Bug 301858 – Update <option> when descendants change

• Status: NEW
• Component: Forms

[Anne van Kesteren]

We currently update the <option> element when its immediate children change, but to be fully correct we need to update it when descendants change. See this demo which requires HTMLEnhancedSelectParsingEnabled and should show "24" after clicking:

<p><select id=select>
 <div>
  <option>2<div id=evil>3</div></option>
 </div>
 <div>
  <option>1</option>
 </div>
</select>
<p><button onclick=evil.textContent='4'>Click</button>

This is not a critical issue, but would be nice to do correctly. Here's a sketch from rniwa on how to approach this:

> I think we want to add a new Node flag to identify any descendent of option. Something like StateFlag::HasOptionAsAncestor. Then we want to propagate this flag in insertedIntoAncestor and removedFromAncestor. See Element::updateEffectiveTextDirectionIfNeeded() for an example. Once this flag is properly updated, we want to add a [[unlikely]] if statement which notifies option in Element::childrenChanged.

[Radar WebKit Bug Importer]

<rdar://problem/164396354>