dlls/mshtml/navigate.c

   1 /*
   2  * Copyright 2006-2010 Jacek Caban for CodeWeavers
   3  *
   4  * This library is free software; you can redistribute it and/or
   5  * modify it under the terms of the GNU Lesser General Public
   6  * License as published by the Free Software Foundation; either
   7  * version 2.1 of the License, or (at your option) any later version.
   8  *
   9  * This library is distributed in the hope that it will be useful,
  10  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  11  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  12  * Lesser General Public License for more details.
  13  *
  14  * You should have received a copy of the GNU Lesser General Public
  15  * License along with this library; if not, write to the Free Software
  16  * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
  17  */
  18
  19 #include <stdarg.h>
  20
  21 #define COBJMACROS
  22 #define NONAMELESSUNION
  23
  24 #include "windef.h"
  25 #include "winbase.h"
  26 #include "winuser.h"
  27 #include "winreg.h"
  28 #include "ole2.h"
  29 #include "hlguids.h"
  30 #include "shlguid.h"
  31 #include "wininet.h"
  32 #include "shlwapi.h"
  33 #include "htiface.h"
  34 #include "shdeprecated.h"
  35
  36 #include "wine/debug.h"
  37
  38 #include "mshtml_private.h"
  39 #include "htmlscript.h"
  40 #include "binding.h"
  41
  42 WINE_DEFAULT_DEBUG_CHANNEL(mshtml);
  43
  44 #define CONTENT_LENGTH "Content-Length"
  45 #define UTF8_STR "utf-8"
  46 #define UTF16_STR "utf-16"
  47
  48 struct nsProtocolStream {
  49     nsIInputStream nsIInputStream_iface;
  50
  51     LONG ref;
  52
  53     char buf[1024];
  54     DWORD buf_size;
  55 };
  56
  57 static inline nsProtocolStream *impl_from_nsIInputStream(nsIInputStream *iface)
  58 {
  59     return CONTAINING_RECORD(iface, nsProtocolStream, nsIInputStream_iface);
  60 }
  61
  62 static nsresult NSAPI nsInputStream_QueryInterface(nsIInputStream *iface, nsIIDRef riid,
  63         void **result)
  64 {
  65     nsProtocolStream *This = impl_from_nsIInputStream(iface);
  66
  67     *result = NULL;
  68
  69     if(IsEqualGUID(&IID_nsISupports, riid)) {
  70         TRACE("(%p)->(IID_nsISupports %p)\n", This, result);
  71         *result  = &This->nsIInputStream_iface;
  72     }else if(IsEqualGUID(&IID_nsIInputStream, riid)) {
  73         TRACE("(%p)->(IID_nsIInputStream %p)\n", This, result);
  74         *result  = &This->nsIInputStream_iface;
  75     }
  76
  77     if(*result) {
  78         nsIInputStream_AddRef(&This->nsIInputStream_iface);
  79         return NS_OK;
  80     }
  81
  82     WARN("unsupported interface %s\n", debugstr_guid(riid));
  83     return NS_NOINTERFACE;
  84 }
  85
  86 static nsrefcnt NSAPI nsInputStream_AddRef(nsIInputStream *iface)
  87 {
  88     nsProtocolStream *This = impl_from_nsIInputStream(iface);
  89     LONG ref = InterlockedIncrement(&This->ref);
  90
  91     TRACE("(%p) ref=%ld\n", This, ref);
  92
  93     return ref;
  94 }
  95
  96
  97 static nsrefcnt NSAPI nsInputStream_Release(nsIInputStream *iface)
  98 {
  99     nsProtocolStream *This = impl_from_nsIInputStream(iface);
 100     LONG ref = InterlockedDecrement(&This->ref);
 101
 102     TRACE("(%p) ref=%ld\n", This, ref);
 103
 104     if(!ref)
 105         heap_free(This);
 106
 107     return ref;
 108 }
 109
 110 static nsresult NSAPI nsInputStream_Close(nsIInputStream *iface)
 111 {
 112     nsProtocolStream *This = impl_from_nsIInputStream(iface);
 113     FIXME("(%p)\n", This);
 114     return NS_ERROR_NOT_IMPLEMENTED;
 115 }
 116
 117 static nsresult NSAPI nsInputStream_Available(nsIInputStream *iface, UINT64 *_retval)
 118 {
 119     nsProtocolStream *This = impl_from_nsIInputStream(iface);
 120     FIXME("(%p)->(%p)\n", This, _retval);
 121     return NS_ERROR_NOT_IMPLEMENTED;
 122 }
 123
 124 static nsresult NSAPI nsInputStream_Read(nsIInputStream *iface, char *aBuf, UINT32 aCount,
 125                                          UINT32 *_retval)
 126 {
 127     nsProtocolStream *This = impl_from_nsIInputStream(iface);
 128     DWORD read = aCount;
 129
 130     TRACE("(%p)->(%p %d %p)\n", This, aBuf, aCount, _retval);
 131
 132     if(read > This->buf_size)
 133         read = This->buf_size;
 134
 135     if(read) {
 136         memcpy(aBuf, This->buf, read);
 137         if(read < This->buf_size)
 138             memmove(This->buf, This->buf+read, This->buf_size-read);
 139         This->buf_size -= read;
 140     }
 141
 142     *_retval = read;
 143     return NS_OK;
 144 }
 145
 146 static nsresult NSAPI nsInputStream_ReadSegments(nsIInputStream *iface,
 147         nsresult (WINAPI *aWriter)(nsIInputStream*,void*,const char*,UINT32,UINT32,UINT32*),
 148         void *aClousure, UINT32 aCount, UINT32 *_retval)
 149 {
 150     nsProtocolStream *This = impl_from_nsIInputStream(iface);
 151     UINT32 written = 0;
 152     nsresult nsres;
 153
 154     TRACE("(%p)->(%p %p %d %p)\n", This, aWriter, aClousure, aCount, _retval);
 155
 156     if(!This->buf_size)
 157         return S_OK;
 158
 159     if(aCount > This->buf_size)
 160         aCount = This->buf_size;
 161
 162     nsres = aWriter(&This->nsIInputStream_iface, aClousure, This->buf, 0, aCount, &written);
 163     if(NS_FAILED(nsres))
 164         TRACE("aWriter failed: %08lx\n", nsres);
 165     else if(written != This->buf_size)
 166         FIXME("written %d != buf_size %ld\n", written, This->buf_size);
 167
 168     This->buf_size -= written;
 169
 170     *_retval = written;
 171     return nsres;
 172 }
 173
 174 static nsresult NSAPI nsInputStream_IsNonBlocking(nsIInputStream *iface, cpp_bool *_retval)
 175 {
 176     nsProtocolStream *This = impl_from_nsIInputStream(iface);
 177     FIXME("(%p)->(%p)\n", This, _retval);
 178     return NS_ERROR_NOT_IMPLEMENTED;
 179 }
 180
 181 static const nsIInputStreamVtbl nsInputStreamVtbl = {
 182     nsInputStream_QueryInterface,
 183     nsInputStream_AddRef,
 184     nsInputStream_Release,
 185     nsInputStream_Close,
 186     nsInputStream_Available,
 187     nsInputStream_Read,
 188     nsInputStream_ReadSegments,
 189     nsInputStream_IsNonBlocking
 190 };
 191
 192 static nsProtocolStream *create_nsprotocol_stream(void)
 193 {
 194     nsProtocolStream *ret;
 195
 196     ret = heap_alloc(sizeof(nsProtocolStream));
 197     if(!ret)
 198         return NULL;
 199
 200     ret->nsIInputStream_iface.lpVtbl = &nsInputStreamVtbl;
 201     ret->ref = 1;
 202     ret->buf_size = 0;
 203
 204     return ret;
 205 }
 206
 207 static void release_request_data(request_data_t *request_data)
 208 {
 209     if(request_data->post_stream)
 210         nsIInputStream_Release(request_data->post_stream);
 211     heap_free(request_data->headers);
 212     if(request_data->post_data)
 213         GlobalFree(request_data->post_data);
 214 }
 215
 216 static inline BSCallback *impl_from_IBindStatusCallback(IBindStatusCallback *iface)
 217 {
 218     return CONTAINING_RECORD(iface, BSCallback, IBindStatusCallback_iface);
 219 }
 220
 221 static HRESULT WINAPI BindStatusCallback_QueryInterface(IBindStatusCallback *iface,
 222         REFIID riid, void **ppv)
 223 {
 224     BSCallback *This = impl_from_IBindStatusCallback(iface);
 225
 226     *ppv = NULL;
 227     if(IsEqualGUID(&IID_IUnknown, riid)) {
 228         TRACE("(%p)->(IID_IUnknown, %p)\n", This, ppv);
 229         *ppv = &This->IBindStatusCallback_iface;
 230     }else if(IsEqualGUID(&IID_IBindStatusCallback, riid)) {
 231         TRACE("(%p)->(IID_IBindStatusCallback, %p)\n", This, ppv);
 232         *ppv = &This->IBindStatusCallback_iface;
 233     }else if(IsEqualGUID(&IID_IServiceProvider, riid)) {
 234         TRACE("(%p)->(IID_IServiceProvider %p)\n", This, ppv);
 235         *ppv = &This->IServiceProvider_iface;
 236     }else if(IsEqualGUID(&IID_IHttpNegotiate, riid)) {
 237         TRACE("(%p)->(IID_IHttpNegotiate %p)\n", This, ppv);
 238         *ppv = &This->IHttpNegotiate2_iface;
 239     }else if(IsEqualGUID(&IID_IHttpNegotiate2, riid)) {
 240         TRACE("(%p)->(IID_IHttpNegotiate2 %p)\n", This, ppv);
 241         *ppv = &This->IHttpNegotiate2_iface;
 242     }else if(IsEqualGUID(&IID_IInternetBindInfo, riid)) {
 243         TRACE("(%p)->(IID_IInternetBindInfo %p)\n", This, ppv);
 244         *ppv = &This->IInternetBindInfo_iface;
 245     }else if(IsEqualGUID(&IID_IBindCallbackRedirect, riid)) {
 246         TRACE("(%p)->(IID_IBindCallbackRedirect %p)\n", This, ppv);
 247         *ppv = &This->IBindCallbackRedirect_iface;
 248     }
 249
 250     if(*ppv) {
 251         IBindStatusCallback_AddRef(&This->IBindStatusCallback_iface);
 252         return S_OK;
 253     }
 254
 255     TRACE("Unsupported riid = %s\n", debugstr_guid(riid));
 256     return E_NOINTERFACE;
 257 }
 258
 259 static ULONG WINAPI BindStatusCallback_AddRef(IBindStatusCallback *iface)
 260 {
 261     BSCallback *This = impl_from_IBindStatusCallback(iface);
 262     LONG ref = InterlockedIncrement(&This->ref);
 263
 264     TRACE("(%p) ref = %ld\n", This, ref);
 265
 266     return ref;
 267 }
 268
 269 static ULONG WINAPI BindStatusCallback_Release(IBindStatusCallback *iface)
 270 {
 271     BSCallback *This = impl_from_IBindStatusCallback(iface);
 272     LONG ref = InterlockedDecrement(&This->ref);
 273
 274     TRACE("(%p) ref = %ld\n", This, ref);
 275
 276     if(!ref) {
 277         release_request_data(&This->request_data);
 278         if(This->mon)
 279             IMoniker_Release(This->mon);
 280         if(This->binding)
 281             IBinding_Release(This->binding);
 282         list_remove(&This->entry);
 283         list_init(&This->entry);
 284
 285         This->vtbl->destroy(This);
 286     }
 287
 288     return ref;
 289 }
 290
 291 static HRESULT WINAPI BindStatusCallback_OnStartBinding(IBindStatusCallback *iface,
 292         DWORD dwReserved, IBinding *pbind)
 293 {
 294     BSCallback *This = impl_from_IBindStatusCallback(iface);
 295
 296     TRACE("(%p)->(%ld %p)\n", This, dwReserved, pbind);
 297
 298     IBinding_AddRef(pbind);
 299     This->binding = pbind;
 300
 301     if(This->window)
 302         list_add_head(&This->window->bindings, &This->entry);
 303
 304     return This->vtbl->start_binding(This);
 305 }
 306
 307 static HRESULT WINAPI BindStatusCallback_GetPriority(IBindStatusCallback *iface, LONG *pnPriority)
 308 {
 309     BSCallback *This = impl_from_IBindStatusCallback(iface);
 310     FIXME("(%p)->(%p)\n", This, pnPriority);
 311     return E_NOTIMPL;
 312 }
 313
 314 static HRESULT WINAPI BindStatusCallback_OnLowResource(IBindStatusCallback *iface, DWORD reserved)
 315 {
 316     BSCallback *This = impl_from_IBindStatusCallback(iface);
 317     FIXME("(%p)->(%ld)\n", This, reserved);
 318     return E_NOTIMPL;
 319 }
 320
 321 static HRESULT WINAPI BindStatusCallback_OnProgress(IBindStatusCallback *iface, ULONG ulProgress,
 322         ULONG ulProgressMax, ULONG ulStatusCode, LPCWSTR szStatusText)
 323 {
 324     BSCallback *This = impl_from_IBindStatusCallback(iface);
 325
 326     TRACE("%p)->(%lu %lu %lu %s)\n", This, ulProgress, ulProgressMax, ulStatusCode,
 327             debugstr_w(szStatusText));
 328
 329     return This->vtbl->on_progress(This, ulProgress, ulProgressMax, ulStatusCode, szStatusText);
 330 }
 331
 332 static HRESULT WINAPI BindStatusCallback_OnStopBinding(IBindStatusCallback *iface,
 333         HRESULT hresult, LPCWSTR szError)
 334 {
 335     BSCallback *This = impl_from_IBindStatusCallback(iface);
 336     HRESULT hres;
 337
 338     TRACE("(%p)->(%08lx %s)\n", This, hresult, debugstr_w(szError));
 339
 340     /* NOTE: IE7 calls GetBindResult here */
 341
 342     hres = This->vtbl->stop_binding(This, hresult);
 343
 344     if(This->binding) {
 345         IBinding_Release(This->binding);
 346         This->binding = NULL;
 347     }
 348
 349     if(This->mon) {
 350         IMoniker_Release(This->mon);
 351         This->mon = NULL;
 352     }
 353
 354     list_remove(&This->entry);
 355     list_init(&This->entry);
 356     This->window = NULL;
 357
 358     return hres;
 359 }
 360
 361 static HRESULT WINAPI BindStatusCallback_GetBindInfo(IBindStatusCallback *iface,
 362         DWORD *grfBINDF, BINDINFO *pbindinfo)
 363 {
 364     BSCallback *This = impl_from_IBindStatusCallback(iface);
 365     DWORD size;
 366
 367     TRACE("(%p)->(%p %p)\n", This, grfBINDF, pbindinfo);
 368
 369     if(!This->bindinfo_ready) {
 370         HRESULT hres;
 371
 372         hres = This->vtbl->init_bindinfo(This);
 373         if(FAILED(hres))
 374             return hres;
 375
 376         This->bindinfo_ready = TRUE;
 377     }
 378
 379     *grfBINDF = This->bindf;
 380
 381     size = pbindinfo->cbSize;
 382     memset(pbindinfo, 0, size);
 383     pbindinfo->cbSize = size;
 384
 385     pbindinfo->cbstgmedData = This->request_data.post_data_len;
 386     pbindinfo->dwCodePage = CP_UTF8;
 387     pbindinfo->dwOptions = This->bindinfo_options;
 388
 389     if(This->request_data.post_data_len) {
 390         pbindinfo->dwBindVerb = BINDVERB_POST;
 391
 392         pbindinfo->stgmedData.tymed = TYMED_HGLOBAL;
 393         pbindinfo->stgmedData.u.hGlobal = This->request_data.post_data;
 394         pbindinfo->stgmedData.pUnkForRelease = (IUnknown*)&This->IBindStatusCallback_iface;
 395         IBindStatusCallback_AddRef(&This->IBindStatusCallback_iface);
 396     }
 397
 398     return S_OK;
 399 }
 400
 401 static HRESULT WINAPI BindStatusCallback_OnDataAvailable(IBindStatusCallback *iface,
 402         DWORD grfBSCF, DWORD dwSize, FORMATETC *pformatetc, STGMEDIUM *pstgmed)
 403 {
 404     BSCallback *This = impl_from_IBindStatusCallback(iface);
 405
 406     TRACE("(%p)->(%08lx %ld %p %p)\n", This, grfBSCF, dwSize, pformatetc, pstgmed);
 407
 408     return This->vtbl->read_data(This, pstgmed->u.pstm);
 409 }
 410
 411 static HRESULT WINAPI BindStatusCallback_OnObjectAvailable(IBindStatusCallback *iface,
 412         REFIID riid, IUnknown *punk)
 413 {
 414     BSCallback *This = impl_from_IBindStatusCallback(iface);
 415     FIXME("(%p)->(%s %p)\n", This, debugstr_guid(riid), punk);
 416     return E_NOTIMPL;
 417 }
 418
 419 static const IBindStatusCallbackVtbl BindStatusCallbackVtbl = {
 420     BindStatusCallback_QueryInterface,
 421     BindStatusCallback_AddRef,
 422     BindStatusCallback_Release,
 423     BindStatusCallback_OnStartBinding,
 424     BindStatusCallback_GetPriority,
 425     BindStatusCallback_OnLowResource,
 426     BindStatusCallback_OnProgress,
 427     BindStatusCallback_OnStopBinding,
 428     BindStatusCallback_GetBindInfo,
 429     BindStatusCallback_OnDataAvailable,
 430     BindStatusCallback_OnObjectAvailable
 431 };
 432
 433 static inline BSCallback *impl_from_IHttpNegotiate2(IHttpNegotiate2 *iface)
 434 {
 435     return CONTAINING_RECORD(iface, BSCallback, IHttpNegotiate2_iface);
 436 }
 437
 438 static HRESULT WINAPI HttpNegotiate_QueryInterface(IHttpNegotiate2 *iface,
 439                                                    REFIID riid, void **ppv)
 440 {
 441     BSCallback *This = impl_from_IHttpNegotiate2(iface);
 442     return IBindStatusCallback_QueryInterface(&This->IBindStatusCallback_iface, riid, ppv);
 443 }
 444
 445 static ULONG WINAPI HttpNegotiate_AddRef(IHttpNegotiate2 *iface)
 446 {
 447     BSCallback *This = impl_from_IHttpNegotiate2(iface);
 448     return IBindStatusCallback_AddRef(&This->IBindStatusCallback_iface);
 449 }
 450
 451 static ULONG WINAPI HttpNegotiate_Release(IHttpNegotiate2 *iface)
 452 {
 453     BSCallback *This = impl_from_IHttpNegotiate2(iface);
 454     return IBindStatusCallback_Release(&This->IBindStatusCallback_iface);
 455 }
 456
 457 static HRESULT WINAPI HttpNegotiate_BeginningTransaction(IHttpNegotiate2 *iface,
 458         LPCWSTR szURL, LPCWSTR szHeaders, DWORD dwReserved, LPWSTR *pszAdditionalHeaders)
 459 {
 460     BSCallback *This = impl_from_IHttpNegotiate2(iface);
 461     HRESULT hres;
 462
 463     TRACE("(%p)->(%s %s %ld %p)\n", This, debugstr_w(szURL), debugstr_w(szHeaders),
 464           dwReserved, pszAdditionalHeaders);
 465
 466     *pszAdditionalHeaders = NULL;
 467
 468     hres = This->vtbl->beginning_transaction(This, pszAdditionalHeaders);
 469     if(hres != S_FALSE)
 470         return hres;
 471
 472     if(This->request_data.headers) {
 473         DWORD size;
 474
 475         size = (lstrlenW(This->request_data.headers)+1)*sizeof(WCHAR);
 476         *pszAdditionalHeaders = CoTaskMemAlloc(size);
 477         if(!*pszAdditionalHeaders)
 478             return E_OUTOFMEMORY;
 479         memcpy(*pszAdditionalHeaders, This->request_data.headers, size);
 480     }
 481
 482     return S_OK;
 483 }
 484
 485 static HRESULT WINAPI HttpNegotiate_OnResponse(IHttpNegotiate2 *iface, DWORD dwResponseCode,
 486         LPCWSTR szResponseHeaders, LPCWSTR szRequestHeaders, LPWSTR *pszAdditionalRequestHeaders)
 487 {
 488     BSCallback *This = impl_from_IHttpNegotiate2(iface);
 489
 490     TRACE("(%p)->(%ld %s %s %p)\n", This, dwResponseCode, debugstr_w(szResponseHeaders),
 491           debugstr_w(szRequestHeaders), pszAdditionalRequestHeaders);
 492
 493     return This->vtbl->on_response(This, dwResponseCode, szResponseHeaders);
 494 }
 495
 496 static HRESULT WINAPI HttpNegotiate_GetRootSecurityId(IHttpNegotiate2 *iface,
 497         BYTE *pbSecurityId, DWORD *pcbSecurityId, DWORD_PTR dwReserved)
 498 {
 499     BSCallback *This = impl_from_IHttpNegotiate2(iface);
 500     TRACE("(%p)->(%p %p %Id)\n", This, pbSecurityId, pcbSecurityId, dwReserved);
 501     return E_NOTIMPL; /* FIXME */
 502 }
 503
 504 static const IHttpNegotiate2Vtbl HttpNegotiate2Vtbl = {
 505     HttpNegotiate_QueryInterface,
 506     HttpNegotiate_AddRef,
 507     HttpNegotiate_Release,
 508     HttpNegotiate_BeginningTransaction,
 509     HttpNegotiate_OnResponse,
 510     HttpNegotiate_GetRootSecurityId
 511 };
 512
 513 static inline BSCallback *impl_from_IInternetBindInfo(IInternetBindInfo *iface)
 514 {
 515     return CONTAINING_RECORD(iface, BSCallback, IInternetBindInfo_iface);
 516 }
 517
 518 static HRESULT WINAPI InternetBindInfo_QueryInterface(IInternetBindInfo *iface,
 519                                                       REFIID riid, void **ppv)
 520 {
 521     BSCallback *This = impl_from_IInternetBindInfo(iface);
 522     return IBindStatusCallback_QueryInterface(&This->IBindStatusCallback_iface, riid, ppv);
 523 }
 524
 525 static ULONG WINAPI InternetBindInfo_AddRef(IInternetBindInfo *iface)
 526 {
 527     BSCallback *This = impl_from_IInternetBindInfo(iface);
 528     return IBindStatusCallback_AddRef(&This->IBindStatusCallback_iface);
 529 }
 530
 531 static ULONG WINAPI InternetBindInfo_Release(IInternetBindInfo *iface)
 532 {
 533     BSCallback *This = impl_from_IInternetBindInfo(iface);
 534     return IBindStatusCallback_Release(&This->IBindStatusCallback_iface);
 535 }
 536
 537 static HRESULT WINAPI InternetBindInfo_GetBindInfo(IInternetBindInfo *iface,
 538                                                    DWORD *grfBINDF, BINDINFO *pbindinfo)
 539 {
 540     BSCallback *This = impl_from_IInternetBindInfo(iface);
 541     FIXME("(%p)->(%p %p)\n", This, grfBINDF, pbindinfo);
 542     return E_NOTIMPL;
 543 }
 544
 545 static HRESULT WINAPI InternetBindInfo_GetBindString(IInternetBindInfo *iface,
 546         ULONG ulStringType, LPOLESTR *ppwzStr, ULONG cEl, ULONG *pcElFetched)
 547 {
 548     BSCallback *This = impl_from_IInternetBindInfo(iface);
 549     FIXME("(%p)->(%lu %p %lu %p)\n", This, ulStringType, ppwzStr, cEl, pcElFetched);
 550     return E_NOTIMPL;
 551 }
 552
 553 static const IInternetBindInfoVtbl InternetBindInfoVtbl = {
 554     InternetBindInfo_QueryInterface,
 555     InternetBindInfo_AddRef,
 556     InternetBindInfo_Release,
 557     InternetBindInfo_GetBindInfo,
 558     InternetBindInfo_GetBindString
 559 };
 560
 561 static inline BSCallback *impl_from_IBindCallbackRedirect(IBindCallbackRedirect *iface)
 562 {
 563     return CONTAINING_RECORD(iface, BSCallback, IBindCallbackRedirect_iface);
 564 }
 565
 566 static HRESULT WINAPI BindCallbackRedirect_QueryInterface(IBindCallbackRedirect *iface, REFIID riid, void **ppv)
 567 {
 568     BSCallback *This = impl_from_IBindCallbackRedirect(iface);
 569     return IBindStatusCallback_QueryInterface(&This->IBindStatusCallback_iface, riid, ppv);
 570 }
 571
 572 static ULONG WINAPI BindCallbackRedirect_AddRef(IBindCallbackRedirect *iface)
 573 {
 574     BSCallback *This = impl_from_IBindCallbackRedirect(iface);
 575     return IBindStatusCallback_AddRef(&This->IBindStatusCallback_iface);
 576 }
 577
 578 static ULONG WINAPI BindCallbackRedirect_Release(IBindCallbackRedirect *iface)
 579 {
 580     BSCallback *This = impl_from_IBindCallbackRedirect(iface);
 581     return IBindStatusCallback_Release(&This->IBindStatusCallback_iface);
 582 }
 583
 584 static HRESULT WINAPI BindCallbackRedirect_Redirect(IBindCallbackRedirect *iface, const WCHAR *url, VARIANT_BOOL *vbCancel)
 585 {
 586     BSCallback *This = impl_from_IBindCallbackRedirect(iface);
 587     GeckoBrowser *browser;
 588     BOOL cancel = FALSE;
 589     BSTR frame_name = NULL;
 590     HRESULT hres = S_OK;
 591
 592     TRACE("(%p)->(%s %p)\n", This, debugstr_w(url), vbCancel);
 593
 594     if(This->window && This->window->base.outer_window && (browser = This->window->base.outer_window->browser)
 595        && browser->doc->doc_object_service) {
 596         if(is_main_content_window(This->window->base.outer_window)) {
 597             hres = IHTMLWindow2_get_name(&This->window->base.IHTMLWindow2_iface, &frame_name);
 598             if(FAILED(hres))
 599                 return hres;
 600         }
 601
 602         hres = IDocObjectService_FireBeforeNavigate2(browser->doc->doc_object_service, NULL, url, 0x40,
 603                                                      frame_name, NULL, 0, NULL, TRUE, &cancel);
 604         SysFreeString(frame_name);
 605     }
 606
 607     *vbCancel = variant_bool(cancel);
 608     return hres;
 609 }
 610
 611 static const IBindCallbackRedirectVtbl BindCallbackRedirectVtbl = {
 612     BindCallbackRedirect_QueryInterface,
 613     BindCallbackRedirect_AddRef,
 614     BindCallbackRedirect_Release,
 615     BindCallbackRedirect_Redirect
 616 };
 617
 618 static inline BSCallback *impl_from_IServiceProvider(IServiceProvider *iface)
 619 {
 620     return CONTAINING_RECORD(iface, BSCallback, IServiceProvider_iface);
 621 }
 622
 623 static HRESULT WINAPI BSCServiceProvider_QueryInterface(IServiceProvider *iface,
 624                                                         REFIID riid, void **ppv)
 625 {
 626     BSCallback *This = impl_from_IServiceProvider(iface);
 627     return IBindStatusCallback_QueryInterface(&This->IBindStatusCallback_iface, riid, ppv);
 628 }
 629
 630 static ULONG WINAPI BSCServiceProvider_AddRef(IServiceProvider *iface)
 631 {
 632     BSCallback *This = impl_from_IServiceProvider(iface);
 633     return IBindStatusCallback_AddRef(&This->IBindStatusCallback_iface);
 634 }
 635
 636 static ULONG WINAPI BSCServiceProvider_Release(IServiceProvider *iface)
 637 {
 638     BSCallback *This = impl_from_IServiceProvider(iface);
 639     return IBindStatusCallback_Release(&This->IBindStatusCallback_iface);
 640 }
 641
 642 static HRESULT WINAPI BSCServiceProvider_QueryService(IServiceProvider *iface,
 643         REFGUID guidService, REFIID riid, void **ppv)
 644 {
 645     BSCallback *This = impl_from_IServiceProvider(iface);
 646
 647     TRACE("(%p)->(%s %s %p)\n", This, debugstr_guid(guidService), debugstr_guid(riid), ppv);
 648
 649     if(This->window && IsEqualGUID(guidService, &IID_IWindowForBindingUI))
 650         return IServiceProvider_QueryService(&This->window->base.IServiceProvider_iface, guidService, riid, ppv);
 651     return E_NOINTERFACE;
 652 }
 653
 654 static const IServiceProviderVtbl ServiceProviderVtbl = {
 655     BSCServiceProvider_QueryInterface,
 656     BSCServiceProvider_AddRef,
 657     BSCServiceProvider_Release,
 658     BSCServiceProvider_QueryService
 659 };
 660
 661 void init_bscallback(BSCallback *This, const BSCallbackVtbl *vtbl, IMoniker *mon, DWORD bindf)
 662 {
 663     This->IBindStatusCallback_iface.lpVtbl = &BindStatusCallbackVtbl;
 664     This->IServiceProvider_iface.lpVtbl = &ServiceProviderVtbl;
 665     This->IHttpNegotiate2_iface.lpVtbl = &HttpNegotiate2Vtbl;
 666     This->IInternetBindInfo_iface.lpVtbl = &InternetBindInfoVtbl;
 667     This->IBindCallbackRedirect_iface.lpVtbl = &BindCallbackRedirectVtbl;
 668     This->vtbl = vtbl;
 669     This->ref = 1;
 670     This->bindf = bindf;
 671     This->bindinfo_options = BINDINFO_OPTIONS_USE_IE_ENCODING;
 672     This->bom = BOM_NONE;
 673
 674     list_init(&This->entry);
 675
 676     if(mon)
 677         IMoniker_AddRef(mon);
 678     This->mon = mon;
 679 }
 680
 681 HRESULT read_stream(BSCallback *This, IStream *stream, void *buf, DWORD size, DWORD *ret_size)
 682 {
 683     DWORD read_size = 0, skip=0;
 684     BYTE *data = buf;
 685     HRESULT hres;
 686
 687     hres = IStream_Read(stream, buf, size, &read_size);
 688
 689     if(!This->read && This->bom == BOM_NONE) {
 690         if(read_size >= 2 && data[0] == 0xff && data[1] == 0xfe) {
 691             This->bom = BOM_UTF16;
 692             skip = 2;
 693         }else if(read_size >= 3 && data[0] == 0xef && data[1] == 0xbb && data[2] == 0xbf) {
 694             This->bom = BOM_UTF8;
 695             skip = 3;
 696         }
 697         if(skip) {
 698             read_size -= skip;
 699             if(read_size)
 700                 memmove(data, data+skip, read_size);
 701         }
 702     }
 703
 704     This->read += read_size;
 705     *ret_size = read_size;
 706     return hres;
 707 }
 708
 709 static void parse_content_type(nsChannelBSC *This, const WCHAR *value)
 710 {
 711     const WCHAR *ptr, *beg, *end;
 712     size_t len = wcslen(value);
 713     char *content_type;
 714
 715     static const WCHAR charsetW[] = {'c','h','a','r','s','e','t','='};
 716
 717     ptr = wcschr(value, ';');
 718
 719     if(!This->nschannel->content_type || !(This->nschannel->load_flags & LOAD_CALL_CONTENT_SNIFFERS)) {
 720         for(end = ptr ? ptr : value + len; end > value; end--)
 721             if(!iswspace(end[-1]))
 722                 break;
 723         for(beg = value; beg < end; beg++)
 724             if(!iswspace(*beg))
 725                 break;
 726
 727         if((content_type = heap_strndupWtoU(beg, end - beg))) {
 728             heap_free(This->nschannel->content_type);
 729             This->nschannel->content_type = content_type;
 730             strlwr(content_type);
 731         }
 732     }
 733
 734     if(!ptr)
 735         return;
 736
 737     ptr++;
 738     while(*ptr && iswspace(*ptr))
 739         ptr++;
 740
 741     if(ptr + ARRAY_SIZE(charsetW) < value+len && !wcsnicmp(ptr, charsetW, ARRAY_SIZE(charsetW))) {
 742         size_t charset_len, lena;
 743         nsACString charset_str;
 744         const WCHAR *charset;
 745         char *charseta;
 746
 747         ptr += ARRAY_SIZE(charsetW);
 748
 749         if(*ptr == '\'') {
 750             FIXME("Quoted value\n");
 751             return;
 752         }else {
 753             charset = ptr;
 754             while(*ptr && *ptr != ',')
 755                 ptr++;
 756             charset_len = ptr-charset;
 757         }
 758
 759         lena = WideCharToMultiByte(CP_ACP, 0, charset, charset_len, NULL, 0, NULL, NULL);
 760         charseta = heap_alloc(lena+1);
 761         if(!charseta)
 762             return;
 763
 764         WideCharToMultiByte(CP_ACP, 0, charset, charset_len, charseta, lena, NULL, NULL);
 765         charseta[lena] = 0;
 766
 767         nsACString_InitDepend(&charset_str, charseta);
 768         nsIHttpChannel_SetContentCharset(&This->nschannel->nsIHttpChannel_iface, &charset_str);
 769         nsACString_Finish(&charset_str);
 770         heap_free(charseta);
 771     }else {
 772         FIXME("unhandled: %s\n", debugstr_wn(ptr, len - (ptr-value)));
 773     }
 774 }
 775
 776 static HRESULT parse_headers(const WCHAR *headers, struct list *headers_list)
 777 {
 778     const WCHAR *header, *header_end, *colon, *value;
 779     HRESULT hres;
 780
 781     header = headers;
 782     while(*header) {
 783         if(header[0] == '\r' && header[1] == '\n' && !header[2])
 784             break;
 785         for(colon = header; *colon && *colon != ':' && *colon != '\r'; colon++);
 786         if(*colon != ':')
 787             return E_FAIL;
 788
 789         value = colon+1;
 790         while(*value == ' ')
 791             value++;
 792         if(!*value)
 793             return E_FAIL;
 794
 795         for(header_end = value+1; *header_end && *header_end != '\r'; header_end++);
 796
 797         hres = set_http_header(headers_list, header, colon-header, value, header_end-value);
 798         if(FAILED(hres))
 799             return hres;
 800
 801         header = header_end;
 802         if(header[0] == '\r' && header[1] == '\n')
 803             header += 2;
 804     }
 805
 806     return S_OK;
 807 }
 808
 809 static HRESULT process_response_headers(nsChannelBSC *This, const WCHAR *headers)
 810 {
 811     http_header_t *iter;
 812     HRESULT hres;
 813
 814     hres = parse_headers(headers, &This->nschannel->response_headers);
 815     if(FAILED(hres))
 816         return hres;
 817
 818     LIST_FOR_EACH_ENTRY(iter, &This->nschannel->response_headers, http_header_t, entry) {
 819         if(!wcsicmp(iter->header, L"content-type"))
 820             parse_content_type(This, iter->data);
 821     }
 822
 823     return S_OK;
 824 }
 825
 826 static void query_http_info(nsChannelBSC *This, IWinInetHttpInfo *wininet_info)
 827 {
 828     const WCHAR *ptr;
 829     DWORD len = 0;
 830     WCHAR *buf;
 831
 832     IWinInetHttpInfo_QueryInfo(wininet_info, HTTP_QUERY_RAW_HEADERS_CRLF, NULL, &len, NULL, NULL);
 833     if(!len)
 834         return;
 835
 836     buf = heap_alloc(len);
 837     if(!buf)
 838         return;
 839
 840     IWinInetHttpInfo_QueryInfo(wininet_info, HTTP_QUERY_RAW_HEADERS_CRLF, buf, &len, NULL, NULL);
 841     if(!len) {
 842         heap_free(buf);
 843         return;
 844     }
 845
 846     ptr = wcschr(buf, '\r');
 847     if(ptr && ptr[1] == '\n') {
 848         ptr += 2;
 849         process_response_headers(This, ptr);
 850     }
 851
 852     heap_free(buf);
 853 }
 854
 855 HRESULT start_binding(HTMLInnerWindow *inner_window, BSCallback *bscallback, IBindCtx *bctx)
 856 {
 857     IStream *str = NULL;
 858     HRESULT hres;
 859
 860     TRACE("(%p %p %p)\n", inner_window, bscallback, bctx);
 861
 862     bscallback->window = inner_window;
 863
 864     /* NOTE: IE7 calls IsSystemMoniker here*/
 865
 866     if(bctx) {
 867         hres = RegisterBindStatusCallback(bctx, &bscallback->IBindStatusCallback_iface, NULL, 0);
 868         if(SUCCEEDED(hres))
 869             IBindCtx_AddRef(bctx);
 870     }else {
 871         hres = CreateAsyncBindCtx(0, &bscallback->IBindStatusCallback_iface, NULL, &bctx);
 872     }
 873
 874     if(FAILED(hres)) {
 875         bscallback->window = NULL;
 876         return hres;
 877     }
 878
 879     hres = IMoniker_BindToStorage(bscallback->mon, bctx, NULL, &IID_IStream, (void**)&str);
 880     IBindCtx_Release(bctx);
 881     if(FAILED(hres)) {
 882         WARN("BindToStorage failed: %08lx\n", hres);
 883         bscallback->window = NULL;
 884         return hres;
 885     }
 886
 887     if(str)
 888         IStream_Release(str);
 889
 890     return S_OK;
 891 }
 892
 893 static HRESULT read_post_data_stream(nsIInputStream *stream, BOOL contains_headers, struct list *headers_list,
 894         request_data_t *request_data)
 895 {
 896     nsISeekableStream *seekable_stream;
 897     UINT64 available = 0;
 898     UINT32 data_len = 0;
 899     char *data, *post_data;
 900     nsresult nsres;
 901     HRESULT hres = S_OK;
 902
 903     if(!stream)
 904         return S_OK;
 905
 906     nsres =  nsIInputStream_Available(stream, &available);
 907     if(NS_FAILED(nsres))
 908         return E_FAIL;
 909
 910     post_data = data = GlobalAlloc(0, available+1);
 911     if(!data)
 912         return E_OUTOFMEMORY;
 913
 914     nsres = nsIInputStream_Read(stream, data, available, &data_len);
 915     if(NS_FAILED(nsres)) {
 916         GlobalFree(data);
 917         return E_FAIL;
 918     }
 919
 920     if(contains_headers) {
 921         if(data_len >= 2 && data[0] == '\r' && data[1] == '\n') {
 922             post_data = data+2;
 923             data_len -= 2;
 924         }else {
 925             WCHAR *headers;
 926             DWORD size;
 927             char *ptr;
 928
 929             post_data += data_len;
 930             for(ptr = data; ptr+4 < data+data_len; ptr++) {
 931                 if(!memcmp(ptr, "\r\n\r\n", 4)) {
 932                     ptr += 2;
 933                     post_data = ptr+2;
 934                     break;
 935                 }
 936             }
 937
 938             data_len -= post_data-data;
 939
 940             size = MultiByteToWideChar(CP_ACP, 0, data, ptr-data, NULL, 0);
 941             headers = heap_alloc((size+1)*sizeof(WCHAR));
 942             if(headers) {
 943                 MultiByteToWideChar(CP_ACP, 0, data, ptr-data, headers, size);
 944                 headers[size] = 0;
 945                 if(headers_list)
 946                     hres = parse_headers(headers, headers_list);
 947                 if(SUCCEEDED(hres))
 948                     request_data->headers = headers;
 949                 else
 950                     heap_free(headers);
 951             }else {
 952                 hres = E_OUTOFMEMORY;
 953             }
 954         }
 955     }
 956
 957     if(FAILED(hres)) {
 958         GlobalFree(data);
 959         return hres;
 960     }
 961
 962     if(!data_len) {
 963         GlobalFree(data);
 964         post_data = NULL;
 965     }else if(post_data != data) {
 966         char *new_data;
 967
 968         new_data = GlobalAlloc(0, data_len+1);
 969         if(new_data)
 970             memcpy(new_data, post_data, data_len);
 971         GlobalFree(data);
 972         if(!new_data)
 973             return E_OUTOFMEMORY;
 974         post_data = new_data;
 975     }
 976
 977     if(post_data)
 978         post_data[data_len] = 0;
 979     request_data->post_data = post_data;
 980     request_data->post_data_len = data_len;
 981
 982     nsres = nsIInputStream_QueryInterface(stream, &IID_nsISeekableStream, (void**)&seekable_stream);
 983     assert(nsres == NS_OK);
 984
 985     nsres = nsISeekableStream_Seek(seekable_stream, NS_SEEK_SET, 0);
 986     assert(nsres == NS_OK);
 987
 988     nsISeekableStream_Release(seekable_stream);
 989
 990     nsIInputStream_AddRef(stream);
 991     request_data->post_stream = stream;
 992     TRACE("post_data = %s\n", debugstr_an(request_data->post_data, request_data->post_data_len));
 993     return S_OK;
 994 }
 995
 996 static HRESULT on_start_nsrequest(nsChannelBSC *This)
 997 {
 998     nsresult nsres;
 999
1000     /* Async request can be cancelled before we got to it */
1001     if(NS_FAILED(This->nschannel->status))
1002         return E_ABORT; /* FIXME: map status to HRESULT */
1003
1004     This->nschannel->binding = This;
1005
1006     /* FIXME: it's needed for http connections from BindToObject. */
1007     if(!This->nschannel->response_status)
1008         This->nschannel->response_status = 200;
1009
1010     nsres = nsIStreamListener_OnStartRequest(This->nslistener,
1011             (nsIRequest*)&This->nschannel->nsIHttpChannel_iface, This->nscontext);
1012     if(NS_FAILED(nsres)) {
1013         FIXME("OnStartRequest failed: %08lx\n", nsres);
1014         return E_FAIL;
1015     }
1016
1017     if(This->is_doc_channel) {
1018         HRESULT hres;
1019
1020         if(!This->bsc.window)
1021             return E_ABORT; /* Binding aborted in OnStartRequest call. */
1022         hres = update_window_doc(This->bsc.window);
1023         if(FAILED(hres))
1024             return hres;
1025
1026         if(This->bsc.binding)
1027             process_document_response_headers(This->bsc.window->doc, This->bsc.binding);
1028         if(This->bsc.window->base.outer_window->readystate != READYSTATE_LOADING)
1029             set_ready_state(This->bsc.window->base.outer_window, READYSTATE_LOADING);
1030     }
1031
1032     return S_OK;
1033 }
1034
1035 static void on_stop_nsrequest(nsChannelBSC *This, HRESULT result)
1036 {
1037     nsresult nsres, request_result;
1038
1039     switch(result) {
1040     case S_OK:
1041         request_result = NS_OK;
1042         break;
1043     case E_ABORT:
1044         request_result = NS_BINDING_ABORTED;
1045         break;
1046     default:
1047         request_result = NS_ERROR_FAILURE;
1048     }
1049
1050     if(This->nslistener) {
1051         nsres = nsIStreamListener_OnStopRequest(This->nslistener,
1052                  (nsIRequest*)&This->nschannel->nsIHttpChannel_iface, This->nscontext,
1053                  request_result);
1054         if(NS_FAILED(nsres))
1055             WARN("OnStopRequest failed: %08lx\n", nsres);
1056     }
1057
1058     if(This->nschannel) {
1059         if(This->nschannel->load_group) {
1060             nsres = nsILoadGroup_RemoveRequest(This->nschannel->load_group,
1061                     (nsIRequest*)&This->nschannel->nsIHttpChannel_iface, NULL, request_result);
1062             if(NS_FAILED(nsres))
1063                 ERR("RemoveRequest failed: %08lx\n", nsres);
1064         }
1065         if(This->nschannel->binding == This)
1066             This->nschannel->binding = NULL;
1067     }
1068 }
1069
1070 static void notify_progress(nsChannelBSC *This)
1071 {
1072     nsChannel *nschannel = This->nschannel;
1073     nsIProgressEventSink *sink = NULL;
1074     nsresult nsres;
1075
1076     if(!nschannel)
1077         return;
1078
1079     if(nschannel->notif_callback)
1080         if(NS_FAILED(nsIInterfaceRequestor_GetInterface(nschannel->notif_callback, &IID_nsIProgressEventSink, (void**)&sink)))
1081             sink = NULL;
1082
1083     if(!sink && nschannel->load_group) {
1084         nsIRequestObserver *req_observer;
1085
1086         if(NS_SUCCEEDED(nsILoadGroup_GetGroupObserver(nschannel->load_group, &req_observer)) && req_observer) {
1087             nsres = nsIRequestObserver_QueryInterface(req_observer, &IID_nsIProgressEventSink, (void**)&sink);
1088             nsIRequestObserver_Release(req_observer);
1089             if(NS_FAILED(nsres))
1090                 sink = NULL;
1091         }
1092     }
1093
1094     if(sink) {
1095         nsIProgressEventSink_OnProgress(sink, (nsIRequest*)&nschannel->nsIHttpChannel_iface, This->nscontext,
1096                                         This->progress, (This->total == ~0) ? -1 : This->total);
1097         nsIProgressEventSink_Release(sink);
1098     }
1099 }
1100
1101 static HRESULT read_stream_data(nsChannelBSC *This, IStream *stream)
1102 {
1103     DWORD read;
1104     nsresult nsres;
1105     HRESULT hres;
1106
1107     if(!This->response_processed) {
1108         IWinInetHttpInfo *wininet_info;
1109
1110         This->response_processed = TRUE;
1111         if(This->bsc.binding) {
1112             hres = IBinding_QueryInterface(This->bsc.binding, &IID_IWinInetHttpInfo, (void**)&wininet_info);
1113             if(SUCCEEDED(hres)) {
1114                 query_http_info(This, wininet_info);
1115                 IWinInetHttpInfo_Release(wininet_info);
1116             }
1117         }
1118     }
1119
1120     if(!This->nschannel)
1121         return S_OK;
1122
1123     if(!This->nslistener) {
1124         BYTE buf[1024];
1125
1126         do {
1127             hres = read_stream(&This->bsc, stream, buf, sizeof(buf), &read);
1128         }while(hres == S_OK && read);
1129
1130         return S_OK;
1131     }
1132
1133     if(!This->nsstream) {
1134         This->nsstream = create_nsprotocol_stream();
1135         if(!This->nsstream)
1136             return E_OUTOFMEMORY;
1137     }
1138
1139     do {
1140         BOOL first_read = !This->bsc.read;
1141
1142         hres = read_stream(&This->bsc, stream, This->nsstream->buf+This->nsstream->buf_size,
1143                 sizeof(This->nsstream->buf)-This->nsstream->buf_size, &read);
1144         if(!read)
1145             break;
1146
1147         This->nsstream->buf_size += read;
1148
1149         if(first_read) {
1150             switch(This->bsc.bom) {
1151             case BOM_UTF8:
1152                 This->nschannel->charset = heap_strdupA(UTF8_STR);
1153                 break;
1154             case BOM_UTF16:
1155                 This->nschannel->charset = heap_strdupA(UTF16_STR);
1156             case BOM_NONE:
1157                 /* FIXME: Get charset from HTTP headers */;
1158             }
1159
1160             if(!This->nschannel->content_type) {
1161                 WCHAR *mime;
1162
1163                 hres = FindMimeFromData(NULL, NULL, This->nsstream->buf, This->nsstream->buf_size,
1164                         This->is_doc_channel ? L"text/html" : NULL, 0, &mime, 0);
1165                 if(FAILED(hres))
1166                     return hres;
1167
1168                 TRACE("Found MIME %s\n", debugstr_w(mime));
1169
1170                 This->nschannel->content_type = heap_strdupWtoA(mime);
1171                 CoTaskMemFree(mime);
1172                 if(!This->nschannel->content_type)
1173                     return E_OUTOFMEMORY;
1174             }
1175
1176             hres = on_start_nsrequest(This);
1177             if(FAILED(hres))
1178                 return hres;
1179         }
1180
1181         notify_progress(This);
1182
1183         nsres = nsIStreamListener_OnDataAvailable(This->nslistener,
1184                 (nsIRequest*)&This->nschannel->nsIHttpChannel_iface, This->nscontext,
1185                 &This->nsstream->nsIInputStream_iface, This->bsc.read-This->nsstream->buf_size,
1186                 This->nsstream->buf_size);
1187         if(NS_FAILED(nsres))
1188             ERR("OnDataAvailable failed: %08lx\n", nsres);
1189
1190         if(This->nsstream->buf_size == sizeof(This->nsstream->buf)) {
1191             ERR("buffer is full\n");
1192             break;
1193         }
1194     }while(hres == S_OK);
1195
1196     return S_OK;
1197 }
1198
1199 typedef struct {
1200     nsIAsyncVerifyRedirectCallback nsIAsyncVerifyRedirectCallback_iface;
1201
1202     LONG ref;
1203
1204     nsChannel *nschannel;
1205     nsChannelBSC *bsc;
1206 } nsRedirectCallback;
1207
1208 static nsRedirectCallback *impl_from_nsIAsyncVerifyRedirectCallback(nsIAsyncVerifyRedirectCallback *iface)
1209 {
1210     return CONTAINING_RECORD(iface, nsRedirectCallback, nsIAsyncVerifyRedirectCallback_iface);
1211 }
1212
1213 static nsresult NSAPI nsAsyncVerifyRedirectCallback_QueryInterface(nsIAsyncVerifyRedirectCallback *iface,
1214         nsIIDRef riid, void **result)
1215 {
1216     nsRedirectCallback *This = impl_from_nsIAsyncVerifyRedirectCallback(iface);
1217
1218     if(IsEqualGUID(&IID_nsISupports, riid)) {
1219         TRACE("(%p)->(IID_nsISupports %p)\n", This, result);
1220         *result = &This->nsIAsyncVerifyRedirectCallback_iface;
1221     }else if(IsEqualGUID(&IID_nsIAsyncVerifyRedirectCallback, riid)) {
1222         TRACE("(%p)->(IID_nsIAsyncVerifyRedirectCallback %p)\n", This, result);
1223         *result = &This->nsIAsyncVerifyRedirectCallback_iface;
1224     }else {
1225         *result = NULL;
1226         WARN("unimplemented iface %s\n", debugstr_guid(riid));
1227         return NS_NOINTERFACE;
1228     }
1229
1230     nsISupports_AddRef((nsISupports*)*result);
1231     return NS_OK;
1232 }
1233
1234 static nsrefcnt NSAPI nsAsyncVerifyRedirectCallback_AddRef(nsIAsyncVerifyRedirectCallback *iface)
1235 {
1236     nsRedirectCallback *This = impl_from_nsIAsyncVerifyRedirectCallback(iface);
1237     LONG ref = InterlockedIncrement(&This->ref);
1238
1239     TRACE("(%p) ref=%ld\n", This, ref);
1240
1241     return ref;
1242 }
1243
1244 static nsrefcnt NSAPI nsAsyncVerifyRedirectCallback_Release(nsIAsyncVerifyRedirectCallback *iface)
1245 {
1246     nsRedirectCallback *This = impl_from_nsIAsyncVerifyRedirectCallback(iface);
1247     LONG ref = InterlockedDecrement(&This->ref);
1248
1249     TRACE("(%p) ref=%ld\n", This, ref);
1250
1251     if(!ref) {
1252         IBindStatusCallback_Release(&This->bsc->bsc.IBindStatusCallback_iface);
1253         nsIHttpChannel_Release(&This->nschannel->nsIHttpChannel_iface);
1254         heap_free(This);
1255     }
1256
1257     return ref;
1258 }
1259
1260 static nsresult NSAPI nsAsyncVerifyRedirectCallback_OnRedirectVerifyCallback(nsIAsyncVerifyRedirectCallback *iface, nsresult result)
1261 {
1262     nsRedirectCallback *This = impl_from_nsIAsyncVerifyRedirectCallback(iface);
1263     nsChannel *old_nschannel;
1264     nsresult nsres;
1265
1266     TRACE("(%p)->(%08lx)\n", This, result);
1267
1268     old_nschannel = This->bsc->nschannel;
1269     nsIHttpChannel_AddRef(&This->nschannel->nsIHttpChannel_iface);
1270     This->bsc->nschannel = This->nschannel;
1271
1272     if(This->nschannel->load_group) {
1273         nsres = nsILoadGroup_AddRequest(This->nschannel->load_group, (nsIRequest*)&This->nschannel->nsIHttpChannel_iface,
1274                 NULL);
1275         if(NS_FAILED(nsres))
1276             ERR("AddRequest failed: %08lx\n", nsres);
1277     }
1278
1279     if(This->bsc->is_doc_channel && This->bsc->bsc.window && This->bsc->bsc.window->base.outer_window) {
1280         IUri *uri = nsuri_get_uri(This->nschannel->uri);
1281
1282         if(uri) {
1283             set_current_uri(This->bsc->bsc.window->base.outer_window, uri);
1284             IUri_Release(uri);
1285         }else {
1286             WARN("Could not get IUri from nsWineURI\n");
1287         }
1288     }
1289
1290     if(old_nschannel) {
1291         if(old_nschannel->load_group) {
1292             nsres = nsILoadGroup_RemoveRequest(old_nschannel->load_group,
1293                     (nsIRequest*)&old_nschannel->nsIHttpChannel_iface, NULL, NS_OK);
1294             if(NS_FAILED(nsres))
1295                 ERR("RemoveRequest failed: %08lx\n", nsres);
1296         }
1297         nsIHttpChannel_Release(&old_nschannel->nsIHttpChannel_iface);
1298     }
1299
1300     return NS_OK;
1301 }
1302
1303 static const nsIAsyncVerifyRedirectCallbackVtbl nsAsyncVerifyRedirectCallbackVtbl = {
1304     nsAsyncVerifyRedirectCallback_QueryInterface,
1305     nsAsyncVerifyRedirectCallback_AddRef,
1306     nsAsyncVerifyRedirectCallback_Release,
1307     nsAsyncVerifyRedirectCallback_OnRedirectVerifyCallback
1308 };
1309
1310 static HRESULT create_redirect_callback(nsChannel *nschannel, nsChannelBSC *bsc, nsRedirectCallback **ret)
1311 {
1312     nsRedirectCallback *callback;
1313
1314     callback = heap_alloc(sizeof(*callback));
1315     if(!callback)
1316         return E_OUTOFMEMORY;
1317
1318     callback->nsIAsyncVerifyRedirectCallback_iface.lpVtbl = &nsAsyncVerifyRedirectCallbackVtbl;
1319     callback->ref = 1;
1320
1321     nsIHttpChannel_AddRef(&nschannel->nsIHttpChannel_iface);
1322     callback->nschannel = nschannel;
1323
1324     IBindStatusCallback_AddRef(&bsc->bsc.IBindStatusCallback_iface);
1325     callback->bsc = bsc;
1326
1327     *ret = callback;
1328     return S_OK;
1329 }
1330
1331 static inline nsChannelBSC *nsChannelBSC_from_BSCallback(BSCallback *iface)
1332 {
1333     return CONTAINING_RECORD(iface, nsChannelBSC, bsc);
1334 }
1335
1336 static void nsChannelBSC_destroy(BSCallback *bsc)
1337 {
1338     nsChannelBSC *This = nsChannelBSC_from_BSCallback(bsc);
1339
1340     if(This->nschannel) {
1341         if(This->nschannel->binding == This)
1342             This->nschannel->binding = NULL;
1343         nsIHttpChannel_Release(&This->nschannel->nsIHttpChannel_iface);
1344     }
1345     if(This->nslistener)
1346         nsIStreamListener_Release(This->nslistener);
1347     if(This->nscontext)
1348         nsISupports_Release(This->nscontext);
1349     if(This->nsstream)
1350         nsIInputStream_Release(&This->nsstream->nsIInputStream_iface);
1351     heap_free(This);
1352 }
1353
1354 static HRESULT nsChannelBSC_start_binding(BSCallback *bsc)
1355 {
1356     nsChannelBSC *This = nsChannelBSC_from_BSCallback(bsc);
1357
1358     if(This->is_doc_channel)
1359         This->bsc.window->base.outer_window->base.inner_window->doc->skip_mutation_notif = FALSE;
1360
1361     return S_OK;
1362 }
1363
1364 static HRESULT nsChannelBSC_init_bindinfo(BSCallback *bsc)
1365 {
1366     nsChannelBSC *This = nsChannelBSC_from_BSCallback(bsc);
1367     nsChannel *nschannel = This->nschannel;
1368     GeckoBrowser *browser;
1369     HRESULT hres;
1370
1371     if(This->is_doc_channel && This->bsc.window && This->bsc.window->base.outer_window
1372        && (browser = This->bsc.window->base.outer_window->browser)) {
1373         if(browser->doc->hostinfo.dwFlags & DOCHOSTUIFLAG_ENABLE_REDIRECT_NOTIFICATION)
1374             This->bsc.bindinfo_options |= BINDINFO_OPTIONS_DISABLEAUTOREDIRECTS;
1375     }
1376
1377     if(nschannel && nschannel->post_data_stream) {
1378         hres = read_post_data_stream(nschannel->post_data_stream, nschannel->post_data_contains_headers,
1379                 &nschannel->request_headers, &This->bsc.request_data);
1380         if(FAILED(hres))
1381             return hres;
1382     }
1383
1384     return S_OK;
1385 }
1386
1387 typedef struct {
1388     task_t header;
1389     nsChannelBSC *bsc;
1390 } stop_request_task_t;
1391
1392 static void stop_request_proc(task_t *_task)
1393 {
1394     stop_request_task_t *task = (stop_request_task_t*)_task;
1395
1396     TRACE("(%p)\n", task->bsc);
1397
1398     list_remove(&task->bsc->bsc.entry);
1399     list_init(&task->bsc->bsc.entry);
1400     on_stop_nsrequest(task->bsc, S_OK);
1401 }
1402
1403 static void stop_request_task_destr(task_t *_task)
1404 {
1405     stop_request_task_t *task = (stop_request_task_t*)_task;
1406
1407     IBindStatusCallback_Release(&task->bsc->bsc.IBindStatusCallback_iface);
1408     heap_free(task);
1409 }
1410
1411 static HRESULT async_stop_request(nsChannelBSC *This)
1412 {
1413     stop_request_task_t *task;
1414
1415     if(!This->bsc.read) {
1416         TRACE("No data read, calling OnStartRequest\n");
1417         on_start_nsrequest(This);
1418     }
1419
1420     task = heap_alloc(sizeof(*task));
1421     if(!task)
1422         return E_OUTOFMEMORY;
1423
1424     IBindStatusCallback_AddRef(&This->bsc.IBindStatusCallback_iface);
1425     task->bsc = This;
1426
1427     return push_task(&task->header, stop_request_proc, stop_request_task_destr, This->bsc.window->task_magic);
1428 }
1429
1430 static void handle_navigation_error(nsChannelBSC *This, DWORD result)
1431 {
1432     HTMLOuterWindow *outer_window;
1433     HTMLDocumentObj *doc;
1434     BOOL is_error_url;
1435     SAFEARRAY *sa;
1436     SAFEARRAYBOUND bound;
1437     VARIANT var, varOut;
1438     LONG ind;
1439     BSTR unk;
1440     HRESULT hres;
1441
1442     if(!This->is_doc_channel || !This->bsc.window || !This->bsc.window->base.outer_window
1443        || !This->bsc.window->base.outer_window->browser)
1444         return;
1445
1446     outer_window = This->bsc.window->base.outer_window;
1447     doc = outer_window->browser->doc;
1448     if(!doc->doc_object_service || !doc->client)
1449         return;
1450
1451     hres = IDocObjectService_IsErrorUrl(doc->doc_object_service,
1452             outer_window->url, &is_error_url);
1453     if(FAILED(hres) || is_error_url)
1454         return;
1455
1456     if(!doc->client_cmdtrg)
1457         return;
1458
1459     bound.lLbound = 0;
1460     bound.cElements = 8;
1461     sa = SafeArrayCreate(VT_VARIANT, 1, &bound);
1462     if(!sa)
1463         return;
1464
1465     ind = 0;
1466     V_VT(&var) = VT_I4;
1467     V_I4(&var) = result;
1468     SafeArrayPutElement(sa, &ind, &var);
1469
1470     ind = 1;
1471     V_VT(&var) = VT_BSTR;
1472     V_BSTR(&var) = outer_window->url;
1473     SafeArrayPutElement(sa, &ind, &var);
1474
1475     ind = 3;
1476     V_VT(&var) = VT_UNKNOWN;
1477     V_UNKNOWN(&var) = (IUnknown*)&outer_window->base.IHTMLWindow2_iface;
1478     SafeArrayPutElement(sa, &ind, &var);
1479
1480     /* FIXME: what are the following fields for? */
1481     ind = 2;
1482     V_VT(&var) = VT_UNKNOWN;
1483     V_UNKNOWN(&var) = NULL;
1484     SafeArrayPutElement(sa, &ind, &var);
1485
1486     ind = 4;
1487     V_VT(&var) = VT_BOOL;
1488     V_BOOL(&var) = FALSE;
1489     SafeArrayPutElement(sa, &ind, &var);
1490
1491     ind = 5;
1492     V_VT(&var) = VT_BOOL;
1493     V_BOOL(&var) = FALSE;
1494     SafeArrayPutElement(sa, &ind, &var);
1495
1496     ind = 6;
1497     V_VT(&var) = VT_BSTR;
1498     unk = SysAllocString(NULL);
1499     V_BSTR(&var) = unk;
1500     SafeArrayPutElement(sa, &ind, &var);
1501
1502     ind = 7;
1503     V_VT(&var) = VT_UNKNOWN;
1504     V_UNKNOWN(&var) = NULL;
1505     SafeArrayPutElement(sa, &ind, &var);
1506
1507     V_VT(&var) = VT_ARRAY;
1508     V_ARRAY(&var) = sa;
1509     V_VT(&varOut) = VT_BOOL;
1510     V_BOOL(&varOut) = VARIANT_TRUE;
1511     IOleCommandTarget_Exec(doc->client_cmdtrg, &CGID_DocHostCmdPriv, 1, 0, &var, FAILED(hres)?NULL:&varOut);
1512
1513     SysFreeString(unk);
1514     SafeArrayDestroy(sa);
1515 }
1516
1517 static HRESULT nsChannelBSC_stop_binding(BSCallback *bsc, HRESULT result)
1518 {
1519     nsChannelBSC *This = nsChannelBSC_from_BSCallback(bsc);
1520
1521     if(result != E_ABORT && This->is_doc_channel && This->bsc.window) {
1522         if(FAILED(result))
1523             handle_navigation_error(This, result);
1524         else if(This->nschannel) {
1525             result = async_stop_request(This);
1526             if(SUCCEEDED(result))
1527                 return S_OK;
1528         }
1529     }
1530
1531     on_stop_nsrequest(This, result);
1532     return S_OK;
1533 }
1534
1535 static HRESULT nsChannelBSC_read_data(BSCallback *bsc, IStream *stream)
1536 {
1537     nsChannelBSC *This = nsChannelBSC_from_BSCallback(bsc);
1538
1539     return read_stream_data(This, stream);
1540 }
1541
1542 static HRESULT handle_redirect(nsChannelBSC *This, const WCHAR *new_url)
1543 {
1544     nsRedirectCallback *callback;
1545     nsIChannelEventSink *sink;
1546     nsChannel *new_channel;
1547     IMoniker *mon;
1548     nsresult nsres;
1549     HRESULT hres;
1550
1551     TRACE("(%p)->(%s)\n", This, debugstr_w(new_url));
1552
1553     hres = CreateURLMoniker(NULL, new_url, &mon);
1554     if(FAILED(hres))
1555         return hres;
1556     IMoniker_Release(This->bsc.mon);
1557     This->bsc.mon = mon;
1558
1559     if(!This->nschannel || !This->nschannel->notif_callback)
1560         return S_OK;
1561
1562     nsres = nsIInterfaceRequestor_GetInterface(This->nschannel->notif_callback, &IID_nsIChannelEventSink, (void**)&sink);
1563     if(NS_FAILED(nsres))
1564         return S_OK;
1565
1566     hres = create_redirect_nschannel(new_url, This->nschannel, &new_channel);
1567     if(SUCCEEDED(hres)) {
1568         TRACE("%p %p->%p\n", This, This->nschannel, new_channel);
1569
1570         hres = create_redirect_callback(new_channel, This, &callback);
1571         nsIHttpChannel_Release(&new_channel->nsIHttpChannel_iface);
1572     }
1573
1574     if(SUCCEEDED(hres)) {
1575         nsres = nsIChannelEventSink_AsyncOnChannelRedirect(sink, (nsIChannel*)&This->nschannel->nsIHttpChannel_iface,
1576                 (nsIChannel*)&callback->nschannel->nsIHttpChannel_iface, REDIRECT_TEMPORARY, /* FIXME */
1577                 &callback->nsIAsyncVerifyRedirectCallback_iface);
1578
1579         if(NS_FAILED(nsres))
1580             FIXME("AsyncOnChannelRedirect failed: %08lx\n", hres);
1581         else if(This->nschannel != callback->nschannel)
1582             FIXME("nschannel not updated\n");
1583
1584         nsIAsyncVerifyRedirectCallback_Release(&callback->nsIAsyncVerifyRedirectCallback_iface);
1585     }
1586
1587     nsIChannelEventSink_Release(sink);
1588     return hres;
1589 }
1590
1591 static BOOL is_supported_doc_mime(const WCHAR *mime)
1592 {
1593     char *nscat, *mimea;
1594     BOOL ret;
1595
1596     mimea = heap_strdupWtoA(mime);
1597     if(!mimea)
1598         return FALSE;
1599
1600     nscat = get_nscategory_entry("Gecko-Content-Viewers", mimea);
1601
1602     ret = nscat != NULL && !strcmp(nscat, "@mozilla.org/content/document-loader-factory;1");
1603
1604     heap_free(mimea);
1605     nsfree(nscat);
1606     return ret;
1607 }
1608
1609 static IUri *get_moniker_uri(IMoniker *mon)
1610 {
1611     IUriContainer *uri_container;
1612     IUri *ret = NULL;
1613     HRESULT hres;
1614
1615     hres = IMoniker_QueryInterface(mon, &IID_IUriContainer, (void**)&uri_container);
1616     if(SUCCEEDED(hres)) {
1617         hres = IUriContainer_GetIUri(uri_container, &ret);
1618         IUriContainer_Release(uri_container);
1619         if(FAILED(hres))
1620             return NULL;
1621     }else {
1622         FIXME("No IUriContainer\n");
1623     }
1624
1625     return ret;
1626 }
1627
1628 static void handle_extern_mime_navigation(nsChannelBSC *This)
1629 {
1630     IWebBrowserPriv2IE9 *webbrowser_priv;
1631     IOleCommandTarget *cmdtrg;
1632     HTMLDocumentObj *doc_obj;
1633     IBindCtx *bind_ctx;
1634     IUri *uri;
1635     VARIANT flags;
1636     HRESULT hres;
1637
1638     if(!This->bsc.window || !This->bsc.window->base.outer_window || !This->bsc.window->base.outer_window->browser)
1639         return;
1640
1641     doc_obj = This->bsc.window->base.outer_window->browser->doc;
1642
1643     hres = IOleClientSite_QueryInterface(doc_obj->client, &IID_IOleCommandTarget, (void**)&cmdtrg);
1644     if(SUCCEEDED(hres)) {
1645         IOleCommandTarget_Exec(cmdtrg, &CGID_ShellDocView, 62, 0, NULL, NULL);
1646         IOleCommandTarget_Release(cmdtrg);
1647     }
1648
1649     set_document_navigation(doc_obj, FALSE);
1650
1651     if(!doc_obj->webbrowser) {
1652         FIXME("unimplemented in non-webbrowser mode\n");
1653         return;
1654     }
1655
1656     uri = get_moniker_uri(This->bsc.mon);
1657     if(!uri)
1658         return;
1659
1660     hres = CreateBindCtx(0, &bind_ctx);
1661     if(FAILED(hres)) {
1662         IUri_Release(uri);
1663         return;
1664     }
1665
1666     V_VT(&flags) = VT_I4;
1667     V_I4(&flags) = navHyperlink;
1668
1669     hres = IUnknown_QueryInterface(doc_obj->webbrowser, &IID_IWebBrowserPriv2IE8, (void**)&webbrowser_priv);
1670     if(SUCCEEDED(hres)) {
1671         hres = IWebBrowserPriv2IE9_NavigateWithBindCtx2(webbrowser_priv, uri, &flags, NULL, NULL, NULL, bind_ctx, NULL, 0);
1672         IWebBrowserPriv2IE9_Release(webbrowser_priv);
1673     }else {
1674         IWebBrowserPriv *webbrowser_priv_old;
1675         VARIANT uriv;
1676
1677         hres = IUnknown_QueryInterface(doc_obj->webbrowser, &IID_IWebBrowserPriv, (void**)&webbrowser_priv_old);
1678         if(SUCCEEDED(hres)) {
1679             V_VT(&uriv) = VT_BSTR;
1680             V_BSTR(&uriv) = NULL;
1681             hres = IUri_GetDisplayUri(uri, &V_BSTR(&uriv));
1682
1683             if(hres == S_OK)
1684                 hres = IWebBrowserPriv_NavigateWithBindCtx(webbrowser_priv_old, &uriv, &flags, NULL, NULL, NULL, bind_ctx, NULL);
1685
1686             SysFreeString(V_BSTR(&uriv));
1687             IWebBrowserPriv_Release(webbrowser_priv_old);
1688         }
1689     }
1690
1691     IUri_Release(uri);
1692 }
1693
1694 static HRESULT nsChannelBSC_on_progress(BSCallback *bsc, ULONG progress, ULONG total, ULONG status_code, LPCWSTR status_text)
1695 {
1696     nsChannelBSC *This = nsChannelBSC_from_BSCallback(bsc);
1697
1698     switch(status_code) {
1699     case BINDSTATUS_MIMETYPEAVAILABLE:
1700         if(This->is_doc_channel && !is_supported_doc_mime(status_text)) {
1701             FIXME("External MIME: %s\n", debugstr_w(status_text));
1702
1703             handle_extern_mime_navigation(This);
1704
1705             This->nschannel = NULL;
1706         }
1707
1708         if(!This->nschannel ||
1709            (This->nschannel->content_type && !(This->nschannel->load_flags & LOAD_CALL_CONTENT_SNIFFERS)))
1710             return S_OK;
1711
1712         heap_free(This->nschannel->content_type);
1713         This->nschannel->content_type = heap_strdupWtoA(status_text);
1714         break;
1715     case BINDSTATUS_REDIRECTING:
1716         return handle_redirect(This, status_text);
1717     case BINDSTATUS_BEGINDOWNLOADDATA: {
1718         IWinInetHttpInfo *http_info;
1719         DWORD status, size = sizeof(DWORD);
1720         HRESULT hres;
1721
1722         if(This->bsc.binding) {
1723             hres = IBinding_QueryInterface(This->bsc.binding, &IID_IWinInetHttpInfo, (void**)&http_info);
1724             if(SUCCEEDED(hres)) {
1725                 hres = IWinInetHttpInfo_QueryInfo(http_info,
1726                         HTTP_QUERY_STATUS_CODE|HTTP_QUERY_FLAG_NUMBER, &status, &size, NULL, NULL);
1727                 IWinInetHttpInfo_Release(http_info);
1728                 if(SUCCEEDED(hres) && status != HTTP_STATUS_OK)
1729                     handle_navigation_error(This, status);
1730             }
1731         }
1732         /* fall through */
1733     }
1734     case BINDSTATUS_DOWNLOADINGDATA:
1735     case BINDSTATUS_ENDDOWNLOADDATA:
1736         /* Defer it to just before calling OnDataAvailable, otherwise it can have wrong state */
1737         This->progress = progress;
1738         This->total = total;
1739         break;
1740     }
1741
1742     return S_OK;
1743 }
1744
1745 static HRESULT process_response_status_text(const WCHAR *header, const WCHAR *header_end, char **status_text)
1746 {
1747     header = wcschr(header + 1, ' ');
1748     if(!header || header >= header_end)
1749         return E_FAIL;
1750     header = wcschr(header + 1, ' ');
1751     if(!header || header >= header_end)
1752         header = header_end;
1753     else
1754         ++header;
1755
1756     *status_text = heap_strndupWtoU(header, header_end - header);
1757
1758     if(!*status_text)
1759         return E_OUTOFMEMORY;
1760
1761     return S_OK;
1762 }
1763
1764 static HRESULT nsChannelBSC_on_response(BSCallback *bsc, DWORD response_code,
1765         LPCWSTR response_headers)
1766 {
1767     nsChannelBSC *This = nsChannelBSC_from_BSCallback(bsc);
1768     char *str;
1769     HRESULT hres;
1770
1771     This->response_processed = TRUE;
1772     This->nschannel->response_status = response_code;
1773
1774     if(response_headers) {
1775         const WCHAR *headers;
1776
1777         headers = wcschr(response_headers, '\r');
1778         hres = process_response_status_text(response_headers, headers, &str);
1779         if(FAILED(hres)) {
1780             WARN("parsing headers failed: %08lx\n", hres);
1781             return hres;
1782         }
1783
1784         heap_free(This->nschannel->response_status_text);
1785         This->nschannel->response_status_text = str;
1786
1787         if(headers && headers[1] == '\n') {
1788             headers += 2;
1789             hres = process_response_headers(This, headers);
1790             if(FAILED(hres)) {
1791                 WARN("parsing headers failed: %08lx\n", hres);
1792                 return hres;
1793             }
1794         }
1795     }
1796
1797     return S_OK;
1798 }
1799
1800 static HRESULT nsChannelBSC_beginning_transaction(BSCallback *bsc, WCHAR **additional_headers)
1801 {
1802     nsChannelBSC *This = nsChannelBSC_from_BSCallback(bsc);
1803     http_header_t *iter;
1804     DWORD len = 0;
1805     WCHAR *ptr;
1806
1807     if(!This->nschannel)
1808         return S_FALSE;
1809
1810     LIST_FOR_EACH_ENTRY(iter, &This->nschannel->request_headers, http_header_t, entry) {
1811         if(wcscmp(iter->header, L"Content-Length"))
1812             len += lstrlenW(iter->header) + 2 /* ": " */ + lstrlenW(iter->data) + 2 /* "\r\n" */;
1813     }
1814
1815     if(!len)
1816         return S_OK;
1817
1818     *additional_headers = ptr = CoTaskMemAlloc((len+1)*sizeof(WCHAR));
1819     if(!ptr)
1820         return E_OUTOFMEMORY;
1821
1822     LIST_FOR_EACH_ENTRY(iter, &This->nschannel->request_headers, http_header_t, entry) {
1823         if(!wcscmp(iter->header, L"Content-Length"))
1824             continue;
1825
1826         len = lstrlenW(iter->header);
1827         memcpy(ptr, iter->header, len*sizeof(WCHAR));
1828         ptr += len;
1829
1830         *ptr++ = ':';
1831         *ptr++ = ' ';
1832
1833         len = lstrlenW(iter->data);
1834         memcpy(ptr, iter->data, len*sizeof(WCHAR));
1835         ptr += len;
1836
1837         *ptr++ = '\r';
1838         *ptr++ = '\n';
1839     }
1840
1841     *ptr = 0;
1842
1843     return S_OK;
1844 }
1845
1846 static const BSCallbackVtbl nsChannelBSCVtbl = {
1847     nsChannelBSC_destroy,
1848     nsChannelBSC_init_bindinfo,
1849     nsChannelBSC_start_binding,
1850     nsChannelBSC_stop_binding,
1851     nsChannelBSC_read_data,
1852     nsChannelBSC_on_progress,
1853     nsChannelBSC_on_response,
1854     nsChannelBSC_beginning_transaction
1855 };
1856
1857 HRESULT create_channelbsc(IMoniker *mon, const WCHAR *headers, BYTE *post_data, DWORD post_data_size,
1858         BOOL is_doc_binding, nsChannelBSC **retval)
1859 {
1860     nsChannelBSC *ret;
1861     DWORD bindf;
1862
1863     ret = heap_alloc_zero(sizeof(*ret));
1864     if(!ret)
1865         return E_OUTOFMEMORY;
1866
1867     bindf = BINDF_ASYNCHRONOUS | BINDF_ASYNCSTORAGE | BINDF_PULLDATA;
1868     if(post_data_size)
1869         bindf |= BINDF_FORMS_SUBMIT | BINDF_PRAGMA_NO_CACHE | BINDF_HYPERLINK | BINDF_GETNEWESTVERSION;
1870
1871     init_bscallback(&ret->bsc, &nsChannelBSCVtbl, mon, bindf);
1872     ret->is_doc_channel = is_doc_binding;
1873
1874     if(headers) {
1875         ret->bsc.request_data.headers = heap_strdupW(headers);
1876         if(!ret->bsc.request_data.headers) {
1877             IBindStatusCallback_Release(&ret->bsc.IBindStatusCallback_iface);
1878             return E_OUTOFMEMORY;
1879         }
1880     }
1881
1882     if(post_data) {
1883         ret->bsc.request_data.post_data = GlobalAlloc(0, post_data_size+1);
1884         if(!ret->bsc.request_data.post_data) {
1885             release_request_data(&ret->bsc.request_data);
1886             IBindStatusCallback_Release(&ret->bsc.IBindStatusCallback_iface);
1887             return E_OUTOFMEMORY;
1888         }
1889
1890         memcpy(ret->bsc.request_data.post_data, post_data, post_data_size);
1891         ((BYTE*)ret->bsc.request_data.post_data)[post_data_size] = 0;
1892         ret->bsc.request_data.post_data_len = post_data_size;
1893     }
1894
1895     TRACE("created %p\n", ret);
1896     *retval = ret;
1897     return S_OK;
1898 }
1899
1900 typedef struct {
1901     task_t header;
1902     HTMLOuterWindow *window;
1903     HTMLInnerWindow *pending_window;
1904 } start_doc_binding_task_t;
1905
1906 static void start_doc_binding_proc(task_t *_task)
1907 {
1908     start_doc_binding_task_t *task = (start_doc_binding_task_t*)_task;
1909
1910     set_current_mon(task->window, task->pending_window->bscallback->bsc.mon, BINDING_NAVIGATED);
1911     start_binding(task->pending_window, &task->pending_window->bscallback->bsc, NULL);
1912 }
1913
1914 static void start_doc_binding_task_destr(task_t *_task)
1915 {
1916     start_doc_binding_task_t *task = (start_doc_binding_task_t*)_task;
1917
1918     IHTMLWindow2_Release(&task->pending_window->base.IHTMLWindow2_iface);
1919     heap_free(task);
1920 }
1921
1922 HRESULT async_start_doc_binding(HTMLOuterWindow *window, HTMLInnerWindow *pending_window)
1923 {
1924     start_doc_binding_task_t *task;
1925
1926     TRACE("%p\n", pending_window);
1927
1928     task = heap_alloc(sizeof(start_doc_binding_task_t));
1929     if(!task)
1930         return E_OUTOFMEMORY;
1931
1932     task->window = window;
1933     task->pending_window = pending_window;
1934     IHTMLWindow2_AddRef(&pending_window->base.IHTMLWindow2_iface);
1935
1936     return push_task(&task->header, start_doc_binding_proc, start_doc_binding_task_destr, pending_window->task_magic);
1937 }
1938
1939 void abort_window_bindings(HTMLInnerWindow *window)
1940 {
1941     BSCallback *iter;
1942
1943     remove_target_tasks(window->task_magic);
1944
1945     while(!list_empty(&window->bindings)) {
1946         iter = LIST_ENTRY(window->bindings.next, BSCallback, entry);
1947
1948         TRACE("Aborting %p\n", iter);
1949
1950         IBindStatusCallback_AddRef(&iter->IBindStatusCallback_iface);
1951
1952         if(iter->binding)
1953             IBinding_Abort(iter->binding);
1954         else
1955             iter->vtbl->stop_binding(iter, E_ABORT);
1956
1957         iter->window = NULL;
1958         list_remove(&iter->entry);
1959         list_init(&iter->entry);
1960
1961         IBindStatusCallback_Release(&iter->IBindStatusCallback_iface);
1962     }
1963
1964     if(window->bscallback) {
1965         IBindStatusCallback_Release(&window->bscallback->bsc.IBindStatusCallback_iface);
1966         window->bscallback = NULL;
1967     }
1968
1969     if(window->mon) {
1970         IMoniker_Release(window->mon);
1971         window->mon = NULL;
1972     }
1973 }
1974
1975 HRESULT channelbsc_load_stream(HTMLInnerWindow *pending_window, IMoniker *mon, IStream *stream)
1976 {
1977     nsChannelBSC *bscallback = pending_window->bscallback;
1978     HRESULT hres = S_OK;
1979
1980     if(!bscallback->nschannel) {
1981         ERR("NULL nschannel\n");
1982         return E_FAIL;
1983     }
1984
1985     bscallback->nschannel->content_type = heap_strdupA("text/html");
1986     if(!bscallback->nschannel->content_type)
1987         return E_OUTOFMEMORY;
1988
1989     set_current_mon(pending_window->base.outer_window, mon, 0);
1990
1991     bscallback->bsc.window = pending_window;
1992     if(stream)
1993         hres = read_stream_data(bscallback, stream);
1994     if(SUCCEEDED(hres))
1995         hres = async_stop_request(bscallback);
1996     if(FAILED(hres))
1997         IBindStatusCallback_OnStopBinding(&bscallback->bsc.IBindStatusCallback_iface, hres, NULL);
1998
1999     return hres;
2000 }
2001
2002 void channelbsc_set_channel(nsChannelBSC *This, nsChannel *channel, nsIStreamListener *listener, nsISupports *context)
2003 {
2004     nsIHttpChannel_AddRef(&channel->nsIHttpChannel_iface);
2005     This->nschannel = channel;
2006
2007     nsIStreamListener_AddRef(listener);
2008     This->nslistener = listener;
2009
2010     if(context) {
2011         nsISupports_AddRef(context);
2012         This->nscontext = context;
2013     }
2014
2015     if(This->bsc.request_data.headers) {
2016         HRESULT hres;
2017
2018         hres = parse_headers(This->bsc.request_data.headers, &channel->request_headers);
2019         heap_free(This->bsc.request_data.headers);
2020         This->bsc.request_data.headers = NULL;
2021         if(FAILED(hres))
2022             WARN("parse_headers failed: %08lx\n", hres);
2023     }
2024 }
2025
2026 typedef struct {
2027     task_t header;
2028     HTMLOuterWindow *window;
2029     IUri *uri;
2030 } navigate_javascript_task_t;
2031
2032 static void navigate_javascript_proc(task_t *_task)
2033 {
2034     navigate_javascript_task_t *task = (navigate_javascript_task_t*)_task;
2035     HTMLOuterWindow *window = task->window;
2036     BSTR code = NULL;
2037     VARIANT v;
2038     HRESULT hres;
2039
2040     task->window->readystate = READYSTATE_COMPLETE;
2041
2042     hres = IUri_GetPath(task->uri, &code);
2043     if(hres != S_OK) {
2044         SysFreeString(code);
2045         return;
2046     }
2047
2048     hres = UrlUnescapeW(code, NULL, NULL, URL_UNESCAPE_INPLACE);
2049     if(FAILED(hres)) {
2050         SysFreeString(code);
2051         return;
2052     }
2053
2054     set_download_state(window->browser->doc, 1);
2055
2056     V_VT(&v) = VT_EMPTY;
2057     hres = exec_script(window->base.inner_window, code, L"jscript", &v);
2058     SysFreeString(code);
2059     if(SUCCEEDED(hres) && V_VT(&v) != VT_EMPTY) {
2060         FIXME("javascirpt URL returned %s\n", debugstr_variant(&v));
2061         VariantClear(&v);
2062     }
2063
2064     if(window->browser->doc->view_sink)
2065         IAdviseSink_OnViewChange(window->browser->doc->view_sink, DVASPECT_CONTENT, -1);
2066
2067     set_download_state(window->browser->doc, 0);
2068 }
2069
2070 static void navigate_javascript_task_destr(task_t *_task)
2071 {
2072     navigate_javascript_task_t *task = (navigate_javascript_task_t*)_task;
2073
2074     IUri_Release(task->uri);
2075     heap_free(task);
2076 }
2077
2078 typedef struct {
2079     task_t header;
2080     HTMLOuterWindow *window;
2081     nsChannelBSC *bscallback;
2082     DWORD flags;
2083     IMoniker *mon;
2084     IUri *uri;
2085 } navigate_task_t;
2086
2087 static void navigate_proc(task_t *_task)
2088 {
2089     navigate_task_t *task = (navigate_task_t*)_task;
2090     HRESULT hres;
2091
2092     hres = set_moniker(task->window, task->mon, task->uri, NULL, task->bscallback, TRUE);
2093     if(SUCCEEDED(hres)) {
2094         set_current_mon(task->window, task->bscallback->bsc.mon, task->flags);
2095         set_current_uri(task->window, task->uri);
2096         start_binding(task->window->pending_window, &task->bscallback->bsc, NULL);
2097     }
2098 }
2099
2100 static void navigate_task_destr(task_t *_task)
2101 {
2102     navigate_task_t *task = (navigate_task_t*)_task;
2103
2104     IBindStatusCallback_Release(&task->bscallback->bsc.IBindStatusCallback_iface);
2105     IMoniker_Release(task->mon);
2106     IUri_Release(task->uri);
2107     heap_free(task);
2108 }
2109
2110 static HRESULT navigate_fragment(HTMLOuterWindow *window, IUri *uri)
2111 {
2112     nsIDOMLocation *nslocation;
2113     nsAString nsfrag_str;
2114     BSTR frag = NULL;
2115     WCHAR *selector;
2116     nsresult nsres;
2117     HRESULT hres;
2118     static const WCHAR selector_formatW[] = L"a[id=\"%s\"]";
2119
2120     set_current_uri(window, uri);
2121
2122     nsres = nsIDOMWindow_GetLocation(window->nswindow, &nslocation);
2123     if(FAILED(nsres) || !nslocation)
2124         return E_FAIL;
2125
2126     hres = IUri_GetFragment(uri, &frag);
2127     if(hres != S_OK) {
2128         SysFreeString(frag);
2129         nsIDOMLocation_Release(nslocation);
2130         return FAILED(hres) ? hres : S_OK;
2131     }
2132
2133     nsAString_InitDepend(&nsfrag_str, frag);
2134     nsres = nsIDOMLocation_SetHash(nslocation, &nsfrag_str);
2135     nsAString_Finish(&nsfrag_str);
2136     nsIDOMLocation_Release(nslocation);
2137     if(NS_FAILED(nsres))
2138         ERR("SetHash failed: %08lx\n", nsres);
2139
2140     /*
2141      * IE supports scrolling to anchor elements with "#hash" ids (note that '#' is part of the id),
2142      * while Gecko scrolls only to elements with "hash" ids. We scroll the page ourselves if
2143      * a[id="#hash"] element can be found.
2144      */
2145     selector = heap_alloc(sizeof(selector_formatW)+SysStringLen(frag)*sizeof(WCHAR));
2146     if(selector) {
2147         nsIDOMElement *nselem = NULL;
2148         nsAString selector_str;
2149
2150         swprintf(selector, ARRAY_SIZE(selector_formatW)+SysStringLen(frag), selector_formatW, frag);
2151         nsAString_InitDepend(&selector_str, selector);
2152         /* NOTE: Gecko doesn't set result to NULL if there is no match, so nselem must be initialized */
2153         nsres = nsIDOMHTMLDocument_QuerySelector(window->base.inner_window->doc->nsdoc, &selector_str, &nselem);
2154         nsAString_Finish(&selector_str);
2155         heap_free(selector);
2156         if(NS_SUCCEEDED(nsres) && nselem) {
2157             nsIDOMHTMLElement *html_elem;
2158
2159             nsres = nsIDOMElement_QueryInterface(nselem, &IID_nsIDOMHTMLElement, (void**)&html_elem);
2160             nsIDOMElement_Release(nselem);
2161             if(NS_SUCCEEDED(nsres)) {
2162                 nsIDOMHTMLElement_ScrollIntoView(html_elem, TRUE, 1);
2163                 nsIDOMHTMLElement_Release(html_elem);
2164             }
2165         }
2166     }
2167
2168     SysFreeString(frag);
2169
2170     if(window->browser->doc->doc_object_service) {
2171         IDocObjectService_FireNavigateComplete2(window->browser->doc->doc_object_service, &window->base.IHTMLWindow2_iface, 0x10);
2172         IDocObjectService_FireDocumentComplete(window->browser->doc->doc_object_service, &window->base.IHTMLWindow2_iface, 0);
2173
2174     }
2175
2176     return S_OK;
2177 }
2178
2179 HRESULT super_navigate(HTMLOuterWindow *window, IUri *uri, DWORD flags, const WCHAR *headers, BYTE *post_data, DWORD post_data_size)
2180 {
2181     nsChannelBSC *bsc;
2182     IUri *uri_nofrag;
2183     IMoniker *mon;
2184     DWORD scheme;
2185     HRESULT hres;
2186
2187     uri_nofrag = get_uri_nofrag(uri);
2188     if(!uri_nofrag)
2189         return E_FAIL;
2190
2191     if(window->browser->doc->client && !(flags & BINDING_REFRESH)) {
2192         IOleCommandTarget *cmdtrg;
2193
2194         hres = IOleClientSite_QueryInterface(window->browser->doc->client, &IID_IOleCommandTarget, (void**)&cmdtrg);
2195         if(SUCCEEDED(hres)) {
2196             VARIANT in, out;
2197             BSTR url_str;
2198
2199             hres = IUri_GetDisplayUri(uri_nofrag, &url_str);
2200             if(SUCCEEDED(hres)) {
2201                 V_VT(&in) = VT_BSTR;
2202                 V_BSTR(&in) = url_str;
2203                 V_VT(&out) = VT_BOOL;
2204                 V_BOOL(&out) = VARIANT_TRUE;
2205                 hres = IOleCommandTarget_Exec(cmdtrg, &CGID_ShellDocView, 67, 0, &in, &out);
2206                 IOleCommandTarget_Release(cmdtrg);
2207                 if(SUCCEEDED(hres))
2208                     VariantClear(&out);
2209                 SysFreeString(url_str);
2210             }
2211         }
2212     }
2213
2214     if(!(flags & BINDING_NOFRAG) && window->uri_nofrag && !post_data_size) {
2215         BOOL eq;
2216
2217         hres = IUri_IsEqual(uri_nofrag, window->uri_nofrag, &eq);
2218         if(SUCCEEDED(hres) && eq) {
2219             IUri_Release(uri_nofrag);
2220             TRACE("fragment navigate\n");
2221             return navigate_fragment(window, uri);
2222         }
2223     }
2224
2225     hres = CreateURLMonikerEx2(NULL, uri_nofrag, &mon, URL_MK_UNIFORM);
2226     IUri_Release(uri_nofrag);
2227     if(FAILED(hres))
2228         return hres;
2229
2230     /* FIXME: Why not set_ready_state? */
2231     window->readystate = READYSTATE_UNINITIALIZED;
2232
2233     hres = create_channelbsc(mon, headers, post_data, post_data_size, TRUE, &bsc);
2234     if(FAILED(hres)) {
2235         IMoniker_Release(mon);
2236         return hres;
2237     }
2238
2239     prepare_for_binding(&window->browser->doc->basedoc, mon, flags);
2240
2241     hres = IUri_GetScheme(uri, &scheme);
2242     if(hres == S_OK && scheme == URL_SCHEME_JAVASCRIPT) {
2243         navigate_javascript_task_t *task;
2244
2245         IBindStatusCallback_Release(&bsc->bsc.IBindStatusCallback_iface);
2246         IMoniker_Release(mon);
2247
2248         task = heap_alloc(sizeof(*task));
2249         if(!task)
2250             return E_OUTOFMEMORY;
2251
2252         /* Why silently? */
2253         window->readystate = READYSTATE_COMPLETE;
2254         if(!(flags & BINDING_FROMHIST))
2255             call_docview_84(window->browser->doc);
2256
2257         IUri_AddRef(uri);
2258         task->window = window;
2259         task->uri = uri;
2260         hres = push_task(&task->header, navigate_javascript_proc, navigate_javascript_task_destr, window->task_magic);
2261     }else if(flags & BINDING_SUBMIT) {
2262         hres = set_moniker(window, mon, uri, NULL, bsc, TRUE);
2263         if(SUCCEEDED(hres))
2264             hres = start_binding(window->pending_window, &bsc->bsc, NULL);
2265         IBindStatusCallback_Release(&bsc->bsc.IBindStatusCallback_iface);
2266         IMoniker_Release(mon);
2267     }else {
2268         navigate_task_t *task;
2269
2270         task = heap_alloc(sizeof(*task));
2271         if(!task) {
2272             IBindStatusCallback_Release(&bsc->bsc.IBindStatusCallback_iface);
2273             IMoniker_Release(mon);
2274             return E_OUTOFMEMORY;
2275         }
2276
2277         /* Silently and repeated when real loading starts? */
2278         window->readystate = READYSTATE_LOADING;
2279         if(!(flags & (BINDING_FROMHIST|BINDING_REFRESH)))
2280             call_docview_84(window->browser->doc);
2281
2282         task->window = window;
2283         task->bscallback = bsc;
2284         task->flags = flags;
2285         task->mon = mon;
2286
2287         IUri_AddRef(uri);
2288         task->uri = uri;
2289         hres = push_task(&task->header, navigate_proc, navigate_task_destr, window->task_magic);
2290     }
2291
2292     return hres;
2293 }
2294
2295 HRESULT navigate_new_window(HTMLOuterWindow *window, IUri *uri, const WCHAR *name, request_data_t *request_data, IHTMLWindow2 **ret)
2296 {
2297     INewWindowManager *new_window_mgr;
2298     BSTR display_uri, context_url;
2299     IWebBrowser2 *web_browser;
2300     IHTMLWindow2 *new_window;
2301     IBindCtx *bind_ctx;
2302     nsChannelBSC *bsc;
2303     HRESULT hres;
2304
2305     if(!window->browser)
2306         return E_UNEXPECTED;
2307
2308     if (window->browser->doc->client) {
2309         hres = do_query_service((IUnknown*)window->browser->doc->client, &SID_SNewWindowManager,
2310                                 &IID_INewWindowManager, (void**)&new_window_mgr);
2311         if (FAILED(hres)) {
2312             FIXME("No INewWindowManager\n");
2313             return hres;
2314         }
2315
2316         hres = IUri_GetDisplayUri(window->uri_nofrag, &context_url);
2317         if(FAILED(hres))
2318             return hres;
2319
2320         hres = IUri_GetDisplayUri(uri, &display_uri);
2321         if(FAILED(hres)) {
2322             SysFreeString(context_url);
2323             return hres;
2324         }
2325
2326         hres = INewWindowManager_EvaluateNewWindow(new_window_mgr, display_uri, name, context_url,
2327                 NULL, FALSE, window->browser->doc->has_popup ? 0 : NWMF_FIRST, 0);
2328         window->browser->doc->has_popup = TRUE;
2329         SysFreeString(display_uri);
2330         SysFreeString(context_url);
2331         INewWindowManager_Release(new_window_mgr);
2332         if(FAILED(hres)) {
2333             if(ret)
2334                 *ret = NULL;
2335             return S_OK;
2336         }
2337     }
2338
2339
2340     if(request_data)
2341         hres = create_channelbsc(NULL, request_data->headers,
2342                 request_data->post_data, request_data->post_data_len, FALSE,
2343                 &bsc);
2344     else
2345         hres = create_channelbsc(NULL, NULL, NULL, 0, FALSE, &bsc);
2346     if(FAILED(hres))
2347         return hres;
2348
2349     hres = CreateAsyncBindCtx(0, &bsc->bsc.IBindStatusCallback_iface, NULL, &bind_ctx);
2350     if(FAILED(hres)) {
2351         IBindStatusCallback_Release(&bsc->bsc.IBindStatusCallback_iface);
2352         return hres;
2353     }
2354
2355     hres = CoCreateInstance(&CLSID_InternetExplorer, NULL, CLSCTX_LOCAL_SERVER,
2356             &IID_IWebBrowser2, (void**)&web_browser);
2357     if(SUCCEEDED(hres)) {
2358         ITargetFramePriv2 *target_frame_priv;
2359
2360         hres = IWebBrowser2_QueryInterface(web_browser, &IID_ITargetFramePriv2, (void**)&target_frame_priv);
2361         if(SUCCEEDED(hres)) {
2362             hres = ITargetFramePriv2_AggregatedNavigation2(target_frame_priv,
2363                     HLNF_DISABLEWINDOWRESTRICTIONS|HLNF_OPENINNEWWINDOW, bind_ctx, &bsc->bsc.IBindStatusCallback_iface,
2364                     name, uri, L"");
2365             ITargetFramePriv2_Release(target_frame_priv);
2366
2367             if(SUCCEEDED(hres))
2368                 hres = do_query_service((IUnknown*)web_browser, &SID_SHTMLWindow, &IID_IHTMLWindow2, (void**)&new_window);
2369         }
2370         if(FAILED(hres)) {
2371             IWebBrowser2_Quit(web_browser);
2372             IWebBrowser2_Release(web_browser);
2373         }
2374     }else {
2375         WARN("Could not create InternetExplorer instance: %08lx\n", hres);
2376     }
2377
2378     IBindStatusCallback_Release(&bsc->bsc.IBindStatusCallback_iface);
2379     IBindCtx_Release(bind_ctx);
2380     if(FAILED(hres))
2381         return hres;
2382
2383     IWebBrowser2_put_Visible(web_browser, VARIANT_TRUE);
2384     IWebBrowser2_Release(web_browser);
2385
2386     if(ret)
2387         *ret = new_window;
2388     else
2389         IHTMLWindow2_Release(new_window);
2390     return S_OK;
2391 }
2392
2393 HRESULT hlink_frame_navigate(HTMLDocument *doc, LPCWSTR url, nsChannel *nschannel, DWORD hlnf, BOOL *cancel)
2394 {
2395     IHlinkFrame *hlink_frame;
2396     nsChannelBSC *callback;
2397     IBindCtx *bindctx;
2398     IMoniker *mon;
2399     IHlink *hlink;
2400     HRESULT hres;
2401
2402     *cancel = FALSE;
2403
2404     hres = do_query_service((IUnknown*)doc->doc_obj->client, &IID_IHlinkFrame, &IID_IHlinkFrame,
2405             (void**)&hlink_frame);
2406     if(FAILED(hres))
2407         return S_OK;
2408
2409     hres = create_channelbsc(NULL, NULL, NULL, 0, FALSE, &callback);
2410     if(FAILED(hres)) {
2411         IHlinkFrame_Release(hlink_frame);
2412         return hres;
2413     }
2414
2415     if(nschannel)
2416         read_post_data_stream(nschannel->post_data_stream, nschannel->post_data_contains_headers,
2417                 &nschannel->request_headers, &callback->bsc.request_data);
2418
2419     hres = CreateAsyncBindCtx(0, &callback->bsc.IBindStatusCallback_iface, NULL, &bindctx);
2420     if(SUCCEEDED(hres))
2421        hres = CoCreateInstance(&CLSID_StdHlink, NULL, CLSCTX_INPROC_SERVER,
2422                 &IID_IHlink, (LPVOID*)&hlink);
2423
2424     if(SUCCEEDED(hres))
2425         hres = CreateURLMoniker(NULL, url, &mon);
2426
2427     if(SUCCEEDED(hres)) {
2428         IHlink_SetMonikerReference(hlink, HLINKSETF_TARGET, mon, NULL);
2429
2430         if(hlnf & HLNF_OPENINNEWWINDOW) {
2431             IHlink_SetTargetFrameName(hlink, L"_blank"); /* FIXME */
2432         }
2433
2434         hres = IHlinkFrame_Navigate(hlink_frame, hlnf, bindctx,
2435                 &callback->bsc.IBindStatusCallback_iface, hlink);
2436         IMoniker_Release(mon);
2437         *cancel = hres == S_OK;
2438         hres = S_OK;
2439     }
2440
2441     IHlinkFrame_Release(hlink_frame);
2442     IBindCtx_Release(bindctx);
2443     IBindStatusCallback_Release(&callback->bsc.IBindStatusCallback_iface);
2444     return hres;
2445 }
2446
2447 static HRESULT navigate_uri(HTMLOuterWindow *window, IUri *uri, const WCHAR *display_uri, const request_data_t *request_data,
2448         DWORD flags)
2449 {
2450     nsWineURI *nsuri;
2451     HRESULT hres;
2452
2453     TRACE("%s\n", debugstr_w(display_uri));
2454
2455     if(!window->browser)
2456         return E_UNEXPECTED;
2457
2458     if(window->browser->doc->webbrowser) {
2459         DWORD post_data_len = request_data ? request_data->post_data_len : 0;
2460         void *post_data = post_data_len ? request_data->post_data : NULL;
2461         const WCHAR *headers = request_data ? request_data->headers : NULL;
2462
2463         if(!(flags & BINDING_REFRESH)) {
2464             BSTR frame_name = NULL;
2465             BOOL cancel = FALSE;
2466
2467             if(!is_main_content_window(window)) {
2468                 hres = IHTMLWindow2_get_name(&window->base.IHTMLWindow2_iface, &frame_name);
2469                 if(FAILED(hres))
2470                     return hres;
2471             }
2472
2473             hres = IDocObjectService_FireBeforeNavigate2(window->browser->doc->doc_object_service, NULL, display_uri, 0x40,
2474                     frame_name, post_data, post_data_len ? post_data_len+1 : 0, headers, TRUE, &cancel);
2475             SysFreeString(frame_name);
2476             if(SUCCEEDED(hres) && cancel) {
2477                 TRACE("Navigation canceled\n");
2478                 return S_OK;
2479             }
2480         }
2481
2482         if(is_main_content_window(window))
2483             return super_navigate(window, uri, flags, headers, post_data, post_data_len);
2484     }
2485
2486     if(is_main_content_window(window)) {
2487         BOOL cancel;
2488
2489         hres = hlink_frame_navigate(&window->base.inner_window->doc->basedoc, display_uri, NULL, 0, &cancel);
2490         if(FAILED(hres))
2491             return hres;
2492
2493         if(cancel) {
2494             TRACE("Navigation handled by hlink frame\n");
2495             return S_OK;
2496         }
2497     }
2498
2499     hres = create_doc_uri(uri, &nsuri);
2500     if(FAILED(hres))
2501         return hres;
2502
2503     hres = load_nsuri(window, nsuri, request_data ? request_data->post_stream : NULL, NULL, LOAD_FLAGS_NONE);
2504     nsISupports_Release((nsISupports*)nsuri);
2505     return hres;
2506 }
2507
2508 HRESULT load_uri(HTMLOuterWindow *window, IUri *uri, DWORD flags)
2509 {
2510     BSTR display_uri;
2511     HRESULT hres;
2512
2513     hres = IUri_GetDisplayUri(uri, &display_uri);
2514     if(FAILED(hres))
2515         return hres;
2516
2517     hres = navigate_uri(window, uri, display_uri, NULL, flags);
2518     SysFreeString(display_uri);
2519     return hres;
2520 }
2521
2522 static HRESULT translate_uri(HTMLOuterWindow *window, IUri *orig_uri, BSTR *ret_display_uri, IUri **ret_uri)
2523 {
2524     IUri *uri = NULL;
2525     BSTR display_uri;
2526     HRESULT hres;
2527
2528     hres = IUri_GetDisplayUri(orig_uri, &display_uri);
2529     if(FAILED(hres))
2530         return hres;
2531
2532     if(window->browser->doc->hostui) {
2533         OLECHAR *translated_url = NULL;
2534
2535         hres = IDocHostUIHandler_TranslateUrl(window->browser->doc->hostui, 0, display_uri,
2536                 &translated_url);
2537         if(hres == S_OK && translated_url) {
2538             TRACE("%08lx %s -> %s\n", hres, debugstr_w(display_uri), debugstr_w(translated_url));
2539             SysFreeString(display_uri);
2540             hres = create_uri(translated_url, 0, &uri);
2541             CoTaskMemFree(translated_url);
2542             if(FAILED(hres))
2543                 return hres;
2544
2545             hres = IUri_GetDisplayUri(uri, &display_uri);
2546             if(FAILED(hres)) {
2547                 IUri_Release(uri);
2548                 return hres;
2549             }
2550         }
2551     }
2552
2553     if(!uri) {
2554         IUri_AddRef(orig_uri);
2555         uri = orig_uri;
2556     }
2557
2558     *ret_display_uri = display_uri;
2559     *ret_uri = uri;
2560     return S_OK;
2561 }
2562
2563 HRESULT submit_form(HTMLOuterWindow *window, const WCHAR *target, IUri *submit_uri, nsIInputStream *post_stream)
2564 {
2565     request_data_t request_data = {NULL};
2566     HRESULT hres;
2567
2568     hres = read_post_data_stream(post_stream, TRUE, NULL, &request_data);
2569     if(FAILED(hres))
2570         return hres;
2571
2572     if(window) {
2573         IUri *uri;
2574         BSTR display_uri;
2575
2576         window->readystate_locked++;
2577
2578         hres = translate_uri(window, submit_uri, &display_uri, &uri);
2579         if(SUCCEEDED(hres)) {
2580             hres = navigate_uri(window, uri, display_uri, &request_data, BINDING_NAVIGATED|BINDING_SUBMIT);
2581             IUri_Release(uri);
2582             SysFreeString(display_uri);
2583         }
2584
2585         window->readystate_locked--;
2586     }else
2587         hres = navigate_new_window(window, submit_uri, target, &request_data, NULL);
2588
2589     release_request_data(&request_data);
2590     return hres;
2591 }
2592
2593 HRESULT navigate_url(HTMLOuterWindow *window, const WCHAR *new_url, IUri *base_uri, DWORD flags)
2594 {
2595     IUri *uri, *nav_uri;
2596     BSTR display_uri;
2597     HRESULT hres;
2598
2599     if(new_url && base_uri)
2600         hres = CoInternetCombineUrlEx(base_uri, new_url, URL_ESCAPE_SPACES_ONLY|URL_DONT_ESCAPE_EXTRA_INFO,
2601                 &nav_uri, 0);
2602     else
2603         hres = create_uri(new_url, 0, &nav_uri);
2604     if(FAILED(hres))
2605         return hres;
2606
2607     hres = translate_uri(window, nav_uri, &display_uri, &uri);
2608     IUri_Release(nav_uri);
2609     if(FAILED(hres))
2610         return hres;
2611
2612     hres = navigate_uri(window, uri, display_uri, NULL, flags);
2613     IUri_Release(uri);
2614     SysFreeString(display_uri);
2615     return hres;
2616 }