Added checks for integer overflow conditions to deleteData and replaceData.

Source/core/editing/FrameSelection.cpp

Index: Source/core/editing/FrameSelection.cpp
diff --git a/Source/core/editing/FrameSelection.cpp b/Source/core/editing/FrameSelection.cpp
index 23ed26c171e1e9047368c79b5a16472e77bd720a..6af027ec7556b95f592bfe0641eeb082bb697d6b 100644
--- a/Source/core/editing/FrameSelection.cpp
+++ b/Source/core/editing/FrameSelection.cpp
@@ -383,7 +383,7 @@ static Position updatePositionAfterAdoptingTextReplacement(const Position& posit
     if (positionOffset > offset + oldLength)
         positionOffset = positionOffset - oldLength + newLength;
 
-    ASSERT(positionOffset <= node->length());
+    ASSERT_WITH_SECURITY_IMPLICATION(positionOffset <= node->length());
     // CharacterNode in VisibleSelection must be Text node, because Comment
     // and ProcessingInstruction node aren't visible.
     return Position(toText(node), positionOffset);