image/imgLoader.cpp

   1 /* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
   2 /* vim: set ts=8 sts=2 et sw=2 tw=80: */
   3 /* This Source Code Form is subject to the terms of the Mozilla Public
   4  * License, v. 2.0. If a copy of the MPL was not distributed with this
   5  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
   6
   7 // Undefine windows version of LoadImage because our code uses that name.
   8 #include "mozilla/ScopeExit.h"
   9 #undef LoadImage
  10
  11 #include "imgLoader.h"
  12
  13 #include <algorithm>
  14 #include <utility>
  15
  16 #include "DecoderFactory.h"
  17 #include "Image.h"
  18 #include "ImageLogging.h"
  19 #include "ReferrerInfo.h"
  20 #include "imgRequestProxy.h"
  21 #include "mozilla/Attributes.h"
  22 #include "mozilla/BasePrincipal.h"
  23 #include "mozilla/ChaosMode.h"
  24 #include "mozilla/ClearOnShutdown.h"
  25 #include "mozilla/LoadInfo.h"
  26 #include "mozilla/NullPrincipal.h"
  27 #include "mozilla/Preferences.h"
  28 #include "mozilla/ProfilerLabels.h"
  29 #include "mozilla/StaticPrefs_image.h"
  30 #include "mozilla/StaticPrefs_network.h"
  31 #include "mozilla/StoragePrincipalHelper.h"
  32 #include "mozilla/dom/ContentParent.h"
  33 #include "mozilla/dom/nsMixedContentBlocker.h"
  34 #include "mozilla/image/ImageMemoryReporter.h"
  35 #include "mozilla/layers/CompositorManagerChild.h"
  36 #include "nsCOMPtr.h"
  37 #include "nsCRT.h"
  38 #include "nsComponentManagerUtils.h"
  39 #include "nsContentPolicyUtils.h"
  40 #include "nsContentUtils.h"
  41 #include "nsHttpChannel.h"
  42 #include "nsIAsyncVerifyRedirectCallback.h"
  43 #include "nsICacheInfoChannel.h"
  44 #include "nsIChannelEventSink.h"
  45 #include "nsIClassOfService.h"
  46 #include "nsIEffectiveTLDService.h"
  47 #include "nsIFile.h"
  48 #include "nsIFileURL.h"
  49 #include "nsIHttpChannel.h"
  50 #include "nsIInterfaceRequestor.h"
  51 #include "nsIInterfaceRequestorUtils.h"
  52 #include "nsIMemoryReporter.h"
  53 #include "nsINetworkPredictor.h"
  54 #include "nsIProgressEventSink.h"
  55 #include "nsIProtocolHandler.h"
  56 #include "nsImageModule.h"
  57 #include "nsMediaSniffer.h"
  58 #include "nsMimeTypes.h"
  59 #include "nsNetCID.h"
  60 #include "nsNetUtil.h"
  61 #include "nsProxyRelease.h"
  62 #include "nsQueryObject.h"
  63 #include "nsReadableUtils.h"
  64 #include "nsStreamUtils.h"
  65 #include "prtime.h"
  66
  67 // we want to explore making the document own the load group
  68 // so we can associate the document URI with the load group.
  69 // until this point, we have an evil hack:
  70 #include "nsIHttpChannelInternal.h"
  71 #include "nsILoadGroupChild.h"
  72 #include "nsIDocShell.h"
  73
  74 using namespace mozilla;
  75 using namespace mozilla::dom;
  76 using namespace mozilla::image;
  77 using namespace mozilla::net;
  78
  79 MOZ_DEFINE_MALLOC_SIZE_OF(ImagesMallocSizeOf)
  80
  81 class imgMemoryReporter final : public nsIMemoryReporter {
  82   ~imgMemoryReporter() = default;
  83
  84  public:
  85   NS_DECL_ISUPPORTS
  86
  87   NS_IMETHOD CollectReports(nsIHandleReportCallback* aHandleReport,
  88                             nsISupports* aData, bool aAnonymize) override {
  89     MOZ_ASSERT(NS_IsMainThread());
  90
  91     layers::CompositorManagerChild* manager =
  92         mozilla::layers::CompositorManagerChild::GetInstance();
  93     if (!manager || !StaticPrefs::image_mem_debug_reporting()) {
  94       layers::SharedSurfacesMemoryReport sharedSurfaces;
  95       FinishCollectReports(aHandleReport, aData, aAnonymize, sharedSurfaces);
  96       return NS_OK;
  97     }
  98
  99     RefPtr<imgMemoryReporter> self(this);
 100     nsCOMPtr<nsIHandleReportCallback> handleReport(aHandleReport);
 101     nsCOMPtr<nsISupports> data(aData);
 102     manager->SendReportSharedSurfacesMemory(
 103         [=](layers::SharedSurfacesMemoryReport aReport) {
 104           self->FinishCollectReports(handleReport, data, aAnonymize, aReport);
 105         },
 106         [=](mozilla::ipc::ResponseRejectReason&& aReason) {
 107           layers::SharedSurfacesMemoryReport sharedSurfaces;
 108           self->FinishCollectReports(handleReport, data, aAnonymize,
 109                                      sharedSurfaces);
 110         });
 111     return NS_OK;
 112   }
 113
 114   void FinishCollectReports(
 115       nsIHandleReportCallback* aHandleReport, nsISupports* aData,
 116       bool aAnonymize, layers::SharedSurfacesMemoryReport& aSharedSurfaces) {
 117     nsTArray<ImageMemoryCounter> chrome;
 118     nsTArray<ImageMemoryCounter> content;
 119     nsTArray<ImageMemoryCounter> uncached;
 120
 121     for (uint32_t i = 0; i < mKnownLoaders.Length(); i++) {
 122       for (imgCacheEntry* entry : mKnownLoaders[i]->mChromeCache.Values()) {
 123         RefPtr<imgRequest> req = entry->GetRequest();
 124         RecordCounterForRequest(req, &chrome, !entry->HasNoProxies());
 125       }
 126       for (imgCacheEntry* entry : mKnownLoaders[i]->mCache.Values()) {
 127         RefPtr<imgRequest> req = entry->GetRequest();
 128         RecordCounterForRequest(req, &content, !entry->HasNoProxies());
 129       }
 130       MutexAutoLock lock(mKnownLoaders[i]->mUncachedImagesMutex);
 131       for (RefPtr<imgRequest> req : mKnownLoaders[i]->mUncachedImages) {
 132         RecordCounterForRequest(req, &uncached, req->HasConsumers());
 133       }
 134     }
 135
 136     // Note that we only need to anonymize content image URIs.
 137
 138     ReportCounterArray(aHandleReport, aData, chrome, "images/chrome",
 139                        /* aAnonymize */ false, aSharedSurfaces);
 140
 141     ReportCounterArray(aHandleReport, aData, content, "images/content",
 142                        aAnonymize, aSharedSurfaces);
 143
 144     // Uncached images may be content or chrome, so anonymize them.
 145     ReportCounterArray(aHandleReport, aData, uncached, "images/uncached",
 146                        aAnonymize, aSharedSurfaces);
 147
 148     // Report any shared surfaces that were not merged with the surface cache.
 149     ImageMemoryReporter::ReportSharedSurfaces(aHandleReport, aData,
 150                                               aSharedSurfaces);
 151
 152     nsCOMPtr<nsIMemoryReporterManager> imgr =
 153         do_GetService("@mozilla.org/memory-reporter-manager;1");
 154     if (imgr) {
 155       imgr->EndReport();
 156     }
 157   }
 158
 159   static int64_t ImagesContentUsedUncompressedDistinguishedAmount() {
 160     size_t n = 0;
 161     for (uint32_t i = 0; i < imgLoader::sMemReporter->mKnownLoaders.Length();
 162          i++) {
 163       for (imgCacheEntry* entry :
 164            imgLoader::sMemReporter->mKnownLoaders[i]->mCache.Values()) {
 165         if (entry->HasNoProxies()) {
 166           continue;
 167         }
 168
 169         RefPtr<imgRequest> req = entry->GetRequest();
 170         RefPtr<image::Image> image = req->GetImage();
 171         if (!image) {
 172           continue;
 173         }
 174
 175         // Both this and EntryImageSizes measure
 176         // images/content/raster/used/decoded memory.  This function's
 177         // measurement is secondary -- the result doesn't go in the "explicit"
 178         // tree -- so we use moz_malloc_size_of instead of ImagesMallocSizeOf to
 179         // prevent DMD from seeing it reported twice.
 180         SizeOfState state(moz_malloc_size_of);
 181         ImageMemoryCounter counter(req, image, state, /* aIsUsed = */ true);
 182
 183         n += counter.Values().DecodedHeap();
 184         n += counter.Values().DecodedNonHeap();
 185         n += counter.Values().DecodedUnknown();
 186       }
 187     }
 188     return n;
 189   }
 190
 191   void RegisterLoader(imgLoader* aLoader) {
 192     mKnownLoaders.AppendElement(aLoader);
 193   }
 194
 195   void UnregisterLoader(imgLoader* aLoader) {
 196     mKnownLoaders.RemoveElement(aLoader);
 197   }
 198
 199  private:
 200   nsTArray<imgLoader*> mKnownLoaders;
 201
 202   struct MemoryTotal {
 203     MemoryTotal& operator+=(const ImageMemoryCounter& aImageCounter) {
 204       if (aImageCounter.Type() == imgIContainer::TYPE_RASTER) {
 205         if (aImageCounter.IsUsed()) {
 206           mUsedRasterCounter += aImageCounter.Values();
 207         } else {
 208           mUnusedRasterCounter += aImageCounter.Values();
 209         }
 210       } else if (aImageCounter.Type() == imgIContainer::TYPE_VECTOR) {
 211         if (aImageCounter.IsUsed()) {
 212           mUsedVectorCounter += aImageCounter.Values();
 213         } else {
 214           mUnusedVectorCounter += aImageCounter.Values();
 215         }
 216       } else if (aImageCounter.Type() == imgIContainer::TYPE_REQUEST) {
 217         // Nothing to do, we did not get to the point of having an image.
 218       } else {
 219         MOZ_CRASH("Unexpected image type");
 220       }
 221
 222       return *this;
 223     }
 224
 225     const MemoryCounter& UsedRaster() const { return mUsedRasterCounter; }
 226     const MemoryCounter& UnusedRaster() const { return mUnusedRasterCounter; }
 227     const MemoryCounter& UsedVector() const { return mUsedVectorCounter; }
 228     const MemoryCounter& UnusedVector() const { return mUnusedVectorCounter; }
 229
 230    private:
 231     MemoryCounter mUsedRasterCounter;
 232     MemoryCounter mUnusedRasterCounter;
 233     MemoryCounter mUsedVectorCounter;
 234     MemoryCounter mUnusedVectorCounter;
 235   };
 236
 237   // Reports all images of a single kind, e.g. all used chrome images.
 238   void ReportCounterArray(nsIHandleReportCallback* aHandleReport,
 239                           nsISupports* aData,
 240                           nsTArray<ImageMemoryCounter>& aCounterArray,
 241                           const char* aPathPrefix, bool aAnonymize,
 242                           layers::SharedSurfacesMemoryReport& aSharedSurfaces) {
 243     MemoryTotal summaryTotal;
 244     MemoryTotal nonNotableTotal;
 245
 246     // Report notable images, and compute total and non-notable aggregate sizes.
 247     for (uint32_t i = 0; i < aCounterArray.Length(); i++) {
 248       ImageMemoryCounter& counter = aCounterArray[i];
 249
 250       if (aAnonymize) {
 251         counter.URI().Truncate();
 252         counter.URI().AppendPrintf("<anonymized-%u>", i);
 253       } else {
 254         // The URI could be an extremely long data: URI. Truncate if needed.
 255         static const size_t max = 256;
 256         if (counter.URI().Length() > max) {
 257           counter.URI().Truncate(max);
 258           counter.URI().AppendLiteral(" (truncated)");
 259         }
 260         counter.URI().ReplaceChar('/', '\\');
 261       }
 262
 263       summaryTotal += counter;
 264
 265       if (counter.IsNotable() || StaticPrefs::image_mem_debug_reporting()) {
 266         ReportImage(aHandleReport, aData, aPathPrefix, counter,
 267                     aSharedSurfaces);
 268       } else {
 269         ImageMemoryReporter::TrimSharedSurfaces(counter, aSharedSurfaces);
 270         nonNotableTotal += counter;
 271       }
 272     }
 273
 274     // Report non-notable images in aggregate.
 275     ReportTotal(aHandleReport, aData, /* aExplicit = */ true, aPathPrefix,
 276                 "<non-notable images>/", nonNotableTotal);
 277
 278     // Report a summary in aggregate, outside of the explicit tree.
 279     ReportTotal(aHandleReport, aData, /* aExplicit = */ false, aPathPrefix, "",
 280                 summaryTotal);
 281   }
 282
 283   static void ReportImage(nsIHandleReportCallback* aHandleReport,
 284                           nsISupports* aData, const char* aPathPrefix,
 285                           const ImageMemoryCounter& aCounter,
 286                           layers::SharedSurfacesMemoryReport& aSharedSurfaces) {
 287     nsAutoCString pathPrefix("explicit/"_ns);
 288     pathPrefix.Append(aPathPrefix);
 289
 290     switch (aCounter.Type()) {
 291       case imgIContainer::TYPE_RASTER:
 292         pathPrefix.AppendLiteral("/raster/");
 293         break;
 294       case imgIContainer::TYPE_VECTOR:
 295         pathPrefix.AppendLiteral("/vector/");
 296         break;
 297       case imgIContainer::TYPE_REQUEST:
 298         pathPrefix.AppendLiteral("/request/");
 299         break;
 300       default:
 301         pathPrefix.AppendLiteral("/unknown=");
 302         pathPrefix.AppendInt(aCounter.Type());
 303         pathPrefix.AppendLiteral("/");
 304         break;
 305     }
 306
 307     pathPrefix.Append(aCounter.IsUsed() ? "used/" : "unused/");
 308     if (aCounter.IsValidating()) {
 309       pathPrefix.AppendLiteral("validating/");
 310     }
 311     if (aCounter.HasError()) {
 312       pathPrefix.AppendLiteral("err/");
 313     }
 314
 315     pathPrefix.AppendLiteral("progress=");
 316     pathPrefix.AppendInt(aCounter.Progress(), 16);
 317     pathPrefix.AppendLiteral("/");
 318
 319     pathPrefix.AppendLiteral("image(");
 320     pathPrefix.AppendInt(aCounter.IntrinsicSize().width);
 321     pathPrefix.AppendLiteral("x");
 322     pathPrefix.AppendInt(aCounter.IntrinsicSize().height);
 323     pathPrefix.AppendLiteral(", ");
 324
 325     if (aCounter.URI().IsEmpty()) {
 326       pathPrefix.AppendLiteral("<unknown URI>");
 327     } else {
 328       pathPrefix.Append(aCounter.URI());
 329     }
 330
 331     pathPrefix.AppendLiteral(")/");
 332
 333     ReportSurfaces(aHandleReport, aData, pathPrefix, aCounter, aSharedSurfaces);
 334
 335     ReportSourceValue(aHandleReport, aData, pathPrefix, aCounter.Values());
 336   }
 337
 338   static void ReportSurfaces(
 339       nsIHandleReportCallback* aHandleReport, nsISupports* aData,
 340       const nsACString& aPathPrefix, const ImageMemoryCounter& aCounter,
 341       layers::SharedSurfacesMemoryReport& aSharedSurfaces) {
 342     for (const SurfaceMemoryCounter& counter : aCounter.Surfaces()) {
 343       nsAutoCString surfacePathPrefix(aPathPrefix);
 344       switch (counter.Type()) {
 345         case SurfaceMemoryCounterType::NORMAL:
 346           if (counter.IsLocked()) {
 347             surfacePathPrefix.AppendLiteral("locked/");
 348           } else {
 349             surfacePathPrefix.AppendLiteral("unlocked/");
 350           }
 351           if (counter.IsFactor2()) {
 352             surfacePathPrefix.AppendLiteral("factor2/");
 353           }
 354           if (counter.CannotSubstitute()) {
 355             surfacePathPrefix.AppendLiteral("cannot_substitute/");
 356           }
 357           break;
 358         case SurfaceMemoryCounterType::CONTAINER:
 359           surfacePathPrefix.AppendLiteral("container/");
 360           break;
 361         default:
 362           MOZ_ASSERT_UNREACHABLE("Unknown counter type");
 363           break;
 364       }
 365
 366       surfacePathPrefix.AppendLiteral("types=");
 367       surfacePathPrefix.AppendInt(counter.Values().SurfaceTypes(), 16);
 368       surfacePathPrefix.AppendLiteral("/surface(");
 369       surfacePathPrefix.AppendInt(counter.Key().Size().width);
 370       surfacePathPrefix.AppendLiteral("x");
 371       surfacePathPrefix.AppendInt(counter.Key().Size().height);
 372
 373       if (!counter.IsFinished()) {
 374         surfacePathPrefix.AppendLiteral(", incomplete");
 375       }
 376
 377       if (counter.Values().ExternalHandles() > 0) {
 378         surfacePathPrefix.AppendLiteral(", handles:");
 379         surfacePathPrefix.AppendInt(
 380             uint32_t(counter.Values().ExternalHandles()));
 381       }
 382
 383       ImageMemoryReporter::AppendSharedSurfacePrefix(surfacePathPrefix, counter,
 384                                                      aSharedSurfaces);
 385
 386       PlaybackType playback = counter.Key().Playback();
 387       if (playback == PlaybackType::eAnimated) {
 388         if (StaticPrefs::image_mem_debug_reporting()) {
 389           surfacePathPrefix.AppendPrintf(
 390               " (animation %4u)", uint32_t(counter.Values().FrameIndex()));
 391         } else {
 392           surfacePathPrefix.AppendLiteral(" (animation)");
 393         }
 394       }
 395
 396       if (counter.Key().Flags() != DefaultSurfaceFlags()) {
 397         surfacePathPrefix.AppendLiteral(", flags:");
 398         surfacePathPrefix.AppendInt(uint32_t(counter.Key().Flags()),
 399                                     /* aRadix = */ 16);
 400       }
 401
 402       if (counter.Key().SVGContext()) {
 403         const SVGImageContext& context = counter.Key().SVGContext().ref();
 404         surfacePathPrefix.AppendLiteral(", svgContext:[ ");
 405         if (context.GetViewportSize()) {
 406           const CSSIntSize& size = context.GetViewportSize().ref();
 407           surfacePathPrefix.AppendLiteral("viewport=(");
 408           surfacePathPrefix.AppendInt(size.width);
 409           surfacePathPrefix.AppendLiteral("x");
 410           surfacePathPrefix.AppendInt(size.height);
 411           surfacePathPrefix.AppendLiteral(") ");
 412         }
 413         if (context.GetPreserveAspectRatio()) {
 414           nsAutoString aspect;
 415           context.GetPreserveAspectRatio()->ToString(aspect);
 416           surfacePathPrefix.AppendLiteral("preserveAspectRatio=(");
 417           LossyAppendUTF16toASCII(aspect, surfacePathPrefix);
 418           surfacePathPrefix.AppendLiteral(") ");
 419         }
 420         if (context.GetContextPaint()) {
 421           const SVGEmbeddingContextPaint* paint = context.GetContextPaint();
 422           surfacePathPrefix.AppendLiteral("contextPaint=(");
 423           if (paint->GetFill()) {
 424             surfacePathPrefix.AppendLiteral(" fill=");
 425             surfacePathPrefix.AppendInt(paint->GetFill()->ToABGR(), 16);
 426           }
 427           if (paint->GetFillOpacity() != 1.0) {
 428             surfacePathPrefix.AppendLiteral(" fillOpa=");
 429             surfacePathPrefix.AppendFloat(paint->GetFillOpacity());
 430           }
 431           if (paint->GetStroke()) {
 432             surfacePathPrefix.AppendLiteral(" stroke=");
 433             surfacePathPrefix.AppendInt(paint->GetStroke()->ToABGR(), 16);
 434           }
 435           if (paint->GetStrokeOpacity() != 1.0) {
 436             surfacePathPrefix.AppendLiteral(" strokeOpa=");
 437             surfacePathPrefix.AppendFloat(paint->GetStrokeOpacity());
 438           }
 439           surfacePathPrefix.AppendLiteral(" ) ");
 440         }
 441         surfacePathPrefix.AppendLiteral("]");
 442       }
 443
 444       surfacePathPrefix.AppendLiteral(")/");
 445
 446       ReportValues(aHandleReport, aData, surfacePathPrefix, counter.Values());
 447     }
 448   }
 449
 450   static void ReportTotal(nsIHandleReportCallback* aHandleReport,
 451                           nsISupports* aData, bool aExplicit,
 452                           const char* aPathPrefix, const char* aPathInfix,
 453                           const MemoryTotal& aTotal) {
 454     nsAutoCString pathPrefix;
 455     if (aExplicit) {
 456       pathPrefix.AppendLiteral("explicit/");
 457     }
 458     pathPrefix.Append(aPathPrefix);
 459
 460     nsAutoCString rasterUsedPrefix(pathPrefix);
 461     rasterUsedPrefix.AppendLiteral("/raster/used/");
 462     rasterUsedPrefix.Append(aPathInfix);
 463     ReportValues(aHandleReport, aData, rasterUsedPrefix, aTotal.UsedRaster());
 464
 465     nsAutoCString rasterUnusedPrefix(pathPrefix);
 466     rasterUnusedPrefix.AppendLiteral("/raster/unused/");
 467     rasterUnusedPrefix.Append(aPathInfix);
 468     ReportValues(aHandleReport, aData, rasterUnusedPrefix,
 469                  aTotal.UnusedRaster());
 470
 471     nsAutoCString vectorUsedPrefix(pathPrefix);
 472     vectorUsedPrefix.AppendLiteral("/vector/used/");
 473     vectorUsedPrefix.Append(aPathInfix);
 474     ReportValues(aHandleReport, aData, vectorUsedPrefix, aTotal.UsedVector());
 475
 476     nsAutoCString vectorUnusedPrefix(pathPrefix);
 477     vectorUnusedPrefix.AppendLiteral("/vector/unused/");
 478     vectorUnusedPrefix.Append(aPathInfix);
 479     ReportValues(aHandleReport, aData, vectorUnusedPrefix,
 480                  aTotal.UnusedVector());
 481   }
 482
 483   static void ReportValues(nsIHandleReportCallback* aHandleReport,
 484                            nsISupports* aData, const nsACString& aPathPrefix,
 485                            const MemoryCounter& aCounter) {
 486     ReportSourceValue(aHandleReport, aData, aPathPrefix, aCounter);
 487
 488     ReportValue(aHandleReport, aData, KIND_HEAP, aPathPrefix, "decoded-heap",
 489                 "Decoded image data which is stored on the heap.",
 490                 aCounter.DecodedHeap());
 491
 492     ReportValue(aHandleReport, aData, KIND_NONHEAP, aPathPrefix,
 493                 "decoded-nonheap",
 494                 "Decoded image data which isn't stored on the heap.",
 495                 aCounter.DecodedNonHeap());
 496
 497     // We don't know for certain whether or not it is on the heap, so let's
 498     // just report it as non-heap for reporting purposes.
 499     ReportValue(aHandleReport, aData, KIND_NONHEAP, aPathPrefix,
 500                 "decoded-unknown",
 501                 "Decoded image data which is unknown to be on the heap or not.",
 502                 aCounter.DecodedUnknown());
 503   }
 504
 505   static void ReportSourceValue(nsIHandleReportCallback* aHandleReport,
 506                                 nsISupports* aData,
 507                                 const nsACString& aPathPrefix,
 508                                 const MemoryCounter& aCounter) {
 509     ReportValue(aHandleReport, aData, KIND_HEAP, aPathPrefix, "source",
 510                 "Raster image source data and vector image documents.",
 511                 aCounter.Source());
 512   }
 513
 514   static void ReportValue(nsIHandleReportCallback* aHandleReport,
 515                           nsISupports* aData, int32_t aKind,
 516                           const nsACString& aPathPrefix,
 517                           const char* aPathSuffix, const char* aDescription,
 518                           size_t aValue) {
 519     if (aValue == 0) {
 520       return;
 521     }
 522
 523     nsAutoCString desc(aDescription);
 524     nsAutoCString path(aPathPrefix);
 525     path.Append(aPathSuffix);
 526
 527     aHandleReport->Callback(""_ns, path, aKind, UNITS_BYTES, aValue, desc,
 528                             aData);
 529   }
 530
 531   static void RecordCounterForRequest(imgRequest* aRequest,
 532                                       nsTArray<ImageMemoryCounter>* aArray,
 533                                       bool aIsUsed) {
 534     SizeOfState state(ImagesMallocSizeOf);
 535     RefPtr<image::Image> image = aRequest->GetImage();
 536     if (image) {
 537       ImageMemoryCounter counter(aRequest, image, state, aIsUsed);
 538       aArray->AppendElement(std::move(counter));
 539     } else {
 540       // We can at least record some information about the image from the
 541       // request, and mark it as not knowing the image type yet.
 542       ImageMemoryCounter counter(aRequest, state, aIsUsed);
 543       aArray->AppendElement(std::move(counter));
 544     }
 545   }
 546 };
 547
 548 NS_IMPL_ISUPPORTS(imgMemoryReporter, nsIMemoryReporter)
 549
 550 NS_IMPL_ISUPPORTS(nsProgressNotificationProxy, nsIProgressEventSink,
 551                   nsIChannelEventSink, nsIInterfaceRequestor)
 552
 553 NS_IMETHODIMP
 554 nsProgressNotificationProxy::OnProgress(nsIRequest* request, int64_t progress,
 555                                         int64_t progressMax) {
 556   nsCOMPtr<nsILoadGroup> loadGroup;
 557   request->GetLoadGroup(getter_AddRefs(loadGroup));
 558
 559   nsCOMPtr<nsIProgressEventSink> target;
 560   NS_QueryNotificationCallbacks(mOriginalCallbacks, loadGroup,
 561                                 NS_GET_IID(nsIProgressEventSink),
 562                                 getter_AddRefs(target));
 563   if (!target) {
 564     return NS_OK;
 565   }
 566   return target->OnProgress(mImageRequest, progress, progressMax);
 567 }
 568
 569 NS_IMETHODIMP
 570 nsProgressNotificationProxy::OnStatus(nsIRequest* request, nsresult status,
 571                                       const char16_t* statusArg) {
 572   nsCOMPtr<nsILoadGroup> loadGroup;
 573   request->GetLoadGroup(getter_AddRefs(loadGroup));
 574
 575   nsCOMPtr<nsIProgressEventSink> target;
 576   NS_QueryNotificationCallbacks(mOriginalCallbacks, loadGroup,
 577                                 NS_GET_IID(nsIProgressEventSink),
 578                                 getter_AddRefs(target));
 579   if (!target) {
 580     return NS_OK;
 581   }
 582   return target->OnStatus(mImageRequest, status, statusArg);
 583 }
 584
 585 NS_IMETHODIMP
 586 nsProgressNotificationProxy::AsyncOnChannelRedirect(
 587     nsIChannel* oldChannel, nsIChannel* newChannel, uint32_t flags,
 588     nsIAsyncVerifyRedirectCallback* cb) {
 589   // Tell the original original callbacks about it too
 590   nsCOMPtr<nsILoadGroup> loadGroup;
 591   newChannel->GetLoadGroup(getter_AddRefs(loadGroup));
 592   nsCOMPtr<nsIChannelEventSink> target;
 593   NS_QueryNotificationCallbacks(mOriginalCallbacks, loadGroup,
 594                                 NS_GET_IID(nsIChannelEventSink),
 595                                 getter_AddRefs(target));
 596   if (!target) {
 597     cb->OnRedirectVerifyCallback(NS_OK);
 598     return NS_OK;
 599   }
 600
 601   // Delegate to |target| if set, reusing |cb|
 602   return target->AsyncOnChannelRedirect(oldChannel, newChannel, flags, cb);
 603 }
 604
 605 NS_IMETHODIMP
 606 nsProgressNotificationProxy::GetInterface(const nsIID& iid, void** result) {
 607   if (iid.Equals(NS_GET_IID(nsIProgressEventSink))) {
 608     *result = static_cast<nsIProgressEventSink*>(this);
 609     NS_ADDREF_THIS();
 610     return NS_OK;
 611   }
 612   if (iid.Equals(NS_GET_IID(nsIChannelEventSink))) {
 613     *result = static_cast<nsIChannelEventSink*>(this);
 614     NS_ADDREF_THIS();
 615     return NS_OK;
 616   }
 617   if (mOriginalCallbacks) {
 618     return mOriginalCallbacks->GetInterface(iid, result);
 619   }
 620   return NS_NOINTERFACE;
 621 }
 622
 623 static void NewRequestAndEntry(bool aForcePrincipalCheckForCacheEntry,
 624                                imgLoader* aLoader, const ImageCacheKey& aKey,
 625                                imgRequest** aRequest, imgCacheEntry** aEntry) {
 626   RefPtr<imgRequest> request = new imgRequest(aLoader, aKey);
 627   RefPtr<imgCacheEntry> entry =
 628       new imgCacheEntry(aLoader, request, aForcePrincipalCheckForCacheEntry);
 629   aLoader->AddToUncachedImages(request);
 630   request.forget(aRequest);
 631   entry.forget(aEntry);
 632 }
 633
 634 static bool ShouldRevalidateEntry(imgCacheEntry* aEntry, nsLoadFlags aFlags,
 635                                   bool aHasExpired) {
 636   bool bValidateEntry = false;
 637
 638   if (aFlags & nsIRequest::LOAD_BYPASS_CACHE) {
 639     return false;
 640   }
 641
 642   if (aFlags & nsIRequest::VALIDATE_ALWAYS) {
 643     bValidateEntry = true;
 644   } else if (aEntry->GetMustValidate()) {
 645     bValidateEntry = true;
 646   } else if (aHasExpired) {
 647     // The cache entry has expired...  Determine whether the stale cache
 648     // entry can be used without validation...
 649     if (aFlags &
 650         (nsIRequest::VALIDATE_NEVER | nsIRequest::VALIDATE_ONCE_PER_SESSION)) {
 651       // VALIDATE_NEVER and VALIDATE_ONCE_PER_SESSION allow stale cache
 652       // entries to be used unless they have been explicitly marked to
 653       // indicate that revalidation is necessary.
 654       bValidateEntry = false;
 655
 656     } else if (!(aFlags & nsIRequest::LOAD_FROM_CACHE)) {
 657       // LOAD_FROM_CACHE allows a stale cache entry to be used... Otherwise,
 658       // the entry must be revalidated.
 659       bValidateEntry = true;
 660     }
 661   }
 662
 663   return bValidateEntry;
 664 }
 665
 666 /* Call content policies on cached images that went through a redirect */
 667 static bool ShouldLoadCachedImage(imgRequest* aImgRequest,
 668                                   Document* aLoadingDocument,
 669                                   nsIPrincipal* aTriggeringPrincipal,
 670                                   nsContentPolicyType aPolicyType,
 671                                   bool aSendCSPViolationReports) {
 672   /* Call content policies on cached images - Bug 1082837
 673    * Cached images are keyed off of the first uri in a redirect chain.
 674    * Hence content policies don't get a chance to test the intermediate hops
 675    * or the final destination.  Here we test the final destination using
 676    * mFinalURI off of the imgRequest and passing it into content policies.
 677    * For Mixed Content Blocker, we do an additional check to determine if any
 678    * of the intermediary hops went through an insecure redirect with the
 679    * mHadInsecureRedirect flag
 680    */
 681   bool insecureRedirect = aImgRequest->HadInsecureRedirect();
 682   nsCOMPtr<nsIURI> contentLocation;
 683   aImgRequest->GetFinalURI(getter_AddRefs(contentLocation));
 684   nsresult rv;
 685
 686   nsCOMPtr<nsIPrincipal> loadingPrincipal =
 687       aLoadingDocument ? aLoadingDocument->NodePrincipal()
 688                        : aTriggeringPrincipal;
 689   // If there is no context and also no triggeringPrincipal, then we use a fresh
 690   // nullPrincipal as the loadingPrincipal because we can not create a loadinfo
 691   // without a valid loadingPrincipal.
 692   if (!loadingPrincipal) {
 693     loadingPrincipal = NullPrincipal::CreateWithoutOriginAttributes();
 694   }
 695
 696   nsCOMPtr<nsILoadInfo> secCheckLoadInfo = new LoadInfo(
 697       loadingPrincipal, aTriggeringPrincipal, aLoadingDocument,
 698       nsILoadInfo::SEC_ONLY_FOR_EXPLICIT_CONTENTSEC_CHECK, aPolicyType);
 699
 700   secCheckLoadInfo->SetSendCSPViolationEvents(aSendCSPViolationReports);
 701
 702   int16_t decision = nsIContentPolicy::REJECT_REQUEST;
 703   rv = NS_CheckContentLoadPolicy(contentLocation, secCheckLoadInfo,
 704                                  ""_ns,  // mime guess
 705                                  &decision, nsContentUtils::GetContentPolicy());
 706   if (NS_FAILED(rv) || !NS_CP_ACCEPTED(decision)) {
 707     return false;
 708   }
 709
 710   // We call all Content Policies above, but we also have to call mcb
 711   // individually to check the intermediary redirect hops are secure.
 712   if (insecureRedirect) {
 713     // Bug 1314356: If the image ended up in the cache upgraded by HSTS and the
 714     // page uses upgrade-inscure-requests it had an insecure redirect
 715     // (http->https). We need to invalidate the image and reload it because
 716     // mixed content blocker only bails if upgrade-insecure-requests is set on
 717     // the doc and the resource load is http: which would result in an incorrect
 718     // mixed content warning.
 719     nsCOMPtr<nsIDocShell> docShell =
 720         NS_CP_GetDocShellFromContext(ToSupports(aLoadingDocument));
 721     if (docShell) {
 722       Document* document = docShell->GetDocument();
 723       if (document && document->GetUpgradeInsecureRequests(false)) {
 724         return false;
 725       }
 726     }
 727
 728     if (!aTriggeringPrincipal || !aTriggeringPrincipal->IsSystemPrincipal()) {
 729       // reset the decision for mixed content blocker check
 730       decision = nsIContentPolicy::REJECT_REQUEST;
 731       rv = nsMixedContentBlocker::ShouldLoad(insecureRedirect, contentLocation,
 732                                              secCheckLoadInfo,
 733                                              ""_ns,  // mime guess
 734                                              true,   // aReportError
 735                                              &decision);
 736       if (NS_FAILED(rv) || !NS_CP_ACCEPTED(decision)) {
 737         return false;
 738       }
 739     }
 740   }
 741
 742   return true;
 743 }
 744
 745 // Returns true if this request is compatible with the given CORS mode on the
 746 // given loading principal, and false if the request may not be reused due
 747 // to CORS.
 748 static bool ValidateCORSMode(imgRequest* aRequest, bool aForcePrincipalCheck,
 749                              CORSMode aCORSMode,
 750                              nsIPrincipal* aTriggeringPrincipal) {
 751   // If the entry's CORS mode doesn't match, or the CORS mode matches but the
 752   // document principal isn't the same, we can't use this request.
 753   if (aRequest->GetCORSMode() != aCORSMode) {
 754     return false;
 755   }
 756
 757   if (aRequest->GetCORSMode() != CORS_NONE || aForcePrincipalCheck) {
 758     nsCOMPtr<nsIPrincipal> otherprincipal = aRequest->GetTriggeringPrincipal();
 759
 760     // If we previously had a principal, but we don't now, we can't use this
 761     // request.
 762     if (otherprincipal && !aTriggeringPrincipal) {
 763       return false;
 764     }
 765
 766     if (otherprincipal && aTriggeringPrincipal &&
 767         !otherprincipal->Equals(aTriggeringPrincipal)) {
 768       return false;
 769     }
 770   }
 771
 772   return true;
 773 }
 774
 775 static bool ValidateSecurityInfo(imgRequest* aRequest,
 776                                  bool aForcePrincipalCheck, CORSMode aCORSMode,
 777                                  nsIPrincipal* aTriggeringPrincipal,
 778                                  Document* aLoadingDocument,
 779                                  nsContentPolicyType aPolicyType) {
 780   if (!ValidateCORSMode(aRequest, aForcePrincipalCheck, aCORSMode,
 781                         aTriggeringPrincipal)) {
 782     return false;
 783   }
 784   // Content Policy Check on Cached Images
 785   return ShouldLoadCachedImage(aRequest, aLoadingDocument, aTriggeringPrincipal,
 786                                aPolicyType,
 787                                /* aSendCSPViolationReports */ false);
 788 }
 789
 790 static nsresult NewImageChannel(
 791     nsIChannel** aResult,
 792     // If aForcePrincipalCheckForCacheEntry is true, then we will
 793     // force a principal check even when not using CORS before
 794     // assuming we have a cache hit on a cache entry that we
 795     // create for this channel.  This is an out param that should
 796     // be set to true if this channel ends up depending on
 797     // aTriggeringPrincipal and false otherwise.
 798     bool* aForcePrincipalCheckForCacheEntry, nsIURI* aURI,
 799     nsIURI* aInitialDocumentURI, CORSMode aCORSMode,
 800     nsIReferrerInfo* aReferrerInfo, nsILoadGroup* aLoadGroup,
 801     nsLoadFlags aLoadFlags, nsContentPolicyType aPolicyType,
 802     nsIPrincipal* aTriggeringPrincipal, nsINode* aRequestingNode,
 803     bool aRespectPrivacy) {
 804   MOZ_ASSERT(aResult);
 805
 806   nsresult rv;
 807   nsCOMPtr<nsIHttpChannel> newHttpChannel;
 808
 809   nsCOMPtr<nsIInterfaceRequestor> callbacks;
 810
 811   if (aLoadGroup) {
 812     // Get the notification callbacks from the load group for the new channel.
 813     //
 814     // XXX: This is not exactly correct, because the network request could be
 815     //      referenced by multiple windows...  However, the new channel needs
 816     //      something.  So, using the 'first' notification callbacks is better
 817     //      than nothing...
 818     //
 819     aLoadGroup->GetNotificationCallbacks(getter_AddRefs(callbacks));
 820   }
 821
 822   // Pass in a nullptr loadgroup because this is the underlying network
 823   // request. This request may be referenced by several proxy image requests
 824   // (possibly in different documents).
 825   // If all of the proxy requests are canceled then this request should be
 826   // canceled too.
 827   //
 828
 829   nsSecurityFlags securityFlags =
 830       aCORSMode == CORS_NONE
 831           ? nsILoadInfo::SEC_ALLOW_CROSS_ORIGIN_INHERITS_SEC_CONTEXT
 832           : nsILoadInfo::SEC_REQUIRE_CORS_INHERITS_SEC_CONTEXT;
 833   if (aCORSMode == CORS_ANONYMOUS) {
 834     securityFlags |= nsILoadInfo::SEC_COOKIES_SAME_ORIGIN;
 835   } else if (aCORSMode == CORS_USE_CREDENTIALS) {
 836     securityFlags |= nsILoadInfo::SEC_COOKIES_INCLUDE;
 837   }
 838   securityFlags |= nsILoadInfo::SEC_ALLOW_CHROME;
 839
 840   // Note we are calling NS_NewChannelWithTriggeringPrincipal() here with a
 841   // node and a principal. This is for things like background images that are
 842   // specified by user stylesheets, where the document is being styled, but
 843   // the principal is that of the user stylesheet.
 844   if (aRequestingNode && aTriggeringPrincipal) {
 845     rv = NS_NewChannelWithTriggeringPrincipal(aResult, aURI, aRequestingNode,
 846                                               aTriggeringPrincipal,
 847                                               securityFlags, aPolicyType,
 848                                               nullptr,  // PerformanceStorage
 849                                               nullptr,  // loadGroup
 850                                               callbacks, aLoadFlags);
 851
 852     if (NS_FAILED(rv)) {
 853       return rv;
 854     }
 855
 856     if (aPolicyType == nsIContentPolicy::TYPE_INTERNAL_IMAGE_FAVICON) {
 857       // If this is a favicon loading, we will use the originAttributes from the
 858       // triggeringPrincipal as the channel's originAttributes. This allows the
 859       // favicon loading from XUL will use the correct originAttributes.
 860
 861       nsCOMPtr<nsILoadInfo> loadInfo = (*aResult)->LoadInfo();
 862       rv = loadInfo->SetOriginAttributes(
 863           aTriggeringPrincipal->OriginAttributesRef());
 864     }
 865   } else {
 866     // either we are loading something inside a document, in which case
 867     // we should always have a requestingNode, or we are loading something
 868     // outside a document, in which case the triggeringPrincipal and
 869     // triggeringPrincipal should always be the systemPrincipal.
 870     // However, there are exceptions: one is Notifications which create a
 871     // channel in the parent process in which case we can't get a
 872     // requestingNode.
 873     rv = NS_NewChannel(aResult, aURI, nsContentUtils::GetSystemPrincipal(),
 874                        securityFlags, aPolicyType,
 875                        nullptr,  // nsICookieJarSettings
 876                        nullptr,  // PerformanceStorage
 877                        nullptr,  // loadGroup
 878                        callbacks, aLoadFlags);
 879
 880     if (NS_FAILED(rv)) {
 881       return rv;
 882     }
 883
 884     // Use the OriginAttributes from the loading principal, if one is available,
 885     // and adjust the private browsing ID based on what kind of load the caller
 886     // has asked us to perform.
 887     OriginAttributes attrs;
 888     if (aTriggeringPrincipal) {
 889       attrs = aTriggeringPrincipal->OriginAttributesRef();
 890     }
 891     attrs.mPrivateBrowsingId = aRespectPrivacy ? 1 : 0;
 892
 893     nsCOMPtr<nsILoadInfo> loadInfo = (*aResult)->LoadInfo();
 894     rv = loadInfo->SetOriginAttributes(attrs);
 895   }
 896
 897   if (NS_FAILED(rv)) {
 898     return rv;
 899   }
 900
 901   // only inherit if we have a principal
 902   *aForcePrincipalCheckForCacheEntry =
 903       aTriggeringPrincipal && nsContentUtils::ChannelShouldInheritPrincipal(
 904                                   aTriggeringPrincipal, aURI,
 905                                   /* aInheritForAboutBlank */ false,
 906                                   /* aForceInherit */ false);
 907
 908   // Initialize HTTP-specific attributes
 909   newHttpChannel = do_QueryInterface(*aResult);
 910   if (newHttpChannel) {
 911     nsCOMPtr<nsIHttpChannelInternal> httpChannelInternal =
 912         do_QueryInterface(newHttpChannel);
 913     NS_ENSURE_TRUE(httpChannelInternal, NS_ERROR_UNEXPECTED);
 914     rv = httpChannelInternal->SetDocumentURI(aInitialDocumentURI);
 915     MOZ_ASSERT(NS_SUCCEEDED(rv));
 916     if (aReferrerInfo) {
 917       DebugOnly<nsresult> rv = newHttpChannel->SetReferrerInfo(aReferrerInfo);
 918       MOZ_ASSERT(NS_SUCCEEDED(rv));
 919     }
 920   }
 921
 922   // Image channels are loaded by default with reduced priority.
 923   nsCOMPtr<nsISupportsPriority> p = do_QueryInterface(*aResult);
 924   if (p) {
 925     uint32_t priority = nsISupportsPriority::PRIORITY_LOW;
 926
 927     if (aLoadFlags & nsIRequest::LOAD_BACKGROUND) {
 928       ++priority;  // further reduce priority for background loads
 929     }
 930
 931     p->AdjustPriority(priority);
 932   }
 933
 934   // Create a new loadgroup for this new channel, using the old group as
 935   // the parent. The indirection keeps the channel insulated from cancels,
 936   // but does allow a way for this revalidation to be associated with at
 937   // least one base load group for scheduling/caching purposes.
 938
 939   nsCOMPtr<nsILoadGroup> loadGroup = do_CreateInstance(NS_LOADGROUP_CONTRACTID);
 940   nsCOMPtr<nsILoadGroupChild> childLoadGroup = do_QueryInterface(loadGroup);
 941   if (childLoadGroup) {
 942     childLoadGroup->SetParentLoadGroup(aLoadGroup);
 943   }
 944   (*aResult)->SetLoadGroup(loadGroup);
 945
 946   return NS_OK;
 947 }
 948
 949 static uint32_t SecondsFromPRTime(PRTime aTime) {
 950   return nsContentUtils::SecondsFromPRTime(aTime);
 951 }
 952
 953 /* static */
 954 imgCacheEntry::imgCacheEntry(imgLoader* loader, imgRequest* request,
 955                              bool forcePrincipalCheck)
 956     : mLoader(loader),
 957       mRequest(request),
 958       mDataSize(0),
 959       mTouchedTime(SecondsFromPRTime(PR_Now())),
 960       mLoadTime(SecondsFromPRTime(PR_Now())),
 961       mExpiryTime(0),
 962       mMustValidate(false),
 963       // We start off as evicted so we don't try to update the cache.
 964       // PutIntoCache will set this to false.
 965       mEvicted(true),
 966       mHasNoProxies(true),
 967       mForcePrincipalCheck(forcePrincipalCheck) {}
 968
 969 imgCacheEntry::~imgCacheEntry() {
 970   LOG_FUNC(gImgLog, "imgCacheEntry::~imgCacheEntry()");
 971 }
 972
 973 void imgCacheEntry::Touch(bool updateTime /* = true */) {
 974   LOG_SCOPE(gImgLog, "imgCacheEntry::Touch");
 975
 976   if (updateTime) {
 977     mTouchedTime = SecondsFromPRTime(PR_Now());
 978   }
 979
 980   UpdateCache();
 981 }
 982
 983 void imgCacheEntry::UpdateCache(int32_t diff /* = 0 */) {
 984   // Don't update the cache if we've been removed from it or it doesn't care
 985   // about our size or usage.
 986   if (!Evicted() && HasNoProxies()) {
 987     mLoader->CacheEntriesChanged(mRequest->IsChrome(), diff);
 988   }
 989 }
 990
 991 void imgCacheEntry::UpdateLoadTime() {
 992   mLoadTime = SecondsFromPRTime(PR_Now());
 993 }
 994
 995 void imgCacheEntry::SetHasNoProxies(bool hasNoProxies) {
 996   if (MOZ_LOG_TEST(gImgLog, LogLevel::Debug)) {
 997     if (hasNoProxies) {
 998       LOG_FUNC_WITH_PARAM(gImgLog, "imgCacheEntry::SetHasNoProxies true", "uri",
 999                           mRequest->CacheKey().URI());
1000     } else {
1001       LOG_FUNC_WITH_PARAM(gImgLog, "imgCacheEntry::SetHasNoProxies false",
1002                           "uri", mRequest->CacheKey().URI());
1003     }
1004   }
1005
1006   mHasNoProxies = hasNoProxies;
1007 }
1008
1009 imgCacheQueue::imgCacheQueue() : mDirty(false), mSize(0) {}
1010
1011 void imgCacheQueue::UpdateSize(int32_t diff) { mSize += diff; }
1012
1013 uint32_t imgCacheQueue::GetSize() const { return mSize; }
1014
1015 void imgCacheQueue::Remove(imgCacheEntry* entry) {
1016   uint64_t index = mQueue.IndexOf(entry);
1017   if (index == queueContainer::NoIndex) {
1018     return;
1019   }
1020
1021   mSize -= mQueue[index]->GetDataSize();
1022
1023   // If the queue is clean and this is the first entry,
1024   // then we can efficiently remove the entry without
1025   // dirtying the sort order.
1026   if (!IsDirty() && index == 0) {
1027     std::pop_heap(mQueue.begin(), mQueue.end(), imgLoader::CompareCacheEntries);
1028     mQueue.RemoveLastElement();
1029     return;
1030   }
1031
1032   // Remove from the middle of the list.  This potentially
1033   // breaks the binary heap sort order.
1034   mQueue.RemoveElementAt(index);
1035
1036   // If we only have one entry or the queue is empty, though,
1037   // then the sort order is still effectively good.  Simply
1038   // refresh the list to clear the dirty flag.
1039   if (mQueue.Length() <= 1) {
1040     Refresh();
1041     return;
1042   }
1043
1044   // Otherwise we must mark the queue dirty and potentially
1045   // trigger an expensive sort later.
1046   MarkDirty();
1047 }
1048
1049 void imgCacheQueue::Push(imgCacheEntry* entry) {
1050   mSize += entry->GetDataSize();
1051
1052   RefPtr<imgCacheEntry> refptr(entry);
1053   mQueue.AppendElement(std::move(refptr));
1054   // If we're not dirty already, then we can efficiently add this to the
1055   // binary heap immediately.  This is only O(log n).
1056   if (!IsDirty()) {
1057     std::push_heap(mQueue.begin(), mQueue.end(),
1058                    imgLoader::CompareCacheEntries);
1059   }
1060 }
1061
1062 already_AddRefed<imgCacheEntry> imgCacheQueue::Pop() {
1063   if (mQueue.IsEmpty()) {
1064     return nullptr;
1065   }
1066   if (IsDirty()) {
1067     Refresh();
1068   }
1069
1070   std::pop_heap(mQueue.begin(), mQueue.end(), imgLoader::CompareCacheEntries);
1071   RefPtr<imgCacheEntry> entry = mQueue.PopLastElement();
1072
1073   mSize -= entry->GetDataSize();
1074   return entry.forget();
1075 }
1076
1077 void imgCacheQueue::Refresh() {
1078   // Resort the list.  This is an O(3 * n) operation and best avoided
1079   // if possible.
1080   std::make_heap(mQueue.begin(), mQueue.end(), imgLoader::CompareCacheEntries);
1081   mDirty = false;
1082 }
1083
1084 void imgCacheQueue::MarkDirty() { mDirty = true; }
1085
1086 bool imgCacheQueue::IsDirty() { return mDirty; }
1087
1088 uint32_t imgCacheQueue::GetNumElements() const { return mQueue.Length(); }
1089
1090 bool imgCacheQueue::Contains(imgCacheEntry* aEntry) const {
1091   return mQueue.Contains(aEntry);
1092 }
1093
1094 imgCacheQueue::iterator imgCacheQueue::begin() { return mQueue.begin(); }
1095
1096 imgCacheQueue::const_iterator imgCacheQueue::begin() const {
1097   return mQueue.begin();
1098 }
1099
1100 imgCacheQueue::iterator imgCacheQueue::end() { return mQueue.end(); }
1101
1102 imgCacheQueue::const_iterator imgCacheQueue::end() const {
1103   return mQueue.end();
1104 }
1105
1106 nsresult imgLoader::CreateNewProxyForRequest(
1107     imgRequest* aRequest, nsIURI* aURI, nsILoadGroup* aLoadGroup,
1108     Document* aLoadingDocument, imgINotificationObserver* aObserver,
1109     nsLoadFlags aLoadFlags, imgRequestProxy** _retval) {
1110   LOG_SCOPE_WITH_PARAM(gImgLog, "imgLoader::CreateNewProxyForRequest",
1111                        "imgRequest", aRequest);
1112
1113   /* XXX If we move decoding onto separate threads, we should save off the
1114      calling thread here and pass it off to |proxyRequest| so that it call
1115      proxy calls to |aObserver|.
1116    */
1117
1118   RefPtr<imgRequestProxy> proxyRequest = new imgRequestProxy();
1119
1120   /* It is important to call |SetLoadFlags()| before calling |Init()| because
1121      |Init()| adds the request to the loadgroup.
1122    */
1123   proxyRequest->SetLoadFlags(aLoadFlags);
1124
1125   // init adds itself to imgRequest's list of observers
1126   nsresult rv = proxyRequest->Init(aRequest, aLoadGroup, aLoadingDocument, aURI,
1127                                    aObserver);
1128   if (NS_WARN_IF(NS_FAILED(rv))) {
1129     return rv;
1130   }
1131
1132   proxyRequest.forget(_retval);
1133   return NS_OK;
1134 }
1135
1136 class imgCacheExpirationTracker final
1137     : public nsExpirationTracker<imgCacheEntry, 3> {
1138   enum { TIMEOUT_SECONDS = 10 };
1139
1140  public:
1141   imgCacheExpirationTracker();
1142
1143  protected:
1144   void NotifyExpired(imgCacheEntry* entry) override;
1145 };
1146
1147 imgCacheExpirationTracker::imgCacheExpirationTracker()
1148     : nsExpirationTracker<imgCacheEntry, 3>(TIMEOUT_SECONDS * 1000,
1149                                             "imgCacheExpirationTracker") {}
1150
1151 void imgCacheExpirationTracker::NotifyExpired(imgCacheEntry* entry) {
1152   // Hold on to a reference to this entry, because the expiration tracker
1153   // mechanism doesn't.
1154   RefPtr<imgCacheEntry> kungFuDeathGrip(entry);
1155
1156   if (MOZ_LOG_TEST(gImgLog, LogLevel::Debug)) {
1157     RefPtr<imgRequest> req = entry->GetRequest();
1158     if (req) {
1159       LOG_FUNC_WITH_PARAM(gImgLog, "imgCacheExpirationTracker::NotifyExpired",
1160                           "entry", req->CacheKey().URI());
1161     }
1162   }
1163
1164   // We can be called multiple times on the same entry. Don't do work multiple
1165   // times.
1166   if (!entry->Evicted()) {
1167     entry->Loader()->RemoveFromCache(entry);
1168   }
1169
1170   entry->Loader()->VerifyCacheSizes();
1171 }
1172
1173 ///////////////////////////////////////////////////////////////////////////////
1174 // imgLoader
1175 ///////////////////////////////////////////////////////////////////////////////
1176
1177 double imgLoader::sCacheTimeWeight;
1178 uint32_t imgLoader::sCacheMaxSize;
1179 imgMemoryReporter* imgLoader::sMemReporter;
1180
1181 NS_IMPL_ISUPPORTS(imgLoader, imgILoader, nsIContentSniffer, imgICache,
1182                   nsISupportsWeakReference, nsIObserver)
1183
1184 static imgLoader* gNormalLoader = nullptr;
1185 static imgLoader* gPrivateBrowsingLoader = nullptr;
1186
1187 /* static */
1188 already_AddRefed<imgLoader> imgLoader::CreateImageLoader() {
1189   // In some cases, such as xpctests, XPCOM modules are not automatically
1190   // initialized.  We need to make sure that our module is initialized before
1191   // we hand out imgLoader instances and code starts using them.
1192   mozilla::image::EnsureModuleInitialized();
1193
1194   RefPtr<imgLoader> loader = new imgLoader();
1195   loader->Init();
1196
1197   return loader.forget();
1198 }
1199
1200 imgLoader* imgLoader::NormalLoader() {
1201   if (!gNormalLoader) {
1202     gNormalLoader = CreateImageLoader().take();
1203   }
1204   return gNormalLoader;
1205 }
1206
1207 imgLoader* imgLoader::PrivateBrowsingLoader() {
1208   if (!gPrivateBrowsingLoader) {
1209     gPrivateBrowsingLoader = CreateImageLoader().take();
1210     gPrivateBrowsingLoader->RespectPrivacyNotifications();
1211   }
1212   return gPrivateBrowsingLoader;
1213 }
1214
1215 imgLoader::imgLoader()
1216     : mUncachedImagesMutex("imgLoader::UncachedImages"),
1217       mRespectPrivacy(false) {
1218   sMemReporter->AddRef();
1219   sMemReporter->RegisterLoader(this);
1220 }
1221
1222 imgLoader::~imgLoader() {
1223   ClearChromeImageCache();
1224   ClearImageCache();
1225   {
1226     // If there are any of our imgRequest's left they are in the uncached
1227     // images set, so clear their pointer to us.
1228     MutexAutoLock lock(mUncachedImagesMutex);
1229     for (RefPtr<imgRequest> req : mUncachedImages) {
1230       req->ClearLoader();
1231     }
1232   }
1233   sMemReporter->UnregisterLoader(this);
1234   sMemReporter->Release();
1235 }
1236
1237 void imgLoader::VerifyCacheSizes() {
1238 #ifdef DEBUG
1239   if (!mCacheTracker) {
1240     return;
1241   }
1242
1243   uint32_t cachesize = mCache.Count() + mChromeCache.Count();
1244   uint32_t queuesize =
1245       mCacheQueue.GetNumElements() + mChromeCacheQueue.GetNumElements();
1246   uint32_t trackersize = 0;
1247   for (nsExpirationTracker<imgCacheEntry, 3>::Iterator it(mCacheTracker.get());
1248        it.Next();) {
1249     trackersize++;
1250   }
1251   MOZ_ASSERT(queuesize == trackersize, "Queue and tracker sizes out of sync!");
1252   MOZ_ASSERT(queuesize <= cachesize, "Queue has more elements than cache!");
1253 #endif
1254 }
1255
1256 imgLoader::imgCacheTable& imgLoader::GetCache(bool aForChrome) {
1257   return aForChrome ? mChromeCache : mCache;
1258 }
1259
1260 imgLoader::imgCacheTable& imgLoader::GetCache(const ImageCacheKey& aKey) {
1261   return GetCache(aKey.IsChrome());
1262 }
1263
1264 imgCacheQueue& imgLoader::GetCacheQueue(bool aForChrome) {
1265   return aForChrome ? mChromeCacheQueue : mCacheQueue;
1266 }
1267
1268 imgCacheQueue& imgLoader::GetCacheQueue(const ImageCacheKey& aKey) {
1269   return GetCacheQueue(aKey.IsChrome());
1270 }
1271
1272 void imgLoader::GlobalInit() {
1273   sCacheTimeWeight = StaticPrefs::image_cache_timeweight_AtStartup() / 1000.0;
1274   int32_t cachesize = StaticPrefs::image_cache_size_AtStartup();
1275   sCacheMaxSize = cachesize > 0 ? cachesize : 0;
1276
1277   sMemReporter = new imgMemoryReporter();
1278   RegisterStrongAsyncMemoryReporter(sMemReporter);
1279   RegisterImagesContentUsedUncompressedDistinguishedAmount(
1280       imgMemoryReporter::ImagesContentUsedUncompressedDistinguishedAmount);
1281 }
1282
1283 void imgLoader::ShutdownMemoryReporter() {
1284   UnregisterImagesContentUsedUncompressedDistinguishedAmount();
1285   UnregisterStrongMemoryReporter(sMemReporter);
1286 }
1287
1288 nsresult imgLoader::InitCache() {
1289   nsCOMPtr<nsIObserverService> os = mozilla::services::GetObserverService();
1290   if (!os) {
1291     return NS_ERROR_FAILURE;
1292   }
1293
1294   os->AddObserver(this, "memory-pressure", false);
1295   os->AddObserver(this, "chrome-flush-caches", false);
1296   os->AddObserver(this, "last-pb-context-exited", false);
1297   os->AddObserver(this, "profile-before-change", false);
1298   os->AddObserver(this, "xpcom-shutdown", false);
1299
1300   mCacheTracker = MakeUnique<imgCacheExpirationTracker>();
1301
1302   return NS_OK;
1303 }
1304
1305 nsresult imgLoader::Init() {
1306   InitCache();
1307
1308   return NS_OK;
1309 }
1310
1311 NS_IMETHODIMP
1312 imgLoader::RespectPrivacyNotifications() {
1313   mRespectPrivacy = true;
1314   return NS_OK;
1315 }
1316
1317 NS_IMETHODIMP
1318 imgLoader::Observe(nsISupports* aSubject, const char* aTopic,
1319                    const char16_t* aData) {
1320   if (strcmp(aTopic, "memory-pressure") == 0) {
1321     MinimizeCaches();
1322   } else if (strcmp(aTopic, "chrome-flush-caches") == 0) {
1323     MinimizeCaches();
1324     ClearChromeImageCache();
1325   } else if (strcmp(aTopic, "last-pb-context-exited") == 0) {
1326     if (mRespectPrivacy) {
1327       ClearImageCache();
1328       ClearChromeImageCache();
1329     }
1330   } else if (strcmp(aTopic, "profile-before-change") == 0) {
1331     mCacheTracker = nullptr;
1332   } else if (strcmp(aTopic, "xpcom-shutdown") == 0) {
1333     mCacheTracker = nullptr;
1334     ShutdownMemoryReporter();
1335
1336   } else {
1337     // (Nothing else should bring us here)
1338     MOZ_ASSERT(0, "Invalid topic received");
1339   }
1340
1341   return NS_OK;
1342 }
1343
1344 NS_IMETHODIMP
1345 imgLoader::ClearCache(bool chrome) {
1346   if (XRE_IsParentProcess()) {
1347     bool privateLoader = this == gPrivateBrowsingLoader;
1348     for (auto* cp : ContentParent::AllProcesses(ContentParent::eLive)) {
1349       Unused << cp->SendClearImageCache(privateLoader, chrome);
1350     }
1351   }
1352
1353   if (chrome) {
1354     return ClearChromeImageCache();
1355   }
1356   return ClearImageCache();
1357 }
1358
1359 NS_IMETHODIMP
1360 imgLoader::RemoveEntriesFromPrincipalInAllProcesses(nsIPrincipal* aPrincipal) {
1361   if (!XRE_IsParentProcess()) {
1362     return NS_ERROR_NOT_AVAILABLE;
1363   }
1364
1365   for (auto* cp : ContentParent::AllProcesses(ContentParent::eLive)) {
1366     Unused << cp->SendClearImageCacheFromPrincipal(aPrincipal);
1367   }
1368
1369   imgLoader* loader;
1370   if (aPrincipal->OriginAttributesRef().mPrivateBrowsingId ==
1371       nsIScriptSecurityManager::DEFAULT_PRIVATE_BROWSING_ID) {
1372     loader = imgLoader::NormalLoader();
1373   } else {
1374     loader = imgLoader::PrivateBrowsingLoader();
1375   }
1376
1377   return loader->RemoveEntriesInternal(aPrincipal, nullptr);
1378 }
1379
1380 NS_IMETHODIMP
1381 imgLoader::RemoveEntriesFromBaseDomainInAllProcesses(
1382     const nsACString& aBaseDomain) {
1383   if (!XRE_IsParentProcess()) {
1384     return NS_ERROR_NOT_AVAILABLE;
1385   }
1386
1387   for (auto* cp : ContentParent::AllProcesses(ContentParent::eLive)) {
1388     Unused << cp->SendClearImageCacheFromBaseDomain(nsCString(aBaseDomain));
1389   }
1390
1391   return RemoveEntriesInternal(nullptr, &aBaseDomain);
1392 }
1393
1394 nsresult imgLoader::RemoveEntriesInternal(nsIPrincipal* aPrincipal,
1395                                           const nsACString* aBaseDomain) {
1396   // Can only clear by either principal or base domain.
1397   if ((!aPrincipal && !aBaseDomain) || (aPrincipal && aBaseDomain)) {
1398     return NS_ERROR_INVALID_ARG;
1399   }
1400
1401   nsAutoString origin;
1402   if (aPrincipal) {
1403     nsresult rv = nsContentUtils::GetUTFOrigin(aPrincipal, origin);
1404     if (NS_WARN_IF(NS_FAILED(rv))) {
1405       return rv;
1406     }
1407   }
1408
1409   nsCOMPtr<nsIEffectiveTLDService> tldService;
1410   AutoTArray<RefPtr<imgCacheEntry>, 128> entriesToBeRemoved;
1411
1412   // For base domain we only clear the non-chrome cache.
1413   imgCacheTable& cache =
1414       GetCache(aPrincipal && aPrincipal->IsSystemPrincipal());
1415   for (const auto& entry : cache) {
1416     const auto& key = entry.GetKey();
1417
1418     const bool shouldRemove = [&] {
1419       if (aPrincipal) {
1420         if (key.OriginAttributesRef() !=
1421             BasePrincipal::Cast(aPrincipal)->OriginAttributesRef()) {
1422           return false;
1423         }
1424
1425         nsAutoString imageOrigin;
1426         nsresult rv = nsContentUtils::GetUTFOrigin(key.URI(), imageOrigin);
1427         if (NS_WARN_IF(NS_FAILED(rv))) {
1428           return false;
1429         }
1430
1431         return imageOrigin == origin;
1432       }
1433
1434       if (!aBaseDomain) {
1435         return false;
1436       }
1437       // Clear by baseDomain.
1438       nsAutoCString host;
1439       nsresult rv = key.URI()->GetHost(host);
1440       if (NS_FAILED(rv) || host.IsEmpty()) {
1441         return false;
1442       }
1443
1444       if (!tldService) {
1445         tldService = do_GetService(NS_EFFECTIVETLDSERVICE_CONTRACTID);
1446       }
1447       if (NS_WARN_IF(!tldService)) {
1448         return false;
1449       }
1450
1451       bool hasRootDomain = false;
1452       rv = tldService->HasRootDomain(host, *aBaseDomain, &hasRootDomain);
1453       if (NS_SUCCEEDED(rv) && hasRootDomain) {
1454         return true;
1455       }
1456
1457       // If we don't get a direct base domain match, also check for cache of
1458       // third parties partitioned under aBaseDomain.
1459
1460       // The isolation key is either just the base domain, or an origin suffix
1461       // which contains the partitionKey holding the baseDomain.
1462
1463       if (key.IsolationKeyRef().Equals(*aBaseDomain)) {
1464         return true;
1465       }
1466
1467       // The isolation key does not match the given base domain. It may be an
1468       // origin suffix. Parse it into origin attributes.
1469       OriginAttributes attrs;
1470       if (!attrs.PopulateFromSuffix(key.IsolationKeyRef())) {
1471         // Key is not an origin suffix.
1472         return false;
1473       }
1474
1475       return StoragePrincipalHelper::PartitionKeyHasBaseDomain(
1476           attrs.mPartitionKey, *aBaseDomain);
1477     }();
1478
1479     if (shouldRemove) {
1480       entriesToBeRemoved.AppendElement(entry.GetData());
1481     }
1482   }
1483
1484   for (auto& entry : entriesToBeRemoved) {
1485     if (!RemoveFromCache(entry)) {
1486       NS_WARNING(
1487           "Couldn't remove an entry from the cache in "
1488           "RemoveEntriesInternal()\n");
1489     }
1490   }
1491
1492   return NS_OK;
1493 }
1494
1495 NS_IMETHODIMP
1496 imgLoader::RemoveEntry(nsIURI* aURI, Document* aDoc) {
1497   if (aURI) {
1498     OriginAttributes attrs;
1499     if (aDoc) {
1500       nsCOMPtr<nsIPrincipal> principal = aDoc->NodePrincipal();
1501       if (principal) {
1502         attrs = principal->OriginAttributesRef();
1503       }
1504     }
1505
1506     ImageCacheKey key(aURI, attrs, aDoc);
1507     if (RemoveFromCache(key)) {
1508       return NS_OK;
1509     }
1510   }
1511   return NS_ERROR_NOT_AVAILABLE;
1512 }
1513
1514 NS_IMETHODIMP
1515 imgLoader::FindEntryProperties(nsIURI* uri, Document* aDoc,
1516                                nsIProperties** _retval) {
1517   *_retval = nullptr;
1518
1519   OriginAttributes attrs;
1520   if (aDoc) {
1521     nsCOMPtr<nsIPrincipal> principal = aDoc->NodePrincipal();
1522     if (principal) {
1523       attrs = principal->OriginAttributesRef();
1524     }
1525   }
1526
1527   ImageCacheKey key(uri, attrs, aDoc);
1528   imgCacheTable& cache = GetCache(key);
1529
1530   RefPtr<imgCacheEntry> entry;
1531   if (cache.Get(key, getter_AddRefs(entry)) && entry) {
1532     if (mCacheTracker && entry->HasNoProxies()) {
1533       mCacheTracker->MarkUsed(entry);
1534     }
1535
1536     RefPtr<imgRequest> request = entry->GetRequest();
1537     if (request) {
1538       nsCOMPtr<nsIProperties> properties = request->Properties();
1539       properties.forget(_retval);
1540     }
1541   }
1542
1543   return NS_OK;
1544 }
1545
1546 NS_IMETHODIMP_(void)
1547 imgLoader::ClearCacheForControlledDocument(Document* aDoc) {
1548   MOZ_ASSERT(aDoc);
1549   AutoTArray<RefPtr<imgCacheEntry>, 128> entriesToBeRemoved;
1550   imgCacheTable& cache = GetCache(false);
1551   for (const auto& entry : cache) {
1552     const auto& key = entry.GetKey();
1553     if (key.ControlledDocument() == aDoc) {
1554       entriesToBeRemoved.AppendElement(entry.GetData());
1555     }
1556   }
1557   for (auto& entry : entriesToBeRemoved) {
1558     if (!RemoveFromCache(entry)) {
1559       NS_WARNING(
1560           "Couldn't remove an entry from the cache in "
1561           "ClearCacheForControlledDocument()\n");
1562     }
1563   }
1564 }
1565
1566 void imgLoader::Shutdown() {
1567   NS_IF_RELEASE(gNormalLoader);
1568   gNormalLoader = nullptr;
1569   NS_IF_RELEASE(gPrivateBrowsingLoader);
1570   gPrivateBrowsingLoader = nullptr;
1571 }
1572
1573 nsresult imgLoader::ClearChromeImageCache() {
1574   return EvictEntries(mChromeCache);
1575 }
1576
1577 nsresult imgLoader::ClearImageCache() { return EvictEntries(mCache); }
1578
1579 void imgLoader::MinimizeCaches() {
1580   EvictEntries(mCacheQueue);
1581   EvictEntries(mChromeCacheQueue);
1582 }
1583
1584 bool imgLoader::PutIntoCache(const ImageCacheKey& aKey, imgCacheEntry* entry) {
1585   imgCacheTable& cache = GetCache(aKey);
1586
1587   LOG_STATIC_FUNC_WITH_PARAM(gImgLog, "imgLoader::PutIntoCache", "uri",
1588                              aKey.URI());
1589
1590   // Check to see if this request already exists in the cache. If so, we'll
1591   // replace the old version.
1592   RefPtr<imgCacheEntry> tmpCacheEntry;
1593   if (cache.Get(aKey, getter_AddRefs(tmpCacheEntry)) && tmpCacheEntry) {
1594     MOZ_LOG(
1595         gImgLog, LogLevel::Debug,
1596         ("[this=%p] imgLoader::PutIntoCache -- Element already in the cache",
1597          nullptr));
1598     RefPtr<imgRequest> tmpRequest = tmpCacheEntry->GetRequest();
1599
1600     // If it already exists, and we're putting the same key into the cache, we
1601     // should remove the old version.
1602     MOZ_LOG(gImgLog, LogLevel::Debug,
1603             ("[this=%p] imgLoader::PutIntoCache -- Replacing cached element",
1604              nullptr));
1605
1606     RemoveFromCache(aKey);
1607   } else {
1608     MOZ_LOG(gImgLog, LogLevel::Debug,
1609             ("[this=%p] imgLoader::PutIntoCache --"
1610              " Element NOT already in the cache",
1611              nullptr));
1612   }
1613
1614   cache.InsertOrUpdate(aKey, RefPtr{entry});
1615
1616   // We can be called to resurrect an evicted entry.
1617   if (entry->Evicted()) {
1618     entry->SetEvicted(false);
1619   }
1620
1621   // If we're resurrecting an entry with no proxies, put it back in the
1622   // tracker and queue.
1623   if (entry->HasNoProxies()) {
1624     nsresult addrv = NS_OK;
1625
1626     if (mCacheTracker) {
1627       addrv = mCacheTracker->AddObject(entry);
1628     }
1629
1630     if (NS_SUCCEEDED(addrv)) {
1631       imgCacheQueue& queue = GetCacheQueue(aKey);
1632       queue.Push(entry);
1633     }
1634   }
1635
1636   RefPtr<imgRequest> request = entry->GetRequest();
1637   request->SetIsInCache(true);
1638   RemoveFromUncachedImages(request);
1639
1640   return true;
1641 }
1642
1643 bool imgLoader::SetHasNoProxies(imgRequest* aRequest, imgCacheEntry* aEntry) {
1644   LOG_STATIC_FUNC_WITH_PARAM(gImgLog, "imgLoader::SetHasNoProxies", "uri",
1645                              aRequest->CacheKey().URI());
1646
1647   aEntry->SetHasNoProxies(true);
1648
1649   if (aEntry->Evicted()) {
1650     return false;
1651   }
1652
1653   imgCacheQueue& queue = GetCacheQueue(aRequest->IsChrome());
1654
1655   nsresult addrv = NS_OK;
1656
1657   if (mCacheTracker) {
1658     addrv = mCacheTracker->AddObject(aEntry);
1659   }
1660
1661   if (NS_SUCCEEDED(addrv)) {
1662     queue.Push(aEntry);
1663   }
1664
1665   imgCacheTable& cache = GetCache(aRequest->IsChrome());
1666   CheckCacheLimits(cache, queue);
1667
1668   return true;
1669 }
1670
1671 bool imgLoader::SetHasProxies(imgRequest* aRequest) {
1672   VerifyCacheSizes();
1673
1674   const ImageCacheKey& key = aRequest->CacheKey();
1675   imgCacheTable& cache = GetCache(key);
1676
1677   LOG_STATIC_FUNC_WITH_PARAM(gImgLog, "imgLoader::SetHasProxies", "uri",
1678                              key.URI());
1679
1680   RefPtr<imgCacheEntry> entry;
1681   if (cache.Get(key, getter_AddRefs(entry)) && entry) {
1682     // Make sure the cache entry is for the right request
1683     RefPtr<imgRequest> entryRequest = entry->GetRequest();
1684     if (entryRequest == aRequest && entry->HasNoProxies()) {
1685       imgCacheQueue& queue = GetCacheQueue(key);
1686       queue.Remove(entry);
1687
1688       if (mCacheTracker) {
1689         mCacheTracker->RemoveObject(entry);
1690       }
1691
1692       entry->SetHasNoProxies(false);
1693
1694       return true;
1695     }
1696   }
1697
1698   return false;
1699 }
1700
1701 void imgLoader::CacheEntriesChanged(bool aForChrome,
1702                                     int32_t aSizeDiff /* = 0 */) {
1703   imgCacheQueue& queue = GetCacheQueue(aForChrome);
1704   // We only need to dirty the queue if there is any sorting
1705   // taking place.  Empty or single-entry lists can't become
1706   // dirty.
1707   if (queue.GetNumElements() > 1) {
1708     queue.MarkDirty();
1709   }
1710   queue.UpdateSize(aSizeDiff);
1711 }
1712
1713 void imgLoader::CheckCacheLimits(imgCacheTable& cache, imgCacheQueue& queue) {
1714   if (queue.GetNumElements() == 0) {
1715     NS_ASSERTION(queue.GetSize() == 0,
1716                  "imgLoader::CheckCacheLimits -- incorrect cache size");
1717   }
1718
1719   // Remove entries from the cache until we're back at our desired max size.
1720   while (queue.GetSize() > sCacheMaxSize) {
1721     // Remove the first entry in the queue.
1722     RefPtr<imgCacheEntry> entry(queue.Pop());
1723
1724     NS_ASSERTION(entry, "imgLoader::CheckCacheLimits -- NULL entry pointer");
1725
1726     if (MOZ_LOG_TEST(gImgLog, LogLevel::Debug)) {
1727       RefPtr<imgRequest> req = entry->GetRequest();
1728       if (req) {
1729         LOG_STATIC_FUNC_WITH_PARAM(gImgLog, "imgLoader::CheckCacheLimits",
1730                                    "entry", req->CacheKey().URI());
1731       }
1732     }
1733
1734     if (entry) {
1735       // We just popped this entry from the queue, so pass AlreadyRemoved
1736       // to avoid searching the queue again in RemoveFromCache.
1737       RemoveFromCache(entry, QueueState::AlreadyRemoved);
1738     }
1739   }
1740 }
1741
1742 bool imgLoader::ValidateRequestWithNewChannel(
1743     imgRequest* request, nsIURI* aURI, nsIURI* aInitialDocumentURI,
1744     nsIReferrerInfo* aReferrerInfo, nsILoadGroup* aLoadGroup,
1745     imgINotificationObserver* aObserver, Document* aLoadingDocument,
1746     uint64_t aInnerWindowId, nsLoadFlags aLoadFlags,
1747     nsContentPolicyType aLoadPolicyType, imgRequestProxy** aProxyRequest,
1748     nsIPrincipal* aTriggeringPrincipal, CORSMode aCORSMode, bool aLinkPreload,
1749     bool* aNewChannelCreated) {
1750   // now we need to insert a new channel request object in between the real
1751   // request and the proxy that basically delays loading the image until it
1752   // gets a 304 or figures out that this needs to be a new request
1753
1754   nsresult rv;
1755
1756   // If we're currently in the middle of validating this request, just hand
1757   // back a proxy to it; the required work will be done for us.
1758   if (imgCacheValidator* validator = request->GetValidator()) {
1759     rv = CreateNewProxyForRequest(request, aURI, aLoadGroup, aLoadingDocument,
1760                                   aObserver, aLoadFlags, aProxyRequest);
1761     if (NS_FAILED(rv)) {
1762       return false;
1763     }
1764
1765     if (*aProxyRequest) {
1766       imgRequestProxy* proxy = static_cast<imgRequestProxy*>(*aProxyRequest);
1767
1768       // We will send notifications from imgCacheValidator::OnStartRequest().
1769       // In the mean time, we must defer notifications because we are added to
1770       // the imgRequest's proxy list, and we can get extra notifications
1771       // resulting from methods such as StartDecoding(). See bug 579122.
1772       proxy->MarkValidating();
1773
1774       if (aLinkPreload) {
1775         MOZ_ASSERT(aLoadingDocument);
1776         proxy->PrioritizeAsPreload();
1777         auto preloadKey = PreloadHashKey::CreateAsImage(
1778             aURI, aTriggeringPrincipal, aCORSMode);
1779         proxy->NotifyOpen(preloadKey, aLoadingDocument, true);
1780       }
1781
1782       // Attach the proxy without notifying
1783       validator->AddProxy(proxy);
1784     }
1785
1786     return true;
1787   }
1788   // We will rely on Necko to cache this request when it's possible, and to
1789   // tell imgCacheValidator::OnStartRequest whether the request came from its
1790   // cache.
1791   nsCOMPtr<nsIChannel> newChannel;
1792   bool forcePrincipalCheck;
1793   rv = NewImageChannel(getter_AddRefs(newChannel), &forcePrincipalCheck, aURI,
1794                        aInitialDocumentURI, aCORSMode, aReferrerInfo,
1795                        aLoadGroup, aLoadFlags, aLoadPolicyType,
1796                        aTriggeringPrincipal, aLoadingDocument, mRespectPrivacy);
1797   if (NS_FAILED(rv)) {
1798     return false;
1799   }
1800
1801   if (aNewChannelCreated) {
1802     *aNewChannelCreated = true;
1803   }
1804
1805   RefPtr<imgRequestProxy> req;
1806   rv = CreateNewProxyForRequest(request, aURI, aLoadGroup, aLoadingDocument,
1807                                 aObserver, aLoadFlags, getter_AddRefs(req));
1808   if (NS_FAILED(rv)) {
1809     return false;
1810   }
1811
1812   // Make sure that OnStatus/OnProgress calls have the right request set...
1813   RefPtr<nsProgressNotificationProxy> progressproxy =
1814       new nsProgressNotificationProxy(newChannel, req);
1815   if (!progressproxy) {
1816     return false;
1817   }
1818
1819   RefPtr<imgCacheValidator> hvc =
1820       new imgCacheValidator(progressproxy, this, request, aLoadingDocument,
1821                             aInnerWindowId, forcePrincipalCheck);
1822
1823   // Casting needed here to get past multiple inheritance.
1824   nsCOMPtr<nsIStreamListener> listener =
1825       do_QueryInterface(static_cast<nsIThreadRetargetableStreamListener*>(hvc));
1826   NS_ENSURE_TRUE(listener, false);
1827
1828   // We must set the notification callbacks before setting up the
1829   // CORS listener, because that's also interested inthe
1830   // notification callbacks.
1831   newChannel->SetNotificationCallbacks(hvc);
1832
1833   request->SetValidator(hvc);
1834
1835   // We will send notifications from imgCacheValidator::OnStartRequest().
1836   // In the mean time, we must defer notifications because we are added to
1837   // the imgRequest's proxy list, and we can get extra notifications
1838   // resulting from methods such as StartDecoding(). See bug 579122.
1839   req->MarkValidating();
1840
1841   if (aLinkPreload) {
1842     MOZ_ASSERT(aLoadingDocument);
1843     req->PrioritizeAsPreload();
1844     auto preloadKey =
1845         PreloadHashKey::CreateAsImage(aURI, aTriggeringPrincipal, aCORSMode);
1846     req->NotifyOpen(preloadKey, aLoadingDocument, true);
1847   }
1848
1849   // Add the proxy without notifying
1850   hvc->AddProxy(req);
1851
1852   mozilla::net::PredictorLearn(aURI, aInitialDocumentURI,
1853                                nsINetworkPredictor::LEARN_LOAD_SUBRESOURCE,
1854                                aLoadGroup);
1855   rv = newChannel->AsyncOpen(listener);
1856   if (NS_WARN_IF(NS_FAILED(rv))) {
1857     req->CancelAndForgetObserver(rv);
1858     // This will notify any current or future <link preload> tags.  Pass the
1859     // non-open channel so that we can read loadinfo and referrer info of that
1860     // channel.
1861     req->NotifyStart(newChannel);
1862     // Use the non-channel overload of this method to force the notification to
1863     // happen.  The preload request has not been assigned a channel.
1864     req->NotifyStop(rv);
1865     return false;
1866   }
1867
1868   req.forget(aProxyRequest);
1869   return true;
1870 }
1871
1872 bool imgLoader::ValidateEntry(
1873     imgCacheEntry* aEntry, nsIURI* aURI, nsIURI* aInitialDocumentURI,
1874     nsIReferrerInfo* aReferrerInfo, nsILoadGroup* aLoadGroup,
1875     imgINotificationObserver* aObserver, Document* aLoadingDocument,
1876     nsLoadFlags aLoadFlags, nsContentPolicyType aLoadPolicyType,
1877     bool aCanMakeNewChannel, bool* aNewChannelCreated,
1878     imgRequestProxy** aProxyRequest, nsIPrincipal* aTriggeringPrincipal,
1879     CORSMode aCORSMode, bool aLinkPreload) {
1880   LOG_SCOPE(gImgLog, "imgLoader::ValidateEntry");
1881
1882   // If the expiration time is zero, then the request has not gotten far enough
1883   // to know when it will expire, or we know it will never expire (see
1884   // nsContentUtils::GetSubresourceCacheValidationInfo).
1885   uint32_t expiryTime = aEntry->GetExpiryTime();
1886   bool hasExpired = expiryTime && expiryTime <= SecondsFromPRTime(PR_Now());
1887
1888   nsresult rv;
1889
1890   // Special treatment for file URLs - aEntry has expired if file has changed
1891   nsCOMPtr<nsIFileURL> fileUrl(do_QueryInterface(aURI));
1892   if (fileUrl) {
1893     uint32_t lastModTime = aEntry->GetLoadTime();
1894
1895     nsCOMPtr<nsIFile> theFile;
1896     rv = fileUrl->GetFile(getter_AddRefs(theFile));
1897     if (NS_SUCCEEDED(rv)) {
1898       PRTime fileLastMod;
1899       rv = theFile->GetLastModifiedTime(&fileLastMod);
1900       if (NS_SUCCEEDED(rv)) {
1901         // nsIFile uses millisec, NSPR usec
1902         fileLastMod *= 1000;
1903         hasExpired = SecondsFromPRTime((PRTime)fileLastMod) > lastModTime;
1904       }
1905     }
1906   }
1907
1908   RefPtr<imgRequest> request(aEntry->GetRequest());
1909
1910   if (!request) {
1911     return false;
1912   }
1913
1914   if (!ValidateSecurityInfo(request, aEntry->ForcePrincipalCheck(), aCORSMode,
1915                             aTriggeringPrincipal, aLoadingDocument,
1916                             aLoadPolicyType)) {
1917     return false;
1918   }
1919
1920   // data URIs are immutable and by their nature can't leak data, so we can
1921   // just return true in that case.  Doing so would mean that shift-reload
1922   // doesn't reload data URI documents/images though (which is handy for
1923   // debugging during gecko development) so we make an exception in that case.
1924   nsAutoCString scheme;
1925   aURI->GetScheme(scheme);
1926   if (scheme.EqualsLiteral("data") &&
1927       !(aLoadFlags & nsIRequest::LOAD_BYPASS_CACHE)) {
1928     return true;
1929   }
1930
1931   bool validateRequest = false;
1932
1933   if (!request->CanReuseWithoutValidation(aLoadingDocument)) {
1934     // If we would need to revalidate this entry, but we're being told to
1935     // bypass the cache, we don't allow this entry to be used.
1936     if (aLoadFlags & nsIRequest::LOAD_BYPASS_CACHE) {
1937       return false;
1938     }
1939
1940     if (MOZ_UNLIKELY(ChaosMode::isActive(ChaosFeature::ImageCache))) {
1941       if (ChaosMode::randomUint32LessThan(4) < 1) {
1942         return false;
1943       }
1944     }
1945
1946     // Determine whether the cache aEntry must be revalidated...
1947     validateRequest = ShouldRevalidateEntry(aEntry, aLoadFlags, hasExpired);
1948
1949     MOZ_LOG(gImgLog, LogLevel::Debug,
1950             ("imgLoader::ValidateEntry validating cache entry. "
1951              "validateRequest = %d",
1952              validateRequest));
1953   } else if (!aLoadingDocument && MOZ_LOG_TEST(gImgLog, LogLevel::Debug)) {
1954     MOZ_LOG(gImgLog, LogLevel::Debug,
1955             ("imgLoader::ValidateEntry BYPASSING cache validation for %s "
1956              "because of NULL loading document",
1957              aURI->GetSpecOrDefault().get()));
1958   }
1959
1960   // If the original request is still transferring don't kick off a validation
1961   // network request because it is a bit silly to issue a validation request if
1962   // the original request hasn't even finished yet. So just return true
1963   // indicating the caller can create a new proxy for the request and use it as
1964   // is.
1965   // This is an optimization but it's also required for correctness. If we don't
1966   // do this then when firing the load complete notification for the original
1967   // request that can unblock load for the document and then spin the event loop
1968   // (see the stack in bug 1641682) which then the OnStartRequest for the
1969   // validation request can fire which can call UpdateProxies and can sync
1970   // notify on the progress tracker about all existing state, which includes
1971   // load complete, so we fire a second load complete notification for the
1972   // image.
1973   // In addition, we want to validate if the original request encountered
1974   // an error for two reasons. The first being if the error was a network error
1975   // then trying to re-fetch the image might succeed. The second is more
1976   // complicated. We decide if we should fire the load or error event for img
1977   // elements depending on if the image has error in its status at the time when
1978   // the load complete notification is received, and we set error status on an
1979   // image if it encounters a network error or a decode error with no real way
1980   // to tell them apart. So if we load an image that will produce a decode error
1981   // the first time we will usually fire the load event, and then decode enough
1982   // to encounter the decode error and set the error status on the image. The
1983   // next time we reference the image in the same document the load complete
1984   // notification is replayed and this time the error status from the decode is
1985   // already present so we fire the error event instead of the load event. This
1986   // is a bug (bug 1645576) that we should fix. In order to avoid that bug in
1987   // some cases (specifically the cases when we hit this code and try to
1988   // validate the request) we make sure to validate. This avoids the bug because
1989   // when the load complete notification arrives the proxy is marked as
1990   // validating so it lies about its status and returns nothing.
1991   bool requestComplete = false;
1992   RefPtr<ProgressTracker> tracker;
1993   RefPtr<mozilla::image::Image> image = request->GetImage();
1994   if (image) {
1995     tracker = image->GetProgressTracker();
1996   } else {
1997     tracker = request->GetProgressTracker();
1998   }
1999   if (tracker) {
2000     if (tracker->GetProgress() & (FLAG_LOAD_COMPLETE | FLAG_HAS_ERROR)) {
2001       requestComplete = true;
2002     }
2003   }
2004   if (!requestComplete) {
2005     return true;
2006   }
2007
2008   if (validateRequest && aCanMakeNewChannel) {
2009     LOG_SCOPE(gImgLog, "imgLoader::ValidateRequest |cache hit| must validate");
2010
2011     uint64_t innerWindowID =
2012         aLoadingDocument ? aLoadingDocument->InnerWindowID() : 0;
2013     return ValidateRequestWithNewChannel(
2014         request, aURI, aInitialDocumentURI, aReferrerInfo, aLoadGroup,
2015         aObserver, aLoadingDocument, innerWindowID, aLoadFlags, aLoadPolicyType,
2016         aProxyRequest, aTriggeringPrincipal, aCORSMode, aLinkPreload,
2017         aNewChannelCreated);
2018   }
2019
2020   return !validateRequest;
2021 }
2022
2023 bool imgLoader::RemoveFromCache(const ImageCacheKey& aKey) {
2024   LOG_STATIC_FUNC_WITH_PARAM(gImgLog, "imgLoader::RemoveFromCache", "uri",
2025                              aKey.URI());
2026
2027   imgCacheTable& cache = GetCache(aKey);
2028   imgCacheQueue& queue = GetCacheQueue(aKey);
2029
2030   RefPtr<imgCacheEntry> entry;
2031   cache.Remove(aKey, getter_AddRefs(entry));
2032   if (entry) {
2033     MOZ_ASSERT(!entry->Evicted(), "Evicting an already-evicted cache entry!");
2034
2035     // Entries with no proxies are in the tracker.
2036     if (entry->HasNoProxies()) {
2037       if (mCacheTracker) {
2038         mCacheTracker->RemoveObject(entry);
2039       }
2040       queue.Remove(entry);
2041     }
2042
2043     entry->SetEvicted(true);
2044
2045     RefPtr<imgRequest> request = entry->GetRequest();
2046     request->SetIsInCache(false);
2047     AddToUncachedImages(request);
2048
2049     return true;
2050   }
2051   return false;
2052 }
2053
2054 bool imgLoader::RemoveFromCache(imgCacheEntry* entry, QueueState aQueueState) {
2055   LOG_STATIC_FUNC(gImgLog, "imgLoader::RemoveFromCache entry");
2056
2057   RefPtr<imgRequest> request = entry->GetRequest();
2058   if (request) {
2059     const ImageCacheKey& key = request->CacheKey();
2060     imgCacheTable& cache = GetCache(key);
2061     imgCacheQueue& queue = GetCacheQueue(key);
2062
2063     LOG_STATIC_FUNC_WITH_PARAM(gImgLog, "imgLoader::RemoveFromCache",
2064                                "entry's uri", key.URI());
2065
2066     cache.Remove(key);
2067
2068     if (entry->HasNoProxies()) {
2069       LOG_STATIC_FUNC(gImgLog,
2070                       "imgLoader::RemoveFromCache removing from tracker");
2071       if (mCacheTracker) {
2072         mCacheTracker->RemoveObject(entry);
2073       }
2074       // Only search the queue to remove the entry if its possible it might
2075       // be in the queue.  If we know its not in the queue this would be
2076       // wasted work.
2077       MOZ_ASSERT_IF(aQueueState == QueueState::AlreadyRemoved,
2078                     !queue.Contains(entry));
2079       if (aQueueState == QueueState::MaybeExists) {
2080         queue.Remove(entry);
2081       }
2082     }
2083
2084     entry->SetEvicted(true);
2085     request->SetIsInCache(false);
2086     AddToUncachedImages(request);
2087
2088     return true;
2089   }
2090
2091   return false;
2092 }
2093
2094 nsresult imgLoader::EvictEntries(imgCacheTable& aCacheToClear) {
2095   LOG_STATIC_FUNC(gImgLog, "imgLoader::EvictEntries table");
2096
2097   // We have to make a temporary, since RemoveFromCache removes the element
2098   // from the queue, invalidating iterators.
2099   const auto entries =
2100       ToTArray<nsTArray<RefPtr<imgCacheEntry>>>(aCacheToClear.Values());
2101   for (const auto& entry : entries) {
2102     if (!RemoveFromCache(entry)) {
2103       return NS_ERROR_FAILURE;
2104     }
2105   }
2106
2107   MOZ_ASSERT(aCacheToClear.Count() == 0);
2108
2109   return NS_OK;
2110 }
2111
2112 nsresult imgLoader::EvictEntries(imgCacheQueue& aQueueToClear) {
2113   LOG_STATIC_FUNC(gImgLog, "imgLoader::EvictEntries queue");
2114
2115   // We have to make a temporary, since RemoveFromCache removes the element
2116   // from the queue, invalidating iterators.
2117   nsTArray<RefPtr<imgCacheEntry>> entries(aQueueToClear.GetNumElements());
2118   for (auto i = aQueueToClear.begin(); i != aQueueToClear.end(); ++i) {
2119     entries.AppendElement(*i);
2120   }
2121
2122   // Iterate in reverse order to minimize array copying.
2123   for (auto& entry : entries) {
2124     if (!RemoveFromCache(entry)) {
2125       return NS_ERROR_FAILURE;
2126     }
2127   }
2128
2129   MOZ_ASSERT(aQueueToClear.GetNumElements() == 0);
2130
2131   return NS_OK;
2132 }
2133
2134 void imgLoader::AddToUncachedImages(imgRequest* aRequest) {
2135   MutexAutoLock lock(mUncachedImagesMutex);
2136   mUncachedImages.Insert(aRequest);
2137 }
2138
2139 void imgLoader::RemoveFromUncachedImages(imgRequest* aRequest) {
2140   MutexAutoLock lock(mUncachedImagesMutex);
2141   mUncachedImages.Remove(aRequest);
2142 }
2143
2144 bool imgLoader::PreferLoadFromCache(nsIURI* aURI) const {
2145   // If we are trying to load an image from a protocol that doesn't support
2146   // caching (e.g. thumbnails via the moz-page-thumb:// protocol, or icons via
2147   // the moz-extension:// protocol), load it directly from the cache to prevent
2148   // re-decoding the image. See Bug 1373258.
2149   // TODO: Bug 1406134
2150   return aURI->SchemeIs("moz-page-thumb") || aURI->SchemeIs("moz-extension");
2151 }
2152
2153 #define LOAD_FLAGS_CACHE_MASK \
2154   (nsIRequest::LOAD_BYPASS_CACHE | nsIRequest::LOAD_FROM_CACHE)
2155
2156 #define LOAD_FLAGS_VALIDATE_MASK                              \
2157   (nsIRequest::VALIDATE_ALWAYS | nsIRequest::VALIDATE_NEVER | \
2158    nsIRequest::VALIDATE_ONCE_PER_SESSION)
2159
2160 NS_IMETHODIMP
2161 imgLoader::LoadImageXPCOM(
2162     nsIURI* aURI, nsIURI* aInitialDocumentURI, nsIReferrerInfo* aReferrerInfo,
2163     nsIPrincipal* aTriggeringPrincipal, nsILoadGroup* aLoadGroup,
2164     imgINotificationObserver* aObserver, Document* aLoadingDocument,
2165     nsLoadFlags aLoadFlags, nsISupports* aCacheKey,
2166     nsContentPolicyType aContentPolicyType, imgIRequest** _retval) {
2167   // Optional parameter, so defaults to 0 (== TYPE_INVALID)
2168   if (!aContentPolicyType) {
2169     aContentPolicyType = nsIContentPolicy::TYPE_INTERNAL_IMAGE;
2170   }
2171   imgRequestProxy* proxy;
2172   nsresult rv = LoadImage(
2173       aURI, aInitialDocumentURI, aReferrerInfo, aTriggeringPrincipal, 0,
2174       aLoadGroup, aObserver, aLoadingDocument, aLoadingDocument, aLoadFlags,
2175       aCacheKey, aContentPolicyType, u""_ns,
2176       /* aUseUrgentStartForChannel */ false, /* aListPreload */ false, &proxy);
2177   *_retval = proxy;
2178   return rv;
2179 }
2180
2181 static void MakeRequestStaticIfNeeded(
2182     Document* aLoadingDocument, imgRequestProxy** aProxyAboutToGetReturned) {
2183   if (!aLoadingDocument || !aLoadingDocument->IsStaticDocument()) {
2184     return;
2185   }
2186
2187   if (!*aProxyAboutToGetReturned) {
2188     return;
2189   }
2190
2191   RefPtr<imgRequestProxy> proxy = dont_AddRef(*aProxyAboutToGetReturned);
2192   *aProxyAboutToGetReturned = nullptr;
2193
2194   RefPtr<imgRequestProxy> staticProxy =
2195       proxy->GetStaticRequest(aLoadingDocument);
2196   if (staticProxy != proxy) {
2197     proxy->CancelAndForgetObserver(NS_BINDING_ABORTED);
2198     proxy = std::move(staticProxy);
2199   }
2200   proxy.forget(aProxyAboutToGetReturned);
2201 }
2202
2203 bool imgLoader::IsImageAvailable(nsIURI* aURI,
2204                                  nsIPrincipal* aTriggeringPrincipal,
2205                                  CORSMode aCORSMode, Document* aDocument) {
2206   ImageCacheKey key(aURI, aTriggeringPrincipal->OriginAttributesRef(),
2207                     aDocument);
2208   RefPtr<imgCacheEntry> entry;
2209   imgCacheTable& cache = GetCache(key);
2210   if (!cache.Get(key, getter_AddRefs(entry)) || !entry) {
2211     return false;
2212   }
2213   RefPtr<imgRequest> request = entry->GetRequest();
2214   if (!request) {
2215     return false;
2216   }
2217   return ValidateCORSMode(request, false, aCORSMode, aTriggeringPrincipal);
2218 }
2219
2220 nsresult imgLoader::LoadImage(
2221     nsIURI* aURI, nsIURI* aInitialDocumentURI, nsIReferrerInfo* aReferrerInfo,
2222     nsIPrincipal* aTriggeringPrincipal, uint64_t aRequestContextID,
2223     nsILoadGroup* aLoadGroup, imgINotificationObserver* aObserver,
2224     nsINode* aContext, Document* aLoadingDocument, nsLoadFlags aLoadFlags,
2225     nsISupports* aCacheKey, nsContentPolicyType aContentPolicyType,
2226     const nsAString& initiatorType, bool aUseUrgentStartForChannel,
2227     bool aLinkPreload, imgRequestProxy** _retval) {
2228   VerifyCacheSizes();
2229
2230   NS_ASSERTION(aURI, "imgLoader::LoadImage -- NULL URI pointer");
2231
2232   if (!aURI) {
2233     return NS_ERROR_NULL_POINTER;
2234   }
2235
2236   auto makeStaticIfNeeded = mozilla::MakeScopeExit(
2237       [&] { MakeRequestStaticIfNeeded(aLoadingDocument, _retval); });
2238
2239   AUTO_PROFILER_LABEL_DYNAMIC_NSCSTRING("imgLoader::LoadImage", NETWORK,
2240                                         aURI->GetSpecOrDefault());
2241
2242   LOG_SCOPE_WITH_PARAM(gImgLog, "imgLoader::LoadImage", "aURI", aURI);
2243
2244   *_retval = nullptr;
2245
2246   RefPtr<imgRequest> request;
2247
2248   nsresult rv;
2249   nsLoadFlags requestFlags = nsIRequest::LOAD_NORMAL;
2250
2251 #ifdef DEBUG
2252   bool isPrivate = false;
2253
2254   if (aLoadingDocument) {
2255     isPrivate = nsContentUtils::IsInPrivateBrowsing(aLoadingDocument);
2256   } else if (aLoadGroup) {
2257     isPrivate = nsContentUtils::IsInPrivateBrowsing(aLoadGroup);
2258   }
2259   MOZ_ASSERT(isPrivate == mRespectPrivacy);
2260
2261   if (aLoadingDocument) {
2262     // The given load group should match that of the document if given. If
2263     // that isn't the case, then we need to add more plumbing to ensure we
2264     // block the document as well.
2265     nsCOMPtr<nsILoadGroup> docLoadGroup =
2266         aLoadingDocument->GetDocumentLoadGroup();
2267     MOZ_ASSERT(docLoadGroup == aLoadGroup);
2268   }
2269 #endif
2270
2271   // Get the default load flags from the loadgroup (if possible)...
2272   if (aLoadGroup) {
2273     aLoadGroup->GetLoadFlags(&requestFlags);
2274     if (PreferLoadFromCache(aURI)) {
2275       requestFlags |= nsIRequest::LOAD_FROM_CACHE;
2276     }
2277   }
2278   //
2279   // Merge the default load flags with those passed in via aLoadFlags.
2280   // Currently, *only* the caching, validation and background load flags
2281   // are merged...
2282   //
2283   // The flags in aLoadFlags take precedence over the default flags!
2284   //
2285   if (aLoadFlags & LOAD_FLAGS_CACHE_MASK) {
2286     // Override the default caching flags...
2287     requestFlags = (requestFlags & ~LOAD_FLAGS_CACHE_MASK) |
2288                    (aLoadFlags & LOAD_FLAGS_CACHE_MASK);
2289   }
2290   if (aLoadFlags & LOAD_FLAGS_VALIDATE_MASK) {
2291     // Override the default validation flags...
2292     requestFlags = (requestFlags & ~LOAD_FLAGS_VALIDATE_MASK) |
2293                    (aLoadFlags & LOAD_FLAGS_VALIDATE_MASK);
2294   }
2295   if (aLoadFlags & nsIRequest::LOAD_BACKGROUND) {
2296     // Propagate background loading...
2297     requestFlags |= nsIRequest::LOAD_BACKGROUND;
2298   }
2299   if (aLoadFlags & nsIRequest::LOAD_RECORD_START_REQUEST_DELAY) {
2300     requestFlags |= nsIRequest::LOAD_RECORD_START_REQUEST_DELAY;
2301   }
2302
2303   if (aLinkPreload) {
2304     // Set background loading if it is <link rel=preload>
2305     requestFlags |= nsIRequest::LOAD_BACKGROUND;
2306   }
2307
2308   CORSMode corsmode = CORS_NONE;
2309   if (aLoadFlags & imgILoader::LOAD_CORS_ANONYMOUS) {
2310     corsmode = CORS_ANONYMOUS;
2311   } else if (aLoadFlags & imgILoader::LOAD_CORS_USE_CREDENTIALS) {
2312     corsmode = CORS_USE_CREDENTIALS;
2313   }
2314
2315   // Look in the preloaded images of loading document first.
2316   if (StaticPrefs::network_preload() && !aLinkPreload && aLoadingDocument) {
2317     auto key =
2318         PreloadHashKey::CreateAsImage(aURI, aTriggeringPrincipal, corsmode);
2319     if (RefPtr<PreloaderBase> preload =
2320             aLoadingDocument->Preloads().LookupPreload(key)) {
2321       RefPtr<imgRequestProxy> proxy = do_QueryObject(preload);
2322       MOZ_ASSERT(proxy);
2323
2324       MOZ_LOG(gImgLog, LogLevel::Debug,
2325               ("[this=%p] imgLoader::LoadImage -- preloaded [proxy=%p]"
2326                " [document=%p]\n",
2327                this, proxy.get(), aLoadingDocument));
2328
2329       // Removing the preload for this image to be in parity with Chromium.  Any
2330       // following regular image request will be reloaded using the regular
2331       // path: image cache, http cache, network.  Any following `<link
2332       // rel=preload as=image>` will start a new image preload that can be
2333       // satisfied from http cache or network.
2334       //
2335       // There is a spec discussion for "preload cache", see
2336       // https://github.com/w3c/preload/issues/97. And it is also not clear how
2337       // preload image interacts with list of available images, see
2338       // https://github.com/whatwg/html/issues/4474.
2339       proxy->RemoveSelf(aLoadingDocument);
2340       proxy->NotifyUsage();
2341
2342       imgRequest* request = proxy->GetOwner();
2343       nsresult rv =
2344           CreateNewProxyForRequest(request, aURI, aLoadGroup, aLoadingDocument,
2345                                    aObserver, requestFlags, _retval);
2346       NS_ENSURE_SUCCESS(rv, rv);
2347
2348       imgRequestProxy* newProxy = *_retval;
2349       if (imgCacheValidator* validator = request->GetValidator()) {
2350         newProxy->MarkValidating();
2351         // Attach the proxy without notifying and this will add us to the load
2352         // group.
2353         validator->AddProxy(newProxy);
2354       } else {
2355         // It's OK to add here even if the request is done. If it is, it'll send
2356         // a OnStopRequest()and the proxy will be removed from the loadgroup in
2357         // imgRequestProxy::OnLoadComplete.
2358         newProxy->AddToLoadGroup();
2359         newProxy->NotifyListener();
2360       }
2361
2362       return NS_OK;
2363     }
2364   }
2365
2366   RefPtr<imgCacheEntry> entry;
2367
2368   // Look in the cache for our URI, and then validate it.
2369   // XXX For now ignore aCacheKey. We will need it in the future
2370   // for correctly dealing with image load requests that are a result
2371   // of post data.
2372   OriginAttributes attrs;
2373   if (aTriggeringPrincipal) {
2374     attrs = aTriggeringPrincipal->OriginAttributesRef();
2375   }
2376   ImageCacheKey key(aURI, attrs, aLoadingDocument);
2377   imgCacheTable& cache = GetCache(key);
2378
2379   if (cache.Get(key, getter_AddRefs(entry)) && entry) {
2380     bool newChannelCreated = false;
2381     if (ValidateEntry(entry, aURI, aInitialDocumentURI, aReferrerInfo,
2382                       aLoadGroup, aObserver, aLoadingDocument, requestFlags,
2383                       aContentPolicyType, true, &newChannelCreated, _retval,
2384                       aTriggeringPrincipal, corsmode, aLinkPreload)) {
2385       request = entry->GetRequest();
2386
2387       // If this entry has no proxies, its request has no reference to the
2388       // entry.
2389       if (entry->HasNoProxies()) {
2390         LOG_FUNC_WITH_PARAM(gImgLog,
2391                             "imgLoader::LoadImage() adding proxyless entry",
2392                             "uri", key.URI());
2393         MOZ_ASSERT(!request->HasCacheEntry(),
2394                    "Proxyless entry's request has cache entry!");
2395         request->SetCacheEntry(entry);
2396
2397         if (mCacheTracker && entry->GetExpirationState()->IsTracked()) {
2398           mCacheTracker->MarkUsed(entry);
2399         }
2400       }
2401
2402       entry->Touch();
2403
2404       if (!newChannelCreated) {
2405         // This is ugly but it's needed to report CSP violations. We have 3
2406         // scenarios:
2407         // - we don't have cache. We are not in this if() stmt. A new channel is
2408         //   created and that triggers the CSP checks.
2409         // - We have a cache entry and this is blocked by CSP directives.
2410         DebugOnly<bool> shouldLoad = ShouldLoadCachedImage(
2411             request, aLoadingDocument, aTriggeringPrincipal, aContentPolicyType,
2412             /* aSendCSPViolationReports */ true);
2413         MOZ_ASSERT(shouldLoad);
2414       }
2415     } else {
2416       // We can't use this entry. We'll try to load it off the network, and if
2417       // successful, overwrite the old entry in the cache with a new one.
2418       entry = nullptr;
2419     }
2420   }
2421
2422   // Keep the channel in this scope, so we can adjust its notificationCallbacks
2423   // later when we create the proxy.
2424   nsCOMPtr<nsIChannel> newChannel;
2425   // If we didn't get a cache hit, we need to load from the network.
2426   if (!request) {
2427     LOG_SCOPE(gImgLog, "imgLoader::LoadImage |cache miss|");
2428
2429     bool forcePrincipalCheck;
2430     rv = NewImageChannel(getter_AddRefs(newChannel), &forcePrincipalCheck, aURI,
2431                          aInitialDocumentURI, corsmode, aReferrerInfo,
2432                          aLoadGroup, requestFlags, aContentPolicyType,
2433                          aTriggeringPrincipal, aContext, mRespectPrivacy);
2434     if (NS_FAILED(rv)) {
2435       return NS_ERROR_FAILURE;
2436     }
2437
2438     MOZ_ASSERT(NS_UsePrivateBrowsing(newChannel) == mRespectPrivacy);
2439
2440     NewRequestAndEntry(forcePrincipalCheck, this, key, getter_AddRefs(request),
2441                        getter_AddRefs(entry));
2442
2443     MOZ_LOG(gImgLog, LogLevel::Debug,
2444             ("[this=%p] imgLoader::LoadImage -- Created new imgRequest"
2445              " [request=%p]\n",
2446              this, request.get()));
2447
2448     nsCOMPtr<nsIClassOfService> cos(do_QueryInterface(newChannel));
2449     if (cos) {
2450       if (aUseUrgentStartForChannel && !aLinkPreload) {
2451         cos->AddClassFlags(nsIClassOfService::UrgentStart);
2452       }
2453
2454       if (StaticPrefs::network_http_tailing_enabled() &&
2455           aContentPolicyType == nsIContentPolicy::TYPE_INTERNAL_IMAGE_FAVICON) {
2456         cos->AddClassFlags(nsIClassOfService::Throttleable |
2457                            nsIClassOfService::Tail);
2458         nsCOMPtr<nsIHttpChannel> httpChannel(do_QueryInterface(newChannel));
2459         if (httpChannel) {
2460           Unused << httpChannel->SetRequestContextID(aRequestContextID);
2461         }
2462       }
2463     }
2464
2465     nsCOMPtr<nsILoadGroup> channelLoadGroup;
2466     newChannel->GetLoadGroup(getter_AddRefs(channelLoadGroup));
2467     rv = request->Init(aURI, aURI, /* aHadInsecureRedirect = */ false,
2468                        channelLoadGroup, newChannel, entry, aLoadingDocument,
2469                        aTriggeringPrincipal, corsmode, aReferrerInfo);
2470     if (NS_FAILED(rv)) {
2471       return NS_ERROR_FAILURE;
2472     }
2473
2474     // Add the initiator type for this image load
2475     nsCOMPtr<nsITimedChannel> timedChannel = do_QueryInterface(newChannel);
2476     if (timedChannel) {
2477       timedChannel->SetInitiatorType(initiatorType);
2478     }
2479
2480     // create the proxy listener
2481     nsCOMPtr<nsIStreamListener> listener = new ProxyListener(request.get());
2482
2483     MOZ_LOG(gImgLog, LogLevel::Debug,
2484             ("[this=%p] imgLoader::LoadImage -- Calling channel->AsyncOpen()\n",
2485              this));
2486
2487     mozilla::net::PredictorLearn(aURI, aInitialDocumentURI,
2488                                  nsINetworkPredictor::LEARN_LOAD_SUBRESOURCE,
2489                                  aLoadGroup);
2490
2491     nsresult openRes = newChannel->AsyncOpen(listener);
2492
2493     if (NS_FAILED(openRes)) {
2494       MOZ_LOG(
2495           gImgLog, LogLevel::Debug,
2496           ("[this=%p] imgLoader::LoadImage -- AsyncOpen() failed: 0x%" PRIx32
2497            "\n",
2498            this, static_cast<uint32_t>(openRes)));
2499       request->CancelAndAbort(openRes);
2500       return openRes;
2501     }
2502
2503     // Try to add the new request into the cache.
2504     PutIntoCache(key, entry);
2505   } else {
2506     LOG_MSG_WITH_PARAM(gImgLog, "imgLoader::LoadImage |cache hit|", "request",
2507                        request);
2508   }
2509
2510   // If we didn't get a proxy when validating the cache entry, we need to
2511   // create one.
2512   if (!*_retval) {
2513     // ValidateEntry() has three return values: "Is valid," "might be valid --
2514     // validating over network", and "not valid." If we don't have a _retval,
2515     // we know ValidateEntry is not validating over the network, so it's safe
2516     // to SetLoadId here because we know this request is valid for this context.
2517     //
2518     // Note, however, that this doesn't guarantee the behaviour we want (one
2519     // URL maps to the same image on a page) if we load the same image in a
2520     // different tab (see bug 528003), because its load id will get re-set, and
2521     // that'll cause us to validate over the network.
2522     request->SetLoadId(aLoadingDocument);
2523
2524     LOG_MSG(gImgLog, "imgLoader::LoadImage", "creating proxy request.");
2525     rv = CreateNewProxyForRequest(request, aURI, aLoadGroup, aLoadingDocument,
2526                                   aObserver, requestFlags, _retval);
2527     if (NS_FAILED(rv)) {
2528       return rv;
2529     }
2530
2531     imgRequestProxy* proxy = *_retval;
2532
2533     // Make sure that OnStatus/OnProgress calls have the right request set, if
2534     // we did create a channel here.
2535     if (newChannel) {
2536       nsCOMPtr<nsIInterfaceRequestor> requestor(
2537           new nsProgressNotificationProxy(newChannel, proxy));
2538       if (!requestor) {
2539         return NS_ERROR_OUT_OF_MEMORY;
2540       }
2541       newChannel->SetNotificationCallbacks(requestor);
2542     }
2543
2544     if (aLinkPreload) {
2545       MOZ_ASSERT(aLoadingDocument);
2546       proxy->PrioritizeAsPreload();
2547       auto preloadKey =
2548           PreloadHashKey::CreateAsImage(aURI, aTriggeringPrincipal, corsmode);
2549       proxy->NotifyOpen(preloadKey, aLoadingDocument, true);
2550     }
2551
2552     // Note that it's OK to add here even if the request is done.  If it is,
2553     // it'll send a OnStopRequest() to the proxy in imgRequestProxy::Notify and
2554     // the proxy will be removed from the loadgroup.
2555     proxy->AddToLoadGroup();
2556
2557     // If we're loading off the network, explicitly don't notify our proxy,
2558     // because necko (or things called from necko, such as imgCacheValidator)
2559     // are going to call our notifications asynchronously, and we can't make it
2560     // further asynchronous because observers might rely on imagelib completing
2561     // its work between the channel's OnStartRequest and OnStopRequest.
2562     if (!newChannel) {
2563       proxy->NotifyListener();
2564     }
2565
2566     return rv;
2567   }
2568
2569   NS_ASSERTION(*_retval, "imgLoader::LoadImage -- no return value");
2570
2571   return NS_OK;
2572 }
2573
2574 NS_IMETHODIMP
2575 imgLoader::LoadImageWithChannelXPCOM(nsIChannel* channel,
2576                                      imgINotificationObserver* aObserver,
2577                                      Document* aLoadingDocument,
2578                                      nsIStreamListener** listener,
2579                                      imgIRequest** _retval) {
2580   nsresult result;
2581   imgRequestProxy* proxy;
2582   result = LoadImageWithChannel(channel, aObserver, aLoadingDocument, listener,
2583                                 &proxy);
2584   *_retval = proxy;
2585   return result;
2586 }
2587
2588 nsresult imgLoader::LoadImageWithChannel(nsIChannel* channel,
2589                                          imgINotificationObserver* aObserver,
2590                                          Document* aLoadingDocument,
2591                                          nsIStreamListener** listener,
2592                                          imgRequestProxy** _retval) {
2593   NS_ASSERTION(channel,
2594                "imgLoader::LoadImageWithChannel -- NULL channel pointer");
2595
2596   MOZ_ASSERT(NS_UsePrivateBrowsing(channel) == mRespectPrivacy);
2597
2598   auto makeStaticIfNeeded = mozilla::MakeScopeExit(
2599       [&] { MakeRequestStaticIfNeeded(aLoadingDocument, _retval); });
2600
2601   LOG_SCOPE(gImgLog, "imgLoader::LoadImageWithChannel");
2602   RefPtr<imgRequest> request;
2603
2604   nsCOMPtr<nsIURI> uri;
2605   channel->GetURI(getter_AddRefs(uri));
2606
2607   NS_ENSURE_TRUE(channel, NS_ERROR_FAILURE);
2608   nsCOMPtr<nsILoadInfo> loadInfo = channel->LoadInfo();
2609
2610   OriginAttributes attrs = loadInfo->GetOriginAttributes();
2611
2612   ImageCacheKey key(uri, attrs, aLoadingDocument);
2613
2614   nsLoadFlags requestFlags = nsIRequest::LOAD_NORMAL;
2615   channel->GetLoadFlags(&requestFlags);
2616
2617   if (PreferLoadFromCache(uri)) {
2618     requestFlags |= nsIRequest::LOAD_FROM_CACHE;
2619   }
2620
2621   RefPtr<imgCacheEntry> entry;
2622
2623   if (requestFlags & nsIRequest::LOAD_BYPASS_CACHE) {
2624     RemoveFromCache(key);
2625   } else {
2626     // Look in the cache for our URI, and then validate it.
2627     // XXX For now ignore aCacheKey. We will need it in the future
2628     // for correctly dealing with image load requests that are a result
2629     // of post data.
2630     imgCacheTable& cache = GetCache(key);
2631     if (cache.Get(key, getter_AddRefs(entry)) && entry) {
2632       // We don't want to kick off another network load. So we ask
2633       // ValidateEntry to only do validation without creating a new proxy. If
2634       // it says that the entry isn't valid any more, we'll only use the entry
2635       // we're getting if the channel is loading from the cache anyways.
2636       //
2637       // XXX -- should this be changed? it's pretty much verbatim from the old
2638       // code, but seems nonsensical.
2639       //
2640       // Since aCanMakeNewChannel == false, we don't need to pass content policy
2641       // type/principal/etc
2642
2643       nsCOMPtr<nsILoadInfo> loadInfo = channel->LoadInfo();
2644       // if there is a loadInfo, use the right contentType, otherwise
2645       // default to the internal image type
2646       nsContentPolicyType policyType = loadInfo->InternalContentPolicyType();
2647
2648       if (ValidateEntry(entry, uri, nullptr, nullptr, nullptr, aObserver,
2649                         aLoadingDocument, requestFlags, policyType, false,
2650                         nullptr, nullptr, nullptr, CORS_NONE, false)) {
2651         request = entry->GetRequest();
2652       } else {
2653         nsCOMPtr<nsICacheInfoChannel> cacheChan(do_QueryInterface(channel));
2654         bool bUseCacheCopy;
2655
2656         if (cacheChan) {
2657           cacheChan->IsFromCache(&bUseCacheCopy);
2658         } else {
2659           bUseCacheCopy = false;
2660         }
2661
2662         if (!bUseCacheCopy) {
2663           entry = nullptr;
2664         } else {
2665           request = entry->GetRequest();
2666         }
2667       }
2668
2669       if (request && entry) {
2670         // If this entry has no proxies, its request has no reference to
2671         // the entry.
2672         if (entry->HasNoProxies()) {
2673           LOG_FUNC_WITH_PARAM(
2674               gImgLog,
2675               "imgLoader::LoadImageWithChannel() adding proxyless entry", "uri",
2676               key.URI());
2677           MOZ_ASSERT(!request->HasCacheEntry(),
2678                      "Proxyless entry's request has cache entry!");
2679           request->SetCacheEntry(entry);
2680
2681           if (mCacheTracker && entry->GetExpirationState()->IsTracked()) {
2682             mCacheTracker->MarkUsed(entry);
2683           }
2684         }
2685       }
2686     }
2687   }
2688
2689   nsCOMPtr<nsILoadGroup> loadGroup;
2690   channel->GetLoadGroup(getter_AddRefs(loadGroup));
2691
2692 #ifdef DEBUG
2693   if (aLoadingDocument) {
2694     // The load group of the channel should always match that of the
2695     // document if given. If that isn't the case, then we need to add more
2696     // plumbing to ensure we block the document as well.
2697     nsCOMPtr<nsILoadGroup> docLoadGroup =
2698         aLoadingDocument->GetDocumentLoadGroup();
2699     MOZ_ASSERT(docLoadGroup == loadGroup);
2700   }
2701 #endif
2702
2703   // Filter out any load flags not from nsIRequest
2704   requestFlags &= nsIRequest::LOAD_REQUESTMASK;
2705
2706   nsresult rv = NS_OK;
2707   if (request) {
2708     // we have this in our cache already.. cancel the current (document) load
2709
2710     // this should fire an OnStopRequest
2711     channel->Cancel(NS_ERROR_PARSED_DATA_CACHED);
2712
2713     *listener = nullptr;  // give them back a null nsIStreamListener
2714
2715     rv = CreateNewProxyForRequest(request, uri, loadGroup, aLoadingDocument,
2716                                   aObserver, requestFlags, _retval);
2717     static_cast<imgRequestProxy*>(*_retval)->NotifyListener();
2718   } else {
2719     // We use originalURI here to fulfil the imgIRequest contract on GetURI.
2720     nsCOMPtr<nsIURI> originalURI;
2721     channel->GetOriginalURI(getter_AddRefs(originalURI));
2722
2723     // XXX(seth): We should be able to just use |key| here, except that |key| is
2724     // constructed above with the *current URI* and not the *original URI*. I'm
2725     // pretty sure this is a bug, and it's preventing us from ever getting a
2726     // cache hit in LoadImageWithChannel when redirects are involved.
2727     ImageCacheKey originalURIKey(originalURI, attrs, aLoadingDocument);
2728
2729     // Default to doing a principal check because we don't know who
2730     // started that load and whether their principal ended up being
2731     // inherited on the channel.
2732     NewRequestAndEntry(/* aForcePrincipalCheckForCacheEntry = */ true, this,
2733                        originalURIKey, getter_AddRefs(request),
2734                        getter_AddRefs(entry));
2735
2736     // No principal specified here, because we're not passed one.
2737     // In LoadImageWithChannel, the redirects that may have been
2738     // associated with this load would have gone through necko.
2739     // We only have the final URI in ImageLib and hence don't know
2740     // if the request went through insecure redirects.  But if it did,
2741     // the necko cache should have handled that (since all necko cache hits
2742     // including the redirects will go through content policy).  Hence, we
2743     // can set aHadInsecureRedirect to false here.
2744     rv = request->Init(originalURI, uri, /* aHadInsecureRedirect = */ false,
2745                        channel, channel, entry, aLoadingDocument, nullptr,
2746                        CORS_NONE, nullptr);
2747     NS_ENSURE_SUCCESS(rv, rv);
2748
2749     RefPtr<ProxyListener> pl =
2750         new ProxyListener(static_cast<nsIStreamListener*>(request.get()));
2751     pl.forget(listener);
2752
2753     // Try to add the new request into the cache.
2754     PutIntoCache(originalURIKey, entry);
2755
2756     rv = CreateNewProxyForRequest(request, originalURI, loadGroup,
2757                                   aLoadingDocument, aObserver, requestFlags,
2758                                   _retval);
2759
2760     // Explicitly don't notify our proxy, because we're loading off the
2761     // network, and necko (or things called from necko, such as
2762     // imgCacheValidator) are going to call our notifications asynchronously,
2763     // and we can't make it further asynchronous because observers might rely
2764     // on imagelib completing its work between the channel's OnStartRequest and
2765     // OnStopRequest.
2766   }
2767
2768   if (NS_FAILED(rv)) {
2769     return rv;
2770   }
2771
2772   (*_retval)->AddToLoadGroup();
2773   return rv;
2774 }
2775
2776 bool imgLoader::SupportImageWithMimeType(const nsACString& aMimeType,
2777                                          AcceptedMimeTypes aAccept
2778                                          /* = AcceptedMimeTypes::IMAGES */) {
2779   nsAutoCString mimeType(aMimeType);
2780   ToLowerCase(mimeType);
2781
2782   if (aAccept == AcceptedMimeTypes::IMAGES_AND_DOCUMENTS &&
2783       mimeType.EqualsLiteral("image/svg+xml")) {
2784     return true;
2785   }
2786
2787   DecoderType type = DecoderFactory::GetDecoderType(mimeType.get());
2788   return type != DecoderType::UNKNOWN;
2789 }
2790
2791 NS_IMETHODIMP
2792 imgLoader::GetMIMETypeFromContent(nsIRequest* aRequest,
2793                                   const uint8_t* aContents, uint32_t aLength,
2794                                   nsACString& aContentType) {
2795   nsCOMPtr<nsIChannel> channel(do_QueryInterface(aRequest));
2796   if (channel) {
2797     nsCOMPtr<nsILoadInfo> loadInfo = channel->LoadInfo();
2798     if (loadInfo->GetSkipContentSniffing()) {
2799       return NS_ERROR_NOT_AVAILABLE;
2800     }
2801   }
2802
2803   nsresult rv =
2804       GetMimeTypeFromContent((const char*)aContents, aLength, aContentType);
2805   if (NS_SUCCEEDED(rv) && channel && XRE_IsParentProcess()) {
2806     if (RefPtr<mozilla::net::nsHttpChannel> httpChannel =
2807             do_QueryObject(channel)) {
2808       // If the image type pattern matching algorithm given bytes does not
2809       // return undefined, then disable the further check and allow the
2810       // response.
2811       httpChannel->DisableIsOpaqueResponseAllowedAfterSniffCheck(
2812           mozilla::net::nsHttpChannel::SnifferType::Image);
2813     }
2814   }
2815
2816   return rv;
2817 }
2818
2819 /* static */
2820 nsresult imgLoader::GetMimeTypeFromContent(const char* aContents,
2821                                            uint32_t aLength,
2822                                            nsACString& aContentType) {
2823   nsAutoCString detected;
2824
2825   /* Is it a GIF? */
2826   if (aLength >= 6 &&
2827       (!strncmp(aContents, "GIF87a", 6) || !strncmp(aContents, "GIF89a", 6))) {
2828     aContentType.AssignLiteral(IMAGE_GIF);
2829
2830     /* or a PNG? */
2831   } else if (aLength >= 8 && ((unsigned char)aContents[0] == 0x89 &&
2832                               (unsigned char)aContents[1] == 0x50 &&
2833                               (unsigned char)aContents[2] == 0x4E &&
2834                               (unsigned char)aContents[3] == 0x47 &&
2835                               (unsigned char)aContents[4] == 0x0D &&
2836                               (unsigned char)aContents[5] == 0x0A &&
2837                               (unsigned char)aContents[6] == 0x1A &&
2838                               (unsigned char)aContents[7] == 0x0A)) {
2839     aContentType.AssignLiteral(IMAGE_PNG);
2840
2841     /* maybe a JPEG (JFIF)? */
2842     /* JFIF files start with SOI APP0 but older files can start with SOI DQT
2843      * so we test for SOI followed by any marker, i.e. FF D8 FF
2844      * this will also work for SPIFF JPEG files if they appear in the future.
2845      *
2846      * (JFIF is 0XFF 0XD8 0XFF 0XE0 <skip 2> 0X4A 0X46 0X49 0X46 0X00)
2847      */
2848   } else if (aLength >= 3 && ((unsigned char)aContents[0]) == 0xFF &&
2849              ((unsigned char)aContents[1]) == 0xD8 &&
2850              ((unsigned char)aContents[2]) == 0xFF) {
2851     aContentType.AssignLiteral(IMAGE_JPEG);
2852
2853     /* or how about ART? */
2854     /* ART begins with JG (4A 47). Major version offset 2.
2855      * Minor version offset 3. Offset 4 must be nullptr.
2856      */
2857   } else if (aLength >= 5 && ((unsigned char)aContents[0]) == 0x4a &&
2858              ((unsigned char)aContents[1]) == 0x47 &&
2859              ((unsigned char)aContents[4]) == 0x00) {
2860     aContentType.AssignLiteral(IMAGE_ART);
2861
2862   } else if (aLength >= 2 && !strncmp(aContents, "BM", 2)) {
2863     aContentType.AssignLiteral(IMAGE_BMP);
2864
2865     // ICOs always begin with a 2-byte 0 followed by a 2-byte 1.
2866     // CURs begin with 2-byte 0 followed by 2-byte 2.
2867   } else if (aLength >= 4 && (!memcmp(aContents, "\000\000\001\000", 4) ||
2868                               !memcmp(aContents, "\000\000\002\000", 4))) {
2869     aContentType.AssignLiteral(IMAGE_ICO);
2870
2871     // WebPs always begin with RIFF, a 32-bit length, and WEBP.
2872   } else if (aLength >= 12 && !memcmp(aContents, "RIFF", 4) &&
2873              !memcmp(aContents + 8, "WEBP", 4)) {
2874     aContentType.AssignLiteral(IMAGE_WEBP);
2875
2876   } else if (MatchesMP4(reinterpret_cast<const uint8_t*>(aContents), aLength,
2877                         detected) &&
2878              detected.Equals(IMAGE_AVIF)) {
2879     aContentType.AssignLiteral(IMAGE_AVIF);
2880   } else if ((aLength >= 2 && !memcmp(aContents, "\xFF\x0A", 2)) ||
2881              (aLength >= 12 &&
2882               !memcmp(aContents, "\x00\x00\x00\x0CJXL \x0D\x0A\x87\x0A", 12))) {
2883     // Each version is for containerless and containerful files respectively.
2884     aContentType.AssignLiteral(IMAGE_JXL);
2885   } else {
2886     /* none of the above?  I give up */
2887     return NS_ERROR_NOT_AVAILABLE;
2888   }
2889
2890   return NS_OK;
2891 }
2892
2893 /**
2894  * proxy stream listener class used to handle multipart/x-mixed-replace
2895  */
2896
2897 #include "nsIRequest.h"
2898 #include "nsIStreamConverterService.h"
2899
2900 NS_IMPL_ISUPPORTS(ProxyListener, nsIStreamListener,
2901                   nsIThreadRetargetableStreamListener, nsIRequestObserver)
2902
2903 ProxyListener::ProxyListener(nsIStreamListener* dest) : mDestListener(dest) {
2904   /* member initializers and constructor code */
2905 }
2906
2907 ProxyListener::~ProxyListener() { /* destructor code */
2908 }
2909
2910 /** nsIRequestObserver methods **/
2911
2912 NS_IMETHODIMP
2913 ProxyListener::OnStartRequest(nsIRequest* aRequest) {
2914   if (!mDestListener) {
2915     return NS_ERROR_FAILURE;
2916   }
2917
2918   nsCOMPtr<nsIChannel> channel(do_QueryInterface(aRequest));
2919   if (channel) {
2920     // We need to set the initiator type for the image load
2921     nsCOMPtr<nsITimedChannel> timedChannel = do_QueryInterface(channel);
2922     if (timedChannel) {
2923       nsAutoString type;
2924       timedChannel->GetInitiatorType(type);
2925       if (type.IsEmpty()) {
2926         timedChannel->SetInitiatorType(u"img"_ns);
2927       }
2928     }
2929
2930     nsAutoCString contentType;
2931     nsresult rv = channel->GetContentType(contentType);
2932
2933     if (!contentType.IsEmpty()) {
2934       /* If multipart/x-mixed-replace content, we'll insert a MIME decoder
2935          in the pipeline to handle the content and pass it along to our
2936          original listener.
2937        */
2938       if ("multipart/x-mixed-replace"_ns.Equals(contentType)) {
2939         nsCOMPtr<nsIStreamConverterService> convServ(
2940             do_GetService("@mozilla.org/streamConverters;1", &rv));
2941         if (NS_SUCCEEDED(rv)) {
2942           nsCOMPtr<nsIStreamListener> toListener(mDestListener);
2943           nsCOMPtr<nsIStreamListener> fromListener;
2944
2945           rv = convServ->AsyncConvertData("multipart/x-mixed-replace", "*/*",
2946                                           toListener, nullptr,
2947                                           getter_AddRefs(fromListener));
2948           if (NS_SUCCEEDED(rv)) {
2949             mDestListener = fromListener;
2950           }
2951         }
2952       }
2953     }
2954   }
2955
2956   return mDestListener->OnStartRequest(aRequest);
2957 }
2958
2959 NS_IMETHODIMP
2960 ProxyListener::OnStopRequest(nsIRequest* aRequest, nsresult status) {
2961   if (!mDestListener) {
2962     return NS_ERROR_FAILURE;
2963   }
2964
2965   return mDestListener->OnStopRequest(aRequest, status);
2966 }
2967
2968 /** nsIStreamListener methods **/
2969
2970 NS_IMETHODIMP
2971 ProxyListener::OnDataAvailable(nsIRequest* aRequest, nsIInputStream* inStr,
2972                                uint64_t sourceOffset, uint32_t count) {
2973   if (!mDestListener) {
2974     return NS_ERROR_FAILURE;
2975   }
2976
2977   return mDestListener->OnDataAvailable(aRequest, inStr, sourceOffset, count);
2978 }
2979
2980 /** nsThreadRetargetableStreamListener methods **/
2981 NS_IMETHODIMP
2982 ProxyListener::CheckListenerChain() {
2983   NS_ASSERTION(NS_IsMainThread(), "Should be on the main thread!");
2984   nsresult rv = NS_OK;
2985   nsCOMPtr<nsIThreadRetargetableStreamListener> retargetableListener =
2986       do_QueryInterface(mDestListener, &rv);
2987   if (retargetableListener) {
2988     rv = retargetableListener->CheckListenerChain();
2989   }
2990   MOZ_LOG(
2991       gImgLog, LogLevel::Debug,
2992       ("ProxyListener::CheckListenerChain %s [this=%p listener=%p rv=%" PRIx32
2993        "]",
2994        (NS_SUCCEEDED(rv) ? "success" : "failure"), this,
2995        (nsIStreamListener*)mDestListener, static_cast<uint32_t>(rv)));
2996   return rv;
2997 }
2998
2999 /**
3000  * http validate class.  check a channel for a 304
3001  */
3002
3003 NS_IMPL_ISUPPORTS(imgCacheValidator, nsIStreamListener, nsIRequestObserver,
3004                   nsIThreadRetargetableStreamListener, nsIChannelEventSink,
3005                   nsIInterfaceRequestor, nsIAsyncVerifyRedirectCallback)
3006
3007 imgCacheValidator::imgCacheValidator(nsProgressNotificationProxy* progress,
3008                                      imgLoader* loader, imgRequest* request,
3009                                      Document* aDocument,
3010                                      uint64_t aInnerWindowId,
3011                                      bool forcePrincipalCheckForCacheEntry)
3012     : mProgressProxy(progress),
3013       mRequest(request),
3014       mDocument(aDocument),
3015       mInnerWindowId(aInnerWindowId),
3016       mImgLoader(loader),
3017       mHadInsecureRedirect(false) {
3018   NewRequestAndEntry(forcePrincipalCheckForCacheEntry, loader,
3019                      mRequest->CacheKey(), getter_AddRefs(mNewRequest),
3020                      getter_AddRefs(mNewEntry));
3021 }
3022
3023 imgCacheValidator::~imgCacheValidator() {
3024   if (mRequest) {
3025     // If something went wrong, and we never unblocked the requests waiting on
3026     // validation, now is our last chance. We will cancel the new request and
3027     // switch the waiting proxies to it.
3028     UpdateProxies(/* aCancelRequest */ true, /* aSyncNotify */ false);
3029   }
3030 }
3031
3032 void imgCacheValidator::AddProxy(imgRequestProxy* aProxy) {
3033   // aProxy needs to be in the loadgroup since we're validating from
3034   // the network.
3035   aProxy->AddToLoadGroup();
3036
3037   mProxies.AppendElement(aProxy);
3038 }
3039
3040 void imgCacheValidator::RemoveProxy(imgRequestProxy* aProxy) {
3041   mProxies.RemoveElement(aProxy);
3042 }
3043
3044 void imgCacheValidator::UpdateProxies(bool aCancelRequest, bool aSyncNotify) {
3045   MOZ_ASSERT(mRequest);
3046
3047   // Clear the validator before updating the proxies. The notifications may
3048   // clone an existing request, and its state could be inconsistent.
3049   mRequest->SetValidator(nullptr);
3050   mRequest = nullptr;
3051
3052   // If an error occurred, we will want to cancel the new request, and make the
3053   // validating proxies point to it. Any proxies still bound to the original
3054   // request which are not validating should remain untouched.
3055   if (aCancelRequest) {
3056     MOZ_ASSERT(mNewRequest);
3057     mNewRequest->CancelAndAbort(NS_BINDING_ABORTED);
3058   }
3059
3060   // We have finished validating the request, so we can safely take ownership
3061   // of the proxy list. imgRequestProxy::SyncNotifyListener can mutate the list
3062   // if imgRequestProxy::CancelAndForgetObserver is called by its owner. Note
3063   // that any potential notifications should still be suppressed in
3064   // imgRequestProxy::ChangeOwner because we haven't cleared the validating
3065   // flag yet, and thus they will remain deferred.
3066   AutoTArray<RefPtr<imgRequestProxy>, 4> proxies(std::move(mProxies));
3067
3068   for (auto& proxy : proxies) {
3069     // First update the state of all proxies before notifying any of them
3070     // to ensure a consistent state (e.g. in case the notification causes
3071     // other proxies to be touched indirectly.)
3072     MOZ_ASSERT(proxy->IsValidating());
3073     MOZ_ASSERT(proxy->NotificationsDeferred(),
3074                "Proxies waiting on cache validation should be "
3075                "deferring notifications!");
3076     if (mNewRequest) {
3077       proxy->ChangeOwner(mNewRequest);
3078     }
3079     proxy->ClearValidating();
3080   }
3081
3082   mNewRequest = nullptr;
3083   mNewEntry = nullptr;
3084
3085   for (auto& proxy : proxies) {
3086     if (aSyncNotify) {
3087       // Notify synchronously, because the caller knows we are already in an
3088       // asynchronously-called function (e.g. OnStartRequest).
3089       proxy->SyncNotifyListener();
3090     } else {
3091       // Notify asynchronously, because the caller does not know our current
3092       // call state (e.g. ~imgCacheValidator).
3093       proxy->NotifyListener();
3094     }
3095   }
3096 }
3097
3098 /** nsIRequestObserver methods **/
3099
3100 NS_IMETHODIMP
3101 imgCacheValidator::OnStartRequest(nsIRequest* aRequest) {
3102   // We may be holding on to a document, so ensure that it's released.
3103   RefPtr<Document> document = mDocument.forget();
3104
3105   // If for some reason we don't still have an existing request (probably
3106   // because OnStartRequest got delivered more than once), just bail.
3107   if (!mRequest) {
3108     MOZ_ASSERT_UNREACHABLE("OnStartRequest delivered more than once?");
3109     aRequest->Cancel(NS_BINDING_ABORTED);
3110     return NS_ERROR_FAILURE;
3111   }
3112
3113   // If this request is coming from cache and has the same URI as our
3114   // imgRequest, the request all our proxies are pointing at is valid, and all
3115   // we have to do is tell them to notify their listeners.
3116   nsCOMPtr<nsICacheInfoChannel> cacheChan(do_QueryInterface(aRequest));
3117   nsCOMPtr<nsIChannel> channel(do_QueryInterface(aRequest));
3118   if (cacheChan && channel) {
3119     bool isFromCache = false;
3120     cacheChan->IsFromCache(&isFromCache);
3121
3122     nsCOMPtr<nsIURI> channelURI;
3123     channel->GetURI(getter_AddRefs(channelURI));
3124
3125     nsCOMPtr<nsIURI> finalURI;
3126     mRequest->GetFinalURI(getter_AddRefs(finalURI));
3127
3128     bool sameURI = false;
3129     if (channelURI && finalURI) {
3130       channelURI->Equals(finalURI, &sameURI);
3131     }
3132
3133     if (isFromCache && sameURI) {
3134       // We don't need to load this any more.
3135       aRequest->Cancel(NS_BINDING_ABORTED);
3136       mNewRequest = nullptr;
3137
3138       // Clear the validator before updating the proxies. The notifications may
3139       // clone an existing request, and its state could be inconsistent.
3140       mRequest->SetLoadId(document);
3141       mRequest->SetInnerWindowID(mInnerWindowId);
3142       UpdateProxies(/* aCancelRequest */ false, /* aSyncNotify */ true);
3143       return NS_OK;
3144     }
3145   }
3146
3147   // We can't load out of cache. We have to create a whole new request for the
3148   // data that's coming in off the channel.
3149   nsCOMPtr<nsIURI> uri;
3150   mRequest->GetURI(getter_AddRefs(uri));
3151
3152   LOG_MSG_WITH_PARAM(gImgLog,
3153                      "imgCacheValidator::OnStartRequest creating new request",
3154                      "uri", uri);
3155
3156   CORSMode corsmode = mRequest->GetCORSMode();
3157   nsCOMPtr<nsIReferrerInfo> referrerInfo = mRequest->GetReferrerInfo();
3158   nsCOMPtr<nsIPrincipal> triggeringPrincipal =
3159       mRequest->GetTriggeringPrincipal();
3160
3161   // Doom the old request's cache entry
3162   mRequest->RemoveFromCache();
3163
3164   // We use originalURI here to fulfil the imgIRequest contract on GetURI.
3165   nsCOMPtr<nsIURI> originalURI;
3166   channel->GetOriginalURI(getter_AddRefs(originalURI));
3167   nsresult rv = mNewRequest->Init(originalURI, uri, mHadInsecureRedirect,
3168                                   aRequest, channel, mNewEntry, document,
3169                                   triggeringPrincipal, corsmode, referrerInfo);
3170   if (NS_FAILED(rv)) {
3171     UpdateProxies(/* aCancelRequest */ true, /* aSyncNotify */ true);
3172     return rv;
3173   }
3174
3175   mDestListener = new ProxyListener(mNewRequest);
3176
3177   // Try to add the new request into the cache. Note that the entry must be in
3178   // the cache before the proxies' ownership changes, because adding a proxy
3179   // changes the caching behaviour for imgRequests.
3180   mImgLoader->PutIntoCache(mNewRequest->CacheKey(), mNewEntry);
3181   UpdateProxies(/* aCancelRequest */ false, /* aSyncNotify */ true);
3182   return mDestListener->OnStartRequest(aRequest);
3183 }
3184
3185 NS_IMETHODIMP
3186 imgCacheValidator::OnStopRequest(nsIRequest* aRequest, nsresult status) {
3187   // Be sure we've released the document that we may have been holding on to.
3188   mDocument = nullptr;
3189
3190   if (!mDestListener) {
3191     return NS_OK;
3192   }
3193
3194   return mDestListener->OnStopRequest(aRequest, status);
3195 }
3196
3197 /** nsIStreamListener methods **/
3198
3199 NS_IMETHODIMP
3200 imgCacheValidator::OnDataAvailable(nsIRequest* aRequest, nsIInputStream* inStr,
3201                                    uint64_t sourceOffset, uint32_t count) {
3202   if (!mDestListener) {
3203     // XXX see bug 113959
3204     uint32_t _retval;
3205     inStr->ReadSegments(NS_DiscardSegment, nullptr, count, &_retval);
3206     return NS_OK;
3207   }
3208
3209   return mDestListener->OnDataAvailable(aRequest, inStr, sourceOffset, count);
3210 }
3211
3212 /** nsIThreadRetargetableStreamListener methods **/
3213
3214 NS_IMETHODIMP
3215 imgCacheValidator::CheckListenerChain() {
3216   NS_ASSERTION(NS_IsMainThread(), "Should be on the main thread!");
3217   nsresult rv = NS_OK;
3218   nsCOMPtr<nsIThreadRetargetableStreamListener> retargetableListener =
3219       do_QueryInterface(mDestListener, &rv);
3220   if (retargetableListener) {
3221     rv = retargetableListener->CheckListenerChain();
3222   }
3223   MOZ_LOG(
3224       gImgLog, LogLevel::Debug,
3225       ("[this=%p] imgCacheValidator::CheckListenerChain -- rv %" PRId32 "=%s",
3226        this, static_cast<uint32_t>(rv),
3227        NS_SUCCEEDED(rv) ? "succeeded" : "failed"));
3228   return rv;
3229 }
3230
3231 /** nsIInterfaceRequestor methods **/
3232
3233 NS_IMETHODIMP
3234 imgCacheValidator::GetInterface(const nsIID& aIID, void** aResult) {
3235   if (aIID.Equals(NS_GET_IID(nsIChannelEventSink))) {
3236     return QueryInterface(aIID, aResult);
3237   }
3238
3239   return mProgressProxy->GetInterface(aIID, aResult);
3240 }
3241
3242 // These functions are materially the same as the same functions in imgRequest.
3243 // We duplicate them because we're verifying whether cache loads are necessary,
3244 // not unconditionally loading.
3245
3246 /** nsIChannelEventSink methods **/
3247 NS_IMETHODIMP
3248 imgCacheValidator::AsyncOnChannelRedirect(
3249     nsIChannel* oldChannel, nsIChannel* newChannel, uint32_t flags,
3250     nsIAsyncVerifyRedirectCallback* callback) {
3251   // Note all cache information we get from the old channel.
3252   mNewRequest->SetCacheValidation(mNewEntry, oldChannel);
3253
3254   // If the previous URI is a non-HTTPS URI, record that fact for later use by
3255   // security code, which needs to know whether there is an insecure load at any
3256   // point in the redirect chain.
3257   nsCOMPtr<nsIURI> oldURI;
3258   bool schemeLocal = false;
3259   if (NS_FAILED(oldChannel->GetURI(getter_AddRefs(oldURI))) ||
3260       NS_FAILED(NS_URIChainHasFlags(
3261           oldURI, nsIProtocolHandler::URI_IS_LOCAL_RESOURCE, &schemeLocal)) ||
3262       (!oldURI->SchemeIs("https") && !oldURI->SchemeIs("chrome") &&
3263        !schemeLocal)) {
3264     mHadInsecureRedirect = true;
3265   }
3266
3267   // Prepare for callback
3268   mRedirectCallback = callback;
3269   mRedirectChannel = newChannel;
3270
3271   return mProgressProxy->AsyncOnChannelRedirect(oldChannel, newChannel, flags,
3272                                                 this);
3273 }
3274
3275 NS_IMETHODIMP
3276 imgCacheValidator::OnRedirectVerifyCallback(nsresult aResult) {
3277   // If we've already been told to abort, just do so.
3278   if (NS_FAILED(aResult)) {
3279     mRedirectCallback->OnRedirectVerifyCallback(aResult);
3280     mRedirectCallback = nullptr;
3281     mRedirectChannel = nullptr;
3282     return NS_OK;
3283   }
3284
3285   // make sure we have a protocol that returns data rather than opens
3286   // an external application, e.g. mailto:
3287   nsCOMPtr<nsIURI> uri;
3288   mRedirectChannel->GetURI(getter_AddRefs(uri));
3289   bool doesNotReturnData = false;
3290   NS_URIChainHasFlags(uri, nsIProtocolHandler::URI_DOES_NOT_RETURN_DATA,
3291                       &doesNotReturnData);
3292
3293   nsresult result = NS_OK;
3294
3295   if (doesNotReturnData) {
3296     result = NS_ERROR_ABORT;
3297   }
3298
3299   mRedirectCallback->OnRedirectVerifyCallback(result);
3300   mRedirectCallback = nullptr;
3301   mRedirectChannel = nullptr;
3302   return NS_OK;
3303 }