Fix the logic that limits the number of frames in a page.

Source/core/dom/NodeRareData.h

 /*
  * Copyright (C) 2008, 2010 Apple Inc. All rights reserved.
  * Copyright (C) 2008 David Smith <catfish.man@gmail.com>
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
  * version 2 of the License, or (at your option) any later version.
  *
  * This library is distributed in the hope that it will be useful,
@@ skipping 66 matching lines @@
     NodeMutationObserverData& ensureMutationObserverData()
     {
         if (!m_mutationObserverData)
             m_mutationObserverData = NodeMutationObserverData::create();
         return *m_mutationObserverData;
     }
 
     unsigned connectedSubframeCount() const { return m_connectedFrameCount; }
     void incrementConnectedSubframeCount(unsigned amount)
     {
+        RELEASE_ASSERT_WITH_SECURITY_IMPLICATION((m_connectedFrameCount + amount) < (1 << ConnectedFrameCountBits));

[dcheng, 2015/06/10 22:08:05]

Would it make sense to use maxNumberOfFrames here too?

[Nate Chapin, 2015/06/10 22:13:47]

I don't feel strongly, though this impl would need to move to the .cpp, so we
don't include FrameHost.h here unnecessarily.

         m_connectedFrameCount += amount;
     }
     void decrementConnectedSubframeCount(unsigned amount)
     {
         ASSERT(m_connectedFrameCount);
         ASSERT(amount <= m_connectedFrameCount);
         m_connectedFrameCount -= amount;
     }
 
     bool hasElementFlag(ElementFlags mask) const { return m_elementFlags & mask; }
@@ skipping 30 matching lines @@
     unsigned m_connectedFrameCount : ConnectedFrameCountBits;
     unsigned m_elementFlags : NumberOfElementFlags;
     unsigned m_restyleFlags : NumberOfDynamicRestyleFlags;
 protected:
     unsigned m_isElementRareData : 1;
 };
 
 } // namespace blink
 
 #endif // NodeRareData_h