Immediately SetTitle on a new NavigationEntry created via history.pushState

content/browser/frame_host/navigation_controller_impl.cc

Index: content/browser/frame_host/navigation_controller_impl.cc
diff --git a/content/browser/frame_host/navigation_controller_impl.cc b/content/browser/frame_host/navigation_controller_impl.cc
index 54691513c4e6440fbb327cd921af88d3d5f09d5f..463d186bc263b0cf643653a20d7eccae541ffbe5 100644
--- a/content/browser/frame_host/navigation_controller_impl.cc
+++ b/content/browser/frame_host/navigation_controller_impl.cc
@@ -1057,6 +1057,12 @@ void NavigationControllerImpl::RendererDidNavigateToNewPage(
   new_entry->SetOriginalRequestURL(params.original_request_url);
   new_entry->SetIsOverridingUserAgent(params.is_overriding_user_agent);
 
+  // history.pushState() is classified as a navigation to a new page, but
+  // sets was_within_same_page to true. In this case, we already have the
+  // title available, so set it immediately.
+  if (params.was_within_same_page)
+    new_entry->SetTitle(GetLastCommittedEntry()->GetTitle());
+
   DCHECK(!params.history_list_was_cleared || !replace_entry);
   // The browser requested to clear the session history when it initiated the
   // navigation. Now we know that the renderer has updated its state accordingly