322975 2026-08-31 01:57:03 -0700 animVal of a list attribute keeps reporting the old items after the content attribute changes, if it was read once before the change 2026-09-07 01:57:12 -0700 1 1 1 Unclassified WebKit SVG Safari 26 Unspecified Unspecified NEW https://bugs.webkit.org/show_bug.cgi?id=322976 InRadar P2 Normal --- 1 karlcow webkit-unassigned sabouhallawa webkit-bug-importer zimmermann oldest_to_newest 2245336 0 karlcow 2026-08-31 01:57:03 -0700 Read animVal on a list attribute, then change the attribute. animVal keeps reporting the item count and the values from before the change, forever, while baseVal reports the new ones. Read animVal for the first time after the change and it is correct, so the object is a snapshot taken at first access rather than a wrong computation. No animation is involved anywhere in this, so it is not the SMIL question. Firefox 156 and Chrome 154 both report the new values, on all four list interfaces. ### Testcase <svg xmlns="http://www.w3.org/2000/svg"> <text id="t" rotate="10 20 30" x="5" y="20">abc</text> </svg> t.rotate.animVal.numberOfItems; // 3, and this read is what makes the bug appear t.setAttribute("rotate", "40 50"); t.rotate.baseVal.numberOfItems; // 2, correct t.rotate.animVal.numberOfItems; // 2 per spec. Safari says 3. t.rotate.animVal.getItem(0).value; // 40 per spec. Safari says 10. Delete the first line and every later line is correct, which is the diagnosis: the animVal list is built once, on first access, and nothing refreshes it when the attribute is parsed again. All four list interfaces are affected, on nine attributes: rotate, tableValues, kernelMatrix, values, x, y, dx, dy, points, transform, gradientTransform, patternTransform. polyline.animatedPoints has it too, since it is the same animVal. A DOM change to baseVal does NOT show the bug: t.rotate.baseVal.removeItem(2) leaves animVal correct. Only the attribute path is affected. ### Measured, 3 engines, 2026-08-29 Probe attached, group A. All 7 controls pass in all three runs, no errors. Firefox 156.0 fails nothing in the whole file, 144 of 144. Safari 27.0 Firefox 156.0 Chrome 154 animVal read BEFORE the change reports the new item count afterwards no YES YES ... and the new value at index 0 no YES YES animVal read AFTER the change is correct YES YES YES animVal list object is stable across the change YES YES YES animVal items are read only YES YES YES animVal follows a baseVal DOM change YES YES YES All four lists, same pattern. Safari's detail on the count row is "before=3 after=3 baseVal=2": animVal and baseVal disagree about how many items the element has. Safari is alone. The two rows that pass everywhere are the diagnosis: read animVal after the change and it is right, so it is a snapshot that is never refreshed rather than a wrong computation, and the DOM path already refreshes it. ### Spec Both readings of animVal give the same answer here, because nothing is animating. SVG 2, https://w3c.github.io/svgwg/svg2-draft/types.html#InterfaceSVGAnimatedNumberList "The baseVal and animVal IDL attributes represent the current non-animated value of the reflected attribute. On getting baseVal or animVal, an SVGNumberList object is returned that reflects the base value of the reflected attribute." and https://w3c.github.io/svgwg/svg2-draft/types.html#DOMInterfacesForReflectingSVGAttributes "In SVG 1.1, the animVal attribute of the SVG DOM interfaces represented the current animated value of the reflected attribute. In this version of SVG, animVal no longer represents the current animated value and is instead an alias of baseVal." SVG 1.1 said animVal holds the animated value while animating and otherwise the same value as baseVal. With no animation in the document, both say animVal must report what the attribute now says. ### Cause The refresh already exists. Every non-list animated property does it inside the setter the attribute parse uses: https://github.com/WebKit/WebKit/blob/4ae53427d5d8e52791da2cfe0c0c98b877b2b5d5/Source/WebCore/svg/properties/SVGAnimatedValueProperty.h#L50-L57 // Used by SVGElement::parseAttribute(). void setBaseValInternal(const ValueType& baseVal) { m_baseVal->setValue(baseVal); if (m_animVal) m_animVal->setValue(baseVal); } The list version has the same two lines, but only on the DOM mutation path: https://github.com/WebKit/WebKit/blob/4ae53427d5d8e52791da2cfe0c0c98b877b2b5d5/Source/WebCore/svg/properties/SVGAnimatedPropertyList.h#L142-L148 // Called when m_baseVal changes or an item in m_baseVal changes. void commitPropertyChange(SVGProperty* property) override { if (m_animVal) *m_animVal = m_baseVal; Base::commitPropertyChange(property); } The attribute path never reaches it. attributeChanged calls baseVal()->parse(newValue) directly, for example SVGTextPositioningElement.cpp:74, and parse() does not call commitChange(), so commitPropertyChange never runs and the animVal clone made at first access is never touched again: https://github.com/WebKit/WebKit/blob/4ae53427d5d8e52791da2cfe0c0c98b877b2b5d5/Source/WebCore/svg/properties/SVGAnimatedPropertyList.h#L127-L132 ListType& ensureAnimVal() { if (!m_animVal) m_animVal = ListType::create(m_baseVal, SVGPropertyAccess::ReadOnly); return *m_animVal; } So the list case is the only animated property shape with neither of the two refreshes on the attribute path. Every SVGAnimatedNumber, SVGAnimatedLength, SVGAnimatedRect, SVGAnimatedAngle, SVGAnimatedString, SVGAnimatedEnumeration and SVGAnimatedPreserveAspectRatio was checked in the browser and all of them are correct. Suggested shape: refresh animVal after the parse, the way commitPropertyChange already does. Giving SVGAnimatedPropertyList its own parse entry point keeps the twelve attributeChanged call sites one line each. Making animVal() return m_baseVal when nothing is animating would be smaller and matches the SVG 2 alias wording, but it changes what an animVal item is, and LayoutTests/svg/dom/animated-tearoff-list-remove-target.html depends on the current shape: it holds an animVal item, retargets the <animate> away, and asserts the held item kept its own copy of the value. ### Tests No WPT coverage: nothing in the corpus reads animVal on a list, changes the attribute, and reads animVal again. The SMIL list tests re-read animVal.getItem(i).value at every sample, which is a fresh read each time and correct either way. No WebKit-local test covers it either, so nothing needs rebaselining. animated-tearoff-list-remove-target.html constrains the shape of the fix but does not assert this behaviour. 2245347 1 481223 karlcow 2026-08-31 02:16:31 -0700 Created attachment 481223 testcase-probe.html 2247921 2 webkit-bug-importer 2026-09-07 01:57:12 -0700 <rdar://problem/186835675> 481223 2026-08-31 02:16:31 -0700 2026-08-31 02:16:31 -0700 testcase-probe.html testcase-C-animval-stale.html text/html 5554 karlcow PCFET0NUWVBFIGh0bWw+CjxodG1sIGxhbmc9ImVuIj4KPG1ldGEgY2hhcnNldD0idXRmLTgiPgo8 dGl0bGU+VGVzdGNhc2U6IGFuaW1WYWwgb2YgYSBsaXN0IGF0dHJpYnV0ZSBnb2VzIHN0YWxlIGFm dGVyIHRoZSBhdHRyaWJ1dGUgY2hhbmdlczwvdGl0bGU+CjxzdHlsZT4KIGJvZHkgeyBmb250OiAx M3B4LzEuNSAtYXBwbGUtc3lzdGVtLCBzeXN0ZW0tdWksIHNhbnMtc2VyaWY7IG1hcmdpbjogMS41 cmVtOyBtYXgtd2lkdGg6IDYycmVtOyB9CiB0YWJsZSB7IGJvcmRlci1jb2xsYXBzZTogY29sbGFw c2U7IG1hcmdpbjogLjZyZW0gMCAxLjJyZW07IGZvbnQtc2l6ZTogMTJweDsgfQogdGgsIHRkIHsg Ym9yZGVyOiAxcHggc29saWQgI2JiYjsgcGFkZGluZzogM3B4IDdweDsgdGV4dC1hbGlnbjogbGVm dDsgfQogdGggeyBiYWNrZ3JvdW5kOiAjZWVlOyB9CiAub2sgeyBjb2xvcjogIzA2MDsgZm9udC13 ZWlnaHQ6IDcwMDsgfQogLmJhZCB7IGNvbG9yOiAjYTAwOyBmb250LXdlaWdodDogNzAwOyB9CiBw cmUgeyBiYWNrZ3JvdW5kOiAjZjVmNWY1OyBwYWRkaW5nOiAuNnJlbTsgZm9udC1zaXplOiAxMnB4 OyB9CiBzdmcgeyBib3JkZXI6IDFweCBzb2xpZCAjY2NjOyB9Cjwvc3R5bGU+Cgo8aDE+YW5pbVZh bCBvZiBhIGxpc3QgYXR0cmlidXRlIGdvZXMgc3RhbGUgYWZ0ZXIgdGhlIGF0dHJpYnV0ZSBjaGFu Z2VzPC9oMT4KCjxwPjxiPlRoZXJlIGlzIG5vIGFuaW1hdGlvbiBhbnl3aGVyZSBpbiB0aGlzIGZp bGUuPC9iPiBTVkcgMS4xIHNhaWQgYW5pbVZhbCBob2xkcyB0aGUgYW5pbWF0ZWQKdmFsdWUgd2hp bGUgYW5pbWF0aW5nIGFuZCBvdGhlcndpc2UgdGhlIHNhbWUgdmFsdWUgYXMgYmFzZVZhbDsgU1ZH IDIgc2F5cyBhbmltVmFsICJpcyBpbnN0ZWFkIGFuCmFsaWFzIG9mIGJhc2VWYWwiIGFuZCB0aGF0 IGJvdGggInJlcHJlc2VudCB0aGUgY3VycmVudCBub24tYW5pbWF0ZWQgdmFsdWUgb2YgdGhlIHJl ZmxlY3RlZAphdHRyaWJ1dGUiLiBXaXRoIG5vdGhpbmcgYW5pbWF0aW5nLCBib3RoIHJlYWRpbmdz IHJlcXVpcmUgYW5pbVZhbCB0byByZXBvcnQgd2hhdCB0aGUgYXR0cmlidXRlCm5vdyBzYXlzLjwv cD4KCjx1bD4KICA8bGk+aHR0cHM6Ly93M2MuZ2l0aHViLmlvL3N2Z3dnL3N2ZzItZHJhZnQvdHlw ZXMuaHRtbCNET01JbnRlcmZhY2VzRm9yUmVmbGVjdGluZ1NWR0F0dHJpYnV0ZXM8L2xpPgogIDxs aT5odHRwczovL3czYy5naXRodWIuaW8vc3Znd2cvc3ZnMi1kcmFmdC90eXBlcy5odG1sI0ludGVy ZmFjZVNWR0FuaW1hdGVkTnVtYmVyTGlzdDwvbGk+CjwvdWw+Cgo8c3ZnIGlkPSJzdGFnZSIgd2lk dGg9IjIwMCIgaGVpZ2h0PSIxMDAiIHZpZXdCb3g9IjAgMCAyMDAgMTAwIj48L3N2Zz4KCjxwcmUg aWQ9ImNvZGUiPgp0LnJvdGF0ZS5hbmltVmFsLm51bWJlck9mSXRlbXM7ICAgICAgLy8gMywgYW5k IHRoaXMgcmVhZCBpcyB3aGF0IG1ha2VzIHRoZSBidWcgYXBwZWFyCgp0LnNldEF0dHJpYnV0ZSgi cm90YXRlIiwgIjQwIDUwIik7Cgp0LnJvdGF0ZS5iYXNlVmFsLm51bWJlck9mSXRlbXM7ICAgICAg Ly8gMiwgY29ycmVjdAp0LnJvdGF0ZS5hbmltVmFsLm51bWJlck9mSXRlbXM7ICAgICAgLy8gMiBw ZXIgc3BlYwp0LnJvdGF0ZS5hbmltVmFsLmdldEl0ZW0oMCkudmFsdWU7ICAgLy8gNDAgcGVyIHNw ZWMKCkRlbGV0ZSB0aGUgZmlyc3QgbGluZSBhbmQgZXZlcnkgbGF0ZXIgbGluZSBpcyBjb3JyZWN0 LiBUaGF0IGlzIHRoZSBkaWFnbm9zaXM6IHRoZQphbmltVmFsIGxpc3QgaXMgYnVpbHQgb25jZSwg b24gZmlyc3QgYWNjZXNzLCBhbmQgdGhlIGF0dHJpYnV0ZSBwYXRoIG5ldmVyIHJlZnJlc2hlcyBp dC4KPC9wcmU+Cgo8ZGl2IGlkPSJvdXQiPjwvZGl2PgoKPHNjcmlwdD4KY29uc3QgU1ZHTlMgPSAn aHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmcnOwpjb25zdCBzdGFnZSA9IGRvY3VtZW50LmdldEVs ZW1lbnRCeUlkKCdzdGFnZScpOwoKY29uc3QgQ0FTRVMgPSBbCiAgeyBuYW1lOiAnU1ZHTnVtYmVy TGlzdCwgcm90YXRlIG9uIHRleHQnLCBhdHRyOiAncm90YXRlJywKICAgIGZyb206ICcxMCAyMCAz MCcsIHRvOiAnNDAgNTAnLCB3YW50OiA0MCwKICAgIGJ1aWxkKCkgeyBjb25zdCBlID0gZG9jdW1l bnQuY3JlYXRlRWxlbWVudE5TKFNWR05TLCAndGV4dCcpOwogICAgICBlLnNldEF0dHJpYnV0ZSgn cm90YXRlJywgdGhpcy5mcm9tKTsgZS5zZXRBdHRyaWJ1dGUoJ3gnLCAnNScpOyBlLnNldEF0dHJp YnV0ZSgneScsICcyMCcpOwogICAgICBlLnRleHRDb250ZW50ID0gJ2FiYyc7IHN0YWdlLmFwcGVu ZENoaWxkKGUpOyByZXR1cm4gZTsgfSwKICAgIGJhc2U6IChlKSA9PiBlLnJvdGF0ZS5iYXNlVmFs LCBhbmltOiAoZSkgPT4gZS5yb3RhdGUuYW5pbVZhbCwgcmVhZDogKGkpID0+IGkudmFsdWUgfSwK CiAgeyBuYW1lOiAnU1ZHTGVuZ3RoTGlzdCwgeCBvbiB0ZXh0JywgYXR0cjogJ3gnLAogICAgZnJv bTogJzEgMiAzJywgdG86ICc3IDgnLCB3YW50OiA3LAogICAgYnVpbGQoKSB7IGNvbnN0IGUgPSBk b2N1bWVudC5jcmVhdGVFbGVtZW50TlMoU1ZHTlMsICd0ZXh0Jyk7CiAgICAgIGUuc2V0QXR0cmli dXRlKCd4JywgdGhpcy5mcm9tKTsgZS5zZXRBdHRyaWJ1dGUoJ3knLCAnNDUnKTsKICAgICAgZS50 ZXh0Q29udGVudCA9ICdhYmMnOyBzdGFnZS5hcHBlbmRDaGlsZChlKTsgcmV0dXJuIGU7IH0sCiAg ICBiYXNlOiAoZSkgPT4gZS54LmJhc2VWYWwsIGFuaW06IChlKSA9PiBlLnguYW5pbVZhbCwgcmVh ZDogKGkpID0+IGkudmFsdWUgfSwKCiAgeyBuYW1lOiAnU1ZHUG9pbnRMaXN0LCBwb2ludHMgb24g cG9seWxpbmUgKGFuaW1hdGVkUG9pbnRzKScsIGF0dHI6ICdwb2ludHMnLAogICAgZnJvbTogJzEs MiAzLDQgNSw2JywgdG86ICcxMSwxMiAxMywxNCcsIHdhbnQ6IDExLAogICAgYnVpbGQoKSB7IGNv bnN0IGUgPSBkb2N1bWVudC5jcmVhdGVFbGVtZW50TlMoU1ZHTlMsICdwb2x5bGluZScpOwogICAg ICBlLnNldEF0dHJpYnV0ZSgncG9pbnRzJywgdGhpcy5mcm9tKTsgZS5zZXRBdHRyaWJ1dGUoJ2Zp bGwnLCAnbm9uZScpOwogICAgICBlLnNldEF0dHJpYnV0ZSgnc3Ryb2tlJywgJ2JsYWNrJyk7IHN0 YWdlLmFwcGVuZENoaWxkKGUpOyByZXR1cm4gZTsgfSwKICAgIGJhc2U6IChlKSA9PiBlLnBvaW50 cywgYW5pbTogKGUpID0+IGUuYW5pbWF0ZWRQb2ludHMsIHJlYWQ6IChpKSA9PiBpLnggfSwKCiAg eyBuYW1lOiAnU1ZHVHJhbnNmb3JtTGlzdCwgZ3JhZGllbnRUcmFuc2Zvcm0nLCBhdHRyOiAnZ3Jh ZGllbnRUcmFuc2Zvcm0nLAogICAgZnJvbTogJ3RyYW5zbGF0ZSgxLDIpIHRyYW5zbGF0ZSgzLDQp IHRyYW5zbGF0ZSg1LDYpJywKICAgIHRvOiAndHJhbnNsYXRlKDExLDEyKSB0cmFuc2xhdGUoMTMs MTQpJywgd2FudDogMTEsCiAgICBidWlsZCgpIHsgY29uc3QgZSA9IGRvY3VtZW50LmNyZWF0ZUVs ZW1lbnROUyhTVkdOUywgJ2xpbmVhckdyYWRpZW50Jyk7CiAgICAgIGUuc2V0QXR0cmlidXRlKCdn cmFkaWVudFRyYW5zZm9ybScsIHRoaXMuZnJvbSk7IHN0YWdlLmFwcGVuZENoaWxkKGUpOyByZXR1 cm4gZTsgfSwKICAgIGJhc2U6IChlKSA9PiBlLmdyYWRpZW50VHJhbnNmb3JtLmJhc2VWYWwsIGFu aW06IChlKSA9PiBlLmdyYWRpZW50VHJhbnNmb3JtLmFuaW1WYWwsCiAgICByZWFkOiAoaSkgPT4g aS5tYXRyaXguZSB9LApdOwoKbGV0IGh0bWwgPSAnPHRhYmxlPjx0cj48dGg+bGlzdDwvdGg+PHRo PmFuaW1WYWwgcmVhZCBCRUZPUkUgdGhlIGNoYW5nZTwvdGg+JwogICAgICAgICArICc8dGg+YW5p bVZhbCByZWFkIEFGVEVSIHRoZSBjaGFuZ2U8L3RoPjx0aD5yZWFkaW5nPC90aD48L3RyPic7Cmxl dCBzdGFsZSA9IDA7Cgpmb3IgKGNvbnN0IGMgb2YgQ0FTRVMpIHsKICAvLyBPcmRlciBBOiB0b3Vj aCBhbmltVmFsIGZpcnN0LCB0aGVuIGNoYW5nZSB0aGUgYXR0cmlidXRlLgogIGNvbnN0IGVsID0g Yy5idWlsZCgpOwogIGNvbnN0IGFuaW0gPSBjLmFuaW0oZWwpOwogIGNvbnN0IG4wID0gYW5pbS5u dW1iZXJPZkl0ZW1zOwogIGVsLnNldEF0dHJpYnV0ZShjLmF0dHIsIGMudG8pOwogIGNvbnN0IG5B ZnRlciA9IGFuaW0ubnVtYmVyT2ZJdGVtczsKICBjb25zdCB2QWZ0ZXIgPSBjLnJlYWQoYW5pbS5n ZXRJdGVtKDApKTsKICBjb25zdCBiYXNlTiA9IGMuYmFzZShlbCkubnVtYmVyT2ZJdGVtczsKCiAg Ly8gT3JkZXIgQjogY2hhbmdlIHRoZSBhdHRyaWJ1dGUgZmlyc3QsIGFuZCBvbmx5IHRoZW4gdG91 Y2ggYW5pbVZhbC4gVGhpcyBpcyB0aGUKICAvLyBjb250cm9sIHRoYXQgc2VwYXJhdGVzICJhbmlt VmFsIGlzIHdyb25nIiBmcm9tICJhbmltVmFsIGlzIG5ldmVyIHJlZnJlc2hlZCIuCiAgY29uc3Qg ZWwyID0gYy5idWlsZCgpOwogIGVsMi5zZXRBdHRyaWJ1dGUoYy5hdHRyLCBjLnRvKTsKICBjb25z dCBhbmltMiA9IGMuYW5pbShlbDIpOwogIGNvbnN0IG5GcmVzaCA9IGFuaW0yLm51bWJlck9mSXRl bXM7CiAgY29uc3QgdkZyZXNoID0gYy5yZWFkKGFuaW0yLmdldEl0ZW0oMCkpOwoKICBjb25zdCBi ZWZvcmVPayA9IG5BZnRlciA9PT0gYmFzZU4gJiYgdkFmdGVyID09PSBjLndhbnQ7CiAgY29uc3Qg YWZ0ZXJPayA9IG5GcmVzaCA9PT0gYmFzZU4gJiYgdkZyZXNoID09PSBjLndhbnQ7CiAgaWYgKCFi ZWZvcmVPayAmJiBhZnRlck9rKSBzdGFsZSsrOwoKICBodG1sICs9ICc8dHI+PHRkPicgKyBjLm5h bWUgKyAnPC90ZD4nCiAgICAgICAgKyAnPHRkPm51bWJlck9mSXRlbXM9JyArIG5BZnRlciArICcs IGl0ZW0gMD0nICsgdkFmdGVyCiAgICAgICAgKyAnIChiYXNlVmFsIHNheXMgJyArIGJhc2VOICsg Jywgc3BlYyAnICsgYy53YW50ICsgJyk8L3RkPicKICAgICAgICArICc8dGQ+bnVtYmVyT2ZJdGVt cz0nICsgbkZyZXNoICsgJywgaXRlbSAwPScgKyB2RnJlc2ggKyAnPC90ZD4nCiAgICAgICAgKyAn PHRkIGNsYXNzPSInICsgKGJlZm9yZU9rID8gJ29rJyA6ICdiYWQnKSArICciPicKICAgICAgICAr IChiZWZvcmVPayA/ICdMSVZFJyA6IChhZnRlck9rID8gJ1NUQUxFJyA6ICdvdGhlcicpKSArICc8 L3RkPjwvdHI+JzsKfQoKaHRtbCArPSAnPC90YWJsZT48cCBzdHlsZT0iZm9udC1zaXplOjE1cHg7 Zm9udC13ZWlnaHQ6NzAwIj5zdGFsZTogJyArIHN0YWxlCiAgICAgICsgJyBvZiAnICsgQ0FTRVMu bGVuZ3RoICsgJzwvcD4nOwoKaHRtbCArPSAnPHA+RmlyZWZveCAxNTYgYW5kIENocm9tZSAxNTQg Z2l2ZSAwIG9mIDQuIFNhZmFyaSAyNy4wIGdpdmVzIDQgb2YgNC48L3A+JwogICAgICArICc8cD5U aGUgdGhpcmQgY29sdW1uIGlzIHRoZSBkaWFnbm9zaXMgcmF0aGVyIHRoYW4gYSBzZWNvbmQgc3lt cHRvbTogcmVhZCBhbmltVmFsIGZvciAnCiAgICAgICsgJ3RoZSBmaXJzdCB0aW1lIGFmdGVyIHRo ZSBjaGFuZ2UgYW5kIGl0IGlzIGNvcnJlY3QgZXZlcnl3aGVyZSwgc28gdGhpcyBpcyBhIHNuYXBz aG90ICcKICAgICAgKyAndGhhdCBpcyBuZXZlciByZWZyZXNoZWQsIG5vdCBhIHdyb25nIGNvbXB1 dGF0aW9uLjwvcD4nOwoKZG9jdW1lbnQuZ2V0RWxlbWVudEJ5SWQoJ291dCcpLmlubmVySFRNTCA9 IGh0bWw7Cjwvc2NyaXB0Pgo8L2h0bWw+Cg==