Do not fire a DOMSubtreeModified event when Attr.value attribute is set

Source/core/dom/ContainerNode.cpp

 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2001 Dirk Mueller (mueller@kde.org)
  * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009, 2013 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
  * version 2 of the License, or (at your option) any later version.
@@ skipping 652 matching lines @@
                 removeBetween(0, child->nextSibling(), *child);
                 removedChildren.append(child.get());
                 notifyNodeRemoved(*child);
             }
         }
 
         ChildrenChange change = {AllChildrenRemoved, nullptr, nullptr, ChildrenChangeSourceAPI};
         childrenChanged(change);
     }
 
-    dispatchSubtreeModifiedEvent();
+    // We don't fire the DOMSubtreeModified event for Attr Nodes. This matches the behavior
+    // of IE and Firefox. This event is fired synchronously and is a source of trouble for
+    // attributes as the JS callback could alter the attributes and leave us in a bad state.
+    if (!isAttributeNode())
+        dispatchSubtreeModifiedEvent();
 }
 
 PassRefPtrWillBeRawPtr<Node> ContainerNode::appendChild(PassRefPtrWillBeRawPtr<Node> newChild, ExceptionState& exceptionState)
 {
     RefPtrWillBeRawPtr<ContainerNode> protect(this);
 
 #if !ENABLE(OILPAN)
     // Check that this node is not "floating".
     // If it is, it can be deleted as a side effect of sending mutation events.
     ASSERT(refCount() || parentOrShadowHostNode());
@@ skipping 722 matching lines @@
         return true;
 
     if (node->isElementNode() && toElement(node)->shadow())
         return true;
 
     return false;
 }
 #endif
 
 } // namespace blink