Bug 588643 - Crash in [@ nsDocShell::SetHistoryEntry ], r=bent/neil, a=blocking

docshell/shistory/src/nsSHEntry.cpp

@@ -642,7 +642,17 @@ nsSHEntry::AddChild(nsISHEntry * aChild, PRInt32 aOffset)
   }
 #endif
 
-  mChildren.InsertObjectAt(aChild, aOffset);
+  // InsertObjectAt allows only appending one object.
+  // If aOffset is larger than Count(), we must first manually
+  // set the capacity.
+  if (aOffset > mChildren.Count()) {
+    mChildren.SetCount(aOffset);
+  }
+  if (!mChildren.InsertObjectAt(aChild, aOffset)) {
+    NS_WARNING("Adding a child failed!");
+    aChild->SetParent(nsnull);
+    return NS_ERROR_FAILURE;
+  }
 
   return NS_OK;
 }