Bug 474349. Set mOSHE when starting load for document.write, since there will never be an Embed call, and do so in all cases, not just when we already have an mOSHE. r+sr=jst

docshell/base/nsDocShell.cpp

@@ -5103,8 +5103,9 @@ nsDocShell::OnStateChange(nsIWebProgress * aProgress, nsIRequest * aRequest,
                 SetCurrentURI(uri, aRequest, PR_TRUE);
                 // Save history state of the previous page
                 rv = PersistLayoutHistoryState();
-                if (mOSHE)
-                    SetHistoryEntry(&mOSHE, mLSHE);
+                // We'll never get an Embed() for this load, so just go ahead
+                // and SetHistoryEntry now.
+                SetHistoryEntry(&mOSHE, mLSHE);
             }
         
         }