Fix History.{push,replace}State handling of null 'url' argument

Source/core/page/History.cpp

Index: Source/core/page/History.cpp
diff --git a/Source/core/page/History.cpp b/Source/core/page/History.cpp
index 3b6fd1e54fb045abf52ebcb424bf96c46eb36656..7e16ff4293fa0e720a56b6519124615430629fe9 100644
--- a/Source/core/page/History.cpp
+++ b/Source/core/page/History.cpp
@@ -132,11 +132,14 @@ void History::go(ScriptExecutionContext* context, int distance)
 
 KURL History::urlForState(const String& urlString)
 {
-    KURL baseURL = m_frame->document()->baseURL();
+    Document* document = m_frame->document();
+
+    if (urlString.isNull())
+        return document->url();
     if (urlString.isEmpty())
-        return baseURL;
+        return document->baseURL();
 
-    return KURL(baseURL, urlString);
+    return KURL(document->baseURL(), urlString);
 }
 
 void History::stateObjectAdded(PassRefPtr<SerializedScriptValue> data, const String& /* title */, const String& urlString, SameDocumentNavigationSource sameDocumentNavigationSource, ExceptionState& es)