301858 2025-11-03 04:37:57 -0800 Update <option> when descendants change 2025-11-10 04:38:11 -0800 1 1 1 Unclassified WebKit Forms WebKit Nightly Build Unspecified Unspecified NEW https://bugs.webkit.org/show_bug.cgi?id=301859 InRadar P2 Normal --- 286642 1 annevk webkit-unassigned cdumez webkit-bug-importer wenson_hsieh oldest_to_newest 2155956 0 annevk 2025-11-03 04:37:57 -0800 We currently update the <option> element when its immediate children change, but to be fully correct we need to update it when descendants change. See this demo which requires HTMLEnhancedSelectParsingEnabled and should show "24" after clicking: <p><select id=select> <div> <option>2<div id=evil>3</div></option> </div> <div> <option>1</option> </div> </select> <p><button onclick=evil.textContent='4'>Click</button> This is not a critical issue, but would be nice to do correctly. Here's a sketch from rniwa on how to approach this: > I think we want to add a new Node flag to identify any descendent of option. Something like StateFlag::HasOptionAsAncestor. Then we want to propagate this flag in insertedIntoAncestor and removedFromAncestor. See Element::updateEffectiveTextDirectionIfNeeded() for an example. Once this flag is properly updated, we want to add a [[unlikely]] if statement which notifies option in Element::childrenChanged. 2157621 1 webkit-bug-importer 2025-11-10 04:38:11 -0800 <rdar://problem/164396354>