dom/base/nsImageLoadingContent.cpp

   1 /* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
   2 /* vim: set ts=8 sts=2 et sw=2 tw=80: */
   3 /* This Source Code Form is subject to the terms of the Mozilla Public
   4  * License, v. 2.0. If a copy of the MPL was not distributed with this
   5  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
   6
   7 /*
   8  * A base class which implements nsIImageLoadingContent and can be
   9  * subclassed by various content nodes that want to provide image
  10  * loading functionality (eg <img>, <object>, etc).
  11  */
  12
  13 #include "nsImageLoadingContent.h"
  14 #include "nsError.h"
  15 #include "nsIContent.h"
  16 #include "nsIScriptGlobalObject.h"
  17 #include "nsServiceManagerUtils.h"
  18 #include "nsContentList.h"
  19 #include "nsContentPolicyUtils.h"
  20 #include "nsIURI.h"
  21 #include "imgIContainer.h"
  22 #include "imgLoader.h"
  23 #include "imgRequestProxy.h"
  24 #include "nsThreadUtils.h"
  25 #include "nsNetUtil.h"
  26 #include "nsImageFrame.h"
  27
  28 #include "nsIChannel.h"
  29 #include "nsIStreamListener.h"
  30
  31 #include "nsIFrame.h"
  32
  33 #include "nsContentUtils.h"
  34 #include "nsLayoutUtils.h"
  35 #include "nsIContentPolicy.h"
  36
  37 #include "mozAutoDocUpdate.h"
  38 #include "mozilla/AsyncEventDispatcher.h"
  39 #include "mozilla/AutoRestore.h"
  40 #include "mozilla/CycleCollectedJSContext.h"
  41 #include "mozilla/EventStateManager.h"
  42 #include "mozilla/Preferences.h"
  43 #include "mozilla/PresShell.h"
  44 #include "mozilla/StaticPrefs_image.h"
  45 #include "mozilla/SVGImageFrame.h"
  46 #include "mozilla/SVGObserverUtils.h"
  47 #include "mozilla/dom/BindContext.h"
  48 #include "mozilla/dom/Document.h"
  49 #include "mozilla/dom/Element.h"
  50 #include "mozilla/dom/FetchPriority.h"
  51 #include "mozilla/dom/PContent.h"  // For TextRecognitionResult
  52 #include "mozilla/dom/HTMLImageElement.h"
  53 #include "mozilla/dom/ImageTextBinding.h"
  54 #include "mozilla/dom/ImageTracker.h"
  55 #include "mozilla/dom/ReferrerInfo.h"
  56 #include "mozilla/dom/ScriptSettings.h"
  57 #include "mozilla/intl/LocaleService.h"
  58 #include "mozilla/intl/Locale.h"
  59 #include "mozilla/dom/LargestContentfulPaint.h"
  60 #include "mozilla/net/UrlClassifierFeatureFactory.h"
  61 #include "mozilla/widget/TextRecognition.h"
  62
  63 #include "Orientation.h"
  64
  65 #ifdef LoadImage
  66 // Undefine LoadImage to prevent naming conflict with Windows.
  67 #  undef LoadImage
  68 #endif
  69
  70 using namespace mozilla;
  71 using namespace mozilla::dom;
  72
  73 #ifdef DEBUG_chb
  74 static void PrintReqURL(imgIRequest* req) {
  75   if (!req) {
  76     printf("(null req)\n");
  77     return;
  78   }
  79
  80   nsCOMPtr<nsIURI> uri;
  81   req->GetURI(getter_AddRefs(uri));
  82   if (!uri) {
  83     printf("(null uri)\n");
  84     return;
  85   }
  86
  87   nsAutoCString spec;
  88   uri->GetSpec(spec);
  89   printf("spec='%s'\n", spec.get());
  90 }
  91 #endif /* DEBUG_chb */
  92
  93 const nsAttrValue::EnumTable nsImageLoadingContent::kDecodingTable[] = {
  94     {"auto", nsImageLoadingContent::ImageDecodingType::Auto},
  95     {"async", nsImageLoadingContent::ImageDecodingType::Async},
  96     {"sync", nsImageLoadingContent::ImageDecodingType::Sync},
  97     {nullptr, 0}};
  98
  99 const nsAttrValue::EnumTable* nsImageLoadingContent::kDecodingTableDefault =
 100     &nsImageLoadingContent::kDecodingTable[0];
 101
 102 nsImageLoadingContent::nsImageLoadingContent()
 103     : mObserverList(nullptr),
 104       mOutstandingDecodePromises(0),
 105       mRequestGeneration(0),
 106       mLoadingEnabled(true),
 107       mLoading(false),
 108       mNewRequestsWillNeedAnimationReset(false),
 109       mUseUrgentStartForChannel(false),
 110       mLazyLoading(false),
 111       mStateChangerDepth(0),
 112       mCurrentRequestRegistered(false),
 113       mPendingRequestRegistered(false),
 114       mIsStartingImageLoad(false),
 115       mSyncDecodingHint(false) {
 116   if (!nsContentUtils::GetImgLoaderForChannel(nullptr, nullptr)) {
 117     mLoadingEnabled = false;
 118   }
 119
 120   mMostRecentRequestChange = TimeStamp::ProcessCreation();
 121 }
 122
 123 void nsImageLoadingContent::Destroy() {
 124   // Cancel our requests so they won't hold stale refs to us
 125   // NB: Don't ask to discard the images here.
 126   RejectDecodePromises(NS_ERROR_DOM_IMAGE_INVALID_REQUEST);
 127   ClearCurrentRequest(NS_BINDING_ABORTED);
 128   ClearPendingRequest(NS_BINDING_ABORTED);
 129 }
 130
 131 nsImageLoadingContent::~nsImageLoadingContent() {
 132   MOZ_ASSERT(!mCurrentRequest && !mPendingRequest, "Destroy not called");
 133   MOZ_ASSERT(!mObserverList.mObserver && !mObserverList.mNext,
 134              "Observers still registered?");
 135   MOZ_ASSERT(mScriptedObservers.IsEmpty(),
 136              "Scripted observers still registered?");
 137   MOZ_ASSERT(mOutstandingDecodePromises == 0,
 138              "Decode promises still unfulfilled?");
 139   MOZ_ASSERT(mDecodePromises.IsEmpty(), "Decode promises still unfulfilled?");
 140 }
 141
 142 /*
 143  * imgINotificationObserver impl
 144  */
 145 void nsImageLoadingContent::Notify(imgIRequest* aRequest, int32_t aType,
 146                                    const nsIntRect* aData) {
 147   MOZ_ASSERT(aRequest, "no request?");
 148   MOZ_ASSERT(aRequest == mCurrentRequest || aRequest == mPendingRequest,
 149              "Forgot to cancel a previous request?");
 150
 151   if (aType == imgINotificationObserver::IS_ANIMATED) {
 152     return OnImageIsAnimated(aRequest);
 153   }
 154
 155   if (aType == imgINotificationObserver::UNLOCKED_DRAW) {
 156     return OnUnlockedDraw();
 157   }
 158
 159   {
 160     // Calling Notify on observers can modify the list of observers so make
 161     // a local copy.
 162     AutoTArray<nsCOMPtr<imgINotificationObserver>, 2> observers;
 163     for (ImageObserver *observer = &mObserverList, *next; observer;
 164          observer = next) {
 165       next = observer->mNext;
 166       if (observer->mObserver) {
 167         observers.AppendElement(observer->mObserver);
 168       }
 169     }
 170
 171     nsAutoScriptBlocker scriptBlocker;
 172
 173     for (auto& observer : observers) {
 174       observer->Notify(aRequest, aType, aData);
 175     }
 176   }
 177
 178   if (aType == imgINotificationObserver::SIZE_AVAILABLE) {
 179     // Have to check for state changes here, since we might have been in
 180     // the LOADING state before.
 181     UpdateImageState(true);
 182   }
 183
 184   if (aType == imgINotificationObserver::LOAD_COMPLETE) {
 185     uint32_t reqStatus;
 186     aRequest->GetImageStatus(&reqStatus);
 187     /* triage STATUS_ERROR */
 188     if (reqStatus & imgIRequest::STATUS_ERROR) {
 189       nsresult errorCode = NS_OK;
 190       aRequest->GetImageErrorCode(&errorCode);
 191
 192       /* Handle image not loading error because source was a tracking URL (or
 193        * fingerprinting, cryptomining, etc).
 194        * We make a note of this image node by including it in a dedicated
 195        * array of blocked tracking nodes under its parent document.
 196        */
 197       if (net::UrlClassifierFeatureFactory::IsClassifierBlockingErrorCode(
 198               errorCode)) {
 199         Document* doc = GetOurOwnerDoc();
 200         doc->AddBlockedNodeByClassifier(AsContent());
 201       }
 202     }
 203     nsresult status =
 204         reqStatus & imgIRequest::STATUS_ERROR ? NS_ERROR_FAILURE : NS_OK;
 205     return OnLoadComplete(aRequest, status);
 206   }
 207
 208   if ((aType == imgINotificationObserver::FRAME_COMPLETE ||
 209        aType == imgINotificationObserver::FRAME_UPDATE) &&
 210       mCurrentRequest == aRequest) {
 211     MaybeResolveDecodePromises();
 212   }
 213
 214   if (aType == imgINotificationObserver::DECODE_COMPLETE) {
 215     nsCOMPtr<imgIContainer> container;
 216     aRequest->GetImage(getter_AddRefs(container));
 217     if (container) {
 218       container->PropagateUseCounters(GetOurOwnerDoc());
 219     }
 220
 221     UpdateImageState(true);
 222   }
 223 }
 224
 225 void nsImageLoadingContent::OnLoadComplete(imgIRequest* aRequest,
 226                                            nsresult aStatus) {
 227   uint32_t oldStatus;
 228   aRequest->GetImageStatus(&oldStatus);
 229
 230   // XXXjdm This occurs when we have a pending request created, then another
 231   //       pending request replaces it before the first one is finished.
 232   //       This begs the question of what the correct behaviour is; we used
 233   //       to not have to care because we ran this code in OnStopDecode which
 234   //       wasn't called when the first request was cancelled. For now, I choose
 235   //       to punt when the given request doesn't appear to have terminated in
 236   //       an expected state.
 237   if (!(oldStatus &
 238         (imgIRequest::STATUS_ERROR | imgIRequest::STATUS_LOAD_COMPLETE))) {
 239     return;
 240   }
 241
 242   // Our state may change. Watch it.
 243   AutoStateChanger changer(this, true);
 244
 245   // If the pending request is loaded, switch to it.
 246   if (aRequest == mPendingRequest) {
 247     MakePendingRequestCurrent();
 248   }
 249   MOZ_ASSERT(aRequest == mCurrentRequest,
 250              "One way or another, we should be current by now");
 251
 252   // Fire the appropriate DOM event.
 253   if (NS_SUCCEEDED(aStatus)) {
 254     FireEvent(u"load"_ns);
 255   } else {
 256     FireEvent(u"error"_ns);
 257   }
 258
 259   Element* element = AsContent()->AsElement();
 260   SVGObserverUtils::InvalidateDirectRenderingObservers(element);
 261   MaybeResolveDecodePromises();
 262   LargestContentfulPaint::MaybeProcessImageForElementTiming(mCurrentRequest,
 263                                                             element);
 264 }
 265
 266 void nsImageLoadingContent::OnUnlockedDraw() {
 267   // This notification is only sent for animated images. It's OK for
 268   // non-animated images to wait until the next frame visibility update to
 269   // become locked. (And that's preferable, since in the case of scrolling it
 270   // keeps memory usage minimal.)
 271   //
 272   // For animated images, though, we want to mark them visible right away so we
 273   // can call IncrementAnimationConsumers() on them and they'll start animating.
 274
 275   nsIFrame* frame = GetOurPrimaryImageFrame();
 276   if (!frame) {
 277     return;
 278   }
 279
 280   if (frame->GetVisibility() == Visibility::ApproximatelyVisible) {
 281     // This frame is already marked visible; there's nothing to do.
 282     return;
 283   }
 284
 285   nsPresContext* presContext = frame->PresContext();
 286   if (!presContext) {
 287     return;
 288   }
 289
 290   PresShell* presShell = presContext->GetPresShell();
 291   if (!presShell) {
 292     return;
 293   }
 294
 295   presShell->EnsureFrameInApproximatelyVisibleList(frame);
 296 }
 297
 298 void nsImageLoadingContent::OnImageIsAnimated(imgIRequest* aRequest) {
 299   bool* requestFlag = nullptr;
 300   if (aRequest == mCurrentRequest) {
 301     requestFlag = &mCurrentRequestRegistered;
 302   } else if (aRequest == mPendingRequest) {
 303     requestFlag = &mPendingRequestRegistered;
 304   } else {
 305     MOZ_ASSERT_UNREACHABLE("Which image is this?");
 306     return;
 307   }
 308   nsLayoutUtils::RegisterImageRequest(GetFramePresContext(), aRequest,
 309                                       requestFlag);
 310 }
 311
 312 static bool IsOurImageFrame(nsIFrame* aFrame) {
 313   if (nsImageFrame* f = do_QueryFrame(aFrame)) {
 314     return f->IsForImageLoadingContent();
 315   }
 316   return aFrame->IsSVGImageFrame() || aFrame->IsSVGFEImageFrame();
 317 }
 318
 319 nsIFrame* nsImageLoadingContent::GetOurPrimaryImageFrame() {
 320   nsIFrame* frame = AsContent()->GetPrimaryFrame();
 321   if (!frame || !IsOurImageFrame(frame)) {
 322     return nullptr;
 323   }
 324   return frame;
 325 }
 326
 327 /*
 328  * nsIImageLoadingContent impl
 329  */
 330
 331 void nsImageLoadingContent::SetLoadingEnabled(bool aLoadingEnabled) {
 332   if (nsContentUtils::GetImgLoaderForChannel(nullptr, nullptr)) {
 333     mLoadingEnabled = aLoadingEnabled;
 334   }
 335 }
 336
 337 nsresult nsImageLoadingContent::GetSyncDecodingHint(bool* aHint) {
 338   *aHint = mSyncDecodingHint;
 339   return NS_OK;
 340 }
 341
 342 already_AddRefed<Promise> nsImageLoadingContent::QueueDecodeAsync(
 343     ErrorResult& aRv) {
 344   Document* doc = GetOurOwnerDoc();
 345   RefPtr<Promise> promise = Promise::Create(doc->GetScopeObject(), aRv);
 346   if (aRv.Failed()) {
 347     return nullptr;
 348   }
 349
 350   class QueueDecodeTask final : public MicroTaskRunnable {
 351    public:
 352     QueueDecodeTask(nsImageLoadingContent* aOwner, Promise* aPromise,
 353                     uint32_t aRequestGeneration)
 354         : mOwner(aOwner),
 355           mPromise(aPromise),
 356           mRequestGeneration(aRequestGeneration) {}
 357
 358     virtual void Run(AutoSlowOperation& aAso) override {
 359       mOwner->DecodeAsync(std::move(mPromise), mRequestGeneration);
 360     }
 361
 362     virtual bool Suppressed() override {
 363       nsIGlobalObject* global = mOwner->GetOurOwnerDoc()->GetScopeObject();
 364       return global && global->IsInSyncOperation();
 365     }
 366
 367    private:
 368     RefPtr<nsImageLoadingContent> mOwner;
 369     RefPtr<Promise> mPromise;
 370     uint32_t mRequestGeneration;
 371   };
 372
 373   if (++mOutstandingDecodePromises == 1) {
 374     MOZ_ASSERT(mDecodePromises.IsEmpty());
 375     doc->RegisterActivityObserver(AsContent()->AsElement());
 376   }
 377
 378   auto task = MakeRefPtr<QueueDecodeTask>(this, promise, mRequestGeneration);
 379   CycleCollectedJSContext::Get()->DispatchToMicroTask(task.forget());
 380   return promise.forget();
 381 }
 382
 383 void nsImageLoadingContent::DecodeAsync(RefPtr<Promise>&& aPromise,
 384                                         uint32_t aRequestGeneration) {
 385   MOZ_ASSERT(aPromise);
 386   MOZ_ASSERT(mOutstandingDecodePromises > mDecodePromises.Length());
 387
 388   // The request may have gotten updated since the decode call was issued.
 389   if (aRequestGeneration != mRequestGeneration) {
 390     aPromise->MaybeReject(NS_ERROR_DOM_IMAGE_INVALID_REQUEST);
 391     // We never got placed in mDecodePromises, so we must ensure we decrement
 392     // the counter explicitly.
 393     --mOutstandingDecodePromises;
 394     MaybeDeregisterActivityObserver();
 395     return;
 396   }
 397
 398   bool wasEmpty = mDecodePromises.IsEmpty();
 399   mDecodePromises.AppendElement(std::move(aPromise));
 400   if (wasEmpty) {
 401     MaybeResolveDecodePromises();
 402   }
 403 }
 404
 405 void nsImageLoadingContent::MaybeResolveDecodePromises() {
 406   if (mDecodePromises.IsEmpty()) {
 407     return;
 408   }
 409
 410   if (!mCurrentRequest) {
 411     RejectDecodePromises(NS_ERROR_DOM_IMAGE_INVALID_REQUEST);
 412     return;
 413   }
 414
 415   // Only can resolve if our document is the active document. If not we are
 416   // supposed to reject the promise, even if it was fulfilled successfully.
 417   if (!GetOurOwnerDoc()->IsCurrentActiveDocument()) {
 418     RejectDecodePromises(NS_ERROR_DOM_IMAGE_INACTIVE_DOCUMENT);
 419     return;
 420   }
 421
 422   // If any error occurred while decoding, we need to reject first.
 423   uint32_t status = imgIRequest::STATUS_NONE;
 424   mCurrentRequest->GetImageStatus(&status);
 425   if (status & imgIRequest::STATUS_ERROR) {
 426     RejectDecodePromises(NS_ERROR_DOM_IMAGE_BROKEN);
 427     return;
 428   }
 429
 430   // We need the size to bother with requesting a decode, as we are either
 431   // blocked on validation or metadata decoding.
 432   if (!(status & imgIRequest::STATUS_SIZE_AVAILABLE)) {
 433     return;
 434   }
 435
 436   // Check the surface cache status and/or request decoding begin. We do this
 437   // before LOAD_COMPLETE because we want to start as soon as possible.
 438   uint32_t flags = imgIContainer::FLAG_HIGH_QUALITY_SCALING |
 439                    imgIContainer::FLAG_AVOID_REDECODE_FOR_SIZE;
 440   imgIContainer::DecodeResult decodeResult =
 441       mCurrentRequest->RequestDecodeWithResult(flags);
 442   if (decodeResult == imgIContainer::DECODE_REQUESTED) {
 443     return;
 444   }
 445   if (decodeResult == imgIContainer::DECODE_REQUEST_FAILED) {
 446     RejectDecodePromises(NS_ERROR_DOM_IMAGE_BROKEN);
 447     return;
 448   }
 449   MOZ_ASSERT(decodeResult == imgIContainer::DECODE_SURFACE_AVAILABLE);
 450
 451   // We can only fulfill the promises once we have all the data.
 452   if (!(status & imgIRequest::STATUS_LOAD_COMPLETE)) {
 453     return;
 454   }
 455
 456   for (auto& promise : mDecodePromises) {
 457     promise->MaybeResolveWithUndefined();
 458   }
 459
 460   MOZ_ASSERT(mOutstandingDecodePromises >= mDecodePromises.Length());
 461   mOutstandingDecodePromises -= mDecodePromises.Length();
 462   mDecodePromises.Clear();
 463   MaybeDeregisterActivityObserver();
 464 }
 465
 466 void nsImageLoadingContent::RejectDecodePromises(nsresult aStatus) {
 467   if (mDecodePromises.IsEmpty()) {
 468     return;
 469   }
 470
 471   for (auto& promise : mDecodePromises) {
 472     promise->MaybeReject(aStatus);
 473   }
 474
 475   MOZ_ASSERT(mOutstandingDecodePromises >= mDecodePromises.Length());
 476   mOutstandingDecodePromises -= mDecodePromises.Length();
 477   mDecodePromises.Clear();
 478   MaybeDeregisterActivityObserver();
 479 }
 480
 481 void nsImageLoadingContent::MaybeAgeRequestGeneration(nsIURI* aNewURI) {
 482   MOZ_ASSERT(mCurrentRequest);
 483
 484   // If the current request is about to change, we need to verify if the new
 485   // URI matches the existing current request's URI. If it doesn't, we need to
 486   // reject any outstanding promises due to the current request mutating as per
 487   // step 2.2 of the decode API requirements.
 488   //
 489   // https://html.spec.whatwg.org/multipage/embedded-content.html#dom-img-decode
 490   if (aNewURI) {
 491     nsCOMPtr<nsIURI> currentURI;
 492     mCurrentRequest->GetURI(getter_AddRefs(currentURI));
 493
 494     bool equal = false;
 495     if (NS_SUCCEEDED(aNewURI->Equals(currentURI, &equal)) && equal) {
 496       return;
 497     }
 498   }
 499
 500   ++mRequestGeneration;
 501   RejectDecodePromises(NS_ERROR_DOM_IMAGE_INVALID_REQUEST);
 502 }
 503
 504 void nsImageLoadingContent::MaybeDeregisterActivityObserver() {
 505   if (mOutstandingDecodePromises == 0) {
 506     MOZ_ASSERT(mDecodePromises.IsEmpty());
 507     GetOurOwnerDoc()->UnregisterActivityObserver(AsContent()->AsElement());
 508   }
 509 }
 510
 511 void nsImageLoadingContent::SetSyncDecodingHint(bool aHint) {
 512   if (mSyncDecodingHint == aHint) {
 513     return;
 514   }
 515
 516   mSyncDecodingHint = aHint;
 517   MaybeForceSyncDecoding(/* aPrepareNextRequest */ false);
 518 }
 519
 520 void nsImageLoadingContent::MaybeForceSyncDecoding(
 521     bool aPrepareNextRequest, nsIFrame* aFrame /* = nullptr */) {
 522   // GetOurPrimaryImageFrame() might not return the frame during frame init.
 523   nsIFrame* frame = aFrame ? aFrame : GetOurPrimaryImageFrame();
 524   if (!frame) {
 525     return;
 526   }
 527
 528   bool forceSync = mSyncDecodingHint;
 529   if (!forceSync && aPrepareNextRequest) {
 530     // Detect JavaScript-based animations created by changing the |src|
 531     // attribute on a timer.
 532     TimeStamp now = TimeStamp::Now();
 533     TimeDuration threshold = TimeDuration::FromMilliseconds(
 534         StaticPrefs::image_infer_src_animation_threshold_ms());
 535
 536     // If the length of time between request changes is less than the threshold,
 537     // then force sync decoding to eliminate flicker from the animation.
 538     forceSync = (now - mMostRecentRequestChange < threshold);
 539     mMostRecentRequestChange = now;
 540   }
 541
 542   if (nsImageFrame* imageFrame = do_QueryFrame(frame)) {
 543     imageFrame->SetForceSyncDecoding(forceSync);
 544   } else if (SVGImageFrame* svgImageFrame = do_QueryFrame(frame)) {
 545     svgImageFrame->SetForceSyncDecoding(forceSync);
 546   }
 547 }
 548
 549 static void ReplayImageStatus(imgIRequest* aRequest,
 550                               imgINotificationObserver* aObserver) {
 551   if (!aRequest) {
 552     return;
 553   }
 554
 555   uint32_t status = 0;
 556   nsresult rv = aRequest->GetImageStatus(&status);
 557   if (NS_FAILED(rv)) {
 558     return;
 559   }
 560
 561   if (status & imgIRequest::STATUS_SIZE_AVAILABLE) {
 562     aObserver->Notify(aRequest, imgINotificationObserver::SIZE_AVAILABLE,
 563                       nullptr);
 564   }
 565   if (status & imgIRequest::STATUS_FRAME_COMPLETE) {
 566     aObserver->Notify(aRequest, imgINotificationObserver::FRAME_COMPLETE,
 567                       nullptr);
 568   }
 569   if (status & imgIRequest::STATUS_HAS_TRANSPARENCY) {
 570     aObserver->Notify(aRequest, imgINotificationObserver::HAS_TRANSPARENCY,
 571                       nullptr);
 572   }
 573   if (status & imgIRequest::STATUS_IS_ANIMATED) {
 574     aObserver->Notify(aRequest, imgINotificationObserver::IS_ANIMATED, nullptr);
 575   }
 576   if (status & imgIRequest::STATUS_DECODE_COMPLETE) {
 577     aObserver->Notify(aRequest, imgINotificationObserver::DECODE_COMPLETE,
 578                       nullptr);
 579   }
 580   if (status & imgIRequest::STATUS_LOAD_COMPLETE) {
 581     aObserver->Notify(aRequest, imgINotificationObserver::LOAD_COMPLETE,
 582                       nullptr);
 583   }
 584 }
 585
 586 void nsImageLoadingContent::AddNativeObserver(
 587     imgINotificationObserver* aObserver) {
 588   if (NS_WARN_IF(!aObserver)) {
 589     return;
 590   }
 591
 592   if (!mObserverList.mObserver) {
 593     // Don't touch the linking of the list!
 594     mObserverList.mObserver = aObserver;
 595
 596     ReplayImageStatus(mCurrentRequest, aObserver);
 597     ReplayImageStatus(mPendingRequest, aObserver);
 598
 599     return;
 600   }
 601
 602   // otherwise we have to create a new entry
 603
 604   ImageObserver* observer = &mObserverList;
 605   while (observer->mNext) {
 606     observer = observer->mNext;
 607   }
 608
 609   observer->mNext = new ImageObserver(aObserver);
 610   ReplayImageStatus(mCurrentRequest, aObserver);
 611   ReplayImageStatus(mPendingRequest, aObserver);
 612 }
 613
 614 void nsImageLoadingContent::RemoveNativeObserver(
 615     imgINotificationObserver* aObserver) {
 616   if (NS_WARN_IF(!aObserver)) {
 617     return;
 618   }
 619
 620   if (mObserverList.mObserver == aObserver) {
 621     mObserverList.mObserver = nullptr;
 622     // Don't touch the linking of the list!
 623     return;
 624   }
 625
 626   // otherwise have to find it and splice it out
 627   ImageObserver* observer = &mObserverList;
 628   while (observer->mNext && observer->mNext->mObserver != aObserver) {
 629     observer = observer->mNext;
 630   }
 631
 632   // At this point, we are pointing to the list element whose mNext is
 633   // the right observer (assuming of course that mNext is not null)
 634   if (observer->mNext) {
 635     // splice it out
 636     ImageObserver* oldObserver = observer->mNext;
 637     observer->mNext = oldObserver->mNext;
 638     oldObserver->mNext = nullptr;  // so we don't destroy them all
 639     delete oldObserver;
 640   }
 641 #ifdef DEBUG
 642   else {
 643     NS_WARNING("Asked to remove nonexistent observer");
 644   }
 645 #endif
 646 }
 647
 648 void nsImageLoadingContent::AddObserver(imgINotificationObserver* aObserver) {
 649   if (NS_WARN_IF(!aObserver)) {
 650     return;
 651   }
 652
 653   RefPtr<imgRequestProxy> currentReq;
 654   if (mCurrentRequest) {
 655     // Scripted observers may not belong to the same document as us, so when we
 656     // create the imgRequestProxy, we shouldn't use any. This allows the request
 657     // to dispatch notifications from the correct scheduler group.
 658     nsresult rv =
 659         mCurrentRequest->Clone(aObserver, nullptr, getter_AddRefs(currentReq));
 660     if (NS_FAILED(rv)) {
 661       return;
 662     }
 663   }
 664
 665   RefPtr<imgRequestProxy> pendingReq;
 666   if (mPendingRequest) {
 667     // See above for why we don't use the loading document.
 668     nsresult rv =
 669         mPendingRequest->Clone(aObserver, nullptr, getter_AddRefs(pendingReq));
 670     if (NS_FAILED(rv)) {
 671       mCurrentRequest->CancelAndForgetObserver(NS_BINDING_ABORTED);
 672       return;
 673     }
 674   }
 675
 676   mScriptedObservers.AppendElement(new ScriptedImageObserver(
 677       aObserver, std::move(currentReq), std::move(pendingReq)));
 678 }
 679
 680 void nsImageLoadingContent::RemoveObserver(
 681     imgINotificationObserver* aObserver) {
 682   if (NS_WARN_IF(!aObserver)) {
 683     return;
 684   }
 685
 686   if (NS_WARN_IF(mScriptedObservers.IsEmpty())) {
 687     return;
 688   }
 689
 690   RefPtr<ScriptedImageObserver> observer;
 691   auto i = mScriptedObservers.Length();
 692   do {
 693     --i;
 694     if (mScriptedObservers[i]->mObserver == aObserver) {
 695       observer = std::move(mScriptedObservers[i]);
 696       mScriptedObservers.RemoveElementAt(i);
 697       break;
 698     }
 699   } while (i > 0);
 700
 701   if (NS_WARN_IF(!observer)) {
 702     return;
 703   }
 704
 705   // If the cancel causes a mutation, it will be harmless, because we have
 706   // already removed the observer from the list.
 707   observer->CancelRequests();
 708 }
 709
 710 void nsImageLoadingContent::ClearScriptedRequests(int32_t aRequestType,
 711                                                   nsresult aReason) {
 712   if (MOZ_LIKELY(mScriptedObservers.IsEmpty())) {
 713     return;
 714   }
 715
 716   nsTArray<RefPtr<ScriptedImageObserver>> observers(mScriptedObservers.Clone());
 717   auto i = observers.Length();
 718   do {
 719     --i;
 720
 721     RefPtr<imgRequestProxy> req;
 722     switch (aRequestType) {
 723       case CURRENT_REQUEST:
 724         req = std::move(observers[i]->mCurrentRequest);
 725         break;
 726       case PENDING_REQUEST:
 727         req = std::move(observers[i]->mPendingRequest);
 728         break;
 729       default:
 730         NS_ERROR("Unknown request type");
 731         return;
 732     }
 733
 734     if (req) {
 735       req->CancelAndForgetObserver(aReason);
 736     }
 737   } while (i > 0);
 738 }
 739
 740 void nsImageLoadingContent::CloneScriptedRequests(imgRequestProxy* aRequest) {
 741   MOZ_ASSERT(aRequest);
 742
 743   if (MOZ_LIKELY(mScriptedObservers.IsEmpty())) {
 744     return;
 745   }
 746
 747   bool current;
 748   if (aRequest == mCurrentRequest) {
 749     current = true;
 750   } else if (aRequest == mPendingRequest) {
 751     current = false;
 752   } else {
 753     MOZ_ASSERT_UNREACHABLE("Unknown request type");
 754     return;
 755   }
 756
 757   nsTArray<RefPtr<ScriptedImageObserver>> observers(mScriptedObservers.Clone());
 758   auto i = observers.Length();
 759   do {
 760     --i;
 761
 762     ScriptedImageObserver* observer = observers[i];
 763     RefPtr<imgRequestProxy>& req =
 764         current ? observer->mCurrentRequest : observer->mPendingRequest;
 765     if (NS_WARN_IF(req)) {
 766       MOZ_ASSERT_UNREACHABLE("Should have cancelled original request");
 767       req->CancelAndForgetObserver(NS_BINDING_ABORTED);
 768       req = nullptr;
 769     }
 770
 771     nsresult rv =
 772         aRequest->Clone(observer->mObserver, nullptr, getter_AddRefs(req));
 773     Unused << NS_WARN_IF(NS_FAILED(rv));
 774   } while (i > 0);
 775 }
 776
 777 void nsImageLoadingContent::MakePendingScriptedRequestsCurrent() {
 778   if (MOZ_LIKELY(mScriptedObservers.IsEmpty())) {
 779     return;
 780   }
 781
 782   nsTArray<RefPtr<ScriptedImageObserver>> observers(mScriptedObservers.Clone());
 783   auto i = observers.Length();
 784   do {
 785     --i;
 786
 787     ScriptedImageObserver* observer = observers[i];
 788     if (observer->mCurrentRequest) {
 789       observer->mCurrentRequest->CancelAndForgetObserver(NS_BINDING_ABORTED);
 790     }
 791     observer->mCurrentRequest = std::move(observer->mPendingRequest);
 792   } while (i > 0);
 793 }
 794
 795 already_AddRefed<imgIRequest> nsImageLoadingContent::GetRequest(
 796     int32_t aRequestType, ErrorResult& aError) {
 797   nsCOMPtr<imgIRequest> request;
 798   switch (aRequestType) {
 799     case CURRENT_REQUEST:
 800       request = mCurrentRequest;
 801       break;
 802     case PENDING_REQUEST:
 803       request = mPendingRequest;
 804       break;
 805     default:
 806       NS_ERROR("Unknown request type");
 807       aError.Throw(NS_ERROR_UNEXPECTED);
 808   }
 809
 810   return request.forget();
 811 }
 812
 813 NS_IMETHODIMP
 814 nsImageLoadingContent::GetRequest(int32_t aRequestType,
 815                                   imgIRequest** aRequest) {
 816   NS_ENSURE_ARG_POINTER(aRequest);
 817
 818   ErrorResult result;
 819   *aRequest = GetRequest(aRequestType, result).take();
 820
 821   return result.StealNSResult();
 822 }
 823
 824 NS_IMETHODIMP_(void)
 825 nsImageLoadingContent::FrameCreated(nsIFrame* aFrame) {
 826   MOZ_ASSERT(aFrame, "aFrame is null");
 827   MOZ_ASSERT(IsOurImageFrame(aFrame));
 828
 829   MaybeForceSyncDecoding(/* aPrepareNextRequest */ false, aFrame);
 830   TrackImage(mCurrentRequest, aFrame);
 831   TrackImage(mPendingRequest, aFrame);
 832
 833   // We need to make sure that our image request is registered, if it should
 834   // be registered.
 835   nsPresContext* presContext = aFrame->PresContext();
 836   if (mCurrentRequest) {
 837     nsLayoutUtils::RegisterImageRequestIfAnimated(presContext, mCurrentRequest,
 838                                                   &mCurrentRequestRegistered);
 839   }
 840
 841   if (mPendingRequest) {
 842     nsLayoutUtils::RegisterImageRequestIfAnimated(presContext, mPendingRequest,
 843                                                   &mPendingRequestRegistered);
 844   }
 845 }
 846
 847 NS_IMETHODIMP_(void)
 848 nsImageLoadingContent::FrameDestroyed(nsIFrame* aFrame) {
 849   NS_ASSERTION(aFrame, "aFrame is null");
 850
 851   // We need to make sure that our image request is deregistered.
 852   nsPresContext* presContext = GetFramePresContext();
 853   if (mCurrentRequest) {
 854     nsLayoutUtils::DeregisterImageRequest(presContext, mCurrentRequest,
 855                                           &mCurrentRequestRegistered);
 856   }
 857
 858   if (mPendingRequest) {
 859     nsLayoutUtils::DeregisterImageRequest(presContext, mPendingRequest,
 860                                           &mPendingRequestRegistered);
 861   }
 862
 863   UntrackImage(mCurrentRequest);
 864   UntrackImage(mPendingRequest);
 865
 866   PresShell* presShell = presContext ? presContext->GetPresShell() : nullptr;
 867   if (presShell) {
 868     presShell->RemoveFrameFromApproximatelyVisibleList(aFrame);
 869   }
 870 }
 871
 872 /* static */
 873 nsContentPolicyType nsImageLoadingContent::PolicyTypeForLoad(
 874     ImageLoadType aImageLoadType) {
 875   if (aImageLoadType == eImageLoadType_Imageset) {
 876     return nsIContentPolicy::TYPE_IMAGESET;
 877   }
 878
 879   MOZ_ASSERT(aImageLoadType == eImageLoadType_Normal,
 880              "Unknown ImageLoadType type in PolicyTypeForLoad");
 881   return nsIContentPolicy::TYPE_INTERNAL_IMAGE;
 882 }
 883
 884 int32_t nsImageLoadingContent::GetRequestType(imgIRequest* aRequest,
 885                                               ErrorResult& aError) {
 886   if (aRequest == mCurrentRequest) {
 887     return CURRENT_REQUEST;
 888   }
 889
 890   if (aRequest == mPendingRequest) {
 891     return PENDING_REQUEST;
 892   }
 893
 894   NS_ERROR("Unknown request");
 895   aError.Throw(NS_ERROR_UNEXPECTED);
 896   return UNKNOWN_REQUEST;
 897 }
 898
 899 NS_IMETHODIMP
 900 nsImageLoadingContent::GetRequestType(imgIRequest* aRequest,
 901                                       int32_t* aRequestType) {
 902   MOZ_ASSERT(aRequestType, "Null out param");
 903
 904   ErrorResult result;
 905   *aRequestType = GetRequestType(aRequest, result);
 906   return result.StealNSResult();
 907 }
 908
 909 already_AddRefed<nsIURI> nsImageLoadingContent::GetCurrentURI() {
 910   nsCOMPtr<nsIURI> uri;
 911   if (mCurrentRequest) {
 912     mCurrentRequest->GetURI(getter_AddRefs(uri));
 913   } else {
 914     uri = mCurrentURI;
 915   }
 916
 917   return uri.forget();
 918 }
 919
 920 NS_IMETHODIMP
 921 nsImageLoadingContent::GetCurrentURI(nsIURI** aURI) {
 922   NS_ENSURE_ARG_POINTER(aURI);
 923   *aURI = GetCurrentURI().take();
 924   return NS_OK;
 925 }
 926
 927 already_AddRefed<nsIURI> nsImageLoadingContent::GetCurrentRequestFinalURI() {
 928   nsCOMPtr<nsIURI> uri;
 929   if (mCurrentRequest) {
 930     mCurrentRequest->GetFinalURI(getter_AddRefs(uri));
 931   }
 932   return uri.forget();
 933 }
 934
 935 NS_IMETHODIMP
 936 nsImageLoadingContent::LoadImageWithChannel(nsIChannel* aChannel,
 937                                             nsIStreamListener** aListener) {
 938   imgLoader* loader =
 939       nsContentUtils::GetImgLoaderForChannel(aChannel, GetOurOwnerDoc());
 940   if (!loader) {
 941     return NS_ERROR_NULL_POINTER;
 942   }
 943
 944   nsCOMPtr<Document> doc = GetOurOwnerDoc();
 945   if (!doc) {
 946     // Don't bother
 947     *aListener = nullptr;
 948     return NS_OK;
 949   }
 950
 951   // XXX what should we do with content policies here, if anything?
 952   // Shouldn't that be done before the start of the load?
 953   // XXX what about shouldProcess?
 954
 955   // If we have a current request without a size, we know we will replace it
 956   // with the PrepareNextRequest below. If the new current request is for a
 957   // different URI, then we need to reject any outstanding promises.
 958   if (mCurrentRequest && !HaveSize(mCurrentRequest)) {
 959     nsCOMPtr<nsIURI> uri;
 960     aChannel->GetOriginalURI(getter_AddRefs(uri));
 961     MaybeAgeRequestGeneration(uri);
 962   }
 963
 964   // Our state might change. Watch it.
 965   AutoStateChanger changer(this, true);
 966
 967   // Do the load.
 968   RefPtr<imgRequestProxy>& req = PrepareNextRequest(eImageLoadType_Normal);
 969   nsresult rv = loader->LoadImageWithChannel(aChannel, this, doc, aListener,
 970                                              getter_AddRefs(req));
 971   if (NS_SUCCEEDED(rv)) {
 972     CloneScriptedRequests(req);
 973     TrackImage(req);
 974     ResetAnimationIfNeeded();
 975     return NS_OK;
 976   }
 977
 978   MOZ_ASSERT(!req, "Shouldn't have non-null request here");
 979   // If we don't have a current URI, we might as well store this URI so people
 980   // know what we tried (and failed) to load.
 981   if (!mCurrentRequest) aChannel->GetURI(getter_AddRefs(mCurrentURI));
 982
 983   FireEvent(u"error"_ns);
 984   return rv;
 985 }
 986
 987 void nsImageLoadingContent::ForceReload(bool aNotify, ErrorResult& aError) {
 988   nsCOMPtr<nsIURI> currentURI;
 989   GetCurrentURI(getter_AddRefs(currentURI));
 990   if (!currentURI) {
 991     aError.Throw(NS_ERROR_NOT_AVAILABLE);
 992     return;
 993   }
 994
 995   // We keep this flag around along with the old URI even for failed requests
 996   // without a live request object
 997   ImageLoadType loadType = (mCurrentRequestFlags & REQUEST_IS_IMAGESET)
 998                                ? eImageLoadType_Imageset
 999                                : eImageLoadType_Normal;
1000   nsresult rv = LoadImage(currentURI, true, aNotify, loadType,
1001                           nsIRequest::VALIDATE_ALWAYS | LoadFlags());
1002   if (NS_FAILED(rv)) {
1003     aError.Throw(rv);
1004   }
1005 }
1006
1007 /*
1008  * Non-interface methods
1009  */
1010
1011 nsresult nsImageLoadingContent::LoadImage(const nsAString& aNewURI, bool aForce,
1012                                           bool aNotify,
1013                                           ImageLoadType aImageLoadType,
1014                                           nsIPrincipal* aTriggeringPrincipal) {
1015   // First, get a document (needed for security checks and the like)
1016   Document* doc = GetOurOwnerDoc();
1017   if (!doc) {
1018     // No reason to bother, I think...
1019     return NS_OK;
1020   }
1021
1022   // Parse the URI string to get image URI
1023   nsCOMPtr<nsIURI> imageURI;
1024   if (!aNewURI.IsEmpty()) {
1025     Unused << StringToURI(aNewURI, doc, getter_AddRefs(imageURI));
1026   }
1027
1028   return LoadImage(imageURI, aForce, aNotify, aImageLoadType, LoadFlags(), doc,
1029                    aTriggeringPrincipal);
1030 }
1031
1032 nsresult nsImageLoadingContent::LoadImage(nsIURI* aNewURI, bool aForce,
1033                                           bool aNotify,
1034                                           ImageLoadType aImageLoadType,
1035                                           nsLoadFlags aLoadFlags,
1036                                           Document* aDocument,
1037                                           nsIPrincipal* aTriggeringPrincipal) {
1038   MOZ_ASSERT(!mIsStartingImageLoad, "some evil code is reentering LoadImage.");
1039   if (mIsStartingImageLoad) {
1040     return NS_OK;
1041   }
1042
1043   // Pending load/error events need to be canceled in some situations. This
1044   // is not documented in the spec, but can cause site compat problems if not
1045   // done. See bug 1309461 and https://github.com/whatwg/html/issues/1872.
1046   CancelPendingEvent();
1047
1048   if (!aNewURI) {
1049     // Cancel image requests and then fire only error event per spec.
1050     CancelImageRequests(aNotify);
1051     if (aImageLoadType == eImageLoadType_Normal) {
1052       // Mark error event as cancelable only for src="" case, since only this
1053       // error causes site compat problem (bug 1308069) for now.
1054       FireEvent(u"error"_ns, true);
1055     }
1056     return NS_OK;
1057   }
1058
1059   if (!mLoadingEnabled) {
1060     // XXX Why fire an error here? seems like the callers to SetLoadingEnabled
1061     // don't want/need it.
1062     FireEvent(u"error"_ns);
1063     return NS_OK;
1064   }
1065
1066   NS_ASSERTION(!aDocument || aDocument == GetOurOwnerDoc(),
1067                "Bogus document passed in");
1068   // First, get a document (needed for security checks and the like)
1069   if (!aDocument) {
1070     aDocument = GetOurOwnerDoc();
1071     if (!aDocument) {
1072       // No reason to bother, I think...
1073       return NS_OK;
1074     }
1075   }
1076
1077   AutoRestore<bool> guard(mIsStartingImageLoad);
1078   mIsStartingImageLoad = true;
1079
1080   // Data documents, or documents from DOMParser shouldn't perform image
1081   // loading.
1082   //
1083   // FIXME(emilio): Shouldn't this check be part of
1084   // Document::ShouldLoadImages()? Or alternatively check ShouldLoadImages here
1085   // instead? (It seems we only check ShouldLoadImages in HTMLImageElement,
1086   // which seems wrong...)
1087   if (aDocument->IsLoadedAsData() && !aDocument->IsStaticDocument()) {
1088     // Clear our pending request if we do have one.
1089     ClearPendingRequest(NS_BINDING_ABORTED, Some(OnNonvisible::DiscardImages));
1090
1091     FireEvent(u"error"_ns);
1092     return NS_OK;
1093   }
1094
1095   // URI equality check.
1096   //
1097   // We skip the equality check if we don't have a current image, since in that
1098   // case we really do want to try loading again.
1099   if (!aForce && mCurrentRequest) {
1100     nsCOMPtr<nsIURI> currentURI;
1101     GetCurrentURI(getter_AddRefs(currentURI));
1102     bool equal;
1103     if (currentURI && NS_SUCCEEDED(currentURI->Equals(aNewURI, &equal)) &&
1104         equal) {
1105       // Nothing to do here.
1106       return NS_OK;
1107     }
1108   }
1109
1110   // If we have a current request without a size, we know we will replace it
1111   // with the PrepareNextRequest below. If the new current request is for a
1112   // different URI, then we need to reject any outstanding promises.
1113   if (mCurrentRequest && !HaveSize(mCurrentRequest)) {
1114     MaybeAgeRequestGeneration(aNewURI);
1115   }
1116
1117   // From this point on, our image state could change. Watch it.
1118   AutoStateChanger changer(this, aNotify);
1119
1120   // Sanity check.
1121   //
1122   // We use the principal of aDocument to avoid having to QI |this| an extra
1123   // time. It should always be the same as the principal of this node.
1124   Element* element = AsContent()->AsElement();
1125   MOZ_ASSERT(element->NodePrincipal() == aDocument->NodePrincipal(),
1126              "Principal mismatch?");
1127
1128   nsLoadFlags loadFlags =
1129       aLoadFlags | nsContentUtils::CORSModeToLoadImageFlags(GetCORSMode());
1130
1131   RefPtr<imgRequestProxy>& req = PrepareNextRequest(aImageLoadType);
1132   nsCOMPtr<nsIPrincipal> triggeringPrincipal;
1133   bool result = nsContentUtils::QueryTriggeringPrincipal(
1134       element, aTriggeringPrincipal, getter_AddRefs(triggeringPrincipal));
1135
1136   // If result is true, which means this node has specified
1137   // 'triggeringprincipal' attribute on it, so we use favicon as the policy
1138   // type.
1139   nsContentPolicyType policyType =
1140       result ? nsIContentPolicy::TYPE_INTERNAL_IMAGE_FAVICON
1141              : PolicyTypeForLoad(aImageLoadType);
1142
1143   auto referrerInfo = MakeRefPtr<ReferrerInfo>(*element);
1144   nsresult rv = nsContentUtils::LoadImage(
1145       aNewURI, element, aDocument, triggeringPrincipal, 0, referrerInfo, this,
1146       loadFlags, element->LocalName(), getter_AddRefs(req), policyType,
1147       mUseUrgentStartForChannel, /* aLinkPreload */ false,
1148       /* aEarlyHintPreloaderId */ 0, GetFetchPriorityForImage());
1149
1150   // Reset the flag to avoid loading from XPCOM or somewhere again else without
1151   // initiated by user interaction.
1152   mUseUrgentStartForChannel = false;
1153
1154   // Tell the document to forget about the image preload, if any, for
1155   // this URI, now that we might have another imgRequestProxy for it.
1156   // That way if we get canceled later the image load won't continue.
1157   aDocument->ForgetImagePreload(aNewURI);
1158
1159   if (NS_SUCCEEDED(rv)) {
1160     // Based on performance testing unsuppressing painting soon after the page
1161     // has gotten an image may improve visual metrics.
1162     if (Document* doc = element->GetComposedDoc()) {
1163       if (PresShell* shell = doc->GetPresShell()) {
1164         shell->TryUnsuppressPaintingSoon();
1165       }
1166     }
1167
1168     CloneScriptedRequests(req);
1169     TrackImage(req);
1170     ResetAnimationIfNeeded();
1171
1172     // Handle cases when we just ended up with a request but it's already done.
1173     // In that situation we have to synchronously switch that request to being
1174     // the current request, because websites depend on that behavior.
1175     {
1176       uint32_t loadStatus;
1177       if (NS_SUCCEEDED(req->GetImageStatus(&loadStatus)) &&
1178           (loadStatus & imgIRequest::STATUS_LOAD_COMPLETE)) {
1179         if (req == mPendingRequest) {
1180           MakePendingRequestCurrent();
1181         }
1182         MOZ_ASSERT(mCurrentRequest,
1183                    "How could we not have a current request here?");
1184
1185         if (nsImageFrame* f = do_QueryFrame(GetOurPrimaryImageFrame())) {
1186           f->NotifyNewCurrentRequest(mCurrentRequest, NS_OK);
1187         }
1188       }
1189     }
1190   } else {
1191     MOZ_ASSERT(!req, "Shouldn't have non-null request here");
1192     // If we don't have a current URI, we might as well store this URI so people
1193     // know what we tried (and failed) to load.
1194     if (!mCurrentRequest) {
1195       mCurrentURI = aNewURI;
1196     }
1197
1198     FireEvent(u"error"_ns);
1199   }
1200
1201   return NS_OK;
1202 }
1203
1204 already_AddRefed<Promise> nsImageLoadingContent::RecognizeCurrentImageText(
1205     ErrorResult& aRv) {
1206   using widget::TextRecognition;
1207
1208   if (!mCurrentRequest) {
1209     aRv.ThrowInvalidStateError("No current request");
1210     return nullptr;
1211   }
1212   nsCOMPtr<imgIContainer> image;
1213   mCurrentRequest->GetImage(getter_AddRefs(image));
1214   if (!image) {
1215     aRv.ThrowInvalidStateError("No image");
1216     return nullptr;
1217   }
1218
1219   RefPtr<Promise> domPromise =
1220       Promise::Create(GetOurOwnerDoc()->GetScopeObject(), aRv);
1221   if (aRv.Failed()) {
1222     return nullptr;
1223   }
1224
1225   // The list of ISO 639-1 language tags to pass to the text recognition API.
1226   AutoTArray<nsCString, 4> languages;
1227   {
1228     // The document's locale should be the top language to use. Parse the BCP 47
1229     // locale and extract the ISO 639-1 language tag. e.g. "en-US" -> "en".
1230     nsAutoCString elementLanguage;
1231     nsAtom* imgLanguage = AsContent()->GetLang();
1232     intl::Locale locale;
1233     if (imgLanguage) {
1234       imgLanguage->ToUTF8String(elementLanguage);
1235       auto result = intl::LocaleParser::TryParse(elementLanguage, locale);
1236       if (result.isOk()) {
1237         languages.AppendElement(locale.Language().Span());
1238       }
1239     }
1240   }
1241
1242   {
1243     // The app locales should also be included after the document's locales.
1244     // Extract the language tag like above.
1245     nsTArray<nsCString> appLocales;
1246     intl::LocaleService::GetInstance()->GetAppLocalesAsBCP47(appLocales);
1247
1248     for (const auto& localeString : appLocales) {
1249       intl::Locale locale;
1250       auto result = intl::LocaleParser::TryParse(localeString, locale);
1251       if (result.isErr()) {
1252         NS_WARNING("Could not parse an app locale string, ignoring it.");
1253         continue;
1254       }
1255       languages.AppendElement(locale.Language().Span());
1256     }
1257   }
1258
1259   TextRecognition::FindText(*image, languages)
1260       ->Then(
1261           GetCurrentSerialEventTarget(), __func__,
1262           [weak = RefPtr{do_GetWeakReference(this)},
1263            request = RefPtr{mCurrentRequest}, domPromise](
1264               TextRecognition::NativePromise::ResolveOrRejectValue&& aValue) {
1265             if (aValue.IsReject()) {
1266               domPromise->MaybeRejectWithNotSupportedError(
1267                   aValue.RejectValue());
1268               return;
1269             }
1270             RefPtr<nsIImageLoadingContent> iilc = do_QueryReferent(weak.get());
1271             if (!iilc) {
1272               domPromise->MaybeRejectWithInvalidStateError(
1273                   "Element was dead when we got the results");
1274               return;
1275             }
1276             auto* ilc = static_cast<nsImageLoadingContent*>(iilc.get());
1277             if (ilc->mCurrentRequest != request) {
1278               domPromise->MaybeRejectWithInvalidStateError(
1279                   "Request not current");
1280               return;
1281             }
1282             auto& textRecognitionResult = aValue.ResolveValue();
1283             Element* el = ilc->AsContent()->AsElement();
1284
1285             // When enabled, this feature will place the recognized text as
1286             // spans inside of the shadow dom of the img element. These are then
1287             // positioned so that the user can select the text.
1288             if (Preferences::GetBool("dom.text-recognition.shadow-dom-enabled",
1289                                      false)) {
1290               el->AttachAndSetUAShadowRoot(Element::NotifyUAWidgetSetup::Yes);
1291               TextRecognition::FillShadow(*el->GetShadowRoot(),
1292                                           textRecognitionResult);
1293               el->NotifyUAWidgetSetupOrChange();
1294             }
1295
1296             nsTArray<ImageText> imageTexts(
1297                 textRecognitionResult.quads().Length());
1298             nsIGlobalObject* global = el->OwnerDoc()->GetOwnerGlobal();
1299
1300             for (const auto& quad : textRecognitionResult.quads()) {
1301               NotNull<ImageText*> imageText = imageTexts.AppendElement();
1302
1303               // Note: These points are not actually CSSPixels, but a DOMQuad is
1304               // a conveniently similar structure that can store these values.
1305               CSSPoint points[4];
1306               points[0] = CSSPoint(quad.points()[0].x, quad.points()[0].y);
1307               points[1] = CSSPoint(quad.points()[1].x, quad.points()[1].y);
1308               points[2] = CSSPoint(quad.points()[2].x, quad.points()[2].y);
1309               points[3] = CSSPoint(quad.points()[3].x, quad.points()[3].y);
1310
1311               imageText->mQuad = new DOMQuad(global, points);
1312               imageText->mConfidence = quad.confidence();
1313               imageText->mString = quad.string();
1314             }
1315             domPromise->MaybeResolve(std::move(imageTexts));
1316           });
1317   return domPromise.forget();
1318 }
1319
1320 CSSIntSize nsImageLoadingContent::GetWidthHeightForImage() {
1321   Element* element = AsContent()->AsElement();
1322   if (nsIFrame* frame = element->GetPrimaryFrame(FlushType::Layout)) {
1323     return CSSIntSize::FromAppUnitsRounded(frame->GetContentRect().Size());
1324   }
1325   const nsAttrValue* value;
1326   nsCOMPtr<imgIContainer> image;
1327   if (mCurrentRequest) {
1328     mCurrentRequest->GetImage(getter_AddRefs(image));
1329   }
1330
1331   CSSIntSize size;
1332   if ((value = element->GetParsedAttr(nsGkAtoms::width)) &&
1333       value->Type() == nsAttrValue::eInteger) {
1334     size.width = value->GetIntegerValue();
1335   } else if (image) {
1336     image->GetWidth(&size.width);
1337   }
1338
1339   if ((value = element->GetParsedAttr(nsGkAtoms::height)) &&
1340       value->Type() == nsAttrValue::eInteger) {
1341     size.height = value->GetIntegerValue();
1342   } else if (image) {
1343     image->GetHeight(&size.height);
1344   }
1345
1346   NS_ASSERTION(size.width >= 0, "negative width");
1347   NS_ASSERTION(size.height >= 0, "negative height");
1348   return size;
1349 }
1350
1351 void nsImageLoadingContent::UpdateImageState(bool aNotify) {
1352   if (mStateChangerDepth > 0) {
1353     // Ignore this call; we'll update our state when the outermost state changer
1354     // is destroyed. Need this to work around the fact that some ImageLib
1355     // stuff is actually sync and hence we can get OnStopDecode called while
1356     // we're still under LoadImage, and OnStopDecode doesn't know anything about
1357     // aNotify.
1358     // XXX - This machinery should be removed after bug 521604.
1359     return;
1360   }
1361
1362   Element* thisElement = AsContent()->AsElement();
1363
1364   mLoading = false;
1365
1366   Element::AutoStateChangeNotifier notifier(*thisElement, aNotify);
1367   thisElement->RemoveStatesSilently(ElementState::BROKEN);
1368
1369   // If we were blocked, we're broken, so are we if we don't have an image
1370   // request at all or the image has errored.
1371   if (!mCurrentRequest) {
1372     if (!mLazyLoading) {
1373       // In case of non-lazy loading, no current request means error, since we
1374       // weren't disabled or suppressed
1375       thisElement->AddStatesSilently(ElementState::BROKEN);
1376       RejectDecodePromises(NS_ERROR_DOM_IMAGE_BROKEN);
1377     }
1378   } else {
1379     uint32_t currentLoadStatus;
1380     nsresult rv = mCurrentRequest->GetImageStatus(&currentLoadStatus);
1381     if (NS_FAILED(rv) || (currentLoadStatus & imgIRequest::STATUS_ERROR)) {
1382       thisElement->AddStatesSilently(ElementState::BROKEN);
1383       RejectDecodePromises(NS_ERROR_DOM_IMAGE_BROKEN);
1384     } else if (!(currentLoadStatus & imgIRequest::STATUS_SIZE_AVAILABLE)) {
1385       mLoading = true;
1386     }
1387   }
1388 }
1389
1390 void nsImageLoadingContent::CancelImageRequests(bool aNotify) {
1391   RejectDecodePromises(NS_ERROR_DOM_IMAGE_INVALID_REQUEST);
1392   AutoStateChanger changer(this, aNotify);
1393   ClearPendingRequest(NS_BINDING_ABORTED, Some(OnNonvisible::DiscardImages));
1394   ClearCurrentRequest(NS_BINDING_ABORTED, Some(OnNonvisible::DiscardImages));
1395 }
1396
1397 Document* nsImageLoadingContent::GetOurOwnerDoc() {
1398   return AsContent()->OwnerDoc();
1399 }
1400
1401 Document* nsImageLoadingContent::GetOurCurrentDoc() {
1402   return AsContent()->GetComposedDoc();
1403 }
1404
1405 nsPresContext* nsImageLoadingContent::GetFramePresContext() {
1406   nsIFrame* frame = GetOurPrimaryImageFrame();
1407   if (!frame) {
1408     return nullptr;
1409   }
1410   return frame->PresContext();
1411 }
1412
1413 nsresult nsImageLoadingContent::StringToURI(const nsAString& aSpec,
1414                                             Document* aDocument,
1415                                             nsIURI** aURI) {
1416   MOZ_ASSERT(aDocument, "Must have a document");
1417   MOZ_ASSERT(aURI, "Null out param");
1418
1419   // (1) Get the base URI
1420   nsIContent* thisContent = AsContent();
1421   nsIURI* baseURL = thisContent->GetBaseURI();
1422
1423   // (2) Get the charset
1424   auto encoding = aDocument->GetDocumentCharacterSet();
1425
1426   // (3) Construct the silly thing
1427   return NS_NewURI(aURI, aSpec, encoding, baseURL);
1428 }
1429
1430 nsresult nsImageLoadingContent::FireEvent(const nsAString& aEventType,
1431                                           bool aIsCancelable) {
1432   if (nsContentUtils::DocumentInactiveForImageLoads(GetOurOwnerDoc())) {
1433     // Don't bother to fire any events, especially error events.
1434     RejectDecodePromises(NS_ERROR_DOM_IMAGE_INACTIVE_DOCUMENT);
1435     return NS_OK;
1436   }
1437
1438   // We have to fire the event asynchronously so that we won't go into infinite
1439   // loops in cases when onLoad handlers reset the src and the new src is in
1440   // cache.
1441
1442   nsCOMPtr<nsINode> thisNode = AsContent();
1443
1444   RefPtr<AsyncEventDispatcher> loadBlockingAsyncDispatcher =
1445       new LoadBlockingAsyncEventDispatcher(thisNode, aEventType, CanBubble::eNo,
1446                                            ChromeOnlyDispatch::eNo);
1447   loadBlockingAsyncDispatcher->PostDOMEvent();
1448
1449   if (aIsCancelable) {
1450     mPendingEvent = loadBlockingAsyncDispatcher;
1451   }
1452
1453   return NS_OK;
1454 }
1455
1456 void nsImageLoadingContent::AsyncEventRunning(AsyncEventDispatcher* aEvent) {
1457   if (mPendingEvent == aEvent) {
1458     mPendingEvent = nullptr;
1459   }
1460 }
1461
1462 void nsImageLoadingContent::CancelPendingEvent() {
1463   if (mPendingEvent) {
1464     mPendingEvent->Cancel();
1465     mPendingEvent = nullptr;
1466   }
1467 }
1468
1469 RefPtr<imgRequestProxy>& nsImageLoadingContent::PrepareNextRequest(
1470     ImageLoadType aImageLoadType) {
1471   MaybeForceSyncDecoding(/* aPrepareNextRequest */ true);
1472
1473   // We only want to cancel the existing current request if size is not
1474   // available. bz says the web depends on this behavior.
1475   // Otherwise, we get rid of any half-baked request that might be sitting there
1476   // and make this one current.
1477   return HaveSize(mCurrentRequest) ? PreparePendingRequest(aImageLoadType)
1478                                    : PrepareCurrentRequest(aImageLoadType);
1479 }
1480
1481 RefPtr<imgRequestProxy>& nsImageLoadingContent::PrepareCurrentRequest(
1482     ImageLoadType aImageLoadType) {
1483   // Get rid of anything that was there previously.
1484   ClearCurrentRequest(NS_BINDING_ABORTED, Some(OnNonvisible::DiscardImages));
1485
1486   if (mNewRequestsWillNeedAnimationReset) {
1487     mCurrentRequestFlags |= REQUEST_NEEDS_ANIMATION_RESET;
1488   }
1489
1490   if (aImageLoadType == eImageLoadType_Imageset) {
1491     mCurrentRequestFlags |= REQUEST_IS_IMAGESET;
1492   }
1493
1494   // Return a reference.
1495   return mCurrentRequest;
1496 }
1497
1498 RefPtr<imgRequestProxy>& nsImageLoadingContent::PreparePendingRequest(
1499     ImageLoadType aImageLoadType) {
1500   // Get rid of anything that was there previously.
1501   ClearPendingRequest(NS_BINDING_ABORTED, Some(OnNonvisible::DiscardImages));
1502
1503   if (mNewRequestsWillNeedAnimationReset) {
1504     mPendingRequestFlags |= REQUEST_NEEDS_ANIMATION_RESET;
1505   }
1506
1507   if (aImageLoadType == eImageLoadType_Imageset) {
1508     mPendingRequestFlags |= REQUEST_IS_IMAGESET;
1509   }
1510
1511   // Return a reference.
1512   return mPendingRequest;
1513 }
1514
1515 namespace {
1516
1517 class ImageRequestAutoLock {
1518  public:
1519   explicit ImageRequestAutoLock(imgIRequest* aRequest) : mRequest(aRequest) {
1520     if (mRequest) {
1521       mRequest->LockImage();
1522     }
1523   }
1524
1525   ~ImageRequestAutoLock() {
1526     if (mRequest) {
1527       mRequest->UnlockImage();
1528     }
1529   }
1530
1531  private:
1532   nsCOMPtr<imgIRequest> mRequest;
1533 };
1534
1535 }  // namespace
1536
1537 void nsImageLoadingContent::MakePendingRequestCurrent() {
1538   MOZ_ASSERT(mPendingRequest);
1539
1540   // If we have a pending request, we know that there is an existing current
1541   // request with size information. If the pending request is for a different
1542   // URI, then we need to reject any outstanding promises.
1543   nsCOMPtr<nsIURI> uri;
1544   mPendingRequest->GetURI(getter_AddRefs(uri));
1545   MaybeAgeRequestGeneration(uri);
1546
1547   // Lock mCurrentRequest for the duration of this method.  We do this because
1548   // PrepareCurrentRequest() might unlock mCurrentRequest.  If mCurrentRequest
1549   // and mPendingRequest are both requests for the same image, unlocking
1550   // mCurrentRequest before we lock mPendingRequest can cause the lock count
1551   // to go to 0 and the image to be discarded!
1552   ImageRequestAutoLock autoLock(mCurrentRequest);
1553
1554   ImageLoadType loadType = (mPendingRequestFlags & REQUEST_IS_IMAGESET)
1555                                ? eImageLoadType_Imageset
1556                                : eImageLoadType_Normal;
1557
1558   PrepareCurrentRequest(loadType) = mPendingRequest;
1559   MakePendingScriptedRequestsCurrent();
1560   mPendingRequest = nullptr;
1561   mCurrentRequestFlags = mPendingRequestFlags;
1562   mPendingRequestFlags = 0;
1563   mCurrentRequestRegistered = mPendingRequestRegistered;
1564   mPendingRequestRegistered = false;
1565   ResetAnimationIfNeeded();
1566 }
1567
1568 void nsImageLoadingContent::ClearCurrentRequest(
1569     nsresult aReason, const Maybe<OnNonvisible>& aNonvisibleAction) {
1570   if (!mCurrentRequest) {
1571     // Even if we didn't have a current request, we might have been keeping
1572     // a URI and flags as a placeholder for a failed load. Clear that now.
1573     mCurrentURI = nullptr;
1574     mCurrentRequestFlags = 0;
1575     return;
1576   }
1577   MOZ_ASSERT(!mCurrentURI,
1578              "Shouldn't have both mCurrentRequest and mCurrentURI!");
1579
1580   // Deregister this image from the refresh driver so it no longer receives
1581   // notifications.
1582   nsLayoutUtils::DeregisterImageRequest(GetFramePresContext(), mCurrentRequest,
1583                                         &mCurrentRequestRegistered);
1584
1585   // Clean up the request.
1586   UntrackImage(mCurrentRequest, aNonvisibleAction);
1587   ClearScriptedRequests(CURRENT_REQUEST, aReason);
1588   mCurrentRequest->CancelAndForgetObserver(aReason);
1589   mCurrentRequest = nullptr;
1590   mCurrentRequestFlags = 0;
1591 }
1592
1593 void nsImageLoadingContent::ClearPendingRequest(
1594     nsresult aReason, const Maybe<OnNonvisible>& aNonvisibleAction) {
1595   if (!mPendingRequest) return;
1596
1597   // Deregister this image from the refresh driver so it no longer receives
1598   // notifications.
1599   nsLayoutUtils::DeregisterImageRequest(GetFramePresContext(), mPendingRequest,
1600                                         &mPendingRequestRegistered);
1601
1602   UntrackImage(mPendingRequest, aNonvisibleAction);
1603   ClearScriptedRequests(PENDING_REQUEST, aReason);
1604   mPendingRequest->CancelAndForgetObserver(aReason);
1605   mPendingRequest = nullptr;
1606   mPendingRequestFlags = 0;
1607 }
1608
1609 void nsImageLoadingContent::ResetAnimationIfNeeded() {
1610   if (mCurrentRequest &&
1611       (mCurrentRequestFlags & REQUEST_NEEDS_ANIMATION_RESET)) {
1612     nsCOMPtr<imgIContainer> container;
1613     mCurrentRequest->GetImage(getter_AddRefs(container));
1614     if (container) container->ResetAnimation();
1615     mCurrentRequestFlags &= ~REQUEST_NEEDS_ANIMATION_RESET;
1616   }
1617 }
1618
1619 bool nsImageLoadingContent::HaveSize(imgIRequest* aImage) {
1620   // Handle the null case
1621   if (!aImage) return false;
1622
1623   // Query the image
1624   uint32_t status;
1625   nsresult rv = aImage->GetImageStatus(&status);
1626   return (NS_SUCCEEDED(rv) && (status & imgIRequest::STATUS_SIZE_AVAILABLE));
1627 }
1628
1629 void nsImageLoadingContent::NotifyOwnerDocumentActivityChanged() {
1630   if (!GetOurOwnerDoc()->IsCurrentActiveDocument()) {
1631     RejectDecodePromises(NS_ERROR_DOM_IMAGE_INACTIVE_DOCUMENT);
1632   }
1633 }
1634
1635 void nsImageLoadingContent::BindToTree(BindContext& aContext,
1636                                        nsINode& aParent) {
1637   // We may be getting connected, if so our image should be tracked,
1638   if (aContext.InComposedDoc()) {
1639     TrackImage(mCurrentRequest);
1640     TrackImage(mPendingRequest);
1641   }
1642 }
1643
1644 void nsImageLoadingContent::UnbindFromTree() {
1645   // We may be leaving the document, so if our image is tracked, untrack it.
1646   nsCOMPtr<Document> doc = GetOurCurrentDoc();
1647   if (!doc) {
1648     return;
1649   }
1650
1651   UntrackImage(mCurrentRequest);
1652   UntrackImage(mPendingRequest);
1653 }
1654
1655 void nsImageLoadingContent::OnVisibilityChange(
1656     Visibility aNewVisibility, const Maybe<OnNonvisible>& aNonvisibleAction) {
1657   switch (aNewVisibility) {
1658     case Visibility::ApproximatelyVisible:
1659       TrackImage(mCurrentRequest);
1660       TrackImage(mPendingRequest);
1661       break;
1662
1663     case Visibility::ApproximatelyNonVisible:
1664       UntrackImage(mCurrentRequest, aNonvisibleAction);
1665       UntrackImage(mPendingRequest, aNonvisibleAction);
1666       break;
1667
1668     case Visibility::Untracked:
1669       MOZ_ASSERT_UNREACHABLE("Shouldn't notify for untracked visibility");
1670       break;
1671   }
1672 }
1673
1674 void nsImageLoadingContent::TrackImage(imgIRequest* aImage,
1675                                        nsIFrame* aFrame /*= nullptr */) {
1676   if (!aImage) return;
1677
1678   MOZ_ASSERT(aImage == mCurrentRequest || aImage == mPendingRequest,
1679              "Why haven't we heard of this request?");
1680
1681   Document* doc = GetOurCurrentDoc();
1682   if (!doc) {
1683     return;
1684   }
1685
1686   if (!aFrame) {
1687     aFrame = GetOurPrimaryImageFrame();
1688   }
1689
1690   /* This line is deceptively simple. It hides a lot of subtlety. Before we
1691    * create an nsImageFrame we call nsImageFrame::ShouldCreateImageFrameFor
1692    * to determine if we should create an nsImageFrame or create a frame based
1693    * on the display of the element (ie inline, block, etc). Inline, block, etc
1694    * frames don't register for visibility tracking so they will return UNTRACKED
1695    * from GetVisibility(). So this line is choosing to mark such images as
1696    * visible. Once the image loads we will get an nsImageFrame and the proper
1697    * visibility. This is a pitfall of tracking the visibility on the frames
1698    * instead of the content node.
1699    */
1700   if (!aFrame ||
1701       aFrame->GetVisibility() == Visibility::ApproximatelyNonVisible) {
1702     return;
1703   }
1704
1705   if (aImage == mCurrentRequest &&
1706       !(mCurrentRequestFlags & REQUEST_IS_TRACKED)) {
1707     mCurrentRequestFlags |= REQUEST_IS_TRACKED;
1708     doc->ImageTracker()->Add(mCurrentRequest);
1709   }
1710   if (aImage == mPendingRequest &&
1711       !(mPendingRequestFlags & REQUEST_IS_TRACKED)) {
1712     mPendingRequestFlags |= REQUEST_IS_TRACKED;
1713     doc->ImageTracker()->Add(mPendingRequest);
1714   }
1715 }
1716
1717 void nsImageLoadingContent::UntrackImage(
1718     imgIRequest* aImage, const Maybe<OnNonvisible>& aNonvisibleAction
1719     /* = Nothing() */) {
1720   if (!aImage) return;
1721
1722   MOZ_ASSERT(aImage == mCurrentRequest || aImage == mPendingRequest,
1723              "Why haven't we heard of this request?");
1724
1725   // We may not be in the document.  If we outlived our document that's fine,
1726   // because the document empties out the tracker and unlocks all locked images
1727   // on destruction.  But if we were never in the document we may need to force
1728   // discarding the image here, since this is the only chance we have.
1729   Document* doc = GetOurCurrentDoc();
1730   if (aImage == mCurrentRequest) {
1731     if (doc && (mCurrentRequestFlags & REQUEST_IS_TRACKED)) {
1732       mCurrentRequestFlags &= ~REQUEST_IS_TRACKED;
1733       doc->ImageTracker()->Remove(
1734           mCurrentRequest,
1735           aNonvisibleAction == Some(OnNonvisible::DiscardImages)
1736               ? ImageTracker::REQUEST_DISCARD
1737               : 0);
1738     } else if (aNonvisibleAction == Some(OnNonvisible::DiscardImages)) {
1739       // If we're not in the document we may still need to be discarded.
1740       aImage->RequestDiscard();
1741     }
1742   }
1743   if (aImage == mPendingRequest) {
1744     if (doc && (mPendingRequestFlags & REQUEST_IS_TRACKED)) {
1745       mPendingRequestFlags &= ~REQUEST_IS_TRACKED;
1746       doc->ImageTracker()->Remove(
1747           mPendingRequest,
1748           aNonvisibleAction == Some(OnNonvisible::DiscardImages)
1749               ? ImageTracker::REQUEST_DISCARD
1750               : 0);
1751     } else if (aNonvisibleAction == Some(OnNonvisible::DiscardImages)) {
1752       // If we're not in the document we may still need to be discarded.
1753       aImage->RequestDiscard();
1754     }
1755   }
1756 }
1757
1758 CORSMode nsImageLoadingContent::GetCORSMode() { return CORS_NONE; }
1759
1760 nsImageLoadingContent::ImageObserver::ImageObserver(
1761     imgINotificationObserver* aObserver)
1762     : mObserver(aObserver), mNext(nullptr) {
1763   MOZ_COUNT_CTOR(ImageObserver);
1764 }
1765
1766 nsImageLoadingContent::ImageObserver::~ImageObserver() {
1767   MOZ_COUNT_DTOR(ImageObserver);
1768   NS_CONTENT_DELETE_LIST_MEMBER(ImageObserver, this, mNext);
1769 }
1770
1771 nsImageLoadingContent::ScriptedImageObserver::ScriptedImageObserver(
1772     imgINotificationObserver* aObserver,
1773     RefPtr<imgRequestProxy>&& aCurrentRequest,
1774     RefPtr<imgRequestProxy>&& aPendingRequest)
1775     : mObserver(aObserver),
1776       mCurrentRequest(aCurrentRequest),
1777       mPendingRequest(aPendingRequest) {}
1778
1779 nsImageLoadingContent::ScriptedImageObserver::~ScriptedImageObserver() {
1780   // We should have cancelled any requests before getting released.
1781   DebugOnly<bool> cancel = CancelRequests();
1782   MOZ_ASSERT(!cancel, "Still have requests in ~ScriptedImageObserver!");
1783 }
1784
1785 bool nsImageLoadingContent::ScriptedImageObserver::CancelRequests() {
1786   bool cancelled = false;
1787   if (mCurrentRequest) {
1788     mCurrentRequest->CancelAndForgetObserver(NS_BINDING_ABORTED);
1789     mCurrentRequest = nullptr;
1790     cancelled = true;
1791   }
1792   if (mPendingRequest) {
1793     mPendingRequest->CancelAndForgetObserver(NS_BINDING_ABORTED);
1794     mPendingRequest = nullptr;
1795     cancelled = true;
1796   }
1797   return cancelled;
1798 }
1799
1800 Element* nsImageLoadingContent::FindImageMap() {
1801   return FindImageMap(AsContent()->AsElement());
1802 }
1803
1804 /* static */ Element* nsImageLoadingContent::FindImageMap(Element* aElement) {
1805   nsAutoString useMap;
1806   aElement->GetAttr(nsGkAtoms::usemap, useMap);
1807   if (useMap.IsEmpty()) {
1808     return nullptr;
1809   }
1810
1811   nsAString::const_iterator start, end;
1812   useMap.BeginReading(start);
1813   useMap.EndReading(end);
1814
1815   int32_t hash = useMap.FindChar('#');
1816   if (hash < 0) {
1817     return nullptr;
1818   }
1819   // useMap contains a '#', set start to point right after the '#'
1820   start.advance(hash + 1);
1821
1822   if (start == end) {
1823     return nullptr;  // useMap == "#"
1824   }
1825
1826   RefPtr<nsContentList> imageMapList;
1827   if (aElement->IsInUncomposedDoc()) {
1828     // Optimize the common case and use document level image map.
1829     imageMapList = aElement->OwnerDoc()->ImageMapList();
1830   } else {
1831     // Per HTML spec image map should be searched in the element's scope,
1832     // so using SubtreeRoot() here.
1833     // Because this is a temporary list, we don't need to make it live.
1834     imageMapList =
1835         new nsContentList(aElement->SubtreeRoot(), kNameSpaceID_XHTML,
1836                           nsGkAtoms::map, nsGkAtoms::map, true, /* deep */
1837                           false /* live */);
1838   }
1839
1840   nsAutoString mapName(Substring(start, end));
1841
1842   uint32_t i, n = imageMapList->Length(true);
1843   for (i = 0; i < n; ++i) {
1844     nsIContent* map = imageMapList->Item(i);
1845     if (map->AsElement()->AttrValueIs(kNameSpaceID_None, nsGkAtoms::id, mapName,
1846                                       eCaseMatters) ||
1847         map->AsElement()->AttrValueIs(kNameSpaceID_None, nsGkAtoms::name,
1848                                       mapName, eCaseMatters)) {
1849       return map->AsElement();
1850     }
1851   }
1852
1853   return nullptr;
1854 }
1855
1856 nsLoadFlags nsImageLoadingContent::LoadFlags() {
1857   auto* image = HTMLImageElement::FromNode(AsContent());
1858   if (image && image->OwnerDoc()->IsScriptEnabled() &&
1859       !image->OwnerDoc()->IsStaticDocument() &&
1860       image->LoadingState() == Element::Loading::Lazy) {
1861     // Note that LOAD_BACKGROUND is not about priority of the load, but about
1862     // whether it blocks the load event (by bypassing the loadgroup).
1863     return nsIRequest::LOAD_BACKGROUND;
1864   }
1865   return nsIRequest::LOAD_NORMAL;
1866 }
1867
1868 FetchPriority nsImageLoadingContent::GetFetchPriorityForImage() const {
1869   return FetchPriority::Auto;
1870 }