code: static NameConstraintsExtension mergeNameConstraints(
          X509Certificate currCert, NameConstraintsExtension prevNC)
          throws CertPathValidatorException
      {
          X509CertImpl currCertImpl;
          try {
              currCertImpl = X509CertImpl.toImpl(currCert);
          } catch (CertificateException ce) {
              throw new CertPathValidatorException(ce);
          }
  
          NameConstraintsExtension newConstraints =
              currCertImpl.getNameConstraintsExtension();
  
          if (debug != null) {
              debug.println("prevNC = " + prevNC +
                          ", newNC = " + String.valueOf(newConstraints));
          }
  
          // if there are no previous name constraints, we just return the
          // new name constraints.
          if (prevNC == null) {
              if (debug != null) {
                  debug.println("mergedNC = " + String.valueOf(newConstraints));
              }
              if (newConstraints == null) {
                  return newConstraints;
              } else {
                  // Make sure we do a clone here, because we're probably
                  // going to modify this object later and we don't want to
                  // be sharing it with a Certificate object!
                  return (NameConstraintsExtension)newConstraints.clone();
              }
          } else {
              try {
                  // after merge, prevNC should contain the merged constraints
                  prevNC.merge(newConstraints);
              } catch (IOException ioe) {
                  throw new CertPathValidatorException(ioe);
              }
              if (debug != null) {
                  debug.println("mergedNC = " + prevNC);
              }
              return prevNC;
          }
      }
docs: Helper to fold sets of name constraints together