From de3f899c022bc428d293fe824ee0b38a00776249 Mon Sep 17 00:00:00 2001
From: Aditya Keerthi <akeerthi@apple.com>
Date: Mon, 10 Apr 2023 16:20:53 -0700
Subject: [PATCH] Cherry-pick 262791@main (d86fed1a2d3d).
 https://bugs.webkit.org/show_bug.cgi?id=255230

    REGRESSION (255086@main): Safari 16.4 and above does not render <option> label/text updates until <select> is focused
    https://bugs.webkit.org/show_bug.cgi?id=255230
    rdar://107838336

    Reviewed by Chris Dumez.

    255086@main removed the call to `HTMLSelectElement::setRecalcListItems` in
    `HTMLSelectElement::optionElementChildrenChanged` so that updating the text
    inside an <option> element does not reset the <select> element's selected option.

    However, this broke rendering of the option's new text, since
    `setRecalcListItems` contained logic to update the rendered text. Fix by
    reintroducing the logic that is responsible for ensuring the displayed text
    matches the <option> element's text.

    Add a regression (reference) test which would have caught this issue.

    * LayoutTests/fast/forms/select/selected-option-update-inner-html-expected.html: Added.
    * LayoutTests/fast/forms/select/selected-option-update-inner-html.html: Added.
    * Source/WebCore/html/HTMLSelectElement.cpp:
    (WebCore::HTMLSelectElement::optionElementChildrenChanged):

    Canonical link: https://commits.webkit.org/262791@main
---
 ...lected-option-update-inner-html-expected.html |  8 ++++++++
 .../selected-option-update-inner-html.html       | 16 ++++++++++++++++
 Source/WebCore/html/HTMLSelectElement.cpp        |  2 ++
 3 files changed, 26 insertions(+)
 create mode 100644 LayoutTests/fast/forms/select/selected-option-update-inner-html-expected.html
 create mode 100644 LayoutTests/fast/forms/select/selected-option-update-inner-html.html
diff --git a/LayoutTests/fast/forms/select/selected-option-update-inner-html-expected.html b/LayoutTests/fast/forms/select/selected-option-update-inner-html-expected.html
new file mode 100644
index 000000000000..0acb6bd260e5
--- /dev/null
+++ b/LayoutTests/fast/forms/select/selected-option-update-inner-html-expected.html
@@ -0,0 +1,8 @@
+<!DOCTYPE html>
+<html>
+<body>
+<select>
+    <option>Bar</option>
+</select>
+</body>
+</html>
diff --git a/LayoutTests/fast/forms/select/selected-option-update-inner-html.html b/LayoutTests/fast/forms/select/selected-option-update-inner-html.html
new file mode 100644
index 000000000000..1e07eb2b93df
--- /dev/null
+++ b/LayoutTests/fast/forms/select/selected-option-update-inner-html.html
@@ -0,0 +1,16 @@
+<!DOCTYPE html>
+<html>
+<body>
+<select>
+    <option>Foo</option>
+</select>
+<script>
+
+addEventListener("load", () => {
+    let option = document.querySelector("option");
+    option.innerHTML = "Bar";
+});
+
+</script>
+</body>
+</html>
diff --git a/Source/WebCore/html/HTMLSelectElement.cpp b/Source/WebCore/html/HTMLSelectElement.cpp
index 07bbeb13cf5c..69634f28189c 100644
--- a/Source/WebCore/html/HTMLSelectElement.cpp
+++ b/Source/WebCore/html/HTMLSelectElement.cpp
@@ -426,6 +426,8 @@ void HTMLSelectElement::childrenChanged(const ChildChange& change)
 
 void HTMLSelectElement::optionElementChildrenChanged()
 {
+    setOptionsChangedOnRenderer();
+    invalidateStyleForSubtree();
     updateValidity();
     if (auto* cache = document().existingAXObjectCache())
         cache->childrenChanged(this);
