The behavior of the current JSC binding for DOMStringMap is: put: Handle JavaScript property first, then handle HTML attribute if there is not JS property. delete: ditto. get: Handle HTML attribute, then handle JavaScript property. The get operation is inconsistent with put/delete. So, we have the following curious behavior: 1> document.body.dataset.toString function toString() { ... 2> document.body.setAttribute('data-to-string', 'attr') 3> document.body.dataset.toString "attr" 4> document.body.dataset.toString = function() { return "dataset"; } 5> document.body.dataset.toString "attr" Even if one sets a new value to .toString [4], .toString doesn't return the new value [5]. It's not good. I think it's reasonable to handle JavaScript properties first to protect JavaScript Object behavior. However, we should do it in the get operation too and should give up providing "data-to-string" attribute via HTMLElement::dataset for consistency.
Created attachment 81440 [details] Incomplete patch The last test (delete div.dataset.foobarbaz) doesn't work.
(In reply to comment #0) > I think it's reasonable to handle JavaScript properties first to protect JavaScript Object behavior. However, we should do it in the get operation too and should give up providing "data-to-string" attribute via HTMLElement::dataset for consistency. I changed my mind. Both of Firefox and Opera always handles data-* attributes first. We had better follow them.
Created attachment 109933 [details] Patch
Comment on attachment 109933 [details] Patch Looks good.
Comment on attachment 109933 [details] Patch Thank you for reviewing.
Comment on attachment 109933 [details] Patch Clearing flags on attachment: 109933 Committed r96893: <http://trac.webkit.org/changeset/96893>
All reviewed patches have been landed. Closing bug.
A follow-up test change: http://trac.webkit.org/changeset/96911