Correctly handle accessing a replaced Attr object's attribute value.

Source/core/dom/Attr.h

Index: Source/core/dom/Attr.h
diff --git a/Source/core/dom/Attr.h b/Source/core/dom/Attr.h
index dbc9dd3c519686265dd53d9729ee8196d1e24165..b6b2b4d362cf339423ffc2e85de3264af8852fae 100644
--- a/Source/core/dom/Attr.h
+++ b/Source/core/dom/Attr.h
@@ -44,7 +44,7 @@ public:
     static PassRefPtrWillBeRawPtr<Attr> create(Document&, const QualifiedName&, const AtomicString& value);
     virtual ~Attr();
 
-    String name() const { return qualifiedName().toString(); }
+    String name() const { return m_name.toString(); }
     bool specified() const { return true; }
     Element* ownerElement() const { return m_element; }
 
@@ -54,9 +54,9 @@ public:
     const AtomicString& valueForBindings() const;
     void setValueForBindings(const AtomicString&);
 
-    const QualifiedName& qualifiedName() const { return m_name; }
+    const QualifiedName qualifiedName() const;
 
-    void attachToElement(Element*);
+    void attachToElement(Element*, const AtomicString&);
     void detachFromElementWithValue(const AtomicString&);
 
     virtual const AtomicString& localName() const OVERRIDE { return m_name.localName(); }
@@ -91,7 +91,11 @@ private:
     // Note that m_name is always set, but m_element/m_standaloneValue may be null.
     RawPtrWillBeMember<Element> m_element;
     QualifiedName m_name;
-    AtomicString m_standaloneValue;
+    // Holds the value if it is a standalone Node, or the local name of the
+    // attribute it is attached to on an Element. The latter may (letter case)
+    // differ from m_name's local name. As these two modes are non-overlapping,
+    // use a single field.
+    AtomicString m_standaloneValueOrAttachedLocalName;
     unsigned m_ignoreChildrenChanged;
 };