Home | History | Annotate | Download | only in chrome_frame
      1 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
      2 // Use of this source code is governed by a BSD-style license that can be
      3 // found in the LICENSE file.
      4 
      5 // Implementation of ChromeActiveDocument
      6 #include "chrome_frame/chrome_active_document.h"
      7 
      8 #include <hlink.h>
      9 #include <htiface.h>
     10 #include <initguid.h>
     11 #include <mshtmcid.h>
     12 #include <shdeprecated.h>
     13 #include <shlguid.h>
     14 #include <shlobj.h>
     15 #include <shobjidl.h>
     16 #include <tlogstg.h>
     17 #include <urlmon.h>
     18 #include <wininet.h>
     19 
     20 #include "base/command_line.h"
     21 #include "base/debug/trace_event.h"
     22 #include "base/logging.h"
     23 #include "base/strings/string_util.h"
     24 #include "base/strings/utf_string_conversions.h"
     25 #include "base/win/scoped_variant.h"
     26 #include "chrome/app/chrome_command_ids.h"
     27 #include "chrome/app/chrome_dll_resource.h"
     28 #include "chrome/common/automation_messages.h"
     29 #include "chrome/common/chrome_constants.h"
     30 #include "chrome/test/automation/browser_proxy.h"
     31 #include "chrome/test/automation/tab_proxy.h"
     32 #include "chrome_frame/bho.h"
     33 #include "chrome_frame/bind_context_info.h"
     34 #include "chrome_frame/buggy_bho_handling.h"
     35 #include "chrome_frame/crash_reporting/crash_metrics.h"
     36 #include "chrome_frame/utils.h"
     37 #include "content/public/browser/invalidate_type.h"
     38 #include "content/public/browser/navigation_type.h"
     39 #include "content/public/browser/web_contents.h"
     40 #include "content/public/common/page_zoom.h"
     41 #include "grit/generated_resources.h"
     42 
     43 DEFINE_GUID(CGID_DocHostCmdPriv, 0x000214D4L, 0, 0, 0xC0, 0, 0, 0, 0, 0, 0,
     44             0x46);
     45 
     46 bool g_first_launch_by_process_ = true;
     47 
     48 const DWORD kIEEncodingIdArray[] = {
     49 #define DEFINE_ENCODING_ID_ARRAY(encoding_name, id, chrome_name) encoding_name,
     50   INTERNAL_IE_ENCODINGMENU_IDS(DEFINE_ENCODING_ID_ARRAY)
     51 #undef DEFINE_ENCODING_ID_ARRAY
     52   0  // The Last data must be 0 to indicate the end of the encoding id array.
     53 };
     54 
     55 ChromeActiveDocument::ChromeActiveDocument()
     56     : navigation_info_(new NavigationInfo()),
     57       first_navigation_(true),
     58       is_automation_client_reused_(false),
     59       popup_allowed_(false),
     60       accelerator_table_(NULL) {
     61   TRACE_EVENT_BEGIN_ETW("chromeframe.createactivedocument", this, "");
     62 
     63   url_fetcher_->set_frame_busting(false);
     64   memset(navigation_info_.get(), 0, sizeof(NavigationInfo));
     65 }
     66 
     67 HRESULT ChromeActiveDocument::FinalConstruct() {
     68   // The FinalConstruct implementation in the ChromeFrameActivexBase class
     69   // i.e. Base creates an instance of the ChromeFrameAutomationClient class
     70   // and initializes it, which would spawn a new Chrome process, etc.
     71   // We don't want to be doing this if we have a cached document, whose
     72   // automation client instance can be reused.
     73   HRESULT hr = BaseActiveX::FinalConstruct();
     74   if (FAILED(hr))
     75     return hr;
     76 
     77   InitializeAutomationSettings();
     78 
     79   find_dialog_.Init(automation_client_.get());
     80 
     81   OLECMDF flags = static_cast<OLECMDF>(OLECMDF_ENABLED | OLECMDF_SUPPORTED);
     82 
     83   null_group_commands_map_[OLECMDID_PRINT] = flags;
     84   null_group_commands_map_[OLECMDID_FIND] = flags;
     85   null_group_commands_map_[OLECMDID_CUT] = flags;
     86   null_group_commands_map_[OLECMDID_COPY] = flags;
     87   null_group_commands_map_[OLECMDID_PASTE] = flags;
     88   null_group_commands_map_[OLECMDID_SELECTALL] = flags;
     89   null_group_commands_map_[OLECMDID_SAVEAS] = flags;
     90 
     91   mshtml_group_commands_map_[IDM_BASELINEFONT1] = flags;
     92   mshtml_group_commands_map_[IDM_BASELINEFONT2] = flags;
     93   mshtml_group_commands_map_[IDM_BASELINEFONT3] = flags;
     94   mshtml_group_commands_map_[IDM_BASELINEFONT4] = flags;
     95   mshtml_group_commands_map_[IDM_BASELINEFONT5] = flags;
     96   mshtml_group_commands_map_[IDM_VIEWSOURCE] = flags;
     97 
     98   HMODULE this_module = reinterpret_cast<HMODULE>(&__ImageBase);
     99   accelerator_table_ =
    100     LoadAccelerators(this_module,
    101                      MAKEINTRESOURCE(IDR_CHROME_FRAME_IE_FULL_TAB));
    102   DCHECK(accelerator_table_ != NULL);
    103   return S_OK;
    104 }
    105 
    106 ChromeActiveDocument::~ChromeActiveDocument() {
    107   DVLOG(1) << __FUNCTION__;
    108   if (find_dialog_.IsWindow())
    109     find_dialog_.DestroyWindow();
    110   // ChromeFramePlugin
    111   BaseActiveX::Uninitialize();
    112 
    113   TRACE_EVENT_END_ETW("chromeframe.createactivedocument", this, "");
    114 }
    115 
    116 // Override DoVerb
    117 STDMETHODIMP ChromeActiveDocument::DoVerb(LONG verb,
    118                                           LPMSG msg,
    119                                           IOleClientSite* active_site,
    120                                           LONG index,
    121                                           HWND parent_window,
    122                                           LPCRECT pos) {
    123   // IE will try and in-place activate us in some cases. This happens when
    124   // the user opens a new IE window with a URL that has us as the DocObject.
    125   // Here we refuse to be activated in-place and we will force IE to UIActivate
    126   // us.
    127   if (OLEIVERB_INPLACEACTIVATE == verb)
    128     return OLEOBJ_E_INVALIDVERB;
    129   // Check if we should activate as a docobject or not
    130   // (client supports IOleDocumentSite)
    131   if (doc_site_) {
    132     switch (verb) {
    133     case OLEIVERB_SHOW: {
    134       base::win::ScopedComPtr<IDocHostUIHandler> doc_host_handler;
    135       doc_host_handler.QueryFrom(doc_site_);
    136       if (doc_host_handler.get())
    137         doc_host_handler->ShowUI(DOCHOSTUITYPE_BROWSE, this, this, NULL, NULL);
    138     }
    139     case OLEIVERB_OPEN:
    140     case OLEIVERB_UIACTIVATE:
    141       if (!m_bUIActive)
    142         return doc_site_->ActivateMe(NULL);
    143       break;
    144     }
    145   }
    146   return IOleObjectImpl<ChromeActiveDocument>::DoVerb(verb,
    147                                                       msg,
    148                                                       active_site,
    149                                                       index,
    150                                                       parent_window,
    151                                                       pos);
    152 }
    153 
    154 // Override IOleInPlaceActiveObjectImpl::OnDocWindowActivate
    155 STDMETHODIMP ChromeActiveDocument::OnDocWindowActivate(BOOL activate) {
    156   DVLOG(1) << __FUNCTION__;
    157   return S_OK;
    158 }
    159 
    160 STDMETHODIMP ChromeActiveDocument::TranslateAccelerator(MSG* msg) {
    161   DVLOG(1) << __FUNCTION__;
    162   if (msg == NULL)
    163     return E_POINTER;
    164 
    165   if (msg->message == WM_KEYDOWN && msg->wParam == VK_TAB) {
    166     HWND focus = ::GetFocus();
    167     if (focus != m_hWnd && !::IsChild(m_hWnd, focus)) {
    168       // The call to SetFocus triggers a WM_SETFOCUS that makes the base class
    169       // set focus to the correct element in Chrome.
    170       ::SetFocus(m_hWnd);
    171       return S_OK;
    172     }
    173   }
    174 
    175   return S_FALSE;
    176 }
    177 // Override IPersistStorageImpl::IsDirty
    178 STDMETHODIMP ChromeActiveDocument::IsDirty() {
    179   DVLOG(1) << __FUNCTION__;
    180   return S_FALSE;
    181 }
    182 
    183 void ChromeActiveDocument::OnAutomationServerReady() {
    184   BaseActiveX::OnAutomationServerReady();
    185   BaseActiveX::GiveFocusToChrome(true);
    186 }
    187 
    188 STDMETHODIMP ChromeActiveDocument::Load(BOOL fully_avalable,
    189                                         IMoniker* moniker_name,
    190                                         LPBC bind_context,
    191                                         DWORD mode) {
    192   if (NULL == moniker_name)
    193     return E_INVALIDARG;
    194 
    195   base::win::ScopedComPtr<IOleClientSite> client_site;
    196   if (bind_context) {
    197     base::win::ScopedComPtr<IUnknown> site;
    198     bind_context->GetObjectParam(SZ_HTML_CLIENTSITE_OBJECTPARAM,
    199                                  site.Receive());
    200     if (site)
    201       client_site.QueryFrom(site);
    202   }
    203 
    204   if (client_site) {
    205     SetClientSite(client_site);
    206     DoQueryService(IID_INewWindowManager, client_site,
    207                    popup_manager_.Receive());
    208 
    209     // See if mshtml parsed the html header for us.  If so, we need to
    210     // clear the browser service flag that we use to indicate that this
    211     // browser instance is navigating to a CF document.
    212     base::win::ScopedComPtr<IBrowserService> browser_service;
    213     DoQueryService(SID_SShellBrowser, client_site, browser_service.Receive());
    214     if (browser_service) {
    215       bool flagged = CheckForCFNavigation(browser_service, true);
    216       DVLOG_IF(1, flagged) << "Cleared flagged browser service";
    217     }
    218   }
    219 
    220   NavigationManager* mgr = NavigationManager::GetThreadInstance();
    221   DLOG_IF(ERROR, !mgr) << "Couldn't get instance of NavigationManager";
    222 
    223   std::wstring url;
    224 
    225   base::win::ScopedComPtr<BindContextInfo> info;
    226   BindContextInfo::FromBindContext(bind_context, info.Receive());
    227   DCHECK(info);
    228   if (info && !info->GetUrl().empty()) {
    229     url = info->GetUrl();
    230     if (mgr) {
    231       // If the original URL contains an anchor, then the URL queried
    232       // from the protocol sink wrapper does not contain the anchor. To
    233       // workaround this we retrieve the anchor from the navigation manager
    234       // and append it to the url retrieved from the protocol sink wrapper.
    235       GURL url_for_anchor(mgr->url());
    236       if (url_for_anchor.has_ref()) {
    237         url += L"#";
    238         url += UTF8ToWide(url_for_anchor.ref());
    239       }
    240     }
    241   } else {
    242     // If the original URL contains an anchor, then the URL queried
    243     // from the moniker does not contain the anchor. To workaround
    244     // this we retrieve the URL from our BHO.
    245     url = GetActualUrlFromMoniker(moniker_name, bind_context,
    246                                   mgr ? mgr->url(): std::wstring());
    247   }
    248 
    249   ChromeFrameUrl cf_url;
    250   if (!cf_url.Parse(url)) {
    251     DLOG(WARNING) << __FUNCTION__ << " Failed to parse url:" << url;
    252     return E_INVALIDARG;
    253   }
    254 
    255   std::string referrer(mgr ? mgr->referrer() : EmptyString());
    256   RendererType renderer_type = cf_url.is_chrome_protocol() ?
    257       RENDERER_TYPE_CHROME_GCF_PROTOCOL : RENDERER_TYPE_UNDETERMINED;
    258 
    259   // With CTransaction patch we have more robust way to grab the referrer for
    260   // each top-level-switch-to-CF request by peeking at our sniffing data
    261   // object that lives inside the bind context.  We also remember the reason
    262   // we're rendering the document in Chrome.
    263   if (g_patch_helper.state() == PatchHelper::PATCH_PROTOCOL && info) {
    264     scoped_refptr<ProtData> prot_data = info->get_prot_data();
    265     if (prot_data) {
    266       referrer = prot_data->referrer();
    267       renderer_type = prot_data->renderer_type();
    268     }
    269   }
    270 
    271   // For gcf: URLs allow only about and view-source schemes to pass through for
    272   // further inspection.
    273   bool is_safe_scheme = cf_url.gurl().SchemeIs(chrome::kAboutScheme) ||
    274       cf_url.gurl().SchemeIs(content::kViewSourceScheme);
    275   if (cf_url.is_chrome_protocol() && !is_safe_scheme &&
    276       !GetConfigBool(false, kAllowUnsafeURLs)) {
    277     DLOG(ERROR) << __FUNCTION__ << " gcf: not allowed:" << url;
    278     return E_INVALIDARG;
    279   }
    280 
    281   if (!LaunchUrl(cf_url, referrer)) {
    282     DLOG(ERROR) << __FUNCTION__ << " Failed to launch url:" << url;
    283     return E_INVALIDARG;
    284   }
    285 
    286   if (!cf_url.is_chrome_protocol() && !cf_url.attach_to_external_tab())
    287     url_fetcher_->SetInfoForUrl(url.c_str(), moniker_name, bind_context);
    288 
    289   // Log a metric indicating why GCF is rendering in Chrome.
    290   // (Note: we only track the renderer type when using the CTransaction patch.
    291   // When the code for the browser service patch and for the moniker patch is
    292   // removed, this conditional can also go away.)
    293   if (RENDERER_TYPE_UNDETERMINED != renderer_type) {
    294     UMA_LAUNCH_TYPE_COUNT(renderer_type);
    295   }
    296 
    297   return S_OK;
    298 }
    299 
    300 STDMETHODIMP ChromeActiveDocument::Save(IMoniker* moniker_name,
    301                                         LPBC bind_context,
    302                                         BOOL remember) {
    303   return E_NOTIMPL;
    304 }
    305 
    306 STDMETHODIMP ChromeActiveDocument::SaveCompleted(IMoniker* moniker_name,
    307                                                  LPBC bind_context) {
    308   return E_NOTIMPL;
    309 }
    310 
    311 STDMETHODIMP ChromeActiveDocument::GetCurMoniker(IMoniker** moniker_name) {
    312   return E_NOTIMPL;
    313 }
    314 
    315 STDMETHODIMP ChromeActiveDocument::GetClassID(CLSID* class_id) {
    316   if (NULL == class_id)
    317     return E_POINTER;
    318   *class_id = GetObjectCLSID();
    319   return S_OK;
    320 }
    321 
    322 STDMETHODIMP ChromeActiveDocument::QueryStatus(const GUID* cmd_group_guid,
    323                                                ULONG number_of_commands,
    324                                                OLECMD commands[],
    325                                                OLECMDTEXT* command_text) {
    326   DVLOG(1) << __FUNCTION__;
    327 
    328   CommandStatusMap* command_map = NULL;
    329 
    330   if (cmd_group_guid) {
    331     if (IsEqualGUID(*cmd_group_guid, GUID_NULL)) {
    332       command_map = &null_group_commands_map_;
    333     } else if (IsEqualGUID(*cmd_group_guid, CGID_MSHTML)) {
    334       command_map = &mshtml_group_commands_map_;
    335     } else if (IsEqualGUID(*cmd_group_guid, CGID_Explorer)) {
    336       command_map = &explorer_group_commands_map_;
    337     } else if (IsEqualGUID(*cmd_group_guid, CGID_ShellDocView)) {
    338       command_map = &shdoc_view_group_commands_map_;
    339     }
    340   } else {
    341     command_map = &null_group_commands_map_;
    342   }
    343 
    344   if (!command_map) {
    345     DVLOG(1) << "unsupported command group: " << GuidToString(*cmd_group_guid);
    346     return OLECMDERR_E_NOTSUPPORTED;
    347   }
    348 
    349   for (ULONG command_index = 0; command_index < number_of_commands;
    350        command_index++) {
    351     DVLOG(1) << "Command id = " << commands[command_index].cmdID;
    352     CommandStatusMap::iterator index =
    353         command_map->find(commands[command_index].cmdID);
    354     if (index != command_map->end())
    355       commands[command_index].cmdf = index->second;
    356   }
    357   return S_OK;
    358 }
    359 
    360 STDMETHODIMP ChromeActiveDocument::Exec(const GUID* cmd_group_guid,
    361                                         DWORD command_id,
    362                                         DWORD cmd_exec_opt,
    363                                         VARIANT* in_args,
    364                                         VARIANT* out_args) {
    365   DVLOG(1) << __FUNCTION__ << " Cmd id =" << command_id;
    366   // Bail out if we have been uninitialized.
    367   if (automation_client_.get() && automation_client_->tab()) {
    368     return ProcessExecCommand(cmd_group_guid, command_id, cmd_exec_opt,
    369                               in_args, out_args);
    370   } else if (command_id == OLECMDID_REFRESH && cmd_group_guid == NULL) {
    371     // If the automation server has crashed and the user is refreshing the
    372     // page, let OnRefreshPage attempt to recover.
    373     OnRefreshPage(cmd_group_guid, command_id, cmd_exec_opt, in_args, out_args);
    374   }
    375 
    376   return OLECMDERR_E_NOTSUPPORTED;
    377 }
    378 
    379 STDMETHODIMP ChromeActiveDocument::LoadHistory(IStream* stream,
    380                                                IBindCtx* bind_context) {
    381   // Read notes in ChromeActiveDocument::SaveHistory
    382   DCHECK(stream);
    383   LARGE_INTEGER offset = {0};
    384   ULARGE_INTEGER cur_pos = {0};
    385   STATSTG statstg = {0};
    386 
    387   stream->Seek(offset, STREAM_SEEK_CUR, &cur_pos);
    388   stream->Stat(&statstg, STATFLAG_NONAME);
    389 
    390   DWORD url_size = statstg.cbSize.LowPart - cur_pos.LowPart;
    391   base::win::ScopedBstr url_bstr;
    392   DWORD bytes_read = 0;
    393   stream->Read(url_bstr.AllocateBytes(url_size), url_size, &bytes_read);
    394   std::wstring url(url_bstr);
    395 
    396   ChromeFrameUrl cf_url;
    397   if (!cf_url.Parse(url)) {
    398     DLOG(WARNING) << __FUNCTION__ << " Failed to parse url:" << url;
    399     return E_INVALIDARG;
    400   }
    401 
    402   const std::string& referrer = EmptyString();
    403   if (!LaunchUrl(cf_url, referrer)) {
    404     NOTREACHED() << __FUNCTION__ << " Failed to launch url:" << url;
    405     return E_INVALIDARG;
    406   }
    407   return S_OK;
    408 }
    409 
    410 STDMETHODIMP ChromeActiveDocument::SaveHistory(IStream* stream) {
    411   // TODO(sanjeevr): We need to fetch the entire list of navigation entries
    412   // from Chrome and persist it in the stream. And in LoadHistory we need to
    413   // pass this list back to Chrome which will recreate the list. This will allow
    414   // Back-Forward navigation to anchors to work correctly when we navigate to a
    415   // page outside of ChromeFrame and then come back.
    416   if (!stream) {
    417     NOTREACHED();
    418     return E_INVALIDARG;
    419   }
    420 
    421   LARGE_INTEGER offset = {0};
    422   ULARGE_INTEGER new_pos = {0};
    423   DWORD written = 0;
    424   std::wstring url = UTF8ToWide(navigation_info_->url.spec());
    425   return stream->Write(url.c_str(), (url.length() + 1) * sizeof(wchar_t),
    426                        &written);
    427 }
    428 
    429 STDMETHODIMP ChromeActiveDocument::SetPositionCookie(DWORD position_cookie) {
    430   if (automation_client_.get()) {
    431     int index = static_cast<int>(position_cookie);
    432     navigation_info_->navigation_index = index;
    433     automation_client_->NavigateToIndex(index);
    434   } else {
    435     DLOG(WARNING) << "Invalid automation client instance";
    436   }
    437   return S_OK;
    438 }
    439 
    440 STDMETHODIMP ChromeActiveDocument::GetPositionCookie(DWORD* position_cookie) {
    441   if (!position_cookie)
    442     return E_INVALIDARG;
    443 
    444   *position_cookie = navigation_info_->navigation_index;
    445   return S_OK;
    446 }
    447 
    448 STDMETHODIMP ChromeActiveDocument::GetUrlForEvents(BSTR* url) {
    449   if (NULL == url)
    450     return E_POINTER;
    451   *url = ::SysAllocString(url_);
    452   return S_OK;
    453 }
    454 
    455 STDMETHODIMP ChromeActiveDocument::GetAddressBarUrl(BSTR* url) {
    456   return GetUrlForEvents(url);
    457 }
    458 
    459 STDMETHODIMP ChromeActiveDocument::Reset() {
    460   next_privacy_record_ = privacy_info_.privacy_records.begin();
    461   return S_OK;
    462 }
    463 
    464 STDMETHODIMP ChromeActiveDocument::GetSize(DWORD* size) {
    465   if (!size)
    466     return E_POINTER;
    467 
    468   *size = privacy_info_.privacy_records.size();
    469   return S_OK;
    470 }
    471 
    472 STDMETHODIMP ChromeActiveDocument::GetPrivacyImpacted(BOOL* privacy_impacted) {
    473   if (!privacy_impacted)
    474     return E_POINTER;
    475 
    476   *privacy_impacted = privacy_info_.privacy_impacted;
    477   return S_OK;
    478 }
    479 
    480 STDMETHODIMP ChromeActiveDocument::Next(BSTR* url, BSTR* policy,
    481                                         LONG* reserved, DWORD* flags) {
    482   if (!url || !policy || !flags)
    483     return E_POINTER;
    484 
    485   if (next_privacy_record_ == privacy_info_.privacy_records.end())
    486     return HRESULT_FROM_WIN32(ERROR_NO_MORE_ITEMS);
    487 
    488   *url = SysAllocString(next_privacy_record_->first.c_str());
    489   *policy = SysAllocString(next_privacy_record_->second.policy_ref.c_str());
    490   *flags = next_privacy_record_->second.flags;
    491 
    492   next_privacy_record_++;
    493   return S_OK;
    494 }
    495 
    496 bool ChromeActiveDocument::IsSchemeAllowed(const GURL& url) {
    497   bool allowed = BaseActiveX::IsSchemeAllowed(url);
    498   if (allowed)
    499     return true;
    500 
    501   if (url.SchemeIs(chrome::kAboutScheme)) {
    502     if (LowerCaseEqualsASCII(url.spec(), chrome::kAboutPluginsURL))
    503       return true;
    504   }
    505   return false;
    506 }
    507 
    508 HRESULT ChromeActiveDocument::GetInPlaceFrame(
    509     IOleInPlaceFrame** in_place_frame) {
    510   DCHECK(in_place_frame);
    511   if (in_place_frame_) {
    512     *in_place_frame = in_place_frame_.get();
    513     (*in_place_frame)->AddRef();
    514     return S_OK;
    515   } else {
    516     return S_FALSE;
    517   }
    518 }
    519 
    520 HRESULT ChromeActiveDocument::IOleObject_SetClientSite(
    521     IOleClientSite* client_site) {
    522   if (client_site == NULL) {
    523     base::win::ScopedComPtr<IDocHostUIHandler> doc_host_handler;
    524     if (doc_site_)
    525       doc_host_handler.QueryFrom(doc_site_);
    526 
    527     if (doc_host_handler.get())
    528       doc_host_handler->HideUI();
    529 
    530     doc_site_.Release();
    531   }
    532 
    533   if (client_site != m_spClientSite)
    534     return BaseActiveX::IOleObject_SetClientSite(client_site);
    535 
    536   return S_OK;
    537 }
    538 
    539 HRESULT ChromeActiveDocument::ActiveXDocActivate(LONG verb) {
    540   HRESULT hr = S_OK;
    541   m_bNegotiatedWnd = TRUE;
    542   if (!m_bInPlaceActive) {
    543     hr = m_spInPlaceSite->CanInPlaceActivate();
    544     if (FAILED(hr))
    545       return hr;
    546     m_spInPlaceSite->OnInPlaceActivate();
    547   }
    548   m_bInPlaceActive = TRUE;
    549   // get location in the parent window,
    550   // as well as some information about the parent
    551   base::win::ScopedComPtr<IOleInPlaceUIWindow> in_place_ui_window;
    552   frame_info_.cb = sizeof(OLEINPLACEFRAMEINFO);
    553   HWND parent_window = NULL;
    554   if (m_spInPlaceSite->GetWindow(&parent_window) == S_OK) {
    555     in_place_frame_.Release();
    556     RECT position_rect = {0};
    557     RECT clip_rect = {0};
    558     m_spInPlaceSite->GetWindowContext(in_place_frame_.Receive(),
    559                                       in_place_ui_window.Receive(),
    560                                       &position_rect,
    561                                       &clip_rect,
    562                                       &frame_info_);
    563     if (!m_bWndLess) {
    564       if (IsWindow()) {
    565         ::ShowWindow(m_hWnd, SW_SHOW);
    566         SetFocus();
    567       } else {
    568         m_hWnd = Create(parent_window, position_rect);
    569         if (!IsWindow()) {
    570           // This might happen if the automation server couldn't be
    571           // instantiated.  If so, a NOTREACHED() will have already been hit.
    572           DLOG(ERROR) << "Failed to create Ax window";
    573           return AtlHresultFromLastError();
    574         }
    575       }
    576     }
    577     SetObjectRects(&position_rect, &clip_rect);
    578   }
    579 
    580   base::win::ScopedComPtr<IOleInPlaceActiveObject> in_place_active_object(this);
    581 
    582   // Gone active by now, take care of UIACTIVATE
    583   if (DoesVerbUIActivate(verb)) {
    584     if (!m_bUIActive) {
    585       m_bUIActive = TRUE;
    586       hr = m_spInPlaceSite->OnUIActivate();
    587       if (FAILED(hr))
    588         return hr;
    589       // set ourselves up in the host
    590       if (in_place_active_object) {
    591         if (in_place_frame_)
    592           in_place_frame_->SetActiveObject(in_place_active_object, NULL);
    593         if (in_place_ui_window)
    594           in_place_ui_window->SetActiveObject(in_place_active_object, NULL);
    595       }
    596     }
    597   }
    598   m_spClientSite->ShowObject();
    599   return S_OK;
    600 }
    601 
    602 void ChromeActiveDocument::OnNavigationStateChanged(
    603     int flags, const NavigationInfo& nav_info) {
    604   // TODO(joshia): handle INVALIDATE_TYPE_TAB,INVALIDATE_TYPE_LOAD etc.
    605   DVLOG(1) << __FUNCTION__
    606            << "\n Flags: " << flags
    607            << ", Url: " << nav_info.url
    608            << ", Title: " << nav_info.title
    609            << ", Type: " << nav_info.navigation_type
    610            << ", Relative Offset: " << nav_info.relative_offset
    611            << ", Index: " << nav_info.navigation_index;
    612 
    613   UpdateNavigationState(nav_info, flags);
    614 }
    615 
    616 void ChromeActiveDocument::OnUpdateTargetUrl(
    617     const std::wstring& new_target_url) {
    618   if (in_place_frame_)
    619     in_place_frame_->SetStatusText(new_target_url.c_str());
    620 }
    621 
    622 bool IsFindAccelerator(const MSG& msg) {
    623   // TODO(robertshield): This may not stand up to localization. Fix if this
    624   // is the case.
    625   return msg.message == WM_KEYDOWN && msg.wParam == 'F' &&
    626          base::win::IsCtrlPressed() &&
    627          !(base::win::IsAltPressed() || base::win::IsShiftPressed());
    628 }
    629 
    630 void ChromeActiveDocument::OnAcceleratorPressed(const MSG& accel_message) {
    631   if (::TranslateAccelerator(m_hWnd, accelerator_table_,
    632                              const_cast<MSG*>(&accel_message)))
    633     return;
    634 
    635   bool handled_accel = false;
    636   if (in_place_frame_ != NULL) {
    637     handled_accel = (S_OK == in_place_frame_->TranslateAcceleratorW(
    638         const_cast<MSG*>(&accel_message), 0));
    639   }
    640 
    641   if (!handled_accel) {
    642     if (IsFindAccelerator(accel_message)) {
    643       // Handle the showing of the find dialog explicitly.
    644       OnFindInPage();
    645     } else {
    646       BaseActiveX::OnAcceleratorPressed(accel_message);
    647     }
    648   } else {
    649     DVLOG(1) << "IE handled accel key " << accel_message.wParam;
    650   }
    651 }
    652 
    653 void ChromeActiveDocument::OnTabbedOut(bool reverse) {
    654   DVLOG(1) << __FUNCTION__;
    655   if (in_place_frame_) {
    656     MSG msg = { NULL, WM_KEYDOWN, VK_TAB };
    657     in_place_frame_->TranslateAcceleratorW(&msg, 0);
    658   }
    659 }
    660 
    661 void ChromeActiveDocument::OnDidNavigate(const NavigationInfo& nav_info) {
    662   DVLOG(1) << __FUNCTION__ << std::endl
    663            << "Url: " << nav_info.url
    664            << ", Title: " << nav_info.title
    665            << ", Type: " << nav_info.navigation_type
    666            << ", Relative Offset: " << nav_info.relative_offset
    667            << ", Index: " << nav_info.navigation_index;
    668 
    669   CrashMetricsReporter::GetInstance()->IncrementMetric(
    670       CrashMetricsReporter::CHROME_FRAME_NAVIGATION_COUNT);
    671 
    672   UpdateNavigationState(nav_info, 0);
    673 }
    674 
    675 void ChromeActiveDocument::OnCloseTab() {
    676   // Base class will fire DIChromeFrameEvents::onclose.
    677   BaseActiveX::OnCloseTab();
    678 
    679   // Close the container window.
    680   base::win::ScopedComPtr<IWebBrowser2> web_browser2;
    681   DoQueryService(SID_SWebBrowserApp, m_spClientSite, web_browser2.Receive());
    682   if (web_browser2)
    683     web_browser2->Quit();
    684 }
    685 
    686 void ChromeActiveDocument::UpdateNavigationState(
    687     const NavigationInfo& new_navigation_info, int flags) {
    688   // This could be NULL if the active document instance is being destroyed.
    689   if (!m_spInPlaceSite) {
    690     DVLOG(1) << __FUNCTION__ << "m_spInPlaceSite is NULL. Returning";
    691     return;
    692   }
    693 
    694   HRESULT hr = S_OK;
    695   bool is_title_changed =
    696       (navigation_info_->title != new_navigation_info.title);
    697   bool is_ssl_state_changed =
    698       (navigation_info_->security_style !=
    699           new_navigation_info.security_style) ||
    700       (navigation_info_->displayed_insecure_content !=
    701           new_navigation_info.displayed_insecure_content) ||
    702       (navigation_info_->ran_insecure_content !=
    703           new_navigation_info.ran_insecure_content);
    704 
    705   if (is_ssl_state_changed) {
    706     int lock_status = SECURELOCK_SET_UNSECURE;
    707     switch (new_navigation_info.security_style) {
    708       case content::SECURITY_STYLE_AUTHENTICATED:
    709         lock_status = new_navigation_info.displayed_insecure_content ?
    710             SECURELOCK_SET_MIXED : SECURELOCK_SET_SECUREUNKNOWNBIT;
    711         break;
    712       default:
    713         break;
    714     }
    715 
    716     base::win::ScopedVariant secure_lock_status(lock_status);
    717     IEExec(&CGID_ShellDocView, INTERNAL_CMDID_SET_SSL_LOCK,
    718            OLECMDEXECOPT_DODEFAULT, secure_lock_status.AsInput(), NULL);
    719   }
    720 
    721   // A number of poorly written bho's crash in their event sink callbacks if
    722   // chrome frame is the currently loaded document. This is because they expect
    723   // chrome frame to implement interfaces like IHTMLDocument, etc. We patch the
    724   // event sink's of these bho's and don't invoke the event sink if chrome
    725   // frame is the currently loaded document.
    726   if (GetConfigBool(true, kEnableBuggyBhoIntercept)) {
    727     base::win::ScopedComPtr<IWebBrowser2> wb2;
    728     DoQueryService(SID_SWebBrowserApp, m_spClientSite, wb2.Receive());
    729     if (wb2 && buggy_bho::BuggyBhoTls::GetInstance()) {
    730       buggy_bho::BuggyBhoTls::GetInstance()->PatchBuggyBHOs(wb2);
    731     }
    732   }
    733 
    734   // Ideally all navigations should come to Chrome Frame so that we can call
    735   // BeforeNavigate2 on installed BHOs and give them a chance to cancel the
    736   // navigation. However, in practice what happens is as below:
    737   // The very first navigation that happens in CF happens via a Load or a
    738   // LoadHistory call. In this case, IE already has the correct information for
    739   // its travel log as well address bar. For other internal navigations (navs
    740   // that only happen within Chrome such as anchor navigations) we need to
    741   // update IE's internal state after the fact. In the case of internal
    742   // navigations, we notify the BHOs but ignore the should_cancel flag.
    743 
    744   // Another case where we need to issue BeforeNavigate2 calls is as below:-
    745   // We get notified after the fact, when navigations are initiated within
    746   // Chrome via window.open calls. These navigations are handled by creating
    747   // an external tab container within chrome and then connecting to it from IE.
    748   // We still want to update the address bar/history, etc, to ensure that
    749   // the special URL used by Chrome to indicate this is updated correctly.
    750   ChromeFrameUrl cf_url;
    751   bool is_attach_external_tab_url = cf_url.Parse(std::wstring(url_)) &&
    752       cf_url.attach_to_external_tab();
    753 
    754   bool is_internal_navigation =
    755       IsNewNavigation(new_navigation_info, flags) || is_attach_external_tab_url;
    756 
    757   if (new_navigation_info.url.is_valid())
    758     url_.Allocate(UTF8ToWide(new_navigation_info.url.spec()).c_str());
    759 
    760   if (is_internal_navigation) {
    761     // IE6 does not support tabs. If Chrome sent us a window open request
    762     // indicating that the navigation needs to occur in a foreground tab or
    763     // a popup window, then we need to ensure that the new window in IE6 is
    764     // brought to the foreground.
    765     if (GetIEVersion() == IE_6 &&
    766         is_attach_external_tab_url &&
    767         (cf_url.disposition() == NEW_FOREGROUND_TAB ||
    768          cf_url.disposition() == NEW_POPUP)) {
    769       base::win::ScopedComPtr<IWebBrowser2> wb2;
    770       DoQueryService(SID_SWebBrowserApp, m_spClientSite, wb2.Receive());
    771       if (wb2)
    772         BaseActiveX::BringWebBrowserWindowToTop(wb2);
    773     }
    774     base::win::ScopedComPtr<IDocObjectService> doc_object_svc;
    775     base::win::ScopedComPtr<IWebBrowserEventsService> web_browser_events_svc;
    776 
    777     DoQueryService(__uuidof(web_browser_events_svc), m_spClientSite,
    778                    web_browser_events_svc.Receive());
    779 
    780     if (!web_browser_events_svc.get()) {
    781       DoQueryService(SID_SShellBrowser, m_spClientSite,
    782                      doc_object_svc.Receive());
    783     }
    784 
    785     // web_browser_events_svc can be NULL on IE6.
    786     if (web_browser_events_svc) {
    787       VARIANT_BOOL should_cancel = VARIANT_FALSE;
    788       web_browser_events_svc->FireBeforeNavigate2Event(&should_cancel);
    789     } else if (doc_object_svc) {
    790       BOOL should_cancel = FALSE;
    791       doc_object_svc->FireBeforeNavigate2(NULL, url_, 0, NULL, NULL, 0,
    792                                           NULL, FALSE, &should_cancel);
    793     }
    794 
    795     // We need to tell IE that we support navigation so that IE will query us
    796     // for IPersistHistory and call GetPositionCookie to save our navigation
    797     // index.
    798     base::win::ScopedVariant html_window(static_cast<IUnknown*>(
    799         static_cast<IHTMLWindow2*>(this)));
    800     IEExec(&CGID_DocHostCmdPriv, DOCHOST_DOCCANNAVIGATE, 0,
    801            html_window.AsInput(), NULL);
    802 
    803     // We pass the HLNF_INTERNALJUMP flag to INTERNAL_CMDID_FINALIZE_TRAVEL_LOG
    804     // since we want to make IE treat all internal navigations within this page
    805     // (including anchor navigations and subframe navigations) as anchor
    806     // navigations. This will ensure that IE calls GetPositionCookie
    807     // to save the current position cookie in the travel log and then call
    808     // SetPositionCookie when the user hits Back/Forward to come back here.
    809     base::win::ScopedVariant internal_navigation(HLNF_INTERNALJUMP);
    810     IEExec(&CGID_Explorer, INTERNAL_CMDID_FINALIZE_TRAVEL_LOG, 0,
    811            internal_navigation.AsInput(), NULL);
    812 
    813     // We no longer need to lie to IE. If we lie persistently to IE, then
    814     // IE reuses us for new navigations.
    815     IEExec(&CGID_DocHostCmdPriv, DOCHOST_DOCCANNAVIGATE, 0, NULL, NULL);
    816 
    817     if (doc_object_svc) {
    818       // Now call the FireNavigateCompleteEvent which makes IE update the text
    819       // in the address-bar.
    820       doc_object_svc->FireNavigateComplete2(this, 0);
    821       doc_object_svc->FireDocumentComplete(this, 0);
    822     } else if (web_browser_events_svc) {
    823       web_browser_events_svc->FireNavigateComplete2Event();
    824       web_browser_events_svc->FireDocumentCompleteEvent();
    825     }
    826   }
    827 
    828   if (is_title_changed) {
    829     base::win::ScopedVariant title(new_navigation_info.title.c_str());
    830     IEExec(NULL, OLECMDID_SETTITLE, OLECMDEXECOPT_DONTPROMPTUSER,
    831            title.AsInput(), NULL);
    832   }
    833 
    834   // There are cases in which we receive NavigationStateChanged events for
    835   // provisional loads. These events will contain a new URL but will not be
    836   // considered new navigations since their navigation_index is 0. For these
    837   // events, do not update the navigation_info_ state, as this will muck up the
    838   // travel log when the subsequent committed navigation event takes place.
    839   //
    840   // Given this filtering, also special-case first navigations since those
    841   // are needed to initially populate navigation_info_ to keep it in sync with
    842   // what was placed in the IE travel log when CF was first opened.
    843   //
    844   // Lastly, allow through navigation events that would neither affect the
    845   // travel log nor cause the page location to change, as these will
    846   // contain informational state (referrer, title, etc.) that we should
    847   // preserve.
    848   if (is_internal_navigation || IsFirstNavigation(new_navigation_info) ||
    849       new_navigation_info.url == navigation_info_->url) {
    850     // It is important that we only update the navigation_info_ after we have
    851     // finalized the travel log. This is because IE will ask for information
    852     // such as navigation index when the travel log is finalized and we need
    853     // supply the old index and not the new one.
    854     *navigation_info_ = new_navigation_info;
    855   }
    856 
    857   // Update the IE zone here. Ideally we would like to do it when the active
    858   // document is activated. However that does not work at times as the frame we
    859   // get there is not the actual frame which handles the command.
    860   IEExec(&CGID_Explorer, SBCMDID_MIXEDZONE, 0, NULL, NULL);
    861 }
    862 
    863 void ChromeActiveDocument::OnFindInPage() {
    864   TabProxy* tab = GetTabProxy();
    865   if (tab) {
    866     if (!find_dialog_.IsWindow())
    867       find_dialog_.Create(m_hWnd);
    868 
    869     find_dialog_.ShowWindow(SW_SHOW);
    870   }
    871 }
    872 
    873 void ChromeActiveDocument::OnViewSource() {
    874   DCHECK(navigation_info_->url.is_valid());
    875   HostNavigate(GURL(content::kViewSourceScheme + std::string(":") +
    876       navigation_info_->url.spec()), GURL(), NEW_WINDOW);
    877 }
    878 
    879 void ChromeActiveDocument::OnDetermineSecurityZone(const GUID* cmd_group_guid,
    880                                                    DWORD command_id,
    881                                                    DWORD cmd_exec_opt,
    882                                                    VARIANT* in_args,
    883                                                    VARIANT* out_args) {
    884   // Always return URLZONE_INTERNET since that is the Chrome's behaviour.
    885   // Correct step is to use MapUrlToZone().
    886   if (out_args != NULL) {
    887     out_args->vt = VT_UI4;
    888     out_args->ulVal = URLZONE_INTERNET;
    889   }
    890 }
    891 
    892 void ChromeActiveDocument::OnDisplayPrivacyInfo() {
    893   privacy_info_ = url_fetcher_->privacy_info();
    894   Reset();
    895   DoPrivacyDlg(m_hWnd, url_, this, TRUE);
    896 }
    897 
    898 void ChromeActiveDocument::OnGetZoomRange(const GUID* cmd_group_guid,
    899                                           DWORD command_id,
    900                                           DWORD cmd_exec_opt,
    901                                           VARIANT* in_args,
    902                                           VARIANT* out_args) {
    903   if (out_args != NULL) {
    904     out_args->vt = VT_I4;
    905     out_args->lVal = 0;
    906   }
    907 }
    908 
    909 void ChromeActiveDocument::OnSetZoomRange(const GUID* cmd_group_guid,
    910                                           DWORD command_id,
    911                                           DWORD cmd_exec_opt,
    912                                           VARIANT* in_args,
    913                                           VARIANT* out_args) {
    914   const int kZoomIn = 125;
    915   const int kZoomOut = 75;
    916 
    917   if (in_args && V_VT(in_args) == VT_I4 && IsValid()) {
    918     if (in_args->lVal == kZoomIn) {
    919       automation_client_->SetZoomLevel(content::PAGE_ZOOM_IN);
    920     } else if (in_args->lVal == kZoomOut) {
    921       automation_client_->SetZoomLevel(content::PAGE_ZOOM_OUT);
    922     } else {
    923       DLOG(WARNING) << "Unsupported zoom level:" << in_args->lVal;
    924     }
    925   }
    926 }
    927 
    928 void ChromeActiveDocument::OnUnload(const GUID* cmd_group_guid,
    929                                     DWORD command_id,
    930                                     DWORD cmd_exec_opt,
    931                                     VARIANT* in_args,
    932                                     VARIANT* out_args) {
    933   if (IsValid() && out_args) {
    934     // If the navigation is attempted to the url loaded in CF, with the only
    935     // difference being the addition of an anchor, IE will attempt to unload
    936     // the currently loaded document which basically would end up running
    937     // unload handlers on the currently loaded document thus rendering it non
    938     // functional. We handle this as below:-
    939     // The BHO receives the new url in the BeforeNavigate event.
    940     // We compare the non anchor portions of the url in the BHO with the loaded
    941     // url and if they match, we initiate a Chrome navigation to the url with
    942     // the anchor which works nicely.
    943     // We don't want to continue processing the unload in this case.
    944     // Note:-
    945     // IE handles these navigations by querying the loaded document for
    946     // IHTMLDocument which then handles the new navigation. That won't work for
    947     // us as we don't implement IHTMLDocument.
    948     NavigationManager* mgr = NavigationManager::GetThreadInstance();
    949     DLOG_IF(ERROR, !mgr) << "Couldn't get instance of NavigationManager";
    950     if (mgr) {
    951       ChromeFrameUrl url;
    952       url.Parse(mgr->url());
    953       if (url.gurl().has_ref()) {
    954         url_canon::Replacements<char> replacements;
    955         replacements.ClearRef();
    956 
    957         if (url.gurl().ReplaceComponents(replacements) ==
    958             GURL(static_cast<BSTR>(url_))) {
    959           // We want to reuse the existing automation client and channel for
    960           // initiating the new navigation. Setting the
    961           // is_automation_client_reused_ flag to true before calling the
    962           // LaunchUrl function achieves that.
    963           is_automation_client_reused_ = true;
    964           LaunchUrl(url, mgr->referrer());
    965           out_args->vt = VT_BOOL;
    966           out_args->boolVal = VARIANT_FALSE;
    967           return;
    968         }
    969       }
    970     }
    971     bool should_unload = true;
    972     automation_client_->OnUnload(&should_unload);
    973     out_args->vt = VT_BOOL;
    974     out_args->boolVal = should_unload ? VARIANT_TRUE : VARIANT_FALSE;
    975   }
    976 }
    977 
    978 void ChromeActiveDocument::OnAttachExternalTab(
    979     const AttachExternalTabParams& params) {
    980   if (!automation_client_.get()) {
    981     DLOG(WARNING) << "Invalid automation client instance";
    982     return;
    983   }
    984   DWORD flags = 0;
    985   if (params.user_gesture)
    986     flags = NWMF_USERREQUESTED;
    987   else if (popup_allowed_)
    988     flags = NWMF_USERALLOWED;
    989 
    990   HRESULT hr = S_OK;
    991   if (popup_manager_) {
    992     const std::wstring& url_wide = UTF8ToWide(params.url.spec());
    993     hr = popup_manager_->EvaluateNewWindow(url_wide.c_str(), NULL, url_,
    994         NULL, FALSE, flags, 0);
    995   }
    996   // Allow popup
    997   if (hr == S_OK) {
    998     BaseActiveX::OnAttachExternalTab(params);
    999     return;
   1000   }
   1001 
   1002   automation_client_->BlockExternalTab(params.cookie);
   1003 }
   1004 
   1005 bool ChromeActiveDocument::PreProcessContextMenu(HMENU menu) {
   1006   base::win::ScopedComPtr<IBrowserService> browser_service;
   1007   base::win::ScopedComPtr<ITravelLog> travel_log;
   1008   GetBrowserServiceAndTravelLog(browser_service.Receive(),
   1009                                 travel_log.Receive());
   1010   if (!browser_service || !travel_log)
   1011     return true;
   1012 
   1013   EnableMenuItem(menu, IDC_BACK, MF_BYCOMMAND |
   1014       (SUCCEEDED(travel_log->GetTravelEntry(browser_service, TLOG_BACK,
   1015                                             NULL)) ?
   1016       MF_ENABLED : MF_DISABLED));
   1017   EnableMenuItem(menu, IDC_FORWARD, MF_BYCOMMAND |
   1018       (SUCCEEDED(travel_log->GetTravelEntry(browser_service, TLOG_FORE,
   1019                                             NULL)) ?
   1020       MF_ENABLED : MF_DISABLED));
   1021   // Call base class (adds 'About' item)
   1022   return BaseActiveX::PreProcessContextMenu(menu);
   1023 }
   1024 
   1025 bool ChromeActiveDocument::HandleContextMenuCommand(
   1026     UINT cmd, const MiniContextMenuParams& params) {
   1027   base::win::ScopedComPtr<IWebBrowser2> web_browser2;
   1028   DoQueryService(SID_SWebBrowserApp, m_spClientSite, web_browser2.Receive());
   1029 
   1030   if (cmd == IDC_BACK)
   1031     web_browser2->GoBack();
   1032   else if (cmd == IDC_FORWARD)
   1033     web_browser2->GoForward();
   1034   else if (cmd == IDC_RELOAD)
   1035     web_browser2->Refresh();
   1036   else
   1037     return BaseActiveX::HandleContextMenuCommand(cmd, params);
   1038 
   1039   return true;
   1040 }
   1041 
   1042 HRESULT ChromeActiveDocument::IEExec(const GUID* cmd_group_guid,
   1043                                      DWORD command_id, DWORD cmd_exec_opt,
   1044                                      VARIANT* in_args, VARIANT* out_args) {
   1045   HRESULT hr = E_FAIL;
   1046 
   1047   base::win::ScopedComPtr<IOleCommandTarget> frame_cmd_target;
   1048 
   1049   base::win::ScopedComPtr<IOleInPlaceSite> in_place_site(m_spInPlaceSite);
   1050   if (!in_place_site.get() && m_spClientSite != NULL)
   1051     in_place_site.QueryFrom(m_spClientSite);
   1052 
   1053   if (in_place_site)
   1054     hr = frame_cmd_target.QueryFrom(in_place_site);
   1055 
   1056   if (frame_cmd_target) {
   1057     hr = frame_cmd_target->Exec(cmd_group_guid, command_id, cmd_exec_opt,
   1058                                 in_args, out_args);
   1059   }
   1060 
   1061   return hr;
   1062 }
   1063 
   1064 bool ChromeActiveDocument::LaunchUrl(const ChromeFrameUrl& cf_url,
   1065                                      const std::string& referrer) {
   1066   DCHECK(!cf_url.gurl().is_empty());
   1067 
   1068   if (!automation_client_.get()) {
   1069     // http://code.google.com/p/chromium/issues/detail?id=52894
   1070     // Still not sure how this happens.
   1071     DLOG(ERROR) << "No automation client!";
   1072     if (!Initialize()) {
   1073       NOTREACHED() << "...and failed to start a new one >:(";
   1074       return false;
   1075     }
   1076   }
   1077 
   1078   document_url_ = cf_url.gurl().spec();
   1079 
   1080   url_.Allocate(UTF8ToWide(cf_url.gurl().spec()).c_str());
   1081   if (cf_url.attach_to_external_tab()) {
   1082     automation_client_->AttachExternalTab(cf_url.cookie());
   1083     OnMoveWindow(cf_url.dimensions());
   1084   } else if (!automation_client_->InitiateNavigation(cf_url.gurl().spec(),
   1085                                                      referrer,
   1086                                                      this)) {
   1087     DLOG(ERROR) << "Invalid URL: " << url_;
   1088     Error(L"Invalid URL");
   1089     url_.Reset();
   1090     return false;
   1091   }
   1092 
   1093   if (is_automation_client_reused_)
   1094     return true;
   1095 
   1096   automation_client_->SetUrlFetcher(url_fetcher_.get());
   1097   if (launch_params_) {
   1098     return automation_client_->Initialize(this, launch_params_);
   1099   } else {
   1100     std::wstring profile = UTF8ToWide(cf_url.profile_name());
   1101     // If no profile was given, then make use of the host process's name.
   1102     if (profile.empty())
   1103       profile = GetHostProcessName(false);
   1104     return InitializeAutomation(profile, IsIEInPrivate(),
   1105                                 false, cf_url.gurl(), GURL(referrer),
   1106                                 false);
   1107   }
   1108 }
   1109 
   1110 HRESULT ChromeActiveDocument::OnRefreshPage(const GUID* cmd_group_guid,
   1111     DWORD command_id, DWORD cmd_exec_opt, VARIANT* in_args, VARIANT* out_args) {
   1112   DVLOG(1) << __FUNCTION__;
   1113   popup_allowed_ = false;
   1114   if (in_args->vt == VT_I4 &&
   1115       in_args->lVal & OLECMDIDF_REFRESH_PAGEACTION_POPUPWINDOW) {
   1116     popup_allowed_ = true;
   1117 
   1118     // Ask the yellow security band to change the text and icon and to remain
   1119     // visible.
   1120     IEExec(&CGID_DocHostCommandHandler, OLECMDID_PAGEACTIONBLOCKED,
   1121         0x80000000 | OLECMDIDF_WINDOWSTATE_USERVISIBLE_VALID, NULL, NULL);
   1122   }
   1123 
   1124   NavigationManager* mgr = NavigationManager::GetThreadInstance();
   1125   DLOG_IF(ERROR, !mgr) << "Couldn't get instance of NavigationManager";
   1126 
   1127   // If ChromeFrame was activated on this page as a result of a document
   1128   // received in response to a top level post, then we ask the user for
   1129   // permission to repost and issue a navigation with the saved post data
   1130   // which reinitates the whole sequence, i.e. the server receives the top
   1131   // level post and chrome frame will be reactivated in response.
   1132   if (mgr && mgr->post_data().type() != VT_EMPTY) {
   1133     if (MessageBox(
   1134             SimpleResourceLoader::Get(IDS_HTTP_POST_WARNING).c_str(),
   1135             SimpleResourceLoader::Get(IDS_HTTP_POST_WARNING_TITLE).c_str(),
   1136             MB_YESNO | MB_ICONEXCLAMATION) == IDYES) {
   1137       base::win::ScopedComPtr<IWebBrowser2> web_browser2;
   1138       DoQueryService(SID_SWebBrowserApp, m_spClientSite,
   1139                      web_browser2.Receive());
   1140       DCHECK(web_browser2);
   1141       VARIANT empty = base::win::ScopedVariant::kEmptyVariant;
   1142       VARIANT flags = { VT_I4 };
   1143       V_I4(&flags) = navNoHistory;
   1144 
   1145       return web_browser2->Navigate2(base::win::ScopedVariant(url_).AsInput(),
   1146                                      &flags,
   1147                                      &empty,
   1148                                      const_cast<VARIANT*>(&mgr->post_data()),
   1149                                      const_cast<VARIANT*>(&mgr->headers()));
   1150     } else {
   1151       return S_OK;
   1152     }
   1153   }
   1154 
   1155   TabProxy* tab_proxy = GetTabProxy();
   1156   if (tab_proxy) {
   1157     tab_proxy->ReloadAsync();
   1158   } else {
   1159     DLOG(ERROR) << "No automation proxy";
   1160     DCHECK(automation_client_.get() != NULL) << "how did it get freed?";
   1161     // The current url request manager (url_fetcher_) has been switched to
   1162     // a stopping state so we need to reset it and get a new one for the new
   1163     // automation server.
   1164     ResetUrlRequestManager();
   1165     url_fetcher_->set_frame_busting(false);
   1166     // And now launch the current URL again.  This starts a new server process.
   1167     DCHECK(navigation_info_->url.is_valid());
   1168     ChromeFrameUrl cf_url;
   1169     cf_url.Parse(UTF8ToWide(navigation_info_->url.spec()));
   1170     LaunchUrl(cf_url, navigation_info_->referrer.spec());
   1171   }
   1172 
   1173   return S_OK;
   1174 }
   1175 
   1176 HRESULT ChromeActiveDocument::SetPageFontSize(const GUID* cmd_group_guid,
   1177                                               DWORD command_id,
   1178                                               DWORD cmd_exec_opt,
   1179                                               VARIANT* in_args,
   1180                                               VARIANT* out_args) {
   1181   if (!automation_client_.get()) {
   1182     NOTREACHED() << "Invalid automation client";
   1183     return E_FAIL;
   1184   }
   1185 
   1186   switch (command_id) {
   1187     case IDM_BASELINEFONT1:
   1188       automation_client_->SetPageFontSize(SMALLEST_FONT);
   1189       break;
   1190 
   1191     case IDM_BASELINEFONT2:
   1192       automation_client_->SetPageFontSize(SMALL_FONT);
   1193       break;
   1194 
   1195     case IDM_BASELINEFONT3:
   1196       automation_client_->SetPageFontSize(MEDIUM_FONT);
   1197       break;
   1198 
   1199     case IDM_BASELINEFONT4:
   1200       automation_client_->SetPageFontSize(LARGE_FONT);
   1201       break;
   1202 
   1203     case IDM_BASELINEFONT5:
   1204       automation_client_->SetPageFontSize(LARGEST_FONT);
   1205       break;
   1206 
   1207     default:
   1208       NOTREACHED() << "Invalid font size command: "
   1209                   << command_id;
   1210       return E_FAIL;
   1211   }
   1212 
   1213   // Forward the command back to IEFrame with group set to
   1214   // CGID_ExplorerBarDoc. This is probably needed to update the menu state to
   1215   // indicate that the font size was set. This currently fails with error
   1216   // 0x80040104.
   1217   // TODO(iyengar)
   1218   // Do some investigation into why this Exec call fails.
   1219   IEExec(&CGID_ExplorerBarDoc, command_id, cmd_exec_opt, NULL, NULL);
   1220   return S_OK;
   1221 }
   1222 
   1223 HRESULT ChromeActiveDocument::OnEncodingChange(const GUID* cmd_group_guid,
   1224                                                DWORD command_id,
   1225                                                DWORD cmd_exec_opt,
   1226                                                VARIANT* in_args,
   1227                                                VARIANT* out_args) {
   1228   const struct EncodingMapData {
   1229     DWORD ie_encoding_id;
   1230     const char* chrome_encoding_name;
   1231   } kEncodingTestDatas[] = {
   1232 #define DEFINE_ENCODING_MAP(encoding_name, id, chrome_name) \
   1233     { encoding_name, chrome_name },
   1234   INTERNAL_IE_ENCODINGMENU_IDS(DEFINE_ENCODING_MAP)
   1235 #undef DEFINE_ENCODING_MAP
   1236   };
   1237 
   1238   if (!automation_client_.get()) {
   1239     NOTREACHED() << "Invalid automtion client";
   1240     return E_FAIL;
   1241   }
   1242 
   1243   // Using ARRAYSIZE_UNSAFE in here is because we define the struct
   1244   // EncodingMapData inside function.
   1245   const char* chrome_encoding_name = NULL;
   1246   for (int i = 0; i < ARRAYSIZE_UNSAFE(kEncodingTestDatas); ++i) {
   1247     const struct EncodingMapData* encoding_data = &kEncodingTestDatas[i];
   1248     if (command_id == encoding_data->ie_encoding_id) {
   1249       chrome_encoding_name = encoding_data->chrome_encoding_name;
   1250       break;
   1251     }
   1252   }
   1253   // Return E_FAIL when encountering invalid encoding id.
   1254   if (!chrome_encoding_name)
   1255     return E_FAIL;
   1256 
   1257   TabProxy* tab = GetTabProxy();
   1258   if (!tab) {
   1259     NOTREACHED() << "Can not get TabProxy";
   1260     return E_FAIL;
   1261   }
   1262 
   1263   if (chrome_encoding_name)
   1264     tab->OverrideEncoding(chrome_encoding_name);
   1265 
   1266   // Like we did on SetPageFontSize, we may forward the command back to IEFrame
   1267   // to update the menu state to indicate that which encoding was set.
   1268   // TODO(iyengar)
   1269   // Do some investigation into why this Exec call fails.
   1270   IEExec(&CGID_ExplorerBarDoc, command_id, cmd_exec_opt, NULL, NULL);
   1271   return S_OK;
   1272 }
   1273 
   1274 void ChromeActiveDocument::OnGoToHistoryEntryOffset(int offset) {
   1275   DVLOG(1) <<  __FUNCTION__ << " - offset:" << offset;
   1276 
   1277   base::win::ScopedComPtr<IBrowserService> browser_service;
   1278   base::win::ScopedComPtr<ITravelLog> travel_log;
   1279   GetBrowserServiceAndTravelLog(browser_service.Receive(),
   1280                                 travel_log.Receive());
   1281 
   1282   if (browser_service && travel_log)
   1283     travel_log->Travel(browser_service, offset);
   1284 }
   1285 
   1286 void ChromeActiveDocument::OnMoveWindow(const gfx::Rect& dimensions) {
   1287   base::win::ScopedComPtr<IWebBrowser2> web_browser2;
   1288   DoQueryService(SID_SWebBrowserApp, m_spClientSite,
   1289                  web_browser2.Receive());
   1290   if (!web_browser2)
   1291     return;
   1292   DVLOG(1) << "this:" << this << "\ndimensions: width:" << dimensions.width()
   1293            << " height:" << dimensions.height();
   1294   if (!dimensions.IsEmpty()) {
   1295     web_browser2->put_MenuBar(VARIANT_FALSE);
   1296     web_browser2->put_ToolBar(VARIANT_FALSE);
   1297 
   1298     int width = dimensions.width();
   1299     int height = dimensions.height();
   1300     // Compute the size of the browser window given the desired size of the
   1301     // content area. As per MSDN, the WebBrowser object returns an error from
   1302     // this method. As a result the code below is best effort.
   1303     web_browser2->ClientToWindow(&width, &height);
   1304 
   1305     web_browser2->put_Width(width);
   1306     web_browser2->put_Height(height);
   1307     web_browser2->put_Left(dimensions.x());
   1308     web_browser2->put_Top(dimensions.y());
   1309   }
   1310 }
   1311 
   1312 HRESULT ChromeActiveDocument::GetBrowserServiceAndTravelLog(
   1313     IBrowserService** browser_service, ITravelLog** travel_log) {
   1314   DCHECK(browser_service || travel_log);
   1315   base::win::ScopedComPtr<IBrowserService> browser_service_local;
   1316   HRESULT hr = DoQueryService(SID_SShellBrowser, m_spClientSite,
   1317                               browser_service_local.Receive());
   1318   if (!browser_service_local) {
   1319     NOTREACHED() << "DoQueryService for IBrowserService failed: " << hr;
   1320     return hr;
   1321   }
   1322 
   1323   if (travel_log) {
   1324     hr = browser_service_local->GetTravelLog(travel_log);
   1325     DVLOG_IF(1, !travel_log) << "browser_service->GetTravelLog failed: " << hr;
   1326   }
   1327 
   1328   if (browser_service)
   1329     *browser_service = browser_service_local.Detach();
   1330 
   1331   return hr;
   1332 }
   1333 
   1334 LRESULT ChromeActiveDocument::OnForward(WORD notify_code, WORD id,
   1335                                         HWND control_window,
   1336                                         BOOL& bHandled) {
   1337   base::win::ScopedComPtr<IWebBrowser2> web_browser2;
   1338   DoQueryService(SID_SWebBrowserApp, m_spClientSite, web_browser2.Receive());
   1339   DCHECK(web_browser2);
   1340 
   1341   if (web_browser2)
   1342     web_browser2->GoForward();
   1343   return 0;
   1344 }
   1345 
   1346 LRESULT ChromeActiveDocument::OnBack(WORD notify_code, WORD id,
   1347                                      HWND control_window,
   1348                                      BOOL& bHandled) {
   1349   base::win::ScopedComPtr<IWebBrowser2> web_browser2;
   1350   DoQueryService(SID_SWebBrowserApp, m_spClientSite, web_browser2.Receive());
   1351   DCHECK(web_browser2);
   1352 
   1353   if (web_browser2)
   1354     web_browser2->GoBack();
   1355   return 0;
   1356 }
   1357 
   1358 LRESULT ChromeActiveDocument::OnFirePrivacyChange(UINT message, WPARAM wparam,
   1359                                                   LPARAM lparam,
   1360                                                   BOOL& handled) {
   1361   if (!m_spClientSite)
   1362     return 0;
   1363 
   1364   base::win::ScopedComPtr<IWebBrowser2> web_browser2;
   1365   DoQueryService(SID_SWebBrowserApp, m_spClientSite,
   1366                  web_browser2.Receive());
   1367   if (!web_browser2) {
   1368     NOTREACHED() << "Failed to retrieve IWebBrowser2 interface.";
   1369     return 0;
   1370   }
   1371 
   1372   base::win::ScopedComPtr<IShellBrowser> shell_browser;
   1373   DoQueryService(SID_STopLevelBrowser, web_browser2,
   1374                  shell_browser.Receive());
   1375   DCHECK(shell_browser.get() != NULL);
   1376   base::win::ScopedComPtr<ITridentService2> trident_services;
   1377   trident_services.QueryFrom(shell_browser);
   1378   if (trident_services)
   1379     trident_services->FirePrivacyImpactedStateChange(wparam);
   1380   else
   1381     NOTREACHED() << "Failed to retrieve IWebBrowser2 interface.";
   1382   return 0;
   1383 }
   1384 
   1385 LRESULT ChromeActiveDocument::OnShowWindow(UINT message, WPARAM wparam,
   1386                                            LPARAM lparam,
   1387                                            BOOL& handled) {  // NO_LINT
   1388   if (wparam)
   1389     SetFocus();
   1390   return 0;
   1391 }
   1392 
   1393 LRESULT ChromeActiveDocument::OnSetFocus(UINT message, WPARAM wparam,
   1394                                          LPARAM lparam,
   1395                                          BOOL& handled) {  // NO_LINT
   1396   if (!ignore_setfocus_)
   1397     GiveFocusToChrome(false);
   1398   return 0;
   1399 }
   1400 
   1401 bool ChromeActiveDocument::IsNewNavigation(
   1402     const NavigationInfo& new_navigation_info, int flags) const {
   1403   // A new navigation is typically an internal navigation which is initiated by
   1404   // the renderer(WebKit). Condition 1 below has to be true along with the
   1405   // any of the other conditions below.
   1406   // 1. The navigation notification flags passed in as the flags parameter
   1407   //    is not INVALIDATE_TYPE_LOAD which indicates that the loading state of
   1408   //    the tab changed.
   1409   // 2. The navigation index is greater than 0 which means that a top level
   1410   //    navigation was initiated on the current external tab.
   1411   // 3. The navigation type has changed.
   1412   // 4. The url or the referrer are different.
   1413   if (flags == content::INVALIDATE_TYPE_LOAD)
   1414     return false;
   1415 
   1416   if (new_navigation_info.navigation_index <= 0)
   1417     return false;
   1418 
   1419   if (new_navigation_info.navigation_index ==
   1420       navigation_info_->navigation_index)
   1421     return false;
   1422 
   1423   if (new_navigation_info.navigation_type != navigation_info_->navigation_type)
   1424     return true;
   1425 
   1426   if (new_navigation_info.url != navigation_info_->url)
   1427     return true;
   1428 
   1429   if (new_navigation_info.referrer != navigation_info_->referrer)
   1430     return true;
   1431 
   1432   return false;
   1433 }
   1434 
   1435 bool ChromeActiveDocument::IsFirstNavigation(
   1436     const NavigationInfo& new_navigation_info) const {
   1437   return (navigation_info_->url.is_empty() &&
   1438           new_navigation_info.navigation_type ==
   1439               content::NAVIGATION_TYPE_NEW_PAGE);
   1440 }
   1441