image/imgLoader.cpp

   1 /* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
   2 /* vim: set ts=8 sts=2 et sw=2 tw=80: */
   3 /* This Source Code Form is subject to the terms of the Mozilla Public
   4  * License, v. 2.0. If a copy of the MPL was not distributed with this
   5  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
   6
   7 // Undefine windows version of LoadImage because our code uses that name.
   8 #include "mozilla/ScopeExit.h"
   9 #include "nsIChildChannel.h"
  10 #include "nsIThreadRetargetableStreamListener.h"
  11 #undef LoadImage
  12
  13 #include "imgLoader.h"
  14
  15 #include <algorithm>
  16 #include <utility>
  17
  18 #include "DecoderFactory.h"
  19 #include "Image.h"
  20 #include "ImageLogging.h"
  21 #include "ReferrerInfo.h"
  22 #include "imgRequestProxy.h"
  23 #include "mozilla/Attributes.h"
  24 #include "mozilla/BasePrincipal.h"
  25 #include "mozilla/ChaosMode.h"
  26 #include "mozilla/ClearOnShutdown.h"
  27 #include "mozilla/LoadInfo.h"
  28 #include "mozilla/NullPrincipal.h"
  29 #include "mozilla/Preferences.h"
  30 #include "mozilla/ProfilerLabels.h"
  31 #include "mozilla/StaticPrefs_image.h"
  32 #include "mozilla/StaticPrefs_network.h"
  33 #include "mozilla/StoragePrincipalHelper.h"
  34 #include "mozilla/dom/ContentParent.h"
  35 #include "mozilla/dom/nsMixedContentBlocker.h"
  36 #include "mozilla/image/ImageMemoryReporter.h"
  37 #include "mozilla/layers/CompositorManagerChild.h"
  38 #include "nsCOMPtr.h"
  39 #include "nsCRT.h"
  40 #include "nsComponentManagerUtils.h"
  41 #include "nsContentPolicyUtils.h"
  42 #include "nsContentSecurityManager.h"
  43 #include "nsContentUtils.h"
  44 #include "nsHttpChannel.h"
  45 #include "nsIAsyncVerifyRedirectCallback.h"
  46 #include "nsICacheInfoChannel.h"
  47 #include "nsIChannelEventSink.h"
  48 #include "nsIClassOfService.h"
  49 #include "nsIEffectiveTLDService.h"
  50 #include "nsIFile.h"
  51 #include "nsIFileURL.h"
  52 #include "nsIHttpChannel.h"
  53 #include "nsIInterfaceRequestor.h"
  54 #include "nsIInterfaceRequestorUtils.h"
  55 #include "nsIMemoryReporter.h"
  56 #include "nsINetworkPredictor.h"
  57 #include "nsIProgressEventSink.h"
  58 #include "nsIProtocolHandler.h"
  59 #include "nsImageModule.h"
  60 #include "nsMediaSniffer.h"
  61 #include "nsMimeTypes.h"
  62 #include "nsNetCID.h"
  63 #include "nsNetUtil.h"
  64 #include "nsProxyRelease.h"
  65 #include "nsQueryObject.h"
  66 #include "nsReadableUtils.h"
  67 #include "nsStreamUtils.h"
  68 #include "prtime.h"
  69
  70 // we want to explore making the document own the load group
  71 // so we can associate the document URI with the load group.
  72 // until this point, we have an evil hack:
  73 #include "nsIHttpChannelInternal.h"
  74 #include "nsILoadGroupChild.h"
  75 #include "nsIDocShell.h"
  76
  77 using namespace mozilla;
  78 using namespace mozilla::dom;
  79 using namespace mozilla::image;
  80 using namespace mozilla::net;
  81
  82 MOZ_DEFINE_MALLOC_SIZE_OF(ImagesMallocSizeOf)
  83
  84 class imgMemoryReporter final : public nsIMemoryReporter {
  85   ~imgMemoryReporter() = default;
  86
  87  public:
  88   NS_DECL_ISUPPORTS
  89
  90   NS_IMETHOD CollectReports(nsIHandleReportCallback* aHandleReport,
  91                             nsISupports* aData, bool aAnonymize) override {
  92     MOZ_ASSERT(NS_IsMainThread());
  93
  94     layers::CompositorManagerChild* manager =
  95         mozilla::layers::CompositorManagerChild::GetInstance();
  96     if (!manager || !StaticPrefs::image_mem_debug_reporting()) {
  97       layers::SharedSurfacesMemoryReport sharedSurfaces;
  98       FinishCollectReports(aHandleReport, aData, aAnonymize, sharedSurfaces);
  99       return NS_OK;
 100     }
 101
 102     RefPtr<imgMemoryReporter> self(this);
 103     nsCOMPtr<nsIHandleReportCallback> handleReport(aHandleReport);
 104     nsCOMPtr<nsISupports> data(aData);
 105     manager->SendReportSharedSurfacesMemory(
 106         [=](layers::SharedSurfacesMemoryReport aReport) {
 107           self->FinishCollectReports(handleReport, data, aAnonymize, aReport);
 108         },
 109         [=](mozilla::ipc::ResponseRejectReason&& aReason) {
 110           layers::SharedSurfacesMemoryReport sharedSurfaces;
 111           self->FinishCollectReports(handleReport, data, aAnonymize,
 112                                      sharedSurfaces);
 113         });
 114     return NS_OK;
 115   }
 116
 117   void FinishCollectReports(
 118       nsIHandleReportCallback* aHandleReport, nsISupports* aData,
 119       bool aAnonymize, layers::SharedSurfacesMemoryReport& aSharedSurfaces) {
 120     nsTArray<ImageMemoryCounter> chrome;
 121     nsTArray<ImageMemoryCounter> content;
 122     nsTArray<ImageMemoryCounter> uncached;
 123
 124     for (uint32_t i = 0; i < mKnownLoaders.Length(); i++) {
 125       for (imgCacheEntry* entry : mKnownLoaders[i]->mCache.Values()) {
 126         RefPtr<imgRequest> req = entry->GetRequest();
 127         RecordCounterForRequest(req, &content, !entry->HasNoProxies());
 128       }
 129       MutexAutoLock lock(mKnownLoaders[i]->mUncachedImagesMutex);
 130       for (RefPtr<imgRequest> req : mKnownLoaders[i]->mUncachedImages) {
 131         RecordCounterForRequest(req, &uncached, req->HasConsumers());
 132       }
 133     }
 134
 135     // Note that we only need to anonymize content image URIs.
 136
 137     ReportCounterArray(aHandleReport, aData, chrome, "images/chrome",
 138                        /* aAnonymize */ false, aSharedSurfaces);
 139
 140     ReportCounterArray(aHandleReport, aData, content, "images/content",
 141                        aAnonymize, aSharedSurfaces);
 142
 143     // Uncached images may be content or chrome, so anonymize them.
 144     ReportCounterArray(aHandleReport, aData, uncached, "images/uncached",
 145                        aAnonymize, aSharedSurfaces);
 146
 147     // Report any shared surfaces that were not merged with the surface cache.
 148     ImageMemoryReporter::ReportSharedSurfaces(aHandleReport, aData,
 149                                               aSharedSurfaces);
 150
 151     nsCOMPtr<nsIMemoryReporterManager> imgr =
 152         do_GetService("@mozilla.org/memory-reporter-manager;1");
 153     if (imgr) {
 154       imgr->EndReport();
 155     }
 156   }
 157
 158   static int64_t ImagesContentUsedUncompressedDistinguishedAmount() {
 159     size_t n = 0;
 160     for (uint32_t i = 0; i < imgLoader::sMemReporter->mKnownLoaders.Length();
 161          i++) {
 162       for (imgCacheEntry* entry :
 163            imgLoader::sMemReporter->mKnownLoaders[i]->mCache.Values()) {
 164         if (entry->HasNoProxies()) {
 165           continue;
 166         }
 167
 168         RefPtr<imgRequest> req = entry->GetRequest();
 169         RefPtr<image::Image> image = req->GetImage();
 170         if (!image) {
 171           continue;
 172         }
 173
 174         // Both this and EntryImageSizes measure
 175         // images/content/raster/used/decoded memory.  This function's
 176         // measurement is secondary -- the result doesn't go in the "explicit"
 177         // tree -- so we use moz_malloc_size_of instead of ImagesMallocSizeOf to
 178         // prevent DMD from seeing it reported twice.
 179         SizeOfState state(moz_malloc_size_of);
 180         ImageMemoryCounter counter(req, image, state, /* aIsUsed = */ true);
 181
 182         n += counter.Values().DecodedHeap();
 183         n += counter.Values().DecodedNonHeap();
 184         n += counter.Values().DecodedUnknown();
 185       }
 186     }
 187     return n;
 188   }
 189
 190   void RegisterLoader(imgLoader* aLoader) {
 191     mKnownLoaders.AppendElement(aLoader);
 192   }
 193
 194   void UnregisterLoader(imgLoader* aLoader) {
 195     mKnownLoaders.RemoveElement(aLoader);
 196   }
 197
 198  private:
 199   nsTArray<imgLoader*> mKnownLoaders;
 200
 201   struct MemoryTotal {
 202     MemoryTotal& operator+=(const ImageMemoryCounter& aImageCounter) {
 203       if (aImageCounter.Type() == imgIContainer::TYPE_RASTER) {
 204         if (aImageCounter.IsUsed()) {
 205           mUsedRasterCounter += aImageCounter.Values();
 206         } else {
 207           mUnusedRasterCounter += aImageCounter.Values();
 208         }
 209       } else if (aImageCounter.Type() == imgIContainer::TYPE_VECTOR) {
 210         if (aImageCounter.IsUsed()) {
 211           mUsedVectorCounter += aImageCounter.Values();
 212         } else {
 213           mUnusedVectorCounter += aImageCounter.Values();
 214         }
 215       } else if (aImageCounter.Type() == imgIContainer::TYPE_REQUEST) {
 216         // Nothing to do, we did not get to the point of having an image.
 217       } else {
 218         MOZ_CRASH("Unexpected image type");
 219       }
 220
 221       return *this;
 222     }
 223
 224     const MemoryCounter& UsedRaster() const { return mUsedRasterCounter; }
 225     const MemoryCounter& UnusedRaster() const { return mUnusedRasterCounter; }
 226     const MemoryCounter& UsedVector() const { return mUsedVectorCounter; }
 227     const MemoryCounter& UnusedVector() const { return mUnusedVectorCounter; }
 228
 229    private:
 230     MemoryCounter mUsedRasterCounter;
 231     MemoryCounter mUnusedRasterCounter;
 232     MemoryCounter mUsedVectorCounter;
 233     MemoryCounter mUnusedVectorCounter;
 234   };
 235
 236   // Reports all images of a single kind, e.g. all used chrome images.
 237   void ReportCounterArray(nsIHandleReportCallback* aHandleReport,
 238                           nsISupports* aData,
 239                           nsTArray<ImageMemoryCounter>& aCounterArray,
 240                           const char* aPathPrefix, bool aAnonymize,
 241                           layers::SharedSurfacesMemoryReport& aSharedSurfaces) {
 242     MemoryTotal summaryTotal;
 243     MemoryTotal nonNotableTotal;
 244
 245     // Report notable images, and compute total and non-notable aggregate sizes.
 246     for (uint32_t i = 0; i < aCounterArray.Length(); i++) {
 247       ImageMemoryCounter& counter = aCounterArray[i];
 248
 249       if (aAnonymize) {
 250         counter.URI().Truncate();
 251         counter.URI().AppendPrintf("<anonymized-%u>", i);
 252       } else {
 253         // The URI could be an extremely long data: URI. Truncate if needed.
 254         static const size_t max = 256;
 255         if (counter.URI().Length() > max) {
 256           counter.URI().Truncate(max);
 257           counter.URI().AppendLiteral(" (truncated)");
 258         }
 259         counter.URI().ReplaceChar('/', '\\');
 260       }
 261
 262       summaryTotal += counter;
 263
 264       if (counter.IsNotable() || StaticPrefs::image_mem_debug_reporting()) {
 265         ReportImage(aHandleReport, aData, aPathPrefix, counter,
 266                     aSharedSurfaces);
 267       } else {
 268         ImageMemoryReporter::TrimSharedSurfaces(counter, aSharedSurfaces);
 269         nonNotableTotal += counter;
 270       }
 271     }
 272
 273     // Report non-notable images in aggregate.
 274     ReportTotal(aHandleReport, aData, /* aExplicit = */ true, aPathPrefix,
 275                 "<non-notable images>/", nonNotableTotal);
 276
 277     // Report a summary in aggregate, outside of the explicit tree.
 278     ReportTotal(aHandleReport, aData, /* aExplicit = */ false, aPathPrefix, "",
 279                 summaryTotal);
 280   }
 281
 282   static void ReportImage(nsIHandleReportCallback* aHandleReport,
 283                           nsISupports* aData, const char* aPathPrefix,
 284                           const ImageMemoryCounter& aCounter,
 285                           layers::SharedSurfacesMemoryReport& aSharedSurfaces) {
 286     nsAutoCString pathPrefix("explicit/"_ns);
 287     pathPrefix.Append(aPathPrefix);
 288
 289     switch (aCounter.Type()) {
 290       case imgIContainer::TYPE_RASTER:
 291         pathPrefix.AppendLiteral("/raster/");
 292         break;
 293       case imgIContainer::TYPE_VECTOR:
 294         pathPrefix.AppendLiteral("/vector/");
 295         break;
 296       case imgIContainer::TYPE_REQUEST:
 297         pathPrefix.AppendLiteral("/request/");
 298         break;
 299       default:
 300         pathPrefix.AppendLiteral("/unknown=");
 301         pathPrefix.AppendInt(aCounter.Type());
 302         pathPrefix.AppendLiteral("/");
 303         break;
 304     }
 305
 306     pathPrefix.Append(aCounter.IsUsed() ? "used/" : "unused/");
 307     if (aCounter.IsValidating()) {
 308       pathPrefix.AppendLiteral("validating/");
 309     }
 310     if (aCounter.HasError()) {
 311       pathPrefix.AppendLiteral("err/");
 312     }
 313
 314     pathPrefix.AppendLiteral("progress=");
 315     pathPrefix.AppendInt(aCounter.Progress(), 16);
 316     pathPrefix.AppendLiteral("/");
 317
 318     pathPrefix.AppendLiteral("image(");
 319     pathPrefix.AppendInt(aCounter.IntrinsicSize().width);
 320     pathPrefix.AppendLiteral("x");
 321     pathPrefix.AppendInt(aCounter.IntrinsicSize().height);
 322     pathPrefix.AppendLiteral(", ");
 323
 324     if (aCounter.URI().IsEmpty()) {
 325       pathPrefix.AppendLiteral("<unknown URI>");
 326     } else {
 327       pathPrefix.Append(aCounter.URI());
 328     }
 329
 330     pathPrefix.AppendLiteral(")/");
 331
 332     ReportSurfaces(aHandleReport, aData, pathPrefix, aCounter, aSharedSurfaces);
 333
 334     ReportSourceValue(aHandleReport, aData, pathPrefix, aCounter.Values());
 335   }
 336
 337   static void ReportSurfaces(
 338       nsIHandleReportCallback* aHandleReport, nsISupports* aData,
 339       const nsACString& aPathPrefix, const ImageMemoryCounter& aCounter,
 340       layers::SharedSurfacesMemoryReport& aSharedSurfaces) {
 341     for (const SurfaceMemoryCounter& counter : aCounter.Surfaces()) {
 342       nsAutoCString surfacePathPrefix(aPathPrefix);
 343       switch (counter.Type()) {
 344         case SurfaceMemoryCounterType::NORMAL:
 345           if (counter.IsLocked()) {
 346             surfacePathPrefix.AppendLiteral("locked/");
 347           } else {
 348             surfacePathPrefix.AppendLiteral("unlocked/");
 349           }
 350           if (counter.IsFactor2()) {
 351             surfacePathPrefix.AppendLiteral("factor2/");
 352           }
 353           if (counter.CannotSubstitute()) {
 354             surfacePathPrefix.AppendLiteral("cannot_substitute/");
 355           }
 356           break;
 357         case SurfaceMemoryCounterType::CONTAINER:
 358           surfacePathPrefix.AppendLiteral("container/");
 359           break;
 360         default:
 361           MOZ_ASSERT_UNREACHABLE("Unknown counter type");
 362           break;
 363       }
 364
 365       surfacePathPrefix.AppendLiteral("types=");
 366       surfacePathPrefix.AppendInt(counter.Values().SurfaceTypes(), 16);
 367       surfacePathPrefix.AppendLiteral("/surface(");
 368       surfacePathPrefix.AppendInt(counter.Key().Size().width);
 369       surfacePathPrefix.AppendLiteral("x");
 370       surfacePathPrefix.AppendInt(counter.Key().Size().height);
 371
 372       if (!counter.IsFinished()) {
 373         surfacePathPrefix.AppendLiteral(", incomplete");
 374       }
 375
 376       if (counter.Values().ExternalHandles() > 0) {
 377         surfacePathPrefix.AppendLiteral(", handles:");
 378         surfacePathPrefix.AppendInt(
 379             uint32_t(counter.Values().ExternalHandles()));
 380       }
 381
 382       ImageMemoryReporter::AppendSharedSurfacePrefix(surfacePathPrefix, counter,
 383                                                      aSharedSurfaces);
 384
 385       PlaybackType playback = counter.Key().Playback();
 386       if (playback == PlaybackType::eAnimated) {
 387         if (StaticPrefs::image_mem_debug_reporting()) {
 388           surfacePathPrefix.AppendPrintf(
 389               " (animation %4u)", uint32_t(counter.Values().FrameIndex()));
 390         } else {
 391           surfacePathPrefix.AppendLiteral(" (animation)");
 392         }
 393       }
 394
 395       if (counter.Key().Flags() != DefaultSurfaceFlags()) {
 396         surfacePathPrefix.AppendLiteral(", flags:");
 397         surfacePathPrefix.AppendInt(uint32_t(counter.Key().Flags()),
 398                                     /* aRadix = */ 16);
 399       }
 400
 401       if (counter.Key().Region()) {
 402         const ImageIntRegion& region = counter.Key().Region().ref();
 403         const gfx::IntRect& rect = region.Rect();
 404         surfacePathPrefix.AppendLiteral(", region:[ rect=(");
 405         surfacePathPrefix.AppendInt(rect.x);
 406         surfacePathPrefix.AppendLiteral(",");
 407         surfacePathPrefix.AppendInt(rect.y);
 408         surfacePathPrefix.AppendLiteral(") ");
 409         surfacePathPrefix.AppendInt(rect.width);
 410         surfacePathPrefix.AppendLiteral("x");
 411         surfacePathPrefix.AppendInt(rect.height);
 412         if (region.IsRestricted()) {
 413           const gfx::IntRect& restrict = region.Restriction();
 414           if (restrict == rect) {
 415             surfacePathPrefix.AppendLiteral(", restrict=rect");
 416           } else {
 417             surfacePathPrefix.AppendLiteral(", restrict=(");
 418             surfacePathPrefix.AppendInt(restrict.x);
 419             surfacePathPrefix.AppendLiteral(",");
 420             surfacePathPrefix.AppendInt(restrict.y);
 421             surfacePathPrefix.AppendLiteral(") ");
 422             surfacePathPrefix.AppendInt(restrict.width);
 423             surfacePathPrefix.AppendLiteral("x");
 424             surfacePathPrefix.AppendInt(restrict.height);
 425           }
 426         }
 427         if (region.GetExtendMode() != gfx::ExtendMode::CLAMP) {
 428           surfacePathPrefix.AppendLiteral(", extendMode=");
 429           surfacePathPrefix.AppendInt(int32_t(region.GetExtendMode()));
 430         }
 431         surfacePathPrefix.AppendLiteral("]");
 432       }
 433
 434       const SVGImageContext& context = counter.Key().SVGContext();
 435       surfacePathPrefix.AppendLiteral(", svgContext:[ ");
 436       if (context.GetViewportSize()) {
 437         const CSSIntSize& size = context.GetViewportSize().ref();
 438         surfacePathPrefix.AppendLiteral("viewport=(");
 439         surfacePathPrefix.AppendInt(size.width);
 440         surfacePathPrefix.AppendLiteral("x");
 441         surfacePathPrefix.AppendInt(size.height);
 442         surfacePathPrefix.AppendLiteral(") ");
 443       }
 444       if (context.GetPreserveAspectRatio()) {
 445         nsAutoString aspect;
 446         context.GetPreserveAspectRatio()->ToString(aspect);
 447         surfacePathPrefix.AppendLiteral("preserveAspectRatio=(");
 448         LossyAppendUTF16toASCII(aspect, surfacePathPrefix);
 449         surfacePathPrefix.AppendLiteral(") ");
 450       }
 451       if (auto scheme = context.GetColorScheme()) {
 452         surfacePathPrefix.AppendLiteral("colorScheme=");
 453         surfacePathPrefix.AppendInt(int32_t(*scheme));
 454         surfacePathPrefix.AppendLiteral(" ");
 455       }
 456       if (context.GetContextPaint()) {
 457         const SVGEmbeddingContextPaint* paint = context.GetContextPaint();
 458         surfacePathPrefix.AppendLiteral("contextPaint=(");
 459         if (paint->GetFill()) {
 460           surfacePathPrefix.AppendLiteral(" fill=");
 461           surfacePathPrefix.AppendInt(paint->GetFill()->ToABGR(), 16);
 462         }
 463         if (paint->GetFillOpacity() != 1.0) {
 464           surfacePathPrefix.AppendLiteral(" fillOpa=");
 465           surfacePathPrefix.AppendFloat(paint->GetFillOpacity());
 466         }
 467         if (paint->GetStroke()) {
 468           surfacePathPrefix.AppendLiteral(" stroke=");
 469           surfacePathPrefix.AppendInt(paint->GetStroke()->ToABGR(), 16);
 470         }
 471         if (paint->GetStrokeOpacity() != 1.0) {
 472           surfacePathPrefix.AppendLiteral(" strokeOpa=");
 473           surfacePathPrefix.AppendFloat(paint->GetStrokeOpacity());
 474         }
 475         surfacePathPrefix.AppendLiteral(" ) ");
 476       }
 477       surfacePathPrefix.AppendLiteral("]");
 478
 479       surfacePathPrefix.AppendLiteral(")/");
 480
 481       ReportValues(aHandleReport, aData, surfacePathPrefix, counter.Values());
 482     }
 483   }
 484
 485   static void ReportTotal(nsIHandleReportCallback* aHandleReport,
 486                           nsISupports* aData, bool aExplicit,
 487                           const char* aPathPrefix, const char* aPathInfix,
 488                           const MemoryTotal& aTotal) {
 489     nsAutoCString pathPrefix;
 490     if (aExplicit) {
 491       pathPrefix.AppendLiteral("explicit/");
 492     }
 493     pathPrefix.Append(aPathPrefix);
 494
 495     nsAutoCString rasterUsedPrefix(pathPrefix);
 496     rasterUsedPrefix.AppendLiteral("/raster/used/");
 497     rasterUsedPrefix.Append(aPathInfix);
 498     ReportValues(aHandleReport, aData, rasterUsedPrefix, aTotal.UsedRaster());
 499
 500     nsAutoCString rasterUnusedPrefix(pathPrefix);
 501     rasterUnusedPrefix.AppendLiteral("/raster/unused/");
 502     rasterUnusedPrefix.Append(aPathInfix);
 503     ReportValues(aHandleReport, aData, rasterUnusedPrefix,
 504                  aTotal.UnusedRaster());
 505
 506     nsAutoCString vectorUsedPrefix(pathPrefix);
 507     vectorUsedPrefix.AppendLiteral("/vector/used/");
 508     vectorUsedPrefix.Append(aPathInfix);
 509     ReportValues(aHandleReport, aData, vectorUsedPrefix, aTotal.UsedVector());
 510
 511     nsAutoCString vectorUnusedPrefix(pathPrefix);
 512     vectorUnusedPrefix.AppendLiteral("/vector/unused/");
 513     vectorUnusedPrefix.Append(aPathInfix);
 514     ReportValues(aHandleReport, aData, vectorUnusedPrefix,
 515                  aTotal.UnusedVector());
 516   }
 517
 518   static void ReportValues(nsIHandleReportCallback* aHandleReport,
 519                            nsISupports* aData, const nsACString& aPathPrefix,
 520                            const MemoryCounter& aCounter) {
 521     ReportSourceValue(aHandleReport, aData, aPathPrefix, aCounter);
 522
 523     ReportValue(aHandleReport, aData, KIND_HEAP, aPathPrefix, "decoded-heap",
 524                 "Decoded image data which is stored on the heap.",
 525                 aCounter.DecodedHeap());
 526
 527     ReportValue(aHandleReport, aData, KIND_NONHEAP, aPathPrefix,
 528                 "decoded-nonheap",
 529                 "Decoded image data which isn't stored on the heap.",
 530                 aCounter.DecodedNonHeap());
 531
 532     // We don't know for certain whether or not it is on the heap, so let's
 533     // just report it as non-heap for reporting purposes.
 534     ReportValue(aHandleReport, aData, KIND_NONHEAP, aPathPrefix,
 535                 "decoded-unknown",
 536                 "Decoded image data which is unknown to be on the heap or not.",
 537                 aCounter.DecodedUnknown());
 538   }
 539
 540   static void ReportSourceValue(nsIHandleReportCallback* aHandleReport,
 541                                 nsISupports* aData,
 542                                 const nsACString& aPathPrefix,
 543                                 const MemoryCounter& aCounter) {
 544     ReportValue(aHandleReport, aData, KIND_HEAP, aPathPrefix, "source",
 545                 "Raster image source data and vector image documents.",
 546                 aCounter.Source());
 547   }
 548
 549   static void ReportValue(nsIHandleReportCallback* aHandleReport,
 550                           nsISupports* aData, int32_t aKind,
 551                           const nsACString& aPathPrefix,
 552                           const char* aPathSuffix, const char* aDescription,
 553                           size_t aValue) {
 554     if (aValue == 0) {
 555       return;
 556     }
 557
 558     nsAutoCString desc(aDescription);
 559     nsAutoCString path(aPathPrefix);
 560     path.Append(aPathSuffix);
 561
 562     aHandleReport->Callback(""_ns, path, aKind, UNITS_BYTES, aValue, desc,
 563                             aData);
 564   }
 565
 566   static void RecordCounterForRequest(imgRequest* aRequest,
 567                                       nsTArray<ImageMemoryCounter>* aArray,
 568                                       bool aIsUsed) {
 569     SizeOfState state(ImagesMallocSizeOf);
 570     RefPtr<image::Image> image = aRequest->GetImage();
 571     if (image) {
 572       ImageMemoryCounter counter(aRequest, image, state, aIsUsed);
 573       aArray->AppendElement(std::move(counter));
 574     } else {
 575       // We can at least record some information about the image from the
 576       // request, and mark it as not knowing the image type yet.
 577       ImageMemoryCounter counter(aRequest, state, aIsUsed);
 578       aArray->AppendElement(std::move(counter));
 579     }
 580   }
 581 };
 582
 583 NS_IMPL_ISUPPORTS(imgMemoryReporter, nsIMemoryReporter)
 584
 585 NS_IMPL_ISUPPORTS(nsProgressNotificationProxy, nsIProgressEventSink,
 586                   nsIChannelEventSink, nsIInterfaceRequestor)
 587
 588 NS_IMETHODIMP
 589 nsProgressNotificationProxy::OnProgress(nsIRequest* request, int64_t progress,
 590                                         int64_t progressMax) {
 591   nsCOMPtr<nsILoadGroup> loadGroup;
 592   request->GetLoadGroup(getter_AddRefs(loadGroup));
 593
 594   nsCOMPtr<nsIProgressEventSink> target;
 595   NS_QueryNotificationCallbacks(mOriginalCallbacks, loadGroup,
 596                                 NS_GET_IID(nsIProgressEventSink),
 597                                 getter_AddRefs(target));
 598   if (!target) {
 599     return NS_OK;
 600   }
 601   return target->OnProgress(mImageRequest, progress, progressMax);
 602 }
 603
 604 NS_IMETHODIMP
 605 nsProgressNotificationProxy::OnStatus(nsIRequest* request, nsresult status,
 606                                       const char16_t* statusArg) {
 607   nsCOMPtr<nsILoadGroup> loadGroup;
 608   request->GetLoadGroup(getter_AddRefs(loadGroup));
 609
 610   nsCOMPtr<nsIProgressEventSink> target;
 611   NS_QueryNotificationCallbacks(mOriginalCallbacks, loadGroup,
 612                                 NS_GET_IID(nsIProgressEventSink),
 613                                 getter_AddRefs(target));
 614   if (!target) {
 615     return NS_OK;
 616   }
 617   return target->OnStatus(mImageRequest, status, statusArg);
 618 }
 619
 620 NS_IMETHODIMP
 621 nsProgressNotificationProxy::AsyncOnChannelRedirect(
 622     nsIChannel* oldChannel, nsIChannel* newChannel, uint32_t flags,
 623     nsIAsyncVerifyRedirectCallback* cb) {
 624   // Tell the original original callbacks about it too
 625   nsCOMPtr<nsILoadGroup> loadGroup;
 626   newChannel->GetLoadGroup(getter_AddRefs(loadGroup));
 627   nsCOMPtr<nsIChannelEventSink> target;
 628   NS_QueryNotificationCallbacks(mOriginalCallbacks, loadGroup,
 629                                 NS_GET_IID(nsIChannelEventSink),
 630                                 getter_AddRefs(target));
 631   if (!target) {
 632     cb->OnRedirectVerifyCallback(NS_OK);
 633     return NS_OK;
 634   }
 635
 636   // Delegate to |target| if set, reusing |cb|
 637   return target->AsyncOnChannelRedirect(oldChannel, newChannel, flags, cb);
 638 }
 639
 640 NS_IMETHODIMP
 641 nsProgressNotificationProxy::GetInterface(const nsIID& iid, void** result) {
 642   if (iid.Equals(NS_GET_IID(nsIProgressEventSink))) {
 643     *result = static_cast<nsIProgressEventSink*>(this);
 644     NS_ADDREF_THIS();
 645     return NS_OK;
 646   }
 647   if (iid.Equals(NS_GET_IID(nsIChannelEventSink))) {
 648     *result = static_cast<nsIChannelEventSink*>(this);
 649     NS_ADDREF_THIS();
 650     return NS_OK;
 651   }
 652   if (mOriginalCallbacks) {
 653     return mOriginalCallbacks->GetInterface(iid, result);
 654   }
 655   return NS_NOINTERFACE;
 656 }
 657
 658 static void NewRequestAndEntry(bool aForcePrincipalCheckForCacheEntry,
 659                                imgLoader* aLoader, const ImageCacheKey& aKey,
 660                                imgRequest** aRequest, imgCacheEntry** aEntry) {
 661   RefPtr<imgRequest> request = new imgRequest(aLoader, aKey);
 662   RefPtr<imgCacheEntry> entry =
 663       new imgCacheEntry(aLoader, request, aForcePrincipalCheckForCacheEntry);
 664   aLoader->AddToUncachedImages(request);
 665   request.forget(aRequest);
 666   entry.forget(aEntry);
 667 }
 668
 669 static bool ShouldRevalidateEntry(imgCacheEntry* aEntry, nsLoadFlags aFlags,
 670                                   bool aHasExpired) {
 671   if (aFlags & nsIRequest::LOAD_BYPASS_CACHE) {
 672     return false;
 673   }
 674   if (aFlags & nsIRequest::VALIDATE_ALWAYS) {
 675     return true;
 676   }
 677   if (aEntry->GetMustValidate()) {
 678     return true;
 679   }
 680   if (aHasExpired) {
 681     // The cache entry has expired...  Determine whether the stale cache
 682     // entry can be used without validation...
 683     if (aFlags & (nsIRequest::LOAD_FROM_CACHE | nsIRequest::VALIDATE_NEVER |
 684                   nsIRequest::VALIDATE_ONCE_PER_SESSION)) {
 685       // LOAD_FROM_CACHE, VALIDATE_NEVER and VALIDATE_ONCE_PER_SESSION allow
 686       // stale cache entries to be used unless they have been explicitly marked
 687       // to indicate that revalidation is necessary.
 688       return false;
 689     }
 690     // Entry is expired, revalidate.
 691     return true;
 692   }
 693   return false;
 694 }
 695
 696 /* Call content policies on cached images that went through a redirect */
 697 static bool ShouldLoadCachedImage(imgRequest* aImgRequest,
 698                                   Document* aLoadingDocument,
 699                                   nsIPrincipal* aTriggeringPrincipal,
 700                                   nsContentPolicyType aPolicyType,
 701                                   bool aSendCSPViolationReports) {
 702   /* Call content policies on cached images - Bug 1082837
 703    * Cached images are keyed off of the first uri in a redirect chain.
 704    * Hence content policies don't get a chance to test the intermediate hops
 705    * or the final destination.  Here we test the final destination using
 706    * mFinalURI off of the imgRequest and passing it into content policies.
 707    * For Mixed Content Blocker, we do an additional check to determine if any
 708    * of the intermediary hops went through an insecure redirect with the
 709    * mHadInsecureRedirect flag
 710    */
 711   bool insecureRedirect = aImgRequest->HadInsecureRedirect();
 712   nsCOMPtr<nsIURI> contentLocation;
 713   aImgRequest->GetFinalURI(getter_AddRefs(contentLocation));
 714   nsresult rv;
 715
 716   nsCOMPtr<nsIPrincipal> loadingPrincipal =
 717       aLoadingDocument ? aLoadingDocument->NodePrincipal()
 718                        : aTriggeringPrincipal;
 719   // If there is no context and also no triggeringPrincipal, then we use a fresh
 720   // nullPrincipal as the loadingPrincipal because we can not create a loadinfo
 721   // without a valid loadingPrincipal.
 722   if (!loadingPrincipal) {
 723     loadingPrincipal = NullPrincipal::CreateWithoutOriginAttributes();
 724   }
 725
 726   nsCOMPtr<nsILoadInfo> secCheckLoadInfo = new LoadInfo(
 727       loadingPrincipal, aTriggeringPrincipal, aLoadingDocument,
 728       nsILoadInfo::SEC_ONLY_FOR_EXPLICIT_CONTENTSEC_CHECK, aPolicyType);
 729
 730   secCheckLoadInfo->SetSendCSPViolationEvents(aSendCSPViolationReports);
 731
 732   int16_t decision = nsIContentPolicy::REJECT_REQUEST;
 733   rv = NS_CheckContentLoadPolicy(contentLocation, secCheckLoadInfo,
 734                                  ""_ns,  // mime guess
 735                                  &decision, nsContentUtils::GetContentPolicy());
 736   if (NS_FAILED(rv) || !NS_CP_ACCEPTED(decision)) {
 737     return false;
 738   }
 739
 740   // We call all Content Policies above, but we also have to call mcb
 741   // individually to check the intermediary redirect hops are secure.
 742   if (insecureRedirect) {
 743     // Bug 1314356: If the image ended up in the cache upgraded by HSTS and the
 744     // page uses upgrade-inscure-requests it had an insecure redirect
 745     // (http->https). We need to invalidate the image and reload it because
 746     // mixed content blocker only bails if upgrade-insecure-requests is set on
 747     // the doc and the resource load is http: which would result in an incorrect
 748     // mixed content warning.
 749     nsCOMPtr<nsIDocShell> docShell =
 750         NS_CP_GetDocShellFromContext(ToSupports(aLoadingDocument));
 751     if (docShell) {
 752       Document* document = docShell->GetDocument();
 753       if (document && document->GetUpgradeInsecureRequests(false)) {
 754         return false;
 755       }
 756     }
 757
 758     if (!aTriggeringPrincipal || !aTriggeringPrincipal->IsSystemPrincipal()) {
 759       // reset the decision for mixed content blocker check
 760       decision = nsIContentPolicy::REJECT_REQUEST;
 761       rv = nsMixedContentBlocker::ShouldLoad(insecureRedirect, contentLocation,
 762                                              secCheckLoadInfo,
 763                                              ""_ns,  // mime guess
 764                                              true,   // aReportError
 765                                              &decision);
 766       if (NS_FAILED(rv) || !NS_CP_ACCEPTED(decision)) {
 767         return false;
 768       }
 769     }
 770   }
 771
 772   return true;
 773 }
 774
 775 // Returns true if this request is compatible with the given CORS mode on the
 776 // given loading principal, and false if the request may not be reused due
 777 // to CORS.
 778 static bool ValidateCORSMode(imgRequest* aRequest, bool aForcePrincipalCheck,
 779                              CORSMode aCORSMode,
 780                              nsIPrincipal* aTriggeringPrincipal) {
 781   // If the entry's CORS mode doesn't match, or the CORS mode matches but the
 782   // document principal isn't the same, we can't use this request.
 783   if (aRequest->GetCORSMode() != aCORSMode) {
 784     return false;
 785   }
 786
 787   if (aRequest->GetCORSMode() != CORS_NONE || aForcePrincipalCheck) {
 788     nsCOMPtr<nsIPrincipal> otherprincipal = aRequest->GetTriggeringPrincipal();
 789
 790     // If we previously had a principal, but we don't now, we can't use this
 791     // request.
 792     if (otherprincipal && !aTriggeringPrincipal) {
 793       return false;
 794     }
 795
 796     if (otherprincipal && aTriggeringPrincipal &&
 797         !otherprincipal->Equals(aTriggeringPrincipal)) {
 798       return false;
 799     }
 800   }
 801
 802   return true;
 803 }
 804
 805 static bool ValidateSecurityInfo(imgRequest* aRequest,
 806                                  bool aForcePrincipalCheck, CORSMode aCORSMode,
 807                                  nsIPrincipal* aTriggeringPrincipal,
 808                                  Document* aLoadingDocument,
 809                                  nsContentPolicyType aPolicyType) {
 810   if (!ValidateCORSMode(aRequest, aForcePrincipalCheck, aCORSMode,
 811                         aTriggeringPrincipal)) {
 812     return false;
 813   }
 814   // Content Policy Check on Cached Images
 815   return ShouldLoadCachedImage(aRequest, aLoadingDocument, aTriggeringPrincipal,
 816                                aPolicyType,
 817                                /* aSendCSPViolationReports */ false);
 818 }
 819
 820 static nsresult NewImageChannel(
 821     nsIChannel** aResult,
 822     // If aForcePrincipalCheckForCacheEntry is true, then we will
 823     // force a principal check even when not using CORS before
 824     // assuming we have a cache hit on a cache entry that we
 825     // create for this channel.  This is an out param that should
 826     // be set to true if this channel ends up depending on
 827     // aTriggeringPrincipal and false otherwise.
 828     bool* aForcePrincipalCheckForCacheEntry, nsIURI* aURI,
 829     nsIURI* aInitialDocumentURI, CORSMode aCORSMode,
 830     nsIReferrerInfo* aReferrerInfo, nsILoadGroup* aLoadGroup,
 831     nsLoadFlags aLoadFlags, nsContentPolicyType aPolicyType,
 832     nsIPrincipal* aTriggeringPrincipal, nsINode* aRequestingNode,
 833     bool aRespectPrivacy, uint64_t aEarlyHintPreloaderId) {
 834   MOZ_ASSERT(aResult);
 835
 836   nsresult rv;
 837   nsCOMPtr<nsIHttpChannel> newHttpChannel;
 838
 839   nsCOMPtr<nsIInterfaceRequestor> callbacks;
 840
 841   if (aLoadGroup) {
 842     // Get the notification callbacks from the load group for the new channel.
 843     //
 844     // XXX: This is not exactly correct, because the network request could be
 845     //      referenced by multiple windows...  However, the new channel needs
 846     //      something.  So, using the 'first' notification callbacks is better
 847     //      than nothing...
 848     //
 849     aLoadGroup->GetNotificationCallbacks(getter_AddRefs(callbacks));
 850   }
 851
 852   // Pass in a nullptr loadgroup because this is the underlying network
 853   // request. This request may be referenced by several proxy image requests
 854   // (possibly in different documents).
 855   // If all of the proxy requests are canceled then this request should be
 856   // canceled too.
 857   //
 858
 859   nsSecurityFlags securityFlags =
 860       nsContentSecurityManager::ComputeSecurityFlags(
 861           aCORSMode, nsContentSecurityManager::CORSSecurityMapping::
 862                          CORS_NONE_MAPS_TO_INHERITED_CONTEXT);
 863
 864   securityFlags |= nsILoadInfo::SEC_ALLOW_CHROME;
 865
 866   // Note we are calling NS_NewChannelWithTriggeringPrincipal() here with a
 867   // node and a principal. This is for things like background images that are
 868   // specified by user stylesheets, where the document is being styled, but
 869   // the principal is that of the user stylesheet.
 870   if (aRequestingNode && aTriggeringPrincipal) {
 871     rv = NS_NewChannelWithTriggeringPrincipal(aResult, aURI, aRequestingNode,
 872                                               aTriggeringPrincipal,
 873                                               securityFlags, aPolicyType,
 874                                               nullptr,  // PerformanceStorage
 875                                               nullptr,  // loadGroup
 876                                               callbacks, aLoadFlags);
 877
 878     if (NS_FAILED(rv)) {
 879       return rv;
 880     }
 881
 882     if (aPolicyType == nsIContentPolicy::TYPE_INTERNAL_IMAGE_FAVICON) {
 883       // If this is a favicon loading, we will use the originAttributes from the
 884       // triggeringPrincipal as the channel's originAttributes. This allows the
 885       // favicon loading from XUL will use the correct originAttributes.
 886
 887       nsCOMPtr<nsILoadInfo> loadInfo = (*aResult)->LoadInfo();
 888       rv = loadInfo->SetOriginAttributes(
 889           aTriggeringPrincipal->OriginAttributesRef());
 890     }
 891   } else {
 892     // either we are loading something inside a document, in which case
 893     // we should always have a requestingNode, or we are loading something
 894     // outside a document, in which case the triggeringPrincipal and
 895     // triggeringPrincipal should always be the systemPrincipal.
 896     // However, there are exceptions: one is Notifications which create a
 897     // channel in the parent process in which case we can't get a
 898     // requestingNode.
 899     rv = NS_NewChannel(aResult, aURI, nsContentUtils::GetSystemPrincipal(),
 900                        securityFlags, aPolicyType,
 901                        nullptr,  // nsICookieJarSettings
 902                        nullptr,  // PerformanceStorage
 903                        nullptr,  // loadGroup
 904                        callbacks, aLoadFlags);
 905
 906     if (NS_FAILED(rv)) {
 907       return rv;
 908     }
 909
 910     // Use the OriginAttributes from the loading principal, if one is available,
 911     // and adjust the private browsing ID based on what kind of load the caller
 912     // has asked us to perform.
 913     OriginAttributes attrs;
 914     if (aTriggeringPrincipal) {
 915       attrs = aTriggeringPrincipal->OriginAttributesRef();
 916     }
 917     attrs.mPrivateBrowsingId = aRespectPrivacy ? 1 : 0;
 918
 919     nsCOMPtr<nsILoadInfo> loadInfo = (*aResult)->LoadInfo();
 920     rv = loadInfo->SetOriginAttributes(attrs);
 921   }
 922
 923   if (NS_FAILED(rv)) {
 924     return rv;
 925   }
 926
 927   // only inherit if we have a principal
 928   *aForcePrincipalCheckForCacheEntry =
 929       aTriggeringPrincipal && nsContentUtils::ChannelShouldInheritPrincipal(
 930                                   aTriggeringPrincipal, aURI,
 931                                   /* aInheritForAboutBlank */ false,
 932                                   /* aForceInherit */ false);
 933
 934   // Initialize HTTP-specific attributes
 935   newHttpChannel = do_QueryInterface(*aResult);
 936   if (newHttpChannel) {
 937     nsCOMPtr<nsIHttpChannelInternal> httpChannelInternal =
 938         do_QueryInterface(newHttpChannel);
 939     NS_ENSURE_TRUE(httpChannelInternal, NS_ERROR_UNEXPECTED);
 940     rv = httpChannelInternal->SetDocumentURI(aInitialDocumentURI);
 941     MOZ_ASSERT(NS_SUCCEEDED(rv));
 942     if (aReferrerInfo) {
 943       DebugOnly<nsresult> rv = newHttpChannel->SetReferrerInfo(aReferrerInfo);
 944       MOZ_ASSERT(NS_SUCCEEDED(rv));
 945     }
 946
 947     if (aEarlyHintPreloaderId) {
 948       rv = httpChannelInternal->SetEarlyHintPreloaderId(aEarlyHintPreloaderId);
 949       NS_ENSURE_SUCCESS(rv, rv);
 950     }
 951   }
 952
 953   // Image channels are loaded by default with reduced priority.
 954   nsCOMPtr<nsISupportsPriority> p = do_QueryInterface(*aResult);
 955   if (p) {
 956     uint32_t priority = nsISupportsPriority::PRIORITY_LOW;
 957
 958     if (aLoadFlags & nsIRequest::LOAD_BACKGROUND) {
 959       ++priority;  // further reduce priority for background loads
 960     }
 961
 962     p->AdjustPriority(priority);
 963   }
 964
 965   // Create a new loadgroup for this new channel, using the old group as
 966   // the parent. The indirection keeps the channel insulated from cancels,
 967   // but does allow a way for this revalidation to be associated with at
 968   // least one base load group for scheduling/caching purposes.
 969
 970   nsCOMPtr<nsILoadGroup> loadGroup = do_CreateInstance(NS_LOADGROUP_CONTRACTID);
 971   nsCOMPtr<nsILoadGroupChild> childLoadGroup = do_QueryInterface(loadGroup);
 972   if (childLoadGroup) {
 973     childLoadGroup->SetParentLoadGroup(aLoadGroup);
 974   }
 975   (*aResult)->SetLoadGroup(loadGroup);
 976
 977   return NS_OK;
 978 }
 979
 980 static uint32_t SecondsFromPRTime(PRTime aTime) {
 981   return nsContentUtils::SecondsFromPRTime(aTime);
 982 }
 983
 984 /* static */
 985 imgCacheEntry::imgCacheEntry(imgLoader* loader, imgRequest* request,
 986                              bool forcePrincipalCheck)
 987     : mLoader(loader),
 988       mRequest(request),
 989       mDataSize(0),
 990       mTouchedTime(SecondsFromPRTime(PR_Now())),
 991       mLoadTime(SecondsFromPRTime(PR_Now())),
 992       mExpiryTime(0),
 993       mMustValidate(false),
 994       // We start off as evicted so we don't try to update the cache.
 995       // PutIntoCache will set this to false.
 996       mEvicted(true),
 997       mHasNoProxies(true),
 998       mForcePrincipalCheck(forcePrincipalCheck),
 999       mHasNotified(false) {}
1000
1001 imgCacheEntry::~imgCacheEntry() {
1002   LOG_FUNC(gImgLog, "imgCacheEntry::~imgCacheEntry()");
1003 }
1004
1005 void imgCacheEntry::Touch(bool updateTime /* = true */) {
1006   LOG_SCOPE(gImgLog, "imgCacheEntry::Touch");
1007
1008   if (updateTime) {
1009     mTouchedTime = SecondsFromPRTime(PR_Now());
1010   }
1011
1012   UpdateCache();
1013 }
1014
1015 void imgCacheEntry::UpdateCache(int32_t diff /* = 0 */) {
1016   // Don't update the cache if we've been removed from it or it doesn't care
1017   // about our size or usage.
1018   if (!Evicted() && HasNoProxies()) {
1019     mLoader->CacheEntriesChanged(diff);
1020   }
1021 }
1022
1023 void imgCacheEntry::UpdateLoadTime() {
1024   mLoadTime = SecondsFromPRTime(PR_Now());
1025 }
1026
1027 void imgCacheEntry::SetHasNoProxies(bool hasNoProxies) {
1028   if (MOZ_LOG_TEST(gImgLog, LogLevel::Debug)) {
1029     if (hasNoProxies) {
1030       LOG_FUNC_WITH_PARAM(gImgLog, "imgCacheEntry::SetHasNoProxies true", "uri",
1031                           mRequest->CacheKey().URI());
1032     } else {
1033       LOG_FUNC_WITH_PARAM(gImgLog, "imgCacheEntry::SetHasNoProxies false",
1034                           "uri", mRequest->CacheKey().URI());
1035     }
1036   }
1037
1038   mHasNoProxies = hasNoProxies;
1039 }
1040
1041 imgCacheQueue::imgCacheQueue() : mDirty(false), mSize(0) {}
1042
1043 void imgCacheQueue::UpdateSize(int32_t diff) { mSize += diff; }
1044
1045 uint32_t imgCacheQueue::GetSize() const { return mSize; }
1046
1047 void imgCacheQueue::Remove(imgCacheEntry* entry) {
1048   uint64_t index = mQueue.IndexOf(entry);
1049   if (index == queueContainer::NoIndex) {
1050     return;
1051   }
1052
1053   mSize -= mQueue[index]->GetDataSize();
1054
1055   // If the queue is clean and this is the first entry,
1056   // then we can efficiently remove the entry without
1057   // dirtying the sort order.
1058   if (!IsDirty() && index == 0) {
1059     std::pop_heap(mQueue.begin(), mQueue.end(), imgLoader::CompareCacheEntries);
1060     mQueue.RemoveLastElement();
1061     return;
1062   }
1063
1064   // Remove from the middle of the list.  This potentially
1065   // breaks the binary heap sort order.
1066   mQueue.RemoveElementAt(index);
1067
1068   // If we only have one entry or the queue is empty, though,
1069   // then the sort order is still effectively good.  Simply
1070   // refresh the list to clear the dirty flag.
1071   if (mQueue.Length() <= 1) {
1072     Refresh();
1073     return;
1074   }
1075
1076   // Otherwise we must mark the queue dirty and potentially
1077   // trigger an expensive sort later.
1078   MarkDirty();
1079 }
1080
1081 void imgCacheQueue::Push(imgCacheEntry* entry) {
1082   mSize += entry->GetDataSize();
1083
1084   RefPtr<imgCacheEntry> refptr(entry);
1085   mQueue.AppendElement(std::move(refptr));
1086   // If we're not dirty already, then we can efficiently add this to the
1087   // binary heap immediately.  This is only O(log n).
1088   if (!IsDirty()) {
1089     std::push_heap(mQueue.begin(), mQueue.end(),
1090                    imgLoader::CompareCacheEntries);
1091   }
1092 }
1093
1094 already_AddRefed<imgCacheEntry> imgCacheQueue::Pop() {
1095   if (mQueue.IsEmpty()) {
1096     return nullptr;
1097   }
1098   if (IsDirty()) {
1099     Refresh();
1100   }
1101
1102   std::pop_heap(mQueue.begin(), mQueue.end(), imgLoader::CompareCacheEntries);
1103   RefPtr<imgCacheEntry> entry = mQueue.PopLastElement();
1104
1105   mSize -= entry->GetDataSize();
1106   return entry.forget();
1107 }
1108
1109 void imgCacheQueue::Refresh() {
1110   // Resort the list.  This is an O(3 * n) operation and best avoided
1111   // if possible.
1112   std::make_heap(mQueue.begin(), mQueue.end(), imgLoader::CompareCacheEntries);
1113   mDirty = false;
1114 }
1115
1116 void imgCacheQueue::MarkDirty() { mDirty = true; }
1117
1118 bool imgCacheQueue::IsDirty() { return mDirty; }
1119
1120 uint32_t imgCacheQueue::GetNumElements() const { return mQueue.Length(); }
1121
1122 bool imgCacheQueue::Contains(imgCacheEntry* aEntry) const {
1123   return mQueue.Contains(aEntry);
1124 }
1125
1126 imgCacheQueue::iterator imgCacheQueue::begin() { return mQueue.begin(); }
1127
1128 imgCacheQueue::const_iterator imgCacheQueue::begin() const {
1129   return mQueue.begin();
1130 }
1131
1132 imgCacheQueue::iterator imgCacheQueue::end() { return mQueue.end(); }
1133
1134 imgCacheQueue::const_iterator imgCacheQueue::end() const {
1135   return mQueue.end();
1136 }
1137
1138 nsresult imgLoader::CreateNewProxyForRequest(
1139     imgRequest* aRequest, nsIURI* aURI, nsILoadGroup* aLoadGroup,
1140     Document* aLoadingDocument, imgINotificationObserver* aObserver,
1141     nsLoadFlags aLoadFlags, imgRequestProxy** _retval) {
1142   LOG_SCOPE_WITH_PARAM(gImgLog, "imgLoader::CreateNewProxyForRequest",
1143                        "imgRequest", aRequest);
1144
1145   /* XXX If we move decoding onto separate threads, we should save off the
1146      calling thread here and pass it off to |proxyRequest| so that it call
1147      proxy calls to |aObserver|.
1148    */
1149
1150   RefPtr<imgRequestProxy> proxyRequest = new imgRequestProxy();
1151
1152   /* It is important to call |SetLoadFlags()| before calling |Init()| because
1153      |Init()| adds the request to the loadgroup.
1154    */
1155   proxyRequest->SetLoadFlags(aLoadFlags);
1156
1157   // init adds itself to imgRequest's list of observers
1158   nsresult rv = proxyRequest->Init(aRequest, aLoadGroup, aURI, aObserver);
1159   if (NS_WARN_IF(NS_FAILED(rv))) {
1160     return rv;
1161   }
1162
1163   proxyRequest.forget(_retval);
1164   return NS_OK;
1165 }
1166
1167 class imgCacheExpirationTracker final
1168     : public nsExpirationTracker<imgCacheEntry, 3> {
1169   enum { TIMEOUT_SECONDS = 10 };
1170
1171  public:
1172   imgCacheExpirationTracker();
1173
1174  protected:
1175   void NotifyExpired(imgCacheEntry* entry) override;
1176 };
1177
1178 imgCacheExpirationTracker::imgCacheExpirationTracker()
1179     : nsExpirationTracker<imgCacheEntry, 3>(TIMEOUT_SECONDS * 1000,
1180                                             "imgCacheExpirationTracker") {}
1181
1182 void imgCacheExpirationTracker::NotifyExpired(imgCacheEntry* entry) {
1183   // Hold on to a reference to this entry, because the expiration tracker
1184   // mechanism doesn't.
1185   RefPtr<imgCacheEntry> kungFuDeathGrip(entry);
1186
1187   if (MOZ_LOG_TEST(gImgLog, LogLevel::Debug)) {
1188     RefPtr<imgRequest> req = entry->GetRequest();
1189     if (req) {
1190       LOG_FUNC_WITH_PARAM(gImgLog, "imgCacheExpirationTracker::NotifyExpired",
1191                           "entry", req->CacheKey().URI());
1192     }
1193   }
1194
1195   // We can be called multiple times on the same entry. Don't do work multiple
1196   // times.
1197   if (!entry->Evicted()) {
1198     entry->Loader()->RemoveFromCache(entry);
1199   }
1200
1201   entry->Loader()->VerifyCacheSizes();
1202 }
1203
1204 ///////////////////////////////////////////////////////////////////////////////
1205 // imgLoader
1206 ///////////////////////////////////////////////////////////////////////////////
1207
1208 double imgLoader::sCacheTimeWeight;
1209 uint32_t imgLoader::sCacheMaxSize;
1210 imgMemoryReporter* imgLoader::sMemReporter;
1211
1212 NS_IMPL_ISUPPORTS(imgLoader, imgILoader, nsIContentSniffer, imgICache,
1213                   nsISupportsWeakReference, nsIObserver)
1214
1215 static imgLoader* gNormalLoader = nullptr;
1216 static imgLoader* gPrivateBrowsingLoader = nullptr;
1217
1218 /* static */
1219 already_AddRefed<imgLoader> imgLoader::CreateImageLoader() {
1220   // In some cases, such as xpctests, XPCOM modules are not automatically
1221   // initialized.  We need to make sure that our module is initialized before
1222   // we hand out imgLoader instances and code starts using them.
1223   mozilla::image::EnsureModuleInitialized();
1224
1225   RefPtr<imgLoader> loader = new imgLoader();
1226   loader->Init();
1227
1228   return loader.forget();
1229 }
1230
1231 imgLoader* imgLoader::NormalLoader() {
1232   if (!gNormalLoader) {
1233     gNormalLoader = CreateImageLoader().take();
1234   }
1235   return gNormalLoader;
1236 }
1237
1238 imgLoader* imgLoader::PrivateBrowsingLoader() {
1239   if (!gPrivateBrowsingLoader) {
1240     gPrivateBrowsingLoader = CreateImageLoader().take();
1241     gPrivateBrowsingLoader->RespectPrivacyNotifications();
1242   }
1243   return gPrivateBrowsingLoader;
1244 }
1245
1246 imgLoader::imgLoader()
1247     : mUncachedImagesMutex("imgLoader::UncachedImages"),
1248       mRespectPrivacy(false) {
1249   sMemReporter->AddRef();
1250   sMemReporter->RegisterLoader(this);
1251 }
1252
1253 imgLoader::~imgLoader() {
1254   ClearImageCache();
1255   {
1256     // If there are any of our imgRequest's left they are in the uncached
1257     // images set, so clear their pointer to us.
1258     MutexAutoLock lock(mUncachedImagesMutex);
1259     for (RefPtr<imgRequest> req : mUncachedImages) {
1260       req->ClearLoader();
1261     }
1262   }
1263   sMemReporter->UnregisterLoader(this);
1264   sMemReporter->Release();
1265 }
1266
1267 void imgLoader::VerifyCacheSizes() {
1268 #ifdef DEBUG
1269   if (!mCacheTracker) {
1270     return;
1271   }
1272
1273   uint32_t cachesize = mCache.Count();
1274   uint32_t queuesize = mCacheQueue.GetNumElements();
1275   uint32_t trackersize = 0;
1276   for (nsExpirationTracker<imgCacheEntry, 3>::Iterator it(mCacheTracker.get());
1277        it.Next();) {
1278     trackersize++;
1279   }
1280   MOZ_ASSERT(queuesize == trackersize, "Queue and tracker sizes out of sync!");
1281   MOZ_ASSERT(queuesize <= cachesize, "Queue has more elements than cache!");
1282 #endif
1283 }
1284
1285 void imgLoader::GlobalInit() {
1286   sCacheTimeWeight = StaticPrefs::image_cache_timeweight_AtStartup() / 1000.0;
1287   int32_t cachesize = StaticPrefs::image_cache_size_AtStartup();
1288   sCacheMaxSize = cachesize > 0 ? cachesize : 0;
1289
1290   sMemReporter = new imgMemoryReporter();
1291   RegisterStrongAsyncMemoryReporter(sMemReporter);
1292   RegisterImagesContentUsedUncompressedDistinguishedAmount(
1293       imgMemoryReporter::ImagesContentUsedUncompressedDistinguishedAmount);
1294 }
1295
1296 void imgLoader::ShutdownMemoryReporter() {
1297   UnregisterImagesContentUsedUncompressedDistinguishedAmount();
1298   UnregisterStrongMemoryReporter(sMemReporter);
1299 }
1300
1301 nsresult imgLoader::InitCache() {
1302   nsCOMPtr<nsIObserverService> os = mozilla::services::GetObserverService();
1303   if (!os) {
1304     return NS_ERROR_FAILURE;
1305   }
1306
1307   os->AddObserver(this, "memory-pressure", false);
1308   os->AddObserver(this, "chrome-flush-caches", false);
1309   os->AddObserver(this, "last-pb-context-exited", false);
1310   os->AddObserver(this, "profile-before-change", false);
1311   os->AddObserver(this, "xpcom-shutdown", false);
1312
1313   mCacheTracker = MakeUnique<imgCacheExpirationTracker>();
1314
1315   return NS_OK;
1316 }
1317
1318 nsresult imgLoader::Init() {
1319   InitCache();
1320
1321   return NS_OK;
1322 }
1323
1324 NS_IMETHODIMP
1325 imgLoader::RespectPrivacyNotifications() {
1326   mRespectPrivacy = true;
1327   return NS_OK;
1328 }
1329
1330 NS_IMETHODIMP
1331 imgLoader::Observe(nsISupports* aSubject, const char* aTopic,
1332                    const char16_t* aData) {
1333   if (strcmp(aTopic, "memory-pressure") == 0) {
1334     MinimizeCache();
1335   } else if (strcmp(aTopic, "chrome-flush-caches") == 0) {
1336     MinimizeCache();
1337     ClearImageCache({ClearOption::ChromeOnly});
1338   } else if (strcmp(aTopic, "last-pb-context-exited") == 0) {
1339     if (mRespectPrivacy) {
1340       ClearImageCache();
1341     }
1342   } else if (strcmp(aTopic, "profile-before-change") == 0) {
1343     mCacheTracker = nullptr;
1344   } else if (strcmp(aTopic, "xpcom-shutdown") == 0) {
1345     mCacheTracker = nullptr;
1346     ShutdownMemoryReporter();
1347
1348   } else {
1349     // (Nothing else should bring us here)
1350     MOZ_ASSERT(0, "Invalid topic received");
1351   }
1352
1353   return NS_OK;
1354 }
1355
1356 NS_IMETHODIMP
1357 imgLoader::ClearCache(bool chrome) {
1358   if (XRE_IsParentProcess()) {
1359     bool privateLoader = this == gPrivateBrowsingLoader;
1360     for (auto* cp : ContentParent::AllProcesses(ContentParent::eLive)) {
1361       Unused << cp->SendClearImageCache(privateLoader, chrome);
1362     }
1363   }
1364   ClearOptions options;
1365   if (chrome) {
1366     options += ClearOption::ChromeOnly;
1367   }
1368   return ClearImageCache(options);
1369 }
1370
1371 NS_IMETHODIMP
1372 imgLoader::RemoveEntriesFromPrincipalInAllProcesses(nsIPrincipal* aPrincipal) {
1373   if (!XRE_IsParentProcess()) {
1374     return NS_ERROR_NOT_AVAILABLE;
1375   }
1376
1377   for (auto* cp : ContentParent::AllProcesses(ContentParent::eLive)) {
1378     Unused << cp->SendClearImageCacheFromPrincipal(aPrincipal);
1379   }
1380
1381   imgLoader* loader;
1382   if (aPrincipal->OriginAttributesRef().mPrivateBrowsingId ==
1383       nsIScriptSecurityManager::DEFAULT_PRIVATE_BROWSING_ID) {
1384     loader = imgLoader::NormalLoader();
1385   } else {
1386     loader = imgLoader::PrivateBrowsingLoader();
1387   }
1388
1389   return loader->RemoveEntriesInternal(aPrincipal, nullptr);
1390 }
1391
1392 NS_IMETHODIMP
1393 imgLoader::RemoveEntriesFromBaseDomainInAllProcesses(
1394     const nsACString& aBaseDomain) {
1395   if (!XRE_IsParentProcess()) {
1396     return NS_ERROR_NOT_AVAILABLE;
1397   }
1398
1399   for (auto* cp : ContentParent::AllProcesses(ContentParent::eLive)) {
1400     Unused << cp->SendClearImageCacheFromBaseDomain(aBaseDomain);
1401   }
1402
1403   return RemoveEntriesInternal(nullptr, &aBaseDomain);
1404 }
1405
1406 nsresult imgLoader::RemoveEntriesInternal(nsIPrincipal* aPrincipal,
1407                                           const nsACString* aBaseDomain) {
1408   // Can only clear by either principal or base domain.
1409   if ((!aPrincipal && !aBaseDomain) || (aPrincipal && aBaseDomain)) {
1410     return NS_ERROR_INVALID_ARG;
1411   }
1412
1413   nsCOMPtr<nsIEffectiveTLDService> tldService;
1414   AutoTArray<RefPtr<imgCacheEntry>, 128> entriesToBeRemoved;
1415
1416   // For base domain we only clear the non-chrome cache.
1417   for (const auto& entry : mCache) {
1418     const auto& key = entry.GetKey();
1419
1420     const bool shouldRemove = [&] {
1421       if (aPrincipal) {
1422         nsCOMPtr<nsIPrincipal> keyPrincipal =
1423             BasePrincipal::CreateContentPrincipal(key.URI(),
1424                                                   key.OriginAttributesRef());
1425         return keyPrincipal->Equals(aPrincipal);
1426       }
1427
1428       if (!aBaseDomain) {
1429         return false;
1430       }
1431       // Clear by baseDomain.
1432       nsAutoCString host;
1433       nsresult rv = key.URI()->GetHost(host);
1434       if (NS_FAILED(rv) || host.IsEmpty()) {
1435         return false;
1436       }
1437
1438       if (!tldService) {
1439         tldService = do_GetService(NS_EFFECTIVETLDSERVICE_CONTRACTID);
1440       }
1441       if (NS_WARN_IF(!tldService)) {
1442         return false;
1443       }
1444
1445       bool hasRootDomain = false;
1446       rv = tldService->HasRootDomain(host, *aBaseDomain, &hasRootDomain);
1447       if (NS_SUCCEEDED(rv) && hasRootDomain) {
1448         return true;
1449       }
1450
1451       // If we don't get a direct base domain match, also check for cache of
1452       // third parties partitioned under aBaseDomain.
1453
1454       // The isolation key is either just the base domain, or an origin suffix
1455       // which contains the partitionKey holding the baseDomain.
1456
1457       if (key.IsolationKeyRef().Equals(*aBaseDomain)) {
1458         return true;
1459       }
1460
1461       // The isolation key does not match the given base domain. It may be an
1462       // origin suffix. Parse it into origin attributes.
1463       OriginAttributes attrs;
1464       if (!attrs.PopulateFromSuffix(key.IsolationKeyRef())) {
1465         // Key is not an origin suffix.
1466         return false;
1467       }
1468
1469       return StoragePrincipalHelper::PartitionKeyHasBaseDomain(
1470           attrs.mPartitionKey, *aBaseDomain);
1471     }();
1472
1473     if (shouldRemove) {
1474       entriesToBeRemoved.AppendElement(entry.GetData());
1475     }
1476   }
1477
1478   for (auto& entry : entriesToBeRemoved) {
1479     if (!RemoveFromCache(entry)) {
1480       NS_WARNING(
1481           "Couldn't remove an entry from the cache in "
1482           "RemoveEntriesInternal()\n");
1483     }
1484   }
1485
1486   return NS_OK;
1487 }
1488
1489 constexpr auto AllCORSModes() {
1490   return MakeInclusiveEnumeratedRange(kFirstCORSMode, kLastCORSMode);
1491 }
1492
1493 NS_IMETHODIMP
1494 imgLoader::RemoveEntry(nsIURI* aURI, Document* aDoc) {
1495   if (!aURI) {
1496     return NS_OK;
1497   }
1498   OriginAttributes attrs;
1499   if (aDoc) {
1500     attrs = aDoc->NodePrincipal()->OriginAttributesRef();
1501   }
1502   for (auto corsMode : AllCORSModes()) {
1503     ImageCacheKey key(aURI, corsMode, attrs, aDoc);
1504     RemoveFromCache(key);
1505   }
1506   return NS_OK;
1507 }
1508
1509 NS_IMETHODIMP
1510 imgLoader::FindEntryProperties(nsIURI* uri, Document* aDoc,
1511                                nsIProperties** _retval) {
1512   *_retval = nullptr;
1513
1514   OriginAttributes attrs;
1515   if (aDoc) {
1516     nsCOMPtr<nsIPrincipal> principal = aDoc->NodePrincipal();
1517     if (principal) {
1518       attrs = principal->OriginAttributesRef();
1519     }
1520   }
1521
1522   for (auto corsMode : AllCORSModes()) {
1523     ImageCacheKey key(uri, corsMode, attrs, aDoc);
1524     RefPtr<imgCacheEntry> entry;
1525     if (!mCache.Get(key, getter_AddRefs(entry)) || !entry) {
1526       continue;
1527     }
1528     if (mCacheTracker && entry->HasNoProxies()) {
1529       mCacheTracker->MarkUsed(entry);
1530     }
1531     RefPtr<imgRequest> request = entry->GetRequest();
1532     if (request) {
1533       nsCOMPtr<nsIProperties> properties = request->Properties();
1534       properties.forget(_retval);
1535       return NS_OK;
1536     }
1537   }
1538   return NS_OK;
1539 }
1540
1541 NS_IMETHODIMP_(void)
1542 imgLoader::ClearCacheForControlledDocument(Document* aDoc) {
1543   MOZ_ASSERT(aDoc);
1544   AutoTArray<RefPtr<imgCacheEntry>, 128> entriesToBeRemoved;
1545   for (const auto& entry : mCache) {
1546     const auto& key = entry.GetKey();
1547     if (key.ControlledDocument() == aDoc) {
1548       entriesToBeRemoved.AppendElement(entry.GetData());
1549     }
1550   }
1551   for (auto& entry : entriesToBeRemoved) {
1552     if (!RemoveFromCache(entry)) {
1553       NS_WARNING(
1554           "Couldn't remove an entry from the cache in "
1555           "ClearCacheForControlledDocument()\n");
1556     }
1557   }
1558 }
1559
1560 void imgLoader::Shutdown() {
1561   NS_IF_RELEASE(gNormalLoader);
1562   gNormalLoader = nullptr;
1563   NS_IF_RELEASE(gPrivateBrowsingLoader);
1564   gPrivateBrowsingLoader = nullptr;
1565 }
1566
1567 bool imgLoader::PutIntoCache(const ImageCacheKey& aKey, imgCacheEntry* entry) {
1568   LOG_STATIC_FUNC_WITH_PARAM(gImgLog, "imgLoader::PutIntoCache", "uri",
1569                              aKey.URI());
1570
1571   // Check to see if this request already exists in the cache. If so, we'll
1572   // replace the old version.
1573   RefPtr<imgCacheEntry> tmpCacheEntry;
1574   if (mCache.Get(aKey, getter_AddRefs(tmpCacheEntry)) && tmpCacheEntry) {
1575     MOZ_LOG(
1576         gImgLog, LogLevel::Debug,
1577         ("[this=%p] imgLoader::PutIntoCache -- Element already in the cache",
1578          nullptr));
1579     RefPtr<imgRequest> tmpRequest = tmpCacheEntry->GetRequest();
1580
1581     // If it already exists, and we're putting the same key into the cache, we
1582     // should remove the old version.
1583     MOZ_LOG(gImgLog, LogLevel::Debug,
1584             ("[this=%p] imgLoader::PutIntoCache -- Replacing cached element",
1585              nullptr));
1586
1587     RemoveFromCache(aKey);
1588   } else {
1589     MOZ_LOG(gImgLog, LogLevel::Debug,
1590             ("[this=%p] imgLoader::PutIntoCache --"
1591              " Element NOT already in the cache",
1592              nullptr));
1593   }
1594
1595   mCache.InsertOrUpdate(aKey, RefPtr{entry});
1596
1597   // We can be called to resurrect an evicted entry.
1598   if (entry->Evicted()) {
1599     entry->SetEvicted(false);
1600   }
1601
1602   // If we're resurrecting an entry with no proxies, put it back in the
1603   // tracker and queue.
1604   if (entry->HasNoProxies()) {
1605     nsresult addrv = NS_OK;
1606
1607     if (mCacheTracker) {
1608       addrv = mCacheTracker->AddObject(entry);
1609     }
1610
1611     if (NS_SUCCEEDED(addrv)) {
1612       mCacheQueue.Push(entry);
1613     }
1614   }
1615
1616   RefPtr<imgRequest> request = entry->GetRequest();
1617   request->SetIsInCache(true);
1618   RemoveFromUncachedImages(request);
1619
1620   return true;
1621 }
1622
1623 bool imgLoader::SetHasNoProxies(imgRequest* aRequest, imgCacheEntry* aEntry) {
1624   LOG_STATIC_FUNC_WITH_PARAM(gImgLog, "imgLoader::SetHasNoProxies", "uri",
1625                              aRequest->CacheKey().URI());
1626
1627   aEntry->SetHasNoProxies(true);
1628
1629   if (aEntry->Evicted()) {
1630     return false;
1631   }
1632
1633   nsresult addrv = NS_OK;
1634
1635   if (mCacheTracker) {
1636     addrv = mCacheTracker->AddObject(aEntry);
1637   }
1638
1639   if (NS_SUCCEEDED(addrv)) {
1640     mCacheQueue.Push(aEntry);
1641   }
1642
1643   return true;
1644 }
1645
1646 bool imgLoader::SetHasProxies(imgRequest* aRequest) {
1647   VerifyCacheSizes();
1648
1649   const ImageCacheKey& key = aRequest->CacheKey();
1650
1651   LOG_STATIC_FUNC_WITH_PARAM(gImgLog, "imgLoader::SetHasProxies", "uri",
1652                              key.URI());
1653
1654   RefPtr<imgCacheEntry> entry;
1655   if (mCache.Get(key, getter_AddRefs(entry)) && entry) {
1656     // Make sure the cache entry is for the right request
1657     RefPtr<imgRequest> entryRequest = entry->GetRequest();
1658     if (entryRequest == aRequest && entry->HasNoProxies()) {
1659       mCacheQueue.Remove(entry);
1660
1661       if (mCacheTracker) {
1662         mCacheTracker->RemoveObject(entry);
1663       }
1664
1665       entry->SetHasNoProxies(false);
1666
1667       return true;
1668     }
1669   }
1670
1671   return false;
1672 }
1673
1674 void imgLoader::CacheEntriesChanged(int32_t aSizeDiff /* = 0 */) {
1675   // We only need to dirty the queue if there is any sorting
1676   // taking place.  Empty or single-entry lists can't become
1677   // dirty.
1678   if (mCacheQueue.GetNumElements() > 1) {
1679     mCacheQueue.MarkDirty();
1680   }
1681   mCacheQueue.UpdateSize(aSizeDiff);
1682 }
1683
1684 void imgLoader::CheckCacheLimits() {
1685   if (mCacheQueue.GetNumElements() == 0) {
1686     NS_ASSERTION(mCacheQueue.GetSize() == 0,
1687                  "imgLoader::CheckCacheLimits -- incorrect cache size");
1688   }
1689
1690   // Remove entries from the cache until we're back at our desired max size.
1691   while (mCacheQueue.GetSize() > sCacheMaxSize) {
1692     // Remove the first entry in the queue.
1693     RefPtr<imgCacheEntry> entry(mCacheQueue.Pop());
1694
1695     NS_ASSERTION(entry, "imgLoader::CheckCacheLimits -- NULL entry pointer");
1696
1697     if (MOZ_LOG_TEST(gImgLog, LogLevel::Debug)) {
1698       RefPtr<imgRequest> req = entry->GetRequest();
1699       if (req) {
1700         LOG_STATIC_FUNC_WITH_PARAM(gImgLog, "imgLoader::CheckCacheLimits",
1701                                    "entry", req->CacheKey().URI());
1702       }
1703     }
1704
1705     if (entry) {
1706       // We just popped this entry from the queue, so pass AlreadyRemoved
1707       // to avoid searching the queue again in RemoveFromCache.
1708       RemoveFromCache(entry, QueueState::AlreadyRemoved);
1709     }
1710   }
1711 }
1712
1713 bool imgLoader::ValidateRequestWithNewChannel(
1714     imgRequest* request, nsIURI* aURI, nsIURI* aInitialDocumentURI,
1715     nsIReferrerInfo* aReferrerInfo, nsILoadGroup* aLoadGroup,
1716     imgINotificationObserver* aObserver, Document* aLoadingDocument,
1717     uint64_t aInnerWindowId, nsLoadFlags aLoadFlags,
1718     nsContentPolicyType aLoadPolicyType, imgRequestProxy** aProxyRequest,
1719     nsIPrincipal* aTriggeringPrincipal, CORSMode aCORSMode, bool aLinkPreload,
1720     uint64_t aEarlyHintPreloaderId, bool* aNewChannelCreated) {
1721   // now we need to insert a new channel request object in between the real
1722   // request and the proxy that basically delays loading the image until it
1723   // gets a 304 or figures out that this needs to be a new request
1724
1725   nsresult rv;
1726
1727   // If we're currently in the middle of validating this request, just hand
1728   // back a proxy to it; the required work will be done for us.
1729   if (imgCacheValidator* validator = request->GetValidator()) {
1730     rv = CreateNewProxyForRequest(request, aURI, aLoadGroup, aLoadingDocument,
1731                                   aObserver, aLoadFlags, aProxyRequest);
1732     if (NS_FAILED(rv)) {
1733       return false;
1734     }
1735
1736     if (*aProxyRequest) {
1737       imgRequestProxy* proxy = static_cast<imgRequestProxy*>(*aProxyRequest);
1738
1739       // We will send notifications from imgCacheValidator::OnStartRequest().
1740       // In the mean time, we must defer notifications because we are added to
1741       // the imgRequest's proxy list, and we can get extra notifications
1742       // resulting from methods such as StartDecoding(). See bug 579122.
1743       proxy->MarkValidating();
1744
1745       if (aLinkPreload) {
1746         MOZ_ASSERT(aLoadingDocument);
1747         auto preloadKey = PreloadHashKey::CreateAsImage(
1748             aURI, aTriggeringPrincipal, aCORSMode);
1749         proxy->NotifyOpen(preloadKey, aLoadingDocument, true);
1750       }
1751
1752       // Attach the proxy without notifying
1753       validator->AddProxy(proxy);
1754     }
1755
1756     return true;
1757   }
1758   // We will rely on Necko to cache this request when it's possible, and to
1759   // tell imgCacheValidator::OnStartRequest whether the request came from its
1760   // cache.
1761   nsCOMPtr<nsIChannel> newChannel;
1762   bool forcePrincipalCheck;
1763   rv =
1764       NewImageChannel(getter_AddRefs(newChannel), &forcePrincipalCheck, aURI,
1765                       aInitialDocumentURI, aCORSMode, aReferrerInfo, aLoadGroup,
1766                       aLoadFlags, aLoadPolicyType, aTriggeringPrincipal,
1767                       aLoadingDocument, mRespectPrivacy, aEarlyHintPreloaderId);
1768   if (NS_FAILED(rv)) {
1769     return false;
1770   }
1771
1772   if (aNewChannelCreated) {
1773     *aNewChannelCreated = true;
1774   }
1775
1776   RefPtr<imgRequestProxy> req;
1777   rv = CreateNewProxyForRequest(request, aURI, aLoadGroup, aLoadingDocument,
1778                                 aObserver, aLoadFlags, getter_AddRefs(req));
1779   if (NS_FAILED(rv)) {
1780     return false;
1781   }
1782
1783   // Make sure that OnStatus/OnProgress calls have the right request set...
1784   RefPtr<nsProgressNotificationProxy> progressproxy =
1785       new nsProgressNotificationProxy(newChannel, req);
1786   if (!progressproxy) {
1787     return false;
1788   }
1789
1790   RefPtr<imgCacheValidator> hvc =
1791       new imgCacheValidator(progressproxy, this, request, aLoadingDocument,
1792                             aInnerWindowId, forcePrincipalCheck);
1793
1794   // Casting needed here to get past multiple inheritance.
1795   nsCOMPtr<nsIStreamListener> listener =
1796       static_cast<nsIThreadRetargetableStreamListener*>(hvc);
1797   NS_ENSURE_TRUE(listener, false);
1798
1799   // We must set the notification callbacks before setting up the
1800   // CORS listener, because that's also interested inthe
1801   // notification callbacks.
1802   newChannel->SetNotificationCallbacks(hvc);
1803
1804   request->SetValidator(hvc);
1805
1806   // We will send notifications from imgCacheValidator::OnStartRequest().
1807   // In the mean time, we must defer notifications because we are added to
1808   // the imgRequest's proxy list, and we can get extra notifications
1809   // resulting from methods such as StartDecoding(). See bug 579122.
1810   req->MarkValidating();
1811
1812   if (aLinkPreload) {
1813     MOZ_ASSERT(aLoadingDocument);
1814     auto preloadKey =
1815         PreloadHashKey::CreateAsImage(aURI, aTriggeringPrincipal, aCORSMode);
1816     req->NotifyOpen(preloadKey, aLoadingDocument, true);
1817   }
1818
1819   // Add the proxy without notifying
1820   hvc->AddProxy(req);
1821
1822   mozilla::net::PredictorLearn(aURI, aInitialDocumentURI,
1823                                nsINetworkPredictor::LEARN_LOAD_SUBRESOURCE,
1824                                aLoadGroup);
1825   rv = newChannel->AsyncOpen(listener);
1826   if (NS_WARN_IF(NS_FAILED(rv))) {
1827     req->CancelAndForgetObserver(rv);
1828     // This will notify any current or future <link preload> tags.  Pass the
1829     // non-open channel so that we can read loadinfo and referrer info of that
1830     // channel.
1831     req->NotifyStart(newChannel);
1832     // Use the non-channel overload of this method to force the notification to
1833     // happen.  The preload request has not been assigned a channel.
1834     req->NotifyStop(rv);
1835     return false;
1836   }
1837
1838   req.forget(aProxyRequest);
1839   return true;
1840 }
1841
1842 void imgLoader::NotifyObserversForCachedImage(
1843     imgCacheEntry* aEntry, imgRequest* request, nsIURI* aURI,
1844     nsIReferrerInfo* aReferrerInfo, Document* aLoadingDocument,
1845     nsIPrincipal* aTriggeringPrincipal, CORSMode aCORSMode,
1846     uint64_t aEarlyHintPreloaderId) {
1847   if (aEntry->HasNotified()) {
1848     return;
1849   }
1850
1851   nsCOMPtr<nsIObserverService> obsService = services::GetObserverService();
1852
1853   if (!obsService->HasObservers("http-on-image-cache-response")) {
1854     return;
1855   }
1856
1857   aEntry->SetHasNotified();
1858
1859   nsCOMPtr<nsIChannel> newChannel;
1860   bool forcePrincipalCheck;
1861   nsresult rv = NewImageChannel(
1862       getter_AddRefs(newChannel), &forcePrincipalCheck, aURI, nullptr,
1863       aCORSMode, aReferrerInfo, nullptr, 0,
1864       nsIContentPolicy::TYPE_INTERNAL_IMAGE, aTriggeringPrincipal,
1865       aLoadingDocument, mRespectPrivacy, aEarlyHintPreloaderId);
1866   if (NS_FAILED(rv)) {
1867     return;
1868   }
1869
1870   RefPtr<HttpBaseChannel> httpBaseChannel = do_QueryObject(newChannel);
1871   if (httpBaseChannel) {
1872     httpBaseChannel->SetDummyChannelForImageCache();
1873     newChannel->SetContentType(nsDependentCString(request->GetMimeType()));
1874     RefPtr<mozilla::image::Image> image = request->GetImage();
1875     if (image) {
1876       newChannel->SetContentLength(aEntry->GetDataSize());
1877     }
1878     obsService->NotifyObservers(newChannel, "http-on-image-cache-response",
1879                                 nullptr);
1880   }
1881 }
1882
1883 bool imgLoader::ValidateEntry(
1884     imgCacheEntry* aEntry, nsIURI* aURI, nsIURI* aInitialDocumentURI,
1885     nsIReferrerInfo* aReferrerInfo, nsILoadGroup* aLoadGroup,
1886     imgINotificationObserver* aObserver, Document* aLoadingDocument,
1887     nsLoadFlags aLoadFlags, nsContentPolicyType aLoadPolicyType,
1888     bool aCanMakeNewChannel, bool* aNewChannelCreated,
1889     imgRequestProxy** aProxyRequest, nsIPrincipal* aTriggeringPrincipal,
1890     CORSMode aCORSMode, bool aLinkPreload, uint64_t aEarlyHintPreloaderId) {
1891   LOG_SCOPE(gImgLog, "imgLoader::ValidateEntry");
1892
1893   // If the expiration time is zero, then the request has not gotten far enough
1894   // to know when it will expire, or we know it will never expire (see
1895   // nsContentUtils::GetSubresourceCacheValidationInfo).
1896   uint32_t expiryTime = aEntry->GetExpiryTime();
1897   bool hasExpired = expiryTime && expiryTime <= SecondsFromPRTime(PR_Now());
1898
1899   // Special treatment for file URLs - aEntry has expired if file has changed
1900   if (nsCOMPtr<nsIFileURL> fileUrl = do_QueryInterface(aURI)) {
1901     uint32_t lastModTime = aEntry->GetLoadTime();
1902     nsCOMPtr<nsIFile> theFile;
1903     if (NS_SUCCEEDED(fileUrl->GetFile(getter_AddRefs(theFile)))) {
1904       PRTime fileLastMod;
1905       if (NS_SUCCEEDED(theFile->GetLastModifiedTime(&fileLastMod))) {
1906         // nsIFile uses millisec, NSPR usec.
1907         fileLastMod *= 1000;
1908         hasExpired = SecondsFromPRTime((PRTime)fileLastMod) > lastModTime;
1909       }
1910     }
1911   }
1912
1913   RefPtr<imgRequest> request(aEntry->GetRequest());
1914
1915   if (!request) {
1916     return false;
1917   }
1918
1919   if (!ValidateSecurityInfo(request, aEntry->ForcePrincipalCheck(), aCORSMode,
1920                             aTriggeringPrincipal, aLoadingDocument,
1921                             aLoadPolicyType)) {
1922     return false;
1923   }
1924
1925   // data URIs are immutable and by their nature can't leak data, so we can
1926   // just return true in that case.  Doing so would mean that shift-reload
1927   // doesn't reload data URI documents/images though (which is handy for
1928   // debugging during gecko development) so we make an exception in that case.
1929   if (aURI->SchemeIs("data") && !(aLoadFlags & nsIRequest::LOAD_BYPASS_CACHE)) {
1930     return true;
1931   }
1932
1933   bool validateRequest = false;
1934
1935   if (!request->CanReuseWithoutValidation(aLoadingDocument)) {
1936     // If we would need to revalidate this entry, but we're being told to
1937     // bypass the cache, we don't allow this entry to be used.
1938     if (aLoadFlags & nsIRequest::LOAD_BYPASS_CACHE) {
1939       return false;
1940     }
1941
1942     if (MOZ_UNLIKELY(ChaosMode::isActive(ChaosFeature::ImageCache))) {
1943       if (ChaosMode::randomUint32LessThan(4) < 1) {
1944         return false;
1945       }
1946     }
1947
1948     // Determine whether the cache aEntry must be revalidated...
1949     validateRequest = ShouldRevalidateEntry(aEntry, aLoadFlags, hasExpired);
1950
1951     MOZ_LOG(gImgLog, LogLevel::Debug,
1952             ("imgLoader::ValidateEntry validating cache entry. "
1953              "validateRequest = %d",
1954              validateRequest));
1955   } else if (!aLoadingDocument && MOZ_LOG_TEST(gImgLog, LogLevel::Debug)) {
1956     MOZ_LOG(gImgLog, LogLevel::Debug,
1957             ("imgLoader::ValidateEntry BYPASSING cache validation for %s "
1958              "because of NULL loading document",
1959              aURI->GetSpecOrDefault().get()));
1960   }
1961
1962   // If the original request is still transferring don't kick off a validation
1963   // network request because it is a bit silly to issue a validation request if
1964   // the original request hasn't even finished yet. So just return true
1965   // indicating the caller can create a new proxy for the request and use it as
1966   // is.
1967   // This is an optimization but it's also required for correctness. If we don't
1968   // do this then when firing the load complete notification for the original
1969   // request that can unblock load for the document and then spin the event loop
1970   // (see the stack in bug 1641682) which then the OnStartRequest for the
1971   // validation request can fire which can call UpdateProxies and can sync
1972   // notify on the progress tracker about all existing state, which includes
1973   // load complete, so we fire a second load complete notification for the
1974   // image.
1975   // In addition, we want to validate if the original request encountered
1976   // an error for two reasons. The first being if the error was a network error
1977   // then trying to re-fetch the image might succeed. The second is more
1978   // complicated. We decide if we should fire the load or error event for img
1979   // elements depending on if the image has error in its status at the time when
1980   // the load complete notification is received, and we set error status on an
1981   // image if it encounters a network error or a decode error with no real way
1982   // to tell them apart. So if we load an image that will produce a decode error
1983   // the first time we will usually fire the load event, and then decode enough
1984   // to encounter the decode error and set the error status on the image. The
1985   // next time we reference the image in the same document the load complete
1986   // notification is replayed and this time the error status from the decode is
1987   // already present so we fire the error event instead of the load event. This
1988   // is a bug (bug 1645576) that we should fix. In order to avoid that bug in
1989   // some cases (specifically the cases when we hit this code and try to
1990   // validate the request) we make sure to validate. This avoids the bug because
1991   // when the load complete notification arrives the proxy is marked as
1992   // validating so it lies about its status and returns nothing.
1993   const bool requestComplete = [&] {
1994     RefPtr<ProgressTracker> tracker;
1995     RefPtr<mozilla::image::Image> image = request->GetImage();
1996     if (image) {
1997       tracker = image->GetProgressTracker();
1998     } else {
1999       tracker = request->GetProgressTracker();
2000     }
2001     return tracker &&
2002            tracker->GetProgress() & (FLAG_LOAD_COMPLETE | FLAG_HAS_ERROR);
2003   }();
2004
2005   if (!requestComplete) {
2006     return true;
2007   }
2008
2009   if (validateRequest && aCanMakeNewChannel) {
2010     LOG_SCOPE(gImgLog, "imgLoader::ValidateRequest |cache hit| must validate");
2011
2012     uint64_t innerWindowID =
2013         aLoadingDocument ? aLoadingDocument->InnerWindowID() : 0;
2014     return ValidateRequestWithNewChannel(
2015         request, aURI, aInitialDocumentURI, aReferrerInfo, aLoadGroup,
2016         aObserver, aLoadingDocument, innerWindowID, aLoadFlags, aLoadPolicyType,
2017         aProxyRequest, aTriggeringPrincipal, aCORSMode, aLinkPreload,
2018         aEarlyHintPreloaderId, aNewChannelCreated);
2019   }
2020
2021   if (!validateRequest) {
2022     NotifyObserversForCachedImage(aEntry, request, aURI, aReferrerInfo,
2023                                   aLoadingDocument, aTriggeringPrincipal,
2024                                   aCORSMode, aEarlyHintPreloaderId);
2025   }
2026
2027   return !validateRequest;
2028 }
2029
2030 bool imgLoader::RemoveFromCache(const ImageCacheKey& aKey) {
2031   LOG_STATIC_FUNC_WITH_PARAM(gImgLog, "imgLoader::RemoveFromCache", "uri",
2032                              aKey.URI());
2033   RefPtr<imgCacheEntry> entry;
2034   mCache.Remove(aKey, getter_AddRefs(entry));
2035   if (entry) {
2036     MOZ_ASSERT(!entry->Evicted(), "Evicting an already-evicted cache entry!");
2037
2038     // Entries with no proxies are in the tracker.
2039     if (entry->HasNoProxies()) {
2040       if (mCacheTracker) {
2041         mCacheTracker->RemoveObject(entry);
2042       }
2043       mCacheQueue.Remove(entry);
2044     }
2045
2046     entry->SetEvicted(true);
2047
2048     RefPtr<imgRequest> request = entry->GetRequest();
2049     request->SetIsInCache(false);
2050     AddToUncachedImages(request);
2051
2052     return true;
2053   }
2054   return false;
2055 }
2056
2057 bool imgLoader::RemoveFromCache(imgCacheEntry* entry, QueueState aQueueState) {
2058   LOG_STATIC_FUNC(gImgLog, "imgLoader::RemoveFromCache entry");
2059
2060   RefPtr<imgRequest> request = entry->GetRequest();
2061   if (request) {
2062     const ImageCacheKey& key = request->CacheKey();
2063     LOG_STATIC_FUNC_WITH_PARAM(gImgLog, "imgLoader::RemoveFromCache",
2064                                "entry's uri", key.URI());
2065
2066     mCache.Remove(key);
2067
2068     if (entry->HasNoProxies()) {
2069       LOG_STATIC_FUNC(gImgLog,
2070                       "imgLoader::RemoveFromCache removing from tracker");
2071       if (mCacheTracker) {
2072         mCacheTracker->RemoveObject(entry);
2073       }
2074       // Only search the queue to remove the entry if its possible it might
2075       // be in the queue.  If we know its not in the queue this would be
2076       // wasted work.
2077       MOZ_ASSERT_IF(aQueueState == QueueState::AlreadyRemoved,
2078                     !mCacheQueue.Contains(entry));
2079       if (aQueueState == QueueState::MaybeExists) {
2080         mCacheQueue.Remove(entry);
2081       }
2082     }
2083
2084     entry->SetEvicted(true);
2085     request->SetIsInCache(false);
2086     AddToUncachedImages(request);
2087
2088     return true;
2089   }
2090
2091   return false;
2092 }
2093
2094 nsresult imgLoader::ClearImageCache(ClearOptions aOptions) {
2095   const bool chromeOnly = aOptions.contains(ClearOption::ChromeOnly);
2096   const auto ShouldRemove = [&](imgCacheEntry* aEntry) {
2097     if (chromeOnly) {
2098       // TODO: Consider also removing "resource://" etc?
2099       RefPtr<imgRequest> request = aEntry->GetRequest();
2100       if (!request || !request->CacheKey().URI()->SchemeIs("chrome")) {
2101         return false;
2102       }
2103     }
2104     return true;
2105   };
2106   if (aOptions.contains(ClearOption::UnusedOnly)) {
2107     LOG_STATIC_FUNC(gImgLog, "imgLoader::ClearImageCache queue");
2108     // We have to make a temporary, since RemoveFromCache removes the element
2109     // from the queue, invalidating iterators.
2110     nsTArray<RefPtr<imgCacheEntry>> entries(mCacheQueue.GetNumElements());
2111     for (auto& entry : mCacheQueue) {
2112       if (ShouldRemove(entry)) {
2113         entries.AppendElement(entry);
2114       }
2115     }
2116
2117     // Iterate in reverse order to minimize array copying.
2118     for (auto& entry : entries) {
2119       if (!RemoveFromCache(entry)) {
2120         return NS_ERROR_FAILURE;
2121       }
2122     }
2123
2124     MOZ_ASSERT(chromeOnly || mCacheQueue.GetNumElements() == 0);
2125     return NS_OK;
2126   }
2127
2128   LOG_STATIC_FUNC(gImgLog, "imgLoader::ClearImageCache table");
2129   // We have to make a temporary, since RemoveFromCache removes the element
2130   // from the queue, invalidating iterators.
2131   const auto entries =
2132       ToTArray<nsTArray<RefPtr<imgCacheEntry>>>(mCache.Values());
2133   for (const auto& entry : entries) {
2134     if (!ShouldRemove(entry)) {
2135       continue;
2136     }
2137     if (!RemoveFromCache(entry)) {
2138       return NS_ERROR_FAILURE;
2139     }
2140   }
2141   MOZ_ASSERT(chromeOnly || mCache.IsEmpty());
2142   return NS_OK;
2143 }
2144
2145 void imgLoader::AddToUncachedImages(imgRequest* aRequest) {
2146   MutexAutoLock lock(mUncachedImagesMutex);
2147   mUncachedImages.Insert(aRequest);
2148 }
2149
2150 void imgLoader::RemoveFromUncachedImages(imgRequest* aRequest) {
2151   MutexAutoLock lock(mUncachedImagesMutex);
2152   mUncachedImages.Remove(aRequest);
2153 }
2154
2155 #define LOAD_FLAGS_CACHE_MASK \
2156   (nsIRequest::LOAD_BYPASS_CACHE | nsIRequest::LOAD_FROM_CACHE)
2157
2158 #define LOAD_FLAGS_VALIDATE_MASK                              \
2159   (nsIRequest::VALIDATE_ALWAYS | nsIRequest::VALIDATE_NEVER | \
2160    nsIRequest::VALIDATE_ONCE_PER_SESSION)
2161
2162 NS_IMETHODIMP
2163 imgLoader::LoadImageXPCOM(
2164     nsIURI* aURI, nsIURI* aInitialDocumentURI, nsIReferrerInfo* aReferrerInfo,
2165     nsIPrincipal* aTriggeringPrincipal, nsILoadGroup* aLoadGroup,
2166     imgINotificationObserver* aObserver, Document* aLoadingDocument,
2167     nsLoadFlags aLoadFlags, nsISupports* aCacheKey,
2168     nsContentPolicyType aContentPolicyType, imgIRequest** _retval) {
2169   // Optional parameter, so defaults to 0 (== TYPE_INVALID)
2170   if (!aContentPolicyType) {
2171     aContentPolicyType = nsIContentPolicy::TYPE_INTERNAL_IMAGE;
2172   }
2173   imgRequestProxy* proxy;
2174   nsresult rv =
2175       LoadImage(aURI, aInitialDocumentURI, aReferrerInfo, aTriggeringPrincipal,
2176                 0, aLoadGroup, aObserver, aLoadingDocument, aLoadingDocument,
2177                 aLoadFlags, aCacheKey, aContentPolicyType, u""_ns,
2178                 /* aUseUrgentStartForChannel */ false, /* aListPreload */ false,
2179                 0, &proxy);
2180   *_retval = proxy;
2181   return rv;
2182 }
2183
2184 static void MakeRequestStaticIfNeeded(
2185     Document* aLoadingDocument, imgRequestProxy** aProxyAboutToGetReturned) {
2186   if (!aLoadingDocument || !aLoadingDocument->IsStaticDocument()) {
2187     return;
2188   }
2189
2190   if (!*aProxyAboutToGetReturned) {
2191     return;
2192   }
2193
2194   RefPtr<imgRequestProxy> proxy = dont_AddRef(*aProxyAboutToGetReturned);
2195   *aProxyAboutToGetReturned = nullptr;
2196
2197   RefPtr<imgRequestProxy> staticProxy =
2198       proxy->GetStaticRequest(aLoadingDocument);
2199   if (staticProxy != proxy) {
2200     proxy->CancelAndForgetObserver(NS_BINDING_ABORTED);
2201     proxy = std::move(staticProxy);
2202   }
2203   proxy.forget(aProxyAboutToGetReturned);
2204 }
2205
2206 bool imgLoader::IsImageAvailable(nsIURI* aURI,
2207                                  nsIPrincipal* aTriggeringPrincipal,
2208                                  CORSMode aCORSMode, Document* aDocument) {
2209   ImageCacheKey key(aURI, aCORSMode,
2210                     aTriggeringPrincipal->OriginAttributesRef(), aDocument);
2211   RefPtr<imgCacheEntry> entry;
2212   if (!mCache.Get(key, getter_AddRefs(entry)) || !entry) {
2213     return false;
2214   }
2215   RefPtr<imgRequest> request = entry->GetRequest();
2216   if (!request) {
2217     return false;
2218   }
2219   if (nsCOMPtr<nsILoadGroup> docLoadGroup = aDocument->GetDocumentLoadGroup()) {
2220     nsLoadFlags requestFlags = nsIRequest::LOAD_NORMAL;
2221     docLoadGroup->GetLoadFlags(&requestFlags);
2222     if (requestFlags & nsIRequest::LOAD_BYPASS_CACHE) {
2223       // If we're bypassing the cache, treat the image as not available.
2224       return false;
2225     }
2226   }
2227   return ValidateCORSMode(request, false, aCORSMode, aTriggeringPrincipal);
2228 }
2229
2230 nsresult imgLoader::LoadImage(
2231     nsIURI* aURI, nsIURI* aInitialDocumentURI, nsIReferrerInfo* aReferrerInfo,
2232     nsIPrincipal* aTriggeringPrincipal, uint64_t aRequestContextID,
2233     nsILoadGroup* aLoadGroup, imgINotificationObserver* aObserver,
2234     nsINode* aContext, Document* aLoadingDocument, nsLoadFlags aLoadFlags,
2235     nsISupports* aCacheKey, nsContentPolicyType aContentPolicyType,
2236     const nsAString& initiatorType, bool aUseUrgentStartForChannel,
2237     bool aLinkPreload, uint64_t aEarlyHintPreloaderId,
2238     imgRequestProxy** _retval) {
2239   VerifyCacheSizes();
2240
2241   NS_ASSERTION(aURI, "imgLoader::LoadImage -- NULL URI pointer");
2242
2243   if (!aURI) {
2244     return NS_ERROR_NULL_POINTER;
2245   }
2246
2247   auto makeStaticIfNeeded = mozilla::MakeScopeExit(
2248       [&] { MakeRequestStaticIfNeeded(aLoadingDocument, _retval); });
2249
2250   AUTO_PROFILER_LABEL_DYNAMIC_NSCSTRING("imgLoader::LoadImage", NETWORK,
2251                                         aURI->GetSpecOrDefault());
2252
2253   LOG_SCOPE_WITH_PARAM(gImgLog, "imgLoader::LoadImage", "aURI", aURI);
2254
2255   *_retval = nullptr;
2256
2257   RefPtr<imgRequest> request;
2258
2259   nsresult rv;
2260   nsLoadFlags requestFlags = nsIRequest::LOAD_NORMAL;
2261
2262 #ifdef DEBUG
2263   bool isPrivate = false;
2264
2265   if (aLoadingDocument) {
2266     isPrivate = nsContentUtils::IsInPrivateBrowsing(aLoadingDocument);
2267   } else if (aLoadGroup) {
2268     isPrivate = nsContentUtils::IsInPrivateBrowsing(aLoadGroup);
2269   }
2270   MOZ_ASSERT(isPrivate == mRespectPrivacy);
2271
2272   if (aLoadingDocument) {
2273     // The given load group should match that of the document if given. If
2274     // that isn't the case, then we need to add more plumbing to ensure we
2275     // block the document as well.
2276     nsCOMPtr<nsILoadGroup> docLoadGroup =
2277         aLoadingDocument->GetDocumentLoadGroup();
2278     MOZ_ASSERT(docLoadGroup == aLoadGroup);
2279   }
2280 #endif
2281
2282   // Get the default load flags from the loadgroup (if possible)...
2283   if (aLoadGroup) {
2284     aLoadGroup->GetLoadFlags(&requestFlags);
2285   }
2286   //
2287   // Merge the default load flags with those passed in via aLoadFlags.
2288   // Currently, *only* the caching, validation and background load flags
2289   // are merged...
2290   //
2291   // The flags in aLoadFlags take precedence over the default flags!
2292   //
2293   if (aLoadFlags & LOAD_FLAGS_CACHE_MASK) {
2294     // Override the default caching flags...
2295     requestFlags = (requestFlags & ~LOAD_FLAGS_CACHE_MASK) |
2296                    (aLoadFlags & LOAD_FLAGS_CACHE_MASK);
2297   }
2298   if (aLoadFlags & LOAD_FLAGS_VALIDATE_MASK) {
2299     // Override the default validation flags...
2300     requestFlags = (requestFlags & ~LOAD_FLAGS_VALIDATE_MASK) |
2301                    (aLoadFlags & LOAD_FLAGS_VALIDATE_MASK);
2302   }
2303   if (aLoadFlags & nsIRequest::LOAD_BACKGROUND) {
2304     // Propagate background loading...
2305     requestFlags |= nsIRequest::LOAD_BACKGROUND;
2306   }
2307
2308   if (aLinkPreload) {
2309     // Set background loading if it is <link rel=preload>
2310     requestFlags |= nsIRequest::LOAD_BACKGROUND;
2311   }
2312
2313   CORSMode corsmode = CORS_NONE;
2314   if (aLoadFlags & imgILoader::LOAD_CORS_ANONYMOUS) {
2315     corsmode = CORS_ANONYMOUS;
2316   } else if (aLoadFlags & imgILoader::LOAD_CORS_USE_CREDENTIALS) {
2317     corsmode = CORS_USE_CREDENTIALS;
2318   }
2319
2320   // Look in the preloaded images of loading document first.
2321   if (!aLinkPreload && aLoadingDocument) {
2322     // All Early Hints preloads are Link preloads, therefore we don't have a
2323     // Early Hints preload here
2324     MOZ_ASSERT(!aEarlyHintPreloaderId);
2325     auto key =
2326         PreloadHashKey::CreateAsImage(aURI, aTriggeringPrincipal, corsmode);
2327     if (RefPtr<PreloaderBase> preload =
2328             aLoadingDocument->Preloads().LookupPreload(key)) {
2329       RefPtr<imgRequestProxy> proxy = do_QueryObject(preload);
2330       MOZ_ASSERT(proxy);
2331
2332       MOZ_LOG(gImgLog, LogLevel::Debug,
2333               ("[this=%p] imgLoader::LoadImage -- preloaded [proxy=%p]"
2334                " [document=%p]\n",
2335                this, proxy.get(), aLoadingDocument));
2336
2337       // Removing the preload for this image to be in parity with Chromium.  Any
2338       // following regular image request will be reloaded using the regular
2339       // path: image cache, http cache, network.  Any following `<link
2340       // rel=preload as=image>` will start a new image preload that can be
2341       // satisfied from http cache or network.
2342       //
2343       // There is a spec discussion for "preload cache", see
2344       // https://github.com/w3c/preload/issues/97. And it is also not clear how
2345       // preload image interacts with list of available images, see
2346       // https://github.com/whatwg/html/issues/4474.
2347       proxy->RemoveSelf(aLoadingDocument);
2348       proxy->NotifyUsage(aLoadingDocument);
2349
2350       imgRequest* request = proxy->GetOwner();
2351       nsresult rv =
2352           CreateNewProxyForRequest(request, aURI, aLoadGroup, aLoadingDocument,
2353                                    aObserver, requestFlags, _retval);
2354       NS_ENSURE_SUCCESS(rv, rv);
2355
2356       imgRequestProxy* newProxy = *_retval;
2357       if (imgCacheValidator* validator = request->GetValidator()) {
2358         newProxy->MarkValidating();
2359         // Attach the proxy without notifying and this will add us to the load
2360         // group.
2361         validator->AddProxy(newProxy);
2362       } else {
2363         // It's OK to add here even if the request is done. If it is, it'll send
2364         // a OnStopRequest()and the proxy will be removed from the loadgroup in
2365         // imgRequestProxy::OnLoadComplete.
2366         newProxy->AddToLoadGroup();
2367         newProxy->NotifyListener();
2368       }
2369
2370       return NS_OK;
2371     }
2372   }
2373
2374   RefPtr<imgCacheEntry> entry;
2375
2376   // Look in the cache for our URI, and then validate it.
2377   // XXX For now ignore aCacheKey. We will need it in the future
2378   // for correctly dealing with image load requests that are a result
2379   // of post data.
2380   OriginAttributes attrs;
2381   if (aTriggeringPrincipal) {
2382     attrs = aTriggeringPrincipal->OriginAttributesRef();
2383   }
2384   ImageCacheKey key(aURI, corsmode, attrs, aLoadingDocument);
2385   if (mCache.Get(key, getter_AddRefs(entry)) && entry) {
2386     bool newChannelCreated = false;
2387     if (ValidateEntry(entry, aURI, aInitialDocumentURI, aReferrerInfo,
2388                       aLoadGroup, aObserver, aLoadingDocument, requestFlags,
2389                       aContentPolicyType, true, &newChannelCreated, _retval,
2390                       aTriggeringPrincipal, corsmode, aLinkPreload,
2391                       aEarlyHintPreloaderId)) {
2392       request = entry->GetRequest();
2393
2394       // If this entry has no proxies, its request has no reference to the
2395       // entry.
2396       if (entry->HasNoProxies()) {
2397         LOG_FUNC_WITH_PARAM(gImgLog,
2398                             "imgLoader::LoadImage() adding proxyless entry",
2399                             "uri", key.URI());
2400         MOZ_ASSERT(!request->HasCacheEntry(),
2401                    "Proxyless entry's request has cache entry!");
2402         request->SetCacheEntry(entry);
2403
2404         if (mCacheTracker && entry->GetExpirationState()->IsTracked()) {
2405           mCacheTracker->MarkUsed(entry);
2406         }
2407       }
2408
2409       entry->Touch();
2410
2411       if (!newChannelCreated) {
2412         // This is ugly but it's needed to report CSP violations. We have 3
2413         // scenarios:
2414         // - we don't have cache. We are not in this if() stmt. A new channel is
2415         //   created and that triggers the CSP checks.
2416         // - We have a cache entry and this is blocked by CSP directives.
2417         DebugOnly<bool> shouldLoad = ShouldLoadCachedImage(
2418             request, aLoadingDocument, aTriggeringPrincipal, aContentPolicyType,
2419             /* aSendCSPViolationReports */ true);
2420         MOZ_ASSERT(shouldLoad);
2421       }
2422     } else {
2423       // We can't use this entry. We'll try to load it off the network, and if
2424       // successful, overwrite the old entry in the cache with a new one.
2425       entry = nullptr;
2426     }
2427   }
2428
2429   // Keep the channel in this scope, so we can adjust its notificationCallbacks
2430   // later when we create the proxy.
2431   nsCOMPtr<nsIChannel> newChannel;
2432   // If we didn't get a cache hit, we need to load from the network.
2433   if (!request) {
2434     LOG_SCOPE(gImgLog, "imgLoader::LoadImage |cache miss|");
2435
2436     bool forcePrincipalCheck;
2437     rv = NewImageChannel(getter_AddRefs(newChannel), &forcePrincipalCheck, aURI,
2438                          aInitialDocumentURI, corsmode, aReferrerInfo,
2439                          aLoadGroup, requestFlags, aContentPolicyType,
2440                          aTriggeringPrincipal, aContext, mRespectPrivacy,
2441                          aEarlyHintPreloaderId);
2442     if (NS_FAILED(rv)) {
2443       return NS_ERROR_FAILURE;
2444     }
2445
2446     MOZ_ASSERT(NS_UsePrivateBrowsing(newChannel) == mRespectPrivacy);
2447
2448     NewRequestAndEntry(forcePrincipalCheck, this, key, getter_AddRefs(request),
2449                        getter_AddRefs(entry));
2450
2451     MOZ_LOG(gImgLog, LogLevel::Debug,
2452             ("[this=%p] imgLoader::LoadImage -- Created new imgRequest"
2453              " [request=%p]\n",
2454              this, request.get()));
2455
2456     nsCOMPtr<nsIClassOfService> cos(do_QueryInterface(newChannel));
2457     if (cos) {
2458       if (aUseUrgentStartForChannel && !aLinkPreload) {
2459         cos->AddClassFlags(nsIClassOfService::UrgentStart);
2460       }
2461
2462       if (StaticPrefs::network_http_tailing_enabled() &&
2463           aContentPolicyType == nsIContentPolicy::TYPE_INTERNAL_IMAGE_FAVICON) {
2464         cos->AddClassFlags(nsIClassOfService::Throttleable |
2465                            nsIClassOfService::Tail);
2466         nsCOMPtr<nsIHttpChannel> httpChannel(do_QueryInterface(newChannel));
2467         if (httpChannel) {
2468           Unused << httpChannel->SetRequestContextID(aRequestContextID);
2469         }
2470       }
2471     }
2472
2473     nsCOMPtr<nsILoadGroup> channelLoadGroup;
2474     newChannel->GetLoadGroup(getter_AddRefs(channelLoadGroup));
2475     rv = request->Init(aURI, aURI, /* aHadInsecureRedirect = */ false,
2476                        channelLoadGroup, newChannel, entry, aLoadingDocument,
2477                        aTriggeringPrincipal, corsmode, aReferrerInfo);
2478     if (NS_FAILED(rv)) {
2479       return NS_ERROR_FAILURE;
2480     }
2481
2482     // Add the initiator type for this image load
2483     nsCOMPtr<nsITimedChannel> timedChannel = do_QueryInterface(newChannel);
2484     if (timedChannel) {
2485       timedChannel->SetInitiatorType(initiatorType);
2486     }
2487
2488     // create the proxy listener
2489     nsCOMPtr<nsIStreamListener> listener = new ProxyListener(request.get());
2490
2491     MOZ_LOG(gImgLog, LogLevel::Debug,
2492             ("[this=%p] imgLoader::LoadImage -- Calling channel->AsyncOpen()\n",
2493              this));
2494
2495     mozilla::net::PredictorLearn(aURI, aInitialDocumentURI,
2496                                  nsINetworkPredictor::LEARN_LOAD_SUBRESOURCE,
2497                                  aLoadGroup);
2498
2499     nsresult openRes;
2500     openRes = newChannel->AsyncOpen(listener);
2501
2502     if (NS_FAILED(openRes)) {
2503       MOZ_LOG(
2504           gImgLog, LogLevel::Debug,
2505           ("[this=%p] imgLoader::LoadImage -- AsyncOpen() failed: 0x%" PRIx32
2506            "\n",
2507            this, static_cast<uint32_t>(openRes)));
2508       request->CancelAndAbort(openRes);
2509       return openRes;
2510     }
2511
2512     // Try to add the new request into the cache.
2513     PutIntoCache(key, entry);
2514   } else {
2515     LOG_MSG_WITH_PARAM(gImgLog, "imgLoader::LoadImage |cache hit|", "request",
2516                        request);
2517   }
2518
2519   // If we didn't get a proxy when validating the cache entry, we need to
2520   // create one.
2521   if (!*_retval) {
2522     // ValidateEntry() has three return values: "Is valid," "might be valid --
2523     // validating over network", and "not valid." If we don't have a _retval,
2524     // we know ValidateEntry is not validating over the network, so it's safe
2525     // to SetLoadId here because we know this request is valid for this context.
2526     //
2527     // Note, however, that this doesn't guarantee the behaviour we want (one
2528     // URL maps to the same image on a page) if we load the same image in a
2529     // different tab (see bug 528003), because its load id will get re-set, and
2530     // that'll cause us to validate over the network.
2531     request->SetLoadId(aLoadingDocument);
2532
2533     LOG_MSG(gImgLog, "imgLoader::LoadImage", "creating proxy request.");
2534     rv = CreateNewProxyForRequest(request, aURI, aLoadGroup, aLoadingDocument,
2535                                   aObserver, requestFlags, _retval);
2536     if (NS_FAILED(rv)) {
2537       return rv;
2538     }
2539
2540     imgRequestProxy* proxy = *_retval;
2541
2542     // Make sure that OnStatus/OnProgress calls have the right request set, if
2543     // we did create a channel here.
2544     if (newChannel) {
2545       nsCOMPtr<nsIInterfaceRequestor> requestor(
2546           new nsProgressNotificationProxy(newChannel, proxy));
2547       if (!requestor) {
2548         return NS_ERROR_OUT_OF_MEMORY;
2549       }
2550       newChannel->SetNotificationCallbacks(requestor);
2551     }
2552
2553     if (aLinkPreload) {
2554       MOZ_ASSERT(aLoadingDocument);
2555       auto preloadKey =
2556           PreloadHashKey::CreateAsImage(aURI, aTriggeringPrincipal, corsmode);
2557       proxy->NotifyOpen(preloadKey, aLoadingDocument, true);
2558     }
2559
2560     // Note that it's OK to add here even if the request is done.  If it is,
2561     // it'll send a OnStopRequest() to the proxy in imgRequestProxy::Notify and
2562     // the proxy will be removed from the loadgroup.
2563     proxy->AddToLoadGroup();
2564
2565     // If we're loading off the network, explicitly don't notify our proxy,
2566     // because necko (or things called from necko, such as imgCacheValidator)
2567     // are going to call our notifications asynchronously, and we can't make it
2568     // further asynchronous because observers might rely on imagelib completing
2569     // its work between the channel's OnStartRequest and OnStopRequest.
2570     if (!newChannel) {
2571       proxy->NotifyListener();
2572     }
2573
2574     return rv;
2575   }
2576
2577   NS_ASSERTION(*_retval, "imgLoader::LoadImage -- no return value");
2578
2579   return NS_OK;
2580 }
2581
2582 NS_IMETHODIMP
2583 imgLoader::LoadImageWithChannelXPCOM(nsIChannel* channel,
2584                                      imgINotificationObserver* aObserver,
2585                                      Document* aLoadingDocument,
2586                                      nsIStreamListener** listener,
2587                                      imgIRequest** _retval) {
2588   nsresult result;
2589   imgRequestProxy* proxy;
2590   result = LoadImageWithChannel(channel, aObserver, aLoadingDocument, listener,
2591                                 &proxy);
2592   *_retval = proxy;
2593   return result;
2594 }
2595
2596 nsresult imgLoader::LoadImageWithChannel(nsIChannel* channel,
2597                                          imgINotificationObserver* aObserver,
2598                                          Document* aLoadingDocument,
2599                                          nsIStreamListener** listener,
2600                                          imgRequestProxy** _retval) {
2601   NS_ASSERTION(channel,
2602                "imgLoader::LoadImageWithChannel -- NULL channel pointer");
2603
2604   MOZ_ASSERT(NS_UsePrivateBrowsing(channel) == mRespectPrivacy);
2605
2606   auto makeStaticIfNeeded = mozilla::MakeScopeExit(
2607       [&] { MakeRequestStaticIfNeeded(aLoadingDocument, _retval); });
2608
2609   LOG_SCOPE(gImgLog, "imgLoader::LoadImageWithChannel");
2610   RefPtr<imgRequest> request;
2611
2612   nsCOMPtr<nsIURI> uri;
2613   channel->GetURI(getter_AddRefs(uri));
2614
2615   NS_ENSURE_TRUE(channel, NS_ERROR_FAILURE);
2616   nsCOMPtr<nsILoadInfo> loadInfo = channel->LoadInfo();
2617
2618   OriginAttributes attrs = loadInfo->GetOriginAttributes();
2619
2620   // TODO: Get a meaningful cors mode from the caller probably?
2621   const auto corsMode = CORS_NONE;
2622   ImageCacheKey key(uri, corsMode, attrs, aLoadingDocument);
2623
2624   nsLoadFlags requestFlags = nsIRequest::LOAD_NORMAL;
2625   channel->GetLoadFlags(&requestFlags);
2626
2627   RefPtr<imgCacheEntry> entry;
2628
2629   if (requestFlags & nsIRequest::LOAD_BYPASS_CACHE) {
2630     RemoveFromCache(key);
2631   } else {
2632     // Look in the cache for our URI, and then validate it.
2633     // XXX For now ignore aCacheKey. We will need it in the future
2634     // for correctly dealing with image load requests that are a result
2635     // of post data.
2636     if (mCache.Get(key, getter_AddRefs(entry)) && entry) {
2637       // We don't want to kick off another network load. So we ask
2638       // ValidateEntry to only do validation without creating a new proxy. If
2639       // it says that the entry isn't valid any more, we'll only use the entry
2640       // we're getting if the channel is loading from the cache anyways.
2641       //
2642       // XXX -- should this be changed? it's pretty much verbatim from the old
2643       // code, but seems nonsensical.
2644       //
2645       // Since aCanMakeNewChannel == false, we don't need to pass content policy
2646       // type/principal/etc
2647
2648       nsCOMPtr<nsILoadInfo> loadInfo = channel->LoadInfo();
2649       // if there is a loadInfo, use the right contentType, otherwise
2650       // default to the internal image type
2651       nsContentPolicyType policyType = loadInfo->InternalContentPolicyType();
2652
2653       if (ValidateEntry(entry, uri, nullptr, nullptr, nullptr, aObserver,
2654                         aLoadingDocument, requestFlags, policyType, false,
2655                         nullptr, nullptr, nullptr, corsMode, false, 0)) {
2656         request = entry->GetRequest();
2657       } else {
2658         nsCOMPtr<nsICacheInfoChannel> cacheChan(do_QueryInterface(channel));
2659         bool bUseCacheCopy;
2660
2661         if (cacheChan) {
2662           cacheChan->IsFromCache(&bUseCacheCopy);
2663         } else {
2664           bUseCacheCopy = false;
2665         }
2666
2667         if (!bUseCacheCopy) {
2668           entry = nullptr;
2669         } else {
2670           request = entry->GetRequest();
2671         }
2672       }
2673
2674       if (request && entry) {
2675         // If this entry has no proxies, its request has no reference to
2676         // the entry.
2677         if (entry->HasNoProxies()) {
2678           LOG_FUNC_WITH_PARAM(
2679               gImgLog,
2680               "imgLoader::LoadImageWithChannel() adding proxyless entry", "uri",
2681               key.URI());
2682           MOZ_ASSERT(!request->HasCacheEntry(),
2683                      "Proxyless entry's request has cache entry!");
2684           request->SetCacheEntry(entry);
2685
2686           if (mCacheTracker && entry->GetExpirationState()->IsTracked()) {
2687             mCacheTracker->MarkUsed(entry);
2688           }
2689         }
2690       }
2691     }
2692   }
2693
2694   nsCOMPtr<nsILoadGroup> loadGroup;
2695   channel->GetLoadGroup(getter_AddRefs(loadGroup));
2696
2697 #ifdef DEBUG
2698   if (aLoadingDocument) {
2699     // The load group of the channel should always match that of the
2700     // document if given. If that isn't the case, then we need to add more
2701     // plumbing to ensure we block the document as well.
2702     nsCOMPtr<nsILoadGroup> docLoadGroup =
2703         aLoadingDocument->GetDocumentLoadGroup();
2704     MOZ_ASSERT(docLoadGroup == loadGroup);
2705   }
2706 #endif
2707
2708   // Filter out any load flags not from nsIRequest
2709   requestFlags &= nsIRequest::LOAD_REQUESTMASK;
2710
2711   nsresult rv = NS_OK;
2712   if (request) {
2713     // we have this in our cache already.. cancel the current (document) load
2714
2715     // this should fire an OnStopRequest
2716     channel->Cancel(NS_ERROR_PARSED_DATA_CACHED);
2717
2718     *listener = nullptr;  // give them back a null nsIStreamListener
2719
2720     rv = CreateNewProxyForRequest(request, uri, loadGroup, aLoadingDocument,
2721                                   aObserver, requestFlags, _retval);
2722     static_cast<imgRequestProxy*>(*_retval)->NotifyListener();
2723   } else {
2724     // We use originalURI here to fulfil the imgIRequest contract on GetURI.
2725     nsCOMPtr<nsIURI> originalURI;
2726     channel->GetOriginalURI(getter_AddRefs(originalURI));
2727
2728     // XXX(seth): We should be able to just use |key| here, except that |key| is
2729     // constructed above with the *current URI* and not the *original URI*. I'm
2730     // pretty sure this is a bug, and it's preventing us from ever getting a
2731     // cache hit in LoadImageWithChannel when redirects are involved.
2732     ImageCacheKey originalURIKey(originalURI, corsMode, attrs,
2733                                  aLoadingDocument);
2734
2735     // Default to doing a principal check because we don't know who
2736     // started that load and whether their principal ended up being
2737     // inherited on the channel.
2738     NewRequestAndEntry(/* aForcePrincipalCheckForCacheEntry = */ true, this,
2739                        originalURIKey, getter_AddRefs(request),
2740                        getter_AddRefs(entry));
2741
2742     // No principal specified here, because we're not passed one.
2743     // In LoadImageWithChannel, the redirects that may have been
2744     // associated with this load would have gone through necko.
2745     // We only have the final URI in ImageLib and hence don't know
2746     // if the request went through insecure redirects.  But if it did,
2747     // the necko cache should have handled that (since all necko cache hits
2748     // including the redirects will go through content policy).  Hence, we
2749     // can set aHadInsecureRedirect to false here.
2750     rv = request->Init(originalURI, uri, /* aHadInsecureRedirect = */ false,
2751                        channel, channel, entry, aLoadingDocument, nullptr,
2752                        corsMode, nullptr);
2753     NS_ENSURE_SUCCESS(rv, rv);
2754
2755     RefPtr<ProxyListener> pl =
2756         new ProxyListener(static_cast<nsIStreamListener*>(request.get()));
2757     pl.forget(listener);
2758
2759     // Try to add the new request into the cache.
2760     PutIntoCache(originalURIKey, entry);
2761
2762     rv = CreateNewProxyForRequest(request, originalURI, loadGroup,
2763                                   aLoadingDocument, aObserver, requestFlags,
2764                                   _retval);
2765
2766     // Explicitly don't notify our proxy, because we're loading off the
2767     // network, and necko (or things called from necko, such as
2768     // imgCacheValidator) are going to call our notifications asynchronously,
2769     // and we can't make it further asynchronous because observers might rely
2770     // on imagelib completing its work between the channel's OnStartRequest and
2771     // OnStopRequest.
2772   }
2773
2774   if (NS_FAILED(rv)) {
2775     return rv;
2776   }
2777
2778   (*_retval)->AddToLoadGroup();
2779   return rv;
2780 }
2781
2782 bool imgLoader::SupportImageWithMimeType(const nsACString& aMimeType,
2783                                          AcceptedMimeTypes aAccept
2784                                          /* = AcceptedMimeTypes::IMAGES */) {
2785   nsAutoCString mimeType(aMimeType);
2786   ToLowerCase(mimeType);
2787
2788   if (aAccept == AcceptedMimeTypes::IMAGES_AND_DOCUMENTS &&
2789       mimeType.EqualsLiteral("image/svg+xml")) {
2790     return true;
2791   }
2792
2793   DecoderType type = DecoderFactory::GetDecoderType(mimeType.get());
2794   return type != DecoderType::UNKNOWN;
2795 }
2796
2797 NS_IMETHODIMP
2798 imgLoader::GetMIMETypeFromContent(nsIRequest* aRequest,
2799                                   const uint8_t* aContents, uint32_t aLength,
2800                                   nsACString& aContentType) {
2801   nsCOMPtr<nsIChannel> channel(do_QueryInterface(aRequest));
2802   if (channel) {
2803     nsCOMPtr<nsILoadInfo> loadInfo = channel->LoadInfo();
2804     if (loadInfo->GetSkipContentSniffing()) {
2805       return NS_ERROR_NOT_AVAILABLE;
2806     }
2807   }
2808
2809   nsresult rv =
2810       GetMimeTypeFromContent((const char*)aContents, aLength, aContentType);
2811   if (NS_SUCCEEDED(rv) && channel && XRE_IsParentProcess()) {
2812     if (RefPtr<mozilla::net::nsHttpChannel> httpChannel =
2813             do_QueryObject(channel)) {
2814       // If the image type pattern matching algorithm given bytes does not
2815       // return undefined, then disable the further check and allow the
2816       // response.
2817       httpChannel->DisableIsOpaqueResponseAllowedAfterSniffCheck(
2818           mozilla::net::nsHttpChannel::SnifferType::Image);
2819     }
2820   }
2821
2822   return rv;
2823 }
2824
2825 /* static */
2826 nsresult imgLoader::GetMimeTypeFromContent(const char* aContents,
2827                                            uint32_t aLength,
2828                                            nsACString& aContentType) {
2829   nsAutoCString detected;
2830
2831   /* Is it a GIF? */
2832   if (aLength >= 6 &&
2833       (!strncmp(aContents, "GIF87a", 6) || !strncmp(aContents, "GIF89a", 6))) {
2834     aContentType.AssignLiteral(IMAGE_GIF);
2835
2836     /* or a PNG? */
2837   } else if (aLength >= 8 && ((unsigned char)aContents[0] == 0x89 &&
2838                               (unsigned char)aContents[1] == 0x50 &&
2839                               (unsigned char)aContents[2] == 0x4E &&
2840                               (unsigned char)aContents[3] == 0x47 &&
2841                               (unsigned char)aContents[4] == 0x0D &&
2842                               (unsigned char)aContents[5] == 0x0A &&
2843                               (unsigned char)aContents[6] == 0x1A &&
2844                               (unsigned char)aContents[7] == 0x0A)) {
2845     aContentType.AssignLiteral(IMAGE_PNG);
2846
2847     /* maybe a JPEG (JFIF)? */
2848     /* JFIF files start with SOI APP0 but older files can start with SOI DQT
2849      * so we test for SOI followed by any marker, i.e. FF D8 FF
2850      * this will also work for SPIFF JPEG files if they appear in the future.
2851      *
2852      * (JFIF is 0XFF 0XD8 0XFF 0XE0 <skip 2> 0X4A 0X46 0X49 0X46 0X00)
2853      */
2854   } else if (aLength >= 3 && ((unsigned char)aContents[0]) == 0xFF &&
2855              ((unsigned char)aContents[1]) == 0xD8 &&
2856              ((unsigned char)aContents[2]) == 0xFF) {
2857     aContentType.AssignLiteral(IMAGE_JPEG);
2858
2859     /* or how about ART? */
2860     /* ART begins with JG (4A 47). Major version offset 2.
2861      * Minor version offset 3. Offset 4 must be nullptr.
2862      */
2863   } else if (aLength >= 5 && ((unsigned char)aContents[0]) == 0x4a &&
2864              ((unsigned char)aContents[1]) == 0x47 &&
2865              ((unsigned char)aContents[4]) == 0x00) {
2866     aContentType.AssignLiteral(IMAGE_ART);
2867
2868   } else if (aLength >= 2 && !strncmp(aContents, "BM", 2)) {
2869     aContentType.AssignLiteral(IMAGE_BMP);
2870
2871     // ICOs always begin with a 2-byte 0 followed by a 2-byte 1.
2872     // CURs begin with 2-byte 0 followed by 2-byte 2.
2873   } else if (aLength >= 4 && (!memcmp(aContents, "\000\000\001\000", 4) ||
2874                               !memcmp(aContents, "\000\000\002\000", 4))) {
2875     aContentType.AssignLiteral(IMAGE_ICO);
2876
2877     // WebPs always begin with RIFF, a 32-bit length, and WEBP.
2878   } else if (aLength >= 12 && !memcmp(aContents, "RIFF", 4) &&
2879              !memcmp(aContents + 8, "WEBP", 4)) {
2880     aContentType.AssignLiteral(IMAGE_WEBP);
2881
2882   } else if (MatchesMP4(reinterpret_cast<const uint8_t*>(aContents), aLength,
2883                         detected) &&
2884              detected.Equals(IMAGE_AVIF)) {
2885     aContentType.AssignLiteral(IMAGE_AVIF);
2886   } else if ((aLength >= 2 && !memcmp(aContents, "\xFF\x0A", 2)) ||
2887              (aLength >= 12 &&
2888               !memcmp(aContents, "\x00\x00\x00\x0CJXL \x0D\x0A\x87\x0A", 12))) {
2889     // Each version is for containerless and containerful files respectively.
2890     aContentType.AssignLiteral(IMAGE_JXL);
2891   } else {
2892     /* none of the above?  I give up */
2893     return NS_ERROR_NOT_AVAILABLE;
2894   }
2895
2896   return NS_OK;
2897 }
2898
2899 /**
2900  * proxy stream listener class used to handle multipart/x-mixed-replace
2901  */
2902
2903 #include "nsIRequest.h"
2904 #include "nsIStreamConverterService.h"
2905
2906 NS_IMPL_ISUPPORTS(ProxyListener, nsIStreamListener,
2907                   nsIThreadRetargetableStreamListener, nsIRequestObserver)
2908
2909 ProxyListener::ProxyListener(nsIStreamListener* dest) : mDestListener(dest) {}
2910
2911 ProxyListener::~ProxyListener() = default;
2912
2913 /** nsIRequestObserver methods **/
2914
2915 NS_IMETHODIMP
2916 ProxyListener::OnStartRequest(nsIRequest* aRequest) {
2917   if (!mDestListener) {
2918     return NS_ERROR_FAILURE;
2919   }
2920
2921   nsCOMPtr<nsIChannel> channel(do_QueryInterface(aRequest));
2922   if (channel) {
2923     // We need to set the initiator type for the image load
2924     nsCOMPtr<nsITimedChannel> timedChannel = do_QueryInterface(channel);
2925     if (timedChannel) {
2926       nsAutoString type;
2927       timedChannel->GetInitiatorType(type);
2928       if (type.IsEmpty()) {
2929         timedChannel->SetInitiatorType(u"img"_ns);
2930       }
2931     }
2932
2933     nsAutoCString contentType;
2934     nsresult rv = channel->GetContentType(contentType);
2935
2936     if (!contentType.IsEmpty()) {
2937       /* If multipart/x-mixed-replace content, we'll insert a MIME decoder
2938          in the pipeline to handle the content and pass it along to our
2939          original listener.
2940        */
2941       if ("multipart/x-mixed-replace"_ns.Equals(contentType)) {
2942         nsCOMPtr<nsIStreamConverterService> convServ(
2943             do_GetService("@mozilla.org/streamConverters;1", &rv));
2944         if (NS_SUCCEEDED(rv)) {
2945           nsCOMPtr<nsIStreamListener> toListener(mDestListener);
2946           nsCOMPtr<nsIStreamListener> fromListener;
2947
2948           rv = convServ->AsyncConvertData("multipart/x-mixed-replace", "*/*",
2949                                           toListener, nullptr,
2950                                           getter_AddRefs(fromListener));
2951           if (NS_SUCCEEDED(rv)) {
2952             mDestListener = fromListener;
2953           }
2954         }
2955       }
2956     }
2957   }
2958
2959   return mDestListener->OnStartRequest(aRequest);
2960 }
2961
2962 NS_IMETHODIMP
2963 ProxyListener::OnStopRequest(nsIRequest* aRequest, nsresult status) {
2964   if (!mDestListener) {
2965     return NS_ERROR_FAILURE;
2966   }
2967
2968   return mDestListener->OnStopRequest(aRequest, status);
2969 }
2970
2971 /** nsIStreamListener methods **/
2972
2973 NS_IMETHODIMP
2974 ProxyListener::OnDataAvailable(nsIRequest* aRequest, nsIInputStream* inStr,
2975                                uint64_t sourceOffset, uint32_t count) {
2976   if (!mDestListener) {
2977     return NS_ERROR_FAILURE;
2978   }
2979
2980   return mDestListener->OnDataAvailable(aRequest, inStr, sourceOffset, count);
2981 }
2982
2983 NS_IMETHODIMP
2984 ProxyListener::OnDataFinished(nsresult aStatus) {
2985   if (!mDestListener) {
2986     return NS_ERROR_FAILURE;
2987   }
2988   nsCOMPtr<nsIThreadRetargetableStreamListener> retargetableListener =
2989       do_QueryInterface(mDestListener);
2990   if (retargetableListener) {
2991     return retargetableListener->OnDataFinished(aStatus);
2992   }
2993
2994   return NS_OK;
2995 }
2996
2997 /** nsThreadRetargetableStreamListener methods **/
2998 NS_IMETHODIMP
2999 ProxyListener::CheckListenerChain() {
3000   NS_ASSERTION(NS_IsMainThread(), "Should be on the main thread!");
3001   nsresult rv = NS_OK;
3002   nsCOMPtr<nsIThreadRetargetableStreamListener> retargetableListener =
3003       do_QueryInterface(mDestListener, &rv);
3004   if (retargetableListener) {
3005     rv = retargetableListener->CheckListenerChain();
3006   }
3007   MOZ_LOG(
3008       gImgLog, LogLevel::Debug,
3009       ("ProxyListener::CheckListenerChain %s [this=%p listener=%p rv=%" PRIx32
3010        "]",
3011        (NS_SUCCEEDED(rv) ? "success" : "failure"), this,
3012        (nsIStreamListener*)mDestListener, static_cast<uint32_t>(rv)));
3013   return rv;
3014 }
3015
3016 /**
3017  * http validate class.  check a channel for a 304
3018  */
3019
3020 NS_IMPL_ISUPPORTS(imgCacheValidator, nsIStreamListener, nsIRequestObserver,
3021                   nsIThreadRetargetableStreamListener, nsIChannelEventSink,
3022                   nsIInterfaceRequestor, nsIAsyncVerifyRedirectCallback)
3023
3024 imgCacheValidator::imgCacheValidator(nsProgressNotificationProxy* progress,
3025                                      imgLoader* loader, imgRequest* request,
3026                                      Document* aDocument,
3027                                      uint64_t aInnerWindowId,
3028                                      bool forcePrincipalCheckForCacheEntry)
3029     : mProgressProxy(progress),
3030       mRequest(request),
3031       mDocument(aDocument),
3032       mInnerWindowId(aInnerWindowId),
3033       mImgLoader(loader),
3034       mHadInsecureRedirect(false) {
3035   NewRequestAndEntry(forcePrincipalCheckForCacheEntry, loader,
3036                      mRequest->CacheKey(), getter_AddRefs(mNewRequest),
3037                      getter_AddRefs(mNewEntry));
3038 }
3039
3040 imgCacheValidator::~imgCacheValidator() {
3041   if (mRequest) {
3042     // If something went wrong, and we never unblocked the requests waiting on
3043     // validation, now is our last chance. We will cancel the new request and
3044     // switch the waiting proxies to it.
3045     UpdateProxies(/* aCancelRequest */ true, /* aSyncNotify */ false);
3046   }
3047 }
3048
3049 void imgCacheValidator::AddProxy(imgRequestProxy* aProxy) {
3050   // aProxy needs to be in the loadgroup since we're validating from
3051   // the network.
3052   aProxy->AddToLoadGroup();
3053
3054   mProxies.AppendElement(aProxy);
3055 }
3056
3057 void imgCacheValidator::RemoveProxy(imgRequestProxy* aProxy) {
3058   mProxies.RemoveElement(aProxy);
3059 }
3060
3061 void imgCacheValidator::UpdateProxies(bool aCancelRequest, bool aSyncNotify) {
3062   MOZ_ASSERT(mRequest);
3063
3064   // Clear the validator before updating the proxies. The notifications may
3065   // clone an existing request, and its state could be inconsistent.
3066   mRequest->SetValidator(nullptr);
3067   mRequest = nullptr;
3068
3069   // If an error occurred, we will want to cancel the new request, and make the
3070   // validating proxies point to it. Any proxies still bound to the original
3071   // request which are not validating should remain untouched.
3072   if (aCancelRequest) {
3073     MOZ_ASSERT(mNewRequest);
3074     mNewRequest->CancelAndAbort(NS_BINDING_ABORTED);
3075   }
3076
3077   // We have finished validating the request, so we can safely take ownership
3078   // of the proxy list. imgRequestProxy::SyncNotifyListener can mutate the list
3079   // if imgRequestProxy::CancelAndForgetObserver is called by its owner. Note
3080   // that any potential notifications should still be suppressed in
3081   // imgRequestProxy::ChangeOwner because we haven't cleared the validating
3082   // flag yet, and thus they will remain deferred.
3083   AutoTArray<RefPtr<imgRequestProxy>, 4> proxies(std::move(mProxies));
3084
3085   for (auto& proxy : proxies) {
3086     // First update the state of all proxies before notifying any of them
3087     // to ensure a consistent state (e.g. in case the notification causes
3088     // other proxies to be touched indirectly.)
3089     MOZ_ASSERT(proxy->IsValidating());
3090     MOZ_ASSERT(proxy->NotificationsDeferred(),
3091                "Proxies waiting on cache validation should be "
3092                "deferring notifications!");
3093     if (mNewRequest) {
3094       proxy->ChangeOwner(mNewRequest);
3095     }
3096     proxy->ClearValidating();
3097   }
3098
3099   mNewRequest = nullptr;
3100   mNewEntry = nullptr;
3101
3102   for (auto& proxy : proxies) {
3103     if (aSyncNotify) {
3104       // Notify synchronously, because the caller knows we are already in an
3105       // asynchronously-called function (e.g. OnStartRequest).
3106       proxy->SyncNotifyListener();
3107     } else {
3108       // Notify asynchronously, because the caller does not know our current
3109       // call state (e.g. ~imgCacheValidator).
3110       proxy->NotifyListener();
3111     }
3112   }
3113 }
3114
3115 /** nsIRequestObserver methods **/
3116
3117 NS_IMETHODIMP
3118 imgCacheValidator::OnStartRequest(nsIRequest* aRequest) {
3119   // We may be holding on to a document, so ensure that it's released.
3120   RefPtr<Document> document = mDocument.forget();
3121
3122   // If for some reason we don't still have an existing request (probably
3123   // because OnStartRequest got delivered more than once), just bail.
3124   if (!mRequest) {
3125     MOZ_ASSERT_UNREACHABLE("OnStartRequest delivered more than once?");
3126     aRequest->CancelWithReason(NS_BINDING_ABORTED,
3127                                "OnStartRequest delivered more than once?"_ns);
3128     return NS_ERROR_FAILURE;
3129   }
3130
3131   // If this request is coming from cache and has the same URI as our
3132   // imgRequest, the request all our proxies are pointing at is valid, and all
3133   // we have to do is tell them to notify their listeners.
3134   nsCOMPtr<nsICacheInfoChannel> cacheChan(do_QueryInterface(aRequest));
3135   nsCOMPtr<nsIChannel> channel(do_QueryInterface(aRequest));
3136   if (cacheChan && channel) {
3137     bool isFromCache = false;
3138     cacheChan->IsFromCache(&isFromCache);
3139
3140     nsCOMPtr<nsIURI> channelURI;
3141     channel->GetURI(getter_AddRefs(channelURI));
3142
3143     nsCOMPtr<nsIURI> finalURI;
3144     mRequest->GetFinalURI(getter_AddRefs(finalURI));
3145
3146     bool sameURI = false;
3147     if (channelURI && finalURI) {
3148       channelURI->Equals(finalURI, &sameURI);
3149     }
3150
3151     if (isFromCache && sameURI) {
3152       // We don't need to load this any more.
3153       aRequest->CancelWithReason(NS_BINDING_ABORTED,
3154                                  "imgCacheValidator::OnStartRequest"_ns);
3155       mNewRequest = nullptr;
3156
3157       // Clear the validator before updating the proxies. The notifications may
3158       // clone an existing request, and its state could be inconsistent.
3159       mRequest->SetLoadId(document);
3160       mRequest->SetInnerWindowID(mInnerWindowId);
3161       UpdateProxies(/* aCancelRequest */ false, /* aSyncNotify */ true);
3162       return NS_OK;
3163     }
3164   }
3165
3166   // We can't load out of cache. We have to create a whole new request for the
3167   // data that's coming in off the channel.
3168   nsCOMPtr<nsIURI> uri;
3169   mRequest->GetURI(getter_AddRefs(uri));
3170
3171   LOG_MSG_WITH_PARAM(gImgLog,
3172                      "imgCacheValidator::OnStartRequest creating new request",
3173                      "uri", uri);
3174
3175   CORSMode corsmode = mRequest->GetCORSMode();
3176   nsCOMPtr<nsIReferrerInfo> referrerInfo = mRequest->GetReferrerInfo();
3177   nsCOMPtr<nsIPrincipal> triggeringPrincipal =
3178       mRequest->GetTriggeringPrincipal();
3179
3180   // Doom the old request's cache entry
3181   mRequest->RemoveFromCache();
3182
3183   // We use originalURI here to fulfil the imgIRequest contract on GetURI.
3184   nsCOMPtr<nsIURI> originalURI;
3185   channel->GetOriginalURI(getter_AddRefs(originalURI));
3186   nsresult rv = mNewRequest->Init(originalURI, uri, mHadInsecureRedirect,
3187                                   aRequest, channel, mNewEntry, document,
3188                                   triggeringPrincipal, corsmode, referrerInfo);
3189   if (NS_FAILED(rv)) {
3190     UpdateProxies(/* aCancelRequest */ true, /* aSyncNotify */ true);
3191     return rv;
3192   }
3193
3194   mDestListener = new ProxyListener(mNewRequest);
3195
3196   // Try to add the new request into the cache. Note that the entry must be in
3197   // the cache before the proxies' ownership changes, because adding a proxy
3198   // changes the caching behaviour for imgRequests.
3199   mImgLoader->PutIntoCache(mNewRequest->CacheKey(), mNewEntry);
3200   UpdateProxies(/* aCancelRequest */ false, /* aSyncNotify */ true);
3201   return mDestListener->OnStartRequest(aRequest);
3202 }
3203
3204 NS_IMETHODIMP
3205 imgCacheValidator::OnStopRequest(nsIRequest* aRequest, nsresult status) {
3206   // Be sure we've released the document that we may have been holding on to.
3207   mDocument = nullptr;
3208
3209   if (!mDestListener) {
3210     return NS_OK;
3211   }
3212
3213   return mDestListener->OnStopRequest(aRequest, status);
3214 }
3215
3216 /** nsIStreamListener methods **/
3217
3218 NS_IMETHODIMP
3219 imgCacheValidator::OnDataAvailable(nsIRequest* aRequest, nsIInputStream* inStr,
3220                                    uint64_t sourceOffset, uint32_t count) {
3221   if (!mDestListener) {
3222     // XXX see bug 113959
3223     uint32_t _retval;
3224     inStr->ReadSegments(NS_DiscardSegment, nullptr, count, &_retval);
3225     return NS_OK;
3226   }
3227
3228   return mDestListener->OnDataAvailable(aRequest, inStr, sourceOffset, count);
3229 }
3230
3231 NS_IMETHODIMP
3232 imgCacheValidator::OnDataFinished(nsresult aStatus) {
3233   if (!mDestListener) {
3234     return NS_ERROR_FAILURE;
3235   }
3236   nsCOMPtr<nsIThreadRetargetableStreamListener> retargetableListener =
3237       do_QueryInterface(mDestListener);
3238   if (retargetableListener) {
3239     return retargetableListener->OnDataFinished(aStatus);
3240   }
3241
3242   return NS_OK;
3243 }
3244
3245 /** nsIThreadRetargetableStreamListener methods **/
3246
3247 NS_IMETHODIMP
3248 imgCacheValidator::CheckListenerChain() {
3249   NS_ASSERTION(NS_IsMainThread(), "Should be on the main thread!");
3250   nsresult rv = NS_OK;
3251   nsCOMPtr<nsIThreadRetargetableStreamListener> retargetableListener =
3252       do_QueryInterface(mDestListener, &rv);
3253   if (retargetableListener) {
3254     rv = retargetableListener->CheckListenerChain();
3255   }
3256   MOZ_LOG(
3257       gImgLog, LogLevel::Debug,
3258       ("[this=%p] imgCacheValidator::CheckListenerChain -- rv %" PRId32 "=%s",
3259        this, static_cast<uint32_t>(rv),
3260        NS_SUCCEEDED(rv) ? "succeeded" : "failed"));
3261   return rv;
3262 }
3263
3264 /** nsIInterfaceRequestor methods **/
3265
3266 NS_IMETHODIMP
3267 imgCacheValidator::GetInterface(const nsIID& aIID, void** aResult) {
3268   if (aIID.Equals(NS_GET_IID(nsIChannelEventSink))) {
3269     return QueryInterface(aIID, aResult);
3270   }
3271
3272   return mProgressProxy->GetInterface(aIID, aResult);
3273 }
3274
3275 // These functions are materially the same as the same functions in imgRequest.
3276 // We duplicate them because we're verifying whether cache loads are necessary,
3277 // not unconditionally loading.
3278
3279 /** nsIChannelEventSink methods **/
3280 NS_IMETHODIMP
3281 imgCacheValidator::AsyncOnChannelRedirect(
3282     nsIChannel* oldChannel, nsIChannel* newChannel, uint32_t flags,
3283     nsIAsyncVerifyRedirectCallback* callback) {
3284   // Note all cache information we get from the old channel.
3285   mNewRequest->SetCacheValidation(mNewEntry, oldChannel);
3286
3287   // If the previous URI is a non-HTTPS URI, record that fact for later use by
3288   // security code, which needs to know whether there is an insecure load at any
3289   // point in the redirect chain.
3290   nsCOMPtr<nsIURI> oldURI;
3291   bool schemeLocal = false;
3292   if (NS_FAILED(oldChannel->GetURI(getter_AddRefs(oldURI))) ||
3293       NS_FAILED(NS_URIChainHasFlags(
3294           oldURI, nsIProtocolHandler::URI_IS_LOCAL_RESOURCE, &schemeLocal)) ||
3295       (!oldURI->SchemeIs("https") && !oldURI->SchemeIs("chrome") &&
3296        !schemeLocal)) {
3297     mHadInsecureRedirect = true;
3298   }
3299
3300   // Prepare for callback
3301   mRedirectCallback = callback;
3302   mRedirectChannel = newChannel;
3303
3304   return mProgressProxy->AsyncOnChannelRedirect(oldChannel, newChannel, flags,
3305                                                 this);
3306 }
3307
3308 NS_IMETHODIMP
3309 imgCacheValidator::OnRedirectVerifyCallback(nsresult aResult) {
3310   // If we've already been told to abort, just do so.
3311   if (NS_FAILED(aResult)) {
3312     mRedirectCallback->OnRedirectVerifyCallback(aResult);
3313     mRedirectCallback = nullptr;
3314     mRedirectChannel = nullptr;
3315     return NS_OK;
3316   }
3317
3318   // make sure we have a protocol that returns data rather than opens
3319   // an external application, e.g. mailto:
3320   nsCOMPtr<nsIURI> uri;
3321   mRedirectChannel->GetURI(getter_AddRefs(uri));
3322
3323   nsresult result = NS_OK;
3324
3325   if (nsContentUtils::IsExternalProtocol(uri)) {
3326     result = NS_ERROR_ABORT;
3327   }
3328
3329   mRedirectCallback->OnRedirectVerifyCallback(result);
3330   mRedirectCallback = nullptr;
3331   mRedirectChannel = nullptr;
3332   return NS_OK;
3333 }