Fix for 112044, positional attribute in overlays doesn't do a merge when position is higher than the number of current children. r=rginda, sr=ben

content/xul/content/src/nsXULElement.cpp

@@ -2262,33 +2262,34 @@ nsXULElement::InsertChildAt(nsIContent* aKid, PRInt32 aIndex, PRBool aNotify,
     // freak out.
     NS_ASSERTION(mChildren.IndexOf(aKid) < 0, "element is already a child");
 
-    PRBool insertOk = mChildren.InsertElementAt(aKid, aIndex);
-    if (insertOk) {
-        NS_ADDREF(aKid);
-        aKid->SetParent(NS_STATIC_CAST(nsIStyledContent*, this));
-        //nsRange::OwnerChildInserted(this, aIndex);
+    if (!mChildren.InsertElementAt(aKid, aIndex))
+        return NS_ERROR_FAILURE;
 
-        aKid->SetDocument(mDocument, aDeepSetDocument, PR_TRUE);
+    NS_ADDREF(aKid);
+    aKid->SetParent(NS_STATIC_CAST(nsIStyledContent*, this));
+    //nsRange::OwnerChildInserted(this, aIndex);
 
-        if (mDocument && HasMutationListeners(NS_STATIC_CAST(nsIStyledContent*,this),
-                                              NS_EVENT_BITS_MUTATION_NODEINSERTED)) {
-          nsCOMPtr<nsIDOMEventTarget> node(do_QueryInterface(aKid));
-          nsMutationEvent mutation;
-          mutation.eventStructType = NS_MUTATION_EVENT;
-          mutation.message = NS_MUTATION_NODEINSERTED;
-          mutation.mTarget = node;
+    aKid->SetDocument(mDocument, aDeepSetDocument, PR_TRUE);
 
-          nsCOMPtr<nsIDOMNode> relNode(do_QueryInterface(NS_STATIC_CAST(nsIStyledContent*,this)));
-          mutation.mRelatedNode = relNode;
+    if (mDocument && HasMutationListeners(NS_STATIC_CAST(nsIStyledContent*,this),
+                                          NS_EVENT_BITS_MUTATION_NODEINSERTED)) {
+      nsCOMPtr<nsIDOMEventTarget> node(do_QueryInterface(aKid));
+      nsMutationEvent mutation;
+      mutation.eventStructType = NS_MUTATION_EVENT;
+      mutation.message = NS_MUTATION_NODEINSERTED;
+      mutation.mTarget = node;
 
-          nsEventStatus status = nsEventStatus_eIgnore;
-          aKid->HandleDOMEvent(nsnull, &mutation, nsnull, NS_EVENT_FLAG_INIT, &status);
-        }
+      nsCOMPtr<nsIDOMNode> relNode(do_QueryInterface(NS_STATIC_CAST(nsIStyledContent*,this)));
+      mutation.mRelatedNode = relNode;
 
-        if (aNotify && mDocument) {
-          mDocument->ContentInserted(NS_STATIC_CAST(nsIStyledContent*, this), aKid, aIndex);
-        }
+      nsEventStatus status = nsEventStatus_eIgnore;
+      aKid->HandleDOMEvent(nsnull, &mutation, nsnull, NS_EVENT_FLAG_INIT, &status);
     }
+
+    if (aNotify && mDocument) {
+      mDocument->ContentInserted(NS_STATIC_CAST(nsIStyledContent*, this), aKid, aIndex);
+    }
+   
     return NS_OK;
 }
 

content/xul/document/src/nsXULDocument.cpp

@@ -6938,9 +6938,11 @@ nsXULDocument::InsertElement(nsIContent* aParent, nsIContent* aChild)
             PRInt32 pos = posStr.ToInteger(NS_REINTERPRET_CAST(PRInt32*, &rv));
             if (NS_SUCCEEDED(rv)) {
                 rv = aParent->InsertChildAt(aChild, pos - 1, PR_FALSE, PR_TRUE);
-                if (NS_FAILED(rv)) return rv;
-
-                wasInserted = PR_TRUE;
+                if (NS_SUCCEEDED(rv))
+                    wasInserted = PR_TRUE;
+                // If the insertion fails, then we should still attempt an append.
+                // Thus, rather than returning rv immediately, we fall through
+                // to the final "catch-all" case that just does an AppendChildTo.
             }
         }
     }