Fix missing back navigation item when pending item is displayed.

ios/web/navigation/crw_session_controller_unittest.mm

Index: ios/web/navigation/crw_session_controller_unittest.mm
diff --git a/ios/web/navigation/crw_session_controller_unittest.mm b/ios/web/navigation/crw_session_controller_unittest.mm
index b23a26b5f028a90b09e4f5c02ba2d44d5adf758d..eb674c26447a20f5e13e81b50e739f7925adc27a 100644
--- a/ios/web/navigation/crw_session_controller_unittest.mm
+++ b/ios/web/navigation/crw_session_controller_unittest.mm
@@ -994,10 +994,10 @@ TEST_F(CRWSessionControllerTest, TestBackwardForwardItems) {
   [session_controller_ commitPendingItem];
 
   EXPECT_EQ(3, session_controller_.get().lastCommittedItemIndex);
-  web::NavigationItemList backItems = [session_controller_ backwardItems];
-  EXPECT_EQ(2U, backItems.size());
+  web::NavigationItemList back_items = [session_controller_ backwardItems];
+  EXPECT_EQ(2U, back_items.size());
   EXPECT_TRUE([session_controller_ forwardItems].empty());
-  EXPECT_EQ("http://www.example.com/redirect", backItems[0]->GetURL().spec());
+  EXPECT_EQ("http://www.example.com/redirect", back_items[0]->GetURL().spec());
 
   [session_controller_ goToItemAtIndex:1 discardNonCommittedItems:NO];
   EXPECT_EQ(1U, [session_controller_ backwardItems].size());
@@ -1236,4 +1236,57 @@ TEST_F(CRWSessionControllerTest, BackwardItemsForAllRedirects) {
   EXPECT_EQ(0U, [session_controller_ backwardItems].size());
 }
 
+// Tests that |-backwardItems| returns all committed items if there is an
+// uncommitted pending item. This can happend if the pending page loading is
+// intercepted by safe browsing. See crbug.com/691311.
+TEST_F(CRWSessionControllerTest,
+       BackwardItemsShouldContainAllCommittedIfCurrentIsPending) {
+  [session_controller_
+               addPendingItem:GURL("http://www.example.com/0")
+                     referrer:MakeReferrer("http://www.example.com/a")
+                   transition:ui::PAGE_TRANSITION_LINK
+               initiationType:web::NavigationInitiationType::USER_INITIATED
+      userAgentOverrideOption:UserAgentOverrideOption::INHERIT];
+  [session_controller_ commitPendingItem];
+  [session_controller_
+               addPendingItem:GURL("http://www.example.com/1")
+                     referrer:MakeReferrer("http://www.example.com/b")
+                   transition:ui::PAGE_TRANSITION_LINK
+               initiationType:web::NavigationInitiationType::USER_INITIATED
+      userAgentOverrideOption:UserAgentOverrideOption::INHERIT];
+
+  EXPECT_EQ(0, session_controller_.get().lastCommittedItemIndex);
+  EXPECT_TRUE([session_controller_ pendingItem]);
+  EXPECT_EQ(-1, [session_controller_ pendingItemIndex]);
+  EXPECT_EQ(GURL("http://www.example.com/1"), [session_controller_ currentURL]);
+
+  web::NavigationItemList back_items = [session_controller_ backwardItems];
+  ASSERT_EQ(1U, back_items.size());
+  EXPECT_EQ("http://www.example.com/0", back_items[0]->GetURL().spec());
+}
+
+// Tests that |-backwardItems| returns all committed items if there is a
+// transient item. This can happen if an intersitial was loaded for safe
+// browsing. See crbug.com/691311.
+TEST_F(CRWSessionControllerTest,
+       BackwardItemsShouldContainAllCommittedIfCurrentIsTransient) {
+  [session_controller_
+               addPendingItem:GURL("http://www.example.com/0")
+                     referrer:MakeReferrer("http://www.example.com/a")
+                   transition:ui::PAGE_TRANSITION_LINK
+               initiationType:web::NavigationInitiationType::USER_INITIATED
+      userAgentOverrideOption:UserAgentOverrideOption::INHERIT];
+  [session_controller_ commitPendingItem];
+  [session_controller_
+      addTransientItemWithURL:GURL("http://www.example.com/1")];
+
+  EXPECT_EQ(0, session_controller_.get().lastCommittedItemIndex);
+  EXPECT_TRUE([session_controller_ transientItem]);
+  EXPECT_EQ(GURL("http://www.example.com/1"), [session_controller_ currentURL]);
+
+  web::NavigationItemList back_items = [session_controller_ backwardItems];
+  ASSERT_EQ(1U, back_items.size());
+  EXPECT_EQ("http://www.example.com/0", back_items[0]->GetURL().spec());
+}
+
 }  // anonymous namespace