Bug 1347075 - Validate insertion index for a child move. r=yzen, a=jcristau
authorAlexander Surkov <surkov.alexander@gmail.com>
Mon, 10 Apr 2017 17:31:13 -0400
changeset 312881 a017569d35357fda5647e5649eac4e73f7f835cb
parent 312880 3d9d1d3c6022b70a157de9389448e20a5360664f
child 312882 cd44925d52c3940db736a642cbb847341cea769f
push id524
push userryanvm@gmail.com
push dateMon, 10 Apr 2017 21:33:11 +0000
treeherdermozilla-esr45@a017569d3535 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersyzen, jcristau
bugs1347075
milestone45.9.0
Bug 1347075 - Validate insertion index for a child move. r=yzen, a=jcristau
accessible/generic/DocAccessible.cpp
--- a/accessible/generic/DocAccessible.cpp
+++ b/accessible/generic/DocAccessible.cpp
@@ -2096,17 +2096,18 @@ DocAccessible::SeizeChild(Accessible* aN
   reorderEvent->AddSubMutationEvent(hideEvent);
 
   {
     AutoTreeMutation mut(oldParent);
     oldParent->RemoveChild(aChild);
   }
 
   bool isReinserted = false;
-  {
+  if (aIdxInParent != -1 &&
+      aIdxInParent <= static_cast<int32_t>(aNewParent->ChildCount())) {
     AutoTreeMutation mut(aNewParent);
     isReinserted = aNewParent->InsertChildAt(aIdxInParent, aChild);
   }
 
   if (!isReinserted) {
     AutoTreeMutation mut(oldParent);
     oldParent->InsertChildAt(oldIdxInParent, aChild);
     return false;