Use DOMSettableTokenList for {HTMLAnchorElement, HTMLAreaElement}.ping.

third_party/WebKit/Source/core/html/HTMLAnchorElement.cpp

Index: third_party/WebKit/Source/core/html/HTMLAnchorElement.cpp
diff --git a/third_party/WebKit/Source/core/html/HTMLAnchorElement.cpp b/third_party/WebKit/Source/core/html/HTMLAnchorElement.cpp
index a5b29fa83b4746787b77ea9b5a6ab09ed6f15fe2..782290c8f212fa6c02f9be2e92aab6b8aea10793 100644
--- a/third_party/WebKit/Source/core/html/HTMLAnchorElement.cpp
+++ b/third_party/WebKit/Source/core/html/HTMLAnchorElement.cpp
@@ -53,6 +53,13 @@ HTMLAnchorElement::HTMLAnchorElement(const QualifiedName& tagName, Document& doc
 {
 }
 
+DEFINE_TRACE(HTMLAnchorElement)
+{
+    visitor->trace(m_ping);
+    HTMLElement::trace(visitor);
+    DOMSettableTokenListObserver::trace(visitor);
+}
+
 PassRefPtrWillBeRawPtr<HTMLAnchorElement> HTMLAnchorElement::create(Document& document)
 {
     return adoptRefWillBeNoop(new HTMLAnchorElement(aTag, document));
@@ -60,6 +67,10 @@ PassRefPtrWillBeRawPtr<HTMLAnchorElement> HTMLAnchorElement::create(Document& do
 
 HTMLAnchorElement::~HTMLAnchorElement()
 {
+#if !ENABLE(OILPAN)
+    if (m_ping)
+        m_ping->setObserver(nullptr);
+#endif
 }
 
 bool HTMLAnchorElement::supportsFocus() const
@@ -220,6 +231,8 @@ void HTMLAnchorElement::parseAttribute(const QualifiedName& name, const AtomicSt
         // Do nothing.
     } else if (name == relAttr) {
         setRel(value);
+    } else if (name == pingAttr) {
+        ping()->setValue(value); 
     } else {
         HTMLElement::parseAttribute(name, value);
     }
@@ -320,17 +333,24 @@ bool HTMLAnchorElement::isLiveLink() const
 
 void HTMLAnchorElement::sendPings(const KURL& destinationURL) const
 {
-    const AtomicString& pingValue = getAttribute(pingAttr);
-    if (pingValue.isNull() || !document().settings() || !document().settings()->hyperlinkAuditingEnabled())
+    if (!m_ping || m_ping->value().isNull() || !document().settings() || !document().settings()->hyperlinkAuditingEnabled())
         return;
 
     UseCounter::count(document(), UseCounter::HTMLAnchorElementPingAttribute);
 
-    SpaceSplitString pingURLs(pingValue, SpaceSplitString::ShouldNotFoldCase);
+    const SpaceSplitString& pingURLs = m_ping->tokens();
     for (unsigned i = 0; i < pingURLs.size(); i++)
         PingLoader::sendLinkAuditPing(document().frame(), document().completeURL(pingURLs[i]), destinationURL);
 }
 
+DOMSettableTokenList* HTMLAnchorElement::ping()
+{
+    if (!m_ping)
+        m_ping = DOMSettableTokenList::create(this);
+
+    return m_ping.get();
+}
+
 void HTMLAnchorElement::handleClick(Event* event)
 {
     event->setDefaultHandled();
@@ -373,6 +393,11 @@ void HTMLAnchorElement::handleClick(Event* event)
     }
 }
 
+void HTMLAnchorElement::valueChanged()
+{
+    setSynchronizedLazyAttribute(pingAttr, m_ping->value());

[sof, 2015/10/06 08:16:15]

m_ping is guaranteed to be non-null?

[philipj_slow, 2015/10/06 09:01:00]

I think so, because valueChanged() is called from
DOMSettableTokenList::setValue() and the lifetimes of the two objects look
right.

+}
+
 bool isEnterKeyKeydownEvent(Event* event)
 {
     return event->type() == EventTypeNames::keydown && event->isKeyboardEvent() && toKeyboardEvent(event)->keyIdentifier() == "Enter";