Allow 'history.pushState' to modify query string for unique and file origins.

third_party/WebKit/Source/core/frame/History.cpp

Index: third_party/WebKit/Source/core/frame/History.cpp
diff --git a/third_party/WebKit/Source/core/frame/History.cpp b/third_party/WebKit/Source/core/frame/History.cpp
index 393394fd90761c0421b21ac3a049088aa8b50c83..b3a2f46f56f28b08987e6cf74b749190fd0233a7 100644
--- a/third_party/WebKit/Source/core/frame/History.cpp
+++ b/third_party/WebKit/Source/core/frame/History.cpp
@@ -59,6 +59,32 @@ bool equalIgnoringPathQueryAndFragment(const KURL& a, const KURL& b)
     return true;
 }
 
+bool equalIgnoringQueryAndFragment(const KURL& a, const KURL& b)
+{
+    int aLength = a.getString().length();
+    if (a.parsed().ref.len >= 0)
+        aLength = a.parsed().ref.begin - 1;
+    if (a.parsed().query.len >= 0 && a.parsed().query.begin <= aLength)
+        aLength = a.parsed().query.begin - 1;
+
+    int bLength = b.getString().length();
+    if (b.parsed().ref.len >= 0)
+        bLength = b.parsed().ref.begin - 1;
+    if (b.parsed().query.len >= 0 && b.parsed().query.begin <= bLength)
+        bLength = b.parsed().query.begin - 1;
+
+    if (aLength != bLength)
+        return false;
+
+    const String& aString = a.getString();
+    const String& bString = b.getString();
+    for (int i = 0; i < aLength; ++i) {
+        if (aString[i] != bString[i])
+            return false;
+    }
+    return true;
+}

[Mike West, 2016/06/14 08:44:59]

You can write this more simply by copy/pasting
`equalIgnoringPathQueryAndFragment`'s body, then replacing `pathStart` with
`pathEnd`. :)

+
 }  // namespace
 
 History::History(LocalFrame* frame)
@@ -196,7 +222,7 @@ bool History::canChangeToUrl(const KURL& url, SecurityOrigin* documentOrigin, co
     // 'pushState'/'replaceState' to modify the URL fragment: see
     // https://crbug.com/528681 for the compatibility concerns.
     if (documentOrigin->isUnique() || documentOrigin->isLocal())
-        return equalIgnoringFragmentIdentifier(url, documentURL);
+        return equalIgnoringQueryAndFragment(url, documentURL);
 
     if (!equalIgnoringPathQueryAndFragment(url, documentURL))
         return false;