Merge 197139 "Fix the logic that limits the number of frames in ..."

Source/core/dom/NodeRareData.cpp

 /*
  * Copyright (C) 2012 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 55 matching lines @@
 
 void NodeRareData::finalizeGarbageCollectedObject()
 {
     RELEASE_ASSERT(!layoutObject());
     if (m_isElementRareData)
         static_cast<ElementRareData*>(this)->~ElementRareData();
     else
         this->~NodeRareData();
 }
 
+void NodeRareData::incrementConnectedSubframeCount(unsigned amount)
+{
+    RELEASE_ASSERT_WITH_SECURITY_IMPLICATION((m_connectedFrameCount + amount) <= FrameHost::maxNumberOfFrames);
+    m_connectedFrameCount += amount;
+}
+
 // Ensure the 10 bits reserved for the m_connectedFrameCount cannot overflow
 static_assert(FrameHost::maxNumberOfFrames < (1 << NodeRareData::ConnectedFrameCountBits), "Frame limit should fit in rare data count");
 
 } // namespace blink