When call getAttribute, HTMLIFrame.sandbox has a bug which don't return changed value.

Source/core/dom/DOMSettableTokenList.h

 /*
  * Copyright (C) 2010 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1.  Redistributions of source code must retain the above copyright
  *     notice, this list of conditions and the following disclaimer.
  * 2.  Redistributions in binary form must reproduce the above copyright
  *     notice, this list of conditions and the following disclaimer in the
@@ skipping 16 matching lines @@
 
 #include "core/dom/DOMTokenList.h"
 #include "core/dom/SpaceSplitString.h"
 #include "platform/heap/Handle.h"
 #include "wtf/RefCounted.h"
 #include "wtf/text/AtomicString.h"
 
 namespace blink {
 
 class ExceptionState;
-
-class DOMSettableTokenListObserver : public WillBeGarbageCollectedMixin {
-public:
-    virtual void valueChanged() = 0;
-
-    DEFINE_INLINE_VIRTUAL_TRACE() { }
-};
+class DOMSettableTokenListObserver;
 
 class DOMSettableTokenList final
     : public DOMTokenList
 #if !ENABLE(OILPAN)
     , public RefCounted<DOMSettableTokenList>
 #endif
     {
     DEFINE_WRAPPERTYPEINFO();
     WTF_MAKE_FAST_ALLOCATED_WILL_BE_REMOVED(DOMSettableTokenList);
 public:
@@ skipping 28 matching lines @@
 private:
     virtual void addInternal(const AtomicString&) override;
     virtual bool containsInternal(const AtomicString&) const override;
     virtual void removeInternal(const AtomicString&) override;
 
     AtomicString m_value;
     SpaceSplitString m_tokens;
     RawPtrWillBeWeakMember<DOMSettableTokenListObserver> m_observer;
 };
 
+class DOMSettableTokenListObserver : public WillBeGarbageCollectedMixin {
+public:
+    virtual void valueChanged(DOMSettableTokenList*) = 0;
+
+    DEFINE_INLINE_VIRTUAL_TRACE() { }
+};
+
 } // namespace blink
 
 #endif // DOMSettableTokenList_h