Nothing in WPT holds an item out of an SVG list and then changes the content attribute, so none of the four branches of "synchronizing a list interface object" is covered: https://w3c.github.io/svgwg/svg2-draft/types.html#TermSynchronizeList same item count no detach, values updated in place the list grows new objects appended, existing ones updated the list shrinks the items at or above the new length are detached and keep their values, the ones still in range are updated new count is 0 everything detached DOMString the list is replaced instead, which is the deliberate opposite The near misses all re-fetch instead of holding, so they pass whatever the engine does: svg/coordinate-systems/SVGTransformList.list-01.html only sets the attribute in its setup helper, svg/types/scripted/SVGLengthList-basics.html sets x then re-reads getItem(0).value, and the SMIL list tests re-read animVal.getItem(i).value at every sample. 42 files under svg/ and css/css-transforms/ use getItem, so this is a gap rather than a failed search. Two files, markup attached. svg/types/scripted/SVGList-reflected-attribute-synchronize.html 54 subtests. Four branches across SVGNumberList, SVGLengthList, SVGPointList and SVGTransformList (both transform and gradientTransform), the SVGTransformList case where the transform function at an index changes, and the SVGStringList branch that replaces the list. svg/types/scripted/SVGList-animVal-reflects-base-value.html 20 subtests. animVal must report the base value when nothing is animating. There is no animation element in the file, so it says nothing about animVal during an animation. Both keep identity assertions in different subtests from value assertions, because an engine that returns a fresh wrapper object from every getItem call fails the identity ones for an unrelated reason and the value ones still say what an author loses. The 33 and 12 subtests that already pass are worth having on their own: they cover the detach branch, the read-only rule for animVal items, and the DOMString asymmetry, and nothing anywhere covers those today. Expected results, from the probe that these files were derived from, run in three engines on 2026-08-29 with all controls passing: Firefox 156.0 conformant on every branch, every list, and every animVal row. Both files should be all-pass. Safari 27.0 fails the three-list branches, the SVGTransformList transform-function change, and every animVal-before-the-change row. Chrome 154 fails the same value rows plus every identity row, because it returns a fresh wrapper object from every getItem call, which is a separate defect. That is why identity and value assertions are in separate subtests here. Expected results in Safari today, from the drafted files run against WebKit through a WKWebView, not through run-webkit-tests: SVGList-reflected-attribute-synchronize.html 33 pass, 21 fail SVGList-animVal-reflects-base-value.html 12 pass, 8 fail The failures are the subject of three other bugs, so this one needs TestExpectations entries pointing at them rather than a fix. ### Related - Bug 322973: SVGNumberList, SVGLengthList and SVGPointList detach items on re-parse. - Bug 322974: SVGTransformList detaches when the transform function at an index changes. - Bug 322975: animVal of a list attribute goes stale after the attribute changes. - Bug 314992, the same algorithm read the other way.