Set fromEntry to nil after discardNonCommittedItems.

ios/web/web_state/ui/crw_web_controller.mm

Index: ios/web/web_state/ui/crw_web_controller.mm
diff --git a/ios/web/web_state/ui/crw_web_controller.mm b/ios/web/web_state/ui/crw_web_controller.mm
index 19a95a60e53e49fa95a2123711e9f9f759feb4a8..91c187aab7e7b430def193032a00666735113b48 100644
--- a/ios/web/web_state/ui/crw_web_controller.mm
+++ b/ios/web/web_state/ui/crw_web_controller.mm
@@ -2165,6 +2165,10 @@ const NSTimeInterval kSnapshotOverlayTransition = 0.5;
       [self updateHTML5HistoryState];
     } else {
       [sessionController discardNonCommittedItems];

[sdefresne, 2017/02/13 10:47:36]

I think we should instead retain the fromEntry, by changing the type to
base::scoped_nsobject<CRWSessionEntry>.

[Olivier, 2017/02/13 12:21:05]

Thanks

I cannot retain the fromEntry as CRWSessionEntry does not own the
navigationItem.
Even if the entry is retained, the inside pointer will be invalid.

As discussed offline, I also tried to set the entry to nil.
But the first instruction of |webWillFinishHistoryNavigationFromEntry:| is
DCHECK(fromEntry), which obviously lead to a crash.

[Olivier, 2017/02/13 13:21:24]

Done. PTAL.

+      // TODO(crbug.com/691492): After discardNonCommittedItems, fromEntry may
+      // not be valid anymore. Refetch it from the sessionController.
+      // Remove when the fix is not needed anymore.
+      fromEntry = sessionController.currentEntry;
       [sessionController setPendingItemIndex:index];
 
       // TODO(crbug.com/684098): move this call out this block to avoid code