Correctly handle accessing a replaced Attr object's attribute value.

Source/core/dom/Attr.cpp

 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2001 Peter Kelly (pmk@post.com)
  *           (C) 2001 Dirk Mueller (mueller@kde.org)
  * Copyright (C) 2004, 2005, 2006, 2007, 2009, 2010, 2012 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
@@ skipping 160 matching lines @@
         elementAttribute().setValue(newValue);
     else
         m_standaloneValue = newValue;
 
     if (m_element)
         m_element->attributeChanged(qualifiedName(), newValue);
 }
 
 const AtomicString& Attr::value() const
 {
-    if (m_element)
-        return m_element->getAttribute(qualifiedName());
+    if (m_element) {
+        const AtomicString& value = m_element->getAttribute(qualifiedName());
+        if (value != nullAtom || !m_element->shouldIgnoreAttributeCase())
+            return value;
+        return m_element->getAttribute(QualifiedName(prefix(), localName().lower(), namespaceURI()));
+    }
     return m_standaloneValue;
 }
 
 Attribute& Attr::elementAttribute()
 {
     ASSERT(m_element);
     ASSERT(m_element->elementData());
-    return *m_element->ensureUniqueElementData().getAttributeItem(qualifiedName());
+    return *m_element->ensureUniqueElementData().getAttributeItem(qualifiedName(), m_element->shouldIgnoreAttributeCase());
 }
 
 void Attr::detachFromElementWithValue(const AtomicString& value)
 {
     ASSERT(m_element);
     ASSERT(m_standaloneValue.isNull());
     m_standaloneValue = value;
     m_element = nullptr;
 }
 
 void Attr::attachToElement(Element* element)
 {
     ASSERT(!m_element);
     m_element = element;
     m_standaloneValue = nullAtom;
 }
 
 void Attr::trace(Visitor* visitor)
 {
     visitor->trace(m_element);
     ContainerNode::trace(visitor);
 }
 
 }