Fix for 112044, positional attribute in overlays doesn't do a merge when position is higher than the number of current children. r=rginda, sr=ben

content/xul/content/src/nsXULElement.cpp

@@ -2262,8 +2262,9 @@ nsXULElement::InsertChildAt(nsIContent* aKid, PRInt32 aIndex, PRBool aNotify,
     // freak out.
     NS_ASSERTION(mChildren.IndexOf(aKid) < 0, "element is already a child");
 
-    PRBool insertOk = mChildren.InsertElementAt(aKid, aIndex);
-    if (insertOk) {
+    if (!mChildren.InsertElementAt(aKid, aIndex))
+        return NS_ERROR_FAILURE;
+
     NS_ADDREF(aKid);
     aKid->SetParent(NS_STATIC_CAST(nsIStyledContent*, this));
     //nsRange::OwnerChildInserted(this, aIndex);
@@ -2288,7 +2289,7 @@ nsXULElement::InsertChildAt(nsIContent* aKid, PRInt32 aIndex, PRBool aNotify,
     if (aNotify && mDocument) {
       mDocument->ContentInserted(NS_STATIC_CAST(nsIStyledContent*, this), aKid, aIndex);
     }
-    }
+   
     return NS_OK;
 }
 

content/xul/document/src/nsXULDocument.cpp

@@ -6938,9 +6938,11 @@ nsXULDocument::InsertElement(nsIContent* aParent, nsIContent* aChild)
             PRInt32 pos = posStr.ToInteger(NS_REINTERPRET_CAST(PRInt32*, &rv));
             if (NS_SUCCEEDED(rv)) {
                 rv = aParent->InsertChildAt(aChild, pos - 1, PR_FALSE, PR_TRUE);
-                if (NS_FAILED(rv)) return rv;
-
+                if (NS_SUCCEEDED(rv))
                     wasInserted = PR_TRUE;
+                // If the insertion fails, then we should still attempt an append.
+                // Thus, rather than returning rv immediately, we fall through
+                // to the final "catch-all" case that just does an AppendChildTo.
             }
         }
     }