Clear hash when setting URL in document.open()

third_party/WebKit/Source/core/dom/Document.cpp

Index: third_party/WebKit/Source/core/dom/Document.cpp
diff --git a/third_party/WebKit/Source/core/dom/Document.cpp b/third_party/WebKit/Source/core/dom/Document.cpp
index 7e13015e997d68e9a2d488863196987939bbfda7..2fcd4f37ae08426c75ea9b5f73e1703ae9c8b42f 100644
--- a/third_party/WebKit/Source/core/dom/Document.cpp
+++ b/third_party/WebKit/Source/core/dom/Document.cpp
@@ -2727,7 +2727,15 @@ void Document::open(Document* entered_document,
       return;
     }
     SetSecurityOrigin(entered_document->GetSecurityOrigin());
-    SetURL(entered_document->Url());
+
+    if (this != entered_document) {
+      // Clear the hash fragment from the inherited URL to prevent a
+      // scroll-into-view for any document.open()'d frame.
+      KURL new_url = entered_document->Url();
+      new_url.SetFragmentIdentifier(String());
+      SetURL(new_url);
+    }
+
     cookie_url_ = entered_document->CookieURL();
   }