Code: bool NavigationRateLimiter::CanProceed() {
  if (!enabled)
    return true;

  static constexpr int kStateUpdateLimit = 200;
  static constexpr base::TimeDelta kStateUpdateLimitResetInterval =
      base::TimeDelta::FromSeconds(10);

  if (++count_ <= kStateUpdateLimit)
    return true;

  const base::TimeTicks now = base::TimeTicks::Now();
  if (now - time_first_count_ > kStateUpdateLimitResetInterval) {
    time_first_count_ = now;
    count_ = 1;
    error_message_sent_ = false;
    return true;
   }
 
   if (!error_message_sent_) {
     error_message_sent_ = true;
     if (auto* local_frame = DynamicTo<LocalFrame>(frame_.Get())) {
      local_frame->Console().AddMessage(ConsoleMessage::Create(
          mojom::ConsoleMessageSource::kJavaScript,
          mojom::ConsoleMessageLevel::kWarning,
          "Throttling navigation to prevent the browser from hanging. See "
          "https://crbug.com/882238. Command line switch "
          "--disable-ipc-flooding-protection can be used to bypass the "
          "protection"));
    }
  }

  return false;
}

Vulnerability Type: 
CWE ID: CWE-416
Summary: A use after free in Google Chrome prior to 56.0.2924.76 for Linux, Windows and Mac, and 56.0.2924.87 for Android, allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Commit Message: Convert FrameHostMsg_DidAddMessageToConsole to Mojo.

Note: Since this required changing the test
RenderViewImplTest.DispatchBeforeUnloadCanDetachFrame, I manually
re-introduced https://crbug.com/666714 locally (the bug the test was
added for), and reran the test to confirm that it still covers the bug.

Bug: 786836
Change-Id: I110668fa6f0f261fd2ac36bb91a8d8b31c99f4f1
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1526270
Commit-Queue: Lowell Manners <lowell@chromium.org>
Reviewed-by: Daniel Cheng <dcheng@chromium.org>
Reviewed-by: Camille Lamy <clamy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#653137}