Fragment navigation should use replacement enabled

Tests: web-platform-tests/wpt#6877.

Fixes #2796.

source

@@ -81732,7 +81732,8 @@ State: <OUTPUT NAME=I>1</OUTPUT> <INPUT VALUE="Increment" TYPE=BUTTON O
    data-x="concept-document-url">URL</span> with <var>exclude fragments flag</var> set, and
    <var>resource</var>'s <span data-x="concept-request-url">url</span>'s <span
    data-x="concept-url-fragment">fragment</span> is non-null, then <span
-   data-x="navigate-fragid">navigate to that fragment</span> and abort these steps.</p></li>
+   data-x="navigate-fragid">navigate to that fragment</span>, with <span>replacement enabled</span>
+   if this was invoked with <span>replacement enabled</span>, and abort these steps.</p></li>
 
    <li><p>Cancel any preexisting but not yet <span data-x="concept-navigate-mature">mature</span>
    attempt to navigate <var>browsingContext</var>, including canceling any instances of the <span
@@ -82785,20 +82786,19 @@ State: &lt;OUTPUT NAME=I>1&lt;/OUTPUT> &lt;INPUT VALUE="Increment" TYPE=BUTTON O
 
   <h4 id="scroll-to-fragid"><dfn data-x="navigate-fragid">Navigating to a fragment</dfn></h4>
 
-  <p>When a user agent is supposed to navigate to a <span data-x="concept-url-fragment">fragment</span>, then the user agent must
-  run the following steps:</p>
+  <p>When a user agent is supposed to navigate to a <span
+  data-x="concept-url-fragment">fragment</span>, optionally with <span>replacement enabled</span>,
+  then the user agent must run the following steps:</p>
 
   <ol>
-
    <li>
-
-    <p>Remove all the entries in the <span>browsing context</span>'s <span>session history</span>
-    after the <span>current entry</span>. If the <span>current entry</span> is the last entry in the
-    session history, then no entries are removed.</p>
+    <p>If not with <span>replacement enabled</span>, then remove all the entries in the
+    <span>browsing context</span>'s <span>session history</span> after the <span>current
+    entry</span>. If the <span>current entry</span> is the last entry in the session history, then
+    no entries are removed.</p>
 
     <p class="note">This <a href="#history-notes">doesn't necessarily have to affect</a> the user
     agent's user interface.</p>
-
    </li>
 
    <li><p>Remove any <span data-x="concept-task">tasks</span> queued by the <span>history traversal
@@ -82811,10 +82811,10 @@ State: &lt;OUTPUT NAME=I>1&lt;/OUTPUT> &lt;INPUT VALUE="Increment" TYPE=BUTTON O
    the user agent was <span data-x="navigate">navigating</span>. The title must be left
    unset.</p></li>
 
-   <li><p><span>Traverse the history</span> to the new entry, with the <i>non-blocking events</i> flag
-   set. This will <span>scroll to the fragment</span> given in what is now the document's <span
-   data-x="concept-document-url">URL</span>.</p></li>
-
+   <li><p><span>Traverse the history</span> to the new entry, with <span>replacement enabled</span>
+   if this was invoked with <span>replacement enabled</span>, and with the <i>non-blocking
+   events</i> flag set. This will <span>scroll to the fragment</span> given in what is now the
+   document's <span data-x="concept-document-url">URL</span>.</p></li>
   </ol>
 
   <p class="note">If the scrolling fails because the relevant <span data-x="concept-id">ID</span> has
@@ -120555,6 +120555,7 @@ INSERT INTERFACES HERE
   Felix Sanz,
   Felix Sasaki,
   Fernando Altomare Serboncini,
+  Forbes Lindesay,
   Francesco Schwarz,
   Francis Brosnan Blazquez,
   Franck 'Shift' Qu&eacute;lain,