When call getAttribute, HTMLIFrame.sandbox has a bug which don't return changed value.

Source/core/dom/DOMSettableTokenList.h

Index: Source/core/dom/DOMSettableTokenList.h
diff --git a/Source/core/dom/DOMSettableTokenList.h b/Source/core/dom/DOMSettableTokenList.h
index fe274a762192acbfd04b42864a59a9889a536c80..90c86f6c6f47a97dbe3739e701281d33e374be95 100644
--- a/Source/core/dom/DOMSettableTokenList.h
+++ b/Source/core/dom/DOMSettableTokenList.h
@@ -34,13 +34,7 @@
 namespace blink {
 
 class ExceptionState;
-
-class DOMSettableTokenListObserver : public WillBeGarbageCollectedMixin {
-public:
-    virtual void valueChanged() = 0;
-
-    DEFINE_INLINE_VIRTUAL_TRACE() { }
-};
+class DOMSettableTokenListObserver;
 
 class DOMSettableTokenList final
     : public DOMTokenList
@@ -89,6 +83,13 @@ private:
     RawPtrWillBeWeakMember<DOMSettableTokenListObserver> m_observer;
 };
 
+class DOMSettableTokenListObserver : public WillBeGarbageCollectedMixin {
+public:
+    virtual void valueChanged(DOMSettableTokenList*) = 0;
+
+    DEFINE_INLINE_VIRTUAL_TRACE() { }
+};
+
 } // namespace blink
 
 #endif // DOMSettableTokenList_h