Expected behavior:
Browser navigates to Page2 

Tested the issue in Android and able to reproduce the issue. 

Steps Followed:
1.) Loaded https://www.r0b.in/test/page1.htm
2.) Clicked next
3.) Clicked next
4.) Clicked test -- Browser navigated to Page1 

Chrome versions tested:
60.0.3072.0, 68.0.3440.87 (stable) , 70.0.3511.0(Latest canary)

OS:
Android 9.0.0

Android Devices:
Pixel 2 

Issue is seen in from older builds[M-60]. Hence considering this as Non-regression and marking as Untriaged for further inputs from dev team.

Please navigate to below link for log's  --
go/chrome-androidlogs/869710

Thanks!

Clank frontend triage: Nate, can you find an owner or bump down to P3?

clamy, I'm guessing this is a content/ bug, given that blink doesn't know what to do with a back/forward navigation besides give a number of steps to go back/forward. Do you have suggestions on who should own it?

(copy-pasted the wrong email from the cc: line, actually assigning to clamy this time) :)

It seems arthursonzogni@ found the root cause behind this bug while investigating  issue 879965 . Assigning to arthursonzogni.

;-) I don't think I've found the root cause if this, but yes, I will have to take a look at this one too.

I have a pending CL causing this issue not to reproduce anymore, but it is not for a good reason: other bugs, put end to end, causes the second history.back() to be canceled.

I understand the issue.
When doing a renderer initiated backforward navigation, it is relative to: GetCurrentEntryIndex().
The issue is that GetCurrentEntryIndex() doesn't return the current index.

-----------
int NavigationControllerImpl::GetCurrentEntryIndex() const {
  if (transient_entry_index_ != -1)
    return transient_entry_index_;
  if (pending_entry_index_ != -1)         <-.
    return pending_entry_index_;          <--`--- Why are we doing this?
  return last_committed_entry_index_;
}
-----------

The second navigation cancels the first one, but since the first one updated pending_entry_index_, it will occurs at -2 instead of -1.

I think it is done so that when the user click twice one the back button, it goes back twice.
But for renderer initiated navigation, it should go back only once. Maybe I can just use a different function and that's it.

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/44f585c8931835707e5a7f70c9871880f746e7d8

commit 44f585c8931835707e5a7f70c9871880f746e7d8
Author: Arthur Sonzogni <arthursonzogni@chromium.org>
Date: Mon Sep 24 16:05:17 2018

Add regression tests: history.back() called twice.

history.back() called twice causes the browser to navigate back twice.
This is wrong. It should navigate back only once. This CL adds
regression tests.

The specification says the following:
---
If there is an ongoing attempt to navigate specified browsing context
that has not yet matured (i.e. it has not passed the point of making its
Document the active document), then cancel that attempt to navigate the
browsing context.
---

Specification:
https://html.spec.whatwg.org/multipage/history.html#traverse-the-history-by-a-delta

Bug: 869710
Change-Id: I1534c7a04dbd220920970576baad02cedfaf6a12
Reviewed-on: https://chromium-review.googlesource.com/1215803
Commit-Queue: Arthur Sonzogni <arthursonzogni@chromium.org>
Reviewed-by: Camille Lamy <clamy@chromium.org>
Reviewed-by: Charlie Reis <creis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#593553}
[modify] https://crrev.com/44f585c8931835707e5a7f70c9871880f746e7d8/content/browser/frame_host/navigation_controller_impl_browsertest.cc

I added a test for this bug in #13
I am not going to work on a fix immediately.

To fix this issue, I guess content-initiated history navigation need to be relative to |last_committed_entry_index_| instead of what GetCurrentEntryIndex() returns.