Bug 237912 – REGRESSION(r288307): instanceof value wrong in MutationObserver callback for Safari extensions

• Status: RESOLVED
• Resolution: FIXED
• Component: Bindings

[Jeff Johnson]

Created attachment 454735 [details]
Sample Xcode project

This bug occurs with Safari Technology Release 141 (Safari 15.4, WebKit 16614.1.3.7) on macOS 11.6.5. The bug does not occur with Safari 15.3 or Safari 15.4 (released yesterday), only with Safari Technology Preview.

The bug is that JavaScript instanceof is returning false when it should return true in the callback of MutationObserver for Safari extensions, both Safari web extensions and Safari app extensions. This bug does not seem to affect scripts in the web pages, only extension scripts.

Attached is a sample Safari web extension Xcode project that demonstrates the bug. Just enable the extension, run it on any web site, such as cnn.com, and look at the console log. For HTML <div> elements, it should log true true for instanceof HTMLElement and instanceof HTMLDivElement, but it logs false false in Safari Technology Preview 141.

This bug is a massive problem for me, a showstopper for several of my Safari extensions in the App Store. It totally breaks essential functionality in my extensions.

[Jeff Johnson]

Note that instanceof works correctly in the setTimeout function. It's only wrong in the MutationObserver callback.

[Jeff Johnson]

I can also reproduce with Safari Technology Preview 141 on macOS 12.3 on Apple Silicon. Safari 15.4 (17613.1.17.1.6) is not affected.

[Jon Davis]

Thank you for the bug report. I’ve cc’d some engineers to investigate.

[Radar WebKit Bug Importer]

<rdar://problem/90333276>

[Alexey Shvayka]

Created attachment 455377 [details]
Patch

[EWS]

Committed r291694 (248736@main): <https://commits.webkit.org/248736@main>

All reviewed patches have been landed. Closing bug and clearing flags on attachment 455377 [details].