[cc] Fix crash when adding a child layer to its own parent.

Only calculate the index after calling removeFromParent in case
it modifies the number of children.

BUG=


Review URL: https://chromiumcodereview.appspot.com/11377108

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@167315 0039d316-1c4b-4281-b951-d872f2087c98

2 files changed, 19 insertions, 1 deletions

diff --git a/cc/layer.cc b/cc/layer.cc
index e300fe0..88390a0 100644
--- a/cc/layer.cc
+++ b/cc/layer.cc
@@ -153,11 +153,11 @@ void Layer::addChild(scoped_refptr<Layer> child)
 
 void Layer::insertChild(scoped_refptr<Layer> child, size_t index)
 {
-    index = min(index, m_children.size());
     child->removeFromParent();
     child->setParent(this);
     child->m_stackingOrderChanged = true;
 
+    index = min(index, m_children.size());
     LayerList::iterator iter = m_children.begin();
     m_children.insert(iter + index, child);
     setNeedsCommit();
diff --git a/cc/layer_unittest.cc b/cc/layer_unittest.cc
index 6c26de5..1ce8dec 100644
--- a/cc/layer_unittest.cc
+++ b/cc/layer_unittest.cc
@@ -163,6 +163,24 @@ TEST_F(LayerTest, addAndRemoveChild)
     EXECUTE_AND_VERIFY_SET_NEEDS_COMMIT_BEHAVIOR(AtLeast(1), child->removeFromParent());
 }
 
+TEST_F(LayerTest, addSameChildTwice)
+{
+    scoped_refptr<Layer> parent = Layer::create();
+    scoped_refptr<Layer> child = Layer::create();
+
+    m_layerTreeHost->setRootLayer(parent);
+
+    ASSERT_EQ(0u, parent->children().size());
+
+    parent->addChild(child);
+    ASSERT_EQ(1u, parent->children().size());
+    EXPECT_EQ(parent.get(), child->parent());
+
+    parent->addChild(child);
+    ASSERT_EQ(1u, parent->children().size());
+    EXPECT_EQ(parent.get(), child->parent());
+}
+
 TEST_F(LayerTest, insertChild)
 {
     scoped_refptr<Layer> parent = Layer::create();