushState',
                    'stateObject': serializedState,
                    'baseUrl': document.baseURI,