Fix NavController buffer overflow found by IPC fuzzer.

content/browser/frame_host/navigation_controller_impl.cc

Index: content/browser/frame_host/navigation_controller_impl.cc
diff --git a/content/browser/frame_host/navigation_controller_impl.cc b/content/browser/frame_host/navigation_controller_impl.cc
index df3413c8d9574185287dc1862b509fc7a3c04671..05faf3b0e6e3e42611785efbbbd78ee34df91129 100644
--- a/content/browser/frame_host/navigation_controller_impl.cc
+++ b/content/browser/frame_host/navigation_controller_impl.cc
@@ -1627,8 +1627,7 @@ void NavigationControllerImpl::InsertOrReplaceEntry(
   int current_size = static_cast<int>(entries_.size());
 
   // When replacing, don't prune the forward history.
-  if (replace) {
-    DCHECK_GT(current_size, 0);
+  if (replace && current_size > 0) {
     int32 page_id = entry->GetPageID();
 
     // ScopedVectors don't automatically delete the replaced value, so make sure
@@ -1642,6 +1641,9 @@ void NavigationControllerImpl::InsertOrReplaceEntry(
     return;
   }
 
+  // We shouldn't see replace == true when there's no committed entries.
+  DCHECK(!replace);
+
   if (current_size > 0) {
     // Prune any entries which are in front of the current entry.
     // last_committed_entry_index_ must be updated here since calls to