Crash when going back/forward when back/forward list is in a bad state.
Created attachment 81742 [details] Patch
Comment on attachment 81742 [details] Patch Local variables for m_backForwardList->forwardItem() and m_backForwardList->backItem() could make this clearer since each of those is called four times within the function.
Created attachment 81743 [details] Patch
Committed r78015: <http://trac.webkit.org/changeset/78015>