First you should determine if you are actually getting the same session or not. There are 2 easy ways I can think of to do this.
1.) Look at the contents of the JSESSIONID cookie. Most browsers make this trivial. If the contents change, you have received a different session.
2.) You could try plugging in an HttpSessionListener to log when your sessions are being destroyed.
If you are getting a new session, you have to narrow it down to a configuration issue (Tomcat, web.xml, context snippet etc.) or an app issue. If it's a configuration issue, the problem should be repeatable on other pages than the ones you mention.
Also consider using getSession(false), which won't create a new session if one isn't already present. If you get null from this, it's another indicator that your sessions are timing out.
If you determine you have the same session, but for some odd reason attributes are disappearing, you can implement a HttpSessionAttributeListener and either log or breakpoint when items are removed from the session.
Thanks this helped me a lot. It seems that when I get to the resultpage and I open a new browser window and I leave my result page unfocused, after a minute or 2 the httpsession gets destroyed.