REGRESSION(r164856): Use after free in WebCore::QualifiedName::operator== / WebCore...

REGRESSION(r164856): Use after free in WebCore::QualifiedName::operator== / WebCore::StyledElement::attributeChanged
https://bugs.webkit.org/show_bug.cgi?id=129550

Reviewed by Andreas Kling.

Source/WebCore:

We can't store a reference to QualifiedName here because ensureUniqueElementData could delete QualifiedName inside Attribute.

Test: fast/dom/uniquing-attributes-via-setAttribute.html

* dom/Element.cpp:
(WebCore::Element::setAttributeInternal):

LayoutTests:

Added a regression test.

* fast/dom/uniquing-attributes-via-setAttribute-expected.txt: Added.
* fast/dom/uniquing-attributes-via-setAttribute.html: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@165044 268f45cc-cd09-0410-ab3c-d52691b4dbfc