Bug 1347075 - Validate insertion index for a child move. r=yzen, a=jcristau
authorAlexander Surkov <surkov.alexander@gmail.com>
Wed, 29 Mar 2017 12:08:10 -0400
changeset 355590 1852dc0beba41c9d681daa6c090b94a00f180501
parent 355589 f0f591f82cc0b0ca7de99fa54c62fc9671f39779
child 355591 6913f0537208fe4f20236048b243cb5987df8542
push id7007
push userryanvm@gmail.com
push dateThu, 06 Apr 2017 19:58:49 +0000
treeherdermozilla-esr52@6913f0537208 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersyzen, jcristau
bugs1347075
milestone52.0.3
Bug 1347075 - Validate insertion index for a child move. r=yzen, a=jcristau
accessible/generic/DocAccessible.cpp
--- a/accessible/generic/DocAccessible.cpp
+++ b/accessible/generic/DocAccessible.cpp
@@ -2155,17 +2155,24 @@ DocAccessible::PutChildrenBack(nsTArray<
     child->SetRelocated(false);
 
     int32_t idxInParent = -1;
     Accessible* origContainer = GetContainerAccessible(child->GetContent());
     if (origContainer) {
       TreeWalker walker(origContainer);
       if (walker.Seek(child->GetContent())) {
         Accessible* prevChild = walker.Prev();
-        idxInParent = prevChild ? prevChild->IndexInParent() + 1 : 0;
+        if (prevChild) {
+          idxInParent = prevChild->IndexInParent() + 1;
+          MOZ_ASSERT(origContainer == prevChild->Parent(), "Broken tree");
+          origContainer = prevChild->Parent();
+        }
+        else {
+          idxInParent = 0;
+        }
       }
     }
     MoveChild(child, origContainer, idxInParent);
   }
 
   aChildren->RemoveElementsAt(aStartIdx, aChildren->Length() - aStartIdx);
 }
 
@@ -2212,16 +2219,21 @@ DocAccessible::MoveChild(Accessible* aCh
   curParent->RemoveChild(aChild);
   rmut.Done();
 
   // No insertion point for the child.
   if (aIdxInParent == -1) {
     return true;
   }
 
+  if (aIdxInParent > static_cast<int32_t>(aNewParent->ChildCount())) {
+    MOZ_ASSERT_UNREACHABLE("Wrong insertion point for a moving child");
+    return true;
+  }
+
   TreeMutation imut(aNewParent);
   aNewParent->InsertChildAt(aIdxInParent, aChild);
   imut.AfterInsertion(aChild);
   imut.Done();
 
 #ifdef A11Y_LOG
   logging::TreeInfo("move child: old parent tree after",
                     logging::eVerbose, curParent);