Lexing XML attribute values with newlines triggers memory allocation errors

This only happens when an IO instance is used as the input. Simple repro:

Oga.parse_xml(StringIO.new("<foo bar='\n10'></foo>"))

This results in:

NoMemoryError: failed to allocate memory
from /home/yorickpeterse/Private/Projects/ruby/oga/lib/oga/xml/lexer.rb:139:in `advance_native'

Digging around, it seems that ts in the C code is set to NULL when processing attribute values (= strings). Not sure yet what the heck is going on.