Use DOMSettableTokenList for {HTMLAnchorElement, HTMLAreaElement}.ping.

third_party/WebKit/Source/core/html/HTMLAnchorElement.cpp

Index: third_party/WebKit/Source/core/html/HTMLAnchorElement.cpp
diff --git a/third_party/WebKit/Source/core/html/HTMLAnchorElement.cpp b/third_party/WebKit/Source/core/html/HTMLAnchorElement.cpp
index a5b29fa83b4746787b77ea9b5a6ab09ed6f15fe2..1d3ea9ee72e350b5e2fcfd3dfd04460e0f0ac3d6 100644
--- a/third_party/WebKit/Source/core/html/HTMLAnchorElement.cpp
+++ b/third_party/WebKit/Source/core/html/HTMLAnchorElement.cpp
@@ -53,6 +53,13 @@ HTMLAnchorElement::HTMLAnchorElement(const QualifiedName& tagName, Document& doc
 {
 }
 
+DEFINE_TRACE(HTMLAnchorElement)
+{
+    visitor->trace(m_ping);
+    HTMLElement::trace(visitor);
+    DOMSettableTokenListObserver::trace(visitor);
+}
+
 PassRefPtrWillBeRawPtr<HTMLAnchorElement> HTMLAnchorElement::create(Document& document)
 {
     return adoptRefWillBeNoop(new HTMLAnchorElement(aTag, document));
@@ -60,6 +67,10 @@ PassRefPtrWillBeRawPtr<HTMLAnchorElement> HTMLAnchorElement::create(Document& do
 
 HTMLAnchorElement::~HTMLAnchorElement()
 {
+#if !ENABLE(OILPAN)
+    if (m_ping)
+        m_ping->setObserver(nullptr);
+#endif
 }
 
 bool HTMLAnchorElement::supportsFocus() const
@@ -220,6 +231,10 @@ void HTMLAnchorElement::parseAttribute(const QualifiedName& name, const AtomicSt
         // Do nothing.
     } else if (name == relAttr) {
         setRel(value);
+    } else if (name == pingAttr) {
+        if (!m_ping)
+            m_ping = DOMSettableTokenList::create((DOMSettableTokenListObserver*)this);

[philipj_slow, 2015/10/05 15:03:17]

It looks like you could use ping()->setValue(value) here to achieve the same
thing.

[hyunjunekim2, 2015/10/05 15:30:25]

When call |anchor.setAttribute('ping', 'p1');|, if hasn't this codes, occur to
segment fault.

[philipj_slow, 2015/10/05 16:36:43]

It will segfault if you use use m_ping->, but why does ping()-> not work?

+        m_ping->setValue(value); 
     } else {
         HTMLElement::parseAttribute(name, value);
     }
@@ -320,17 +335,24 @@ bool HTMLAnchorElement::isLiveLink() const
 
 void HTMLAnchorElement::sendPings(const KURL& destinationURL) const
 {
-    const AtomicString& pingValue = getAttribute(pingAttr);
-    if (pingValue.isNull() || !document().settings() || !document().settings()->hyperlinkAuditingEnabled())
+    if (!m_ping || m_ping->value().isNull() || !document().settings() || !document().settings()->hyperlinkAuditingEnabled())
         return;
 
     UseCounter::count(document(), UseCounter::HTMLAnchorElementPingAttribute);
 
-    SpaceSplitString pingURLs(pingValue, SpaceSplitString::ShouldNotFoldCase);
+    const SpaceSplitString& pingURLs = m_ping->tokens();
     for (unsigned i = 0; i < pingURLs.size(); i++)
         PingLoader::sendLinkAuditPing(document().frame(), document().completeURL(pingURLs[i]), destinationURL);
 }
 
+DOMSettableTokenList* HTMLAnchorElement::ping() const
+{
+    if (!m_ping)
+        m_ping = DOMSettableTokenList::create((DOMSettableTokenListObserver*)this);

[philipj_slow, 2015/10/05 15:03:17]

Why is the case needed? If it is needed, it should be a static_cast.

[hyunjunekim2, 2015/10/05 15:30:25]

currently lazily it did make. If there is'n this code, return undefined then
call |a.ping|.
|this| object is const, So don't use a static_cast.

[philipj_slow, 2015/10/05 16:36:43]

It seems like just making ping() not const would be better, but there's also
const_cast of course.

+
+    return m_ping.get();
+}
+
 void HTMLAnchorElement::handleClick(Event* event)
 {
     event->setDefaultHandled();
@@ -373,6 +395,11 @@ void HTMLAnchorElement::handleClick(Event* event)
     }
 }
 
+void HTMLAnchorElement::valueChanged()
+{
+    setSynchronizedLazyAttribute(pingAttr, m_ping->value());
+}
+
 bool isEnterKeyKeydownEvent(Event* event)
 {
     return event->type() == EventTypeNames::keydown && event->isKeyboardEvent() && toKeyboardEvent(event)->keyIdentifier() == "Enter";