Fix crash in NavigationControllerImpl::RendererDidNavigateToNewPage

content/browser/frame_host/navigation_controller_impl_unittest.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "base/basictypes.h"
 #include "base/bind.h"
 #include "base/file_util.h"
 #include "base/memory/scoped_ptr.h"
 #include "base/path_service.h"
 #include "base/stl_util.h"
@@ skipping 2243 matching lines @@
   {
     const GURL url("http://foo2/");
     controller.GoBack();
     main_test_rfh()->SendNavigate(1, url);
     EXPECT_EQ(1U, navigation_entry_committed_counter_);
     navigation_entry_committed_counter_ = 0;
     EXPECT_EQ(url, controller.GetVisibleEntry()->GetURL());
   }
 }
 
+TEST_F(NavigationControllerTest, PushStateWithoutPreviousEntry)
+{
+  ASSERT_FALSE(controller_impl().GetLastCommittedEntry());
+  FrameHostMsg_DidCommitProvisionalLoad_Params params;
+  GURL url("http://foo");
+  params.page_id = 1;
+  params.url = url;
+  params.page_state = PageState::CreateFromURL(url);
+  params.was_within_same_page = true;
+  test_rvh()->SendNavigateWithParams(&params);
+  // We pass if we don't crash.
+}
+
 // NotificationObserver implementation used in verifying we've received the
 // NOTIFICATION_NAV_LIST_PRUNED method.
 class PrunedListener : public NotificationObserver {
  public:
   explicit PrunedListener(NavigationControllerImpl* controller)
       : notification_count_(0) {
     registrar_.Add(this, NOTIFICATION_NAV_LIST_PRUNED,
                    Source<NavigationController>(controller));
   }
 
@@ skipping 2016 matching lines @@
   params.post_id = -1;
   test_rvh()->SendNavigateWithParams(&params);
 
   // Now reload. replaceState overrides the POST, so we should not show a
   // repost warning dialog.
   controller_impl().Reload(true);
   EXPECT_EQ(0, delegate->repost_form_warning_count());
 }
 
 }  // namespace content