Bug 1347075 - Validate insertion index for a child move. r=yzen, a=lizzard
authorAlexander Surkov <surkov.alexander@gmail.com>
Wed, 29 Mar 2017 12:08:10 -0400
changeset 377189 88fce9c3223f281b9ab7f13f82eba44aabed9d4b
parent 377186 acc4c147ae006e22c51820caf6386054d6e05a31
child 377190 474495111e5487124a72b6b98ea681c6a2ec41dc
push id7164
push userryanvm@gmail.com
push dateThu, 06 Apr 2017 11:16:59 +0000
treeherdermozilla-beta@3fb6a3a12954 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersyzen, lizzard
bugs1347075
milestone53.0
Bug 1347075 - Validate insertion index for a child move. r=yzen, a=lizzard
accessible/generic/DocAccessible.cpp
--- a/accessible/generic/DocAccessible.cpp
+++ b/accessible/generic/DocAccessible.cpp
@@ -2173,17 +2173,24 @@ DocAccessible::PutChildrenBack(nsTArray<
     child->SetRelocated(false);
 
     int32_t idxInParent = -1;
     Accessible* origContainer = GetContainerAccessible(child->GetContent());
     if (origContainer) {
       TreeWalker walker(origContainer);
       if (walker.Seek(child->GetContent())) {
         Accessible* prevChild = walker.Prev();
-        idxInParent = prevChild ? prevChild->IndexInParent() + 1 : 0;
+        if (prevChild) {
+          idxInParent = prevChild->IndexInParent() + 1;
+          MOZ_ASSERT(origContainer == prevChild->Parent(), "Broken tree");
+          origContainer = prevChild->Parent();
+        }
+        else {
+          idxInParent = 0;
+        }
       }
     }
     MoveChild(child, origContainer, idxInParent);
   }
 
   aChildren->RemoveElementsAt(aStartIdx, aChildren->Length() - aStartIdx);
 }
 
@@ -2230,16 +2237,21 @@ DocAccessible::MoveChild(Accessible* aCh
   curParent->RemoveChild(aChild);
   rmut.Done();
 
   // No insertion point for the child.
   if (aIdxInParent == -1) {
     return true;
   }
 
+  if (aIdxInParent > static_cast<int32_t>(aNewParent->ChildCount())) {
+    MOZ_ASSERT_UNREACHABLE("Wrong insertion point for a moving child");
+    return true;
+  }
+
   TreeMutation imut(aNewParent);
   aNewParent->InsertChildAt(aIdxInParent, aChild);
   imut.AfterInsertion(aChild);
   imut.Done();
 
 #ifdef A11Y_LOG
   logging::TreeInfo("move child: old parent tree after",
                     logging::eVerbose, curParent);