Revert of Move FrameHost::m_subframeCount to Page

third_party/WebKit/Source/core/frame/FrameHost.h

 /*
  * Copyright (C) 2013 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 66 matching lines @@
   VisualViewport& visualViewport();
   const VisualViewport& visualViewport() const;
 
   ConsoleMessageStorage& consoleMessageStorage();
   const ConsoleMessageStorage& consoleMessageStorage() const;
 
   TopDocumentRootScrollerController& globalRootScrollerController() const;
 
   DECLARE_TRACE();
 
-  void incrementSubframeCount();
-  void decrementSubframeCount();
+  // Don't allow more than a certain number of frames in a page.
+  // This seems like a reasonable upper bound, and otherwise mutually
+  // recursive frameset pages can quickly bring the program to its knees
+  // with exponential growth in the number of frames.
+  static const int maxNumberOfFrames = 1000;
+  void incrementSubframeCount() { ++m_subframeCount; }
+  void decrementSubframeCount() {
+    ASSERT(m_subframeCount);
+    --m_subframeCount;
+  }
   int subframeCount() const;
 
  private:
   explicit FrameHost(Page&);
 
   const Member<Page> m_page;
   const Member<VisualViewport> m_visualViewport;
   const Member<OverscrollController> m_overscrollController;
   const Member<ConsoleMessageStorage> m_consoleMessageStorage;
   const Member<TopDocumentRootScrollerController>
       m_globalRootScrollerController;
+
+  int m_subframeCount;
 };
 
 }  // namespace blink
 
 #endif  // FrameHost_h