Protect an element while removing an attribute.

LayoutTests/http/tests/misc/adopt-iframe-src-attr-after-remove.html

+We pass if we don't crash under ASAN.
+<iframe id=i src="../navigation/resources/blank.txt"></iframe>
+<script>
+if (window.testRunner) {
+    testRunner.dumpAsText();
+    testRunner.waitUntilDone();
+}
+
+window.onload = function()
+{
+    i.parentNode.removeChild(i);
+    gc();
+}
+
+document.addEventListener("DOMContentLoaded", function() {
+    setTimeout(function() {
+        document.adoptNode(i.attributes["src"]);

[esprehn, 2014/06/20 21:24:45]

It abarth explained to me the reason for the adoptNode. The "i" variable is gone
since we've called down into adoptNode to remove the Attr node and for some
reason the Attr is not keeping the owner element alive.

So the two bugs here seem to be:

1) Attr should keep the owner element alive.
2) onload should never fire synchronously.

+        if (window.testRunner)
+            testRunner.notifyDone();
+    }, 0);
+}, false);
+</script>