Have ElementData::attributeItem() return a reference

Source/core/dom/ElementData.cpp

Index: Source/core/dom/ElementData.cpp
diff --git a/Source/core/dom/ElementData.cpp b/Source/core/dom/ElementData.cpp
index 2cff71fc531461b532f7e88af58ce8febf7a54d9..dbd47f0fdacdd821daa0551b70e00f9a4a1fa55f 100644
--- a/Source/core/dom/ElementData.cpp
+++ b/Source/core/dom/ElementData.cpp
@@ -105,9 +105,9 @@ bool ElementData::isEquivalent(const ElementData* other) const
         return false;
 
     for (unsigned i = 0; i < length; ++i) {
-        const Attribute* attribute = attributeItem(i);
-        const Attribute* otherAttr = other->getAttributeItem(attribute->name());
-        if (!otherAttr || attribute->value() != otherAttr->value())
+        const Attribute& attribute = attributeItem(i);
+        const Attribute* otherAttr = other->getAttributeItem(attribute.name());
+        if (!otherAttr || attribute.value() != otherAttr->value())
             return false;
     }
 
@@ -119,7 +119,7 @@ size_t ElementData::getAttrIndex(Attr* attr) const
     // This relies on the fact that Attr's QualifiedName == the Attribute's name.
     unsigned length = this->length();
     for (unsigned i = 0; i < length; ++i) {
-        if (attributeItem(i)->name() == attr->qualifiedName())
+        if (attributeItem(i).name() == attr->qualifiedName())
             return i;
     }
     return kNotFound;
@@ -130,17 +130,17 @@ size_t ElementData::getAttributeItemIndexSlowCase(const AtomicString& name, bool
     // Continue to checking case-insensitively and/or full namespaced names if necessary:
     unsigned length = this->length();
     for (unsigned i = 0; i < length; ++i) {
-        const Attribute* attribute = attributeItem(i);
+        const Attribute& attribute = attributeItem(i);
         // FIXME: Why check the prefix? Namespace is all that should matter
         // and all HTML/SVG attributes have a null namespace!
-        if (!attribute->name().hasPrefix()) {
-            if (shouldIgnoreAttributeCase && equalIgnoringCase(name, attribute->localName()))
+        if (!attribute.name().hasPrefix()) {
+            if (shouldIgnoreAttributeCase && equalIgnoringCase(name, attribute.localName()))
                 return i;
         } else {
             // FIXME: Would be faster to do this comparison without calling toString, which
             // generates a temporary string by concatenation. But this branch is only reached
             // if the attribute name has a prefix, which is rare in HTML.
-            if (equalPossiblyIgnoringCase(name, attribute->name().toString(), shouldIgnoreAttributeCase))
+            if (equalPossiblyIgnoringCase(name, attribute.name().toString(), shouldIgnoreAttributeCase))
                 return i;
         }
     }