Check refcounts for overflow.

31 bit refcounts are pushing up against larger renderer memory limits
so should be guarded for overflow.

Bug: 1101547
Change-Id: Iaf613e642be43f2dbddf25bed573e50a0eedf7f9
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2288490
Reviewed-by: Bill Budge <bbudge@chromium.org>
Commit-Queue: Alex Gough <ajgo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#786543}

ppapi/proxy/plugin_var_tracker.cc

@@ -6,6 +6,8 @@
 
 #include <stddef.h>
 
+#include <limits>
+
 #include "base/memory/ref_counted.h"
 #include "base/memory/singleton.h"
 #include "ipc/ipc_message.h"
@@ -79,6 +81,7 @@ PP_Var PluginVarTracker::ReceiveObjectPassRef(const PP_Var& host_var,
     SendReleaseObjectMsg(*object.get());
   }
   info.ref_count++;
+  CHECK(info.ref_count != std::numeric_limits<decltype(info.ref_count)>::max());
   return ret;
 }
 

ppapi/shared_impl/var_tracker.cc

@@ -83,6 +83,7 @@ bool VarTracker::AddRefVar(int32_t var_id) {
 
   // Basic refcount increment.
   info.ref_count++;
+  CHECK(info.ref_count != std::numeric_limits<decltype(info.ref_count)>::max());
   return true;
 }