Set fromEntry to nil after discardNonCommittedItems.

ios/web/web_state/ui/crw_web_controller.mm

 // Copyright 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #import "ios/web/web_state/ui/crw_web_controller.h"
 
 #import <WebKit/WebKit.h>
 
 #import <objc/runtime.h>
 #include <stddef.h>
@@ skipping 2146 matching lines @@
     BOOL sameDocumentNavigation = [sessionController
         isSameDocumentNavigationBetweenItem:fromEntry.navigationItem
                                     andItem:toEntry.navigationItem];
     if (sameDocumentNavigation) {
       [self.sessionController goToItemAtIndex:index];
       // TODO(crbug.com/684098): move this call out this block to avoid code
       // duplication.
       [self webWillFinishHistoryNavigationFromEntry:fromEntry];
       [self updateHTML5HistoryState];
     } else {
       [sessionController discardNonCommittedItems];

[sdefresne, 2017/02/13 10:47:36]

I think we should instead retain the fromEntry, by changing the type to
base::scoped_nsobject<CRWSessionEntry>.

[Olivier, 2017/02/13 12:21:05]

Thanks

I cannot retain the fromEntry as CRWSessionEntry does not own the
navigationItem.
Even if the entry is retained, the inside pointer will be invalid.

As discussed offline, I also tried to set the entry to nil.
But the first instruction of |webWillFinishHistoryNavigationFromEntry:| is
DCHECK(fromEntry), which obviously lead to a crash.

[Olivier, 2017/02/13 13:21:24]

Done. PTAL.

+      // TODO(crbug.com/691492): After discardNonCommittedItems, fromEntry may
+      // not be valid anymore. Refetch it from the sessionController.
+      // Remove when the fix is not needed anymore.
+      fromEntry = sessionController.currentEntry;
       [sessionController setPendingItemIndex:index];
 
       // TODO(crbug.com/684098): move this call out this block to avoid code
       // duplication.
       [self webWillFinishHistoryNavigationFromEntry:fromEntry];
 
       web::NavigationItemImpl* pendingItem =
           sessionController.pendingEntry.navigationItemImpl;
       pendingItem->SetTransitionType(ui::PageTransitionFromInt(
           pendingItem->GetTransitionType() | ui::PAGE_TRANSITION_FORWARD_BACK));
@@ skipping 3136 matching lines @@
 - (void)simulateLoadRequestWithURL:(const GURL&)URL {
   _lastRegisteredRequestURL = URL;
   _loadPhase = web::LOAD_REQUESTED;
 }
 
 - (NSString*)refererFromNavigationAction:(WKNavigationAction*)action {
   return [action.request valueForHTTPHeaderField:@"Referer"];
 }
 
 @end