1 files changed, 62 insertions, 21 deletions

diff --git a/chrome/browser/session_service.cc b/chrome/browser/session_service.cc
index 25e0174..8305642 100644
--- a/chrome/browser/session_service.cc
+++ b/chrome/browser/session_service.cc
@@ -88,6 +88,32 @@ typedef IDAndIndexPayload WindowTypePayload;
 
 typedef IDAndIndexPayload TabNavigationPathPrunedFromFrontPayload;
 
+// Helper used by CreateUpdateTabNavigationCommand(). It writes |str| to
+// |pickle|, if and only if |str| fits within (|max_bytes| - |*bytes_written|).
+// |bytes_written| is incremented to reflect the data written.
+void WriteStringToPickle(Pickle& pickle, int* bytes_written, int max_bytes,
+                         const std::string& str) {
+  int num_bytes = str.size() * sizeof(char);
+  if (*bytes_written + num_bytes < max_bytes) {
+    *bytes_written += num_bytes;
+    pickle.WriteString(str);
+  } else {
+    pickle.WriteString(std::string());
+  }
+}
+
+// Wide version of WriteStringToPickle.
+void WriteWStringToPickle(Pickle& pickle, int* bytes_written, int max_bytes,
+                          const std::wstring& str) {
+  int num_bytes = str.size() * sizeof(wchar_t);
+  if (*bytes_written + num_bytes < max_bytes) {
+    *bytes_written += num_bytes;
+    pickle.WriteWString(str);
+  } else {
+    pickle.WriteWString(std::wstring());
+  }
+}
+
 }  // namespace
 
 // SessionID ------------------------------------------------------------------
@@ -583,31 +609,34 @@ SessionCommand* SessionService::CreateUpdateTabNavigationCommand(
   Pickle pickle;
   pickle.WriteInt(tab_id.id());
   pickle.WriteInt(index);
+
+  // We only allow navigations up to 63k (which should be completely
+  // reasonable). On the off chance we get one that is too big, try to
+  // keep the url.
+
+  // Bound the string data (which is variable length) to
+  // |max_state_size bytes| bytes.
   static const SessionCommand::size_type max_state_size =
       std::numeric_limits<SessionCommand::size_type>::max() - 1024;
-  if (entry.display_url().spec().size() +
-      entry.title().size() +
-      entry.content_state().size() >= max_state_size) {
-    // We only allow navigations up to 63k (which should be completely
-    // reasonable). On the off chance we get one that is too big, try to
-    // keep the url.
-    if (entry.display_url().spec().size() < max_state_size) {
-      pickle.WriteString(entry.display_url().spec());
-      pickle.WriteWString(std::wstring());
-      pickle.WriteString(std::string());
-    } else {
-      pickle.WriteString(std::string());
-      pickle.WriteWString(std::wstring());
-      pickle.WriteString(std::string());
-    }
-  } else {
-    pickle.WriteString(entry.display_url().spec());
-    pickle.WriteWString(entry.title());
-    pickle.WriteString(entry.content_state());
-  }
+
+  int bytes_written = 0;
+  
+  WriteStringToPickle(pickle, &bytes_written, max_state_size,
+                      entry.display_url().spec());
+
+  WriteWStringToPickle(pickle, &bytes_written, max_state_size,
+                       entry.title());
+
+  WriteStringToPickle(pickle, &bytes_written, max_state_size,
+                      entry.content_state());
+
   pickle.WriteInt(entry.transition_type());
   int type_mask = entry.has_post_data() ? TabNavigation::HAS_POST_DATA : 0;
   pickle.WriteInt(type_mask);
+
+  WriteStringToPickle(pickle, &bytes_written, max_state_size,
+      entry.referrer().is_valid() ? entry.referrer().spec() : std::string());
+
   // Adding more data? Be sure and update TabRestoreService too.
   return new SessionCommand(kCommandUpdateTabNavigation, pickle);
 }
@@ -902,7 +931,19 @@ bool SessionService::CreateTabsAndWindows(
           return true;
         // type_mask did not always exist in the written stream. As such, we
         // don't fail if it can't be read.
-        pickle->ReadInt(&iterator, &(navigation.type_mask));
+        bool has_type_mask =
+            pickle->ReadInt(&iterator, &(navigation.type_mask));
+
+        if (has_type_mask) {
+          // the "referrer" property was added after type_mask to the written
+          // stream. As such, we don't fail if it can't be read.
+          std::string referrer_spec;
+          pickle->ReadString(&iterator, &referrer_spec);
+          if (!referrer_spec.empty()) {
+            navigation.referrer = GURL(referrer_spec);
+          }
+        }
+
         navigation.url = GURL(url_spec);
         SessionTab* tab = GetTab(tab_id, tabs);
         std::vector<TabNavigation>::iterator i =