[fix] ignore popstate events from outside the router (#7721)

fixes #6914

Author: Rich-Harris

.changeset/ninety-colts-protect.md

@@ -0,0 +1,5 @@
+---
+'@sveltejs/kit': patch
+---
+
+Ignore popstate events from outside the router

packages/kit/src/runtime/client/client.js

@@ -1458,7 +1458,7 @@ export function create_client({ target, base, trailing_slash }) {
 			});
 
 			addEventListener('popstate', (event) => {
-				if (event.state) {
+				if (event.state?.[INDEX_KEY]) {
 					// if a popstate-driven navigation is cancelled, we need to counteract it
 					// with history.go, which means we end up back here, hence this check
 					if (event.state[INDEX_KEY] === current_history_index) return;

packages/kit/test/apps/basics/src/routes/routing/external-popstate/+page.svelte

@@ -0,0 +1,7 @@
+<h1>hello</h1>
+
+<button
+	on:click={() => {
+		history.pushState({}, '', '/routing/external-popstate/does-not-exist');
+	}}>go to /routing/external-popstate/does-not-exist</button
+>

packages/kit/test/apps/basics/test/client.test.js

@@ -791,6 +791,20 @@ test.describe('Routing', () => {
 			await close();
 		}
 	});
+
+	test('ignores popstate events from outside the router', async ({ page }) => {
+		await page.goto('/routing/external-popstate');
+		expect(await page.textContent('h1')).toBe('hello');
+
+		await page.click('button');
+		expect(await page.textContent('h1')).toBe('hello');
+
+		await page.goBack();
+		expect(await page.textContent('h1')).toBe('hello');
+
+		await page.goForward();
+		expect(await page.textContent('h1')).toBe('hello');
+	});
 });
 
 test.describe('Shadow DOM', () => {