Fix missing back navigation item when pending item is displayed.

ios/web/navigation/crw_session_controller.mm

 // Copyright 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #import "ios/web/navigation/crw_session_controller.h"
 
 #include <stddef.h>
 
 #include <algorithm>
 #include <utility>
@@ skipping 184 matching lines @@
   return index == -1 ? nullptr : self.items[index].get();
 }
 
 - (web::NavigationItemImpl*)previousItem {
   NSInteger index = self.previousItemIndex;
   return index == -1 || self.items.empty() ? nullptr : self.items[index].get();
 }
 
 - (web::NavigationItemList)backwardItems {
   web::NavigationItemList items;
-  for (size_t index = _lastCommittedItemIndex; index > 0; --index) {
-    if (![self isRedirectTransitionForItemAtIndex:index])
-      items.push_back(self.items[index - 1].get());
+
+  // This explicit check is necessary to protect the loop below which uses an
+  // unsafe signed (NSInteger) to unsigned (size_t) conversion.
+  if (_lastCommittedItemIndex > -1) {
+    // If the current navigation item is a transient item (e.g. SSL
+    // interstitial), the last committed item should also be considered part of
+    // the backward history.
+    DCHECK(self.lastCommittedItem);
+    if (self.transientItem) {
+      items.push_back(self.lastCommittedItem);
+    }
+
+    for (size_t index = _lastCommittedItemIndex; index > 0; --index) {
+      if (![self isRedirectTransitionForItemAtIndex:index])
+        items.push_back(self.items[index - 1].get());
+    }
   }
   return items;
 }
 
 - (web::NavigationItemList)forwardItems {
   web::NavigationItemList items;
   NSUInteger lastNonRedirectedIndex = _lastCommittedItemIndex + 1;
   while (lastNonRedirectedIndex < self.items.size()) {
     web::NavigationItem* item = self.items[lastNonRedirectedIndex].get();
     if (!ui::PageTransitionIsRedirect(item->GetTransitionType()))
@@ skipping 439 matching lines @@
   return item;
 }
 
 - (BOOL)isRedirectTransitionForItemAtIndex:(size_t)index {
   DCHECK_LT(index, self.items.size());
   ui::PageTransition transition = self.items[index]->GetTransitionType();
   return (transition & ui::PAGE_TRANSITION_IS_REDIRECT_MASK) ? YES : NO;
 }
 
 @end