Backed out 16 changesets (bug 1607984) for leaks on browser_ext_webRequest.js. CLOSED TREE

Backed out changeset 6c6ffa908c06 (bug 1607984)
Backed out changeset e973911e67e6 (bug 1607984)
Backed out changeset 28af6418ac16 (bug 1607984)
Backed out changeset 9a15a605f91a (bug 1607984)
Backed out changeset 52566b3564ba (bug 1607984)
Backed out changeset 142148a95181 (bug 1607984)
Backed out changeset 108e2cb6b2a9 (bug 1607984)
Backed out changeset 77fda525ee12 (bug 1607984)
Backed out changeset 980067f3ac1d (bug 1607984)
Backed out changeset 12b82a39c910 (bug 1607984)
Backed out changeset 7657023a763b (bug 1607984)
Backed out changeset 1ab8758802a6 (bug 1607984)
Backed out changeset 35f22d0817e1 (bug 1607984)
Backed out changeset b8c6277207d8 (bug 1607984)
Backed out changeset 244d3cb006be (bug 1607984)
Backed out changeset 9fc1a237829c (bug 1607984)

docshell/base/nsDocShell.cpp

@@ -73,8 +73,9 @@
 #include "mozilla/dom/nsCSPContext.h"
 #include "mozilla/dom/LoadURIOptionsBinding.h"
 #include "mozilla/dom/JSWindowActorChild.h"
-#include "nsSHEntry.h"
 #include "mozilla/net/DocumentChannel.h"
+#include "nsSHEntry.h"
+#include "mozilla/net/DocumentChannelChild.h"
 #include "mozilla/net/UrlClassifierFeatureFactory.h"
 #include "ReferrerInfo.h"
 
@@ -5712,8 +5713,7 @@ void nsDocShell::OnRedirectStateChange(nsIChannel* aOldChannel,
   // of redirects handled in the parent process.
   // Query the full redirect chain directly, so that we can add history
   // entries for them.
-  RefPtr<DocumentChannel> docChannel = do_QueryObject(aOldChannel);
-  if (docChannel) {
+  if (RefPtr<DocumentChannel> docChannel = do_QueryObject(aOldChannel)) {
     nsCOMPtr<nsIURI> previousURI;
     uint32_t previousFlags = 0;
     docChannel->GetLastVisit(getter_AddRefs(previousURI), &previousFlags);
@@ -5761,7 +5761,7 @@ void nsDocShell::OnRedirectStateChange(nsIChannel* aOldChannel,
   // check if the new load should go through the application cache.
   nsCOMPtr<nsIApplicationCacheChannel> appCacheChannel =
       do_QueryInterface(aNewChannel);
-  if (appCacheChannel && !docChannel) {
+  if (appCacheChannel) {
     if (GeckoProcessType_Default != XRE_GetProcessType()) {
       // Permission will be checked in the parent process.
       appCacheChannel->SetChooseApplicationCache(true);
@@ -9188,6 +9188,23 @@ static bool IsConsideredSameOriginForUIR(nsIPrincipal* aTriggeringPrincipal,
   return NS_OK;
 }
 
+// Changes here should also be made in
+// E10SUtils.documentChannelPermittedForURI().
+static bool URIUsesDocChannel(nsIURI* aURI) {
+  if (SchemeIsJavascript(aURI) || NS_IsAboutBlank(aURI)) {
+    return false;
+  }
+
+  nsCString spec = aURI->GetSpecOrDefault();
+
+  if (spec.EqualsLiteral("about:printpreview") ||
+      spec.EqualsLiteral("about:crashcontent")) {
+    return false;
+  }
+
+  return true;
+}
+
 /* static */ bool nsDocShell::CreateAndConfigureRealChannelForLoadState(
     BrowsingContext* aBrowsingContext, nsDocShellLoadState* aLoadState,
     LoadInfo* aLoadInfo, nsIInterfaceRequestor* aCallbacks,
@@ -9588,9 +9605,8 @@ nsresult nsDocShell::DoURILoad(nsDocShellLoadState* aLoadState,
   // If we have a pending channel, use the channel we've already created here.
   // We don't need to set up load flags for our channel, as it has already been
   // created.
-
-  if (nsCOMPtr<nsIChannel> channel =
-          aLoadState->GetPendingRedirectedChannel()) {
+  nsCOMPtr<nsIChannel> channel = aLoadState->GetPendingRedirectedChannel();
+  if (channel) {
     MOZ_ASSERT(!aLoadState->HasLoadFlags(INTERNAL_LOAD_FLAGS_IS_SRCDOC),
                "pending channel for srcdoc load?");
 
@@ -9759,11 +9775,20 @@ nsresult nsDocShell::DoURILoad(nsDocShellLoadState* aLoadState,
     cacheKey = mOSHE->GetCacheKey();
   }
 
-  nsCOMPtr<nsIChannel> channel;
-  if (DocumentChannel::CanUseDocumentChannel(aLoadState)) {
-    channel = DocumentChannel::CreateDocumentChannel(aLoadState, loadInfo,
-                                                     loadFlags, this, cacheKey);
-    MOZ_ASSERT(channel);
+  // We want to use DocumentChannel if we're using a supported scheme. Sandboxed
+  // srcdoc loads break due to failing assertions after changing processes, and
+  // non-sandboxed srcdoc loads need to share the same principal object as their
+  // outer document (and must load in the same process), which breaks if we
+  // serialize to the parent process.
+  bool canUseDocumentChannel =
+      !aLoadState->HasLoadFlags(INTERNAL_LOAD_FLAGS_IS_SRCDOC) &&
+      URIUsesDocChannel(aLoadState->URI());
+
+  if (StaticPrefs::browser_tabs_documentchannel() && XRE_IsContentProcess() &&
+      canUseDocumentChannel) {
+    channel =
+        new DocumentChannelChild(aLoadState, loadInfo, loadFlags, cacheKey);
+    channel->SetNotificationCallbacks(this);
   } else if (!CreateAndConfigureRealChannelForLoadState(
                  mBrowsingContext, aLoadState, loadInfo, this, this,
                  GetOriginAttributes(), loadFlags, cacheKey, rv,