Fix NavigationItem use-after-free crash in |-goToItemAtIndex:|
If a history navigation item occurs and the current NavigationItem is transient item, it will get discarded in CRWSessionController's |-discardTransientItem|. This CL updates history navigation logic to store copies of the current NavigationItem's information before calling any CRWSessionController code that might deallocate it. BUG=700319 Review-Url: https://codereview.chromium.org/2745653007 Cr-Commit-Position: refs/heads/master@{#456190}
Showing
Please register or sign in to comment