Fixing a bug with interstitial pages triggered with malware....

chrome/browser/tab_contents/navigation_controller.cc

 // Copyright (c) 2009 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/tab_contents/navigation_controller.h"
 
 #include "app/resource_bundle.h"
 #include "base/file_util.h"
 #include "base/logging.h"
 #include "base/string_util.h"
@@ skipping 643 matching lines @@
 
   // The entry we found in the list might be pending if the user hit
   // back/forward/reload. This load should commit it (since it's already in the
   // list, we can just discard the pending pointer).
   //
   // Note that we need to use the "internal" version since we don't want to
   // actually change any other state, just kill the pointer.
   if (entry == pending_entry_)
     DiscardNonCommittedEntriesInternal();
 
+  // If a transient entry was removed, the indeces might have changed, get

[brettw, 2009/10/14 20:47:09]

indeces -> indices

+  // entry_index again.
+  entry_index = GetEntryIndexWithPageID(tab_contents_->GetSiteInstance(),

[brettw, 2009/10/14 20:47:09]

How about skipping entry_index and just setting last_committed_entry_index_ =
GetEntryIndexWithPageID(...
(be sure to update the comment).

+                                        params.page_id);
   last_committed_entry_index_ = entry_index;
 }
 
 void NavigationController::RendererDidNavigateToSamePage(
     const ViewHostMsg_FrameNavigate_Params& params) {
   // This mode implies we have a pending entry that's the same as an existing
   // entry for this page ID. This entry is guaranteed to exist by
   // ClassifyNavigation. All we need to do is update the existing entry.
   NavigationEntry* existing_entry = GetEntryWithPageID(
       tab_contents_->GetSiteInstance(),
@@ skipping 296 matching lines @@
   pending_entry_ = NULL;
   pending_entry_index_ = -1;
 
   DiscardTransientEntry();
 }
 
 void NavigationController::DiscardTransientEntry() {
   if (transient_entry_index_ == -1)
     return;
   entries_.erase(entries_.begin() + transient_entry_index_);
+  if (last_committed_entry_index_ > transient_entry_index_)
+    last_committed_entry_index_--;
   transient_entry_index_ = -1;
 }
 
 int NavigationController::GetEntryIndexWithPageID(
     SiteInstance* instance, int32 page_id) const {
   for (int i = static_cast<int>(entries_.size()) - 1; i >= 0; --i) {
     if ((entries_[i]->site_instance() == instance) &&
         (entries_[i]->page_id() == page_id))
       return i;
   }
   return -1;
 }
 
 NavigationEntry* NavigationController::GetTransientEntry() const {
   if (transient_entry_index_ == -1)
     return NULL;
   return entries_[transient_entry_index_].get();
 }