Fix cross-process location.replace for main frames and subframes.

content/renderer/render_frame_impl.cc

Index: content/renderer/render_frame_impl.cc
diff --git a/content/renderer/render_frame_impl.cc b/content/renderer/render_frame_impl.cc
index 41daf307a3cf84ae2fd2c504e9845f93a172996f..b45d41f0d69164d81ac5306efef1f79e1b866d94 100644
--- a/content/renderer/render_frame_impl.cc
+++ b/content/renderer/render_frame_impl.cc
@@ -3720,8 +3720,12 @@ void RenderFrameImpl::willSendRequest(
     // If the navigation is browser-initiated, the NavigationState contains the
     // correct value instead of the WebDataSource.
     //
-    // TODO(davidben): Avoid this awkward duplication of state. See comment on
-    // NavigationState::should_replace_current_entry().
+    // TODO(creis): Remove should_replace_current_entry from NavigationState
+    // once we verify this is correct, since the WebDataSource should now be
+    // correct.  Currently failing in NewAndAutoSubframe test with CHECK_EQ.
+    CHECK(
+        !navigation_state->common_params().should_replace_current_entry ||
+        data_source->replacesCurrentHistoryItem());
     should_replace_current_entry =
         navigation_state->common_params().should_replace_current_entry;
   }
@@ -4382,7 +4386,14 @@ void RenderFrameImpl::SendDidCommitProvisionalLoad(
   params.is_post = false;
   params.intended_as_new_entry =
       navigation_state->request_params().intended_as_new_entry;
-  params.did_create_new_entry = commit_type == blink::WebStandardCommit;
+  // We create a new entry for standard commits, as well as location.replace
+  // navigations that replace the current entry with a different document.
+  params.did_create_new_entry = commit_type == blink::WebStandardCommit ||
+      (ds->replacesCurrentHistoryItem() &&
+       !navigation_state->WasWithinSamePage());
+  CHECK(!navigation_state->common_params().should_replace_current_entry ||
+        ds->replacesCurrentHistoryItem());
+  params.should_replace_current_entry = ds->replacesCurrentHistoryItem();
   params.post_id = -1;
   params.page_id = render_view_->page_id_;
   params.nav_entry_id = navigation_state->request_params().nav_entry_id;
@@ -4551,7 +4562,7 @@ void RenderFrameImpl::SendDidCommitProvisionalLoad(
     // generated a new session history entry. When they do generate a session
     // history entry, it means the user initiated the navigation and we should
     // mark it as such.
-    if (commit_type == blink::WebStandardCommit)
+    if (params.did_create_new_entry)
       params.transition = ui::PAGE_TRANSITION_MANUAL_SUBFRAME;
     else
       params.transition = ui::PAGE_TRANSITION_AUTO_SUBFRAME;
@@ -4972,8 +4983,17 @@ void RenderFrameImpl::OpenURL(const GURL& url,
     // This is necessary to preserve the should_replace_current_entry value on
     // cross-process redirects, in the event it was set by a previous process.
     //
-    // TODO(davidben): Avoid this awkward duplication of state. See comment on
-    // NavigationState::should_replace_current_entry().
+    // TODO(creis): Remove should_replace_current_entry from NavigationState
+    // once we verify this is correct, since the WebDataSource should now be
+    // correct.
+    WebDataSource* ds = frame_->provisionalDataSource();
+    if (ds) {
+      DocumentState* document_state = DocumentState::FromDataSource(ds);
+      NavigationStateImpl* navigation_state =
+          static_cast<NavigationStateImpl*>(document_state->navigation_state());
+      CHECK_EQ(navigation_state->common_params().should_replace_current_entry,
+               ds->replacesCurrentHistoryItem());
+    }
     params.should_replace_current_entry =
         pending_navigation_params_->common_params.should_replace_current_entry;
   } else {
@@ -5060,8 +5080,12 @@ void RenderFrameImpl::NavigateInternal(
   pending_navigation_params_->common_params.navigation_start =
       base::TimeTicks();
 
-  // Create parameters for a standard navigation.
-  blink::WebFrameLoadType load_type = blink::WebFrameLoadType::Standard;
+  // Create parameters for a standard navigation, indicating whether it should
+  // replace the current NavigationEntry.
+  blink::WebFrameLoadType load_type =
+      common_params.should_replace_current_entry ?
+          blink::WebFrameLoadType::ReplaceCurrentItem :
+          blink::WebFrameLoadType::Standard;
   blink::WebHistoryLoadType history_load_type =
       blink::WebHistoryDifferentDocumentLoad;
   bool should_load_request = false;