Mitigate the pushState IPC storm DoS.

third_party/WebKit/Source/core/frame/History.h

Index: third_party/WebKit/Source/core/frame/History.h
diff --git a/third_party/WebKit/Source/core/frame/History.h b/third_party/WebKit/Source/core/frame/History.h
index fb7fc5ea80e861f79ba6018f86a012daf1056201..9c2f875046200c8b8ebfe6d14886cfc770a83630 100644
--- a/third_party/WebKit/Source/core/frame/History.h
+++ b/third_party/WebKit/Source/core/frame/History.h
@@ -33,6 +33,7 @@
 #include "platform/bindings/ScriptWrappable.h"
 #include "platform/heap/Handle.h"
 #include "platform/wtf/Forward.h"
+#include "platform/wtf/Time.h"
 
 namespace blink {
 
@@ -102,7 +103,13 @@ class CORE_EXPORT History final : public GarbageCollectedFinalized<History>,
   SerializedScriptValue* StateInternal() const;
   HistoryScrollRestorationType ScrollRestorationInternal() const;
 
+  bool ShouldThrottleStateObjectChanges();
+
   RefPtr<SerializedScriptValue> last_state_object_requested_;
+  struct {
+    int count;
+    TimeTicks last_updated;
+  } state_flood_guard;
 };
 
 }  // namespace blink