Correctly handle updates over attached Attrs involving null values.

Source/core/dom/Attr.h

 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2001 Peter Kelly (pmk@post.com)
  *           (C) 2001 Dirk Mueller (mueller@kde.org)
  * Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
@@ skipping 68 matching lines @@
 
     virtual String nodeValue() const override { return value(); }
     virtual void setNodeValue(const String&) override;
     virtual PassRefPtrWillBeRawPtr<Node> cloneNode(bool deep = true) override;
 
     virtual bool isAttributeNode() const override { return true; }
     virtual bool childTypeAllowed(NodeType) const override;
 
     virtual void childrenChanged(const ChildrenChange&) override;
 
-    Attribute& elementAttribute();
+    void updateElementAttribute(const AtomicString&);
 
     // Attr wraps either an element/name, or a name/value pair (when it's a standalone Node.)
     // Note that m_name is always set, but m_element/m_standaloneValue may be null.
     RawPtrWillBeMember<Element> m_element;
     QualifiedName m_name;
     // Holds the value if it is a standalone Node, or the local name of the
     // attribute it is attached to on an Element. The latter may (letter case)
     // differ from m_name's local name. As these two modes are non-overlapping,
     // use a single field.
     AtomicString m_standaloneValueOrAttachedLocalName;
     unsigned m_ignoreChildrenChanged;
 };
 
 DEFINE_NODE_TYPE_CASTS(Attr, isAttributeNode());
 
 } // namespace blink
 
 #endif // Attr_h