ElementData::attributeItem() should bounds-check the index.
Created attachment 199377 [details] Patch
Committed r149060: <http://trac.webkit.org/changeset/149060>