Make textContent trigger single DOMSubtreeModified event

Source/core/dom/Attr.cpp

 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2001 Peter Kelly (pmk@post.com)
  *           (C) 2001 Dirk Mueller (mueller@kde.org)
  * Copyright (C) 2004, 2005, 2006, 2007, 2009, 2010, 2012 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
@@ skipping 88 matching lines @@
         treeScope().adoptIfNeeded(*textNode);
         setFirstChild(textNode.get());
         setLastChild(textNode.get());
     }
 }
 
 void Attr::setValue(const AtomicString& value)
 {
     EventQueueScope scope;
     m_ignoreChildrenChanged++;
-    removeChildren();
+    // We don't fire the DOMSubtreeModified event for Attr Nodes. This matches the behavior
+    // of IE and Firefox. This event is fired synchronously and is a source of trouble for
+    // attributes as the JS callback could alter the attributes and leave us in a bad state.
+    removeChildren(OmitSubtreeModifiedEvent);
     if (m_element)
         elementAttribute().setValue(value);
     else
         m_standaloneValueOrAttachedLocalName = value;
     createTextChild();
     m_ignoreChildrenChanged--;
 
     QualifiedName name = qualifiedName();
     invalidateNodeListCachesInAncestors(&name, m_element);
 }
@@ skipping 100 matching lines @@
     m_standaloneValueOrAttachedLocalName = attachedLocalName;
 }
 
 void Attr::trace(Visitor* visitor)
 {
     visitor->trace(m_element);
     ContainerNode::trace(visitor);
 }
 
 }