Correctly handle updates over attached Attrs involving null values.

Source/core/dom/Attr.cpp

 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2001 Peter Kelly (pmk@post.com)
  *           (C) 2001 Dirk Mueller (mueller@kde.org)
  * Copyright (C) 2004, 2005, 2006, 2007, 2009, 2010, 2012 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
@@ skipping 93 matching lines @@
 
 void Attr::setValue(const AtomicString& value)
 {
     EventQueueScope scope;
     m_ignoreChildrenChanged++;
     // We don't fire the DOMSubtreeModified event for Attr Nodes. This matches the behavior
     // of IE and Firefox. This event is fired synchronously and is a source of trouble for
     // attributes as the JS callback could alter the attributes and leave us in a bad state.
     removeChildren(OmitSubtreeModifiedEvent);
     if (m_element)
-        elementAttribute().setValue(value);
+        updateElementAttribute(value);
     else
         m_standaloneValueOrAttachedLocalName = value;
     createTextChild();
     m_ignoreChildrenChanged--;
 
     QualifiedName name = qualifiedName();
     invalidateNodeListCachesInAncestors(&name, m_element);
 }
 
 void Attr::setValueInternal(const AtomicString& value)
@@ skipping 55 matching lines @@
     for (Node *n = firstChild(); n; n = n->nextSibling()) {
         if (n->isTextNode())
             valueBuilder.append(toText(n)->data());
     }
 
     AtomicString newValue = valueBuilder.toAtomicString();
     if (m_element)
         m_element->willModifyAttribute(qualifiedName(), value(), newValue);
 
     if (m_element)
-        elementAttribute().setValue(newValue);
+        updateElementAttribute(newValue);
     else
         m_standaloneValueOrAttachedLocalName = newValue;
 
     if (m_element)
         m_element->attributeChanged(qualifiedName(), newValue);
 }
 
 const AtomicString& Attr::value() const
 {
     if (m_element)
         return m_element->getAttribute(qualifiedName());
     return m_standaloneValueOrAttachedLocalName;
 }
 
-Attribute& Attr::elementAttribute()
+void Attr::updateElementAttribute(const AtomicString& value)
 {
     ASSERT(m_element);
     ASSERT(m_element->elementData());
-    return *m_element->ensureUniqueElementData().attributes().find(qualifiedName());
+    MutableAttributeCollection attributes = m_element->ensureUniqueElementData().attributes();
+    size_t index = attributes.findIndex(qualifiedName());
+    if (index == kNotFound) {
+        // Element attributes with null values are not stored.
+        if (!value.isNull())
+            attributes.append(qualifiedName(), value);
+        return;
+    }
+    return attributes[index].setValue(value);
 }
 
 void Attr::detachFromElementWithValue(const AtomicString& value)
 {
     ASSERT(m_element);
     m_standaloneValueOrAttachedLocalName = value;
     m_element = nullptr;
 }
 
 void Attr::attachToElement(Element* element, const AtomicString& attachedLocalName)
 {
     ASSERT(!m_element);
     m_element = element;
     m_standaloneValueOrAttachedLocalName = attachedLocalName;
 }
 
 DEFINE_TRACE(Attr)
 {
     visitor->trace(m_element);
     ContainerNode::trace(visitor);
 }
 
 }