Set fromEntry to nil after discardNonCommittedItems.

ios/web/web_state/ui/crw_web_controller.mm

 // Copyright 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #import "ios/web/web_state/ui/crw_web_controller.h"
 
 #import <WebKit/WebKit.h>
 
 #import <objc/runtime.h>
 #include <stddef.h>
@@ skipping 2146 matching lines @@
     BOOL sameDocumentNavigation = [sessionController
         isSameDocumentNavigationBetweenItem:fromEntry.navigationItem
                                     andItem:toEntry.navigationItem];
     if (sameDocumentNavigation) {
       [self.sessionController goToItemAtIndex:index];
       // TODO(crbug.com/684098): move this call out this block to avoid code
       // duplication.
       [self webWillFinishHistoryNavigationFromEntry:fromEntry];
       [self updateHTML5HistoryState];
     } else {
+      // TODO(crbug.com/691492): After discardNonCommittedItems, the item
+      // pointed by |fromEntry| may not be valid anymore.
+      // Set |fromEntry| to nil to avoid crash whan using the item.
+      // Remove when the fix is not needed anymore.
+      if ([fromEntry isEqual:sessionController.transientEntry] ||
+          [fromEntry isEqual:sessionController.pendingEntry]) {
+        fromEntry = nil;
+      }
       [sessionController discardNonCommittedItems];
       [sessionController setPendingItemIndex:index];
 
       // TODO(crbug.com/684098): move this call out this block to avoid code
       // duplication.
       [self webWillFinishHistoryNavigationFromEntry:fromEntry];
 
       web::NavigationItemImpl* pendingItem =
           sessionController.pendingEntry.navigationItemImpl;
       pendingItem->SetTransitionType(ui::PageTransitionFromInt(
@@ skipping 217 matching lines @@
     }
   };
   web::BrowserState* browserState = self.webStateImpl->GetBrowserState();
   _passKitDownloader.reset([[CRWPassKitDownloader alloc]
       initWithContextGetter:browserState->GetRequestContext()
           completionHandler:passKitCompletion]);
   return _passKitDownloader.get();
 }
 
 - (void)webWillFinishHistoryNavigationFromEntry:(CRWSessionEntry*)fromEntry {
-  DCHECK(fromEntry);
+  // TODO(crbug.com/691492): Removing the DCHECK as |fromEntry| may be nil if
+  // the pending entry was discarded.
+  // Remove when the fix is not needed anymore.
+  // DCHECK(fromEntry);
   [self updateDesktopUserAgentForEntry:self.currentSessionEntry
                              fromEntry:fromEntry];
   [_delegate webWillFinishHistoryNavigationFromEntry:fromEntry];
 }
 
 - (void)updateDesktopUserAgentForEntry:(CRWSessionEntry*)entry
                              fromEntry:(CRWSessionEntry*)fromEntry {
   web::NavigationItemImpl* item = entry.navigationItemImpl;
   web::NavigationItemImpl* fromItem = fromEntry.navigationItemImpl;
   if (!item || !fromItem)
@@ skipping 2899 matching lines @@
 - (void)simulateLoadRequestWithURL:(const GURL&)URL {
   _lastRegisteredRequestURL = URL;
   _loadPhase = web::LOAD_REQUESTED;
 }
 
 - (NSString*)refererFromNavigationAction:(WKNavigationAction*)action {
   return [action.request valueForHTTPHeaderField:@"Referer"];
 }
 
 @end