document.open(): Align history/URL behavior with spec

This change aligns document.open() with the current HTML Standard, which
mandates that in addition to setting the document's URL to the last-entered
document's, the document's current history item's URL must also be updated à la
history.replaceState().

To accomplish that, this CL reuses the logic in History::StateObjectAdded(),
including the throttling behavior, for Document::open() as well. The update
steps are run unconditionally, no matter what the document's current URL is, in
order to have consistent behavior for other things in the history entry like
POST form data, which document.open() now erases.

This also means that document.open() now also counts as a navigation, just like
history.replaceState(). Several browsertests are updated as such.

In this CL, we also enables some WPTs that were previously disabled; in
particular, reload.window.html has been enabled to converge to WebKit's
behavior.

Bug: 68833, 866274
Change-Id: Iea6d665fd97bcaee44bcfaa45f8e92c356003d8a

html/webappapis/dynamic-markup-insertion/opening-the-input-stream/url.window.js

@@ -13,22 +13,23 @@ async_test(t => {
   const frameURL = new URL("resources/page-with-frame.html", document.URL).href;
   const frame = document.body.appendChild(document.createElement("iframe"));
   t.add_cleanup(() => frame.remove());
+
+  // We do not test for win.location.href in this test due to
+  // https://github.com/whatwg/html/issues/3959.
+
   frame.onload = t.step_func(() => {
     assert_equals(frame.contentDocument.URL, frameURL);
-    assert_equals(frame.contentWindow.location.href, frameURL);
     const childFrame = frame.contentDocument.querySelector("iframe");
     const childDoc = childFrame.contentDocument;
     const childWin = childFrame.contentWindow;
     assert_equals(childDoc.URL, blankURL);
-    assert_equals(childWin.location.href, blankURL);
 
     // Right now childDoc is still fully active.
 
     frame.onload = t.step_func_done(() => {
       // Now childDoc is still active but no longer fully active.
       assert_equals(childDoc.open(), childDoc);
       assert_equals(childDoc.URL, blankURL);
-      assert_equals(childWin.location.href, blankURL);
     });
     frame.src = "/common/blank.html";
   });