When we tried to share RenderStyle object for optgroup and option elements, see patch for bug 88059. We failed on following two tests: 1 fast/css/text-transform-select.html 2 fast/forms/select/menulist-disabled-option.html == fast/css/text-transform-select.html == RenderText object doesn't apply text transformation when calling setStyle. This is occurred in RenderMenuList::setText if (m_buttonText && !m_buttonText->isBR()) m_buttonText->setText(s.impl(), true); else { if (m_buttonText) m_buttonText->destroy(); m_buttonText = new (renderArena()) RenderText(document(), s.impl()); m_buttonText->setStyle(style()); When we don't share RenderStyle object, setText is called for each option element and m_buttonText->setText is called for same option more than once == RenderText::setText is called more than once. === Proposed Fix === It seems we create RenderText once then reuse it. == fast/forms/select/menulist-disabled-option.html == The problem was we called HTMLSelectElement::listItems() during DOM construction. The first disabled option was marked selected when it was added. === Proposed Fix === It seems it is better to store selected state into HTMLSelectElement rather than HTMLOptionElement object. Because "selected" attribute of the "option" element doesn't denote selected state, e.g. <select><option selected value="1">One</option><option selected value="2">Two</option> In this HTML, selected option is the first one even if second "option" has attribute "selected".
Created attachment 236603 [details] patch
https://trac.webkit.org/r172597