3 files changed, 28 insertions, 7 deletions
diff --git a/chrome/browser/resources/shared/js/cr/ui/array_data_model.js b/chrome/browser/resources/shared/js/cr/ui/array_data_model.js
index 16e7c0f..861bbae 100644
--- a/chrome/browser/resources/shared/js/cr/ui/array_data_model.js
+++ b/chrome/browser/resources/shared/js/cr/ui/array_data_model.js
@@ -139,7 +139,6 @@ cr.define('cr.ui', function() {
       var addCount = arguments.length - 2;
       var newIndexes = [];
       var deletePermutation = [];
-      var deleted = 0;
       var deletedItems = [];
       var newArray = [];
       index = Math.min(index, this.indexes_.length);
@@ -147,13 +146,12 @@ cr.define('cr.ui', function() {
       // Copy items before the insertion point.
       for (var i = 0; i < index; i++) {
         newIndexes.push(newArray.length);
-        deletePermutation.push(i - deleted);
+        deletePermutation.push(i);
         newArray.push(this.array_[this.indexes_[i]]);
       }
       // Delete items.
       for (; i < index + deleteCount; i++) {
         deletePermutation.push(-1);
-        deleted++;
         deletedItems.push(this.array_[this.indexes_[i]]);
       }
       // Insert new items instead deleted ones.
@@ -164,7 +162,7 @@ cr.define('cr.ui', function() {
       // Copy items after the insertion point.
       for (; i < this.indexes_.length; i++) {
         newIndexes.push(newArray.length);
-        deletePermutation.push(i - deleted);
+        deletePermutation.push(i - deleteCount + addCount);
         newArray.push(this.array_[this.indexes_[i]]);
       }
 
diff --git a/chrome/browser/resources/shared/js/cr/ui/array_data_model_test.html b/chrome/browser/resources/shared/js/cr/ui/array_data_model_test.html
index a827404..ed6e44f 100644
--- a/chrome/browser/resources/shared/js/cr/ui/array_data_model_test.html
+++ b/chrome/browser/resources/shared/js/cr/ui/array_data_model_test.html
@@ -60,6 +60,32 @@ function testSplice() {
   compare([1, 2, 3], [5, 3, 1, 2, 3]);
 }
 
+function testPermutation() {
+  function doTest(sourceArray, spliceArgs) {
+    var m = new cr.ui.ArrayDataModel(sourceArray.slice());
+    var permutation;
+    m.addEventListener('permuted', function(event) {
+      permutation = event.permutation;
+    });
+    m.splice.apply(m, spliceArgs);
+    var deleted = 0;
+    for (var i = 0; i < sourceArray.length; i++) {
+      if (permutation[i] == -1)
+        deleted++;
+      else
+        assertEquals(sourceArray[i], m.item(permutation[i]));
+    }
+    assertEquals(deleted, spliceArgs[1]);
+  }
+
+  doTest([1, 2, 3], [0, 0]);
+  doTest([1, 2, 3], [0, 1]);
+  doTest([1, 2, 3], [1, 1]);
+  doTest([1, 2, 3], [0, 3]);
+  doTest([1, 2, 3], [0, 1, 5]);
+  doTest([1, 2, 3], [0, 3, 1, 2, 3]);
+}
+
 </script>
 
 </body>
diff --git a/chrome/test/functional/PYAUTO_TESTS b/chrome/test/functional/PYAUTO_TESTS
index 559ffbe..a63f210 100644
--- a/chrome/test/functional/PYAUTO_TESTS
+++ b/chrome/test/functional/PYAUTO_TESTS
@@ -128,9 +128,6 @@
       '-popups.PopupsTest.testUnblockedPopupAddedToOmnibox',
       # crbug.com/85600
       '-prefs.PrefsTest.testNavigationStateOnSessionRestore',
-      # crbug.com/122269
-      '-prefs_ui.PrefsUITest.testAddNewExceptionUI',
-      '-prefs_ui.PrefsUITest.testDeleteExceptionUI',
       # crbug.com/112051
       '-prefs_ui.PrefsUITest.testChangeExceptionBehaviorUI',
       # crbug.com/119183