Bug 1478573; r=asuth

dom/indexedDB/IDBObjectStore.cpp

@@ -1941,10 +1941,16 @@ IDBObjectStore::GetAddInfo(JSContext* aCx,
   // Figure out indexes and the index values to update here.
   const nsTArray<IndexMetadata>& indexes = mSpec->indexes();
 
-  const uint32_t idxCount = indexes.Length();
+  uint32_t idxCount = indexes.Length();
 
-  if (idxCount && !aValueWrapper.Clone(aCx)) {
-    return NS_ERROR_DOM_DATA_CLONE_ERR;
+  if (idxCount) {
+    if (!aValueWrapper.Clone(aCx)) {
+      return NS_ERROR_DOM_DATA_CLONE_ERR;
+    }
+
+    // Update idxCount, the structured clone process may trigger content code
+    // via getters/other which can potentially call CreateIndex/DeleteIndex.
+    idxCount = indexes.Length();
   }
 
   aUpdateInfoArray.SetCapacity(idxCount); // Pretty good estimate