Do not rewrite about urls to chrome:// for cetain renderer-initated loads

ios/web/web_state/ui/crw_web_controller.mm

 // Copyright 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #import "ios/web/web_state/ui/crw_web_controller.h"
 
 #import <WebKit/WebKit.h>
 
 #import <objc/runtime.h>
 #include <stddef.h>
@@ skipping 1248 matching lines @@
 - (BOOL)atTop {
   if (!_webView)
     return YES;
   UIScrollView* scrollView = self.webScrollView;
   return scrollView.contentOffset.y == -scrollView.contentInset.top;
 }
 
 - (GURL)currentURLWithTrustLevel:(web::URLVerificationTrustLevel*)trustLevel {
   DCHECK(trustLevel) << "Verification of the trustLevel state is mandatory";
   if (_webView) {
-    GURL url([self webURLWithTrustLevel:trustLevel]);
-    // Web views treat all about: URLs as the same origin, which makes it
-    // possible for pages to document.write into about:<foo> pages, where <foo>
-    // can be something misleading. Report any about: URL as about:blank to
-    // prevent that. See crbug.com/326118
-    if (url.scheme() == url::kAboutScheme)
-      return GURL(url::kAboutBlankURL);
-    return url;
+    return [self webURLWithTrustLevel:trustLevel];
   }
   // Any non-web URL source is trusted.
   *trustLevel = web::URLVerificationTrustLevel::kAbsolute;
   if (self.nativeController) {
     if ([self.nativeController respondsToSelector:@selector(virtualURL)]) {
       return [self.nativeController virtualURL];
     } else {
       return [self.nativeController url];
     }
   }
@@ skipping 847 matching lines @@
 
   _loadPhase = web::PAGE_LOADED;
 
   [self optOutScrollsToTopForSubviews];
 
   DCHECK((currentURL == _lastRegisteredRequestURL) ||  // latest navigation
          // previous navigation
          ![[_navigationStates lastAddedNavigation] isEqual:navigation] ||
          // invalid URL load
          (!_lastRegisteredRequestURL.is_valid() &&
-          _documentURL.spec() == url::kAboutBlankURL))
+          _documentURL.spec() == url::kAboutBlankURL) ||
+         // about URL was changed by WebKit (e.g. about:newtab -> about:blank)
+         (_lastRegisteredRequestURL.scheme() == url::kAboutScheme &&
+          currentURL.spec() == url::kAboutBlankURL))
       << std::endl
       << "currentURL = [" << currentURL << "]" << std::endl
       << "_lastRegisteredRequestURL = [" << _lastRegisteredRequestURL << "]";
 
   // Perform post-load-finished updates.
   [self didFinishWithURL:currentURL loadSuccess:loadSuccess];
 
   // Execute the pending LoadCompleteActions.
   for (ProceduralBlock action in _pendingLoadCompleteActions.get()) {
     action();
@@ skipping 3077 matching lines @@
 - (NSUInteger)observerCount {
   DCHECK_EQ(_observerBridges.size(), [_observers count]);
   return [_observers count];
 }
 
 - (NSString*)referrerFromNavigationAction:(WKNavigationAction*)action {
   return [action.request valueForHTTPHeaderField:kReferrerHeaderName];
 }
 
 @end