RenderViewImpl::page_id_ isn't initialized for cross-process replacement navigations.

content/renderer/render_frame_impl.cc

Index: content/renderer/render_frame_impl.cc
diff --git a/content/renderer/render_frame_impl.cc b/content/renderer/render_frame_impl.cc
index 75bb31eb4732ef4c141537b0b8d236f3bd05a214..417411e84dafb821811ab77c36bf34610a1ae40c 100644
--- a/content/renderer/render_frame_impl.cc
+++ b/content/renderer/render_frame_impl.cc
@@ -3257,8 +3257,13 @@ void RenderFrameImpl::didCommitProvisionalLoad(
     internal_data->set_must_reset_scroll_and_scale_state(false);
   }
 
+  const auto& request_params = navigation_state->request_params();

[Charlie Reis, 2016/05/13 19:14:32]

nit: I think it's useful documentation to leave the type
(RequestNavigationParams) here.  There are a lot of params objects floating
around this class, so it's nice to know at a glance.

[Andrey Kraynov, 2016/05/16 08:03:11]

Done.

   bool is_new_navigation = commit_type == blink::WebStandardCommit;
-  if (is_new_navigation) {
+  bool should_init_page_id = render_view_->page_id_ == -1 &&

[Charlie Reis, 2016/05/13 19:14:32]

Let's add a comment above this:

Ensure that we allocate a page ID if this is the first navigation for the page
in this process.  This can happen even when is_new_navigation is false, such as
after a cross-process location.replace navigation.

[Andrey Kraynov, 2016/05/16 08:03:11]

Done.

+                             request_params.page_id == -1 &&
+                             request_params.nav_entry_id != 0 &&
+                             !navigation_state->IsContentInitiated();
+  if (is_new_navigation || should_init_page_id) {
     // We bump our Page ID to correspond with the new session history entry.
     render_view_->page_id_ = render_view_->next_page_id_++;
 
@@ -3274,8 +3279,6 @@ void RenderFrameImpl::didCommitProvisionalLoad(
           render_view_->history_list_offset_ + 1;
     }
   } else {
-    const RequestNavigationParams& request_params =
-        navigation_state->request_params();
     if (request_params.nav_entry_id != 0 &&
         !request_params.intended_as_new_entry) {
       // This is a successful session history navigation!