Fix a browser crasher with negative index set on select popups.

webkit/glue/webmenurunner_mac.mm

Index: webkit/glue/webmenurunner_mac.mm
diff --git a/webkit/glue/webmenurunner_mac.mm b/webkit/glue/webmenurunner_mac.mm
index b7e48bafcd46256fcd2c0b2e6843166960e21ddf..db5696ed1ed5c0c6543291ea79d9d1c4d0728182 100644
--- a/webkit/glue/webmenurunner_mac.mm
+++ b/webkit/glue/webmenurunner_mac.mm
@@ -91,8 +91,7 @@ BOOL gNewNSMenuAPI;
                                         attributes:attrs]);
     [menuItem setAttributedTitle:attrTitle];
   }
-  if (gNewNSMenuAPI)
-    [menuItem setTag:[menu_ numberOfItems] - 1];
+  [menuItem setTag:[menu_ numberOfItems] - 1];
 }
 
 // Reflects the result of the user's interaction with the popup menu. If NO, the
@@ -113,8 +112,13 @@ BOOL gNewNSMenuAPI;
            withBounds:(NSRect)bounds
          initialIndex:(int)index {
   if (gNewNSMenuAPI) {
-    NSMenuItem* selectedItem = [menu_ itemAtIndex:index];
-    [selectedItem setState:NSOnState];
+    // index might be out of bounds, in which case we set no selection.
+    NSMenuItem* selectedItem = [menu_ itemWithTag:index];
+    if (selectedItem) {
+      [selectedItem setState:NSOnState];
+    } else {
+      selectedItem = [menu_ itemWithTag:0];
+    }
     NSPoint anchor = NSMakePoint(NSMinX(bounds) + kPopupXOffset,
                                  NSMaxY(bounds));
     [menu_ popUpMenuPositioningItem:selectedItem
@@ -126,6 +130,8 @@ BOOL gNewNSMenuAPI;
     // popup button, which is the expected Mac popup menu behavior.
     NSPopUpButtonCell* button = [[NSPopUpButtonCell alloc] initTextCell:@""
                                                               pullsDown:NO];
+    if (index < -1 || index >= [button numberOfItems])
+      index = -1;  // -1 in selectItemAtIndex means no selection.

[Scott Hess - ex-Googler, 2010/12/01 02:53:36]

What I meant down here was that -selectItemWithTag: with index too big or too
small would automatically work (because no item would be so tagged).  It can't
be completely consistent with the above code, but the style is similar.

[Jay Civelli, 2010/12/01 16:58:24]

Ah, I see. Done.

     [button autorelease];
     [button setMenu:menu_];
     [button selectItemAtIndex:index];