Bug 1635094 - Cleanup the ReferrerInfo code. r=ckerschb

The cast in InitWithNode is wrong. AsElement() asserts instead of
checking the flag, so we always pass an element (and if we didn't we'd
have type confusion problems). I audited the callers and we're fine.

Anyhow, always require an element, and add two convenience constructors
for C++ code.

Differential Revision: https://phabricator.services.mozilla.com/D73636

browser/actors/ClickHandlerChild.jsm

@@ -75,7 +75,7 @@ class ClickHandlerChild extends JSWindowActorChild {
       Ci.nsIReferrerInfo
     );
     if (node) {
-      referrerInfo.initWithNode(node);
+      referrerInfo.initWithElement(node);
     } else {
       referrerInfo.initWithDocument(ownerDoc);
     }

browser/actors/ContextMenuChild.jsm

@@ -629,7 +629,7 @@ class ContextMenuChild extends JSWindowActorChild {
     let referrerInfo = Cc["@mozilla.org/referrer-info;1"].createInstance(
       Ci.nsIReferrerInfo
     );
-    referrerInfo.initWithNode(aEvent.composedTarget);
+    referrerInfo.initWithElement(aEvent.composedTarget);
     referrerInfo = E10SUtils.serializeReferrerInfo(referrerInfo);
 
     // In the case "onLink" we may have to send link referrerInfo to use in
@@ -639,7 +639,7 @@ class ContextMenuChild extends JSWindowActorChild {
       linkReferrerInfo = Cc["@mozilla.org/referrer-info;1"].createInstance(
         Ci.nsIReferrerInfo
       );
-      linkReferrerInfo.initWithNode(context.link);
+      linkReferrerInfo.initWithElement(context.link);
     }
 
     let target = context.target;

browser/base/content/browser.js

@@ -6854,7 +6854,7 @@ function handleLinkClick(event, href, linkNode) {
     Ci.nsIReferrerInfo
   );
   if (linkNode) {
-    referrerInfo.initWithNode(linkNode);
+    referrerInfo.initWithElement(linkNode);
   } else {
     referrerInfo.initWithDocument(doc);
   }

browser/components/shell/nsMacShellService.cpp

@@ -152,9 +152,7 @@ nsMacShellService::SetDesktopBackground(Element* aElement, int32_t aPosition,
     loadContext = do_QueryInterface(docShell);
   }
 
-  nsCOMPtr<nsIReferrerInfo> referrerInfo = new mozilla::dom::ReferrerInfo();
-  referrerInfo->InitWithNode(aElement);
-
+  auto referrerInfo = MakeRefPtr<mozilla::dom::ReferrerInfo>(*aElement);
   return wbp->SaveURI(imageURI, aElement->NodePrincipal(), 0, referrerInfo,
                       nullptr, nullptr, mBackgroundFile,
                       nsIContentPolicy::TYPE_IMAGE, loadContext);

docshell/base/nsDocShell.cpp

@@ -11996,7 +11996,6 @@ nsresult nsDocShell::OnLinkClickSync(
   // referrer, since the current URI in this docshell may be a
   // new document that we're in the process of loading.
   RefPtr<Document> referrerDoc = aContent->OwnerDoc();
-  NS_ENSURE_TRUE(referrerDoc, NS_ERROR_UNEXPECTED);
 
   // Now check that the referrerDoc's inner window is the current inner
   // window for mScriptGlobal.  If it's not, then we don't want to
@@ -12029,12 +12028,9 @@ nsresult nsDocShell::OnLinkClickSync(
   GetIsExecutingOnLoadHandler(&inOnLoadHandler);
   uint32_t loadType = inOnLoadHandler ? LOAD_NORMAL_REPLACE : LOAD_LINK;
 
-  nsCOMPtr<nsIReferrerInfo> referrerInfo = new ReferrerInfo();
-  if (isElementAnchorOrArea) {
-    referrerInfo->InitWithNode(aContent);
-  } else {
-    referrerInfo->InitWithDocument(referrerDoc);
-  }
+  nsCOMPtr<nsIReferrerInfo> referrerInfo =
+      isElementAnchorOrArea ? new ReferrerInfo(*aContent->AsElement())
+                            : new ReferrerInfo(*referrerDoc);
 
   RefPtr<nsDocShellLoadState> loadState = new nsDocShellLoadState(aURI);
   loadState->SetReferrerInfo(referrerInfo);

dom/base/Element.cpp

@@ -3698,15 +3698,15 @@ void Element::GetImplementedPseudoElement(nsAString& aPseudo) const {
   aPseudo.Append(pseudo);
 }
 
-ReferrerPolicy Element::GetReferrerPolicyAsEnum() {
+ReferrerPolicy Element::GetReferrerPolicyAsEnum() const {
   if (IsHTMLElement()) {
-    const nsAttrValue* referrerValue = GetParsedAttr(nsGkAtoms::referrerpolicy);
-    return ReferrerPolicyFromAttr(referrerValue);
+    return ReferrerPolicyFromAttr(GetParsedAttr(nsGkAtoms::referrerpolicy));
   }
   return ReferrerPolicy::_empty;
 }
 
-ReferrerPolicy Element::ReferrerPolicyFromAttr(const nsAttrValue* aValue) {
+ReferrerPolicy Element::ReferrerPolicyFromAttr(
+    const nsAttrValue* aValue) const {
   if (aValue && aValue->Type() == nsAttrValue::eEnum) {
     return ReferrerPolicy(aValue->GetEnumValue());
   }

dom/base/Element.h

@@ -1616,8 +1616,8 @@ class Element : public FragmentOrElement {
 
   void GetImplementedPseudoElement(nsAString&) const;
 
-  ReferrerPolicy GetReferrerPolicyAsEnum();
-  ReferrerPolicy ReferrerPolicyFromAttr(const nsAttrValue* aValue);
+  ReferrerPolicy GetReferrerPolicyAsEnum() const;
+  ReferrerPolicy ReferrerPolicyFromAttr(const nsAttrValue* aValue) const;
 
   /*
    * Helpers for .dataset.  This is implemented on Element, though only some

dom/base/EventSource.cpp

@@ -967,10 +967,9 @@ void EventSourceImpl::SetupHttpChannel() {
 nsresult EventSourceImpl::SetupReferrerInfo() {
   AssertIsOnMainThread();
   MOZ_ASSERT(!IsShutDown());
-  nsCOMPtr<Document> doc = mEventSource->GetDocumentIfCurrent();
-  if (doc) {
-    nsCOMPtr<nsIReferrerInfo> referrerInfo = new ReferrerInfo();
-    referrerInfo->InitWithDocument(doc);
+
+  if (nsCOMPtr<Document> doc = mEventSource->GetDocumentIfCurrent()) {
+    auto referrerInfo = MakeRefPtr<ReferrerInfo>(*doc);
     nsresult rv = mHttpChannel->SetReferrerInfoWithoutClone(referrerInfo);
     NS_ENSURE_SUCCESS(rv, rv);
   }

dom/base/Navigator.cpp

@@ -1179,8 +1179,7 @@ bool Navigator::SendBeaconInternal(const nsAString& aUrl,
     return false;
   }
 
-  nsCOMPtr<nsIReferrerInfo> referrerInfo = new ReferrerInfo();
-  referrerInfo->InitWithDocument(doc);
+  auto referrerInfo = MakeRefPtr<ReferrerInfo>(*doc);
   rv = httpChannel->SetReferrerInfoWithoutClone(referrerInfo);
   MOZ_ASSERT(NS_SUCCEEDED(rv));
 

dom/base/nsContentSink.cpp

@@ -786,10 +786,8 @@ void nsContentSink::PrefetchPreloadHref(const nsAString& aHref,
         }
       }
 
-      nsCOMPtr<nsIReferrerInfo> referrerInfo = new ReferrerInfo();
-      referrerInfo->InitWithDocument(mDocument);
-      referrerInfo = static_cast<ReferrerInfo*>(referrerInfo.get())
-                         ->CloneWithNewOriginalReferrer(mDocumentURI);
+      auto referrerInfo = MakeRefPtr<ReferrerInfo>(*mDocument);
+      referrerInfo = referrerInfo->CloneWithNewOriginalReferrer(mDocumentURI);
 
       if (preload) {
         prefetchService->PreloadURI(uri, referrerInfo, mDocument, policyType);

dom/base/nsFrameLoader.cpp

@@ -658,8 +658,7 @@ nsresult nsFrameLoader::ReallyStartLoadingInternal() {
     loadState->SetBaseURI(mOwnerContent->GetBaseURI());
   }
 
-  nsCOMPtr<nsIReferrerInfo> referrerInfo = new ReferrerInfo();
-  referrerInfo->InitWithNode(mOwnerContent);
+  auto referrerInfo = MakeRefPtr<ReferrerInfo>(*mOwnerContent);
   loadState->SetReferrerInfo(referrerInfo);
 
   // Default flags:

dom/base/nsImageLoadingContent.cpp

@@ -1145,22 +1145,17 @@ nsresult nsImageLoadingContent::LoadImage(nsIURI* aNewURI, bool aForce,
   //
   // We use the principal of aDocument to avoid having to QI |this| an extra
   // time. It should always be the same as the principal of this node.
-#ifdef DEBUG
-  nsIContent* thisContent = AsContent();
-  MOZ_ASSERT(thisContent->NodePrincipal() == aDocument->NodePrincipal(),
+  Element* element = AsContent()->AsElement();
+  MOZ_ASSERT(element->NodePrincipal() == aDocument->NodePrincipal(),
              "Principal mismatch?");
-#endif
 
   nsLoadFlags loadFlags =
       aLoadFlags | nsContentUtils::CORSModeToLoadImageFlags(GetCORSMode());
 
   RefPtr<imgRequestProxy>& req = PrepareNextRequest(aImageLoadType);
-  nsCOMPtr<nsIContent> content =
-      do_QueryInterface(static_cast<nsIImageLoadingContent*>(this));
-
   nsCOMPtr<nsIPrincipal> triggeringPrincipal;
   bool result = nsContentUtils::QueryTriggeringPrincipal(
-      content, aTriggeringPrincipal, getter_AddRefs(triggeringPrincipal));
+      element, aTriggeringPrincipal, getter_AddRefs(triggeringPrincipal));
 
   // If result is true, which means this node has specified
   // 'triggeringprincipal' attribute on it, so we use favicon as the policy
@@ -1169,14 +1164,10 @@ nsresult nsImageLoadingContent::LoadImage(nsIURI* aNewURI, bool aForce,
       result ? nsIContentPolicy::TYPE_INTERNAL_IMAGE_FAVICON
              : PolicyTypeForLoad(aImageLoadType);
 
-  nsCOMPtr<nsINode> thisNode =
-      do_QueryInterface(static_cast<nsIImageLoadingContent*>(this));
-  nsCOMPtr<nsIReferrerInfo> referrerInfo = new ReferrerInfo();
-  referrerInfo->InitWithNode(thisNode);
-
+  auto referrerInfo = MakeRefPtr<ReferrerInfo>(*element);
   nsresult rv = nsContentUtils::LoadImage(
-      aNewURI, thisNode, aDocument, triggeringPrincipal, 0, referrerInfo, this,
-      loadFlags, content->LocalName(), getter_AddRefs(req), policyType,
+      aNewURI, element, aDocument, triggeringPrincipal, 0, referrerInfo, this,
+      loadFlags, element->LocalName(), getter_AddRefs(req), policyType,
       mUseUrgentStartForChannel);
 
   // Reset the flag to avoid loading from XPCOM or somewhere again else without
@@ -1332,7 +1323,6 @@ void nsImageLoadingContent::UpdateImageState(bool aNotify) {
     }
   }
 
-  NS_ASSERTION(thisContent->IsElement(), "Not an element?");
   thisContent->AsElement()->UpdateState(aNotify);
 }
 

dom/base/nsObjectLoadingContent.cpp

@@ -2321,8 +2321,7 @@ nsresult nsObjectLoadingContent::OpenChannel() {
   // Referrer
   nsCOMPtr<nsIHttpChannel> httpChan(do_QueryInterface(chan));
   if (httpChan) {
-    nsCOMPtr<nsIReferrerInfo> referrerInfo = new ReferrerInfo();
-    referrerInfo->InitWithDocument(doc);
+    auto referrerInfo = MakeRefPtr<ReferrerInfo>(*doc);
 
     rv = httpChan->SetReferrerInfoWithoutClone(referrerInfo);
     MOZ_ASSERT(NS_SUCCEEDED(rv));

dom/clients/manager/ClientNavigateOpChild.cpp

@@ -247,12 +247,11 @@ RefPtr<ClientOpPromise> ClientNavigateOpChild::DoNavigate(
   }
 
   RefPtr<nsDocShellLoadState> loadState = new nsDocShellLoadState(url);
-  nsCOMPtr<nsIReferrerInfo> referrerInfo = new ReferrerInfo();
-  referrerInfo->InitWithDocument(doc);
   loadState->SetTriggeringPrincipal(principal);
 
   loadState->SetCsp(doc->GetCsp());
 
+  auto referrerInfo = MakeRefPtr<ReferrerInfo>(*doc);
   loadState->SetReferrerInfo(referrerInfo);
   loadState->SetLoadType(LOAD_STOP_CONTENT);
   loadState->SetSourceBrowsingContext(docShell->GetBrowsingContext());

dom/html/HTMLLinkElement.cpp

@@ -469,8 +469,6 @@ Maybe<nsStyleLinkElement::SheetInfo> HTMLLinkElement::GetStyleSheetInfo() {
 
   nsCOMPtr<nsIURI> uri = Link::GetURI();
   nsCOMPtr<nsIPrincipal> prin = mTriggeringPrincipal;
-  nsCOMPtr<nsIReferrerInfo> referrerInfo = new ReferrerInfo();
-  referrerInfo->InitWithNode(this);
 
   nsAutoString nonce;
   nsString* cspNonce = static_cast<nsString*>(GetProperty(nsGkAtoms::nonce));
@@ -483,7 +481,7 @@ Maybe<nsStyleLinkElement::SheetInfo> HTMLLinkElement::GetStyleSheetInfo() {
       this,
       uri.forget(),
       prin.forget(),
-      referrerInfo.forget(),
+      MakeAndAddRef<ReferrerInfo>(*this),
       GetCORSMode(),
       title,
       media,
@@ -619,8 +617,7 @@ void HTMLLinkElement::
           }
         }
 
-        nsCOMPtr<nsIReferrerInfo> referrerInfo = new ReferrerInfo();
-        referrerInfo->InitWithNode(this);
+        auto referrerInfo = MakeRefPtr<ReferrerInfo>(*this);
         if (preload) {
           prefetchService->PreloadURI(uri, referrerInfo, this, policyType);
         } else {
@@ -704,8 +701,7 @@ void HTMLLinkElement::UpdatePreload(nsAtom* aName, const nsAttrValue* aValue,
     if (corsMode != oldCorsMode) {
       prefetchService->CancelPrefetchPreloadURI(uri, this);
 
-      nsCOMPtr<nsIReferrerInfo> referrerInfo = new ReferrerInfo();
-      referrerInfo->InitWithNode(this);
+      auto referrerInfo = MakeRefPtr<ReferrerInfo>(*this);
       prefetchService->PreloadURI(uri, referrerInfo, this, policyType);
     }
     return;
@@ -762,8 +758,7 @@ void HTMLLinkElement::UpdatePreload(nsAtom* aName, const nsAttrValue* aValue,
   // trigger an error event.
   if ((policyType != oldPolicyType) ||
       (policyType == nsIContentPolicy::TYPE_INVALID)) {
-    nsCOMPtr<nsIReferrerInfo> referrerInfo = new ReferrerInfo();
-    referrerInfo->InitWithNode(this);
+    auto referrerInfo = MakeRefPtr<ReferrerInfo>(*this);
     prefetchService->PreloadURI(uri, referrerInfo, this, policyType);
   }
 }

dom/html/HTMLMediaElement.cpp

@@ -6668,9 +6668,11 @@ void HTMLMediaElement::SetRequestHeaders(nsIHttpChannel* aChannel) {
       NS_LITERAL_CSTRING("Accept-Encoding"), EmptyCString(), false);
   MOZ_ASSERT(NS_SUCCEEDED(rv));
 
-  // Set the Referer header
-  nsCOMPtr<nsIReferrerInfo> referrerInfo = new ReferrerInfo();
-  referrerInfo->InitWithDocument(OwnerDoc());
+  // Set the Referrer header
+  //
+  // FIXME: Shouldn't this use the Element constructor? Though I guess it
+  // doesn't matter as no HTMLMediaElement supports the referrerinfo attribute.
+  auto referrerInfo = MakeRefPtr<ReferrerInfo>(*OwnerDoc());
   rv = aChannel->SetReferrerInfoWithoutClone(referrerInfo);
   MOZ_ASSERT(NS_SUCCEEDED(rv));
 }

dom/html/HTMLStyleElement.cpp

@@ -172,15 +172,12 @@ Maybe<nsStyleLinkElement::SheetInfo> HTMLStyleElement::GetStyleSheetInfo() {
   nsAutoString media;
   GetTitleAndMediaForElement(*this, title, media);
 
-  nsCOMPtr<nsIReferrerInfo> referrerInfo = new ReferrerInfo();
-  referrerInfo->InitWithNode(this);
-
   return Some(SheetInfo{
       *OwnerDoc(),
       this,
       nullptr,
       do_AddRef(mTriggeringPrincipal),
-      referrerInfo.forget(),
+      MakeAndAddRef<ReferrerInfo>(*this),
       CORS_NONE,
       title,
       media,

dom/interfaces/security/nsIReferrerInfo.idl

@@ -11,7 +11,7 @@
 
 interface nsIURI;
 webidl Document;
-webidl Node;
+webidl Element;
 
 native ReferrerPolicy(mozilla::dom::ReferrerPolicy);
 native URIRef(already_AddRefed<nsIURI>);
@@ -132,7 +132,7 @@ interface nsIReferrerInfo : nsISerializable
    * Initialize with a given document.
    * @param aDocument the document to init referrerInfo object
    */
-  void initWithDocument(in Document aDocument);
+  void initWithDocument([const] in Document aDocument);
 
   /**
    * Initialize with a given node. It you are working with node which supports
@@ -141,6 +141,5 @@ interface nsIReferrerInfo : nsISerializable
    * from rel and attribute has a higher priority.
    * @param aNode the element to init referrerInfo object
    */
-  void initWithNode(in Node aNode);
-
+  void initWithElement([const] in Element aNode);
 };

dom/ipc/ContentChild.cpp

@@ -849,8 +849,7 @@ static nsresult GetCreateWindowParams(nsIOpenWindowInfo* aOpenWindowInfo,
   }
 
   if (!referrerInfo) {
-    referrerInfo = new ReferrerInfo();
-    referrerInfo->InitWithDocument(doc);
+    referrerInfo = new ReferrerInfo(*doc);
   }
 
   referrerInfo.swap(*aReferrerInfo);

dom/security/ReferrerInfo.cpp

@@ -4,6 +4,7 @@
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
+#include "mozilla/dom/ReferrerPolicyBinding.h"
 #include "nsIClassInfoImpl.h"
 #include "nsIEffectiveTLDService.h"
 #include "nsIHttpChannel.h"
@@ -787,8 +788,15 @@ ReferrerInfo::ReferrerInfo()
       mPolicy(ReferrerPolicy::_empty),
       mSendReferrer(true),
       mInitialized(false),
-      mOverridePolicyByDefault(false),
-      mComputedReferrer(Maybe<nsCString>()) {}
+      mOverridePolicyByDefault(false) {}
+
+ReferrerInfo::ReferrerInfo(const Document& aDoc) : ReferrerInfo() {
+  InitWithDocument(&aDoc);
+}
+
+ReferrerInfo::ReferrerInfo(const Element& aElement) : ReferrerInfo() {
+  InitWithElement(&aElement);
+}
 
 ReferrerInfo::ReferrerInfo(nsIURI* aOriginalReferrer,
                            ReferrerPolicyEnum aPolicy, bool aSendReferrer,
@@ -808,26 +816,26 @@ ReferrerInfo::ReferrerInfo(const ReferrerInfo& rhs)
       mOverridePolicyByDefault(rhs.mOverridePolicyByDefault),
       mComputedReferrer(rhs.mComputedReferrer) {}
 
-already_AddRefed<nsIReferrerInfo> ReferrerInfo::Clone() const {
+already_AddRefed<ReferrerInfo> ReferrerInfo::Clone() const {
   RefPtr<ReferrerInfo> copy(new ReferrerInfo(*this));
   return copy.forget();
 }
 
-already_AddRefed<nsIReferrerInfo> ReferrerInfo::CloneWithNewPolicy(
+already_AddRefed<ReferrerInfo> ReferrerInfo::CloneWithNewPolicy(
     ReferrerPolicyEnum aPolicy) const {
   RefPtr<ReferrerInfo> copy(new ReferrerInfo(*this));
   copy->mPolicy = aPolicy;
   return copy.forget();
 }
 
-already_AddRefed<nsIReferrerInfo> ReferrerInfo::CloneWithNewSendReferrer(
+already_AddRefed<ReferrerInfo> ReferrerInfo::CloneWithNewSendReferrer(
     bool aSendReferrer) const {
   RefPtr<ReferrerInfo> copy(new ReferrerInfo(*this));
   copy->mSendReferrer = aSendReferrer;
   return copy.forget();
 }
 
-already_AddRefed<nsIReferrerInfo> ReferrerInfo::CloneWithNewOriginalReferrer(
+already_AddRefed<ReferrerInfo> ReferrerInfo::CloneWithNewOriginalReferrer(
     nsIURI* aOriginalReferrer) const {
   RefPtr<ReferrerInfo> copy(new ReferrerInfo(*this));
   copy->mOriginalReferrer = aOriginalReferrer;
@@ -952,7 +960,7 @@ ReferrerInfo::Init(nsIReferrerInfo::ReferrerPolicyIDL aReferrerPolicy,
 }
 
 NS_IMETHODIMP
-ReferrerInfo::InitWithDocument(Document* aDocument) {
+ReferrerInfo::InitWithDocument(const Document* aDocument) {
   MOZ_ASSERT(!mInitialized);
   if (mInitialized) {
     return NS_ERROR_ALREADY_INITIALIZED;
@@ -965,8 +973,43 @@ ReferrerInfo::InitWithDocument(Document* aDocument) {
   return NS_OK;
 }
 
+/**
+ * Check whether the given node has referrerpolicy attribute and parse
+ * referrer policy from the attribute.
+ * Currently, referrerpolicy attribute is supported in a, area, img, iframe,
+ * script, or link element.
+ */
+static ReferrerPolicy ReferrerPolicyFromAttribute(const Element& aElement) {
+  if (!aElement.IsAnyOfHTMLElements(nsGkAtoms::a, nsGkAtoms::area,
+                                    nsGkAtoms::script, nsGkAtoms::iframe,
+                                    nsGkAtoms::link, nsGkAtoms::img)) {
+    return ReferrerPolicy::_empty;
+  }
+  return aElement.GetReferrerPolicyAsEnum();
+}
+
+static bool HasRelNoReferrer(const Element& aElement) {
+  // rel=noreferrer is only support in <a> and <area>
+  if (!aElement.IsAnyOfHTMLElements(nsGkAtoms::a, nsGkAtoms::area)) {
+    return false;
+  }
+
+  nsAutoString rel;
+  aElement.GetAttr(nsGkAtoms::rel, rel);
+  nsWhitespaceTokenizerTemplate<nsContentUtils::IsHTMLWhitespace> tok(rel);
+
+  while (tok.hasMoreTokens()) {
+    const nsAString& token = tok.nextToken();
+    if (token.LowerCaseEqualsLiteral("noreferrer")) {
+      return true;
+    }
+  }
+
+  return false;
+}
+
 NS_IMETHODIMP
-ReferrerInfo::InitWithNode(nsINode* aNode) {
+ReferrerInfo::InitWithElement(const Element* aElement) {
   MOZ_ASSERT(!mInitialized);
   if (mInitialized) {
     return NS_ERROR_ALREADY_INITIALIZED;
@@ -974,15 +1017,15 @@ ReferrerInfo::InitWithNode(nsINode* aNode) {
 
   // Referrer policy from referrerpolicy attribute will have a higher priority
   // than referrer policy from <meta> tag and Referrer-Policy header.
-  GetReferrerPolicyFromAtribute(aNode, mPolicy);
+  mPolicy = ReferrerPolicyFromAttribute(*aElement);
   if (mPolicy == ReferrerPolicy::_empty) {
     // Fallback to use document's referrer poicy if we don't have referrer
     // policy from attribute.
-    mPolicy = aNode->OwnerDoc()->GetReferrerPolicy();
+    mPolicy = aElement->OwnerDoc()->GetReferrerPolicy();
   }
 
-  mSendReferrer = !HasRelNoReferrer(aNode);
-  mOriginalReferrer = aNode->OwnerDoc()->GetDocumentURIAsReferrer();
+  mSendReferrer = !HasRelNoReferrer(*aElement);
+  mOriginalReferrer = aElement->OwnerDoc()->GetDocumentURIAsReferrer();
 
   mInitialized = true;
   return NS_OK;
@@ -1095,43 +1138,6 @@ already_AddRefed<nsIReferrerInfo> ReferrerInfo::CreateForSVGResources(
   return referrerInfo.forget();
 }
 
-void ReferrerInfo::GetReferrerPolicyFromAtribute(
-    nsINode* aNode, ReferrerPolicyEnum& aPolicy) const {
-  aPolicy = ReferrerPolicy::_empty;
-  mozilla::dom::Element* element = aNode->AsElement();
-
-  if (!element || !element->IsAnyOfHTMLElements(
-                      nsGkAtoms::a, nsGkAtoms::area, nsGkAtoms::script,
-                      nsGkAtoms::iframe, nsGkAtoms::link, nsGkAtoms::img)) {
-    return;
-  }
-
-  aPolicy = element->GetReferrerPolicyAsEnum();
-}
-
-bool ReferrerInfo::HasRelNoReferrer(nsINode* aNode) const {
-  mozilla::dom::Element* element = aNode->AsElement();
-
-  // rel=noreferrer is only support in <a> and <area>
-  if (!element ||
-      !element->IsAnyOfHTMLElements(nsGkAtoms::a, nsGkAtoms::area)) {
-    return false;
-  }
-
-  nsAutoString rel;
-  element->GetAttr(kNameSpaceID_None, nsGkAtoms::rel, rel);
-  nsWhitespaceTokenizerTemplate<nsContentUtils::IsHTMLWhitespace> tok(rel);
-
-  while (tok.hasMoreTokens()) {
-    const nsAString& token = tok.nextToken();
-    if (token.LowerCaseEqualsLiteral("noreferrer")) {
-      return true;
-    }
-  }
-
-  return false;
-}
-
 nsresult ReferrerInfo::ComputeReferrer(nsIHttpChannel* aChannel) {
   NS_ENSURE_ARG(aChannel);
   MOZ_ASSERT(NS_IsMainThread());

dom/security/ReferrerInfo.h

@@ -70,19 +70,23 @@ class ReferrerInfo : public nsIReferrerInfo {
       bool aSendReferrer = true,
       const Maybe<nsCString>& aComputedReferrer = Maybe<nsCString>());
 
+  // Creates already initialized ReferrerInfo from an element or a document.
+  explicit ReferrerInfo(const Element&);
+  explicit ReferrerInfo(const Document&);
+
   // create an exact copy of the ReferrerInfo
-  already_AddRefed<nsIReferrerInfo> Clone() const;
+  already_AddRefed<ReferrerInfo> Clone() const;
 
   // create an copy of the ReferrerInfo with new referrer policy
-  already_AddRefed<nsIReferrerInfo> CloneWithNewPolicy(
+  already_AddRefed<ReferrerInfo> CloneWithNewPolicy(
       ReferrerPolicyEnum aPolicy) const;
 
   // create an copy of the ReferrerInfo with new send referrer
-  already_AddRefed<nsIReferrerInfo> CloneWithNewSendReferrer(
+  already_AddRefed<ReferrerInfo> CloneWithNewSendReferrer(
       bool aSendReferrer) const;
 
   // create an copy of the ReferrerInfo with new original referrer
-  already_AddRefed<nsIReferrerInfo> CloneWithNewOriginalReferrer(
+  already_AddRefed<ReferrerInfo> CloneWithNewOriginalReferrer(
       nsIURI* aOriginalReferrer) const;
 
   /*
@@ -313,20 +317,6 @@ class ReferrerInfo : public nsIReferrerInfo {
     ePolicySendWhenSameHost = 2,
   };
 
-  /**
-   * Check whether the given node has referrerpolicy attribute and parse
-   * referrer policy from the attribute.
-   * Currently, referrerpolicy attribute is supported in a, area, img, iframe,
-   * script, or link element.
-   */
-  void GetReferrerPolicyFromAtribute(nsINode* aNode,
-                                     ReferrerPolicyEnum& aPolicy) const;
-
-  /**
-   * Return true if node has a rel="noreferrer" attribute.
-   */
-  bool HasRelNoReferrer(nsINode* aNode) const;
-
   /*
    * Handle user controlled pref network.http.referer.XOriginPolicy
    */

dom/svg/SVGStyleElement.cpp

@@ -6,6 +6,7 @@
 
 #include "mozilla/dom/SVGStyleElement.h"
 
+#include "mozilla/RefPtr.h"
 #include "mozilla/dom/Element.h"
 #include "mozilla/dom/SVGStyleElementBinding.h"
 #include "nsCOMPtr.h"
@@ -179,8 +180,6 @@ Maybe<nsStyleLinkElement::SheetInfo> SVGStyleElement::GetStyleSheetInfo() {
   nsAutoString title;
   nsAutoString media;
   GetTitleAndMediaForElement(*this, title, media);
-  nsCOMPtr<nsIReferrerInfo> referrerInfo = new ReferrerInfo();
-  referrerInfo->InitWithNode(this);
 
   return Some(SheetInfo{
       *OwnerDoc(),
@@ -191,7 +190,7 @@ Maybe<nsStyleLinkElement::SheetInfo> SVGStyleElement::GetStyleSheetInfo() {
       nullptr,
       // FIXME(bug 1459822): Why does this need a crossorigin attribute, but
       // HTMLStyleElement doesn't?
-      referrerInfo.forget(),
+      MakeAndAddRef<ReferrerInfo>(*this),
       AttrValueToCORSMode(GetParsedAttr(nsGkAtoms::crossorigin)),
       title,
       media,

dom/svg/SVGUseElement.cpp

@@ -358,9 +358,7 @@ void SVGUseElement::UpdateShadowTree() {
 
   // Bug 1415044 the specs do not say which referrer information we should use.
   // This may change if there's any spec comes out.
-  nsCOMPtr<nsIReferrerInfo> referrerInfo = new mozilla::dom::ReferrerInfo();
-  referrerInfo->InitWithNode(this);
-
+  auto referrerInfo = MakeRefPtr<ReferrerInfo>(*this);
   mContentURLData = new URLExtraData(baseURI.forget(), referrerInfo.forget(),
                                      do_AddRef(NodePrincipal()));
 

dom/xml/XMLStylesheetProcessingInstruction.cpp

@@ -125,15 +125,13 @@ XMLStylesheetProcessingInstruction::GetStyleSheetInfo() {
   auto encoding = doc->GetDocumentCharacterSet();
   nsCOMPtr<nsIURI> uri;
   NS_NewURI(getter_AddRefs(uri), href, encoding, baseURL);
-  nsCOMPtr<nsIReferrerInfo> referrerInfo = new ReferrerInfo();
-  referrerInfo->InitWithDocument(doc);
 
   return Some(SheetInfo{
       *doc,
       this,
       uri.forget(),
       nullptr,
-      referrerInfo.forget(),
+      MakeAndAddRef<ReferrerInfo>(*doc),
       CORS_NONE,
       title,
       media,

layout/xul/nsImageBoxFrame.cpp

@@ -250,9 +250,7 @@ void nsImageBoxFrame::UpdateImage() {
     nsContentUtils::NewURIWithDocumentCharset(getter_AddRefs(uri), src, doc,
                                               mContent->GetBaseURI());
     if (uri) {
-      nsCOMPtr<nsIReferrerInfo> referrerInfo = new ReferrerInfo();
-      referrerInfo->InitWithNode(mContent);
-
+      auto referrerInfo = MakeRefPtr<ReferrerInfo>(*mContent->AsElement());
       nsresult rv = nsContentUtils::LoadImage(
           uri, mContent, doc, triggeringPrincipal, requestContextID,
           referrerInfo, mListener, mLoadFlags, EmptyString(),

layout/xul/tree/nsTreeBodyFrame.cpp

@@ -1918,8 +1918,7 @@ nsresult nsTreeBodyFrame::GetImage(int32_t aRowIndex, nsTreeColumn* aCol,
           getter_AddRefs(srcURI), imageSrc, doc, mContent->GetBaseURI());
       if (!srcURI) return NS_ERROR_FAILURE;
 
-      nsCOMPtr<nsIReferrerInfo> referrerInfo = new mozilla::dom::ReferrerInfo();
-      referrerInfo->InitWithDocument(doc);
+      auto referrerInfo = MakeRefPtr<mozilla::dom::ReferrerInfo>(*doc);
 
       // XXXbz what's the origin principal for this stuff that comes from our
       // view?  I guess we should assume that it's the node's principal...

toolkit/components/windowwatcher/nsWindowWatcher.cpp

@@ -1171,8 +1171,7 @@ nsresult nsWindowWatcher::OpenWindowInternal(
         doc = parentWindow->GetExtantDoc();
       }
       if (doc) {
-        nsCOMPtr<nsIReferrerInfo> referrerInfo = new ReferrerInfo();
-        referrerInfo->InitWithDocument(doc);
+        auto referrerInfo = MakeRefPtr<ReferrerInfo>(*doc);
         loadState->SetReferrerInfo(referrerInfo);
       }
     }