Created attachment 58856 [details] files to reproduce bug. Background: Form controls generally preserve their values in cache. When a user hits the back button and returns to a form which he has already filled out, he will find the values that he previously entered intact. Since webkit nightly r57054, this behavior is not observed on the input type=hidden form controls if the prototype.js Javascript library is loaded prior to entering values into the controls (for example, in the head section). Instead of the these values, the controls are cleared when we come back to them via the back-button. It was OK up till r56990. Interestingly, this regression does not happen for input type=text controls. The cache returns the values to their previous state, as expected. I have not been able to understand what is happening inside the Prototype.js framework to cause such behavior. I have attached a test page. Steps to reproduce; 1) Unzip the attached "Naofumi Kagami webkit bug report.zip" file 2) Open the index.html file with a browser. 3) In the index.html file, I have listed 5 procedures to test for the presence of this bug. The first two work fine in the current nightly. The last three do not work. 4) Click each link in the order listed. Before the regression, all 5 procedures showed a alert box with the text 'hello' (success). After the regression, the last three show alert boxes with no text. The general pattern seems to be loading the prototype.js library somehow disturbs how the form value is kept in the browser cache. The form value is not being restored when the page is read in from cache (as when the back button is pressed). Note; I am dynamically loading the prototype.js library in the attached example, but the problem is the same when I load it statically in either the head portion or anywhere in the body.
r57013 changed behavior for type=hidden. The value of type=hidden is not saved basically. However, the value is preserved if page cache works. As for Kagami-san's tests cases, page cache works for the first and second tests, and doesn't work for the third-fifth tests because probably prototype.js sets 'unload' handler.
I read the comments on Bug 26241 and understand why you don't want to save the value of type=hidden fields. I'm setting the status to RESOLVED.