Merge 130717 - HTMLSelectElement::typeAheadFind depends on implementation dependent behavior

Source/WebCore/html/HTMLSelectElement.cpp

 /*
  * Copyright (C) 2010 Nokia Corporation and/or its subsidiary(-ies).
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2001 Dirk Mueller (mueller@kde.org)
  * Copyright (C) 2004, 2005, 2006, 2007, 2009, 2010, 2011 Apple Inc. All rights reserved.
  *           (C) 2006 Alexey Proskuryakov (ap@nypop.com)
  * Copyright (C) 2010 Google Inc. All rights reserved.
  * Copyright (C) 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
  *
@@ skipping 1496 matching lines @@
             searchStartOffset = 0;
         }
     }
 
     const Vector<HTMLElement*>& items = listItems();
     int itemCount = items.size();
     if (itemCount < 1)
         return;
 
     int selected = selectedIndex();
-    int index = (optionToListIndex(selected >= 0 ? selected : 0) + searchStartOffset) % itemCount;
-    ASSERT(index >= 0);
+    int index = optionToListIndex(selected >= 0 ? selected : 0) + searchStartOffset;
+    if (index < 0)
+        return;
+    index %= itemCount;
 
     // Compute a case-folded copy of the prefix string before beginning the search for
     // a matching element. This code uses foldCase to work around the fact that
     // String::startWith does not fold non-ASCII characters. This code can be changed
     // to use startWith once that is fixed.
     String prefixWithCaseFolded(prefix.foldCase());
     for (int i = 0; i < itemCount; ++i, index = (index + 1) % itemCount) {
         HTMLElement* element = items[index];
         if (!element->hasTagName(optionTag) || toHTMLOptionElement(element)->disabled())
             continue;
@@ skipping 72 matching lines @@
 
 const HTMLSelectElement* toHTMLSelectElement(const Node* node)
 {
     ASSERT(!node || node->hasTagName(selectTag));
     return static_cast<const HTMLSelectElement*>(node);
 }
 
 #endif
 
 } // namespace