fix tab restore service crash

chrome/browser/sessions/tab_restore_service.cc

Index: chrome/browser/sessions/tab_restore_service.cc
diff --git a/chrome/browser/sessions/tab_restore_service.cc b/chrome/browser/sessions/tab_restore_service.cc
index 99d1153ad5121f0117a195facf8edf32fc48dc83..3d7698087142f98bb66bc67907b884906492e2b0 100644
--- a/chrome/browser/sessions/tab_restore_service.cc
+++ b/chrome/browser/sessions/tab_restore_service.cc
@@ -537,8 +537,10 @@ void TabRestoreService::AddEntry(Entry* entry, bool notify, bool to_front) {
   else
     entries_.push_back(entry);
 
-  if (notify)
+  if (notify) {
+    PruneEntries();

[sky, 2011/12/01 21:46:49]

How come we only prune if we're notifying?

[Evan Stade, 2011/12/02 02:22:27]

I did this because it was how the code worked before, but I guess we should
always do it.

     NotifyTabsChanged();
+  }
 
   // Start the save timer, when it fires we'll generate the commands.
   StartSaveTimer();
@@ -1121,7 +1123,7 @@ void TabRestoreService::LoadStateChanged() {
   // We're done loading.
   load_state_ ^= LOADING;
 
-  if (entries_.size() == kMaxEntries) {
+  if (staging_entries_.empty() || entries_.size() >= kMaxEntries) {
     STLDeleteElements(&staging_entries_);
     return;
   }
@@ -1130,7 +1132,9 @@ void TabRestoreService::LoadStateChanged() {
     // If we add all the staged entries we'll end up with more than
     // kMaxEntries. Delete entries such that we only end up with
     // at most kMaxEntries.
-    DCHECK(entries_.size() < kMaxEntries);
+    int surplus = kMaxEntries - entries_.size();
+    CHECK_LE(0, surplus);
+    CHECK_GE(static_cast<int>(staging_entries_.size()), surplus);
     STLDeleteContainerPointers(
         staging_entries_.begin() + (kMaxEntries - entries_.size()),
         staging_entries_.end());