UserAgent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Ubuntu Chromium/56.0.2924.76 Chrome/56.0.2924.76 Safari/537.36

Steps to reproduce the problem:
1. Use `history.pushState` to change the current document's URL
2. From a ServiceWorker, retrieve a Client instance representing the client
   used to complete step 1
3. Inspect the `url` property of the Client instance

What is the expected behavior?
The value should be the client's original URL

What went wrong?
The value is the modified URL

Did this work before? N/A 

Does this work in other browsers? Yes

Chrome version: 58.0.3029.19  Channel: dev
OS Version: 
Flash Version: 

The `url` property of each `Client` instance should describe the "creation URL"
[1] of that environment, which is not susceptible to modification through, e.g.
the `history.pushState` API [2]. A test in Web Platform Tests verifies this,
but it is currently disabled (previously reported simply as a "test timeout")
[4].

[1] https://w3c.github.io/ServiceWorker/#client-url

> ## 4.2.1. url
>
> The url attribute must return the context object’s associated service worker
> client's serialized creation URL.

[2] https://html.spec.whatwg.org/multipage/webappapis.html#concept-environment-creation-url

> ## A creation URL
>
> An absolute URL that represents the location of the resource with which the
> environment is associated.
>
> Note: In the case of an environment settings object, this URL might be
> distinct from the environment settings object's responsible document's URL,
> due to mechanisms such as history.pushState().

[3] https://github.com/w3c/web-platform-tests/blob/8bb0b769af8d7a6d245db31c0b6029eb3b7da861/service-workers/service-worker/resources/clients-matchall-client-types-iframe.html#L3-L7
[4] https://chromium.googlesource.com/chromium/src.git/+/92c1a4cf87397d9a63c6e1bc0bb6ecc141a0979c/third_party/WebKit/LayoutTests/TestExpectations#2322