Update a comment and fix a possible crash in HTMLSelectElement::setRecalcListItems.

third_party/WebKit/Source/core/html/HTMLSelectElement.cpp

 /*
  * Copyright (C) 2010 Nokia Corporation and/or its subsidiary(-ies).
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2001 Dirk Mueller (mueller@kde.org)
  * Copyright (C) 2004, 2005, 2006, 2007, 2009, 2010, 2011 Apple Inc. All rights reserved.
  *           (C) 2006 Alexey Proskuryakov (ap@nypop.com)
  * Copyright (C) 2010 Google Inc. All rights reserved.
  * Copyright (C) 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
  *
@@ skipping 781 matching lines @@
             shouldRecalc = false;
         } else if (lastChild() == &subject) {
             // The subject was appended. This doesn't handle elements in an
             // OPTGROUP.
             DCHECK(m_listItems.size() == 0 || m_listItems.last() != &subject);
             m_listItems.append(&subject);
             shouldRecalc = false;
         } else if (!subject.isDescendantOf(this)) {
             // |subject| was removed from this. This logic works well with
             // SELECT children and OPTGROUP children.
-            // TODO(tkent): m_listItems.size() is 0 in OOBE-related tests.  It
-            // should not happen.
+
+            // m_listItems might be empty, or might not have the OPTION.
+            //   1. Remove an OPTGROUP with OPTION children from a SELECT.
+            //   2. This function is called for the OPTGROUP removal.
+            //   3. m_shouldRecalcListItems becomes true.
+            //   4. recalcListItems() happens.  m_listItems has no OPTGROUP and
+            //      no its children.  m_shouldRecalcListItems becomes false.
+            //   5. This function is called for the removal of an OPTION child
+            //      of the OPTGROUP.
             if (m_listItems.size() > 0) {
                 size_t index;
                 // Avoid Vector::find() in typical cases.
-                if (m_listItems.first() == &subject) {
+                if (m_listItems.first() == &subject)
                     index = 0;
-                } else if (m_listItems.last() == &subject) {
+                else if (m_listItems.last() == &subject)
                     index = m_listItems.size() - 1;
-                } else {
+                else
                     index = m_listItems.find(&subject);
-                    DCHECK_NE(index, WTF::kNotFound);
+                if (index != WTF::kNotFound) {
+                    m_listItems.remove(index);
+                    shouldRecalc = false;
                 }
-                m_listItems.remove(index);
-                shouldRecalc = false;
             }
         }
     }
     m_shouldRecalcListItems = shouldRecalc;
 
     setOptionsChangedOnLayoutObject();
     if (!inShadowIncludingDocument()) {
         if (HTMLOptionsCollection* collection = cachedCollection<HTMLOptionsCollection>(SelectOptions))
             collection->invalidateCache();
         invalidateSelectedItems();
@@ skipping 1302 matching lines @@
 }
 
 void HTMLSelectElement::didMutateSubtree()
 {
     DCHECK(popupIsVisible());
     DCHECK(m_popup);
     m_popup->updateFromElement(PopupMenu::ByDOMChange);
 }
 
 } // namespace blink