dlls/mshtml/navigate.c

   1 /*
   2  * Copyright 2006-2010 Jacek Caban for CodeWeavers
   3  *
   4  * This library is free software; you can redistribute it and/or
   5  * modify it under the terms of the GNU Lesser General Public
   6  * License as published by the Free Software Foundation; either
   7  * version 2.1 of the License, or (at your option) any later version.
   8  *
   9  * This library is distributed in the hope that it will be useful,
  10  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  11  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  12  * Lesser General Public License for more details.
  13  *
  14  * You should have received a copy of the GNU Lesser General Public
  15  * License along with this library; if not, write to the Free Software
  16  * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
  17  */
  18
  19 #include <stdarg.h>
  20 #include <assert.h>
  21
  22 #define COBJMACROS
  23 #define NONAMELESSUNION
  24
  25 #include "windef.h"
  26 #include "winbase.h"
  27 #include "winuser.h"
  28 #include "winreg.h"
  29 #include "ole2.h"
  30 #include "hlguids.h"
  31 #include "shlguid.h"
  32 #include "wininet.h"
  33 #include "shlwapi.h"
  34 #include "htiface.h"
  35 #include "shdeprecated.h"
  36
  37 #include "wine/debug.h"
  38
  39 #include "mshtml_private.h"
  40 #include "htmlscript.h"
  41 #include "binding.h"
  42
  43 WINE_DEFAULT_DEBUG_CHANNEL(mshtml);
  44
  45 #define CONTENT_LENGTH "Content-Length"
  46 #define UTF8_STR "utf-8"
  47 #define UTF16_STR "utf-16"
  48
  49 static const WCHAR emptyW[] = {0};
  50 static const WCHAR text_htmlW[] = {'t','e','x','t','/','h','t','m','l',0};
  51
  52 struct nsProtocolStream {
  53     nsIInputStream nsIInputStream_iface;
  54
  55     LONG ref;
  56
  57     char buf[1024];
  58     DWORD buf_size;
  59 };
  60
  61 static inline nsProtocolStream *impl_from_nsIInputStream(nsIInputStream *iface)
  62 {
  63     return CONTAINING_RECORD(iface, nsProtocolStream, nsIInputStream_iface);
  64 }
  65
  66 static nsresult NSAPI nsInputStream_QueryInterface(nsIInputStream *iface, nsIIDRef riid,
  67         void **result)
  68 {
  69     nsProtocolStream *This = impl_from_nsIInputStream(iface);
  70
  71     *result = NULL;
  72
  73     if(IsEqualGUID(&IID_nsISupports, riid)) {
  74         TRACE("(%p)->(IID_nsISupports %p)\n", This, result);
  75         *result  = &This->nsIInputStream_iface;
  76     }else if(IsEqualGUID(&IID_nsIInputStream, riid)) {
  77         TRACE("(%p)->(IID_nsIInputStream %p)\n", This, result);
  78         *result  = &This->nsIInputStream_iface;
  79     }
  80
  81     if(*result) {
  82         nsIInputStream_AddRef(&This->nsIInputStream_iface);
  83         return NS_OK;
  84     }
  85
  86     WARN("unsupported interface %s\n", debugstr_guid(riid));
  87     return NS_NOINTERFACE;
  88 }
  89
  90 static nsrefcnt NSAPI nsInputStream_AddRef(nsIInputStream *iface)
  91 {
  92     nsProtocolStream *This = impl_from_nsIInputStream(iface);
  93     LONG ref = InterlockedIncrement(&This->ref);
  94
  95     TRACE("(%p) ref=%d\n", This, ref);
  96
  97     return ref;
  98 }
  99
 100
 101 static nsrefcnt NSAPI nsInputStream_Release(nsIInputStream *iface)
 102 {
 103     nsProtocolStream *This = impl_from_nsIInputStream(iface);
 104     LONG ref = InterlockedDecrement(&This->ref);
 105
 106     TRACE("(%p) ref=%d\n", This, ref);
 107
 108     if(!ref)
 109         heap_free(This);
 110
 111     return ref;
 112 }
 113
 114 static nsresult NSAPI nsInputStream_Close(nsIInputStream *iface)
 115 {
 116     nsProtocolStream *This = impl_from_nsIInputStream(iface);
 117     FIXME("(%p)\n", This);
 118     return NS_ERROR_NOT_IMPLEMENTED;
 119 }
 120
 121 static nsresult NSAPI nsInputStream_Available(nsIInputStream *iface, UINT64 *_retval)
 122 {
 123     nsProtocolStream *This = impl_from_nsIInputStream(iface);
 124     FIXME("(%p)->(%p)\n", This, _retval);
 125     return NS_ERROR_NOT_IMPLEMENTED;
 126 }
 127
 128 static nsresult NSAPI nsInputStream_Read(nsIInputStream *iface, char *aBuf, UINT32 aCount,
 129                                          UINT32 *_retval)
 130 {
 131     nsProtocolStream *This = impl_from_nsIInputStream(iface);
 132     DWORD read = aCount;
 133
 134     TRACE("(%p)->(%p %d %p)\n", This, aBuf, aCount, _retval);
 135
 136     if(read > This->buf_size)
 137         read = This->buf_size;
 138
 139     if(read) {
 140         memcpy(aBuf, This->buf, read);
 141         if(read < This->buf_size)
 142             memmove(This->buf, This->buf+read, This->buf_size-read);
 143         This->buf_size -= read;
 144     }
 145
 146     *_retval = read;
 147     return NS_OK;
 148 }
 149
 150 static nsresult NSAPI nsInputStream_ReadSegments(nsIInputStream *iface,
 151         nsresult (WINAPI *aWriter)(nsIInputStream*,void*,const char*,UINT32,UINT32,UINT32*),
 152         void *aClousure, UINT32 aCount, UINT32 *_retval)
 153 {
 154     nsProtocolStream *This = impl_from_nsIInputStream(iface);
 155     UINT32 written = 0;
 156     nsresult nsres;
 157
 158     TRACE("(%p)->(%p %p %d %p)\n", This, aWriter, aClousure, aCount, _retval);
 159
 160     if(!This->buf_size)
 161         return S_OK;
 162
 163     if(aCount > This->buf_size)
 164         aCount = This->buf_size;
 165
 166     nsres = aWriter(&This->nsIInputStream_iface, aClousure, This->buf, 0, aCount, &written);
 167     if(NS_FAILED(nsres))
 168         TRACE("aWriter failed: %08x\n", nsres);
 169     else if(written != This->buf_size)
 170         FIXME("written %d != buf_size %d\n", written, This->buf_size);
 171
 172     This->buf_size -= written;
 173
 174     *_retval = written;
 175     return nsres;
 176 }
 177
 178 static nsresult NSAPI nsInputStream_IsNonBlocking(nsIInputStream *iface, cpp_bool *_retval)
 179 {
 180     nsProtocolStream *This = impl_from_nsIInputStream(iface);
 181     FIXME("(%p)->(%p)\n", This, _retval);
 182     return NS_ERROR_NOT_IMPLEMENTED;
 183 }
 184
 185 static const nsIInputStreamVtbl nsInputStreamVtbl = {
 186     nsInputStream_QueryInterface,
 187     nsInputStream_AddRef,
 188     nsInputStream_Release,
 189     nsInputStream_Close,
 190     nsInputStream_Available,
 191     nsInputStream_Read,
 192     nsInputStream_ReadSegments,
 193     nsInputStream_IsNonBlocking
 194 };
 195
 196 static nsProtocolStream *create_nsprotocol_stream(void)
 197 {
 198     nsProtocolStream *ret;
 199
 200     ret = heap_alloc(sizeof(nsProtocolStream));
 201     if(!ret)
 202         return NULL;
 203
 204     ret->nsIInputStream_iface.lpVtbl = &nsInputStreamVtbl;
 205     ret->ref = 1;
 206     ret->buf_size = 0;
 207
 208     return ret;
 209 }
 210
 211 static void release_request_data(request_data_t *request_data)
 212 {
 213     if(request_data->post_stream)
 214         nsIInputStream_Release(request_data->post_stream);
 215     heap_free(request_data->headers);
 216     if(request_data->post_data)
 217         GlobalFree(request_data->post_data);
 218 }
 219
 220 static inline BSCallback *impl_from_IBindStatusCallback(IBindStatusCallback *iface)
 221 {
 222     return CONTAINING_RECORD(iface, BSCallback, IBindStatusCallback_iface);
 223 }
 224
 225 static HRESULT WINAPI BindStatusCallback_QueryInterface(IBindStatusCallback *iface,
 226         REFIID riid, void **ppv)
 227 {
 228     BSCallback *This = impl_from_IBindStatusCallback(iface);
 229
 230     *ppv = NULL;
 231     if(IsEqualGUID(&IID_IUnknown, riid)) {
 232         TRACE("(%p)->(IID_IUnknown, %p)\n", This, ppv);
 233         *ppv = &This->IBindStatusCallback_iface;
 234     }else if(IsEqualGUID(&IID_IBindStatusCallback, riid)) {
 235         TRACE("(%p)->(IID_IBindStatusCallback, %p)\n", This, ppv);
 236         *ppv = &This->IBindStatusCallback_iface;
 237     }else if(IsEqualGUID(&IID_IServiceProvider, riid)) {
 238         TRACE("(%p)->(IID_IServiceProvider %p)\n", This, ppv);
 239         *ppv = &This->IServiceProvider_iface;
 240     }else if(IsEqualGUID(&IID_IHttpNegotiate, riid)) {
 241         TRACE("(%p)->(IID_IHttpNegotiate %p)\n", This, ppv);
 242         *ppv = &This->IHttpNegotiate2_iface;
 243     }else if(IsEqualGUID(&IID_IHttpNegotiate2, riid)) {
 244         TRACE("(%p)->(IID_IHttpNegotiate2 %p)\n", This, ppv);
 245         *ppv = &This->IHttpNegotiate2_iface;
 246     }else if(IsEqualGUID(&IID_IInternetBindInfo, riid)) {
 247         TRACE("(%p)->(IID_IInternetBindInfo %p)\n", This, ppv);
 248         *ppv = &This->IInternetBindInfo_iface;
 249     }else if(IsEqualGUID(&IID_IBindCallbackRedirect, riid)) {
 250         TRACE("(%p)->(IID_IBindCallbackRedirect %p)\n", This, ppv);
 251         *ppv = &This->IBindCallbackRedirect_iface;
 252     }
 253
 254     if(*ppv) {
 255         IBindStatusCallback_AddRef(&This->IBindStatusCallback_iface);
 256         return S_OK;
 257     }
 258
 259     TRACE("Unsupported riid = %s\n", debugstr_guid(riid));
 260     return E_NOINTERFACE;
 261 }
 262
 263 static ULONG WINAPI BindStatusCallback_AddRef(IBindStatusCallback *iface)
 264 {
 265     BSCallback *This = impl_from_IBindStatusCallback(iface);
 266     LONG ref = InterlockedIncrement(&This->ref);
 267
 268     TRACE("(%p) ref = %d\n", This, ref);
 269
 270     return ref;
 271 }
 272
 273 static ULONG WINAPI BindStatusCallback_Release(IBindStatusCallback *iface)
 274 {
 275     BSCallback *This = impl_from_IBindStatusCallback(iface);
 276     LONG ref = InterlockedDecrement(&This->ref);
 277
 278     TRACE("(%p) ref = %d\n", This, ref);
 279
 280     if(!ref) {
 281         release_request_data(&This->request_data);
 282         if(This->mon)
 283             IMoniker_Release(This->mon);
 284         if(This->binding)
 285             IBinding_Release(This->binding);
 286         list_remove(&This->entry);
 287         list_init(&This->entry);
 288
 289         This->vtbl->destroy(This);
 290     }
 291
 292     return ref;
 293 }
 294
 295 static HRESULT WINAPI BindStatusCallback_OnStartBinding(IBindStatusCallback *iface,
 296         DWORD dwReserved, IBinding *pbind)
 297 {
 298     BSCallback *This = impl_from_IBindStatusCallback(iface);
 299
 300     TRACE("(%p)->(%d %p)\n", This, dwReserved, pbind);
 301
 302     IBinding_AddRef(pbind);
 303     This->binding = pbind;
 304
 305     if(This->window)
 306         list_add_head(&This->window->bindings, &This->entry);
 307
 308     return This->vtbl->start_binding(This);
 309 }
 310
 311 static HRESULT WINAPI BindStatusCallback_GetPriority(IBindStatusCallback *iface, LONG *pnPriority)
 312 {
 313     BSCallback *This = impl_from_IBindStatusCallback(iface);
 314     FIXME("(%p)->(%p)\n", This, pnPriority);
 315     return E_NOTIMPL;
 316 }
 317
 318 static HRESULT WINAPI BindStatusCallback_OnLowResource(IBindStatusCallback *iface, DWORD reserved)
 319 {
 320     BSCallback *This = impl_from_IBindStatusCallback(iface);
 321     FIXME("(%p)->(%d)\n", This, reserved);
 322     return E_NOTIMPL;
 323 }
 324
 325 static HRESULT WINAPI BindStatusCallback_OnProgress(IBindStatusCallback *iface, ULONG ulProgress,
 326         ULONG ulProgressMax, ULONG ulStatusCode, LPCWSTR szStatusText)
 327 {
 328     BSCallback *This = impl_from_IBindStatusCallback(iface);
 329
 330     TRACE("%p)->(%u %u %u %s)\n", This, ulProgress, ulProgressMax, ulStatusCode,
 331             debugstr_w(szStatusText));
 332
 333     return This->vtbl->on_progress(This, ulStatusCode, szStatusText);
 334 }
 335
 336 static HRESULT WINAPI BindStatusCallback_OnStopBinding(IBindStatusCallback *iface,
 337         HRESULT hresult, LPCWSTR szError)
 338 {
 339     BSCallback *This = impl_from_IBindStatusCallback(iface);
 340     HRESULT hres;
 341
 342     TRACE("(%p)->(%08x %s)\n", This, hresult, debugstr_w(szError));
 343
 344     /* NOTE: IE7 calls GetBindResult here */
 345
 346     hres = This->vtbl->stop_binding(This, hresult);
 347
 348     if(This->binding) {
 349         IBinding_Release(This->binding);
 350         This->binding = NULL;
 351     }
 352
 353     if(This->mon) {
 354         IMoniker_Release(This->mon);
 355         This->mon = NULL;
 356     }
 357
 358     list_remove(&This->entry);
 359     list_init(&This->entry);
 360     This->window = NULL;
 361
 362     return hres;
 363 }
 364
 365 static HRESULT WINAPI BindStatusCallback_GetBindInfo(IBindStatusCallback *iface,
 366         DWORD *grfBINDF, BINDINFO *pbindinfo)
 367 {
 368     BSCallback *This = impl_from_IBindStatusCallback(iface);
 369     DWORD size;
 370
 371     TRACE("(%p)->(%p %p)\n", This, grfBINDF, pbindinfo);
 372
 373     if(!This->bindinfo_ready) {
 374         HRESULT hres;
 375
 376         hres = This->vtbl->init_bindinfo(This);
 377         if(FAILED(hres))
 378             return hres;
 379
 380         This->bindinfo_ready = TRUE;
 381     }
 382
 383     *grfBINDF = This->bindf;
 384
 385     size = pbindinfo->cbSize;
 386     memset(pbindinfo, 0, size);
 387     pbindinfo->cbSize = size;
 388
 389     pbindinfo->cbstgmedData = This->request_data.post_data_len;
 390     pbindinfo->dwCodePage = CP_UTF8;
 391     pbindinfo->dwOptions = This->bindinfo_options;
 392
 393     if(This->request_data.post_data_len) {
 394         pbindinfo->dwBindVerb = BINDVERB_POST;
 395
 396         pbindinfo->stgmedData.tymed = TYMED_HGLOBAL;
 397         pbindinfo->stgmedData.u.hGlobal = This->request_data.post_data;
 398         pbindinfo->stgmedData.pUnkForRelease = (IUnknown*)&This->IBindStatusCallback_iface;
 399         IBindStatusCallback_AddRef(&This->IBindStatusCallback_iface);
 400     }
 401
 402     return S_OK;
 403 }
 404
 405 static HRESULT WINAPI BindStatusCallback_OnDataAvailable(IBindStatusCallback *iface,
 406         DWORD grfBSCF, DWORD dwSize, FORMATETC *pformatetc, STGMEDIUM *pstgmed)
 407 {
 408     BSCallback *This = impl_from_IBindStatusCallback(iface);
 409
 410     TRACE("(%p)->(%08x %d %p %p)\n", This, grfBSCF, dwSize, pformatetc, pstgmed);
 411
 412     return This->vtbl->read_data(This, pstgmed->u.pstm);
 413 }
 414
 415 static HRESULT WINAPI BindStatusCallback_OnObjectAvailable(IBindStatusCallback *iface,
 416         REFIID riid, IUnknown *punk)
 417 {
 418     BSCallback *This = impl_from_IBindStatusCallback(iface);
 419     FIXME("(%p)->(%s %p)\n", This, debugstr_guid(riid), punk);
 420     return E_NOTIMPL;
 421 }
 422
 423 static const IBindStatusCallbackVtbl BindStatusCallbackVtbl = {
 424     BindStatusCallback_QueryInterface,
 425     BindStatusCallback_AddRef,
 426     BindStatusCallback_Release,
 427     BindStatusCallback_OnStartBinding,
 428     BindStatusCallback_GetPriority,
 429     BindStatusCallback_OnLowResource,
 430     BindStatusCallback_OnProgress,
 431     BindStatusCallback_OnStopBinding,
 432     BindStatusCallback_GetBindInfo,
 433     BindStatusCallback_OnDataAvailable,
 434     BindStatusCallback_OnObjectAvailable
 435 };
 436
 437 static inline BSCallback *impl_from_IHttpNegotiate2(IHttpNegotiate2 *iface)
 438 {
 439     return CONTAINING_RECORD(iface, BSCallback, IHttpNegotiate2_iface);
 440 }
 441
 442 static HRESULT WINAPI HttpNegotiate_QueryInterface(IHttpNegotiate2 *iface,
 443                                                    REFIID riid, void **ppv)
 444 {
 445     BSCallback *This = impl_from_IHttpNegotiate2(iface);
 446     return IBindStatusCallback_QueryInterface(&This->IBindStatusCallback_iface, riid, ppv);
 447 }
 448
 449 static ULONG WINAPI HttpNegotiate_AddRef(IHttpNegotiate2 *iface)
 450 {
 451     BSCallback *This = impl_from_IHttpNegotiate2(iface);
 452     return IBindStatusCallback_AddRef(&This->IBindStatusCallback_iface);
 453 }
 454
 455 static ULONG WINAPI HttpNegotiate_Release(IHttpNegotiate2 *iface)
 456 {
 457     BSCallback *This = impl_from_IHttpNegotiate2(iface);
 458     return IBindStatusCallback_Release(&This->IBindStatusCallback_iface);
 459 }
 460
 461 static HRESULT WINAPI HttpNegotiate_BeginningTransaction(IHttpNegotiate2 *iface,
 462         LPCWSTR szURL, LPCWSTR szHeaders, DWORD dwReserved, LPWSTR *pszAdditionalHeaders)
 463 {
 464     BSCallback *This = impl_from_IHttpNegotiate2(iface);
 465     HRESULT hres;
 466
 467     TRACE("(%p)->(%s %s %d %p)\n", This, debugstr_w(szURL), debugstr_w(szHeaders),
 468           dwReserved, pszAdditionalHeaders);
 469
 470     *pszAdditionalHeaders = NULL;
 471
 472     hres = This->vtbl->beginning_transaction(This, pszAdditionalHeaders);
 473     if(hres != S_FALSE)
 474         return hres;
 475
 476     if(This->request_data.headers) {
 477         DWORD size;
 478
 479         size = (lstrlenW(This->request_data.headers)+1)*sizeof(WCHAR);
 480         *pszAdditionalHeaders = CoTaskMemAlloc(size);
 481         if(!*pszAdditionalHeaders)
 482             return E_OUTOFMEMORY;
 483         memcpy(*pszAdditionalHeaders, This->request_data.headers, size);
 484     }
 485
 486     return S_OK;
 487 }
 488
 489 static HRESULT WINAPI HttpNegotiate_OnResponse(IHttpNegotiate2 *iface, DWORD dwResponseCode,
 490         LPCWSTR szResponseHeaders, LPCWSTR szRequestHeaders, LPWSTR *pszAdditionalRequestHeaders)
 491 {
 492     BSCallback *This = impl_from_IHttpNegotiate2(iface);
 493
 494     TRACE("(%p)->(%d %s %s %p)\n", This, dwResponseCode, debugstr_w(szResponseHeaders),
 495           debugstr_w(szRequestHeaders), pszAdditionalRequestHeaders);
 496
 497     return This->vtbl->on_response(This, dwResponseCode, szResponseHeaders);
 498 }
 499
 500 static HRESULT WINAPI HttpNegotiate_GetRootSecurityId(IHttpNegotiate2 *iface,
 501         BYTE *pbSecurityId, DWORD *pcbSecurityId, DWORD_PTR dwReserved)
 502 {
 503     BSCallback *This = impl_from_IHttpNegotiate2(iface);
 504     TRACE("(%p)->(%p %p %ld)\n", This, pbSecurityId, pcbSecurityId, dwReserved);
 505     return E_NOTIMPL; /* FIXME */
 506 }
 507
 508 static const IHttpNegotiate2Vtbl HttpNegotiate2Vtbl = {
 509     HttpNegotiate_QueryInterface,
 510     HttpNegotiate_AddRef,
 511     HttpNegotiate_Release,
 512     HttpNegotiate_BeginningTransaction,
 513     HttpNegotiate_OnResponse,
 514     HttpNegotiate_GetRootSecurityId
 515 };
 516
 517 static inline BSCallback *impl_from_IInternetBindInfo(IInternetBindInfo *iface)
 518 {
 519     return CONTAINING_RECORD(iface, BSCallback, IInternetBindInfo_iface);
 520 }
 521
 522 static HRESULT WINAPI InternetBindInfo_QueryInterface(IInternetBindInfo *iface,
 523                                                       REFIID riid, void **ppv)
 524 {
 525     BSCallback *This = impl_from_IInternetBindInfo(iface);
 526     return IBindStatusCallback_QueryInterface(&This->IBindStatusCallback_iface, riid, ppv);
 527 }
 528
 529 static ULONG WINAPI InternetBindInfo_AddRef(IInternetBindInfo *iface)
 530 {
 531     BSCallback *This = impl_from_IInternetBindInfo(iface);
 532     return IBindStatusCallback_AddRef(&This->IBindStatusCallback_iface);
 533 }
 534
 535 static ULONG WINAPI InternetBindInfo_Release(IInternetBindInfo *iface)
 536 {
 537     BSCallback *This = impl_from_IInternetBindInfo(iface);
 538     return IBindStatusCallback_Release(&This->IBindStatusCallback_iface);
 539 }
 540
 541 static HRESULT WINAPI InternetBindInfo_GetBindInfo(IInternetBindInfo *iface,
 542                                                    DWORD *grfBINDF, BINDINFO *pbindinfo)
 543 {
 544     BSCallback *This = impl_from_IInternetBindInfo(iface);
 545     FIXME("(%p)->(%p %p)\n", This, grfBINDF, pbindinfo);
 546     return E_NOTIMPL;
 547 }
 548
 549 static HRESULT WINAPI InternetBindInfo_GetBindString(IInternetBindInfo *iface,
 550         ULONG ulStringType, LPOLESTR *ppwzStr, ULONG cEl, ULONG *pcElFetched)
 551 {
 552     BSCallback *This = impl_from_IInternetBindInfo(iface);
 553     FIXME("(%p)->(%u %p %u %p)\n", This, ulStringType, ppwzStr, cEl, pcElFetched);
 554     return E_NOTIMPL;
 555 }
 556
 557 static const IInternetBindInfoVtbl InternetBindInfoVtbl = {
 558     InternetBindInfo_QueryInterface,
 559     InternetBindInfo_AddRef,
 560     InternetBindInfo_Release,
 561     InternetBindInfo_GetBindInfo,
 562     InternetBindInfo_GetBindString
 563 };
 564
 565 static inline BSCallback *impl_from_IBindCallbackRedirect(IBindCallbackRedirect *iface)
 566 {
 567     return CONTAINING_RECORD(iface, BSCallback, IBindCallbackRedirect_iface);
 568 }
 569
 570 static HRESULT WINAPI BindCallbackRedirect_QueryInterface(IBindCallbackRedirect *iface, REFIID riid, void **ppv)
 571 {
 572     BSCallback *This = impl_from_IBindCallbackRedirect(iface);
 573     return IBindStatusCallback_QueryInterface(&This->IBindStatusCallback_iface, riid, ppv);
 574 }
 575
 576 static ULONG WINAPI BindCallbackRedirect_AddRef(IBindCallbackRedirect *iface)
 577 {
 578     BSCallback *This = impl_from_IBindCallbackRedirect(iface);
 579     return IBindStatusCallback_AddRef(&This->IBindStatusCallback_iface);
 580 }
 581
 582 static ULONG WINAPI BindCallbackRedirect_Release(IBindCallbackRedirect *iface)
 583 {
 584     BSCallback *This = impl_from_IBindCallbackRedirect(iface);
 585     return IBindStatusCallback_Release(&This->IBindStatusCallback_iface);
 586 }
 587
 588 static HRESULT WINAPI BindCallbackRedirect_Redirect(IBindCallbackRedirect *iface, const WCHAR *url, VARIANT_BOOL *vbCancel)
 589 {
 590     BSCallback *This = impl_from_IBindCallbackRedirect(iface);
 591     GeckoBrowser *browser;
 592     BOOL cancel = FALSE;
 593     BSTR frame_name = NULL;
 594     HRESULT hres = S_OK;
 595
 596     TRACE("(%p)->(%s %p)\n", This, debugstr_w(url), vbCancel);
 597
 598     if(This->window && This->window->base.outer_window && (browser = This->window->base.outer_window->browser)
 599        && browser->doc->doc_object_service) {
 600         if(is_main_content_window(This->window->base.outer_window)) {
 601             hres = IHTMLWindow2_get_name(&This->window->base.IHTMLWindow2_iface, &frame_name);
 602             if(FAILED(hres))
 603                 return hres;
 604         }
 605
 606         hres = IDocObjectService_FireBeforeNavigate2(browser->doc->doc_object_service, NULL, url, 0x40,
 607                                                      frame_name, NULL, 0, NULL, TRUE, &cancel);
 608         SysFreeString(frame_name);
 609     }
 610
 611     *vbCancel = variant_bool(cancel);
 612     return hres;
 613 }
 614
 615 static const IBindCallbackRedirectVtbl BindCallbackRedirectVtbl = {
 616     BindCallbackRedirect_QueryInterface,
 617     BindCallbackRedirect_AddRef,
 618     BindCallbackRedirect_Release,
 619     BindCallbackRedirect_Redirect
 620 };
 621
 622 static inline BSCallback *impl_from_IServiceProvider(IServiceProvider *iface)
 623 {
 624     return CONTAINING_RECORD(iface, BSCallback, IServiceProvider_iface);
 625 }
 626
 627 static HRESULT WINAPI BSCServiceProvider_QueryInterface(IServiceProvider *iface,
 628                                                         REFIID riid, void **ppv)
 629 {
 630     BSCallback *This = impl_from_IServiceProvider(iface);
 631     return IBindStatusCallback_QueryInterface(&This->IBindStatusCallback_iface, riid, ppv);
 632 }
 633
 634 static ULONG WINAPI BSCServiceProvider_AddRef(IServiceProvider *iface)
 635 {
 636     BSCallback *This = impl_from_IServiceProvider(iface);
 637     return IBindStatusCallback_AddRef(&This->IBindStatusCallback_iface);
 638 }
 639
 640 static ULONG WINAPI BSCServiceProvider_Release(IServiceProvider *iface)
 641 {
 642     BSCallback *This = impl_from_IServiceProvider(iface);
 643     return IBindStatusCallback_Release(&This->IBindStatusCallback_iface);
 644 }
 645
 646 static HRESULT WINAPI BSCServiceProvider_QueryService(IServiceProvider *iface,
 647         REFGUID guidService, REFIID riid, void **ppv)
 648 {
 649     BSCallback *This = impl_from_IServiceProvider(iface);
 650
 651     TRACE("(%p)->(%s %s %p)\n", This, debugstr_guid(guidService), debugstr_guid(riid), ppv);
 652
 653     if(This->window && IsEqualGUID(guidService, &IID_IWindowForBindingUI))
 654         return IServiceProvider_QueryService(&This->window->base.IServiceProvider_iface, guidService, riid, ppv);
 655     return E_NOINTERFACE;
 656 }
 657
 658 static const IServiceProviderVtbl ServiceProviderVtbl = {
 659     BSCServiceProvider_QueryInterface,
 660     BSCServiceProvider_AddRef,
 661     BSCServiceProvider_Release,
 662     BSCServiceProvider_QueryService
 663 };
 664
 665 void init_bscallback(BSCallback *This, const BSCallbackVtbl *vtbl, IMoniker *mon, DWORD bindf)
 666 {
 667     This->IBindStatusCallback_iface.lpVtbl = &BindStatusCallbackVtbl;
 668     This->IServiceProvider_iface.lpVtbl = &ServiceProviderVtbl;
 669     This->IHttpNegotiate2_iface.lpVtbl = &HttpNegotiate2Vtbl;
 670     This->IInternetBindInfo_iface.lpVtbl = &InternetBindInfoVtbl;
 671     This->IBindCallbackRedirect_iface.lpVtbl = &BindCallbackRedirectVtbl;
 672     This->vtbl = vtbl;
 673     This->ref = 1;
 674     This->bindf = bindf;
 675     This->bindinfo_options = BINDINFO_OPTIONS_USE_IE_ENCODING;
 676     This->bom = BOM_NONE;
 677
 678     list_init(&This->entry);
 679
 680     if(mon)
 681         IMoniker_AddRef(mon);
 682     This->mon = mon;
 683 }
 684
 685 HRESULT read_stream(BSCallback *This, IStream *stream, void *buf, DWORD size, DWORD *ret_size)
 686 {
 687     DWORD read_size = 0, skip=0;
 688     BYTE *data = buf;
 689     HRESULT hres;
 690
 691     hres = IStream_Read(stream, buf, size, &read_size);
 692
 693     if(!This->read && This->bom == BOM_NONE) {
 694         if(read_size >= 2 && data[0] == 0xff && data[1] == 0xfe) {
 695             This->bom = BOM_UTF16;
 696             skip = 2;
 697         }else if(read_size >= 3 && data[0] == 0xef && data[1] == 0xbb && data[2] == 0xbf) {
 698             This->bom = BOM_UTF8;
 699             skip = 3;
 700         }
 701         if(skip) {
 702             read_size -= skip;
 703             if(read_size)
 704                 memmove(data, data+skip, read_size);
 705         }
 706     }
 707
 708     This->read += read_size;
 709     *ret_size = read_size;
 710     return hres;
 711 }
 712
 713 static void parse_content_type(nsChannelBSC *This, const WCHAR *value)
 714 {
 715     const WCHAR *ptr;
 716     size_t len;
 717
 718     static const WCHAR charsetW[] = {'c','h','a','r','s','e','t','='};
 719
 720     ptr = wcschr(value, ';');
 721     if(!ptr)
 722         return;
 723
 724     ptr++;
 725     while(*ptr && iswspace(*ptr))
 726         ptr++;
 727
 728     len = lstrlenW(value);
 729     if(ptr + ARRAY_SIZE(charsetW) < value+len && !wcsnicmp(ptr, charsetW, ARRAY_SIZE(charsetW))) {
 730         size_t charset_len, lena;
 731         nsACString charset_str;
 732         const WCHAR *charset;
 733         char *charseta;
 734
 735         ptr += ARRAY_SIZE(charsetW);
 736
 737         if(*ptr == '\'') {
 738             FIXME("Quoted value\n");
 739             return;
 740         }else {
 741             charset = ptr;
 742             while(*ptr && *ptr != ',')
 743                 ptr++;
 744             charset_len = ptr-charset;
 745         }
 746
 747         lena = WideCharToMultiByte(CP_ACP, 0, charset, charset_len, NULL, 0, NULL, NULL);
 748         charseta = heap_alloc(lena+1);
 749         if(!charseta)
 750             return;
 751
 752         WideCharToMultiByte(CP_ACP, 0, charset, charset_len, charseta, lena, NULL, NULL);
 753         charseta[lena] = 0;
 754
 755         nsACString_InitDepend(&charset_str, charseta);
 756         nsIHttpChannel_SetContentCharset(&This->nschannel->nsIHttpChannel_iface, &charset_str);
 757         nsACString_Finish(&charset_str);
 758         heap_free(charseta);
 759     }else {
 760         FIXME("unhandled: %s\n", debugstr_wn(ptr, len - (ptr-value)));
 761     }
 762 }
 763
 764 static HRESULT parse_headers(const WCHAR *headers, struct list *headers_list)
 765 {
 766     const WCHAR *header, *header_end, *colon, *value;
 767     HRESULT hres;
 768
 769     header = headers;
 770     while(*header) {
 771         if(header[0] == '\r' && header[1] == '\n' && !header[2])
 772             break;
 773         for(colon = header; *colon && *colon != ':' && *colon != '\r'; colon++);
 774         if(*colon != ':')
 775             return E_FAIL;
 776
 777         value = colon+1;
 778         while(*value == ' ')
 779             value++;
 780         if(!*value)
 781             return E_FAIL;
 782
 783         for(header_end = value+1; *header_end && *header_end != '\r'; header_end++);
 784
 785         hres = set_http_header(headers_list, header, colon-header, value, header_end-value);
 786         if(FAILED(hres))
 787             return hres;
 788
 789         header = header_end;
 790         if(header[0] == '\r' && header[1] == '\n')
 791             header += 2;
 792     }
 793
 794     return S_OK;
 795 }
 796
 797 static HRESULT process_response_headers(nsChannelBSC *This, const WCHAR *headers)
 798 {
 799     http_header_t *iter;
 800     HRESULT hres;
 801
 802     static const WCHAR content_typeW[] = {'c','o','n','t','e','n','t','-','t','y','p','e',0};
 803
 804     hres = parse_headers(headers, &This->nschannel->response_headers);
 805     if(FAILED(hres))
 806         return hres;
 807
 808     LIST_FOR_EACH_ENTRY(iter, &This->nschannel->response_headers, http_header_t, entry) {
 809         if(!wcsicmp(iter->header, content_typeW))
 810             parse_content_type(This, iter->data);
 811     }
 812
 813     return S_OK;
 814 }
 815
 816 static void query_http_info(nsChannelBSC *This, IWinInetHttpInfo *wininet_info)
 817 {
 818     const WCHAR *ptr;
 819     DWORD len = 0;
 820     WCHAR *buf;
 821
 822     IWinInetHttpInfo_QueryInfo(wininet_info, HTTP_QUERY_RAW_HEADERS_CRLF, NULL, &len, NULL, NULL);
 823     if(!len)
 824         return;
 825
 826     buf = heap_alloc(len);
 827     if(!buf)
 828         return;
 829
 830     IWinInetHttpInfo_QueryInfo(wininet_info, HTTP_QUERY_RAW_HEADERS_CRLF, buf, &len, NULL, NULL);
 831     if(!len) {
 832         heap_free(buf);
 833         return;
 834     }
 835
 836     ptr = wcschr(buf, '\r');
 837     if(ptr && ptr[1] == '\n') {
 838         ptr += 2;
 839         process_response_headers(This, ptr);
 840     }
 841
 842     heap_free(buf);
 843 }
 844
 845 HRESULT start_binding(HTMLInnerWindow *inner_window, BSCallback *bscallback, IBindCtx *bctx)
 846 {
 847     IStream *str = NULL;
 848     HRESULT hres;
 849
 850     TRACE("(%p %p %p)\n", inner_window, bscallback, bctx);
 851
 852     bscallback->window = inner_window;
 853
 854     /* NOTE: IE7 calls IsSystemMoniker here*/
 855
 856     if(bctx) {
 857         hres = RegisterBindStatusCallback(bctx, &bscallback->IBindStatusCallback_iface, NULL, 0);
 858         if(SUCCEEDED(hres))
 859             IBindCtx_AddRef(bctx);
 860     }else {
 861         hres = CreateAsyncBindCtx(0, &bscallback->IBindStatusCallback_iface, NULL, &bctx);
 862     }
 863
 864     if(FAILED(hres)) {
 865         bscallback->window = NULL;
 866         return hres;
 867     }
 868
 869     hres = IMoniker_BindToStorage(bscallback->mon, bctx, NULL, &IID_IStream, (void**)&str);
 870     IBindCtx_Release(bctx);
 871     if(FAILED(hres)) {
 872         WARN("BindToStorage failed: %08x\n", hres);
 873         bscallback->window = NULL;
 874         return hres;
 875     }
 876
 877     if(str)
 878         IStream_Release(str);
 879
 880     return S_OK;
 881 }
 882
 883 static HRESULT read_post_data_stream(nsIInputStream *stream, BOOL contains_headers, struct list *headers_list,
 884         request_data_t *request_data)
 885 {
 886     nsISeekableStream *seekable_stream;
 887     UINT64 available = 0;
 888     UINT32 data_len = 0;
 889     char *data, *post_data;
 890     nsresult nsres;
 891     HRESULT hres = S_OK;
 892
 893     if(!stream)
 894         return S_OK;
 895
 896     nsres =  nsIInputStream_Available(stream, &available);
 897     if(NS_FAILED(nsres))
 898         return E_FAIL;
 899
 900     post_data = data = GlobalAlloc(0, available+1);
 901     if(!data)
 902         return E_OUTOFMEMORY;
 903
 904     nsres = nsIInputStream_Read(stream, data, available, &data_len);
 905     if(NS_FAILED(nsres)) {
 906         GlobalFree(data);
 907         return E_FAIL;
 908     }
 909
 910     if(contains_headers) {
 911         if(data_len >= 2 && data[0] == '\r' && data[1] == '\n') {
 912             post_data = data+2;
 913             data_len -= 2;
 914         }else {
 915             WCHAR *headers;
 916             DWORD size;
 917             char *ptr;
 918
 919             post_data += data_len;
 920             for(ptr = data; ptr+4 < data+data_len; ptr++) {
 921                 if(!memcmp(ptr, "\r\n\r\n", 4)) {
 922                     ptr += 2;
 923                     post_data = ptr+2;
 924                     break;
 925                 }
 926             }
 927
 928             data_len -= post_data-data;
 929
 930             size = MultiByteToWideChar(CP_ACP, 0, data, ptr-data, NULL, 0);
 931             headers = heap_alloc((size+1)*sizeof(WCHAR));
 932             if(headers) {
 933                 MultiByteToWideChar(CP_ACP, 0, data, ptr-data, headers, size);
 934                 headers[size] = 0;
 935                 if(headers_list)
 936                     hres = parse_headers(headers, headers_list);
 937                 if(SUCCEEDED(hres))
 938                     request_data->headers = headers;
 939                 else
 940                     heap_free(headers);
 941             }else {
 942                 hres = E_OUTOFMEMORY;
 943             }
 944         }
 945     }
 946
 947     if(FAILED(hres)) {
 948         GlobalFree(data);
 949         return hres;
 950     }
 951
 952     if(!data_len) {
 953         GlobalFree(data);
 954         post_data = NULL;
 955     }else if(post_data != data) {
 956         char *new_data;
 957
 958         new_data = GlobalAlloc(0, data_len+1);
 959         if(new_data)
 960             memcpy(new_data, post_data, data_len);
 961         GlobalFree(data);
 962         if(!new_data)
 963             return E_OUTOFMEMORY;
 964         post_data = new_data;
 965     }
 966
 967     if(post_data)
 968         post_data[data_len] = 0;
 969     request_data->post_data = post_data;
 970     request_data->post_data_len = data_len;
 971
 972     nsres = nsIInputStream_QueryInterface(stream, &IID_nsISeekableStream, (void**)&seekable_stream);
 973     assert(nsres == NS_OK);
 974
 975     nsres = nsISeekableStream_Seek(seekable_stream, NS_SEEK_SET, 0);
 976     assert(nsres == NS_OK);
 977
 978     nsISeekableStream_Release(seekable_stream);
 979
 980     nsIInputStream_AddRef(stream);
 981     request_data->post_stream = stream;
 982     TRACE("post_data = %s\n", debugstr_an(request_data->post_data, request_data->post_data_len));
 983     return S_OK;
 984 }
 985
 986 static HRESULT on_start_nsrequest(nsChannelBSC *This)
 987 {
 988     nsresult nsres;
 989
 990     This->nschannel->binding = This;
 991
 992     /* FIXME: it's needed for http connections from BindToObject. */
 993     if(!This->nschannel->response_status)
 994         This->nschannel->response_status = 200;
 995
 996     nsres = nsIStreamListener_OnStartRequest(This->nslistener,
 997             (nsIRequest*)&This->nschannel->nsIHttpChannel_iface, This->nscontext);
 998     if(NS_FAILED(nsres)) {
 999         FIXME("OnStartRequest failed: %08x\n", nsres);
1000         return E_FAIL;
1001     }
1002
1003     if(This->is_doc_channel) {
1004         HRESULT hres;
1005
1006         if(!This->bsc.window)
1007             return E_ABORT; /* Binding aborted in OnStartRequest call. */
1008         hres = update_window_doc(This->bsc.window);
1009         if(FAILED(hres))
1010             return hres;
1011
1012         if(This->bsc.binding)
1013             process_document_response_headers(This->bsc.window->doc, This->bsc.binding);
1014         if(This->bsc.window->base.outer_window->readystate != READYSTATE_LOADING)
1015             set_ready_state(This->bsc.window->base.outer_window, READYSTATE_LOADING);
1016     }
1017
1018     return S_OK;
1019 }
1020
1021 static void on_stop_nsrequest(nsChannelBSC *This, HRESULT result)
1022 {
1023     nsresult nsres, request_result;
1024
1025     switch(result) {
1026     case S_OK:
1027         request_result = NS_OK;
1028         break;
1029     case E_ABORT:
1030         request_result = NS_BINDING_ABORTED;
1031         break;
1032     default:
1033         request_result = NS_ERROR_FAILURE;
1034     }
1035
1036     if(This->nslistener) {
1037         nsres = nsIStreamListener_OnStopRequest(This->nslistener,
1038                  (nsIRequest*)&This->nschannel->nsIHttpChannel_iface, This->nscontext,
1039                  request_result);
1040         if(NS_FAILED(nsres))
1041             WARN("OnStopRequest failed: %08x\n", nsres);
1042     }
1043
1044     if(This->nschannel) {
1045         if(This->nschannel->load_group) {
1046             nsres = nsILoadGroup_RemoveRequest(This->nschannel->load_group,
1047                     (nsIRequest*)&This->nschannel->nsIHttpChannel_iface, NULL, request_result);
1048             if(NS_FAILED(nsres))
1049                 ERR("RemoveRequest failed: %08x\n", nsres);
1050         }
1051         if(This->nschannel->binding == This)
1052             This->nschannel->binding = NULL;
1053     }
1054 }
1055
1056 static HRESULT read_stream_data(nsChannelBSC *This, IStream *stream)
1057 {
1058     DWORD read;
1059     nsresult nsres;
1060     HRESULT hres;
1061
1062     if(!This->response_processed) {
1063         IWinInetHttpInfo *wininet_info;
1064
1065         This->response_processed = TRUE;
1066         if(This->bsc.binding) {
1067             hres = IBinding_QueryInterface(This->bsc.binding, &IID_IWinInetHttpInfo, (void**)&wininet_info);
1068             if(SUCCEEDED(hres)) {
1069                 query_http_info(This, wininet_info);
1070                 IWinInetHttpInfo_Release(wininet_info);
1071             }
1072         }
1073     }
1074
1075     if(!This->nschannel)
1076         return S_OK;
1077
1078     if(!This->nslistener) {
1079         BYTE buf[1024];
1080
1081         do {
1082             hres = read_stream(&This->bsc, stream, buf, sizeof(buf), &read);
1083         }while(hres == S_OK && read);
1084
1085         return S_OK;
1086     }
1087
1088     if(!This->nsstream) {
1089         This->nsstream = create_nsprotocol_stream();
1090         if(!This->nsstream)
1091             return E_OUTOFMEMORY;
1092     }
1093
1094     do {
1095         BOOL first_read = !This->bsc.read;
1096
1097         hres = read_stream(&This->bsc, stream, This->nsstream->buf+This->nsstream->buf_size,
1098                 sizeof(This->nsstream->buf)-This->nsstream->buf_size, &read);
1099         if(!read)
1100             break;
1101
1102         This->nsstream->buf_size += read;
1103
1104         if(first_read) {
1105             switch(This->bsc.bom) {
1106             case BOM_UTF8:
1107                 This->nschannel->charset = heap_strdupA(UTF8_STR);
1108                 break;
1109             case BOM_UTF16:
1110                 This->nschannel->charset = heap_strdupA(UTF16_STR);
1111             case BOM_NONE:
1112                 /* FIXME: Get charset from HTTP headers */;
1113             }
1114
1115             if(!This->nschannel->content_type) {
1116                 WCHAR *mime;
1117
1118                 hres = FindMimeFromData(NULL, NULL, This->nsstream->buf, This->nsstream->buf_size,
1119                         This->is_doc_channel ? text_htmlW : NULL, 0, &mime, 0);
1120                 if(FAILED(hres))
1121                     return hres;
1122
1123                 TRACE("Found MIME %s\n", debugstr_w(mime));
1124
1125                 This->nschannel->content_type = heap_strdupWtoA(mime);
1126                 CoTaskMemFree(mime);
1127                 if(!This->nschannel->content_type)
1128                     return E_OUTOFMEMORY;
1129             }
1130
1131             hres = on_start_nsrequest(This);
1132             if(FAILED(hres))
1133                 return hres;
1134         }
1135
1136         nsres = nsIStreamListener_OnDataAvailable(This->nslistener,
1137                 (nsIRequest*)&This->nschannel->nsIHttpChannel_iface, This->nscontext,
1138                 &This->nsstream->nsIInputStream_iface, This->bsc.read-This->nsstream->buf_size,
1139                 This->nsstream->buf_size);
1140         if(NS_FAILED(nsres))
1141             ERR("OnDataAvailable failed: %08x\n", nsres);
1142
1143         if(This->nsstream->buf_size == sizeof(This->nsstream->buf)) {
1144             ERR("buffer is full\n");
1145             break;
1146         }
1147     }while(hres == S_OK);
1148
1149     return S_OK;
1150 }
1151
1152 typedef struct {
1153     nsIAsyncVerifyRedirectCallback nsIAsyncVerifyRedirectCallback_iface;
1154
1155     LONG ref;
1156
1157     nsChannel *nschannel;
1158     nsChannelBSC *bsc;
1159 } nsRedirectCallback;
1160
1161 static nsRedirectCallback *impl_from_nsIAsyncVerifyRedirectCallback(nsIAsyncVerifyRedirectCallback *iface)
1162 {
1163     return CONTAINING_RECORD(iface, nsRedirectCallback, nsIAsyncVerifyRedirectCallback_iface);
1164 }
1165
1166 static nsresult NSAPI nsAsyncVerifyRedirectCallback_QueryInterface(nsIAsyncVerifyRedirectCallback *iface,
1167         nsIIDRef riid, void **result)
1168 {
1169     nsRedirectCallback *This = impl_from_nsIAsyncVerifyRedirectCallback(iface);
1170
1171     if(IsEqualGUID(&IID_nsISupports, riid)) {
1172         TRACE("(%p)->(IID_nsISupports %p)\n", This, result);
1173         *result = &This->nsIAsyncVerifyRedirectCallback_iface;
1174     }else if(IsEqualGUID(&IID_nsIAsyncVerifyRedirectCallback, riid)) {
1175         TRACE("(%p)->(IID_nsIAsyncVerifyRedirectCallback %p)\n", This, result);
1176         *result = &This->nsIAsyncVerifyRedirectCallback_iface;
1177     }else {
1178         *result = NULL;
1179         WARN("unimplemented iface %s\n", debugstr_guid(riid));
1180         return NS_NOINTERFACE;
1181     }
1182
1183     nsISupports_AddRef((nsISupports*)*result);
1184     return NS_OK;
1185 }
1186
1187 static nsrefcnt NSAPI nsAsyncVerifyRedirectCallback_AddRef(nsIAsyncVerifyRedirectCallback *iface)
1188 {
1189     nsRedirectCallback *This = impl_from_nsIAsyncVerifyRedirectCallback(iface);
1190     LONG ref = InterlockedIncrement(&This->ref);
1191
1192     TRACE("(%p) ref=%d\n", This, ref);
1193
1194     return ref;
1195 }
1196
1197 static nsrefcnt NSAPI nsAsyncVerifyRedirectCallback_Release(nsIAsyncVerifyRedirectCallback *iface)
1198 {
1199     nsRedirectCallback *This = impl_from_nsIAsyncVerifyRedirectCallback(iface);
1200     LONG ref = InterlockedDecrement(&This->ref);
1201
1202     TRACE("(%p) ref=%d\n", This, ref);
1203
1204     if(!ref) {
1205         IBindStatusCallback_Release(&This->bsc->bsc.IBindStatusCallback_iface);
1206         nsIHttpChannel_Release(&This->nschannel->nsIHttpChannel_iface);
1207         heap_free(This);
1208     }
1209
1210     return ref;
1211 }
1212
1213 static nsresult NSAPI nsAsyncVerifyRedirectCallback_OnRedirectVerifyCallback(nsIAsyncVerifyRedirectCallback *iface, nsresult result)
1214 {
1215     nsRedirectCallback *This = impl_from_nsIAsyncVerifyRedirectCallback(iface);
1216     nsChannel *old_nschannel;
1217     nsresult nsres;
1218
1219     TRACE("(%p)->(%08x)\n", This, result);
1220
1221     old_nschannel = This->bsc->nschannel;
1222     nsIHttpChannel_AddRef(&This->nschannel->nsIHttpChannel_iface);
1223     This->bsc->nschannel = This->nschannel;
1224
1225     if(This->nschannel->load_group) {
1226         nsres = nsILoadGroup_AddRequest(This->nschannel->load_group, (nsIRequest*)&This->nschannel->nsIHttpChannel_iface,
1227                 NULL);
1228         if(NS_FAILED(nsres))
1229             ERR("AddRequest failed: %08x\n", nsres);
1230     }
1231
1232     if(This->bsc->is_doc_channel && This->bsc->bsc.window && This->bsc->bsc.window->base.outer_window) {
1233         IUri *uri = nsuri_get_uri(This->nschannel->uri);
1234
1235         if(uri) {
1236             set_current_uri(This->bsc->bsc.window->base.outer_window, uri);
1237             IUri_Release(uri);
1238         }else {
1239             WARN("Could not get IUri from nsWineURI\n");
1240         }
1241     }
1242
1243     if(old_nschannel) {
1244         if(old_nschannel->load_group) {
1245             nsres = nsILoadGroup_RemoveRequest(old_nschannel->load_group,
1246                     (nsIRequest*)&old_nschannel->nsIHttpChannel_iface, NULL, NS_OK);
1247             if(NS_FAILED(nsres))
1248                 ERR("RemoveRequest failed: %08x\n", nsres);
1249         }
1250         nsIHttpChannel_Release(&old_nschannel->nsIHttpChannel_iface);
1251     }
1252
1253     return NS_OK;
1254 }
1255
1256 static const nsIAsyncVerifyRedirectCallbackVtbl nsAsyncVerifyRedirectCallbackVtbl = {
1257     nsAsyncVerifyRedirectCallback_QueryInterface,
1258     nsAsyncVerifyRedirectCallback_AddRef,
1259     nsAsyncVerifyRedirectCallback_Release,
1260     nsAsyncVerifyRedirectCallback_OnRedirectVerifyCallback
1261 };
1262
1263 static HRESULT create_redirect_callback(nsChannel *nschannel, nsChannelBSC *bsc, nsRedirectCallback **ret)
1264 {
1265     nsRedirectCallback *callback;
1266
1267     callback = heap_alloc(sizeof(*callback));
1268     if(!callback)
1269         return E_OUTOFMEMORY;
1270
1271     callback->nsIAsyncVerifyRedirectCallback_iface.lpVtbl = &nsAsyncVerifyRedirectCallbackVtbl;
1272     callback->ref = 1;
1273
1274     nsIHttpChannel_AddRef(&nschannel->nsIHttpChannel_iface);
1275     callback->nschannel = nschannel;
1276
1277     IBindStatusCallback_AddRef(&bsc->bsc.IBindStatusCallback_iface);
1278     callback->bsc = bsc;
1279
1280     *ret = callback;
1281     return S_OK;
1282 }
1283
1284 static inline nsChannelBSC *nsChannelBSC_from_BSCallback(BSCallback *iface)
1285 {
1286     return CONTAINING_RECORD(iface, nsChannelBSC, bsc);
1287 }
1288
1289 static void nsChannelBSC_destroy(BSCallback *bsc)
1290 {
1291     nsChannelBSC *This = nsChannelBSC_from_BSCallback(bsc);
1292
1293     if(This->nschannel) {
1294         if(This->nschannel->binding == This)
1295             This->nschannel->binding = NULL;
1296         nsIHttpChannel_Release(&This->nschannel->nsIHttpChannel_iface);
1297     }
1298     if(This->nslistener)
1299         nsIStreamListener_Release(This->nslistener);
1300     if(This->nscontext)
1301         nsISupports_Release(This->nscontext);
1302     if(This->nsstream)
1303         nsIInputStream_Release(&This->nsstream->nsIInputStream_iface);
1304     heap_free(This);
1305 }
1306
1307 static HRESULT nsChannelBSC_start_binding(BSCallback *bsc)
1308 {
1309     nsChannelBSC *This = nsChannelBSC_from_BSCallback(bsc);
1310
1311     if(This->is_doc_channel)
1312         This->bsc.window->base.outer_window->base.inner_window->doc->skip_mutation_notif = FALSE;
1313
1314     return S_OK;
1315 }
1316
1317 static HRESULT nsChannelBSC_init_bindinfo(BSCallback *bsc)
1318 {
1319     nsChannelBSC *This = nsChannelBSC_from_BSCallback(bsc);
1320     nsChannel *nschannel = This->nschannel;
1321     GeckoBrowser *browser;
1322     HRESULT hres;
1323
1324     if(This->is_doc_channel && This->bsc.window && This->bsc.window->base.outer_window
1325        && (browser = This->bsc.window->base.outer_window->browser)) {
1326         if(browser->doc->hostinfo.dwFlags & DOCHOSTUIFLAG_ENABLE_REDIRECT_NOTIFICATION)
1327             This->bsc.bindinfo_options |= BINDINFO_OPTIONS_DISABLEAUTOREDIRECTS;
1328     }
1329
1330     if(nschannel && nschannel->post_data_stream) {
1331         hres = read_post_data_stream(nschannel->post_data_stream, nschannel->post_data_contains_headers,
1332                 &nschannel->request_headers, &This->bsc.request_data);
1333         if(FAILED(hres))
1334             return hres;
1335     }
1336
1337     return S_OK;
1338 }
1339
1340 typedef struct {
1341     task_t header;
1342     nsChannelBSC *bsc;
1343 } stop_request_task_t;
1344
1345 static void stop_request_proc(task_t *_task)
1346 {
1347     stop_request_task_t *task = (stop_request_task_t*)_task;
1348
1349     TRACE("(%p)\n", task->bsc);
1350
1351     list_remove(&task->bsc->bsc.entry);
1352     list_init(&task->bsc->bsc.entry);
1353     on_stop_nsrequest(task->bsc, S_OK);
1354 }
1355
1356 static void stop_request_task_destr(task_t *_task)
1357 {
1358     stop_request_task_t *task = (stop_request_task_t*)_task;
1359
1360     IBindStatusCallback_Release(&task->bsc->bsc.IBindStatusCallback_iface);
1361     heap_free(task);
1362 }
1363
1364 static HRESULT async_stop_request(nsChannelBSC *This)
1365 {
1366     stop_request_task_t *task;
1367
1368     if(!This->bsc.read) {
1369         TRACE("No data read, calling OnStartRequest\n");
1370         on_start_nsrequest(This);
1371     }
1372
1373     task = heap_alloc(sizeof(*task));
1374     if(!task)
1375         return E_OUTOFMEMORY;
1376
1377     IBindStatusCallback_AddRef(&This->bsc.IBindStatusCallback_iface);
1378     task->bsc = This;
1379
1380     return push_task(&task->header, stop_request_proc, stop_request_task_destr, This->bsc.window->task_magic);
1381 }
1382
1383 static void handle_navigation_error(nsChannelBSC *This, DWORD result)
1384 {
1385     HTMLOuterWindow *outer_window;
1386     HTMLDocumentObj *doc;
1387     BOOL is_error_url;
1388     SAFEARRAY *sa;
1389     SAFEARRAYBOUND bound;
1390     VARIANT var, varOut;
1391     LONG ind;
1392     BSTR unk;
1393     HRESULT hres;
1394
1395     if(!This->is_doc_channel || !This->bsc.window || !This->bsc.window->base.outer_window
1396        || !This->bsc.window->base.outer_window->browser)
1397         return;
1398
1399     outer_window = This->bsc.window->base.outer_window;
1400     doc = outer_window->browser->doc;
1401     if(!doc->doc_object_service || !doc->client)
1402         return;
1403
1404     hres = IDocObjectService_IsErrorUrl(doc->doc_object_service,
1405             outer_window->url, &is_error_url);
1406     if(FAILED(hres) || is_error_url)
1407         return;
1408
1409     if(!doc->client_cmdtrg)
1410         return;
1411
1412     bound.lLbound = 0;
1413     bound.cElements = 8;
1414     sa = SafeArrayCreate(VT_VARIANT, 1, &bound);
1415     if(!sa)
1416         return;
1417
1418     ind = 0;
1419     V_VT(&var) = VT_I4;
1420     V_I4(&var) = result;
1421     SafeArrayPutElement(sa, &ind, &var);
1422
1423     ind = 1;
1424     V_VT(&var) = VT_BSTR;
1425     V_BSTR(&var) = outer_window->url;
1426     SafeArrayPutElement(sa, &ind, &var);
1427
1428     ind = 3;
1429     V_VT(&var) = VT_UNKNOWN;
1430     V_UNKNOWN(&var) = (IUnknown*)&outer_window->base.IHTMLWindow2_iface;
1431     SafeArrayPutElement(sa, &ind, &var);
1432
1433     /* FIXME: what are the following fields for? */
1434     ind = 2;
1435     V_VT(&var) = VT_UNKNOWN;
1436     V_UNKNOWN(&var) = NULL;
1437     SafeArrayPutElement(sa, &ind, &var);
1438
1439     ind = 4;
1440     V_VT(&var) = VT_BOOL;
1441     V_BOOL(&var) = FALSE;
1442     SafeArrayPutElement(sa, &ind, &var);
1443
1444     ind = 5;
1445     V_VT(&var) = VT_BOOL;
1446     V_BOOL(&var) = FALSE;
1447     SafeArrayPutElement(sa, &ind, &var);
1448
1449     ind = 6;
1450     V_VT(&var) = VT_BSTR;
1451     unk = SysAllocString(NULL);
1452     V_BSTR(&var) = unk;
1453     SafeArrayPutElement(sa, &ind, &var);
1454
1455     ind = 7;
1456     V_VT(&var) = VT_UNKNOWN;
1457     V_UNKNOWN(&var) = NULL;
1458     SafeArrayPutElement(sa, &ind, &var);
1459
1460     V_VT(&var) = VT_ARRAY;
1461     V_ARRAY(&var) = sa;
1462     V_VT(&varOut) = VT_BOOL;
1463     V_BOOL(&varOut) = VARIANT_TRUE;
1464     IOleCommandTarget_Exec(doc->client_cmdtrg, &CGID_DocHostCmdPriv, 1, 0, &var, FAILED(hres)?NULL:&varOut);
1465
1466     SysFreeString(unk);
1467     SafeArrayDestroy(sa);
1468 }
1469
1470 static HRESULT nsChannelBSC_stop_binding(BSCallback *bsc, HRESULT result)
1471 {
1472     nsChannelBSC *This = nsChannelBSC_from_BSCallback(bsc);
1473
1474     if(result != E_ABORT && This->is_doc_channel && This->bsc.window) {
1475         if(FAILED(result))
1476             handle_navigation_error(This, result);
1477         else if(This->nschannel) {
1478             result = async_stop_request(This);
1479             if(SUCCEEDED(result))
1480                 return S_OK;
1481         }
1482     }
1483
1484     on_stop_nsrequest(This, result);
1485     return S_OK;
1486 }
1487
1488 static HRESULT nsChannelBSC_read_data(BSCallback *bsc, IStream *stream)
1489 {
1490     nsChannelBSC *This = nsChannelBSC_from_BSCallback(bsc);
1491
1492     return read_stream_data(This, stream);
1493 }
1494
1495 static HRESULT handle_redirect(nsChannelBSC *This, const WCHAR *new_url)
1496 {
1497     nsRedirectCallback *callback;
1498     nsIChannelEventSink *sink;
1499     nsChannel *new_channel;
1500     IMoniker *mon;
1501     nsresult nsres;
1502     HRESULT hres;
1503
1504     TRACE("(%p)->(%s)\n", This, debugstr_w(new_url));
1505
1506     hres = CreateURLMoniker(NULL, new_url, &mon);
1507     if(FAILED(hres))
1508         return hres;
1509     IMoniker_Release(This->bsc.mon);
1510     This->bsc.mon = mon;
1511
1512     if(!This->nschannel || !This->nschannel->notif_callback)
1513         return S_OK;
1514
1515     nsres = nsIInterfaceRequestor_GetInterface(This->nschannel->notif_callback, &IID_nsIChannelEventSink, (void**)&sink);
1516     if(NS_FAILED(nsres))
1517         return S_OK;
1518
1519     hres = create_redirect_nschannel(new_url, This->nschannel, &new_channel);
1520     if(SUCCEEDED(hres)) {
1521         TRACE("%p %p->%p\n", This, This->nschannel, new_channel);
1522
1523         hres = create_redirect_callback(new_channel, This, &callback);
1524         nsIHttpChannel_Release(&new_channel->nsIHttpChannel_iface);
1525     }
1526
1527     if(SUCCEEDED(hres)) {
1528         nsres = nsIChannelEventSink_AsyncOnChannelRedirect(sink, (nsIChannel*)&This->nschannel->nsIHttpChannel_iface,
1529                 (nsIChannel*)&callback->nschannel->nsIHttpChannel_iface, REDIRECT_TEMPORARY, /* FIXME */
1530                 &callback->nsIAsyncVerifyRedirectCallback_iface);
1531
1532         if(NS_FAILED(nsres))
1533             FIXME("AsyncOnChannelRedirect failed: %08x\n", hres);
1534         else if(This->nschannel != callback->nschannel)
1535             FIXME("nschannel not updated\n");
1536
1537         nsIAsyncVerifyRedirectCallback_Release(&callback->nsIAsyncVerifyRedirectCallback_iface);
1538     }
1539
1540     nsIChannelEventSink_Release(sink);
1541     return hres;
1542 }
1543
1544 static BOOL is_supported_doc_mime(const WCHAR *mime)
1545 {
1546     char *nscat, *mimea;
1547     BOOL ret;
1548
1549     mimea = heap_strdupWtoA(mime);
1550     if(!mimea)
1551         return FALSE;
1552
1553     nscat = get_nscategory_entry("Gecko-Content-Viewers", mimea);
1554
1555     ret = nscat != NULL && !strcmp(nscat, "@mozilla.org/content/document-loader-factory;1");
1556
1557     heap_free(mimea);
1558     nsfree(nscat);
1559     return ret;
1560 }
1561
1562 static IUri *get_moniker_uri(IMoniker *mon)
1563 {
1564     IUriContainer *uri_container;
1565     IUri *ret = NULL;
1566     HRESULT hres;
1567
1568     hres = IMoniker_QueryInterface(mon, &IID_IUriContainer, (void**)&uri_container);
1569     if(SUCCEEDED(hres)) {
1570         hres = IUriContainer_GetIUri(uri_container, &ret);
1571         IUriContainer_Release(uri_container);
1572         if(FAILED(hres))
1573             return NULL;
1574     }else {
1575         FIXME("No IUriContainer\n");
1576     }
1577
1578     return ret;
1579 }
1580
1581 static void handle_extern_mime_navigation(nsChannelBSC *This)
1582 {
1583     IWebBrowserPriv2IE9 *webbrowser_priv;
1584     IOleCommandTarget *cmdtrg;
1585     HTMLDocumentObj *doc_obj;
1586     IBindCtx *bind_ctx;
1587     IUri *uri;
1588     VARIANT flags;
1589     HRESULT hres;
1590
1591     if(!This->bsc.window || !This->bsc.window->base.outer_window || !This->bsc.window->base.outer_window->browser)
1592         return;
1593
1594     doc_obj = This->bsc.window->base.outer_window->browser->doc;
1595
1596     hres = IOleClientSite_QueryInterface(doc_obj->client, &IID_IOleCommandTarget, (void**)&cmdtrg);
1597     if(SUCCEEDED(hres)) {
1598         IOleCommandTarget_Exec(cmdtrg, &CGID_ShellDocView, 62, 0, NULL, NULL);
1599         IOleCommandTarget_Release(cmdtrg);
1600     }
1601
1602     set_document_navigation(doc_obj, FALSE);
1603
1604     if(!doc_obj->webbrowser) {
1605         FIXME("unimplemented in non-webbrowser mode\n");
1606         return;
1607     }
1608
1609     uri = get_moniker_uri(This->bsc.mon);
1610     if(!uri)
1611         return;
1612
1613     hres = CreateBindCtx(0, &bind_ctx);
1614     if(FAILED(hres)) {
1615         IUri_Release(uri);
1616         return;
1617     }
1618
1619     V_VT(&flags) = VT_I4;
1620     V_I4(&flags) = navHyperlink;
1621
1622     hres = IUnknown_QueryInterface(doc_obj->webbrowser, &IID_IWebBrowserPriv2IE8, (void**)&webbrowser_priv);
1623     if(SUCCEEDED(hres)) {
1624         hres = IWebBrowserPriv2IE9_NavigateWithBindCtx2(webbrowser_priv, uri, &flags, NULL, NULL, NULL, bind_ctx, NULL, 0);
1625         IWebBrowserPriv2IE9_Release(webbrowser_priv);
1626     }else {
1627         IWebBrowserPriv *webbrowser_priv_old;
1628         VARIANT uriv;
1629
1630         hres = IUnknown_QueryInterface(doc_obj->webbrowser, &IID_IWebBrowserPriv, (void**)&webbrowser_priv_old);
1631         if(SUCCEEDED(hres)) {
1632             V_VT(&uriv) = VT_BSTR;
1633             IUri_GetDisplayUri(uri, &V_BSTR(&uriv));
1634
1635             hres = IWebBrowserPriv_NavigateWithBindCtx(webbrowser_priv_old, &uriv, &flags, NULL, NULL, NULL, bind_ctx, NULL);
1636
1637             SysFreeString(V_BSTR(&uriv));
1638             IWebBrowserPriv_Release(webbrowser_priv_old);
1639         }
1640     }
1641
1642     IUri_Release(uri);
1643 }
1644
1645 static HRESULT nsChannelBSC_on_progress(BSCallback *bsc, ULONG status_code, LPCWSTR status_text)
1646 {
1647     nsChannelBSC *This = nsChannelBSC_from_BSCallback(bsc);
1648
1649     switch(status_code) {
1650     case BINDSTATUS_MIMETYPEAVAILABLE:
1651         if(This->is_doc_channel && !is_supported_doc_mime(status_text)) {
1652             FIXME("External MIME: %s\n", debugstr_w(status_text));
1653
1654             handle_extern_mime_navigation(This);
1655
1656             This->nschannel = NULL;
1657         }
1658
1659         if(!This->nschannel)
1660             return S_OK;
1661
1662         heap_free(This->nschannel->content_type);
1663         This->nschannel->content_type = heap_strdupWtoA(status_text);
1664         break;
1665     case BINDSTATUS_REDIRECTING:
1666         return handle_redirect(This, status_text);
1667     case BINDSTATUS_BEGINDOWNLOADDATA: {
1668         IWinInetHttpInfo *http_info;
1669         DWORD status, size = sizeof(DWORD);
1670         HRESULT hres;
1671
1672         if(!This->bsc.binding)
1673             break;
1674
1675         hres = IBinding_QueryInterface(This->bsc.binding, &IID_IWinInetHttpInfo, (void**)&http_info);
1676         if(FAILED(hres))
1677             break;
1678
1679         hres = IWinInetHttpInfo_QueryInfo(http_info,
1680                 HTTP_QUERY_STATUS_CODE|HTTP_QUERY_FLAG_NUMBER, &status, &size, NULL, NULL);
1681         IWinInetHttpInfo_Release(http_info);
1682         if(FAILED(hres) || status == HTTP_STATUS_OK)
1683             break;
1684
1685         handle_navigation_error(This, status);
1686     }
1687     }
1688
1689     return S_OK;
1690 }
1691
1692 static HRESULT process_response_status_text(const WCHAR *header, const WCHAR *header_end, char **status_text)
1693 {
1694     header = wcschr(header + 1, ' ');
1695     if(!header || header >= header_end)
1696         return E_FAIL;
1697     header = wcschr(header + 1, ' ');
1698     if(!header || header >= header_end)
1699         return E_FAIL;
1700     ++header;
1701
1702     *status_text = heap_strndupWtoU(header, header_end - header);
1703
1704     if(!*status_text)
1705         return E_OUTOFMEMORY;
1706
1707     return S_OK;
1708 }
1709
1710 static HRESULT nsChannelBSC_on_response(BSCallback *bsc, DWORD response_code,
1711         LPCWSTR response_headers)
1712 {
1713     nsChannelBSC *This = nsChannelBSC_from_BSCallback(bsc);
1714     char *str;
1715     HRESULT hres;
1716
1717     This->response_processed = TRUE;
1718     This->nschannel->response_status = response_code;
1719
1720     if(response_headers) {
1721         const WCHAR *headers;
1722
1723         headers = wcschr(response_headers, '\r');
1724         hres = process_response_status_text(response_headers, headers, &str);
1725         if(FAILED(hres)) {
1726             WARN("parsing headers failed: %08x\n", hres);
1727             return hres;
1728         }
1729
1730         heap_free(This->nschannel->response_status_text);
1731         This->nschannel->response_status_text = str;
1732
1733         if(headers && headers[1] == '\n') {
1734             headers += 2;
1735             hres = process_response_headers(This, headers);
1736             if(FAILED(hres)) {
1737                 WARN("parsing headers failed: %08x\n", hres);
1738                 return hres;
1739             }
1740         }
1741     }
1742
1743     return S_OK;
1744 }
1745
1746 static HRESULT nsChannelBSC_beginning_transaction(BSCallback *bsc, WCHAR **additional_headers)
1747 {
1748     nsChannelBSC *This = nsChannelBSC_from_BSCallback(bsc);
1749     http_header_t *iter;
1750     DWORD len = 0;
1751     WCHAR *ptr;
1752
1753     static const WCHAR content_lengthW[] =
1754         {'C','o','n','t','e','n','t','-','L','e','n','g','t','h',0};
1755
1756     if(!This->nschannel)
1757         return S_FALSE;
1758
1759     LIST_FOR_EACH_ENTRY(iter, &This->nschannel->request_headers, http_header_t, entry) {
1760         if(wcscmp(iter->header, content_lengthW))
1761             len += lstrlenW(iter->header) + 2 /* ": " */ + lstrlenW(iter->data) + 2 /* "\r\n" */;
1762     }
1763
1764     if(!len)
1765         return S_OK;
1766
1767     *additional_headers = ptr = CoTaskMemAlloc((len+1)*sizeof(WCHAR));
1768     if(!ptr)
1769         return E_OUTOFMEMORY;
1770
1771     LIST_FOR_EACH_ENTRY(iter, &This->nschannel->request_headers, http_header_t, entry) {
1772         if(!wcscmp(iter->header, content_lengthW))
1773             continue;
1774
1775         len = lstrlenW(iter->header);
1776         memcpy(ptr, iter->header, len*sizeof(WCHAR));
1777         ptr += len;
1778
1779         *ptr++ = ':';
1780         *ptr++ = ' ';
1781
1782         len = lstrlenW(iter->data);
1783         memcpy(ptr, iter->data, len*sizeof(WCHAR));
1784         ptr += len;
1785
1786         *ptr++ = '\r';
1787         *ptr++ = '\n';
1788     }
1789
1790     *ptr = 0;
1791
1792     return S_OK;
1793 }
1794
1795 static const BSCallbackVtbl nsChannelBSCVtbl = {
1796     nsChannelBSC_destroy,
1797     nsChannelBSC_init_bindinfo,
1798     nsChannelBSC_start_binding,
1799     nsChannelBSC_stop_binding,
1800     nsChannelBSC_read_data,
1801     nsChannelBSC_on_progress,
1802     nsChannelBSC_on_response,
1803     nsChannelBSC_beginning_transaction
1804 };
1805
1806 HRESULT create_channelbsc(IMoniker *mon, const WCHAR *headers, BYTE *post_data, DWORD post_data_size,
1807         BOOL is_doc_binding, nsChannelBSC **retval)
1808 {
1809     nsChannelBSC *ret;
1810     DWORD bindf;
1811
1812     ret = heap_alloc_zero(sizeof(*ret));
1813     if(!ret)
1814         return E_OUTOFMEMORY;
1815
1816     bindf = BINDF_ASYNCHRONOUS | BINDF_ASYNCSTORAGE | BINDF_PULLDATA;
1817     if(post_data_size)
1818         bindf |= BINDF_FORMS_SUBMIT | BINDF_PRAGMA_NO_CACHE | BINDF_HYPERLINK | BINDF_GETNEWESTVERSION;
1819
1820     init_bscallback(&ret->bsc, &nsChannelBSCVtbl, mon, bindf);
1821     ret->is_doc_channel = is_doc_binding;
1822
1823     if(headers) {
1824         ret->bsc.request_data.headers = heap_strdupW(headers);
1825         if(!ret->bsc.request_data.headers) {
1826             IBindStatusCallback_Release(&ret->bsc.IBindStatusCallback_iface);
1827             return E_OUTOFMEMORY;
1828         }
1829     }
1830
1831     if(post_data) {
1832         ret->bsc.request_data.post_data = GlobalAlloc(0, post_data_size+1);
1833         if(!ret->bsc.request_data.post_data) {
1834             release_request_data(&ret->bsc.request_data);
1835             IBindStatusCallback_Release(&ret->bsc.IBindStatusCallback_iface);
1836             return E_OUTOFMEMORY;
1837         }
1838
1839         memcpy(ret->bsc.request_data.post_data, post_data, post_data_size);
1840         ((BYTE*)ret->bsc.request_data.post_data)[post_data_size] = 0;
1841         ret->bsc.request_data.post_data_len = post_data_size;
1842     }
1843
1844     TRACE("created %p\n", ret);
1845     *retval = ret;
1846     return S_OK;
1847 }
1848
1849 typedef struct {
1850     task_t header;
1851     HTMLOuterWindow *window;
1852     HTMLInnerWindow *pending_window;
1853 } start_doc_binding_task_t;
1854
1855 static void start_doc_binding_proc(task_t *_task)
1856 {
1857     start_doc_binding_task_t *task = (start_doc_binding_task_t*)_task;
1858
1859     set_current_mon(task->window, task->pending_window->bscallback->bsc.mon, BINDING_NAVIGATED);
1860     start_binding(task->pending_window, &task->pending_window->bscallback->bsc, NULL);
1861 }
1862
1863 static void start_doc_binding_task_destr(task_t *_task)
1864 {
1865     start_doc_binding_task_t *task = (start_doc_binding_task_t*)_task;
1866
1867     IHTMLWindow2_Release(&task->pending_window->base.IHTMLWindow2_iface);
1868     heap_free(task);
1869 }
1870
1871 HRESULT async_start_doc_binding(HTMLOuterWindow *window, HTMLInnerWindow *pending_window)
1872 {
1873     start_doc_binding_task_t *task;
1874
1875     TRACE("%p\n", pending_window);
1876
1877     task = heap_alloc(sizeof(start_doc_binding_task_t));
1878     if(!task)
1879         return E_OUTOFMEMORY;
1880
1881     task->window = window;
1882     task->pending_window = pending_window;
1883     IHTMLWindow2_AddRef(&pending_window->base.IHTMLWindow2_iface);
1884
1885     return push_task(&task->header, start_doc_binding_proc, start_doc_binding_task_destr, pending_window->task_magic);
1886 }
1887
1888 void abort_window_bindings(HTMLInnerWindow *window)
1889 {
1890     BSCallback *iter;
1891
1892     remove_target_tasks(window->task_magic);
1893
1894     while(!list_empty(&window->bindings)) {
1895         iter = LIST_ENTRY(window->bindings.next, BSCallback, entry);
1896
1897         TRACE("Aborting %p\n", iter);
1898
1899         IBindStatusCallback_AddRef(&iter->IBindStatusCallback_iface);
1900
1901         if(iter->binding)
1902             IBinding_Abort(iter->binding);
1903         else
1904             iter->vtbl->stop_binding(iter, E_ABORT);
1905
1906         iter->window = NULL;
1907         list_remove(&iter->entry);
1908         list_init(&iter->entry);
1909
1910         IBindStatusCallback_Release(&iter->IBindStatusCallback_iface);
1911     }
1912
1913     if(window->bscallback) {
1914         IBindStatusCallback_Release(&window->bscallback->bsc.IBindStatusCallback_iface);
1915         window->bscallback = NULL;
1916     }
1917
1918     if(window->mon) {
1919         IMoniker_Release(window->mon);
1920         window->mon = NULL;
1921     }
1922 }
1923
1924 HRESULT channelbsc_load_stream(HTMLInnerWindow *pending_window, IMoniker *mon, IStream *stream)
1925 {
1926     nsChannelBSC *bscallback = pending_window->bscallback;
1927     HRESULT hres = S_OK;
1928
1929     if(!bscallback->nschannel) {
1930         ERR("NULL nschannel\n");
1931         return E_FAIL;
1932     }
1933
1934     bscallback->nschannel->content_type = heap_strdupA("text/html");
1935     if(!bscallback->nschannel->content_type)
1936         return E_OUTOFMEMORY;
1937
1938     set_current_mon(pending_window->base.outer_window, mon, 0);
1939
1940     bscallback->bsc.window = pending_window;
1941     if(stream)
1942         hres = read_stream_data(bscallback, stream);
1943     if(SUCCEEDED(hres))
1944         hres = async_stop_request(bscallback);
1945     if(FAILED(hres))
1946         IBindStatusCallback_OnStopBinding(&bscallback->bsc.IBindStatusCallback_iface, hres, NULL);
1947
1948     return hres;
1949 }
1950
1951 void channelbsc_set_channel(nsChannelBSC *This, nsChannel *channel, nsIStreamListener *listener, nsISupports *context)
1952 {
1953     nsIHttpChannel_AddRef(&channel->nsIHttpChannel_iface);
1954     This->nschannel = channel;
1955
1956     nsIStreamListener_AddRef(listener);
1957     This->nslistener = listener;
1958
1959     if(context) {
1960         nsISupports_AddRef(context);
1961         This->nscontext = context;
1962     }
1963
1964     if(This->bsc.request_data.headers) {
1965         HRESULT hres;
1966
1967         hres = parse_headers(This->bsc.request_data.headers, &channel->request_headers);
1968         heap_free(This->bsc.request_data.headers);
1969         This->bsc.request_data.headers = NULL;
1970         if(FAILED(hres))
1971             WARN("parse_headers failed: %08x\n", hres);
1972     }
1973 }
1974
1975 typedef struct {
1976     task_t header;
1977     HTMLOuterWindow *window;
1978     IUri *uri;
1979 } navigate_javascript_task_t;
1980
1981 static void navigate_javascript_proc(task_t *_task)
1982 {
1983     navigate_javascript_task_t *task = (navigate_javascript_task_t*)_task;
1984     HTMLOuterWindow *window = task->window;
1985     VARIANT v;
1986     BSTR code;
1987     HRESULT hres;
1988
1989     static const WCHAR jscriptW[] = {'j','s','c','r','i','p','t',0};
1990
1991     task->window->readystate = READYSTATE_COMPLETE;
1992
1993     hres = IUri_GetPath(task->uri, &code);
1994     if(FAILED(hres))
1995         return;
1996
1997     hres = UrlUnescapeW(code, NULL, NULL, URL_UNESCAPE_INPLACE);
1998     if(FAILED(hres)) {
1999         SysFreeString(code);
2000         return;
2001     }
2002
2003     set_download_state(window->browser->doc, 1);
2004
2005     V_VT(&v) = VT_EMPTY;
2006     hres = exec_script(window->base.inner_window, code, jscriptW, &v);
2007     SysFreeString(code);
2008     if(SUCCEEDED(hres) && V_VT(&v) != VT_EMPTY) {
2009         FIXME("javascirpt URL returned %s\n", debugstr_variant(&v));
2010         VariantClear(&v);
2011     }
2012
2013     if(window->browser->doc->view_sink)
2014         IAdviseSink_OnViewChange(window->browser->doc->view_sink, DVASPECT_CONTENT, -1);
2015
2016     set_download_state(window->browser->doc, 0);
2017 }
2018
2019 static void navigate_javascript_task_destr(task_t *_task)
2020 {
2021     navigate_javascript_task_t *task = (navigate_javascript_task_t*)_task;
2022
2023     IUri_Release(task->uri);
2024     heap_free(task);
2025 }
2026
2027 typedef struct {
2028     task_t header;
2029     HTMLOuterWindow *window;
2030     nsChannelBSC *bscallback;
2031     DWORD flags;
2032     IMoniker *mon;
2033     IUri *uri;
2034 } navigate_task_t;
2035
2036 static void navigate_proc(task_t *_task)
2037 {
2038     navigate_task_t *task = (navigate_task_t*)_task;
2039     HRESULT hres;
2040
2041     hres = set_moniker(task->window, task->mon, task->uri, NULL, task->bscallback, TRUE);
2042     if(SUCCEEDED(hres)) {
2043         set_current_mon(task->window, task->bscallback->bsc.mon, task->flags);
2044         set_current_uri(task->window, task->uri);
2045         start_binding(task->window->pending_window, &task->bscallback->bsc, NULL);
2046     }
2047 }
2048
2049 static void navigate_task_destr(task_t *_task)
2050 {
2051     navigate_task_t *task = (navigate_task_t*)_task;
2052
2053     IBindStatusCallback_Release(&task->bscallback->bsc.IBindStatusCallback_iface);
2054     IMoniker_Release(task->mon);
2055     IUri_Release(task->uri);
2056     heap_free(task);
2057 }
2058
2059 static HRESULT navigate_fragment(HTMLOuterWindow *window, IUri *uri)
2060 {
2061     nsIDOMLocation *nslocation;
2062     nsAString nsfrag_str;
2063     WCHAR *selector;
2064     BSTR frag;
2065     nsresult nsres;
2066     HRESULT hres;
2067
2068     static const WCHAR selector_formatW[] = {'a','[','i','d','=','"','%','s','"',']',0};
2069
2070     set_current_uri(window, uri);
2071
2072     nsres = nsIDOMWindow_GetLocation(window->nswindow, &nslocation);
2073     if(FAILED(nsres) || !nslocation)
2074         return E_FAIL;
2075
2076     hres = IUri_GetFragment(uri, &frag);
2077     if(FAILED(hres)) {
2078         nsIDOMLocation_Release(nslocation);
2079         return hres;
2080     }
2081
2082     nsAString_InitDepend(&nsfrag_str, frag);
2083     nsres = nsIDOMLocation_SetHash(nslocation, &nsfrag_str);
2084     nsAString_Finish(&nsfrag_str);
2085     nsIDOMLocation_Release(nslocation);
2086     if(NS_FAILED(nsres))
2087         ERR("SetHash failed: %08x\n", nsres);
2088
2089     /*
2090      * IE supports scrolling to anchor elements with "#hash" ids (note that '#' is part of the id),
2091      * while Gecko scrolls only to elements with "hash" ids. We scroll the page ourselves if
2092      * a[id="#hash"] element can be found.
2093      */
2094     selector = heap_alloc(sizeof(selector_formatW)+SysStringLen(frag)*sizeof(WCHAR));
2095     if(selector) {
2096         nsIDOMElement *nselem = NULL;
2097         nsAString selector_str;
2098
2099         swprintf(selector, ARRAY_SIZE(selector_formatW)+SysStringLen(frag), selector_formatW, frag);
2100         nsAString_InitDepend(&selector_str, selector);
2101         /* NOTE: Gecko doesn't set result to NULL if there is no match, so nselem must be initialized */
2102         nsres = nsIDOMHTMLDocument_QuerySelector(window->base.inner_window->doc->nsdoc, &selector_str, &nselem);
2103         nsAString_Finish(&selector_str);
2104         heap_free(selector);
2105         if(NS_SUCCEEDED(nsres) && nselem) {
2106             nsIDOMHTMLElement *html_elem;
2107
2108             nsres = nsIDOMElement_QueryInterface(nselem, &IID_nsIDOMHTMLElement, (void**)&html_elem);
2109             nsIDOMElement_Release(nselem);
2110             if(NS_SUCCEEDED(nsres)) {
2111                 nsIDOMHTMLElement_ScrollIntoView(html_elem, TRUE, 1);
2112                 nsIDOMHTMLElement_Release(html_elem);
2113             }
2114         }
2115     }
2116
2117     SysFreeString(frag);
2118
2119     if(window->browser->doc->doc_object_service) {
2120         IDocObjectService_FireNavigateComplete2(window->browser->doc->doc_object_service, &window->base.IHTMLWindow2_iface, 0x10);
2121         IDocObjectService_FireDocumentComplete(window->browser->doc->doc_object_service, &window->base.IHTMLWindow2_iface, 0);
2122
2123     }
2124
2125     return S_OK;
2126 }
2127
2128 HRESULT super_navigate(HTMLOuterWindow *window, IUri *uri, DWORD flags, const WCHAR *headers, BYTE *post_data, DWORD post_data_size)
2129 {
2130     nsChannelBSC *bsc;
2131     IUri *uri_nofrag;
2132     IMoniker *mon;
2133     DWORD scheme;
2134     HRESULT hres;
2135
2136     uri_nofrag = get_uri_nofrag(uri);
2137     if(!uri_nofrag)
2138         return E_FAIL;
2139
2140     if(window->browser->doc->client && !(flags & BINDING_REFRESH)) {
2141         IOleCommandTarget *cmdtrg;
2142
2143         hres = IOleClientSite_QueryInterface(window->browser->doc->client, &IID_IOleCommandTarget, (void**)&cmdtrg);
2144         if(SUCCEEDED(hres)) {
2145             VARIANT in, out;
2146             BSTR url_str;
2147
2148             hres = IUri_GetDisplayUri(uri_nofrag, &url_str);
2149             if(SUCCEEDED(hres)) {
2150                 V_VT(&in) = VT_BSTR;
2151                 V_BSTR(&in) = url_str;
2152                 V_VT(&out) = VT_BOOL;
2153                 V_BOOL(&out) = VARIANT_TRUE;
2154                 hres = IOleCommandTarget_Exec(cmdtrg, &CGID_ShellDocView, 67, 0, &in, &out);
2155                 IOleCommandTarget_Release(cmdtrg);
2156                 if(SUCCEEDED(hres))
2157                     VariantClear(&out);
2158                 SysFreeString(url_str);
2159             }
2160         }
2161     }
2162
2163     if(!(flags & BINDING_NOFRAG) && window->uri_nofrag && !post_data_size) {
2164         BOOL eq;
2165
2166         hres = IUri_IsEqual(uri_nofrag, window->uri_nofrag, &eq);
2167         if(SUCCEEDED(hres) && eq) {
2168             IUri_Release(uri_nofrag);
2169             TRACE("fragment navigate\n");
2170             return navigate_fragment(window, uri);
2171         }
2172     }
2173
2174     hres = CreateURLMonikerEx2(NULL, uri_nofrag, &mon, URL_MK_UNIFORM);
2175     IUri_Release(uri_nofrag);
2176     if(FAILED(hres))
2177         return hres;
2178
2179     /* FIXME: Why not set_ready_state? */
2180     window->readystate = READYSTATE_UNINITIALIZED;
2181
2182     hres = create_channelbsc(mon, headers, post_data, post_data_size, TRUE, &bsc);
2183     if(FAILED(hres)) {
2184         IMoniker_Release(mon);
2185         return hres;
2186     }
2187
2188     prepare_for_binding(&window->browser->doc->basedoc, mon, flags);
2189
2190     hres = IUri_GetScheme(uri, &scheme);
2191     if(SUCCEEDED(hres) && scheme == URL_SCHEME_JAVASCRIPT) {
2192         navigate_javascript_task_t *task;
2193
2194         IBindStatusCallback_Release(&bsc->bsc.IBindStatusCallback_iface);
2195         IMoniker_Release(mon);
2196
2197         task = heap_alloc(sizeof(*task));
2198         if(!task)
2199             return E_OUTOFMEMORY;
2200
2201         /* Why silently? */
2202         window->readystate = READYSTATE_COMPLETE;
2203         if(!(flags & BINDING_FROMHIST))
2204             call_docview_84(window->browser->doc);
2205
2206         IUri_AddRef(uri);
2207         task->window = window;
2208         task->uri = uri;
2209         hres = push_task(&task->header, navigate_javascript_proc, navigate_javascript_task_destr, window->task_magic);
2210     }else if(flags & BINDING_SUBMIT) {
2211         hres = set_moniker(window, mon, uri, NULL, bsc, TRUE);
2212         if(SUCCEEDED(hres))
2213             hres = start_binding(window->pending_window, &bsc->bsc, NULL);
2214         IBindStatusCallback_Release(&bsc->bsc.IBindStatusCallback_iface);
2215         IMoniker_Release(mon);
2216     }else {
2217         navigate_task_t *task;
2218
2219         task = heap_alloc(sizeof(*task));
2220         if(!task) {
2221             IBindStatusCallback_Release(&bsc->bsc.IBindStatusCallback_iface);
2222             IMoniker_Release(mon);
2223             return E_OUTOFMEMORY;
2224         }
2225
2226         /* Silently and repeated when real loading starts? */
2227         window->readystate = READYSTATE_LOADING;
2228         if(!(flags & (BINDING_FROMHIST|BINDING_REFRESH)))
2229             call_docview_84(window->browser->doc);
2230
2231         task->window = window;
2232         task->bscallback = bsc;
2233         task->flags = flags;
2234         task->mon = mon;
2235
2236         IUri_AddRef(uri);
2237         task->uri = uri;
2238         hres = push_task(&task->header, navigate_proc, navigate_task_destr, window->task_magic);
2239     }
2240
2241     return hres;
2242 }
2243
2244 HRESULT navigate_new_window(HTMLOuterWindow *window, IUri *uri, const WCHAR *name, request_data_t *request_data, IHTMLWindow2 **ret)
2245 {
2246     INewWindowManager *new_window_mgr;
2247     BSTR display_uri, context_url;
2248     IWebBrowser2 *web_browser;
2249     IHTMLWindow2 *new_window;
2250     IBindCtx *bind_ctx;
2251     nsChannelBSC *bsc;
2252     HRESULT hres;
2253
2254     if(!window->browser)
2255         return E_UNEXPECTED;
2256
2257     if (window->browser->doc->client) {
2258         hres = do_query_service((IUnknown*)window->browser->doc->client, &SID_SNewWindowManager,
2259                                 &IID_INewWindowManager, (void**)&new_window_mgr);
2260         if (FAILED(hres)) {
2261             FIXME("No INewWindowManager\n");
2262             return hres;
2263         }
2264
2265         hres = IUri_GetDisplayUri(window->uri_nofrag, &context_url);
2266         if(FAILED(hres))
2267             return hres;
2268
2269         hres = IUri_GetDisplayUri(uri, &display_uri);
2270         if(FAILED(hres)) {
2271             SysFreeString(context_url);
2272             return hres;
2273         }
2274
2275         hres = INewWindowManager_EvaluateNewWindow(new_window_mgr, display_uri, name, context_url,
2276                 NULL, FALSE, window->browser->doc->has_popup ? 0 : NWMF_FIRST, 0);
2277         window->browser->doc->has_popup = TRUE;
2278         SysFreeString(display_uri);
2279         SysFreeString(context_url);
2280         INewWindowManager_Release(new_window_mgr);
2281         if(FAILED(hres)) {
2282             if(ret)
2283                 *ret = NULL;
2284             return S_OK;
2285         }
2286     }
2287
2288
2289     if(request_data)
2290         hres = create_channelbsc(NULL, request_data->headers,
2291                 request_data->post_data, request_data->post_data_len, FALSE,
2292                 &bsc);
2293     else
2294         hres = create_channelbsc(NULL, NULL, NULL, 0, FALSE, &bsc);
2295     if(FAILED(hres))
2296         return hres;
2297
2298     hres = CreateAsyncBindCtx(0, &bsc->bsc.IBindStatusCallback_iface, NULL, &bind_ctx);
2299     if(FAILED(hres)) {
2300         IBindStatusCallback_Release(&bsc->bsc.IBindStatusCallback_iface);
2301         return hres;
2302     }
2303
2304     hres = CoCreateInstance(&CLSID_InternetExplorer, NULL, CLSCTX_LOCAL_SERVER,
2305             &IID_IWebBrowser2, (void**)&web_browser);
2306     if(SUCCEEDED(hres)) {
2307         ITargetFramePriv2 *target_frame_priv;
2308
2309         hres = IWebBrowser2_QueryInterface(web_browser, &IID_ITargetFramePriv2, (void**)&target_frame_priv);
2310         if(SUCCEEDED(hres)) {
2311             hres = ITargetFramePriv2_AggregatedNavigation2(target_frame_priv,
2312                     HLNF_DISABLEWINDOWRESTRICTIONS|HLNF_OPENINNEWWINDOW, bind_ctx, &bsc->bsc.IBindStatusCallback_iface,
2313                     name, uri, emptyW);
2314             ITargetFramePriv2_Release(target_frame_priv);
2315
2316             if(SUCCEEDED(hres))
2317                 hres = do_query_service((IUnknown*)web_browser, &SID_SHTMLWindow, &IID_IHTMLWindow2, (void**)&new_window);
2318         }
2319         if(FAILED(hres)) {
2320             IWebBrowser2_Quit(web_browser);
2321             IWebBrowser2_Release(web_browser);
2322         }
2323     }else {
2324         WARN("Could not create InternetExplorer instance: %08x\n", hres);
2325     }
2326
2327     IBindStatusCallback_Release(&bsc->bsc.IBindStatusCallback_iface);
2328     IBindCtx_Release(bind_ctx);
2329     if(FAILED(hres))
2330         return hres;
2331
2332     IWebBrowser2_put_Visible(web_browser, VARIANT_TRUE);
2333     IWebBrowser2_Release(web_browser);
2334
2335     if(ret)
2336         *ret = new_window;
2337     else
2338         IHTMLWindow2_Release(new_window);
2339     return S_OK;
2340 }
2341
2342 HRESULT hlink_frame_navigate(HTMLDocument *doc, LPCWSTR url, nsChannel *nschannel, DWORD hlnf, BOOL *cancel)
2343 {
2344     IHlinkFrame *hlink_frame;
2345     nsChannelBSC *callback;
2346     IBindCtx *bindctx;
2347     IMoniker *mon;
2348     IHlink *hlink;
2349     HRESULT hres;
2350
2351     *cancel = FALSE;
2352
2353     hres = do_query_service((IUnknown*)doc->doc_obj->client, &IID_IHlinkFrame, &IID_IHlinkFrame,
2354             (void**)&hlink_frame);
2355     if(FAILED(hres))
2356         return S_OK;
2357
2358     hres = create_channelbsc(NULL, NULL, NULL, 0, FALSE, &callback);
2359     if(FAILED(hres)) {
2360         IHlinkFrame_Release(hlink_frame);
2361         return hres;
2362     }
2363
2364     if(nschannel)
2365         read_post_data_stream(nschannel->post_data_stream, nschannel->post_data_contains_headers,
2366                 &nschannel->request_headers, &callback->bsc.request_data);
2367
2368     hres = CreateAsyncBindCtx(0, &callback->bsc.IBindStatusCallback_iface, NULL, &bindctx);
2369     if(SUCCEEDED(hres))
2370        hres = CoCreateInstance(&CLSID_StdHlink, NULL, CLSCTX_INPROC_SERVER,
2371                 &IID_IHlink, (LPVOID*)&hlink);
2372
2373     if(SUCCEEDED(hres))
2374         hres = CreateURLMoniker(NULL, url, &mon);
2375
2376     if(SUCCEEDED(hres)) {
2377         IHlink_SetMonikerReference(hlink, HLINKSETF_TARGET, mon, NULL);
2378
2379         if(hlnf & HLNF_OPENINNEWWINDOW) {
2380             static const WCHAR wszBlank[] = {'_','b','l','a','n','k',0};
2381             IHlink_SetTargetFrameName(hlink, wszBlank); /* FIXME */
2382         }
2383
2384         hres = IHlinkFrame_Navigate(hlink_frame, hlnf, bindctx,
2385                 &callback->bsc.IBindStatusCallback_iface, hlink);
2386         IMoniker_Release(mon);
2387         *cancel = hres == S_OK;
2388         hres = S_OK;
2389     }
2390
2391     IHlinkFrame_Release(hlink_frame);
2392     IBindCtx_Release(bindctx);
2393     IBindStatusCallback_Release(&callback->bsc.IBindStatusCallback_iface);
2394     return hres;
2395 }
2396
2397 static HRESULT navigate_uri(HTMLOuterWindow *window, IUri *uri, const WCHAR *display_uri, const request_data_t *request_data,
2398         DWORD flags)
2399 {
2400     nsWineURI *nsuri;
2401     HRESULT hres;
2402
2403     TRACE("%s\n", debugstr_w(display_uri));
2404
2405     if(!window->browser)
2406         return E_UNEXPECTED;
2407
2408     if(window->browser->doc->webbrowser) {
2409         DWORD post_data_len = request_data ? request_data->post_data_len : 0;
2410         void *post_data = post_data_len ? request_data->post_data : NULL;
2411         const WCHAR *headers = request_data ? request_data->headers : NULL;
2412
2413         if(!(flags & BINDING_REFRESH)) {
2414             BSTR frame_name = NULL;
2415             BOOL cancel = FALSE;
2416
2417             if(!is_main_content_window(window)) {
2418                 hres = IHTMLWindow2_get_name(&window->base.IHTMLWindow2_iface, &frame_name);
2419                 if(FAILED(hres))
2420                     return hres;
2421             }
2422
2423             hres = IDocObjectService_FireBeforeNavigate2(window->browser->doc->doc_object_service, NULL, display_uri, 0x40,
2424                     frame_name, post_data, post_data_len ? post_data_len+1 : 0, headers, TRUE, &cancel);
2425             SysFreeString(frame_name);
2426             if(SUCCEEDED(hres) && cancel) {
2427                 TRACE("Navigation canceled\n");
2428                 return S_OK;
2429             }
2430         }
2431
2432         if(is_main_content_window(window))
2433             return super_navigate(window, uri, flags, headers, post_data, post_data_len);
2434     }
2435
2436     if(is_main_content_window(window)) {
2437         BOOL cancel;
2438
2439         hres = hlink_frame_navigate(&window->base.inner_window->doc->basedoc, display_uri, NULL, 0, &cancel);
2440         if(FAILED(hres))
2441             return hres;
2442
2443         if(cancel) {
2444             TRACE("Navigation handled by hlink frame\n");
2445             return S_OK;
2446         }
2447     }
2448
2449     hres = create_doc_uri(uri, &nsuri);
2450     if(FAILED(hres))
2451         return hres;
2452
2453     hres = load_nsuri(window, nsuri, request_data ? request_data->post_stream : NULL, NULL, LOAD_FLAGS_NONE);
2454     nsISupports_Release((nsISupports*)nsuri);
2455     return hres;
2456 }
2457
2458 HRESULT load_uri(HTMLOuterWindow *window, IUri *uri, DWORD flags)
2459 {
2460     BSTR display_uri;
2461     HRESULT hres;
2462
2463     hres = IUri_GetDisplayUri(uri, &display_uri);
2464     if(FAILED(hres))
2465         return hres;
2466
2467     hres = navigate_uri(window, uri, display_uri, NULL, flags);
2468     SysFreeString(display_uri);
2469     return hres;
2470 }
2471
2472 static HRESULT translate_uri(HTMLOuterWindow *window, IUri *orig_uri, BSTR *ret_display_uri, IUri **ret_uri)
2473 {
2474     IUri *uri = NULL;
2475     BSTR display_uri;
2476     HRESULT hres;
2477
2478     hres = IUri_GetDisplayUri(orig_uri, &display_uri);
2479     if(FAILED(hres))
2480         return hres;
2481
2482     if(window->browser->doc->hostui) {
2483         OLECHAR *translated_url = NULL;
2484
2485         hres = IDocHostUIHandler_TranslateUrl(window->browser->doc->hostui, 0, display_uri,
2486                 &translated_url);
2487         if(hres == S_OK && translated_url) {
2488             TRACE("%08x %s -> %s\n", hres, debugstr_w(display_uri), debugstr_w(translated_url));
2489             SysFreeString(display_uri);
2490             hres = create_uri(translated_url, 0, &uri);
2491             CoTaskMemFree(translated_url);
2492             if(FAILED(hres))
2493                 return hres;
2494
2495             hres = IUri_GetDisplayUri(uri, &display_uri);
2496             if(FAILED(hres)) {
2497                 IUri_Release(uri);
2498                 return hres;
2499             }
2500         }
2501     }
2502
2503     if(!uri) {
2504         IUri_AddRef(orig_uri);
2505         uri = orig_uri;
2506     }
2507
2508     *ret_display_uri = display_uri;
2509     *ret_uri = uri;
2510     return S_OK;
2511 }
2512
2513 HRESULT submit_form(HTMLOuterWindow *window, const WCHAR *target, IUri *submit_uri, nsIInputStream *post_stream)
2514 {
2515     request_data_t request_data = {NULL};
2516     HRESULT hres;
2517
2518     hres = read_post_data_stream(post_stream, TRUE, NULL, &request_data);
2519     if(FAILED(hres))
2520         return hres;
2521
2522     if(window) {
2523         IUri *uri;
2524         BSTR display_uri;
2525
2526         window->readystate_locked++;
2527
2528         hres = translate_uri(window, submit_uri, &display_uri, &uri);
2529         if(SUCCEEDED(hres)) {
2530             hres = navigate_uri(window, uri, display_uri, &request_data, BINDING_NAVIGATED|BINDING_SUBMIT);
2531             IUri_Release(uri);
2532             SysFreeString(display_uri);
2533         }
2534
2535         window->readystate_locked--;
2536     }else
2537         hres = navigate_new_window(window, submit_uri, target, &request_data, NULL);
2538
2539     release_request_data(&request_data);
2540     return hres;
2541 }
2542
2543 HRESULT navigate_url(HTMLOuterWindow *window, const WCHAR *new_url, IUri *base_uri, DWORD flags)
2544 {
2545     IUri *uri, *nav_uri;
2546     BSTR display_uri;
2547     HRESULT hres;
2548
2549     if(new_url && base_uri)
2550         hres = CoInternetCombineUrlEx(base_uri, new_url, URL_ESCAPE_SPACES_ONLY|URL_DONT_ESCAPE_EXTRA_INFO,
2551                 &nav_uri, 0);
2552     else
2553         hres = create_uri(new_url, 0, &nav_uri);
2554     if(FAILED(hres))
2555         return hres;
2556
2557     hres = translate_uri(window, nav_uri, &display_uri, &uri);
2558     IUri_Release(nav_uri);
2559     if(FAILED(hres))
2560         return hres;
2561
2562     hres = navigate_uri(window, uri, display_uri, NULL, flags);
2563     IUri_Release(uri);
2564     SysFreeString(display_uri);
2565     return hres;
2566 }