image/imgLoader.cpp

   1 /* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
   2 /* vim: set ts=8 sts=2 et sw=2 tw=80: */
   3 /* This Source Code Form is subject to the terms of the Mozilla Public
   4  * License, v. 2.0. If a copy of the MPL was not distributed with this
   5  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
   6
   7 // Undefine windows version of LoadImage because our code uses that name.
   8 #include "mozilla/ScopeExit.h"
   9 #include "nsIChildChannel.h"
  10 #include "nsIThreadRetargetableStreamListener.h"
  11 #undef LoadImage
  12
  13 #include "imgLoader.h"
  14
  15 #include <algorithm>
  16 #include <utility>
  17
  18 #include "DecoderFactory.h"
  19 #include "Image.h"
  20 #include "ImageLogging.h"
  21 #include "ReferrerInfo.h"
  22 #include "imgRequestProxy.h"
  23 #include "mozilla/Attributes.h"
  24 #include "mozilla/BasePrincipal.h"
  25 #include "mozilla/ChaosMode.h"
  26 #include "mozilla/ClearOnShutdown.h"
  27 #include "mozilla/LoadInfo.h"
  28 #include "mozilla/NullPrincipal.h"
  29 #include "mozilla/Preferences.h"
  30 #include "mozilla/ProfilerLabels.h"
  31 #include "mozilla/StaticPrefs_image.h"
  32 #include "mozilla/StaticPrefs_network.h"
  33 #include "mozilla/StoragePrincipalHelper.h"
  34 #include "mozilla/dom/ContentParent.h"
  35 #include "mozilla/dom/FetchPriority.h"
  36 #include "mozilla/dom/nsMixedContentBlocker.h"
  37 #include "mozilla/image/ImageMemoryReporter.h"
  38 #include "mozilla/layers/CompositorManagerChild.h"
  39 #include "nsCOMPtr.h"
  40 #include "nsCRT.h"
  41 #include "nsComponentManagerUtils.h"
  42 #include "nsContentPolicyUtils.h"
  43 #include "nsContentSecurityManager.h"
  44 #include "nsContentUtils.h"
  45 #include "nsHttpChannel.h"
  46 #include "nsIAsyncVerifyRedirectCallback.h"
  47 #include "nsICacheInfoChannel.h"
  48 #include "nsIChannelEventSink.h"
  49 #include "nsIClassOfService.h"
  50 #include "nsIEffectiveTLDService.h"
  51 #include "nsIFile.h"
  52 #include "nsIFileURL.h"
  53 #include "nsIHttpChannel.h"
  54 #include "nsIInterfaceRequestor.h"
  55 #include "nsIInterfaceRequestorUtils.h"
  56 #include "nsIMemoryReporter.h"
  57 #include "nsINetworkPredictor.h"
  58 #include "nsIProgressEventSink.h"
  59 #include "nsIProtocolHandler.h"
  60 #include "nsImageModule.h"
  61 #include "nsMediaSniffer.h"
  62 #include "nsMimeTypes.h"
  63 #include "nsNetCID.h"
  64 #include "nsNetUtil.h"
  65 #include "nsProxyRelease.h"
  66 #include "nsQueryObject.h"
  67 #include "nsReadableUtils.h"
  68 #include "nsStreamUtils.h"
  69 #include "prtime.h"
  70
  71 // we want to explore making the document own the load group
  72 // so we can associate the document URI with the load group.
  73 // until this point, we have an evil hack:
  74 #include "nsIHttpChannelInternal.h"
  75 #include "nsILoadGroupChild.h"
  76 #include "nsIDocShell.h"
  77
  78 using namespace mozilla;
  79 using namespace mozilla::dom;
  80 using namespace mozilla::image;
  81 using namespace mozilla::net;
  82
  83 MOZ_DEFINE_MALLOC_SIZE_OF(ImagesMallocSizeOf)
  84
  85 class imgMemoryReporter final : public nsIMemoryReporter {
  86   ~imgMemoryReporter() = default;
  87
  88  public:
  89   NS_DECL_ISUPPORTS
  90
  91   NS_IMETHOD CollectReports(nsIHandleReportCallback* aHandleReport,
  92                             nsISupports* aData, bool aAnonymize) override {
  93     MOZ_ASSERT(NS_IsMainThread());
  94
  95     layers::CompositorManagerChild* manager =
  96         mozilla::layers::CompositorManagerChild::GetInstance();
  97     if (!manager || !StaticPrefs::image_mem_debug_reporting()) {
  98       layers::SharedSurfacesMemoryReport sharedSurfaces;
  99       FinishCollectReports(aHandleReport, aData, aAnonymize, sharedSurfaces);
 100       return NS_OK;
 101     }
 102
 103     RefPtr<imgMemoryReporter> self(this);
 104     nsCOMPtr<nsIHandleReportCallback> handleReport(aHandleReport);
 105     nsCOMPtr<nsISupports> data(aData);
 106     manager->SendReportSharedSurfacesMemory(
 107         [=](layers::SharedSurfacesMemoryReport aReport) {
 108           self->FinishCollectReports(handleReport, data, aAnonymize, aReport);
 109         },
 110         [=](mozilla::ipc::ResponseRejectReason&& aReason) {
 111           layers::SharedSurfacesMemoryReport sharedSurfaces;
 112           self->FinishCollectReports(handleReport, data, aAnonymize,
 113                                      sharedSurfaces);
 114         });
 115     return NS_OK;
 116   }
 117
 118   void FinishCollectReports(
 119       nsIHandleReportCallback* aHandleReport, nsISupports* aData,
 120       bool aAnonymize, layers::SharedSurfacesMemoryReport& aSharedSurfaces) {
 121     nsTArray<ImageMemoryCounter> chrome;
 122     nsTArray<ImageMemoryCounter> content;
 123     nsTArray<ImageMemoryCounter> uncached;
 124
 125     for (uint32_t i = 0; i < mKnownLoaders.Length(); i++) {
 126       for (imgCacheEntry* entry : mKnownLoaders[i]->mCache.Values()) {
 127         RefPtr<imgRequest> req = entry->GetRequest();
 128         RecordCounterForRequest(req, &content, !entry->HasNoProxies());
 129       }
 130       MutexAutoLock lock(mKnownLoaders[i]->mUncachedImagesMutex);
 131       for (RefPtr<imgRequest> req : mKnownLoaders[i]->mUncachedImages) {
 132         RecordCounterForRequest(req, &uncached, req->HasConsumers());
 133       }
 134     }
 135
 136     // Note that we only need to anonymize content image URIs.
 137
 138     ReportCounterArray(aHandleReport, aData, chrome, "images/chrome",
 139                        /* aAnonymize */ false, aSharedSurfaces);
 140
 141     ReportCounterArray(aHandleReport, aData, content, "images/content",
 142                        aAnonymize, aSharedSurfaces);
 143
 144     // Uncached images may be content or chrome, so anonymize them.
 145     ReportCounterArray(aHandleReport, aData, uncached, "images/uncached",
 146                        aAnonymize, aSharedSurfaces);
 147
 148     // Report any shared surfaces that were not merged with the surface cache.
 149     ImageMemoryReporter::ReportSharedSurfaces(aHandleReport, aData,
 150                                               aSharedSurfaces);
 151
 152     nsCOMPtr<nsIMemoryReporterManager> imgr =
 153         do_GetService("@mozilla.org/memory-reporter-manager;1");
 154     if (imgr) {
 155       imgr->EndReport();
 156     }
 157   }
 158
 159   static int64_t ImagesContentUsedUncompressedDistinguishedAmount() {
 160     size_t n = 0;
 161     for (uint32_t i = 0; i < imgLoader::sMemReporter->mKnownLoaders.Length();
 162          i++) {
 163       for (imgCacheEntry* entry :
 164            imgLoader::sMemReporter->mKnownLoaders[i]->mCache.Values()) {
 165         if (entry->HasNoProxies()) {
 166           continue;
 167         }
 168
 169         RefPtr<imgRequest> req = entry->GetRequest();
 170         RefPtr<image::Image> image = req->GetImage();
 171         if (!image) {
 172           continue;
 173         }
 174
 175         // Both this and EntryImageSizes measure
 176         // images/content/raster/used/decoded memory.  This function's
 177         // measurement is secondary -- the result doesn't go in the "explicit"
 178         // tree -- so we use moz_malloc_size_of instead of ImagesMallocSizeOf to
 179         // prevent DMD from seeing it reported twice.
 180         SizeOfState state(moz_malloc_size_of);
 181         ImageMemoryCounter counter(req, image, state, /* aIsUsed = */ true);
 182
 183         n += counter.Values().DecodedHeap();
 184         n += counter.Values().DecodedNonHeap();
 185         n += counter.Values().DecodedUnknown();
 186       }
 187     }
 188     return n;
 189   }
 190
 191   void RegisterLoader(imgLoader* aLoader) {
 192     mKnownLoaders.AppendElement(aLoader);
 193   }
 194
 195   void UnregisterLoader(imgLoader* aLoader) {
 196     mKnownLoaders.RemoveElement(aLoader);
 197   }
 198
 199  private:
 200   nsTArray<imgLoader*> mKnownLoaders;
 201
 202   struct MemoryTotal {
 203     MemoryTotal& operator+=(const ImageMemoryCounter& aImageCounter) {
 204       if (aImageCounter.Type() == imgIContainer::TYPE_RASTER) {
 205         if (aImageCounter.IsUsed()) {
 206           mUsedRasterCounter += aImageCounter.Values();
 207         } else {
 208           mUnusedRasterCounter += aImageCounter.Values();
 209         }
 210       } else if (aImageCounter.Type() == imgIContainer::TYPE_VECTOR) {
 211         if (aImageCounter.IsUsed()) {
 212           mUsedVectorCounter += aImageCounter.Values();
 213         } else {
 214           mUnusedVectorCounter += aImageCounter.Values();
 215         }
 216       } else if (aImageCounter.Type() == imgIContainer::TYPE_REQUEST) {
 217         // Nothing to do, we did not get to the point of having an image.
 218       } else {
 219         MOZ_CRASH("Unexpected image type");
 220       }
 221
 222       return *this;
 223     }
 224
 225     const MemoryCounter& UsedRaster() const { return mUsedRasterCounter; }
 226     const MemoryCounter& UnusedRaster() const { return mUnusedRasterCounter; }
 227     const MemoryCounter& UsedVector() const { return mUsedVectorCounter; }
 228     const MemoryCounter& UnusedVector() const { return mUnusedVectorCounter; }
 229
 230    private:
 231     MemoryCounter mUsedRasterCounter;
 232     MemoryCounter mUnusedRasterCounter;
 233     MemoryCounter mUsedVectorCounter;
 234     MemoryCounter mUnusedVectorCounter;
 235   };
 236
 237   // Reports all images of a single kind, e.g. all used chrome images.
 238   void ReportCounterArray(nsIHandleReportCallback* aHandleReport,
 239                           nsISupports* aData,
 240                           nsTArray<ImageMemoryCounter>& aCounterArray,
 241                           const char* aPathPrefix, bool aAnonymize,
 242                           layers::SharedSurfacesMemoryReport& aSharedSurfaces) {
 243     MemoryTotal summaryTotal;
 244     MemoryTotal nonNotableTotal;
 245
 246     // Report notable images, and compute total and non-notable aggregate sizes.
 247     for (uint32_t i = 0; i < aCounterArray.Length(); i++) {
 248       ImageMemoryCounter& counter = aCounterArray[i];
 249
 250       if (aAnonymize) {
 251         counter.URI().Truncate();
 252         counter.URI().AppendPrintf("<anonymized-%u>", i);
 253       } else {
 254         // The URI could be an extremely long data: URI. Truncate if needed.
 255         static const size_t max = 256;
 256         if (counter.URI().Length() > max) {
 257           counter.URI().Truncate(max);
 258           counter.URI().AppendLiteral(" (truncated)");
 259         }
 260         counter.URI().ReplaceChar('/', '\\');
 261       }
 262
 263       summaryTotal += counter;
 264
 265       if (counter.IsNotable() || StaticPrefs::image_mem_debug_reporting()) {
 266         ReportImage(aHandleReport, aData, aPathPrefix, counter,
 267                     aSharedSurfaces);
 268       } else {
 269         ImageMemoryReporter::TrimSharedSurfaces(counter, aSharedSurfaces);
 270         nonNotableTotal += counter;
 271       }
 272     }
 273
 274     // Report non-notable images in aggregate.
 275     ReportTotal(aHandleReport, aData, /* aExplicit = */ true, aPathPrefix,
 276                 "<non-notable images>/", nonNotableTotal);
 277
 278     // Report a summary in aggregate, outside of the explicit tree.
 279     ReportTotal(aHandleReport, aData, /* aExplicit = */ false, aPathPrefix, "",
 280                 summaryTotal);
 281   }
 282
 283   static void ReportImage(nsIHandleReportCallback* aHandleReport,
 284                           nsISupports* aData, const char* aPathPrefix,
 285                           const ImageMemoryCounter& aCounter,
 286                           layers::SharedSurfacesMemoryReport& aSharedSurfaces) {
 287     nsAutoCString pathPrefix("explicit/"_ns);
 288     pathPrefix.Append(aPathPrefix);
 289
 290     switch (aCounter.Type()) {
 291       case imgIContainer::TYPE_RASTER:
 292         pathPrefix.AppendLiteral("/raster/");
 293         break;
 294       case imgIContainer::TYPE_VECTOR:
 295         pathPrefix.AppendLiteral("/vector/");
 296         break;
 297       case imgIContainer::TYPE_REQUEST:
 298         pathPrefix.AppendLiteral("/request/");
 299         break;
 300       default:
 301         pathPrefix.AppendLiteral("/unknown=");
 302         pathPrefix.AppendInt(aCounter.Type());
 303         pathPrefix.AppendLiteral("/");
 304         break;
 305     }
 306
 307     pathPrefix.Append(aCounter.IsUsed() ? "used/" : "unused/");
 308     if (aCounter.IsValidating()) {
 309       pathPrefix.AppendLiteral("validating/");
 310     }
 311     if (aCounter.HasError()) {
 312       pathPrefix.AppendLiteral("err/");
 313     }
 314
 315     pathPrefix.AppendLiteral("progress=");
 316     pathPrefix.AppendInt(aCounter.Progress(), 16);
 317     pathPrefix.AppendLiteral("/");
 318
 319     pathPrefix.AppendLiteral("image(");
 320     pathPrefix.AppendInt(aCounter.IntrinsicSize().width);
 321     pathPrefix.AppendLiteral("x");
 322     pathPrefix.AppendInt(aCounter.IntrinsicSize().height);
 323     pathPrefix.AppendLiteral(", ");
 324
 325     if (aCounter.URI().IsEmpty()) {
 326       pathPrefix.AppendLiteral("<unknown URI>");
 327     } else {
 328       pathPrefix.Append(aCounter.URI());
 329     }
 330
 331     pathPrefix.AppendLiteral(")/");
 332
 333     ReportSurfaces(aHandleReport, aData, pathPrefix, aCounter, aSharedSurfaces);
 334
 335     ReportSourceValue(aHandleReport, aData, pathPrefix, aCounter.Values());
 336   }
 337
 338   static void ReportSurfaces(
 339       nsIHandleReportCallback* aHandleReport, nsISupports* aData,
 340       const nsACString& aPathPrefix, const ImageMemoryCounter& aCounter,
 341       layers::SharedSurfacesMemoryReport& aSharedSurfaces) {
 342     for (const SurfaceMemoryCounter& counter : aCounter.Surfaces()) {
 343       nsAutoCString surfacePathPrefix(aPathPrefix);
 344       switch (counter.Type()) {
 345         case SurfaceMemoryCounterType::NORMAL:
 346           if (counter.IsLocked()) {
 347             surfacePathPrefix.AppendLiteral("locked/");
 348           } else {
 349             surfacePathPrefix.AppendLiteral("unlocked/");
 350           }
 351           if (counter.IsFactor2()) {
 352             surfacePathPrefix.AppendLiteral("factor2/");
 353           }
 354           if (counter.CannotSubstitute()) {
 355             surfacePathPrefix.AppendLiteral("cannot_substitute/");
 356           }
 357           break;
 358         case SurfaceMemoryCounterType::CONTAINER:
 359           surfacePathPrefix.AppendLiteral("container/");
 360           break;
 361         default:
 362           MOZ_ASSERT_UNREACHABLE("Unknown counter type");
 363           break;
 364       }
 365
 366       surfacePathPrefix.AppendLiteral("types=");
 367       surfacePathPrefix.AppendInt(counter.Values().SurfaceTypes(), 16);
 368       surfacePathPrefix.AppendLiteral("/surface(");
 369       surfacePathPrefix.AppendInt(counter.Key().Size().width);
 370       surfacePathPrefix.AppendLiteral("x");
 371       surfacePathPrefix.AppendInt(counter.Key().Size().height);
 372
 373       if (!counter.IsFinished()) {
 374         surfacePathPrefix.AppendLiteral(", incomplete");
 375       }
 376
 377       if (counter.Values().ExternalHandles() > 0) {
 378         surfacePathPrefix.AppendLiteral(", handles:");
 379         surfacePathPrefix.AppendInt(
 380             uint32_t(counter.Values().ExternalHandles()));
 381       }
 382
 383       ImageMemoryReporter::AppendSharedSurfacePrefix(surfacePathPrefix, counter,
 384                                                      aSharedSurfaces);
 385
 386       PlaybackType playback = counter.Key().Playback();
 387       if (playback == PlaybackType::eAnimated) {
 388         if (StaticPrefs::image_mem_debug_reporting()) {
 389           surfacePathPrefix.AppendPrintf(
 390               " (animation %4u)", uint32_t(counter.Values().FrameIndex()));
 391         } else {
 392           surfacePathPrefix.AppendLiteral(" (animation)");
 393         }
 394       }
 395
 396       if (counter.Key().Flags() != DefaultSurfaceFlags()) {
 397         surfacePathPrefix.AppendLiteral(", flags:");
 398         surfacePathPrefix.AppendInt(uint32_t(counter.Key().Flags()),
 399                                     /* aRadix = */ 16);
 400       }
 401
 402       if (counter.Key().Region()) {
 403         const ImageIntRegion& region = counter.Key().Region().ref();
 404         const gfx::IntRect& rect = region.Rect();
 405         surfacePathPrefix.AppendLiteral(", region:[ rect=(");
 406         surfacePathPrefix.AppendInt(rect.x);
 407         surfacePathPrefix.AppendLiteral(",");
 408         surfacePathPrefix.AppendInt(rect.y);
 409         surfacePathPrefix.AppendLiteral(") ");
 410         surfacePathPrefix.AppendInt(rect.width);
 411         surfacePathPrefix.AppendLiteral("x");
 412         surfacePathPrefix.AppendInt(rect.height);
 413         if (region.IsRestricted()) {
 414           const gfx::IntRect& restrict = region.Restriction();
 415           if (restrict == rect) {
 416             surfacePathPrefix.AppendLiteral(", restrict=rect");
 417           } else {
 418             surfacePathPrefix.AppendLiteral(", restrict=(");
 419             surfacePathPrefix.AppendInt(restrict.x);
 420             surfacePathPrefix.AppendLiteral(",");
 421             surfacePathPrefix.AppendInt(restrict.y);
 422             surfacePathPrefix.AppendLiteral(") ");
 423             surfacePathPrefix.AppendInt(restrict.width);
 424             surfacePathPrefix.AppendLiteral("x");
 425             surfacePathPrefix.AppendInt(restrict.height);
 426           }
 427         }
 428         if (region.GetExtendMode() != gfx::ExtendMode::CLAMP) {
 429           surfacePathPrefix.AppendLiteral(", extendMode=");
 430           surfacePathPrefix.AppendInt(int32_t(region.GetExtendMode()));
 431         }
 432         surfacePathPrefix.AppendLiteral("]");
 433       }
 434
 435       const SVGImageContext& context = counter.Key().SVGContext();
 436       surfacePathPrefix.AppendLiteral(", svgContext:[ ");
 437       if (context.GetViewportSize()) {
 438         const CSSIntSize& size = context.GetViewportSize().ref();
 439         surfacePathPrefix.AppendLiteral("viewport=(");
 440         surfacePathPrefix.AppendInt(size.width);
 441         surfacePathPrefix.AppendLiteral("x");
 442         surfacePathPrefix.AppendInt(size.height);
 443         surfacePathPrefix.AppendLiteral(") ");
 444       }
 445       if (context.GetPreserveAspectRatio()) {
 446         nsAutoString aspect;
 447         context.GetPreserveAspectRatio()->ToString(aspect);
 448         surfacePathPrefix.AppendLiteral("preserveAspectRatio=(");
 449         LossyAppendUTF16toASCII(aspect, surfacePathPrefix);
 450         surfacePathPrefix.AppendLiteral(") ");
 451       }
 452       if (auto scheme = context.GetColorScheme()) {
 453         surfacePathPrefix.AppendLiteral("colorScheme=");
 454         surfacePathPrefix.AppendInt(int32_t(*scheme));
 455         surfacePathPrefix.AppendLiteral(" ");
 456       }
 457       if (context.GetContextPaint()) {
 458         const SVGEmbeddingContextPaint* paint = context.GetContextPaint();
 459         surfacePathPrefix.AppendLiteral("contextPaint=(");
 460         if (paint->GetFill()) {
 461           surfacePathPrefix.AppendLiteral(" fill=");
 462           surfacePathPrefix.AppendInt(paint->GetFill()->ToABGR(), 16);
 463         }
 464         if (paint->GetFillOpacity() != 1.0) {
 465           surfacePathPrefix.AppendLiteral(" fillOpa=");
 466           surfacePathPrefix.AppendFloat(paint->GetFillOpacity());
 467         }
 468         if (paint->GetStroke()) {
 469           surfacePathPrefix.AppendLiteral(" stroke=");
 470           surfacePathPrefix.AppendInt(paint->GetStroke()->ToABGR(), 16);
 471         }
 472         if (paint->GetStrokeOpacity() != 1.0) {
 473           surfacePathPrefix.AppendLiteral(" strokeOpa=");
 474           surfacePathPrefix.AppendFloat(paint->GetStrokeOpacity());
 475         }
 476         surfacePathPrefix.AppendLiteral(" ) ");
 477       }
 478       surfacePathPrefix.AppendLiteral("]");
 479
 480       surfacePathPrefix.AppendLiteral(")/");
 481
 482       ReportValues(aHandleReport, aData, surfacePathPrefix, counter.Values());
 483     }
 484   }
 485
 486   static void ReportTotal(nsIHandleReportCallback* aHandleReport,
 487                           nsISupports* aData, bool aExplicit,
 488                           const char* aPathPrefix, const char* aPathInfix,
 489                           const MemoryTotal& aTotal) {
 490     nsAutoCString pathPrefix;
 491     if (aExplicit) {
 492       pathPrefix.AppendLiteral("explicit/");
 493     }
 494     pathPrefix.Append(aPathPrefix);
 495
 496     nsAutoCString rasterUsedPrefix(pathPrefix);
 497     rasterUsedPrefix.AppendLiteral("/raster/used/");
 498     rasterUsedPrefix.Append(aPathInfix);
 499     ReportValues(aHandleReport, aData, rasterUsedPrefix, aTotal.UsedRaster());
 500
 501     nsAutoCString rasterUnusedPrefix(pathPrefix);
 502     rasterUnusedPrefix.AppendLiteral("/raster/unused/");
 503     rasterUnusedPrefix.Append(aPathInfix);
 504     ReportValues(aHandleReport, aData, rasterUnusedPrefix,
 505                  aTotal.UnusedRaster());
 506
 507     nsAutoCString vectorUsedPrefix(pathPrefix);
 508     vectorUsedPrefix.AppendLiteral("/vector/used/");
 509     vectorUsedPrefix.Append(aPathInfix);
 510     ReportValues(aHandleReport, aData, vectorUsedPrefix, aTotal.UsedVector());
 511
 512     nsAutoCString vectorUnusedPrefix(pathPrefix);
 513     vectorUnusedPrefix.AppendLiteral("/vector/unused/");
 514     vectorUnusedPrefix.Append(aPathInfix);
 515     ReportValues(aHandleReport, aData, vectorUnusedPrefix,
 516                  aTotal.UnusedVector());
 517   }
 518
 519   static void ReportValues(nsIHandleReportCallback* aHandleReport,
 520                            nsISupports* aData, const nsACString& aPathPrefix,
 521                            const MemoryCounter& aCounter) {
 522     ReportSourceValue(aHandleReport, aData, aPathPrefix, aCounter);
 523
 524     ReportValue(aHandleReport, aData, KIND_HEAP, aPathPrefix, "decoded-heap",
 525                 "Decoded image data which is stored on the heap.",
 526                 aCounter.DecodedHeap());
 527
 528     ReportValue(aHandleReport, aData, KIND_NONHEAP, aPathPrefix,
 529                 "decoded-nonheap",
 530                 "Decoded image data which isn't stored on the heap.",
 531                 aCounter.DecodedNonHeap());
 532
 533     // We don't know for certain whether or not it is on the heap, so let's
 534     // just report it as non-heap for reporting purposes.
 535     ReportValue(aHandleReport, aData, KIND_NONHEAP, aPathPrefix,
 536                 "decoded-unknown",
 537                 "Decoded image data which is unknown to be on the heap or not.",
 538                 aCounter.DecodedUnknown());
 539   }
 540
 541   static void ReportSourceValue(nsIHandleReportCallback* aHandleReport,
 542                                 nsISupports* aData,
 543                                 const nsACString& aPathPrefix,
 544                                 const MemoryCounter& aCounter) {
 545     ReportValue(aHandleReport, aData, KIND_HEAP, aPathPrefix, "source",
 546                 "Raster image source data and vector image documents.",
 547                 aCounter.Source());
 548   }
 549
 550   static void ReportValue(nsIHandleReportCallback* aHandleReport,
 551                           nsISupports* aData, int32_t aKind,
 552                           const nsACString& aPathPrefix,
 553                           const char* aPathSuffix, const char* aDescription,
 554                           size_t aValue) {
 555     if (aValue == 0) {
 556       return;
 557     }
 558
 559     nsAutoCString desc(aDescription);
 560     nsAutoCString path(aPathPrefix);
 561     path.Append(aPathSuffix);
 562
 563     aHandleReport->Callback(""_ns, path, aKind, UNITS_BYTES, aValue, desc,
 564                             aData);
 565   }
 566
 567   static void RecordCounterForRequest(imgRequest* aRequest,
 568                                       nsTArray<ImageMemoryCounter>* aArray,
 569                                       bool aIsUsed) {
 570     SizeOfState state(ImagesMallocSizeOf);
 571     RefPtr<image::Image> image = aRequest->GetImage();
 572     if (image) {
 573       ImageMemoryCounter counter(aRequest, image, state, aIsUsed);
 574       aArray->AppendElement(std::move(counter));
 575     } else {
 576       // We can at least record some information about the image from the
 577       // request, and mark it as not knowing the image type yet.
 578       ImageMemoryCounter counter(aRequest, state, aIsUsed);
 579       aArray->AppendElement(std::move(counter));
 580     }
 581   }
 582 };
 583
 584 NS_IMPL_ISUPPORTS(imgMemoryReporter, nsIMemoryReporter)
 585
 586 NS_IMPL_ISUPPORTS(nsProgressNotificationProxy, nsIProgressEventSink,
 587                   nsIChannelEventSink, nsIInterfaceRequestor)
 588
 589 NS_IMETHODIMP
 590 nsProgressNotificationProxy::OnProgress(nsIRequest* request, int64_t progress,
 591                                         int64_t progressMax) {
 592   nsCOMPtr<nsILoadGroup> loadGroup;
 593   request->GetLoadGroup(getter_AddRefs(loadGroup));
 594
 595   nsCOMPtr<nsIProgressEventSink> target;
 596   NS_QueryNotificationCallbacks(mOriginalCallbacks, loadGroup,
 597                                 NS_GET_IID(nsIProgressEventSink),
 598                                 getter_AddRefs(target));
 599   if (!target) {
 600     return NS_OK;
 601   }
 602   return target->OnProgress(mImageRequest, progress, progressMax);
 603 }
 604
 605 NS_IMETHODIMP
 606 nsProgressNotificationProxy::OnStatus(nsIRequest* request, nsresult status,
 607                                       const char16_t* statusArg) {
 608   nsCOMPtr<nsILoadGroup> loadGroup;
 609   request->GetLoadGroup(getter_AddRefs(loadGroup));
 610
 611   nsCOMPtr<nsIProgressEventSink> target;
 612   NS_QueryNotificationCallbacks(mOriginalCallbacks, loadGroup,
 613                                 NS_GET_IID(nsIProgressEventSink),
 614                                 getter_AddRefs(target));
 615   if (!target) {
 616     return NS_OK;
 617   }
 618   return target->OnStatus(mImageRequest, status, statusArg);
 619 }
 620
 621 NS_IMETHODIMP
 622 nsProgressNotificationProxy::AsyncOnChannelRedirect(
 623     nsIChannel* oldChannel, nsIChannel* newChannel, uint32_t flags,
 624     nsIAsyncVerifyRedirectCallback* cb) {
 625   // Tell the original original callbacks about it too
 626   nsCOMPtr<nsILoadGroup> loadGroup;
 627   newChannel->GetLoadGroup(getter_AddRefs(loadGroup));
 628   nsCOMPtr<nsIChannelEventSink> target;
 629   NS_QueryNotificationCallbacks(mOriginalCallbacks, loadGroup,
 630                                 NS_GET_IID(nsIChannelEventSink),
 631                                 getter_AddRefs(target));
 632   if (!target) {
 633     cb->OnRedirectVerifyCallback(NS_OK);
 634     return NS_OK;
 635   }
 636
 637   // Delegate to |target| if set, reusing |cb|
 638   return target->AsyncOnChannelRedirect(oldChannel, newChannel, flags, cb);
 639 }
 640
 641 NS_IMETHODIMP
 642 nsProgressNotificationProxy::GetInterface(const nsIID& iid, void** result) {
 643   if (iid.Equals(NS_GET_IID(nsIProgressEventSink))) {
 644     *result = static_cast<nsIProgressEventSink*>(this);
 645     NS_ADDREF_THIS();
 646     return NS_OK;
 647   }
 648   if (iid.Equals(NS_GET_IID(nsIChannelEventSink))) {
 649     *result = static_cast<nsIChannelEventSink*>(this);
 650     NS_ADDREF_THIS();
 651     return NS_OK;
 652   }
 653   if (mOriginalCallbacks) {
 654     return mOriginalCallbacks->GetInterface(iid, result);
 655   }
 656   return NS_NOINTERFACE;
 657 }
 658
 659 static void NewRequestAndEntry(bool aForcePrincipalCheckForCacheEntry,
 660                                imgLoader* aLoader, const ImageCacheKey& aKey,
 661                                imgRequest** aRequest, imgCacheEntry** aEntry) {
 662   RefPtr<imgRequest> request = new imgRequest(aLoader, aKey);
 663   RefPtr<imgCacheEntry> entry =
 664       new imgCacheEntry(aLoader, request, aForcePrincipalCheckForCacheEntry);
 665   aLoader->AddToUncachedImages(request);
 666   request.forget(aRequest);
 667   entry.forget(aEntry);
 668 }
 669
 670 static bool ShouldRevalidateEntry(imgCacheEntry* aEntry, nsLoadFlags aFlags,
 671                                   bool aHasExpired) {
 672   if (aFlags & nsIRequest::LOAD_BYPASS_CACHE) {
 673     return false;
 674   }
 675   if (aFlags & nsIRequest::VALIDATE_ALWAYS) {
 676     return true;
 677   }
 678   if (aEntry->GetMustValidate()) {
 679     return true;
 680   }
 681   if (aHasExpired) {
 682     // The cache entry has expired...  Determine whether the stale cache
 683     // entry can be used without validation...
 684     if (aFlags & (nsIRequest::LOAD_FROM_CACHE | nsIRequest::VALIDATE_NEVER |
 685                   nsIRequest::VALIDATE_ONCE_PER_SESSION)) {
 686       // LOAD_FROM_CACHE, VALIDATE_NEVER and VALIDATE_ONCE_PER_SESSION allow
 687       // stale cache entries to be used unless they have been explicitly marked
 688       // to indicate that revalidation is necessary.
 689       return false;
 690     }
 691     // Entry is expired, revalidate.
 692     return true;
 693   }
 694   return false;
 695 }
 696
 697 /* Call content policies on cached images that went through a redirect */
 698 static bool ShouldLoadCachedImage(imgRequest* aImgRequest,
 699                                   Document* aLoadingDocument,
 700                                   nsIPrincipal* aTriggeringPrincipal,
 701                                   nsContentPolicyType aPolicyType,
 702                                   bool aSendCSPViolationReports) {
 703   /* Call content policies on cached images - Bug 1082837
 704    * Cached images are keyed off of the first uri in a redirect chain.
 705    * Hence content policies don't get a chance to test the intermediate hops
 706    * or the final destination.  Here we test the final destination using
 707    * mFinalURI off of the imgRequest and passing it into content policies.
 708    * For Mixed Content Blocker, we do an additional check to determine if any
 709    * of the intermediary hops went through an insecure redirect with the
 710    * mHadInsecureRedirect flag
 711    */
 712   bool insecureRedirect = aImgRequest->HadInsecureRedirect();
 713   nsCOMPtr<nsIURI> contentLocation;
 714   aImgRequest->GetFinalURI(getter_AddRefs(contentLocation));
 715   nsresult rv;
 716
 717   nsCOMPtr<nsIPrincipal> loadingPrincipal =
 718       aLoadingDocument ? aLoadingDocument->NodePrincipal()
 719                        : aTriggeringPrincipal;
 720   // If there is no context and also no triggeringPrincipal, then we use a fresh
 721   // nullPrincipal as the loadingPrincipal because we can not create a loadinfo
 722   // without a valid loadingPrincipal.
 723   if (!loadingPrincipal) {
 724     loadingPrincipal = NullPrincipal::CreateWithoutOriginAttributes();
 725   }
 726
 727   nsCOMPtr<nsILoadInfo> secCheckLoadInfo = new LoadInfo(
 728       loadingPrincipal, aTriggeringPrincipal, aLoadingDocument,
 729       nsILoadInfo::SEC_ONLY_FOR_EXPLICIT_CONTENTSEC_CHECK, aPolicyType);
 730
 731   secCheckLoadInfo->SetSendCSPViolationEvents(aSendCSPViolationReports);
 732
 733   int16_t decision = nsIContentPolicy::REJECT_REQUEST;
 734   rv = NS_CheckContentLoadPolicy(contentLocation, secCheckLoadInfo, &decision,
 735                                  nsContentUtils::GetContentPolicy());
 736   if (NS_FAILED(rv) || !NS_CP_ACCEPTED(decision)) {
 737     return false;
 738   }
 739
 740   // We call all Content Policies above, but we also have to call mcb
 741   // individually to check the intermediary redirect hops are secure.
 742   if (insecureRedirect) {
 743     // Bug 1314356: If the image ended up in the cache upgraded by HSTS and the
 744     // page uses upgrade-inscure-requests it had an insecure redirect
 745     // (http->https). We need to invalidate the image and reload it because
 746     // mixed content blocker only bails if upgrade-insecure-requests is set on
 747     // the doc and the resource load is http: which would result in an incorrect
 748     // mixed content warning.
 749     nsCOMPtr<nsIDocShell> docShell =
 750         NS_CP_GetDocShellFromContext(ToSupports(aLoadingDocument));
 751     if (docShell) {
 752       Document* document = docShell->GetDocument();
 753       if (document && document->GetUpgradeInsecureRequests(false)) {
 754         return false;
 755       }
 756     }
 757
 758     if (!aTriggeringPrincipal || !aTriggeringPrincipal->IsSystemPrincipal()) {
 759       // reset the decision for mixed content blocker check
 760       decision = nsIContentPolicy::REJECT_REQUEST;
 761       rv = nsMixedContentBlocker::ShouldLoad(insecureRedirect, contentLocation,
 762                                              secCheckLoadInfo,
 763                                              true,  // aReportError
 764                                              &decision);
 765       if (NS_FAILED(rv) || !NS_CP_ACCEPTED(decision)) {
 766         return false;
 767       }
 768     }
 769   }
 770
 771   return true;
 772 }
 773
 774 // Returns true if this request is compatible with the given CORS mode on the
 775 // given loading principal, and false if the request may not be reused due
 776 // to CORS.
 777 static bool ValidateCORSMode(imgRequest* aRequest, bool aForcePrincipalCheck,
 778                              CORSMode aCORSMode,
 779                              nsIPrincipal* aTriggeringPrincipal) {
 780   // If the entry's CORS mode doesn't match, or the CORS mode matches but the
 781   // document principal isn't the same, we can't use this request.
 782   if (aRequest->GetCORSMode() != aCORSMode) {
 783     return false;
 784   }
 785
 786   if (aRequest->GetCORSMode() != CORS_NONE || aForcePrincipalCheck) {
 787     nsCOMPtr<nsIPrincipal> otherprincipal = aRequest->GetTriggeringPrincipal();
 788
 789     // If we previously had a principal, but we don't now, we can't use this
 790     // request.
 791     if (otherprincipal && !aTriggeringPrincipal) {
 792       return false;
 793     }
 794
 795     if (otherprincipal && aTriggeringPrincipal &&
 796         !otherprincipal->Equals(aTriggeringPrincipal)) {
 797       return false;
 798     }
 799   }
 800
 801   return true;
 802 }
 803
 804 static bool ValidateSecurityInfo(imgRequest* aRequest,
 805                                  bool aForcePrincipalCheck, CORSMode aCORSMode,
 806                                  nsIPrincipal* aTriggeringPrincipal,
 807                                  Document* aLoadingDocument,
 808                                  nsContentPolicyType aPolicyType) {
 809   if (!ValidateCORSMode(aRequest, aForcePrincipalCheck, aCORSMode,
 810                         aTriggeringPrincipal)) {
 811     return false;
 812   }
 813   // Content Policy Check on Cached Images
 814   return ShouldLoadCachedImage(aRequest, aLoadingDocument, aTriggeringPrincipal,
 815                                aPolicyType,
 816                                /* aSendCSPViolationReports */ false);
 817 }
 818
 819 static void AdjustPriorityForImages(nsIChannel* aChannel,
 820                                     nsLoadFlags aLoadFlags,
 821                                     FetchPriority aFetchPriority) {
 822   // Image channels are loaded by default with reduced priority.
 823   if (nsCOMPtr<nsISupportsPriority> supportsPriority =
 824           do_QueryInterface(aChannel)) {
 825     int32_t priority = nsISupportsPriority::PRIORITY_LOW;
 826
 827     // Adjust priority according to fetchpriorty attribute.
 828     if (StaticPrefs::network_fetchpriority_enabled()) {
 829       priority += FETCH_PRIORITY_ADJUSTMENT_FOR(images, aFetchPriority);
 830     }
 831
 832     // Further reduce priority for background loads
 833     if (aLoadFlags & nsIRequest::LOAD_BACKGROUND) {
 834       ++priority;
 835     }
 836
 837     supportsPriority->AdjustPriority(priority);
 838   }
 839 }
 840
 841 static nsresult NewImageChannel(
 842     nsIChannel** aResult,
 843     // If aForcePrincipalCheckForCacheEntry is true, then we will
 844     // force a principal check even when not using CORS before
 845     // assuming we have a cache hit on a cache entry that we
 846     // create for this channel.  This is an out param that should
 847     // be set to true if this channel ends up depending on
 848     // aTriggeringPrincipal and false otherwise.
 849     bool* aForcePrincipalCheckForCacheEntry, nsIURI* aURI,
 850     nsIURI* aInitialDocumentURI, CORSMode aCORSMode,
 851     nsIReferrerInfo* aReferrerInfo, nsILoadGroup* aLoadGroup,
 852     nsLoadFlags aLoadFlags, nsContentPolicyType aPolicyType,
 853     nsIPrincipal* aTriggeringPrincipal, nsINode* aRequestingNode,
 854     bool aRespectPrivacy, uint64_t aEarlyHintPreloaderId,
 855     FetchPriority aFetchPriority) {
 856   MOZ_ASSERT(aResult);
 857
 858   nsresult rv;
 859   nsCOMPtr<nsIHttpChannel> newHttpChannel;
 860
 861   nsCOMPtr<nsIInterfaceRequestor> callbacks;
 862
 863   if (aLoadGroup) {
 864     // Get the notification callbacks from the load group for the new channel.
 865     //
 866     // XXX: This is not exactly correct, because the network request could be
 867     //      referenced by multiple windows...  However, the new channel needs
 868     //      something.  So, using the 'first' notification callbacks is better
 869     //      than nothing...
 870     //
 871     aLoadGroup->GetNotificationCallbacks(getter_AddRefs(callbacks));
 872   }
 873
 874   // Pass in a nullptr loadgroup because this is the underlying network
 875   // request. This request may be referenced by several proxy image requests
 876   // (possibly in different documents).
 877   // If all of the proxy requests are canceled then this request should be
 878   // canceled too.
 879   //
 880
 881   nsSecurityFlags securityFlags =
 882       nsContentSecurityManager::ComputeSecurityFlags(
 883           aCORSMode, nsContentSecurityManager::CORSSecurityMapping::
 884                          CORS_NONE_MAPS_TO_INHERITED_CONTEXT);
 885
 886   securityFlags |= nsILoadInfo::SEC_ALLOW_CHROME;
 887
 888   // Note we are calling NS_NewChannelWithTriggeringPrincipal() here with a
 889   // node and a principal. This is for things like background images that are
 890   // specified by user stylesheets, where the document is being styled, but
 891   // the principal is that of the user stylesheet.
 892   if (aRequestingNode && aTriggeringPrincipal) {
 893     rv = NS_NewChannelWithTriggeringPrincipal(aResult, aURI, aRequestingNode,
 894                                               aTriggeringPrincipal,
 895                                               securityFlags, aPolicyType,
 896                                               nullptr,  // PerformanceStorage
 897                                               nullptr,  // loadGroup
 898                                               callbacks, aLoadFlags);
 899
 900     if (NS_FAILED(rv)) {
 901       return rv;
 902     }
 903
 904     if (aPolicyType == nsIContentPolicy::TYPE_INTERNAL_IMAGE_FAVICON) {
 905       // If this is a favicon loading, we will use the originAttributes from the
 906       // triggeringPrincipal as the channel's originAttributes. This allows the
 907       // favicon loading from XUL will use the correct originAttributes.
 908
 909       nsCOMPtr<nsILoadInfo> loadInfo = (*aResult)->LoadInfo();
 910       rv = loadInfo->SetOriginAttributes(
 911           aTriggeringPrincipal->OriginAttributesRef());
 912     }
 913   } else {
 914     // either we are loading something inside a document, in which case
 915     // we should always have a requestingNode, or we are loading something
 916     // outside a document, in which case the triggeringPrincipal and
 917     // triggeringPrincipal should always be the systemPrincipal.
 918     // However, there are exceptions: one is Notifications which create a
 919     // channel in the parent process in which case we can't get a
 920     // requestingNode.
 921     rv = NS_NewChannel(aResult, aURI, nsContentUtils::GetSystemPrincipal(),
 922                        securityFlags, aPolicyType,
 923                        nullptr,  // nsICookieJarSettings
 924                        nullptr,  // PerformanceStorage
 925                        nullptr,  // loadGroup
 926                        callbacks, aLoadFlags);
 927
 928     if (NS_FAILED(rv)) {
 929       return rv;
 930     }
 931
 932     // Use the OriginAttributes from the loading principal, if one is available,
 933     // and adjust the private browsing ID based on what kind of load the caller
 934     // has asked us to perform.
 935     OriginAttributes attrs;
 936     if (aTriggeringPrincipal) {
 937       attrs = aTriggeringPrincipal->OriginAttributesRef();
 938     }
 939     attrs.mPrivateBrowsingId = aRespectPrivacy ? 1 : 0;
 940
 941     nsCOMPtr<nsILoadInfo> loadInfo = (*aResult)->LoadInfo();
 942     rv = loadInfo->SetOriginAttributes(attrs);
 943   }
 944
 945   if (NS_FAILED(rv)) {
 946     return rv;
 947   }
 948
 949   // only inherit if we have a principal
 950   *aForcePrincipalCheckForCacheEntry =
 951       aTriggeringPrincipal && nsContentUtils::ChannelShouldInheritPrincipal(
 952                                   aTriggeringPrincipal, aURI,
 953                                   /* aInheritForAboutBlank */ false,
 954                                   /* aForceInherit */ false);
 955
 956   // Initialize HTTP-specific attributes
 957   newHttpChannel = do_QueryInterface(*aResult);
 958   if (newHttpChannel) {
 959     nsCOMPtr<nsIHttpChannelInternal> httpChannelInternal =
 960         do_QueryInterface(newHttpChannel);
 961     NS_ENSURE_TRUE(httpChannelInternal, NS_ERROR_UNEXPECTED);
 962     rv = httpChannelInternal->SetDocumentURI(aInitialDocumentURI);
 963     MOZ_ASSERT(NS_SUCCEEDED(rv));
 964     if (aReferrerInfo) {
 965       DebugOnly<nsresult> rv = newHttpChannel->SetReferrerInfo(aReferrerInfo);
 966       MOZ_ASSERT(NS_SUCCEEDED(rv));
 967     }
 968
 969     if (aEarlyHintPreloaderId) {
 970       rv = httpChannelInternal->SetEarlyHintPreloaderId(aEarlyHintPreloaderId);
 971       NS_ENSURE_SUCCESS(rv, rv);
 972     }
 973   }
 974
 975   AdjustPriorityForImages(*aResult, aLoadFlags, aFetchPriority);
 976
 977   // Create a new loadgroup for this new channel, using the old group as
 978   // the parent. The indirection keeps the channel insulated from cancels,
 979   // but does allow a way for this revalidation to be associated with at
 980   // least one base load group for scheduling/caching purposes.
 981
 982   nsCOMPtr<nsILoadGroup> loadGroup = do_CreateInstance(NS_LOADGROUP_CONTRACTID);
 983   nsCOMPtr<nsILoadGroupChild> childLoadGroup = do_QueryInterface(loadGroup);
 984   if (childLoadGroup) {
 985     childLoadGroup->SetParentLoadGroup(aLoadGroup);
 986   }
 987   (*aResult)->SetLoadGroup(loadGroup);
 988
 989   return NS_OK;
 990 }
 991
 992 static uint32_t SecondsFromPRTime(PRTime aTime) {
 993   return nsContentUtils::SecondsFromPRTime(aTime);
 994 }
 995
 996 /* static */
 997 imgCacheEntry::imgCacheEntry(imgLoader* loader, imgRequest* request,
 998                              bool forcePrincipalCheck)
 999     : mLoader(loader),
1000       mRequest(request),
1001       mDataSize(0),
1002       mTouchedTime(SecondsFromPRTime(PR_Now())),
1003       mLoadTime(SecondsFromPRTime(PR_Now())),
1004       mExpiryTime(0),
1005       mMustValidate(false),
1006       // We start off as evicted so we don't try to update the cache.
1007       // PutIntoCache will set this to false.
1008       mEvicted(true),
1009       mHasNoProxies(true),
1010       mForcePrincipalCheck(forcePrincipalCheck),
1011       mHasNotified(false) {}
1012
1013 imgCacheEntry::~imgCacheEntry() {
1014   LOG_FUNC(gImgLog, "imgCacheEntry::~imgCacheEntry()");
1015 }
1016
1017 void imgCacheEntry::Touch(bool updateTime /* = true */) {
1018   LOG_SCOPE(gImgLog, "imgCacheEntry::Touch");
1019
1020   if (updateTime) {
1021     mTouchedTime = SecondsFromPRTime(PR_Now());
1022   }
1023
1024   UpdateCache();
1025 }
1026
1027 void imgCacheEntry::UpdateCache(int32_t diff /* = 0 */) {
1028   // Don't update the cache if we've been removed from it or it doesn't care
1029   // about our size or usage.
1030   if (!Evicted() && HasNoProxies()) {
1031     mLoader->CacheEntriesChanged(diff);
1032   }
1033 }
1034
1035 void imgCacheEntry::UpdateLoadTime() {
1036   mLoadTime = SecondsFromPRTime(PR_Now());
1037 }
1038
1039 void imgCacheEntry::SetHasNoProxies(bool hasNoProxies) {
1040   if (MOZ_LOG_TEST(gImgLog, LogLevel::Debug)) {
1041     if (hasNoProxies) {
1042       LOG_FUNC_WITH_PARAM(gImgLog, "imgCacheEntry::SetHasNoProxies true", "uri",
1043                           mRequest->CacheKey().URI());
1044     } else {
1045       LOG_FUNC_WITH_PARAM(gImgLog, "imgCacheEntry::SetHasNoProxies false",
1046                           "uri", mRequest->CacheKey().URI());
1047     }
1048   }
1049
1050   mHasNoProxies = hasNoProxies;
1051 }
1052
1053 imgCacheQueue::imgCacheQueue() : mDirty(false), mSize(0) {}
1054
1055 void imgCacheQueue::UpdateSize(int32_t diff) { mSize += diff; }
1056
1057 uint32_t imgCacheQueue::GetSize() const { return mSize; }
1058
1059 void imgCacheQueue::Remove(imgCacheEntry* entry) {
1060   uint64_t index = mQueue.IndexOf(entry);
1061   if (index == queueContainer::NoIndex) {
1062     return;
1063   }
1064
1065   mSize -= mQueue[index]->GetDataSize();
1066
1067   // If the queue is clean and this is the first entry,
1068   // then we can efficiently remove the entry without
1069   // dirtying the sort order.
1070   if (!IsDirty() && index == 0) {
1071     std::pop_heap(mQueue.begin(), mQueue.end(), imgLoader::CompareCacheEntries);
1072     mQueue.RemoveLastElement();
1073     return;
1074   }
1075
1076   // Remove from the middle of the list.  This potentially
1077   // breaks the binary heap sort order.
1078   mQueue.RemoveElementAt(index);
1079
1080   // If we only have one entry or the queue is empty, though,
1081   // then the sort order is still effectively good.  Simply
1082   // refresh the list to clear the dirty flag.
1083   if (mQueue.Length() <= 1) {
1084     Refresh();
1085     return;
1086   }
1087
1088   // Otherwise we must mark the queue dirty and potentially
1089   // trigger an expensive sort later.
1090   MarkDirty();
1091 }
1092
1093 void imgCacheQueue::Push(imgCacheEntry* entry) {
1094   mSize += entry->GetDataSize();
1095
1096   RefPtr<imgCacheEntry> refptr(entry);
1097   mQueue.AppendElement(std::move(refptr));
1098   // If we're not dirty already, then we can efficiently add this to the
1099   // binary heap immediately.  This is only O(log n).
1100   if (!IsDirty()) {
1101     std::push_heap(mQueue.begin(), mQueue.end(),
1102                    imgLoader::CompareCacheEntries);
1103   }
1104 }
1105
1106 already_AddRefed<imgCacheEntry> imgCacheQueue::Pop() {
1107   if (mQueue.IsEmpty()) {
1108     return nullptr;
1109   }
1110   if (IsDirty()) {
1111     Refresh();
1112   }
1113
1114   std::pop_heap(mQueue.begin(), mQueue.end(), imgLoader::CompareCacheEntries);
1115   RefPtr<imgCacheEntry> entry = mQueue.PopLastElement();
1116
1117   mSize -= entry->GetDataSize();
1118   return entry.forget();
1119 }
1120
1121 void imgCacheQueue::Refresh() {
1122   // Resort the list.  This is an O(3 * n) operation and best avoided
1123   // if possible.
1124   std::make_heap(mQueue.begin(), mQueue.end(), imgLoader::CompareCacheEntries);
1125   mDirty = false;
1126 }
1127
1128 void imgCacheQueue::MarkDirty() { mDirty = true; }
1129
1130 bool imgCacheQueue::IsDirty() { return mDirty; }
1131
1132 uint32_t imgCacheQueue::GetNumElements() const { return mQueue.Length(); }
1133
1134 bool imgCacheQueue::Contains(imgCacheEntry* aEntry) const {
1135   return mQueue.Contains(aEntry);
1136 }
1137
1138 imgCacheQueue::iterator imgCacheQueue::begin() { return mQueue.begin(); }
1139
1140 imgCacheQueue::const_iterator imgCacheQueue::begin() const {
1141   return mQueue.begin();
1142 }
1143
1144 imgCacheQueue::iterator imgCacheQueue::end() { return mQueue.end(); }
1145
1146 imgCacheQueue::const_iterator imgCacheQueue::end() const {
1147   return mQueue.end();
1148 }
1149
1150 nsresult imgLoader::CreateNewProxyForRequest(
1151     imgRequest* aRequest, nsIURI* aURI, nsILoadGroup* aLoadGroup,
1152     Document* aLoadingDocument, imgINotificationObserver* aObserver,
1153     nsLoadFlags aLoadFlags, imgRequestProxy** _retval) {
1154   LOG_SCOPE_WITH_PARAM(gImgLog, "imgLoader::CreateNewProxyForRequest",
1155                        "imgRequest", aRequest);
1156
1157   /* XXX If we move decoding onto separate threads, we should save off the
1158      calling thread here and pass it off to |proxyRequest| so that it call
1159      proxy calls to |aObserver|.
1160    */
1161
1162   RefPtr<imgRequestProxy> proxyRequest = new imgRequestProxy();
1163
1164   /* It is important to call |SetLoadFlags()| before calling |Init()| because
1165      |Init()| adds the request to the loadgroup.
1166    */
1167   proxyRequest->SetLoadFlags(aLoadFlags);
1168
1169   // init adds itself to imgRequest's list of observers
1170   nsresult rv = proxyRequest->Init(aRequest, aLoadGroup, aURI, aObserver);
1171   if (NS_WARN_IF(NS_FAILED(rv))) {
1172     return rv;
1173   }
1174
1175   proxyRequest.forget(_retval);
1176   return NS_OK;
1177 }
1178
1179 class imgCacheExpirationTracker final
1180     : public nsExpirationTracker<imgCacheEntry, 3> {
1181   enum { TIMEOUT_SECONDS = 10 };
1182
1183  public:
1184   imgCacheExpirationTracker();
1185
1186  protected:
1187   void NotifyExpired(imgCacheEntry* entry) override;
1188 };
1189
1190 imgCacheExpirationTracker::imgCacheExpirationTracker()
1191     : nsExpirationTracker<imgCacheEntry, 3>(TIMEOUT_SECONDS * 1000,
1192                                             "imgCacheExpirationTracker") {}
1193
1194 void imgCacheExpirationTracker::NotifyExpired(imgCacheEntry* entry) {
1195   // Hold on to a reference to this entry, because the expiration tracker
1196   // mechanism doesn't.
1197   RefPtr<imgCacheEntry> kungFuDeathGrip(entry);
1198
1199   if (MOZ_LOG_TEST(gImgLog, LogLevel::Debug)) {
1200     RefPtr<imgRequest> req = entry->GetRequest();
1201     if (req) {
1202       LOG_FUNC_WITH_PARAM(gImgLog, "imgCacheExpirationTracker::NotifyExpired",
1203                           "entry", req->CacheKey().URI());
1204     }
1205   }
1206
1207   // We can be called multiple times on the same entry. Don't do work multiple
1208   // times.
1209   if (!entry->Evicted()) {
1210     entry->Loader()->RemoveFromCache(entry);
1211   }
1212
1213   entry->Loader()->VerifyCacheSizes();
1214 }
1215
1216 ///////////////////////////////////////////////////////////////////////////////
1217 // imgLoader
1218 ///////////////////////////////////////////////////////////////////////////////
1219
1220 double imgLoader::sCacheTimeWeight;
1221 uint32_t imgLoader::sCacheMaxSize;
1222 imgMemoryReporter* imgLoader::sMemReporter;
1223
1224 NS_IMPL_ISUPPORTS(imgLoader, imgILoader, nsIContentSniffer, imgICache,
1225                   nsISupportsWeakReference, nsIObserver)
1226
1227 static imgLoader* gNormalLoader = nullptr;
1228 static imgLoader* gPrivateBrowsingLoader = nullptr;
1229
1230 /* static */
1231 already_AddRefed<imgLoader> imgLoader::CreateImageLoader() {
1232   // In some cases, such as xpctests, XPCOM modules are not automatically
1233   // initialized.  We need to make sure that our module is initialized before
1234   // we hand out imgLoader instances and code starts using them.
1235   mozilla::image::EnsureModuleInitialized();
1236
1237   RefPtr<imgLoader> loader = new imgLoader();
1238   loader->Init();
1239
1240   return loader.forget();
1241 }
1242
1243 imgLoader* imgLoader::NormalLoader() {
1244   if (!gNormalLoader) {
1245     gNormalLoader = CreateImageLoader().take();
1246   }
1247   return gNormalLoader;
1248 }
1249
1250 imgLoader* imgLoader::PrivateBrowsingLoader() {
1251   if (!gPrivateBrowsingLoader) {
1252     gPrivateBrowsingLoader = CreateImageLoader().take();
1253     gPrivateBrowsingLoader->RespectPrivacyNotifications();
1254   }
1255   return gPrivateBrowsingLoader;
1256 }
1257
1258 imgLoader::imgLoader()
1259     : mUncachedImagesMutex("imgLoader::UncachedImages"),
1260       mRespectPrivacy(false) {
1261   sMemReporter->AddRef();
1262   sMemReporter->RegisterLoader(this);
1263 }
1264
1265 imgLoader::~imgLoader() {
1266   ClearImageCache();
1267   {
1268     // If there are any of our imgRequest's left they are in the uncached
1269     // images set, so clear their pointer to us.
1270     MutexAutoLock lock(mUncachedImagesMutex);
1271     for (RefPtr<imgRequest> req : mUncachedImages) {
1272       req->ClearLoader();
1273     }
1274   }
1275   sMemReporter->UnregisterLoader(this);
1276   sMemReporter->Release();
1277 }
1278
1279 void imgLoader::VerifyCacheSizes() {
1280 #ifdef DEBUG
1281   if (!mCacheTracker) {
1282     return;
1283   }
1284
1285   uint32_t cachesize = mCache.Count();
1286   uint32_t queuesize = mCacheQueue.GetNumElements();
1287   uint32_t trackersize = 0;
1288   for (nsExpirationTracker<imgCacheEntry, 3>::Iterator it(mCacheTracker.get());
1289        it.Next();) {
1290     trackersize++;
1291   }
1292   MOZ_ASSERT(queuesize == trackersize, "Queue and tracker sizes out of sync!");
1293   MOZ_ASSERT(queuesize <= cachesize, "Queue has more elements than cache!");
1294 #endif
1295 }
1296
1297 void imgLoader::GlobalInit() {
1298   sCacheTimeWeight = StaticPrefs::image_cache_timeweight_AtStartup() / 1000.0;
1299   int32_t cachesize = StaticPrefs::image_cache_size_AtStartup();
1300   sCacheMaxSize = cachesize > 0 ? cachesize : 0;
1301
1302   sMemReporter = new imgMemoryReporter();
1303   RegisterStrongAsyncMemoryReporter(sMemReporter);
1304   RegisterImagesContentUsedUncompressedDistinguishedAmount(
1305       imgMemoryReporter::ImagesContentUsedUncompressedDistinguishedAmount);
1306 }
1307
1308 void imgLoader::ShutdownMemoryReporter() {
1309   UnregisterImagesContentUsedUncompressedDistinguishedAmount();
1310   UnregisterStrongMemoryReporter(sMemReporter);
1311 }
1312
1313 nsresult imgLoader::InitCache() {
1314   nsCOMPtr<nsIObserverService> os = mozilla::services::GetObserverService();
1315   if (!os) {
1316     return NS_ERROR_FAILURE;
1317   }
1318
1319   os->AddObserver(this, "memory-pressure", false);
1320   os->AddObserver(this, "chrome-flush-caches", false);
1321   os->AddObserver(this, "last-pb-context-exited", false);
1322   os->AddObserver(this, "profile-before-change", false);
1323   os->AddObserver(this, "xpcom-shutdown", false);
1324
1325   mCacheTracker = MakeUnique<imgCacheExpirationTracker>();
1326
1327   return NS_OK;
1328 }
1329
1330 nsresult imgLoader::Init() {
1331   InitCache();
1332
1333   return NS_OK;
1334 }
1335
1336 NS_IMETHODIMP
1337 imgLoader::RespectPrivacyNotifications() {
1338   mRespectPrivacy = true;
1339   return NS_OK;
1340 }
1341
1342 NS_IMETHODIMP
1343 imgLoader::Observe(nsISupports* aSubject, const char* aTopic,
1344                    const char16_t* aData) {
1345   if (strcmp(aTopic, "memory-pressure") == 0) {
1346     MinimizeCache();
1347   } else if (strcmp(aTopic, "chrome-flush-caches") == 0) {
1348     MinimizeCache();
1349     ClearImageCache({ClearOption::ChromeOnly});
1350   } else if (strcmp(aTopic, "last-pb-context-exited") == 0) {
1351     if (mRespectPrivacy) {
1352       ClearImageCache();
1353     }
1354   } else if (strcmp(aTopic, "profile-before-change") == 0) {
1355     mCacheTracker = nullptr;
1356   } else if (strcmp(aTopic, "xpcom-shutdown") == 0) {
1357     mCacheTracker = nullptr;
1358     ShutdownMemoryReporter();
1359
1360   } else {
1361     // (Nothing else should bring us here)
1362     MOZ_ASSERT(0, "Invalid topic received");
1363   }
1364
1365   return NS_OK;
1366 }
1367
1368 NS_IMETHODIMP
1369 imgLoader::ClearCache(bool chrome) {
1370   if (XRE_IsParentProcess()) {
1371     bool privateLoader = this == gPrivateBrowsingLoader;
1372     for (auto* cp : ContentParent::AllProcesses(ContentParent::eLive)) {
1373       Unused << cp->SendClearImageCache(privateLoader, chrome);
1374     }
1375   }
1376   ClearOptions options;
1377   if (chrome) {
1378     options += ClearOption::ChromeOnly;
1379   }
1380   return ClearImageCache(options);
1381 }
1382
1383 NS_IMETHODIMP
1384 imgLoader::RemoveEntriesFromPrincipalInAllProcesses(nsIPrincipal* aPrincipal) {
1385   if (!XRE_IsParentProcess()) {
1386     return NS_ERROR_NOT_AVAILABLE;
1387   }
1388
1389   for (auto* cp : ContentParent::AllProcesses(ContentParent::eLive)) {
1390     Unused << cp->SendClearImageCacheFromPrincipal(aPrincipal);
1391   }
1392
1393   imgLoader* loader;
1394   if (aPrincipal->OriginAttributesRef().mPrivateBrowsingId ==
1395       nsIScriptSecurityManager::DEFAULT_PRIVATE_BROWSING_ID) {
1396     loader = imgLoader::NormalLoader();
1397   } else {
1398     loader = imgLoader::PrivateBrowsingLoader();
1399   }
1400
1401   return loader->RemoveEntriesInternal(aPrincipal, nullptr);
1402 }
1403
1404 NS_IMETHODIMP
1405 imgLoader::RemoveEntriesFromBaseDomainInAllProcesses(
1406     const nsACString& aBaseDomain) {
1407   if (!XRE_IsParentProcess()) {
1408     return NS_ERROR_NOT_AVAILABLE;
1409   }
1410
1411   for (auto* cp : ContentParent::AllProcesses(ContentParent::eLive)) {
1412     Unused << cp->SendClearImageCacheFromBaseDomain(aBaseDomain);
1413   }
1414
1415   return RemoveEntriesInternal(nullptr, &aBaseDomain);
1416 }
1417
1418 nsresult imgLoader::RemoveEntriesInternal(nsIPrincipal* aPrincipal,
1419                                           const nsACString* aBaseDomain) {
1420   // Can only clear by either principal or base domain.
1421   if ((!aPrincipal && !aBaseDomain) || (aPrincipal && aBaseDomain)) {
1422     return NS_ERROR_INVALID_ARG;
1423   }
1424
1425   nsCOMPtr<nsIEffectiveTLDService> tldService;
1426   AutoTArray<RefPtr<imgCacheEntry>, 128> entriesToBeRemoved;
1427
1428   // For base domain we only clear the non-chrome cache.
1429   for (const auto& entry : mCache) {
1430     const auto& key = entry.GetKey();
1431
1432     const bool shouldRemove = [&] {
1433       if (aPrincipal) {
1434         nsCOMPtr<nsIPrincipal> keyPrincipal =
1435             BasePrincipal::CreateContentPrincipal(key.URI(),
1436                                                   key.OriginAttributesRef());
1437         return keyPrincipal->Equals(aPrincipal);
1438       }
1439
1440       if (!aBaseDomain) {
1441         return false;
1442       }
1443       // Clear by baseDomain.
1444       nsAutoCString host;
1445       nsresult rv = key.URI()->GetHost(host);
1446       if (NS_FAILED(rv) || host.IsEmpty()) {
1447         return false;
1448       }
1449
1450       if (!tldService) {
1451         tldService = do_GetService(NS_EFFECTIVETLDSERVICE_CONTRACTID);
1452       }
1453       if (NS_WARN_IF(!tldService)) {
1454         return false;
1455       }
1456
1457       bool hasRootDomain = false;
1458       rv = tldService->HasRootDomain(host, *aBaseDomain, &hasRootDomain);
1459       if (NS_SUCCEEDED(rv) && hasRootDomain) {
1460         return true;
1461       }
1462
1463       // If we don't get a direct base domain match, also check for cache of
1464       // third parties partitioned under aBaseDomain.
1465
1466       // The isolation key is either just the base domain, or an origin suffix
1467       // which contains the partitionKey holding the baseDomain.
1468
1469       if (key.IsolationKeyRef().Equals(*aBaseDomain)) {
1470         return true;
1471       }
1472
1473       // The isolation key does not match the given base domain. It may be an
1474       // origin suffix. Parse it into origin attributes.
1475       OriginAttributes attrs;
1476       if (!attrs.PopulateFromSuffix(key.IsolationKeyRef())) {
1477         // Key is not an origin suffix.
1478         return false;
1479       }
1480
1481       return StoragePrincipalHelper::PartitionKeyHasBaseDomain(
1482           attrs.mPartitionKey, *aBaseDomain);
1483     }();
1484
1485     if (shouldRemove) {
1486       entriesToBeRemoved.AppendElement(entry.GetData());
1487     }
1488   }
1489
1490   for (auto& entry : entriesToBeRemoved) {
1491     if (!RemoveFromCache(entry)) {
1492       NS_WARNING(
1493           "Couldn't remove an entry from the cache in "
1494           "RemoveEntriesInternal()\n");
1495     }
1496   }
1497
1498   return NS_OK;
1499 }
1500
1501 constexpr auto AllCORSModes() {
1502   return MakeInclusiveEnumeratedRange(kFirstCORSMode, kLastCORSMode);
1503 }
1504
1505 NS_IMETHODIMP
1506 imgLoader::RemoveEntry(nsIURI* aURI, Document* aDoc) {
1507   if (!aURI) {
1508     return NS_OK;
1509   }
1510   OriginAttributes attrs;
1511   if (aDoc) {
1512     attrs = aDoc->NodePrincipal()->OriginAttributesRef();
1513   }
1514   for (auto corsMode : AllCORSModes()) {
1515     ImageCacheKey key(aURI, corsMode, attrs, aDoc);
1516     RemoveFromCache(key);
1517   }
1518   return NS_OK;
1519 }
1520
1521 NS_IMETHODIMP
1522 imgLoader::FindEntryProperties(nsIURI* uri, Document* aDoc,
1523                                nsIProperties** _retval) {
1524   *_retval = nullptr;
1525
1526   OriginAttributes attrs;
1527   if (aDoc) {
1528     nsCOMPtr<nsIPrincipal> principal = aDoc->NodePrincipal();
1529     if (principal) {
1530       attrs = principal->OriginAttributesRef();
1531     }
1532   }
1533
1534   for (auto corsMode : AllCORSModes()) {
1535     ImageCacheKey key(uri, corsMode, attrs, aDoc);
1536     RefPtr<imgCacheEntry> entry;
1537     if (!mCache.Get(key, getter_AddRefs(entry)) || !entry) {
1538       continue;
1539     }
1540     if (mCacheTracker && entry->HasNoProxies()) {
1541       mCacheTracker->MarkUsed(entry);
1542     }
1543     RefPtr<imgRequest> request = entry->GetRequest();
1544     if (request) {
1545       nsCOMPtr<nsIProperties> properties = request->Properties();
1546       properties.forget(_retval);
1547       return NS_OK;
1548     }
1549   }
1550   return NS_OK;
1551 }
1552
1553 NS_IMETHODIMP_(void)
1554 imgLoader::ClearCacheForControlledDocument(Document* aDoc) {
1555   MOZ_ASSERT(aDoc);
1556   AutoTArray<RefPtr<imgCacheEntry>, 128> entriesToBeRemoved;
1557   for (const auto& entry : mCache) {
1558     const auto& key = entry.GetKey();
1559     if (key.ControlledDocument() == aDoc) {
1560       entriesToBeRemoved.AppendElement(entry.GetData());
1561     }
1562   }
1563   for (auto& entry : entriesToBeRemoved) {
1564     if (!RemoveFromCache(entry)) {
1565       NS_WARNING(
1566           "Couldn't remove an entry from the cache in "
1567           "ClearCacheForControlledDocument()\n");
1568     }
1569   }
1570 }
1571
1572 void imgLoader::Shutdown() {
1573   NS_IF_RELEASE(gNormalLoader);
1574   gNormalLoader = nullptr;
1575   NS_IF_RELEASE(gPrivateBrowsingLoader);
1576   gPrivateBrowsingLoader = nullptr;
1577 }
1578
1579 bool imgLoader::PutIntoCache(const ImageCacheKey& aKey, imgCacheEntry* entry) {
1580   LOG_STATIC_FUNC_WITH_PARAM(gImgLog, "imgLoader::PutIntoCache", "uri",
1581                              aKey.URI());
1582
1583   // Check to see if this request already exists in the cache. If so, we'll
1584   // replace the old version.
1585   RefPtr<imgCacheEntry> tmpCacheEntry;
1586   if (mCache.Get(aKey, getter_AddRefs(tmpCacheEntry)) && tmpCacheEntry) {
1587     MOZ_LOG(
1588         gImgLog, LogLevel::Debug,
1589         ("[this=%p] imgLoader::PutIntoCache -- Element already in the cache",
1590          nullptr));
1591     RefPtr<imgRequest> tmpRequest = tmpCacheEntry->GetRequest();
1592
1593     // If it already exists, and we're putting the same key into the cache, we
1594     // should remove the old version.
1595     MOZ_LOG(gImgLog, LogLevel::Debug,
1596             ("[this=%p] imgLoader::PutIntoCache -- Replacing cached element",
1597              nullptr));
1598
1599     RemoveFromCache(aKey);
1600   } else {
1601     MOZ_LOG(gImgLog, LogLevel::Debug,
1602             ("[this=%p] imgLoader::PutIntoCache --"
1603              " Element NOT already in the cache",
1604              nullptr));
1605   }
1606
1607   mCache.InsertOrUpdate(aKey, RefPtr{entry});
1608
1609   // We can be called to resurrect an evicted entry.
1610   if (entry->Evicted()) {
1611     entry->SetEvicted(false);
1612   }
1613
1614   // If we're resurrecting an entry with no proxies, put it back in the
1615   // tracker and queue.
1616   if (entry->HasNoProxies()) {
1617     nsresult addrv = NS_OK;
1618
1619     if (mCacheTracker) {
1620       addrv = mCacheTracker->AddObject(entry);
1621     }
1622
1623     if (NS_SUCCEEDED(addrv)) {
1624       mCacheQueue.Push(entry);
1625     }
1626   }
1627
1628   RefPtr<imgRequest> request = entry->GetRequest();
1629   request->SetIsInCache(true);
1630   RemoveFromUncachedImages(request);
1631
1632   return true;
1633 }
1634
1635 bool imgLoader::SetHasNoProxies(imgRequest* aRequest, imgCacheEntry* aEntry) {
1636   LOG_STATIC_FUNC_WITH_PARAM(gImgLog, "imgLoader::SetHasNoProxies", "uri",
1637                              aRequest->CacheKey().URI());
1638
1639   aEntry->SetHasNoProxies(true);
1640
1641   if (aEntry->Evicted()) {
1642     return false;
1643   }
1644
1645   nsresult addrv = NS_OK;
1646
1647   if (mCacheTracker) {
1648     addrv = mCacheTracker->AddObject(aEntry);
1649   }
1650
1651   if (NS_SUCCEEDED(addrv)) {
1652     mCacheQueue.Push(aEntry);
1653   }
1654
1655   return true;
1656 }
1657
1658 bool imgLoader::SetHasProxies(imgRequest* aRequest) {
1659   VerifyCacheSizes();
1660
1661   const ImageCacheKey& key = aRequest->CacheKey();
1662
1663   LOG_STATIC_FUNC_WITH_PARAM(gImgLog, "imgLoader::SetHasProxies", "uri",
1664                              key.URI());
1665
1666   RefPtr<imgCacheEntry> entry;
1667   if (mCache.Get(key, getter_AddRefs(entry)) && entry) {
1668     // Make sure the cache entry is for the right request
1669     RefPtr<imgRequest> entryRequest = entry->GetRequest();
1670     if (entryRequest == aRequest && entry->HasNoProxies()) {
1671       mCacheQueue.Remove(entry);
1672
1673       if (mCacheTracker) {
1674         mCacheTracker->RemoveObject(entry);
1675       }
1676
1677       entry->SetHasNoProxies(false);
1678
1679       return true;
1680     }
1681   }
1682
1683   return false;
1684 }
1685
1686 void imgLoader::CacheEntriesChanged(int32_t aSizeDiff /* = 0 */) {
1687   // We only need to dirty the queue if there is any sorting
1688   // taking place.  Empty or single-entry lists can't become
1689   // dirty.
1690   if (mCacheQueue.GetNumElements() > 1) {
1691     mCacheQueue.MarkDirty();
1692   }
1693   mCacheQueue.UpdateSize(aSizeDiff);
1694 }
1695
1696 void imgLoader::CheckCacheLimits() {
1697   if (mCacheQueue.GetNumElements() == 0) {
1698     NS_ASSERTION(mCacheQueue.GetSize() == 0,
1699                  "imgLoader::CheckCacheLimits -- incorrect cache size");
1700   }
1701
1702   // Remove entries from the cache until we're back at our desired max size.
1703   while (mCacheQueue.GetSize() > sCacheMaxSize) {
1704     // Remove the first entry in the queue.
1705     RefPtr<imgCacheEntry> entry(mCacheQueue.Pop());
1706
1707     NS_ASSERTION(entry, "imgLoader::CheckCacheLimits -- NULL entry pointer");
1708
1709     if (MOZ_LOG_TEST(gImgLog, LogLevel::Debug)) {
1710       RefPtr<imgRequest> req = entry->GetRequest();
1711       if (req) {
1712         LOG_STATIC_FUNC_WITH_PARAM(gImgLog, "imgLoader::CheckCacheLimits",
1713                                    "entry", req->CacheKey().URI());
1714       }
1715     }
1716
1717     if (entry) {
1718       // We just popped this entry from the queue, so pass AlreadyRemoved
1719       // to avoid searching the queue again in RemoveFromCache.
1720       RemoveFromCache(entry, QueueState::AlreadyRemoved);
1721     }
1722   }
1723 }
1724
1725 bool imgLoader::ValidateRequestWithNewChannel(
1726     imgRequest* request, nsIURI* aURI, nsIURI* aInitialDocumentURI,
1727     nsIReferrerInfo* aReferrerInfo, nsILoadGroup* aLoadGroup,
1728     imgINotificationObserver* aObserver, Document* aLoadingDocument,
1729     uint64_t aInnerWindowId, nsLoadFlags aLoadFlags,
1730     nsContentPolicyType aLoadPolicyType, imgRequestProxy** aProxyRequest,
1731     nsIPrincipal* aTriggeringPrincipal, CORSMode aCORSMode, bool aLinkPreload,
1732     uint64_t aEarlyHintPreloaderId, FetchPriority aFetchPriority,
1733     bool* aNewChannelCreated) {
1734   // now we need to insert a new channel request object in between the real
1735   // request and the proxy that basically delays loading the image until it
1736   // gets a 304 or figures out that this needs to be a new request
1737
1738   nsresult rv;
1739
1740   // If we're currently in the middle of validating this request, just hand
1741   // back a proxy to it; the required work will be done for us.
1742   if (imgCacheValidator* validator = request->GetValidator()) {
1743     rv = CreateNewProxyForRequest(request, aURI, aLoadGroup, aLoadingDocument,
1744                                   aObserver, aLoadFlags, aProxyRequest);
1745     if (NS_FAILED(rv)) {
1746       return false;
1747     }
1748
1749     if (*aProxyRequest) {
1750       imgRequestProxy* proxy = static_cast<imgRequestProxy*>(*aProxyRequest);
1751
1752       // We will send notifications from imgCacheValidator::OnStartRequest().
1753       // In the mean time, we must defer notifications because we are added to
1754       // the imgRequest's proxy list, and we can get extra notifications
1755       // resulting from methods such as StartDecoding(). See bug 579122.
1756       proxy->MarkValidating();
1757
1758       if (aLinkPreload) {
1759         MOZ_ASSERT(aLoadingDocument);
1760         auto preloadKey = PreloadHashKey::CreateAsImage(
1761             aURI, aTriggeringPrincipal, aCORSMode);
1762         proxy->NotifyOpen(preloadKey, aLoadingDocument, true);
1763       }
1764
1765       // Attach the proxy without notifying
1766       validator->AddProxy(proxy);
1767     }
1768
1769     return true;
1770   }
1771   // We will rely on Necko to cache this request when it's possible, and to
1772   // tell imgCacheValidator::OnStartRequest whether the request came from its
1773   // cache.
1774   nsCOMPtr<nsIChannel> newChannel;
1775   bool forcePrincipalCheck;
1776   rv = NewImageChannel(getter_AddRefs(newChannel), &forcePrincipalCheck, aURI,
1777                        aInitialDocumentURI, aCORSMode, aReferrerInfo,
1778                        aLoadGroup, aLoadFlags, aLoadPolicyType,
1779                        aTriggeringPrincipal, aLoadingDocument, mRespectPrivacy,
1780                        aEarlyHintPreloaderId, aFetchPriority);
1781   if (NS_FAILED(rv)) {
1782     return false;
1783   }
1784
1785   if (aNewChannelCreated) {
1786     *aNewChannelCreated = true;
1787   }
1788
1789   RefPtr<imgRequestProxy> req;
1790   rv = CreateNewProxyForRequest(request, aURI, aLoadGroup, aLoadingDocument,
1791                                 aObserver, aLoadFlags, getter_AddRefs(req));
1792   if (NS_FAILED(rv)) {
1793     return false;
1794   }
1795
1796   // Make sure that OnStatus/OnProgress calls have the right request set...
1797   RefPtr<nsProgressNotificationProxy> progressproxy =
1798       new nsProgressNotificationProxy(newChannel, req);
1799   if (!progressproxy) {
1800     return false;
1801   }
1802
1803   RefPtr<imgCacheValidator> hvc =
1804       new imgCacheValidator(progressproxy, this, request, aLoadingDocument,
1805                             aInnerWindowId, forcePrincipalCheck);
1806
1807   // Casting needed here to get past multiple inheritance.
1808   nsCOMPtr<nsIStreamListener> listener =
1809       static_cast<nsIThreadRetargetableStreamListener*>(hvc);
1810   NS_ENSURE_TRUE(listener, false);
1811
1812   // We must set the notification callbacks before setting up the
1813   // CORS listener, because that's also interested inthe
1814   // notification callbacks.
1815   newChannel->SetNotificationCallbacks(hvc);
1816
1817   request->SetValidator(hvc);
1818
1819   // We will send notifications from imgCacheValidator::OnStartRequest().
1820   // In the mean time, we must defer notifications because we are added to
1821   // the imgRequest's proxy list, and we can get extra notifications
1822   // resulting from methods such as StartDecoding(). See bug 579122.
1823   req->MarkValidating();
1824
1825   if (aLinkPreload) {
1826     MOZ_ASSERT(aLoadingDocument);
1827     auto preloadKey =
1828         PreloadHashKey::CreateAsImage(aURI, aTriggeringPrincipal, aCORSMode);
1829     req->NotifyOpen(preloadKey, aLoadingDocument, true);
1830   }
1831
1832   // Add the proxy without notifying
1833   hvc->AddProxy(req);
1834
1835   mozilla::net::PredictorLearn(aURI, aInitialDocumentURI,
1836                                nsINetworkPredictor::LEARN_LOAD_SUBRESOURCE,
1837                                aLoadGroup);
1838   rv = newChannel->AsyncOpen(listener);
1839   if (NS_WARN_IF(NS_FAILED(rv))) {
1840     req->CancelAndForgetObserver(rv);
1841     // This will notify any current or future <link preload> tags.  Pass the
1842     // non-open channel so that we can read loadinfo and referrer info of that
1843     // channel.
1844     req->NotifyStart(newChannel);
1845     // Use the non-channel overload of this method to force the notification to
1846     // happen.  The preload request has not been assigned a channel.
1847     req->NotifyStop(rv);
1848     return false;
1849   }
1850
1851   req.forget(aProxyRequest);
1852   return true;
1853 }
1854
1855 void imgLoader::NotifyObserversForCachedImage(
1856     imgCacheEntry* aEntry, imgRequest* request, nsIURI* aURI,
1857     nsIReferrerInfo* aReferrerInfo, Document* aLoadingDocument,
1858     nsIPrincipal* aTriggeringPrincipal, CORSMode aCORSMode,
1859     uint64_t aEarlyHintPreloaderId, FetchPriority aFetchPriority) {
1860   if (aEntry->HasNotified()) {
1861     return;
1862   }
1863
1864   nsCOMPtr<nsIObserverService> obsService = services::GetObserverService();
1865
1866   if (!obsService->HasObservers("http-on-image-cache-response")) {
1867     return;
1868   }
1869
1870   aEntry->SetHasNotified();
1871
1872   nsCOMPtr<nsIChannel> newChannel;
1873   bool forcePrincipalCheck;
1874   nsresult rv = NewImageChannel(
1875       getter_AddRefs(newChannel), &forcePrincipalCheck, aURI, nullptr,
1876       aCORSMode, aReferrerInfo, nullptr, 0,
1877       nsIContentPolicy::TYPE_INTERNAL_IMAGE, aTriggeringPrincipal,
1878       aLoadingDocument, mRespectPrivacy, aEarlyHintPreloaderId, aFetchPriority);
1879   if (NS_FAILED(rv)) {
1880     return;
1881   }
1882
1883   RefPtr<HttpBaseChannel> httpBaseChannel = do_QueryObject(newChannel);
1884   if (httpBaseChannel) {
1885     httpBaseChannel->SetDummyChannelForImageCache();
1886     newChannel->SetContentType(nsDependentCString(request->GetMimeType()));
1887     RefPtr<mozilla::image::Image> image = request->GetImage();
1888     if (image) {
1889       newChannel->SetContentLength(aEntry->GetDataSize());
1890     }
1891     obsService->NotifyObservers(newChannel, "http-on-image-cache-response",
1892                                 nullptr);
1893   }
1894 }
1895
1896 bool imgLoader::ValidateEntry(
1897     imgCacheEntry* aEntry, nsIURI* aURI, nsIURI* aInitialDocumentURI,
1898     nsIReferrerInfo* aReferrerInfo, nsILoadGroup* aLoadGroup,
1899     imgINotificationObserver* aObserver, Document* aLoadingDocument,
1900     nsLoadFlags aLoadFlags, nsContentPolicyType aLoadPolicyType,
1901     bool aCanMakeNewChannel, bool* aNewChannelCreated,
1902     imgRequestProxy** aProxyRequest, nsIPrincipal* aTriggeringPrincipal,
1903     CORSMode aCORSMode, bool aLinkPreload, uint64_t aEarlyHintPreloaderId,
1904     FetchPriority aFetchPriority) {
1905   LOG_SCOPE(gImgLog, "imgLoader::ValidateEntry");
1906
1907   // If the expiration time is zero, then the request has not gotten far enough
1908   // to know when it will expire, or we know it will never expire (see
1909   // nsContentUtils::GetSubresourceCacheValidationInfo).
1910   uint32_t expiryTime = aEntry->GetExpiryTime();
1911   bool hasExpired = expiryTime && expiryTime <= SecondsFromPRTime(PR_Now());
1912
1913   // Special treatment for file URLs - aEntry has expired if file has changed
1914   if (nsCOMPtr<nsIFileURL> fileUrl = do_QueryInterface(aURI)) {
1915     uint32_t lastModTime = aEntry->GetLoadTime();
1916     nsCOMPtr<nsIFile> theFile;
1917     if (NS_SUCCEEDED(fileUrl->GetFile(getter_AddRefs(theFile)))) {
1918       PRTime fileLastMod;
1919       if (NS_SUCCEEDED(theFile->GetLastModifiedTime(&fileLastMod))) {
1920         // nsIFile uses millisec, NSPR usec.
1921         fileLastMod *= 1000;
1922         hasExpired = SecondsFromPRTime((PRTime)fileLastMod) > lastModTime;
1923       }
1924     }
1925   }
1926
1927   RefPtr<imgRequest> request(aEntry->GetRequest());
1928
1929   if (!request) {
1930     return false;
1931   }
1932
1933   if (!ValidateSecurityInfo(request, aEntry->ForcePrincipalCheck(), aCORSMode,
1934                             aTriggeringPrincipal, aLoadingDocument,
1935                             aLoadPolicyType)) {
1936     return false;
1937   }
1938
1939   // data URIs are immutable and by their nature can't leak data, so we can
1940   // just return true in that case.  Doing so would mean that shift-reload
1941   // doesn't reload data URI documents/images though (which is handy for
1942   // debugging during gecko development) so we make an exception in that case.
1943   if (aURI->SchemeIs("data") && !(aLoadFlags & nsIRequest::LOAD_BYPASS_CACHE)) {
1944     return true;
1945   }
1946
1947   bool validateRequest = false;
1948
1949   if (!request->CanReuseWithoutValidation(aLoadingDocument)) {
1950     // If we would need to revalidate this entry, but we're being told to
1951     // bypass the cache, we don't allow this entry to be used.
1952     if (aLoadFlags & nsIRequest::LOAD_BYPASS_CACHE) {
1953       return false;
1954     }
1955
1956     if (MOZ_UNLIKELY(ChaosMode::isActive(ChaosFeature::ImageCache))) {
1957       if (ChaosMode::randomUint32LessThan(4) < 1) {
1958         return false;
1959       }
1960     }
1961
1962     // Determine whether the cache aEntry must be revalidated...
1963     validateRequest = ShouldRevalidateEntry(aEntry, aLoadFlags, hasExpired);
1964
1965     MOZ_LOG(gImgLog, LogLevel::Debug,
1966             ("imgLoader::ValidateEntry validating cache entry. "
1967              "validateRequest = %d",
1968              validateRequest));
1969   } else if (!aLoadingDocument && MOZ_LOG_TEST(gImgLog, LogLevel::Debug)) {
1970     MOZ_LOG(gImgLog, LogLevel::Debug,
1971             ("imgLoader::ValidateEntry BYPASSING cache validation for %s "
1972              "because of NULL loading document",
1973              aURI->GetSpecOrDefault().get()));
1974   }
1975
1976   // If the original request is still transferring don't kick off a validation
1977   // network request because it is a bit silly to issue a validation request if
1978   // the original request hasn't even finished yet. So just return true
1979   // indicating the caller can create a new proxy for the request and use it as
1980   // is.
1981   // This is an optimization but it's also required for correctness. If we don't
1982   // do this then when firing the load complete notification for the original
1983   // request that can unblock load for the document and then spin the event loop
1984   // (see the stack in bug 1641682) which then the OnStartRequest for the
1985   // validation request can fire which can call UpdateProxies and can sync
1986   // notify on the progress tracker about all existing state, which includes
1987   // load complete, so we fire a second load complete notification for the
1988   // image.
1989   // In addition, we want to validate if the original request encountered
1990   // an error for two reasons. The first being if the error was a network error
1991   // then trying to re-fetch the image might succeed. The second is more
1992   // complicated. We decide if we should fire the load or error event for img
1993   // elements depending on if the image has error in its status at the time when
1994   // the load complete notification is received, and we set error status on an
1995   // image if it encounters a network error or a decode error with no real way
1996   // to tell them apart. So if we load an image that will produce a decode error
1997   // the first time we will usually fire the load event, and then decode enough
1998   // to encounter the decode error and set the error status on the image. The
1999   // next time we reference the image in the same document the load complete
2000   // notification is replayed and this time the error status from the decode is
2001   // already present so we fire the error event instead of the load event. This
2002   // is a bug (bug 1645576) that we should fix. In order to avoid that bug in
2003   // some cases (specifically the cases when we hit this code and try to
2004   // validate the request) we make sure to validate. This avoids the bug because
2005   // when the load complete notification arrives the proxy is marked as
2006   // validating so it lies about its status and returns nothing.
2007   const bool requestComplete = [&] {
2008     RefPtr<ProgressTracker> tracker;
2009     RefPtr<mozilla::image::Image> image = request->GetImage();
2010     if (image) {
2011       tracker = image->GetProgressTracker();
2012     } else {
2013       tracker = request->GetProgressTracker();
2014     }
2015     return tracker &&
2016            tracker->GetProgress() & (FLAG_LOAD_COMPLETE | FLAG_HAS_ERROR);
2017   }();
2018
2019   if (!requestComplete) {
2020     return true;
2021   }
2022
2023   if (validateRequest && aCanMakeNewChannel) {
2024     LOG_SCOPE(gImgLog, "imgLoader::ValidateRequest |cache hit| must validate");
2025
2026     uint64_t innerWindowID =
2027         aLoadingDocument ? aLoadingDocument->InnerWindowID() : 0;
2028     return ValidateRequestWithNewChannel(
2029         request, aURI, aInitialDocumentURI, aReferrerInfo, aLoadGroup,
2030         aObserver, aLoadingDocument, innerWindowID, aLoadFlags, aLoadPolicyType,
2031         aProxyRequest, aTriggeringPrincipal, aCORSMode, aLinkPreload,
2032         aEarlyHintPreloaderId, aFetchPriority, aNewChannelCreated);
2033   }
2034
2035   if (!validateRequest) {
2036     NotifyObserversForCachedImage(
2037         aEntry, request, aURI, aReferrerInfo, aLoadingDocument,
2038         aTriggeringPrincipal, aCORSMode, aEarlyHintPreloaderId, aFetchPriority);
2039   }
2040
2041   return !validateRequest;
2042 }
2043
2044 bool imgLoader::RemoveFromCache(const ImageCacheKey& aKey) {
2045   LOG_STATIC_FUNC_WITH_PARAM(gImgLog, "imgLoader::RemoveFromCache", "uri",
2046                              aKey.URI());
2047   RefPtr<imgCacheEntry> entry;
2048   mCache.Remove(aKey, getter_AddRefs(entry));
2049   if (entry) {
2050     MOZ_ASSERT(!entry->Evicted(), "Evicting an already-evicted cache entry!");
2051
2052     // Entries with no proxies are in the tracker.
2053     if (entry->HasNoProxies()) {
2054       if (mCacheTracker) {
2055         mCacheTracker->RemoveObject(entry);
2056       }
2057       mCacheQueue.Remove(entry);
2058     }
2059
2060     entry->SetEvicted(true);
2061
2062     RefPtr<imgRequest> request = entry->GetRequest();
2063     request->SetIsInCache(false);
2064     AddToUncachedImages(request);
2065
2066     return true;
2067   }
2068   return false;
2069 }
2070
2071 bool imgLoader::RemoveFromCache(imgCacheEntry* entry, QueueState aQueueState) {
2072   LOG_STATIC_FUNC(gImgLog, "imgLoader::RemoveFromCache entry");
2073
2074   RefPtr<imgRequest> request = entry->GetRequest();
2075   if (request) {
2076     const ImageCacheKey& key = request->CacheKey();
2077     LOG_STATIC_FUNC_WITH_PARAM(gImgLog, "imgLoader::RemoveFromCache",
2078                                "entry's uri", key.URI());
2079
2080     mCache.Remove(key);
2081
2082     if (entry->HasNoProxies()) {
2083       LOG_STATIC_FUNC(gImgLog,
2084                       "imgLoader::RemoveFromCache removing from tracker");
2085       if (mCacheTracker) {
2086         mCacheTracker->RemoveObject(entry);
2087       }
2088       // Only search the queue to remove the entry if its possible it might
2089       // be in the queue.  If we know its not in the queue this would be
2090       // wasted work.
2091       MOZ_ASSERT_IF(aQueueState == QueueState::AlreadyRemoved,
2092                     !mCacheQueue.Contains(entry));
2093       if (aQueueState == QueueState::MaybeExists) {
2094         mCacheQueue.Remove(entry);
2095       }
2096     }
2097
2098     entry->SetEvicted(true);
2099     request->SetIsInCache(false);
2100     AddToUncachedImages(request);
2101
2102     return true;
2103   }
2104
2105   return false;
2106 }
2107
2108 nsresult imgLoader::ClearImageCache(ClearOptions aOptions) {
2109   const bool chromeOnly = aOptions.contains(ClearOption::ChromeOnly);
2110   const auto ShouldRemove = [&](imgCacheEntry* aEntry) {
2111     if (chromeOnly) {
2112       // TODO: Consider also removing "resource://" etc?
2113       RefPtr<imgRequest> request = aEntry->GetRequest();
2114       if (!request || !request->CacheKey().URI()->SchemeIs("chrome")) {
2115         return false;
2116       }
2117     }
2118     return true;
2119   };
2120   if (aOptions.contains(ClearOption::UnusedOnly)) {
2121     LOG_STATIC_FUNC(gImgLog, "imgLoader::ClearImageCache queue");
2122     // We have to make a temporary, since RemoveFromCache removes the element
2123     // from the queue, invalidating iterators.
2124     nsTArray<RefPtr<imgCacheEntry>> entries(mCacheQueue.GetNumElements());
2125     for (auto& entry : mCacheQueue) {
2126       if (ShouldRemove(entry)) {
2127         entries.AppendElement(entry);
2128       }
2129     }
2130
2131     // Iterate in reverse order to minimize array copying.
2132     for (auto& entry : entries) {
2133       if (!RemoveFromCache(entry)) {
2134         return NS_ERROR_FAILURE;
2135       }
2136     }
2137
2138     MOZ_ASSERT(chromeOnly || mCacheQueue.GetNumElements() == 0);
2139     return NS_OK;
2140   }
2141
2142   LOG_STATIC_FUNC(gImgLog, "imgLoader::ClearImageCache table");
2143   // We have to make a temporary, since RemoveFromCache removes the element
2144   // from the queue, invalidating iterators.
2145   const auto entries =
2146       ToTArray<nsTArray<RefPtr<imgCacheEntry>>>(mCache.Values());
2147   for (const auto& entry : entries) {
2148     if (!ShouldRemove(entry)) {
2149       continue;
2150     }
2151     if (!RemoveFromCache(entry)) {
2152       return NS_ERROR_FAILURE;
2153     }
2154   }
2155   MOZ_ASSERT(chromeOnly || mCache.IsEmpty());
2156   return NS_OK;
2157 }
2158
2159 void imgLoader::AddToUncachedImages(imgRequest* aRequest) {
2160   MutexAutoLock lock(mUncachedImagesMutex);
2161   mUncachedImages.Insert(aRequest);
2162 }
2163
2164 void imgLoader::RemoveFromUncachedImages(imgRequest* aRequest) {
2165   MutexAutoLock lock(mUncachedImagesMutex);
2166   mUncachedImages.Remove(aRequest);
2167 }
2168
2169 #define LOAD_FLAGS_CACHE_MASK \
2170   (nsIRequest::LOAD_BYPASS_CACHE | nsIRequest::LOAD_FROM_CACHE)
2171
2172 #define LOAD_FLAGS_VALIDATE_MASK                              \
2173   (nsIRequest::VALIDATE_ALWAYS | nsIRequest::VALIDATE_NEVER | \
2174    nsIRequest::VALIDATE_ONCE_PER_SESSION)
2175
2176 NS_IMETHODIMP
2177 imgLoader::LoadImageXPCOM(
2178     nsIURI* aURI, nsIURI* aInitialDocumentURI, nsIReferrerInfo* aReferrerInfo,
2179     nsIPrincipal* aTriggeringPrincipal, nsILoadGroup* aLoadGroup,
2180     imgINotificationObserver* aObserver, Document* aLoadingDocument,
2181     nsLoadFlags aLoadFlags, nsISupports* aCacheKey,
2182     nsContentPolicyType aContentPolicyType, imgIRequest** _retval) {
2183   // Optional parameter, so defaults to 0 (== TYPE_INVALID)
2184   if (!aContentPolicyType) {
2185     aContentPolicyType = nsIContentPolicy::TYPE_INTERNAL_IMAGE;
2186   }
2187   imgRequestProxy* proxy;
2188   nsresult rv =
2189       LoadImage(aURI, aInitialDocumentURI, aReferrerInfo, aTriggeringPrincipal,
2190                 0, aLoadGroup, aObserver, aLoadingDocument, aLoadingDocument,
2191                 aLoadFlags, aCacheKey, aContentPolicyType, u""_ns,
2192                 /* aUseUrgentStartForChannel */ false, /* aListPreload */ false,
2193                 0, FetchPriority::Auto, &proxy);
2194   *_retval = proxy;
2195   return rv;
2196 }
2197
2198 static void MakeRequestStaticIfNeeded(
2199     Document* aLoadingDocument, imgRequestProxy** aProxyAboutToGetReturned) {
2200   if (!aLoadingDocument || !aLoadingDocument->IsStaticDocument()) {
2201     return;
2202   }
2203
2204   if (!*aProxyAboutToGetReturned) {
2205     return;
2206   }
2207
2208   RefPtr<imgRequestProxy> proxy = dont_AddRef(*aProxyAboutToGetReturned);
2209   *aProxyAboutToGetReturned = nullptr;
2210
2211   RefPtr<imgRequestProxy> staticProxy =
2212       proxy->GetStaticRequest(aLoadingDocument);
2213   if (staticProxy != proxy) {
2214     proxy->CancelAndForgetObserver(NS_BINDING_ABORTED);
2215     proxy = std::move(staticProxy);
2216   }
2217   proxy.forget(aProxyAboutToGetReturned);
2218 }
2219
2220 bool imgLoader::IsImageAvailable(nsIURI* aURI,
2221                                  nsIPrincipal* aTriggeringPrincipal,
2222                                  CORSMode aCORSMode, Document* aDocument) {
2223   ImageCacheKey key(aURI, aCORSMode,
2224                     aTriggeringPrincipal->OriginAttributesRef(), aDocument);
2225   RefPtr<imgCacheEntry> entry;
2226   if (!mCache.Get(key, getter_AddRefs(entry)) || !entry) {
2227     return false;
2228   }
2229   RefPtr<imgRequest> request = entry->GetRequest();
2230   if (!request) {
2231     return false;
2232   }
2233   if (nsCOMPtr<nsILoadGroup> docLoadGroup = aDocument->GetDocumentLoadGroup()) {
2234     nsLoadFlags requestFlags = nsIRequest::LOAD_NORMAL;
2235     docLoadGroup->GetLoadFlags(&requestFlags);
2236     if (requestFlags & nsIRequest::LOAD_BYPASS_CACHE) {
2237       // If we're bypassing the cache, treat the image as not available.
2238       return false;
2239     }
2240   }
2241   return ValidateCORSMode(request, false, aCORSMode, aTriggeringPrincipal);
2242 }
2243
2244 nsresult imgLoader::LoadImage(
2245     nsIURI* aURI, nsIURI* aInitialDocumentURI, nsIReferrerInfo* aReferrerInfo,
2246     nsIPrincipal* aTriggeringPrincipal, uint64_t aRequestContextID,
2247     nsILoadGroup* aLoadGroup, imgINotificationObserver* aObserver,
2248     nsINode* aContext, Document* aLoadingDocument, nsLoadFlags aLoadFlags,
2249     nsISupports* aCacheKey, nsContentPolicyType aContentPolicyType,
2250     const nsAString& initiatorType, bool aUseUrgentStartForChannel,
2251     bool aLinkPreload, uint64_t aEarlyHintPreloaderId,
2252     FetchPriority aFetchPriority, imgRequestProxy** _retval) {
2253   VerifyCacheSizes();
2254
2255   NS_ASSERTION(aURI, "imgLoader::LoadImage -- NULL URI pointer");
2256
2257   if (!aURI) {
2258     return NS_ERROR_NULL_POINTER;
2259   }
2260
2261   auto makeStaticIfNeeded = mozilla::MakeScopeExit(
2262       [&] { MakeRequestStaticIfNeeded(aLoadingDocument, _retval); });
2263
2264   AUTO_PROFILER_LABEL_DYNAMIC_NSCSTRING("imgLoader::LoadImage", NETWORK,
2265                                         aURI->GetSpecOrDefault());
2266
2267   LOG_SCOPE_WITH_PARAM(gImgLog, "imgLoader::LoadImage", "aURI", aURI);
2268
2269   *_retval = nullptr;
2270
2271   RefPtr<imgRequest> request;
2272
2273   nsresult rv;
2274   nsLoadFlags requestFlags = nsIRequest::LOAD_NORMAL;
2275
2276 #ifdef DEBUG
2277   bool isPrivate = false;
2278
2279   if (aLoadingDocument) {
2280     isPrivate = nsContentUtils::IsInPrivateBrowsing(aLoadingDocument);
2281   } else if (aLoadGroup) {
2282     isPrivate = nsContentUtils::IsInPrivateBrowsing(aLoadGroup);
2283   }
2284   MOZ_ASSERT(isPrivate == mRespectPrivacy);
2285
2286   if (aLoadingDocument) {
2287     // The given load group should match that of the document if given. If
2288     // that isn't the case, then we need to add more plumbing to ensure we
2289     // block the document as well.
2290     nsCOMPtr<nsILoadGroup> docLoadGroup =
2291         aLoadingDocument->GetDocumentLoadGroup();
2292     MOZ_ASSERT(docLoadGroup == aLoadGroup);
2293   }
2294 #endif
2295
2296   // Get the default load flags from the loadgroup (if possible)...
2297   if (aLoadGroup) {
2298     aLoadGroup->GetLoadFlags(&requestFlags);
2299   }
2300   //
2301   // Merge the default load flags with those passed in via aLoadFlags.
2302   // Currently, *only* the caching, validation and background load flags
2303   // are merged...
2304   //
2305   // The flags in aLoadFlags take precedence over the default flags!
2306   //
2307   if (aLoadFlags & LOAD_FLAGS_CACHE_MASK) {
2308     // Override the default caching flags...
2309     requestFlags = (requestFlags & ~LOAD_FLAGS_CACHE_MASK) |
2310                    (aLoadFlags & LOAD_FLAGS_CACHE_MASK);
2311   }
2312   if (aLoadFlags & LOAD_FLAGS_VALIDATE_MASK) {
2313     // Override the default validation flags...
2314     requestFlags = (requestFlags & ~LOAD_FLAGS_VALIDATE_MASK) |
2315                    (aLoadFlags & LOAD_FLAGS_VALIDATE_MASK);
2316   }
2317   if (aLoadFlags & nsIRequest::LOAD_BACKGROUND) {
2318     // Propagate background loading...
2319     requestFlags |= nsIRequest::LOAD_BACKGROUND;
2320   }
2321
2322   if (aLinkPreload) {
2323     // Set background loading if it is <link rel=preload>
2324     requestFlags |= nsIRequest::LOAD_BACKGROUND;
2325   }
2326
2327   CORSMode corsmode = CORS_NONE;
2328   if (aLoadFlags & imgILoader::LOAD_CORS_ANONYMOUS) {
2329     corsmode = CORS_ANONYMOUS;
2330   } else if (aLoadFlags & imgILoader::LOAD_CORS_USE_CREDENTIALS) {
2331     corsmode = CORS_USE_CREDENTIALS;
2332   }
2333
2334   // Look in the preloaded images of loading document first.
2335   if (!aLinkPreload && aLoadingDocument) {
2336     // All Early Hints preloads are Link preloads, therefore we don't have a
2337     // Early Hints preload here
2338     MOZ_ASSERT(!aEarlyHintPreloaderId);
2339     auto key =
2340         PreloadHashKey::CreateAsImage(aURI, aTriggeringPrincipal, corsmode);
2341     if (RefPtr<PreloaderBase> preload =
2342             aLoadingDocument->Preloads().LookupPreload(key)) {
2343       RefPtr<imgRequestProxy> proxy = do_QueryObject(preload);
2344       MOZ_ASSERT(proxy);
2345
2346       MOZ_LOG(gImgLog, LogLevel::Debug,
2347               ("[this=%p] imgLoader::LoadImage -- preloaded [proxy=%p]"
2348                " [document=%p]\n",
2349                this, proxy.get(), aLoadingDocument));
2350
2351       // Removing the preload for this image to be in parity with Chromium.  Any
2352       // following regular image request will be reloaded using the regular
2353       // path: image cache, http cache, network.  Any following `<link
2354       // rel=preload as=image>` will start a new image preload that can be
2355       // satisfied from http cache or network.
2356       //
2357       // There is a spec discussion for "preload cache", see
2358       // https://github.com/w3c/preload/issues/97. And it is also not clear how
2359       // preload image interacts with list of available images, see
2360       // https://github.com/whatwg/html/issues/4474.
2361       proxy->RemoveSelf(aLoadingDocument);
2362       proxy->NotifyUsage(aLoadingDocument);
2363
2364       imgRequest* request = proxy->GetOwner();
2365       nsresult rv =
2366           CreateNewProxyForRequest(request, aURI, aLoadGroup, aLoadingDocument,
2367                                    aObserver, requestFlags, _retval);
2368       NS_ENSURE_SUCCESS(rv, rv);
2369
2370       imgRequestProxy* newProxy = *_retval;
2371       if (imgCacheValidator* validator = request->GetValidator()) {
2372         newProxy->MarkValidating();
2373         // Attach the proxy without notifying and this will add us to the load
2374         // group.
2375         validator->AddProxy(newProxy);
2376       } else {
2377         // It's OK to add here even if the request is done. If it is, it'll send
2378         // a OnStopRequest()and the proxy will be removed from the loadgroup in
2379         // imgRequestProxy::OnLoadComplete.
2380         newProxy->AddToLoadGroup();
2381         newProxy->NotifyListener();
2382       }
2383
2384       return NS_OK;
2385     }
2386   }
2387
2388   RefPtr<imgCacheEntry> entry;
2389
2390   // Look in the cache for our URI, and then validate it.
2391   // XXX For now ignore aCacheKey. We will need it in the future
2392   // for correctly dealing with image load requests that are a result
2393   // of post data.
2394   OriginAttributes attrs;
2395   if (aTriggeringPrincipal) {
2396     attrs = aTriggeringPrincipal->OriginAttributesRef();
2397   }
2398   ImageCacheKey key(aURI, corsmode, attrs, aLoadingDocument);
2399   if (mCache.Get(key, getter_AddRefs(entry)) && entry) {
2400     bool newChannelCreated = false;
2401     if (ValidateEntry(entry, aURI, aInitialDocumentURI, aReferrerInfo,
2402                       aLoadGroup, aObserver, aLoadingDocument, requestFlags,
2403                       aContentPolicyType, true, &newChannelCreated, _retval,
2404                       aTriggeringPrincipal, corsmode, aLinkPreload,
2405                       aEarlyHintPreloaderId, aFetchPriority)) {
2406       request = entry->GetRequest();
2407
2408       // If this entry has no proxies, its request has no reference to the
2409       // entry.
2410       if (entry->HasNoProxies()) {
2411         LOG_FUNC_WITH_PARAM(gImgLog,
2412                             "imgLoader::LoadImage() adding proxyless entry",
2413                             "uri", key.URI());
2414         MOZ_ASSERT(!request->HasCacheEntry(),
2415                    "Proxyless entry's request has cache entry!");
2416         request->SetCacheEntry(entry);
2417
2418         if (mCacheTracker && entry->GetExpirationState()->IsTracked()) {
2419           mCacheTracker->MarkUsed(entry);
2420         }
2421       }
2422
2423       entry->Touch();
2424
2425       if (!newChannelCreated) {
2426         // This is ugly but it's needed to report CSP violations. We have 3
2427         // scenarios:
2428         // - we don't have cache. We are not in this if() stmt. A new channel is
2429         //   created and that triggers the CSP checks.
2430         // - We have a cache entry and this is blocked by CSP directives.
2431         DebugOnly<bool> shouldLoad = ShouldLoadCachedImage(
2432             request, aLoadingDocument, aTriggeringPrincipal, aContentPolicyType,
2433             /* aSendCSPViolationReports */ true);
2434         MOZ_ASSERT(shouldLoad);
2435       }
2436     } else {
2437       // We can't use this entry. We'll try to load it off the network, and if
2438       // successful, overwrite the old entry in the cache with a new one.
2439       entry = nullptr;
2440     }
2441   }
2442
2443   // Keep the channel in this scope, so we can adjust its notificationCallbacks
2444   // later when we create the proxy.
2445   nsCOMPtr<nsIChannel> newChannel;
2446   // If we didn't get a cache hit, we need to load from the network.
2447   if (!request) {
2448     LOG_SCOPE(gImgLog, "imgLoader::LoadImage |cache miss|");
2449
2450     bool forcePrincipalCheck;
2451     rv = NewImageChannel(getter_AddRefs(newChannel), &forcePrincipalCheck, aURI,
2452                          aInitialDocumentURI, corsmode, aReferrerInfo,
2453                          aLoadGroup, requestFlags, aContentPolicyType,
2454                          aTriggeringPrincipal, aContext, mRespectPrivacy,
2455                          aEarlyHintPreloaderId, aFetchPriority);
2456     if (NS_FAILED(rv)) {
2457       return NS_ERROR_FAILURE;
2458     }
2459
2460     MOZ_ASSERT(NS_UsePrivateBrowsing(newChannel) == mRespectPrivacy);
2461
2462     NewRequestAndEntry(forcePrincipalCheck, this, key, getter_AddRefs(request),
2463                        getter_AddRefs(entry));
2464
2465     MOZ_LOG(gImgLog, LogLevel::Debug,
2466             ("[this=%p] imgLoader::LoadImage -- Created new imgRequest"
2467              " [request=%p]\n",
2468              this, request.get()));
2469
2470     nsCOMPtr<nsIClassOfService> cos(do_QueryInterface(newChannel));
2471     if (cos) {
2472       if (aUseUrgentStartForChannel && !aLinkPreload) {
2473         cos->AddClassFlags(nsIClassOfService::UrgentStart);
2474       }
2475
2476       if (StaticPrefs::network_http_tailing_enabled() &&
2477           aContentPolicyType == nsIContentPolicy::TYPE_INTERNAL_IMAGE_FAVICON) {
2478         cos->AddClassFlags(nsIClassOfService::Throttleable |
2479                            nsIClassOfService::Tail);
2480         nsCOMPtr<nsIHttpChannel> httpChannel(do_QueryInterface(newChannel));
2481         if (httpChannel) {
2482           Unused << httpChannel->SetRequestContextID(aRequestContextID);
2483         }
2484       }
2485     }
2486
2487     nsCOMPtr<nsILoadGroup> channelLoadGroup;
2488     newChannel->GetLoadGroup(getter_AddRefs(channelLoadGroup));
2489     rv = request->Init(aURI, aURI, /* aHadInsecureRedirect = */ false,
2490                        channelLoadGroup, newChannel, entry, aLoadingDocument,
2491                        aTriggeringPrincipal, corsmode, aReferrerInfo);
2492     if (NS_FAILED(rv)) {
2493       return NS_ERROR_FAILURE;
2494     }
2495
2496     // Add the initiator type for this image load
2497     nsCOMPtr<nsITimedChannel> timedChannel = do_QueryInterface(newChannel);
2498     if (timedChannel) {
2499       timedChannel->SetInitiatorType(initiatorType);
2500     }
2501
2502     // create the proxy listener
2503     nsCOMPtr<nsIStreamListener> listener = new ProxyListener(request.get());
2504
2505     MOZ_LOG(gImgLog, LogLevel::Debug,
2506             ("[this=%p] imgLoader::LoadImage -- Calling channel->AsyncOpen()\n",
2507              this));
2508
2509     mozilla::net::PredictorLearn(aURI, aInitialDocumentURI,
2510                                  nsINetworkPredictor::LEARN_LOAD_SUBRESOURCE,
2511                                  aLoadGroup);
2512
2513     nsresult openRes;
2514     openRes = newChannel->AsyncOpen(listener);
2515
2516     if (NS_FAILED(openRes)) {
2517       MOZ_LOG(
2518           gImgLog, LogLevel::Debug,
2519           ("[this=%p] imgLoader::LoadImage -- AsyncOpen() failed: 0x%" PRIx32
2520            "\n",
2521            this, static_cast<uint32_t>(openRes)));
2522       request->CancelAndAbort(openRes);
2523       return openRes;
2524     }
2525
2526     // Try to add the new request into the cache.
2527     PutIntoCache(key, entry);
2528   } else {
2529     LOG_MSG_WITH_PARAM(gImgLog, "imgLoader::LoadImage |cache hit|", "request",
2530                        request);
2531   }
2532
2533   // If we didn't get a proxy when validating the cache entry, we need to
2534   // create one.
2535   if (!*_retval) {
2536     // ValidateEntry() has three return values: "Is valid," "might be valid --
2537     // validating over network", and "not valid." If we don't have a _retval,
2538     // we know ValidateEntry is not validating over the network, so it's safe
2539     // to SetLoadId here because we know this request is valid for this context.
2540     //
2541     // Note, however, that this doesn't guarantee the behaviour we want (one
2542     // URL maps to the same image on a page) if we load the same image in a
2543     // different tab (see bug 528003), because its load id will get re-set, and
2544     // that'll cause us to validate over the network.
2545     request->SetLoadId(aLoadingDocument);
2546
2547     LOG_MSG(gImgLog, "imgLoader::LoadImage", "creating proxy request.");
2548     rv = CreateNewProxyForRequest(request, aURI, aLoadGroup, aLoadingDocument,
2549                                   aObserver, requestFlags, _retval);
2550     if (NS_FAILED(rv)) {
2551       return rv;
2552     }
2553
2554     imgRequestProxy* proxy = *_retval;
2555
2556     // Make sure that OnStatus/OnProgress calls have the right request set, if
2557     // we did create a channel here.
2558     if (newChannel) {
2559       nsCOMPtr<nsIInterfaceRequestor> requestor(
2560           new nsProgressNotificationProxy(newChannel, proxy));
2561       if (!requestor) {
2562         return NS_ERROR_OUT_OF_MEMORY;
2563       }
2564       newChannel->SetNotificationCallbacks(requestor);
2565     }
2566
2567     if (aLinkPreload) {
2568       MOZ_ASSERT(aLoadingDocument);
2569       auto preloadKey =
2570           PreloadHashKey::CreateAsImage(aURI, aTriggeringPrincipal, corsmode);
2571       proxy->NotifyOpen(preloadKey, aLoadingDocument, true);
2572     }
2573
2574     // Note that it's OK to add here even if the request is done.  If it is,
2575     // it'll send a OnStopRequest() to the proxy in imgRequestProxy::Notify and
2576     // the proxy will be removed from the loadgroup.
2577     proxy->AddToLoadGroup();
2578
2579     // If we're loading off the network, explicitly don't notify our proxy,
2580     // because necko (or things called from necko, such as imgCacheValidator)
2581     // are going to call our notifications asynchronously, and we can't make it
2582     // further asynchronous because observers might rely on imagelib completing
2583     // its work between the channel's OnStartRequest and OnStopRequest.
2584     if (!newChannel) {
2585       proxy->NotifyListener();
2586     }
2587
2588     return rv;
2589   }
2590
2591   NS_ASSERTION(*_retval, "imgLoader::LoadImage -- no return value");
2592
2593   return NS_OK;
2594 }
2595
2596 NS_IMETHODIMP
2597 imgLoader::LoadImageWithChannelXPCOM(nsIChannel* channel,
2598                                      imgINotificationObserver* aObserver,
2599                                      Document* aLoadingDocument,
2600                                      nsIStreamListener** listener,
2601                                      imgIRequest** _retval) {
2602   nsresult result;
2603   imgRequestProxy* proxy;
2604   result = LoadImageWithChannel(channel, aObserver, aLoadingDocument, listener,
2605                                 &proxy);
2606   *_retval = proxy;
2607   return result;
2608 }
2609
2610 nsresult imgLoader::LoadImageWithChannel(nsIChannel* channel,
2611                                          imgINotificationObserver* aObserver,
2612                                          Document* aLoadingDocument,
2613                                          nsIStreamListener** listener,
2614                                          imgRequestProxy** _retval) {
2615   NS_ASSERTION(channel,
2616                "imgLoader::LoadImageWithChannel -- NULL channel pointer");
2617
2618   MOZ_ASSERT(NS_UsePrivateBrowsing(channel) == mRespectPrivacy);
2619
2620   auto makeStaticIfNeeded = mozilla::MakeScopeExit(
2621       [&] { MakeRequestStaticIfNeeded(aLoadingDocument, _retval); });
2622
2623   LOG_SCOPE(gImgLog, "imgLoader::LoadImageWithChannel");
2624   RefPtr<imgRequest> request;
2625
2626   nsCOMPtr<nsIURI> uri;
2627   channel->GetURI(getter_AddRefs(uri));
2628
2629   NS_ENSURE_TRUE(channel, NS_ERROR_FAILURE);
2630   nsCOMPtr<nsILoadInfo> loadInfo = channel->LoadInfo();
2631
2632   OriginAttributes attrs = loadInfo->GetOriginAttributes();
2633
2634   // TODO: Get a meaningful cors mode from the caller probably?
2635   const auto corsMode = CORS_NONE;
2636   ImageCacheKey key(uri, corsMode, attrs, aLoadingDocument);
2637
2638   nsLoadFlags requestFlags = nsIRequest::LOAD_NORMAL;
2639   channel->GetLoadFlags(&requestFlags);
2640
2641   RefPtr<imgCacheEntry> entry;
2642
2643   if (requestFlags & nsIRequest::LOAD_BYPASS_CACHE) {
2644     RemoveFromCache(key);
2645   } else {
2646     // Look in the cache for our URI, and then validate it.
2647     // XXX For now ignore aCacheKey. We will need it in the future
2648     // for correctly dealing with image load requests that are a result
2649     // of post data.
2650     if (mCache.Get(key, getter_AddRefs(entry)) && entry) {
2651       // We don't want to kick off another network load. So we ask
2652       // ValidateEntry to only do validation without creating a new proxy. If
2653       // it says that the entry isn't valid any more, we'll only use the entry
2654       // we're getting if the channel is loading from the cache anyways.
2655       //
2656       // XXX -- should this be changed? it's pretty much verbatim from the old
2657       // code, but seems nonsensical.
2658       //
2659       // Since aCanMakeNewChannel == false, we don't need to pass content policy
2660       // type/principal/etc
2661
2662       nsCOMPtr<nsILoadInfo> loadInfo = channel->LoadInfo();
2663       // if there is a loadInfo, use the right contentType, otherwise
2664       // default to the internal image type
2665       nsContentPolicyType policyType = loadInfo->InternalContentPolicyType();
2666
2667       if (ValidateEntry(entry, uri, nullptr, nullptr, nullptr, aObserver,
2668                         aLoadingDocument, requestFlags, policyType, false,
2669                         nullptr, nullptr, nullptr, corsMode, false, 0,
2670                         FetchPriority::Auto)) {
2671         request = entry->GetRequest();
2672       } else {
2673         nsCOMPtr<nsICacheInfoChannel> cacheChan(do_QueryInterface(channel));
2674         bool bUseCacheCopy;
2675
2676         if (cacheChan) {
2677           cacheChan->IsFromCache(&bUseCacheCopy);
2678         } else {
2679           bUseCacheCopy = false;
2680         }
2681
2682         if (!bUseCacheCopy) {
2683           entry = nullptr;
2684         } else {
2685           request = entry->GetRequest();
2686         }
2687       }
2688
2689       if (request && entry) {
2690         // If this entry has no proxies, its request has no reference to
2691         // the entry.
2692         if (entry->HasNoProxies()) {
2693           LOG_FUNC_WITH_PARAM(
2694               gImgLog,
2695               "imgLoader::LoadImageWithChannel() adding proxyless entry", "uri",
2696               key.URI());
2697           MOZ_ASSERT(!request->HasCacheEntry(),
2698                      "Proxyless entry's request has cache entry!");
2699           request->SetCacheEntry(entry);
2700
2701           if (mCacheTracker && entry->GetExpirationState()->IsTracked()) {
2702             mCacheTracker->MarkUsed(entry);
2703           }
2704         }
2705       }
2706     }
2707   }
2708
2709   nsCOMPtr<nsILoadGroup> loadGroup;
2710   channel->GetLoadGroup(getter_AddRefs(loadGroup));
2711
2712 #ifdef DEBUG
2713   if (aLoadingDocument) {
2714     // The load group of the channel should always match that of the
2715     // document if given. If that isn't the case, then we need to add more
2716     // plumbing to ensure we block the document as well.
2717     nsCOMPtr<nsILoadGroup> docLoadGroup =
2718         aLoadingDocument->GetDocumentLoadGroup();
2719     MOZ_ASSERT(docLoadGroup == loadGroup);
2720   }
2721 #endif
2722
2723   // Filter out any load flags not from nsIRequest
2724   requestFlags &= nsIRequest::LOAD_REQUESTMASK;
2725
2726   nsresult rv = NS_OK;
2727   if (request) {
2728     // we have this in our cache already.. cancel the current (document) load
2729
2730     // this should fire an OnStopRequest
2731     channel->Cancel(NS_ERROR_PARSED_DATA_CACHED);
2732
2733     *listener = nullptr;  // give them back a null nsIStreamListener
2734
2735     rv = CreateNewProxyForRequest(request, uri, loadGroup, aLoadingDocument,
2736                                   aObserver, requestFlags, _retval);
2737     static_cast<imgRequestProxy*>(*_retval)->NotifyListener();
2738   } else {
2739     // We use originalURI here to fulfil the imgIRequest contract on GetURI.
2740     nsCOMPtr<nsIURI> originalURI;
2741     channel->GetOriginalURI(getter_AddRefs(originalURI));
2742
2743     // XXX(seth): We should be able to just use |key| here, except that |key| is
2744     // constructed above with the *current URI* and not the *original URI*. I'm
2745     // pretty sure this is a bug, and it's preventing us from ever getting a
2746     // cache hit in LoadImageWithChannel when redirects are involved.
2747     ImageCacheKey originalURIKey(originalURI, corsMode, attrs,
2748                                  aLoadingDocument);
2749
2750     // Default to doing a principal check because we don't know who
2751     // started that load and whether their principal ended up being
2752     // inherited on the channel.
2753     NewRequestAndEntry(/* aForcePrincipalCheckForCacheEntry = */ true, this,
2754                        originalURIKey, getter_AddRefs(request),
2755                        getter_AddRefs(entry));
2756
2757     // No principal specified here, because we're not passed one.
2758     // In LoadImageWithChannel, the redirects that may have been
2759     // associated with this load would have gone through necko.
2760     // We only have the final URI in ImageLib and hence don't know
2761     // if the request went through insecure redirects.  But if it did,
2762     // the necko cache should have handled that (since all necko cache hits
2763     // including the redirects will go through content policy).  Hence, we
2764     // can set aHadInsecureRedirect to false here.
2765     rv = request->Init(originalURI, uri, /* aHadInsecureRedirect = */ false,
2766                        channel, channel, entry, aLoadingDocument, nullptr,
2767                        corsMode, nullptr);
2768     NS_ENSURE_SUCCESS(rv, rv);
2769
2770     RefPtr<ProxyListener> pl =
2771         new ProxyListener(static_cast<nsIStreamListener*>(request.get()));
2772     pl.forget(listener);
2773
2774     // Try to add the new request into the cache.
2775     PutIntoCache(originalURIKey, entry);
2776
2777     rv = CreateNewProxyForRequest(request, originalURI, loadGroup,
2778                                   aLoadingDocument, aObserver, requestFlags,
2779                                   _retval);
2780
2781     // Explicitly don't notify our proxy, because we're loading off the
2782     // network, and necko (or things called from necko, such as
2783     // imgCacheValidator) are going to call our notifications asynchronously,
2784     // and we can't make it further asynchronous because observers might rely
2785     // on imagelib completing its work between the channel's OnStartRequest and
2786     // OnStopRequest.
2787   }
2788
2789   if (NS_FAILED(rv)) {
2790     return rv;
2791   }
2792
2793   (*_retval)->AddToLoadGroup();
2794   return rv;
2795 }
2796
2797 bool imgLoader::SupportImageWithMimeType(const nsACString& aMimeType,
2798                                          AcceptedMimeTypes aAccept
2799                                          /* = AcceptedMimeTypes::IMAGES */) {
2800   nsAutoCString mimeType(aMimeType);
2801   ToLowerCase(mimeType);
2802
2803   if (aAccept == AcceptedMimeTypes::IMAGES_AND_DOCUMENTS &&
2804       mimeType.EqualsLiteral("image/svg+xml")) {
2805     return true;
2806   }
2807
2808   DecoderType type = DecoderFactory::GetDecoderType(mimeType.get());
2809   return type != DecoderType::UNKNOWN;
2810 }
2811
2812 NS_IMETHODIMP
2813 imgLoader::GetMIMETypeFromContent(nsIRequest* aRequest,
2814                                   const uint8_t* aContents, uint32_t aLength,
2815                                   nsACString& aContentType) {
2816   nsCOMPtr<nsIChannel> channel(do_QueryInterface(aRequest));
2817   if (channel) {
2818     nsCOMPtr<nsILoadInfo> loadInfo = channel->LoadInfo();
2819     if (loadInfo->GetSkipContentSniffing()) {
2820       return NS_ERROR_NOT_AVAILABLE;
2821     }
2822   }
2823
2824   nsresult rv =
2825       GetMimeTypeFromContent((const char*)aContents, aLength, aContentType);
2826   if (NS_SUCCEEDED(rv) && channel && XRE_IsParentProcess()) {
2827     if (RefPtr<mozilla::net::nsHttpChannel> httpChannel =
2828             do_QueryObject(channel)) {
2829       // If the image type pattern matching algorithm given bytes does not
2830       // return undefined, then disable the further check and allow the
2831       // response.
2832       httpChannel->DisableIsOpaqueResponseAllowedAfterSniffCheck(
2833           mozilla::net::nsHttpChannel::SnifferType::Image);
2834     }
2835   }
2836
2837   return rv;
2838 }
2839
2840 /* static */
2841 nsresult imgLoader::GetMimeTypeFromContent(const char* aContents,
2842                                            uint32_t aLength,
2843                                            nsACString& aContentType) {
2844   nsAutoCString detected;
2845
2846   /* Is it a GIF? */
2847   if (aLength >= 6 &&
2848       (!strncmp(aContents, "GIF87a", 6) || !strncmp(aContents, "GIF89a", 6))) {
2849     aContentType.AssignLiteral(IMAGE_GIF);
2850
2851     /* or a PNG? */
2852   } else if (aLength >= 8 && ((unsigned char)aContents[0] == 0x89 &&
2853                               (unsigned char)aContents[1] == 0x50 &&
2854                               (unsigned char)aContents[2] == 0x4E &&
2855                               (unsigned char)aContents[3] == 0x47 &&
2856                               (unsigned char)aContents[4] == 0x0D &&
2857                               (unsigned char)aContents[5] == 0x0A &&
2858                               (unsigned char)aContents[6] == 0x1A &&
2859                               (unsigned char)aContents[7] == 0x0A)) {
2860     aContentType.AssignLiteral(IMAGE_PNG);
2861
2862     /* maybe a JPEG (JFIF)? */
2863     /* JFIF files start with SOI APP0 but older files can start with SOI DQT
2864      * so we test for SOI followed by any marker, i.e. FF D8 FF
2865      * this will also work for SPIFF JPEG files if they appear in the future.
2866      *
2867      * (JFIF is 0XFF 0XD8 0XFF 0XE0 <skip 2> 0X4A 0X46 0X49 0X46 0X00)
2868      */
2869   } else if (aLength >= 3 && ((unsigned char)aContents[0]) == 0xFF &&
2870              ((unsigned char)aContents[1]) == 0xD8 &&
2871              ((unsigned char)aContents[2]) == 0xFF) {
2872     aContentType.AssignLiteral(IMAGE_JPEG);
2873
2874     /* or how about ART? */
2875     /* ART begins with JG (4A 47). Major version offset 2.
2876      * Minor version offset 3. Offset 4 must be nullptr.
2877      */
2878   } else if (aLength >= 5 && ((unsigned char)aContents[0]) == 0x4a &&
2879              ((unsigned char)aContents[1]) == 0x47 &&
2880              ((unsigned char)aContents[4]) == 0x00) {
2881     aContentType.AssignLiteral(IMAGE_ART);
2882
2883   } else if (aLength >= 2 && !strncmp(aContents, "BM", 2)) {
2884     aContentType.AssignLiteral(IMAGE_BMP);
2885
2886     // ICOs always begin with a 2-byte 0 followed by a 2-byte 1.
2887     // CURs begin with 2-byte 0 followed by 2-byte 2.
2888   } else if (aLength >= 4 && (!memcmp(aContents, "\000\000\001\000", 4) ||
2889                               !memcmp(aContents, "\000\000\002\000", 4))) {
2890     aContentType.AssignLiteral(IMAGE_ICO);
2891
2892     // WebPs always begin with RIFF, a 32-bit length, and WEBP.
2893   } else if (aLength >= 12 && !memcmp(aContents, "RIFF", 4) &&
2894              !memcmp(aContents + 8, "WEBP", 4)) {
2895     aContentType.AssignLiteral(IMAGE_WEBP);
2896
2897   } else if (MatchesMP4(reinterpret_cast<const uint8_t*>(aContents), aLength,
2898                         detected) &&
2899              detected.Equals(IMAGE_AVIF)) {
2900     aContentType.AssignLiteral(IMAGE_AVIF);
2901   } else if ((aLength >= 2 && !memcmp(aContents, "\xFF\x0A", 2)) ||
2902              (aLength >= 12 &&
2903               !memcmp(aContents, "\x00\x00\x00\x0CJXL \x0D\x0A\x87\x0A", 12))) {
2904     // Each version is for containerless and containerful files respectively.
2905     aContentType.AssignLiteral(IMAGE_JXL);
2906   } else {
2907     /* none of the above?  I give up */
2908     return NS_ERROR_NOT_AVAILABLE;
2909   }
2910
2911   return NS_OK;
2912 }
2913
2914 /**
2915  * proxy stream listener class used to handle multipart/x-mixed-replace
2916  */
2917
2918 #include "nsIRequest.h"
2919 #include "nsIStreamConverterService.h"
2920
2921 NS_IMPL_ISUPPORTS(ProxyListener, nsIStreamListener,
2922                   nsIThreadRetargetableStreamListener, nsIRequestObserver)
2923
2924 ProxyListener::ProxyListener(nsIStreamListener* dest) : mDestListener(dest) {}
2925
2926 ProxyListener::~ProxyListener() = default;
2927
2928 /** nsIRequestObserver methods **/
2929
2930 NS_IMETHODIMP
2931 ProxyListener::OnStartRequest(nsIRequest* aRequest) {
2932   if (!mDestListener) {
2933     return NS_ERROR_FAILURE;
2934   }
2935
2936   nsCOMPtr<nsIChannel> channel(do_QueryInterface(aRequest));
2937   if (channel) {
2938     // We need to set the initiator type for the image load
2939     nsCOMPtr<nsITimedChannel> timedChannel = do_QueryInterface(channel);
2940     if (timedChannel) {
2941       nsAutoString type;
2942       timedChannel->GetInitiatorType(type);
2943       if (type.IsEmpty()) {
2944         timedChannel->SetInitiatorType(u"img"_ns);
2945       }
2946     }
2947
2948     nsAutoCString contentType;
2949     nsresult rv = channel->GetContentType(contentType);
2950
2951     if (!contentType.IsEmpty()) {
2952       /* If multipart/x-mixed-replace content, we'll insert a MIME decoder
2953          in the pipeline to handle the content and pass it along to our
2954          original listener.
2955        */
2956       if ("multipart/x-mixed-replace"_ns.Equals(contentType)) {
2957         nsCOMPtr<nsIStreamConverterService> convServ(
2958             do_GetService("@mozilla.org/streamConverters;1", &rv));
2959         if (NS_SUCCEEDED(rv)) {
2960           nsCOMPtr<nsIStreamListener> toListener(mDestListener);
2961           nsCOMPtr<nsIStreamListener> fromListener;
2962
2963           rv = convServ->AsyncConvertData("multipart/x-mixed-replace", "*/*",
2964                                           toListener, nullptr,
2965                                           getter_AddRefs(fromListener));
2966           if (NS_SUCCEEDED(rv)) {
2967             mDestListener = fromListener;
2968           }
2969         }
2970       }
2971     }
2972   }
2973
2974   return mDestListener->OnStartRequest(aRequest);
2975 }
2976
2977 NS_IMETHODIMP
2978 ProxyListener::OnStopRequest(nsIRequest* aRequest, nsresult status) {
2979   if (!mDestListener) {
2980     return NS_ERROR_FAILURE;
2981   }
2982
2983   return mDestListener->OnStopRequest(aRequest, status);
2984 }
2985
2986 /** nsIStreamListener methods **/
2987
2988 NS_IMETHODIMP
2989 ProxyListener::OnDataAvailable(nsIRequest* aRequest, nsIInputStream* inStr,
2990                                uint64_t sourceOffset, uint32_t count) {
2991   if (!mDestListener) {
2992     return NS_ERROR_FAILURE;
2993   }
2994
2995   return mDestListener->OnDataAvailable(aRequest, inStr, sourceOffset, count);
2996 }
2997
2998 NS_IMETHODIMP
2999 ProxyListener::OnDataFinished(nsresult aStatus) {
3000   if (!mDestListener) {
3001     return NS_ERROR_FAILURE;
3002   }
3003   nsCOMPtr<nsIThreadRetargetableStreamListener> retargetableListener =
3004       do_QueryInterface(mDestListener);
3005   if (retargetableListener) {
3006     return retargetableListener->OnDataFinished(aStatus);
3007   }
3008
3009   return NS_OK;
3010 }
3011
3012 /** nsThreadRetargetableStreamListener methods **/
3013 NS_IMETHODIMP
3014 ProxyListener::CheckListenerChain() {
3015   NS_ASSERTION(NS_IsMainThread(), "Should be on the main thread!");
3016   nsresult rv = NS_OK;
3017   nsCOMPtr<nsIThreadRetargetableStreamListener> retargetableListener =
3018       do_QueryInterface(mDestListener, &rv);
3019   if (retargetableListener) {
3020     rv = retargetableListener->CheckListenerChain();
3021   }
3022   MOZ_LOG(
3023       gImgLog, LogLevel::Debug,
3024       ("ProxyListener::CheckListenerChain %s [this=%p listener=%p rv=%" PRIx32
3025        "]",
3026        (NS_SUCCEEDED(rv) ? "success" : "failure"), this,
3027        (nsIStreamListener*)mDestListener, static_cast<uint32_t>(rv)));
3028   return rv;
3029 }
3030
3031 /**
3032  * http validate class.  check a channel for a 304
3033  */
3034
3035 NS_IMPL_ISUPPORTS(imgCacheValidator, nsIStreamListener, nsIRequestObserver,
3036                   nsIThreadRetargetableStreamListener, nsIChannelEventSink,
3037                   nsIInterfaceRequestor, nsIAsyncVerifyRedirectCallback)
3038
3039 imgCacheValidator::imgCacheValidator(nsProgressNotificationProxy* progress,
3040                                      imgLoader* loader, imgRequest* request,
3041                                      Document* aDocument,
3042                                      uint64_t aInnerWindowId,
3043                                      bool forcePrincipalCheckForCacheEntry)
3044     : mProgressProxy(progress),
3045       mRequest(request),
3046       mDocument(aDocument),
3047       mInnerWindowId(aInnerWindowId),
3048       mImgLoader(loader),
3049       mHadInsecureRedirect(false) {
3050   NewRequestAndEntry(forcePrincipalCheckForCacheEntry, loader,
3051                      mRequest->CacheKey(), getter_AddRefs(mNewRequest),
3052                      getter_AddRefs(mNewEntry));
3053 }
3054
3055 imgCacheValidator::~imgCacheValidator() {
3056   if (mRequest) {
3057     // If something went wrong, and we never unblocked the requests waiting on
3058     // validation, now is our last chance. We will cancel the new request and
3059     // switch the waiting proxies to it.
3060     UpdateProxies(/* aCancelRequest */ true, /* aSyncNotify */ false);
3061   }
3062 }
3063
3064 void imgCacheValidator::AddProxy(imgRequestProxy* aProxy) {
3065   // aProxy needs to be in the loadgroup since we're validating from
3066   // the network.
3067   aProxy->AddToLoadGroup();
3068
3069   mProxies.AppendElement(aProxy);
3070 }
3071
3072 void imgCacheValidator::RemoveProxy(imgRequestProxy* aProxy) {
3073   mProxies.RemoveElement(aProxy);
3074 }
3075
3076 void imgCacheValidator::UpdateProxies(bool aCancelRequest, bool aSyncNotify) {
3077   MOZ_ASSERT(mRequest);
3078
3079   // Clear the validator before updating the proxies. The notifications may
3080   // clone an existing request, and its state could be inconsistent.
3081   mRequest->SetValidator(nullptr);
3082   mRequest = nullptr;
3083
3084   // If an error occurred, we will want to cancel the new request, and make the
3085   // validating proxies point to it. Any proxies still bound to the original
3086   // request which are not validating should remain untouched.
3087   if (aCancelRequest) {
3088     MOZ_ASSERT(mNewRequest);
3089     mNewRequest->CancelAndAbort(NS_BINDING_ABORTED);
3090   }
3091
3092   // We have finished validating the request, so we can safely take ownership
3093   // of the proxy list. imgRequestProxy::SyncNotifyListener can mutate the list
3094   // if imgRequestProxy::CancelAndForgetObserver is called by its owner. Note
3095   // that any potential notifications should still be suppressed in
3096   // imgRequestProxy::ChangeOwner because we haven't cleared the validating
3097   // flag yet, and thus they will remain deferred.
3098   AutoTArray<RefPtr<imgRequestProxy>, 4> proxies(std::move(mProxies));
3099
3100   for (auto& proxy : proxies) {
3101     // First update the state of all proxies before notifying any of them
3102     // to ensure a consistent state (e.g. in case the notification causes
3103     // other proxies to be touched indirectly.)
3104     MOZ_ASSERT(proxy->IsValidating());
3105     MOZ_ASSERT(proxy->NotificationsDeferred(),
3106                "Proxies waiting on cache validation should be "
3107                "deferring notifications!");
3108     if (mNewRequest) {
3109       proxy->ChangeOwner(mNewRequest);
3110     }
3111     proxy->ClearValidating();
3112   }
3113
3114   mNewRequest = nullptr;
3115   mNewEntry = nullptr;
3116
3117   for (auto& proxy : proxies) {
3118     if (aSyncNotify) {
3119       // Notify synchronously, because the caller knows we are already in an
3120       // asynchronously-called function (e.g. OnStartRequest).
3121       proxy->SyncNotifyListener();
3122     } else {
3123       // Notify asynchronously, because the caller does not know our current
3124       // call state (e.g. ~imgCacheValidator).
3125       proxy->NotifyListener();
3126     }
3127   }
3128 }
3129
3130 /** nsIRequestObserver methods **/
3131
3132 NS_IMETHODIMP
3133 imgCacheValidator::OnStartRequest(nsIRequest* aRequest) {
3134   // We may be holding on to a document, so ensure that it's released.
3135   RefPtr<Document> document = mDocument.forget();
3136
3137   // If for some reason we don't still have an existing request (probably
3138   // because OnStartRequest got delivered more than once), just bail.
3139   if (!mRequest) {
3140     MOZ_ASSERT_UNREACHABLE("OnStartRequest delivered more than once?");
3141     aRequest->CancelWithReason(NS_BINDING_ABORTED,
3142                                "OnStartRequest delivered more than once?"_ns);
3143     return NS_ERROR_FAILURE;
3144   }
3145
3146   // If this request is coming from cache and has the same URI as our
3147   // imgRequest, the request all our proxies are pointing at is valid, and all
3148   // we have to do is tell them to notify their listeners.
3149   nsCOMPtr<nsICacheInfoChannel> cacheChan(do_QueryInterface(aRequest));
3150   nsCOMPtr<nsIChannel> channel(do_QueryInterface(aRequest));
3151   if (cacheChan && channel) {
3152     bool isFromCache = false;
3153     cacheChan->IsFromCache(&isFromCache);
3154
3155     nsCOMPtr<nsIURI> channelURI;
3156     channel->GetURI(getter_AddRefs(channelURI));
3157
3158     nsCOMPtr<nsIURI> finalURI;
3159     mRequest->GetFinalURI(getter_AddRefs(finalURI));
3160
3161     bool sameURI = false;
3162     if (channelURI && finalURI) {
3163       channelURI->Equals(finalURI, &sameURI);
3164     }
3165
3166     if (isFromCache && sameURI) {
3167       // We don't need to load this any more.
3168       aRequest->CancelWithReason(NS_BINDING_ABORTED,
3169                                  "imgCacheValidator::OnStartRequest"_ns);
3170       mNewRequest = nullptr;
3171
3172       // Clear the validator before updating the proxies. The notifications may
3173       // clone an existing request, and its state could be inconsistent.
3174       mRequest->SetLoadId(document);
3175       mRequest->SetInnerWindowID(mInnerWindowId);
3176       UpdateProxies(/* aCancelRequest */ false, /* aSyncNotify */ true);
3177       return NS_OK;
3178     }
3179   }
3180
3181   // We can't load out of cache. We have to create a whole new request for the
3182   // data that's coming in off the channel.
3183   nsCOMPtr<nsIURI> uri;
3184   mRequest->GetURI(getter_AddRefs(uri));
3185
3186   LOG_MSG_WITH_PARAM(gImgLog,
3187                      "imgCacheValidator::OnStartRequest creating new request",
3188                      "uri", uri);
3189
3190   CORSMode corsmode = mRequest->GetCORSMode();
3191   nsCOMPtr<nsIReferrerInfo> referrerInfo = mRequest->GetReferrerInfo();
3192   nsCOMPtr<nsIPrincipal> triggeringPrincipal =
3193       mRequest->GetTriggeringPrincipal();
3194
3195   // Doom the old request's cache entry
3196   mRequest->RemoveFromCache();
3197
3198   // We use originalURI here to fulfil the imgIRequest contract on GetURI.
3199   nsCOMPtr<nsIURI> originalURI;
3200   channel->GetOriginalURI(getter_AddRefs(originalURI));
3201   nsresult rv = mNewRequest->Init(originalURI, uri, mHadInsecureRedirect,
3202                                   aRequest, channel, mNewEntry, document,
3203                                   triggeringPrincipal, corsmode, referrerInfo);
3204   if (NS_FAILED(rv)) {
3205     UpdateProxies(/* aCancelRequest */ true, /* aSyncNotify */ true);
3206     return rv;
3207   }
3208
3209   mDestListener = new ProxyListener(mNewRequest);
3210
3211   // Try to add the new request into the cache. Note that the entry must be in
3212   // the cache before the proxies' ownership changes, because adding a proxy
3213   // changes the caching behaviour for imgRequests.
3214   mImgLoader->PutIntoCache(mNewRequest->CacheKey(), mNewEntry);
3215   UpdateProxies(/* aCancelRequest */ false, /* aSyncNotify */ true);
3216   return mDestListener->OnStartRequest(aRequest);
3217 }
3218
3219 NS_IMETHODIMP
3220 imgCacheValidator::OnStopRequest(nsIRequest* aRequest, nsresult status) {
3221   // Be sure we've released the document that we may have been holding on to.
3222   mDocument = nullptr;
3223
3224   if (!mDestListener) {
3225     return NS_OK;
3226   }
3227
3228   return mDestListener->OnStopRequest(aRequest, status);
3229 }
3230
3231 /** nsIStreamListener methods **/
3232
3233 NS_IMETHODIMP
3234 imgCacheValidator::OnDataAvailable(nsIRequest* aRequest, nsIInputStream* inStr,
3235                                    uint64_t sourceOffset, uint32_t count) {
3236   if (!mDestListener) {
3237     // XXX see bug 113959
3238     uint32_t _retval;
3239     inStr->ReadSegments(NS_DiscardSegment, nullptr, count, &_retval);
3240     return NS_OK;
3241   }
3242
3243   return mDestListener->OnDataAvailable(aRequest, inStr, sourceOffset, count);
3244 }
3245
3246 NS_IMETHODIMP
3247 imgCacheValidator::OnDataFinished(nsresult aStatus) {
3248   if (!mDestListener) {
3249     return NS_ERROR_FAILURE;
3250   }
3251   nsCOMPtr<nsIThreadRetargetableStreamListener> retargetableListener =
3252       do_QueryInterface(mDestListener);
3253   if (retargetableListener) {
3254     return retargetableListener->OnDataFinished(aStatus);
3255   }
3256
3257   return NS_OK;
3258 }
3259
3260 /** nsIThreadRetargetableStreamListener methods **/
3261
3262 NS_IMETHODIMP
3263 imgCacheValidator::CheckListenerChain() {
3264   NS_ASSERTION(NS_IsMainThread(), "Should be on the main thread!");
3265   nsresult rv = NS_OK;
3266   nsCOMPtr<nsIThreadRetargetableStreamListener> retargetableListener =
3267       do_QueryInterface(mDestListener, &rv);
3268   if (retargetableListener) {
3269     rv = retargetableListener->CheckListenerChain();
3270   }
3271   MOZ_LOG(
3272       gImgLog, LogLevel::Debug,
3273       ("[this=%p] imgCacheValidator::CheckListenerChain -- rv %" PRId32 "=%s",
3274        this, static_cast<uint32_t>(rv),
3275        NS_SUCCEEDED(rv) ? "succeeded" : "failed"));
3276   return rv;
3277 }
3278
3279 /** nsIInterfaceRequestor methods **/
3280
3281 NS_IMETHODIMP
3282 imgCacheValidator::GetInterface(const nsIID& aIID, void** aResult) {
3283   if (aIID.Equals(NS_GET_IID(nsIChannelEventSink))) {
3284     return QueryInterface(aIID, aResult);
3285   }
3286
3287   return mProgressProxy->GetInterface(aIID, aResult);
3288 }
3289
3290 // These functions are materially the same as the same functions in imgRequest.
3291 // We duplicate them because we're verifying whether cache loads are necessary,
3292 // not unconditionally loading.
3293
3294 /** nsIChannelEventSink methods **/
3295 NS_IMETHODIMP
3296 imgCacheValidator::AsyncOnChannelRedirect(
3297     nsIChannel* oldChannel, nsIChannel* newChannel, uint32_t flags,
3298     nsIAsyncVerifyRedirectCallback* callback) {
3299   // Note all cache information we get from the old channel.
3300   mNewRequest->SetCacheValidation(mNewEntry, oldChannel);
3301
3302   // If the previous URI is a non-HTTPS URI, record that fact for later use by
3303   // security code, which needs to know whether there is an insecure load at any
3304   // point in the redirect chain.
3305   nsCOMPtr<nsIURI> oldURI;
3306   bool schemeLocal = false;
3307   if (NS_FAILED(oldChannel->GetURI(getter_AddRefs(oldURI))) ||
3308       NS_FAILED(NS_URIChainHasFlags(
3309           oldURI, nsIProtocolHandler::URI_IS_LOCAL_RESOURCE, &schemeLocal)) ||
3310       (!oldURI->SchemeIs("https") && !oldURI->SchemeIs("chrome") &&
3311        !schemeLocal)) {
3312     mHadInsecureRedirect = true;
3313   }
3314
3315   // Prepare for callback
3316   mRedirectCallback = callback;
3317   mRedirectChannel = newChannel;
3318
3319   return mProgressProxy->AsyncOnChannelRedirect(oldChannel, newChannel, flags,
3320                                                 this);
3321 }
3322
3323 NS_IMETHODIMP
3324 imgCacheValidator::OnRedirectVerifyCallback(nsresult aResult) {
3325   // If we've already been told to abort, just do so.
3326   if (NS_FAILED(aResult)) {
3327     mRedirectCallback->OnRedirectVerifyCallback(aResult);
3328     mRedirectCallback = nullptr;
3329     mRedirectChannel = nullptr;
3330     return NS_OK;
3331   }
3332
3333   // make sure we have a protocol that returns data rather than opens
3334   // an external application, e.g. mailto:
3335   nsCOMPtr<nsIURI> uri;
3336   mRedirectChannel->GetURI(getter_AddRefs(uri));
3337
3338   nsresult result = NS_OK;
3339
3340   if (nsContentUtils::IsExternalProtocol(uri)) {
3341     result = NS_ERROR_ABORT;
3342   }
3343
3344   mRedirectCallback->OnRedirectVerifyCallback(result);
3345   mRedirectCallback = nullptr;
3346   mRedirectChannel = nullptr;
3347   return NS_OK;
3348 }