Fix cross-process location.replace for main frames and subframes.

content/browser/frame_host/navigation_controller_impl.h

Index: content/browser/frame_host/navigation_controller_impl.h
diff --git a/content/browser/frame_host/navigation_controller_impl.h b/content/browser/frame_host/navigation_controller_impl.h
index 72b76d7464ab00d3071e2b6395b21032b32c3f01..12fb3fdcebe39270a6bc6b2016bfebc9ce816a4e 100644
--- a/content/browser/frame_host/navigation_controller_impl.h
+++ b/content/browser/frame_host/navigation_controller_impl.h
@@ -272,9 +272,10 @@ class CONTENT_EXPORT NavigationControllerImpl
   // anything if some random subframe is loaded. It will return true if anything
   // changed, or false if not.
   //
-  // The functions taking |did_replace_entry| will fill into the given variable
-  // whether the last entry has been replaced or not.
-  // See LoadCommittedDetails.did_replace_entry.
+  // The NewPage and NewSubframe functions take in |replace_entry| to pass to
+  // InsertOrReplaceEntry, in case the newly created NavigationEntry is meant to
+  // replace the current one (e.g., for location.replace), in contrast to
+  // updating a NavigationEntry in place (e.g., for history.replaceState).
   void RendererDidNavigateToNewPage(
       RenderFrameHostImpl* rfh,
       const FrameHostMsg_DidCommitProvisionalLoad_Params& params,
@@ -287,7 +288,8 @@ class CONTENT_EXPORT NavigationControllerImpl
       const FrameHostMsg_DidCommitProvisionalLoad_Params& params);
   void RendererDidNavigateNewSubframe(
       RenderFrameHostImpl* rfh,
-      const FrameHostMsg_DidCommitProvisionalLoad_Params& params);
+      const FrameHostMsg_DidCommitProvisionalLoad_Params& params,
+      bool replace_entry);
   bool RendererDidNavigateAutoSubframe(
       RenderFrameHostImpl* rfh,
       const FrameHostMsg_DidCommitProvisionalLoad_Params& params);