--- a/ChangeLog	Wed Apr 02 22:17:14 2008 +0200
+++ b/ChangeLog	Fri Apr 04 00:23:21 2008 +0200
@@ -47,6 +47,8 @@
  - Added code to ignore the first <P> after <LI>.
  - Added a http_referer preference. See details in dillorc2.
  - Added a text placeholder: "[IMG]" for img_off mode.
+ - Fixed a SEGFAULT bug in http.c (handling of web->url).
+ - Fixed handling of #anchors with repush, and other operations.
    Patches: Jorge Arellano Cid
 +- Connected signals to <li> elements (fixes links within lists).
  - Enabled text, background-color, panel_size, geometry, fullscreen,

--- a/dlib/dlib.h	Wed Apr 02 22:17:14 2008 +0200
+++ b/dlib/dlib.h	Fri Apr 04 00:23:21 2008 +0200
@@ -133,6 +133,7 @@
 void dList_free (Dlist *lp);
 void dList_append (Dlist *lp, void *data);
 void dList_prepend (Dlist *lp, void *data);
+void dList_insert_pos (Dlist *lp, void *data, int pos0);
 int  dList_length (Dlist *lp);
 void dList_remove (Dlist *lp, const void *data);
 void dList_remove_fast (Dlist *lp, const void *data);

--- a/src/IO/http.c	Wed Apr 02 22:17:14 2008 +0200
+++ b/src/IO/http.c	Fri Apr 04 00:23:21 2008 +0200
@@ -55,7 +55,6 @@
 /* 'Url' and 'web' are just references (no need to deallocate them here). */
 typedef struct {
    int SockFD;
-   const DilloUrl *Url;    /* reference to original URL */
    uint_t port;            /* need a separate port in order to support PROXY */
    bool_t use_proxy;       /* indicates whether to use proxy or not */
    DilloWeb *web;          /* reference to client's web structure */
@@ -293,12 +292,12 @@
    DataBuf *dbuf;
 
    /* Create the query */
-   query = a_Http_make_query_str(S->Url, S->use_proxy);
+   query = a_Http_make_query_str(S->web->url, S->use_proxy);
    dbuf = a_Chain_dbuf_new(query->str, query->len, 0);
 
    /* actually this message is sent too early.
     * It should go when the socket is ready for writing (i.e. connected) */
-   _MSG_BW(S->web, 1, "Sending query to %s...", URL_HOST_(S->Url));
+   _MSG_BW(S->web, 1, "Sending query to %s...", URL_HOST_(S->web->url));
 
    /* send query */
    a_Chain_link_new(Info, a_Http_ccc, BCK, a_IO_ccc, 1, 1);
@@ -444,7 +443,7 @@
       } else {
          /* DNS wasn't able to resolve the hostname */
          MSG_BW(S->web, 0, "ERROR: Dns can't resolve %s",
-            (S->use_proxy) ? URL_HOST_(HTTP_Proxy) : URL_HOST_(S->Url));
+            (S->use_proxy) ? URL_HOST_(HTTP_Proxy) : URL_HOST_(S->web->url));
          a_Chain_fcb(OpAbort, S->Info, NULL, NULL);
          dFree(S->Info);
          Http_socket_free(SKey);
@@ -467,24 +466,22 @@
    S = a_Klist_get_data(ValidSocks, VOIDP2INT(Info->LocalKey));
    /* Reference Web data */
    S->web = Data1;
-   /* Reference URL data */
-   S->Url = S->web->url;
    /* Reference Info data */
    S->Info = Info;
 
    /* Proxy support */
-   if (Http_must_use_proxy(S->Url)) {
+   if (Http_must_use_proxy(S->web->url)) {
       hostname = dStrdup(URL_HOST(HTTP_Proxy));
       S->port = URL_PORT(HTTP_Proxy);
       S->use_proxy = TRUE;
    } else {
-      hostname = dStrdup(URL_HOST(S->Url));
-      S->port = URL_PORT(S->Url);
+      hostname = dStrdup(URL_HOST(S->web->url));
+      S->port = URL_PORT(S->web->url);
       S->use_proxy = FALSE;
    }
 
    /* Let the user know what we'll do */
-   MSG_BW(S->web, 1, "DNS resolving %s", URL_HOST_(S->Url));
+   MSG_BW(S->web, 1, "DNS resolving %s", URL_HOST_(S->web->url));
 
    /* Let the DNS engine resolve the hostname, and when done,
     * we'll try to connect the socket from the callback function */

--- a/src/history.c	Wed Apr 02 22:17:14 2008 +0200
+++ b/src/history.c	Fri Apr 04 00:23:21 2008 +0200
@@ -13,6 +13,7 @@
  * Linear history (it also provides indexes for the navigation stack)
  */
 
+#include "msg.h"
 #include "list.h"
 #include "history.h"
 
@@ -30,6 +31,19 @@
 
 
 /*
+ * Debug procedure.
+ */
+void History_show()
+{
+   int i;
+
+   MSG("  {");
+   for (i = 0; i < history_size; ++i)
+      MSG(" %s", URL_STR(history[i].url));
+   MSG(" }\n");
+}
+
+/*
  * Add a new H_Item at the end of the history list
  * (taking care of not making a duplicate entry)
  */
@@ -37,16 +51,26 @@
 {
    int i, idx;
 
+   _MSG("a_History_add_url: '%s' ", URL_STR(url));
    for (i = 0; i < history_size; ++i)
       if (!a_Url_cmp(history[i].url, url) &&
           !strcmp(URL_FRAGMENT(history[i].url), URL_FRAGMENT(url)))
-         return i;
+         break;
 
-   idx = history_size;
-   a_List_add(history, history_size, history_size_max);
-   history[idx].url = a_Url_dup(url);
-   history[idx].title = NULL;
-   ++history_size;
+   if (i < history_size) {
+      idx = i;
+      _MSG("FOUND at idx=%d\n", idx);
+   } else {
+      idx = history_size;
+      a_List_add(history, history_size, history_size_max);
+      history[idx].url = a_Url_dup(url);
+      history[idx].title = NULL;
+      ++history_size;
+      _MSG("ADDED at idx=%d\n", idx);
+   }
+
+   /* History_show(); */
+
    return idx;
 }
 
@@ -68,6 +92,9 @@
  */
 DilloUrl *a_History_get_url(int idx)
 {
+   _MSG("a_History_get_url: ");
+   /* History_show(); */
+
    dReturn_val_if_fail(idx >= 0 && idx < history_size, NULL);
 
    return history[idx].url;

--- a/src/nav.c	Wed Apr 02 22:17:14 2008 +0200
+++ b/src/nav.c	Fri Apr 04 00:23:21 2008 +0200
@@ -109,27 +109,41 @@
 }
 
 /*
- * Add a nav_stack_item into the stack.
- * If idx is not at the top, the stack is truncated at idx before adding.
+ * Truncate the navigation stack including 'pos' and upwards.
  */
-static void Nav_stack_add(BrowserWindow *bw, int url_idx, int posx, int posy)
+static void Nav_stack_truncate(BrowserWindow *bw, int pos)
 {
-   int j;
+   void *data;
+
+   dReturn_if_fail (bw != NULL && pos >= 0);
+
+   while (pos < dList_length(bw->nav_stack)) {
+      data = dList_nth_data(bw->nav_stack, pos);
+      dList_remove_fast (bw->nav_stack, data);
+   }
+}
+
+/*
+ * Insert a nav_stack_item into the stack at a given position.
+ */
+static void Nav_stack_insert(BrowserWindow *bw, int url_idx,
+                             int stack_idx, int posx, int posy)
+{
    void *data;
    nav_stack_item *nsi;
 
    dReturn_if_fail (bw != NULL);
 
-   j = ++bw->nav_stack_ptr;
-   while (j < dList_length(bw->nav_stack)) {
-      data = dList_nth_data(bw->nav_stack, j);
-      dList_remove_fast (bw->nav_stack, data);
-   }
+   /* Free the old element if present */
+   if ((data = dList_nth_data(bw->nav_stack, stack_idx)))
+      dFree(data);
+
+   /* Insert the new element */
    nsi = dNew(nav_stack_item, 1);
    nsi->url_idx = url_idx;
    nsi->posx = posx;
    nsi->posy = posy;
-   dList_append (bw->nav_stack, nsi);
+   dList_insert_pos (bw->nav_stack, nsi, stack_idx);
 }
 
 /*
@@ -148,9 +162,9 @@
 }
 
 /*
- * Set the scrolling position of the current page.
+ * Save the scrolling position of the current page.
  */
-static void Nav_set_scroll_pos(BrowserWindow *bw, int idx, int posx, int posy)
+static void Nav_save_scroll_pos(BrowserWindow *bw, int idx, int posx, int posy)
 {
    nav_stack_item *nsi;
 
@@ -201,14 +215,14 @@
    /* Get the url of the current page */
    idx = a_Nav_stack_ptr(bw);
    old_url = a_History_get_url(NAV_UIDX(bw, idx));
-   _MSG("Nav_open_url:  idx=%d old_url='%s'\n", idx, URL_STR(old_url));
+   MSG("Nav_open_url:  old_url='%s' idx=%d\n", URL_STR(old_url), idx);
    /* Record current scrolling position */
    if (URL_FLAGS(url) & URL_ReloadFromCache) {
       /* Repush operation, don't change scroll position */
    } else if (old_url) {
       a_UIcmd_get_scroll_xy(bw, &x, &y);
-      Nav_set_scroll_pos(bw, idx, x, y);
-      _MSG("Nav_open_url:  saved scroll of '%s' at x=%d y=%d\n",
+      Nav_save_scroll_pos(bw, idx, x, y);
+      MSG("Nav_open_url:  saved scroll of '%s' at x=%d y=%d\n",
           URL_STR(old_url), x, y);
    }
 
@@ -236,14 +250,6 @@
          a_Bw_add_url(bw, url);
       }
    }
-
-   // /* Jump to #anchor position */
-   // if (URL_FRAGMENT_(url)) {
-   //    /* todo: push on stack */
-   //    char *pf = a_Url_decode_hex_str(URL_FRAGMENT_(url));
-   //    //a_Dw_render_layout_set_anchor(bw->render_layout, pf);
-   //    dFree(pf);
-   // }
 }
 
 /*
@@ -266,37 +272,50 @@
  */
 void a_Nav_expect_done(BrowserWindow *bw)
 {
-   int url_idx, posx, posy;
+   int url_idx, posx, posy, repush, goto_old_scroll = 1;
    DilloUrl *url;
-   char *f;
+   char *fragment = NULL;
 
    dReturn_if_fail(bw != NULL);
 
    if (bw->nav_expecting) {
       url = bw->nav_expect_url;
+      repush = (URL_FLAGS(url) & URL_ReloadFromCache);
+      fragment = a_Url_decode_hex_str(URL_FRAGMENT_(url));
+
       /* unset E2EReload before adding this url to history */
       a_Url_set_flags(url, URL_FLAGS(url) & ~URL_E2EReload);
       /* unset ReloadFromCache before adding this url to history */
       a_Url_set_flags(url, URL_FLAGS(url) & ~URL_ReloadFromCache);
       url_idx = a_History_add_url(url);
-      Nav_stack_add(bw, url_idx, 0, 0);
-      /* Scroll to the origin unless there's a fragment part */
-      f = a_Url_decode_hex_str(URL_FRAGMENT_(url));
-      if (!f) {
-         a_UIcmd_set_scroll_xy(bw, 0, 0);
+
+      Nav_get_scroll_pos(bw, &posx, &posy);
+      if (repush) {
+         MSG("a_Nav_expect_done: repush!\n");
       } else {
-         a_UIcmd_set_scroll_by_fragment(bw, f);
-         dFree(f);
+         Nav_stack_truncate(bw, a_Nav_stack_ptr(bw) + 1);
+         Nav_stack_insert(bw, url_idx, a_Nav_stack_ptr(bw) + 1, 0, 0);
+         Nav_stack_move_ptr(bw, 1);
       }
-      a_Url_free(url);
-      bw->nav_expect_url = NULL;
-      bw->nav_expecting = FALSE;
-   } else {
+      if (fragment && posx == 0 && posy == 0)
+         goto_old_scroll = 0;
+      a_Nav_cancel_expect(bw);
+   }
+
+   if (goto_old_scroll) {
       /* Scroll to were we were in this page */
       Nav_get_scroll_pos(bw, &posx, &posy);
       a_UIcmd_set_scroll_xy(bw, posx, posy);
       _MSG("Nav: expect_done scrolling to x=%d y=%d\n", posx, posy);
+   } else if (fragment) {
+      /* Scroll to fragment */
+      a_UIcmd_set_scroll_by_fragment(bw, fragment);
+   } else {
+      /* Scroll to origin */
+      a_UIcmd_set_scroll_xy(bw, 0, 0);
    }
+
+   dFree(fragment);
    Nav_stack_clean(bw);
    a_UIcmd_set_buttons_sens(bw);
    _MSG("Nav: a_Nav_expect_done\n");
@@ -327,15 +346,17 @@
  */
 static void Nav_repush(BrowserWindow *bw)
 {
-   DilloUrl *ReqURL;
+   DilloUrl *url;
 
    a_Nav_cancel_expect(bw);
    if (a_Nav_stack_size(bw)) {
-      ReqURL = a_Url_dup(a_History_get_url(NAV_TOP_UIDX(bw)));
+      url = a_Url_dup(a_History_get_url(NAV_TOP_UIDX(bw)));
       /* Let's make reload be from Cache */
-      a_Url_set_flags(ReqURL, URL_FLAGS(ReqURL) | URL_ReloadFromCache);
-      Nav_open_url(bw, ReqURL, 0);
-      a_Url_free(ReqURL);
+      a_Url_set_flags(url, URL_FLAGS(url) | URL_ReloadFromCache);
+      bw->nav_expect_url = a_Url_dup(url);
+      bw->nav_expecting = TRUE;
+      Nav_open_url(bw, url, 0);
+      a_Url_free(url);
    }
 }