One consequence of this is that we aren't clearing subframe FrameNavigationEntries after location.replace, which is bad for cross-site pages that might end up loading the wrong iframes.  We should at least clear those as a first step toward fixing this behavior.

Here are some crashes that Nasko pointed out that are a result of this. NavigationEntry is null in RendererDidNavigateToExistingPage sometimes

https://crash/browse?q=custom_data.ChromeCrashProto.magic_signature_1.name%3D%27content%3A%3ANavigationControllerImpl%3A%3ARendererDidNavigate%27%20AND%20product.Version%3D%2756.0.2924.87%27%20AND%20product.name%3D%27Chrome%27&ignore_case=false&enable_rewrite=true&omit_field_name=&omit_field_value=&omit_field_opt=%3D#samplereports:15

https://crash/browse?q=custom_data.ChromeCrashProto.magic_signature_1.name%3D%27content%3A%3ANavigationControllerImpl%3A%3ARendererDidNavigateToExistingPage%27%20AND%20product.Version%3D%2756.0.2924.87%27%20AND%20product.name%3D%27Chrome%27&ignore_case=false&enable_rewrite=true&omit_field_name=&omit_field_value=&omit_field_opt=%3D#samplereports:15

Note: The second link in comment 2 is indeed due to a null NavigationEntry, and is related to this and issue 697827.  (Specifically, it's due to r452106 from  issue 688425 , when this bug offers an alternative way to fix it.)

The RendererDidNavigate crashes from the first link in comment 2 are due to issue 585248 and are a CHECK failure in SetBindings, not a null deref on active_entry.  That said, it's possible that the bindings mismatch in those crashes could be indirectly happening because of the same GetLastCommittedEntry mixup in RendererDidNavigateToExistingPage.  It's possible that a fix for this bug might fix those crashes as well.

I have a CL in progress for this at https://chromium-review.googlesource.com/c/567683.  It's currently stuck on a failure in HistoryBrowserTest.RedirectHistory, where apparently the redirecting URL isn't remembered in history.

I'll have to learn more about how the history service works to understand how to resolve this.

(Note that this work was kicked off because of a bug in how we set details->did_replace_entry, as discovered by mastiz@ in https://codereview.chromium.org/2972793002/.)

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/1378111f1aa93354eb473234996da727cd211585

commit 1378111f1aa93354eb473234996da727cd211585
Author: Charles Reis <creis@chromium.org>
Date: Wed Nov 08 21:44:06 2017

Classify cross-document replacement navigation as new.

This ensures that we create a new NavigationEntry for them rather than
trying to (incompletely) update an existing one.

BUG= 596707 
TEST=Tests still pass

Cq-Include-Trybots: master.tryserver.chromium.linux:linux_site_isolation
Change-Id: Ie58c9cd2633dbd6042ace83b75b7449911052925
Reviewed-on: https://chromium-review.googlesource.com/567683
Reviewed-by: Alex Moshchuk <alexmos@chromium.org>
Reviewed-by: Scott Violet <sky@chromium.org>
Commit-Queue: Charlie Reis <creis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#514951}
[modify] https://crrev.com/1378111f1aa93354eb473234996da727cd211585/chrome/browser/history/history_browsertest.cc
[modify] https://crrev.com/1378111f1aa93354eb473234996da727cd211585/chrome/browser/translate/translate_browsertest.cc
[modify] https://crrev.com/1378111f1aa93354eb473234996da727cd211585/content/browser/frame_host/frame_navigation_entry.cc
[modify] https://crrev.com/1378111f1aa93354eb473234996da727cd211585/content/browser/frame_host/navigation_controller_impl.cc
[modify] https://crrev.com/1378111f1aa93354eb473234996da727cd211585/content/browser/frame_host/navigation_controller_impl_browsertest.cc
[modify] https://crrev.com/1378111f1aa93354eb473234996da727cd211585/content/browser/frame_host/navigation_controller_impl_unittest.cc
[modify] https://crrev.com/1378111f1aa93354eb473234996da727cd211585/content/renderer/render_frame_impl.cc

Fixed!  Filed issue 781879 for the change to the translate infobar behavior.