Cherry-pick WebKit security fix (webkit.org r68096) Do not merge

See http://trac.webkit.org/changeset/68096

Note that this is not an exact cherry pick of the above webkit
CL as it is dependant on http://trac.webkit.org/changeset/61094
that we do not have and provides the Element::isIdAttributName and
Element::getIdAttribute methods. 61094 is a large change so we do
not take it, rather use methods that achieve the same effect.

Change-Id: Ifae90116f794673a610dd7988ba366a0b51888d9

1 files changed, 8 insertions, 2 deletions

diff --git a/WebCore/dom/Element.cpp b/WebCore/dom/Element.cpp
index e12d326..93200a7 100644
--- a/WebCore/dom/Element.cpp
+++ b/WebCore/dom/Element.cpp
@@ -528,7 +528,10 @@ void Element::setAttribute(const AtomicString& name, const AtomicString& value,
     else if (!old && !value.isNull())
         namedAttrMap->addAttribute(createAttribute(QualifiedName(nullAtom, localName, nullAtom), value));
     else if (old && !value.isNull()) {
-        old->setValue(value);
+        if (Attr* attrNode = old->attr())
+            attrNode->setValue(value);
+        else
+            old->setValue(value);
         attributeChanged(old);
     }
 
@@ -557,7 +560,10 @@ void Element::setAttribute(const QualifiedName& name, const AtomicString& value,
     else if (!old && !value.isNull())
         namedAttrMap->addAttribute(createAttribute(name, value));
     else if (old) {
-        old->setValue(value);
+        if (Attr* attrNode = old->attr())
+            attrNode->setValue(value);
+        else
+            old->setValue(value);
         attributeChanged(old);
     }