Use DOMSettableTokenList for {HTMLAnchorElement, HTMLAreaElement}.ping.

Source/core/html/HTMLAnchorElement.cpp

Index: Source/core/html/HTMLAnchorElement.cpp
diff --git a/Source/core/html/HTMLAnchorElement.cpp b/Source/core/html/HTMLAnchorElement.cpp
index 0e49c829ee7e3e136e827760e1bceabc25431131..ccecf53e8328e4051063442ba15f3ba9b5f969fc 100644
--- a/Source/core/html/HTMLAnchorElement.cpp
+++ b/Source/core/html/HTMLAnchorElement.cpp
@@ -47,9 +47,17 @@ HTMLAnchorElement::HTMLAnchorElement(const QualifiedName& tagName, Document& doc
     , m_linkRelations(0)
     , m_cachedVisitedLinkHash(0)
     , m_wasFocusedByMouse(false)
+    , m_ping(DOMSettableTokenList::create(this))
 {
 }
 
+DEFINE_TRACE(HTMLAnchorElement)
+{
+    visitor->trace(m_ping);
+    HTMLElement::trace(visitor);
+    DOMSettableTokenListObserver::trace(visitor);
+}
+
 PassRefPtrWillBeRawPtr<HTMLAnchorElement> HTMLAnchorElement::create(Document& document)
 {
     return adoptRefWillBeNoop(new HTMLAnchorElement(aTag, document));
@@ -57,6 +65,7 @@ PassRefPtrWillBeRawPtr<HTMLAnchorElement> HTMLAnchorElement::create(Document& do
 
 HTMLAnchorElement::~HTMLAnchorElement()
 {
+    m_ping->setObserver(nullptr);

[tkent, 2015/07/14 00:29:44]

This doesn't work on Oilpan because m_ping can be destructed before |this|.  On
Oilpan, DOMSettableTokenList::m_observer is a weak member, so we don't need to
do anything here.
We need #if here.

#if !ENABLE(OILPAN)
    m_ping->setObserver(nullptr)+
#endif

 }
 
 bool HTMLAnchorElement::supportsFocus() const
@@ -217,6 +226,8 @@ void HTMLAnchorElement::parseAttribute(const QualifiedName& name, const AtomicSt
         // Do nothing.
     } else if (name == relAttr) {
         setRel(value);
+    } else if (name == pingAttr) {
+        m_ping->setValue(value);
     } else {
         HTMLElement::parseAttribute(name, value);
     }
@@ -317,17 +328,21 @@ bool HTMLAnchorElement::isLiveLink() const
 
 void HTMLAnchorElement::sendPings(const KURL& destinationURL) const
 {
-    const AtomicString& pingValue = getAttribute(pingAttr);
-    if (pingValue.isNull() || !document().settings() || !document().settings()->hyperlinkAuditingEnabled())
+    if (m_ping->value().isNull() || !document().settings() || !document().settings()->hyperlinkAuditingEnabled())
         return;
 
     UseCounter::count(document(), UseCounter::HTMLAnchorElementPingAttribute);
 
-    SpaceSplitString pingURLs(pingValue, SpaceSplitString::ShouldNotFoldCase);
+    SpaceSplitString pingURLs = m_ping->tokens();

[tkent, 2015/07/14 00:29:44]

should be |const SpaceSplitString&|.

     for (unsigned i = 0; i < pingURLs.size(); i++)
         PingLoader::sendLinkAuditPing(document().frame(), document().completeURL(pingURLs[i]), destinationURL);
 }
 
+DOMSettableTokenList* HTMLAnchorElement::ping() const
+{
+    return m_ping.get();
+}
+
 void HTMLAnchorElement::handleClick(Event* event)
 {
     event->setDefaultHandled();
@@ -398,4 +413,9 @@ Node::InsertionNotificationRequest HTMLAnchorElement::insertedInto(ContainerNode
     return HTMLElement::insertedInto(insertionPoint);
 }
 
+void HTMLAnchorElement::valueChanged()
+{
+    setSynchronizedLazyAttribute(pingAttr, m_ping->value());
+}
+
 } // namespace blink