The problem is in [CRWWebController -webViewLoadingStateDidChange]. The back/forward navigation from step 9 triggers the following KVO and WKNavigationDelegate callbacks:

- webViewLoadingStateDidChange => webView.loading 1
- webView:didStartProvisionalNavigation
- webView:didCommitProvisionalNavigation
- webViewLoadingStateDidChange => webView.loading 0
- webView:didFinishNavigation

The first |webViewLoadingStateDidChange| call early exits because webView.loading is 1. In the second call, we try to look up the navigation context associated with the pending navigation. However, since the navigation is already committed, |existingContext| is null. Just before this method returns, we call [self didFinishNavigation:nil], which calls [_navigationStates contextForNavigation:nil]. This ends up finding the NavigationContext associated with the back/forward navigation in Step 8. That navigation context was associated with nil in |_navigationStates| because it was a same-document navigation, and it was never cleared from |_navigationStates| because nil entries need to be removed explicitly.

Since the context from step 8 is used in |didFinishNavigation:| call for step 9, and the step 8 context has a restore session URL, we set |_loadingPhase| to web::PAGE_LOADED, but skips the |loadCompleteWithSuccess:| call, which would call webStateImpl->SetIsLoading(false), and causes the loading bar to disappear.

To sum up, there are two bugs here:
1. incorrect context is looked up in step 9, due to ambiguous interface of |didFinishNavigation|
2. |webViewLoadingStateDidChange| does not find the correct navigation context, because the back/forward navigation is already committed (so not returned by [self contextForPendingMainFrameNavigationWithURL}. This affects back/forward navigation that is not cached in WKWebView's page cache.

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/8f2187bd41d8aa8ef5b2027d6beffcb25f48f7ea

commit 8f2187bd41d8aa8ef5b2027d6beffcb25f48f7ea
Author: Danyao Wang <danyao@chromium.org>
Date: Fri Dec 21 20:52:39 2018

[iOS] Switch |didFinishNavigation| to operate on NavigationContext.

This change prevents an edge case where |_navigationStates| contains a
non-null NavigationContext for the key |nil|, which can happen in
same-document back/forward navigation. This NavigationContext is
incorrectly used later when calling [self didFinishNavigation:nil],
when the caller expects there to be no navigation context.

Outside of this pathological case, this refactor is a no-op as it
simply extracted the lookup of NavigationContext from WKNavigation*
from this method to the caller.

Change-Id: If900a7cbed92d68a415ab2be8575f3e866f742ca
Bug:  917162 
Reviewed-on: https://chromium-review.googlesource.com/c/1387951
Commit-Queue: Danyao Wang <danyao@chromium.org>
Reviewed-by: Eugene But <eugenebut@chromium.org>
Cr-Commit-Position: refs/heads/master@{#618589}
[modify] https://crrev.com/8f2187bd41d8aa8ef5b2027d6beffcb25f48f7ea/ios/web/web_state/ui/crw_web_controller.mm

Verified on 73.0.3672.0 Canary,  iPhoneXR  iOS 12.1.2

Looks good.