Fix regression with back-button not working on prerendered and instant pages.

content/browser/tab_contents/tab_contents.cc

Index: content/browser/tab_contents/tab_contents.cc
diff --git a/content/browser/tab_contents/tab_contents.cc b/content/browser/tab_contents/tab_contents.cc
index 14a387a62d7298b7d325c9325819baf2291c3afb..2965d7efed5c66a1f625ac674c5b490c73ce0d68 100644
--- a/content/browser/tab_contents/tab_contents.cc
+++ b/content/browser/tab_contents/tab_contents.cc
@@ -596,6 +596,14 @@ bool TabContents::NavigateToEntry(
   return true;
 }
 
+void TabContents::SetHistoryLengthAndClear(int history_length) {
+  RenderViewHost* rvh = render_view_host();

[Charlie Reis, 2011/08/09 20:59:31]

This concerns me because a TabContents can have multiple RenderViewHosts (e.g.,
a pending one), making a race possible here if this is called at the wrong time.
 We would not want to send this message to an in-use RenderViewHost, since it
could corrupt its history and lead to worse problems.

Are there assertions we can make here to be sure we're actually swapping in a
new TabContents that doesn't have a pending RVH?

[cbentzel, 2011/08/09 22:22:15]

Is there a way to retrieve whether a NavigationEntry would be handled by a
particular RenderViewHost? I could skip sending this message down if the current
render_view_host_ does not work for the NavigationEntry we are trying to retain
when pruning. 

[Charlie Reis, 2011/08/09 22:51:42]

Yes-- you can compare the SiteInstance of the NavigationEntry (if it has one)
with the SiteInstance of the RVH.  If they don't match, abort.

[Charlie Reis, 2011/08/09 23:25:16]

Please remember this for the followup CL.  (Maybe with a TODO?)

+  if (!rvh)
+    return;
+  rvh->Send(new ViewMsg_SetHistoryLengthAndClear(rvh->routing_id(),
+                                                 history_length));
+}
+
 void TabContents::Stop() {
   render_manager_.Stop();
   FOR_EACH_OBSERVER(TabContentsObserver, observers_, StopNavigation());