Fix a browser crasher with negative index set on select popups.

webkit/glue/webmenurunner_mac.mm

Index: webkit/glue/webmenurunner_mac.mm
diff --git a/webkit/glue/webmenurunner_mac.mm b/webkit/glue/webmenurunner_mac.mm
index b7e48bafcd46256fcd2c0b2e6843166960e21ddf..82328cdd022713e2712fa4a2f0c128fc0075e66c 100644
--- a/webkit/glue/webmenurunner_mac.mm
+++ b/webkit/glue/webmenurunner_mac.mm
@@ -113,8 +113,15 @@ BOOL gNewNSMenuAPI;
            withBounds:(NSRect)bounds
          initialIndex:(int)index {
   if (gNewNSMenuAPI) {
-    NSMenuItem* selectedItem = [menu_ itemAtIndex:index];
-    [selectedItem setState:NSOnState];
+    int actualIndex;
+    if (index < 0 || index > [menu_ numberOfItems]) {
+      actualIndex = 0;
+    } else {
+      actualIndex = index;
+    }
+    NSMenuItem* selectedItem = [menu_ itemAtIndex:actualIndex];
+    if (actualIndex == index)
+      [selectedItem setState:NSOnState];

[Scott Hess - ex-Googler, 2010/12/01 01:29:51]

If I understand this correctly, what you want is the actual item, if possible,
else the item at 0?  This seems sort of convoluted for that.  How about:

NSMenuItem* selectedItem;
if (index < 0 || index > [menu_ numberOfItems]) {
  selectedItem = [menu_ itemAtIndex:0];
} else {
  selectedItem = [menu_ itemAtIndex:index];
  [selectedItem setState:NSOnState];
}

Hmm.  Or even:

NSMenuItem* selectedItem = [menu_ itemWithTag:index];
if (selectedItem) {
  [selectedItem setState:NSOnState];
} else {
  selectedItem = [menu_ itemWithTag:0];  // In case menu is empty.
}

[Jay Civelli, 2010/12/01 02:07:13]

Good idea. Done.

     NSPoint anchor = NSMakePoint(NSMinX(bounds) + kPopupXOffset,
                                  NSMaxY(bounds));
     [menu_ popUpMenuPositioningItem:selectedItem