fix tab restore service crash

chrome/browser/sessions/tab_restore_service.cc

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/sessions/tab_restore_service.h"
 
 #include <algorithm>
 #include <iterator>
 #include <map>
 
@@ skipping 519 matching lines @@
   if (!FilterEntry(entry) || (entries_.size() >= kMaxEntries && !to_front)) {
     delete entry;
     return;
   }
 
   if (to_front)
     entries_.push_front(entry);
   else
     entries_.push_back(entry);
 
+  PruneEntries();
+
   if (notify)
     NotifyTabsChanged();
 
   // Start the save timer, when it fires we'll generate the commands.
   StartSaveTimer();
   entries_to_write_++;
 }
 
 void TabRestoreService::PruneEntries() {
   Entries new_entries;
@@ skipping 564 matching lines @@
 void TabRestoreService::LoadStateChanged() {
   if ((load_state_ & (LOADED_LAST_TABS | LOADED_LAST_SESSION)) !=
       (LOADED_LAST_TABS | LOADED_LAST_SESSION)) {
     // Still waiting on previous session or previous tabs.
     return;
   }
 
   // We're done loading.
   load_state_ ^= LOADING;
 
-  if (entries_.size() == kMaxEntries) {
+  if (staging_entries_.empty() || entries_.size() >= kMaxEntries) {
     STLDeleteElements(&staging_entries_);
     return;
   }
 
   if (staging_entries_.size() + entries_.size() > kMaxEntries) {
     // If we add all the staged entries we'll end up with more than
     // kMaxEntries. Delete entries such that we only end up with
     // at most kMaxEntries.
-    DCHECK(entries_.size() < kMaxEntries);
+    int surplus = kMaxEntries - entries_.size();
+    CHECK_LE(0, surplus);
+    CHECK_GE(static_cast<int>(staging_entries_.size()), surplus);
     STLDeleteContainerPointers(
         staging_entries_.begin() + (kMaxEntries - entries_.size()),
         staging_entries_.end());
     staging_entries_.erase(
         staging_entries_.begin() + (kMaxEntries - entries_.size()),
         staging_entries_.end());
   }
 
   // And add them.
   for (size_t i = 0; i < staging_entries_.size(); ++i) {
@@ skipping 10 matching lines @@
   // the front, not the end and we just added the entries to the end).
   entries_to_write_ = staging_entries_.size();
 
   PruneEntries();
   NotifyTabsChanged();
 }
 
 Time TabRestoreService::TimeNow() const {
   return time_factory_ ? time_factory_->TimeNow() : Time::Now();
 }