Mitigate the pushState IPC storm DoS.

third_party/WebKit/Source/core/frame/History.h

Index: third_party/WebKit/Source/core/frame/History.h
diff --git a/third_party/WebKit/Source/core/frame/History.h b/third_party/WebKit/Source/core/frame/History.h
index fb7fc5ea80e861f79ba6018f86a012daf1056201..ccca9cbe1e4a30c0d63b5fab779b224da9f9782c 100644
--- a/third_party/WebKit/Source/core/frame/History.h
+++ b/third_party/WebKit/Source/core/frame/History.h
@@ -33,6 +33,7 @@
 #include "platform/bindings/ScriptWrappable.h"
 #include "platform/heap/Handle.h"
 #include "platform/wtf/Forward.h"
+#include "platform/wtf/Time.h"
 
 namespace blink {
 
@@ -102,7 +103,13 @@ class CORE_EXPORT History final : public GarbageCollectedFinalized<History>,
   SerializedScriptValue* StateInternal() const;
   HistoryScrollRestorationType ScrollRestorationInternal() const;
 
+  bool IsFloodingState(const String& hostname) const;

[dcheng, 2017/07/07 21:04:09]

Nit: remove the arg which is no longer needed.
Nit 2: how about calling this IsThrottlingStateObjectChanges()

[palmer, 2017/07/07 21:38:17]

Done.
Done.

+
   RefPtr<SerializedScriptValue> last_state_object_requested_;
+  mutable struct {
+    int count;
+    TimeTicks last_updated;
+  } state_flood_guard;
 };
 
 }  // namespace blink