If we navigate to a URL which has an anchor in IE, which eventually ends up in ChromeFrame,

the actual URL queried from the moniker passed in to our implementation of IPersistStream::Load
does not have the anchor. It looks like there are some private interfaces exposed by MSHTML and
invoked by IEFrame to pass this information over.

Our fix is to save away the url received in our Bho BeforeNavigate2 notification and use this URL
if available before querying the moniker for the URL. This needs to be done in IPersistStream::Load
and in the OnHttpEquiv patch when we initiate a navigation to the actual URL using the moniker.

Fixes bug http://code.google.com/p/chromium/issues/detail?id=27270

Bug=27270
Test=Covered by unit test.

Review URL: http://codereview.chromium.org/542096

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@36814 0039d316-1c4b-4281-b951-d872f2087c98

1 files changed, 19 insertions, 4 deletions

diff --git a/chrome_frame/bho.cc b/chrome_frame/bho.cc
index f0bd64e..896ca65 100644
--- a/chrome_frame/bho.cc
+++ b/chrome_frame/bho.cc
@@ -147,7 +147,7 @@ STDMETHODIMP Bho::BeforeNavigate2(IDispatch* dispatch, VARIANT* url,
       }
     }
   }
-
+  url_ = url->bstrVal;
   return S_OK;
 }
 
@@ -268,14 +268,29 @@ HRESULT Bho::OnHttpEquiv(IBrowserService_OnHttpEquiv_Fn original_httpequiv,
 
           // If there's a referrer, preserve it.
           std::wstring headers;
+          // Pass in URL fragments if applicable.
+          std::wstring fragment;
+
           Bho* chrome_frame_bho = Bho::GetCurrentThreadBhoInstance();
-          if (chrome_frame_bho && !chrome_frame_bho->referrer().empty()) {
-            headers = StringPrintf(L"Referer: %ls\r\n\r\n",
+          if (chrome_frame_bho) {
+            if (!chrome_frame_bho->referrer().empty()) {
+              headers = StringPrintf(L"Referer: %ls\r\n\r\n",
                 ASCIIToWide(chrome_frame_bho->referrer()).c_str());
+            }
+            // If the original URL contains an anchor, then the URL queried
+            // from the moniker does not contain the anchor. To workaround
+            // this we retrieve the URL from our BHO.
+            std::wstring moniker_url = GetActualUrlFromMoniker(
+                moniker, NULL, chrome_frame_bho->url());
+
+            GURL parsed_moniker_url(moniker_url);
+            if (parsed_moniker_url.has_ref()) {
+              fragment = UTF8ToWide(parsed_moniker_url.ref());
+            }
           }
 
           hr = NavigateBrowserToMoniker(browser, moniker, headers.c_str(),
-                                        bind_context);
+                                        bind_context, fragment.c_str());
 
           if (SUCCEEDED(hr)) {
             // Now that we've reissued the request, we need to remove the