diff --git a/docshell/shistory/src/nsSHEntry.cpp b/docshell/shistory/src/nsSHEntry.cpp
index b3d83e669b2..6f158c82846 100644
--- a/docshell/shistory/src/nsSHEntry.cpp
+++ b/docshell/shistory/src/nsSHEntry.cpp
@@ -642,7 +642,17 @@ nsSHEntry::AddChild(nsISHEntry * aChild, PRInt32 aOffset)
   }
 #endif
 
-  mChildren.InsertObjectAt(aChild, aOffset);
+  // InsertObjectAt allows only appending one object.
+  // If aOffset is larger than Count(), we must first manually
+  // set the capacity.
+  if (aOffset > mChildren.Count()) {
+    mChildren.SetCount(aOffset);
+  }
+  if (!mChildren.InsertObjectAt(aChild, aOffset)) {
+    NS_WARNING("Adding a child failed!");
+    aChild->SetParent(nsnull);
+    return NS_ERROR_FAILURE;
+  }
 
   return NS_OK;
 }