fix(zone.js): preserve accessor and non-enumerable event listener options - #70432

PR Checklist

• The commit message follows our guidelines: https://github.com/angular/angular/blob/main/contributing-docs/commit-message-guidelines.md
• Tests for the changes have been added (for bug fixes / features)

PR Type

• Bugfix

What is the current behavior?

Issue Number: #70431

Since zone.js 0.14.7 (June 2024, #55796), the patched addEventListener silently drops event listener options that are exposed as accessors or as non-enumerable properties.

copyEventListenerOptions copies the caller's options with {...options} before forwarding to native. Object spread copies only own enumerable data properties. The native call, by contrast, reads each dictionary member via WebIDL — a plain [[Get]], which invokes accessors and ignores enumerability. The copy is therefore lossy in a way the native call is not.

Observed in Chromium, zone.js 0.15.1:

Nothing throws in any case.

signal was already special-cased for AbortController.prototype.signal after #54142; the other three members were not.

The passive row is the one with ecosystem-wide fallout: it defeats the MDN feature test for passive-listener support, where the getter being read is the signal. That snippet is used verbatim by Highcharts (See: https://github.com/highcharts/highcharts/blob/69edf8952a04b9872b6510fbdacd7dff8b03970b/ts/Core/Globals.ts#L201). Making every listener they register non-passive. Including ones they explicitly intended to be passive.

What is the new behavior?

The copy is still made — that fix from #55796 is preserved (frozen/readonly options still work). Each recognised member (capture, once, passive, signal) is additionally read from the source object via [[Get]] when the spread didn't already produce it, which recovers non-enumerable and prototype accessors. The hasOwnProperty gate on the loop ensures no getter is invoked twice.

The call site is reordered to buildEventListenerOptions(copyEventListenerOptions(...)) so the passive-events code path ({...options, passive: true} in buildEventListenerOptions) also spreads a normalised data object rather than the caller's raw input.

Tests added in packages/zone.js/test/browser/browser.spec.ts cover:

• non-enumerable passive getter invoked exactly once (MDN feature-detect pattern);
• capture: true accessor honoured for both add and remove;
• once: true accessor honoured across two dispatches;
• AbortController passed directly as options (regression guard for AbortController error with walletconnect lib after zone.js 0.14.3 update #54142);
• frozen options object accepted without mutation (regression guard for fix(zone.js): do not mutate event listener options (may be readonly) #55796).

Alternatives considered and rejected:

• Spread, then unconditionally re-read the four members. Double-invokes enumerable accessors.
• Descriptor-preserving copy (Object.defineProperties({}, Object.getOwnPropertyDescriptors(options))). Loses signal — it lives on AbortController.prototype, not as an own property.
• Prototype-preserving copy (Object.create(Object.getPrototypeOf(options), Object.getOwnPropertyDescriptors(options))). Throws on built-ins: TypeError: Cannot read private member #signal from an object whose class did not declare it. This is the hazard the pre-existing code comment already warned about.

Does this PR introduce a breaking change?

• Yes
• No

Other information

Provenance: introduced by #55796 / 85c1719. Bisected: 0.13.3, 0.14.0, 0.14.4, 0.14.6 all behave correctly; 0.14.7 → 0.16.2 do not.

Fixes #70431.