Hack around crash.

chrome/browser/navigation_controller.cc

 // Copyright (c) 2006-2008 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/navigation_controller.h"
 
 #include "base/command_line.h"
 #include "base/file_util.h"
 #include "base/logging.h"
 #include "base/string_util.h"
@@ skipping 844 matching lines @@
 
     entries_.pop_back();
 
     if (last_committed_entry_index_ >= current_size - 1) {
       last_committed_entry_index_ = current_size - 2;
 
       if (last_committed_entry_index_ != -1) {
         // Broadcast the notification of the navigation. This is kind of a hack,
         // since the navigation wasn't actually committed. But this function is
         // used for interstital pages, and the UI needs to get updated when the
-        // interstitial page
+        // interstitial page. Since we want to preserve the SSL state, we
+        // recreate the serialized security info so the SSL manager doesn't
+        // clear out the state (thinking it just got a commit from the renderer
+        // with no security state).
         LoadCommittedDetails details;
         details.entry = GetActiveEntry();
         details.is_auto = false;
         details.is_in_page = false;
         details.is_main_frame = true;
+        details.serialized_security_info = SSLManager::SerializeSecurityInfo(
+            details.entry->ssl().cert_id(),
+            details.entry->ssl().cert_status(),
+            details.entry->ssl().security_bits());
         NotifyNavigationEntryCommitted(&details);
       }
     }
 
     NotifyPrunedEntries(this, false, 1);
   }
 }
 
 void NavigationController::AddDummyEntryForInterstitial(
     const NavigationEntry& clone_me) {
@@ skipping 21 matching lines @@
   return AreURLsInPageNavigation(last_committed->url(), url);
 }
 
 void NavigationController::DiscardPendingEntry() {
   DiscardPendingEntryInternal();
 
   // Synchronize the active_contents_ to the last committed entry.
   NavigationEntry* last_entry = GetLastCommittedEntry();
   if (last_entry && last_entry->tab_type() != active_contents_->type()) {
     TabContents* from_contents = active_contents_;
+    if (from_contents->type() == active_contents_->type()) {
+      // EVIL HACK ALERT! This condition is a wallpaper patch around bug
+      // http://code.google.com/p/chromium/issues/detail?id=2855
+      // See the bug for more, but the short answer is that an old render view
+      // host's "cancel" message will get received by a newer one that happens
+      // to be navigated to the same URL, which will trigger improperly
+      // discarding the pending entry. This will in turn trigger tab contents
+      // collection and other bad things.
+      //
+      // This early return doesn't fix the problem at all, but does prevent the
+      // immediate crash. There are very likely to be problems as a result of
+      // the confused state that this generates, so the underlying bug really
+      // needs to be fixed!
+      return;
+    }
     from_contents->set_is_active(false);
 
     // Switch back to the previous tab contents.
     active_contents_ = GetTabContents(last_entry->tab_type());
     DCHECK(active_contents_);
 
     active_contents_->set_is_active(true);
 
     // If we are transitioning from two types of WebContents, we need to migrate
     // the download shelf if it is visible. The download shelf may have been
@@ skipping 298 matching lines @@
 int NavigationController::GetEntryIndexWithPageID(
     TabContentsType type, SiteInstance* instance, int32 page_id) const {
   for (int i = static_cast<int>(entries_.size()) - 1; i >= 0; --i) {
     if ((entries_[i]->tab_type() == type) &&
         (entries_[i]->site_instance() == instance) &&
         (entries_[i]->page_id() == page_id))
       return i;
   }
   return -1;
 }