[cssom]Inline style manipulation is somewhere between underspecified and incorrectly specified

[bzbarsky]

A simple example. Say we start at https://drafts.csswg.org/cssom/#dom-cssstyledeclaration-setproperty and walk through the steps. The property value is parsed, the new value is set, etc. This is all fine.

But there's a comefrom bit in https://drafts.csswg.org/cssom/#the-elementcssinlinestyle-interface that says:

Mutating the declarations must set the style content attribute on the context object to the serialization of the declarations. If the style content attribute is set, changed or removed, the declarations must be updated as appropriate.

Where does that fit into the above-linked algorithm? Does it run inside https://drafts.csswg.org/cssom/#set-a-css-declaration and if so does it run after step 3 and after step 4, or just after step 4, or something else? This is observable via mutation observers.

Or does it run at all? I'm pretty sure that in browsers mutating the inline style via CSSOM does NOT do a serialize-and-reparse thing. And this is black-box distinguishable (in browsers; not sure about per spec, because the processing model for this stuff is somewhat underdefined in various other ways) from doing the serialize-and-reparse, as far as I can tell, if base URIs are changed.

[upsuper]

So, I think the bits to fix this are:

1. Define "attribute change steps" in either CSS Style Attributes or CSSOM (probably the former?) to accept change from setting attribute via DOM.
2. Change the set functions and delete function to run change an attribute and append an attribute.

The hard part is that this create a slightly unfortunate reparsing in "attribute change steps", it's probably not too bad. Browsers should be able to optimize out that easily without observable difference. Actually this is already the case for DOMTokenList.

[upsuper]

Actually... just "set an attribute value" algorithm.

[bzbarsky]

Browsers should be able to optimize out that easily without observable difference.

No, they can't, as I already pointed out in this issue in #1559 (comment) -- serialize-and-reparse is black-box different from not serializing and reparsing wrt base URI handling. And probably also wrt CSP.