This adds a Flush to the session backend to help with data corruption

webkit/glue/glue_serialize.cc

Index: webkit/glue/glue_serialize.cc
diff --git a/webkit/glue/glue_serialize.cc b/webkit/glue/glue_serialize.cc
index 0a3d887b9978d848e967416ba34b60d6d7fbd62c..558b1bcc85c6d465227737e23f93a2ccd262961a 100644
--- a/webkit/glue/glue_serialize.cc
+++ b/webkit/glue/glue_serialize.cc
@@ -296,6 +296,10 @@ WebHTTPBody ReadFormData(const SerializeObject* obj) {
 // serialization.
 void WriteHistoryItem(
     const WebHistoryItem& item, SerializeObject* obj) {
+  // If the history item is not valid, then just return.
+  if (item.IsNull())
+    return;
+
   // WARNING: This data may be persisted for later use. As such, care must be
   // taken when changing the serialized format. If a new field needs to be
   // written, only adding at the end will make it easier to deal with loading
@@ -328,17 +332,32 @@ void WriteHistoryItem(
       WriteString(item.stateObject().toString(), obj);
   }
 
-  // Yes, the referrer is written twice.  This is for backwards
-  // compatibility with the format.
   WriteFormData(item.httpBody(), obj);
   WriteString(item.httpContentType(), obj);
+
+  // Yes, the referrer is written twice.  This is for backwards
+  // compatibility with the format.
   WriteString(item.referrer(), obj);
 
-  // Subitems
-  const WebVector<WebHistoryItem>& children = item.children();
-  WriteInteger(static_cast<int>(children.size()), obj);
-  for (size_t i = 0, c = children.size(); i < c; ++i)
-    WriteHistoryItem(children[i], obj);
+  // Write subitems, making sure that we skip any NULL items (which
+  // can occur with corrupted input), and adjust the item count to
+  // match.
+  const WebVector<WebHistoryItem>& child_vector = item.children();
+  int real_size = static_cast<int>(child_vector.size());
+  for (size_t i = 0, size = child_vector.size(); i < size; ++i) {
+    if (child_vector[i].IsNull())
+      real_size--;
+  }
+
+  if (real_size > 0) {
+    WriteInteger(real_size, obj);

[sky, 2011/05/18 22:39:07]

Move this to before the if and nuke the else.

+    for (size_t i = 0, size = child_vector.size(); i < size; ++i) {
+      if (!child_vector[i].IsNull())
+        WriteHistoryItem(child_vector[i], obj);
+    }
+  } else {
+    WriteInteger(0, obj);
+  }
 }
 
 // Creates a new HistoryItem tree based on the serialized string.