RenderViewImpl::page_id_ isn't initialized for cross-process replacement navigations.

content/renderer/render_frame_impl.cc

Index: content/renderer/render_frame_impl.cc
diff --git a/content/renderer/render_frame_impl.cc b/content/renderer/render_frame_impl.cc
index 75bb31eb4732ef4c141537b0b8d236f3bd05a214..d5a54d8676f277ba277fa7e9fef81d386fcdb4d7 100644
--- a/content/renderer/render_frame_impl.cc
+++ b/content/renderer/render_frame_impl.cc
@@ -3257,8 +3257,18 @@ void RenderFrameImpl::didCommitProvisionalLoad(
     internal_data->set_must_reset_scroll_and_scale_state(false);
   }
 
+  const RequestNavigationParams& request_params =
+      navigation_state->request_params();
   bool is_new_navigation = commit_type == blink::WebStandardCommit;
-  if (is_new_navigation) {
+
+  // Ensure that we allocate a page ID if this is the first navigation for the
+  // page in this process.  This can happen even when is_new_navigation
+  // is false, such as after a cross-process location.replace navigation.
+  bool should_init_page_id = render_view_->page_id_ == -1 &&
+                             request_params.page_id == -1 &&
+                             request_params.nav_entry_id != 0 &&
+                             !navigation_state->IsContentInitiated();
+  if (is_new_navigation || should_init_page_id) {
     // We bump our Page ID to correspond with the new session history entry.
     render_view_->page_id_ = render_view_->next_page_id_++;
 
@@ -3274,8 +3284,6 @@ void RenderFrameImpl::didCommitProvisionalLoad(
           render_view_->history_list_offset_ + 1;
     }
   } else {
-    const RequestNavigationParams& request_params =
-        navigation_state->request_params();
     if (request_params.nav_entry_id != 0 &&
         !request_params.intended_as_new_entry) {
       // This is a successful session history navigation!