Correctly handle accessing a replaced Attr object's attribute value.

Source/core/dom/Attr.cpp

Index: Source/core/dom/Attr.cpp
diff --git a/Source/core/dom/Attr.cpp b/Source/core/dom/Attr.cpp
index d25ebeae29043ade7c71270ffa21eb1bffd7d6e8..dbcf00520ff9ba177568ecc55602ef52960f5769 100644
--- a/Source/core/dom/Attr.cpp
+++ b/Source/core/dom/Attr.cpp
@@ -178,8 +178,12 @@ void Attr::childrenChanged(bool, Node*, Node*, int)
 
 const AtomicString& Attr::value() const
 {
-    if (m_element)
-        return m_element->getAttribute(qualifiedName());
+    if (m_element) {
+        const AtomicString& value = m_element->getAttribute(qualifiedName());
+        if (value != nullAtom || !m_element->shouldIgnoreAttributeCase())
+            return value;
+        return m_element->getAttribute(QualifiedName(prefix(), localName().lower(), namespaceURI()));
+    }
     return m_standaloneValue;
 }
 
@@ -187,7 +191,7 @@ Attribute& Attr::elementAttribute()
 {
     ASSERT(m_element);
     ASSERT(m_element->elementData());
-    return *m_element->ensureUniqueElementData().getAttributeItem(qualifiedName());
+    return *m_element->ensureUniqueElementData().getAttributeItem(qualifiedName(), m_element->shouldIgnoreAttributeCase());
 }
 
 void Attr::detachFromElementWithValue(const AtomicString& value)