Clear hash when setting URL in document.open

third_party/WebKit/Source/core/dom/Document.cpp

Index: third_party/WebKit/Source/core/dom/Document.cpp
diff --git a/third_party/WebKit/Source/core/dom/Document.cpp b/third_party/WebKit/Source/core/dom/Document.cpp
index a3642619f5eee819a093f00845bf188effd22243..fb7aae58bf9133a4cbcee0bd87f75a9a0359f1b1 100644
--- a/third_party/WebKit/Source/core/dom/Document.cpp
+++ b/third_party/WebKit/Source/core/dom/Document.cpp
@@ -2727,7 +2727,15 @@ void Document::open(Document* entered_document,
       return;
     }
     SetSecurityOrigin(entered_document->GetSecurityOrigin());
-    SetURL(entered_document->Url());
+
+    if (this != entered_document) {
+      // Clear the hash fragment from the inherited URL to prevent a
+      // scroll-into-view for any document.open()'d frame.
+      KURL new_url = entered_document->Url();
+      new_url.SetFragmentIdentifier(String());
+      SetURL(new_url);
+    }
+
     cookie_url_ = entered_document->CookieURL();
   }