Skip to content

MutationObserver.observe() incorrectly throws when attributeOldValue or characterDataOldValue is present with value false#66529

Merged
webkit-commit-queue merged 1 commit into
WebKit:mainfrom
cdumez:316382_MutationObserver_fix
Jun 5, 2026
Merged

MutationObserver.observe() incorrectly throws when attributeOldValue or characterDataOldValue is present with value false#66529
webkit-commit-queue merged 1 commit into
WebKit:mainfrom
cdumez:316382_MutationObserver_fix

Conversation

@cdumez
Copy link
Copy Markdown
Contributor

@cdumez cdumez commented Jun 5, 2026

a811f8d

MutationObserver.observe() incorrectly throws when attributeOldValue or characterDataOldValue is present with value false
https://bugs.webkit.org/show_bug.cgi?id=316382

Reviewed by Ryosuke Niwa.

Per https://dom.spec.whatwg.org/#dom-mutationobserver-observe, if either
attributeOldValue or attributeFilter is *present* in the init dictionary
and attributes is omitted, attributes is set to true. The same applies to
characterDataOldValue and characterData. "Present" here means the
dictionary key was provided, regardless of its value.

WebKit was conflating presence with truthiness: AttributeOldValue /
CharacterDataOldValue option flags were only added when the value was
true, and the auto-set step keyed off those flags rather than off
presence. As a result, observe(node, { attributeOldValue: false }) — and
likewise for characterDataOldValue: false — incorrectly threw a
TypeError instead of registering an attribute observer with no
old-value delivery.

Use std::optional::has_value() to test presence in the auto-set step,
matching Blink & Gecko's behavior and the spec.

Test: imported/w3c/web-platform-tests/dom/nodes/MutationObserver-sanity.html

* LayoutTests/imported/w3c/web-platform-tests/dom/nodes/MutationObserver-sanity-expected.txt:
* LayoutTests/imported/w3c/web-platform-tests/dom/nodes/MutationObserver-sanity.html:
* Source/WebCore/dom/MutationObserver.cpp:
(WebCore::MutationObserver::observe):

Canonical link: https://commits.webkit.org/314623@main

787d63f

Misc iOS, visionOS, tvOS & watchOS macOS Linux Windows Apple Internal
✅ 🧪 style ✅ 🛠 ios ✅ 🛠 mac ✅ 🛠 wpe ✅ 🛠 win ✅ 🛠 ios-apple
✅ 🧪 bindings ✅ 🛠 ios-sim ✅ 🛠 mac-AS-debug ✅ 🧪 wpe-wk2 🧪 win-tests ✅ 🛠 mac-apple
✅ 🧪 webkitperl ✅ 🧪 ios-wk2 ✅ 🧪 api-mac ✅ 🧪 api-wpe ✅ 🛠 vision-apple
✅ 🧪 ios-wk2-wpt ✅ 🧪 api-mac-debug ✅ 🛠 gtk3-libwebrtc
🧪 api-ios ✅ 🧪 mac-wk1 ✅ 🛠 gtk
✅ 🛠 ios-safer-cpp ✅ 🧪 mac-wk2 ✅ 🧪 gtk-wk2
✅ 🛠 vision ✅ 🧪 mac-AS-debug-wk2 ✅ 🧪 api-gtk
✅ 🛠 🧪 merge ✅ 🛠 vision-sim ✅ 🧪 mac-wk2-stress ✅ 🛠 playstation
✅ 🧪 vision-wk2 ✅ 🧪 mac-intel-wk2
✅ 🛠 tv ✅ 🛠 mac-safer-cpp
✅ 🛠 tv-sim ❌ 🧪 mac-site-isolation
✅ 🛠 watch
✅ 🛠 watch-sim

@cdumez cdumez self-assigned this Jun 5, 2026
@cdumez cdumez added the DOM For bugs specific to XML/HTML DOM elements (including parsing). label Jun 5, 2026
@cdumez cdumez marked this pull request as ready for review June 5, 2026 09:29
@cdumez cdumez requested a review from rniwa as a code owner June 5, 2026 09:29
@cdumez cdumez requested a review from annevk June 5, 2026 09:29
@cdumez cdumez added the merge-queue Applied to send a pull request to merge-queue label Jun 5, 2026
@cdumez
Copy link
Copy Markdown
Contributor Author

cdumez commented Jun 5, 2026

Test upstreaming: web-platform-tests/wpt#60421

…or characterDataOldValue is present with value false

https://bugs.webkit.org/show_bug.cgi?id=316382

Reviewed by Ryosuke Niwa.

Per https://dom.spec.whatwg.org/#dom-mutationobserver-observe, if either
attributeOldValue or attributeFilter is *present* in the init dictionary
and attributes is omitted, attributes is set to true. The same applies to
characterDataOldValue and characterData. "Present" here means the
dictionary key was provided, regardless of its value.

WebKit was conflating presence with truthiness: AttributeOldValue /
CharacterDataOldValue option flags were only added when the value was
true, and the auto-set step keyed off those flags rather than off
presence. As a result, observe(node, { attributeOldValue: false }) — and
likewise for characterDataOldValue: false — incorrectly threw a
TypeError instead of registering an attribute observer with no
old-value delivery.

Use std::optional::has_value() to test presence in the auto-set step,
matching Blink & Gecko's behavior and the spec.

Test: imported/w3c/web-platform-tests/dom/nodes/MutationObserver-sanity.html

* LayoutTests/imported/w3c/web-platform-tests/dom/nodes/MutationObserver-sanity-expected.txt:
* LayoutTests/imported/w3c/web-platform-tests/dom/nodes/MutationObserver-sanity.html:
* Source/WebCore/dom/MutationObserver.cpp:
(WebCore::MutationObserver::observe):

Canonical link: https://commits.webkit.org/314623@main
@webkit-commit-queue webkit-commit-queue force-pushed the 316382_MutationObserver_fix branch from 787d63f to a811f8d Compare June 5, 2026 10:20
@webkit-commit-queue
Copy link
Copy Markdown
Collaborator

Committed 314623@main (a811f8d): https://commits.webkit.org/314623@main

Reviewed commits have been landed. Closing PR #66529 and removing active labels.

@webkit-commit-queue webkit-commit-queue merged commit a811f8d into WebKit:main Jun 5, 2026
@webkit-commit-queue webkit-commit-queue removed the merge-queue Applied to send a pull request to merge-queue label Jun 5, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

DOM For bugs specific to XML/HTML DOM elements (including parsing).

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants