Add DidSaveScrollOrScaleState flag to prevent restoreScrollPositionAndViewState restore from default

third_party/WebKit/Source/core/loader/FrameLoader.cpp

 /*
  * Copyright (C) 2006, 2007, 2008, 2009, 2010, 2011 Apple Inc. All rights
  * reserved.
  * Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)
  * Copyright (C) 2008, 2009 Torch Mobile Inc. All rights reserved.
  * (http://www.torchmobile.com/)
  * Copyright (C) 2008 Alp Toker <alp@atoker.com>
  * Copyright (C) Research In Motion Limited 2009. All rights reserved.
  * Copyright (C) 2011 Kris Jordan <krisjordan@gmail.com>
  * Copyright (C) 2011 Google Inc. All rights reserved.
@@ skipping 616 matching lines @@
   if (client()) {
     ScriptForbiddenScope forbidScripts;
     client()->dispatchDidFinishDocumentLoad();
   }
 
   if (client()) {
     client()->runScriptsAtDocumentReady(
         m_documentLoader ? m_documentLoader->isCommittedButEmpty() : true);
   }
 
+  // RestoreScrollPositionAndViewState maybe called in checkCompleted. We need
+  // to ensure processFragment called before restoreScrollPositionAndViewState.
+  processFragment(m_frame->document()->url(), NavigationToDifferentDocument);
   checkCompleted();
 
   if (!m_frame->view())
     return;
 
   // Check if the scrollbars are really needed for the content. If not, remove
   // them, relayout, and repaint.
   m_frame->view()->restoreScrollbar();
   processFragment(m_frame->document()->url(), NavigationToDifferentDocument);

[chaopeng, 2017/01/12 19:56:02]

We need to keep the processFragment here (after the
m_frame->document()->implicitClose() in checkCompleted) otherwise SVG may render
to wrong position.

 }
 
 static bool allDescendantsAreComplete(Frame* frame) {
   for (Frame* child = frame->tree().firstChild(); child;
        child = child->tree().traverseNext(frame)) {
     if (child->isLoading())
       return false;
   }
   return true;
 }
@@ skipping 1250 matching lines @@
                          m_documentLoader ? m_documentLoader->url() : String());
   return tracedValue;
 }
 
 inline void FrameLoader::takeObjectSnapshot() const {
   TRACE_EVENT_OBJECT_SNAPSHOT_WITH_ID("loading", "FrameLoader", this,
                                       toTracedValue());
 }
 
 }  // namespace blink