diff --git a/content/html/content/src/nsHTMLSelectElement.cpp b/content/html/content/src/nsHTMLSelectElement.cpp
index b7744c56870a..87e8f5dae9a7 100644
--- a/content/html/content/src/nsHTMLSelectElement.cpp
+++ b/content/html/content/src/nsHTMLSelectElement.cpp
@@ -598,8 +598,14 @@ nsOptionList::GetLength(PRUint32* aLength)
 NS_IMETHODIMP
 nsOptionList::Item(PRUint32 aIndex, nsIDOMNode** aReturn)
 {
-  *aReturn = (nsIDOMNode*)mElements.ElementAt(aIndex);
-  NS_ADDREF(*aReturn);
+  PRUint32 length = 0;
+  GetLength(&length);
+  if (aIndex >= length) {
+    *aReturn = nsnull;
+  } else {
+    *aReturn = (nsIDOMNode*)mElements.ElementAt(aIndex);
+    NS_ADDREF(*aReturn);
+  }
   return NS_OK;
 }
 
diff --git a/layout/html/content/src/nsHTMLSelectElement.cpp b/layout/html/content/src/nsHTMLSelectElement.cpp
index b7744c56870a..87e8f5dae9a7 100644
--- a/layout/html/content/src/nsHTMLSelectElement.cpp
+++ b/layout/html/content/src/nsHTMLSelectElement.cpp
@@ -598,8 +598,14 @@ nsOptionList::GetLength(PRUint32* aLength)
 NS_IMETHODIMP
 nsOptionList::Item(PRUint32 aIndex, nsIDOMNode** aReturn)
 {
-  *aReturn = (nsIDOMNode*)mElements.ElementAt(aIndex);
-  NS_ADDREF(*aReturn);
+  PRUint32 length = 0;
+  GetLength(&length);
+  if (aIndex >= length) {
+    *aReturn = nsnull;
+  } else {
+    *aReturn = (nsIDOMNode*)mElements.ElementAt(aIndex);
+    NS_ADDREF(*aReturn);
+  }
   return NS_OK;
 }