location.replace() breaks same-document back/forward navigations.

For navigations that don't create a new entry in the back/forward list (like
location.replace), we don't create a new HistoryItem, we just update the
existing one. If the url changes, we currently update some id numbers as well:
the item sequence number (which uniquely identifies the item), and the
document sequence number (which is common among history items that can be
navigated between without creating a new document). For a location.replace()
within the same document, we still need to change the item sequence number
(so that a back navigation is guaranteed to do something), but the document
sequence number should *not* update, so that a same-document navigation is
still possible.

BUG=363724
TEST=fast/loader/back-after-same-document-location-replace.html

Review URL: https://codereview.chromium.org/267613003

git-svn-id: svn://svn.chromium.org/blink/trunk@173045 bbb929c8-8fbe-4397-9dbb-9b2b20218538