rv = securityManager->CheckLoadURI(baseURI, uri);
rv = securityManager->CheckLoadURI(baseURI, uri, PR_TRUE);
HTMLContentSink::ProcessMETATag(const nsIParserNode& aNode){  nsresult rv = NS_OK;  nsIHTMLContent* parent = nsnull;    if(mCurrentContext!=nsnull) {    parent=mCurrentContext->mStack[mCurrentContext->mStackPos-1].mContent;  }  if (nsnull != parent) {    // Create content object    nsAutoString tmp("meta");    nsIAtom* atom = NS_NewAtom(tmp);    if (nsnull == atom) {      return NS_ERROR_OUT_OF_MEMORY;    }    nsIHTMLContent* it;    rv = NS_NewHTMLMetaElement(&it, atom);    NS_RELEASE(atom);    if (NS_OK == rv) {      // Add in the attributes and add the meta content object to the      // head container.      it->SetDocument(mDocument, PR_FALSE);      rv = AddAttributes(aNode, it);      if (NS_OK != rv) {        NS_RELEASE(it);        return rv;      }      parent->AppendChildTo(it, PR_FALSE);                  // XXX It's just not sufficient to check if the parent is head. Also check for      // the preference.      if(!mInsideNoXXXTag) {        // set any HTTP-EQUIV data into document's header data as well as url        nsAutoString header;        it->GetAttribute(kNameSpaceID_HTML, nsHTMLAtoms::httpEquiv, header);        if (header.Length() > 0) {          nsAutoString result;          it->GetAttribute(kNameSpaceID_HTML, nsHTMLAtoms::content, result);          if (result.Length() > 0) {            // XXX necko isn't going to process headers coming in from the parser            //NS_WARNING("need to fix how necko adds mime headers (in HTMLContentSink::ProcessMETATag)");                      // see if we have a refresh "header".            if (!header.Compare("refresh", PR_TRUE)) {                // Refresh headers are parsed with the following format in mind                // <META HTTP-EQUIV=REFRESH CONTENT="5; URL=http://uri">                // By the time we are here, the following is true:                // header = "REFRESH"                // result = "5; URL=http://uri" // note the URL attribute is optional, if it                //   is absent, the currently loaded url is used.                const PRUnichar *uriCStr = nsnull;                nsAutoString uriAttribStr;                // first get our baseURI                rv = mWebShell->GetURL(&uriCStr);                if (NS_FAILED(rv)) return rv;                nsCOMPtr<nsIURI> baseURI;                rv = NS_NewURI(getter_AddRefs(baseURI), uriCStr, nsnull);                if (NS_FAILED(rv)) return rv;                // next get any uri provided as an attribute in the tag.                PRInt32 loc = result.Find("url", PR_TRUE);                PRInt32 urlLoc = loc;                if (loc > -1) {                    // there is a url attribute, let's use it.                    loc += 3;                     // go past the '=' sign                    loc = result.Find("=", PR_TRUE, loc);                    if (loc > -1) {                        loc++;                        result.Mid(uriAttribStr, loc, result.Length() - loc);                        uriAttribStr.CompressWhitespace();                        // remove any single or double quotes from the ends of the string                        uriAttribStr.Trim("\"'");                        uriCStr = uriAttribStr.GetUnicode();                    }                }                nsCOMPtr<nsIURI> uri;                rv = NS_NewURI(getter_AddRefs(uri), uriCStr, baseURI);                if (loc > -1 && NS_SUCCEEDED(rv)) {                    NS_WITH_SERVICE(nsIScriptSecurityManager, securityManager,                                     NS_SCRIPTSECURITYMANAGER_PROGID, &rv);                    if (NS_SUCCEEDED(rv))                        rv = securityManager->CheckLoadURI(baseURI, uri);                }                if (NS_FAILED(rv)) return rv;                // the units of the numeric value contained in the result are seconds.                // we need them in milliseconds before handing off to the refresh interface.                PRInt32 millis;                if (urlLoc > 1) {                    nsString2 seconds;                    result.Left(seconds, urlLoc-1);                    millis = seconds.ToInteger(&loc) * 1000;                } else {                    millis = result.ToInteger(&loc) * 1000;                }                nsCOMPtr<nsIRefreshURI> reefer = do_QueryInterface(mWebShell, &rv);                if (NS_FAILED(rv)) return rv;                rv = reefer->RefreshURI(uri, millis, PR_FALSE);                if (NS_FAILED(rv)) return rv;            } // END refresh            else if (!header.Compare("set-cookie", PR_TRUE)) {                nsCOMPtr<nsICookieService> cookieServ = do_GetService(NS_COOKIESERVICE_PROGID, &rv);                if (NS_FAILED(rv)) return rv;                // first get our baseURI                const PRUnichar *uriCStr = nsnull;                rv = mWebShell->GetURL(&uriCStr);                if (NS_FAILED(rv)) return rv;                nsCOMPtr<nsIURI> baseURI;                rv = NS_NewURI(getter_AddRefs(baseURI), uriCStr, nsnull);                if (NS_FAILED(rv)) return rv;                rv = cookieServ->SetCookieString(baseURI, result);                if (NS_FAILED(rv)) return rv;            } // END set-cookie            header.ToLowerCase();            nsIAtom* fieldAtom = NS_NewAtom(header);            mDocument->SetHeaderData(fieldAtom, result);            if (fieldAtom == nsHTMLAtoms::headerDefaultStyle) {              mPreferredStyle = result;              mCSSLoader->SetPreferredSheet(mPreferredStyle);            }            else if (fieldAtom == nsHTMLAtoms::link) {              rv = ProcessLink(it, result);            }            else if (fieldAtom == nsHTMLAtoms::headerContentBase) {              ProcessBaseHref(result);            }            else if (fieldAtom == nsHTMLAtoms::headerWindowTarget) {              ProcessBaseTarget(result);            }            NS_IF_RELEASE(fieldAtom);          }//if (result.Length() > 0)         }//if (header.Length() > 0)       }//if(!mInsideNoXXXTag)      NS_RELEASE(it);    }//if (NS_OK == rv)   }//if (nsnull != parent)