Clicking on a select with size other than 1 and no children results in a crash. This is reproducible every time.
Created attachment 11747 [details] Reduced test case
Confirming - I also get the following assertion failure ASSERTION FAILED: i < size() (/Users/matt/Code/WebKit/WebKitBuild/Debug/JavaScriptCore.framework/PrivateHeaders/Vector.h:387 const T& WTF::Vector<T, inlineCapacity>::at(size_t) const [with T = WebCore::HTMLElement*, long unsigned int inlineCapacity = 0ul])
Created attachment 11771 [details] First attempt This patch should fix it. The testcase is a bit tricky but I think it does the job, with ToT it shows the crash, with my patch it will say Passed. Cheers, Rob.
Landed in r18089.