Use DOMSettableTokenList for {HTMLAnchorElement, HTMLAreaElement}.ping.

third_party/WebKit/Source/core/html/HTMLAnchorElement.cpp

 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2000 Simon Hausmann <hausmann@kde.org>
  * Copyright (C) 2003, 2006, 2007, 2008, 2009, 2010 Apple Inc. All rights reserved.
  *           (C) 2006 Graham Dennis (graham.dennis@gmail.com)
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
@@ skipping 35 matching lines @@
 using namespace HTMLNames;
 
 HTMLAnchorElement::HTMLAnchorElement(const QualifiedName& tagName, Document& document)
     : HTMLElement(tagName, document)
     , m_linkRelations(0)
     , m_cachedVisitedLinkHash(0)
     , m_wasFocusedByMouse(false)
 {
 }
 
+DEFINE_TRACE(HTMLAnchorElement)
+{
+    visitor->trace(m_ping);
+    HTMLElement::trace(visitor);
+    DOMSettableTokenListObserver::trace(visitor);
+}
+
 PassRefPtrWillBeRawPtr<HTMLAnchorElement> HTMLAnchorElement::create(Document& document)
 {
     return adoptRefWillBeNoop(new HTMLAnchorElement(aTag, document));
 }
 
 HTMLAnchorElement::~HTMLAnchorElement()
 {
+#if !ENABLE(OILPAN)
+    if (m_ping)
+        m_ping->setObserver(nullptr);
+#endif
 }
 
 bool HTMLAnchorElement::supportsFocus() const
 {
     if (hasEditableStyle())
         return HTMLElement::supportsFocus();
     // If not a link we should still be able to focus the element if it has tabIndex.
     return isLink() || HTMLElement::supportsFocus();
 }
 
@@ skipping 140 matching lines @@
             if (document().isDNSPrefetchEnabled()) {
                 if (protocolIs(parsedURL, "http") || protocolIs(parsedURL, "https") || parsedURL.startsWith("//"))
                     prefetchDNS(document().completeURL(parsedURL).host());
             }
         }
         invalidateCachedVisitedLinkHash();
     } else if (name == nameAttr || name == titleAttr) {
         // Do nothing.
     } else if (name == relAttr) {
         setRel(value);
+    } else if (name == pingAttr) {
+        ping()->setValue(value); 
     } else {
         HTMLElement::parseAttribute(name, value);
     }
 }
 
 void HTMLAnchorElement::accessKeyAction(bool sendMouseEvents)
 {
     dispatchSimulatedClick(0, sendMouseEvents ? SendMouseUpDownEvents : SendNoEvents);
 }
 
@@ skipping 80 matching lines @@
     return Element::tabIndex();
 }
 
 bool HTMLAnchorElement::isLiveLink() const
 {
     return isLink() && !hasEditableStyle();
 }
 
 void HTMLAnchorElement::sendPings(const KURL& destinationURL) const
 {
-    const AtomicString& pingValue = getAttribute(pingAttr);
-    if (pingValue.isNull() || !document().settings() || !document().settings()->hyperlinkAuditingEnabled())
+    if (!m_ping || m_ping->value().isNull() || !document().settings() || !document().settings()->hyperlinkAuditingEnabled())
         return;
 
     UseCounter::count(document(), UseCounter::HTMLAnchorElementPingAttribute);
 
-    SpaceSplitString pingURLs(pingValue, SpaceSplitString::ShouldNotFoldCase);
+    const SpaceSplitString& pingURLs = m_ping->tokens();
     for (unsigned i = 0; i < pingURLs.size(); i++)
         PingLoader::sendLinkAuditPing(document().frame(), document().completeURL(pingURLs[i]), destinationURL);
 }
 
+DOMSettableTokenList* HTMLAnchorElement::ping()
+{
+    if (!m_ping)
+        m_ping = DOMSettableTokenList::create(this);
+
+    return m_ping.get();
+}
+
 void HTMLAnchorElement::handleClick(Event* event)
 {
     event->setDefaultHandled();
 
     LocalFrame* frame = document().frame();
     if (!frame)
         return;
 
     StringBuilder url;
     url.append(stripLeadingAndTrailingHTMLSpaces(fastGetAttribute(hrefAttr)));
@@ skipping 22 matching lines @@
     } else {
         request.setRequestContext(WebURLRequest::RequestContextHyperlink);
         FrameLoadRequest frameRequest(&document(), request, getAttribute(targetAttr));
         frameRequest.setTriggeringEvent(event);
         if (hasRel(RelationNoReferrer))
             frameRequest.setShouldSendReferrer(NeverSendReferrer);
         frame->loader().load(frameRequest);
     }
 }
 
+void HTMLAnchorElement::valueChanged()
+{
+    setSynchronizedLazyAttribute(pingAttr, m_ping->value());

[sof, 2015/10/06 08:16:15]

m_ping is guaranteed to be non-null?

[philipj_slow, 2015/10/06 09:01:00]

I think so, because valueChanged() is called from
DOMSettableTokenList::setValue() and the lifetimes of the two objects look
right.

+}
+
 bool isEnterKeyKeydownEvent(Event* event)
 {
     return event->type() == EventTypeNames::keydown && event->isKeyboardEvent() && toKeyboardEvent(event)->keyIdentifier() == "Enter";
 }
 
 bool isLinkClick(Event* event)
 {
     return event->type() == EventTypeNames::click && (!event->isMouseEvent() || toMouseEvent(event)->button() != RightButton);
 }
 
@@ skipping 15 matching lines @@
             Vector<String> argv;
             argv.append("a");
             argv.append(fastGetAttribute(hrefAttr));
             activityLogger->logEvent("blinkAddElement", argv.size(), argv.data());
         }
     }
     return HTMLElement::insertedInto(insertionPoint);
 }
 
 } // namespace blink