Fix incorrect iframe loading during back/forward navigation.

Source/core/loader/NavigationScheduler.cpp

 /*
  * Copyright (C) 2006, 2007, 2008, 2009, 2010 Apple Inc. All rights reserved.
  * Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)
  * Copyright (C) 2008, 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
  * Copyright (C) 2009 Adam Barth. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  *
@@ skipping 355 matching lines @@
     RefPtr<LocalFrame> protect(m_frame);
 
     OwnPtr<ScheduledNavigation> redirect(m_redirect.release());
     redirect->fire(m_frame);
     InspectorInstrumentation::frameClearedScheduledNavigation(m_frame);
 }
 
 void NavigationScheduler::schedule(PassOwnPtr<ScheduledNavigation> redirect)
 {
     ASSERT(m_frame->page());
+
+    // In a back/forward navigation, we sometimes restore history state to iframes, even though the state was generated
+    // dynamically and JS will try to put something different in the iframe. In this case, we will load stale things
+    // and/or confuse the JS when it shortly thereafter tries to schedule a location change. Let the JS have its way.
+    // FIXME: This check seems out of place.
+    if (!m_frame->loader().stateMachine()->committedFirstRealDocumentLoad() && m_frame->loader().provisionalDocumentLoader()) {
+        RefPtr<Frame> protect(m_frame);
+        m_frame->loader().provisionalDocumentLoader()->stopLoading();
+        if (!m_frame->host())
+            return;
+    }
+
     cancel();
     m_redirect = redirect;
     startTimer();
 }
 
 void NavigationScheduler::startTimer()
 {
     if (!m_redirect)
         return;
 
     ASSERT(m_frame->page());
     if (m_timer.isActive())
         return;
     if (!m_redirect->shouldStartTimer(m_frame))
         return;
 
     m_timer.startOneShot(m_redirect->delay(), FROM_HERE);
     InspectorInstrumentation::frameScheduledNavigation(m_frame, m_redirect->delay());
 }
 
 void NavigationScheduler::cancel()
 {
     if (m_timer.isActive())
         InspectorInstrumentation::frameClearedScheduledNavigation(m_frame);
     m_timer.stop();
     m_redirect.clear();
 }
 
 } // namespace WebCore