dlls/mshtml/navigate.c

   1 /*
   2  * Copyright 2006-2010 Jacek Caban for CodeWeavers
   3  *
   4  * This library is free software; you can redistribute it and/or
   5  * modify it under the terms of the GNU Lesser General Public
   6  * License as published by the Free Software Foundation; either
   7  * version 2.1 of the License, or (at your option) any later version.
   8  *
   9  * This library is distributed in the hope that it will be useful,
  10  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  11  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  12  * Lesser General Public License for more details.
  13  *
  14  * You should have received a copy of the GNU Lesser General Public
  15  * License along with this library; if not, write to the Free Software
  16  * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
  17  */
  18
  19 #include <stdarg.h>
  20
  21 #define COBJMACROS
  22 #include "windef.h"
  23 #include "winbase.h"
  24 #include "winuser.h"
  25 #include "winreg.h"
  26 #include "ole2.h"
  27 #include "hlguids.h"
  28 #include "shlguid.h"
  29 #include "wininet.h"
  30 #include "shlwapi.h"
  31 #include "htiface.h"
  32 #include "shdeprecated.h"
  33
  34 #include "wine/debug.h"
  35
  36 #include "mshtml_private.h"
  37 #include "htmlscript.h"
  38 #include "binding.h"
  39
  40 WINE_DEFAULT_DEBUG_CHANNEL(mshtml);
  41
  42 struct nsProtocolStream {
  43     nsIInputStream nsIInputStream_iface;
  44
  45     LONG ref;
  46
  47     char buf[1024];
  48     DWORD buf_size;
  49 };
  50
  51 static inline nsProtocolStream *impl_from_nsIInputStream(nsIInputStream *iface)
  52 {
  53     return CONTAINING_RECORD(iface, nsProtocolStream, nsIInputStream_iface);
  54 }
  55
  56 static nsresult NSAPI nsInputStream_QueryInterface(nsIInputStream *iface, nsIIDRef riid,
  57         void **result)
  58 {
  59     nsProtocolStream *This = impl_from_nsIInputStream(iface);
  60
  61     *result = NULL;
  62
  63     if(IsEqualGUID(&IID_nsISupports, riid)) {
  64         TRACE("(%p)->(IID_nsISupports %p)\n", This, result);
  65         *result  = &This->nsIInputStream_iface;
  66     }else if(IsEqualGUID(&IID_nsIInputStream, riid)) {
  67         TRACE("(%p)->(IID_nsIInputStream %p)\n", This, result);
  68         *result  = &This->nsIInputStream_iface;
  69     }
  70
  71     if(*result) {
  72         nsIInputStream_AddRef(&This->nsIInputStream_iface);
  73         return NS_OK;
  74     }
  75
  76     WARN("unsupported interface %s\n", debugstr_guid(riid));
  77     return NS_NOINTERFACE;
  78 }
  79
  80 static nsrefcnt NSAPI nsInputStream_AddRef(nsIInputStream *iface)
  81 {
  82     nsProtocolStream *This = impl_from_nsIInputStream(iface);
  83     LONG ref = InterlockedIncrement(&This->ref);
  84
  85     TRACE("(%p) ref=%ld\n", This, ref);
  86
  87     return ref;
  88 }
  89
  90
  91 static nsrefcnt NSAPI nsInputStream_Release(nsIInputStream *iface)
  92 {
  93     nsProtocolStream *This = impl_from_nsIInputStream(iface);
  94     LONG ref = InterlockedDecrement(&This->ref);
  95
  96     TRACE("(%p) ref=%ld\n", This, ref);
  97
  98     if(!ref)
  99         free(This);
 100
 101     return ref;
 102 }
 103
 104 static nsresult NSAPI nsInputStream_Close(nsIInputStream *iface)
 105 {
 106     nsProtocolStream *This = impl_from_nsIInputStream(iface);
 107     FIXME("(%p)\n", This);
 108     return NS_ERROR_NOT_IMPLEMENTED;
 109 }
 110
 111 static nsresult NSAPI nsInputStream_Available(nsIInputStream *iface, UINT64 *_retval)
 112 {
 113     nsProtocolStream *This = impl_from_nsIInputStream(iface);
 114     FIXME("(%p)->(%p)\n", This, _retval);
 115     return NS_ERROR_NOT_IMPLEMENTED;
 116 }
 117
 118 static nsresult NSAPI nsInputStream_Read(nsIInputStream *iface, char *aBuf, UINT32 aCount,
 119                                          UINT32 *_retval)
 120 {
 121     nsProtocolStream *This = impl_from_nsIInputStream(iface);
 122     DWORD read = aCount;
 123
 124     TRACE("(%p)->(%p %d %p)\n", This, aBuf, aCount, _retval);
 125
 126     if(read > This->buf_size)
 127         read = This->buf_size;
 128
 129     if(read) {
 130         memcpy(aBuf, This->buf, read);
 131         if(read < This->buf_size)
 132             memmove(This->buf, This->buf+read, This->buf_size-read);
 133         This->buf_size -= read;
 134     }
 135
 136     *_retval = read;
 137     return NS_OK;
 138 }
 139
 140 static nsresult NSAPI nsInputStream_ReadSegments(nsIInputStream *iface,
 141         nsresult (WINAPI *aWriter)(nsIInputStream*,void*,const char*,UINT32,UINT32,UINT32*),
 142         void *aClousure, UINT32 aCount, UINT32 *_retval)
 143 {
 144     nsProtocolStream *This = impl_from_nsIInputStream(iface);
 145     UINT32 written = 0;
 146     nsresult nsres;
 147
 148     TRACE("(%p)->(%p %p %d %p)\n", This, aWriter, aClousure, aCount, _retval);
 149
 150     if(!This->buf_size)
 151         return S_OK;
 152
 153     if(aCount > This->buf_size)
 154         aCount = This->buf_size;
 155
 156     nsres = aWriter(&This->nsIInputStream_iface, aClousure, This->buf, 0, aCount, &written);
 157     if(NS_FAILED(nsres))
 158         TRACE("aWriter failed: %08lx\n", nsres);
 159     else if(written != This->buf_size)
 160         FIXME("written %d != buf_size %ld\n", written, This->buf_size);
 161
 162     This->buf_size -= written;
 163
 164     *_retval = written;
 165     return nsres;
 166 }
 167
 168 static nsresult NSAPI nsInputStream_IsNonBlocking(nsIInputStream *iface, cpp_bool *_retval)
 169 {
 170     nsProtocolStream *This = impl_from_nsIInputStream(iface);
 171     FIXME("(%p)->(%p)\n", This, _retval);
 172     return NS_ERROR_NOT_IMPLEMENTED;
 173 }
 174
 175 static const nsIInputStreamVtbl nsInputStreamVtbl = {
 176     nsInputStream_QueryInterface,
 177     nsInputStream_AddRef,
 178     nsInputStream_Release,
 179     nsInputStream_Close,
 180     nsInputStream_Available,
 181     nsInputStream_Read,
 182     nsInputStream_ReadSegments,
 183     nsInputStream_IsNonBlocking
 184 };
 185
 186 static nsProtocolStream *create_nsprotocol_stream(void)
 187 {
 188     nsProtocolStream *ret;
 189
 190     ret = malloc(sizeof(nsProtocolStream));
 191     if(!ret)
 192         return NULL;
 193
 194     ret->nsIInputStream_iface.lpVtbl = &nsInputStreamVtbl;
 195     ret->ref = 1;
 196     ret->buf_size = 0;
 197
 198     return ret;
 199 }
 200
 201 static void release_request_data(request_data_t *request_data)
 202 {
 203     if(request_data->post_stream)
 204         nsIInputStream_Release(request_data->post_stream);
 205     free(request_data->headers);
 206     if(request_data->post_data)
 207         GlobalFree(request_data->post_data);
 208 }
 209
 210 static inline BSCallback *impl_from_IBindStatusCallback(IBindStatusCallback *iface)
 211 {
 212     return CONTAINING_RECORD(iface, BSCallback, IBindStatusCallback_iface);
 213 }
 214
 215 static HRESULT WINAPI BindStatusCallback_QueryInterface(IBindStatusCallback *iface,
 216         REFIID riid, void **ppv)
 217 {
 218     BSCallback *This = impl_from_IBindStatusCallback(iface);
 219
 220     *ppv = NULL;
 221     if(IsEqualGUID(&IID_IUnknown, riid)) {
 222         TRACE("(%p)->(IID_IUnknown, %p)\n", This, ppv);
 223         *ppv = &This->IBindStatusCallback_iface;
 224     }else if(IsEqualGUID(&IID_IBindStatusCallback, riid)) {
 225         TRACE("(%p)->(IID_IBindStatusCallback, %p)\n", This, ppv);
 226         *ppv = &This->IBindStatusCallback_iface;
 227     }else if(IsEqualGUID(&IID_IServiceProvider, riid)) {
 228         TRACE("(%p)->(IID_IServiceProvider %p)\n", This, ppv);
 229         *ppv = &This->IServiceProvider_iface;
 230     }else if(IsEqualGUID(&IID_IHttpNegotiate, riid)) {
 231         TRACE("(%p)->(IID_IHttpNegotiate %p)\n", This, ppv);
 232         *ppv = &This->IHttpNegotiate2_iface;
 233     }else if(IsEqualGUID(&IID_IHttpNegotiate2, riid)) {
 234         TRACE("(%p)->(IID_IHttpNegotiate2 %p)\n", This, ppv);
 235         *ppv = &This->IHttpNegotiate2_iface;
 236     }else if(IsEqualGUID(&IID_IInternetBindInfo, riid)) {
 237         TRACE("(%p)->(IID_IInternetBindInfo %p)\n", This, ppv);
 238         *ppv = &This->IInternetBindInfo_iface;
 239     }else if(IsEqualGUID(&IID_IBindCallbackRedirect, riid)) {
 240         TRACE("(%p)->(IID_IBindCallbackRedirect %p)\n", This, ppv);
 241         *ppv = &This->IBindCallbackRedirect_iface;
 242     }
 243
 244     if(*ppv) {
 245         IBindStatusCallback_AddRef(&This->IBindStatusCallback_iface);
 246         return S_OK;
 247     }
 248
 249     TRACE("Unsupported riid = %s\n", debugstr_guid(riid));
 250     return E_NOINTERFACE;
 251 }
 252
 253 static ULONG WINAPI BindStatusCallback_AddRef(IBindStatusCallback *iface)
 254 {
 255     BSCallback *This = impl_from_IBindStatusCallback(iface);
 256     LONG ref = InterlockedIncrement(&This->ref);
 257
 258     TRACE("(%p) ref = %ld\n", This, ref);
 259
 260     return ref;
 261 }
 262
 263 static ULONG WINAPI BindStatusCallback_Release(IBindStatusCallback *iface)
 264 {
 265     BSCallback *This = impl_from_IBindStatusCallback(iface);
 266     LONG ref = InterlockedDecrement(&This->ref);
 267
 268     TRACE("(%p) ref = %ld\n", This, ref);
 269
 270     if(!ref) {
 271         release_request_data(&This->request_data);
 272         if(This->mon)
 273             IMoniker_Release(This->mon);
 274         if(This->binding)
 275             IBinding_Release(This->binding);
 276         list_remove(&This->entry);
 277         list_init(&This->entry);
 278
 279         This->vtbl->destroy(This);
 280     }
 281
 282     return ref;
 283 }
 284
 285 static HRESULT WINAPI BindStatusCallback_OnStartBinding(IBindStatusCallback *iface,
 286         DWORD dwReserved, IBinding *pbind)
 287 {
 288     BSCallback *This = impl_from_IBindStatusCallback(iface);
 289
 290     TRACE("(%p)->(%ld %p)\n", This, dwReserved, pbind);
 291
 292     IBinding_AddRef(pbind);
 293     This->binding = pbind;
 294
 295     if(This->window)
 296         list_add_head(&This->window->bindings, &This->entry);
 297
 298     return This->vtbl->start_binding(This);
 299 }
 300
 301 static HRESULT WINAPI BindStatusCallback_GetPriority(IBindStatusCallback *iface, LONG *pnPriority)
 302 {
 303     BSCallback *This = impl_from_IBindStatusCallback(iface);
 304     FIXME("(%p)->(%p)\n", This, pnPriority);
 305     return E_NOTIMPL;
 306 }
 307
 308 static HRESULT WINAPI BindStatusCallback_OnLowResource(IBindStatusCallback *iface, DWORD reserved)
 309 {
 310     BSCallback *This = impl_from_IBindStatusCallback(iface);
 311     FIXME("(%p)->(%ld)\n", This, reserved);
 312     return E_NOTIMPL;
 313 }
 314
 315 static HRESULT WINAPI BindStatusCallback_OnProgress(IBindStatusCallback *iface, ULONG ulProgress,
 316         ULONG ulProgressMax, ULONG ulStatusCode, LPCWSTR szStatusText)
 317 {
 318     BSCallback *This = impl_from_IBindStatusCallback(iface);
 319
 320     TRACE("%p)->(%lu %lu %lu %s)\n", This, ulProgress, ulProgressMax, ulStatusCode,
 321             debugstr_w(szStatusText));
 322
 323     return This->vtbl->on_progress(This, ulProgress, ulProgressMax, ulStatusCode, szStatusText);
 324 }
 325
 326 static HRESULT WINAPI BindStatusCallback_OnStopBinding(IBindStatusCallback *iface,
 327         HRESULT hresult, LPCWSTR szError)
 328 {
 329     BSCallback *This = impl_from_IBindStatusCallback(iface);
 330     HRESULT hres;
 331
 332     TRACE("(%p)->(%08lx %s)\n", This, hresult, debugstr_w(szError));
 333
 334     /* NOTE: IE7 calls GetBindResult here */
 335
 336     hres = This->vtbl->stop_binding(This, hresult);
 337
 338     unlink_ref(&This->binding);
 339     unlink_ref(&This->mon);
 340
 341     list_remove(&This->entry);
 342     list_init(&This->entry);
 343     This->window = NULL;
 344
 345     return hres;
 346 }
 347
 348 static HRESULT WINAPI BindStatusCallback_GetBindInfo(IBindStatusCallback *iface,
 349         DWORD *grfBINDF, BINDINFO *pbindinfo)
 350 {
 351     BSCallback *This = impl_from_IBindStatusCallback(iface);
 352     DWORD size;
 353
 354     TRACE("(%p)->(%p %p)\n", This, grfBINDF, pbindinfo);
 355
 356     if(!This->bindinfo_ready) {
 357         HRESULT hres;
 358
 359         hres = This->vtbl->init_bindinfo(This);
 360         if(FAILED(hres))
 361             return hres;
 362
 363         This->bindinfo_ready = TRUE;
 364     }
 365
 366     *grfBINDF = This->bindf;
 367
 368     size = pbindinfo->cbSize;
 369     memset(pbindinfo, 0, size);
 370     pbindinfo->cbSize = size;
 371
 372     pbindinfo->cbstgmedData = This->request_data.post_data_len;
 373     pbindinfo->dwCodePage = CP_UTF8;
 374     pbindinfo->dwOptions = This->bindinfo_options;
 375
 376     if(This->request_data.post_data_len) {
 377         pbindinfo->dwBindVerb = BINDVERB_POST;
 378
 379         pbindinfo->stgmedData.tymed = TYMED_HGLOBAL;
 380         pbindinfo->stgmedData.hGlobal = This->request_data.post_data;
 381         pbindinfo->stgmedData.pUnkForRelease = (IUnknown*)&This->IBindStatusCallback_iface;
 382         IBindStatusCallback_AddRef(&This->IBindStatusCallback_iface);
 383     }
 384
 385     return S_OK;
 386 }
 387
 388 static HRESULT WINAPI BindStatusCallback_OnDataAvailable(IBindStatusCallback *iface,
 389         DWORD grfBSCF, DWORD dwSize, FORMATETC *pformatetc, STGMEDIUM *pstgmed)
 390 {
 391     BSCallback *This = impl_from_IBindStatusCallback(iface);
 392
 393     TRACE("(%p)->(%08lx %ld %p %p)\n", This, grfBSCF, dwSize, pformatetc, pstgmed);
 394
 395     return This->vtbl->read_data(This, pstgmed->pstm);
 396 }
 397
 398 static HRESULT WINAPI BindStatusCallback_OnObjectAvailable(IBindStatusCallback *iface,
 399         REFIID riid, IUnknown *punk)
 400 {
 401     BSCallback *This = impl_from_IBindStatusCallback(iface);
 402     FIXME("(%p)->(%s %p)\n", This, debugstr_guid(riid), punk);
 403     return E_NOTIMPL;
 404 }
 405
 406 static const IBindStatusCallbackVtbl BindStatusCallbackVtbl = {
 407     BindStatusCallback_QueryInterface,
 408     BindStatusCallback_AddRef,
 409     BindStatusCallback_Release,
 410     BindStatusCallback_OnStartBinding,
 411     BindStatusCallback_GetPriority,
 412     BindStatusCallback_OnLowResource,
 413     BindStatusCallback_OnProgress,
 414     BindStatusCallback_OnStopBinding,
 415     BindStatusCallback_GetBindInfo,
 416     BindStatusCallback_OnDataAvailable,
 417     BindStatusCallback_OnObjectAvailable
 418 };
 419
 420 static inline BSCallback *impl_from_IHttpNegotiate2(IHttpNegotiate2 *iface)
 421 {
 422     return CONTAINING_RECORD(iface, BSCallback, IHttpNegotiate2_iface);
 423 }
 424
 425 static HRESULT WINAPI HttpNegotiate_QueryInterface(IHttpNegotiate2 *iface,
 426                                                    REFIID riid, void **ppv)
 427 {
 428     BSCallback *This = impl_from_IHttpNegotiate2(iface);
 429     return IBindStatusCallback_QueryInterface(&This->IBindStatusCallback_iface, riid, ppv);
 430 }
 431
 432 static ULONG WINAPI HttpNegotiate_AddRef(IHttpNegotiate2 *iface)
 433 {
 434     BSCallback *This = impl_from_IHttpNegotiate2(iface);
 435     return IBindStatusCallback_AddRef(&This->IBindStatusCallback_iface);
 436 }
 437
 438 static ULONG WINAPI HttpNegotiate_Release(IHttpNegotiate2 *iface)
 439 {
 440     BSCallback *This = impl_from_IHttpNegotiate2(iface);
 441     return IBindStatusCallback_Release(&This->IBindStatusCallback_iface);
 442 }
 443
 444 static HRESULT WINAPI HttpNegotiate_BeginningTransaction(IHttpNegotiate2 *iface,
 445         LPCWSTR szURL, LPCWSTR szHeaders, DWORD dwReserved, LPWSTR *pszAdditionalHeaders)
 446 {
 447     BSCallback *This = impl_from_IHttpNegotiate2(iface);
 448     HRESULT hres;
 449
 450     TRACE("(%p)->(%s %s %ld %p)\n", This, debugstr_w(szURL), debugstr_w(szHeaders),
 451           dwReserved, pszAdditionalHeaders);
 452
 453     *pszAdditionalHeaders = NULL;
 454
 455     hres = This->vtbl->beginning_transaction(This, pszAdditionalHeaders);
 456     if(hres != S_FALSE)
 457         return hres;
 458
 459     if(This->request_data.headers) {
 460         DWORD size;
 461
 462         size = (lstrlenW(This->request_data.headers)+1)*sizeof(WCHAR);
 463         *pszAdditionalHeaders = CoTaskMemAlloc(size);
 464         if(!*pszAdditionalHeaders)
 465             return E_OUTOFMEMORY;
 466         memcpy(*pszAdditionalHeaders, This->request_data.headers, size);
 467     }
 468
 469     return S_OK;
 470 }
 471
 472 static HRESULT WINAPI HttpNegotiate_OnResponse(IHttpNegotiate2 *iface, DWORD dwResponseCode,
 473         LPCWSTR szResponseHeaders, LPCWSTR szRequestHeaders, LPWSTR *pszAdditionalRequestHeaders)
 474 {
 475     BSCallback *This = impl_from_IHttpNegotiate2(iface);
 476
 477     TRACE("(%p)->(%ld %s %s %p)\n", This, dwResponseCode, debugstr_w(szResponseHeaders),
 478           debugstr_w(szRequestHeaders), pszAdditionalRequestHeaders);
 479
 480     return This->vtbl->on_response(This, dwResponseCode, szResponseHeaders);
 481 }
 482
 483 static HRESULT WINAPI HttpNegotiate_GetRootSecurityId(IHttpNegotiate2 *iface,
 484         BYTE *pbSecurityId, DWORD *pcbSecurityId, DWORD_PTR dwReserved)
 485 {
 486     BSCallback *This = impl_from_IHttpNegotiate2(iface);
 487     TRACE("(%p)->(%p %p %Id)\n", This, pbSecurityId, pcbSecurityId, dwReserved);
 488     return E_NOTIMPL; /* FIXME */
 489 }
 490
 491 static const IHttpNegotiate2Vtbl HttpNegotiate2Vtbl = {
 492     HttpNegotiate_QueryInterface,
 493     HttpNegotiate_AddRef,
 494     HttpNegotiate_Release,
 495     HttpNegotiate_BeginningTransaction,
 496     HttpNegotiate_OnResponse,
 497     HttpNegotiate_GetRootSecurityId
 498 };
 499
 500 static inline BSCallback *impl_from_IInternetBindInfo(IInternetBindInfo *iface)
 501 {
 502     return CONTAINING_RECORD(iface, BSCallback, IInternetBindInfo_iface);
 503 }
 504
 505 static HRESULT WINAPI InternetBindInfo_QueryInterface(IInternetBindInfo *iface,
 506                                                       REFIID riid, void **ppv)
 507 {
 508     BSCallback *This = impl_from_IInternetBindInfo(iface);
 509     return IBindStatusCallback_QueryInterface(&This->IBindStatusCallback_iface, riid, ppv);
 510 }
 511
 512 static ULONG WINAPI InternetBindInfo_AddRef(IInternetBindInfo *iface)
 513 {
 514     BSCallback *This = impl_from_IInternetBindInfo(iface);
 515     return IBindStatusCallback_AddRef(&This->IBindStatusCallback_iface);
 516 }
 517
 518 static ULONG WINAPI InternetBindInfo_Release(IInternetBindInfo *iface)
 519 {
 520     BSCallback *This = impl_from_IInternetBindInfo(iface);
 521     return IBindStatusCallback_Release(&This->IBindStatusCallback_iface);
 522 }
 523
 524 static HRESULT WINAPI InternetBindInfo_GetBindInfo(IInternetBindInfo *iface,
 525                                                    DWORD *grfBINDF, BINDINFO *pbindinfo)
 526 {
 527     BSCallback *This = impl_from_IInternetBindInfo(iface);
 528     FIXME("(%p)->(%p %p)\n", This, grfBINDF, pbindinfo);
 529     return E_NOTIMPL;
 530 }
 531
 532 static HRESULT WINAPI InternetBindInfo_GetBindString(IInternetBindInfo *iface,
 533         ULONG ulStringType, LPOLESTR *ppwzStr, ULONG cEl, ULONG *pcElFetched)
 534 {
 535     BSCallback *This = impl_from_IInternetBindInfo(iface);
 536     FIXME("(%p)->(%lu %p %lu %p)\n", This, ulStringType, ppwzStr, cEl, pcElFetched);
 537     return E_NOTIMPL;
 538 }
 539
 540 static const IInternetBindInfoVtbl InternetBindInfoVtbl = {
 541     InternetBindInfo_QueryInterface,
 542     InternetBindInfo_AddRef,
 543     InternetBindInfo_Release,
 544     InternetBindInfo_GetBindInfo,
 545     InternetBindInfo_GetBindString
 546 };
 547
 548 static inline BSCallback *impl_from_IBindCallbackRedirect(IBindCallbackRedirect *iface)
 549 {
 550     return CONTAINING_RECORD(iface, BSCallback, IBindCallbackRedirect_iface);
 551 }
 552
 553 static HRESULT WINAPI BindCallbackRedirect_QueryInterface(IBindCallbackRedirect *iface, REFIID riid, void **ppv)
 554 {
 555     BSCallback *This = impl_from_IBindCallbackRedirect(iface);
 556     return IBindStatusCallback_QueryInterface(&This->IBindStatusCallback_iface, riid, ppv);
 557 }
 558
 559 static ULONG WINAPI BindCallbackRedirect_AddRef(IBindCallbackRedirect *iface)
 560 {
 561     BSCallback *This = impl_from_IBindCallbackRedirect(iface);
 562     return IBindStatusCallback_AddRef(&This->IBindStatusCallback_iface);
 563 }
 564
 565 static ULONG WINAPI BindCallbackRedirect_Release(IBindCallbackRedirect *iface)
 566 {
 567     BSCallback *This = impl_from_IBindCallbackRedirect(iface);
 568     return IBindStatusCallback_Release(&This->IBindStatusCallback_iface);
 569 }
 570
 571 static HRESULT WINAPI BindCallbackRedirect_Redirect(IBindCallbackRedirect *iface, const WCHAR *url, VARIANT_BOOL *vbCancel)
 572 {
 573     BSCallback *This = impl_from_IBindCallbackRedirect(iface);
 574     GeckoBrowser *browser;
 575     BOOL cancel = FALSE;
 576     BSTR frame_name = NULL;
 577     HRESULT hres = S_OK;
 578
 579     TRACE("(%p)->(%s %p)\n", This, debugstr_w(url), vbCancel);
 580
 581     if(This->window && This->window->base.outer_window && (browser = This->window->base.outer_window->browser)
 582        && browser->doc->doc_object_service) {
 583         if(is_main_content_window(This->window->base.outer_window)) {
 584             hres = IHTMLWindow2_get_name(&This->window->base.IHTMLWindow2_iface, &frame_name);
 585             if(FAILED(hres))
 586                 return hres;
 587         }
 588
 589         hres = IDocObjectService_FireBeforeNavigate2(browser->doc->doc_object_service, NULL, url, 0x40,
 590                                                      frame_name, NULL, 0, NULL, TRUE, &cancel);
 591         SysFreeString(frame_name);
 592     }
 593
 594     *vbCancel = variant_bool(cancel);
 595     return hres;
 596 }
 597
 598 static const IBindCallbackRedirectVtbl BindCallbackRedirectVtbl = {
 599     BindCallbackRedirect_QueryInterface,
 600     BindCallbackRedirect_AddRef,
 601     BindCallbackRedirect_Release,
 602     BindCallbackRedirect_Redirect
 603 };
 604
 605 static inline BSCallback *impl_from_IServiceProvider(IServiceProvider *iface)
 606 {
 607     return CONTAINING_RECORD(iface, BSCallback, IServiceProvider_iface);
 608 }
 609
 610 static HRESULT WINAPI BSCServiceProvider_QueryInterface(IServiceProvider *iface,
 611                                                         REFIID riid, void **ppv)
 612 {
 613     BSCallback *This = impl_from_IServiceProvider(iface);
 614     return IBindStatusCallback_QueryInterface(&This->IBindStatusCallback_iface, riid, ppv);
 615 }
 616
 617 static ULONG WINAPI BSCServiceProvider_AddRef(IServiceProvider *iface)
 618 {
 619     BSCallback *This = impl_from_IServiceProvider(iface);
 620     return IBindStatusCallback_AddRef(&This->IBindStatusCallback_iface);
 621 }
 622
 623 static ULONG WINAPI BSCServiceProvider_Release(IServiceProvider *iface)
 624 {
 625     BSCallback *This = impl_from_IServiceProvider(iface);
 626     return IBindStatusCallback_Release(&This->IBindStatusCallback_iface);
 627 }
 628
 629 static HRESULT WINAPI BSCServiceProvider_QueryService(IServiceProvider *iface,
 630         REFGUID guidService, REFIID riid, void **ppv)
 631 {
 632     BSCallback *This = impl_from_IServiceProvider(iface);
 633
 634     TRACE("(%p)->(%s %s %p)\n", This, debugstr_guid(guidService), debugstr_guid(riid), ppv);
 635
 636     if(This->window && IsEqualGUID(guidService, &IID_IWindowForBindingUI))
 637         return IServiceProvider_QueryService(&This->window->base.IServiceProvider_iface, guidService, riid, ppv);
 638     return E_NOINTERFACE;
 639 }
 640
 641 static const IServiceProviderVtbl ServiceProviderVtbl = {
 642     BSCServiceProvider_QueryInterface,
 643     BSCServiceProvider_AddRef,
 644     BSCServiceProvider_Release,
 645     BSCServiceProvider_QueryService
 646 };
 647
 648 void init_bscallback(BSCallback *This, const BSCallbackVtbl *vtbl, IMoniker *mon, DWORD bindf)
 649 {
 650     This->IBindStatusCallback_iface.lpVtbl = &BindStatusCallbackVtbl;
 651     This->IServiceProvider_iface.lpVtbl = &ServiceProviderVtbl;
 652     This->IHttpNegotiate2_iface.lpVtbl = &HttpNegotiate2Vtbl;
 653     This->IInternetBindInfo_iface.lpVtbl = &InternetBindInfoVtbl;
 654     This->IBindCallbackRedirect_iface.lpVtbl = &BindCallbackRedirectVtbl;
 655     This->vtbl = vtbl;
 656     This->ref = 1;
 657     This->bindf = bindf;
 658     This->bindinfo_options = BINDINFO_OPTIONS_USE_IE_ENCODING;
 659     This->bom = BOM_NONE;
 660
 661     list_init(&This->entry);
 662
 663     if(mon)
 664         IMoniker_AddRef(mon);
 665     This->mon = mon;
 666 }
 667
 668 HRESULT read_stream(BSCallback *This, IStream *stream, void *buf, DWORD size, DWORD *ret_size)
 669 {
 670     DWORD read_size = 0, skip=0;
 671     BYTE *data = buf;
 672     HRESULT hres;
 673
 674     hres = IStream_Read(stream, buf, size, &read_size);
 675
 676     if(!This->read && This->bom == BOM_NONE) {
 677         if(read_size >= 2 && data[0] == 0xff && data[1] == 0xfe) {
 678             This->bom = BOM_UTF16;
 679             skip = 2;
 680         }else if(read_size >= 3 && data[0] == 0xef && data[1] == 0xbb && data[2] == 0xbf) {
 681             This->bom = BOM_UTF8;
 682             skip = 3;
 683         }
 684         if(skip) {
 685             read_size -= skip;
 686             if(read_size)
 687                 memmove(data, data+skip, read_size);
 688         }
 689     }
 690
 691     This->read += read_size;
 692     *ret_size = read_size;
 693     return hres;
 694 }
 695
 696 static void parse_content_type(nsChannelBSC *This, const WCHAR *value)
 697 {
 698     const WCHAR *ptr, *beg, *end;
 699     size_t len = wcslen(value);
 700     char *content_type;
 701
 702     static const WCHAR charsetW[] = {'c','h','a','r','s','e','t','='};
 703
 704     ptr = wcschr(value, ';');
 705
 706     if(!This->nschannel->content_type || !(This->nschannel->load_flags & LOAD_CALL_CONTENT_SNIFFERS)) {
 707         for(end = ptr ? ptr : value + len; end > value; end--)
 708             if(!iswspace(end[-1]))
 709                 break;
 710         for(beg = value; beg < end; beg++)
 711             if(!iswspace(*beg))
 712                 break;
 713
 714         if((content_type = strndupWtoU(beg, end - beg))) {
 715             free(This->nschannel->content_type);
 716             This->nschannel->content_type = content_type;
 717             strlwr(content_type);
 718         }
 719     }
 720
 721     if(!ptr)
 722         return;
 723
 724     ptr++;
 725     while(*ptr && iswspace(*ptr))
 726         ptr++;
 727
 728     if(ptr + ARRAY_SIZE(charsetW) < value+len && !wcsnicmp(ptr, charsetW, ARRAY_SIZE(charsetW))) {
 729         size_t charset_len, lena;
 730         nsACString charset_str;
 731         const WCHAR *charset;
 732         char *charseta;
 733
 734         ptr += ARRAY_SIZE(charsetW);
 735
 736         if(*ptr == '\'') {
 737             FIXME("Quoted value\n");
 738             return;
 739         }else {
 740             charset = ptr;
 741             while(*ptr && *ptr != ',')
 742                 ptr++;
 743             charset_len = ptr-charset;
 744         }
 745
 746         lena = WideCharToMultiByte(CP_ACP, 0, charset, charset_len, NULL, 0, NULL, NULL);
 747         charseta = malloc(lena + 1);
 748         if(!charseta)
 749             return;
 750
 751         WideCharToMultiByte(CP_ACP, 0, charset, charset_len, charseta, lena, NULL, NULL);
 752         charseta[lena] = 0;
 753
 754         nsACString_InitDepend(&charset_str, charseta);
 755         nsIHttpChannel_SetContentCharset(&This->nschannel->nsIHttpChannel_iface, &charset_str);
 756         nsACString_Finish(&charset_str);
 757         free(charseta);
 758     }else {
 759         FIXME("unhandled: %s\n", debugstr_wn(ptr, len - (ptr-value)));
 760     }
 761 }
 762
 763 static HRESULT parse_headers(const WCHAR *headers, struct list *headers_list)
 764 {
 765     const WCHAR *header, *header_end, *colon, *value;
 766     HRESULT hres;
 767
 768     header = headers;
 769     while(*header) {
 770         if(header[0] == '\r' && header[1] == '\n' && !header[2])
 771             break;
 772         for(colon = header; *colon && *colon != ':' && *colon != '\r'; colon++);
 773         if(*colon != ':')
 774             return E_FAIL;
 775
 776         value = colon+1;
 777         while(*value == ' ')
 778             value++;
 779         if(!*value)
 780             return E_FAIL;
 781
 782         for(header_end = value+1; *header_end && *header_end != '\r'; header_end++);
 783
 784         hres = set_http_header(headers_list, header, colon-header, value, header_end-value);
 785         if(FAILED(hres))
 786             return hres;
 787
 788         header = header_end;
 789         if(header[0] == '\r' && header[1] == '\n')
 790             header += 2;
 791     }
 792
 793     return S_OK;
 794 }
 795
 796 static HRESULT process_response_headers(nsChannelBSC *This, const WCHAR *headers)
 797 {
 798     http_header_t *iter;
 799     HRESULT hres;
 800
 801     hres = parse_headers(headers, &This->nschannel->response_headers);
 802     if(FAILED(hres))
 803         return hres;
 804
 805     LIST_FOR_EACH_ENTRY(iter, &This->nschannel->response_headers, http_header_t, entry) {
 806         if(!wcsicmp(iter->header, L"content-type"))
 807             parse_content_type(This, iter->data);
 808     }
 809
 810     return S_OK;
 811 }
 812
 813 static void query_http_info(nsChannelBSC *This, IWinInetHttpInfo *wininet_info)
 814 {
 815     const WCHAR *ptr;
 816     DWORD len = 0;
 817     WCHAR *buf;
 818
 819     IWinInetHttpInfo_QueryInfo(wininet_info, HTTP_QUERY_RAW_HEADERS_CRLF, NULL, &len, NULL, NULL);
 820     if(!len)
 821         return;
 822
 823     buf = malloc(len);
 824     if(!buf)
 825         return;
 826
 827     IWinInetHttpInfo_QueryInfo(wininet_info, HTTP_QUERY_RAW_HEADERS_CRLF, buf, &len, NULL, NULL);
 828     if(!len) {
 829         free(buf);
 830         return;
 831     }
 832
 833     ptr = wcschr(buf, '\r');
 834     if(ptr && ptr[1] == '\n') {
 835         ptr += 2;
 836         process_response_headers(This, ptr);
 837     }
 838
 839     free(buf);
 840 }
 841
 842 HRESULT start_binding(HTMLInnerWindow *inner_window, BSCallback *bscallback, IBindCtx *bctx)
 843 {
 844     IStream *str = NULL;
 845     HRESULT hres;
 846
 847     TRACE("(%p %p %p)\n", inner_window, bscallback, bctx);
 848
 849     bscallback->window = inner_window;
 850
 851     /* NOTE: IE7 calls IsSystemMoniker here*/
 852
 853     if(bctx) {
 854         hres = RegisterBindStatusCallback(bctx, &bscallback->IBindStatusCallback_iface, NULL, 0);
 855         if(SUCCEEDED(hres))
 856             IBindCtx_AddRef(bctx);
 857     }else {
 858         hres = CreateAsyncBindCtx(0, &bscallback->IBindStatusCallback_iface, NULL, &bctx);
 859     }
 860
 861     if(FAILED(hres)) {
 862         bscallback->window = NULL;
 863         return hres;
 864     }
 865
 866     hres = IMoniker_BindToStorage(bscallback->mon, bctx, NULL, &IID_IStream, (void**)&str);
 867     IBindCtx_Release(bctx);
 868     if(FAILED(hres)) {
 869         WARN("BindToStorage failed: %08lx\n", hres);
 870         bscallback->window = NULL;
 871         return hres;
 872     }
 873
 874     if(str)
 875         IStream_Release(str);
 876
 877     return S_OK;
 878 }
 879
 880 static HRESULT read_post_data_stream(nsIInputStream *stream, BOOL contains_headers, struct list *headers_list,
 881         request_data_t *request_data)
 882 {
 883     nsISeekableStream *seekable_stream;
 884     UINT64 available = 0;
 885     UINT32 data_len = 0;
 886     char *data, *post_data;
 887     nsresult nsres;
 888     HRESULT hres = S_OK;
 889
 890     if(!stream)
 891         return S_OK;
 892
 893     nsres =  nsIInputStream_Available(stream, &available);
 894     if(NS_FAILED(nsres))
 895         return E_FAIL;
 896
 897     post_data = data = GlobalAlloc(0, available+1);
 898     if(!data)
 899         return E_OUTOFMEMORY;
 900
 901     nsres = nsIInputStream_Read(stream, data, available, &data_len);
 902     if(NS_FAILED(nsres)) {
 903         GlobalFree(data);
 904         return E_FAIL;
 905     }
 906
 907     if(contains_headers) {
 908         if(data_len >= 2 && data[0] == '\r' && data[1] == '\n') {
 909             post_data = data+2;
 910             data_len -= 2;
 911         }else {
 912             WCHAR *headers;
 913             DWORD size;
 914             char *ptr;
 915
 916             post_data += data_len;
 917             for(ptr = data; ptr+4 < data+data_len; ptr++) {
 918                 if(!memcmp(ptr, "\r\n\r\n", 4)) {
 919                     ptr += 2;
 920                     post_data = ptr+2;
 921                     break;
 922                 }
 923             }
 924
 925             data_len -= post_data-data;
 926
 927             size = MultiByteToWideChar(CP_ACP, 0, data, ptr-data, NULL, 0);
 928             headers = malloc((size + 1) * sizeof(WCHAR));
 929             if(headers) {
 930                 MultiByteToWideChar(CP_ACP, 0, data, ptr-data, headers, size);
 931                 headers[size] = 0;
 932                 if(headers_list)
 933                     hres = parse_headers(headers, headers_list);
 934                 if(SUCCEEDED(hres))
 935                     request_data->headers = headers;
 936                 else
 937                     free(headers);
 938             }else {
 939                 hres = E_OUTOFMEMORY;
 940             }
 941         }
 942     }
 943
 944     if(FAILED(hres)) {
 945         GlobalFree(data);
 946         return hres;
 947     }
 948
 949     if(!data_len) {
 950         GlobalFree(data);
 951         post_data = NULL;
 952     }else if(post_data != data) {
 953         char *new_data;
 954
 955         new_data = GlobalAlloc(0, data_len+1);
 956         if(new_data)
 957             memcpy(new_data, post_data, data_len);
 958         GlobalFree(data);
 959         if(!new_data)
 960             return E_OUTOFMEMORY;
 961         post_data = new_data;
 962     }
 963
 964     if(post_data)
 965         post_data[data_len] = 0;
 966     request_data->post_data = post_data;
 967     request_data->post_data_len = data_len;
 968
 969     nsres = nsIInputStream_QueryInterface(stream, &IID_nsISeekableStream, (void**)&seekable_stream);
 970     assert(nsres == NS_OK);
 971
 972     nsres = nsISeekableStream_Seek(seekable_stream, NS_SEEK_SET, 0);
 973     assert(nsres == NS_OK);
 974
 975     nsISeekableStream_Release(seekable_stream);
 976
 977     nsIInputStream_AddRef(stream);
 978     request_data->post_stream = stream;
 979     TRACE("post_data = %s\n", debugstr_an(request_data->post_data, request_data->post_data_len));
 980     return S_OK;
 981 }
 982
 983 static HRESULT on_start_nsrequest(nsChannelBSC *This)
 984 {
 985     nsresult nsres;
 986
 987     /* Async request can be cancelled before we got to it */
 988     if(NS_FAILED(This->nschannel->status))
 989         return E_ABORT; /* FIXME: map status to HRESULT */
 990
 991     This->nschannel->binding = This;
 992
 993     /* FIXME: it's needed for http connections from BindToObject. */
 994     if(!This->nschannel->response_status)
 995         This->nschannel->response_status = 200;
 996
 997     nsres = nsIStreamListener_OnStartRequest(This->nslistener,
 998             (nsIRequest*)&This->nschannel->nsIHttpChannel_iface, This->nscontext);
 999     if(NS_FAILED(nsres)) {
1000         FIXME("OnStartRequest failed: %08lx\n", nsres);
1001         return E_FAIL;
1002     }
1003
1004     if(This->is_doc_channel) {
1005         HRESULT hres;
1006
1007         if(!This->bsc.window)
1008             return E_ABORT; /* Binding aborted in OnStartRequest call. */
1009         hres = update_window_doc(This->bsc.window);
1010         if(FAILED(hres))
1011             return hres;
1012
1013         if(This->bsc.binding)
1014             process_document_response_headers(This->bsc.window->doc, This->bsc.binding);
1015         if(This->bsc.window->base.outer_window->readystate != READYSTATE_LOADING)
1016             set_ready_state(This->bsc.window->base.outer_window, READYSTATE_LOADING);
1017     }
1018
1019     return S_OK;
1020 }
1021
1022 static void on_stop_nsrequest(nsChannelBSC *This, HRESULT result)
1023 {
1024     nsresult nsres, request_result;
1025
1026     switch(result) {
1027     case S_OK:
1028         request_result = NS_OK;
1029         break;
1030     case E_ABORT:
1031         request_result = NS_BINDING_ABORTED;
1032         break;
1033     default:
1034         request_result = NS_ERROR_FAILURE;
1035     }
1036
1037     if(This->nslistener) {
1038         nsres = nsIStreamListener_OnStopRequest(This->nslistener,
1039                  (nsIRequest*)&This->nschannel->nsIHttpChannel_iface, This->nscontext,
1040                  request_result);
1041         if(NS_FAILED(nsres))
1042             WARN("OnStopRequest failed: %08lx\n", nsres);
1043     }
1044
1045     if(This->nschannel) {
1046         if(This->nschannel->load_group) {
1047             nsres = nsILoadGroup_RemoveRequest(This->nschannel->load_group,
1048                     (nsIRequest*)&This->nschannel->nsIHttpChannel_iface, NULL, request_result);
1049             if(NS_FAILED(nsres))
1050                 ERR("RemoveRequest failed: %08lx\n", nsres);
1051         }
1052         if(This->nschannel->binding == This)
1053             This->nschannel->binding = NULL;
1054     }
1055 }
1056
1057 static void notify_progress(nsChannelBSC *This)
1058 {
1059     nsChannel *nschannel = This->nschannel;
1060     nsIProgressEventSink *sink = NULL;
1061     nsresult nsres;
1062
1063     if(!nschannel)
1064         return;
1065
1066     if(nschannel->notif_callback)
1067         if(NS_FAILED(nsIInterfaceRequestor_GetInterface(nschannel->notif_callback, &IID_nsIProgressEventSink, (void**)&sink)))
1068             sink = NULL;
1069
1070     if(!sink && nschannel->load_group) {
1071         nsIRequestObserver *req_observer;
1072
1073         if(NS_SUCCEEDED(nsILoadGroup_GetGroupObserver(nschannel->load_group, &req_observer)) && req_observer) {
1074             nsres = nsIRequestObserver_QueryInterface(req_observer, &IID_nsIProgressEventSink, (void**)&sink);
1075             nsIRequestObserver_Release(req_observer);
1076             if(NS_FAILED(nsres))
1077                 sink = NULL;
1078         }
1079     }
1080
1081     if(sink) {
1082         nsIProgressEventSink_OnProgress(sink, (nsIRequest*)&nschannel->nsIHttpChannel_iface, This->nscontext,
1083                                         This->progress, (This->total == ~0) ? -1 : This->total);
1084         nsIProgressEventSink_Release(sink);
1085     }
1086 }
1087
1088 static HRESULT read_stream_data(nsChannelBSC *This, IStream *stream)
1089 {
1090     DWORD read;
1091     nsresult nsres;
1092     HRESULT hres;
1093
1094     if(!This->response_processed) {
1095         IWinInetHttpInfo *wininet_info;
1096
1097         if(This->is_doc_channel)
1098             This->bsc.window->response_start_time = get_time_stamp();
1099
1100         This->response_processed = TRUE;
1101         if(This->bsc.binding) {
1102             hres = IBinding_QueryInterface(This->bsc.binding, &IID_IWinInetHttpInfo, (void**)&wininet_info);
1103             if(SUCCEEDED(hres)) {
1104                 query_http_info(This, wininet_info);
1105                 IWinInetHttpInfo_Release(wininet_info);
1106             }
1107         }
1108     }
1109
1110     if(!This->nschannel)
1111         return S_OK;
1112
1113     if(!This->nslistener) {
1114         BYTE buf[1024];
1115
1116         do {
1117             hres = read_stream(&This->bsc, stream, buf, sizeof(buf), &read);
1118         }while(hres == S_OK && read);
1119
1120         return S_OK;
1121     }
1122
1123     if(!This->nsstream) {
1124         This->nsstream = create_nsprotocol_stream();
1125         if(!This->nsstream)
1126             return E_OUTOFMEMORY;
1127     }
1128
1129     do {
1130         BOOL first_read = !This->bsc.read;
1131
1132         hres = read_stream(&This->bsc, stream, This->nsstream->buf+This->nsstream->buf_size,
1133                 sizeof(This->nsstream->buf)-This->nsstream->buf_size, &read);
1134         if(!read)
1135             break;
1136
1137         This->nsstream->buf_size += read;
1138
1139         if(first_read) {
1140             switch(This->bsc.bom) {
1141             case BOM_UTF8:
1142                 This->nschannel->charset = strdup("utf-8");
1143                 break;
1144             case BOM_UTF16:
1145                 This->nschannel->charset = strdup("utf-16");
1146             case BOM_NONE:
1147                 /* FIXME: Get charset from HTTP headers */;
1148             }
1149
1150             if(!This->nschannel->content_type) {
1151                 WCHAR *mime;
1152
1153                 hres = FindMimeFromData(NULL, NULL, This->nsstream->buf, This->nsstream->buf_size,
1154                         This->is_doc_channel ? L"text/html" : NULL, 0, &mime, 0);
1155                 if(FAILED(hres))
1156                     return hres;
1157
1158                 TRACE("Found MIME %s\n", debugstr_w(mime));
1159
1160                 This->nschannel->content_type = strdupWtoA(mime);
1161                 CoTaskMemFree(mime);
1162                 if(!This->nschannel->content_type)
1163                     return E_OUTOFMEMORY;
1164             }
1165
1166             hres = on_start_nsrequest(This);
1167             if(FAILED(hres))
1168                 return hres;
1169         }
1170
1171         notify_progress(This);
1172
1173         nsres = nsIStreamListener_OnDataAvailable(This->nslistener,
1174                 (nsIRequest*)&This->nschannel->nsIHttpChannel_iface, This->nscontext,
1175                 &This->nsstream->nsIInputStream_iface, This->bsc.read-This->nsstream->buf_size,
1176                 This->nsstream->buf_size);
1177         if(NS_FAILED(nsres)) {
1178             WARN("OnDataAvailable failed: %08lx\n", nsres);
1179             return map_nsresult(nsres);
1180         }
1181
1182         if(This->nsstream->buf_size == sizeof(This->nsstream->buf)) {
1183             ERR("buffer is full\n");
1184             break;
1185         }
1186     }while(hres == S_OK);
1187
1188     return S_OK;
1189 }
1190
1191 typedef struct {
1192     nsIAsyncVerifyRedirectCallback nsIAsyncVerifyRedirectCallback_iface;
1193
1194     LONG ref;
1195
1196     nsChannel *nschannel;
1197     nsChannelBSC *bsc;
1198 } nsRedirectCallback;
1199
1200 static nsRedirectCallback *impl_from_nsIAsyncVerifyRedirectCallback(nsIAsyncVerifyRedirectCallback *iface)
1201 {
1202     return CONTAINING_RECORD(iface, nsRedirectCallback, nsIAsyncVerifyRedirectCallback_iface);
1203 }
1204
1205 static nsresult NSAPI nsAsyncVerifyRedirectCallback_QueryInterface(nsIAsyncVerifyRedirectCallback *iface,
1206         nsIIDRef riid, void **result)
1207 {
1208     nsRedirectCallback *This = impl_from_nsIAsyncVerifyRedirectCallback(iface);
1209
1210     if(IsEqualGUID(&IID_nsISupports, riid)) {
1211         TRACE("(%p)->(IID_nsISupports %p)\n", This, result);
1212         *result = &This->nsIAsyncVerifyRedirectCallback_iface;
1213     }else if(IsEqualGUID(&IID_nsIAsyncVerifyRedirectCallback, riid)) {
1214         TRACE("(%p)->(IID_nsIAsyncVerifyRedirectCallback %p)\n", This, result);
1215         *result = &This->nsIAsyncVerifyRedirectCallback_iface;
1216     }else {
1217         *result = NULL;
1218         WARN("unimplemented iface %s\n", debugstr_guid(riid));
1219         return NS_NOINTERFACE;
1220     }
1221
1222     nsISupports_AddRef((nsISupports*)*result);
1223     return NS_OK;
1224 }
1225
1226 static nsrefcnt NSAPI nsAsyncVerifyRedirectCallback_AddRef(nsIAsyncVerifyRedirectCallback *iface)
1227 {
1228     nsRedirectCallback *This = impl_from_nsIAsyncVerifyRedirectCallback(iface);
1229     LONG ref = InterlockedIncrement(&This->ref);
1230
1231     TRACE("(%p) ref=%ld\n", This, ref);
1232
1233     return ref;
1234 }
1235
1236 static nsrefcnt NSAPI nsAsyncVerifyRedirectCallback_Release(nsIAsyncVerifyRedirectCallback *iface)
1237 {
1238     nsRedirectCallback *This = impl_from_nsIAsyncVerifyRedirectCallback(iface);
1239     LONG ref = InterlockedDecrement(&This->ref);
1240
1241     TRACE("(%p) ref=%ld\n", This, ref);
1242
1243     if(!ref) {
1244         IBindStatusCallback_Release(&This->bsc->bsc.IBindStatusCallback_iface);
1245         nsIHttpChannel_Release(&This->nschannel->nsIHttpChannel_iface);
1246         free(This);
1247     }
1248
1249     return ref;
1250 }
1251
1252 static nsresult NSAPI nsAsyncVerifyRedirectCallback_OnRedirectVerifyCallback(nsIAsyncVerifyRedirectCallback *iface, nsresult result)
1253 {
1254     nsRedirectCallback *This = impl_from_nsIAsyncVerifyRedirectCallback(iface);
1255     nsChannel *old_nschannel;
1256     nsresult nsres;
1257
1258     TRACE("(%p)->(%08lx)\n", This, result);
1259
1260     old_nschannel = This->bsc->nschannel;
1261     nsIHttpChannel_AddRef(&This->nschannel->nsIHttpChannel_iface);
1262     This->bsc->nschannel = This->nschannel;
1263
1264     if(This->nschannel->load_group) {
1265         nsres = nsILoadGroup_AddRequest(This->nschannel->load_group, (nsIRequest*)&This->nschannel->nsIHttpChannel_iface,
1266                 NULL);
1267         if(NS_FAILED(nsres))
1268             ERR("AddRequest failed: %08lx\n", nsres);
1269     }
1270
1271     if(This->bsc->is_doc_channel && This->bsc->bsc.window && This->bsc->bsc.window->base.outer_window) {
1272         IUri *uri = nsuri_get_uri(This->nschannel->uri);
1273
1274         if(uri) {
1275             set_current_uri(This->bsc->bsc.window->base.outer_window, uri);
1276             IUri_Release(uri);
1277         }else {
1278             WARN("Could not get IUri from nsWineURI\n");
1279         }
1280     }
1281
1282     if(old_nschannel) {
1283         if(old_nschannel->load_group) {
1284             nsres = nsILoadGroup_RemoveRequest(old_nschannel->load_group,
1285                     (nsIRequest*)&old_nschannel->nsIHttpChannel_iface, NULL, NS_OK);
1286             if(NS_FAILED(nsres))
1287                 ERR("RemoveRequest failed: %08lx\n", nsres);
1288         }
1289         nsIHttpChannel_Release(&old_nschannel->nsIHttpChannel_iface);
1290     }
1291
1292     return NS_OK;
1293 }
1294
1295 static const nsIAsyncVerifyRedirectCallbackVtbl nsAsyncVerifyRedirectCallbackVtbl = {
1296     nsAsyncVerifyRedirectCallback_QueryInterface,
1297     nsAsyncVerifyRedirectCallback_AddRef,
1298     nsAsyncVerifyRedirectCallback_Release,
1299     nsAsyncVerifyRedirectCallback_OnRedirectVerifyCallback
1300 };
1301
1302 static HRESULT create_redirect_callback(nsChannel *nschannel, nsChannelBSC *bsc, nsRedirectCallback **ret)
1303 {
1304     nsRedirectCallback *callback;
1305
1306     callback = malloc(sizeof(*callback));
1307     if(!callback)
1308         return E_OUTOFMEMORY;
1309
1310     callback->nsIAsyncVerifyRedirectCallback_iface.lpVtbl = &nsAsyncVerifyRedirectCallbackVtbl;
1311     callback->ref = 1;
1312
1313     nsIHttpChannel_AddRef(&nschannel->nsIHttpChannel_iface);
1314     callback->nschannel = nschannel;
1315
1316     IBindStatusCallback_AddRef(&bsc->bsc.IBindStatusCallback_iface);
1317     callback->bsc = bsc;
1318
1319     *ret = callback;
1320     return S_OK;
1321 }
1322
1323 static inline nsChannelBSC *nsChannelBSC_from_BSCallback(BSCallback *iface)
1324 {
1325     return CONTAINING_RECORD(iface, nsChannelBSC, bsc);
1326 }
1327
1328 static void nsChannelBSC_destroy(BSCallback *bsc)
1329 {
1330     nsChannelBSC *This = nsChannelBSC_from_BSCallback(bsc);
1331
1332     if(This->nschannel) {
1333         if(This->nschannel->binding == This)
1334             This->nschannel->binding = NULL;
1335         nsIHttpChannel_Release(&This->nschannel->nsIHttpChannel_iface);
1336     }
1337     if(This->nslistener)
1338         nsIStreamListener_Release(This->nslistener);
1339     if(This->nscontext)
1340         nsISupports_Release(This->nscontext);
1341     if(This->nsstream)
1342         nsIInputStream_Release(&This->nsstream->nsIInputStream_iface);
1343     free(This);
1344 }
1345
1346 static HRESULT nsChannelBSC_start_binding(BSCallback *bsc)
1347 {
1348     nsChannelBSC *This = nsChannelBSC_from_BSCallback(bsc);
1349
1350     if(This->is_doc_channel) {
1351         DWORD flags = This->bsc.window->base.outer_window->load_flags;
1352
1353         if(flags & BINDING_FROMHIST)
1354             This->bsc.window->navigation_type = 2;  /* TYPE_BACK_FORWARD */
1355         if(flags & BINDING_REFRESH)
1356             This->bsc.window->navigation_type = 1;  /* TYPE_RELOAD */
1357
1358         This->bsc.window->base.outer_window->base.inner_window->doc->skip_mutation_notif = FALSE;
1359         This->bsc.window->navigation_start_time = get_time_stamp();
1360     }
1361
1362     return S_OK;
1363 }
1364
1365 static HRESULT nsChannelBSC_init_bindinfo(BSCallback *bsc)
1366 {
1367     nsChannelBSC *This = nsChannelBSC_from_BSCallback(bsc);
1368     nsChannel *nschannel = This->nschannel;
1369     GeckoBrowser *browser;
1370     HRESULT hres;
1371
1372     if(This->is_doc_channel && This->bsc.window && This->bsc.window->base.outer_window
1373        && (browser = This->bsc.window->base.outer_window->browser)) {
1374         if(browser->doc->hostinfo.dwFlags & DOCHOSTUIFLAG_ENABLE_REDIRECT_NOTIFICATION)
1375             This->bsc.bindinfo_options |= BINDINFO_OPTIONS_DISABLEAUTOREDIRECTS;
1376     }
1377
1378     if(nschannel && nschannel->post_data_stream) {
1379         hres = read_post_data_stream(nschannel->post_data_stream, nschannel->post_data_contains_headers,
1380                 &nschannel->request_headers, &This->bsc.request_data);
1381         if(FAILED(hres))
1382             return hres;
1383     }
1384
1385     return S_OK;
1386 }
1387
1388 typedef struct {
1389     task_t header;
1390     nsChannelBSC *bsc;
1391 } stop_request_task_t;
1392
1393 static void stop_request_proc(task_t *_task)
1394 {
1395     stop_request_task_t *task = (stop_request_task_t*)_task;
1396
1397     TRACE("(%p)\n", task->bsc);
1398
1399     list_remove(&task->bsc->bsc.entry);
1400     list_init(&task->bsc->bsc.entry);
1401     on_stop_nsrequest(task->bsc, S_OK);
1402 }
1403
1404 static void stop_request_task_destr(task_t *_task)
1405 {
1406     stop_request_task_t *task = (stop_request_task_t*)_task;
1407
1408     IBindStatusCallback_Release(&task->bsc->bsc.IBindStatusCallback_iface);
1409 }
1410
1411 static HRESULT async_stop_request(nsChannelBSC *This)
1412 {
1413     HTMLInnerWindow *window = This->bsc.window;
1414     stop_request_task_t *task;
1415     HRESULT hres;
1416
1417     IHTMLWindow2_AddRef(&window->base.IHTMLWindow2_iface);
1418     if(!This->bsc.read) {
1419         TRACE("No data read, calling OnStartRequest\n");
1420         on_start_nsrequest(This);
1421     }
1422
1423     task = malloc(sizeof(*task));
1424     if(!task)
1425         return E_OUTOFMEMORY;
1426
1427     IBindStatusCallback_AddRef(&This->bsc.IBindStatusCallback_iface);
1428     task->bsc = This;
1429
1430     hres = push_task(&task->header, stop_request_proc, stop_request_task_destr, window->task_magic);
1431     IHTMLWindow2_Release(&window->base.IHTMLWindow2_iface);
1432     return hres;
1433 }
1434
1435 static void handle_navigation_error(nsChannelBSC *This, DWORD result)
1436 {
1437     HTMLOuterWindow *outer_window;
1438     HTMLDocumentObj *doc;
1439     BOOL is_error_url;
1440     SAFEARRAY *sa;
1441     SAFEARRAYBOUND bound;
1442     VARIANT var, varOut;
1443     LONG ind;
1444     BSTR unk;
1445     HRESULT hres;
1446
1447     if(!This->is_doc_channel || !This->bsc.window || !This->bsc.window->base.outer_window
1448        || !This->bsc.window->base.outer_window->browser)
1449         return;
1450
1451     outer_window = This->bsc.window->base.outer_window;
1452     doc = outer_window->browser->doc;
1453     if(!doc->doc_object_service || !doc->client)
1454         return;
1455
1456     hres = IDocObjectService_IsErrorUrl(doc->doc_object_service,
1457             outer_window->url, &is_error_url);
1458     if(FAILED(hres) || is_error_url)
1459         return;
1460
1461     if(!doc->client_cmdtrg)
1462         return;
1463
1464     bound.lLbound = 0;
1465     bound.cElements = 8;
1466     sa = SafeArrayCreate(VT_VARIANT, 1, &bound);
1467     if(!sa)
1468         return;
1469
1470     ind = 0;
1471     V_VT(&var) = VT_I4;
1472     V_I4(&var) = result;
1473     SafeArrayPutElement(sa, &ind, &var);
1474
1475     ind = 1;
1476     V_VT(&var) = VT_BSTR;
1477     V_BSTR(&var) = outer_window->url;
1478     SafeArrayPutElement(sa, &ind, &var);
1479
1480     ind = 3;
1481     V_VT(&var) = VT_UNKNOWN;
1482     V_UNKNOWN(&var) = (IUnknown*)&outer_window->base.IHTMLWindow2_iface;
1483     SafeArrayPutElement(sa, &ind, &var);
1484
1485     /* FIXME: what are the following fields for? */
1486     ind = 2;
1487     V_VT(&var) = VT_UNKNOWN;
1488     V_UNKNOWN(&var) = NULL;
1489     SafeArrayPutElement(sa, &ind, &var);
1490
1491     ind = 4;
1492     V_VT(&var) = VT_BOOL;
1493     V_BOOL(&var) = FALSE;
1494     SafeArrayPutElement(sa, &ind, &var);
1495
1496     ind = 5;
1497     V_VT(&var) = VT_BOOL;
1498     V_BOOL(&var) = FALSE;
1499     SafeArrayPutElement(sa, &ind, &var);
1500
1501     ind = 6;
1502     V_VT(&var) = VT_BSTR;
1503     unk = SysAllocString(NULL);
1504     V_BSTR(&var) = unk;
1505     SafeArrayPutElement(sa, &ind, &var);
1506
1507     ind = 7;
1508     V_VT(&var) = VT_UNKNOWN;
1509     V_UNKNOWN(&var) = NULL;
1510     SafeArrayPutElement(sa, &ind, &var);
1511
1512     V_VT(&var) = VT_ARRAY;
1513     V_ARRAY(&var) = sa;
1514     V_VT(&varOut) = VT_BOOL;
1515     V_BOOL(&varOut) = VARIANT_TRUE;
1516     IOleCommandTarget_Exec(doc->client_cmdtrg, &CGID_DocHostCmdPriv, 1, 0, &var, FAILED(hres)?NULL:&varOut);
1517
1518     SysFreeString(unk);
1519     SafeArrayDestroy(sa);
1520 }
1521
1522 static HRESULT nsChannelBSC_stop_binding(BSCallback *bsc, HRESULT result)
1523 {
1524     nsChannelBSC *This = nsChannelBSC_from_BSCallback(bsc);
1525
1526     if(This->is_doc_channel && This->bsc.window) {
1527         This->bsc.window->response_end_time = get_time_stamp();
1528         if(result != E_ABORT) {
1529             if(FAILED(result))
1530                 handle_navigation_error(This, result);
1531             else if(This->nschannel) {
1532                 result = async_stop_request(This);
1533                 if(SUCCEEDED(result))
1534                     return S_OK;
1535             }
1536         }
1537     }
1538
1539     on_stop_nsrequest(This, result);
1540     return S_OK;
1541 }
1542
1543 static HRESULT nsChannelBSC_read_data(BSCallback *bsc, IStream *stream)
1544 {
1545     nsChannelBSC *This = nsChannelBSC_from_BSCallback(bsc);
1546
1547     return read_stream_data(This, stream);
1548 }
1549
1550 static HRESULT handle_redirect(nsChannelBSC *This, const WCHAR *new_url)
1551 {
1552     nsRedirectCallback *callback;
1553     nsIChannelEventSink *sink;
1554     nsChannel *new_channel;
1555     IMoniker *mon;
1556     nsresult nsres;
1557     HRESULT hres;
1558
1559     TRACE("(%p)->(%s)\n", This, debugstr_w(new_url));
1560
1561     hres = CreateURLMoniker(NULL, new_url, &mon);
1562     if(FAILED(hres))
1563         return hres;
1564     IMoniker_Release(This->bsc.mon);
1565     This->bsc.mon = mon;
1566
1567     if(!This->nschannel || !This->nschannel->notif_callback)
1568         return S_OK;
1569
1570     nsres = nsIInterfaceRequestor_GetInterface(This->nschannel->notif_callback, &IID_nsIChannelEventSink, (void**)&sink);
1571     if(NS_FAILED(nsres))
1572         return S_OK;
1573
1574     hres = create_redirect_nschannel(new_url, This->nschannel, &new_channel);
1575     if(SUCCEEDED(hres)) {
1576         TRACE("%p %p->%p\n", This, This->nschannel, new_channel);
1577
1578         hres = create_redirect_callback(new_channel, This, &callback);
1579         nsIHttpChannel_Release(&new_channel->nsIHttpChannel_iface);
1580     }
1581
1582     if(SUCCEEDED(hres)) {
1583         nsres = nsIChannelEventSink_AsyncOnChannelRedirect(sink, (nsIChannel*)&This->nschannel->nsIHttpChannel_iface,
1584                 (nsIChannel*)&callback->nschannel->nsIHttpChannel_iface, REDIRECT_TEMPORARY, /* FIXME */
1585                 &callback->nsIAsyncVerifyRedirectCallback_iface);
1586
1587         if(NS_FAILED(nsres))
1588             FIXME("AsyncOnChannelRedirect failed: %08lx\n", hres);
1589         else if(This->nschannel != callback->nschannel)
1590             FIXME("nschannel not updated\n");
1591
1592         nsIAsyncVerifyRedirectCallback_Release(&callback->nsIAsyncVerifyRedirectCallback_iface);
1593     }
1594
1595     nsIChannelEventSink_Release(sink);
1596     return hres;
1597 }
1598
1599 static BOOL is_supported_doc_mime(const WCHAR *mime)
1600 {
1601     char *nscat, *mimea;
1602     BOOL ret;
1603
1604     mimea = strdupWtoA(mime);
1605     if(!mimea)
1606         return FALSE;
1607
1608     nscat = get_nscategory_entry("Gecko-Content-Viewers", mimea);
1609
1610     ret = nscat != NULL && !strcmp(nscat, "@mozilla.org/content/document-loader-factory;1");
1611
1612     free(mimea);
1613     nsfree(nscat);
1614     return ret;
1615 }
1616
1617 static IUri *get_moniker_uri(IMoniker *mon)
1618 {
1619     IUriContainer *uri_container;
1620     IUri *ret = NULL;
1621     HRESULT hres;
1622
1623     hres = IMoniker_QueryInterface(mon, &IID_IUriContainer, (void**)&uri_container);
1624     if(SUCCEEDED(hres)) {
1625         hres = IUriContainer_GetIUri(uri_container, &ret);
1626         IUriContainer_Release(uri_container);
1627         if(FAILED(hres))
1628             return NULL;
1629     }else {
1630         FIXME("No IUriContainer\n");
1631     }
1632
1633     return ret;
1634 }
1635
1636 static void handle_extern_mime_navigation(nsChannelBSC *This)
1637 {
1638     IWebBrowserPriv2IE9 *webbrowser_priv;
1639     IOleCommandTarget *cmdtrg;
1640     HTMLDocumentObj *doc_obj;
1641     IBindCtx *bind_ctx;
1642     IUri *uri;
1643     VARIANT flags;
1644     HRESULT hres;
1645
1646     if(!This->bsc.window || !This->bsc.window->base.outer_window || !This->bsc.window->base.outer_window->browser)
1647         return;
1648
1649     doc_obj = This->bsc.window->base.outer_window->browser->doc;
1650     IUnknown_AddRef(doc_obj->outer_unk);
1651
1652     hres = IOleClientSite_QueryInterface(doc_obj->client, &IID_IOleCommandTarget, (void**)&cmdtrg);
1653     if(SUCCEEDED(hres)) {
1654         IOleCommandTarget_Exec(cmdtrg, &CGID_ShellDocView, 62, 0, NULL, NULL);
1655         IOleCommandTarget_Release(cmdtrg);
1656     }
1657
1658     set_document_navigation(doc_obj, FALSE);
1659
1660     if(!doc_obj->webbrowser) {
1661         FIXME("unimplemented in non-webbrowser mode\n");
1662         goto done;
1663     }
1664
1665     uri = get_moniker_uri(This->bsc.mon);
1666     if(!uri)
1667         goto done;
1668
1669     hres = CreateBindCtx(0, &bind_ctx);
1670     if(FAILED(hres)) {
1671         IUri_Release(uri);
1672         goto done;
1673     }
1674
1675     V_VT(&flags) = VT_I4;
1676     V_I4(&flags) = navHyperlink;
1677
1678     hres = IUnknown_QueryInterface(doc_obj->webbrowser, &IID_IWebBrowserPriv2IE8, (void**)&webbrowser_priv);
1679     if(SUCCEEDED(hres)) {
1680         hres = IWebBrowserPriv2IE9_NavigateWithBindCtx2(webbrowser_priv, uri, &flags, NULL, NULL, NULL, bind_ctx, NULL, 0);
1681         IWebBrowserPriv2IE9_Release(webbrowser_priv);
1682     }else {
1683         IWebBrowserPriv *webbrowser_priv_old;
1684         VARIANT uriv;
1685
1686         hres = IUnknown_QueryInterface(doc_obj->webbrowser, &IID_IWebBrowserPriv, (void**)&webbrowser_priv_old);
1687         if(SUCCEEDED(hres)) {
1688             V_VT(&uriv) = VT_BSTR;
1689             V_BSTR(&uriv) = NULL;
1690             hres = IUri_GetDisplayUri(uri, &V_BSTR(&uriv));
1691
1692             if(hres == S_OK)
1693                 hres = IWebBrowserPriv_NavigateWithBindCtx(webbrowser_priv_old, &uriv, &flags, NULL, NULL, NULL, bind_ctx, NULL);
1694
1695             SysFreeString(V_BSTR(&uriv));
1696             IWebBrowserPriv_Release(webbrowser_priv_old);
1697         }
1698     }
1699
1700     IUri_Release(uri);
1701
1702 done:
1703     IUnknown_Release(doc_obj->outer_unk);
1704 }
1705
1706 static HRESULT nsChannelBSC_on_progress(BSCallback *bsc, ULONG progress, ULONG total, ULONG status_code, LPCWSTR status_text)
1707 {
1708     nsChannelBSC *This = nsChannelBSC_from_BSCallback(bsc);
1709
1710     switch(status_code) {
1711     case BINDSTATUS_MIMETYPEAVAILABLE:
1712         if(This->is_doc_channel && !is_supported_doc_mime(status_text)) {
1713             FIXME("External MIME: %s\n", debugstr_w(status_text));
1714
1715             handle_extern_mime_navigation(This);
1716
1717             This->nschannel = NULL;
1718         }
1719
1720         if(!This->nschannel ||
1721            (This->nschannel->content_type && !(This->nschannel->load_flags & LOAD_CALL_CONTENT_SNIFFERS)))
1722             return S_OK;
1723
1724         free(This->nschannel->content_type);
1725         This->nschannel->content_type = strdupWtoA(status_text);
1726         break;
1727     case BINDSTATUS_REDIRECTING:
1728         if(This->is_doc_channel) {
1729             This->bsc.window->redirect_count++;
1730             if(!This->bsc.window->redirect_time)
1731                 This->bsc.window->redirect_time = get_time_stamp();
1732         }
1733         return handle_redirect(This, status_text);
1734     case BINDSTATUS_FINDINGRESOURCE:
1735         if(This->is_doc_channel && !This->bsc.window->dns_lookup_time)
1736             This->bsc.window->dns_lookup_time = get_time_stamp();
1737         break;
1738     case BINDSTATUS_CONNECTING:
1739         if(This->is_doc_channel)
1740             This->bsc.window->connect_time = get_time_stamp();
1741         break;
1742     case BINDSTATUS_SENDINGREQUEST:
1743         if(This->is_doc_channel)
1744             This->bsc.window->request_time = get_time_stamp();
1745         break;
1746     case BINDSTATUS_BEGINDOWNLOADDATA: {
1747         IWinInetHttpInfo *http_info;
1748         DWORD status, size = sizeof(DWORD);
1749         HRESULT hres;
1750
1751         if(This->bsc.binding) {
1752             hres = IBinding_QueryInterface(This->bsc.binding, &IID_IWinInetHttpInfo, (void**)&http_info);
1753             if(SUCCEEDED(hres)) {
1754                 hres = IWinInetHttpInfo_QueryInfo(http_info,
1755                         HTTP_QUERY_STATUS_CODE|HTTP_QUERY_FLAG_NUMBER, &status, &size, NULL, NULL);
1756                 IWinInetHttpInfo_Release(http_info);
1757                 if(SUCCEEDED(hres) && status != HTTP_STATUS_OK)
1758                     handle_navigation_error(This, status);
1759             }
1760         }
1761         /* fall through */
1762     }
1763     case BINDSTATUS_DOWNLOADINGDATA:
1764     case BINDSTATUS_ENDDOWNLOADDATA:
1765         /* Defer it to just before calling OnDataAvailable, otherwise it can have wrong state */
1766         This->progress = progress;
1767         This->total = total;
1768         break;
1769     }
1770
1771     return S_OK;
1772 }
1773
1774 static HRESULT process_response_status_text(const WCHAR *header, const WCHAR *header_end, char **status_text)
1775 {
1776     header = wcschr(header + 1, ' ');
1777     if(!header || header >= header_end)
1778         return E_FAIL;
1779     header = wcschr(header + 1, ' ');
1780     if(!header || header >= header_end)
1781         header = header_end;
1782     else
1783         ++header;
1784
1785     *status_text = strndupWtoU(header, header_end - header);
1786
1787     if(!*status_text)
1788         return E_OUTOFMEMORY;
1789
1790     return S_OK;
1791 }
1792
1793 static HRESULT nsChannelBSC_on_response(BSCallback *bsc, DWORD response_code,
1794         LPCWSTR response_headers)
1795 {
1796     nsChannelBSC *This = nsChannelBSC_from_BSCallback(bsc);
1797     char *str;
1798     HRESULT hres;
1799
1800     if(This->is_doc_channel)
1801         This->bsc.window->response_start_time = get_time_stamp();
1802
1803     This->response_processed = TRUE;
1804     This->nschannel->response_status = response_code;
1805
1806     if(response_headers) {
1807         const WCHAR *headers;
1808
1809         headers = wcschr(response_headers, '\r');
1810         hres = process_response_status_text(response_headers, headers, &str);
1811         if(FAILED(hres)) {
1812             WARN("parsing headers failed: %08lx\n", hres);
1813             return hres;
1814         }
1815
1816         free(This->nschannel->response_status_text);
1817         This->nschannel->response_status_text = str;
1818
1819         if(headers && headers[1] == '\n') {
1820             headers += 2;
1821             hres = process_response_headers(This, headers);
1822             if(FAILED(hres)) {
1823                 WARN("parsing headers failed: %08lx\n", hres);
1824                 return hres;
1825             }
1826         }
1827     }
1828
1829     return S_OK;
1830 }
1831
1832 static HRESULT nsChannelBSC_beginning_transaction(BSCallback *bsc, WCHAR **additional_headers)
1833 {
1834     nsChannelBSC *This = nsChannelBSC_from_BSCallback(bsc);
1835     http_header_t *iter;
1836     DWORD len = 0;
1837     WCHAR *ptr;
1838
1839     if(!This->nschannel)
1840         return S_FALSE;
1841
1842     LIST_FOR_EACH_ENTRY(iter, &This->nschannel->request_headers, http_header_t, entry) {
1843         if(wcscmp(iter->header, L"Content-Length"))
1844             len += lstrlenW(iter->header) + 2 /* ": " */ + lstrlenW(iter->data) + 2 /* "\r\n" */;
1845     }
1846
1847     if(!len)
1848         return S_OK;
1849
1850     *additional_headers = ptr = CoTaskMemAlloc((len+1)*sizeof(WCHAR));
1851     if(!ptr)
1852         return E_OUTOFMEMORY;
1853
1854     LIST_FOR_EACH_ENTRY(iter, &This->nschannel->request_headers, http_header_t, entry) {
1855         if(!wcscmp(iter->header, L"Content-Length"))
1856             continue;
1857
1858         len = lstrlenW(iter->header);
1859         memcpy(ptr, iter->header, len*sizeof(WCHAR));
1860         ptr += len;
1861
1862         *ptr++ = ':';
1863         *ptr++ = ' ';
1864
1865         len = lstrlenW(iter->data);
1866         memcpy(ptr, iter->data, len*sizeof(WCHAR));
1867         ptr += len;
1868
1869         *ptr++ = '\r';
1870         *ptr++ = '\n';
1871     }
1872
1873     *ptr = 0;
1874
1875     return S_OK;
1876 }
1877
1878 static const BSCallbackVtbl nsChannelBSCVtbl = {
1879     nsChannelBSC_destroy,
1880     nsChannelBSC_init_bindinfo,
1881     nsChannelBSC_start_binding,
1882     nsChannelBSC_stop_binding,
1883     nsChannelBSC_read_data,
1884     nsChannelBSC_on_progress,
1885     nsChannelBSC_on_response,
1886     nsChannelBSC_beginning_transaction
1887 };
1888
1889 HRESULT create_channelbsc(IMoniker *mon, const WCHAR *headers, BYTE *post_data, DWORD post_data_size,
1890         BOOL is_doc_binding, nsChannelBSC **retval)
1891 {
1892     nsChannelBSC *ret;
1893     DWORD bindf;
1894
1895     ret = calloc(1, sizeof(*ret));
1896     if(!ret)
1897         return E_OUTOFMEMORY;
1898
1899     bindf = BINDF_ASYNCHRONOUS | BINDF_ASYNCSTORAGE | BINDF_PULLDATA;
1900     if(post_data_size)
1901         bindf |= BINDF_FORMS_SUBMIT | BINDF_PRAGMA_NO_CACHE | BINDF_HYPERLINK | BINDF_GETNEWESTVERSION;
1902
1903     init_bscallback(&ret->bsc, &nsChannelBSCVtbl, mon, bindf);
1904     ret->is_doc_channel = is_doc_binding;
1905
1906     if(headers) {
1907         ret->bsc.request_data.headers = wcsdup(headers);
1908         if(!ret->bsc.request_data.headers) {
1909             IBindStatusCallback_Release(&ret->bsc.IBindStatusCallback_iface);
1910             return E_OUTOFMEMORY;
1911         }
1912     }
1913
1914     if(post_data) {
1915         ret->bsc.request_data.post_data = GlobalAlloc(0, post_data_size+1);
1916         if(!ret->bsc.request_data.post_data) {
1917             release_request_data(&ret->bsc.request_data);
1918             IBindStatusCallback_Release(&ret->bsc.IBindStatusCallback_iface);
1919             return E_OUTOFMEMORY;
1920         }
1921
1922         memcpy(ret->bsc.request_data.post_data, post_data, post_data_size);
1923         ((BYTE*)ret->bsc.request_data.post_data)[post_data_size] = 0;
1924         ret->bsc.request_data.post_data_len = post_data_size;
1925     }
1926
1927     TRACE("created %p\n", ret);
1928     *retval = ret;
1929     return S_OK;
1930 }
1931
1932 typedef struct {
1933     task_t header;
1934     DWORD flags;
1935     HTMLOuterWindow *window;
1936     HTMLInnerWindow *pending_window;
1937 } start_doc_binding_task_t;
1938
1939 static void start_doc_binding_proc(task_t *_task)
1940 {
1941     start_doc_binding_task_t *task = (start_doc_binding_task_t*)_task;
1942     HTMLOuterWindow *window = task->window;
1943
1944     IHTMLWindow2_AddRef(&window->base.IHTMLWindow2_iface);
1945     set_current_mon(window, task->pending_window->bscallback->bsc.mon, task->flags);
1946     IHTMLWindow2_Release(&window->base.IHTMLWindow2_iface);
1947
1948     start_binding(task->pending_window, &task->pending_window->bscallback->bsc, NULL);
1949 }
1950
1951 static void start_doc_binding_task_destr(task_t *_task)
1952 {
1953     start_doc_binding_task_t *task = (start_doc_binding_task_t*)_task;
1954
1955     IHTMLWindow2_Release(&task->pending_window->base.IHTMLWindow2_iface);
1956 }
1957
1958 HRESULT async_start_doc_binding(HTMLOuterWindow *window, HTMLInnerWindow *pending_window, DWORD flags)
1959 {
1960     start_doc_binding_task_t *task;
1961
1962     TRACE("%p\n", pending_window);
1963
1964     task = malloc(sizeof(start_doc_binding_task_t));
1965     if(!task)
1966         return E_OUTOFMEMORY;
1967
1968     task->flags = flags;
1969     task->window = window;
1970     task->pending_window = pending_window;
1971     IHTMLWindow2_AddRef(&pending_window->base.IHTMLWindow2_iface);
1972
1973     return push_task(&task->header, start_doc_binding_proc, start_doc_binding_task_destr, pending_window->task_magic);
1974 }
1975
1976 void abort_window_bindings(HTMLInnerWindow *window)
1977 {
1978     BSCallback *iter;
1979
1980     remove_target_tasks(window->task_magic);
1981
1982     while(!list_empty(&window->bindings)) {
1983         iter = LIST_ENTRY(window->bindings.next, BSCallback, entry);
1984
1985         TRACE("Aborting %p\n", iter);
1986
1987         IBindStatusCallback_AddRef(&iter->IBindStatusCallback_iface);
1988
1989         if(iter->binding) {
1990             IBinding *binding = iter->binding;
1991
1992             /* Abort can end up calling our OnStopBinding, which releases the binding. */
1993             IBinding_AddRef(binding);
1994             IBinding_Abort(binding);
1995             IBinding_Release(binding);
1996         }else {
1997             iter->vtbl->stop_binding(iter, E_ABORT);
1998         }
1999
2000         iter->window = NULL;
2001         list_remove(&iter->entry);
2002         list_init(&iter->entry);
2003
2004         IBindStatusCallback_Release(&iter->IBindStatusCallback_iface);
2005     }
2006
2007     if(window->bscallback) {
2008         IBindStatusCallback_Release(&window->bscallback->bsc.IBindStatusCallback_iface);
2009         window->bscallback = NULL;
2010     }
2011
2012     unlink_ref(&window->mon);
2013 }
2014
2015 HRESULT channelbsc_load_stream(HTMLInnerWindow *pending_window, IMoniker *mon, IStream *stream)
2016 {
2017     HTMLOuterWindow *window = pending_window->base.outer_window;
2018     nsChannelBSC *bscallback = pending_window->bscallback;
2019     HRESULT hres = S_OK;
2020
2021     if(!bscallback->nschannel) {
2022         ERR("NULL nschannel\n");
2023         return E_FAIL;
2024     }
2025
2026     bscallback->nschannel->content_type = strdup("text/html");
2027     if(!bscallback->nschannel->content_type)
2028         return E_OUTOFMEMORY;
2029
2030     IHTMLWindow2_AddRef(&window->base.IHTMLWindow2_iface);
2031     set_current_mon(window, mon, 0);
2032     IHTMLWindow2_Release(&window->base.IHTMLWindow2_iface);
2033
2034     bscallback->bsc.window = pending_window;
2035     if(stream)
2036         hres = read_stream_data(bscallback, stream);
2037     if(SUCCEEDED(hres))
2038         hres = async_stop_request(bscallback);
2039     if(FAILED(hres))
2040         IBindStatusCallback_OnStopBinding(&bscallback->bsc.IBindStatusCallback_iface, hres, NULL);
2041
2042     return hres;
2043 }
2044
2045 void channelbsc_set_channel(nsChannelBSC *This, nsChannel *channel, nsIStreamListener *listener, nsISupports *context)
2046 {
2047     nsIHttpChannel_AddRef(&channel->nsIHttpChannel_iface);
2048     This->nschannel = channel;
2049
2050     nsIStreamListener_AddRef(listener);
2051     This->nslistener = listener;
2052
2053     if(context) {
2054         nsISupports_AddRef(context);
2055         This->nscontext = context;
2056     }
2057
2058     if(This->bsc.request_data.headers) {
2059         HRESULT hres;
2060
2061         hres = parse_headers(This->bsc.request_data.headers, &channel->request_headers);
2062         free(This->bsc.request_data.headers);
2063         This->bsc.request_data.headers = NULL;
2064         if(FAILED(hres))
2065             WARN("parse_headers failed: %08lx\n", hres);
2066     }
2067 }
2068
2069 typedef struct {
2070     task_t header;
2071     HTMLOuterWindow *window;
2072     IUri *uri;
2073 } navigate_javascript_task_t;
2074
2075 static void navigate_javascript_proc(task_t *_task)
2076 {
2077     navigate_javascript_task_t *task = (navigate_javascript_task_t*)_task;
2078     HTMLInnerWindow *inner_window = task->window->base.inner_window;
2079     HTMLOuterWindow *window = task->window;
2080     HTMLDocumentObj *doc = NULL;
2081     BSTR code = NULL;
2082     VARIANT v;
2083     HRESULT hres;
2084
2085     window->readystate = READYSTATE_COMPLETE;
2086     if(window->browser) {
2087         doc = window->browser->doc;
2088         IUnknown_AddRef(doc->outer_unk);
2089     }
2090     IHTMLWindow2_AddRef(&inner_window->base.IHTMLWindow2_iface);
2091
2092     hres = IUri_GetPath(task->uri, &code);
2093     if(hres != S_OK) {
2094         SysFreeString(code);
2095         goto done;
2096     }
2097
2098     hres = UrlUnescapeW(code, NULL, NULL, URL_UNESCAPE_INPLACE);
2099     if(FAILED(hres)) {
2100         SysFreeString(code);
2101         goto done;
2102     }
2103
2104     if(doc)
2105         set_download_state(doc, 1);
2106
2107     V_VT(&v) = VT_EMPTY;
2108     hres = exec_script(inner_window, code, L"jscript", &v);
2109     SysFreeString(code);
2110     if(SUCCEEDED(hres) && V_VT(&v) != VT_EMPTY) {
2111         FIXME("javascirpt URL returned %s\n", debugstr_variant(&v));
2112         VariantClear(&v);
2113     }
2114
2115     if(doc) {
2116         if(doc->view_sink)
2117             IAdviseSink_OnViewChange(doc->view_sink, DVASPECT_CONTENT, -1);
2118
2119         set_download_state(doc, 0);
2120     }
2121
2122 done:
2123     IHTMLWindow2_Release(&inner_window->base.IHTMLWindow2_iface);
2124     if(doc)
2125         IUnknown_Release(doc->outer_unk);
2126 }
2127
2128 static void navigate_javascript_task_destr(task_t *_task)
2129 {
2130     navigate_javascript_task_t *task = (navigate_javascript_task_t*)_task;
2131
2132     IUri_Release(task->uri);
2133 }
2134
2135 typedef struct {
2136     task_t header;
2137     HTMLOuterWindow *window;
2138     nsChannelBSC *bscallback;
2139     DWORD flags;
2140     IMoniker *mon;
2141     IUri *uri;
2142 } navigate_task_t;
2143
2144 static void navigate_proc(task_t *_task)
2145 {
2146     navigate_task_t *task = (navigate_task_t*)_task;
2147     HTMLOuterWindow *window = task->window;
2148     HRESULT hres;
2149
2150     IHTMLWindow2_AddRef(&window->base.IHTMLWindow2_iface);
2151
2152     hres = set_moniker(window, task->mon, task->uri, NULL, task->bscallback, TRUE);
2153     if(SUCCEEDED(hres)) {
2154         set_current_mon(window, task->bscallback->bsc.mon, task->flags);
2155         set_current_uri(window, task->uri);
2156         start_binding(window->pending_window, &task->bscallback->bsc, NULL);
2157     }
2158
2159     IHTMLWindow2_Release(&window->base.IHTMLWindow2_iface);
2160 }
2161
2162 static void navigate_task_destr(task_t *_task)
2163 {
2164     navigate_task_t *task = (navigate_task_t*)_task;
2165
2166     IBindStatusCallback_Release(&task->bscallback->bsc.IBindStatusCallback_iface);
2167     IMoniker_Release(task->mon);
2168     IUri_Release(task->uri);
2169 }
2170
2171 static HRESULT navigate_fragment(HTMLOuterWindow *window, IUri *uri)
2172 {
2173     nsIDOMLocation *nslocation;
2174     nsAString nsfrag_str;
2175     BSTR frag = NULL;
2176     WCHAR *selector;
2177     nsresult nsres;
2178     HRESULT hres;
2179     static const WCHAR selector_formatW[] = L"a[id=\"%s\"]";
2180
2181     set_current_uri(window, uri);
2182
2183     nsres = nsIDOMWindow_GetLocation(window->nswindow, &nslocation);
2184     if(FAILED(nsres) || !nslocation)
2185         return E_FAIL;
2186
2187     hres = IUri_GetFragment(uri, &frag);
2188     if(hres != S_OK) {
2189         SysFreeString(frag);
2190         nsIDOMLocation_Release(nslocation);
2191         return FAILED(hres) ? hres : S_OK;
2192     }
2193
2194     nsAString_InitDepend(&nsfrag_str, frag);
2195     nsres = nsIDOMLocation_SetHash(nslocation, &nsfrag_str);
2196     nsAString_Finish(&nsfrag_str);
2197     nsIDOMLocation_Release(nslocation);
2198     if(NS_FAILED(nsres))
2199         ERR("SetHash failed: %08lx\n", nsres);
2200
2201     /*
2202      * IE supports scrolling to anchor elements with "#hash" ids (note that '#' is part of the id),
2203      * while Gecko scrolls only to elements with "hash" ids. We scroll the page ourselves if
2204      * a[id="#hash"] element can be found.
2205      */
2206     selector = malloc(sizeof(selector_formatW) + SysStringLen(frag) * sizeof(WCHAR));
2207     if(selector) {
2208         nsIDOMElement *nselem = NULL;
2209         nsAString selector_str;
2210
2211         swprintf(selector, ARRAY_SIZE(selector_formatW)+SysStringLen(frag), selector_formatW, frag);
2212         nsAString_InitDepend(&selector_str, selector);
2213         /* NOTE: Gecko doesn't set result to NULL if there is no match, so nselem must be initialized */
2214         nsres = nsIDOMDocument_QuerySelector(window->base.inner_window->doc->dom_document, &selector_str, &nselem);
2215         nsAString_Finish(&selector_str);
2216         free(selector);
2217         if(NS_SUCCEEDED(nsres) && nselem) {
2218             nsIDOMHTMLElement *html_elem;
2219
2220             nsres = nsIDOMElement_QueryInterface(nselem, &IID_nsIDOMHTMLElement, (void**)&html_elem);
2221             nsIDOMElement_Release(nselem);
2222             if(NS_SUCCEEDED(nsres)) {
2223                 nsIDOMHTMLElement_ScrollIntoView(html_elem, TRUE, 1);
2224                 nsIDOMHTMLElement_Release(html_elem);
2225             }
2226         }
2227     }
2228
2229     SysFreeString(frag);
2230
2231     if(window->browser->doc->doc_object_service) {
2232         HTMLDocumentObj *doc_obj = window->browser->doc;
2233
2234         IUnknown_AddRef(doc_obj->outer_unk);
2235         IDocObjectService_FireNavigateComplete2(doc_obj->doc_object_service, &window->base.IHTMLWindow2_iface, 0x10);
2236         IDocObjectService_FireDocumentComplete(doc_obj->doc_object_service, &window->base.IHTMLWindow2_iface, 0);
2237         IUnknown_Release(doc_obj->outer_unk);
2238     }
2239
2240     return S_OK;
2241 }
2242
2243 HRESULT super_navigate(HTMLOuterWindow *window, IUri *uri, DWORD flags, const WCHAR *headers, BYTE *post_data, DWORD post_data_size)
2244 {
2245     HTMLDocumentObj *doc_obj;
2246     nsChannelBSC *bsc;
2247     IUri *uri_nofrag;
2248     IMoniker *mon;
2249     DWORD scheme;
2250     HRESULT hres;
2251
2252     uri_nofrag = get_uri_nofrag(uri);
2253     if(!uri_nofrag)
2254         return E_FAIL;
2255
2256     doc_obj = window->browser->doc;
2257     IUnknown_AddRef(doc_obj->outer_unk);
2258
2259     if(doc_obj->client && !(flags & BINDING_REFRESH)) {
2260         IOleCommandTarget *cmdtrg;
2261
2262         hres = IOleClientSite_QueryInterface(doc_obj->client, &IID_IOleCommandTarget, (void**)&cmdtrg);
2263         if(SUCCEEDED(hres)) {
2264             VARIANT in, out;
2265             BSTR url_str;
2266
2267             hres = IUri_GetDisplayUri(uri_nofrag, &url_str);
2268             if(SUCCEEDED(hres)) {
2269                 V_VT(&in) = VT_BSTR;
2270                 V_BSTR(&in) = url_str;
2271                 V_VT(&out) = VT_BOOL;
2272                 V_BOOL(&out) = VARIANT_TRUE;
2273                 hres = IOleCommandTarget_Exec(cmdtrg, &CGID_ShellDocView, 67, 0, &in, &out);
2274                 IOleCommandTarget_Release(cmdtrg);
2275                 if(SUCCEEDED(hres))
2276                     VariantClear(&out);
2277                 SysFreeString(url_str);
2278             }
2279         }
2280     }
2281
2282     if(!(flags & BINDING_NOFRAG) && window->uri_nofrag && !post_data_size) {
2283         BOOL eq;
2284
2285         hres = IUri_IsEqual(uri_nofrag, window->uri_nofrag, &eq);
2286         if(SUCCEEDED(hres) && eq) {
2287             IUri_Release(uri_nofrag);
2288             TRACE("fragment navigate\n");
2289             hres = navigate_fragment(window, uri);
2290             goto done;
2291         }
2292     }
2293
2294     hres = CreateURLMonikerEx2(NULL, uri_nofrag, &mon, URL_MK_UNIFORM);
2295     IUri_Release(uri_nofrag);
2296     if(FAILED(hres))
2297         goto done;
2298
2299     /* FIXME: Why not set_ready_state? */
2300     window->readystate = READYSTATE_UNINITIALIZED;
2301
2302     hres = create_channelbsc(mon, headers, post_data, post_data_size, TRUE, &bsc);
2303     if(FAILED(hres)) {
2304         IMoniker_Release(mon);
2305         goto done;
2306     }
2307
2308     prepare_for_binding(doc_obj, mon, flags);
2309
2310     hres = IUri_GetScheme(uri, &scheme);
2311     if(hres == S_OK && scheme == URL_SCHEME_JAVASCRIPT) {
2312         navigate_javascript_task_t *task;
2313
2314         IBindStatusCallback_Release(&bsc->bsc.IBindStatusCallback_iface);
2315         IMoniker_Release(mon);
2316
2317         task = malloc(sizeof(*task));
2318         if(!task) {
2319             hres = E_OUTOFMEMORY;
2320             goto done;
2321         }
2322
2323         /* Why silently? */
2324         window->readystate = READYSTATE_COMPLETE;
2325         if(!(flags & BINDING_FROMHIST))
2326             call_docview_84(doc_obj);
2327
2328         IUri_AddRef(uri);
2329         task->window = window;
2330         task->uri = uri;
2331         hres = push_task(&task->header, navigate_javascript_proc, navigate_javascript_task_destr, window->task_magic);
2332     }else if(flags & BINDING_SUBMIT) {
2333         hres = set_moniker(window, mon, uri, NULL, bsc, TRUE);
2334         if(SUCCEEDED(hres))
2335             hres = start_binding(window->pending_window, &bsc->bsc, NULL);
2336         IBindStatusCallback_Release(&bsc->bsc.IBindStatusCallback_iface);
2337         IMoniker_Release(mon);
2338     }else {
2339         navigate_task_t *task;
2340
2341         task = malloc(sizeof(*task));
2342         if(!task) {
2343             IBindStatusCallback_Release(&bsc->bsc.IBindStatusCallback_iface);
2344             IMoniker_Release(mon);
2345             hres = E_OUTOFMEMORY;
2346             goto done;
2347         }
2348
2349         /* Silently and repeated when real loading starts? */
2350         window->readystate = READYSTATE_LOADING;
2351         if(!(flags & (BINDING_FROMHIST|BINDING_REFRESH)))
2352             call_docview_84(doc_obj);
2353
2354         task->window = window;
2355         task->bscallback = bsc;
2356         task->flags = flags;
2357         task->mon = mon;
2358
2359         IUri_AddRef(uri);
2360         task->uri = uri;
2361         hres = push_task(&task->header, navigate_proc, navigate_task_destr, window->task_magic);
2362     }
2363
2364 done:
2365     IUnknown_Release(doc_obj->outer_unk);
2366     return hres;
2367 }
2368
2369 HRESULT navigate_new_window(HTMLOuterWindow *window, IUri *uri, const WCHAR *name, request_data_t *request_data, IHTMLWindow2 **ret)
2370 {
2371     INewWindowManager *new_window_mgr;
2372     BSTR display_uri, context_url;
2373     IWebBrowser2 *web_browser;
2374     IHTMLWindow2 *new_window;
2375     IBindCtx *bind_ctx;
2376     nsChannelBSC *bsc;
2377     HRESULT hres;
2378
2379     if(!window->browser)
2380         return E_UNEXPECTED;
2381
2382     if (window->browser->doc->client) {
2383         hres = do_query_service((IUnknown*)window->browser->doc->client, &SID_SNewWindowManager,
2384                                 &IID_INewWindowManager, (void**)&new_window_mgr);
2385         if (FAILED(hres)) {
2386             FIXME("No INewWindowManager\n");
2387             return hres;
2388         }
2389
2390         hres = IUri_GetDisplayUri(window->uri_nofrag, &context_url);
2391         if(FAILED(hres))
2392             return hres;
2393
2394         hres = IUri_GetDisplayUri(uri, &display_uri);
2395         if(FAILED(hres)) {
2396             SysFreeString(context_url);
2397             return hres;
2398         }
2399
2400         hres = INewWindowManager_EvaluateNewWindow(new_window_mgr, display_uri, name, context_url,
2401                 NULL, FALSE, window->browser->doc->has_popup ? 0 : NWMF_FIRST, 0);
2402         window->browser->doc->has_popup = TRUE;
2403         SysFreeString(display_uri);
2404         SysFreeString(context_url);
2405         INewWindowManager_Release(new_window_mgr);
2406         if(FAILED(hres)) {
2407             if(ret)
2408                 *ret = NULL;
2409             return S_OK;
2410         }
2411     }
2412
2413
2414     if(request_data)
2415         hres = create_channelbsc(NULL, request_data->headers,
2416                 request_data->post_data, request_data->post_data_len, FALSE,
2417                 &bsc);
2418     else
2419         hres = create_channelbsc(NULL, NULL, NULL, 0, FALSE, &bsc);
2420     if(FAILED(hres))
2421         return hres;
2422
2423     hres = CreateAsyncBindCtx(0, &bsc->bsc.IBindStatusCallback_iface, NULL, &bind_ctx);
2424     if(FAILED(hres)) {
2425         IBindStatusCallback_Release(&bsc->bsc.IBindStatusCallback_iface);
2426         return hres;
2427     }
2428
2429     hres = CoCreateInstance(&CLSID_InternetExplorer, NULL, CLSCTX_LOCAL_SERVER,
2430             &IID_IWebBrowser2, (void**)&web_browser);
2431     if(SUCCEEDED(hres)) {
2432         ITargetFramePriv2 *target_frame_priv;
2433
2434         hres = IWebBrowser2_QueryInterface(web_browser, &IID_ITargetFramePriv2, (void**)&target_frame_priv);
2435         if(SUCCEEDED(hres)) {
2436             hres = ITargetFramePriv2_AggregatedNavigation2(target_frame_priv,
2437                     HLNF_DISABLEWINDOWRESTRICTIONS|HLNF_OPENINNEWWINDOW, bind_ctx, &bsc->bsc.IBindStatusCallback_iface,
2438                     name, uri, L"");
2439             ITargetFramePriv2_Release(target_frame_priv);
2440
2441             if(SUCCEEDED(hres))
2442                 hres = do_query_service((IUnknown*)web_browser, &SID_SHTMLWindow, &IID_IHTMLWindow2, (void**)&new_window);
2443         }
2444         if(FAILED(hres)) {
2445             IWebBrowser2_Quit(web_browser);
2446             IWebBrowser2_Release(web_browser);
2447         }
2448     }else {
2449         WARN("Could not create InternetExplorer instance: %08lx\n", hres);
2450     }
2451
2452     IBindStatusCallback_Release(&bsc->bsc.IBindStatusCallback_iface);
2453     IBindCtx_Release(bind_ctx);
2454     if(FAILED(hres))
2455         return hres;
2456
2457     IWebBrowser2_put_Visible(web_browser, VARIANT_TRUE);
2458     IWebBrowser2_Release(web_browser);
2459
2460     if(ret)
2461         *ret = new_window;
2462     else
2463         IHTMLWindow2_Release(new_window);
2464     return S_OK;
2465 }
2466
2467 HRESULT hlink_frame_navigate(HTMLDocumentObj *doc, LPCWSTR url, nsChannel *nschannel, DWORD hlnf, BOOL *cancel)
2468 {
2469     IHlinkFrame *hlink_frame;
2470     nsChannelBSC *callback;
2471     IBindCtx *bindctx;
2472     IMoniker *mon;
2473     IHlink *hlink;
2474     HRESULT hres;
2475
2476     *cancel = FALSE;
2477
2478     hres = do_query_service((IUnknown*)doc->client, &IID_IHlinkFrame, &IID_IHlinkFrame,
2479             (void**)&hlink_frame);
2480     if(FAILED(hres))
2481         return S_OK;
2482
2483     hres = create_channelbsc(NULL, NULL, NULL, 0, FALSE, &callback);
2484     if(FAILED(hres)) {
2485         IHlinkFrame_Release(hlink_frame);
2486         return hres;
2487     }
2488
2489     if(nschannel)
2490         read_post_data_stream(nschannel->post_data_stream, nschannel->post_data_contains_headers,
2491                 &nschannel->request_headers, &callback->bsc.request_data);
2492
2493     hres = CreateAsyncBindCtx(0, &callback->bsc.IBindStatusCallback_iface, NULL, &bindctx);
2494     if(SUCCEEDED(hres))
2495        hres = CoCreateInstance(&CLSID_StdHlink, NULL, CLSCTX_INPROC_SERVER,
2496                 &IID_IHlink, (LPVOID*)&hlink);
2497
2498     if(SUCCEEDED(hres))
2499         hres = CreateURLMoniker(NULL, url, &mon);
2500
2501     if(SUCCEEDED(hres)) {
2502         IHlink_SetMonikerReference(hlink, HLINKSETF_TARGET, mon, NULL);
2503
2504         if(hlnf & HLNF_OPENINNEWWINDOW) {
2505             IHlink_SetTargetFrameName(hlink, L"_blank"); /* FIXME */
2506         }
2507
2508         hres = IHlinkFrame_Navigate(hlink_frame, hlnf, bindctx,
2509                 &callback->bsc.IBindStatusCallback_iface, hlink);
2510         IMoniker_Release(mon);
2511         *cancel = hres == S_OK;
2512         hres = S_OK;
2513     }
2514
2515     IHlinkFrame_Release(hlink_frame);
2516     IBindCtx_Release(bindctx);
2517     IBindStatusCallback_Release(&callback->bsc.IBindStatusCallback_iface);
2518     return hres;
2519 }
2520
2521 static HRESULT navigate_uri(HTMLOuterWindow *window, IUri *uri, const WCHAR *display_uri, const request_data_t *request_data,
2522         DWORD flags)
2523 {
2524     DWORD post_data_len = request_data ? request_data->post_data_len : 0;
2525     nsWineURI *nsuri;
2526     HRESULT hres;
2527
2528     TRACE("%s\n", debugstr_w(display_uri));
2529
2530     if(!window->browser)
2531         return E_UNEXPECTED;
2532
2533     if(window->browser->doc->webbrowser) {
2534         void *post_data = post_data_len ? request_data->post_data : NULL;
2535         const WCHAR *headers = request_data ? request_data->headers : NULL;
2536
2537         if(!(flags & BINDING_REFRESH)) {
2538             BSTR frame_name = NULL;
2539             BOOL cancel = FALSE;
2540
2541             if(!is_main_content_window(window)) {
2542                 hres = IHTMLWindow2_get_name(&window->base.IHTMLWindow2_iface, &frame_name);
2543                 if(FAILED(hres))
2544                     return hres;
2545             }
2546
2547             hres = IDocObjectService_FireBeforeNavigate2(window->browser->doc->doc_object_service, NULL, display_uri, 0x40,
2548                     frame_name, post_data, post_data_len ? post_data_len+1 : 0, headers, TRUE, &cancel);
2549             SysFreeString(frame_name);
2550             if(SUCCEEDED(hres) && cancel) {
2551                 TRACE("Navigation canceled\n");
2552                 return S_OK;
2553             }
2554         }
2555
2556         if(!window->browser)
2557             return S_OK;
2558
2559         if(is_main_content_window(window))
2560             return super_navigate(window, uri, flags, headers, post_data, post_data_len);
2561     }
2562
2563     if(!(flags & BINDING_NOFRAG) && window->uri_nofrag && !post_data_len &&
2564        compare_uri_ignoring_frag(window->uri_nofrag, uri))
2565          return navigate_fragment(window, uri);
2566
2567     if(is_main_content_window(window)) {
2568         BOOL cancel;
2569
2570         hres = hlink_frame_navigate(window->base.inner_window->doc->doc_obj, display_uri, NULL, 0, &cancel);
2571         if(FAILED(hres))
2572             return hres;
2573
2574         if(cancel) {
2575             TRACE("Navigation handled by hlink frame\n");
2576             return S_OK;
2577         }
2578     }
2579
2580     hres = create_doc_uri(uri, &nsuri);
2581     if(FAILED(hres))
2582         return hres;
2583
2584     hres = load_nsuri(window, nsuri, request_data ? request_data->post_stream : NULL, NULL,
2585                       (flags & BINDING_REFRESH) ? LOAD_FLAGS_IS_REFRESH : LOAD_FLAGS_NONE);
2586     nsISupports_Release((nsISupports*)nsuri);
2587     return hres;
2588 }
2589
2590 HRESULT load_uri(HTMLOuterWindow *window, IUri *uri, DWORD flags)
2591 {
2592     BSTR display_uri;
2593     HRESULT hres;
2594
2595     hres = IUri_GetDisplayUri(uri, &display_uri);
2596     if(FAILED(hres))
2597         return hres;
2598
2599     hres = navigate_uri(window, uri, display_uri, NULL, flags);
2600     SysFreeString(display_uri);
2601     return hres;
2602 }
2603
2604 static HRESULT translate_uri(HTMLOuterWindow *window, IUri *orig_uri, BSTR *ret_display_uri, IUri **ret_uri)
2605 {
2606     IUri *uri = NULL;
2607     BSTR display_uri;
2608     HRESULT hres;
2609
2610     hres = IUri_GetDisplayUri(orig_uri, &display_uri);
2611     if(FAILED(hres))
2612         return hres;
2613
2614     if(window->browser->doc->hostui) {
2615         OLECHAR *translated_url = NULL;
2616
2617         hres = IDocHostUIHandler_TranslateUrl(window->browser->doc->hostui, 0, display_uri,
2618                 &translated_url);
2619         if(hres == S_OK && translated_url) {
2620             TRACE("%08lx %s -> %s\n", hres, debugstr_w(display_uri), debugstr_w(translated_url));
2621             SysFreeString(display_uri);
2622             hres = create_uri(translated_url, 0, &uri);
2623             CoTaskMemFree(translated_url);
2624             if(FAILED(hres))
2625                 return hres;
2626
2627             hres = IUri_GetDisplayUri(uri, &display_uri);
2628             if(FAILED(hres)) {
2629                 IUri_Release(uri);
2630                 return hres;
2631             }
2632         }
2633     }
2634
2635     if(!uri) {
2636         IUri_AddRef(orig_uri);
2637         uri = orig_uri;
2638     }
2639
2640     *ret_display_uri = display_uri;
2641     *ret_uri = uri;
2642     return S_OK;
2643 }
2644
2645 HRESULT submit_form(HTMLOuterWindow *window, const WCHAR *target, IUri *submit_uri, nsIInputStream *post_stream)
2646 {
2647     request_data_t request_data = {NULL};
2648     HRESULT hres;
2649
2650     hres = read_post_data_stream(post_stream, TRUE, NULL, &request_data);
2651     if(FAILED(hres))
2652         return hres;
2653
2654     if(window) {
2655         IUri *uri;
2656         BSTR display_uri;
2657
2658         window->readystate_locked++;
2659
2660         hres = translate_uri(window, submit_uri, &display_uri, &uri);
2661         if(SUCCEEDED(hres)) {
2662             hres = navigate_uri(window, uri, display_uri, &request_data, BINDING_NAVIGATED|BINDING_SUBMIT);
2663             IUri_Release(uri);
2664             SysFreeString(display_uri);
2665         }
2666
2667         window->readystate_locked--;
2668     }else
2669         hres = navigate_new_window(window, submit_uri, target, &request_data, NULL);
2670
2671     release_request_data(&request_data);
2672     return hres;
2673 }
2674
2675 HRESULT navigate_url(HTMLOuterWindow *window, const WCHAR *new_url, IUri *base_uri, DWORD flags)
2676 {
2677     IUri *uri, *nav_uri;
2678     BSTR display_uri;
2679     HRESULT hres;
2680
2681     if(new_url && base_uri)
2682         hres = CoInternetCombineUrlEx(base_uri, new_url, URL_ESCAPE_SPACES_ONLY|URL_DONT_ESCAPE_EXTRA_INFO,
2683                 &nav_uri, 0);
2684     else
2685         hres = create_uri(new_url, 0, &nav_uri);
2686     if(FAILED(hres))
2687         return hres;
2688     IHTMLWindow2_AddRef(&window->base.IHTMLWindow2_iface);
2689
2690     hres = translate_uri(window, nav_uri, &display_uri, &uri);
2691     IUri_Release(nav_uri);
2692     if(SUCCEEDED(hres)) {
2693         hres = navigate_uri(window, uri, display_uri, NULL, flags);
2694         IUri_Release(uri);
2695         SysFreeString(display_uri);
2696     }
2697
2698     IHTMLWindow2_Release(&window->base.IHTMLWindow2_iface);
2699     return hres;
2700 }