Bug 1608501 - Part 3: Clean up image request in DestroyContent; r=smaug

Differential Revision: https://phabricator.services.mozilla.com/D82875

dom/base/nsObjectLoadingContent.cpp

@@ -2420,6 +2420,12 @@ void nsObjectLoadingContent::Destroy() {
   if (mInstanceOwner || mInstantiating) {
     QueueCheckPluginStopEvent();
   }
+
+  // Reset state so that if the element is re-appended to tree again (e.g.
+  // adopting to another document), it will reload resource again.
+  UnloadObject();
+
+  nsImageLoadingContent::Destroy();
 }
 
 /* static */

dom/html/HTMLImageElement.cpp

@@ -1240,6 +1240,7 @@ bool HTMLImageElement::SelectSourceForTagWithAttrs(
 void HTMLImageElement::DestroyContent() {
   mResponsiveSelector = nullptr;
 
+  nsImageLoadingContent::Destroy();
   nsGenericHTMLElement::DestroyContent();
 }
 

dom/html/HTMLInputElement.cpp

@@ -5825,6 +5825,11 @@ void HTMLInputElement::DoneCreatingElement() {
   mShouldInitChecked = false;
 }
 
+void HTMLInputElement::DestroyContent() {
+  nsImageLoadingContent::Destroy();
+  TextControlElement::DestroyContent();
+}
+
 EventStates HTMLInputElement::IntrinsicState() const {
   // If you add states here, and they're type-dependent, you need to add them
   // to the type case in AfterSetAttr.

dom/html/HTMLInputElement.h

@@ -194,6 +194,8 @@ class HTMLInputElement final : public TextControlElement,
   MOZ_CAN_RUN_SCRIPT_BOUNDARY
   virtual void DoneCreatingElement() override;
 
+  virtual void DestroyContent() override;
+
   virtual EventStates IntrinsicState() const override;
 
  public:

dom/svg/SVGFEImageElement.cpp

@@ -158,6 +158,11 @@ EventStates SVGFEImageElement::IntrinsicState() const {
          nsImageLoadingContent::ImageState();
 }
 
+void SVGFEImageElement::DestroyContent() {
+  nsImageLoadingContent::Destroy();
+  SVGFEImageElementBase::DestroyContent();
+}
+
 //----------------------------------------------------------------------
 // nsINode methods
 

dom/svg/SVGFEImageElement.h

@@ -68,6 +68,7 @@ class SVGFEImageElement final : public SVGFEImageElementBase,
   virtual nsresult BindToTree(BindContext&, nsINode& aParent) override;
   virtual void UnbindFromTree(bool aNullParent) override;
   virtual EventStates IntrinsicState() const override;
+  virtual void DestroyContent() override;
 
   void Notify(imgIRequest* aRequest, int32_t aType,
               const nsIntRect* aData) override;

dom/svg/SVGImageElement.cpp

@@ -229,6 +229,11 @@ EventStates SVGImageElement::IntrinsicState() const {
          nsImageLoadingContent::ImageState();
 }
 
+void SVGImageElement::DestroyContent() {
+  nsImageLoadingContent::Destroy();
+  SVGImageElementBase::DestroyContent();
+}
+
 NS_IMETHODIMP_(bool)
 SVGImageElement::IsAttributeMapped(const nsAtom* name) const {
   static const MappedAttributeEntry* const map[] = {

dom/svg/SVGImageElement.h

@@ -67,6 +67,8 @@ class SVGImageElement : public SVGImageElementBase,
 
   virtual EventStates IntrinsicState() const override;
 
+  virtual void DestroyContent() override;
+
   NS_IMETHOD_(bool) IsAttributeMapped(const nsAtom* name) const override;
 
   // SVGGeometryElement methods:

testing/web-platform/meta/content-security-policy/inheritance/iframe-all-local-schemes-inherit-self.sub.html.ini

@@ -0,0 +1,5 @@
+[iframe-all-local-schemes-inherit-self.sub.html]
+  expected: TIMEOUT
+  [<iframe>'s about:blank inherits policy.]
+    expected: TIMEOUT # bug 543435
+