Don't ignore back navigations after max entry limit is reached.

content/renderer/render_view.cc

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/renderer/render_view.h"
 
 #include <algorithm>
 #include <cmath>
 #include <string>
 #include <vector>
@@ skipping 836 matching lines @@
   DCHECK_EQ(static_cast<int>(history_page_ids_.size()), history_list_length_);
 
   // Check for whether the forward history has been cropped due to a recent
   // navigation the browser didn't know about.
   if (params.pending_history_list_offset >= history_list_length_)
     return true;
 
   // Check for whether this entry has been replaced with a new one.
   int expected_page_id =
       history_page_ids_[params.pending_history_list_offset];
-  if (expected_page_id > 0 && params.page_id != expected_page_id)
-    return true;
+  if (expected_page_id > 0 && params.page_id != expected_page_id) {
+    if (params.page_id < expected_page_id)
+      return true;
+
+    // Otherwise we've removed an earlier entry and should have shifted all
+    // entries left.  For now, it's ok to lazily update the list.
+    // TODO(creis): Notify all live renderers when we remove entries from
+    // the front of the list, so that we don't hit this case.
+    history_page_ids_[params.pending_history_list_offset] = params.page_id;
+  }
 
   return false;
 }
 
 // Stop loading the current page
 void RenderView::OnStop() {
   if (webview()) {
     WebFrame* main_frame = webview()->mainFrame();
     // Stop the alt error page fetcher. If we let it continue it may complete
     // and cause RenderViewHostManager to swap to this RenderView, even though
@@ skipping 3615 matching lines @@
 }
 #endif
 
 void RenderView::OnContextMenuClosed(
     const webkit_glue::CustomContextMenuContext& custom_context) {
   if (custom_context.is_pepper_menu)
     pepper_delegate_.OnContextMenuClosed(custom_context);
   else
     context_menu_node_.reset();
 }