From 4c8b6bf03f9a579a4373a61aa4423467826f0b90 Mon Sep 17 00:00:00 2001
From: Peter Van der Beken <peterv@propagandism.org>
Date: Tue, 18 Aug 2020 15:12:51 +0000
Subject: [PATCH] Bug 1659668 - Make sure the children array is big enough when
 adding a child using ReplaceElementAt in SessionHistoryEntry::AddChild.
 r=smaug

Differential Revision: https://phabricator.services.mozilla.com/D87415
---
 docshell/shistory/SessionHistoryEntry.cpp | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/docshell/shistory/SessionHistoryEntry.cpp b/docshell/shistory/SessionHistoryEntry.cpp
index 90d9199d8dfe..5325205f406f 100644
--- a/docshell/shistory/SessionHistoryEntry.cpp
+++ b/docshell/shistory/SessionHistoryEntry.cpp
@@ -805,6 +805,8 @@ void SessionHistoryEntry::AddChild(SessionHistoryEntry* aChild, int32_t aOffset,
           "Adding a child where we already have a child? This may misbehave");
       oldChild->SetParent(nullptr);
     }
+  } else {
+    mChildren.SetLength(aOffset + 1);
   }
 
   mChildren.ReplaceElementAt(aOffset, aChild);