location.replace() breaks same-document back/forward navigations.

Source/core/loader/HistoryItem.h

 /*
  * Copyright (C) 2006, 2008, 2011 Apple Inc. All rights reserved.
  * Copyright (C) 2012 Research In Motion Limited. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
@@ skipping 34 matching lines @@
 
 typedef Vector<RefPtr<HistoryItem> > HistoryItemVector;
 
 class HistoryItem : public RefCounted<HistoryItem> {
 public:
     static PassRefPtr<HistoryItem> create() { return adoptRef(new HistoryItem); }
     ~HistoryItem();
 
     // Used when the frame this item represents was navigated to a different
     // url but a new item wasn't created.
-    void generateNewSequenceNumbers();
+    void generateNewItemSequenceNumber();
+    void generateNewDocumentSequenceNumber();
 
     const String& urlString() const;
     KURL url() const;
 
     const Referrer& referrer() const;
     const String& target() const;
 
     FormData* formData();
     const AtomicString& formContentType() const;
 
@@ skipping 67 matching lines @@
 
     // info used to repost form data
     RefPtr<FormData> m_formData;
     AtomicString m_formContentType;
 
 }; // class HistoryItem
 
 } // namespace WebCore
 
 #endif // HISTORYITEM_H