This adds a Flush to the session backend to help with data corruption

webkit/glue/glue_serialize.cc

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "webkit/glue/glue_serialize.h"
 
 #include <string>
 
 #include "base/pickle.h"
 #include "base/utf_string_conversions.h"
@@ skipping 278 matching lines @@
   if (obj->version >= 4)
     http_body.setIdentifier(ReadInteger64(obj));
 
   return http_body;
 }
 
 // Writes the HistoryItem data into the SerializeObject object for
 // serialization.
 void WriteHistoryItem(
     const WebHistoryItem& item, SerializeObject* obj) {
+  // If the history item is not valid, then just return.
+  if (item.IsNull())
+    return;
+
   // WARNING: This data may be persisted for later use. As such, care must be
   // taken when changing the serialized format. If a new field needs to be
   // written, only adding at the end will make it easier to deal with loading
   // older versions. Similarly, this should NOT save fields with sensitive
   // data, such as password fields.
   WriteInteger(kVersion, obj);
   WriteString(item.urlString(), obj);
   WriteString(item.originalURLString(), obj);
   WriteString(item.target(), obj);
   WriteString(item.parent(), obj);
@@ skipping 12 matching lines @@
     WriteInteger64(item.itemSequenceNumber(), obj);
   if (kVersion >= 6)
     WriteInteger64(item.documentSequenceNumber(), obj);
   if (kVersion >= 7) {
     bool has_state_object = !item.stateObject().isNull();
     WriteBoolean(has_state_object, obj);
     if (has_state_object)
       WriteString(item.stateObject().toString(), obj);
   }
 
+  WriteFormData(item.httpBody(), obj);
+  WriteString(item.httpContentType(), obj);
+
   // Yes, the referrer is written twice.  This is for backwards
   // compatibility with the format.
-  WriteFormData(item.httpBody(), obj);
-  WriteString(item.httpContentType(), obj);
   WriteString(item.referrer(), obj);
 
-  // Subitems
-  const WebVector<WebHistoryItem>& children = item.children();
-  WriteInteger(static_cast<int>(children.size()), obj);
-  for (size_t i = 0, c = children.size(); i < c; ++i)
-    WriteHistoryItem(children[i], obj);
+  // Write subitems, making sure that we skip any NULL items (which
+  // can occur with corrupted input), and adjust the item count to
+  // match.
+  const WebVector<WebHistoryItem>& child_vector = item.children();
+  int real_size = static_cast<int>(child_vector.size());
+  for (size_t i = 0, size = child_vector.size(); i < size; ++i) {
+    if (child_vector[i].IsNull())
+      real_size--;
+  }
+
+  if (real_size > 0) {
+    WriteInteger(real_size, obj);

[sky, 2011/05/18 22:39:07]

Move this to before the if and nuke the else.

+    for (size_t i = 0, size = child_vector.size(); i < size; ++i) {
+      if (!child_vector[i].IsNull())
+        WriteHistoryItem(child_vector[i], obj);
+    }
+  } else {
+    WriteInteger(0, obj);
+  }
 }
 
 // Creates a new HistoryItem tree based on the serialized string.
 // Assumes the data is in the format returned by WriteHistoryItem.
 WebHistoryItem ReadHistoryItem(
     const SerializeObject* obj,
     bool include_form_data,
     bool include_scroll_offset) {
   // See note in WriteHistoryItem. on this.
   obj->version = ReadInteger(obj);
@@ skipping 146 matching lines @@
   kVersion = version;
 
   SerializeObject obj;
   WriteHistoryItem(item, &obj);
   *serialized_item = obj.GetAsString();
 
   kVersion = real_version;
 }
 
 }  // namespace webkit_glue