Expose attributionsrc support on <area> through IDL

This was already unintentionally supported due to the handling of the
attributionsrc attribute on HTMLAnchorBaseElement, and is reasonable to
support anyway, as <area> is a first-class navigation surface, just like
the already supported <a> and window.open.

WICG/attribution-reporting-api#1465

I2S: https://groups.google.com/a/chromium.org/d/msgid/blink-dev/673f72a6.2b0a0220.3bb1d2.02f2.GAE%40google.com

Bug: 369219144, 379275911
Change-Id: I7230229de087c752af7a5be2f7663fff999d66e0
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/6022268
Reviewed-by: Nate Chapin <japhet@chromium.org>
Reviewed-by: Domenic Denicola <domenic@chromium.org>
Commit-Queue: Andrew Paseltiner <apaseltiner@chromium.org>
Reviewed-by: John Delaney <johnidel@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1392912}

attribution-reporting/request-format.sub.https.html

@@ -2,6 +2,7 @@
 <meta charset=utf-8>
 <meta name=timeout content=long>
 <meta name=variant content="?method=a&expected-eligible=navigation-source">
+<meta name=variant content="?method=area&expected-eligible=navigation-source">
 <meta name=variant content="?method=img&expected-eligible=event-source, trigger">
 <meta name=variant content="?method=img&eligible&expected-eligible=event-source, trigger">
 <meta name=variant content="?method=open&expected-eligible=navigation-source">

attribution-reporting/resources/helpers.js

@@ -63,6 +63,23 @@ const resetRegisteredSources = () => {
   return fetch(`${blankURL()}?clear-stash=true`);
 }
 
+function prepareAnchorOrArea(tag, referrerPolicy, eligible, url) {
+  const el = document.createElement(tag);
+  el.referrerPolicy = referrerPolicy;
+  el.target = '_blank';
+  el.textContent = 'link';
+  if (eligible === null) {
+    el.attributionSrc = url;
+    el.href = blankURL();
+  } else {
+    el.attributionSrc = '';
+    el.href = url;
+  }
+  return el;
+}
+
+let nextMapId = 0;
+
 /**
  * Method to clear the stash. Takes the URL as parameter. This could be for
  * event-level or aggregatable reports.
@@ -193,7 +210,7 @@ const registerAttributionSrc = ({
       .forEach(([key, value]) => url.searchParams.set(key, value));
 
   switch (method) {
-    case 'img':
+    case 'img': {
       const img = document.createElement('img');
       img.referrerPolicy = referrerPolicy;
       if (eligible === null) {
@@ -203,6 +220,7 @@ const registerAttributionSrc = ({
         img.src = url;
       }
       return 'event';
+    }
     case 'script':
       const script = document.createElement('script');
       script.referrerPolicy = referrerPolicy;
@@ -215,20 +233,26 @@ const registerAttributionSrc = ({
       }
       return 'event';
     case 'a':
-      const a = document.createElement('a');
-      a.referrerPolicy = referrerPolicy;
-      a.target = '_blank';
-      a.textContent = 'link';
-      if (eligible === null) {
-        a.attributionSrc = url;
-        a.href = blankURL();
-      } else {
-        a.attributionSrc = '';
-        a.href = url;
-      }
+      const a = prepareAnchorOrArea('a', referrerPolicy, eligible, url);
       document.body.appendChild(a);
       test_driver.click(a);
       return 'navigation';
+    case 'area': {
+      const area = prepareAnchorOrArea('area', referrerPolicy, eligible, url);
+      const size = 100;
+      area.coords = `0,0,${size},${size}`;
+      area.shape = 'rect';
+      const map = document.createElement('map');
+      map.name = `map-${nextMapId++}`;
+      map.append(area);
+      const img = document.createElement('img');
+      img.width = size;
+      img.height = size;
+      img.useMap = `#${map.name}`;
+      document.body.append(map, img);
+      test_driver.click(area);
+      return 'navigation';
+    }
     case 'open':
       test_driver.bless('open window', () => {
         const feature = referrerPolicy === 'no-referrer' ? 'noreferrer' : '';