dlls/mshtml/navigate.c

   1 /*
   2  * Copyright 2006-2010 Jacek Caban for CodeWeavers
   3  *
   4  * This library is free software; you can redistribute it and/or
   5  * modify it under the terms of the GNU Lesser General Public
   6  * License as published by the Free Software Foundation; either
   7  * version 2.1 of the License, or (at your option) any later version.
   8  *
   9  * This library is distributed in the hope that it will be useful,
  10  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  11  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  12  * Lesser General Public License for more details.
  13  *
  14  * You should have received a copy of the GNU Lesser General Public
  15  * License along with this library; if not, write to the Free Software
  16  * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
  17  */
  18
  19 #include <stdarg.h>
  20
  21 #define COBJMACROS
  22 #include "windef.h"
  23 #include "winbase.h"
  24 #include "winuser.h"
  25 #include "winreg.h"
  26 #include "ole2.h"
  27 #include "hlguids.h"
  28 #include "shlguid.h"
  29 #include "wininet.h"
  30 #include "shlwapi.h"
  31 #include "htiface.h"
  32 #include "shdeprecated.h"
  33
  34 #include "wine/debug.h"
  35
  36 #include "mshtml_private.h"
  37 #include "htmlscript.h"
  38 #include "binding.h"
  39
  40 WINE_DEFAULT_DEBUG_CHANNEL(mshtml);
  41
  42 struct nsProtocolStream {
  43     nsIInputStream nsIInputStream_iface;
  44
  45     LONG ref;
  46
  47     char buf[1024];
  48     DWORD buf_size;
  49 };
  50
  51 static inline nsProtocolStream *impl_from_nsIInputStream(nsIInputStream *iface)
  52 {
  53     return CONTAINING_RECORD(iface, nsProtocolStream, nsIInputStream_iface);
  54 }
  55
  56 static nsresult NSAPI nsInputStream_QueryInterface(nsIInputStream *iface, nsIIDRef riid,
  57         void **result)
  58 {
  59     nsProtocolStream *This = impl_from_nsIInputStream(iface);
  60
  61     *result = NULL;
  62
  63     if(IsEqualGUID(&IID_nsISupports, riid)) {
  64         TRACE("(%p)->(IID_nsISupports %p)\n", This, result);
  65         *result  = &This->nsIInputStream_iface;
  66     }else if(IsEqualGUID(&IID_nsIInputStream, riid)) {
  67         TRACE("(%p)->(IID_nsIInputStream %p)\n", This, result);
  68         *result  = &This->nsIInputStream_iface;
  69     }
  70
  71     if(*result) {
  72         nsIInputStream_AddRef(&This->nsIInputStream_iface);
  73         return NS_OK;
  74     }
  75
  76     WARN("unsupported interface %s\n", debugstr_guid(riid));
  77     return NS_NOINTERFACE;
  78 }
  79
  80 static nsrefcnt NSAPI nsInputStream_AddRef(nsIInputStream *iface)
  81 {
  82     nsProtocolStream *This = impl_from_nsIInputStream(iface);
  83     LONG ref = InterlockedIncrement(&This->ref);
  84
  85     TRACE("(%p) ref=%ld\n", This, ref);
  86
  87     return ref;
  88 }
  89
  90
  91 static nsrefcnt NSAPI nsInputStream_Release(nsIInputStream *iface)
  92 {
  93     nsProtocolStream *This = impl_from_nsIInputStream(iface);
  94     LONG ref = InterlockedDecrement(&This->ref);
  95
  96     TRACE("(%p) ref=%ld\n", This, ref);
  97
  98     if(!ref)
  99         free(This);
 100
 101     return ref;
 102 }
 103
 104 static nsresult NSAPI nsInputStream_Close(nsIInputStream *iface)
 105 {
 106     nsProtocolStream *This = impl_from_nsIInputStream(iface);
 107     FIXME("(%p)\n", This);
 108     return NS_ERROR_NOT_IMPLEMENTED;
 109 }
 110
 111 static nsresult NSAPI nsInputStream_Available(nsIInputStream *iface, UINT64 *_retval)
 112 {
 113     nsProtocolStream *This = impl_from_nsIInputStream(iface);
 114     FIXME("(%p)->(%p)\n", This, _retval);
 115     return NS_ERROR_NOT_IMPLEMENTED;
 116 }
 117
 118 static nsresult NSAPI nsInputStream_Read(nsIInputStream *iface, char *aBuf, UINT32 aCount,
 119                                          UINT32 *_retval)
 120 {
 121     nsProtocolStream *This = impl_from_nsIInputStream(iface);
 122     DWORD read = aCount;
 123
 124     TRACE("(%p)->(%p %d %p)\n", This, aBuf, aCount, _retval);
 125
 126     if(read > This->buf_size)
 127         read = This->buf_size;
 128
 129     if(read) {
 130         memcpy(aBuf, This->buf, read);
 131         if(read < This->buf_size)
 132             memmove(This->buf, This->buf+read, This->buf_size-read);
 133         This->buf_size -= read;
 134     }
 135
 136     *_retval = read;
 137     return NS_OK;
 138 }
 139
 140 static nsresult NSAPI nsInputStream_ReadSegments(nsIInputStream *iface,
 141         nsresult (WINAPI *aWriter)(nsIInputStream*,void*,const char*,UINT32,UINT32,UINT32*),
 142         void *aClousure, UINT32 aCount, UINT32 *_retval)
 143 {
 144     nsProtocolStream *This = impl_from_nsIInputStream(iface);
 145     UINT32 written = 0;
 146     nsresult nsres;
 147
 148     TRACE("(%p)->(%p %p %d %p)\n", This, aWriter, aClousure, aCount, _retval);
 149
 150     if(!This->buf_size)
 151         return S_OK;
 152
 153     if(aCount > This->buf_size)
 154         aCount = This->buf_size;
 155
 156     nsres = aWriter(&This->nsIInputStream_iface, aClousure, This->buf, 0, aCount, &written);
 157     if(NS_FAILED(nsres))
 158         TRACE("aWriter failed: %08lx\n", nsres);
 159     else if(written != This->buf_size)
 160         FIXME("written %d != buf_size %ld\n", written, This->buf_size);
 161
 162     This->buf_size -= written;
 163
 164     *_retval = written;
 165     return nsres;
 166 }
 167
 168 static nsresult NSAPI nsInputStream_IsNonBlocking(nsIInputStream *iface, cpp_bool *_retval)
 169 {
 170     nsProtocolStream *This = impl_from_nsIInputStream(iface);
 171     FIXME("(%p)->(%p)\n", This, _retval);
 172     return NS_ERROR_NOT_IMPLEMENTED;
 173 }
 174
 175 static const nsIInputStreamVtbl nsInputStreamVtbl = {
 176     nsInputStream_QueryInterface,
 177     nsInputStream_AddRef,
 178     nsInputStream_Release,
 179     nsInputStream_Close,
 180     nsInputStream_Available,
 181     nsInputStream_Read,
 182     nsInputStream_ReadSegments,
 183     nsInputStream_IsNonBlocking
 184 };
 185
 186 static nsProtocolStream *create_nsprotocol_stream(void)
 187 {
 188     nsProtocolStream *ret;
 189
 190     ret = malloc(sizeof(nsProtocolStream));
 191     if(!ret)
 192         return NULL;
 193
 194     ret->nsIInputStream_iface.lpVtbl = &nsInputStreamVtbl;
 195     ret->ref = 1;
 196     ret->buf_size = 0;
 197
 198     return ret;
 199 }
 200
 201 static void release_request_data(request_data_t *request_data)
 202 {
 203     if(request_data->post_stream)
 204         nsIInputStream_Release(request_data->post_stream);
 205     free(request_data->headers);
 206     if(request_data->post_data)
 207         GlobalFree(request_data->post_data);
 208 }
 209
 210 static inline BSCallback *impl_from_IBindStatusCallback(IBindStatusCallback *iface)
 211 {
 212     return CONTAINING_RECORD(iface, BSCallback, IBindStatusCallback_iface);
 213 }
 214
 215 static HRESULT WINAPI BindStatusCallback_QueryInterface(IBindStatusCallback *iface,
 216         REFIID riid, void **ppv)
 217 {
 218     BSCallback *This = impl_from_IBindStatusCallback(iface);
 219
 220     *ppv = NULL;
 221     if(IsEqualGUID(&IID_IUnknown, riid)) {
 222         TRACE("(%p)->(IID_IUnknown, %p)\n", This, ppv);
 223         *ppv = &This->IBindStatusCallback_iface;
 224     }else if(IsEqualGUID(&IID_IBindStatusCallback, riid)) {
 225         TRACE("(%p)->(IID_IBindStatusCallback, %p)\n", This, ppv);
 226         *ppv = &This->IBindStatusCallback_iface;
 227     }else if(IsEqualGUID(&IID_IServiceProvider, riid)) {
 228         TRACE("(%p)->(IID_IServiceProvider %p)\n", This, ppv);
 229         *ppv = &This->IServiceProvider_iface;
 230     }else if(IsEqualGUID(&IID_IHttpNegotiate, riid)) {
 231         TRACE("(%p)->(IID_IHttpNegotiate %p)\n", This, ppv);
 232         *ppv = &This->IHttpNegotiate2_iface;
 233     }else if(IsEqualGUID(&IID_IHttpNegotiate2, riid)) {
 234         TRACE("(%p)->(IID_IHttpNegotiate2 %p)\n", This, ppv);
 235         *ppv = &This->IHttpNegotiate2_iface;
 236     }else if(IsEqualGUID(&IID_IInternetBindInfo, riid)) {
 237         TRACE("(%p)->(IID_IInternetBindInfo %p)\n", This, ppv);
 238         *ppv = &This->IInternetBindInfo_iface;
 239     }else if(IsEqualGUID(&IID_IBindCallbackRedirect, riid)) {
 240         TRACE("(%p)->(IID_IBindCallbackRedirect %p)\n", This, ppv);
 241         *ppv = &This->IBindCallbackRedirect_iface;
 242     }
 243
 244     if(*ppv) {
 245         IBindStatusCallback_AddRef(&This->IBindStatusCallback_iface);
 246         return S_OK;
 247     }
 248
 249     TRACE("Unsupported riid = %s\n", debugstr_guid(riid));
 250     return E_NOINTERFACE;
 251 }
 252
 253 static ULONG WINAPI BindStatusCallback_AddRef(IBindStatusCallback *iface)
 254 {
 255     BSCallback *This = impl_from_IBindStatusCallback(iface);
 256     LONG ref = InterlockedIncrement(&This->ref);
 257
 258     TRACE("(%p) ref = %ld\n", This, ref);
 259
 260     return ref;
 261 }
 262
 263 static ULONG WINAPI BindStatusCallback_Release(IBindStatusCallback *iface)
 264 {
 265     BSCallback *This = impl_from_IBindStatusCallback(iface);
 266     LONG ref = InterlockedDecrement(&This->ref);
 267
 268     TRACE("(%p) ref = %ld\n", This, ref);
 269
 270     if(!ref) {
 271         release_request_data(&This->request_data);
 272         if(This->mon)
 273             IMoniker_Release(This->mon);
 274         if(This->binding)
 275             IBinding_Release(This->binding);
 276         list_remove(&This->entry);
 277         list_init(&This->entry);
 278
 279         This->vtbl->destroy(This);
 280     }
 281
 282     return ref;
 283 }
 284
 285 static HRESULT WINAPI BindStatusCallback_OnStartBinding(IBindStatusCallback *iface,
 286         DWORD dwReserved, IBinding *pbind)
 287 {
 288     BSCallback *This = impl_from_IBindStatusCallback(iface);
 289
 290     TRACE("(%p)->(%ld %p)\n", This, dwReserved, pbind);
 291
 292     IBinding_AddRef(pbind);
 293     This->binding = pbind;
 294
 295     if(This->window)
 296         list_add_head(&This->window->bindings, &This->entry);
 297
 298     return This->vtbl->start_binding(This);
 299 }
 300
 301 static HRESULT WINAPI BindStatusCallback_GetPriority(IBindStatusCallback *iface, LONG *pnPriority)
 302 {
 303     BSCallback *This = impl_from_IBindStatusCallback(iface);
 304     FIXME("(%p)->(%p)\n", This, pnPriority);
 305     return E_NOTIMPL;
 306 }
 307
 308 static HRESULT WINAPI BindStatusCallback_OnLowResource(IBindStatusCallback *iface, DWORD reserved)
 309 {
 310     BSCallback *This = impl_from_IBindStatusCallback(iface);
 311     FIXME("(%p)->(%ld)\n", This, reserved);
 312     return E_NOTIMPL;
 313 }
 314
 315 static HRESULT WINAPI BindStatusCallback_OnProgress(IBindStatusCallback *iface, ULONG ulProgress,
 316         ULONG ulProgressMax, ULONG ulStatusCode, LPCWSTR szStatusText)
 317 {
 318     BSCallback *This = impl_from_IBindStatusCallback(iface);
 319
 320     TRACE("%p)->(%lu %lu %lu %s)\n", This, ulProgress, ulProgressMax, ulStatusCode,
 321             debugstr_w(szStatusText));
 322
 323     return This->vtbl->on_progress(This, ulProgress, ulProgressMax, ulStatusCode, szStatusText);
 324 }
 325
 326 static HRESULT WINAPI BindStatusCallback_OnStopBinding(IBindStatusCallback *iface,
 327         HRESULT hresult, LPCWSTR szError)
 328 {
 329     BSCallback *This = impl_from_IBindStatusCallback(iface);
 330     HRESULT hres;
 331
 332     TRACE("(%p)->(%08lx %s)\n", This, hresult, debugstr_w(szError));
 333
 334     /* NOTE: IE7 calls GetBindResult here */
 335
 336     hres = This->vtbl->stop_binding(This, hresult);
 337
 338     unlink_ref(&This->binding);
 339     unlink_ref(&This->mon);
 340
 341     list_remove(&This->entry);
 342     list_init(&This->entry);
 343     This->window = NULL;
 344
 345     return hres;
 346 }
 347
 348 static HRESULT WINAPI BindStatusCallback_GetBindInfo(IBindStatusCallback *iface,
 349         DWORD *grfBINDF, BINDINFO *pbindinfo)
 350 {
 351     BSCallback *This = impl_from_IBindStatusCallback(iface);
 352     DWORD size;
 353
 354     TRACE("(%p)->(%p %p)\n", This, grfBINDF, pbindinfo);
 355
 356     if(!This->bindinfo_ready) {
 357         HRESULT hres;
 358
 359         hres = This->vtbl->init_bindinfo(This);
 360         if(FAILED(hres))
 361             return hres;
 362
 363         This->bindinfo_ready = TRUE;
 364     }
 365
 366     *grfBINDF = This->bindf;
 367
 368     size = pbindinfo->cbSize;
 369     memset(pbindinfo, 0, size);
 370     pbindinfo->cbSize = size;
 371
 372     pbindinfo->cbstgmedData = This->request_data.post_data_len;
 373     pbindinfo->dwCodePage = CP_UTF8;
 374     pbindinfo->dwOptions = This->bindinfo_options;
 375
 376     if(This->request_data.post_data_len) {
 377         pbindinfo->dwBindVerb = BINDVERB_POST;
 378
 379         pbindinfo->stgmedData.tymed = TYMED_HGLOBAL;
 380         pbindinfo->stgmedData.hGlobal = This->request_data.post_data;
 381         pbindinfo->stgmedData.pUnkForRelease = (IUnknown*)&This->IBindStatusCallback_iface;
 382         IBindStatusCallback_AddRef(&This->IBindStatusCallback_iface);
 383     }
 384
 385     return S_OK;
 386 }
 387
 388 static HRESULT WINAPI BindStatusCallback_OnDataAvailable(IBindStatusCallback *iface,
 389         DWORD grfBSCF, DWORD dwSize, FORMATETC *pformatetc, STGMEDIUM *pstgmed)
 390 {
 391     BSCallback *This = impl_from_IBindStatusCallback(iface);
 392
 393     TRACE("(%p)->(%08lx %ld %p %p)\n", This, grfBSCF, dwSize, pformatetc, pstgmed);
 394
 395     return This->vtbl->read_data(This, pstgmed->pstm);
 396 }
 397
 398 static HRESULT WINAPI BindStatusCallback_OnObjectAvailable(IBindStatusCallback *iface,
 399         REFIID riid, IUnknown *punk)
 400 {
 401     BSCallback *This = impl_from_IBindStatusCallback(iface);
 402     FIXME("(%p)->(%s %p)\n", This, debugstr_guid(riid), punk);
 403     return E_NOTIMPL;
 404 }
 405
 406 static const IBindStatusCallbackVtbl BindStatusCallbackVtbl = {
 407     BindStatusCallback_QueryInterface,
 408     BindStatusCallback_AddRef,
 409     BindStatusCallback_Release,
 410     BindStatusCallback_OnStartBinding,
 411     BindStatusCallback_GetPriority,
 412     BindStatusCallback_OnLowResource,
 413     BindStatusCallback_OnProgress,
 414     BindStatusCallback_OnStopBinding,
 415     BindStatusCallback_GetBindInfo,
 416     BindStatusCallback_OnDataAvailable,
 417     BindStatusCallback_OnObjectAvailable
 418 };
 419
 420 static inline BSCallback *impl_from_IHttpNegotiate2(IHttpNegotiate2 *iface)
 421 {
 422     return CONTAINING_RECORD(iface, BSCallback, IHttpNegotiate2_iface);
 423 }
 424
 425 static HRESULT WINAPI HttpNegotiate_QueryInterface(IHttpNegotiate2 *iface,
 426                                                    REFIID riid, void **ppv)
 427 {
 428     BSCallback *This = impl_from_IHttpNegotiate2(iface);
 429     return IBindStatusCallback_QueryInterface(&This->IBindStatusCallback_iface, riid, ppv);
 430 }
 431
 432 static ULONG WINAPI HttpNegotiate_AddRef(IHttpNegotiate2 *iface)
 433 {
 434     BSCallback *This = impl_from_IHttpNegotiate2(iface);
 435     return IBindStatusCallback_AddRef(&This->IBindStatusCallback_iface);
 436 }
 437
 438 static ULONG WINAPI HttpNegotiate_Release(IHttpNegotiate2 *iface)
 439 {
 440     BSCallback *This = impl_from_IHttpNegotiate2(iface);
 441     return IBindStatusCallback_Release(&This->IBindStatusCallback_iface);
 442 }
 443
 444 static HRESULT WINAPI HttpNegotiate_BeginningTransaction(IHttpNegotiate2 *iface,
 445         LPCWSTR szURL, LPCWSTR szHeaders, DWORD dwReserved, LPWSTR *pszAdditionalHeaders)
 446 {
 447     BSCallback *This = impl_from_IHttpNegotiate2(iface);
 448     HRESULT hres;
 449
 450     TRACE("(%p)->(%s %s %ld %p)\n", This, debugstr_w(szURL), debugstr_w(szHeaders),
 451           dwReserved, pszAdditionalHeaders);
 452
 453     *pszAdditionalHeaders = NULL;
 454
 455     hres = This->vtbl->beginning_transaction(This, pszAdditionalHeaders);
 456     if(hres != S_FALSE)
 457         return hres;
 458
 459     if(This->request_data.headers) {
 460         DWORD size;
 461
 462         size = (lstrlenW(This->request_data.headers)+1)*sizeof(WCHAR);
 463         *pszAdditionalHeaders = CoTaskMemAlloc(size);
 464         if(!*pszAdditionalHeaders)
 465             return E_OUTOFMEMORY;
 466         memcpy(*pszAdditionalHeaders, This->request_data.headers, size);
 467     }
 468
 469     return S_OK;
 470 }
 471
 472 static HRESULT WINAPI HttpNegotiate_OnResponse(IHttpNegotiate2 *iface, DWORD dwResponseCode,
 473         LPCWSTR szResponseHeaders, LPCWSTR szRequestHeaders, LPWSTR *pszAdditionalRequestHeaders)
 474 {
 475     BSCallback *This = impl_from_IHttpNegotiate2(iface);
 476
 477     TRACE("(%p)->(%ld %s %s %p)\n", This, dwResponseCode, debugstr_w(szResponseHeaders),
 478           debugstr_w(szRequestHeaders), pszAdditionalRequestHeaders);
 479
 480     return This->vtbl->on_response(This, dwResponseCode, szResponseHeaders);
 481 }
 482
 483 static HRESULT WINAPI HttpNegotiate_GetRootSecurityId(IHttpNegotiate2 *iface,
 484         BYTE *pbSecurityId, DWORD *pcbSecurityId, DWORD_PTR dwReserved)
 485 {
 486     BSCallback *This = impl_from_IHttpNegotiate2(iface);
 487     TRACE("(%p)->(%p %p %Id)\n", This, pbSecurityId, pcbSecurityId, dwReserved);
 488     return E_NOTIMPL; /* FIXME */
 489 }
 490
 491 static const IHttpNegotiate2Vtbl HttpNegotiate2Vtbl = {
 492     HttpNegotiate_QueryInterface,
 493     HttpNegotiate_AddRef,
 494     HttpNegotiate_Release,
 495     HttpNegotiate_BeginningTransaction,
 496     HttpNegotiate_OnResponse,
 497     HttpNegotiate_GetRootSecurityId
 498 };
 499
 500 static inline BSCallback *impl_from_IInternetBindInfo(IInternetBindInfo *iface)
 501 {
 502     return CONTAINING_RECORD(iface, BSCallback, IInternetBindInfo_iface);
 503 }
 504
 505 static HRESULT WINAPI InternetBindInfo_QueryInterface(IInternetBindInfo *iface,
 506                                                       REFIID riid, void **ppv)
 507 {
 508     BSCallback *This = impl_from_IInternetBindInfo(iface);
 509     return IBindStatusCallback_QueryInterface(&This->IBindStatusCallback_iface, riid, ppv);
 510 }
 511
 512 static ULONG WINAPI InternetBindInfo_AddRef(IInternetBindInfo *iface)
 513 {
 514     BSCallback *This = impl_from_IInternetBindInfo(iface);
 515     return IBindStatusCallback_AddRef(&This->IBindStatusCallback_iface);
 516 }
 517
 518 static ULONG WINAPI InternetBindInfo_Release(IInternetBindInfo *iface)
 519 {
 520     BSCallback *This = impl_from_IInternetBindInfo(iface);
 521     return IBindStatusCallback_Release(&This->IBindStatusCallback_iface);
 522 }
 523
 524 static HRESULT WINAPI InternetBindInfo_GetBindInfo(IInternetBindInfo *iface,
 525                                                    DWORD *grfBINDF, BINDINFO *pbindinfo)
 526 {
 527     BSCallback *This = impl_from_IInternetBindInfo(iface);
 528     FIXME("(%p)->(%p %p)\n", This, grfBINDF, pbindinfo);
 529     return E_NOTIMPL;
 530 }
 531
 532 static HRESULT WINAPI InternetBindInfo_GetBindString(IInternetBindInfo *iface,
 533         ULONG ulStringType, LPOLESTR *ppwzStr, ULONG cEl, ULONG *pcElFetched)
 534 {
 535     BSCallback *This = impl_from_IInternetBindInfo(iface);
 536     FIXME("(%p)->(%lu %p %lu %p)\n", This, ulStringType, ppwzStr, cEl, pcElFetched);
 537     return E_NOTIMPL;
 538 }
 539
 540 static const IInternetBindInfoVtbl InternetBindInfoVtbl = {
 541     InternetBindInfo_QueryInterface,
 542     InternetBindInfo_AddRef,
 543     InternetBindInfo_Release,
 544     InternetBindInfo_GetBindInfo,
 545     InternetBindInfo_GetBindString
 546 };
 547
 548 static inline BSCallback *impl_from_IBindCallbackRedirect(IBindCallbackRedirect *iface)
 549 {
 550     return CONTAINING_RECORD(iface, BSCallback, IBindCallbackRedirect_iface);
 551 }
 552
 553 static HRESULT WINAPI BindCallbackRedirect_QueryInterface(IBindCallbackRedirect *iface, REFIID riid, void **ppv)
 554 {
 555     BSCallback *This = impl_from_IBindCallbackRedirect(iface);
 556     return IBindStatusCallback_QueryInterface(&This->IBindStatusCallback_iface, riid, ppv);
 557 }
 558
 559 static ULONG WINAPI BindCallbackRedirect_AddRef(IBindCallbackRedirect *iface)
 560 {
 561     BSCallback *This = impl_from_IBindCallbackRedirect(iface);
 562     return IBindStatusCallback_AddRef(&This->IBindStatusCallback_iface);
 563 }
 564
 565 static ULONG WINAPI BindCallbackRedirect_Release(IBindCallbackRedirect *iface)
 566 {
 567     BSCallback *This = impl_from_IBindCallbackRedirect(iface);
 568     return IBindStatusCallback_Release(&This->IBindStatusCallback_iface);
 569 }
 570
 571 static HRESULT WINAPI BindCallbackRedirect_Redirect(IBindCallbackRedirect *iface, const WCHAR *url, VARIANT_BOOL *vbCancel)
 572 {
 573     BSCallback *This = impl_from_IBindCallbackRedirect(iface);
 574     GeckoBrowser *browser;
 575     BOOL cancel = FALSE;
 576     BSTR frame_name = NULL;
 577     HRESULT hres = S_OK;
 578
 579     TRACE("(%p)->(%s %p)\n", This, debugstr_w(url), vbCancel);
 580
 581     if(This->window && This->window->base.outer_window && (browser = This->window->base.outer_window->browser)
 582        && browser->doc->doc_object_service) {
 583         if(is_main_content_window(This->window->base.outer_window)) {
 584             hres = IHTMLWindow2_get_name(&This->window->base.IHTMLWindow2_iface, &frame_name);
 585             if(FAILED(hres))
 586                 return hres;
 587         }
 588
 589         hres = IDocObjectService_FireBeforeNavigate2(browser->doc->doc_object_service, NULL, url, 0x40,
 590                                                      frame_name, NULL, 0, NULL, TRUE, &cancel);
 591         SysFreeString(frame_name);
 592     }
 593
 594     *vbCancel = variant_bool(cancel);
 595     return hres;
 596 }
 597
 598 static const IBindCallbackRedirectVtbl BindCallbackRedirectVtbl = {
 599     BindCallbackRedirect_QueryInterface,
 600     BindCallbackRedirect_AddRef,
 601     BindCallbackRedirect_Release,
 602     BindCallbackRedirect_Redirect
 603 };
 604
 605 static inline BSCallback *impl_from_IServiceProvider(IServiceProvider *iface)
 606 {
 607     return CONTAINING_RECORD(iface, BSCallback, IServiceProvider_iface);
 608 }
 609
 610 static HRESULT WINAPI BSCServiceProvider_QueryInterface(IServiceProvider *iface,
 611                                                         REFIID riid, void **ppv)
 612 {
 613     BSCallback *This = impl_from_IServiceProvider(iface);
 614     return IBindStatusCallback_QueryInterface(&This->IBindStatusCallback_iface, riid, ppv);
 615 }
 616
 617 static ULONG WINAPI BSCServiceProvider_AddRef(IServiceProvider *iface)
 618 {
 619     BSCallback *This = impl_from_IServiceProvider(iface);
 620     return IBindStatusCallback_AddRef(&This->IBindStatusCallback_iface);
 621 }
 622
 623 static ULONG WINAPI BSCServiceProvider_Release(IServiceProvider *iface)
 624 {
 625     BSCallback *This = impl_from_IServiceProvider(iface);
 626     return IBindStatusCallback_Release(&This->IBindStatusCallback_iface);
 627 }
 628
 629 static HRESULT WINAPI BSCServiceProvider_QueryService(IServiceProvider *iface,
 630         REFGUID guidService, REFIID riid, void **ppv)
 631 {
 632     BSCallback *This = impl_from_IServiceProvider(iface);
 633
 634     TRACE("(%p)->(%s %s %p)\n", This, debugstr_guid(guidService), debugstr_guid(riid), ppv);
 635
 636     if(This->window && IsEqualGUID(guidService, &IID_IWindowForBindingUI))
 637         return IServiceProvider_QueryService(&This->window->base.IServiceProvider_iface, guidService, riid, ppv);
 638     return E_NOINTERFACE;
 639 }
 640
 641 static const IServiceProviderVtbl ServiceProviderVtbl = {
 642     BSCServiceProvider_QueryInterface,
 643     BSCServiceProvider_AddRef,
 644     BSCServiceProvider_Release,
 645     BSCServiceProvider_QueryService
 646 };
 647
 648 void init_bscallback(BSCallback *This, const BSCallbackVtbl *vtbl, IMoniker *mon, DWORD bindf)
 649 {
 650     This->IBindStatusCallback_iface.lpVtbl = &BindStatusCallbackVtbl;
 651     This->IServiceProvider_iface.lpVtbl = &ServiceProviderVtbl;
 652     This->IHttpNegotiate2_iface.lpVtbl = &HttpNegotiate2Vtbl;
 653     This->IInternetBindInfo_iface.lpVtbl = &InternetBindInfoVtbl;
 654     This->IBindCallbackRedirect_iface.lpVtbl = &BindCallbackRedirectVtbl;
 655     This->vtbl = vtbl;
 656     This->ref = 1;
 657     This->bindf = bindf;
 658     This->bindinfo_options = BINDINFO_OPTIONS_USE_IE_ENCODING;
 659     This->bom = BOM_NONE;
 660
 661     list_init(&This->entry);
 662
 663     if(mon)
 664         IMoniker_AddRef(mon);
 665     This->mon = mon;
 666 }
 667
 668 HRESULT read_stream(BSCallback *This, IStream *stream, void *buf, DWORD size, DWORD *ret_size)
 669 {
 670     DWORD read_size = 0, skip=0;
 671     BYTE *data = buf;
 672     HRESULT hres;
 673
 674     hres = IStream_Read(stream, buf, size, &read_size);
 675
 676     if(!This->read && This->bom == BOM_NONE) {
 677         if(read_size >= 2 && data[0] == 0xff && data[1] == 0xfe) {
 678             This->bom = BOM_UTF16;
 679             skip = 2;
 680         }else if(read_size >= 3 && data[0] == 0xef && data[1] == 0xbb && data[2] == 0xbf) {
 681             This->bom = BOM_UTF8;
 682             skip = 3;
 683         }
 684         if(skip) {
 685             read_size -= skip;
 686             if(read_size)
 687                 memmove(data, data+skip, read_size);
 688         }
 689     }
 690
 691     This->read += read_size;
 692     *ret_size = read_size;
 693     return hres;
 694 }
 695
 696 static void parse_content_type(nsChannelBSC *This, const WCHAR *value)
 697 {
 698     const WCHAR *ptr, *beg, *end;
 699     size_t len = wcslen(value);
 700     char *content_type;
 701
 702     static const WCHAR charsetW[] = {'c','h','a','r','s','e','t','='};
 703
 704     ptr = wcschr(value, ';');
 705
 706     if(!This->nschannel->content_type || !(This->nschannel->load_flags & LOAD_CALL_CONTENT_SNIFFERS)) {
 707         for(end = ptr ? ptr : value + len; end > value; end--)
 708             if(!iswspace(end[-1]))
 709                 break;
 710         for(beg = value; beg < end; beg++)
 711             if(!iswspace(*beg))
 712                 break;
 713
 714         if((content_type = strndupWtoU(beg, end - beg))) {
 715             free(This->nschannel->content_type);
 716             This->nschannel->content_type = content_type;
 717             strlwr(content_type);
 718         }
 719     }
 720
 721     if(!ptr)
 722         return;
 723
 724     ptr++;
 725     while(*ptr && iswspace(*ptr))
 726         ptr++;
 727
 728     if(ptr + ARRAY_SIZE(charsetW) < value+len && !wcsnicmp(ptr, charsetW, ARRAY_SIZE(charsetW))) {
 729         size_t charset_len, lena;
 730         nsACString charset_str;
 731         const WCHAR *charset;
 732         char *charseta;
 733
 734         ptr += ARRAY_SIZE(charsetW);
 735
 736         if(*ptr == '\'') {
 737             FIXME("Quoted value\n");
 738             return;
 739         }else {
 740             charset = ptr;
 741             while(*ptr && *ptr != ',')
 742                 ptr++;
 743             charset_len = ptr-charset;
 744         }
 745
 746         lena = WideCharToMultiByte(CP_ACP, 0, charset, charset_len, NULL, 0, NULL, NULL);
 747         charseta = malloc(lena + 1);
 748         if(!charseta)
 749             return;
 750
 751         WideCharToMultiByte(CP_ACP, 0, charset, charset_len, charseta, lena, NULL, NULL);
 752         charseta[lena] = 0;
 753
 754         nsACString_InitDepend(&charset_str, charseta);
 755         nsIHttpChannel_SetContentCharset(&This->nschannel->nsIHttpChannel_iface, &charset_str);
 756         nsACString_Finish(&charset_str);
 757         free(charseta);
 758     }else {
 759         FIXME("unhandled: %s\n", debugstr_wn(ptr, len - (ptr-value)));
 760     }
 761 }
 762
 763 static HRESULT parse_headers(const WCHAR *headers, struct list *headers_list)
 764 {
 765     const WCHAR *header, *header_end, *colon, *value;
 766     HRESULT hres;
 767
 768     header = headers;
 769     while(*header) {
 770         if(header[0] == '\r' && header[1] == '\n' && !header[2])
 771             break;
 772         for(colon = header; *colon && *colon != ':' && *colon != '\r'; colon++);
 773         if(*colon != ':')
 774             return E_FAIL;
 775
 776         value = colon+1;
 777         while(*value == ' ')
 778             value++;
 779         if(!*value)
 780             return E_FAIL;
 781
 782         for(header_end = value+1; *header_end && *header_end != '\r'; header_end++);
 783
 784         hres = set_http_header(headers_list, header, colon-header, value, header_end-value);
 785         if(FAILED(hres))
 786             return hres;
 787
 788         header = header_end;
 789         if(header[0] == '\r' && header[1] == '\n')
 790             header += 2;
 791     }
 792
 793     return S_OK;
 794 }
 795
 796 static HRESULT process_response_headers(nsChannelBSC *This, const WCHAR *headers)
 797 {
 798     http_header_t *iter;
 799     HRESULT hres;
 800
 801     hres = parse_headers(headers, &This->nschannel->response_headers);
 802     if(FAILED(hres))
 803         return hres;
 804
 805     LIST_FOR_EACH_ENTRY(iter, &This->nschannel->response_headers, http_header_t, entry) {
 806         if(!wcsicmp(iter->header, L"content-type"))
 807             parse_content_type(This, iter->data);
 808     }
 809
 810     return S_OK;
 811 }
 812
 813 static void query_http_info(nsChannelBSC *This, IWinInetHttpInfo *wininet_info)
 814 {
 815     const WCHAR *ptr;
 816     DWORD len = 0;
 817     WCHAR *buf;
 818
 819     IWinInetHttpInfo_QueryInfo(wininet_info, HTTP_QUERY_RAW_HEADERS_CRLF, NULL, &len, NULL, NULL);
 820     if(!len)
 821         return;
 822
 823     buf = malloc(len);
 824     if(!buf)
 825         return;
 826
 827     IWinInetHttpInfo_QueryInfo(wininet_info, HTTP_QUERY_RAW_HEADERS_CRLF, buf, &len, NULL, NULL);
 828     if(!len) {
 829         free(buf);
 830         return;
 831     }
 832
 833     ptr = wcschr(buf, '\r');
 834     if(ptr && ptr[1] == '\n') {
 835         ptr += 2;
 836         process_response_headers(This, ptr);
 837     }
 838
 839     free(buf);
 840 }
 841
 842 HRESULT start_binding(HTMLInnerWindow *inner_window, BSCallback *bscallback, IBindCtx *bctx)
 843 {
 844     IStream *str = NULL;
 845     HRESULT hres;
 846
 847     TRACE("(%p %p %p)\n", inner_window, bscallback, bctx);
 848
 849     bscallback->window = inner_window;
 850
 851     /* NOTE: IE7 calls IsSystemMoniker here*/
 852
 853     if(bctx) {
 854         hres = RegisterBindStatusCallback(bctx, &bscallback->IBindStatusCallback_iface, NULL, 0);
 855         if(SUCCEEDED(hres))
 856             IBindCtx_AddRef(bctx);
 857     }else {
 858         hres = CreateAsyncBindCtx(0, &bscallback->IBindStatusCallback_iface, NULL, &bctx);
 859     }
 860
 861     if(FAILED(hres)) {
 862         bscallback->window = NULL;
 863         return hres;
 864     }
 865
 866     hres = IMoniker_BindToStorage(bscallback->mon, bctx, NULL, &IID_IStream, (void**)&str);
 867     IBindCtx_Release(bctx);
 868     if(FAILED(hres)) {
 869         WARN("BindToStorage failed: %08lx\n", hres);
 870         bscallback->window = NULL;
 871         return hres;
 872     }
 873
 874     if(str)
 875         IStream_Release(str);
 876
 877     return S_OK;
 878 }
 879
 880 static HRESULT read_post_data_stream(nsIInputStream *stream, BOOL contains_headers, struct list *headers_list,
 881         request_data_t *request_data)
 882 {
 883     nsISeekableStream *seekable_stream;
 884     UINT64 available = 0;
 885     UINT32 data_len = 0;
 886     char *data, *post_data;
 887     nsresult nsres;
 888     HRESULT hres = S_OK;
 889
 890     if(!stream)
 891         return S_OK;
 892
 893     nsres =  nsIInputStream_Available(stream, &available);
 894     if(NS_FAILED(nsres))
 895         return E_FAIL;
 896
 897     post_data = data = GlobalAlloc(0, available+1);
 898     if(!data)
 899         return E_OUTOFMEMORY;
 900
 901     nsres = nsIInputStream_Read(stream, data, available, &data_len);
 902     if(NS_FAILED(nsres)) {
 903         GlobalFree(data);
 904         return E_FAIL;
 905     }
 906
 907     if(contains_headers) {
 908         if(data_len >= 2 && data[0] == '\r' && data[1] == '\n') {
 909             post_data = data+2;
 910             data_len -= 2;
 911         }else {
 912             WCHAR *headers;
 913             DWORD size;
 914             char *ptr;
 915
 916             post_data += data_len;
 917             for(ptr = data; ptr+4 < data+data_len; ptr++) {
 918                 if(!memcmp(ptr, "\r\n\r\n", 4)) {
 919                     ptr += 2;
 920                     post_data = ptr+2;
 921                     break;
 922                 }
 923             }
 924
 925             data_len -= post_data-data;
 926
 927             size = MultiByteToWideChar(CP_ACP, 0, data, ptr-data, NULL, 0);
 928             headers = malloc((size + 1) * sizeof(WCHAR));
 929             if(headers) {
 930                 MultiByteToWideChar(CP_ACP, 0, data, ptr-data, headers, size);
 931                 headers[size] = 0;
 932                 if(headers_list)
 933                     hres = parse_headers(headers, headers_list);
 934                 if(SUCCEEDED(hres))
 935                     request_data->headers = headers;
 936                 else
 937                     free(headers);
 938             }else {
 939                 hres = E_OUTOFMEMORY;
 940             }
 941         }
 942     }
 943
 944     if(FAILED(hres)) {
 945         GlobalFree(data);
 946         return hres;
 947     }
 948
 949     if(!data_len) {
 950         GlobalFree(data);
 951         post_data = NULL;
 952     }else if(post_data != data) {
 953         char *new_data;
 954
 955         new_data = GlobalAlloc(0, data_len+1);
 956         if(new_data)
 957             memcpy(new_data, post_data, data_len);
 958         GlobalFree(data);
 959         if(!new_data)
 960             return E_OUTOFMEMORY;
 961         post_data = new_data;
 962     }
 963
 964     if(post_data)
 965         post_data[data_len] = 0;
 966     request_data->post_data = post_data;
 967     request_data->post_data_len = data_len;
 968
 969     nsres = nsIInputStream_QueryInterface(stream, &IID_nsISeekableStream, (void**)&seekable_stream);
 970     assert(nsres == NS_OK);
 971
 972     nsres = nsISeekableStream_Seek(seekable_stream, NS_SEEK_SET, 0);
 973     assert(nsres == NS_OK);
 974
 975     nsISeekableStream_Release(seekable_stream);
 976
 977     nsIInputStream_AddRef(stream);
 978     request_data->post_stream = stream;
 979     TRACE("post_data = %s\n", debugstr_an(request_data->post_data, request_data->post_data_len));
 980     return S_OK;
 981 }
 982
 983 static HRESULT on_start_nsrequest(nsChannelBSC *This)
 984 {
 985     nsresult nsres;
 986
 987     /* Async request can be cancelled before we got to it */
 988     if(NS_FAILED(This->nschannel->status))
 989         return E_ABORT; /* FIXME: map status to HRESULT */
 990
 991     This->nschannel->binding = This;
 992
 993     /* FIXME: it's needed for http connections from BindToObject. */
 994     if(!This->nschannel->response_status)
 995         This->nschannel->response_status = 200;
 996
 997     nsres = nsIStreamListener_OnStartRequest(This->nslistener,
 998             (nsIRequest*)&This->nschannel->nsIHttpChannel_iface, This->nscontext);
 999     if(NS_FAILED(nsres)) {
1000         FIXME("OnStartRequest failed: %08lx\n", nsres);
1001         return E_FAIL;
1002     }
1003
1004     if(This->is_doc_channel) {
1005         HRESULT hres;
1006
1007         if(!This->bsc.window)
1008             return E_ABORT; /* Binding aborted in OnStartRequest call. */
1009         hres = update_window_doc(This->bsc.window);
1010         if(FAILED(hres))
1011             return hres;
1012
1013         if(This->bsc.binding)
1014             process_document_response_headers(This->bsc.window->doc, This->bsc.binding);
1015         if(This->bsc.window->base.outer_window->readystate != READYSTATE_LOADING &&
1016            This->bsc.window->base.outer_window->browser->doc)
1017             set_ready_state(This->bsc.window->base.outer_window, READYSTATE_LOADING);
1018     }
1019
1020     return S_OK;
1021 }
1022
1023 static void on_stop_nsrequest(nsChannelBSC *This, HRESULT result)
1024 {
1025     nsresult nsres, request_result;
1026
1027     switch(result) {
1028     case S_OK:
1029         request_result = NS_OK;
1030         break;
1031     case E_ABORT:
1032         request_result = NS_BINDING_ABORTED;
1033         break;
1034     default:
1035         request_result = NS_ERROR_FAILURE;
1036     }
1037
1038     if(This->nslistener) {
1039         nsres = nsIStreamListener_OnStopRequest(This->nslistener,
1040                  (nsIRequest*)&This->nschannel->nsIHttpChannel_iface, This->nscontext,
1041                  request_result);
1042         if(NS_FAILED(nsres))
1043             WARN("OnStopRequest failed: %08lx\n", nsres);
1044     }
1045
1046     if(This->nschannel) {
1047         if(This->nschannel->load_group) {
1048             nsres = nsILoadGroup_RemoveRequest(This->nschannel->load_group,
1049                     (nsIRequest*)&This->nschannel->nsIHttpChannel_iface, NULL, request_result);
1050             if(NS_FAILED(nsres))
1051                 ERR("RemoveRequest failed: %08lx\n", nsres);
1052         }
1053         if(This->nschannel->binding == This)
1054             This->nschannel->binding = NULL;
1055     }
1056 }
1057
1058 static void notify_progress(nsChannelBSC *This)
1059 {
1060     nsChannel *nschannel = This->nschannel;
1061     nsIProgressEventSink *sink = NULL;
1062     nsresult nsres;
1063
1064     if(!nschannel)
1065         return;
1066
1067     if(nschannel->notif_callback)
1068         if(NS_FAILED(nsIInterfaceRequestor_GetInterface(nschannel->notif_callback, &IID_nsIProgressEventSink, (void**)&sink)))
1069             sink = NULL;
1070
1071     if(!sink && nschannel->load_group) {
1072         nsIRequestObserver *req_observer;
1073
1074         if(NS_SUCCEEDED(nsILoadGroup_GetGroupObserver(nschannel->load_group, &req_observer)) && req_observer) {
1075             nsres = nsIRequestObserver_QueryInterface(req_observer, &IID_nsIProgressEventSink, (void**)&sink);
1076             nsIRequestObserver_Release(req_observer);
1077             if(NS_FAILED(nsres))
1078                 sink = NULL;
1079         }
1080     }
1081
1082     if(sink) {
1083         nsIProgressEventSink_OnProgress(sink, (nsIRequest*)&nschannel->nsIHttpChannel_iface, This->nscontext,
1084                                         This->progress, (This->total == ~0) ? -1 : This->total);
1085         nsIProgressEventSink_Release(sink);
1086     }
1087 }
1088
1089 static HRESULT read_stream_data(nsChannelBSC *This, IStream *stream)
1090 {
1091     DWORD read;
1092     nsresult nsres;
1093     HRESULT hres;
1094
1095     if(!This->response_processed) {
1096         IWinInetHttpInfo *wininet_info;
1097
1098         if(This->is_doc_channel)
1099             This->bsc.window->response_start_time = get_time_stamp();
1100
1101         This->response_processed = TRUE;
1102         if(This->bsc.binding) {
1103             hres = IBinding_QueryInterface(This->bsc.binding, &IID_IWinInetHttpInfo, (void**)&wininet_info);
1104             if(SUCCEEDED(hres)) {
1105                 query_http_info(This, wininet_info);
1106                 IWinInetHttpInfo_Release(wininet_info);
1107             }
1108         }
1109     }
1110
1111     if(!This->nschannel)
1112         return S_OK;
1113
1114     if(!This->nslistener) {
1115         BYTE buf[1024];
1116
1117         do {
1118             hres = read_stream(&This->bsc, stream, buf, sizeof(buf), &read);
1119         }while(hres == S_OK && read);
1120
1121         return S_OK;
1122     }
1123
1124     if(!This->nsstream) {
1125         This->nsstream = create_nsprotocol_stream();
1126         if(!This->nsstream)
1127             return E_OUTOFMEMORY;
1128     }
1129
1130     do {
1131         BOOL first_read = !This->bsc.read;
1132
1133         hres = read_stream(&This->bsc, stream, This->nsstream->buf+This->nsstream->buf_size,
1134                 sizeof(This->nsstream->buf)-This->nsstream->buf_size, &read);
1135         if(!read)
1136             break;
1137
1138         This->nsstream->buf_size += read;
1139
1140         if(first_read) {
1141             switch(This->bsc.bom) {
1142             case BOM_UTF8:
1143                 This->nschannel->charset = strdup("utf-8");
1144                 break;
1145             case BOM_UTF16:
1146                 This->nschannel->charset = strdup("utf-16");
1147             case BOM_NONE:
1148                 /* FIXME: Get charset from HTTP headers */;
1149             }
1150
1151             if(!This->nschannel->content_type) {
1152                 WCHAR *mime;
1153
1154                 hres = FindMimeFromData(NULL, NULL, This->nsstream->buf, This->nsstream->buf_size,
1155                         This->is_doc_channel ? L"text/html" : NULL, 0, &mime, 0);
1156                 if(FAILED(hres))
1157                     return hres;
1158
1159                 TRACE("Found MIME %s\n", debugstr_w(mime));
1160
1161                 This->nschannel->content_type = strdupWtoA(mime);
1162                 CoTaskMemFree(mime);
1163                 if(!This->nschannel->content_type)
1164                     return E_OUTOFMEMORY;
1165             }
1166
1167             hres = on_start_nsrequest(This);
1168             if(FAILED(hres))
1169                 return hres;
1170         }
1171
1172         notify_progress(This);
1173
1174         nsres = nsIStreamListener_OnDataAvailable(This->nslistener,
1175                 (nsIRequest*)&This->nschannel->nsIHttpChannel_iface, This->nscontext,
1176                 &This->nsstream->nsIInputStream_iface, This->bsc.read-This->nsstream->buf_size,
1177                 This->nsstream->buf_size);
1178         if(NS_FAILED(nsres)) {
1179             WARN("OnDataAvailable failed: %08lx\n", nsres);
1180             return map_nsresult(nsres);
1181         }
1182
1183         if(This->nsstream->buf_size == sizeof(This->nsstream->buf)) {
1184             ERR("buffer is full\n");
1185             break;
1186         }
1187     }while(hres == S_OK);
1188
1189     return S_OK;
1190 }
1191
1192 typedef struct {
1193     nsIAsyncVerifyRedirectCallback nsIAsyncVerifyRedirectCallback_iface;
1194
1195     LONG ref;
1196
1197     nsChannel *nschannel;
1198     nsChannelBSC *bsc;
1199 } nsRedirectCallback;
1200
1201 static nsRedirectCallback *impl_from_nsIAsyncVerifyRedirectCallback(nsIAsyncVerifyRedirectCallback *iface)
1202 {
1203     return CONTAINING_RECORD(iface, nsRedirectCallback, nsIAsyncVerifyRedirectCallback_iface);
1204 }
1205
1206 static nsresult NSAPI nsAsyncVerifyRedirectCallback_QueryInterface(nsIAsyncVerifyRedirectCallback *iface,
1207         nsIIDRef riid, void **result)
1208 {
1209     nsRedirectCallback *This = impl_from_nsIAsyncVerifyRedirectCallback(iface);
1210
1211     if(IsEqualGUID(&IID_nsISupports, riid)) {
1212         TRACE("(%p)->(IID_nsISupports %p)\n", This, result);
1213         *result = &This->nsIAsyncVerifyRedirectCallback_iface;
1214     }else if(IsEqualGUID(&IID_nsIAsyncVerifyRedirectCallback, riid)) {
1215         TRACE("(%p)->(IID_nsIAsyncVerifyRedirectCallback %p)\n", This, result);
1216         *result = &This->nsIAsyncVerifyRedirectCallback_iface;
1217     }else {
1218         *result = NULL;
1219         WARN("unimplemented iface %s\n", debugstr_guid(riid));
1220         return NS_NOINTERFACE;
1221     }
1222
1223     nsISupports_AddRef((nsISupports*)*result);
1224     return NS_OK;
1225 }
1226
1227 static nsrefcnt NSAPI nsAsyncVerifyRedirectCallback_AddRef(nsIAsyncVerifyRedirectCallback *iface)
1228 {
1229     nsRedirectCallback *This = impl_from_nsIAsyncVerifyRedirectCallback(iface);
1230     LONG ref = InterlockedIncrement(&This->ref);
1231
1232     TRACE("(%p) ref=%ld\n", This, ref);
1233
1234     return ref;
1235 }
1236
1237 static nsrefcnt NSAPI nsAsyncVerifyRedirectCallback_Release(nsIAsyncVerifyRedirectCallback *iface)
1238 {
1239     nsRedirectCallback *This = impl_from_nsIAsyncVerifyRedirectCallback(iface);
1240     LONG ref = InterlockedDecrement(&This->ref);
1241
1242     TRACE("(%p) ref=%ld\n", This, ref);
1243
1244     if(!ref) {
1245         IBindStatusCallback_Release(&This->bsc->bsc.IBindStatusCallback_iface);
1246         nsIHttpChannel_Release(&This->nschannel->nsIHttpChannel_iface);
1247         free(This);
1248     }
1249
1250     return ref;
1251 }
1252
1253 static nsresult NSAPI nsAsyncVerifyRedirectCallback_OnRedirectVerifyCallback(nsIAsyncVerifyRedirectCallback *iface, nsresult result)
1254 {
1255     nsRedirectCallback *This = impl_from_nsIAsyncVerifyRedirectCallback(iface);
1256     nsChannel *old_nschannel;
1257     nsresult nsres;
1258
1259     TRACE("(%p)->(%08lx)\n", This, result);
1260
1261     old_nschannel = This->bsc->nschannel;
1262     nsIHttpChannel_AddRef(&This->nschannel->nsIHttpChannel_iface);
1263     This->bsc->nschannel = This->nschannel;
1264
1265     if(This->nschannel->load_group) {
1266         nsres = nsILoadGroup_AddRequest(This->nschannel->load_group, (nsIRequest*)&This->nschannel->nsIHttpChannel_iface,
1267                 NULL);
1268         if(NS_FAILED(nsres))
1269             ERR("AddRequest failed: %08lx\n", nsres);
1270     }
1271
1272     if(This->bsc->is_doc_channel && This->bsc->bsc.window && This->bsc->bsc.window->base.outer_window) {
1273         IUri *uri = nsuri_get_uri(This->nschannel->uri);
1274
1275         if(uri) {
1276             set_current_uri(This->bsc->bsc.window->base.outer_window, uri);
1277             IUri_Release(uri);
1278         }else {
1279             WARN("Could not get IUri from nsWineURI\n");
1280         }
1281     }
1282
1283     if(old_nschannel) {
1284         if(old_nschannel->load_group) {
1285             nsres = nsILoadGroup_RemoveRequest(old_nschannel->load_group,
1286                     (nsIRequest*)&old_nschannel->nsIHttpChannel_iface, NULL, NS_OK);
1287             if(NS_FAILED(nsres))
1288                 ERR("RemoveRequest failed: %08lx\n", nsres);
1289         }
1290         nsIHttpChannel_Release(&old_nschannel->nsIHttpChannel_iface);
1291     }
1292
1293     return NS_OK;
1294 }
1295
1296 static const nsIAsyncVerifyRedirectCallbackVtbl nsAsyncVerifyRedirectCallbackVtbl = {
1297     nsAsyncVerifyRedirectCallback_QueryInterface,
1298     nsAsyncVerifyRedirectCallback_AddRef,
1299     nsAsyncVerifyRedirectCallback_Release,
1300     nsAsyncVerifyRedirectCallback_OnRedirectVerifyCallback
1301 };
1302
1303 static HRESULT create_redirect_callback(nsChannel *nschannel, nsChannelBSC *bsc, nsRedirectCallback **ret)
1304 {
1305     nsRedirectCallback *callback;
1306
1307     callback = malloc(sizeof(*callback));
1308     if(!callback)
1309         return E_OUTOFMEMORY;
1310
1311     callback->nsIAsyncVerifyRedirectCallback_iface.lpVtbl = &nsAsyncVerifyRedirectCallbackVtbl;
1312     callback->ref = 1;
1313
1314     nsIHttpChannel_AddRef(&nschannel->nsIHttpChannel_iface);
1315     callback->nschannel = nschannel;
1316
1317     IBindStatusCallback_AddRef(&bsc->bsc.IBindStatusCallback_iface);
1318     callback->bsc = bsc;
1319
1320     *ret = callback;
1321     return S_OK;
1322 }
1323
1324 static inline nsChannelBSC *nsChannelBSC_from_BSCallback(BSCallback *iface)
1325 {
1326     return CONTAINING_RECORD(iface, nsChannelBSC, bsc);
1327 }
1328
1329 static void nsChannelBSC_destroy(BSCallback *bsc)
1330 {
1331     nsChannelBSC *This = nsChannelBSC_from_BSCallback(bsc);
1332
1333     if(This->nschannel) {
1334         if(This->nschannel->binding == This)
1335             This->nschannel->binding = NULL;
1336         nsIHttpChannel_Release(&This->nschannel->nsIHttpChannel_iface);
1337     }
1338     if(This->nslistener)
1339         nsIStreamListener_Release(This->nslistener);
1340     if(This->nscontext)
1341         nsISupports_Release(This->nscontext);
1342     if(This->nsstream)
1343         nsIInputStream_Release(&This->nsstream->nsIInputStream_iface);
1344     free(This);
1345 }
1346
1347 static HRESULT nsChannelBSC_start_binding(BSCallback *bsc)
1348 {
1349     nsChannelBSC *This = nsChannelBSC_from_BSCallback(bsc);
1350
1351     if(This->is_doc_channel) {
1352         DWORD flags = This->bsc.window->base.outer_window->load_flags;
1353
1354         if(flags & BINDING_FROMHIST)
1355             This->bsc.window->navigation_type = 2;  /* TYPE_BACK_FORWARD */
1356         if(flags & BINDING_REFRESH)
1357             This->bsc.window->navigation_type = 1;  /* TYPE_RELOAD */
1358
1359         This->bsc.window->base.outer_window->base.inner_window->doc->skip_mutation_notif = FALSE;
1360         This->bsc.window->navigation_start_time = get_time_stamp();
1361     }
1362
1363     return S_OK;
1364 }
1365
1366 static HRESULT nsChannelBSC_init_bindinfo(BSCallback *bsc)
1367 {
1368     nsChannelBSC *This = nsChannelBSC_from_BSCallback(bsc);
1369     nsChannel *nschannel = This->nschannel;
1370     GeckoBrowser *browser;
1371     HRESULT hres;
1372
1373     if(This->is_doc_channel && This->bsc.window && This->bsc.window->base.outer_window
1374        && (browser = This->bsc.window->base.outer_window->browser) && browser->doc) {
1375         if(browser->doc->hostinfo.dwFlags & DOCHOSTUIFLAG_ENABLE_REDIRECT_NOTIFICATION)
1376             This->bsc.bindinfo_options |= BINDINFO_OPTIONS_DISABLEAUTOREDIRECTS;
1377     }
1378
1379     if(nschannel && nschannel->post_data_stream) {
1380         hres = read_post_data_stream(nschannel->post_data_stream, nschannel->post_data_contains_headers,
1381                 &nschannel->request_headers, &This->bsc.request_data);
1382         if(FAILED(hres))
1383             return hres;
1384     }
1385
1386     return S_OK;
1387 }
1388
1389 typedef struct {
1390     task_t header;
1391     nsChannelBSC *bsc;
1392 } stop_request_task_t;
1393
1394 static void stop_request_proc(task_t *_task)
1395 {
1396     stop_request_task_t *task = (stop_request_task_t*)_task;
1397
1398     TRACE("(%p)\n", task->bsc);
1399
1400     list_remove(&task->bsc->bsc.entry);
1401     list_init(&task->bsc->bsc.entry);
1402     on_stop_nsrequest(task->bsc, S_OK);
1403 }
1404
1405 static void stop_request_task_destr(task_t *_task)
1406 {
1407     stop_request_task_t *task = (stop_request_task_t*)_task;
1408
1409     IBindStatusCallback_Release(&task->bsc->bsc.IBindStatusCallback_iface);
1410 }
1411
1412 static HRESULT async_stop_request(nsChannelBSC *This)
1413 {
1414     HTMLInnerWindow *window = This->bsc.window;
1415     stop_request_task_t *task;
1416     HRESULT hres;
1417
1418     task = malloc(sizeof(*task));
1419     if(!task)
1420         return E_OUTOFMEMORY;
1421
1422     IHTMLWindow2_AddRef(&window->base.IHTMLWindow2_iface);
1423     if(!This->bsc.read) {
1424         TRACE("No data read, calling OnStartRequest\n");
1425         on_start_nsrequest(This);
1426     }
1427
1428     IBindStatusCallback_AddRef(&This->bsc.IBindStatusCallback_iface);
1429     task->bsc = This;
1430
1431     hres = push_task(&task->header, stop_request_proc, stop_request_task_destr, window->task_magic);
1432     IHTMLWindow2_Release(&window->base.IHTMLWindow2_iface);
1433     return hres;
1434 }
1435
1436 static void handle_navigation_error(nsChannelBSC *This, DWORD result)
1437 {
1438     HTMLOuterWindow *outer_window;
1439     HTMLDocumentObj *doc;
1440     BOOL is_error_url;
1441     SAFEARRAY *sa;
1442     SAFEARRAYBOUND bound;
1443     VARIANT var, varOut;
1444     LONG ind;
1445     BSTR unk;
1446     HRESULT hres;
1447
1448     if(!This->is_doc_channel || !This->bsc.window || !This->bsc.window->base.outer_window
1449        || !This->bsc.window->base.outer_window->browser)
1450         return;
1451
1452     outer_window = This->bsc.window->base.outer_window;
1453     doc = outer_window->browser->doc;
1454     if(!doc->doc_object_service || !doc->client)
1455         return;
1456
1457     hres = IDocObjectService_IsErrorUrl(doc->doc_object_service,
1458             outer_window->url, &is_error_url);
1459     if(FAILED(hres) || is_error_url)
1460         return;
1461
1462     if(!doc->client_cmdtrg)
1463         return;
1464
1465     bound.lLbound = 0;
1466     bound.cElements = 8;
1467     sa = SafeArrayCreate(VT_VARIANT, 1, &bound);
1468     if(!sa)
1469         return;
1470
1471     ind = 0;
1472     V_VT(&var) = VT_I4;
1473     V_I4(&var) = result;
1474     SafeArrayPutElement(sa, &ind, &var);
1475
1476     ind = 1;
1477     V_VT(&var) = VT_BSTR;
1478     V_BSTR(&var) = outer_window->url;
1479     SafeArrayPutElement(sa, &ind, &var);
1480
1481     ind = 3;
1482     V_VT(&var) = VT_UNKNOWN;
1483     V_UNKNOWN(&var) = (IUnknown*)&outer_window->base.IHTMLWindow2_iface;
1484     SafeArrayPutElement(sa, &ind, &var);
1485
1486     /* FIXME: what are the following fields for? */
1487     ind = 2;
1488     V_VT(&var) = VT_UNKNOWN;
1489     V_UNKNOWN(&var) = NULL;
1490     SafeArrayPutElement(sa, &ind, &var);
1491
1492     ind = 4;
1493     V_VT(&var) = VT_BOOL;
1494     V_BOOL(&var) = FALSE;
1495     SafeArrayPutElement(sa, &ind, &var);
1496
1497     ind = 5;
1498     V_VT(&var) = VT_BOOL;
1499     V_BOOL(&var) = FALSE;
1500     SafeArrayPutElement(sa, &ind, &var);
1501
1502     ind = 6;
1503     V_VT(&var) = VT_BSTR;
1504     unk = SysAllocString(NULL);
1505     V_BSTR(&var) = unk;
1506     SafeArrayPutElement(sa, &ind, &var);
1507
1508     ind = 7;
1509     V_VT(&var) = VT_UNKNOWN;
1510     V_UNKNOWN(&var) = NULL;
1511     SafeArrayPutElement(sa, &ind, &var);
1512
1513     V_VT(&var) = VT_ARRAY;
1514     V_ARRAY(&var) = sa;
1515     V_VT(&varOut) = VT_BOOL;
1516     V_BOOL(&varOut) = VARIANT_TRUE;
1517     IOleCommandTarget_Exec(doc->client_cmdtrg, &CGID_DocHostCmdPriv, 1, 0, &var, FAILED(hres)?NULL:&varOut);
1518
1519     SysFreeString(unk);
1520     SafeArrayDestroy(sa);
1521 }
1522
1523 static HRESULT nsChannelBSC_stop_binding(BSCallback *bsc, HRESULT result)
1524 {
1525     nsChannelBSC *This = nsChannelBSC_from_BSCallback(bsc);
1526
1527     if(This->is_doc_channel && This->bsc.window) {
1528         This->bsc.window->response_end_time = get_time_stamp();
1529         if(result != E_ABORT) {
1530             if(FAILED(result))
1531                 handle_navigation_error(This, result);
1532             else if(This->nschannel) {
1533                 result = async_stop_request(This);
1534                 if(SUCCEEDED(result))
1535                     return S_OK;
1536             }
1537         }
1538     }
1539
1540     on_stop_nsrequest(This, result);
1541     return S_OK;
1542 }
1543
1544 static HRESULT nsChannelBSC_read_data(BSCallback *bsc, IStream *stream)
1545 {
1546     nsChannelBSC *This = nsChannelBSC_from_BSCallback(bsc);
1547
1548     return read_stream_data(This, stream);
1549 }
1550
1551 static HRESULT handle_redirect(nsChannelBSC *This, const WCHAR *new_url)
1552 {
1553     nsRedirectCallback *callback;
1554     nsIChannelEventSink *sink;
1555     nsChannel *new_channel;
1556     IMoniker *mon;
1557     nsresult nsres;
1558     HRESULT hres;
1559
1560     TRACE("(%p)->(%s)\n", This, debugstr_w(new_url));
1561
1562     hres = CreateURLMoniker(NULL, new_url, &mon);
1563     if(FAILED(hres))
1564         return hres;
1565     IMoniker_Release(This->bsc.mon);
1566     This->bsc.mon = mon;
1567
1568     if(!This->nschannel || !This->nschannel->notif_callback)
1569         return S_OK;
1570
1571     nsres = nsIInterfaceRequestor_GetInterface(This->nschannel->notif_callback, &IID_nsIChannelEventSink, (void**)&sink);
1572     if(NS_FAILED(nsres))
1573         return S_OK;
1574
1575     hres = create_redirect_nschannel(new_url, This->nschannel, &new_channel);
1576     if(SUCCEEDED(hres)) {
1577         TRACE("%p %p->%p\n", This, This->nschannel, new_channel);
1578
1579         hres = create_redirect_callback(new_channel, This, &callback);
1580         nsIHttpChannel_Release(&new_channel->nsIHttpChannel_iface);
1581     }
1582
1583     if(SUCCEEDED(hres)) {
1584         nsres = nsIChannelEventSink_AsyncOnChannelRedirect(sink, (nsIChannel*)&This->nschannel->nsIHttpChannel_iface,
1585                 (nsIChannel*)&callback->nschannel->nsIHttpChannel_iface, REDIRECT_TEMPORARY, /* FIXME */
1586                 &callback->nsIAsyncVerifyRedirectCallback_iface);
1587
1588         if(NS_FAILED(nsres))
1589             FIXME("AsyncOnChannelRedirect failed: %08lx\n", hres);
1590         else if(This->nschannel != callback->nschannel)
1591             FIXME("nschannel not updated\n");
1592
1593         nsIAsyncVerifyRedirectCallback_Release(&callback->nsIAsyncVerifyRedirectCallback_iface);
1594     }
1595
1596     nsIChannelEventSink_Release(sink);
1597     return hres;
1598 }
1599
1600 static BOOL is_supported_doc_mime(const WCHAR *mime)
1601 {
1602     char *nscat, *mimea;
1603     BOOL ret;
1604
1605     mimea = strdupWtoA(mime);
1606     if(!mimea)
1607         return FALSE;
1608
1609     nscat = get_nscategory_entry("Gecko-Content-Viewers", mimea);
1610
1611     ret = nscat != NULL && !strcmp(nscat, "@mozilla.org/content/document-loader-factory;1");
1612
1613     free(mimea);
1614     nsfree(nscat);
1615     return ret;
1616 }
1617
1618 static IUri *get_moniker_uri(IMoniker *mon)
1619 {
1620     IUriContainer *uri_container;
1621     IUri *ret = NULL;
1622     HRESULT hres;
1623
1624     hres = IMoniker_QueryInterface(mon, &IID_IUriContainer, (void**)&uri_container);
1625     if(SUCCEEDED(hres)) {
1626         hres = IUriContainer_GetIUri(uri_container, &ret);
1627         IUriContainer_Release(uri_container);
1628         if(FAILED(hres))
1629             return NULL;
1630     }else {
1631         FIXME("No IUriContainer\n");
1632     }
1633
1634     return ret;
1635 }
1636
1637 static void handle_extern_mime_navigation(nsChannelBSC *This)
1638 {
1639     IWebBrowserPriv2IE9 *webbrowser_priv;
1640     IOleCommandTarget *cmdtrg;
1641     HTMLDocumentObj *doc_obj;
1642     IBindCtx *bind_ctx;
1643     IUri *uri;
1644     VARIANT flags;
1645     HRESULT hres;
1646
1647     if(!This->bsc.window || !This->bsc.window->base.outer_window || !This->bsc.window->base.outer_window->browser)
1648         return;
1649
1650     doc_obj = This->bsc.window->base.outer_window->browser->doc;
1651     IUnknown_AddRef(doc_obj->outer_unk);
1652
1653     hres = IOleClientSite_QueryInterface(doc_obj->client, &IID_IOleCommandTarget, (void**)&cmdtrg);
1654     if(SUCCEEDED(hres)) {
1655         IOleCommandTarget_Exec(cmdtrg, &CGID_ShellDocView, 62, 0, NULL, NULL);
1656         IOleCommandTarget_Release(cmdtrg);
1657     }
1658
1659     set_document_navigation(doc_obj, FALSE);
1660
1661     if(!doc_obj->webbrowser) {
1662         FIXME("unimplemented in non-webbrowser mode\n");
1663         goto done;
1664     }
1665
1666     uri = get_moniker_uri(This->bsc.mon);
1667     if(!uri)
1668         goto done;
1669
1670     hres = CreateBindCtx(0, &bind_ctx);
1671     if(FAILED(hres)) {
1672         IUri_Release(uri);
1673         goto done;
1674     }
1675
1676     V_VT(&flags) = VT_I4;
1677     V_I4(&flags) = navHyperlink;
1678
1679     hres = IUnknown_QueryInterface(doc_obj->webbrowser, &IID_IWebBrowserPriv2IE8, (void**)&webbrowser_priv);
1680     if(SUCCEEDED(hres)) {
1681         hres = IWebBrowserPriv2IE9_NavigateWithBindCtx2(webbrowser_priv, uri, &flags, NULL, NULL, NULL, bind_ctx, NULL, 0);
1682         IWebBrowserPriv2IE9_Release(webbrowser_priv);
1683     }else {
1684         IWebBrowserPriv *webbrowser_priv_old;
1685         VARIANT uriv;
1686
1687         hres = IUnknown_QueryInterface(doc_obj->webbrowser, &IID_IWebBrowserPriv, (void**)&webbrowser_priv_old);
1688         if(SUCCEEDED(hres)) {
1689             V_VT(&uriv) = VT_BSTR;
1690             V_BSTR(&uriv) = NULL;
1691             hres = IUri_GetDisplayUri(uri, &V_BSTR(&uriv));
1692
1693             if(hres == S_OK)
1694                 hres = IWebBrowserPriv_NavigateWithBindCtx(webbrowser_priv_old, &uriv, &flags, NULL, NULL, NULL, bind_ctx, NULL);
1695
1696             SysFreeString(V_BSTR(&uriv));
1697             IWebBrowserPriv_Release(webbrowser_priv_old);
1698         }
1699     }
1700
1701     IUri_Release(uri);
1702
1703 done:
1704     IUnknown_Release(doc_obj->outer_unk);
1705 }
1706
1707 static HRESULT nsChannelBSC_on_progress(BSCallback *bsc, ULONG progress, ULONG total, ULONG status_code, LPCWSTR status_text)
1708 {
1709     nsChannelBSC *This = nsChannelBSC_from_BSCallback(bsc);
1710
1711     switch(status_code) {
1712     case BINDSTATUS_MIMETYPEAVAILABLE:
1713         if(This->is_doc_channel && !is_supported_doc_mime(status_text)) {
1714             FIXME("External MIME: %s\n", debugstr_w(status_text));
1715
1716             handle_extern_mime_navigation(This);
1717
1718             This->nschannel = NULL;
1719         }
1720
1721         if(!This->nschannel ||
1722            (This->nschannel->content_type && !(This->nschannel->load_flags & LOAD_CALL_CONTENT_SNIFFERS)))
1723             return S_OK;
1724
1725         free(This->nschannel->content_type);
1726         This->nschannel->content_type = strdupWtoA(status_text);
1727         break;
1728     case BINDSTATUS_REDIRECTING:
1729         if(This->is_doc_channel) {
1730             This->bsc.window->redirect_count++;
1731             if(!This->bsc.window->redirect_time)
1732                 This->bsc.window->redirect_time = get_time_stamp();
1733         }
1734         return handle_redirect(This, status_text);
1735     case BINDSTATUS_FINDINGRESOURCE:
1736         if(This->is_doc_channel && !This->bsc.window->dns_lookup_time)
1737             This->bsc.window->dns_lookup_time = get_time_stamp();
1738         break;
1739     case BINDSTATUS_CONNECTING:
1740         if(This->is_doc_channel)
1741             This->bsc.window->connect_time = get_time_stamp();
1742         break;
1743     case BINDSTATUS_SENDINGREQUEST:
1744         if(This->is_doc_channel)
1745             This->bsc.window->request_time = get_time_stamp();
1746         break;
1747     case BINDSTATUS_BEGINDOWNLOADDATA: {
1748         IWinInetHttpInfo *http_info;
1749         DWORD status, size = sizeof(DWORD);
1750         HRESULT hres;
1751
1752         if(This->bsc.binding) {
1753             hres = IBinding_QueryInterface(This->bsc.binding, &IID_IWinInetHttpInfo, (void**)&http_info);
1754             if(SUCCEEDED(hres)) {
1755                 hres = IWinInetHttpInfo_QueryInfo(http_info,
1756                         HTTP_QUERY_STATUS_CODE|HTTP_QUERY_FLAG_NUMBER, &status, &size, NULL, NULL);
1757                 IWinInetHttpInfo_Release(http_info);
1758                 if(SUCCEEDED(hres) && status != HTTP_STATUS_OK)
1759                     handle_navigation_error(This, status);
1760             }
1761         }
1762         /* fall through */
1763     }
1764     case BINDSTATUS_DOWNLOADINGDATA:
1765     case BINDSTATUS_ENDDOWNLOADDATA:
1766         /* Defer it to just before calling OnDataAvailable, otherwise it can have wrong state */
1767         This->progress = progress;
1768         This->total = total;
1769         break;
1770     }
1771
1772     return S_OK;
1773 }
1774
1775 static HRESULT process_response_status_text(const WCHAR *header, const WCHAR *header_end, char **status_text)
1776 {
1777     header = wcschr(header + 1, ' ');
1778     if(!header || header >= header_end)
1779         return E_FAIL;
1780     header = wcschr(header + 1, ' ');
1781     if(!header || header >= header_end)
1782         header = header_end;
1783     else
1784         ++header;
1785
1786     *status_text = strndupWtoU(header, header_end - header);
1787
1788     if(!*status_text)
1789         return E_OUTOFMEMORY;
1790
1791     return S_OK;
1792 }
1793
1794 static HRESULT nsChannelBSC_on_response(BSCallback *bsc, DWORD response_code,
1795         LPCWSTR response_headers)
1796 {
1797     nsChannelBSC *This = nsChannelBSC_from_BSCallback(bsc);
1798     char *str;
1799     HRESULT hres;
1800
1801     if(This->is_doc_channel)
1802         This->bsc.window->response_start_time = get_time_stamp();
1803
1804     This->response_processed = TRUE;
1805     This->nschannel->response_status = response_code;
1806
1807     if(response_headers) {
1808         const WCHAR *headers;
1809
1810         headers = wcschr(response_headers, '\r');
1811         hres = process_response_status_text(response_headers, headers, &str);
1812         if(FAILED(hres)) {
1813             WARN("parsing headers failed: %08lx\n", hres);
1814             return hres;
1815         }
1816
1817         free(This->nschannel->response_status_text);
1818         This->nschannel->response_status_text = str;
1819
1820         if(headers && headers[1] == '\n') {
1821             headers += 2;
1822             hres = process_response_headers(This, headers);
1823             if(FAILED(hres)) {
1824                 WARN("parsing headers failed: %08lx\n", hres);
1825                 return hres;
1826             }
1827         }
1828     }
1829
1830     return S_OK;
1831 }
1832
1833 static HRESULT nsChannelBSC_beginning_transaction(BSCallback *bsc, WCHAR **additional_headers)
1834 {
1835     nsChannelBSC *This = nsChannelBSC_from_BSCallback(bsc);
1836     http_header_t *iter;
1837     DWORD len = 0;
1838     WCHAR *ptr;
1839
1840     if(!This->nschannel)
1841         return S_FALSE;
1842
1843     LIST_FOR_EACH_ENTRY(iter, &This->nschannel->request_headers, http_header_t, entry) {
1844         if(wcscmp(iter->header, L"Content-Length"))
1845             len += lstrlenW(iter->header) + 2 /* ": " */ + lstrlenW(iter->data) + 2 /* "\r\n" */;
1846     }
1847
1848     if(!len)
1849         return S_OK;
1850
1851     *additional_headers = ptr = CoTaskMemAlloc((len+1)*sizeof(WCHAR));
1852     if(!ptr)
1853         return E_OUTOFMEMORY;
1854
1855     LIST_FOR_EACH_ENTRY(iter, &This->nschannel->request_headers, http_header_t, entry) {
1856         if(!wcscmp(iter->header, L"Content-Length"))
1857             continue;
1858
1859         len = lstrlenW(iter->header);
1860         memcpy(ptr, iter->header, len*sizeof(WCHAR));
1861         ptr += len;
1862
1863         *ptr++ = ':';
1864         *ptr++ = ' ';
1865
1866         len = lstrlenW(iter->data);
1867         memcpy(ptr, iter->data, len*sizeof(WCHAR));
1868         ptr += len;
1869
1870         *ptr++ = '\r';
1871         *ptr++ = '\n';
1872     }
1873
1874     *ptr = 0;
1875
1876     return S_OK;
1877 }
1878
1879 static const BSCallbackVtbl nsChannelBSCVtbl = {
1880     nsChannelBSC_destroy,
1881     nsChannelBSC_init_bindinfo,
1882     nsChannelBSC_start_binding,
1883     nsChannelBSC_stop_binding,
1884     nsChannelBSC_read_data,
1885     nsChannelBSC_on_progress,
1886     nsChannelBSC_on_response,
1887     nsChannelBSC_beginning_transaction
1888 };
1889
1890 HRESULT create_channelbsc(IMoniker *mon, const WCHAR *headers, BYTE *post_data, DWORD post_data_size,
1891         BOOL is_doc_binding, nsChannelBSC **retval)
1892 {
1893     nsChannelBSC *ret;
1894     DWORD bindf;
1895
1896     ret = calloc(1, sizeof(*ret));
1897     if(!ret)
1898         return E_OUTOFMEMORY;
1899
1900     bindf = BINDF_ASYNCHRONOUS | BINDF_ASYNCSTORAGE | BINDF_PULLDATA;
1901     if(post_data_size)
1902         bindf |= BINDF_FORMS_SUBMIT | BINDF_PRAGMA_NO_CACHE | BINDF_HYPERLINK | BINDF_GETNEWESTVERSION;
1903
1904     init_bscallback(&ret->bsc, &nsChannelBSCVtbl, mon, bindf);
1905     ret->is_doc_channel = is_doc_binding;
1906
1907     if(headers) {
1908         ret->bsc.request_data.headers = wcsdup(headers);
1909         if(!ret->bsc.request_data.headers) {
1910             IBindStatusCallback_Release(&ret->bsc.IBindStatusCallback_iface);
1911             return E_OUTOFMEMORY;
1912         }
1913     }
1914
1915     if(post_data) {
1916         ret->bsc.request_data.post_data = GlobalAlloc(0, post_data_size+1);
1917         if(!ret->bsc.request_data.post_data) {
1918             release_request_data(&ret->bsc.request_data);
1919             IBindStatusCallback_Release(&ret->bsc.IBindStatusCallback_iface);
1920             return E_OUTOFMEMORY;
1921         }
1922
1923         memcpy(ret->bsc.request_data.post_data, post_data, post_data_size);
1924         ((BYTE*)ret->bsc.request_data.post_data)[post_data_size] = 0;
1925         ret->bsc.request_data.post_data_len = post_data_size;
1926     }
1927
1928     TRACE("created %p\n", ret);
1929     *retval = ret;
1930     return S_OK;
1931 }
1932
1933 typedef struct {
1934     task_t header;
1935     DWORD flags;
1936     HTMLOuterWindow *window;
1937     HTMLInnerWindow *pending_window;
1938 } start_doc_binding_task_t;
1939
1940 static void start_doc_binding_proc(task_t *_task)
1941 {
1942     start_doc_binding_task_t *task = (start_doc_binding_task_t*)_task;
1943     HTMLOuterWindow *window = task->window;
1944
1945     IHTMLWindow2_AddRef(&window->base.IHTMLWindow2_iface);
1946     set_current_mon(window, task->pending_window->bscallback->bsc.mon, task->flags);
1947     IHTMLWindow2_Release(&window->base.IHTMLWindow2_iface);
1948
1949     start_binding(task->pending_window, &task->pending_window->bscallback->bsc, NULL);
1950 }
1951
1952 static void start_doc_binding_task_destr(task_t *_task)
1953 {
1954     start_doc_binding_task_t *task = (start_doc_binding_task_t*)_task;
1955
1956     IHTMLWindow2_Release(&task->pending_window->base.IHTMLWindow2_iface);
1957 }
1958
1959 HRESULT async_start_doc_binding(HTMLOuterWindow *window, HTMLInnerWindow *pending_window, DWORD flags)
1960 {
1961     start_doc_binding_task_t *task;
1962
1963     TRACE("%p\n", pending_window);
1964
1965     task = malloc(sizeof(start_doc_binding_task_t));
1966     if(!task)
1967         return E_OUTOFMEMORY;
1968
1969     task->flags = flags;
1970     task->window = window;
1971     task->pending_window = pending_window;
1972     IHTMLWindow2_AddRef(&pending_window->base.IHTMLWindow2_iface);
1973
1974     return push_task(&task->header, start_doc_binding_proc, start_doc_binding_task_destr, pending_window->task_magic);
1975 }
1976
1977 void abort_window_bindings(HTMLInnerWindow *window)
1978 {
1979     BSCallback *iter;
1980
1981     remove_target_tasks(window->task_magic);
1982
1983     while(!list_empty(&window->bindings)) {
1984         iter = LIST_ENTRY(window->bindings.next, BSCallback, entry);
1985
1986         TRACE("Aborting %p\n", iter);
1987
1988         IBindStatusCallback_AddRef(&iter->IBindStatusCallback_iface);
1989
1990         if(iter->binding) {
1991             IBinding *binding = iter->binding;
1992
1993             /* Abort can end up calling our OnStopBinding, which releases the binding. */
1994             IBinding_AddRef(binding);
1995             IBinding_Abort(binding);
1996             IBinding_Release(binding);
1997         }else {
1998             iter->vtbl->stop_binding(iter, E_ABORT);
1999         }
2000
2001         iter->window = NULL;
2002         list_remove(&iter->entry);
2003         list_init(&iter->entry);
2004
2005         IBindStatusCallback_Release(&iter->IBindStatusCallback_iface);
2006     }
2007
2008     if(window->bscallback) {
2009         IBindStatusCallback_Release(&window->bscallback->bsc.IBindStatusCallback_iface);
2010         window->bscallback = NULL;
2011     }
2012
2013     unlink_ref(&window->mon);
2014 }
2015
2016 HRESULT channelbsc_load_stream(HTMLInnerWindow *pending_window, IMoniker *mon, IStream *stream)
2017 {
2018     HTMLOuterWindow *window = pending_window->base.outer_window;
2019     nsChannelBSC *bscallback = pending_window->bscallback;
2020     HRESULT hres = S_OK;
2021
2022     if(!bscallback->nschannel) {
2023         ERR("NULL nschannel\n");
2024         return E_FAIL;
2025     }
2026
2027     bscallback->nschannel->content_type = strdup("text/html");
2028     if(!bscallback->nschannel->content_type)
2029         return E_OUTOFMEMORY;
2030
2031     IHTMLWindow2_AddRef(&window->base.IHTMLWindow2_iface);
2032     set_current_mon(window, mon, 0);
2033     IHTMLWindow2_Release(&window->base.IHTMLWindow2_iface);
2034
2035     bscallback->bsc.window = pending_window;
2036     if(stream)
2037         hres = read_stream_data(bscallback, stream);
2038     if(SUCCEEDED(hres))
2039         hres = async_stop_request(bscallback);
2040     if(FAILED(hres))
2041         IBindStatusCallback_OnStopBinding(&bscallback->bsc.IBindStatusCallback_iface, hres, NULL);
2042
2043     return hres;
2044 }
2045
2046 void channelbsc_set_channel(nsChannelBSC *This, nsChannel *channel, nsIStreamListener *listener, nsISupports *context)
2047 {
2048     nsIHttpChannel_AddRef(&channel->nsIHttpChannel_iface);
2049     This->nschannel = channel;
2050
2051     nsIStreamListener_AddRef(listener);
2052     This->nslistener = listener;
2053
2054     if(context) {
2055         nsISupports_AddRef(context);
2056         This->nscontext = context;
2057     }
2058
2059     if(This->bsc.request_data.headers) {
2060         HRESULT hres;
2061
2062         hres = parse_headers(This->bsc.request_data.headers, &channel->request_headers);
2063         free(This->bsc.request_data.headers);
2064         This->bsc.request_data.headers = NULL;
2065         if(FAILED(hres))
2066             WARN("parse_headers failed: %08lx\n", hres);
2067     }
2068 }
2069
2070 typedef struct {
2071     task_t header;
2072     HTMLOuterWindow *window;
2073     IUri *uri;
2074 } navigate_javascript_task_t;
2075
2076 static void navigate_javascript_proc(task_t *_task)
2077 {
2078     navigate_javascript_task_t *task = (navigate_javascript_task_t*)_task;
2079     HTMLInnerWindow *inner_window = task->window->base.inner_window;
2080     HTMLOuterWindow *window = task->window;
2081     HTMLDocumentObj *doc = NULL;
2082     BSTR code = NULL;
2083     VARIANT v;
2084     HRESULT hres;
2085
2086     window->readystate = READYSTATE_COMPLETE;
2087     if(window->browser) {
2088         doc = window->browser->doc;
2089         IUnknown_AddRef(doc->outer_unk);
2090     }
2091     IHTMLWindow2_AddRef(&inner_window->base.IHTMLWindow2_iface);
2092
2093     hres = IUri_GetPath(task->uri, &code);
2094     if(hres != S_OK) {
2095         SysFreeString(code);
2096         goto done;
2097     }
2098
2099     hres = UrlUnescapeW(code, NULL, NULL, URL_UNESCAPE_INPLACE);
2100     if(FAILED(hres)) {
2101         SysFreeString(code);
2102         goto done;
2103     }
2104
2105     if(doc)
2106         set_download_state(doc, 1);
2107
2108     V_VT(&v) = VT_EMPTY;
2109     hres = exec_script(inner_window, code, L"jscript", &v);
2110     SysFreeString(code);
2111     if(SUCCEEDED(hres) && V_VT(&v) != VT_EMPTY) {
2112         FIXME("javascirpt URL returned %s\n", debugstr_variant(&v));
2113         VariantClear(&v);
2114     }
2115
2116     if(doc) {
2117         if(doc->view_sink)
2118             IAdviseSink_OnViewChange(doc->view_sink, DVASPECT_CONTENT, -1);
2119
2120         set_download_state(doc, 0);
2121     }
2122
2123 done:
2124     IHTMLWindow2_Release(&inner_window->base.IHTMLWindow2_iface);
2125     if(doc)
2126         IUnknown_Release(doc->outer_unk);
2127 }
2128
2129 static void navigate_javascript_task_destr(task_t *_task)
2130 {
2131     navigate_javascript_task_t *task = (navigate_javascript_task_t*)_task;
2132
2133     IUri_Release(task->uri);
2134 }
2135
2136 typedef struct {
2137     task_t header;
2138     HTMLOuterWindow *window;
2139     nsChannelBSC *bscallback;
2140     DWORD flags;
2141     IMoniker *mon;
2142     IUri *uri;
2143 } navigate_task_t;
2144
2145 static void navigate_proc(task_t *_task)
2146 {
2147     navigate_task_t *task = (navigate_task_t*)_task;
2148     HTMLOuterWindow *window = task->window;
2149     HRESULT hres;
2150
2151     IHTMLWindow2_AddRef(&window->base.IHTMLWindow2_iface);
2152
2153     hres = set_moniker(window, task->mon, task->uri, NULL, task->bscallback, TRUE);
2154     if(SUCCEEDED(hres)) {
2155         set_current_mon(window, task->bscallback->bsc.mon, task->flags);
2156         set_current_uri(window, task->uri);
2157         start_binding(window->pending_window, &task->bscallback->bsc, NULL);
2158     }
2159
2160     IHTMLWindow2_Release(&window->base.IHTMLWindow2_iface);
2161 }
2162
2163 static void navigate_task_destr(task_t *_task)
2164 {
2165     navigate_task_t *task = (navigate_task_t*)_task;
2166
2167     IBindStatusCallback_Release(&task->bscallback->bsc.IBindStatusCallback_iface);
2168     IMoniker_Release(task->mon);
2169     IUri_Release(task->uri);
2170 }
2171
2172 static HRESULT navigate_fragment(HTMLOuterWindow *window, IUri *uri)
2173 {
2174     nsIDOMLocation *nslocation;
2175     nsAString nsfrag_str;
2176     BSTR frag = NULL;
2177     WCHAR *selector;
2178     nsresult nsres;
2179     HRESULT hres;
2180     static const WCHAR selector_formatW[] = L"a[id=\"%s\"]";
2181
2182     set_current_uri(window, uri);
2183
2184     nsres = nsIDOMWindow_GetLocation(window->nswindow, &nslocation);
2185     if(FAILED(nsres) || !nslocation)
2186         return E_FAIL;
2187
2188     hres = IUri_GetFragment(uri, &frag);
2189     if(hres != S_OK) {
2190         SysFreeString(frag);
2191         nsIDOMLocation_Release(nslocation);
2192         return FAILED(hres) ? hres : S_OK;
2193     }
2194
2195     nsAString_InitDepend(&nsfrag_str, frag);
2196     nsres = nsIDOMLocation_SetHash(nslocation, &nsfrag_str);
2197     nsAString_Finish(&nsfrag_str);
2198     nsIDOMLocation_Release(nslocation);
2199     if(NS_FAILED(nsres))
2200         ERR("SetHash failed: %08lx\n", nsres);
2201
2202     /*
2203      * IE supports scrolling to anchor elements with "#hash" ids (note that '#' is part of the id),
2204      * while Gecko scrolls only to elements with "hash" ids. We scroll the page ourselves if
2205      * a[id="#hash"] element can be found.
2206      */
2207     selector = malloc(sizeof(selector_formatW) + SysStringLen(frag) * sizeof(WCHAR));
2208     if(selector) {
2209         nsIDOMElement *nselem = NULL;
2210         nsAString selector_str;
2211
2212         swprintf(selector, ARRAY_SIZE(selector_formatW)+SysStringLen(frag), selector_formatW, frag);
2213         nsAString_InitDepend(&selector_str, selector);
2214         /* NOTE: Gecko doesn't set result to NULL if there is no match, so nselem must be initialized */
2215         nsres = nsIDOMDocument_QuerySelector(window->base.inner_window->doc->dom_document, &selector_str, &nselem);
2216         nsAString_Finish(&selector_str);
2217         free(selector);
2218         if(NS_SUCCEEDED(nsres) && nselem) {
2219             nsIDOMHTMLElement *html_elem;
2220
2221             nsres = nsIDOMElement_QueryInterface(nselem, &IID_nsIDOMHTMLElement, (void**)&html_elem);
2222             nsIDOMElement_Release(nselem);
2223             if(NS_SUCCEEDED(nsres)) {
2224                 nsIDOMHTMLElement_ScrollIntoView(html_elem, TRUE, 1);
2225                 nsIDOMHTMLElement_Release(html_elem);
2226             }
2227         }
2228     }
2229
2230     SysFreeString(frag);
2231
2232     if(window->browser->doc->doc_object_service) {
2233         HTMLDocumentObj *doc_obj = window->browser->doc;
2234
2235         IUnknown_AddRef(doc_obj->outer_unk);
2236         IDocObjectService_FireNavigateComplete2(doc_obj->doc_object_service, &window->base.IHTMLWindow2_iface, 0x10);
2237         IDocObjectService_FireDocumentComplete(doc_obj->doc_object_service, &window->base.IHTMLWindow2_iface, 0);
2238         IUnknown_Release(doc_obj->outer_unk);
2239     }
2240
2241     return S_OK;
2242 }
2243
2244 HRESULT super_navigate(HTMLOuterWindow *window, IUri *uri, DWORD flags, const WCHAR *headers, BYTE *post_data, DWORD post_data_size)
2245 {
2246     HTMLDocumentObj *doc_obj;
2247     nsChannelBSC *bsc;
2248     IUri *uri_nofrag;
2249     IMoniker *mon;
2250     DWORD scheme;
2251     HRESULT hres;
2252
2253     uri_nofrag = get_uri_nofrag(uri);
2254     if(!uri_nofrag)
2255         return E_FAIL;
2256
2257     doc_obj = window->browser->doc;
2258     IUnknown_AddRef(doc_obj->outer_unk);
2259
2260     if(doc_obj->client && !(flags & BINDING_REFRESH)) {
2261         IOleCommandTarget *cmdtrg;
2262
2263         hres = IOleClientSite_QueryInterface(doc_obj->client, &IID_IOleCommandTarget, (void**)&cmdtrg);
2264         if(SUCCEEDED(hres)) {
2265             VARIANT in, out;
2266             BSTR url_str;
2267
2268             hres = IUri_GetDisplayUri(uri_nofrag, &url_str);
2269             if(SUCCEEDED(hres)) {
2270                 V_VT(&in) = VT_BSTR;
2271                 V_BSTR(&in) = url_str;
2272                 V_VT(&out) = VT_BOOL;
2273                 V_BOOL(&out) = VARIANT_TRUE;
2274                 hres = IOleCommandTarget_Exec(cmdtrg, &CGID_ShellDocView, 67, 0, &in, &out);
2275                 IOleCommandTarget_Release(cmdtrg);
2276                 if(SUCCEEDED(hres))
2277                     VariantClear(&out);
2278                 SysFreeString(url_str);
2279             }
2280         }
2281     }
2282
2283     if(!(flags & BINDING_NOFRAG) && window->uri_nofrag && !post_data_size) {
2284         BOOL eq;
2285
2286         hres = IUri_IsEqual(uri_nofrag, window->uri_nofrag, &eq);
2287         if(SUCCEEDED(hres) && eq) {
2288             IUri_Release(uri_nofrag);
2289             TRACE("fragment navigate\n");
2290             hres = navigate_fragment(window, uri);
2291             goto done;
2292         }
2293     }
2294
2295     hres = CreateURLMonikerEx2(NULL, uri_nofrag, &mon, URL_MK_UNIFORM);
2296     IUri_Release(uri_nofrag);
2297     if(FAILED(hres))
2298         goto done;
2299
2300     /* FIXME: Why not set_ready_state? */
2301     window->readystate = READYSTATE_UNINITIALIZED;
2302
2303     hres = create_channelbsc(mon, headers, post_data, post_data_size, TRUE, &bsc);
2304     if(FAILED(hres)) {
2305         IMoniker_Release(mon);
2306         goto done;
2307     }
2308
2309     prepare_for_binding(doc_obj, mon, flags);
2310
2311     hres = IUri_GetScheme(uri, &scheme);
2312     if(hres == S_OK && scheme == URL_SCHEME_JAVASCRIPT) {
2313         navigate_javascript_task_t *task;
2314
2315         IBindStatusCallback_Release(&bsc->bsc.IBindStatusCallback_iface);
2316         IMoniker_Release(mon);
2317
2318         task = malloc(sizeof(*task));
2319         if(!task) {
2320             hres = E_OUTOFMEMORY;
2321             goto done;
2322         }
2323
2324         /* Why silently? */
2325         window->readystate = READYSTATE_COMPLETE;
2326         if(!(flags & BINDING_FROMHIST))
2327             call_docview_84(doc_obj);
2328
2329         IUri_AddRef(uri);
2330         task->window = window;
2331         task->uri = uri;
2332         hres = push_task(&task->header, navigate_javascript_proc, navigate_javascript_task_destr, window->task_magic);
2333     }else if(flags & BINDING_SUBMIT) {
2334         hres = set_moniker(window, mon, uri, NULL, bsc, TRUE);
2335         if(SUCCEEDED(hres))
2336             hres = start_binding(window->pending_window, &bsc->bsc, NULL);
2337         IBindStatusCallback_Release(&bsc->bsc.IBindStatusCallback_iface);
2338         IMoniker_Release(mon);
2339     }else {
2340         navigate_task_t *task;
2341
2342         task = malloc(sizeof(*task));
2343         if(!task) {
2344             IBindStatusCallback_Release(&bsc->bsc.IBindStatusCallback_iface);
2345             IMoniker_Release(mon);
2346             hres = E_OUTOFMEMORY;
2347             goto done;
2348         }
2349
2350         /* Silently and repeated when real loading starts? */
2351         window->readystate = READYSTATE_LOADING;
2352         if(!(flags & (BINDING_FROMHIST|BINDING_REFRESH)))
2353             call_docview_84(doc_obj);
2354
2355         task->window = window;
2356         task->bscallback = bsc;
2357         task->flags = flags;
2358         task->mon = mon;
2359
2360         IUri_AddRef(uri);
2361         task->uri = uri;
2362         hres = push_task(&task->header, navigate_proc, navigate_task_destr, window->task_magic);
2363     }
2364
2365 done:
2366     IUnknown_Release(doc_obj->outer_unk);
2367     return hres;
2368 }
2369
2370 HRESULT navigate_new_window(HTMLOuterWindow *window, IUri *uri, const WCHAR *name, request_data_t *request_data, IHTMLWindow2 **ret)
2371 {
2372     INewWindowManager *new_window_mgr;
2373     BSTR display_uri, context_url;
2374     IWebBrowser2 *web_browser;
2375     IHTMLWindow2 *new_window;
2376     IBindCtx *bind_ctx;
2377     nsChannelBSC *bsc;
2378     HRESULT hres;
2379
2380     if(!window->browser)
2381         return E_UNEXPECTED;
2382
2383     if (window->browser->doc->client) {
2384         hres = do_query_service((IUnknown*)window->browser->doc->client, &SID_SNewWindowManager,
2385                                 &IID_INewWindowManager, (void**)&new_window_mgr);
2386         if (FAILED(hres)) {
2387             FIXME("No INewWindowManager\n");
2388             return hres;
2389         }
2390
2391         hres = IUri_GetDisplayUri(window->uri_nofrag, &context_url);
2392         if(FAILED(hres))
2393             return hres;
2394
2395         hres = IUri_GetDisplayUri(uri, &display_uri);
2396         if(FAILED(hres)) {
2397             SysFreeString(context_url);
2398             return hres;
2399         }
2400
2401         hres = INewWindowManager_EvaluateNewWindow(new_window_mgr, display_uri, name, context_url,
2402                 NULL, FALSE, window->browser->doc->has_popup ? 0 : NWMF_FIRST, 0);
2403         window->browser->doc->has_popup = TRUE;
2404         SysFreeString(display_uri);
2405         SysFreeString(context_url);
2406         INewWindowManager_Release(new_window_mgr);
2407         if(FAILED(hres)) {
2408             if(ret)
2409                 *ret = NULL;
2410             return S_OK;
2411         }
2412     }
2413
2414
2415     if(request_data)
2416         hres = create_channelbsc(NULL, request_data->headers,
2417                 request_data->post_data, request_data->post_data_len, FALSE,
2418                 &bsc);
2419     else
2420         hres = create_channelbsc(NULL, NULL, NULL, 0, FALSE, &bsc);
2421     if(FAILED(hres))
2422         return hres;
2423
2424     hres = CreateAsyncBindCtx(0, &bsc->bsc.IBindStatusCallback_iface, NULL, &bind_ctx);
2425     if(FAILED(hres)) {
2426         IBindStatusCallback_Release(&bsc->bsc.IBindStatusCallback_iface);
2427         return hres;
2428     }
2429
2430     hres = CoCreateInstance(&CLSID_InternetExplorer, NULL, CLSCTX_LOCAL_SERVER,
2431             &IID_IWebBrowser2, (void**)&web_browser);
2432     if(SUCCEEDED(hres)) {
2433         ITargetFramePriv2 *target_frame_priv;
2434
2435         hres = IWebBrowser2_QueryInterface(web_browser, &IID_ITargetFramePriv2, (void**)&target_frame_priv);
2436         if(SUCCEEDED(hres)) {
2437             hres = ITargetFramePriv2_AggregatedNavigation2(target_frame_priv,
2438                     HLNF_DISABLEWINDOWRESTRICTIONS|HLNF_OPENINNEWWINDOW, bind_ctx, &bsc->bsc.IBindStatusCallback_iface,
2439                     name, uri, L"");
2440             ITargetFramePriv2_Release(target_frame_priv);
2441
2442             if(SUCCEEDED(hres))
2443                 hres = do_query_service((IUnknown*)web_browser, &SID_SHTMLWindow, &IID_IHTMLWindow2, (void**)&new_window);
2444         }
2445         if(FAILED(hres)) {
2446             IWebBrowser2_Quit(web_browser);
2447             IWebBrowser2_Release(web_browser);
2448         }
2449     }else {
2450         WARN("Could not create InternetExplorer instance: %08lx\n", hres);
2451     }
2452
2453     IBindStatusCallback_Release(&bsc->bsc.IBindStatusCallback_iface);
2454     IBindCtx_Release(bind_ctx);
2455     if(FAILED(hres))
2456         return hres;
2457
2458     IWebBrowser2_put_Visible(web_browser, VARIANT_TRUE);
2459     IWebBrowser2_Release(web_browser);
2460
2461     if(ret)
2462         *ret = new_window;
2463     else
2464         IHTMLWindow2_Release(new_window);
2465     return S_OK;
2466 }
2467
2468 HRESULT hlink_frame_navigate(HTMLDocumentObj *doc, LPCWSTR url, nsChannel *nschannel, DWORD hlnf, BOOL *cancel)
2469 {
2470     IHlinkFrame *hlink_frame;
2471     nsChannelBSC *callback;
2472     IBindCtx *bindctx;
2473     IMoniker *mon;
2474     IHlink *hlink;
2475     HRESULT hres;
2476
2477     *cancel = FALSE;
2478
2479     hres = do_query_service((IUnknown*)doc->client, &IID_IHlinkFrame, &IID_IHlinkFrame,
2480             (void**)&hlink_frame);
2481     if(FAILED(hres))
2482         return S_OK;
2483
2484     hres = create_channelbsc(NULL, NULL, NULL, 0, FALSE, &callback);
2485     if(FAILED(hres)) {
2486         IHlinkFrame_Release(hlink_frame);
2487         return hres;
2488     }
2489
2490     if(nschannel)
2491         read_post_data_stream(nschannel->post_data_stream, nschannel->post_data_contains_headers,
2492                 &nschannel->request_headers, &callback->bsc.request_data);
2493
2494     hres = CreateAsyncBindCtx(0, &callback->bsc.IBindStatusCallback_iface, NULL, &bindctx);
2495     if(SUCCEEDED(hres))
2496        hres = CoCreateInstance(&CLSID_StdHlink, NULL, CLSCTX_INPROC_SERVER,
2497                 &IID_IHlink, (LPVOID*)&hlink);
2498
2499     if(SUCCEEDED(hres))
2500         hres = CreateURLMoniker(NULL, url, &mon);
2501
2502     if(SUCCEEDED(hres)) {
2503         IHlink_SetMonikerReference(hlink, HLINKSETF_TARGET, mon, NULL);
2504
2505         if(hlnf & HLNF_OPENINNEWWINDOW) {
2506             IHlink_SetTargetFrameName(hlink, L"_blank"); /* FIXME */
2507         }
2508
2509         hres = IHlinkFrame_Navigate(hlink_frame, hlnf, bindctx,
2510                 &callback->bsc.IBindStatusCallback_iface, hlink);
2511         IMoniker_Release(mon);
2512         *cancel = hres == S_OK;
2513         hres = S_OK;
2514     }
2515
2516     IHlinkFrame_Release(hlink_frame);
2517     IBindCtx_Release(bindctx);
2518     IBindStatusCallback_Release(&callback->bsc.IBindStatusCallback_iface);
2519     return hres;
2520 }
2521
2522 static HRESULT navigate_uri(HTMLOuterWindow *window, IUri *uri, const WCHAR *display_uri, const request_data_t *request_data,
2523         DWORD flags)
2524 {
2525     DWORD post_data_len = request_data ? request_data->post_data_len : 0;
2526     nsWineURI *nsuri;
2527     HRESULT hres;
2528
2529     TRACE("%s\n", debugstr_w(display_uri));
2530
2531     if(!window->browser)
2532         return E_UNEXPECTED;
2533
2534     if(window->browser->doc->webbrowser) {
2535         void *post_data = post_data_len ? request_data->post_data : NULL;
2536         const WCHAR *headers = request_data ? request_data->headers : NULL;
2537
2538         if(!(flags & BINDING_REFRESH)) {
2539             BSTR frame_name = NULL;
2540             BOOL cancel = FALSE;
2541
2542             if(!is_main_content_window(window)) {
2543                 hres = IHTMLWindow2_get_name(&window->base.IHTMLWindow2_iface, &frame_name);
2544                 if(FAILED(hres))
2545                     return hres;
2546             }
2547
2548             hres = IDocObjectService_FireBeforeNavigate2(window->browser->doc->doc_object_service, NULL, display_uri, 0x40,
2549                     frame_name, post_data, post_data_len ? post_data_len+1 : 0, headers, TRUE, &cancel);
2550             SysFreeString(frame_name);
2551             if(SUCCEEDED(hres) && cancel) {
2552                 TRACE("Navigation canceled\n");
2553                 return S_OK;
2554             }
2555         }
2556
2557         if(!window->browser)
2558             return S_OK;
2559
2560         if(is_main_content_window(window))
2561             return super_navigate(window, uri, flags, headers, post_data, post_data_len);
2562     }
2563
2564     if(!(flags & BINDING_NOFRAG) && window->uri_nofrag && !post_data_len &&
2565        compare_uri_ignoring_frag(window->uri_nofrag, uri))
2566          return navigate_fragment(window, uri);
2567
2568     if(is_main_content_window(window)) {
2569         BOOL cancel;
2570
2571         hres = hlink_frame_navigate(window->base.inner_window->doc->doc_obj, display_uri, NULL, 0, &cancel);
2572         if(FAILED(hres))
2573             return hres;
2574
2575         if(cancel) {
2576             TRACE("Navigation handled by hlink frame\n");
2577             return S_OK;
2578         }
2579     }
2580
2581     hres = create_doc_uri(uri, &nsuri);
2582     if(FAILED(hres))
2583         return hres;
2584
2585     hres = load_nsuri(window, nsuri, request_data ? request_data->post_stream : NULL, NULL,
2586                       (flags & BINDING_REFRESH) ? LOAD_FLAGS_IS_REFRESH : LOAD_FLAGS_NONE);
2587     nsISupports_Release((nsISupports*)nsuri);
2588     return hres;
2589 }
2590
2591 HRESULT load_uri(HTMLOuterWindow *window, IUri *uri, DWORD flags)
2592 {
2593     BSTR display_uri;
2594     HRESULT hres;
2595
2596     hres = IUri_GetDisplayUri(uri, &display_uri);
2597     if(FAILED(hres))
2598         return hres;
2599
2600     hres = navigate_uri(window, uri, display_uri, NULL, flags);
2601     SysFreeString(display_uri);
2602     return hres;
2603 }
2604
2605 static HRESULT translate_uri(HTMLOuterWindow *window, IUri *orig_uri, BSTR *ret_display_uri, IUri **ret_uri)
2606 {
2607     IUri *uri = NULL;
2608     BSTR display_uri;
2609     HRESULT hres;
2610
2611     hres = IUri_GetDisplayUri(orig_uri, &display_uri);
2612     if(FAILED(hres))
2613         return hres;
2614
2615     if(window->browser->doc->hostui) {
2616         OLECHAR *translated_url = NULL;
2617
2618         hres = IDocHostUIHandler_TranslateUrl(window->browser->doc->hostui, 0, display_uri,
2619                 &translated_url);
2620         if(hres == S_OK && translated_url) {
2621             TRACE("%08lx %s -> %s\n", hres, debugstr_w(display_uri), debugstr_w(translated_url));
2622             SysFreeString(display_uri);
2623             hres = create_uri(translated_url, 0, &uri);
2624             CoTaskMemFree(translated_url);
2625             if(FAILED(hres))
2626                 return hres;
2627
2628             hres = IUri_GetDisplayUri(uri, &display_uri);
2629             if(FAILED(hres)) {
2630                 IUri_Release(uri);
2631                 return hres;
2632             }
2633         }
2634     }
2635
2636     if(!uri) {
2637         IUri_AddRef(orig_uri);
2638         uri = orig_uri;
2639     }
2640
2641     *ret_display_uri = display_uri;
2642     *ret_uri = uri;
2643     return S_OK;
2644 }
2645
2646 HRESULT submit_form(HTMLOuterWindow *window, const WCHAR *target, IUri *submit_uri, nsIInputStream *post_stream)
2647 {
2648     request_data_t request_data = {NULL};
2649     HRESULT hres;
2650
2651     hres = read_post_data_stream(post_stream, TRUE, NULL, &request_data);
2652     if(FAILED(hres))
2653         return hres;
2654
2655     if(window) {
2656         IUri *uri;
2657         BSTR display_uri;
2658
2659         window->readystate_locked++;
2660
2661         hres = translate_uri(window, submit_uri, &display_uri, &uri);
2662         if(SUCCEEDED(hres)) {
2663             hres = navigate_uri(window, uri, display_uri, &request_data, BINDING_NAVIGATED|BINDING_SUBMIT);
2664             IUri_Release(uri);
2665             SysFreeString(display_uri);
2666         }
2667
2668         window->readystate_locked--;
2669     }else
2670         hres = navigate_new_window(window, submit_uri, target, &request_data, NULL);
2671
2672     release_request_data(&request_data);
2673     return hres;
2674 }
2675
2676 HRESULT navigate_url(HTMLOuterWindow *window, const WCHAR *new_url, IUri *base_uri, DWORD flags)
2677 {
2678     IUri *uri, *nav_uri;
2679     BSTR display_uri;
2680     HRESULT hres;
2681
2682     if(!window->browser)
2683         return E_UNEXPECTED;
2684
2685     if(new_url && base_uri)
2686         hres = CoInternetCombineUrlEx(base_uri, new_url, URL_ESCAPE_SPACES_ONLY|URL_DONT_ESCAPE_EXTRA_INFO,
2687                 &nav_uri, 0);
2688     else
2689         hres = create_uri(new_url, 0, &nav_uri);
2690     if(FAILED(hres))
2691         return hres;
2692     IHTMLWindow2_AddRef(&window->base.IHTMLWindow2_iface);
2693
2694     hres = translate_uri(window, nav_uri, &display_uri, &uri);
2695     IUri_Release(nav_uri);
2696     if(SUCCEEDED(hres)) {
2697         hres = navigate_uri(window, uri, display_uri, NULL, flags);
2698         IUri_Release(uri);
2699         SysFreeString(display_uri);
2700     }
2701
2702     IHTMLWindow2_Release(&window->base.IHTMLWindow2_iface);
2703     return hres;
2704 }