location.replace() breaks same-document back/forward navigations.

Source/core/loader/FrameLoader.cpp

Index: Source/core/loader/FrameLoader.cpp
diff --git a/Source/core/loader/FrameLoader.cpp b/Source/core/loader/FrameLoader.cpp
index 770c73a0cb9627004e2ffd9a1cd5f8d2df2384f3..a12592f9295080a6c558b40402890b3bf787e2d8 100644
--- a/Source/core/loader/FrameLoader.cpp
+++ b/Source/core/loader/FrameLoader.cpp
@@ -257,10 +257,15 @@ void FrameLoader::setHistoryItemStateForCommit(HistoryCommitType historyCommitTy
 {
     if (m_provisionalItem)
         m_currentItem = m_provisionalItem.release();
-    if (!m_currentItem || historyCommitType == StandardCommit)
+
+    if (!m_currentItem || historyCommitType == StandardCommit) {
         m_currentItem = HistoryItem::create();
-    else if (!isPushOrReplaceState && m_documentLoader->url() != m_currentItem->url())
-        m_currentItem->generateNewSequenceNumbers();
+    } else if (!isPushOrReplaceState && m_documentLoader->url() != m_currentItem->url()) {
+        m_currentItem->generateNewItemSequenceNumber();
+        if (!equalIgnoringFragmentIdentifier(m_documentLoader->url(), m_currentItem->url()))
+            m_currentItem->generateNewDocumentSequenceNumber();
+    }
+
     m_currentItem->setURL(m_documentLoader->urlForHistory());
     m_currentItem->setDocumentState(m_frame->document()->formElementsState());
     m_currentItem->setTarget(m_frame->tree().uniqueName());