Fix missing back navigation item when pending item is displayed.

ios/web/navigation/crw_session_controller.mm

 // Copyright 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #import "ios/web/navigation/crw_session_controller.h"
 
 #include <stddef.h>
 
 #include <algorithm>
 #include <utility>
@@ skipping 184 matching lines @@
   return index == -1 ? nullptr : self.items[index].get();
 }
 
 - (web::NavigationItemImpl*)previousItem {
   NSInteger index = self.previousItemIndex;
   return index == -1 || self.items.empty() ? nullptr : self.items[index].get();
 }
 
 - (web::NavigationItemList)backwardItems {
   web::NavigationItemList items;
+
+  // If the current navigation item is a transient item (e.g. SSL interstitial),
+  // the last committed item should also be considered part of the backward
+  // history.
+  if (self.transientItem) {
+    items.push_back(self.items[_lastCommittedItemIndex].get());

[kkhorimoto, 2017/04/26 10:50:37]

Optional nit: items.push_back(self.lastCommittedItem)

+  }
+
   for (size_t index = _lastCommittedItemIndex; index > 0; --index) {
     if (![self isRedirectTransitionForItemAtIndex:index])
       items.push_back(self.items[index - 1].get());
   }
   return items;
 }
 
 - (web::NavigationItemList)forwardItems {
   web::NavigationItemList items;
   NSUInteger lastNonRedirectedIndex = _lastCommittedItemIndex + 1;
@@ skipping 442 matching lines @@
   return item;
 }
 
 - (BOOL)isRedirectTransitionForItemAtIndex:(size_t)index {
   DCHECK_LT(index, self.items.size());
   ui::PageTransition transition = self.items[index]->GetTransitionType();
   return (transition & ui::PAGE_TRANSITION_IS_REDIRECT_MASK) ? YES : NO;
 }
 
 @end