When call getAttribute, HTMLIFrame.sandbox has a bug which don't return changed value.

Source/core/dom/DOMSettableTokenList.cpp

 /*
  * Copyright (C) 2010 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1.  Redistributions of source code must retain the above copyright
  *     notice, this list of conditions and the following disclaimer.
  * 2.  Redistributions in binary form must reproduce the above copyright
  *     notice, this list of conditions and the following disclaimer in the
@@ skipping 79 matching lines @@
 {
     DOMTokenList::removeInternal(token);
     m_tokens.remove(token);
 }
 
 void DOMSettableTokenList::setValue(const AtomicString& value)
 {
     m_value = value;
     m_tokens.set(value, SpaceSplitString::ShouldNotFoldCase);
     if (m_observer)
-        m_observer->valueChanged();
+        m_observer->valueChanged(this);
 }
 
 } // namespace blink