Steps to Reproduce

1. run the zul below

<zk>
	<zscript><![CDATA[
		ListModelList model = new ListModelList();
		model.add("a");
		model.add("b");
		model.add("c");
	]]></zscript>

	<listbox id="lb" model="${model}" height="200px">
	</listbox>
	<button label="add and clear">
		<attribute name="onClick"><![CDATA[
			model.add("1");
			lb.detach();
			model.clear();
		]]></attribute>
	</button>
</zk>

2. click the button

Current Result

SEVERE:
java.lang.IndexOutOfBoundsException: Index: 3, Size: 0
at java.util.ArrayList.rangeCheck(ArrayList.java:635)
at java.util.ArrayList.get(ArrayList.java:411)
at org.zkoss.zul.ListModelList.getElementAt(ListModelList.java:158)
at org.zkoss.zul.Listbox$Renderer.render(Listbox.java:2759)
at org.zkoss.zul.Listbox.doInitRenderer(Listbox.java:2584)
at org.zkoss.zul.Listbox.onInitRender(Listbox.java:2537)
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:57)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
at java.lang.reflect.Method.invoke(Method.java:606)
at org.zkoss.zk.ui.AbstractComponent.service(AbstractComponent.java:3143)
at org.zkoss.zk.ui.AbstractComponent.service(AbstractComponent.java:3074)
at org.zkoss.zk.ui.impl.EventProcessor.process(EventProcessor.java:138)

Expected Result

the Listbox disappears and no exception

Debug Info

1. if change calling order, e.g. call add() and clear() together, then no exception
2. if you remove add(), detach(), or clear(), then no exception

User Scenario

Due to our configuration approach where the data structure can change at runtime, we destroy all components and create them again on refreshing or saving.
To make sure, that everything is cleaned up correctly and we don't have any memory leaks, we call detach directly and also clear the model.
In this case we have some kind of data calculation prior to saving. The result is written back to the ui. This makes normally no sense (because everything is thrown away after saving), but validation is done afterwards, and if an error is detected, the structure is kept and saving is aborted.
When the error occurs, this listbox is refreshed and the model is changed. Afterwards the listbox is detached and the model is cleared. Everything in one roundtrip.
So I'm not sure if this is an invalid usage. Technically probably yes, but it makes sense in our context.

the pseudo code of the event listener

calculate
model.add()
if (validation succeed){
    save, refresh
    Listbox.detach()
    model.clear()
} else{
    abort saving
}