Update Fetch to adhere to the updated spec (pass referrerpolicy)

dom/base/nsContentSink.cpp

@@ -472,6 +472,7 @@ nsContentSink::ProcessLinkHeader(const nsAString& aLinkData)
   nsAutoString media;
   nsAutoString anchor;
   nsAutoString crossOrigin;
+  nsAutoString referrerPolicy;
   nsAutoString destination;
 
   crossOrigin.SetIsVoid(true);
@@ -660,6 +661,15 @@ nsContentSink::ProcessLinkHeader(const nsAString& aLinkData)
               destination = value;
               destination.StripWhitespace();
             }
+          } else if (attr.LowerCaseEqualsLiteral("referrerpolicy")) {
+            // https://html.spec.whatwg.org/multipage/urls-and-fetching.html#referrer-policy-attribute
+            // The spec says that the referrer policy attribute is an enumerated attribute,
+            // case insensitive and includes the empty string.
+            // We will parse the value with AttributeReferrerPolicyFromString
+            // later, which will handle parsing it as an enumerated attribute.
+            if (referrerPolicy.IsEmpty()) {
+              referrerPolicy = value;
+            }
           }
         }
       }
@@ -673,7 +683,7 @@ nsContentSink::ProcessLinkHeader(const nsAString& aLinkData)
         rv = ProcessLink(anchor, href, rel,
                          // prefer RFC 5987 variant over non-I18zed version
                          titleStar.IsEmpty() ? title : titleStar,
-                         type, media, crossOrigin, destination);
+                         type, media, crossOrigin, referrerPolicy, destination);
       }
 
       href.Truncate();
@@ -682,6 +692,7 @@ nsContentSink::ProcessLinkHeader(const nsAString& aLinkData)
       type.Truncate();
       media.Truncate();
       anchor.Truncate();
+      referrerPolicy.Truncate();
       crossOrigin.SetIsVoid(true);
       destination.Truncate();
       
@@ -696,7 +707,7 @@ nsContentSink::ProcessLinkHeader(const nsAString& aLinkData)
     rv = ProcessLink(anchor, href, rel,
                      // prefer RFC 5987 variant over non-I18zed version
                      titleStar.IsEmpty() ? title : titleStar,
-                     type, media, crossOrigin, destination);
+                     type, media, crossOrigin, referrerPolicy, destination);
   }
 
   return rv;
@@ -708,6 +719,7 @@ nsContentSink::ProcessLink(const nsSubstring& aAnchor, const nsSubstring& aHref,
                            const nsSubstring& aRel, const nsSubstring& aTitle,
                            const nsSubstring& aType, const nsSubstring& aMedia,
                            const nsSubstring& aCrossOrigin,
+                           const nsAString& aReferrerPolicy,
                            const nsSubstring& aDestination)
 {
   uint32_t linkTypes =
@@ -749,7 +761,7 @@ nsContentSink::ProcessLink(const nsSubstring& aAnchor, const nsSubstring& aHref,
 
   bool isAlternate = linkTypes & nsStyleLinkElement::eALTERNATE;
   return ProcessStyleLink(nullptr, aHref, isAlternate, aTitle, aType,
-                          aMedia);
+                          aMedia, aReferrerPolicy);
 }
 
 nsresult
@@ -758,7 +770,8 @@ nsContentSink::ProcessStyleLink(nsIContent* aElement,
                                 bool aAlternate,
                                 const nsSubstring& aTitle,
                                 const nsSubstring& aType,
-                                const nsSubstring& aMedia)
+                                const nsSubstring& aMedia,
+                                const nsSubstring& aReferrerPolicy)
 {
   if (aAlternate && aTitle.IsEmpty()) {
     // alternates must have title return without error, for now
@@ -797,13 +810,18 @@ nsContentSink::ProcessStyleLink(nsIContent* aElement,
             ("nsContentSink::ProcessStyleLink, integrity=%s",
              NS_ConvertUTF16toUTF8(integrity).get()));
   }
+  mozilla::net::ReferrerPolicy referrerPolicy =
+    mozilla::net::AttributeReferrerPolicyFromString(aReferrerPolicy);
+  if (referrerPolicy == net::RP_Unset) {
+    referrerPolicy = mDocument->GetReferrerPolicy();
+  }
 
   // If this is a fragment parser, we don't want to observe.
   // We don't support CORS for processing instructions
   bool isAlternate;
   bool isExplicitlyEnabled;
   rv = mCSSLoader->LoadStyleLink(aElement, url, aTitle, aMedia, aAlternate,
-                                 CORS_NONE, mDocument->GetReferrerPolicy(),
+                                 CORS_NONE, referrerPolicy,
                                  integrity, mRunsToCompletion ? nullptr : this,
                                  &isAlternate, &isExplicitlyEnabled);
   NS_ENSURE_SUCCESS(rv, rv);

dom/base/nsContentSink.h

@@ -154,6 +154,7 @@ protected:
                        const nsSubstring& aHref, const nsSubstring& aRel,
                        const nsSubstring& aTitle, const nsSubstring& aType,
                        const nsSubstring& aMedia, const nsSubstring& aCrossOrigin,
+                       const nsSubstring& aReferrerPolicy,
                        const nsSubstring& aDestination);
 
   virtual nsresult ProcessStyleLink(nsIContent* aElement,
@@ -161,7 +162,8 @@ protected:
                                     bool aAlternate,
                                     const nsSubstring& aTitle,
                                     const nsSubstring& aType,
-                                    const nsSubstring& aMedia);
+                                    const nsSubstring& aMedia,
+                                    const nsSubstring& aReferrerPolicy);
 
   void PrefetchOrPreloadHref(const nsAString &aHref,
                              nsINode *aSource,

dom/base/nsContentUtils.cpp

@@ -8868,10 +8868,8 @@ nsContentUtils::SetFetchReferrerURIWithPolicy(nsIPrincipal* aPrincipal,
     referrerURI = principalURI;
   }
 
-  net::ReferrerPolicy referrerPolicy = aReferrerPolicy;
-  if (referrerPolicy == net::RP_Default) {
-    referrerPolicy = aDoc->GetReferrerPolicy();
-  }
+  net::ReferrerPolicy referrerPolicy = (aReferrerPolicy != net::RP_Unset) ?
+                                       aReferrerPolicy : net::RP_Default;
   return aChannel->SetReferrerWithPolicy(referrerURI, referrerPolicy);
 }
 

dom/base/nsStyleLinkElement.cpp

@@ -411,6 +411,16 @@ nsStyleLinkElement::DoUpdateStyleSheet(nsIDocument* aOldDocument,
 
   bool doneLoading = false;
   nsresult rv = NS_OK;
+
+  // Load the link's referrerpolicy attribute. If the link does not provide a
+  // referrerpolicy attribute, ignore this and use the document's referrer
+  // policy
+
+  net::ReferrerPolicy referrerPolicy = GetLinkReferrerPolicy();
+  if (referrerPolicy == net::RP_Unset) {
+    referrerPolicy = doc->GetReferrerPolicy();
+  }
+
   if (isInline) {
     nsAutoString text;
     if (!nsContentUtils::GetNodeTextContent(thisContent, false, text, fallible)) {
@@ -429,7 +439,7 @@ nsStyleLinkElement::DoUpdateStyleSheet(nsIDocument* aOldDocument,
 
     // Parse the style sheet.
     rv = doc->CSSLoader()->
-      LoadInlineStyle(thisContent, text, mLineNumber, title, media,
+      LoadInlineStyle(thisContent, text, mLineNumber, title, media, referrerPolicy,
                       scopeElement, aObserver, &doneLoading, &isAlternate, &isExplicitlyEnabled);
   } else {
     nsAutoString integrity;
@@ -440,15 +450,6 @@ nsStyleLinkElement::DoUpdateStyleSheet(nsIDocument* aOldDocument,
                NS_ConvertUTF16toUTF8(integrity).get()));
     }
 
-    // if referrer attributes are enabled in preferences, load the link's referrer
-    // attribute. If the link does not provide a referrer attribute, ignore this
-    // and use the document's referrer policy
-
-    net::ReferrerPolicy referrerPolicy = GetLinkReferrerPolicy();
-    if (referrerPolicy == net::RP_Unset) {
-      referrerPolicy = doc->GetReferrerPolicy();
-    }
-
     // XXXbz clone the URI here to work around content policies modifying URIs.
     nsCOMPtr<nsIURI> clonedURI;
     uri->Clone(getter_AddRefs(clonedURI));

dom/cache/DBSchema.cpp

@@ -196,7 +196,10 @@ static_assert(int(ReferrerPolicy::_empty) == 0 &&
               int(ReferrerPolicy::Origin) == 3 &&
               int(ReferrerPolicy::Origin_when_cross_origin) == 4 &&
               int(ReferrerPolicy::Unsafe_url) == 5 &&
-              int(ReferrerPolicy::EndGuard_) == 6,
+              int(ReferrerPolicy::Same_origin) == 6 &&
+              int(ReferrerPolicy::Strict_origin) == 7 &&
+              int(ReferrerPolicy::Strict_origin_when_cross_origin) == 8 &&
+              int(ReferrerPolicy::EndGuard_) == 9,
               "ReferrerPolicy values are as expected");
 static_assert(int(RequestMode::Same_origin) == 0 &&
               int(RequestMode::No_cors) == 1 &&

dom/fetch/FetchDriver.cpp

@@ -33,6 +33,7 @@
 #include "mozilla/Unused.h"
 
 #include "Fetch.h"
+#include "FetchUtil.h"
 #include "InternalRequest.h"
 #include "InternalResponse.h"
 
@@ -262,62 +263,30 @@ FetchDriver::HttpFetch()
     // Set the same headers.
     SetRequestHeaders(httpChan);
 
-    // Step 2. Set the referrer.
-    nsAutoString referrer;
-    mRequest->GetReferrer(referrer);
-
-    // The Referrer Policy in Request can be used to override a referrer policy
-    // associated with an environment settings object.
-    // If there's no Referrer Policy in the request, it should be inherited
-    // from environment.
-    ReferrerPolicy referrerPolicy = mRequest->ReferrerPolicy_();
     net::ReferrerPolicy net_referrerPolicy = mRequest->GetEnvironmentReferrerPolicy();
-    switch (referrerPolicy) {
-    case ReferrerPolicy::_empty:
-      break;
-    case ReferrerPolicy::No_referrer:
-      net_referrerPolicy = net::RP_No_Referrer;
-      break;
-    case ReferrerPolicy::No_referrer_when_downgrade:
-      net_referrerPolicy = net::RP_No_Referrer_When_Downgrade;
-      break;
-    case ReferrerPolicy::Origin:
-      net_referrerPolicy = net::RP_Origin;
-      break;
-    case ReferrerPolicy::Origin_when_cross_origin:
-      net_referrerPolicy = net::RP_Origin_When_Crossorigin;
-      break;
-    case ReferrerPolicy::Unsafe_url:
-      net_referrerPolicy = net::RP_Unsafe_URL;
-      break;
-    default:
-      MOZ_ASSERT_UNREACHABLE("Invalid ReferrerPolicy enum value?");
-      break;
+    // Step 6 of
+    // https://fetch.spec.whatwg.org/#main-fetch
+    // If request's referrer policy is the empty string and request's client is
+    // non-null, then set request's referrer policy to request's client's
+    // associated referrer policy.
+    // Basically, "client" is not in our implementation, we use
+    // EnvironmentReferrerPolicy of the worker or document context
+    if (mRequest->ReferrerPolicy_() == ReferrerPolicy::_empty) {
+      mRequest->SetReferrerPolicy(net_referrerPolicy);
+    }
+    // Step 7 of
+    // https://fetch.spec.whatwg.org/#main-fetch
+    // If request’s referrer policy is the empty string,
+    // then set request’s referrer policy to "no-referrer-when-downgrade".
+    if (mRequest->ReferrerPolicy_() == ReferrerPolicy::_empty) {
+      mRequest->SetReferrerPolicy(net::RP_No_Referrer_When_Downgrade);
     }
-    if (referrer.EqualsLiteral(kFETCH_CLIENT_REFERRER_STR)) {
-      rv = nsContentUtils::SetFetchReferrerURIWithPolicy(mPrincipal,
-                                                         mDocument,
-                                                         httpChan,
-                                                         net_referrerPolicy);
-      NS_ENSURE_SUCCESS(rv, rv);
-    } else if (referrer.IsEmpty()) {
-      rv = httpChan->SetReferrerWithPolicy(nullptr, net::RP_No_Referrer);
-      NS_ENSURE_SUCCESS(rv, rv);
-    } else {
-      // From "Determine request's Referrer" step 3
-      // "If request's referrer is a URL, let referrerSource be request's
-      // referrer."
-      nsCOMPtr<nsIURI> referrerURI;
-      rv = NS_NewURI(getter_AddRefs(referrerURI), referrer, nullptr, nullptr);
-      NS_ENSURE_SUCCESS(rv, rv);
 
-      rv =
-        httpChan->SetReferrerWithPolicy(referrerURI,
-                                        referrerPolicy == ReferrerPolicy::_empty ?
-                                          mRequest->GetEnvironmentReferrerPolicy() :
-                                          net_referrerPolicy);
-      NS_ENSURE_SUCCESS(rv, rv);
-    }
+    rv = FetchUtil::SetRequestReferrer(mPrincipal,
+                                       mDocument,
+                                       httpChan,
+                                       mRequest);
+    NS_ENSURE_SUCCESS(rv, rv);
 
     // Bug 1120722 - Authorization will be handled later.
     // Auth may require prompting, we don't support it yet.
@@ -864,29 +833,15 @@ FetchDriver::AsyncOnChannelRedirect(nsIChannel* aOldChannel,
     net::ReferrerPolicy net_referrerPolicy =
       nsContentUtils::GetReferrerPolicyFromHeader(tRPHeaderValue);
     if (net_referrerPolicy != net::RP_Unset) {
-      ReferrerPolicy referrerPolicy = mRequest->ReferrerPolicy_();
-      switch (net_referrerPolicy) {
-        case net::RP_No_Referrer:
-          referrerPolicy = ReferrerPolicy::No_referrer;
-          break;
-        case net::RP_No_Referrer_When_Downgrade:
-          referrerPolicy = ReferrerPolicy::No_referrer_when_downgrade;
-          break;
-        case net::RP_Origin:
-          referrerPolicy = ReferrerPolicy::Origin;
-          break;
-        case net::RP_Origin_When_Crossorigin:
-          referrerPolicy = ReferrerPolicy::Origin_when_cross_origin;
-          break;
-        case net::RP_Unsafe_URL:
-          referrerPolicy = ReferrerPolicy::Unsafe_url;
-          break;
-        default:
-          MOZ_ASSERT_UNREACHABLE("Invalid ReferrerPolicy value");
-          break;
+      mRequest->SetReferrerPolicy(net_referrerPolicy);
+      // Should update channel's referrer policy
+      if (httpChannel) {
+        rv = FetchUtil::SetRequestReferrer(mPrincipal,
+                                           mDocument,
+                                           httpChannel,
+                                           mRequest);
+        NS_ENSURE_SUCCESS(rv, rv);
       }
-
-      mRequest->SetReferrerPolicy(referrerPolicy);
     }
   }
 

dom/fetch/FetchUtil.cpp

@@ -4,8 +4,10 @@
 #include "nsIUnicodeDecoder.h"
 #include "nsNetUtil.h"
 #include "nsString.h"
+#include "nsIDocument.h"
 
 #include "mozilla/dom/EncodingUtils.h"
+#include "mozilla/dom/InternalRequest.h"
 
 namespace mozilla {
 namespace dom {
@@ -111,5 +113,59 @@ FetchUtil::ExtractHeader(nsACString::const_iterator& aStart,
   return PushOverLine(aStart, aEnd);
 }
 
+// static
+nsresult
+FetchUtil::SetRequestReferrer(nsIPrincipal* aPrincipal,
+                              nsIDocument* aDoc,
+                              nsIHttpChannel* aChannel,
+                              InternalRequest* aRequest) {
+  MOZ_ASSERT(NS_IsMainThread());
+
+  nsAutoString referrer;
+  aRequest->GetReferrer(referrer);
+  net::ReferrerPolicy policy = aRequest->GetReferrerPolicy();
+
+  nsresult rv = NS_OK;
+  if (referrer.IsEmpty()) {
+    // This is the case request’s referrer is "no-referrer"
+    rv = aChannel->SetReferrerWithPolicy(nullptr, net::RP_No_Referrer);
+    NS_ENSURE_SUCCESS(rv, rv);
+  } else if (referrer.EqualsLiteral(kFETCH_CLIENT_REFERRER_STR)) {
+    rv = nsContentUtils::SetFetchReferrerURIWithPolicy(aPrincipal,
+                                                       aDoc,
+                                                       aChannel,
+                                                       policy);
+    NS_ENSURE_SUCCESS(rv, rv);
+  } else {
+    // From "Determine request's Referrer" step 3
+    // "If request's referrer is a URL, let referrerSource be request's
+    // referrer."
+    nsCOMPtr<nsIURI> referrerURI;
+    rv = NS_NewURI(getter_AddRefs(referrerURI), referrer, nullptr, nullptr);
+    NS_ENSURE_SUCCESS(rv, rv);
+
+    rv = aChannel->SetReferrerWithPolicy(referrerURI, policy);
+    NS_ENSURE_SUCCESS(rv, rv);
+  }
+
+  nsCOMPtr<nsIURI> referrerURI;
+  aChannel->GetReferrer(getter_AddRefs(referrerURI));
+
+  // Step 8 https://fetch.spec.whatwg.org/#main-fetch
+  // If request’s referrer is not "no-referrer", set request’s referrer to
+  // the result of invoking determine request’s referrer.
+  if (referrerURI) {
+    nsAutoCString spec;
+    rv = referrerURI->GetSpec(spec);
+    NS_ENSURE_SUCCESS(rv, rv);
+
+    aRequest->SetReferrer(NS_ConvertUTF8toUTF16(spec));
+  } else {
+    aRequest->SetReferrer(EmptyString());
+  }
+
+  return NS_OK;
+}
+
 } // namespace dom
 } // namespace mozilla

dom/fetch/FetchUtil.h

@@ -8,9 +8,15 @@
 #include "mozilla/dom/File.h"
 #include "mozilla/dom/FormData.h"
 
+class nsIPrincipal;
+class nsIDocument;
+class nsIHttpChannel;
+
 namespace mozilla {
 namespace dom {
 
+class InternalRequest;
+
 class FetchUtil final
 {
 private:
@@ -35,6 +41,13 @@ public:
                 nsCString& aHeaderName,
                 nsCString& aHeaderValue,
                 bool* aWasEmptyHeader);
+
+  static nsresult
+  SetRequestReferrer(nsIPrincipal* aPrincipal,
+                     nsIDocument* aDoc,
+                     nsIHttpChannel* aChannel,
+                     InternalRequest* aRequest);
+
 };
 
 } // namespace dom

dom/fetch/InternalRequest.h

@@ -232,6 +232,72 @@ public:
     mReferrerPolicy = aReferrerPolicy;
   }
 
+  void
+  SetReferrerPolicy(net::ReferrerPolicy aReferrerPolicy)
+  {
+    switch (aReferrerPolicy) {
+      case net::RP_Unset:
+        mReferrerPolicy = ReferrerPolicy::_empty;
+        break;
+      case net::RP_No_Referrer:
+        mReferrerPolicy = ReferrerPolicy::No_referrer;
+        break;
+      case net::RP_No_Referrer_When_Downgrade:
+        mReferrerPolicy = ReferrerPolicy::No_referrer_when_downgrade;
+        break;
+      case net::RP_Origin:
+        mReferrerPolicy = ReferrerPolicy::Origin;
+        break;
+      case net::RP_Origin_When_Crossorigin:
+        mReferrerPolicy = ReferrerPolicy::Origin_when_cross_origin;
+        break;
+      case net::RP_Unsafe_URL:
+        mReferrerPolicy = ReferrerPolicy::Unsafe_url;
+        break;
+      case net::RP_Same_Origin:
+        mReferrerPolicy = ReferrerPolicy::Same_origin;
+        break;
+      case net::RP_Strict_Origin:
+        mReferrerPolicy = ReferrerPolicy::Strict_origin;
+        break;
+      case net::RP_Strict_Origin_When_Cross_Origin:
+        mReferrerPolicy = ReferrerPolicy::Strict_origin_when_cross_origin;
+        break;
+      default:
+        MOZ_ASSERT_UNREACHABLE("Invalid ReferrerPolicy value");
+        break;
+    }
+  }
+
+  net::ReferrerPolicy
+  GetReferrerPolicy()
+  {
+    switch (mReferrerPolicy) {
+      case ReferrerPolicy::_empty:
+        return net::RP_Unset;
+      case ReferrerPolicy::No_referrer:
+        return net::RP_No_Referrer;
+      case ReferrerPolicy::No_referrer_when_downgrade:
+        return net::RP_No_Referrer_When_Downgrade;
+      case ReferrerPolicy::Origin:
+        return net::RP_Origin;
+      case ReferrerPolicy::Origin_when_cross_origin:
+        return net::RP_Origin_When_Crossorigin;
+      case ReferrerPolicy::Unsafe_url:
+        return net::RP_Unsafe_URL;
+      case ReferrerPolicy::Strict_origin:
+        return net::RP_Strict_Origin;
+      case ReferrerPolicy::Same_origin:
+        return net::RP_Same_Origin;
+      case ReferrerPolicy::Strict_origin_when_cross_origin:
+        return net::RP_Strict_Origin_When_Cross_Origin;
+      default:
+        MOZ_ASSERT_UNREACHABLE("Invalid ReferrerPolicy enum value?");
+        break;
+    }
+    return net::RP_Unset;
+  }
+
   net::ReferrerPolicy
   GetEnvironmentReferrerPolicy() const
   {

dom/html/HTMLScriptElement.cpp

@@ -324,6 +324,12 @@ HTMLScriptElement::GetCORSMode() const
   return AttrValueToCORSMode(GetParsedAttr(nsGkAtoms::crossorigin));
 }
 
+mozilla::net::ReferrerPolicy
+HTMLScriptElement::GetReferrerPolicy()
+{
+  return GetReferrerPolicyAsEnum();
+}
+
 bool
 HTMLScriptElement::HasScriptContent()
 {

dom/html/HTMLScriptElement.h

@@ -42,6 +42,7 @@ public:
   virtual void GetScriptCharset(nsAString& charset) override;
   virtual void FreezeExecutionAttrs(nsIDocument* aOwnerDoc) override;
   virtual CORSMode GetCORSMode() const override;
+  virtual mozilla::net::ReferrerPolicy GetReferrerPolicy() override;
 
   // nsIContent
   virtual nsresult BindToTree(nsIDocument* aDocument, nsIContent* aParent,
@@ -96,6 +97,14 @@ public:
   {
     SetHTMLAttr(nsGkAtoms::integrity, aIntegrity, rv);
   }
+  void SetReferrerPolicy(const nsAString& aReferrerPolicy, ErrorResult& aError)
+  {
+    SetHTMLAttr(nsGkAtoms::referrerpolicy, aReferrerPolicy, aError);
+  }
+  void GetReferrerPolicy(nsAString& aReferrerPolicy)
+  {
+    GetEnumAttr(nsGkAtoms::referrerpolicy, EmptyCString().get(), aReferrerPolicy);
+  }
   bool Async();
   void SetAsync(bool aValue, ErrorResult& rv);
   bool NoModule();

dom/html/test/test_bug1260664.html

@@ -24,7 +24,7 @@ SimpleTest.waitForExplicitFinish();
 SimpleTest.waitForFocus(runTests);
 
 function runTests() {
-  var elements = [ "iframe", "img", "a", "area", "link" ];
+  var elements = [ "iframe", "img", "a", "area", "link", "script"];
 
   for (var i = 0; i < elements.length; ++i) {
     reflectLimitedEnumerated({

dom/script/ScriptLoader.cpp

@@ -1562,7 +1562,7 @@ ScriptLoader::ProcessScriptElement(nsIScriptElement *aElement)
   // Step 15. and later in the HTML5 spec
   nsresult rv = NS_OK;
   RefPtr<ScriptLoadRequest> request;
-  mozilla::net::ReferrerPolicy ourRefPolicy = mDocument->GetReferrerPolicy();
+  mozilla::net::ReferrerPolicy referrerPolicy = GetReferrerPolicy(aElement);
   if (aElement->GetScriptExternal()) {
     // external script
     nsCOMPtr<nsIURI> scriptURI = aElement->GetScriptURI();
@@ -1592,7 +1592,7 @@ ScriptLoader::ProcessScriptElement(nsIScriptElement *aElement)
       aElement->GetScriptCharset(elementCharset);
       if (elementCharset.Equals(preloadCharset) &&
           ourCORSMode == request->CORSMode() &&
-          ourRefPolicy == request->ReferrerPolicy() &&
+          referrerPolicy == request->ReferrerPolicy() &&
           scriptKind == request->mKind) {
         rv = CheckContentPolicy(mDocument, aElement, request->mURI, type, false);
         if (NS_FAILED(rv)) {
@@ -1638,7 +1638,7 @@ ScriptLoader::ProcessScriptElement(nsIScriptElement *aElement)
       nsCOMPtr<nsIPrincipal> principal = scriptContent->NodePrincipal();
 
       request = CreateLoadRequest(scriptKind, scriptURI, aElement, principal,
-                                  ourCORSMode, sriMetadata, ourRefPolicy);
+                                  ourCORSMode, sriMetadata, referrerPolicy);
       request->mIsInline = false;
       request->SetScriptMode(aElement->GetScriptDeferred(),
                              aElement->GetScriptAsync());
@@ -1759,7 +1759,7 @@ ScriptLoader::ProcessScriptElement(nsIScriptElement *aElement)
                               mDocument->NodePrincipal(),
                               CORS_NONE,
                               SRIMetadata(), // SRI doesn't apply
-                              ourRefPolicy);
+                              referrerPolicy);
   request->mIsInline = true;
   request->mLineNo = aElement->GetScriptLineNumber();
 
@@ -1825,6 +1825,17 @@ ScriptLoader::ProcessScriptElement(nsIScriptElement *aElement)
   return ProcessRequest(request) == NS_ERROR_HTMLPARSER_BLOCK;
 }
 
+mozilla::net::ReferrerPolicy
+ScriptLoader::GetReferrerPolicy(nsIScriptElement* aElement)
+{
+  mozilla::net::ReferrerPolicy scriptReferrerPolicy =
+    aElement->GetReferrerPolicy();
+  if (scriptReferrerPolicy != mozilla::net::RP_Unset) {
+    return scriptReferrerPolicy;
+  }
+  return mDocument->GetReferrerPolicy();
+}
+
 namespace {
 
 class NotifyOffThreadScriptLoadCompletedRunnable : public Runnable

dom/script/ScriptLoader.h

@@ -619,6 +619,12 @@ private:
   void ContinueParserAsync(ScriptLoadRequest* aParserBlockingRequest);
 
 
+  /**
+   * Given a script element, get the referrer policy that should be applied to
+   * load requests.
+   */
+  mozilla::net::ReferrerPolicy GetReferrerPolicy(nsIScriptElement* aElement);
+
   /**
    * Helper function to check the content policy for a given request.
    */

dom/script/nsIScriptElement.h

@@ -16,6 +16,7 @@
 #include "nsContentCreatorFunctions.h"
 #include "nsIDOMHTMLScriptElement.h"
 #include "mozilla/CORSMode.h"
+#include "mozilla/net/ReferrerPolicy.h"
 
 #define NS_ISCRIPTELEMENT_IID \
 { 0xe60fca9b, 0x1b96, 0x4e4e, \
@@ -263,6 +264,14 @@ public:
     return mozilla::CORS_NONE;
   }
 
+  /**
+   * Get referrer policy of the script element
+   */
+  virtual mozilla::net::ReferrerPolicy GetReferrerPolicy()
+  {
+    return mozilla::net::RP_Unset;
+  }
+
   /**
    * Fire an error event
    */

dom/webidl/HTMLScriptElement.webidl

@@ -25,6 +25,8 @@ interface HTMLScriptElement : HTMLElement {
   [CEReactions, SetterThrows]
   attribute DOMString? crossOrigin;
   [CEReactions, SetterThrows]
+  attribute DOMString referrerPolicy;
+  [CEReactions, SetterThrows]
   attribute DOMString text;
   [CEReactions, SetterThrows, Pure]
   attribute DOMString nonce;

dom/webidl/Request.webidl

@@ -73,4 +73,8 @@ enum RequestMode { "same-origin", "no-cors", "cors", "navigate" };
 enum RequestCredentials { "omit", "same-origin", "include" };
 enum RequestCache { "default", "no-store", "reload", "no-cache", "force-cache", "only-if-cached" };
 enum RequestRedirect { "follow", "error", "manual" };
-enum ReferrerPolicy { "", "no-referrer", "no-referrer-when-downgrade", "origin", "origin-when-cross-origin", "unsafe-url" };
+enum ReferrerPolicy {
+  "", "no-referrer", "no-referrer-when-downgrade", "origin",
+  "origin-when-cross-origin", "unsafe-url", "same-origin", "strict-origin",
+  "strict-origin-when-cross-origin"
+};

dom/workers/ScriptLoader.cpp

@@ -208,8 +208,10 @@ ChannelFromScriptURL(nsIPrincipal* principal,
   NS_ENSURE_SUCCESS(rv, rv);
 
   if (nsCOMPtr<nsIHttpChannel> httpChannel = do_QueryInterface(channel)) {
+    mozilla::net::ReferrerPolicy referrerPolicy = parentDoc ?
+      parentDoc->GetReferrerPolicy() : mozilla::net::RP_Default;
     rv = nsContentUtils::SetFetchReferrerURIWithPolicy(principal, parentDoc,
-                                                       httpChannel, mozilla::net::RP_Default);
+                                                       httpChannel, referrerPolicy);
     if (NS_WARN_IF(NS_FAILED(rv))) {
       return rv;
     }

dom/workers/ServiceWorkerPrivate.cpp

@@ -1345,12 +1345,19 @@ public:
     httpChannel->GetRequestHeader(NS_LITERAL_CSTRING("Referer"), referrer);
     if (!referrer.IsEmpty()) {
       mReferrer = referrer;
+    } else {
+      // If there's no referrer Header, means the header was omitted for
+      // security/privacy reason.
+      mReferrer = EmptyCString();
     }
 
     uint32_t referrerPolicy = 0;
     rv = httpChannel->GetReferrerPolicy(&referrerPolicy);
     NS_ENSURE_SUCCESS(rv, rv);
     switch (referrerPolicy) {
+      case nsIHttpChannel::REFERRER_POLICY_UNSET:
+      mReferrerPolicy = ReferrerPolicy::_empty;
+      break;
     case nsIHttpChannel::REFERRER_POLICY_NO_REFERRER:
       mReferrerPolicy = ReferrerPolicy::No_referrer;
       break;
@@ -1366,6 +1373,15 @@ public:
     case nsIHttpChannel::REFERRER_POLICY_UNSAFE_URL:
       mReferrerPolicy = ReferrerPolicy::Unsafe_url;
       break;
+    case nsIHttpChannel::REFERRER_POLICY_SAME_ORIGIN:
+      mReferrerPolicy = ReferrerPolicy::Same_origin;
+      break;
+    case nsIHttpChannel::REFERRER_POLICY_STRICT_ORIGIN_WHEN_XORIGIN:
+      mReferrerPolicy = ReferrerPolicy::Strict_origin_when_cross_origin;
+      break;
+    case nsIHttpChannel::REFERRER_POLICY_STRICT_ORIGIN:
+      mReferrerPolicy = ReferrerPolicy::Strict_origin;
+      break;
     default:
       MOZ_ASSERT_UNREACHABLE("Invalid Referrer Policy enum value?");
       break;

dom/xhr/XMLHttpRequestMainThread.cpp

@@ -2433,9 +2433,10 @@ XMLHttpRequestMainThread::InitiateFetch(nsIInputStream* aUploadStream,
     if (!IsSystemXHR()) {
       nsCOMPtr<nsPIDOMWindowInner> owner = GetOwner();
       nsCOMPtr<nsIDocument> doc = owner ? owner->GetExtantDoc() : nullptr;
+      mozilla::net::ReferrerPolicy referrerPolicy = doc ?
+        doc->GetReferrerPolicy() : mozilla::net::RP_Default;
       nsContentUtils::SetFetchReferrerURIWithPolicy(mPrincipal, doc,
-                                                    httpChannel,
-                                                    mozilla::net::RP_Default);
+                                                    httpChannel, referrerPolicy);
     }
 
     // Some extensions override the http protocol handler and provide their own

dom/xml/nsXMLContentSink.cpp

@@ -655,7 +655,8 @@ nsXMLContentSink::ProcessStyleLink(nsIContent* aElement,
                                    bool aAlternate,
                                    const nsSubstring& aTitle,
                                    const nsSubstring& aType,
-                                   const nsSubstring& aMedia)
+                                   const nsSubstring& aMedia,
+                                   const nsSubstring& aReferrerPolicy)
 {
   nsresult rv = NS_OK;
   mPrettyPrintXML = false;
@@ -714,7 +715,7 @@ nsXMLContentSink::ProcessStyleLink(nsIContent* aElement,
 
   // Let nsContentSink deal with css.
   rv = nsContentSink::ProcessStyleLink(aElement, aHref, aAlternate,
-                                       aTitle, aType, aMedia);
+                                       aTitle, aType, aMedia, aReferrerPolicy);
 
   // nsContentSink::ProcessStyleLink handles the bookkeeping here wrt
   // pending sheets.
@@ -1261,7 +1262,9 @@ nsXMLContentSink::HandleProcessingInstruction(const char16_t *aTarget,
       return DidProcessATokenImpl();
   }
 
-  rv = ProcessStyleLink(node, href, isAlternate, title, type, media);
+  // <?xml-stylesheet?> processing instructions don't have a referrerpolicy
+  // pseudo-attribute, so we pass in an empty string
+  rv = ProcessStyleLink(node, href, isAlternate, title, type, media, EmptyString());
   return NS_SUCCEEDED(rv) ? DidProcessATokenImpl() : rv;
 }
 

dom/xml/nsXMLContentSink.h

@@ -150,7 +150,8 @@ protected:
                                     bool aAlternate,
                                     const nsSubstring& aTitle,
                                     const nsSubstring& aType,
-                                    const nsSubstring& aMedia) override;
+                                    const nsSubstring& aMedia,
+                                    const nsSubstring& aReferrerPolicy) override;
 
   nsresult LoadXSLStyleSheet(nsIURI* aUrl);
 

dom/xml/nsXMLFragmentContentSink.cpp

@@ -97,7 +97,9 @@ protected:
                                     bool aAlternate,
                                     const nsSubstring& aTitle,
                                     const nsSubstring& aType,
-                                    const nsSubstring& aMedia) override;
+                                    const nsSubstring& aMedia,
+                                    const nsSubstring& aReferrerPolicy) override;
+
   nsresult LoadXSLStyleSheet(nsIURI* aUrl);
   void StartLayout();
 
@@ -332,7 +334,8 @@ nsXMLFragmentContentSink::ProcessStyleLink(nsIContent* aElement,
                                            bool aAlternate,
                                            const nsSubstring& aTitle,
                                            const nsSubstring& aType,
-                                           const nsSubstring& aMedia)
+                                           const nsSubstring& aMedia,
+                                           const nsSubstring& aReferrerPolicy)
 {
   // don't process until moved to document
   return NS_OK;

layout/style/Loader.cpp

@@ -1907,6 +1907,7 @@ Loader::LoadInlineStyle(nsIContent* aElement,
                         uint32_t aLineNumber,
                         const nsAString& aTitle,
                         const nsAString& aMedia,
+                        ReferrerPolicy aReferrerPolicy,
                         Element* aScopeElement,
                         nsICSSLoaderObserver* aObserver,
                         bool* aCompleted,
@@ -1930,11 +1931,12 @@ Loader::LoadInlineStyle(nsIContent* aElement,
 
   // Since we're not planning to load a URI, no need to hand a principal to the
   // load data or to CreateSheet().  Also, OK to use CORS_NONE for the CORS
-  // mode and mDocument's ReferrerPolicy.
+  // mode.
+
   StyleSheetState state;
   RefPtr<StyleSheet> sheet;
   nsresult rv = CreateSheet(nullptr, aElement, nullptr, eAuthorSheetFeatures,
-                            CORS_NONE, mDocument->GetReferrerPolicy(),
+                            CORS_NONE, aReferrerPolicy,
                             EmptyString(), // no inline integrity checks
                             false, false, aTitle, state, aIsAlternate,
                             &sheet);

layout/style/Loader.h

@@ -224,6 +224,7 @@ public:
    * @param aLineNumber the line number at which the stylesheet data started.
    * @param aTitle the title of the sheet.
    * @param aMedia the media string for the sheet.
+   * @param aReferrerPolicy the referrer policy for loading the sheet.
    * @param aObserver the observer to notify when the load completes.
    *        May be null.
    * @param [out] aCompleted whether parsing of the sheet completed.
@@ -237,6 +238,7 @@ public:
                            uint32_t aLineNumber,
                            const nsAString& aTitle,
                            const nsAString& aMedia,
+                           ReferrerPolicy aReferrerPolicy,
                            mozilla::dom::Element* aScopeElement,
                            nsICSSLoaderObserver* aObserver,
                            bool* aCompleted,

netwerk/protocol/http/HttpBaseChannel.cpp

@@ -1316,7 +1316,7 @@ HttpBaseChannel::SetReferrerWithPolicy(nsIURI *referrer,
   if(NS_FAILED(rv)) {
     return rv;
   }
-  mReferrerPolicy = REFERRER_POLICY_NO_REFERRER_WHEN_DOWNGRADE;
+  mReferrerPolicy = referrerPolicy;
 
   if (!referrer) {
     return NS_OK;
@@ -1324,7 +1324,6 @@ HttpBaseChannel::SetReferrerWithPolicy(nsIURI *referrer,
 
   // Don't send referrer at all when the meta referrer setting is "no-referrer"
   if (referrerPolicy == REFERRER_POLICY_NO_REFERRER) {
-    mReferrerPolicy = REFERRER_POLICY_NO_REFERRER;
     return NS_OK;
   }
 
@@ -1597,7 +1596,6 @@ HttpBaseChannel::SetReferrerWithPolicy(nsIURI *referrer,
   if (NS_FAILED(rv)) return rv;
 
   mReferrer = clone;
-  mReferrerPolicy = referrerPolicy;
   return NS_OK;
 }
 

netwerk/protocol/http/HttpChannelChild.cpp

@@ -1666,8 +1666,13 @@ NS_IMETHODIMP
 HttpChannelChild::OnRedirectVerifyCallback(nsresult result)
 {
   LOG(("HttpChannelChild::OnRedirectVerifyCallback [this=%p]\n", this));
-  OptionalURIParams redirectURI;
   nsresult rv;
+  OptionalURIParams redirectURI;
+
+  uint32_t referrerPolicy = REFERRER_POLICY_NO_REFERRER_WHEN_DOWNGRADE;
+  OptionalURIParams referrerURI;
+  SerializeURI(nullptr, referrerURI);
+
   nsCOMPtr<nsIHttpChannel> newHttpChannel =
       do_QueryInterface(mRedirectChannelChild);
 
@@ -1685,6 +1690,12 @@ HttpChannelChild::OnRedirectVerifyCallback(nsresult result)
   if (newHttpChannel) {
     // Must not be called until after redirect observers called.
     newHttpChannel->SetOriginalURI(mOriginalURI);
+
+    newHttpChannel->GetReferrerPolicy(&referrerPolicy);
+    nsCOMPtr<nsIURI> newChannelReferrerURI;
+    newHttpChannel->GetReferrer(getter_AddRefs(newChannelReferrerURI));
+
+    SerializeURI(newChannelReferrerURI, referrerURI);
   }
 
   if (mRedirectingForSubsequentSynthesizedResponse) {
@@ -1755,8 +1766,9 @@ HttpChannelChild::OnRedirectVerifyCallback(nsresult result)
   }
 
   if (mIPCOpen)
-    SendRedirect2Verify(result, *headerTuples, loadFlags, redirectURI,
-                        corsPreflightArgs, chooseAppcache);
+    SendRedirect2Verify(result, *headerTuples, loadFlags, referrerPolicy,
+                        referrerURI, redirectURI, corsPreflightArgs,
+                        chooseAppcache);
 
   return NS_OK;
 }
@@ -2132,6 +2144,25 @@ HttpChannelChild::ContinueAsyncOpen()
 // HttpChannelChild::nsIHttpChannel
 //-----------------------------------------------------------------------------
 
+NS_IMETHODIMP
+HttpChannelChild::SetReferrerWithPolicy(nsIURI *referrer,
+                                       uint32_t referrerPolicy)
+{
+  ENSURE_CALLED_BEFORE_CONNECT();
+
+  // remove old referrer if any, loop backwards
+  for (int i = mClientSetRequestHeaders.Length() - 1; i >= 0; --i) {
+    if (NS_LITERAL_CSTRING("Referer").Equals(mClientSetRequestHeaders[i].mHeader)) {
+      mClientSetRequestHeaders.RemoveElementAt(i);
+    }
+  }
+
+  nsresult rv = HttpBaseChannel::SetReferrerWithPolicy(referrer, referrerPolicy);
+  if (NS_FAILED(rv))
+    return rv;
+  return NS_OK;
+
+}
 NS_IMETHODIMP
 HttpChannelChild::SetRequestHeader(const nsACString& aHeader,
                                    const nsACString& aValue,

netwerk/protocol/http/HttpChannelChild.h

@@ -77,6 +77,7 @@ public:
   NS_IMETHOD AsyncOpen2(nsIStreamListener *aListener) override;
 
   // HttpBaseChannel::nsIHttpChannel
+  NS_IMETHOD SetReferrerWithPolicy(nsIURI *referrer, uint32_t referrerPolicy) override;
   NS_IMETHOD SetRequestHeader(const nsACString& aHeader,
                               const nsACString& aValue,
                               bool aMerge) override;

netwerk/protocol/http/HttpChannelParent.cpp

@@ -733,6 +733,8 @@ bool
 HttpChannelParent::RecvRedirect2Verify(const nsresult& result,
                                        const RequestHeaderTuples& changedHeaders,
                                        const uint32_t& loadFlags,
+                                       const uint32_t& referrerPolicy,
+                                       const OptionalURIParams& aReferrerURI,
                                        const OptionalURIParams& aAPIRedirectURI,
                                        const OptionalCorsPreflightArgs& aCorsPreflightArgs,
                                        const bool& aChooseAppcache)
@@ -773,6 +775,9 @@ HttpChannelParent::RecvRedirect2Verify(const nsresult& result,
         newInternalChannel->SetCorsPreflightParameters(args.unsafeHeaders());
       }
 
+      nsCOMPtr<nsIURI> referrerUri = DeserializeURI(aReferrerURI);
+      newHttpChannel->SetReferrerWithPolicy(referrerUri, referrerPolicy);
+
       nsCOMPtr<nsIApplicationCacheChannel> appCacheChannel =
         do_QueryInterface(newHttpChannel);
       if (appCacheChannel) {

netwerk/protocol/http/HttpChannelParent.h

@@ -159,6 +159,8 @@ protected:
   virtual bool RecvRedirect2Verify(const nsresult& result,
                                    const RequestHeaderTuples& changedHeaders,
                                    const uint32_t& loadFlags,
+                                   const uint32_t& referrerPolicy,
+                                   const OptionalURIParams& aReferrerURI,
                                    const OptionalURIParams& apiRedirectUri,
                                    const OptionalCorsPreflightArgs& aCorsPreflightArgs,
                                    const bool& aChooseAppcache) override;

netwerk/protocol/http/PHttpChannel.ipdl

@@ -44,7 +44,9 @@ parent:
 
   // Reports approval/veto of redirect by child process redirect observers
   async Redirect2Verify(nsresult result, RequestHeaderTuples changedHeaders,
-                        uint32_t loadFlags, OptionalURIParams apiRedirectTo,
+                        uint32_t loadFlags, uint32_t referrerPolicy,
+                        OptionalURIParams referrerUri,
+                        OptionalURIParams apiRedirectTo,
                         OptionalCorsPreflightArgs corsPreflightArgs,
                         bool chooseAppcache);
 

parser/html/nsHtml5SpeculativeLoad.cpp

@@ -28,16 +28,18 @@ nsHtml5SpeculativeLoad::Perform(nsHtml5TreeOpExecutor* aExecutor)
 {
   switch (mOpCode) {
     case eSpeculativeLoadBase:
-      aExecutor->SetSpeculationBase(mUrl);
+      aExecutor->SetSpeculationBase(mUrlOrSizes);
       break;
     case eSpeculativeLoadCSP:
-      aExecutor->AddSpeculationCSP(mMetaCSP);
+      aExecutor->AddSpeculationCSP(mTypeOrCharsetSourceOrDocumentModeOrMetaCSPOrSizesOrIntegrity);
       break;
     case eSpeculativeLoadMetaReferrer:
-      aExecutor->SetSpeculationReferrerPolicy(mReferrerPolicy);
+      aExecutor->SetSpeculationReferrerPolicy(mReferrerPolicyOrIntegrity);
       break;
     case eSpeculativeLoadImage:
-      aExecutor->PreloadImage(mUrl, mCrossOrigin, mSrcset, mSizes, mReferrerPolicy);
+      aExecutor->PreloadImage(mUrlOrSizes, mCrossOriginOrMedia, mCharsetOrSrcset,
+                              mTypeOrCharsetSourceOrDocumentModeOrMetaCSPOrSizesOrIntegrity,
+                              mReferrerPolicyOrIntegrity);
       break;
     case eSpeculativeLoadOpenPicture:
       aExecutor->PreloadOpenPicture();
@@ -46,55 +48,61 @@ nsHtml5SpeculativeLoad::Perform(nsHtml5TreeOpExecutor* aExecutor)
       aExecutor->PreloadEndPicture();
       break;
     case eSpeculativeLoadPictureSource:
-      aExecutor->PreloadPictureSource(mSrcset, mSizes, mTypeOrCharsetSourceOrDocumentMode,
-                                      mMedia);
+      aExecutor->PreloadPictureSource(mCharsetOrSrcset, mUrlOrSizes,
+                                      mTypeOrCharsetSourceOrDocumentModeOrMetaCSPOrSizesOrIntegrity,
+                                      mCrossOriginOrMedia);
       break;
     case eSpeculativeLoadScript:
-      aExecutor->PreloadScript(mUrl, mCharset, mTypeOrCharsetSourceOrDocumentMode,
-                               mCrossOrigin, mIntegrity, false,
+      aExecutor->PreloadScript(mUrlOrSizes, mCharsetOrSrcset,
+                               mTypeOrCharsetSourceOrDocumentModeOrMetaCSPOrSizesOrIntegrity,
+                               mCrossOriginOrMedia, mReferrerPolicyOrIntegrity, mScriptReferrerPolicy, false,
                                mIsAsync, mIsDefer, false);
       break;
     case eSpeculativeLoadScriptFromHead:
-      aExecutor->PreloadScript(mUrl, mCharset, mTypeOrCharsetSourceOrDocumentMode,
-                               mCrossOrigin, mIntegrity, true,
+      aExecutor->PreloadScript(mUrlOrSizes, mCharsetOrSrcset,
+                               mTypeOrCharsetSourceOrDocumentModeOrMetaCSPOrSizesOrIntegrity,
+                               mCrossOriginOrMedia, mReferrerPolicyOrIntegrity, mScriptReferrerPolicy, true,
                                mIsAsync, mIsDefer, false);
       break;
     case eSpeculativeLoadNoModuleScript:
-      aExecutor->PreloadScript(mUrl, mCharset, mTypeOrCharsetSourceOrDocumentMode,
-                               mCrossOrigin, mIntegrity, false,
+      aExecutor->PreloadScript(mUrlOrSizes, mCharsetOrSrcset,
+                               mTypeOrCharsetSourceOrDocumentModeOrMetaCSPOrSizesOrIntegrity,
+                               mCrossOriginOrMedia, mReferrerPolicyOrIntegrity, mScriptReferrerPolicy, false,
                                mIsAsync, mIsDefer, true);
       break;
     case eSpeculativeLoadNoModuleScriptFromHead:
-      aExecutor->PreloadScript(mUrl, mCharset, mTypeOrCharsetSourceOrDocumentMode,
-                               mCrossOrigin, mIntegrity, true,
+      aExecutor->PreloadScript(mUrlOrSizes, mCharsetOrSrcset,
+                               mTypeOrCharsetSourceOrDocumentModeOrMetaCSPOrSizesOrIntegrity,
+                               mCrossOriginOrMedia, mReferrerPolicyOrIntegrity, mScriptReferrerPolicy, true,
                                mIsAsync, mIsDefer, true);
       break;
     case eSpeculativeLoadStyle:
-      aExecutor->PreloadStyle(mUrl, mCharset, mCrossOrigin, mIntegrity);
+      aExecutor->PreloadStyle(mUrlOrSizes, mCharsetOrSrcset, mCrossOriginOrMedia, mReferrerPolicyOrIntegrity,
+                              mTypeOrCharsetSourceOrDocumentModeOrMetaCSPOrSizesOrIntegrity);
       break;
     case eSpeculativeLoadManifest:
-      aExecutor->ProcessOfflineManifest(mUrl);
+      aExecutor->ProcessOfflineManifest(mUrlOrSizes);
       break;
     case eSpeculativeLoadSetDocumentCharset: {
         nsAutoCString narrowName;
-        CopyUTF16toUTF8(mCharset, narrowName);
-        NS_ASSERTION(mTypeOrCharsetSourceOrDocumentMode.Length() == 1,
+        CopyUTF16toUTF8(mCharsetOrSrcset, narrowName);
+        NS_ASSERTION(mTypeOrCharsetSourceOrDocumentModeOrMetaCSPOrSizesOrIntegrity.Length() == 1,
             "Unexpected charset source string");
-        int32_t intSource = (int32_t)mTypeOrCharsetSourceOrDocumentMode.First();
+        int32_t intSource = (int32_t)mTypeOrCharsetSourceOrDocumentModeOrMetaCSPOrSizesOrIntegrity.First();
         aExecutor->SetDocumentCharsetAndSource(narrowName,
                                                intSource);
       }
       break;
     case eSpeculativeLoadSetDocumentMode: {
-        NS_ASSERTION(mTypeOrCharsetSourceOrDocumentMode.Length() == 1,
+        NS_ASSERTION(mTypeOrCharsetSourceOrDocumentModeOrMetaCSPOrSizesOrIntegrity.Length() == 1,
             "Unexpected document mode string");
         nsHtml5DocumentMode mode =
-            (nsHtml5DocumentMode)mTypeOrCharsetSourceOrDocumentMode.First();
+            (nsHtml5DocumentMode)mTypeOrCharsetSourceOrDocumentModeOrMetaCSPOrSizesOrIntegrity.First();
         aExecutor->SetDocumentMode(mode);
       }
       break;
     case eSpeculativeLoadPreconnect:
-      aExecutor->Preconnect(mUrl, mCrossOrigin);
+      aExecutor->Preconnect(mUrlOrSizes, mCrossOriginOrMedia);
       break;
     default:
       NS_NOTREACHED("Bogus speculative load.");

parser/html/nsHtml5SpeculativeLoad.h

@@ -7,6 +7,7 @@
 
 #include "nsString.h"
 #include "nsContentUtils.h"
+#include "mozilla/net/ReferrerPolicy.h"
 
 class nsHtml5TreeOpExecutor;
 
@@ -43,7 +44,7 @@ class nsHtml5SpeculativeLoad {
       NS_PRECONDITION(mOpCode == eSpeculativeLoadUninitialized,
                       "Trying to reinitialize a speculative load!");
       mOpCode = eSpeculativeLoadBase;
-      aUrl.ToString(mUrl);
+      aUrl.ToString(mUrlOrSizes);
     }
 
     inline void InitMetaCSP(nsHtml5String aCSP)
@@ -53,7 +54,7 @@ class nsHtml5SpeculativeLoad {
       mOpCode = eSpeculativeLoadCSP;
       nsString csp; // Not Auto, because using it to hold nsStringBuffer*
       aCSP.ToString(csp);
-      mMetaCSP.Assign(
+      mTypeOrCharsetSourceOrDocumentModeOrMetaCSPOrSizesOrIntegrity.Assign(
         nsContentUtils::TrimWhitespace<nsContentUtils::IsHTMLWhitespace>(csp));
     }
 
@@ -65,7 +66,7 @@ class nsHtml5SpeculativeLoad {
       nsString
         referrerPolicy; // Not Auto, because using it to hold nsStringBuffer*
       aReferrerPolicy.ToString(referrerPolicy);
-      mReferrerPolicy.Assign(
+      mReferrerPolicyOrIntegrity.Assign(
         nsContentUtils::TrimWhitespace<nsContentUtils::IsHTMLWhitespace>(
           referrerPolicy));
     }
@@ -79,16 +80,16 @@ class nsHtml5SpeculativeLoad {
       NS_PRECONDITION(mOpCode == eSpeculativeLoadUninitialized,
                       "Trying to reinitialize a speculative load!");
       mOpCode = eSpeculativeLoadImage;
-      aUrl.ToString(mUrl);
-      aCrossOrigin.ToString(mCrossOrigin);
+      aUrl.ToString(mUrlOrSizes);
+      aCrossOrigin.ToString(mCrossOriginOrMedia);
       nsString
         referrerPolicy; // Not Auto, because using it to hold nsStringBuffer*
       aReferrerPolicy.ToString(referrerPolicy);
-      mReferrerPolicy.Assign(
+      mReferrerPolicyOrIntegrity.Assign(
         nsContentUtils::TrimWhitespace<nsContentUtils::IsHTMLWhitespace>(
           referrerPolicy));
-      aSrcset.ToString(mSrcset);
-      aSizes.ToString(mSizes);
+      aSrcset.ToString(mCharsetOrSrcset);
+      aSizes.ToString(mTypeOrCharsetSourceOrDocumentModeOrMetaCSPOrSizesOrIntegrity);
     }
 
     // <picture> elements have multiple <source> nodes followed by an <img>,
@@ -120,10 +121,10 @@ class nsHtml5SpeculativeLoad {
       NS_PRECONDITION(mOpCode == eSpeculativeLoadUninitialized,
                       "Trying to reinitialize a speculative load!");
       mOpCode = eSpeculativeLoadPictureSource;
-      aSrcset.ToString(mSrcset);
-      aSizes.ToString(mSizes);
-      aType.ToString(mTypeOrCharsetSourceOrDocumentMode);
-      aMedia.ToString(mMedia);
+      aSrcset.ToString(mCharsetOrSrcset);
+      aSizes.ToString(mUrlOrSizes);
+      aType.ToString(mTypeOrCharsetSourceOrDocumentModeOrMetaCSPOrSizesOrIntegrity);
+      aMedia.ToString(mCrossOriginOrMedia);
     }
 
     inline void InitScript(nsHtml5String aUrl,
@@ -131,6 +132,7 @@ class nsHtml5SpeculativeLoad {
                            nsHtml5String aType,
                            nsHtml5String aCrossOrigin,
                            nsHtml5String aIntegrity,
+                           nsHtml5String aReferrerPolicy,
                            bool aParserInHead,
                            bool aAsync,
                            bool aDefer,
@@ -145,11 +147,19 @@ class nsHtml5SpeculativeLoad {
           mOpCode = aParserInHead ? eSpeculativeLoadScriptFromHead
                                   : eSpeculativeLoadScript;
       }
-      aUrl.ToString(mUrl);
-      aCharset.ToString(mCharset);
-      aType.ToString(mTypeOrCharsetSourceOrDocumentMode);
-      aCrossOrigin.ToString(mCrossOrigin);
-      aIntegrity.ToString(mIntegrity);
+      aUrl.ToString(mUrlOrSizes);
+      aCharset.ToString(mCharsetOrSrcset);
+      aType.ToString(mTypeOrCharsetSourceOrDocumentModeOrMetaCSPOrSizesOrIntegrity);
+      aCrossOrigin.ToString(mCrossOriginOrMedia);
+      aIntegrity.ToString(mReferrerPolicyOrIntegrity);
+      nsAutoString referrerPolicy;
+      aReferrerPolicy.ToString(referrerPolicy);
+      referrerPolicy =
+        nsContentUtils::TrimWhitespace<
+        nsContentUtils::IsHTMLWhitespace>(referrerPolicy);
+      mScriptReferrerPolicy =
+        mozilla::net::AttributeReferrerPolicyFromString(referrerPolicy);
+
       mIsAsync = aAsync;
       mIsDefer = aDefer;
     }
@@ -157,15 +167,22 @@ class nsHtml5SpeculativeLoad {
     inline void InitStyle(nsHtml5String aUrl,
                           nsHtml5String aCharset,
                           nsHtml5String aCrossOrigin,
+                          nsHtml5String aReferrerPolicy,
                           nsHtml5String aIntegrity)
     {
       NS_PRECONDITION(mOpCode == eSpeculativeLoadUninitialized,
                       "Trying to reinitialize a speculative load!");
       mOpCode = eSpeculativeLoadStyle;
-      aUrl.ToString(mUrl);
-      aCharset.ToString(mCharset);
-      aCrossOrigin.ToString(mCrossOrigin);
-      aIntegrity.ToString(mIntegrity);
+      aUrl.ToString(mUrlOrSizes);
+      aCharset.ToString(mCharsetOrSrcset);
+      aCrossOrigin.ToString(mCrossOriginOrMedia);
+      nsString
+        referrerPolicy; // Not Auto, because using it to hold nsStringBuffer*
+      aReferrerPolicy.ToString(referrerPolicy);
+      mReferrerPolicyOrIntegrity.Assign(
+        nsContentUtils::TrimWhitespace<nsContentUtils::IsHTMLWhitespace>(
+          referrerPolicy));
+      aIntegrity.ToString(mTypeOrCharsetSourceOrDocumentModeOrMetaCSPOrSizesOrIntegrity);
     }
 
     /**
@@ -184,7 +201,7 @@ class nsHtml5SpeculativeLoad {
       NS_PRECONDITION(mOpCode == eSpeculativeLoadUninitialized,
                       "Trying to reinitialize a speculative load!");
       mOpCode = eSpeculativeLoadManifest;
-      aUrl.ToString(mUrl);
+      aUrl.ToString(mUrlOrSizes);
     }
 
     /**
@@ -203,8 +220,8 @@ class nsHtml5SpeculativeLoad {
       NS_PRECONDITION(mOpCode == eSpeculativeLoadUninitialized,
                       "Trying to reinitialize a speculative load!");
       mOpCode = eSpeculativeLoadSetDocumentCharset;
-      CopyUTF8toUTF16(aCharset, mCharset);
-      mTypeOrCharsetSourceOrDocumentMode.Assign((char16_t)aCharsetSource);
+      CopyUTF8toUTF16(aCharset, mCharsetOrSrcset);
+      mTypeOrCharsetSourceOrDocumentModeOrMetaCSPOrSizesOrIntegrity.Assign((char16_t)aCharsetSource);
     }
 
     /**
@@ -218,7 +235,7 @@ class nsHtml5SpeculativeLoad {
       NS_PRECONDITION(mOpCode == eSpeculativeLoadUninitialized,
                       "Trying to reinitialize a speculative load!");
       mOpCode = eSpeculativeLoadSetDocumentMode;
-      mTypeOrCharsetSourceOrDocumentMode.Assign((char16_t)aMode);
+      mTypeOrCharsetSourceOrDocumentModeOrMetaCSPOrSizesOrIntegrity.Assign((char16_t)aMode);
     }
 
     inline void InitPreconnect(nsHtml5String aUrl, nsHtml5String aCrossOrigin)
@@ -226,8 +243,8 @@ class nsHtml5SpeculativeLoad {
       NS_PRECONDITION(mOpCode == eSpeculativeLoadUninitialized,
                       "Trying to reinitialize a speculative load!");
       mOpCode = eSpeculativeLoadPreconnect;
-      aUrl.ToString(mUrl);
-      aCrossOrigin.ToString(mCrossOrigin);
+      aUrl.ToString(mUrlOrSizes);
+      aCrossOrigin.ToString(mCrossOriginOrMedia);
     }
 
     void Perform(nsHtml5TreeOpExecutor* aExecutor);
@@ -241,55 +258,56 @@ class nsHtml5SpeculativeLoad {
     bool mIsAsync;
     bool mIsDefer;
 
-    nsString mUrl;
-    nsString mReferrerPolicy;
-    nsString mMetaCSP;
+    /* If mOpCode is eSpeculativeLoadPictureSource, this is the value of the
+     * "sizes" attribute. If the attribute is not set, this will be a void
+     * string. Otherwise it empty or the value of the url.
+     */
+    nsString mUrlOrSizes;
+    /**
+     * If mOpCode is eSpeculativeLoadScript[FromHead], this is the value of the
+     * "integrity" attribute. If the attribute is not set, this will be a void
+     * string. Otherwise it is empty or the value of the referrer policy.
+     */
+    nsString mReferrerPolicyOrIntegrity;
 
     /**
      * If mOpCode is eSpeculativeLoadStyle or eSpeculativeLoadScript[FromHead]
      * then this is the value of the "charset" attribute. For
      * eSpeculativeLoadSetDocumentCharset it is the charset that the
-     * document's charset is being set to. Otherwise it's empty.
+     * document's charset is being set to. If mOpCode is eSpeculativeLoadImage
+     * or eSpeculativeLoadPictureSource, this is the value of the "srcset" attribute.
+     * If the attribute is not set, this will be a void string. Otherwise it's empty.
      */
-    nsString mCharset;
+    nsString mCharsetOrSrcset;
     /**
      * If mOpCode is eSpeculativeLoadSetDocumentCharset, this is a
      * one-character string whose single character's code point is to be
      * interpreted as a charset source integer. If mOpCode is
      * eSpeculativeLoadSetDocumentMode, this is a one-character string whose
      * single character's code point is to be interpreted as an
-     * nsHtml5DocumentMode. Otherwise, it is empty or the value of the type
-     * attribute.
+     * nsHtml5DocumentMode. If mOpCode is eSpeculativeLoadCSP, this is a meta
+     * element's CSP value. If mOpCode is eSpeculativeLoadImage, this is the
+     * value of the "sizes" attribute. If the attribute is not set, this will
+     * be a void string. If mOpCode is eSpeculativeLoadStyle, this
+     * is the value of the "integrity" attribute. If the attribute is not set,
+     * this will be a void string. Otherwise it is empty or the value of the
+     * referrer policy. Otherwise, it is empty or the value of the type attribute.
      */
-    nsString mTypeOrCharsetSourceOrDocumentMode;
+    nsString mTypeOrCharsetSourceOrDocumentModeOrMetaCSPOrSizesOrIntegrity;
     /**
      * If mOpCode is eSpeculativeLoadImage or eSpeculativeLoadScript[FromHead]
      * or eSpeculativeLoadPreconnect this is the value of the "crossorigin"
      * attribute.  If the attribute is not set, this will be a void string.
+     * If mOpCode is eSpeculativeLoadPictureSource, this is the value of the
+     * "media" attribute.  If the attribute is not set, this will be a void string.
      */
-    nsString mCrossOrigin;
+    nsString mCrossOriginOrMedia;
     /**
-     * If mOpCode is eSpeculativeLoadImage or eSpeculativeLoadPictureSource,
-     * this is the value of "srcset" attribute.  If the attribute is not set,
-     * this will be a void string.
+     * If mOpCode is eSpeculativeLoadScript[FromHead] this represents the value
+     * of the "referrerpolicy" attribute. This field holds one of the values
+     * (REFERRER_POLICY_*) defined in nsIHttpChannel.
      */
-    nsString mSrcset;
-    /**
-     * If mOpCode is eSpeculativeLoadPictureSource, this is the value of "sizes"
-     * attribute.  If the attribute is not set, this will be a void string.
-     */
-    nsString mSizes;
-    /**
-     * If mOpCode is eSpeculativeLoadPictureSource, this is the value of "media"
-     * attribute.  If the attribute is not set, this will be a void string.
-     */
-    nsString mMedia;
-    /**
-     * If mOpCode is eSpeculativeLoadScript[FromHead], this is the value of the
-     * "integrity" attribute.  If the attribute is not set, this will be a void
-     * string.
-     */
-    nsString mIntegrity;
+    mozilla::net::ReferrerPolicy mScriptReferrerPolicy;
 };
 
 #endif // nsHtml5SpeculativeLoad_h

parser/html/nsHtml5TreeBuilderCppSupplement.h

@@ -184,6 +184,8 @@ nsHtml5TreeBuilder::createElement(int32_t aNamespace,
               aAttributes->getValue(nsHtml5AttributeName::ATTR_CROSSORIGIN);
             nsHtml5String integrity =
               aAttributes->getValue(nsHtml5AttributeName::ATTR_INTEGRITY);
+            nsHtml5String referrerPolicy =
+              aAttributes->getValue(nsHtml5AttributeName::ATTR_REFERRERPOLICY);
             bool async =
               aAttributes->contains(nsHtml5AttributeName::ATTR_ASYNC);
             bool defer =
@@ -196,6 +198,7 @@ nsHtml5TreeBuilder::createElement(int32_t aNamespace,
               type,
               crossOrigin,
               integrity,
+              referrerPolicy,
               mode == nsHtml5TreeBuilder::IN_HEAD,
               async,
               defer,
@@ -218,8 +221,10 @@ nsHtml5TreeBuilder::createElement(int32_t aNamespace,
                   aAttributes->getValue(nsHtml5AttributeName::ATTR_CROSSORIGIN);
                 nsHtml5String integrity =
                   aAttributes->getValue(nsHtml5AttributeName::ATTR_INTEGRITY);
+                nsHtml5String referrerPolicy =
+                  aAttributes->getValue(nsHtml5AttributeName::ATTR_REFERRERPOLICY);
                 mSpeculativeLoadQueue.AppendElement()->InitStyle(
-                  url, charset, crossOrigin, integrity);
+                  url, charset, crossOrigin, referrerPolicy, integrity);
               }
             } else if (rel.LowerCaseEqualsASCII("preconnect")) {
               nsHtml5String url =
@@ -245,12 +250,15 @@ nsHtml5TreeBuilder::createElement(int32_t aNamespace,
                     aAttributes->getValue(nsHtml5AttributeName::ATTR_CROSSORIGIN);
                   nsHtml5String integrity =
                     aAttributes->getValue(nsHtml5AttributeName::ATTR_INTEGRITY);
+                  nsHtml5String referrerPolicy =
+                    aAttributes->getValue(nsHtml5AttributeName::ATTR_REFERRERPOLICY);
                   mSpeculativeLoadQueue.AppendElement()->InitScript(
                     url,
                     charset,
                     type,
                     crossOrigin,
                     integrity,
+                    referrerPolicy,
                     mode == nsHtml5TreeBuilder::IN_HEAD,
                     false,
                     false,
@@ -263,8 +271,10 @@ nsHtml5TreeBuilder::createElement(int32_t aNamespace,
                     aAttributes->getValue(nsHtml5AttributeName::ATTR_CROSSORIGIN);
                   nsHtml5String integrity =
                     aAttributes->getValue(nsHtml5AttributeName::ATTR_INTEGRITY);
+                  nsHtml5String referrerPolicy =
+                    aAttributes->getValue(nsHtml5AttributeName::ATTR_REFERRERPOLICY);
                   mSpeculativeLoadQueue.AppendElement()->InitStyle(
-                    url, charset, crossOrigin, integrity);
+                    url, charset, crossOrigin, referrerPolicy, integrity);
                 } else if (preloadAs.LowerCaseEqualsASCII("image")) {
                   nsHtml5String srcset =
                     aAttributes->getValue(nsHtml5AttributeName::ATTR_SRCSET);
@@ -345,12 +355,15 @@ nsHtml5TreeBuilder::createElement(int32_t aNamespace,
               aAttributes->getValue(nsHtml5AttributeName::ATTR_CROSSORIGIN);
             nsHtml5String integrity =
               aAttributes->getValue(nsHtml5AttributeName::ATTR_INTEGRITY);
+            nsHtml5String referrerPolicy =
+              aAttributes->getValue(nsHtml5AttributeName::ATTR_REFERRERPOLICY);
             mSpeculativeLoadQueue.AppendElement()->InitScript(
               url,
               nullptr,
               type,
               crossOrigin,
               integrity,
+              referrerPolicy,
               mode == nsHtml5TreeBuilder::IN_HEAD,
               false /* async */, 
               false /* defer */,
@@ -368,8 +381,10 @@ nsHtml5TreeBuilder::createElement(int32_t aNamespace,
               aAttributes->getValue(nsHtml5AttributeName::ATTR_CROSSORIGIN);
             nsHtml5String integrity =
               aAttributes->getValue(nsHtml5AttributeName::ATTR_INTEGRITY);
+            nsHtml5String referrerPolicy =
+              aAttributes->getValue(nsHtml5AttributeName::ATTR_REFERRERPOLICY);
             mSpeculativeLoadQueue.AppendElement()->InitStyle(
-              url, nullptr, crossOrigin, integrity);
+              url, nullptr, crossOrigin, referrerPolicy, integrity);
           }
         }
         break;

parser/html/nsHtml5TreeOpExecutor.cpp

@@ -914,12 +914,23 @@ nsHtml5TreeOpExecutor::ShouldPreloadURI(nsIURI *aURI)
   return true;
 }
 
+net::ReferrerPolicy
+nsHtml5TreeOpExecutor::GetPreloadReferrerPolicy(
+  const nsAString& aReferrerPolicy)
+{
+  net::ReferrerPolicy referrerPolicy =
+    net::AttributeReferrerPolicyFromString(aReferrerPolicy);
+ return referrerPolicy != net::RP_Unset ? referrerPolicy :
+                                          mSpeculationReferrerPolicy;
+}
+
 void
 nsHtml5TreeOpExecutor::PreloadScript(const nsAString& aURL,
                                      const nsAString& aCharset,
                                      const nsAString& aType,
                                      const nsAString& aCrossOrigin,
                                      const nsAString& aIntegrity,
+                                     net::ReferrerPolicy aReferrerPolicy,
                                      bool aScriptFromHead,
                                      bool aAsync,
                                      bool aDefer,
@@ -929,24 +940,35 @@ nsHtml5TreeOpExecutor::PreloadScript(const nsAString& aURL,
   if (!uri) {
     return;
   }
-  mDocument->ScriptLoader()->PreloadURI(uri, aCharset, aType, aCrossOrigin,
-                                        aIntegrity, aScriptFromHead, aAsync,
-                                        aDefer, aNoModule,
-                                        mSpeculationReferrerPolicy);
+  net::ReferrerPolicy referrerPolicy = aReferrerPolicy != net::RP_Unset ?
+    aReferrerPolicy : mSpeculationReferrerPolicy;
+  mDocument->ScriptLoader()
+           ->PreloadURI(uri,
+                        aCharset,
+                        aType,
+                        aCrossOrigin,
+                        aIntegrity,
+                        aScriptFromHead,
+                        aAsync,
+                        aDefer,
+                        aNoModule,
+                        referrerPolicy);
 }
 
 void
 nsHtml5TreeOpExecutor::PreloadStyle(const nsAString& aURL,
                                     const nsAString& aCharset,
                                     const nsAString& aCrossOrigin,
+                                    const nsAString& aReferrerPolicy,
                                     const nsAString& aIntegrity)
 {
   nsCOMPtr<nsIURI> uri = ConvertIfNotPreloadedYet(aURL);
   if (!uri) {
     return;
   }
-  mDocument->PreloadStyle(uri, aCharset, aCrossOrigin,
-                          mSpeculationReferrerPolicy, aIntegrity);
+
+  mDocument->PreloadStyle(uri, aCharset, aCrossOrigin, GetPreloadReferrerPolicy(aReferrerPolicy),
+                          aIntegrity);
 }
 
 void
@@ -962,18 +984,10 @@ nsHtml5TreeOpExecutor::PreloadImage(const nsAString& aURL,
                                                         aSizes, &isImgSet);
   if (uri && ShouldPreloadURI(uri)) {
     // use document wide referrer policy
-    mozilla::net::ReferrerPolicy referrerPolicy = mSpeculationReferrerPolicy;
-    // if enabled in preferences, use the referrer attribute from the image, if provided
-    bool referrerAttributeEnabled = Preferences::GetBool("network.http.enablePerElementReferrer", true);
-    if (referrerAttributeEnabled) {
-      mozilla::net::ReferrerPolicy imageReferrerPolicy =
-        mozilla::net::AttributeReferrerPolicyFromString(aImageReferrerPolicy);
-      if (imageReferrerPolicy != mozilla::net::RP_Unset) {
-        referrerPolicy = imageReferrerPolicy;
-      }
-    }
-
-    mDocument->MaybePreLoadImage(uri, aCrossOrigin, referrerPolicy, isImgSet);
+    mDocument->MaybePreLoadImage(uri,
+                                 aCrossOrigin,
+                                 GetPreloadReferrerPolicy(aImageReferrerPolicy),
+                                 isImgSet);
   }
 }
 

parser/html/nsHtml5TreeOpExecutor.h

@@ -249,6 +249,7 @@ class nsHtml5TreeOpExecutor final : public nsHtml5DocumentBuilder,
                        const nsAString& aType,
                        const nsAString& aCrossOrigin,
                        const nsAString& aIntegrity,
+                       ReferrerPolicy aReferrerPolicy,
                        bool aScriptFromHead,
                        bool aAsync,
                        bool aDefer,
@@ -256,6 +257,7 @@ class nsHtml5TreeOpExecutor final : public nsHtml5DocumentBuilder,
 
     void PreloadStyle(const nsAString& aURL, const nsAString& aCharset,
                       const nsAString& aCrossOrigin,
+                      const nsAString& aReferrerPolicy,
                       const nsAString& aIntegrity);
 
     void PreloadImage(const nsAString& aURL,
@@ -304,6 +306,8 @@ class nsHtml5TreeOpExecutor final : public nsHtml5DocumentBuilder,
      * list of preloaded URIs
      */
     bool ShouldPreloadURI(nsIURI *aURI);
+
+    ReferrerPolicy GetPreloadReferrerPolicy(const nsAString& aReferrerPolicy);
 };
 
 #endif // nsHtml5TreeOpExecutor_h