Download requests initiated in a ChromeFrame popup window opened via window.open should be reissued

in the current navigation context. We use the attach external tab URL prefix as a cue to identify whether
the navigation should be reissued in a new window.

Fixes bug http://code.google.com/p/chromium/issues/detail?id=84235

BUG=84235
Review URL: http://codereview.chromium.org/7033061

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@88230 0039d316-1c4b-4281-b951-d872f2087c98

5 files changed, 29 insertions, 15 deletions

diff --git a/chrome_frame/chrome_active_document.cc b/chrome_frame/chrome_active_document.cc
index 0a9d3a9..dc005c4 100644
--- a/chrome_frame/chrome_active_document.cc
+++ b/chrome_frame/chrome_active_document.cc
@@ -1054,6 +1054,8 @@ bool ChromeActiveDocument::LaunchUrl(const ChromeFrameUrl& cf_url,
     }
   }
 
+  document_url_ = cf_url.gurl().spec();
+
   url_.Allocate(UTF8ToWide(cf_url.gurl().spec()).c_str());
   if (cf_url.attach_to_external_tab()) {
     automation_client_->AttachExternalTab(cf_url.cookie());
diff --git a/chrome_frame/chrome_frame_activex_base.h b/chrome_frame/chrome_frame_activex_base.h
index 9667da0..e57a157 100644
--- a/chrome_frame/chrome_frame_activex_base.h
+++ b/chrome_frame/chrome_frame_activex_base.h
@@ -8,6 +8,7 @@
 #include <atlbase.h>
 #include <atlcom.h>
 #include <atlctl.h>
+#include <exdisp.h>
 #include <wininet.h>
 #include <shdeprecated.h>  // for IBrowserService2
 #include <shlguid.h>
@@ -448,6 +449,18 @@ END_MSG_MAP()
   // There's room for improvement here and also see todo below.
   LPARAM OnDownloadRequestInHost(UINT message, WPARAM wparam, LPARAM lparam,
                                  BOOL& handled) {
+    ChromeFrameUrl cf_url;
+    cf_url.Parse(UTF8ToWide(GetDocumentUrl()));
+
+    // Always issue the download request in a new window to ensure that the
+    // currently loaded ChromeFrame document does not inadvartently see an
+    // unload request. This runs javascript unload handlers on the page which
+    // renders the page non functional.
+    VARIANT flags = { VT_I4 };
+    V_I4(&flags) = navNoHistory;
+    if (!cf_url.attach_to_external_tab())
+      V_I4(&flags) |= navOpenInNewWindow;
+
     DownloadInHostParams* download_params =
         reinterpret_cast<DownloadInHostParams*>(wparam);
     DCHECK(download_params);
@@ -459,7 +472,8 @@ END_MSG_MAP()
       NavigateBrowserToMoniker(
           doc_site_, download_params->moniker,
           UTF8ToWide(download_params->request_headers).c_str(),
-          download_params->bind_ctx, NULL, download_params->post_data);
+          download_params->bind_ctx, NULL, download_params->post_data,
+          &flags);
     }
     delete download_params;
     return TRUE;
@@ -1051,7 +1065,6 @@ END_MSG_MAP()
         return;
       }
     }
-
     // Last chance to handle the keystroke is to pass it to chromium.
     // We do this last partially because there's no way for us to tell if
     // chromium actually handled the keystroke, but also since the browser
diff --git a/chrome_frame/urlmon_moniker.cc b/chrome_frame/urlmon_moniker.cc
index 12ce098..0f5ea5a 100644
--- a/chrome_frame/urlmon_moniker.cc
+++ b/chrome_frame/urlmon_moniker.cc
@@ -4,6 +4,7 @@
 
 #include "chrome_frame/urlmon_moniker.h"
 
+#include <exdisp.h>
 #include <shlguid.h>
 
 #include "base/string_util.h"
@@ -62,8 +63,11 @@ HRESULT NavigationManager::NavigateToCurrentUrlInCF(IBrowserService* browser) {
         fragment = UTF8ToWide(parsed_moniker_url.ref());
       }
 
+      VARIANT flags = { VT_I4 };
+      V_VT(&flags) = navNoHistory | navOpenInNewWindow;
+
       hr = NavigateBrowserToMoniker(browser, moniker, headers.c_str(),
-          bind_context, fragment.c_str(), NULL);
+          bind_context, fragment.c_str(), NULL, &flags);
       DVLOG(1) << base::StringPrintf("NavigateBrowserToMoniker: 0x%08X", hr);
     }
   }
diff --git a/chrome_frame/utils.cc b/chrome_frame/utils.cc
index 69c4b31..c1f9fe5 100644
--- a/chrome_frame/utils.cc
+++ b/chrome_frame/utils.cc
@@ -792,7 +792,8 @@ RendererType RendererTypeForUrl(const std::wstring& url) {
 
 HRESULT NavigateBrowserToMoniker(IUnknown* browser, IMoniker* moniker,
                                  const wchar_t* headers, IBindCtx* bind_ctx,
-                                 const wchar_t* fragment, IStream* post_data) {
+                                 const wchar_t* fragment, IStream* post_data,
+                                 VARIANT* flags) {
   DCHECK(browser);
   DCHECK(moniker);
   DCHECK(bind_ctx);
@@ -806,13 +807,6 @@ HRESULT NavigateBrowserToMoniker(IUnknown* browser, IMoniker* moniker,
   if (FAILED(hr))
     return hr;
 
-  // Always issue the download request in a new window to ensure that the
-  // currently loaded ChromeFrame document does not inadvarently see an unload
-  // request. This runs javascript unload handlers on the page which renders
-  // the page non functional.
-  VARIANT flags = { VT_I4 };
-  V_I4(&flags) = navOpenInNewWindow | navNoHistory;
-
   // If the data to be downloaded was received in response to a post request
   // then we need to reissue the post request.
   base::win::ScopedVariant post_data_variant;
@@ -893,14 +887,14 @@ HRESULT NavigateBrowserToMoniker(IUnknown* browser, IMoniker* moniker,
 
       if (GetIEVersion() < IE_9) {
         hr = browser_priv2->NavigateWithBindCtx2(
-                uri_obj, &flags, NULL, post_data_variant.AsInput(),
+                uri_obj, flags, NULL, post_data_variant.AsInput(),
                 headers_var.AsInput(), bind_ctx,
                 const_cast<wchar_t*>(fragment));
       } else {
         IWebBrowserPriv2CommonIE9* browser_priv2_ie9 =
             reinterpret_cast<IWebBrowserPriv2CommonIE9*>(browser_priv2.get());
         hr = browser_priv2_ie9->NavigateWithBindCtx2(
-                uri_obj, &flags, NULL, post_data_variant.AsInput(),
+                uri_obj, flags, NULL, post_data_variant.AsInput(),
                 headers_var.AsInput(), bind_ctx,
                 const_cast<wchar_t*>(fragment), 0);
       }
@@ -930,7 +924,7 @@ HRESULT NavigateBrowserToMoniker(IUnknown* browser, IMoniker* moniker,
         }
 
         base::win::ScopedVariant var_url(UTF8ToWide(target_url.spec()).c_str());
-        hr = browser_priv->NavigateWithBindCtx(var_url.AsInput(), &flags, NULL,
+        hr = browser_priv->NavigateWithBindCtx(var_url.AsInput(), flags, NULL,
                                                post_data_variant.AsInput(),
                                                headers_var.AsInput(), bind_ctx,
                                                const_cast<wchar_t*>(fragment));
diff --git a/chrome_frame/utils.h b/chrome_frame/utils.h
index da5a2d2..b0352e6 100644
--- a/chrome_frame/utils.h
+++ b/chrome_frame/utils.h
@@ -302,7 +302,8 @@ HRESULT DoQueryService(const IID& service_id, IUnknown* unk, T** service) {
 // |headers| can be NULL.
 HRESULT NavigateBrowserToMoniker(IUnknown* browser, IMoniker* moniker,
                                  const wchar_t* headers, IBindCtx* bind_ctx,
-                                 const wchar_t* fragment, IStream* post_data);
+                                 const wchar_t* fragment, IStream* post_data,
+                                 VARIANT* flags);
 
 // Raises a flag on the current thread (using TLS) to indicate that an
 // in-progress navigation should be rendered in chrome frame.