Created attachment 32383 [details] test case contenteditable="inherit" doesn't cause the attribute to be removed, as specified (makes parts of some Mail messages editable) HTMLElement::parseMappedAttribute is never getting called for contenteditableAttr, so userModify is never updated correctly for the inherit value. And the attribute is never removed, which is the specified behavior for the "inherit" value. See attached test case. <rdar://problem/7022306>
Created attachment 38771 [details] a test that actually works
It seems like this bug doesn't reproduce any more on TOT. At least the new test case you've attached doesn't reproduce the bug you described.
Yes, this appears to be fixed.