Reproducing Steps:

There are two different exceptions thrown in the same zul and ViewModel (in the attachment).

prepare to reproduce:

1. download the attachment
2. correct package name and import statement to no compilation error
3. check zul's ViewModel name and run it

1. Add Issue

1. enter some value in the textbox
2. click "Add" button
3. Null pointer exception is thrown as follows:

   嚴重的: >>java.lang.NullPointerException
   >>	at org.zkoss.zul.Listbox.setSelectedIndex(Listbox.java:929)
   >>	at org.zkoss.zul.Listbox.onListDataChange(Listbox.java:2531)
   >>	at org.zkoss.zul.Listbox.access$800(Listbox.java:261)
   >>	at org.zkoss.zul.Listbox$4.onChange(Listbox.java:461)
   >>	at org.zkoss.zul.AbstractListModel.fireEvent(AbstractListModel.java:61)
   >>	at org.zkoss.zul.ListModelList.fireSelectionEvent(ListModelList.java:438)
   >>	at org.zkoss.zul.AbstractListModel.addToSelection(AbstractListModel.java:130)
   >>	at org.zkoss.bind.converter.sys.ListboxSelectedItemConverter.coerceToUi(ListboxSelectedItemConverter.java:48)
   >>	at org.zkoss.bind.impl.LoadPropertyBindingImpl.load(LoadPropertyBindingImpl.java:74)
   >>	at org.zkoss.bind.impl.BinderImpl.loadOnPropertyChange(BinderImpl.java:360)
   >>	at org.zkoss.bind.impl.BinderImpl.access$100(BinderImpl.java:98)
   >>	at org.zkoss.bind.impl.BinderImpl$QueueListener.onEvent(BinderImpl.java:278)
   >>	at org.zkoss.zk.ui.event.impl.DesktopEventQueue$QueueListener.onEvent(DesktopEventQueue.java:145)
   >>	at org.zkoss.zk.ui.AbstractComponent.onEvent(AbstractComponent.java:2739)
   >>	at org.zkoss.zk.ui.AbstractComponent.service(AbstractComponent.java:2710)
   >>	at org.zkoss.zk.ui.AbstractComponent.service(AbstractComponent.java:2651)
   >>	at org.zkoss.zk.ui.impl.EventProcessor.process(EventProcessor.java:136)
   >>	at org.zkoss.zk.ui.impl.UiEngineImpl.processEvent(UiEngineImpl.java:1710)
   >>	at org.zkoss.zk.ui.impl.UiEngineImpl.process(UiEngineImpl.java:1495)
   >>	at org.zkoss.zk.ui.impl.UiEngineImpl.execUpdate(UiEngineImpl.java:1205)
   >>	at org.zkoss.zk.au.http.DHtmlUpdateServlet.process(DHtmlUpdateServlet.java:583)
   >>	at org.zkoss.zk.au.http.DHtmlUpdateServlet.doGet(DHtmlUpdateServlet.java:481)
   >>	at org.zkoss.zk.au.http.DHtmlUpdateServlet.doPost(DHtmlUpdateServlet.java:489)
   >>	at javax.servlet.http.HttpServlet.service(HttpServlet.java:727)
   >>	at javax.servlet.http.HttpServlet.service(HttpServlet.java:820)
   >>	at org.mortbay.jetty.servlet.ServletHolder.handle(ServletHolder.java:511)
   >>	at org.mortbay.jetty.servlet.ServletHandler.handle(ServletHandler.java:401)
   >>	at org.mortbay.jetty.security.SecurityHandler.handle(SecurityHandler.java:216)
   >>	at org.mortbay.jetty.servlet.SessionHandler.handle(SessionHandler.java:182)
   >>	at org.mortbay.jetty.handler.ContextHandler.handle(ContextHandler.java:766)
   >>	at org.mortbay.jetty.webapp.WebAppContext.handle(WebAppContext.java:450)
   >>	at org.mortbay.jetty.handler.HandlerWrapper.handle(HandlerWrapper.java:152)
   >>	at org.mortbay.jetty.Server.handle(Server.java:326)
   >>	at org.mortbay.jetty.HttpConnection.handleRequest(HttpConnection.java:542)
   >>	at org.mortbay.jetty.HttpConnection$RequestHandler.content(HttpConnection.java:945)
   >>	at org.mortbay.jetty.HttpParser.parseNext(HttpParser.java:756)
   >>	at org.mortbay.jetty.HttpParser.parseAvailable(HttpParser.java:218)
   >>	at org.mortbay.jetty.HttpConnection.handle(HttpConnection.java:404)
   >>	at org.mortbay.io.nio.SelectChannelEndPoint.run(SelectChannelEndPoint.java:410)
   >>	at org.mortbay.thread.QueuedThreadPool$PoolThread.run(QueuedThreadPool.java:582)
   

Initial Observation

1. This issue only happens under "paging" mold instead of "default" mold
2. add a statenent pickedItem = new Item(); after adding to list will eliminate the exception.
3. move "itemList" in front of "pickedItem" in @NotifyChange can eliminate NullPointerException

Incomplete Reproducing Case

This a incomplete page that I tried to reproduce the issue under MVC but no succeeded.

<zk>
	<div width="400px" >
		<listbox id="listbox" mold="paging" pageSize="10">
			<listhead>
				<listheader label="name" />
			</listhead>
			<template name="model" >
				<listitem>
					<listcell label="${each}" />
				</listitem>
			</template>
		</listbox>
		<button label="Phase1" onClick="phase1()"/>
		<button label="Phose2" onClick="phase2()"/>
	</div>
<zscript><![CDATA[
	List itemList = new LinkedList();
	for (int i= 0 ; i < 10 ; i ++){
		itemList.add("item "+i);
	}
	ListModelList listModelList = new ListModelList(itemList);
	listbox.setModel(listModelList);
	
	String t = "item 10";
	
	public void phase1(){
		listModelList.addSelection(t);
	}
	
	public void phase2(){
		itemList.add(t);
		listModelList.addSelection(t);
		listModelList = new ListModelList(itemList);
		listModelList.addSelection(t);
		listbox.setModel(listModelList);
	}
]]>
</zscript>
</zk>

2. Delete Issue

1. select last item, click "Delete"
2. an exception thrown as follows:

嚴重的: >>java.lang.IndexOutOfBoundsException: Index: 9, Size: 9
>>	at java.util.LinkedList.entry(LinkedList.java:368)
>>	at java.util.LinkedList.get(LinkedList.java:313)
>>	at org.zkoss.zul.ListModelList.getElementAt(ListModelList.java:150)
>>	at org.zkoss.zul.Listbox.doSelectionChanged(Listbox.java:2580)
>>	at org.zkoss.zul.Listbox.onListDataChange(Listbox.java:2534)
>>	at org.zkoss.zul.Listbox.access$800(Listbox.java:261)
>>	at org.zkoss.zul.Listbox$4.onChange(Listbox.java:461)
>>	at org.zkoss.zul.AbstractListModel.fireEvent(AbstractListModel.java:61)
>>	at org.zkoss.zul.ListModelList.fireSelectionEvent(ListModelList.java:438)
>>	at org.zkoss.zul.AbstractListModel.addToSelection(AbstractListModel.java:130)
>>	at org.zkoss.bind.converter.sys.ListboxSelectedItemConverter.coerceToUi(ListboxSelectedItemConverter.java:48)
>>	at org.zkoss.bind.impl.LoadPropertyBindingImpl.load(LoadPropertyBindingImpl.java:74)
>>	at org.zkoss.bind.impl.BinderImpl.loadOnPropertyChange(BinderImpl.java:360)
>>	at org.zkoss.bind.impl.BinderImpl.access$100(BinderImpl.java:98)
>>	at org.zkoss.bind.impl.BinderImpl$QueueListener.onEvent(BinderImpl.java:278)
>>	at org.zkoss.zk.ui.event.impl.DesktopEventQueue$QueueListener.onEvent(DesktopEventQueue.java:145)
>>	at org.zkoss.zk.ui.AbstractComponent.onEvent(AbstractComponent.java:2739)
>>	at org.zkoss.zk.ui.AbstractComponent.service(AbstractComponent.java:2710)
>>	at org.zkoss.zk.ui.AbstractComponent.service(AbstractComponent.java:2651)
>>	at org.zkoss.zk.ui.impl.EventProcessor.process(EventProcessor.java:136)
>>	at org.zkoss.zk.ui.impl.UiEngineImpl.processEvent(UiEngineImpl.java:1710)
>>	at org.zkoss.zk.ui.impl.UiEngineImpl.process(UiEngineImpl.java:1495)
>>	at org.zkoss.zk.ui.impl.UiEngineImpl.execUpdate(UiEngineImpl.java:1205)
>>	at org.zkoss.zk.au.http.DHtmlUpdateServlet.process(DHtmlUpdateServlet.java:583)
>>	at org.zkoss.zk.au.http.DHtmlUpdateServlet.doGet(DHtmlUpdateServlet.java:481)
>>	at org.zkoss.zk.au.http.DHtmlUpdateServlet.doPost(DHtmlUpdateServlet.java:489)
>>	at javax.servlet.http.HttpServlet.service(HttpServlet.java:727)
>>	at javax.servlet.http.HttpServlet.service(HttpServlet.java:820)
>>	at org.mortbay.jetty.servlet.ServletHolder.handle(ServletHolder.java:511)
>>	at org.mortbay.jetty.servlet.ServletHandler.handle(ServletHandler.java:401)
>>	at org.mortbay.jetty.security.SecurityHandler.handle(SecurityHandler.java:216)
>>	at org.mortbay.jetty.servlet.SessionHandler.handle(SessionHandler.java:182)
>>	at org.mortbay.jetty.handler.ContextHandler.handle(ContextHandler.java:766)
>>	at org.mortbay.jetty.webapp.WebAppContext.handle(WebAppContext.java:450)
>>	at org.mortbay.jetty.handler.HandlerWrapper.handle(HandlerWrapper.java:152)
>>	at org.mortbay.jetty.Server.handle(Server.java:326)
>>	at org.mortbay.jetty.HttpConnection.handleRequest(HttpConnection.java:542)
>>	at org.mortbay.jetty.HttpConnection$RequestHandler.content(HttpConnection.java:945)
>>	at org.mortbay.jetty.HttpParser.parseNext(HttpParser.java:756)
>>	at org.mortbay.jetty.HttpParser.parseAvailable(HttpParser.java:218)
>>	at org.mortbay.jetty.HttpConnection.handle(HttpConnection.java:404)
>>	at org.mortbay.io.nio.SelectChannelEndPoint.run(SelectChannelEndPoint.java:410)
>>	at org.mortbay.thread.QueuedThreadPool$PoolThread.run(QueuedThreadPool.java:582)

Initial Observation:

1. This issue only happens under both "paging" and "default" mold
2. add a statement pickedItem = null; after deletion will eliminate the exception. But use a statement pickedItem = new Item() still cause the exception.
3. move "itemList" in front of "pickedItem" in @NotifyChange can eliminate the exception, like {{@NotifyChange( {"itemList","pickedItem"}

   )}}