Open the URL, position the mouse inside the list box and use the scroll wheel to scroll up or down. Crashes r20610. In a debug build you get: ASSERTION FAILED: i < size() (JavaScriptCore.framework/PrivateHeaders/Vector.h:406 const T& WTF::Vector<T, inlineCapacity>::at(size_t) const [with T = WebCore::HTMLElement*, long unsigned int inlineCapacity = 0ul]) Thread 0 Crashed: 0 com.apple.WebCore 0x0165f2b8 WTF::Vector<WebCore::HTMLElement*, (unsigned long)0>::at(unsigned long) const + 120 (Vector.h:406) 1 com.apple.WebCore 0x0165f320 WTF::Vector<WebCore::HTMLElement*, (unsigned long)0>::operator[](int) const + 44 (Vector.h:415) 2 com.apple.WebCore 0x0144b4f8 WebCore::RenderListBox::paintItemBackground(WebCore::RenderObject::PaintInfo&, int, int, int) + 96 (RenderListBox.cpp:351) 3 com.apple.WebCore 0x0144ce20 WebCore::RenderListBox::paintObject(WebCore::RenderObject::PaintInfo&, int, int) + 300 (RenderListBox.cpp:268) 4 com.apple.WebCore 0x01181bc4 WebCore::RenderBlock::paint(WebCore::RenderObject::PaintInfo&, int, int) + 672 (RenderBlock.cpp:1326) [...]
Created attachment 13909 [details] Patch
Comment on attachment 13909 [details] Patch r=me
<rdar://problem/5103226>
Landed in r20645.