dlls/mshtml/navigate.c

   1 /*
   2  * Copyright 2006-2010 Jacek Caban for CodeWeavers
   3  *
   4  * This library is free software; you can redistribute it and/or
   5  * modify it under the terms of the GNU Lesser General Public
   6  * License as published by the Free Software Foundation; either
   7  * version 2.1 of the License, or (at your option) any later version.
   8  *
   9  * This library is distributed in the hope that it will be useful,
  10  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  11  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  12  * Lesser General Public License for more details.
  13  *
  14  * You should have received a copy of the GNU Lesser General Public
  15  * License along with this library; if not, write to the Free Software
  16  * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
  17  */
  18
  19 #include "config.h"
  20
  21 #include <stdarg.h>
  22
  23 #define COBJMACROS
  24 #define NONAMELESSUNION
  25 #define NONAMELESSSTRUCT
  26
  27 #include "windef.h"
  28 #include "winbase.h"
  29 #include "winuser.h"
  30 #include "winreg.h"
  31 #include "ole2.h"
  32 #include "hlguids.h"
  33 #include "shlguid.h"
  34 #include "wininet.h"
  35 #include "shlwapi.h"
  36 #include "htiface.h"
  37 #include "shdeprecated.h"
  38
  39 #include "wine/debug.h"
  40
  41 #include "mshtml_private.h"
  42 #include "binding.h"
  43
  44 WINE_DEFAULT_DEBUG_CHANNEL(mshtml);
  45
  46 #define CONTENT_LENGTH "Content-Length"
  47 #define UTF8_STR "utf-8"
  48 #define UTF16_STR "utf-16"
  49
  50 static const WCHAR emptyW[] = {0};
  51
  52 struct nsProtocolStream {
  53     nsIInputStream nsIInputStream_iface;
  54
  55     LONG ref;
  56
  57     char buf[1024];
  58     DWORD buf_size;
  59 };
  60
  61 struct BSCallbackVtbl {
  62     void (*destroy)(BSCallback*);
  63     HRESULT (*init_bindinfo)(BSCallback*);
  64     HRESULT (*start_binding)(BSCallback*);
  65     HRESULT (*stop_binding)(BSCallback*,HRESULT);
  66     HRESULT (*read_data)(BSCallback*,IStream*);
  67     HRESULT (*on_progress)(BSCallback*,ULONG,LPCWSTR);
  68     HRESULT (*on_response)(BSCallback*,DWORD,LPCWSTR);
  69     HRESULT (*beginning_transaction)(BSCallback*,WCHAR**);
  70 };
  71
  72 static inline nsProtocolStream *impl_from_nsIInputStream(nsIInputStream *iface)
  73 {
  74     return CONTAINING_RECORD(iface, nsProtocolStream, nsIInputStream_iface);
  75 }
  76
  77 static nsresult NSAPI nsInputStream_QueryInterface(nsIInputStream *iface, nsIIDRef riid,
  78         void **result)
  79 {
  80     nsProtocolStream *This = impl_from_nsIInputStream(iface);
  81
  82     *result = NULL;
  83
  84     if(IsEqualGUID(&IID_nsISupports, riid)) {
  85         TRACE("(%p)->(IID_nsISupports %p)\n", This, result);
  86         *result  = &This->nsIInputStream_iface;
  87     }else if(IsEqualGUID(&IID_nsIInputStream, riid)) {
  88         TRACE("(%p)->(IID_nsIInputStream %p)\n", This, result);
  89         *result  = &This->nsIInputStream_iface;
  90     }
  91
  92     if(*result) {
  93         nsIInputStream_AddRef(&This->nsIInputStream_iface);
  94         return NS_OK;
  95     }
  96
  97     WARN("unsupported interface %s\n", debugstr_guid(riid));
  98     return NS_NOINTERFACE;
  99 }
 100
 101 static nsrefcnt NSAPI nsInputStream_AddRef(nsIInputStream *iface)
 102 {
 103     nsProtocolStream *This = impl_from_nsIInputStream(iface);
 104     LONG ref = InterlockedIncrement(&This->ref);
 105
 106     TRACE("(%p) ref=%d\n", This, ref);
 107
 108     return ref;
 109 }
 110
 111
 112 static nsrefcnt NSAPI nsInputStream_Release(nsIInputStream *iface)
 113 {
 114     nsProtocolStream *This = impl_from_nsIInputStream(iface);
 115     LONG ref = InterlockedDecrement(&This->ref);
 116
 117     TRACE("(%p) ref=%d\n", This, ref);
 118
 119     if(!ref)
 120         heap_free(This);
 121
 122     return ref;
 123 }
 124
 125 static nsresult NSAPI nsInputStream_Close(nsIInputStream *iface)
 126 {
 127     nsProtocolStream *This = impl_from_nsIInputStream(iface);
 128     FIXME("(%p)\n", This);
 129     return NS_ERROR_NOT_IMPLEMENTED;
 130 }
 131
 132 static nsresult NSAPI nsInputStream_Available(nsIInputStream *iface, PRUint32 *_retval)
 133 {
 134     nsProtocolStream *This = impl_from_nsIInputStream(iface);
 135     FIXME("(%p)->(%p)\n", This, _retval);
 136     return NS_ERROR_NOT_IMPLEMENTED;
 137 }
 138
 139 static nsresult NSAPI nsInputStream_Read(nsIInputStream *iface, char *aBuf, PRUint32 aCount,
 140                                          PRUint32 *_retval)
 141 {
 142     nsProtocolStream *This = impl_from_nsIInputStream(iface);
 143     DWORD read = aCount;
 144
 145     TRACE("(%p)->(%p %d %p)\n", This, aBuf, aCount, _retval);
 146
 147     if(read > This->buf_size)
 148         read = This->buf_size;
 149
 150     if(read) {
 151         memcpy(aBuf, This->buf, read);
 152         if(read < This->buf_size)
 153             memmove(This->buf, This->buf+read, This->buf_size-read);
 154         This->buf_size -= read;
 155     }
 156
 157     *_retval = read;
 158     return NS_OK;
 159 }
 160
 161 static nsresult NSAPI nsInputStream_ReadSegments(nsIInputStream *iface,
 162         nsresult (WINAPI *aWriter)(nsIInputStream*,void*,const char*,PRUint32,PRUint32,PRUint32*),
 163         void *aClousure, PRUint32 aCount, PRUint32 *_retval)
 164 {
 165     nsProtocolStream *This = impl_from_nsIInputStream(iface);
 166     PRUint32 written = 0;
 167     nsresult nsres;
 168
 169     TRACE("(%p)->(%p %p %d %p)\n", This, aWriter, aClousure, aCount, _retval);
 170
 171     if(!This->buf_size)
 172         return S_OK;
 173
 174     if(aCount > This->buf_size)
 175         aCount = This->buf_size;
 176
 177     nsres = aWriter(&This->nsIInputStream_iface, aClousure, This->buf, 0, aCount, &written);
 178     if(NS_FAILED(nsres))
 179         TRACE("aWritter failed: %08x\n", nsres);
 180     else if(written != This->buf_size)
 181         FIXME("written %d != buf_size %d\n", written, This->buf_size);
 182
 183     This->buf_size -= written;
 184
 185     *_retval = written;
 186     return nsres;
 187 }
 188
 189 static nsresult NSAPI nsInputStream_IsNonBlocking(nsIInputStream *iface, cpp_bool *_retval)
 190 {
 191     nsProtocolStream *This = impl_from_nsIInputStream(iface);
 192     FIXME("(%p)->(%p)\n", This, _retval);
 193     return NS_ERROR_NOT_IMPLEMENTED;
 194 }
 195
 196 static const nsIInputStreamVtbl nsInputStreamVtbl = {
 197     nsInputStream_QueryInterface,
 198     nsInputStream_AddRef,
 199     nsInputStream_Release,
 200     nsInputStream_Close,
 201     nsInputStream_Available,
 202     nsInputStream_Read,
 203     nsInputStream_ReadSegments,
 204     nsInputStream_IsNonBlocking
 205 };
 206
 207 static nsProtocolStream *create_nsprotocol_stream(void)
 208 {
 209     nsProtocolStream *ret = heap_alloc(sizeof(nsProtocolStream));
 210
 211     ret->nsIInputStream_iface.lpVtbl = &nsInputStreamVtbl;
 212     ret->ref = 1;
 213     ret->buf_size = 0;
 214
 215     return ret;
 216 }
 217
 218 static inline BSCallback *impl_from_IBindStatusCallback(IBindStatusCallback *iface)
 219 {
 220     return CONTAINING_RECORD(iface, BSCallback, IBindStatusCallback_iface);
 221 }
 222
 223 static HRESULT WINAPI BindStatusCallback_QueryInterface(IBindStatusCallback *iface,
 224         REFIID riid, void **ppv)
 225 {
 226     BSCallback *This = impl_from_IBindStatusCallback(iface);
 227
 228     *ppv = NULL;
 229     if(IsEqualGUID(&IID_IUnknown, riid)) {
 230         TRACE("(%p)->(IID_IUnknown, %p)\n", This, ppv);
 231         *ppv = &This->IBindStatusCallback_iface;
 232     }else if(IsEqualGUID(&IID_IBindStatusCallback, riid)) {
 233         TRACE("(%p)->(IID_IBindStatusCallback, %p)\n", This, ppv);
 234         *ppv = &This->IBindStatusCallback_iface;
 235     }else if(IsEqualGUID(&IID_IServiceProvider, riid)) {
 236         TRACE("(%p)->(IID_IServiceProvider %p)\n", This, ppv);
 237         *ppv = &This->IServiceProvider_iface;
 238     }else if(IsEqualGUID(&IID_IHttpNegotiate, riid)) {
 239         TRACE("(%p)->(IID_IHttpNegotiate %p)\n", This, ppv);
 240         *ppv = &This->IHttpNegotiate2_iface;
 241     }else if(IsEqualGUID(&IID_IHttpNegotiate2, riid)) {
 242         TRACE("(%p)->(IID_IHttpNegotiate2 %p)\n", This, ppv);
 243         *ppv = &This->IHttpNegotiate2_iface;
 244     }else if(IsEqualGUID(&IID_IInternetBindInfo, riid)) {
 245         TRACE("(%p)->(IID_IInternetBindInfo %p)\n", This, ppv);
 246         *ppv = &This->IInternetBindInfo_iface;
 247     }
 248
 249     if(*ppv) {
 250         IBindStatusCallback_AddRef(&This->IBindStatusCallback_iface);
 251         return S_OK;
 252     }
 253
 254     TRACE("Unsupported riid = %s\n", debugstr_guid(riid));
 255     return E_NOINTERFACE;
 256 }
 257
 258 static ULONG WINAPI BindStatusCallback_AddRef(IBindStatusCallback *iface)
 259 {
 260     BSCallback *This = impl_from_IBindStatusCallback(iface);
 261     LONG ref = InterlockedIncrement(&This->ref);
 262
 263     TRACE("(%p) ref = %d\n", This, ref);
 264
 265     return ref;
 266 }
 267
 268 static ULONG WINAPI BindStatusCallback_Release(IBindStatusCallback *iface)
 269 {
 270     BSCallback *This = impl_from_IBindStatusCallback(iface);
 271     LONG ref = InterlockedDecrement(&This->ref);
 272
 273     TRACE("(%p) ref = %d\n", This, ref);
 274
 275     if(!ref) {
 276         if(This->post_data)
 277             GlobalFree(This->post_data);
 278         if(This->mon)
 279             IMoniker_Release(This->mon);
 280         if(This->binding)
 281             IBinding_Release(This->binding);
 282         list_remove(&This->entry);
 283         list_init(&This->entry);
 284         heap_free(This->headers);
 285
 286         This->vtbl->destroy(This);
 287     }
 288
 289     return ref;
 290 }
 291
 292 static HRESULT WINAPI BindStatusCallback_OnStartBinding(IBindStatusCallback *iface,
 293         DWORD dwReserved, IBinding *pbind)
 294 {
 295     BSCallback *This = impl_from_IBindStatusCallback(iface);
 296
 297     TRACE("(%p)->(%d %p)\n", This, dwReserved, pbind);
 298
 299     IBinding_AddRef(pbind);
 300     This->binding = pbind;
 301
 302     if(This->doc)
 303         list_add_head(&This->doc->bindings, &This->entry);
 304
 305     return This->vtbl->start_binding(This);
 306 }
 307
 308 static HRESULT WINAPI BindStatusCallback_GetPriority(IBindStatusCallback *iface, LONG *pnPriority)
 309 {
 310     BSCallback *This = impl_from_IBindStatusCallback(iface);
 311     FIXME("(%p)->(%p)\n", This, pnPriority);
 312     return E_NOTIMPL;
 313 }
 314
 315 static HRESULT WINAPI BindStatusCallback_OnLowResource(IBindStatusCallback *iface, DWORD reserved)
 316 {
 317     BSCallback *This = impl_from_IBindStatusCallback(iface);
 318     FIXME("(%p)->(%d)\n", This, reserved);
 319     return E_NOTIMPL;
 320 }
 321
 322 static HRESULT WINAPI BindStatusCallback_OnProgress(IBindStatusCallback *iface, ULONG ulProgress,
 323         ULONG ulProgressMax, ULONG ulStatusCode, LPCWSTR szStatusText)
 324 {
 325     BSCallback *This = impl_from_IBindStatusCallback(iface);
 326
 327     TRACE("%p)->(%u %u %u %s)\n", This, ulProgress, ulProgressMax, ulStatusCode,
 328             debugstr_w(szStatusText));
 329
 330     return This->vtbl->on_progress(This, ulStatusCode, szStatusText);
 331 }
 332
 333 static HRESULT WINAPI BindStatusCallback_OnStopBinding(IBindStatusCallback *iface,
 334         HRESULT hresult, LPCWSTR szError)
 335 {
 336     BSCallback *This = impl_from_IBindStatusCallback(iface);
 337     HRESULT hres;
 338
 339     TRACE("(%p)->(%08x %s)\n", This, hresult, debugstr_w(szError));
 340
 341     /* NOTE: IE7 calls GetBindResult here */
 342
 343     hres = This->vtbl->stop_binding(This, hresult);
 344
 345     if(This->binding) {
 346         IBinding_Release(This->binding);
 347         This->binding = NULL;
 348     }
 349
 350     list_remove(&This->entry);
 351     list_init(&This->entry);
 352     This->doc = NULL;
 353
 354     return hres;
 355 }
 356
 357 static HRESULT WINAPI BindStatusCallback_GetBindInfo(IBindStatusCallback *iface,
 358         DWORD *grfBINDF, BINDINFO *pbindinfo)
 359 {
 360     BSCallback *This = impl_from_IBindStatusCallback(iface);
 361     DWORD size;
 362
 363     TRACE("(%p)->(%p %p)\n", This, grfBINDF, pbindinfo);
 364
 365     if(!This->bindinfo_ready) {
 366         HRESULT hres;
 367
 368         hres = This->vtbl->init_bindinfo(This);
 369         if(FAILED(hres))
 370             return hres;
 371
 372         This->bindinfo_ready = TRUE;
 373     }
 374
 375     *grfBINDF = This->bindf;
 376
 377     size = pbindinfo->cbSize;
 378     memset(pbindinfo, 0, size);
 379     pbindinfo->cbSize = size;
 380
 381     pbindinfo->cbstgmedData = This->post_data_len;
 382     pbindinfo->dwCodePage = CP_UTF8;
 383     pbindinfo->dwOptions = 0x80000;
 384
 385     if(This->post_data) {
 386         pbindinfo->dwBindVerb = BINDVERB_POST;
 387
 388         pbindinfo->stgmedData.tymed = TYMED_HGLOBAL;
 389         pbindinfo->stgmedData.u.hGlobal = This->post_data;
 390         pbindinfo->stgmedData.pUnkForRelease = (IUnknown*)&This->IBindStatusCallback_iface;
 391         IBindStatusCallback_AddRef(&This->IBindStatusCallback_iface);
 392     }
 393
 394     return S_OK;
 395 }
 396
 397 static HRESULT WINAPI BindStatusCallback_OnDataAvailable(IBindStatusCallback *iface,
 398         DWORD grfBSCF, DWORD dwSize, FORMATETC *pformatetc, STGMEDIUM *pstgmed)
 399 {
 400     BSCallback *This = impl_from_IBindStatusCallback(iface);
 401
 402     TRACE("(%p)->(%08x %d %p %p)\n", This, grfBSCF, dwSize, pformatetc, pstgmed);
 403
 404     return This->vtbl->read_data(This, pstgmed->u.pstm);
 405 }
 406
 407 static HRESULT WINAPI BindStatusCallback_OnObjectAvailable(IBindStatusCallback *iface,
 408         REFIID riid, IUnknown *punk)
 409 {
 410     BSCallback *This = impl_from_IBindStatusCallback(iface);
 411     FIXME("(%p)->(%s %p)\n", This, debugstr_guid(riid), punk);
 412     return E_NOTIMPL;
 413 }
 414
 415 static const IBindStatusCallbackVtbl BindStatusCallbackVtbl = {
 416     BindStatusCallback_QueryInterface,
 417     BindStatusCallback_AddRef,
 418     BindStatusCallback_Release,
 419     BindStatusCallback_OnStartBinding,
 420     BindStatusCallback_GetPriority,
 421     BindStatusCallback_OnLowResource,
 422     BindStatusCallback_OnProgress,
 423     BindStatusCallback_OnStopBinding,
 424     BindStatusCallback_GetBindInfo,
 425     BindStatusCallback_OnDataAvailable,
 426     BindStatusCallback_OnObjectAvailable
 427 };
 428
 429 static inline BSCallback *impl_from_IHttpNegotiate2(IHttpNegotiate2 *iface)
 430 {
 431     return CONTAINING_RECORD(iface, BSCallback, IHttpNegotiate2_iface);
 432 }
 433
 434 static HRESULT WINAPI HttpNegotiate_QueryInterface(IHttpNegotiate2 *iface,
 435                                                    REFIID riid, void **ppv)
 436 {
 437     BSCallback *This = impl_from_IHttpNegotiate2(iface);
 438     return IBindStatusCallback_QueryInterface(&This->IBindStatusCallback_iface, riid, ppv);
 439 }
 440
 441 static ULONG WINAPI HttpNegotiate_AddRef(IHttpNegotiate2 *iface)
 442 {
 443     BSCallback *This = impl_from_IHttpNegotiate2(iface);
 444     return IBindStatusCallback_AddRef(&This->IBindStatusCallback_iface);
 445 }
 446
 447 static ULONG WINAPI HttpNegotiate_Release(IHttpNegotiate2 *iface)
 448 {
 449     BSCallback *This = impl_from_IHttpNegotiate2(iface);
 450     return IBindStatusCallback_Release(&This->IBindStatusCallback_iface);
 451 }
 452
 453 static HRESULT WINAPI HttpNegotiate_BeginningTransaction(IHttpNegotiate2 *iface,
 454         LPCWSTR szURL, LPCWSTR szHeaders, DWORD dwReserved, LPWSTR *pszAdditionalHeaders)
 455 {
 456     BSCallback *This = impl_from_IHttpNegotiate2(iface);
 457     HRESULT hres;
 458
 459     TRACE("(%p)->(%s %s %d %p)\n", This, debugstr_w(szURL), debugstr_w(szHeaders),
 460           dwReserved, pszAdditionalHeaders);
 461
 462     *pszAdditionalHeaders = NULL;
 463
 464     hres = This->vtbl->beginning_transaction(This, pszAdditionalHeaders);
 465     if(hres != S_FALSE)
 466         return hres;
 467
 468     if(This->headers) {
 469         DWORD size;
 470
 471         size = (strlenW(This->headers)+1)*sizeof(WCHAR);
 472         *pszAdditionalHeaders = CoTaskMemAlloc(size);
 473         if(!*pszAdditionalHeaders)
 474             return E_OUTOFMEMORY;
 475         memcpy(*pszAdditionalHeaders, This->headers, size);
 476     }
 477
 478     return S_OK;
 479 }
 480
 481 static HRESULT WINAPI HttpNegotiate_OnResponse(IHttpNegotiate2 *iface, DWORD dwResponseCode,
 482         LPCWSTR szResponseHeaders, LPCWSTR szRequestHeaders, LPWSTR *pszAdditionalRequestHeaders)
 483 {
 484     BSCallback *This = impl_from_IHttpNegotiate2(iface);
 485
 486     TRACE("(%p)->(%d %s %s %p)\n", This, dwResponseCode, debugstr_w(szResponseHeaders),
 487           debugstr_w(szRequestHeaders), pszAdditionalRequestHeaders);
 488
 489     return This->vtbl->on_response(This, dwResponseCode, szResponseHeaders);
 490 }
 491
 492 static HRESULT WINAPI HttpNegotiate_GetRootSecurityId(IHttpNegotiate2 *iface,
 493         BYTE *pbSecurityId, DWORD *pcbSecurityId, DWORD_PTR dwReserved)
 494 {
 495     BSCallback *This = impl_from_IHttpNegotiate2(iface);
 496     FIXME("(%p)->(%p %p %ld)\n", This, pbSecurityId, pcbSecurityId, dwReserved);
 497     return E_NOTIMPL;
 498 }
 499
 500 static const IHttpNegotiate2Vtbl HttpNegotiate2Vtbl = {
 501     HttpNegotiate_QueryInterface,
 502     HttpNegotiate_AddRef,
 503     HttpNegotiate_Release,
 504     HttpNegotiate_BeginningTransaction,
 505     HttpNegotiate_OnResponse,
 506     HttpNegotiate_GetRootSecurityId
 507 };
 508
 509 static inline BSCallback *impl_from_IInternetBindInfo(IInternetBindInfo *iface)
 510 {
 511     return CONTAINING_RECORD(iface, BSCallback, IInternetBindInfo_iface);
 512 }
 513
 514 static HRESULT WINAPI InternetBindInfo_QueryInterface(IInternetBindInfo *iface,
 515                                                       REFIID riid, void **ppv)
 516 {
 517     BSCallback *This = impl_from_IInternetBindInfo(iface);
 518     return IBindStatusCallback_QueryInterface(&This->IBindStatusCallback_iface, riid, ppv);
 519 }
 520
 521 static ULONG WINAPI InternetBindInfo_AddRef(IInternetBindInfo *iface)
 522 {
 523     BSCallback *This = impl_from_IInternetBindInfo(iface);
 524     return IBindStatusCallback_AddRef(&This->IBindStatusCallback_iface);
 525 }
 526
 527 static ULONG WINAPI InternetBindInfo_Release(IInternetBindInfo *iface)
 528 {
 529     BSCallback *This = impl_from_IInternetBindInfo(iface);
 530     return IBindStatusCallback_Release(&This->IBindStatusCallback_iface);
 531 }
 532
 533 static HRESULT WINAPI InternetBindInfo_GetBindInfo(IInternetBindInfo *iface,
 534                                                    DWORD *grfBINDF, BINDINFO *pbindinfo)
 535 {
 536     BSCallback *This = impl_from_IInternetBindInfo(iface);
 537     FIXME("(%p)->(%p %p)\n", This, grfBINDF, pbindinfo);
 538     return E_NOTIMPL;
 539 }
 540
 541 static HRESULT WINAPI InternetBindInfo_GetBindString(IInternetBindInfo *iface,
 542         ULONG ulStringType, LPOLESTR *ppwzStr, ULONG cEl, ULONG *pcElFetched)
 543 {
 544     BSCallback *This = impl_from_IInternetBindInfo(iface);
 545     FIXME("(%p)->(%u %p %u %p)\n", This, ulStringType, ppwzStr, cEl, pcElFetched);
 546     return E_NOTIMPL;
 547 }
 548
 549 static const IInternetBindInfoVtbl InternetBindInfoVtbl = {
 550     InternetBindInfo_QueryInterface,
 551     InternetBindInfo_AddRef,
 552     InternetBindInfo_Release,
 553     InternetBindInfo_GetBindInfo,
 554     InternetBindInfo_GetBindString
 555 };
 556
 557 static inline BSCallback *impl_from_IServiceProvider(IServiceProvider *iface)
 558 {
 559     return CONTAINING_RECORD(iface, BSCallback, IServiceProvider_iface);
 560 }
 561
 562 static HRESULT WINAPI BSCServiceProvider_QueryInterface(IServiceProvider *iface,
 563                                                         REFIID riid, void **ppv)
 564 {
 565     BSCallback *This = impl_from_IServiceProvider(iface);
 566     return IBindStatusCallback_QueryInterface(&This->IBindStatusCallback_iface, riid, ppv);
 567 }
 568
 569 static ULONG WINAPI BSCServiceProvider_AddRef(IServiceProvider *iface)
 570 {
 571     BSCallback *This = impl_from_IServiceProvider(iface);
 572     return IBindStatusCallback_AddRef(&This->IBindStatusCallback_iface);
 573 }
 574
 575 static ULONG WINAPI BSCServiceProvider_Release(IServiceProvider *iface)
 576 {
 577     BSCallback *This = impl_from_IServiceProvider(iface);
 578     return IBindStatusCallback_Release(&This->IBindStatusCallback_iface);
 579 }
 580
 581 static HRESULT WINAPI BSCServiceProvider_QueryService(IServiceProvider *iface,
 582         REFGUID guidService, REFIID riid, void **ppv)
 583 {
 584     BSCallback *This = impl_from_IServiceProvider(iface);
 585     TRACE("(%p)->(%s %s %p)\n", This, debugstr_guid(guidService), debugstr_guid(riid), ppv);
 586     return E_NOINTERFACE;
 587 }
 588
 589 static const IServiceProviderVtbl ServiceProviderVtbl = {
 590     BSCServiceProvider_QueryInterface,
 591     BSCServiceProvider_AddRef,
 592     BSCServiceProvider_Release,
 593     BSCServiceProvider_QueryService
 594 };
 595
 596 static void init_bscallback(BSCallback *This, const BSCallbackVtbl *vtbl, IMoniker *mon, DWORD bindf)
 597 {
 598     This->IBindStatusCallback_iface.lpVtbl = &BindStatusCallbackVtbl;
 599     This->IServiceProvider_iface.lpVtbl = &ServiceProviderVtbl;
 600     This->IHttpNegotiate2_iface.lpVtbl = &HttpNegotiate2Vtbl;
 601     This->IInternetBindInfo_iface.lpVtbl = &InternetBindInfoVtbl;
 602     This->vtbl = vtbl;
 603     This->ref = 1;
 604     This->bindf = bindf;
 605
 606     list_init(&This->entry);
 607
 608     if(mon)
 609         IMoniker_AddRef(mon);
 610     This->mon = mon;
 611 }
 612
 613 /* Calls undocumented 84 cmd of CGID_ShellDocView */
 614 static void call_docview_84(HTMLDocumentObj *doc)
 615 {
 616     IOleCommandTarget *olecmd;
 617     VARIANT var;
 618     HRESULT hres;
 619
 620     if(!doc->client)
 621         return;
 622
 623     hres = IOleClientSite_QueryInterface(doc->client, &IID_IOleCommandTarget, (void**)&olecmd);
 624     if(FAILED(hres))
 625         return;
 626
 627     VariantInit(&var);
 628     hres = IOleCommandTarget_Exec(olecmd, &CGID_ShellDocView, 84, 0, NULL, &var);
 629     IOleCommandTarget_Release(olecmd);
 630     if(SUCCEEDED(hres) && V_VT(&var) != VT_NULL)
 631         FIXME("handle result\n");
 632 }
 633
 634 static void parse_content_type(nsChannelBSC *This, const WCHAR *value)
 635 {
 636     const WCHAR *ptr;
 637     size_t len;
 638
 639     static const WCHAR charsetW[] = {'c','h','a','r','s','e','t','='};
 640
 641     ptr = strchrW(value, ';');
 642     if(!ptr)
 643         return;
 644
 645     ptr++;
 646     while(*ptr && isspaceW(*ptr))
 647         ptr++;
 648
 649     len = strlenW(value);
 650     if(ptr + sizeof(charsetW)/sizeof(WCHAR) < value+len && !memicmpW(ptr, charsetW, sizeof(charsetW)/sizeof(WCHAR))) {
 651         size_t charset_len, lena;
 652         nsACString charset_str;
 653         const WCHAR *charset;
 654         char *charseta;
 655
 656         ptr += sizeof(charsetW)/sizeof(WCHAR);
 657
 658         if(*ptr == '\'') {
 659             FIXME("Quoted value\n");
 660             return;
 661         }else {
 662             charset = ptr;
 663             while(*ptr && *ptr != ',')
 664                 ptr++;
 665             charset_len = ptr-charset;
 666         }
 667
 668         lena = WideCharToMultiByte(CP_ACP, 0, charset, charset_len, NULL, 0, NULL, NULL);
 669         charseta = heap_alloc(lena+1);
 670         if(!charseta)
 671             return;
 672
 673         WideCharToMultiByte(CP_ACP, 0, charset, charset_len, charseta, lena, NULL, NULL);
 674         charseta[lena] = 0;
 675
 676         nsACString_InitDepend(&charset_str, charseta);
 677         nsIHttpChannel_SetContentCharset(&This->nschannel->nsIHttpChannel_iface, &charset_str);
 678         nsACString_Finish(&charset_str);
 679         heap_free(charseta);
 680     }else {
 681         FIXME("unhandled: %s\n", debugstr_wn(ptr, len - (ptr-value)));
 682     }
 683 }
 684
 685 static HRESULT parse_headers(const WCHAR *headers, struct list *headers_list)
 686 {
 687     const WCHAR *header, *header_end, *colon, *value;
 688     HRESULT hres;
 689
 690     header = headers;
 691     while(*header) {
 692         if(header[0] == '\r' && header[1] == '\n' && !header[2])
 693             break;
 694         for(colon = header; *colon && *colon != ':' && *colon != '\r'; colon++);
 695         if(*colon != ':')
 696             return E_FAIL;
 697
 698         value = colon+1;
 699         while(*value == ' ')
 700             value++;
 701         if(!*value)
 702             return E_FAIL;
 703
 704         for(header_end = value+1; *header_end && *header_end != '\r'; header_end++);
 705
 706         hres = set_http_header(headers_list, header, colon-header, value, header_end-value);
 707         if(FAILED(hres))
 708             return hres;
 709
 710         header = header_end;
 711         if(header[0] == '\r' && header[1] == '\n')
 712             header += 2;
 713     }
 714
 715     return S_OK;
 716 }
 717
 718 static HRESULT process_response_headers(nsChannelBSC *This, const WCHAR *headers)
 719 {
 720     http_header_t *iter;
 721     HRESULT hres;
 722
 723     static const WCHAR content_typeW[] = {'c','o','n','t','e','n','t','-','t','y','p','e',0};
 724
 725     hres = parse_headers(headers, &This->nschannel->response_headers);
 726     if(FAILED(hres))
 727         return hres;
 728
 729     LIST_FOR_EACH_ENTRY(iter, &This->nschannel->response_headers, http_header_t, entry) {
 730         if(!strcmpiW(iter->header, content_typeW))
 731             parse_content_type(This, iter->data);
 732     }
 733
 734     return S_OK;
 735 }
 736
 737 HRESULT start_binding(HTMLWindow *window, HTMLDocumentNode *doc, BSCallback *bscallback, IBindCtx *bctx)
 738 {
 739     IStream *str = NULL;
 740     HRESULT hres;
 741
 742     TRACE("(%p %p %p %p)\n", window, doc, bscallback, bctx);
 743
 744     bscallback->doc = doc;
 745
 746     /* NOTE: IE7 calls IsSystemMoniker here*/
 747
 748     if(window) {
 749         if(bscallback->mon != window->mon)
 750             set_current_mon(window, bscallback->mon);
 751         call_docview_84(window->doc_obj);
 752     }
 753
 754     if(bctx) {
 755         RegisterBindStatusCallback(bctx, &bscallback->IBindStatusCallback_iface, NULL, 0);
 756         IBindCtx_AddRef(bctx);
 757     }else {
 758         hres = CreateAsyncBindCtx(0, &bscallback->IBindStatusCallback_iface, NULL, &bctx);
 759         if(FAILED(hres)) {
 760             WARN("CreateAsyncBindCtx failed: %08x\n", hres);
 761             bscallback->vtbl->stop_binding(bscallback, hres);
 762             return hres;
 763         }
 764     }
 765
 766     hres = IMoniker_BindToStorage(bscallback->mon, bctx, NULL, &IID_IStream, (void**)&str);
 767     IBindCtx_Release(bctx);
 768     if(FAILED(hres)) {
 769         WARN("BindToStorage failed: %08x\n", hres);
 770         bscallback->vtbl->stop_binding(bscallback, hres);
 771         return hres;
 772     }
 773
 774     if(str)
 775         IStream_Release(str);
 776
 777     IMoniker_Release(bscallback->mon);
 778     bscallback->mon = NULL;
 779
 780     return S_OK;
 781 }
 782
 783 typedef struct {
 784     BSCallback bsc;
 785
 786     DWORD size;
 787     BYTE *buf;
 788     HRESULT hres;
 789 } BufferBSC;
 790
 791 static inline BufferBSC *BufferBSC_from_BSCallback(BSCallback *iface)
 792 {
 793     return CONTAINING_RECORD(iface, BufferBSC, bsc);
 794 }
 795
 796 static void BufferBSC_destroy(BSCallback *bsc)
 797 {
 798     BufferBSC *This = BufferBSC_from_BSCallback(bsc);
 799
 800     heap_free(This->buf);
 801     heap_free(This);
 802 }
 803
 804 static HRESULT BufferBSC_init_bindinfo(BSCallback *bsc)
 805 {
 806     return S_OK;
 807 }
 808
 809 static HRESULT BufferBSC_start_binding(BSCallback *bsc)
 810 {
 811     return S_OK;
 812 }
 813
 814 static HRESULT BufferBSC_stop_binding(BSCallback *bsc, HRESULT result)
 815 {
 816     BufferBSC *This = BufferBSC_from_BSCallback(bsc);
 817
 818     This->hres = result;
 819
 820     if(FAILED(result)) {
 821         heap_free(This->buf);
 822         This->buf = NULL;
 823         This->size = 0;
 824     }
 825
 826     return S_OK;
 827 }
 828
 829 static HRESULT BufferBSC_read_data(BSCallback *bsc, IStream *stream)
 830 {
 831     BufferBSC *This = BufferBSC_from_BSCallback(bsc);
 832     DWORD readed;
 833     HRESULT hres;
 834
 835     if(!This->buf) {
 836         This->size = 128;
 837         This->buf = heap_alloc(This->size);
 838     }
 839
 840     do {
 841         if(This->bsc.readed == This->size) {
 842             This->size <<= 1;
 843             This->buf = heap_realloc(This->buf, This->size);
 844         }
 845
 846         readed = 0;
 847         hres = IStream_Read(stream, This->buf+This->bsc.readed, This->size-This->bsc.readed, &readed);
 848         This->bsc.readed += readed;
 849     }while(hres == S_OK);
 850
 851     return S_OK;
 852 }
 853
 854 static HRESULT BufferBSC_on_progress(BSCallback *bsc, ULONG status_code, LPCWSTR status_text)
 855 {
 856     return S_OK;
 857 }
 858
 859 static HRESULT BufferBSC_on_response(BSCallback *bsc, DWORD response_code,
 860         LPCWSTR response_headers)
 861 {
 862     return S_OK;
 863 }
 864
 865 static HRESULT BufferBSC_beginning_transaction(BSCallback *bsc, WCHAR **additional_headers)
 866 {
 867     return S_FALSE;
 868 }
 869
 870 static const BSCallbackVtbl BufferBSCVtbl = {
 871     BufferBSC_destroy,
 872     BufferBSC_init_bindinfo,
 873     BufferBSC_start_binding,
 874     BufferBSC_stop_binding,
 875     BufferBSC_read_data,
 876     BufferBSC_on_progress,
 877     BufferBSC_on_response,
 878     BufferBSC_beginning_transaction
 879 };
 880
 881
 882 static BufferBSC *create_bufferbsc(IMoniker *mon)
 883 {
 884     BufferBSC *ret = heap_alloc_zero(sizeof(*ret));
 885
 886     init_bscallback(&ret->bsc, &BufferBSCVtbl, mon, 0);
 887     ret->hres = E_FAIL;
 888
 889     return ret;
 890 }
 891
 892 HRESULT bind_mon_to_buffer(HTMLDocumentNode *doc, IMoniker *mon, void **buf, DWORD *size)
 893 {
 894     BufferBSC *bsc = create_bufferbsc(mon);
 895     HRESULT hres;
 896
 897     *buf = NULL;
 898
 899     hres = start_binding(NULL, doc, &bsc->bsc, NULL);
 900     if(SUCCEEDED(hres)) {
 901         hres = bsc->hres;
 902         if(SUCCEEDED(hres)) {
 903             *buf = bsc->buf;
 904             bsc->buf = NULL;
 905             *size = bsc->bsc.readed;
 906             bsc->size = 0;
 907         }
 908     }
 909
 910     IBindStatusCallback_Release(&bsc->bsc.IBindStatusCallback_iface);
 911
 912     return hres;
 913 }
 914
 915 static HRESULT read_post_data_stream(nsChannelBSC *This, nsChannel *nschannel)
 916 {
 917     PRUint32 data_len = 0, available = 0;
 918     char *data, *post_data;
 919     nsresult nsres;
 920     HRESULT hres = S_OK;
 921
 922     if(!nschannel->post_data_stream)
 923         return S_OK;
 924
 925     nsres =  nsIInputStream_Available(nschannel->post_data_stream, &available);
 926     if(NS_FAILED(nsres))
 927         return E_FAIL;
 928
 929     post_data = data = GlobalAlloc(0, available);
 930     if(!data)
 931         return E_OUTOFMEMORY;
 932
 933     nsres = nsIInputStream_Read(nschannel->post_data_stream, data, available, &data_len);
 934     if(NS_FAILED(nsres)) {
 935         GlobalFree(data);
 936         return E_FAIL;
 937     }
 938
 939     if(nschannel->post_data_contains_headers) {
 940         if(data_len >= 2 && data[0] == '\r' && data[1] == '\n') {
 941             post_data = data+2;
 942             data_len -= 2;
 943         }else {
 944             WCHAR *headers;
 945             DWORD size;
 946             char *ptr;
 947
 948             post_data += data_len;
 949             for(ptr = data; ptr+4 < data+data_len; ptr++) {
 950                 if(!memcmp(ptr, "\r\n\r\n", 4)) {
 951                     post_data = ptr+4;
 952                     break;
 953                 }
 954             }
 955
 956             data_len -= post_data-data;
 957
 958             size = MultiByteToWideChar(CP_ACP, 0, data, post_data-data, NULL, 0);
 959             headers = heap_alloc((size+1)*sizeof(WCHAR));
 960             if(headers) {
 961                 MultiByteToWideChar(CP_ACP, 0, data, post_data-data, headers, size);
 962                 headers[size] = 0;
 963                 hres = parse_headers(headers , &nschannel->request_headers);
 964                 if(SUCCEEDED(hres))
 965                     This->bsc.headers = headers;
 966                 else
 967                     heap_free(headers);
 968             }else {
 969                 hres = E_OUTOFMEMORY;
 970             }
 971         }
 972     }
 973
 974     if(FAILED(hres)) {
 975         GlobalFree(data);
 976         return hres;
 977     }
 978
 979     if(!data_len) {
 980         GlobalFree(data);
 981         post_data = NULL;
 982     }else if(post_data != data) {
 983         char *new_data;
 984
 985         new_data = GlobalAlloc(0, data_len);
 986         if(new_data)
 987             memcpy(new_data, post_data, data_len);
 988         GlobalFree(data);
 989         if(!new_data)
 990             return E_OUTOFMEMORY;
 991         post_data = new_data;
 992     }
 993
 994     This->bsc.post_data = post_data;
 995     This->bsc.post_data_len = data_len;
 996     TRACE("post_data = %s\n", debugstr_a(This->bsc.post_data));
 997     return S_OK;
 998 }
 999
1000 static HRESULT on_start_nsrequest(nsChannelBSC *This)
1001 {
1002     nsresult nsres;
1003
1004     /* FIXME: it's needed for http connections from BindToObject. */
1005     if(!This->nschannel->response_status)
1006         This->nschannel->response_status = 200;
1007
1008     nsres = nsIStreamListener_OnStartRequest(This->nslistener,
1009             (nsIRequest*)&This->nschannel->nsIHttpChannel_iface, This->nscontext);
1010     if(NS_FAILED(nsres)) {
1011         FIXME("OnStartRequest failed: %08x\n", nsres);
1012         return E_FAIL;
1013     }
1014
1015     if(This->window) {
1016         list_remove(&This->bsc.entry);
1017         list_init(&This->bsc.entry);
1018         update_window_doc(This->window);
1019         if(This->window->doc != This->bsc.doc)
1020             This->bsc.doc = This->window->doc;
1021         list_add_head(&This->bsc.doc->bindings, &This->bsc.entry);
1022         if(This->window->readystate != READYSTATE_LOADING)
1023             set_ready_state(This->window, READYSTATE_LOADING);
1024     }
1025
1026     return S_OK;
1027 }
1028
1029 static void on_stop_nsrequest(nsChannelBSC *This, HRESULT result)
1030 {
1031     nsresult nsres, request_result;
1032
1033     switch(result) {
1034     case S_OK:
1035         request_result = NS_OK;
1036         break;
1037     case E_ABORT:
1038         request_result = NS_BINDING_ABORTED;
1039         break;
1040     default:
1041         request_result = NS_ERROR_FAILURE;
1042     }
1043
1044     if(This->nslistener) {
1045         nsres = nsIStreamListener_OnStopRequest(This->nslistener,
1046                  (nsIRequest*)&This->nschannel->nsIHttpChannel_iface, This->nscontext,
1047                  request_result);
1048         if(NS_FAILED(nsres))
1049             WARN("OnStopRequest failed: %08x\n", nsres);
1050     }
1051
1052     if(This->nschannel->load_group) {
1053         nsres = nsILoadGroup_RemoveRequest(This->nschannel->load_group,
1054                 (nsIRequest*)&This->nschannel->nsIHttpChannel_iface, NULL, request_result);
1055         if(NS_FAILED(nsres))
1056             ERR("RemoveRequest failed: %08x\n", nsres);
1057     }
1058 }
1059
1060 static HRESULT read_stream_data(nsChannelBSC *This, IStream *stream)
1061 {
1062     static const WCHAR mimeTextHtml[] = {'t','e','x','t','/','h','t','m','l',0};
1063
1064     DWORD read;
1065     nsresult nsres;
1066     HRESULT hres;
1067
1068     if(!This->nslistener) {
1069         BYTE buf[1024];
1070
1071         do {
1072             read = 0;
1073             hres = IStream_Read(stream, buf, sizeof(buf), &read);
1074         }while(hres == S_OK && read);
1075
1076         return S_OK;
1077     }
1078
1079     if(!This->nsstream)
1080         This->nsstream = create_nsprotocol_stream();
1081
1082     do {
1083         read = 0;
1084         hres = IStream_Read(stream, This->nsstream->buf+This->nsstream->buf_size,
1085                 sizeof(This->nsstream->buf)-This->nsstream->buf_size, &read);
1086         if(!read)
1087             break;
1088
1089         This->nsstream->buf_size += read;
1090
1091         if(!This->bsc.readed) {
1092             if(This->nsstream->buf_size >= 2
1093                && (BYTE)This->nsstream->buf[0] == 0xff
1094                && (BYTE)This->nsstream->buf[1] == 0xfe)
1095                 This->nschannel->charset = heap_strdupA(UTF16_STR);
1096             if(This->nsstream->buf_size >= 3
1097                && (BYTE)This->nsstream->buf[0] == 0xef
1098                && (BYTE)This->nsstream->buf[1] == 0xbb
1099                && (BYTE)This->nsstream->buf[2] == 0xbf)
1100                 This->nschannel->charset = heap_strdupA(UTF8_STR);
1101
1102             if(!This->nschannel->content_type) {
1103                 WCHAR *mime;
1104
1105                 hres = FindMimeFromData(NULL, NULL, This->nsstream->buf, This->nsstream->buf_size,
1106                         This->window ? mimeTextHtml : NULL, 0, &mime, 0);
1107                 if(FAILED(hres))
1108                     return hres;
1109
1110                 TRACE("Found MIME %s\n", debugstr_w(mime));
1111
1112                 This->nschannel->content_type = heap_strdupWtoA(mime);
1113                 CoTaskMemFree(mime);
1114                 if(!This->nschannel->content_type)
1115                     return E_OUTOFMEMORY;
1116             }
1117
1118             on_start_nsrequest(This);
1119         }
1120
1121         This->bsc.readed += This->nsstream->buf_size;
1122
1123         nsres = nsIStreamListener_OnDataAvailable(This->nslistener,
1124                 (nsIRequest*)&This->nschannel->nsIHttpChannel_iface, This->nscontext,
1125                 &This->nsstream->nsIInputStream_iface, This->bsc.readed-This->nsstream->buf_size,
1126                 This->nsstream->buf_size);
1127         if(NS_FAILED(nsres))
1128             ERR("OnDataAvailable failed: %08x\n", nsres);
1129
1130         if(This->nsstream->buf_size == sizeof(This->nsstream->buf)) {
1131             ERR("buffer is full\n");
1132             break;
1133         }
1134     }while(hres == S_OK);
1135
1136     return S_OK;
1137 }
1138
1139 typedef struct {
1140     nsIAsyncVerifyRedirectCallback nsIAsyncVerifyRedirectCallback_iface;
1141
1142     LONG ref;
1143
1144     nsChannel *nschannel;
1145     nsChannelBSC *bsc;
1146 } nsRedirectCallback;
1147
1148 static nsRedirectCallback *impl_from_nsIAsyncVerifyRedirectCallback(nsIAsyncVerifyRedirectCallback *iface)
1149 {
1150     return CONTAINING_RECORD(iface, nsRedirectCallback, nsIAsyncVerifyRedirectCallback_iface);
1151 }
1152
1153 static nsresult NSAPI nsAsyncVerifyRedirectCallback_QueryInterface(nsIAsyncVerifyRedirectCallback *iface,
1154         nsIIDRef riid, void **result)
1155 {
1156     nsRedirectCallback *This = impl_from_nsIAsyncVerifyRedirectCallback(iface);
1157
1158     if(IsEqualGUID(&IID_nsISupports, riid)) {
1159         TRACE("(%p)->(IID_nsISuports %p)\n", This, result);
1160         *result = &This->nsIAsyncVerifyRedirectCallback_iface;
1161     }else if(IsEqualGUID(&IID_nsIAsyncVerifyRedirectCallback, riid)) {
1162         TRACE("(%p)->(IID_nsIAsyncVerifyRedirectCallback %p)\n", This, result);
1163         *result = &This->nsIAsyncVerifyRedirectCallback_iface;
1164     }else {
1165         *result = NULL;
1166         WARN("unimplemented iface %s\n", debugstr_guid(riid));
1167         return NS_NOINTERFACE;
1168     }
1169
1170     nsISupports_AddRef((nsISupports*)*result);
1171     return NS_OK;
1172 }
1173
1174 static nsrefcnt NSAPI nsAsyncVerifyRedirectCallback_AddRef(nsIAsyncVerifyRedirectCallback *iface)
1175 {
1176     nsRedirectCallback *This = impl_from_nsIAsyncVerifyRedirectCallback(iface);
1177     LONG ref = InterlockedIncrement(&This->ref);
1178
1179     TRACE("(%p) ref=%d\n", This, ref);
1180
1181     return ref;
1182 }
1183
1184 static nsrefcnt NSAPI nsAsyncVerifyRedirectCallback_Release(nsIAsyncVerifyRedirectCallback *iface)
1185 {
1186     nsRedirectCallback *This = impl_from_nsIAsyncVerifyRedirectCallback(iface);
1187     LONG ref = InterlockedDecrement(&This->ref);
1188
1189     TRACE("(%p) ref=%d\n", This, ref);
1190
1191     if(!ref) {
1192         IBindStatusCallback_Release(&This->bsc->bsc.IBindStatusCallback_iface);
1193         nsIChannel_Release(&This->nschannel->nsIHttpChannel_iface);
1194         heap_free(This);
1195     }
1196
1197     return ref;
1198 }
1199
1200 static nsresult NSAPI nsAsyncVerifyRedirectCallback_AsyncOnChannelRedirect(nsIAsyncVerifyRedirectCallback *iface, nsresult result)
1201 {
1202     nsRedirectCallback *This = impl_from_nsIAsyncVerifyRedirectCallback(iface);
1203     nsChannel *old_nschannel;
1204     nsresult nsres;
1205
1206     TRACE("(%p)->(%08x)\n", This, result);
1207
1208     old_nschannel = This->bsc->nschannel;
1209     nsIChannel_AddRef(&This->nschannel->nsIHttpChannel_iface);
1210     This->bsc->nschannel = This->nschannel;
1211
1212     if(This->nschannel->load_group) {
1213         nsres = nsILoadGroup_AddRequest(This->nschannel->load_group, (nsIRequest*)&This->nschannel->nsIHttpChannel_iface,
1214                 NULL);
1215         if(NS_FAILED(nsres))
1216             ERR("AddRequest failed: %08x\n", nsres);
1217     }
1218
1219     if(This->bsc->window) {
1220         IUri *uri = nsuri_get_uri(This->nschannel->uri);
1221
1222         if(uri) {
1223             set_current_uri(This->bsc->window, uri);
1224             IUri_Release(uri);
1225         }else {
1226             WARN("Could not get IUri from nsWineURI\n");
1227         }
1228     }
1229
1230     if(old_nschannel) {
1231         nsres = nsILoadGroup_RemoveRequest(old_nschannel->load_group,
1232                 (nsIRequest*)&old_nschannel->nsIHttpChannel_iface, NULL, NS_OK);
1233         if(NS_FAILED(nsres))
1234             ERR("RemoveRequest failed: %08x\n", nsres);
1235         nsIHttpChannel_Release(&old_nschannel->nsIHttpChannel_iface);
1236     }
1237
1238     return NS_OK;
1239 }
1240
1241 static const nsIAsyncVerifyRedirectCallbackVtbl nsAsyncVerifyRedirectCallbackVtbl = {
1242     nsAsyncVerifyRedirectCallback_QueryInterface,
1243     nsAsyncVerifyRedirectCallback_AddRef,
1244     nsAsyncVerifyRedirectCallback_Release,
1245     nsAsyncVerifyRedirectCallback_AsyncOnChannelRedirect
1246 };
1247
1248 static HRESULT create_redirect_callback(nsChannel *nschannel, nsChannelBSC *bsc, nsRedirectCallback **ret)
1249 {
1250     nsRedirectCallback *callback;
1251
1252     callback = heap_alloc(sizeof(*callback));
1253     if(!callback)
1254         return E_OUTOFMEMORY;
1255
1256     callback->nsIAsyncVerifyRedirectCallback_iface.lpVtbl = &nsAsyncVerifyRedirectCallbackVtbl;
1257     callback->ref = 1;
1258
1259     nsIChannel_AddRef(&nschannel->nsIHttpChannel_iface);
1260     callback->nschannel = nschannel;
1261
1262     IBindStatusCallback_AddRef(&bsc->bsc.IBindStatusCallback_iface);
1263     callback->bsc = bsc;
1264
1265     *ret = callback;
1266     return S_OK;
1267 }
1268
1269 static inline nsChannelBSC *nsChannelBSC_from_BSCallback(BSCallback *iface)
1270 {
1271     return CONTAINING_RECORD(iface, nsChannelBSC, bsc);
1272 }
1273
1274 static void nsChannelBSC_destroy(BSCallback *bsc)
1275 {
1276     nsChannelBSC *This = nsChannelBSC_from_BSCallback(bsc);
1277
1278     if(This->nschannel)
1279         nsIChannel_Release(&This->nschannel->nsIHttpChannel_iface);
1280     if(This->nslistener)
1281         nsIStreamListener_Release(This->nslistener);
1282     if(This->nscontext)
1283         nsISupports_Release(This->nscontext);
1284     if(This->nsstream)
1285         nsIInputStream_Release(&This->nsstream->nsIInputStream_iface);
1286     heap_free(This);
1287 }
1288
1289 static HRESULT nsChannelBSC_start_binding(BSCallback *bsc)
1290 {
1291     nsChannelBSC *This = nsChannelBSC_from_BSCallback(bsc);
1292
1293     if(This->window)
1294         This->window->doc->skip_mutation_notif = FALSE;
1295
1296     return S_OK;
1297 }
1298
1299 static HRESULT nsChannelBSC_init_bindinfo(BSCallback *bsc)
1300 {
1301     nsChannelBSC *This = nsChannelBSC_from_BSCallback(bsc);
1302     HRESULT hres;
1303
1304     if(This->nschannel && This->nschannel->post_data_stream) {
1305         hres = read_post_data_stream(This, This->nschannel);
1306         if(FAILED(hres))
1307             return hres;
1308     }
1309
1310     return S_OK;
1311 }
1312
1313 typedef struct {
1314     task_t header;
1315     nsChannelBSC *bsc;
1316 } stop_request_task_t;
1317
1318 static void stop_request_proc(task_t *_task)
1319 {
1320     stop_request_task_t *task = (stop_request_task_t*)_task;
1321
1322     TRACE("(%p)\n", task->bsc);
1323
1324     list_remove(&task->bsc->bsc.entry);
1325     list_init(&task->bsc->bsc.entry);
1326     on_stop_nsrequest(task->bsc, S_OK);
1327 }
1328
1329 static void stop_request_task_destr(task_t *_task)
1330 {
1331     stop_request_task_t *task = (stop_request_task_t*)_task;
1332
1333     IBindStatusCallback_Release(&task->bsc->bsc.IBindStatusCallback_iface);
1334     heap_free(task);
1335 }
1336
1337 static HRESULT async_stop_request(nsChannelBSC *This)
1338 {
1339     stop_request_task_t *task;
1340
1341     if(!This->bsc.readed) {
1342         TRACE("No data read, calling OnStartRequest\n");
1343         on_start_nsrequest(This);
1344     }
1345
1346     task = heap_alloc(sizeof(*task));
1347     if(!task)
1348         return E_OUTOFMEMORY;
1349
1350     IBindStatusCallback_AddRef(&This->bsc.IBindStatusCallback_iface);
1351     task->bsc = This;
1352     push_task(&task->header, stop_request_proc, stop_request_task_destr, This->bsc.doc->basedoc.doc_obj->basedoc.task_magic);
1353     return S_OK;
1354 }
1355
1356 static void handle_navigation_error(nsChannelBSC *This, DWORD result)
1357 {
1358     HTMLDocumentObj *doc;
1359     IOleCommandTarget *olecmd;
1360     BOOL is_error_url;
1361     SAFEARRAY *sa;
1362     SAFEARRAYBOUND bound;
1363     VARIANT var, varOut;
1364     LONG ind;
1365     BSTR unk;
1366     HRESULT hres;
1367
1368     if(!This->window)
1369         return;
1370
1371     doc = This->window->doc_obj;
1372     if(!doc || !doc->doc_object_service || !doc->client)
1373         return;
1374
1375     hres = IDocObjectService_IsErrorUrl(doc->doc_object_service,
1376             This->window->url, &is_error_url);
1377     if(FAILED(hres) || is_error_url)
1378         return;
1379
1380     hres = IOleClientSite_QueryInterface(doc->client,
1381             &IID_IOleCommandTarget, (void**)&olecmd);
1382     if(FAILED(hres))
1383         return;
1384
1385     bound.lLbound = 0;
1386     bound.cElements = 8;
1387     sa = SafeArrayCreate(VT_VARIANT, 1, &bound);
1388     if(!sa) {
1389         IOleCommandTarget_Release(olecmd);
1390         return;
1391     }
1392
1393     ind = 0;
1394     V_VT(&var) = VT_I4;
1395     V_I4(&var) = result;
1396     SafeArrayPutElement(sa, &ind, &var);
1397
1398     ind = 1;
1399     V_VT(&var) = VT_BSTR;
1400     V_BSTR(&var) = This->window->url;
1401     SafeArrayPutElement(sa, &ind, &var);
1402
1403     ind = 3;
1404     V_VT(&var) = VT_UNKNOWN;
1405     V_UNKNOWN(&var) = (IUnknown*)&This->window->IHTMLWindow2_iface;
1406     SafeArrayPutElement(sa, &ind, &var);
1407
1408     /* FIXME: what are the following fields for? */
1409     ind = 2;
1410     V_VT(&var) = VT_UNKNOWN;
1411     V_UNKNOWN(&var) = NULL;
1412     SafeArrayPutElement(sa, &ind, &var);
1413
1414     ind = 4;
1415     V_VT(&var) = VT_BOOL;
1416     V_BOOL(&var) = FALSE;
1417     SafeArrayPutElement(sa, &ind, &var);
1418
1419     ind = 5;
1420     V_VT(&var) = VT_BOOL;
1421     V_BOOL(&var) = FALSE;
1422     SafeArrayPutElement(sa, &ind, &var);
1423
1424     ind = 6;
1425     V_VT(&var) = VT_BSTR;
1426     unk = SysAllocString(NULL);
1427     V_BSTR(&var) = unk;
1428     SafeArrayPutElement(sa, &ind, &var);
1429
1430     ind = 7;
1431     V_VT(&var) = VT_UNKNOWN;
1432     V_UNKNOWN(&var) = NULL;
1433     SafeArrayPutElement(sa, &ind, &var);
1434
1435     V_VT(&var) = VT_ARRAY;
1436     V_ARRAY(&var) = sa;
1437     V_VT(&varOut) = VT_BOOL;
1438     V_BOOL(&varOut) = VARIANT_TRUE;
1439     IOleCommandTarget_Exec(olecmd, &CGID_DocHostCmdPriv, 1, 0, &var, FAILED(hres)?NULL:&varOut);
1440
1441     SysFreeString(unk);
1442     SafeArrayDestroy(sa);
1443     IOleCommandTarget_Release(olecmd);
1444 }
1445
1446 static HRESULT nsChannelBSC_stop_binding(BSCallback *bsc, HRESULT result)
1447 {
1448     nsChannelBSC *This = nsChannelBSC_from_BSCallback(bsc);
1449
1450     if(result != E_ABORT) {
1451         if(FAILED(result))
1452             handle_navigation_error(This, result);
1453         else if(This->window) {
1454             result = async_stop_request(This);
1455             if(SUCCEEDED(result))
1456                 return S_OK;
1457         }
1458     }
1459
1460     on_stop_nsrequest(This, result);
1461     return S_OK;
1462 }
1463
1464 static HRESULT nsChannelBSC_read_data(BSCallback *bsc, IStream *stream)
1465 {
1466     nsChannelBSC *This = nsChannelBSC_from_BSCallback(bsc);
1467
1468     return read_stream_data(This, stream);
1469 }
1470
1471 static HRESULT handle_redirect(nsChannelBSC *This, const WCHAR *new_url)
1472 {
1473     nsRedirectCallback *callback;
1474     nsIChannelEventSink *sink;
1475     nsChannel *new_channel;
1476     nsresult nsres;
1477     HRESULT hres;
1478
1479     TRACE("(%p)->(%s)\n", This, debugstr_w(new_url));
1480
1481     if(!This->nschannel || !This->nschannel->notif_callback)
1482         return S_OK;
1483
1484     nsres = nsIInterfaceRequestor_GetInterface(This->nschannel->notif_callback, &IID_nsIChannelEventSink, (void**)&sink);
1485     if(NS_FAILED(nsres))
1486         return S_OK;
1487
1488     hres = create_redirect_nschannel(new_url, This->nschannel, &new_channel);
1489     if(SUCCEEDED(hres)) {
1490         TRACE("%p %p->%p\n", This, This->nschannel, new_channel);
1491
1492         hres = create_redirect_callback(new_channel, This, &callback);
1493         nsIChannel_Release(&new_channel->nsIHttpChannel_iface);
1494     }
1495
1496     if(SUCCEEDED(hres)) {
1497         nsres = nsIChannelEventSink_AsyncOnChannelRedirect(sink, (nsIChannel*)&This->nschannel->nsIHttpChannel_iface,
1498                 (nsIChannel*)&callback->nschannel->nsIHttpChannel_iface, REDIRECT_TEMPORARY, /* FIXME */
1499                 &callback->nsIAsyncVerifyRedirectCallback_iface);
1500
1501         if(NS_FAILED(nsres))
1502             FIXME("AsyncOnChannelRedirect failed: %08x\n", hres);
1503         else if(This->nschannel != callback->nschannel)
1504             FIXME("nschannel not updated\n");
1505
1506         nsIAsyncVerifyRedirectCallback_Release(&callback->nsIAsyncVerifyRedirectCallback_iface);
1507     }
1508
1509     nsIChannelEventSink_Release(sink);
1510     return hres;
1511 }
1512
1513 static HRESULT nsChannelBSC_on_progress(BSCallback *bsc, ULONG status_code, LPCWSTR status_text)
1514 {
1515     nsChannelBSC *This = nsChannelBSC_from_BSCallback(bsc);
1516
1517     switch(status_code) {
1518     case BINDSTATUS_MIMETYPEAVAILABLE:
1519         if(!This->nschannel)
1520             return S_OK;
1521
1522         heap_free(This->nschannel->content_type);
1523         This->nschannel->content_type = heap_strdupWtoA(status_text);
1524         break;
1525     case BINDSTATUS_REDIRECTING:
1526         return handle_redirect(This, status_text);
1527     case BINDSTATUS_BEGINDOWNLOADDATA: {
1528         IWinInetHttpInfo *http_info;
1529         DWORD status, size = sizeof(DWORD);
1530         HRESULT hres;
1531
1532         if(!This->bsc.binding)
1533             break;
1534
1535         hres = IBinding_QueryInterface(This->bsc.binding, &IID_IWinInetHttpInfo, (void**)&http_info);
1536         if(FAILED(hres))
1537             break;
1538
1539         hres = IWinInetHttpInfo_QueryInfo(http_info,
1540                 HTTP_QUERY_STATUS_CODE|HTTP_QUERY_FLAG_NUMBER, &status, &size, NULL, NULL);
1541         IWinInetHttpInfo_Release(http_info);
1542         if(FAILED(hres) || status == HTTP_STATUS_OK)
1543             break;
1544
1545         handle_navigation_error(This, status);
1546     }
1547     }
1548
1549     return S_OK;
1550 }
1551
1552 static HRESULT nsChannelBSC_on_response(BSCallback *bsc, DWORD response_code,
1553         LPCWSTR response_headers)
1554 {
1555     nsChannelBSC *This = nsChannelBSC_from_BSCallback(bsc);
1556     HRESULT hres;
1557
1558     This->nschannel->response_status = response_code;
1559
1560     if(response_headers) {
1561         const WCHAR *headers;
1562
1563         headers = strchrW(response_headers, '\r');
1564         if(headers && headers[1] == '\n') {
1565             headers += 2;
1566             hres = process_response_headers(This, headers);
1567             if(FAILED(hres)) {
1568                 WARN("parsing headers failed: %08x\n", hres);
1569                 return hres;
1570             }
1571         }
1572     }
1573
1574     return S_OK;
1575 }
1576
1577 static HRESULT nsChannelBSC_beginning_transaction(BSCallback *bsc, WCHAR **additional_headers)
1578 {
1579     nsChannelBSC *This = nsChannelBSC_from_BSCallback(bsc);
1580     http_header_t *iter;
1581     DWORD len = 0;
1582     WCHAR *ptr;
1583
1584     static const WCHAR content_lengthW[] =
1585         {'C','o','n','t','e','n','t','-','L','e','n','g','t','h',0};
1586
1587     if(!This->nschannel)
1588         return S_FALSE;
1589
1590     LIST_FOR_EACH_ENTRY(iter, &This->nschannel->request_headers, http_header_t, entry) {
1591         if(strcmpW(iter->header, content_lengthW))
1592             len += strlenW(iter->header) + 2 /* ": " */ + strlenW(iter->data) + 2 /* "\r\n" */;
1593     }
1594
1595     if(!len)
1596         return S_OK;
1597
1598     *additional_headers = ptr = CoTaskMemAlloc((len+1)*sizeof(WCHAR));
1599     if(!ptr)
1600         return E_OUTOFMEMORY;
1601
1602     LIST_FOR_EACH_ENTRY(iter, &This->nschannel->request_headers, http_header_t, entry) {
1603         if(!strcmpW(iter->header, content_lengthW))
1604             continue;
1605
1606         len = strlenW(iter->header);
1607         memcpy(ptr, iter->header, len*sizeof(WCHAR));
1608         ptr += len;
1609
1610         *ptr++ = ':';
1611         *ptr++ = ' ';
1612
1613         len = strlenW(iter->data);
1614         memcpy(ptr, iter->data, len*sizeof(WCHAR));
1615         ptr += len;
1616
1617         *ptr++ = '\r';
1618         *ptr++ = '\n';
1619     }
1620
1621     *ptr = 0;
1622
1623     return S_OK;
1624 }
1625
1626 static const BSCallbackVtbl nsChannelBSCVtbl = {
1627     nsChannelBSC_destroy,
1628     nsChannelBSC_init_bindinfo,
1629     nsChannelBSC_start_binding,
1630     nsChannelBSC_stop_binding,
1631     nsChannelBSC_read_data,
1632     nsChannelBSC_on_progress,
1633     nsChannelBSC_on_response,
1634     nsChannelBSC_beginning_transaction
1635 };
1636
1637 HRESULT create_channelbsc(IMoniker *mon, const WCHAR *headers, BYTE *post_data, DWORD post_data_size, nsChannelBSC **retval)
1638 {
1639     nsChannelBSC *ret;
1640
1641     ret = heap_alloc_zero(sizeof(*ret));
1642     if(!ret)
1643         return E_OUTOFMEMORY;
1644
1645     init_bscallback(&ret->bsc, &nsChannelBSCVtbl, mon, BINDF_ASYNCHRONOUS | BINDF_ASYNCSTORAGE | BINDF_PULLDATA);
1646
1647     if(headers) {
1648         ret->bsc.headers = heap_strdupW(headers);
1649         if(!ret->bsc.headers) {
1650             IBindStatusCallback_Release(&ret->bsc.IBindStatusCallback_iface);
1651             return E_OUTOFMEMORY;
1652         }
1653     }
1654
1655     if(post_data) {
1656         ret->bsc.post_data = GlobalAlloc(0, post_data_size);
1657         if(!ret->bsc.post_data) {
1658             heap_free(ret->bsc.headers);
1659             IBindStatusCallback_Release(&ret->bsc.IBindStatusCallback_iface);
1660             return E_OUTOFMEMORY;
1661         }
1662
1663         memcpy(ret->bsc.post_data, post_data, post_data_size);
1664         ret->bsc.post_data_len = post_data_size;
1665     }
1666
1667     *retval = ret;
1668     return S_OK;
1669 }
1670
1671 void set_window_bscallback(HTMLWindow *window, nsChannelBSC *callback)
1672 {
1673     if(window->bscallback) {
1674         if(window->bscallback->bsc.binding)
1675             IBinding_Abort(window->bscallback->bsc.binding);
1676         window->bscallback->bsc.doc = NULL;
1677         window->bscallback->window = NULL;
1678         IBindStatusCallback_Release(&window->bscallback->bsc.IBindStatusCallback_iface);
1679     }
1680
1681     window->bscallback = callback;
1682
1683     if(callback) {
1684         callback->window = window;
1685         IBindStatusCallback_AddRef(&callback->bsc.IBindStatusCallback_iface);
1686         callback->bsc.doc = window->doc;
1687     }
1688 }
1689
1690 typedef struct {
1691     task_t header;
1692     HTMLWindow *window;
1693     nsChannelBSC *bscallback;
1694 } start_doc_binding_task_t;
1695
1696 static void start_doc_binding_proc(task_t *_task)
1697 {
1698     start_doc_binding_task_t *task = (start_doc_binding_task_t*)_task;
1699
1700     start_binding(task->window, NULL, (BSCallback*)task->bscallback, NULL);
1701 }
1702
1703 static void start_doc_binding_task_destr(task_t *_task)
1704 {
1705     start_doc_binding_task_t *task = (start_doc_binding_task_t*)_task;
1706
1707     IBindStatusCallback_Release(&task->bscallback->bsc.IBindStatusCallback_iface);
1708     heap_free(task);
1709 }
1710
1711 HRESULT async_start_doc_binding(HTMLWindow *window, nsChannelBSC *bscallback)
1712 {
1713     start_doc_binding_task_t *task;
1714
1715     TRACE("%p\n", bscallback);
1716
1717     task = heap_alloc(sizeof(start_doc_binding_task_t));
1718     if(!task)
1719         return E_OUTOFMEMORY;
1720
1721     task->window = window;
1722     task->bscallback = bscallback;
1723     IBindStatusCallback_AddRef(&bscallback->bsc.IBindStatusCallback_iface);
1724
1725     push_task(&task->header, start_doc_binding_proc, start_doc_binding_task_destr, window->task_magic);
1726     return S_OK;
1727 }
1728
1729 void abort_document_bindings(HTMLDocumentNode *doc)
1730 {
1731     BSCallback *iter, *next;
1732
1733     LIST_FOR_EACH_ENTRY_SAFE(iter, next, &doc->bindings, BSCallback, entry) {
1734         TRACE("Aborting %p\n", iter);
1735
1736         if(iter->doc)
1737             remove_target_tasks(iter->doc->basedoc.task_magic);
1738
1739         if(iter->binding)
1740             IBinding_Abort(iter->binding);
1741         else {
1742             list_remove(&iter->entry);
1743             list_init(&iter->entry);
1744             iter->vtbl->stop_binding(iter, E_ABORT);
1745         }
1746
1747         iter->doc = NULL;
1748     }
1749 }
1750
1751 HRESULT channelbsc_load_stream(nsChannelBSC *bscallback, IStream *stream)
1752 {
1753     HRESULT hres = S_OK;
1754
1755     if(!bscallback->nschannel) {
1756         ERR("NULL nschannel\n");
1757         return E_FAIL;
1758     }
1759
1760     bscallback->nschannel->content_type = heap_strdupA("text/html");
1761     if(!bscallback->nschannel->content_type)
1762         return E_OUTOFMEMORY;
1763
1764     list_add_head(&bscallback->bsc.doc->bindings, &bscallback->bsc.entry);
1765     if(stream)
1766         hres = read_stream_data(bscallback, stream);
1767     if(SUCCEEDED(hres))
1768         hres = async_stop_request(bscallback);
1769     if(FAILED(hres))
1770         IBindStatusCallback_OnStopBinding(&bscallback->bsc.IBindStatusCallback_iface, hres,
1771                 ERROR_SUCCESS);
1772
1773     return hres;
1774 }
1775
1776 void channelbsc_set_channel(nsChannelBSC *This, nsChannel *channel, nsIStreamListener *listener, nsISupports *context)
1777 {
1778     nsIChannel_AddRef(&channel->nsIHttpChannel_iface);
1779     This->nschannel = channel;
1780
1781     nsIStreamListener_AddRef(listener);
1782     This->nslistener = listener;
1783
1784     if(context) {
1785         nsISupports_AddRef(context);
1786         This->nscontext = context;
1787     }
1788
1789     if(This->bsc.headers) {
1790         HRESULT hres;
1791
1792         hres = parse_headers(This->bsc.headers, &channel->request_headers);
1793         heap_free(This->bsc.headers);
1794         This->bsc.headers = NULL;
1795         if(FAILED(hres))
1796             WARN("parse_headers failed: %08x\n", hres);
1797     }
1798 }
1799
1800 typedef struct {
1801     task_t header;
1802     HTMLWindow *window;
1803     IUri *uri;
1804 } navigate_javascript_task_t;
1805
1806 static void navigate_javascript_proc(task_t *_task)
1807 {
1808     navigate_javascript_task_t *task = (navigate_javascript_task_t*)_task;
1809     HTMLWindow *window = task->window;
1810     VARIANT v;
1811     BSTR code;
1812     HRESULT hres;
1813
1814     static const WCHAR jscriptW[] = {'j','s','c','r','i','p','t',0};
1815
1816     task->window->readystate = READYSTATE_COMPLETE;
1817
1818     hres = IUri_GetPath(task->uri, &code);
1819     if(FAILED(hres))
1820         return;
1821
1822     set_download_state(window->doc_obj, 1);
1823
1824     V_VT(&v) = VT_EMPTY;
1825     hres = exec_script(window, code, jscriptW, &v);
1826     SysFreeString(code);
1827     if(SUCCEEDED(hres) && V_VT(&v) != VT_EMPTY) {
1828         FIXME("javascirpt URL returned %s\n", debugstr_variant(&v));
1829         VariantClear(&v);
1830     }
1831
1832     if(window->doc_obj->view_sink)
1833         IAdviseSink_OnViewChange(window->doc_obj->view_sink, DVASPECT_CONTENT, -1);
1834
1835     set_download_state(window->doc_obj, 0);
1836 }
1837
1838 static void navigate_javascript_task_destr(task_t *_task)
1839 {
1840     navigate_javascript_task_t *task = (navigate_javascript_task_t*)_task;
1841
1842     IUri_Release(task->uri);
1843     heap_free(task);
1844 }
1845
1846 typedef struct {
1847     task_t header;
1848     HTMLWindow *window;
1849     nsChannelBSC *bscallback;
1850     IMoniker *mon;
1851 } navigate_task_t;
1852
1853 static void navigate_proc(task_t *_task)
1854 {
1855     navigate_task_t *task = (navigate_task_t*)_task;
1856     HRESULT hres;
1857
1858     hres = set_moniker(&task->window->doc_obj->basedoc, task->mon, NULL, task->bscallback, TRUE);
1859     if(SUCCEEDED(hres))
1860         start_binding(task->window, NULL, (BSCallback*)task->bscallback, NULL);
1861 }
1862
1863 static void navigate_task_destr(task_t *_task)
1864 {
1865     navigate_task_t *task = (navigate_task_t*)_task;
1866
1867     IUnknown_Release((IUnknown*)task->bscallback);
1868     IMoniker_Release(task->mon);
1869     heap_free(task);
1870 }
1871
1872 static HRESULT navigate_fragment(HTMLWindow *window, IUri *uri)
1873 {
1874     nsIDOMLocation *nslocation;
1875     nsAString nsfrag_str;
1876     BSTR frag;
1877     nsresult nsres;
1878     HRESULT hres;
1879
1880     set_current_uri(window, uri);
1881
1882     nsres = nsIDOMWindow_GetLocation(window->nswindow, &nslocation);
1883     if(FAILED(nsres) || !nslocation)
1884         return E_FAIL;
1885
1886     hres = IUri_GetFragment(uri, &frag);
1887     if(FAILED(hres)) {
1888         nsIDOMLocation_Release(nslocation);
1889         return hres;
1890     }
1891
1892     nsAString_InitDepend(&nsfrag_str, frag);
1893     nsres = nsIDOMLocation_SetHash(nslocation, &nsfrag_str);
1894     nsAString_Finish(&nsfrag_str);
1895     nsIDOMLocation_Release(nslocation);
1896     SysFreeString(frag);
1897     if(NS_FAILED(nsres)) {
1898         ERR("SetHash failed: %08x\n", nsres);
1899         return E_FAIL;
1900     }
1901
1902     if(window->doc_obj->doc_object_service) {
1903         IDocObjectService_FireNavigateComplete2(window->doc_obj->doc_object_service, &window->IHTMLWindow2_iface, 0x10);
1904         IDocObjectService_FireDocumentComplete(window->doc_obj->doc_object_service, &window->IHTMLWindow2_iface, 0);
1905
1906     }
1907
1908     return S_OK;
1909 }
1910
1911 HRESULT super_navigate(HTMLWindow *window, IUri *uri, const WCHAR *headers, BYTE *post_data, DWORD post_data_size)
1912 {
1913     nsChannelBSC *bsc;
1914     IMoniker *mon;
1915     DWORD scheme;
1916     HRESULT hres;
1917
1918     if(window->doc_obj->client) {
1919         IOleCommandTarget *cmdtrg;
1920
1921         hres = IOleClientSite_QueryInterface(window->doc_obj->client, &IID_IOleCommandTarget, (void**)&cmdtrg);
1922         if(SUCCEEDED(hres)) {
1923             VARIANT in, out;
1924             BSTR url_str;
1925
1926             hres = IUri_GetDisplayUri(uri, &url_str);
1927             if(SUCCEEDED(hres)) {
1928                 V_VT(&in) = VT_BSTR;
1929                 V_BSTR(&in) = url_str;
1930                 V_VT(&out) = VT_BOOL;
1931                 V_BOOL(&out) = VARIANT_TRUE;
1932                 hres = IOleCommandTarget_Exec(cmdtrg, &CGID_ShellDocView, 67, 0, &in, &out);
1933                 IOleCommandTarget_Release(cmdtrg);
1934                 if(SUCCEEDED(hres))
1935                     VariantClear(&out);
1936                 SysFreeString(url_str);
1937             }
1938         }
1939     }
1940
1941     if(window->uri && !post_data_size && compare_ignoring_frag(window->uri, uri)) {
1942         TRACE("fragment navigate\n");
1943         return navigate_fragment(window, uri);
1944     }
1945
1946     hres = CreateURLMonikerEx2(NULL, uri, &mon, URL_MK_UNIFORM);
1947     if(FAILED(hres))
1948         return hres;
1949
1950     /* FIXME: Why not set_ready_state? */
1951     window->readystate = READYSTATE_UNINITIALIZED;
1952
1953     hres = create_channelbsc(mon, headers, post_data, post_data_size, &bsc);
1954     if(FAILED(hres)) {
1955         IMoniker_Release(mon);
1956         return hres;
1957     }
1958
1959     prepare_for_binding(&window->doc_obj->basedoc, mon, TRUE);
1960
1961     hres = IUri_GetScheme(uri, &scheme);
1962     if(SUCCEEDED(hres) && scheme != URL_SCHEME_JAVASCRIPT) {
1963         navigate_task_t *task;
1964
1965         task = heap_alloc(sizeof(*task));
1966         if(!task) {
1967             IUnknown_Release((IUnknown*)bsc);
1968             IMoniker_Release(mon);
1969             return E_OUTOFMEMORY;
1970         }
1971
1972         task->window = window;
1973         task->bscallback = bsc;
1974         task->mon = mon;
1975         push_task(&task->header, navigate_proc, navigate_task_destr, window->task_magic);
1976
1977         /* Silently and repeated when real loading starts? */
1978         window->readystate = READYSTATE_LOADING;
1979     }else {
1980         navigate_javascript_task_t *task;
1981
1982         IUnknown_Release((IUnknown*)bsc);
1983         IMoniker_Release(mon);
1984
1985         task = heap_alloc(sizeof(*task));
1986         if(!task)
1987             return E_OUTOFMEMORY;
1988
1989         IUri_AddRef(uri);
1990         task->window = window;
1991         task->uri = uri;
1992         push_task(&task->header, navigate_javascript_proc, navigate_javascript_task_destr, window->task_magic);
1993
1994         /* Why silently? */
1995         window->readystate = READYSTATE_COMPLETE;
1996     }
1997
1998     return S_OK;
1999 }
2000
2001 HRESULT navigate_new_window(HTMLWindow *window, IUri *uri, const WCHAR *name, IHTMLWindow2 **ret)
2002 {
2003     IWebBrowser2 *web_browser;
2004     IHTMLWindow2 *new_window;
2005     IBindCtx *bind_ctx;
2006     nsChannelBSC *bsc;
2007     HRESULT hres;
2008
2009     hres = create_channelbsc(NULL, NULL, NULL, 0, &bsc);
2010     if(FAILED(hres))
2011         return hres;
2012
2013     hres = CreateAsyncBindCtx(0, &bsc->bsc.IBindStatusCallback_iface, NULL, &bind_ctx);
2014     if(FAILED(hres)) {
2015         IBindStatusCallback_Release(&bsc->bsc.IBindStatusCallback_iface);
2016         return hres;
2017     }
2018
2019     hres = CoCreateInstance(&CLSID_InternetExplorer, NULL, CLSCTX_LOCAL_SERVER,
2020             &IID_IWebBrowser2, (void**)&web_browser);
2021     if(SUCCEEDED(hres)) {
2022         ITargetFramePriv2 *target_frame_priv;
2023
2024         hres = IWebBrowser_QueryInterface(web_browser, &IID_ITargetFramePriv2, (void**)&target_frame_priv);
2025         if(SUCCEEDED(hres)) {
2026             hres = ITargetFramePriv2_AggregatedNavigation2(target_frame_priv,
2027                     HLNF_DISABLEWINDOWRESTRICTIONS|HLNF_OPENINNEWWINDOW, bind_ctx, &bsc->bsc.IBindStatusCallback_iface,
2028                     name, uri, emptyW);
2029             ITargetFramePriv2_Release(target_frame_priv);
2030
2031             if(SUCCEEDED(hres))
2032                 hres = do_query_service((IUnknown*)web_browser, &SID_SHTMLWindow, &IID_IHTMLWindow2, (void**)&new_window);
2033         }
2034         if(FAILED(hres)) {
2035             IWebBrowser2_Quit(web_browser);
2036             IWebBrowser2_Release(web_browser);
2037         }
2038     }else {
2039         WARN("Could not create InternetExplorer instance: %08x\n", hres);
2040     }
2041
2042     IBindStatusCallback_Release(&bsc->bsc.IBindStatusCallback_iface);
2043     IBindCtx_Release(bind_ctx);
2044     if(FAILED(hres))
2045         return hres;
2046
2047     IWebBrowser2_put_Visible(web_browser, VARIANT_TRUE);
2048     IWebBrowser2_Release(web_browser);
2049
2050     if(ret)
2051         *ret = new_window;
2052     else
2053         IHTMLWindow2_Release(new_window);
2054     return S_OK;
2055 }
2056
2057 HRESULT hlink_frame_navigate(HTMLDocument *doc, LPCWSTR url, nsChannel *nschannel, DWORD hlnf, BOOL *cancel)
2058 {
2059     IHlinkFrame *hlink_frame;
2060     nsChannelBSC *callback;
2061     IBindCtx *bindctx;
2062     IMoniker *mon;
2063     IHlink *hlink;
2064     HRESULT hres;
2065
2066     *cancel = FALSE;
2067
2068     hres = do_query_service((IUnknown*)doc->doc_obj->client, &IID_IHlinkFrame, &IID_IHlinkFrame,
2069             (void**)&hlink_frame);
2070     if(FAILED(hres))
2071         return S_OK;
2072
2073     hres = create_channelbsc(NULL, NULL, NULL, 0, &callback);
2074     if(FAILED(hres)) {
2075         IHlinkFrame_Release(hlink_frame);
2076         return hres;
2077     }
2078
2079     if(nschannel)
2080         read_post_data_stream(callback, nschannel);
2081
2082     hres = CreateAsyncBindCtx(0, &callback->bsc.IBindStatusCallback_iface, NULL, &bindctx);
2083     if(SUCCEEDED(hres))
2084         hres = CoCreateInstance(&CLSID_StdHlink, NULL, CLSCTX_INPROC_SERVER,
2085                 &IID_IHlink, (LPVOID*)&hlink);
2086
2087     if(SUCCEEDED(hres))
2088         hres = CreateURLMoniker(NULL, url, &mon);
2089
2090     if(SUCCEEDED(hres)) {
2091         IHlink_SetMonikerReference(hlink, HLINKSETF_TARGET, mon, NULL);
2092
2093         if(hlnf & HLNF_OPENINNEWWINDOW) {
2094             static const WCHAR wszBlank[] = {'_','b','l','a','n','k',0};
2095             IHlink_SetTargetFrameName(hlink, wszBlank); /* FIXME */
2096         }
2097
2098         hres = IHlinkFrame_Navigate(hlink_frame, hlnf, bindctx,
2099                 &callback->bsc.IBindStatusCallback_iface, hlink);
2100         IMoniker_Release(mon);
2101         *cancel = hres == S_OK;
2102         hres = S_OK;
2103     }
2104
2105     IHlinkFrame_Release(hlink_frame);
2106     IBindCtx_Release(bindctx);
2107     IBindStatusCallback_Release(&callback->bsc.IBindStatusCallback_iface);
2108     return hres;
2109 }
2110
2111 HRESULT navigate_url(HTMLWindow *window, const WCHAR *new_url, const WCHAR *base_url)
2112 {
2113     WCHAR url[INTERNET_MAX_URL_LENGTH];
2114     nsWineURI *uri;
2115     HRESULT hres;
2116
2117     if(!new_url) {
2118         *url = 0;
2119     }else if(base_url) {
2120         DWORD len = 0;
2121
2122         hres = CoInternetCombineUrl(base_url, new_url, URL_ESCAPE_SPACES_ONLY|URL_DONT_ESCAPE_EXTRA_INFO,
2123                 url, sizeof(url)/sizeof(WCHAR), &len, 0);
2124         if(FAILED(hres))
2125             return hres;
2126     }else {
2127         strcpyW(url, new_url);
2128     }
2129
2130     if(window->doc_obj && window->doc_obj->hostui) {
2131         OLECHAR *translated_url = NULL;
2132
2133         hres = IDocHostUIHandler_TranslateUrl(window->doc_obj->hostui, 0, url,
2134                 &translated_url);
2135         if(hres == S_OK) {
2136             TRACE("%08x %s -> %s\n", hres, debugstr_w(url), debugstr_w(translated_url));
2137             strcpyW(url, translated_url);
2138             CoTaskMemFree(translated_url);
2139         }
2140     }
2141
2142     if(window->doc_obj && window->doc_obj->is_webbrowser && window == window->doc_obj->basedoc.window) {
2143         BOOL cancel = FALSE;
2144         IUri *uri;
2145
2146         hres = IDocObjectService_FireBeforeNavigate2(window->doc_obj->doc_object_service, NULL, url, 0x40,
2147                 NULL, NULL, 0, NULL, TRUE, &cancel);
2148         if(SUCCEEDED(hres) && cancel) {
2149             TRACE("Navigation canceled\n");
2150             return S_OK;
2151         }
2152
2153         hres = CreateUri(url, 0, 0, &uri);
2154         if(FAILED(hres))
2155             return hres;
2156
2157         hres = super_navigate(window, uri, NULL, NULL, 0);
2158         IUri_Release(uri);
2159         return hres;
2160     }
2161
2162     if(window->doc_obj && window == window->doc_obj->basedoc.window) {
2163         BOOL cancel;
2164
2165         hres = hlink_frame_navigate(&window->doc->basedoc, url, NULL, 0, &cancel);
2166         if(FAILED(hres))
2167             return hres;
2168
2169         if(cancel) {
2170             TRACE("Navigation handled by hlink frame\n");
2171             return S_OK;
2172         }
2173     }
2174
2175     hres = create_doc_uri(window, url, &uri);
2176     if(FAILED(hres))
2177         return hres;
2178
2179     hres = load_nsuri(window, uri, NULL, LOAD_FLAGS_NONE);
2180     nsISupports_Release((nsISupports*)uri);
2181     return hres;
2182 }