325152 2026-09-24 07:21:41 -0700 :open stops matching a select whose base appearance picker is still showing 2026-10-04 22:47:49 -0700 1 1 1 Unclassified WebKit Forms WebKit Nightly Build Unspecified Unspecified RESOLVED FIXED https://github.com/web-platform-tests/wpt/pull/63235 InRadar P2 Normal --- 325123 1 annevk annevk cdumez webkit-bug-importer wenson_hsieh oldest_to_newest 2254078 0 481541 annevk 2026-09-24 07:21:41 -0700 Created attachment 481541 test Rebuilding a select's renderers while its base appearance picker is open leaves the picker on screen but stops :open from matching. The picker keeps rendering its options and keeps keyboard focus, so any styling or scripting keyed on :open is wrong for as long as the picker stays up. Steps, with the attached test or by hand: 1. <select style="appearance: base-select"> with ::picker(select) { appearance: base-select }. 2. Click it to open the picker. 3. From the console, select.size = 1. Measured before and after step 3: opened: :open=true option rendered=true activeElement=option after rebuild: :open=false option rendered=true activeElement=option Setting size from absent to 1 leaves it a dropdown box but calls invalidateStyleAndRenderersForSubtree(), and didDetachRenderers() (HTMLSelectElement.cpp:168) then clears m_popupIsVisible unconditionally. That is correct for the native popup menu it tears down in the same breath, but a base appearance picker is a popover whose showing state is independent of the select's renderers, so it survives the rebuild while the flag does not. The underlying problem is that :open is a single stored flag, bool HTMLSelectElement::isOpen() const { return m_popupIsVisible; } serving two owners with different lifetimes: the native popup menu, which dies with the renderers, and the picker popover, which does not. Anything that tears renderers down clobbers state belonging to the other owner. Patching it by clearing on detach and restoring on attach works but leaves two hooks agreeing about a fact neither owns. The fix that removes the class of bug is to stop storing it and derive it, so there is no moment when the flag can be wrong: bool HTMLSelectElement::isOpen() const { if (RefPtr popover = m_popover; popover && /* base picker */) return popover->isPopoverShowing(); return m_popupIsVisible; } Two things make that a real change rather than a tweak. :open invalidation currently happens inside setPopupIsVisible(), so the popover's show and hide paths have to trigger it instead. And isOpen() runs during selector matching, so the base picker test has to be cheaper than usesBaseAppearancePicker(), which reads two computed styles. The flag has 13 reads and 9 writes. The accessibility readers (AccessibilityMenuList, AccessibilityRenderObject, AccessibilityObject) all want the native meaning and would keep using it as-is; only isOpen() and SelectPopoverElement's check want the picker meaning. This is not iOS-specific but also not reachable there: didDetachRenderers()'s body is entirely #if !PLATFORM(IOS_FAMILY), since m_popup does not exist on iOS. The attached test fails on trunk at the third assertion — select.matches(':open') after the rebuild — while the two beside it, that the option still has a box and still has focus, pass and document that the picker really is showing. 2257280 1 webkit-bug-importer 2026-10-01 07:22:14 -0700 <rdar://problem/188911581> 2258174 2 annevk 2026-10-03 00:13:28 -0700 Pull request: https://github.com/WebKit/WebKit/pull/75748 2258175 3 annevk 2026-10-03 00:14:41 -0700 Submitted web-platform-tests pull request: https://github.com/web-platform-tests/wpt/pull/63235 2258660 4 ews-feeder 2026-10-04 22:47:46 -0700 Committed 322666@main (814ebe2cfe6a): <https://commits.webkit.org/322666@main> Reviewed commits have been landed. Closing PR #75748 and removing active labels. 481541 2026-09-24 07:21:41 -0700 2026-09-24 07:21:41 -0700 test select-renderer-rebuild-keeps-picker-open.html text/html 1167 annevk PCFET0NUWVBFIGh0bWw+CjxodG1sPgo8aGVhZD4KPHNjcmlwdCBzcmM9Ii4uLy4uLy4uLy4uL3Jl c291cmNlcy9qcy10ZXN0LmpzIj48L3NjcmlwdD4KPHNjcmlwdCBzcmM9Ii4uLy4uLy4uLy4uL3Jl c291cmNlcy91aS1oZWxwZXIuanMiPjwvc2NyaXB0Pgo8c3R5bGU+CnNlbGVjdCwgc2VsZWN0Ojpw aWNrZXIoc2VsZWN0KSB7CiAgICBhcHBlYXJhbmNlOiBiYXNlLXNlbGVjdDsKfQovKiBqcy10ZXN0 IGdyb3dzIGl0cyBjb25zb2xlIGF0IHRoZSB0b3Agb2YgdGhlIGJvZHksIHdoaWNoIHdvdWxkIHB1 c2ggdGhpcyBvdXQgb2YgcmVhY2guICovCiNjb250cm9scyB7IHBvc2l0aW9uOiBmaXhlZDsgdG9w OiAwOyBsZWZ0OiAwOyB9Cjwvc3R5bGU+CjwvaGVhZD4KPGJvZHk+CjxkaXYgaWQ9ImNvbnRyb2xz Ij4KPHNlbGVjdCBpZD0ic2VsZWN0Ij48b3B0aW9uIGlkPSJvcHRpb24iPm9uZTwvb3B0aW9uPjxv cHRpb24+dHdvPC9vcHRpb24+PC9zZWxlY3Q+CjwvZGl2Pgo8c2NyaXB0PgpkZXNjcmlwdGlvbigi UmVidWlsZGluZyBhIHNlbGVjdCdzIHJlbmRlcmVycyBsZWF2ZXMgaXRzIGJhc2UgYXBwZWFyYW5j ZSBwaWNrZXIgc2hvd2luZywgc28gdGhlIHNlbGVjdCBrZWVwcyBtYXRjaGluZyA6b3Blbi4iKTsK CmpzVGVzdElzQXN5bmMgPSB0cnVlOwoKKGFzeW5jICgpID0+IHsKICAgIGF3YWl0IFVJSGVscGVy LmFjdGl2YXRlRWxlbWVudChzZWxlY3QpOwogICAgYXdhaXQgVUlIZWxwZXIuYW5pbWF0aW9uRnJh bWUoKTsKICAgIHNob3VsZEJlVHJ1ZSgic2VsZWN0Lm1hdGNoZXMoJzpvcGVuJykiKTsKICAgIHNo b3VsZEJlVHJ1ZSgib3B0aW9uLm9mZnNldEhlaWdodCA+IDAiKTsKCiAgICAvLyBTZXR0aW5nIHNp emUgcmVidWlsZHMgdGhlIHJlbmRlcmVycyB3aGlsZSBsZWF2aW5nIHRoaXMgYSBkcm9wZG93biBi b3guCiAgICBzZWxlY3Quc2l6ZSA9IDE7CiAgICBhd2FpdCBVSUhlbHBlci5hbmltYXRpb25GcmFt ZSgpOwogICAgc2hvdWxkQmVUcnVlKCJzZWxlY3QubWF0Y2hlcygnOm9wZW4nKSIpOwogICAgc2hv dWxkQmVUcnVlKCJvcHRpb24ub2Zmc2V0SGVpZ2h0ID4gMCIpOwogICAgc2hvdWxkQmUoImRvY3Vt ZW50LmFjdGl2ZUVsZW1lbnQiLCAib3B0aW9uIik7CgogICAgZmluaXNoSlNUZXN0KCk7Cn0pKCk7 Cjwvc2NyaXB0Pgo8L2JvZHk+CjwvaHRtbD4K