Hack around crash.

chrome/browser/navigation_controller.cc

Index: chrome/browser/navigation_controller.cc
===================================================================
--- chrome/browser/navigation_controller.cc	(revision 4450)
+++ chrome/browser/navigation_controller.cc	(working copy)
@@ -862,12 +862,19 @@
         // Broadcast the notification of the navigation. This is kind of a hack,
         // since the navigation wasn't actually committed. But this function is
         // used for interstital pages, and the UI needs to get updated when the
-        // interstitial page
+        // interstitial page. Since we want to preserve the SSL state, we
+        // recreate the serialized security info so the SSL manager doesn't
+        // clear out the state (thinking it just got a commit from the renderer
+        // with no security state).
         LoadCommittedDetails details;
         details.entry = GetActiveEntry();
         details.is_auto = false;
         details.is_in_page = false;
         details.is_main_frame = true;
+        details.serialized_security_info = SSLManager::SerializeSecurityInfo(
+            details.entry->ssl().cert_id(),
+            details.entry->ssl().cert_status(),
+            details.entry->ssl().security_bits());
         NotifyNavigationEntryCommitted(&details);
       }
     }
@@ -909,6 +916,21 @@
   NavigationEntry* last_entry = GetLastCommittedEntry();
   if (last_entry && last_entry->tab_type() != active_contents_->type()) {
     TabContents* from_contents = active_contents_;
+    if (from_contents->type() == active_contents_->type()) {
+      // EVIL HACK ALERT! This condition is a wallpaper patch around bug
+      // http://code.google.com/p/chromium/issues/detail?id=2855
+      // See the bug for more, but the short answer is that an old render view
+      // host's "cancel" message will get received by a newer one that happens
+      // to be navigated to the same URL, which will trigger improperly
+      // discarding the pending entry. This will in turn trigger tab contents
+      // collection and other bad things.
+      //
+      // This early return doesn't fix the problem at all, but does prevent the
+      // immediate crash. There are very likely to be problems as a result of
+      // the confused state that this generates, so the underlying bug really
+      // needs to be fixed!
+      return;
+    }
     from_contents->set_is_active(false);
 
     // Switch back to the previous tab contents.