Bug 1347075 - validate insertion index for a child move, r=yzen
authorAlexander Surkov <surkov.alexander@gmail.com>
Wed, 29 Mar 2017 12:08:10 -0400
changeset 350372 140d845ace14acddd4283dbea9f828ec1ac69a15
parent 350371 b0bac8c5930689a8edfe702db5f358c14ed1538e
child 350373 09c3073768242d0917af5b633cf0c94fd37571d3
push id88607
push usersurkov.alexander@gmail.com
push dateWed, 29 Mar 2017 16:09:10 +0000
treeherdermozilla-inbound@140d845ace14 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersyzen
bugs1347075
milestone55.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 1347075 - validate insertion index for a child move, r=yzen
accessible/generic/DocAccessible.cpp
--- a/accessible/generic/DocAccessible.cpp
+++ b/accessible/generic/DocAccessible.cpp
@@ -2183,17 +2183,24 @@ DocAccessible::PutChildrenBack(nsTArray<
     child->SetRelocated(false);
 
     int32_t idxInParent = -1;
     Accessible* origContainer = GetContainerAccessible(child->GetContent());
     if (origContainer) {
       TreeWalker walker(origContainer);
       if (walker.Seek(child->GetContent())) {
         Accessible* prevChild = walker.Prev();
-        idxInParent = prevChild ? prevChild->IndexInParent() + 1 : 0;
+        if (prevChild) {
+          idxInParent = prevChild->IndexInParent() + 1;
+          MOZ_ASSERT(origContainer == prevChild->Parent(), "Broken tree");
+          origContainer = prevChild->Parent();
+        }
+        else {
+          idxInParent = 0;
+        }
       }
     }
     MoveChild(child, origContainer, idxInParent);
   }
 
   aChildren->RemoveElementsAt(aStartIdx, aChildren->Length() - aStartIdx);
 }
 
@@ -2240,16 +2247,21 @@ DocAccessible::MoveChild(Accessible* aCh
   curParent->RemoveChild(aChild);
   rmut.Done();
 
   // No insertion point for the child.
   if (aIdxInParent == -1) {
     return true;
   }
 
+  if (aIdxInParent > static_cast<int32_t>(aNewParent->ChildCount())) {
+    MOZ_ASSERT_UNREACHABLE("Wrong insertion point for a moving child");
+    return true;
+  }
+
   TreeMutation imut(aNewParent);
   aNewParent->InsertChildAt(aIdxInParent, aChild);
   imut.AfterInsertion(aChild);
   imut.Done();
 
 #ifdef A11Y_LOG
   logging::TreeInfo("move child: old parent tree after",
                     logging::eVerbose, curParent);