Fix NavController buffer overflow found by IPC fuzzer.

content/browser/frame_host/navigation_controller_impl.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 /*
  * Copyright (C) 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
  * Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)
  * Copyright (C) 2008, 2009 Torch Mobile Inc. All rights reserved.
  *     (http://www.torchmobile.com/)
  *
@@ skipping 1609 matching lines @@
   // then the renderer navigated on its own, independent of the pending entry,
   // so don't copy anything.
   if (pending_entry_ && pending_entry_index_ == -1)
     entry->set_unique_id(pending_entry_->GetUniqueID());
 
   DiscardNonCommittedEntriesInternal();
 
   int current_size = static_cast<int>(entries_.size());
 
   // When replacing, don't prune the forward history.
-  if (replace) {
-    DCHECK_GT(current_size, 0);
+  if (replace && current_size > 0) {
     int32 page_id = entry->GetPageID();
 
     // ScopedVectors don't automatically delete the replaced value, so make sure
     // the previous value gets deleted.
     scoped_ptr<NavigationEntryImpl> old_entry(
         entries_[last_committed_entry_index_]);
     entries_[last_committed_entry_index_] = entry.release();
 
     // This is a new page ID, so we need everybody to know about it.
     delegate_->UpdateMaxPageID(page_id);
     return;
   }
 
+  // We shouldn't see replace == true when there's no committed entries.
+  DCHECK(!replace);
+
   if (current_size > 0) {
     // Prune any entries which are in front of the current entry.
     // last_committed_entry_index_ must be updated here since calls to
     // NotifyPrunedEntries() below may re-enter and we must make sure
     // last_committed_entry_index_ is not left in an invalid state.
     int num_pruned = 0;
     while (last_committed_entry_index_ < (current_size - 1)) {
       num_pruned++;
       entries_.pop_back();
       current_size--;
@@ skipping 327 matching lines @@
     }
   }
 }
 
 void NavigationControllerImpl::SetGetTimestampCallbackForTest(
     const base::Callback<base::Time()>& get_timestamp_callback) {
   get_timestamp_callback_ = get_timestamp_callback;
 }
 
 }  // namespace content