Use correct index for child insertion

The index was sometimes too large due to a previous child not being
inserted when it was already aria-owned by another parent.

Bug: 1135887
Change-Id: If43ff07b6601f024d6d358779cb51d2214aaafb0
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2457548
Commit-Queue: Aaron Leventhal <aleventhal@chromium.org>
Commit-Queue: Dominic Mazzoni <dmazzoni@chromium.org>
Auto-Submit: Aaron Leventhal <aleventhal@chromium.org>
Reviewed-by: Dominic Mazzoni <dmazzoni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#814792}

third_party/blink/renderer/modules/accessibility/ax_node_object.cc

@@ -3453,12 +3453,13 @@ void AXNodeObject::InsertChild(AXObject* child,
     // unignored descendants as it goes.
     const auto& children = child->ChildrenIncludingIgnored();
     wtf_size_t length = children.size();
+    int new_index = index;
     for (wtf_size_t i = 0; i < length; ++i) {
       // If the child was owned, it will be added elsewhere as a direct
       // child of the object owning it, and not as an indirect child under
       // an object not included in the tree.
       if (!AXObjectCache().IsAriaOwned(children[i]))
-        children_.insert(index + i, children[i]);
+        children_.insert(new_index++, children[i]);
     }
   } else if (!child->IsMenuListOption()) {
     // MenuListOptions must only be added in AXMenuListPopup::AddChildren.