Clicking on a select with size other than 1 and no children results in a crash. This is reproducible every time.
Created attachment 11747 [details]
Reduced test case
Confirming - I also get the following assertion failure
ASSERTION FAILED: i < size()
Created attachment 11771 [details]
This patch should fix it. The testcase is a bit tricky but I think it does the job, with ToT it shows the crash, with my patch it will say Passed.
Landed in r18089.