Mitigate the pushState IPC storm DoS.

third_party/WebKit/Source/core/frame/History.h

 /*
  * Copyright (C) 2007 Apple Inc.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
@@ skipping 15 matching lines @@
 #ifndef History_h
 #define History_h
 
 #include "base/gtest_prod_util.h"
 #include "bindings/core/v8/serialization/SerializedScriptValue.h"
 #include "core/dom/ContextLifecycleObserver.h"
 #include "core/loader/FrameLoaderTypes.h"
 #include "platform/bindings/ScriptWrappable.h"
 #include "platform/heap/Handle.h"
 #include "platform/wtf/Forward.h"
+#include "platform/wtf/Time.h"
 
 namespace blink {
 
 class LocalFrame;
 class KURL;
 class ExceptionState;
 class SecurityOrigin;
 class ScriptState;
 
 // This class corresponds to the History interface.
@@ skipping 49 matching lines @@
 
   void StateObjectAdded(PassRefPtr<SerializedScriptValue>,
                         const String& title,
                         const String& url,
                         HistoryScrollRestorationType,
                         FrameLoadType,
                         ExceptionState&);
   SerializedScriptValue* StateInternal() const;
   HistoryScrollRestorationType ScrollRestorationInternal() const;
 
+  bool ShouldThrottleStateObjectChanges();
+
   RefPtr<SerializedScriptValue> last_state_object_requested_;
+  struct {
+    int count;
+    TimeTicks last_updated;
+  } state_flood_guard;
 };
 
 }  // namespace blink
 
 #endif  // History_h