fix: guard ListView dynamic-height probe against shrunk model (fixes #333550)

src/vs/base/browser/ui/list/listView.ts

@@ -1765,7 +1765,14 @@ export class ListView<T> implements IListView<T> {
 		const diffs = new Array<number>(range.end - range.start).fill(0);
 		const measurements: IDynamicHeightMeasurement<T>[] = [];
 
-		for (let index = range.start; index < range.end; index++) {
+		// The model may shrink (e.g. a reentrant splice during a synchronous
+		// rerender, including one triggered by `renderer.renderElement` below) so
+		// that `range.end` now exceeds the current item count. Re-evaluate the
+		// current item count on every iteration and clamp the probe to the items
+		// that still exist; the caller's `modelDidChange` check
+		// (`this.items.length < range.end`) then detects the shrink and restarts
+		// the measurement against the updated range.
+		for (let index = range.start; index < range.end && index < this.items.length; index++) {
 			const item = this.items[index];
 			const delegateHeightDiff = this.probeDynamicHeightFromDelegate(item);
 			if (delegateHeightDiff !== undefined) {