dlls/mshtml/navigate.c

   1 /*
   2  * Copyright 2006-2010 Jacek Caban for CodeWeavers
   3  *
   4  * This library is free software; you can redistribute it and/or
   5  * modify it under the terms of the GNU Lesser General Public
   6  * License as published by the Free Software Foundation; either
   7  * version 2.1 of the License, or (at your option) any later version.
   8  *
   9  * This library is distributed in the hope that it will be useful,
  10  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  11  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  12  * Lesser General Public License for more details.
  13  *
  14  * You should have received a copy of the GNU Lesser General Public
  15  * License along with this library; if not, write to the Free Software
  16  * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
  17  */
  18
  19 #include "config.h"
  20
  21 #include <stdarg.h>
  22 #include <assert.h>
  23
  24 #define COBJMACROS
  25 #define NONAMELESSUNION
  26
  27 #include "windef.h"
  28 #include "winbase.h"
  29 #include "winuser.h"
  30 #include "winreg.h"
  31 #include "ole2.h"
  32 #include "hlguids.h"
  33 #include "shlguid.h"
  34 #include "wininet.h"
  35 #include "shlwapi.h"
  36 #include "htiface.h"
  37 #include "shdeprecated.h"
  38
  39 #include "wine/debug.h"
  40
  41 #include "mshtml_private.h"
  42 #include "htmlscript.h"
  43 #include "binding.h"
  44
  45 WINE_DEFAULT_DEBUG_CHANNEL(mshtml);
  46
  47 #define CONTENT_LENGTH "Content-Length"
  48 #define UTF8_STR "utf-8"
  49 #define UTF16_STR "utf-16"
  50
  51 static const WCHAR emptyW[] = {0};
  52 static const WCHAR text_htmlW[] = {'t','e','x','t','/','h','t','m','l',0};
  53
  54 struct nsProtocolStream {
  55     nsIInputStream nsIInputStream_iface;
  56
  57     LONG ref;
  58
  59     char buf[1024];
  60     DWORD buf_size;
  61 };
  62
  63 static inline nsProtocolStream *impl_from_nsIInputStream(nsIInputStream *iface)
  64 {
  65     return CONTAINING_RECORD(iface, nsProtocolStream, nsIInputStream_iface);
  66 }
  67
  68 static nsresult NSAPI nsInputStream_QueryInterface(nsIInputStream *iface, nsIIDRef riid,
  69         void **result)
  70 {
  71     nsProtocolStream *This = impl_from_nsIInputStream(iface);
  72
  73     *result = NULL;
  74
  75     if(IsEqualGUID(&IID_nsISupports, riid)) {
  76         TRACE("(%p)->(IID_nsISupports %p)\n", This, result);
  77         *result  = &This->nsIInputStream_iface;
  78     }else if(IsEqualGUID(&IID_nsIInputStream, riid)) {
  79         TRACE("(%p)->(IID_nsIInputStream %p)\n", This, result);
  80         *result  = &This->nsIInputStream_iface;
  81     }
  82
  83     if(*result) {
  84         nsIInputStream_AddRef(&This->nsIInputStream_iface);
  85         return NS_OK;
  86     }
  87
  88     WARN("unsupported interface %s\n", debugstr_guid(riid));
  89     return NS_NOINTERFACE;
  90 }
  91
  92 static nsrefcnt NSAPI nsInputStream_AddRef(nsIInputStream *iface)
  93 {
  94     nsProtocolStream *This = impl_from_nsIInputStream(iface);
  95     LONG ref = InterlockedIncrement(&This->ref);
  96
  97     TRACE("(%p) ref=%d\n", This, ref);
  98
  99     return ref;
 100 }
 101
 102
 103 static nsrefcnt NSAPI nsInputStream_Release(nsIInputStream *iface)
 104 {
 105     nsProtocolStream *This = impl_from_nsIInputStream(iface);
 106     LONG ref = InterlockedDecrement(&This->ref);
 107
 108     TRACE("(%p) ref=%d\n", This, ref);
 109
 110     if(!ref)
 111         heap_free(This);
 112
 113     return ref;
 114 }
 115
 116 static nsresult NSAPI nsInputStream_Close(nsIInputStream *iface)
 117 {
 118     nsProtocolStream *This = impl_from_nsIInputStream(iface);
 119     FIXME("(%p)\n", This);
 120     return NS_ERROR_NOT_IMPLEMENTED;
 121 }
 122
 123 static nsresult NSAPI nsInputStream_Available(nsIInputStream *iface, UINT64 *_retval)
 124 {
 125     nsProtocolStream *This = impl_from_nsIInputStream(iface);
 126     FIXME("(%p)->(%p)\n", This, _retval);
 127     return NS_ERROR_NOT_IMPLEMENTED;
 128 }
 129
 130 static nsresult NSAPI nsInputStream_Read(nsIInputStream *iface, char *aBuf, UINT32 aCount,
 131                                          UINT32 *_retval)
 132 {
 133     nsProtocolStream *This = impl_from_nsIInputStream(iface);
 134     DWORD read = aCount;
 135
 136     TRACE("(%p)->(%p %d %p)\n", This, aBuf, aCount, _retval);
 137
 138     if(read > This->buf_size)
 139         read = This->buf_size;
 140
 141     if(read) {
 142         memcpy(aBuf, This->buf, read);
 143         if(read < This->buf_size)
 144             memmove(This->buf, This->buf+read, This->buf_size-read);
 145         This->buf_size -= read;
 146     }
 147
 148     *_retval = read;
 149     return NS_OK;
 150 }
 151
 152 static nsresult NSAPI nsInputStream_ReadSegments(nsIInputStream *iface,
 153         nsresult (WINAPI *aWriter)(nsIInputStream*,void*,const char*,UINT32,UINT32,UINT32*),
 154         void *aClousure, UINT32 aCount, UINT32 *_retval)
 155 {
 156     nsProtocolStream *This = impl_from_nsIInputStream(iface);
 157     UINT32 written = 0;
 158     nsresult nsres;
 159
 160     TRACE("(%p)->(%p %p %d %p)\n", This, aWriter, aClousure, aCount, _retval);
 161
 162     if(!This->buf_size)
 163         return S_OK;
 164
 165     if(aCount > This->buf_size)
 166         aCount = This->buf_size;
 167
 168     nsres = aWriter(&This->nsIInputStream_iface, aClousure, This->buf, 0, aCount, &written);
 169     if(NS_FAILED(nsres))
 170         TRACE("aWriter failed: %08x\n", nsres);
 171     else if(written != This->buf_size)
 172         FIXME("written %d != buf_size %d\n", written, This->buf_size);
 173
 174     This->buf_size -= written;
 175
 176     *_retval = written;
 177     return nsres;
 178 }
 179
 180 static nsresult NSAPI nsInputStream_IsNonBlocking(nsIInputStream *iface, cpp_bool *_retval)
 181 {
 182     nsProtocolStream *This = impl_from_nsIInputStream(iface);
 183     FIXME("(%p)->(%p)\n", This, _retval);
 184     return NS_ERROR_NOT_IMPLEMENTED;
 185 }
 186
 187 static const nsIInputStreamVtbl nsInputStreamVtbl = {
 188     nsInputStream_QueryInterface,
 189     nsInputStream_AddRef,
 190     nsInputStream_Release,
 191     nsInputStream_Close,
 192     nsInputStream_Available,
 193     nsInputStream_Read,
 194     nsInputStream_ReadSegments,
 195     nsInputStream_IsNonBlocking
 196 };
 197
 198 static nsProtocolStream *create_nsprotocol_stream(void)
 199 {
 200     nsProtocolStream *ret;
 201
 202     ret = heap_alloc(sizeof(nsProtocolStream));
 203     if(!ret)
 204         return NULL;
 205
 206     ret->nsIInputStream_iface.lpVtbl = &nsInputStreamVtbl;
 207     ret->ref = 1;
 208     ret->buf_size = 0;
 209
 210     return ret;
 211 }
 212
 213 static void release_request_data(request_data_t *request_data)
 214 {
 215     if(request_data->post_stream)
 216         nsIInputStream_Release(request_data->post_stream);
 217     heap_free(request_data->headers);
 218     if(request_data->post_data)
 219         GlobalFree(request_data->post_data);
 220 }
 221
 222 static inline BSCallback *impl_from_IBindStatusCallback(IBindStatusCallback *iface)
 223 {
 224     return CONTAINING_RECORD(iface, BSCallback, IBindStatusCallback_iface);
 225 }
 226
 227 static HRESULT WINAPI BindStatusCallback_QueryInterface(IBindStatusCallback *iface,
 228         REFIID riid, void **ppv)
 229 {
 230     BSCallback *This = impl_from_IBindStatusCallback(iface);
 231
 232     *ppv = NULL;
 233     if(IsEqualGUID(&IID_IUnknown, riid)) {
 234         TRACE("(%p)->(IID_IUnknown, %p)\n", This, ppv);
 235         *ppv = &This->IBindStatusCallback_iface;
 236     }else if(IsEqualGUID(&IID_IBindStatusCallback, riid)) {
 237         TRACE("(%p)->(IID_IBindStatusCallback, %p)\n", This, ppv);
 238         *ppv = &This->IBindStatusCallback_iface;
 239     }else if(IsEqualGUID(&IID_IServiceProvider, riid)) {
 240         TRACE("(%p)->(IID_IServiceProvider %p)\n", This, ppv);
 241         *ppv = &This->IServiceProvider_iface;
 242     }else if(IsEqualGUID(&IID_IHttpNegotiate, riid)) {
 243         TRACE("(%p)->(IID_IHttpNegotiate %p)\n", This, ppv);
 244         *ppv = &This->IHttpNegotiate2_iface;
 245     }else if(IsEqualGUID(&IID_IHttpNegotiate2, riid)) {
 246         TRACE("(%p)->(IID_IHttpNegotiate2 %p)\n", This, ppv);
 247         *ppv = &This->IHttpNegotiate2_iface;
 248     }else if(IsEqualGUID(&IID_IInternetBindInfo, riid)) {
 249         TRACE("(%p)->(IID_IInternetBindInfo %p)\n", This, ppv);
 250         *ppv = &This->IInternetBindInfo_iface;
 251     }
 252
 253     if(*ppv) {
 254         IBindStatusCallback_AddRef(&This->IBindStatusCallback_iface);
 255         return S_OK;
 256     }
 257
 258     TRACE("Unsupported riid = %s\n", debugstr_guid(riid));
 259     return E_NOINTERFACE;
 260 }
 261
 262 static ULONG WINAPI BindStatusCallback_AddRef(IBindStatusCallback *iface)
 263 {
 264     BSCallback *This = impl_from_IBindStatusCallback(iface);
 265     LONG ref = InterlockedIncrement(&This->ref);
 266
 267     TRACE("(%p) ref = %d\n", This, ref);
 268
 269     return ref;
 270 }
 271
 272 static ULONG WINAPI BindStatusCallback_Release(IBindStatusCallback *iface)
 273 {
 274     BSCallback *This = impl_from_IBindStatusCallback(iface);
 275     LONG ref = InterlockedDecrement(&This->ref);
 276
 277     TRACE("(%p) ref = %d\n", This, ref);
 278
 279     if(!ref) {
 280         release_request_data(&This->request_data);
 281         if(This->mon)
 282             IMoniker_Release(This->mon);
 283         if(This->binding)
 284             IBinding_Release(This->binding);
 285         list_remove(&This->entry);
 286         list_init(&This->entry);
 287
 288         This->vtbl->destroy(This);
 289     }
 290
 291     return ref;
 292 }
 293
 294 static HRESULT WINAPI BindStatusCallback_OnStartBinding(IBindStatusCallback *iface,
 295         DWORD dwReserved, IBinding *pbind)
 296 {
 297     BSCallback *This = impl_from_IBindStatusCallback(iface);
 298
 299     TRACE("(%p)->(%d %p)\n", This, dwReserved, pbind);
 300
 301     IBinding_AddRef(pbind);
 302     This->binding = pbind;
 303
 304     if(This->window)
 305         list_add_head(&This->window->bindings, &This->entry);
 306
 307     return This->vtbl->start_binding(This);
 308 }
 309
 310 static HRESULT WINAPI BindStatusCallback_GetPriority(IBindStatusCallback *iface, LONG *pnPriority)
 311 {
 312     BSCallback *This = impl_from_IBindStatusCallback(iface);
 313     FIXME("(%p)->(%p)\n", This, pnPriority);
 314     return E_NOTIMPL;
 315 }
 316
 317 static HRESULT WINAPI BindStatusCallback_OnLowResource(IBindStatusCallback *iface, DWORD reserved)
 318 {
 319     BSCallback *This = impl_from_IBindStatusCallback(iface);
 320     FIXME("(%p)->(%d)\n", This, reserved);
 321     return E_NOTIMPL;
 322 }
 323
 324 static HRESULT WINAPI BindStatusCallback_OnProgress(IBindStatusCallback *iface, ULONG ulProgress,
 325         ULONG ulProgressMax, ULONG ulStatusCode, LPCWSTR szStatusText)
 326 {
 327     BSCallback *This = impl_from_IBindStatusCallback(iface);
 328
 329     TRACE("%p)->(%u %u %u %s)\n", This, ulProgress, ulProgressMax, ulStatusCode,
 330             debugstr_w(szStatusText));
 331
 332     return This->vtbl->on_progress(This, ulStatusCode, szStatusText);
 333 }
 334
 335 static HRESULT WINAPI BindStatusCallback_OnStopBinding(IBindStatusCallback *iface,
 336         HRESULT hresult, LPCWSTR szError)
 337 {
 338     BSCallback *This = impl_from_IBindStatusCallback(iface);
 339     HRESULT hres;
 340
 341     TRACE("(%p)->(%08x %s)\n", This, hresult, debugstr_w(szError));
 342
 343     /* NOTE: IE7 calls GetBindResult here */
 344
 345     hres = This->vtbl->stop_binding(This, hresult);
 346
 347     if(This->binding) {
 348         IBinding_Release(This->binding);
 349         This->binding = NULL;
 350     }
 351
 352     if(This->mon) {
 353         IMoniker_Release(This->mon);
 354         This->mon = NULL;
 355     }
 356
 357     list_remove(&This->entry);
 358     list_init(&This->entry);
 359     This->window = NULL;
 360
 361     return hres;
 362 }
 363
 364 static HRESULT WINAPI BindStatusCallback_GetBindInfo(IBindStatusCallback *iface,
 365         DWORD *grfBINDF, BINDINFO *pbindinfo)
 366 {
 367     BSCallback *This = impl_from_IBindStatusCallback(iface);
 368     DWORD size;
 369
 370     TRACE("(%p)->(%p %p)\n", This, grfBINDF, pbindinfo);
 371
 372     if(!This->bindinfo_ready) {
 373         HRESULT hres;
 374
 375         hres = This->vtbl->init_bindinfo(This);
 376         if(FAILED(hres))
 377             return hres;
 378
 379         This->bindinfo_ready = TRUE;
 380     }
 381
 382     *grfBINDF = This->bindf;
 383
 384     size = pbindinfo->cbSize;
 385     memset(pbindinfo, 0, size);
 386     pbindinfo->cbSize = size;
 387
 388     pbindinfo->cbstgmedData = This->request_data.post_data_len;
 389     pbindinfo->dwCodePage = CP_UTF8;
 390     pbindinfo->dwOptions = 0x80000;
 391
 392     if(This->request_data.post_data_len) {
 393         pbindinfo->dwBindVerb = BINDVERB_POST;
 394
 395         pbindinfo->stgmedData.tymed = TYMED_HGLOBAL;
 396         pbindinfo->stgmedData.u.hGlobal = This->request_data.post_data;
 397         pbindinfo->stgmedData.pUnkForRelease = (IUnknown*)&This->IBindStatusCallback_iface;
 398         IBindStatusCallback_AddRef(&This->IBindStatusCallback_iface);
 399     }
 400
 401     return S_OK;
 402 }
 403
 404 static HRESULT WINAPI BindStatusCallback_OnDataAvailable(IBindStatusCallback *iface,
 405         DWORD grfBSCF, DWORD dwSize, FORMATETC *pformatetc, STGMEDIUM *pstgmed)
 406 {
 407     BSCallback *This = impl_from_IBindStatusCallback(iface);
 408
 409     TRACE("(%p)->(%08x %d %p %p)\n", This, grfBSCF, dwSize, pformatetc, pstgmed);
 410
 411     return This->vtbl->read_data(This, pstgmed->u.pstm);
 412 }
 413
 414 static HRESULT WINAPI BindStatusCallback_OnObjectAvailable(IBindStatusCallback *iface,
 415         REFIID riid, IUnknown *punk)
 416 {
 417     BSCallback *This = impl_from_IBindStatusCallback(iface);
 418     FIXME("(%p)->(%s %p)\n", This, debugstr_guid(riid), punk);
 419     return E_NOTIMPL;
 420 }
 421
 422 static const IBindStatusCallbackVtbl BindStatusCallbackVtbl = {
 423     BindStatusCallback_QueryInterface,
 424     BindStatusCallback_AddRef,
 425     BindStatusCallback_Release,
 426     BindStatusCallback_OnStartBinding,
 427     BindStatusCallback_GetPriority,
 428     BindStatusCallback_OnLowResource,
 429     BindStatusCallback_OnProgress,
 430     BindStatusCallback_OnStopBinding,
 431     BindStatusCallback_GetBindInfo,
 432     BindStatusCallback_OnDataAvailable,
 433     BindStatusCallback_OnObjectAvailable
 434 };
 435
 436 static inline BSCallback *impl_from_IHttpNegotiate2(IHttpNegotiate2 *iface)
 437 {
 438     return CONTAINING_RECORD(iface, BSCallback, IHttpNegotiate2_iface);
 439 }
 440
 441 static HRESULT WINAPI HttpNegotiate_QueryInterface(IHttpNegotiate2 *iface,
 442                                                    REFIID riid, void **ppv)
 443 {
 444     BSCallback *This = impl_from_IHttpNegotiate2(iface);
 445     return IBindStatusCallback_QueryInterface(&This->IBindStatusCallback_iface, riid, ppv);
 446 }
 447
 448 static ULONG WINAPI HttpNegotiate_AddRef(IHttpNegotiate2 *iface)
 449 {
 450     BSCallback *This = impl_from_IHttpNegotiate2(iface);
 451     return IBindStatusCallback_AddRef(&This->IBindStatusCallback_iface);
 452 }
 453
 454 static ULONG WINAPI HttpNegotiate_Release(IHttpNegotiate2 *iface)
 455 {
 456     BSCallback *This = impl_from_IHttpNegotiate2(iface);
 457     return IBindStatusCallback_Release(&This->IBindStatusCallback_iface);
 458 }
 459
 460 static HRESULT WINAPI HttpNegotiate_BeginningTransaction(IHttpNegotiate2 *iface,
 461         LPCWSTR szURL, LPCWSTR szHeaders, DWORD dwReserved, LPWSTR *pszAdditionalHeaders)
 462 {
 463     BSCallback *This = impl_from_IHttpNegotiate2(iface);
 464     HRESULT hres;
 465
 466     TRACE("(%p)->(%s %s %d %p)\n", This, debugstr_w(szURL), debugstr_w(szHeaders),
 467           dwReserved, pszAdditionalHeaders);
 468
 469     *pszAdditionalHeaders = NULL;
 470
 471     hres = This->vtbl->beginning_transaction(This, pszAdditionalHeaders);
 472     if(hres != S_FALSE)
 473         return hres;
 474
 475     if(This->request_data.headers) {
 476         DWORD size;
 477
 478         size = (strlenW(This->request_data.headers)+1)*sizeof(WCHAR);
 479         *pszAdditionalHeaders = CoTaskMemAlloc(size);
 480         if(!*pszAdditionalHeaders)
 481             return E_OUTOFMEMORY;
 482         memcpy(*pszAdditionalHeaders, This->request_data.headers, size);
 483     }
 484
 485     return S_OK;
 486 }
 487
 488 static HRESULT WINAPI HttpNegotiate_OnResponse(IHttpNegotiate2 *iface, DWORD dwResponseCode,
 489         LPCWSTR szResponseHeaders, LPCWSTR szRequestHeaders, LPWSTR *pszAdditionalRequestHeaders)
 490 {
 491     BSCallback *This = impl_from_IHttpNegotiate2(iface);
 492
 493     TRACE("(%p)->(%d %s %s %p)\n", This, dwResponseCode, debugstr_w(szResponseHeaders),
 494           debugstr_w(szRequestHeaders), pszAdditionalRequestHeaders);
 495
 496     return This->vtbl->on_response(This, dwResponseCode, szResponseHeaders);
 497 }
 498
 499 static HRESULT WINAPI HttpNegotiate_GetRootSecurityId(IHttpNegotiate2 *iface,
 500         BYTE *pbSecurityId, DWORD *pcbSecurityId, DWORD_PTR dwReserved)
 501 {
 502     BSCallback *This = impl_from_IHttpNegotiate2(iface);
 503     TRACE("(%p)->(%p %p %ld)\n", This, pbSecurityId, pcbSecurityId, dwReserved);
 504     return E_NOTIMPL; /* FIXME */
 505 }
 506
 507 static const IHttpNegotiate2Vtbl HttpNegotiate2Vtbl = {
 508     HttpNegotiate_QueryInterface,
 509     HttpNegotiate_AddRef,
 510     HttpNegotiate_Release,
 511     HttpNegotiate_BeginningTransaction,
 512     HttpNegotiate_OnResponse,
 513     HttpNegotiate_GetRootSecurityId
 514 };
 515
 516 static inline BSCallback *impl_from_IInternetBindInfo(IInternetBindInfo *iface)
 517 {
 518     return CONTAINING_RECORD(iface, BSCallback, IInternetBindInfo_iface);
 519 }
 520
 521 static HRESULT WINAPI InternetBindInfo_QueryInterface(IInternetBindInfo *iface,
 522                                                       REFIID riid, void **ppv)
 523 {
 524     BSCallback *This = impl_from_IInternetBindInfo(iface);
 525     return IBindStatusCallback_QueryInterface(&This->IBindStatusCallback_iface, riid, ppv);
 526 }
 527
 528 static ULONG WINAPI InternetBindInfo_AddRef(IInternetBindInfo *iface)
 529 {
 530     BSCallback *This = impl_from_IInternetBindInfo(iface);
 531     return IBindStatusCallback_AddRef(&This->IBindStatusCallback_iface);
 532 }
 533
 534 static ULONG WINAPI InternetBindInfo_Release(IInternetBindInfo *iface)
 535 {
 536     BSCallback *This = impl_from_IInternetBindInfo(iface);
 537     return IBindStatusCallback_Release(&This->IBindStatusCallback_iface);
 538 }
 539
 540 static HRESULT WINAPI InternetBindInfo_GetBindInfo(IInternetBindInfo *iface,
 541                                                    DWORD *grfBINDF, BINDINFO *pbindinfo)
 542 {
 543     BSCallback *This = impl_from_IInternetBindInfo(iface);
 544     FIXME("(%p)->(%p %p)\n", This, grfBINDF, pbindinfo);
 545     return E_NOTIMPL;
 546 }
 547
 548 static HRESULT WINAPI InternetBindInfo_GetBindString(IInternetBindInfo *iface,
 549         ULONG ulStringType, LPOLESTR *ppwzStr, ULONG cEl, ULONG *pcElFetched)
 550 {
 551     BSCallback *This = impl_from_IInternetBindInfo(iface);
 552     FIXME("(%p)->(%u %p %u %p)\n", This, ulStringType, ppwzStr, cEl, pcElFetched);
 553     return E_NOTIMPL;
 554 }
 555
 556 static const IInternetBindInfoVtbl InternetBindInfoVtbl = {
 557     InternetBindInfo_QueryInterface,
 558     InternetBindInfo_AddRef,
 559     InternetBindInfo_Release,
 560     InternetBindInfo_GetBindInfo,
 561     InternetBindInfo_GetBindString
 562 };
 563
 564 static inline BSCallback *impl_from_IServiceProvider(IServiceProvider *iface)
 565 {
 566     return CONTAINING_RECORD(iface, BSCallback, IServiceProvider_iface);
 567 }
 568
 569 static HRESULT WINAPI BSCServiceProvider_QueryInterface(IServiceProvider *iface,
 570                                                         REFIID riid, void **ppv)
 571 {
 572     BSCallback *This = impl_from_IServiceProvider(iface);
 573     return IBindStatusCallback_QueryInterface(&This->IBindStatusCallback_iface, riid, ppv);
 574 }
 575
 576 static ULONG WINAPI BSCServiceProvider_AddRef(IServiceProvider *iface)
 577 {
 578     BSCallback *This = impl_from_IServiceProvider(iface);
 579     return IBindStatusCallback_AddRef(&This->IBindStatusCallback_iface);
 580 }
 581
 582 static ULONG WINAPI BSCServiceProvider_Release(IServiceProvider *iface)
 583 {
 584     BSCallback *This = impl_from_IServiceProvider(iface);
 585     return IBindStatusCallback_Release(&This->IBindStatusCallback_iface);
 586 }
 587
 588 static HRESULT WINAPI BSCServiceProvider_QueryService(IServiceProvider *iface,
 589         REFGUID guidService, REFIID riid, void **ppv)
 590 {
 591     BSCallback *This = impl_from_IServiceProvider(iface);
 592
 593     TRACE("(%p)->(%s %s %p)\n", This, debugstr_guid(guidService), debugstr_guid(riid), ppv);
 594
 595     if(This->window && IsEqualGUID(guidService, &IID_IWindowForBindingUI))
 596         return IServiceProvider_QueryService(&This->window->base.IServiceProvider_iface, guidService, riid, ppv);
 597     return E_NOINTERFACE;
 598 }
 599
 600 static const IServiceProviderVtbl ServiceProviderVtbl = {
 601     BSCServiceProvider_QueryInterface,
 602     BSCServiceProvider_AddRef,
 603     BSCServiceProvider_Release,
 604     BSCServiceProvider_QueryService
 605 };
 606
 607 void init_bscallback(BSCallback *This, const BSCallbackVtbl *vtbl, IMoniker *mon, DWORD bindf)
 608 {
 609     This->IBindStatusCallback_iface.lpVtbl = &BindStatusCallbackVtbl;
 610     This->IServiceProvider_iface.lpVtbl = &ServiceProviderVtbl;
 611     This->IHttpNegotiate2_iface.lpVtbl = &HttpNegotiate2Vtbl;
 612     This->IInternetBindInfo_iface.lpVtbl = &InternetBindInfoVtbl;
 613     This->vtbl = vtbl;
 614     This->ref = 1;
 615     This->bindf = bindf;
 616     This->bom = BOM_NONE;
 617
 618     list_init(&This->entry);
 619
 620     if(mon)
 621         IMoniker_AddRef(mon);
 622     This->mon = mon;
 623 }
 624
 625 HRESULT read_stream(BSCallback *This, IStream *stream, void *buf, DWORD size, DWORD *ret_size)
 626 {
 627     DWORD read_size = 0, skip=0;
 628     BYTE *data = buf;
 629     HRESULT hres;
 630
 631     hres = IStream_Read(stream, buf, size, &read_size);
 632
 633     if(!This->readed && This->bom == BOM_NONE) {
 634         if(read_size >= 2 && data[0] == 0xff && data[1] == 0xfe) {
 635             This->bom = BOM_UTF16;
 636             skip = 2;
 637         }else if(read_size >= 3 && data[0] == 0xef && data[1] == 0xbb && data[2] == 0xbf) {
 638             This->bom = BOM_UTF8;
 639             skip = 3;
 640         }
 641         if(skip) {
 642             read_size -= skip;
 643             if(read_size)
 644                 memmove(data, data+skip, read_size);
 645         }
 646     }
 647
 648     This->readed += read_size;
 649     *ret_size = read_size;
 650     return hres;
 651 }
 652
 653 static void parse_content_type(nsChannelBSC *This, const WCHAR *value)
 654 {
 655     const WCHAR *ptr;
 656     size_t len;
 657
 658     static const WCHAR charsetW[] = {'c','h','a','r','s','e','t','='};
 659
 660     ptr = strchrW(value, ';');
 661     if(!ptr)
 662         return;
 663
 664     ptr++;
 665     while(*ptr && isspaceW(*ptr))
 666         ptr++;
 667
 668     len = strlenW(value);
 669     if(ptr + sizeof(charsetW)/sizeof(WCHAR) < value+len && !memicmpW(ptr, charsetW, sizeof(charsetW)/sizeof(WCHAR))) {
 670         size_t charset_len, lena;
 671         nsACString charset_str;
 672         const WCHAR *charset;
 673         char *charseta;
 674
 675         ptr += sizeof(charsetW)/sizeof(WCHAR);
 676
 677         if(*ptr == '\'') {
 678             FIXME("Quoted value\n");
 679             return;
 680         }else {
 681             charset = ptr;
 682             while(*ptr && *ptr != ',')
 683                 ptr++;
 684             charset_len = ptr-charset;
 685         }
 686
 687         lena = WideCharToMultiByte(CP_ACP, 0, charset, charset_len, NULL, 0, NULL, NULL);
 688         charseta = heap_alloc(lena+1);
 689         if(!charseta)
 690             return;
 691
 692         WideCharToMultiByte(CP_ACP, 0, charset, charset_len, charseta, lena, NULL, NULL);
 693         charseta[lena] = 0;
 694
 695         nsACString_InitDepend(&charset_str, charseta);
 696         nsIHttpChannel_SetContentCharset(&This->nschannel->nsIHttpChannel_iface, &charset_str);
 697         nsACString_Finish(&charset_str);
 698         heap_free(charseta);
 699     }else {
 700         FIXME("unhandled: %s\n", debugstr_wn(ptr, len - (ptr-value)));
 701     }
 702 }
 703
 704 static HRESULT parse_headers(const WCHAR *headers, struct list *headers_list)
 705 {
 706     const WCHAR *header, *header_end, *colon, *value;
 707     HRESULT hres;
 708
 709     header = headers;
 710     while(*header) {
 711         if(header[0] == '\r' && header[1] == '\n' && !header[2])
 712             break;
 713         for(colon = header; *colon && *colon != ':' && *colon != '\r'; colon++);
 714         if(*colon != ':')
 715             return E_FAIL;
 716
 717         value = colon+1;
 718         while(*value == ' ')
 719             value++;
 720         if(!*value)
 721             return E_FAIL;
 722
 723         for(header_end = value+1; *header_end && *header_end != '\r'; header_end++);
 724
 725         hres = set_http_header(headers_list, header, colon-header, value, header_end-value);
 726         if(FAILED(hres))
 727             return hres;
 728
 729         header = header_end;
 730         if(header[0] == '\r' && header[1] == '\n')
 731             header += 2;
 732     }
 733
 734     return S_OK;
 735 }
 736
 737 static HRESULT process_response_headers(nsChannelBSC *This, const WCHAR *headers)
 738 {
 739     http_header_t *iter;
 740     HRESULT hres;
 741
 742     static const WCHAR content_typeW[] = {'c','o','n','t','e','n','t','-','t','y','p','e',0};
 743
 744     hres = parse_headers(headers, &This->nschannel->response_headers);
 745     if(FAILED(hres))
 746         return hres;
 747
 748     LIST_FOR_EACH_ENTRY(iter, &This->nschannel->response_headers, http_header_t, entry) {
 749         if(!strcmpiW(iter->header, content_typeW))
 750             parse_content_type(This, iter->data);
 751     }
 752
 753     return S_OK;
 754 }
 755
 756 static void query_http_info(nsChannelBSC *This, IWinInetHttpInfo *wininet_info)
 757 {
 758     const WCHAR *ptr;
 759     DWORD len = 0;
 760     WCHAR *buf;
 761
 762     IWinInetHttpInfo_QueryInfo(wininet_info, HTTP_QUERY_RAW_HEADERS_CRLF, NULL, &len, NULL, NULL);
 763     if(!len)
 764         return;
 765
 766     buf = heap_alloc(len);
 767     if(!buf)
 768         return;
 769
 770     IWinInetHttpInfo_QueryInfo(wininet_info, HTTP_QUERY_RAW_HEADERS_CRLF, buf, &len, NULL, NULL);
 771     if(!len) {
 772         heap_free(buf);
 773         return;
 774     }
 775
 776     ptr = strchrW(buf, '\r');
 777     if(ptr && ptr[1] == '\n') {
 778         ptr += 2;
 779         process_response_headers(This, ptr);
 780     }
 781
 782     heap_free(buf);
 783 }
 784
 785 HRESULT start_binding(HTMLInnerWindow *inner_window, BSCallback *bscallback, IBindCtx *bctx)
 786 {
 787     IStream *str = NULL;
 788     HRESULT hres;
 789
 790     TRACE("(%p %p %p)\n", inner_window, bscallback, bctx);
 791
 792     bscallback->window = inner_window;
 793
 794     /* NOTE: IE7 calls IsSystemMoniker here*/
 795
 796     if(bctx) {
 797         hres = RegisterBindStatusCallback(bctx, &bscallback->IBindStatusCallback_iface, NULL, 0);
 798         if(SUCCEEDED(hres))
 799             IBindCtx_AddRef(bctx);
 800     }else {
 801         hres = CreateAsyncBindCtx(0, &bscallback->IBindStatusCallback_iface, NULL, &bctx);
 802     }
 803
 804     if(FAILED(hres)) {
 805         bscallback->window = NULL;
 806         return hres;
 807     }
 808
 809     hres = IMoniker_BindToStorage(bscallback->mon, bctx, NULL, &IID_IStream, (void**)&str);
 810     IBindCtx_Release(bctx);
 811     if(FAILED(hres)) {
 812         WARN("BindToStorage failed: %08x\n", hres);
 813         bscallback->window = NULL;
 814         return hres;
 815     }
 816
 817     if(str)
 818         IStream_Release(str);
 819
 820     return S_OK;
 821 }
 822
 823 static HRESULT read_post_data_stream(nsIInputStream *stream, BOOL contains_headers, struct list *headers_list,
 824         request_data_t *request_data)
 825 {
 826     nsISeekableStream *seekable_stream;
 827     UINT64 available = 0;
 828     UINT32 data_len = 0;
 829     char *data, *post_data;
 830     nsresult nsres;
 831     HRESULT hres = S_OK;
 832
 833     if(!stream)
 834         return S_OK;
 835
 836     nsres =  nsIInputStream_Available(stream, &available);
 837     if(NS_FAILED(nsres))
 838         return E_FAIL;
 839
 840     post_data = data = GlobalAlloc(0, available+1);
 841     if(!data)
 842         return E_OUTOFMEMORY;
 843
 844     nsres = nsIInputStream_Read(stream, data, available, &data_len);
 845     if(NS_FAILED(nsres)) {
 846         GlobalFree(data);
 847         return E_FAIL;
 848     }
 849
 850     if(contains_headers) {
 851         if(data_len >= 2 && data[0] == '\r' && data[1] == '\n') {
 852             post_data = data+2;
 853             data_len -= 2;
 854         }else {
 855             WCHAR *headers;
 856             DWORD size;
 857             char *ptr;
 858
 859             post_data += data_len;
 860             for(ptr = data; ptr+4 < data+data_len; ptr++) {
 861                 if(!memcmp(ptr, "\r\n\r\n", 4)) {
 862                     ptr += 2;
 863                     post_data = ptr+2;
 864                     break;
 865                 }
 866             }
 867
 868             data_len -= post_data-data;
 869
 870             size = MultiByteToWideChar(CP_ACP, 0, data, ptr-data, NULL, 0);
 871             headers = heap_alloc((size+1)*sizeof(WCHAR));
 872             if(headers) {
 873                 MultiByteToWideChar(CP_ACP, 0, data, ptr-data, headers, size);
 874                 headers[size] = 0;
 875                 if(headers_list)
 876                     hres = parse_headers(headers, headers_list);
 877                 if(SUCCEEDED(hres))
 878                     request_data->headers = headers;
 879                 else
 880                     heap_free(headers);
 881             }else {
 882                 hres = E_OUTOFMEMORY;
 883             }
 884         }
 885     }
 886
 887     if(FAILED(hres)) {
 888         GlobalFree(data);
 889         return hres;
 890     }
 891
 892     if(!data_len) {
 893         GlobalFree(data);
 894         post_data = NULL;
 895     }else if(post_data != data) {
 896         char *new_data;
 897
 898         new_data = GlobalAlloc(0, data_len+1);
 899         if(new_data)
 900             memcpy(new_data, post_data, data_len);
 901         GlobalFree(data);
 902         if(!new_data)
 903             return E_OUTOFMEMORY;
 904         post_data = new_data;
 905     }
 906
 907     if(post_data)
 908         post_data[data_len] = 0;
 909     request_data->post_data = post_data;
 910     request_data->post_data_len = data_len;
 911
 912     nsres = nsIInputStream_QueryInterface(stream, &IID_nsISeekableStream, (void**)&seekable_stream);
 913     assert(nsres == NS_OK);
 914
 915     nsres = nsISeekableStream_Seek(seekable_stream, NS_SEEK_SET, 0);
 916     assert(nsres == NS_OK);
 917
 918     nsISeekableStream_Release(seekable_stream);
 919
 920     nsIInputStream_AddRef(stream);
 921     request_data->post_stream = stream;
 922     TRACE("post_data = %s\n", debugstr_an(request_data->post_data, request_data->post_data_len));
 923     return S_OK;
 924 }
 925
 926 static HRESULT on_start_nsrequest(nsChannelBSC *This)
 927 {
 928     nsresult nsres;
 929
 930     This->nschannel->binding = This;
 931
 932     /* FIXME: it's needed for http connections from BindToObject. */
 933     if(!This->nschannel->response_status)
 934         This->nschannel->response_status = 200;
 935
 936     nsres = nsIStreamListener_OnStartRequest(This->nslistener,
 937             (nsIRequest*)&This->nschannel->nsIHttpChannel_iface, This->nscontext);
 938     if(NS_FAILED(nsres)) {
 939         FIXME("OnStartRequest failed: %08x\n", nsres);
 940         return E_FAIL;
 941     }
 942
 943     if(This->is_doc_channel) {
 944         if(!This->bsc.window)
 945             return E_ABORT; /* Binding aborted in OnStartRequest call. */
 946         update_window_doc(This->bsc.window);
 947         if(This->bsc.window->base.outer_window->readystate != READYSTATE_LOADING)
 948             set_ready_state(This->bsc.window->base.outer_window, READYSTATE_LOADING);
 949     }
 950
 951     return S_OK;
 952 }
 953
 954 static void on_stop_nsrequest(nsChannelBSC *This, HRESULT result)
 955 {
 956     nsresult nsres, request_result;
 957
 958     switch(result) {
 959     case S_OK:
 960         request_result = NS_OK;
 961         break;
 962     case E_ABORT:
 963         request_result = NS_BINDING_ABORTED;
 964         break;
 965     default:
 966         request_result = NS_ERROR_FAILURE;
 967     }
 968
 969     if(This->nslistener) {
 970         nsres = nsIStreamListener_OnStopRequest(This->nslistener,
 971                  (nsIRequest*)&This->nschannel->nsIHttpChannel_iface, This->nscontext,
 972                  request_result);
 973         if(NS_FAILED(nsres))
 974             WARN("OnStopRequest failed: %08x\n", nsres);
 975     }
 976
 977     if(This->nschannel) {
 978         if(This->nschannel->load_group) {
 979             nsres = nsILoadGroup_RemoveRequest(This->nschannel->load_group,
 980                     (nsIRequest*)&This->nschannel->nsIHttpChannel_iface, NULL, request_result);
 981             if(NS_FAILED(nsres))
 982                 ERR("RemoveRequest failed: %08x\n", nsres);
 983         }
 984         if(This->nschannel->binding == This)
 985             This->nschannel->binding = NULL;
 986     }
 987 }
 988
 989 static HRESULT read_stream_data(nsChannelBSC *This, IStream *stream)
 990 {
 991     DWORD read;
 992     nsresult nsres;
 993     HRESULT hres;
 994
 995     if(!This->response_processed) {
 996         IWinInetHttpInfo *wininet_info;
 997
 998         This->response_processed = TRUE;
 999         if(This->bsc.binding) {
1000             hres = IBinding_QueryInterface(This->bsc.binding, &IID_IWinInetHttpInfo, (void**)&wininet_info);
1001             if(SUCCEEDED(hres)) {
1002                 query_http_info(This, wininet_info);
1003                 IWinInetHttpInfo_Release(wininet_info);
1004             }
1005         }
1006     }
1007
1008     if(!This->nschannel)
1009         return S_OK;
1010
1011     if(!This->nslistener) {
1012         BYTE buf[1024];
1013
1014         do {
1015             hres = read_stream(&This->bsc, stream, buf, sizeof(buf), &read);
1016         }while(hres == S_OK && read);
1017
1018         return S_OK;
1019     }
1020
1021     if(!This->nsstream) {
1022         This->nsstream = create_nsprotocol_stream();
1023         if(!This->nsstream)
1024             return E_OUTOFMEMORY;
1025     }
1026
1027     do {
1028         BOOL first_read = !This->bsc.readed;
1029
1030         hres = read_stream(&This->bsc, stream, This->nsstream->buf+This->nsstream->buf_size,
1031                 sizeof(This->nsstream->buf)-This->nsstream->buf_size, &read);
1032         if(!read)
1033             break;
1034
1035         This->nsstream->buf_size += read;
1036
1037         if(first_read) {
1038             switch(This->bsc.bom) {
1039             case BOM_UTF8:
1040                 This->nschannel->charset = heap_strdupA(UTF8_STR);
1041                 break;
1042             case BOM_UTF16:
1043                 This->nschannel->charset = heap_strdupA(UTF16_STR);
1044             case BOM_NONE:
1045                 /* FIXME: Get charset from HTTP headers */;
1046             }
1047
1048             if(!This->nschannel->content_type) {
1049                 WCHAR *mime;
1050
1051                 hres = FindMimeFromData(NULL, NULL, This->nsstream->buf, This->nsstream->buf_size,
1052                         This->is_doc_channel ? text_htmlW : NULL, 0, &mime, 0);
1053                 if(FAILED(hres))
1054                     return hres;
1055
1056                 TRACE("Found MIME %s\n", debugstr_w(mime));
1057
1058                 This->nschannel->content_type = heap_strdupWtoA(mime);
1059                 CoTaskMemFree(mime);
1060                 if(!This->nschannel->content_type)
1061                     return E_OUTOFMEMORY;
1062             }
1063
1064             hres = on_start_nsrequest(This);
1065             if(FAILED(hres))
1066                 return hres;
1067         }
1068
1069         nsres = nsIStreamListener_OnDataAvailable(This->nslistener,
1070                 (nsIRequest*)&This->nschannel->nsIHttpChannel_iface, This->nscontext,
1071                 &This->nsstream->nsIInputStream_iface, This->bsc.readed-This->nsstream->buf_size,
1072                 This->nsstream->buf_size);
1073         if(NS_FAILED(nsres))
1074             ERR("OnDataAvailable failed: %08x\n", nsres);
1075
1076         if(This->nsstream->buf_size == sizeof(This->nsstream->buf)) {
1077             ERR("buffer is full\n");
1078             break;
1079         }
1080     }while(hres == S_OK);
1081
1082     return S_OK;
1083 }
1084
1085 typedef struct {
1086     nsIAsyncVerifyRedirectCallback nsIAsyncVerifyRedirectCallback_iface;
1087
1088     LONG ref;
1089
1090     nsChannel *nschannel;
1091     nsChannelBSC *bsc;
1092 } nsRedirectCallback;
1093
1094 static nsRedirectCallback *impl_from_nsIAsyncVerifyRedirectCallback(nsIAsyncVerifyRedirectCallback *iface)
1095 {
1096     return CONTAINING_RECORD(iface, nsRedirectCallback, nsIAsyncVerifyRedirectCallback_iface);
1097 }
1098
1099 static nsresult NSAPI nsAsyncVerifyRedirectCallback_QueryInterface(nsIAsyncVerifyRedirectCallback *iface,
1100         nsIIDRef riid, void **result)
1101 {
1102     nsRedirectCallback *This = impl_from_nsIAsyncVerifyRedirectCallback(iface);
1103
1104     if(IsEqualGUID(&IID_nsISupports, riid)) {
1105         TRACE("(%p)->(IID_nsISupports %p)\n", This, result);
1106         *result = &This->nsIAsyncVerifyRedirectCallback_iface;
1107     }else if(IsEqualGUID(&IID_nsIAsyncVerifyRedirectCallback, riid)) {
1108         TRACE("(%p)->(IID_nsIAsyncVerifyRedirectCallback %p)\n", This, result);
1109         *result = &This->nsIAsyncVerifyRedirectCallback_iface;
1110     }else {
1111         *result = NULL;
1112         WARN("unimplemented iface %s\n", debugstr_guid(riid));
1113         return NS_NOINTERFACE;
1114     }
1115
1116     nsISupports_AddRef((nsISupports*)*result);
1117     return NS_OK;
1118 }
1119
1120 static nsrefcnt NSAPI nsAsyncVerifyRedirectCallback_AddRef(nsIAsyncVerifyRedirectCallback *iface)
1121 {
1122     nsRedirectCallback *This = impl_from_nsIAsyncVerifyRedirectCallback(iface);
1123     LONG ref = InterlockedIncrement(&This->ref);
1124
1125     TRACE("(%p) ref=%d\n", This, ref);
1126
1127     return ref;
1128 }
1129
1130 static nsrefcnt NSAPI nsAsyncVerifyRedirectCallback_Release(nsIAsyncVerifyRedirectCallback *iface)
1131 {
1132     nsRedirectCallback *This = impl_from_nsIAsyncVerifyRedirectCallback(iface);
1133     LONG ref = InterlockedDecrement(&This->ref);
1134
1135     TRACE("(%p) ref=%d\n", This, ref);
1136
1137     if(!ref) {
1138         IBindStatusCallback_Release(&This->bsc->bsc.IBindStatusCallback_iface);
1139         nsIHttpChannel_Release(&This->nschannel->nsIHttpChannel_iface);
1140         heap_free(This);
1141     }
1142
1143     return ref;
1144 }
1145
1146 static nsresult NSAPI nsAsyncVerifyRedirectCallback_OnRedirectVerifyCallback(nsIAsyncVerifyRedirectCallback *iface, nsresult result)
1147 {
1148     nsRedirectCallback *This = impl_from_nsIAsyncVerifyRedirectCallback(iface);
1149     nsChannel *old_nschannel;
1150     nsresult nsres;
1151
1152     TRACE("(%p)->(%08x)\n", This, result);
1153
1154     old_nschannel = This->bsc->nschannel;
1155     nsIHttpChannel_AddRef(&This->nschannel->nsIHttpChannel_iface);
1156     This->bsc->nschannel = This->nschannel;
1157
1158     if(This->nschannel->load_group) {
1159         nsres = nsILoadGroup_AddRequest(This->nschannel->load_group, (nsIRequest*)&This->nschannel->nsIHttpChannel_iface,
1160                 NULL);
1161         if(NS_FAILED(nsres))
1162             ERR("AddRequest failed: %08x\n", nsres);
1163     }
1164
1165     if(This->bsc->is_doc_channel) {
1166         IUri *uri = nsuri_get_uri(This->nschannel->uri);
1167
1168         if(uri) {
1169             set_current_uri(This->bsc->bsc.window->base.outer_window, uri);
1170             IUri_Release(uri);
1171         }else {
1172             WARN("Could not get IUri from nsWineURI\n");
1173         }
1174     }
1175
1176     if(old_nschannel) {
1177         if(old_nschannel->load_group) {
1178             nsres = nsILoadGroup_RemoveRequest(old_nschannel->load_group,
1179                     (nsIRequest*)&old_nschannel->nsIHttpChannel_iface, NULL, NS_OK);
1180             if(NS_FAILED(nsres))
1181                 ERR("RemoveRequest failed: %08x\n", nsres);
1182         }
1183         nsIHttpChannel_Release(&old_nschannel->nsIHttpChannel_iface);
1184     }
1185
1186     return NS_OK;
1187 }
1188
1189 static const nsIAsyncVerifyRedirectCallbackVtbl nsAsyncVerifyRedirectCallbackVtbl = {
1190     nsAsyncVerifyRedirectCallback_QueryInterface,
1191     nsAsyncVerifyRedirectCallback_AddRef,
1192     nsAsyncVerifyRedirectCallback_Release,
1193     nsAsyncVerifyRedirectCallback_OnRedirectVerifyCallback
1194 };
1195
1196 static HRESULT create_redirect_callback(nsChannel *nschannel, nsChannelBSC *bsc, nsRedirectCallback **ret)
1197 {
1198     nsRedirectCallback *callback;
1199
1200     callback = heap_alloc(sizeof(*callback));
1201     if(!callback)
1202         return E_OUTOFMEMORY;
1203
1204     callback->nsIAsyncVerifyRedirectCallback_iface.lpVtbl = &nsAsyncVerifyRedirectCallbackVtbl;
1205     callback->ref = 1;
1206
1207     nsIHttpChannel_AddRef(&nschannel->nsIHttpChannel_iface);
1208     callback->nschannel = nschannel;
1209
1210     IBindStatusCallback_AddRef(&bsc->bsc.IBindStatusCallback_iface);
1211     callback->bsc = bsc;
1212
1213     *ret = callback;
1214     return S_OK;
1215 }
1216
1217 static inline nsChannelBSC *nsChannelBSC_from_BSCallback(BSCallback *iface)
1218 {
1219     return CONTAINING_RECORD(iface, nsChannelBSC, bsc);
1220 }
1221
1222 static void nsChannelBSC_destroy(BSCallback *bsc)
1223 {
1224     nsChannelBSC *This = nsChannelBSC_from_BSCallback(bsc);
1225
1226     if(This->nschannel) {
1227         if(This->nschannel->binding == This)
1228             This->nschannel->binding = NULL;
1229         nsIHttpChannel_Release(&This->nschannel->nsIHttpChannel_iface);
1230     }
1231     if(This->nslistener)
1232         nsIStreamListener_Release(This->nslistener);
1233     if(This->nscontext)
1234         nsISupports_Release(This->nscontext);
1235     if(This->nsstream)
1236         nsIInputStream_Release(&This->nsstream->nsIInputStream_iface);
1237     heap_free(This);
1238 }
1239
1240 static HRESULT nsChannelBSC_start_binding(BSCallback *bsc)
1241 {
1242     nsChannelBSC *This = nsChannelBSC_from_BSCallback(bsc);
1243
1244     if(This->is_doc_channel)
1245         This->bsc.window->base.outer_window->base.inner_window->doc->skip_mutation_notif = FALSE;
1246
1247     return S_OK;
1248 }
1249
1250 static HRESULT nsChannelBSC_init_bindinfo(BSCallback *bsc)
1251 {
1252     nsChannelBSC *This = nsChannelBSC_from_BSCallback(bsc);
1253     nsChannel *nschannel = This->nschannel;
1254     HRESULT hres;
1255
1256     if(nschannel && nschannel->post_data_stream) {
1257         hres = read_post_data_stream(nschannel->post_data_stream, nschannel->post_data_contains_headers,
1258                 &nschannel->request_headers, &This->bsc.request_data);
1259         if(FAILED(hres))
1260             return hres;
1261     }
1262
1263     return S_OK;
1264 }
1265
1266 typedef struct {
1267     task_t header;
1268     nsChannelBSC *bsc;
1269 } stop_request_task_t;
1270
1271 static void stop_request_proc(task_t *_task)
1272 {
1273     stop_request_task_t *task = (stop_request_task_t*)_task;
1274
1275     TRACE("(%p)\n", task->bsc);
1276
1277     list_remove(&task->bsc->bsc.entry);
1278     list_init(&task->bsc->bsc.entry);
1279     on_stop_nsrequest(task->bsc, S_OK);
1280 }
1281
1282 static void stop_request_task_destr(task_t *_task)
1283 {
1284     stop_request_task_t *task = (stop_request_task_t*)_task;
1285
1286     IBindStatusCallback_Release(&task->bsc->bsc.IBindStatusCallback_iface);
1287     heap_free(task);
1288 }
1289
1290 static HRESULT async_stop_request(nsChannelBSC *This)
1291 {
1292     stop_request_task_t *task;
1293
1294     if(!This->bsc.readed) {
1295         TRACE("No data read, calling OnStartRequest\n");
1296         on_start_nsrequest(This);
1297     }
1298
1299     task = heap_alloc(sizeof(*task));
1300     if(!task)
1301         return E_OUTOFMEMORY;
1302
1303     IBindStatusCallback_AddRef(&This->bsc.IBindStatusCallback_iface);
1304     task->bsc = This;
1305
1306     return push_task(&task->header, stop_request_proc, stop_request_task_destr, This->bsc.window->task_magic);
1307 }
1308
1309 static void handle_navigation_error(nsChannelBSC *This, DWORD result)
1310 {
1311     HTMLOuterWindow *outer_window;
1312     HTMLDocumentObj *doc;
1313     BOOL is_error_url;
1314     SAFEARRAY *sa;
1315     SAFEARRAYBOUND bound;
1316     VARIANT var, varOut;
1317     LONG ind;
1318     BSTR unk;
1319     HRESULT hres;
1320
1321     if(!This->is_doc_channel || !This->bsc.window)
1322         return;
1323
1324     outer_window = This->bsc.window->base.outer_window;
1325
1326     doc = outer_window->doc_obj;
1327     if(!doc || !doc->doc_object_service || !doc->client)
1328         return;
1329
1330     hres = IDocObjectService_IsErrorUrl(doc->doc_object_service,
1331             outer_window->url, &is_error_url);
1332     if(FAILED(hres) || is_error_url)
1333         return;
1334
1335     if(!doc->client_cmdtrg)
1336         return;
1337
1338     bound.lLbound = 0;
1339     bound.cElements = 8;
1340     sa = SafeArrayCreate(VT_VARIANT, 1, &bound);
1341     if(!sa)
1342         return;
1343
1344     ind = 0;
1345     V_VT(&var) = VT_I4;
1346     V_I4(&var) = result;
1347     SafeArrayPutElement(sa, &ind, &var);
1348
1349     ind = 1;
1350     V_VT(&var) = VT_BSTR;
1351     V_BSTR(&var) = outer_window->url;
1352     SafeArrayPutElement(sa, &ind, &var);
1353
1354     ind = 3;
1355     V_VT(&var) = VT_UNKNOWN;
1356     V_UNKNOWN(&var) = (IUnknown*)&outer_window->base.IHTMLWindow2_iface;
1357     SafeArrayPutElement(sa, &ind, &var);
1358
1359     /* FIXME: what are the following fields for? */
1360     ind = 2;
1361     V_VT(&var) = VT_UNKNOWN;
1362     V_UNKNOWN(&var) = NULL;
1363     SafeArrayPutElement(sa, &ind, &var);
1364
1365     ind = 4;
1366     V_VT(&var) = VT_BOOL;
1367     V_BOOL(&var) = FALSE;
1368     SafeArrayPutElement(sa, &ind, &var);
1369
1370     ind = 5;
1371     V_VT(&var) = VT_BOOL;
1372     V_BOOL(&var) = FALSE;
1373     SafeArrayPutElement(sa, &ind, &var);
1374
1375     ind = 6;
1376     V_VT(&var) = VT_BSTR;
1377     unk = SysAllocString(NULL);
1378     V_BSTR(&var) = unk;
1379     SafeArrayPutElement(sa, &ind, &var);
1380
1381     ind = 7;
1382     V_VT(&var) = VT_UNKNOWN;
1383     V_UNKNOWN(&var) = NULL;
1384     SafeArrayPutElement(sa, &ind, &var);
1385
1386     V_VT(&var) = VT_ARRAY;
1387     V_ARRAY(&var) = sa;
1388     V_VT(&varOut) = VT_BOOL;
1389     V_BOOL(&varOut) = VARIANT_TRUE;
1390     IOleCommandTarget_Exec(doc->client_cmdtrg, &CGID_DocHostCmdPriv, 1, 0, &var, FAILED(hres)?NULL:&varOut);
1391
1392     SysFreeString(unk);
1393     SafeArrayDestroy(sa);
1394 }
1395
1396 static HRESULT nsChannelBSC_stop_binding(BSCallback *bsc, HRESULT result)
1397 {
1398     nsChannelBSC *This = nsChannelBSC_from_BSCallback(bsc);
1399
1400     if(result != E_ABORT && This->is_doc_channel && This->bsc.window) {
1401         if(FAILED(result))
1402             handle_navigation_error(This, result);
1403         else if(This->nschannel) {
1404             result = async_stop_request(This);
1405             if(SUCCEEDED(result))
1406                 return S_OK;
1407         }
1408     }
1409
1410     on_stop_nsrequest(This, result);
1411     return S_OK;
1412 }
1413
1414 static HRESULT nsChannelBSC_read_data(BSCallback *bsc, IStream *stream)
1415 {
1416     nsChannelBSC *This = nsChannelBSC_from_BSCallback(bsc);
1417
1418     return read_stream_data(This, stream);
1419 }
1420
1421 static HRESULT handle_redirect(nsChannelBSC *This, const WCHAR *new_url)
1422 {
1423     nsRedirectCallback *callback;
1424     nsIChannelEventSink *sink;
1425     nsChannel *new_channel;
1426     IMoniker *mon;
1427     nsresult nsres;
1428     HRESULT hres;
1429
1430     TRACE("(%p)->(%s)\n", This, debugstr_w(new_url));
1431
1432     hres = CreateURLMoniker(NULL, new_url, &mon);
1433     if(FAILED(hres))
1434         return hres;
1435     IMoniker_Release(This->bsc.mon);
1436     This->bsc.mon = mon;
1437
1438     if(!This->nschannel || !This->nschannel->notif_callback)
1439         return S_OK;
1440
1441     nsres = nsIInterfaceRequestor_GetInterface(This->nschannel->notif_callback, &IID_nsIChannelEventSink, (void**)&sink);
1442     if(NS_FAILED(nsres))
1443         return S_OK;
1444
1445     hres = create_redirect_nschannel(new_url, This->nschannel, &new_channel);
1446     if(SUCCEEDED(hres)) {
1447         TRACE("%p %p->%p\n", This, This->nschannel, new_channel);
1448
1449         hres = create_redirect_callback(new_channel, This, &callback);
1450         nsIHttpChannel_Release(&new_channel->nsIHttpChannel_iface);
1451     }
1452
1453     if(SUCCEEDED(hres)) {
1454         nsres = nsIChannelEventSink_AsyncOnChannelRedirect(sink, (nsIChannel*)&This->nschannel->nsIHttpChannel_iface,
1455                 (nsIChannel*)&callback->nschannel->nsIHttpChannel_iface, REDIRECT_TEMPORARY, /* FIXME */
1456                 &callback->nsIAsyncVerifyRedirectCallback_iface);
1457
1458         if(NS_FAILED(nsres))
1459             FIXME("AsyncOnChannelRedirect failed: %08x\n", hres);
1460         else if(This->nschannel != callback->nschannel)
1461             FIXME("nschannel not updated\n");
1462
1463         nsIAsyncVerifyRedirectCallback_Release(&callback->nsIAsyncVerifyRedirectCallback_iface);
1464     }
1465
1466     nsIChannelEventSink_Release(sink);
1467     return hres;
1468 }
1469
1470 static BOOL is_supported_doc_mime(const WCHAR *mime)
1471 {
1472     char *nscat, *mimea;
1473     BOOL ret;
1474
1475     mimea = heap_strdupWtoA(mime);
1476     if(!mimea)
1477         return FALSE;
1478
1479     nscat = get_nscategory_entry("Gecko-Content-Viewers", mimea);
1480
1481     ret = nscat != NULL && !strcmp(nscat, "@mozilla.org/content/document-loader-factory;1");
1482
1483     heap_free(mimea);
1484     nsfree(nscat);
1485     return ret;
1486 }
1487
1488 static IUri *get_moniker_uri(IMoniker *mon)
1489 {
1490     IUriContainer *uri_container;
1491     IUri *ret = NULL;
1492     HRESULT hres;
1493
1494     hres = IMoniker_QueryInterface(mon, &IID_IUriContainer, (void**)&uri_container);
1495     if(SUCCEEDED(hres)) {
1496         hres = IUriContainer_GetIUri(uri_container, &ret);
1497         IUriContainer_Release(uri_container);
1498         if(FAILED(hres))
1499             return NULL;
1500     }else {
1501         FIXME("No IUriContainer\n");
1502     }
1503
1504     return ret;
1505 }
1506
1507 static void handle_extern_mime_navigation(nsChannelBSC *This)
1508 {
1509     IWebBrowserPriv2IE9 *webbrowser_priv;
1510     IOleCommandTarget *cmdtrg;
1511     HTMLDocumentObj *doc_obj;
1512     IBindCtx *bind_ctx;
1513     IUri *uri;
1514     VARIANT flags;
1515     HRESULT hres;
1516
1517     if(!This->bsc.window || !This->bsc.window->base.outer_window || !This->bsc.window->base.outer_window->doc_obj)
1518         return;
1519
1520     doc_obj = This->bsc.window->base.outer_window->doc_obj;
1521
1522     hres = IOleClientSite_QueryInterface(doc_obj->client, &IID_IOleCommandTarget, (void**)&cmdtrg);
1523     if(SUCCEEDED(hres)) {
1524         IOleCommandTarget_Exec(cmdtrg, &CGID_ShellDocView, 62, 0, NULL, NULL);
1525         IOleCommandTarget_Release(cmdtrg);
1526     }
1527
1528     set_document_navigation(doc_obj, FALSE);
1529
1530     if(!doc_obj->webbrowser) {
1531         FIXME("unimplemented in non-webbrowser mode\n");
1532         return;
1533     }
1534
1535     uri = get_moniker_uri(This->bsc.mon);
1536     if(!uri)
1537         return;
1538
1539     hres = CreateBindCtx(0, &bind_ctx);
1540     if(FAILED(hres)) {
1541         IUri_Release(uri);
1542         return;
1543     }
1544
1545     V_VT(&flags) = VT_I4;
1546     V_I4(&flags) = navHyperlink;
1547
1548     hres = IUnknown_QueryInterface(doc_obj->webbrowser, &IID_IWebBrowserPriv2IE8, (void**)&webbrowser_priv);
1549     if(SUCCEEDED(hres)) {
1550         hres = IWebBrowserPriv2IE9_NavigateWithBindCtx2(webbrowser_priv, uri, &flags, NULL, NULL, NULL, bind_ctx, NULL, 0);
1551         IWebBrowserPriv2IE9_Release(webbrowser_priv);
1552     }else {
1553         IWebBrowserPriv *webbrowser_priv_old;
1554         VARIANT uriv;
1555
1556         hres = IUnknown_QueryInterface(doc_obj->webbrowser, &IID_IWebBrowserPriv, (void**)&webbrowser_priv_old);
1557         if(SUCCEEDED(hres)) {
1558             V_VT(&uriv) = VT_BSTR;
1559             IUri_GetDisplayUri(uri, &V_BSTR(&uriv));
1560
1561             hres = IWebBrowserPriv_NavigateWithBindCtx(webbrowser_priv_old, &uriv, &flags, NULL, NULL, NULL, bind_ctx, NULL);
1562
1563             SysFreeString(V_BSTR(&uriv));
1564             IWebBrowserPriv_Release(webbrowser_priv_old);
1565         }
1566     }
1567
1568     IUri_Release(uri);
1569 }
1570
1571 static HRESULT nsChannelBSC_on_progress(BSCallback *bsc, ULONG status_code, LPCWSTR status_text)
1572 {
1573     nsChannelBSC *This = nsChannelBSC_from_BSCallback(bsc);
1574
1575     switch(status_code) {
1576     case BINDSTATUS_MIMETYPEAVAILABLE:
1577         if(This->is_doc_channel && !is_supported_doc_mime(status_text)) {
1578             FIXME("External MIME: %s\n", debugstr_w(status_text));
1579
1580             handle_extern_mime_navigation(This);
1581
1582             This->nschannel = NULL;
1583         }
1584
1585         if(!This->nschannel)
1586             return S_OK;
1587
1588         heap_free(This->nschannel->content_type);
1589         This->nschannel->content_type = heap_strdupWtoA(status_text);
1590         break;
1591     case BINDSTATUS_REDIRECTING:
1592         return handle_redirect(This, status_text);
1593     case BINDSTATUS_BEGINDOWNLOADDATA: {
1594         IWinInetHttpInfo *http_info;
1595         DWORD status, size = sizeof(DWORD);
1596         HRESULT hres;
1597
1598         if(!This->bsc.binding)
1599             break;
1600
1601         hres = IBinding_QueryInterface(This->bsc.binding, &IID_IWinInetHttpInfo, (void**)&http_info);
1602         if(FAILED(hres))
1603             break;
1604
1605         hres = IWinInetHttpInfo_QueryInfo(http_info,
1606                 HTTP_QUERY_STATUS_CODE|HTTP_QUERY_FLAG_NUMBER, &status, &size, NULL, NULL);
1607         IWinInetHttpInfo_Release(http_info);
1608         if(FAILED(hres) || status == HTTP_STATUS_OK)
1609             break;
1610
1611         handle_navigation_error(This, status);
1612     }
1613     }
1614
1615     return S_OK;
1616 }
1617
1618 static HRESULT process_response_status_text(const WCHAR *header, const WCHAR *header_end, char **status_text)
1619 {
1620     header = strchrW(header + 1, ' ');
1621     if(!header || header >= header_end)
1622         return E_FAIL;
1623     header = strchrW(header + 1, ' ');
1624     if(!header || header >= header_end)
1625         return E_FAIL;
1626     ++header;
1627
1628     *status_text = heap_strndupWtoU(header, header_end - header);
1629
1630     if(!*status_text)
1631         return E_OUTOFMEMORY;
1632
1633     return S_OK;
1634 }
1635
1636 static HRESULT nsChannelBSC_on_response(BSCallback *bsc, DWORD response_code,
1637         LPCWSTR response_headers)
1638 {
1639     nsChannelBSC *This = nsChannelBSC_from_BSCallback(bsc);
1640     char *str;
1641     HRESULT hres;
1642
1643     This->response_processed = TRUE;
1644     This->nschannel->response_status = response_code;
1645
1646     if(response_headers) {
1647         const WCHAR *headers;
1648
1649         headers = strchrW(response_headers, '\r');
1650         hres = process_response_status_text(response_headers, headers, &str);
1651         if(FAILED(hres)) {
1652             WARN("parsing headers failed: %08x\n", hres);
1653             return hres;
1654         }
1655
1656         heap_free(This->nschannel->response_status_text);
1657         This->nschannel->response_status_text = str;
1658
1659         if(headers && headers[1] == '\n') {
1660             headers += 2;
1661             hres = process_response_headers(This, headers);
1662             if(FAILED(hres)) {
1663                 WARN("parsing headers failed: %08x\n", hres);
1664                 return hres;
1665             }
1666         }
1667     }
1668
1669     return S_OK;
1670 }
1671
1672 static HRESULT nsChannelBSC_beginning_transaction(BSCallback *bsc, WCHAR **additional_headers)
1673 {
1674     nsChannelBSC *This = nsChannelBSC_from_BSCallback(bsc);
1675     http_header_t *iter;
1676     DWORD len = 0;
1677     WCHAR *ptr;
1678
1679     static const WCHAR content_lengthW[] =
1680         {'C','o','n','t','e','n','t','-','L','e','n','g','t','h',0};
1681
1682     if(!This->nschannel)
1683         return S_FALSE;
1684
1685     LIST_FOR_EACH_ENTRY(iter, &This->nschannel->request_headers, http_header_t, entry) {
1686         if(strcmpW(iter->header, content_lengthW))
1687             len += strlenW(iter->header) + 2 /* ": " */ + strlenW(iter->data) + 2 /* "\r\n" */;
1688     }
1689
1690     if(!len)
1691         return S_OK;
1692
1693     *additional_headers = ptr = CoTaskMemAlloc((len+1)*sizeof(WCHAR));
1694     if(!ptr)
1695         return E_OUTOFMEMORY;
1696
1697     LIST_FOR_EACH_ENTRY(iter, &This->nschannel->request_headers, http_header_t, entry) {
1698         if(!strcmpW(iter->header, content_lengthW))
1699             continue;
1700
1701         len = strlenW(iter->header);
1702         memcpy(ptr, iter->header, len*sizeof(WCHAR));
1703         ptr += len;
1704
1705         *ptr++ = ':';
1706         *ptr++ = ' ';
1707
1708         len = strlenW(iter->data);
1709         memcpy(ptr, iter->data, len*sizeof(WCHAR));
1710         ptr += len;
1711
1712         *ptr++ = '\r';
1713         *ptr++ = '\n';
1714     }
1715
1716     *ptr = 0;
1717
1718     return S_OK;
1719 }
1720
1721 static const BSCallbackVtbl nsChannelBSCVtbl = {
1722     nsChannelBSC_destroy,
1723     nsChannelBSC_init_bindinfo,
1724     nsChannelBSC_start_binding,
1725     nsChannelBSC_stop_binding,
1726     nsChannelBSC_read_data,
1727     nsChannelBSC_on_progress,
1728     nsChannelBSC_on_response,
1729     nsChannelBSC_beginning_transaction
1730 };
1731
1732 HRESULT create_channelbsc(IMoniker *mon, const WCHAR *headers, BYTE *post_data, DWORD post_data_size,
1733         BOOL is_doc_binding, nsChannelBSC **retval)
1734 {
1735     nsChannelBSC *ret;
1736     DWORD bindf;
1737
1738     ret = heap_alloc_zero(sizeof(*ret));
1739     if(!ret)
1740         return E_OUTOFMEMORY;
1741
1742     bindf = BINDF_ASYNCHRONOUS | BINDF_ASYNCSTORAGE | BINDF_PULLDATA;
1743     if(post_data_size)
1744         bindf |= BINDF_FORMS_SUBMIT | BINDF_PRAGMA_NO_CACHE | BINDF_HYPERLINK | BINDF_GETNEWESTVERSION;
1745
1746     init_bscallback(&ret->bsc, &nsChannelBSCVtbl, mon, bindf);
1747     ret->is_doc_channel = is_doc_binding;
1748
1749     if(headers) {
1750         ret->bsc.request_data.headers = heap_strdupW(headers);
1751         if(!ret->bsc.request_data.headers) {
1752             IBindStatusCallback_Release(&ret->bsc.IBindStatusCallback_iface);
1753             return E_OUTOFMEMORY;
1754         }
1755     }
1756
1757     if(post_data) {
1758         ret->bsc.request_data.post_data = GlobalAlloc(0, post_data_size+1);
1759         if(!ret->bsc.request_data.post_data) {
1760             release_request_data(&ret->bsc.request_data);
1761             IBindStatusCallback_Release(&ret->bsc.IBindStatusCallback_iface);
1762             return E_OUTOFMEMORY;
1763         }
1764
1765         memcpy(ret->bsc.request_data.post_data, post_data, post_data_size);
1766         ((BYTE*)ret->bsc.request_data.post_data)[post_data_size] = 0;
1767         ret->bsc.request_data.post_data_len = post_data_size;
1768     }
1769
1770     TRACE("created %p\n", ret);
1771     *retval = ret;
1772     return S_OK;
1773 }
1774
1775 typedef struct {
1776     task_t header;
1777     HTMLOuterWindow *window;
1778     HTMLInnerWindow *pending_window;
1779 } start_doc_binding_task_t;
1780
1781 static void start_doc_binding_proc(task_t *_task)
1782 {
1783     start_doc_binding_task_t *task = (start_doc_binding_task_t*)_task;
1784
1785     set_current_mon(task->window, task->pending_window->bscallback->bsc.mon, BINDING_NAVIGATED);
1786     start_binding(task->pending_window, &task->pending_window->bscallback->bsc, NULL);
1787 }
1788
1789 static void start_doc_binding_task_destr(task_t *_task)
1790 {
1791     start_doc_binding_task_t *task = (start_doc_binding_task_t*)_task;
1792
1793     IHTMLWindow2_Release(&task->pending_window->base.IHTMLWindow2_iface);
1794     heap_free(task);
1795 }
1796
1797 HRESULT async_start_doc_binding(HTMLOuterWindow *window, HTMLInnerWindow *pending_window)
1798 {
1799     start_doc_binding_task_t *task;
1800
1801     TRACE("%p\n", pending_window);
1802
1803     task = heap_alloc(sizeof(start_doc_binding_task_t));
1804     if(!task)
1805         return E_OUTOFMEMORY;
1806
1807     task->window = window;
1808     task->pending_window = pending_window;
1809     IHTMLWindow2_AddRef(&pending_window->base.IHTMLWindow2_iface);
1810
1811     return push_task(&task->header, start_doc_binding_proc, start_doc_binding_task_destr, pending_window->task_magic);
1812 }
1813
1814 void abort_window_bindings(HTMLInnerWindow *window)
1815 {
1816     BSCallback *iter;
1817
1818     remove_target_tasks(window->task_magic);
1819
1820     while(!list_empty(&window->bindings)) {
1821         iter = LIST_ENTRY(window->bindings.next, BSCallback, entry);
1822
1823         TRACE("Aborting %p\n", iter);
1824
1825         IBindStatusCallback_AddRef(&iter->IBindStatusCallback_iface);
1826
1827         if(iter->binding)
1828             IBinding_Abort(iter->binding);
1829         else
1830             iter->vtbl->stop_binding(iter, E_ABORT);
1831
1832         iter->window = NULL;
1833         list_remove(&iter->entry);
1834         list_init(&iter->entry);
1835
1836         IBindStatusCallback_Release(&iter->IBindStatusCallback_iface);
1837     }
1838
1839     if(window->bscallback) {
1840         IBindStatusCallback_Release(&window->bscallback->bsc.IBindStatusCallback_iface);
1841         window->bscallback = NULL;
1842     }
1843
1844     if(window->mon) {
1845         IMoniker_Release(window->mon);
1846         window->mon = NULL;
1847     }
1848 }
1849
1850 HRESULT channelbsc_load_stream(HTMLInnerWindow *pending_window, IMoniker *mon, IStream *stream)
1851 {
1852     nsChannelBSC *bscallback = pending_window->bscallback;
1853     HRESULT hres = S_OK;
1854
1855     if(!bscallback->nschannel) {
1856         ERR("NULL nschannel\n");
1857         return E_FAIL;
1858     }
1859
1860     bscallback->nschannel->content_type = heap_strdupA("text/html");
1861     if(!bscallback->nschannel->content_type)
1862         return E_OUTOFMEMORY;
1863
1864     set_current_mon(pending_window->base.outer_window, mon, 0);
1865
1866     bscallback->bsc.window = pending_window;
1867     if(stream)
1868         hres = read_stream_data(bscallback, stream);
1869     if(SUCCEEDED(hres))
1870         hres = async_stop_request(bscallback);
1871     if(FAILED(hres))
1872         IBindStatusCallback_OnStopBinding(&bscallback->bsc.IBindStatusCallback_iface, hres, NULL);
1873
1874     return hres;
1875 }
1876
1877 void channelbsc_set_channel(nsChannelBSC *This, nsChannel *channel, nsIStreamListener *listener, nsISupports *context)
1878 {
1879     nsIHttpChannel_AddRef(&channel->nsIHttpChannel_iface);
1880     This->nschannel = channel;
1881
1882     nsIStreamListener_AddRef(listener);
1883     This->nslistener = listener;
1884
1885     if(context) {
1886         nsISupports_AddRef(context);
1887         This->nscontext = context;
1888     }
1889
1890     if(This->bsc.request_data.headers) {
1891         HRESULT hres;
1892
1893         hres = parse_headers(This->bsc.request_data.headers, &channel->request_headers);
1894         heap_free(This->bsc.request_data.headers);
1895         This->bsc.request_data.headers = NULL;
1896         if(FAILED(hres))
1897             WARN("parse_headers failed: %08x\n", hres);
1898     }
1899 }
1900
1901 typedef struct {
1902     task_t header;
1903     HTMLOuterWindow *window;
1904     IUri *uri;
1905 } navigate_javascript_task_t;
1906
1907 static void navigate_javascript_proc(task_t *_task)
1908 {
1909     navigate_javascript_task_t *task = (navigate_javascript_task_t*)_task;
1910     HTMLOuterWindow *window = task->window;
1911     VARIANT v;
1912     BSTR code;
1913     HRESULT hres;
1914
1915     static const WCHAR jscriptW[] = {'j','s','c','r','i','p','t',0};
1916
1917     task->window->readystate = READYSTATE_COMPLETE;
1918
1919     hres = IUri_GetPath(task->uri, &code);
1920     if(FAILED(hres))
1921         return;
1922
1923     hres = UrlUnescapeW(code, NULL, NULL, URL_UNESCAPE_INPLACE);
1924     if(FAILED(hres)) {
1925         SysFreeString(code);
1926         return;
1927     }
1928
1929     set_download_state(window->doc_obj, 1);
1930
1931     V_VT(&v) = VT_EMPTY;
1932     hres = exec_script(window->base.inner_window, code, jscriptW, &v);
1933     SysFreeString(code);
1934     if(SUCCEEDED(hres) && V_VT(&v) != VT_EMPTY) {
1935         FIXME("javascirpt URL returned %s\n", debugstr_variant(&v));
1936         VariantClear(&v);
1937     }
1938
1939     if(window->doc_obj->view_sink)
1940         IAdviseSink_OnViewChange(window->doc_obj->view_sink, DVASPECT_CONTENT, -1);
1941
1942     set_download_state(window->doc_obj, 0);
1943 }
1944
1945 static void navigate_javascript_task_destr(task_t *_task)
1946 {
1947     navigate_javascript_task_t *task = (navigate_javascript_task_t*)_task;
1948
1949     IUri_Release(task->uri);
1950     heap_free(task);
1951 }
1952
1953 typedef struct {
1954     task_t header;
1955     HTMLOuterWindow *window;
1956     nsChannelBSC *bscallback;
1957     DWORD flags;
1958     IMoniker *mon;
1959     IUri *uri;
1960 } navigate_task_t;
1961
1962 static void navigate_proc(task_t *_task)
1963 {
1964     navigate_task_t *task = (navigate_task_t*)_task;
1965     HRESULT hres;
1966
1967     hres = set_moniker(task->window, task->mon, task->uri, NULL, task->bscallback, TRUE);
1968     if(SUCCEEDED(hres)) {
1969         set_current_mon(task->window, task->bscallback->bsc.mon, task->flags);
1970         set_current_uri(task->window, task->uri);
1971         start_binding(task->window->pending_window, &task->bscallback->bsc, NULL);
1972     }
1973 }
1974
1975 static void navigate_task_destr(task_t *_task)
1976 {
1977     navigate_task_t *task = (navigate_task_t*)_task;
1978
1979     IBindStatusCallback_Release(&task->bscallback->bsc.IBindStatusCallback_iface);
1980     IMoniker_Release(task->mon);
1981     IUri_Release(task->uri);
1982     heap_free(task);
1983 }
1984
1985 static HRESULT navigate_fragment(HTMLOuterWindow *window, IUri *uri)
1986 {
1987     nsIDOMLocation *nslocation;
1988     nsAString nsfrag_str;
1989     WCHAR *selector;
1990     BSTR frag;
1991     nsresult nsres;
1992     HRESULT hres;
1993
1994     const WCHAR selector_formatW[] = {'a','[','i','d','=','"','%','s','"',']',0};
1995
1996     set_current_uri(window, uri);
1997
1998     nsres = nsIDOMWindow_GetLocation(window->nswindow, &nslocation);
1999     if(FAILED(nsres) || !nslocation)
2000         return E_FAIL;
2001
2002     hres = IUri_GetFragment(uri, &frag);
2003     if(FAILED(hres)) {
2004         nsIDOMLocation_Release(nslocation);
2005         return hres;
2006     }
2007
2008     nsAString_InitDepend(&nsfrag_str, frag);
2009     nsres = nsIDOMLocation_SetHash(nslocation, &nsfrag_str);
2010     nsAString_Finish(&nsfrag_str);
2011     nsIDOMLocation_Release(nslocation);
2012     if(NS_FAILED(nsres))
2013         ERR("SetHash failed: %08x\n", nsres);
2014
2015     /*
2016      * IE supports scrolling to anchor elements with "#hash" ids (note that '#' is part of the id),
2017      * while Gecko scrolls only to elements with "hash" ids. We scroll the page ourselves if
2018      * a[id="#hash"] element can be found.
2019      */
2020     selector = heap_alloc(sizeof(selector_formatW)+SysStringLen(frag)*sizeof(WCHAR));
2021     if(selector) {
2022         nsIDOMElement *nselem = NULL;
2023         nsAString selector_str;
2024
2025         sprintfW(selector, selector_formatW, frag);
2026         nsAString_InitDepend(&selector_str, selector);
2027         /* NOTE: Gecko doesn't set result to NULL if there is no match, so nselem must be initialized */
2028         nsres = nsIDOMHTMLDocument_QuerySelector(window->base.inner_window->doc->nsdoc, &selector_str, &nselem);
2029         nsAString_Finish(&selector_str);
2030         heap_free(selector);
2031         if(NS_SUCCEEDED(nsres) && nselem) {
2032             nsIDOMHTMLElement *html_elem;
2033
2034             nsres = nsIDOMElement_QueryInterface(nselem, &IID_nsIDOMHTMLElement, (void**)&html_elem);
2035             nsIDOMElement_Release(nselem);
2036             if(NS_SUCCEEDED(nsres)) {
2037                 nsIDOMHTMLElement_ScrollIntoView(html_elem, TRUE, 1);
2038                 nsIDOMHTMLElement_Release(html_elem);
2039             }
2040         }
2041     }
2042
2043     SysFreeString(frag);
2044
2045     if(window->doc_obj->doc_object_service) {
2046         IDocObjectService_FireNavigateComplete2(window->doc_obj->doc_object_service, &window->base.IHTMLWindow2_iface, 0x10);
2047         IDocObjectService_FireDocumentComplete(window->doc_obj->doc_object_service, &window->base.IHTMLWindow2_iface, 0);
2048
2049     }
2050
2051     return S_OK;
2052 }
2053
2054 HRESULT super_navigate(HTMLOuterWindow *window, IUri *uri, DWORD flags, const WCHAR *headers, BYTE *post_data, DWORD post_data_size)
2055 {
2056     nsChannelBSC *bsc;
2057     IUri *uri_nofrag;
2058     IMoniker *mon;
2059     DWORD scheme;
2060     HRESULT hres;
2061
2062     uri_nofrag = get_uri_nofrag(uri);
2063     if(!uri_nofrag)
2064         return E_FAIL;
2065
2066     if(window->doc_obj->client && !(flags & BINDING_REFRESH)) {
2067         IOleCommandTarget *cmdtrg;
2068
2069         hres = IOleClientSite_QueryInterface(window->doc_obj->client, &IID_IOleCommandTarget, (void**)&cmdtrg);
2070         if(SUCCEEDED(hres)) {
2071             VARIANT in, out;
2072             BSTR url_str;
2073
2074             hres = IUri_GetDisplayUri(uri_nofrag, &url_str);
2075             if(SUCCEEDED(hres)) {
2076                 V_VT(&in) = VT_BSTR;
2077                 V_BSTR(&in) = url_str;
2078                 V_VT(&out) = VT_BOOL;
2079                 V_BOOL(&out) = VARIANT_TRUE;
2080                 hres = IOleCommandTarget_Exec(cmdtrg, &CGID_ShellDocView, 67, 0, &in, &out);
2081                 IOleCommandTarget_Release(cmdtrg);
2082                 if(SUCCEEDED(hres))
2083                     VariantClear(&out);
2084                 SysFreeString(url_str);
2085             }
2086         }
2087     }
2088
2089     if(!(flags & BINDING_NOFRAG) && window->uri_nofrag && !post_data_size) {
2090         BOOL eq;
2091
2092         hres = IUri_IsEqual(uri_nofrag, window->uri_nofrag, &eq);
2093         if(SUCCEEDED(hres) && eq) {
2094             IUri_Release(uri_nofrag);
2095             TRACE("fragment navigate\n");
2096             return navigate_fragment(window, uri);
2097         }
2098     }
2099
2100     hres = CreateURLMonikerEx2(NULL, uri_nofrag, &mon, URL_MK_UNIFORM);
2101     IUri_Release(uri_nofrag);
2102     if(FAILED(hres))
2103         return hres;
2104
2105     /* FIXME: Why not set_ready_state? */
2106     window->readystate = READYSTATE_UNINITIALIZED;
2107
2108     hres = create_channelbsc(mon, headers, post_data, post_data_size, TRUE, &bsc);
2109     if(FAILED(hres)) {
2110         IMoniker_Release(mon);
2111         return hres;
2112     }
2113
2114     prepare_for_binding(&window->doc_obj->basedoc, mon, flags);
2115
2116     hres = IUri_GetScheme(uri, &scheme);
2117     if(SUCCEEDED(hres) && scheme == URL_SCHEME_JAVASCRIPT) {
2118         navigate_javascript_task_t *task;
2119
2120         IBindStatusCallback_Release(&bsc->bsc.IBindStatusCallback_iface);
2121         IMoniker_Release(mon);
2122
2123         task = heap_alloc(sizeof(*task));
2124         if(!task)
2125             return E_OUTOFMEMORY;
2126
2127         /* Why silently? */
2128         window->readystate = READYSTATE_COMPLETE;
2129         if(!(flags & BINDING_FROMHIST))
2130             call_docview_84(window->doc_obj);
2131
2132         IUri_AddRef(uri);
2133         task->window = window;
2134         task->uri = uri;
2135         hres = push_task(&task->header, navigate_javascript_proc, navigate_javascript_task_destr, window->task_magic);
2136     }else if(flags & BINDING_SUBMIT) {
2137         hres = set_moniker(window, mon, uri, NULL, bsc, TRUE);
2138         if(SUCCEEDED(hres))
2139             hres = start_binding(window->pending_window, &bsc->bsc, NULL);
2140         IBindStatusCallback_Release(&bsc->bsc.IBindStatusCallback_iface);
2141         IMoniker_Release(mon);
2142     }else {
2143         navigate_task_t *task;
2144
2145         task = heap_alloc(sizeof(*task));
2146         if(!task) {
2147             IBindStatusCallback_Release(&bsc->bsc.IBindStatusCallback_iface);
2148             IMoniker_Release(mon);
2149             return E_OUTOFMEMORY;
2150         }
2151
2152         /* Silently and repeated when real loading starts? */
2153         window->readystate = READYSTATE_LOADING;
2154         if(!(flags & (BINDING_FROMHIST|BINDING_REFRESH)))
2155             call_docview_84(window->doc_obj);
2156
2157         task->window = window;
2158         task->bscallback = bsc;
2159         task->flags = flags;
2160         task->mon = mon;
2161
2162         IUri_AddRef(uri);
2163         task->uri = uri;
2164         hres = push_task(&task->header, navigate_proc, navigate_task_destr, window->task_magic);
2165     }
2166
2167     return hres;
2168 }
2169
2170 HRESULT navigate_new_window(HTMLOuterWindow *window, IUri *uri, const WCHAR *name, request_data_t *request_data, IHTMLWindow2 **ret)
2171 {
2172     IWebBrowser2 *web_browser;
2173     IHTMLWindow2 *new_window;
2174     IBindCtx *bind_ctx;
2175     nsChannelBSC *bsc;
2176     HRESULT hres;
2177
2178     if(request_data)
2179         hres = create_channelbsc(NULL, request_data->headers,
2180                 request_data->post_data, request_data->post_data_len, FALSE,
2181                 &bsc);
2182     else
2183         hres = create_channelbsc(NULL, NULL, NULL, 0, FALSE, &bsc);
2184     if(FAILED(hres))
2185         return hres;
2186
2187     hres = CreateAsyncBindCtx(0, &bsc->bsc.IBindStatusCallback_iface, NULL, &bind_ctx);
2188     if(FAILED(hres)) {
2189         IBindStatusCallback_Release(&bsc->bsc.IBindStatusCallback_iface);
2190         return hres;
2191     }
2192
2193     hres = CoCreateInstance(&CLSID_InternetExplorer, NULL, CLSCTX_LOCAL_SERVER,
2194             &IID_IWebBrowser2, (void**)&web_browser);
2195     if(SUCCEEDED(hres)) {
2196         ITargetFramePriv2 *target_frame_priv;
2197
2198         hres = IWebBrowser2_QueryInterface(web_browser, &IID_ITargetFramePriv2, (void**)&target_frame_priv);
2199         if(SUCCEEDED(hres)) {
2200             hres = ITargetFramePriv2_AggregatedNavigation2(target_frame_priv,
2201                     HLNF_DISABLEWINDOWRESTRICTIONS|HLNF_OPENINNEWWINDOW, bind_ctx, &bsc->bsc.IBindStatusCallback_iface,
2202                     name, uri, emptyW);
2203             ITargetFramePriv2_Release(target_frame_priv);
2204
2205             if(SUCCEEDED(hres))
2206                 hres = do_query_service((IUnknown*)web_browser, &SID_SHTMLWindow, &IID_IHTMLWindow2, (void**)&new_window);
2207         }
2208         if(FAILED(hres)) {
2209             IWebBrowser2_Quit(web_browser);
2210             IWebBrowser2_Release(web_browser);
2211         }
2212     }else {
2213         WARN("Could not create InternetExplorer instance: %08x\n", hres);
2214     }
2215
2216     IBindStatusCallback_Release(&bsc->bsc.IBindStatusCallback_iface);
2217     IBindCtx_Release(bind_ctx);
2218     if(FAILED(hres))
2219         return hres;
2220
2221     IWebBrowser2_put_Visible(web_browser, VARIANT_TRUE);
2222     IWebBrowser2_Release(web_browser);
2223
2224     if(ret)
2225         *ret = new_window;
2226     else
2227         IHTMLWindow2_Release(new_window);
2228     return S_OK;
2229 }
2230
2231 HRESULT hlink_frame_navigate(HTMLDocument *doc, LPCWSTR url, nsChannel *nschannel, DWORD hlnf, BOOL *cancel)
2232 {
2233     IHlinkFrame *hlink_frame;
2234     nsChannelBSC *callback;
2235     IBindCtx *bindctx;
2236     IMoniker *mon;
2237     IHlink *hlink;
2238     HRESULT hres;
2239
2240     *cancel = FALSE;
2241
2242     hres = do_query_service((IUnknown*)doc->doc_obj->client, &IID_IHlinkFrame, &IID_IHlinkFrame,
2243             (void**)&hlink_frame);
2244     if(FAILED(hres))
2245         return S_OK;
2246
2247     hres = create_channelbsc(NULL, NULL, NULL, 0, FALSE, &callback);
2248     if(FAILED(hres)) {
2249         IHlinkFrame_Release(hlink_frame);
2250         return hres;
2251     }
2252
2253     if(nschannel)
2254         read_post_data_stream(nschannel->post_data_stream, nschannel->post_data_contains_headers,
2255                 &nschannel->request_headers, &callback->bsc.request_data);
2256
2257     hres = CreateAsyncBindCtx(0, &callback->bsc.IBindStatusCallback_iface, NULL, &bindctx);
2258     if(SUCCEEDED(hres))
2259        hres = CoCreateInstance(&CLSID_StdHlink, NULL, CLSCTX_INPROC_SERVER,
2260                 &IID_IHlink, (LPVOID*)&hlink);
2261
2262     if(SUCCEEDED(hres))
2263         hres = CreateURLMoniker(NULL, url, &mon);
2264
2265     if(SUCCEEDED(hres)) {
2266         IHlink_SetMonikerReference(hlink, HLINKSETF_TARGET, mon, NULL);
2267
2268         if(hlnf & HLNF_OPENINNEWWINDOW) {
2269             static const WCHAR wszBlank[] = {'_','b','l','a','n','k',0};
2270             IHlink_SetTargetFrameName(hlink, wszBlank); /* FIXME */
2271         }
2272
2273         hres = IHlinkFrame_Navigate(hlink_frame, hlnf, bindctx,
2274                 &callback->bsc.IBindStatusCallback_iface, hlink);
2275         IMoniker_Release(mon);
2276         *cancel = hres == S_OK;
2277         hres = S_OK;
2278     }
2279
2280     IHlinkFrame_Release(hlink_frame);
2281     IBindCtx_Release(bindctx);
2282     IBindStatusCallback_Release(&callback->bsc.IBindStatusCallback_iface);
2283     return hres;
2284 }
2285
2286 static HRESULT navigate_uri(HTMLOuterWindow *window, IUri *uri, const WCHAR *display_uri, const request_data_t *request_data,
2287         DWORD flags)
2288 {
2289     nsWineURI *nsuri;
2290     HRESULT hres;
2291
2292     TRACE("%s\n", debugstr_w(display_uri));
2293
2294     if(window->doc_obj && window->doc_obj->webbrowser) {
2295         DWORD post_data_len = request_data ? request_data->post_data_len : 0;
2296         void *post_data = post_data_len ? request_data->post_data : NULL;
2297         const WCHAR *headers = request_data ? request_data->headers : NULL;
2298
2299         if(!(flags & BINDING_REFRESH)) {
2300             BSTR frame_name = NULL;
2301             BOOL cancel = FALSE;
2302
2303             if(window != window->doc_obj->basedoc.window) {
2304                 hres = IHTMLWindow2_get_name(&window->base.IHTMLWindow2_iface, &frame_name);
2305                 if(FAILED(hres))
2306                     return hres;
2307             }
2308
2309             hres = IDocObjectService_FireBeforeNavigate2(window->doc_obj->doc_object_service, NULL, display_uri, 0x40,
2310                     frame_name, post_data, post_data_len ? post_data_len+1 : 0, headers, TRUE, &cancel);
2311             SysFreeString(frame_name);
2312             if(SUCCEEDED(hres) && cancel) {
2313                 TRACE("Navigation canceled\n");
2314                 return S_OK;
2315             }
2316         }
2317
2318         if(window == window->doc_obj->basedoc.window)
2319             return super_navigate(window, uri, flags, headers, post_data, post_data_len);
2320     }
2321
2322     if(window->doc_obj && window == window->doc_obj->basedoc.window) {
2323         BOOL cancel;
2324
2325         hres = hlink_frame_navigate(&window->base.inner_window->doc->basedoc, display_uri, NULL, 0, &cancel);
2326         if(FAILED(hres))
2327             return hres;
2328
2329         if(cancel) {
2330             TRACE("Navigation handled by hlink frame\n");
2331             return S_OK;
2332         }
2333     }
2334
2335     hres = create_doc_uri(window, uri, &nsuri);
2336     if(FAILED(hres))
2337         return hres;
2338
2339     hres = load_nsuri(window, nsuri, request_data ? request_data->post_stream : NULL, NULL, LOAD_FLAGS_NONE);
2340     nsISupports_Release((nsISupports*)nsuri);
2341     return hres;
2342 }
2343
2344 HRESULT load_uri(HTMLOuterWindow *window, IUri *uri, DWORD flags)
2345 {
2346     BSTR display_uri;
2347     HRESULT hres;
2348
2349     hres = IUri_GetDisplayUri(uri, &display_uri);
2350     if(FAILED(hres))
2351         return hres;
2352
2353     hres = navigate_uri(window, uri, display_uri, NULL, flags);
2354     SysFreeString(display_uri);
2355     return hres;
2356 }
2357
2358 static HRESULT translate_uri(HTMLOuterWindow *window, IUri *orig_uri, BSTR *ret_display_uri, IUri **ret_uri)
2359 {
2360     IUri *uri = NULL;
2361     BSTR display_uri;
2362     HRESULT hres;
2363
2364     hres = IUri_GetDisplayUri(orig_uri, &display_uri);
2365     if(FAILED(hres))
2366         return hres;
2367
2368     if(window->doc_obj && window->doc_obj->hostui) {
2369         OLECHAR *translated_url = NULL;
2370
2371         hres = IDocHostUIHandler_TranslateUrl(window->doc_obj->hostui, 0, display_uri,
2372                 &translated_url);
2373         if(hres == S_OK && translated_url) {
2374             TRACE("%08x %s -> %s\n", hres, debugstr_w(display_uri), debugstr_w(translated_url));
2375             SysFreeString(display_uri);
2376             hres = create_uri(translated_url, 0, &uri);
2377             CoTaskMemFree(translated_url);
2378             if(FAILED(hres))
2379                 return hres;
2380
2381             hres = IUri_GetDisplayUri(uri, &display_uri);
2382             if(FAILED(hres)) {
2383                 IUri_Release(uri);
2384                 return hres;
2385             }
2386         }
2387     }
2388
2389     if(!uri) {
2390         IUri_AddRef(orig_uri);
2391         uri = orig_uri;
2392     }
2393
2394     *ret_display_uri = display_uri;
2395     *ret_uri = uri;
2396     return S_OK;
2397 }
2398
2399 HRESULT submit_form(HTMLOuterWindow *window, const WCHAR *target, IUri *submit_uri, nsIInputStream *post_stream)
2400 {
2401     request_data_t request_data = {NULL};
2402     HRESULT hres;
2403
2404     hres = read_post_data_stream(post_stream, TRUE, NULL, &request_data);
2405     if(FAILED(hres))
2406         return hres;
2407
2408     if(window) {
2409         IUri *uri;
2410         BSTR display_uri;
2411
2412         window->readystate_locked++;
2413
2414         hres = translate_uri(window, submit_uri, &display_uri, &uri);
2415         if(SUCCEEDED(hres)) {
2416             hres = navigate_uri(window, uri, display_uri, &request_data, BINDING_NAVIGATED|BINDING_SUBMIT);
2417             IUri_Release(uri);
2418             SysFreeString(display_uri);
2419         }
2420
2421         window->readystate_locked--;
2422     }else
2423         hres = navigate_new_window(window, submit_uri, target, &request_data, NULL);
2424
2425     release_request_data(&request_data);
2426     return hres;
2427 }
2428
2429 HRESULT navigate_url(HTMLOuterWindow *window, const WCHAR *new_url, IUri *base_uri, DWORD flags)
2430 {
2431     IUri *uri, *nav_uri;
2432     BSTR display_uri;
2433     HRESULT hres;
2434
2435     if(new_url && base_uri)
2436         hres = CoInternetCombineUrlEx(base_uri, new_url, URL_ESCAPE_SPACES_ONLY|URL_DONT_ESCAPE_EXTRA_INFO,
2437                 &nav_uri, 0);
2438     else
2439         hres = create_uri(new_url, 0, &nav_uri);
2440     if(FAILED(hres))
2441         return hres;
2442
2443     hres = translate_uri(window, nav_uri, &display_uri, &uri);
2444     IUri_Release(nav_uri);
2445     if(FAILED(hres))
2446         return hres;
2447
2448     hres = navigate_uri(window, uri, display_uri, NULL, flags);
2449     IUri_Release(uri);
2450     SysFreeString(display_uri);
2451     return hres;
2452 }