Allow 'history.pushState' to modify query string for unique and file origins.

third_party/WebKit/Source/core/frame/History.cpp

Index: third_party/WebKit/Source/core/frame/History.cpp
diff --git a/third_party/WebKit/Source/core/frame/History.cpp b/third_party/WebKit/Source/core/frame/History.cpp
index 393394fd90761c0421b21ac3a049088aa8b50c83..dc7802484a843656537fca413322ffe118fa1904 100644
--- a/third_party/WebKit/Source/core/frame/History.cpp
+++ b/third_party/WebKit/Source/core/frame/History.cpp
@@ -59,6 +59,23 @@ bool equalIgnoringPathQueryAndFragment(const KURL& a, const KURL& b)
     return true;
 }
 
+bool equalIgnoringQueryAndFragment(const KURL& a, const KURL& b)
+{
+    int aLength = a.pathEnd();
+    int bLength = b.pathEnd();
+
+    if (aLength != bLength)
+        return false;
+
+    const String& aString = a.getString();
+    const String& bString = b.getString();
+    for (int i = 0; i < aLength; ++i) {
+        if (aString[i] != bString[i])
+            return false;
+    }
+    return true;
+}
+
 }  // namespace
 
 History::History(LocalFrame* frame)
@@ -196,7 +213,7 @@ bool History::canChangeToUrl(const KURL& url, SecurityOrigin* documentOrigin, co
     // 'pushState'/'replaceState' to modify the URL fragment: see
     // https://crbug.com/528681 for the compatibility concerns.
     if (documentOrigin->isUnique() || documentOrigin->isLocal())
-        return equalIgnoringFragmentIdentifier(url, documentURL);
+        return equalIgnoringQueryAndFragment(url, documentURL);
 
     if (!equalIgnoringPathQueryAndFragment(url, documentURL))
         return false;