Code: bool LocalFrameClientImpl::NavigateBackForward(int offset) const {
  WebViewImpl* webview = web_frame_->ViewImpl();
  if (!webview->Client())
    return false;

  DCHECK(offset);
  if (offset > webview->Client()->HistoryForwardListCount())
     return false;
   if (offset < -webview->Client()->HistoryBackListCount())
     return false;
  webview->Client()->NavigateBackForwardSoon(offset);
   return true;
 }

Vulnerability Type: 
CWE ID: CWE-254
Summary: A renderer initiated back navigation was incorrectly allowed to cancel a browser initiated one in Navigation in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to confuse the user about the origin of the current page via a crafted HTML page.
Commit Message: Prevent renderer initiated back navigation to cancel a browser one.

Renderer initiated back/forward navigations must not be able to cancel ongoing
browser initiated navigation if they are not user initiated.

Note: 'normal' renderer initiated navigation uses the
FrameHost::BeginNavigation() path. A code similar to this patch is done
in NavigatorImpl::OnBeginNavigation().

Test:
-----

Added: NavigationBrowserTest.
 * HistoryBackInBeforeUnload
 * HistoryBackInBeforeUnloadAfterSetTimeout
 * HistoryBackCancelPendingNavigationNoUserGesture
 * HistoryBackCancelPendingNavigationUserGesture

Fixed:
 * (WPT) .../the-history-interface/traverse_the_history_2.html
 * (WPT) .../the-history-interface/traverse_the_history_3.html
 * (WPT) .../the-history-interface/traverse_the_history_4.html
 * (WPT) .../the-history-interface/traverse_the_history_5.html

Bug: 879965
Change-Id: I1a9bfaaea1ffc219e6c32f6e676b660e746c578c
Reviewed-on: https://chromium-review.googlesource.com/1209744
Commit-Queue: Arthur Sonzogni <arthursonzogni@chromium.org>
Reviewed-by: Daniel Cheng <dcheng@chromium.org>
Reviewed-by: Mustaq Ahmed <mustaq@chromium.org>
Reviewed-by: Camille Lamy <clamy@chromium.org>
Reviewed-by: Charlie Reis <creis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#592823}