Correctly handle updates over attached Attrs involving null values.

Correctly handle updates over attached Attrs involving null values.

Element attributes having a null value are not stored by the ElementData's
attribute collection. When updating an Element-attached Attr with
a new value, which previously was null, correctly handle updates over
null values (before and after.)

R=
BUG=472840
Committed: https://src.chromium.org/viewvc/blink?view=rev&revision=193484

[sof, 2015-04-09 15:35:45]

sigbjornf@opera.com changed reviewers:
+ adamk@chromium.org, mkwst@chromium.org, tkent@chromium.org

[sof, 2015-04-09 15:35:46]

Please take a look.

Older issue; surprising it has gone undetected.

[tkent, 2015-04-09 22:56:55]

lgtm

> Older issue; surprising it has gone undetected.

Unfortunately no one was responsible for Cr-Blink-DOM bugs.

[tkent, 2015-04-09 22:56:58]

The CQ bit was checked by tkent@chromium.org

[commit-bot: I haz the power, 2015-04-09 22:57:16]

CQ is trying da patch. Follow status at
 https://chromium-cq-status.appspot.com/patch-status/1073823002/1

[commit-bot: I haz the power, 2015-04-09 23:08:54]

Committed patchset #1 (id:1) as
https://src.chromium.org/viewvc/blink?view=rev&revision=193484

[sof, 2015-04-10 05:18:06]

On 2015/04/09 22:56:55, tkent wrote:
> lgtm
> 
> > Older issue; surprising it has gone undetected.
> 
> Unfortunately no one was responsible for Cr-Blink-DOM bugs.

thanks for the review (and commit.) Responsible for making sure incoming bugs
are sorted, assigned, prioritized ?

(I was just surprised that fuzzers haven't uncovered this - problem has been
there since 2012.)

[tkent, 2015-04-12 23:41:38]

On 2015/04/10 05:18:06, sof wrote:
> On 2015/04/09 22:56:55, tkent wrote:
> > lgtm
> > 
> > > Older issue; surprising it has gone undetected.
> > 
> > Unfortunately no one was responsible for Cr-Blink-DOM bugs.
> 
> thanks for the review (and commit.) Responsible for making sure incoming bugs
> are sorted, assigned, prioritized ?

Right.

> (I was just surprised that fuzzers haven't uncovered this - problem has been
> there since 2012.)

I heard our fuzzer constructed test cases from fragments of existing layout
tests.  If we have a few tests including |attr.value = null|, it has low
possibility to produce a test case for this bug.