Make textContent trigger single DOMSubtreeModified event

Source/core/dom/Attr.cpp

Index: Source/core/dom/Attr.cpp
diff --git a/Source/core/dom/Attr.cpp b/Source/core/dom/Attr.cpp
index 33453205688ace876928c3a94e41aeb55bb02716..c6236a4faaeec174777f96e9d170b8d0d21164dd 100644
--- a/Source/core/dom/Attr.cpp
+++ b/Source/core/dom/Attr.cpp
@@ -106,7 +106,10 @@ void Attr::setValue(const AtomicString& value)
 {
     EventQueueScope scope;
     m_ignoreChildrenChanged++;
-    removeChildren();
+    // We don't fire the DOMSubtreeModified event for Attr Nodes. This matches the behavior
+    // of IE and Firefox. This event is fired synchronously and is a source of trouble for
+    // attributes as the JS callback could alter the attributes and leave us in a bad state.
+    removeChildren(OmitSubtreeModifiedEvent);
     if (m_element)
         elementAttribute().setValue(value);
     else