fix($brower): set the url even if the browser transforms it

src/ng/browser.js

@@ -153,7 +153,7 @@ function Browser(window, document, $log, $sniffer) {
         // Do the assignment again so that those two variables are referentially identical.
         lastHistoryState = cachedState;
       } else {
-        if (!sameBase || pendingLocation) {
+        if (!sameBase) {
           pendingLocation = url;
         }
         if (replace) {
@@ -167,6 +167,9 @@ function Browser(window, document, $log, $sniffer) {
           pendingLocation = url;
         }
       }
+      if (pendingLocation) {
+        pendingLocation = url;
+      }
       return self;
     // getter
     } else {

test/ng/browserSpecs.js

@@ -92,6 +92,7 @@ function MockWindow(options) {
     },
     replaceState: function(state, title, url) {
       locationHref = url;
+      if (!options.updateAsync) committedHref = locationHref;
       mockWindow.history.state = copy(state);
     }
   };
@@ -443,6 +444,38 @@ describe('browser', function() {
 
   });
 
+  // #14427
+  it('url() should actually set the url, even if IE 11 is weird and replaces HTML entities in the URL', function() {
+    // this test can not be expressed with the Jasmine spies in the previous describe block, because $browser.url()
+    // needs to observe the change to location.href during its invocation to enter the failing code path, but the spies
+    // are not callThrough
+
+    sniffer.history = true;
+    var originalReplace = fakeWindow.location.replace;
+    fakeWindow.location.replace = function(url) {
+      url = url.replace('&not', '¬');
+      // I really don't know why IE 11 (sometimes) does this, but I am not the only one to notice:
+      // https://connect.microsoft.com/IE/feedback/details/1040980/bug-in-ie-which-interprets-document-location-href-as-html
+      originalReplace.call(this, url);
+    };
+
+    // the initial URL contains a lengthy oauth token in the hash
+    var initialUrl = 'http://test.com/oauthcallback#state=xxx%3D&not-before-policy=0';
+    fakeWindow.location.href = initialUrl;
+    browser = new Browser(fakeWindow, fakeDocument, fakeLog, sniffer);
+
+    // somehow, $location gets a version of this url where the = is no longer escaped, and tells the browser:
+    var initialUrlFixedByLocation = initialUrl.replace('%3D', '=');
+    browser.url(initialUrlFixedByLocation, true, null);
+    expect(browser.url()).toEqual(initialUrlFixedByLocation);
+
+    // a little later (but in the same digest cycle) the view asks $location to change the route, which tells $browser
+    var secondUrl = 'http://test.com/otherView';
+    browser.url(secondUrl, true, null);
+    expect(browser.url()).toEqual(secondUrl);
+  });
+
+
   describe('url (when state passed)', function() {
     var currentHref, pushState, replaceState, locationReplace;