dlls/mshtml/navigate.c

   1 /*
   2  * Copyright 2006-2010 Jacek Caban for CodeWeavers
   3  *
   4  * This library is free software; you can redistribute it and/or
   5  * modify it under the terms of the GNU Lesser General Public
   6  * License as published by the Free Software Foundation; either
   7  * version 2.1 of the License, or (at your option) any later version.
   8  *
   9  * This library is distributed in the hope that it will be useful,
  10  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  11  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  12  * Lesser General Public License for more details.
  13  *
  14  * You should have received a copy of the GNU Lesser General Public
  15  * License along with this library; if not, write to the Free Software
  16  * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
  17  */
  18
  19 #include <stdarg.h>
  20 #include <assert.h>
  21
  22 #define COBJMACROS
  23 #define NONAMELESSUNION
  24
  25 #include "windef.h"
  26 #include "winbase.h"
  27 #include "winuser.h"
  28 #include "winreg.h"
  29 #include "ole2.h"
  30 #include "hlguids.h"
  31 #include "shlguid.h"
  32 #include "wininet.h"
  33 #include "shlwapi.h"
  34 #include "htiface.h"
  35 #include "shdeprecated.h"
  36
  37 #include "wine/debug.h"
  38
  39 #include "mshtml_private.h"
  40 #include "htmlscript.h"
  41 #include "binding.h"
  42
  43 WINE_DEFAULT_DEBUG_CHANNEL(mshtml);
  44
  45 #define CONTENT_LENGTH "Content-Length"
  46 #define UTF8_STR "utf-8"
  47 #define UTF16_STR "utf-16"
  48
  49 struct nsProtocolStream {
  50     nsIInputStream nsIInputStream_iface;
  51
  52     LONG ref;
  53
  54     char buf[1024];
  55     DWORD buf_size;
  56 };
  57
  58 static inline nsProtocolStream *impl_from_nsIInputStream(nsIInputStream *iface)
  59 {
  60     return CONTAINING_RECORD(iface, nsProtocolStream, nsIInputStream_iface);
  61 }
  62
  63 static nsresult NSAPI nsInputStream_QueryInterface(nsIInputStream *iface, nsIIDRef riid,
  64         void **result)
  65 {
  66     nsProtocolStream *This = impl_from_nsIInputStream(iface);
  67
  68     *result = NULL;
  69
  70     if(IsEqualGUID(&IID_nsISupports, riid)) {
  71         TRACE("(%p)->(IID_nsISupports %p)\n", This, result);
  72         *result  = &This->nsIInputStream_iface;
  73     }else if(IsEqualGUID(&IID_nsIInputStream, riid)) {
  74         TRACE("(%p)->(IID_nsIInputStream %p)\n", This, result);
  75         *result  = &This->nsIInputStream_iface;
  76     }
  77
  78     if(*result) {
  79         nsIInputStream_AddRef(&This->nsIInputStream_iface);
  80         return NS_OK;
  81     }
  82
  83     WARN("unsupported interface %s\n", debugstr_guid(riid));
  84     return NS_NOINTERFACE;
  85 }
  86
  87 static nsrefcnt NSAPI nsInputStream_AddRef(nsIInputStream *iface)
  88 {
  89     nsProtocolStream *This = impl_from_nsIInputStream(iface);
  90     LONG ref = InterlockedIncrement(&This->ref);
  91
  92     TRACE("(%p) ref=%d\n", This, ref);
  93
  94     return ref;
  95 }
  96
  97
  98 static nsrefcnt NSAPI nsInputStream_Release(nsIInputStream *iface)
  99 {
 100     nsProtocolStream *This = impl_from_nsIInputStream(iface);
 101     LONG ref = InterlockedDecrement(&This->ref);
 102
 103     TRACE("(%p) ref=%d\n", This, ref);
 104
 105     if(!ref)
 106         heap_free(This);
 107
 108     return ref;
 109 }
 110
 111 static nsresult NSAPI nsInputStream_Close(nsIInputStream *iface)
 112 {
 113     nsProtocolStream *This = impl_from_nsIInputStream(iface);
 114     FIXME("(%p)\n", This);
 115     return NS_ERROR_NOT_IMPLEMENTED;
 116 }
 117
 118 static nsresult NSAPI nsInputStream_Available(nsIInputStream *iface, UINT64 *_retval)
 119 {
 120     nsProtocolStream *This = impl_from_nsIInputStream(iface);
 121     FIXME("(%p)->(%p)\n", This, _retval);
 122     return NS_ERROR_NOT_IMPLEMENTED;
 123 }
 124
 125 static nsresult NSAPI nsInputStream_Read(nsIInputStream *iface, char *aBuf, UINT32 aCount,
 126                                          UINT32 *_retval)
 127 {
 128     nsProtocolStream *This = impl_from_nsIInputStream(iface);
 129     DWORD read = aCount;
 130
 131     TRACE("(%p)->(%p %d %p)\n", This, aBuf, aCount, _retval);
 132
 133     if(read > This->buf_size)
 134         read = This->buf_size;
 135
 136     if(read) {
 137         memcpy(aBuf, This->buf, read);
 138         if(read < This->buf_size)
 139             memmove(This->buf, This->buf+read, This->buf_size-read);
 140         This->buf_size -= read;
 141     }
 142
 143     *_retval = read;
 144     return NS_OK;
 145 }
 146
 147 static nsresult NSAPI nsInputStream_ReadSegments(nsIInputStream *iface,
 148         nsresult (WINAPI *aWriter)(nsIInputStream*,void*,const char*,UINT32,UINT32,UINT32*),
 149         void *aClousure, UINT32 aCount, UINT32 *_retval)
 150 {
 151     nsProtocolStream *This = impl_from_nsIInputStream(iface);
 152     UINT32 written = 0;
 153     nsresult nsres;
 154
 155     TRACE("(%p)->(%p %p %d %p)\n", This, aWriter, aClousure, aCount, _retval);
 156
 157     if(!This->buf_size)
 158         return S_OK;
 159
 160     if(aCount > This->buf_size)
 161         aCount = This->buf_size;
 162
 163     nsres = aWriter(&This->nsIInputStream_iface, aClousure, This->buf, 0, aCount, &written);
 164     if(NS_FAILED(nsres))
 165         TRACE("aWriter failed: %08x\n", nsres);
 166     else if(written != This->buf_size)
 167         FIXME("written %d != buf_size %d\n", written, This->buf_size);
 168
 169     This->buf_size -= written;
 170
 171     *_retval = written;
 172     return nsres;
 173 }
 174
 175 static nsresult NSAPI nsInputStream_IsNonBlocking(nsIInputStream *iface, cpp_bool *_retval)
 176 {
 177     nsProtocolStream *This = impl_from_nsIInputStream(iface);
 178     FIXME("(%p)->(%p)\n", This, _retval);
 179     return NS_ERROR_NOT_IMPLEMENTED;
 180 }
 181
 182 static const nsIInputStreamVtbl nsInputStreamVtbl = {
 183     nsInputStream_QueryInterface,
 184     nsInputStream_AddRef,
 185     nsInputStream_Release,
 186     nsInputStream_Close,
 187     nsInputStream_Available,
 188     nsInputStream_Read,
 189     nsInputStream_ReadSegments,
 190     nsInputStream_IsNonBlocking
 191 };
 192
 193 static nsProtocolStream *create_nsprotocol_stream(void)
 194 {
 195     nsProtocolStream *ret;
 196
 197     ret = heap_alloc(sizeof(nsProtocolStream));
 198     if(!ret)
 199         return NULL;
 200
 201     ret->nsIInputStream_iface.lpVtbl = &nsInputStreamVtbl;
 202     ret->ref = 1;
 203     ret->buf_size = 0;
 204
 205     return ret;
 206 }
 207
 208 static void release_request_data(request_data_t *request_data)
 209 {
 210     if(request_data->post_stream)
 211         nsIInputStream_Release(request_data->post_stream);
 212     heap_free(request_data->headers);
 213     if(request_data->post_data)
 214         GlobalFree(request_data->post_data);
 215 }
 216
 217 static inline BSCallback *impl_from_IBindStatusCallback(IBindStatusCallback *iface)
 218 {
 219     return CONTAINING_RECORD(iface, BSCallback, IBindStatusCallback_iface);
 220 }
 221
 222 static HRESULT WINAPI BindStatusCallback_QueryInterface(IBindStatusCallback *iface,
 223         REFIID riid, void **ppv)
 224 {
 225     BSCallback *This = impl_from_IBindStatusCallback(iface);
 226
 227     *ppv = NULL;
 228     if(IsEqualGUID(&IID_IUnknown, riid)) {
 229         TRACE("(%p)->(IID_IUnknown, %p)\n", This, ppv);
 230         *ppv = &This->IBindStatusCallback_iface;
 231     }else if(IsEqualGUID(&IID_IBindStatusCallback, riid)) {
 232         TRACE("(%p)->(IID_IBindStatusCallback, %p)\n", This, ppv);
 233         *ppv = &This->IBindStatusCallback_iface;
 234     }else if(IsEqualGUID(&IID_IServiceProvider, riid)) {
 235         TRACE("(%p)->(IID_IServiceProvider %p)\n", This, ppv);
 236         *ppv = &This->IServiceProvider_iface;
 237     }else if(IsEqualGUID(&IID_IHttpNegotiate, riid)) {
 238         TRACE("(%p)->(IID_IHttpNegotiate %p)\n", This, ppv);
 239         *ppv = &This->IHttpNegotiate2_iface;
 240     }else if(IsEqualGUID(&IID_IHttpNegotiate2, riid)) {
 241         TRACE("(%p)->(IID_IHttpNegotiate2 %p)\n", This, ppv);
 242         *ppv = &This->IHttpNegotiate2_iface;
 243     }else if(IsEqualGUID(&IID_IInternetBindInfo, riid)) {
 244         TRACE("(%p)->(IID_IInternetBindInfo %p)\n", This, ppv);
 245         *ppv = &This->IInternetBindInfo_iface;
 246     }else if(IsEqualGUID(&IID_IBindCallbackRedirect, riid)) {
 247         TRACE("(%p)->(IID_IBindCallbackRedirect %p)\n", This, ppv);
 248         *ppv = &This->IBindCallbackRedirect_iface;
 249     }
 250
 251     if(*ppv) {
 252         IBindStatusCallback_AddRef(&This->IBindStatusCallback_iface);
 253         return S_OK;
 254     }
 255
 256     TRACE("Unsupported riid = %s\n", debugstr_guid(riid));
 257     return E_NOINTERFACE;
 258 }
 259
 260 static ULONG WINAPI BindStatusCallback_AddRef(IBindStatusCallback *iface)
 261 {
 262     BSCallback *This = impl_from_IBindStatusCallback(iface);
 263     LONG ref = InterlockedIncrement(&This->ref);
 264
 265     TRACE("(%p) ref = %d\n", This, ref);
 266
 267     return ref;
 268 }
 269
 270 static ULONG WINAPI BindStatusCallback_Release(IBindStatusCallback *iface)
 271 {
 272     BSCallback *This = impl_from_IBindStatusCallback(iface);
 273     LONG ref = InterlockedDecrement(&This->ref);
 274
 275     TRACE("(%p) ref = %d\n", This, ref);
 276
 277     if(!ref) {
 278         release_request_data(&This->request_data);
 279         if(This->mon)
 280             IMoniker_Release(This->mon);
 281         if(This->binding)
 282             IBinding_Release(This->binding);
 283         list_remove(&This->entry);
 284         list_init(&This->entry);
 285
 286         This->vtbl->destroy(This);
 287     }
 288
 289     return ref;
 290 }
 291
 292 static HRESULT WINAPI BindStatusCallback_OnStartBinding(IBindStatusCallback *iface,
 293         DWORD dwReserved, IBinding *pbind)
 294 {
 295     BSCallback *This = impl_from_IBindStatusCallback(iface);
 296
 297     TRACE("(%p)->(%d %p)\n", This, dwReserved, pbind);
 298
 299     IBinding_AddRef(pbind);
 300     This->binding = pbind;
 301
 302     if(This->window)
 303         list_add_head(&This->window->bindings, &This->entry);
 304
 305     return This->vtbl->start_binding(This);
 306 }
 307
 308 static HRESULT WINAPI BindStatusCallback_GetPriority(IBindStatusCallback *iface, LONG *pnPriority)
 309 {
 310     BSCallback *This = impl_from_IBindStatusCallback(iface);
 311     FIXME("(%p)->(%p)\n", This, pnPriority);
 312     return E_NOTIMPL;
 313 }
 314
 315 static HRESULT WINAPI BindStatusCallback_OnLowResource(IBindStatusCallback *iface, DWORD reserved)
 316 {
 317     BSCallback *This = impl_from_IBindStatusCallback(iface);
 318     FIXME("(%p)->(%d)\n", This, reserved);
 319     return E_NOTIMPL;
 320 }
 321
 322 static HRESULT WINAPI BindStatusCallback_OnProgress(IBindStatusCallback *iface, ULONG ulProgress,
 323         ULONG ulProgressMax, ULONG ulStatusCode, LPCWSTR szStatusText)
 324 {
 325     BSCallback *This = impl_from_IBindStatusCallback(iface);
 326
 327     TRACE("%p)->(%u %u %u %s)\n", This, ulProgress, ulProgressMax, ulStatusCode,
 328             debugstr_w(szStatusText));
 329
 330     return This->vtbl->on_progress(This, ulStatusCode, szStatusText);
 331 }
 332
 333 static HRESULT WINAPI BindStatusCallback_OnStopBinding(IBindStatusCallback *iface,
 334         HRESULT hresult, LPCWSTR szError)
 335 {
 336     BSCallback *This = impl_from_IBindStatusCallback(iface);
 337     HRESULT hres;
 338
 339     TRACE("(%p)->(%08x %s)\n", This, hresult, debugstr_w(szError));
 340
 341     /* NOTE: IE7 calls GetBindResult here */
 342
 343     hres = This->vtbl->stop_binding(This, hresult);
 344
 345     if(This->binding) {
 346         IBinding_Release(This->binding);
 347         This->binding = NULL;
 348     }
 349
 350     if(This->mon) {
 351         IMoniker_Release(This->mon);
 352         This->mon = NULL;
 353     }
 354
 355     list_remove(&This->entry);
 356     list_init(&This->entry);
 357     This->window = NULL;
 358
 359     return hres;
 360 }
 361
 362 static HRESULT WINAPI BindStatusCallback_GetBindInfo(IBindStatusCallback *iface,
 363         DWORD *grfBINDF, BINDINFO *pbindinfo)
 364 {
 365     BSCallback *This = impl_from_IBindStatusCallback(iface);
 366     DWORD size;
 367
 368     TRACE("(%p)->(%p %p)\n", This, grfBINDF, pbindinfo);
 369
 370     if(!This->bindinfo_ready) {
 371         HRESULT hres;
 372
 373         hres = This->vtbl->init_bindinfo(This);
 374         if(FAILED(hres))
 375             return hres;
 376
 377         This->bindinfo_ready = TRUE;
 378     }
 379
 380     *grfBINDF = This->bindf;
 381
 382     size = pbindinfo->cbSize;
 383     memset(pbindinfo, 0, size);
 384     pbindinfo->cbSize = size;
 385
 386     pbindinfo->cbstgmedData = This->request_data.post_data_len;
 387     pbindinfo->dwCodePage = CP_UTF8;
 388     pbindinfo->dwOptions = This->bindinfo_options;
 389
 390     if(This->request_data.post_data_len) {
 391         pbindinfo->dwBindVerb = BINDVERB_POST;
 392
 393         pbindinfo->stgmedData.tymed = TYMED_HGLOBAL;
 394         pbindinfo->stgmedData.u.hGlobal = This->request_data.post_data;
 395         pbindinfo->stgmedData.pUnkForRelease = (IUnknown*)&This->IBindStatusCallback_iface;
 396         IBindStatusCallback_AddRef(&This->IBindStatusCallback_iface);
 397     }
 398
 399     return S_OK;
 400 }
 401
 402 static HRESULT WINAPI BindStatusCallback_OnDataAvailable(IBindStatusCallback *iface,
 403         DWORD grfBSCF, DWORD dwSize, FORMATETC *pformatetc, STGMEDIUM *pstgmed)
 404 {
 405     BSCallback *This = impl_from_IBindStatusCallback(iface);
 406
 407     TRACE("(%p)->(%08x %d %p %p)\n", This, grfBSCF, dwSize, pformatetc, pstgmed);
 408
 409     return This->vtbl->read_data(This, pstgmed->u.pstm);
 410 }
 411
 412 static HRESULT WINAPI BindStatusCallback_OnObjectAvailable(IBindStatusCallback *iface,
 413         REFIID riid, IUnknown *punk)
 414 {
 415     BSCallback *This = impl_from_IBindStatusCallback(iface);
 416     FIXME("(%p)->(%s %p)\n", This, debugstr_guid(riid), punk);
 417     return E_NOTIMPL;
 418 }
 419
 420 static const IBindStatusCallbackVtbl BindStatusCallbackVtbl = {
 421     BindStatusCallback_QueryInterface,
 422     BindStatusCallback_AddRef,
 423     BindStatusCallback_Release,
 424     BindStatusCallback_OnStartBinding,
 425     BindStatusCallback_GetPriority,
 426     BindStatusCallback_OnLowResource,
 427     BindStatusCallback_OnProgress,
 428     BindStatusCallback_OnStopBinding,
 429     BindStatusCallback_GetBindInfo,
 430     BindStatusCallback_OnDataAvailable,
 431     BindStatusCallback_OnObjectAvailable
 432 };
 433
 434 static inline BSCallback *impl_from_IHttpNegotiate2(IHttpNegotiate2 *iface)
 435 {
 436     return CONTAINING_RECORD(iface, BSCallback, IHttpNegotiate2_iface);
 437 }
 438
 439 static HRESULT WINAPI HttpNegotiate_QueryInterface(IHttpNegotiate2 *iface,
 440                                                    REFIID riid, void **ppv)
 441 {
 442     BSCallback *This = impl_from_IHttpNegotiate2(iface);
 443     return IBindStatusCallback_QueryInterface(&This->IBindStatusCallback_iface, riid, ppv);
 444 }
 445
 446 static ULONG WINAPI HttpNegotiate_AddRef(IHttpNegotiate2 *iface)
 447 {
 448     BSCallback *This = impl_from_IHttpNegotiate2(iface);
 449     return IBindStatusCallback_AddRef(&This->IBindStatusCallback_iface);
 450 }
 451
 452 static ULONG WINAPI HttpNegotiate_Release(IHttpNegotiate2 *iface)
 453 {
 454     BSCallback *This = impl_from_IHttpNegotiate2(iface);
 455     return IBindStatusCallback_Release(&This->IBindStatusCallback_iface);
 456 }
 457
 458 static HRESULT WINAPI HttpNegotiate_BeginningTransaction(IHttpNegotiate2 *iface,
 459         LPCWSTR szURL, LPCWSTR szHeaders, DWORD dwReserved, LPWSTR *pszAdditionalHeaders)
 460 {
 461     BSCallback *This = impl_from_IHttpNegotiate2(iface);
 462     HRESULT hres;
 463
 464     TRACE("(%p)->(%s %s %d %p)\n", This, debugstr_w(szURL), debugstr_w(szHeaders),
 465           dwReserved, pszAdditionalHeaders);
 466
 467     *pszAdditionalHeaders = NULL;
 468
 469     hres = This->vtbl->beginning_transaction(This, pszAdditionalHeaders);
 470     if(hres != S_FALSE)
 471         return hres;
 472
 473     if(This->request_data.headers) {
 474         DWORD size;
 475
 476         size = (lstrlenW(This->request_data.headers)+1)*sizeof(WCHAR);
 477         *pszAdditionalHeaders = CoTaskMemAlloc(size);
 478         if(!*pszAdditionalHeaders)
 479             return E_OUTOFMEMORY;
 480         memcpy(*pszAdditionalHeaders, This->request_data.headers, size);
 481     }
 482
 483     return S_OK;
 484 }
 485
 486 static HRESULT WINAPI HttpNegotiate_OnResponse(IHttpNegotiate2 *iface, DWORD dwResponseCode,
 487         LPCWSTR szResponseHeaders, LPCWSTR szRequestHeaders, LPWSTR *pszAdditionalRequestHeaders)
 488 {
 489     BSCallback *This = impl_from_IHttpNegotiate2(iface);
 490
 491     TRACE("(%p)->(%d %s %s %p)\n", This, dwResponseCode, debugstr_w(szResponseHeaders),
 492           debugstr_w(szRequestHeaders), pszAdditionalRequestHeaders);
 493
 494     return This->vtbl->on_response(This, dwResponseCode, szResponseHeaders);
 495 }
 496
 497 static HRESULT WINAPI HttpNegotiate_GetRootSecurityId(IHttpNegotiate2 *iface,
 498         BYTE *pbSecurityId, DWORD *pcbSecurityId, DWORD_PTR dwReserved)
 499 {
 500     BSCallback *This = impl_from_IHttpNegotiate2(iface);
 501     TRACE("(%p)->(%p %p %ld)\n", This, pbSecurityId, pcbSecurityId, dwReserved);
 502     return E_NOTIMPL; /* FIXME */
 503 }
 504
 505 static const IHttpNegotiate2Vtbl HttpNegotiate2Vtbl = {
 506     HttpNegotiate_QueryInterface,
 507     HttpNegotiate_AddRef,
 508     HttpNegotiate_Release,
 509     HttpNegotiate_BeginningTransaction,
 510     HttpNegotiate_OnResponse,
 511     HttpNegotiate_GetRootSecurityId
 512 };
 513
 514 static inline BSCallback *impl_from_IInternetBindInfo(IInternetBindInfo *iface)
 515 {
 516     return CONTAINING_RECORD(iface, BSCallback, IInternetBindInfo_iface);
 517 }
 518
 519 static HRESULT WINAPI InternetBindInfo_QueryInterface(IInternetBindInfo *iface,
 520                                                       REFIID riid, void **ppv)
 521 {
 522     BSCallback *This = impl_from_IInternetBindInfo(iface);
 523     return IBindStatusCallback_QueryInterface(&This->IBindStatusCallback_iface, riid, ppv);
 524 }
 525
 526 static ULONG WINAPI InternetBindInfo_AddRef(IInternetBindInfo *iface)
 527 {
 528     BSCallback *This = impl_from_IInternetBindInfo(iface);
 529     return IBindStatusCallback_AddRef(&This->IBindStatusCallback_iface);
 530 }
 531
 532 static ULONG WINAPI InternetBindInfo_Release(IInternetBindInfo *iface)
 533 {
 534     BSCallback *This = impl_from_IInternetBindInfo(iface);
 535     return IBindStatusCallback_Release(&This->IBindStatusCallback_iface);
 536 }
 537
 538 static HRESULT WINAPI InternetBindInfo_GetBindInfo(IInternetBindInfo *iface,
 539                                                    DWORD *grfBINDF, BINDINFO *pbindinfo)
 540 {
 541     BSCallback *This = impl_from_IInternetBindInfo(iface);
 542     FIXME("(%p)->(%p %p)\n", This, grfBINDF, pbindinfo);
 543     return E_NOTIMPL;
 544 }
 545
 546 static HRESULT WINAPI InternetBindInfo_GetBindString(IInternetBindInfo *iface,
 547         ULONG ulStringType, LPOLESTR *ppwzStr, ULONG cEl, ULONG *pcElFetched)
 548 {
 549     BSCallback *This = impl_from_IInternetBindInfo(iface);
 550     FIXME("(%p)->(%u %p %u %p)\n", This, ulStringType, ppwzStr, cEl, pcElFetched);
 551     return E_NOTIMPL;
 552 }
 553
 554 static const IInternetBindInfoVtbl InternetBindInfoVtbl = {
 555     InternetBindInfo_QueryInterface,
 556     InternetBindInfo_AddRef,
 557     InternetBindInfo_Release,
 558     InternetBindInfo_GetBindInfo,
 559     InternetBindInfo_GetBindString
 560 };
 561
 562 static inline BSCallback *impl_from_IBindCallbackRedirect(IBindCallbackRedirect *iface)
 563 {
 564     return CONTAINING_RECORD(iface, BSCallback, IBindCallbackRedirect_iface);
 565 }
 566
 567 static HRESULT WINAPI BindCallbackRedirect_QueryInterface(IBindCallbackRedirect *iface, REFIID riid, void **ppv)
 568 {
 569     BSCallback *This = impl_from_IBindCallbackRedirect(iface);
 570     return IBindStatusCallback_QueryInterface(&This->IBindStatusCallback_iface, riid, ppv);
 571 }
 572
 573 static ULONG WINAPI BindCallbackRedirect_AddRef(IBindCallbackRedirect *iface)
 574 {
 575     BSCallback *This = impl_from_IBindCallbackRedirect(iface);
 576     return IBindStatusCallback_AddRef(&This->IBindStatusCallback_iface);
 577 }
 578
 579 static ULONG WINAPI BindCallbackRedirect_Release(IBindCallbackRedirect *iface)
 580 {
 581     BSCallback *This = impl_from_IBindCallbackRedirect(iface);
 582     return IBindStatusCallback_Release(&This->IBindStatusCallback_iface);
 583 }
 584
 585 static HRESULT WINAPI BindCallbackRedirect_Redirect(IBindCallbackRedirect *iface, const WCHAR *url, VARIANT_BOOL *vbCancel)
 586 {
 587     BSCallback *This = impl_from_IBindCallbackRedirect(iface);
 588     GeckoBrowser *browser;
 589     BOOL cancel = FALSE;
 590     BSTR frame_name = NULL;
 591     HRESULT hres = S_OK;
 592
 593     TRACE("(%p)->(%s %p)\n", This, debugstr_w(url), vbCancel);
 594
 595     if(This->window && This->window->base.outer_window && (browser = This->window->base.outer_window->browser)
 596        && browser->doc->doc_object_service) {
 597         if(is_main_content_window(This->window->base.outer_window)) {
 598             hres = IHTMLWindow2_get_name(&This->window->base.IHTMLWindow2_iface, &frame_name);
 599             if(FAILED(hres))
 600                 return hres;
 601         }
 602
 603         hres = IDocObjectService_FireBeforeNavigate2(browser->doc->doc_object_service, NULL, url, 0x40,
 604                                                      frame_name, NULL, 0, NULL, TRUE, &cancel);
 605         SysFreeString(frame_name);
 606     }
 607
 608     *vbCancel = variant_bool(cancel);
 609     return hres;
 610 }
 611
 612 static const IBindCallbackRedirectVtbl BindCallbackRedirectVtbl = {
 613     BindCallbackRedirect_QueryInterface,
 614     BindCallbackRedirect_AddRef,
 615     BindCallbackRedirect_Release,
 616     BindCallbackRedirect_Redirect
 617 };
 618
 619 static inline BSCallback *impl_from_IServiceProvider(IServiceProvider *iface)
 620 {
 621     return CONTAINING_RECORD(iface, BSCallback, IServiceProvider_iface);
 622 }
 623
 624 static HRESULT WINAPI BSCServiceProvider_QueryInterface(IServiceProvider *iface,
 625                                                         REFIID riid, void **ppv)
 626 {
 627     BSCallback *This = impl_from_IServiceProvider(iface);
 628     return IBindStatusCallback_QueryInterface(&This->IBindStatusCallback_iface, riid, ppv);
 629 }
 630
 631 static ULONG WINAPI BSCServiceProvider_AddRef(IServiceProvider *iface)
 632 {
 633     BSCallback *This = impl_from_IServiceProvider(iface);
 634     return IBindStatusCallback_AddRef(&This->IBindStatusCallback_iface);
 635 }
 636
 637 static ULONG WINAPI BSCServiceProvider_Release(IServiceProvider *iface)
 638 {
 639     BSCallback *This = impl_from_IServiceProvider(iface);
 640     return IBindStatusCallback_Release(&This->IBindStatusCallback_iface);
 641 }
 642
 643 static HRESULT WINAPI BSCServiceProvider_QueryService(IServiceProvider *iface,
 644         REFGUID guidService, REFIID riid, void **ppv)
 645 {
 646     BSCallback *This = impl_from_IServiceProvider(iface);
 647
 648     TRACE("(%p)->(%s %s %p)\n", This, debugstr_guid(guidService), debugstr_guid(riid), ppv);
 649
 650     if(This->window && IsEqualGUID(guidService, &IID_IWindowForBindingUI))
 651         return IServiceProvider_QueryService(&This->window->base.IServiceProvider_iface, guidService, riid, ppv);
 652     return E_NOINTERFACE;
 653 }
 654
 655 static const IServiceProviderVtbl ServiceProviderVtbl = {
 656     BSCServiceProvider_QueryInterface,
 657     BSCServiceProvider_AddRef,
 658     BSCServiceProvider_Release,
 659     BSCServiceProvider_QueryService
 660 };
 661
 662 void init_bscallback(BSCallback *This, const BSCallbackVtbl *vtbl, IMoniker *mon, DWORD bindf)
 663 {
 664     This->IBindStatusCallback_iface.lpVtbl = &BindStatusCallbackVtbl;
 665     This->IServiceProvider_iface.lpVtbl = &ServiceProviderVtbl;
 666     This->IHttpNegotiate2_iface.lpVtbl = &HttpNegotiate2Vtbl;
 667     This->IInternetBindInfo_iface.lpVtbl = &InternetBindInfoVtbl;
 668     This->IBindCallbackRedirect_iface.lpVtbl = &BindCallbackRedirectVtbl;
 669     This->vtbl = vtbl;
 670     This->ref = 1;
 671     This->bindf = bindf;
 672     This->bindinfo_options = BINDINFO_OPTIONS_USE_IE_ENCODING;
 673     This->bom = BOM_NONE;
 674
 675     list_init(&This->entry);
 676
 677     if(mon)
 678         IMoniker_AddRef(mon);
 679     This->mon = mon;
 680 }
 681
 682 HRESULT read_stream(BSCallback *This, IStream *stream, void *buf, DWORD size, DWORD *ret_size)
 683 {
 684     DWORD read_size = 0, skip=0;
 685     BYTE *data = buf;
 686     HRESULT hres;
 687
 688     hres = IStream_Read(stream, buf, size, &read_size);
 689
 690     if(!This->read && This->bom == BOM_NONE) {
 691         if(read_size >= 2 && data[0] == 0xff && data[1] == 0xfe) {
 692             This->bom = BOM_UTF16;
 693             skip = 2;
 694         }else if(read_size >= 3 && data[0] == 0xef && data[1] == 0xbb && data[2] == 0xbf) {
 695             This->bom = BOM_UTF8;
 696             skip = 3;
 697         }
 698         if(skip) {
 699             read_size -= skip;
 700             if(read_size)
 701                 memmove(data, data+skip, read_size);
 702         }
 703     }
 704
 705     This->read += read_size;
 706     *ret_size = read_size;
 707     return hres;
 708 }
 709
 710 static void parse_content_type(nsChannelBSC *This, const WCHAR *value)
 711 {
 712     const WCHAR *ptr;
 713     size_t len;
 714
 715     static const WCHAR charsetW[] = {'c','h','a','r','s','e','t','='};
 716
 717     ptr = wcschr(value, ';');
 718     if(!ptr)
 719         return;
 720
 721     ptr++;
 722     while(*ptr && iswspace(*ptr))
 723         ptr++;
 724
 725     len = lstrlenW(value);
 726     if(ptr + ARRAY_SIZE(charsetW) < value+len && !wcsnicmp(ptr, charsetW, ARRAY_SIZE(charsetW))) {
 727         size_t charset_len, lena;
 728         nsACString charset_str;
 729         const WCHAR *charset;
 730         char *charseta;
 731
 732         ptr += ARRAY_SIZE(charsetW);
 733
 734         if(*ptr == '\'') {
 735             FIXME("Quoted value\n");
 736             return;
 737         }else {
 738             charset = ptr;
 739             while(*ptr && *ptr != ',')
 740                 ptr++;
 741             charset_len = ptr-charset;
 742         }
 743
 744         lena = WideCharToMultiByte(CP_ACP, 0, charset, charset_len, NULL, 0, NULL, NULL);
 745         charseta = heap_alloc(lena+1);
 746         if(!charseta)
 747             return;
 748
 749         WideCharToMultiByte(CP_ACP, 0, charset, charset_len, charseta, lena, NULL, NULL);
 750         charseta[lena] = 0;
 751
 752         nsACString_InitDepend(&charset_str, charseta);
 753         nsIHttpChannel_SetContentCharset(&This->nschannel->nsIHttpChannel_iface, &charset_str);
 754         nsACString_Finish(&charset_str);
 755         heap_free(charseta);
 756     }else {
 757         FIXME("unhandled: %s\n", debugstr_wn(ptr, len - (ptr-value)));
 758     }
 759 }
 760
 761 static HRESULT parse_headers(const WCHAR *headers, struct list *headers_list)
 762 {
 763     const WCHAR *header, *header_end, *colon, *value;
 764     HRESULT hres;
 765
 766     header = headers;
 767     while(*header) {
 768         if(header[0] == '\r' && header[1] == '\n' && !header[2])
 769             break;
 770         for(colon = header; *colon && *colon != ':' && *colon != '\r'; colon++);
 771         if(*colon != ':')
 772             return E_FAIL;
 773
 774         value = colon+1;
 775         while(*value == ' ')
 776             value++;
 777         if(!*value)
 778             return E_FAIL;
 779
 780         for(header_end = value+1; *header_end && *header_end != '\r'; header_end++);
 781
 782         hres = set_http_header(headers_list, header, colon-header, value, header_end-value);
 783         if(FAILED(hres))
 784             return hres;
 785
 786         header = header_end;
 787         if(header[0] == '\r' && header[1] == '\n')
 788             header += 2;
 789     }
 790
 791     return S_OK;
 792 }
 793
 794 static HRESULT process_response_headers(nsChannelBSC *This, const WCHAR *headers)
 795 {
 796     http_header_t *iter;
 797     HRESULT hres;
 798
 799     hres = parse_headers(headers, &This->nschannel->response_headers);
 800     if(FAILED(hres))
 801         return hres;
 802
 803     LIST_FOR_EACH_ENTRY(iter, &This->nschannel->response_headers, http_header_t, entry) {
 804         if(!wcsicmp(iter->header, L"content-type"))
 805             parse_content_type(This, iter->data);
 806     }
 807
 808     return S_OK;
 809 }
 810
 811 static void query_http_info(nsChannelBSC *This, IWinInetHttpInfo *wininet_info)
 812 {
 813     const WCHAR *ptr;
 814     DWORD len = 0;
 815     WCHAR *buf;
 816
 817     IWinInetHttpInfo_QueryInfo(wininet_info, HTTP_QUERY_RAW_HEADERS_CRLF, NULL, &len, NULL, NULL);
 818     if(!len)
 819         return;
 820
 821     buf = heap_alloc(len);
 822     if(!buf)
 823         return;
 824
 825     IWinInetHttpInfo_QueryInfo(wininet_info, HTTP_QUERY_RAW_HEADERS_CRLF, buf, &len, NULL, NULL);
 826     if(!len) {
 827         heap_free(buf);
 828         return;
 829     }
 830
 831     ptr = wcschr(buf, '\r');
 832     if(ptr && ptr[1] == '\n') {
 833         ptr += 2;
 834         process_response_headers(This, ptr);
 835     }
 836
 837     heap_free(buf);
 838 }
 839
 840 HRESULT start_binding(HTMLInnerWindow *inner_window, BSCallback *bscallback, IBindCtx *bctx)
 841 {
 842     IStream *str = NULL;
 843     HRESULT hres;
 844
 845     TRACE("(%p %p %p)\n", inner_window, bscallback, bctx);
 846
 847     bscallback->window = inner_window;
 848
 849     /* NOTE: IE7 calls IsSystemMoniker here*/
 850
 851     if(bctx) {
 852         hres = RegisterBindStatusCallback(bctx, &bscallback->IBindStatusCallback_iface, NULL, 0);
 853         if(SUCCEEDED(hres))
 854             IBindCtx_AddRef(bctx);
 855     }else {
 856         hres = CreateAsyncBindCtx(0, &bscallback->IBindStatusCallback_iface, NULL, &bctx);
 857     }
 858
 859     if(FAILED(hres)) {
 860         bscallback->window = NULL;
 861         return hres;
 862     }
 863
 864     hres = IMoniker_BindToStorage(bscallback->mon, bctx, NULL, &IID_IStream, (void**)&str);
 865     IBindCtx_Release(bctx);
 866     if(FAILED(hres)) {
 867         WARN("BindToStorage failed: %08x\n", hres);
 868         bscallback->window = NULL;
 869         return hres;
 870     }
 871
 872     if(str)
 873         IStream_Release(str);
 874
 875     return S_OK;
 876 }
 877
 878 static HRESULT read_post_data_stream(nsIInputStream *stream, BOOL contains_headers, struct list *headers_list,
 879         request_data_t *request_data)
 880 {
 881     nsISeekableStream *seekable_stream;
 882     UINT64 available = 0;
 883     UINT32 data_len = 0;
 884     char *data, *post_data;
 885     nsresult nsres;
 886     HRESULT hres = S_OK;
 887
 888     if(!stream)
 889         return S_OK;
 890
 891     nsres =  nsIInputStream_Available(stream, &available);
 892     if(NS_FAILED(nsres))
 893         return E_FAIL;
 894
 895     post_data = data = GlobalAlloc(0, available+1);
 896     if(!data)
 897         return E_OUTOFMEMORY;
 898
 899     nsres = nsIInputStream_Read(stream, data, available, &data_len);
 900     if(NS_FAILED(nsres)) {
 901         GlobalFree(data);
 902         return E_FAIL;
 903     }
 904
 905     if(contains_headers) {
 906         if(data_len >= 2 && data[0] == '\r' && data[1] == '\n') {
 907             post_data = data+2;
 908             data_len -= 2;
 909         }else {
 910             WCHAR *headers;
 911             DWORD size;
 912             char *ptr;
 913
 914             post_data += data_len;
 915             for(ptr = data; ptr+4 < data+data_len; ptr++) {
 916                 if(!memcmp(ptr, "\r\n\r\n", 4)) {
 917                     ptr += 2;
 918                     post_data = ptr+2;
 919                     break;
 920                 }
 921             }
 922
 923             data_len -= post_data-data;
 924
 925             size = MultiByteToWideChar(CP_ACP, 0, data, ptr-data, NULL, 0);
 926             headers = heap_alloc((size+1)*sizeof(WCHAR));
 927             if(headers) {
 928                 MultiByteToWideChar(CP_ACP, 0, data, ptr-data, headers, size);
 929                 headers[size] = 0;
 930                 if(headers_list)
 931                     hres = parse_headers(headers, headers_list);
 932                 if(SUCCEEDED(hres))
 933                     request_data->headers = headers;
 934                 else
 935                     heap_free(headers);
 936             }else {
 937                 hres = E_OUTOFMEMORY;
 938             }
 939         }
 940     }
 941
 942     if(FAILED(hres)) {
 943         GlobalFree(data);
 944         return hres;
 945     }
 946
 947     if(!data_len) {
 948         GlobalFree(data);
 949         post_data = NULL;
 950     }else if(post_data != data) {
 951         char *new_data;
 952
 953         new_data = GlobalAlloc(0, data_len+1);
 954         if(new_data)
 955             memcpy(new_data, post_data, data_len);
 956         GlobalFree(data);
 957         if(!new_data)
 958             return E_OUTOFMEMORY;
 959         post_data = new_data;
 960     }
 961
 962     if(post_data)
 963         post_data[data_len] = 0;
 964     request_data->post_data = post_data;
 965     request_data->post_data_len = data_len;
 966
 967     nsres = nsIInputStream_QueryInterface(stream, &IID_nsISeekableStream, (void**)&seekable_stream);
 968     assert(nsres == NS_OK);
 969
 970     nsres = nsISeekableStream_Seek(seekable_stream, NS_SEEK_SET, 0);
 971     assert(nsres == NS_OK);
 972
 973     nsISeekableStream_Release(seekable_stream);
 974
 975     nsIInputStream_AddRef(stream);
 976     request_data->post_stream = stream;
 977     TRACE("post_data = %s\n", debugstr_an(request_data->post_data, request_data->post_data_len));
 978     return S_OK;
 979 }
 980
 981 static HRESULT on_start_nsrequest(nsChannelBSC *This)
 982 {
 983     nsresult nsres;
 984
 985     This->nschannel->binding = This;
 986
 987     /* FIXME: it's needed for http connections from BindToObject. */
 988     if(!This->nschannel->response_status)
 989         This->nschannel->response_status = 200;
 990
 991     nsres = nsIStreamListener_OnStartRequest(This->nslistener,
 992             (nsIRequest*)&This->nschannel->nsIHttpChannel_iface, This->nscontext);
 993     if(NS_FAILED(nsres)) {
 994         FIXME("OnStartRequest failed: %08x\n", nsres);
 995         return E_FAIL;
 996     }
 997
 998     if(This->is_doc_channel) {
 999         HRESULT hres;
1000
1001         if(!This->bsc.window)
1002             return E_ABORT; /* Binding aborted in OnStartRequest call. */
1003         hres = update_window_doc(This->bsc.window);
1004         if(FAILED(hres))
1005             return hres;
1006
1007         if(This->bsc.binding)
1008             process_document_response_headers(This->bsc.window->doc, This->bsc.binding);
1009         if(This->bsc.window->base.outer_window->readystate != READYSTATE_LOADING)
1010             set_ready_state(This->bsc.window->base.outer_window, READYSTATE_LOADING);
1011     }
1012
1013     return S_OK;
1014 }
1015
1016 static void on_stop_nsrequest(nsChannelBSC *This, HRESULT result)
1017 {
1018     nsresult nsres, request_result;
1019
1020     switch(result) {
1021     case S_OK:
1022         request_result = NS_OK;
1023         break;
1024     case E_ABORT:
1025         request_result = NS_BINDING_ABORTED;
1026         break;
1027     default:
1028         request_result = NS_ERROR_FAILURE;
1029     }
1030
1031     if(This->nslistener) {
1032         nsres = nsIStreamListener_OnStopRequest(This->nslistener,
1033                  (nsIRequest*)&This->nschannel->nsIHttpChannel_iface, This->nscontext,
1034                  request_result);
1035         if(NS_FAILED(nsres))
1036             WARN("OnStopRequest failed: %08x\n", nsres);
1037     }
1038
1039     if(This->nschannel) {
1040         if(This->nschannel->load_group) {
1041             nsres = nsILoadGroup_RemoveRequest(This->nschannel->load_group,
1042                     (nsIRequest*)&This->nschannel->nsIHttpChannel_iface, NULL, request_result);
1043             if(NS_FAILED(nsres))
1044                 ERR("RemoveRequest failed: %08x\n", nsres);
1045         }
1046         if(This->nschannel->binding == This)
1047             This->nschannel->binding = NULL;
1048     }
1049 }
1050
1051 static HRESULT read_stream_data(nsChannelBSC *This, IStream *stream)
1052 {
1053     DWORD read;
1054     nsresult nsres;
1055     HRESULT hres;
1056
1057     if(!This->response_processed) {
1058         IWinInetHttpInfo *wininet_info;
1059
1060         This->response_processed = TRUE;
1061         if(This->bsc.binding) {
1062             hres = IBinding_QueryInterface(This->bsc.binding, &IID_IWinInetHttpInfo, (void**)&wininet_info);
1063             if(SUCCEEDED(hres)) {
1064                 query_http_info(This, wininet_info);
1065                 IWinInetHttpInfo_Release(wininet_info);
1066             }
1067         }
1068     }
1069
1070     if(!This->nschannel)
1071         return S_OK;
1072
1073     if(!This->nslistener) {
1074         BYTE buf[1024];
1075
1076         do {
1077             hres = read_stream(&This->bsc, stream, buf, sizeof(buf), &read);
1078         }while(hres == S_OK && read);
1079
1080         return S_OK;
1081     }
1082
1083     if(!This->nsstream) {
1084         This->nsstream = create_nsprotocol_stream();
1085         if(!This->nsstream)
1086             return E_OUTOFMEMORY;
1087     }
1088
1089     do {
1090         BOOL first_read = !This->bsc.read;
1091
1092         hres = read_stream(&This->bsc, stream, This->nsstream->buf+This->nsstream->buf_size,
1093                 sizeof(This->nsstream->buf)-This->nsstream->buf_size, &read);
1094         if(!read)
1095             break;
1096
1097         This->nsstream->buf_size += read;
1098
1099         if(first_read) {
1100             switch(This->bsc.bom) {
1101             case BOM_UTF8:
1102                 This->nschannel->charset = heap_strdupA(UTF8_STR);
1103                 break;
1104             case BOM_UTF16:
1105                 This->nschannel->charset = heap_strdupA(UTF16_STR);
1106             case BOM_NONE:
1107                 /* FIXME: Get charset from HTTP headers */;
1108             }
1109
1110             if(!This->nschannel->content_type) {
1111                 WCHAR *mime;
1112
1113                 hres = FindMimeFromData(NULL, NULL, This->nsstream->buf, This->nsstream->buf_size,
1114                         This->is_doc_channel ? L"text/html" : NULL, 0, &mime, 0);
1115                 if(FAILED(hres))
1116                     return hres;
1117
1118                 TRACE("Found MIME %s\n", debugstr_w(mime));
1119
1120                 This->nschannel->content_type = heap_strdupWtoA(mime);
1121                 CoTaskMemFree(mime);
1122                 if(!This->nschannel->content_type)
1123                     return E_OUTOFMEMORY;
1124             }
1125
1126             hres = on_start_nsrequest(This);
1127             if(FAILED(hres))
1128                 return hres;
1129         }
1130
1131         nsres = nsIStreamListener_OnDataAvailable(This->nslistener,
1132                 (nsIRequest*)&This->nschannel->nsIHttpChannel_iface, This->nscontext,
1133                 &This->nsstream->nsIInputStream_iface, This->bsc.read-This->nsstream->buf_size,
1134                 This->nsstream->buf_size);
1135         if(NS_FAILED(nsres))
1136             ERR("OnDataAvailable failed: %08x\n", nsres);
1137
1138         if(This->nsstream->buf_size == sizeof(This->nsstream->buf)) {
1139             ERR("buffer is full\n");
1140             break;
1141         }
1142     }while(hres == S_OK);
1143
1144     return S_OK;
1145 }
1146
1147 typedef struct {
1148     nsIAsyncVerifyRedirectCallback nsIAsyncVerifyRedirectCallback_iface;
1149
1150     LONG ref;
1151
1152     nsChannel *nschannel;
1153     nsChannelBSC *bsc;
1154 } nsRedirectCallback;
1155
1156 static nsRedirectCallback *impl_from_nsIAsyncVerifyRedirectCallback(nsIAsyncVerifyRedirectCallback *iface)
1157 {
1158     return CONTAINING_RECORD(iface, nsRedirectCallback, nsIAsyncVerifyRedirectCallback_iface);
1159 }
1160
1161 static nsresult NSAPI nsAsyncVerifyRedirectCallback_QueryInterface(nsIAsyncVerifyRedirectCallback *iface,
1162         nsIIDRef riid, void **result)
1163 {
1164     nsRedirectCallback *This = impl_from_nsIAsyncVerifyRedirectCallback(iface);
1165
1166     if(IsEqualGUID(&IID_nsISupports, riid)) {
1167         TRACE("(%p)->(IID_nsISupports %p)\n", This, result);
1168         *result = &This->nsIAsyncVerifyRedirectCallback_iface;
1169     }else if(IsEqualGUID(&IID_nsIAsyncVerifyRedirectCallback, riid)) {
1170         TRACE("(%p)->(IID_nsIAsyncVerifyRedirectCallback %p)\n", This, result);
1171         *result = &This->nsIAsyncVerifyRedirectCallback_iface;
1172     }else {
1173         *result = NULL;
1174         WARN("unimplemented iface %s\n", debugstr_guid(riid));
1175         return NS_NOINTERFACE;
1176     }
1177
1178     nsISupports_AddRef((nsISupports*)*result);
1179     return NS_OK;
1180 }
1181
1182 static nsrefcnt NSAPI nsAsyncVerifyRedirectCallback_AddRef(nsIAsyncVerifyRedirectCallback *iface)
1183 {
1184     nsRedirectCallback *This = impl_from_nsIAsyncVerifyRedirectCallback(iface);
1185     LONG ref = InterlockedIncrement(&This->ref);
1186
1187     TRACE("(%p) ref=%d\n", This, ref);
1188
1189     return ref;
1190 }
1191
1192 static nsrefcnt NSAPI nsAsyncVerifyRedirectCallback_Release(nsIAsyncVerifyRedirectCallback *iface)
1193 {
1194     nsRedirectCallback *This = impl_from_nsIAsyncVerifyRedirectCallback(iface);
1195     LONG ref = InterlockedDecrement(&This->ref);
1196
1197     TRACE("(%p) ref=%d\n", This, ref);
1198
1199     if(!ref) {
1200         IBindStatusCallback_Release(&This->bsc->bsc.IBindStatusCallback_iface);
1201         nsIHttpChannel_Release(&This->nschannel->nsIHttpChannel_iface);
1202         heap_free(This);
1203     }
1204
1205     return ref;
1206 }
1207
1208 static nsresult NSAPI nsAsyncVerifyRedirectCallback_OnRedirectVerifyCallback(nsIAsyncVerifyRedirectCallback *iface, nsresult result)
1209 {
1210     nsRedirectCallback *This = impl_from_nsIAsyncVerifyRedirectCallback(iface);
1211     nsChannel *old_nschannel;
1212     nsresult nsres;
1213
1214     TRACE("(%p)->(%08x)\n", This, result);
1215
1216     old_nschannel = This->bsc->nschannel;
1217     nsIHttpChannel_AddRef(&This->nschannel->nsIHttpChannel_iface);
1218     This->bsc->nschannel = This->nschannel;
1219
1220     if(This->nschannel->load_group) {
1221         nsres = nsILoadGroup_AddRequest(This->nschannel->load_group, (nsIRequest*)&This->nschannel->nsIHttpChannel_iface,
1222                 NULL);
1223         if(NS_FAILED(nsres))
1224             ERR("AddRequest failed: %08x\n", nsres);
1225     }
1226
1227     if(This->bsc->is_doc_channel && This->bsc->bsc.window && This->bsc->bsc.window->base.outer_window) {
1228         IUri *uri = nsuri_get_uri(This->nschannel->uri);
1229
1230         if(uri) {
1231             set_current_uri(This->bsc->bsc.window->base.outer_window, uri);
1232             IUri_Release(uri);
1233         }else {
1234             WARN("Could not get IUri from nsWineURI\n");
1235         }
1236     }
1237
1238     if(old_nschannel) {
1239         if(old_nschannel->load_group) {
1240             nsres = nsILoadGroup_RemoveRequest(old_nschannel->load_group,
1241                     (nsIRequest*)&old_nschannel->nsIHttpChannel_iface, NULL, NS_OK);
1242             if(NS_FAILED(nsres))
1243                 ERR("RemoveRequest failed: %08x\n", nsres);
1244         }
1245         nsIHttpChannel_Release(&old_nschannel->nsIHttpChannel_iface);
1246     }
1247
1248     return NS_OK;
1249 }
1250
1251 static const nsIAsyncVerifyRedirectCallbackVtbl nsAsyncVerifyRedirectCallbackVtbl = {
1252     nsAsyncVerifyRedirectCallback_QueryInterface,
1253     nsAsyncVerifyRedirectCallback_AddRef,
1254     nsAsyncVerifyRedirectCallback_Release,
1255     nsAsyncVerifyRedirectCallback_OnRedirectVerifyCallback
1256 };
1257
1258 static HRESULT create_redirect_callback(nsChannel *nschannel, nsChannelBSC *bsc, nsRedirectCallback **ret)
1259 {
1260     nsRedirectCallback *callback;
1261
1262     callback = heap_alloc(sizeof(*callback));
1263     if(!callback)
1264         return E_OUTOFMEMORY;
1265
1266     callback->nsIAsyncVerifyRedirectCallback_iface.lpVtbl = &nsAsyncVerifyRedirectCallbackVtbl;
1267     callback->ref = 1;
1268
1269     nsIHttpChannel_AddRef(&nschannel->nsIHttpChannel_iface);
1270     callback->nschannel = nschannel;
1271
1272     IBindStatusCallback_AddRef(&bsc->bsc.IBindStatusCallback_iface);
1273     callback->bsc = bsc;
1274
1275     *ret = callback;
1276     return S_OK;
1277 }
1278
1279 static inline nsChannelBSC *nsChannelBSC_from_BSCallback(BSCallback *iface)
1280 {
1281     return CONTAINING_RECORD(iface, nsChannelBSC, bsc);
1282 }
1283
1284 static void nsChannelBSC_destroy(BSCallback *bsc)
1285 {
1286     nsChannelBSC *This = nsChannelBSC_from_BSCallback(bsc);
1287
1288     if(This->nschannel) {
1289         if(This->nschannel->binding == This)
1290             This->nschannel->binding = NULL;
1291         nsIHttpChannel_Release(&This->nschannel->nsIHttpChannel_iface);
1292     }
1293     if(This->nslistener)
1294         nsIStreamListener_Release(This->nslistener);
1295     if(This->nscontext)
1296         nsISupports_Release(This->nscontext);
1297     if(This->nsstream)
1298         nsIInputStream_Release(&This->nsstream->nsIInputStream_iface);
1299     heap_free(This);
1300 }
1301
1302 static HRESULT nsChannelBSC_start_binding(BSCallback *bsc)
1303 {
1304     nsChannelBSC *This = nsChannelBSC_from_BSCallback(bsc);
1305
1306     if(This->is_doc_channel)
1307         This->bsc.window->base.outer_window->base.inner_window->doc->skip_mutation_notif = FALSE;
1308
1309     return S_OK;
1310 }
1311
1312 static HRESULT nsChannelBSC_init_bindinfo(BSCallback *bsc)
1313 {
1314     nsChannelBSC *This = nsChannelBSC_from_BSCallback(bsc);
1315     nsChannel *nschannel = This->nschannel;
1316     GeckoBrowser *browser;
1317     HRESULT hres;
1318
1319     if(This->is_doc_channel && This->bsc.window && This->bsc.window->base.outer_window
1320        && (browser = This->bsc.window->base.outer_window->browser)) {
1321         if(browser->doc->hostinfo.dwFlags & DOCHOSTUIFLAG_ENABLE_REDIRECT_NOTIFICATION)
1322             This->bsc.bindinfo_options |= BINDINFO_OPTIONS_DISABLEAUTOREDIRECTS;
1323     }
1324
1325     if(nschannel && nschannel->post_data_stream) {
1326         hres = read_post_data_stream(nschannel->post_data_stream, nschannel->post_data_contains_headers,
1327                 &nschannel->request_headers, &This->bsc.request_data);
1328         if(FAILED(hres))
1329             return hres;
1330     }
1331
1332     return S_OK;
1333 }
1334
1335 typedef struct {
1336     task_t header;
1337     nsChannelBSC *bsc;
1338 } stop_request_task_t;
1339
1340 static void stop_request_proc(task_t *_task)
1341 {
1342     stop_request_task_t *task = (stop_request_task_t*)_task;
1343
1344     TRACE("(%p)\n", task->bsc);
1345
1346     list_remove(&task->bsc->bsc.entry);
1347     list_init(&task->bsc->bsc.entry);
1348     on_stop_nsrequest(task->bsc, S_OK);
1349 }
1350
1351 static void stop_request_task_destr(task_t *_task)
1352 {
1353     stop_request_task_t *task = (stop_request_task_t*)_task;
1354
1355     IBindStatusCallback_Release(&task->bsc->bsc.IBindStatusCallback_iface);
1356     heap_free(task);
1357 }
1358
1359 static HRESULT async_stop_request(nsChannelBSC *This)
1360 {
1361     stop_request_task_t *task;
1362
1363     if(!This->bsc.read) {
1364         TRACE("No data read, calling OnStartRequest\n");
1365         on_start_nsrequest(This);
1366     }
1367
1368     task = heap_alloc(sizeof(*task));
1369     if(!task)
1370         return E_OUTOFMEMORY;
1371
1372     IBindStatusCallback_AddRef(&This->bsc.IBindStatusCallback_iface);
1373     task->bsc = This;
1374
1375     return push_task(&task->header, stop_request_proc, stop_request_task_destr, This->bsc.window->task_magic);
1376 }
1377
1378 static void handle_navigation_error(nsChannelBSC *This, DWORD result)
1379 {
1380     HTMLOuterWindow *outer_window;
1381     HTMLDocumentObj *doc;
1382     BOOL is_error_url;
1383     SAFEARRAY *sa;
1384     SAFEARRAYBOUND bound;
1385     VARIANT var, varOut;
1386     LONG ind;
1387     BSTR unk;
1388     HRESULT hres;
1389
1390     if(!This->is_doc_channel || !This->bsc.window || !This->bsc.window->base.outer_window
1391        || !This->bsc.window->base.outer_window->browser)
1392         return;
1393
1394     outer_window = This->bsc.window->base.outer_window;
1395     doc = outer_window->browser->doc;
1396     if(!doc->doc_object_service || !doc->client)
1397         return;
1398
1399     hres = IDocObjectService_IsErrorUrl(doc->doc_object_service,
1400             outer_window->url, &is_error_url);
1401     if(FAILED(hres) || is_error_url)
1402         return;
1403
1404     if(!doc->client_cmdtrg)
1405         return;
1406
1407     bound.lLbound = 0;
1408     bound.cElements = 8;
1409     sa = SafeArrayCreate(VT_VARIANT, 1, &bound);
1410     if(!sa)
1411         return;
1412
1413     ind = 0;
1414     V_VT(&var) = VT_I4;
1415     V_I4(&var) = result;
1416     SafeArrayPutElement(sa, &ind, &var);
1417
1418     ind = 1;
1419     V_VT(&var) = VT_BSTR;
1420     V_BSTR(&var) = outer_window->url;
1421     SafeArrayPutElement(sa, &ind, &var);
1422
1423     ind = 3;
1424     V_VT(&var) = VT_UNKNOWN;
1425     V_UNKNOWN(&var) = (IUnknown*)&outer_window->base.IHTMLWindow2_iface;
1426     SafeArrayPutElement(sa, &ind, &var);
1427
1428     /* FIXME: what are the following fields for? */
1429     ind = 2;
1430     V_VT(&var) = VT_UNKNOWN;
1431     V_UNKNOWN(&var) = NULL;
1432     SafeArrayPutElement(sa, &ind, &var);
1433
1434     ind = 4;
1435     V_VT(&var) = VT_BOOL;
1436     V_BOOL(&var) = FALSE;
1437     SafeArrayPutElement(sa, &ind, &var);
1438
1439     ind = 5;
1440     V_VT(&var) = VT_BOOL;
1441     V_BOOL(&var) = FALSE;
1442     SafeArrayPutElement(sa, &ind, &var);
1443
1444     ind = 6;
1445     V_VT(&var) = VT_BSTR;
1446     unk = SysAllocString(NULL);
1447     V_BSTR(&var) = unk;
1448     SafeArrayPutElement(sa, &ind, &var);
1449
1450     ind = 7;
1451     V_VT(&var) = VT_UNKNOWN;
1452     V_UNKNOWN(&var) = NULL;
1453     SafeArrayPutElement(sa, &ind, &var);
1454
1455     V_VT(&var) = VT_ARRAY;
1456     V_ARRAY(&var) = sa;
1457     V_VT(&varOut) = VT_BOOL;
1458     V_BOOL(&varOut) = VARIANT_TRUE;
1459     IOleCommandTarget_Exec(doc->client_cmdtrg, &CGID_DocHostCmdPriv, 1, 0, &var, FAILED(hres)?NULL:&varOut);
1460
1461     SysFreeString(unk);
1462     SafeArrayDestroy(sa);
1463 }
1464
1465 static HRESULT nsChannelBSC_stop_binding(BSCallback *bsc, HRESULT result)
1466 {
1467     nsChannelBSC *This = nsChannelBSC_from_BSCallback(bsc);
1468
1469     if(result != E_ABORT && This->is_doc_channel && This->bsc.window) {
1470         if(FAILED(result))
1471             handle_navigation_error(This, result);
1472         else if(This->nschannel) {
1473             result = async_stop_request(This);
1474             if(SUCCEEDED(result))
1475                 return S_OK;
1476         }
1477     }
1478
1479     on_stop_nsrequest(This, result);
1480     return S_OK;
1481 }
1482
1483 static HRESULT nsChannelBSC_read_data(BSCallback *bsc, IStream *stream)
1484 {
1485     nsChannelBSC *This = nsChannelBSC_from_BSCallback(bsc);
1486
1487     return read_stream_data(This, stream);
1488 }
1489
1490 static HRESULT handle_redirect(nsChannelBSC *This, const WCHAR *new_url)
1491 {
1492     nsRedirectCallback *callback;
1493     nsIChannelEventSink *sink;
1494     nsChannel *new_channel;
1495     IMoniker *mon;
1496     nsresult nsres;
1497     HRESULT hres;
1498
1499     TRACE("(%p)->(%s)\n", This, debugstr_w(new_url));
1500
1501     hres = CreateURLMoniker(NULL, new_url, &mon);
1502     if(FAILED(hres))
1503         return hres;
1504     IMoniker_Release(This->bsc.mon);
1505     This->bsc.mon = mon;
1506
1507     if(!This->nschannel || !This->nschannel->notif_callback)
1508         return S_OK;
1509
1510     nsres = nsIInterfaceRequestor_GetInterface(This->nschannel->notif_callback, &IID_nsIChannelEventSink, (void**)&sink);
1511     if(NS_FAILED(nsres))
1512         return S_OK;
1513
1514     hres = create_redirect_nschannel(new_url, This->nschannel, &new_channel);
1515     if(SUCCEEDED(hres)) {
1516         TRACE("%p %p->%p\n", This, This->nschannel, new_channel);
1517
1518         hres = create_redirect_callback(new_channel, This, &callback);
1519         nsIHttpChannel_Release(&new_channel->nsIHttpChannel_iface);
1520     }
1521
1522     if(SUCCEEDED(hres)) {
1523         nsres = nsIChannelEventSink_AsyncOnChannelRedirect(sink, (nsIChannel*)&This->nschannel->nsIHttpChannel_iface,
1524                 (nsIChannel*)&callback->nschannel->nsIHttpChannel_iface, REDIRECT_TEMPORARY, /* FIXME */
1525                 &callback->nsIAsyncVerifyRedirectCallback_iface);
1526
1527         if(NS_FAILED(nsres))
1528             FIXME("AsyncOnChannelRedirect failed: %08x\n", hres);
1529         else if(This->nschannel != callback->nschannel)
1530             FIXME("nschannel not updated\n");
1531
1532         nsIAsyncVerifyRedirectCallback_Release(&callback->nsIAsyncVerifyRedirectCallback_iface);
1533     }
1534
1535     nsIChannelEventSink_Release(sink);
1536     return hres;
1537 }
1538
1539 static BOOL is_supported_doc_mime(const WCHAR *mime)
1540 {
1541     char *nscat, *mimea;
1542     BOOL ret;
1543
1544     mimea = heap_strdupWtoA(mime);
1545     if(!mimea)
1546         return FALSE;
1547
1548     nscat = get_nscategory_entry("Gecko-Content-Viewers", mimea);
1549
1550     ret = nscat != NULL && !strcmp(nscat, "@mozilla.org/content/document-loader-factory;1");
1551
1552     heap_free(mimea);
1553     nsfree(nscat);
1554     return ret;
1555 }
1556
1557 static IUri *get_moniker_uri(IMoniker *mon)
1558 {
1559     IUriContainer *uri_container;
1560     IUri *ret = NULL;
1561     HRESULT hres;
1562
1563     hres = IMoniker_QueryInterface(mon, &IID_IUriContainer, (void**)&uri_container);
1564     if(SUCCEEDED(hres)) {
1565         hres = IUriContainer_GetIUri(uri_container, &ret);
1566         IUriContainer_Release(uri_container);
1567         if(FAILED(hres))
1568             return NULL;
1569     }else {
1570         FIXME("No IUriContainer\n");
1571     }
1572
1573     return ret;
1574 }
1575
1576 static void handle_extern_mime_navigation(nsChannelBSC *This)
1577 {
1578     IWebBrowserPriv2IE9 *webbrowser_priv;
1579     IOleCommandTarget *cmdtrg;
1580     HTMLDocumentObj *doc_obj;
1581     IBindCtx *bind_ctx;
1582     IUri *uri;
1583     VARIANT flags;
1584     HRESULT hres;
1585
1586     if(!This->bsc.window || !This->bsc.window->base.outer_window || !This->bsc.window->base.outer_window->browser)
1587         return;
1588
1589     doc_obj = This->bsc.window->base.outer_window->browser->doc;
1590
1591     hres = IOleClientSite_QueryInterface(doc_obj->client, &IID_IOleCommandTarget, (void**)&cmdtrg);
1592     if(SUCCEEDED(hres)) {
1593         IOleCommandTarget_Exec(cmdtrg, &CGID_ShellDocView, 62, 0, NULL, NULL);
1594         IOleCommandTarget_Release(cmdtrg);
1595     }
1596
1597     set_document_navigation(doc_obj, FALSE);
1598
1599     if(!doc_obj->webbrowser) {
1600         FIXME("unimplemented in non-webbrowser mode\n");
1601         return;
1602     }
1603
1604     uri = get_moniker_uri(This->bsc.mon);
1605     if(!uri)
1606         return;
1607
1608     hres = CreateBindCtx(0, &bind_ctx);
1609     if(FAILED(hres)) {
1610         IUri_Release(uri);
1611         return;
1612     }
1613
1614     V_VT(&flags) = VT_I4;
1615     V_I4(&flags) = navHyperlink;
1616
1617     hres = IUnknown_QueryInterface(doc_obj->webbrowser, &IID_IWebBrowserPriv2IE8, (void**)&webbrowser_priv);
1618     if(SUCCEEDED(hres)) {
1619         hres = IWebBrowserPriv2IE9_NavigateWithBindCtx2(webbrowser_priv, uri, &flags, NULL, NULL, NULL, bind_ctx, NULL, 0);
1620         IWebBrowserPriv2IE9_Release(webbrowser_priv);
1621     }else {
1622         IWebBrowserPriv *webbrowser_priv_old;
1623         VARIANT uriv;
1624
1625         hres = IUnknown_QueryInterface(doc_obj->webbrowser, &IID_IWebBrowserPriv, (void**)&webbrowser_priv_old);
1626         if(SUCCEEDED(hres)) {
1627             V_VT(&uriv) = VT_BSTR;
1628             IUri_GetDisplayUri(uri, &V_BSTR(&uriv));
1629
1630             hres = IWebBrowserPriv_NavigateWithBindCtx(webbrowser_priv_old, &uriv, &flags, NULL, NULL, NULL, bind_ctx, NULL);
1631
1632             SysFreeString(V_BSTR(&uriv));
1633             IWebBrowserPriv_Release(webbrowser_priv_old);
1634         }
1635     }
1636
1637     IUri_Release(uri);
1638 }
1639
1640 static HRESULT nsChannelBSC_on_progress(BSCallback *bsc, ULONG status_code, LPCWSTR status_text)
1641 {
1642     nsChannelBSC *This = nsChannelBSC_from_BSCallback(bsc);
1643
1644     switch(status_code) {
1645     case BINDSTATUS_MIMETYPEAVAILABLE:
1646         if(This->is_doc_channel && !is_supported_doc_mime(status_text)) {
1647             FIXME("External MIME: %s\n", debugstr_w(status_text));
1648
1649             handle_extern_mime_navigation(This);
1650
1651             This->nschannel = NULL;
1652         }
1653
1654         if(!This->nschannel)
1655             return S_OK;
1656
1657         heap_free(This->nschannel->content_type);
1658         This->nschannel->content_type = heap_strdupWtoA(status_text);
1659         break;
1660     case BINDSTATUS_REDIRECTING:
1661         return handle_redirect(This, status_text);
1662     case BINDSTATUS_BEGINDOWNLOADDATA: {
1663         IWinInetHttpInfo *http_info;
1664         DWORD status, size = sizeof(DWORD);
1665         HRESULT hres;
1666
1667         if(!This->bsc.binding)
1668             break;
1669
1670         hres = IBinding_QueryInterface(This->bsc.binding, &IID_IWinInetHttpInfo, (void**)&http_info);
1671         if(FAILED(hres))
1672             break;
1673
1674         hres = IWinInetHttpInfo_QueryInfo(http_info,
1675                 HTTP_QUERY_STATUS_CODE|HTTP_QUERY_FLAG_NUMBER, &status, &size, NULL, NULL);
1676         IWinInetHttpInfo_Release(http_info);
1677         if(FAILED(hres) || status == HTTP_STATUS_OK)
1678             break;
1679
1680         handle_navigation_error(This, status);
1681     }
1682     }
1683
1684     return S_OK;
1685 }
1686
1687 static HRESULT process_response_status_text(const WCHAR *header, const WCHAR *header_end, char **status_text)
1688 {
1689     header = wcschr(header + 1, ' ');
1690     if(!header || header >= header_end)
1691         return E_FAIL;
1692     header = wcschr(header + 1, ' ');
1693     if(!header || header >= header_end)
1694         return E_FAIL;
1695     ++header;
1696
1697     *status_text = heap_strndupWtoU(header, header_end - header);
1698
1699     if(!*status_text)
1700         return E_OUTOFMEMORY;
1701
1702     return S_OK;
1703 }
1704
1705 static HRESULT nsChannelBSC_on_response(BSCallback *bsc, DWORD response_code,
1706         LPCWSTR response_headers)
1707 {
1708     nsChannelBSC *This = nsChannelBSC_from_BSCallback(bsc);
1709     char *str;
1710     HRESULT hres;
1711
1712     This->response_processed = TRUE;
1713     This->nschannel->response_status = response_code;
1714
1715     if(response_headers) {
1716         const WCHAR *headers;
1717
1718         headers = wcschr(response_headers, '\r');
1719         hres = process_response_status_text(response_headers, headers, &str);
1720         if(FAILED(hres)) {
1721             WARN("parsing headers failed: %08x\n", hres);
1722             return hres;
1723         }
1724
1725         heap_free(This->nschannel->response_status_text);
1726         This->nschannel->response_status_text = str;
1727
1728         if(headers && headers[1] == '\n') {
1729             headers += 2;
1730             hres = process_response_headers(This, headers);
1731             if(FAILED(hres)) {
1732                 WARN("parsing headers failed: %08x\n", hres);
1733                 return hres;
1734             }
1735         }
1736     }
1737
1738     return S_OK;
1739 }
1740
1741 static HRESULT nsChannelBSC_beginning_transaction(BSCallback *bsc, WCHAR **additional_headers)
1742 {
1743     nsChannelBSC *This = nsChannelBSC_from_BSCallback(bsc);
1744     http_header_t *iter;
1745     DWORD len = 0;
1746     WCHAR *ptr;
1747
1748     if(!This->nschannel)
1749         return S_FALSE;
1750
1751     LIST_FOR_EACH_ENTRY(iter, &This->nschannel->request_headers, http_header_t, entry) {
1752         if(wcscmp(iter->header, L"Content-Length"))
1753             len += lstrlenW(iter->header) + 2 /* ": " */ + lstrlenW(iter->data) + 2 /* "\r\n" */;
1754     }
1755
1756     if(!len)
1757         return S_OK;
1758
1759     *additional_headers = ptr = CoTaskMemAlloc((len+1)*sizeof(WCHAR));
1760     if(!ptr)
1761         return E_OUTOFMEMORY;
1762
1763     LIST_FOR_EACH_ENTRY(iter, &This->nschannel->request_headers, http_header_t, entry) {
1764         if(!wcscmp(iter->header, L"Content-Length"))
1765             continue;
1766
1767         len = lstrlenW(iter->header);
1768         memcpy(ptr, iter->header, len*sizeof(WCHAR));
1769         ptr += len;
1770
1771         *ptr++ = ':';
1772         *ptr++ = ' ';
1773
1774         len = lstrlenW(iter->data);
1775         memcpy(ptr, iter->data, len*sizeof(WCHAR));
1776         ptr += len;
1777
1778         *ptr++ = '\r';
1779         *ptr++ = '\n';
1780     }
1781
1782     *ptr = 0;
1783
1784     return S_OK;
1785 }
1786
1787 static const BSCallbackVtbl nsChannelBSCVtbl = {
1788     nsChannelBSC_destroy,
1789     nsChannelBSC_init_bindinfo,
1790     nsChannelBSC_start_binding,
1791     nsChannelBSC_stop_binding,
1792     nsChannelBSC_read_data,
1793     nsChannelBSC_on_progress,
1794     nsChannelBSC_on_response,
1795     nsChannelBSC_beginning_transaction
1796 };
1797
1798 HRESULT create_channelbsc(IMoniker *mon, const WCHAR *headers, BYTE *post_data, DWORD post_data_size,
1799         BOOL is_doc_binding, nsChannelBSC **retval)
1800 {
1801     nsChannelBSC *ret;
1802     DWORD bindf;
1803
1804     ret = heap_alloc_zero(sizeof(*ret));
1805     if(!ret)
1806         return E_OUTOFMEMORY;
1807
1808     bindf = BINDF_ASYNCHRONOUS | BINDF_ASYNCSTORAGE | BINDF_PULLDATA;
1809     if(post_data_size)
1810         bindf |= BINDF_FORMS_SUBMIT | BINDF_PRAGMA_NO_CACHE | BINDF_HYPERLINK | BINDF_GETNEWESTVERSION;
1811
1812     init_bscallback(&ret->bsc, &nsChannelBSCVtbl, mon, bindf);
1813     ret->is_doc_channel = is_doc_binding;
1814
1815     if(headers) {
1816         ret->bsc.request_data.headers = heap_strdupW(headers);
1817         if(!ret->bsc.request_data.headers) {
1818             IBindStatusCallback_Release(&ret->bsc.IBindStatusCallback_iface);
1819             return E_OUTOFMEMORY;
1820         }
1821     }
1822
1823     if(post_data) {
1824         ret->bsc.request_data.post_data = GlobalAlloc(0, post_data_size+1);
1825         if(!ret->bsc.request_data.post_data) {
1826             release_request_data(&ret->bsc.request_data);
1827             IBindStatusCallback_Release(&ret->bsc.IBindStatusCallback_iface);
1828             return E_OUTOFMEMORY;
1829         }
1830
1831         memcpy(ret->bsc.request_data.post_data, post_data, post_data_size);
1832         ((BYTE*)ret->bsc.request_data.post_data)[post_data_size] = 0;
1833         ret->bsc.request_data.post_data_len = post_data_size;
1834     }
1835
1836     TRACE("created %p\n", ret);
1837     *retval = ret;
1838     return S_OK;
1839 }
1840
1841 typedef struct {
1842     task_t header;
1843     HTMLOuterWindow *window;
1844     HTMLInnerWindow *pending_window;
1845 } start_doc_binding_task_t;
1846
1847 static void start_doc_binding_proc(task_t *_task)
1848 {
1849     start_doc_binding_task_t *task = (start_doc_binding_task_t*)_task;
1850
1851     set_current_mon(task->window, task->pending_window->bscallback->bsc.mon, BINDING_NAVIGATED);
1852     start_binding(task->pending_window, &task->pending_window->bscallback->bsc, NULL);
1853 }
1854
1855 static void start_doc_binding_task_destr(task_t *_task)
1856 {
1857     start_doc_binding_task_t *task = (start_doc_binding_task_t*)_task;
1858
1859     IHTMLWindow2_Release(&task->pending_window->base.IHTMLWindow2_iface);
1860     heap_free(task);
1861 }
1862
1863 HRESULT async_start_doc_binding(HTMLOuterWindow *window, HTMLInnerWindow *pending_window)
1864 {
1865     start_doc_binding_task_t *task;
1866
1867     TRACE("%p\n", pending_window);
1868
1869     task = heap_alloc(sizeof(start_doc_binding_task_t));
1870     if(!task)
1871         return E_OUTOFMEMORY;
1872
1873     task->window = window;
1874     task->pending_window = pending_window;
1875     IHTMLWindow2_AddRef(&pending_window->base.IHTMLWindow2_iface);
1876
1877     return push_task(&task->header, start_doc_binding_proc, start_doc_binding_task_destr, pending_window->task_magic);
1878 }
1879
1880 void abort_window_bindings(HTMLInnerWindow *window)
1881 {
1882     BSCallback *iter;
1883
1884     remove_target_tasks(window->task_magic);
1885
1886     while(!list_empty(&window->bindings)) {
1887         iter = LIST_ENTRY(window->bindings.next, BSCallback, entry);
1888
1889         TRACE("Aborting %p\n", iter);
1890
1891         IBindStatusCallback_AddRef(&iter->IBindStatusCallback_iface);
1892
1893         if(iter->binding)
1894             IBinding_Abort(iter->binding);
1895         else
1896             iter->vtbl->stop_binding(iter, E_ABORT);
1897
1898         iter->window = NULL;
1899         list_remove(&iter->entry);
1900         list_init(&iter->entry);
1901
1902         IBindStatusCallback_Release(&iter->IBindStatusCallback_iface);
1903     }
1904
1905     if(window->bscallback) {
1906         IBindStatusCallback_Release(&window->bscallback->bsc.IBindStatusCallback_iface);
1907         window->bscallback = NULL;
1908     }
1909
1910     if(window->mon) {
1911         IMoniker_Release(window->mon);
1912         window->mon = NULL;
1913     }
1914 }
1915
1916 HRESULT channelbsc_load_stream(HTMLInnerWindow *pending_window, IMoniker *mon, IStream *stream)
1917 {
1918     nsChannelBSC *bscallback = pending_window->bscallback;
1919     HRESULT hres = S_OK;
1920
1921     if(!bscallback->nschannel) {
1922         ERR("NULL nschannel\n");
1923         return E_FAIL;
1924     }
1925
1926     bscallback->nschannel->content_type = heap_strdupA("text/html");
1927     if(!bscallback->nschannel->content_type)
1928         return E_OUTOFMEMORY;
1929
1930     set_current_mon(pending_window->base.outer_window, mon, 0);
1931
1932     bscallback->bsc.window = pending_window;
1933     if(stream)
1934         hres = read_stream_data(bscallback, stream);
1935     if(SUCCEEDED(hres))
1936         hres = async_stop_request(bscallback);
1937     if(FAILED(hres))
1938         IBindStatusCallback_OnStopBinding(&bscallback->bsc.IBindStatusCallback_iface, hres, NULL);
1939
1940     return hres;
1941 }
1942
1943 void channelbsc_set_channel(nsChannelBSC *This, nsChannel *channel, nsIStreamListener *listener, nsISupports *context)
1944 {
1945     nsIHttpChannel_AddRef(&channel->nsIHttpChannel_iface);
1946     This->nschannel = channel;
1947
1948     nsIStreamListener_AddRef(listener);
1949     This->nslistener = listener;
1950
1951     if(context) {
1952         nsISupports_AddRef(context);
1953         This->nscontext = context;
1954     }
1955
1956     if(This->bsc.request_data.headers) {
1957         HRESULT hres;
1958
1959         hres = parse_headers(This->bsc.request_data.headers, &channel->request_headers);
1960         heap_free(This->bsc.request_data.headers);
1961         This->bsc.request_data.headers = NULL;
1962         if(FAILED(hres))
1963             WARN("parse_headers failed: %08x\n", hres);
1964     }
1965 }
1966
1967 typedef struct {
1968     task_t header;
1969     HTMLOuterWindow *window;
1970     IUri *uri;
1971 } navigate_javascript_task_t;
1972
1973 static void navigate_javascript_proc(task_t *_task)
1974 {
1975     navigate_javascript_task_t *task = (navigate_javascript_task_t*)_task;
1976     HTMLOuterWindow *window = task->window;
1977     VARIANT v;
1978     BSTR code;
1979     HRESULT hres;
1980
1981     task->window->readystate = READYSTATE_COMPLETE;
1982
1983     hres = IUri_GetPath(task->uri, &code);
1984     if(FAILED(hres))
1985         return;
1986
1987     hres = UrlUnescapeW(code, NULL, NULL, URL_UNESCAPE_INPLACE);
1988     if(FAILED(hres)) {
1989         SysFreeString(code);
1990         return;
1991     }
1992
1993     set_download_state(window->browser->doc, 1);
1994
1995     V_VT(&v) = VT_EMPTY;
1996     hres = exec_script(window->base.inner_window, code, L"jscript", &v);
1997     SysFreeString(code);
1998     if(SUCCEEDED(hres) && V_VT(&v) != VT_EMPTY) {
1999         FIXME("javascirpt URL returned %s\n", debugstr_variant(&v));
2000         VariantClear(&v);
2001     }
2002
2003     if(window->browser->doc->view_sink)
2004         IAdviseSink_OnViewChange(window->browser->doc->view_sink, DVASPECT_CONTENT, -1);
2005
2006     set_download_state(window->browser->doc, 0);
2007 }
2008
2009 static void navigate_javascript_task_destr(task_t *_task)
2010 {
2011     navigate_javascript_task_t *task = (navigate_javascript_task_t*)_task;
2012
2013     IUri_Release(task->uri);
2014     heap_free(task);
2015 }
2016
2017 typedef struct {
2018     task_t header;
2019     HTMLOuterWindow *window;
2020     nsChannelBSC *bscallback;
2021     DWORD flags;
2022     IMoniker *mon;
2023     IUri *uri;
2024 } navigate_task_t;
2025
2026 static void navigate_proc(task_t *_task)
2027 {
2028     navigate_task_t *task = (navigate_task_t*)_task;
2029     HRESULT hres;
2030
2031     hres = set_moniker(task->window, task->mon, task->uri, NULL, task->bscallback, TRUE);
2032     if(SUCCEEDED(hres)) {
2033         set_current_mon(task->window, task->bscallback->bsc.mon, task->flags);
2034         set_current_uri(task->window, task->uri);
2035         start_binding(task->window->pending_window, &task->bscallback->bsc, NULL);
2036     }
2037 }
2038
2039 static void navigate_task_destr(task_t *_task)
2040 {
2041     navigate_task_t *task = (navigate_task_t*)_task;
2042
2043     IBindStatusCallback_Release(&task->bscallback->bsc.IBindStatusCallback_iface);
2044     IMoniker_Release(task->mon);
2045     IUri_Release(task->uri);
2046     heap_free(task);
2047 }
2048
2049 static HRESULT navigate_fragment(HTMLOuterWindow *window, IUri *uri)
2050 {
2051     nsIDOMLocation *nslocation;
2052     nsAString nsfrag_str;
2053     WCHAR *selector;
2054     BSTR frag;
2055     nsresult nsres;
2056     HRESULT hres;
2057     static const WCHAR selector_formatW[] = L"a[id=\"%s\"]";
2058
2059     set_current_uri(window, uri);
2060
2061     nsres = nsIDOMWindow_GetLocation(window->nswindow, &nslocation);
2062     if(FAILED(nsres) || !nslocation)
2063         return E_FAIL;
2064
2065     hres = IUri_GetFragment(uri, &frag);
2066     if(FAILED(hres)) {
2067         nsIDOMLocation_Release(nslocation);
2068         return hres;
2069     }
2070
2071     nsAString_InitDepend(&nsfrag_str, frag);
2072     nsres = nsIDOMLocation_SetHash(nslocation, &nsfrag_str);
2073     nsAString_Finish(&nsfrag_str);
2074     nsIDOMLocation_Release(nslocation);
2075     if(NS_FAILED(nsres))
2076         ERR("SetHash failed: %08x\n", nsres);
2077
2078     /*
2079      * IE supports scrolling to anchor elements with "#hash" ids (note that '#' is part of the id),
2080      * while Gecko scrolls only to elements with "hash" ids. We scroll the page ourselves if
2081      * a[id="#hash"] element can be found.
2082      */
2083     selector = heap_alloc(sizeof(selector_formatW)+SysStringLen(frag)*sizeof(WCHAR));
2084     if(selector) {
2085         nsIDOMElement *nselem = NULL;
2086         nsAString selector_str;
2087
2088         swprintf(selector, ARRAY_SIZE(selector_formatW)+SysStringLen(frag), selector_formatW, frag);
2089         nsAString_InitDepend(&selector_str, selector);
2090         /* NOTE: Gecko doesn't set result to NULL if there is no match, so nselem must be initialized */
2091         nsres = nsIDOMHTMLDocument_QuerySelector(window->base.inner_window->doc->nsdoc, &selector_str, &nselem);
2092         nsAString_Finish(&selector_str);
2093         heap_free(selector);
2094         if(NS_SUCCEEDED(nsres) && nselem) {
2095             nsIDOMHTMLElement *html_elem;
2096
2097             nsres = nsIDOMElement_QueryInterface(nselem, &IID_nsIDOMHTMLElement, (void**)&html_elem);
2098             nsIDOMElement_Release(nselem);
2099             if(NS_SUCCEEDED(nsres)) {
2100                 nsIDOMHTMLElement_ScrollIntoView(html_elem, TRUE, 1);
2101                 nsIDOMHTMLElement_Release(html_elem);
2102             }
2103         }
2104     }
2105
2106     SysFreeString(frag);
2107
2108     if(window->browser->doc->doc_object_service) {
2109         IDocObjectService_FireNavigateComplete2(window->browser->doc->doc_object_service, &window->base.IHTMLWindow2_iface, 0x10);
2110         IDocObjectService_FireDocumentComplete(window->browser->doc->doc_object_service, &window->base.IHTMLWindow2_iface, 0);
2111
2112     }
2113
2114     return S_OK;
2115 }
2116
2117 HRESULT super_navigate(HTMLOuterWindow *window, IUri *uri, DWORD flags, const WCHAR *headers, BYTE *post_data, DWORD post_data_size)
2118 {
2119     nsChannelBSC *bsc;
2120     IUri *uri_nofrag;
2121     IMoniker *mon;
2122     DWORD scheme;
2123     HRESULT hres;
2124
2125     uri_nofrag = get_uri_nofrag(uri);
2126     if(!uri_nofrag)
2127         return E_FAIL;
2128
2129     if(window->browser->doc->client && !(flags & BINDING_REFRESH)) {
2130         IOleCommandTarget *cmdtrg;
2131
2132         hres = IOleClientSite_QueryInterface(window->browser->doc->client, &IID_IOleCommandTarget, (void**)&cmdtrg);
2133         if(SUCCEEDED(hres)) {
2134             VARIANT in, out;
2135             BSTR url_str;
2136
2137             hres = IUri_GetDisplayUri(uri_nofrag, &url_str);
2138             if(SUCCEEDED(hres)) {
2139                 V_VT(&in) = VT_BSTR;
2140                 V_BSTR(&in) = url_str;
2141                 V_VT(&out) = VT_BOOL;
2142                 V_BOOL(&out) = VARIANT_TRUE;
2143                 hres = IOleCommandTarget_Exec(cmdtrg, &CGID_ShellDocView, 67, 0, &in, &out);
2144                 IOleCommandTarget_Release(cmdtrg);
2145                 if(SUCCEEDED(hres))
2146                     VariantClear(&out);
2147                 SysFreeString(url_str);
2148             }
2149         }
2150     }
2151
2152     if(!(flags & BINDING_NOFRAG) && window->uri_nofrag && !post_data_size) {
2153         BOOL eq;
2154
2155         hres = IUri_IsEqual(uri_nofrag, window->uri_nofrag, &eq);
2156         if(SUCCEEDED(hres) && eq) {
2157             IUri_Release(uri_nofrag);
2158             TRACE("fragment navigate\n");
2159             return navigate_fragment(window, uri);
2160         }
2161     }
2162
2163     hres = CreateURLMonikerEx2(NULL, uri_nofrag, &mon, URL_MK_UNIFORM);
2164     IUri_Release(uri_nofrag);
2165     if(FAILED(hres))
2166         return hres;
2167
2168     /* FIXME: Why not set_ready_state? */
2169     window->readystate = READYSTATE_UNINITIALIZED;
2170
2171     hres = create_channelbsc(mon, headers, post_data, post_data_size, TRUE, &bsc);
2172     if(FAILED(hres)) {
2173         IMoniker_Release(mon);
2174         return hres;
2175     }
2176
2177     prepare_for_binding(&window->browser->doc->basedoc, mon, flags);
2178
2179     hres = IUri_GetScheme(uri, &scheme);
2180     if(SUCCEEDED(hres) && scheme == URL_SCHEME_JAVASCRIPT) {
2181         navigate_javascript_task_t *task;
2182
2183         IBindStatusCallback_Release(&bsc->bsc.IBindStatusCallback_iface);
2184         IMoniker_Release(mon);
2185
2186         task = heap_alloc(sizeof(*task));
2187         if(!task)
2188             return E_OUTOFMEMORY;
2189
2190         /* Why silently? */
2191         window->readystate = READYSTATE_COMPLETE;
2192         if(!(flags & BINDING_FROMHIST))
2193             call_docview_84(window->browser->doc);
2194
2195         IUri_AddRef(uri);
2196         task->window = window;
2197         task->uri = uri;
2198         hres = push_task(&task->header, navigate_javascript_proc, navigate_javascript_task_destr, window->task_magic);
2199     }else if(flags & BINDING_SUBMIT) {
2200         hres = set_moniker(window, mon, uri, NULL, bsc, TRUE);
2201         if(SUCCEEDED(hres))
2202             hres = start_binding(window->pending_window, &bsc->bsc, NULL);
2203         IBindStatusCallback_Release(&bsc->bsc.IBindStatusCallback_iface);
2204         IMoniker_Release(mon);
2205     }else {
2206         navigate_task_t *task;
2207
2208         task = heap_alloc(sizeof(*task));
2209         if(!task) {
2210             IBindStatusCallback_Release(&bsc->bsc.IBindStatusCallback_iface);
2211             IMoniker_Release(mon);
2212             return E_OUTOFMEMORY;
2213         }
2214
2215         /* Silently and repeated when real loading starts? */
2216         window->readystate = READYSTATE_LOADING;
2217         if(!(flags & (BINDING_FROMHIST|BINDING_REFRESH)))
2218             call_docview_84(window->browser->doc);
2219
2220         task->window = window;
2221         task->bscallback = bsc;
2222         task->flags = flags;
2223         task->mon = mon;
2224
2225         IUri_AddRef(uri);
2226         task->uri = uri;
2227         hres = push_task(&task->header, navigate_proc, navigate_task_destr, window->task_magic);
2228     }
2229
2230     return hres;
2231 }
2232
2233 HRESULT navigate_new_window(HTMLOuterWindow *window, IUri *uri, const WCHAR *name, request_data_t *request_data, IHTMLWindow2 **ret)
2234 {
2235     INewWindowManager *new_window_mgr;
2236     BSTR display_uri, context_url;
2237     IWebBrowser2 *web_browser;
2238     IHTMLWindow2 *new_window;
2239     IBindCtx *bind_ctx;
2240     nsChannelBSC *bsc;
2241     HRESULT hres;
2242
2243     if(!window->browser)
2244         return E_UNEXPECTED;
2245
2246     if (window->browser->doc->client) {
2247         hres = do_query_service((IUnknown*)window->browser->doc->client, &SID_SNewWindowManager,
2248                                 &IID_INewWindowManager, (void**)&new_window_mgr);
2249         if (FAILED(hres)) {
2250             FIXME("No INewWindowManager\n");
2251             return hres;
2252         }
2253
2254         hres = IUri_GetDisplayUri(window->uri_nofrag, &context_url);
2255         if(FAILED(hres))
2256             return hres;
2257
2258         hres = IUri_GetDisplayUri(uri, &display_uri);
2259         if(FAILED(hres)) {
2260             SysFreeString(context_url);
2261             return hres;
2262         }
2263
2264         hres = INewWindowManager_EvaluateNewWindow(new_window_mgr, display_uri, name, context_url,
2265                 NULL, FALSE, window->browser->doc->has_popup ? 0 : NWMF_FIRST, 0);
2266         window->browser->doc->has_popup = TRUE;
2267         SysFreeString(display_uri);
2268         SysFreeString(context_url);
2269         INewWindowManager_Release(new_window_mgr);
2270         if(FAILED(hres)) {
2271             if(ret)
2272                 *ret = NULL;
2273             return S_OK;
2274         }
2275     }
2276
2277
2278     if(request_data)
2279         hres = create_channelbsc(NULL, request_data->headers,
2280                 request_data->post_data, request_data->post_data_len, FALSE,
2281                 &bsc);
2282     else
2283         hres = create_channelbsc(NULL, NULL, NULL, 0, FALSE, &bsc);
2284     if(FAILED(hres))
2285         return hres;
2286
2287     hres = CreateAsyncBindCtx(0, &bsc->bsc.IBindStatusCallback_iface, NULL, &bind_ctx);
2288     if(FAILED(hres)) {
2289         IBindStatusCallback_Release(&bsc->bsc.IBindStatusCallback_iface);
2290         return hres;
2291     }
2292
2293     hres = CoCreateInstance(&CLSID_InternetExplorer, NULL, CLSCTX_LOCAL_SERVER,
2294             &IID_IWebBrowser2, (void**)&web_browser);
2295     if(SUCCEEDED(hres)) {
2296         ITargetFramePriv2 *target_frame_priv;
2297
2298         hres = IWebBrowser2_QueryInterface(web_browser, &IID_ITargetFramePriv2, (void**)&target_frame_priv);
2299         if(SUCCEEDED(hres)) {
2300             hres = ITargetFramePriv2_AggregatedNavigation2(target_frame_priv,
2301                     HLNF_DISABLEWINDOWRESTRICTIONS|HLNF_OPENINNEWWINDOW, bind_ctx, &bsc->bsc.IBindStatusCallback_iface,
2302                     name, uri, L"");
2303             ITargetFramePriv2_Release(target_frame_priv);
2304
2305             if(SUCCEEDED(hres))
2306                 hres = do_query_service((IUnknown*)web_browser, &SID_SHTMLWindow, &IID_IHTMLWindow2, (void**)&new_window);
2307         }
2308         if(FAILED(hres)) {
2309             IWebBrowser2_Quit(web_browser);
2310             IWebBrowser2_Release(web_browser);
2311         }
2312     }else {
2313         WARN("Could not create InternetExplorer instance: %08x\n", hres);
2314     }
2315
2316     IBindStatusCallback_Release(&bsc->bsc.IBindStatusCallback_iface);
2317     IBindCtx_Release(bind_ctx);
2318     if(FAILED(hres))
2319         return hres;
2320
2321     IWebBrowser2_put_Visible(web_browser, VARIANT_TRUE);
2322     IWebBrowser2_Release(web_browser);
2323
2324     if(ret)
2325         *ret = new_window;
2326     else
2327         IHTMLWindow2_Release(new_window);
2328     return S_OK;
2329 }
2330
2331 HRESULT hlink_frame_navigate(HTMLDocument *doc, LPCWSTR url, nsChannel *nschannel, DWORD hlnf, BOOL *cancel)
2332 {
2333     IHlinkFrame *hlink_frame;
2334     nsChannelBSC *callback;
2335     IBindCtx *bindctx;
2336     IMoniker *mon;
2337     IHlink *hlink;
2338     HRESULT hres;
2339
2340     *cancel = FALSE;
2341
2342     hres = do_query_service((IUnknown*)doc->doc_obj->client, &IID_IHlinkFrame, &IID_IHlinkFrame,
2343             (void**)&hlink_frame);
2344     if(FAILED(hres))
2345         return S_OK;
2346
2347     hres = create_channelbsc(NULL, NULL, NULL, 0, FALSE, &callback);
2348     if(FAILED(hres)) {
2349         IHlinkFrame_Release(hlink_frame);
2350         return hres;
2351     }
2352
2353     if(nschannel)
2354         read_post_data_stream(nschannel->post_data_stream, nschannel->post_data_contains_headers,
2355                 &nschannel->request_headers, &callback->bsc.request_data);
2356
2357     hres = CreateAsyncBindCtx(0, &callback->bsc.IBindStatusCallback_iface, NULL, &bindctx);
2358     if(SUCCEEDED(hres))
2359        hres = CoCreateInstance(&CLSID_StdHlink, NULL, CLSCTX_INPROC_SERVER,
2360                 &IID_IHlink, (LPVOID*)&hlink);
2361
2362     if(SUCCEEDED(hres))
2363         hres = CreateURLMoniker(NULL, url, &mon);
2364
2365     if(SUCCEEDED(hres)) {
2366         IHlink_SetMonikerReference(hlink, HLINKSETF_TARGET, mon, NULL);
2367
2368         if(hlnf & HLNF_OPENINNEWWINDOW) {
2369             IHlink_SetTargetFrameName(hlink, L"_blank"); /* FIXME */
2370         }
2371
2372         hres = IHlinkFrame_Navigate(hlink_frame, hlnf, bindctx,
2373                 &callback->bsc.IBindStatusCallback_iface, hlink);
2374         IMoniker_Release(mon);
2375         *cancel = hres == S_OK;
2376         hres = S_OK;
2377     }
2378
2379     IHlinkFrame_Release(hlink_frame);
2380     IBindCtx_Release(bindctx);
2381     IBindStatusCallback_Release(&callback->bsc.IBindStatusCallback_iface);
2382     return hres;
2383 }
2384
2385 static HRESULT navigate_uri(HTMLOuterWindow *window, IUri *uri, const WCHAR *display_uri, const request_data_t *request_data,
2386         DWORD flags)
2387 {
2388     nsWineURI *nsuri;
2389     HRESULT hres;
2390
2391     TRACE("%s\n", debugstr_w(display_uri));
2392
2393     if(!window->browser)
2394         return E_UNEXPECTED;
2395
2396     if(window->browser->doc->webbrowser) {
2397         DWORD post_data_len = request_data ? request_data->post_data_len : 0;
2398         void *post_data = post_data_len ? request_data->post_data : NULL;
2399         const WCHAR *headers = request_data ? request_data->headers : NULL;
2400
2401         if(!(flags & BINDING_REFRESH)) {
2402             BSTR frame_name = NULL;
2403             BOOL cancel = FALSE;
2404
2405             if(!is_main_content_window(window)) {
2406                 hres = IHTMLWindow2_get_name(&window->base.IHTMLWindow2_iface, &frame_name);
2407                 if(FAILED(hres))
2408                     return hres;
2409             }
2410
2411             hres = IDocObjectService_FireBeforeNavigate2(window->browser->doc->doc_object_service, NULL, display_uri, 0x40,
2412                     frame_name, post_data, post_data_len ? post_data_len+1 : 0, headers, TRUE, &cancel);
2413             SysFreeString(frame_name);
2414             if(SUCCEEDED(hres) && cancel) {
2415                 TRACE("Navigation canceled\n");
2416                 return S_OK;
2417             }
2418         }
2419
2420         if(is_main_content_window(window))
2421             return super_navigate(window, uri, flags, headers, post_data, post_data_len);
2422     }
2423
2424     if(is_main_content_window(window)) {
2425         BOOL cancel;
2426
2427         hres = hlink_frame_navigate(&window->base.inner_window->doc->basedoc, display_uri, NULL, 0, &cancel);
2428         if(FAILED(hres))
2429             return hres;
2430
2431         if(cancel) {
2432             TRACE("Navigation handled by hlink frame\n");
2433             return S_OK;
2434         }
2435     }
2436
2437     hres = create_doc_uri(uri, &nsuri);
2438     if(FAILED(hres))
2439         return hres;
2440
2441     hres = load_nsuri(window, nsuri, request_data ? request_data->post_stream : NULL, NULL, LOAD_FLAGS_NONE);
2442     nsISupports_Release((nsISupports*)nsuri);
2443     return hres;
2444 }
2445
2446 HRESULT load_uri(HTMLOuterWindow *window, IUri *uri, DWORD flags)
2447 {
2448     BSTR display_uri;
2449     HRESULT hres;
2450
2451     hres = IUri_GetDisplayUri(uri, &display_uri);
2452     if(FAILED(hres))
2453         return hres;
2454
2455     hres = navigate_uri(window, uri, display_uri, NULL, flags);
2456     SysFreeString(display_uri);
2457     return hres;
2458 }
2459
2460 static HRESULT translate_uri(HTMLOuterWindow *window, IUri *orig_uri, BSTR *ret_display_uri, IUri **ret_uri)
2461 {
2462     IUri *uri = NULL;
2463     BSTR display_uri;
2464     HRESULT hres;
2465
2466     hres = IUri_GetDisplayUri(orig_uri, &display_uri);
2467     if(FAILED(hres))
2468         return hres;
2469
2470     if(window->browser->doc->hostui) {
2471         OLECHAR *translated_url = NULL;
2472
2473         hres = IDocHostUIHandler_TranslateUrl(window->browser->doc->hostui, 0, display_uri,
2474                 &translated_url);
2475         if(hres == S_OK && translated_url) {
2476             TRACE("%08x %s -> %s\n", hres, debugstr_w(display_uri), debugstr_w(translated_url));
2477             SysFreeString(display_uri);
2478             hres = create_uri(translated_url, 0, &uri);
2479             CoTaskMemFree(translated_url);
2480             if(FAILED(hres))
2481                 return hres;
2482
2483             hres = IUri_GetDisplayUri(uri, &display_uri);
2484             if(FAILED(hres)) {
2485                 IUri_Release(uri);
2486                 return hres;
2487             }
2488         }
2489     }
2490
2491     if(!uri) {
2492         IUri_AddRef(orig_uri);
2493         uri = orig_uri;
2494     }
2495
2496     *ret_display_uri = display_uri;
2497     *ret_uri = uri;
2498     return S_OK;
2499 }
2500
2501 HRESULT submit_form(HTMLOuterWindow *window, const WCHAR *target, IUri *submit_uri, nsIInputStream *post_stream)
2502 {
2503     request_data_t request_data = {NULL};
2504     HRESULT hres;
2505
2506     hres = read_post_data_stream(post_stream, TRUE, NULL, &request_data);
2507     if(FAILED(hres))
2508         return hres;
2509
2510     if(window) {
2511         IUri *uri;
2512         BSTR display_uri;
2513
2514         window->readystate_locked++;
2515
2516         hres = translate_uri(window, submit_uri, &display_uri, &uri);
2517         if(SUCCEEDED(hres)) {
2518             hres = navigate_uri(window, uri, display_uri, &request_data, BINDING_NAVIGATED|BINDING_SUBMIT);
2519             IUri_Release(uri);
2520             SysFreeString(display_uri);
2521         }
2522
2523         window->readystate_locked--;
2524     }else
2525         hres = navigate_new_window(window, submit_uri, target, &request_data, NULL);
2526
2527     release_request_data(&request_data);
2528     return hres;
2529 }
2530
2531 HRESULT navigate_url(HTMLOuterWindow *window, const WCHAR *new_url, IUri *base_uri, DWORD flags)
2532 {
2533     IUri *uri, *nav_uri;
2534     BSTR display_uri;
2535     HRESULT hres;
2536
2537     if(new_url && base_uri)
2538         hres = CoInternetCombineUrlEx(base_uri, new_url, URL_ESCAPE_SPACES_ONLY|URL_DONT_ESCAPE_EXTRA_INFO,
2539                 &nav_uri, 0);
2540     else
2541         hres = create_uri(new_url, 0, &nav_uri);
2542     if(FAILED(hres))
2543         return hres;
2544
2545     hres = translate_uri(window, nav_uri, &display_uri, &uri);
2546     IUri_Release(nav_uri);
2547     if(FAILED(hres))
2548         return hres;
2549
2550     hres = navigate_uri(window, uri, display_uri, NULL, flags);
2551     IUri_Release(uri);
2552     SysFreeString(display_uri);
2553     return hres;
2554 }