WebBackForwardList::forwardListAsImmutableArrayWithLimit() has incorrect math that can result in it returning an array that is only partly (or not at all) filled in.
The offending line is this one:
unsigned last = std::min(m_current + limit, static_cast<unsigned>(m_entries.size() - 1));
if m_current + limit is larger than numeric_limits<unsigned>::max(), this expression will return the wrong value, and the subsequent for loop can skip filling in data for some array slots.
Created attachment 63242 [details]
Compute "last" a simpler way that doesn't have overflow potential.
Fixed in http://trac.webkit.org/changeset/64480