1 files changed, 251 insertions, 152 deletions

diff --git a/Source/WebCore/html/HTMLLinkElement.cpp b/Source/WebCore/html/HTMLLinkElement.cpp
index 95cfcda4d..32c021f0a 100644
--- a/Source/WebCore/html/HTMLLinkElement.cpp
+++ b/Source/WebCore/html/HTMLLinkElement.cpp
@@ -2,7 +2,7 @@
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2001 Dirk Mueller (mueller@kde.org)
- * Copyright (C) 2003, 2006, 2007, 2008, 2009, 2010 Apple Inc. All rights reserved.
+ * Copyright (C) 2003-2017 Apple Inc. All rights reserved.
  * Copyright (C) 2009 Rob Buis (rwlbuis@gmail.com)
  * Copyright (C) 2011 Google Inc. All rights reserved.
  *
@@ -30,27 +30,32 @@
 #include "CachedResource.h"
 #include "CachedResourceLoader.h"
 #include "CachedResourceRequest.h"
+#include "ContentSecurityPolicy.h"
+#include "DOMTokenList.h"
 #include "Document.h"
-#include "DocumentStyleSheetCollection.h"
 #include "Event.h"
+#include "EventNames.h"
 #include "EventSender.h"
 #include "Frame.h"
 #include "FrameLoader.h"
 #include "FrameLoaderClient.h"
 #include "FrameTree.h"
 #include "FrameView.h"
+#include "HTMLAnchorElement.h"
 #include "HTMLNames.h"
 #include "HTMLParserIdioms.h"
 #include "MediaList.h"
 #include "MediaQueryEvaluator.h"
-#include "Page.h"
+#include "MouseEvent.h"
 #include "RenderStyle.h"
 #include "SecurityOrigin.h"
 #include "Settings.h"
 #include "StyleInheritedData.h"
 #include "StyleResolveForDocument.h"
+#include "StyleScope.h"
 #include "StyleSheetContents.h"
 #include <wtf/Ref.h>
+#include <wtf/SetForScope.h>
 #include <wtf/StdLibExtras.h>
 
 namespace WebCore {
@@ -59,28 +64,32 @@ using namespace HTMLNames;
 
 static LinkEventSender& linkLoadEventSender()
 {
-    DEFINE_STATIC_LOCAL(LinkEventSender, sharedLoadEventSender, (eventNames().loadEvent));
+    static NeverDestroyed<LinkEventSender> sharedLoadEventSender(eventNames().loadEvent);
     return sharedLoadEventSender;
 }
 
+static LinkEventSender& linkErrorEventSender()
+{
+    static NeverDestroyed<LinkEventSender> sharedErrorEventSender(eventNames().errorEvent);
+    return sharedErrorEventSender;
+}
+
 inline HTMLLinkElement::HTMLLinkElement(const QualifiedName& tagName, Document& document, bool createdByParser)
     : HTMLElement(tagName, document)
-    , m_linkLoader(this)
-    , m_sizes(DOMSettableTokenList::create())
+    , m_linkLoader(*this)
     , m_disabledState(Unset)
     , m_loading(false)
     , m_createdByParser(createdByParser)
-    , m_isInShadowTree(false)
     , m_firedLoad(false)
-    , m_loadedSheet(false)
+    , m_loadedResource(false)
     , m_pendingSheetType(Unknown)
 {
     ASSERT(hasTagName(linkTag));
 }
 
-PassRefPtr<HTMLLinkElement> HTMLLinkElement::create(const QualifiedName& tagName, Document& document, bool createdByParser)
+Ref<HTMLLinkElement> HTMLLinkElement::create(const QualifiedName& tagName, Document& document, bool createdByParser)
 {
-    return adoptRef(new HTMLLinkElement(tagName, document, createdByParser));
+    return adoptRef(*new HTMLLinkElement(tagName, document, createdByParser));
 }
 
 HTMLLinkElement::~HTMLLinkElement()
@@ -89,47 +98,55 @@ HTMLLinkElement::~HTMLLinkElement()
         m_sheet->clearOwnerNode();
 
     if (m_cachedSheet)
-        m_cachedSheet->removeClient(this);
+        m_cachedSheet->removeClient(*this);
 
-    if (inDocument())
-        document().styleSheetCollection().removeStyleSheetCandidateNode(*this);
+    if (m_styleScope)
+        m_styleScope->removeStyleSheetCandidateNode(*this);
 
-    linkLoadEventSender().cancelEvent(this);
+    linkLoadEventSender().cancelEvent(*this);
+    linkErrorEventSender().cancelEvent(*this);
 }
 
 void HTMLLinkElement::setDisabledState(bool disabled)
 {
     DisabledState oldDisabledState = m_disabledState;
     m_disabledState = disabled ? Disabled : EnabledViaScript;
-    if (oldDisabledState != m_disabledState) {
-        // If we change the disabled state while the sheet is still loading, then we have to
-        // perform three checks:
-        if (styleSheetIsLoading()) {
-            // Check #1: The sheet becomes disabled while loading.
-            if (m_disabledState == Disabled)
-                removePendingSheet();
-
-            // Check #2: An alternate sheet becomes enabled while it is still loading.
-            if (m_relAttribute.m_isAlternate && m_disabledState == EnabledViaScript)
-                addPendingSheet(ActiveSheet);
-
-            // Check #3: A main sheet becomes enabled while it was still loading and
-            // after it was disabled via script. It takes really terrible code to make this
-            // happen (a double toggle for no reason essentially). This happens on
-            // virtualplastic.net, which manages to do about 12 enable/disables on only 3
-            // sheets. :)
-            if (!m_relAttribute.m_isAlternate && m_disabledState == EnabledViaScript && oldDisabledState == Disabled)
-                addPendingSheet(ActiveSheet);
-
-            // If the sheet is already loading just bail.
-            return;
-        }
+    if (oldDisabledState == m_disabledState)
+        return;
+
+    ASSERT(isConnected() || !styleSheetIsLoading());
+    if (!isConnected())
+        return;
+
+    // If we change the disabled state while the sheet is still loading, then we have to
+    // perform three checks:
+    if (styleSheetIsLoading()) {
+        // Check #1: The sheet becomes disabled while loading.
+        if (m_disabledState == Disabled)
+            removePendingSheet();
+
+        // Check #2: An alternate sheet becomes enabled while it is still loading.
+        if (m_relAttribute.isAlternate && m_disabledState == EnabledViaScript)
+            addPendingSheet(ActiveSheet);
+
+        // Check #3: A main sheet becomes enabled while it was still loading and
+        // after it was disabled via script. It takes really terrible code to make this
+        // happen (a double toggle for no reason essentially). This happens on
+        // virtualplastic.net, which manages to do about 12 enable/disables on only 3
+        // sheets. :)
+        if (!m_relAttribute.isAlternate && m_disabledState == EnabledViaScript && oldDisabledState == Disabled)
+            addPendingSheet(ActiveSheet);
 
-        // Load the sheet, since it's never been loaded before.
-        if (!m_sheet && m_disabledState == EnabledViaScript)
-            process();
-        else
-            document().styleResolverChanged(DeferRecalcStyle); // Update the style selector.
+        // If the sheet is already loading just bail.
+        return;
+    }
+
+    // Load the sheet, since it's never been loaded before.
+    if (!m_sheet && m_disabledState == EnabledViaScript)
+        process();
+    else {
+        ASSERT(m_styleScope);
+        m_styleScope->didChangeActiveStyleSheetCandidates();
     }
 }
 
@@ -137,81 +154,115 @@ void HTMLLinkElement::parseAttribute(const QualifiedName& name, const AtomicStri
 {
     if (name == relAttr) {
         m_relAttribute = LinkRelAttribute(value);
+        if (m_relList)
+            m_relList->associatedAttributeValueChanged(value);
         process();
-    } else if (name == hrefAttr) {
+        return;
+    }
+    if (name == hrefAttr) {
+        bool wasLink = isLink();
+        setIsLink(!value.isNull() && !shouldProhibitLinks(this));
+        if (wasLink != isLink())
+            invalidateStyleForSubtree();
         process();
-    } else if (name == typeAttr) {
+        return;
+    }
+    if (name == typeAttr) {
         m_type = value;
         process();
-    } else if (name == sizesAttr) {
-        setSizes(value);
+        return;
+    }
+    if (name == sizesAttr) {
+        if (m_sizes)
+            m_sizes->associatedAttributeValueChanged(value);
         process();
-    } else if (name == mediaAttr) {
-        m_media = value.string().lower();
+        return;
+    }
+    if (name == mediaAttr) {
+        m_media = value.string().convertToASCIILowercase();
         process();
-    } else if (name == disabledAttr)
+        if (m_sheet && !isDisabled())
+            m_styleScope->didChangeActiveStyleSheetCandidates();
+        return;
+    }
+    if (name == disabledAttr) {
         setDisabledState(!value.isNull());
-    else if (name == onbeforeloadAttr)
-        setAttributeEventListener(eventNames().beforeloadEvent, name, value);
-    else {
-        if (name == titleAttr && m_sheet)
+        return;
+    }
+    if (name == titleAttr) {
+        if (m_sheet)
             m_sheet->setTitle(value);
-        HTMLElement::parseAttribute(name, value);
+        return;
     }
+    HTMLElement::parseAttribute(name, value);
 }
 
 bool HTMLLinkElement::shouldLoadLink()
 {
-    Ref<Document> originalDocument(document());
+    Ref<Document> originalDocument = document();
     if (!dispatchBeforeLoadEvent(getNonEmptyURLAttribute(hrefAttr)))
         return false;
     // A beforeload handler might have removed us from the document or changed the document.
-    if (!inDocument() || &document() != &originalDocument.get())
+    if (!isConnected() || &document() != originalDocument.ptr())
         return false;
     return true;
 }
 
+void HTMLLinkElement::setCrossOrigin(const AtomicString& value)
+{
+    setAttributeWithoutSynchronization(crossoriginAttr, value);
+}
+
+String HTMLLinkElement::crossOrigin() const
+{
+    return parseCORSSettingsAttribute(attributeWithoutSynchronization(crossoriginAttr));
+}
+
 void HTMLLinkElement::process()
 {
-    if (!inDocument() || m_isInShadowTree) {
+    if (!isConnected()) {
         ASSERT(!m_sheet);
         return;
     }
 
-    String type = m_type.lower();
+    // Prevent recursive loading of link.
+    if (m_isHandlingBeforeLoad)
+        return;
+
     URL url = getNonEmptyURLAttribute(hrefAttr);
 
-    if (!m_linkLoader.loadLink(m_relAttribute, type, m_sizes->toString(), url, &document()))
+    if (!m_linkLoader.loadLink(m_relAttribute, url, attributeWithoutSynchronization(asAttr), attributeWithoutSynchronization(crossoriginAttr), document()))
         return;
 
-    bool acceptIfTypeContainsTextCSS = document().page() && document().page()->settings().treatsAnyTextCSSLinkAsStylesheet();
+    bool treatAsStyleSheet = m_relAttribute.isStyleSheet
+        || (document().settings().treatsAnyTextCSSLinkAsStylesheet() && m_type.containsIgnoringASCIICase("text/css"));
 
-    if (m_disabledState != Disabled && (m_relAttribute.m_isStyleSheet || (acceptIfTypeContainsTextCSS && type.contains("text/css")))
-        && document().frame() && url.isValid()) {
-        
-        String charset = getAttribute(charsetAttr);
+    if (m_disabledState != Disabled && treatAsStyleSheet && document().frame() && url.isValid()) {
+        String charset = attributeWithoutSynchronization(charsetAttr);
         if (charset.isEmpty() && document().frame())
             charset = document().charset();
-        
+
         if (m_cachedSheet) {
             removePendingSheet();
-            m_cachedSheet->removeClient(this);
-            m_cachedSheet = 0;
+            m_cachedSheet->removeClient(*this);
+            m_cachedSheet = nullptr;
         }
 
+        {
+        SetForScope<bool> change(m_isHandlingBeforeLoad, true);
         if (!shouldLoadLink())
             return;
+        }
 
         m_loading = true;
 
         bool mediaQueryMatches = true;
         if (!m_media.isEmpty()) {
-            RefPtr<RenderStyle> documentStyle;
+            std::optional<RenderStyle> documentStyle;
             if (document().hasLivingRenderTree())
                 documentStyle = Style::resolveForDocument(document());
-            RefPtr<MediaQuerySet> media = MediaQuerySet::createAllowingDescriptionSyntax(m_media);
-            MediaQueryEvaluator evaluator(document().frame()->view()->mediaType(), document().frame(), documentStyle.get());
-            mediaQueryMatches = evaluator.eval(media.get());
+            auto media = MediaQuerySet::create(m_media);
+            mediaQueryMatches = MediaQueryEvaluator { document().frame()->view()->mediaType(), document(), documentStyle ? &*documentStyle : nullptr }.evaluate(media.get());
         }
 
         // Don't hold up render tree construction and script execution on stylesheets
@@ -220,13 +271,25 @@ void HTMLLinkElement::process()
         addPendingSheet(isActive ? ActiveSheet : InactiveSheet);
 
         // Load stylesheets that are not needed for the rendering immediately with low priority.
-        ResourceLoadPriority priority = isActive ? ResourceLoadPriorityUnresolved : ResourceLoadPriorityVeryLow;
-        CachedResourceRequest request(ResourceRequest(document().completeURL(url)), charset, priority);
-        request.setInitiator(this);
-        m_cachedSheet = document().cachedResourceLoader()->requestCSSStyleSheet(request);
-        
+        std::optional<ResourceLoadPriority> priority;
+        if (!isActive)
+            priority = ResourceLoadPriority::VeryLow;
+
+        ResourceLoaderOptions options = CachedResourceLoader::defaultCachedResourceOptions();
+        options.sameOriginDataURLFlag = SameOriginDataURLFlag::Set;
+        if (document().contentSecurityPolicy()->allowStyleWithNonce(attributeWithoutSynchronization(HTMLNames::nonceAttr)))
+            options.contentSecurityPolicyImposition = ContentSecurityPolicyImposition::SkipPolicyCheck;
+
+        CachedResourceRequest request(url, options, priority, WTFMove(charset));
+        request.setInitiator(*this);
+
+        request.setAsPotentiallyCrossOrigin(crossOrigin(), document());
+
+        ASSERT_WITH_SECURITY_IMPLICATION(!m_cachedSheet);
+        m_cachedSheet = document().cachedResourceLoader().requestCSSStyleSheet(WTFMove(request));
+
         if (m_cachedSheet)
-            m_cachedSheet->addClient(this);
+            m_cachedSheet->addClient(*this);
         else {
             // The request may have been denied if (for example) the stylesheet is local and the document is remote.
             m_loading = false;
@@ -235,7 +298,7 @@ void HTMLLinkElement::process()
     } else if (m_sheet) {
         // we no longer contain a stylesheet, e.g. perhaps rel or type was changed
         clearSheet();
-        document().styleResolverChanged(DeferRecalcStyle);
+        m_styleScope->didChangeActiveStyleSheetCandidates();
     }
 }
 
@@ -244,47 +307,46 @@ void HTMLLinkElement::clearSheet()
     ASSERT(m_sheet);
     ASSERT(m_sheet->ownerNode() == this);
     m_sheet->clearOwnerNode();
-    m_sheet = 0;
+    m_sheet = nullptr;
 }
 
 Node::InsertionNotificationRequest HTMLLinkElement::insertedInto(ContainerNode& insertionPoint)
 {
+    bool wasInDocument = isConnected();
     HTMLElement::insertedInto(insertionPoint);
-    if (!insertionPoint.inDocument())
+    if (!insertionPoint.isConnected() || wasInDocument)
         return InsertionDone;
 
-    m_isInShadowTree = isInShadowTree();
-    if (m_isInShadowTree)
-        return InsertionDone;
+    m_styleScope = &Style::Scope::forNode(*this);
+    m_styleScope->addStyleSheetCandidateNode(*this, m_createdByParser);
 
-    document().styleSheetCollection().addStyleSheetCandidateNode(*this, m_createdByParser);
+    return InsertionShouldCallFinishedInsertingSubtree;
+}
 
+void HTMLLinkElement::finishedInsertingSubtree()
+{
     process();
-    return InsertionDone;
 }
 
 void HTMLLinkElement::removedFrom(ContainerNode& insertionPoint)
 {
     HTMLElement::removedFrom(insertionPoint);
-    if (!insertionPoint.inDocument())
+    if (!insertionPoint.isConnected() || isConnected())
         return;
 
-    m_linkLoader.released();
-
-    if (m_isInShadowTree) {
-        ASSERT(!m_sheet);
-        return;
-    }
-    document().styleSheetCollection().removeStyleSheetCandidateNode(*this);
+    m_linkLoader.cancelLoad();
 
     if (m_sheet)
         clearSheet();
 
     if (styleSheetIsLoading())
-        removePendingSheet(RemovePendingSheetNotifyLater);
+        removePendingSheet();
+    
+    if (m_styleScope) {
+        m_styleScope->removeStyleSheetCandidateNode(*this);
+        m_styleScope = nullptr;
+    }
 
-    if (document().hasLivingRenderTree())
-        document().styleResolverChanged(DeferRecalcStyleIfNeeded);
 }
 
 void HTMLLinkElement::finishParsingChildren()
@@ -293,24 +355,38 @@ void HTMLLinkElement::finishParsingChildren()
     HTMLElement::finishParsingChildren();
 }
 
+void HTMLLinkElement::initializeStyleSheet(Ref<StyleSheetContents>&& styleSheet, const CachedCSSStyleSheet& cachedStyleSheet)
+{
+    // FIXME: originClean should be turned to false except if fetch mode is CORS.
+    std::optional<bool> originClean;
+    if (cachedStyleSheet.options().mode == FetchOptions::Mode::Cors)
+        originClean = cachedStyleSheet.isCORSSameOrigin();
+
+    m_sheet = CSSStyleSheet::create(WTFMove(styleSheet), *this, originClean);
+    m_sheet->setMediaQueries(MediaQuerySet::create(m_media));
+    m_sheet->setTitle(title());
+}
+
 void HTMLLinkElement::setCSSStyleSheet(const String& href, const URL& baseURL, const String& charset, const CachedCSSStyleSheet* cachedStyleSheet)
 {
-    if (!inDocument()) {
+    if (!isConnected()) {
         ASSERT(!m_sheet);
         return;
     }
+    auto* frame = document().frame();
+    if (!frame)
+        return;
+
     // Completing the sheet load may cause scripts to execute.
-    Ref<HTMLLinkElement> protect(*this);
+    Ref<HTMLLinkElement> protectedThis(*this);
 
     CSSParserContext parserContext(document(), baseURL, charset);
+    auto cachePolicy = frame->loader().subresourceCachePolicy();
 
-    if (RefPtr<StyleSheetContents> restoredSheet = const_cast<CachedCSSStyleSheet*>(cachedStyleSheet)->restoreParsedStyleSheet(parserContext)) {
+    if (auto restoredSheet = const_cast<CachedCSSStyleSheet*>(cachedStyleSheet)->restoreParsedStyleSheet(parserContext, cachePolicy)) {
         ASSERT(restoredSheet->isCacheable());
         ASSERT(!restoredSheet->isLoading());
-
-        m_sheet = CSSStyleSheet::create(restoredSheet.releaseNonNull(), this);
-        m_sheet->setMediaQueries(MediaQuerySet::createAllowingDescriptionSyntax(m_media));
-        m_sheet->setTitle(title());
+        initializeStyleSheet(restoredSheet.releaseNonNull(), *cachedStyleSheet);
 
         m_loading = false;
         sheetLoaded();
@@ -318,19 +394,17 @@ void HTMLLinkElement::setCSSStyleSheet(const String& href, const URL& baseURL, c
         return;
     }
 
-    Ref<StyleSheetContents> styleSheet(StyleSheetContents::create(href, parserContext));
-    m_sheet = CSSStyleSheet::create(styleSheet.get(), this);
-    m_sheet->setMediaQueries(MediaQuerySet::createAllowingDescriptionSyntax(m_media));
-    m_sheet->setTitle(title());
+    auto styleSheet = StyleSheetContents::create(href, parserContext);
+    initializeStyleSheet(styleSheet.copyRef(), *cachedStyleSheet);
 
-    styleSheet.get().parseAuthorStyleSheet(cachedStyleSheet, document().securityOrigin());
+    styleSheet.get().parseAuthorStyleSheet(cachedStyleSheet, &document().securityOrigin());
 
     m_loading = false;
     styleSheet.get().notifyLoadedSheet(cachedStyleSheet);
     styleSheet.get().checkLoaded();
 
     if (styleSheet.get().isCacheable())
-        const_cast<CachedCSSStyleSheet*>(cachedStyleSheet)->saveParsedStyleSheet(styleSheet.get());
+        const_cast<CachedCSSStyleSheet*>(cachedStyleSheet)->saveParsedStyleSheet(WTFMove(styleSheet));
 }
 
 bool HTMLLinkElement::styleSheetIsLoading() const
@@ -342,14 +416,22 @@ bool HTMLLinkElement::styleSheetIsLoading() const
     return m_sheet->contents().isLoading();
 }
 
+DOMTokenList& HTMLLinkElement::sizes()
+{
+    if (!m_sizes)
+        m_sizes = std::make_unique<DOMTokenList>(*this, sizesAttr);
+    return *m_sizes;
+}
+
 void HTMLLinkElement::linkLoaded()
 {
-    dispatchEvent(Event::create(eventNames().loadEvent, false, false));
+    m_loadedResource = true;
+    linkLoadEventSender().dispatchEventSoon(*this);
 }
 
 void HTMLLinkElement::linkLoadingErrored()
 {
-    dispatchEvent(Event::create(eventNames().errorEvent, false, false));
+    linkErrorEventSender().dispatchEventSoon(*this);
 }
 
 bool HTMLLinkElement::sheetLoaded()
@@ -368,19 +450,28 @@ void HTMLLinkElement::dispatchPendingLoadEvents()
 
 void HTMLLinkElement::dispatchPendingEvent(LinkEventSender* eventSender)
 {
-    ASSERT_UNUSED(eventSender, eventSender == &linkLoadEventSender());
-    if (m_loadedSheet)
-        linkLoaded();
+    ASSERT_UNUSED(eventSender, eventSender == &linkLoadEventSender() || eventSender == &linkErrorEventSender());
+    if (m_loadedResource)
+        dispatchEvent(Event::create(eventNames().loadEvent, false, false));
     else
-        linkLoadingErrored();
+        dispatchEvent(Event::create(eventNames().errorEvent, false, false));
+}
+
+DOMTokenList& HTMLLinkElement::relList()
+{
+    if (!m_relList) 
+        m_relList = std::make_unique<DOMTokenList>(*this, HTMLNames::relAttr, [](StringView token) {
+            return LinkRelAttribute::isSupported(token);
+        });
+    return *m_relList;
 }
 
 void HTMLLinkElement::notifyLoadedSheetAndAllCriticalSubresources(bool errorOccurred)
 {
     if (m_firedLoad)
         return;
-    m_loadedSheet = !errorOccurred;
-    linkLoadEventSender().dispatchEventSoon(this);
+    m_loadedResource = !errorOccurred;
+    linkLoadEventSender().dispatchEventSoon(*this);
     m_firedLoad = true;
 }
 
@@ -396,34 +487,50 @@ bool HTMLLinkElement::isURLAttribute(const Attribute& attribute) const
     return attribute.name().localName() == hrefAttr || HTMLElement::isURLAttribute(attribute);
 }
 
-URL HTMLLinkElement::href() const
+void HTMLLinkElement::defaultEventHandler(Event& event)
 {
-    return document().completeURL(getAttribute(hrefAttr));
+    if (MouseEvent::canTriggerActivationBehavior(event)) {
+        handleClick(event);
+        return;
+    }
+    HTMLElement::defaultEventHandler(event);
 }
 
-String HTMLLinkElement::rel() const
+void HTMLLinkElement::handleClick(Event& event)
 {
-    return getAttribute(relAttr);
+    event.setDefaultHandled();
+    URL url = href();
+    if (url.isNull())
+        return;
+    Frame* frame = document().frame();
+    if (!frame)
+        return;
+    frame->loader().urlSelected(url, target(), &event, LockHistory::No, LockBackForwardList::No, MaybeSendReferrer, document().shouldOpenExternalURLsPolicyToPropagate());
 }
 
-String HTMLLinkElement::target() const
+URL HTMLLinkElement::href() const
+{
+    return document().completeURL(attributeWithoutSynchronization(hrefAttr));
+}
+
+const AtomicString& HTMLLinkElement::rel() const
 {
-    return getAttribute(targetAttr);
+    return attributeWithoutSynchronization(relAttr);
 }
 
-String HTMLLinkElement::type() const
+String HTMLLinkElement::target() const
 {
-    return getAttribute(typeAttr);
+    return attributeWithoutSynchronization(targetAttr);
 }
 
-IconType HTMLLinkElement::iconType() const
+const AtomicString& HTMLLinkElement::type() const
 {
-    return m_relAttribute.m_iconType;
+    return attributeWithoutSynchronization(typeAttr);
 }
 
-String HTMLLinkElement::iconSizes() const
+std::optional<LinkIconType> HTMLLinkElement::iconType() const
 {
-    return m_sizes->toString();
+    return m_relAttribute.iconType;
 }
 
 void HTMLLinkElement::addSubresourceAttributeURLs(ListHashSet<URL>& urls) const
@@ -431,18 +538,21 @@ void HTMLLinkElement::addSubresourceAttributeURLs(ListHashSet<URL>& urls) const
     HTMLElement::addSubresourceAttributeURLs(urls);
 
     // Favicons are handled by a special case in LegacyWebArchive::create()
-    if (m_relAttribute.m_iconType != InvalidIcon)
+    if (m_relAttribute.iconType)
         return;
 
-    if (!m_relAttribute.m_isStyleSheet)
+    if (!m_relAttribute.isStyleSheet)
         return;
     
     // Append the URL of this link element.
     addSubresourceURL(urls, href());
-    
-    // Walk the URLs linked by the linked-to stylesheet.
-    if (CSSStyleSheet* styleSheet = const_cast<HTMLLinkElement*>(this)->sheet())
-        styleSheet->contents().addSubresourceStyleURLs(urls);
+
+    if (auto* styleSheet = this->sheet()) {
+        styleSheet->contents().traverseSubresources([&] (auto& resource) {
+            urls.add(resource.url());
+            return false;
+        });
+    }
 }
 
 void HTMLLinkElement::addPendingSheet(PendingSheetType type)
@@ -453,10 +563,11 @@ void HTMLLinkElement::addPendingSheet(PendingSheetType type)
 
     if (m_pendingSheetType == InactiveSheet)
         return;
-    document().styleSheetCollection().addPendingSheet();
+    ASSERT(m_styleScope);
+    m_styleScope->addPendingSheet();
 }
 
-void HTMLLinkElement::removePendingSheet(RemovePendingSheetNotificationType notification)
+void HTMLLinkElement::removePendingSheet()
 {
     PendingSheetType type = m_pendingSheetType;
     m_pendingSheetType = Unknown;
@@ -464,26 +575,14 @@ void HTMLLinkElement::removePendingSheet(RemovePendingSheetNotificationType noti
     if (type == Unknown)
         return;
 
+    ASSERT(m_styleScope);
     if (type == InactiveSheet) {
         // Document just needs to know about the sheet for exposure through document.styleSheets
-        document().styleSheetCollection().updateActiveStyleSheets(DocumentStyleSheetCollection::OptimizedUpdate);
+        m_styleScope->didChangeActiveStyleSheetCandidates();
         return;
     }
 
-    document().styleSheetCollection().removePendingSheet(
-        notification == RemovePendingSheetNotifyImmediately
-        ? DocumentStyleSheetCollection::RemovePendingSheetNotifyImmediately
-        : DocumentStyleSheetCollection::RemovePendingSheetNotifyLater);
-}
-
-DOMSettableTokenList* HTMLLinkElement::sizes() const
-{
-    return m_sizes.get();
-}
-
-void HTMLLinkElement::setSizes(const String& value)
-{
-    m_sizes->setValue(value);
+    m_styleScope->removePendingSheet();
 }
 
 } // namespace WebCore