Trust the renderer's same-document navigation flag if it is a same-origin nav.

content/browser/frame_host/navigation_controller_impl.h

Index: content/browser/frame_host/navigation_controller_impl.h
diff --git a/content/browser/frame_host/navigation_controller_impl.h b/content/browser/frame_host/navigation_controller_impl.h
index 7ec82f38aedd563c379a4d1de8327ec02e23e2c5..7a06ba663b67bce4950cd7571f4231ae67749af0 100644
--- a/content/browser/frame_host/navigation_controller_impl.h
+++ b/content/browser/frame_host/navigation_controller_impl.h
@@ -159,15 +159,11 @@ class CONTENT_EXPORT NavigationControllerImpl
   // whether a navigation happened without loading anything, the same URL could
   // be a reload, while only a different ref would be in-page (pages can't clear
   // refs without reload, only change to "#" which we don't count as empty).
-  bool IsURLInPageNavigation(const GURL& url) const {
-    return IsURLInPageNavigation(url, false, NAVIGATION_TYPE_UNKNOWN);
-  }
-
+  //
   // The situation is made murkier by history.replaceState(), which could
   // provide the same URL as part of an in-page navigation, not a reload. So
-  // we need this form which lets the (untrustworthy) renderer resolve the
-  // ambiguity, but only when the URLs are equal. This should be safe since the
-  // origin isn't changing.
+  // we need to let the (untrustworthy) renderer resolve the ambiguity, but
+  // only when the URLs are on the same origin.
   bool IsURLInPageNavigation(
       const GURL& url,
       bool renderer_says_in_page,