UserAgent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:61.0) Gecko/20100101 Firefox/61.0

Steps to reproduce the problem:
1 - Load index.html
2 - Open the console
3 - Push the button

What is the expected behavior?
The console should log the original page URL (creation URL - https://html.spec.whatwg.org/multipage/webappapis.html#concept-environment-creation-url)

What went wrong?
The console logs the updated (by history.replaceState) URL

Did this work before? No 

Does this work in other browsers? Yes

Chrome version: 67.0.3396.99  Channel: n/a
OS Version: 
Flash Version: 

The specification defines Client#url as "the context object’s associated service worker client's serialized creation URL."
https://w3c.github.io/ServiceWorker/#client-url
https://html.spec.whatwg.org/multipage/webappapis.html#concept-environment-creation-url

Chrome looks like is incorrectly returning the document URL value instead (which is the one history.replaceState changes).

On Firefox this works correctly, as per spec.
 

Deleted: index.html 743 bytes

index.html 743 bytes View Download

Deleted: worker.js 68 bytes

worker.js 68 bytes View Download