dom/base/nsImageLoadingContent.cpp

   1 /* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
   2 // vim: ft=cpp tw=78 sw=2 et ts=2
   3 /* This Source Code Form is subject to the terms of the Mozilla Public
   4  * License, v. 2.0. If a copy of the MPL was not distributed with this
   5  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
   6
   7 /*
   8  * A base class which implements nsIImageLoadingContent and can be
   9  * subclassed by various content nodes that want to provide image
  10  * loading functionality (eg <img>, <object>, etc).
  11  */
  12
  13 #include "nsImageLoadingContent.h"
  14 #include "nsAutoPtr.h"
  15 #include "nsError.h"
  16 #include "nsIContent.h"
  17 #include "nsIDocument.h"
  18 #include "nsIScriptGlobalObject.h"
  19 #include "nsIDOMWindow.h"
  20 #include "nsServiceManagerUtils.h"
  21 #include "nsContentPolicyUtils.h"
  22 #include "nsIURI.h"
  23 #include "nsILoadGroup.h"
  24 #include "imgIContainer.h"
  25 #include "imgLoader.h"
  26 #include "imgRequestProxy.h"
  27 #include "nsThreadUtils.h"
  28 #include "nsNetUtil.h"
  29 #include "nsImageFrame.h"
  30
  31 #include "nsIPresShell.h"
  32
  33 #include "nsIChannel.h"
  34 #include "nsIStreamListener.h"
  35
  36 #include "nsIFrame.h"
  37 #include "nsIDOMNode.h"
  38
  39 #include "nsContentUtils.h"
  40 #include "nsLayoutUtils.h"
  41 #include "nsIContentPolicy.h"
  42 #include "nsSVGEffects.h"
  43
  44 #include "mozAutoDocUpdate.h"
  45 #include "mozilla/AsyncEventDispatcher.h"
  46 #include "mozilla/EventStates.h"
  47 #include "mozilla/dom/Element.h"
  48 #include "mozilla/dom/ScriptSettings.h"
  49
  50 #ifdef LoadImage
  51 // Undefine LoadImage to prevent naming conflict with Windows.
  52 #undef LoadImage
  53 #endif
  54
  55 using namespace mozilla;
  56
  57 #ifdef DEBUG_chb
  58 static void PrintReqURL(imgIRequest* req) {
  59   if (!req) {
  60     printf("(null req)\n");
  61     return;
  62   }
  63
  64   nsCOMPtr<nsIURI> uri;
  65   req->GetURI(getter_AddRefs(uri));
  66   if (!uri) {
  67     printf("(null uri)\n");
  68     return;
  69   }
  70
  71   nsAutoCString spec;
  72   uri->GetSpec(spec);
  73   printf("spec='%s'\n", spec.get());
  74 }
  75 #endif /* DEBUG_chb */
  76
  77
  78 nsImageLoadingContent::nsImageLoadingContent()
  79   : mCurrentRequestFlags(0),
  80     mPendingRequestFlags(0),
  81     mObserverList(nullptr),
  82     mImageBlockingStatus(nsIContentPolicy::ACCEPT),
  83     mLoadingEnabled(true),
  84     mIsImageStateForced(false),
  85     mLoading(false),
  86     // mBroken starts out true, since an image without a URI is broken....
  87     mBroken(true),
  88     mUserDisabled(false),
  89     mSuppressed(false),
  90     mFireEventsOnDecode(false),
  91     mNewRequestsWillNeedAnimationReset(false),
  92     mStateChangerDepth(0),
  93     mCurrentRequestRegistered(false),
  94     mPendingRequestRegistered(false),
  95     mFrameCreateCalled(false),
  96     mVisibleCount(0)
  97 {
  98   if (!nsContentUtils::GetImgLoaderForChannel(nullptr, nullptr)) {
  99     mLoadingEnabled = false;
 100   }
 101 }
 102
 103 void
 104 nsImageLoadingContent::DestroyImageLoadingContent()
 105 {
 106   // Cancel our requests so they won't hold stale refs to us
 107   // NB: Don't ask to discard the images here.
 108   ClearCurrentRequest(NS_BINDING_ABORTED, ON_NONVISIBLE_NO_ACTION);
 109   ClearPendingRequest(NS_BINDING_ABORTED, ON_NONVISIBLE_NO_ACTION);
 110 }
 111
 112 nsImageLoadingContent::~nsImageLoadingContent()
 113 {
 114   NS_ASSERTION(!mCurrentRequest && !mPendingRequest,
 115                "DestroyImageLoadingContent not called");
 116   NS_ASSERTION(!mObserverList.mObserver && !mObserverList.mNext,
 117                "Observers still registered?");
 118 }
 119
 120 /*
 121  * imgINotificationObserver impl
 122  */
 123 NS_IMETHODIMP
 124 nsImageLoadingContent::Notify(imgIRequest* aRequest,
 125                               int32_t aType,
 126                               const nsIntRect* aData)
 127 {
 128   if (aType == imgINotificationObserver::IS_ANIMATED) {
 129     return OnImageIsAnimated(aRequest);
 130   }
 131
 132   if (aType == imgINotificationObserver::UNLOCKED_DRAW) {
 133     OnUnlockedDraw();
 134     return NS_OK;
 135   }
 136
 137   if (aType == imgINotificationObserver::LOAD_COMPLETE) {
 138     // We should definitely have a request here
 139     NS_ABORT_IF_FALSE(aRequest, "no request?");
 140
 141     NS_PRECONDITION(aRequest == mCurrentRequest || aRequest == mPendingRequest,
 142                     "Unknown request");
 143   }
 144
 145   {
 146     nsAutoScriptBlocker scriptBlocker;
 147
 148     for (ImageObserver* observer = &mObserverList, *next; observer;
 149          observer = next) {
 150       next = observer->mNext;
 151       if (observer->mObserver) {
 152         observer->mObserver->Notify(aRequest, aType, aData);
 153       }
 154     }
 155   }
 156
 157   if (aType == imgINotificationObserver::SIZE_AVAILABLE) {
 158     // Have to check for state changes here, since we might have been in
 159     // the LOADING state before.
 160     UpdateImageState(true);
 161   }
 162
 163   if (aType == imgINotificationObserver::LOAD_COMPLETE) {
 164     uint32_t reqStatus;
 165     aRequest->GetImageStatus(&reqStatus);
 166     /* triage STATUS_ERROR */
 167     if (reqStatus & imgIRequest::STATUS_ERROR) {
 168       nsresult errorCode = NS_OK;
 169       aRequest->GetImageErrorCode(&errorCode);
 170
 171       /* Handle image not loading error because source was a tracking URL.
 172        * We make a note of this image node by including it in a dedicated
 173        * array of blocked tracking nodes under its parent document.
 174        */
 175       if (errorCode == NS_ERROR_TRACKING_URI) {
 176         nsCOMPtr<nsIContent> thisNode
 177           = do_QueryInterface(static_cast<nsIImageLoadingContent*>(this));
 178
 179         nsIDocument *doc = GetOurOwnerDoc();
 180         doc->AddBlockedTrackingNode(thisNode);
 181       }
 182     }
 183     nsresult status =
 184         reqStatus & imgIRequest::STATUS_ERROR ? NS_ERROR_FAILURE : NS_OK;
 185     return OnLoadComplete(aRequest, status);
 186   }
 187
 188   if (aType == imgINotificationObserver::DECODE_COMPLETE) {
 189     if (mFireEventsOnDecode) {
 190       mFireEventsOnDecode = false;
 191
 192       uint32_t reqStatus;
 193       aRequest->GetImageStatus(&reqStatus);
 194       if (reqStatus & imgIRequest::STATUS_ERROR) {
 195         FireEvent(NS_LITERAL_STRING("error"));
 196       } else {
 197         FireEvent(NS_LITERAL_STRING("load"));
 198       }
 199     }
 200
 201     UpdateImageState(true);
 202   }
 203
 204   return NS_OK;
 205 }
 206
 207 nsresult
 208 nsImageLoadingContent::OnLoadComplete(imgIRequest* aRequest, nsresult aStatus)
 209 {
 210   uint32_t oldStatus;
 211   aRequest->GetImageStatus(&oldStatus);
 212
 213   //XXXjdm This occurs when we have a pending request created, then another
 214   //       pending request replaces it before the first one is finished.
 215   //       This begs the question of what the correct behaviour is; we used
 216   //       to not have to care because we ran this code in OnStopDecode which
 217   //       wasn't called when the first request was cancelled. For now, I choose
 218   //       to punt when the given request doesn't appear to have terminated in
 219   //       an expected state.
 220   if (!(oldStatus & (imgIRequest::STATUS_ERROR | imgIRequest::STATUS_LOAD_COMPLETE)))
 221     return NS_OK;
 222
 223   // Our state may change. Watch it.
 224   AutoStateChanger changer(this, true);
 225
 226   // If the pending request is loaded, switch to it.
 227   if (aRequest == mPendingRequest) {
 228     MakePendingRequestCurrent();
 229   }
 230   NS_ABORT_IF_FALSE(aRequest == mCurrentRequest,
 231                     "One way or another, we should be current by now");
 232
 233   // We just loaded all the data we're going to get. If we're visible and
 234   // haven't done an initial paint (*), we want to make sure the image starts
 235   // decoding immediately, for two reasons:
 236   //
 237   // 1) This image is sitting idle but might need to be decoded as soon as we
 238   // start painting, in which case we've wasted time.
 239   //
 240   // 2) We want to block onload until all visible images are decoded. We do this
 241   // by blocking onload until all in-progress decodes get at least one frame
 242   // decoded. However, if all the data comes in while painting is suppressed
 243   // (ie, before the initial paint delay is finished), we fire onload without
 244   // doing a paint first. This means that decode-on-draw images don't start
 245   // decoding, so we can't wait for them to finish. See bug 512435.
 246   //
 247   // (*) IsPaintingSuppressed returns false if we haven't gotten the initial
 248   // reflow yet, so we have to test !DidInitialize || IsPaintingSuppressed.
 249   // It's possible for painting to be suppressed for reasons other than the
 250   // initial paint delay (for example, being in the bfcache), but we probably
 251   // aren't loading images in those situations.
 252
 253   // XXXkhuey should this be GetOurCurrentDoc?  Decoding if we're not in
 254   // the document seems silly.
 255   nsIDocument* doc = GetOurOwnerDoc();
 256   nsIPresShell* shell = doc ? doc->GetShell() : nullptr;
 257   if (shell && shell->IsVisible() &&
 258       (!shell->DidInitialize() || shell->IsPaintingSuppressed())) {
 259
 260     nsIFrame* f = GetOurPrimaryFrame();
 261     // If we haven't gotten a frame yet either we aren't going to (so don't
 262     // bother kicking off a decode), or we will get very soon on the next
 263     // refresh driver tick when it flushes. And it will most likely be a
 264     // specific image type frame (we only create generic (ie inline) type
 265     // frames for images that don't have a size, and since we have all the data
 266     // we should have the size) which will check its own visibility on its
 267     // first reflow.
 268     if (f) {
 269       // If we've gotten a frame and that frame has called FrameCreate and that
 270       // frame has been reflowed then we know that it checked it's own visibility
 271       // so we can trust our visible count and we don't start decode if we are not
 272       // visible.
 273       if (!mFrameCreateCalled || (f->GetStateBits() & NS_FRAME_FIRST_REFLOW) ||
 274           mVisibleCount > 0 || shell->AssumeAllImagesVisible()) {
 275         mCurrentRequest->StartDecoding();
 276       }
 277     }
 278   }
 279
 280   // We want to give the decoder a chance to find errors. If we haven't found
 281   // an error yet and we've started decoding, either from the above
 282   // StartDecoding or from some other place, we must only fire these events
 283   // after we finish decoding.
 284   uint32_t reqStatus;
 285   aRequest->GetImageStatus(&reqStatus);
 286   if (NS_SUCCEEDED(aStatus) && !(reqStatus & imgIRequest::STATUS_ERROR) &&
 287       (reqStatus & imgIRequest::STATUS_DECODE_STARTED) &&
 288       !(reqStatus & imgIRequest::STATUS_DECODE_COMPLETE)) {
 289     mFireEventsOnDecode = true;
 290   } else {
 291     // Fire the appropriate DOM event.
 292     if (NS_SUCCEEDED(aStatus)) {
 293       FireEvent(NS_LITERAL_STRING("load"));
 294     } else {
 295       FireEvent(NS_LITERAL_STRING("error"));
 296     }
 297   }
 298
 299   nsCOMPtr<nsINode> thisNode = do_QueryInterface(static_cast<nsIImageLoadingContent*>(this));
 300   nsSVGEffects::InvalidateDirectRenderingObservers(thisNode->AsElement());
 301
 302   return NS_OK;
 303 }
 304
 305 static bool
 306 ImageIsAnimated(imgIRequest* aRequest)
 307 {
 308   if (!aRequest) {
 309     return false;
 310   }
 311
 312   nsCOMPtr<imgIContainer> image;
 313   if (NS_SUCCEEDED(aRequest->GetImage(getter_AddRefs(image)))) {
 314     bool isAnimated = false;
 315     nsresult rv = image->GetAnimated(&isAnimated);
 316     if (NS_SUCCEEDED(rv) && isAnimated) {
 317       return true;
 318     }
 319   }
 320
 321   return false;
 322 }
 323
 324 void
 325 nsImageLoadingContent::OnUnlockedDraw()
 326 {
 327   if (mVisibleCount > 0) {
 328     // We should already be marked as visible, there is nothing more we can do.
 329     return;
 330   }
 331
 332   // It's OK for non-animated images to wait until the next image visibility
 333   // update to become locked. (And that's preferable, since in the case of
 334   // scrolling it keeps memory usage minimal.) For animated images, though, we
 335   // want to mark them visible right away so we can call
 336   // IncrementAnimationConsumers() on them and they'll start animating.
 337   if (!ImageIsAnimated(mCurrentRequest) && !ImageIsAnimated(mPendingRequest)) {
 338     return;
 339   }
 340
 341   nsPresContext* presContext = GetFramePresContext();
 342   if (!presContext)
 343     return;
 344
 345   nsIPresShell* presShell = presContext->PresShell();
 346   if (!presShell)
 347     return;
 348
 349   presShell->EnsureImageInVisibleList(this);
 350 }
 351
 352 nsresult
 353 nsImageLoadingContent::OnImageIsAnimated(imgIRequest *aRequest)
 354 {
 355   bool* requestFlag = GetRegisteredFlagForRequest(aRequest);
 356   if (requestFlag) {
 357     nsLayoutUtils::RegisterImageRequest(GetFramePresContext(),
 358                                         aRequest, requestFlag);
 359   }
 360
 361   return NS_OK;
 362 }
 363
 364 /*
 365  * nsIImageLoadingContent impl
 366  */
 367
 368 NS_IMETHODIMP
 369 nsImageLoadingContent::GetLoadingEnabled(bool *aLoadingEnabled)
 370 {
 371   *aLoadingEnabled = mLoadingEnabled;
 372   return NS_OK;
 373 }
 374
 375 NS_IMETHODIMP
 376 nsImageLoadingContent::SetLoadingEnabled(bool aLoadingEnabled)
 377 {
 378   if (nsContentUtils::GetImgLoaderForChannel(nullptr, nullptr)) {
 379     mLoadingEnabled = aLoadingEnabled;
 380   }
 381   return NS_OK;
 382 }
 383
 384 NS_IMETHODIMP
 385 nsImageLoadingContent::GetImageBlockingStatus(int16_t* aStatus)
 386 {
 387   NS_PRECONDITION(aStatus, "Null out param");
 388   *aStatus = ImageBlockingStatus();
 389   return NS_OK;
 390 }
 391
 392 static void
 393 ReplayImageStatus(imgIRequest* aRequest, imgINotificationObserver* aObserver)
 394 {
 395   if (!aRequest) {
 396     return;
 397   }
 398
 399   uint32_t status = 0;
 400   nsresult rv = aRequest->GetImageStatus(&status);
 401   if (NS_FAILED(rv)) {
 402     return;
 403   }
 404
 405   if (status & imgIRequest::STATUS_SIZE_AVAILABLE) {
 406     aObserver->Notify(aRequest, imgINotificationObserver::SIZE_AVAILABLE, nullptr);
 407   }
 408   if (status & imgIRequest::STATUS_FRAME_COMPLETE) {
 409     aObserver->Notify(aRequest, imgINotificationObserver::FRAME_COMPLETE, nullptr);
 410   }
 411   if (status & imgIRequest::STATUS_HAS_TRANSPARENCY) {
 412     aObserver->Notify(aRequest, imgINotificationObserver::HAS_TRANSPARENCY, nullptr);
 413   }
 414   if (status & imgIRequest::STATUS_IS_ANIMATED) {
 415     aObserver->Notify(aRequest, imgINotificationObserver::IS_ANIMATED, nullptr);
 416   }
 417   if (status & imgIRequest::STATUS_DECODE_COMPLETE) {
 418     aObserver->Notify(aRequest, imgINotificationObserver::DECODE_COMPLETE, nullptr);
 419   }
 420   if (status & imgIRequest::STATUS_LOAD_COMPLETE) {
 421     aObserver->Notify(aRequest, imgINotificationObserver::LOAD_COMPLETE, nullptr);
 422   }
 423 }
 424
 425 NS_IMETHODIMP
 426 nsImageLoadingContent::AddObserver(imgINotificationObserver* aObserver)
 427 {
 428   NS_ENSURE_ARG_POINTER(aObserver);
 429
 430   if (!mObserverList.mObserver) {
 431     // Don't touch the linking of the list!
 432     mObserverList.mObserver = aObserver;
 433
 434     ReplayImageStatus(mCurrentRequest, aObserver);
 435     ReplayImageStatus(mPendingRequest, aObserver);
 436
 437     return NS_OK;
 438   }
 439
 440   // otherwise we have to create a new entry
 441
 442   ImageObserver* observer = &mObserverList;
 443   while (observer->mNext) {
 444     observer = observer->mNext;
 445   }
 446
 447   observer->mNext = new ImageObserver(aObserver);
 448   if (! observer->mNext) {
 449     return NS_ERROR_OUT_OF_MEMORY;
 450   }
 451
 452   ReplayImageStatus(mCurrentRequest, aObserver);
 453   ReplayImageStatus(mPendingRequest, aObserver);
 454
 455   return NS_OK;
 456 }
 457
 458 NS_IMETHODIMP
 459 nsImageLoadingContent::RemoveObserver(imgINotificationObserver* aObserver)
 460 {
 461   NS_ENSURE_ARG_POINTER(aObserver);
 462
 463   if (mObserverList.mObserver == aObserver) {
 464     mObserverList.mObserver = nullptr;
 465     // Don't touch the linking of the list!
 466     return NS_OK;
 467   }
 468
 469   // otherwise have to find it and splice it out
 470   ImageObserver* observer = &mObserverList;
 471   while (observer->mNext && observer->mNext->mObserver != aObserver) {
 472     observer = observer->mNext;
 473   }
 474
 475   // At this point, we are pointing to the list element whose mNext is
 476   // the right observer (assuming of course that mNext is not null)
 477   if (observer->mNext) {
 478     // splice it out
 479     ImageObserver* oldObserver = observer->mNext;
 480     observer->mNext = oldObserver->mNext;
 481     oldObserver->mNext = nullptr;  // so we don't destroy them all
 482     delete oldObserver;
 483   }
 484 #ifdef DEBUG
 485   else {
 486     NS_WARNING("Asked to remove nonexistent observer");
 487   }
 488 #endif
 489   return NS_OK;
 490 }
 491
 492 already_AddRefed<imgIRequest>
 493 nsImageLoadingContent::GetRequest(int32_t aRequestType,
 494                                   ErrorResult& aError)
 495 {
 496   nsCOMPtr<imgIRequest> request;
 497   switch(aRequestType) {
 498   case CURRENT_REQUEST:
 499     request = mCurrentRequest;
 500     break;
 501   case PENDING_REQUEST:
 502     request = mPendingRequest;
 503     break;
 504   default:
 505     NS_ERROR("Unknown request type");
 506     aError.Throw(NS_ERROR_UNEXPECTED);
 507   }
 508
 509   return request.forget();
 510 }
 511
 512 NS_IMETHODIMP
 513 nsImageLoadingContent::GetRequest(int32_t aRequestType,
 514                                   imgIRequest** aRequest)
 515 {
 516   NS_ENSURE_ARG_POINTER(aRequest);
 517
 518   ErrorResult result;
 519   *aRequest = GetRequest(aRequestType, result).take();
 520
 521   return result.ErrorCode();
 522 }
 523
 524 NS_IMETHODIMP_(bool)
 525 nsImageLoadingContent::CurrentRequestHasSize()
 526 {
 527   return HaveSize(mCurrentRequest);
 528 }
 529
 530 NS_IMETHODIMP_(void)
 531 nsImageLoadingContent::FrameCreated(nsIFrame* aFrame)
 532 {
 533   NS_ASSERTION(aFrame, "aFrame is null");
 534
 535   mFrameCreateCalled = true;
 536
 537   if (aFrame->HasAnyStateBits(NS_FRAME_IN_POPUP)) {
 538     // Assume all images in popups are visible.
 539     IncrementVisibleCount();
 540   }
 541
 542   TrackImage(mCurrentRequest);
 543   TrackImage(mPendingRequest);
 544
 545   // We need to make sure that our image request is registered, if it should
 546   // be registered.
 547   nsPresContext* presContext = aFrame->PresContext();
 548   if (mCurrentRequest) {
 549     nsLayoutUtils::RegisterImageRequestIfAnimated(presContext, mCurrentRequest,
 550                                                   &mCurrentRequestRegistered);
 551   }
 552
 553   if (mPendingRequest) {
 554     nsLayoutUtils::RegisterImageRequestIfAnimated(presContext, mPendingRequest,
 555                                                   &mPendingRequestRegistered);
 556   }
 557 }
 558
 559 NS_IMETHODIMP_(void)
 560 nsImageLoadingContent::FrameDestroyed(nsIFrame* aFrame)
 561 {
 562   NS_ASSERTION(aFrame, "aFrame is null");
 563
 564   mFrameCreateCalled = false;
 565
 566   // We need to make sure that our image request is deregistered.
 567   nsPresContext* presContext = GetFramePresContext();
 568   if (mCurrentRequest) {
 569     nsLayoutUtils::DeregisterImageRequest(presContext,
 570                                           mCurrentRequest,
 571                                           &mCurrentRequestRegistered);
 572   }
 573
 574   if (mPendingRequest) {
 575     nsLayoutUtils::DeregisterImageRequest(presContext,
 576                                           mPendingRequest,
 577                                           &mPendingRequestRegistered);
 578   }
 579
 580   UntrackImage(mCurrentRequest);
 581   UntrackImage(mPendingRequest);
 582
 583   nsIPresShell* presShell = presContext ? presContext->GetPresShell() : nullptr;
 584   if (presShell) {
 585     presShell->RemoveImageFromVisibleList(this);
 586   }
 587
 588   if (aFrame->HasAnyStateBits(NS_FRAME_IN_POPUP)) {
 589     // We assume all images in popups are visible, so this decrement balances
 590     // out the increment in FrameCreated above.
 591     DecrementVisibleCount(ON_NONVISIBLE_NO_ACTION);
 592   }
 593 }
 594
 595 /* static */
 596 nsContentPolicyType
 597 nsImageLoadingContent::PolicyTypeForLoad(ImageLoadType aImageLoadType)
 598 {
 599   if (aImageLoadType == eImageLoadType_Imageset) {
 600     return nsIContentPolicy::TYPE_IMAGESET;
 601   }
 602
 603   MOZ_ASSERT(aImageLoadType == eImageLoadType_Normal,
 604              "Unknown ImageLoadType type in PolicyTypeForLoad");
 605   return nsIContentPolicy::TYPE_IMAGE;
 606 }
 607
 608 int32_t
 609 nsImageLoadingContent::GetRequestType(imgIRequest* aRequest,
 610                                       ErrorResult& aError)
 611 {
 612   if (aRequest == mCurrentRequest) {
 613     return CURRENT_REQUEST;
 614   }
 615
 616   if (aRequest == mPendingRequest) {
 617     return PENDING_REQUEST;
 618   }
 619
 620   NS_ERROR("Unknown request");
 621   aError.Throw(NS_ERROR_UNEXPECTED);
 622   return UNKNOWN_REQUEST;
 623 }
 624
 625 NS_IMETHODIMP
 626 nsImageLoadingContent::GetRequestType(imgIRequest* aRequest,
 627                                       int32_t* aRequestType)
 628 {
 629   NS_PRECONDITION(aRequestType, "Null out param");
 630
 631   ErrorResult result;
 632   *aRequestType = GetRequestType(aRequest, result);
 633   return result.ErrorCode();
 634 }
 635
 636 already_AddRefed<nsIURI>
 637 nsImageLoadingContent::GetCurrentURI(ErrorResult& aError)
 638 {
 639   nsCOMPtr<nsIURI> uri;
 640   if (mCurrentRequest) {
 641     mCurrentRequest->GetURI(getter_AddRefs(uri));
 642   } else if (mCurrentURI) {
 643     nsresult rv = NS_EnsureSafeToReturn(mCurrentURI, getter_AddRefs(uri));
 644     if (NS_FAILED(rv)) {
 645       aError.Throw(rv);
 646     }
 647   }
 648
 649   return uri.forget();
 650 }
 651
 652 NS_IMETHODIMP
 653 nsImageLoadingContent::GetCurrentURI(nsIURI** aURI)
 654 {
 655   NS_ENSURE_ARG_POINTER(aURI);
 656
 657   ErrorResult result;
 658   *aURI = GetCurrentURI(result).take();
 659   return result.ErrorCode();
 660 }
 661
 662 already_AddRefed<nsIStreamListener>
 663 nsImageLoadingContent::LoadImageWithChannel(nsIChannel* aChannel,
 664                                             ErrorResult& aError)
 665 {
 666   imgLoader* loader =
 667     nsContentUtils::GetImgLoaderForChannel(aChannel, GetOurOwnerDoc());
 668   if (!loader) {
 669     aError.Throw(NS_ERROR_NULL_POINTER);
 670     return nullptr;
 671   }
 672
 673   nsCOMPtr<nsIDocument> doc = GetOurOwnerDoc();
 674   if (!doc) {
 675     // Don't bother
 676     return nullptr;
 677   }
 678
 679   // XXX what should we do with content policies here, if anything?
 680   // Shouldn't that be done before the start of the load?
 681   // XXX what about shouldProcess?
 682
 683   // Our state might change. Watch it.
 684   AutoStateChanger changer(this, true);
 685
 686   // Do the load.
 687   nsCOMPtr<nsIStreamListener> listener;
 688   nsRefPtr<imgRequestProxy>& req = PrepareNextRequest(eImageLoadType_Normal);
 689   nsresult rv = loader->
 690     LoadImageWithChannel(aChannel, this, doc,
 691                          getter_AddRefs(listener),
 692                          getter_AddRefs(req));
 693   if (NS_SUCCEEDED(rv)) {
 694     TrackImage(req);
 695     ResetAnimationIfNeeded();
 696   } else {
 697     MOZ_ASSERT(!req, "Shouldn't have non-null request here");
 698     // If we don't have a current URI, we might as well store this URI so people
 699     // know what we tried (and failed) to load.
 700     if (!mCurrentRequest)
 701       aChannel->GetURI(getter_AddRefs(mCurrentURI));
 702     FireEvent(NS_LITERAL_STRING("error"));
 703     aError.Throw(rv);
 704   }
 705   return listener.forget();
 706 }
 707
 708 NS_IMETHODIMP
 709 nsImageLoadingContent::LoadImageWithChannel(nsIChannel* aChannel,
 710                                             nsIStreamListener** aListener)
 711 {
 712   NS_ENSURE_ARG_POINTER(aListener);
 713
 714   ErrorResult result;
 715   *aListener = LoadImageWithChannel(aChannel, result).take();
 716   return result.ErrorCode();
 717 }
 718
 719 void
 720 nsImageLoadingContent::ForceReload(const mozilla::dom::Optional<bool>& aNotify,
 721                                    mozilla::ErrorResult& aError)
 722 {
 723   nsCOMPtr<nsIURI> currentURI;
 724   GetCurrentURI(getter_AddRefs(currentURI));
 725   if (!currentURI) {
 726     aError.Throw(NS_ERROR_NOT_AVAILABLE);
 727     return;
 728   }
 729
 730   // defaults to true
 731   bool notify = !aNotify.WasPassed() || aNotify.Value();
 732
 733   // We keep this flag around along with the old URI even for failed requests
 734   // without a live request object
 735   ImageLoadType loadType = \
 736     (mCurrentRequestFlags & REQUEST_IS_IMAGESET) ? eImageLoadType_Imageset
 737                                                  : eImageLoadType_Normal;
 738   nsresult rv = LoadImage(currentURI, true, notify, loadType, nullptr,
 739                           nsIRequest::VALIDATE_ALWAYS);
 740   if (NS_FAILED(rv)) {
 741     aError.Throw(rv);
 742   }
 743 }
 744
 745 NS_IMETHODIMP
 746 nsImageLoadingContent::ForceReload(bool aNotify /* = true */,
 747                                    uint8_t aArgc)
 748 {
 749   mozilla::dom::Optional<bool> notify;
 750   if (aArgc >= 1) {
 751     notify.Construct() = aNotify;
 752   }
 753
 754   ErrorResult result;
 755   ForceReload(notify, result);
 756   return result.ErrorCode();
 757 }
 758
 759 NS_IMETHODIMP
 760 nsImageLoadingContent::BlockOnload(imgIRequest* aRequest)
 761 {
 762   if (aRequest == mCurrentRequest) {
 763     NS_ASSERTION(!(mCurrentRequestFlags & REQUEST_BLOCKS_ONLOAD),
 764                  "Double BlockOnload!?");
 765     mCurrentRequestFlags |= REQUEST_BLOCKS_ONLOAD;
 766   } else if (aRequest == mPendingRequest) {
 767     NS_ASSERTION(!(mPendingRequestFlags & REQUEST_BLOCKS_ONLOAD),
 768                  "Double BlockOnload!?");
 769     mPendingRequestFlags |= REQUEST_BLOCKS_ONLOAD;
 770   } else {
 771     return NS_OK;
 772   }
 773
 774   nsIDocument* doc = GetOurCurrentDoc();
 775   if (doc) {
 776     doc->BlockOnload();
 777   }
 778
 779   return NS_OK;
 780 }
 781
 782 NS_IMETHODIMP
 783 nsImageLoadingContent::UnblockOnload(imgIRequest* aRequest)
 784 {
 785   if (aRequest == mCurrentRequest) {
 786     NS_ASSERTION(mCurrentRequestFlags & REQUEST_BLOCKS_ONLOAD,
 787                  "Double UnblockOnload!?");
 788     mCurrentRequestFlags &= ~REQUEST_BLOCKS_ONLOAD;
 789   } else if (aRequest == mPendingRequest) {
 790     NS_ASSERTION(mPendingRequestFlags & REQUEST_BLOCKS_ONLOAD,
 791                  "Double UnblockOnload!?");
 792     mPendingRequestFlags &= ~REQUEST_BLOCKS_ONLOAD;
 793   } else {
 794     return NS_OK;
 795   }
 796
 797   nsIDocument* doc = GetOurCurrentDoc();
 798   if (doc) {
 799     doc->UnblockOnload(false);
 800   }
 801
 802   return NS_OK;
 803 }
 804
 805 void
 806 nsImageLoadingContent::IncrementVisibleCount()
 807 {
 808   mVisibleCount++;
 809   if (mVisibleCount == 1) {
 810     TrackImage(mCurrentRequest);
 811     TrackImage(mPendingRequest);
 812   }
 813 }
 814
 815 void
 816 nsImageLoadingContent::DecrementVisibleCount(uint32_t aNonvisibleAction)
 817 {
 818   NS_ASSERTION(mVisibleCount > 0, "visible count should be positive here");
 819   mVisibleCount--;
 820
 821   if (mVisibleCount == 0) {
 822     UntrackImage(mCurrentRequest, aNonvisibleAction);
 823     UntrackImage(mPendingRequest, aNonvisibleAction);
 824   }
 825 }
 826
 827 uint32_t
 828 nsImageLoadingContent::GetVisibleCount()
 829 {
 830   return mVisibleCount;
 831 }
 832
 833 /*
 834  * Non-interface methods
 835  */
 836
 837 nsresult
 838 nsImageLoadingContent::LoadImage(const nsAString& aNewURI,
 839                                  bool aForce,
 840                                  bool aNotify,
 841                                  ImageLoadType aImageLoadType)
 842 {
 843   // First, get a document (needed for security checks and the like)
 844   nsIDocument* doc = GetOurOwnerDoc();
 845   if (!doc) {
 846     // No reason to bother, I think...
 847     return NS_OK;
 848   }
 849
 850   nsCOMPtr<nsIURI> imageURI;
 851   nsresult rv = StringToURI(aNewURI, doc, getter_AddRefs(imageURI));
 852   NS_ENSURE_SUCCESS(rv, rv);
 853   // XXXbiesi fire onerror if that failed?
 854
 855   bool equal;
 856
 857   if (aNewURI.IsEmpty() &&
 858       doc->GetDocumentURI() &&
 859       NS_SUCCEEDED(doc->GetDocumentURI()->EqualsExceptRef(imageURI, &equal)) &&
 860       equal)  {
 861
 862     // Loading an embedded img from the same URI as the document URI will not work
 863     // as a resource cannot recursively embed itself. Attempting to do so generally
 864     // results in having to pre-emptively close down an in-flight HTTP transaction
 865     // and then incurring the significant cost of establishing a new TCP channel.
 866     // This is generally triggered from <img src="">
 867     // In light of that, just skip loading it..
 868     // Do make sure to drop our existing image, if any
 869     CancelImageRequests(aNotify);
 870     return NS_OK;
 871   }
 872
 873   NS_TryToSetImmutable(imageURI);
 874
 875   return LoadImage(imageURI, aForce, aNotify, aImageLoadType, doc);
 876 }
 877
 878 nsresult
 879 nsImageLoadingContent::LoadImage(nsIURI* aNewURI,
 880                                  bool aForce,
 881                                  bool aNotify,
 882                                  ImageLoadType aImageLoadType,
 883                                  nsIDocument* aDocument,
 884                                  nsLoadFlags aLoadFlags)
 885 {
 886   if (!mLoadingEnabled) {
 887     // XXX Why fire an error here? seems like the callers to SetLoadingEnabled
 888     // don't want/need it.
 889     FireEvent(NS_LITERAL_STRING("error"));
 890     return NS_OK;
 891   }
 892
 893   NS_ASSERTION(!aDocument || aDocument == GetOurOwnerDoc(),
 894                "Bogus document passed in");
 895   // First, get a document (needed for security checks and the like)
 896   if (!aDocument) {
 897     aDocument = GetOurOwnerDoc();
 898     if (!aDocument) {
 899       // No reason to bother, I think...
 900       return NS_OK;
 901     }
 902   }
 903
 904   // URI equality check.
 905   //
 906   // We skip the equality check if our current image was blocked, since in that
 907   // case we really do want to try loading again.
 908   if (!aForce && NS_CP_ACCEPTED(mImageBlockingStatus)) {
 909     nsCOMPtr<nsIURI> currentURI;
 910     GetCurrentURI(getter_AddRefs(currentURI));
 911     bool equal;
 912     if (currentURI &&
 913         NS_SUCCEEDED(currentURI->Equals(aNewURI, &equal)) &&
 914         equal) {
 915       // Nothing to do here.
 916       return NS_OK;
 917     }
 918   }
 919
 920   // From this point on, our image state could change. Watch it.
 921   AutoStateChanger changer(this, aNotify);
 922
 923   // Sanity check.
 924   //
 925   // We use the principal of aDocument to avoid having to QI |this| an extra
 926   // time. It should always be the same as the principal of this node.
 927 #ifdef DEBUG
 928   nsCOMPtr<nsIContent> thisContent = do_QueryInterface(static_cast<nsIImageLoadingContent*>(this));
 929   NS_ABORT_IF_FALSE(thisContent &&
 930                     thisContent->NodePrincipal() == aDocument->NodePrincipal(),
 931                     "Principal mismatch?");
 932 #endif
 933
 934   // Are we blocked?
 935   int16_t cpDecision = nsIContentPolicy::REJECT_REQUEST;
 936   nsContentPolicyType policyType = PolicyTypeForLoad(aImageLoadType);
 937
 938   nsContentUtils::CanLoadImage(aNewURI,
 939                                static_cast<nsIImageLoadingContent*>(this),
 940                                aDocument,
 941                                aDocument->NodePrincipal(),
 942                                &cpDecision,
 943                                policyType);
 944   if (!NS_CP_ACCEPTED(cpDecision)) {
 945     FireEvent(NS_LITERAL_STRING("error"));
 946     SetBlockedRequest(aNewURI, cpDecision);
 947     return NS_OK;
 948   }
 949
 950   nsLoadFlags loadFlags = aLoadFlags;
 951   int32_t corsmode = GetCORSMode();
 952   if (corsmode == CORS_ANONYMOUS) {
 953     loadFlags |= imgILoader::LOAD_CORS_ANONYMOUS;
 954   } else if (corsmode == CORS_USE_CREDENTIALS) {
 955     loadFlags |= imgILoader::LOAD_CORS_USE_CREDENTIALS;
 956   }
 957
 958   // Not blocked. Do the load.
 959   nsRefPtr<imgRequestProxy>& req = PrepareNextRequest(aImageLoadType);
 960   nsCOMPtr<nsIContent> content =
 961       do_QueryInterface(static_cast<nsIImageLoadingContent*>(this));
 962   nsresult rv;
 963   rv = nsContentUtils::LoadImage(aNewURI, aDocument,
 964                                  aDocument->NodePrincipal(),
 965                                  aDocument->GetDocumentURI(),
 966                                  aDocument->GetReferrerPolicy(),
 967                                  this, loadFlags,
 968                                  content->LocalName(),
 969                                  getter_AddRefs(req),
 970                                  policyType);
 971
 972   // Tell the document to forget about the image preload, if any, for
 973   // this URI, now that we might have another imgRequestProxy for it.
 974   // That way if we get canceled later the image load won't continue.
 975   aDocument->ForgetImagePreload(aNewURI);
 976
 977   if (NS_SUCCEEDED(rv)) {
 978     TrackImage(req);
 979     ResetAnimationIfNeeded();
 980
 981     // Handle cases when we just ended up with a pending request but it's
 982     // already done.  In that situation we have to synchronously switch that
 983     // request to being the current request, because websites depend on that
 984     // behavior.
 985     if (req == mPendingRequest) {
 986       uint32_t pendingLoadStatus;
 987       rv = req->GetImageStatus(&pendingLoadStatus);
 988       if (NS_SUCCEEDED(rv) &&
 989           (pendingLoadStatus & imgIRequest::STATUS_LOAD_COMPLETE)) {
 990         MakePendingRequestCurrent();
 991         MOZ_ASSERT(mCurrentRequest,
 992                    "How could we not have a current request here?");
 993
 994         nsImageFrame *f = do_QueryFrame(GetOurPrimaryFrame());
 995         if (f) {
 996           f->NotifyNewCurrentRequest(mCurrentRequest, NS_OK);
 997         }
 998       }
 999     }
1000   } else {
1001     MOZ_ASSERT(!req, "Shouldn't have non-null request here");
1002     // If we don't have a current URI, we might as well store this URI so people
1003     // know what we tried (and failed) to load.
1004     if (!mCurrentRequest)
1005       mCurrentURI = aNewURI;
1006     FireEvent(NS_LITERAL_STRING("error"));
1007     return NS_OK;
1008   }
1009
1010   return NS_OK;
1011 }
1012
1013 nsresult
1014 nsImageLoadingContent::ForceImageState(bool aForce,
1015                                        EventStates::InternalType aState)
1016 {
1017   mIsImageStateForced = aForce;
1018   mForcedImageState = EventStates(aState);
1019   return NS_OK;
1020 }
1021
1022 NS_IMETHODIMP
1023 nsImageLoadingContent::GetNaturalWidth(uint32_t* aNaturalWidth)
1024 {
1025   NS_ENSURE_ARG_POINTER(aNaturalWidth);
1026
1027   nsCOMPtr<imgIContainer> image;
1028   if (mCurrentRequest) {
1029     mCurrentRequest->GetImage(getter_AddRefs(image));
1030   }
1031
1032   int32_t width;
1033   if (image && NS_SUCCEEDED(image->GetWidth(&width))) {
1034     *aNaturalWidth = width;
1035   } else {
1036     *aNaturalWidth = 0;
1037   }
1038
1039   return NS_OK;
1040 }
1041
1042 NS_IMETHODIMP
1043 nsImageLoadingContent::GetNaturalHeight(uint32_t* aNaturalHeight)
1044 {
1045   NS_ENSURE_ARG_POINTER(aNaturalHeight);
1046
1047   nsCOMPtr<imgIContainer> image;
1048   if (mCurrentRequest) {
1049     mCurrentRequest->GetImage(getter_AddRefs(image));
1050   }
1051
1052   int32_t height;
1053   if (image && NS_SUCCEEDED(image->GetHeight(&height))) {
1054     *aNaturalHeight = height;
1055   } else {
1056     *aNaturalHeight = 0;
1057   }
1058
1059   return NS_OK;
1060 }
1061
1062 EventStates
1063 nsImageLoadingContent::ImageState() const
1064 {
1065   if (mIsImageStateForced) {
1066     return mForcedImageState;
1067   }
1068
1069   EventStates states;
1070
1071   if (mBroken) {
1072     states |= NS_EVENT_STATE_BROKEN;
1073   }
1074   if (mUserDisabled) {
1075     states |= NS_EVENT_STATE_USERDISABLED;
1076   }
1077   if (mSuppressed) {
1078     states |= NS_EVENT_STATE_SUPPRESSED;
1079   }
1080   if (mLoading) {
1081     states |= NS_EVENT_STATE_LOADING;
1082   }
1083
1084   return states;
1085 }
1086
1087 void
1088 nsImageLoadingContent::UpdateImageState(bool aNotify)
1089 {
1090   if (mStateChangerDepth > 0) {
1091     // Ignore this call; we'll update our state when the outermost state changer
1092     // is destroyed. Need this to work around the fact that some ImageLib
1093     // stuff is actually sync and hence we can get OnStopDecode called while
1094     // we're still under LoadImage, and OnStopDecode doesn't know anything about
1095     // aNotify.
1096     // XXX - This machinery should be removed after bug 521604.
1097     return;
1098   }
1099
1100   nsCOMPtr<nsIContent> thisContent = do_QueryInterface(static_cast<nsIImageLoadingContent*>(this));
1101   if (!thisContent) {
1102     return;
1103   }
1104
1105   mLoading = mBroken = mUserDisabled = mSuppressed = false;
1106
1107   // If we were blocked by server-based content policy, we claim to be
1108   // suppressed.  If we were blocked by type-based content policy, we claim to
1109   // be user-disabled.  Otherwise, claim to be broken.
1110   if (mImageBlockingStatus == nsIContentPolicy::REJECT_SERVER) {
1111     mSuppressed = true;
1112   } else if (mImageBlockingStatus == nsIContentPolicy::REJECT_TYPE) {
1113     mUserDisabled = true;
1114   } else if (!mCurrentRequest) {
1115     // No current request means error, since we weren't disabled or suppressed
1116     mBroken = true;
1117   } else {
1118     uint32_t currentLoadStatus;
1119     nsresult rv = mCurrentRequest->GetImageStatus(&currentLoadStatus);
1120     if (NS_FAILED(rv) || (currentLoadStatus & imgIRequest::STATUS_ERROR)) {
1121       mBroken = true;
1122     } else if (!(currentLoadStatus & imgIRequest::STATUS_SIZE_AVAILABLE)) {
1123       mLoading = true;
1124     }
1125   }
1126
1127   NS_ASSERTION(thisContent->IsElement(), "Not an element?");
1128   thisContent->AsElement()->UpdateState(aNotify);
1129 }
1130
1131 void
1132 nsImageLoadingContent::CancelImageRequests(bool aNotify)
1133 {
1134   AutoStateChanger changer(this, aNotify);
1135   ClearPendingRequest(NS_BINDING_ABORTED, ON_NONVISIBLE_REQUEST_DISCARD);
1136   ClearCurrentRequest(NS_BINDING_ABORTED, ON_NONVISIBLE_REQUEST_DISCARD);
1137 }
1138
1139 nsresult
1140 nsImageLoadingContent::UseAsPrimaryRequest(imgRequestProxy* aRequest,
1141                                            bool aNotify,
1142                                            ImageLoadType aImageLoadType)
1143 {
1144   // Our state will change. Watch it.
1145   AutoStateChanger changer(this, aNotify);
1146
1147   // Get rid if our existing images
1148   ClearPendingRequest(NS_BINDING_ABORTED, ON_NONVISIBLE_REQUEST_DISCARD);
1149   ClearCurrentRequest(NS_BINDING_ABORTED, ON_NONVISIBLE_REQUEST_DISCARD);
1150
1151   // Clone the request we were given.
1152   nsRefPtr<imgRequestProxy>& req = PrepareNextRequest(aImageLoadType);
1153   nsresult rv = aRequest->Clone(this, getter_AddRefs(req));
1154   if (NS_SUCCEEDED(rv)) {
1155     TrackImage(req);
1156   } else {
1157     MOZ_ASSERT(!req, "Shouldn't have non-null request here");
1158     return rv;
1159   }
1160
1161   return NS_OK;
1162 }
1163
1164 nsIDocument*
1165 nsImageLoadingContent::GetOurOwnerDoc()
1166 {
1167   nsCOMPtr<nsIContent> thisContent =
1168     do_QueryInterface(static_cast<nsIImageLoadingContent*>(this));
1169   NS_ENSURE_TRUE(thisContent, nullptr);
1170
1171   return thisContent->OwnerDoc();
1172 }
1173
1174 nsIDocument*
1175 nsImageLoadingContent::GetOurCurrentDoc()
1176 {
1177   nsCOMPtr<nsIContent> thisContent =
1178     do_QueryInterface(static_cast<nsIImageLoadingContent*>(this));
1179   NS_ENSURE_TRUE(thisContent, nullptr);
1180
1181   return thisContent->GetComposedDoc();
1182 }
1183
1184 nsIFrame*
1185 nsImageLoadingContent::GetOurPrimaryFrame()
1186 {
1187   nsCOMPtr<nsIContent> thisContent =
1188     do_QueryInterface(static_cast<nsIImageLoadingContent*>(this));
1189   return thisContent->GetPrimaryFrame();
1190 }
1191
1192 nsPresContext* nsImageLoadingContent::GetFramePresContext()
1193 {
1194   nsIFrame* frame = GetOurPrimaryFrame();
1195   if (!frame) {
1196     return nullptr;
1197   }
1198
1199   return frame->PresContext();
1200 }
1201
1202 nsresult
1203 nsImageLoadingContent::StringToURI(const nsAString& aSpec,
1204                                    nsIDocument* aDocument,
1205                                    nsIURI** aURI)
1206 {
1207   NS_PRECONDITION(aDocument, "Must have a document");
1208   NS_PRECONDITION(aURI, "Null out param");
1209
1210   // (1) Get the base URI
1211   nsCOMPtr<nsIContent> thisContent = do_QueryInterface(static_cast<nsIImageLoadingContent*>(this));
1212   NS_ASSERTION(thisContent, "An image loading content must be an nsIContent");
1213   nsCOMPtr<nsIURI> baseURL = thisContent->GetBaseURI();
1214
1215   // (2) Get the charset
1216   const nsAFlatCString &charset = aDocument->GetDocumentCharacterSet();
1217
1218   // (3) Construct the silly thing
1219   return NS_NewURI(aURI,
1220                    aSpec,
1221                    charset.IsEmpty() ? nullptr : charset.get(),
1222                    baseURL,
1223                    nsContentUtils::GetIOService());
1224 }
1225
1226 nsresult
1227 nsImageLoadingContent::FireEvent(const nsAString& aEventType)
1228 {
1229   if (nsContentUtils::DocumentInactiveForImageLoads(GetOurOwnerDoc())) {
1230     // Don't bother to fire any events, especially error events.
1231     return NS_OK;
1232   }
1233
1234   // We have to fire the event asynchronously so that we won't go into infinite
1235   // loops in cases when onLoad handlers reset the src and the new src is in
1236   // cache.
1237
1238   nsCOMPtr<nsINode> thisNode = do_QueryInterface(static_cast<nsIImageLoadingContent*>(this));
1239
1240   nsRefPtr<AsyncEventDispatcher> loadBlockingAsyncDispatcher =
1241     new LoadBlockingAsyncEventDispatcher(thisNode, aEventType, false, false);
1242   loadBlockingAsyncDispatcher->PostDOMEvent();
1243
1244   return NS_OK;
1245 }
1246
1247 nsRefPtr<imgRequestProxy>&
1248 nsImageLoadingContent::PrepareNextRequest(ImageLoadType aImageLoadType)
1249 {
1250   // If we don't have a usable current request, get rid of any half-baked
1251   // request that might be sitting there and make this one current.
1252   if (!HaveSize(mCurrentRequest))
1253     return PrepareCurrentRequest(aImageLoadType);
1254
1255   // Otherwise, make it pending.
1256   return PreparePendingRequest(aImageLoadType);
1257 }
1258
1259 void
1260 nsImageLoadingContent::SetBlockedRequest(nsIURI* aURI, int16_t aContentDecision)
1261 {
1262   // Sanity
1263   NS_ABORT_IF_FALSE(!NS_CP_ACCEPTED(aContentDecision), "Blocked but not?");
1264
1265   // We do some slightly illogical stuff here to maintain consistency with
1266   // old behavior that people probably depend on. Even in the case where the
1267   // new image is blocked, the old one should really be canceled with the
1268   // reason "image source changed". However, apparently there's some abuse
1269   // over in nsImageFrame where the displaying of the "broken" icon for the
1270   // next image depends on the cancel reason of the previous image. ugh.
1271   ClearPendingRequest(NS_ERROR_IMAGE_BLOCKED, ON_NONVISIBLE_REQUEST_DISCARD);
1272
1273   // For the blocked case, we only want to cancel the existing current request
1274   // if size is not available. bz says the web depends on this behavior.
1275   if (!HaveSize(mCurrentRequest)) {
1276
1277     mImageBlockingStatus = aContentDecision;
1278     uint32_t keepFlags = mCurrentRequestFlags & REQUEST_IS_IMAGESET;
1279     ClearCurrentRequest(NS_ERROR_IMAGE_BLOCKED, ON_NONVISIBLE_REQUEST_DISCARD);
1280
1281     // We still want to remember what URI we were and if it was an imageset,
1282     // despite not having an actual request. These are both cleared as part of
1283     // ClearCurrentRequest() before a new request is started.
1284     mCurrentURI = aURI;
1285     mCurrentRequestFlags = keepFlags;
1286   }
1287 }
1288
1289 nsRefPtr<imgRequestProxy>&
1290 nsImageLoadingContent::PrepareCurrentRequest(ImageLoadType aImageLoadType)
1291 {
1292   // Blocked images go through SetBlockedRequest, which is a separate path. For
1293   // everything else, we're unblocked.
1294   mImageBlockingStatus = nsIContentPolicy::ACCEPT;
1295
1296   // Get rid of anything that was there previously.
1297   ClearCurrentRequest(NS_ERROR_IMAGE_SRC_CHANGED,
1298                       ON_NONVISIBLE_REQUEST_DISCARD);
1299
1300   if (mNewRequestsWillNeedAnimationReset) {
1301     mCurrentRequestFlags |= REQUEST_NEEDS_ANIMATION_RESET;
1302   }
1303
1304   if (aImageLoadType == eImageLoadType_Imageset) {
1305     mCurrentRequestFlags |= REQUEST_IS_IMAGESET;
1306   }
1307
1308   // Return a reference.
1309   return mCurrentRequest;
1310 }
1311
1312 nsRefPtr<imgRequestProxy>&
1313 nsImageLoadingContent::PreparePendingRequest(ImageLoadType aImageLoadType)
1314 {
1315   // Get rid of anything that was there previously.
1316   ClearPendingRequest(NS_ERROR_IMAGE_SRC_CHANGED,
1317                       ON_NONVISIBLE_REQUEST_DISCARD);
1318
1319   if (mNewRequestsWillNeedAnimationReset) {
1320     mPendingRequestFlags |= REQUEST_NEEDS_ANIMATION_RESET;
1321   }
1322
1323   if (aImageLoadType == eImageLoadType_Imageset) {
1324     mPendingRequestFlags |= REQUEST_IS_IMAGESET;
1325   }
1326
1327   // Return a reference.
1328   return mPendingRequest;
1329 }
1330
1331 namespace {
1332
1333 class ImageRequestAutoLock
1334 {
1335 public:
1336   explicit ImageRequestAutoLock(imgIRequest* aRequest)
1337     : mRequest(aRequest)
1338   {
1339     if (mRequest) {
1340       mRequest->LockImage();
1341     }
1342   }
1343
1344   ~ImageRequestAutoLock()
1345   {
1346     if (mRequest) {
1347       mRequest->UnlockImage();
1348     }
1349   }
1350
1351 private:
1352   nsCOMPtr<imgIRequest> mRequest;
1353 };
1354
1355 } // anonymous namespace
1356
1357 void
1358 nsImageLoadingContent::MakePendingRequestCurrent()
1359 {
1360   MOZ_ASSERT(mPendingRequest);
1361
1362   // Lock mCurrentRequest for the duration of this method.  We do this because
1363   // PrepareCurrentRequest() might unlock mCurrentRequest.  If mCurrentRequest
1364   // and mPendingRequest are both requests for the same image, unlocking
1365   // mCurrentRequest before we lock mPendingRequest can cause the lock count
1366   // to go to 0 and the image to be discarded!
1367   ImageRequestAutoLock autoLock(mCurrentRequest);
1368
1369   ImageLoadType loadType = \
1370     (mPendingRequestFlags & REQUEST_IS_IMAGESET) ? eImageLoadType_Imageset
1371                                                  : eImageLoadType_Normal;
1372
1373   PrepareCurrentRequest(loadType) = mPendingRequest;
1374   mPendingRequest = nullptr;
1375   mCurrentRequestFlags = mPendingRequestFlags;
1376   mPendingRequestFlags = 0;
1377   ResetAnimationIfNeeded();
1378 }
1379
1380 void
1381 nsImageLoadingContent::ClearCurrentRequest(nsresult aReason,
1382                                            uint32_t aNonvisibleAction)
1383 {
1384   if (!mCurrentRequest) {
1385     // Even if we didn't have a current request, we might have been keeping
1386     // a URI and flags as a placeholder for a failed load. Clear that now.
1387     mCurrentURI = nullptr;
1388     mCurrentRequestFlags = 0;
1389     return;
1390   }
1391   NS_ABORT_IF_FALSE(!mCurrentURI,
1392                     "Shouldn't have both mCurrentRequest and mCurrentURI!");
1393
1394   // Deregister this image from the refresh driver so it no longer receives
1395   // notifications.
1396   nsLayoutUtils::DeregisterImageRequest(GetFramePresContext(), mCurrentRequest,
1397                                         &mCurrentRequestRegistered);
1398
1399   // Clean up the request.
1400   UntrackImage(mCurrentRequest, aNonvisibleAction);
1401   mCurrentRequest->CancelAndForgetObserver(aReason);
1402   mCurrentRequest = nullptr;
1403   mCurrentRequestFlags = 0;
1404 }
1405
1406 void
1407 nsImageLoadingContent::ClearPendingRequest(nsresult aReason,
1408                                            uint32_t aNonvisibleAction)
1409 {
1410   if (!mPendingRequest)
1411     return;
1412
1413   // Deregister this image from the refresh driver so it no longer receives
1414   // notifications.
1415   nsLayoutUtils::DeregisterImageRequest(GetFramePresContext(), mPendingRequest,
1416                                         &mPendingRequestRegistered);
1417
1418   UntrackImage(mPendingRequest, aNonvisibleAction);
1419   mPendingRequest->CancelAndForgetObserver(aReason);
1420   mPendingRequest = nullptr;
1421   mPendingRequestFlags = 0;
1422 }
1423
1424 bool*
1425 nsImageLoadingContent::GetRegisteredFlagForRequest(imgIRequest* aRequest)
1426 {
1427   if (aRequest == mCurrentRequest) {
1428     return &mCurrentRequestRegistered;
1429   } else if (aRequest == mPendingRequest) {
1430     return &mPendingRequestRegistered;
1431   } else {
1432     return nullptr;
1433   }
1434 }
1435
1436 void
1437 nsImageLoadingContent::ResetAnimationIfNeeded()
1438 {
1439   if (mCurrentRequest &&
1440       (mCurrentRequestFlags & REQUEST_NEEDS_ANIMATION_RESET)) {
1441     nsCOMPtr<imgIContainer> container;
1442     mCurrentRequest->GetImage(getter_AddRefs(container));
1443     if (container)
1444       container->ResetAnimation();
1445     mCurrentRequestFlags &= ~REQUEST_NEEDS_ANIMATION_RESET;
1446   }
1447 }
1448
1449 bool
1450 nsImageLoadingContent::HaveSize(imgIRequest *aImage)
1451 {
1452   // Handle the null case
1453   if (!aImage)
1454     return false;
1455
1456   // Query the image
1457   uint32_t status;
1458   nsresult rv = aImage->GetImageStatus(&status);
1459   return (NS_SUCCEEDED(rv) && (status & imgIRequest::STATUS_SIZE_AVAILABLE));
1460 }
1461
1462 void
1463 nsImageLoadingContent::BindToTree(nsIDocument* aDocument, nsIContent* aParent,
1464                                   nsIContent* aBindingParent,
1465                                   bool aCompileEventHandlers)
1466 {
1467   // We may be entering the document, so if our image should be tracked,
1468   // track it.
1469   if (!aDocument)
1470     return;
1471
1472   TrackImage(mCurrentRequest);
1473   TrackImage(mPendingRequest);
1474
1475   if (mCurrentRequestFlags & REQUEST_BLOCKS_ONLOAD)
1476     aDocument->BlockOnload();
1477 }
1478
1479 void
1480 nsImageLoadingContent::UnbindFromTree(bool aDeep, bool aNullParent)
1481 {
1482   // We may be leaving the document, so if our image is tracked, untrack it.
1483   nsCOMPtr<nsIDocument> doc = GetOurCurrentDoc();
1484   if (!doc)
1485     return;
1486
1487   UntrackImage(mCurrentRequest);
1488   UntrackImage(mPendingRequest);
1489
1490   if (mCurrentRequestFlags & REQUEST_BLOCKS_ONLOAD)
1491     doc->UnblockOnload(false);
1492 }
1493
1494 void
1495 nsImageLoadingContent::TrackImage(imgIRequest* aImage)
1496 {
1497   if (!aImage)
1498     return;
1499
1500   MOZ_ASSERT(aImage == mCurrentRequest || aImage == mPendingRequest,
1501              "Why haven't we heard of this request?");
1502
1503   nsIDocument* doc = GetOurCurrentDoc();
1504   if (doc && (mFrameCreateCalled || GetOurPrimaryFrame()) &&
1505       (mVisibleCount > 0)) {
1506     if (aImage == mCurrentRequest && !(mCurrentRequestFlags & REQUEST_IS_TRACKED)) {
1507       mCurrentRequestFlags |= REQUEST_IS_TRACKED;
1508       doc->AddImage(mCurrentRequest);
1509     }
1510     if (aImage == mPendingRequest && !(mPendingRequestFlags & REQUEST_IS_TRACKED)) {
1511       mPendingRequestFlags |= REQUEST_IS_TRACKED;
1512       doc->AddImage(mPendingRequest);
1513     }
1514   }
1515 }
1516
1517 void
1518 nsImageLoadingContent::UntrackImage(imgIRequest* aImage,
1519                                     uint32_t aNonvisibleAction
1520                                       /* = ON_NONVISIBLE_NO_ACTION */)
1521 {
1522   if (!aImage)
1523     return;
1524
1525   MOZ_ASSERT(aImage == mCurrentRequest || aImage == mPendingRequest,
1526              "Why haven't we heard of this request?");
1527
1528   // We may not be in the document.  If we outlived our document that's fine,
1529   // because the document empties out the tracker and unlocks all locked images
1530   // on destruction.  But if we were never in the document we may need to force
1531   // discarding the image here, since this is the only chance we have.
1532   nsIDocument* doc = GetOurCurrentDoc();
1533   if (aImage == mCurrentRequest) {
1534     if (doc && (mCurrentRequestFlags & REQUEST_IS_TRACKED)) {
1535       mCurrentRequestFlags &= ~REQUEST_IS_TRACKED;
1536       doc->RemoveImage(mCurrentRequest,
1537                        (aNonvisibleAction == ON_NONVISIBLE_REQUEST_DISCARD)
1538                          ? nsIDocument::REQUEST_DISCARD
1539                          : 0);
1540     } else if (aNonvisibleAction == ON_NONVISIBLE_REQUEST_DISCARD) {
1541       // If we're not in the document we may still need to be discarded.
1542       aImage->RequestDiscard();
1543     }
1544   }
1545   if (aImage == mPendingRequest) {
1546     if (doc && (mPendingRequestFlags & REQUEST_IS_TRACKED)) {
1547       mPendingRequestFlags &= ~REQUEST_IS_TRACKED;
1548       doc->RemoveImage(mPendingRequest,
1549                        (aNonvisibleAction == ON_NONVISIBLE_REQUEST_DISCARD)
1550                          ? nsIDocument::REQUEST_DISCARD
1551                          : 0);
1552     } else if (aNonvisibleAction == ON_NONVISIBLE_REQUEST_DISCARD) {
1553       // If we're not in the document we may still need to be discarded.
1554       aImage->RequestDiscard();
1555     }
1556   }
1557 }
1558
1559
1560 void
1561 nsImageLoadingContent::CreateStaticImageClone(nsImageLoadingContent* aDest) const
1562 {
1563   aDest->mCurrentRequest = nsContentUtils::GetStaticRequest(mCurrentRequest);
1564   aDest->TrackImage(aDest->mCurrentRequest);
1565   aDest->mForcedImageState = mForcedImageState;
1566   aDest->mImageBlockingStatus = mImageBlockingStatus;
1567   aDest->mLoadingEnabled = mLoadingEnabled;
1568   aDest->mStateChangerDepth = mStateChangerDepth;
1569   aDest->mIsImageStateForced = mIsImageStateForced;
1570   aDest->mLoading = mLoading;
1571   aDest->mBroken = mBroken;
1572   aDest->mUserDisabled = mUserDisabled;
1573   aDest->mSuppressed = mSuppressed;
1574 }
1575
1576 CORSMode
1577 nsImageLoadingContent::GetCORSMode()
1578 {
1579   return CORS_NONE;
1580 }
1581
1582 nsImageLoadingContent::ImageObserver::ImageObserver(imgINotificationObserver* aObserver)
1583   : mObserver(aObserver)
1584   , mNext(nullptr)
1585 {
1586   MOZ_COUNT_CTOR(ImageObserver);
1587 }
1588
1589 nsImageLoadingContent::ImageObserver::~ImageObserver()
1590 {
1591   MOZ_COUNT_DTOR(ImageObserver);
1592   NS_CONTENT_DELETE_LIST_MEMBER(ImageObserver, this, mNext);
1593 }