Allow 'history.pushState' to modify query string for unique and file origins.

third_party/WebKit/LayoutTests/http/tests/navigation/pushstate-whitelisted-at-unique-origin-denied.php

 <?php
 header("Content-Security-Policy: sandbox allow-scripts");
 ?>
 <script src="../resources/testharness.js"></script>
 <script src="../resources/testharnessreport.js"></script>
 <script>
+var orginURL = document.URL;
 test(function () {
     testRunner.addOriginAccessWhitelistEntry(location.origin, location.protocol, '', false);
 }, 'testRunner.addOriginAccessWhitelistEntry is required for this test');
 
 test(function () {
     assert_throws('SecurityError', function () {
-        history.pushState(null, null, document.URL + "/path");
+        history.pushState(null, null, orginURL + "/path");
     });
 }, 'pushState at unique origin should fail with SecurityError (even with whitelisted origins)');
 
 test(function () {
     try {
-        history.pushState(null, null, document.URL + "#hash");
+        history.pushState(null, null, orginURL + "#hash");
         done();
     } catch (e) {
-        assert_unreached("pushState to a new hash should not fail.");
+        assert_unreached("pushState #hash should not fail.");
     }
-}, 'pushState to new hash in unique origin should not fail with SecurityError');
+}, 'pushState #hash in unique origin should not fail with SecurityError');
+test(function () {
+    try {
+        history.pushState(null, null, orginURL + "?hash");
+        done();
+    } catch (e) {
+        assert_unreached("pushState ?hash should not fail.");
+    }
+}, 'pushState ?hash in unique origin should not fail with SecurityError');

[Mike West, 2016/06/16 09:23:13]

Nit: Newlines, as above.

[Peng Xinchao, 2016/06/17 11:09:52]

Done.

+test(function () {
+    try {
+        history.pushState(null, null, orginURL + "?hash#base");
+        done();
+    } catch (e) {
+        assert_unreached("pushState ?hash#base should not fail.");
+    }
+}, 'pushState ?hash#base in unique origin should not fail with SecurityError');
 </script>