Handle attribute changes after changing attribute

At least in chromium, synchronous internal listeners for attribute
changes which are run as "attribute change steps" are run after the
attribute is actually changed, not before.

This affects popover attribute related algorithms in HTML:
whatwg/html#9048 (comment)

dom.bs

@@ -6185,10 +6185,10 @@ given a <var>document</var>, <var>localName</var>, <var>namespace</var>, and opt
 <a>attribute</a> <var>attribute</var> to <var>value</var>, run these steps:
 
 <ol>
+ <li><p>Set <var>attribute</var>'s <a for=Attr>value</a> to <var>value</var>.
+
  <li><p><a>Handle attribute changes</a> for <var>attribute</var> with <var>attribute</var>'s
  <a for=Attr>element</a>, <var>attribute</var>'s <a for=Attr>value</a>, and <var>value</var>.
-
- <li><p>Set <var>attribute</var>'s <a for=Attr>value</a> to <var>value</var>.
 </ol>
 
 <p>To <dfn export id=concept-element-attributes-append lt="append an attribute">append</dfn> an