image/imgLoader.cpp

   1 /* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
   2 /* vim: set ts=8 sts=2 et sw=2 tw=80: */
   3 /* This Source Code Form is subject to the terms of the Mozilla Public
   4  * License, v. 2.0. If a copy of the MPL was not distributed with this
   5  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
   6
   7 // Undefine windows version of LoadImage because our code uses that name.
   8 #include "mozilla/ScopeExit.h"
   9 #include "nsIChildChannel.h"
  10 #include "nsIThreadRetargetableStreamListener.h"
  11 #undef LoadImage
  12
  13 #include "imgLoader.h"
  14
  15 #include <algorithm>
  16 #include <utility>
  17
  18 #include "DecoderFactory.h"
  19 #include "Image.h"
  20 #include "ImageLogging.h"
  21 #include "ReferrerInfo.h"
  22 #include "imgRequestProxy.h"
  23 #include "mozilla/Attributes.h"
  24 #include "mozilla/BasePrincipal.h"
  25 #include "mozilla/ChaosMode.h"
  26 #include "mozilla/ClearOnShutdown.h"
  27 #include "mozilla/LoadInfo.h"
  28 #include "mozilla/NullPrincipal.h"
  29 #include "mozilla/Preferences.h"
  30 #include "mozilla/ProfilerLabels.h"
  31 #include "mozilla/StaticPrefs_image.h"
  32 #include "mozilla/StaticPrefs_network.h"
  33 #include "mozilla/StoragePrincipalHelper.h"
  34 #include "mozilla/dom/ContentParent.h"
  35 #include "mozilla/dom/FetchPriority.h"
  36 #include "mozilla/dom/nsMixedContentBlocker.h"
  37 #include "mozilla/image/ImageMemoryReporter.h"
  38 #include "mozilla/layers/CompositorManagerChild.h"
  39 #include "nsCOMPtr.h"
  40 #include "nsCRT.h"
  41 #include "nsComponentManagerUtils.h"
  42 #include "nsContentPolicyUtils.h"
  43 #include "nsContentSecurityManager.h"
  44 #include "nsContentUtils.h"
  45 #include "nsHttpChannel.h"
  46 #include "nsIAsyncVerifyRedirectCallback.h"
  47 #include "nsICacheInfoChannel.h"
  48 #include "nsIChannelEventSink.h"
  49 #include "nsIClassOfService.h"
  50 #include "nsIEffectiveTLDService.h"
  51 #include "nsIFile.h"
  52 #include "nsIFileURL.h"
  53 #include "nsIHttpChannel.h"
  54 #include "nsIInterfaceRequestor.h"
  55 #include "nsIInterfaceRequestorUtils.h"
  56 #include "nsIMemoryReporter.h"
  57 #include "nsINetworkPredictor.h"
  58 #include "nsIProgressEventSink.h"
  59 #include "nsIProtocolHandler.h"
  60 #include "nsImageModule.h"
  61 #include "nsMediaSniffer.h"
  62 #include "nsMimeTypes.h"
  63 #include "nsNetCID.h"
  64 #include "nsNetUtil.h"
  65 #include "nsProxyRelease.h"
  66 #include "nsQueryObject.h"
  67 #include "nsReadableUtils.h"
  68 #include "nsStreamUtils.h"
  69 #include "prtime.h"
  70
  71 // we want to explore making the document own the load group
  72 // so we can associate the document URI with the load group.
  73 // until this point, we have an evil hack:
  74 #include "nsIHttpChannelInternal.h"
  75 #include "nsILoadGroupChild.h"
  76 #include "nsIDocShell.h"
  77
  78 using namespace mozilla;
  79 using namespace mozilla::dom;
  80 using namespace mozilla::image;
  81 using namespace mozilla::net;
  82
  83 MOZ_DEFINE_MALLOC_SIZE_OF(ImagesMallocSizeOf)
  84
  85 class imgMemoryReporter final : public nsIMemoryReporter {
  86   ~imgMemoryReporter() = default;
  87
  88  public:
  89   NS_DECL_ISUPPORTS
  90
  91   NS_IMETHOD CollectReports(nsIHandleReportCallback* aHandleReport,
  92                             nsISupports* aData, bool aAnonymize) override {
  93     MOZ_ASSERT(NS_IsMainThread());
  94
  95     layers::CompositorManagerChild* manager =
  96         mozilla::layers::CompositorManagerChild::GetInstance();
  97     if (!manager || !StaticPrefs::image_mem_debug_reporting()) {
  98       layers::SharedSurfacesMemoryReport sharedSurfaces;
  99       FinishCollectReports(aHandleReport, aData, aAnonymize, sharedSurfaces);
 100       return NS_OK;
 101     }
 102
 103     RefPtr<imgMemoryReporter> self(this);
 104     nsCOMPtr<nsIHandleReportCallback> handleReport(aHandleReport);
 105     nsCOMPtr<nsISupports> data(aData);
 106     manager->SendReportSharedSurfacesMemory(
 107         [=](layers::SharedSurfacesMemoryReport aReport) {
 108           self->FinishCollectReports(handleReport, data, aAnonymize, aReport);
 109         },
 110         [=](mozilla::ipc::ResponseRejectReason&& aReason) {
 111           layers::SharedSurfacesMemoryReport sharedSurfaces;
 112           self->FinishCollectReports(handleReport, data, aAnonymize,
 113                                      sharedSurfaces);
 114         });
 115     return NS_OK;
 116   }
 117
 118   void FinishCollectReports(
 119       nsIHandleReportCallback* aHandleReport, nsISupports* aData,
 120       bool aAnonymize, layers::SharedSurfacesMemoryReport& aSharedSurfaces) {
 121     nsTArray<ImageMemoryCounter> chrome;
 122     nsTArray<ImageMemoryCounter> content;
 123     nsTArray<ImageMemoryCounter> uncached;
 124
 125     for (uint32_t i = 0; i < mKnownLoaders.Length(); i++) {
 126       for (imgCacheEntry* entry : mKnownLoaders[i]->mCache.Values()) {
 127         RefPtr<imgRequest> req = entry->GetRequest();
 128         RecordCounterForRequest(req, &content, !entry->HasNoProxies());
 129       }
 130       MutexAutoLock lock(mKnownLoaders[i]->mUncachedImagesMutex);
 131       for (RefPtr<imgRequest> req : mKnownLoaders[i]->mUncachedImages) {
 132         RecordCounterForRequest(req, &uncached, req->HasConsumers());
 133       }
 134     }
 135
 136     // Note that we only need to anonymize content image URIs.
 137
 138     ReportCounterArray(aHandleReport, aData, chrome, "images/chrome",
 139                        /* aAnonymize */ false, aSharedSurfaces);
 140
 141     ReportCounterArray(aHandleReport, aData, content, "images/content",
 142                        aAnonymize, aSharedSurfaces);
 143
 144     // Uncached images may be content or chrome, so anonymize them.
 145     ReportCounterArray(aHandleReport, aData, uncached, "images/uncached",
 146                        aAnonymize, aSharedSurfaces);
 147
 148     // Report any shared surfaces that were not merged with the surface cache.
 149     ImageMemoryReporter::ReportSharedSurfaces(aHandleReport, aData,
 150                                               aSharedSurfaces);
 151
 152     nsCOMPtr<nsIMemoryReporterManager> imgr =
 153         do_GetService("@mozilla.org/memory-reporter-manager;1");
 154     if (imgr) {
 155       imgr->EndReport();
 156     }
 157   }
 158
 159   static int64_t ImagesContentUsedUncompressedDistinguishedAmount() {
 160     size_t n = 0;
 161     for (uint32_t i = 0; i < imgLoader::sMemReporter->mKnownLoaders.Length();
 162          i++) {
 163       for (imgCacheEntry* entry :
 164            imgLoader::sMemReporter->mKnownLoaders[i]->mCache.Values()) {
 165         if (entry->HasNoProxies()) {
 166           continue;
 167         }
 168
 169         RefPtr<imgRequest> req = entry->GetRequest();
 170         RefPtr<image::Image> image = req->GetImage();
 171         if (!image) {
 172           continue;
 173         }
 174
 175         // Both this and EntryImageSizes measure
 176         // images/content/raster/used/decoded memory.  This function's
 177         // measurement is secondary -- the result doesn't go in the "explicit"
 178         // tree -- so we use moz_malloc_size_of instead of ImagesMallocSizeOf to
 179         // prevent DMD from seeing it reported twice.
 180         SizeOfState state(moz_malloc_size_of);
 181         ImageMemoryCounter counter(req, image, state, /* aIsUsed = */ true);
 182
 183         n += counter.Values().DecodedHeap();
 184         n += counter.Values().DecodedNonHeap();
 185         n += counter.Values().DecodedUnknown();
 186       }
 187     }
 188     return n;
 189   }
 190
 191   void RegisterLoader(imgLoader* aLoader) {
 192     mKnownLoaders.AppendElement(aLoader);
 193   }
 194
 195   void UnregisterLoader(imgLoader* aLoader) {
 196     mKnownLoaders.RemoveElement(aLoader);
 197   }
 198
 199  private:
 200   nsTArray<imgLoader*> mKnownLoaders;
 201
 202   struct MemoryTotal {
 203     MemoryTotal& operator+=(const ImageMemoryCounter& aImageCounter) {
 204       if (aImageCounter.Type() == imgIContainer::TYPE_RASTER) {
 205         if (aImageCounter.IsUsed()) {
 206           mUsedRasterCounter += aImageCounter.Values();
 207         } else {
 208           mUnusedRasterCounter += aImageCounter.Values();
 209         }
 210       } else if (aImageCounter.Type() == imgIContainer::TYPE_VECTOR) {
 211         if (aImageCounter.IsUsed()) {
 212           mUsedVectorCounter += aImageCounter.Values();
 213         } else {
 214           mUnusedVectorCounter += aImageCounter.Values();
 215         }
 216       } else if (aImageCounter.Type() == imgIContainer::TYPE_REQUEST) {
 217         // Nothing to do, we did not get to the point of having an image.
 218       } else {
 219         MOZ_CRASH("Unexpected image type");
 220       }
 221
 222       return *this;
 223     }
 224
 225     const MemoryCounter& UsedRaster() const { return mUsedRasterCounter; }
 226     const MemoryCounter& UnusedRaster() const { return mUnusedRasterCounter; }
 227     const MemoryCounter& UsedVector() const { return mUsedVectorCounter; }
 228     const MemoryCounter& UnusedVector() const { return mUnusedVectorCounter; }
 229
 230    private:
 231     MemoryCounter mUsedRasterCounter;
 232     MemoryCounter mUnusedRasterCounter;
 233     MemoryCounter mUsedVectorCounter;
 234     MemoryCounter mUnusedVectorCounter;
 235   };
 236
 237   // Reports all images of a single kind, e.g. all used chrome images.
 238   void ReportCounterArray(nsIHandleReportCallback* aHandleReport,
 239                           nsISupports* aData,
 240                           nsTArray<ImageMemoryCounter>& aCounterArray,
 241                           const char* aPathPrefix, bool aAnonymize,
 242                           layers::SharedSurfacesMemoryReport& aSharedSurfaces) {
 243     MemoryTotal summaryTotal;
 244     MemoryTotal nonNotableTotal;
 245
 246     // Report notable images, and compute total and non-notable aggregate sizes.
 247     for (uint32_t i = 0; i < aCounterArray.Length(); i++) {
 248       ImageMemoryCounter& counter = aCounterArray[i];
 249
 250       if (aAnonymize) {
 251         counter.URI().Truncate();
 252         counter.URI().AppendPrintf("<anonymized-%u>", i);
 253       } else {
 254         // The URI could be an extremely long data: URI. Truncate if needed.
 255         static const size_t max = 256;
 256         if (counter.URI().Length() > max) {
 257           counter.URI().Truncate(max);
 258           counter.URI().AppendLiteral(" (truncated)");
 259         }
 260         counter.URI().ReplaceChar('/', '\\');
 261       }
 262
 263       summaryTotal += counter;
 264
 265       if (counter.IsNotable() || StaticPrefs::image_mem_debug_reporting()) {
 266         ReportImage(aHandleReport, aData, aPathPrefix, counter,
 267                     aSharedSurfaces);
 268       } else {
 269         ImageMemoryReporter::TrimSharedSurfaces(counter, aSharedSurfaces);
 270         nonNotableTotal += counter;
 271       }
 272     }
 273
 274     // Report non-notable images in aggregate.
 275     ReportTotal(aHandleReport, aData, /* aExplicit = */ true, aPathPrefix,
 276                 "<non-notable images>/", nonNotableTotal);
 277
 278     // Report a summary in aggregate, outside of the explicit tree.
 279     ReportTotal(aHandleReport, aData, /* aExplicit = */ false, aPathPrefix, "",
 280                 summaryTotal);
 281   }
 282
 283   static void ReportImage(nsIHandleReportCallback* aHandleReport,
 284                           nsISupports* aData, const char* aPathPrefix,
 285                           const ImageMemoryCounter& aCounter,
 286                           layers::SharedSurfacesMemoryReport& aSharedSurfaces) {
 287     nsAutoCString pathPrefix("explicit/"_ns);
 288     pathPrefix.Append(aPathPrefix);
 289
 290     switch (aCounter.Type()) {
 291       case imgIContainer::TYPE_RASTER:
 292         pathPrefix.AppendLiteral("/raster/");
 293         break;
 294       case imgIContainer::TYPE_VECTOR:
 295         pathPrefix.AppendLiteral("/vector/");
 296         break;
 297       case imgIContainer::TYPE_REQUEST:
 298         pathPrefix.AppendLiteral("/request/");
 299         break;
 300       default:
 301         pathPrefix.AppendLiteral("/unknown=");
 302         pathPrefix.AppendInt(aCounter.Type());
 303         pathPrefix.AppendLiteral("/");
 304         break;
 305     }
 306
 307     pathPrefix.Append(aCounter.IsUsed() ? "used/" : "unused/");
 308     if (aCounter.IsValidating()) {
 309       pathPrefix.AppendLiteral("validating/");
 310     }
 311     if (aCounter.HasError()) {
 312       pathPrefix.AppendLiteral("err/");
 313     }
 314
 315     pathPrefix.AppendLiteral("progress=");
 316     pathPrefix.AppendInt(aCounter.Progress(), 16);
 317     pathPrefix.AppendLiteral("/");
 318
 319     pathPrefix.AppendLiteral("image(");
 320     pathPrefix.AppendInt(aCounter.IntrinsicSize().width);
 321     pathPrefix.AppendLiteral("x");
 322     pathPrefix.AppendInt(aCounter.IntrinsicSize().height);
 323     pathPrefix.AppendLiteral(", ");
 324
 325     if (aCounter.URI().IsEmpty()) {
 326       pathPrefix.AppendLiteral("<unknown URI>");
 327     } else {
 328       pathPrefix.Append(aCounter.URI());
 329     }
 330
 331     pathPrefix.AppendLiteral(")/");
 332
 333     ReportSurfaces(aHandleReport, aData, pathPrefix, aCounter, aSharedSurfaces);
 334
 335     ReportSourceValue(aHandleReport, aData, pathPrefix, aCounter.Values());
 336   }
 337
 338   static void ReportSurfaces(
 339       nsIHandleReportCallback* aHandleReport, nsISupports* aData,
 340       const nsACString& aPathPrefix, const ImageMemoryCounter& aCounter,
 341       layers::SharedSurfacesMemoryReport& aSharedSurfaces) {
 342     for (const SurfaceMemoryCounter& counter : aCounter.Surfaces()) {
 343       nsAutoCString surfacePathPrefix(aPathPrefix);
 344       switch (counter.Type()) {
 345         case SurfaceMemoryCounterType::NORMAL:
 346           if (counter.IsLocked()) {
 347             surfacePathPrefix.AppendLiteral("locked/");
 348           } else {
 349             surfacePathPrefix.AppendLiteral("unlocked/");
 350           }
 351           if (counter.IsFactor2()) {
 352             surfacePathPrefix.AppendLiteral("factor2/");
 353           }
 354           if (counter.CannotSubstitute()) {
 355             surfacePathPrefix.AppendLiteral("cannot_substitute/");
 356           }
 357           break;
 358         case SurfaceMemoryCounterType::CONTAINER:
 359           surfacePathPrefix.AppendLiteral("container/");
 360           break;
 361         default:
 362           MOZ_ASSERT_UNREACHABLE("Unknown counter type");
 363           break;
 364       }
 365
 366       surfacePathPrefix.AppendLiteral("types=");
 367       surfacePathPrefix.AppendInt(counter.Values().SurfaceTypes(), 16);
 368       surfacePathPrefix.AppendLiteral("/surface(");
 369       surfacePathPrefix.AppendInt(counter.Key().Size().width);
 370       surfacePathPrefix.AppendLiteral("x");
 371       surfacePathPrefix.AppendInt(counter.Key().Size().height);
 372
 373       if (!counter.IsFinished()) {
 374         surfacePathPrefix.AppendLiteral(", incomplete");
 375       }
 376
 377       if (counter.Values().ExternalHandles() > 0) {
 378         surfacePathPrefix.AppendLiteral(", handles:");
 379         surfacePathPrefix.AppendInt(
 380             uint32_t(counter.Values().ExternalHandles()));
 381       }
 382
 383       ImageMemoryReporter::AppendSharedSurfacePrefix(surfacePathPrefix, counter,
 384                                                      aSharedSurfaces);
 385
 386       PlaybackType playback = counter.Key().Playback();
 387       if (playback == PlaybackType::eAnimated) {
 388         if (StaticPrefs::image_mem_debug_reporting()) {
 389           surfacePathPrefix.AppendPrintf(
 390               " (animation %4u)", uint32_t(counter.Values().FrameIndex()));
 391         } else {
 392           surfacePathPrefix.AppendLiteral(" (animation)");
 393         }
 394       }
 395
 396       if (counter.Key().Flags() != DefaultSurfaceFlags()) {
 397         surfacePathPrefix.AppendLiteral(", flags:");
 398         surfacePathPrefix.AppendInt(uint32_t(counter.Key().Flags()),
 399                                     /* aRadix = */ 16);
 400       }
 401
 402       if (counter.Key().Region()) {
 403         const ImageIntRegion& region = counter.Key().Region().ref();
 404         const gfx::IntRect& rect = region.Rect();
 405         surfacePathPrefix.AppendLiteral(", region:[ rect=(");
 406         surfacePathPrefix.AppendInt(rect.x);
 407         surfacePathPrefix.AppendLiteral(",");
 408         surfacePathPrefix.AppendInt(rect.y);
 409         surfacePathPrefix.AppendLiteral(") ");
 410         surfacePathPrefix.AppendInt(rect.width);
 411         surfacePathPrefix.AppendLiteral("x");
 412         surfacePathPrefix.AppendInt(rect.height);
 413         if (region.IsRestricted()) {
 414           const gfx::IntRect& restrict = region.Restriction();
 415           if (restrict == rect) {
 416             surfacePathPrefix.AppendLiteral(", restrict=rect");
 417           } else {
 418             surfacePathPrefix.AppendLiteral(", restrict=(");
 419             surfacePathPrefix.AppendInt(restrict.x);
 420             surfacePathPrefix.AppendLiteral(",");
 421             surfacePathPrefix.AppendInt(restrict.y);
 422             surfacePathPrefix.AppendLiteral(") ");
 423             surfacePathPrefix.AppendInt(restrict.width);
 424             surfacePathPrefix.AppendLiteral("x");
 425             surfacePathPrefix.AppendInt(restrict.height);
 426           }
 427         }
 428         if (region.GetExtendMode() != gfx::ExtendMode::CLAMP) {
 429           surfacePathPrefix.AppendLiteral(", extendMode=");
 430           surfacePathPrefix.AppendInt(int32_t(region.GetExtendMode()));
 431         }
 432         surfacePathPrefix.AppendLiteral("]");
 433       }
 434
 435       const SVGImageContext& context = counter.Key().SVGContext();
 436       surfacePathPrefix.AppendLiteral(", svgContext:[ ");
 437       if (context.GetViewportSize()) {
 438         const CSSIntSize& size = context.GetViewportSize().ref();
 439         surfacePathPrefix.AppendLiteral("viewport=(");
 440         surfacePathPrefix.AppendInt(size.width);
 441         surfacePathPrefix.AppendLiteral("x");
 442         surfacePathPrefix.AppendInt(size.height);
 443         surfacePathPrefix.AppendLiteral(") ");
 444       }
 445       if (context.GetPreserveAspectRatio()) {
 446         nsAutoString aspect;
 447         context.GetPreserveAspectRatio()->ToString(aspect);
 448         surfacePathPrefix.AppendLiteral("preserveAspectRatio=(");
 449         LossyAppendUTF16toASCII(aspect, surfacePathPrefix);
 450         surfacePathPrefix.AppendLiteral(") ");
 451       }
 452       if (auto scheme = context.GetColorScheme()) {
 453         surfacePathPrefix.AppendLiteral("colorScheme=");
 454         surfacePathPrefix.AppendInt(int32_t(*scheme));
 455         surfacePathPrefix.AppendLiteral(" ");
 456       }
 457       if (context.GetContextPaint()) {
 458         const SVGEmbeddingContextPaint* paint = context.GetContextPaint();
 459         surfacePathPrefix.AppendLiteral("contextPaint=(");
 460         if (paint->GetFill()) {
 461           surfacePathPrefix.AppendLiteral(" fill=");
 462           surfacePathPrefix.AppendInt(paint->GetFill()->ToABGR(), 16);
 463         }
 464         if (paint->GetFillOpacity() != 1.0) {
 465           surfacePathPrefix.AppendLiteral(" fillOpa=");
 466           surfacePathPrefix.AppendFloat(paint->GetFillOpacity());
 467         }
 468         if (paint->GetStroke()) {
 469           surfacePathPrefix.AppendLiteral(" stroke=");
 470           surfacePathPrefix.AppendInt(paint->GetStroke()->ToABGR(), 16);
 471         }
 472         if (paint->GetStrokeOpacity() != 1.0) {
 473           surfacePathPrefix.AppendLiteral(" strokeOpa=");
 474           surfacePathPrefix.AppendFloat(paint->GetStrokeOpacity());
 475         }
 476         surfacePathPrefix.AppendLiteral(" ) ");
 477       }
 478       surfacePathPrefix.AppendLiteral("]");
 479
 480       surfacePathPrefix.AppendLiteral(")/");
 481
 482       ReportValues(aHandleReport, aData, surfacePathPrefix, counter.Values());
 483     }
 484   }
 485
 486   static void ReportTotal(nsIHandleReportCallback* aHandleReport,
 487                           nsISupports* aData, bool aExplicit,
 488                           const char* aPathPrefix, const char* aPathInfix,
 489                           const MemoryTotal& aTotal) {
 490     nsAutoCString pathPrefix;
 491     if (aExplicit) {
 492       pathPrefix.AppendLiteral("explicit/");
 493     }
 494     pathPrefix.Append(aPathPrefix);
 495
 496     nsAutoCString rasterUsedPrefix(pathPrefix);
 497     rasterUsedPrefix.AppendLiteral("/raster/used/");
 498     rasterUsedPrefix.Append(aPathInfix);
 499     ReportValues(aHandleReport, aData, rasterUsedPrefix, aTotal.UsedRaster());
 500
 501     nsAutoCString rasterUnusedPrefix(pathPrefix);
 502     rasterUnusedPrefix.AppendLiteral("/raster/unused/");
 503     rasterUnusedPrefix.Append(aPathInfix);
 504     ReportValues(aHandleReport, aData, rasterUnusedPrefix,
 505                  aTotal.UnusedRaster());
 506
 507     nsAutoCString vectorUsedPrefix(pathPrefix);
 508     vectorUsedPrefix.AppendLiteral("/vector/used/");
 509     vectorUsedPrefix.Append(aPathInfix);
 510     ReportValues(aHandleReport, aData, vectorUsedPrefix, aTotal.UsedVector());
 511
 512     nsAutoCString vectorUnusedPrefix(pathPrefix);
 513     vectorUnusedPrefix.AppendLiteral("/vector/unused/");
 514     vectorUnusedPrefix.Append(aPathInfix);
 515     ReportValues(aHandleReport, aData, vectorUnusedPrefix,
 516                  aTotal.UnusedVector());
 517   }
 518
 519   static void ReportValues(nsIHandleReportCallback* aHandleReport,
 520                            nsISupports* aData, const nsACString& aPathPrefix,
 521                            const MemoryCounter& aCounter) {
 522     ReportSourceValue(aHandleReport, aData, aPathPrefix, aCounter);
 523
 524     ReportValue(aHandleReport, aData, KIND_HEAP, aPathPrefix, "decoded-heap",
 525                 "Decoded image data which is stored on the heap.",
 526                 aCounter.DecodedHeap());
 527
 528     ReportValue(aHandleReport, aData, KIND_NONHEAP, aPathPrefix,
 529                 "decoded-nonheap",
 530                 "Decoded image data which isn't stored on the heap.",
 531                 aCounter.DecodedNonHeap());
 532
 533     // We don't know for certain whether or not it is on the heap, so let's
 534     // just report it as non-heap for reporting purposes.
 535     ReportValue(aHandleReport, aData, KIND_NONHEAP, aPathPrefix,
 536                 "decoded-unknown",
 537                 "Decoded image data which is unknown to be on the heap or not.",
 538                 aCounter.DecodedUnknown());
 539   }
 540
 541   static void ReportSourceValue(nsIHandleReportCallback* aHandleReport,
 542                                 nsISupports* aData,
 543                                 const nsACString& aPathPrefix,
 544                                 const MemoryCounter& aCounter) {
 545     ReportValue(aHandleReport, aData, KIND_HEAP, aPathPrefix, "source",
 546                 "Raster image source data and vector image documents.",
 547                 aCounter.Source());
 548   }
 549
 550   static void ReportValue(nsIHandleReportCallback* aHandleReport,
 551                           nsISupports* aData, int32_t aKind,
 552                           const nsACString& aPathPrefix,
 553                           const char* aPathSuffix, const char* aDescription,
 554                           size_t aValue) {
 555     if (aValue == 0) {
 556       return;
 557     }
 558
 559     nsAutoCString desc(aDescription);
 560     nsAutoCString path(aPathPrefix);
 561     path.Append(aPathSuffix);
 562
 563     aHandleReport->Callback(""_ns, path, aKind, UNITS_BYTES, aValue, desc,
 564                             aData);
 565   }
 566
 567   static void RecordCounterForRequest(imgRequest* aRequest,
 568                                       nsTArray<ImageMemoryCounter>* aArray,
 569                                       bool aIsUsed) {
 570     SizeOfState state(ImagesMallocSizeOf);
 571     RefPtr<image::Image> image = aRequest->GetImage();
 572     if (image) {
 573       ImageMemoryCounter counter(aRequest, image, state, aIsUsed);
 574       aArray->AppendElement(std::move(counter));
 575     } else {
 576       // We can at least record some information about the image from the
 577       // request, and mark it as not knowing the image type yet.
 578       ImageMemoryCounter counter(aRequest, state, aIsUsed);
 579       aArray->AppendElement(std::move(counter));
 580     }
 581   }
 582 };
 583
 584 NS_IMPL_ISUPPORTS(imgMemoryReporter, nsIMemoryReporter)
 585
 586 NS_IMPL_ISUPPORTS(nsProgressNotificationProxy, nsIProgressEventSink,
 587                   nsIChannelEventSink, nsIInterfaceRequestor)
 588
 589 NS_IMETHODIMP
 590 nsProgressNotificationProxy::OnProgress(nsIRequest* request, int64_t progress,
 591                                         int64_t progressMax) {
 592   nsCOMPtr<nsILoadGroup> loadGroup;
 593   request->GetLoadGroup(getter_AddRefs(loadGroup));
 594
 595   nsCOMPtr<nsIProgressEventSink> target;
 596   NS_QueryNotificationCallbacks(mOriginalCallbacks, loadGroup,
 597                                 NS_GET_IID(nsIProgressEventSink),
 598                                 getter_AddRefs(target));
 599   if (!target) {
 600     return NS_OK;
 601   }
 602   return target->OnProgress(mImageRequest, progress, progressMax);
 603 }
 604
 605 NS_IMETHODIMP
 606 nsProgressNotificationProxy::OnStatus(nsIRequest* request, nsresult status,
 607                                       const char16_t* statusArg) {
 608   nsCOMPtr<nsILoadGroup> loadGroup;
 609   request->GetLoadGroup(getter_AddRefs(loadGroup));
 610
 611   nsCOMPtr<nsIProgressEventSink> target;
 612   NS_QueryNotificationCallbacks(mOriginalCallbacks, loadGroup,
 613                                 NS_GET_IID(nsIProgressEventSink),
 614                                 getter_AddRefs(target));
 615   if (!target) {
 616     return NS_OK;
 617   }
 618   return target->OnStatus(mImageRequest, status, statusArg);
 619 }
 620
 621 NS_IMETHODIMP
 622 nsProgressNotificationProxy::AsyncOnChannelRedirect(
 623     nsIChannel* oldChannel, nsIChannel* newChannel, uint32_t flags,
 624     nsIAsyncVerifyRedirectCallback* cb) {
 625   // Tell the original original callbacks about it too
 626   nsCOMPtr<nsILoadGroup> loadGroup;
 627   newChannel->GetLoadGroup(getter_AddRefs(loadGroup));
 628   nsCOMPtr<nsIChannelEventSink> target;
 629   NS_QueryNotificationCallbacks(mOriginalCallbacks, loadGroup,
 630                                 NS_GET_IID(nsIChannelEventSink),
 631                                 getter_AddRefs(target));
 632   if (!target) {
 633     cb->OnRedirectVerifyCallback(NS_OK);
 634     return NS_OK;
 635   }
 636
 637   // Delegate to |target| if set, reusing |cb|
 638   return target->AsyncOnChannelRedirect(oldChannel, newChannel, flags, cb);
 639 }
 640
 641 NS_IMETHODIMP
 642 nsProgressNotificationProxy::GetInterface(const nsIID& iid, void** result) {
 643   if (iid.Equals(NS_GET_IID(nsIProgressEventSink))) {
 644     *result = static_cast<nsIProgressEventSink*>(this);
 645     NS_ADDREF_THIS();
 646     return NS_OK;
 647   }
 648   if (iid.Equals(NS_GET_IID(nsIChannelEventSink))) {
 649     *result = static_cast<nsIChannelEventSink*>(this);
 650     NS_ADDREF_THIS();
 651     return NS_OK;
 652   }
 653   if (mOriginalCallbacks) {
 654     return mOriginalCallbacks->GetInterface(iid, result);
 655   }
 656   return NS_NOINTERFACE;
 657 }
 658
 659 static void NewRequestAndEntry(bool aForcePrincipalCheckForCacheEntry,
 660                                imgLoader* aLoader, const ImageCacheKey& aKey,
 661                                imgRequest** aRequest, imgCacheEntry** aEntry) {
 662   RefPtr<imgRequest> request = new imgRequest(aLoader, aKey);
 663   RefPtr<imgCacheEntry> entry =
 664       new imgCacheEntry(aLoader, request, aForcePrincipalCheckForCacheEntry);
 665   aLoader->AddToUncachedImages(request);
 666   request.forget(aRequest);
 667   entry.forget(aEntry);
 668 }
 669
 670 static bool ShouldRevalidateEntry(imgCacheEntry* aEntry, nsLoadFlags aFlags,
 671                                   bool aHasExpired) {
 672   if (aFlags & nsIRequest::LOAD_BYPASS_CACHE) {
 673     return false;
 674   }
 675   if (aFlags & nsIRequest::VALIDATE_ALWAYS) {
 676     return true;
 677   }
 678   if (aEntry->GetMustValidate()) {
 679     return true;
 680   }
 681   if (aHasExpired) {
 682     // The cache entry has expired...  Determine whether the stale cache
 683     // entry can be used without validation...
 684     if (aFlags & (nsIRequest::LOAD_FROM_CACHE | nsIRequest::VALIDATE_NEVER |
 685                   nsIRequest::VALIDATE_ONCE_PER_SESSION)) {
 686       // LOAD_FROM_CACHE, VALIDATE_NEVER and VALIDATE_ONCE_PER_SESSION allow
 687       // stale cache entries to be used unless they have been explicitly marked
 688       // to indicate that revalidation is necessary.
 689       return false;
 690     }
 691     // Entry is expired, revalidate.
 692     return true;
 693   }
 694   return false;
 695 }
 696
 697 /* Call content policies on cached images that went through a redirect */
 698 static bool ShouldLoadCachedImage(imgRequest* aImgRequest,
 699                                   Document* aLoadingDocument,
 700                                   nsIPrincipal* aTriggeringPrincipal,
 701                                   nsContentPolicyType aPolicyType,
 702                                   bool aSendCSPViolationReports) {
 703   /* Call content policies on cached images - Bug 1082837
 704    * Cached images are keyed off of the first uri in a redirect chain.
 705    * Hence content policies don't get a chance to test the intermediate hops
 706    * or the final destination.  Here we test the final destination using
 707    * mFinalURI off of the imgRequest and passing it into content policies.
 708    * For Mixed Content Blocker, we do an additional check to determine if any
 709    * of the intermediary hops went through an insecure redirect with the
 710    * mHadInsecureRedirect flag
 711    */
 712   bool insecureRedirect = aImgRequest->HadInsecureRedirect();
 713   nsCOMPtr<nsIURI> contentLocation;
 714   aImgRequest->GetFinalURI(getter_AddRefs(contentLocation));
 715   nsresult rv;
 716
 717   nsCOMPtr<nsIPrincipal> loadingPrincipal =
 718       aLoadingDocument ? aLoadingDocument->NodePrincipal()
 719                        : aTriggeringPrincipal;
 720   // If there is no context and also no triggeringPrincipal, then we use a fresh
 721   // nullPrincipal as the loadingPrincipal because we can not create a loadinfo
 722   // without a valid loadingPrincipal.
 723   if (!loadingPrincipal) {
 724     loadingPrincipal = NullPrincipal::CreateWithoutOriginAttributes();
 725   }
 726
 727   nsCOMPtr<nsILoadInfo> secCheckLoadInfo = new LoadInfo(
 728       loadingPrincipal, aTriggeringPrincipal, aLoadingDocument,
 729       nsILoadInfo::SEC_ONLY_FOR_EXPLICIT_CONTENTSEC_CHECK, aPolicyType);
 730
 731   secCheckLoadInfo->SetSendCSPViolationEvents(aSendCSPViolationReports);
 732
 733   int16_t decision = nsIContentPolicy::REJECT_REQUEST;
 734   rv = NS_CheckContentLoadPolicy(contentLocation, secCheckLoadInfo, &decision,
 735                                  nsContentUtils::GetContentPolicy());
 736   if (NS_FAILED(rv) || !NS_CP_ACCEPTED(decision)) {
 737     return false;
 738   }
 739
 740   // We call all Content Policies above, but we also have to call mcb
 741   // individually to check the intermediary redirect hops are secure.
 742   if (insecureRedirect) {
 743     // Bug 1314356: If the image ended up in the cache upgraded by HSTS and the
 744     // page uses upgrade-inscure-requests it had an insecure redirect
 745     // (http->https). We need to invalidate the image and reload it because
 746     // mixed content blocker only bails if upgrade-insecure-requests is set on
 747     // the doc and the resource load is http: which would result in an incorrect
 748     // mixed content warning.
 749     nsCOMPtr<nsIDocShell> docShell =
 750         NS_CP_GetDocShellFromContext(ToSupports(aLoadingDocument));
 751     if (docShell) {
 752       Document* document = docShell->GetDocument();
 753       if (document && document->GetUpgradeInsecureRequests(false)) {
 754         return false;
 755       }
 756     }
 757
 758     if (!aTriggeringPrincipal || !aTriggeringPrincipal->IsSystemPrincipal()) {
 759       // reset the decision for mixed content blocker check
 760       decision = nsIContentPolicy::REJECT_REQUEST;
 761       rv = nsMixedContentBlocker::ShouldLoad(insecureRedirect, contentLocation,
 762                                              secCheckLoadInfo,
 763                                              true,  // aReportError
 764                                              &decision);
 765       if (NS_FAILED(rv) || !NS_CP_ACCEPTED(decision)) {
 766         return false;
 767       }
 768     }
 769   }
 770
 771   return true;
 772 }
 773
 774 // Returns true if this request is compatible with the given CORS mode on the
 775 // given loading principal, and false if the request may not be reused due
 776 // to CORS.
 777 static bool ValidateCORSMode(imgRequest* aRequest, bool aForcePrincipalCheck,
 778                              CORSMode aCORSMode,
 779                              nsIPrincipal* aTriggeringPrincipal) {
 780   // If the entry's CORS mode doesn't match, or the CORS mode matches but the
 781   // document principal isn't the same, we can't use this request.
 782   if (aRequest->GetCORSMode() != aCORSMode) {
 783     return false;
 784   }
 785
 786   if (aRequest->GetCORSMode() != CORS_NONE || aForcePrincipalCheck) {
 787     nsCOMPtr<nsIPrincipal> otherprincipal = aRequest->GetTriggeringPrincipal();
 788
 789     // If we previously had a principal, but we don't now, we can't use this
 790     // request.
 791     if (otherprincipal && !aTriggeringPrincipal) {
 792       return false;
 793     }
 794
 795     if (otherprincipal && aTriggeringPrincipal &&
 796         !otherprincipal->Equals(aTriggeringPrincipal)) {
 797       return false;
 798     }
 799   }
 800
 801   return true;
 802 }
 803
 804 static bool ValidateSecurityInfo(imgRequest* aRequest,
 805                                  bool aForcePrincipalCheck, CORSMode aCORSMode,
 806                                  nsIPrincipal* aTriggeringPrincipal,
 807                                  Document* aLoadingDocument,
 808                                  nsContentPolicyType aPolicyType) {
 809   if (!ValidateCORSMode(aRequest, aForcePrincipalCheck, aCORSMode,
 810                         aTriggeringPrincipal)) {
 811     return false;
 812   }
 813   // Content Policy Check on Cached Images
 814   return ShouldLoadCachedImage(aRequest, aLoadingDocument, aTriggeringPrincipal,
 815                                aPolicyType,
 816                                /* aSendCSPViolationReports */ false);
 817 }
 818
 819 static void AdjustPriorityForImages(nsIChannel* aChannel,
 820                                     nsLoadFlags aLoadFlags,
 821                                     FetchPriority aFetchPriority) {
 822   // Image channels are loaded by default with reduced priority.
 823   if (nsCOMPtr<nsISupportsPriority> supportsPriority =
 824           do_QueryInterface(aChannel)) {
 825     int32_t priority = nsISupportsPriority::PRIORITY_LOW;
 826
 827     // Adjust priority according to fetchpriorty attribute.
 828     if (StaticPrefs::network_fetchpriority_enabled()) {
 829       priority += FETCH_PRIORITY_ADJUSTMENT_FOR(images, aFetchPriority);
 830     }
 831
 832     // Further reduce priority for background loads
 833     if (aLoadFlags & nsIRequest::LOAD_BACKGROUND) {
 834       ++priority;
 835     }
 836
 837     supportsPriority->AdjustPriority(priority);
 838   }
 839 }
 840
 841 static nsresult NewImageChannel(
 842     nsIChannel** aResult,
 843     // If aForcePrincipalCheckForCacheEntry is true, then we will
 844     // force a principal check even when not using CORS before
 845     // assuming we have a cache hit on a cache entry that we
 846     // create for this channel.  This is an out param that should
 847     // be set to true if this channel ends up depending on
 848     // aTriggeringPrincipal and false otherwise.
 849     bool* aForcePrincipalCheckForCacheEntry, nsIURI* aURI,
 850     nsIURI* aInitialDocumentURI, CORSMode aCORSMode,
 851     nsIReferrerInfo* aReferrerInfo, nsILoadGroup* aLoadGroup,
 852     nsLoadFlags aLoadFlags, nsContentPolicyType aPolicyType,
 853     nsIPrincipal* aTriggeringPrincipal, nsINode* aRequestingNode,
 854     bool aRespectPrivacy, uint64_t aEarlyHintPreloaderId,
 855     FetchPriority aFetchPriority) {
 856   MOZ_ASSERT(aResult);
 857
 858   nsresult rv;
 859   nsCOMPtr<nsIHttpChannel> newHttpChannel;
 860
 861   nsCOMPtr<nsIInterfaceRequestor> callbacks;
 862
 863   if (aLoadGroup) {
 864     // Get the notification callbacks from the load group for the new channel.
 865     //
 866     // XXX: This is not exactly correct, because the network request could be
 867     //      referenced by multiple windows...  However, the new channel needs
 868     //      something.  So, using the 'first' notification callbacks is better
 869     //      than nothing...
 870     //
 871     aLoadGroup->GetNotificationCallbacks(getter_AddRefs(callbacks));
 872   }
 873
 874   // Pass in a nullptr loadgroup because this is the underlying network
 875   // request. This request may be referenced by several proxy image requests
 876   // (possibly in different documents).
 877   // If all of the proxy requests are canceled then this request should be
 878   // canceled too.
 879   //
 880
 881   nsSecurityFlags securityFlags =
 882       nsContentSecurityManager::ComputeSecurityFlags(
 883           aCORSMode, nsContentSecurityManager::CORSSecurityMapping::
 884                          CORS_NONE_MAPS_TO_INHERITED_CONTEXT);
 885
 886   securityFlags |= nsILoadInfo::SEC_ALLOW_CHROME;
 887
 888   // Note we are calling NS_NewChannelWithTriggeringPrincipal() here with a
 889   // node and a principal. This is for things like background images that are
 890   // specified by user stylesheets, where the document is being styled, but
 891   // the principal is that of the user stylesheet.
 892   if (aRequestingNode && aTriggeringPrincipal) {
 893     rv = NS_NewChannelWithTriggeringPrincipal(aResult, aURI, aRequestingNode,
 894                                               aTriggeringPrincipal,
 895                                               securityFlags, aPolicyType,
 896                                               nullptr,  // PerformanceStorage
 897                                               nullptr,  // loadGroup
 898                                               callbacks, aLoadFlags);
 899
 900     if (NS_FAILED(rv)) {
 901       return rv;
 902     }
 903
 904     if (aPolicyType == nsIContentPolicy::TYPE_INTERNAL_IMAGE_FAVICON) {
 905       // If this is a favicon loading, we will use the originAttributes from the
 906       // triggeringPrincipal as the channel's originAttributes. This allows the
 907       // favicon loading from XUL will use the correct originAttributes.
 908
 909       nsCOMPtr<nsILoadInfo> loadInfo = (*aResult)->LoadInfo();
 910       rv = loadInfo->SetOriginAttributes(
 911           aTriggeringPrincipal->OriginAttributesRef());
 912     }
 913   } else {
 914     // either we are loading something inside a document, in which case
 915     // we should always have a requestingNode, or we are loading something
 916     // outside a document, in which case the triggeringPrincipal and
 917     // triggeringPrincipal should always be the systemPrincipal.
 918     // However, there are exceptions: one is Notifications which create a
 919     // channel in the parent process in which case we can't get a
 920     // requestingNode.
 921     rv = NS_NewChannel(aResult, aURI, nsContentUtils::GetSystemPrincipal(),
 922                        securityFlags, aPolicyType,
 923                        nullptr,  // nsICookieJarSettings
 924                        nullptr,  // PerformanceStorage
 925                        nullptr,  // loadGroup
 926                        callbacks, aLoadFlags);
 927
 928     if (NS_FAILED(rv)) {
 929       return rv;
 930     }
 931
 932     // Use the OriginAttributes from the loading principal, if one is available,
 933     // and adjust the private browsing ID based on what kind of load the caller
 934     // has asked us to perform.
 935     OriginAttributes attrs;
 936     if (aTriggeringPrincipal) {
 937       attrs = aTriggeringPrincipal->OriginAttributesRef();
 938     }
 939     attrs.mPrivateBrowsingId = aRespectPrivacy ? 1 : 0;
 940
 941     nsCOMPtr<nsILoadInfo> loadInfo = (*aResult)->LoadInfo();
 942     rv = loadInfo->SetOriginAttributes(attrs);
 943   }
 944
 945   if (NS_FAILED(rv)) {
 946     return rv;
 947   }
 948
 949   // only inherit if we have a principal
 950   *aForcePrincipalCheckForCacheEntry =
 951       aTriggeringPrincipal && nsContentUtils::ChannelShouldInheritPrincipal(
 952                                   aTriggeringPrincipal, aURI,
 953                                   /* aInheritForAboutBlank */ false,
 954                                   /* aForceInherit */ false);
 955
 956   // Initialize HTTP-specific attributes
 957   newHttpChannel = do_QueryInterface(*aResult);
 958   if (newHttpChannel) {
 959     nsCOMPtr<nsIHttpChannelInternal> httpChannelInternal =
 960         do_QueryInterface(newHttpChannel);
 961     NS_ENSURE_TRUE(httpChannelInternal, NS_ERROR_UNEXPECTED);
 962     rv = httpChannelInternal->SetDocumentURI(aInitialDocumentURI);
 963     MOZ_ASSERT(NS_SUCCEEDED(rv));
 964     if (aReferrerInfo) {
 965       DebugOnly<nsresult> rv = newHttpChannel->SetReferrerInfo(aReferrerInfo);
 966       MOZ_ASSERT(NS_SUCCEEDED(rv));
 967     }
 968
 969     if (aEarlyHintPreloaderId) {
 970       rv = httpChannelInternal->SetEarlyHintPreloaderId(aEarlyHintPreloaderId);
 971       NS_ENSURE_SUCCESS(rv, rv);
 972     }
 973   }
 974
 975   AdjustPriorityForImages(*aResult, aLoadFlags, aFetchPriority);
 976
 977   // Create a new loadgroup for this new channel, using the old group as
 978   // the parent. The indirection keeps the channel insulated from cancels,
 979   // but does allow a way for this revalidation to be associated with at
 980   // least one base load group for scheduling/caching purposes.
 981
 982   nsCOMPtr<nsILoadGroup> loadGroup = do_CreateInstance(NS_LOADGROUP_CONTRACTID);
 983   nsCOMPtr<nsILoadGroupChild> childLoadGroup = do_QueryInterface(loadGroup);
 984   if (childLoadGroup) {
 985     childLoadGroup->SetParentLoadGroup(aLoadGroup);
 986   }
 987   (*aResult)->SetLoadGroup(loadGroup);
 988
 989   return NS_OK;
 990 }
 991
 992 static uint32_t SecondsFromPRTime(PRTime aTime) {
 993   return nsContentUtils::SecondsFromPRTime(aTime);
 994 }
 995
 996 /* static */
 997 imgCacheEntry::imgCacheEntry(imgLoader* loader, imgRequest* request,
 998                              bool forcePrincipalCheck)
 999     : mLoader(loader),
1000       mRequest(request),
1001       mDataSize(0),
1002       mTouchedTime(SecondsFromPRTime(PR_Now())),
1003       mLoadTime(SecondsFromPRTime(PR_Now())),
1004       mExpiryTime(0),
1005       mMustValidate(false),
1006       // We start off as evicted so we don't try to update the cache.
1007       // PutIntoCache will set this to false.
1008       mEvicted(true),
1009       mHasNoProxies(true),
1010       mForcePrincipalCheck(forcePrincipalCheck),
1011       mHasNotified(false) {}
1012
1013 imgCacheEntry::~imgCacheEntry() {
1014   LOG_FUNC(gImgLog, "imgCacheEntry::~imgCacheEntry()");
1015 }
1016
1017 void imgCacheEntry::Touch(bool updateTime /* = true */) {
1018   LOG_SCOPE(gImgLog, "imgCacheEntry::Touch");
1019
1020   if (updateTime) {
1021     mTouchedTime = SecondsFromPRTime(PR_Now());
1022   }
1023
1024   UpdateCache();
1025 }
1026
1027 void imgCacheEntry::UpdateCache(int32_t diff /* = 0 */) {
1028   // Don't update the cache if we've been removed from it or it doesn't care
1029   // about our size or usage.
1030   if (!Evicted() && HasNoProxies()) {
1031     mLoader->CacheEntriesChanged(diff);
1032   }
1033 }
1034
1035 void imgCacheEntry::UpdateLoadTime() {
1036   mLoadTime = SecondsFromPRTime(PR_Now());
1037 }
1038
1039 void imgCacheEntry::SetHasNoProxies(bool hasNoProxies) {
1040   if (MOZ_LOG_TEST(gImgLog, LogLevel::Debug)) {
1041     if (hasNoProxies) {
1042       LOG_FUNC_WITH_PARAM(gImgLog, "imgCacheEntry::SetHasNoProxies true", "uri",
1043                           mRequest->CacheKey().URI());
1044     } else {
1045       LOG_FUNC_WITH_PARAM(gImgLog, "imgCacheEntry::SetHasNoProxies false",
1046                           "uri", mRequest->CacheKey().URI());
1047     }
1048   }
1049
1050   mHasNoProxies = hasNoProxies;
1051 }
1052
1053 imgCacheQueue::imgCacheQueue() : mDirty(false), mSize(0) {}
1054
1055 void imgCacheQueue::UpdateSize(int32_t diff) { mSize += diff; }
1056
1057 uint32_t imgCacheQueue::GetSize() const { return mSize; }
1058
1059 void imgCacheQueue::Remove(imgCacheEntry* entry) {
1060   uint64_t index = mQueue.IndexOf(entry);
1061   if (index == queueContainer::NoIndex) {
1062     return;
1063   }
1064
1065   mSize -= mQueue[index]->GetDataSize();
1066
1067   // If the queue is clean and this is the first entry,
1068   // then we can efficiently remove the entry without
1069   // dirtying the sort order.
1070   if (!IsDirty() && index == 0) {
1071     std::pop_heap(mQueue.begin(), mQueue.end(), imgLoader::CompareCacheEntries);
1072     mQueue.RemoveLastElement();
1073     return;
1074   }
1075
1076   // Remove from the middle of the list.  This potentially
1077   // breaks the binary heap sort order.
1078   mQueue.RemoveElementAt(index);
1079
1080   // If we only have one entry or the queue is empty, though,
1081   // then the sort order is still effectively good.  Simply
1082   // refresh the list to clear the dirty flag.
1083   if (mQueue.Length() <= 1) {
1084     Refresh();
1085     return;
1086   }
1087
1088   // Otherwise we must mark the queue dirty and potentially
1089   // trigger an expensive sort later.
1090   MarkDirty();
1091 }
1092
1093 void imgCacheQueue::Push(imgCacheEntry* entry) {
1094   mSize += entry->GetDataSize();
1095
1096   RefPtr<imgCacheEntry> refptr(entry);
1097   mQueue.AppendElement(std::move(refptr));
1098   // If we're not dirty already, then we can efficiently add this to the
1099   // binary heap immediately.  This is only O(log n).
1100   if (!IsDirty()) {
1101     std::push_heap(mQueue.begin(), mQueue.end(),
1102                    imgLoader::CompareCacheEntries);
1103   }
1104 }
1105
1106 already_AddRefed<imgCacheEntry> imgCacheQueue::Pop() {
1107   if (mQueue.IsEmpty()) {
1108     return nullptr;
1109   }
1110   if (IsDirty()) {
1111     Refresh();
1112   }
1113
1114   std::pop_heap(mQueue.begin(), mQueue.end(), imgLoader::CompareCacheEntries);
1115   RefPtr<imgCacheEntry> entry = mQueue.PopLastElement();
1116
1117   mSize -= entry->GetDataSize();
1118   return entry.forget();
1119 }
1120
1121 void imgCacheQueue::Refresh() {
1122   // Resort the list.  This is an O(3 * n) operation and best avoided
1123   // if possible.
1124   std::make_heap(mQueue.begin(), mQueue.end(), imgLoader::CompareCacheEntries);
1125   mDirty = false;
1126 }
1127
1128 void imgCacheQueue::MarkDirty() { mDirty = true; }
1129
1130 bool imgCacheQueue::IsDirty() { return mDirty; }
1131
1132 uint32_t imgCacheQueue::GetNumElements() const { return mQueue.Length(); }
1133
1134 bool imgCacheQueue::Contains(imgCacheEntry* aEntry) const {
1135   return mQueue.Contains(aEntry);
1136 }
1137
1138 imgCacheQueue::iterator imgCacheQueue::begin() { return mQueue.begin(); }
1139
1140 imgCacheQueue::const_iterator imgCacheQueue::begin() const {
1141   return mQueue.begin();
1142 }
1143
1144 imgCacheQueue::iterator imgCacheQueue::end() { return mQueue.end(); }
1145
1146 imgCacheQueue::const_iterator imgCacheQueue::end() const {
1147   return mQueue.end();
1148 }
1149
1150 nsresult imgLoader::CreateNewProxyForRequest(
1151     imgRequest* aRequest, nsIURI* aURI, nsILoadGroup* aLoadGroup,
1152     Document* aLoadingDocument, imgINotificationObserver* aObserver,
1153     nsLoadFlags aLoadFlags, imgRequestProxy** _retval) {
1154   LOG_SCOPE_WITH_PARAM(gImgLog, "imgLoader::CreateNewProxyForRequest",
1155                        "imgRequest", aRequest);
1156
1157   /* XXX If we move decoding onto separate threads, we should save off the
1158      calling thread here and pass it off to |proxyRequest| so that it call
1159      proxy calls to |aObserver|.
1160    */
1161
1162   RefPtr<imgRequestProxy> proxyRequest = new imgRequestProxy();
1163
1164   /* It is important to call |SetLoadFlags()| before calling |Init()| because
1165      |Init()| adds the request to the loadgroup.
1166    */
1167   proxyRequest->SetLoadFlags(aLoadFlags);
1168
1169   // init adds itself to imgRequest's list of observers
1170   nsresult rv = proxyRequest->Init(aRequest, aLoadGroup, aURI, aObserver);
1171   if (NS_WARN_IF(NS_FAILED(rv))) {
1172     return rv;
1173   }
1174
1175   proxyRequest.forget(_retval);
1176   return NS_OK;
1177 }
1178
1179 class imgCacheExpirationTracker final
1180     : public nsExpirationTracker<imgCacheEntry, 3> {
1181   enum { TIMEOUT_SECONDS = 10 };
1182
1183  public:
1184   imgCacheExpirationTracker();
1185
1186  protected:
1187   void NotifyExpired(imgCacheEntry* entry) override;
1188 };
1189
1190 imgCacheExpirationTracker::imgCacheExpirationTracker()
1191     : nsExpirationTracker<imgCacheEntry, 3>(TIMEOUT_SECONDS * 1000,
1192                                             "imgCacheExpirationTracker") {}
1193
1194 void imgCacheExpirationTracker::NotifyExpired(imgCacheEntry* entry) {
1195   // Hold on to a reference to this entry, because the expiration tracker
1196   // mechanism doesn't.
1197   RefPtr<imgCacheEntry> kungFuDeathGrip(entry);
1198
1199   if (MOZ_LOG_TEST(gImgLog, LogLevel::Debug)) {
1200     RefPtr<imgRequest> req = entry->GetRequest();
1201     if (req) {
1202       LOG_FUNC_WITH_PARAM(gImgLog, "imgCacheExpirationTracker::NotifyExpired",
1203                           "entry", req->CacheKey().URI());
1204     }
1205   }
1206
1207   // We can be called multiple times on the same entry. Don't do work multiple
1208   // times.
1209   if (!entry->Evicted()) {
1210     entry->Loader()->RemoveFromCache(entry);
1211   }
1212
1213   entry->Loader()->VerifyCacheSizes();
1214 }
1215
1216 ///////////////////////////////////////////////////////////////////////////////
1217 // imgLoader
1218 ///////////////////////////////////////////////////////////////////////////////
1219
1220 double imgLoader::sCacheTimeWeight;
1221 uint32_t imgLoader::sCacheMaxSize;
1222 imgMemoryReporter* imgLoader::sMemReporter;
1223
1224 NS_IMPL_ISUPPORTS(imgLoader, imgILoader, nsIContentSniffer, imgICache,
1225                   nsISupportsWeakReference, nsIObserver)
1226
1227 static imgLoader* gNormalLoader = nullptr;
1228 static imgLoader* gPrivateBrowsingLoader = nullptr;
1229
1230 /* static */
1231 already_AddRefed<imgLoader> imgLoader::CreateImageLoader() {
1232   // In some cases, such as xpctests, XPCOM modules are not automatically
1233   // initialized.  We need to make sure that our module is initialized before
1234   // we hand out imgLoader instances and code starts using them.
1235   mozilla::image::EnsureModuleInitialized();
1236
1237   RefPtr<imgLoader> loader = new imgLoader();
1238   loader->Init();
1239
1240   return loader.forget();
1241 }
1242
1243 imgLoader* imgLoader::NormalLoader() {
1244   if (!gNormalLoader) {
1245     gNormalLoader = CreateImageLoader().take();
1246   }
1247   return gNormalLoader;
1248 }
1249
1250 imgLoader* imgLoader::PrivateBrowsingLoader() {
1251   if (!gPrivateBrowsingLoader) {
1252     gPrivateBrowsingLoader = CreateImageLoader().take();
1253     gPrivateBrowsingLoader->RespectPrivacyNotifications();
1254   }
1255   return gPrivateBrowsingLoader;
1256 }
1257
1258 imgLoader::imgLoader()
1259     : mUncachedImagesMutex("imgLoader::UncachedImages"),
1260       mRespectPrivacy(false) {
1261   sMemReporter->AddRef();
1262   sMemReporter->RegisterLoader(this);
1263 }
1264
1265 imgLoader::~imgLoader() {
1266   ClearImageCache();
1267   {
1268     // If there are any of our imgRequest's left they are in the uncached
1269     // images set, so clear their pointer to us.
1270     MutexAutoLock lock(mUncachedImagesMutex);
1271     for (RefPtr<imgRequest> req : mUncachedImages) {
1272       req->ClearLoader();
1273     }
1274   }
1275   sMemReporter->UnregisterLoader(this);
1276   sMemReporter->Release();
1277 }
1278
1279 void imgLoader::VerifyCacheSizes() {
1280 #ifdef DEBUG
1281   if (!mCacheTracker) {
1282     return;
1283   }
1284
1285   uint32_t cachesize = mCache.Count();
1286   uint32_t queuesize = mCacheQueue.GetNumElements();
1287   uint32_t trackersize = 0;
1288   for (nsExpirationTracker<imgCacheEntry, 3>::Iterator it(mCacheTracker.get());
1289        it.Next();) {
1290     trackersize++;
1291   }
1292   MOZ_ASSERT(queuesize == trackersize, "Queue and tracker sizes out of sync!");
1293   MOZ_ASSERT(queuesize <= cachesize, "Queue has more elements than cache!");
1294 #endif
1295 }
1296
1297 void imgLoader::GlobalInit() {
1298   sCacheTimeWeight = StaticPrefs::image_cache_timeweight_AtStartup() / 1000.0;
1299   int32_t cachesize = StaticPrefs::image_cache_size_AtStartup();
1300   sCacheMaxSize = cachesize > 0 ? cachesize : 0;
1301
1302   sMemReporter = new imgMemoryReporter();
1303   RegisterStrongAsyncMemoryReporter(sMemReporter);
1304   RegisterImagesContentUsedUncompressedDistinguishedAmount(
1305       imgMemoryReporter::ImagesContentUsedUncompressedDistinguishedAmount);
1306 }
1307
1308 void imgLoader::ShutdownMemoryReporter() {
1309   UnregisterImagesContentUsedUncompressedDistinguishedAmount();
1310   UnregisterStrongMemoryReporter(sMemReporter);
1311 }
1312
1313 nsresult imgLoader::InitCache() {
1314   nsCOMPtr<nsIObserverService> os = mozilla::services::GetObserverService();
1315   if (!os) {
1316     return NS_ERROR_FAILURE;
1317   }
1318
1319   os->AddObserver(this, "memory-pressure", false);
1320   os->AddObserver(this, "chrome-flush-caches", false);
1321   os->AddObserver(this, "last-pb-context-exited", false);
1322   os->AddObserver(this, "profile-before-change", false);
1323   os->AddObserver(this, "xpcom-shutdown", false);
1324
1325   mCacheTracker = MakeUnique<imgCacheExpirationTracker>();
1326
1327   return NS_OK;
1328 }
1329
1330 nsresult imgLoader::Init() {
1331   InitCache();
1332
1333   return NS_OK;
1334 }
1335
1336 NS_IMETHODIMP
1337 imgLoader::RespectPrivacyNotifications() {
1338   mRespectPrivacy = true;
1339   return NS_OK;
1340 }
1341
1342 NS_IMETHODIMP
1343 imgLoader::Observe(nsISupports* aSubject, const char* aTopic,
1344                    const char16_t* aData) {
1345   if (strcmp(aTopic, "memory-pressure") == 0) {
1346     MinimizeCache();
1347   } else if (strcmp(aTopic, "chrome-flush-caches") == 0) {
1348     MinimizeCache();
1349     ClearImageCache({ClearOption::ChromeOnly});
1350   } else if (strcmp(aTopic, "last-pb-context-exited") == 0) {
1351     if (mRespectPrivacy) {
1352       ClearImageCache();
1353     }
1354   } else if (strcmp(aTopic, "profile-before-change") == 0) {
1355     mCacheTracker = nullptr;
1356   } else if (strcmp(aTopic, "xpcom-shutdown") == 0) {
1357     mCacheTracker = nullptr;
1358     ShutdownMemoryReporter();
1359
1360   } else {
1361     // (Nothing else should bring us here)
1362     MOZ_ASSERT(0, "Invalid topic received");
1363   }
1364
1365   return NS_OK;
1366 }
1367
1368 NS_IMETHODIMP
1369 imgLoader::ClearCache(bool chrome) {
1370   if (XRE_IsParentProcess()) {
1371     bool privateLoader = this == gPrivateBrowsingLoader;
1372     for (auto* cp : ContentParent::AllProcesses(ContentParent::eLive)) {
1373       Unused << cp->SendClearImageCache(privateLoader, chrome);
1374     }
1375   }
1376   ClearOptions options;
1377   if (chrome) {
1378     options += ClearOption::ChromeOnly;
1379   }
1380   return ClearImageCache(options);
1381 }
1382
1383 NS_IMETHODIMP
1384 imgLoader::RemoveEntriesFromPrincipalInAllProcesses(nsIPrincipal* aPrincipal) {
1385   if (!XRE_IsParentProcess()) {
1386     return NS_ERROR_NOT_AVAILABLE;
1387   }
1388
1389   for (auto* cp : ContentParent::AllProcesses(ContentParent::eLive)) {
1390     Unused << cp->SendClearImageCacheFromPrincipal(aPrincipal);
1391   }
1392
1393   imgLoader* loader;
1394   if (aPrincipal->OriginAttributesRef().IsPrivateBrowsing()) {
1395     loader = imgLoader::PrivateBrowsingLoader();
1396   } else {
1397     loader = imgLoader::NormalLoader();
1398   }
1399
1400   return loader->RemoveEntriesInternal(aPrincipal, nullptr);
1401 }
1402
1403 NS_IMETHODIMP
1404 imgLoader::RemoveEntriesFromBaseDomainInAllProcesses(
1405     const nsACString& aBaseDomain) {
1406   if (!XRE_IsParentProcess()) {
1407     return NS_ERROR_NOT_AVAILABLE;
1408   }
1409
1410   for (auto* cp : ContentParent::AllProcesses(ContentParent::eLive)) {
1411     Unused << cp->SendClearImageCacheFromBaseDomain(aBaseDomain);
1412   }
1413
1414   return RemoveEntriesInternal(nullptr, &aBaseDomain);
1415 }
1416
1417 nsresult imgLoader::RemoveEntriesInternal(nsIPrincipal* aPrincipal,
1418                                           const nsACString* aBaseDomain) {
1419   // Can only clear by either principal or base domain.
1420   if ((!aPrincipal && !aBaseDomain) || (aPrincipal && aBaseDomain)) {
1421     return NS_ERROR_INVALID_ARG;
1422   }
1423
1424   nsCOMPtr<nsIEffectiveTLDService> tldService;
1425   AutoTArray<RefPtr<imgCacheEntry>, 128> entriesToBeRemoved;
1426
1427   // For base domain we only clear the non-chrome cache.
1428   for (const auto& entry : mCache) {
1429     const auto& key = entry.GetKey();
1430
1431     const bool shouldRemove = [&] {
1432       if (aPrincipal) {
1433         nsCOMPtr<nsIPrincipal> keyPrincipal =
1434             BasePrincipal::CreateContentPrincipal(key.URI(),
1435                                                   key.OriginAttributesRef());
1436         return keyPrincipal->Equals(aPrincipal);
1437       }
1438
1439       if (!aBaseDomain) {
1440         return false;
1441       }
1442       // Clear by baseDomain.
1443       nsAutoCString host;
1444       nsresult rv = key.URI()->GetHost(host);
1445       if (NS_FAILED(rv) || host.IsEmpty()) {
1446         return false;
1447       }
1448
1449       if (!tldService) {
1450         tldService = do_GetService(NS_EFFECTIVETLDSERVICE_CONTRACTID);
1451       }
1452       if (NS_WARN_IF(!tldService)) {
1453         return false;
1454       }
1455
1456       bool hasRootDomain = false;
1457       rv = tldService->HasRootDomain(host, *aBaseDomain, &hasRootDomain);
1458       if (NS_SUCCEEDED(rv) && hasRootDomain) {
1459         return true;
1460       }
1461
1462       // If we don't get a direct base domain match, also check for cache of
1463       // third parties partitioned under aBaseDomain.
1464
1465       // The isolation key is either just the base domain, or an origin suffix
1466       // which contains the partitionKey holding the baseDomain.
1467
1468       if (key.IsolationKeyRef().Equals(*aBaseDomain)) {
1469         return true;
1470       }
1471
1472       // The isolation key does not match the given base domain. It may be an
1473       // origin suffix. Parse it into origin attributes.
1474       OriginAttributes attrs;
1475       if (!attrs.PopulateFromSuffix(key.IsolationKeyRef())) {
1476         // Key is not an origin suffix.
1477         return false;
1478       }
1479
1480       return StoragePrincipalHelper::PartitionKeyHasBaseDomain(
1481           attrs.mPartitionKey, *aBaseDomain);
1482     }();
1483
1484     if (shouldRemove) {
1485       entriesToBeRemoved.AppendElement(entry.GetData());
1486     }
1487   }
1488
1489   for (auto& entry : entriesToBeRemoved) {
1490     if (!RemoveFromCache(entry)) {
1491       NS_WARNING(
1492           "Couldn't remove an entry from the cache in "
1493           "RemoveEntriesInternal()\n");
1494     }
1495   }
1496
1497   return NS_OK;
1498 }
1499
1500 constexpr auto AllCORSModes() {
1501   return MakeInclusiveEnumeratedRange(kFirstCORSMode, kLastCORSMode);
1502 }
1503
1504 NS_IMETHODIMP
1505 imgLoader::RemoveEntry(nsIURI* aURI, Document* aDoc) {
1506   if (!aURI) {
1507     return NS_OK;
1508   }
1509   OriginAttributes attrs;
1510   if (aDoc) {
1511     attrs = aDoc->NodePrincipal()->OriginAttributesRef();
1512   }
1513   for (auto corsMode : AllCORSModes()) {
1514     ImageCacheKey key(aURI, corsMode, attrs, aDoc);
1515     RemoveFromCache(key);
1516   }
1517   return NS_OK;
1518 }
1519
1520 NS_IMETHODIMP
1521 imgLoader::FindEntryProperties(nsIURI* uri, Document* aDoc,
1522                                nsIProperties** _retval) {
1523   *_retval = nullptr;
1524
1525   OriginAttributes attrs;
1526   if (aDoc) {
1527     nsCOMPtr<nsIPrincipal> principal = aDoc->NodePrincipal();
1528     if (principal) {
1529       attrs = principal->OriginAttributesRef();
1530     }
1531   }
1532
1533   for (auto corsMode : AllCORSModes()) {
1534     ImageCacheKey key(uri, corsMode, attrs, aDoc);
1535     RefPtr<imgCacheEntry> entry;
1536     if (!mCache.Get(key, getter_AddRefs(entry)) || !entry) {
1537       continue;
1538     }
1539     if (mCacheTracker && entry->HasNoProxies()) {
1540       mCacheTracker->MarkUsed(entry);
1541     }
1542     RefPtr<imgRequest> request = entry->GetRequest();
1543     if (request) {
1544       nsCOMPtr<nsIProperties> properties = request->Properties();
1545       properties.forget(_retval);
1546       return NS_OK;
1547     }
1548   }
1549   return NS_OK;
1550 }
1551
1552 NS_IMETHODIMP_(void)
1553 imgLoader::ClearCacheForControlledDocument(Document* aDoc) {
1554   MOZ_ASSERT(aDoc);
1555   AutoTArray<RefPtr<imgCacheEntry>, 128> entriesToBeRemoved;
1556   for (const auto& entry : mCache) {
1557     const auto& key = entry.GetKey();
1558     if (key.ControlledDocument() == aDoc) {
1559       entriesToBeRemoved.AppendElement(entry.GetData());
1560     }
1561   }
1562   for (auto& entry : entriesToBeRemoved) {
1563     if (!RemoveFromCache(entry)) {
1564       NS_WARNING(
1565           "Couldn't remove an entry from the cache in "
1566           "ClearCacheForControlledDocument()\n");
1567     }
1568   }
1569 }
1570
1571 void imgLoader::Shutdown() {
1572   NS_IF_RELEASE(gNormalLoader);
1573   gNormalLoader = nullptr;
1574   NS_IF_RELEASE(gPrivateBrowsingLoader);
1575   gPrivateBrowsingLoader = nullptr;
1576 }
1577
1578 bool imgLoader::PutIntoCache(const ImageCacheKey& aKey, imgCacheEntry* entry) {
1579   LOG_STATIC_FUNC_WITH_PARAM(gImgLog, "imgLoader::PutIntoCache", "uri",
1580                              aKey.URI());
1581
1582   // Check to see if this request already exists in the cache. If so, we'll
1583   // replace the old version.
1584   RefPtr<imgCacheEntry> tmpCacheEntry;
1585   if (mCache.Get(aKey, getter_AddRefs(tmpCacheEntry)) && tmpCacheEntry) {
1586     MOZ_LOG(
1587         gImgLog, LogLevel::Debug,
1588         ("[this=%p] imgLoader::PutIntoCache -- Element already in the cache",
1589          nullptr));
1590     RefPtr<imgRequest> tmpRequest = tmpCacheEntry->GetRequest();
1591
1592     // If it already exists, and we're putting the same key into the cache, we
1593     // should remove the old version.
1594     MOZ_LOG(gImgLog, LogLevel::Debug,
1595             ("[this=%p] imgLoader::PutIntoCache -- Replacing cached element",
1596              nullptr));
1597
1598     RemoveFromCache(aKey);
1599   } else {
1600     MOZ_LOG(gImgLog, LogLevel::Debug,
1601             ("[this=%p] imgLoader::PutIntoCache --"
1602              " Element NOT already in the cache",
1603              nullptr));
1604   }
1605
1606   mCache.InsertOrUpdate(aKey, RefPtr{entry});
1607
1608   // We can be called to resurrect an evicted entry.
1609   if (entry->Evicted()) {
1610     entry->SetEvicted(false);
1611   }
1612
1613   // If we're resurrecting an entry with no proxies, put it back in the
1614   // tracker and queue.
1615   if (entry->HasNoProxies()) {
1616     nsresult addrv = NS_OK;
1617
1618     if (mCacheTracker) {
1619       addrv = mCacheTracker->AddObject(entry);
1620     }
1621
1622     if (NS_SUCCEEDED(addrv)) {
1623       mCacheQueue.Push(entry);
1624     }
1625   }
1626
1627   RefPtr<imgRequest> request = entry->GetRequest();
1628   request->SetIsInCache(true);
1629   RemoveFromUncachedImages(request);
1630
1631   return true;
1632 }
1633
1634 bool imgLoader::SetHasNoProxies(imgRequest* aRequest, imgCacheEntry* aEntry) {
1635   LOG_STATIC_FUNC_WITH_PARAM(gImgLog, "imgLoader::SetHasNoProxies", "uri",
1636                              aRequest->CacheKey().URI());
1637
1638   aEntry->SetHasNoProxies(true);
1639
1640   if (aEntry->Evicted()) {
1641     return false;
1642   }
1643
1644   nsresult addrv = NS_OK;
1645
1646   if (mCacheTracker) {
1647     addrv = mCacheTracker->AddObject(aEntry);
1648   }
1649
1650   if (NS_SUCCEEDED(addrv)) {
1651     mCacheQueue.Push(aEntry);
1652   }
1653
1654   return true;
1655 }
1656
1657 bool imgLoader::SetHasProxies(imgRequest* aRequest) {
1658   VerifyCacheSizes();
1659
1660   const ImageCacheKey& key = aRequest->CacheKey();
1661
1662   LOG_STATIC_FUNC_WITH_PARAM(gImgLog, "imgLoader::SetHasProxies", "uri",
1663                              key.URI());
1664
1665   RefPtr<imgCacheEntry> entry;
1666   if (mCache.Get(key, getter_AddRefs(entry)) && entry) {
1667     // Make sure the cache entry is for the right request
1668     RefPtr<imgRequest> entryRequest = entry->GetRequest();
1669     if (entryRequest == aRequest && entry->HasNoProxies()) {
1670       mCacheQueue.Remove(entry);
1671
1672       if (mCacheTracker) {
1673         mCacheTracker->RemoveObject(entry);
1674       }
1675
1676       entry->SetHasNoProxies(false);
1677
1678       return true;
1679     }
1680   }
1681
1682   return false;
1683 }
1684
1685 void imgLoader::CacheEntriesChanged(int32_t aSizeDiff /* = 0 */) {
1686   // We only need to dirty the queue if there is any sorting
1687   // taking place.  Empty or single-entry lists can't become
1688   // dirty.
1689   if (mCacheQueue.GetNumElements() > 1) {
1690     mCacheQueue.MarkDirty();
1691   }
1692   mCacheQueue.UpdateSize(aSizeDiff);
1693 }
1694
1695 void imgLoader::CheckCacheLimits() {
1696   if (mCacheQueue.GetNumElements() == 0) {
1697     NS_ASSERTION(mCacheQueue.GetSize() == 0,
1698                  "imgLoader::CheckCacheLimits -- incorrect cache size");
1699   }
1700
1701   // Remove entries from the cache until we're back at our desired max size.
1702   while (mCacheQueue.GetSize() > sCacheMaxSize) {
1703     // Remove the first entry in the queue.
1704     RefPtr<imgCacheEntry> entry(mCacheQueue.Pop());
1705
1706     NS_ASSERTION(entry, "imgLoader::CheckCacheLimits -- NULL entry pointer");
1707
1708     if (MOZ_LOG_TEST(gImgLog, LogLevel::Debug)) {
1709       RefPtr<imgRequest> req = entry->GetRequest();
1710       if (req) {
1711         LOG_STATIC_FUNC_WITH_PARAM(gImgLog, "imgLoader::CheckCacheLimits",
1712                                    "entry", req->CacheKey().URI());
1713       }
1714     }
1715
1716     if (entry) {
1717       // We just popped this entry from the queue, so pass AlreadyRemoved
1718       // to avoid searching the queue again in RemoveFromCache.
1719       RemoveFromCache(entry, QueueState::AlreadyRemoved);
1720     }
1721   }
1722 }
1723
1724 bool imgLoader::ValidateRequestWithNewChannel(
1725     imgRequest* request, nsIURI* aURI, nsIURI* aInitialDocumentURI,
1726     nsIReferrerInfo* aReferrerInfo, nsILoadGroup* aLoadGroup,
1727     imgINotificationObserver* aObserver, Document* aLoadingDocument,
1728     uint64_t aInnerWindowId, nsLoadFlags aLoadFlags,
1729     nsContentPolicyType aLoadPolicyType, imgRequestProxy** aProxyRequest,
1730     nsIPrincipal* aTriggeringPrincipal, CORSMode aCORSMode, bool aLinkPreload,
1731     uint64_t aEarlyHintPreloaderId, FetchPriority aFetchPriority,
1732     bool* aNewChannelCreated) {
1733   // now we need to insert a new channel request object in between the real
1734   // request and the proxy that basically delays loading the image until it
1735   // gets a 304 or figures out that this needs to be a new request
1736
1737   nsresult rv;
1738
1739   // If we're currently in the middle of validating this request, just hand
1740   // back a proxy to it; the required work will be done for us.
1741   if (imgCacheValidator* validator = request->GetValidator()) {
1742     rv = CreateNewProxyForRequest(request, aURI, aLoadGroup, aLoadingDocument,
1743                                   aObserver, aLoadFlags, aProxyRequest);
1744     if (NS_FAILED(rv)) {
1745       return false;
1746     }
1747
1748     if (*aProxyRequest) {
1749       imgRequestProxy* proxy = static_cast<imgRequestProxy*>(*aProxyRequest);
1750
1751       // We will send notifications from imgCacheValidator::OnStartRequest().
1752       // In the mean time, we must defer notifications because we are added to
1753       // the imgRequest's proxy list, and we can get extra notifications
1754       // resulting from methods such as StartDecoding(). See bug 579122.
1755       proxy->MarkValidating();
1756
1757       if (aLinkPreload) {
1758         MOZ_ASSERT(aLoadingDocument);
1759         auto preloadKey = PreloadHashKey::CreateAsImage(
1760             aURI, aTriggeringPrincipal, aCORSMode);
1761         proxy->NotifyOpen(preloadKey, aLoadingDocument, true);
1762       }
1763
1764       // Attach the proxy without notifying
1765       validator->AddProxy(proxy);
1766     }
1767
1768     return true;
1769   }
1770   // We will rely on Necko to cache this request when it's possible, and to
1771   // tell imgCacheValidator::OnStartRequest whether the request came from its
1772   // cache.
1773   nsCOMPtr<nsIChannel> newChannel;
1774   bool forcePrincipalCheck;
1775   rv = NewImageChannel(getter_AddRefs(newChannel), &forcePrincipalCheck, aURI,
1776                        aInitialDocumentURI, aCORSMode, aReferrerInfo,
1777                        aLoadGroup, aLoadFlags, aLoadPolicyType,
1778                        aTriggeringPrincipal, aLoadingDocument, mRespectPrivacy,
1779                        aEarlyHintPreloaderId, aFetchPriority);
1780   if (NS_FAILED(rv)) {
1781     return false;
1782   }
1783
1784   if (aNewChannelCreated) {
1785     *aNewChannelCreated = true;
1786   }
1787
1788   RefPtr<imgRequestProxy> req;
1789   rv = CreateNewProxyForRequest(request, aURI, aLoadGroup, aLoadingDocument,
1790                                 aObserver, aLoadFlags, getter_AddRefs(req));
1791   if (NS_FAILED(rv)) {
1792     return false;
1793   }
1794
1795   // Make sure that OnStatus/OnProgress calls have the right request set...
1796   RefPtr<nsProgressNotificationProxy> progressproxy =
1797       new nsProgressNotificationProxy(newChannel, req);
1798   if (!progressproxy) {
1799     return false;
1800   }
1801
1802   RefPtr<imgCacheValidator> hvc =
1803       new imgCacheValidator(progressproxy, this, request, aLoadingDocument,
1804                             aInnerWindowId, forcePrincipalCheck);
1805
1806   // Casting needed here to get past multiple inheritance.
1807   nsCOMPtr<nsIStreamListener> listener =
1808       static_cast<nsIThreadRetargetableStreamListener*>(hvc);
1809   NS_ENSURE_TRUE(listener, false);
1810
1811   // We must set the notification callbacks before setting up the
1812   // CORS listener, because that's also interested inthe
1813   // notification callbacks.
1814   newChannel->SetNotificationCallbacks(hvc);
1815
1816   request->SetValidator(hvc);
1817
1818   // We will send notifications from imgCacheValidator::OnStartRequest().
1819   // In the mean time, we must defer notifications because we are added to
1820   // the imgRequest's proxy list, and we can get extra notifications
1821   // resulting from methods such as StartDecoding(). See bug 579122.
1822   req->MarkValidating();
1823
1824   if (aLinkPreload) {
1825     MOZ_ASSERT(aLoadingDocument);
1826     auto preloadKey =
1827         PreloadHashKey::CreateAsImage(aURI, aTriggeringPrincipal, aCORSMode);
1828     req->NotifyOpen(preloadKey, aLoadingDocument, true);
1829   }
1830
1831   // Add the proxy without notifying
1832   hvc->AddProxy(req);
1833
1834   mozilla::net::PredictorLearn(aURI, aInitialDocumentURI,
1835                                nsINetworkPredictor::LEARN_LOAD_SUBRESOURCE,
1836                                aLoadGroup);
1837   rv = newChannel->AsyncOpen(listener);
1838   if (NS_WARN_IF(NS_FAILED(rv))) {
1839     req->CancelAndForgetObserver(rv);
1840     // This will notify any current or future <link preload> tags.  Pass the
1841     // non-open channel so that we can read loadinfo and referrer info of that
1842     // channel.
1843     req->NotifyStart(newChannel);
1844     // Use the non-channel overload of this method to force the notification to
1845     // happen.  The preload request has not been assigned a channel.
1846     req->NotifyStop(rv);
1847     return false;
1848   }
1849
1850   req.forget(aProxyRequest);
1851   return true;
1852 }
1853
1854 void imgLoader::NotifyObserversForCachedImage(
1855     imgCacheEntry* aEntry, imgRequest* request, nsIURI* aURI,
1856     nsIReferrerInfo* aReferrerInfo, Document* aLoadingDocument,
1857     nsIPrincipal* aTriggeringPrincipal, CORSMode aCORSMode,
1858     uint64_t aEarlyHintPreloaderId, FetchPriority aFetchPriority) {
1859   if (aEntry->HasNotified()) {
1860     return;
1861   }
1862
1863   nsCOMPtr<nsIObserverService> obsService = services::GetObserverService();
1864
1865   if (!obsService->HasObservers("http-on-image-cache-response")) {
1866     return;
1867   }
1868
1869   aEntry->SetHasNotified();
1870
1871   nsCOMPtr<nsIChannel> newChannel;
1872   bool forcePrincipalCheck;
1873   nsresult rv = NewImageChannel(
1874       getter_AddRefs(newChannel), &forcePrincipalCheck, aURI, nullptr,
1875       aCORSMode, aReferrerInfo, nullptr, 0,
1876       nsIContentPolicy::TYPE_INTERNAL_IMAGE, aTriggeringPrincipal,
1877       aLoadingDocument, mRespectPrivacy, aEarlyHintPreloaderId, aFetchPriority);
1878   if (NS_FAILED(rv)) {
1879     return;
1880   }
1881
1882   RefPtr<HttpBaseChannel> httpBaseChannel = do_QueryObject(newChannel);
1883   if (httpBaseChannel) {
1884     httpBaseChannel->SetDummyChannelForImageCache();
1885     newChannel->SetContentType(nsDependentCString(request->GetMimeType()));
1886     RefPtr<mozilla::image::Image> image = request->GetImage();
1887     if (image) {
1888       newChannel->SetContentLength(aEntry->GetDataSize());
1889     }
1890     obsService->NotifyObservers(newChannel, "http-on-image-cache-response",
1891                                 nullptr);
1892   }
1893 }
1894
1895 bool imgLoader::ValidateEntry(
1896     imgCacheEntry* aEntry, nsIURI* aURI, nsIURI* aInitialDocumentURI,
1897     nsIReferrerInfo* aReferrerInfo, nsILoadGroup* aLoadGroup,
1898     imgINotificationObserver* aObserver, Document* aLoadingDocument,
1899     nsLoadFlags aLoadFlags, nsContentPolicyType aLoadPolicyType,
1900     bool aCanMakeNewChannel, bool* aNewChannelCreated,
1901     imgRequestProxy** aProxyRequest, nsIPrincipal* aTriggeringPrincipal,
1902     CORSMode aCORSMode, bool aLinkPreload, uint64_t aEarlyHintPreloaderId,
1903     FetchPriority aFetchPriority) {
1904   LOG_SCOPE(gImgLog, "imgLoader::ValidateEntry");
1905
1906   // If the expiration time is zero, then the request has not gotten far enough
1907   // to know when it will expire, or we know it will never expire (see
1908   // nsContentUtils::GetSubresourceCacheValidationInfo).
1909   uint32_t expiryTime = aEntry->GetExpiryTime();
1910   bool hasExpired = expiryTime && expiryTime <= SecondsFromPRTime(PR_Now());
1911
1912   // Special treatment for file URLs - aEntry has expired if file has changed
1913   if (nsCOMPtr<nsIFileURL> fileUrl = do_QueryInterface(aURI)) {
1914     uint32_t lastModTime = aEntry->GetLoadTime();
1915     nsCOMPtr<nsIFile> theFile;
1916     if (NS_SUCCEEDED(fileUrl->GetFile(getter_AddRefs(theFile)))) {
1917       PRTime fileLastMod;
1918       if (NS_SUCCEEDED(theFile->GetLastModifiedTime(&fileLastMod))) {
1919         // nsIFile uses millisec, NSPR usec.
1920         fileLastMod *= 1000;
1921         hasExpired = SecondsFromPRTime((PRTime)fileLastMod) > lastModTime;
1922       }
1923     }
1924   }
1925
1926   RefPtr<imgRequest> request(aEntry->GetRequest());
1927
1928   if (!request) {
1929     return false;
1930   }
1931
1932   if (!ValidateSecurityInfo(request, aEntry->ForcePrincipalCheck(), aCORSMode,
1933                             aTriggeringPrincipal, aLoadingDocument,
1934                             aLoadPolicyType)) {
1935     return false;
1936   }
1937
1938   // data URIs are immutable and by their nature can't leak data, so we can
1939   // just return true in that case.  Doing so would mean that shift-reload
1940   // doesn't reload data URI documents/images though (which is handy for
1941   // debugging during gecko development) so we make an exception in that case.
1942   if (aURI->SchemeIs("data") && !(aLoadFlags & nsIRequest::LOAD_BYPASS_CACHE)) {
1943     return true;
1944   }
1945
1946   bool validateRequest = false;
1947
1948   if (!request->CanReuseWithoutValidation(aLoadingDocument)) {
1949     // If we would need to revalidate this entry, but we're being told to
1950     // bypass the cache, we don't allow this entry to be used.
1951     if (aLoadFlags & nsIRequest::LOAD_BYPASS_CACHE) {
1952       return false;
1953     }
1954
1955     if (MOZ_UNLIKELY(ChaosMode::isActive(ChaosFeature::ImageCache))) {
1956       if (ChaosMode::randomUint32LessThan(4) < 1) {
1957         return false;
1958       }
1959     }
1960
1961     // Determine whether the cache aEntry must be revalidated...
1962     validateRequest = ShouldRevalidateEntry(aEntry, aLoadFlags, hasExpired);
1963
1964     MOZ_LOG(gImgLog, LogLevel::Debug,
1965             ("imgLoader::ValidateEntry validating cache entry. "
1966              "validateRequest = %d",
1967              validateRequest));
1968   } else if (!aLoadingDocument && MOZ_LOG_TEST(gImgLog, LogLevel::Debug)) {
1969     MOZ_LOG(gImgLog, LogLevel::Debug,
1970             ("imgLoader::ValidateEntry BYPASSING cache validation for %s "
1971              "because of NULL loading document",
1972              aURI->GetSpecOrDefault().get()));
1973   }
1974
1975   // If the original request is still transferring don't kick off a validation
1976   // network request because it is a bit silly to issue a validation request if
1977   // the original request hasn't even finished yet. So just return true
1978   // indicating the caller can create a new proxy for the request and use it as
1979   // is.
1980   // This is an optimization but it's also required for correctness. If we don't
1981   // do this then when firing the load complete notification for the original
1982   // request that can unblock load for the document and then spin the event loop
1983   // (see the stack in bug 1641682) which then the OnStartRequest for the
1984   // validation request can fire which can call UpdateProxies and can sync
1985   // notify on the progress tracker about all existing state, which includes
1986   // load complete, so we fire a second load complete notification for the
1987   // image.
1988   // In addition, we want to validate if the original request encountered
1989   // an error for two reasons. The first being if the error was a network error
1990   // then trying to re-fetch the image might succeed. The second is more
1991   // complicated. We decide if we should fire the load or error event for img
1992   // elements depending on if the image has error in its status at the time when
1993   // the load complete notification is received, and we set error status on an
1994   // image if it encounters a network error or a decode error with no real way
1995   // to tell them apart. So if we load an image that will produce a decode error
1996   // the first time we will usually fire the load event, and then decode enough
1997   // to encounter the decode error and set the error status on the image. The
1998   // next time we reference the image in the same document the load complete
1999   // notification is replayed and this time the error status from the decode is
2000   // already present so we fire the error event instead of the load event. This
2001   // is a bug (bug 1645576) that we should fix. In order to avoid that bug in
2002   // some cases (specifically the cases when we hit this code and try to
2003   // validate the request) we make sure to validate. This avoids the bug because
2004   // when the load complete notification arrives the proxy is marked as
2005   // validating so it lies about its status and returns nothing.
2006   const bool requestComplete = [&] {
2007     RefPtr<ProgressTracker> tracker;
2008     RefPtr<mozilla::image::Image> image = request->GetImage();
2009     if (image) {
2010       tracker = image->GetProgressTracker();
2011     } else {
2012       tracker = request->GetProgressTracker();
2013     }
2014     return tracker &&
2015            tracker->GetProgress() & (FLAG_LOAD_COMPLETE | FLAG_HAS_ERROR);
2016   }();
2017
2018   if (!requestComplete) {
2019     return true;
2020   }
2021
2022   if (validateRequest && aCanMakeNewChannel) {
2023     LOG_SCOPE(gImgLog, "imgLoader::ValidateRequest |cache hit| must validate");
2024
2025     uint64_t innerWindowID =
2026         aLoadingDocument ? aLoadingDocument->InnerWindowID() : 0;
2027     return ValidateRequestWithNewChannel(
2028         request, aURI, aInitialDocumentURI, aReferrerInfo, aLoadGroup,
2029         aObserver, aLoadingDocument, innerWindowID, aLoadFlags, aLoadPolicyType,
2030         aProxyRequest, aTriggeringPrincipal, aCORSMode, aLinkPreload,
2031         aEarlyHintPreloaderId, aFetchPriority, aNewChannelCreated);
2032   }
2033
2034   if (!validateRequest) {
2035     NotifyObserversForCachedImage(
2036         aEntry, request, aURI, aReferrerInfo, aLoadingDocument,
2037         aTriggeringPrincipal, aCORSMode, aEarlyHintPreloaderId, aFetchPriority);
2038   }
2039
2040   return !validateRequest;
2041 }
2042
2043 bool imgLoader::RemoveFromCache(const ImageCacheKey& aKey) {
2044   LOG_STATIC_FUNC_WITH_PARAM(gImgLog, "imgLoader::RemoveFromCache", "uri",
2045                              aKey.URI());
2046   RefPtr<imgCacheEntry> entry;
2047   mCache.Remove(aKey, getter_AddRefs(entry));
2048   if (entry) {
2049     MOZ_ASSERT(!entry->Evicted(), "Evicting an already-evicted cache entry!");
2050
2051     // Entries with no proxies are in the tracker.
2052     if (entry->HasNoProxies()) {
2053       if (mCacheTracker) {
2054         mCacheTracker->RemoveObject(entry);
2055       }
2056       mCacheQueue.Remove(entry);
2057     }
2058
2059     entry->SetEvicted(true);
2060
2061     RefPtr<imgRequest> request = entry->GetRequest();
2062     request->SetIsInCache(false);
2063     AddToUncachedImages(request);
2064
2065     return true;
2066   }
2067   return false;
2068 }
2069
2070 bool imgLoader::RemoveFromCache(imgCacheEntry* entry, QueueState aQueueState) {
2071   LOG_STATIC_FUNC(gImgLog, "imgLoader::RemoveFromCache entry");
2072
2073   RefPtr<imgRequest> request = entry->GetRequest();
2074   if (request) {
2075     const ImageCacheKey& key = request->CacheKey();
2076     LOG_STATIC_FUNC_WITH_PARAM(gImgLog, "imgLoader::RemoveFromCache",
2077                                "entry's uri", key.URI());
2078
2079     mCache.Remove(key);
2080
2081     if (entry->HasNoProxies()) {
2082       LOG_STATIC_FUNC(gImgLog,
2083                       "imgLoader::RemoveFromCache removing from tracker");
2084       if (mCacheTracker) {
2085         mCacheTracker->RemoveObject(entry);
2086       }
2087       // Only search the queue to remove the entry if its possible it might
2088       // be in the queue.  If we know its not in the queue this would be
2089       // wasted work.
2090       MOZ_ASSERT_IF(aQueueState == QueueState::AlreadyRemoved,
2091                     !mCacheQueue.Contains(entry));
2092       if (aQueueState == QueueState::MaybeExists) {
2093         mCacheQueue.Remove(entry);
2094       }
2095     }
2096
2097     entry->SetEvicted(true);
2098     request->SetIsInCache(false);
2099     AddToUncachedImages(request);
2100
2101     return true;
2102   }
2103
2104   return false;
2105 }
2106
2107 nsresult imgLoader::ClearImageCache(ClearOptions aOptions) {
2108   const bool chromeOnly = aOptions.contains(ClearOption::ChromeOnly);
2109   const auto ShouldRemove = [&](imgCacheEntry* aEntry) {
2110     if (chromeOnly) {
2111       // TODO: Consider also removing "resource://" etc?
2112       RefPtr<imgRequest> request = aEntry->GetRequest();
2113       if (!request || !request->CacheKey().URI()->SchemeIs("chrome")) {
2114         return false;
2115       }
2116     }
2117     return true;
2118   };
2119   if (aOptions.contains(ClearOption::UnusedOnly)) {
2120     LOG_STATIC_FUNC(gImgLog, "imgLoader::ClearImageCache queue");
2121     // We have to make a temporary, since RemoveFromCache removes the element
2122     // from the queue, invalidating iterators.
2123     nsTArray<RefPtr<imgCacheEntry>> entries(mCacheQueue.GetNumElements());
2124     for (auto& entry : mCacheQueue) {
2125       if (ShouldRemove(entry)) {
2126         entries.AppendElement(entry);
2127       }
2128     }
2129
2130     // Iterate in reverse order to minimize array copying.
2131     for (auto& entry : entries) {
2132       if (!RemoveFromCache(entry)) {
2133         return NS_ERROR_FAILURE;
2134       }
2135     }
2136
2137     MOZ_ASSERT(chromeOnly || mCacheQueue.GetNumElements() == 0);
2138     return NS_OK;
2139   }
2140
2141   LOG_STATIC_FUNC(gImgLog, "imgLoader::ClearImageCache table");
2142   // We have to make a temporary, since RemoveFromCache removes the element
2143   // from the queue, invalidating iterators.
2144   const auto entries =
2145       ToTArray<nsTArray<RefPtr<imgCacheEntry>>>(mCache.Values());
2146   for (const auto& entry : entries) {
2147     if (!ShouldRemove(entry)) {
2148       continue;
2149     }
2150     if (!RemoveFromCache(entry)) {
2151       return NS_ERROR_FAILURE;
2152     }
2153   }
2154   MOZ_ASSERT(chromeOnly || mCache.IsEmpty());
2155   return NS_OK;
2156 }
2157
2158 void imgLoader::AddToUncachedImages(imgRequest* aRequest) {
2159   MutexAutoLock lock(mUncachedImagesMutex);
2160   mUncachedImages.Insert(aRequest);
2161 }
2162
2163 void imgLoader::RemoveFromUncachedImages(imgRequest* aRequest) {
2164   MutexAutoLock lock(mUncachedImagesMutex);
2165   mUncachedImages.Remove(aRequest);
2166 }
2167
2168 #define LOAD_FLAGS_CACHE_MASK \
2169   (nsIRequest::LOAD_BYPASS_CACHE | nsIRequest::LOAD_FROM_CACHE)
2170
2171 #define LOAD_FLAGS_VALIDATE_MASK                              \
2172   (nsIRequest::VALIDATE_ALWAYS | nsIRequest::VALIDATE_NEVER | \
2173    nsIRequest::VALIDATE_ONCE_PER_SESSION)
2174
2175 NS_IMETHODIMP
2176 imgLoader::LoadImageXPCOM(
2177     nsIURI* aURI, nsIURI* aInitialDocumentURI, nsIReferrerInfo* aReferrerInfo,
2178     nsIPrincipal* aTriggeringPrincipal, nsILoadGroup* aLoadGroup,
2179     imgINotificationObserver* aObserver, Document* aLoadingDocument,
2180     nsLoadFlags aLoadFlags, nsISupports* aCacheKey,
2181     nsContentPolicyType aContentPolicyType, imgIRequest** _retval) {
2182   // Optional parameter, so defaults to 0 (== TYPE_INVALID)
2183   if (!aContentPolicyType) {
2184     aContentPolicyType = nsIContentPolicy::TYPE_INTERNAL_IMAGE;
2185   }
2186   imgRequestProxy* proxy;
2187   nsresult rv =
2188       LoadImage(aURI, aInitialDocumentURI, aReferrerInfo, aTriggeringPrincipal,
2189                 0, aLoadGroup, aObserver, aLoadingDocument, aLoadingDocument,
2190                 aLoadFlags, aCacheKey, aContentPolicyType, u""_ns,
2191                 /* aUseUrgentStartForChannel */ false, /* aListPreload */ false,
2192                 0, FetchPriority::Auto, &proxy);
2193   *_retval = proxy;
2194   return rv;
2195 }
2196
2197 static void MakeRequestStaticIfNeeded(
2198     Document* aLoadingDocument, imgRequestProxy** aProxyAboutToGetReturned) {
2199   if (!aLoadingDocument || !aLoadingDocument->IsStaticDocument()) {
2200     return;
2201   }
2202
2203   if (!*aProxyAboutToGetReturned) {
2204     return;
2205   }
2206
2207   RefPtr<imgRequestProxy> proxy = dont_AddRef(*aProxyAboutToGetReturned);
2208   *aProxyAboutToGetReturned = nullptr;
2209
2210   RefPtr<imgRequestProxy> staticProxy =
2211       proxy->GetStaticRequest(aLoadingDocument);
2212   if (staticProxy != proxy) {
2213     proxy->CancelAndForgetObserver(NS_BINDING_ABORTED);
2214     proxy = std::move(staticProxy);
2215   }
2216   proxy.forget(aProxyAboutToGetReturned);
2217 }
2218
2219 bool imgLoader::IsImageAvailable(nsIURI* aURI,
2220                                  nsIPrincipal* aTriggeringPrincipal,
2221                                  CORSMode aCORSMode, Document* aDocument) {
2222   ImageCacheKey key(aURI, aCORSMode,
2223                     aTriggeringPrincipal->OriginAttributesRef(), aDocument);
2224   RefPtr<imgCacheEntry> entry;
2225   if (!mCache.Get(key, getter_AddRefs(entry)) || !entry) {
2226     return false;
2227   }
2228   RefPtr<imgRequest> request = entry->GetRequest();
2229   if (!request) {
2230     return false;
2231   }
2232   if (nsCOMPtr<nsILoadGroup> docLoadGroup = aDocument->GetDocumentLoadGroup()) {
2233     nsLoadFlags requestFlags = nsIRequest::LOAD_NORMAL;
2234     docLoadGroup->GetLoadFlags(&requestFlags);
2235     if (requestFlags & nsIRequest::LOAD_BYPASS_CACHE) {
2236       // If we're bypassing the cache, treat the image as not available.
2237       return false;
2238     }
2239   }
2240   return ValidateCORSMode(request, false, aCORSMode, aTriggeringPrincipal);
2241 }
2242
2243 nsresult imgLoader::LoadImage(
2244     nsIURI* aURI, nsIURI* aInitialDocumentURI, nsIReferrerInfo* aReferrerInfo,
2245     nsIPrincipal* aTriggeringPrincipal, uint64_t aRequestContextID,
2246     nsILoadGroup* aLoadGroup, imgINotificationObserver* aObserver,
2247     nsINode* aContext, Document* aLoadingDocument, nsLoadFlags aLoadFlags,
2248     nsISupports* aCacheKey, nsContentPolicyType aContentPolicyType,
2249     const nsAString& initiatorType, bool aUseUrgentStartForChannel,
2250     bool aLinkPreload, uint64_t aEarlyHintPreloaderId,
2251     FetchPriority aFetchPriority, imgRequestProxy** _retval) {
2252   VerifyCacheSizes();
2253
2254   NS_ASSERTION(aURI, "imgLoader::LoadImage -- NULL URI pointer");
2255
2256   if (!aURI) {
2257     return NS_ERROR_NULL_POINTER;
2258   }
2259
2260   auto makeStaticIfNeeded = mozilla::MakeScopeExit(
2261       [&] { MakeRequestStaticIfNeeded(aLoadingDocument, _retval); });
2262
2263   AUTO_PROFILER_LABEL_DYNAMIC_NSCSTRING("imgLoader::LoadImage", NETWORK,
2264                                         aURI->GetSpecOrDefault());
2265
2266   LOG_SCOPE_WITH_PARAM(gImgLog, "imgLoader::LoadImage", "aURI", aURI);
2267
2268   *_retval = nullptr;
2269
2270   RefPtr<imgRequest> request;
2271
2272   nsresult rv;
2273   nsLoadFlags requestFlags = nsIRequest::LOAD_NORMAL;
2274
2275 #ifdef DEBUG
2276   bool isPrivate = false;
2277
2278   if (aLoadingDocument) {
2279     isPrivate = nsContentUtils::IsInPrivateBrowsing(aLoadingDocument);
2280   } else if (aLoadGroup) {
2281     isPrivate = nsContentUtils::IsInPrivateBrowsing(aLoadGroup);
2282   }
2283   MOZ_ASSERT(isPrivate == mRespectPrivacy);
2284
2285   if (aLoadingDocument) {
2286     // The given load group should match that of the document if given. If
2287     // that isn't the case, then we need to add more plumbing to ensure we
2288     // block the document as well.
2289     nsCOMPtr<nsILoadGroup> docLoadGroup =
2290         aLoadingDocument->GetDocumentLoadGroup();
2291     MOZ_ASSERT(docLoadGroup == aLoadGroup);
2292   }
2293 #endif
2294
2295   // Get the default load flags from the loadgroup (if possible)...
2296   if (aLoadGroup) {
2297     aLoadGroup->GetLoadFlags(&requestFlags);
2298   }
2299   //
2300   // Merge the default load flags with those passed in via aLoadFlags.
2301   // Currently, *only* the caching, validation and background load flags
2302   // are merged...
2303   //
2304   // The flags in aLoadFlags take precedence over the default flags!
2305   //
2306   if (aLoadFlags & LOAD_FLAGS_CACHE_MASK) {
2307     // Override the default caching flags...
2308     requestFlags = (requestFlags & ~LOAD_FLAGS_CACHE_MASK) |
2309                    (aLoadFlags & LOAD_FLAGS_CACHE_MASK);
2310   }
2311   if (aLoadFlags & LOAD_FLAGS_VALIDATE_MASK) {
2312     // Override the default validation flags...
2313     requestFlags = (requestFlags & ~LOAD_FLAGS_VALIDATE_MASK) |
2314                    (aLoadFlags & LOAD_FLAGS_VALIDATE_MASK);
2315   }
2316   if (aLoadFlags & nsIRequest::LOAD_BACKGROUND) {
2317     // Propagate background loading...
2318     requestFlags |= nsIRequest::LOAD_BACKGROUND;
2319   }
2320
2321   if (aLinkPreload) {
2322     // Set background loading if it is <link rel=preload>
2323     requestFlags |= nsIRequest::LOAD_BACKGROUND;
2324   }
2325
2326   CORSMode corsmode = CORS_NONE;
2327   if (aLoadFlags & imgILoader::LOAD_CORS_ANONYMOUS) {
2328     corsmode = CORS_ANONYMOUS;
2329   } else if (aLoadFlags & imgILoader::LOAD_CORS_USE_CREDENTIALS) {
2330     corsmode = CORS_USE_CREDENTIALS;
2331   }
2332
2333   // Look in the preloaded images of loading document first.
2334   if (!aLinkPreload && aLoadingDocument) {
2335     // All Early Hints preloads are Link preloads, therefore we don't have a
2336     // Early Hints preload here
2337     MOZ_ASSERT(!aEarlyHintPreloaderId);
2338     auto key =
2339         PreloadHashKey::CreateAsImage(aURI, aTriggeringPrincipal, corsmode);
2340     if (RefPtr<PreloaderBase> preload =
2341             aLoadingDocument->Preloads().LookupPreload(key)) {
2342       RefPtr<imgRequestProxy> proxy = do_QueryObject(preload);
2343       MOZ_ASSERT(proxy);
2344
2345       MOZ_LOG(gImgLog, LogLevel::Debug,
2346               ("[this=%p] imgLoader::LoadImage -- preloaded [proxy=%p]"
2347                " [document=%p]\n",
2348                this, proxy.get(), aLoadingDocument));
2349
2350       // Removing the preload for this image to be in parity with Chromium.  Any
2351       // following regular image request will be reloaded using the regular
2352       // path: image cache, http cache, network.  Any following `<link
2353       // rel=preload as=image>` will start a new image preload that can be
2354       // satisfied from http cache or network.
2355       //
2356       // There is a spec discussion for "preload cache", see
2357       // https://github.com/w3c/preload/issues/97. And it is also not clear how
2358       // preload image interacts with list of available images, see
2359       // https://github.com/whatwg/html/issues/4474.
2360       proxy->RemoveSelf(aLoadingDocument);
2361       proxy->NotifyUsage(aLoadingDocument);
2362
2363       imgRequest* request = proxy->GetOwner();
2364       nsresult rv =
2365           CreateNewProxyForRequest(request, aURI, aLoadGroup, aLoadingDocument,
2366                                    aObserver, requestFlags, _retval);
2367       NS_ENSURE_SUCCESS(rv, rv);
2368
2369       imgRequestProxy* newProxy = *_retval;
2370       if (imgCacheValidator* validator = request->GetValidator()) {
2371         newProxy->MarkValidating();
2372         // Attach the proxy without notifying and this will add us to the load
2373         // group.
2374         validator->AddProxy(newProxy);
2375       } else {
2376         // It's OK to add here even if the request is done. If it is, it'll send
2377         // a OnStopRequest()and the proxy will be removed from the loadgroup in
2378         // imgRequestProxy::OnLoadComplete.
2379         newProxy->AddToLoadGroup();
2380         newProxy->NotifyListener();
2381       }
2382
2383       return NS_OK;
2384     }
2385   }
2386
2387   RefPtr<imgCacheEntry> entry;
2388
2389   // Look in the cache for our URI, and then validate it.
2390   // XXX For now ignore aCacheKey. We will need it in the future
2391   // for correctly dealing with image load requests that are a result
2392   // of post data.
2393   OriginAttributes attrs;
2394   if (aTriggeringPrincipal) {
2395     attrs = aTriggeringPrincipal->OriginAttributesRef();
2396   }
2397   ImageCacheKey key(aURI, corsmode, attrs, aLoadingDocument);
2398   if (mCache.Get(key, getter_AddRefs(entry)) && entry) {
2399     bool newChannelCreated = false;
2400     if (ValidateEntry(entry, aURI, aInitialDocumentURI, aReferrerInfo,
2401                       aLoadGroup, aObserver, aLoadingDocument, requestFlags,
2402                       aContentPolicyType, true, &newChannelCreated, _retval,
2403                       aTriggeringPrincipal, corsmode, aLinkPreload,
2404                       aEarlyHintPreloaderId, aFetchPriority)) {
2405       request = entry->GetRequest();
2406
2407       // If this entry has no proxies, its request has no reference to the
2408       // entry.
2409       if (entry->HasNoProxies()) {
2410         LOG_FUNC_WITH_PARAM(gImgLog,
2411                             "imgLoader::LoadImage() adding proxyless entry",
2412                             "uri", key.URI());
2413         MOZ_ASSERT(!request->HasCacheEntry(),
2414                    "Proxyless entry's request has cache entry!");
2415         request->SetCacheEntry(entry);
2416
2417         if (mCacheTracker && entry->GetExpirationState()->IsTracked()) {
2418           mCacheTracker->MarkUsed(entry);
2419         }
2420       }
2421
2422       entry->Touch();
2423
2424       if (!newChannelCreated) {
2425         // This is ugly but it's needed to report CSP violations. We have 3
2426         // scenarios:
2427         // - we don't have cache. We are not in this if() stmt. A new channel is
2428         //   created and that triggers the CSP checks.
2429         // - We have a cache entry and this is blocked by CSP directives.
2430         DebugOnly<bool> shouldLoad = ShouldLoadCachedImage(
2431             request, aLoadingDocument, aTriggeringPrincipal, aContentPolicyType,
2432             /* aSendCSPViolationReports */ true);
2433         MOZ_ASSERT(shouldLoad);
2434       }
2435     } else {
2436       // We can't use this entry. We'll try to load it off the network, and if
2437       // successful, overwrite the old entry in the cache with a new one.
2438       entry = nullptr;
2439     }
2440   }
2441
2442   // Keep the channel in this scope, so we can adjust its notificationCallbacks
2443   // later when we create the proxy.
2444   nsCOMPtr<nsIChannel> newChannel;
2445   // If we didn't get a cache hit, we need to load from the network.
2446   if (!request) {
2447     LOG_SCOPE(gImgLog, "imgLoader::LoadImage |cache miss|");
2448
2449     bool forcePrincipalCheck;
2450     rv = NewImageChannel(getter_AddRefs(newChannel), &forcePrincipalCheck, aURI,
2451                          aInitialDocumentURI, corsmode, aReferrerInfo,
2452                          aLoadGroup, requestFlags, aContentPolicyType,
2453                          aTriggeringPrincipal, aContext, mRespectPrivacy,
2454                          aEarlyHintPreloaderId, aFetchPriority);
2455     if (NS_FAILED(rv)) {
2456       return NS_ERROR_FAILURE;
2457     }
2458
2459     MOZ_ASSERT(NS_UsePrivateBrowsing(newChannel) == mRespectPrivacy);
2460
2461     NewRequestAndEntry(forcePrincipalCheck, this, key, getter_AddRefs(request),
2462                        getter_AddRefs(entry));
2463
2464     MOZ_LOG(gImgLog, LogLevel::Debug,
2465             ("[this=%p] imgLoader::LoadImage -- Created new imgRequest"
2466              " [request=%p]\n",
2467              this, request.get()));
2468
2469     nsCOMPtr<nsIClassOfService> cos(do_QueryInterface(newChannel));
2470     if (cos) {
2471       if (aUseUrgentStartForChannel && !aLinkPreload) {
2472         cos->AddClassFlags(nsIClassOfService::UrgentStart);
2473       }
2474       if (StaticPrefs::image_priority_incremental()) {
2475         cos->SetIncremental(true);
2476       }
2477
2478       if (StaticPrefs::network_http_tailing_enabled() &&
2479           aContentPolicyType == nsIContentPolicy::TYPE_INTERNAL_IMAGE_FAVICON) {
2480         cos->AddClassFlags(nsIClassOfService::Throttleable |
2481                            nsIClassOfService::Tail);
2482         nsCOMPtr<nsIHttpChannel> httpChannel(do_QueryInterface(newChannel));
2483         if (httpChannel) {
2484           Unused << httpChannel->SetRequestContextID(aRequestContextID);
2485         }
2486       }
2487     }
2488
2489     nsCOMPtr<nsILoadGroup> channelLoadGroup;
2490     newChannel->GetLoadGroup(getter_AddRefs(channelLoadGroup));
2491     rv = request->Init(aURI, aURI, /* aHadInsecureRedirect = */ false,
2492                        channelLoadGroup, newChannel, entry, aLoadingDocument,
2493                        aTriggeringPrincipal, corsmode, aReferrerInfo);
2494     if (NS_FAILED(rv)) {
2495       return NS_ERROR_FAILURE;
2496     }
2497
2498     // Add the initiator type for this image load
2499     nsCOMPtr<nsITimedChannel> timedChannel = do_QueryInterface(newChannel);
2500     if (timedChannel) {
2501       timedChannel->SetInitiatorType(initiatorType);
2502     }
2503
2504     // create the proxy listener
2505     nsCOMPtr<nsIStreamListener> listener = new ProxyListener(request.get());
2506
2507     MOZ_LOG(gImgLog, LogLevel::Debug,
2508             ("[this=%p] imgLoader::LoadImage -- Calling channel->AsyncOpen()\n",
2509              this));
2510
2511     mozilla::net::PredictorLearn(aURI, aInitialDocumentURI,
2512                                  nsINetworkPredictor::LEARN_LOAD_SUBRESOURCE,
2513                                  aLoadGroup);
2514
2515     nsresult openRes;
2516     openRes = newChannel->AsyncOpen(listener);
2517
2518     if (NS_FAILED(openRes)) {
2519       MOZ_LOG(
2520           gImgLog, LogLevel::Debug,
2521           ("[this=%p] imgLoader::LoadImage -- AsyncOpen() failed: 0x%" PRIx32
2522            "\n",
2523            this, static_cast<uint32_t>(openRes)));
2524       request->CancelAndAbort(openRes);
2525       return openRes;
2526     }
2527
2528     // Try to add the new request into the cache.
2529     PutIntoCache(key, entry);
2530   } else {
2531     LOG_MSG_WITH_PARAM(gImgLog, "imgLoader::LoadImage |cache hit|", "request",
2532                        request);
2533   }
2534
2535   // If we didn't get a proxy when validating the cache entry, we need to
2536   // create one.
2537   if (!*_retval) {
2538     // ValidateEntry() has three return values: "Is valid," "might be valid --
2539     // validating over network", and "not valid." If we don't have a _retval,
2540     // we know ValidateEntry is not validating over the network, so it's safe
2541     // to SetLoadId here because we know this request is valid for this context.
2542     //
2543     // Note, however, that this doesn't guarantee the behaviour we want (one
2544     // URL maps to the same image on a page) if we load the same image in a
2545     // different tab (see bug 528003), because its load id will get re-set, and
2546     // that'll cause us to validate over the network.
2547     request->SetLoadId(aLoadingDocument);
2548
2549     LOG_MSG(gImgLog, "imgLoader::LoadImage", "creating proxy request.");
2550     rv = CreateNewProxyForRequest(request, aURI, aLoadGroup, aLoadingDocument,
2551                                   aObserver, requestFlags, _retval);
2552     if (NS_FAILED(rv)) {
2553       return rv;
2554     }
2555
2556     imgRequestProxy* proxy = *_retval;
2557
2558     // Make sure that OnStatus/OnProgress calls have the right request set, if
2559     // we did create a channel here.
2560     if (newChannel) {
2561       nsCOMPtr<nsIInterfaceRequestor> requestor(
2562           new nsProgressNotificationProxy(newChannel, proxy));
2563       if (!requestor) {
2564         return NS_ERROR_OUT_OF_MEMORY;
2565       }
2566       newChannel->SetNotificationCallbacks(requestor);
2567     }
2568
2569     if (aLinkPreload) {
2570       MOZ_ASSERT(aLoadingDocument);
2571       auto preloadKey =
2572           PreloadHashKey::CreateAsImage(aURI, aTriggeringPrincipal, corsmode);
2573       proxy->NotifyOpen(preloadKey, aLoadingDocument, true);
2574     }
2575
2576     // Note that it's OK to add here even if the request is done.  If it is,
2577     // it'll send a OnStopRequest() to the proxy in imgRequestProxy::Notify and
2578     // the proxy will be removed from the loadgroup.
2579     proxy->AddToLoadGroup();
2580
2581     // If we're loading off the network, explicitly don't notify our proxy,
2582     // because necko (or things called from necko, such as imgCacheValidator)
2583     // are going to call our notifications asynchronously, and we can't make it
2584     // further asynchronous because observers might rely on imagelib completing
2585     // its work between the channel's OnStartRequest and OnStopRequest.
2586     if (!newChannel) {
2587       proxy->NotifyListener();
2588     }
2589
2590     return rv;
2591   }
2592
2593   NS_ASSERTION(*_retval, "imgLoader::LoadImage -- no return value");
2594
2595   return NS_OK;
2596 }
2597
2598 NS_IMETHODIMP
2599 imgLoader::LoadImageWithChannelXPCOM(nsIChannel* channel,
2600                                      imgINotificationObserver* aObserver,
2601                                      Document* aLoadingDocument,
2602                                      nsIStreamListener** listener,
2603                                      imgIRequest** _retval) {
2604   nsresult result;
2605   imgRequestProxy* proxy;
2606   result = LoadImageWithChannel(channel, aObserver, aLoadingDocument, listener,
2607                                 &proxy);
2608   *_retval = proxy;
2609   return result;
2610 }
2611
2612 nsresult imgLoader::LoadImageWithChannel(nsIChannel* channel,
2613                                          imgINotificationObserver* aObserver,
2614                                          Document* aLoadingDocument,
2615                                          nsIStreamListener** listener,
2616                                          imgRequestProxy** _retval) {
2617   NS_ASSERTION(channel,
2618                "imgLoader::LoadImageWithChannel -- NULL channel pointer");
2619
2620   MOZ_ASSERT(NS_UsePrivateBrowsing(channel) == mRespectPrivacy);
2621
2622   auto makeStaticIfNeeded = mozilla::MakeScopeExit(
2623       [&] { MakeRequestStaticIfNeeded(aLoadingDocument, _retval); });
2624
2625   LOG_SCOPE(gImgLog, "imgLoader::LoadImageWithChannel");
2626   RefPtr<imgRequest> request;
2627
2628   nsCOMPtr<nsIURI> uri;
2629   channel->GetURI(getter_AddRefs(uri));
2630
2631   NS_ENSURE_TRUE(channel, NS_ERROR_FAILURE);
2632   nsCOMPtr<nsILoadInfo> loadInfo = channel->LoadInfo();
2633
2634   OriginAttributes attrs = loadInfo->GetOriginAttributes();
2635
2636   // TODO: Get a meaningful cors mode from the caller probably?
2637   const auto corsMode = CORS_NONE;
2638   ImageCacheKey key(uri, corsMode, attrs, aLoadingDocument);
2639
2640   nsLoadFlags requestFlags = nsIRequest::LOAD_NORMAL;
2641   channel->GetLoadFlags(&requestFlags);
2642
2643   RefPtr<imgCacheEntry> entry;
2644
2645   if (requestFlags & nsIRequest::LOAD_BYPASS_CACHE) {
2646     RemoveFromCache(key);
2647   } else {
2648     // Look in the cache for our URI, and then validate it.
2649     // XXX For now ignore aCacheKey. We will need it in the future
2650     // for correctly dealing with image load requests that are a result
2651     // of post data.
2652     if (mCache.Get(key, getter_AddRefs(entry)) && entry) {
2653       // We don't want to kick off another network load. So we ask
2654       // ValidateEntry to only do validation without creating a new proxy. If
2655       // it says that the entry isn't valid any more, we'll only use the entry
2656       // we're getting if the channel is loading from the cache anyways.
2657       //
2658       // XXX -- should this be changed? it's pretty much verbatim from the old
2659       // code, but seems nonsensical.
2660       //
2661       // Since aCanMakeNewChannel == false, we don't need to pass content policy
2662       // type/principal/etc
2663
2664       nsCOMPtr<nsILoadInfo> loadInfo = channel->LoadInfo();
2665       // if there is a loadInfo, use the right contentType, otherwise
2666       // default to the internal image type
2667       nsContentPolicyType policyType = loadInfo->InternalContentPolicyType();
2668
2669       if (ValidateEntry(entry, uri, nullptr, nullptr, nullptr, aObserver,
2670                         aLoadingDocument, requestFlags, policyType, false,
2671                         nullptr, nullptr, nullptr, corsMode, false, 0,
2672                         FetchPriority::Auto)) {
2673         request = entry->GetRequest();
2674       } else {
2675         nsCOMPtr<nsICacheInfoChannel> cacheChan(do_QueryInterface(channel));
2676         bool bUseCacheCopy;
2677
2678         if (cacheChan) {
2679           cacheChan->IsFromCache(&bUseCacheCopy);
2680         } else {
2681           bUseCacheCopy = false;
2682         }
2683
2684         if (!bUseCacheCopy) {
2685           entry = nullptr;
2686         } else {
2687           request = entry->GetRequest();
2688         }
2689       }
2690
2691       if (request && entry) {
2692         // If this entry has no proxies, its request has no reference to
2693         // the entry.
2694         if (entry->HasNoProxies()) {
2695           LOG_FUNC_WITH_PARAM(
2696               gImgLog,
2697               "imgLoader::LoadImageWithChannel() adding proxyless entry", "uri",
2698               key.URI());
2699           MOZ_ASSERT(!request->HasCacheEntry(),
2700                      "Proxyless entry's request has cache entry!");
2701           request->SetCacheEntry(entry);
2702
2703           if (mCacheTracker && entry->GetExpirationState()->IsTracked()) {
2704             mCacheTracker->MarkUsed(entry);
2705           }
2706         }
2707       }
2708     }
2709   }
2710
2711   nsCOMPtr<nsILoadGroup> loadGroup;
2712   channel->GetLoadGroup(getter_AddRefs(loadGroup));
2713
2714 #ifdef DEBUG
2715   if (aLoadingDocument) {
2716     // The load group of the channel should always match that of the
2717     // document if given. If that isn't the case, then we need to add more
2718     // plumbing to ensure we block the document as well.
2719     nsCOMPtr<nsILoadGroup> docLoadGroup =
2720         aLoadingDocument->GetDocumentLoadGroup();
2721     MOZ_ASSERT(docLoadGroup == loadGroup);
2722   }
2723 #endif
2724
2725   // Filter out any load flags not from nsIRequest
2726   requestFlags &= nsIRequest::LOAD_REQUESTMASK;
2727
2728   nsresult rv = NS_OK;
2729   if (request) {
2730     // we have this in our cache already.. cancel the current (document) load
2731
2732     // this should fire an OnStopRequest
2733     channel->Cancel(NS_ERROR_PARSED_DATA_CACHED);
2734
2735     *listener = nullptr;  // give them back a null nsIStreamListener
2736
2737     rv = CreateNewProxyForRequest(request, uri, loadGroup, aLoadingDocument,
2738                                   aObserver, requestFlags, _retval);
2739     static_cast<imgRequestProxy*>(*_retval)->NotifyListener();
2740   } else {
2741     // We use originalURI here to fulfil the imgIRequest contract on GetURI.
2742     nsCOMPtr<nsIURI> originalURI;
2743     channel->GetOriginalURI(getter_AddRefs(originalURI));
2744
2745     // XXX(seth): We should be able to just use |key| here, except that |key| is
2746     // constructed above with the *current URI* and not the *original URI*. I'm
2747     // pretty sure this is a bug, and it's preventing us from ever getting a
2748     // cache hit in LoadImageWithChannel when redirects are involved.
2749     ImageCacheKey originalURIKey(originalURI, corsMode, attrs,
2750                                  aLoadingDocument);
2751
2752     // Default to doing a principal check because we don't know who
2753     // started that load and whether their principal ended up being
2754     // inherited on the channel.
2755     NewRequestAndEntry(/* aForcePrincipalCheckForCacheEntry = */ true, this,
2756                        originalURIKey, getter_AddRefs(request),
2757                        getter_AddRefs(entry));
2758
2759     // No principal specified here, because we're not passed one.
2760     // In LoadImageWithChannel, the redirects that may have been
2761     // associated with this load would have gone through necko.
2762     // We only have the final URI in ImageLib and hence don't know
2763     // if the request went through insecure redirects.  But if it did,
2764     // the necko cache should have handled that (since all necko cache hits
2765     // including the redirects will go through content policy).  Hence, we
2766     // can set aHadInsecureRedirect to false here.
2767     rv = request->Init(originalURI, uri, /* aHadInsecureRedirect = */ false,
2768                        channel, channel, entry, aLoadingDocument, nullptr,
2769                        corsMode, nullptr);
2770     NS_ENSURE_SUCCESS(rv, rv);
2771
2772     RefPtr<ProxyListener> pl =
2773         new ProxyListener(static_cast<nsIStreamListener*>(request.get()));
2774     pl.forget(listener);
2775
2776     // Try to add the new request into the cache.
2777     PutIntoCache(originalURIKey, entry);
2778
2779     rv = CreateNewProxyForRequest(request, originalURI, loadGroup,
2780                                   aLoadingDocument, aObserver, requestFlags,
2781                                   _retval);
2782
2783     // Explicitly don't notify our proxy, because we're loading off the
2784     // network, and necko (or things called from necko, such as
2785     // imgCacheValidator) are going to call our notifications asynchronously,
2786     // and we can't make it further asynchronous because observers might rely
2787     // on imagelib completing its work between the channel's OnStartRequest and
2788     // OnStopRequest.
2789   }
2790
2791   if (NS_FAILED(rv)) {
2792     return rv;
2793   }
2794
2795   (*_retval)->AddToLoadGroup();
2796   return rv;
2797 }
2798
2799 bool imgLoader::SupportImageWithMimeType(const nsACString& aMimeType,
2800                                          AcceptedMimeTypes aAccept
2801                                          /* = AcceptedMimeTypes::IMAGES */) {
2802   nsAutoCString mimeType(aMimeType);
2803   ToLowerCase(mimeType);
2804
2805   if (aAccept == AcceptedMimeTypes::IMAGES_AND_DOCUMENTS &&
2806       mimeType.EqualsLiteral("image/svg+xml")) {
2807     return true;
2808   }
2809
2810   DecoderType type = DecoderFactory::GetDecoderType(mimeType.get());
2811   return type != DecoderType::UNKNOWN;
2812 }
2813
2814 NS_IMETHODIMP
2815 imgLoader::GetMIMETypeFromContent(nsIRequest* aRequest,
2816                                   const uint8_t* aContents, uint32_t aLength,
2817                                   nsACString& aContentType) {
2818   nsCOMPtr<nsIChannel> channel(do_QueryInterface(aRequest));
2819   if (channel) {
2820     nsCOMPtr<nsILoadInfo> loadInfo = channel->LoadInfo();
2821     if (loadInfo->GetSkipContentSniffing()) {
2822       return NS_ERROR_NOT_AVAILABLE;
2823     }
2824   }
2825
2826   nsresult rv =
2827       GetMimeTypeFromContent((const char*)aContents, aLength, aContentType);
2828   if (NS_SUCCEEDED(rv) && channel && XRE_IsParentProcess()) {
2829     if (RefPtr<mozilla::net::nsHttpChannel> httpChannel =
2830             do_QueryObject(channel)) {
2831       // If the image type pattern matching algorithm given bytes does not
2832       // return undefined, then disable the further check and allow the
2833       // response.
2834       httpChannel->DisableIsOpaqueResponseAllowedAfterSniffCheck(
2835           mozilla::net::nsHttpChannel::SnifferType::Image);
2836     }
2837   }
2838
2839   return rv;
2840 }
2841
2842 /* static */
2843 nsresult imgLoader::GetMimeTypeFromContent(const char* aContents,
2844                                            uint32_t aLength,
2845                                            nsACString& aContentType) {
2846   nsAutoCString detected;
2847
2848   /* Is it a GIF? */
2849   if (aLength >= 6 &&
2850       (!strncmp(aContents, "GIF87a", 6) || !strncmp(aContents, "GIF89a", 6))) {
2851     aContentType.AssignLiteral(IMAGE_GIF);
2852
2853     /* or a PNG? */
2854   } else if (aLength >= 8 && ((unsigned char)aContents[0] == 0x89 &&
2855                               (unsigned char)aContents[1] == 0x50 &&
2856                               (unsigned char)aContents[2] == 0x4E &&
2857                               (unsigned char)aContents[3] == 0x47 &&
2858                               (unsigned char)aContents[4] == 0x0D &&
2859                               (unsigned char)aContents[5] == 0x0A &&
2860                               (unsigned char)aContents[6] == 0x1A &&
2861                               (unsigned char)aContents[7] == 0x0A)) {
2862     aContentType.AssignLiteral(IMAGE_PNG);
2863
2864     /* maybe a JPEG (JFIF)? */
2865     /* JFIF files start with SOI APP0 but older files can start with SOI DQT
2866      * so we test for SOI followed by any marker, i.e. FF D8 FF
2867      * this will also work for SPIFF JPEG files if they appear in the future.
2868      *
2869      * (JFIF is 0XFF 0XD8 0XFF 0XE0 <skip 2> 0X4A 0X46 0X49 0X46 0X00)
2870      */
2871   } else if (aLength >= 3 && ((unsigned char)aContents[0]) == 0xFF &&
2872              ((unsigned char)aContents[1]) == 0xD8 &&
2873              ((unsigned char)aContents[2]) == 0xFF) {
2874     aContentType.AssignLiteral(IMAGE_JPEG);
2875
2876     /* or how about ART? */
2877     /* ART begins with JG (4A 47). Major version offset 2.
2878      * Minor version offset 3. Offset 4 must be nullptr.
2879      */
2880   } else if (aLength >= 5 && ((unsigned char)aContents[0]) == 0x4a &&
2881              ((unsigned char)aContents[1]) == 0x47 &&
2882              ((unsigned char)aContents[4]) == 0x00) {
2883     aContentType.AssignLiteral(IMAGE_ART);
2884
2885   } else if (aLength >= 2 && !strncmp(aContents, "BM", 2)) {
2886     aContentType.AssignLiteral(IMAGE_BMP);
2887
2888     // ICOs always begin with a 2-byte 0 followed by a 2-byte 1.
2889     // CURs begin with 2-byte 0 followed by 2-byte 2.
2890   } else if (aLength >= 4 && (!memcmp(aContents, "\000\000\001\000", 4) ||
2891                               !memcmp(aContents, "\000\000\002\000", 4))) {
2892     aContentType.AssignLiteral(IMAGE_ICO);
2893
2894     // WebPs always begin with RIFF, a 32-bit length, and WEBP.
2895   } else if (aLength >= 12 && !memcmp(aContents, "RIFF", 4) &&
2896              !memcmp(aContents + 8, "WEBP", 4)) {
2897     aContentType.AssignLiteral(IMAGE_WEBP);
2898
2899   } else if (MatchesMP4(reinterpret_cast<const uint8_t*>(aContents), aLength,
2900                         detected) &&
2901              detected.Equals(IMAGE_AVIF)) {
2902     aContentType.AssignLiteral(IMAGE_AVIF);
2903   } else if ((aLength >= 2 && !memcmp(aContents, "\xFF\x0A", 2)) ||
2904              (aLength >= 12 &&
2905               !memcmp(aContents, "\x00\x00\x00\x0CJXL \x0D\x0A\x87\x0A", 12))) {
2906     // Each version is for containerless and containerful files respectively.
2907     aContentType.AssignLiteral(IMAGE_JXL);
2908   } else {
2909     /* none of the above?  I give up */
2910     return NS_ERROR_NOT_AVAILABLE;
2911   }
2912
2913   return NS_OK;
2914 }
2915
2916 /**
2917  * proxy stream listener class used to handle multipart/x-mixed-replace
2918  */
2919
2920 #include "nsIRequest.h"
2921 #include "nsIStreamConverterService.h"
2922
2923 NS_IMPL_ISUPPORTS(ProxyListener, nsIStreamListener,
2924                   nsIThreadRetargetableStreamListener, nsIRequestObserver)
2925
2926 ProxyListener::ProxyListener(nsIStreamListener* dest) : mDestListener(dest) {}
2927
2928 ProxyListener::~ProxyListener() = default;
2929
2930 /** nsIRequestObserver methods **/
2931
2932 NS_IMETHODIMP
2933 ProxyListener::OnStartRequest(nsIRequest* aRequest) {
2934   if (!mDestListener) {
2935     return NS_ERROR_FAILURE;
2936   }
2937
2938   nsCOMPtr<nsIChannel> channel(do_QueryInterface(aRequest));
2939   if (channel) {
2940     // We need to set the initiator type for the image load
2941     nsCOMPtr<nsITimedChannel> timedChannel = do_QueryInterface(channel);
2942     if (timedChannel) {
2943       nsAutoString type;
2944       timedChannel->GetInitiatorType(type);
2945       if (type.IsEmpty()) {
2946         timedChannel->SetInitiatorType(u"img"_ns);
2947       }
2948     }
2949
2950     nsAutoCString contentType;
2951     nsresult rv = channel->GetContentType(contentType);
2952
2953     if (!contentType.IsEmpty()) {
2954       /* If multipart/x-mixed-replace content, we'll insert a MIME decoder
2955          in the pipeline to handle the content and pass it along to our
2956          original listener.
2957        */
2958       if ("multipart/x-mixed-replace"_ns.Equals(contentType)) {
2959         nsCOMPtr<nsIStreamConverterService> convServ(
2960             do_GetService("@mozilla.org/streamConverters;1", &rv));
2961         if (NS_SUCCEEDED(rv)) {
2962           nsCOMPtr<nsIStreamListener> toListener(mDestListener);
2963           nsCOMPtr<nsIStreamListener> fromListener;
2964
2965           rv = convServ->AsyncConvertData("multipart/x-mixed-replace", "*/*",
2966                                           toListener, nullptr,
2967                                           getter_AddRefs(fromListener));
2968           if (NS_SUCCEEDED(rv)) {
2969             mDestListener = fromListener;
2970           }
2971         }
2972       }
2973     }
2974   }
2975
2976   return mDestListener->OnStartRequest(aRequest);
2977 }
2978
2979 NS_IMETHODIMP
2980 ProxyListener::OnStopRequest(nsIRequest* aRequest, nsresult status) {
2981   if (!mDestListener) {
2982     return NS_ERROR_FAILURE;
2983   }
2984
2985   return mDestListener->OnStopRequest(aRequest, status);
2986 }
2987
2988 /** nsIStreamListener methods **/
2989
2990 NS_IMETHODIMP
2991 ProxyListener::OnDataAvailable(nsIRequest* aRequest, nsIInputStream* inStr,
2992                                uint64_t sourceOffset, uint32_t count) {
2993   if (!mDestListener) {
2994     return NS_ERROR_FAILURE;
2995   }
2996
2997   return mDestListener->OnDataAvailable(aRequest, inStr, sourceOffset, count);
2998 }
2999
3000 NS_IMETHODIMP
3001 ProxyListener::OnDataFinished(nsresult aStatus) {
3002   if (!mDestListener) {
3003     return NS_ERROR_FAILURE;
3004   }
3005   nsCOMPtr<nsIThreadRetargetableStreamListener> retargetableListener =
3006       do_QueryInterface(mDestListener);
3007   if (retargetableListener) {
3008     return retargetableListener->OnDataFinished(aStatus);
3009   }
3010
3011   return NS_OK;
3012 }
3013
3014 /** nsThreadRetargetableStreamListener methods **/
3015 NS_IMETHODIMP
3016 ProxyListener::CheckListenerChain() {
3017   NS_ASSERTION(NS_IsMainThread(), "Should be on the main thread!");
3018   nsresult rv = NS_OK;
3019   nsCOMPtr<nsIThreadRetargetableStreamListener> retargetableListener =
3020       do_QueryInterface(mDestListener, &rv);
3021   if (retargetableListener) {
3022     rv = retargetableListener->CheckListenerChain();
3023   }
3024   MOZ_LOG(
3025       gImgLog, LogLevel::Debug,
3026       ("ProxyListener::CheckListenerChain %s [this=%p listener=%p rv=%" PRIx32
3027        "]",
3028        (NS_SUCCEEDED(rv) ? "success" : "failure"), this,
3029        (nsIStreamListener*)mDestListener, static_cast<uint32_t>(rv)));
3030   return rv;
3031 }
3032
3033 /**
3034  * http validate class.  check a channel for a 304
3035  */
3036
3037 NS_IMPL_ISUPPORTS(imgCacheValidator, nsIStreamListener, nsIRequestObserver,
3038                   nsIThreadRetargetableStreamListener, nsIChannelEventSink,
3039                   nsIInterfaceRequestor, nsIAsyncVerifyRedirectCallback)
3040
3041 imgCacheValidator::imgCacheValidator(nsProgressNotificationProxy* progress,
3042                                      imgLoader* loader, imgRequest* request,
3043                                      Document* aDocument,
3044                                      uint64_t aInnerWindowId,
3045                                      bool forcePrincipalCheckForCacheEntry)
3046     : mProgressProxy(progress),
3047       mRequest(request),
3048       mDocument(aDocument),
3049       mInnerWindowId(aInnerWindowId),
3050       mImgLoader(loader),
3051       mHadInsecureRedirect(false) {
3052   NewRequestAndEntry(forcePrincipalCheckForCacheEntry, loader,
3053                      mRequest->CacheKey(), getter_AddRefs(mNewRequest),
3054                      getter_AddRefs(mNewEntry));
3055 }
3056
3057 imgCacheValidator::~imgCacheValidator() {
3058   if (mRequest) {
3059     // If something went wrong, and we never unblocked the requests waiting on
3060     // validation, now is our last chance. We will cancel the new request and
3061     // switch the waiting proxies to it.
3062     UpdateProxies(/* aCancelRequest */ true, /* aSyncNotify */ false);
3063   }
3064 }
3065
3066 void imgCacheValidator::AddProxy(imgRequestProxy* aProxy) {
3067   // aProxy needs to be in the loadgroup since we're validating from
3068   // the network.
3069   aProxy->AddToLoadGroup();
3070
3071   mProxies.AppendElement(aProxy);
3072 }
3073
3074 void imgCacheValidator::RemoveProxy(imgRequestProxy* aProxy) {
3075   mProxies.RemoveElement(aProxy);
3076 }
3077
3078 void imgCacheValidator::UpdateProxies(bool aCancelRequest, bool aSyncNotify) {
3079   MOZ_ASSERT(mRequest);
3080
3081   // Clear the validator before updating the proxies. The notifications may
3082   // clone an existing request, and its state could be inconsistent.
3083   mRequest->SetValidator(nullptr);
3084   mRequest = nullptr;
3085
3086   // If an error occurred, we will want to cancel the new request, and make the
3087   // validating proxies point to it. Any proxies still bound to the original
3088   // request which are not validating should remain untouched.
3089   if (aCancelRequest) {
3090     MOZ_ASSERT(mNewRequest);
3091     mNewRequest->CancelAndAbort(NS_BINDING_ABORTED);
3092   }
3093
3094   // We have finished validating the request, so we can safely take ownership
3095   // of the proxy list. imgRequestProxy::SyncNotifyListener can mutate the list
3096   // if imgRequestProxy::CancelAndForgetObserver is called by its owner. Note
3097   // that any potential notifications should still be suppressed in
3098   // imgRequestProxy::ChangeOwner because we haven't cleared the validating
3099   // flag yet, and thus they will remain deferred.
3100   AutoTArray<RefPtr<imgRequestProxy>, 4> proxies(std::move(mProxies));
3101
3102   for (auto& proxy : proxies) {
3103     // First update the state of all proxies before notifying any of them
3104     // to ensure a consistent state (e.g. in case the notification causes
3105     // other proxies to be touched indirectly.)
3106     MOZ_ASSERT(proxy->IsValidating());
3107     MOZ_ASSERT(proxy->NotificationsDeferred(),
3108                "Proxies waiting on cache validation should be "
3109                "deferring notifications!");
3110     if (mNewRequest) {
3111       proxy->ChangeOwner(mNewRequest);
3112     }
3113     proxy->ClearValidating();
3114   }
3115
3116   mNewRequest = nullptr;
3117   mNewEntry = nullptr;
3118
3119   for (auto& proxy : proxies) {
3120     if (aSyncNotify) {
3121       // Notify synchronously, because the caller knows we are already in an
3122       // asynchronously-called function (e.g. OnStartRequest).
3123       proxy->SyncNotifyListener();
3124     } else {
3125       // Notify asynchronously, because the caller does not know our current
3126       // call state (e.g. ~imgCacheValidator).
3127       proxy->NotifyListener();
3128     }
3129   }
3130 }
3131
3132 /** nsIRequestObserver methods **/
3133
3134 NS_IMETHODIMP
3135 imgCacheValidator::OnStartRequest(nsIRequest* aRequest) {
3136   // We may be holding on to a document, so ensure that it's released.
3137   RefPtr<Document> document = mDocument.forget();
3138
3139   // If for some reason we don't still have an existing request (probably
3140   // because OnStartRequest got delivered more than once), just bail.
3141   if (!mRequest) {
3142     MOZ_ASSERT_UNREACHABLE("OnStartRequest delivered more than once?");
3143     aRequest->CancelWithReason(NS_BINDING_ABORTED,
3144                                "OnStartRequest delivered more than once?"_ns);
3145     return NS_ERROR_FAILURE;
3146   }
3147
3148   // If this request is coming from cache and has the same URI as our
3149   // imgRequest, the request all our proxies are pointing at is valid, and all
3150   // we have to do is tell them to notify their listeners.
3151   nsCOMPtr<nsICacheInfoChannel> cacheChan(do_QueryInterface(aRequest));
3152   nsCOMPtr<nsIChannel> channel(do_QueryInterface(aRequest));
3153   if (cacheChan && channel) {
3154     bool isFromCache = false;
3155     cacheChan->IsFromCache(&isFromCache);
3156
3157     nsCOMPtr<nsIURI> channelURI;
3158     channel->GetURI(getter_AddRefs(channelURI));
3159
3160     nsCOMPtr<nsIURI> finalURI;
3161     mRequest->GetFinalURI(getter_AddRefs(finalURI));
3162
3163     bool sameURI = false;
3164     if (channelURI && finalURI) {
3165       channelURI->Equals(finalURI, &sameURI);
3166     }
3167
3168     if (isFromCache && sameURI) {
3169       // We don't need to load this any more.
3170       aRequest->CancelWithReason(NS_BINDING_ABORTED,
3171                                  "imgCacheValidator::OnStartRequest"_ns);
3172       mNewRequest = nullptr;
3173
3174       // Clear the validator before updating the proxies. The notifications may
3175       // clone an existing request, and its state could be inconsistent.
3176       mRequest->SetLoadId(document);
3177       mRequest->SetInnerWindowID(mInnerWindowId);
3178       UpdateProxies(/* aCancelRequest */ false, /* aSyncNotify */ true);
3179       return NS_OK;
3180     }
3181   }
3182
3183   // We can't load out of cache. We have to create a whole new request for the
3184   // data that's coming in off the channel.
3185   nsCOMPtr<nsIURI> uri;
3186   mRequest->GetURI(getter_AddRefs(uri));
3187
3188   LOG_MSG_WITH_PARAM(gImgLog,
3189                      "imgCacheValidator::OnStartRequest creating new request",
3190                      "uri", uri);
3191
3192   CORSMode corsmode = mRequest->GetCORSMode();
3193   nsCOMPtr<nsIReferrerInfo> referrerInfo = mRequest->GetReferrerInfo();
3194   nsCOMPtr<nsIPrincipal> triggeringPrincipal =
3195       mRequest->GetTriggeringPrincipal();
3196
3197   // Doom the old request's cache entry
3198   mRequest->RemoveFromCache();
3199
3200   // We use originalURI here to fulfil the imgIRequest contract on GetURI.
3201   nsCOMPtr<nsIURI> originalURI;
3202   channel->GetOriginalURI(getter_AddRefs(originalURI));
3203   nsresult rv = mNewRequest->Init(originalURI, uri, mHadInsecureRedirect,
3204                                   aRequest, channel, mNewEntry, document,
3205                                   triggeringPrincipal, corsmode, referrerInfo);
3206   if (NS_FAILED(rv)) {
3207     UpdateProxies(/* aCancelRequest */ true, /* aSyncNotify */ true);
3208     return rv;
3209   }
3210
3211   mDestListener = new ProxyListener(mNewRequest);
3212
3213   // Try to add the new request into the cache. Note that the entry must be in
3214   // the cache before the proxies' ownership changes, because adding a proxy
3215   // changes the caching behaviour for imgRequests.
3216   mImgLoader->PutIntoCache(mNewRequest->CacheKey(), mNewEntry);
3217   UpdateProxies(/* aCancelRequest */ false, /* aSyncNotify */ true);
3218   return mDestListener->OnStartRequest(aRequest);
3219 }
3220
3221 NS_IMETHODIMP
3222 imgCacheValidator::OnStopRequest(nsIRequest* aRequest, nsresult status) {
3223   // Be sure we've released the document that we may have been holding on to.
3224   mDocument = nullptr;
3225
3226   if (!mDestListener) {
3227     return NS_OK;
3228   }
3229
3230   return mDestListener->OnStopRequest(aRequest, status);
3231 }
3232
3233 /** nsIStreamListener methods **/
3234
3235 NS_IMETHODIMP
3236 imgCacheValidator::OnDataAvailable(nsIRequest* aRequest, nsIInputStream* inStr,
3237                                    uint64_t sourceOffset, uint32_t count) {
3238   if (!mDestListener) {
3239     // XXX see bug 113959
3240     uint32_t _retval;
3241     inStr->ReadSegments(NS_DiscardSegment, nullptr, count, &_retval);
3242     return NS_OK;
3243   }
3244
3245   return mDestListener->OnDataAvailable(aRequest, inStr, sourceOffset, count);
3246 }
3247
3248 NS_IMETHODIMP
3249 imgCacheValidator::OnDataFinished(nsresult aStatus) {
3250   if (!mDestListener) {
3251     return NS_ERROR_FAILURE;
3252   }
3253   nsCOMPtr<nsIThreadRetargetableStreamListener> retargetableListener =
3254       do_QueryInterface(mDestListener);
3255   if (retargetableListener) {
3256     return retargetableListener->OnDataFinished(aStatus);
3257   }
3258
3259   return NS_OK;
3260 }
3261
3262 /** nsIThreadRetargetableStreamListener methods **/
3263
3264 NS_IMETHODIMP
3265 imgCacheValidator::CheckListenerChain() {
3266   NS_ASSERTION(NS_IsMainThread(), "Should be on the main thread!");
3267   nsresult rv = NS_OK;
3268   nsCOMPtr<nsIThreadRetargetableStreamListener> retargetableListener =
3269       do_QueryInterface(mDestListener, &rv);
3270   if (retargetableListener) {
3271     rv = retargetableListener->CheckListenerChain();
3272   }
3273   MOZ_LOG(
3274       gImgLog, LogLevel::Debug,
3275       ("[this=%p] imgCacheValidator::CheckListenerChain -- rv %" PRId32 "=%s",
3276        this, static_cast<uint32_t>(rv),
3277        NS_SUCCEEDED(rv) ? "succeeded" : "failed"));
3278   return rv;
3279 }
3280
3281 /** nsIInterfaceRequestor methods **/
3282
3283 NS_IMETHODIMP
3284 imgCacheValidator::GetInterface(const nsIID& aIID, void** aResult) {
3285   if (aIID.Equals(NS_GET_IID(nsIChannelEventSink))) {
3286     return QueryInterface(aIID, aResult);
3287   }
3288
3289   return mProgressProxy->GetInterface(aIID, aResult);
3290 }
3291
3292 // These functions are materially the same as the same functions in imgRequest.
3293 // We duplicate them because we're verifying whether cache loads are necessary,
3294 // not unconditionally loading.
3295
3296 /** nsIChannelEventSink methods **/
3297 NS_IMETHODIMP
3298 imgCacheValidator::AsyncOnChannelRedirect(
3299     nsIChannel* oldChannel, nsIChannel* newChannel, uint32_t flags,
3300     nsIAsyncVerifyRedirectCallback* callback) {
3301   // Note all cache information we get from the old channel.
3302   mNewRequest->SetCacheValidation(mNewEntry, oldChannel);
3303
3304   // If the previous URI is a non-HTTPS URI, record that fact for later use by
3305   // security code, which needs to know whether there is an insecure load at any
3306   // point in the redirect chain.
3307   nsCOMPtr<nsIURI> oldURI;
3308   bool schemeLocal = false;
3309   if (NS_FAILED(oldChannel->GetURI(getter_AddRefs(oldURI))) ||
3310       NS_FAILED(NS_URIChainHasFlags(
3311           oldURI, nsIProtocolHandler::URI_IS_LOCAL_RESOURCE, &schemeLocal)) ||
3312       (!oldURI->SchemeIs("https") && !oldURI->SchemeIs("chrome") &&
3313        !schemeLocal)) {
3314     mHadInsecureRedirect = true;
3315   }
3316
3317   // Prepare for callback
3318   mRedirectCallback = callback;
3319   mRedirectChannel = newChannel;
3320
3321   return mProgressProxy->AsyncOnChannelRedirect(oldChannel, newChannel, flags,
3322                                                 this);
3323 }
3324
3325 NS_IMETHODIMP
3326 imgCacheValidator::OnRedirectVerifyCallback(nsresult aResult) {
3327   // If we've already been told to abort, just do so.
3328   if (NS_FAILED(aResult)) {
3329     mRedirectCallback->OnRedirectVerifyCallback(aResult);
3330     mRedirectCallback = nullptr;
3331     mRedirectChannel = nullptr;
3332     return NS_OK;
3333   }
3334
3335   // make sure we have a protocol that returns data rather than opens
3336   // an external application, e.g. mailto:
3337   nsCOMPtr<nsIURI> uri;
3338   mRedirectChannel->GetURI(getter_AddRefs(uri));
3339
3340   nsresult result = NS_OK;
3341
3342   if (nsContentUtils::IsExternalProtocol(uri)) {
3343     result = NS_ERROR_ABORT;
3344   }
3345
3346   mRedirectCallback->OnRedirectVerifyCallback(result);
3347   mRedirectCallback = nullptr;
3348   mRedirectChannel = nullptr;
3349   return NS_OK;
3350 }