Fix regression with back-button not working on prerendered and instant pages.

content/browser/tab_contents/tab_contents.cc

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/tab_contents/tab_contents.h"
 
 #include <cmath>
 
 #include "base/command_line.h"
 #include "base/metrics/histogram.h"
@@ skipping 578 matching lines @@
   FOR_EACH_OBSERVER(TabContentsObserver,
                     observers_,
                     NavigateToPendingEntry(entry.url(), reload_type));
 
   if (delegate_)
     delegate_->DidNavigateToPendingEntry(this);
 
   return true;
 }
 
+void TabContents::SetHistoryLengthAndClear(int history_length) {
+  RenderViewHost* rvh = render_view_host();

[Charlie Reis, 2011/08/09 20:59:31]

This concerns me because a TabContents can have multiple RenderViewHosts (e.g.,
a pending one), making a race possible here if this is called at the wrong time.
 We would not want to send this message to an in-use RenderViewHost, since it
could corrupt its history and lead to worse problems.

Are there assertions we can make here to be sure we're actually swapping in a
new TabContents that doesn't have a pending RVH?

[cbentzel, 2011/08/09 22:22:15]

Is there a way to retrieve whether a NavigationEntry would be handled by a
particular RenderViewHost? I could skip sending this message down if the current
render_view_host_ does not work for the NavigationEntry we are trying to retain
when pruning. 

[Charlie Reis, 2011/08/09 22:51:42]

Yes-- you can compare the SiteInstance of the NavigationEntry (if it has one)
with the SiteInstance of the RVH.  If they don't match, abort.

[Charlie Reis, 2011/08/09 23:25:16]

Please remember this for the followup CL.  (Maybe with a TODO?)

+  if (!rvh)
+    return;
+  rvh->Send(new ViewMsg_SetHistoryLengthAndClear(rvh->routing_id(),
+                                                 history_length));
+}
+
 void TabContents::Stop() {
   render_manager_.Stop();
   FOR_EACH_OBSERVER(TabContentsObserver, observers_, StopNavigation());
 }
 
 TabContents* TabContents::Clone() {
   // We create a new SiteInstance so that the new tab won't share processes
   // with the old one. This can be changed in the future if we need it to share
   // processes for some reason.
   TabContents* tc = new TabContents(
@@ skipping 1295 matching lines @@
 }
 
 void TabContents::SwapInRenderViewHost(RenderViewHost* rvh) {
   render_manager_.SwapInRenderViewHost(rvh);
 }
 
 void TabContents::CreateViewAndSetSizeForRVH(RenderViewHost* rvh) {
   RenderWidgetHostView* rwh_view = view()->CreateViewForWidget(rvh);
   rwh_view->SetSize(view()->GetContainerSize());
 }