Keep original pushState() method for use in JS overwrite

Keep original pushState() method for use in JS overwrite of
window.history.pushState. Previously, the original replaceState was
used because back/forward navigation was performed wholly by the native
history stack. Using the original pushState keeps WKWebView's
back forward list in sync with the native stack.

BUG=564633

Review URL: https://codereview.chromium.org/1541023002

Cr-Commit-Position: refs/heads/master@{#367378}

ios/web/web_state/js/resources/core.js

@@ -375,9 +375,10 @@ goog.require('__crWeb.message');
     }, 0);
   };
 
-  // Keep the original replaceState() method. It's needed to update UIWebView's
+  // Keep the original pushState() and replaceState() methods. It's needed to
-  // URL and window.history.state property during history navigations that don't
+  // update the web view's URL and window.history.state property during history
-  // cause a page load.
+  // navigations that don't cause a page load.
+  var originalWindowHistoryPushState = window.history.pushState;
   var originalWindowHistoryReplaceState = window.history.replaceState;
   __gCrWeb['replaceWebViewURL'] = function(url, stateObject) {
     originalWindowHistoryReplaceState.call(history, stateObject, '', url);
@@ -401,7 +402,8 @@ goog.require('__crWeb.message');
         typeof(stateObject) == 'undefined' ? '' :
             __gCrWeb.common.JSONStringify(stateObject);
     pageUrl = pageUrl || window.location.href;
-    originalWindowHistoryReplaceState.call(history, stateObject, '', pageUrl);
+    originalWindowHistoryPushState.call(history, stateObject,
+                                        pageTitle, pageUrl);
     invokeOnHost_({'command': 'window.history.didPushState',
                    'stateObject': serializedState,
                    'baseUrl': document.baseURI,
@@ -416,7 +418,8 @@ goog.require('__crWeb.message');
         typeof(stateObject) == 'undefined' ? '' :
             __gCrWeb.common.JSONStringify(stateObject);
     pageUrl = pageUrl || window.location.href;
-    originalWindowHistoryReplaceState.call(history, stateObject, '', pageUrl);
+    originalWindowHistoryReplaceState.call(history, stateObject,
+                                           pageTitle, pageUrl);
     invokeOnHost_({'command': 'window.history.didReplaceState',
                    'stateObject': serializedState,
                    'baseUrl': document.baseURI,