dlls/mshtml/navigate.c

   1 /*
   2  * Copyright 2006-2010 Jacek Caban for CodeWeavers
   3  *
   4  * This library is free software; you can redistribute it and/or
   5  * modify it under the terms of the GNU Lesser General Public
   6  * License as published by the Free Software Foundation; either
   7  * version 2.1 of the License, or (at your option) any later version.
   8  *
   9  * This library is distributed in the hope that it will be useful,
  10  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  11  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  12  * Lesser General Public License for more details.
  13  *
  14  * You should have received a copy of the GNU Lesser General Public
  15  * License along with this library; if not, write to the Free Software
  16  * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
  17  */
  18
  19 #include "config.h"
  20
  21 #include <stdarg.h>
  22 #include <assert.h>
  23
  24 #define COBJMACROS
  25 #define NONAMELESSUNION
  26
  27 #include "windef.h"
  28 #include "winbase.h"
  29 #include "winuser.h"
  30 #include "winreg.h"
  31 #include "ole2.h"
  32 #include "hlguids.h"
  33 #include "shlguid.h"
  34 #include "wininet.h"
  35 #include "shlwapi.h"
  36 #include "htiface.h"
  37 #include "shdeprecated.h"
  38
  39 #include "wine/debug.h"
  40
  41 #include "mshtml_private.h"
  42 #include "htmlscript.h"
  43 #include "binding.h"
  44
  45 WINE_DEFAULT_DEBUG_CHANNEL(mshtml);
  46
  47 #define CONTENT_LENGTH "Content-Length"
  48 #define UTF8_STR "utf-8"
  49 #define UTF16_STR "utf-16"
  50
  51 static const WCHAR emptyW[] = {0};
  52 static const WCHAR text_htmlW[] = {'t','e','x','t','/','h','t','m','l',0};
  53
  54 struct nsProtocolStream {
  55     nsIInputStream nsIInputStream_iface;
  56
  57     LONG ref;
  58
  59     char buf[1024];
  60     DWORD buf_size;
  61 };
  62
  63 static inline nsProtocolStream *impl_from_nsIInputStream(nsIInputStream *iface)
  64 {
  65     return CONTAINING_RECORD(iface, nsProtocolStream, nsIInputStream_iface);
  66 }
  67
  68 static nsresult NSAPI nsInputStream_QueryInterface(nsIInputStream *iface, nsIIDRef riid,
  69         void **result)
  70 {
  71     nsProtocolStream *This = impl_from_nsIInputStream(iface);
  72
  73     *result = NULL;
  74
  75     if(IsEqualGUID(&IID_nsISupports, riid)) {
  76         TRACE("(%p)->(IID_nsISupports %p)\n", This, result);
  77         *result  = &This->nsIInputStream_iface;
  78     }else if(IsEqualGUID(&IID_nsIInputStream, riid)) {
  79         TRACE("(%p)->(IID_nsIInputStream %p)\n", This, result);
  80         *result  = &This->nsIInputStream_iface;
  81     }
  82
  83     if(*result) {
  84         nsIInputStream_AddRef(&This->nsIInputStream_iface);
  85         return NS_OK;
  86     }
  87
  88     WARN("unsupported interface %s\n", debugstr_guid(riid));
  89     return NS_NOINTERFACE;
  90 }
  91
  92 static nsrefcnt NSAPI nsInputStream_AddRef(nsIInputStream *iface)
  93 {
  94     nsProtocolStream *This = impl_from_nsIInputStream(iface);
  95     LONG ref = InterlockedIncrement(&This->ref);
  96
  97     TRACE("(%p) ref=%d\n", This, ref);
  98
  99     return ref;
 100 }
 101
 102
 103 static nsrefcnt NSAPI nsInputStream_Release(nsIInputStream *iface)
 104 {
 105     nsProtocolStream *This = impl_from_nsIInputStream(iface);
 106     LONG ref = InterlockedDecrement(&This->ref);
 107
 108     TRACE("(%p) ref=%d\n", This, ref);
 109
 110     if(!ref)
 111         heap_free(This);
 112
 113     return ref;
 114 }
 115
 116 static nsresult NSAPI nsInputStream_Close(nsIInputStream *iface)
 117 {
 118     nsProtocolStream *This = impl_from_nsIInputStream(iface);
 119     FIXME("(%p)\n", This);
 120     return NS_ERROR_NOT_IMPLEMENTED;
 121 }
 122
 123 static nsresult NSAPI nsInputStream_Available(nsIInputStream *iface, UINT64 *_retval)
 124 {
 125     nsProtocolStream *This = impl_from_nsIInputStream(iface);
 126     FIXME("(%p)->(%p)\n", This, _retval);
 127     return NS_ERROR_NOT_IMPLEMENTED;
 128 }
 129
 130 static nsresult NSAPI nsInputStream_Read(nsIInputStream *iface, char *aBuf, UINT32 aCount,
 131                                          UINT32 *_retval)
 132 {
 133     nsProtocolStream *This = impl_from_nsIInputStream(iface);
 134     DWORD read = aCount;
 135
 136     TRACE("(%p)->(%p %d %p)\n", This, aBuf, aCount, _retval);
 137
 138     if(read > This->buf_size)
 139         read = This->buf_size;
 140
 141     if(read) {
 142         memcpy(aBuf, This->buf, read);
 143         if(read < This->buf_size)
 144             memmove(This->buf, This->buf+read, This->buf_size-read);
 145         This->buf_size -= read;
 146     }
 147
 148     *_retval = read;
 149     return NS_OK;
 150 }
 151
 152 static nsresult NSAPI nsInputStream_ReadSegments(nsIInputStream *iface,
 153         nsresult (WINAPI *aWriter)(nsIInputStream*,void*,const char*,UINT32,UINT32,UINT32*),
 154         void *aClousure, UINT32 aCount, UINT32 *_retval)
 155 {
 156     nsProtocolStream *This = impl_from_nsIInputStream(iface);
 157     UINT32 written = 0;
 158     nsresult nsres;
 159
 160     TRACE("(%p)->(%p %p %d %p)\n", This, aWriter, aClousure, aCount, _retval);
 161
 162     if(!This->buf_size)
 163         return S_OK;
 164
 165     if(aCount > This->buf_size)
 166         aCount = This->buf_size;
 167
 168     nsres = aWriter(&This->nsIInputStream_iface, aClousure, This->buf, 0, aCount, &written);
 169     if(NS_FAILED(nsres))
 170         TRACE("aWriter failed: %08x\n", nsres);
 171     else if(written != This->buf_size)
 172         FIXME("written %d != buf_size %d\n", written, This->buf_size);
 173
 174     This->buf_size -= written;
 175
 176     *_retval = written;
 177     return nsres;
 178 }
 179
 180 static nsresult NSAPI nsInputStream_IsNonBlocking(nsIInputStream *iface, cpp_bool *_retval)
 181 {
 182     nsProtocolStream *This = impl_from_nsIInputStream(iface);
 183     FIXME("(%p)->(%p)\n", This, _retval);
 184     return NS_ERROR_NOT_IMPLEMENTED;
 185 }
 186
 187 static const nsIInputStreamVtbl nsInputStreamVtbl = {
 188     nsInputStream_QueryInterface,
 189     nsInputStream_AddRef,
 190     nsInputStream_Release,
 191     nsInputStream_Close,
 192     nsInputStream_Available,
 193     nsInputStream_Read,
 194     nsInputStream_ReadSegments,
 195     nsInputStream_IsNonBlocking
 196 };
 197
 198 static nsProtocolStream *create_nsprotocol_stream(void)
 199 {
 200     nsProtocolStream *ret;
 201
 202     ret = heap_alloc(sizeof(nsProtocolStream));
 203     if(!ret)
 204         return NULL;
 205
 206     ret->nsIInputStream_iface.lpVtbl = &nsInputStreamVtbl;
 207     ret->ref = 1;
 208     ret->buf_size = 0;
 209
 210     return ret;
 211 }
 212
 213 static void release_request_data(request_data_t *request_data)
 214 {
 215     if(request_data->post_stream)
 216         nsIInputStream_Release(request_data->post_stream);
 217     heap_free(request_data->headers);
 218     if(request_data->post_data)
 219         GlobalFree(request_data->post_data);
 220 }
 221
 222 static inline BSCallback *impl_from_IBindStatusCallback(IBindStatusCallback *iface)
 223 {
 224     return CONTAINING_RECORD(iface, BSCallback, IBindStatusCallback_iface);
 225 }
 226
 227 static HRESULT WINAPI BindStatusCallback_QueryInterface(IBindStatusCallback *iface,
 228         REFIID riid, void **ppv)
 229 {
 230     BSCallback *This = impl_from_IBindStatusCallback(iface);
 231
 232     *ppv = NULL;
 233     if(IsEqualGUID(&IID_IUnknown, riid)) {
 234         TRACE("(%p)->(IID_IUnknown, %p)\n", This, ppv);
 235         *ppv = &This->IBindStatusCallback_iface;
 236     }else if(IsEqualGUID(&IID_IBindStatusCallback, riid)) {
 237         TRACE("(%p)->(IID_IBindStatusCallback, %p)\n", This, ppv);
 238         *ppv = &This->IBindStatusCallback_iface;
 239     }else if(IsEqualGUID(&IID_IServiceProvider, riid)) {
 240         TRACE("(%p)->(IID_IServiceProvider %p)\n", This, ppv);
 241         *ppv = &This->IServiceProvider_iface;
 242     }else if(IsEqualGUID(&IID_IHttpNegotiate, riid)) {
 243         TRACE("(%p)->(IID_IHttpNegotiate %p)\n", This, ppv);
 244         *ppv = &This->IHttpNegotiate2_iface;
 245     }else if(IsEqualGUID(&IID_IHttpNegotiate2, riid)) {
 246         TRACE("(%p)->(IID_IHttpNegotiate2 %p)\n", This, ppv);
 247         *ppv = &This->IHttpNegotiate2_iface;
 248     }else if(IsEqualGUID(&IID_IInternetBindInfo, riid)) {
 249         TRACE("(%p)->(IID_IInternetBindInfo %p)\n", This, ppv);
 250         *ppv = &This->IInternetBindInfo_iface;
 251     }else if(IsEqualGUID(&IID_IBindCallbackRedirect, riid)) {
 252         TRACE("(%p)->(IID_IBindCallbackRedirect %p)\n", This, ppv);
 253         *ppv = &This->IBindCallbackRedirect_iface;
 254     }
 255
 256     if(*ppv) {
 257         IBindStatusCallback_AddRef(&This->IBindStatusCallback_iface);
 258         return S_OK;
 259     }
 260
 261     TRACE("Unsupported riid = %s\n", debugstr_guid(riid));
 262     return E_NOINTERFACE;
 263 }
 264
 265 static ULONG WINAPI BindStatusCallback_AddRef(IBindStatusCallback *iface)
 266 {
 267     BSCallback *This = impl_from_IBindStatusCallback(iface);
 268     LONG ref = InterlockedIncrement(&This->ref);
 269
 270     TRACE("(%p) ref = %d\n", This, ref);
 271
 272     return ref;
 273 }
 274
 275 static ULONG WINAPI BindStatusCallback_Release(IBindStatusCallback *iface)
 276 {
 277     BSCallback *This = impl_from_IBindStatusCallback(iface);
 278     LONG ref = InterlockedDecrement(&This->ref);
 279
 280     TRACE("(%p) ref = %d\n", This, ref);
 281
 282     if(!ref) {
 283         release_request_data(&This->request_data);
 284         if(This->mon)
 285             IMoniker_Release(This->mon);
 286         if(This->binding)
 287             IBinding_Release(This->binding);
 288         list_remove(&This->entry);
 289         list_init(&This->entry);
 290
 291         This->vtbl->destroy(This);
 292     }
 293
 294     return ref;
 295 }
 296
 297 static HRESULT WINAPI BindStatusCallback_OnStartBinding(IBindStatusCallback *iface,
 298         DWORD dwReserved, IBinding *pbind)
 299 {
 300     BSCallback *This = impl_from_IBindStatusCallback(iface);
 301
 302     TRACE("(%p)->(%d %p)\n", This, dwReserved, pbind);
 303
 304     IBinding_AddRef(pbind);
 305     This->binding = pbind;
 306
 307     if(This->window)
 308         list_add_head(&This->window->bindings, &This->entry);
 309
 310     return This->vtbl->start_binding(This);
 311 }
 312
 313 static HRESULT WINAPI BindStatusCallback_GetPriority(IBindStatusCallback *iface, LONG *pnPriority)
 314 {
 315     BSCallback *This = impl_from_IBindStatusCallback(iface);
 316     FIXME("(%p)->(%p)\n", This, pnPriority);
 317     return E_NOTIMPL;
 318 }
 319
 320 static HRESULT WINAPI BindStatusCallback_OnLowResource(IBindStatusCallback *iface, DWORD reserved)
 321 {
 322     BSCallback *This = impl_from_IBindStatusCallback(iface);
 323     FIXME("(%p)->(%d)\n", This, reserved);
 324     return E_NOTIMPL;
 325 }
 326
 327 static HRESULT WINAPI BindStatusCallback_OnProgress(IBindStatusCallback *iface, ULONG ulProgress,
 328         ULONG ulProgressMax, ULONG ulStatusCode, LPCWSTR szStatusText)
 329 {
 330     BSCallback *This = impl_from_IBindStatusCallback(iface);
 331
 332     TRACE("%p)->(%u %u %u %s)\n", This, ulProgress, ulProgressMax, ulStatusCode,
 333             debugstr_w(szStatusText));
 334
 335     return This->vtbl->on_progress(This, ulStatusCode, szStatusText);
 336 }
 337
 338 static HRESULT WINAPI BindStatusCallback_OnStopBinding(IBindStatusCallback *iface,
 339         HRESULT hresult, LPCWSTR szError)
 340 {
 341     BSCallback *This = impl_from_IBindStatusCallback(iface);
 342     HRESULT hres;
 343
 344     TRACE("(%p)->(%08x %s)\n", This, hresult, debugstr_w(szError));
 345
 346     /* NOTE: IE7 calls GetBindResult here */
 347
 348     hres = This->vtbl->stop_binding(This, hresult);
 349
 350     if(This->binding) {
 351         IBinding_Release(This->binding);
 352         This->binding = NULL;
 353     }
 354
 355     if(This->mon) {
 356         IMoniker_Release(This->mon);
 357         This->mon = NULL;
 358     }
 359
 360     list_remove(&This->entry);
 361     list_init(&This->entry);
 362     This->window = NULL;
 363
 364     return hres;
 365 }
 366
 367 static HRESULT WINAPI BindStatusCallback_GetBindInfo(IBindStatusCallback *iface,
 368         DWORD *grfBINDF, BINDINFO *pbindinfo)
 369 {
 370     BSCallback *This = impl_from_IBindStatusCallback(iface);
 371     DWORD size;
 372
 373     TRACE("(%p)->(%p %p)\n", This, grfBINDF, pbindinfo);
 374
 375     if(!This->bindinfo_ready) {
 376         HRESULT hres;
 377
 378         hres = This->vtbl->init_bindinfo(This);
 379         if(FAILED(hres))
 380             return hres;
 381
 382         This->bindinfo_ready = TRUE;
 383     }
 384
 385     *grfBINDF = This->bindf;
 386
 387     size = pbindinfo->cbSize;
 388     memset(pbindinfo, 0, size);
 389     pbindinfo->cbSize = size;
 390
 391     pbindinfo->cbstgmedData = This->request_data.post_data_len;
 392     pbindinfo->dwCodePage = CP_UTF8;
 393     pbindinfo->dwOptions = This->bindinfo_options;
 394
 395     if(This->request_data.post_data_len) {
 396         pbindinfo->dwBindVerb = BINDVERB_POST;
 397
 398         pbindinfo->stgmedData.tymed = TYMED_HGLOBAL;
 399         pbindinfo->stgmedData.u.hGlobal = This->request_data.post_data;
 400         pbindinfo->stgmedData.pUnkForRelease = (IUnknown*)&This->IBindStatusCallback_iface;
 401         IBindStatusCallback_AddRef(&This->IBindStatusCallback_iface);
 402     }
 403
 404     return S_OK;
 405 }
 406
 407 static HRESULT WINAPI BindStatusCallback_OnDataAvailable(IBindStatusCallback *iface,
 408         DWORD grfBSCF, DWORD dwSize, FORMATETC *pformatetc, STGMEDIUM *pstgmed)
 409 {
 410     BSCallback *This = impl_from_IBindStatusCallback(iface);
 411
 412     TRACE("(%p)->(%08x %d %p %p)\n", This, grfBSCF, dwSize, pformatetc, pstgmed);
 413
 414     return This->vtbl->read_data(This, pstgmed->u.pstm);
 415 }
 416
 417 static HRESULT WINAPI BindStatusCallback_OnObjectAvailable(IBindStatusCallback *iface,
 418         REFIID riid, IUnknown *punk)
 419 {
 420     BSCallback *This = impl_from_IBindStatusCallback(iface);
 421     FIXME("(%p)->(%s %p)\n", This, debugstr_guid(riid), punk);
 422     return E_NOTIMPL;
 423 }
 424
 425 static const IBindStatusCallbackVtbl BindStatusCallbackVtbl = {
 426     BindStatusCallback_QueryInterface,
 427     BindStatusCallback_AddRef,
 428     BindStatusCallback_Release,
 429     BindStatusCallback_OnStartBinding,
 430     BindStatusCallback_GetPriority,
 431     BindStatusCallback_OnLowResource,
 432     BindStatusCallback_OnProgress,
 433     BindStatusCallback_OnStopBinding,
 434     BindStatusCallback_GetBindInfo,
 435     BindStatusCallback_OnDataAvailable,
 436     BindStatusCallback_OnObjectAvailable
 437 };
 438
 439 static inline BSCallback *impl_from_IHttpNegotiate2(IHttpNegotiate2 *iface)
 440 {
 441     return CONTAINING_RECORD(iface, BSCallback, IHttpNegotiate2_iface);
 442 }
 443
 444 static HRESULT WINAPI HttpNegotiate_QueryInterface(IHttpNegotiate2 *iface,
 445                                                    REFIID riid, void **ppv)
 446 {
 447     BSCallback *This = impl_from_IHttpNegotiate2(iface);
 448     return IBindStatusCallback_QueryInterface(&This->IBindStatusCallback_iface, riid, ppv);
 449 }
 450
 451 static ULONG WINAPI HttpNegotiate_AddRef(IHttpNegotiate2 *iface)
 452 {
 453     BSCallback *This = impl_from_IHttpNegotiate2(iface);
 454     return IBindStatusCallback_AddRef(&This->IBindStatusCallback_iface);
 455 }
 456
 457 static ULONG WINAPI HttpNegotiate_Release(IHttpNegotiate2 *iface)
 458 {
 459     BSCallback *This = impl_from_IHttpNegotiate2(iface);
 460     return IBindStatusCallback_Release(&This->IBindStatusCallback_iface);
 461 }
 462
 463 static HRESULT WINAPI HttpNegotiate_BeginningTransaction(IHttpNegotiate2 *iface,
 464         LPCWSTR szURL, LPCWSTR szHeaders, DWORD dwReserved, LPWSTR *pszAdditionalHeaders)
 465 {
 466     BSCallback *This = impl_from_IHttpNegotiate2(iface);
 467     HRESULT hres;
 468
 469     TRACE("(%p)->(%s %s %d %p)\n", This, debugstr_w(szURL), debugstr_w(szHeaders),
 470           dwReserved, pszAdditionalHeaders);
 471
 472     *pszAdditionalHeaders = NULL;
 473
 474     hres = This->vtbl->beginning_transaction(This, pszAdditionalHeaders);
 475     if(hres != S_FALSE)
 476         return hres;
 477
 478     if(This->request_data.headers) {
 479         DWORD size;
 480
 481         size = (strlenW(This->request_data.headers)+1)*sizeof(WCHAR);
 482         *pszAdditionalHeaders = CoTaskMemAlloc(size);
 483         if(!*pszAdditionalHeaders)
 484             return E_OUTOFMEMORY;
 485         memcpy(*pszAdditionalHeaders, This->request_data.headers, size);
 486     }
 487
 488     return S_OK;
 489 }
 490
 491 static HRESULT WINAPI HttpNegotiate_OnResponse(IHttpNegotiate2 *iface, DWORD dwResponseCode,
 492         LPCWSTR szResponseHeaders, LPCWSTR szRequestHeaders, LPWSTR *pszAdditionalRequestHeaders)
 493 {
 494     BSCallback *This = impl_from_IHttpNegotiate2(iface);
 495
 496     TRACE("(%p)->(%d %s %s %p)\n", This, dwResponseCode, debugstr_w(szResponseHeaders),
 497           debugstr_w(szRequestHeaders), pszAdditionalRequestHeaders);
 498
 499     return This->vtbl->on_response(This, dwResponseCode, szResponseHeaders);
 500 }
 501
 502 static HRESULT WINAPI HttpNegotiate_GetRootSecurityId(IHttpNegotiate2 *iface,
 503         BYTE *pbSecurityId, DWORD *pcbSecurityId, DWORD_PTR dwReserved)
 504 {
 505     BSCallback *This = impl_from_IHttpNegotiate2(iface);
 506     TRACE("(%p)->(%p %p %ld)\n", This, pbSecurityId, pcbSecurityId, dwReserved);
 507     return E_NOTIMPL; /* FIXME */
 508 }
 509
 510 static const IHttpNegotiate2Vtbl HttpNegotiate2Vtbl = {
 511     HttpNegotiate_QueryInterface,
 512     HttpNegotiate_AddRef,
 513     HttpNegotiate_Release,
 514     HttpNegotiate_BeginningTransaction,
 515     HttpNegotiate_OnResponse,
 516     HttpNegotiate_GetRootSecurityId
 517 };
 518
 519 static inline BSCallback *impl_from_IInternetBindInfo(IInternetBindInfo *iface)
 520 {
 521     return CONTAINING_RECORD(iface, BSCallback, IInternetBindInfo_iface);
 522 }
 523
 524 static HRESULT WINAPI InternetBindInfo_QueryInterface(IInternetBindInfo *iface,
 525                                                       REFIID riid, void **ppv)
 526 {
 527     BSCallback *This = impl_from_IInternetBindInfo(iface);
 528     return IBindStatusCallback_QueryInterface(&This->IBindStatusCallback_iface, riid, ppv);
 529 }
 530
 531 static ULONG WINAPI InternetBindInfo_AddRef(IInternetBindInfo *iface)
 532 {
 533     BSCallback *This = impl_from_IInternetBindInfo(iface);
 534     return IBindStatusCallback_AddRef(&This->IBindStatusCallback_iface);
 535 }
 536
 537 static ULONG WINAPI InternetBindInfo_Release(IInternetBindInfo *iface)
 538 {
 539     BSCallback *This = impl_from_IInternetBindInfo(iface);
 540     return IBindStatusCallback_Release(&This->IBindStatusCallback_iface);
 541 }
 542
 543 static HRESULT WINAPI InternetBindInfo_GetBindInfo(IInternetBindInfo *iface,
 544                                                    DWORD *grfBINDF, BINDINFO *pbindinfo)
 545 {
 546     BSCallback *This = impl_from_IInternetBindInfo(iface);
 547     FIXME("(%p)->(%p %p)\n", This, grfBINDF, pbindinfo);
 548     return E_NOTIMPL;
 549 }
 550
 551 static HRESULT WINAPI InternetBindInfo_GetBindString(IInternetBindInfo *iface,
 552         ULONG ulStringType, LPOLESTR *ppwzStr, ULONG cEl, ULONG *pcElFetched)
 553 {
 554     BSCallback *This = impl_from_IInternetBindInfo(iface);
 555     FIXME("(%p)->(%u %p %u %p)\n", This, ulStringType, ppwzStr, cEl, pcElFetched);
 556     return E_NOTIMPL;
 557 }
 558
 559 static const IInternetBindInfoVtbl InternetBindInfoVtbl = {
 560     InternetBindInfo_QueryInterface,
 561     InternetBindInfo_AddRef,
 562     InternetBindInfo_Release,
 563     InternetBindInfo_GetBindInfo,
 564     InternetBindInfo_GetBindString
 565 };
 566
 567 static inline BSCallback *impl_from_IBindCallbackRedirect(IBindCallbackRedirect *iface)
 568 {
 569     return CONTAINING_RECORD(iface, BSCallback, IBindCallbackRedirect_iface);
 570 }
 571
 572 static HRESULT WINAPI BindCallbackRedirect_QueryInterface(IBindCallbackRedirect *iface, REFIID riid, void **ppv)
 573 {
 574     BSCallback *This = impl_from_IBindCallbackRedirect(iface);
 575     return IBindStatusCallback_QueryInterface(&This->IBindStatusCallback_iface, riid, ppv);
 576 }
 577
 578 static ULONG WINAPI BindCallbackRedirect_AddRef(IBindCallbackRedirect *iface)
 579 {
 580     BSCallback *This = impl_from_IBindCallbackRedirect(iface);
 581     return IBindStatusCallback_AddRef(&This->IBindStatusCallback_iface);
 582 }
 583
 584 static ULONG WINAPI BindCallbackRedirect_Release(IBindCallbackRedirect *iface)
 585 {
 586     BSCallback *This = impl_from_IBindCallbackRedirect(iface);
 587     return IBindStatusCallback_Release(&This->IBindStatusCallback_iface);
 588 }
 589
 590 static HRESULT WINAPI BindCallbackRedirect_Redirect(IBindCallbackRedirect *iface, const WCHAR *url, VARIANT_BOOL *vbCancel)
 591 {
 592     BSCallback *This = impl_from_IBindCallbackRedirect(iface);
 593     HTMLDocumentObj *doc_obj;
 594     BOOL cancel = FALSE;
 595     BSTR frame_name = NULL;
 596     HRESULT hres = S_OK;
 597
 598     TRACE("(%p)->(%s %p)\n", This, debugstr_w(url), vbCancel);
 599
 600     if(This->window && This->window->base.outer_window && (doc_obj = This->window->base.outer_window->doc_obj)
 601        && doc_obj->doc_object_service) {
 602         if(This->window->base.outer_window != doc_obj->basedoc.window) {
 603             hres = IHTMLWindow2_get_name(&This->window->base.IHTMLWindow2_iface, &frame_name);
 604             if(FAILED(hres))
 605                 return hres;
 606         }
 607
 608         hres = IDocObjectService_FireBeforeNavigate2(doc_obj->doc_object_service, NULL, url, 0x40,
 609                                                      frame_name, NULL, 0, NULL, TRUE, &cancel);
 610         SysFreeString(frame_name);
 611     }
 612
 613     *vbCancel = cancel ? VARIANT_TRUE : VARIANT_FALSE;
 614     return hres;
 615 }
 616
 617 static const IBindCallbackRedirectVtbl BindCallbackRedirectVtbl = {
 618     BindCallbackRedirect_QueryInterface,
 619     BindCallbackRedirect_AddRef,
 620     BindCallbackRedirect_Release,
 621     BindCallbackRedirect_Redirect
 622 };
 623
 624 static inline BSCallback *impl_from_IServiceProvider(IServiceProvider *iface)
 625 {
 626     return CONTAINING_RECORD(iface, BSCallback, IServiceProvider_iface);
 627 }
 628
 629 static HRESULT WINAPI BSCServiceProvider_QueryInterface(IServiceProvider *iface,
 630                                                         REFIID riid, void **ppv)
 631 {
 632     BSCallback *This = impl_from_IServiceProvider(iface);
 633     return IBindStatusCallback_QueryInterface(&This->IBindStatusCallback_iface, riid, ppv);
 634 }
 635
 636 static ULONG WINAPI BSCServiceProvider_AddRef(IServiceProvider *iface)
 637 {
 638     BSCallback *This = impl_from_IServiceProvider(iface);
 639     return IBindStatusCallback_AddRef(&This->IBindStatusCallback_iface);
 640 }
 641
 642 static ULONG WINAPI BSCServiceProvider_Release(IServiceProvider *iface)
 643 {
 644     BSCallback *This = impl_from_IServiceProvider(iface);
 645     return IBindStatusCallback_Release(&This->IBindStatusCallback_iface);
 646 }
 647
 648 static HRESULT WINAPI BSCServiceProvider_QueryService(IServiceProvider *iface,
 649         REFGUID guidService, REFIID riid, void **ppv)
 650 {
 651     BSCallback *This = impl_from_IServiceProvider(iface);
 652
 653     TRACE("(%p)->(%s %s %p)\n", This, debugstr_guid(guidService), debugstr_guid(riid), ppv);
 654
 655     if(This->window && IsEqualGUID(guidService, &IID_IWindowForBindingUI))
 656         return IServiceProvider_QueryService(&This->window->base.IServiceProvider_iface, guidService, riid, ppv);
 657     return E_NOINTERFACE;
 658 }
 659
 660 static const IServiceProviderVtbl ServiceProviderVtbl = {
 661     BSCServiceProvider_QueryInterface,
 662     BSCServiceProvider_AddRef,
 663     BSCServiceProvider_Release,
 664     BSCServiceProvider_QueryService
 665 };
 666
 667 void init_bscallback(BSCallback *This, const BSCallbackVtbl *vtbl, IMoniker *mon, DWORD bindf)
 668 {
 669     This->IBindStatusCallback_iface.lpVtbl = &BindStatusCallbackVtbl;
 670     This->IServiceProvider_iface.lpVtbl = &ServiceProviderVtbl;
 671     This->IHttpNegotiate2_iface.lpVtbl = &HttpNegotiate2Vtbl;
 672     This->IInternetBindInfo_iface.lpVtbl = &InternetBindInfoVtbl;
 673     This->IBindCallbackRedirect_iface.lpVtbl = &BindCallbackRedirectVtbl;
 674     This->vtbl = vtbl;
 675     This->ref = 1;
 676     This->bindf = bindf;
 677     This->bindinfo_options = BINDINFO_OPTIONS_USE_IE_ENCODING;
 678     This->bom = BOM_NONE;
 679
 680     list_init(&This->entry);
 681
 682     if(mon)
 683         IMoniker_AddRef(mon);
 684     This->mon = mon;
 685 }
 686
 687 HRESULT read_stream(BSCallback *This, IStream *stream, void *buf, DWORD size, DWORD *ret_size)
 688 {
 689     DWORD read_size = 0, skip=0;
 690     BYTE *data = buf;
 691     HRESULT hres;
 692
 693     hres = IStream_Read(stream, buf, size, &read_size);
 694
 695     if(!This->readed && This->bom == BOM_NONE) {
 696         if(read_size >= 2 && data[0] == 0xff && data[1] == 0xfe) {
 697             This->bom = BOM_UTF16;
 698             skip = 2;
 699         }else if(read_size >= 3 && data[0] == 0xef && data[1] == 0xbb && data[2] == 0xbf) {
 700             This->bom = BOM_UTF8;
 701             skip = 3;
 702         }
 703         if(skip) {
 704             read_size -= skip;
 705             if(read_size)
 706                 memmove(data, data+skip, read_size);
 707         }
 708     }
 709
 710     This->readed += read_size;
 711     *ret_size = read_size;
 712     return hres;
 713 }
 714
 715 static void parse_content_type(nsChannelBSC *This, const WCHAR *value)
 716 {
 717     const WCHAR *ptr;
 718     size_t len;
 719
 720     static const WCHAR charsetW[] = {'c','h','a','r','s','e','t','='};
 721
 722     ptr = strchrW(value, ';');
 723     if(!ptr)
 724         return;
 725
 726     ptr++;
 727     while(*ptr && isspaceW(*ptr))
 728         ptr++;
 729
 730     len = strlenW(value);
 731     if(ptr + sizeof(charsetW)/sizeof(WCHAR) < value+len && !memicmpW(ptr, charsetW, sizeof(charsetW)/sizeof(WCHAR))) {
 732         size_t charset_len, lena;
 733         nsACString charset_str;
 734         const WCHAR *charset;
 735         char *charseta;
 736
 737         ptr += sizeof(charsetW)/sizeof(WCHAR);
 738
 739         if(*ptr == '\'') {
 740             FIXME("Quoted value\n");
 741             return;
 742         }else {
 743             charset = ptr;
 744             while(*ptr && *ptr != ',')
 745                 ptr++;
 746             charset_len = ptr-charset;
 747         }
 748
 749         lena = WideCharToMultiByte(CP_ACP, 0, charset, charset_len, NULL, 0, NULL, NULL);
 750         charseta = heap_alloc(lena+1);
 751         if(!charseta)
 752             return;
 753
 754         WideCharToMultiByte(CP_ACP, 0, charset, charset_len, charseta, lena, NULL, NULL);
 755         charseta[lena] = 0;
 756
 757         nsACString_InitDepend(&charset_str, charseta);
 758         nsIHttpChannel_SetContentCharset(&This->nschannel->nsIHttpChannel_iface, &charset_str);
 759         nsACString_Finish(&charset_str);
 760         heap_free(charseta);
 761     }else {
 762         FIXME("unhandled: %s\n", debugstr_wn(ptr, len - (ptr-value)));
 763     }
 764 }
 765
 766 static HRESULT parse_headers(const WCHAR *headers, struct list *headers_list)
 767 {
 768     const WCHAR *header, *header_end, *colon, *value;
 769     HRESULT hres;
 770
 771     header = headers;
 772     while(*header) {
 773         if(header[0] == '\r' && header[1] == '\n' && !header[2])
 774             break;
 775         for(colon = header; *colon && *colon != ':' && *colon != '\r'; colon++);
 776         if(*colon != ':')
 777             return E_FAIL;
 778
 779         value = colon+1;
 780         while(*value == ' ')
 781             value++;
 782         if(!*value)
 783             return E_FAIL;
 784
 785         for(header_end = value+1; *header_end && *header_end != '\r'; header_end++);
 786
 787         hres = set_http_header(headers_list, header, colon-header, value, header_end-value);
 788         if(FAILED(hres))
 789             return hres;
 790
 791         header = header_end;
 792         if(header[0] == '\r' && header[1] == '\n')
 793             header += 2;
 794     }
 795
 796     return S_OK;
 797 }
 798
 799 static HRESULT process_response_headers(nsChannelBSC *This, const WCHAR *headers)
 800 {
 801     http_header_t *iter;
 802     HRESULT hres;
 803
 804     static const WCHAR content_typeW[] = {'c','o','n','t','e','n','t','-','t','y','p','e',0};
 805
 806     hres = parse_headers(headers, &This->nschannel->response_headers);
 807     if(FAILED(hres))
 808         return hres;
 809
 810     LIST_FOR_EACH_ENTRY(iter, &This->nschannel->response_headers, http_header_t, entry) {
 811         if(!strcmpiW(iter->header, content_typeW))
 812             parse_content_type(This, iter->data);
 813     }
 814
 815     return S_OK;
 816 }
 817
 818 static void query_http_info(nsChannelBSC *This, IWinInetHttpInfo *wininet_info)
 819 {
 820     const WCHAR *ptr;
 821     DWORD len = 0;
 822     WCHAR *buf;
 823
 824     IWinInetHttpInfo_QueryInfo(wininet_info, HTTP_QUERY_RAW_HEADERS_CRLF, NULL, &len, NULL, NULL);
 825     if(!len)
 826         return;
 827
 828     buf = heap_alloc(len);
 829     if(!buf)
 830         return;
 831
 832     IWinInetHttpInfo_QueryInfo(wininet_info, HTTP_QUERY_RAW_HEADERS_CRLF, buf, &len, NULL, NULL);
 833     if(!len) {
 834         heap_free(buf);
 835         return;
 836     }
 837
 838     ptr = strchrW(buf, '\r');
 839     if(ptr && ptr[1] == '\n') {
 840         ptr += 2;
 841         process_response_headers(This, ptr);
 842     }
 843
 844     heap_free(buf);
 845 }
 846
 847 HRESULT start_binding(HTMLInnerWindow *inner_window, BSCallback *bscallback, IBindCtx *bctx)
 848 {
 849     IStream *str = NULL;
 850     HRESULT hres;
 851
 852     TRACE("(%p %p %p)\n", inner_window, bscallback, bctx);
 853
 854     bscallback->window = inner_window;
 855
 856     /* NOTE: IE7 calls IsSystemMoniker here*/
 857
 858     if(bctx) {
 859         hres = RegisterBindStatusCallback(bctx, &bscallback->IBindStatusCallback_iface, NULL, 0);
 860         if(SUCCEEDED(hres))
 861             IBindCtx_AddRef(bctx);
 862     }else {
 863         hres = CreateAsyncBindCtx(0, &bscallback->IBindStatusCallback_iface, NULL, &bctx);
 864     }
 865
 866     if(FAILED(hres)) {
 867         bscallback->window = NULL;
 868         return hres;
 869     }
 870
 871     hres = IMoniker_BindToStorage(bscallback->mon, bctx, NULL, &IID_IStream, (void**)&str);
 872     IBindCtx_Release(bctx);
 873     if(FAILED(hres)) {
 874         WARN("BindToStorage failed: %08x\n", hres);
 875         bscallback->window = NULL;
 876         return hres;
 877     }
 878
 879     if(str)
 880         IStream_Release(str);
 881
 882     return S_OK;
 883 }
 884
 885 static HRESULT read_post_data_stream(nsIInputStream *stream, BOOL contains_headers, struct list *headers_list,
 886         request_data_t *request_data)
 887 {
 888     nsISeekableStream *seekable_stream;
 889     UINT64 available = 0;
 890     UINT32 data_len = 0;
 891     char *data, *post_data;
 892     nsresult nsres;
 893     HRESULT hres = S_OK;
 894
 895     if(!stream)
 896         return S_OK;
 897
 898     nsres =  nsIInputStream_Available(stream, &available);
 899     if(NS_FAILED(nsres))
 900         return E_FAIL;
 901
 902     post_data = data = GlobalAlloc(0, available+1);
 903     if(!data)
 904         return E_OUTOFMEMORY;
 905
 906     nsres = nsIInputStream_Read(stream, data, available, &data_len);
 907     if(NS_FAILED(nsres)) {
 908         GlobalFree(data);
 909         return E_FAIL;
 910     }
 911
 912     if(contains_headers) {
 913         if(data_len >= 2 && data[0] == '\r' && data[1] == '\n') {
 914             post_data = data+2;
 915             data_len -= 2;
 916         }else {
 917             WCHAR *headers;
 918             DWORD size;
 919             char *ptr;
 920
 921             post_data += data_len;
 922             for(ptr = data; ptr+4 < data+data_len; ptr++) {
 923                 if(!memcmp(ptr, "\r\n\r\n", 4)) {
 924                     ptr += 2;
 925                     post_data = ptr+2;
 926                     break;
 927                 }
 928             }
 929
 930             data_len -= post_data-data;
 931
 932             size = MultiByteToWideChar(CP_ACP, 0, data, ptr-data, NULL, 0);
 933             headers = heap_alloc((size+1)*sizeof(WCHAR));
 934             if(headers) {
 935                 MultiByteToWideChar(CP_ACP, 0, data, ptr-data, headers, size);
 936                 headers[size] = 0;
 937                 if(headers_list)
 938                     hres = parse_headers(headers, headers_list);
 939                 if(SUCCEEDED(hres))
 940                     request_data->headers = headers;
 941                 else
 942                     heap_free(headers);
 943             }else {
 944                 hres = E_OUTOFMEMORY;
 945             }
 946         }
 947     }
 948
 949     if(FAILED(hres)) {
 950         GlobalFree(data);
 951         return hres;
 952     }
 953
 954     if(!data_len) {
 955         GlobalFree(data);
 956         post_data = NULL;
 957     }else if(post_data != data) {
 958         char *new_data;
 959
 960         new_data = GlobalAlloc(0, data_len+1);
 961         if(new_data)
 962             memcpy(new_data, post_data, data_len);
 963         GlobalFree(data);
 964         if(!new_data)
 965             return E_OUTOFMEMORY;
 966         post_data = new_data;
 967     }
 968
 969     if(post_data)
 970         post_data[data_len] = 0;
 971     request_data->post_data = post_data;
 972     request_data->post_data_len = data_len;
 973
 974     nsres = nsIInputStream_QueryInterface(stream, &IID_nsISeekableStream, (void**)&seekable_stream);
 975     assert(nsres == NS_OK);
 976
 977     nsres = nsISeekableStream_Seek(seekable_stream, NS_SEEK_SET, 0);
 978     assert(nsres == NS_OK);
 979
 980     nsISeekableStream_Release(seekable_stream);
 981
 982     nsIInputStream_AddRef(stream);
 983     request_data->post_stream = stream;
 984     TRACE("post_data = %s\n", debugstr_an(request_data->post_data, request_data->post_data_len));
 985     return S_OK;
 986 }
 987
 988 static HRESULT on_start_nsrequest(nsChannelBSC *This)
 989 {
 990     nsresult nsres;
 991
 992     This->nschannel->binding = This;
 993
 994     /* FIXME: it's needed for http connections from BindToObject. */
 995     if(!This->nschannel->response_status)
 996         This->nschannel->response_status = 200;
 997
 998     nsres = nsIStreamListener_OnStartRequest(This->nslistener,
 999             (nsIRequest*)&This->nschannel->nsIHttpChannel_iface, This->nscontext);
1000     if(NS_FAILED(nsres)) {
1001         FIXME("OnStartRequest failed: %08x\n", nsres);
1002         return E_FAIL;
1003     }
1004
1005     if(This->is_doc_channel) {
1006         if(!This->bsc.window)
1007             return E_ABORT; /* Binding aborted in OnStartRequest call. */
1008         update_window_doc(This->bsc.window);
1009         if(This->bsc.window->base.outer_window->readystate != READYSTATE_LOADING)
1010             set_ready_state(This->bsc.window->base.outer_window, READYSTATE_LOADING);
1011     }
1012
1013     return S_OK;
1014 }
1015
1016 static void on_stop_nsrequest(nsChannelBSC *This, HRESULT result)
1017 {
1018     nsresult nsres, request_result;
1019
1020     switch(result) {
1021     case S_OK:
1022         request_result = NS_OK;
1023         break;
1024     case E_ABORT:
1025         request_result = NS_BINDING_ABORTED;
1026         break;
1027     default:
1028         request_result = NS_ERROR_FAILURE;
1029     }
1030
1031     if(This->nslistener) {
1032         nsres = nsIStreamListener_OnStopRequest(This->nslistener,
1033                  (nsIRequest*)&This->nschannel->nsIHttpChannel_iface, This->nscontext,
1034                  request_result);
1035         if(NS_FAILED(nsres))
1036             WARN("OnStopRequest failed: %08x\n", nsres);
1037     }
1038
1039     if(This->nschannel) {
1040         if(This->nschannel->load_group) {
1041             nsres = nsILoadGroup_RemoveRequest(This->nschannel->load_group,
1042                     (nsIRequest*)&This->nschannel->nsIHttpChannel_iface, NULL, request_result);
1043             if(NS_FAILED(nsres))
1044                 ERR("RemoveRequest failed: %08x\n", nsres);
1045         }
1046         if(This->nschannel->binding == This)
1047             This->nschannel->binding = NULL;
1048     }
1049 }
1050
1051 static HRESULT read_stream_data(nsChannelBSC *This, IStream *stream)
1052 {
1053     DWORD read;
1054     nsresult nsres;
1055     HRESULT hres;
1056
1057     if(!This->response_processed) {
1058         IWinInetHttpInfo *wininet_info;
1059
1060         This->response_processed = TRUE;
1061         if(This->bsc.binding) {
1062             hres = IBinding_QueryInterface(This->bsc.binding, &IID_IWinInetHttpInfo, (void**)&wininet_info);
1063             if(SUCCEEDED(hres)) {
1064                 query_http_info(This, wininet_info);
1065                 IWinInetHttpInfo_Release(wininet_info);
1066             }
1067         }
1068     }
1069
1070     if(!This->nschannel)
1071         return S_OK;
1072
1073     if(!This->nslistener) {
1074         BYTE buf[1024];
1075
1076         do {
1077             hres = read_stream(&This->bsc, stream, buf, sizeof(buf), &read);
1078         }while(hres == S_OK && read);
1079
1080         return S_OK;
1081     }
1082
1083     if(!This->nsstream) {
1084         This->nsstream = create_nsprotocol_stream();
1085         if(!This->nsstream)
1086             return E_OUTOFMEMORY;
1087     }
1088
1089     do {
1090         BOOL first_read = !This->bsc.readed;
1091
1092         hres = read_stream(&This->bsc, stream, This->nsstream->buf+This->nsstream->buf_size,
1093                 sizeof(This->nsstream->buf)-This->nsstream->buf_size, &read);
1094         if(!read)
1095             break;
1096
1097         This->nsstream->buf_size += read;
1098
1099         if(first_read) {
1100             switch(This->bsc.bom) {
1101             case BOM_UTF8:
1102                 This->nschannel->charset = heap_strdupA(UTF8_STR);
1103                 break;
1104             case BOM_UTF16:
1105                 This->nschannel->charset = heap_strdupA(UTF16_STR);
1106             case BOM_NONE:
1107                 /* FIXME: Get charset from HTTP headers */;
1108             }
1109
1110             if(!This->nschannel->content_type) {
1111                 WCHAR *mime;
1112
1113                 hres = FindMimeFromData(NULL, NULL, This->nsstream->buf, This->nsstream->buf_size,
1114                         This->is_doc_channel ? text_htmlW : NULL, 0, &mime, 0);
1115                 if(FAILED(hres))
1116                     return hres;
1117
1118                 TRACE("Found MIME %s\n", debugstr_w(mime));
1119
1120                 This->nschannel->content_type = heap_strdupWtoA(mime);
1121                 CoTaskMemFree(mime);
1122                 if(!This->nschannel->content_type)
1123                     return E_OUTOFMEMORY;
1124             }
1125
1126             hres = on_start_nsrequest(This);
1127             if(FAILED(hres))
1128                 return hres;
1129         }
1130
1131         nsres = nsIStreamListener_OnDataAvailable(This->nslistener,
1132                 (nsIRequest*)&This->nschannel->nsIHttpChannel_iface, This->nscontext,
1133                 &This->nsstream->nsIInputStream_iface, This->bsc.readed-This->nsstream->buf_size,
1134                 This->nsstream->buf_size);
1135         if(NS_FAILED(nsres))
1136             ERR("OnDataAvailable failed: %08x\n", nsres);
1137
1138         if(This->nsstream->buf_size == sizeof(This->nsstream->buf)) {
1139             ERR("buffer is full\n");
1140             break;
1141         }
1142     }while(hres == S_OK);
1143
1144     return S_OK;
1145 }
1146
1147 typedef struct {
1148     nsIAsyncVerifyRedirectCallback nsIAsyncVerifyRedirectCallback_iface;
1149
1150     LONG ref;
1151
1152     nsChannel *nschannel;
1153     nsChannelBSC *bsc;
1154 } nsRedirectCallback;
1155
1156 static nsRedirectCallback *impl_from_nsIAsyncVerifyRedirectCallback(nsIAsyncVerifyRedirectCallback *iface)
1157 {
1158     return CONTAINING_RECORD(iface, nsRedirectCallback, nsIAsyncVerifyRedirectCallback_iface);
1159 }
1160
1161 static nsresult NSAPI nsAsyncVerifyRedirectCallback_QueryInterface(nsIAsyncVerifyRedirectCallback *iface,
1162         nsIIDRef riid, void **result)
1163 {
1164     nsRedirectCallback *This = impl_from_nsIAsyncVerifyRedirectCallback(iface);
1165
1166     if(IsEqualGUID(&IID_nsISupports, riid)) {
1167         TRACE("(%p)->(IID_nsISupports %p)\n", This, result);
1168         *result = &This->nsIAsyncVerifyRedirectCallback_iface;
1169     }else if(IsEqualGUID(&IID_nsIAsyncVerifyRedirectCallback, riid)) {
1170         TRACE("(%p)->(IID_nsIAsyncVerifyRedirectCallback %p)\n", This, result);
1171         *result = &This->nsIAsyncVerifyRedirectCallback_iface;
1172     }else {
1173         *result = NULL;
1174         WARN("unimplemented iface %s\n", debugstr_guid(riid));
1175         return NS_NOINTERFACE;
1176     }
1177
1178     nsISupports_AddRef((nsISupports*)*result);
1179     return NS_OK;
1180 }
1181
1182 static nsrefcnt NSAPI nsAsyncVerifyRedirectCallback_AddRef(nsIAsyncVerifyRedirectCallback *iface)
1183 {
1184     nsRedirectCallback *This = impl_from_nsIAsyncVerifyRedirectCallback(iface);
1185     LONG ref = InterlockedIncrement(&This->ref);
1186
1187     TRACE("(%p) ref=%d\n", This, ref);
1188
1189     return ref;
1190 }
1191
1192 static nsrefcnt NSAPI nsAsyncVerifyRedirectCallback_Release(nsIAsyncVerifyRedirectCallback *iface)
1193 {
1194     nsRedirectCallback *This = impl_from_nsIAsyncVerifyRedirectCallback(iface);
1195     LONG ref = InterlockedDecrement(&This->ref);
1196
1197     TRACE("(%p) ref=%d\n", This, ref);
1198
1199     if(!ref) {
1200         IBindStatusCallback_Release(&This->bsc->bsc.IBindStatusCallback_iface);
1201         nsIHttpChannel_Release(&This->nschannel->nsIHttpChannel_iface);
1202         heap_free(This);
1203     }
1204
1205     return ref;
1206 }
1207
1208 static nsresult NSAPI nsAsyncVerifyRedirectCallback_OnRedirectVerifyCallback(nsIAsyncVerifyRedirectCallback *iface, nsresult result)
1209 {
1210     nsRedirectCallback *This = impl_from_nsIAsyncVerifyRedirectCallback(iface);
1211     nsChannel *old_nschannel;
1212     nsresult nsres;
1213
1214     TRACE("(%p)->(%08x)\n", This, result);
1215
1216     old_nschannel = This->bsc->nschannel;
1217     nsIHttpChannel_AddRef(&This->nschannel->nsIHttpChannel_iface);
1218     This->bsc->nschannel = This->nschannel;
1219
1220     if(This->nschannel->load_group) {
1221         nsres = nsILoadGroup_AddRequest(This->nschannel->load_group, (nsIRequest*)&This->nschannel->nsIHttpChannel_iface,
1222                 NULL);
1223         if(NS_FAILED(nsres))
1224             ERR("AddRequest failed: %08x\n", nsres);
1225     }
1226
1227     if(This->bsc->is_doc_channel) {
1228         IUri *uri = nsuri_get_uri(This->nschannel->uri);
1229
1230         if(uri) {
1231             set_current_uri(This->bsc->bsc.window->base.outer_window, uri);
1232             IUri_Release(uri);
1233         }else {
1234             WARN("Could not get IUri from nsWineURI\n");
1235         }
1236     }
1237
1238     if(old_nschannel) {
1239         if(old_nschannel->load_group) {
1240             nsres = nsILoadGroup_RemoveRequest(old_nschannel->load_group,
1241                     (nsIRequest*)&old_nschannel->nsIHttpChannel_iface, NULL, NS_OK);
1242             if(NS_FAILED(nsres))
1243                 ERR("RemoveRequest failed: %08x\n", nsres);
1244         }
1245         nsIHttpChannel_Release(&old_nschannel->nsIHttpChannel_iface);
1246     }
1247
1248     return NS_OK;
1249 }
1250
1251 static const nsIAsyncVerifyRedirectCallbackVtbl nsAsyncVerifyRedirectCallbackVtbl = {
1252     nsAsyncVerifyRedirectCallback_QueryInterface,
1253     nsAsyncVerifyRedirectCallback_AddRef,
1254     nsAsyncVerifyRedirectCallback_Release,
1255     nsAsyncVerifyRedirectCallback_OnRedirectVerifyCallback
1256 };
1257
1258 static HRESULT create_redirect_callback(nsChannel *nschannel, nsChannelBSC *bsc, nsRedirectCallback **ret)
1259 {
1260     nsRedirectCallback *callback;
1261
1262     callback = heap_alloc(sizeof(*callback));
1263     if(!callback)
1264         return E_OUTOFMEMORY;
1265
1266     callback->nsIAsyncVerifyRedirectCallback_iface.lpVtbl = &nsAsyncVerifyRedirectCallbackVtbl;
1267     callback->ref = 1;
1268
1269     nsIHttpChannel_AddRef(&nschannel->nsIHttpChannel_iface);
1270     callback->nschannel = nschannel;
1271
1272     IBindStatusCallback_AddRef(&bsc->bsc.IBindStatusCallback_iface);
1273     callback->bsc = bsc;
1274
1275     *ret = callback;
1276     return S_OK;
1277 }
1278
1279 static inline nsChannelBSC *nsChannelBSC_from_BSCallback(BSCallback *iface)
1280 {
1281     return CONTAINING_RECORD(iface, nsChannelBSC, bsc);
1282 }
1283
1284 static void nsChannelBSC_destroy(BSCallback *bsc)
1285 {
1286     nsChannelBSC *This = nsChannelBSC_from_BSCallback(bsc);
1287
1288     if(This->nschannel) {
1289         if(This->nschannel->binding == This)
1290             This->nschannel->binding = NULL;
1291         nsIHttpChannel_Release(&This->nschannel->nsIHttpChannel_iface);
1292     }
1293     if(This->nslistener)
1294         nsIStreamListener_Release(This->nslistener);
1295     if(This->nscontext)
1296         nsISupports_Release(This->nscontext);
1297     if(This->nsstream)
1298         nsIInputStream_Release(&This->nsstream->nsIInputStream_iface);
1299     heap_free(This);
1300 }
1301
1302 static HRESULT nsChannelBSC_start_binding(BSCallback *bsc)
1303 {
1304     nsChannelBSC *This = nsChannelBSC_from_BSCallback(bsc);
1305
1306     if(This->is_doc_channel)
1307         This->bsc.window->base.outer_window->base.inner_window->doc->skip_mutation_notif = FALSE;
1308
1309     return S_OK;
1310 }
1311
1312 static HRESULT nsChannelBSC_init_bindinfo(BSCallback *bsc)
1313 {
1314     nsChannelBSC *This = nsChannelBSC_from_BSCallback(bsc);
1315     nsChannel *nschannel = This->nschannel;
1316     HTMLDocumentObj *doc_obj;
1317     HRESULT hres;
1318
1319     if(This->is_doc_channel && This->bsc.window && This->bsc.window->base.outer_window
1320        && (doc_obj = This->bsc.window->base.outer_window->doc_obj)) {
1321         if(doc_obj->hostinfo.dwFlags & DOCHOSTUIFLAG_ENABLE_REDIRECT_NOTIFICATION)
1322             This->bsc.bindinfo_options |= BINDINFO_OPTIONS_DISABLEAUTOREDIRECTS;
1323     }
1324
1325     if(nschannel && nschannel->post_data_stream) {
1326         hres = read_post_data_stream(nschannel->post_data_stream, nschannel->post_data_contains_headers,
1327                 &nschannel->request_headers, &This->bsc.request_data);
1328         if(FAILED(hres))
1329             return hres;
1330     }
1331
1332     return S_OK;
1333 }
1334
1335 typedef struct {
1336     task_t header;
1337     nsChannelBSC *bsc;
1338 } stop_request_task_t;
1339
1340 static void stop_request_proc(task_t *_task)
1341 {
1342     stop_request_task_t *task = (stop_request_task_t*)_task;
1343
1344     TRACE("(%p)\n", task->bsc);
1345
1346     list_remove(&task->bsc->bsc.entry);
1347     list_init(&task->bsc->bsc.entry);
1348     on_stop_nsrequest(task->bsc, S_OK);
1349 }
1350
1351 static void stop_request_task_destr(task_t *_task)
1352 {
1353     stop_request_task_t *task = (stop_request_task_t*)_task;
1354
1355     IBindStatusCallback_Release(&task->bsc->bsc.IBindStatusCallback_iface);
1356     heap_free(task);
1357 }
1358
1359 static HRESULT async_stop_request(nsChannelBSC *This)
1360 {
1361     stop_request_task_t *task;
1362
1363     if(!This->bsc.readed) {
1364         TRACE("No data read, calling OnStartRequest\n");
1365         on_start_nsrequest(This);
1366     }
1367
1368     task = heap_alloc(sizeof(*task));
1369     if(!task)
1370         return E_OUTOFMEMORY;
1371
1372     IBindStatusCallback_AddRef(&This->bsc.IBindStatusCallback_iface);
1373     task->bsc = This;
1374
1375     return push_task(&task->header, stop_request_proc, stop_request_task_destr, This->bsc.window->task_magic);
1376 }
1377
1378 static void handle_navigation_error(nsChannelBSC *This, DWORD result)
1379 {
1380     HTMLOuterWindow *outer_window;
1381     HTMLDocumentObj *doc;
1382     BOOL is_error_url;
1383     SAFEARRAY *sa;
1384     SAFEARRAYBOUND bound;
1385     VARIANT var, varOut;
1386     LONG ind;
1387     BSTR unk;
1388     HRESULT hres;
1389
1390     if(!This->is_doc_channel || !This->bsc.window)
1391         return;
1392
1393     outer_window = This->bsc.window->base.outer_window;
1394
1395     doc = outer_window->doc_obj;
1396     if(!doc || !doc->doc_object_service || !doc->client)
1397         return;
1398
1399     hres = IDocObjectService_IsErrorUrl(doc->doc_object_service,
1400             outer_window->url, &is_error_url);
1401     if(FAILED(hres) || is_error_url)
1402         return;
1403
1404     if(!doc->client_cmdtrg)
1405         return;
1406
1407     bound.lLbound = 0;
1408     bound.cElements = 8;
1409     sa = SafeArrayCreate(VT_VARIANT, 1, &bound);
1410     if(!sa)
1411         return;
1412
1413     ind = 0;
1414     V_VT(&var) = VT_I4;
1415     V_I4(&var) = result;
1416     SafeArrayPutElement(sa, &ind, &var);
1417
1418     ind = 1;
1419     V_VT(&var) = VT_BSTR;
1420     V_BSTR(&var) = outer_window->url;
1421     SafeArrayPutElement(sa, &ind, &var);
1422
1423     ind = 3;
1424     V_VT(&var) = VT_UNKNOWN;
1425     V_UNKNOWN(&var) = (IUnknown*)&outer_window->base.IHTMLWindow2_iface;
1426     SafeArrayPutElement(sa, &ind, &var);
1427
1428     /* FIXME: what are the following fields for? */
1429     ind = 2;
1430     V_VT(&var) = VT_UNKNOWN;
1431     V_UNKNOWN(&var) = NULL;
1432     SafeArrayPutElement(sa, &ind, &var);
1433
1434     ind = 4;
1435     V_VT(&var) = VT_BOOL;
1436     V_BOOL(&var) = FALSE;
1437     SafeArrayPutElement(sa, &ind, &var);
1438
1439     ind = 5;
1440     V_VT(&var) = VT_BOOL;
1441     V_BOOL(&var) = FALSE;
1442     SafeArrayPutElement(sa, &ind, &var);
1443
1444     ind = 6;
1445     V_VT(&var) = VT_BSTR;
1446     unk = SysAllocString(NULL);
1447     V_BSTR(&var) = unk;
1448     SafeArrayPutElement(sa, &ind, &var);
1449
1450     ind = 7;
1451     V_VT(&var) = VT_UNKNOWN;
1452     V_UNKNOWN(&var) = NULL;
1453     SafeArrayPutElement(sa, &ind, &var);
1454
1455     V_VT(&var) = VT_ARRAY;
1456     V_ARRAY(&var) = sa;
1457     V_VT(&varOut) = VT_BOOL;
1458     V_BOOL(&varOut) = VARIANT_TRUE;
1459     IOleCommandTarget_Exec(doc->client_cmdtrg, &CGID_DocHostCmdPriv, 1, 0, &var, FAILED(hres)?NULL:&varOut);
1460
1461     SysFreeString(unk);
1462     SafeArrayDestroy(sa);
1463 }
1464
1465 static HRESULT nsChannelBSC_stop_binding(BSCallback *bsc, HRESULT result)
1466 {
1467     nsChannelBSC *This = nsChannelBSC_from_BSCallback(bsc);
1468
1469     if(result != E_ABORT && This->is_doc_channel && This->bsc.window) {
1470         if(FAILED(result))
1471             handle_navigation_error(This, result);
1472         else if(This->nschannel) {
1473             result = async_stop_request(This);
1474             if(SUCCEEDED(result))
1475                 return S_OK;
1476         }
1477     }
1478
1479     on_stop_nsrequest(This, result);
1480     return S_OK;
1481 }
1482
1483 static HRESULT nsChannelBSC_read_data(BSCallback *bsc, IStream *stream)
1484 {
1485     nsChannelBSC *This = nsChannelBSC_from_BSCallback(bsc);
1486
1487     return read_stream_data(This, stream);
1488 }
1489
1490 static HRESULT handle_redirect(nsChannelBSC *This, const WCHAR *new_url)
1491 {
1492     nsRedirectCallback *callback;
1493     nsIChannelEventSink *sink;
1494     nsChannel *new_channel;
1495     IMoniker *mon;
1496     nsresult nsres;
1497     HRESULT hres;
1498
1499     TRACE("(%p)->(%s)\n", This, debugstr_w(new_url));
1500
1501     hres = CreateURLMoniker(NULL, new_url, &mon);
1502     if(FAILED(hres))
1503         return hres;
1504     IMoniker_Release(This->bsc.mon);
1505     This->bsc.mon = mon;
1506
1507     if(!This->nschannel || !This->nschannel->notif_callback)
1508         return S_OK;
1509
1510     nsres = nsIInterfaceRequestor_GetInterface(This->nschannel->notif_callback, &IID_nsIChannelEventSink, (void**)&sink);
1511     if(NS_FAILED(nsres))
1512         return S_OK;
1513
1514     hres = create_redirect_nschannel(new_url, This->nschannel, &new_channel);
1515     if(SUCCEEDED(hres)) {
1516         TRACE("%p %p->%p\n", This, This->nschannel, new_channel);
1517
1518         hres = create_redirect_callback(new_channel, This, &callback);
1519         nsIHttpChannel_Release(&new_channel->nsIHttpChannel_iface);
1520     }
1521
1522     if(SUCCEEDED(hres)) {
1523         nsres = nsIChannelEventSink_AsyncOnChannelRedirect(sink, (nsIChannel*)&This->nschannel->nsIHttpChannel_iface,
1524                 (nsIChannel*)&callback->nschannel->nsIHttpChannel_iface, REDIRECT_TEMPORARY, /* FIXME */
1525                 &callback->nsIAsyncVerifyRedirectCallback_iface);
1526
1527         if(NS_FAILED(nsres))
1528             FIXME("AsyncOnChannelRedirect failed: %08x\n", hres);
1529         else if(This->nschannel != callback->nschannel)
1530             FIXME("nschannel not updated\n");
1531
1532         nsIAsyncVerifyRedirectCallback_Release(&callback->nsIAsyncVerifyRedirectCallback_iface);
1533     }
1534
1535     nsIChannelEventSink_Release(sink);
1536     return hres;
1537 }
1538
1539 static BOOL is_supported_doc_mime(const WCHAR *mime)
1540 {
1541     char *nscat, *mimea;
1542     BOOL ret;
1543
1544     mimea = heap_strdupWtoA(mime);
1545     if(!mimea)
1546         return FALSE;
1547
1548     nscat = get_nscategory_entry("Gecko-Content-Viewers", mimea);
1549
1550     ret = nscat != NULL && !strcmp(nscat, "@mozilla.org/content/document-loader-factory;1");
1551
1552     heap_free(mimea);
1553     nsfree(nscat);
1554     return ret;
1555 }
1556
1557 static IUri *get_moniker_uri(IMoniker *mon)
1558 {
1559     IUriContainer *uri_container;
1560     IUri *ret = NULL;
1561     HRESULT hres;
1562
1563     hres = IMoniker_QueryInterface(mon, &IID_IUriContainer, (void**)&uri_container);
1564     if(SUCCEEDED(hres)) {
1565         hres = IUriContainer_GetIUri(uri_container, &ret);
1566         IUriContainer_Release(uri_container);
1567         if(FAILED(hres))
1568             return NULL;
1569     }else {
1570         FIXME("No IUriContainer\n");
1571     }
1572
1573     return ret;
1574 }
1575
1576 static void handle_extern_mime_navigation(nsChannelBSC *This)
1577 {
1578     IWebBrowserPriv2IE9 *webbrowser_priv;
1579     IOleCommandTarget *cmdtrg;
1580     HTMLDocumentObj *doc_obj;
1581     IBindCtx *bind_ctx;
1582     IUri *uri;
1583     VARIANT flags;
1584     HRESULT hres;
1585
1586     if(!This->bsc.window || !This->bsc.window->base.outer_window || !This->bsc.window->base.outer_window->doc_obj)
1587         return;
1588
1589     doc_obj = This->bsc.window->base.outer_window->doc_obj;
1590
1591     hres = IOleClientSite_QueryInterface(doc_obj->client, &IID_IOleCommandTarget, (void**)&cmdtrg);
1592     if(SUCCEEDED(hres)) {
1593         IOleCommandTarget_Exec(cmdtrg, &CGID_ShellDocView, 62, 0, NULL, NULL);
1594         IOleCommandTarget_Release(cmdtrg);
1595     }
1596
1597     set_document_navigation(doc_obj, FALSE);
1598
1599     if(!doc_obj->webbrowser) {
1600         FIXME("unimplemented in non-webbrowser mode\n");
1601         return;
1602     }
1603
1604     uri = get_moniker_uri(This->bsc.mon);
1605     if(!uri)
1606         return;
1607
1608     hres = CreateBindCtx(0, &bind_ctx);
1609     if(FAILED(hres)) {
1610         IUri_Release(uri);
1611         return;
1612     }
1613
1614     V_VT(&flags) = VT_I4;
1615     V_I4(&flags) = navHyperlink;
1616
1617     hres = IUnknown_QueryInterface(doc_obj->webbrowser, &IID_IWebBrowserPriv2IE8, (void**)&webbrowser_priv);
1618     if(SUCCEEDED(hres)) {
1619         hres = IWebBrowserPriv2IE9_NavigateWithBindCtx2(webbrowser_priv, uri, &flags, NULL, NULL, NULL, bind_ctx, NULL, 0);
1620         IWebBrowserPriv2IE9_Release(webbrowser_priv);
1621     }else {
1622         IWebBrowserPriv *webbrowser_priv_old;
1623         VARIANT uriv;
1624
1625         hres = IUnknown_QueryInterface(doc_obj->webbrowser, &IID_IWebBrowserPriv, (void**)&webbrowser_priv_old);
1626         if(SUCCEEDED(hres)) {
1627             V_VT(&uriv) = VT_BSTR;
1628             IUri_GetDisplayUri(uri, &V_BSTR(&uriv));
1629
1630             hres = IWebBrowserPriv_NavigateWithBindCtx(webbrowser_priv_old, &uriv, &flags, NULL, NULL, NULL, bind_ctx, NULL);
1631
1632             SysFreeString(V_BSTR(&uriv));
1633             IWebBrowserPriv_Release(webbrowser_priv_old);
1634         }
1635     }
1636
1637     IUri_Release(uri);
1638 }
1639
1640 static HRESULT nsChannelBSC_on_progress(BSCallback *bsc, ULONG status_code, LPCWSTR status_text)
1641 {
1642     nsChannelBSC *This = nsChannelBSC_from_BSCallback(bsc);
1643
1644     switch(status_code) {
1645     case BINDSTATUS_MIMETYPEAVAILABLE:
1646         if(This->is_doc_channel && !is_supported_doc_mime(status_text)) {
1647             FIXME("External MIME: %s\n", debugstr_w(status_text));
1648
1649             handle_extern_mime_navigation(This);
1650
1651             This->nschannel = NULL;
1652         }
1653
1654         if(!This->nschannel)
1655             return S_OK;
1656
1657         heap_free(This->nschannel->content_type);
1658         This->nschannel->content_type = heap_strdupWtoA(status_text);
1659         break;
1660     case BINDSTATUS_REDIRECTING:
1661         return handle_redirect(This, status_text);
1662     case BINDSTATUS_BEGINDOWNLOADDATA: {
1663         IWinInetHttpInfo *http_info;
1664         DWORD status, size = sizeof(DWORD);
1665         HRESULT hres;
1666
1667         if(!This->bsc.binding)
1668             break;
1669
1670         hres = IBinding_QueryInterface(This->bsc.binding, &IID_IWinInetHttpInfo, (void**)&http_info);
1671         if(FAILED(hres))
1672             break;
1673
1674         hres = IWinInetHttpInfo_QueryInfo(http_info,
1675                 HTTP_QUERY_STATUS_CODE|HTTP_QUERY_FLAG_NUMBER, &status, &size, NULL, NULL);
1676         IWinInetHttpInfo_Release(http_info);
1677         if(FAILED(hres) || status == HTTP_STATUS_OK)
1678             break;
1679
1680         handle_navigation_error(This, status);
1681     }
1682     }
1683
1684     return S_OK;
1685 }
1686
1687 static HRESULT process_response_status_text(const WCHAR *header, const WCHAR *header_end, char **status_text)
1688 {
1689     header = strchrW(header + 1, ' ');
1690     if(!header || header >= header_end)
1691         return E_FAIL;
1692     header = strchrW(header + 1, ' ');
1693     if(!header || header >= header_end)
1694         return E_FAIL;
1695     ++header;
1696
1697     *status_text = heap_strndupWtoU(header, header_end - header);
1698
1699     if(!*status_text)
1700         return E_OUTOFMEMORY;
1701
1702     return S_OK;
1703 }
1704
1705 static HRESULT nsChannelBSC_on_response(BSCallback *bsc, DWORD response_code,
1706         LPCWSTR response_headers)
1707 {
1708     nsChannelBSC *This = nsChannelBSC_from_BSCallback(bsc);
1709     char *str;
1710     HRESULT hres;
1711
1712     This->response_processed = TRUE;
1713     This->nschannel->response_status = response_code;
1714
1715     if(response_headers) {
1716         const WCHAR *headers;
1717
1718         headers = strchrW(response_headers, '\r');
1719         hres = process_response_status_text(response_headers, headers, &str);
1720         if(FAILED(hres)) {
1721             WARN("parsing headers failed: %08x\n", hres);
1722             return hres;
1723         }
1724
1725         heap_free(This->nschannel->response_status_text);
1726         This->nschannel->response_status_text = str;
1727
1728         if(headers && headers[1] == '\n') {
1729             headers += 2;
1730             hres = process_response_headers(This, headers);
1731             if(FAILED(hres)) {
1732                 WARN("parsing headers failed: %08x\n", hres);
1733                 return hres;
1734             }
1735         }
1736     }
1737
1738     return S_OK;
1739 }
1740
1741 static HRESULT nsChannelBSC_beginning_transaction(BSCallback *bsc, WCHAR **additional_headers)
1742 {
1743     nsChannelBSC *This = nsChannelBSC_from_BSCallback(bsc);
1744     http_header_t *iter;
1745     DWORD len = 0;
1746     WCHAR *ptr;
1747
1748     static const WCHAR content_lengthW[] =
1749         {'C','o','n','t','e','n','t','-','L','e','n','g','t','h',0};
1750
1751     if(!This->nschannel)
1752         return S_FALSE;
1753
1754     LIST_FOR_EACH_ENTRY(iter, &This->nschannel->request_headers, http_header_t, entry) {
1755         if(strcmpW(iter->header, content_lengthW))
1756             len += strlenW(iter->header) + 2 /* ": " */ + strlenW(iter->data) + 2 /* "\r\n" */;
1757     }
1758
1759     if(!len)
1760         return S_OK;
1761
1762     *additional_headers = ptr = CoTaskMemAlloc((len+1)*sizeof(WCHAR));
1763     if(!ptr)
1764         return E_OUTOFMEMORY;
1765
1766     LIST_FOR_EACH_ENTRY(iter, &This->nschannel->request_headers, http_header_t, entry) {
1767         if(!strcmpW(iter->header, content_lengthW))
1768             continue;
1769
1770         len = strlenW(iter->header);
1771         memcpy(ptr, iter->header, len*sizeof(WCHAR));
1772         ptr += len;
1773
1774         *ptr++ = ':';
1775         *ptr++ = ' ';
1776
1777         len = strlenW(iter->data);
1778         memcpy(ptr, iter->data, len*sizeof(WCHAR));
1779         ptr += len;
1780
1781         *ptr++ = '\r';
1782         *ptr++ = '\n';
1783     }
1784
1785     *ptr = 0;
1786
1787     return S_OK;
1788 }
1789
1790 static const BSCallbackVtbl nsChannelBSCVtbl = {
1791     nsChannelBSC_destroy,
1792     nsChannelBSC_init_bindinfo,
1793     nsChannelBSC_start_binding,
1794     nsChannelBSC_stop_binding,
1795     nsChannelBSC_read_data,
1796     nsChannelBSC_on_progress,
1797     nsChannelBSC_on_response,
1798     nsChannelBSC_beginning_transaction
1799 };
1800
1801 HRESULT create_channelbsc(IMoniker *mon, const WCHAR *headers, BYTE *post_data, DWORD post_data_size,
1802         BOOL is_doc_binding, nsChannelBSC **retval)
1803 {
1804     nsChannelBSC *ret;
1805     DWORD bindf;
1806
1807     ret = heap_alloc_zero(sizeof(*ret));
1808     if(!ret)
1809         return E_OUTOFMEMORY;
1810
1811     bindf = BINDF_ASYNCHRONOUS | BINDF_ASYNCSTORAGE | BINDF_PULLDATA;
1812     if(post_data_size)
1813         bindf |= BINDF_FORMS_SUBMIT | BINDF_PRAGMA_NO_CACHE | BINDF_HYPERLINK | BINDF_GETNEWESTVERSION;
1814
1815     init_bscallback(&ret->bsc, &nsChannelBSCVtbl, mon, bindf);
1816     ret->is_doc_channel = is_doc_binding;
1817
1818     if(headers) {
1819         ret->bsc.request_data.headers = heap_strdupW(headers);
1820         if(!ret->bsc.request_data.headers) {
1821             IBindStatusCallback_Release(&ret->bsc.IBindStatusCallback_iface);
1822             return E_OUTOFMEMORY;
1823         }
1824     }
1825
1826     if(post_data) {
1827         ret->bsc.request_data.post_data = GlobalAlloc(0, post_data_size+1);
1828         if(!ret->bsc.request_data.post_data) {
1829             release_request_data(&ret->bsc.request_data);
1830             IBindStatusCallback_Release(&ret->bsc.IBindStatusCallback_iface);
1831             return E_OUTOFMEMORY;
1832         }
1833
1834         memcpy(ret->bsc.request_data.post_data, post_data, post_data_size);
1835         ((BYTE*)ret->bsc.request_data.post_data)[post_data_size] = 0;
1836         ret->bsc.request_data.post_data_len = post_data_size;
1837     }
1838
1839     TRACE("created %p\n", ret);
1840     *retval = ret;
1841     return S_OK;
1842 }
1843
1844 typedef struct {
1845     task_t header;
1846     HTMLOuterWindow *window;
1847     HTMLInnerWindow *pending_window;
1848 } start_doc_binding_task_t;
1849
1850 static void start_doc_binding_proc(task_t *_task)
1851 {
1852     start_doc_binding_task_t *task = (start_doc_binding_task_t*)_task;
1853
1854     set_current_mon(task->window, task->pending_window->bscallback->bsc.mon, BINDING_NAVIGATED);
1855     start_binding(task->pending_window, &task->pending_window->bscallback->bsc, NULL);
1856 }
1857
1858 static void start_doc_binding_task_destr(task_t *_task)
1859 {
1860     start_doc_binding_task_t *task = (start_doc_binding_task_t*)_task;
1861
1862     IHTMLWindow2_Release(&task->pending_window->base.IHTMLWindow2_iface);
1863     heap_free(task);
1864 }
1865
1866 HRESULT async_start_doc_binding(HTMLOuterWindow *window, HTMLInnerWindow *pending_window)
1867 {
1868     start_doc_binding_task_t *task;
1869
1870     TRACE("%p\n", pending_window);
1871
1872     task = heap_alloc(sizeof(start_doc_binding_task_t));
1873     if(!task)
1874         return E_OUTOFMEMORY;
1875
1876     task->window = window;
1877     task->pending_window = pending_window;
1878     IHTMLWindow2_AddRef(&pending_window->base.IHTMLWindow2_iface);
1879
1880     return push_task(&task->header, start_doc_binding_proc, start_doc_binding_task_destr, pending_window->task_magic);
1881 }
1882
1883 void abort_window_bindings(HTMLInnerWindow *window)
1884 {
1885     BSCallback *iter;
1886
1887     remove_target_tasks(window->task_magic);
1888
1889     while(!list_empty(&window->bindings)) {
1890         iter = LIST_ENTRY(window->bindings.next, BSCallback, entry);
1891
1892         TRACE("Aborting %p\n", iter);
1893
1894         IBindStatusCallback_AddRef(&iter->IBindStatusCallback_iface);
1895
1896         if(iter->binding)
1897             IBinding_Abort(iter->binding);
1898         else
1899             iter->vtbl->stop_binding(iter, E_ABORT);
1900
1901         iter->window = NULL;
1902         list_remove(&iter->entry);
1903         list_init(&iter->entry);
1904
1905         IBindStatusCallback_Release(&iter->IBindStatusCallback_iface);
1906     }
1907
1908     if(window->bscallback) {
1909         IBindStatusCallback_Release(&window->bscallback->bsc.IBindStatusCallback_iface);
1910         window->bscallback = NULL;
1911     }
1912
1913     if(window->mon) {
1914         IMoniker_Release(window->mon);
1915         window->mon = NULL;
1916     }
1917 }
1918
1919 HRESULT channelbsc_load_stream(HTMLInnerWindow *pending_window, IMoniker *mon, IStream *stream)
1920 {
1921     nsChannelBSC *bscallback = pending_window->bscallback;
1922     HRESULT hres = S_OK;
1923
1924     if(!bscallback->nschannel) {
1925         ERR("NULL nschannel\n");
1926         return E_FAIL;
1927     }
1928
1929     bscallback->nschannel->content_type = heap_strdupA("text/html");
1930     if(!bscallback->nschannel->content_type)
1931         return E_OUTOFMEMORY;
1932
1933     set_current_mon(pending_window->base.outer_window, mon, 0);
1934
1935     bscallback->bsc.window = pending_window;
1936     if(stream)
1937         hres = read_stream_data(bscallback, stream);
1938     if(SUCCEEDED(hres))
1939         hres = async_stop_request(bscallback);
1940     if(FAILED(hres))
1941         IBindStatusCallback_OnStopBinding(&bscallback->bsc.IBindStatusCallback_iface, hres, NULL);
1942
1943     return hres;
1944 }
1945
1946 void channelbsc_set_channel(nsChannelBSC *This, nsChannel *channel, nsIStreamListener *listener, nsISupports *context)
1947 {
1948     nsIHttpChannel_AddRef(&channel->nsIHttpChannel_iface);
1949     This->nschannel = channel;
1950
1951     nsIStreamListener_AddRef(listener);
1952     This->nslistener = listener;
1953
1954     if(context) {
1955         nsISupports_AddRef(context);
1956         This->nscontext = context;
1957     }
1958
1959     if(This->bsc.request_data.headers) {
1960         HRESULT hres;
1961
1962         hres = parse_headers(This->bsc.request_data.headers, &channel->request_headers);
1963         heap_free(This->bsc.request_data.headers);
1964         This->bsc.request_data.headers = NULL;
1965         if(FAILED(hres))
1966             WARN("parse_headers failed: %08x\n", hres);
1967     }
1968 }
1969
1970 typedef struct {
1971     task_t header;
1972     HTMLOuterWindow *window;
1973     IUri *uri;
1974 } navigate_javascript_task_t;
1975
1976 static void navigate_javascript_proc(task_t *_task)
1977 {
1978     navigate_javascript_task_t *task = (navigate_javascript_task_t*)_task;
1979     HTMLOuterWindow *window = task->window;
1980     VARIANT v;
1981     BSTR code;
1982     HRESULT hres;
1983
1984     static const WCHAR jscriptW[] = {'j','s','c','r','i','p','t',0};
1985
1986     task->window->readystate = READYSTATE_COMPLETE;
1987
1988     hres = IUri_GetPath(task->uri, &code);
1989     if(FAILED(hres))
1990         return;
1991
1992     hres = UrlUnescapeW(code, NULL, NULL, URL_UNESCAPE_INPLACE);
1993     if(FAILED(hres)) {
1994         SysFreeString(code);
1995         return;
1996     }
1997
1998     set_download_state(window->doc_obj, 1);
1999
2000     V_VT(&v) = VT_EMPTY;
2001     hres = exec_script(window->base.inner_window, code, jscriptW, &v);
2002     SysFreeString(code);
2003     if(SUCCEEDED(hres) && V_VT(&v) != VT_EMPTY) {
2004         FIXME("javascirpt URL returned %s\n", debugstr_variant(&v));
2005         VariantClear(&v);
2006     }
2007
2008     if(window->doc_obj->view_sink)
2009         IAdviseSink_OnViewChange(window->doc_obj->view_sink, DVASPECT_CONTENT, -1);
2010
2011     set_download_state(window->doc_obj, 0);
2012 }
2013
2014 static void navigate_javascript_task_destr(task_t *_task)
2015 {
2016     navigate_javascript_task_t *task = (navigate_javascript_task_t*)_task;
2017
2018     IUri_Release(task->uri);
2019     heap_free(task);
2020 }
2021
2022 typedef struct {
2023     task_t header;
2024     HTMLOuterWindow *window;
2025     nsChannelBSC *bscallback;
2026     DWORD flags;
2027     IMoniker *mon;
2028     IUri *uri;
2029 } navigate_task_t;
2030
2031 static void navigate_proc(task_t *_task)
2032 {
2033     navigate_task_t *task = (navigate_task_t*)_task;
2034     HRESULT hres;
2035
2036     hres = set_moniker(task->window, task->mon, task->uri, NULL, task->bscallback, TRUE);
2037     if(SUCCEEDED(hres)) {
2038         set_current_mon(task->window, task->bscallback->bsc.mon, task->flags);
2039         set_current_uri(task->window, task->uri);
2040         start_binding(task->window->pending_window, &task->bscallback->bsc, NULL);
2041     }
2042 }
2043
2044 static void navigate_task_destr(task_t *_task)
2045 {
2046     navigate_task_t *task = (navigate_task_t*)_task;
2047
2048     IBindStatusCallback_Release(&task->bscallback->bsc.IBindStatusCallback_iface);
2049     IMoniker_Release(task->mon);
2050     IUri_Release(task->uri);
2051     heap_free(task);
2052 }
2053
2054 static HRESULT navigate_fragment(HTMLOuterWindow *window, IUri *uri)
2055 {
2056     nsIDOMLocation *nslocation;
2057     nsAString nsfrag_str;
2058     WCHAR *selector;
2059     BSTR frag;
2060     nsresult nsres;
2061     HRESULT hres;
2062
2063     const WCHAR selector_formatW[] = {'a','[','i','d','=','"','%','s','"',']',0};
2064
2065     set_current_uri(window, uri);
2066
2067     nsres = nsIDOMWindow_GetLocation(window->nswindow, &nslocation);
2068     if(FAILED(nsres) || !nslocation)
2069         return E_FAIL;
2070
2071     hres = IUri_GetFragment(uri, &frag);
2072     if(FAILED(hres)) {
2073         nsIDOMLocation_Release(nslocation);
2074         return hres;
2075     }
2076
2077     nsAString_InitDepend(&nsfrag_str, frag);
2078     nsres = nsIDOMLocation_SetHash(nslocation, &nsfrag_str);
2079     nsAString_Finish(&nsfrag_str);
2080     nsIDOMLocation_Release(nslocation);
2081     if(NS_FAILED(nsres))
2082         ERR("SetHash failed: %08x\n", nsres);
2083
2084     /*
2085      * IE supports scrolling to anchor elements with "#hash" ids (note that '#' is part of the id),
2086      * while Gecko scrolls only to elements with "hash" ids. We scroll the page ourselves if
2087      * a[id="#hash"] element can be found.
2088      */
2089     selector = heap_alloc(sizeof(selector_formatW)+SysStringLen(frag)*sizeof(WCHAR));
2090     if(selector) {
2091         nsIDOMElement *nselem = NULL;
2092         nsAString selector_str;
2093
2094         sprintfW(selector, selector_formatW, frag);
2095         nsAString_InitDepend(&selector_str, selector);
2096         /* NOTE: Gecko doesn't set result to NULL if there is no match, so nselem must be initialized */
2097         nsres = nsIDOMHTMLDocument_QuerySelector(window->base.inner_window->doc->nsdoc, &selector_str, &nselem);
2098         nsAString_Finish(&selector_str);
2099         heap_free(selector);
2100         if(NS_SUCCEEDED(nsres) && nselem) {
2101             nsIDOMHTMLElement *html_elem;
2102
2103             nsres = nsIDOMElement_QueryInterface(nselem, &IID_nsIDOMHTMLElement, (void**)&html_elem);
2104             nsIDOMElement_Release(nselem);
2105             if(NS_SUCCEEDED(nsres)) {
2106                 nsIDOMHTMLElement_ScrollIntoView(html_elem, TRUE, 1);
2107                 nsIDOMHTMLElement_Release(html_elem);
2108             }
2109         }
2110     }
2111
2112     SysFreeString(frag);
2113
2114     if(window->doc_obj->doc_object_service) {
2115         IDocObjectService_FireNavigateComplete2(window->doc_obj->doc_object_service, &window->base.IHTMLWindow2_iface, 0x10);
2116         IDocObjectService_FireDocumentComplete(window->doc_obj->doc_object_service, &window->base.IHTMLWindow2_iface, 0);
2117
2118     }
2119
2120     return S_OK;
2121 }
2122
2123 HRESULT super_navigate(HTMLOuterWindow *window, IUri *uri, DWORD flags, const WCHAR *headers, BYTE *post_data, DWORD post_data_size)
2124 {
2125     nsChannelBSC *bsc;
2126     IUri *uri_nofrag;
2127     IMoniker *mon;
2128     DWORD scheme;
2129     HRESULT hres;
2130
2131     uri_nofrag = get_uri_nofrag(uri);
2132     if(!uri_nofrag)
2133         return E_FAIL;
2134
2135     if(window->doc_obj->client && !(flags & BINDING_REFRESH)) {
2136         IOleCommandTarget *cmdtrg;
2137
2138         hres = IOleClientSite_QueryInterface(window->doc_obj->client, &IID_IOleCommandTarget, (void**)&cmdtrg);
2139         if(SUCCEEDED(hres)) {
2140             VARIANT in, out;
2141             BSTR url_str;
2142
2143             hres = IUri_GetDisplayUri(uri_nofrag, &url_str);
2144             if(SUCCEEDED(hres)) {
2145                 V_VT(&in) = VT_BSTR;
2146                 V_BSTR(&in) = url_str;
2147                 V_VT(&out) = VT_BOOL;
2148                 V_BOOL(&out) = VARIANT_TRUE;
2149                 hres = IOleCommandTarget_Exec(cmdtrg, &CGID_ShellDocView, 67, 0, &in, &out);
2150                 IOleCommandTarget_Release(cmdtrg);
2151                 if(SUCCEEDED(hres))
2152                     VariantClear(&out);
2153                 SysFreeString(url_str);
2154             }
2155         }
2156     }
2157
2158     if(!(flags & BINDING_NOFRAG) && window->uri_nofrag && !post_data_size) {
2159         BOOL eq;
2160
2161         hres = IUri_IsEqual(uri_nofrag, window->uri_nofrag, &eq);
2162         if(SUCCEEDED(hres) && eq) {
2163             IUri_Release(uri_nofrag);
2164             TRACE("fragment navigate\n");
2165             return navigate_fragment(window, uri);
2166         }
2167     }
2168
2169     hres = CreateURLMonikerEx2(NULL, uri_nofrag, &mon, URL_MK_UNIFORM);
2170     IUri_Release(uri_nofrag);
2171     if(FAILED(hres))
2172         return hres;
2173
2174     /* FIXME: Why not set_ready_state? */
2175     window->readystate = READYSTATE_UNINITIALIZED;
2176
2177     hres = create_channelbsc(mon, headers, post_data, post_data_size, TRUE, &bsc);
2178     if(FAILED(hres)) {
2179         IMoniker_Release(mon);
2180         return hres;
2181     }
2182
2183     prepare_for_binding(&window->doc_obj->basedoc, mon, flags);
2184
2185     hres = IUri_GetScheme(uri, &scheme);
2186     if(SUCCEEDED(hres) && scheme == URL_SCHEME_JAVASCRIPT) {
2187         navigate_javascript_task_t *task;
2188
2189         IBindStatusCallback_Release(&bsc->bsc.IBindStatusCallback_iface);
2190         IMoniker_Release(mon);
2191
2192         task = heap_alloc(sizeof(*task));
2193         if(!task)
2194             return E_OUTOFMEMORY;
2195
2196         /* Why silently? */
2197         window->readystate = READYSTATE_COMPLETE;
2198         if(!(flags & BINDING_FROMHIST))
2199             call_docview_84(window->doc_obj);
2200
2201         IUri_AddRef(uri);
2202         task->window = window;
2203         task->uri = uri;
2204         hres = push_task(&task->header, navigate_javascript_proc, navigate_javascript_task_destr, window->task_magic);
2205     }else if(flags & BINDING_SUBMIT) {
2206         hres = set_moniker(window, mon, uri, NULL, bsc, TRUE);
2207         if(SUCCEEDED(hres))
2208             hres = start_binding(window->pending_window, &bsc->bsc, NULL);
2209         IBindStatusCallback_Release(&bsc->bsc.IBindStatusCallback_iface);
2210         IMoniker_Release(mon);
2211     }else {
2212         navigate_task_t *task;
2213
2214         task = heap_alloc(sizeof(*task));
2215         if(!task) {
2216             IBindStatusCallback_Release(&bsc->bsc.IBindStatusCallback_iface);
2217             IMoniker_Release(mon);
2218             return E_OUTOFMEMORY;
2219         }
2220
2221         /* Silently and repeated when real loading starts? */
2222         window->readystate = READYSTATE_LOADING;
2223         if(!(flags & (BINDING_FROMHIST|BINDING_REFRESH)))
2224             call_docview_84(window->doc_obj);
2225
2226         task->window = window;
2227         task->bscallback = bsc;
2228         task->flags = flags;
2229         task->mon = mon;
2230
2231         IUri_AddRef(uri);
2232         task->uri = uri;
2233         hres = push_task(&task->header, navigate_proc, navigate_task_destr, window->task_magic);
2234     }
2235
2236     return hres;
2237 }
2238
2239 HRESULT navigate_new_window(HTMLOuterWindow *window, IUri *uri, const WCHAR *name, request_data_t *request_data, IHTMLWindow2 **ret)
2240 {
2241     INewWindowManager *new_window_mgr;
2242     BSTR display_uri, context_url;
2243     IWebBrowser2 *web_browser;
2244     IHTMLWindow2 *new_window;
2245     IBindCtx *bind_ctx;
2246     nsChannelBSC *bsc;
2247     HRESULT hres;
2248
2249     if (window->doc_obj->client) {
2250         hres = do_query_service((IUnknown*)window->doc_obj->client, &SID_SNewWindowManager,
2251                                 &IID_INewWindowManager, (void**)&new_window_mgr);
2252         if (FAILED(hres)) {
2253             FIXME("No INewWindowManager\n");
2254             return hres;
2255         }
2256
2257         hres = IUri_GetDisplayUri(window->uri_nofrag, &context_url);
2258         if(FAILED(hres))
2259             return hres;
2260
2261         hres = IUri_GetDisplayUri(uri, &display_uri);
2262         if(FAILED(hres)) {
2263             SysFreeString(context_url);
2264             return hres;
2265         }
2266
2267         hres = INewWindowManager_EvaluateNewWindow(new_window_mgr, display_uri, name, context_url,
2268                 NULL, FALSE, window->doc_obj->has_popup ? 0 : NWMF_FIRST, 0);
2269         window->doc_obj->has_popup = TRUE;
2270         SysFreeString(display_uri);
2271         SysFreeString(context_url);
2272         INewWindowManager_Release(new_window_mgr);
2273         if(FAILED(hres)) {
2274             if(ret)
2275                 *ret = NULL;
2276             return S_OK;
2277         }
2278     }
2279
2280
2281     if(request_data)
2282         hres = create_channelbsc(NULL, request_data->headers,
2283                 request_data->post_data, request_data->post_data_len, FALSE,
2284                 &bsc);
2285     else
2286         hres = create_channelbsc(NULL, NULL, NULL, 0, FALSE, &bsc);
2287     if(FAILED(hres))
2288         return hres;
2289
2290     hres = CreateAsyncBindCtx(0, &bsc->bsc.IBindStatusCallback_iface, NULL, &bind_ctx);
2291     if(FAILED(hres)) {
2292         IBindStatusCallback_Release(&bsc->bsc.IBindStatusCallback_iface);
2293         return hres;
2294     }
2295
2296     hres = CoCreateInstance(&CLSID_InternetExplorer, NULL, CLSCTX_LOCAL_SERVER,
2297             &IID_IWebBrowser2, (void**)&web_browser);
2298     if(SUCCEEDED(hres)) {
2299         ITargetFramePriv2 *target_frame_priv;
2300
2301         hres = IWebBrowser2_QueryInterface(web_browser, &IID_ITargetFramePriv2, (void**)&target_frame_priv);
2302         if(SUCCEEDED(hres)) {
2303             hres = ITargetFramePriv2_AggregatedNavigation2(target_frame_priv,
2304                     HLNF_DISABLEWINDOWRESTRICTIONS|HLNF_OPENINNEWWINDOW, bind_ctx, &bsc->bsc.IBindStatusCallback_iface,
2305                     name, uri, emptyW);
2306             ITargetFramePriv2_Release(target_frame_priv);
2307
2308             if(SUCCEEDED(hres))
2309                 hres = do_query_service((IUnknown*)web_browser, &SID_SHTMLWindow, &IID_IHTMLWindow2, (void**)&new_window);
2310         }
2311         if(FAILED(hres)) {
2312             IWebBrowser2_Quit(web_browser);
2313             IWebBrowser2_Release(web_browser);
2314         }
2315     }else {
2316         WARN("Could not create InternetExplorer instance: %08x\n", hres);
2317     }
2318
2319     IBindStatusCallback_Release(&bsc->bsc.IBindStatusCallback_iface);
2320     IBindCtx_Release(bind_ctx);
2321     if(FAILED(hres))
2322         return hres;
2323
2324     IWebBrowser2_put_Visible(web_browser, VARIANT_TRUE);
2325     IWebBrowser2_Release(web_browser);
2326
2327     if(ret)
2328         *ret = new_window;
2329     else
2330         IHTMLWindow2_Release(new_window);
2331     return S_OK;
2332 }
2333
2334 HRESULT hlink_frame_navigate(HTMLDocument *doc, LPCWSTR url, nsChannel *nschannel, DWORD hlnf, BOOL *cancel)
2335 {
2336     IHlinkFrame *hlink_frame;
2337     nsChannelBSC *callback;
2338     IBindCtx *bindctx;
2339     IMoniker *mon;
2340     IHlink *hlink;
2341     HRESULT hres;
2342
2343     *cancel = FALSE;
2344
2345     hres = do_query_service((IUnknown*)doc->doc_obj->client, &IID_IHlinkFrame, &IID_IHlinkFrame,
2346             (void**)&hlink_frame);
2347     if(FAILED(hres))
2348         return S_OK;
2349
2350     hres = create_channelbsc(NULL, NULL, NULL, 0, FALSE, &callback);
2351     if(FAILED(hres)) {
2352         IHlinkFrame_Release(hlink_frame);
2353         return hres;
2354     }
2355
2356     if(nschannel)
2357         read_post_data_stream(nschannel->post_data_stream, nschannel->post_data_contains_headers,
2358                 &nschannel->request_headers, &callback->bsc.request_data);
2359
2360     hres = CreateAsyncBindCtx(0, &callback->bsc.IBindStatusCallback_iface, NULL, &bindctx);
2361     if(SUCCEEDED(hres))
2362        hres = CoCreateInstance(&CLSID_StdHlink, NULL, CLSCTX_INPROC_SERVER,
2363                 &IID_IHlink, (LPVOID*)&hlink);
2364
2365     if(SUCCEEDED(hres))
2366         hres = CreateURLMoniker(NULL, url, &mon);
2367
2368     if(SUCCEEDED(hres)) {
2369         IHlink_SetMonikerReference(hlink, HLINKSETF_TARGET, mon, NULL);
2370
2371         if(hlnf & HLNF_OPENINNEWWINDOW) {
2372             static const WCHAR wszBlank[] = {'_','b','l','a','n','k',0};
2373             IHlink_SetTargetFrameName(hlink, wszBlank); /* FIXME */
2374         }
2375
2376         hres = IHlinkFrame_Navigate(hlink_frame, hlnf, bindctx,
2377                 &callback->bsc.IBindStatusCallback_iface, hlink);
2378         IMoniker_Release(mon);
2379         *cancel = hres == S_OK;
2380         hres = S_OK;
2381     }
2382
2383     IHlinkFrame_Release(hlink_frame);
2384     IBindCtx_Release(bindctx);
2385     IBindStatusCallback_Release(&callback->bsc.IBindStatusCallback_iface);
2386     return hres;
2387 }
2388
2389 static HRESULT navigate_uri(HTMLOuterWindow *window, IUri *uri, const WCHAR *display_uri, const request_data_t *request_data,
2390         DWORD flags)
2391 {
2392     nsWineURI *nsuri;
2393     HRESULT hres;
2394
2395     TRACE("%s\n", debugstr_w(display_uri));
2396
2397     if(window->doc_obj && window->doc_obj->webbrowser) {
2398         DWORD post_data_len = request_data ? request_data->post_data_len : 0;
2399         void *post_data = post_data_len ? request_data->post_data : NULL;
2400         const WCHAR *headers = request_data ? request_data->headers : NULL;
2401
2402         if(!(flags & BINDING_REFRESH)) {
2403             BSTR frame_name = NULL;
2404             BOOL cancel = FALSE;
2405
2406             if(window != window->doc_obj->basedoc.window) {
2407                 hres = IHTMLWindow2_get_name(&window->base.IHTMLWindow2_iface, &frame_name);
2408                 if(FAILED(hres))
2409                     return hres;
2410             }
2411
2412             hres = IDocObjectService_FireBeforeNavigate2(window->doc_obj->doc_object_service, NULL, display_uri, 0x40,
2413                     frame_name, post_data, post_data_len ? post_data_len+1 : 0, headers, TRUE, &cancel);
2414             SysFreeString(frame_name);
2415             if(SUCCEEDED(hres) && cancel) {
2416                 TRACE("Navigation canceled\n");
2417                 return S_OK;
2418             }
2419         }
2420
2421         if(window == window->doc_obj->basedoc.window)
2422             return super_navigate(window, uri, flags, headers, post_data, post_data_len);
2423     }
2424
2425     if(window->doc_obj && window == window->doc_obj->basedoc.window) {
2426         BOOL cancel;
2427
2428         hres = hlink_frame_navigate(&window->base.inner_window->doc->basedoc, display_uri, NULL, 0, &cancel);
2429         if(FAILED(hres))
2430             return hres;
2431
2432         if(cancel) {
2433             TRACE("Navigation handled by hlink frame\n");
2434             return S_OK;
2435         }
2436     }
2437
2438     hres = create_doc_uri(window, uri, &nsuri);
2439     if(FAILED(hres))
2440         return hres;
2441
2442     hres = load_nsuri(window, nsuri, request_data ? request_data->post_stream : NULL, NULL, LOAD_FLAGS_NONE);
2443     nsISupports_Release((nsISupports*)nsuri);
2444     return hres;
2445 }
2446
2447 HRESULT load_uri(HTMLOuterWindow *window, IUri *uri, DWORD flags)
2448 {
2449     BSTR display_uri;
2450     HRESULT hres;
2451
2452     hres = IUri_GetDisplayUri(uri, &display_uri);
2453     if(FAILED(hres))
2454         return hres;
2455
2456     hres = navigate_uri(window, uri, display_uri, NULL, flags);
2457     SysFreeString(display_uri);
2458     return hres;
2459 }
2460
2461 static HRESULT translate_uri(HTMLOuterWindow *window, IUri *orig_uri, BSTR *ret_display_uri, IUri **ret_uri)
2462 {
2463     IUri *uri = NULL;
2464     BSTR display_uri;
2465     HRESULT hres;
2466
2467     hres = IUri_GetDisplayUri(orig_uri, &display_uri);
2468     if(FAILED(hres))
2469         return hres;
2470
2471     if(window->doc_obj && window->doc_obj->hostui) {
2472         OLECHAR *translated_url = NULL;
2473
2474         hres = IDocHostUIHandler_TranslateUrl(window->doc_obj->hostui, 0, display_uri,
2475                 &translated_url);
2476         if(hres == S_OK && translated_url) {
2477             TRACE("%08x %s -> %s\n", hres, debugstr_w(display_uri), debugstr_w(translated_url));
2478             SysFreeString(display_uri);
2479             hres = create_uri(translated_url, 0, &uri);
2480             CoTaskMemFree(translated_url);
2481             if(FAILED(hres))
2482                 return hres;
2483
2484             hres = IUri_GetDisplayUri(uri, &display_uri);
2485             if(FAILED(hres)) {
2486                 IUri_Release(uri);
2487                 return hres;
2488             }
2489         }
2490     }
2491
2492     if(!uri) {
2493         IUri_AddRef(orig_uri);
2494         uri = orig_uri;
2495     }
2496
2497     *ret_display_uri = display_uri;
2498     *ret_uri = uri;
2499     return S_OK;
2500 }
2501
2502 HRESULT submit_form(HTMLOuterWindow *window, const WCHAR *target, IUri *submit_uri, nsIInputStream *post_stream)
2503 {
2504     request_data_t request_data = {NULL};
2505     HRESULT hres;
2506
2507     hres = read_post_data_stream(post_stream, TRUE, NULL, &request_data);
2508     if(FAILED(hres))
2509         return hres;
2510
2511     if(window) {
2512         IUri *uri;
2513         BSTR display_uri;
2514
2515         window->readystate_locked++;
2516
2517         hres = translate_uri(window, submit_uri, &display_uri, &uri);
2518         if(SUCCEEDED(hres)) {
2519             hres = navigate_uri(window, uri, display_uri, &request_data, BINDING_NAVIGATED|BINDING_SUBMIT);
2520             IUri_Release(uri);
2521             SysFreeString(display_uri);
2522         }
2523
2524         window->readystate_locked--;
2525     }else
2526         hres = navigate_new_window(window, submit_uri, target, &request_data, NULL);
2527
2528     release_request_data(&request_data);
2529     return hres;
2530 }
2531
2532 HRESULT navigate_url(HTMLOuterWindow *window, const WCHAR *new_url, IUri *base_uri, DWORD flags)
2533 {
2534     IUri *uri, *nav_uri;
2535     BSTR display_uri;
2536     HRESULT hres;
2537
2538     if(new_url && base_uri)
2539         hres = CoInternetCombineUrlEx(base_uri, new_url, URL_ESCAPE_SPACES_ONLY|URL_DONT_ESCAPE_EXTRA_INFO,
2540                 &nav_uri, 0);
2541     else
2542         hres = create_uri(new_url, 0, &nav_uri);
2543     if(FAILED(hres))
2544         return hres;
2545
2546     hres = translate_uri(window, nav_uri, &display_uri, &uri);
2547     IUri_Release(nav_uri);
2548     if(FAILED(hres))
2549         return hres;
2550
2551     hres = navigate_uri(window, uri, display_uri, NULL, flags);
2552     IUri_Release(uri);
2553     SysFreeString(display_uri);
2554     return hres;
2555 }