--- a/docshell/base/nsDocShell.cpp
+++ b/docshell/base/nsDocShell.cpp
@@ -11176,29 +11176,18 @@ nsresult nsDocShell::UpdateURLAndHistory
   // indicating that we're doing a pushState rather than a replaceState, notify
   // bfcache that we've added a page to the history so it can evict content
   // viewers if appropriate. Otherwise call ReplaceEntry so that we notify
   // nsIHistoryListeners that an entry was replaced.  We may not have a root
   // session history if this call is coming from a document.open() in a docshell
   // subtree that disables session history.
   RefPtr<ChildSHistory> rootSH = GetRootSessionHistory();
   if (rootSH) {
-    if (!aReplace) {
-      int32_t curIndex = rootSH->Index();
-      if (curIndex > -1) {
-        rootSH->LegacySHistory()->EvictOutOfRangeContentViewers(curIndex);
-      }
-    } else {
-      nsCOMPtr<nsISHEntry> rootSHEntry = nsSHistory::GetRootSHEntry(newSHEntry);
-
-      int32_t index = rootSH->LegacySHistory()->GetIndexOfEntry(rootSHEntry);
-      if (index > -1) {
-        rootSH->LegacySHistory()->ReplaceEntry(index, rootSHEntry);
-      }
-    }
+    rootSH->LegacySHistory()->EvictContentViewersOrReplaceEntry(newSHEntry,
+                                                                aReplace);
   }
 
   // Step 4: If the document's URI changed, update document's URI and update
   // global history.
   //
   // We need to call FireOnLocationChange so that the browser's address bar
   // gets updated and the back button is enabled, but we only need to
   // explicitly call FireOnLocationChange if we're not calling SetCurrentURI,

--- a/docshell/shistory/PSHistory.ipdl
+++ b/docshell/shistory/PSHistory.ipdl
@@ -52,14 +52,15 @@ parent:
   sync RemoveDynEntries(int32_t index, PSHEntry entry);
   sync RemoveEntries(nsID[] ids, int32_t index) returns (bool didRemove);
   sync RemoveFrameEntries(PSHEntry entry);
   sync Reload(uint32_t reloadFlags) returns (LoadSHEntryResult load);
   sync GetAllEntries() returns (MaybeNewPSHEntry[] entries);
   sync FindEntryForBFCache(uint64_t sharedID, bool includeCurrentEntry) returns (MaybeNewPSHEntry entries, int32_t startIndex);
   sync Evict(PSHEntry[] entry);
   sync EnsureCorrectEntryAtCurrIndex(PSHEntry entry);
+  sync EvictContentViewersOrReplaceEntry(nullable PSHEntry newSHEntry, bool replace);
 
   async __delete__();
 };
 
 } // namespace dom
 } // namespace mozilla

--- a/docshell/shistory/SHistoryChild.cpp
+++ b/docshell/shistory/SHistoryChild.cpp
@@ -278,16 +278,22 @@ SHistoryChild::EvictAllContentViewers(vo
 
   nsTArray<PSHEntryChild*> pshEntries;
   pshEntries.AppendElements(shEntries);
   SendEvict(pshEntries);
   return NS_OK;
 }
 
 NS_IMETHODIMP_(void)
+SHistoryChild::EvictContentViewersOrReplaceEntry(nsISHEntry* aNewSHEntry, bool aReplace) {
+  SendEvictContentViewersOrReplaceEntry(
+      static_cast<SHEntryChild*>(aNewSHEntry), aReplace);
+}
+
+NS_IMETHODIMP_(void)
 SHistoryChild::AddToExpirationTracker(nsIBFCacheEntry* aBFEntry) {
   RefPtr<SHEntryChildShared> entry = static_cast<SHEntryChildShared*>(aBFEntry);
   if (mHistoryTracker && entry) {
     mHistoryTracker->AddObject(entry);
   }
 }
 
 NS_IMETHODIMP_(void)

--- a/docshell/shistory/SHistoryParent.cpp
+++ b/docshell/shistory/SHistoryParent.cpp
@@ -134,16 +134,25 @@ bool SHistoryParent::RecvEvictOutOfRange
   // FIXME Implement this!
   return true;
 }
 
 bool SHistoryParent::RecvEvictAllContentViewers() {
   return NS_SUCCEEDED(mHistory->EvictAllContentViewers());
 }
 
+bool SHistoryParent::RecvEvictContentViewersOrReplaceEntry(
+    PSHEntryParent* aNewSHEntry, bool aReplace) {
+  mHistory->EvictContentViewersOrReplaceEntry(
+      aNewSHEntry ? static_cast<SHEntryParent*>(aNewSHEntry)->mEntry.get()
+                  : nullptr,
+      aReplace);
+  return true;
+}
+
 bool SHistoryParent::RecvRemoveDynEntries(int32_t aIndex,
                                           PSHEntryParent* aEntry) {
   MOZ_ASSERT(Manager() == aEntry->Manager());
   mHistory->RemoveDynEntries(aIndex,
                              static_cast<SHEntryParent*>(aEntry)->mEntry);
   return true;
 }
 

--- a/docshell/shistory/SHistoryParent.h
+++ b/docshell/shistory/SHistoryParent.h
@@ -72,16 +72,17 @@ class SHistoryParent final : public PSHi
   bool RecvRemoveFrameEntries(PSHEntryParent* aEntry);
   bool RecvReload(const uint32_t& aReloadFlags, LoadSHEntryResult* aLoadResult);
   bool RecvGetAllEntries(nsTArray<MaybeNewPSHEntry>* aEntries);
   bool RecvFindEntryForBFCache(const uint64_t& aSharedID,
                                const bool& aIncludeCurrentEntry,
                                MaybeNewPSHEntry* aEntry, int32_t* aIndex);
   bool RecvEvict(nsTArray<PSHEntryParent*>&& aEntries);
   bool RecvEnsureCorrectEntryAtCurrIndex(PSHEntryParent* aEntry);
+  bool RecvEvictContentViewersOrReplaceEntry(PSHEntryParent* aNewSHEntry, bool aReplace);
 
   RefPtr<CanonicalBrowsingContext> mContext;
   RefPtr<LegacySHistory> mHistory;
 };
 
 }  // namespace dom
 }  // namespace mozilla
 

--- a/docshell/shistory/nsISHistory.idl
+++ b/docshell/shistory/nsISHistory.idl
@@ -257,9 +257,11 @@ interface nsISHistory: nsISupports
   */
   [noscript, notxpcom]
   void RemoveFrameEntries(in nsISHEntry aEntry);
 
   [noscript]
   void Reload(in unsigned long aReloadFlags);
 
   [notxpcom] void EnsureCorrectEntryAtCurrIndex(in nsISHEntry aEntry);
+  
+  [notxpcom] void EvictContentViewersOrReplaceEntry(in nsISHEntry aNewSHEntry, in bool aReplace);
 };

--- a/docshell/shistory/nsSHistory.cpp
+++ b/docshell/shistory/nsSHistory.cpp
@@ -794,16 +794,35 @@ NS_IMETHODIMP
 nsSHistory::EvictOutOfRangeContentViewers(int32_t aIndex) {
   // Check our per SHistory object limit in the currently navigated SHistory
   EvictOutOfRangeWindowContentViewers(aIndex);
   // Check our total limit across all SHistory objects
   GloballyEvictContentViewers();
   return NS_OK;
 }
 
+NS_IMETHODIMP_(void)
+nsSHistory::EvictContentViewersOrReplaceEntry(nsISHEntry* aNewSHEntry,
+                                              bool aReplace) {
+  if (!aReplace) {
+    int32_t curIndex;
+    GetIndex(&curIndex);
+    if (curIndex > -1) {
+      EvictOutOfRangeContentViewers(curIndex);
+    }
+  } else {
+    nsCOMPtr<nsISHEntry> rootSHEntry = nsSHistory::GetRootSHEntry(aNewSHEntry);
+
+    int32_t index = GetIndexOfEntry(rootSHEntry);
+    if (index > -1) {
+      ReplaceEntry(index, rootSHEntry);
+    }
+  }
+}
+
 NS_IMETHODIMP
 nsSHistory::EvictAllContentViewers() {
   // XXXbz we don't actually do a good job of evicting things as we should, so
   // we might have viewers quite far from mIndex.  So just evict everything.
   for (int32_t i = 0; i < Length(); i++) {
     EvictContentViewerForEntry(mEntries[i]);
   }
 

--- a/ipc/ipdl/sync-messages.ini
+++ b/ipc/ipdl/sync-messages.ini
@@ -833,16 +833,18 @@ description = Standing up Fission
 [PSHistory::ReplaceEntry]
 description = Standing up Fission
 [PSHistory::NotifyOnHistoryReload]
 description = Standing up Fission
 [PSHistory::EvictOutOfRangeContentViewers]
 description = Standing up Fission
 [PSHistory::EvictAllContentViewers]
 description = Standing up Fission
+[PSHistory::EvictContentViewersOrReplaceEntry]
+description = Standing up Fission
 [PSHistory::RemoveDynEntries]
 description = Standing up Fission
 [PSHistory::RemoveEntries]
 description = Standing up Fission
 [PSHistory::RemoveFrameEntries]
 description = Standing up Fission
 [PSHistory::Reload]
 description = Standing up Fission