Adding upstream version 124.0.1.upstream/124.0.1

Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>

1 files changed, 4338 insertions, 0 deletions

diff --git a/dom/xhr/XMLHttpRequestMainThread.cpp b/dom/xhr/XMLHttpRequestMainThread.cpp
new file mode 100644
index 0000000000..dc256b10c2
--- /dev/null
+++ b/dom/xhr/XMLHttpRequestMainThread.cpp
@@ -0,0 +1,4338 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "XMLHttpRequestMainThread.h"
+
+#include <algorithm>
+#ifndef XP_WIN
+#  include <unistd.h>
+#endif
+#include "mozilla/ArrayUtils.h"
+#include "mozilla/BasePrincipal.h"
+#include "mozilla/CheckedInt.h"
+#include "mozilla/Components.h"
+#include "mozilla/dom/AutoSuppressEventHandlingAndSuspend.h"
+#include "mozilla/dom/BlobBinding.h"
+#include "mozilla/dom/BlobURLProtocolHandler.h"
+#include "mozilla/dom/DocGroup.h"
+#include "mozilla/dom/DOMString.h"
+#include "mozilla/dom/File.h"
+#include "mozilla/dom/FileBinding.h"
+#include "mozilla/dom/FileCreatorHelper.h"
+#include "mozilla/dom/FetchUtil.h"
+#include "mozilla/dom/FormData.h"
+#include "mozilla/dom/quota/QuotaCommon.h"
+#include "mozilla/dom/MutableBlobStorage.h"
+#include "mozilla/dom/XMLDocument.h"
+#include "mozilla/dom/URLSearchParams.h"
+#include "mozilla/dom/UserActivation.h"
+#include "mozilla/dom/Promise.h"
+#include "mozilla/dom/PromiseNativeHandler.h"
+#include "mozilla/dom/ReferrerInfo.h"
+#include "mozilla/dom/WorkerError.h"
+#include "mozilla/Encoding.h"
+#include "mozilla/EventDispatcher.h"
+#include "mozilla/EventListenerManager.h"
+#include "mozilla/HoldDropJSObjects.h"
+#include "mozilla/LoadInfo.h"
+#include "mozilla/LoadContext.h"
+#include "mozilla/MemoryReporting.h"
+#include "mozilla/PreloaderBase.h"
+#include "mozilla/ScopeExit.h"
+#include "mozilla/SpinEventLoopUntil.h"
+#include "mozilla/StaticPrefs_dom.h"
+#include "mozilla/StaticPrefs_network.h"
+#include "mozilla/StaticPrefs_privacy.h"
+#include "mozilla/dom/ProgressEvent.h"
+#include "nsDataChannel.h"
+#include "nsIJARChannel.h"
+#include "nsIJARURI.h"
+#include "nsLayoutCID.h"
+#include "nsReadableUtils.h"
+#include "nsSandboxFlags.h"
+
+#include "nsIURI.h"
+#include "nsIURIMutator.h"
+#include "nsILoadGroup.h"
+#include "nsNetUtil.h"
+#include "nsStringStream.h"
+#include "nsIAuthPrompt.h"
+#include "nsIAuthPrompt2.h"
+#include "nsIClassOfService.h"
+#include "nsIHttpChannel.h"
+#include "nsISupportsPriority.h"
+#include "nsIInterfaceRequestorUtils.h"
+#include "nsStreamUtils.h"
+#include "nsThreadUtils.h"
+#include "nsIUploadChannel.h"
+#include "nsIUploadChannel2.h"
+#include "nsXPCOM.h"
+#include "nsIDOMEventListener.h"
+#include "nsVariant.h"
+#include "nsIScriptError.h"
+#include "nsICachingChannel.h"
+#include "nsICookieJarSettings.h"
+#include "nsContentUtils.h"
+#include "nsCycleCollectionParticipant.h"
+#include "nsError.h"
+#include "nsIPromptFactory.h"
+#include "nsIWindowWatcher.h"
+#include "nsIConsoleService.h"
+#include "nsAsyncRedirectVerifyHelper.h"
+#include "nsStringBuffer.h"
+#include "nsIFileChannel.h"
+#include "mozilla/Telemetry.h"
+#include "js/ArrayBuffer.h"  // JS::{Create,Release}MappedArrayBufferContents,New{,Mapped}ArrayBufferWithContents
+#include "js/JSON.h"         // JS_ParseJSON
+#include "js/MemoryFunctions.h"
+#include "js/RootingAPI.h"  // JS::{{,Mutable}Handle,Rooted}
+#include "js/Value.h"       // JS::{,Undefined}Value
+#include "jsapi.h"          // JS_ClearPendingException
+#include "GeckoProfiler.h"
+#include "mozilla/dom/XMLHttpRequestBinding.h"
+#include "mozilla/Attributes.h"
+#include "MultipartBlobImpl.h"
+#include "nsIPermissionManager.h"
+#include "nsMimeTypes.h"
+#include "nsIHttpChannelInternal.h"
+#include "nsCharSeparatedTokenizer.h"
+#include "nsStreamListenerWrapper.h"
+#include "nsITimedChannel.h"
+#include "nsWrapperCacheInlines.h"
+#include "nsZipArchive.h"
+#include "mozilla/Preferences.h"
+#include "private/pprio.h"
+#include "XMLHttpRequestUpload.h"
+
+// Undefine the macro of CreateFile to avoid FileCreatorHelper#CreateFile being
+// replaced by FileCreatorHelper#CreateFileW.
+#ifdef CreateFile
+#  undef CreateFile
+#endif
+
+extern mozilla::LazyLogModule gXMLHttpRequestLog;
+
+using namespace mozilla::net;
+
+namespace mozilla::dom {
+
+using EventType = XMLHttpRequest::EventType;
+using Events = XMLHttpRequest::Events;
+
+// Maximum size that we'll grow an ArrayBuffer instead of doubling,
+// once doubling reaches this threshold
+const uint32_t XML_HTTP_REQUEST_ARRAYBUFFER_MAX_GROWTH = 32 * 1024 * 1024;
+// start at 32k to avoid lots of doubling right at the start
+const uint32_t XML_HTTP_REQUEST_ARRAYBUFFER_MIN_SIZE = 32 * 1024;
+// the maximum Content-Length that we'll preallocate.  1GB.  Must fit
+// in an int32_t!
+const int32_t XML_HTTP_REQUEST_MAX_CONTENT_LENGTH_PREALLOCATE =
+    1 * 1024 * 1024 * 1024LL;
+
+namespace {
+const nsString kLiteralString_readystatechange = u"readystatechange"_ns;
+const nsString kLiteralString_xmlhttprequest = u"xmlhttprequest"_ns;
+const nsString kLiteralString_DOMContentLoaded = u"DOMContentLoaded"_ns;
+const nsCString kLiteralString_charset = "charset"_ns;
+const nsCString kLiteralString_UTF_8 = "UTF-8"_ns;
+}  // namespace
+
+#define NS_PROGRESS_EVENT_INTERVAL 50
+#define MAX_SYNC_TIMEOUT_WHEN_UNLOADING 10000 /* 10 secs */
+
+NS_IMPL_ISUPPORTS(nsXHRParseEndListener, nsIDOMEventListener)
+
+class nsResumeTimeoutsEvent : public Runnable {
+ public:
+  explicit nsResumeTimeoutsEvent(nsPIDOMWindowInner* aWindow)
+      : Runnable("dom::nsResumeTimeoutsEvent"), mWindow(aWindow) {}
+
+  NS_IMETHOD Run() override {
+    mWindow->Resume();
+    return NS_OK;
+  }
+
+ private:
+  nsCOMPtr<nsPIDOMWindowInner> mWindow;
+};
+
+// This helper function adds the given load flags to the request's existing
+// load flags.
+static void AddLoadFlags(nsIRequest* request, nsLoadFlags newFlags) {
+  nsLoadFlags flags;
+  request->GetLoadFlags(&flags);
+  flags |= newFlags;
+  request->SetLoadFlags(flags);
+}
+
+// We are in a sync event loop.
+#define NOT_CALLABLE_IN_SYNC_SEND_RV                               \
+  if (mFlagSyncLooping || mEventDispatchingSuspended) {            \
+    aRv.Throw(NS_ERROR_DOM_INVALID_STATE_XHR_HAS_INVALID_CONTEXT); \
+    return;                                                        \
+  }
+
+/////////////////////////////////////////////
+//
+//
+/////////////////////////////////////////////
+
+#ifdef DEBUG
+
+// In debug mode, annotate WorkerRefs with the name of the function being
+// invoked for increased scrutability.  Save the previous value on the stack.
+namespace {
+struct DebugWorkerRefs {
+  RefPtr<ThreadSafeWorkerRef>& mTSWorkerRef;
+  nsCString mPrev;
+
+  DebugWorkerRefs(RefPtr<ThreadSafeWorkerRef>& aTSWorkerRef,
+                  const std::string& aStatus)
+      : mTSWorkerRef(aTSWorkerRef) {
+    if (!mTSWorkerRef) {
+      MOZ_LOG(gXMLHttpRequestLog, LogLevel::Info,
+              ("No WorkerRef during: %s", aStatus.c_str()));
+      return;
+    }
+
+    MOZ_ASSERT(mTSWorkerRef->Private());
+
+    nsCString status(aStatus.c_str());
+    mPrev = GET_WORKERREF_DEBUG_STATUS(mTSWorkerRef->Ref());
+    SET_WORKERREF_DEBUG_STATUS(mTSWorkerRef->Ref(), status);
+  }
+
+  ~DebugWorkerRefs() {
+    if (!mTSWorkerRef) {
+      return;
+    }
+
+    MOZ_ASSERT(mTSWorkerRef->Private());
+
+    SET_WORKERREF_DEBUG_STATUS(mTSWorkerRef->Ref(), mPrev);
+  }
+};
+}  // namespace
+
+#  define STREAM_STRING(stuff)                                    \
+    (((const std::ostringstream&)(std::ostringstream() << stuff)) \
+         .str())  // NOLINT
+#  define DEBUG_WORKERREFS \
+    DebugWorkerRefs MOZ_UNIQUE_VAR(debugWR__)(mTSWorkerRef, __func__)
+#  define DEBUG_WORKERREFS1(x)                 \
+    DebugWorkerRefs MOZ_UNIQUE_VAR(debugWR__)( \
+        mTSWorkerRef, STREAM_STRING(__func__ << ": " << x))  // NOLINT
+
+#else
+#  define DEBUG_WORKERREFS void()
+#  define DEBUG_WORKERREFS1(x) void()
+#endif  // DEBUG
+
+bool XMLHttpRequestMainThread::sDontWarnAboutSyncXHR = false;
+
+XMLHttpRequestMainThread::XMLHttpRequestMainThread(
+    nsIGlobalObject* aGlobalObject)
+    : XMLHttpRequest(aGlobalObject),
+      mResponseBodyDecodedPos(0),
+      mResponseType(XMLHttpRequestResponseType::_empty),
+      mState(XMLHttpRequest_Binding::UNSENT),
+      mFlagSynchronous(false),
+      mFlagAborted(false),
+      mFlagParseBody(false),
+      mFlagSyncLooping(false),
+      mFlagBackgroundRequest(false),
+      mFlagHadUploadListenersOnSend(false),
+      mFlagACwithCredentials(false),
+      mFlagTimedOut(false),
+      mFlagDeleted(false),
+      mFlagSend(false),
+      mUploadTransferred(0),
+      mUploadTotal(0),
+      mUploadComplete(true),
+      mProgressSinceLastProgressEvent(false),
+      mRequestSentTime(0),
+      mTimeoutMilliseconds(0),
+      mErrorLoad(ErrorType::eOK),
+      mErrorLoadDetail(NS_OK),
+      mErrorParsingXML(false),
+      mWaitingForOnStopRequest(false),
+      mProgressTimerIsActive(false),
+      mIsHtml(false),
+      mWarnAboutSyncHtml(false),
+      mLoadTotal(-1),
+      mLoadTransferred(0),
+      mIsSystem(false),
+      mIsAnon(false),
+      mResultJSON(JS::UndefinedValue()),
+      mArrayBufferBuilder(new ArrayBufferBuilder()),
+      mResultArrayBuffer(nullptr),
+      mIsMappedArrayBuffer(false),
+      mXPCOMifier(nullptr),
+      mEventDispatchingSuspended(false),
+      mEofDecoded(false),
+      mDelayedDoneNotifier(nullptr) {
+  DEBUG_WORKERREFS;
+  mozilla::HoldJSObjects(this);
+}
+
+XMLHttpRequestMainThread::~XMLHttpRequestMainThread() {
+  DEBUG_WORKERREFS;
+  MOZ_ASSERT(
+      !mDelayedDoneNotifier,
+      "How can we have mDelayedDoneNotifier, which owns us, in destructor?");
+
+  mFlagDeleted = true;
+
+  if ((mState == XMLHttpRequest_Binding::OPENED && mFlagSend) ||
+      mState == XMLHttpRequest_Binding::LOADING) {
+    Abort();
+  }
+
+  if (mParseEndListener) {
+    mParseEndListener->SetIsStale();
+    mParseEndListener = nullptr;
+  }
+
+  MOZ_ASSERT(!mFlagSyncLooping, "we rather crash than hang");
+  mFlagSyncLooping = false;
+
+  mozilla::DropJSObjects(this);
+}
+
+void XMLHttpRequestMainThread::Construct(
+    nsIPrincipal* aPrincipal, nsICookieJarSettings* aCookieJarSettings,
+    bool aForWorker, nsIURI* aBaseURI /* = nullptr */,
+    nsILoadGroup* aLoadGroup /* = nullptr */,
+    PerformanceStorage* aPerformanceStorage /* = nullptr */,
+    nsICSPEventListener* aCSPEventListener /* = nullptr */) {
+  DEBUG_WORKERREFS;
+  MOZ_ASSERT(aPrincipal);
+  mPrincipal = aPrincipal;
+  mBaseURI = aBaseURI;
+  mLoadGroup = aLoadGroup;
+  mCookieJarSettings = aCookieJarSettings;
+  mForWorker = aForWorker;
+  mPerformanceStorage = aPerformanceStorage;
+  mCSPEventListener = aCSPEventListener;
+}
+
+void XMLHttpRequestMainThread::InitParameters(bool aAnon, bool aSystem) {
+  DEBUG_WORKERREFS;
+  if (!aAnon && !aSystem) {
+    return;
+  }
+
+  // Check for permissions.
+  // Chrome is always allowed access, so do the permission check only
+  // for non-chrome pages.
+  if (!IsSystemXHR() && aSystem) {
+    nsIGlobalObject* global = GetOwnerGlobal();
+    if (NS_WARN_IF(!global)) {
+      SetParameters(aAnon, false);
+      return;
+    }
+
+    nsIPrincipal* principal = global->PrincipalOrNull();
+    if (NS_WARN_IF(!principal)) {
+      SetParameters(aAnon, false);
+      return;
+    }
+
+    nsCOMPtr<nsIPermissionManager> permMgr =
+        components::PermissionManager::Service();
+    if (NS_WARN_IF(!permMgr)) {
+      SetParameters(aAnon, false);
+      return;
+    }
+
+    uint32_t permission;
+    nsresult rv = permMgr->TestPermissionFromPrincipal(
+        principal, "systemXHR"_ns, &permission);
+    if (NS_FAILED(rv) || permission != nsIPermissionManager::ALLOW_ACTION) {
+      SetParameters(aAnon, false);
+      return;
+    }
+  }
+
+  SetParameters(aAnon, aSystem);
+}
+
+void XMLHttpRequestMainThread::SetClientInfoAndController(
+    const ClientInfo& aClientInfo,
+    const Maybe<ServiceWorkerDescriptor>& aController) {
+  mClientInfo.emplace(aClientInfo);
+  mController = aController;
+}
+
+void XMLHttpRequestMainThread::ResetResponse() {
+  mResponseXML = nullptr;
+  mResponseBody.Truncate();
+  TruncateResponseText();
+  mResponseBlobImpl = nullptr;
+  mResponseBlob = nullptr;
+  mBlobStorage = nullptr;
+  mResultArrayBuffer = nullptr;
+  mArrayBufferBuilder = new ArrayBufferBuilder();
+  mResultJSON.setUndefined();
+  mLoadTransferred = 0;
+  mResponseBodyDecodedPos = 0;
+  mEofDecoded = false;
+}
+
+NS_IMPL_CYCLE_COLLECTION_CLASS(XMLHttpRequestMainThread)
+
+NS_IMPL_CYCLE_COLLECTION_TRAVERSE_BEGIN_INHERITED(XMLHttpRequestMainThread,
+                                                  XMLHttpRequestEventTarget)
+  NS_IMPL_CYCLE_COLLECTION_TRAVERSE(mContext)
+  NS_IMPL_CYCLE_COLLECTION_TRAVERSE(mChannel)
+  NS_IMPL_CYCLE_COLLECTION_TRAVERSE(mResponseXML)
+
+  NS_IMPL_CYCLE_COLLECTION_TRAVERSE(mXMLParserStreamListener)
+
+  NS_IMPL_CYCLE_COLLECTION_TRAVERSE(mResponseBlob)
+  NS_IMPL_CYCLE_COLLECTION_TRAVERSE(mNotificationCallbacks)
+
+  NS_IMPL_CYCLE_COLLECTION_TRAVERSE(mChannelEventSink)
+  NS_IMPL_CYCLE_COLLECTION_TRAVERSE(mProgressEventSink)
+
+  NS_IMPL_CYCLE_COLLECTION_TRAVERSE(mUpload)
+NS_IMPL_CYCLE_COLLECTION_TRAVERSE_END
+
+NS_IMPL_CYCLE_COLLECTION_UNLINK_BEGIN_INHERITED(XMLHttpRequestMainThread,
+                                                XMLHttpRequestEventTarget)
+  tmp->mResultArrayBuffer = nullptr;
+  tmp->mArrayBufferBuilder = nullptr;
+  tmp->mResultJSON.setUndefined();
+  tmp->mResponseBlobImpl = nullptr;
+
+  NS_IMPL_CYCLE_COLLECTION_UNLINK(mContext)
+  NS_IMPL_CYCLE_COLLECTION_UNLINK(mChannel)
+  NS_IMPL_CYCLE_COLLECTION_UNLINK(mResponseXML)
+
+  NS_IMPL_CYCLE_COLLECTION_UNLINK(mXMLParserStreamListener)
+
+  NS_IMPL_CYCLE_COLLECTION_UNLINK(mResponseBlob)
+  NS_IMPL_CYCLE_COLLECTION_UNLINK(mNotificationCallbacks)
+
+  NS_IMPL_CYCLE_COLLECTION_UNLINK(mChannelEventSink)
+  NS_IMPL_CYCLE_COLLECTION_UNLINK(mProgressEventSink)
+
+  NS_IMPL_CYCLE_COLLECTION_UNLINK(mUpload)
+NS_IMPL_CYCLE_COLLECTION_UNLINK_END
+
+NS_IMPL_CYCLE_COLLECTION_TRACE_BEGIN_INHERITED(XMLHttpRequestMainThread,
+                                               XMLHttpRequestEventTarget)
+  NS_IMPL_CYCLE_COLLECTION_TRACE_JS_MEMBER_CALLBACK(mResultArrayBuffer)
+  NS_IMPL_CYCLE_COLLECTION_TRACE_JS_MEMBER_CALLBACK(mResultJSON)
+NS_IMPL_CYCLE_COLLECTION_TRACE_END
+
+bool XMLHttpRequestMainThread::IsCertainlyAliveForCC() const {
+  return mWaitingForOnStopRequest;
+}
+
+// QueryInterface implementation for XMLHttpRequestMainThread
+NS_INTERFACE_MAP_BEGIN_CYCLE_COLLECTION(XMLHttpRequestMainThread)
+  NS_INTERFACE_MAP_ENTRY(nsIRequestObserver)
+  NS_INTERFACE_MAP_ENTRY(nsIStreamListener)
+  NS_INTERFACE_MAP_ENTRY(nsIChannelEventSink)
+  NS_INTERFACE_MAP_ENTRY(nsIProgressEventSink)
+  NS_INTERFACE_MAP_ENTRY(nsIInterfaceRequestor)
+  NS_INTERFACE_MAP_ENTRY(nsITimerCallback)
+  NS_INTERFACE_MAP_ENTRY(nsINamed)
+  NS_INTERFACE_MAP_ENTRY(nsISizeOfEventTarget)
+NS_INTERFACE_MAP_END_INHERITING(XMLHttpRequestEventTarget)
+
+NS_IMPL_ADDREF_INHERITED(XMLHttpRequestMainThread, XMLHttpRequestEventTarget)
+NS_IMPL_RELEASE_INHERITED(XMLHttpRequestMainThread, XMLHttpRequestEventTarget)
+
+void XMLHttpRequestMainThread::DisconnectFromOwner() {
+  XMLHttpRequestEventTarget::DisconnectFromOwner();
+  Abort();
+}
+
+size_t XMLHttpRequestMainThread::SizeOfEventTargetIncludingThis(
+    MallocSizeOf aMallocSizeOf) const {
+  size_t n = aMallocSizeOf(this);
+  n += mResponseBody.SizeOfExcludingThisIfUnshared(aMallocSizeOf);
+
+  // Why is this safe?  Because no-one else will report this string.  The
+  // other possible sharers of this string are as follows.
+  //
+  // - The JS engine could hold copies if the JS code holds references, e.g.
+  //   |var text = XHR.responseText|.  However, those references will be via JS
+  //   external strings, for which the JS memory reporter does *not* report the
+  //   chars.
+  //
+  // - Binary extensions, but they're *extremely* unlikely to do any memory
+  //   reporting.
+  //
+  n += mResponseText.SizeOfThis(aMallocSizeOf);
+
+  return n;
+
+  // Measurement of the following members may be added later if DMD finds it is
+  // worthwhile:
+  // - lots
+}
+
+static void LogMessage(
+    const char* aWarning, nsPIDOMWindowInner* aWindow,
+    const nsTArray<nsString>& aParams = nsTArray<nsString>()) {
+  nsCOMPtr<Document> doc;
+  if (aWindow) {
+    doc = aWindow->GetExtantDoc();
+  }
+  nsContentUtils::ReportToConsole(nsIScriptError::warningFlag, "DOM"_ns, doc,
+                                  nsContentUtils::eDOM_PROPERTIES, aWarning,
+                                  aParams);
+}
+
+Document* XMLHttpRequestMainThread::GetResponseXML(ErrorResult& aRv) {
+  if (mResponseType != XMLHttpRequestResponseType::_empty &&
+      mResponseType != XMLHttpRequestResponseType::Document) {
+    aRv.ThrowInvalidStateError(
+        "responseXML is only available if responseType is '' or 'document'.");
+    return nullptr;
+  }
+  if (mWarnAboutSyncHtml) {
+    mWarnAboutSyncHtml = false;
+    LogMessage("HTMLSyncXHRWarning", GetOwner());
+  }
+  if (mState != XMLHttpRequest_Binding::DONE) {
+    return nullptr;
+  }
+  return mResponseXML;
+}
+
+/*
+ * This piece copied from XMLDocument, we try to get the charset
+ * from HTTP headers.
+ */
+nsresult XMLHttpRequestMainThread::DetectCharset() {
+  DEBUG_WORKERREFS;
+  mDecoder = nullptr;
+
+  if (mResponseType != XMLHttpRequestResponseType::_empty &&
+      mResponseType != XMLHttpRequestResponseType::Text &&
+      mResponseType != XMLHttpRequestResponseType::Json) {
+    return NS_OK;
+  }
+
+  nsAutoCString charsetVal;
+  const Encoding* encoding;
+  bool ok = mChannel && NS_SUCCEEDED(mChannel->GetContentCharset(charsetVal)) &&
+            (encoding = Encoding::ForLabel(charsetVal));
+  if (!ok) {
+    // MS documentation states UTF-8 is default for responseText
+    encoding = UTF_8_ENCODING;
+  }
+
+  if (mResponseType == XMLHttpRequestResponseType::Json &&
+      encoding != UTF_8_ENCODING) {
+    // The XHR spec says only UTF-8 is supported for responseType == "json"
+    LogMessage("JSONCharsetWarning", GetOwner());
+    encoding = UTF_8_ENCODING;
+  }
+
+  // Only sniff the BOM for non-JSON responseTypes
+  if (mResponseType == XMLHttpRequestResponseType::Json) {
+    mDecoder = encoding->NewDecoderWithBOMRemoval();
+  } else {
+    mDecoder = encoding->NewDecoder();
+  }
+
+  return NS_OK;
+}
+
+nsresult XMLHttpRequestMainThread::AppendToResponseText(
+    Span<const uint8_t> aBuffer, bool aLast) {
+  // Call this with an empty buffer to send the decoder the signal
+  // that we have hit the end of the stream.
+
+  NS_ENSURE_STATE(mDecoder);
+
+  CheckedInt<size_t> destBufferLen =
+      mDecoder->MaxUTF16BufferLength(aBuffer.Length());
+
+  {  // scope for holding the mutex that protects mResponseText
+    XMLHttpRequestStringWriterHelper helper(mResponseText);
+
+    uint32_t len = helper.Length();
+
+    destBufferLen += len;
+    if (!destBufferLen.isValid() || destBufferLen.value() > UINT32_MAX) {
+      return NS_ERROR_OUT_OF_MEMORY;
+    }
+
+    auto handleOrErr = helper.BulkWrite(destBufferLen.value());
+    if (handleOrErr.isErr()) {
+      return handleOrErr.unwrapErr();
+    }
+
+    auto handle = handleOrErr.unwrap();
+
+    uint32_t result;
+    size_t read;
+    size_t written;
+    std::tie(result, read, written, std::ignore) =
+        mDecoder->DecodeToUTF16(aBuffer, handle.AsSpan().From(len), aLast);
+    MOZ_ASSERT(result == kInputEmpty);
+    MOZ_ASSERT(read == aBuffer.Length());
+    len += written;
+    MOZ_ASSERT(len <= destBufferLen.value());
+    handle.Finish(len, false);
+  }  // release mutex
+
+  if (aLast) {
+    // Drop the finished decoder to avoid calling into a decoder
+    // that has finished.
+    mDecoder = nullptr;
+    mEofDecoded = true;
+  }
+  return NS_OK;
+}
+
+void XMLHttpRequestMainThread::GetResponseText(DOMString& aResponseText,
+                                               ErrorResult& aRv) {
+  MOZ_DIAGNOSTIC_ASSERT(!mForWorker);
+
+  XMLHttpRequestStringSnapshot snapshot;
+  GetResponseText(snapshot, aRv);
+  if (aRv.Failed()) {
+    return;
+  }
+
+  if (!snapshot.GetAsString(aResponseText)) {
+    aRv.Throw(NS_ERROR_OUT_OF_MEMORY);
+    return;
+  }
+}
+
+void XMLHttpRequestMainThread::GetResponseText(
+    XMLHttpRequestStringSnapshot& aSnapshot, ErrorResult& aRv) {
+  aSnapshot.Reset();
+
+  if (mResponseType != XMLHttpRequestResponseType::_empty &&
+      mResponseType != XMLHttpRequestResponseType::Text) {
+    aRv.ThrowInvalidStateError(
+        "responseText is only available if responseType is '' or 'text'.");
+    return;
+  }
+
+  if (mState != XMLHttpRequest_Binding::LOADING &&
+      mState != XMLHttpRequest_Binding::DONE) {
+    return;
+  }
+
+  // Main Fetch step 18 requires to ignore body for head/connect methods.
+  if (mRequestMethod.EqualsLiteral("HEAD") ||
+      mRequestMethod.EqualsLiteral("CONNECT")) {
+    return;
+  }
+
+  // We only decode text lazily if we're also parsing to a doc.
+  // Also, if we've decoded all current data already, then no need to decode
+  // more.
+  if ((!mResponseXML && !mErrorParsingXML) ||
+      (mResponseBodyDecodedPos == mResponseBody.Length() &&
+       (mState != XMLHttpRequest_Binding::DONE || mEofDecoded))) {
+    mResponseText.CreateSnapshot(aSnapshot);
+    return;
+  }
+
+  MatchCharsetAndDecoderToResponseDocument();
+
+  MOZ_ASSERT(mResponseBodyDecodedPos < mResponseBody.Length() ||
+                 mState == XMLHttpRequest_Binding::DONE,
+             "Unexpected mResponseBodyDecodedPos");
+  Span<const uint8_t> span = mResponseBody;
+  aRv = AppendToResponseText(span.From(mResponseBodyDecodedPos),
+                             mState == XMLHttpRequest_Binding::DONE);
+  if (aRv.Failed()) {
+    return;
+  }
+
+  mResponseBodyDecodedPos = mResponseBody.Length();
+
+  if (mEofDecoded) {
+    // Free memory buffer which we no longer need
+    mResponseBody.Truncate();
+    mResponseBodyDecodedPos = 0;
+  }
+
+  mResponseText.CreateSnapshot(aSnapshot);
+}
+
+nsresult XMLHttpRequestMainThread::CreateResponseParsedJSON(JSContext* aCx) {
+  if (!aCx) {
+    return NS_ERROR_FAILURE;
+  }
+
+  nsAutoString string;
+  nsresult rv = GetResponseTextForJSON(string);
+  if (NS_WARN_IF(NS_FAILED(rv))) {
+    return rv;
+  }
+
+  // The Unicode converter has already zapped the BOM if there was one
+  JS::Rooted<JS::Value> value(aCx);
+  if (!JS_ParseJSON(aCx, string.BeginReading(), string.Length(), &value)) {
+    return NS_ERROR_FAILURE;
+  }
+
+  mResultJSON = value;
+  return NS_OK;
+}
+
+void XMLHttpRequestMainThread::SetResponseType(
+    XMLHttpRequestResponseType aResponseType, ErrorResult& aRv) {
+  NOT_CALLABLE_IN_SYNC_SEND_RV
+
+  if (mState == XMLHttpRequest_Binding::LOADING ||
+      mState == XMLHttpRequest_Binding::DONE) {
+    aRv.ThrowInvalidStateError(
+        "Cannot set 'responseType' property on XMLHttpRequest after 'send()' "
+        "(when its state is LOADING or DONE).");
+    return;
+  }
+
+  // sync request is not allowed setting responseType in window context
+  if (HasOrHasHadOwner() && mState != XMLHttpRequest_Binding::UNSENT &&
+      mFlagSynchronous) {
+    LogMessage("ResponseTypeSyncXHRWarning", GetOwner());
+    aRv.ThrowInvalidAccessError(
+        "synchronous XMLHttpRequests do not support timeout and responseType");
+    return;
+  }
+
+  // Set the responseType attribute's value to the given value.
+  SetResponseTypeRaw(aResponseType);
+}
+
+void XMLHttpRequestMainThread::GetResponse(
+    JSContext* aCx, JS::MutableHandle<JS::Value> aResponse, ErrorResult& aRv) {
+  MOZ_DIAGNOSTIC_ASSERT(!mForWorker);
+
+  switch (mResponseType) {
+    case XMLHttpRequestResponseType::_empty:
+    case XMLHttpRequestResponseType::Text: {
+      DOMString str;
+      GetResponseText(str, aRv);
+      if (aRv.Failed()) {
+        return;
+      }
+      if (!xpc::StringToJsval(aCx, str, aResponse)) {
+        aRv.Throw(NS_ERROR_OUT_OF_MEMORY);
+      }
+      return;
+    }
+
+    case XMLHttpRequestResponseType::Arraybuffer: {
+      if (mState != XMLHttpRequest_Binding::DONE) {
+        aResponse.setNull();
+        return;
+      }
+
+      if (!mResultArrayBuffer) {
+        mResultArrayBuffer = mArrayBufferBuilder->TakeArrayBuffer(aCx);
+        if (!mResultArrayBuffer) {
+          aRv.Throw(NS_ERROR_OUT_OF_MEMORY);
+          return;
+        }
+      }
+      aResponse.setObject(*mResultArrayBuffer);
+      return;
+    }
+    case XMLHttpRequestResponseType::Blob: {
+      if (mState != XMLHttpRequest_Binding::DONE) {
+        aResponse.setNull();
+        return;
+      }
+
+      if (!mResponseBlobImpl) {
+        aResponse.setNull();
+        return;
+      }
+
+      if (!mResponseBlob) {
+        mResponseBlob = Blob::Create(GetOwnerGlobal(), mResponseBlobImpl);
+      }
+
+      if (!GetOrCreateDOMReflector(aCx, mResponseBlob, aResponse)) {
+        aResponse.setNull();
+      }
+
+      return;
+    }
+    case XMLHttpRequestResponseType::Document: {
+      if (!mResponseXML || mState != XMLHttpRequest_Binding::DONE) {
+        aResponse.setNull();
+        return;
+      }
+
+      aRv =
+          nsContentUtils::WrapNative(aCx, ToSupports(mResponseXML), aResponse);
+      return;
+    }
+    case XMLHttpRequestResponseType::Json: {
+      if (mState != XMLHttpRequest_Binding::DONE) {
+        aResponse.setNull();
+        return;
+      }
+
+      if (mResultJSON.isUndefined()) {
+        aRv = CreateResponseParsedJSON(aCx);
+        TruncateResponseText();
+        if (aRv.Failed()) {
+          // Per spec, errors aren't propagated. null is returned instead.
+          aRv = NS_OK;
+          // It would be nice to log the error to the console. That's hard to
+          // do without calling window.onerror as a side effect, though.
+          JS_ClearPendingException(aCx);
+          mResultJSON.setNull();
+        }
+      }
+      aResponse.set(mResultJSON);
+      return;
+    }
+    default:
+      NS_ERROR("Should not happen");
+  }
+
+  aResponse.setNull();
+}
+
+already_AddRefed<BlobImpl> XMLHttpRequestMainThread::GetResponseBlobImpl() {
+  MOZ_DIAGNOSTIC_ASSERT(mForWorker);
+  MOZ_DIAGNOSTIC_ASSERT(mResponseType == XMLHttpRequestResponseType::Blob);
+
+  if (mState != XMLHttpRequest_Binding::DONE) {
+    return nullptr;
+  }
+
+  RefPtr<BlobImpl> blobImpl = mResponseBlobImpl;
+  return blobImpl.forget();
+}
+
+already_AddRefed<ArrayBufferBuilder>
+XMLHttpRequestMainThread::GetResponseArrayBufferBuilder() {
+  MOZ_DIAGNOSTIC_ASSERT(mForWorker);
+  MOZ_DIAGNOSTIC_ASSERT(mResponseType ==
+                        XMLHttpRequestResponseType::Arraybuffer);
+
+  if (mState != XMLHttpRequest_Binding::DONE) {
+    return nullptr;
+  }
+
+  RefPtr<ArrayBufferBuilder> builder = mArrayBufferBuilder;
+  return builder.forget();
+}
+
+nsresult XMLHttpRequestMainThread::GetResponseTextForJSON(nsAString& aString) {
+  if (mState != XMLHttpRequest_Binding::DONE) {
+    aString.SetIsVoid(true);
+    return NS_OK;
+  }
+
+  if (!mResponseText.GetAsString(aString)) {
+    return NS_ERROR_OUT_OF_MEMORY;
+  }
+
+  return NS_OK;
+}
+
+bool XMLHttpRequestMainThread::IsCrossSiteCORSRequest() const {
+  if (!mChannel) {
+    return false;
+  }
+
+  nsCOMPtr<nsILoadInfo> loadInfo = mChannel->LoadInfo();
+  return loadInfo->GetTainting() == LoadTainting::CORS;
+}
+
+bool XMLHttpRequestMainThread::IsDeniedCrossSiteCORSRequest() {
+  if (IsCrossSiteCORSRequest()) {
+    nsresult rv;
+    mChannel->GetStatus(&rv);
+    if (NS_FAILED(rv)) {
+      return true;
+    }
+  }
+  return false;
+}
+
+Maybe<nsBaseChannel::ContentRange>
+XMLHttpRequestMainThread::GetRequestedContentRange() const {
+  MOZ_ASSERT(mChannel);
+  nsBaseChannel* baseChan = static_cast<nsBaseChannel*>(mChannel.get());
+  if (!baseChan) {
+    return mozilla::Nothing();
+  }
+  return baseChan->GetContentRange();
+}
+
+void XMLHttpRequestMainThread::GetContentRangeHeader(nsACString& out) const {
+  if (!IsBlobURI(mRequestURL)) {
+    out.SetIsVoid(true);
+    return;
+  }
+  Maybe<nsBaseChannel::ContentRange> range = GetRequestedContentRange();
+  if (range.isSome()) {
+    range->AsHeader(out);
+  } else {
+    out.SetIsVoid(true);
+  }
+}
+
+void XMLHttpRequestMainThread::GetResponseURL(nsAString& aUrl) {
+  aUrl.Truncate();
+
+  if ((mState == XMLHttpRequest_Binding::UNSENT ||
+       mState == XMLHttpRequest_Binding::OPENED) ||
+      !mChannel) {
+    return;
+  }
+
+  // Make sure we don't leak responseURL information from denied cross-site
+  // requests.
+  if (IsDeniedCrossSiteCORSRequest()) {
+    return;
+  }
+
+  nsCOMPtr<nsIURI> responseUrl;
+  if (NS_FAILED(NS_GetFinalChannelURI(mChannel, getter_AddRefs(responseUrl)))) {
+    return;
+  }
+
+  nsAutoCString temp;
+  responseUrl->GetSpecIgnoringRef(temp);
+  CopyUTF8toUTF16(temp, aUrl);
+}
+
+uint32_t XMLHttpRequestMainThread::GetStatus(ErrorResult& aRv) {
+  // Make sure we don't leak status information from denied cross-site
+  // requests.
+  if (IsDeniedCrossSiteCORSRequest()) {
+    return 0;
+  }
+
+  if (mState == XMLHttpRequest_Binding::UNSENT ||
+      mState == XMLHttpRequest_Binding::OPENED) {
+    return 0;
+  }
+
+  if (mErrorLoad != ErrorType::eOK) {
+    // Let's simulate the http protocol for jar/app requests:
+    nsCOMPtr<nsIJARChannel> jarChannel = GetCurrentJARChannel();
+    if (jarChannel) {
+      nsresult status;
+      mChannel->GetStatus(&status);
+
+      if (status == NS_ERROR_FILE_NOT_FOUND) {
+        return 404;  // Not Found
+      } else {
+        return 500;  // Internal Error
+      }
+    }
+
+    return 0;
+  }
+
+  nsCOMPtr<nsIHttpChannel> httpChannel = GetCurrentHttpChannel();
+  if (!httpChannel) {
+    // Pretend like we got a 200/206 response, since our load was successful
+    return IsBlobURI(mRequestURL) && GetRequestedContentRange().isSome() ? 206
+                                                                         : 200;
+  }
+
+  uint32_t status;
+  nsresult rv = httpChannel->GetResponseStatus(&status);
+  if (NS_FAILED(rv)) {
+    status = 0;
+  }
+
+  return status;
+}
+
+void XMLHttpRequestMainThread::GetStatusText(nsACString& aStatusText,
+                                             ErrorResult& aRv) {
+  // Return an empty status text on all error loads.
+  aStatusText.Truncate();
+
+  // Make sure we don't leak status information from denied cross-site
+  // requests.
+  if (IsDeniedCrossSiteCORSRequest()) {
+    return;
+  }
+
+  // Check the current XHR state to see if it is valid to obtain the statusText
+  // value.  This check is to prevent the status text for redirects from being
+  // available before all the redirects have been followed and HTTP headers have
+  // been received.
+  if (mState == XMLHttpRequest_Binding::UNSENT ||
+      mState == XMLHttpRequest_Binding::OPENED) {
+    return;
+  }
+
+  if (mErrorLoad != ErrorType::eOK) {
+    return;
+  }
+
+  nsCOMPtr<nsIHttpChannel> httpChannel = GetCurrentHttpChannel();
+  if (httpChannel) {
+    Unused << httpChannel->GetResponseStatusText(aStatusText);
+  } else {
+    aStatusText.AssignLiteral("OK");
+  }
+}
+
+void XMLHttpRequestMainThread::TerminateOngoingFetch(nsresult detail) {
+  DEBUG_WORKERREFS;
+  if ((mState == XMLHttpRequest_Binding::OPENED && mFlagSend) ||
+      mState == XMLHttpRequest_Binding::HEADERS_RECEIVED ||
+      mState == XMLHttpRequest_Binding::LOADING) {
+    MOZ_LOG(gXMLHttpRequestLog, LogLevel::Info,
+            ("%p TerminateOngoingFetch(0x%" PRIx32 ")", this,
+             static_cast<uint32_t>(detail)));
+    CloseRequest(detail);
+  }
+}
+
+void XMLHttpRequestMainThread::CloseRequest(nsresult detail) {
+  DEBUG_WORKERREFS;
+  mWaitingForOnStopRequest = false;
+  mErrorLoad = ErrorType::eTerminated;
+  mErrorLoadDetail = detail;
+  if (mChannel) {
+    mChannel->CancelWithReason(NS_BINDING_ABORTED,
+                               "XMLHttpRequestMainThread::CloseRequest"_ns);
+  }
+  CancelTimeoutTimer();
+}
+
+void XMLHttpRequestMainThread::CloseRequestWithError(
+    const ErrorProgressEventType& aType) {
+  DEBUG_WORKERREFS;
+  MOZ_LOG(gXMLHttpRequestLog, LogLevel::Debug,
+          ("%p CloseRequestWithError(%s)", this, aType.cStr));
+
+  CloseRequest(aType.errorCode);
+
+  ResetResponse();
+
+  // If we're in the destructor, don't risk dispatching an event.
+  if (mFlagDeleted) {
+    mFlagSyncLooping = false;
+    return;
+  }
+
+  if (mState != XMLHttpRequest_Binding::UNSENT &&
+      !(mState == XMLHttpRequest_Binding::OPENED && !mFlagSend) &&
+      mState != XMLHttpRequest_Binding::DONE) {
+    ChangeState(XMLHttpRequest_Binding::DONE, true);
+
+    if (!mFlagSyncLooping) {
+      if (mUpload && !mUploadComplete) {
+        mUploadComplete = true;
+        DispatchProgressEvent(mUpload, aType, 0, -1);
+      }
+      DispatchProgressEvent(this, aType, 0, -1);
+    }
+  }
+
+  // The ChangeState call above calls onreadystatechange handlers which
+  // if they load a new url will cause XMLHttpRequestMainThread::Open to clear
+  // the abort state bit. If this occurs we're not uninitialized (bug 361773).
+  if (mFlagAborted) {
+    ChangeState(XMLHttpRequest_Binding::UNSENT, false);  // IE seems to do it
+  }
+
+  mFlagSyncLooping = false;
+}
+
+void XMLHttpRequestMainThread::RequestErrorSteps(
+    const ProgressEventType aEventType, const nsresult aOptionalException,
+    ErrorResult& aRv) {
+  MOZ_LOG(gXMLHttpRequestLog, LogLevel::Debug,
+          ("%p RequestErrorSteps(%s,0x%" PRIx32 ")", this, aEventType.cStr,
+           static_cast<uint32_t>(aOptionalException)));
+
+  // Cancel our timers first before setting our state to done, so we don't
+  // trip any assertions if one fires and asserts that state != done.
+  CancelTimeoutTimer();
+  CancelSyncTimeoutTimer();
+  StopProgressEventTimer();
+
+  // Step 1
+  mState = XMLHttpRequest_Binding::DONE;
+
+  // Step 2
+  mFlagSend = false;
+
+  // Step 3
+  ResetResponse();
+
+  // If we're in the destructor, don't risk dispatching an event.
+  if (mFlagDeleted) {
+    mFlagSyncLooping = false;
+    return;
+  }
+
+  // Step 4
+  if (mFlagSynchronous && NS_FAILED(aOptionalException)) {
+    aRv.Throw(aOptionalException);
+    return;
+  }
+
+  // Step 5
+  FireReadystatechangeEvent();
+
+  // Step 6
+  if (mUpload && !mUploadComplete) {
+    // Step 6-1
+    mUploadComplete = true;
+
+    // Step 6-2
+    if (mFlagHadUploadListenersOnSend) {
+      // Steps 6-3, 6-4 (loadend is fired for us)
+      DispatchProgressEvent(mUpload, aEventType, 0, -1);
+    }
+  }
+
+  // Steps 7 and 8 (loadend is fired for us)
+  DispatchProgressEvent(this, aEventType, 0, -1);
+}
+
+void XMLHttpRequestMainThread::Abort(ErrorResult& aRv) {
+  NOT_CALLABLE_IN_SYNC_SEND_RV
+  MOZ_LOG(gXMLHttpRequestLog, LogLevel::Debug, ("%p Abort()", this));
+  AbortInternal(aRv);
+}
+
+void XMLHttpRequestMainThread::AbortInternal(ErrorResult& aRv) {
+  MOZ_LOG(gXMLHttpRequestLog, LogLevel::Debug, ("%p AbortInternal()", this));
+  mFlagAborted = true;
+  DisconnectDoneNotifier();
+
+  // Step 1
+  TerminateOngoingFetch(NS_ERROR_DOM_ABORT_ERR);
+
+  // Step 2
+  if ((mState == XMLHttpRequest_Binding::OPENED && mFlagSend) ||
+      mState == XMLHttpRequest_Binding::HEADERS_RECEIVED ||
+      mState == XMLHttpRequest_Binding::LOADING) {
+    RequestErrorSteps(Events::abort, NS_ERROR_DOM_ABORT_ERR, aRv);
+  }
+
+  // Step 3
+  if (mState == XMLHttpRequest_Binding::DONE) {
+    ChangeState(XMLHttpRequest_Binding::UNSENT,
+                false);  // no ReadystateChange event
+  }
+
+  mFlagSyncLooping = false;
+}
+
+/*Method that checks if it is safe to expose a header value to the client.
+It is used to check what headers are exposed for CORS requests.*/
+bool XMLHttpRequestMainThread::IsSafeHeader(
+    const nsACString& aHeader, NotNull<nsIHttpChannel*> aHttpChannel) const {
+  // See bug #380418. Hide "Set-Cookie" headers from non-chrome scripts.
+  if (!IsSystemXHR() && nsContentUtils::IsForbiddenResponseHeader(aHeader)) {
+    NS_WARNING("blocked access to response header");
+    return false;
+  }
+  // if this is not a CORS call all headers are safe
+  if (!IsCrossSiteCORSRequest()) {
+    return true;
+  }
+  // Check for dangerous headers
+  // Make sure we don't leak header information from denied cross-site
+  // requests.
+  if (mChannel) {
+    nsresult status;
+    mChannel->GetStatus(&status);
+    if (NS_FAILED(status)) {
+      return false;
+    }
+  }
+  const char* kCrossOriginSafeHeaders[] = {
+      "cache-control", "content-language", "content-type", "content-length",
+      "expires",       "last-modified",    "pragma"};
+  for (uint32_t i = 0; i < ArrayLength(kCrossOriginSafeHeaders); ++i) {
+    if (aHeader.LowerCaseEqualsASCII(kCrossOriginSafeHeaders[i])) {
+      return true;
+    }
+  }
+  nsAutoCString headerVal;
+  // The "Access-Control-Expose-Headers" header contains a comma separated
+  // list of method names.
+  Unused << aHttpChannel->GetResponseHeader("Access-Control-Expose-Headers"_ns,
+                                            headerVal);
+  bool isSafe = false;
+  for (const nsACString& token :
+       nsCCharSeparatedTokenizer(headerVal, ',').ToRange()) {
+    if (token.IsEmpty()) {
+      continue;
+    }
+    if (!NS_IsValidHTTPToken(token)) {
+      return false;
+    }
+
+    if (token.EqualsLiteral("*") && !mFlagACwithCredentials) {
+      isSafe = true;
+    } else if (aHeader.Equals(token, nsCaseInsensitiveCStringComparator)) {
+      isSafe = true;
+    }
+  }
+
+  return isSafe;
+}
+
+bool XMLHttpRequestMainThread::GetContentType(nsACString& aValue) const {
+  MOZ_ASSERT(mChannel);
+  nsCOMPtr<nsIURI> uri;
+  if (NS_SUCCEEDED(mChannel->GetURI(getter_AddRefs(uri))) &&
+      uri->SchemeIs("data")) {
+    nsDataChannel* dchan = static_cast<nsDataChannel*>(mChannel.get());
+    MOZ_ASSERT(dchan);
+    aValue.Assign(dchan->MimeType());
+    return true;
+  }
+  if (NS_SUCCEEDED(mChannel->GetContentType(aValue))) {
+    nsCString value;
+    if (NS_SUCCEEDED(mChannel->GetContentCharset(value)) && !value.IsEmpty()) {
+      aValue.AppendLiteral(";charset=");
+      aValue.Append(value);
+    }
+    return true;
+  }
+  return false;
+}
+void XMLHttpRequestMainThread::GetAllResponseHeaders(
+    nsACString& aResponseHeaders, ErrorResult& aRv) {
+  NOT_CALLABLE_IN_SYNC_SEND_RV
+
+  aResponseHeaders.Truncate();
+
+  // If the state is UNSENT or OPENED,
+  // return the empty string and terminate these steps.
+  if (mState == XMLHttpRequest_Binding::UNSENT ||
+      mState == XMLHttpRequest_Binding::OPENED) {
+    return;
+  }
+
+  if (mErrorLoad != ErrorType::eOK) {
+    return;
+  }
+
+  if (nsCOMPtr<nsIHttpChannel> httpChannel = GetCurrentHttpChannel()) {
+    RefPtr<nsHeaderVisitor> visitor =
+        new nsHeaderVisitor(*this, WrapNotNull(httpChannel));
+    if (NS_SUCCEEDED(httpChannel->VisitResponseHeaders(visitor))) {
+      aResponseHeaders = visitor->Headers();
+    }
+    return;
+  }
+
+  if (!mChannel) {
+    return;
+  }
+
+  // Even non-http channels supply content type.
+  nsAutoCString value;
+  if (GetContentType(value)) {
+    aResponseHeaders.AppendLiteral("Content-Type: ");
+    aResponseHeaders.Append(value);
+    aResponseHeaders.AppendLiteral("\r\n");
+  }
+
+  // Don't provide Content-Length for data URIs
+  nsCOMPtr<nsIURI> uri;
+  if (NS_FAILED(mChannel->GetURI(getter_AddRefs(uri))) ||
+      !uri->SchemeIs("data")) {
+    int64_t length;
+    if (NS_SUCCEEDED(mChannel->GetContentLength(&length))) {
+      aResponseHeaders.AppendLiteral("Content-Length: ");
+      aResponseHeaders.AppendInt(length);
+      aResponseHeaders.AppendLiteral("\r\n");
+    }
+  }
+
+  // Should set a Content-Range header for blob scheme.
+  // From https://fetch.spec.whatwg.org/#scheme-fetch 3.blob.9.20:
+  // "Set response’s header list to «(`Content-Length`, serializedSlicedLength),
+  //  (`Content-Type`, type), (`Content-Range`, contentRange)»."
+  GetContentRangeHeader(value);
+  if (!value.IsVoid()) {
+    aResponseHeaders.AppendLiteral("Content-Range: ");
+    aResponseHeaders.Append(value);
+    aResponseHeaders.AppendLiteral("\r\n");
+  }
+}
+
+void XMLHttpRequestMainThread::GetResponseHeader(const nsACString& header,
+                                                 nsACString& _retval,
+                                                 ErrorResult& aRv) {
+  NOT_CALLABLE_IN_SYNC_SEND_RV
+
+  _retval.SetIsVoid(true);
+
+  nsCOMPtr<nsIHttpChannel> httpChannel = GetCurrentHttpChannel();
+
+  if (!httpChannel) {
+    // If the state is UNSENT or OPENED,
+    // return null and terminate these steps.
+    if (mState == XMLHttpRequest_Binding::UNSENT ||
+        mState == XMLHttpRequest_Binding::OPENED) {
+      return;
+    }
+
+    // Even non-http channels supply content type and content length.
+    // Remember we don't leak header information from denied cross-site
+    // requests. However, we handle file: and blob: URLs for blob response
+    // types by canceling them with a specific error, so we have to allow
+    // them to pass through this check.
+    nsresult status;
+    if (!mChannel || NS_FAILED(mChannel->GetStatus(&status)) ||
+        (NS_FAILED(status) && status != NS_ERROR_FILE_ALREADY_EXISTS)) {
+      return;
+    }
+
+    // Content Type:
+    if (header.LowerCaseEqualsASCII("content-type")) {
+      if (!GetContentType(_retval)) {
+        // Means no content type
+        _retval.SetIsVoid(true);
+        return;
+      }
+    }
+
+    // Content Length:
+    else if (header.LowerCaseEqualsASCII("content-length")) {
+      int64_t length;
+      if (NS_SUCCEEDED(mChannel->GetContentLength(&length))) {
+        _retval.AppendInt(length);
+      }
+    }
+
+    // Content Range:
+    else if (header.LowerCaseEqualsASCII("content-range")) {
+      GetContentRangeHeader(_retval);
+    }
+
+    return;
+  }
+
+  // Check for dangerous headers
+  if (!IsSafeHeader(header, WrapNotNull(httpChannel))) {
+    return;
+  }
+
+  aRv = httpChannel->GetResponseHeader(header, _retval);
+  if (aRv.ErrorCodeIs(NS_ERROR_NOT_AVAILABLE)) {
+    // Means no header
+    _retval.SetIsVoid(true);
+    aRv.SuppressException();
+  }
+}
+
+already_AddRefed<nsILoadGroup> XMLHttpRequestMainThread::GetLoadGroup() const {
+  if (mFlagBackgroundRequest) {
+    return nullptr;
+  }
+
+  if (mLoadGroup) {
+    nsCOMPtr<nsILoadGroup> ref = mLoadGroup;
+    return ref.forget();
+  }
+
+  Document* doc = GetDocumentIfCurrent();
+  if (doc) {
+    return doc->GetDocumentLoadGroup();
+  }
+
+  return nullptr;
+}
+
+nsresult XMLHttpRequestMainThread::FireReadystatechangeEvent() {
+  MOZ_ASSERT(mState != XMLHttpRequest_Binding::UNSENT);
+  RefPtr<Event> event = NS_NewDOMEvent(this, nullptr, nullptr);
+  event->InitEvent(kLiteralString_readystatechange, false, false);
+  // We assume anyone who managed to call CreateReadystatechangeEvent is trusted
+  event->SetTrusted(true);
+  DispatchOrStoreEvent(this, event);
+  return NS_OK;
+}
+
+void XMLHttpRequestMainThread::DispatchProgressEvent(
+    DOMEventTargetHelper* aTarget, const ProgressEventType& aType,
+    int64_t aLoaded, int64_t aTotal) {
+  DEBUG_WORKERREFS;
+  NS_ASSERTION(aTarget, "null target");
+
+  if (NS_FAILED(CheckCurrentGlobalCorrectness()) ||
+      (!AllowUploadProgress() && aTarget == mUpload)) {
+    return;
+  }
+
+  // If blocked by CORS, zero-out the stats on progress events
+  // and never fire "progress" or "load" events at all.
+  if (IsDeniedCrossSiteCORSRequest()) {
+    if (aType == Events::progress || aType == Events::load) {
+      return;
+    }
+    aLoaded = 0;
+    aTotal = -1;
+  }
+
+  ProgressEventInit init;
+  init.mBubbles = false;
+  init.mCancelable = false;
+  init.mLengthComputable = aTotal != -1;  // XHR spec step 6.1
+  init.mLoaded = aLoaded;
+  init.mTotal = (aTotal == -1) ? 0 : aTotal;
+
+  RefPtr<ProgressEvent> event =
+      ProgressEvent::Constructor(aTarget, aType, init);
+  event->SetTrusted(true);
+
+  MOZ_LOG(
+      gXMLHttpRequestLog, LogLevel::Debug,
+      ("firing %s event (%u,%u,%" PRIu64 ",%" PRIu64 ")", aType.cStr,
+       aTarget == mUpload, aTotal != -1, aLoaded, (aTotal == -1) ? 0 : aTotal));
+
+  DispatchOrStoreEvent(aTarget, event);
+
+  // If we're sending a load, error, timeout or abort event, then
+  // also dispatch the subsequent loadend event.
+  if (aType == Events::load || aType == Events::error ||
+      aType == Events::timeout || aType == Events::abort) {
+    DispatchProgressEvent(aTarget, Events::loadend, aLoaded, aTotal);
+  }
+}
+
+void XMLHttpRequestMainThread::DispatchOrStoreEvent(
+    DOMEventTargetHelper* aTarget, Event* aEvent) {
+  DEBUG_WORKERREFS;
+  MOZ_ASSERT(aTarget);
+  MOZ_ASSERT(aEvent);
+
+  if (NS_FAILED(CheckCurrentGlobalCorrectness())) {
+    return;
+  }
+
+  if (mEventDispatchingSuspended) {
+    PendingEvent* event = mPendingEvents.AppendElement();
+    event->mTarget = aTarget;
+    event->mEvent = aEvent;
+    return;
+  }
+
+  aTarget->DispatchEvent(*aEvent);
+}
+
+void XMLHttpRequestMainThread::SuspendEventDispatching() {
+  MOZ_ASSERT(!mEventDispatchingSuspended);
+  mEventDispatchingSuspended = true;
+}
+
+void XMLHttpRequestMainThread::ResumeEventDispatching() {
+  MOZ_ASSERT(mEventDispatchingSuspended);
+  mEventDispatchingSuspended = false;
+
+  nsTArray<PendingEvent> pendingEvents = std::move(mPendingEvents);
+
+  if (NS_FAILED(CheckCurrentGlobalCorrectness())) {
+    return;
+  }
+
+  for (uint32_t i = 0; i < pendingEvents.Length(); ++i) {
+    pendingEvents[i].mTarget->DispatchEvent(*pendingEvents[i].mEvent);
+  }
+}
+
+already_AddRefed<nsIHttpChannel>
+XMLHttpRequestMainThread::GetCurrentHttpChannel() {
+  nsCOMPtr<nsIHttpChannel> httpChannel = do_QueryInterface(mChannel);
+  return httpChannel.forget();
+}
+
+already_AddRefed<nsIJARChannel>
+XMLHttpRequestMainThread::GetCurrentJARChannel() {
+  nsCOMPtr<nsIJARChannel> appChannel = do_QueryInterface(mChannel);
+  return appChannel.forget();
+}
+
+bool XMLHttpRequestMainThread::IsSystemXHR() const {
+  return mIsSystem || mPrincipal->IsSystemPrincipal();
+}
+
+bool XMLHttpRequestMainThread::InUploadPhase() const {
+  // We're in the upload phase while our state is OPENED.
+  return mState == XMLHttpRequest_Binding::OPENED;
+}
+
+// This case is hit when the async parameter is outright omitted, which
+// should set it to true (and the username and password to null).
+void XMLHttpRequestMainThread::Open(const nsACString& aMethod,
+                                    const nsAString& aUrl, ErrorResult& aRv) {
+  Open(aMethod, aUrl, true, VoidString(), VoidString(), aRv);
+}
+
+// This case is hit when the async parameter is specified, even if the
+// JS value was "undefined" (which due to legacy reasons should be
+// treated as true, which is how it will already be passed in here).
+void XMLHttpRequestMainThread::Open(const nsACString& aMethod,
+                                    const nsAString& aUrl, bool aAsync,
+                                    const nsAString& aUsername,
+                                    const nsAString& aPassword,
+                                    ErrorResult& aRv) {
+  Open(aMethod, NS_ConvertUTF16toUTF8(aUrl), aAsync, aUsername, aPassword, aRv);
+}
+
+void XMLHttpRequestMainThread::Open(const nsACString& aMethod,
+                                    const nsACString& aUrl, bool aAsync,
+                                    const nsAString& aUsername,
+                                    const nsAString& aPassword,
+                                    ErrorResult& aRv) {
+  DEBUG_WORKERREFS1(aMethod << " " << aUrl);
+  NOT_CALLABLE_IN_SYNC_SEND_RV
+
+  // Gecko-specific
+  if (!aAsync && !DontWarnAboutSyncXHR() && GetOwner() &&
+      GetOwner()->GetExtantDoc()) {
+    GetOwner()->GetExtantDoc()->WarnOnceAbout(
+        DeprecatedOperations::eSyncXMLHttpRequestDeprecated);
+  }
+
+  Telemetry::Accumulate(Telemetry::XMLHTTPREQUEST_ASYNC_OR_SYNC,
+                        aAsync ? 0 : 1);
+
+  // Step 1
+  nsCOMPtr<Document> responsibleDocument = GetDocumentIfCurrent();
+  if (!responsibleDocument) {
+    // This could be because we're no longer current or because we're in some
+    // non-window context...
+    if (NS_WARN_IF(NS_FAILED(CheckCurrentGlobalCorrectness()))) {
+      aRv.Throw(NS_ERROR_DOM_INVALID_STATE_XHR_HAS_INVALID_CONTEXT);
+      return;
+    }
+  }
+  if (!mPrincipal) {
+    aRv.Throw(NS_ERROR_NOT_INITIALIZED);
+    return;
+  }
+
+  // Gecko-specific
+  if (!aAsync && responsibleDocument && GetOwner()) {
+    // We have no extant document during unload, so the above general
+    // syncXHR warning will not display. But we do want to display a
+    // recommendation to use sendBeacon instead of syncXHR during unload.
+    nsCOMPtr<nsIDocShell> shell = responsibleDocument->GetDocShell();
+    if (shell) {
+      bool inUnload = false;
+      shell->GetIsInUnload(&inUnload);
+      if (inUnload) {
+        LogMessage("UseSendBeaconDuringUnloadAndPagehideWarning", GetOwner());
+      }
+    }
+  }
+
+  // Steps 2-4
+  nsAutoCString method;
+  aRv = FetchUtil::GetValidRequestMethod(aMethod, method);
+  if (NS_WARN_IF(aRv.Failed())) {
+    return;
+  }
+
+  // Steps 5-6
+  nsIURI* baseURI = nullptr;
+  if (mBaseURI) {
+    baseURI = mBaseURI;
+  } else if (responsibleDocument) {
+    baseURI = responsibleDocument->GetBaseURI();
+  }
+
+  // Use the responsible document's encoding for the URL if we have one,
+  // except for dedicated workers. Use UTF-8 otherwise.
+  NotNull<const Encoding*> originCharset = UTF_8_ENCODING;
+  if (responsibleDocument &&
+      responsibleDocument->NodePrincipal() == mPrincipal) {
+    originCharset = responsibleDocument->GetDocumentCharacterSet();
+  }
+
+  nsCOMPtr<nsIURI> parsedURL;
+  nsresult rv =
+      NS_NewURI(getter_AddRefs(parsedURL), aUrl, originCharset, baseURI);
+  if (NS_FAILED(rv)) {
+    aRv.ThrowSyntaxError("'"_ns + aUrl + "' is not a valid URL."_ns);
+    return;
+  }
+  if (NS_WARN_IF(NS_FAILED(CheckCurrentGlobalCorrectness()))) {
+    aRv.Throw(NS_ERROR_DOM_INVALID_STATE_XHR_HAS_INVALID_CONTEXT);
+    return;
+  }
+
+  // Step 7
+  // This is already handled by the other Open() method, which passes
+  // username and password in as NullStrings.
+
+  // Step 8
+  nsAutoCString host;
+  parsedURL->GetHost(host);
+  if (!host.IsEmpty() && (!aUsername.IsVoid() || !aPassword.IsVoid())) {
+    auto mutator = NS_MutateURI(parsedURL);
+    if (!aUsername.IsVoid()) {
+      mutator.SetUsername(NS_ConvertUTF16toUTF8(aUsername));
+    }
+    if (!aPassword.IsVoid()) {
+      mutator.SetPassword(NS_ConvertUTF16toUTF8(aPassword));
+    }
+    Unused << mutator.Finalize(parsedURL);
+  }
+
+  // Step 9
+  if (!aAsync && HasOrHasHadOwner() &&
+      (mTimeoutMilliseconds ||
+       mResponseType != XMLHttpRequestResponseType::_empty)) {
+    if (mTimeoutMilliseconds) {
+      LogMessage("TimeoutSyncXHRWarning", GetOwner());
+    }
+    if (mResponseType != XMLHttpRequestResponseType::_empty) {
+      LogMessage("ResponseTypeSyncXHRWarning", GetOwner());
+    }
+    aRv.ThrowInvalidAccessError(
+        "synchronous XMLHttpRequests do not support timeout and responseType");
+    return;
+  }
+
+  // Step 10
+  TerminateOngoingFetch(NS_OK);
+
+  // Step 11
+  // timeouts are handled without a flag
+  DisconnectDoneNotifier();
+  mFlagSend = false;
+  mRequestMethod.Assign(method);
+  mRequestURL = parsedURL;
+  mFlagSynchronous = !aAsync;
+  mAuthorRequestHeaders.Clear();
+  ResetResponse();
+
+  // Gecko-specific
+  mFlagHadUploadListenersOnSend = false;
+  mFlagAborted = false;
+  mFlagTimedOut = false;
+  mDecoder = nullptr;
+
+  // Per spec we should only create the channel on send(), but we have internal
+  // code that relies on the channel being created now, and that code is not
+  // always IsSystemXHR(). However, we're not supposed to throw channel-creation
+  // errors during open(), so we silently ignore those here.
+  CreateChannel();
+
+  // Step 12
+  if (mState != XMLHttpRequest_Binding::OPENED) {
+    mState = XMLHttpRequest_Binding::OPENED;
+    FireReadystatechangeEvent();
+  }
+}
+
+void XMLHttpRequestMainThread::SetOriginAttributes(
+    const OriginAttributesDictionary& aAttrs) {
+  MOZ_ASSERT((mState == XMLHttpRequest_Binding::OPENED) && !mFlagSend);
+
+  OriginAttributes attrs(aAttrs);
+
+  nsCOMPtr<nsILoadInfo> loadInfo = mChannel->LoadInfo();
+  loadInfo->SetOriginAttributes(attrs);
+}
+
+/*
+ * "Copy" from a stream.
+ */
+nsresult XMLHttpRequestMainThread::StreamReaderFunc(
+    nsIInputStream* in, void* closure, const char* fromRawSegment,
+    uint32_t toOffset, uint32_t count, uint32_t* writeCount) {
+  XMLHttpRequestMainThread* xmlHttpRequest =
+      static_cast<XMLHttpRequestMainThread*>(closure);
+  if (!xmlHttpRequest || !writeCount) {
+    NS_WARNING(
+        "XMLHttpRequest cannot read from stream: no closure or writeCount");
+    return NS_ERROR_FAILURE;
+  }
+
+  nsresult rv = NS_OK;
+
+  if (xmlHttpRequest->mResponseType == XMLHttpRequestResponseType::Blob) {
+    xmlHttpRequest->MaybeCreateBlobStorage();
+    rv = xmlHttpRequest->mBlobStorage->Append(fromRawSegment, count);
+  } else if (xmlHttpRequest->mResponseType ==
+                 XMLHttpRequestResponseType::Arraybuffer &&
+             !xmlHttpRequest->mIsMappedArrayBuffer) {
+    // get the initial capacity to something reasonable to avoid a bunch of
+    // reallocs right at the start
+    if (xmlHttpRequest->mArrayBufferBuilder->Capacity() == 0)
+      xmlHttpRequest->mArrayBufferBuilder->SetCapacity(
+          std::max(count, XML_HTTP_REQUEST_ARRAYBUFFER_MIN_SIZE));
+
+    if (NS_WARN_IF(!xmlHttpRequest->mArrayBufferBuilder->Append(
+            reinterpret_cast<const uint8_t*>(fromRawSegment), count,
+            XML_HTTP_REQUEST_ARRAYBUFFER_MAX_GROWTH))) {
+      return NS_ERROR_OUT_OF_MEMORY;
+    }
+
+  } else if (xmlHttpRequest->mResponseType ==
+                 XMLHttpRequestResponseType::_empty &&
+             xmlHttpRequest->mResponseXML) {
+    // Copy for our own use
+    if (!xmlHttpRequest->mResponseBody.Append(fromRawSegment, count,
+                                              fallible)) {
+      return NS_ERROR_OUT_OF_MEMORY;
+    }
+  } else if (xmlHttpRequest->mResponseType ==
+                 XMLHttpRequestResponseType::_empty ||
+             xmlHttpRequest->mResponseType ==
+                 XMLHttpRequestResponseType::Text ||
+             xmlHttpRequest->mResponseType ==
+                 XMLHttpRequestResponseType::Json) {
+    MOZ_ASSERT(!xmlHttpRequest->mResponseXML,
+               "We shouldn't be parsing a doc here");
+    rv = xmlHttpRequest->AppendToResponseText(
+        AsBytes(Span(fromRawSegment, count)));
+    if (NS_WARN_IF(NS_FAILED(rv))) {
+      return rv;
+    }
+  }
+
+  if (xmlHttpRequest->mFlagParseBody) {
+    // Give the same data to the parser.
+
+    // We need to wrap the data in a new lightweight stream and pass that
+    // to the parser, because calling ReadSegments() recursively on the same
+    // stream is not supported.
+    nsCOMPtr<nsIInputStream> copyStream;
+    rv = NS_NewByteInputStream(getter_AddRefs(copyStream),
+                               Span(fromRawSegment, count),
+                               NS_ASSIGNMENT_DEPEND);
+
+    if (NS_SUCCEEDED(rv) && xmlHttpRequest->mXMLParserStreamListener) {
+      NS_ASSERTION(copyStream, "NS_NewByteInputStream lied");
+      nsresult parsingResult =
+          xmlHttpRequest->mXMLParserStreamListener->OnDataAvailable(
+              xmlHttpRequest->mChannel, copyStream, toOffset, count);
+
+      // No use to continue parsing if we failed here, but we
+      // should still finish reading the stream
+      if (NS_FAILED(parsingResult)) {
+        xmlHttpRequest->mFlagParseBody = false;
+      }
+    }
+  }
+
+  if (NS_SUCCEEDED(rv)) {
+    *writeCount = count;
+  } else {
+    *writeCount = 0;
+  }
+
+  return rv;
+}
+
+namespace {
+
+void GetBlobURIFromChannel(nsIRequest* aRequest, nsIURI** aURI) {
+  MOZ_ASSERT(aRequest);
+  MOZ_ASSERT(aURI);
+
+  *aURI = nullptr;
+
+  nsCOMPtr<nsIChannel> channel = do_QueryInterface(aRequest);
+  if (!channel) {
+    return;
+  }
+
+  nsCOMPtr<nsIURI> uri;
+  nsresult rv = channel->GetURI(getter_AddRefs(uri));
+  if (NS_FAILED(rv)) {
+    return;
+  }
+
+  if (!dom::IsBlobURI(uri)) {
+    return;
+  }
+
+  uri.forget(aURI);
+}
+
+nsresult GetLocalFileFromChannel(nsIRequest* aRequest, nsIFile** aFile) {
+  MOZ_ASSERT(aRequest);
+  MOZ_ASSERT(aFile);
+
+  *aFile = nullptr;
+
+  nsCOMPtr<nsIFileChannel> fc = do_QueryInterface(aRequest);
+  if (!fc) {
+    return NS_OK;
+  }
+
+  nsCOMPtr<nsIFile> file;
+  nsresult rv = fc->GetFile(getter_AddRefs(file));
+  if (NS_WARN_IF(NS_FAILED(rv))) {
+    return rv;
+  }
+
+  file.forget(aFile);
+  return NS_OK;
+}
+
+nsresult DummyStreamReaderFunc(nsIInputStream* aInputStream, void* aClosure,
+                               const char* aFromRawSegment, uint32_t aToOffset,
+                               uint32_t aCount, uint32_t* aWriteCount) {
+  *aWriteCount = aCount;
+  return NS_OK;
+}
+
+class FileCreationHandler final : public PromiseNativeHandler {
+ public:
+  NS_DECL_ISUPPORTS
+
+  static void Create(Promise* aPromise, XMLHttpRequestMainThread* aXHR) {
+    MOZ_ASSERT(aPromise);
+
+    RefPtr<FileCreationHandler> handler = new FileCreationHandler(aXHR);
+    aPromise->AppendNativeHandler(handler);
+  }
+
+  void ResolvedCallback(JSContext* aCx, JS::Handle<JS::Value> aValue,
+                        ErrorResult& aRv) override {
+    if (NS_WARN_IF(!aValue.isObject())) {
+      mXHR->LocalFileToBlobCompleted(nullptr);
+      return;
+    }
+
+    RefPtr<Blob> blob;
+    if (NS_WARN_IF(NS_FAILED(UNWRAP_OBJECT(Blob, &aValue.toObject(), blob)))) {
+      mXHR->LocalFileToBlobCompleted(nullptr);
+      return;
+    }
+
+    mXHR->LocalFileToBlobCompleted(blob->Impl());
+  }
+
+  void RejectedCallback(JSContext* aCx, JS::Handle<JS::Value> aValue,
+                        ErrorResult& aRv) override {
+    mXHR->LocalFileToBlobCompleted(nullptr);
+  }
+
+ private:
+  explicit FileCreationHandler(XMLHttpRequestMainThread* aXHR) : mXHR(aXHR) {
+    MOZ_ASSERT(aXHR);
+  }
+
+  ~FileCreationHandler() = default;
+
+  RefPtr<XMLHttpRequestMainThread> mXHR;
+};
+
+NS_IMPL_ISUPPORTS0(FileCreationHandler)
+
+}  // namespace
+
+void XMLHttpRequestMainThread::LocalFileToBlobCompleted(BlobImpl* aBlobImpl) {
+  MOZ_ASSERT(mState != XMLHttpRequest_Binding::DONE);
+
+  mResponseBlobImpl = aBlobImpl;
+  mBlobStorage = nullptr;
+  NS_ASSERTION(mResponseBody.IsEmpty(), "mResponseBody should be empty");
+
+  ChangeStateToDone(mFlagSyncLooping);
+}
+
+NS_IMETHODIMP
+XMLHttpRequestMainThread::OnDataAvailable(nsIRequest* request,
+                                          nsIInputStream* inStr,
+                                          uint64_t sourceOffset,
+                                          uint32_t count) {
+  DEBUG_WORKERREFS;
+  NS_ENSURE_ARG_POINTER(inStr);
+
+  mProgressSinceLastProgressEvent = true;
+  XMLHttpRequest_Binding::ClearCachedResponseTextValue(this);
+
+  nsresult rv;
+
+  if (mResponseType == XMLHttpRequestResponseType::Blob) {
+    nsCOMPtr<nsIFile> localFile;
+    nsCOMPtr<nsIURI> blobURI;
+    GetBlobURIFromChannel(request, getter_AddRefs(blobURI));
+    if (blobURI) {
+      RefPtr<BlobImpl> blobImpl;
+      rv = NS_GetBlobForBlobURI(blobURI, getter_AddRefs(blobImpl));
+      if (NS_SUCCEEDED(rv)) {
+        mResponseBlobImpl = blobImpl;
+      }
+    } else {
+      rv = GetLocalFileFromChannel(request, getter_AddRefs(localFile));
+    }
+    if (NS_WARN_IF(NS_FAILED(rv))) {
+      return rv;
+    }
+
+    if (mResponseBlobImpl || localFile) {
+      mBlobStorage = nullptr;
+      NS_ASSERTION(mResponseBody.IsEmpty(), "mResponseBody should be empty");
+
+      // The nsIStreamListener contract mandates us to read from the stream
+      // before returning.
+      uint32_t totalRead;
+      rv = inStr->ReadSegments(DummyStreamReaderFunc, nullptr, count,
+                               &totalRead);
+      NS_ENSURE_SUCCESS(rv, rv);
+
+      ChangeState(XMLHttpRequest_Binding::LOADING);
+
+      // Cancel() must be called with an error. We use
+      // NS_ERROR_FILE_ALREADY_EXISTS to know that we've aborted the operation
+      // just because we can retrieve the File from the channel directly.
+      return request->Cancel(NS_ERROR_FILE_ALREADY_EXISTS);
+    }
+  }
+
+  uint32_t totalRead;
+  rv = inStr->ReadSegments(XMLHttpRequestMainThread::StreamReaderFunc,
+                           (void*)this, count, &totalRead);
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  // Fire the first progress event/loading state change
+  if (mState == XMLHttpRequest_Binding::HEADERS_RECEIVED) {
+    ChangeState(XMLHttpRequest_Binding::LOADING);
+    if (!mFlagSynchronous) {
+      DispatchProgressEvent(this, Events::progress, mLoadTransferred,
+                            mLoadTotal);
+    }
+    mProgressSinceLastProgressEvent = false;
+  }
+
+  if (!mFlagSynchronous && !mProgressTimerIsActive) {
+    StartProgressEventTimer();
+  }
+
+  return NS_OK;
+}
+
+NS_IMETHODIMP
+XMLHttpRequestMainThread::OnStartRequest(nsIRequest* request) {
+  DEBUG_WORKERREFS;
+  AUTO_PROFILER_LABEL("XMLHttpRequestMainThread::OnStartRequest", NETWORK);
+
+  nsresult rv = NS_OK;
+
+  if (request != mChannel) {
+    // Can this still happen?
+    return NS_OK;
+  }
+
+  // Don't do anything if we have been aborted
+  if (mState == XMLHttpRequest_Binding::UNSENT) {
+    return NS_OK;
+  }
+
+  // Don't do anything if we're in mid-abort, but let the request
+  // know (this can happen due to race conditions in valid XHRs,
+  // see bz1070763 for info).
+  if (mFlagAborted) {
+    return NS_BINDING_ABORTED;
+  }
+
+  // Don't do anything if we have timed out.
+  if (mFlagTimedOut) {
+    return NS_OK;
+  }
+
+  // If we were asked for a bad range on a blob URL, but we're async,
+  // we should throw now in order to fire an error progress event.
+  if (IsBlobURI(mRequestURL) && GetRequestedContentRange().isNothing() &&
+      mAuthorRequestHeaders.Has("range")) {
+    return NS_ERROR_NET_PARTIAL_TRANSFER;
+  }
+
+  nsCOMPtr<nsIChannel> channel(do_QueryInterface(request));
+  NS_ENSURE_TRUE(channel, NS_ERROR_UNEXPECTED);
+
+  nsresult status;
+  request->GetStatus(&status);
+  if (mErrorLoad == ErrorType::eOK && NS_FAILED(status)) {
+    mErrorLoad = ErrorType::eRequest;
+    mErrorLoadDetail = status;
+  }
+
+  // Upload phase is now over. If we were uploading anything,
+  // stop the timer and fire any final progress events.
+  if (mUpload && !mUploadComplete && mErrorLoad == ErrorType::eOK &&
+      !mFlagSynchronous) {
+    StopProgressEventTimer();
+
+    mUploadTransferred = mUploadTotal;
+
+    if (mProgressSinceLastProgressEvent) {
+      DispatchProgressEvent(mUpload, Events::progress, mUploadTransferred,
+                            mUploadTotal);
+      mProgressSinceLastProgressEvent = false;
+    }
+
+    mUploadComplete = true;
+    DispatchProgressEvent(mUpload, Events::load, mUploadTotal, mUploadTotal);
+  }
+
+  mFlagParseBody = true;
+  if (mErrorLoad == ErrorType::eOK) {
+    ChangeState(XMLHttpRequest_Binding::HEADERS_RECEIVED);
+  }
+
+  ResetResponse();
+
+  if (!mOverrideMimeType.IsEmpty()) {
+    channel->SetContentType(NS_ConvertUTF16toUTF8(mOverrideMimeType));
+  }
+
+  // Fallback to 'application/octet-stream' (leaving data URLs alone)
+  if (!IsBlobURI(mRequestURL)) {
+    nsAutoCString type;
+    channel->GetContentType(type);
+    if (type.IsEmpty() || type.EqualsLiteral(UNKNOWN_CONTENT_TYPE)) {
+      channel->SetContentType(nsLiteralCString(APPLICATION_OCTET_STREAM));
+    }
+  }
+
+  DetectCharset();
+
+  // Set up arraybuffer
+  if (mResponseType == XMLHttpRequestResponseType::Arraybuffer &&
+      NS_SUCCEEDED(status)) {
+    if (mIsMappedArrayBuffer) {
+      nsCOMPtr<nsIJARChannel> jarChannel = do_QueryInterface(channel);
+      if (jarChannel) {
+        nsCOMPtr<nsIURI> uri;
+        rv = channel->GetURI(getter_AddRefs(uri));
+        if (NS_SUCCEEDED(rv)) {
+          nsAutoCString file;
+          nsAutoCString scheme;
+          uri->GetScheme(scheme);
+          if (scheme.LowerCaseEqualsLiteral("jar")) {
+            nsCOMPtr<nsIJARURI> jarURI = do_QueryInterface(uri);
+            if (jarURI) {
+              jarURI->GetJAREntry(file);
+            }
+          }
+          nsCOMPtr<nsIFile> jarFile;
+          jarChannel->GetJarFile(getter_AddRefs(jarFile));
+          if (!jarFile) {
+            mIsMappedArrayBuffer = false;
+          } else {
+            rv = mArrayBufferBuilder->MapToFileInPackage(file, jarFile);
+            // This can happen legitimately if there are compressed files
+            // in the jarFile. See bug #1357219. No need to warn on the error.
+            if (NS_FAILED(rv)) {
+              mIsMappedArrayBuffer = false;
+            } else {
+              channel->SetContentType("application/mem-mapped"_ns);
+            }
+          }
+        }
+      }
+    }
+    // If memory mapping failed, mIsMappedArrayBuffer would be set to false,
+    // and we want it fallback to the malloc way.
+    if (!mIsMappedArrayBuffer) {
+      int64_t contentLength;
+      rv = channel->GetContentLength(&contentLength);
+      if (NS_SUCCEEDED(rv) && contentLength > 0 &&
+          contentLength < XML_HTTP_REQUEST_MAX_CONTENT_LENGTH_PREALLOCATE) {
+        mArrayBufferBuilder->SetCapacity(static_cast<int32_t>(contentLength));
+      }
+    }
+  }
+
+  // Set up responseXML
+  // Fetch spec Main Fetch step 21: ignore body for head/connect methods.
+  bool parseBody = (mResponseType == XMLHttpRequestResponseType::_empty ||
+                    mResponseType == XMLHttpRequestResponseType::Document) &&
+                   !(mRequestMethod.EqualsLiteral("HEAD") ||
+                     mRequestMethod.EqualsLiteral("CONNECT"));
+
+  if (parseBody) {
+    // Do not try to parse documents if content-length = 0
+    int64_t contentLength;
+    if (NS_SUCCEEDED(mChannel->GetContentLength(&contentLength)) &&
+        contentLength == 0) {
+      parseBody = false;
+    }
+  }
+
+  mIsHtml = false;
+  mWarnAboutSyncHtml = false;
+  if (parseBody && NS_SUCCEEDED(status)) {
+    // We can gain a huge performance win by not even trying to
+    // parse non-XML data. This also protects us from the situation
+    // where we have an XML document and sink, but HTML (or other)
+    // parser, which can produce unreliable results.
+    nsAutoCString type;
+    channel->GetContentType(type);
+
+    if ((mResponseType == XMLHttpRequestResponseType::Document) &&
+        type.EqualsLiteral("text/html")) {
+      // HTML parsing is only supported for responseType == "document" to
+      // avoid running the parser and, worse, populating responseXML for
+      // legacy users of XHR who use responseType == "" for retrieving the
+      // responseText of text/html resources. This legacy case is so common
+      // that it's not useful to emit a warning about it.
+      if (mFlagSynchronous) {
+        // We don't make cool new features available in the bad synchronous
+        // mode. The synchronous mode is for legacy only.
+        mWarnAboutSyncHtml = true;
+        mFlagParseBody = false;
+      } else {
+        mIsHtml = true;
+      }
+    } else if (!type.IsEmpty() && (!(type.EqualsLiteral("text/xml") ||
+                                     type.EqualsLiteral("application/xml") ||
+                                     StringEndsWith(type, "+xml"_ns)))) {
+      // Follow https://xhr.spec.whatwg.org/
+      // If final MIME type is not null, text/html, text/xml, application/xml,
+      // or does not end in +xml, return null.
+      mFlagParseBody = false;
+    }
+  } else {
+    // The request failed, so we shouldn't be parsing anyway
+    mFlagParseBody = false;
+  }
+
+  if (mFlagParseBody) {
+    nsCOMPtr<nsIURI> baseURI, docURI;
+    rv = mChannel->GetURI(getter_AddRefs(docURI));
+    NS_ENSURE_SUCCESS(rv, rv);
+    baseURI = docURI;
+
+    nsCOMPtr<Document> doc = GetDocumentIfCurrent();
+    nsCOMPtr<nsIURI> chromeXHRDocURI, chromeXHRDocBaseURI;
+    if (doc) {
+      chromeXHRDocURI = doc->GetDocumentURI();
+      chromeXHRDocBaseURI = doc->GetBaseURI();
+    } else {
+      // If we're no longer current, just kill the load, though it really should
+      // have been killed already.
+      if (NS_WARN_IF(NS_FAILED(CheckCurrentGlobalCorrectness()))) {
+        return NS_ERROR_DOM_INVALID_STATE_XHR_HAS_INVALID_CONTEXT;
+      }
+    }
+
+    // Create an empty document from it.
+    const auto& emptyStr = u""_ns;
+    nsIGlobalObject* global = DOMEventTargetHelper::GetParentObject();
+
+    nsCOMPtr<nsIPrincipal> requestingPrincipal;
+    rv = nsContentUtils::GetSecurityManager()->GetChannelResultPrincipal(
+        channel, getter_AddRefs(requestingPrincipal));
+    NS_ENSURE_SUCCESS(rv, rv);
+
+    rv = NS_NewDOMDocument(
+        getter_AddRefs(mResponseXML), emptyStr, emptyStr, nullptr, docURI,
+        baseURI, requestingPrincipal, true, global,
+        mIsHtml ? DocumentFlavorHTML : DocumentFlavorLegacyGuess);
+    NS_ENSURE_SUCCESS(rv, rv);
+    mResponseXML->SetChromeXHRDocURI(chromeXHRDocURI);
+    mResponseXML->SetChromeXHRDocBaseURI(chromeXHRDocBaseURI);
+
+    // suppress parsing failure messages to console for statuses which
+    // can have empty bodies (see bug 884693).
+    IgnoredErrorResult rv2;
+    uint32_t responseStatus = GetStatus(rv2);
+    if (!rv2.Failed() && (responseStatus == 201 || responseStatus == 202 ||
+                          responseStatus == 204 || responseStatus == 205 ||
+                          responseStatus == 304)) {
+      mResponseXML->SetSuppressParserErrorConsoleMessages(true);
+    }
+
+    nsCOMPtr<nsILoadInfo> loadInfo = mChannel->LoadInfo();
+    bool isCrossSite = false;
+    isCrossSite = loadInfo->GetTainting() != LoadTainting::Basic;
+
+    if (isCrossSite) {
+      mResponseXML->DisableCookieAccess();
+    }
+
+    nsCOMPtr<nsIStreamListener> listener;
+    nsCOMPtr<nsILoadGroup> loadGroup;
+    channel->GetLoadGroup(getter_AddRefs(loadGroup));
+
+    // suppress <parsererror> nodes on XML document parse failure, but only
+    // for non-privileged code (including Web Extensions). See bug 289714.
+    if (!IsSystemXHR()) {
+      mResponseXML->SetSuppressParserErrorElement(true);
+    }
+
+    rv = mResponseXML->StartDocumentLoad(kLoadAsData, channel, loadGroup,
+                                         nullptr, getter_AddRefs(listener),
+                                         !isCrossSite);
+    NS_ENSURE_SUCCESS(rv, rv);
+
+    // the spec requires the response document.referrer to be the empty string
+    nsCOMPtr<nsIReferrerInfo> referrerInfo =
+        new ReferrerInfo(nullptr, mResponseXML->ReferrerPolicy());
+    mResponseXML->SetReferrerInfo(referrerInfo);
+
+    mXMLParserStreamListener = listener;
+    rv = mXMLParserStreamListener->OnStartRequest(request);
+    NS_ENSURE_SUCCESS(rv, rv);
+  }
+
+  // Download phase beginning; start the progress event timer if necessary.
+  if (NS_SUCCEEDED(rv) && HasListenersFor(nsGkAtoms::onprogress)) {
+    StartProgressEventTimer();
+  }
+
+  return NS_OK;
+}
+
+NS_IMETHODIMP
+XMLHttpRequestMainThread::OnStopRequest(nsIRequest* request, nsresult status) {
+  DEBUG_WORKERREFS;
+  AUTO_PROFILER_LABEL("XMLHttpRequestMainThread::OnStopRequest", NETWORK);
+
+  if (request != mChannel) {
+    // Can this still happen?
+    return NS_OK;
+  }
+
+  // Send the decoder the signal that we've hit the end of the stream,
+  // but only when decoding text eagerly.
+  if (mDecoder && ((mResponseType == XMLHttpRequestResponseType::Text) ||
+                   (mResponseType == XMLHttpRequestResponseType::Json) ||
+                   (mResponseType == XMLHttpRequestResponseType::_empty &&
+                    !mResponseXML))) {
+    AppendToResponseText(Span<const uint8_t>(), true);
+  }
+
+  mWaitingForOnStopRequest = false;
+
+  // make sure to notify the listener if we were aborted
+  // XXX in fact, why don't we do the cleanup below in this case??
+  // UNSENT is for abort calls.  See OnStartRequest above.
+  if (mState == XMLHttpRequest_Binding::UNSENT || mFlagTimedOut) {
+    if (mXMLParserStreamListener)
+      (void)mXMLParserStreamListener->OnStopRequest(request, status);
+    return NS_OK;
+  }
+
+  // Is this good enough here?
+  if (mXMLParserStreamListener && mFlagParseBody) {
+    mXMLParserStreamListener->OnStopRequest(request, status);
+  }
+
+  mXMLParserStreamListener = nullptr;
+  mContext = nullptr;
+
+  // If window.stop() or other aborts were issued, handle as an abort
+  if (status == NS_BINDING_ABORTED) {
+    mFlagParseBody = false;
+    IgnoredErrorResult rv;
+    RequestErrorSteps(Events::abort, NS_ERROR_DOM_ABORT_ERR, rv);
+    ChangeState(XMLHttpRequest_Binding::UNSENT, false);
+    return NS_OK;
+  }
+
+  // If we were just reading a blob URL, we're already done
+  if (status == NS_ERROR_FILE_ALREADY_EXISTS && mResponseBlobImpl) {
+    ChangeStateToDone(mFlagSyncLooping);
+    return NS_OK;
+  }
+
+  bool waitingForBlobCreation = false;
+
+  // If we have this error, we have to deal with a file: URL + responseType =
+  // blob. We have this error because we canceled the channel. The status will
+  // be set to NS_OK.
+  if (!mResponseBlobImpl && status == NS_ERROR_FILE_ALREADY_EXISTS &&
+      mResponseType == XMLHttpRequestResponseType::Blob) {
+    nsCOMPtr<nsIFile> file;
+    nsresult rv = GetLocalFileFromChannel(request, getter_AddRefs(file));
+    if (NS_WARN_IF(NS_FAILED(rv))) {
+      return rv;
+    }
+
+    if (file) {
+      nsAutoCString contentType;
+      rv = mChannel->GetContentType(contentType);
+      if (NS_WARN_IF(NS_FAILED(rv))) {
+        return rv;
+      }
+
+      ChromeFilePropertyBag bag;
+      CopyUTF8toUTF16(contentType, bag.mType);
+
+      nsCOMPtr<nsIGlobalObject> global = GetOwnerGlobal();
+
+      ErrorResult error;
+      RefPtr<Promise> promise =
+          FileCreatorHelper::CreateFile(global, file, bag, true, error);
+      if (NS_WARN_IF(error.Failed())) {
+        return error.StealNSResult();
+      }
+
+      FileCreationHandler::Create(promise, this);
+      waitingForBlobCreation = true;
+      status = NS_OK;
+
+      NS_ASSERTION(mResponseBody.IsEmpty(), "mResponseBody should be empty");
+      NS_ASSERTION(mResponseText.IsEmpty(), "mResponseText should be empty");
+    }
+  }
+
+  if (NS_SUCCEEDED(status) &&
+      mResponseType == XMLHttpRequestResponseType::Blob &&
+      !waitingForBlobCreation) {
+    // Smaller files may be written in cache map instead of separate files.
+    // Also, no-store response cannot be written in persistent cache.
+    nsAutoCString contentType;
+    if (!mOverrideMimeType.IsEmpty()) {
+      contentType.Assign(NS_ConvertUTF16toUTF8(mOverrideMimeType));
+    } else {
+      mChannel->GetContentType(contentType);
+    }
+
+    // mBlobStorage can be null if the channel is non-file non-cacheable
+    // and if the response length is zero.
+    MaybeCreateBlobStorage();
+    mBlobStorage->GetBlobImplWhenReady(contentType, this);
+    waitingForBlobCreation = true;
+
+    NS_ASSERTION(mResponseBody.IsEmpty(), "mResponseBody should be empty");
+    NS_ASSERTION(mResponseText.IsEmpty(), "mResponseText should be empty");
+  } else if (NS_SUCCEEDED(status) && !mIsMappedArrayBuffer &&
+             mResponseType == XMLHttpRequestResponseType::Arraybuffer) {
+    // set the capacity down to the actual length, to realloc back
+    // down to the actual size
+    if (!mArrayBufferBuilder->SetCapacity(mArrayBufferBuilder->Length())) {
+      // this should never happen!
+      status = NS_ERROR_UNEXPECTED;
+    }
+  }
+
+  nsCOMPtr<nsIChannel> channel(do_QueryInterface(request));
+  NS_ENSURE_TRUE(channel, NS_ERROR_UNEXPECTED);
+
+  channel->SetNotificationCallbacks(nullptr);
+  mNotificationCallbacks = nullptr;
+  mChannelEventSink = nullptr;
+  mProgressEventSink = nullptr;
+
+  bool wasSync = mFlagSyncLooping;
+  mFlagSyncLooping = false;
+  mRequestSentTime = 0;
+
+  // update our charset and decoder to match mResponseXML,
+  // before it is possibly nulled out
+  MatchCharsetAndDecoderToResponseDocument();
+
+  if (NS_FAILED(status)) {
+    // This can happen if the server is unreachable. Other possible
+    // reasons are that the user leaves the page or hits the ESC key.
+
+    mErrorLoad = ErrorType::eUnreachable;
+    mErrorLoadDetail = status;
+    mResponseXML = nullptr;
+
+    // Handle network errors specifically per spec.
+    if (NS_ERROR_GET_MODULE(status) == NS_ERROR_MODULE_NETWORK) {
+      MOZ_LOG(gXMLHttpRequestLog, LogLevel::Debug,
+              ("%p detected networking error 0x%" PRIx32 "\n", this,
+               static_cast<uint32_t>(status)));
+      IgnoredErrorResult rv;
+      mFlagParseBody = false;
+      RequestErrorSteps(Events::error, NS_ERROR_DOM_NETWORK_ERR, rv);
+      // RequestErrorSteps will not call ChangeStateToDone for sync XHRs, so we
+      // do so here to ensure progress events are sent and our state is sane.
+      if (mFlagSynchronous) {
+        ChangeStateToDone(wasSync);
+      }
+      return NS_OK;
+    }
+
+    MOZ_LOG(gXMLHttpRequestLog, LogLevel::Debug,
+            ("%p detected unreachable error 0x%" PRIx32 "\n", this,
+             static_cast<uint32_t>(status)));
+  }
+
+  // If we're uninitialized at this point, we encountered an error
+  // earlier and listeners have already been notified. Also we do
+  // not want to do this if we already completed.
+  if (mState == XMLHttpRequest_Binding::UNSENT ||
+      mState == XMLHttpRequest_Binding::DONE) {
+    return NS_OK;
+  }
+
+  if (!mResponseXML) {
+    mFlagParseBody = false;
+
+    // We postpone the 'done' until the creation of the Blob is completed.
+    if (!waitingForBlobCreation) {
+      ChangeStateToDone(wasSync);
+    }
+
+    return NS_OK;
+  }
+
+  if (mIsHtml) {
+    NS_ASSERTION(!mFlagSyncLooping,
+                 "We weren't supposed to support HTML parsing with XHR!");
+    mParseEndListener = new nsXHRParseEndListener(this);
+    RefPtr<EventTarget> eventTarget = mResponseXML;
+    EventListenerManager* manager = eventTarget->GetOrCreateListenerManager();
+    manager->AddEventListenerByType(mParseEndListener,
+                                    kLiteralString_DOMContentLoaded,
+                                    TrustedEventsAtSystemGroupBubble());
+    return NS_OK;
+  } else {
+    mFlagParseBody = false;
+  }
+
+  // We might have been sent non-XML data. If that was the case,
+  // we should null out the document member. The idea in this
+  // check here is that if there is no document element it is not
+  // an XML document. We might need a fancier check...
+  if (!mResponseXML->GetRootElement()) {
+    mErrorParsingXML = true;
+    mResponseXML = nullptr;
+  }
+  ChangeStateToDone(wasSync);
+  return NS_OK;
+}
+
+void XMLHttpRequestMainThread::OnBodyParseEnd() {
+  mFlagParseBody = false;
+  mParseEndListener = nullptr;
+  ChangeStateToDone(mFlagSyncLooping);
+}
+
+void XMLHttpRequestMainThread::MatchCharsetAndDecoderToResponseDocument() {
+  if (mResponseXML &&
+      (!mDecoder ||
+       mDecoder->Encoding() != mResponseXML->GetDocumentCharacterSet())) {
+    TruncateResponseText();
+    mResponseBodyDecodedPos = 0;
+    mEofDecoded = false;
+    mDecoder = mResponseXML->GetDocumentCharacterSet()->NewDecoder();
+  }
+}
+
+void XMLHttpRequestMainThread::DisconnectDoneNotifier() {
+  if (mDelayedDoneNotifier) {
+    // Disconnect may release the last reference to 'this'.
+    RefPtr<XMLHttpRequestMainThread> kungfuDeathGrip = this;
+    mDelayedDoneNotifier->Disconnect();
+    mDelayedDoneNotifier = nullptr;
+  }
+}
+
+void XMLHttpRequestMainThread::ChangeStateToDone(bool aWasSync) {
+  DEBUG_WORKERREFS;
+  DisconnectDoneNotifier();
+
+  if (!mForWorker && !aWasSync && mChannel) {
+    // If the top level page is loading, try to postpone the handling of the
+    // final events.
+    nsLoadFlags loadFlags = 0;
+    mChannel->GetLoadFlags(&loadFlags);
+    if (loadFlags & nsIRequest::LOAD_BACKGROUND) {
+      nsPIDOMWindowInner* owner = GetOwner();
+      BrowsingContext* bc = owner ? owner->GetBrowsingContext() : nullptr;
+      bc = bc ? bc->Top() : nullptr;
+      if (bc && bc->IsLoading()) {
+        MOZ_ASSERT(!mDelayedDoneNotifier);
+        RefPtr<XMLHttpRequestDoneNotifier> notifier =
+            new XMLHttpRequestDoneNotifier(this);
+        mDelayedDoneNotifier = notifier;
+        bc->AddDeprioritizedLoadRunner(notifier);
+        return;
+      }
+    }
+  }
+
+  ChangeStateToDoneInternal();
+}
+
+void XMLHttpRequestMainThread::ChangeStateToDoneInternal() {
+  DEBUG_WORKERREFS;
+  DisconnectDoneNotifier();
+  StopProgressEventTimer();
+
+  MOZ_ASSERT(!mFlagParseBody,
+             "ChangeStateToDone() called before async HTML parsing is done.");
+
+  mFlagSend = false;
+
+  CancelTimeoutTimer();
+
+  // Per spec, fire the last download progress event, if any,
+  // before readystatechange=4/done. (Note that 0-sized responses
+  // will have not sent a progress event yet, so one must be sent here).
+  if (!mFlagSynchronous &&
+      (!mLoadTransferred || mProgressSinceLastProgressEvent)) {
+    DispatchProgressEvent(this, Events::progress, mLoadTransferred, mLoadTotal);
+    mProgressSinceLastProgressEvent = false;
+  }
+
+  // Notify the document when an XHR request completes successfully.
+  // This is used by the password manager as a hint to observe DOM mutations.
+  // Call this prior to changing state to DONE to ensure we set up the
+  // observer before mutations occur.
+  if (mErrorLoad == ErrorType::eOK) {
+    Document* doc = GetDocumentIfCurrent();
+    if (doc) {
+      doc->NotifyFetchOrXHRSuccess();
+    }
+  }
+
+  // Per spec, fire readystatechange=4/done before final error events.
+  ChangeState(XMLHttpRequest_Binding::DONE, true);
+
+  // Per spec, if we failed in the upload phase, fire a final error
+  // and loadend events for the upload after readystatechange=4/done.
+  if (!mFlagSynchronous && mUpload && !mUploadComplete) {
+    DispatchProgressEvent(mUpload, Events::error, 0, -1);
+  }
+
+  // Per spec, fire download's load/error and loadend events after
+  // readystatechange=4/done (and of course all upload events).
+  if (mErrorLoad != ErrorType::eOK) {
+    DispatchProgressEvent(this, Events::error, 0, -1);
+  } else {
+    DispatchProgressEvent(this, Events::load, mLoadTransferred, mLoadTotal);
+  }
+
+  if (mErrorLoad != ErrorType::eOK) {
+    // By nulling out channel here we make it so that Send() can test
+    // for that and throw. Also calling the various status
+    // methods/members will not throw.
+    // This matches what IE does.
+    mChannel = nullptr;
+  }
+}
+
+nsresult XMLHttpRequestMainThread::CreateChannel() {
+  DEBUG_WORKERREFS;
+  // When we are called from JS we can find the load group for the page,
+  // and add ourselves to it. This way any pending requests
+  // will be automatically aborted if the user leaves the page.
+  nsCOMPtr<nsILoadGroup> loadGroup = GetLoadGroup();
+
+  nsSecurityFlags secFlags;
+  nsLoadFlags loadFlags = nsIRequest::LOAD_BACKGROUND;
+  uint32_t sandboxFlags = 0;
+  if (mPrincipal->IsSystemPrincipal()) {
+    // When chrome is loading we want to make sure to sandbox any potential
+    // result document. We also want to allow cross-origin loads.
+    secFlags = nsILoadInfo::SEC_ALLOW_CROSS_ORIGIN_SEC_CONTEXT_IS_NULL;
+    sandboxFlags = SANDBOXED_ORIGIN;
+  } else if (IsSystemXHR()) {
+    // For pages that have appropriate permissions, we want to still allow
+    // cross-origin loads, but make sure that the any potential result
+    // documents get the same principal as the loader.
+    secFlags = nsILoadInfo::SEC_ALLOW_CROSS_ORIGIN_INHERITS_SEC_CONTEXT |
+               nsILoadInfo::SEC_FORCE_INHERIT_PRINCIPAL;
+    loadFlags |= nsIChannel::LOAD_BYPASS_SERVICE_WORKER;
+  } else {
+    // Otherwise use CORS. Again, make sure that potential result documents
+    // use the same principal as the loader.
+    secFlags = nsILoadInfo::SEC_REQUIRE_CORS_INHERITS_SEC_CONTEXT |
+               nsILoadInfo::SEC_FORCE_INHERIT_PRINCIPAL;
+  }
+
+  if (mIsAnon) {
+    secFlags |= nsILoadInfo::SEC_COOKIES_OMIT;
+  }
+
+  // Use the responsibleDocument if we have it, except for dedicated workers
+  // where it will be the parent document, which is not the one we want to use.
+  nsresult rv;
+  nsCOMPtr<Document> responsibleDocument = GetDocumentIfCurrent();
+  if (responsibleDocument &&
+      responsibleDocument->NodePrincipal() == mPrincipal) {
+    rv = NS_NewChannel(getter_AddRefs(mChannel), mRequestURL,
+                       responsibleDocument, secFlags,
+                       nsIContentPolicy::TYPE_INTERNAL_XMLHTTPREQUEST,
+                       nullptr,  // aPerformanceStorage
+                       loadGroup,
+                       nullptr,  // aCallbacks
+                       loadFlags, nullptr, sandboxFlags);
+  } else if (mClientInfo.isSome()) {
+    rv = NS_NewChannel(getter_AddRefs(mChannel), mRequestURL, mPrincipal,
+                       mClientInfo.ref(), mController, secFlags,
+                       nsIContentPolicy::TYPE_INTERNAL_XMLHTTPREQUEST,
+                       mCookieJarSettings,
+                       mPerformanceStorage,  // aPerformanceStorage
+                       loadGroup,
+                       nullptr,  // aCallbacks
+                       loadFlags, nullptr, sandboxFlags);
+  } else {
+    // Otherwise use the principal.
+    rv = NS_NewChannel(getter_AddRefs(mChannel), mRequestURL, mPrincipal,
+                       secFlags, nsIContentPolicy::TYPE_INTERNAL_XMLHTTPREQUEST,
+                       mCookieJarSettings,
+                       mPerformanceStorage,  // aPerformanceStorage
+                       loadGroup,
+                       nullptr,  // aCallbacks
+                       loadFlags, nullptr, sandboxFlags);
+  }
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  if (mCSPEventListener) {
+    nsCOMPtr<nsILoadInfo> loadInfo = mChannel->LoadInfo();
+    rv = loadInfo->SetCspEventListener(mCSPEventListener);
+    NS_ENSURE_SUCCESS(rv, rv);
+  }
+
+  nsCOMPtr<nsIHttpChannel> httpChannel(do_QueryInterface(mChannel));
+  if (httpChannel) {
+    rv = httpChannel->SetRequestMethod(mRequestMethod);
+    NS_ENSURE_SUCCESS(rv, rv);
+
+    httpChannel->SetSource(profiler_capture_backtrace());
+
+    // Set the initiator type
+    nsCOMPtr<nsITimedChannel> timedChannel(do_QueryInterface(httpChannel));
+    if (timedChannel) {
+      timedChannel->SetInitiatorType(u"xmlhttprequest"_ns);
+    }
+  }
+
+  return NS_OK;
+}
+
+void XMLHttpRequestMainThread::MaybeLowerChannelPriority() {
+  nsCOMPtr<Document> doc = GetDocumentIfCurrent();
+  if (!doc) {
+    return;
+  }
+
+  AutoJSAPI jsapi;
+  if (!jsapi.Init(GetOwnerGlobal())) {
+    return;
+  }
+
+  JSContext* cx = jsapi.cx();
+
+  if (!doc->IsScriptTracking(cx)) {
+    return;
+  }
+
+  if (StaticPrefs::network_http_tailing_enabled()) {
+    nsCOMPtr<nsIClassOfService> cos = do_QueryInterface(mChannel);
+    if (cos) {
+      // Adding TailAllowed to overrule the Unblocked flag, but to preserve
+      // the effect of Unblocked when tailing is off.
+      cos->AddClassFlags(nsIClassOfService::Throttleable |
+                         nsIClassOfService::Tail |
+                         nsIClassOfService::TailAllowed);
+    }
+  }
+
+  nsCOMPtr<nsISupportsPriority> p = do_QueryInterface(mChannel);
+  if (p) {
+    p->SetPriority(nsISupportsPriority::PRIORITY_LOWEST);
+  }
+}
+
+nsresult XMLHttpRequestMainThread::InitiateFetch(
+    already_AddRefed<nsIInputStream> aUploadStream, int64_t aUploadLength,
+    nsACString& aUploadContentType) {
+  DEBUG_WORKERREFS;
+  nsresult rv;
+  nsCOMPtr<nsIInputStream> uploadStream = std::move(aUploadStream);
+
+  if (!uploadStream) {
+    RefPtr<PreloaderBase> preload = FindPreload();
+    if (preload) {
+      // Because of bug 682305, we can't let listener be the XHR object itself
+      // because JS wouldn't be able to use it. So create a listener around
+      // 'this'. Make sure to hold a strong reference so that we don't leak the
+      // wrapper.
+      nsCOMPtr<nsIStreamListener> listener =
+          new net::nsStreamListenerWrapper(this);
+      rv = preload->AsyncConsume(listener);
+      if (NS_SUCCEEDED(rv)) {
+        mFromPreload = true;
+
+        // May be null when the preload has already finished, but the XHR code
+        // is safe to live with it.
+        mChannel = preload->Channel();
+        MOZ_ASSERT(mChannel);
+        EnsureChannelContentType();
+        return NS_OK;
+      }
+
+      preload = nullptr;
+    }
+  }
+
+  // nsIRequest::LOAD_BACKGROUND prevents throbber from becoming active, which
+  // in turn keeps STOP button from becoming active.  If the consumer passed in
+  // a progress event handler we must load with nsIRequest::LOAD_NORMAL or
+  // necko won't generate any progress notifications.
+  if (HasListenersFor(nsGkAtoms::onprogress) ||
+      (mUpload && mUpload->HasListenersFor(nsGkAtoms::onprogress))) {
+    nsLoadFlags loadFlags;
+    mChannel->GetLoadFlags(&loadFlags);
+    loadFlags &= ~nsIRequest::LOAD_BACKGROUND;
+    loadFlags |= nsIRequest::LOAD_NORMAL;
+    mChannel->SetLoadFlags(loadFlags);
+  }
+
+  nsCOMPtr<nsIHttpChannel> httpChannel(do_QueryInterface(mChannel));
+  if (httpChannel) {
+    // If the user hasn't overridden the Accept header, set it to */* per spec.
+    if (!mAuthorRequestHeaders.Has("accept")) {
+      mAuthorRequestHeaders.Set("accept", "*/*"_ns);
+    }
+
+    mAuthorRequestHeaders.ApplyToChannel(httpChannel, false, false);
+
+    if (!IsSystemXHR()) {
+      nsCOMPtr<nsPIDOMWindowInner> owner = GetOwner();
+      nsCOMPtr<Document> doc = owner ? owner->GetExtantDoc() : nullptr;
+      nsCOMPtr<nsIReferrerInfo> referrerInfo =
+          ReferrerInfo::CreateForFetch(mPrincipal, doc);
+      Unused << httpChannel->SetReferrerInfoWithoutClone(referrerInfo);
+    }
+
+    // Some extensions override the http protocol handler and provide their own
+    // implementation. The channels returned from that implementation don't
+    // always seem to implement the nsIUploadChannel2 interface, presumably
+    // because it's a new interface. Eventually we should remove this and simply
+    // require that http channels implement the new interface (see bug 529041).
+    nsCOMPtr<nsIUploadChannel2> uploadChannel2 = do_QueryInterface(httpChannel);
+    if (!uploadChannel2) {
+      nsCOMPtr<nsIConsoleService> consoleService =
+          do_GetService(NS_CONSOLESERVICE_CONTRACTID);
+      if (consoleService) {
+        consoleService->LogStringMessage(
+            u"Http channel implementation doesn't support nsIUploadChannel2. "
+            "An extension has supplied a non-functional http protocol handler. "
+            "This will break behavior and in future releases not work at all.");
+      }
+    }
+
+    if (uploadStream) {
+      // If necessary, wrap the stream in a buffered stream so as to guarantee
+      // support for our upload when calling ExplicitSetUploadStream.
+      if (!NS_InputStreamIsBuffered(uploadStream)) {
+        nsCOMPtr<nsIInputStream> bufferedStream;
+        rv = NS_NewBufferedInputStream(getter_AddRefs(bufferedStream),
+                                       uploadStream.forget(), 4096);
+        NS_ENSURE_SUCCESS(rv, rv);
+
+        uploadStream = bufferedStream;
+      }
+
+      // We want to use a newer version of the upload channel that won't
+      // ignore the necessary headers for an empty Content-Type.
+      nsCOMPtr<nsIUploadChannel2> uploadChannel2(
+          do_QueryInterface(httpChannel));
+      // This assertion will fire if buggy extensions are installed
+      NS_ASSERTION(uploadChannel2, "http must support nsIUploadChannel2");
+      if (uploadChannel2) {
+        uploadChannel2->ExplicitSetUploadStream(
+            uploadStream, aUploadContentType, mUploadTotal, mRequestMethod,
+            false);
+      } else {
+        // The http channel doesn't support the new nsIUploadChannel2.
+        // Emulate it as best we can using nsIUploadChannel.
+        if (aUploadContentType.IsEmpty()) {
+          aUploadContentType.AssignLiteral("application/octet-stream");
+        }
+        nsCOMPtr<nsIUploadChannel> uploadChannel =
+            do_QueryInterface(httpChannel);
+        uploadChannel->SetUploadStream(uploadStream, aUploadContentType,
+                                       mUploadTotal);
+        // Reset the method to its original value
+        rv = httpChannel->SetRequestMethod(mRequestMethod);
+        MOZ_ASSERT(NS_SUCCEEDED(rv));
+      }
+    }
+  }
+
+  // Should set a Content-Range header for blob scheme, and also slice the
+  // blob appropriately, so we process the Range header here for later use.
+  if (IsBlobURI(mRequestURL)) {
+    nsAutoCString range;
+    mAuthorRequestHeaders.Get("range", range);
+    if (!range.IsVoid()) {
+      rv = NS_SetChannelContentRangeForBlobURI(mChannel, mRequestURL, range);
+      if (mFlagSynchronous && NS_FAILED(rv)) {
+        // We later fire an error progress event for non-sync
+        mState = XMLHttpRequest_Binding::DONE;
+        return NS_ERROR_DOM_NETWORK_ERR;
+      }
+    }
+  }
+
+  // Due to the chrome-only XHR.channel API, we need a hacky way to set the
+  // SEC_COOKIES_INCLUDE *after* the channel has been has been created, since
+  // .withCredentials can be called after open() is called.
+  // Not doing this for privileged system XHRs since those don't use CORS.
+  if (!IsSystemXHR() && !mIsAnon && mFlagACwithCredentials) {
+    nsCOMPtr<nsILoadInfo> loadInfo = mChannel->LoadInfo();
+    static_cast<net::LoadInfo*>(loadInfo.get())->SetIncludeCookiesSecFlag();
+  }
+
+  // We never let XHR be blocked by head CSS/JS loads to avoid potential
+  // deadlock where server generation of CSS/JS requires an XHR signal.
+  nsCOMPtr<nsIClassOfService> cos(do_QueryInterface(mChannel));
+  if (cos) {
+    cos->AddClassFlags(nsIClassOfService::Unblocked);
+
+    // Mark channel as urgent-start if the XHR is triggered by user input
+    // events.
+    if (UserActivation::IsHandlingUserInput()) {
+      cos->AddClassFlags(nsIClassOfService::UrgentStart);
+    }
+  }
+
+  // Disable Necko-internal response timeouts.
+  nsCOMPtr<nsIHttpChannelInternal> internalHttpChannel(
+      do_QueryInterface(mChannel));
+  if (internalHttpChannel) {
+    rv = internalHttpChannel->SetResponseTimeoutEnabled(false);
+    MOZ_ASSERT(NS_SUCCEEDED(rv));
+  }
+
+  if (!mIsAnon) {
+    AddLoadFlags(mChannel, nsIChannel::LOAD_EXPLICIT_CREDENTIALS);
+  }
+
+  // Bypass the network cache in cases where it makes no sense:
+  // POST responses are always unique, and we provide no API that would
+  // allow our consumers to specify a "cache key" to access old POST
+  // responses, so they are not worth caching.
+  if (mRequestMethod.EqualsLiteral("POST")) {
+    AddLoadFlags(mChannel, nsICachingChannel::LOAD_BYPASS_LOCAL_CACHE |
+                               nsIRequest::INHIBIT_CACHING);
+  } else {
+    // When we are sync loading, we need to bypass the local cache when it would
+    // otherwise block us waiting for exclusive access to the cache.  If we
+    // don't do this, then we could dead lock in some cases (see bug 309424).
+    //
+    // Also don't block on the cache entry on async if it is busy - favoring
+    // parallelism over cache hit rate for xhr. This does not disable the cache
+    // everywhere - only in cases where more than one channel for the same URI
+    // is accessed simultanously.
+    AddLoadFlags(mChannel, nsICachingChannel::LOAD_BYPASS_LOCAL_CACHE_IF_BUSY);
+  }
+
+  EnsureChannelContentType();
+
+  // Set up the preflight if needed
+  if (!IsSystemXHR()) {
+    nsTArray<nsCString> CORSUnsafeHeaders;
+    mAuthorRequestHeaders.GetCORSUnsafeHeaders(CORSUnsafeHeaders);
+    nsCOMPtr<nsILoadInfo> loadInfo = mChannel->LoadInfo();
+    loadInfo->SetCorsPreflightInfo(CORSUnsafeHeaders,
+                                   mFlagHadUploadListenersOnSend);
+  }
+
+  // Hook us up to listen to redirects and the like. Only do this very late
+  // since this creates a cycle between the channel and us. This cycle has
+  // to be manually broken if anything below fails.
+  mChannel->GetNotificationCallbacks(getter_AddRefs(mNotificationCallbacks));
+  mChannel->SetNotificationCallbacks(this);
+
+  if (internalHttpChannel) {
+    internalHttpChannel->SetBlockAuthPrompt(ShouldBlockAuthPrompt());
+  }
+
+  // Because of bug 682305, we can't let listener be the XHR object itself
+  // because JS wouldn't be able to use it. So create a listener around 'this'.
+  // Make sure to hold a strong reference so that we don't leak the wrapper.
+  nsCOMPtr<nsIStreamListener> listener = new net::nsStreamListenerWrapper(this);
+
+  // Check if this XHR is created from a tracking script.
+  // If yes, lower the channel's priority.
+  if (StaticPrefs::privacy_trackingprotection_lower_network_priority()) {
+    MaybeLowerChannelPriority();
+  }
+
+  // Associate any originating stack with the channel.
+  NotifyNetworkMonitorAlternateStack(mChannel, std::move(mOriginStack));
+
+  // Start reading from the channel
+  rv = mChannel->AsyncOpen(listener);
+  listener = nullptr;
+  if (NS_WARN_IF(NS_FAILED(rv))) {
+    // Drop our ref to the channel to avoid cycles. Also drop channel's
+    // ref to us to be extra safe.
+    mChannel->SetNotificationCallbacks(mNotificationCallbacks);
+    mChannel = nullptr;
+
+    mErrorLoad = ErrorType::eChannelOpen;
+    mErrorLoadDetail = rv;
+
+    // Per spec, we throw on sync errors, but not async.
+    if (mFlagSynchronous) {
+      mState = XMLHttpRequest_Binding::DONE;
+      return NS_ERROR_DOM_NETWORK_ERR;
+    }
+  }
+
+  return NS_OK;
+}
+
+already_AddRefed<PreloaderBase> XMLHttpRequestMainThread::FindPreload() {
+  Document* doc = GetDocumentIfCurrent();
+  if (!doc) {
+    return nullptr;
+  }
+  if (mPrincipal->IsSystemPrincipal() || IsSystemXHR()) {
+    return nullptr;
+  }
+  if (!mRequestMethod.EqualsLiteral("GET")) {
+    // Preload can only do GET.
+    return nullptr;
+  }
+  if (!mAuthorRequestHeaders.IsEmpty()) {
+    // Preload can't set headers.
+    return nullptr;
+  }
+
+  // mIsAnon overrules mFlagACwithCredentials.
+  CORSMode cors = (mIsAnon || !mFlagACwithCredentials)
+                      ? CORSMode::CORS_ANONYMOUS
+                      : CORSMode::CORS_USE_CREDENTIALS;
+  nsCOMPtr<nsIReferrerInfo> referrerInfo =
+      ReferrerInfo::CreateForFetch(mPrincipal, doc);
+  auto key = PreloadHashKey::CreateAsFetch(mRequestURL, cors);
+  RefPtr<PreloaderBase> preload = doc->Preloads().LookupPreload(key);
+  if (!preload) {
+    return nullptr;
+  }
+
+  preload->RemoveSelf(doc);
+  preload->NotifyUsage(doc, PreloaderBase::LoadBackground::Keep);
+
+  return preload.forget();
+}
+
+void XMLHttpRequestMainThread::EnsureChannelContentType() {
+  MOZ_ASSERT(mChannel);
+
+  // We don't mess with the content type of a blob URL.
+  if (IsBlobURI(mRequestURL)) {
+    return;
+  }
+
+  // Since we expect XML data, set the type hint accordingly
+  // if the channel doesn't know any content type.
+  // This means that we always try to parse local files as XML
+  // ignoring return value, as this is not critical. Use text/xml as fallback
+  // MIME type.
+  nsAutoCString contentType;
+  if (NS_FAILED(mChannel->GetContentType(contentType)) ||
+      contentType.IsEmpty() ||
+      contentType.EqualsLiteral(UNKNOWN_CONTENT_TYPE)) {
+    mChannel->SetContentType("text/xml"_ns);
+  }
+}
+
+void XMLHttpRequestMainThread::ResumeTimeout() {
+  DEBUG_WORKERREFS;
+  MOZ_ASSERT(NS_IsMainThread());
+  MOZ_ASSERT(mFlagSynchronous);
+
+  if (mResumeTimeoutRunnable) {
+    DispatchToMainThread(mResumeTimeoutRunnable.forget());
+    mResumeTimeoutRunnable = nullptr;
+  }
+}
+
+void XMLHttpRequestMainThread::Send(
+    const Nullable<
+        DocumentOrBlobOrArrayBufferViewOrArrayBufferOrFormDataOrURLSearchParamsOrUSVString>&
+        aData,
+    ErrorResult& aRv) {
+  DEBUG_WORKERREFS1(mRequestURL);
+  NOT_CALLABLE_IN_SYNC_SEND_RV
+
+  if (!CanSend(aRv)) {
+    return;
+  }
+
+  if (aData.IsNull()) {
+    SendInternal(nullptr, false, aRv);
+    return;
+  }
+
+  if (aData.Value().IsDocument()) {
+    BodyExtractor<Document> body(&aData.Value().GetAsDocument());
+    SendInternal(&body, true, aRv);
+    return;
+  }
+
+  if (aData.Value().IsBlob()) {
+    BodyExtractor<const Blob> body(&aData.Value().GetAsBlob());
+    SendInternal(&body, false, aRv);
+    return;
+  }
+
+  if (aData.Value().IsArrayBuffer()) {
+    BodyExtractor<const ArrayBuffer> body(&aData.Value().GetAsArrayBuffer());
+    SendInternal(&body, false, aRv);
+    return;
+  }
+
+  if (aData.Value().IsArrayBufferView()) {
+    BodyExtractor<const ArrayBufferView> body(
+        &aData.Value().GetAsArrayBufferView());
+    SendInternal(&body, false, aRv);
+    return;
+  }
+
+  if (aData.Value().IsFormData()) {
+    BodyExtractor<const FormData> body(&aData.Value().GetAsFormData());
+    SendInternal(&body, false, aRv);
+    return;
+  }
+
+  if (aData.Value().IsURLSearchParams()) {
+    BodyExtractor<const URLSearchParams> body(
+        &aData.Value().GetAsURLSearchParams());
+    SendInternal(&body, false, aRv);
+    return;
+  }
+
+  if (aData.Value().IsUSVString()) {
+    BodyExtractor<const nsAString> body(&aData.Value().GetAsUSVString());
+    SendInternal(&body, true, aRv);
+    return;
+  }
+}
+
+nsresult XMLHttpRequestMainThread::MaybeSilentSendFailure(nsresult aRv) {
+  // Per spec, silently fail on async request failures; throw for sync.
+  if (mFlagSynchronous) {
+    mState = XMLHttpRequest_Binding::DONE;
+    return NS_ERROR_DOM_NETWORK_ERR;
+  }
+
+  // Defer the actual sending of async events just in case listeners
+  // are attached after the send() method is called.
+  Unused << NS_WARN_IF(
+      NS_FAILED(DispatchToMainThread(NewRunnableMethod<ErrorProgressEventType>(
+          "dom::XMLHttpRequestMainThread::CloseRequestWithError", this,
+          &XMLHttpRequestMainThread::CloseRequestWithError, Events::error))));
+  return NS_OK;
+}
+
+bool XMLHttpRequestMainThread::CanSend(ErrorResult& aRv) {
+  if (!mPrincipal) {
+    aRv.Throw(NS_ERROR_NOT_INITIALIZED);
+    return false;
+  }
+
+  // Step 1
+  if (mState != XMLHttpRequest_Binding::OPENED) {
+    aRv.ThrowInvalidStateError("XMLHttpRequest state must be OPENED.");
+    return false;
+  }
+
+  // Step 2
+  if (mFlagSend) {
+    aRv.ThrowInvalidStateError("XMLHttpRequest must not be sending.");
+    return false;
+  }
+
+  if (NS_FAILED(CheckCurrentGlobalCorrectness())) {
+    aRv.Throw(NS_ERROR_DOM_INVALID_STATE_XHR_HAS_INVALID_CONTEXT);
+    return false;
+  }
+
+  return true;
+}
+
+void XMLHttpRequestMainThread::SendInternal(const BodyExtractorBase* aBody,
+                                            bool aBodyIsDocumentOrString,
+                                            ErrorResult& aRv) {
+  DEBUG_WORKERREFS;
+  MOZ_ASSERT(NS_IsMainThread());
+
+  // We expect that CanSend has been called before we get here!
+  // We cannot move the remaining two checks below there because
+  // MaybeSilentSendFailure can cause unexpected side effects if called
+  // too early.
+
+  // If open() failed to create the channel, then throw a network error
+  // as per spec. We really should create the channel here in send(), but
+  // we have internal code relying on the channel being created in open().
+  if (!mChannel) {
+    mErrorLoad = ErrorType::eChannelOpen;
+    mErrorLoadDetail = NS_ERROR_DOM_NETWORK_ERR;
+    mFlagSend = true;  // so CloseRequestWithError sets us to DONE.
+    aRv = MaybeSilentSendFailure(mErrorLoadDetail);
+    return;
+  }
+
+  // non-GET requests aren't allowed for blob.
+  if (IsBlobURI(mRequestURL) && !mRequestMethod.EqualsLiteral("GET")) {
+    mErrorLoad = ErrorType::eChannelOpen;
+    mErrorLoadDetail = NS_ERROR_DOM_NETWORK_ERR;
+    mFlagSend = true;  // so CloseRequestWithError sets us to DONE.
+    aRv = MaybeSilentSendFailure(mErrorLoadDetail);
+    return;
+  }
+
+  // XXX We should probably send a warning to the JS console
+  //     if there are no event listeners set and we are doing
+  //     an asynchronous call.
+
+  mUploadTransferred = 0;
+  mUploadTotal = 0;
+  // By default we don't have any upload, so mark upload complete.
+  mUploadComplete = true;
+  mErrorLoad = ErrorType::eOK;
+  mErrorLoadDetail = NS_OK;
+  mLoadTotal = -1;
+  nsCOMPtr<nsIInputStream> uploadStream;
+  nsAutoCString uploadContentType;
+  nsCOMPtr<nsIHttpChannel> httpChannel(do_QueryInterface(mChannel));
+  if (aBody && httpChannel && !mRequestMethod.EqualsLiteral("GET") &&
+      !mRequestMethod.EqualsLiteral("HEAD")) {
+    nsAutoCString charset;
+    nsAutoCString defaultContentType;
+    uint64_t size_u64;
+    aRv = aBody->GetAsStream(getter_AddRefs(uploadStream), &size_u64,
+                             defaultContentType, charset);
+    if (aRv.Failed()) {
+      return;
+    }
+
+    // make sure it fits within js MAX_SAFE_INTEGER
+    mUploadTotal =
+        net::InScriptableRange(size_u64) ? static_cast<int64_t>(size_u64) : -1;
+
+    if (uploadStream) {
+      // If author set no Content-Type, use the default from GetAsStream().
+      mAuthorRequestHeaders.Get("content-type", uploadContentType);
+      if (uploadContentType.IsVoid()) {
+        uploadContentType = defaultContentType;
+      } else if (aBodyIsDocumentOrString) {
+        UniquePtr<CMimeType> contentTypeRecord =
+            CMimeType::Parse(uploadContentType);
+        nsAutoCString charset;
+        if (contentTypeRecord &&
+            contentTypeRecord->GetParameterValue(kLiteralString_charset,
+                                                 charset) &&
+            !charset.EqualsIgnoreCase("utf-8")) {
+          contentTypeRecord->SetParameterValue(kLiteralString_charset,
+                                               kLiteralString_UTF_8);
+          contentTypeRecord->Serialize(uploadContentType);
+        }
+      } else if (!charset.IsEmpty()) {
+        // We don't want to set a charset for streams.
+        // Replace all case-insensitive matches of the charset in the
+        // content-type with the correct case.
+        RequestHeaders::CharsetIterator iter(uploadContentType);
+        while (iter.Next()) {
+          if (!iter.Equals(charset, nsCaseInsensitiveCStringComparator)) {
+            iter.Replace(charset);
+          }
+        }
+      }
+
+      mUploadComplete = false;
+    }
+  }
+
+  ResetResponse();
+
+  // Check if we should enable cross-origin upload listeners.
+  if (mUpload && mUpload->HasListeners()) {
+    mFlagHadUploadListenersOnSend = true;
+  }
+
+  mIsMappedArrayBuffer = false;
+  if (mResponseType == XMLHttpRequestResponseType::Arraybuffer &&
+      StaticPrefs::dom_mapped_arraybuffer_enabled()) {
+    nsCOMPtr<nsIURI> uri;
+    nsAutoCString scheme;
+
+    aRv = mChannel->GetURI(getter_AddRefs(uri));
+    if (!aRv.Failed()) {
+      uri->GetScheme(scheme);
+      if (scheme.LowerCaseEqualsLiteral("jar")) {
+        mIsMappedArrayBuffer = true;
+      }
+    }
+  }
+
+  aRv = InitiateFetch(uploadStream.forget(), mUploadTotal, uploadContentType);
+  if (aRv.Failed()) {
+    return;
+  }
+
+  // Start our timeout
+  mRequestSentTime = PR_Now();
+  StartTimeoutTimer();
+
+  mWaitingForOnStopRequest = true;
+
+  // Step 8
+  mFlagSend = true;
+
+  // If we're synchronous, spin an event loop here and wait
+  RefPtr<Document> suspendedDoc;
+  if (mFlagSynchronous) {
+    auto scopeExit = MakeScopeExit([&] {
+      CancelSyncTimeoutTimer();
+      ResumeTimeout();
+      ResumeEventDispatching();
+    });
+    Maybe<AutoSuppressEventHandling> autoSuppress;
+
+    mFlagSyncLooping = true;
+
+    if (GetOwner()) {
+      if (nsCOMPtr<nsPIDOMWindowOuter> topWindow =
+              GetOwner()->GetOuterWindow()->GetInProcessTop()) {
+        if (nsCOMPtr<nsPIDOMWindowInner> topInner =
+                topWindow->GetCurrentInnerWindow()) {
+          suspendedDoc = topWindow->GetExtantDoc();
+          autoSuppress.emplace(topWindow->GetBrowsingContext());
+          topInner->Suspend();
+          mResumeTimeoutRunnable = new nsResumeTimeoutsEvent(topInner);
+        }
+      }
+    }
+
+    SuspendEventDispatching();
+    StopProgressEventTimer();
+
+    SyncTimeoutType syncTimeoutType = MaybeStartSyncTimeoutTimer();
+    if (syncTimeoutType == eErrorOrExpired) {
+      Abort();
+      aRv.Throw(NS_ERROR_DOM_NETWORK_ERR);
+      return;
+    }
+
+    nsAutoSyncOperation sync(suspendedDoc,
+                             SyncOperationBehavior::eSuspendInput);
+    if (!SpinEventLoopUntil("XMLHttpRequestMainThread::SendInternal"_ns,
+                            [&]() { return !mFlagSyncLooping; })) {
+      aRv.Throw(NS_ERROR_UNEXPECTED);
+      return;
+    }
+
+    // Time expired... We should throw.
+    if (syncTimeoutType == eTimerStarted && !mSyncTimeoutTimer) {
+      aRv.Throw(NS_ERROR_DOM_NETWORK_ERR);
+      return;
+    }
+  } else {
+    // Now that we've successfully opened the channel, we can change state. Note
+    // that this needs to come after the AsyncOpen() and rv check, because this
+    // can run script that would try to restart this request, and that could end
+    // up doing our AsyncOpen on a null channel if the reentered AsyncOpen
+    // fails.
+    StopProgressEventTimer();
+
+    // Upload phase beginning; start the progress event timer if necessary.
+    if (mUpload && mUpload->HasListenersFor(nsGkAtoms::onprogress)) {
+      StartProgressEventTimer();
+    }
+    // Dispatch loadstart events
+    DispatchProgressEvent(this, Events::loadstart, 0, -1);
+    if (mUpload && !mUploadComplete) {
+      DispatchProgressEvent(mUpload, Events::loadstart, 0, mUploadTotal);
+    }
+  }
+
+  if (!mChannel) {
+    aRv = MaybeSilentSendFailure(NS_ERROR_DOM_NETWORK_ERR);
+  }
+}
+
+// http://dvcs.w3.org/hg/xhr/raw-file/tip/Overview.html#dom-xmlhttprequest-setrequestheader
+void XMLHttpRequestMainThread::SetRequestHeader(const nsACString& aName,
+                                                const nsACString& aValue,
+                                                ErrorResult& aRv) {
+  NOT_CALLABLE_IN_SYNC_SEND_RV
+
+  // Step 1
+  if (mState != XMLHttpRequest_Binding::OPENED) {
+    aRv.ThrowInvalidStateError("XMLHttpRequest state must be OPENED.");
+    return;
+  }
+
+  // Step 2
+  if (mFlagSend) {
+    aRv.ThrowInvalidStateError("XMLHttpRequest must not be sending.");
+    return;
+  }
+
+  // Step 3
+  nsAutoCString value;
+  NS_TrimHTTPWhitespace(aValue, value);
+
+  // Step 4
+  if (!NS_IsValidHTTPToken(aName) || !NS_IsReasonableHTTPHeaderValue(value)) {
+    aRv.Throw(NS_ERROR_DOM_INVALID_HEADER_NAME);
+    return;
+  }
+
+  // Step 5
+  bool isPrivilegedCaller = IsSystemXHR();
+  bool isForbiddenHeader =
+      nsContentUtils::IsForbiddenRequestHeader(aName, aValue);
+  if (!isPrivilegedCaller && isForbiddenHeader) {
+    AutoTArray<nsString, 1> params;
+    CopyUTF8toUTF16(aName, *params.AppendElement());
+    LogMessage("ForbiddenHeaderWarning", GetOwner(), params);
+    return;
+  }
+
+  // Step 6.1
+  // Skipping for now, as normalizing the case of header names may not be
+  // web-compatible. See bug 1285036.
+
+  // Step 6.2-6.3
+  // Gecko-specific: invalid headers can be set by privileged
+  //                 callers, but will not merge.
+  if (isPrivilegedCaller && isForbiddenHeader) {
+    mAuthorRequestHeaders.Set(aName, value);
+  } else {
+    mAuthorRequestHeaders.MergeOrSet(aName, value);
+  }
+}
+
+void XMLHttpRequestMainThread::SetTimeout(uint32_t aTimeout, ErrorResult& aRv) {
+  NOT_CALLABLE_IN_SYNC_SEND_RV
+
+  if (mFlagSynchronous && mState != XMLHttpRequest_Binding::UNSENT &&
+      HasOrHasHadOwner()) {
+    /* Timeout is not supported for synchronous requests with an owning window,
+       per XHR2 spec. */
+    LogMessage("TimeoutSyncXHRWarning", GetOwner());
+    aRv.ThrowInvalidAccessError(
+        "synchronous XMLHttpRequests do not support timeout and responseType");
+    return;
+  }
+
+  mTimeoutMilliseconds = aTimeout;
+  if (mRequestSentTime) {
+    StartTimeoutTimer();
+  }
+}
+
+nsIEventTarget* XMLHttpRequestMainThread::GetTimerEventTarget() {
+  if (nsIGlobalObject* global = GetOwnerGlobal()) {
+    return global->SerialEventTarget();
+  }
+  return nullptr;
+}
+
+nsresult XMLHttpRequestMainThread::DispatchToMainThread(
+    already_AddRefed<nsIRunnable> aRunnable) {
+  DEBUG_WORKERREFS;
+  if (nsIGlobalObject* global = GetOwnerGlobal()) {
+    return global->Dispatch(std::move(aRunnable));
+  }
+  return NS_DispatchToMainThread(std::move(aRunnable));
+}
+
+void XMLHttpRequestMainThread::StartTimeoutTimer() {
+  DEBUG_WORKERREFS;
+  MOZ_ASSERT(
+      mRequestSentTime,
+      "StartTimeoutTimer mustn't be called before the request was sent!");
+  if (mState == XMLHttpRequest_Binding::DONE) {
+    // do nothing!
+    return;
+  }
+
+  CancelTimeoutTimer();
+
+  if (!mTimeoutMilliseconds) {
+    return;
+  }
+
+  if (!mTimeoutTimer) {
+    mTimeoutTimer = NS_NewTimer(GetTimerEventTarget());
+  }
+  uint32_t elapsed =
+      (uint32_t)((PR_Now() - mRequestSentTime) / PR_USEC_PER_MSEC);
+  mTimeoutTimer->InitWithCallback(
+      this, mTimeoutMilliseconds > elapsed ? mTimeoutMilliseconds - elapsed : 0,
+      nsITimer::TYPE_ONE_SHOT);
+}
+
+uint16_t XMLHttpRequestMainThread::ReadyState() const { return mState; }
+
+void XMLHttpRequestMainThread::OverrideMimeType(const nsAString& aMimeType,
+                                                ErrorResult& aRv) {
+  NOT_CALLABLE_IN_SYNC_SEND_RV
+
+  if (mState == XMLHttpRequest_Binding::LOADING ||
+      mState == XMLHttpRequest_Binding::DONE) {
+    aRv.ThrowInvalidStateError(
+        "Cannot call 'overrideMimeType()' on XMLHttpRequest after 'send()' "
+        "(when its state is LOADING or DONE).");
+    return;
+  }
+
+  UniquePtr<MimeType> parsed = MimeType::Parse(aMimeType);
+  if (parsed) {
+    parsed->Serialize(mOverrideMimeType);
+  } else {
+    mOverrideMimeType.AssignLiteral(APPLICATION_OCTET_STREAM);
+  }
+}
+
+bool XMLHttpRequestMainThread::MozBackgroundRequest() const {
+  return mFlagBackgroundRequest;
+}
+
+void XMLHttpRequestMainThread::SetMozBackgroundRequestExternal(
+    bool aMozBackgroundRequest, ErrorResult& aRv) {
+  if (!IsSystemXHR()) {
+    aRv.Throw(NS_ERROR_DOM_SECURITY_ERR);
+    return;
+  }
+
+  if (mState != XMLHttpRequest_Binding::UNSENT) {
+    // Can't change this while we're in the middle of something.
+    aRv.ThrowInvalidStateError("XMLHttpRequest must not be sending.");
+    return;
+  }
+
+  mFlagBackgroundRequest = aMozBackgroundRequest;
+}
+
+void XMLHttpRequestMainThread::SetMozBackgroundRequest(
+    bool aMozBackgroundRequest, ErrorResult& aRv) {
+  // No errors for this webIDL method on main-thread.
+  SetMozBackgroundRequestExternal(aMozBackgroundRequest, IgnoreErrors());
+}
+
+void XMLHttpRequestMainThread::SetOriginStack(
+    UniquePtr<SerializedStackHolder> aOriginStack) {
+  mOriginStack = std::move(aOriginStack);
+}
+
+void XMLHttpRequestMainThread::SetSource(
+    UniquePtr<ProfileChunkedBuffer> aSource) {
+  if (!mChannel) {
+    return;
+  }
+  nsCOMPtr<nsIHttpChannel> httpChannel = do_QueryInterface(mChannel);
+
+  if (httpChannel) {
+    httpChannel->SetSource(std::move(aSource));
+  }
+}
+
+bool XMLHttpRequestMainThread::WithCredentials() const {
+  return mFlagACwithCredentials;
+}
+
+void XMLHttpRequestMainThread::SetWithCredentials(bool aWithCredentials,
+                                                  ErrorResult& aRv) {
+  NOT_CALLABLE_IN_SYNC_SEND_RV
+
+  // Return error if we're already processing a request.  Note that we can't use
+  // ReadyState() here, because it can't differentiate between "opened" and
+  // "sent", so we use mState directly.
+
+  if ((mState != XMLHttpRequest_Binding::UNSENT &&
+       mState != XMLHttpRequest_Binding::OPENED) ||
+      mFlagSend || mIsAnon) {
+    aRv.ThrowInvalidStateError("XMLHttpRequest must not be sending.");
+    return;
+  }
+
+  mFlagACwithCredentials = aWithCredentials;
+}
+
+nsresult XMLHttpRequestMainThread::ChangeState(uint16_t aState,
+                                               bool aBroadcast) {
+  mState = aState;
+  nsresult rv = NS_OK;
+
+  if (aState != XMLHttpRequest_Binding::HEADERS_RECEIVED &&
+      aState != XMLHttpRequest_Binding::LOADING) {
+    StopProgressEventTimer();
+  }
+
+  if (aBroadcast &&
+      (!mFlagSynchronous || aState == XMLHttpRequest_Binding::OPENED ||
+       aState == XMLHttpRequest_Binding::DONE)) {
+    rv = FireReadystatechangeEvent();
+  }
+
+  return rv;
+}
+
+/////////////////////////////////////////////////////
+// nsIChannelEventSink methods:
+//
+NS_IMETHODIMP
+XMLHttpRequestMainThread::AsyncOnChannelRedirect(
+    nsIChannel* aOldChannel, nsIChannel* aNewChannel, uint32_t aFlags,
+    nsIAsyncVerifyRedirectCallback* callback) {
+  DEBUG_WORKERREFS;
+  MOZ_ASSERT(aNewChannel, "Redirect without a channel?");
+
+  // Prepare to receive callback
+  mRedirectCallback = callback;
+  mNewRedirectChannel = aNewChannel;
+
+  if (mChannelEventSink) {
+    nsCOMPtr<nsIAsyncVerifyRedirectCallback> fwd = EnsureXPCOMifier();
+
+    nsresult rv = mChannelEventSink->AsyncOnChannelRedirect(
+        aOldChannel, aNewChannel, aFlags, fwd);
+    if (NS_FAILED(rv)) {
+      mRedirectCallback = nullptr;
+      mNewRedirectChannel = nullptr;
+    }
+    return rv;
+  }
+
+  // we need to strip Authentication headers for cross-origin requests
+  // Ref: https://fetch.spec.whatwg.org/#http-redirect-fetch
+  bool stripAuth =
+      StaticPrefs::network_fetch_redirect_stripAuthHeader() &&
+      NS_ShouldRemoveAuthHeaderOnRedirect(aOldChannel, aNewChannel, aFlags);
+
+  OnRedirectVerifyCallback(NS_OK, stripAuth);
+
+  return NS_OK;
+}
+
+nsresult XMLHttpRequestMainThread::OnRedirectVerifyCallback(nsresult result,
+                                                            bool aStripAuth) {
+  DEBUG_WORKERREFS;
+  NS_ASSERTION(mRedirectCallback, "mRedirectCallback not set in callback");
+  NS_ASSERTION(mNewRedirectChannel, "mNewRedirectChannel not set in callback");
+
+  if (NS_SUCCEEDED(result)) {
+    bool rewriteToGET = false;
+    nsCOMPtr<nsIHttpChannel> oldHttpChannel = GetCurrentHttpChannel();
+    // Fetch 4.4.11
+    Unused << oldHttpChannel->ShouldStripRequestBodyHeader(mRequestMethod,
+                                                           &rewriteToGET);
+
+    mChannel = mNewRedirectChannel;
+
+    nsCOMPtr<nsIHttpChannel> newHttpChannel(do_QueryInterface(mChannel));
+    if (newHttpChannel) {
+      // Ensure all original headers are duplicated for the new channel (bug
+      // #553888)
+      mAuthorRequestHeaders.ApplyToChannel(newHttpChannel, rewriteToGET,
+                                           aStripAuth);
+    }
+  } else {
+    mErrorLoad = ErrorType::eRedirect;
+    mErrorLoadDetail = result;
+  }
+
+  mNewRedirectChannel = nullptr;
+
+  mRedirectCallback->OnRedirectVerifyCallback(result);
+  mRedirectCallback = nullptr;
+
+  // It's important that we return success here. If we return the result code
+  // that we were passed, JavaScript callers who cancel the redirect will wind
+  // up throwing an exception in the process.
+  return NS_OK;
+}
+
+/////////////////////////////////////////////////////
+// nsIProgressEventSink methods:
+//
+
+NS_IMETHODIMP
+XMLHttpRequestMainThread::OnProgress(nsIRequest* aRequest, int64_t aProgress,
+                                     int64_t aProgressMax) {
+  DEBUG_WORKERREFS;
+  // When uploading, OnProgress reports also headers in aProgress and
+  // aProgressMax. So, try to remove the headers, if possible.
+  bool lengthComputable = (aProgressMax != -1);
+  if (InUploadPhase()) {
+    int64_t loaded = aProgress;
+    if (lengthComputable) {
+      int64_t headerSize = aProgressMax - mUploadTotal;
+      loaded -= headerSize;
+    }
+    mUploadTransferred = loaded;
+    mProgressSinceLastProgressEvent = true;
+
+    if (!mFlagSynchronous && !mProgressTimerIsActive) {
+      StartProgressEventTimer();
+    }
+  } else {
+    mLoadTotal = aProgressMax;
+    mLoadTransferred = aProgress;
+    // OnDataAvailable() handles mProgressSinceLastProgressEvent
+    // for the download phase.
+  }
+
+  if (mProgressEventSink) {
+    mProgressEventSink->OnProgress(aRequest, aProgress, aProgressMax);
+  }
+
+  return NS_OK;
+}
+
+NS_IMETHODIMP
+XMLHttpRequestMainThread::OnStatus(nsIRequest* aRequest, nsresult aStatus,
+                                   const char16_t* aStatusArg) {
+  DEBUG_WORKERREFS;
+  if (mProgressEventSink) {
+    mProgressEventSink->OnStatus(aRequest, aStatus, aStatusArg);
+  }
+
+  return NS_OK;
+}
+
+bool XMLHttpRequestMainThread::AllowUploadProgress() {
+  return !IsCrossSiteCORSRequest() || mFlagHadUploadListenersOnSend;
+}
+
+/////////////////////////////////////////////////////
+// nsIInterfaceRequestor methods:
+//
+NS_IMETHODIMP
+XMLHttpRequestMainThread::GetInterface(const nsIID& aIID, void** aResult) {
+  nsresult rv;
+
+  // Make sure to return ourselves for the channel event sink interface and
+  // progress event sink interface, no matter what.  We can forward these to
+  // mNotificationCallbacks if it wants to get notifications for them.  But we
+  // need to see these notifications for proper functioning.
+  if (aIID.Equals(NS_GET_IID(nsIChannelEventSink))) {
+    mChannelEventSink = do_GetInterface(mNotificationCallbacks);
+    *aResult = static_cast<nsIChannelEventSink*>(EnsureXPCOMifier().take());
+    return NS_OK;
+  } else if (aIID.Equals(NS_GET_IID(nsIProgressEventSink))) {
+    mProgressEventSink = do_GetInterface(mNotificationCallbacks);
+    *aResult = static_cast<nsIProgressEventSink*>(EnsureXPCOMifier().take());
+    return NS_OK;
+  }
+
+  // Now give mNotificationCallbacks (if non-null) a chance to return the
+  // desired interface.
+  if (mNotificationCallbacks) {
+    rv = mNotificationCallbacks->GetInterface(aIID, aResult);
+    if (NS_SUCCEEDED(rv)) {
+      NS_ASSERTION(*aResult, "Lying nsIInterfaceRequestor implementation!");
+      return rv;
+    }
+  }
+
+  if (!mFlagBackgroundRequest && (aIID.Equals(NS_GET_IID(nsIAuthPrompt)) ||
+                                  aIID.Equals(NS_GET_IID(nsIAuthPrompt2)))) {
+    nsCOMPtr<nsIPromptFactory> wwatch =
+        do_GetService(NS_WINDOWWATCHER_CONTRACTID, &rv);
+    NS_ENSURE_SUCCESS(rv, rv);
+
+    // Get the an auth prompter for our window so that the parenting
+    // of the dialogs works as it should when using tabs.
+    nsCOMPtr<nsPIDOMWindowOuter> window;
+    if (GetOwner()) {
+      window = GetOwner()->GetOuterWindow();
+    }
+    return wwatch->GetPrompt(window, aIID, reinterpret_cast<void**>(aResult));
+  }
+
+  // Now check for the various XHR non-DOM interfaces, except
+  // nsIProgressEventSink and nsIChannelEventSink which we already
+  // handled above.
+  if (aIID.Equals(NS_GET_IID(nsIStreamListener))) {
+    *aResult = static_cast<nsIStreamListener*>(EnsureXPCOMifier().take());
+    return NS_OK;
+  }
+  if (aIID.Equals(NS_GET_IID(nsIRequestObserver))) {
+    *aResult = static_cast<nsIRequestObserver*>(EnsureXPCOMifier().take());
+    return NS_OK;
+  }
+  if (aIID.Equals(NS_GET_IID(nsITimerCallback))) {
+    *aResult = static_cast<nsITimerCallback*>(EnsureXPCOMifier().take());
+    return NS_OK;
+  }
+
+  return QueryInterface(aIID, aResult);
+}
+
+void XMLHttpRequestMainThread::GetInterface(
+    JSContext* aCx, JS::Handle<JS::Value> aIID,
+    JS::MutableHandle<JS::Value> aRetval, ErrorResult& aRv) {
+  dom::GetInterface(aCx, this, aIID, aRetval, aRv);
+}
+
+XMLHttpRequestUpload* XMLHttpRequestMainThread::GetUpload(ErrorResult& aRv) {
+  if (!mUpload) {
+    mUpload = new XMLHttpRequestUpload(this);
+  }
+  return mUpload;
+}
+
+bool XMLHttpRequestMainThread::MozAnon() const { return mIsAnon; }
+
+bool XMLHttpRequestMainThread::MozSystem() const { return IsSystemXHR(); }
+
+void XMLHttpRequestMainThread::HandleTimeoutCallback() {
+  DEBUG_WORKERREFS;
+  if (mState == XMLHttpRequest_Binding::DONE) {
+    MOZ_ASSERT_UNREACHABLE(
+        "XMLHttpRequestMainThread::HandleTimeoutCallback "
+        "with completed request");
+    // do nothing!
+    return;
+  }
+
+  mFlagTimedOut = true;
+  CloseRequestWithError(Events::timeout);
+}
+
+void XMLHttpRequestMainThread::CancelTimeoutTimer() {
+  DEBUG_WORKERREFS;
+  if (mTimeoutTimer) {
+    mTimeoutTimer->Cancel();
+    mTimeoutTimer = nullptr;
+  }
+}
+
+NS_IMETHODIMP
+XMLHttpRequestMainThread::Notify(nsITimer* aTimer) {
+  DEBUG_WORKERREFS;
+  if (mProgressNotifier == aTimer) {
+    HandleProgressTimerCallback();
+    return NS_OK;
+  }
+
+  if (mTimeoutTimer == aTimer) {
+    HandleTimeoutCallback();
+    return NS_OK;
+  }
+
+  if (mSyncTimeoutTimer == aTimer) {
+    HandleSyncTimeoutTimer();
+    return NS_OK;
+  }
+
+  // Just in case some JS user wants to QI to nsITimerCallback and play with
+  // us...
+  NS_WARNING("Unexpected timer!");
+  return NS_ERROR_INVALID_POINTER;
+}
+
+void XMLHttpRequestMainThread::HandleProgressTimerCallback() {
+  DEBUG_WORKERREFS;
+  // Don't fire the progress event if mLoadTotal is 0, see XHR spec step 6.1
+  if (!mLoadTotal && mLoadTransferred) {
+    return;
+  }
+
+  mProgressTimerIsActive = false;
+
+  if (!mProgressSinceLastProgressEvent || mErrorLoad != ErrorType::eOK) {
+    return;
+  }
+
+  if (InUploadPhase()) {
+    if (mUpload && !mUploadComplete && mFlagHadUploadListenersOnSend) {
+      DispatchProgressEvent(mUpload, Events::progress, mUploadTransferred,
+                            mUploadTotal);
+    }
+  } else {
+    FireReadystatechangeEvent();
+    DispatchProgressEvent(this, Events::progress, mLoadTransferred, mLoadTotal);
+  }
+
+  mProgressSinceLastProgressEvent = false;
+
+  StartProgressEventTimer();
+}
+
+void XMLHttpRequestMainThread::StopProgressEventTimer() {
+  if (mProgressNotifier) {
+    mProgressTimerIsActive = false;
+    mProgressNotifier->Cancel();
+  }
+}
+
+void XMLHttpRequestMainThread::StartProgressEventTimer() {
+  if (!mProgressNotifier) {
+    mProgressNotifier = NS_NewTimer(GetTimerEventTarget());
+  }
+  if (mProgressNotifier) {
+    mProgressTimerIsActive = true;
+    mProgressNotifier->Cancel();
+    mProgressNotifier->InitWithCallback(this, NS_PROGRESS_EVENT_INTERVAL,
+                                        nsITimer::TYPE_ONE_SHOT);
+  }
+}
+
+XMLHttpRequestMainThread::SyncTimeoutType
+XMLHttpRequestMainThread::MaybeStartSyncTimeoutTimer() {
+  MOZ_ASSERT(mFlagSynchronous);
+
+  Document* doc = GetDocumentIfCurrent();
+  if (!doc || !doc->GetPageUnloadingEventTimeStamp()) {
+    return eNoTimerNeeded;
+  }
+
+  // If we are in a beforeunload or a unload event, we must force a timeout.
+  TimeDuration diff =
+      (TimeStamp::NowLoRes() - doc->GetPageUnloadingEventTimeStamp());
+  if (diff.ToMilliseconds() > MAX_SYNC_TIMEOUT_WHEN_UNLOADING) {
+    return eErrorOrExpired;
+  }
+
+  mSyncTimeoutTimer = NS_NewTimer(GetTimerEventTarget());
+  if (!mSyncTimeoutTimer) {
+    return eErrorOrExpired;
+  }
+
+  uint32_t timeout = MAX_SYNC_TIMEOUT_WHEN_UNLOADING - diff.ToMilliseconds();
+  nsresult rv = mSyncTimeoutTimer->InitWithCallback(this, timeout,
+                                                    nsITimer::TYPE_ONE_SHOT);
+  return NS_FAILED(rv) ? eErrorOrExpired : eTimerStarted;
+}
+
+void XMLHttpRequestMainThread::HandleSyncTimeoutTimer() {
+  MOZ_ASSERT(mSyncTimeoutTimer);
+  MOZ_ASSERT(mFlagSyncLooping);
+
+  CancelSyncTimeoutTimer();
+  Abort();
+  mErrorLoadDetail = NS_ERROR_DOM_TIMEOUT_ERR;
+}
+
+void XMLHttpRequestMainThread::CancelSyncTimeoutTimer() {
+  if (mSyncTimeoutTimer) {
+    mSyncTimeoutTimer->Cancel();
+    mSyncTimeoutTimer = nullptr;
+  }
+}
+
+already_AddRefed<nsXMLHttpRequestXPCOMifier>
+XMLHttpRequestMainThread::EnsureXPCOMifier() {
+  if (!mXPCOMifier) {
+    mXPCOMifier = new nsXMLHttpRequestXPCOMifier(this);
+  }
+  RefPtr<nsXMLHttpRequestXPCOMifier> newRef(mXPCOMifier);
+  return newRef.forget();
+}
+
+bool XMLHttpRequestMainThread::ShouldBlockAuthPrompt() {
+  // Verify that it's ok to prompt for credentials here, per spec
+  // http://xhr.spec.whatwg.org/#the-send%28%29-method
+
+  if (mAuthorRequestHeaders.Has("authorization")) {
+    return true;
+  }
+
+  nsCOMPtr<nsIURI> uri;
+  nsresult rv = mChannel->GetURI(getter_AddRefs(uri));
+  if (NS_WARN_IF(NS_FAILED(rv))) {
+    return false;
+  }
+
+  // Also skip if a username and/or password is provided in the URI.
+  bool hasUserPass;
+  return NS_SUCCEEDED(uri->GetHasUserPass(&hasUserPass)) && hasUserPass;
+}
+
+void XMLHttpRequestMainThread::TruncateResponseText() {
+  mResponseText.Truncate();
+  XMLHttpRequest_Binding::ClearCachedResponseTextValue(this);
+}
+
+NS_IMPL_ISUPPORTS(XMLHttpRequestMainThread::nsHeaderVisitor,
+                  nsIHttpHeaderVisitor)
+
+NS_IMETHODIMP XMLHttpRequestMainThread::nsHeaderVisitor::VisitHeader(
+    const nsACString& header, const nsACString& value) {
+  if (mXHR.IsSafeHeader(header, mHttpChannel)) {
+    nsAutoCString lowerHeader(header);
+    ToLowerCase(lowerHeader);
+    if (!mHeaderList.InsertElementSorted(HeaderEntry(lowerHeader, value),
+                                         fallible)) {
+      return NS_ERROR_OUT_OF_MEMORY;
+    }
+  }
+  return NS_OK;
+}
+
+XMLHttpRequestMainThread::nsHeaderVisitor::nsHeaderVisitor(
+    const XMLHttpRequestMainThread& aXMLHttpRequest,
+    NotNull<nsIHttpChannel*> aHttpChannel)
+    : mXHR(aXMLHttpRequest), mHttpChannel(aHttpChannel) {}
+
+XMLHttpRequestMainThread::nsHeaderVisitor::~nsHeaderVisitor() = default;
+
+void XMLHttpRequestMainThread::MaybeCreateBlobStorage() {
+  DEBUG_WORKERREFS;
+  MOZ_ASSERT(mResponseType == XMLHttpRequestResponseType::Blob);
+
+  if (mBlobStorage) {
+    return;
+  }
+
+  MutableBlobStorage::MutableBlobStorageType storageType =
+      BasePrincipal::Cast(mPrincipal)->PrivateBrowsingId() == 0
+          ? MutableBlobStorage::eCouldBeInTemporaryFile
+          : MutableBlobStorage::eOnlyInMemory;
+
+  nsCOMPtr<nsIEventTarget> eventTarget;
+  if (nsIGlobalObject* global = GetOwnerGlobal()) {
+    eventTarget = global->SerialEventTarget();
+  }
+
+  mBlobStorage = new MutableBlobStorage(storageType, eventTarget);
+}
+
+void XMLHttpRequestMainThread::BlobStoreCompleted(
+    MutableBlobStorage* aBlobStorage, BlobImpl* aBlobImpl, nsresult aRv) {
+  DEBUG_WORKERREFS;
+  // Ok, the state is changed...
+  if (mBlobStorage != aBlobStorage || NS_FAILED(aRv)) {
+    return;
+  }
+
+  MOZ_ASSERT(mState != XMLHttpRequest_Binding::DONE);
+
+  mResponseBlobImpl = aBlobImpl;
+  mBlobStorage = nullptr;
+
+  ChangeStateToDone(mFlagSyncLooping);
+}
+
+NS_IMETHODIMP
+XMLHttpRequestMainThread::GetName(nsACString& aName) {
+  aName.AssignLiteral("XMLHttpRequest");
+  return NS_OK;
+}
+
+// nsXMLHttpRequestXPCOMifier implementation
+NS_INTERFACE_MAP_BEGIN_CYCLE_COLLECTION(nsXMLHttpRequestXPCOMifier)
+  NS_INTERFACE_MAP_ENTRY(nsIStreamListener)
+  NS_INTERFACE_MAP_ENTRY(nsIRequestObserver)
+  NS_INTERFACE_MAP_ENTRY(nsIChannelEventSink)
+  NS_INTERFACE_MAP_ENTRY(nsIAsyncVerifyRedirectCallback)
+  NS_INTERFACE_MAP_ENTRY(nsIProgressEventSink)
+  NS_INTERFACE_MAP_ENTRY(nsIInterfaceRequestor)
+  NS_INTERFACE_MAP_ENTRY(nsITimerCallback)
+  NS_INTERFACE_MAP_ENTRY(nsINamed)
+  NS_INTERFACE_MAP_ENTRY_AMBIGUOUS(nsISupports, nsIStreamListener)
+NS_INTERFACE_MAP_END
+
+NS_IMPL_CYCLE_COLLECTING_ADDREF(nsXMLHttpRequestXPCOMifier)
+NS_IMPL_CYCLE_COLLECTING_RELEASE(nsXMLHttpRequestXPCOMifier)
+
+// Can't NS_IMPL_CYCLE_COLLECTION( because mXHR has ambiguous
+// inheritance from nsISupports.
+NS_IMPL_CYCLE_COLLECTION_CLASS(nsXMLHttpRequestXPCOMifier)
+
+NS_IMPL_CYCLE_COLLECTION_UNLINK_BEGIN(nsXMLHttpRequestXPCOMifier)
+  if (tmp->mXHR) {
+    tmp->mXHR->mXPCOMifier = nullptr;
+  }
+  NS_IMPL_CYCLE_COLLECTION_UNLINK(mXHR)
+NS_IMPL_CYCLE_COLLECTION_UNLINK_END
+
+NS_IMPL_CYCLE_COLLECTION_TRAVERSE_BEGIN(nsXMLHttpRequestXPCOMifier)
+  NS_IMPL_CYCLE_COLLECTION_TRAVERSE(mXHR)
+NS_IMPL_CYCLE_COLLECTION_TRAVERSE_END
+
+NS_IMETHODIMP
+nsXMLHttpRequestXPCOMifier::GetInterface(const nsIID& aIID, void** aResult) {
+  // Return ourselves for the things we implement (except
+  // nsIInterfaceRequestor) and the XHR for the rest.
+  if (!aIID.Equals(NS_GET_IID(nsIInterfaceRequestor))) {
+    nsresult rv = QueryInterface(aIID, aResult);
+    if (NS_SUCCEEDED(rv)) {
+      return rv;
+    }
+  }
+
+  return mXHR->GetInterface(aIID, aResult);
+}
+
+ArrayBufferBuilder::ArrayBufferBuilder()
+    : mMutex("ArrayBufferBuilder"),
+      mDataPtr(nullptr),
+      mCapacity(0),
+      mLength(0),
+      mMapPtr(nullptr),
+      mNeutered(false) {}
+
+ArrayBufferBuilder::~ArrayBufferBuilder() {
+  if (mDataPtr) {
+    JS_free(nullptr, mDataPtr);
+  }
+
+  if (mMapPtr) {
+    JS::ReleaseMappedArrayBufferContents(mMapPtr, mLength);
+    mMapPtr = nullptr;
+  }
+
+  mDataPtr = nullptr;
+  mCapacity = mLength = 0;
+}
+
+bool ArrayBufferBuilder::SetCapacity(uint32_t aNewCap) {
+  MutexAutoLock lock(mMutex);
+  return SetCapacityInternal(aNewCap, lock);
+}
+
+bool ArrayBufferBuilder::SetCapacityInternal(
+    uint32_t aNewCap, const MutexAutoLock& aProofOfLock) {
+  MOZ_ASSERT(!mMapPtr);
+  MOZ_ASSERT(!mNeutered);
+
+  // To ensure that realloc won't free mDataPtr, use a size of 1
+  // instead of 0.
+  uint8_t* newdata = (uint8_t*)js_realloc(mDataPtr, aNewCap ? aNewCap : 1);
+
+  if (!newdata) {
+    return false;
+  }
+
+  if (aNewCap > mCapacity) {
+    memset(newdata + mCapacity, 0, aNewCap - mCapacity);
+  }
+
+  mDataPtr = newdata;
+  mCapacity = aNewCap;
+  if (mLength > aNewCap) {
+    mLength = aNewCap;
+  }
+
+  return true;
+}
+
+bool ArrayBufferBuilder::Append(const uint8_t* aNewData, uint32_t aDataLen,
+                                uint32_t aMaxGrowth) {
+  MutexAutoLock lock(mMutex);
+  MOZ_ASSERT(!mMapPtr);
+  MOZ_ASSERT(!mNeutered);
+
+  CheckedUint32 neededCapacity = mLength;
+  neededCapacity += aDataLen;
+  if (!neededCapacity.isValid()) {
+    return false;
+  }
+  if (mLength + aDataLen > mCapacity) {
+    CheckedUint32 newcap = mCapacity;
+    // Double while under aMaxGrowth or if not specified.
+    if (!aMaxGrowth || mCapacity < aMaxGrowth) {
+      newcap *= 2;
+    } else {
+      newcap += aMaxGrowth;
+    }
+
+    if (!newcap.isValid()) {
+      return false;
+    }
+
+    // But make sure there's always enough to satisfy our request.
+    if (newcap.value() < neededCapacity.value()) {
+      newcap = neededCapacity;
+    }
+
+    if (!SetCapacityInternal(newcap.value(), lock)) {
+      return false;
+    }
+  }
+
+  // Assert that the region isn't overlapping so we can memcpy.
+  MOZ_ASSERT(
+      !AreOverlappingRegions(aNewData, aDataLen, mDataPtr + mLength, aDataLen));
+
+  memcpy(mDataPtr + mLength, aNewData, aDataLen);
+  mLength += aDataLen;
+
+  return true;
+}
+
+uint32_t ArrayBufferBuilder::Length() {
+  MutexAutoLock lock(mMutex);
+  MOZ_ASSERT(!mNeutered);
+  return mLength;
+}
+
+uint32_t ArrayBufferBuilder::Capacity() {
+  MutexAutoLock lock(mMutex);
+  MOZ_ASSERT(!mNeutered);
+  return mCapacity;
+}
+
+JSObject* ArrayBufferBuilder::TakeArrayBuffer(JSContext* aCx) {
+  MutexAutoLock lock(mMutex);
+  MOZ_DIAGNOSTIC_ASSERT(!mNeutered);
+
+  if (mMapPtr) {
+    JSObject* obj = JS::NewMappedArrayBufferWithContents(aCx, mLength, mMapPtr);
+    if (!obj) {
+      JS::ReleaseMappedArrayBufferContents(mMapPtr, mLength);
+    }
+
+    mMapPtr = nullptr;
+    mNeutered = true;
+
+    // The memory-mapped contents will be released when the ArrayBuffer becomes
+    // detached or is GC'd.
+    return obj;
+  }
+
+  // we need to check for mLength == 0, because nothing may have been
+  // added
+  if (mCapacity > mLength || mLength == 0) {
+    if (!SetCapacityInternal(mLength, lock)) {
+      return nullptr;
+    }
+  }
+
+  // |mDataPtr| will be deallocated in ArrayBufferBuilder's destructor when this
+  // ArrayBuffer allocation failed.
+  JSObject* obj = JS::NewArrayBufferWithContents(
+      aCx, mLength, mDataPtr,
+      JS::NewArrayBufferOutOfMemory::CallerMustFreeMemory);
+  if (!obj) {
+    return nullptr;
+  }
+
+  mDataPtr = nullptr;
+  mCapacity = mLength = 0;
+
+  mNeutered = true;
+  return obj;
+}
+
+nsresult ArrayBufferBuilder::MapToFileInPackage(const nsCString& aFile,
+                                                nsIFile* aJarFile) {
+  MutexAutoLock lock(mMutex);
+  MOZ_ASSERT(NS_IsMainThread());
+  MOZ_ASSERT(!mNeutered);
+
+  nsresult rv;
+
+  // Open Jar file to get related attributes of target file.
+  RefPtr<nsZipArchive> zip = nsZipArchive::OpenArchive(aJarFile);
+  if (!zip) {
+    return NS_ERROR_FAILURE;
+  }
+  nsZipItem* zipItem = zip->GetItem(aFile.get());
+  if (!zipItem) {
+    return NS_ERROR_FILE_NOT_FOUND;
+  }
+
+  // If file was added to the package as stored(uncompressed), map to the
+  // offset of file in zip package.
+  if (!zipItem->Compression()) {
+    uint32_t offset = zip->GetDataOffset(zipItem);
+    uint32_t size = zipItem->RealSize();
+    mozilla::AutoFDClose pr_fd;
+    rv = aJarFile->OpenNSPRFileDesc(PR_RDONLY, 0, getter_Transfers(pr_fd));
+    if (NS_FAILED(rv)) {
+      return rv;
+    }
+    mMapPtr = JS::CreateMappedArrayBufferContents(
+        PR_FileDesc2NativeHandle(pr_fd.get()), offset, size);
+    if (mMapPtr) {
+      mLength = size;
+      return NS_OK;
+    }
+  }
+  return NS_ERROR_FAILURE;
+}
+
+/* static */
+bool ArrayBufferBuilder::AreOverlappingRegions(const uint8_t* aStart1,
+                                               uint32_t aLength1,
+                                               const uint8_t* aStart2,
+                                               uint32_t aLength2) {
+  const uint8_t* end1 = aStart1 + aLength1;
+  const uint8_t* end2 = aStart2 + aLength2;
+
+  const uint8_t* max_start = aStart1 > aStart2 ? aStart1 : aStart2;
+  const uint8_t* min_end = end1 < end2 ? end1 : end2;
+
+  return max_start < min_end;
+}
+
+RequestHeaders::RequestHeader* RequestHeaders::Find(const nsACString& aName) {
+  for (RequestHeaders::RequestHeader& header : mHeaders) {
+    if (header.mName.Equals(aName, nsCaseInsensitiveCStringComparator)) {
+      return &header;
+    }
+  }
+  return nullptr;
+}
+
+bool RequestHeaders::IsEmpty() const { return mHeaders.IsEmpty(); }
+
+bool RequestHeaders::Has(const char* aName) {
+  return Has(nsDependentCString(aName));
+}
+
+bool RequestHeaders::Has(const nsACString& aName) { return !!Find(aName); }
+
+void RequestHeaders::Get(const char* aName, nsACString& aValue) {
+  Get(nsDependentCString(aName), aValue);
+}
+
+void RequestHeaders::Get(const nsACString& aName, nsACString& aValue) {
+  RequestHeader* header = Find(aName);
+  if (header) {
+    aValue = header->mValue;
+  } else {
+    aValue.SetIsVoid(true);
+  }
+}
+
+void RequestHeaders::Set(const char* aName, const nsACString& aValue) {
+  Set(nsDependentCString(aName), aValue);
+}
+
+void RequestHeaders::Set(const nsACString& aName, const nsACString& aValue) {
+  RequestHeader* header = Find(aName);
+  if (header) {
+    header->mValue.Assign(aValue);
+  } else {
+    RequestHeader newHeader = {nsCString(aName), nsCString(aValue)};
+    mHeaders.AppendElement(newHeader);
+  }
+}
+
+void RequestHeaders::MergeOrSet(const char* aName, const nsACString& aValue) {
+  MergeOrSet(nsDependentCString(aName), aValue);
+}
+
+void RequestHeaders::MergeOrSet(const nsACString& aName,
+                                const nsACString& aValue) {
+  RequestHeader* header = Find(aName);
+  if (header) {
+    header->mValue.AppendLiteral(", ");
+    header->mValue.Append(aValue);
+  } else {
+    RequestHeader newHeader = {nsCString(aName), nsCString(aValue)};
+    mHeaders.AppendElement(newHeader);
+  }
+}
+
+void RequestHeaders::Clear() { mHeaders.Clear(); }
+
+void RequestHeaders::ApplyToChannel(nsIHttpChannel* aChannel,
+                                    bool aStripRequestBodyHeader,
+                                    bool aStripAuthHeader) const {
+  for (const RequestHeader& header : mHeaders) {
+    if (aStripRequestBodyHeader &&
+        (header.mName.LowerCaseEqualsASCII("content-type") ||
+         header.mName.LowerCaseEqualsASCII("content-encoding") ||
+         header.mName.LowerCaseEqualsASCII("content-language") ||
+         header.mName.LowerCaseEqualsASCII("content-location"))) {
+      continue;
+    }
+
+    if (aStripAuthHeader &&
+        header.mName.LowerCaseEqualsASCII("authorization")) {
+      continue;
+    }
+
+    // Update referrerInfo to override referrer header in system privileged.
+    if (header.mName.LowerCaseEqualsASCII("referer")) {
+      DebugOnly<nsresult> rv = aChannel->SetNewReferrerInfo(
+          header.mValue, nsIReferrerInfo::ReferrerPolicyIDL::UNSAFE_URL, true);
+      MOZ_ASSERT(NS_SUCCEEDED(rv));
+    }
+    if (header.mValue.IsEmpty()) {
+      DebugOnly<nsresult> rv = aChannel->SetEmptyRequestHeader(header.mName);
+      MOZ_ASSERT(NS_SUCCEEDED(rv));
+    } else {
+      DebugOnly<nsresult> rv =
+          aChannel->SetRequestHeader(header.mName, header.mValue, false);
+      MOZ_ASSERT(NS_SUCCEEDED(rv));
+    }
+  }
+}
+
+void RequestHeaders::GetCORSUnsafeHeaders(nsTArray<nsCString>& aArray) const {
+  for (const RequestHeader& header : mHeaders) {
+    if (!nsContentUtils::IsCORSSafelistedRequestHeader(header.mName,
+                                                       header.mValue)) {
+      aArray.AppendElement(header.mName);
+    }
+  }
+}
+
+RequestHeaders::CharsetIterator::CharsetIterator(nsACString& aSource)
+    : mValid(false),
+      mCurPos(-1),
+      mCurLen(-1),
+      mCutoff(aSource.Length()),
+      mSource(aSource) {}
+
+bool RequestHeaders::CharsetIterator::Equals(
+    const nsACString& aOther, const nsCStringComparator& aCmp) const {
+  if (mValid) {
+    return Substring(mSource, mCurPos, mCurLen).Equals(aOther, aCmp);
+  } else {
+    return false;
+  }
+}
+
+void RequestHeaders::CharsetIterator::Replace(const nsACString& aReplacement) {
+  if (mValid) {
+    mSource.Replace(mCurPos, mCurLen, aReplacement);
+    mCurLen = aReplacement.Length();
+  }
+}
+
+bool RequestHeaders::CharsetIterator::Next() {
+  int32_t start, end;
+  nsAutoCString charset;
+
+  // Look for another charset declaration in the string, limiting the
+  // search to only the characters before the parts we've already searched
+  // (before mCutoff), so that we don't find the same charset twice.
+  NS_ExtractCharsetFromContentType(Substring(mSource, 0, mCutoff), charset,
+                                   &mValid, &start, &end);
+
+  if (!mValid) {
+    return false;
+  }
+
+  // Everything after the = sign is the part of the charset we want.
+  mCurPos = mSource.FindChar('=', start) + 1;
+  mCurLen = end - mCurPos;
+
+  // Special case: the extracted charset is quoted with single quotes.
+  // For the purpose of preserving what was set we want to handle them
+  // as delimiters (although they aren't really).
+  if (charset.Length() >= 2 && charset.First() == '\'' &&
+      charset.Last() == '\'') {
+    ++mCurPos;
+    mCurLen -= 2;
+  }
+
+  mCutoff = start;
+
+  return true;
+}
+
+}  // namespace mozilla::dom