Fix overlay code to not trust overlays and violate the nsIContent API in the

process.  Bug 233641, r=sicking, sr=ben

content/xul/content/src/nsXULElement.cpp

@@ -1011,12 +1011,6 @@ nsXULElement::InsertChildAt(nsIContent* aKid, PRUint32 aIndex, PRBool aNotify,
     nsIDocument* doc = GetCurrentDoc();
     mozAutoDocUpdate updateBatch(doc, UPDATE_CONTENT_MODEL, aNotify);
 
-    if (aIndex > mAttrsAndChildren.ChildCount()) {
-      // XXX This *does* happen, probably a bug in the overlay code.
-      // See bug 233641.
-      return NS_ERROR_FAILURE;
-    }
-
     rv = mAttrsAndChildren.InsertChildAt(aKid, aIndex);
     NS_ENSURE_SUCCESS(rv, rv);
 

content/xul/document/src/nsXULDocument.cpp

@@ -4297,7 +4297,12 @@ nsXULDocument::InsertElement(nsIContent* aParent, nsIContent* aChild, PRBool aNo
         if (rv == NS_CONTENT_ATTR_HAS_VALUE) {
             // Positions are one-indexed.
             PRInt32 pos = posStr.ToInteger(NS_REINTERPRET_CAST(PRInt32*, &rv));
-            if (NS_SUCCEEDED(rv)) {
+            // Note: if the insertion index (which is |pos - 1|) would be less
+            // than 0 or greater than the number of children aParent has, then
+            // don't insert, since the position is bogus.  Just skip on to
+            // appending.
+            if (NS_SUCCEEDED(rv) && pos > 0 &&
+                PRUint32(pos - 1) <= aParent->GetChildCount()) {
                 rv = aParent->InsertChildAt(aChild, pos - 1, aNotify,
                                             PR_TRUE);
                 if (NS_SUCCEEDED(rv))