Pressing tab with no selection while the form autofill was showing would crash.

BUG=4847
TEST=Open a form, type something so the autofill shows, press tab with no selection.
Review URL: http://codereview.chromium.org/13019

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@6153 0039d316-1c4b-4281-b951-d872f2087c98

1 files changed, 5 insertions, 3 deletions

diff --git a/webkit/port/platform/chromium/PopupMenuChromium.cpp b/webkit/port/platform/chromium/PopupMenuChromium.cpp
index c11c525..c85b1e2 100644
--- a/webkit/port/platform/chromium/PopupMenuChromium.cpp
+++ b/webkit/port/platform/chromium/PopupMenuChromium.cpp
@@ -639,8 +639,10 @@ bool PopupListBox::handleKeyEvent(const PlatformKeyboardEvent& event)
             m_popupClient->setTextFromItem(m_selectedIndex);
     } else if (!m_setTextOnIndexChange &&
                event.windowsVirtualKeyCode() == VKEY_TAB) {
-        // TAB is a special case as it should select the item and advance focus.
-        m_popupClient->setTextFromItem(m_selectedIndex);
+        // TAB is a special case as it should select the current item if any and
+        // advance focus.
+        if (m_selectedIndex >= 0)
+            m_popupClient->setTextFromItem(m_selectedIndex);
         // Return false so the TAB key event is propagated to the page.
         return false;
     }
@@ -697,7 +699,7 @@ void PopupListBox::typeAheadFind(const PlatformKeyboardEvent& event)
     }
 
     int itemCount = numItems();
-    int index = (m_selectedIndex + searchStartOffset) % itemCount;
+    int index = (max(0, m_selectedIndex) + searchStartOffset) % itemCount;
     for (int i = 0; i < itemCount; i++, index = (index + 1) % itemCount) {
         if (!isSelectableItem(index))
             continue;