window.location.replace not working - inserts __ into url #3994

Current behavior:

Navigating within our application using location.replace("") in a chained promise handler throws a cross-origin error. In our actual application, we are waiting on a network request, then navigating using location.replace() in a then handler.

I've simplified the code to the most basic thing I can, and am able to reproduce by calling location.replace() in a simple setTimeout.

window.location.replace("") -- works

setTimeout(() =>{
  window.location.replace("");
});

-- gives the following error: SecurityError: Blocked a frame with origin "http://localhost:58236" from accessing a cross-origin frame.

Desired behavior:

I need to be able to call location.replace() in a chained promise handler.

Steps to reproduce: (app code and test code)

https://github.com/beckee/cypress-test-tiny

Versions

Cypress 3.2.0
Mac OSX
Chrome Version 73