chrome_frame/chrome_frame_activex_base.h

   1 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
   2 // Use of this source code is governed by a BSD-style license that can be
   3 // found in the LICENSE file.
   4
   5 #ifndef CHROME_FRAME_CHROME_FRAME_ACTIVEX_BASE_H_
   6 #define CHROME_FRAME_CHROME_FRAME_ACTIVEX_BASE_H_
   7
   8 #include <atlbase.h>
   9 #include <atlcom.h>
  10 #include <atlctl.h>
  11 #include <exdisp.h>
  12 #include <wininet.h>
  13 #include <shdeprecated.h>  // for IBrowserService2
  14 #include <shlguid.h>
  15
  16 #include <set>
  17 #include <string>
  18 #include <vector>
  19
  20 #include "base/metrics/histogram.h"
  21 #include "base/string_util.h"
  22 #include "base/stringprintf.h"
  23 #include "base/utf_string_conversions.h"
  24 #include "base/win/scoped_bstr.h"
  25 #include "base/win/scoped_comptr.h"
  26 #include "base/win/scoped_variant.h"
  27 #include "grit/chrome_frame_resources.h"
  28 #include "chrome/app/chrome_command_ids.h"
  29 #include "chrome/common/url_constants.h"
  30 #include "chrome_frame/chrome_frame_plugin.h"
  31 #include "chrome_frame/chrome_tab.h"
  32 #include "chrome_frame/com_message_event.h"
  33 #include "chrome_frame/com_type_info_holder.h"
  34 #include "chrome_frame/simple_resource_loader.h"
  35 #include "chrome_frame/urlmon_url_request.h"
  36 #include "chrome_frame/urlmon_url_request_private.h"
  37 #include "chrome_frame/utils.h"
  38 #include "grit/generated_resources.h"
  39 #include "net/base/cookie_monster.h"
  40
  41 // Connection point class to support firing IChromeFrameEvents (dispinterface).
  42 template<class T>
  43 class ATL_NO_VTABLE ProxyDIChromeFrameEvents
  44     : public IConnectionPointImpl<T, &DIID_DIChromeFrameEvents> {
  45  public:
  46   void FireMethodWithParams(ChromeFrameEventDispId dispid,
  47                             const VARIANT* params, size_t num_params) {
  48     T* me = static_cast<T*>(this);
  49     // We need to copy the whole vector and AddRef the sinks in case
  50     // some would get disconnected as we fire methods. Note that this is not
  51     // a threading issue, but a re-entrance issue, because the connection
  52     // can be affected by the implementation of the sinks receiving the event.
  53     me->Lock();
  54     std::vector< base::win::ScopedComPtr<IUnknown> > sink_array(
  55         m_vec.GetSize());
  56     for (int connection = 0; connection < m_vec.GetSize(); ++connection)
  57       sink_array[connection] = m_vec.GetAt(connection);
  58     me->Unlock();
  59
  60     for (size_t sink = 0; sink < sink_array.size(); ++sink) {
  61       DIChromeFrameEvents* events =
  62           static_cast<DIChromeFrameEvents*>(sink_array[sink].get());
  63       if (events) {
  64         DISPPARAMS disp_params = {
  65             const_cast<VARIANT*>(params),
  66             NULL,
  67             num_params,
  68             0};
  69         HRESULT hr = events->Invoke(static_cast<DISPID>(dispid),
  70                                     DIID_DIChromeFrameEvents,
  71                                     LOCALE_USER_DEFAULT, DISPATCH_METHOD,
  72                                     &disp_params, NULL, NULL, NULL);
  73         DLOG_IF(ERROR, FAILED(hr)) << "invoke(" << dispid << ") failed" <<
  74             base::StringPrintf("0x%08X", hr);
  75       }
  76     }
  77   }
  78
  79   void FireMethodWithParam(ChromeFrameEventDispId dispid,
  80                            const VARIANT& param) {
  81     FireMethodWithParams(dispid, &param, 1);
  82   }
  83
  84   void Fire_onload(IDispatch* event) {
  85     VARIANT var = { VT_DISPATCH };
  86     var.pdispVal = event;
  87     FireMethodWithParam(CF_EVENT_DISPID_ONLOAD, var);
  88   }
  89
  90   void Fire_onloaderror(IDispatch* event) {
  91     VARIANT var = { VT_DISPATCH };
  92     var.pdispVal = event;
  93     FireMethodWithParam(CF_EVENT_DISPID_ONLOADERROR, var);
  94   }
  95
  96   void Fire_onmessage(IDispatch* event) {
  97     VARIANT var = { VT_DISPATCH };
  98     var.pdispVal = event;
  99     FireMethodWithParam(CF_EVENT_DISPID_ONMESSAGE, var);
 100   }
 101
 102   void Fire_onreadystatechanged(long readystate) {  // NOLINT
 103     VARIANT var = { VT_I4 };
 104     var.lVal = readystate;
 105     FireMethodWithParam(CF_EVENT_DISPID_ONREADYSTATECHANGED, var);
 106   }
 107
 108   void Fire_onprivatemessage(IDispatch* event, BSTR target) {
 109     // Arguments in reverse order to the function declaration, because
 110     // that's what DISPPARAMS requires.
 111     VARIANT args[2] = { { VT_BSTR, }, {VT_DISPATCH, } };
 112     args[0].bstrVal = target;
 113     args[1].pdispVal = event;
 114
 115     FireMethodWithParams(CF_EVENT_DISPID_ONPRIVATEMESSAGE,
 116                          args,
 117                          arraysize(args));
 118   }
 119
 120   void Fire_onchannelerror() {  // NOLINT
 121     FireMethodWithParams(CF_EVENT_DISPID_ONCHANNELERROR, NULL, 0);
 122   }
 123
 124   void Fire_onclose() {  // NOLINT
 125     FireMethodWithParams(CF_EVENT_DISPID_ONCLOSE, NULL, 0);
 126   }
 127 };
 128
 129 extern bool g_first_launch_by_process_;
 130
 131 namespace chrome_frame {
 132 // Implemented outside this file so that the header doesn't include
 133 // automation_messages.h.
 134 std::string ActiveXCreateUrl(const GURL& parsed_url,
 135                              const AttachExternalTabParams& params);
 136 int GetDisposition(const AttachExternalTabParams& params);
 137 void GetMiniContextMenuData(UINT cmd,
 138                             const MiniContextMenuParams& params,
 139                             GURL* referrer,
 140                             GURL* url);
 141 }  // namespace chrome_frame
 142
 143 // Common implementation for ActiveX and Active Document
 144 template <class T, const CLSID& class_id>
 145 class ATL_NO_VTABLE ChromeFrameActivexBase :  // NOLINT
 146   public CComObjectRootEx<CComMultiThreadModel>,
 147   public IOleControlImpl<T>,
 148   public IOleObjectImpl<T>,
 149   public IOleInPlaceActiveObjectImpl<T>,
 150   public IViewObjectExImpl<T>,
 151   public IOleInPlaceObjectWindowlessImpl<T>,
 152   public ISupportErrorInfo,
 153   public IQuickActivateImpl<T>,
 154   public com_util::IProvideClassInfo2Impl<class_id,
 155                                           DIID_DIChromeFrameEvents>,
 156   public com_util::IDispatchImpl<IChromeFrame>,
 157   public IConnectionPointContainerImpl<T>,
 158   public ProxyDIChromeFrameEvents<T>,
 159   public IPropertyNotifySinkCP<T>,
 160   public CComCoClass<T, &class_id>,
 161   public CComControl<T>,
 162   public ChromeFramePlugin<T> {
 163  protected:
 164   typedef std::set<base::win::ScopedComPtr<IDispatch> > EventHandlers;
 165   typedef ChromeFrameActivexBase<T, class_id> BasePlugin;
 166
 167  public:
 168   ChromeFrameActivexBase()
 169       : ready_state_(READYSTATE_UNINITIALIZED),
 170       url_fetcher_(new UrlmonUrlRequestManager()),
 171       failed_to_fetch_in_place_frame_(false),
 172       draw_sad_tab_(false) {
 173     m_bWindowOnly = TRUE;
 174     url_fetcher_->set_container(static_cast<IDispatch*>(this));
 175   }
 176
 177   ~ChromeFrameActivexBase() {
 178     url_fetcher_->set_container(NULL);
 179   }
 180
 181 DECLARE_OLEMISC_STATUS(OLEMISC_RECOMPOSEONRESIZE | OLEMISC_CANTLINKINSIDE |
 182                        OLEMISC_INSIDEOUT | OLEMISC_ACTIVATEWHENVISIBLE |
 183                        OLEMISC_SETCLIENTSITEFIRST)
 184
 185 DECLARE_NOT_AGGREGATABLE(T)
 186
 187 BEGIN_COM_MAP(ChromeFrameActivexBase)
 188   COM_INTERFACE_ENTRY(IChromeFrame)
 189   COM_INTERFACE_ENTRY(IDispatch)
 190   COM_INTERFACE_ENTRY(IViewObjectEx)
 191   COM_INTERFACE_ENTRY(IViewObject2)
 192   COM_INTERFACE_ENTRY(IViewObject)
 193   COM_INTERFACE_ENTRY(IOleInPlaceObjectWindowless)
 194   COM_INTERFACE_ENTRY(IOleInPlaceObject)
 195   COM_INTERFACE_ENTRY2(IOleWindow, IOleInPlaceObjectWindowless)
 196   COM_INTERFACE_ENTRY(IOleInPlaceActiveObject)
 197   COM_INTERFACE_ENTRY(IOleControl)
 198   COM_INTERFACE_ENTRY(IOleObject)
 199   COM_INTERFACE_ENTRY(ISupportErrorInfo)
 200   COM_INTERFACE_ENTRY(IQuickActivate)
 201   COM_INTERFACE_ENTRY(IProvideClassInfo)
 202   COM_INTERFACE_ENTRY(IProvideClassInfo2)
 203   COM_INTERFACE_ENTRY(IConnectionPointContainer)
 204   COM_INTERFACE_ENTRY_FUNC_BLIND(0, InterfaceNotSupported)
 205 END_COM_MAP()
 206
 207 BEGIN_CONNECTION_POINT_MAP(T)
 208   CONNECTION_POINT_ENTRY(IID_IPropertyNotifySink)
 209   CONNECTION_POINT_ENTRY(DIID_DIChromeFrameEvents)
 210 END_CONNECTION_POINT_MAP()
 211
 212 BEGIN_MSG_MAP(ChromeFrameActivexBase)
 213   MESSAGE_HANDLER(WM_CREATE, OnCreate)
 214   MESSAGE_HANDLER(WM_DOWNLOAD_IN_HOST, OnDownloadRequestInHost)
 215   MESSAGE_HANDLER(WM_DESTROY, OnDestroy)
 216   CHAIN_MSG_MAP(ChromeFramePlugin<T>)
 217   CHAIN_MSG_MAP(CComControl<T>)
 218   DEFAULT_REFLECTION_HANDLER()
 219 END_MSG_MAP()
 220
 221   // IViewObjectEx
 222   DECLARE_VIEW_STATUS(VIEWSTATUS_SOLIDBKGND | VIEWSTATUS_OPAQUE)
 223
 224   inline HRESULT IViewObject_Draw(DWORD draw_aspect, LONG index,
 225       void* aspect_info, DVTARGETDEVICE* ptd, HDC info_dc, HDC dc,
 226       LPCRECTL bounds, LPCRECTL win_bounds) {
 227     // ATL ASSERTs if dwDrawAspect is DVASPECT_DOCPRINT, so we cheat.
 228     DWORD aspect = draw_aspect;
 229     if (aspect == DVASPECT_DOCPRINT)
 230       aspect = DVASPECT_CONTENT;
 231
 232     return CComControl<T>::IViewObject_Draw(aspect, index, aspect_info, ptd,
 233         info_dc, dc, bounds, win_bounds);
 234   }
 235
 236   DECLARE_PROTECT_FINAL_CONSTRUCT()
 237
 238   void SetResourceModule() {
 239     SimpleResourceLoader* loader_instance = SimpleResourceLoader::GetInstance();
 240     DCHECK(loader_instance);
 241     HMODULE res_dll = loader_instance->GetResourceModuleHandle();
 242     _AtlBaseModule.SetResourceInstance(res_dll);
 243   }
 244
 245   HRESULT FinalConstruct() {
 246     SetResourceModule();
 247
 248     if (!Initialize())
 249       return E_OUTOFMEMORY;
 250
 251     // Set to true if this is the first launch by this process.
 252     // Used to perform one time tasks.
 253     if (g_first_launch_by_process_) {
 254       g_first_launch_by_process_ = false;
 255       UMA_HISTOGRAM_CUSTOM_COUNTS("ChromeFrame.IEVersion",
 256                                   GetIEVersion(),
 257                                   IE_INVALID,
 258                                   IE_10,
 259                                   IE_10 + 1);
 260     }
 261
 262     return S_OK;
 263   }
 264
 265   void FinalRelease() {
 266     Uninitialize();
 267   }
 268
 269   void ResetUrlRequestManager() {
 270     url_fetcher_.reset(new UrlmonUrlRequestManager());
 271   }
 272
 273   static HRESULT WINAPI InterfaceNotSupported(void* pv, REFIID riid, void** ppv,
 274                                               DWORD dw) {
 275 #ifndef NDEBUG
 276     wchar_t buffer[64] = {0};
 277     ::StringFromGUID2(riid, buffer, arraysize(buffer));
 278     DVLOG(1) << "E_NOINTERFACE: " << buffer;
 279 #endif
 280     return E_NOINTERFACE;
 281   }
 282
 283   // ISupportsErrorInfo
 284   STDMETHOD(InterfaceSupportsErrorInfo)(REFIID riid) {
 285     static const IID* interfaces[] = {
 286       &IID_IChromeFrame,
 287       &IID_IDispatch
 288     };
 289
 290     for (int i = 0; i < arraysize(interfaces); ++i) {
 291       if (InlineIsEqualGUID(*interfaces[i], riid))
 292         return S_OK;
 293     }
 294     return S_FALSE;
 295   }
 296
 297   // Called to draw our control when chrome hasn't been initialized.
 298   virtual HRESULT OnDraw(ATL_DRAWINFO& draw_info) {  // NOLINT
 299     if (NULL == draw_info.prcBounds) {
 300       NOTREACHED();
 301       return E_FAIL;
 302     }
 303
 304     if (draw_sad_tab_) {
 305       // TODO(tommi): Draw a proper sad tab.
 306       RECT rc = {0};
 307       if (draw_info.prcBounds) {
 308         rc.top = draw_info.prcBounds->top;
 309         rc.bottom = draw_info.prcBounds->bottom;
 310         rc.left = draw_info.prcBounds->left;
 311         rc.right = draw_info.prcBounds->right;
 312       } else {
 313         GetClientRect(&rc);
 314       }
 315       ::DrawTextA(draw_info.hdcDraw, ":-(", -1, &rc,
 316           DT_CENTER | DT_VCENTER | DT_SINGLELINE);
 317     } else {
 318       // Don't draw anything.
 319     }
 320     return S_OK;
 321   }
 322
 323   // Used to setup the document_url_ member needed for completing navigation.
 324   // Create external tab (possibly in incognito mode).
 325   HRESULT IOleObject_SetClientSite(IOleClientSite* client_site) {
 326     // If we currently have a document site pointer, release it.
 327     doc_site_.Release();
 328     if (client_site) {
 329       doc_site_.QueryFrom(client_site);
 330     }
 331
 332     if (client_site == NULL) {
 333       in_place_frame_.Release();
 334     }
 335
 336     return CComControlBase::IOleObject_SetClientSite(client_site);
 337   }
 338
 339   bool HandleContextMenuCommand(UINT cmd, const MiniContextMenuParams& params) {
 340     if (cmd == IDC_ABOUT_CHROME_FRAME) {
 341       int tab_handle = automation_client_->tab()->handle();
 342       HostNavigate(GURL("about:version"), GURL(), NEW_WINDOW);
 343       return true;
 344     } else {
 345       switch (cmd) {
 346         case IDS_CONTENT_CONTEXT_SAVEAUDIOAS:
 347         case IDS_CONTENT_CONTEXT_SAVEVIDEOAS:
 348         case IDS_CONTENT_CONTEXT_SAVEIMAGEAS:
 349         case IDS_CONTENT_CONTEXT_SAVELINKAS: {
 350           GURL referrer, url;
 351           chrome_frame::GetMiniContextMenuData(cmd, params, &referrer, &url);
 352           DoFileDownloadInIE(UTF8ToWide(url.spec()).c_str());
 353           return true;
 354         }
 355
 356         case IDC_PRINT: {
 357           automation_client_->PrintTab();
 358           return true;
 359         }
 360       }
 361     }
 362
 363     return false;
 364   }
 365
 366   // Should connections initiated by this class try to block
 367   // responses served with the X-Frame-Options header?
 368   // ActiveX controls genereally will want to do this,
 369   // returning true, while true top-level documents
 370   // (ActiveDocument servers) will not. Your specialization
 371   // of this template should implement this method based on how
 372   // it "feels" from a security perspective. If it's hosted in another
 373   // scriptable document, return true, else false.
 374   //
 375   // The base implementation returns true unless we are in privileged
 376   // mode, in which case we always trust our container so we return false.
 377   bool is_frame_busting_enabled() const {
 378     return !is_privileged();
 379   }
 380
 381   // Needed to support PostTask.
 382   static bool ImplementsThreadSafeReferenceCounting() {
 383     return true;
 384   }
 385
 386   static void BringWebBrowserWindowToTop(IWebBrowser2* web_browser2) {
 387     DCHECK(web_browser2);
 388     if (web_browser2) {
 389       web_browser2->put_Visible(VARIANT_TRUE);
 390       HWND ie_window = NULL;
 391       web_browser2->get_HWND(reinterpret_cast<long*>(&ie_window));
 392       ::BringWindowToTop(ie_window);
 393     }
 394   }
 395
 396  protected:
 397   virtual void GetProfilePath(const std::wstring& profile_name,
 398                               FilePath* profile_path) {
 399     bool is_IE = (lstrcmpi(profile_name.c_str(), kIexploreProfileName) == 0) ||
 400                  (lstrcmpi(profile_name.c_str(), kRundllProfileName) == 0);
 401     // Browsers without IDeleteBrowsingHistory in non-priv mode
 402     // have their profiles moved into "Temporary Internet Files".
 403     if (is_IE && GetIEVersion() < IE_8) {
 404       *profile_path = GetIETemporaryFilesFolder();
 405       *profile_path = profile_path->Append(L"Google Chrome Frame");
 406     } else {
 407       ChromeFramePlugin::GetProfilePath(profile_name, profile_path);
 408     }
 409     DVLOG(1) << __FUNCTION__ << ": " << profile_path->value();
 410   }
 411
 412   void OnLoad(const GURL& url) {
 413     if (ready_state_ < READYSTATE_COMPLETE) {
 414       ready_state_ = READYSTATE_COMPLETE;
 415       FireOnChanged(DISPID_READYSTATE);
 416     }
 417
 418     HRESULT hr = InvokeScriptFunction(onload_handler_, url.spec());
 419   }
 420
 421   void OnLoadFailed(int error_code, const std::string& url) {
 422     HRESULT hr = InvokeScriptFunction(onerror_handler_, url);
 423   }
 424
 425   void OnMessageFromChromeFrame(const std::string& message,
 426                                 const std::string& origin,
 427                                 const std::string& target) {
 428     base::win::ScopedComPtr<IDispatch> message_event;
 429     if (SUCCEEDED(CreateDomEvent("message", message, origin,
 430                                  message_event.Receive()))) {
 431       base::win::ScopedVariant event_var;
 432       event_var.Set(static_cast<IDispatch*>(message_event));
 433       InvokeScriptFunction(onmessage_handler_, event_var.AsInput());
 434     }
 435   }
 436
 437   virtual void OnTabbedOut(bool reverse) {
 438     DCHECK(m_bInPlaceActive);
 439
 440     HWND parent = ::GetParent(m_hWnd);
 441     ::SetFocus(parent);
 442     base::win::ScopedComPtr<IOleControlSite> control_site;
 443     control_site.QueryFrom(m_spClientSite);
 444     if (control_site)
 445       control_site->OnFocus(FALSE);
 446   }
 447
 448   virtual void OnOpenURL(const GURL& url_to_open,
 449                          const GURL& referrer, int open_disposition) {
 450     HostNavigate(url_to_open, referrer, open_disposition);
 451   }
 452
 453   // Called when Chrome has decided that a request needs to be treated as a
 454   // download.  The caller will be the UrlRequest worker thread.
 455   // The worker thread will block while we process the request and take
 456   // ownership of the request object.
 457   // There's room for improvement here and also see todo below.
 458   LPARAM OnDownloadRequestInHost(UINT message, WPARAM wparam, LPARAM lparam,
 459                                  BOOL& handled) {
 460     ChromeFrameUrl cf_url;
 461     cf_url.Parse(UTF8ToWide(GetDocumentUrl()));
 462
 463     // Always issue the download request in a new window to ensure that the
 464     // currently loaded ChromeFrame document does not inadvartently see an
 465     // unload request. This runs javascript unload handlers on the page which
 466     // renders the page non functional.
 467     VARIANT flags = { VT_I4 };
 468     V_I4(&flags) = navNoHistory;
 469     if (!cf_url.attach_to_external_tab())
 470       V_I4(&flags) |= navOpenInNewWindow;
 471
 472     DownloadInHostParams* download_params =
 473         reinterpret_cast<DownloadInHostParams*>(wparam);
 474     DCHECK(download_params);
 475     // TODO(tommi): It looks like we might have to switch the request object
 476     // into a pass-through request object and serve up any thus far received
 477     // content and headers to IE in order to prevent what can currently happen
 478     // which is reissuing requests and turning POST into GET.
 479     if (download_params->moniker) {
 480       NavigateBrowserToMoniker(
 481           doc_site_, download_params->moniker,
 482           UTF8ToWide(download_params->request_headers).c_str(),
 483           download_params->bind_ctx, NULL, download_params->post_data,
 484           &flags);
 485     }
 486     delete download_params;
 487     return TRUE;
 488   }
 489
 490   virtual void OnAttachExternalTab(const AttachExternalTabParams& params) {
 491     GURL current_url(static_cast<BSTR>(url_));
 492     std::string url = chrome_frame::ActiveXCreateUrl(current_url, params);
 493     // Pass the current document url as the referrer for the new navigation.
 494     HostNavigate(GURL(url), current_url, chrome_frame::GetDisposition(params));
 495   }
 496
 497   virtual void OnHandleContextMenu(const ContextMenuModel& menu_model,
 498                                    int align_flags,
 499                                    const MiniContextMenuParams& params) {
 500     scoped_refptr<BasePlugin> ref(this);
 501     ChromeFramePlugin<T>::OnHandleContextMenu(menu_model, align_flags, params);
 502   }
 503
 504   LRESULT OnCreate(UINT message, WPARAM wparam, LPARAM lparam,
 505                    BOOL& handled) {  // NO_LINT
 506     ModifyStyle(0, WS_CLIPCHILDREN | WS_CLIPSIBLINGS, 0);
 507     url_fetcher_->put_notification_window(m_hWnd);
 508     if (automation_client_.get()) {
 509       automation_client_->SetParentWindow(m_hWnd);
 510     } else {
 511       NOTREACHED() << "No automation server";
 512       return -1;
 513     }
 514     // Only fire the 'interactive' ready state if we aren't there already.
 515     if (ready_state_ < READYSTATE_INTERACTIVE) {
 516       ready_state_ = READYSTATE_INTERACTIVE;
 517       FireOnChanged(DISPID_READYSTATE);
 518     }
 519     return 0;
 520   }
 521
 522   LRESULT OnDestroy(UINT message, WPARAM wparam, LPARAM lparam,
 523                     BOOL& handled) {  // NO_LINT
 524     DVLOG(1) << __FUNCTION__;
 525     return 0;
 526   }
 527
 528   // ChromeFrameDelegate override
 529   virtual void OnAutomationServerReady() {
 530     draw_sad_tab_ = false;
 531     ChromeFramePlugin<T>::OnAutomationServerReady();
 532
 533     ready_state_ = READYSTATE_COMPLETE;
 534     FireOnChanged(DISPID_READYSTATE);
 535   }
 536
 537   // ChromeFrameDelegate override
 538   virtual void OnAutomationServerLaunchFailed(
 539       AutomationLaunchResult reason, const std::string& server_version) {
 540     DVLOG(1) << __FUNCTION__;
 541     if (reason == AUTOMATION_SERVER_CRASHED)
 542       draw_sad_tab_ = true;
 543
 544     ready_state_ = READYSTATE_UNINITIALIZED;
 545     FireOnChanged(DISPID_READYSTATE);
 546   }
 547
 548   virtual void OnCloseTab() {
 549     Fire_onclose();
 550   }
 551
 552   // Overridden to take advantage of readystate prop changes and send those
 553   // to potential listeners.
 554   HRESULT FireOnChanged(DISPID dispid) {
 555     if (dispid == DISPID_READYSTATE) {
 556       Fire_onreadystatechanged(ready_state_);
 557     }
 558     return __super::FireOnChanged(dispid);
 559   }
 560
 561   // IChromeFrame
 562   // Property getter/setters for the src attribute, which contains a URL.
 563   // The ChromeFrameActivex control initiates navigation to this URL
 564   // when instantiated.
 565   STDMETHOD(get_src)(BSTR* src) {
 566     if (NULL == src) {
 567       return E_POINTER;
 568     }
 569
 570     *src = SysAllocString(url_);
 571     return S_OK;
 572   }
 573
 574   STDMETHOD(put_src)(BSTR src) {
 575     if (src == NULL)
 576       return E_INVALIDARG;
 577
 578     // Switch the src to UTF8 and try to expand to full URL
 579     std::string src_utf8;
 580     WideToUTF8(src, SysStringLen(src), &src_utf8);
 581     std::string full_url = ResolveURL(GetDocumentUrl(), src_utf8);
 582
 583     // We can initiate navigation here even if ready_state is not complete.
 584     // We do not have to set proxy, and AutomationClient will take care
 585     // of navigation just after CreateExternalTab is done.
 586     if (!automation_client_->InitiateNavigation(full_url,
 587                                                 GetDocumentUrl(),
 588                                                 this)) {
 589       // TODO(robertshield): Make InitiateNavigation return more useful
 590       // error information.
 591       return E_INVALIDARG;
 592     }
 593
 594     // Save full URL in BSTR member
 595     url_.Reset(::SysAllocString(UTF8ToWide(full_url).c_str()));
 596
 597     return S_OK;
 598   }
 599
 600   STDMETHOD(get_onload)(VARIANT* onload_handler) {
 601     if (NULL == onload_handler)
 602       return E_INVALIDARG;
 603
 604     *onload_handler = onload_handler_.Copy();
 605
 606     return S_OK;
 607   }
 608
 609   // Property setter for the onload attribute, which contains a
 610   // javascript function to be invoked on successful navigation.
 611   STDMETHOD(put_onload)(VARIANT onload_handler) {
 612     if (V_VT(&onload_handler) != VT_DISPATCH) {
 613       DLOG(WARNING) << "Invalid onload handler type: "
 614                     << onload_handler.vt
 615                     << " specified";
 616       return E_INVALIDARG;
 617     }
 618
 619     onload_handler_ = onload_handler;
 620
 621     return S_OK;
 622   }
 623
 624   // Property getter/setters for the onloaderror attribute, which contains a
 625   // javascript function to be invoked on navigation failure.
 626   STDMETHOD(get_onloaderror)(VARIANT* onerror_handler) {
 627     if (NULL == onerror_handler)
 628       return E_INVALIDARG;
 629
 630     *onerror_handler = onerror_handler_.Copy();
 631
 632     return S_OK;
 633   }
 634
 635   STDMETHOD(put_onloaderror)(VARIANT onerror_handler) {
 636     if (V_VT(&onerror_handler) != VT_DISPATCH) {
 637       DLOG(WARNING) << "Invalid onloaderror handler type: "
 638                     << onerror_handler.vt
 639                     << " specified";
 640       return E_INVALIDARG;
 641     }
 642
 643     onerror_handler_ = onerror_handler;
 644
 645     return S_OK;
 646   }
 647
 648   // Property getter/setters for the onmessage attribute, which contains a
 649   // javascript function to be invoked when we receive a message from the
 650   // chrome frame.
 651   STDMETHOD(put_onmessage)(VARIANT onmessage_handler) {
 652     if (V_VT(&onmessage_handler) != VT_DISPATCH) {
 653       DLOG(WARNING) << "Invalid onmessage handler type: "
 654                     << onmessage_handler.vt
 655                     << " specified";
 656       return E_INVALIDARG;
 657     }
 658
 659     onmessage_handler_ = onmessage_handler;
 660
 661     return S_OK;
 662   }
 663
 664   STDMETHOD(get_onmessage)(VARIANT* onmessage_handler) {
 665     if (NULL == onmessage_handler)
 666       return E_INVALIDARG;
 667
 668     *onmessage_handler = onmessage_handler_.Copy();
 669
 670     return S_OK;
 671   }
 672
 673   STDMETHOD(get_readyState)(long* ready_state) {  // NOLINT
 674     DVLOG(1) << __FUNCTION__;
 675     DCHECK(ready_state);
 676
 677     if (!ready_state)
 678       return E_INVALIDARG;
 679
 680     *ready_state = ready_state_;
 681
 682     return S_OK;
 683   }
 684
 685   // Property getter/setters for use_chrome_network flag. This flag
 686   // indicates if chrome network stack is to be used for fetching
 687   // network requests.
 688   STDMETHOD(get_useChromeNetwork)(VARIANT_BOOL* use_chrome_network) {
 689     if (!use_chrome_network)
 690       return E_INVALIDARG;
 691
 692     *use_chrome_network =
 693         automation_client_->use_chrome_network() ? VARIANT_TRUE : VARIANT_FALSE;
 694     return S_OK;
 695   }
 696
 697   STDMETHOD(put_useChromeNetwork)(VARIANT_BOOL use_chrome_network) {
 698     if (!is_privileged()) {
 699       DLOG(ERROR) << "Attempt to set useChromeNetwork in non-privileged mode";
 700       return E_ACCESSDENIED;
 701     }
 702
 703     automation_client_->set_use_chrome_network(
 704         (VARIANT_FALSE != use_chrome_network));
 705     return S_OK;
 706   }
 707
 708   // Posts a message to the chrome frame.
 709   STDMETHOD(postMessage)(BSTR message, VARIANT target) {
 710     if (NULL == message) {
 711       return E_INVALIDARG;
 712     }
 713
 714     if (!automation_client_.get())
 715       return E_FAIL;
 716
 717     std::string utf8_target;
 718     if (target.vt == VT_BSTR) {
 719       int len = ::SysStringLen(target.bstrVal);
 720       if (len == 1 && target.bstrVal[0] == L'*') {
 721         utf8_target = "*";
 722       } else {
 723         GURL resolved(target.bstrVal);
 724         if (!resolved.is_valid()) {
 725           Error(L"Unable to parse the specified target URL.");
 726           return E_INVALIDARG;
 727         }
 728
 729         utf8_target = resolved.spec();
 730       }
 731     } else {
 732       utf8_target = "*";
 733     }
 734
 735     std::string utf8_message;
 736     WideToUTF8(message, ::SysStringLen(message), &utf8_message);
 737
 738     GURL url(GURL(document_url_).GetOrigin());
 739     std::string origin(url.is_empty() ? "null" : url.spec());
 740     if (!automation_client_->ForwardMessageFromExternalHost(utf8_message,
 741                                                             origin,
 742                                                             utf8_target)) {
 743       Error(L"Failed to post message to chrome frame");
 744       return E_FAIL;
 745     }
 746
 747     return S_OK;
 748   }
 749
 750   STDMETHOD(addEventListener)(BSTR event_type, IDispatch* listener,
 751                               VARIANT use_capture) {
 752     EventHandlers* handlers = NULL;
 753     HRESULT hr = GetHandlersForEvent(event_type, &handlers);
 754     if (FAILED(hr))
 755       return hr;
 756
 757     DCHECK(handlers != NULL);
 758
 759     handlers->insert(base::win::ScopedComPtr<IDispatch>(listener));
 760
 761     return hr;
 762   }
 763
 764   STDMETHOD(removeEventListener)(BSTR event_type, IDispatch* listener,
 765                                  VARIANT use_capture) {
 766     EventHandlers* handlers = NULL;
 767     HRESULT hr = GetHandlersForEvent(event_type, &handlers);
 768     if (FAILED(hr))
 769       return hr;
 770
 771     DCHECK(handlers != NULL);
 772     handlers->erase(base::win::ScopedComPtr<IDispatch>(listener));
 773
 774     return hr;
 775   }
 776
 777   STDMETHOD(get_version)(BSTR* version) {
 778     if (!automation_client_.get()) {
 779       NOTREACHED();
 780       return E_FAIL;
 781     }
 782
 783     if (version == NULL) {
 784       return E_INVALIDARG;
 785     }
 786
 787     *version = SysAllocString(automation_client_->GetVersion().c_str());
 788     return S_OK;
 789   }
 790
 791   STDMETHOD(postPrivateMessage)(BSTR message, BSTR origin, BSTR target) {
 792     if (NULL == message)
 793       return E_INVALIDARG;
 794
 795     if (!is_privileged()) {
 796       DLOG(ERROR) << "Attempt to postPrivateMessage in non-privileged mode";
 797       return E_ACCESSDENIED;
 798     }
 799
 800     DCHECK(automation_client_.get());
 801     std::string utf8_message, utf8_origin, utf8_target;
 802     WideToUTF8(message, ::SysStringLen(message), &utf8_message);
 803     WideToUTF8(origin, ::SysStringLen(origin), &utf8_origin);
 804     WideToUTF8(target, ::SysStringLen(target), &utf8_target);
 805
 806     if (!automation_client_->ForwardMessageFromExternalHost(utf8_message,
 807                                                             utf8_origin,
 808                                                             utf8_target)) {
 809       Error(L"Failed to post message to chrome frame");
 810       return E_FAIL;
 811     }
 812
 813     return S_OK;
 814   }
 815
 816   STDMETHOD(installExtension)(BSTR crx_path) {
 817     NOTREACHED();  // Deprecated.
 818     return E_NOTIMPL;
 819   }
 820
 821   STDMETHOD(loadExtension)(BSTR path) {
 822     NOTREACHED();  // Deprecated.
 823     return E_NOTIMPL;
 824   }
 825
 826   STDMETHOD(getEnabledExtensions)() {
 827     NOTREACHED();  // Deprecated.
 828     return E_NOTIMPL;
 829   }
 830
 831   STDMETHOD(registerBhoIfNeeded)() {
 832     return E_NOTIMPL;
 833   }
 834
 835   // Returns the vector of event handlers for a given event (e.g. "load").
 836   // If the event type isn't recognized, the function fills in a descriptive
 837   // error (IErrorInfo) and returns E_INVALIDARG.
 838   HRESULT GetHandlersForEvent(BSTR event_type, EventHandlers** handlers) {
 839     DCHECK(handlers != NULL);
 840
 841     // TODO(tommi): make these if() statements data-driven.
 842     HRESULT hr = S_OK;
 843     const wchar_t* event_type_end = event_type + ::SysStringLen(event_type);
 844     if (LowerCaseEqualsASCII(event_type, event_type_end, "message")) {
 845       *handlers = &onmessage_;
 846     } else if (LowerCaseEqualsASCII(event_type, event_type_end, "load")) {
 847       *handlers = &onload_;
 848     } else if (LowerCaseEqualsASCII(event_type, event_type_end, "loaderror")) {
 849       *handlers = &onloaderror_;
 850     } else if (LowerCaseEqualsASCII(event_type, event_type_end,
 851                                     "readystatechanged")) {
 852       *handlers = &onreadystatechanged_;
 853     } else if (LowerCaseEqualsASCII(event_type, event_type_end,
 854                                     "privatemessage")) {
 855       // This event handler is only available in privileged mode.
 856       if (is_privileged()) {
 857         *handlers = &onprivatemessage_;
 858       } else {
 859         Error("Event type 'privatemessage' is privileged");
 860         hr = E_ACCESSDENIED;
 861       }
 862     } else if (LowerCaseEqualsASCII(event_type, event_type_end,
 863                                     "extensionready")) {
 864       // This event handler is only available in privileged mode.
 865       if (is_privileged()) {
 866         *handlers = &onextensionready_;
 867       } else {
 868         Error("Event type 'extensionready' is privileged");
 869         hr = E_ACCESSDENIED;
 870       }
 871     } else {
 872       Error(base::StringPrintf(
 873           "Event type '%ls' not found", event_type).c_str());
 874       hr = E_INVALIDARG;
 875     }
 876
 877     return hr;
 878   }
 879
 880   // Creates a new event object that supports the |data| property.
 881   // Note: you should supply an empty string for |origin| unless you're
 882   // creating a "message" event.
 883   HRESULT CreateDomEvent(const std::string& event_type, const std::string& data,
 884                          const std::string& origin, IDispatch** event) {
 885     DCHECK(event_type.length() > 0);  // NOLINT
 886     DCHECK(event != NULL);
 887
 888     CComObject<ComMessageEvent>* ev = NULL;
 889     HRESULT hr = CComObject<ComMessageEvent>::CreateInstance(&ev);
 890     if (SUCCEEDED(hr)) {
 891       ev->AddRef();
 892
 893       base::win::ScopedComPtr<IOleContainer> container;
 894       m_spClientSite->GetContainer(container.Receive());
 895       if (ev->Initialize(container, data, origin, event_type)) {
 896         *event = ev;
 897       } else {
 898         NOTREACHED() << "event->Initialize";
 899         ev->Release();
 900         hr = E_UNEXPECTED;
 901       }
 902     }
 903
 904     return hr;
 905   }
 906
 907   // Helper function to execute a function on a script IDispatch interface.
 908   HRESULT InvokeScriptFunction(const VARIANT& script_object,
 909                                const std::string& param) {
 910     base::win::ScopedVariant script_arg(UTF8ToWide(param.c_str()).c_str());
 911     return InvokeScriptFunction(script_object, script_arg.AsInput());
 912   }
 913
 914   HRESULT InvokeScriptFunction(const VARIANT& script_object, VARIANT* param) {
 915     return InvokeScriptFunction(script_object, param, 1);
 916   }
 917
 918   HRESULT InvokeScriptFunction(const VARIANT& script_object, VARIANT* params,
 919                                int param_count) {
 920     DCHECK_GE(param_count, 0);
 921     DCHECK(params);
 922
 923     if (V_VT(&script_object) != VT_DISPATCH ||
 924         script_object.pdispVal == NULL) {
 925       return S_FALSE;
 926     }
 927
 928     CComPtr<IDispatch> script(script_object.pdispVal);
 929     HRESULT hr = script.InvokeN(static_cast<DISPID>(DISPID_VALUE),
 930                                 params,
 931                                 param_count);
 932     // 0x80020101 == SCRIPT_E_REPORTED.
 933     // When the script we're invoking has an error, we get this error back.
 934     DLOG_IF(ERROR, FAILED(hr) && hr != 0x80020101) << "Failed to invoke script";
 935     return hr;
 936   }
 937
 938   // Gives the browser a chance to handle an accelerator that was
 939   // sent to the out of proc chromium instance.
 940   // Returns S_OK iff the accelerator was handled by the browser.
 941   HRESULT AllowFrameToTranslateAccelerator(const MSG& msg) {
 942     static const int kMayTranslateAcceleratorOffset = 0x5c;
 943     // Although IBrowserService2 is officially deprecated, it's still alive
 944     // and well in IE7 and earlier.  We have to use it here to correctly give
 945     // the browser a chance to handle keyboard shortcuts.
 946     // This happens automatically for activex components that have windows that
 947     // belong to the current thread.  In that circumstance IE owns the message
 948     // loop and can walk the line of components allowing each participant the
 949     // chance to handle the keystroke and eventually falls back to
 950     // v_MayTranslateAccelerator.  However in our case, the message loop is
 951     // owned by the out-of-proc chromium instance so IE doesn't have a chance to
 952     // fall back on its default behavior.  Instead we give IE a chance to
 953     // handle the shortcut here.
 954     MSG accel_message = msg;
 955     accel_message.hwnd = ::GetParent(m_hWnd);
 956     HRESULT hr = S_FALSE;
 957     base::win::ScopedComPtr<IBrowserService2> bs2;
 958
 959     // For non-IE containers, we use the standard IOleInPlaceFrame contract
 960     // (which IE does not support). For IE, we try to use IBrowserService2,
 961     // but need special handling for IE8 (see below).
 962     //
 963     // We try to cache an IOleInPlaceFrame for our site.  If we fail, we don't
 964     // retry, and we fall back to the IBrowserService2 and PostMessage
 965     // approaches below.
 966     if (!in_place_frame_ && !failed_to_fetch_in_place_frame_) {
 967       base::win::ScopedComPtr<IOleInPlaceUIWindow> dummy_ui_window;
 968       RECT dummy_pos_rect = {0};
 969       RECT dummy_clip_rect = {0};
 970       OLEINPLACEFRAMEINFO dummy_frame_info = {0};
 971       if (!m_spInPlaceSite ||
 972           FAILED(m_spInPlaceSite->GetWindowContext(in_place_frame_.Receive(),
 973                                                    dummy_ui_window.Receive(),
 974                                                    &dummy_pos_rect,
 975                                                    &dummy_clip_rect,
 976                                                    &dummy_frame_info))) {
 977         failed_to_fetch_in_place_frame_ = true;
 978       }
 979     }
 980
 981     // The IBrowserService2 code below (second conditional) explicitly checks
 982     // for whether the IBrowserService2::v_MayTranslateAccelerator function is
 983     // valid. On IE8 there is one vtable ieframe!c_ImpostorBrowserService2Vtbl
 984     // where this function entry is NULL which leads to a crash. We don't know
 985     // under what circumstances this vtable is actually used though.
 986     if (in_place_frame_) {
 987       hr = in_place_frame_->TranslateAccelerator(&accel_message, 0);
 988     } else if (S_OK == DoQueryService(
 989         SID_STopLevelBrowser, m_spInPlaceSite,
 990         bs2.Receive()) && bs2.get() &&
 991         *(*(reinterpret_cast<void***>(bs2.get())) +
 992         kMayTranslateAcceleratorOffset)) {
 993       hr = bs2->v_MayTranslateAccelerator(&accel_message);
 994     } else {
 995       // IE8 doesn't support IBrowserService2 unless you enable a special,
 996       // undocumented flag with CoInternetSetFeatureEnabled and even then,
 997       // the object you get back implements only a couple of methods of
 998       // that interface... all the other entries in the vtable are NULL.
 999       // In addition, the class that implements it is called
1000       // ImpostorBrowserService2 :)
1001       // IE8 does have a new interface though, presumably called
1002       // ITabBrowserService or something that can be abbreviated to TBS.
1003       // That interface has a method, TranslateAcceleratorTBS that does
1004       // call the root MayTranslateAccelerator function, but alas the
1005       // first argument to MayTranslateAccelerator is hard coded to FALSE
1006       // which means that global accelerators are not handled and we're
1007       // out of luck.
1008       // A third thing that's notable with regards to IE8 is that
1009       // none of the *MayTranslate* functions exist in a vtable inside
1010       // ieframe.dll.  I checked this by scanning for the address of
1011       // those functions inside the dll and found none, which means that
1012       // all calls to those functions are relative.
1013       // So, for IE8 in certain cases, and for other containers that may
1014       // support neither IOleInPlaceFrame or IBrowserService2 our approach
1015       // is very simple.  Just post the message to our parent window and IE
1016       // will pick it up if it's an accelerator. We won't know for sure if
1017       // the browser handled the keystroke or not.
1018       ::PostMessage(accel_message.hwnd, accel_message.message,
1019                     accel_message.wParam, accel_message.lParam);
1020     }
1021
1022     return hr;
1023   }
1024
1025   virtual void OnAcceleratorPressed(const MSG& accel_message) {
1026     DCHECK(m_spInPlaceSite != NULL);
1027     // Allow our host a chance to handle the accelerator.
1028     // This catches things like Ctrl+F, Ctrl+O etc, but not browser
1029     // accelerators such as F11, Ctrl+T etc.
1030     // (see AllowFrameToTranslateAccelerator for those).
1031     HRESULT hr = TranslateAccelerator(const_cast<MSG*>(&accel_message));
1032     if (hr != S_OK)
1033       hr = AllowFrameToTranslateAccelerator(accel_message);
1034
1035     DVLOG(1) << __FUNCTION__ << " browser response: "
1036              << base::StringPrintf("0x%08x", hr);
1037
1038     if (hr != S_OK) {
1039       // The WM_SYSKEYDOWN/WM_SYSKEYUP messages are not processed by the
1040       // IOleControlSite and IBrowserService2::v_MayTranslateAccelerator
1041       // implementations. We need to understand this better. That is for
1042       // another day. For now we just post these messages back to the parent
1043       // which forwards it off to the frame. This should not cause major
1044       // grief for Chrome as it does not need to handle WM_SYSKEY* messages in
1045       // in ChromeFrame mode.
1046       // TODO(iyengar)
1047       // Understand and fix WM_SYSCHAR handling
1048       // We should probably unify the accelerator handling for the active
1049       // document and the activex.
1050       if (accel_message.message == WM_SYSCHAR ||
1051           accel_message.message == WM_SYSKEYDOWN ||
1052           accel_message.message == WM_SYSKEYUP) {
1053         ::PostMessage(GetParent(), accel_message.message, accel_message.wParam,
1054                       accel_message.lParam);
1055         return;
1056       }
1057     }
1058     // Last chance to handle the keystroke is to pass it to chromium.
1059     // We do this last partially because there's no way for us to tell if
1060     // chromium actually handled the keystroke, but also since the browser
1061     // should have first dibs anyway.
1062     if (hr != S_OK && automation_client_.get()) {
1063       TabProxy* tab = automation_client_->tab();
1064       if (tab) {
1065         tab->ProcessUnhandledAccelerator(accel_message);
1066       }
1067     }
1068   }
1069
1070  protected:
1071   void HostNavigate(const GURL& url_to_open,
1072                     const GURL& referrer, int open_disposition) {
1073     base::win::ScopedComPtr<IWebBrowser2> web_browser2;
1074     DoQueryService(SID_SWebBrowserApp, m_spClientSite, web_browser2.Receive());
1075     if (!web_browser2) {
1076       NOTREACHED() << "Failed to retrieve IWebBrowser2 interface";
1077       return;
1078     }
1079     base::win::ScopedVariant url;
1080     // Check to see if the URL uses a "view-source:" prefix, if so, open it
1081     // using chrome frame full tab mode by using 'cf:' protocol handler.
1082     // Also change the disposition to NEW_WINDOW since IE6 doesn't have tabs.
1083     if (url_to_open.has_scheme() &&
1084         (url_to_open.SchemeIs(chrome::kViewSourceScheme) ||
1085         url_to_open.SchemeIs(chrome::kAboutScheme))) {
1086       std::wstring chrome_url;
1087       chrome_url.append(kChromeProtocolPrefix);
1088       chrome_url.append(UTF8ToWide(url_to_open.spec()));
1089       url.Set(chrome_url.c_str());
1090       open_disposition = NEW_WINDOW;
1091     } else {
1092       url.Set(UTF8ToWide(url_to_open.spec()).c_str());
1093     }
1094
1095     VARIANT flags = { VT_I4 };
1096     V_I4(&flags) = 0;
1097
1098     IEVersion ie_version = GetIEVersion();
1099     DCHECK(ie_version != NON_IE && ie_version != IE_UNSUPPORTED);
1100     // Since IE6 doesn't support tabs, so we just use window instead.
1101     if (ie_version == IE_6) {
1102       if (open_disposition == NEW_FOREGROUND_TAB ||
1103           open_disposition == NEW_BACKGROUND_TAB ||
1104           open_disposition == NEW_WINDOW ||
1105           open_disposition == NEW_POPUP) {
1106         V_I4(&flags) = navOpenInNewWindow;
1107       } else if (open_disposition != CURRENT_TAB) {
1108         NOTREACHED() << "Unsupported open disposition in IE6";
1109       }
1110     } else {
1111       switch (open_disposition) {
1112         case NEW_FOREGROUND_TAB:
1113           V_I4(&flags) = navOpenInNewTab;
1114           break;
1115         case NEW_BACKGROUND_TAB:
1116           V_I4(&flags) = navOpenInBackgroundTab;
1117           break;
1118         case NEW_WINDOW:
1119         case NEW_POPUP:
1120           V_I4(&flags) = navOpenInNewWindow;
1121           break;
1122         default:
1123           break;
1124       }
1125     }
1126
1127     // TODO(sanjeevr): The navOpenInNewWindow flag causes IE to open this
1128     // in a new window ONLY if the user has specified
1129     // "Always open popups in a new window". Otherwise it opens in a new tab.
1130     // We need to investigate more and see if we can force IE to display the
1131     // link in a new window. MSHTML uses the below code to force an open in a
1132     // new window. But this logic also fails for us. Perhaps this flag is not
1133     // honoured if the ActiveDoc is not MSHTML.
1134     // Even the HLNF_DISABLEWINDOWRESTRICTIONS flag did not work.
1135     // Start of MSHTML-like logic.
1136     // CComQIPtr<ITargetFramePriv2> target_frame = web_browser2;
1137     // if (target_frame) {
1138     //   CComPtr<IUri> uri;
1139     //   CreateUri(UTF8ToWide(open_url_command->url_.spec()).c_str(),
1140     //             Uri_CREATE_IE_SETTINGS, 0, &uri);
1141     //   CComPtr<IBindCtx> bind_ctx;
1142     //   CreateBindCtx(0, &bind_ctx);
1143     //   target_frame->AggregatedNavigation2(
1144     //       HLNF_TRUSTFIRSTDOWNLOAD|HLNF_OPENINNEWWINDOW, bind_ctx, NULL,
1145     //       L"No_Name", uri, L"");
1146     // }
1147     // End of MSHTML-like logic
1148     VARIANT empty = base::win::ScopedVariant::kEmptyVariant;
1149     base::win::ScopedVariant http_headers;
1150
1151     if (referrer.is_valid()) {
1152       std::wstring referrer_header = L"Referer: ";
1153       referrer_header += UTF8ToWide(referrer.spec());
1154       referrer_header += L"\r\n\r\n";
1155       http_headers.Set(referrer_header.c_str());
1156     }
1157
1158     // IE6 does not support tabs. If Chrome sent us a window open request
1159     // indicating that the navigation needs to occur in a foreground tab or
1160     // a popup window, then we need to ensure that the new window in IE6 is
1161     // brought to the foreground.
1162     if (ie_version == IE_6) {
1163       ChromeFrameUrl cf_url;
1164       cf_url.Parse(static_cast<BSTR>(url_));
1165
1166       if (cf_url.attach_to_external_tab() &&
1167           (cf_url.disposition() == NEW_FOREGROUND_TAB ||
1168            cf_url.disposition() == NEW_POPUP)) {
1169         BringWebBrowserWindowToTop(web_browser2);
1170       }
1171     }
1172
1173     HRESULT hr = web_browser2->Navigate2(url.AsInput(), &flags, &empty, &empty,
1174                                          http_headers.AsInput());
1175     // If the current window is a popup window then attempting to open a new
1176     // tab for the navigation will fail. We attempt to issue the navigation in
1177     // a new window in this case.
1178     // http://msdn.microsoft.com/en-us/library/aa752133(v=vs.85).aspx
1179     if (FAILED(hr) && V_I4(&flags) != navOpenInNewWindow) {
1180       V_I4(&flags) = navOpenInNewWindow;
1181       hr = web_browser2->Navigate2(url.AsInput(), &flags, &empty, &empty,
1182                                    http_headers.AsInput());
1183       DLOG_IF(ERROR, FAILED(hr))
1184           << "Navigate2 failed with error: "
1185           << base::StringPrintf("0x%08X", hr);
1186     }
1187   }
1188
1189   void InitializeAutomationSettings() {
1190     static const wchar_t kHandleTopLevelRequests[] = L"HandleTopLevelRequests";
1191     static const wchar_t kUseChromeNetworking[] = L"UseChromeNetworking";
1192
1193     // Query and assign the top-level-request routing, and host networking
1194     // settings from the registry.
1195     bool top_level_requests = GetConfigBool(true, kHandleTopLevelRequests);
1196     bool chrome_network = GetConfigBool(false, kUseChromeNetworking);
1197     automation_client_->set_handle_top_level_requests(top_level_requests);
1198     automation_client_->set_use_chrome_network(chrome_network);
1199   }
1200
1201   base::win::ScopedBstr url_;
1202   base::win::ScopedComPtr<IOleDocumentSite> doc_site_;
1203
1204   // If false, we tried but failed to fetch an IOleInPlaceFrame from our host.
1205   // Cached here so we don't try to fetch it every time if we keep failing.
1206   bool failed_to_fetch_in_place_frame_;
1207   bool draw_sad_tab_;
1208
1209   base::win::ScopedComPtr<IOleInPlaceFrame> in_place_frame_;
1210
1211   // For more information on the ready_state_ property see:
1212   // http://msdn.microsoft.com/en-us/library/aa768179(VS.85).aspx#
1213   READYSTATE ready_state_;
1214
1215   // The following members contain IDispatch interfaces representing the
1216   // onload/onerror/onmessage handlers on the page.
1217   base::win::ScopedVariant onload_handler_;
1218   base::win::ScopedVariant onerror_handler_;
1219   base::win::ScopedVariant onmessage_handler_;
1220
1221   EventHandlers onmessage_;
1222   EventHandlers onloaderror_;
1223   EventHandlers onload_;
1224   EventHandlers onreadystatechanged_;
1225   EventHandlers onprivatemessage_;
1226   EventHandlers onextensionready_;
1227
1228   // Handle network requests when host network stack is used. Passed to the
1229   // automation client on initialization.
1230   scoped_ptr<UrlmonUrlRequestManager> url_fetcher_;
1231 };
1232
1233 #endif  // CHROME_FRAME_CHROME_FRAME_ACTIVEX_BASE_H_