dlls/mshtml/navigate.c

   1 /*
   2  * Copyright 2006-2010 Jacek Caban for CodeWeavers
   3  *
   4  * This library is free software; you can redistribute it and/or
   5  * modify it under the terms of the GNU Lesser General Public
   6  * License as published by the Free Software Foundation; either
   7  * version 2.1 of the License, or (at your option) any later version.
   8  *
   9  * This library is distributed in the hope that it will be useful,
  10  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  11  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  12  * Lesser General Public License for more details.
  13  *
  14  * You should have received a copy of the GNU Lesser General Public
  15  * License along with this library; if not, write to the Free Software
  16  * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
  17  */
  18
  19 #include "config.h"
  20
  21 #include <stdarg.h>
  22 #include <assert.h>
  23
  24 #define COBJMACROS
  25 #define NONAMELESSUNION
  26 #define NONAMELESSSTRUCT
  27
  28 #include "windef.h"
  29 #include "winbase.h"
  30 #include "winuser.h"
  31 #include "winreg.h"
  32 #include "ole2.h"
  33 #include "hlguids.h"
  34 #include "shlguid.h"
  35 #include "wininet.h"
  36 #include "shlwapi.h"
  37 #include "htiface.h"
  38 #include "shdeprecated.h"
  39
  40 #include "wine/debug.h"
  41
  42 #include "mshtml_private.h"
  43 #include "htmlscript.h"
  44 #include "binding.h"
  45
  46 WINE_DEFAULT_DEBUG_CHANNEL(mshtml);
  47
  48 #define CONTENT_LENGTH "Content-Length"
  49 #define UTF8_STR "utf-8"
  50 #define UTF16_STR "utf-16"
  51
  52 static const WCHAR emptyW[] = {0};
  53 static const WCHAR text_htmlW[] = {'t','e','x','t','/','h','t','m','l',0};
  54
  55 enum {
  56     BOM_NONE,
  57     BOM_UTF8,
  58     BOM_UTF16
  59 };
  60
  61 struct nsProtocolStream {
  62     nsIInputStream nsIInputStream_iface;
  63
  64     LONG ref;
  65
  66     char buf[1024];
  67     DWORD buf_size;
  68 };
  69
  70 struct BSCallbackVtbl {
  71     void (*destroy)(BSCallback*);
  72     HRESULT (*init_bindinfo)(BSCallback*);
  73     HRESULT (*start_binding)(BSCallback*);
  74     HRESULT (*stop_binding)(BSCallback*,HRESULT);
  75     HRESULT (*read_data)(BSCallback*,IStream*);
  76     HRESULT (*on_progress)(BSCallback*,ULONG,LPCWSTR);
  77     HRESULT (*on_response)(BSCallback*,DWORD,LPCWSTR);
  78     HRESULT (*beginning_transaction)(BSCallback*,WCHAR**);
  79 };
  80
  81 static inline nsProtocolStream *impl_from_nsIInputStream(nsIInputStream *iface)
  82 {
  83     return CONTAINING_RECORD(iface, nsProtocolStream, nsIInputStream_iface);
  84 }
  85
  86 static nsresult NSAPI nsInputStream_QueryInterface(nsIInputStream *iface, nsIIDRef riid,
  87         void **result)
  88 {
  89     nsProtocolStream *This = impl_from_nsIInputStream(iface);
  90
  91     *result = NULL;
  92
  93     if(IsEqualGUID(&IID_nsISupports, riid)) {
  94         TRACE("(%p)->(IID_nsISupports %p)\n", This, result);
  95         *result  = &This->nsIInputStream_iface;
  96     }else if(IsEqualGUID(&IID_nsIInputStream, riid)) {
  97         TRACE("(%p)->(IID_nsIInputStream %p)\n", This, result);
  98         *result  = &This->nsIInputStream_iface;
  99     }
 100
 101     if(*result) {
 102         nsIInputStream_AddRef(&This->nsIInputStream_iface);
 103         return NS_OK;
 104     }
 105
 106     WARN("unsupported interface %s\n", debugstr_guid(riid));
 107     return NS_NOINTERFACE;
 108 }
 109
 110 static nsrefcnt NSAPI nsInputStream_AddRef(nsIInputStream *iface)
 111 {
 112     nsProtocolStream *This = impl_from_nsIInputStream(iface);
 113     LONG ref = InterlockedIncrement(&This->ref);
 114
 115     TRACE("(%p) ref=%d\n", This, ref);
 116
 117     return ref;
 118 }
 119
 120
 121 static nsrefcnt NSAPI nsInputStream_Release(nsIInputStream *iface)
 122 {
 123     nsProtocolStream *This = impl_from_nsIInputStream(iface);
 124     LONG ref = InterlockedDecrement(&This->ref);
 125
 126     TRACE("(%p) ref=%d\n", This, ref);
 127
 128     if(!ref)
 129         heap_free(This);
 130
 131     return ref;
 132 }
 133
 134 static nsresult NSAPI nsInputStream_Close(nsIInputStream *iface)
 135 {
 136     nsProtocolStream *This = impl_from_nsIInputStream(iface);
 137     FIXME("(%p)\n", This);
 138     return NS_ERROR_NOT_IMPLEMENTED;
 139 }
 140
 141 static nsresult NSAPI nsInputStream_Available(nsIInputStream *iface, UINT64 *_retval)
 142 {
 143     nsProtocolStream *This = impl_from_nsIInputStream(iface);
 144     FIXME("(%p)->(%p)\n", This, _retval);
 145     return NS_ERROR_NOT_IMPLEMENTED;
 146 }
 147
 148 static nsresult NSAPI nsInputStream_Read(nsIInputStream *iface, char *aBuf, UINT32 aCount,
 149                                          UINT32 *_retval)
 150 {
 151     nsProtocolStream *This = impl_from_nsIInputStream(iface);
 152     DWORD read = aCount;
 153
 154     TRACE("(%p)->(%p %d %p)\n", This, aBuf, aCount, _retval);
 155
 156     if(read > This->buf_size)
 157         read = This->buf_size;
 158
 159     if(read) {
 160         memcpy(aBuf, This->buf, read);
 161         if(read < This->buf_size)
 162             memmove(This->buf, This->buf+read, This->buf_size-read);
 163         This->buf_size -= read;
 164     }
 165
 166     *_retval = read;
 167     return NS_OK;
 168 }
 169
 170 static nsresult NSAPI nsInputStream_ReadSegments(nsIInputStream *iface,
 171         nsresult (WINAPI *aWriter)(nsIInputStream*,void*,const char*,UINT32,UINT32,UINT32*),
 172         void *aClousure, UINT32 aCount, UINT32 *_retval)
 173 {
 174     nsProtocolStream *This = impl_from_nsIInputStream(iface);
 175     UINT32 written = 0;
 176     nsresult nsres;
 177
 178     TRACE("(%p)->(%p %p %d %p)\n", This, aWriter, aClousure, aCount, _retval);
 179
 180     if(!This->buf_size)
 181         return S_OK;
 182
 183     if(aCount > This->buf_size)
 184         aCount = This->buf_size;
 185
 186     nsres = aWriter(&This->nsIInputStream_iface, aClousure, This->buf, 0, aCount, &written);
 187     if(NS_FAILED(nsres))
 188         TRACE("aWriter failed: %08x\n", nsres);
 189     else if(written != This->buf_size)
 190         FIXME("written %d != buf_size %d\n", written, This->buf_size);
 191
 192     This->buf_size -= written;
 193
 194     *_retval = written;
 195     return nsres;
 196 }
 197
 198 static nsresult NSAPI nsInputStream_IsNonBlocking(nsIInputStream *iface, cpp_bool *_retval)
 199 {
 200     nsProtocolStream *This = impl_from_nsIInputStream(iface);
 201     FIXME("(%p)->(%p)\n", This, _retval);
 202     return NS_ERROR_NOT_IMPLEMENTED;
 203 }
 204
 205 static const nsIInputStreamVtbl nsInputStreamVtbl = {
 206     nsInputStream_QueryInterface,
 207     nsInputStream_AddRef,
 208     nsInputStream_Release,
 209     nsInputStream_Close,
 210     nsInputStream_Available,
 211     nsInputStream_Read,
 212     nsInputStream_ReadSegments,
 213     nsInputStream_IsNonBlocking
 214 };
 215
 216 static nsProtocolStream *create_nsprotocol_stream(void)
 217 {
 218     nsProtocolStream *ret;
 219
 220     ret = heap_alloc(sizeof(nsProtocolStream));
 221     if(!ret)
 222         return NULL;
 223
 224     ret->nsIInputStream_iface.lpVtbl = &nsInputStreamVtbl;
 225     ret->ref = 1;
 226     ret->buf_size = 0;
 227
 228     return ret;
 229 }
 230
 231 static void release_request_data(request_data_t *request_data)
 232 {
 233     heap_free(request_data->headers);
 234     if(request_data->post_data)
 235         GlobalFree(request_data->post_data);
 236 }
 237
 238 static inline BSCallback *impl_from_IBindStatusCallback(IBindStatusCallback *iface)
 239 {
 240     return CONTAINING_RECORD(iface, BSCallback, IBindStatusCallback_iface);
 241 }
 242
 243 static HRESULT WINAPI BindStatusCallback_QueryInterface(IBindStatusCallback *iface,
 244         REFIID riid, void **ppv)
 245 {
 246     BSCallback *This = impl_from_IBindStatusCallback(iface);
 247
 248     *ppv = NULL;
 249     if(IsEqualGUID(&IID_IUnknown, riid)) {
 250         TRACE("(%p)->(IID_IUnknown, %p)\n", This, ppv);
 251         *ppv = &This->IBindStatusCallback_iface;
 252     }else if(IsEqualGUID(&IID_IBindStatusCallback, riid)) {
 253         TRACE("(%p)->(IID_IBindStatusCallback, %p)\n", This, ppv);
 254         *ppv = &This->IBindStatusCallback_iface;
 255     }else if(IsEqualGUID(&IID_IServiceProvider, riid)) {
 256         TRACE("(%p)->(IID_IServiceProvider %p)\n", This, ppv);
 257         *ppv = &This->IServiceProvider_iface;
 258     }else if(IsEqualGUID(&IID_IHttpNegotiate, riid)) {
 259         TRACE("(%p)->(IID_IHttpNegotiate %p)\n", This, ppv);
 260         *ppv = &This->IHttpNegotiate2_iface;
 261     }else if(IsEqualGUID(&IID_IHttpNegotiate2, riid)) {
 262         TRACE("(%p)->(IID_IHttpNegotiate2 %p)\n", This, ppv);
 263         *ppv = &This->IHttpNegotiate2_iface;
 264     }else if(IsEqualGUID(&IID_IInternetBindInfo, riid)) {
 265         TRACE("(%p)->(IID_IInternetBindInfo %p)\n", This, ppv);
 266         *ppv = &This->IInternetBindInfo_iface;
 267     }
 268
 269     if(*ppv) {
 270         IBindStatusCallback_AddRef(&This->IBindStatusCallback_iface);
 271         return S_OK;
 272     }
 273
 274     TRACE("Unsupported riid = %s\n", debugstr_guid(riid));
 275     return E_NOINTERFACE;
 276 }
 277
 278 static ULONG WINAPI BindStatusCallback_AddRef(IBindStatusCallback *iface)
 279 {
 280     BSCallback *This = impl_from_IBindStatusCallback(iface);
 281     LONG ref = InterlockedIncrement(&This->ref);
 282
 283     TRACE("(%p) ref = %d\n", This, ref);
 284
 285     return ref;
 286 }
 287
 288 static ULONG WINAPI BindStatusCallback_Release(IBindStatusCallback *iface)
 289 {
 290     BSCallback *This = impl_from_IBindStatusCallback(iface);
 291     LONG ref = InterlockedDecrement(&This->ref);
 292
 293     TRACE("(%p) ref = %d\n", This, ref);
 294
 295     if(!ref) {
 296         release_request_data(&This->request_data);
 297         if(This->mon)
 298             IMoniker_Release(This->mon);
 299         if(This->binding)
 300             IBinding_Release(This->binding);
 301         list_remove(&This->entry);
 302         list_init(&This->entry);
 303
 304         This->vtbl->destroy(This);
 305     }
 306
 307     return ref;
 308 }
 309
 310 static HRESULT WINAPI BindStatusCallback_OnStartBinding(IBindStatusCallback *iface,
 311         DWORD dwReserved, IBinding *pbind)
 312 {
 313     BSCallback *This = impl_from_IBindStatusCallback(iface);
 314
 315     TRACE("(%p)->(%d %p)\n", This, dwReserved, pbind);
 316
 317     IBinding_AddRef(pbind);
 318     This->binding = pbind;
 319
 320     if(This->window)
 321         list_add_head(&This->window->bindings, &This->entry);
 322
 323     return This->vtbl->start_binding(This);
 324 }
 325
 326 static HRESULT WINAPI BindStatusCallback_GetPriority(IBindStatusCallback *iface, LONG *pnPriority)
 327 {
 328     BSCallback *This = impl_from_IBindStatusCallback(iface);
 329     FIXME("(%p)->(%p)\n", This, pnPriority);
 330     return E_NOTIMPL;
 331 }
 332
 333 static HRESULT WINAPI BindStatusCallback_OnLowResource(IBindStatusCallback *iface, DWORD reserved)
 334 {
 335     BSCallback *This = impl_from_IBindStatusCallback(iface);
 336     FIXME("(%p)->(%d)\n", This, reserved);
 337     return E_NOTIMPL;
 338 }
 339
 340 static HRESULT WINAPI BindStatusCallback_OnProgress(IBindStatusCallback *iface, ULONG ulProgress,
 341         ULONG ulProgressMax, ULONG ulStatusCode, LPCWSTR szStatusText)
 342 {
 343     BSCallback *This = impl_from_IBindStatusCallback(iface);
 344
 345     TRACE("%p)->(%u %u %u %s)\n", This, ulProgress, ulProgressMax, ulStatusCode,
 346             debugstr_w(szStatusText));
 347
 348     return This->vtbl->on_progress(This, ulStatusCode, szStatusText);
 349 }
 350
 351 static HRESULT WINAPI BindStatusCallback_OnStopBinding(IBindStatusCallback *iface,
 352         HRESULT hresult, LPCWSTR szError)
 353 {
 354     BSCallback *This = impl_from_IBindStatusCallback(iface);
 355     HRESULT hres;
 356
 357     TRACE("(%p)->(%08x %s)\n", This, hresult, debugstr_w(szError));
 358
 359     /* NOTE: IE7 calls GetBindResult here */
 360
 361     hres = This->vtbl->stop_binding(This, hresult);
 362
 363     if(This->binding) {
 364         IBinding_Release(This->binding);
 365         This->binding = NULL;
 366     }
 367
 368     if(This->mon) {
 369         IMoniker_Release(This->mon);
 370         This->mon = NULL;
 371     }
 372
 373     list_remove(&This->entry);
 374     list_init(&This->entry);
 375     This->window = NULL;
 376
 377     return hres;
 378 }
 379
 380 static HRESULT WINAPI BindStatusCallback_GetBindInfo(IBindStatusCallback *iface,
 381         DWORD *grfBINDF, BINDINFO *pbindinfo)
 382 {
 383     BSCallback *This = impl_from_IBindStatusCallback(iface);
 384     DWORD size;
 385
 386     TRACE("(%p)->(%p %p)\n", This, grfBINDF, pbindinfo);
 387
 388     if(!This->bindinfo_ready) {
 389         HRESULT hres;
 390
 391         hres = This->vtbl->init_bindinfo(This);
 392         if(FAILED(hres))
 393             return hres;
 394
 395         This->bindinfo_ready = TRUE;
 396     }
 397
 398     *grfBINDF = This->bindf;
 399
 400     size = pbindinfo->cbSize;
 401     memset(pbindinfo, 0, size);
 402     pbindinfo->cbSize = size;
 403
 404     pbindinfo->cbstgmedData = This->request_data.post_data_len;
 405     pbindinfo->dwCodePage = CP_UTF8;
 406     pbindinfo->dwOptions = 0x80000;
 407
 408     if(This->request_data.post_data_len) {
 409         pbindinfo->dwBindVerb = BINDVERB_POST;
 410
 411         pbindinfo->stgmedData.tymed = TYMED_HGLOBAL;
 412         pbindinfo->stgmedData.u.hGlobal = This->request_data.post_data;
 413         pbindinfo->stgmedData.pUnkForRelease = (IUnknown*)&This->IBindStatusCallback_iface;
 414         IBindStatusCallback_AddRef(&This->IBindStatusCallback_iface);
 415     }
 416
 417     return S_OK;
 418 }
 419
 420 static HRESULT WINAPI BindStatusCallback_OnDataAvailable(IBindStatusCallback *iface,
 421         DWORD grfBSCF, DWORD dwSize, FORMATETC *pformatetc, STGMEDIUM *pstgmed)
 422 {
 423     BSCallback *This = impl_from_IBindStatusCallback(iface);
 424
 425     TRACE("(%p)->(%08x %d %p %p)\n", This, grfBSCF, dwSize, pformatetc, pstgmed);
 426
 427     return This->vtbl->read_data(This, pstgmed->u.pstm);
 428 }
 429
 430 static HRESULT WINAPI BindStatusCallback_OnObjectAvailable(IBindStatusCallback *iface,
 431         REFIID riid, IUnknown *punk)
 432 {
 433     BSCallback *This = impl_from_IBindStatusCallback(iface);
 434     FIXME("(%p)->(%s %p)\n", This, debugstr_guid(riid), punk);
 435     return E_NOTIMPL;
 436 }
 437
 438 static const IBindStatusCallbackVtbl BindStatusCallbackVtbl = {
 439     BindStatusCallback_QueryInterface,
 440     BindStatusCallback_AddRef,
 441     BindStatusCallback_Release,
 442     BindStatusCallback_OnStartBinding,
 443     BindStatusCallback_GetPriority,
 444     BindStatusCallback_OnLowResource,
 445     BindStatusCallback_OnProgress,
 446     BindStatusCallback_OnStopBinding,
 447     BindStatusCallback_GetBindInfo,
 448     BindStatusCallback_OnDataAvailable,
 449     BindStatusCallback_OnObjectAvailable
 450 };
 451
 452 static inline BSCallback *impl_from_IHttpNegotiate2(IHttpNegotiate2 *iface)
 453 {
 454     return CONTAINING_RECORD(iface, BSCallback, IHttpNegotiate2_iface);
 455 }
 456
 457 static HRESULT WINAPI HttpNegotiate_QueryInterface(IHttpNegotiate2 *iface,
 458                                                    REFIID riid, void **ppv)
 459 {
 460     BSCallback *This = impl_from_IHttpNegotiate2(iface);
 461     return IBindStatusCallback_QueryInterface(&This->IBindStatusCallback_iface, riid, ppv);
 462 }
 463
 464 static ULONG WINAPI HttpNegotiate_AddRef(IHttpNegotiate2 *iface)
 465 {
 466     BSCallback *This = impl_from_IHttpNegotiate2(iface);
 467     return IBindStatusCallback_AddRef(&This->IBindStatusCallback_iface);
 468 }
 469
 470 static ULONG WINAPI HttpNegotiate_Release(IHttpNegotiate2 *iface)
 471 {
 472     BSCallback *This = impl_from_IHttpNegotiate2(iface);
 473     return IBindStatusCallback_Release(&This->IBindStatusCallback_iface);
 474 }
 475
 476 static HRESULT WINAPI HttpNegotiate_BeginningTransaction(IHttpNegotiate2 *iface,
 477         LPCWSTR szURL, LPCWSTR szHeaders, DWORD dwReserved, LPWSTR *pszAdditionalHeaders)
 478 {
 479     BSCallback *This = impl_from_IHttpNegotiate2(iface);
 480     HRESULT hres;
 481
 482     TRACE("(%p)->(%s %s %d %p)\n", This, debugstr_w(szURL), debugstr_w(szHeaders),
 483           dwReserved, pszAdditionalHeaders);
 484
 485     *pszAdditionalHeaders = NULL;
 486
 487     hres = This->vtbl->beginning_transaction(This, pszAdditionalHeaders);
 488     if(hres != S_FALSE)
 489         return hres;
 490
 491     if(This->request_data.headers) {
 492         DWORD size;
 493
 494         size = (strlenW(This->request_data.headers)+1)*sizeof(WCHAR);
 495         *pszAdditionalHeaders = CoTaskMemAlloc(size);
 496         if(!*pszAdditionalHeaders)
 497             return E_OUTOFMEMORY;
 498         memcpy(*pszAdditionalHeaders, This->request_data.headers, size);
 499     }
 500
 501     return S_OK;
 502 }
 503
 504 static HRESULT WINAPI HttpNegotiate_OnResponse(IHttpNegotiate2 *iface, DWORD dwResponseCode,
 505         LPCWSTR szResponseHeaders, LPCWSTR szRequestHeaders, LPWSTR *pszAdditionalRequestHeaders)
 506 {
 507     BSCallback *This = impl_from_IHttpNegotiate2(iface);
 508
 509     TRACE("(%p)->(%d %s %s %p)\n", This, dwResponseCode, debugstr_w(szResponseHeaders),
 510           debugstr_w(szRequestHeaders), pszAdditionalRequestHeaders);
 511
 512     return This->vtbl->on_response(This, dwResponseCode, szResponseHeaders);
 513 }
 514
 515 static HRESULT WINAPI HttpNegotiate_GetRootSecurityId(IHttpNegotiate2 *iface,
 516         BYTE *pbSecurityId, DWORD *pcbSecurityId, DWORD_PTR dwReserved)
 517 {
 518     BSCallback *This = impl_from_IHttpNegotiate2(iface);
 519     FIXME("(%p)->(%p %p %ld)\n", This, pbSecurityId, pcbSecurityId, dwReserved);
 520     return E_NOTIMPL;
 521 }
 522
 523 static const IHttpNegotiate2Vtbl HttpNegotiate2Vtbl = {
 524     HttpNegotiate_QueryInterface,
 525     HttpNegotiate_AddRef,
 526     HttpNegotiate_Release,
 527     HttpNegotiate_BeginningTransaction,
 528     HttpNegotiate_OnResponse,
 529     HttpNegotiate_GetRootSecurityId
 530 };
 531
 532 static inline BSCallback *impl_from_IInternetBindInfo(IInternetBindInfo *iface)
 533 {
 534     return CONTAINING_RECORD(iface, BSCallback, IInternetBindInfo_iface);
 535 }
 536
 537 static HRESULT WINAPI InternetBindInfo_QueryInterface(IInternetBindInfo *iface,
 538                                                       REFIID riid, void **ppv)
 539 {
 540     BSCallback *This = impl_from_IInternetBindInfo(iface);
 541     return IBindStatusCallback_QueryInterface(&This->IBindStatusCallback_iface, riid, ppv);
 542 }
 543
 544 static ULONG WINAPI InternetBindInfo_AddRef(IInternetBindInfo *iface)
 545 {
 546     BSCallback *This = impl_from_IInternetBindInfo(iface);
 547     return IBindStatusCallback_AddRef(&This->IBindStatusCallback_iface);
 548 }
 549
 550 static ULONG WINAPI InternetBindInfo_Release(IInternetBindInfo *iface)
 551 {
 552     BSCallback *This = impl_from_IInternetBindInfo(iface);
 553     return IBindStatusCallback_Release(&This->IBindStatusCallback_iface);
 554 }
 555
 556 static HRESULT WINAPI InternetBindInfo_GetBindInfo(IInternetBindInfo *iface,
 557                                                    DWORD *grfBINDF, BINDINFO *pbindinfo)
 558 {
 559     BSCallback *This = impl_from_IInternetBindInfo(iface);
 560     FIXME("(%p)->(%p %p)\n", This, grfBINDF, pbindinfo);
 561     return E_NOTIMPL;
 562 }
 563
 564 static HRESULT WINAPI InternetBindInfo_GetBindString(IInternetBindInfo *iface,
 565         ULONG ulStringType, LPOLESTR *ppwzStr, ULONG cEl, ULONG *pcElFetched)
 566 {
 567     BSCallback *This = impl_from_IInternetBindInfo(iface);
 568     FIXME("(%p)->(%u %p %u %p)\n", This, ulStringType, ppwzStr, cEl, pcElFetched);
 569     return E_NOTIMPL;
 570 }
 571
 572 static const IInternetBindInfoVtbl InternetBindInfoVtbl = {
 573     InternetBindInfo_QueryInterface,
 574     InternetBindInfo_AddRef,
 575     InternetBindInfo_Release,
 576     InternetBindInfo_GetBindInfo,
 577     InternetBindInfo_GetBindString
 578 };
 579
 580 static inline BSCallback *impl_from_IServiceProvider(IServiceProvider *iface)
 581 {
 582     return CONTAINING_RECORD(iface, BSCallback, IServiceProvider_iface);
 583 }
 584
 585 static HRESULT WINAPI BSCServiceProvider_QueryInterface(IServiceProvider *iface,
 586                                                         REFIID riid, void **ppv)
 587 {
 588     BSCallback *This = impl_from_IServiceProvider(iface);
 589     return IBindStatusCallback_QueryInterface(&This->IBindStatusCallback_iface, riid, ppv);
 590 }
 591
 592 static ULONG WINAPI BSCServiceProvider_AddRef(IServiceProvider *iface)
 593 {
 594     BSCallback *This = impl_from_IServiceProvider(iface);
 595     return IBindStatusCallback_AddRef(&This->IBindStatusCallback_iface);
 596 }
 597
 598 static ULONG WINAPI BSCServiceProvider_Release(IServiceProvider *iface)
 599 {
 600     BSCallback *This = impl_from_IServiceProvider(iface);
 601     return IBindStatusCallback_Release(&This->IBindStatusCallback_iface);
 602 }
 603
 604 static HRESULT WINAPI BSCServiceProvider_QueryService(IServiceProvider *iface,
 605         REFGUID guidService, REFIID riid, void **ppv)
 606 {
 607     BSCallback *This = impl_from_IServiceProvider(iface);
 608
 609     TRACE("(%p)->(%s %s %p)\n", This, debugstr_guid(guidService), debugstr_guid(riid), ppv);
 610
 611     if(This->window && IsEqualGUID(guidService, &IID_IWindowForBindingUI))
 612         return IServiceProvider_QueryService(&This->window->base.IServiceProvider_iface, guidService, riid, ppv);
 613     return E_NOINTERFACE;
 614 }
 615
 616 static const IServiceProviderVtbl ServiceProviderVtbl = {
 617     BSCServiceProvider_QueryInterface,
 618     BSCServiceProvider_AddRef,
 619     BSCServiceProvider_Release,
 620     BSCServiceProvider_QueryService
 621 };
 622
 623 static void init_bscallback(BSCallback *This, const BSCallbackVtbl *vtbl, IMoniker *mon, DWORD bindf)
 624 {
 625     This->IBindStatusCallback_iface.lpVtbl = &BindStatusCallbackVtbl;
 626     This->IServiceProvider_iface.lpVtbl = &ServiceProviderVtbl;
 627     This->IHttpNegotiate2_iface.lpVtbl = &HttpNegotiate2Vtbl;
 628     This->IInternetBindInfo_iface.lpVtbl = &InternetBindInfoVtbl;
 629     This->vtbl = vtbl;
 630     This->ref = 1;
 631     This->bindf = bindf;
 632     This->bom = BOM_NONE;
 633
 634     list_init(&This->entry);
 635
 636     if(mon)
 637         IMoniker_AddRef(mon);
 638     This->mon = mon;
 639 }
 640
 641 static HRESULT read_stream(BSCallback *This, IStream *stream, void *buf, DWORD size, DWORD *ret_size)
 642 {
 643     DWORD read_size = 0, skip=0;
 644     BYTE *data = buf;
 645     HRESULT hres;
 646
 647     hres = IStream_Read(stream, buf, size, &read_size);
 648
 649     if(!This->readed && This->bom == BOM_NONE) {
 650         if(read_size >= 2 && data[0] == 0xff && data[1] == 0xfe) {
 651             This->bom = BOM_UTF16;
 652             skip = 2;
 653         }else if(read_size >= 3 && data[0] == 0xef && data[1] == 0xbb && data[2] == 0xbf) {
 654             This->bom = BOM_UTF8;
 655             skip = 3;
 656         }
 657         if(skip) {
 658             read_size -= skip;
 659             if(read_size)
 660                 memmove(data, data+skip, read_size);
 661         }
 662     }
 663
 664     This->readed += read_size;
 665     *ret_size = read_size;
 666     return hres;
 667 }
 668
 669 static void parse_content_type(nsChannelBSC *This, const WCHAR *value)
 670 {
 671     const WCHAR *ptr;
 672     size_t len;
 673
 674     static const WCHAR charsetW[] = {'c','h','a','r','s','e','t','='};
 675
 676     ptr = strchrW(value, ';');
 677     if(!ptr)
 678         return;
 679
 680     ptr++;
 681     while(*ptr && isspaceW(*ptr))
 682         ptr++;
 683
 684     len = strlenW(value);
 685     if(ptr + sizeof(charsetW)/sizeof(WCHAR) < value+len && !memicmpW(ptr, charsetW, sizeof(charsetW)/sizeof(WCHAR))) {
 686         size_t charset_len, lena;
 687         nsACString charset_str;
 688         const WCHAR *charset;
 689         char *charseta;
 690
 691         ptr += sizeof(charsetW)/sizeof(WCHAR);
 692
 693         if(*ptr == '\'') {
 694             FIXME("Quoted value\n");
 695             return;
 696         }else {
 697             charset = ptr;
 698             while(*ptr && *ptr != ',')
 699                 ptr++;
 700             charset_len = ptr-charset;
 701         }
 702
 703         lena = WideCharToMultiByte(CP_ACP, 0, charset, charset_len, NULL, 0, NULL, NULL);
 704         charseta = heap_alloc(lena+1);
 705         if(!charseta)
 706             return;
 707
 708         WideCharToMultiByte(CP_ACP, 0, charset, charset_len, charseta, lena, NULL, NULL);
 709         charseta[lena] = 0;
 710
 711         nsACString_InitDepend(&charset_str, charseta);
 712         nsIHttpChannel_SetContentCharset(&This->nschannel->nsIHttpChannel_iface, &charset_str);
 713         nsACString_Finish(&charset_str);
 714         heap_free(charseta);
 715     }else {
 716         FIXME("unhandled: %s\n", debugstr_wn(ptr, len - (ptr-value)));
 717     }
 718 }
 719
 720 static HRESULT parse_headers(const WCHAR *headers, struct list *headers_list)
 721 {
 722     const WCHAR *header, *header_end, *colon, *value;
 723     HRESULT hres;
 724
 725     header = headers;
 726     while(*header) {
 727         if(header[0] == '\r' && header[1] == '\n' && !header[2])
 728             break;
 729         for(colon = header; *colon && *colon != ':' && *colon != '\r'; colon++);
 730         if(*colon != ':')
 731             return E_FAIL;
 732
 733         value = colon+1;
 734         while(*value == ' ')
 735             value++;
 736         if(!*value)
 737             return E_FAIL;
 738
 739         for(header_end = value+1; *header_end && *header_end != '\r'; header_end++);
 740
 741         hres = set_http_header(headers_list, header, colon-header, value, header_end-value);
 742         if(FAILED(hres))
 743             return hres;
 744
 745         header = header_end;
 746         if(header[0] == '\r' && header[1] == '\n')
 747             header += 2;
 748     }
 749
 750     return S_OK;
 751 }
 752
 753 static HRESULT process_response_headers(nsChannelBSC *This, const WCHAR *headers)
 754 {
 755     http_header_t *iter;
 756     HRESULT hres;
 757
 758     static const WCHAR content_typeW[] = {'c','o','n','t','e','n','t','-','t','y','p','e',0};
 759
 760     hres = parse_headers(headers, &This->nschannel->response_headers);
 761     if(FAILED(hres))
 762         return hres;
 763
 764     LIST_FOR_EACH_ENTRY(iter, &This->nschannel->response_headers, http_header_t, entry) {
 765         if(!strcmpiW(iter->header, content_typeW))
 766             parse_content_type(This, iter->data);
 767     }
 768
 769     return S_OK;
 770 }
 771
 772 static void query_http_info(nsChannelBSC *This, IWinInetHttpInfo *wininet_info)
 773 {
 774     const WCHAR *ptr;
 775     DWORD len = 0;
 776     WCHAR *buf;
 777
 778     IWinInetHttpInfo_QueryInfo(wininet_info, HTTP_QUERY_RAW_HEADERS_CRLF, NULL, &len, NULL, NULL);
 779     if(!len)
 780         return;
 781
 782     buf = heap_alloc(len);
 783     if(!buf)
 784         return;
 785
 786     IWinInetHttpInfo_QueryInfo(wininet_info, HTTP_QUERY_RAW_HEADERS_CRLF, buf, &len, NULL, NULL);
 787     if(!len) {
 788         heap_free(buf);
 789         return;
 790     }
 791
 792     ptr = strchrW(buf, '\r');
 793     if(ptr && ptr[1] == '\n') {
 794         ptr += 2;
 795         process_response_headers(This, ptr);
 796     }
 797
 798     heap_free(buf);
 799 }
 800
 801 HRESULT start_binding(HTMLInnerWindow *inner_window, BSCallback *bscallback, IBindCtx *bctx)
 802 {
 803     IStream *str = NULL;
 804     HRESULT hres;
 805
 806     TRACE("(%p %p %p)\n", inner_window, bscallback, bctx);
 807
 808     bscallback->window = inner_window;
 809
 810     /* NOTE: IE7 calls IsSystemMoniker here*/
 811
 812     if(bctx) {
 813         hres = RegisterBindStatusCallback(bctx, &bscallback->IBindStatusCallback_iface, NULL, 0);
 814         if(SUCCEEDED(hres))
 815             IBindCtx_AddRef(bctx);
 816     }else {
 817         hres = CreateAsyncBindCtx(0, &bscallback->IBindStatusCallback_iface, NULL, &bctx);
 818     }
 819
 820     if(FAILED(hres)) {
 821         bscallback->vtbl->stop_binding(bscallback, hres);
 822         return hres;
 823     }
 824
 825     hres = IMoniker_BindToStorage(bscallback->mon, bctx, NULL, &IID_IStream, (void**)&str);
 826     IBindCtx_Release(bctx);
 827     if(FAILED(hres)) {
 828         WARN("BindToStorage failed: %08x\n", hres);
 829         bscallback->vtbl->stop_binding(bscallback, hres);
 830         return hres;
 831     }
 832
 833     if(str)
 834         IStream_Release(str);
 835
 836     return S_OK;
 837 }
 838
 839 typedef struct {
 840     BSCallback bsc;
 841
 842     DWORD size;
 843     char *buf;
 844     HRESULT hres;
 845 } BufferBSC;
 846
 847 static inline BufferBSC *BufferBSC_from_BSCallback(BSCallback *iface)
 848 {
 849     return CONTAINING_RECORD(iface, BufferBSC, bsc);
 850 }
 851
 852 static void BufferBSC_destroy(BSCallback *bsc)
 853 {
 854     BufferBSC *This = BufferBSC_from_BSCallback(bsc);
 855
 856     heap_free(This->buf);
 857     heap_free(This);
 858 }
 859
 860 static HRESULT BufferBSC_init_bindinfo(BSCallback *bsc)
 861 {
 862     return S_OK;
 863 }
 864
 865 static HRESULT BufferBSC_start_binding(BSCallback *bsc)
 866 {
 867     return S_OK;
 868 }
 869
 870 static HRESULT BufferBSC_stop_binding(BSCallback *bsc, HRESULT result)
 871 {
 872     BufferBSC *This = BufferBSC_from_BSCallback(bsc);
 873
 874     This->hres = result;
 875
 876     if(FAILED(result)) {
 877         heap_free(This->buf);
 878         This->buf = NULL;
 879         This->size = 0;
 880     }
 881
 882     return S_OK;
 883 }
 884
 885 static HRESULT BufferBSC_read_data(BSCallback *bsc, IStream *stream)
 886 {
 887     BufferBSC *This = BufferBSC_from_BSCallback(bsc);
 888     DWORD readed;
 889     HRESULT hres;
 890
 891     if(!This->buf) {
 892         This->buf = heap_alloc(128);
 893         if(!This->buf)
 894             return E_OUTOFMEMORY;
 895         This->size = 128;
 896     }
 897
 898     do {
 899         if(This->bsc.readed >= This->size) {
 900             This->size <<= 1;
 901             This->buf = heap_realloc(This->buf, This->size);
 902         }
 903
 904         hres = read_stream(&This->bsc, stream, This->buf+This->bsc.readed, This->size-This->bsc.readed, &readed);
 905     }while(hres == S_OK);
 906
 907     return S_OK;
 908 }
 909
 910 static HRESULT BufferBSC_on_progress(BSCallback *bsc, ULONG status_code, LPCWSTR status_text)
 911 {
 912     return S_OK;
 913 }
 914
 915 static HRESULT BufferBSC_on_response(BSCallback *bsc, DWORD response_code,
 916         LPCWSTR response_headers)
 917 {
 918     return S_OK;
 919 }
 920
 921 static HRESULT BufferBSC_beginning_transaction(BSCallback *bsc, WCHAR **additional_headers)
 922 {
 923     return S_FALSE;
 924 }
 925
 926 static const BSCallbackVtbl BufferBSCVtbl = {
 927     BufferBSC_destroy,
 928     BufferBSC_init_bindinfo,
 929     BufferBSC_start_binding,
 930     BufferBSC_stop_binding,
 931     BufferBSC_read_data,
 932     BufferBSC_on_progress,
 933     BufferBSC_on_response,
 934     BufferBSC_beginning_transaction
 935 };
 936
 937
 938 HRESULT bind_mon_to_wstr(HTMLInnerWindow *window, IMoniker *mon, WCHAR **ret)
 939 {
 940     BufferBSC *bsc;
 941     WCHAR *text;
 942     HRESULT hres;
 943
 944     bsc = heap_alloc_zero(sizeof(*bsc));
 945     if(!bsc)
 946         return E_OUTOFMEMORY;
 947
 948     init_bscallback(&bsc->bsc, &BufferBSCVtbl, mon, 0);
 949     bsc->hres = E_FAIL;
 950
 951     hres = start_binding(window, &bsc->bsc, NULL);
 952     if(SUCCEEDED(hres))
 953         hres = bsc->hres;
 954     if(FAILED(hres)) {
 955         IBindStatusCallback_Release(&bsc->bsc.IBindStatusCallback_iface);
 956         return hres;
 957     }
 958
 959     if(!bsc->bsc.readed) {
 960         *ret = NULL;
 961         return S_OK;
 962     }
 963
 964     switch(bsc->bsc.bom) {
 965     case BOM_UTF16:
 966         if(bsc->bsc.readed % sizeof(WCHAR)) {
 967             FIXME("The buffer is not a valid utf16 string\n");
 968             hres = E_FAIL;
 969             break;
 970         }
 971
 972         text = heap_alloc(bsc->bsc.readed+sizeof(WCHAR));
 973         if(!text) {
 974             hres = E_OUTOFMEMORY;
 975             break;
 976         }
 977
 978         memcpy(text, bsc->buf, bsc->bsc.readed);
 979         text[bsc->bsc.readed/sizeof(WCHAR)] = 0;
 980         break;
 981
 982     case BOM_UTF8:
 983     default: {
 984         DWORD len;
 985
 986         len = MultiByteToWideChar(CP_UTF8, 0, bsc->buf, bsc->bsc.readed, NULL, 0);
 987         text = heap_alloc((len+1)*sizeof(WCHAR));
 988         if(!text) {
 989             hres = E_OUTOFMEMORY;
 990             break;
 991         }
 992
 993         MultiByteToWideChar(CP_UTF8, 0, bsc->buf, bsc->bsc.readed, text, len);
 994         text[len] = 0;
 995     }
 996     }
 997
 998     IBindStatusCallback_Release(&bsc->bsc.IBindStatusCallback_iface);
 999     if(FAILED(hres))
1000         return hres;
1001
1002     *ret = text;
1003     return S_OK;
1004 }
1005
1006 static HRESULT read_post_data_stream(nsIInputStream *stream, BOOL contains_headers, struct list *headers_list,
1007         request_data_t *request_data)
1008 {
1009     UINT64 available = 0;
1010     UINT32 data_len = 0;
1011     char *data, *post_data;
1012     nsresult nsres;
1013     HRESULT hres = S_OK;
1014
1015     if(!stream)
1016         return S_OK;
1017
1018     nsres =  nsIInputStream_Available(stream, &available);
1019     if(NS_FAILED(nsres))
1020         return E_FAIL;
1021
1022     post_data = data = GlobalAlloc(0, available+1);
1023     if(!data)
1024         return E_OUTOFMEMORY;
1025
1026     nsres = nsIInputStream_Read(stream, data, available, &data_len);
1027     if(NS_FAILED(nsres)) {
1028         GlobalFree(data);
1029         return E_FAIL;
1030     }
1031
1032     if(contains_headers) {
1033         if(data_len >= 2 && data[0] == '\r' && data[1] == '\n') {
1034             post_data = data+2;
1035             data_len -= 2;
1036         }else {
1037             WCHAR *headers;
1038             DWORD size;
1039             char *ptr;
1040
1041             post_data += data_len;
1042             for(ptr = data; ptr+4 < data+data_len; ptr++) {
1043                 if(!memcmp(ptr, "\r\n\r\n", 4)) {
1044                     ptr += 2;
1045                     post_data = ptr+2;
1046                     break;
1047                 }
1048             }
1049
1050             data_len -= post_data-data;
1051
1052             size = MultiByteToWideChar(CP_ACP, 0, data, ptr-data, NULL, 0);
1053             headers = heap_alloc((size+1)*sizeof(WCHAR));
1054             if(headers) {
1055                 MultiByteToWideChar(CP_ACP, 0, data, ptr-data, headers, size);
1056                 headers[size] = 0;
1057                 if(headers_list)
1058                     hres = parse_headers(headers, headers_list);
1059                 if(SUCCEEDED(hres))
1060                     request_data->headers = headers;
1061                 else
1062                     heap_free(headers);
1063             }else {
1064                 hres = E_OUTOFMEMORY;
1065             }
1066         }
1067     }
1068
1069     if(FAILED(hres)) {
1070         GlobalFree(data);
1071         return hres;
1072     }
1073
1074     if(!data_len) {
1075         GlobalFree(data);
1076         post_data = NULL;
1077     }else if(post_data != data) {
1078         char *new_data;
1079
1080         new_data = GlobalAlloc(0, data_len+1);
1081         if(new_data)
1082             memcpy(new_data, post_data, data_len);
1083         GlobalFree(data);
1084         if(!new_data)
1085             return E_OUTOFMEMORY;
1086         post_data = new_data;
1087     }
1088
1089     post_data[data_len] = 0;
1090     request_data->post_data = post_data;
1091     request_data->post_data_len = data_len;
1092     TRACE("post_data = %s\n", debugstr_an(request_data->post_data, request_data->post_data_len));
1093     return S_OK;
1094 }
1095
1096 static HRESULT on_start_nsrequest(nsChannelBSC *This)
1097 {
1098     nsresult nsres;
1099
1100     /* FIXME: it's needed for http connections from BindToObject. */
1101     if(!This->nschannel->response_status)
1102         This->nschannel->response_status = 200;
1103
1104     nsres = nsIStreamListener_OnStartRequest(This->nslistener,
1105             (nsIRequest*)&This->nschannel->nsIHttpChannel_iface, This->nscontext);
1106     if(NS_FAILED(nsres)) {
1107         FIXME("OnStartRequest failed: %08x\n", nsres);
1108         return E_FAIL;
1109     }
1110
1111     if(This->is_doc_channel) {
1112         update_window_doc(This->bsc.window);
1113         if(This->bsc.window->base.outer_window->readystate != READYSTATE_LOADING)
1114             set_ready_state(This->bsc.window->base.outer_window, READYSTATE_LOADING);
1115     }
1116
1117     return S_OK;
1118 }
1119
1120 static void on_stop_nsrequest(nsChannelBSC *This, HRESULT result)
1121 {
1122     nsresult nsres, request_result;
1123
1124     switch(result) {
1125     case S_OK:
1126         request_result = NS_OK;
1127         break;
1128     case E_ABORT:
1129         request_result = NS_BINDING_ABORTED;
1130         break;
1131     default:
1132         request_result = NS_ERROR_FAILURE;
1133     }
1134
1135     if(This->nslistener) {
1136         nsres = nsIStreamListener_OnStopRequest(This->nslistener,
1137                  (nsIRequest*)&This->nschannel->nsIHttpChannel_iface, This->nscontext,
1138                  request_result);
1139         if(NS_FAILED(nsres))
1140             WARN("OnStopRequest failed: %08x\n", nsres);
1141     }
1142
1143     if(This->nschannel && This->nschannel->load_group) {
1144         nsres = nsILoadGroup_RemoveRequest(This->nschannel->load_group,
1145                 (nsIRequest*)&This->nschannel->nsIHttpChannel_iface, NULL, request_result);
1146         if(NS_FAILED(nsres))
1147             ERR("RemoveRequest failed: %08x\n", nsres);
1148     }
1149 }
1150
1151 static HRESULT read_stream_data(nsChannelBSC *This, IStream *stream)
1152 {
1153     DWORD read;
1154     nsresult nsres;
1155     HRESULT hres;
1156
1157     if(!This->response_processed) {
1158         IWinInetHttpInfo *wininet_info;
1159
1160         This->response_processed = TRUE;
1161         if(This->bsc.binding) {
1162             hres = IBinding_QueryInterface(This->bsc.binding, &IID_IWinInetHttpInfo, (void**)&wininet_info);
1163             if(SUCCEEDED(hres)) {
1164                 query_http_info(This, wininet_info);
1165                 IWinInetHttpInfo_Release(wininet_info);
1166             }
1167         }
1168     }
1169
1170     if(!This->nschannel)
1171         return S_OK;
1172
1173     if(!This->nslistener) {
1174         BYTE buf[1024];
1175
1176         do {
1177             hres = read_stream(&This->bsc, stream, buf, sizeof(buf), &read);
1178         }while(hres == S_OK && read);
1179
1180         return S_OK;
1181     }
1182
1183     if(!This->nsstream) {
1184         This->nsstream = create_nsprotocol_stream();
1185         if(!This->nsstream)
1186             return E_OUTOFMEMORY;
1187     }
1188
1189     do {
1190         BOOL first_read = !This->bsc.readed;
1191
1192         hres = read_stream(&This->bsc, stream, This->nsstream->buf+This->nsstream->buf_size,
1193                 sizeof(This->nsstream->buf)-This->nsstream->buf_size, &read);
1194         if(!read)
1195             break;
1196
1197         This->nsstream->buf_size += read;
1198
1199         if(first_read) {
1200             switch(This->bsc.bom) {
1201             case BOM_UTF8:
1202                 This->nschannel->charset = heap_strdupA(UTF8_STR);
1203                 break;
1204             case BOM_UTF16:
1205                 This->nschannel->charset = heap_strdupA(UTF16_STR);
1206             }
1207
1208             if(!This->nschannel->content_type) {
1209                 WCHAR *mime;
1210
1211                 hres = FindMimeFromData(NULL, NULL, This->nsstream->buf, This->nsstream->buf_size,
1212                         This->is_doc_channel ? text_htmlW : NULL, 0, &mime, 0);
1213                 if(FAILED(hres))
1214                     return hres;
1215
1216                 TRACE("Found MIME %s\n", debugstr_w(mime));
1217
1218                 This->nschannel->content_type = heap_strdupWtoA(mime);
1219                 CoTaskMemFree(mime);
1220                 if(!This->nschannel->content_type)
1221                     return E_OUTOFMEMORY;
1222             }
1223
1224             on_start_nsrequest(This);
1225         }
1226
1227         nsres = nsIStreamListener_OnDataAvailable(This->nslistener,
1228                 (nsIRequest*)&This->nschannel->nsIHttpChannel_iface, This->nscontext,
1229                 &This->nsstream->nsIInputStream_iface, This->bsc.readed-This->nsstream->buf_size,
1230                 This->nsstream->buf_size);
1231         if(NS_FAILED(nsres))
1232             ERR("OnDataAvailable failed: %08x\n", nsres);
1233
1234         if(This->nsstream->buf_size == sizeof(This->nsstream->buf)) {
1235             ERR("buffer is full\n");
1236             break;
1237         }
1238     }while(hres == S_OK);
1239
1240     return S_OK;
1241 }
1242
1243 typedef struct {
1244     nsIAsyncVerifyRedirectCallback nsIAsyncVerifyRedirectCallback_iface;
1245
1246     LONG ref;
1247
1248     nsChannel *nschannel;
1249     nsChannelBSC *bsc;
1250 } nsRedirectCallback;
1251
1252 static nsRedirectCallback *impl_from_nsIAsyncVerifyRedirectCallback(nsIAsyncVerifyRedirectCallback *iface)
1253 {
1254     return CONTAINING_RECORD(iface, nsRedirectCallback, nsIAsyncVerifyRedirectCallback_iface);
1255 }
1256
1257 static nsresult NSAPI nsAsyncVerifyRedirectCallback_QueryInterface(nsIAsyncVerifyRedirectCallback *iface,
1258         nsIIDRef riid, void **result)
1259 {
1260     nsRedirectCallback *This = impl_from_nsIAsyncVerifyRedirectCallback(iface);
1261
1262     if(IsEqualGUID(&IID_nsISupports, riid)) {
1263         TRACE("(%p)->(IID_nsISupports %p)\n", This, result);
1264         *result = &This->nsIAsyncVerifyRedirectCallback_iface;
1265     }else if(IsEqualGUID(&IID_nsIAsyncVerifyRedirectCallback, riid)) {
1266         TRACE("(%p)->(IID_nsIAsyncVerifyRedirectCallback %p)\n", This, result);
1267         *result = &This->nsIAsyncVerifyRedirectCallback_iface;
1268     }else {
1269         *result = NULL;
1270         WARN("unimplemented iface %s\n", debugstr_guid(riid));
1271         return NS_NOINTERFACE;
1272     }
1273
1274     nsISupports_AddRef((nsISupports*)*result);
1275     return NS_OK;
1276 }
1277
1278 static nsrefcnt NSAPI nsAsyncVerifyRedirectCallback_AddRef(nsIAsyncVerifyRedirectCallback *iface)
1279 {
1280     nsRedirectCallback *This = impl_from_nsIAsyncVerifyRedirectCallback(iface);
1281     LONG ref = InterlockedIncrement(&This->ref);
1282
1283     TRACE("(%p) ref=%d\n", This, ref);
1284
1285     return ref;
1286 }
1287
1288 static nsrefcnt NSAPI nsAsyncVerifyRedirectCallback_Release(nsIAsyncVerifyRedirectCallback *iface)
1289 {
1290     nsRedirectCallback *This = impl_from_nsIAsyncVerifyRedirectCallback(iface);
1291     LONG ref = InterlockedDecrement(&This->ref);
1292
1293     TRACE("(%p) ref=%d\n", This, ref);
1294
1295     if(!ref) {
1296         IBindStatusCallback_Release(&This->bsc->bsc.IBindStatusCallback_iface);
1297         nsIHttpChannel_Release(&This->nschannel->nsIHttpChannel_iface);
1298         heap_free(This);
1299     }
1300
1301     return ref;
1302 }
1303
1304 static nsresult NSAPI nsAsyncVerifyRedirectCallback_AsyncOnChannelRedirect(nsIAsyncVerifyRedirectCallback *iface, nsresult result)
1305 {
1306     nsRedirectCallback *This = impl_from_nsIAsyncVerifyRedirectCallback(iface);
1307     nsChannel *old_nschannel;
1308     nsresult nsres;
1309
1310     TRACE("(%p)->(%08x)\n", This, result);
1311
1312     old_nschannel = This->bsc->nschannel;
1313     nsIHttpChannel_AddRef(&This->nschannel->nsIHttpChannel_iface);
1314     This->bsc->nschannel = This->nschannel;
1315
1316     if(This->nschannel->load_group) {
1317         nsres = nsILoadGroup_AddRequest(This->nschannel->load_group, (nsIRequest*)&This->nschannel->nsIHttpChannel_iface,
1318                 NULL);
1319         if(NS_FAILED(nsres))
1320             ERR("AddRequest failed: %08x\n", nsres);
1321     }
1322
1323     if(This->bsc->is_doc_channel) {
1324         IUri *uri = nsuri_get_uri(This->nschannel->uri);
1325
1326         if(uri) {
1327             set_current_uri(This->bsc->bsc.window->base.outer_window, uri);
1328             IUri_Release(uri);
1329         }else {
1330             WARN("Could not get IUri from nsWineURI\n");
1331         }
1332     }
1333
1334     if(old_nschannel) {
1335         if(old_nschannel->load_group) {
1336             nsres = nsILoadGroup_RemoveRequest(old_nschannel->load_group,
1337                     (nsIRequest*)&old_nschannel->nsIHttpChannel_iface, NULL, NS_OK);
1338             if(NS_FAILED(nsres))
1339                 ERR("RemoveRequest failed: %08x\n", nsres);
1340         }
1341         nsIHttpChannel_Release(&old_nschannel->nsIHttpChannel_iface);
1342     }
1343
1344     return NS_OK;
1345 }
1346
1347 static const nsIAsyncVerifyRedirectCallbackVtbl nsAsyncVerifyRedirectCallbackVtbl = {
1348     nsAsyncVerifyRedirectCallback_QueryInterface,
1349     nsAsyncVerifyRedirectCallback_AddRef,
1350     nsAsyncVerifyRedirectCallback_Release,
1351     nsAsyncVerifyRedirectCallback_AsyncOnChannelRedirect
1352 };
1353
1354 static HRESULT create_redirect_callback(nsChannel *nschannel, nsChannelBSC *bsc, nsRedirectCallback **ret)
1355 {
1356     nsRedirectCallback *callback;
1357
1358     callback = heap_alloc(sizeof(*callback));
1359     if(!callback)
1360         return E_OUTOFMEMORY;
1361
1362     callback->nsIAsyncVerifyRedirectCallback_iface.lpVtbl = &nsAsyncVerifyRedirectCallbackVtbl;
1363     callback->ref = 1;
1364
1365     nsIHttpChannel_AddRef(&nschannel->nsIHttpChannel_iface);
1366     callback->nschannel = nschannel;
1367
1368     IBindStatusCallback_AddRef(&bsc->bsc.IBindStatusCallback_iface);
1369     callback->bsc = bsc;
1370
1371     *ret = callback;
1372     return S_OK;
1373 }
1374
1375 static inline nsChannelBSC *nsChannelBSC_from_BSCallback(BSCallback *iface)
1376 {
1377     return CONTAINING_RECORD(iface, nsChannelBSC, bsc);
1378 }
1379
1380 static void nsChannelBSC_destroy(BSCallback *bsc)
1381 {
1382     nsChannelBSC *This = nsChannelBSC_from_BSCallback(bsc);
1383
1384     if(This->nschannel)
1385         nsIHttpChannel_Release(&This->nschannel->nsIHttpChannel_iface);
1386     if(This->nslistener)
1387         nsIStreamListener_Release(This->nslistener);
1388     if(This->nscontext)
1389         nsISupports_Release(This->nscontext);
1390     if(This->nsstream)
1391         nsIInputStream_Release(&This->nsstream->nsIInputStream_iface);
1392     heap_free(This);
1393 }
1394
1395 static HRESULT nsChannelBSC_start_binding(BSCallback *bsc)
1396 {
1397     nsChannelBSC *This = nsChannelBSC_from_BSCallback(bsc);
1398
1399     if(This->is_doc_channel)
1400         This->bsc.window->base.outer_window->base.inner_window->doc->skip_mutation_notif = FALSE;
1401
1402     return S_OK;
1403 }
1404
1405 static HRESULT nsChannelBSC_init_bindinfo(BSCallback *bsc)
1406 {
1407     nsChannelBSC *This = nsChannelBSC_from_BSCallback(bsc);
1408     nsChannel *nschannel = This->nschannel;
1409     HRESULT hres;
1410
1411     if(nschannel && nschannel->post_data_stream) {
1412         hres = read_post_data_stream(nschannel->post_data_stream, nschannel->post_data_contains_headers,
1413                 &nschannel->request_headers, &This->bsc.request_data);
1414         if(FAILED(hres))
1415             return hres;
1416     }
1417
1418     return S_OK;
1419 }
1420
1421 typedef struct {
1422     task_t header;
1423     nsChannelBSC *bsc;
1424 } stop_request_task_t;
1425
1426 static void stop_request_proc(task_t *_task)
1427 {
1428     stop_request_task_t *task = (stop_request_task_t*)_task;
1429
1430     TRACE("(%p)\n", task->bsc);
1431
1432     list_remove(&task->bsc->bsc.entry);
1433     list_init(&task->bsc->bsc.entry);
1434     on_stop_nsrequest(task->bsc, S_OK);
1435 }
1436
1437 static void stop_request_task_destr(task_t *_task)
1438 {
1439     stop_request_task_t *task = (stop_request_task_t*)_task;
1440
1441     IBindStatusCallback_Release(&task->bsc->bsc.IBindStatusCallback_iface);
1442     heap_free(task);
1443 }
1444
1445 static HRESULT async_stop_request(nsChannelBSC *This)
1446 {
1447     stop_request_task_t *task;
1448
1449     if(!This->bsc.readed) {
1450         TRACE("No data read, calling OnStartRequest\n");
1451         on_start_nsrequest(This);
1452     }
1453
1454     task = heap_alloc(sizeof(*task));
1455     if(!task)
1456         return E_OUTOFMEMORY;
1457
1458     IBindStatusCallback_AddRef(&This->bsc.IBindStatusCallback_iface);
1459     task->bsc = This;
1460
1461     return push_task(&task->header, stop_request_proc, stop_request_task_destr, This->bsc.window->task_magic);
1462 }
1463
1464 static void handle_navigation_error(nsChannelBSC *This, DWORD result)
1465 {
1466     HTMLOuterWindow *outer_window;
1467     HTMLDocumentObj *doc;
1468     BOOL is_error_url;
1469     SAFEARRAY *sa;
1470     SAFEARRAYBOUND bound;
1471     VARIANT var, varOut;
1472     LONG ind;
1473     BSTR unk;
1474     HRESULT hres;
1475
1476     if(!This->is_doc_channel || !This->bsc.window)
1477         return;
1478
1479     outer_window = This->bsc.window->base.outer_window;
1480
1481     doc = outer_window->doc_obj;
1482     if(!doc || !doc->doc_object_service || !doc->client)
1483         return;
1484
1485     hres = IDocObjectService_IsErrorUrl(doc->doc_object_service,
1486             outer_window->url, &is_error_url);
1487     if(FAILED(hres) || is_error_url)
1488         return;
1489
1490     if(!doc->client_cmdtrg)
1491         return;
1492
1493     bound.lLbound = 0;
1494     bound.cElements = 8;
1495     sa = SafeArrayCreate(VT_VARIANT, 1, &bound);
1496     if(!sa)
1497         return;
1498
1499     ind = 0;
1500     V_VT(&var) = VT_I4;
1501     V_I4(&var) = result;
1502     SafeArrayPutElement(sa, &ind, &var);
1503
1504     ind = 1;
1505     V_VT(&var) = VT_BSTR;
1506     V_BSTR(&var) = outer_window->url;
1507     SafeArrayPutElement(sa, &ind, &var);
1508
1509     ind = 3;
1510     V_VT(&var) = VT_UNKNOWN;
1511     V_UNKNOWN(&var) = (IUnknown*)&outer_window->base.IHTMLWindow2_iface;
1512     SafeArrayPutElement(sa, &ind, &var);
1513
1514     /* FIXME: what are the following fields for? */
1515     ind = 2;
1516     V_VT(&var) = VT_UNKNOWN;
1517     V_UNKNOWN(&var) = NULL;
1518     SafeArrayPutElement(sa, &ind, &var);
1519
1520     ind = 4;
1521     V_VT(&var) = VT_BOOL;
1522     V_BOOL(&var) = FALSE;
1523     SafeArrayPutElement(sa, &ind, &var);
1524
1525     ind = 5;
1526     V_VT(&var) = VT_BOOL;
1527     V_BOOL(&var) = FALSE;
1528     SafeArrayPutElement(sa, &ind, &var);
1529
1530     ind = 6;
1531     V_VT(&var) = VT_BSTR;
1532     unk = SysAllocString(NULL);
1533     V_BSTR(&var) = unk;
1534     SafeArrayPutElement(sa, &ind, &var);
1535
1536     ind = 7;
1537     V_VT(&var) = VT_UNKNOWN;
1538     V_UNKNOWN(&var) = NULL;
1539     SafeArrayPutElement(sa, &ind, &var);
1540
1541     V_VT(&var) = VT_ARRAY;
1542     V_ARRAY(&var) = sa;
1543     V_VT(&varOut) = VT_BOOL;
1544     V_BOOL(&varOut) = VARIANT_TRUE;
1545     IOleCommandTarget_Exec(doc->client_cmdtrg, &CGID_DocHostCmdPriv, 1, 0, &var, FAILED(hres)?NULL:&varOut);
1546
1547     SysFreeString(unk);
1548     SafeArrayDestroy(sa);
1549 }
1550
1551 static HRESULT nsChannelBSC_stop_binding(BSCallback *bsc, HRESULT result)
1552 {
1553     nsChannelBSC *This = nsChannelBSC_from_BSCallback(bsc);
1554
1555     if(result != E_ABORT) {
1556         if(FAILED(result))
1557             handle_navigation_error(This, result);
1558         else if(This->is_doc_channel && This->nschannel) {
1559             result = async_stop_request(This);
1560             if(SUCCEEDED(result))
1561                 return S_OK;
1562         }
1563     }
1564
1565     on_stop_nsrequest(This, result);
1566     return S_OK;
1567 }
1568
1569 static HRESULT nsChannelBSC_read_data(BSCallback *bsc, IStream *stream)
1570 {
1571     nsChannelBSC *This = nsChannelBSC_from_BSCallback(bsc);
1572
1573     return read_stream_data(This, stream);
1574 }
1575
1576 static HRESULT handle_redirect(nsChannelBSC *This, const WCHAR *new_url)
1577 {
1578     nsRedirectCallback *callback;
1579     nsIChannelEventSink *sink;
1580     nsChannel *new_channel;
1581     nsresult nsres;
1582     HRESULT hres;
1583
1584     TRACE("(%p)->(%s)\n", This, debugstr_w(new_url));
1585
1586     if(!This->nschannel || !This->nschannel->notif_callback)
1587         return S_OK;
1588
1589     nsres = nsIInterfaceRequestor_GetInterface(This->nschannel->notif_callback, &IID_nsIChannelEventSink, (void**)&sink);
1590     if(NS_FAILED(nsres))
1591         return S_OK;
1592
1593     hres = create_redirect_nschannel(new_url, This->nschannel, &new_channel);
1594     if(SUCCEEDED(hres)) {
1595         TRACE("%p %p->%p\n", This, This->nschannel, new_channel);
1596
1597         hres = create_redirect_callback(new_channel, This, &callback);
1598         nsIHttpChannel_Release(&new_channel->nsIHttpChannel_iface);
1599     }
1600
1601     if(SUCCEEDED(hres)) {
1602         nsres = nsIChannelEventSink_AsyncOnChannelRedirect(sink, (nsIChannel*)&This->nschannel->nsIHttpChannel_iface,
1603                 (nsIChannel*)&callback->nschannel->nsIHttpChannel_iface, REDIRECT_TEMPORARY, /* FIXME */
1604                 &callback->nsIAsyncVerifyRedirectCallback_iface);
1605
1606         if(NS_FAILED(nsres))
1607             FIXME("AsyncOnChannelRedirect failed: %08x\n", hres);
1608         else if(This->nschannel != callback->nschannel)
1609             FIXME("nschannel not updated\n");
1610
1611         nsIAsyncVerifyRedirectCallback_Release(&callback->nsIAsyncVerifyRedirectCallback_iface);
1612     }
1613
1614     nsIChannelEventSink_Release(sink);
1615     return hres;
1616 }
1617
1618 static BOOL is_supported_doc_mime(const WCHAR *mime)
1619 {
1620     char *nscat, *mimea;
1621     BOOL ret;
1622
1623     mimea = heap_strdupWtoA(mime);
1624     if(!mimea)
1625         return FALSE;
1626
1627     nscat = get_nscategory_entry("Gecko-Content-Viewers", mimea);
1628
1629     ret = nscat != NULL && !strcmp(nscat, "@mozilla.org/content/document-loader-factory;1");
1630
1631     heap_free(mimea);
1632     nsfree(nscat);
1633     return ret;
1634 }
1635
1636 static IUri *get_moniker_uri(IMoniker *mon)
1637 {
1638     IUriContainer *uri_container;
1639     IUri *ret = NULL;
1640     HRESULT hres;
1641
1642     hres = IMoniker_QueryInterface(mon, &IID_IUriContainer, (void**)&uri_container);
1643     if(SUCCEEDED(hres)) {
1644         hres = IUriContainer_GetIUri(uri_container, &ret);
1645         IUriContainer_Release(uri_container);
1646         if(FAILED(hres))
1647             return NULL;
1648     }else {
1649         FIXME("No IUriContainer\n");
1650     }
1651
1652     return ret;
1653 }
1654
1655 static void handle_extern_mime_navigation(nsChannelBSC *This)
1656 {
1657     IWebBrowserPriv2IE9 *webbrowser_priv;
1658     IOleCommandTarget *cmdtrg;
1659     HTMLDocumentObj *doc_obj;
1660     IBindCtx *bind_ctx;
1661     IUri *uri;
1662     VARIANT flags;
1663     HRESULT hres;
1664
1665     if(!This->bsc.window || !This->bsc.window->base.outer_window || !This->bsc.window->base.outer_window->doc_obj)
1666         return;
1667
1668     doc_obj = This->bsc.window->base.outer_window->doc_obj;
1669
1670     hres = IOleClientSite_QueryInterface(doc_obj->client, &IID_IOleCommandTarget, (void**)&cmdtrg);
1671     if(SUCCEEDED(hres)) {
1672         IOleCommandTarget_Exec(cmdtrg, &CGID_ShellDocView, 62, 0, NULL, NULL);
1673         IOleCommandTarget_Release(cmdtrg);
1674     }
1675
1676     set_document_navigation(doc_obj, FALSE);
1677
1678     if(!doc_obj->webbrowser) {
1679         FIXME("unimplemented in non-webbrowser mode\n");
1680         return;
1681     }
1682
1683     uri = get_moniker_uri(This->bsc.mon);
1684     if(!uri)
1685         return;
1686
1687     hres = CreateBindCtx(0, &bind_ctx);
1688     if(FAILED(hres)) {
1689         IUri_Release(uri);
1690         return;
1691     }
1692
1693     V_VT(&flags) = VT_I4;
1694     V_I4(&flags) = navHyperlink;
1695
1696     hres = IUnknown_QueryInterface(doc_obj->webbrowser, &IID_IWebBrowserPriv2IE8, (void**)&webbrowser_priv);
1697     if(SUCCEEDED(hres)) {
1698         hres = IWebBrowserPriv2IE9_NavigateWithBindCtx2(webbrowser_priv, uri, &flags, NULL, NULL, NULL, bind_ctx, NULL, 0);
1699         IWebBrowserPriv2IE9_Release(webbrowser_priv);
1700     }else {
1701         IWebBrowserPriv *webbrowser_priv_old;
1702         VARIANT uriv;
1703
1704         hres = IUnknown_QueryInterface(doc_obj->webbrowser, &IID_IWebBrowserPriv, (void**)&webbrowser_priv_old);
1705         if(SUCCEEDED(hres)) {
1706             V_VT(&uriv) = VT_BSTR;
1707             IUri_GetDisplayUri(uri, &V_BSTR(&uriv));
1708
1709             hres = IWebBrowserPriv_NavigateWithBindCtx(webbrowser_priv_old, &uriv, &flags, NULL, NULL, NULL, bind_ctx, NULL);
1710
1711             SysFreeString(V_BSTR(&uriv));
1712             IWebBrowserPriv_Release(webbrowser_priv_old);
1713         }
1714     }
1715
1716     IUri_Release(uri);
1717 }
1718
1719 static HRESULT nsChannelBSC_on_progress(BSCallback *bsc, ULONG status_code, LPCWSTR status_text)
1720 {
1721     nsChannelBSC *This = nsChannelBSC_from_BSCallback(bsc);
1722
1723     switch(status_code) {
1724     case BINDSTATUS_MIMETYPEAVAILABLE:
1725         if(This->is_doc_channel && !is_supported_doc_mime(status_text)) {
1726             FIXME("External MIME: %s\n", debugstr_w(status_text));
1727
1728             handle_extern_mime_navigation(This);
1729
1730             This->nschannel = NULL;
1731         }
1732
1733         if(!This->nschannel)
1734             return S_OK;
1735
1736         heap_free(This->nschannel->content_type);
1737         This->nschannel->content_type = heap_strdupWtoA(status_text);
1738         break;
1739     case BINDSTATUS_REDIRECTING:
1740         return handle_redirect(This, status_text);
1741     case BINDSTATUS_BEGINDOWNLOADDATA: {
1742         IWinInetHttpInfo *http_info;
1743         DWORD status, size = sizeof(DWORD);
1744         HRESULT hres;
1745
1746         if(!This->bsc.binding)
1747             break;
1748
1749         hres = IBinding_QueryInterface(This->bsc.binding, &IID_IWinInetHttpInfo, (void**)&http_info);
1750         if(FAILED(hres))
1751             break;
1752
1753         hres = IWinInetHttpInfo_QueryInfo(http_info,
1754                 HTTP_QUERY_STATUS_CODE|HTTP_QUERY_FLAG_NUMBER, &status, &size, NULL, NULL);
1755         IWinInetHttpInfo_Release(http_info);
1756         if(FAILED(hres) || status == HTTP_STATUS_OK)
1757             break;
1758
1759         handle_navigation_error(This, status);
1760     }
1761     }
1762
1763     return S_OK;
1764 }
1765
1766 static HRESULT nsChannelBSC_on_response(BSCallback *bsc, DWORD response_code,
1767         LPCWSTR response_headers)
1768 {
1769     nsChannelBSC *This = nsChannelBSC_from_BSCallback(bsc);
1770     HRESULT hres;
1771
1772     This->response_processed = TRUE;
1773     This->nschannel->response_status = response_code;
1774
1775     if(response_headers) {
1776         const WCHAR *headers;
1777
1778         headers = strchrW(response_headers, '\r');
1779         if(headers && headers[1] == '\n') {
1780             headers += 2;
1781             hres = process_response_headers(This, headers);
1782             if(FAILED(hres)) {
1783                 WARN("parsing headers failed: %08x\n", hres);
1784                 return hres;
1785             }
1786         }
1787     }
1788
1789     return S_OK;
1790 }
1791
1792 static HRESULT nsChannelBSC_beginning_transaction(BSCallback *bsc, WCHAR **additional_headers)
1793 {
1794     nsChannelBSC *This = nsChannelBSC_from_BSCallback(bsc);
1795     http_header_t *iter;
1796     DWORD len = 0;
1797     WCHAR *ptr;
1798
1799     static const WCHAR content_lengthW[] =
1800         {'C','o','n','t','e','n','t','-','L','e','n','g','t','h',0};
1801
1802     if(!This->nschannel)
1803         return S_FALSE;
1804
1805     LIST_FOR_EACH_ENTRY(iter, &This->nschannel->request_headers, http_header_t, entry) {
1806         if(strcmpW(iter->header, content_lengthW))
1807             len += strlenW(iter->header) + 2 /* ": " */ + strlenW(iter->data) + 2 /* "\r\n" */;
1808     }
1809
1810     if(!len)
1811         return S_OK;
1812
1813     *additional_headers = ptr = CoTaskMemAlloc((len+1)*sizeof(WCHAR));
1814     if(!ptr)
1815         return E_OUTOFMEMORY;
1816
1817     LIST_FOR_EACH_ENTRY(iter, &This->nschannel->request_headers, http_header_t, entry) {
1818         if(!strcmpW(iter->header, content_lengthW))
1819             continue;
1820
1821         len = strlenW(iter->header);
1822         memcpy(ptr, iter->header, len*sizeof(WCHAR));
1823         ptr += len;
1824
1825         *ptr++ = ':';
1826         *ptr++ = ' ';
1827
1828         len = strlenW(iter->data);
1829         memcpy(ptr, iter->data, len*sizeof(WCHAR));
1830         ptr += len;
1831
1832         *ptr++ = '\r';
1833         *ptr++ = '\n';
1834     }
1835
1836     *ptr = 0;
1837
1838     return S_OK;
1839 }
1840
1841 static const BSCallbackVtbl nsChannelBSCVtbl = {
1842     nsChannelBSC_destroy,
1843     nsChannelBSC_init_bindinfo,
1844     nsChannelBSC_start_binding,
1845     nsChannelBSC_stop_binding,
1846     nsChannelBSC_read_data,
1847     nsChannelBSC_on_progress,
1848     nsChannelBSC_on_response,
1849     nsChannelBSC_beginning_transaction
1850 };
1851
1852 HRESULT create_channelbsc(IMoniker *mon, const WCHAR *headers, BYTE *post_data, DWORD post_data_size,
1853         BOOL is_doc_binding, nsChannelBSC **retval)
1854 {
1855     nsChannelBSC *ret;
1856     DWORD bindf;
1857
1858     ret = heap_alloc_zero(sizeof(*ret));
1859     if(!ret)
1860         return E_OUTOFMEMORY;
1861
1862     bindf = BINDF_ASYNCHRONOUS | BINDF_ASYNCSTORAGE | BINDF_PULLDATA;
1863     if(post_data_size)
1864         bindf |= BINDF_FORMS_SUBMIT | BINDF_PRAGMA_NO_CACHE | BINDF_HYPERLINK | BINDF_GETNEWESTVERSION;
1865
1866     init_bscallback(&ret->bsc, &nsChannelBSCVtbl, mon, bindf);
1867     ret->is_doc_channel = is_doc_binding;
1868
1869     if(headers) {
1870         ret->bsc.request_data.headers = heap_strdupW(headers);
1871         if(!ret->bsc.request_data.headers) {
1872             IBindStatusCallback_Release(&ret->bsc.IBindStatusCallback_iface);
1873             return E_OUTOFMEMORY;
1874         }
1875     }
1876
1877     if(post_data) {
1878         ret->bsc.request_data.post_data = GlobalAlloc(0, post_data_size+1);
1879         if(!ret->bsc.request_data.post_data) {
1880             release_request_data(&ret->bsc.request_data);
1881             IBindStatusCallback_Release(&ret->bsc.IBindStatusCallback_iface);
1882             return E_OUTOFMEMORY;
1883         }
1884
1885         memcpy(ret->bsc.request_data.post_data, post_data, post_data_size);
1886         ((BYTE*)ret->bsc.request_data.post_data)[post_data_size] = 0;
1887         ret->bsc.request_data.post_data_len = post_data_size;
1888     }
1889
1890     TRACE("created %p\n", ret);
1891     *retval = ret;
1892     return S_OK;
1893 }
1894
1895 typedef struct {
1896     task_t header;
1897     HTMLOuterWindow *window;
1898     HTMLInnerWindow *pending_window;
1899 } start_doc_binding_task_t;
1900
1901 static void start_doc_binding_proc(task_t *_task)
1902 {
1903     start_doc_binding_task_t *task = (start_doc_binding_task_t*)_task;
1904
1905     set_current_mon(task->window, task->pending_window->bscallback->bsc.mon, BINDING_NAVIGATED);
1906     start_binding(task->pending_window, &task->pending_window->bscallback->bsc, NULL);
1907 }
1908
1909 static void start_doc_binding_task_destr(task_t *_task)
1910 {
1911     start_doc_binding_task_t *task = (start_doc_binding_task_t*)_task;
1912
1913     IHTMLWindow2_Release(&task->pending_window->base.IHTMLWindow2_iface);
1914     heap_free(task);
1915 }
1916
1917 HRESULT async_start_doc_binding(HTMLOuterWindow *window, HTMLInnerWindow *pending_window)
1918 {
1919     start_doc_binding_task_t *task;
1920
1921     TRACE("%p\n", pending_window);
1922
1923     task = heap_alloc(sizeof(start_doc_binding_task_t));
1924     if(!task)
1925         return E_OUTOFMEMORY;
1926
1927     task->window = window;
1928     task->pending_window = pending_window;
1929     IHTMLWindow2_AddRef(&pending_window->base.IHTMLWindow2_iface);
1930
1931     return push_task(&task->header, start_doc_binding_proc, start_doc_binding_task_destr, pending_window->task_magic);
1932 }
1933
1934 void abort_window_bindings(HTMLInnerWindow *window)
1935 {
1936     BSCallback *iter;
1937
1938     remove_target_tasks(window->task_magic);
1939
1940     while(!list_empty(&window->bindings)) {
1941         iter = LIST_ENTRY(window->bindings.next, BSCallback, entry);
1942
1943         TRACE("Aborting %p\n", iter);
1944
1945         IBindStatusCallback_AddRef(&iter->IBindStatusCallback_iface);
1946
1947         if(iter->binding)
1948             IBinding_Abort(iter->binding);
1949         else
1950             iter->vtbl->stop_binding(iter, E_ABORT);
1951
1952         iter->window = NULL;
1953         list_remove(&iter->entry);
1954         list_init(&iter->entry);
1955
1956         IBindStatusCallback_Release(&iter->IBindStatusCallback_iface);
1957     }
1958
1959     if(window->bscallback) {
1960         IBindStatusCallback_Release(&window->bscallback->bsc.IBindStatusCallback_iface);
1961         window->bscallback = NULL;
1962     }
1963
1964     if(window->mon) {
1965         IMoniker_Release(window->mon);
1966         window->mon = NULL;
1967     }
1968 }
1969
1970 HRESULT channelbsc_load_stream(HTMLInnerWindow *pending_window, IMoniker *mon, IStream *stream)
1971 {
1972     nsChannelBSC *bscallback = pending_window->bscallback;
1973     HRESULT hres = S_OK;
1974
1975     if(!bscallback->nschannel) {
1976         ERR("NULL nschannel\n");
1977         return E_FAIL;
1978     }
1979
1980     bscallback->nschannel->content_type = heap_strdupA("text/html");
1981     if(!bscallback->nschannel->content_type)
1982         return E_OUTOFMEMORY;
1983
1984     set_current_mon(pending_window->base.outer_window, mon, 0);
1985
1986     bscallback->bsc.window = pending_window;
1987     if(stream)
1988         hres = read_stream_data(bscallback, stream);
1989     if(SUCCEEDED(hres))
1990         hres = async_stop_request(bscallback);
1991     if(FAILED(hres))
1992         IBindStatusCallback_OnStopBinding(&bscallback->bsc.IBindStatusCallback_iface, hres,
1993                 ERROR_SUCCESS);
1994
1995     return hres;
1996 }
1997
1998 void channelbsc_set_channel(nsChannelBSC *This, nsChannel *channel, nsIStreamListener *listener, nsISupports *context)
1999 {
2000     nsIHttpChannel_AddRef(&channel->nsIHttpChannel_iface);
2001     This->nschannel = channel;
2002
2003     nsIStreamListener_AddRef(listener);
2004     This->nslistener = listener;
2005
2006     if(context) {
2007         nsISupports_AddRef(context);
2008         This->nscontext = context;
2009     }
2010
2011     if(This->bsc.request_data.headers) {
2012         HRESULT hres;
2013
2014         hres = parse_headers(This->bsc.request_data.headers, &channel->request_headers);
2015         heap_free(This->bsc.request_data.headers);
2016         This->bsc.request_data.headers = NULL;
2017         if(FAILED(hres))
2018             WARN("parse_headers failed: %08x\n", hres);
2019     }
2020 }
2021
2022 typedef struct {
2023     task_t header;
2024     HTMLOuterWindow *window;
2025     IUri *uri;
2026 } navigate_javascript_task_t;
2027
2028 static void navigate_javascript_proc(task_t *_task)
2029 {
2030     navigate_javascript_task_t *task = (navigate_javascript_task_t*)_task;
2031     HTMLOuterWindow *window = task->window;
2032     VARIANT v;
2033     BSTR code;
2034     HRESULT hres;
2035
2036     static const WCHAR jscriptW[] = {'j','s','c','r','i','p','t',0};
2037
2038     task->window->readystate = READYSTATE_COMPLETE;
2039
2040     hres = IUri_GetPath(task->uri, &code);
2041     if(FAILED(hres))
2042         return;
2043
2044     hres = UrlUnescapeW(code, NULL, NULL, URL_UNESCAPE_INPLACE);
2045     if(FAILED(hres)) {
2046         SysFreeString(code);
2047         return;
2048     }
2049
2050     set_download_state(window->doc_obj, 1);
2051
2052     V_VT(&v) = VT_EMPTY;
2053     hres = exec_script(window->base.inner_window, code, jscriptW, &v);
2054     SysFreeString(code);
2055     if(SUCCEEDED(hres) && V_VT(&v) != VT_EMPTY) {
2056         FIXME("javascirpt URL returned %s\n", debugstr_variant(&v));
2057         VariantClear(&v);
2058     }
2059
2060     if(window->doc_obj->view_sink)
2061         IAdviseSink_OnViewChange(window->doc_obj->view_sink, DVASPECT_CONTENT, -1);
2062
2063     set_download_state(window->doc_obj, 0);
2064 }
2065
2066 static void navigate_javascript_task_destr(task_t *_task)
2067 {
2068     navigate_javascript_task_t *task = (navigate_javascript_task_t*)_task;
2069
2070     IUri_Release(task->uri);
2071     heap_free(task);
2072 }
2073
2074 typedef struct {
2075     task_t header;
2076     HTMLOuterWindow *window;
2077     nsChannelBSC *bscallback;
2078     DWORD flags;
2079     IMoniker *mon;
2080     IUri *uri;
2081 } navigate_task_t;
2082
2083 static void navigate_proc(task_t *_task)
2084 {
2085     navigate_task_t *task = (navigate_task_t*)_task;
2086     HRESULT hres;
2087
2088     hres = set_moniker(task->window, task->mon, task->uri, NULL, task->bscallback, TRUE);
2089     if(SUCCEEDED(hres)) {
2090         set_current_mon(task->window, task->bscallback->bsc.mon, task->flags);
2091         set_current_uri(task->window, task->uri);
2092         start_binding(task->window->pending_window, &task->bscallback->bsc, NULL);
2093     }
2094 }
2095
2096 static void navigate_task_destr(task_t *_task)
2097 {
2098     navigate_task_t *task = (navigate_task_t*)_task;
2099
2100     IBindStatusCallback_Release(&task->bscallback->bsc.IBindStatusCallback_iface);
2101     IMoniker_Release(task->mon);
2102     IUri_Release(task->uri);
2103     heap_free(task);
2104 }
2105
2106 static HRESULT navigate_fragment(HTMLOuterWindow *window, IUri *uri)
2107 {
2108     nsIDOMLocation *nslocation;
2109     nsAString nsfrag_str;
2110     WCHAR *selector;
2111     BSTR frag;
2112     nsresult nsres;
2113     HRESULT hres;
2114
2115     const WCHAR selector_formatW[] = {'a','[','i','d','=','"','%','s','"',']',0};
2116
2117     set_current_uri(window, uri);
2118
2119     nsres = nsIDOMWindow_GetLocation(window->nswindow, &nslocation);
2120     if(FAILED(nsres) || !nslocation)
2121         return E_FAIL;
2122
2123     hres = IUri_GetFragment(uri, &frag);
2124     if(FAILED(hres)) {
2125         nsIDOMLocation_Release(nslocation);
2126         return hres;
2127     }
2128
2129     nsAString_InitDepend(&nsfrag_str, frag);
2130     nsres = nsIDOMLocation_SetHash(nslocation, &nsfrag_str);
2131     nsAString_Finish(&nsfrag_str);
2132     nsIDOMLocation_Release(nslocation);
2133     if(NS_FAILED(nsres))
2134         ERR("SetHash failed: %08x\n", nsres);
2135
2136     /*
2137      * IE supports scrolling to anchor elements with "#hash" ids (note that '#' is part of the id),
2138      * while Gecko scrolls only to elements with "hash" ids. We scroll the page ourselves if
2139      * a[id="#hash"] element can be found.
2140      */
2141     selector = heap_alloc(sizeof(selector_formatW)+SysStringLen(frag)*sizeof(WCHAR));
2142     if(selector) {
2143         nsIDOMElement *nselem = NULL;
2144         nsAString selector_str;
2145
2146         sprintfW(selector, selector_formatW, frag);
2147         nsAString_InitDepend(&selector_str, selector);
2148         /* NOTE: Gecko doesn't set result to NULL if there is no match, so nselem must be initialized */
2149         nsres = nsIDOMNodeSelector_QuerySelector(window->base.inner_window->doc->nsnode_selector, &selector_str, &nselem);
2150         nsAString_Finish(&selector_str);
2151         heap_free(selector);
2152         if(NS_SUCCEEDED(nsres) && nselem) {
2153             nsIDOMHTMLElement *html_elem;
2154
2155             nsres = nsIDOMElement_QueryInterface(nselem, &IID_nsIDOMHTMLElement, (void**)&html_elem);
2156             nsIDOMElement_Release(nselem);
2157             if(NS_SUCCEEDED(nsres)) {
2158                 nsIDOMHTMLElement_ScrollIntoView(html_elem, TRUE, 1);
2159                 nsIDOMHTMLElement_Release(html_elem);
2160             }
2161         }
2162     }
2163
2164     SysFreeString(frag);
2165
2166     if(window->doc_obj->doc_object_service) {
2167         IDocObjectService_FireNavigateComplete2(window->doc_obj->doc_object_service, &window->base.IHTMLWindow2_iface, 0x10);
2168         IDocObjectService_FireDocumentComplete(window->doc_obj->doc_object_service, &window->base.IHTMLWindow2_iface, 0);
2169
2170     }
2171
2172     return S_OK;
2173 }
2174
2175 HRESULT super_navigate(HTMLOuterWindow *window, IUri *uri, DWORD flags, const WCHAR *headers, BYTE *post_data, DWORD post_data_size)
2176 {
2177     nsChannelBSC *bsc;
2178     IUri *uri_nofrag;
2179     IMoniker *mon;
2180     DWORD scheme;
2181     HRESULT hres;
2182
2183     uri_nofrag = get_uri_nofrag(uri);
2184     if(!uri_nofrag)
2185         return E_FAIL;
2186
2187     if(window->doc_obj->client && !(flags & BINDING_REFRESH)) {
2188         IOleCommandTarget *cmdtrg;
2189
2190         hres = IOleClientSite_QueryInterface(window->doc_obj->client, &IID_IOleCommandTarget, (void**)&cmdtrg);
2191         if(SUCCEEDED(hres)) {
2192             VARIANT in, out;
2193             BSTR url_str;
2194
2195             hres = IUri_GetDisplayUri(uri_nofrag, &url_str);
2196             if(SUCCEEDED(hres)) {
2197                 V_VT(&in) = VT_BSTR;
2198                 V_BSTR(&in) = url_str;
2199                 V_VT(&out) = VT_BOOL;
2200                 V_BOOL(&out) = VARIANT_TRUE;
2201                 hres = IOleCommandTarget_Exec(cmdtrg, &CGID_ShellDocView, 67, 0, &in, &out);
2202                 IOleCommandTarget_Release(cmdtrg);
2203                 if(SUCCEEDED(hres))
2204                     VariantClear(&out);
2205                 SysFreeString(url_str);
2206             }
2207         }
2208     }
2209
2210     if(!(flags & BINDING_NOFRAG) && window->uri_nofrag && !post_data_size) {
2211         BOOL eq;
2212
2213         hres = IUri_IsEqual(uri_nofrag, window->uri_nofrag, &eq);
2214         if(SUCCEEDED(hres) && eq) {
2215             IUri_Release(uri_nofrag);
2216             TRACE("fragment navigate\n");
2217             return navigate_fragment(window, uri);
2218         }
2219     }
2220
2221     hres = CreateURLMonikerEx2(NULL, uri_nofrag, &mon, URL_MK_UNIFORM);
2222     IUri_Release(uri_nofrag);
2223     if(FAILED(hres))
2224         return hres;
2225
2226     /* FIXME: Why not set_ready_state? */
2227     window->readystate = READYSTATE_UNINITIALIZED;
2228
2229     hres = create_channelbsc(mon, headers, post_data, post_data_size, TRUE, &bsc);
2230     if(FAILED(hres)) {
2231         IMoniker_Release(mon);
2232         return hres;
2233     }
2234
2235     prepare_for_binding(&window->doc_obj->basedoc, mon, flags);
2236
2237     hres = IUri_GetScheme(uri, &scheme);
2238     if(SUCCEEDED(hres) && scheme == URL_SCHEME_JAVASCRIPT) {
2239         navigate_javascript_task_t *task;
2240
2241         IBindStatusCallback_Release(&bsc->bsc.IBindStatusCallback_iface);
2242         IMoniker_Release(mon);
2243
2244         task = heap_alloc(sizeof(*task));
2245         if(!task)
2246             return E_OUTOFMEMORY;
2247
2248         /* Why silently? */
2249         window->readystate = READYSTATE_COMPLETE;
2250         if(!(flags & BINDING_FROMHIST))
2251             call_docview_84(window->doc_obj);
2252
2253         IUri_AddRef(uri);
2254         task->window = window;
2255         task->uri = uri;
2256         hres = push_task(&task->header, navigate_javascript_proc, navigate_javascript_task_destr, window->task_magic);
2257     }else if(flags & BINDING_SUBMIT) {
2258         hres = set_moniker(window, mon, uri, NULL, bsc, TRUE);
2259         if(SUCCEEDED(hres))
2260             hres = start_binding(window->pending_window, &bsc->bsc, NULL);
2261         IBindStatusCallback_Release(&bsc->bsc.IBindStatusCallback_iface);
2262         IMoniker_Release(mon);
2263     }else {
2264         navigate_task_t *task;
2265
2266         task = heap_alloc(sizeof(*task));
2267         if(!task) {
2268             IBindStatusCallback_Release(&bsc->bsc.IBindStatusCallback_iface);
2269             IMoniker_Release(mon);
2270             return E_OUTOFMEMORY;
2271         }
2272
2273         /* Silently and repeated when real loading starts? */
2274         window->readystate = READYSTATE_LOADING;
2275         if(!(flags & (BINDING_FROMHIST|BINDING_REFRESH)))
2276             call_docview_84(window->doc_obj);
2277
2278         task->window = window;
2279         task->bscallback = bsc;
2280         task->flags = flags;
2281         task->mon = mon;
2282
2283         IUri_AddRef(uri);
2284         task->uri = uri;
2285         hres = push_task(&task->header, navigate_proc, navigate_task_destr, window->task_magic);
2286     }
2287
2288     return hres;
2289 }
2290
2291 HRESULT navigate_new_window(HTMLOuterWindow *window, IUri *uri, const WCHAR *name, IHTMLWindow2 **ret)
2292 {
2293     IWebBrowser2 *web_browser;
2294     IHTMLWindow2 *new_window;
2295     IBindCtx *bind_ctx;
2296     nsChannelBSC *bsc;
2297     HRESULT hres;
2298
2299     hres = create_channelbsc(NULL, NULL, NULL, 0, FALSE, &bsc);
2300     if(FAILED(hres))
2301         return hres;
2302
2303     hres = CreateAsyncBindCtx(0, &bsc->bsc.IBindStatusCallback_iface, NULL, &bind_ctx);
2304     if(FAILED(hres)) {
2305         IBindStatusCallback_Release(&bsc->bsc.IBindStatusCallback_iface);
2306         return hres;
2307     }
2308
2309     hres = CoCreateInstance(&CLSID_InternetExplorer, NULL, CLSCTX_LOCAL_SERVER,
2310             &IID_IWebBrowser2, (void**)&web_browser);
2311     if(SUCCEEDED(hres)) {
2312         ITargetFramePriv2 *target_frame_priv;
2313
2314         hres = IWebBrowser2_QueryInterface(web_browser, &IID_ITargetFramePriv2, (void**)&target_frame_priv);
2315         if(SUCCEEDED(hres)) {
2316             hres = ITargetFramePriv2_AggregatedNavigation2(target_frame_priv,
2317                     HLNF_DISABLEWINDOWRESTRICTIONS|HLNF_OPENINNEWWINDOW, bind_ctx, &bsc->bsc.IBindStatusCallback_iface,
2318                     name, uri, emptyW);
2319             ITargetFramePriv2_Release(target_frame_priv);
2320
2321             if(SUCCEEDED(hres))
2322                 hres = do_query_service((IUnknown*)web_browser, &SID_SHTMLWindow, &IID_IHTMLWindow2, (void**)&new_window);
2323         }
2324         if(FAILED(hres)) {
2325             IWebBrowser2_Quit(web_browser);
2326             IWebBrowser2_Release(web_browser);
2327         }
2328     }else {
2329         WARN("Could not create InternetExplorer instance: %08x\n", hres);
2330     }
2331
2332     IBindStatusCallback_Release(&bsc->bsc.IBindStatusCallback_iface);
2333     IBindCtx_Release(bind_ctx);
2334     if(FAILED(hres))
2335         return hres;
2336
2337     IWebBrowser2_put_Visible(web_browser, VARIANT_TRUE);
2338     IWebBrowser2_Release(web_browser);
2339
2340     if(ret)
2341         *ret = new_window;
2342     else
2343         IHTMLWindow2_Release(new_window);
2344     return S_OK;
2345 }
2346
2347 HRESULT hlink_frame_navigate(HTMLDocument *doc, LPCWSTR url, nsChannel *nschannel, DWORD hlnf, BOOL *cancel)
2348 {
2349     IHlinkFrame *hlink_frame;
2350     nsChannelBSC *callback;
2351     IBindCtx *bindctx;
2352     IMoniker *mon;
2353     IHlink *hlink;
2354     HRESULT hres;
2355
2356     *cancel = FALSE;
2357
2358     hres = do_query_service((IUnknown*)doc->doc_obj->client, &IID_IHlinkFrame, &IID_IHlinkFrame,
2359             (void**)&hlink_frame);
2360     if(FAILED(hres))
2361         return S_OK;
2362
2363     hres = create_channelbsc(NULL, NULL, NULL, 0, FALSE, &callback);
2364     if(FAILED(hres)) {
2365         IHlinkFrame_Release(hlink_frame);
2366         return hres;
2367     }
2368
2369     if(nschannel)
2370         read_post_data_stream(nschannel->post_data_stream, nschannel->post_data_contains_headers,
2371                 &nschannel->request_headers, &callback->bsc.request_data);
2372
2373     hres = CreateAsyncBindCtx(0, &callback->bsc.IBindStatusCallback_iface, NULL, &bindctx);
2374     if(SUCCEEDED(hres))
2375        hres = CoCreateInstance(&CLSID_StdHlink, NULL, CLSCTX_INPROC_SERVER,
2376                 &IID_IHlink, (LPVOID*)&hlink);
2377
2378     if(SUCCEEDED(hres))
2379         hres = CreateURLMoniker(NULL, url, &mon);
2380
2381     if(SUCCEEDED(hres)) {
2382         IHlink_SetMonikerReference(hlink, HLINKSETF_TARGET, mon, NULL);
2383
2384         if(hlnf & HLNF_OPENINNEWWINDOW) {
2385             static const WCHAR wszBlank[] = {'_','b','l','a','n','k',0};
2386             IHlink_SetTargetFrameName(hlink, wszBlank); /* FIXME */
2387         }
2388
2389         hres = IHlinkFrame_Navigate(hlink_frame, hlnf, bindctx,
2390                 &callback->bsc.IBindStatusCallback_iface, hlink);
2391         IMoniker_Release(mon);
2392         *cancel = hres == S_OK;
2393         hres = S_OK;
2394     }
2395
2396     IHlinkFrame_Release(hlink_frame);
2397     IBindCtx_Release(bindctx);
2398     IBindStatusCallback_Release(&callback->bsc.IBindStatusCallback_iface);
2399     return hres;
2400 }
2401
2402 static HRESULT navigate_uri(HTMLOuterWindow *window, IUri *uri, const WCHAR *display_uri, const request_data_t *request_data,
2403         DWORD flags)
2404 {
2405     nsWineURI *nsuri;
2406     HRESULT hres;
2407
2408     TRACE("%s\n", debugstr_w(display_uri));
2409
2410     if(window->doc_obj && window->doc_obj->webbrowser && window == window->doc_obj->basedoc.window) {
2411         DWORD post_data_len = request_data ? request_data->post_data_len : 0;
2412         void *post_data = post_data_len ? request_data->post_data : NULL;
2413         const WCHAR *headers = request_data ? request_data->headers : NULL;
2414
2415         if(!(flags & BINDING_REFRESH)) {
2416             BOOL cancel = FALSE;
2417
2418             hres = IDocObjectService_FireBeforeNavigate2(window->doc_obj->doc_object_service, NULL, display_uri, 0x40,
2419                     NULL, post_data, post_data_len ? post_data_len+1 : 0, headers, TRUE, &cancel);
2420             if(SUCCEEDED(hres) && cancel) {
2421                 TRACE("Navigation canceled\n");
2422                 return S_OK;
2423             }
2424         }
2425
2426         return super_navigate(window, uri, flags, headers, post_data, post_data_len);
2427     }
2428
2429     if(window->doc_obj && window == window->doc_obj->basedoc.window) {
2430         BOOL cancel;
2431
2432         hres = hlink_frame_navigate(&window->base.inner_window->doc->basedoc, display_uri, NULL, 0, &cancel);
2433         if(FAILED(hres))
2434             return hres;
2435
2436         if(cancel) {
2437             TRACE("Navigation handled by hlink frame\n");
2438             return S_OK;
2439         }
2440     }
2441
2442     hres = create_doc_uri(window, uri, &nsuri);
2443     if(FAILED(hres))
2444         return hres;
2445
2446     hres = load_nsuri(window, nsuri, NULL, LOAD_FLAGS_NONE);
2447     nsISupports_Release((nsISupports*)nsuri);
2448     return hres;
2449 }
2450
2451 HRESULT load_uri(HTMLOuterWindow *window, IUri *uri, DWORD flags)
2452 {
2453     BSTR display_uri;
2454     HRESULT hres;
2455
2456     hres = IUri_GetDisplayUri(uri, &display_uri);
2457     if(FAILED(hres))
2458         return hres;
2459
2460     hres = navigate_uri(window, uri, display_uri, NULL, flags);
2461     SysFreeString(display_uri);
2462     return hres;
2463 }
2464
2465 static HRESULT translate_uri(HTMLOuterWindow *window, IUri *orig_uri, BSTR *ret_display_uri, IUri **ret_uri)
2466 {
2467     IUri *uri = NULL;
2468     BSTR display_uri;
2469     HRESULT hres;
2470
2471     hres = IUri_GetDisplayUri(orig_uri, &display_uri);
2472     if(FAILED(hres))
2473         return hres;
2474
2475     if(window->doc_obj && window->doc_obj->hostui) {
2476         OLECHAR *translated_url = NULL;
2477
2478         hres = IDocHostUIHandler_TranslateUrl(window->doc_obj->hostui, 0, display_uri,
2479                 &translated_url);
2480         if(hres == S_OK) {
2481             TRACE("%08x %s -> %s\n", hres, debugstr_w(display_uri), debugstr_w(translated_url));
2482             SysFreeString(display_uri);
2483             hres = create_uri(translated_url, 0, &uri);
2484             CoTaskMemFree(translated_url);
2485             if(FAILED(hres))
2486                 return hres;
2487
2488             hres = IUri_GetDisplayUri(uri, &display_uri);
2489             if(FAILED(hres)) {
2490                 IUri_Release(uri);
2491                 return hres;
2492             }
2493         }
2494     }
2495
2496     if(!uri) {
2497         IUri_AddRef(orig_uri);
2498         uri = orig_uri;
2499     }
2500
2501     *ret_display_uri = display_uri;
2502     *ret_uri = uri;
2503     return S_OK;
2504 }
2505
2506 HRESULT submit_form(HTMLOuterWindow *window, IUri *submit_uri, nsIInputStream *post_stream)
2507 {
2508     request_data_t request_data = {NULL};
2509     BSTR display_uri;
2510     IUri *uri;
2511     HRESULT hres;
2512
2513     hres = read_post_data_stream(post_stream, TRUE, NULL, &request_data);
2514     if(FAILED(hres))
2515         return hres;
2516
2517     hres = translate_uri(window, submit_uri, &display_uri, &uri);
2518     if(SUCCEEDED(hres)) {
2519         hres = navigate_uri(window, uri, display_uri, &request_data, BINDING_NAVIGATED|BINDING_SUBMIT);
2520         IUri_Release(uri);
2521         SysFreeString(display_uri);
2522     }
2523     release_request_data(&request_data);
2524     return hres;
2525 }
2526
2527 HRESULT navigate_url(HTMLOuterWindow *window, const WCHAR *new_url, IUri *base_uri, DWORD flags)
2528 {
2529     IUri *uri, *nav_uri;
2530     BSTR display_uri;
2531     HRESULT hres;
2532
2533     if(new_url && base_uri)
2534         hres = CoInternetCombineUrlEx(base_uri, new_url, URL_ESCAPE_SPACES_ONLY|URL_DONT_ESCAPE_EXTRA_INFO,
2535                 &nav_uri, 0);
2536     else
2537         hres = create_uri(new_url, 0, &nav_uri);
2538     if(FAILED(hres))
2539         return hres;
2540
2541     hres = translate_uri(window, nav_uri, &display_uri, &uri);
2542     IUri_Release(nav_uri);
2543     if(FAILED(hres))
2544         return hres;
2545
2546     hres = navigate_uri(window, uri, display_uri, NULL, flags);
2547     IUri_Release(uri);
2548     SysFreeString(display_uri);
2549     return hres;
2550 }