Bug 1659668 - Make sure the children array is big enough when adding a child using ReplaceElementAt in SessionHistoryEntry::AddChild. r=smaug

Differential Revision: https://phabricator.services.mozilla.com/D87415

docshell/shistory/SessionHistoryEntry.cpp

@@ -805,6 +805,8 @@ void SessionHistoryEntry::AddChild(SessionHistoryEntry* aChild, int32_t aOffset,
           "Adding a child where we already have a child? This may misbehave");
       oldChild->SetParent(nullptr);
     }
+  } else {
+    mChildren.SetLength(aOffset + 1);
   }
 
   mChildren.ReplaceElementAt(aOffset, aChild);