Fix regression with back-button not working on prerendered and instant pages.

content/browser/tab_contents/navigation_controller.cc

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/tab_contents/navigation_controller.h"
 
 #include "base/file_util.h"
 #include "base/logging.h"
 #include "base/string_util.h"
 #include "base/time.h"
@@ skipping 913 matching lines @@
   last_committed_entry_index_ = entry_count() - 1;
   if (pending_entry_index_ != -1)
     pending_entry_index_ = entry_count() - 1;
   if (transient_entry_index_ != -1) {
     // There's a transient entry. In this case we want the last committed to
     // point to the previous entry.
     transient_entry_index_ = entry_count() - 1;
     if (last_committed_entry_index_ != -1)
       last_committed_entry_index_--;
   }
+
+  // Update the history in the RenderView.
+  tab_contents_->SetHistoryLengthAndClear(entry_count() - 1);

[Charlie Reis, 2011/08/09 20:59:31]

There's some hidden assumptions here that make me a little uneasy about putting
this call here.  The comments on CopyStateFromAndPrune seem to suggest this is
somewhat general, but this call assumes all previous entries were not rendered
by the current RenderViewHost and can thus be marked -1.

Just wondering if we should update the comment or contract to say this method is
explicitly for preparing a TabContents to be swapped in.

Outside of that, are we guaranteed this message will be sent before the new
TabContents has a chance to do a history.back() or history.forward()?  Otherwise
that could lead to a race.

[cbentzel, 2011/08/09 21:21:12]

We chatted about history.back() and history.forward() for the prerendered page.
In general these should be no-ops, but I don't think we handle the case where
history.pushState or location setting takes place with this well. 

 }
 
 void NavigationController::PruneAllButActive() {
   if (transient_entry_index_ != -1) {
     // There is a transient entry. Prune up to it.
     DCHECK_EQ(entry_count() - 1, transient_entry_index_);
     entries_.erase(entries_.begin(), entries_.begin() + transient_entry_index_);
     transient_entry_index_ = 0;
     last_committed_entry_index_ = -1;
     pending_entry_index_ = -1;
@@ skipping 224 matching lines @@
   size_t insert_index = 0;
   for (int i = 0; i < max_index; i++) {
     // When cloning a tab, copy all entries except interstitial pages
     if (source.entries_[i].get()->page_type() != INTERSTITIAL_PAGE) {
       entries_.insert(entries_.begin() + insert_index++,
                       linked_ptr<NavigationEntry>(
                           new NavigationEntry(*source.entries_[i])));
     }
   }
 }