Disallow WKBackForwardListItem navigations for pushState pages.

ios/web/web_state/ui/crw_web_controller.mm

 // Copyright 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #import "ios/web/web_state/ui/crw_web_controller.h"
 
 #import <WebKit/WebKit.h>
 
 #import <objc/runtime.h>
 #include <stddef.h>
@@ skipping 1835 matching lines @@
   DCHECK(holder);
   return holder;
 }
 
 - (void)updateCurrentBackForwardListItemHolder {
   // WebUI pages (which are loaded via loadHTMLString:baseURL:) have no entry
   // in the back/forward list, so the current item will still be the previous
   // page, and should not be associated.
   if (_webUIManager)
     return;
+  // The WKWebViewConfiguration's |userScripts| are not injected when navigating
+  // via BFLI to a page created using window.history.pushState.  This means that
+  // calling window.history navigation functions will invoke WKWebView's
+  // non-overridden implementations, causing a mismatch between the
+  // WKBackForwardList and NavigationManager.
+  web::NavigationItemImpl* currentItem =
+      [self currentSessionEntry].navigationItemImpl;
+  if (currentItem->IsCreatedFromPushState())
+    return;
 
   web::WKBackForwardListItemHolder* holder =
       [self currentBackForwardListItemHolder];
 
   WKNavigationType navigationType =
       _pendingNavigationInfo ? [_pendingNavigationInfo navigationType]
                              : WKNavigationTypeOther;
   holder->set_back_forward_list_item([_webView backForwardList].currentItem);
   holder->set_navigation_type(navigationType);
   holder->set_http_method([_pendingNavigationInfo HTTPMethod]);
@@ skipping 3764 matching lines @@
   }
 
   return web::WEB_VIEW_DOCUMENT_TYPE_GENERIC;
 }
 
 - (NSString*)refererFromNavigationAction:(WKNavigationAction*)action {
   return [action.request valueForHTTPHeaderField:@"Referer"];
 }
 
 @end