Fix missing back navigation item when pending item is displayed.

ios/web/navigation/crw_session_controller_unittest.mm

 // Copyright 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #import "ios/web/navigation/crw_session_controller.h"
 
 #import <Foundation/Foundation.h>
 
 #include <utility>
 
@@ skipping 976 matching lines @@
   [session_controller_ commitPendingItem];
   [session_controller_
                addPendingItem:GURL("http://www.example.com/2")
                      referrer:MakeReferrer("http://www.example.com/c")
                    transition:ui::PAGE_TRANSITION_LINK
                initiationType:web::NavigationInitiationType::USER_INITIATED
       userAgentOverrideOption:UserAgentOverrideOption::INHERIT];
   [session_controller_ commitPendingItem];
 
   EXPECT_EQ(3, session_controller_.get().lastCommittedItemIndex);
-  web::NavigationItemList backItems = [session_controller_ backwardItems];
-  EXPECT_EQ(2U, backItems.size());
+  web::NavigationItemList back_items = [session_controller_ backwardItems];
+  EXPECT_EQ(2U, back_items.size());
   EXPECT_TRUE([session_controller_ forwardItems].empty());
-  EXPECT_EQ("http://www.example.com/redirect", backItems[0]->GetURL().spec());
+  EXPECT_EQ("http://www.example.com/redirect", back_items[0]->GetURL().spec());
 
   [session_controller_ goToItemAtIndex:1 discardNonCommittedItems:NO];
   EXPECT_EQ(1U, [session_controller_ backwardItems].size());
   EXPECT_EQ(1U, [session_controller_ forwardItems].size());
 
   [session_controller_ goToItemAtIndex:0 discardNonCommittedItems:NO];
   web::NavigationItemList forwardItems = [session_controller_ forwardItems];
   EXPECT_EQ(0U, [session_controller_ backwardItems].size());
   EXPECT_EQ(2U, forwardItems.size());
   EXPECT_EQ("http://www.example.com/2", forwardItems[1]->GetURL().spec());
@@ skipping 218 matching lines @@
   [session_controller_
                addPendingItem:GURL("http://www.example.com/0")
                      referrer:MakeReferrer("http://www.example.com/b")
                    transition:ui::PAGE_TRANSITION_CLIENT_REDIRECT
                initiationType:web::NavigationInitiationType::RENDERER_INITIATED
       userAgentOverrideOption:UserAgentOverrideOption::INHERIT];
   [session_controller_ commitPendingItem];
   EXPECT_EQ(0U, [session_controller_ backwardItems].size());
 }
 
+// Tests that |-backwardItems| returns all committed items if there is an
+// uncommitted pending item. This can happend if the pending page loading is
+// intercepted by safe browsing. See crbug.com/691311.
+TEST_F(CRWSessionControllerTest,
+       BackwardItemsShouldContainAllCommittedIfCurrentIsPending) {
+  [session_controller_
+               addPendingItem:GURL("http://www.example.com/0")
+                     referrer:MakeReferrer("http://www.example.com/a")
+                   transition:ui::PAGE_TRANSITION_LINK
+               initiationType:web::NavigationInitiationType::USER_INITIATED
+      userAgentOverrideOption:UserAgentOverrideOption::INHERIT];
+  [session_controller_ commitPendingItem];
+  [session_controller_
+               addPendingItem:GURL("http://www.example.com/1")
+                     referrer:MakeReferrer("http://www.example.com/b")
+                   transition:ui::PAGE_TRANSITION_LINK
+               initiationType:web::NavigationInitiationType::USER_INITIATED
+      userAgentOverrideOption:UserAgentOverrideOption::INHERIT];
+
+  EXPECT_EQ(0, session_controller_.get().lastCommittedItemIndex);
+  EXPECT_TRUE([session_controller_ pendingItem]);
+  EXPECT_EQ(-1, [session_controller_ pendingItemIndex]);
+  EXPECT_EQ(GURL("http://www.example.com/1"), [session_controller_ currentURL]);
+
+  web::NavigationItemList back_items = [session_controller_ backwardItems];
+  ASSERT_EQ(1U, back_items.size());
+  EXPECT_EQ("http://www.example.com/0", back_items[0]->GetURL().spec());
+}
+
+// Tests that |-backwardItems| returns all committed items if there is a
+// transient item. This can happen if an intersitial was loaded for safe
+// browsing. See crbug.com/691311.
+TEST_F(CRWSessionControllerTest,
+       BackwardItemsShouldContainAllCommittedIfCurrentIsTransient) {
+  [session_controller_
+               addPendingItem:GURL("http://www.example.com/0")
+                     referrer:MakeReferrer("http://www.example.com/a")
+                   transition:ui::PAGE_TRANSITION_LINK
+               initiationType:web::NavigationInitiationType::USER_INITIATED
+      userAgentOverrideOption:UserAgentOverrideOption::INHERIT];
+  [session_controller_ commitPendingItem];
+  [session_controller_
+      addTransientItemWithURL:GURL("http://www.example.com/1")];
+
+  EXPECT_EQ(0, session_controller_.get().lastCommittedItemIndex);
+  EXPECT_TRUE([session_controller_ transientItem]);
+  EXPECT_EQ(GURL("http://www.example.com/1"), [session_controller_ currentURL]);
+
+  web::NavigationItemList back_items = [session_controller_ backwardItems];
+  ASSERT_EQ(1U, back_items.size());
+  EXPECT_EQ("http://www.example.com/0", back_items[0]->GetURL().spec());
+}
+
 }  // anonymous namespace