Fix a browser crasher with negative index set on select popups.

webkit/glue/webmenurunner_mac.mm

 // Copyright (c) 2009 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "webkit/glue/webmenurunner_mac.h"
 
 #include "base/sys_string_conversions.h"
 
 namespace {
 
@@ skipping 73 matching lines @@
                                           action:@selector(menuItemSelected:)
                                    keyEquivalent:@""];
   [menuItem setEnabled:(item.enabled && item.type != WebMenuItem::GROUP)];
   [menuItem setTarget:self];
   if (attrs) {
     scoped_nsobject<NSAttributedString> attrTitle(
         [[NSAttributedString alloc] initWithString:title
                                         attributes:attrs]);
     [menuItem setAttributedTitle:attrTitle];
   }
-  if (gNewNSMenuAPI)
-    [menuItem setTag:[menu_ numberOfItems] - 1];
+  [menuItem setTag:[menu_ numberOfItems] - 1];
 }
 
 // Reflects the result of the user's interaction with the popup menu. If NO, the
 // menu was dismissed without the user choosing an item, which can happen if the
 // user clicked outside the menu region or hit the escape key. If YES, the user
 // selected an item from the menu.
 - (BOOL)menuItemWasChosen {
   return menuItemWasChosen_;
 }
 
 - (void)menuItemSelected:(id)sender {
   menuItemWasChosen_ = YES;
   if (gNewNSMenuAPI)
     index_ = [sender tag];
 }
 
 - (void)runMenuInView:(NSView*)view
            withBounds:(NSRect)bounds
          initialIndex:(int)index {
   if (gNewNSMenuAPI) {
-    NSMenuItem* selectedItem = [menu_ itemAtIndex:index];
-    [selectedItem setState:NSOnState];
+    // index might be out of bounds, in which case we set no selection.
+    NSMenuItem* selectedItem = [menu_ itemWithTag:index];
+    if (selectedItem) {
+      [selectedItem setState:NSOnState];
+    } else {
+      selectedItem = [menu_ itemWithTag:0];
+    }
     NSPoint anchor = NSMakePoint(NSMinX(bounds) + kPopupXOffset,
                                  NSMaxY(bounds));
     [menu_ popUpMenuPositioningItem:selectedItem
                          atLocation:anchor
                              inView:view];
   } else {
     // Set up the button cell, converting to NSView coordinates. The menu is
     // positioned such that the currently selected menu item appears over the
     // popup button, which is the expected Mac popup menu behavior.
     NSPopUpButtonCell* button = [[NSPopUpButtonCell alloc] initTextCell:@""
                                                               pullsDown:NO];
     [button autorelease];
     [button setMenu:menu_];
-    [button selectItemAtIndex:index];
+    // We use selectItemWithTag below so if the index is out-of-bounds nothing
+    // bad happens.
+    [button selectItemWithTag:index];
     [button setFont:[NSFont menuFontOfSize:fontSize_]];
 
     // Create a dummy view to associate the popup with, since the OS will use
     // that view for positioning the menu.
     NSView* dummyView = [[[NSView alloc] initWithFrame:bounds] autorelease];
     [view addSubview:dummyView];
     NSRect dummyBounds = [dummyView convertRect:bounds fromView:view];
 
     // Display the menu, and set a flag if a menu item was chosen.
     [button performClickWithFrame:dummyBounds inView:dummyView];
@@ skipping 61 matching lines @@
                            characters:@""
           charactersIgnoringModifiers:escape_str
                             isARepeat:NO
                               keyCode:0x1B];
   }
 
   return event;
 }
 
 }  // namespace webkit_glue