browsers handle document.open'ed iframe documents differently in session history

[smaug----]

Context is https://bugzilla.mozilla.org/show_bug.cgi?id=1563176#c6

https://www.w3schools.com/tags/tryit.asp?filename=tryhtml_input_checked is an example
Click submit button, and then click back

Firefox loads a duplicate of the top level page, since that is what the url is.
Chrome loads about:blank (where is that coming from ?)
and I was told that Safari goes back to the page which was in the session history before https://www.w3schools.com/tags/tryit.asp?filename=tryhtml_input_checked

All of those are pretty bad experience.

[domenic]

This seems potentially related to #6556, which I tried to fix in #6649 but got stuck on. Not sure though.