diff --git a/docshell/base/BrowsingContext.cpp b/docshell/base/BrowsingContext.cpp
index c406d67797e7..15f9da6c8855 100644
--- a/docshell/base/BrowsingContext.cpp
+++ b/docshell/base/BrowsingContext.cpp
@@ -2730,6 +2730,7 @@ void BrowsingContext::SetActiveSessionHistoryEntry(
     const Maybe<nsPoint>& aPreviousScrollPos, SessionHistoryInfo* aInfo,
     uint32_t aLoadType, int32_t aChildOffset, uint32_t aUpdatedCacheKey) {
   if (XRE_IsContentProcess()) {
+    // XXX Why we update cache key only in content process case?
     if (aUpdatedCacheKey != 0) {
       aInfo->SetCacheKey(aUpdatedCacheKey);
     }
diff --git a/docshell/base/nsDocShell.cpp b/docshell/base/nsDocShell.cpp
index 0fce49f20354..d2920f05f86e 100644
--- a/docshell/base/nsDocShell.cpp
+++ b/docshell/base/nsDocShell.cpp
@@ -8955,12 +8955,16 @@ nsresult nsDocShell::HandleSameDocumentNavigation(
             scrollRestorationIsManual.value());
       }
 
-      // FIXME We should probably just compute mChildOffset in the parent
-      //       instead of passing it over IPC here.
-      mBrowsingContext->SetActiveSessionHistoryEntry(
-          Some(scrollPos), mActiveEntry.get(), mLoadType, mChildOffset,
-          cacheKey);
-      // FIXME Do we need to update mPreviousEntryIndex and mLoadedEntryIndex?
+      if (LOAD_TYPE_HAS_FLAGS(mLoadType, LOAD_FLAGS_REPLACE_HISTORY)) {
+        mBrowsingContext->ReplaceActiveSessionHistoryEntry(mActiveEntry.get());
+      } else {
+        // FIXME We should probably just compute mChildOffset in the parent
+        //       instead of passing it over IPC here.
+        mBrowsingContext->SetActiveSessionHistoryEntry(
+            Some(scrollPos), mActiveEntry.get(), mLoadType, mChildOffset,
+            cacheKey);
+        // FIXME Do we need to update mPreviousEntryIndex and mLoadedEntryIndex?
+      }
     }
   }
 
diff --git a/testing/web-platform/meta/html/browsers/browsing-the-web/scroll-to-fragid/forward-triggers-hashchange.html.ini b/testing/web-platform/meta/html/browsers/browsing-the-web/scroll-to-fragid/forward-triggers-hashchange.html.ini
index f81882d18f83..65568aa94165 100644
--- a/testing/web-platform/meta/html/browsers/browsing-the-web/scroll-to-fragid/forward-triggers-hashchange.html.ini
+++ b/testing/web-platform/meta/html/browsers/browsing-the-web/scroll-to-fragid/forward-triggers-hashchange.html.ini
@@ -1,5 +1,9 @@
 [forward-triggers-hashchange.html]
-  expected: TIMEOUT
+  expected:
+    if fission: OK
+    TIMEOUT
   [Navigating forward after replace() should still trigger hashchange]
-    expected: TIMEOUT
+    expected:
+      if fission: PASS
+      TIMEOUT
 
diff --git a/testing/web-platform/meta/html/browsers/browsing-the-web/scroll-to-fragid/replacement-enabled.html.ini b/testing/web-platform/meta/html/browsers/browsing-the-web/scroll-to-fragid/replacement-enabled.html.ini
index 84e3a62035a3..680b7bbf391c 100644
--- a/testing/web-platform/meta/html/browsers/browsing-the-web/scroll-to-fragid/replacement-enabled.html.ini
+++ b/testing/web-platform/meta/html/browsers/browsing-the-web/scroll-to-fragid/replacement-enabled.html.ini
@@ -1,6 +1,4 @@
 [replacement-enabled.html]
-  disabled:
-    if fission: https://bugzilla.mozilla.org/show_bug.cgi?id=1656208
   [Navigating to a fragment should not clear forward history]
     expected:
       if webrender and debug and (os == "linux") and not fission: ["PASS", "FAIL"]