dlls/mshtml/navigate.c

   1 /*
   2  * Copyright 2006-2010 Jacek Caban for CodeWeavers
   3  *
   4  * This library is free software; you can redistribute it and/or
   5  * modify it under the terms of the GNU Lesser General Public
   6  * License as published by the Free Software Foundation; either
   7  * version 2.1 of the License, or (at your option) any later version.
   8  *
   9  * This library is distributed in the hope that it will be useful,
  10  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  11  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  12  * Lesser General Public License for more details.
  13  *
  14  * You should have received a copy of the GNU Lesser General Public
  15  * License along with this library; if not, write to the Free Software
  16  * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
  17  */
  18
  19 #include "config.h"
  20
  21 #include <stdarg.h>
  22
  23 #define COBJMACROS
  24 #define NONAMELESSUNION
  25 #define NONAMELESSSTRUCT
  26
  27 #include "windef.h"
  28 #include "winbase.h"
  29 #include "winuser.h"
  30 #include "winreg.h"
  31 #include "ole2.h"
  32 #include "hlguids.h"
  33 #include "shlguid.h"
  34 #include "wininet.h"
  35 #include "shlwapi.h"
  36 #include "htiface.h"
  37 #include "shdeprecated.h"
  38
  39 #include "wine/debug.h"
  40
  41 #include "mshtml_private.h"
  42 #include "binding.h"
  43
  44 WINE_DEFAULT_DEBUG_CHANNEL(mshtml);
  45
  46 #define CONTENT_LENGTH "Content-Length"
  47 #define UTF8_STR "utf-8"
  48 #define UTF16_STR "utf-16"
  49
  50 static const WCHAR emptyW[] = {0};
  51 static const WCHAR text_htmlW[] = {'t','e','x','t','/','h','t','m','l',0};
  52
  53 struct nsProtocolStream {
  54     nsIInputStream nsIInputStream_iface;
  55
  56     LONG ref;
  57
  58     char buf[1024];
  59     DWORD buf_size;
  60 };
  61
  62 struct BSCallbackVtbl {
  63     void (*destroy)(BSCallback*);
  64     HRESULT (*init_bindinfo)(BSCallback*);
  65     HRESULT (*start_binding)(BSCallback*);
  66     HRESULT (*stop_binding)(BSCallback*,HRESULT);
  67     HRESULT (*read_data)(BSCallback*,IStream*);
  68     HRESULT (*on_progress)(BSCallback*,ULONG,LPCWSTR);
  69     HRESULT (*on_response)(BSCallback*,DWORD,LPCWSTR);
  70     HRESULT (*beginning_transaction)(BSCallback*,WCHAR**);
  71 };
  72
  73 static inline nsProtocolStream *impl_from_nsIInputStream(nsIInputStream *iface)
  74 {
  75     return CONTAINING_RECORD(iface, nsProtocolStream, nsIInputStream_iface);
  76 }
  77
  78 static nsresult NSAPI nsInputStream_QueryInterface(nsIInputStream *iface, nsIIDRef riid,
  79         void **result)
  80 {
  81     nsProtocolStream *This = impl_from_nsIInputStream(iface);
  82
  83     *result = NULL;
  84
  85     if(IsEqualGUID(&IID_nsISupports, riid)) {
  86         TRACE("(%p)->(IID_nsISupports %p)\n", This, result);
  87         *result  = &This->nsIInputStream_iface;
  88     }else if(IsEqualGUID(&IID_nsIInputStream, riid)) {
  89         TRACE("(%p)->(IID_nsIInputStream %p)\n", This, result);
  90         *result  = &This->nsIInputStream_iface;
  91     }
  92
  93     if(*result) {
  94         nsIInputStream_AddRef(&This->nsIInputStream_iface);
  95         return NS_OK;
  96     }
  97
  98     WARN("unsupported interface %s\n", debugstr_guid(riid));
  99     return NS_NOINTERFACE;
 100 }
 101
 102 static nsrefcnt NSAPI nsInputStream_AddRef(nsIInputStream *iface)
 103 {
 104     nsProtocolStream *This = impl_from_nsIInputStream(iface);
 105     LONG ref = InterlockedIncrement(&This->ref);
 106
 107     TRACE("(%p) ref=%d\n", This, ref);
 108
 109     return ref;
 110 }
 111
 112
 113 static nsrefcnt NSAPI nsInputStream_Release(nsIInputStream *iface)
 114 {
 115     nsProtocolStream *This = impl_from_nsIInputStream(iface);
 116     LONG ref = InterlockedDecrement(&This->ref);
 117
 118     TRACE("(%p) ref=%d\n", This, ref);
 119
 120     if(!ref)
 121         heap_free(This);
 122
 123     return ref;
 124 }
 125
 126 static nsresult NSAPI nsInputStream_Close(nsIInputStream *iface)
 127 {
 128     nsProtocolStream *This = impl_from_nsIInputStream(iface);
 129     FIXME("(%p)\n", This);
 130     return NS_ERROR_NOT_IMPLEMENTED;
 131 }
 132
 133 static nsresult NSAPI nsInputStream_Available(nsIInputStream *iface, PRUint32 *_retval)
 134 {
 135     nsProtocolStream *This = impl_from_nsIInputStream(iface);
 136     FIXME("(%p)->(%p)\n", This, _retval);
 137     return NS_ERROR_NOT_IMPLEMENTED;
 138 }
 139
 140 static nsresult NSAPI nsInputStream_Read(nsIInputStream *iface, char *aBuf, PRUint32 aCount,
 141                                          PRUint32 *_retval)
 142 {
 143     nsProtocolStream *This = impl_from_nsIInputStream(iface);
 144     DWORD read = aCount;
 145
 146     TRACE("(%p)->(%p %d %p)\n", This, aBuf, aCount, _retval);
 147
 148     if(read > This->buf_size)
 149         read = This->buf_size;
 150
 151     if(read) {
 152         memcpy(aBuf, This->buf, read);
 153         if(read < This->buf_size)
 154             memmove(This->buf, This->buf+read, This->buf_size-read);
 155         This->buf_size -= read;
 156     }
 157
 158     *_retval = read;
 159     return NS_OK;
 160 }
 161
 162 static nsresult NSAPI nsInputStream_ReadSegments(nsIInputStream *iface,
 163         nsresult (WINAPI *aWriter)(nsIInputStream*,void*,const char*,PRUint32,PRUint32,PRUint32*),
 164         void *aClousure, PRUint32 aCount, PRUint32 *_retval)
 165 {
 166     nsProtocolStream *This = impl_from_nsIInputStream(iface);
 167     PRUint32 written = 0;
 168     nsresult nsres;
 169
 170     TRACE("(%p)->(%p %p %d %p)\n", This, aWriter, aClousure, aCount, _retval);
 171
 172     if(!This->buf_size)
 173         return S_OK;
 174
 175     if(aCount > This->buf_size)
 176         aCount = This->buf_size;
 177
 178     nsres = aWriter(&This->nsIInputStream_iface, aClousure, This->buf, 0, aCount, &written);
 179     if(NS_FAILED(nsres))
 180         TRACE("aWritter failed: %08x\n", nsres);
 181     else if(written != This->buf_size)
 182         FIXME("written %d != buf_size %d\n", written, This->buf_size);
 183
 184     This->buf_size -= written;
 185
 186     *_retval = written;
 187     return nsres;
 188 }
 189
 190 static nsresult NSAPI nsInputStream_IsNonBlocking(nsIInputStream *iface, cpp_bool *_retval)
 191 {
 192     nsProtocolStream *This = impl_from_nsIInputStream(iface);
 193     FIXME("(%p)->(%p)\n", This, _retval);
 194     return NS_ERROR_NOT_IMPLEMENTED;
 195 }
 196
 197 static const nsIInputStreamVtbl nsInputStreamVtbl = {
 198     nsInputStream_QueryInterface,
 199     nsInputStream_AddRef,
 200     nsInputStream_Release,
 201     nsInputStream_Close,
 202     nsInputStream_Available,
 203     nsInputStream_Read,
 204     nsInputStream_ReadSegments,
 205     nsInputStream_IsNonBlocking
 206 };
 207
 208 static nsProtocolStream *create_nsprotocol_stream(void)
 209 {
 210     nsProtocolStream *ret = heap_alloc(sizeof(nsProtocolStream));
 211
 212     ret->nsIInputStream_iface.lpVtbl = &nsInputStreamVtbl;
 213     ret->ref = 1;
 214     ret->buf_size = 0;
 215
 216     return ret;
 217 }
 218
 219 static inline BSCallback *impl_from_IBindStatusCallback(IBindStatusCallback *iface)
 220 {
 221     return CONTAINING_RECORD(iface, BSCallback, IBindStatusCallback_iface);
 222 }
 223
 224 static HRESULT WINAPI BindStatusCallback_QueryInterface(IBindStatusCallback *iface,
 225         REFIID riid, void **ppv)
 226 {
 227     BSCallback *This = impl_from_IBindStatusCallback(iface);
 228
 229     *ppv = NULL;
 230     if(IsEqualGUID(&IID_IUnknown, riid)) {
 231         TRACE("(%p)->(IID_IUnknown, %p)\n", This, ppv);
 232         *ppv = &This->IBindStatusCallback_iface;
 233     }else if(IsEqualGUID(&IID_IBindStatusCallback, riid)) {
 234         TRACE("(%p)->(IID_IBindStatusCallback, %p)\n", This, ppv);
 235         *ppv = &This->IBindStatusCallback_iface;
 236     }else if(IsEqualGUID(&IID_IServiceProvider, riid)) {
 237         TRACE("(%p)->(IID_IServiceProvider %p)\n", This, ppv);
 238         *ppv = &This->IServiceProvider_iface;
 239     }else if(IsEqualGUID(&IID_IHttpNegotiate, riid)) {
 240         TRACE("(%p)->(IID_IHttpNegotiate %p)\n", This, ppv);
 241         *ppv = &This->IHttpNegotiate2_iface;
 242     }else if(IsEqualGUID(&IID_IHttpNegotiate2, riid)) {
 243         TRACE("(%p)->(IID_IHttpNegotiate2 %p)\n", This, ppv);
 244         *ppv = &This->IHttpNegotiate2_iface;
 245     }else if(IsEqualGUID(&IID_IInternetBindInfo, riid)) {
 246         TRACE("(%p)->(IID_IInternetBindInfo %p)\n", This, ppv);
 247         *ppv = &This->IInternetBindInfo_iface;
 248     }
 249
 250     if(*ppv) {
 251         IBindStatusCallback_AddRef(&This->IBindStatusCallback_iface);
 252         return S_OK;
 253     }
 254
 255     TRACE("Unsupported riid = %s\n", debugstr_guid(riid));
 256     return E_NOINTERFACE;
 257 }
 258
 259 static ULONG WINAPI BindStatusCallback_AddRef(IBindStatusCallback *iface)
 260 {
 261     BSCallback *This = impl_from_IBindStatusCallback(iface);
 262     LONG ref = InterlockedIncrement(&This->ref);
 263
 264     TRACE("(%p) ref = %d\n", This, ref);
 265
 266     return ref;
 267 }
 268
 269 static ULONG WINAPI BindStatusCallback_Release(IBindStatusCallback *iface)
 270 {
 271     BSCallback *This = impl_from_IBindStatusCallback(iface);
 272     LONG ref = InterlockedDecrement(&This->ref);
 273
 274     TRACE("(%p) ref = %d\n", This, ref);
 275
 276     if(!ref) {
 277         if(This->post_data)
 278             GlobalFree(This->post_data);
 279         if(This->mon)
 280             IMoniker_Release(This->mon);
 281         if(This->binding)
 282             IBinding_Release(This->binding);
 283         list_remove(&This->entry);
 284         list_init(&This->entry);
 285         heap_free(This->headers);
 286
 287         This->vtbl->destroy(This);
 288     }
 289
 290     return ref;
 291 }
 292
 293 static HRESULT WINAPI BindStatusCallback_OnStartBinding(IBindStatusCallback *iface,
 294         DWORD dwReserved, IBinding *pbind)
 295 {
 296     BSCallback *This = impl_from_IBindStatusCallback(iface);
 297
 298     TRACE("(%p)->(%d %p)\n", This, dwReserved, pbind);
 299
 300     IBinding_AddRef(pbind);
 301     This->binding = pbind;
 302
 303     if(This->window)
 304         list_add_head(&This->window->bindings, &This->entry);
 305
 306     return This->vtbl->start_binding(This);
 307 }
 308
 309 static HRESULT WINAPI BindStatusCallback_GetPriority(IBindStatusCallback *iface, LONG *pnPriority)
 310 {
 311     BSCallback *This = impl_from_IBindStatusCallback(iface);
 312     FIXME("(%p)->(%p)\n", This, pnPriority);
 313     return E_NOTIMPL;
 314 }
 315
 316 static HRESULT WINAPI BindStatusCallback_OnLowResource(IBindStatusCallback *iface, DWORD reserved)
 317 {
 318     BSCallback *This = impl_from_IBindStatusCallback(iface);
 319     FIXME("(%p)->(%d)\n", This, reserved);
 320     return E_NOTIMPL;
 321 }
 322
 323 static HRESULT WINAPI BindStatusCallback_OnProgress(IBindStatusCallback *iface, ULONG ulProgress,
 324         ULONG ulProgressMax, ULONG ulStatusCode, LPCWSTR szStatusText)
 325 {
 326     BSCallback *This = impl_from_IBindStatusCallback(iface);
 327
 328     TRACE("%p)->(%u %u %u %s)\n", This, ulProgress, ulProgressMax, ulStatusCode,
 329             debugstr_w(szStatusText));
 330
 331     return This->vtbl->on_progress(This, ulStatusCode, szStatusText);
 332 }
 333
 334 static HRESULT WINAPI BindStatusCallback_OnStopBinding(IBindStatusCallback *iface,
 335         HRESULT hresult, LPCWSTR szError)
 336 {
 337     BSCallback *This = impl_from_IBindStatusCallback(iface);
 338     HRESULT hres;
 339
 340     TRACE("(%p)->(%08x %s)\n", This, hresult, debugstr_w(szError));
 341
 342     /* NOTE: IE7 calls GetBindResult here */
 343
 344     hres = This->vtbl->stop_binding(This, hresult);
 345
 346     if(This->binding) {
 347         IBinding_Release(This->binding);
 348         This->binding = NULL;
 349     }
 350
 351     list_remove(&This->entry);
 352     list_init(&This->entry);
 353     This->window = NULL;
 354
 355     return hres;
 356 }
 357
 358 static HRESULT WINAPI BindStatusCallback_GetBindInfo(IBindStatusCallback *iface,
 359         DWORD *grfBINDF, BINDINFO *pbindinfo)
 360 {
 361     BSCallback *This = impl_from_IBindStatusCallback(iface);
 362     DWORD size;
 363
 364     TRACE("(%p)->(%p %p)\n", This, grfBINDF, pbindinfo);
 365
 366     if(!This->bindinfo_ready) {
 367         HRESULT hres;
 368
 369         hres = This->vtbl->init_bindinfo(This);
 370         if(FAILED(hres))
 371             return hres;
 372
 373         This->bindinfo_ready = TRUE;
 374     }
 375
 376     *grfBINDF = This->bindf;
 377
 378     size = pbindinfo->cbSize;
 379     memset(pbindinfo, 0, size);
 380     pbindinfo->cbSize = size;
 381
 382     pbindinfo->cbstgmedData = This->post_data_len;
 383     pbindinfo->dwCodePage = CP_UTF8;
 384     pbindinfo->dwOptions = 0x80000;
 385
 386     if(This->post_data) {
 387         pbindinfo->dwBindVerb = BINDVERB_POST;
 388
 389         pbindinfo->stgmedData.tymed = TYMED_HGLOBAL;
 390         pbindinfo->stgmedData.u.hGlobal = This->post_data;
 391         pbindinfo->stgmedData.pUnkForRelease = (IUnknown*)&This->IBindStatusCallback_iface;
 392         IBindStatusCallback_AddRef(&This->IBindStatusCallback_iface);
 393     }
 394
 395     return S_OK;
 396 }
 397
 398 static HRESULT WINAPI BindStatusCallback_OnDataAvailable(IBindStatusCallback *iface,
 399         DWORD grfBSCF, DWORD dwSize, FORMATETC *pformatetc, STGMEDIUM *pstgmed)
 400 {
 401     BSCallback *This = impl_from_IBindStatusCallback(iface);
 402
 403     TRACE("(%p)->(%08x %d %p %p)\n", This, grfBSCF, dwSize, pformatetc, pstgmed);
 404
 405     return This->vtbl->read_data(This, pstgmed->u.pstm);
 406 }
 407
 408 static HRESULT WINAPI BindStatusCallback_OnObjectAvailable(IBindStatusCallback *iface,
 409         REFIID riid, IUnknown *punk)
 410 {
 411     BSCallback *This = impl_from_IBindStatusCallback(iface);
 412     FIXME("(%p)->(%s %p)\n", This, debugstr_guid(riid), punk);
 413     return E_NOTIMPL;
 414 }
 415
 416 static const IBindStatusCallbackVtbl BindStatusCallbackVtbl = {
 417     BindStatusCallback_QueryInterface,
 418     BindStatusCallback_AddRef,
 419     BindStatusCallback_Release,
 420     BindStatusCallback_OnStartBinding,
 421     BindStatusCallback_GetPriority,
 422     BindStatusCallback_OnLowResource,
 423     BindStatusCallback_OnProgress,
 424     BindStatusCallback_OnStopBinding,
 425     BindStatusCallback_GetBindInfo,
 426     BindStatusCallback_OnDataAvailable,
 427     BindStatusCallback_OnObjectAvailable
 428 };
 429
 430 static inline BSCallback *impl_from_IHttpNegotiate2(IHttpNegotiate2 *iface)
 431 {
 432     return CONTAINING_RECORD(iface, BSCallback, IHttpNegotiate2_iface);
 433 }
 434
 435 static HRESULT WINAPI HttpNegotiate_QueryInterface(IHttpNegotiate2 *iface,
 436                                                    REFIID riid, void **ppv)
 437 {
 438     BSCallback *This = impl_from_IHttpNegotiate2(iface);
 439     return IBindStatusCallback_QueryInterface(&This->IBindStatusCallback_iface, riid, ppv);
 440 }
 441
 442 static ULONG WINAPI HttpNegotiate_AddRef(IHttpNegotiate2 *iface)
 443 {
 444     BSCallback *This = impl_from_IHttpNegotiate2(iface);
 445     return IBindStatusCallback_AddRef(&This->IBindStatusCallback_iface);
 446 }
 447
 448 static ULONG WINAPI HttpNegotiate_Release(IHttpNegotiate2 *iface)
 449 {
 450     BSCallback *This = impl_from_IHttpNegotiate2(iface);
 451     return IBindStatusCallback_Release(&This->IBindStatusCallback_iface);
 452 }
 453
 454 static HRESULT WINAPI HttpNegotiate_BeginningTransaction(IHttpNegotiate2 *iface,
 455         LPCWSTR szURL, LPCWSTR szHeaders, DWORD dwReserved, LPWSTR *pszAdditionalHeaders)
 456 {
 457     BSCallback *This = impl_from_IHttpNegotiate2(iface);
 458     HRESULT hres;
 459
 460     TRACE("(%p)->(%s %s %d %p)\n", This, debugstr_w(szURL), debugstr_w(szHeaders),
 461           dwReserved, pszAdditionalHeaders);
 462
 463     *pszAdditionalHeaders = NULL;
 464
 465     hres = This->vtbl->beginning_transaction(This, pszAdditionalHeaders);
 466     if(hres != S_FALSE)
 467         return hres;
 468
 469     if(This->headers) {
 470         DWORD size;
 471
 472         size = (strlenW(This->headers)+1)*sizeof(WCHAR);
 473         *pszAdditionalHeaders = CoTaskMemAlloc(size);
 474         if(!*pszAdditionalHeaders)
 475             return E_OUTOFMEMORY;
 476         memcpy(*pszAdditionalHeaders, This->headers, size);
 477     }
 478
 479     return S_OK;
 480 }
 481
 482 static HRESULT WINAPI HttpNegotiate_OnResponse(IHttpNegotiate2 *iface, DWORD dwResponseCode,
 483         LPCWSTR szResponseHeaders, LPCWSTR szRequestHeaders, LPWSTR *pszAdditionalRequestHeaders)
 484 {
 485     BSCallback *This = impl_from_IHttpNegotiate2(iface);
 486
 487     TRACE("(%p)->(%d %s %s %p)\n", This, dwResponseCode, debugstr_w(szResponseHeaders),
 488           debugstr_w(szRequestHeaders), pszAdditionalRequestHeaders);
 489
 490     return This->vtbl->on_response(This, dwResponseCode, szResponseHeaders);
 491 }
 492
 493 static HRESULT WINAPI HttpNegotiate_GetRootSecurityId(IHttpNegotiate2 *iface,
 494         BYTE *pbSecurityId, DWORD *pcbSecurityId, DWORD_PTR dwReserved)
 495 {
 496     BSCallback *This = impl_from_IHttpNegotiate2(iface);
 497     FIXME("(%p)->(%p %p %ld)\n", This, pbSecurityId, pcbSecurityId, dwReserved);
 498     return E_NOTIMPL;
 499 }
 500
 501 static const IHttpNegotiate2Vtbl HttpNegotiate2Vtbl = {
 502     HttpNegotiate_QueryInterface,
 503     HttpNegotiate_AddRef,
 504     HttpNegotiate_Release,
 505     HttpNegotiate_BeginningTransaction,
 506     HttpNegotiate_OnResponse,
 507     HttpNegotiate_GetRootSecurityId
 508 };
 509
 510 static inline BSCallback *impl_from_IInternetBindInfo(IInternetBindInfo *iface)
 511 {
 512     return CONTAINING_RECORD(iface, BSCallback, IInternetBindInfo_iface);
 513 }
 514
 515 static HRESULT WINAPI InternetBindInfo_QueryInterface(IInternetBindInfo *iface,
 516                                                       REFIID riid, void **ppv)
 517 {
 518     BSCallback *This = impl_from_IInternetBindInfo(iface);
 519     return IBindStatusCallback_QueryInterface(&This->IBindStatusCallback_iface, riid, ppv);
 520 }
 521
 522 static ULONG WINAPI InternetBindInfo_AddRef(IInternetBindInfo *iface)
 523 {
 524     BSCallback *This = impl_from_IInternetBindInfo(iface);
 525     return IBindStatusCallback_AddRef(&This->IBindStatusCallback_iface);
 526 }
 527
 528 static ULONG WINAPI InternetBindInfo_Release(IInternetBindInfo *iface)
 529 {
 530     BSCallback *This = impl_from_IInternetBindInfo(iface);
 531     return IBindStatusCallback_Release(&This->IBindStatusCallback_iface);
 532 }
 533
 534 static HRESULT WINAPI InternetBindInfo_GetBindInfo(IInternetBindInfo *iface,
 535                                                    DWORD *grfBINDF, BINDINFO *pbindinfo)
 536 {
 537     BSCallback *This = impl_from_IInternetBindInfo(iface);
 538     FIXME("(%p)->(%p %p)\n", This, grfBINDF, pbindinfo);
 539     return E_NOTIMPL;
 540 }
 541
 542 static HRESULT WINAPI InternetBindInfo_GetBindString(IInternetBindInfo *iface,
 543         ULONG ulStringType, LPOLESTR *ppwzStr, ULONG cEl, ULONG *pcElFetched)
 544 {
 545     BSCallback *This = impl_from_IInternetBindInfo(iface);
 546     FIXME("(%p)->(%u %p %u %p)\n", This, ulStringType, ppwzStr, cEl, pcElFetched);
 547     return E_NOTIMPL;
 548 }
 549
 550 static const IInternetBindInfoVtbl InternetBindInfoVtbl = {
 551     InternetBindInfo_QueryInterface,
 552     InternetBindInfo_AddRef,
 553     InternetBindInfo_Release,
 554     InternetBindInfo_GetBindInfo,
 555     InternetBindInfo_GetBindString
 556 };
 557
 558 static inline BSCallback *impl_from_IServiceProvider(IServiceProvider *iface)
 559 {
 560     return CONTAINING_RECORD(iface, BSCallback, IServiceProvider_iface);
 561 }
 562
 563 static HRESULT WINAPI BSCServiceProvider_QueryInterface(IServiceProvider *iface,
 564                                                         REFIID riid, void **ppv)
 565 {
 566     BSCallback *This = impl_from_IServiceProvider(iface);
 567     return IBindStatusCallback_QueryInterface(&This->IBindStatusCallback_iface, riid, ppv);
 568 }
 569
 570 static ULONG WINAPI BSCServiceProvider_AddRef(IServiceProvider *iface)
 571 {
 572     BSCallback *This = impl_from_IServiceProvider(iface);
 573     return IBindStatusCallback_AddRef(&This->IBindStatusCallback_iface);
 574 }
 575
 576 static ULONG WINAPI BSCServiceProvider_Release(IServiceProvider *iface)
 577 {
 578     BSCallback *This = impl_from_IServiceProvider(iface);
 579     return IBindStatusCallback_Release(&This->IBindStatusCallback_iface);
 580 }
 581
 582 static HRESULT WINAPI BSCServiceProvider_QueryService(IServiceProvider *iface,
 583         REFGUID guidService, REFIID riid, void **ppv)
 584 {
 585     BSCallback *This = impl_from_IServiceProvider(iface);
 586
 587     TRACE("(%p)->(%s %s %p)\n", This, debugstr_guid(guidService), debugstr_guid(riid), ppv);
 588
 589     if(This->window && IsEqualGUID(guidService, &IID_IWindowForBindingUI))
 590         return IServiceProvider_QueryService(&This->window->base.IServiceProvider_iface, guidService, riid, ppv);
 591     return E_NOINTERFACE;
 592 }
 593
 594 static const IServiceProviderVtbl ServiceProviderVtbl = {
 595     BSCServiceProvider_QueryInterface,
 596     BSCServiceProvider_AddRef,
 597     BSCServiceProvider_Release,
 598     BSCServiceProvider_QueryService
 599 };
 600
 601 static void init_bscallback(BSCallback *This, const BSCallbackVtbl *vtbl, IMoniker *mon, DWORD bindf)
 602 {
 603     This->IBindStatusCallback_iface.lpVtbl = &BindStatusCallbackVtbl;
 604     This->IServiceProvider_iface.lpVtbl = &ServiceProviderVtbl;
 605     This->IHttpNegotiate2_iface.lpVtbl = &HttpNegotiate2Vtbl;
 606     This->IInternetBindInfo_iface.lpVtbl = &InternetBindInfoVtbl;
 607     This->vtbl = vtbl;
 608     This->ref = 1;
 609     This->bindf = bindf;
 610
 611     list_init(&This->entry);
 612
 613     if(mon)
 614         IMoniker_AddRef(mon);
 615     This->mon = mon;
 616 }
 617
 618 static HRESULT read_stream(BSCallback *This, IStream *stream, void *buf, DWORD size, DWORD *ret_size)
 619 {
 620     DWORD read_size = 0;
 621     HRESULT hres;
 622
 623     hres = IStream_Read(stream, buf, size, &read_size);
 624     This->readed += (*ret_size = read_size);
 625     return hres;
 626 }
 627
 628 static void parse_content_type(nsChannelBSC *This, const WCHAR *value)
 629 {
 630     const WCHAR *ptr;
 631     size_t len;
 632
 633     static const WCHAR charsetW[] = {'c','h','a','r','s','e','t','='};
 634
 635     ptr = strchrW(value, ';');
 636     if(!ptr)
 637         return;
 638
 639     ptr++;
 640     while(*ptr && isspaceW(*ptr))
 641         ptr++;
 642
 643     len = strlenW(value);
 644     if(ptr + sizeof(charsetW)/sizeof(WCHAR) < value+len && !memicmpW(ptr, charsetW, sizeof(charsetW)/sizeof(WCHAR))) {
 645         size_t charset_len, lena;
 646         nsACString charset_str;
 647         const WCHAR *charset;
 648         char *charseta;
 649
 650         ptr += sizeof(charsetW)/sizeof(WCHAR);
 651
 652         if(*ptr == '\'') {
 653             FIXME("Quoted value\n");
 654             return;
 655         }else {
 656             charset = ptr;
 657             while(*ptr && *ptr != ',')
 658                 ptr++;
 659             charset_len = ptr-charset;
 660         }
 661
 662         lena = WideCharToMultiByte(CP_ACP, 0, charset, charset_len, NULL, 0, NULL, NULL);
 663         charseta = heap_alloc(lena+1);
 664         if(!charseta)
 665             return;
 666
 667         WideCharToMultiByte(CP_ACP, 0, charset, charset_len, charseta, lena, NULL, NULL);
 668         charseta[lena] = 0;
 669
 670         nsACString_InitDepend(&charset_str, charseta);
 671         nsIHttpChannel_SetContentCharset(&This->nschannel->nsIHttpChannel_iface, &charset_str);
 672         nsACString_Finish(&charset_str);
 673         heap_free(charseta);
 674     }else {
 675         FIXME("unhandled: %s\n", debugstr_wn(ptr, len - (ptr-value)));
 676     }
 677 }
 678
 679 static HRESULT parse_headers(const WCHAR *headers, struct list *headers_list)
 680 {
 681     const WCHAR *header, *header_end, *colon, *value;
 682     HRESULT hres;
 683
 684     header = headers;
 685     while(*header) {
 686         if(header[0] == '\r' && header[1] == '\n' && !header[2])
 687             break;
 688         for(colon = header; *colon && *colon != ':' && *colon != '\r'; colon++);
 689         if(*colon != ':')
 690             return E_FAIL;
 691
 692         value = colon+1;
 693         while(*value == ' ')
 694             value++;
 695         if(!*value)
 696             return E_FAIL;
 697
 698         for(header_end = value+1; *header_end && *header_end != '\r'; header_end++);
 699
 700         hres = set_http_header(headers_list, header, colon-header, value, header_end-value);
 701         if(FAILED(hres))
 702             return hres;
 703
 704         header = header_end;
 705         if(header[0] == '\r' && header[1] == '\n')
 706             header += 2;
 707     }
 708
 709     return S_OK;
 710 }
 711
 712 static HRESULT process_response_headers(nsChannelBSC *This, const WCHAR *headers)
 713 {
 714     http_header_t *iter;
 715     HRESULT hres;
 716
 717     static const WCHAR content_typeW[] = {'c','o','n','t','e','n','t','-','t','y','p','e',0};
 718
 719     hres = parse_headers(headers, &This->nschannel->response_headers);
 720     if(FAILED(hres))
 721         return hres;
 722
 723     LIST_FOR_EACH_ENTRY(iter, &This->nschannel->response_headers, http_header_t, entry) {
 724         if(!strcmpiW(iter->header, content_typeW))
 725             parse_content_type(This, iter->data);
 726     }
 727
 728     return S_OK;
 729 }
 730
 731 HRESULT start_binding(HTMLInnerWindow *inner_window, BSCallback *bscallback, IBindCtx *bctx)
 732 {
 733     IStream *str = NULL;
 734     HRESULT hres;
 735
 736     TRACE("(%p %p %p)\n", inner_window, bscallback, bctx);
 737
 738     bscallback->window = inner_window;
 739
 740     /* NOTE: IE7 calls IsSystemMoniker here*/
 741
 742     if(bctx) {
 743         RegisterBindStatusCallback(bctx, &bscallback->IBindStatusCallback_iface, NULL, 0);
 744         IBindCtx_AddRef(bctx);
 745     }else {
 746         hres = CreateAsyncBindCtx(0, &bscallback->IBindStatusCallback_iface, NULL, &bctx);
 747         if(FAILED(hres)) {
 748             WARN("CreateAsyncBindCtx failed: %08x\n", hres);
 749             bscallback->vtbl->stop_binding(bscallback, hres);
 750             return hres;
 751         }
 752     }
 753
 754     hres = IMoniker_BindToStorage(bscallback->mon, bctx, NULL, &IID_IStream, (void**)&str);
 755     IBindCtx_Release(bctx);
 756     if(FAILED(hres)) {
 757         WARN("BindToStorage failed: %08x\n", hres);
 758         bscallback->vtbl->stop_binding(bscallback, hres);
 759         return hres;
 760     }
 761
 762     if(str)
 763         IStream_Release(str);
 764
 765     IMoniker_Release(bscallback->mon);
 766     bscallback->mon = NULL;
 767
 768     return S_OK;
 769 }
 770
 771 typedef struct {
 772     BSCallback bsc;
 773
 774     DWORD size;
 775     char *buf;
 776     HRESULT hres;
 777 } BufferBSC;
 778
 779 static inline BufferBSC *BufferBSC_from_BSCallback(BSCallback *iface)
 780 {
 781     return CONTAINING_RECORD(iface, BufferBSC, bsc);
 782 }
 783
 784 static void BufferBSC_destroy(BSCallback *bsc)
 785 {
 786     BufferBSC *This = BufferBSC_from_BSCallback(bsc);
 787
 788     heap_free(This->buf);
 789     heap_free(This);
 790 }
 791
 792 static HRESULT BufferBSC_init_bindinfo(BSCallback *bsc)
 793 {
 794     return S_OK;
 795 }
 796
 797 static HRESULT BufferBSC_start_binding(BSCallback *bsc)
 798 {
 799     return S_OK;
 800 }
 801
 802 static HRESULT BufferBSC_stop_binding(BSCallback *bsc, HRESULT result)
 803 {
 804     BufferBSC *This = BufferBSC_from_BSCallback(bsc);
 805
 806     This->hres = result;
 807
 808     if(FAILED(result)) {
 809         heap_free(This->buf);
 810         This->buf = NULL;
 811         This->size = 0;
 812     }
 813
 814     return S_OK;
 815 }
 816
 817 static HRESULT BufferBSC_read_data(BSCallback *bsc, IStream *stream)
 818 {
 819     BufferBSC *This = BufferBSC_from_BSCallback(bsc);
 820     DWORD readed;
 821     HRESULT hres;
 822
 823     if(!This->buf) {
 824         This->size = 128;
 825         This->buf = heap_alloc(This->size);
 826     }
 827
 828     do {
 829         if(This->bsc.readed == This->size) {
 830             This->size <<= 1;
 831             This->buf = heap_realloc(This->buf, This->size);
 832         }
 833
 834         hres = read_stream(&This->bsc, stream, This->buf+This->bsc.readed, This->size-This->bsc.readed, &readed);
 835     }while(hres == S_OK);
 836
 837     return S_OK;
 838 }
 839
 840 static HRESULT BufferBSC_on_progress(BSCallback *bsc, ULONG status_code, LPCWSTR status_text)
 841 {
 842     return S_OK;
 843 }
 844
 845 static HRESULT BufferBSC_on_response(BSCallback *bsc, DWORD response_code,
 846         LPCWSTR response_headers)
 847 {
 848     return S_OK;
 849 }
 850
 851 static HRESULT BufferBSC_beginning_transaction(BSCallback *bsc, WCHAR **additional_headers)
 852 {
 853     return S_FALSE;
 854 }
 855
 856 static const BSCallbackVtbl BufferBSCVtbl = {
 857     BufferBSC_destroy,
 858     BufferBSC_init_bindinfo,
 859     BufferBSC_start_binding,
 860     BufferBSC_stop_binding,
 861     BufferBSC_read_data,
 862     BufferBSC_on_progress,
 863     BufferBSC_on_response,
 864     BufferBSC_beginning_transaction
 865 };
 866
 867
 868 static BufferBSC *create_bufferbsc(IMoniker *mon)
 869 {
 870     BufferBSC *ret = heap_alloc_zero(sizeof(*ret));
 871
 872     init_bscallback(&ret->bsc, &BufferBSCVtbl, mon, 0);
 873     ret->hres = E_FAIL;
 874
 875     return ret;
 876 }
 877
 878 HRESULT bind_mon_to_wstr(HTMLInnerWindow *window, IMoniker *mon, WCHAR **ret)
 879 {
 880     BufferBSC *bsc = create_bufferbsc(mon);
 881     WCHAR *text;
 882     DWORD len;
 883     HRESULT hres;
 884
 885     hres = start_binding(window, &bsc->bsc, NULL);
 886     if(SUCCEEDED(hres))
 887         hres = bsc->hres;
 888     if(FAILED(hres)) {
 889         IBindStatusCallback_Release(&bsc->bsc.IBindStatusCallback_iface);
 890         return hres;
 891     }
 892
 893     len = MultiByteToWideChar(CP_ACP, 0, bsc->buf, bsc->bsc.readed, NULL, 0);
 894     text = heap_alloc((len+1)*sizeof(WCHAR));
 895     if(text) {
 896         MultiByteToWideChar(CP_ACP, 0, bsc->buf, bsc->bsc.readed, text, len);
 897         text[len] = 0;
 898     }else {
 899         hres = E_OUTOFMEMORY;
 900     }
 901     IBindStatusCallback_Release(&bsc->bsc.IBindStatusCallback_iface);
 902     if(FAILED(hres))
 903         return hres;
 904
 905     *ret = text;
 906     return S_OK;
 907 }
 908
 909 static HRESULT read_post_data_stream(nsChannelBSC *This, nsChannel *nschannel)
 910 {
 911     PRUint32 data_len = 0, available = 0;
 912     char *data, *post_data;
 913     nsresult nsres;
 914     HRESULT hres = S_OK;
 915
 916     if(!nschannel->post_data_stream)
 917         return S_OK;
 918
 919     nsres =  nsIInputStream_Available(nschannel->post_data_stream, &available);
 920     if(NS_FAILED(nsres))
 921         return E_FAIL;
 922
 923     post_data = data = GlobalAlloc(0, available);
 924     if(!data)
 925         return E_OUTOFMEMORY;
 926
 927     nsres = nsIInputStream_Read(nschannel->post_data_stream, data, available, &data_len);
 928     if(NS_FAILED(nsres)) {
 929         GlobalFree(data);
 930         return E_FAIL;
 931     }
 932
 933     if(nschannel->post_data_contains_headers) {
 934         if(data_len >= 2 && data[0] == '\r' && data[1] == '\n') {
 935             post_data = data+2;
 936             data_len -= 2;
 937         }else {
 938             WCHAR *headers;
 939             DWORD size;
 940             char *ptr;
 941
 942             post_data += data_len;
 943             for(ptr = data; ptr+4 < data+data_len; ptr++) {
 944                 if(!memcmp(ptr, "\r\n\r\n", 4)) {
 945                     post_data = ptr+4;
 946                     break;
 947                 }
 948             }
 949
 950             data_len -= post_data-data;
 951
 952             size = MultiByteToWideChar(CP_ACP, 0, data, post_data-data, NULL, 0);
 953             headers = heap_alloc((size+1)*sizeof(WCHAR));
 954             if(headers) {
 955                 MultiByteToWideChar(CP_ACP, 0, data, post_data-data, headers, size);
 956                 headers[size] = 0;
 957                 hres = parse_headers(headers , &nschannel->request_headers);
 958                 if(SUCCEEDED(hres))
 959                     This->bsc.headers = headers;
 960                 else
 961                     heap_free(headers);
 962             }else {
 963                 hres = E_OUTOFMEMORY;
 964             }
 965         }
 966     }
 967
 968     if(FAILED(hres)) {
 969         GlobalFree(data);
 970         return hres;
 971     }
 972
 973     if(!data_len) {
 974         GlobalFree(data);
 975         post_data = NULL;
 976     }else if(post_data != data) {
 977         char *new_data;
 978
 979         new_data = GlobalAlloc(0, data_len);
 980         if(new_data)
 981             memcpy(new_data, post_data, data_len);
 982         GlobalFree(data);
 983         if(!new_data)
 984             return E_OUTOFMEMORY;
 985         post_data = new_data;
 986     }
 987
 988     This->bsc.post_data = post_data;
 989     This->bsc.post_data_len = data_len;
 990     TRACE("post_data = %s\n", debugstr_a(This->bsc.post_data));
 991     return S_OK;
 992 }
 993
 994 static HRESULT on_start_nsrequest(nsChannelBSC *This)
 995 {
 996     nsresult nsres;
 997
 998     /* FIXME: it's needed for http connections from BindToObject. */
 999     if(!This->nschannel->response_status)
1000         This->nschannel->response_status = 200;
1001
1002     nsres = nsIStreamListener_OnStartRequest(This->nslistener,
1003             (nsIRequest*)&This->nschannel->nsIHttpChannel_iface, This->nscontext);
1004     if(NS_FAILED(nsres)) {
1005         FIXME("OnStartRequest failed: %08x\n", nsres);
1006         return E_FAIL;
1007     }
1008
1009     if(This->is_doc_channel) {
1010         update_window_doc(This->bsc.window);
1011         if(This->bsc.window->base.outer_window->readystate != READYSTATE_LOADING)
1012             set_ready_state(This->bsc.window->base.outer_window, READYSTATE_LOADING);
1013     }
1014
1015     return S_OK;
1016 }
1017
1018 static void on_stop_nsrequest(nsChannelBSC *This, HRESULT result)
1019 {
1020     nsresult nsres, request_result;
1021
1022     switch(result) {
1023     case S_OK:
1024         request_result = NS_OK;
1025         break;
1026     case E_ABORT:
1027         request_result = NS_BINDING_ABORTED;
1028         break;
1029     default:
1030         request_result = NS_ERROR_FAILURE;
1031     }
1032
1033     if(This->nslistener) {
1034         nsres = nsIStreamListener_OnStopRequest(This->nslistener,
1035                  (nsIRequest*)&This->nschannel->nsIHttpChannel_iface, This->nscontext,
1036                  request_result);
1037         if(NS_FAILED(nsres))
1038             WARN("OnStopRequest failed: %08x\n", nsres);
1039     }
1040
1041     if(This->nschannel->load_group) {
1042         nsres = nsILoadGroup_RemoveRequest(This->nschannel->load_group,
1043                 (nsIRequest*)&This->nschannel->nsIHttpChannel_iface, NULL, request_result);
1044         if(NS_FAILED(nsres))
1045             ERR("RemoveRequest failed: %08x\n", nsres);
1046     }
1047 }
1048
1049 static HRESULT read_stream_data(nsChannelBSC *This, IStream *stream)
1050 {
1051     DWORD read;
1052     nsresult nsres;
1053     HRESULT hres;
1054
1055     if(!This->nslistener) {
1056         BYTE buf[1024];
1057
1058         do {
1059             hres = read_stream(&This->bsc, stream, buf, sizeof(buf), &read);
1060         }while(hres == S_OK && read);
1061
1062         return S_OK;
1063     }
1064
1065     if(!This->nsstream)
1066         This->nsstream = create_nsprotocol_stream();
1067
1068     do {
1069         BOOL first_read = !This->bsc.readed;
1070
1071         hres = read_stream(&This->bsc, stream, This->nsstream->buf+This->nsstream->buf_size,
1072                 sizeof(This->nsstream->buf)-This->nsstream->buf_size, &read);
1073         if(!read)
1074             break;
1075
1076         This->nsstream->buf_size += read;
1077
1078         if(first_read) {
1079             if(This->nsstream->buf_size >= 2
1080                && (BYTE)This->nsstream->buf[0] == 0xff
1081                && (BYTE)This->nsstream->buf[1] == 0xfe)
1082                 This->nschannel->charset = heap_strdupA(UTF16_STR);
1083             if(This->nsstream->buf_size >= 3
1084                && (BYTE)This->nsstream->buf[0] == 0xef
1085                && (BYTE)This->nsstream->buf[1] == 0xbb
1086                && (BYTE)This->nsstream->buf[2] == 0xbf)
1087                 This->nschannel->charset = heap_strdupA(UTF8_STR);
1088
1089             if(!This->nschannel->content_type) {
1090                 WCHAR *mime;
1091
1092                 hres = FindMimeFromData(NULL, NULL, This->nsstream->buf, This->nsstream->buf_size,
1093                         This->is_doc_channel ? text_htmlW : NULL, 0, &mime, 0);
1094                 if(FAILED(hres))
1095                     return hres;
1096
1097                 TRACE("Found MIME %s\n", debugstr_w(mime));
1098
1099                 This->nschannel->content_type = heap_strdupWtoA(mime);
1100                 CoTaskMemFree(mime);
1101                 if(!This->nschannel->content_type)
1102                     return E_OUTOFMEMORY;
1103             }
1104
1105             on_start_nsrequest(This);
1106         }
1107
1108         nsres = nsIStreamListener_OnDataAvailable(This->nslistener,
1109                 (nsIRequest*)&This->nschannel->nsIHttpChannel_iface, This->nscontext,
1110                 &This->nsstream->nsIInputStream_iface, This->bsc.readed-This->nsstream->buf_size,
1111                 This->nsstream->buf_size);
1112         if(NS_FAILED(nsres))
1113             ERR("OnDataAvailable failed: %08x\n", nsres);
1114
1115         if(This->nsstream->buf_size == sizeof(This->nsstream->buf)) {
1116             ERR("buffer is full\n");
1117             break;
1118         }
1119     }while(hres == S_OK);
1120
1121     return S_OK;
1122 }
1123
1124 typedef struct {
1125     nsIAsyncVerifyRedirectCallback nsIAsyncVerifyRedirectCallback_iface;
1126
1127     LONG ref;
1128
1129     nsChannel *nschannel;
1130     nsChannelBSC *bsc;
1131 } nsRedirectCallback;
1132
1133 static nsRedirectCallback *impl_from_nsIAsyncVerifyRedirectCallback(nsIAsyncVerifyRedirectCallback *iface)
1134 {
1135     return CONTAINING_RECORD(iface, nsRedirectCallback, nsIAsyncVerifyRedirectCallback_iface);
1136 }
1137
1138 static nsresult NSAPI nsAsyncVerifyRedirectCallback_QueryInterface(nsIAsyncVerifyRedirectCallback *iface,
1139         nsIIDRef riid, void **result)
1140 {
1141     nsRedirectCallback *This = impl_from_nsIAsyncVerifyRedirectCallback(iface);
1142
1143     if(IsEqualGUID(&IID_nsISupports, riid)) {
1144         TRACE("(%p)->(IID_nsISuports %p)\n", This, result);
1145         *result = &This->nsIAsyncVerifyRedirectCallback_iface;
1146     }else if(IsEqualGUID(&IID_nsIAsyncVerifyRedirectCallback, riid)) {
1147         TRACE("(%p)->(IID_nsIAsyncVerifyRedirectCallback %p)\n", This, result);
1148         *result = &This->nsIAsyncVerifyRedirectCallback_iface;
1149     }else {
1150         *result = NULL;
1151         WARN("unimplemented iface %s\n", debugstr_guid(riid));
1152         return NS_NOINTERFACE;
1153     }
1154
1155     nsISupports_AddRef((nsISupports*)*result);
1156     return NS_OK;
1157 }
1158
1159 static nsrefcnt NSAPI nsAsyncVerifyRedirectCallback_AddRef(nsIAsyncVerifyRedirectCallback *iface)
1160 {
1161     nsRedirectCallback *This = impl_from_nsIAsyncVerifyRedirectCallback(iface);
1162     LONG ref = InterlockedIncrement(&This->ref);
1163
1164     TRACE("(%p) ref=%d\n", This, ref);
1165
1166     return ref;
1167 }
1168
1169 static nsrefcnt NSAPI nsAsyncVerifyRedirectCallback_Release(nsIAsyncVerifyRedirectCallback *iface)
1170 {
1171     nsRedirectCallback *This = impl_from_nsIAsyncVerifyRedirectCallback(iface);
1172     LONG ref = InterlockedDecrement(&This->ref);
1173
1174     TRACE("(%p) ref=%d\n", This, ref);
1175
1176     if(!ref) {
1177         IBindStatusCallback_Release(&This->bsc->bsc.IBindStatusCallback_iface);
1178         nsIHttpChannel_Release(&This->nschannel->nsIHttpChannel_iface);
1179         heap_free(This);
1180     }
1181
1182     return ref;
1183 }
1184
1185 static nsresult NSAPI nsAsyncVerifyRedirectCallback_AsyncOnChannelRedirect(nsIAsyncVerifyRedirectCallback *iface, nsresult result)
1186 {
1187     nsRedirectCallback *This = impl_from_nsIAsyncVerifyRedirectCallback(iface);
1188     nsChannel *old_nschannel;
1189     nsresult nsres;
1190
1191     TRACE("(%p)->(%08x)\n", This, result);
1192
1193     old_nschannel = This->bsc->nschannel;
1194     nsIHttpChannel_AddRef(&This->nschannel->nsIHttpChannel_iface);
1195     This->bsc->nschannel = This->nschannel;
1196
1197     if(This->nschannel->load_group) {
1198         nsres = nsILoadGroup_AddRequest(This->nschannel->load_group, (nsIRequest*)&This->nschannel->nsIHttpChannel_iface,
1199                 NULL);
1200         if(NS_FAILED(nsres))
1201             ERR("AddRequest failed: %08x\n", nsres);
1202     }
1203
1204     if(This->bsc->is_doc_channel) {
1205         IUri *uri = nsuri_get_uri(This->nschannel->uri);
1206
1207         if(uri) {
1208             set_current_uri(This->bsc->bsc.window->base.outer_window, uri);
1209             IUri_Release(uri);
1210         }else {
1211             WARN("Could not get IUri from nsWineURI\n");
1212         }
1213     }
1214
1215     if(old_nschannel) {
1216         nsres = nsILoadGroup_RemoveRequest(old_nschannel->load_group,
1217                 (nsIRequest*)&old_nschannel->nsIHttpChannel_iface, NULL, NS_OK);
1218         if(NS_FAILED(nsres))
1219             ERR("RemoveRequest failed: %08x\n", nsres);
1220         nsIHttpChannel_Release(&old_nschannel->nsIHttpChannel_iface);
1221     }
1222
1223     return NS_OK;
1224 }
1225
1226 static const nsIAsyncVerifyRedirectCallbackVtbl nsAsyncVerifyRedirectCallbackVtbl = {
1227     nsAsyncVerifyRedirectCallback_QueryInterface,
1228     nsAsyncVerifyRedirectCallback_AddRef,
1229     nsAsyncVerifyRedirectCallback_Release,
1230     nsAsyncVerifyRedirectCallback_AsyncOnChannelRedirect
1231 };
1232
1233 static HRESULT create_redirect_callback(nsChannel *nschannel, nsChannelBSC *bsc, nsRedirectCallback **ret)
1234 {
1235     nsRedirectCallback *callback;
1236
1237     callback = heap_alloc(sizeof(*callback));
1238     if(!callback)
1239         return E_OUTOFMEMORY;
1240
1241     callback->nsIAsyncVerifyRedirectCallback_iface.lpVtbl = &nsAsyncVerifyRedirectCallbackVtbl;
1242     callback->ref = 1;
1243
1244     nsIHttpChannel_AddRef(&nschannel->nsIHttpChannel_iface);
1245     callback->nschannel = nschannel;
1246
1247     IBindStatusCallback_AddRef(&bsc->bsc.IBindStatusCallback_iface);
1248     callback->bsc = bsc;
1249
1250     *ret = callback;
1251     return S_OK;
1252 }
1253
1254 static inline nsChannelBSC *nsChannelBSC_from_BSCallback(BSCallback *iface)
1255 {
1256     return CONTAINING_RECORD(iface, nsChannelBSC, bsc);
1257 }
1258
1259 static void nsChannelBSC_destroy(BSCallback *bsc)
1260 {
1261     nsChannelBSC *This = nsChannelBSC_from_BSCallback(bsc);
1262
1263     if(This->nschannel)
1264         nsIHttpChannel_Release(&This->nschannel->nsIHttpChannel_iface);
1265     if(This->nslistener)
1266         nsIStreamListener_Release(This->nslistener);
1267     if(This->nscontext)
1268         nsISupports_Release(This->nscontext);
1269     if(This->nsstream)
1270         nsIInputStream_Release(&This->nsstream->nsIInputStream_iface);
1271     heap_free(This);
1272 }
1273
1274 static HRESULT nsChannelBSC_start_binding(BSCallback *bsc)
1275 {
1276     nsChannelBSC *This = nsChannelBSC_from_BSCallback(bsc);
1277
1278     if(This->is_doc_channel)
1279         This->bsc.window->base.outer_window->base.inner_window->doc->skip_mutation_notif = FALSE;
1280
1281     return S_OK;
1282 }
1283
1284 static HRESULT nsChannelBSC_init_bindinfo(BSCallback *bsc)
1285 {
1286     nsChannelBSC *This = nsChannelBSC_from_BSCallback(bsc);
1287     HRESULT hres;
1288
1289     if(This->nschannel && This->nschannel->post_data_stream) {
1290         hres = read_post_data_stream(This, This->nschannel);
1291         if(FAILED(hres))
1292             return hres;
1293     }
1294
1295     return S_OK;
1296 }
1297
1298 typedef struct {
1299     task_t header;
1300     nsChannelBSC *bsc;
1301 } stop_request_task_t;
1302
1303 static void stop_request_proc(task_t *_task)
1304 {
1305     stop_request_task_t *task = (stop_request_task_t*)_task;
1306
1307     TRACE("(%p)\n", task->bsc);
1308
1309     list_remove(&task->bsc->bsc.entry);
1310     list_init(&task->bsc->bsc.entry);
1311     on_stop_nsrequest(task->bsc, S_OK);
1312 }
1313
1314 static void stop_request_task_destr(task_t *_task)
1315 {
1316     stop_request_task_t *task = (stop_request_task_t*)_task;
1317
1318     IBindStatusCallback_Release(&task->bsc->bsc.IBindStatusCallback_iface);
1319     heap_free(task);
1320 }
1321
1322 static HRESULT async_stop_request(nsChannelBSC *This)
1323 {
1324     stop_request_task_t *task;
1325
1326     if(!This->bsc.readed) {
1327         TRACE("No data read, calling OnStartRequest\n");
1328         on_start_nsrequest(This);
1329     }
1330
1331     task = heap_alloc(sizeof(*task));
1332     if(!task)
1333         return E_OUTOFMEMORY;
1334
1335     IBindStatusCallback_AddRef(&This->bsc.IBindStatusCallback_iface);
1336     task->bsc = This;
1337
1338     push_task(&task->header, stop_request_proc, stop_request_task_destr, This->bsc.window->task_magic);
1339     return S_OK;
1340 }
1341
1342 static void handle_navigation_error(nsChannelBSC *This, DWORD result)
1343 {
1344     HTMLOuterWindow *outer_window;
1345     HTMLDocumentObj *doc;
1346     IOleCommandTarget *olecmd;
1347     BOOL is_error_url;
1348     SAFEARRAY *sa;
1349     SAFEARRAYBOUND bound;
1350     VARIANT var, varOut;
1351     LONG ind;
1352     BSTR unk;
1353     HRESULT hres;
1354
1355     if(!This->is_doc_channel || !This->bsc.window)
1356         return;
1357
1358     outer_window = This->bsc.window->base.outer_window;
1359
1360     doc = outer_window->doc_obj;
1361     if(!doc || !doc->doc_object_service || !doc->client)
1362         return;
1363
1364     hres = IDocObjectService_IsErrorUrl(doc->doc_object_service,
1365             outer_window->url, &is_error_url);
1366     if(FAILED(hres) || is_error_url)
1367         return;
1368
1369     hres = IOleClientSite_QueryInterface(doc->client,
1370             &IID_IOleCommandTarget, (void**)&olecmd);
1371     if(FAILED(hres))
1372         return;
1373
1374     bound.lLbound = 0;
1375     bound.cElements = 8;
1376     sa = SafeArrayCreate(VT_VARIANT, 1, &bound);
1377     if(!sa) {
1378         IOleCommandTarget_Release(olecmd);
1379         return;
1380     }
1381
1382     ind = 0;
1383     V_VT(&var) = VT_I4;
1384     V_I4(&var) = result;
1385     SafeArrayPutElement(sa, &ind, &var);
1386
1387     ind = 1;
1388     V_VT(&var) = VT_BSTR;
1389     V_BSTR(&var) = outer_window->url;
1390     SafeArrayPutElement(sa, &ind, &var);
1391
1392     ind = 3;
1393     V_VT(&var) = VT_UNKNOWN;
1394     V_UNKNOWN(&var) = (IUnknown*)&outer_window->base.IHTMLWindow2_iface;
1395     SafeArrayPutElement(sa, &ind, &var);
1396
1397     /* FIXME: what are the following fields for? */
1398     ind = 2;
1399     V_VT(&var) = VT_UNKNOWN;
1400     V_UNKNOWN(&var) = NULL;
1401     SafeArrayPutElement(sa, &ind, &var);
1402
1403     ind = 4;
1404     V_VT(&var) = VT_BOOL;
1405     V_BOOL(&var) = FALSE;
1406     SafeArrayPutElement(sa, &ind, &var);
1407
1408     ind = 5;
1409     V_VT(&var) = VT_BOOL;
1410     V_BOOL(&var) = FALSE;
1411     SafeArrayPutElement(sa, &ind, &var);
1412
1413     ind = 6;
1414     V_VT(&var) = VT_BSTR;
1415     unk = SysAllocString(NULL);
1416     V_BSTR(&var) = unk;
1417     SafeArrayPutElement(sa, &ind, &var);
1418
1419     ind = 7;
1420     V_VT(&var) = VT_UNKNOWN;
1421     V_UNKNOWN(&var) = NULL;
1422     SafeArrayPutElement(sa, &ind, &var);
1423
1424     V_VT(&var) = VT_ARRAY;
1425     V_ARRAY(&var) = sa;
1426     V_VT(&varOut) = VT_BOOL;
1427     V_BOOL(&varOut) = VARIANT_TRUE;
1428     IOleCommandTarget_Exec(olecmd, &CGID_DocHostCmdPriv, 1, 0, &var, FAILED(hres)?NULL:&varOut);
1429
1430     SysFreeString(unk);
1431     SafeArrayDestroy(sa);
1432     IOleCommandTarget_Release(olecmd);
1433 }
1434
1435 static HRESULT nsChannelBSC_stop_binding(BSCallback *bsc, HRESULT result)
1436 {
1437     nsChannelBSC *This = nsChannelBSC_from_BSCallback(bsc);
1438
1439     if(result != E_ABORT) {
1440         if(FAILED(result))
1441             handle_navigation_error(This, result);
1442         else if(This->is_doc_channel) {
1443             result = async_stop_request(This);
1444             if(SUCCEEDED(result))
1445                 return S_OK;
1446         }
1447     }
1448
1449     on_stop_nsrequest(This, result);
1450     return S_OK;
1451 }
1452
1453 static HRESULT nsChannelBSC_read_data(BSCallback *bsc, IStream *stream)
1454 {
1455     nsChannelBSC *This = nsChannelBSC_from_BSCallback(bsc);
1456
1457     return read_stream_data(This, stream);
1458 }
1459
1460 static HRESULT handle_redirect(nsChannelBSC *This, const WCHAR *new_url)
1461 {
1462     nsRedirectCallback *callback;
1463     nsIChannelEventSink *sink;
1464     nsChannel *new_channel;
1465     nsresult nsres;
1466     HRESULT hres;
1467
1468     TRACE("(%p)->(%s)\n", This, debugstr_w(new_url));
1469
1470     if(!This->nschannel || !This->nschannel->notif_callback)
1471         return S_OK;
1472
1473     nsres = nsIInterfaceRequestor_GetInterface(This->nschannel->notif_callback, &IID_nsIChannelEventSink, (void**)&sink);
1474     if(NS_FAILED(nsres))
1475         return S_OK;
1476
1477     hres = create_redirect_nschannel(new_url, This->nschannel, &new_channel);
1478     if(SUCCEEDED(hres)) {
1479         TRACE("%p %p->%p\n", This, This->nschannel, new_channel);
1480
1481         hres = create_redirect_callback(new_channel, This, &callback);
1482         nsIHttpChannel_Release(&new_channel->nsIHttpChannel_iface);
1483     }
1484
1485     if(SUCCEEDED(hres)) {
1486         nsres = nsIChannelEventSink_AsyncOnChannelRedirect(sink, (nsIChannel*)&This->nschannel->nsIHttpChannel_iface,
1487                 (nsIChannel*)&callback->nschannel->nsIHttpChannel_iface, REDIRECT_TEMPORARY, /* FIXME */
1488                 &callback->nsIAsyncVerifyRedirectCallback_iface);
1489
1490         if(NS_FAILED(nsres))
1491             FIXME("AsyncOnChannelRedirect failed: %08x\n", hres);
1492         else if(This->nschannel != callback->nschannel)
1493             FIXME("nschannel not updated\n");
1494
1495         nsIAsyncVerifyRedirectCallback_Release(&callback->nsIAsyncVerifyRedirectCallback_iface);
1496     }
1497
1498     nsIChannelEventSink_Release(sink);
1499     return hres;
1500 }
1501
1502 static HRESULT nsChannelBSC_on_progress(BSCallback *bsc, ULONG status_code, LPCWSTR status_text)
1503 {
1504     nsChannelBSC *This = nsChannelBSC_from_BSCallback(bsc);
1505
1506     switch(status_code) {
1507     case BINDSTATUS_MIMETYPEAVAILABLE:
1508         if(!This->nschannel)
1509             return S_OK;
1510
1511         heap_free(This->nschannel->content_type);
1512         This->nschannel->content_type = heap_strdupWtoA(status_text);
1513         break;
1514     case BINDSTATUS_REDIRECTING:
1515         return handle_redirect(This, status_text);
1516     case BINDSTATUS_BEGINDOWNLOADDATA: {
1517         IWinInetHttpInfo *http_info;
1518         DWORD status, size = sizeof(DWORD);
1519         HRESULT hres;
1520
1521         if(!This->bsc.binding)
1522             break;
1523
1524         hres = IBinding_QueryInterface(This->bsc.binding, &IID_IWinInetHttpInfo, (void**)&http_info);
1525         if(FAILED(hres))
1526             break;
1527
1528         hres = IWinInetHttpInfo_QueryInfo(http_info,
1529                 HTTP_QUERY_STATUS_CODE|HTTP_QUERY_FLAG_NUMBER, &status, &size, NULL, NULL);
1530         IWinInetHttpInfo_Release(http_info);
1531         if(FAILED(hres) || status == HTTP_STATUS_OK)
1532             break;
1533
1534         handle_navigation_error(This, status);
1535     }
1536     }
1537
1538     return S_OK;
1539 }
1540
1541 static HRESULT nsChannelBSC_on_response(BSCallback *bsc, DWORD response_code,
1542         LPCWSTR response_headers)
1543 {
1544     nsChannelBSC *This = nsChannelBSC_from_BSCallback(bsc);
1545     HRESULT hres;
1546
1547     This->nschannel->response_status = response_code;
1548
1549     if(response_headers) {
1550         const WCHAR *headers;
1551
1552         headers = strchrW(response_headers, '\r');
1553         if(headers && headers[1] == '\n') {
1554             headers += 2;
1555             hres = process_response_headers(This, headers);
1556             if(FAILED(hres)) {
1557                 WARN("parsing headers failed: %08x\n", hres);
1558                 return hres;
1559             }
1560         }
1561     }
1562
1563     return S_OK;
1564 }
1565
1566 static HRESULT nsChannelBSC_beginning_transaction(BSCallback *bsc, WCHAR **additional_headers)
1567 {
1568     nsChannelBSC *This = nsChannelBSC_from_BSCallback(bsc);
1569     http_header_t *iter;
1570     DWORD len = 0;
1571     WCHAR *ptr;
1572
1573     static const WCHAR content_lengthW[] =
1574         {'C','o','n','t','e','n','t','-','L','e','n','g','t','h',0};
1575
1576     if(!This->nschannel)
1577         return S_FALSE;
1578
1579     LIST_FOR_EACH_ENTRY(iter, &This->nschannel->request_headers, http_header_t, entry) {
1580         if(strcmpW(iter->header, content_lengthW))
1581             len += strlenW(iter->header) + 2 /* ": " */ + strlenW(iter->data) + 2 /* "\r\n" */;
1582     }
1583
1584     if(!len)
1585         return S_OK;
1586
1587     *additional_headers = ptr = CoTaskMemAlloc((len+1)*sizeof(WCHAR));
1588     if(!ptr)
1589         return E_OUTOFMEMORY;
1590
1591     LIST_FOR_EACH_ENTRY(iter, &This->nschannel->request_headers, http_header_t, entry) {
1592         if(!strcmpW(iter->header, content_lengthW))
1593             continue;
1594
1595         len = strlenW(iter->header);
1596         memcpy(ptr, iter->header, len*sizeof(WCHAR));
1597         ptr += len;
1598
1599         *ptr++ = ':';
1600         *ptr++ = ' ';
1601
1602         len = strlenW(iter->data);
1603         memcpy(ptr, iter->data, len*sizeof(WCHAR));
1604         ptr += len;
1605
1606         *ptr++ = '\r';
1607         *ptr++ = '\n';
1608     }
1609
1610     *ptr = 0;
1611
1612     return S_OK;
1613 }
1614
1615 static const BSCallbackVtbl nsChannelBSCVtbl = {
1616     nsChannelBSC_destroy,
1617     nsChannelBSC_init_bindinfo,
1618     nsChannelBSC_start_binding,
1619     nsChannelBSC_stop_binding,
1620     nsChannelBSC_read_data,
1621     nsChannelBSC_on_progress,
1622     nsChannelBSC_on_response,
1623     nsChannelBSC_beginning_transaction
1624 };
1625
1626 HRESULT create_channelbsc(IMoniker *mon, const WCHAR *headers, BYTE *post_data, DWORD post_data_size,
1627         BOOL is_doc_binding, nsChannelBSC **retval)
1628 {
1629     nsChannelBSC *ret;
1630
1631     ret = heap_alloc_zero(sizeof(*ret));
1632     if(!ret)
1633         return E_OUTOFMEMORY;
1634
1635     init_bscallback(&ret->bsc, &nsChannelBSCVtbl, mon, BINDF_ASYNCHRONOUS | BINDF_ASYNCSTORAGE | BINDF_PULLDATA);
1636     ret->is_doc_channel = is_doc_binding;
1637
1638     if(headers) {
1639         ret->bsc.headers = heap_strdupW(headers);
1640         if(!ret->bsc.headers) {
1641             IBindStatusCallback_Release(&ret->bsc.IBindStatusCallback_iface);
1642             return E_OUTOFMEMORY;
1643         }
1644     }
1645
1646     if(post_data) {
1647         ret->bsc.post_data = GlobalAlloc(0, post_data_size);
1648         if(!ret->bsc.post_data) {
1649             heap_free(ret->bsc.headers);
1650             IBindStatusCallback_Release(&ret->bsc.IBindStatusCallback_iface);
1651             return E_OUTOFMEMORY;
1652         }
1653
1654         memcpy(ret->bsc.post_data, post_data, post_data_size);
1655         ret->bsc.post_data_len = post_data_size;
1656     }
1657
1658     *retval = ret;
1659     return S_OK;
1660 }
1661
1662 typedef struct {
1663     task_t header;
1664     HTMLOuterWindow *window;
1665     HTMLInnerWindow *pending_window;
1666 } start_doc_binding_task_t;
1667
1668 static void start_doc_binding_proc(task_t *_task)
1669 {
1670     start_doc_binding_task_t *task = (start_doc_binding_task_t*)_task;
1671
1672     set_current_mon(task->window, task->pending_window->bscallback->bsc.mon);
1673     start_binding(task->pending_window, &task->pending_window->bscallback->bsc, NULL);
1674 }
1675
1676 static void start_doc_binding_task_destr(task_t *_task)
1677 {
1678     start_doc_binding_task_t *task = (start_doc_binding_task_t*)_task;
1679
1680     IHTMLWindow2_Release(&task->pending_window->base.IHTMLWindow2_iface);
1681     heap_free(task);
1682 }
1683
1684 HRESULT async_start_doc_binding(HTMLOuterWindow *window, HTMLInnerWindow *pending_window)
1685 {
1686     start_doc_binding_task_t *task;
1687
1688     TRACE("%p\n", pending_window);
1689
1690     task = heap_alloc(sizeof(start_doc_binding_task_t));
1691     if(!task)
1692         return E_OUTOFMEMORY;
1693
1694     task->window = window;
1695     task->pending_window = pending_window;
1696     IHTMLWindow2_AddRef(&pending_window->base.IHTMLWindow2_iface);
1697
1698     push_task(&task->header, start_doc_binding_proc, start_doc_binding_task_destr, pending_window->task_magic);
1699     return S_OK;
1700 }
1701
1702 void abort_window_bindings(HTMLInnerWindow *window)
1703 {
1704     BSCallback *iter;
1705
1706     remove_target_tasks(window->task_magic);
1707
1708     while(!list_empty(&window->bindings)) {
1709         iter = LIST_ENTRY(window->bindings.next, BSCallback, entry);
1710
1711         TRACE("Aborting %p\n", iter);
1712
1713         IBindStatusCallback_AddRef(&iter->IBindStatusCallback_iface);
1714
1715         if(iter->binding)
1716             IBinding_Abort(iter->binding);
1717         else
1718             iter->vtbl->stop_binding(iter, E_ABORT);
1719
1720         iter->window = NULL;
1721         list_remove(&iter->entry);
1722         list_init(&iter->entry);
1723
1724         IBindStatusCallback_Release(&iter->IBindStatusCallback_iface);
1725     }
1726
1727     if(window->bscallback) {
1728         IBindStatusCallback_Release(&window->bscallback->bsc.IBindStatusCallback_iface);
1729         window->bscallback = NULL;
1730     }
1731 }
1732
1733 HRESULT channelbsc_load_stream(HTMLInnerWindow *pending_window, IStream *stream)
1734 {
1735     nsChannelBSC *bscallback = pending_window->bscallback;
1736     HRESULT hres = S_OK;
1737
1738     if(!bscallback->nschannel) {
1739         ERR("NULL nschannel\n");
1740         return E_FAIL;
1741     }
1742
1743     bscallback->nschannel->content_type = heap_strdupA("text/html");
1744     if(!bscallback->nschannel->content_type)
1745         return E_OUTOFMEMORY;
1746
1747     bscallback->bsc.window = pending_window;
1748     if(stream)
1749         hres = read_stream_data(bscallback, stream);
1750     if(SUCCEEDED(hres))
1751         hres = async_stop_request(bscallback);
1752     if(FAILED(hres))
1753         IBindStatusCallback_OnStopBinding(&bscallback->bsc.IBindStatusCallback_iface, hres,
1754                 ERROR_SUCCESS);
1755
1756     return hres;
1757 }
1758
1759 void channelbsc_set_channel(nsChannelBSC *This, nsChannel *channel, nsIStreamListener *listener, nsISupports *context)
1760 {
1761     nsIHttpChannel_AddRef(&channel->nsIHttpChannel_iface);
1762     This->nschannel = channel;
1763
1764     nsIStreamListener_AddRef(listener);
1765     This->nslistener = listener;
1766
1767     if(context) {
1768         nsISupports_AddRef(context);
1769         This->nscontext = context;
1770     }
1771
1772     if(This->bsc.headers) {
1773         HRESULT hres;
1774
1775         hres = parse_headers(This->bsc.headers, &channel->request_headers);
1776         heap_free(This->bsc.headers);
1777         This->bsc.headers = NULL;
1778         if(FAILED(hres))
1779             WARN("parse_headers failed: %08x\n", hres);
1780     }
1781 }
1782
1783 typedef struct {
1784     task_t header;
1785     HTMLOuterWindow *window;
1786     IUri *uri;
1787 } navigate_javascript_task_t;
1788
1789 static void navigate_javascript_proc(task_t *_task)
1790 {
1791     navigate_javascript_task_t *task = (navigate_javascript_task_t*)_task;
1792     HTMLOuterWindow *window = task->window;
1793     VARIANT v;
1794     BSTR code;
1795     HRESULT hres;
1796
1797     static const WCHAR jscriptW[] = {'j','s','c','r','i','p','t',0};
1798
1799     task->window->readystate = READYSTATE_COMPLETE;
1800
1801     hres = IUri_GetPath(task->uri, &code);
1802     if(FAILED(hres))
1803         return;
1804
1805     hres = UrlUnescapeW(code, NULL, NULL, URL_UNESCAPE_INPLACE);
1806     if(FAILED(hres)) {
1807         SysFreeString(code);
1808         return;
1809     }
1810
1811     set_download_state(window->doc_obj, 1);
1812
1813     V_VT(&v) = VT_EMPTY;
1814     hres = exec_script(window->base.inner_window, code, jscriptW, &v);
1815     SysFreeString(code);
1816     if(SUCCEEDED(hres) && V_VT(&v) != VT_EMPTY) {
1817         FIXME("javascirpt URL returned %s\n", debugstr_variant(&v));
1818         VariantClear(&v);
1819     }
1820
1821     if(window->doc_obj->view_sink)
1822         IAdviseSink_OnViewChange(window->doc_obj->view_sink, DVASPECT_CONTENT, -1);
1823
1824     set_download_state(window->doc_obj, 0);
1825 }
1826
1827 static void navigate_javascript_task_destr(task_t *_task)
1828 {
1829     navigate_javascript_task_t *task = (navigate_javascript_task_t*)_task;
1830
1831     IUri_Release(task->uri);
1832     heap_free(task);
1833 }
1834
1835 typedef struct {
1836     task_t header;
1837     HTMLOuterWindow *window;
1838     nsChannelBSC *bscallback;
1839     IMoniker *mon;
1840 } navigate_task_t;
1841
1842 static void navigate_proc(task_t *_task)
1843 {
1844     navigate_task_t *task = (navigate_task_t*)_task;
1845     HRESULT hres;
1846
1847     hres = set_moniker(&task->window->doc_obj->basedoc, task->mon, NULL, task->bscallback, TRUE);
1848     if(SUCCEEDED(hres)) {
1849         set_current_mon(task->window, task->bscallback->bsc.mon);
1850         start_binding(task->window->pending_window, &task->bscallback->bsc, NULL);
1851     }
1852 }
1853
1854 static void navigate_task_destr(task_t *_task)
1855 {
1856     navigate_task_t *task = (navigate_task_t*)_task;
1857
1858     IBindStatusCallback_Release(&task->bscallback->bsc.IBindStatusCallback_iface);
1859     IMoniker_Release(task->mon);
1860     heap_free(task);
1861 }
1862
1863 static HRESULT navigate_fragment(HTMLOuterWindow *window, IUri *uri)
1864 {
1865     nsIDOMLocation *nslocation;
1866     nsAString nsfrag_str;
1867     BSTR frag;
1868     nsresult nsres;
1869     HRESULT hres;
1870
1871     set_current_uri(window, uri);
1872
1873     nsres = nsIDOMWindow_GetLocation(window->nswindow, &nslocation);
1874     if(FAILED(nsres) || !nslocation)
1875         return E_FAIL;
1876
1877     hres = IUri_GetFragment(uri, &frag);
1878     if(FAILED(hres)) {
1879         nsIDOMLocation_Release(nslocation);
1880         return hres;
1881     }
1882
1883     nsAString_InitDepend(&nsfrag_str, frag);
1884     nsres = nsIDOMLocation_SetHash(nslocation, &nsfrag_str);
1885     nsAString_Finish(&nsfrag_str);
1886     nsIDOMLocation_Release(nslocation);
1887     SysFreeString(frag);
1888     if(NS_FAILED(nsres)) {
1889         ERR("SetHash failed: %08x\n", nsres);
1890         return E_FAIL;
1891     }
1892
1893     if(window->doc_obj->doc_object_service) {
1894         IDocObjectService_FireNavigateComplete2(window->doc_obj->doc_object_service, &window->base.IHTMLWindow2_iface, 0x10);
1895         IDocObjectService_FireDocumentComplete(window->doc_obj->doc_object_service, &window->base.IHTMLWindow2_iface, 0);
1896
1897     }
1898
1899     return S_OK;
1900 }
1901
1902 HRESULT super_navigate(HTMLOuterWindow *window, IUri *uri, const WCHAR *headers, BYTE *post_data, DWORD post_data_size)
1903 {
1904     nsChannelBSC *bsc;
1905     IMoniker *mon;
1906     DWORD scheme;
1907     HRESULT hres;
1908
1909     if(window->doc_obj->client) {
1910         IOleCommandTarget *cmdtrg;
1911
1912         hres = IOleClientSite_QueryInterface(window->doc_obj->client, &IID_IOleCommandTarget, (void**)&cmdtrg);
1913         if(SUCCEEDED(hres)) {
1914             VARIANT in, out;
1915             BSTR url_str;
1916
1917             hres = IUri_GetDisplayUri(uri, &url_str);
1918             if(SUCCEEDED(hres)) {
1919                 V_VT(&in) = VT_BSTR;
1920                 V_BSTR(&in) = url_str;
1921                 V_VT(&out) = VT_BOOL;
1922                 V_BOOL(&out) = VARIANT_TRUE;
1923                 hres = IOleCommandTarget_Exec(cmdtrg, &CGID_ShellDocView, 67, 0, &in, &out);
1924                 IOleCommandTarget_Release(cmdtrg);
1925                 if(SUCCEEDED(hres))
1926                     VariantClear(&out);
1927                 SysFreeString(url_str);
1928             }
1929         }
1930     }
1931
1932     if(window->uri && !post_data_size && compare_ignoring_frag(window->uri, uri)) {
1933         TRACE("fragment navigate\n");
1934         return navigate_fragment(window, uri);
1935     }
1936
1937     hres = CreateURLMonikerEx2(NULL, uri, &mon, URL_MK_UNIFORM);
1938     if(FAILED(hres))
1939         return hres;
1940
1941     /* FIXME: Why not set_ready_state? */
1942     window->readystate = READYSTATE_UNINITIALIZED;
1943
1944     hres = create_channelbsc(mon, headers, post_data, post_data_size, TRUE, &bsc);
1945     if(FAILED(hres)) {
1946         IMoniker_Release(mon);
1947         return hres;
1948     }
1949
1950     prepare_for_binding(&window->doc_obj->basedoc, mon, TRUE);
1951
1952     hres = IUri_GetScheme(uri, &scheme);
1953     if(SUCCEEDED(hres) && scheme != URL_SCHEME_JAVASCRIPT) {
1954         navigate_task_t *task;
1955
1956         task = heap_alloc(sizeof(*task));
1957         if(!task) {
1958             IBindStatusCallback_Release(&bsc->bsc.IBindStatusCallback_iface);
1959             IMoniker_Release(mon);
1960             return E_OUTOFMEMORY;
1961         }
1962
1963         /* Silently and repeated when real loading starts? */
1964         window->readystate = READYSTATE_LOADING;
1965         call_docview_84(window->doc_obj);
1966
1967         task->window = window;
1968         task->bscallback = bsc;
1969         task->mon = mon;
1970         push_task(&task->header, navigate_proc, navigate_task_destr, window->task_magic);
1971
1972     }else {
1973         navigate_javascript_task_t *task;
1974
1975         IBindStatusCallback_Release(&bsc->bsc.IBindStatusCallback_iface);
1976         IMoniker_Release(mon);
1977
1978         task = heap_alloc(sizeof(*task));
1979         if(!task)
1980             return E_OUTOFMEMORY;
1981
1982         /* Why silently? */
1983         window->readystate = READYSTATE_COMPLETE;
1984         call_docview_84(window->doc_obj);
1985
1986         IUri_AddRef(uri);
1987         task->window = window;
1988         task->uri = uri;
1989         push_task(&task->header, navigate_javascript_proc, navigate_javascript_task_destr, window->task_magic);
1990     }
1991
1992     return S_OK;
1993 }
1994
1995 HRESULT navigate_new_window(HTMLOuterWindow *window, IUri *uri, const WCHAR *name, IHTMLWindow2 **ret)
1996 {
1997     IWebBrowser2 *web_browser;
1998     IHTMLWindow2 *new_window;
1999     IBindCtx *bind_ctx;
2000     nsChannelBSC *bsc;
2001     HRESULT hres;
2002
2003     hres = create_channelbsc(NULL, NULL, NULL, 0, FALSE, &bsc);
2004     if(FAILED(hres))
2005         return hres;
2006
2007     hres = CreateAsyncBindCtx(0, &bsc->bsc.IBindStatusCallback_iface, NULL, &bind_ctx);
2008     if(FAILED(hres)) {
2009         IBindStatusCallback_Release(&bsc->bsc.IBindStatusCallback_iface);
2010         return hres;
2011     }
2012
2013     hres = CoCreateInstance(&CLSID_InternetExplorer, NULL, CLSCTX_LOCAL_SERVER,
2014             &IID_IWebBrowser2, (void**)&web_browser);
2015     if(SUCCEEDED(hres)) {
2016         ITargetFramePriv2 *target_frame_priv;
2017
2018         hres = IWebBrowser2_QueryInterface(web_browser, &IID_ITargetFramePriv2, (void**)&target_frame_priv);
2019         if(SUCCEEDED(hres)) {
2020             hres = ITargetFramePriv2_AggregatedNavigation2(target_frame_priv,
2021                     HLNF_DISABLEWINDOWRESTRICTIONS|HLNF_OPENINNEWWINDOW, bind_ctx, &bsc->bsc.IBindStatusCallback_iface,
2022                     name, uri, emptyW);
2023             ITargetFramePriv2_Release(target_frame_priv);
2024
2025             if(SUCCEEDED(hres))
2026                 hres = do_query_service((IUnknown*)web_browser, &SID_SHTMLWindow, &IID_IHTMLWindow2, (void**)&new_window);
2027         }
2028         if(FAILED(hres)) {
2029             IWebBrowser2_Quit(web_browser);
2030             IWebBrowser2_Release(web_browser);
2031         }
2032     }else {
2033         WARN("Could not create InternetExplorer instance: %08x\n", hres);
2034     }
2035
2036     IBindStatusCallback_Release(&bsc->bsc.IBindStatusCallback_iface);
2037     IBindCtx_Release(bind_ctx);
2038     if(FAILED(hres))
2039         return hres;
2040
2041     IWebBrowser2_put_Visible(web_browser, VARIANT_TRUE);
2042     IWebBrowser2_Release(web_browser);
2043
2044     if(ret)
2045         *ret = new_window;
2046     else
2047         IHTMLWindow2_Release(new_window);
2048     return S_OK;
2049 }
2050
2051 HRESULT hlink_frame_navigate(HTMLDocument *doc, LPCWSTR url, nsChannel *nschannel, DWORD hlnf, BOOL *cancel)
2052 {
2053     IHlinkFrame *hlink_frame;
2054     nsChannelBSC *callback;
2055     IBindCtx *bindctx;
2056     IMoniker *mon;
2057     IHlink *hlink;
2058     HRESULT hres;
2059
2060     *cancel = FALSE;
2061
2062     hres = do_query_service((IUnknown*)doc->doc_obj->client, &IID_IHlinkFrame, &IID_IHlinkFrame,
2063             (void**)&hlink_frame);
2064     if(FAILED(hres))
2065         return S_OK;
2066
2067     hres = create_channelbsc(NULL, NULL, NULL, 0, FALSE, &callback);
2068     if(FAILED(hres)) {
2069         IHlinkFrame_Release(hlink_frame);
2070         return hres;
2071     }
2072
2073     if(nschannel)
2074         read_post_data_stream(callback, nschannel);
2075
2076     hres = CreateAsyncBindCtx(0, &callback->bsc.IBindStatusCallback_iface, NULL, &bindctx);
2077     if(SUCCEEDED(hres))
2078         hres = CoCreateInstance(&CLSID_StdHlink, NULL, CLSCTX_INPROC_SERVER,
2079                 &IID_IHlink, (LPVOID*)&hlink);
2080
2081     if(SUCCEEDED(hres))
2082         hres = CreateURLMoniker(NULL, url, &mon);
2083
2084     if(SUCCEEDED(hres)) {
2085         IHlink_SetMonikerReference(hlink, HLINKSETF_TARGET, mon, NULL);
2086
2087         if(hlnf & HLNF_OPENINNEWWINDOW) {
2088             static const WCHAR wszBlank[] = {'_','b','l','a','n','k',0};
2089             IHlink_SetTargetFrameName(hlink, wszBlank); /* FIXME */
2090         }
2091
2092         hres = IHlinkFrame_Navigate(hlink_frame, hlnf, bindctx,
2093                 &callback->bsc.IBindStatusCallback_iface, hlink);
2094         IMoniker_Release(mon);
2095         *cancel = hres == S_OK;
2096         hres = S_OK;
2097     }
2098
2099     IHlinkFrame_Release(hlink_frame);
2100     IBindCtx_Release(bindctx);
2101     IBindStatusCallback_Release(&callback->bsc.IBindStatusCallback_iface);
2102     return hres;
2103 }
2104
2105 HRESULT navigate_url(HTMLOuterWindow *window, const WCHAR *new_url, const WCHAR *base_url)
2106 {
2107     WCHAR url[INTERNET_MAX_URL_LENGTH];
2108     nsWineURI *uri;
2109     HRESULT hres;
2110
2111     if(!new_url) {
2112         *url = 0;
2113     }else if(base_url) {
2114         DWORD len = 0;
2115
2116         hres = CoInternetCombineUrl(base_url, new_url, URL_ESCAPE_SPACES_ONLY|URL_DONT_ESCAPE_EXTRA_INFO,
2117                 url, sizeof(url)/sizeof(WCHAR), &len, 0);
2118         if(FAILED(hres))
2119             return hres;
2120     }else {
2121         strcpyW(url, new_url);
2122     }
2123
2124     if(window->doc_obj && window->doc_obj->hostui) {
2125         OLECHAR *translated_url = NULL;
2126
2127         hres = IDocHostUIHandler_TranslateUrl(window->doc_obj->hostui, 0, url,
2128                 &translated_url);
2129         if(hres == S_OK) {
2130             TRACE("%08x %s -> %s\n", hres, debugstr_w(url), debugstr_w(translated_url));
2131             strcpyW(url, translated_url);
2132             CoTaskMemFree(translated_url);
2133         }
2134     }
2135
2136     if(window->doc_obj && window->doc_obj->is_webbrowser && window == window->doc_obj->basedoc.window) {
2137         BOOL cancel = FALSE;
2138         IUri *uri;
2139
2140         hres = IDocObjectService_FireBeforeNavigate2(window->doc_obj->doc_object_service, NULL, url, 0x40,
2141                 NULL, NULL, 0, NULL, TRUE, &cancel);
2142         if(SUCCEEDED(hres) && cancel) {
2143             TRACE("Navigation canceled\n");
2144             return S_OK;
2145         }
2146
2147         hres = CreateUri(url, 0, 0, &uri);
2148         if(FAILED(hres))
2149             return hres;
2150
2151         hres = super_navigate(window, uri, NULL, NULL, 0);
2152         IUri_Release(uri);
2153         return hres;
2154     }
2155
2156     if(window->doc_obj && window == window->doc_obj->basedoc.window) {
2157         BOOL cancel;
2158
2159         hres = hlink_frame_navigate(&window->base.inner_window->doc->basedoc, url, NULL, 0, &cancel);
2160         if(FAILED(hres))
2161             return hres;
2162
2163         if(cancel) {
2164             TRACE("Navigation handled by hlink frame\n");
2165             return S_OK;
2166         }
2167     }
2168
2169     hres = create_doc_uri(window, url, &uri);
2170     if(FAILED(hres))
2171         return hres;
2172
2173     hres = load_nsuri(window, uri, NULL, LOAD_FLAGS_NONE);
2174     nsISupports_Release((nsISupports*)uri);
2175     return hres;
2176 }