image/imgLoader.cpp

   1 /* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
   2 /* vim: set ts=8 sts=2 et sw=2 tw=80: */
   3 /* This Source Code Form is subject to the terms of the Mozilla Public
   4  * License, v. 2.0. If a copy of the MPL was not distributed with this
   5  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
   6
   7 // Undefine windows version of LoadImage because our code uses that name.
   8 #include "mozilla/ScopeExit.h"
   9 #undef LoadImage
  10
  11 #include "imgLoader.h"
  12
  13 #include <algorithm>
  14 #include <utility>
  15
  16 #include "DecoderFactory.h"
  17 #include "Image.h"
  18 #include "ImageLogging.h"
  19 #include "ReferrerInfo.h"
  20 #include "imgRequestProxy.h"
  21 #include "mozilla/Attributes.h"
  22 #include "mozilla/BasePrincipal.h"
  23 #include "mozilla/ChaosMode.h"
  24 #include "mozilla/ClearOnShutdown.h"
  25 #include "mozilla/LoadInfo.h"
  26 #include "mozilla/NullPrincipal.h"
  27 #include "mozilla/Preferences.h"
  28 #include "mozilla/ProfilerLabels.h"
  29 #include "mozilla/StaticPrefs_image.h"
  30 #include "mozilla/StaticPrefs_network.h"
  31 #include "mozilla/dom/ContentParent.h"
  32 #include "mozilla/dom/nsMixedContentBlocker.h"
  33 #include "mozilla/image/ImageMemoryReporter.h"
  34 #include "mozilla/layers/CompositorManagerChild.h"
  35 #include "nsCOMPtr.h"
  36 #include "nsCRT.h"
  37 #include "nsComponentManagerUtils.h"
  38 #include "nsContentPolicyUtils.h"
  39 #include "nsContentUtils.h"
  40 #include "nsHttpChannel.h"
  41 #include "nsIAsyncVerifyRedirectCallback.h"
  42 #include "nsICacheInfoChannel.h"
  43 #include "nsIChannelEventSink.h"
  44 #include "nsIClassOfService.h"
  45 #include "nsIFile.h"
  46 #include "nsIFileURL.h"
  47 #include "nsIHttpChannel.h"
  48 #include "nsIInterfaceRequestor.h"
  49 #include "nsIInterfaceRequestorUtils.h"
  50 #include "nsIMemoryReporter.h"
  51 #include "nsINetworkPredictor.h"
  52 #include "nsIProgressEventSink.h"
  53 #include "nsIProtocolHandler.h"
  54 #include "nsImageModule.h"
  55 #include "nsMediaSniffer.h"
  56 #include "nsMimeTypes.h"
  57 #include "nsNetCID.h"
  58 #include "nsNetUtil.h"
  59 #include "nsProxyRelease.h"
  60 #include "nsQueryObject.h"
  61 #include "nsReadableUtils.h"
  62 #include "nsStreamUtils.h"
  63 #include "prtime.h"
  64
  65 // we want to explore making the document own the load group
  66 // so we can associate the document URI with the load group.
  67 // until this point, we have an evil hack:
  68 #include "nsIHttpChannelInternal.h"
  69 #include "nsILoadGroupChild.h"
  70 #include "nsIDocShell.h"
  71
  72 using namespace mozilla;
  73 using namespace mozilla::dom;
  74 using namespace mozilla::image;
  75 using namespace mozilla::net;
  76
  77 MOZ_DEFINE_MALLOC_SIZE_OF(ImagesMallocSizeOf)
  78
  79 class imgMemoryReporter final : public nsIMemoryReporter {
  80   ~imgMemoryReporter() = default;
  81
  82  public:
  83   NS_DECL_ISUPPORTS
  84
  85   NS_IMETHOD CollectReports(nsIHandleReportCallback* aHandleReport,
  86                             nsISupports* aData, bool aAnonymize) override {
  87     MOZ_ASSERT(NS_IsMainThread());
  88
  89     layers::CompositorManagerChild* manager =
  90         mozilla::layers::CompositorManagerChild::GetInstance();
  91     if (!manager || !StaticPrefs::image_mem_debug_reporting()) {
  92       layers::SharedSurfacesMemoryReport sharedSurfaces;
  93       FinishCollectReports(aHandleReport, aData, aAnonymize, sharedSurfaces);
  94       return NS_OK;
  95     }
  96
  97     RefPtr<imgMemoryReporter> self(this);
  98     nsCOMPtr<nsIHandleReportCallback> handleReport(aHandleReport);
  99     nsCOMPtr<nsISupports> data(aData);
 100     manager->SendReportSharedSurfacesMemory(
 101         [=](layers::SharedSurfacesMemoryReport aReport) {
 102           self->FinishCollectReports(handleReport, data, aAnonymize, aReport);
 103         },
 104         [=](mozilla::ipc::ResponseRejectReason&& aReason) {
 105           layers::SharedSurfacesMemoryReport sharedSurfaces;
 106           self->FinishCollectReports(handleReport, data, aAnonymize,
 107                                      sharedSurfaces);
 108         });
 109     return NS_OK;
 110   }
 111
 112   void FinishCollectReports(
 113       nsIHandleReportCallback* aHandleReport, nsISupports* aData,
 114       bool aAnonymize, layers::SharedSurfacesMemoryReport& aSharedSurfaces) {
 115     nsTArray<ImageMemoryCounter> chrome;
 116     nsTArray<ImageMemoryCounter> content;
 117     nsTArray<ImageMemoryCounter> uncached;
 118
 119     for (uint32_t i = 0; i < mKnownLoaders.Length(); i++) {
 120       for (imgCacheEntry* entry : mKnownLoaders[i]->mChromeCache.Values()) {
 121         RefPtr<imgRequest> req = entry->GetRequest();
 122         RecordCounterForRequest(req, &chrome, !entry->HasNoProxies());
 123       }
 124       for (imgCacheEntry* entry : mKnownLoaders[i]->mCache.Values()) {
 125         RefPtr<imgRequest> req = entry->GetRequest();
 126         RecordCounterForRequest(req, &content, !entry->HasNoProxies());
 127       }
 128       MutexAutoLock lock(mKnownLoaders[i]->mUncachedImagesMutex);
 129       for (RefPtr<imgRequest> req : mKnownLoaders[i]->mUncachedImages) {
 130         RecordCounterForRequest(req, &uncached, req->HasConsumers());
 131       }
 132     }
 133
 134     // Note that we only need to anonymize content image URIs.
 135
 136     ReportCounterArray(aHandleReport, aData, chrome, "images/chrome",
 137                        /* aAnonymize */ false, aSharedSurfaces);
 138
 139     ReportCounterArray(aHandleReport, aData, content, "images/content",
 140                        aAnonymize, aSharedSurfaces);
 141
 142     // Uncached images may be content or chrome, so anonymize them.
 143     ReportCounterArray(aHandleReport, aData, uncached, "images/uncached",
 144                        aAnonymize, aSharedSurfaces);
 145
 146     // Report any shared surfaces that were not merged with the surface cache.
 147     ImageMemoryReporter::ReportSharedSurfaces(aHandleReport, aData,
 148                                               aSharedSurfaces);
 149
 150     nsCOMPtr<nsIMemoryReporterManager> imgr =
 151         do_GetService("@mozilla.org/memory-reporter-manager;1");
 152     if (imgr) {
 153       imgr->EndReport();
 154     }
 155   }
 156
 157   static int64_t ImagesContentUsedUncompressedDistinguishedAmount() {
 158     size_t n = 0;
 159     for (uint32_t i = 0; i < imgLoader::sMemReporter->mKnownLoaders.Length();
 160          i++) {
 161       for (imgCacheEntry* entry :
 162            imgLoader::sMemReporter->mKnownLoaders[i]->mCache.Values()) {
 163         if (entry->HasNoProxies()) {
 164           continue;
 165         }
 166
 167         RefPtr<imgRequest> req = entry->GetRequest();
 168         RefPtr<image::Image> image = req->GetImage();
 169         if (!image) {
 170           continue;
 171         }
 172
 173         // Both this and EntryImageSizes measure
 174         // images/content/raster/used/decoded memory.  This function's
 175         // measurement is secondary -- the result doesn't go in the "explicit"
 176         // tree -- so we use moz_malloc_size_of instead of ImagesMallocSizeOf to
 177         // prevent DMD from seeing it reported twice.
 178         SizeOfState state(moz_malloc_size_of);
 179         ImageMemoryCounter counter(req, image, state, /* aIsUsed = */ true);
 180
 181         n += counter.Values().DecodedHeap();
 182         n += counter.Values().DecodedNonHeap();
 183         n += counter.Values().DecodedUnknown();
 184       }
 185     }
 186     return n;
 187   }
 188
 189   void RegisterLoader(imgLoader* aLoader) {
 190     mKnownLoaders.AppendElement(aLoader);
 191   }
 192
 193   void UnregisterLoader(imgLoader* aLoader) {
 194     mKnownLoaders.RemoveElement(aLoader);
 195   }
 196
 197  private:
 198   nsTArray<imgLoader*> mKnownLoaders;
 199
 200   struct MemoryTotal {
 201     MemoryTotal& operator+=(const ImageMemoryCounter& aImageCounter) {
 202       if (aImageCounter.Type() == imgIContainer::TYPE_RASTER) {
 203         if (aImageCounter.IsUsed()) {
 204           mUsedRasterCounter += aImageCounter.Values();
 205         } else {
 206           mUnusedRasterCounter += aImageCounter.Values();
 207         }
 208       } else if (aImageCounter.Type() == imgIContainer::TYPE_VECTOR) {
 209         if (aImageCounter.IsUsed()) {
 210           mUsedVectorCounter += aImageCounter.Values();
 211         } else {
 212           mUnusedVectorCounter += aImageCounter.Values();
 213         }
 214       } else if (aImageCounter.Type() == imgIContainer::TYPE_REQUEST) {
 215         // Nothing to do, we did not get to the point of having an image.
 216       } else {
 217         MOZ_CRASH("Unexpected image type");
 218       }
 219
 220       return *this;
 221     }
 222
 223     const MemoryCounter& UsedRaster() const { return mUsedRasterCounter; }
 224     const MemoryCounter& UnusedRaster() const { return mUnusedRasterCounter; }
 225     const MemoryCounter& UsedVector() const { return mUsedVectorCounter; }
 226     const MemoryCounter& UnusedVector() const { return mUnusedVectorCounter; }
 227
 228    private:
 229     MemoryCounter mUsedRasterCounter;
 230     MemoryCounter mUnusedRasterCounter;
 231     MemoryCounter mUsedVectorCounter;
 232     MemoryCounter mUnusedVectorCounter;
 233   };
 234
 235   // Reports all images of a single kind, e.g. all used chrome images.
 236   void ReportCounterArray(nsIHandleReportCallback* aHandleReport,
 237                           nsISupports* aData,
 238                           nsTArray<ImageMemoryCounter>& aCounterArray,
 239                           const char* aPathPrefix, bool aAnonymize,
 240                           layers::SharedSurfacesMemoryReport& aSharedSurfaces) {
 241     MemoryTotal summaryTotal;
 242     MemoryTotal nonNotableTotal;
 243
 244     // Report notable images, and compute total and non-notable aggregate sizes.
 245     for (uint32_t i = 0; i < aCounterArray.Length(); i++) {
 246       ImageMemoryCounter& counter = aCounterArray[i];
 247
 248       if (aAnonymize) {
 249         counter.URI().Truncate();
 250         counter.URI().AppendPrintf("<anonymized-%u>", i);
 251       } else {
 252         // The URI could be an extremely long data: URI. Truncate if needed.
 253         static const size_t max = 256;
 254         if (counter.URI().Length() > max) {
 255           counter.URI().Truncate(max);
 256           counter.URI().AppendLiteral(" (truncated)");
 257         }
 258         counter.URI().ReplaceChar('/', '\\');
 259       }
 260
 261       summaryTotal += counter;
 262
 263       if (counter.IsNotable() || StaticPrefs::image_mem_debug_reporting()) {
 264         ReportImage(aHandleReport, aData, aPathPrefix, counter,
 265                     aSharedSurfaces);
 266       } else {
 267         ImageMemoryReporter::TrimSharedSurfaces(counter, aSharedSurfaces);
 268         nonNotableTotal += counter;
 269       }
 270     }
 271
 272     // Report non-notable images in aggregate.
 273     ReportTotal(aHandleReport, aData, /* aExplicit = */ true, aPathPrefix,
 274                 "<non-notable images>/", nonNotableTotal);
 275
 276     // Report a summary in aggregate, outside of the explicit tree.
 277     ReportTotal(aHandleReport, aData, /* aExplicit = */ false, aPathPrefix, "",
 278                 summaryTotal);
 279   }
 280
 281   static void ReportImage(nsIHandleReportCallback* aHandleReport,
 282                           nsISupports* aData, const char* aPathPrefix,
 283                           const ImageMemoryCounter& aCounter,
 284                           layers::SharedSurfacesMemoryReport& aSharedSurfaces) {
 285     nsAutoCString pathPrefix("explicit/"_ns);
 286     pathPrefix.Append(aPathPrefix);
 287
 288     switch (aCounter.Type()) {
 289       case imgIContainer::TYPE_RASTER:
 290         pathPrefix.AppendLiteral("/raster/");
 291         break;
 292       case imgIContainer::TYPE_VECTOR:
 293         pathPrefix.AppendLiteral("/vector/");
 294         break;
 295       case imgIContainer::TYPE_REQUEST:
 296         pathPrefix.AppendLiteral("/request/");
 297         break;
 298       default:
 299         pathPrefix.AppendLiteral("/unknown=");
 300         pathPrefix.AppendInt(aCounter.Type());
 301         pathPrefix.AppendLiteral("/");
 302         break;
 303     }
 304
 305     pathPrefix.Append(aCounter.IsUsed() ? "used/" : "unused/");
 306     if (aCounter.IsValidating()) {
 307       pathPrefix.AppendLiteral("validating/");
 308     }
 309     if (aCounter.HasError()) {
 310       pathPrefix.AppendLiteral("err/");
 311     }
 312
 313     pathPrefix.AppendLiteral("progress=");
 314     pathPrefix.AppendInt(aCounter.Progress(), 16);
 315     pathPrefix.AppendLiteral("/");
 316
 317     pathPrefix.AppendLiteral("image(");
 318     pathPrefix.AppendInt(aCounter.IntrinsicSize().width);
 319     pathPrefix.AppendLiteral("x");
 320     pathPrefix.AppendInt(aCounter.IntrinsicSize().height);
 321     pathPrefix.AppendLiteral(", ");
 322
 323     if (aCounter.URI().IsEmpty()) {
 324       pathPrefix.AppendLiteral("<unknown URI>");
 325     } else {
 326       pathPrefix.Append(aCounter.URI());
 327     }
 328
 329     pathPrefix.AppendLiteral(")/");
 330
 331     ReportSurfaces(aHandleReport, aData, pathPrefix, aCounter, aSharedSurfaces);
 332
 333     ReportSourceValue(aHandleReport, aData, pathPrefix, aCounter.Values());
 334   }
 335
 336   static void ReportSurfaces(
 337       nsIHandleReportCallback* aHandleReport, nsISupports* aData,
 338       const nsACString& aPathPrefix, const ImageMemoryCounter& aCounter,
 339       layers::SharedSurfacesMemoryReport& aSharedSurfaces) {
 340     for (const SurfaceMemoryCounter& counter : aCounter.Surfaces()) {
 341       nsAutoCString surfacePathPrefix(aPathPrefix);
 342       switch (counter.Type()) {
 343         case SurfaceMemoryCounterType::NORMAL:
 344           if (counter.IsLocked()) {
 345             surfacePathPrefix.AppendLiteral("locked/");
 346           } else {
 347             surfacePathPrefix.AppendLiteral("unlocked/");
 348           }
 349           if (counter.IsFactor2()) {
 350             surfacePathPrefix.AppendLiteral("factor2/");
 351           }
 352           if (counter.CannotSubstitute()) {
 353             surfacePathPrefix.AppendLiteral("cannot_substitute/");
 354           }
 355           break;
 356         case SurfaceMemoryCounterType::CONTAINER:
 357           surfacePathPrefix.AppendLiteral("container/");
 358           break;
 359         default:
 360           MOZ_ASSERT_UNREACHABLE("Unknown counter type");
 361           break;
 362       }
 363
 364       surfacePathPrefix.AppendLiteral("types=");
 365       surfacePathPrefix.AppendInt(counter.Values().SurfaceTypes(), 16);
 366       surfacePathPrefix.AppendLiteral("/surface(");
 367       surfacePathPrefix.AppendInt(counter.Key().Size().width);
 368       surfacePathPrefix.AppendLiteral("x");
 369       surfacePathPrefix.AppendInt(counter.Key().Size().height);
 370
 371       if (!counter.IsFinished()) {
 372         surfacePathPrefix.AppendLiteral(", incomplete");
 373       }
 374
 375       if (counter.Values().ExternalHandles() > 0) {
 376         surfacePathPrefix.AppendLiteral(", handles:");
 377         surfacePathPrefix.AppendInt(
 378             uint32_t(counter.Values().ExternalHandles()));
 379       }
 380
 381       ImageMemoryReporter::AppendSharedSurfacePrefix(surfacePathPrefix, counter,
 382                                                      aSharedSurfaces);
 383
 384       PlaybackType playback = counter.Key().Playback();
 385       if (playback == PlaybackType::eAnimated) {
 386         if (StaticPrefs::image_mem_debug_reporting()) {
 387           surfacePathPrefix.AppendPrintf(
 388               " (animation %4u)", uint32_t(counter.Values().FrameIndex()));
 389         } else {
 390           surfacePathPrefix.AppendLiteral(" (animation)");
 391         }
 392       }
 393
 394       if (counter.Key().Flags() != DefaultSurfaceFlags()) {
 395         surfacePathPrefix.AppendLiteral(", flags:");
 396         surfacePathPrefix.AppendInt(uint32_t(counter.Key().Flags()),
 397                                     /* aRadix = */ 16);
 398       }
 399
 400       if (counter.Key().SVGContext()) {
 401         const SVGImageContext& context = counter.Key().SVGContext().ref();
 402         surfacePathPrefix.AppendLiteral(", svgContext:[ ");
 403         if (context.GetViewportSize()) {
 404           const CSSIntSize& size = context.GetViewportSize().ref();
 405           surfacePathPrefix.AppendLiteral("viewport=(");
 406           surfacePathPrefix.AppendInt(size.width);
 407           surfacePathPrefix.AppendLiteral("x");
 408           surfacePathPrefix.AppendInt(size.height);
 409           surfacePathPrefix.AppendLiteral(") ");
 410         }
 411         if (context.GetPreserveAspectRatio()) {
 412           nsAutoString aspect;
 413           context.GetPreserveAspectRatio()->ToString(aspect);
 414           surfacePathPrefix.AppendLiteral("preserveAspectRatio=(");
 415           LossyAppendUTF16toASCII(aspect, surfacePathPrefix);
 416           surfacePathPrefix.AppendLiteral(") ");
 417         }
 418         if (context.GetContextPaint()) {
 419           const SVGEmbeddingContextPaint* paint = context.GetContextPaint();
 420           surfacePathPrefix.AppendLiteral("contextPaint=(");
 421           if (paint->GetFill()) {
 422             surfacePathPrefix.AppendLiteral(" fill=");
 423             surfacePathPrefix.AppendInt(paint->GetFill()->ToABGR(), 16);
 424           }
 425           if (paint->GetFillOpacity() != 1.0) {
 426             surfacePathPrefix.AppendLiteral(" fillOpa=");
 427             surfacePathPrefix.AppendFloat(paint->GetFillOpacity());
 428           }
 429           if (paint->GetStroke()) {
 430             surfacePathPrefix.AppendLiteral(" stroke=");
 431             surfacePathPrefix.AppendInt(paint->GetStroke()->ToABGR(), 16);
 432           }
 433           if (paint->GetStrokeOpacity() != 1.0) {
 434             surfacePathPrefix.AppendLiteral(" strokeOpa=");
 435             surfacePathPrefix.AppendFloat(paint->GetStrokeOpacity());
 436           }
 437           surfacePathPrefix.AppendLiteral(" ) ");
 438         }
 439         surfacePathPrefix.AppendLiteral("]");
 440       }
 441
 442       surfacePathPrefix.AppendLiteral(")/");
 443
 444       ReportValues(aHandleReport, aData, surfacePathPrefix, counter.Values());
 445     }
 446   }
 447
 448   static void ReportTotal(nsIHandleReportCallback* aHandleReport,
 449                           nsISupports* aData, bool aExplicit,
 450                           const char* aPathPrefix, const char* aPathInfix,
 451                           const MemoryTotal& aTotal) {
 452     nsAutoCString pathPrefix;
 453     if (aExplicit) {
 454       pathPrefix.AppendLiteral("explicit/");
 455     }
 456     pathPrefix.Append(aPathPrefix);
 457
 458     nsAutoCString rasterUsedPrefix(pathPrefix);
 459     rasterUsedPrefix.AppendLiteral("/raster/used/");
 460     rasterUsedPrefix.Append(aPathInfix);
 461     ReportValues(aHandleReport, aData, rasterUsedPrefix, aTotal.UsedRaster());
 462
 463     nsAutoCString rasterUnusedPrefix(pathPrefix);
 464     rasterUnusedPrefix.AppendLiteral("/raster/unused/");
 465     rasterUnusedPrefix.Append(aPathInfix);
 466     ReportValues(aHandleReport, aData, rasterUnusedPrefix,
 467                  aTotal.UnusedRaster());
 468
 469     nsAutoCString vectorUsedPrefix(pathPrefix);
 470     vectorUsedPrefix.AppendLiteral("/vector/used/");
 471     vectorUsedPrefix.Append(aPathInfix);
 472     ReportValues(aHandleReport, aData, vectorUsedPrefix, aTotal.UsedVector());
 473
 474     nsAutoCString vectorUnusedPrefix(pathPrefix);
 475     vectorUnusedPrefix.AppendLiteral("/vector/unused/");
 476     vectorUnusedPrefix.Append(aPathInfix);
 477     ReportValues(aHandleReport, aData, vectorUnusedPrefix,
 478                  aTotal.UnusedVector());
 479   }
 480
 481   static void ReportValues(nsIHandleReportCallback* aHandleReport,
 482                            nsISupports* aData, const nsACString& aPathPrefix,
 483                            const MemoryCounter& aCounter) {
 484     ReportSourceValue(aHandleReport, aData, aPathPrefix, aCounter);
 485
 486     ReportValue(aHandleReport, aData, KIND_HEAP, aPathPrefix, "decoded-heap",
 487                 "Decoded image data which is stored on the heap.",
 488                 aCounter.DecodedHeap());
 489
 490     ReportValue(aHandleReport, aData, KIND_NONHEAP, aPathPrefix,
 491                 "decoded-nonheap",
 492                 "Decoded image data which isn't stored on the heap.",
 493                 aCounter.DecodedNonHeap());
 494
 495     // We don't know for certain whether or not it is on the heap, so let's
 496     // just report it as non-heap for reporting purposes.
 497     ReportValue(aHandleReport, aData, KIND_NONHEAP, aPathPrefix,
 498                 "decoded-unknown",
 499                 "Decoded image data which is unknown to be on the heap or not.",
 500                 aCounter.DecodedUnknown());
 501   }
 502
 503   static void ReportSourceValue(nsIHandleReportCallback* aHandleReport,
 504                                 nsISupports* aData,
 505                                 const nsACString& aPathPrefix,
 506                                 const MemoryCounter& aCounter) {
 507     ReportValue(aHandleReport, aData, KIND_HEAP, aPathPrefix, "source",
 508                 "Raster image source data and vector image documents.",
 509                 aCounter.Source());
 510   }
 511
 512   static void ReportValue(nsIHandleReportCallback* aHandleReport,
 513                           nsISupports* aData, int32_t aKind,
 514                           const nsACString& aPathPrefix,
 515                           const char* aPathSuffix, const char* aDescription,
 516                           size_t aValue) {
 517     if (aValue == 0) {
 518       return;
 519     }
 520
 521     nsAutoCString desc(aDescription);
 522     nsAutoCString path(aPathPrefix);
 523     path.Append(aPathSuffix);
 524
 525     aHandleReport->Callback(""_ns, path, aKind, UNITS_BYTES, aValue, desc,
 526                             aData);
 527   }
 528
 529   static void RecordCounterForRequest(imgRequest* aRequest,
 530                                       nsTArray<ImageMemoryCounter>* aArray,
 531                                       bool aIsUsed) {
 532     SizeOfState state(ImagesMallocSizeOf);
 533     RefPtr<image::Image> image = aRequest->GetImage();
 534     if (image) {
 535       ImageMemoryCounter counter(aRequest, image, state, aIsUsed);
 536       aArray->AppendElement(std::move(counter));
 537     } else {
 538       // We can at least record some information about the image from the
 539       // request, and mark it as not knowing the image type yet.
 540       ImageMemoryCounter counter(aRequest, state, aIsUsed);
 541       aArray->AppendElement(std::move(counter));
 542     }
 543   }
 544 };
 545
 546 NS_IMPL_ISUPPORTS(imgMemoryReporter, nsIMemoryReporter)
 547
 548 NS_IMPL_ISUPPORTS(nsProgressNotificationProxy, nsIProgressEventSink,
 549                   nsIChannelEventSink, nsIInterfaceRequestor)
 550
 551 NS_IMETHODIMP
 552 nsProgressNotificationProxy::OnProgress(nsIRequest* request, int64_t progress,
 553                                         int64_t progressMax) {
 554   nsCOMPtr<nsILoadGroup> loadGroup;
 555   request->GetLoadGroup(getter_AddRefs(loadGroup));
 556
 557   nsCOMPtr<nsIProgressEventSink> target;
 558   NS_QueryNotificationCallbacks(mOriginalCallbacks, loadGroup,
 559                                 NS_GET_IID(nsIProgressEventSink),
 560                                 getter_AddRefs(target));
 561   if (!target) {
 562     return NS_OK;
 563   }
 564   return target->OnProgress(mImageRequest, progress, progressMax);
 565 }
 566
 567 NS_IMETHODIMP
 568 nsProgressNotificationProxy::OnStatus(nsIRequest* request, nsresult status,
 569                                       const char16_t* statusArg) {
 570   nsCOMPtr<nsILoadGroup> loadGroup;
 571   request->GetLoadGroup(getter_AddRefs(loadGroup));
 572
 573   nsCOMPtr<nsIProgressEventSink> target;
 574   NS_QueryNotificationCallbacks(mOriginalCallbacks, loadGroup,
 575                                 NS_GET_IID(nsIProgressEventSink),
 576                                 getter_AddRefs(target));
 577   if (!target) {
 578     return NS_OK;
 579   }
 580   return target->OnStatus(mImageRequest, status, statusArg);
 581 }
 582
 583 NS_IMETHODIMP
 584 nsProgressNotificationProxy::AsyncOnChannelRedirect(
 585     nsIChannel* oldChannel, nsIChannel* newChannel, uint32_t flags,
 586     nsIAsyncVerifyRedirectCallback* cb) {
 587   // Tell the original original callbacks about it too
 588   nsCOMPtr<nsILoadGroup> loadGroup;
 589   newChannel->GetLoadGroup(getter_AddRefs(loadGroup));
 590   nsCOMPtr<nsIChannelEventSink> target;
 591   NS_QueryNotificationCallbacks(mOriginalCallbacks, loadGroup,
 592                                 NS_GET_IID(nsIChannelEventSink),
 593                                 getter_AddRefs(target));
 594   if (!target) {
 595     cb->OnRedirectVerifyCallback(NS_OK);
 596     return NS_OK;
 597   }
 598
 599   // Delegate to |target| if set, reusing |cb|
 600   return target->AsyncOnChannelRedirect(oldChannel, newChannel, flags, cb);
 601 }
 602
 603 NS_IMETHODIMP
 604 nsProgressNotificationProxy::GetInterface(const nsIID& iid, void** result) {
 605   if (iid.Equals(NS_GET_IID(nsIProgressEventSink))) {
 606     *result = static_cast<nsIProgressEventSink*>(this);
 607     NS_ADDREF_THIS();
 608     return NS_OK;
 609   }
 610   if (iid.Equals(NS_GET_IID(nsIChannelEventSink))) {
 611     *result = static_cast<nsIChannelEventSink*>(this);
 612     NS_ADDREF_THIS();
 613     return NS_OK;
 614   }
 615   if (mOriginalCallbacks) {
 616     return mOriginalCallbacks->GetInterface(iid, result);
 617   }
 618   return NS_NOINTERFACE;
 619 }
 620
 621 static void NewRequestAndEntry(bool aForcePrincipalCheckForCacheEntry,
 622                                imgLoader* aLoader, const ImageCacheKey& aKey,
 623                                imgRequest** aRequest, imgCacheEntry** aEntry) {
 624   RefPtr<imgRequest> request = new imgRequest(aLoader, aKey);
 625   RefPtr<imgCacheEntry> entry =
 626       new imgCacheEntry(aLoader, request, aForcePrincipalCheckForCacheEntry);
 627   aLoader->AddToUncachedImages(request);
 628   request.forget(aRequest);
 629   entry.forget(aEntry);
 630 }
 631
 632 static bool ShouldRevalidateEntry(imgCacheEntry* aEntry, nsLoadFlags aFlags,
 633                                   bool aHasExpired) {
 634   bool bValidateEntry = false;
 635
 636   if (aFlags & nsIRequest::LOAD_BYPASS_CACHE) {
 637     return false;
 638   }
 639
 640   if (aFlags & nsIRequest::VALIDATE_ALWAYS) {
 641     bValidateEntry = true;
 642   } else if (aEntry->GetMustValidate()) {
 643     bValidateEntry = true;
 644   } else if (aHasExpired) {
 645     // The cache entry has expired...  Determine whether the stale cache
 646     // entry can be used without validation...
 647     if (aFlags &
 648         (nsIRequest::VALIDATE_NEVER | nsIRequest::VALIDATE_ONCE_PER_SESSION)) {
 649       // VALIDATE_NEVER and VALIDATE_ONCE_PER_SESSION allow stale cache
 650       // entries to be used unless they have been explicitly marked to
 651       // indicate that revalidation is necessary.
 652       bValidateEntry = false;
 653
 654     } else if (!(aFlags & nsIRequest::LOAD_FROM_CACHE)) {
 655       // LOAD_FROM_CACHE allows a stale cache entry to be used... Otherwise,
 656       // the entry must be revalidated.
 657       bValidateEntry = true;
 658     }
 659   }
 660
 661   return bValidateEntry;
 662 }
 663
 664 /* Call content policies on cached images that went through a redirect */
 665 static bool ShouldLoadCachedImage(imgRequest* aImgRequest,
 666                                   Document* aLoadingDocument,
 667                                   nsIPrincipal* aTriggeringPrincipal,
 668                                   nsContentPolicyType aPolicyType,
 669                                   bool aSendCSPViolationReports) {
 670   /* Call content policies on cached images - Bug 1082837
 671    * Cached images are keyed off of the first uri in a redirect chain.
 672    * Hence content policies don't get a chance to test the intermediate hops
 673    * or the final destination.  Here we test the final destination using
 674    * mFinalURI off of the imgRequest and passing it into content policies.
 675    * For Mixed Content Blocker, we do an additional check to determine if any
 676    * of the intermediary hops went through an insecure redirect with the
 677    * mHadInsecureRedirect flag
 678    */
 679   bool insecureRedirect = aImgRequest->HadInsecureRedirect();
 680   nsCOMPtr<nsIURI> contentLocation;
 681   aImgRequest->GetFinalURI(getter_AddRefs(contentLocation));
 682   nsresult rv;
 683
 684   nsCOMPtr<nsIPrincipal> loadingPrincipal =
 685       aLoadingDocument ? aLoadingDocument->NodePrincipal()
 686                        : aTriggeringPrincipal;
 687   // If there is no context and also no triggeringPrincipal, then we use a fresh
 688   // nullPrincipal as the loadingPrincipal because we can not create a loadinfo
 689   // without a valid loadingPrincipal.
 690   if (!loadingPrincipal) {
 691     loadingPrincipal = NullPrincipal::CreateWithoutOriginAttributes();
 692   }
 693
 694   nsCOMPtr<nsILoadInfo> secCheckLoadInfo = new LoadInfo(
 695       loadingPrincipal, aTriggeringPrincipal, aLoadingDocument,
 696       nsILoadInfo::SEC_ONLY_FOR_EXPLICIT_CONTENTSEC_CHECK, aPolicyType);
 697
 698   secCheckLoadInfo->SetSendCSPViolationEvents(aSendCSPViolationReports);
 699
 700   int16_t decision = nsIContentPolicy::REJECT_REQUEST;
 701   rv = NS_CheckContentLoadPolicy(contentLocation, secCheckLoadInfo,
 702                                  ""_ns,  // mime guess
 703                                  &decision, nsContentUtils::GetContentPolicy());
 704   if (NS_FAILED(rv) || !NS_CP_ACCEPTED(decision)) {
 705     return false;
 706   }
 707
 708   // We call all Content Policies above, but we also have to call mcb
 709   // individually to check the intermediary redirect hops are secure.
 710   if (insecureRedirect) {
 711     // Bug 1314356: If the image ended up in the cache upgraded by HSTS and the
 712     // page uses upgrade-inscure-requests it had an insecure redirect
 713     // (http->https). We need to invalidate the image and reload it because
 714     // mixed content blocker only bails if upgrade-insecure-requests is set on
 715     // the doc and the resource load is http: which would result in an incorrect
 716     // mixed content warning.
 717     nsCOMPtr<nsIDocShell> docShell =
 718         NS_CP_GetDocShellFromContext(ToSupports(aLoadingDocument));
 719     if (docShell) {
 720       Document* document = docShell->GetDocument();
 721       if (document && document->GetUpgradeInsecureRequests(false)) {
 722         return false;
 723       }
 724     }
 725
 726     if (!aTriggeringPrincipal || !aTriggeringPrincipal->IsSystemPrincipal()) {
 727       // reset the decision for mixed content blocker check
 728       decision = nsIContentPolicy::REJECT_REQUEST;
 729       rv = nsMixedContentBlocker::ShouldLoad(insecureRedirect, contentLocation,
 730                                              secCheckLoadInfo,
 731                                              ""_ns,  // mime guess
 732                                              true,   // aReportError
 733                                              &decision);
 734       if (NS_FAILED(rv) || !NS_CP_ACCEPTED(decision)) {
 735         return false;
 736       }
 737     }
 738   }
 739
 740   return true;
 741 }
 742
 743 // Returns true if this request is compatible with the given CORS mode on the
 744 // given loading principal, and false if the request may not be reused due
 745 // to CORS.
 746 static bool ValidateCORSMode(imgRequest* aRequest, bool aForcePrincipalCheck,
 747                              CORSMode aCORSMode,
 748                              nsIPrincipal* aTriggeringPrincipal) {
 749   // If the entry's CORS mode doesn't match, or the CORS mode matches but the
 750   // document principal isn't the same, we can't use this request.
 751   if (aRequest->GetCORSMode() != aCORSMode) {
 752     return false;
 753   }
 754
 755   if (aRequest->GetCORSMode() != CORS_NONE || aForcePrincipalCheck) {
 756     nsCOMPtr<nsIPrincipal> otherprincipal = aRequest->GetTriggeringPrincipal();
 757
 758     // If we previously had a principal, but we don't now, we can't use this
 759     // request.
 760     if (otherprincipal && !aTriggeringPrincipal) {
 761       return false;
 762     }
 763
 764     if (otherprincipal && aTriggeringPrincipal &&
 765         !otherprincipal->Equals(aTriggeringPrincipal)) {
 766       return false;
 767     }
 768   }
 769
 770   return true;
 771 }
 772
 773 static bool ValidateSecurityInfo(imgRequest* aRequest,
 774                                  bool aForcePrincipalCheck, CORSMode aCORSMode,
 775                                  nsIPrincipal* aTriggeringPrincipal,
 776                                  Document* aLoadingDocument,
 777                                  nsContentPolicyType aPolicyType) {
 778   if (!ValidateCORSMode(aRequest, aForcePrincipalCheck, aCORSMode,
 779                         aTriggeringPrincipal)) {
 780     return false;
 781   }
 782   // Content Policy Check on Cached Images
 783   return ShouldLoadCachedImage(aRequest, aLoadingDocument, aTriggeringPrincipal,
 784                                aPolicyType,
 785                                /* aSendCSPViolationReports */ false);
 786 }
 787
 788 static nsresult NewImageChannel(
 789     nsIChannel** aResult,
 790     // If aForcePrincipalCheckForCacheEntry is true, then we will
 791     // force a principal check even when not using CORS before
 792     // assuming we have a cache hit on a cache entry that we
 793     // create for this channel.  This is an out param that should
 794     // be set to true if this channel ends up depending on
 795     // aTriggeringPrincipal and false otherwise.
 796     bool* aForcePrincipalCheckForCacheEntry, nsIURI* aURI,
 797     nsIURI* aInitialDocumentURI, CORSMode aCORSMode,
 798     nsIReferrerInfo* aReferrerInfo, nsILoadGroup* aLoadGroup,
 799     nsLoadFlags aLoadFlags, nsContentPolicyType aPolicyType,
 800     nsIPrincipal* aTriggeringPrincipal, nsINode* aRequestingNode,
 801     bool aRespectPrivacy) {
 802   MOZ_ASSERT(aResult);
 803
 804   nsresult rv;
 805   nsCOMPtr<nsIHttpChannel> newHttpChannel;
 806
 807   nsCOMPtr<nsIInterfaceRequestor> callbacks;
 808
 809   if (aLoadGroup) {
 810     // Get the notification callbacks from the load group for the new channel.
 811     //
 812     // XXX: This is not exactly correct, because the network request could be
 813     //      referenced by multiple windows...  However, the new channel needs
 814     //      something.  So, using the 'first' notification callbacks is better
 815     //      than nothing...
 816     //
 817     aLoadGroup->GetNotificationCallbacks(getter_AddRefs(callbacks));
 818   }
 819
 820   // Pass in a nullptr loadgroup because this is the underlying network
 821   // request. This request may be referenced by several proxy image requests
 822   // (possibly in different documents).
 823   // If all of the proxy requests are canceled then this request should be
 824   // canceled too.
 825   //
 826
 827   nsSecurityFlags securityFlags =
 828       aCORSMode == CORS_NONE
 829           ? nsILoadInfo::SEC_ALLOW_CROSS_ORIGIN_INHERITS_SEC_CONTEXT
 830           : nsILoadInfo::SEC_REQUIRE_CORS_INHERITS_SEC_CONTEXT;
 831   if (aCORSMode == CORS_ANONYMOUS) {
 832     securityFlags |= nsILoadInfo::SEC_COOKIES_SAME_ORIGIN;
 833   } else if (aCORSMode == CORS_USE_CREDENTIALS) {
 834     securityFlags |= nsILoadInfo::SEC_COOKIES_INCLUDE;
 835   }
 836   securityFlags |= nsILoadInfo::SEC_ALLOW_CHROME;
 837
 838   // Note we are calling NS_NewChannelWithTriggeringPrincipal() here with a
 839   // node and a principal. This is for things like background images that are
 840   // specified by user stylesheets, where the document is being styled, but
 841   // the principal is that of the user stylesheet.
 842   if (aRequestingNode && aTriggeringPrincipal) {
 843     rv = NS_NewChannelWithTriggeringPrincipal(aResult, aURI, aRequestingNode,
 844                                               aTriggeringPrincipal,
 845                                               securityFlags, aPolicyType,
 846                                               nullptr,  // PerformanceStorage
 847                                               nullptr,  // loadGroup
 848                                               callbacks, aLoadFlags);
 849
 850     if (NS_FAILED(rv)) {
 851       return rv;
 852     }
 853
 854     if (aPolicyType == nsIContentPolicy::TYPE_INTERNAL_IMAGE_FAVICON) {
 855       // If this is a favicon loading, we will use the originAttributes from the
 856       // triggeringPrincipal as the channel's originAttributes. This allows the
 857       // favicon loading from XUL will use the correct originAttributes.
 858
 859       nsCOMPtr<nsILoadInfo> loadInfo = (*aResult)->LoadInfo();
 860       rv = loadInfo->SetOriginAttributes(
 861           aTriggeringPrincipal->OriginAttributesRef());
 862     }
 863   } else {
 864     // either we are loading something inside a document, in which case
 865     // we should always have a requestingNode, or we are loading something
 866     // outside a document, in which case the triggeringPrincipal and
 867     // triggeringPrincipal should always be the systemPrincipal.
 868     // However, there are exceptions: one is Notifications which create a
 869     // channel in the parent process in which case we can't get a
 870     // requestingNode.
 871     rv = NS_NewChannel(aResult, aURI, nsContentUtils::GetSystemPrincipal(),
 872                        securityFlags, aPolicyType,
 873                        nullptr,  // nsICookieJarSettings
 874                        nullptr,  // PerformanceStorage
 875                        nullptr,  // loadGroup
 876                        callbacks, aLoadFlags);
 877
 878     if (NS_FAILED(rv)) {
 879       return rv;
 880     }
 881
 882     // Use the OriginAttributes from the loading principal, if one is available,
 883     // and adjust the private browsing ID based on what kind of load the caller
 884     // has asked us to perform.
 885     OriginAttributes attrs;
 886     if (aTriggeringPrincipal) {
 887       attrs = aTriggeringPrincipal->OriginAttributesRef();
 888     }
 889     attrs.mPrivateBrowsingId = aRespectPrivacy ? 1 : 0;
 890
 891     nsCOMPtr<nsILoadInfo> loadInfo = (*aResult)->LoadInfo();
 892     rv = loadInfo->SetOriginAttributes(attrs);
 893   }
 894
 895   if (NS_FAILED(rv)) {
 896     return rv;
 897   }
 898
 899   // only inherit if we have a principal
 900   *aForcePrincipalCheckForCacheEntry =
 901       aTriggeringPrincipal && nsContentUtils::ChannelShouldInheritPrincipal(
 902                                   aTriggeringPrincipal, aURI,
 903                                   /* aInheritForAboutBlank */ false,
 904                                   /* aForceInherit */ false);
 905
 906   // Initialize HTTP-specific attributes
 907   newHttpChannel = do_QueryInterface(*aResult);
 908   if (newHttpChannel) {
 909     nsCOMPtr<nsIHttpChannelInternal> httpChannelInternal =
 910         do_QueryInterface(newHttpChannel);
 911     NS_ENSURE_TRUE(httpChannelInternal, NS_ERROR_UNEXPECTED);
 912     rv = httpChannelInternal->SetDocumentURI(aInitialDocumentURI);
 913     MOZ_ASSERT(NS_SUCCEEDED(rv));
 914     if (aReferrerInfo) {
 915       DebugOnly<nsresult> rv = newHttpChannel->SetReferrerInfo(aReferrerInfo);
 916       MOZ_ASSERT(NS_SUCCEEDED(rv));
 917     }
 918   }
 919
 920   // Image channels are loaded by default with reduced priority.
 921   nsCOMPtr<nsISupportsPriority> p = do_QueryInterface(*aResult);
 922   if (p) {
 923     uint32_t priority = nsISupportsPriority::PRIORITY_LOW;
 924
 925     if (aLoadFlags & nsIRequest::LOAD_BACKGROUND) {
 926       ++priority;  // further reduce priority for background loads
 927     }
 928
 929     p->AdjustPriority(priority);
 930   }
 931
 932   // Create a new loadgroup for this new channel, using the old group as
 933   // the parent. The indirection keeps the channel insulated from cancels,
 934   // but does allow a way for this revalidation to be associated with at
 935   // least one base load group for scheduling/caching purposes.
 936
 937   nsCOMPtr<nsILoadGroup> loadGroup = do_CreateInstance(NS_LOADGROUP_CONTRACTID);
 938   nsCOMPtr<nsILoadGroupChild> childLoadGroup = do_QueryInterface(loadGroup);
 939   if (childLoadGroup) {
 940     childLoadGroup->SetParentLoadGroup(aLoadGroup);
 941   }
 942   (*aResult)->SetLoadGroup(loadGroup);
 943
 944   return NS_OK;
 945 }
 946
 947 static uint32_t SecondsFromPRTime(PRTime aTime) {
 948   return nsContentUtils::SecondsFromPRTime(aTime);
 949 }
 950
 951 /* static */
 952 imgCacheEntry::imgCacheEntry(imgLoader* loader, imgRequest* request,
 953                              bool forcePrincipalCheck)
 954     : mLoader(loader),
 955       mRequest(request),
 956       mDataSize(0),
 957       mTouchedTime(SecondsFromPRTime(PR_Now())),
 958       mLoadTime(SecondsFromPRTime(PR_Now())),
 959       mExpiryTime(0),
 960       mMustValidate(false),
 961       // We start off as evicted so we don't try to update the cache.
 962       // PutIntoCache will set this to false.
 963       mEvicted(true),
 964       mHasNoProxies(true),
 965       mForcePrincipalCheck(forcePrincipalCheck) {}
 966
 967 imgCacheEntry::~imgCacheEntry() {
 968   LOG_FUNC(gImgLog, "imgCacheEntry::~imgCacheEntry()");
 969 }
 970
 971 void imgCacheEntry::Touch(bool updateTime /* = true */) {
 972   LOG_SCOPE(gImgLog, "imgCacheEntry::Touch");
 973
 974   if (updateTime) {
 975     mTouchedTime = SecondsFromPRTime(PR_Now());
 976   }
 977
 978   UpdateCache();
 979 }
 980
 981 void imgCacheEntry::UpdateCache(int32_t diff /* = 0 */) {
 982   // Don't update the cache if we've been removed from it or it doesn't care
 983   // about our size or usage.
 984   if (!Evicted() && HasNoProxies()) {
 985     mLoader->CacheEntriesChanged(mRequest->IsChrome(), diff);
 986   }
 987 }
 988
 989 void imgCacheEntry::UpdateLoadTime() {
 990   mLoadTime = SecondsFromPRTime(PR_Now());
 991 }
 992
 993 void imgCacheEntry::SetHasNoProxies(bool hasNoProxies) {
 994   if (MOZ_LOG_TEST(gImgLog, LogLevel::Debug)) {
 995     if (hasNoProxies) {
 996       LOG_FUNC_WITH_PARAM(gImgLog, "imgCacheEntry::SetHasNoProxies true", "uri",
 997                           mRequest->CacheKey().URI());
 998     } else {
 999       LOG_FUNC_WITH_PARAM(gImgLog, "imgCacheEntry::SetHasNoProxies false",
1000                           "uri", mRequest->CacheKey().URI());
1001     }
1002   }
1003
1004   mHasNoProxies = hasNoProxies;
1005 }
1006
1007 imgCacheQueue::imgCacheQueue() : mDirty(false), mSize(0) {}
1008
1009 void imgCacheQueue::UpdateSize(int32_t diff) { mSize += diff; }
1010
1011 uint32_t imgCacheQueue::GetSize() const { return mSize; }
1012
1013 void imgCacheQueue::Remove(imgCacheEntry* entry) {
1014   uint64_t index = mQueue.IndexOf(entry);
1015   if (index == queueContainer::NoIndex) {
1016     return;
1017   }
1018
1019   mSize -= mQueue[index]->GetDataSize();
1020
1021   // If the queue is clean and this is the first entry,
1022   // then we can efficiently remove the entry without
1023   // dirtying the sort order.
1024   if (!IsDirty() && index == 0) {
1025     std::pop_heap(mQueue.begin(), mQueue.end(), imgLoader::CompareCacheEntries);
1026     mQueue.RemoveLastElement();
1027     return;
1028   }
1029
1030   // Remove from the middle of the list.  This potentially
1031   // breaks the binary heap sort order.
1032   mQueue.RemoveElementAt(index);
1033
1034   // If we only have one entry or the queue is empty, though,
1035   // then the sort order is still effectively good.  Simply
1036   // refresh the list to clear the dirty flag.
1037   if (mQueue.Length() <= 1) {
1038     Refresh();
1039     return;
1040   }
1041
1042   // Otherwise we must mark the queue dirty and potentially
1043   // trigger an expensive sort later.
1044   MarkDirty();
1045 }
1046
1047 void imgCacheQueue::Push(imgCacheEntry* entry) {
1048   mSize += entry->GetDataSize();
1049
1050   RefPtr<imgCacheEntry> refptr(entry);
1051   mQueue.AppendElement(std::move(refptr));
1052   // If we're not dirty already, then we can efficiently add this to the
1053   // binary heap immediately.  This is only O(log n).
1054   if (!IsDirty()) {
1055     std::push_heap(mQueue.begin(), mQueue.end(),
1056                    imgLoader::CompareCacheEntries);
1057   }
1058 }
1059
1060 already_AddRefed<imgCacheEntry> imgCacheQueue::Pop() {
1061   if (mQueue.IsEmpty()) {
1062     return nullptr;
1063   }
1064   if (IsDirty()) {
1065     Refresh();
1066   }
1067
1068   std::pop_heap(mQueue.begin(), mQueue.end(), imgLoader::CompareCacheEntries);
1069   RefPtr<imgCacheEntry> entry = mQueue.PopLastElement();
1070
1071   mSize -= entry->GetDataSize();
1072   return entry.forget();
1073 }
1074
1075 void imgCacheQueue::Refresh() {
1076   // Resort the list.  This is an O(3 * n) operation and best avoided
1077   // if possible.
1078   std::make_heap(mQueue.begin(), mQueue.end(), imgLoader::CompareCacheEntries);
1079   mDirty = false;
1080 }
1081
1082 void imgCacheQueue::MarkDirty() { mDirty = true; }
1083
1084 bool imgCacheQueue::IsDirty() { return mDirty; }
1085
1086 uint32_t imgCacheQueue::GetNumElements() const { return mQueue.Length(); }
1087
1088 bool imgCacheQueue::Contains(imgCacheEntry* aEntry) const {
1089   return mQueue.Contains(aEntry);
1090 }
1091
1092 imgCacheQueue::iterator imgCacheQueue::begin() { return mQueue.begin(); }
1093
1094 imgCacheQueue::const_iterator imgCacheQueue::begin() const {
1095   return mQueue.begin();
1096 }
1097
1098 imgCacheQueue::iterator imgCacheQueue::end() { return mQueue.end(); }
1099
1100 imgCacheQueue::const_iterator imgCacheQueue::end() const {
1101   return mQueue.end();
1102 }
1103
1104 nsresult imgLoader::CreateNewProxyForRequest(
1105     imgRequest* aRequest, nsIURI* aURI, nsILoadGroup* aLoadGroup,
1106     Document* aLoadingDocument, imgINotificationObserver* aObserver,
1107     nsLoadFlags aLoadFlags, imgRequestProxy** _retval) {
1108   LOG_SCOPE_WITH_PARAM(gImgLog, "imgLoader::CreateNewProxyForRequest",
1109                        "imgRequest", aRequest);
1110
1111   /* XXX If we move decoding onto separate threads, we should save off the
1112      calling thread here and pass it off to |proxyRequest| so that it call
1113      proxy calls to |aObserver|.
1114    */
1115
1116   RefPtr<imgRequestProxy> proxyRequest = new imgRequestProxy();
1117
1118   /* It is important to call |SetLoadFlags()| before calling |Init()| because
1119      |Init()| adds the request to the loadgroup.
1120    */
1121   proxyRequest->SetLoadFlags(aLoadFlags);
1122
1123   // init adds itself to imgRequest's list of observers
1124   nsresult rv = proxyRequest->Init(aRequest, aLoadGroup, aLoadingDocument, aURI,
1125                                    aObserver);
1126   if (NS_WARN_IF(NS_FAILED(rv))) {
1127     return rv;
1128   }
1129
1130   proxyRequest.forget(_retval);
1131   return NS_OK;
1132 }
1133
1134 class imgCacheExpirationTracker final
1135     : public nsExpirationTracker<imgCacheEntry, 3> {
1136   enum { TIMEOUT_SECONDS = 10 };
1137
1138  public:
1139   imgCacheExpirationTracker();
1140
1141  protected:
1142   void NotifyExpired(imgCacheEntry* entry) override;
1143 };
1144
1145 imgCacheExpirationTracker::imgCacheExpirationTracker()
1146     : nsExpirationTracker<imgCacheEntry, 3>(TIMEOUT_SECONDS * 1000,
1147                                             "imgCacheExpirationTracker") {}
1148
1149 void imgCacheExpirationTracker::NotifyExpired(imgCacheEntry* entry) {
1150   // Hold on to a reference to this entry, because the expiration tracker
1151   // mechanism doesn't.
1152   RefPtr<imgCacheEntry> kungFuDeathGrip(entry);
1153
1154   if (MOZ_LOG_TEST(gImgLog, LogLevel::Debug)) {
1155     RefPtr<imgRequest> req = entry->GetRequest();
1156     if (req) {
1157       LOG_FUNC_WITH_PARAM(gImgLog, "imgCacheExpirationTracker::NotifyExpired",
1158                           "entry", req->CacheKey().URI());
1159     }
1160   }
1161
1162   // We can be called multiple times on the same entry. Don't do work multiple
1163   // times.
1164   if (!entry->Evicted()) {
1165     entry->Loader()->RemoveFromCache(entry);
1166   }
1167
1168   entry->Loader()->VerifyCacheSizes();
1169 }
1170
1171 ///////////////////////////////////////////////////////////////////////////////
1172 // imgLoader
1173 ///////////////////////////////////////////////////////////////////////////////
1174
1175 double imgLoader::sCacheTimeWeight;
1176 uint32_t imgLoader::sCacheMaxSize;
1177 imgMemoryReporter* imgLoader::sMemReporter;
1178
1179 NS_IMPL_ISUPPORTS(imgLoader, imgILoader, nsIContentSniffer, imgICache,
1180                   nsISupportsWeakReference, nsIObserver)
1181
1182 static imgLoader* gNormalLoader = nullptr;
1183 static imgLoader* gPrivateBrowsingLoader = nullptr;
1184
1185 /* static */
1186 already_AddRefed<imgLoader> imgLoader::CreateImageLoader() {
1187   // In some cases, such as xpctests, XPCOM modules are not automatically
1188   // initialized.  We need to make sure that our module is initialized before
1189   // we hand out imgLoader instances and code starts using them.
1190   mozilla::image::EnsureModuleInitialized();
1191
1192   RefPtr<imgLoader> loader = new imgLoader();
1193   loader->Init();
1194
1195   return loader.forget();
1196 }
1197
1198 imgLoader* imgLoader::NormalLoader() {
1199   if (!gNormalLoader) {
1200     gNormalLoader = CreateImageLoader().take();
1201   }
1202   return gNormalLoader;
1203 }
1204
1205 imgLoader* imgLoader::PrivateBrowsingLoader() {
1206   if (!gPrivateBrowsingLoader) {
1207     gPrivateBrowsingLoader = CreateImageLoader().take();
1208     gPrivateBrowsingLoader->RespectPrivacyNotifications();
1209   }
1210   return gPrivateBrowsingLoader;
1211 }
1212
1213 imgLoader::imgLoader()
1214     : mUncachedImagesMutex("imgLoader::UncachedImages"),
1215       mRespectPrivacy(false) {
1216   sMemReporter->AddRef();
1217   sMemReporter->RegisterLoader(this);
1218 }
1219
1220 imgLoader::~imgLoader() {
1221   ClearChromeImageCache();
1222   ClearImageCache();
1223   {
1224     // If there are any of our imgRequest's left they are in the uncached
1225     // images set, so clear their pointer to us.
1226     MutexAutoLock lock(mUncachedImagesMutex);
1227     for (RefPtr<imgRequest> req : mUncachedImages) {
1228       req->ClearLoader();
1229     }
1230   }
1231   sMemReporter->UnregisterLoader(this);
1232   sMemReporter->Release();
1233 }
1234
1235 void imgLoader::VerifyCacheSizes() {
1236 #ifdef DEBUG
1237   if (!mCacheTracker) {
1238     return;
1239   }
1240
1241   uint32_t cachesize = mCache.Count() + mChromeCache.Count();
1242   uint32_t queuesize =
1243       mCacheQueue.GetNumElements() + mChromeCacheQueue.GetNumElements();
1244   uint32_t trackersize = 0;
1245   for (nsExpirationTracker<imgCacheEntry, 3>::Iterator it(mCacheTracker.get());
1246        it.Next();) {
1247     trackersize++;
1248   }
1249   MOZ_ASSERT(queuesize == trackersize, "Queue and tracker sizes out of sync!");
1250   MOZ_ASSERT(queuesize <= cachesize, "Queue has more elements than cache!");
1251 #endif
1252 }
1253
1254 imgLoader::imgCacheTable& imgLoader::GetCache(bool aForChrome) {
1255   return aForChrome ? mChromeCache : mCache;
1256 }
1257
1258 imgLoader::imgCacheTable& imgLoader::GetCache(const ImageCacheKey& aKey) {
1259   return GetCache(aKey.IsChrome());
1260 }
1261
1262 imgCacheQueue& imgLoader::GetCacheQueue(bool aForChrome) {
1263   return aForChrome ? mChromeCacheQueue : mCacheQueue;
1264 }
1265
1266 imgCacheQueue& imgLoader::GetCacheQueue(const ImageCacheKey& aKey) {
1267   return GetCacheQueue(aKey.IsChrome());
1268 }
1269
1270 void imgLoader::GlobalInit() {
1271   sCacheTimeWeight = StaticPrefs::image_cache_timeweight_AtStartup() / 1000.0;
1272   int32_t cachesize = StaticPrefs::image_cache_size_AtStartup();
1273   sCacheMaxSize = cachesize > 0 ? cachesize : 0;
1274
1275   sMemReporter = new imgMemoryReporter();
1276   RegisterStrongAsyncMemoryReporter(sMemReporter);
1277   RegisterImagesContentUsedUncompressedDistinguishedAmount(
1278       imgMemoryReporter::ImagesContentUsedUncompressedDistinguishedAmount);
1279 }
1280
1281 void imgLoader::ShutdownMemoryReporter() {
1282   UnregisterImagesContentUsedUncompressedDistinguishedAmount();
1283   UnregisterStrongMemoryReporter(sMemReporter);
1284 }
1285
1286 nsresult imgLoader::InitCache() {
1287   nsCOMPtr<nsIObserverService> os = mozilla::services::GetObserverService();
1288   if (!os) {
1289     return NS_ERROR_FAILURE;
1290   }
1291
1292   os->AddObserver(this, "memory-pressure", false);
1293   os->AddObserver(this, "chrome-flush-caches", false);
1294   os->AddObserver(this, "last-pb-context-exited", false);
1295   os->AddObserver(this, "profile-before-change", false);
1296   os->AddObserver(this, "xpcom-shutdown", false);
1297
1298   mCacheTracker = MakeUnique<imgCacheExpirationTracker>();
1299
1300   return NS_OK;
1301 }
1302
1303 nsresult imgLoader::Init() {
1304   InitCache();
1305
1306   return NS_OK;
1307 }
1308
1309 NS_IMETHODIMP
1310 imgLoader::RespectPrivacyNotifications() {
1311   mRespectPrivacy = true;
1312   return NS_OK;
1313 }
1314
1315 NS_IMETHODIMP
1316 imgLoader::Observe(nsISupports* aSubject, const char* aTopic,
1317                    const char16_t* aData) {
1318   if (strcmp(aTopic, "memory-pressure") == 0) {
1319     MinimizeCaches();
1320   } else if (strcmp(aTopic, "chrome-flush-caches") == 0) {
1321     MinimizeCaches();
1322     ClearChromeImageCache();
1323   } else if (strcmp(aTopic, "last-pb-context-exited") == 0) {
1324     if (mRespectPrivacy) {
1325       ClearImageCache();
1326       ClearChromeImageCache();
1327     }
1328   } else if (strcmp(aTopic, "profile-before-change") == 0) {
1329     mCacheTracker = nullptr;
1330   } else if (strcmp(aTopic, "xpcom-shutdown") == 0) {
1331     mCacheTracker = nullptr;
1332     ShutdownMemoryReporter();
1333
1334   } else {
1335     // (Nothing else should bring us here)
1336     MOZ_ASSERT(0, "Invalid topic received");
1337   }
1338
1339   return NS_OK;
1340 }
1341
1342 NS_IMETHODIMP
1343 imgLoader::ClearCache(bool chrome) {
1344   if (XRE_IsParentProcess()) {
1345     bool privateLoader = this == gPrivateBrowsingLoader;
1346     for (auto* cp : ContentParent::AllProcesses(ContentParent::eLive)) {
1347       Unused << cp->SendClearImageCache(privateLoader, chrome);
1348     }
1349   }
1350
1351   if (chrome) {
1352     return ClearChromeImageCache();
1353   }
1354   return ClearImageCache();
1355 }
1356
1357 NS_IMETHODIMP
1358 imgLoader::RemoveEntriesFromPrincipal(nsIPrincipal* aPrincipal) {
1359   nsAutoString origin;
1360   nsresult rv = nsContentUtils::GetUTFOrigin(aPrincipal, origin);
1361   if (NS_WARN_IF(NS_FAILED(rv))) {
1362     return rv;
1363   }
1364
1365   AutoTArray<RefPtr<imgCacheEntry>, 128> entriesToBeRemoved;
1366
1367   imgCacheTable& cache = GetCache(aPrincipal->IsSystemPrincipal());
1368   for (const auto& entry : cache) {
1369     const auto& key = entry.GetKey();
1370
1371     if (key.OriginAttributesRef() !=
1372         BasePrincipal::Cast(aPrincipal)->OriginAttributesRef()) {
1373       continue;
1374     }
1375
1376     nsAutoString imageOrigin;
1377     nsresult rv = nsContentUtils::GetUTFOrigin(key.URI(), imageOrigin);
1378     if (NS_WARN_IF(NS_FAILED(rv))) {
1379       continue;
1380     }
1381
1382     if (imageOrigin == origin) {
1383       entriesToBeRemoved.AppendElement(entry.GetData());
1384     }
1385   }
1386
1387   for (auto& entry : entriesToBeRemoved) {
1388     if (!RemoveFromCache(entry)) {
1389       NS_WARNING(
1390           "Couldn't remove an entry from the cache in "
1391           "RemoveEntriesFromPrincipal()\n");
1392     }
1393   }
1394
1395   return NS_OK;
1396 }
1397
1398 NS_IMETHODIMP
1399 imgLoader::RemoveEntry(nsIURI* aURI, Document* aDoc) {
1400   if (aURI) {
1401     OriginAttributes attrs;
1402     if (aDoc) {
1403       nsCOMPtr<nsIPrincipal> principal = aDoc->NodePrincipal();
1404       if (principal) {
1405         attrs = principal->OriginAttributesRef();
1406       }
1407     }
1408
1409     ImageCacheKey key(aURI, attrs, aDoc);
1410     if (RemoveFromCache(key)) {
1411       return NS_OK;
1412     }
1413   }
1414   return NS_ERROR_NOT_AVAILABLE;
1415 }
1416
1417 NS_IMETHODIMP
1418 imgLoader::FindEntryProperties(nsIURI* uri, Document* aDoc,
1419                                nsIProperties** _retval) {
1420   *_retval = nullptr;
1421
1422   OriginAttributes attrs;
1423   if (aDoc) {
1424     nsCOMPtr<nsIPrincipal> principal = aDoc->NodePrincipal();
1425     if (principal) {
1426       attrs = principal->OriginAttributesRef();
1427     }
1428   }
1429
1430   ImageCacheKey key(uri, attrs, aDoc);
1431   imgCacheTable& cache = GetCache(key);
1432
1433   RefPtr<imgCacheEntry> entry;
1434   if (cache.Get(key, getter_AddRefs(entry)) && entry) {
1435     if (mCacheTracker && entry->HasNoProxies()) {
1436       mCacheTracker->MarkUsed(entry);
1437     }
1438
1439     RefPtr<imgRequest> request = entry->GetRequest();
1440     if (request) {
1441       nsCOMPtr<nsIProperties> properties = request->Properties();
1442       properties.forget(_retval);
1443     }
1444   }
1445
1446   return NS_OK;
1447 }
1448
1449 NS_IMETHODIMP_(void)
1450 imgLoader::ClearCacheForControlledDocument(Document* aDoc) {
1451   MOZ_ASSERT(aDoc);
1452   AutoTArray<RefPtr<imgCacheEntry>, 128> entriesToBeRemoved;
1453   imgCacheTable& cache = GetCache(false);
1454   for (const auto& entry : cache) {
1455     const auto& key = entry.GetKey();
1456     if (key.ControlledDocument() == aDoc) {
1457       entriesToBeRemoved.AppendElement(entry.GetData());
1458     }
1459   }
1460   for (auto& entry : entriesToBeRemoved) {
1461     if (!RemoveFromCache(entry)) {
1462       NS_WARNING(
1463           "Couldn't remove an entry from the cache in "
1464           "ClearCacheForControlledDocument()\n");
1465     }
1466   }
1467 }
1468
1469 void imgLoader::Shutdown() {
1470   NS_IF_RELEASE(gNormalLoader);
1471   gNormalLoader = nullptr;
1472   NS_IF_RELEASE(gPrivateBrowsingLoader);
1473   gPrivateBrowsingLoader = nullptr;
1474 }
1475
1476 nsresult imgLoader::ClearChromeImageCache() {
1477   return EvictEntries(mChromeCache);
1478 }
1479
1480 nsresult imgLoader::ClearImageCache() { return EvictEntries(mCache); }
1481
1482 void imgLoader::MinimizeCaches() {
1483   EvictEntries(mCacheQueue);
1484   EvictEntries(mChromeCacheQueue);
1485 }
1486
1487 bool imgLoader::PutIntoCache(const ImageCacheKey& aKey, imgCacheEntry* entry) {
1488   imgCacheTable& cache = GetCache(aKey);
1489
1490   LOG_STATIC_FUNC_WITH_PARAM(gImgLog, "imgLoader::PutIntoCache", "uri",
1491                              aKey.URI());
1492
1493   // Check to see if this request already exists in the cache. If so, we'll
1494   // replace the old version.
1495   RefPtr<imgCacheEntry> tmpCacheEntry;
1496   if (cache.Get(aKey, getter_AddRefs(tmpCacheEntry)) && tmpCacheEntry) {
1497     MOZ_LOG(
1498         gImgLog, LogLevel::Debug,
1499         ("[this=%p] imgLoader::PutIntoCache -- Element already in the cache",
1500          nullptr));
1501     RefPtr<imgRequest> tmpRequest = tmpCacheEntry->GetRequest();
1502
1503     // If it already exists, and we're putting the same key into the cache, we
1504     // should remove the old version.
1505     MOZ_LOG(gImgLog, LogLevel::Debug,
1506             ("[this=%p] imgLoader::PutIntoCache -- Replacing cached element",
1507              nullptr));
1508
1509     RemoveFromCache(aKey);
1510   } else {
1511     MOZ_LOG(gImgLog, LogLevel::Debug,
1512             ("[this=%p] imgLoader::PutIntoCache --"
1513              " Element NOT already in the cache",
1514              nullptr));
1515   }
1516
1517   cache.InsertOrUpdate(aKey, RefPtr{entry});
1518
1519   // We can be called to resurrect an evicted entry.
1520   if (entry->Evicted()) {
1521     entry->SetEvicted(false);
1522   }
1523
1524   // If we're resurrecting an entry with no proxies, put it back in the
1525   // tracker and queue.
1526   if (entry->HasNoProxies()) {
1527     nsresult addrv = NS_OK;
1528
1529     if (mCacheTracker) {
1530       addrv = mCacheTracker->AddObject(entry);
1531     }
1532
1533     if (NS_SUCCEEDED(addrv)) {
1534       imgCacheQueue& queue = GetCacheQueue(aKey);
1535       queue.Push(entry);
1536     }
1537   }
1538
1539   RefPtr<imgRequest> request = entry->GetRequest();
1540   request->SetIsInCache(true);
1541   RemoveFromUncachedImages(request);
1542
1543   return true;
1544 }
1545
1546 bool imgLoader::SetHasNoProxies(imgRequest* aRequest, imgCacheEntry* aEntry) {
1547   LOG_STATIC_FUNC_WITH_PARAM(gImgLog, "imgLoader::SetHasNoProxies", "uri",
1548                              aRequest->CacheKey().URI());
1549
1550   aEntry->SetHasNoProxies(true);
1551
1552   if (aEntry->Evicted()) {
1553     return false;
1554   }
1555
1556   imgCacheQueue& queue = GetCacheQueue(aRequest->IsChrome());
1557
1558   nsresult addrv = NS_OK;
1559
1560   if (mCacheTracker) {
1561     addrv = mCacheTracker->AddObject(aEntry);
1562   }
1563
1564   if (NS_SUCCEEDED(addrv)) {
1565     queue.Push(aEntry);
1566   }
1567
1568   imgCacheTable& cache = GetCache(aRequest->IsChrome());
1569   CheckCacheLimits(cache, queue);
1570
1571   return true;
1572 }
1573
1574 bool imgLoader::SetHasProxies(imgRequest* aRequest) {
1575   VerifyCacheSizes();
1576
1577   const ImageCacheKey& key = aRequest->CacheKey();
1578   imgCacheTable& cache = GetCache(key);
1579
1580   LOG_STATIC_FUNC_WITH_PARAM(gImgLog, "imgLoader::SetHasProxies", "uri",
1581                              key.URI());
1582
1583   RefPtr<imgCacheEntry> entry;
1584   if (cache.Get(key, getter_AddRefs(entry)) && entry) {
1585     // Make sure the cache entry is for the right request
1586     RefPtr<imgRequest> entryRequest = entry->GetRequest();
1587     if (entryRequest == aRequest && entry->HasNoProxies()) {
1588       imgCacheQueue& queue = GetCacheQueue(key);
1589       queue.Remove(entry);
1590
1591       if (mCacheTracker) {
1592         mCacheTracker->RemoveObject(entry);
1593       }
1594
1595       entry->SetHasNoProxies(false);
1596
1597       return true;
1598     }
1599   }
1600
1601   return false;
1602 }
1603
1604 void imgLoader::CacheEntriesChanged(bool aForChrome,
1605                                     int32_t aSizeDiff /* = 0 */) {
1606   imgCacheQueue& queue = GetCacheQueue(aForChrome);
1607   // We only need to dirty the queue if there is any sorting
1608   // taking place.  Empty or single-entry lists can't become
1609   // dirty.
1610   if (queue.GetNumElements() > 1) {
1611     queue.MarkDirty();
1612   }
1613   queue.UpdateSize(aSizeDiff);
1614 }
1615
1616 void imgLoader::CheckCacheLimits(imgCacheTable& cache, imgCacheQueue& queue) {
1617   if (queue.GetNumElements() == 0) {
1618     NS_ASSERTION(queue.GetSize() == 0,
1619                  "imgLoader::CheckCacheLimits -- incorrect cache size");
1620   }
1621
1622   // Remove entries from the cache until we're back at our desired max size.
1623   while (queue.GetSize() > sCacheMaxSize) {
1624     // Remove the first entry in the queue.
1625     RefPtr<imgCacheEntry> entry(queue.Pop());
1626
1627     NS_ASSERTION(entry, "imgLoader::CheckCacheLimits -- NULL entry pointer");
1628
1629     if (MOZ_LOG_TEST(gImgLog, LogLevel::Debug)) {
1630       RefPtr<imgRequest> req = entry->GetRequest();
1631       if (req) {
1632         LOG_STATIC_FUNC_WITH_PARAM(gImgLog, "imgLoader::CheckCacheLimits",
1633                                    "entry", req->CacheKey().URI());
1634       }
1635     }
1636
1637     if (entry) {
1638       // We just popped this entry from the queue, so pass AlreadyRemoved
1639       // to avoid searching the queue again in RemoveFromCache.
1640       RemoveFromCache(entry, QueueState::AlreadyRemoved);
1641     }
1642   }
1643 }
1644
1645 bool imgLoader::ValidateRequestWithNewChannel(
1646     imgRequest* request, nsIURI* aURI, nsIURI* aInitialDocumentURI,
1647     nsIReferrerInfo* aReferrerInfo, nsILoadGroup* aLoadGroup,
1648     imgINotificationObserver* aObserver, Document* aLoadingDocument,
1649     uint64_t aInnerWindowId, nsLoadFlags aLoadFlags,
1650     nsContentPolicyType aLoadPolicyType, imgRequestProxy** aProxyRequest,
1651     nsIPrincipal* aTriggeringPrincipal, CORSMode aCORSMode, bool aLinkPreload,
1652     bool* aNewChannelCreated) {
1653   // now we need to insert a new channel request object in between the real
1654   // request and the proxy that basically delays loading the image until it
1655   // gets a 304 or figures out that this needs to be a new request
1656
1657   nsresult rv;
1658
1659   // If we're currently in the middle of validating this request, just hand
1660   // back a proxy to it; the required work will be done for us.
1661   if (imgCacheValidator* validator = request->GetValidator()) {
1662     rv = CreateNewProxyForRequest(request, aURI, aLoadGroup, aLoadingDocument,
1663                                   aObserver, aLoadFlags, aProxyRequest);
1664     if (NS_FAILED(rv)) {
1665       return false;
1666     }
1667
1668     if (*aProxyRequest) {
1669       imgRequestProxy* proxy = static_cast<imgRequestProxy*>(*aProxyRequest);
1670
1671       // We will send notifications from imgCacheValidator::OnStartRequest().
1672       // In the mean time, we must defer notifications because we are added to
1673       // the imgRequest's proxy list, and we can get extra notifications
1674       // resulting from methods such as StartDecoding(). See bug 579122.
1675       proxy->MarkValidating();
1676
1677       if (aLinkPreload) {
1678         MOZ_ASSERT(aLoadingDocument);
1679         proxy->PrioritizeAsPreload();
1680         auto preloadKey = PreloadHashKey::CreateAsImage(
1681             aURI, aTriggeringPrincipal, aCORSMode);
1682         proxy->NotifyOpen(preloadKey, aLoadingDocument, true);
1683       }
1684
1685       // Attach the proxy without notifying
1686       validator->AddProxy(proxy);
1687     }
1688
1689     return true;
1690   }
1691   // We will rely on Necko to cache this request when it's possible, and to
1692   // tell imgCacheValidator::OnStartRequest whether the request came from its
1693   // cache.
1694   nsCOMPtr<nsIChannel> newChannel;
1695   bool forcePrincipalCheck;
1696   rv = NewImageChannel(getter_AddRefs(newChannel), &forcePrincipalCheck, aURI,
1697                        aInitialDocumentURI, aCORSMode, aReferrerInfo,
1698                        aLoadGroup, aLoadFlags, aLoadPolicyType,
1699                        aTriggeringPrincipal, aLoadingDocument, mRespectPrivacy);
1700   if (NS_FAILED(rv)) {
1701     return false;
1702   }
1703
1704   if (aNewChannelCreated) {
1705     *aNewChannelCreated = true;
1706   }
1707
1708   RefPtr<imgRequestProxy> req;
1709   rv = CreateNewProxyForRequest(request, aURI, aLoadGroup, aLoadingDocument,
1710                                 aObserver, aLoadFlags, getter_AddRefs(req));
1711   if (NS_FAILED(rv)) {
1712     return false;
1713   }
1714
1715   // Make sure that OnStatus/OnProgress calls have the right request set...
1716   RefPtr<nsProgressNotificationProxy> progressproxy =
1717       new nsProgressNotificationProxy(newChannel, req);
1718   if (!progressproxy) {
1719     return false;
1720   }
1721
1722   RefPtr<imgCacheValidator> hvc =
1723       new imgCacheValidator(progressproxy, this, request, aLoadingDocument,
1724                             aInnerWindowId, forcePrincipalCheck);
1725
1726   // Casting needed here to get past multiple inheritance.
1727   nsCOMPtr<nsIStreamListener> listener =
1728       do_QueryInterface(static_cast<nsIThreadRetargetableStreamListener*>(hvc));
1729   NS_ENSURE_TRUE(listener, false);
1730
1731   // We must set the notification callbacks before setting up the
1732   // CORS listener, because that's also interested inthe
1733   // notification callbacks.
1734   newChannel->SetNotificationCallbacks(hvc);
1735
1736   request->SetValidator(hvc);
1737
1738   // We will send notifications from imgCacheValidator::OnStartRequest().
1739   // In the mean time, we must defer notifications because we are added to
1740   // the imgRequest's proxy list, and we can get extra notifications
1741   // resulting from methods such as StartDecoding(). See bug 579122.
1742   req->MarkValidating();
1743
1744   if (aLinkPreload) {
1745     MOZ_ASSERT(aLoadingDocument);
1746     req->PrioritizeAsPreload();
1747     auto preloadKey =
1748         PreloadHashKey::CreateAsImage(aURI, aTriggeringPrincipal, aCORSMode);
1749     req->NotifyOpen(preloadKey, aLoadingDocument, true);
1750   }
1751
1752   // Add the proxy without notifying
1753   hvc->AddProxy(req);
1754
1755   mozilla::net::PredictorLearn(aURI, aInitialDocumentURI,
1756                                nsINetworkPredictor::LEARN_LOAD_SUBRESOURCE,
1757                                aLoadGroup);
1758   rv = newChannel->AsyncOpen(listener);
1759   if (NS_WARN_IF(NS_FAILED(rv))) {
1760     req->CancelAndForgetObserver(rv);
1761     // This will notify any current or future <link preload> tags.  Pass the
1762     // non-open channel so that we can read loadinfo and referrer info of that
1763     // channel.
1764     req->NotifyStart(newChannel);
1765     // Use the non-channel overload of this method to force the notification to
1766     // happen.  The preload request has not been assigned a channel.
1767     req->NotifyStop(rv);
1768     return false;
1769   }
1770
1771   req.forget(aProxyRequest);
1772   return true;
1773 }
1774
1775 bool imgLoader::ValidateEntry(
1776     imgCacheEntry* aEntry, nsIURI* aURI, nsIURI* aInitialDocumentURI,
1777     nsIReferrerInfo* aReferrerInfo, nsILoadGroup* aLoadGroup,
1778     imgINotificationObserver* aObserver, Document* aLoadingDocument,
1779     nsLoadFlags aLoadFlags, nsContentPolicyType aLoadPolicyType,
1780     bool aCanMakeNewChannel, bool* aNewChannelCreated,
1781     imgRequestProxy** aProxyRequest, nsIPrincipal* aTriggeringPrincipal,
1782     CORSMode aCORSMode, bool aLinkPreload) {
1783   LOG_SCOPE(gImgLog, "imgLoader::ValidateEntry");
1784
1785   // If the expiration time is zero, then the request has not gotten far enough
1786   // to know when it will expire.
1787   uint32_t expiryTime = aEntry->GetExpiryTime();
1788   bool hasExpired =
1789       expiryTime != 0 && expiryTime <= SecondsFromPRTime(PR_Now());
1790
1791   nsresult rv;
1792
1793   // Special treatment for file URLs - aEntry has expired if file has changed
1794   nsCOMPtr<nsIFileURL> fileUrl(do_QueryInterface(aURI));
1795   if (fileUrl) {
1796     uint32_t lastModTime = aEntry->GetLoadTime();
1797
1798     nsCOMPtr<nsIFile> theFile;
1799     rv = fileUrl->GetFile(getter_AddRefs(theFile));
1800     if (NS_SUCCEEDED(rv)) {
1801       PRTime fileLastMod;
1802       rv = theFile->GetLastModifiedTime(&fileLastMod);
1803       if (NS_SUCCEEDED(rv)) {
1804         // nsIFile uses millisec, NSPR usec
1805         fileLastMod *= 1000;
1806         hasExpired = SecondsFromPRTime((PRTime)fileLastMod) > lastModTime;
1807       }
1808     }
1809   }
1810
1811   RefPtr<imgRequest> request(aEntry->GetRequest());
1812
1813   if (!request) {
1814     return false;
1815   }
1816
1817   if (!ValidateSecurityInfo(request, aEntry->ForcePrincipalCheck(), aCORSMode,
1818                             aTriggeringPrincipal, aLoadingDocument,
1819                             aLoadPolicyType)) {
1820     return false;
1821   }
1822
1823   // data URIs are immutable and by their nature can't leak data, so we can
1824   // just return true in that case.  Doing so would mean that shift-reload
1825   // doesn't reload data URI documents/images though (which is handy for
1826   // debugging during gecko development) so we make an exception in that case.
1827   nsAutoCString scheme;
1828   aURI->GetScheme(scheme);
1829   if (scheme.EqualsLiteral("data") &&
1830       !(aLoadFlags & nsIRequest::LOAD_BYPASS_CACHE)) {
1831     return true;
1832   }
1833
1834   bool validateRequest = false;
1835
1836   if (!request->CanReuseWithoutValidation(aLoadingDocument)) {
1837     // If we would need to revalidate this entry, but we're being told to
1838     // bypass the cache, we don't allow this entry to be used.
1839     if (aLoadFlags & nsIRequest::LOAD_BYPASS_CACHE) {
1840       return false;
1841     }
1842
1843     if (MOZ_UNLIKELY(ChaosMode::isActive(ChaosFeature::ImageCache))) {
1844       if (ChaosMode::randomUint32LessThan(4) < 1) {
1845         return false;
1846       }
1847     }
1848
1849     // Determine whether the cache aEntry must be revalidated...
1850     validateRequest = ShouldRevalidateEntry(aEntry, aLoadFlags, hasExpired);
1851
1852     MOZ_LOG(gImgLog, LogLevel::Debug,
1853             ("imgLoader::ValidateEntry validating cache entry. "
1854              "validateRequest = %d",
1855              validateRequest));
1856   } else if (!aLoadingDocument && MOZ_LOG_TEST(gImgLog, LogLevel::Debug)) {
1857     MOZ_LOG(gImgLog, LogLevel::Debug,
1858             ("imgLoader::ValidateEntry BYPASSING cache validation for %s "
1859              "because of NULL loading document",
1860              aURI->GetSpecOrDefault().get()));
1861   }
1862
1863   // If the original request is still transferring don't kick off a validation
1864   // network request because it is a bit silly to issue a validation request if
1865   // the original request hasn't even finished yet. So just return true
1866   // indicating the caller can create a new proxy for the request and use it as
1867   // is.
1868   // This is an optimization but it's also required for correctness. If we don't
1869   // do this then when firing the load complete notification for the original
1870   // request that can unblock load for the document and then spin the event loop
1871   // (see the stack in bug 1641682) which then the OnStartRequest for the
1872   // validation request can fire which can call UpdateProxies and can sync
1873   // notify on the progress tracker about all existing state, which includes
1874   // load complete, so we fire a second load complete notification for the
1875   // image.
1876   // In addition, we want to validate if the original request encountered
1877   // an error for two reasons. The first being if the error was a network error
1878   // then trying to re-fetch the image might succeed. The second is more
1879   // complicated. We decide if we should fire the load or error event for img
1880   // elements depending on if the image has error in its status at the time when
1881   // the load complete notification is received, and we set error status on an
1882   // image if it encounters a network error or a decode error with no real way
1883   // to tell them apart. So if we load an image that will produce a decode error
1884   // the first time we will usually fire the load event, and then decode enough
1885   // to encounter the decode error and set the error status on the image. The
1886   // next time we reference the image in the same document the load complete
1887   // notification is replayed and this time the error status from the decode is
1888   // already present so we fire the error event instead of the load event. This
1889   // is a bug (bug 1645576) that we should fix. In order to avoid that bug in
1890   // some cases (specifically the cases when we hit this code and try to
1891   // validate the request) we make sure to validate. This avoids the bug because
1892   // when the load complete notification arrives the proxy is marked as
1893   // validating so it lies about its status and returns nothing.
1894   bool requestComplete = false;
1895   RefPtr<ProgressTracker> tracker;
1896   RefPtr<mozilla::image::Image> image = request->GetImage();
1897   if (image) {
1898     tracker = image->GetProgressTracker();
1899   } else {
1900     tracker = request->GetProgressTracker();
1901   }
1902   if (tracker) {
1903     if (tracker->GetProgress() & (FLAG_LOAD_COMPLETE | FLAG_HAS_ERROR)) {
1904       requestComplete = true;
1905     }
1906   }
1907   if (!requestComplete) {
1908     return true;
1909   }
1910
1911   if (validateRequest && aCanMakeNewChannel) {
1912     LOG_SCOPE(gImgLog, "imgLoader::ValidateRequest |cache hit| must validate");
1913
1914     uint64_t innerWindowID =
1915         aLoadingDocument ? aLoadingDocument->InnerWindowID() : 0;
1916     return ValidateRequestWithNewChannel(
1917         request, aURI, aInitialDocumentURI, aReferrerInfo, aLoadGroup,
1918         aObserver, aLoadingDocument, innerWindowID, aLoadFlags, aLoadPolicyType,
1919         aProxyRequest, aTriggeringPrincipal, aCORSMode, aLinkPreload,
1920         aNewChannelCreated);
1921   }
1922
1923   return !validateRequest;
1924 }
1925
1926 bool imgLoader::RemoveFromCache(const ImageCacheKey& aKey) {
1927   LOG_STATIC_FUNC_WITH_PARAM(gImgLog, "imgLoader::RemoveFromCache", "uri",
1928                              aKey.URI());
1929
1930   imgCacheTable& cache = GetCache(aKey);
1931   imgCacheQueue& queue = GetCacheQueue(aKey);
1932
1933   RefPtr<imgCacheEntry> entry;
1934   cache.Remove(aKey, getter_AddRefs(entry));
1935   if (entry) {
1936     MOZ_ASSERT(!entry->Evicted(), "Evicting an already-evicted cache entry!");
1937
1938     // Entries with no proxies are in the tracker.
1939     if (entry->HasNoProxies()) {
1940       if (mCacheTracker) {
1941         mCacheTracker->RemoveObject(entry);
1942       }
1943       queue.Remove(entry);
1944     }
1945
1946     entry->SetEvicted(true);
1947
1948     RefPtr<imgRequest> request = entry->GetRequest();
1949     request->SetIsInCache(false);
1950     AddToUncachedImages(request);
1951
1952     return true;
1953   }
1954   return false;
1955 }
1956
1957 bool imgLoader::RemoveFromCache(imgCacheEntry* entry, QueueState aQueueState) {
1958   LOG_STATIC_FUNC(gImgLog, "imgLoader::RemoveFromCache entry");
1959
1960   RefPtr<imgRequest> request = entry->GetRequest();
1961   if (request) {
1962     const ImageCacheKey& key = request->CacheKey();
1963     imgCacheTable& cache = GetCache(key);
1964     imgCacheQueue& queue = GetCacheQueue(key);
1965
1966     LOG_STATIC_FUNC_WITH_PARAM(gImgLog, "imgLoader::RemoveFromCache",
1967                                "entry's uri", key.URI());
1968
1969     cache.Remove(key);
1970
1971     if (entry->HasNoProxies()) {
1972       LOG_STATIC_FUNC(gImgLog,
1973                       "imgLoader::RemoveFromCache removing from tracker");
1974       if (mCacheTracker) {
1975         mCacheTracker->RemoveObject(entry);
1976       }
1977       // Only search the queue to remove the entry if its possible it might
1978       // be in the queue.  If we know its not in the queue this would be
1979       // wasted work.
1980       MOZ_ASSERT_IF(aQueueState == QueueState::AlreadyRemoved,
1981                     !queue.Contains(entry));
1982       if (aQueueState == QueueState::MaybeExists) {
1983         queue.Remove(entry);
1984       }
1985     }
1986
1987     entry->SetEvicted(true);
1988     request->SetIsInCache(false);
1989     AddToUncachedImages(request);
1990
1991     return true;
1992   }
1993
1994   return false;
1995 }
1996
1997 nsresult imgLoader::EvictEntries(imgCacheTable& aCacheToClear) {
1998   LOG_STATIC_FUNC(gImgLog, "imgLoader::EvictEntries table");
1999
2000   // We have to make a temporary, since RemoveFromCache removes the element
2001   // from the queue, invalidating iterators.
2002   const auto entries =
2003       ToTArray<nsTArray<RefPtr<imgCacheEntry>>>(aCacheToClear.Values());
2004   for (const auto& entry : entries) {
2005     if (!RemoveFromCache(entry)) {
2006       return NS_ERROR_FAILURE;
2007     }
2008   }
2009
2010   MOZ_ASSERT(aCacheToClear.Count() == 0);
2011
2012   return NS_OK;
2013 }
2014
2015 nsresult imgLoader::EvictEntries(imgCacheQueue& aQueueToClear) {
2016   LOG_STATIC_FUNC(gImgLog, "imgLoader::EvictEntries queue");
2017
2018   // We have to make a temporary, since RemoveFromCache removes the element
2019   // from the queue, invalidating iterators.
2020   nsTArray<RefPtr<imgCacheEntry>> entries(aQueueToClear.GetNumElements());
2021   for (auto i = aQueueToClear.begin(); i != aQueueToClear.end(); ++i) {
2022     entries.AppendElement(*i);
2023   }
2024
2025   // Iterate in reverse order to minimize array copying.
2026   for (auto& entry : entries) {
2027     if (!RemoveFromCache(entry)) {
2028       return NS_ERROR_FAILURE;
2029     }
2030   }
2031
2032   MOZ_ASSERT(aQueueToClear.GetNumElements() == 0);
2033
2034   return NS_OK;
2035 }
2036
2037 void imgLoader::AddToUncachedImages(imgRequest* aRequest) {
2038   MutexAutoLock lock(mUncachedImagesMutex);
2039   mUncachedImages.Insert(aRequest);
2040 }
2041
2042 void imgLoader::RemoveFromUncachedImages(imgRequest* aRequest) {
2043   MutexAutoLock lock(mUncachedImagesMutex);
2044   mUncachedImages.Remove(aRequest);
2045 }
2046
2047 bool imgLoader::PreferLoadFromCache(nsIURI* aURI) const {
2048   // If we are trying to load an image from a protocol that doesn't support
2049   // caching (e.g. thumbnails via the moz-page-thumb:// protocol, or icons via
2050   // the moz-extension:// protocol), load it directly from the cache to prevent
2051   // re-decoding the image. See Bug 1373258.
2052   // TODO: Bug 1406134
2053   return aURI->SchemeIs("moz-page-thumb") || aURI->SchemeIs("moz-extension");
2054 }
2055
2056 #define LOAD_FLAGS_CACHE_MASK \
2057   (nsIRequest::LOAD_BYPASS_CACHE | nsIRequest::LOAD_FROM_CACHE)
2058
2059 #define LOAD_FLAGS_VALIDATE_MASK                              \
2060   (nsIRequest::VALIDATE_ALWAYS | nsIRequest::VALIDATE_NEVER | \
2061    nsIRequest::VALIDATE_ONCE_PER_SESSION)
2062
2063 NS_IMETHODIMP
2064 imgLoader::LoadImageXPCOM(
2065     nsIURI* aURI, nsIURI* aInitialDocumentURI, nsIReferrerInfo* aReferrerInfo,
2066     nsIPrincipal* aTriggeringPrincipal, nsILoadGroup* aLoadGroup,
2067     imgINotificationObserver* aObserver, Document* aLoadingDocument,
2068     nsLoadFlags aLoadFlags, nsISupports* aCacheKey,
2069     nsContentPolicyType aContentPolicyType, imgIRequest** _retval) {
2070   // Optional parameter, so defaults to 0 (== TYPE_INVALID)
2071   if (!aContentPolicyType) {
2072     aContentPolicyType = nsIContentPolicy::TYPE_INTERNAL_IMAGE;
2073   }
2074   imgRequestProxy* proxy;
2075   nsresult rv = LoadImage(
2076       aURI, aInitialDocumentURI, aReferrerInfo, aTriggeringPrincipal, 0,
2077       aLoadGroup, aObserver, aLoadingDocument, aLoadingDocument, aLoadFlags,
2078       aCacheKey, aContentPolicyType, u""_ns,
2079       /* aUseUrgentStartForChannel */ false, /* aListPreload */ false, &proxy);
2080   *_retval = proxy;
2081   return rv;
2082 }
2083
2084 static void MakeRequestStaticIfNeeded(
2085     Document* aLoadingDocument, imgRequestProxy** aProxyAboutToGetReturned) {
2086   if (!aLoadingDocument || !aLoadingDocument->IsStaticDocument()) {
2087     return;
2088   }
2089
2090   if (!*aProxyAboutToGetReturned) {
2091     return;
2092   }
2093
2094   RefPtr<imgRequestProxy> proxy = dont_AddRef(*aProxyAboutToGetReturned);
2095   *aProxyAboutToGetReturned = nullptr;
2096
2097   RefPtr<imgRequestProxy> staticProxy =
2098       proxy->GetStaticRequest(aLoadingDocument);
2099   if (staticProxy != proxy) {
2100     proxy->CancelAndForgetObserver(NS_BINDING_ABORTED);
2101     proxy = std::move(staticProxy);
2102   }
2103   proxy.forget(aProxyAboutToGetReturned);
2104 }
2105
2106 bool imgLoader::IsImageAvailable(nsIURI* aURI,
2107                                  nsIPrincipal* aTriggeringPrincipal,
2108                                  CORSMode aCORSMode, Document* aDocument) {
2109   ImageCacheKey key(aURI, aTriggeringPrincipal->OriginAttributesRef(),
2110                     aDocument);
2111   RefPtr<imgCacheEntry> entry;
2112   imgCacheTable& cache = GetCache(key);
2113   if (!cache.Get(key, getter_AddRefs(entry)) || !entry) {
2114     return false;
2115   }
2116   RefPtr<imgRequest> request = entry->GetRequest();
2117   if (!request) {
2118     return false;
2119   }
2120   return ValidateCORSMode(request, false, aCORSMode, aTriggeringPrincipal);
2121 }
2122
2123 nsresult imgLoader::LoadImage(
2124     nsIURI* aURI, nsIURI* aInitialDocumentURI, nsIReferrerInfo* aReferrerInfo,
2125     nsIPrincipal* aTriggeringPrincipal, uint64_t aRequestContextID,
2126     nsILoadGroup* aLoadGroup, imgINotificationObserver* aObserver,
2127     nsINode* aContext, Document* aLoadingDocument, nsLoadFlags aLoadFlags,
2128     nsISupports* aCacheKey, nsContentPolicyType aContentPolicyType,
2129     const nsAString& initiatorType, bool aUseUrgentStartForChannel,
2130     bool aLinkPreload, imgRequestProxy** _retval) {
2131   VerifyCacheSizes();
2132
2133   NS_ASSERTION(aURI, "imgLoader::LoadImage -- NULL URI pointer");
2134
2135   if (!aURI) {
2136     return NS_ERROR_NULL_POINTER;
2137   }
2138
2139   auto makeStaticIfNeeded = mozilla::MakeScopeExit(
2140       [&] { MakeRequestStaticIfNeeded(aLoadingDocument, _retval); });
2141
2142   AUTO_PROFILER_LABEL_DYNAMIC_NSCSTRING("imgLoader::LoadImage", NETWORK,
2143                                         aURI->GetSpecOrDefault());
2144
2145   LOG_SCOPE_WITH_PARAM(gImgLog, "imgLoader::LoadImage", "aURI", aURI);
2146
2147   *_retval = nullptr;
2148
2149   RefPtr<imgRequest> request;
2150
2151   nsresult rv;
2152   nsLoadFlags requestFlags = nsIRequest::LOAD_NORMAL;
2153
2154 #ifdef DEBUG
2155   bool isPrivate = false;
2156
2157   if (aLoadingDocument) {
2158     isPrivate = nsContentUtils::IsInPrivateBrowsing(aLoadingDocument);
2159   } else if (aLoadGroup) {
2160     isPrivate = nsContentUtils::IsInPrivateBrowsing(aLoadGroup);
2161   }
2162   MOZ_ASSERT(isPrivate == mRespectPrivacy);
2163
2164   if (aLoadingDocument) {
2165     // The given load group should match that of the document if given. If
2166     // that isn't the case, then we need to add more plumbing to ensure we
2167     // block the document as well.
2168     nsCOMPtr<nsILoadGroup> docLoadGroup =
2169         aLoadingDocument->GetDocumentLoadGroup();
2170     MOZ_ASSERT(docLoadGroup == aLoadGroup);
2171   }
2172 #endif
2173
2174   // Get the default load flags from the loadgroup (if possible)...
2175   if (aLoadGroup) {
2176     aLoadGroup->GetLoadFlags(&requestFlags);
2177     if (PreferLoadFromCache(aURI)) {
2178       requestFlags |= nsIRequest::LOAD_FROM_CACHE;
2179     }
2180   }
2181   //
2182   // Merge the default load flags with those passed in via aLoadFlags.
2183   // Currently, *only* the caching, validation and background load flags
2184   // are merged...
2185   //
2186   // The flags in aLoadFlags take precedence over the default flags!
2187   //
2188   if (aLoadFlags & LOAD_FLAGS_CACHE_MASK) {
2189     // Override the default caching flags...
2190     requestFlags = (requestFlags & ~LOAD_FLAGS_CACHE_MASK) |
2191                    (aLoadFlags & LOAD_FLAGS_CACHE_MASK);
2192   }
2193   if (aLoadFlags & LOAD_FLAGS_VALIDATE_MASK) {
2194     // Override the default validation flags...
2195     requestFlags = (requestFlags & ~LOAD_FLAGS_VALIDATE_MASK) |
2196                    (aLoadFlags & LOAD_FLAGS_VALIDATE_MASK);
2197   }
2198   if (aLoadFlags & nsIRequest::LOAD_BACKGROUND) {
2199     // Propagate background loading...
2200     requestFlags |= nsIRequest::LOAD_BACKGROUND;
2201   }
2202
2203   if (aLinkPreload) {
2204     // Set background loading if it is <link rel=preload>
2205     requestFlags |= nsIRequest::LOAD_BACKGROUND;
2206   }
2207
2208   CORSMode corsmode = CORS_NONE;
2209   if (aLoadFlags & imgILoader::LOAD_CORS_ANONYMOUS) {
2210     corsmode = CORS_ANONYMOUS;
2211   } else if (aLoadFlags & imgILoader::LOAD_CORS_USE_CREDENTIALS) {
2212     corsmode = CORS_USE_CREDENTIALS;
2213   }
2214
2215   // Look in the preloaded images of loading document first.
2216   if (StaticPrefs::network_preload() && !aLinkPreload && aLoadingDocument) {
2217     auto key =
2218         PreloadHashKey::CreateAsImage(aURI, aTriggeringPrincipal, corsmode);
2219     if (RefPtr<PreloaderBase> preload =
2220             aLoadingDocument->Preloads().LookupPreload(key)) {
2221       RefPtr<imgRequestProxy> proxy = do_QueryObject(preload);
2222       MOZ_ASSERT(proxy);
2223
2224       MOZ_LOG(gImgLog, LogLevel::Debug,
2225               ("[this=%p] imgLoader::LoadImage -- preloaded [proxy=%p]"
2226                " [document=%p]\n",
2227                this, proxy.get(), aLoadingDocument));
2228
2229       // Removing the preload for this image to be in parity with Chromium.  Any
2230       // following regular image request will be reloaded using the regular
2231       // path: image cache, http cache, network.  Any following `<link
2232       // rel=preload as=image>` will start a new image preload that can be
2233       // satisfied from http cache or network.
2234       //
2235       // There is a spec discussion for "preload cache", see
2236       // https://github.com/w3c/preload/issues/97. And it is also not clear how
2237       // preload image interacts with list of available images, see
2238       // https://github.com/whatwg/html/issues/4474.
2239       proxy->RemoveSelf(aLoadingDocument);
2240       proxy->NotifyUsage();
2241
2242       imgRequest* request = proxy->GetOwner();
2243       nsresult rv =
2244           CreateNewProxyForRequest(request, aURI, aLoadGroup, aLoadingDocument,
2245                                    aObserver, requestFlags, _retval);
2246       NS_ENSURE_SUCCESS(rv, rv);
2247
2248       imgRequestProxy* newProxy = *_retval;
2249       if (imgCacheValidator* validator = request->GetValidator()) {
2250         newProxy->MarkValidating();
2251         // Attach the proxy without notifying and this will add us to the load
2252         // group.
2253         validator->AddProxy(newProxy);
2254       } else {
2255         // It's OK to add here even if the request is done. If it is, it'll send
2256         // a OnStopRequest()and the proxy will be removed from the loadgroup in
2257         // imgRequestProxy::OnLoadComplete.
2258         newProxy->AddToLoadGroup();
2259         newProxy->NotifyListener();
2260       }
2261
2262       return NS_OK;
2263     }
2264   }
2265
2266   RefPtr<imgCacheEntry> entry;
2267
2268   // Look in the cache for our URI, and then validate it.
2269   // XXX For now ignore aCacheKey. We will need it in the future
2270   // for correctly dealing with image load requests that are a result
2271   // of post data.
2272   OriginAttributes attrs;
2273   if (aTriggeringPrincipal) {
2274     attrs = aTriggeringPrincipal->OriginAttributesRef();
2275   }
2276   ImageCacheKey key(aURI, attrs, aLoadingDocument);
2277   imgCacheTable& cache = GetCache(key);
2278
2279   if (cache.Get(key, getter_AddRefs(entry)) && entry) {
2280     bool newChannelCreated = false;
2281     if (ValidateEntry(entry, aURI, aInitialDocumentURI, aReferrerInfo,
2282                       aLoadGroup, aObserver, aLoadingDocument, requestFlags,
2283                       aContentPolicyType, true, &newChannelCreated, _retval,
2284                       aTriggeringPrincipal, corsmode, aLinkPreload)) {
2285       request = entry->GetRequest();
2286
2287       // If this entry has no proxies, its request has no reference to the
2288       // entry.
2289       if (entry->HasNoProxies()) {
2290         LOG_FUNC_WITH_PARAM(gImgLog,
2291                             "imgLoader::LoadImage() adding proxyless entry",
2292                             "uri", key.URI());
2293         MOZ_ASSERT(!request->HasCacheEntry(),
2294                    "Proxyless entry's request has cache entry!");
2295         request->SetCacheEntry(entry);
2296
2297         if (mCacheTracker && entry->GetExpirationState()->IsTracked()) {
2298           mCacheTracker->MarkUsed(entry);
2299         }
2300       }
2301
2302       entry->Touch();
2303
2304       if (!newChannelCreated) {
2305         // This is ugly but it's needed to report CSP violations. We have 3
2306         // scenarios:
2307         // - we don't have cache. We are not in this if() stmt. A new channel is
2308         //   created and that triggers the CSP checks.
2309         // - We have a cache entry and this is blocked by CSP directives.
2310         DebugOnly<bool> shouldLoad = ShouldLoadCachedImage(
2311             request, aLoadingDocument, aTriggeringPrincipal, aContentPolicyType,
2312             /* aSendCSPViolationReports */ true);
2313         MOZ_ASSERT(shouldLoad);
2314       }
2315     } else {
2316       // We can't use this entry. We'll try to load it off the network, and if
2317       // successful, overwrite the old entry in the cache with a new one.
2318       entry = nullptr;
2319     }
2320   }
2321
2322   // Keep the channel in this scope, so we can adjust its notificationCallbacks
2323   // later when we create the proxy.
2324   nsCOMPtr<nsIChannel> newChannel;
2325   // If we didn't get a cache hit, we need to load from the network.
2326   if (!request) {
2327     LOG_SCOPE(gImgLog, "imgLoader::LoadImage |cache miss|");
2328
2329     bool forcePrincipalCheck;
2330     rv = NewImageChannel(getter_AddRefs(newChannel), &forcePrincipalCheck, aURI,
2331                          aInitialDocumentURI, corsmode, aReferrerInfo,
2332                          aLoadGroup, requestFlags, aContentPolicyType,
2333                          aTriggeringPrincipal, aContext, mRespectPrivacy);
2334     if (NS_FAILED(rv)) {
2335       return NS_ERROR_FAILURE;
2336     }
2337
2338     MOZ_ASSERT(NS_UsePrivateBrowsing(newChannel) == mRespectPrivacy);
2339
2340     NewRequestAndEntry(forcePrincipalCheck, this, key, getter_AddRefs(request),
2341                        getter_AddRefs(entry));
2342
2343     MOZ_LOG(gImgLog, LogLevel::Debug,
2344             ("[this=%p] imgLoader::LoadImage -- Created new imgRequest"
2345              " [request=%p]\n",
2346              this, request.get()));
2347
2348     nsCOMPtr<nsIClassOfService> cos(do_QueryInterface(newChannel));
2349     if (cos) {
2350       if (aUseUrgentStartForChannel && !aLinkPreload) {
2351         cos->AddClassFlags(nsIClassOfService::UrgentStart);
2352       }
2353
2354       if (StaticPrefs::network_http_tailing_enabled() &&
2355           aContentPolicyType == nsIContentPolicy::TYPE_INTERNAL_IMAGE_FAVICON) {
2356         cos->AddClassFlags(nsIClassOfService::Throttleable |
2357                            nsIClassOfService::Tail);
2358         nsCOMPtr<nsIHttpChannel> httpChannel(do_QueryInterface(newChannel));
2359         if (httpChannel) {
2360           Unused << httpChannel->SetRequestContextID(aRequestContextID);
2361         }
2362       }
2363     }
2364
2365     nsCOMPtr<nsILoadGroup> channelLoadGroup;
2366     newChannel->GetLoadGroup(getter_AddRefs(channelLoadGroup));
2367     rv = request->Init(aURI, aURI, /* aHadInsecureRedirect = */ false,
2368                        channelLoadGroup, newChannel, entry, aLoadingDocument,
2369                        aTriggeringPrincipal, corsmode, aReferrerInfo);
2370     if (NS_FAILED(rv)) {
2371       return NS_ERROR_FAILURE;
2372     }
2373
2374     // Add the initiator type for this image load
2375     nsCOMPtr<nsITimedChannel> timedChannel = do_QueryInterface(newChannel);
2376     if (timedChannel) {
2377       timedChannel->SetInitiatorType(initiatorType);
2378     }
2379
2380     // create the proxy listener
2381     nsCOMPtr<nsIStreamListener> listener = new ProxyListener(request.get());
2382
2383     MOZ_LOG(gImgLog, LogLevel::Debug,
2384             ("[this=%p] imgLoader::LoadImage -- Calling channel->AsyncOpen()\n",
2385              this));
2386
2387     mozilla::net::PredictorLearn(aURI, aInitialDocumentURI,
2388                                  nsINetworkPredictor::LEARN_LOAD_SUBRESOURCE,
2389                                  aLoadGroup);
2390
2391     nsresult openRes = newChannel->AsyncOpen(listener);
2392
2393     if (NS_FAILED(openRes)) {
2394       MOZ_LOG(
2395           gImgLog, LogLevel::Debug,
2396           ("[this=%p] imgLoader::LoadImage -- AsyncOpen() failed: 0x%" PRIx32
2397            "\n",
2398            this, static_cast<uint32_t>(openRes)));
2399       request->CancelAndAbort(openRes);
2400       return openRes;
2401     }
2402
2403     // Try to add the new request into the cache.
2404     PutIntoCache(key, entry);
2405   } else {
2406     LOG_MSG_WITH_PARAM(gImgLog, "imgLoader::LoadImage |cache hit|", "request",
2407                        request);
2408   }
2409
2410   // If we didn't get a proxy when validating the cache entry, we need to
2411   // create one.
2412   if (!*_retval) {
2413     // ValidateEntry() has three return values: "Is valid," "might be valid --
2414     // validating over network", and "not valid." If we don't have a _retval,
2415     // we know ValidateEntry is not validating over the network, so it's safe
2416     // to SetLoadId here because we know this request is valid for this context.
2417     //
2418     // Note, however, that this doesn't guarantee the behaviour we want (one
2419     // URL maps to the same image on a page) if we load the same image in a
2420     // different tab (see bug 528003), because its load id will get re-set, and
2421     // that'll cause us to validate over the network.
2422     request->SetLoadId(aLoadingDocument);
2423
2424     LOG_MSG(gImgLog, "imgLoader::LoadImage", "creating proxy request.");
2425     rv = CreateNewProxyForRequest(request, aURI, aLoadGroup, aLoadingDocument,
2426                                   aObserver, requestFlags, _retval);
2427     if (NS_FAILED(rv)) {
2428       return rv;
2429     }
2430
2431     imgRequestProxy* proxy = *_retval;
2432
2433     // Make sure that OnStatus/OnProgress calls have the right request set, if
2434     // we did create a channel here.
2435     if (newChannel) {
2436       nsCOMPtr<nsIInterfaceRequestor> requestor(
2437           new nsProgressNotificationProxy(newChannel, proxy));
2438       if (!requestor) {
2439         return NS_ERROR_OUT_OF_MEMORY;
2440       }
2441       newChannel->SetNotificationCallbacks(requestor);
2442     }
2443
2444     if (aLinkPreload) {
2445       MOZ_ASSERT(aLoadingDocument);
2446       proxy->PrioritizeAsPreload();
2447       auto preloadKey =
2448           PreloadHashKey::CreateAsImage(aURI, aTriggeringPrincipal, corsmode);
2449       proxy->NotifyOpen(preloadKey, aLoadingDocument, true);
2450     }
2451
2452     // Note that it's OK to add here even if the request is done.  If it is,
2453     // it'll send a OnStopRequest() to the proxy in imgRequestProxy::Notify and
2454     // the proxy will be removed from the loadgroup.
2455     proxy->AddToLoadGroup();
2456
2457     // If we're loading off the network, explicitly don't notify our proxy,
2458     // because necko (or things called from necko, such as imgCacheValidator)
2459     // are going to call our notifications asynchronously, and we can't make it
2460     // further asynchronous because observers might rely on imagelib completing
2461     // its work between the channel's OnStartRequest and OnStopRequest.
2462     if (!newChannel) {
2463       proxy->NotifyListener();
2464     }
2465
2466     return rv;
2467   }
2468
2469   NS_ASSERTION(*_retval, "imgLoader::LoadImage -- no return value");
2470
2471   return NS_OK;
2472 }
2473
2474 NS_IMETHODIMP
2475 imgLoader::LoadImageWithChannelXPCOM(nsIChannel* channel,
2476                                      imgINotificationObserver* aObserver,
2477                                      Document* aLoadingDocument,
2478                                      nsIStreamListener** listener,
2479                                      imgIRequest** _retval) {
2480   nsresult result;
2481   imgRequestProxy* proxy;
2482   result = LoadImageWithChannel(channel, aObserver, aLoadingDocument, listener,
2483                                 &proxy);
2484   *_retval = proxy;
2485   return result;
2486 }
2487
2488 nsresult imgLoader::LoadImageWithChannel(nsIChannel* channel,
2489                                          imgINotificationObserver* aObserver,
2490                                          Document* aLoadingDocument,
2491                                          nsIStreamListener** listener,
2492                                          imgRequestProxy** _retval) {
2493   NS_ASSERTION(channel,
2494                "imgLoader::LoadImageWithChannel -- NULL channel pointer");
2495
2496   MOZ_ASSERT(NS_UsePrivateBrowsing(channel) == mRespectPrivacy);
2497
2498   auto makeStaticIfNeeded = mozilla::MakeScopeExit(
2499       [&] { MakeRequestStaticIfNeeded(aLoadingDocument, _retval); });
2500
2501   LOG_SCOPE(gImgLog, "imgLoader::LoadImageWithChannel");
2502   RefPtr<imgRequest> request;
2503
2504   nsCOMPtr<nsIURI> uri;
2505   channel->GetURI(getter_AddRefs(uri));
2506
2507   NS_ENSURE_TRUE(channel, NS_ERROR_FAILURE);
2508   nsCOMPtr<nsILoadInfo> loadInfo = channel->LoadInfo();
2509
2510   OriginAttributes attrs = loadInfo->GetOriginAttributes();
2511
2512   ImageCacheKey key(uri, attrs, aLoadingDocument);
2513
2514   nsLoadFlags requestFlags = nsIRequest::LOAD_NORMAL;
2515   channel->GetLoadFlags(&requestFlags);
2516
2517   if (PreferLoadFromCache(uri)) {
2518     requestFlags |= nsIRequest::LOAD_FROM_CACHE;
2519   }
2520
2521   RefPtr<imgCacheEntry> entry;
2522
2523   if (requestFlags & nsIRequest::LOAD_BYPASS_CACHE) {
2524     RemoveFromCache(key);
2525   } else {
2526     // Look in the cache for our URI, and then validate it.
2527     // XXX For now ignore aCacheKey. We will need it in the future
2528     // for correctly dealing with image load requests that are a result
2529     // of post data.
2530     imgCacheTable& cache = GetCache(key);
2531     if (cache.Get(key, getter_AddRefs(entry)) && entry) {
2532       // We don't want to kick off another network load. So we ask
2533       // ValidateEntry to only do validation without creating a new proxy. If
2534       // it says that the entry isn't valid any more, we'll only use the entry
2535       // we're getting if the channel is loading from the cache anyways.
2536       //
2537       // XXX -- should this be changed? it's pretty much verbatim from the old
2538       // code, but seems nonsensical.
2539       //
2540       // Since aCanMakeNewChannel == false, we don't need to pass content policy
2541       // type/principal/etc
2542
2543       nsCOMPtr<nsILoadInfo> loadInfo = channel->LoadInfo();
2544       // if there is a loadInfo, use the right contentType, otherwise
2545       // default to the internal image type
2546       nsContentPolicyType policyType = loadInfo->InternalContentPolicyType();
2547
2548       if (ValidateEntry(entry, uri, nullptr, nullptr, nullptr, aObserver,
2549                         aLoadingDocument, requestFlags, policyType, false,
2550                         nullptr, nullptr, nullptr, CORS_NONE, false)) {
2551         request = entry->GetRequest();
2552       } else {
2553         nsCOMPtr<nsICacheInfoChannel> cacheChan(do_QueryInterface(channel));
2554         bool bUseCacheCopy;
2555
2556         if (cacheChan) {
2557           cacheChan->IsFromCache(&bUseCacheCopy);
2558         } else {
2559           bUseCacheCopy = false;
2560         }
2561
2562         if (!bUseCacheCopy) {
2563           entry = nullptr;
2564         } else {
2565           request = entry->GetRequest();
2566         }
2567       }
2568
2569       if (request && entry) {
2570         // If this entry has no proxies, its request has no reference to
2571         // the entry.
2572         if (entry->HasNoProxies()) {
2573           LOG_FUNC_WITH_PARAM(
2574               gImgLog,
2575               "imgLoader::LoadImageWithChannel() adding proxyless entry", "uri",
2576               key.URI());
2577           MOZ_ASSERT(!request->HasCacheEntry(),
2578                      "Proxyless entry's request has cache entry!");
2579           request->SetCacheEntry(entry);
2580
2581           if (mCacheTracker && entry->GetExpirationState()->IsTracked()) {
2582             mCacheTracker->MarkUsed(entry);
2583           }
2584         }
2585       }
2586     }
2587   }
2588
2589   nsCOMPtr<nsILoadGroup> loadGroup;
2590   channel->GetLoadGroup(getter_AddRefs(loadGroup));
2591
2592 #ifdef DEBUG
2593   if (aLoadingDocument) {
2594     // The load group of the channel should always match that of the
2595     // document if given. If that isn't the case, then we need to add more
2596     // plumbing to ensure we block the document as well.
2597     nsCOMPtr<nsILoadGroup> docLoadGroup =
2598         aLoadingDocument->GetDocumentLoadGroup();
2599     MOZ_ASSERT(docLoadGroup == loadGroup);
2600   }
2601 #endif
2602
2603   // Filter out any load flags not from nsIRequest
2604   requestFlags &= nsIRequest::LOAD_REQUESTMASK;
2605
2606   nsresult rv = NS_OK;
2607   if (request) {
2608     // we have this in our cache already.. cancel the current (document) load
2609
2610     // this should fire an OnStopRequest
2611     channel->Cancel(NS_ERROR_PARSED_DATA_CACHED);
2612
2613     *listener = nullptr;  // give them back a null nsIStreamListener
2614
2615     rv = CreateNewProxyForRequest(request, uri, loadGroup, aLoadingDocument,
2616                                   aObserver, requestFlags, _retval);
2617     static_cast<imgRequestProxy*>(*_retval)->NotifyListener();
2618   } else {
2619     // We use originalURI here to fulfil the imgIRequest contract on GetURI.
2620     nsCOMPtr<nsIURI> originalURI;
2621     channel->GetOriginalURI(getter_AddRefs(originalURI));
2622
2623     // XXX(seth): We should be able to just use |key| here, except that |key| is
2624     // constructed above with the *current URI* and not the *original URI*. I'm
2625     // pretty sure this is a bug, and it's preventing us from ever getting a
2626     // cache hit in LoadImageWithChannel when redirects are involved.
2627     ImageCacheKey originalURIKey(originalURI, attrs, aLoadingDocument);
2628
2629     // Default to doing a principal check because we don't know who
2630     // started that load and whether their principal ended up being
2631     // inherited on the channel.
2632     NewRequestAndEntry(/* aForcePrincipalCheckForCacheEntry = */ true, this,
2633                        originalURIKey, getter_AddRefs(request),
2634                        getter_AddRefs(entry));
2635
2636     // No principal specified here, because we're not passed one.
2637     // In LoadImageWithChannel, the redirects that may have been
2638     // associated with this load would have gone through necko.
2639     // We only have the final URI in ImageLib and hence don't know
2640     // if the request went through insecure redirects.  But if it did,
2641     // the necko cache should have handled that (since all necko cache hits
2642     // including the redirects will go through content policy).  Hence, we
2643     // can set aHadInsecureRedirect to false here.
2644     rv = request->Init(originalURI, uri, /* aHadInsecureRedirect = */ false,
2645                        channel, channel, entry, aLoadingDocument, nullptr,
2646                        CORS_NONE, nullptr);
2647     NS_ENSURE_SUCCESS(rv, rv);
2648
2649     RefPtr<ProxyListener> pl =
2650         new ProxyListener(static_cast<nsIStreamListener*>(request.get()));
2651     pl.forget(listener);
2652
2653     // Try to add the new request into the cache.
2654     PutIntoCache(originalURIKey, entry);
2655
2656     rv = CreateNewProxyForRequest(request, originalURI, loadGroup,
2657                                   aLoadingDocument, aObserver, requestFlags,
2658                                   _retval);
2659
2660     // Explicitly don't notify our proxy, because we're loading off the
2661     // network, and necko (or things called from necko, such as
2662     // imgCacheValidator) are going to call our notifications asynchronously,
2663     // and we can't make it further asynchronous because observers might rely
2664     // on imagelib completing its work between the channel's OnStartRequest and
2665     // OnStopRequest.
2666   }
2667
2668   if (NS_FAILED(rv)) {
2669     return rv;
2670   }
2671
2672   (*_retval)->AddToLoadGroup();
2673   return rv;
2674 }
2675
2676 bool imgLoader::SupportImageWithMimeType(const nsACString& aMimeType,
2677                                          AcceptedMimeTypes aAccept
2678                                          /* = AcceptedMimeTypes::IMAGES */) {
2679   nsAutoCString mimeType(aMimeType);
2680   ToLowerCase(mimeType);
2681
2682   if (aAccept == AcceptedMimeTypes::IMAGES_AND_DOCUMENTS &&
2683       mimeType.EqualsLiteral("image/svg+xml")) {
2684     return true;
2685   }
2686
2687   DecoderType type = DecoderFactory::GetDecoderType(mimeType.get());
2688   return type != DecoderType::UNKNOWN;
2689 }
2690
2691 NS_IMETHODIMP
2692 imgLoader::GetMIMETypeFromContent(nsIRequest* aRequest,
2693                                   const uint8_t* aContents, uint32_t aLength,
2694                                   nsACString& aContentType) {
2695   nsCOMPtr<nsIChannel> channel(do_QueryInterface(aRequest));
2696   if (channel) {
2697     nsCOMPtr<nsILoadInfo> loadInfo = channel->LoadInfo();
2698     if (loadInfo->GetSkipContentSniffing()) {
2699       return NS_ERROR_NOT_AVAILABLE;
2700     }
2701   }
2702
2703   nsresult rv =
2704       GetMimeTypeFromContent((const char*)aContents, aLength, aContentType);
2705   if (NS_SUCCEEDED(rv) && channel && XRE_IsParentProcess()) {
2706     if (RefPtr<mozilla::net::nsHttpChannel> httpChannel =
2707             do_QueryObject(channel)) {
2708       // If the image type pattern matching algorithm given bytes does not
2709       // return undefined, then disable the further check and allow the
2710       // response.
2711       httpChannel->DisableIsOpaqueResponseAllowedAfterSniffCheck(
2712           mozilla::net::nsHttpChannel::SnifferType::Image);
2713     }
2714   }
2715
2716   return rv;
2717 }
2718
2719 /* static */
2720 nsresult imgLoader::GetMimeTypeFromContent(const char* aContents,
2721                                            uint32_t aLength,
2722                                            nsACString& aContentType) {
2723   nsAutoCString detected;
2724
2725   /* Is it a GIF? */
2726   if (aLength >= 6 &&
2727       (!strncmp(aContents, "GIF87a", 6) || !strncmp(aContents, "GIF89a", 6))) {
2728     aContentType.AssignLiteral(IMAGE_GIF);
2729
2730     /* or a PNG? */
2731   } else if (aLength >= 8 && ((unsigned char)aContents[0] == 0x89 &&
2732                               (unsigned char)aContents[1] == 0x50 &&
2733                               (unsigned char)aContents[2] == 0x4E &&
2734                               (unsigned char)aContents[3] == 0x47 &&
2735                               (unsigned char)aContents[4] == 0x0D &&
2736                               (unsigned char)aContents[5] == 0x0A &&
2737                               (unsigned char)aContents[6] == 0x1A &&
2738                               (unsigned char)aContents[7] == 0x0A)) {
2739     aContentType.AssignLiteral(IMAGE_PNG);
2740
2741     /* maybe a JPEG (JFIF)? */
2742     /* JFIF files start with SOI APP0 but older files can start with SOI DQT
2743      * so we test for SOI followed by any marker, i.e. FF D8 FF
2744      * this will also work for SPIFF JPEG files if they appear in the future.
2745      *
2746      * (JFIF is 0XFF 0XD8 0XFF 0XE0 <skip 2> 0X4A 0X46 0X49 0X46 0X00)
2747      */
2748   } else if (aLength >= 3 && ((unsigned char)aContents[0]) == 0xFF &&
2749              ((unsigned char)aContents[1]) == 0xD8 &&
2750              ((unsigned char)aContents[2]) == 0xFF) {
2751     aContentType.AssignLiteral(IMAGE_JPEG);
2752
2753     /* or how about ART? */
2754     /* ART begins with JG (4A 47). Major version offset 2.
2755      * Minor version offset 3. Offset 4 must be nullptr.
2756      */
2757   } else if (aLength >= 5 && ((unsigned char)aContents[0]) == 0x4a &&
2758              ((unsigned char)aContents[1]) == 0x47 &&
2759              ((unsigned char)aContents[4]) == 0x00) {
2760     aContentType.AssignLiteral(IMAGE_ART);
2761
2762   } else if (aLength >= 2 && !strncmp(aContents, "BM", 2)) {
2763     aContentType.AssignLiteral(IMAGE_BMP);
2764
2765     // ICOs always begin with a 2-byte 0 followed by a 2-byte 1.
2766     // CURs begin with 2-byte 0 followed by 2-byte 2.
2767   } else if (aLength >= 4 && (!memcmp(aContents, "\000\000\001\000", 4) ||
2768                               !memcmp(aContents, "\000\000\002\000", 4))) {
2769     aContentType.AssignLiteral(IMAGE_ICO);
2770
2771     // WebPs always begin with RIFF, a 32-bit length, and WEBP.
2772   } else if (aLength >= 12 && !memcmp(aContents, "RIFF", 4) &&
2773              !memcmp(aContents + 8, "WEBP", 4)) {
2774     aContentType.AssignLiteral(IMAGE_WEBP);
2775
2776   } else if (MatchesMP4(reinterpret_cast<const uint8_t*>(aContents), aLength,
2777                         detected) &&
2778              detected.Equals(IMAGE_AVIF)) {
2779     aContentType.AssignLiteral(IMAGE_AVIF);
2780   } else if ((aLength >= 2 && !memcmp(aContents, "\xFF\x0A", 2)) ||
2781              (aLength >= 12 &&
2782               !memcmp(aContents, "\x00\x00\x00\x0CJXL \x0D\x0A\x87\x0A", 12))) {
2783     // Each version is for containerless and containerful files respectively.
2784     aContentType.AssignLiteral(IMAGE_JXL);
2785   } else {
2786     /* none of the above?  I give up */
2787     return NS_ERROR_NOT_AVAILABLE;
2788   }
2789
2790   return NS_OK;
2791 }
2792
2793 /**
2794  * proxy stream listener class used to handle multipart/x-mixed-replace
2795  */
2796
2797 #include "nsIRequest.h"
2798 #include "nsIStreamConverterService.h"
2799
2800 NS_IMPL_ISUPPORTS(ProxyListener, nsIStreamListener,
2801                   nsIThreadRetargetableStreamListener, nsIRequestObserver)
2802
2803 ProxyListener::ProxyListener(nsIStreamListener* dest) : mDestListener(dest) {
2804   /* member initializers and constructor code */
2805 }
2806
2807 ProxyListener::~ProxyListener() { /* destructor code */
2808 }
2809
2810 /** nsIRequestObserver methods **/
2811
2812 NS_IMETHODIMP
2813 ProxyListener::OnStartRequest(nsIRequest* aRequest) {
2814   if (!mDestListener) {
2815     return NS_ERROR_FAILURE;
2816   }
2817
2818   nsCOMPtr<nsIChannel> channel(do_QueryInterface(aRequest));
2819   if (channel) {
2820     // We need to set the initiator type for the image load
2821     nsCOMPtr<nsITimedChannel> timedChannel = do_QueryInterface(channel);
2822     if (timedChannel) {
2823       nsAutoString type;
2824       timedChannel->GetInitiatorType(type);
2825       if (type.IsEmpty()) {
2826         timedChannel->SetInitiatorType(u"img"_ns);
2827       }
2828     }
2829
2830     nsAutoCString contentType;
2831     nsresult rv = channel->GetContentType(contentType);
2832
2833     if (!contentType.IsEmpty()) {
2834       /* If multipart/x-mixed-replace content, we'll insert a MIME decoder
2835          in the pipeline to handle the content and pass it along to our
2836          original listener.
2837        */
2838       if ("multipart/x-mixed-replace"_ns.Equals(contentType)) {
2839         nsCOMPtr<nsIStreamConverterService> convServ(
2840             do_GetService("@mozilla.org/streamConverters;1", &rv));
2841         if (NS_SUCCEEDED(rv)) {
2842           nsCOMPtr<nsIStreamListener> toListener(mDestListener);
2843           nsCOMPtr<nsIStreamListener> fromListener;
2844
2845           rv = convServ->AsyncConvertData("multipart/x-mixed-replace", "*/*",
2846                                           toListener, nullptr,
2847                                           getter_AddRefs(fromListener));
2848           if (NS_SUCCEEDED(rv)) {
2849             mDestListener = fromListener;
2850           }
2851         }
2852       }
2853     }
2854   }
2855
2856   return mDestListener->OnStartRequest(aRequest);
2857 }
2858
2859 NS_IMETHODIMP
2860 ProxyListener::OnStopRequest(nsIRequest* aRequest, nsresult status) {
2861   if (!mDestListener) {
2862     return NS_ERROR_FAILURE;
2863   }
2864
2865   return mDestListener->OnStopRequest(aRequest, status);
2866 }
2867
2868 /** nsIStreamListener methods **/
2869
2870 NS_IMETHODIMP
2871 ProxyListener::OnDataAvailable(nsIRequest* aRequest, nsIInputStream* inStr,
2872                                uint64_t sourceOffset, uint32_t count) {
2873   if (!mDestListener) {
2874     return NS_ERROR_FAILURE;
2875   }
2876
2877   return mDestListener->OnDataAvailable(aRequest, inStr, sourceOffset, count);
2878 }
2879
2880 /** nsThreadRetargetableStreamListener methods **/
2881 NS_IMETHODIMP
2882 ProxyListener::CheckListenerChain() {
2883   NS_ASSERTION(NS_IsMainThread(), "Should be on the main thread!");
2884   nsresult rv = NS_OK;
2885   nsCOMPtr<nsIThreadRetargetableStreamListener> retargetableListener =
2886       do_QueryInterface(mDestListener, &rv);
2887   if (retargetableListener) {
2888     rv = retargetableListener->CheckListenerChain();
2889   }
2890   MOZ_LOG(
2891       gImgLog, LogLevel::Debug,
2892       ("ProxyListener::CheckListenerChain %s [this=%p listener=%p rv=%" PRIx32
2893        "]",
2894        (NS_SUCCEEDED(rv) ? "success" : "failure"), this,
2895        (nsIStreamListener*)mDestListener, static_cast<uint32_t>(rv)));
2896   return rv;
2897 }
2898
2899 /**
2900  * http validate class.  check a channel for a 304
2901  */
2902
2903 NS_IMPL_ISUPPORTS(imgCacheValidator, nsIStreamListener, nsIRequestObserver,
2904                   nsIThreadRetargetableStreamListener, nsIChannelEventSink,
2905                   nsIInterfaceRequestor, nsIAsyncVerifyRedirectCallback)
2906
2907 imgCacheValidator::imgCacheValidator(nsProgressNotificationProxy* progress,
2908                                      imgLoader* loader, imgRequest* request,
2909                                      Document* aDocument,
2910                                      uint64_t aInnerWindowId,
2911                                      bool forcePrincipalCheckForCacheEntry)
2912     : mProgressProxy(progress),
2913       mRequest(request),
2914       mDocument(aDocument),
2915       mInnerWindowId(aInnerWindowId),
2916       mImgLoader(loader),
2917       mHadInsecureRedirect(false) {
2918   NewRequestAndEntry(forcePrincipalCheckForCacheEntry, loader,
2919                      mRequest->CacheKey(), getter_AddRefs(mNewRequest),
2920                      getter_AddRefs(mNewEntry));
2921 }
2922
2923 imgCacheValidator::~imgCacheValidator() {
2924   if (mRequest) {
2925     // If something went wrong, and we never unblocked the requests waiting on
2926     // validation, now is our last chance. We will cancel the new request and
2927     // switch the waiting proxies to it.
2928     UpdateProxies(/* aCancelRequest */ true, /* aSyncNotify */ false);
2929   }
2930 }
2931
2932 void imgCacheValidator::AddProxy(imgRequestProxy* aProxy) {
2933   // aProxy needs to be in the loadgroup since we're validating from
2934   // the network.
2935   aProxy->AddToLoadGroup();
2936
2937   mProxies.AppendElement(aProxy);
2938 }
2939
2940 void imgCacheValidator::RemoveProxy(imgRequestProxy* aProxy) {
2941   mProxies.RemoveElement(aProxy);
2942 }
2943
2944 void imgCacheValidator::UpdateProxies(bool aCancelRequest, bool aSyncNotify) {
2945   MOZ_ASSERT(mRequest);
2946
2947   // Clear the validator before updating the proxies. The notifications may
2948   // clone an existing request, and its state could be inconsistent.
2949   mRequest->SetValidator(nullptr);
2950   mRequest = nullptr;
2951
2952   // If an error occurred, we will want to cancel the new request, and make the
2953   // validating proxies point to it. Any proxies still bound to the original
2954   // request which are not validating should remain untouched.
2955   if (aCancelRequest) {
2956     MOZ_ASSERT(mNewRequest);
2957     mNewRequest->CancelAndAbort(NS_BINDING_ABORTED);
2958   }
2959
2960   // We have finished validating the request, so we can safely take ownership
2961   // of the proxy list. imgRequestProxy::SyncNotifyListener can mutate the list
2962   // if imgRequestProxy::CancelAndForgetObserver is called by its owner. Note
2963   // that any potential notifications should still be suppressed in
2964   // imgRequestProxy::ChangeOwner because we haven't cleared the validating
2965   // flag yet, and thus they will remain deferred.
2966   AutoTArray<RefPtr<imgRequestProxy>, 4> proxies(std::move(mProxies));
2967
2968   for (auto& proxy : proxies) {
2969     // First update the state of all proxies before notifying any of them
2970     // to ensure a consistent state (e.g. in case the notification causes
2971     // other proxies to be touched indirectly.)
2972     MOZ_ASSERT(proxy->IsValidating());
2973     MOZ_ASSERT(proxy->NotificationsDeferred(),
2974                "Proxies waiting on cache validation should be "
2975                "deferring notifications!");
2976     if (mNewRequest) {
2977       proxy->ChangeOwner(mNewRequest);
2978     }
2979     proxy->ClearValidating();
2980   }
2981
2982   mNewRequest = nullptr;
2983   mNewEntry = nullptr;
2984
2985   for (auto& proxy : proxies) {
2986     if (aSyncNotify) {
2987       // Notify synchronously, because the caller knows we are already in an
2988       // asynchronously-called function (e.g. OnStartRequest).
2989       proxy->SyncNotifyListener();
2990     } else {
2991       // Notify asynchronously, because the caller does not know our current
2992       // call state (e.g. ~imgCacheValidator).
2993       proxy->NotifyListener();
2994     }
2995   }
2996 }
2997
2998 /** nsIRequestObserver methods **/
2999
3000 NS_IMETHODIMP
3001 imgCacheValidator::OnStartRequest(nsIRequest* aRequest) {
3002   // We may be holding on to a document, so ensure that it's released.
3003   RefPtr<Document> document = mDocument.forget();
3004
3005   // If for some reason we don't still have an existing request (probably
3006   // because OnStartRequest got delivered more than once), just bail.
3007   if (!mRequest) {
3008     MOZ_ASSERT_UNREACHABLE("OnStartRequest delivered more than once?");
3009     aRequest->Cancel(NS_BINDING_ABORTED);
3010     return NS_ERROR_FAILURE;
3011   }
3012
3013   // If this request is coming from cache and has the same URI as our
3014   // imgRequest, the request all our proxies are pointing at is valid, and all
3015   // we have to do is tell them to notify their listeners.
3016   nsCOMPtr<nsICacheInfoChannel> cacheChan(do_QueryInterface(aRequest));
3017   nsCOMPtr<nsIChannel> channel(do_QueryInterface(aRequest));
3018   if (cacheChan && channel) {
3019     bool isFromCache = false;
3020     cacheChan->IsFromCache(&isFromCache);
3021
3022     nsCOMPtr<nsIURI> channelURI;
3023     channel->GetURI(getter_AddRefs(channelURI));
3024
3025     nsCOMPtr<nsIURI> finalURI;
3026     mRequest->GetFinalURI(getter_AddRefs(finalURI));
3027
3028     bool sameURI = false;
3029     if (channelURI && finalURI) {
3030       channelURI->Equals(finalURI, &sameURI);
3031     }
3032
3033     if (isFromCache && sameURI) {
3034       // We don't need to load this any more.
3035       aRequest->Cancel(NS_BINDING_ABORTED);
3036       mNewRequest = nullptr;
3037
3038       // Clear the validator before updating the proxies. The notifications may
3039       // clone an existing request, and its state could be inconsistent.
3040       mRequest->SetLoadId(document);
3041       mRequest->SetInnerWindowID(mInnerWindowId);
3042       UpdateProxies(/* aCancelRequest */ false, /* aSyncNotify */ true);
3043       return NS_OK;
3044     }
3045   }
3046
3047   // We can't load out of cache. We have to create a whole new request for the
3048   // data that's coming in off the channel.
3049   nsCOMPtr<nsIURI> uri;
3050   mRequest->GetURI(getter_AddRefs(uri));
3051
3052   LOG_MSG_WITH_PARAM(gImgLog,
3053                      "imgCacheValidator::OnStartRequest creating new request",
3054                      "uri", uri);
3055
3056   CORSMode corsmode = mRequest->GetCORSMode();
3057   nsCOMPtr<nsIReferrerInfo> referrerInfo = mRequest->GetReferrerInfo();
3058   nsCOMPtr<nsIPrincipal> triggeringPrincipal =
3059       mRequest->GetTriggeringPrincipal();
3060
3061   // Doom the old request's cache entry
3062   mRequest->RemoveFromCache();
3063
3064   // We use originalURI here to fulfil the imgIRequest contract on GetURI.
3065   nsCOMPtr<nsIURI> originalURI;
3066   channel->GetOriginalURI(getter_AddRefs(originalURI));
3067   nsresult rv = mNewRequest->Init(originalURI, uri, mHadInsecureRedirect,
3068                                   aRequest, channel, mNewEntry, document,
3069                                   triggeringPrincipal, corsmode, referrerInfo);
3070   if (NS_FAILED(rv)) {
3071     UpdateProxies(/* aCancelRequest */ true, /* aSyncNotify */ true);
3072     return rv;
3073   }
3074
3075   mDestListener = new ProxyListener(mNewRequest);
3076
3077   // Try to add the new request into the cache. Note that the entry must be in
3078   // the cache before the proxies' ownership changes, because adding a proxy
3079   // changes the caching behaviour for imgRequests.
3080   mImgLoader->PutIntoCache(mNewRequest->CacheKey(), mNewEntry);
3081   UpdateProxies(/* aCancelRequest */ false, /* aSyncNotify */ true);
3082   return mDestListener->OnStartRequest(aRequest);
3083 }
3084
3085 NS_IMETHODIMP
3086 imgCacheValidator::OnStopRequest(nsIRequest* aRequest, nsresult status) {
3087   // Be sure we've released the document that we may have been holding on to.
3088   mDocument = nullptr;
3089
3090   if (!mDestListener) {
3091     return NS_OK;
3092   }
3093
3094   return mDestListener->OnStopRequest(aRequest, status);
3095 }
3096
3097 /** nsIStreamListener methods **/
3098
3099 NS_IMETHODIMP
3100 imgCacheValidator::OnDataAvailable(nsIRequest* aRequest, nsIInputStream* inStr,
3101                                    uint64_t sourceOffset, uint32_t count) {
3102   if (!mDestListener) {
3103     // XXX see bug 113959
3104     uint32_t _retval;
3105     inStr->ReadSegments(NS_DiscardSegment, nullptr, count, &_retval);
3106     return NS_OK;
3107   }
3108
3109   return mDestListener->OnDataAvailable(aRequest, inStr, sourceOffset, count);
3110 }
3111
3112 /** nsIThreadRetargetableStreamListener methods **/
3113
3114 NS_IMETHODIMP
3115 imgCacheValidator::CheckListenerChain() {
3116   NS_ASSERTION(NS_IsMainThread(), "Should be on the main thread!");
3117   nsresult rv = NS_OK;
3118   nsCOMPtr<nsIThreadRetargetableStreamListener> retargetableListener =
3119       do_QueryInterface(mDestListener, &rv);
3120   if (retargetableListener) {
3121     rv = retargetableListener->CheckListenerChain();
3122   }
3123   MOZ_LOG(
3124       gImgLog, LogLevel::Debug,
3125       ("[this=%p] imgCacheValidator::CheckListenerChain -- rv %" PRId32 "=%s",
3126        this, static_cast<uint32_t>(rv),
3127        NS_SUCCEEDED(rv) ? "succeeded" : "failed"));
3128   return rv;
3129 }
3130
3131 /** nsIInterfaceRequestor methods **/
3132
3133 NS_IMETHODIMP
3134 imgCacheValidator::GetInterface(const nsIID& aIID, void** aResult) {
3135   if (aIID.Equals(NS_GET_IID(nsIChannelEventSink))) {
3136     return QueryInterface(aIID, aResult);
3137   }
3138
3139   return mProgressProxy->GetInterface(aIID, aResult);
3140 }
3141
3142 // These functions are materially the same as the same functions in imgRequest.
3143 // We duplicate them because we're verifying whether cache loads are necessary,
3144 // not unconditionally loading.
3145
3146 /** nsIChannelEventSink methods **/
3147 NS_IMETHODIMP
3148 imgCacheValidator::AsyncOnChannelRedirect(
3149     nsIChannel* oldChannel, nsIChannel* newChannel, uint32_t flags,
3150     nsIAsyncVerifyRedirectCallback* callback) {
3151   // Note all cache information we get from the old channel.
3152   mNewRequest->SetCacheValidation(mNewEntry, oldChannel);
3153
3154   // If the previous URI is a non-HTTPS URI, record that fact for later use by
3155   // security code, which needs to know whether there is an insecure load at any
3156   // point in the redirect chain.
3157   nsCOMPtr<nsIURI> oldURI;
3158   bool schemeLocal = false;
3159   if (NS_FAILED(oldChannel->GetURI(getter_AddRefs(oldURI))) ||
3160       NS_FAILED(NS_URIChainHasFlags(
3161           oldURI, nsIProtocolHandler::URI_IS_LOCAL_RESOURCE, &schemeLocal)) ||
3162       (!oldURI->SchemeIs("https") && !oldURI->SchemeIs("chrome") &&
3163        !schemeLocal)) {
3164     mHadInsecureRedirect = true;
3165   }
3166
3167   // Prepare for callback
3168   mRedirectCallback = callback;
3169   mRedirectChannel = newChannel;
3170
3171   return mProgressProxy->AsyncOnChannelRedirect(oldChannel, newChannel, flags,
3172                                                 this);
3173 }
3174
3175 NS_IMETHODIMP
3176 imgCacheValidator::OnRedirectVerifyCallback(nsresult aResult) {
3177   // If we've already been told to abort, just do so.
3178   if (NS_FAILED(aResult)) {
3179     mRedirectCallback->OnRedirectVerifyCallback(aResult);
3180     mRedirectCallback = nullptr;
3181     mRedirectChannel = nullptr;
3182     return NS_OK;
3183   }
3184
3185   // make sure we have a protocol that returns data rather than opens
3186   // an external application, e.g. mailto:
3187   nsCOMPtr<nsIURI> uri;
3188   mRedirectChannel->GetURI(getter_AddRefs(uri));
3189   bool doesNotReturnData = false;
3190   NS_URIChainHasFlags(uri, nsIProtocolHandler::URI_DOES_NOT_RETURN_DATA,
3191                       &doesNotReturnData);
3192
3193   nsresult result = NS_OK;
3194
3195   if (doesNotReturnData) {
3196     result = NS_ERROR_ABORT;
3197   }
3198
3199   mRedirectCallback->OnRedirectVerifyCallback(result);
3200   mRedirectCallback = nullptr;
3201   mRedirectChannel = nullptr;
3202   return NS_OK;
3203 }