Correctly handle accessing a replaced Attr object's attribute value.

Source/core/dom/Attr.h

 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2001 Peter Kelly (pmk@post.com)
  *           (C) 2001 Dirk Mueller (mueller@kde.org)
  * Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
@@ skipping 26 matching lines @@
 // is to dynamically allocate a textchild and store the
 // resulting nodevalue in the attribute upon
 // destruction. however, this is not yet implemented.
 
 class Attr FINAL : public ContainerNode {
 public:
     static PassRefPtrWillBeRawPtr<Attr> create(Element&, const QualifiedName&);
     static PassRefPtrWillBeRawPtr<Attr> create(Document&, const QualifiedName&, const AtomicString& value);
     virtual ~Attr();
 
-    String name() const { return qualifiedName().toString(); }
+    String name() const { return m_name.toString(); }
     bool specified() const { return true; }
     Element* ownerElement() const { return m_element; }
 
     const AtomicString& value() const;
     void setValue(const AtomicString&);
 
     const AtomicString& valueForBindings() const;
     void setValueForBindings(const AtomicString&);
 
-    const QualifiedName& qualifiedName() const { return m_name; }
+    const QualifiedName qualifiedName() const;
 
-    void attachToElement(Element*);
+    void attachToElement(Element*, const AtomicString&);
     void detachFromElementWithValue(const AtomicString&);
 
     virtual const AtomicString& localName() const OVERRIDE { return m_name.localName(); }
     virtual const AtomicString& namespaceURI() const OVERRIDE { return m_name.namespaceURI(); }
     const AtomicString& prefix() const { return m_name.prefix(); }
 
     virtual void trace(Visitor*) OVERRIDE;
 
 private:
     Attr(Element&, const QualifiedName&);
@@ skipping 14 matching lines @@
     virtual bool childTypeAllowed(NodeType) const OVERRIDE;
 
     virtual void childrenChanged(bool changedByParser = false, Node* beforeChange = 0, Node* afterChange = 0, int childCountDelta = 0) OVERRIDE;
 
     Attribute& elementAttribute();
 
     // Attr wraps either an element/name, or a name/value pair (when it's a standalone Node.)
     // Note that m_name is always set, but m_element/m_standaloneValue may be null.
     RawPtrWillBeMember<Element> m_element;
     QualifiedName m_name;
-    AtomicString m_standaloneValue;
+    // Holds the value if it is a standalone Node, or the local name of the
+    // attribute it is attached to on an Element. The latter may (letter case)
+    // differ from m_name's local name. As these two modes are non-overlapping,
+    // use a single field.
+    AtomicString m_standaloneValueOrAttachedLocalName;
     unsigned m_ignoreChildrenChanged;
 };
 
 DEFINE_NODE_TYPE_CASTS(Attr, isAttributeNode());
 
 } // namespace WebCore
 
 #endif // Attr_h