Ensure that CopyStateFromAndPrune doesn't exceed kMaxSessionHistoryEntries.

content/browser/tab_contents/navigation_controller_impl.cc

Index: content/browser/tab_contents/navigation_controller_impl.cc
diff --git a/content/browser/tab_contents/navigation_controller_impl.cc b/content/browser/tab_contents/navigation_controller_impl.cc
index e8d722d1a1843bd974b0ffc670af912c2836c958..5cdd8cceef9f8cdf2365b557bee42ce558228b1e 100644
--- a/content/browser/tab_contents/navigation_controller_impl.cc
+++ b/content/browser/tab_contents/navigation_controller_impl.cc
@@ -412,6 +412,7 @@ int NavigationControllerImpl::GetLastCommittedEntryIndex() const {
 }
 
 int NavigationControllerImpl::GetEntryCount() const {
+  DCHECK(entries_.size() <= max_entry_count());
   return static_cast<int>(entries_.size());
 }
 
@@ -1077,6 +1078,12 @@ void NavigationControllerImpl::CopyStateFromAndPrune(
   // Remove all the entries leaving the active entry.
   PruneAllButActive();
 
+  // We now have zero or one entries.  Ensure that adding the entries from
+  // source won't put us over the limit.
+  DCHECK(GetEntryCount() == 0 || GetEntryCount() == 1);
+  if (GetEntryCount() > 0)
+    source->PruneOldestEntryIfFull();
+
   // Insert the entries from source. Don't use source->GetCurrentEntryIndex as
   // we don't want to copy over the transient entry.
   int max_source_index = source->pending_entry_index_ != -1 ?
@@ -1237,11 +1244,7 @@ void NavigationControllerImpl::InsertOrReplaceEntry(NavigationEntryImpl* entry,
       NotifyPrunedEntries(this, false, num_pruned);
   }
 
-  if (entries_.size() >= max_entry_count()) {
-    DCHECK(last_committed_entry_index_ > 0);
-    RemoveEntryAtIndex(0);
-    NotifyPrunedEntries(this, true, 1);
-  }
+  PruneOldestEntryIfFull();
 
   entries_.push_back(linked_ptr<NavigationEntryImpl>(entry));
   last_committed_entry_index_ = static_cast<int>(entries_.size()) - 1;
@@ -1250,6 +1253,15 @@ void NavigationControllerImpl::InsertOrReplaceEntry(NavigationEntryImpl* entry,
   tab_contents_->UpdateMaxPageID(entry->GetPageID());
 }
 
+void NavigationControllerImpl::PruneOldestEntryIfFull() {
+  if (entries_.size() >= max_entry_count()) {
+    DCHECK_EQ(max_entry_count(), entries_.size());
+    DCHECK(last_committed_entry_index_ > 0);
+    RemoveEntryAtIndex(0);
+    NotifyPrunedEntries(this, true, 1);
+  }
+}
+
 void NavigationControllerImpl::NavigateToPendingEntry(ReloadType reload_type) {
   needs_reload_ = false;