From 6d411f9c7852c54df9092796dc049c8209e1186e Mon Sep 17 00:00:00 2001 From: Travis Leithead Date: Mon, 2 May 2016 16:17:41 -0700 Subject: [PATCH 01/19] CSP integrations for Issue #201 Had to adapt "resulting URL record" -> "resulting parsed URL" (will fix with changes to 2.5.2 eventually) --- sections/infrastructure.include | 23 +++++++++++------ sections/semantics-document-metadata.include | 21 ++++++++++----- single-page.bs | 27 +++++++++++++++++++- 3 files changed, 55 insertions(+), 16 deletions(-) diff --git a/sections/infrastructure.include b/sections/infrastructure.include index 52f4209aed..182f0b1599 100644 --- a/sections/infrastructure.include +++ b/sections/infrastructure.include @@ -1250,14 +1250,21 @@ : Content Security Policy :: The following terms are defined in Content Security Policy: [[CSP]] - * Content Security Policy - * Content Security Policy directive - * The Content Security Policy syntax - * enforce the policy - * The frame-ancestors directive - * The parse a serialized Content Security Policy algorithm - * The report-uri directive - * The sandbox directive + * Content Security Policy + * Content Security Policy directive + * The Content Security Policy syntax + * enforce the policy + * The parse a serialized Content Security Policy algorithm + * The Initialize a global object's CSP list algorithm + * The Initialize a Document's CSP list algorithm + * The Should element's inline behavior be blocked by Content Security Policy? algorithm + * The report-uri directive + * The EnsureCSPDoesNotBlockStringCompilation abstract algorithm + * The Is base allowed for Document? algorithm + :: The following terms are defined in Content Security Policy: Document Features + + * The frame-ancestors directive + * The sandbox directive : Service Workers :: The following terms are defined in Service Workers: [[!SERVICE-WORKERS]] diff --git a/sections/semantics-document-metadata.include b/sections/semantics-document-metadata.include index 01102d412a..152464ef6a 100644 --- a/sections/semantics-document-metadata.include +++ b/sections/semantics-document-metadata.include @@ -248,8 +248,9 @@ A <{base}> element that is the first <{base}> element with an <{base/href}> content attribute in a particular {{Document}} has a - frozen base URL. The frozen base URL must be immediately set - whenever any of the following situations occur: + frozen base URL. The frozen base URL must be immediately + set for an element whenever any of the following situations + occur: * The <{base}> element becomes the first <{base}> element in tree order with an <{base/href}> content attribute in its {{Document}}. @@ -258,11 +259,17 @@ an <{base/href}> content attribute in its {{Document}}, and its <{base/href}> content attribute is changed. - To set the frozen base URL, resolve the value of the element's - <{base/href}> content attribute relative to the {{Document}}'s - fallback base URL; if this is successful, set the frozen base URL to the - resulting absolute URL, otherwise, set the frozen base URL to the - fallback base URL. + To set the frozen base URL, for an element element: + + 1. Let document be element's node document. + 2. Let urlRecord be teh result of parsing the value of + element's <{base/href}> content attribute with document's + fallback base URL, and document's character encoding. (Thus the + <{base}> element isn't affected by itself.) + 3. Set elements's frozen base URL to document's fallback base + URL, if urlRecord is failure or running Is base allowed for Document? + on the resulting parsed URL and document returns "Blocked", + and to urlRecord otherwise. The href IDL attribute, on getting, must return the result of running the following algorithm: diff --git a/single-page.bs b/single-page.bs index 8298073625..b879fb4e83 100644 --- a/single-page.bs +++ b/single-page.bs @@ -505,7 +505,32 @@ urlPrefix: https://www.w3.org/TR/workers/#; type: interface; text: WorkerGlobalScope url: http://www.w3.org/TR/2dcontext/#imagedata; type: interface; text: ImageData - +url: https://www.w3.org/TR/CSP3/#policy; type: dfn; + text: Content Security Policy +url: https://www.w3.org/TR/CSP3/#directives; type: dfn; + text: Content Security Policy directive +url: https://www.w3.org/TR/CSP3/#grammardef-serialized-policy; type: dfn; + text: Content Security Policy syntax +url: https://www.w3.org/TR/CSP3/#enforced; type: dfn; + text: enforce the policy +url: https://www.w3.org/TR/CSP3/#parse-serialized-policy; type: dfn; + text: parse a serialized Content Security Policy +url: https://w3c.github.io/webappsec-csp/document/#frame-ancestors; type: dfn; + text: frame-ancestors directive +url: https://w3c.github.io/webappsec-csp/document/#allow-base-for-document; type: dfn; + text: Is base allowed for Document? +url: https://w3c.github.io/webappsec-csp/document/#sandbox; type: dfn; + text: sandbox directive +url: https://www.w3.org/TR/CSP3/#report-uri; type: dfn; + text: report-uri directive +url: https://www.w3.org/TR/CSP3/#can-compile-strings; type: dfn; + text: EnsureCSPDoesNotBlockStringCompilation +url: https://w3c.github.io/webappsec-csp/#initialize-global-object-csp; type: dfn; + text: Initialize a global object's CSP list +url: https://w3c.github.io/webappsec-csp/#initialize-document-csp; type: dfn; + text: Initialize a Document's CSP list +url: https://w3c.github.io/webappsec-csp/#should-block-inline; type: dfn; + text: Should element's inline behavior be blocked by Content Security Policy? - + The message attribute must return the + value it was initialized to. It represents the error message. -
+ The filename attribute must return the value it + was initialized to. It represents the absolute URL of the script in which the error + originally occurred. - When an algorithm running in parallel is to await a stable state, the - user agent must queue a microtask that runs the following steps, and must then stop - executing (execution of the algorithm resumes when the microtask is run, as described in the - following steps): + The lineno attribute must return the value it + was initialized to. It represents the line number where the error occurred in the script. -
    + The colno attribute must return the value it + was initialized to. It represents the column number where the error occurred in the script. -
  1. Run the algorithm's synchronous section.
  2. + The error attribute must return the value it + was initialized to. Where appropriate, it is set to the object representing the error + (e.g., the exception object in the case of an uncaught DOM exception). -
  3. Resumes execution of the algorithm in parallel, if appropriate, as described - in the algorithm's steps.
  4. +
    Unhandled promise rejections
    -
+ In addition to synchronous runtime script errors, scripts may experience asynchronous + promise rejections, tracked via the unhandledrejection and + rejectionhandled events. + + When the user agent is to notify about rejected promises on a given environment + settings object settings object, it must run these steps: + + 1. Let list be a copy of settings object's about-to-be-notified + rejected promises list. + 2. If list is empty, abort these steps. + 3. Clear settings object's about-to-be-notified rejected promises list. + 4. Queue a task to run the following substep: + + 1. For each promise p in list: + + 1. If p's \[[PromiseIsHandled]] internal slot is true, continue to the next + iteration of the loop. + 2. Let event be a new trusted PromiseRejectionEvent object + that does not bubble but is cancelable, and which has the event name + unhandledrejection. + 3. Initialise event's {{PromiseRejectionEvent/promise}} attribute to + p. + 4. Initialise event's {{PromiseRejectionEvent/reason}} attribute to the value + of p's \[[PromiseResult]] internal slot. + 5. Dispatch event at settings object's global object. + 6. If the event was canceled, then the promise rejection is handled. Otherwise, the + promise rejection is not handled. + 7. If p's \[[PromiseIsHandled]] internal slot is false, add p to + settings object's outstanding rejected promises weak set. + + This algorithm results in promise rejections being marked as handled or + not handled. These concepts parallel handled and + not handled script errors. If a rejection is still + not handled after this, then the rejection may be reported to a developer + console. -

- Steps in synchronous sections are marked - with ⌛. -

+
The HostPromiseRejectionTracker implementation
-
+ ECMAScript contains an implementation-defined + HostPromiseRejectionTracker(promise, operation) abstract operation. + User agents must use the following implementation: [[!ECMA-262]] - When an algorithm says to spin the event loop until a condition goal is met, the user agent must run the following steps: + 1. Let script be the running script. + 2. If script has muted errors, terminate these steps. + 3. Let settings object be script's settings object. + 4. If operation is "reject", + 1. Add promise to settings object's about-to-be-notified + rejected promises list. + 5. If operation is "handle", + 1. If settings object's about-to-be-notified rejected promises list contains + promise, remove promise from that list and abort these steps. + 2. If settings object's outstanding rejected promises weak set does not + contain promise, abort these steps. + 3. Remove promise from settings object's outstanding rejected + promises weak set. + 4. Queue a task to run the following steps: -
    + 1. Let event be a new trusted {{PromiseRejectionEvent}} object that does + not bubble and is not cancelable, and which has the event name + rejectionhandled. + 2. Initialise event's {{PromiseRejectionEvent/promise}} attribute to + promise. + 3. Initialise event's {{PromiseRejectionEvent/reason}} attribute to the value + of promise's \[[PromiseResult]] internal slot. + 4. Dispatch event at settings object's global object. -
  1. +
    The PromiseRejectionEvent interface
    - Let task be the event loop's currently running - task. +
    +    [Constructor(DOMString type, PromiseRejectionEventInit eventInitDict), Exposed=(Window,Worker)]
    +    interface PromiseRejectionEvent : Event {
    +      readonly attribute Promise<any> promise;
    +      readonly attribute any reason;
    +    };
    +  
    -

    - This might be a microtask, in which case it is a solitary - callback microtask. It could also be a compound microtask subtask, or a - regular task that is not a microtask. It will - not be a compound microtask. -

    +
    +    dictionary PromiseRejectionEventInit : EventInit {
    +      required Promise<any> promise;
    +      any reason;
    +    };
    +  
    -
  2. + The promise attribute must return + the value it was initialized to. It represents the promise which this notification is about. -
  3. Let task source be task's task - source.
  4. + The reason attribute must return + the value it was initialized to. It represents the rejection reason for the promise. -
  5. Let old stack of script settings objects be a copy of the stack - of script settings objects.
  6. +

    Event loops

    -
  7. Empty the stack of script settings objects.
  8. +
    Definitions
    -
  9. Run the global script clean-up jobs.
  10. + To coordinate events, user interaction, scripts, rendering, networking, and so forth, user agents + must use event loops as described in this section. There + are two kinds of event loops: those for browsing contexts, and those for + {{worker|workers}}. -
  11. Perform a microtask checkpoint.
  12. + There must be at least one browsing context event loop per user + agent, and at most one per unit of related similar-origin browsing contexts. -
  13. +

    + When there is more than one event loop for a unit of related browsing contexts, + complications arise when a browsing context in that group is navigated such that it + switches from one unit of related similar-origin browsing contexts to another. This + specification does not currently describe how to handle these complications.

    - Stop task, allowing whatever algorithm that invoked it to resume, but - continue these steps in parallel. + A browsing context event loop always has at least one browsing context. If + such an event loop's browsing contexts all go away, then the event loop goes + away as well. A browsing context always has an event loop coordinating its + activities. -

    - This causes one of the following algorithms to continue: the event loop's main set of steps, the perform a microtask checkpoint algorithm, or - the execute a compound microtask subtask algorithm to continue. -

    + Worker event loops are simpler: each worker has one event loop, and the worker + processing model manages the event loop's lifetime. -
  14. +
    -
  15. Wait until the condition goal is met.
  16. + An event loop has one or more task queues. A task queue is an ordered + list of tasks, which are algorithms that are responsible for such work as: -
  17. Queue a task to continue running these steps, using the task - source task source. Wait until this new task runs before continuing - these steps.
  18. + : Events + :: Dispatching an {{Event}} object at a particular {{EventTarget}} object is often done by a + dedicated task. -
  19. Replace the stack of script settings objects with the old - stack of script settings objects.
  20. +

    Not all events are dispatched using the task queue, many are + dispatched during other tasks.

    -
  21. Return to the caller.
  22. + : Parsing + :: The HTML parser tokenizing one or more bytes, and then processing any resulting tokens, + is typically a task. -
+ : Callbacks + :: Calling a callback is often done by a dedicated task. -
+ : Using a resource + :: When an algorithm fetches a resource, if the fetching occurs in a non-blocking fashion + then the processing of the resource once some or all of the resource is available is performed + by a task. - Some of the algorithms in this specification, for historical reasons, require the user agent to - pause while running a task until a condition goal is met. This means running the following steps: + : Reacting to DOM manipulation + :: Some elements have tasks that trigger in response to DOM manipulation, e.g., when that element + is inserted into the document. -
    + Each task in a browsing context event loop is associated with a {{Document}}; + if the task was queued in the context of an element, then it is the element's + node document; if the task was queued in the context of a browsing context, then it + is the browsing context's active document at the time the task was queued; if the + task was queued by or for a script then the document is the + responsible document specified by the script's settings object. -
  1. If necessary, update the rendering or user interface of any Document or - browsing context to reflect the current state.
  2. + A task is intended for a specific event loop: the event loop that is handling + tasks for the task's associated {{Document}} or {{worker}}. -
  3. Wait until the condition goal is met. While a user agent has a paused - task, the corresponding event loop must not run - further tasks, and any script in the currently running task must block. User agents should remain responsive to user input - while paused, however, albeit in a reduced capacity since the event loop will not be - doing anything.
  4. + When a user agent is to queue a task, it must + add the given task to one of the task queues of the relevant event loop. -
+ Each task is defined as coming from a specific task source. All the tasks from + one particular task source and destined to a particular event loop (e.g., the + callbacks generated by timers of a {{Document}}, the events fired for mouse movements over that + {{Document}}, the tasks queued for the parser of that Document) must always be added + to the same task queue, but tasks from different task sources may be placed + in different task queues. -
Generic task sources
+

+ For example, a user agent could have one task queue for mouse and + key events (the user interaction task source), and another for everything else. The + user agent could then give keyboard and mouse events preference over other tasks three quarters of + the time, keeping the interface responsive but not starving other task queues, and never + processing events from any one task source out of order. +

- The following task sources are used by a number of mostly - unrelated features in this and other specifications. + Each event loop has a currently running task. Initially, this is null. + It is used to handle reentrancy. Each event loop also has a performing a + microtask checkpoint flag, which must initially be false. It is used to prevent reentrant + invocation of the perform a microtask checkpoint algorithm. -
+
Processing model
-
The DOM manipulation task source
+ An event loop must continually run through the following steps for as long as it exists: + + 1. Select the oldest task on one of the event loop's task queues, if any, + ignoring, in the case of a browsing context event loop, tasks whose associated + {{Document}}s are not fully active. The user agent may pick any task queue. If + there is no task to select, then jump to the microtasks step below. + 2. Set the event loop's currently running task to the task selected in the + previous step. + 3. Run: Run the selected task. + 4. Set the event loop's currently running task back to null. + 5. Remove the task that was run in the run step above from its task queue. + 6. Microtasks: Perform a microtask checkpoint. + 7. Update the rendering: If this event loop is a browsing context + event loop (as opposed to a {{worker}} event loop), then run the following + substeps. + + 1. Let now be the value that would be returned by the {{Performance}} object's + {{Performance/now()}} method. [[!HR-TIME-2]] + 2. Let docs be the list of {{Document}} objects associated with the + event loop in question, sorted arbitrarily except that the following conditions + must be met: + + * Any {{Document}} B that is nested through a {{Document}} A + must be listed after A in the list. + * If there are two documents A and B whose browsing contexts + are both nested browsing contexts and their browsing context containers + are both elements in the same {{Document}} C, then the order of A + and B in the list must match the relative tree order of their + respective browsing context containers in C. + + In the steps below that iterate over docs, each {{Document}} must be processed + in the order it is found in the list. + 3. If there is a top-level browsing context B that the user agent believes + would not benefit from having its rendering updated at this time, then remove from + docs all {{Document}} objects whose browsing context's top-level + browsing context is B. + +

Whether a top-level browsing context would benefit from having + its rendering updated depends on various factors, such as the update frequency. For + example, if the browser is attempting to achieve a 60 Hz refresh rate, then these steps + are only necessary every 60th of a second (about 16.7ms). If the browser finds that a + top-level browsing context is not able to sustain this rate, it might drop to a + more sustainable 30Hz for that set of {{Document}}s, rather than occasionally dropping + frames. (This specification does not mandate any particular model for when to update the + rendering.) Similarly, if a top-level browsing context is in the background, the + user agent might decide to drop that page to a much slower 4Hz, or even less.

+ +

Another example of why a browser might skip updating the rendering is to + ensure certain tasks are executed immediately after each other, with only + microtask checkpoints interleaved (and without, e.g., animation frame + callbacks interleaved). For example, a user agent might wish to coalesce timer + callbacks together, with no intermediate rendering updates.

+ 4. If there are a nested browsing contexts B that the user agent believes + would not benefit from having their rendering updated at this time, then remove from + docs all {{Document}} objects whose browsing context is in B. + +

As with top-level browsing contexts, a variety of factors can + influence whether it is profitable for a browser to update the rendering of nested + browsing contexts. For example, a user agent might wish to spend less resources + rendering third-party content, especially if it is not currently visible to the user or if + resources are constrained. In such cases, the browser could decide to update the rendering + for such content infrequently or never.

+ 5. For each fully active {{Document}} in docs, run the resize steps + for that {{Document}}, passing in now as the timestamp. [[!CSSOM-VIEW]] + 6. For each fully active {{Document}} in docs, run the scroll steps + for that {{Document}}, passing in now as the timestamp. [[!CSSOM-VIEW]] + 7. For each fully active {{Document}} in docs, evaluate media queries and + report changes for that {{Document}}, passing in now as the timestamp. + [[!CSSOM-VIEW]] + 8. For each fully active {{Document}} in docs, run CSS animations and + send events for that {{Document}}, passing in now as the timestamp. + [[CSS3-ANIMATIONS]] + 9. For each fully active {{Document}} in docs, run the fullscreen + rendering steps for that {{Document}}, passing in now as the timestamp. + [[!FULLSCREEN]] + 10. For each fully active {{Document}} in docs, run the animation frame + callbacks for that {{Document}}, passing in now as the timestamp. + 11. For each fully active {{Document}} in docs, run the update + intersection observations steps for that {{Document}}, passing in now as + the timestamp. + 12. For each fully active {{Document}} in docs, update the rendering or user + interface of that {{Document}} and its browsing context to reflect the current + state. + 8. If this is a {{worker}} event loop (i.e., one running for a {{WorkerGlobalScope}}), but + there are no tasks in the event loop's task queues and the + {{WorkerGlobalScope}} object's closing flag is true, then destroy the + event loop, aborting these steps, resuming the run a worker steps. + 9. Return to the first step of the event loop. -
+
- This task source is used for features that react to DOM manipulations, such as - things that happen in a non-blocking fashion when an element is inserted into the document. + Each event loop has a microtask queue. A microtask is a task + that is originally to be queued on the microtask queue rather than a task queue. + There are two kinds of microtasks: solitary callback microtasks, and + compound microtasks. + +

This specification only has solitary callback microtasks. Specifications + that use compound microtasks have to take extra care to wrap callbacks to handle + spinning the event loop.

+ + When an algorithm requires a microtask to be + queued, it must be appended to the relevant + event loop's microtask queue; the task source of such a microtask is + the microtask task source. + +

It is possible for a microtask to be moved to a regular task queue, + if, during its initial execution, it spins the event loop. In that case, the microtask + task source is the task source used. Normally, the task source of a + microtask is irrelevant.

+ + When a user agent is to + perform a microtask checkpoint, + if the performing a microtask checkpoint flag is false, then the user agent must run the + following steps: + + 1. Let the performing a microtask checkpoint flag be true. + 2. Microtask queue handling: If the event loop's microtask queue is + empty, jump to the done step below. + 3. Select the oldest microtask on the event loop's microtask queue. + 4. Set the event loop's currently running task to the task selected in the + previous step. + 5. Run: Run the selected task. + +

This might involve invoking scripted callbacks, which eventually calls the + clean up after running script steps, which call this perform a microtask + checkpoint algorithm again, which is why we use the performing a microtask + checkpoint flag to avoid reentrancy.

+ 6. Set the event loop's currently running task back to null. + 7. Remove the microtask run in the step above from the microtask queue, and return + to the microtask queue handling step. + 8. Done: For each environment settings object whose responsible event + loop is this event loop, notify about rejected promises on that + environment settings object. + 9. Let the performing a microtask checkpoint flag be false. -
+ If, while a compound microtask is running, the user agent is required to + execute a compound microtask subtask + to run a series of steps, the user agent must run the following steps: + + 1. Let parent be the event loop's currently running task (the currently + running compound microtask). + 2. Let subtask be a new task that consists of running the given series of steps. + The task source of such a microtask is the microtask task source. This is + a compound microtask subtask. + 3. Set the event loop's currently running task to subtask. + 4. Run subtask. + 5. Set the event loop's currently running task back to parent. -
The user interaction task source
+
-
+ When an algorithm running in parallel is to + await a stable state, the + user agent must queue a microtask that runs the following steps, and must then stop + executing (execution of the algorithm resumes when the microtask is run, as described in the + following steps): - This task source is used for features that react to user interaction, for - example keyboard or mouse input. + 1. Run the algorithm's synchronous section. + 2. Resumes execution of the algorithm in parallel, if appropriate, as described in the + algorithm's steps. - Events sent in response to user input (e.g., click events) must be fired using tasks queued with the user - interaction task source. [[!UIEVENTS]] +

Steps in synchronous sections are marked with ⌛.

-
+
-
The networking task source
+ When an algorithm says to + spin the event loop + until a condition goal is met, the user agent must run the following steps: + + 1. Let task be the event loop's currently running task. + +

This might be a microtask, in which case it is a solitary callback + microtask. It could also be a compound microtask subtask, or a regular task + that is not a microtask. It will not be a compound microtask.

+ 2. Let task source be task's task source. + 3. Let old stack be a copy of the JavaScript execution context stack. + 4. Empty the JavaScript execution context stack. + 5. Run the global script clean-up jobs. + 6. Perform a microtask checkpoint. + 7. Stop task, allowing whatever algorithm that invoked it to resume, but continue these + steps in parallel. + +

This causes one of the following algorithms to continue: the + event loop's main set of steps, the perform a microtask checkpoint algorithm, or + the execute a compound microtask subtask algorithm to continue.

+ 8. Wait until the condition goal is met. + 9. Queue a task to continue running these steps, using the task source + task source. Wait until this new task runs before continuing these steps. + 10. Replace the JavaScript execution context stack with the old stack. + 11. Return to the caller. -
+
- This task source is used for features that trigger in response to network - activity. + Some of the algorithms in this specification, for historical reasons, require the user agent to + pause while running a task until a + condition goal is met. This means running the following steps: -
+ 1. If necessary, update the rendering or user interface of any {{Document}} or + browsing context to reflect the current state. + 2. Wait until the condition goal is met. While a user agent has a paused task, + the corresponding event loop must not run further tasks, and any script in the + currently running task must block. User agents should remain responsive to user input + while paused, however, albeit in a reduced capacity since the event loop will not be + doing anything. -
The history traversal task source
+
Generic task sources
-
+ The following task sources are used by a number of mostly unrelated features in this and + other specifications. - This task source is used to queue calls to history.back() and similar APIs. + : The DOM manipulation task source + :: This task source is used for features that react to DOM manipulations, such as things + that happen in a non-blocking fashion when an element is inserted into the + document. + + : The user interaction task source + :: This task source is used for features that react to user interaction, for example + keyboard or mouse input. -
+ Events sent in response to user input (e.g., click events) must be fired using + tasks queued with the user interaction task source. [[!UIEVENTS]] -
+ : The networking task source + :: This task source is used for features that trigger in response to network activity. - + : The history traversal task source + :: This task source is used to queue calls to {{History/back()|history.back()}} and + similar APIs.

Events

Event handlers
- Many objects can have event handlers specified. These act as non-capture event - listeners for the object on which they are specified. [[!DOM]] + Many objects can have event handlers specified. These + act as non-capture event listeners for the object on which they are specified. [[!DOM]] An event handler has a name, which always starts with "on" and is followed by the name of the event for which it is intended. - An event handler has a value, which is either null, or is a callback - object, or is an internal raw uncompiled handler. The - EventHandler callback function type describes how this is exposed to scripts. - Initially, an event handler's value must be set to null. + An event handler has a value, which is either null, or is a callback object, or is an + internal raw uncompiled handler. The {{EventHandler}} callback function type describes how + this is exposed to scripts. Initially, an event handler's value must be set to null. Event handlers are exposed in one of two ways. The first way, common to all event handlers, is as an event handler IDL attribute. - The second way is as an event handler content - attribute. Event handlers on html elements and some of the event handlers on - Window objects are exposed in this way. - -
+ The second way is as an event handler content attribute. Event handlers on + html elements and some of the event handlers on {{Window}} objects are exposed in this way.
- An event handler IDL attribute is an IDL - attribute for a specific event handler. The name of the IDL - attribute is the same as the name of the event handler. + An event handler IDL attribute + is an IDL attribute for a specific event handler. The name of the IDL attribute is the same + as the name of the event handler. - Event handler IDL attributes, on setting, must set the corresponding event handler to their new value, and on getting, must return the - result of getting the current value of the event handler in question (this can throw - an exception, in which case the getting propagates it to the caller, it does not catch it). + Event handler IDL attributes, on setting, must set the corresponding event handler + to their new value, and on getting, must return the result of getting the current value of the + event handler in question (this can throw an exception, in which case the getting propagates + it to the caller, it does not catch it). - If an event handler IDL attribute exposes an - event handler of an object that doesn't exist, it must always - return null on getting and must do nothing on setting. + If an event handler IDL attribute exposes an event handler of an object that doesn't + exist, it must always return null on getting and must do nothing on setting. -

- This can happen in particular for event - handler IDL attribute on <{body}> elements that do not have corresponding - Window objects. -

+

This can happen in particular for event handler IDL attribute on <{body}> + elements that do not have corresponding {{Window}} objects.

-

- Certain event handler IDL attributes have additional requirements, in particular - the onmessage attribute of - MessagePort objects. -

+

Certain event handler IDL attributes have additional requirements, in particular + the onmessage attribute of {{MessagePort}} objects.


-
- - An event handler content attribute is a - content attribute for a specific event handler. The name of - the content attribute is the same as the name of the event - handler. - - Event handler content attributes, when specified, must contain valid JavaScript - code which, when parsed, would match the FunctionBody production after - automatic semicolon insertion. [[!ECMA-262]] + An event handler content attribute + is a content attribute for a specific event handler. The name of the content attribute is + the same as the name of the event handler. -
+ Event handler content attributes, when specified, must contain valid JavaScript code which, + when parsed, would match the FunctionBody production after automatic semicolon insertion. + [[!ECMA-262]] - When an event handler content attribute - is set, execute the following steps:

+ When an event handler content attribute is set, execute the following steps: 1. If the Should element's inline behavior be blocked by Content Security Policy? algorithm - returns "Blocked" when executed upon the attribute's element and - "script attribute", then abort these steps. [[!CSP3]] + returns "Blocked" when executed upon the attribute's element + "script attribute", and the attribute's value, then abort these steps. [[!CSP3]] 2. Set the corresponding event handler to an internal raw uncompiled handler consisting of the attribute's new value and the script location where the attribute was set to - this value + this value. - When an event handler content attribute is removed, the user agent must set the corresponding - event handler to null. + When an event handler content attribute is removed, the user agent must set the + corresponding event handler to null.
- When an event handler H of an element - or object T implementing the EventTarget interface is first set - to a non-null value, the user agent must append an event - listener to the list of event listeners - associated with T with type set to the event handler event - type corresponding to H, capture set to false, and - callback set to the event handler processing algorithm defined below. [[!DOM]] + When an event handler H of an element or object T implementing the + {{EventTarget}} interface is first set to a non-null value, the user agent must append an event + listener to the list of event listeners associated with T with type + set to the event handler event type corresponding to H, and + callback set to the event handler processing algorithm defined below. [[!DOM]] -

- The callback is emphatically not the event handler itself. Every event handler ends up registering the same - callback, the algorithm defined below, which takes care of invoking the right callback, and - processing the callback's return value. -

+

The callback is emphatically not the event handler + itself. Every event handler ends up registering the same callback the algorithm + defined below, which takes care of invoking the right callback, and processing the callback's + return value.

This only happens the first time the event @@ -1511,8 +1462,6 @@ Return "run". first time the event handler was set to a non-null value.

-
-
This example demonstrates the order in which event listeners are invoked. If the button in this example is clicked by the user, the page will show four alerts, with the text "ONE", "TWO", @@ -1531,114 +1480,73 @@ Return "run".
-
- -

- The interfaces implemented by the event object do not influence whether an event handler is triggered or not. -

- - The event handler processing algorithm for an event - handler H and an Event object E is as - follows: - -
    - -
  1. - - Let callback be the result of getting the current value of the - event handler H. - -
  2. - -
  3. If callback is null, then abort these steps.
  4. - -
  5. - - Process the Event object E as follows: - -
    - -
    If E is an ErrorEvent object and the event handler IDL attribute's type is - OnErrorEventHandler
    - -
    - - Invoke callback with five - arguments, the first one having the value of E's message attribute, the second having the value of - E's filename attribute, the third - having the value of E's lineno - attribute, the fourth having the value of E's colno attribute, the fifth having the value of - E's error attribute, and with the Callback this value set to E's currentTarget. Let return value be the - callback's return value. [[!WEBIDL]] - -
    - -
    Otherwise
    - -
    - - Invoke callback - with one argument, the value of which is the Event object E, - with the Callback this value set to E's currentTarget. Let return value be the callback's return value. [[!WEBIDL]] - -
    - -
    - - In this step, invoke means to invoke the Web IDL callback function. - - If an exception gets thrown by the callback, end these steps and allow the exception to - propagate. (It will propagate to the DOM event dispatch - logic, which will then report the exception.) - -
  6. - -
  7. - - Process return value as follows: - -
    - -
    If the event type is mouseover
    -
    If the event type is error and E is an ErrorEvent object
    - -
    If return value is a Web IDL boolean true value, then cancel the event.
    +

    The interfaces implemented by the event object do not influence whether an + event handler is triggered or not.

    -
    If the event type is beforeunload
    + The event handler processing algorithm for an event handler H and an + {{Event}} object E is as follows: -
    + 1. Let callback be the result of getting the current value of the event handler + H. + 2. If callback is null, then abort these steps. + 3. Process the {{Event}} object E as follows: -

    - The event handler IDL - attribute's type is OnBeforeUnloadEventHandler, and the return value will therefore have been coerced into either the value null or a - DOMString. -

    - - If the return value is null, then cancel the event. +
    +
    If E is an {{ErrorEvent}} object and the event handler IDL attribute's + type is OnErrorEventHandler
    +
    Invoke callback with five arguments, the first one having the value of + E's {{ErrorEvent/message}} attribute, the second having the value of + E's {{ErrorEvent/filename}} attribute, the third having the value of + E's {{ErrorEvent/lineno}} attribute, the fourth having the value of + E's {{ErrorEvent/colno}} attribute, the fifth having the value of + E's {{ErrorEvent/error}} attribute, and with the + callback this value set to E's {{Event/currentTarget}}. Let + return value be the callback's return value. [[!WEBIDL]] +
    - Otherwise, If the Event object E is a - BeforeUnloadEvent object, and the Event object E's returnValue - attribute's value is the empty string, then set the returnValue attribute's value to return value. +
    Otherwise
    +
    Invoke callback with one argument, the value of which is the {{Event}} + object E, with the callback this value set to E's + {{Event/currentTarget}}. Let return value be the callback's return value. + [[!WEBIDL]] +
    +
    -
    + In this step, invoke means to invoke the Web IDL callback function. -
    Otherwise
    + If an exception gets thrown by the callback, end these steps and allow the exception to + propagate. (It will propagate to the DOM event dispatch logic, which will then + report the exception.) + 4. Process return value as follows: -
    If return value is a Web IDL boolean false value, then cancel the - event.
    +
    +
    If the event type is mouseover
    +
    If the event type is error and E is an {{ErrorEvent}} + object
    +
    If return value is a Web IDL boolean true value, then cancel the event.
    -
    +
    If the event type is beforeunload
    +
    +

    The event handler IDL attribute's type is + OnBeforeUnloadEventHandler, and the return value will therefore have + been coerced into either the value null or a DOMString.

    -
  8. + If the return value is null, then cancel the event. -
+ Otherwise, if the {{Event}} object E is a BeforeUnloadEvent object, + and the {{Event}} object E's {{Event/returnValue}} attribute's value is the + empty string, then set the {{Event/returnValue}} attribute's value to + return value. + -
+
Otherwise
+
If return value is a Web IDL boolean false value, then cancel the event.
+
- The EventHandler callback function type represents a callback used for event - handlers. It is represented in Web IDL as follows: + The {{EventHandler}} callback function type represents a callback used for event handlers. It is + represented in Web IDL as follows:
     [TreatNonObjectAsNull]
@@ -1646,10 +1554,7 @@ Return "run".
     typedef EventHandlerNonNull? EventHandler;
   
-

- In JavaScript, any Function object implements - this interface. -

+

In JavaScript, any {{Function}} object implements this interface.

For example, the following document fragment: @@ -1661,16 +1566,13 @@ Return "run". user clicks something in the page.
-

- The return value of the function affects whether the event is canceled or not: - as described above, if the return value is false, the event is canceled - (except for mouseover events, where the return value has to - be true to cancel the event). With beforeunload events, - the value is instead used to determine the message to show the user. -

+

The return value of the function affects whether the event is canceled or not: + as described above, if the return value is false, the event is canceled (except for + mouseover events, where the return value has to be true to cancel the event). With + beforeunload events, the value is instead used to determine whether or not the + message to prompt about unloading the document.

- For historical reasons, the onerror handler has different - arguments: + For historical reasons, the onerror handler has different arguments:
     [TreatNonObjectAsNull]
@@ -1687,8 +1589,6 @@ Return "run".
     typedef OnBeforeUnloadEventHandlerNonNull? OnBeforeUnloadEventHandler;
   
-
-
An internal raw uncompiled handler is a tuple with the following information: @@ -1858,13 +1758,11 @@ Return "run". -
-
Event handlers on elements, Document objects, and Window objects
- The following are the event handlers (and their corresponding event handler event types) that must be + The following are the event handlers (and their corresponding event handler event types) that must be supported by all html elements, as both event handler content attributes - and event handler IDL attributes; and that must be + and event handler IDL attributes; and that must be supported by all Document and Window objects, as event handler IDL attributes: @@ -1933,11 +1831,11 @@ Return "run".
- The following are the event handlers (and their corresponding event handler event types) that must be + The following are the event handlers (and their corresponding event handler event types) that must be supported by all html elements other than <{body}> and <{frameset}> elements, as both event handler content attributes and event handler IDL - attributes; that must be supported by all Document - objects, as event handler IDL attributes; and that must be + attributes; that must be supported by all Document + objects, as event handler IDL attributes; and that must be supported by all Window objects, as event handler IDL attributes on the Window objects themselves, and with corresponding event handler content attributes and event handler IDL attributes exposed on all body @@ -1957,7 +1855,7 @@ Return "run".
- The following are the event handlers (and their corresponding event handler event types) that must be + The following are the event handlers (and their corresponding event handler event types) that must be supported by Window objects, as event handler IDL attributes on the Window objects themselves, and with corresponding event handler content attributes and event handler IDL attributes exposed on all body @@ -1986,7 +1884,7 @@ Return "run".
- The following are the event handlers (and their corresponding event handler event types) that must be + The following are the event handlers (and their corresponding event handler event types) that must be supported on Document objects as event handler IDL attributes: @@ -2088,8 +1986,6 @@ Return "run". }; -
-
Event firing
Certain operations and methods are defined as firing events on elements. For example, the click() method on the HTMLElement interface is defined as @@ -2117,10 +2013,6 @@ Return "run". The default action of these events is to do nothing except where otherwise stated. -
- -
-
Events and the Window object
When an event is dispatched at a DOM node in a Document in a browsing @@ -2128,8 +2020,6 @@ Return "run". must act as if, for the purposes of event dispatching, the Window object is the parent of the Document object. [[!DOM]] -
-

Base64 utility methods

The atob() and btoa() methods allow authors to transform content to and from @@ -2182,8 +2072,6 @@ Return "run". -
- The btoa() method must throw an InvalidCharacterError exception if the method's first argument contains any character whose code point is greater than U+00FF. Otherwise, the user agent must convert that argument to a @@ -2348,8 +2236,6 @@ Return "run". -
-

Dynamic markup insertion

@@ -2396,8 +2282,6 @@ Return "run". -

- Document objects have an ignore-opens-during-unload counter, which is used to prevent scripts from invoking the document.open() method (directly or indirectly) while the document is being unloaded. Initially, the counter must be set to zero. @@ -2593,8 +2477,6 @@ Return "run". that method returned. If the Document object has no Window object, then the method must throw an InvalidAccessError exception. -
-

Closing the input stream

@@ -2613,8 +2495,6 @@ Return "run".
-
- The close() method must run the following steps: @@ -2638,8 +2518,6 @@ Return "run". -
-

document.write()

@@ -2666,8 +2544,6 @@ Return "run".
-
- Document objects have an ignore-destructive-writes counter, which is used in conjunction with the processing of <{script}> elements to prevent external scripts from being able to use document.write() to blow @@ -2745,8 +2621,6 @@ Return "run". -
-

document.writeln()

@@ -2766,15 +2640,11 @@ Return "run".
-
- The document.writeln(...) method, when invoked, must act as if the document.write() method had been invoked with the same argument(s), plus an extra argument consisting of a string containing a single line feed character (U+000A). -
-

Timers

The setTimeout() @@ -2859,8 +2729,6 @@ Return "run". to CPU load, other tasks, etc, are to be expected.

-
- Objects that implement the WindowTimers interface have a list of active timers. Each entry in this lists is identified by a number, which must be unique within the list for the lifetime of the object that implements the WindowTimers interface. @@ -3057,8 +2925,6 @@ Return "run". The task source for these tasks is the timer task source. -
-
To run tasks of several milliseconds back to back without any delay, while still yielding back to the browser to avoid starving the user interface (and to avoid the browser killing the script @@ -3123,8 +2989,6 @@ Return "run". loading their media data, are stalled when these methods are invoked.

-
- The alert(message) method, when invoked, must run the following steps: @@ -3207,8 +3071,6 @@ Return "run". -
-

Printing

@@ -3223,8 +3085,6 @@ Return "run".
-
- When the print() method is invoked, if the Document is ready for post-load tasks, then the user agent must run the printing steps in parallel. Otherwise, the user agent must only set the @@ -3308,15 +3168,11 @@ Return "run". -
-

Dialogs implemented using separate documents with showModalDialog()

This feature is in the process of being removed from the Web platform. (This is a long process that takes many years.) Using the showModalDialog() API at this time is highly discouraged. -

- The showModalDialog(url, argument) method, when invoked, must cause the user agent to run the following steps: @@ -3495,8 +3351,6 @@ Return "run". method).

-
-
     [NoInterfaceObject]
     interface WindowModal {
@@ -3527,8 +3381,6 @@ Return "run".
 
   
 
-  
- Such browsing contexts have associated dialog arguments, which are stored along with the dialog arguments' origin. These values are set by the showModalDialog() method in the algorithm above, when the browsing context is created, based on the arguments provided to the method. @@ -3552,8 +3404,6 @@ Return "run". value origin to the browsing context's active document's effective script origin. -
-

The window.close() method can be used to close the browsing context. @@ -3563,15 +3413,11 @@ Return "run".

The Navigator object

-
- The navigator attribute of the {{Window}} interface must return an instance of the Navigator interface, which represents the identity and state of the user agent (the client), and allows Web pages to register themselves as potential protocol and content handlers: -
-
     interface Navigator {
       // objects implementing this interface also implement the interfaces given below
@@ -3584,13 +3430,9 @@ Return "run".
     Navigator implements NavigatorPlugins;
   
-
- These interfaces are defined separately so that other specifications can re-use parts of the Navigator interface. -
-
Client identification
@@ -3653,8 +3495,6 @@ Return "run".
 
   
 
-  
-
appCodeName
@@ -3691,9 +3531,6 @@ Return "run". little information in this API as possible.

- -
-
Language preferences
@@ -3725,8 +3562,6 @@ Return "run".
   of what the user's preferred languages are changes.
   

-
-
language
@@ -3778,8 +3613,6 @@ Return "run". To avoid introducing any more fingerprinting vectors, user agents should use the same list for the APIs defined in this function as for the HTTP Accept-Language header. -
-
Custom scheme and content handlers: the registerProtocolHandler() and registerContentHandler() methods
@@ -3828,8 +3661,6 @@ Return "run".
 
   
 
-  
- User agents may, within the constraints described in this section, do whatever they like when the methods are called. A user agent could, for instance, prompt the user and offer the user the opportunity to add the site to a shortlist of handlers, or make the handlers his default, or @@ -4053,8 +3884,6 @@ Return "run".
-
- In addition to the registration methods, there are also methods for determining if particular handlers have been registered, and for unregistering handlers. @@ -4101,8 +3930,6 @@ Return "run". -
- The isProtocolHandlerRegistered() method must return the handler state string that most closely describes the current state of the handler described by the two arguments to the method, where the first argument gives @@ -4241,9 +4068,6 @@ Return "run". -
- -
Security and privacy
These mechanisms can introduce a number of concerns, in particular privacy concerns. @@ -4321,9 +4145,6 @@ Return "run". data. User agents are therefore strongly urged to treat registrations in the same manner as cookies: clearing cookies for a site should also clear all registrations for that site, and disabling cookies for a site should also disable registrations. -
- -
Sample user interface
@@ -4360,8 +4181,6 @@ Return "run". The registerProtocolHandler() method would work equivalently, but for schemes instead of unknown content types. -
-
Cookies
@@ -4376,14 +4195,10 @@ Return "run".
     
Returns false if setting a cookie will be ignored, and true otherwise.
-
- The cookieEnabled attribute must return true if the user agent attempts to handle cookies according to the cookie specification, and false if it ignores cookie change requests. [[!COOKIES]] -
-
Plugins
@@ -4533,8 +4348,6 @@ Return "run".
 
   
 
-  
- The plugins attribute must return a PluginArray object. @@ -4792,17 +4605,11 @@ Return "run". must return true if the user agent supports a plugin that supports the MIME type "application/x-java-vm"; otherwise it must return false. -
-

The External interface

-
- The external attribute of the Window interface must return an instance of the External interface. -
-
     interface External {
       void AddSearchProvider(DOMString engineURL);
@@ -4851,8 +4658,6 @@ Return "run".
   using a <{link}> element with the search link type.
   

-
- The AddSearchProvider() method, when invoked, must run the following steps: @@ -4923,8 +4728,6 @@ Return "run". -
-

Images

@@ -5010,7 +4813,6 @@ Return "run".
 
   
 
-  
An ImageBitmap object always has associated bitmap data, with a width and a height. However, it is possible for this data to be corrupted. If an ImageBitmap object's media data can be decoded without errors, it is said to be fully decodable. @@ -5244,7 +5046,6 @@ Return "run". The height attribute must return the ImageBitmap object's height, in CSS pixels. -
Using this API, a sprite sheet can be precut and prepared: From 50181631bdbef61e652aaf4ea6576f1b24bdae69 Mon Sep 17 00:00:00 2001 From: Travis Leithead Date: Fri, 6 May 2016 15:08:39 -0700 Subject: [PATCH 08/19] webappapi include mostly synced. script element section remains --- sections/browsers.include | 99 ++-- sections/dom.include | 2 +- sections/infrastructure.include | 31 +- sections/semantics-embedded-content.include | 9 +- sections/semantics-forms.include | 18 +- sections/syntax.include | 2 +- sections/webappapis.include | 515 +++++++++----------- single-page.bs | 131 +++-- 8 files changed, 380 insertions(+), 427 deletions(-) diff --git a/sections/browsers.include b/sections/browsers.include index c940452f69..f5cd268597 100644 --- a/sections/browsers.include +++ b/sections/browsers.include @@ -70,64 +70,36 @@ creator browsing context at the time A was created is the creator Document. -
- To create a new browsing context: -
    -
  1. Let document be a new Document, whose address is about:blank, which is marked as being an - HTML document, whose character encoding is UTF-8, and which is both ready for post-load - tasks and completely loaded immediately.
  2. - -
  3. - Set the origin and effective script - origin of document: - - -
  4. - -
  5. If the new browsing context has a creator - Document, then set document's referrer to the address of that - creator Document.
  6. - -
  7. Ensure that document has a single child html node, which itself - has two empty child nodes: a head element, and a body - element.
  8. - -
  9. Implement the sandboxing for document.
  10. - -
  11. Let window be a new Window object.
  12. - -
  13. Set window's associated Document to document.
  14. - -
  15. Add document to the new browsing context's session - history.
  16. - -
  17. -

    Let windowProxy be a new WindowProxy object that forwards - everything to the new browsing context's active document's - Window object.

    - -

    Initially, this means forwarding to window, but this can change as - navigations occur.

    -
  18. - -
  19. Set the new browsing context's associated WindowProxy to - windowProxy.
  20. -
- -
+ 1. Call the JavaScript InitializeHostDefinedRealm() abstract operation with the following + customizations: + + * For the global object, create a new {{Window}} object window. + * For the global this value, create a new {{WindowProxy}} object + windowProxy, whose \[[{{Window}}]] internal slot value is window. + +

The internal slot value is updated when navigations occur.

+ * Let realm execution context be the created JavaScript execution context. + 2. Set the new browsing context's associated {{WindowProxy}} to windowProxy. + 3. Let document be a new {{Document}}, whose URL is about:blank, + which is marked as being an HTML document, whose character encoding is UTF-8, + and which is both ready for post-load tasks and completely loaded immediately. + 4. Set the origin of document: + + * If the new browsing context has a creator browsing context, then the + origin of document is the creator origin. + * Otherwise, the origin of document is a unique opaque originassigned + when the new browsing context is created. + 5. If the new browsing context has a creator browsing context, then set + document's referrer to the creator URL. + 6. Ensure that document has a single child <{html}> node, which itself has two empty + child nodes: a <{head}> element, and a <{body}> element. + 7. Implement the sandboxing for document. + 8. Add document to the new browsing context's session history. + 9. Set window's associated {{Document}} to document. + 10. Set up a browsing context environment settings object with realm execution + context.

Nested browsing contexts

@@ -1623,7 +1595,7 @@
- The origin of a resource and the + The origin of a resource and the effective script origin of a resource are each one of the following: @@ -3911,10 +3883,10 @@ response whose status is 204. Otherwise, the result of obtaining the resource for the URL is a response whose - header list consists of + header list consists of Content-Type/text/html and whose - body is result, and whose HTTPS state is settings's - HTTPS state. + body is result, and whose HTTPS state is + settings's HTTPS state. When it comes time to set the document's address in the navigation algorithm, use address as the override URL. @@ -3975,7 +3947,7 @@
  • Set request's omit-Origin-header flag. -
  • If request's method is not +
  • If request's method is not GET, or, if the navigation algorithm was invoked as a result of the form submission algorithm, then if there is an origin of the active document @@ -5724,8 +5696,7 @@ have its completeness flag set to incomplete; the others are always all complete. - Each application cache group has an update - status, which is one of the following: idle, checking, downloading. + Each application cache group has an update status, which is one of the following: idle, checking, downloading. A relevant application cache is an application cache that is the newest in its group to be complete. @@ -6439,7 +6410,7 @@ Fetching the manifest: Let manifest be the result of fetching request. HTTP caching semantics should be honored for this request. - Parse manifest's body according to the + Parse manifest's body according to the rules for parsing manifests, obtaining a list of explicit entries, fallback entries and the fallback namespaces that map to them, entries for the online safelist, and values for the diff --git a/sections/dom.include b/sections/dom.include index fd97c7bfad..e5d05a518c 100644 --- a/sections/dom.include +++ b/sections/dom.include @@ -584,7 +584,7 @@ 11. If response's Content-Type metadata is an XML MIME type, then run these substeps: 1. Create a new XML parser associated with the result document. - 2. Pass this parser response's body. + 2. Pass this parser response's body. 3. If there is an XML well-formedness or XML namespace well-formedness error, then remove all child nodes from result. Otherwise let success be true. 12. Queue a task to run the following steps. diff --git a/sections/infrastructure.include b/sections/infrastructure.include index eddc9197df..88da327022 100644 --- a/sections/infrastructure.include +++ b/sections/infrastructure.include @@ -685,38 +685,51 @@ :: The following terms are defined in the WHATWG Fetch specification: [[!FETCH]] * about:blank + * HTTPS state value + * referrer policy + * CORS protocol + * default User-Agent value + * extract a MIME type * fetch * ok status * Origin header + * process response * set + * terminate + * the RequestCredentials enumeration * response and its associated: * type - * URL + * url * url list * status - * header list - * body + * header list + * body * internal response + * CSP list * HTTPS state * request and its associated: - * URL - * method - * header list - * body + * url + * method + * header list + * body * client * target browsing context * initiator * type * destination * origin - * omit-Origin-header flag + * omit-Origin-header flag + * same-origin data-URL flag * referrer * synchronous flag * mode * credentials mode * use-URL-credentials flag + * unsafe-request flat * cache mode * redirect mode + * cryptographic nonce metadata + * parser metadata : Web IDL :: The IDL fragments in this specification must be interpreted as required for conforming IDL @@ -849,7 +862,7 @@ * The HostEnsureCanCompileStrings abstract operation * The HostPromiseRejectionTracker abstract operation * The HostResolveImportedModule abstract operation - * The InitializeHostDefinedRealm abstract operation + * The InitializeHostDefinedRealm() abstract operation * The IsAccessorDescriptor abstract operation * The IsCallable abstract operation * The IsConstructor abstract operation diff --git a/sections/semantics-embedded-content.include b/sections/semantics-embedded-content.include index c58904986f..85277462fe 100644 --- a/sections/semantics-embedded-content.include +++ b/sections/semantics-embedded-content.include @@ -3569,10 +3569,11 @@ My <img src="heart.png" alt="heart"> breaks.
    - Navigate the element's child browsing context to - a new response whose url list consists of about:srcdoc, header list consists of - Content-Type/text/html, body is the value of the attribute, and HTTPS state is the HTTPS state of the <{iframe}> element's - node document's {{Window}}. + Navigate the element's child browsing context to a new response whose + url list consists of about:srcdoc, header list + consists of Content-Type/text/html, + body is the value of the attribute, and HTTPS state is the + HTTPS state of the <{iframe}> element's node document's {{Window}}. The resulting {{Document}} must be considered an iframe srcdoc document. diff --git a/sections/semantics-forms.include b/sections/semantics-forms.include index 2f69fb3069..27843f2c26 100644 --- a/sections/semantics-forms.include +++ b/sections/semantics-forms.include @@ -8019,7 +8019,7 @@ You cannot submit this form when the field is incorrect.
  • a task to first fire a simple event that bubbles named input at the <{select}> element, and then fire a simple event that bubbles named change at the <{select}> element, using the user interaction task source as the task - source. If the stack of script settings objects was not empty when the user agent was + source. If the JavaScript execution context stack was not empty when the user agent was to send select update notifications, then the resulting input and change events must not be trusted. @@ -10913,9 +10913,10 @@ out of 233 257 824 bytes available</meter></p> The invalid value default for these attributes is the GET state. The missing value default for the <{form/method}> attribute is also the GET state. (There is no missing value default for the <{submitbuttonelements/formmethod}> attribute.) - The method of an element is one of those states. If the - element is a submit button and has a <{submitbuttonelements/formmethod}> attribute, then the element's <{form/method}> is that attribute's state; otherwise, it is the form - owner's <{form/method}> attribute's state. + The method of an element is one of those states. If the element is a + submit button and has a <{submitbuttonelements/formmethod}> + attribute, then the element's method is that attribute's state; otherwise, it + is the form owner's <{form/method}> attribute's state.
    Here the <{form/method}> attribute is used to explicitly specify @@ -13917,7 +13918,7 @@ control.setSelectionRange(oldStart + prefix.length, oldEnd + prefix.length, oldD When a form is submitted, the data in the form is converted into the structure specified by the enctype, and then sent to the destination specified by the - <{form/action}> using the given method. + <{form/action}> using the given method. For example, take the following form: @@ -14059,7 +14060,7 @@ fur
  • Let enctype be the submitter element's enctype.
  • -
  • Let method be the submitter element's method.
  • +
  • Let method be the submitter element's method.
  • Let target be the submitter element's target.
  • @@ -14199,8 +14200,9 @@ fur :: Let MIME type be "text/plain". Otherwise, plan to navigate to a new request whose URL is - action, method is method, header list consists of - Content-Type/MIME type, and body is entity body. + action, method is method, header list + consists of Content-Type/MIME type, and body is + entity body. : Get action URL :: Plan to navigate to action. diff --git a/sections/syntax.include b/sections/syntax.include index 2b147b6194..d6009f4c2a 100644 --- a/sections/syntax.include +++ b/sections/syntax.include @@ -6971,7 +6971,7 @@
    An end tag whose tag name is "script"
    - If the stack of script settings objects is empty, perform a microtask checkpoint. + If the JavaScript execution context stack is empty, perform a microtask checkpoint. Let script be the current node (which will be a <{script}> element). diff --git a/sections/webappapis.include b/sections/webappapis.include index 49ecf181a6..bf4e54db6b 100644 --- a/sections/webappapis.include +++ b/sections/webappapis.include @@ -203,8 +203,9 @@ 8. If response's Content Type metadata, if any, specifies a character encoding, and the user agent supports that encoding, then set character encoding to that encoding (ignoring the passed-in value). - 9. Let source text be the result of decoding response's body - to Unicode, using character encoding as the fallback encoding. + 9. Let source text be the result of decoding response's + body to Unicode, using character encoding as the fallback + encoding.

    The decode algorithm overrides character encoding if the file contains a BOM.

    @@ -238,7 +239,7 @@ response. If they return false, complete this algorithm with null, and abort these steps. 7. Let source text be the result of UTF-8 decoding response's - body. + body. 8. Let script be the result of creating a classic script using source text and settings object. 9. Asynchronously complete this algorithm with script. @@ -338,8 +339,9 @@ * response's type is "error" * response's status is not an ok status - * The result of extracting a MIME type from response's header list - (ignoring parameters) is not a JavaScript MIME type. + * The result of extracting a MIME type from response's + header list (ignoring parameters) is not a + JavaScript MIME type.

    For historical reasons, fetching a classic script does not include MIME type checking. In contrast, module scripts will fail to load if they are not of a @@ -347,7 +349,7 @@ * The caller specified custom steps to process the response, which when performed on response return false. 10. Let source text be the result of UTF-8 decoding response's - body. + body. 11. Let module script be the result of creating a module script given source text, settings object, response's url, credentials mode, and cryptographic nonce. @@ -362,8 +364,9 @@

    Creating scripts
    - To create a classic script, given some script source, an environment settings - object, and an optional muted errors flag: + To create a classic script, + given some script source, an environment settings object, and an optional + muted errors flag: 1. Let script be a new classic script that this algorithm will subsequently initialize. @@ -401,8 +404,8 @@ object, a script base URL, a credentials mode, a cryptographic nonce, and a
    Calling scripts
    - To run a classic script given a classic script s and an optional - rethrow errors flag: + To run a classic script given a + classic script s and an optional rethrow errors flag: 1. Let settings be the settings object of s. 2. Check if we can run script with settings. If this returns "do not run", then @@ -415,10 +418,10 @@ object, a script base URL, a credentials mode, a cryptographic nonce, and a element of result and go to the step labeled error. 7. Let evaluationStatus be ScriptEvaluation(result). 8. If evaluationStatus is an abrupt completion, set result to - evaluationStatus.\[[Value]] and go to the next step (labeled error). If + evaluationStatus.\[[Value]] and go to the next step (labeled Error). If evaluationStatus is a normal completion, or if ScriptEvaluation does not complete because the user agent has aborted the running script, skip to the step - labeled cleanup. + labeled Cleanup. 9. Error: At this point result must be an exception. Perform the following steps: @@ -601,6 +604,7 @@ object, a script base URL, a credentials mode, a cryptographic nonce, and a method from c.html whose code is running). * The relevant Realm of the object on which the {{Window/print()}} method is being called is that of d.html. +

    The incumbent and entry concepts should not be used by new @@ -666,7 +670,7 @@ object, a script base URL, a credentials mode, a cryptographic nonce, and a The rest of this section deals with formally defining the entry, incumbent, current, and relevant concepts. -

    Entry
    +
    Entry
    All realm execution contexts must contain, as part of their code evaluation state, an entrance counter value, which is initially zero. In the process of calling @@ -683,7 +687,7 @@ object, a script base URL, a credentials mode, a cryptographic nonce, and a Similarly, the entry global object is the global object of the entry Realm. -
    Incumbent
    +
    Incumbent
    The incumbent settings object is determined as follows: @@ -699,10 +703,10 @@ object, a script base URL, a credentials mode, a cryptographic nonce, and a Similarly, the incumbent global object is the global object of the incumbent settings object. -
    Current
    +
    Current
    The JavaScript specification defines the current Realm Record, sometimes abbreviated to the - "current Realm". [ECMA-262] + "current Realm". [[ECMA-262]] Then, the current settings object is the environment settings object of the current Realm Record. @@ -710,7 +714,7 @@ object, a script base URL, a credentials mode, a cryptographic nonce, and a Similarly, the current global object is the global object of the current Realm Record. -
    Relevant
    +
    Relevant
    The relevant settings object for a platform object is defined as follows: @@ -727,7 +731,8 @@ object, a script base URL, a credentials mode, a cryptographic nonce, and a

    The "global environment associated with" concept is from the olden days, before the modern JavaScript specification and its concept of realms. We expect that as the Web IDL specification gets updated, every platform object will have a Realm - associated with it, and this definition can be re-cast in those terms. [ECMA-262] [WEBIDL]

    + associated with it, and this definition can be re-cast in those terms. [[ECMA-262]] [[WEBIDL]] +

    @@ -743,7 +748,7 @@ object, a script base URL, a credentials mode, a cryptographic nonce, and a necessary to abort a running script. This causes any ScriptEvaluation or ModuleEvaluation to cease immediately, emptying the JavaScript execution context stack without triggering any of the normal mechanisms like finally blocks. - [ECMA-262] + [[ECMA-262]] User agents may impose resource limitations on scripts, for example CPU quotas, memory limits, total execution time limits, or bandwidth limitations. When a script exceeds a limit, the user @@ -822,7 +827,7 @@ object, a script base URL, a credentials mode, a cryptographic nonce, and a The JavaScript specification defines a syntax for modules, as well as some host-agnostic parts of their processing model. This specification defines the rest of their processing model: how the module system is bootstrapped, via the <{script}> element with <{script/type}> attribute set to - "module", and how modules are fetched, resolved, and executed. [ECMA-262] + "module", and how modules are fetched, resolved, and executed. [[ECMA-262]]

    Although the JavaScript specification speaks in terms of "scripts" versus "modules", in general this specification speaks in terms of classic scripts versus @@ -833,9 +838,9 @@ object, a script base URL, a credentials mode, a cryptographic nonce, and a ensure that imported JavaScript modules are only fetched, parsed, and evaluated once per {{Document}} or worker. - To resolve a module specifier given a module script script and a - string specifier, perform the following steps. It will return either an - absolute URL or failure. + To resolve a module specifier + given a module script script and a string specifier, perform the + following steps. It will return either an absolute URL or failure. 1. Apply the URL parser to specifier. If the result is not failure, return the result. @@ -851,10 +856,10 @@ object, a script base URL, a credentials mode, a cryptographic nonce, and a 3. Return the result of applying the URL parser to specifier with script's base URL as the base URL. -

    HostResolveImportedModule(referencingModule, specifier)
    +
    HostResolveImportedModule(referencingModule, specifier)
    JavaScript contains an implementation-defined HostResolveImportedModule abstract operation. - User agents must use the following implementation: [ECMA-262] + User agents must use the following implementation: [[ECMA-262]] 1. Let referencing module script be referencingModule.\[[HostDefined]]. 2. Let module map be referencing module script's settings object's @@ -1152,14 +1157,14 @@ object, a script base URL, a credentials mode, a cryptographic nonce, and a 1. Select the oldest task on one of the event loop's task queues, if any, ignoring, in the case of a browsing context event loop, tasks whose associated {{Document}}s are not fully active. The user agent may pick any task queue. If - there is no task to select, then jump to the microtasks step below. + there is no task to select, then jump to the Microtasks step below. 2. Set the event loop's currently running task to the task selected in the previous step. 3. Run: Run the selected task. 4. Set the event loop's currently running task back to null. - 5. Remove the task that was run in the run step above from its task queue. + 5. Remove the task that was run in the Run step above from its task queue. 6. Microtasks: Perform a microtask checkpoint. - 7. Update the rendering: If this event loop is a browsing context + 7. Update the rendering: If this event loop is a browsing context event loop (as opposed to a {{worker}} event loop), then run the following substeps. @@ -1226,7 +1231,7 @@ object, a script base URL, a credentials mode, a cryptographic nonce, and a callbacks for that {{Document}}, passing in now as the timestamp. 11. For each fully active {{Document}} in docs, run the update intersection observations steps for that {{Document}}, passing in now as - the timestamp. + the timestamp. 12. For each fully active {{Document}} in docs, update the rendering or user interface of that {{Document}} and its browsing context to reflect the current state. @@ -1264,7 +1269,7 @@ object, a script base URL, a credentials mode, a cryptographic nonce, and a 1. Let the performing a microtask checkpoint flag be true. 2. Microtask queue handling: If the event loop's microtask queue is - empty, jump to the done step below. + empty, jump to the Done step below. 3. Select the oldest microtask on the event loop's microtask queue. 4. Set the event loop's currently running task to the task selected in the previous step. @@ -1276,7 +1281,7 @@ object, a script base URL, a credentials mode, a cryptographic nonce, and a checkpoint flag to avoid reentrancy.

    6. Set the event loop's currently running task back to null. 7. Remove the microtask run in the step above from the microtask queue, and return - to the microtask queue handling step. + to the Microtask queue handling step. 8. Done: For each environment settings object whose responsible event loop is this event loop, notify about rejected promises on that environment settings object. @@ -1353,26 +1358,26 @@ object, a script base URL, a credentials mode, a cryptographic nonce, and a
    Generic task sources
    - The following task sources are used by a number of mostly unrelated features in this and + The following task sources are used by a number of mostly unrelated features in this and other specifications. : The DOM manipulation task source - :: This task source is used for features that react to DOM manipulations, such as things - that happen in a non-blocking fashion when an element is inserted into the + :: This task source is used for features that react to DOM manipulations, such as things + that happen in a non-blocking fashion when an element is inserted into the document. - + : The user interaction task source - :: This task source is used for features that react to user interaction, for example + :: This task source is used for features that react to user interaction, for example keyboard or mouse input. - Events sent in response to user input (e.g., click events) must be fired using + Events sent in response to user input (e.g., click events) must be fired using tasks queued with the user interaction task source. [[!UIEVENTS]] : The networking task source :: This task source is used for features that trigger in response to network activity. : The history traversal task source - :: This task source is used to queue calls to {{History/back()|history.back()}} and + :: This task source is used to queue calls to {{History/back()|history.back()}} and similar APIs.

    Events

    @@ -1385,32 +1390,32 @@ object, a script base URL, a credentials mode, a cryptographic nonce, and a An event handler has a name, which always starts with "on" and is followed by the name of the event for which it is intended. - An event handler has a value, which is either null, or is a callback object, or is an - internal raw uncompiled handler. The {{EventHandler}} callback function type describes how + An event handler has a value, which is either null, or is a callback object, or is an + internal raw uncompiled handler. The {{EventHandler}} callback function type describes how this is exposed to scripts. Initially, an event handler's value must be set to null. Event handlers are exposed in one of two ways. The first way, common to all event handlers, is as an event handler IDL attribute. - The second way is as an event handler content attribute. Event handlers on + The second way is as an event handler content attribute. Event handlers on html elements and some of the event handlers on {{Window}} objects are exposed in this way.
    - An event handler IDL attribute - is an IDL attribute for a specific event handler. The name of the IDL attribute is the same + An event handler IDL attribute + is an IDL attribute for a specific event handler. The name of the IDL attribute is the same as the name of the event handler. - Event handler IDL attributes, on setting, must set the corresponding event handler - to their new value, and on getting, must return the result of getting the current value of the - event handler in question (this can throw an exception, in which case the getting propagates + Event handler IDL attributes, on setting, must set the corresponding event handler + to their new value, and on getting, must return the result of getting the current value of the + event handler in question (this can throw an exception, in which case the getting propagates it to the caller, it does not catch it). If an event handler IDL attribute exposes an event handler of an object that doesn't exist, it must always return null on getting and must do nothing on setting. -

    This can happen in particular for event handler IDL attribute on <{body}> +

    This can happen in particular for event handler IDL attribute on <{body}> elements that do not have corresponding {{Window}} objects.

    Certain event handler IDL attributes have additional requirements, in particular @@ -1418,37 +1423,37 @@ object, a script base URL, a credentials mode, a cryptographic nonce, and a


    - An event handler content attribute - is a content attribute for a specific event handler. The name of the content attribute is + An event handler content attribute + is a content attribute for a specific event handler. The name of the content attribute is the same as the name of the event handler. - Event handler content attributes, when specified, must contain valid JavaScript code which, - when parsed, would match the FunctionBody production after automatic semicolon insertion. + Event handler content attributes, when specified, must contain valid JavaScript code which, + when parsed, would match the FunctionBody production after automatic semicolon insertion. [[!ECMA-262]] When an event handler content attribute is set, execute the following steps: 1. If the Should element's inline behavior be blocked by Content Security Policy? algorithm - returns "Blocked" when executed upon the attribute's element + returns "Blocked" when executed upon the attribute's element "script attribute", and the attribute's value, then abort these steps. [[!CSP3]] 2. Set the corresponding event handler to an internal raw uncompiled handler consisting of the attribute's new value and the script location where the attribute was set to this value. - When an event handler content attribute is removed, the user agent must set the + When an event handler content attribute is removed, the user agent must set the corresponding event handler to null.
    - When an event handler H of an element or object T implementing the + When an event handler H of an element or object T implementing the {{EventTarget}} interface is first set to a non-null value, the user agent must append an event - listener to the list of event listeners associated with T with type - set to the event handler event type corresponding to H, and + listener to the list of event listeners associated with T with type + set to the event handler event type corresponding to H, and callback set to the event handler processing algorithm defined below. [[!DOM]] -

    The callback is emphatically not the event handler - itself. Every event handler ends up registering the same callback the algorithm - defined below, which takes care of invoking the right callback, and processing the callback's +

    The callback is emphatically not the event handler + itself. Every event handler ends up registering the same callback the algorithm + defined below, which takes care of invoking the right callback, and processing the callback's return value.

    @@ -1480,34 +1485,34 @@ object, a script base URL, a credentials mode, a cryptographic nonce, and a

    -

    The interfaces implemented by the event object do not influence whether an +

    The interfaces implemented by the event object do not influence whether an event handler is triggered or not.

    - The event handler processing algorithm for an event handlerH and an + The event handler processing algorithm for an event handlerH and an {{Event}} object E is as follows: - 1. Let callback be the result of getting the current value of the event handler + 1. Let callback be the result of getting the current value of the event handlerH. 2. If callback is null, then abort these steps. 3. Process the {{Event}} object E as follows:
    -
    If E is an {{ErrorEvent}} object and the event handler IDL attribute's +
    If E is an {{ErrorEvent}} object and the event handler IDL attribute's type is OnErrorEventHandler
    -
    Invoke callback with five arguments, the first one having the value of +
    Invoke callback with five arguments, the first one having the value of E's {{ErrorEvent/message}} attribute, the second having the value of - E's {{ErrorEvent/filename}} attribute, the third having the value of - E's {{ErrorEvent/lineno}} attribute, the fourth having the value of - E's {{ErrorEvent/colno}} attribute, the fifth having the value of - E's {{ErrorEvent/error}} attribute, and with the - callback this value set to E's {{Event/currentTarget}}. Let + E's {{ErrorEvent/filename}} attribute, the third having the value of + E's {{ErrorEvent/lineno}} attribute, the fourth having the value of + E's {{ErrorEvent/colno}} attribute, the fifth having the value of + E's {{ErrorEvent/error}} attribute, and with the + callback this value set to E's {{Event/currentTarget}}. Let return value be the callback's return value. [[!WEBIDL]]
    Otherwise
    Invoke callback with one argument, the value of which is the {{Event}} object E, with the callback this value set to E's - {{Event/currentTarget}}. Let return value be the callback's return value. + {{Event/currentTarget}}. Let return value be the callback's return value. [[!WEBIDL]]
    @@ -1515,27 +1520,27 @@ object, a script base URL, a credentials mode, a cryptographic nonce, and a In this step, invoke means to invoke the Web IDL callback function. If an exception gets thrown by the callback, end these steps and allow the exception to - propagate. (It will propagate to the DOM event dispatch logic, which will then + propagate. (It will propagate to the DOM event dispatch logic, which will then report the exception.) 4. Process return value as follows:
    If the event type is mouseover
    -
    If the event type is error and E is an {{ErrorEvent}} +
    If the event type is error and E is an {{ErrorEvent}} object
    If return value is a Web IDL boolean true value, then cancel the event.
    If the event type is beforeunload
    -

    The event handler IDL attribute's type is - OnBeforeUnloadEventHandler, and the return value will therefore have +

    The event handler IDL attribute's type is + OnBeforeUnloadEventHandler, and the return value will therefore have been coerced into either the value null or a DOMString.

    If the return value is null, then cancel the event. - Otherwise, if the {{Event}} object E is a BeforeUnloadEvent object, - and the {{Event}} object E's {{Event/returnValue}} attribute's value is the - empty string, then set the {{Event/returnValue}} attribute's value to + Otherwise, if the {{Event}} object E is a BeforeUnloadEvent object, + and the {{Event}} object E's {{Event/returnValue}} attribute's value is the + empty string, then set the {{Event/returnValue}} attribute's value to return value.
    @@ -1545,7 +1550,7 @@ object, a script base URL, a credentials mode, a cryptographic nonce, and a
    - The {{EventHandler}} callback function type represents a callback used for event handlers. It is + The {{EventHandler}} callback function type represents a callback used for event handlers. It is represented in Web IDL as follows:
    @@ -1567,12 +1572,12 @@ object, a script base URL, a credentials mode, a cryptographic nonce, and a
       
     
       

    The return value of the function affects whether the event is canceled or not: - as described above, if the return value is false, the event is canceled (except for - mouseover events, where the return value has to be true to cancel the event). With - beforeunload events, the value is instead used to determine whether or not the - message to prompt about unloading the document.

    + as described above, if the return value is false, the event is canceled (except for + mouseover events, where the return value has to be true to cancel the event). With + beforeunload events, the value is instead used to determine whether or not to prompt + about unloading the document.

    - For historical reasons, the onerror handler has different arguments: + For historical reasons, the {{Window/onerror}} handler has different arguments:
         [TreatNonObjectAsNull]
    @@ -1580,8 +1585,7 @@ object, a script base URL, a credentials mode, a cryptographic nonce, and a
         typedef OnErrorEventHandlerNonNull? OnErrorEventHandler;
       
    - Similarly, the onbeforeunload handler has a - different return value: + Similarly, the {{Window/onbeforeunload}} handler has a different return value:
         [TreatNonObjectAsNull]
    @@ -1593,178 +1597,88 @@ object, a script base URL, a credentials mode, a cryptographic nonce, and a
     
       An internal raw uncompiled handler is a tuple with the following information:
     
    -  
      - -
    • An uncompiled script body - -
    • A location where the script body originated, in case an error needs to be reported - -
    - - When the user agent is to get the current value of the event handler H, it must run these steps: - -
      - -
    1. - - If H's value is an internal raw uncompiled handler, run these - substeps: - -
        - -
      1. - - If H is an element's event - handler, then let element be the element, and document be the element's node document. - - Otherwise, H is a Window object's event handler: let element be null, and let document be the Document most recently associated with that - Window object. - -
      2. - -
      3. If document is - not in a browsing context, or if scripting is - enabled for document's browsing context, then return - null.
      4. - -
      5. Let body be the uncompiled script body in the internal raw - uncompiled handler.
      6. - -
      7. Let location be the location where the script body originated, as - given by the internal raw uncompiled handler.
      8. - -
      9. If element is not null and element has a - form owner, let form owner be that form owner. - Otherwise, let form owner be null.
      10. - -
      11. Let script settings be the environment settings object - created for the Window object with which document is - currently associated.
      12. - -
      13. Obtain the script execution environment for JavaScript from script settings.
      14. - -
      15. - - If body is not parsable as FunctionBody or if parsing detects - an early error, then follow these substeps: - -
          - -
        1. Set H's value to null.
        2. - -
        3. Report the error for the appropriate script and with the appropriate position (line number and - column number) given by location, using the global object - specified by script settings as the target. If the error is still not handled after this, then the error may be reported - to a developer console.
        4. - -
        5. Return null.
        6. - -
        - -
      16. - -
      17. - If body begins with a Directive Prologue that contains a Use Strict Directive then let strict be true, otherwise let strict - be false. -
      18. - -
      19. - - Using the script execution environment obtained above, let function be the - result of calling FunctionCreate, with arguments: - -
        - -
        kind
        -
        Normal
        - -
        ParameterList
        - -
        - -
        - -
        If H is an onerror event handler of a Window object
        + * An uncompiled script body + * A location where the script body originated, in case an error needs to be reported -
        Let the function have five arguments, named event, source, lineno, colno, and - error.
        - -
        Otherwise
        - -
        Let the function have a single argument called event.
        - -
        - -
        - -
        Body
        - -
        The result of parsing body above.
        - -
        Scope
        - -
        - -
          - -
        1. - - If H is an element's event - handler, then let Scope be the result of - NewObjectEnvironment(document, the global - environment). - - Otherwise, H is a Window object's event handler: let Scope be the global environment. - -
        2. - -
        3. If form owner is not null, let Scope be - the result of NewObjectEnvironment(form owner, Scope).
        4. - -
        5. If element is not null, let Scope be the - result of NewObjectEnvironment(element, Scope).
        6. - -
        - -

        - NewObjectEnvironment() is defined in ECMAScript edition 5 section 10.2.2.3 - NewObjectEnvironment (O, E). [[!ECMA-262]] -

        - -
        - -
        Strict
        - -
        The value of strict.
        - -
        - -
      20. - -
      21. Let script be a new classic script.
      22. - -
      23. Let script's code entry-point be function.
      24. - -
      25. Let script's settings object be script - settings.
      26. - -
      27. Set H's value to function.
      28. - -
      - -
    2. - -
    3. Return H's value.
    4. - -
    + When the user agent is to + get the current value of the event handler + H, it must run these steps: + + 1. If H's value is an internal raw uncompiled handler, run these substeps: + + 1. If H is an element's event handler, then let element be the + element, and document be the element's node document. + + Otherwise, H is a {{Window}} object's event handler: let + element be null, and let document be the {{Document}} most recently + associated with that {{Window}} object. + 2. If document does not have a browsing context, or if scripting is + enabled for document's browsing context, then return null. + 3. Let body be the uncompiled script body in the internal raw uncompiled + handler. + 4. Let location be the location where the script body originated, as given by the + internal raw uncompiled handler. + 5. If element is not null and element has a form owner, let + form owner be that form owner. Otherwise, let form owner be + null. + 6. Let script settings be the environment settings object created for the + {{Window}} object with which document is currently associated. + 7. If body is not parsable as FunctionBody or if parsing detects an + early error, then follow these substeps: + + 1. Set H's value to null. + 2. Report the error for the appropriate script and with the + appropriate position (line number and column number) given by location, + using the global object specified by script settings as the target. + If the error is still not handled after this, then the error + may be reported to a developer console. + 3. Return null. + 8. If body begins with a Directive Prologue that contains a Use Strict + Directive then let strict be true, otherwise let strict be + false. + 9. Let function be the result of calling FunctionCreate, with arguments: + + : kind + :: Normal + + : ParameterList + ::
    +
    If H is an {{Window/onerror}} event handler of a {{Window}} + object
    +
    Let the function have five arguments, named event, + source, lineno, colno, and error. +
    + +
    Otherwise
    +
    Let the function have a single argument called event.
    +
    + : Body + :: The result of parsing body above. + + : Scope + :: + 1. If H is an element's event handler, then let Scope be + the result of NewObjectEnvironment(document, the global + environment). + + Otherwise, H is a {{Window}} object's event handler: let + Scope be the global environment. + 2. If form owner is not null, let Scope be + NewObjectEnvironment(form owner, Scope). + 3. If element is not null, let Scope be the + NewObjectEnvironment(element, Scope). + + : Strict + :: The value of strict. + 10. Set H's value to function. + 2. Return H's value.
    Event handlers on elements, Document objects, and Window objects
    - The following are the event handlers (and their corresponding event handler event types) that must be - supported by all html elements, as both event handler content attributes - and event handler IDL attributes; and that must be - supported by all Document and Window objects, as event handler IDL - attributes: + The following are the event handlers (and their corresponding event handler event + types) that must be supported by all html elements, as both event handler content + attributes and event handler IDL attributes; and that must be supported by all + {{Document}} and {{Window}} objects, as event handler IDL attributes:
    @@ -1831,15 +1745,14 @@ object, a script base URL, a credentials mode, a cryptographic nonce, and a
    - The following are the event handlers (and their corresponding event handler event types) that must be - supported by all html elements other than <{body}> and <{frameset}> - elements, as both event handler content attributes and event handler IDL - attributes; that must be supported by all Document - objects, as event handler IDL attributes; and that must be - supported by all Window objects, as event handler IDL attributes on the - Window objects themselves, and with corresponding event handler content - attributes and event handler IDL attributes exposed on all body - and <{frameset}> elements that are owned by that Window object's Documents: + The following are the event handlers (and their corresponding event handler event + types) that must be supported by all html elements other than <{body}> and <{frameset}> + elements, as both event handler content attributes and event handler IDL attributes; + that must be supported by all {{Document}} objects, as event handler IDL attributes; and + that must be supported by all {{Window}} objects, as event handler IDL attributes on the + {{Window}} objects themselves, and with corresponding event handler content attributes and + event handler IDL attributes exposed on all <{body}> and <{frameset}> elements that are + owned by that {{Window}} object's {{Document}}s:
    @@ -1855,11 +1768,11 @@ object, a script base URL, a credentials mode, a cryptographic nonce, and a
    - The following are the event handlers (and their corresponding event handler event types) that must be - supported by Window objects, as event handler IDL attributes on the - Window objects themselves, and with corresponding event handler content - attributes and event handler IDL attributes exposed on all body - and <{frameset}> elements that are owned by that Window object's Documents: + The following are the event handlers (and their corresponding event handler event + types) that must be supported by {{Window}} objects, as event handler IDL attributes on + the {{Window}} objects themselves, and with corresponding event handler content attributes + and event handler IDL attributes exposed on all <{body}> and <{frameset}> elements that are + owned by that {{Window}} object's {{Document}}s:
    @@ -1884,8 +1797,24 @@ object, a script base URL, a credentials mode, a cryptographic nonce, and a
    - The following are the event handlers (and their corresponding event handler event types) that must be - supported on Document objects as event handler IDL attributes: + The following are the event handlers (and their corresponding event handler event + types) that must be supported by all html elements, as both event handler content + attributes and event handler IDL attributes and that must be supported by all + {{Document}} objects, as event handler IDL attributes: + +
    + + +
    Event handler Event handler event type +
    oncut cut +
    oncopy copy +
    onpaste paste +
    + +
    + + The following are the event handlers (and their corresponding event handler event + types) that must be supported on {{Document}} objects as event handler IDL attributes: @@ -1988,28 +1917,32 @@ object, a script base URL, a credentials mode, a cryptographic nonce, and a
    Event firing
    - Certain operations and methods are defined as firing events on elements. For example, the click() method on the HTMLElement interface is defined as - firing a click event on the element. [[!UIEVENTS]] - - Firing a simple event named e - means that a trusted event with the name e, which does not bubble (except where otherwise stated) and is not cancelable - (except where otherwise stated), and which uses the Event interface, must be created - and dispatched at the given target. - - Firing a synthetic mouse event named e means that an event with the name e, which is trusted (except where otherwise stated), does not bubble - (except where otherwise stated), is not cancelable (except where otherwise stated), and which uses - the MouseEvent interface, must be created and dispatched at the given target. The - event object must have its screenX, screenY, clientX, clientY, and button - attributes initialized to 0, its ctrlKey, shiftKey, - altKey, and metaKey attributes initialized according - to the current state of the key input device, if any (false for any keys that are not available), - its detail attribute initialized to 1, its relatedTarget attribute initialized to null (except - where otherwise stated), and its view attribute initialized to the Window object of the Document object of the given target node, if any, or else null. The getModifierState() method on the object must - return values appropriately describing the state of the key input device at the time the event is - created. - - Firing a click event - means firing a synthetic mouse event named click, which bubbles and is cancelable. + Certain operations and methods are defined as firing events on elements. For example, the + {{HTMLElement/click()}} method on the {{HTMLElement}} interface is defined as firing a + click event on the element. [[!UIEVENTS]] + + Firing a simple event named + e means that a trusted event with the name e, which does not + bubble (except where otherwise stated) and is not cancelable (except where otherwise stated), and + which uses the {{Event}} interface, must be created and dispatched at the given target. + + Firing a synthetic mouse event named e + means that an event with the name e, which is trusted (except where otherwise + stated), does not bubble (except where otherwise stated), is not cancelable (except where + otherwise stated), and which uses the {{MouseEvent}} interface, must be created and dispatched at + the given target. The event object must have its {{MouseEvent/screenX}}, {{MouseEvent/screenY}}, + {{MouseEvent/clientX}, {{MouseEvent/clientY}}, and {{MouseEvent/button}} attributes initialized to + 0, its {{MouseEvent/ctrlKey}}, {{MouseEvent/shiftKey}}, {{MouseEvent/altKey}}, and + {{MouseEvent/metaKey}} attributes initialized according to the current state of the key input + device, if any (false for any keys that are not available), its {{MouseEvent/detail}} attribute + initialized to 1, its {{MouseEvent/relatedTarget}} attribute initialized to null (except where + otherwise stated), and its {{MouseEvent/view}} attribute initialized to the {{Window}} object of + the {{Document}} object of the given target node, if any, or else null. The + {{MouseEvent/getModifierState()}} method on the object must return values appropriately describing + the state of the key input device at the time the event is created. + + Firing a click event means + firing a synthetic mouse event named click, which bubbles and is cancelable. The default action of these events is to do nothing except where otherwise stated. diff --git a/single-page.bs b/single-page.bs index a67bf3fe23..9125047ae3 100644 --- a/single-page.bs +++ b/single-page.bs @@ -30,14 +30,9 @@ Ignored Vars: this, object, variable, optionalArgument, name, value, e, oldParen
    +
     urlPrefix: http://validator.w3.org/nu/; url:; type:dfn;
         text: Nu Markup Validation Service;
    -urlPrefix: http://www.w3.org/TR/workers/; type: interface; spec: workers;
    -    text: worker;
    -url: https://www.w3.org/TR/workers/#the-event-loop; type: dfn; spec: workers;
    -    text: Worker event loops
    -url: https://www.w3.org/TR/workers/#processing-model; type: dfn; spec: workers;
    -    text: worker processing model
     urlPrefix: http://www.w3.org/TR/cssom-view/; type: interface; spec: cssom-view;
         text: screen;
     urlPrefix: http://www.whatwg.org/specs/web-apps/current-work/; url:; type: dfn; spec: WHATWG;
    @@ -159,43 +154,6 @@ url: http://tools.ietf.org/html/rfc6265#section-4.1; type: dfn; spec: rfc6265;
         text: receiving a set-cookie-string
     url: http://tools.ietf.org/html/rfc5988#section-5; type: dfn; spec: rfc5988;
         text: link header
    -urlPrefix: https://fetch.spec.whatwg.org/#; type: dfn; spec: fetch;
    -    text: origin header
    -    text: ok status
    -    text: synchronous flag
    -    text: CORS-cross-origin; url: concept-cors-check
    -urlPrefix: https://fetch.spec.whatwg.org/#concept-; type: dfn; spec: fetch;
    -    text: fetch
    -    text: status
    -    text: header list
    -    text: body
    -    text: internal response
    -    text: response
    -    text: method
    -    text: request
    -url: https://fetch.spec.whatwg.org/#concept-fetch; type: dfn; spec: fetch;
    -    text: fetching algorithm
    -urlPrefix: https://fetch.spec.whatwg.org/#concept-header-list-; type: dfn; spec: fetch; for: header list;
    -    text: set
    -urlPrefix: https://fetch.spec.whatwg.org/#concept-request-; type: dfn; for: request; spec: fetch;
    -    text: client
    -    text: target browsing context
    -    text: initiator
    -    text: type
    -    text: destination
    -    text: origin
    -    text: referrer
    -    text: mode
    -    text: credentials mode
    -    text: use-URL-credentials flag
    -    text: cache mode
    -    text: redirect mode
    -url: https://fetch.spec.whatwg.org/#omit-origin-header-flag; type: dfn; for: request; spec: fetch;
    -    text: omit-origin-header flag;
    -urlPrefix: https://fetch.spec.whatwg.org/#concept-response-; type: dfn; for: response; spec: fetch;
    -    text: type
    -    text: https state
    -    text: url list
     urlPrefix: http://www.w3.org/TR/WebIDL/#dfn-; type: dfn; spec: webidl;
         text: Platform array object
     urlPrefix: http://www.w3.org/TR/WebIDL-1/#idl-; type: interface;
    @@ -516,12 +474,10 @@ url: https://tc39.github.io/ecma262/#execution-context-stack; type: dfn;
         text: javascript execution context stack
     url: https://html.spec.whatwg.org/#run-the-animation-frame-callbacks; type: dfn;
         text: run the animation frame callbacks
    -urlPrefix: https://www.w3.org/TR/workers/#; type: dfn;
    -    text: run a worker
    +
     url: https://tc39.github.io/ecma262/#sec-functioncreate; type: dfn;
         text: FunctionCreate
    -urlPrefix: https://www.w3.org/TR/workers/#; type: interface;
    -    text: WorkerGlobalScope
    +
     url: http://www.w3.org/TR/2dcontext/#imagedata; type: interface;
         text: ImageData
     url: https://www.w3.org/TR/CSP3/#policy; type: dfn;
    @@ -632,8 +588,8 @@ url: https://tc39.github.io/ecma262/#sec-host-promise-rejection-tracker; type: d
         text: HostPromiseRejectionTracker
     url: https://tc39.github.io/ecma262/#sec-hostresolveimportedmodule; type: dfn; spec: ecma-262;
         text: HostResolveImportedModule
    -url: https://tc39.github.io/ecma262/#sec-initializehostdefinedrealm; type: dfn; spec: ecma-262;
    -    text: InitializeHostDefinedRealm
    +url: https://tc39.github.io/ecma262/#sec-initializehostdefinedrealm; type: method; spec: ecma-262;
    +    text: InitializeHostDefinedRealm()
     url: https://tc39.github.io/ecma262/#sec-isaccessordescriptor; type: dfn; spec: ecma-262;
         text: IsAccessorDescriptor
     url: https://tc39.github.io/ecma262/#sec-iscallable; type: dfn; spec: ecma-262;
    @@ -692,6 +648,81 @@ url: https://tc39.github.io/ecma262/#sec-typeof-operator; type: dfn; spec: ecma-
         text: typeof
     url: https://tc39.github.io/ecma262/#table-49; type: dfn; spec: ecma-262;
         text: The TypedArray Constructors
    +
    +
    +
    +urlPrefix: https://fetch.spec.whatwg.org/#; type: dfn; spec: FETCH;
    +    urlPrefix: concept-;
    +        text: body
    +        text: CORS-cross-origin; url: cors-check
    +        url: fetch
    +            text: fetch
    +            text: fetching algorithm
    +        urlPrefix: fetch-;
    +            text: terminate
    +        urlPrefix: header-;
    +            text: extract a MIME type; url: extract-mime-type
    +            urlPrefix: list-; for: header list
    +                text: set
    +        text: header list
    +        text: HTTPS state value
    +        text: internal response
    +        text: method
    +        text: referrer policy
    +        text: request
    +        urlPrefix: request-; for: request
    +            text: body
    +            text: cache mode
    +            text: client
    +            text: credentials mode
    +            text: destination
    +            text: header list
    +            text: initiator
    +            text: method
    +            text: mode
    +            text: cryptographic nonce metadata; url: nonce-metadata
    +            text: origin
    +            text: parser metadata
    +            text: redirect mode
    +            text: referrer
    +            text: target browsing context
    +            text: type
    +            text: url
    +            text: use-URL-credentials flag
    +        text: response
    +        urlPrefix: response-; for: response
    +            text: body
    +            text: CSP list
    +            text: header list
    +            text: https state
    +            text: type
    +            text: url
    +            text: url list
    +        text: status
    +    text: default User-Agent value
    +    urlPrefix: http-;
    +        text: CORS protocol
    +        text: origin; for: header
    +    text: omit-origin-header flag;
    +    text: origin header
    +    text: ok status
    +    text: process response
    +    text: RequestCredentials
    +    text: same-origin data-URL flag
    +    text: synchronous flag
    +    text: unsafe-request flag
    +
    +
    +
    +urlPrefix: https://www.w3.org/TR/workers/; type: interface; spec: WORKERS;
    +    text: worker
    +    text: WorkerGlobalScope
    +urlPrefix: https://www.w3.org/TR/workers/#; type: dfn; spec: WORKERS;
    +    text: run a worker
    +url: https://www.w3.org/TR/workers/#the-event-loop; type: dfn; spec: WORKERS;
    +    text: Worker event loops
    +url: https://www.w3.org/TR/workers/#processing-model; type: dfn; spec: WORKERS;
    +    text: worker processing model
     
    
    From d4391f2238296f592ae9bf8d9d97ba3236240366 Mon Sep 17 00:00:00 2001
    From: Travis Leithead 
    Date: Mon, 9 May 2016 16:11:56 -0700
    Subject: [PATCH 09/19] syncing changes for the script element
    
    ---
     sections/semantics-scriptings.include | 1683 +++++++++++--------------
     1 file changed, 771 insertions(+), 912 deletions(-)
    
    diff --git a/sections/semantics-scriptings.include b/sections/semantics-scriptings.include
    index bd23cb6761..7505c3e65c 100644
    --- a/sections/semantics-scriptings.include
    +++ b/sections/semantics-scriptings.include
    @@ -47,12 +47,13 @@
         
    Neither tag is omissible
    Content attributes:
    Global attributes
    -
    src - Address of the resource
    -
    type - Type of embedded resource
    -
    charset - Character encoding of the external script resource
    -
    async - Execute script in parallel
    -
    defer - Defer script execution
    -
    crossorigin - How the element handles crossorigin requests
    +
    <{script/src}> - Address of the resource
    +
    <{script/type}> - Type of embedded resource
    +
    <{script/charset}> - Character encoding of the external script resource
    +
    <{script/async}> - Execute script in parallel
    +
    <{script/defer}> - Defer script execution
    +
    <{script/crossorigin}> - How the element handles crossorigin requests
    +
    <{script/nonce}> - Cryptographic nonce used in Content Security Policy checks [[CSP3]]
    Allowed ARIA role attribute values:
    None
    Allowed ARIA state and property attributes:
    @@ -68,6 +69,7 @@ attribute boolean defer; attribute DOMString? crossOrigin; attribute DOMString text; + attribute DOMString nonce; };
    @@ -77,757 +79,154 @@ their documents. The element does not represent content for the user. - When used to include dynamic scripts, the scripts may either be embedded inline or may be - imported from an external file using the src attribute. If - the language is not that described by "text/javascript", then the type attribute must be present, as described below. Whatever - language is used, the contents of the <{script}> element must conform with the - requirements of that language's specification. - - When used to include data blocks (as opposed to scripts), the data must be embedded inline, the - format of the data must be given using the type attribute, - the src attribute must not be specified, and the contents of - the <{script}> element must conform to the requirements defined for the format used. - - The type attribute gives the language of the - script or format of the data. If the attribute is present, its value must be a valid MIME - type. The charset parameter must not be specified. The default, which - is used if the attribute is absent, is "text/javascript". - - The src attribute, if specified, gives the - address of the external script resource to use. The value of the attribute must be a valid - non-empty URL potentially surrounded by spaces identifying a script resource of the type - given by the type attribute, if the attribute is present, or - of the type "text/javascript", if the attribute is absent. A resource is a - script resource of a given type if that type identifies a scripting language and the resource - conforms with the requirements of that language's specification. + The type attribute allows customization of the + type of script represented: + + * Omitting the attribute, or setting it to a JavaScript MIME type, means that the script is + a classic script, to be interpreted according to the JavaScript Script + top-level production. Classic scripts are affected by the <{script/charset}>, <{script/async}>, + and <{script/defer}> attributes. Authors should omit the attribute, instead of redundantly + giving a JavaScript MIME type. + * Setting the attribute to an ASCII case-insensitive match for the string + "`module`" means that the script is a module script, to be interpreted + according to the JavaScript Module top-level production. Module scripts are + not affected by the <{script/charset}> and <{script/defer}> attributes. + * Setting the attribute to any other value means that the script is a + data block, which is not processed. None of the + <{script}> attributes (except <{script/type}> itself) have any effect on data blocks. + Authors must use a valid MIME type that is not a JavaScript MIME type to denote + data blocks. + +

    The requirement that data blocks must be denoted using a + valid MIME type is in place to avoid potential future collisions. If this specification + ever adds additional types of script, they will be triggered by setting the + <{script/type}> attribute to something which is not a MIME type, like how the "`module`" value + denotes module scripts. By using a valid MIME type now, you ensure that your data block + will not ever be reinterpreted as a different script type, even in future user agents.

    + + Classic scripts and module scripts may either be embedded inline or may be imported + from an external file using the src attribute, + which if specified gives the URL of the external script resource to use. If <{script/src}> + is specified, it must be a valid non-empty URL potentially surrounded by spaces. The + contents of inline <{script}> elements, or the external script resource, must conform with the + requirements of the JavaScript specification's Script or + Module productions, for classic scripts and module scripts + respectively. [[ECMA-262]] + + When used to include data blocks, the data must be embedded inline, the format of the data + must be given using the <{script/type}> attribute, and the contents of the <{script}> element must + conform to the requirements defined for the format used. The <{script/src}>, <{script/charset}>, + <{script/async}>, <{script/defer}>, <{script/crossorigin}>, and <{script/nonce}> attributes must + not be specified. The charset attribute gives the character - encoding of the external script resource. The attribute must not be specified if the src attribute is not present. If the attribute is set, its value - must be an ASCII case-insensitive match for one of the labels of an encoding, and must specify the same encoding as - the charset parameter of the Content-Type - metadata of the external file, if any. [[!ENCODING]] - - The async and defer attributes are boolean attributes that indicate how the script should be executed. The defer and async attributes - must not be specified if the src attribute is not - present. - - There are three possible modes that can be selected using these attributes. If the async attribute is present, then the script will be executed - as soon as it is available, but without blocking further parsing of the page. If the async - attribute is not present but the defer attribute is - present, then the script is executed when the page has finished parsing. If neither attribute is - present, then the script is fetched and executed immediately, before the user agent continues - parsing the page. This is summarized in the following schematic diagram: - - With <script>, parsing is interrupted by fetching and execution; with <script defer>, fetching is parallel to parsing and execution takes place after all parsing has finished; and with <script async>, fetching is parallel to parsing but once it finishes parsing is interrupted to execute the script. + encoding of the external script resource. The attribute must not be specified if the + <{script/src}> attribute is not present, or if the script is not a classic script. + (Module scripts are always interpreted as UTF-8.) If the attribute is set, its value + must be an ASCII case-insensitive match for one of the + labels of an encoding, and must specify the same + encoding as the `charset` parameter of the Content-Type metadata of the external + file, if any. [[!ENCODING]] + + The async and + defer attributes are boolean attributes + that indicate how the script should be executed. Classic scripts may specify + <{script/defer}> or <{script/async}>; module scripts may specify <{script/async}>. + + There are several possible modes that can be selected using these attributes, and depending on the + script's <{script/type}>. + + For classic scripts, if the <{script/async}> attribute is present, then the classic script + will be fetched in parallel to parsing and evaluated as soon as it is available + (potentially before parsing completes). If the <{script/async}> attribute is not present but the + <{script/defer}> attribute is present, then the classic script will be fetched + in parallel and evaluated when the page has finished parsing. If neither attribute is + present, then the script is fetched and evaluated immediately, blocking parsing until these are + both complete. + + For module scripts, if the <{script/async}> attribute is present, then the module script + and all its dependencies will be fetched in parallel to parsing, and the module script will + be evaluated as soon as it is available (potentially before parsing completes). Otherwise, the + module script and its dependencies will be fetched in parallel to parsing and evaluated + when the page has finished parsing. (The <{script/defer}> attribute has no effect on module + scripts.) + + This is all summarized in the following schematic diagram: + + With <script>, parsing is interrupted by fetching and execution. With <script defer>, fetching is parallel to parsing and execution takes place after all parsing has finished. And with <script async>, fetching is parallel to parsing but once it finishes parsing is interrupted to execute the script. The story for <script type= is similar to <script defer>, but the dependencies will be fetched as well, and the story for <script type="module" async> is similar to <script async> with the extra dependency fetching." />

    The exact processing details for these attributes are, for mostly historical reasons, somewhat non-trivial, involving a number of aspects of HTML. The implementation requirements are therefore by necessity scattered throughout the specification. The algorithms below (in this section) describe the core of this processing, but these algorithms reference and - are referenced by the parsing rules for script start and end tags in HTML, in foreign content, - and in XML, the rules for the document.write() method, the handling of scripting, etc. -

    + are referenced by the parsing rules for <{script}> start and + end tags in HTML, in foreign content, and in XML, the rules for the + document.write() method, the handling of + scripting, etc.

    - The defer attribute may be specified even if the async attribute is specified, to cause legacy Web browsers that - only support defer (and not async) to fall back to the defer behavior instead of the blocking behavior that - is the default. + The <{script/defer}> attribute may be specified even if the <{script/async}> attribute is + specified, to cause legacy Web browsers that only support <{script/defer}> (and not + <{script/async}>) to fall back to the <{script/defer}> behavior instead of the blocking behavior + that is the default. The crossorigin attribute is a - CORS settings attribute. It controls, for scripts that are obtained from other origins, whether error information will be exposed. - - Changing the src, type, charset, async, defer, and crossorigin attributes dynamically has no direct effect; - these attribute are only used at specific times described below. - -
    - - A <{script}> element has several associated pieces of state. - - The first is a flag indicating whether or not the script block has been "already - started". Initially, <{script}> elements must have this flag unset (script blocks, - when created, are not "already started"). The cloning - steps for <{script}> elements must set the "already started" flag on the copy if - it is set on the element being cloned. - - The second is a flag indicating whether the element was "parser-inserted". - Initially, <{script}> elements must have this flag unset. It is set by the HTML - parser and the XML parser on <{script}> elements they insert and - affects the processing of those elements. - - The third is a flag indicating whether the element will "non-blocking". Initially, - <{script}> elements must have this flag set. It is unset by the HTML parser - and the XML parser on <{script}> elements they insert. In addition, whenever - a <{script}> element whose "non-blocking" flag is set has an async content attribute added, the element's - "non-blocking" flag must be unset. - - The fourth is a flag indicating whether or not the script block is "ready to be - parser-executed". Initially, <{script}> elements must have this flag unset (script - blocks, when created, are not "ready to be parser-executed"). This flag is used only for elements - that are also "parser-inserted", to let the parser know when to execute the - script. - - The last few pieces of state are the script block - type, the script block character - encoding, and the script block - fallback character encoding. They are determined when the script is prepared, based on - the attributes on the element at that time, and the - <{script}> element's node document. - - When a <{script}> element that is not marked as being "parser-inserted" - experiences one of the events listed in the following list, the user agent must immediately - prepare the <{script}> element: - -
      - -
    • The <{script}> element gets inserted into a document, at the time the node is inserted - according to the DOM, after any other <{script}> elements inserted at the same time that - are earlier in the Document in tree order.
    • - -
    • The <{script}> element is in a Document and a node or - document fragment is inserted into the - <{script}> element, after any <{script}> elements inserted at that time.
    • - -
    • The <{script}> element is in a Document and has a src attribute set where previously the element had no such - attribute.
    • - -
    - - To prepare a script, the user agent must act as - follows: - -
      - -
    1. - - If the <{script}> element is marked as having "already started", then - the user agent must abort these steps at this point. The script is not executed. - -
    2. - -
    3. - - If the element has its "parser-inserted" flag set, then set was-parser-inserted to true and unset the element's - "parser-inserted" flag. Otherwise, set was-parser-inserted to - false. - -

      - This is done so that if parser-inserted <{script}> elements fail to run - when the parser tries to run them, e.g., because they are empty or specify an unsupported - scripting language, another script can later mutate them and cause them to run again. -

      - -
    4. - -
    5. - - If was-parser-inserted is true and the element does not have an async attribute, then set the element's - "non-blocking" flag to true. - -

      - This is done so that if a parser-inserted <{script}> element fails to - run when the parser tries to run it, but it is later executed after a script dynamically updates - it, it will execute in a non-blocking fashion even if the async - attribute isn't set. -

      - -
    6. - -
    7. - - If the element has no src attribute, and its child - nodes, if any, consist only of comment nodes and empty Text nodes, then the user - agent must abort these steps at this point. The script is not executed. - -
    8. - -
    9. - - If the element is not in a Document, then the user agent must abort - these steps at this point. The script is not executed. - -
    10. - -
    11. - - If either: - -
        - -
      • the <{script}> element has a type attribute - and its value is the empty string, or
      • - -
      • the <{script}> element has no type attribute - but it has a language attribute and that - attribute's value is the empty string, or
      • - -
      • the <{script}> element has neither a type - attribute nor a language attribute, then
      • - -
      - - ...let the script block's type for this - <{script}> element be "text/javascript". - - Otherwise, if the <{script}> element has a type attribute, let the - script block's type for this <{script}> element be the value of that attribute - with any leading or trailing sequences of space characters - removed. - - Otherwise, the element has a non-empty language - attribute; let the script block's type for this - <{script}> element be the concatenation of the string "text/" - followed by the value of the language attribute. - -

      - The language attribute is never - conforming, and is always ignored if there is a type - attribute present. -

      - -
    12. - -
    13. - - If the user agent does not support the scripting language given by the script block's type for this <{script}> element, - then the user agent must abort these steps at this point. The script is not executed. - -
    14. - -
    15. - - If was-parser-inserted is true, then flag the element as - "parser-inserted" again, and set the element's "non-blocking" flag to - false. - -
    16. - -
    17. - - The user agent must set the element's "already started" flag. - -

      - The state of the element at this moment is later used to determine the script source. -

      - -
    18. - -
    19. - - If the element is flagged as "parser-inserted", but the element's - node document is not the Document of the parser that created the element, - then abort these steps. - -
    20. - -
    21. - - If scripting is disabled for the script - element, then the user agent must abort these steps at this point. The script is not - executed. - -

      - The definition of scripting is disabled - means that, amongst others, the following scripts will not execute: scripts in - XMLHttpRequest's responseXML - documents, scripts in DOMParser-created documents, scripts in documents created by - XSLTProcessor's transformToDocument feature, and scripts - that are first inserted by a script into a Document that was created using the - createDocument() API. [[!XHR]] [[!DOMPARSING]] [[!DOM]] -

      - -
    22. - -
    23. - - If the <{script}> element has an event - attribute and a for attribute, then run these substeps: - -
        - -
      1. Let for be the value of the for - attribute.
      2. - -
      3. Let event be the value of the event attribute.
      4. - -
      5. Strip leading and trailing whitespace from event and - for.
      6. - -
      7. If for is not an ASCII case-insensitive match for the - string "window", then the user agent must abort these steps at this - point. The script is not executed.
      8. - -
      9. If event is not an ASCII case-insensitive match for - either the string "onload" or the string "onload()", then the user agent must abort these steps at this point. The script - is not executed.
      10. - -
      - -
    24. - -
    25. - - If the <{script}> element has a charset - attribute, then let the script block's character - encoding for this <{script}> element be the result of getting an - encoding from the value of the charset - attribute. - - Otherwise, let the script block's fallback - character encoding for this <{script}> element be the same as the encoding of the document itself. - -

      - Only one of these two pieces of state is set. -

      - -
    26. - -
    27. - - If the element has a src content attribute, run these - substeps: - -
        - -
      1. Let src be the value of the element's src attribute.
      2. - -
      3. If src is the empty string, queue a task to fire - a simple event named error at the element, and abort - these steps.
      4. - -
      5. Resolve src relative to the - element.
      6. - -
      7. If the previous step failed, queue a task to fire a simple - event named error at the element, and abort these - steps.
      8. - -
      9. Let request be the result of creating a potential-CORS request given the - resulting absolute URL and the current state of the element's - crossorigin content attribute.
      10. - -
      11. Set request's client to the - element's node document's Window object's environment settings - object and type to "script".
      12. - -
      13. - Fetch request. - - The resource obtained in this fashion can be either CORS-same-origin or - CORS-cross-origin. This only affects how error reporting happens. - - For performance reasons, user agents may start fetching the script (as defined above) as - soon as the src attribute is set, instead, in the hope - that the element will be inserted into the document (and that the crossorigin attribute won't change value in the - meantime). Either way, once the element is inserted into the document, the load must have started as described in this - step. If the user agent performs such prefetching, but the element is never inserted in the document, - or the src attribute is dynamically changed, or the crossorigin attribute is dynamically changed, then the - user agent will not execute the script so obtained, and the fetching process will have been - effectively wasted. - -
      14. - -
      - -
    28. - -
    29. - - Then, the first of the following options that describes the situation must be followed: - -
      - -
      If the element has a src - attribute, and the element has a defer attribute, and - the element has been flagged as "parser-inserted", and the element does not have - an async attribute
      - -
      - - The element must be added to the end of the list of scripts that will execute when the - document has finished parsing associated with the Document of the parser - that created the element. - - The task that the networking task source - places on the task queue once fetching has completed must set the element's - "ready to be parser-executed" flag. The parser will handle executing the - script. - -
      - -
      If the element has a src attribute, and the element has been flagged as - "parser-inserted", and the element does not have an async attribute
      - -
      - - The element is the pending parsing-blocking script of the - Document of the parser that created the element. (There can only be one such - script per Document at a time.) - - The task that the networking task source - places on the task queue once fetching has completed must set the element's - "ready to be parser-executed" flag. The parser will handle executing the - script. - -
      - -
      If the element does not have a src attribute, and the element has been flagged as - "parser-inserted", and either the parser that created the script is - an XML parser or it's an HTML parser whose script nesting - level is not greater than one, and the Document of the HTML - parser or XML parser that created the <{script}> element has - a style sheet that is blocking scripts
      - -
      - - The element is the pending parsing-blocking script of the - Document of the parser that created the element. (There can only be one such - script per Document at a time.) - - Set the element's "ready to be parser-executed" flag. The parser will handle - executing the script. - -
      - -
      If the element has a src attribute, does not have an async attribute, and does not have the - "non-blocking" flag set
      - -
      - - The element must be added to the end of the list of scripts that will execute in order - as soon as possible associated with the node document of the script - element at the time the prepare a script algorithm started. - - The task that the networking task source - places on the task queue once fetching has completed must run the following - steps: - -
        - -
      1. If the element is not now the first element in the list of scripts that will - execute in order as soon as possible to which it was added above, then mark the - element as ready but abort these steps without executing the script yet.
      2. - -
      3. Execution: Execute the script block corresponding to the first - script element in this list of scripts that will execute in order as soon as - possible.
      4. - -
      5. Remove the first element from this list of scripts that will execute in order as - soon as possible.
      6. - -
      7. If this list of scripts that will execute in order as soon as possible is - still not empty and the first entry has already been marked as ready, then jump back to the - step labeled execution.
      8. - -
      - -
      - -
      If the element has a src - attribute
      - -
      - - The element must be added to the set of scripts that will execute as soon as - possible of the node document of the <{script}> element at the time the - prepare a script algorithm started. - - The task that the networking task source - places on the task queue once fetching has completed must execute the - script block and then remove the element from the set of scripts that will - execute as soon as possible. - -
      - -
      Otherwise
      - -
      The user agent must immediately execute the script block, even if other - scripts are already executing.
      - -
      - -
    30. - -
    - - Fetching an external script must delay the load event of the element's node document - until the task that is queued - by the networking task source once the resource has been fetched (defined above) has - been run. - - The pending parsing-blocking script of a Document is used by the - Document's parser(s). - -

    - If a <{script}> element that blocks a parser gets moved to another - Document before it would normally have stopped blocking that parser, it nonetheless - continues blocking that parser until the condition that causes it to be blocking the parser no - longer applies (e.g., if the script is a pending parsing-blocking script because there - was a style sheet that is blocking scripts when it was parsed, but then the script is - moved to another Document before the style sheet loads, the script still blocks the - parser until the style sheets are all loaded, at which time the script executes and the parser is - unblocked). -

    - - When the user agent is required to execute a script block, it must run the following steps: - -
      - -
    1. - - If the element is flagged as "parser-inserted", but the element's - node document is not the Document of the parser that created the element, - then abort these steps. - -
    2. - -
    3. - - Jump to the appropriate set of steps from the list below: - -
      - -
      If the load resulted in an error (for example a DNS error, or an HTTP 404 error)
      - -
      Executing the script block must just consist of firing a simple event named error at the element.
      - -
      If the load was successful
      - -
      - - Executing the script block must consist of running the following steps. For the purposes of - these steps, the script is considered to be from an external file if, while the - prepare a script algorithm above was running for this script, the - <{script}> element had a src attribute - specified. - -
        - -
      1. - - Initialize the script block's source - as follows: - -
        - -
        If the script is from an external file and the script - block's type is a text-based language
        - -
        - - The contents of that file, interpreted as a Unicode string, are the script source. - - To obtain the Unicode string, the user agent run the following steps: - -
          - -
        1. If the resource's Content-Type metadata, if any, - specifies a character encoding, and the user agent supports that encoding, then let character encoding be that encoding, and jump to the bottom step in this - series of steps.
        2. - -
        3. If the algorithm above set the script - block's character encoding, then let character encoding be - that encoding, and jump to the bottom step in this series of steps.
        4. - -
        5. Let character encoding be the script block's fallback character - encoding.
        6. - -
        7. - - If the specification for the script block's - type gives specific rules for decoding files in that format to Unicode, follow - them, using character encoding as the character encoding specified by - higher-level protocols, if necessary. - - Otherwise, decode the file to Unicode, using character - encoding as the fallback encoding. - -

          - The decode algorithm overrides character - encoding if the file contains a BOM. -

          - -
        8. - -
        - -
        - -
        If the script is from an external file and the script - block's type is an XML-based language
        - -
        - - The external file is the script source. When it is later executed, it must be - interpreted in a manner consistent with the specification defining the language given by - the script block's type. - -
        - -
        If the script is inline and the script block's - type is a text-based language
        - -
        - - The value of the text IDL attribute at the time - the element's "already started" flag was last set is the script source. - -
        - -
        If the script is inline and the script block's - type is an XML-based language
        - -
        - - The child nodes of the <{script}> element at the time the element's - "already started" flag was last set are the script source. - -
        - -
        - -
      2. - -
      3. - - Fire a simple event named beforescriptexecute that bubbles and is cancelable - at the <{script}> element. - - If the event is canceled, then abort these steps. - -
      4. - -
      5. - - If the script is from an external file, then increment the - ignore-destructive-writes counter of the <{script}> element's - node document. Let neutralized doc be that - {{Document}}. - -
      6. - -
      7. - - Let old script element be the value to which the script - element's node document's currentScript object was most recently - initialized. - -
      8. - -
      9. - - Initialize the <{script}> element's node document's currentScript object to the script - element. - -
      10. - -
      11. - - Create a script, using the script - block's source, the URL from which the script was obtained, the script block's type as the scripting language, and - the environment settings object of the <{script}> element's - node document's Window object. - - If the script came from a resource that was fetched in the steps above, and the resource - was CORS-cross-origin, then pass the muted errors flag to the - create a script algorithm as well. - -

        - This is where the script is compiled and actually executed. -

        - -
      12. - -
      13. - - Initialize the <{script}> element's node document's currentScript object to old script - element. - -
      14. - -
      15. - - Decrement the ignore-destructive-writes counter of neutralized doc, if it was incremented in the earlier step. - -
      16. - -
      17. - - Fire a simple event named afterscriptexecute that bubbles (but is not - cancelable) at the <{script}> element. - -
      18. - -
      19. - - If the script is from an external file, fire a simple event named load at the <{script}> element. - - Otherwise, the script is internal; queue a task to fire a simple - event named load at the script - element. - -
      20. - -
      - -
      - -
      - -
    4. - -
    - - The IDL attributes src, type, charset, and defer, must each reflect the respective - content attributes of the same name. + CORS settings attribute. For classic scripts, it controls whether error information + will be exposed, when the script is obtained from other origins. For module scripts, + it controls the credentials mode used for cross-origin requests. + +

    Unlike classic scripts, module scripts require the use of the + CORS protocol for cross-origin fetching.

    + + The nonce attribute represents a + cryptographic nonce ("number used once") which can be used by Content Security Policy to + determine whether or not the script specified by an element will be executed. The value is text. + [[CSP3]] + + Changing the <{script/src}>, <{script/type}>, <{script/charset}>, <{script/async}>, + <{script/defer}>, <{script/crossorigin}>, and <{script/nonce}> attributes dynamically has no + direct effect; these attributes are only used at specific times described below. + + The IDL attributes + src, + type, + charset, + defer, and + nonce, must each reflect the + respective content attributes of the same name. The crossOrigin IDL attribute must reflect the <{script/crossorigin}> content attribute. - The async IDL attribute controls whether the - element will execute in parallel or not. If the element's "non-blocking" flag is - set, then, on getting, the async IDL attribute must return - true, and on setting, the "non-blocking" flag must first be unset, and then the - content attribute must be removed if the IDL attribute's new value is false, and must be set to - the empty string if the IDL attribute's new value is true. If the element's - "non-blocking" flag is not set, the IDL attribute must reflect - the <{script/async}> content attribute. - -
    + The async IDL attribute controls whether + the element will execute in parallel or not. If the element's "non-blocking" flag is + set, then, on getting, the {{HTMLScriptElement/async}} IDL attribute must return true, and on + setting, the "non-blocking" flag must first be unset, and then the content attribute must + be removed if the IDL attribute's new value is false, and must be set to the empty string if the + IDL attribute's new value is true. If the element's "non-blocking" flag is not + set, the IDL attribute must reflect the <{script/async}> content attribute.
    -
    script . text [ = value ]
    - -
    - - Returns the contents of the element, ignoring child nodes that aren't Text - nodes. +
    script . {{HTMLScriptElement/text}} [ = value ]
    +
    Returns the child text content of the element. Can be set, to replace the element's children with the given value. -
    -
    -
    - - The IDL attribute text must return a - concatenation of the contents of all the Text nodes that are children of the - <{script}> element (ignoring any other nodes such as comments or elements), in tree - order. On setting, it must act the same way as the {{Node/textContent}} IDL attribute. + The IDL attribute text must return the + child text content of the <{script}> element. On setting, it must act the same way as the + {{Node/textContent}} IDL attribute. -
    - -

    - When inserted using the document.write() - method, <{script}> elements execute (typically blocking further script execution or HTML parsing), but when inserted using - innerHTML and outerHTML - attributes, they do not execute at all. -

    +

    When inserted using the document.write() + method, <{script}> elements execute (typically blocking further script execution or HTML parsing), + but when inserted using innerHTML and outerHTML attributes, they do not + execute at all.

    - In this example, two <{script}> elements are used. One embeds an external script, and - the other includes some data. + In this example, two <{script}> elements are used. One embeds an external classic script, + and the other includes some data as a data block.
     <script src="game-engine.js"></script>
    @@ -843,14 +242,13 @@ o............A....e
         data doesn't have to be used that way, though; maybe the map data is actually embedded in other
         parts of the page's markup, and the data block here is just used by the site's search engine to
         help users who are looking for particular features in their game maps.
    -
       
    - The following sample shows how a script element can be used to define a function that is then - used by other parts of the document. It also shows how a <{script}> element can be used - to invoke script while the document is being parsed, in this case to initialize the form's - output. + The following sample shows how a <{script}> element can be used to define a function that is + then used by other parts of the document, as part of a classic script. It also shows how + a <{script}> element can be used to invoke script while the document is being parsed, in this + case to initialize the form's output.
           <script>
    @@ -885,19 +283,542 @@ o............A....e
             </script>
           </form>
         
    -
    -
    Scripting languages
    +
    + The following sample shows how a <{script}> element can be used to include an external + module script. -
    +
    +      <script type="module" src="app.js"></script>
    +    
    - A user agent is said to support the scripting language if each component of the script block's type is an ASCII - case-insensitive match for the corresponding component in the MIME type string - of a scripting language that the user agent implements. + This module, and all its dependencies (expressed through JavaScript `import` statements in the + source file), will be fetched. Once the entire resulting module tree has been imported, and the + document has finished parsing, the contents of `app.js` will be evaluated. +
    +
    + The following sample shows how a <{script}> element can be used to write an inline + module script that performs a number of substitutions on the document's text, in order to + make for a more interesting reading experience (e.g. on a news site): [[XKCD-1288]] + +
    +      <script type="module">
    +       import { walkAllTextNodeDescendants } from "./dom-utils.js";
    +
    +       const substitutions = new Map([
    +         ["witnesses", "these dudes I know"]
    +         ["allegedly", "kinda probably"]
    +         ["new study", "Tumblr post"]
    +         ["rebuild", "avenge"]
    +         ["space", "spaaace"]
    +         ["Google glass", "Virtual Boy"]
    +         ["smartphone", "Pokédex"]
    +         ["electric", "atomic"]
    +         ["Senator", "Elf-Lord"]
    +         ["car", "cat"]
    +         ["election", "eating contest"]
    +         ["Congressional leaders", "river spirits"]
    +         ["homeland security", "Homestar Runner"]
    +         ["could not be reached for comment", "is guilty and everyone knows it"]
    +       ]);
    +
    +       function substitute(textNode) {
    +         for (const [before, after] of substitutions.entries()) {
    +           textNode.data = textNode.data.replace(new RegExp(`\\b${before}\\b`, "ig"), after);
    +         }
    +       }
    +
    +       walkAllTextNodeDescendants(document.body, substitute);
    +      </script>
    +    
    + + Some notable features gained by using a module script include the ability to import + functions from other JavaScript modules, strict mode by default, and how top-level declarations + do not introduce new properties onto the global object. Also note that no matter where + this <{script}> element appears in the document, it will not be evaluated until both document + parsing has complete and its dependency (`dom-utils.js`) has been fetched and evaluated.
    +
    Processing model
    + + A <{script}> element has several associated pieces of state. + + The first is a flag indicating whether or not the script block has been + "already started". Initially, <{script}> elements must have this flag unset (script + blocks, when created, are not "already started"). The cloning steps for <{script}> elements + must set the "already started" flag on the copy if it is set on the element being cloned. + + The second is a flag indicating whether the element was "parser-inserted". + Initially, <{script}> elements must have this flag unset. It is set by the HTML parser + and the XML parser on <{script}> elements they insert and affects the processing of those + elements. + + The third is a flag indicating whether the element will "non-blocking". Initially, + <{script}> elements must have this flag set. It is unset by the HTML parser + and the XML parser on <{script}> elements they insert. In addition, whenever + a <{script}> element whose "non-blocking" flag is set has an <{script/async}> content + attribute added, the element's "non-blocking" flag must be unset. + + The fourth is a flag indicating whether or not the script block is + "ready to be parser-executed". Initially, <{script}> elements must have this flag unset + (script blocks, when created, are not "ready to be parser-executed"). This flag is used only for + elements that are also "parser-inserted", to let the parser know when to execute the + script. + + The fifth is the script's type, which is either "`classic`" or "`module`". It is + determined when the script is prepared, based on the <{script/type}> attribute of the + element at that time. Initially, <{script}> elements must have this flag unset. + + The sixth is a flag indicating whether or not the script is from an external file. It + is determined when the script is prepared, based on the <{script/src}> attribute of the + element at that time. + + Finally, a <{script}> element has the script's script, which is a + <{script}> resulting from preparing the element. This is set asynchronously after the + classic script or module tree is fetched. Once it is set, either to a <{script}> in the + case of success or to null in the case of failure, the fetching algorithms will note that + the script is ready, which can trigger other actions. The user agent must + delay the load event of the element's node document until + the script is ready. + + When a <{script}> element that is not marked as being "parser-inserted" experiences one of + the events listed in the following list, the user agent must immediately prepare the + <{script}> element: + + * The <{script}> element gets inserted into a document, at the time the node + is inserted according to the DOM, after any other <{script}> elements inserted at the same time + that are earlier in the Document in tree order. + * The <{script}> element is in a Document and a node or document fragment is + inserted into the <{script}> element, after any <{script}> elements inserted at + that time. + * The <{script}> element is in a Document and has a src attribute + set where previously the element had no such attribute. + + To prepare a script, the user agent must act as follows: + + 1. If the <{script}> element is marked as having "already started", then the user agent + must abort these steps at this point. The script is not executed. + 2. If the element has its "parser-inserted" flag set, then set + was-parser-inserted to true and unset the element's "parser-inserted" flag. + Otherwise, set was-parser-inserted to false. + +

    This is done so that if parser-inserted <{script}> elements fail to run when + the parser tries to run them, e.g., because they are empty or specify an unsupported + scripting language, another script can later mutate them and cause them to run again.

    + 3. If was-parser-inserted is true and the element does not have an <{script/async}> + attribute, then set the element's "non-blocking" flag to true. + +

    This is done so that if a parser-inserted <{script}> element fails to run when + the parser tries to run it, but it is later executed after a script dynamically updates it, it + will execute in a non-blocking fashion even if the <{script/async}> attribute isn't set.

    + 4. If the element has no <{script/src}> attribute, and its child nodes, if any, consist only of + comment nodes and empty {{Text}} nodes, then abort these steps at this point. The script is + not executed. + 5. If the element is not in a `Document`, then the user agent must abort these steps at + this point. The script is not executed. + 6. If either: + + * the <{script}> element has a <{script/type}> attribute and its value is the empty string, or + * the <{script}> element has no <{script/type}> attribute but it has a <{script/language}> + attribute and that attribute's value is the empty string, or + * the <{script}> element has neither a <{script/type}> attribute nor a <{script/language}> + attribute, then + + ...let the script block's type for this <{script}> element be "<`text/javascript`". + + Otherwise, if the <{script}> element has a <{script/type}> attribute, let + the script block's type string for this <{script}> element be the value of that + attribute with any leading or trailing sequences of space characters removed. + + Otherwise, the element has a non-empty <{script/language}> attribute; let + the script block's type string for this <{script}> element be the concatenation of + the string "`text/`" followed by the value of the <{script/language}> attribute. + +

    The <{script/language}> attribute is never conforming, and is always ignored + if there is a <{script/type}> attribute present.

    + + Determine the script's type as follows: + + * If the script block's type string is an ASCII case-insensitive match for + any JavaScript MIME type, the script's type is "`classic`". + * If the script block's type string is an ASCII case-insensitive match for + the string "`module`", the script's type is "`module`". + * If neither of the above conditions are true, then abort these steps at this point. No script + is executed. + 7. If was-parser-inserted is true, then flag the element as "parser-inserted" + again, and set the element's "non-blocking" flag to false. + 8. The user agent must set the element's "already started" flag. + 9. If the element is flagged as "parser-inserted", but the element's node document + is not the {{Document}} of the parser that created the element, then abort these steps. + 10. If scripting is disabled for the <{script}> element, then abort these steps at this + point. The script is not executed. + +

    The definition of scripting is disabled means that, amongst others, + the following scripts will not execute: scripts in {{XMLHttpRequest}}'s + {{XMLHttpRequest/responseXML}} documents, scripts in {{DOMParser}}-created documents, scripts + in documents created by XSLTProcessor's transformToDocument + feature, and scripts that are first inserted by a script into a {{Document}} that was created + using the {{DOMImplementation/createDocument()}} API. [[!XHR]] [[!DOMPARSING]] [[!DOM]]

    + 11. If the <{script}> element does not have a <{script/src}> content attribute, and the + Should element's inline behavior be blocked by Content Security Policy? algorithm + returns "`Blocked`" when executed upon the <{script}> element, "`script`", and the <{script}> + element's child text content, then abort these steps. The script is not executed. + [[CSP3]] + 12. If the <{script}> element has an <{script/event}> attribute and a <{script/for}> attribute, + and the script's type is "`classic`", then run these substeps: + + 1. Let for be the value of the <{script/for}> attribute. + 2. Let event be the value of the <{script/event}> attribute. + 3. Strip leading and trailing whitespace from event and for. + 4. If for is not an ASCII case-insensitive match for the string "`window`", + then the user agent must abort these steps at this point. The script is not executed. + 5. If event is not an ASCII case-insensitive match for either the string + "`onload`" or the string "`onload()`", then the user agent must abort these steps at this + point. The script is not executed. + 13. If the <{script}> element has a <{script/charset}> attribute, then let encoding be + the result of getting an encoding from the value of the <{script/charset}> attribute. + + If the <{script}> element does not have a <{script/charset}> attribute, or if + getting an encoding failed, let encoding be the same as + the encoding of the document itself. + +

    If the script's type is "`module`", this encoding will be ignored.

    + 14. Let CORS setting be the current state of the element's <{script/crossorigin}> + content attribute. + 15. If the <{script}> element has a <{script/nonce}> attribute, then let + crytographic nonce be that attribute's value. + + Otherwise, let cryptographic nonce be the empty string. + 16. Let parser state be "`parser-inserted`" if the <{script}> element has been flagged + as "parser-inserted", and "`not parser-inserted`" otherwise. + 17. Let settings be the element's node document's {{Window}} object's + environment settings object. + 18. If the element has a <{script/src}> content attribute, run these substeps: + + 1. Let src be the value of the element's <{script/src}> attribute. + 2. If src is the empty string, queue a task to fire a simple event + named error at the element, and abort these steps. + 3. Set the element's from an external file flag. + 4. Resolve src relative to the element's node document. + 5. If the previous step failed, queue a task to fire a simple event named + error at the element, and abort these steps. + + Otherwise, let url be the resulting URL record. + 6. Switch on the script's type: +
    +
    `"classic"`
    +
    Fetch a classic script given url, CORS setting, + cryptographic nonce, parser state, settings, and + encoding. + +
    `"module"`
    +
    + 1. Let credentials mode be determined by switching on + CORS setting: +
    +
    No CORS
    +
    `"omit"`
    + +
    Anonymous
    +
    `"same-origin"`
    + +
    Use Credentials
    +
    `"include"`
    +
    + 2. Fetch a module script tree given url, + credentials mode, cryptographic nonce, + parser state, "`script`", and settings. +
    +
    + When the chosen algorithm asynchronously completes, set the script's script to the + result. At that time, the script is ready. + + For performance reasons, user agents may start fetching the classic script or module tree + (as defined above) as the <{script/src}> attribute is set, instead, in the hope that the + element will be inserted into the document (and that the + <{script/crossorigin}> attribute won't change value in the meantime). Either way, once + the element is inserted into the document, the load must have + started as described in this step. If the UA performs such prefetching, but the element + is never inserted in the document, or the <{script/src}> attribute is dynamically + changed, or the <{script/crossorigin}> attribute is dynamically changed, then the user + agent will not execute the script so obtained, and the fetching process will have been + effectively wasted. + 19. If the element does not have a <{script/src}> content attribute, run these substeps: + + 1. Let source text be the value of the {{HTMLScriptElement/text}} IDL attribute. + 2. Switch on the script's type: +
    +
    `"classic"`
    +
    + 1. Let script be the result of creating a classic script using + source text and settings. + 2. Set the script's script to script. + 3. The script is ready. +
    + +
    `"module"`
    +
    + 1. Let base URL be the <{script}> element's node document's + document base URL. + 2. Let script be the result of creating a module script using + source text, settings, base URL, and + CORS setting. + 3. If this returns null, set the script's script to null and abort these + substeps; the script is ready. + 4. Fetch the descendants of script. When this asynchronously + completes, set the script's script to the result. At that time, + the script is ready. +
    +
    + 20. Then, follow the first of the following options that describes the situation: +
    +
    +
    + + + + + + + + + + +
    the script's type + <{script/src}> present? + <{script/defer}> present? + <{script/async}> present? + other conditions +
    `"classic"` + yes + yes + no + element flagged as "parser-inserted" +
    `"module"` + yes or no + n/a + no + element flagged as "parser-inserted" +
    + +
    Add the element to the end of the list of scripts that will execute when the + document has finished parsing associated with the {{Document}} of the parser that + created the element. + + When the the script is ready, set the element's "ready to be parser-executed" + flag. The parser will handle executing the script.
    + +
    + + + + + + + + + +
    the script's type + <{script/src}> present? + <{script/defer}> present? + <{script/async}> present? + other conditions +
    `"classic"` + yes + no + no + element flagged as "parser-inserted" +
    +
    +
    The element is the pending parsing-blocking script of the {{Document}} of the + parser that created the element. (There can only be one such script per {{Document}} at a + time.) + + When the script is ready, set the element's "ready to be parser-executed" + flag. The parser will handle executing the script. +
    + +
    + + + + + + + + + + + +
    the script's type + <{script/src}> present? + <{script/defer}> present? + <{script/async}> present? + other conditions +
    `"classic"` + yes + yes or no + no + "non-blocking" flag not set on element +
    `"module"` + yes or no + n/a + no + "non-blocking" flag not set on element +
    +
    +
    Add the element to the end of the list of scripts that will execute in order + as soon as possible associated with the node document of the <{script}> + element at the time the prepare a script algorithm started. + + When the script is ready, run the following steps: + + 1. If the element is not now the first element in the + list of scripts that will execute in order as soon as possible to which it was + added above, then mark the element as ready but abort these steps without executing the + script yet. + 2. Execution: Execute the script block corresponding to the first script + element in this list of scripts that will execute in order as soon as possible. + 3. Remove the first element from this + list of scripts that will execute in order as soon as possible. + 4. If this list of scripts that will execute in order as soon as possible is still + not empty and the first entry has already been marked as ready, then jump back to the + step labeled Execution. + +
    + +
    + + + + + + + + + + + +
    the script's type + <{script/src}> present? + <{script/defer}> present? + <{script/async}> present? + other conditions +
    `"classic"` + yes + yes or no + yes or no + n/a +
    `"module"` + yes or no + n/a + yes or no + n/a +
    +
    +
    The element must be added to the + set of scripts that will execute as soon as possible of the node document + of the <{script}> element at the time the prepare a script algorithm started. + + When the script is ready, execute the script block and then remove the + element from the set of scripts that will execute as soon as possible.
    + +
    + + + + + + + + + +
    the script's type + <{script/src}> present? + <{script/defer}> present? + <{script/async}> present? + other conditions +
    `"classic"` or `"module"` + no + yes or no + yes or no + All of the following: + + * element flagged as "parser-inserted" + * an XML parser or an HTML parser whose + script nesting level is not greater than one created the <{script}> + * the {{Document}} of the XML parser or HTML parser that created + the <{script}> has a style sheet that is blocking scripts + +
    +
    +
    The element is the pending parsing-blocking script of the {{Document}} of the + parser that created the element. (There can only be one such script per {{Document}} at a + time.) + + Set the element's "ready to be parser-executed" flag. The parser will handle + executing the script.
    + +
    Otherwise
    +
    Immediately execute the script block, even if other scripts are already + executing.
    + + + The pending parsing-blocking script of a {{Document}} is used by the {{Document}}'s + parser(s). + +

    If a <{script}> element that blocks a parser gets moved to another {{Document}} + before it would normally have stopped blocking that parser, it nonetheless continues blocking that + parser until the condition that causes it to be blocking the parser no longer applies (e.g., if + the script is a pending parsing-blocking script because there was + a style sheet that is blocking scripts when it was parsed, but then the script is moved to + another {{Document}} before the style sheet loads, the script still blocks the parser until the + style sheets are all loaded, at which time the script executes and the parser is unblocked).

    + + When the user agent is required to execute a script block, it must run the following steps: + + 1. If the element is flagged as "parser-inserted", but the element's node document + is not the {{Document}} of the parser that created the element, then abort these steps. + 2. If the script's script is null, fire a simple event named `error` at the element, + and abort these steps. + 3. If the script is from an external file, or the script's type is "`module`", then + increment the ignore-destructive-writes counter of the <{script}> element's + node document. Let neutralized doc be that {{Document}}. + 4. Let old script element be the value to which the <{script}> element's + node document's {{Document/currentScript}} object was most recently set. + 5. Switch on the script's type: +
    +
    `classic`
    +
    + 1. Set the <{script}> element's node document's {{Document/currentScript}} + attribute to the <{script}> element. + +

    This does not use the in a document check, as the <{script}> + element could have been removed from the document prior to execution, and in that + scenario {{Document/currentScript}} still needs to point to it.

    + 2. Run the classic script given by the script's script. +
    + +
    `module`
    +
    + 1. Set the <{script}> element's node document's {{Document/currentScript}} + attribute to null. + 2. Run the module script given by the script's script. +
    + 6. Set the <{script}> element's node document's {{Document/currentScript}} object to + old script element. + 7. Decrement the ignore-destructive-writes counter of neutralized doc, if it was + incremented in the earlier step. + 8. If the script's type is "`classic`" and the script is from an external file, + fire a simple event named `load` at the <{script}> element. + + Otherwise queue a task to fire a simple event named `load` at the <{script}> + element. + +
    Scripting languages
    + A JavaScript MIME type is a MIME type string that is one of the following and refers to JavaScript: [[!ECMA-262]] @@ -920,57 +841,43 @@ o............A....e
  • text/x-javascript
  • - User agents must recognize all JavaScript MIME - types. - -
    - - User agents may support other MIME types for other languages, - but must not support other MIME types for the languages in the list - above. User agents are not required to support the languages listed above. - - The following MIME types (with or without parameters) must not - be interpreted as scripting languages: + User agents must recognize all JavaScript MIME types. -
      - -
    • text/plain -
    • text/xml + User agents may support other MIME types for other languages, but must not support other + MIME types for the languages in the list above. User agents are not required to support + JavaScript. The processing model for languages other than JavaScript is outside the scope of this + specification. -
    • application/octet-stream -
    • application/xml + The following MIME types (with or without parameters) must not be interpreted as scripting + languages: -
    + * `text/plain` + * `text/xml` + * `application/octet-stream` + * `application/xml` -

    - These types are explicitly listed here because they are poorly-defined types that +

    These types are explicitly listed here because they are poorly-defined types that are nonetheless likely to be used as formats for data blocks, and it would be problematic if they - were suddenly to be interpreted as script by a user agent. -

    + were suddenly to be interpreted as script by a user agent.

    When examining types to determine if they represent supported languages, user agents must not ignore MIME parameters. Types are to be compared including all parameters. -

    - For example, types that include the charset parameter will - not be recognized as referencing any of the scripting languages listed above. -

    - -
    +

    For example, types that include the charset parameter will not be + recognized as referencing any of the scripting languages listed above.

    Restrictions for contents of <{script}> elements
    -

    - The easiest and safest way to avoid the rather strange restrictions described in - this section is to always escape "<!--" as "<\!--", "<script" as "<\script", and "</script" as "<\/script" when these sequences appear in literals in scripts (e.g., in - strings, regular expressions, or comments), and to avoid writing code that uses such constructs in - expressions. Doing so avoids the pitfalls that the restrictions in this section are prone to - triggering: namely, that, for historical reasons, parsing of script blocks in HTML is - a strange and exotic practice that acts unintuitively in the face of these sequences. -

    +

    The easiest and safest way to avoid the rather strange restrictions described in + this section is to always escape "`<!--`" as "`<\!--`", "`<script`" as "`<\script`", + and "`</script`" as "`<\/script`" when these sequences appear in literals in scripts (e.g., + in strings, regular expressions, or comments), and to avoid writing code that uses such constructs + in expressions. Doing so avoids the pitfalls that the restrictions in this section are prone to + triggering: namely, that, for historical reasons, parsing of <{script}> blocks in HTML is a + strange and exotic practice that acts unintuitively in the face of these sequences.

    - The {{Node/textContent}} of a <{script}> element must match the script production in the following ABNF, the character set for which is Unicode. - [[!ABNF]] + The {{Node/textContent}} of a <{script}> element must match the script production in + the following ABNF, the character set for which is Unicode. [[!ABNF]]
         script        = outer *( comment-open inner comment-close outer )
    @@ -1005,8 +912,8 @@ o............A....e
         tag-end       =/ %x003E ; U+003E GREATER-THAN SIGN (>)
       
    - When a <{script}> element contains script documentation, there are - further restrictions on the contents of the element, as described in the section below. + When a <{script}> element contains script documentation, there are further restrictions on + the contents of the element, as described in the section below.
    The following script illustrates this issue. Suppose you have a script that contains a string, @@ -1017,7 +924,7 @@ o............A....e console.log(example); - If one were to put this string directly in a script block, it would violate the + If one were to put this string directly in a <{script}> block, it would violate the restrictions above:
    @@ -1029,10 +936,10 @@ o............A....e
     
         The bigger problem, though, and the reason why it would violate those restrictions, is that
         actually the script would get parsed weirdly: the script block above is not terminated.
    -    That is, what looks like a "</script>" end tag in this snippet is
    -    actually still part of the script block. The script doesn't execute (since it's not
    -    terminated); if it somehow were to execute, as it might if the markup looked as follows, it would
    -    fail because the script is not valid JavaScript:
    +    That is, what looks like a "`</script>`" end tag in this snippet is actually still part of 
    +    the <{script}> block. The script doesn't execute (since it's not terminated); if it somehow were 
    +    to execute, as it might if the markup looked as follows, it would fail because the script is not 
    +    valid JavaScript:
     
         
           <script>
    @@ -1045,8 +952,9 @@ o............A....e
           </script>
         
    - What is going on here is that for legacy reasons, "<!--" and "<script" strings in <{script}> elements in HTML need to be balanced - in order for the parser to consider closing the block. + What is going on here is that for legacy reasons, "`<!--`" and "`<script`" strings in + <{script}> elements in HTML need to be balanced in order for the parser to consider closing the + block. By escaping the problematic strings as mentioned at the top of this section, the problem is avoided entirely: @@ -1082,17 +990,17 @@ o............A....e
    Doing this also avoids a different pitfall as well: for related historical reasons, the string - "<!--" in JavaScript is actually treated as a line comment start, just like "//". + "`<!--`" in classic scripts is actually treated as a line comment start, just like + "`//`".
    Inline documentation for external scripts
    - If a <{script}> element's <{script/src}> attribute is - specified, then the contents of the <{script}> element, if any, must be such that the - value of the text IDL attribute, which is derived from the - element's contents, matches the documentation production in the following - ABNF, the character set for which is Unicode. [[!ABNF]] + If a <{script}> element's <{script/src}> attribute is specified, then the contents of the + <{script}> element, if any, must be such that the value of the {{HTMLScriptElement/text}} IDL + attribute, which is derived from the element's contents, matches the `documentation` production in + the following ABNF, the character set for which is Unicode. [[!ABNF]]
         documentation = *( *( space / tab / comment ) [ line-comment ] newline )
    @@ -1113,9 +1021,7 @@ o............A....e
                         ; a Unicode character other than U+002F SOLIDUS (/)
       
    -

    - This corresponds to putting the contents of the element in JavaScript - comments. +

    This corresponds to putting the contents of the element in JavaScript comments.

    @@ -1127,7 +1033,7 @@ o............A....e This allows authors to include documentation, such as license information or API information, inside their documents while still referring to external script files. The syntax is constrained so that authors don't accidentally include what looks like valid script while also providing a - src attribute. + <{script/src}> attribute.

           <script src="cool-effects.js">
    @@ -1140,8 +1046,6 @@ o............A....e
         
    -
    -
    Interaction of <{script}> elements and XSLT
    This section is non-normative. @@ -1150,33 +1054,26 @@ o............A....e However, in the absence of another specification actually defining this, here are some guidelines for implementors, based on existing implementations: -
      - -
    • When an XSLT transformation program is triggered by an <?xml-stylesheet?> processing instruction and the browser implements a - direct-to-DOM transformation, <{script}> elements created by the XSLT processor need to - be marked "parser-inserted" and run in document order (modulo scripts marked defer or async), - immediately, as the transformation is occurring.
    • - -
    • The XSLTProcessor.transformToDocument() method - adds elements to a Document that is not in a browsing context, and, - accordingly, any <{script}> elements they create need to have their "already - started" flag set in the prepare a script algorithm and never get executed - (scripting is disabled). Such script - elements still need to be marked "parser-inserted", though, such that their async IDL attribute will return false in the absence of an async content attribute.
    • - -
    • The XSLTProcessor.transformToFragment() method - needs to create a fragment that is equivalent to one built manually by creating the elements - using document.createElementNS(). For instance, - it needs to create <{script}> elements that aren't "parser-inserted" and - that don't have their "already started" flag set, so that they will execute when the - fragment is inserted into a document.
    • - -
    + * When an XSLT transformation program is triggered by an `<?xml-stylesheet?>` processing + instruction and the browser implements a direct-to-DOM transformation, <{script}> elements + created by the XSLT processor need to be marked "parser-inserted" and run in document + order (modulo scripts marked <{script/defer}> or <{script/async}>), immediately, as the + transformation is occurring. + * The XSLTProcessor.transformToDocument() method adds elements to a {{Document}} that + is not in a browsing context, and, accordingly, any <{script}> elements they create need + to have their "already started" flag set in the prepare a script algorithm and + never get executed (scripting is disabled). Such <{script}> elements still need to be + marked "parser-inserted", though, such that their {{HTMLScriptElement/async}} IDL + attribute will return false in the absence of an <{script/async}> content attribute. + * The XSLTProcessor.transformToFragment() method needs to create a fragment that is + equivalent to one built manually by creating the elements using + {{Document/createElementNS()|document.createElementNS()}}. For instance, it needs to create + <{script}> elements that aren't "parser-inserted" and that don't have their + "already started" flag set, so that they will execute when the fragment is + inserted into a document. The main distinction between the first two cases and the last case is that the first two - operate on Documents and the last operates on a fragment. - -
    + operate on {{Document}}s and the last operates on a fragment.

    The noscript element

    @@ -1201,104 +1098,66 @@ o............A....e
    Allowed ARIA state and property attributes:
    Global aria-* attributes
    DOM interface:
    -
    Uses HTMLElement.
    +
    Uses {{HTMLElement}}.
    - The <{noscript}> element represents nothing if scripting is enabled, and represents its children if - scripting is disabled. It is used to present different + The <{noscript}> element represents nothing if scripting is enabled, and + represents its children if scripting is disabled. It is used to present different markup to user agents that support scripting and those that don't support scripting, by affecting how the document is parsed. When used in HTML documents, the allowed content model is as follows: -
    - -
    In a <{head}> element, if scripting is - disabled for the <{noscript}> element
    - -
    The <{noscript}> element must contain only <{link}>, <{style}>, - and <{meta}> elements.
    - -
    In a <{head}> element, if scripting is enabled - for the <{noscript}> element
    - -
    The <{noscript}> element must contain only text, except that invoking the - HTML fragment parsing algorithm with - the <{noscript}> element as the context - element and the text contents as the input must result in a list of nodes - that consists only of <{link}>, <{style}>, and <{meta}> elements that - would be conforming if they were children of the <{noscript}> element, and no parse errors.
    - -
    Outside of <{head}> elements, if scripting is - disabled for the <{noscript}> element
    - -
    The <{noscript}> element's content model is transparent, with the - additional restriction that a <{noscript}> element must not have a noscript - element as an ancestor (that is, noscript can't be nested).
    - -
    Outside of <{head}> elements, if scripting is - enabled for the <{noscript}> element
    - -
    - - The <{noscript}> element must contain only text, except that the text must be such - that running the following algorithm results in a conforming document with no - <{noscript}> elements and no <{script}> elements, and such that no step in the - algorithm throws an exception or causes an HTML parser to flag a parse error: - -
      - -
    1. Remove every <{script}> element from the document.
    2. - -
    3. Make a list of every <{noscript}> element in the document. For every - <{noscript}> element in that list, perform the following steps: - -
        - -
      1. Let s be the concatenation of all the Text node - children of the <{noscript}> element.
      2. - -
      3. Set the outerHTML attribute of the - <{noscript}> element to the value of s. (This, as a - side-effect, causes the <{noscript}> element to be removed from the document.) [[!DOMPARSING]]
      4. - -
      - -
    4. - -
    - -
    - -
    - -

    - All these contortions are required because, for historical reasons, the - <{noscript}> element is handled differently by the HTML parser based on - whether scripting was enabled or not when the parser was - invoked. -

    + : In a <{head}> element, if scripting is disabled for the <{noscript}> element + :: The <{noscript}> element must contain only <{link}>, <{style}>, and <{meta}> elements. + + : In a <{head}> element, if scripting is enabled for the <{noscript}> element + :: The <{noscript}> element must contain only text, except that invoking the + HTML fragment parsing algorithm with the <{noscript}> element as the context + element and the text contents as the input must result in a list of nodes that + consists only of <{link}>, <{style}>, and <{meta}> elements that would be conforming if they + were children of the <{noscript}> element, and no + parse errors. + + : Outside of <{head}> elements, if scripting is disabled for the <{noscript}> element + :: The <{noscript}> element's content model is transparent, with the additional restriction + that a <{noscript}> element must not have a <{noscript}> element as an ancestor (that is, + <{noscript}> can't be nested). + + : Outside of <{head}> elements, if scripting is enabled for the <{noscript}> element + :: The <{noscript}> element must contain only text, except that the text must be such that running + the following algorithm results in a conforming document with + no <{noscript}> elements and no <{script}> elements, and such that no step in the algorithm + throws an exception or causes an HTML parser to flag a parse error: + + 1. Remove every <{script}> element from the document. + 2. Make a list of every <{noscript}> element in the document. For every <{noscript}> element + in that list, perform the following steps: + + 1. Let s be the concatenation of all the {{Text}} node children of the + <{noscript}> element. + 2. Set the outerHTML attribute of the <{noscript}> element to the value of + s. (This, as a side-effect, causes the <{noscript}> element to be removed + from the document.) [[!DOMPARSING]] + +

    All these contortions are required because, for historical reasons, the + <{noscript}> element is handled differently by the HTML parser based on whether + scripting was enabled or not when the parser was invoked.

    The <{noscript}> element must not be used in XML documents. -

    - The <{noscript}> element is only effective in the HTML syntax, it has no effect in the XHTML syntax. This is because the way it works - is by essentially "turning off" the parser when scripts are enabled, so that the contents of the - element are treated as pure text and not as real elements. XML does not define a mechanism by - which to do this. -

    - -
    - - The <{noscript}> element has no other requirements. In particular, children of the - <{noscript}> element are not exempt from [[#forms-form-submission]], scripting, and so - forth, even when scripting is enabled for the element. +

    The <{noscript}> element is only effective in + the HTML syntax, it has no effect in the XHTML syntax. + This is because the way it works is by essentially "turning off" the parser when scripts are + enabled, so that the contents of the element are treated as pure text and not as real elements. + XML does not define a mechanism by which to do this.

    -
    + The <{noscript}> element has no other requirements. In particular, children of the <{noscript}> + element are not exempt from [[#forms-form-submission]], scripting, and so forth, even when + scripting is enabled for the element.
    - In the following example, a <{noscript}> element is - used to provide fallback for a script. + In the following example, a <{noscript}> element is used to provide fallback for a script.
     <form action="calcSquare.php">
    @@ -1354,7 +1213,7 @@ o............A....e
     </form>
         
    - The above technique is also useful in XHTML, since noscript is not supported in + The above technique is also useful in XHTML, since <{noscript}> is not supported in the XHTML syntax.
    From bfa7886fded51b9757c41405d4b4c3a270aa1f34 Mon Sep 17 00:00:00 2001 From: Travis Leithead Date: Thu, 12 May 2016 09:30:39 -0700 Subject: [PATCH 10/19] pulling in more required sections for linking issues --- sections/attributes.include | 2 +- sections/browsers.include | 1436 +++++++++-------- sections/dom.include | 21 +- sections/editing.include | 6 +- sections/infrastructure.include | 150 +- sections/obsolete.include | 4 +- sections/rendering.include | 12 +- sections/semantics-document-metadata.include | 47 +- sections/semantics-embedded-content.include | 693 ++++---- sections/semantics-forms.include | 29 +- .../semantics-interactive-elements.include | 6 +- sections/semantics-links.include | 58 +- sections/semantics-root.include | 2 +- sections/semantics-scriptings.include | 146 +- sections/syntax.include | 17 +- sections/webappapis.include | 116 +- single-page.bs | 138 +- 17 files changed, 1542 insertions(+), 1341 deletions(-) diff --git a/sections/attributes.include b/sections/attributes.include index b9aaa7616a..b5f798879f 100644 --- a/sections/attributes.include +++ b/sections/attributes.include @@ -477,7 +477,7 @@ mediagroup <{audio}>; <{video}> - Groups media elements together with an implicit {{MediaController}} + Groups media elements together with an implicit {{MediaController}} Text diff --git a/sections/browsers.include b/sections/browsers.include index f5cd268597..a828101592 100644 --- a/sections/browsers.include +++ b/sections/browsers.include @@ -21,85 +21,85 @@

    Browsing contexts

    - A browsing context is an environment in which Document objects are - presented to the user. + A browsing context is an environment in which + {{Document}} objects are presented to the user. -

    - A tab or window in a Web browser typically contains a browsing context, as does an iframe or frames in a - frameset. -

    +

    A tab or window in a Web browser typically contains a browsing context, as + does an <{iframe}> or <{frame}>s in a <{frameset}>.

    - A browsing context has a corresponding WindowProxy object. + A browsing context has a corresponding {{WindowProxy}} object. A browsing context has a session history, which lists the - Document objects that the browsing context has presented, is - presenting, or will present. At any time, one Document in each browsing context is designated the active document. A Document's + {{Document}} objects that the browsing context has presented, is + presenting, or will present. At any time, one {{Document}} in each browsing context + is designated the active document. A {{Document}}'s browsing context is that browsing context whose session - history contains the {{Document}}, if any. (A Document created using - an API such as createDocument() has no - browsing context.) Each Document in a browsing context is - associated with a Window object. - -

    - In general, there is a 1-to-1 mapping from the Window object to the - Document object. There are two exceptions. First, a Window can be reused - for the presentation of a second Document in the same browsing context, - such that the mapping is then 1-to-2. This occurs when a browsing context is navigated from the initial about:blank Document - to another, with replacement enabled. Second, a Document can end up - being reused for several Window objects when the document.open() method is used, such that the mapping is then - many-to-1. -

    + history contains the {{Document}}, if any. (A {{Document}} created using + an API such as {{DOMImplementation/createDocument()}} has no + browsing context.) Each {{Document}} in a browsing context is + associated with + a {{Window}} object.

    - A Document does not necessarily have a browsing context + In general, there is a 1-to-1 mapping from the {{Window}} object to the + {{Document}} object. There are two exceptions. First, a {{Window}} can be reused + for the presentation of a second {{Document}} in the same browsing context, + such that the mapping is then 1-to-2. This occurs when a browsing context is + navigated from the initial about:blank {{Document}} + to another, with replacement enabled. Second, a {{Document}} can end up + being reused for several {{Window}} objects when the {{Document/open()|document.open()}} method is + used, such that the mapping is then many-to-1.

    + +

    A {{Document}} does not necessarily have a browsing context associated with it. In particular, data mining tools are likely to never instantiate browsing - contexts. -

    + contexts.


    A browsing context can have a creator browsing context, the - browsing context that was responsible for its creation. If a browsing - context has a parent browsing context, then that is its creator browsing - context. Otherwise, if the browsing context has an opener browsing - context, then that is its creator browsing context. Otherwise, the - browsing context has no creator browsing context. - - If a browsing context A has a creator browsing - context, then the Document that was the active document of that - creator browsing context at the time A was created is the - creator Document. + browsing context that was responsible for its creation. If a browsing context has a + parent browsing context, then that is its creator browsing context. Otherwise, if + the browsing context has an opener browsing context, then that is its + creator browsing context. Otherwise, the browsing context has no + creator browsing context. + + If a browsing context A has a creator browsing context, then the + creator origin, creator URL, and creator base URL are the + origin, URL, and base URL, respectively, of the {{Document}} that + was the active document of that creator browsing context at the time A + was created. To create a new browsing context: - 1. Call the JavaScript InitializeHostDefinedRealm() abstract operation with the following + 1. Call the JavaScript InitializeHostDefinedRealm() abstract operation with the following customizations: - + * For the global object, create a new {{Window}} object window. - * For the global this value, create a new {{WindowProxy}} object + * For the global this value, create a new {{WindowProxy}} object windowProxy, whose \[[{{Window}}]] internal slot value is window. - +

    The internal slot value is updated when navigations occur.

    * Let realm execution context be the created JavaScript execution context. 2. Set the new browsing context's associated {{WindowProxy}} to windowProxy. - 3. Let document be a new {{Document}}, whose URL is about:blank, - which is marked as being an HTML document, whose character encoding is UTF-8, - and which is both ready for post-load tasks and completely loaded immediately. + 3. Let document be a new {{Document}}, whose URL is + about:blank, which is marked as being an HTML document, whose + character encoding is UTF-8, and which is both ready for post-load tasks and + completely loaded immediately. 4. Set the origin of document: - - * If the new browsing context has a creator browsing context, then the + + * If the new browsing context has a creator browsing context, then the origin of document is the creator origin. - * Otherwise, the origin of document is a unique opaque originassigned - when the new browsing context is created. - 5. If the new browsing context has a creator browsing context, then set + * Otherwise, the origin of document is a unique opaque origin + assigned when the new browsing context is created. + 5. If the new browsing context has a creator browsing context, then set document's referrer to the creator URL. - 6. Ensure that document has a single child <{html}> node, which itself has two empty + 6. Ensure that document has a single child <{html}> node, which itself has two empty child nodes: a <{head}> element, and a <{body}> element. 7. Implement the sandboxing for document. 8. Add document to the new browsing context's session history. 9. Set window's associated {{Document}} to document. - 10. Set up a browsing context environment settings object with realm execution - context. + 10. Set up a browsing context environment settings object with + realm execution context.

    Nested browsing contexts

    @@ -777,10 +777,283 @@ +

    Script settings for browsing contexts

    + + When the user agent is required to + set up a browsing context environment settings object, given a JavaScript execution + context execution context, it must run the following steps: + + 1. Let realm be the value of execution context's Realm component. + 2. Let window be realm's global object. + 3. Let url be a copy of the URL of the {{Document}} with which + window associated. + 4. Let settings object be a new environment settings object whose algorithms are + defined as follows: + : The realm execution context + :: Return execution context. + + : The module map + :: Return the module map of the {{Document}} with which window is currently + associated. + + : The responsible browsing context + :: Return the browsing context with which window is associated. + + : The responsible event loop + :: Return the event loop that is associated with the + unit of related similar-origin browsing contexts to which window's + browsing context belongs. + + : The responsible document + :: Return the {{Document}} with which window is currently associated. + + : The API URL character encoding + :: Return the current character encoding of the {{Document}} with which + window is currently associated. + + : The API base URL + :: Return the current base URL of the {{Document}} with which window is + currently associated. + + : The origin + :: Return the origin of the {{Document}} with which window is currently + associated. + + : The creation URL + :: Return url. + + : The HTTPS state + :: Return the HTTPS state of the {{Document}} with which window is currently + associated. + 5. Set realm's \[[HostDefined]] field to settings object. + 6. Return settings object. + +

    Security infrastructure for Window, WindowProxy, and Location objects

    + + Although typically objects cannot be accessed across origins, the web platform would not be true + to itself if it did not have some legacy exceptions to that rule that the web depends upon. + +

    Integration with IDL

    + + When perform a security check is invoked, with a platformObject, + realm, identifier, and type, run these steps: + + 1. If platformObject is a {{Window}} or {{Location}} object, then: + 1. Repeat for each e that is an element of + CrossOriginProperties(platformObject): + 1. If SameValue(e.\[[Property]], identifier) is true, then: + 1. If type is "method" and e has neither + \[[NeedsGet]] nor \[[NeedsGet]], then return. + 2. Otherwise, if type is "getter" and + e.\[[NeedsGet]] is true, then return. + 3. Otherwise, if type is "setter" and + e.\[[NeedsSet]] is true, then return. + 2. If IsPlatformObjectSameOrigin(platformObject) is false, then throw a + "SecurityError" {{DOMException}}. + +

    Shared internal slot: \[[CrossOriginPropertyDescriptorMap]]

    + + {{Window}} and {{Location}} objects both have a \[[CrossOriginPropertyDescriptorMap]] + internal slot, whose value is initially an empty map. + +

    The \[[CrossOriginPropertyDescriptorMap]] internal slot contains a map with + entries whose keys are (currentOrigin, objectOrigin, propertyKey)-tuples and values are property + descriptors, as a memoization of what is visible to scripts when currentOrigin inspects a + {{Window}} or {{Location}} object from objectOrigin. It is filled lazily by + CrossOriginGetOwnPropertyHelper, which consults it on future lookups.

    + + User agents should allow a value held in the map to be garbage collected along with its + corresponding key when nothing holds a reference to any part of the value. That is, as long as + garbage collection is not observable. + +
    + For example, with +
    const href = Object.getOwnPropertyDescriptor(crossOriginLocation, "href").set
    + the value and its corresponding key in the map cannot be garbage collected as that would be + observable. +
    + + User agents may have an optimization whereby they remove key-value pairs from the map when + {{Document/domain|document.domain}} is set. This is not observable as + {{Document/domain|document.domain}} cannot revisit an earlier value. + +
    + For example, setting {{Document/domain|document.domain}} to "example.com" on + www.example.com means user agents can remove all key-value pairs from the map where + part of the key is www.example.com, as that can never be part of the origin again and + therefore the corresponding value could never be retrieved from the map. +
    + +

    Shared abstract operations

    + +
    CrossOriginProperties ( O )
    + + 1. Assert: O is a {{Location}} or {{Window}} object. + 2. If O is a {{Location}} object, then return «
    {
    +        \[[Property]]: "href",
    +        \[[NeedsGet]]: false,
    +        \[[NeedsSet]]: true
    +      }, {
    +        \[[Property]]: "replace"
    +      }
    ». + 3. Let crossOriginWindowProperties be «
    {
    +        \[[Property]]: "window",
    +        \[[NeedsGet]]: true,
    +        \[[NeedsSet]]: false
    +      }, {
    +        \[[Property]]: "self",
    +        \[[NeedsGet]]: true,
    +        \[[NeedsSet]]: false
    +      }, {
    +        \[[Property]]: "location",
    +        \[[NeedsGet]]: true,
    +        \[[NeedsSet]]: true
    +      }, {
    +        \[[Property]]: "close"
    +      }, {
    +        \[[Property]]: "closed",
    +        \[[NeedsGet]]: true,
    +        \[[NeedsSet]]: false
    +      }, {
    +        \[[Property]]: "focus"
    +      }, {
    +        \[[Property]]: "blur"
    +      }, {
    +        \[[Property]]: "frames",
    +        \[[NeedsGet]]: true,
    +        \[[NeedsSet]]: false
    +      }, {
    +        \[[Property]]: "length",
    +        \[[NeedsGet]]: true,
    +        \[[NeedsSet]]: false
    +      }, {
    +        \[[Property]]: "top",
    +        \[[NeedsGet]]: true,
    +        \[[NeedsSet]]: false
    +      }, {
    +        \[[Property]]: "opener",
    +        \[[NeedsGet]]: true,
    +        \[[NeedsSet]]: false
    +      }, {
    +        \[[Property]]: "parent",
    +        \[[NeedsGet]]: true,
    +        \[[NeedsSet]]: false
    +      }, {
    +        \[[Property]]: "postMessage"
    +      }
    ». + 4. Repeat for each e that is an element of the + child browsing context name property set: + 1. Add { \[[Property]]: e } as the last element of crossOriginWindowProperties. + 5. Return crossOriginWindowProperties. + +

    Indexed properties do not need to be safelisted as they are handled directly by + the {{WindowProxy}} object.

    + +
    IsPlatformObjectSameOrigin ( O )
    + + 1. Return true if the current settings object's origin is same origin-domain + with O's relevant settings object's origin, and false otherwise. + +
    CrossOriginGetOwnPropertyHelper ( O, P )
    + +

    If this abstract operation returns undefined and there is no custom behavior, the + caller needs to throw a "SecurityError" {{DOMException}}.

    + + 1. If P is @@toStringTag, + @@hasInstance, or + @@isConcatSpreadable, then return PropertyDescriptor + { \[[Value]]: undefined, \[[Writable]]: false, \[[Enumerable]]: false, + \[[Configurable]]: true }. + 2. Let crossOriginKey be a tuple consisting of the current settings object's + origin's effective domain, O's relevant settings object's + origin's effective domain, and P. + 3. Repeat for each e that is an element of CrossOriginProperties(O): + 1. If SameValue(e.\[[Property]], P) is true, then: + 1. If the value of the \[[CrossOriginPropertyDescriptorMap]] internal slot of + O contains an entry whose key is crossOriginKey, then return that + entry's value. + 2. Let originalDesc be OrdinaryGetOwnProperty(O, + P). + 3. Let crossOriginDesc be CrossOriginPropertyDescriptor(e, + originalDesc). + 4. Create an entry in the value of the \[[CrossOriginPropertyDescriptorMap]] + internal slot of O with key crossOriginKey and value + crossOriginDesc. + 5. Return crossOriginDesc. + 4. Return undefined. + +
    CrossOriginPropertyDescriptor ( crossOriginProperty, originalDesc )
    + + 1. If crossOriginProperty.\[[NeedsGet]] and + crossOriginProperty.\[[NeedsSet]] are absent, then: + 1. Let value be originalDesc.\[[Value]]. + 2. If IsCallable(value) is true, set value to + CrossOriginFunctionWrapper(true, value). + 3. Return PropertyDescriptor{ \[[Value]]: value, \[[Enumerable]]: false, + \[[Writable]]: false, \[[Configurable]]: true }. + 2. Otherwise: + 1. Let crossOriginGet be + CrossOriginFunctionWrapper(crossOriginProperty.\[[NeedsGet]], + originalDesc.\[[Get]]). + 2. Let crossOriginSet be + CrossOriginFunctionWrapper(crossOriginProperty.\[[NeedsSet]], + originalDesc.\[[Set]]). + 3. Return PropertyDescriptor{ \[[Get]]: crossOriginGet, + \[[Set]]: crossOriginSet, \[[Enumerable]]: false, \[[Configurable]]: true }. + +
    CrossOriginFunctionWrapper ( needsWrapping, functionToWrap )
    + + 1. If needsWrapping is false, then return undefined. + 2. Return a new cross-origin wrapper function whose \[[Wrapped]] internal slot is + functionToWrap. + + A cross-origin wrapper function is an anonymous built-in function that has a + \\[[Wrapped]] internal slot. + + When a cross-origin wrapper function F is called with a list of arguments + argumentsList, the following steps are taken: + + 1. Assert: F has a \[[Wrapped]] internal slot that is a function. + 2. Let wrappedFunction be the \[[Wrapped]] internal slot of F. + 3. Return Call(wrappedFunction, this, argumentsList). + +

    Due to this being invoked from a different origin, a + cross-origin wrapper function will have a different value for + Function.prototype from the function being wrapped. This follows from how JavaScript + creates anonymous built-in functions.

    + +
    CrossOriginGet ( O, P, Receiver )
    + + 1. Let desc be O.\[[GetOwnProperty]](P). + 2. Assert: desc is not undefined. + 3. If IsDataDescriptor(desc) is true, then return desc.\[[Value]]. + 4. Assert: IsAccessorDescriptor(desc) is true. + 5. Let getter be desc.\[[Get]]. + 6. If getter is undefined, throw a "SecurityError" {{DOMException}}. + 7. Return Call(getter, Receiver). + +
    CrossOriginSet ( O, P, V, Receiver )
    + + 1. Let desc be O.\[[GetOwnProperty]](P). + 2. Assert: desc is not undefined. + 3. If IsAccessorDescriptor(desc) is true, then: + 1. Let setter be desc.\[[Set]]. + 2. If setter is undefined, return false. + 3. Perform Call(setter, Receiver, «V»). + 4. Return true. + 4. Return false. + +
    CrossOriginOwnPropertyKeys ( O )
    + + 1. Let keys be a new empty List. + 2. Repeat for each e that is an element of CrossOriginProperties(O): + 1. Add e.\[[Property]] as the last element of keys. + 3. Return keys. +

    The Window object

    -    [PrimaryGlobal]
    +    [PrimaryGlobal, LegacyUnenumerableNamedProperties]
         /*sealed*/ interface Window : EventTarget {
         // the current browsing context
         [Unforgeable] readonly attribute WindowProxy window;
    @@ -1095,9 +1368,9 @@
     
         
     
    -    Otherwise, resolve url relative to the
    -    API base URL specified by entry settings, and let resource be
    -    the resulting absolute URL, if any. If the resolve a URL algorithm
    +    Otherwise, parse url relative to entry settings, and let
    +    resource be
    +    the resulting URL record, if any. If the parse a URL algorithm
         failed, then run one of the following two steps instead:
     
         
      @@ -1233,44 +1506,34 @@

      Named access on the Window object

      -
      window[name]
      - -
      - - Returns the indicated element or collection of elements. +
      Returns the indicated element or collection of elements. As a general rule, relying on this will lead to brittle code. Which IDs end up mapping to this API can vary over time, as new features are added to the Web platform, for example. Instead - of this, use document.getElementById() or document.querySelector(). - + of this, use {{Document/getElementById()|document.getElementById()}} or + document.querySelector().
      -
      -
      - - The Window interface supports named properties. The supported property names at any moment consist of the - following, in tree order, ignoring later duplicates: - - - - The properties exposed in this way must be unenumerable. - - To determine the value of a named property name when the Window object is indexed for property - retrieval, the user agent must return the value obtained using the following steps: + The child browsing context name property set consists of the + browsing context names of any child browsing context of the active document + whose name is not the empty string, with duplicates omitted. + + The Window interface supports named properties. + The supported property names at any moment consist of the following, in tree order, + ignoring later duplicates: + + * the child browsing context name property set. + * the value of the name content attribute for all <{a}>, <{applet}>, <{area}>, + <{embed}>, <{form}>, <{frameset}>, <{img}>, and <{object}> elements in the + active document that have a non-empty name content attribute, and + * the value of the id content attribute of any HTML element in the + active document with a non-empty id content attribute. + + To determine the value of a named property name when + the Window object is indexed for property retrieval, the user agent must + return the value obtained using the following steps:
        @@ -1326,8 +1589,6 @@
    - -

    Garbage collection and browsing contexts

    @@ -1541,35 +1802,29 @@
    -
    -

    The WindowProxy object

    -
    -    [NoInterfaceObject]
    -    interface WindowProxy : Window {};
    -  
    + A WindowProxy is an exotic object that wraps a {{Window}} + ordinary object, indirecting most operations through to the wrapped object. Each + browsing context has an associated {{WindowProxy}} object. When the browsing context + is navigated, the {{Window}} object wrapped by the browsing context's associated + {{WindowProxy}} object is changed. + + There is no {{WindowProxy}} interface object. - As mentioned earlier, each browsing context has a - WindowProxy object. This object is unusual in that all operations that - would be performed on it must be performed on the Window object of the browsing - context's active document instead. It is thus indistinguishable from that - Window object in every way until the browsing context is navigated. + Every {{WindowProxy}} object has a \[[Window]] internal slot + representing the wrapped {{Window}} object. - There is no WindowProxy interface object. - -

    - The WindowProxy object allows scripts to act as if each - browsing context had a single Window object, while still keeping - separate {{Window}} objects for each {{Document}}. -

    +

    Although {{WindowProxy}} is named as a "proxy", it does not do polymorphic + dispatch on its target's internal methods as a real proxy would, due to a desire to reuse + machinery between {{WindowProxy}} and {{Location}} objects. As long as the {{Window}} object + remains an ordinary object this is unobservable and can be implemented either way.

    - In the following example, the variable x is set to the - WindowProxy object returned by the window accessor - on the global object. All of the expressions following the assignment return true, because in - every respect, the WindowProxy object acts like the underlying Window - object. + In the following example, the variable x is set to the {{WindowProxy}} object + returned by the {{Window/window}} accessor on the global object. All of the + expressions following the assignment return true, because the {{WindowProxy}} object passes + most operations through to the underlying ordinary {{Window}} object.
           var x = window;
    @@ -1578,8 +1833,115 @@
         
    -
    - +
    The WindowProxy internal methods
    + + The {{WindowProxy}} object internal methods are described in the subsections below. + +
    \[[GetPrototypeOf]] ( )
    + + 1. Let W be the value of the \[[Window]] internal slot of + this. + 2. If IsPlatformObjectSameOrigin(W) is true, then return ! + OrdinaryGetPrototypeOf(W). + 3. Return null. + +
    \[[SetPrototypeOf]] ( V )
    + + 1. Return false. + +
    \[[IsExtensible]] ( )
    + + 1. Return true. + +
    \[[PreventExtensions]] ( )
    + + 1. Return false. + +
    \[[GetOwnProperty]] ( P )
    + + 1. Let W be the value of the \[[Window]] internal slot of + this. + 2. If P is an array index property name, then: + 1. Let index be ToUint32(P). + 2. Let maxProperties be the number of child browsing contexts of + W. + 3. Let value be undefined. + 4. If maxProperties is greater than 0 and index is less than + maxProperties, then: + 1. Set value to the {{WindowProxy}} object of the indexth + child browsing context of the {{Document}} that is + nested through an element that is in W's {{Document}}, sorted in the + order that the elements nesting those browsing contexts were most recently + inserted into the {{Document}}, the {{WindowProxy}} object of the most recently + inserted browsing context container's nested browsing context being + last. + 5. Return PropertyDescriptor{ \[[Value]]: value, \[[Writable]]: false, + \[[Enumerable]]: false, \[[Configurable]]: true }. + 3. If IsPlatformObjectSameOrigin(W) is true, then return + OrdinaryGetOwnProperty(W, P). + +

    This violates JavaScript's internal method invariants.

    + 4. Let property be CrossOriginGetOwnPropertyHelper(W, P). + 5. If property is not undefined, return property. + 6. If property is undefined and P is in the + child browsing context name property set, then: + 1. Let value be the {{WindowProxy}} object of the named object with the name + P. + 2. Return PropertyDescriptor{ \[[Value]]: value, \[[Enumerable]]: false, + \[[Writable]]: false, \[[Configurable]]: true }. + 7. Throw a "SecurityError" {{DOMException}}. + +
    \[[DefineOwnProperty]] ( P, Desc )
    + + 1. If P is an array index property name, return false. + 2. Let W be the value of the \[[Window]] internal slot of + this. + 3. If IsPlatformObjectSameOrigin(W) is true, then return + OrdinaryDefineOwnProperty(W, P, Desc). + +

    See above about how this violates JavaScript's internal method invariants.

    + 4. Return false. + +
    \[[Get]] ( P, Receiver )
    + + 1. Let W be the value of the \[[Window]] internal slot of + this. + 2. If IsPlatformObjectSameOrigin(W) is true, then return + OrdinaryGet(this, P, Receiver). + 3. Return ? CrossOriginGet(this, P, Receiver). + +
    \[[Set]] ( P, V, Receiver )
    + + 1. Let W be the value of the \[[Window]] internal slot of + this. + 2. If IsPlatformObjectSameOrigin(W) is true, then return + OrdinarySet(W, this, Receiver). + 3. Return CrossOriginSet(this, P, V, Receiver). + +
    \[[Delete]] ( P )
    + + 1. If P is an array index property name, return false. + 2. Let W be the value of the \[[Window]] internal slot of + this. + 3. If IsPlatformObjectSameOrigin(W) is true, then return + OrdinaryDelete(W, P). + 4. Return false. + +
    \[[OwnPropertyKeys]] ( )
    + + 1. Let W be the value of the \[[Window]] internal slot of + this. + 2. Let keys be a new empty List. + 3. Let maxProperties be the number of child browsing contexts of W. + 4. Let index be 0. + 5. Repeat while index < maxProperties, + 1. Add ! ToString(index) as the last element of keys. + 2. Increment index by 1. + 6. If IsPlatformObjectSameOrigin(W) is true, then return the concatenation of + keys and ! OrdinaryOwnPropertyKeys(W). + 7. Return the concatenation of keys and ! + CrossOriginOwnPropertyKeys(W). +

    Origin

    Origins are the fundamental currency of the Web's security model. Two actors in the Web @@ -1587,332 +1949,216 @@ Actors with differing origins are considered potentially hostile versus each other, and are isolated from each other to varying degrees. -

    - For example, if Example Bank's Web site, hosted at bank.example.com, tries to examine the DOM of Example Charity's Web site, hosted - at charity.example.org, a SecurityError exception will be - raised. +

    For example, if Example Bank's Web site, hosted at + bank.example.com, tries to examine the DOM of Example Charity's Web site, hosted at + charity.example.org, a "SecurityError" {{DOMException}} will be raised.


    - The origin of a resource and the - effective script origin of a resource are each one of the - following: - -
    - -
    Opaque identifiers + An origin is one of the following: -
    - - Internal values, with no serialization, for which the only meaningful operation is testing - for equality. + : An opaque origin + :: An internal value, with no serialisation, for which the only meaningful operation is testing + for equality. -
    Tuples + : A tuple origin + :: A tuple consists of: -
    + * A scheme (a scheme). + * A host (a host). + * A port (a port). + * A domain (null or a domain). Null unless + stated otherwise. - Tuples consisting of a scheme component, a host component, a port component, and optionally - extra data. - -

    - The extra data could include the certificate of the site when using encrypted - connections, to ensure that if the site's secure certificate changes, the origin is considered to - change as well. +

    Origins can be shared, e.g., among multiple {{Document}} objects. Furthermore, + origins are generally immutable. Only the domain of a + tuple origin can be changed, and only through the {{Document/domain|document.domain}} API.

    -
    Aliases - -
    - - A reference to another origin or effective script origin. - -
    - -
    - - An origin or effective script origin can be defined as an alias to another origin or effective script - origin. The value of the origin or effective script origin is - then the value of the origin or effective script origin to which it is - an alias. - - These characteristics are defined as follows: - -
    - -
    For URLs
    - -
    - - The origin and effective script origin of the URL are - the origin defined in The Web Origin Concept. [[!ORIGIN]] - -
    - -
    For Document objects
    - -
    - -
    - -
    If a Document's active sandboxing flag set has - its sandboxed origin browsing context flag set
    - -
    - - The origin is a globally unique identifier assigned when the - Document is created. - - The effective script origin is initially an alias to the origin of the - {{Document}}. - -
    - -
    If a Document was served over the network and has an address that uses a URL - scheme with a server-based naming authority
    - -
    - - The origin is an alias to the - origin of the Document's address. - - The effective script origin is initially an alias to the origin of the - {{Document}}. - -
    - -
    If a Document was generated from a data: URL found in another Document or in a - script
    - -
    - - The origin of the incumbent settings object when the navigate algorithm - was invoked, or, if no script was involved, of the node document - of the element that initiated the navigation to that URL. - - The effective script origin is initially an alias to the effective script origin of that - same environment settings object or {{Document}}. - -
    - -
    If a Document is the initial "about:blank" document
    - -
    - - The origin and effective script origin of the - Document are those it was assigned when its - browsing context was created. - -
    - -
    If a Document was created as part of the processing for javascript: URLs
    - -
    - - The origin is an alias to the - origin of the active document of the browsing context - being navigated when the navigate algorithm was invoked. - - The effective script origin is initially an alias to the effective script origin of that - same {{Document}}. - -
    - -
    If a Document is an iframe srcdoc document
    - -
    - - The origin of the Document is an alias to the origin of the - Document's browsing context's browsing context - container's node document. - - The effective script origin is initially an alias to the effective script origin of the - Document's browsing context's browsing context - container's node document. - -
    - -
    If a Document was obtained in some other manner (e.g., a data: URL typed in by the user or that was returned as the - location of a redirect, a Document created using the createDocument() API, etc)
    - -
    - - The default behavior as defined in the DOM standard applies. [[!DOM]]. - -

    - The origin is a globally unique identifier assigned when the - Document is created, and the effective script origin is initially an - alias to the origin of the - {{Document}}. -

    - -
    - -
    - -

    - The effective script origin of a Document can be - manipulated using the document.domain IDL - attribute. -

    - -
    - -
    For images of <{img}> elements
    - -
    - -
    + The effective domain of an origin origin is computed as follows: -
    If the image data is CORS-cross-origin
    + 1. If origin is an opaque origin, then return origin. + 2. If origin's domain is non-null, then return + origin's domain. + 3. Return origin's host. -
    The origin is a globally unique identifier assigned when the image is - created.
    + Various specification objects are defined to have an origin. These origins are + determined as follows: -
    If the image data is CORS-same-origin
    - -
    The origin is an alias to the - origin of the <{img}> element's node document.
    - -
    - - Images do not have an effective script origin. - -
    - -
    For audio and <{video}> elements
    - -
    - -
    - -
    If the media data is CORS-cross-origin
    - -
    The origin is a globally unique identifier assigned when the media - data is fetched.
    - -
    If the media data is CORS-same-origin
    - -
    The origin is an alias to the - origin of the media element's node document.
    - -
    - - Media elements do not have an effective script - origin. - -
    - -
    For fonts
    - -
    + : For {{Document}} objects + :: +
    +
    If the {{Document}}'s + active sandboxing flag set has its sandboxed origin browsing context flag + set
    +
    A unique opaque origin is assigned when the {{Document}} is created.
    + +
    If the {{Document}}'s URL's scheme is a + network scheme
    +
    A copy of the {{Document}}'s URL's origin assigned when the + {{Document}} is created. + +

    The {{Document/open()|document.open()}} method can change the {{Document}}'s + URL to "about:blank". Therefore the origin is assigned + when the {{Document}} is created.

    +
    - The origin of a downloadable Web font is an alias to the origin of the absolute - URL used to obtain the font (after any redirects). [[!CSS-FONTS-3]] - [[CSS-FONT-LOADING-3]] +
    If the {{Document}} is the initial "about:blank" document
    +
    The one it was assigned when its browsing context was created. +
    - The origin of a locally installed system font is an alias to the origin of the - Document in which that font is being used. +
    If the {{Document}} is a non-initial "about:blank" document
    +
    If the {{Document}} was generated from a data: URL + found in another Document or in a script
    +
    The origin of the incumbent settings object when the navigate + algorithm was invoked, or, if no script was involved, of the + node document of the element that initiated the navigation to that + URL.
    + +
    If the {{Document}} was created as part of the processing for + javascript: URLs
    +
    The origin of the active document of the browsing context being + navigated when the navigate algorithm was invoked.
    + +
    If the {{Document}} is + an iframe srcdoc document
    +
    The origin of the {{Document}}'s browsing context's + browsing context container's node document.
    + +
    If the {{Document}} was obtained in some other manner (e.g., a + data: URL typed in by the user or that was returned as + the location of a redirect, a {{Document}} created using the + {{DOMImplementation/createDocument()}} API, etc)
    +
    The default behavior as defined in the DOM standard applies. [[!DOM]]. + +

    The origin is a unique opaque origin assigned when the + {{Document}} is created.

    +
    +
    + : For images of <{img}> elements + :: +
    +
    If the image data is CORS-cross-origin
    +
    A unique opaque origin assigned when the image is created.
    - Fonts do not have an effective script origin. +
    If the image data is CORS-same-origin
    +
    The <{img}> element's node document's origin.
    +
    + : For <{audio}> and <{video}> elements + :: +
    +
    If the media data is CORS-cross-origin
    +
    A unique opaque origin assigned when the media data is fetched.
    -
    +
    If the media data is CORS-same-origin
    +
    The media element's node document's origin. +
    +
    + : For fonts + :: For a downloadable Web font it is a copy of the origin of the URL record used to + obtain the font (after any redirects). [[!CSS-FONTS-3]] [[CSS-FONT-LOADING-3]] - + For a locally installed system font it is the origin of the {{Document}} in which that + font is being used. Other specifications can override the above definitions by themselves specifying the origin of - a particular URL, {{Document}}, image, media element, or - font. + a particular {{Document}} object, image, media element, or font.
    - The Unicode serialization of an origin is the string obtained by applying the - following algorithm to the given origin: - -
      - -
    1. If the origin in question is not a scheme/host/port tuple, then return the - literal string "null" and abort these steps.
    2. - -
    3. Otherwise, let result be the scheme part of the origin - tuple.
    4. + The Unicode serialization of an origin + is the string obtained by applying the following algorithm to the given origin + origin: -
    5. Append the string "://" to result.
    6. + 1. If origin is an opaque origin, then return "null". + 2. Let host be origin's host. + 3. Let unicodeHost be host if host is not a + domain, and the result of applying domain to Unicode to + host otherwise. + 4. Let unicodeOrigin be a new tuple origin consisting origin's + scheme, unicodeHost, and origin's + port. + 5. Return the ASCII serialisation of an origin, given unicodeOrigin. -
    7. Apply the domain to Unicode algorithm to each component of the host - part of the origin tuple, and append the results — each component, in the same - order, separated by U+002E FULL STOP characters (.) — to result. [[!URL]]
    8. +

      The name ASCII serialisation of an origin is misleading, as it merely + serialises an origin, which are all ASCII by default due to the URL parser.

      -
    9. If the port part of the origin tuple gives a port that is different from the - default port for the protocol given by the scheme part of the origin tuple, then - append a U+003A COLON character (:) and the given port, in base ten, to result.
    10. - -
    11. Return result.
    12. - -
    +
    + The Unicode serialisation of ("https", "xn--maraa-rta.example", + null, null) is "https://maraña.example". +
    The ASCII serialization of an origin is the string obtained by applying the - following algorithm to the given origin: - -
      - -
    1. If the origin in question is not a scheme/host/port tuple, then return the - literal string "null" and abort these steps.
    2. - -
    3. Otherwise, let result be the scheme part of the origin - tuple.
    4. - -
    5. Append the string "://" to result.
    6. - -
    7. - - Apply the domain to ASCII algorithm to each component of the host part of - the origin tuple, and append the results — each component, in the same order, - separated by U+002E FULL STOP characters (.) — to result. [[!URL]] - - If the domain to ASCII algorithm returns failure, e.g., because a component is too long or because it contains - invalid characters, then throw a SecurityError exception and abort these steps. - -
    8. - -
    9. If the port part of the origin tuple gives a port that is different from the - default port for the protocol given by the scheme part of the origin tuple, then - append a U+003A COLON character (:) and the given port, in base ten, to result.
    10. - -
    11. Return result.
    12. + following algorithm to the given origin origin: + + 1. If origin is an opaque origin, then return "null". + 2. Otherwise, let result be origin's scheme. + 3. Append "://" to result. + 4. Append origin's host, serialized, to + result. + 5. If origin's port is non-null, append a + U+003A COLON character (:), and origin's port, + serialized, to result. + 6. Return result. + + Two origins A and B are said to be + same origin if the following + algorithm returns true: + + 1. If A and B are the same opaque origin, then return true. + 2. If A and B are both tuple origins, and their + schemes, hosts, and + ports are identical, then return true. + 3. Return false. + + Two origins A and B are said to be + same origin-domain if the following algorithm returns true: + + 1. If A and B are the same opaque origin, then return true. + 2. If A and B are both tuple origins, run these substeps: + 1. If A and B's schemes are identical, and + their domains are identical and non-null, then return true. + 2. Otherwise, if A and B are same origin and their + domains are identical and null, then return true. + 3. Return false. -
    - - Two origins are said to be the same origin if the - following algorithm returns true: - -
      - -
    1. Let A be the first origin being compared, and B be the second origin being compared.
    2. - -
    3. If A and B are both opaque identifiers, and their - value is equal, then return true.
    4. - -
    5. Otherwise, if either A or B or both are opaque - identifiers, return false.
    6. - -
    7. If A and B have scheme components that are not - identical, return false.
    8. - -
    9. If A and B have host components that are not - identical, return false.
    10. - -
    11. If A and B have port components that are not - identical, return false.
    12. - -
    13. If either A or B have additional data, but that - data is not identical for both, return false.
    14. - -
    15. Return true.
    16. - -
    - -
    + + + + + + + + + + + + + + + +
    A + B + same origin + same origin-domain +
    ("https", "example.org", null, null) + ("https", "example.org", null, null) + ✅ + ✅ +
    ("https", "example.org", 314, "example.org") + ("https", "example.org", 420, "example.org") + ❌ + ✅ +
    ("https", "example.org", null, null) + ("https", "example.org", null, "example.org") + ✅ + ❌ +
    ("https", "example.org", null, "example.org") + ("http", "example.org", null, "example.org") + ❌ + ❌ +

    Relaxing the same-origin restriction

    @@ -2804,145 +3050,74 @@ When either of these methods is invoked, the user agent must run the following steps: -
      - -
    1. If this History object is associated with a Document that is - not fully active, throw a SecurityError.
    2. - -
    3. Let cloned data be a structured clone of the specified - data. If this throws an exception, then rethrow that exception and abort - these steps.
    4. - -
    5. If the third argument is null, then let new URL be the URL - of the current entry.
    6. - -
    7. - - If the third argument is not null, run these substeps: - -
        - -
      1. Resolve the value of the third argument, relative to - the API base URL specified by the entry settings object.
      2. - -
      3. If that fails, throw a SecurityError exception and abort these steps.
      4. - -
      5. Compare the resulting parsed URL to the result of applying the URL - parser algorithm to the document's address. If any component of these two - URLs differ other than the path, query, and fragment components, then throw a - SecurityError exception and abort these steps.
      6. - -
      7. If the origin of the resulting absolute URL is not the same as - the origin of the responsible document specified by the entry - settings object, and either the path or query components of the two parsed - URLs compared in the previous step differ, throw a SecurityError exception - and abort these steps. (This prevents sandboxed content from spoofing other pages on the same - origin.)
      8. - -
      9. Let new URL be the resulting absolute URL.
      10. - -
      - - For the purposes of the comparisons in the above substeps, the path and query components - can only be the same if the scheme component of both - resulting parsed URLs are relative schemes. - -
    8. - -
    9. - - If the third argument is null, then let new URL be the URL - of the current entry. - -
    10. - - If the method invoked was the pushState() - method: - -
        - -
      1. - - Remove all the entries in the browsing context's session history - after the current entry. If the current entry is the last entry in - the session history, then no entries are removed. - -

        - This doesn't necessarily have to affect the user - agent's user interface. -

        - -
      2. - -
      3. Remove any tasks queued by the history traversal - task source that are associated with any Document objects in the - top-level browsing context's document family.
      4. - -
      5. If appropriate, update the current entry to reflect any state that the user - agent wishes to persist. The entry is then said to be an entry with persisted user - state.
      6. - -
      7. Add a state object entry to the session history, after the current - entry, with cloned data as the state object, the given - title as the title, new URL as the URL - of the entry, and the scroll restoration mode of the current entry in the - session history as the scroll restoration mode.
      8. - -
      9. Update the current entry to be this newly added entry.
      10. - -
      - - Otherwise, if the method invoked was the replaceState() method: - -
        - -
      1. Update the current entry in the session history so that cloned data is the entry's new state object, the given title - is the new title, and new URL is the entry's new URL.
      2. - -
      - -
    11. - -
    12. If the current entry in the session history represents a non-GET request - (e.g., it was the result of a POST submission) then update it to instead represent a GET - request.
    13. - -
    14. - - Set the document's address to new URL. - -

      - Since this is neither a navigation of the - browsing context nor a history traversal, - it does not cause a hashchange event to be fired. -

      - -
    15. - -
    16. - - Set history.state to a structured clone - of cloned data. - -
    17. - -
    18. - - Let the latest entry of the Document of the current - entry be the current entry. - -
    19. - -
    - -

    - The title is purely advisory. User agents might use the title - in the user interface. -

    + 1. If this {{History}} object is associated with a {{Document}} that is not fully active, + throw a "SecurityError" {{DOMException}}. + 2. Optionally, abort these steps. (For example, the user agent might disallow calls to these + methods that are invoked on a timer, or from event listeners that are not triggered in + response to a clear user action, or that are invoked in rapid succession.) + 3. Let targetRealm be this {{History}} object's relevant settings object's + Realm. + 4. Let cloned data be a StructuredClone(data, + targetRealm). Rethrow any exceptions. + 5. If the third argument is not null, run these substeps: + 1. Parse the value of the third argument, relative to the entry settings object. + 2. If that fails, throw a "SecurityError" {{DOMException}} and abort these steps. + 3. Let new URL be the resulting URL record. + 4. Compare new URL to the document's URL. If any component of + these two URL records differ other than the path, + query, and fragment components, then throw a + "SecurityError" {{DOMException}} and abort these steps. + 5. If the origin of new URL is not the same as the origin of the + responsible document specified by the entry settings object, and either the + path or query components of the two URL records + compared in the previous step differ, throw a "SecurityError" + {{DOMException}} and abort these steps. (This prevents sandboxed content from spoofing + other pages on the same origin.) + 6. If the third argument is null, then let new URL be the URL of the + current entry. + 7. If the method invoked was the {{History/pushState()}} method: + 1. Remove all the entries in the browsing context's session history after the + current entry. If the current entry is the last entry in the session + history, then no entries are removed. + +

    This doesn't necessarily have to affect the user agent's user + interface.

    + 2. Remove any tasks queued by the history traversal task source that are + associated with any {{Document}} objects in the top-level browsing context's + document family. + 3. If appropriate, update the current entry to reflect any state that the user agent + wishes to persist. The entry is then said to be an entry with persisted user state. + 4. Add a state object entry to the session history, after the current entry, + with cloned data as the state object, the given title as the + title, new URL as the URL of the entry, and the + scroll restoration mode of the current entry in the session history as the + scroll restoration mode. + 5. Update the current entry to be this newly added entry. + + Otherwise, if the method invoked was the {{History/replaceState()}} method: + + 1. Update the current entry in the session history so that cloned data is + the entry's new state object, the given title is the new title, and + new URL is the entry's new URL. + 8. If the current entry in the session history represents a non-GET request (e.g., it was + the result of a POST submission) then update it to instead represent a GET request. + 9. Set the document's URL to new URL. + +

    Since this is neither a navigation of the browsing context nor a + history traversal, it does not cause a hashchange event to be fired.

    + 10. Let targetRealm be this {{History}} object's relevant settings object's + Realm. + 11. Set {{History/state|history.state}} to StructuredClone(cloned data, + targetRealm). + 12. Let the latest entry of the {{Document}} of the current entry be the + current entry. + +

    The title is purely advisory. User agents might use the title in the + user interface.

    User agents may limit the number of state objects added to the session history per page. If a - page hits the user agent-defined limit, user agents must remove the entry immediately after the first - entry for that Document object in the session history after having added the new + page hits the user agent-defined limit, user agents must remove the entry immediately after the + first entry for that {{Document}} object in the session history after having added the new entry. (Thus the state history acts as a FIFO buffer for eviction, but as a LIFO buffer for navigation.) @@ -3247,7 +3422,7 @@ The href attribute's setter must run these steps:
      -
    1. Let newURL be the resulting parsed URL of resolving the given value relative to the entry settings object's +
    2. Let newURL be the resulting URL string of parsing the given value relative to the entry settings object's API base URL.
    3. If that aborted with an error, throw a TypeError exception.
    4. @@ -3263,7 +3438,7 @@ compatibility with MessageEvent. The protocol attribute's getter must - return this Location object's URL's scheme, followed by ":". + return this Location object's URL's scheme, followed by ":". The {{Location/protocol}} attribute's setter must run these steps: @@ -3277,7 +3452,7 @@
    5. If possibleFailure is failure, throw a TypeError exception.
    6. -
    7. If copyURL's scheme is not "http" or "https", terminate these steps.
    8. +
    9. If copyURL's scheme is not "http" or "https", terminate these steps.
    10. Location-object-setter navigate to copyURL.
    @@ -3291,7 +3466,7 @@
  • If url's host is null, return the empty string.
  • -
  • If url's port is null, return +
  • If url's port is null, return url's host, serialized.
  • Return url's host, serialized, followed by ":" and url's port, serialized.
  • @@ -3343,9 +3518,9 @@
    1. If this Location object's URL's - port is null, return the empty string.
    2. + port is null, return the empty string. -
    3. Return this Location object's URL's port, serialized.
    4. +
    5. Return this Location object's URL's port, serialized.
    The port attribute's setter must run these steps: @@ -3354,7 +3529,7 @@
  • Let copyURL be a copy of this Location object's URL.
  • If copyURL's host is null, - copyURL's non-relative flag is set, or copyURL's scheme is "file", terminate these + copyURL's non-relative flag is set, or copyURL's scheme is "file", terminate these steps.
  • Basic URL parse the given value, with @@ -3401,10 +3576,10 @@
    1. If this Location object's URL's - query is either null or the empty string, return the + query is either null or the empty string, return the empty string.
    2. -
    3. Return "?", followed by this Location object's URL's query.
    4. +
    5. Return "?", followed by this Location object's URL's query.
    The search attribute's setter must run these @@ -3413,7 +3588,7 @@
    1. Let copyURL be a copy of this Location object's URL.
    2. -
    3. If the given value is the empty string, set copyURL's query to null. +
    4. If the given value is the empty string, set copyURL's query to null.
    5. Otherwise, run these substeps: @@ -3422,7 +3597,7 @@
    6. Let input be the given value with a single leading "?" removed, if any.
    7. -
    8. Set copyURL's query to the empty +
    9. Set copyURL's query to the empty string.
    10. Basic URL parse input, with @@ -3440,10 +3615,10 @@
      1. If this Location object's URL's - fragment is either null or the empty string, return + fragment is either null or the empty string, return the empty string.
      2. -
      3. Return "#", followed by this Location object's URL's fragment.
      4. +
      5. Return "#", followed by this Location object's URL's fragment.
      The hash attribute's setter must run these steps: @@ -3451,9 +3626,9 @@
      1. Let copyURL be a copy of this Location object's URL.
      2. -
      3. If copyURL's scheme is "javascript", terminate these steps.
      4. +
      5. If copyURL's scheme is "javascript", terminate these steps.
      6. -
      7. If the given value is the empty string, set copyURL's fragment to null. +
      8. If the given value is the empty string, set copyURL's fragment to null.
      9. Otherwise, run these substeps: @@ -3462,7 +3637,7 @@
      10. Let input be the given value with a single leading "#" removed, if any.
      11. -
      12. Set copyURL's fragment to the +
      13. Set copyURL's fragment to the empty string.
      14. Basic URL parse input, with @@ -3483,9 +3658,9 @@
      15. - Resolve url, relative to the + Parse url, relative to the API base URL specified by the entry settings object and let - parsedURL be the resulting parsed URL. + parsedURL be the resulting URL string. If this is not successful, throw a SyntaxError exception and abort these steps. @@ -3503,9 +3678,9 @@
      16. - Resolve url, relative to the + Parse url, relative to the API base URL specified by the entry settings object and let - parsedURL be the resulting parsed URL. + parsedURL be the resulting URL string. If this is not successful, throw a SyntaxError exception and abort these steps. @@ -3771,9 +3946,9 @@ reload-triggered navigation: apply the URL parser algorithm to the absolute URL of the new resource and the address of the active document of the browsing context being navigated; if all the components of the resulting parsed - URLs, ignoring any fragment components, are + URLs, ignoring any fragment components, are identical, and the new resource is to be fetched using GET, and the - URL record of the new resource has a fragment component that is not null (even if it is empty), + URL record of the new resource has a fragment component that is not null (even if it is empty), then navigate to that fragment identifier and abort these steps.
      17. @@ -3841,54 +4016,54 @@
        Skip this step. The data is already available.
        -
        If the new resource is a URL whose scheme is javascript
        +
        If the new resource is a URL whose scheme is javascript
        - Queue a task to run - these "javascript: URL" steps, + Queue a task to run + these "javascript: URL" steps, associated with the active document of the browsing context being navigated: - 1. If the origin of the source browsing context is not the same origin as - the origin of the active document of the browsing context being - navigated, then let result be undefined, and jump to the step labeled + 1. If the origin of the source browsing context is not the same origin as + the origin of the active document of the browsing context being + navigated, then let result be undefined, and jump to the step labeled process results below. - 2. Let urlRecord be the result of running the URL parser on the + 2. Let urlRecord be the result of running the URL parser on the URL of the new resource. 3. Let script source be the empty string. - 4. Append the first string of urlRecord's path component to script + 4. Append the first string of urlRecord's path component to script source. - 5. If urlRecord's query component is not null, then first - append a U+003F QUESTION MARK character (?) to script source, and then append - urlRecord's query component to script source. - 6. If urlRecord's fragment component is not null, then first - append a U+0023 NUMBER SIGN character (#) to script source, and then append - urlRecord's fragment component to script + 5. If urlRecord's query component is not null, then first + append a U+003F QUESTION MARK character (?) to script source, and then append + urlRecord's query component to script source. + 6. If urlRecord's fragment component is not null, then first + append a U+0023 NUMBER SIGN character (#) to script source, and then append + urlRecord's fragment component to script source. 7. Replace script source with the result of applying the percent decode algorithm to script source. - 8. Replace script source with the result of applying the UTF-8 decode + 8. Replace script source with the result of applying the UTF-8 decode algorithm to script source. - 9. Let address be the address of the active document of the + 9. Let address be the address of the active document of the browsing context being navigated. 10. Let settings be the relevant settings object of the browsing context being navigated. - 11. Let script be the result of creating a classic script given + 11. Let script be the result of creating a classic script given script source and settings. - 12. Let result be the result of running the classic script - script. If evaluation was unsuccessful, let result be undefined + 12. Let result be the result of running the classic script + script. If evaluation was unsuccessful, let result be undefined instead. (The result will also be undefined if scripting is disabled.) - 13. Process results: If Type(result) is not - String, then the result of obtaining the resource for the URL is a + 13. Process results: If Type(result) is not + String, then the result of obtaining the resource for the URL is a response whose status is 204. - Otherwise, the result of obtaining the resource for the URL is a response whose - header list consists of - Content-Type/text/html and whose - body is result, and whose HTTPS state is + Otherwise, the result of obtaining the resource for the URL is a response whose + header list consists of + Content-Type/text/html and whose + body is result, and whose HTTPS state is settings's HTTPS state. - When it comes time to set the document's address in the + When it comes time to set the document's address in the navigation algorithm, use address as the override URL. The task source for this task is the @@ -4419,13 +4594,15 @@ If the root element, as parsed according to the XML specifications cited above, is found to be an <{html}> element with an attribute manifest - whose value is not the empty string, then, as soon as the element is inserted into the document, the user agent must resolve the value of that attribute relative to that element, and if + whose value is not the empty string, then, as soon as the element is + inserted into the document, the user agent must parse the value of + that attribute relative to that element, and if that is successful, must apply the URL serializer - algorithm to the resulting parsed URL with the exclude fragment flag set to + algorithm to the resulting URL record with the exclude fragment flag set to obtain manifest URL, and then run the application cache selection algorithm with manifest URL as the manifest URL, passing in the newly-created {{Document}}. Otherwise, if the attribute is absent, its value is the empty - string, or resolving its value fails, then as soon as the root element is inserted into the document, the user agent must run the application cache selection algorithm with no manifest, and + string, or parsing its value fails, then as soon as the root element is inserted into the document, the user agent must run the application cache selection algorithm with no manifest, and passing in the {{Document}}.

        @@ -4695,8 +4872,8 @@

          -
        1. Apply the URL parser algorithm to the URL, and let fragid be the fragment component of the - resulting parsed URL.
        2. +
        3. Apply the URL parser algorithm to the URL, and let fragid be the fragment component of the + resulting URL record.
        4. If fragid is the empty string, then the indicated part of the document is the top of the document; stop the algorithm here.
        5. @@ -5147,14 +5324,14 @@
        6. - If the Document's active sandboxing flag set does not have its - sandboxed modals flag set, and the returnValue attribute of the event - object is not the empty string, or if the event was canceled, then the user agent should ask the - user to confirm that they wish to unload the document. + If the {{Document}}'s active sandboxing flag set does not have its + sandboxed modals flag set, and the {{BeforeUnloadEvent/returnValue}} attribute of the + event object is not the empty string, or if the event was canceled, then the user + agent should ask the user to confirm that they wish to unload the document. - The prompt shown by the user agent may include the string of the returnValue attribute, or some leading subset - thereof. (A user agent may want to truncate the string to 1024 characters for display, for - instance.) + The prompt shown by the user agent may include the string of the + {{BeforeUnloadEvent/returnValue}} attribute, or some leading subset thereof. (A user agent may + want to truncate the string to 1024 characters for display, for instance.) The user agent must pause while waiting for the user's response. @@ -5320,7 +5497,7 @@
          -
          event . returnValue [ = value ]
          +
          event . {{BeforeUnloadEvent/returnValue}} [ = value ]
          @@ -5338,7 +5515,7 @@
          - The returnValue attribute + The returnValue attribute represents the message to show the user. When the event is created, the attribute must be set to the empty string. On getting, it must return the last value it was set to. On setting, the attribute must be set to the new value. @@ -6137,17 +6314,17 @@
          - Resolve the first item in tokens, + Parse the first item in tokens, relative to base URL, with the URL character encoding set to UTF-8; ignore the rest. If this fails, then jump back to the step labeled start of line. - If the resulting parsed URL has a different scheme component than base URL (the + If the resulting URL record has a different scheme component than base URL (the manifest's URL), then jump back to the step labeled start of line. - Let new URL be the result of applying the URL serializer algorithm to the resulting parsed - URL, with the exclude fragment flag set. + Let new URL be the result of applying the URL serializer + algorithm to the resulting parsed URL, with the exclude fragment flag set. Add new URL to the explicit URLs. @@ -6160,7 +6337,7 @@ Let part one be the first token in tokens, and let part two be the second token in tokens. - Resolve part one and part two, relative to base URL, with the URL character + Parse part one and part two, relative to base URL, with the URL character encoding set to UTF-8. If either fails, then jump back to the step labeled start of line. @@ -6170,16 +6347,17 @@ then jump back to the step labeled start of line. Let part one path be the path component - of the resulting parsed URL for part one. + of the resulting URL record for part one. If manifest path is not a prefix match for part one path, then jump back to the step labeled start of line. - Let part one be the result of applying the URL serializer algorithm to the first resulting - parsed URL, with the exclude fragment flag set. + Let part one be the result of applying the URL serializer + algorithm to the first resulting parsed URL, with the exclude fragment flag set. - Let part two be the result of applying the URL serializer algorithm to the second resulting - parsed URL, with the exclude fragment flag set. + Let part two be the result of applying the URL serializer + algorithm to the second resulting parsed URL, with the exclude fragment flag + set. If part one is already in the fallback URLs mapping as a fallback namespace, then jump back to @@ -6200,16 +6378,16 @@ set online safelist wildcard flag to open and jump back to the step labeled start of line. - Otherwise, resolve the first item in tokens, relative to base URL, with the URL character - encoding set to UTF-8; ignore the rest. + Otherwise, let urlRecord be the result of parsing the first item in + tokens with base URL. - If this fails, then jump back to the step labeled start of line. + If urlRecord is failure, then jump back to the step labeled start of line. - If the resulting parsed URL has a different scheme component than base URL (the + If urlRecord has a different scheme component than base URL (the manifest's URL), then jump back to the step labeled start of line. - Let new URL be the result of applying the URL serializer algorithm to the resulting parsed - URL, with the exclude fragment flag set. + Let new URL be the result of applying the URL serializer + algorithm to the resulting parsed URL, with the exclude fragment flag set. Add new URL to the online safelist namespaces. @@ -6512,11 +6690,11 @@ Otherwise, associate the Document for this entry with cache; store the resource for this entry in cache, if it isn't already there, and categorize its entry as a master entry. If applying the URL parser - algorithm to the resource's URL results in a resulting parsed URL that has a - non-null fragment component, the URL + algorithm to the resource's URL results in a resulting URL record that has a + non-null fragment component, the URL used for the entry in cache must instead be the absolute URL obtained from applying the URL serializer - algorithm to the resulting parsed URL with the exclude fragment flag set + algorithm to the resulting URL record with the exclude fragment flag set (application caches never include fragment identifiers).
        7. @@ -7070,7 +7248,7 @@
        8. If the resource is not to be fetched using the GET method, or if applying the URL parser algorithm to both its URL and the application cache's - manifest's URL results in two URL records with different scheme components, + manifest's URL results in two URL records with different scheme components, then fetch the resource normally and abort these steps.
        9. If the resource's URL is a master entry, diff --git a/sections/dom.include b/sections/dom.include index e5d05a518c..f0ef72c2a3 100644 --- a/sections/dom.include +++ b/sections/dom.include @@ -171,7 +171,7 @@ On getting, if the document is a cookie-averse Document object, then the user agent must return the empty string. Otherwise, if the {{Document}}'s - origin is not a scheme/host/port tuple, the user agent must throw a + origin is an opaque origin, the user agent must throw a SecurityError exception. Otherwise, the user agent must return the cookie-string for the document's address for a "non-HTTP" API, decoded using the UTF-8 decoder. @@ -180,7 +180,7 @@ On setting, if the document is a cookie-averse Document object, then the user agent must do nothing. Otherwise, if the {{Document}}'s origin is - not a scheme/host/port tuple, the user agent must throw a SecurityError exception. + an opaque origin, the user agent must throw a SecurityError exception. Otherwise, the user agent must act as it would when receiving a set-cookie-string for the document's address via a "non-HTTP" API, consisting of the new value encoded as UTF-8. [[!COOKIES]] [[!ENCODING]] @@ -564,18 +564,19 @@ 1. Let document be the {{XMLDocument}} object on which the method was invoked. - 2. Resolve the method's first argument, relative to the API base URL specified by - the entry settings object. If this is not successful, throw a - SyntaxError exception and abort these steps. Otherwise, let url be - the resulting absolute URL. - 3. If the origin of url is not the same as the origin of - document, throw a SecurityError exception and abort these steps. + 2. Parse url, relative to the entry settings object. If this is not + successful, throw a "SyntaxError" {{DOMException}} and abort these steps. + Otherwise, let urlRecord be the resulting URL record. + 3. If urlRecord's origin is not the same as the origin of + document, throw a "SecurityError" {{DOMException}} and abort these + steps. 4. Remove all child nodes of document, without firing any mutation events. 5. Set the current document readiness of document to "loading". 6. Run the remainder of these steps in parallel, and return true from the method. 7. Let result be a {{Document}} object. 8. Let success be false. - 9. Let request be a new request whose URL is url, + 9. Let request be a new request whose URL is + urlRecord, client is entry settings object, destination is "subresource", synchronous flag is set, mode is "same-origin", credentials mode is "same-origin", and whose @@ -1708,7 +1709,7 @@

          While these attributes apply to all elements, they are not useful on all elements. For example, - only media elements will ever receive a volumechange event fired by the user + only media elements will ever receive a volumechange event fired by the user agent.

          diff --git a/sections/editing.include b/sections/editing.include index 04a04db4c8..6f1e919a54 100644 --- a/sections/editing.include +++ b/sections/editing.include @@ -230,7 +230,7 @@
        10. Let target be the element designated by the user (the target of event).
        11. -
        12. If target is a <{canvas}> element, run the canvas MouseEvent rerouting steps. If this changes event's +
        13. If target is a <{canvas}> element, run the canvas {{MouseEvent}} rerouting steps. If this changes event's target, then let target be the new target.
        14. Set the click in progress flag on target to @@ -3307,13 +3307,13 @@
          If the node is an <{a}> element with an <{links/href}> attribute
          -
          Add to urls the result of resolving the element's <{links/href}> content +
          Add to urls the result of parsing the element's <{links/href}> content attribute relative to the element.
          If the node is an <{img}> element with a <{img/src}> attribute
          -
          Add to urls the result of resolving the element's src content attribute +
          Add to urls the result of parsing the element's src content attribute relative to the element.
          diff --git a/sections/infrastructure.include b/sections/infrastructure.include index 88da327022..d44f1fa2af 100644 --- a/sections/infrastructure.include +++ b/sections/infrastructure.include @@ -180,6 +180,10 @@ means that the length of the text is zero (i.e., not even containing spaces or control characters). + An element's child text content is the concatenation of the data of all the + {{Text}} nodes that are children of the element (ignoring any other nodes such as comments or + elements), in tree order. + A node A is inserted into a node B when the insertion steps are invoked with A as the argument and A's new parent @@ -630,8 +634,8 @@ * The host component of a URL record * The port component of a URL record * The path component of a URL record - * The query component of a URL record - * The fragment component of a URL record + * The query component of a URL record + * The fragment component of a URL record * non-relative flag * Parse errors from the URL parser * The URL serializer @@ -725,7 +729,7 @@ * mode * credentials mode * use-URL-credentials flag - * unsafe-request flat + * unsafe-request flag * cache mode * redirect mode * cryptographic nonce metadata @@ -829,10 +833,10 @@ * The current Realm Record * Use Strict Directive * Well-Known Symbols, including: - * @@hasInstance - * @@isConcatSpreadable - * @@toPrimitive - * @@toStringTag + * @@hasInstance + * @@isConcatSpreadable + * @@toPrimitive + * @@toStringTag * Well-Known Intrinsic Objects, including: * %ArrayBuffer% * %ArrayPrototype% @@ -856,7 +860,7 @@ * The EnqueueJob abstract operation * The FunctionCreate abstract operation * The Get abstract operation - * The GetActiveScriptOrModule abstract operation + * The GetActiveScriptOrModule() abstract operation * The GetFunctionRealm abstract operation * The HasOwnProperty abstract operation * The HostEnsureCanCompileStrings abstract operation @@ -1013,11 +1017,18 @@ The following features are defined in the UI Events specification: [[!UIEVENTS]] - * {{MouseEvent}} interface + * {{MouseEvent}} interface and the following interface members: + * The {{MouseEvent/relatedTarget}} attribute + * The {{MouseEvent/button}} attribute + * The {{MouseEvent/ctrlKey}} attribute + * The {{MouseEvent/shiftKey}} attribute + * The {{MouseEvent/altKey}} attribute + * The {{MouseEvent/metaKey}} attribute + * The {{MouseEvent/getModifierState()}} method * {{MouseEventInit}} dictionary type * The {{FocusEvent}} interface and its {{FocusEvent/relatedTarget}} attribute - * The {{UIEvent}} interface's {{UIEvent/detail}} attribute + * The {{UIEvent}} interface's {{UIEvent/view}} and {{UIEvent/detail}} attributes * click event * dblclick event * mousedown event @@ -1062,10 +1073,8 @@ * The fullscreen enabled flag * The fully exit fullscreen algorithm - The High Resolution Time specification provides the - {{DOMHighResTimeStamp}} typedef and the - {{Performance}} object's {{Performance/now|now()}} method. - [[!HR-TIME-2]] + The High Resolution Time specification provides the {{DOMHighResTimeStamp}} + typedef and the {{Performance}} object's {{Performance/now()}} method. [[!HR-TIME-2]] : File API :: This specification uses the following features defined in the File API specification: @@ -1095,7 +1104,7 @@ features and terms are defined in the XMLHttpRequest specification: [[!XHR]] * {{XMLHttpRequest}} interface - * XMLHttpRequest.responseXML attribute + * {{XMLHttpRequest/responseXML|XMLHttpRequest.responseXML}} attribute * {{ProgressEvent}} interface * ProgressEvent.lengthComputable attribute * ProgressEvent.loaded attribute @@ -3266,14 +3275,14 @@ The fallback base URL of a {{Document}} object is the absolute URL obtained by running these substeps: - 1. If the {{Document}} is an iframe srcdoc document, - then return the document base URL of the {{Document}}'s - browsing context's browsing context container's node document and abort - these steps. - 2. If the document's address is about:blank, and the {{Document}}'s - browsing context has a creator browsing context, then return the document - base URL of the creator Document, and abort these steps. - 3. Return the document's address. + 1. If document is + an iframe srcdoc document, + then return the document base URL of the Document's + browsing context's browsing context container's node document. + 2. If document's URL is about:blank, and the + Document's browsing context has a creator browsing context, then + return the creator base URL. + 3. Return document's URL. The document base URL of a {{Document}} object is the absolute URL obtained by running these substeps: @@ -3285,53 +3294,33 @@ <{base}> element in the {{Document}} that has an <{base/href}> attribute, in tree order. -

          Resolving URLs

          - - Resolving a URL is the process of taking a relative URL and obtaining the - absolute URL that it implies. - - To resolve a URL to an absolute URL relative to either another - absolute URL or an element, the user agent must use the following steps. Resolving a URL - can result in an error, in which case the URL is not resolvable. - - 1. Let url be the URL being resolved. - 2. Let encoding be determined as follows: - -
          -
          - If the URL had a character encoding defined when the URL was created or defined or when - this algorithm was invoked -
          -
          The URL character encoding is as defined.
          - -
          If the URL came from a script (e.g., as an argument to a method)
          -
          - The URL character encoding is the API URL character encoding specified by the - script's settings object. -
          +

          Parsing URLs

          -
          If the URL came from a DOM node (e.g., from an element)
          -
          - The node has a {{Document}}, and the URL character encoding is the - document's character encoding. -
          -
          - - 3. If encoding is a UTF-16 encoding, then change the value of - encoding to UTF-8. - 4. If the algorithm was invoked with an absolute URL to use as the base URL, let - base be that absolute URL. + Parsing a URL is the process of taking a URL string and obtaining the URL record that it + implies. While this process is defined in the WHATWG URL standard, this specification defines a + wrapper for convenience. [[URL]] - Otherwise, let base be the element's node document's document base URL. - - 5. Apply the URL parser to url, with base as the base URL, with - encoding as the encoding. - 6. If this returns failure, then abort these steps with an error. - 7. Let parsed URL be the result of the URL parser. - 8. Let serialized URL be the result of apply the URL serializer to - parsed URL. - 9. Return serialized URL as the resulting absolute URL and - parsed URL as the resulting parsed URL. +

          This wrapper is only useful when the character encoding for the URL parser has to + match that of the document or environment settings object for legacy reasons. When that is not the + case the URL parser can be used directly.

          + + To parse a URL + url, relative to either a document or + environment settings object, the user agent must use the following steps. Parsing a URL + either results in failure or a resulting URL string and resulting URL record. + + 1. Let encoding be document's character encoding, if + document was given, and environment settings object's + API URL character encoding otherwise. + 2. Let baseURL be document's base URL, if document was + given, and environment settings object's API base URL otherwise. + 3. Let urlRecord be the result of applying the URL parser to url, + with baseURL and encoding. + 4. If urlRecord is failure, then abort these steps with an error. + 5. Let urlString be the result of applying the URL serializer to + urlRecord. + 6. Return urlString as the resulting URL string and urlRecord as + the resulting URL record.

          Dynamic changes to base URLs

          @@ -3344,9 +3333,10 @@
          If the element creates a hyperlink
          - If the absolute URL identified by the hyperlink is being shown to the user, or if any - data derived from that URL is affecting the display, then the <{links/href}> attribute - should be re-resolved relative to the element and the UI updated appropriately. + If the URL identified by the hyperlink is being shown to the user, or if any + data derived from that URL is affecting the display, then the <{links/href}> + attribute should be reparsed relative to the element's node document and the UI + updated appropriately.

          For example, the CSS :link/:visited pseudo-classes might have @@ -3359,9 +3349,10 @@ <{del}> element with a cite attribute

          - If the absolute URL identified by the cite attribute is being shown to - the user, or if any data derived from that URL is affecting the display, then the URL - should be re-resolved relative to the element and the UI updated appropriately. + If the URL identified by the cite attribute is being shown to + the user, or if any data derived from that URL is affecting the display, then + the URL should be reparsed relative to the element's + node document and the UI updated appropriately.
          Otherwise
          @@ -3401,7 +3392,7 @@ corsAttributeState, and an optional same-origin fallback flag, run these steps: 1. Let mode be "no-cors" if corsAttributeState is - No CORS, and "cors" otherwise. + No CORS, and "cors" otherwise. 2. If same-origin fallback flag is set and mode is "no-cors", set mode to "same-origin". @@ -3448,7 +3439,7 @@ referrer to the empty string and jump to the step labeled clean referrer. 5. Let referrer be the document's address of document. 6. Clean referrer: Apply the URL parser to referrer and let - parsed referrer be the resulting parsed URL. + parsed referrer be the resulting URL record. 7. Let referrer be the result of applying the URL serializer to parsed referrer, with the exclude fragment flag set. 8. If referrer is not the empty string, is not a data: URL, and @@ -3716,7 +3707,8 @@ The empty string is also a valid keyword, and maps to the Anonymous state. The attribute's invalid value default is the Anonymous state. For the purposes of reflection, the canonical case for the Anonymous state is the anonymous keyword. The - missing value default, used when the attribute is omitted, is the No CORS state. + missing value default, used when the attribute is omitted, is the + No CORS state.

          Common DOM interfaces

          @@ -3731,7 +3723,7 @@ is not present, it must first be added. If a reflecting IDL attribute is a DOMString attribute whose content attribute is - defined to contain a URL, then on getting, the IDL attribute must resolve the + defined to contain a URL, then on getting, the IDL attribute must parse the value of the content attribute relative to the element and return the resulting absolute URL if that was successful, or the empty string otherwise; and on setting, must set the content attribute to the specified literal value. If the content attribute is absent, @@ -3740,7 +3732,7 @@ If a reflecting IDL attribute is a DOMString attribute whose content attribute is defined to contain one or more URLs, then on getting, the IDL attribute must split the - content attribute on spaces and return the concatenation of resolving each token URL + content attribute on spaces and return the concatenation of parsing each token URL to an absolute URL relative to the element, with a single U+0020 SPACE character between each URL, ignoring any tokens that did not resolve successfully. If the content attribute is absent, the IDL attribute must return the default value, if the content attribute has one, or diff --git a/sections/obsolete.include b/sections/obsolete.include index 3874593913..e459c19316 100644 --- a/sections/obsolete.include +++ b/sections/obsolete.include @@ -427,7 +427,7 @@ * The element's node document is not fully active. * The element's node document's active sandboxing flag set has its sandboxed plugins browsing context flag set. - * The element has an ancestor media element. + * The element has an ancestor media element. * The element has an ancestor <{object}> element that is not showing its fallback content. * No Java Language runtime plugin is available. @@ -760,7 +760,7 @@ 1. If the value of the src attribute is the empty string, let url be the string "about:blank". - Otherwise, resolve the value of the src attribute, relative to the + Otherwise, parse the value of the src attribute, relative to the <{frame}> element. If that is not successful, then let url be the string diff --git a/sections/rendering.include b/sections/rendering.include index 93bf291a54..c3b4187978 100644 --- a/sections/rendering.include +++ b/sections/rendering.include @@ -214,9 +214,10 @@
          When a <{body}> element has a <{common/background}> - attribute set to a non-empty value, the new value is expected to be resolved relative to the element, and if this is successful, the user agent is + attribute set to a non-empty value, the new value is expected to be parsed relative to the + element's node document, and if this is successful, the user agent is expected to treat the attribute as a presentational hint - setting the element's 'background-image' property to the resulting absolute URL. + setting the element's 'background-image' property to the resulting URL string. When a <{body}> element has a <{body/bgcolor}> attribute set, the new value is expected to be parsed using the rules for parsing a legacy color @@ -980,9 +981,10 @@ path: includes/cldr.include When a <{table}>, <{thead}>, <{tbody}>, <{tfoot}>, <{tr}>, <{td}>, or <{th}> element has a <{common/background}> attribute set to a non-empty value, the new value is - expected to be resolved relative to the element, and if this is - successful, the user agent is expected to treat the attribute as a presentational hint setting the element's 'background-image' property to the - resulting absolute URL. + expected to be parsed relative to the element's node document, and if this is + successful, the user agent is expected to treat the attribute as a presentational hint + setting the element's 'background-image' property to the + resulting URL string. When a <{table}>, <{thead}>, <{tbody}>, <{tfoot}>, <{tr}>, <{td}>, or <{th}> element has a bgcolor diff --git a/sections/semantics-document-metadata.include b/sections/semantics-document-metadata.include index 8ddfcd21b4..40cf0dbf5b 100644 --- a/sections/semantics-document-metadata.include +++ b/sections/semantics-document-metadata.include @@ -208,7 +208,7 @@
          The <{base}> element allows authors to specify the document base URL for the - purposes of resolving relative URLs, and the name of the default browsing context + purposes of parsing relative URLs, and the name of the default browsing context for the purposes of following hyperlinks. The element does not represent any content beyond this information. @@ -254,7 +254,6 @@ * The <{base}> element becomes the first <{base}> element in tree order with an <{base/href}> content attribute in its {{Document}}. - * The <{base}> element is the first <{base}> element in tree order with an <{base/href}> content attribute in its {{Document}}, and its <{base/href}> content attribute is changed. @@ -262,29 +261,27 @@ To set the frozen base URL, for an element element: 1. Let document be element's node document. - 2. Let urlRecord be the result of parsing the value of + 2. Let urlRecord be the result of parsing the value of element's <{base/href}> content attribute with document's fallback base URL, and document's character encoding. (Thus the <{base}> element isn't affected by itself.) - 3. Set elements's frozen base URL to document's fallback base - URL, if urlRecord is failure or running Is base allowed for Document? - on the resulting parsed URL and document returns "Blocked", - and to urlRecord otherwise. - - The href IDL attribute, on getting, must return the result of running - the following algorithm: - - 1. If the <{base}> element has no <{base/href}> content attribute, then return the - document base URL and abort these steps. - 2. Let fallback base url be the {{Document}}'s fallback base URL. - 3. Let url be the value of the <{base/href}> attribute of the base - element. - 4. Resolve url relative to fallback base url (thus, the - base's <{base/href}> attribute isn't affected by other base - elements). - 5. If the previous step was successful, return the resulting absolute URL and abort these - steps. - 6. Otherwise, return the empty string. + 3. Set elements's frozen base URL to document's + fallback base URL, if urlRecord is failure or running + Is base allowed for Document? on the resulting URL record and + document returns "Blocked", and to urlRecord otherwise. + + The href IDL attribute, on getting, must + return the result of running the following algorithm: + + 1. Let document be element's node document. + 2. Let url be the value of the <{base/href}> attribute of the <{base}> element, if it + has one, and the empty string otherwise. + 3. Let urlRecord be the result of parsing url with + document's fallback base url, and document's + character encoding. (Thus, the <{base}> element isn't affected by other <{base}> + elements or itself). + 4. If urlRecord is failure, return url. + 5. Return the serialization of urlRecord. The {{HTMLBaseElement/href}} IDL attribute, on setting, must set the <{base/href}> content attribute to the given new value. @@ -431,7 +428,7 @@ run the following steps: 1. If the <{link/href}> attribute's value is the empty string, then abort these steps. - 2. Resolve the URL given by the <{link/href}> attribute, relative to the + 2. Parse the URL given by the <{link/href}> attribute, relative to the element. 3. If the previous step fails, then abort these steps. 4. Let corsAttributeState be the current state of the element's @@ -1158,9 +1155,9 @@ and all subsequent characters are removed. 25. Trim: Strip any trailing space characters from the end of url. 26. Strip any U+0009 CHARACTER TABULATION (tab), U+000A LINE FEED (LF), and U+000D CARRIAGE RETURN (CR) characters from url. - 27. Resolve the url value, relative to the <{meta}> element. If this + 27. Parse the url value, relative to the <{meta}> element. If this fails, abort these steps. - 28. Otherwise, let parsed url be the resulting parsed URL. + 28. Otherwise, let parsed url be the resulting URL string. 29. End: Perform one or more of the following steps: * After the refresh has come due (as defined below), if the user has not canceled the diff --git a/sections/semantics-embedded-content.include b/sections/semantics-embedded-content.include index 85277462fe..8d82dc01c1 100644 --- a/sections/semantics-embedded-content.include +++ b/sections/semantics-embedded-content.include @@ -827,8 +827,8 @@ was an English <a href="/wiki/Music_hall">music hall</a> singer, ... Each {{Document}} object must have a list of available images. Each image in this list is identified by a tuple consisting of an absolute URL, a CORS - settings attribute mode, and, if the mode is not No - CORS, an origin. + settings attribute mode, and, if the mode is not No CORS, an + origin. Each image furthermore has an ignore higher-layer caching flag. User agents may copy entries from one {{Document}} object's list of available images to another at any time (e.g., when the @@ -904,13 +904,13 @@ was an English <a href="/wiki/Music_hall">music hall</a> singer, ...
            -
          1. Resolve selected source, relative +
          2. Parse selected source, relative to the element, and let the result be absolute URL. If that is not successful, then abort these inner set of steps.
          3. -
          4. Let key be a tuple consisting of the resulting absolute - URL, the <{img}> element's crossorigin - attribute's mode, and, if that mode is not No CORS, +
          5. Let key be a tuple consisting of the resulting absolute URL, the + <{img}> element's crossorigin + attribute's mode, and, if that mode is not No CORS, the node document's origin.
          6. @@ -1005,8 +1005,9 @@ was an English <a href="/wiki/Music_hall">music hall</a> singer, ...
          7. - ⌛ Resolve selected source, relative - to the element, and let absolute URL be the resulting absolute URL. If + ⌛ Parse selected source, relative + to the element's node document, and let absolute URL be the + resulting URL string. If that is not successful, run these substeps:
              @@ -1889,8 +1890,9 @@ was an English <a href="/wiki/Music_hall">music hall</a> singer, ... density are the same as the element's last selected source and current pixel density, then abort these steps. -
            1. Resolve selected source, - relative to the element, and let absolute URL be the resulting absolute URL. +
            2. Parse selected source, + relative to the element's node document, and let absolute URL be the + resulting URL string. If that is not successful, abort these steps.
            3. ⌛ Let corsAttributeState be the state of the element's crossorigin content attribute.
            4. @@ -1901,7 +1903,8 @@ was an English <a href="/wiki/Music_hall">music hall</a> singer, ... document's Window object's environment settings object.
            5. ⌛ Let key be a tuple consisting of absolute URL, - corsAttributeState, and, if corsAttributeState is not No CORS, origin.
            6. + corsAttributeState, and, if corsAttributeState is not + No CORS, origin.
            7. ⌛ Let image request be a new image request whose current URL is absolute URL
            8. @@ -3604,10 +3607,10 @@ My <img src="heart.png" alt="heart"> breaks. value is the empty string, let url be the string "about:blank". - Otherwise, resolve the value of the src attribute, relative to the <{iframe}> element. + Otherwise, parse the value of the src attribute, relative to the <{iframe}> element. If that is not successful, then let url be the string - "about:blank". Otherwise, let url be the resulting parsed URL. + "about:blank". Otherwise, let url be the resulting URL string. @@ -4054,7 +4057,7 @@ My <img src="heart.png" alt="heart"> breaks. When used in HTML documents, the allowed content model of <{iframe}> elements is text, except that invoking the HTML fragment parsing algorithm with the <{iframe}> element as the context element and the text contents as the input must result in a list of nodes that are all phrasing content, - with no parse errors having occurred, with no script + with no parse errors having occurred, with no script elements being anywhere in the list or as descendants of elements in the list, and with all the elements in the list (including their descendants) being themselves conforming. @@ -4173,7 +4176,7 @@ My <img src="heart.png" alt="heart"> breaks.
            9. The element has neither a src attribute nor a type attribute.
            10. -
            11. The element has a media element ancestor.
            12. +
            13. The element has a media element ancestor.
            14. The element has an ancestor <{object}> element that is not showing its fallback content.
            15. @@ -4195,7 +4198,7 @@ My <img src="heart.png" alt="heart"> breaks.
            16. The element's src attribute is either absent or its value is not the empty string.
            17. -
            18. The element is not a descendant of a media element.
            19. +
            20. The element is not a descendant of a media element.
            21. The element is not a descendant of an <{object}> element that is not showing its fallback content.
            22. @@ -4225,14 +4228,14 @@ My <img src="heart.png" alt="heart"> breaks.
              - The user agent must resolve the value of the element's + The user agent must parse the value of the element's src attribute, relative to the element. If that is successful, the user agent should run these steps:
              1. Let request be a new request whose - URL is the resulting absolute URL, + URL is the resulting URL string, client is the element's node document's Window object's environment settings object, destination is "unknown", omit-Origin-header flag is set if the @@ -4601,7 +4604,7 @@ attribute's value is a type that a plugin supports, then the value of the
              2. - If the element has an ancestor media element, or has an ancestor + If the element has an ancestor media element, or has an ancestor <{object}> element that is not showing its fallback content, or if the element is not in a Document with a browsing context, or if the element's node document is not fully @@ -4634,13 +4637,13 @@ attribute's value is a type that a plugin supports, then the value of the plugin for, then the user agent may jump to the step below labeled fallback without fetching the content to examine its real type.
              3. -
              4. Resolve the URL specified by the data attribute, relative to the element.
              5. +
              6. Parse the URL specified by the data attribute, relative to the element.
              7. If that failed, fire a simple event named error at the element, then jump to the step below labeled fallback.
              8. Let request be a new request whose - URL is the resulting absolute URL, + URL is the resulting URL string, client is the element's node document's Window object's environment settings object, destination is "unknown", omit-Origin-header flag is set if the @@ -5216,10 +5219,10 @@ attribute's value is a type that a plugin supports, then the value of the
                Content model:
                If the element has a src attribute: zero or more <{track}> elements, then - transparent, but with no media element descendants.
                + transparent, but with no media element descendants.
              If the element does not have a src attribute: zero or more <{source}> elements, then zero or more <{track}> elements, then - transparent, but with no media element descendants.
              + transparent, but with no media element descendants.
        Tag omission in text/html:
        Neither tag is omissible
        Content attributes:
        @@ -5231,7 +5234,7 @@ attribute's value is a type that a plugin supports, then the value of the media resource will likely need
        autoplay - Hint that the media resource can be started automatically when the page is loaded
        -
        mediagroup - Groups media elements +
        mediagroup - Groups media elements together with an implicit MediaController
        loop - Whether to loop the media resource
        muted - Whether to mute the media resource by default
        @@ -5282,7 +5285,7 @@ attribute's value is a type that a plugin supports, then the value of the can be provided by simply linking to them in the prose near the <{video}> element. [[WEBVTT]]

        - The <{video}> element is a media element whose media data is + The <{video}> element is a media element whose media data is ostensibly video data, possibly with associated audio data. The src, preload, @@ -5309,11 +5312,11 @@ attribute's value is a type that a plugin supports, then the value of the or if the attribute is absent, then there is no poster frame; abort these steps. -
      18. Resolve the poster attribute's value relative to the element. If this fails, +
      19. Parse the poster attribute's value relative to the element. If this fails, then there is no poster frame; abort these steps.
      20. Let request be a new request whose - URL is the resulting parsed URL, + URL is the resulting URL string, client is the element's node document's Window object's environment settings object, type is "image", destination is "subresource", credentials mode is "include", and whose use-URL-credentials flag is set. @@ -5451,7 +5454,7 @@ attribute's value is a type that a plugin supports, then the value of the (including, for example, because the selected video track was changed), if the element's readyState attribute is not HAVE_NOTHING, the user agent must - queue a task to fire a simple event named resize at the media element. + queue a task to fire a simple event named resize at the media element. @@ -5554,10 +5557,10 @@ attribute's value is a type that a plugin supports, then the value of the
        Content model:
        If the element has a src attribute: zero or more <{track}> elements, then -transparent, but with no media element descendants.
        +transparent, but with no media element descendants.
        If the element does not have a src attribute: zero or more <{source}> elements, then zero or more <{track}> elements, then - transparent, but with no media element descendants.
        + transparent, but with no media element descendants.
        Tag omission in text/html:
        Neither tag is omissible
        Content attributes:
        @@ -5568,7 +5571,7 @@ zero or more <{track}> elements, then media resource will likely need
        autoplay - Hint that the media resource can be started automatically when the page is loaded
        -
        mediagroup - Groups media elements +
        mediagroup - Groups media elements together with an implicit MediaController
        loop - Whether to loop the media resource
        muted - Whether to mute the media resource by default
        @@ -5606,7 +5609,7 @@ zero or more <{track}> elements, then the prose near the <{audio}> element. [[WEBVTT]]

        - The <{audio}> element is a media element whose media data is + The <{audio}> element is a media element whose media data is ostensibly audio data. The src, preload, @@ -5658,7 +5661,7 @@ zero or more <{track}> elements, then
        Categories:
        None.
        Contexts in which this element can be used:
        -
        As a child of a media element, before any flow content +
        As a child of a media element, before any flow content or <{track}> elements.
        Content model:
        Nothing.
        @@ -5683,7 +5686,7 @@ zero or more <{track}> elements, then - The <{source}> element allows authors to specify multiple alternative media resources for media elements. It does not represent anything on its own. + The <{source}> element allows authors to specify multiple alternative media resources for media elements. It does not represent anything on its own. The src attribute gives the address of the media resource. The value must be a valid non-empty URL potentially surrounded @@ -5693,7 +5696,7 @@ zero or more <{track}> elements, then Dynamically modifying a <{source}> element and its attribute when the element is already inserted in a video or <{audio}> element will have no effect. To change what is playing, just use the src attribute - on the media element directly, possibly making use of the canPlayType() method to pick from amongst available + on the media element directly, possibly making use of the canPlayType() method to pick from amongst available resources. Generally, manipulating <{source}> elements manually after the document has been parsed is an unnecessarily complicated approach.

        @@ -5781,8 +5784,8 @@ zero or more <{track}> elements, then
        - If a source element is inserted as a child of a media element that - has no src attribute and whose networkState has the value NETWORK_EMPTY, the user agent must invoke the media element's resource selection + If a source element is inserted as a child of a media element that + has no src attribute and whose networkState has the value NETWORK_EMPTY, the user agent must invoke the media element's resource selection algorithm. The IDL attributes src and type must reflect the respective content @@ -5824,7 +5827,7 @@ zero or more <{track}> elements, then
        Categories:
        None.
        Contexts in which this element can be used:
        -
        As a child of a media element, before any flow content.
        +
        As a child of a media element, before any flow content.
        Content model:
        Nothing.
        Tag omission in text/html:
        @@ -5862,7 +5865,7 @@ zero or more <{track}> elements, then - The <{track}> element allows authors to specify explicit external text resources for media elements. It + The <{track}> element allows authors to specify explicit external text resources for media elements. It does not represent anything on its own. The kind attribute is an enumerated @@ -5914,14 +5917,10 @@ zero or more <{track}> elements, then track data. The value must be a valid non-empty URL potentially surrounded by spaces. This attribute must be present. -
        - - If the element has a src attribute whose value is not the - empty string and whose value, when the attribute was set, could be successfully resolved relative to the element, then the element's track - URL is the resulting absolute URL. Otherwise, the element's track - URL is the empty string. - -
        + If the element has a <{track/src}> attribute whose value is not the + empty string and whose value, when the attribute was set, could be successfully parsed + relative to the element's node document, then the element's track URL is the + resulting URL string. Otherwise, the element's track URL is the empty string.
        If the element's track URL identifies a WebVTT resource, and the @@ -5951,7 +5950,7 @@ zero or more <{track}> elements, then The value of the label attribute, if the attribute is present, must not be the empty string. Furthermore, there must not be two track - element children of the same media element whose kind attributes are in the same state, whose srclang attributes are both missing or have values that + element children of the same media element whose kind attributes are in the same state, whose srclang attributes are both missing or have values that represent the same language, and whose label attributes are again both missing or both have the same value. @@ -5967,13 +5966,13 @@ zero or more <{track}> elements, then attribute, which, if specified, indicates that the track is to be enabled if the user's preferences do not indicate that another track would be more appropriate. - Each media element must have no more than one <{track}> element child + Each media element must have no more than one <{track}> element child whose kind attribute is in the Subtitles or Captions state and whose <{track/default}> attribute is specified. - Each media element must have no more than one <{track}> element child + Each media element must have no more than one <{track}> element child whose kind attribute is in the Descriptions state and whose <{track/default}> attribute is specified. - Each media element must have no more than one <{track}> element child + Each media element must have no more than one <{track}> element child whose kind attribute is in the Chapters state and whose <{track/default}> attribute is specified.

        @@ -6061,10 +6060,10 @@ zero or more <{track}> elements, then

        -

        Media elements

        +

        Media elements

        - {{HTMLMediaElement}} objects (audio and <{video}>, in this - specification) are simply known as media elements. + {{HTMLMediaElement}} objects (<{audio}> and <{video}>, in this specification) are simply known as + media elements.
             enum CanPlayTypeResult { "" /* empty string */, "maybe", "probably" };
        @@ -6133,18 +6132,18 @@ zero or more <{track}> elements, then
         
           The media element attributes, src, crossorigin, preload, autoplay,
           mediagroup, loop,
        -  muted, and <{mediaelements/controls}>, apply to all media elements. They are defined in this section.
        +  muted, and <{mediaelements/controls}>, apply to all media elements. They are defined in this section.
         
        -  Media elements are used to present audio data, or video and
        +  Media elements are used to present audio data, or video and
           audio data, to the user. This is referred to as media data in this section, since this
        -  section applies equally to media elements for audio or for
        +  section applies equally to media elements for audio or for
           video.
         
           The term media resource is used to refer to the complete set of media data, e.g., the
           complete video file, or complete audio file.
         
           A media resource can have multiple audio and video tracks. For the purposes of a
        -  media element, the video data of the media resource is only that of the
        +  media element, the video data of the media resource is only that of the
           currently selected track (if any) as given by the element's videoTracks attribute when the event loop last
           reached step 1, and the audio data of the media resource is the result of mixing all
           the currently enabled tracks (if any) given by the element's audioTracks attribute when the event loop last
        @@ -6161,7 +6160,7 @@ zero or more <{track}> elements, then
         
           Except where otherwise explicitly specified, the task source for all the tasks
           queued in this section and its subsections is the media
        -  element event task source of the media element in question.
        +  element event task source of the media element in question.
         
           
        @@ -6184,7 +6183,7 @@ zero or more <{track}> elements, then
        - All media elements have an associated error status, which + All media elements have an associated error status, which records the last error the element encountered since its resource selection algorithm was last invoked. The error attribute, on getting, must return the MediaError object created for this last error, or null if there has not been an @@ -6248,26 +6247,26 @@ zero or more <{track}> elements, then
        Location of the media resource
        - The src content attribute on media elements gives the address of the media resource (video, audio) to show. The + The src content attribute on media elements gives the address of the media resource (video, audio) to show. The attribute, if present, must contain a valid non-empty URL potentially surrounded by spaces. The crossorigin content attribute on - media elements is a CORS settings attribute. + media elements is a CORS settings attribute.
        - If a media element is created with a + If a media element is created with a src attribute, the user agent must immediately invoke the - media element's resource selection + media element's resource selection algorithm. - If a src attribute of a media element is set - or changed, the user agent must invoke the media element's media element load + If a src attribute of a media element is set + or changed, the user agent must invoke the media element's media element load algorithm. (Removing the src attribute does not do this, even if there are <{source}> elements present.) - The src IDL attribute on media elements must reflect the content attribute of the same + The src IDL attribute on media elements must reflect the content attribute of the same name. The crossOrigin IDL attribute must @@ -6281,8 +6280,8 @@ zero or more <{track}> elements, then
        - Each media element can have an assigned media provider object, which is a - media provider object. When a media element is created, it has no + Each media element can have an assigned media provider object, which is a + media provider object. When a media element is created, it has no assigned media provider object.
        @@ -6424,7 +6423,7 @@ zero or more <{track}> elements, then
        - As media elements interact with the network, their current + As media elements interact with the network, their current network activity is represented by the networkState attribute. On getting, it must return the current network state of the element, which must be one of the following values: @@ -6477,12 +6476,12 @@ zero or more <{track}> elements, then
        - All media elements have an autoplaying flag, + All media elements have an autoplaying flag, which must begin in the true state, and a delaying-the-load-event flag, which must begin in the false state. While the delaying-the-load-event flag is true, the element must delay the load event of its document. - When the load() method on a media element is invoked, the user agent must run the media element load + When the load() method on a media element is invoked, the user agent must run the media element load algorithm. The media element load algorithm consists of the following steps. @@ -6494,7 +6493,7 @@ zero or more <{track}> elements, then
      21. - If there are any tasks from the media element's media element event task source in one of the task queues, then remove those tasks. + If there are any tasks from the media element's media element event task source in one of the task queues, then remove those tasks.

        Basically, pending events and callbacks for the media element are discarded when @@ -6503,22 +6502,22 @@ zero or more <{track}> elements, then

      22. -
      23. If the media element's networkState is set to NETWORK_LOADING or NETWORK_IDLE, queue a task to fire a - simple event named abort at the media element.
      24. +
      25. If the media element's networkState is set to NETWORK_LOADING or NETWORK_IDLE, queue a task to fire a + simple event named abort at the media element.
      26. - If the media element's networkState + If the media element's networkState is not set to NETWORK_EMPTY, then run these substeps:
          -
        1. Queue a task to fire a simple event named emptied at the media element.
        2. +
        3. Queue a task to fire a simple event named emptied at the media element.
        4. -
        5. If a fetching process is in progress for the media element, the user agent should stop it.
        6. +
        7. If a fetching process is in progress for the media element, the user agent should stop it.
        8. -
        9. If the media element's assigned media provider object +
        10. If the media element's assigned media provider object is a MediaSource object, then detach it. @@ -6540,7 +6539,7 @@ zero or more <{track}> elements, then Set the official playback position to 0. If this changed the official playback position, then queue a task - to fire a simple event named timeupdate at the media element. + to fire a simple event named timeupdate at the media element.
        11. @@ -6570,7 +6569,7 @@ zero or more <{track}> elements, then
        12. Set the error attribute to null and the autoplaying flag to true.
        13. -
        14. Invoke the media element's resource selection algorithm.
        15. +
        16. Invoke the media element's resource selection algorithm.
        17. @@ -6583,7 +6582,7 @@ zero or more <{track}> elements, then
        The resource selection algorithm for a - media element is as follows. This algorithm is always invoked as part of a task, but one + media element is as follows. This algorithm is always invoked as part of a task, but one of the first steps in the algorithm is to return and continue running the remaining steps in parallel. In addition, this algorithm interacts closely with the event loop mechanism; in particular, it has synchronous sections (which are triggered as part of the event loop @@ -6596,7 +6595,7 @@ zero or more <{track}> elements, then
      27. Set the element's show poster flag to true.
      28. -
      29. Set the media element's delaying-the-load-event flag to true +
      30. Set the media element's delaying-the-load-event flag to true (this delays the load event).
      31. in parallel await a stable state, allowing the task that invoked this algorithm to continue. The synchronous @@ -6605,35 +6604,35 @@ zero or more <{track}> elements, then
      32. - ⌛ If the media element's blocked-on-parser flag is false, + ⌛ If the media element's blocked-on-parser flag is false, then populate the list of pending text tracks.
      33. - ⌛ If the media element has an assigned media provider + ⌛ If the media element has an assigned media provider object, then let mode be object. - ⌛ Otherwise, if the media element has no assigned media provider + ⌛ Otherwise, if the media element has no assigned media provider object but has a src attribute, then let mode be attribute. - ⌛ Otherwise, if the media element does not have an assigned media provider + ⌛ Otherwise, if the media element does not have an assigned media provider object and does not have a src attribute, but does have a <{source}> element child, then let mode be children and let candidate be the first such <{source}> element child in tree order. - ⌛ Otherwise the media element has no assigned media provider + ⌛ Otherwise the media element has no assigned media provider object and has neither a src attribute nor a <{source}> element child: set the networkState to NETWORK_EMPTY, and abort these steps; the synchronous section ends.
      34. -
      35. ⌛ Set the media element's networkState to NETWORK_LOADING.
      36. +
      37. ⌛ Set the media element's networkState to NETWORK_LOADING.
      38. -
      39. Queue a task to fire a simple event named loadstart at the media element.
      40. +
      41. Queue a task to fire a simple event named loadstart at the media element.
      42. @@ -6682,9 +6681,9 @@ zero or more <{track}> elements, then down to the failed with attribute step below.
      43. ⌛ Let absolute URL be the absolute URL that - would have resulted from resolving the URL + would have resulted from parsing the URL specified by the src attribute's value relative to the - media element when the src attribute was last + media element when the src attribute was last changed.
      44. ⌛ If absolute URL was obtained successfully, set the currentSrc attribute to absolute @@ -6720,13 +6719,13 @@ zero or more <{track}> elements, then
      45. ⌛ Let pointer be a position defined by two adjacent nodes in the - media element's child list, treating the start of the list (before the first + media element's child list, treating the start of the list (before the first child in the list, if any) and end of the list (after the last child in the list, if any) as nodes in their own right. One node is the node before pointer, and the other node is the node after pointer. Initially, let pointer be the position between the candidate node and the next node, if there are any, or the end of the list, if it is the last node. - As nodes are inserted and removed into the media element, pointer must be updated as follows: + As nodes are inserted and removed into the media element, pointer must be updated as follows:
        @@ -6757,7 +6756,7 @@ zero or more <{track}> elements, then below.
      46. ⌛ Let absolute URL be the absolute URL that - would have resulted from resolving the URL + would have resulted from parsing the URL specified by candidate's src attribute's value relative to the candidate when the src attribute was last changed. @@ -6852,7 +6851,7 @@ zero or more <{track}> elements, then
      47. Set the element's show poster flag to true.
      48. Fire a simple event named error at - the media element.
      49. + the media element.
      50. Set the element's delaying-the-load-event flag to false. This stops delaying the load event.
      51. @@ -6862,7 +6861,7 @@ zero or more <{track}> elements, then
      - The resource fetch algorithm for a media element and a given absolute URL or media provider object is as + The resource fetch algorithm for a media element and a given absolute URL or media provider object is as follows:
        @@ -6877,7 +6876,7 @@ zero or more <{track}> elements, then resource.
      1. Remove all media-resource-specific text - tracks from the media element's list of pending text tracks, if + tracks from the media element's list of pending text tracks, if any.
      2. @@ -6925,13 +6924,13 @@ zero or more <{track}> elements, then
      3. Let request be the result of creating a potential-CORS request given - current media resource's absolute URL and the media element's crossorigin content attribute + current media resource's absolute URL and the media element's crossorigin content attribute value. Set request's client to the - media element's node document's Window object's + media element's node document's Window object's environment settings object and type - to "audio" if the media element is an audio + to "audio" if the media element is an audio element and to "video" otherwise. Fetch request. @@ -6943,13 +6942,13 @@ zero or more <{track}> elements, then canvas gets tainted when the video is drawn on it. The stall timeout is a user-agent defined length of time, which should be about - three seconds. When a media element that is actively attempting to obtain + three seconds. When a media element that is actively attempting to obtain media data has failed to receive any data for a duration equal to the stall timeout, the user agent must queue a task to fire a simple event named stalled at the element. User agents may allow users to selectively block or slow media data downloads. - When a media element's download has been blocked altogether, the user agent must + When a media element's download has been blocked altogether, the user agent must act as if it was stalled (as opposed to acting as if the connection was closed). The rate of the download may also be throttled automatically by the user agent, e.g., to balance the download with other connections sharing the same bandwidth. @@ -6957,7 +6956,7 @@ zero or more <{track}> elements, then User agents may decide to not download more content at any time, e.g., after buffering five minutes of a one hour media resource, while waiting for the user to decide whether to play the resource or not, while waiting for user input in an interactive resource, or - when the user navigates away from the page. When a media element's download has + when the user navigates away from the page. When a media element's download has been suspended, the user agent must queue a task, to set the networkState to NETWORK_IDLE and fire a simple event named suspend at the element. If and when downloading of the resource resumes, the user agent must queue a task to set the networkState to NETWORK_LOADING. Between the queuing of these tasks, @@ -7079,7 +7078,7 @@ zero or more <{track}> elements, then
      4. Create an AudioTrack object to represent the audio track.
      5. -
      6. Update the media element's audioTracks attribute's AudioTrackList +
      7. Update the media element's audioTracks attribute's AudioTrackList object with the new AudioTrack object.
      8. Let enable be unknown.
      9. @@ -7099,7 +7098,7 @@ zero or more <{track}> elements, then -
      10. If enable is still unknown, then, if the media element does not yet have an enabled +
      11. If enable is still unknown, then, if the media element does not yet have an enabled audio track, then set enable to true, otherwise, set enable to false.
      12. If enable is true, then enable this audio track, @@ -7122,7 +7121,7 @@ zero or more <{track}> elements, then
      13. Create a {{VideoTrack}} object to represent the video track.
      14. -
      15. Update the media element's videoTracks attribute's VideoTrackList +
      16. Update the media element's videoTracks attribute's VideoTrackList object with the new VideoTrack object.
      17. Let enable be unknown.
      18. @@ -7141,7 +7140,7 @@ zero or more <{track}> elements, then -
      19. If enable is still unknown, then, if the media element does not yet have a selected +
      20. If enable is still unknown, then, if the media element does not yet have a selected video track, then set enable to true, otherwise, set enable to false.
      21. If enable is true, then select this track and unselect any @@ -7202,7 +7201,7 @@ zero or more <{track}> elements, then For <{video}> elements, set the videoWidth and videoHeight attributes, and queue a task to fire a simple event named resize at - the media element. + the media element.

        Further resize events will be fired @@ -7224,10 +7223,10 @@ zero or more <{track}> elements, then

      22. Let jumped be false.
      23. -
      24. If the media element's default playback start position is +
      25. If the media element's default playback start position is greater than zero, then seek to that time, and let jumped be true.
      26. -
      27. Let the media element's default playback +
      28. Let the media element's default playback start position be zero.
      29. Let the initial playback position be zero.
      30. @@ -7251,14 +7250,14 @@ zero or more <{track}> elements, then
      31. If there is no selected video track, then select a video track. This will cause a change event to be fired.
      32. -
      33. If the media element has a current media controller, then: +
      34. If the media element has a current media controller, then: if jumped is true and the initial playback position, relative to the current media controller's timeline, is greater than the current media controller's media controller position, then - seek the media controller to the media element's initial + seek the media controller to the media element's initial playback position, relative to the current media controller's timeline; - otherwise, seek the media element to the - media controller position, relative to the media element's + otherwise, seek the media element to the + media controller position, relative to the media element's timeline.
      @@ -7287,10 +7286,10 @@ zero or more <{track}> elements, then
      Fire a simple event named progress - at the media element. + at the media element. Set the networkState to NETWORK_IDLE and fire a simple event named - suspend at the media element. + suspend at the media element. If the user agent ever discards any media data and then needs to resume the network activity to obtain it again, then it must queue a task to set the networkState to NETWORK_LOADING. @@ -7307,7 +7306,7 @@ zero or more <{track}> elements, then
      - Fatal network errors that occur after the user agent has established whether the current media resource is usable (i.e., once the media element's + Fatal network errors that occur after the user agent has established whether the current media resource is usable (i.e., once the media element's readyState attribute is no longer HAVE_NOTHING) must cause the user agent to execute the following steps: @@ -7325,7 +7324,7 @@ zero or more <{track}> elements, then
    11. Set the element's delaying-the-load-event flag to false. This stops delaying the load event.
    12. Fire a simple event named error at - the media element.
    13. + the media element.
    14. Abort the overall resource selection algorithm.
    15. @@ -7339,7 +7338,7 @@ zero or more <{track}> elements, then
      Fatal errors in decoding the media data that occur after the user agent has - established whether the current media resource is usable (i.e., once the media element's + established whether the current media resource is usable (i.e., once the media element's readyState attribute is no longer HAVE_NOTHING) must cause the user agent to execute the following steps: @@ -7357,7 +7356,7 @@ zero or more <{track}> elements, then
    16. Set the element's delaying-the-load-event flag to false. This stops delaying the load event.
    17. Fire a simple event named error at - the media element.
    18. + the media element.
    19. Abort the overall resource selection algorithm.
    20. @@ -7384,11 +7383,11 @@ zero or more <{track}> elements, then is set to MEDIA_ERR_ABORTED.
    21. Fire a simple event named abort at - the media element.
    22. + the media element.
    23. - If the media element's readyState + If the media element's readyState attribute has a value equal to HAVE_NOTHING, set the element's networkState attribute to the NETWORK_EMPTY value, set the element's @@ -7445,11 +7444,11 @@ zero or more <{track}> elements, then
    - When a media element is to forget the media element's media-resource-specific - tracks, the user agent must remove from the media element's list of text + When a media element is to forget the media element's media-resource-specific + tracks, the user agent must remove from the media element's list of text tracks all the media-resource-specific - text tracks, then empty the media element's audioTracks attribute's AudioTrackList object, - then empty the media element's videoTracks + text tracks, then empty the media element's audioTracks attribute's AudioTrackList object, + then empty the media element's videoTracks attribute's VideoTrackList object. No events (in particular, no removetrack events) are fired as part of this; the error and emptied events, fired by the algorithms that invoke this one, can be used instead. @@ -7479,7 +7478,7 @@ zero or more <{track}> elements, then metadata Metadata - Hints to the user agent that the author does not expect the user to need the media resource, but that fetching the resource metadata (dimensions, track list, duration, etc), and maybe even the first few frames, is reasonable. If the user agent precisely fetches no more than the metadata, then the media element will end up with its readyState attribute set to HAVE_METADATA; typically though, some frames will be obtained as well and it will probably be HAVE_CURRENT_DATA or HAVE_FUTURE_DATA. + Hints to the user agent that the author does not expect the user to need the media resource, but that fetching the resource metadata (dimensions, track list, duration, etc), and maybe even the first few frames, is reasonable. If the user agent precisely fetches no more than the metadata, then the media element will end up with its readyState attribute set to HAVE_METADATA; typically though, some frames will be obtained as well and it will probably be HAVE_CURRENT_DATA or HAVE_FUTURE_DATA. When the media resource is playing, hints to the user agent that bandwidth is to be considered scarce, e.g., suggesting throttling the download so that the media data is obtained at the slowest possible rate that still maintains consistent playback. auto @@ -7679,36 +7678,36 @@ zero or more <{track}> elements, then wall clock.

    - All the media elements that share current + All the media elements that share current media controller use the same clock for their media timeline.

    - Media elements have a current playback position, + Media elements have a current playback position, which must initially (i.e., in the absence of media data) be zero seconds. The current playback position is a time on the media timeline. - Media elements also have an official playback + Media elements also have an official playback position, which must initially be set to zero seconds. The official playback position is an approximation of the current playback position that is kept stable while scripts are running. - Media elements also have a default playback start + Media elements also have a default playback start position, which must initially be set to zero seconds. This time is used to allow the element to be seeked even before the media is loaded. - Each media element has a show poster flag. When a media element is created, this flag must be set to true. This flag is used to control when the + Each media element has a show poster flag. When a media element is created, this flag must be set to true. This flag is used to control when the user agent is to show a poster frame for a <{video}> element instead of showing the video contents. The currentTime attribute must, on - getting, return the media element's default playback start position, + getting, return the media element's default playback start position, unless that is zero, in which case it must return the element's official playback - position. The returned value must be expressed in seconds. On setting, if the media element has a current media controller, then the user agent must throw an - InvalidStateError exception; otherwise, if the media element's readyState is HAVE_NOTHING, then it must set the media element's default playback start position to the new value; otherwise, it must + position. The returned value must be expressed in seconds. On setting, if the media element has a current media controller, then the user agent must throw an + InvalidStateError exception; otherwise, if the media element's readyState is HAVE_NOTHING, then it must set the media element's default playback start position to the new value; otherwise, it must set the official playback position to the new value and then seek to the new value. The new value must be interpreted as being in seconds. - Media elements have an initial playback position, + Media elements have an initial playback position, which must initially (i.e., in the absence of media data) be zero seconds. The initial playback position is updated when a media resource is loaded. The initial playback position is a time on the media timeline. @@ -7744,7 +7743,7 @@ zero or more <{track}> elements, then attribute's AudioTrackList object or the videoTracks attribute's VideoTrackList object as appropriate and then fire a trusted event with the name removetrack, that does not bubble and is not cancelable, and that uses the TrackEvent interface, with the track attribute initialized to the AudioTrack or - VideoTrack object representing the track, at the media element's + VideoTrack object representing the track, at the media element's aforementioned AudioTrackList or VideoTrackList object. The duration attribute must return the time @@ -7760,7 +7759,7 @@ zero or more <{track}> elements, then When the length of the media resource changes to a known value (e.g., from being unknown to known, or from a previously established length to a new length) the - user agent must queue a task to fire a simple event named durationchange at the media element. (The + user agent must queue a task to fire a simple event named durationchange at the media element. (The event is not fired when the duration is reset as part of loading a new media resource.) If the duration is changed such that the current playback position ends up being greater than the time of the end of the media resource, then the user agent must also seek to the time of the end of the media resource. @@ -7784,7 +7783,7 @@ zero or more <{track}> elements, then
    The loop attribute is a boolean - attribute that, if specified, indicates that the media element is to seek back + attribute that, if specified, indicates that the media element is to seek back to the start of the media resource upon reaching the end. The loop attribute has no effect while the element has a @@ -7814,7 +7813,7 @@ zero or more <{track}> elements, then
    - Media elements have a ready state, which describes to + Media elements have a ready state, which describes to what degree they are ready to be rendered at the current playback position. The possible values are as follows; the ready state of a media element at any particular time is the greatest value describing the state of the element: @@ -7826,7 +7825,7 @@ zero or more <{track}> elements, then
    HAVE_NOTHING (numeric value 0)
    No information regarding the media resource is available. No data for the - current playback position is available. Media elements whose networkState attribute are set + current playback position is available. Media elements whose networkState attribute are set to NETWORK_EMPTY are always in the HAVE_NOTHING state.
    HAVE_METADATA (numeric value 1)
    @@ -7896,7 +7895,7 @@ zero or more <{track}> elements, then
    - When the ready state of a media element whose networkState is not NETWORK_EMPTY changes, the user agent must follow the steps + When the ready state of a media element whose networkState is not NETWORK_EMPTY changes, the user agent must follow the steps given below:
      @@ -7925,7 +7924,7 @@ zero or more <{track}> elements, then
      - If this is the first time this occurs for this media element since the load() algorithm was last + If this is the first time this occurs for this media element since the load() algorithm was last invoked, the user agent must queue a task to fire a simple event named loadeddata at the element. @@ -7940,7 +7939,7 @@ zero or more <{track}> elements, then
      - If the media element was potentially + If the media element was potentially playing before its readyState attribute changed to a value lower than HAVE_FUTURE_DATA, and the element has not ended playback, and playback has not stopped due to errors, @@ -7973,9 +7972,9 @@ zero or more <{track}> elements, then fire a simple event named playing at the element. - If the autoplaying flag is true, and the paused attribute is true, and the media element + If the autoplaying flag is true, and the paused attribute is true, and the media element has an autoplay attribute specified, and the - media element's node document's active sandboxing flag set + media element's node document's active sandboxing flag set does not have the sandboxed automatic features browsing context flag set, then the user agent may also run the following substeps: @@ -8009,8 +8008,8 @@ zero or more <{track}> elements, then -
    1. If the media element has a current media controller, then - report the controller state for the media element's current media +
    2. If the media element has a current media controller, then + report the controller state for the media element's current media controller.
    @@ -8026,7 +8025,7 @@ zero or more <{track}> elements, then The readyState IDL attribute must, on getting, return the value described above that describes the current ready state of the - media element. + media element.
    @@ -8135,12 +8134,12 @@ zero or more <{track}> elements, then
    The paused attribute represents whether the - media element is paused or not. The attribute must initially be true. + media element is paused or not. The attribute must initially be true. - A media element is a blocked media element if its readyState attribute is in the HAVE_NOTHING state, the HAVE_METADATA state, or the HAVE_CURRENT_DATA state, or if the element has + A media element is a blocked media element if its readyState attribute is in the HAVE_NOTHING state, the HAVE_METADATA state, or the HAVE_CURRENT_DATA state, or if the element has paused for user interaction or paused for in-band content. - A media element is said to be potentially playing when its paused attribute is false, the element has not ended + A media element is said to be potentially playing when its paused attribute is false, the element has not ended playback, playback has not stopped due to errors, the element either has no current media controller or has a current media controller but is not blocked on its media controller, and the element is not a blocked media @@ -8151,7 +8150,7 @@ zero or more <{track}> elements, then potentially playing stopping playback due to its readyState attribute changing to a value lower than HAVE_FUTURE_DATA.

    - A media element is said to have ended playback when: + A media element is said to have ended playback when: @@ -8189,42 +8188,42 @@ zero or more <{track}> elements, then The ended attribute must return true if, the - last time the event loop reached step 1, the media element had + last time the event loop reached step 1, the media element had ended playback and the direction of playback was forwards, and false otherwise. - A media element is said to have stopped due to errors when the + A media element is said to have stopped due to errors when the element's readyState attribute is HAVE_METADATA or greater, and the user agent encounters a non-fatal error during the processing of the media data, and due to that error, is not able to play the content at the current playback position. - A media element is said to have paused for user interaction when its + A media element is said to have paused for user interaction when its paused attribute is false, the readyState attribute is either HAVE_FUTURE_DATA or HAVE_ENOUGH_DATA and the user agent has reached a point in the media resource where the user has to make a selection for the resource to - continue. If the media element has a current media controller when this - happens, then the user agent must report the controller state for the media element's current media controller. If the media element has a + continue. If the media element has a current media controller when this + happens, then the user agent must report the controller state for the media element's current media controller. If the media element has a current media controller when the user makes a selection, allowing playback to - resume, the user agent must similarly report the controller state for the media element's current media controller. + resume, the user agent must similarly report the controller state for the media element's current media controller. - It is possible for a media element to have both ended playback and + It is possible for a media element to have both ended playback and paused for user interaction at the same time. - When a media element that is potentially playing stops playing + When a media element that is potentially playing stops playing because it has paused for user interaction, the user agent must queue a task to fire a simple event named timeupdate at the element. - A media element is said to have paused for in-band content when its + A media element is said to have paused for in-band content when its paused attribute is false, the readyState attribute is either HAVE_FUTURE_DATA or HAVE_ENOUGH_DATA and the user agent has suspended playback of the media resource in order to play content that is temporally anchored to the media resource and has a non-zero length, or to play content that is temporally anchored to a segment of the media resource but has a length longer than - that segment. If the media element has a current media controller when + that segment. If the media element has a current media controller when this happens, then the user agent must report the controller state for the - media element's current media controller. If the media element has a current media controller when the user agent unsuspends + media element's current media controller. If the media element has a current media controller when the user agent unsuspends playback, the user agent must similarly report the controller state for the - media element's current media controller. + media element's current media controller. -

    One example of when a media element would be paused for +

    One example of when a media element would be paused for in-band content is when the user agent is playing audio descriptions from an external WebVTT file, and the synthesized speech generated for a cue is longer than the time between the text track cue start time and the text track cue end time.

    @@ -8237,24 +8236,24 @@ zero or more <{track}> elements, then
      -
    1. If the media element has a loop +
    2. If the media element has a loop attribute specified and does not have a current media controller, then seek to the earliest possible position of the media resource and abort these steps.
    3. As defined above, the ended IDL attribute starts returning true once the event loop returns to step 1.
    4. -
    5. Queue a task to fire a simple event named timeupdate at the media element.
    6. +
    7. Queue a task to fire a simple event named timeupdate at the media element.
    8. -
    9. Queue a task that, if the media element does not have a - current media controller, and the media element has still ended +
    10. Queue a task that, if the media element does not have a + current media controller, and the media element has still ended playback, and the direction of playback is still forwards, and paused is false, changes paused to true and fires a - simple event named pause at the media element.
    11. + simple event named pause at the media element. -
    12. Queue a task to fire a simple event named ended at the media element.
    13. +
    14. Queue a task to fire a simple event named ended at the media element.
    15. -
    16. If the media element has a current media controller, then - report the controller state for the media element's current media +
    17. If the media element has a current media controller, then + report the controller state for the media element's current media controller.
    @@ -8295,12 +8294,12 @@ zero or more <{track}> elements, then or playbackRate attributes change value (either by being set by script or by being changed directly by the user agent, e.g., in response to user control) the user agent must queue a task to fire a simple event named - ratechange at the media element. + ratechange at the media element.

    The defaultPlaybackRate and playbackRate attributes have no effect when the - media element has a current media controller; the namesake attributes on + media element has a current media controller; the namesake attributes on the MediaController object are used instead in that situation.

    @@ -8314,32 +8313,32 @@ zero or more <{track}> elements, then
    - When the play() method on a media element is invoked, the user agent must run the following steps. + When the play() method on a media element is invoked, the user agent must run the following steps.
      -
    1. If the media element's networkState attribute has the value NETWORK_EMPTY, invoke the media element's +
    2. If the media element's networkState attribute has the value NETWORK_EMPTY, invoke the media element's resource selection algorithm.
    3. If the playback has ended and the direction of - playback is forwards, and the media element does not have a current + playback is forwards, and the media element does not have a current media controller, seek to the earliest possible position of the media resource.

      - This will cause the user agent to queue a task to fire a simple event named timeupdate at the media element. + This will cause the user agent to queue a task to fire a simple event named timeupdate at the media element.

    4. -
    5. If the media element has a current media controller, then +
    6. If the media element has a current media controller, then bring the media element up to speed with its new media controller.
    7. - If the media element's paused attribute is + If the media element's paused attribute is true, run the following substeps:
        @@ -8353,12 +8352,12 @@ zero or more <{track}> elements, then
      1. - If the media element's readyState + If the media element's readyState attribute has the value HAVE_NOTHING, HAVE_METADATA, or HAVE_CURRENT_DATA, queue a task to fire a simple event named waiting at the element. - Otherwise, the media element's readyState attribute has the value HAVE_FUTURE_DATA or HAVE_ENOUGH_DATA: queue a task to + Otherwise, the media element's readyState attribute has the value HAVE_FUTURE_DATA or HAVE_ENOUGH_DATA: queue a task to fire a simple event named playing at the element. @@ -8368,10 +8367,10 @@ zero or more <{track}> elements, then
      2. -
      3. Set the media element's autoplaying flag to false.
      4. +
      5. Set the media element's autoplaying flag to false.
      6. -
      7. If the media element has a current media controller, then - report the controller state for the media element's current media +
      8. If the media element has a current media controller, then + report the controller state for the media element's current media controller.
      @@ -8379,25 +8378,25 @@ zero or more <{track}> elements, then
      When the pause() method is invoked, and when - the user agent is required to pause the media element, the user agent must run the + the user agent is required to pause the media element, the user agent must run the following steps:
        -
      1. If the media element's networkState attribute has the value NETWORK_EMPTY, invoke the media element's +
      2. If the media element's networkState attribute has the value NETWORK_EMPTY, invoke the media element's resource selection algorithm.
      3. -
      4. Run the internal pause steps for the media element.
      5. +
      6. Run the internal pause steps for the media element.
      - The internal pause steps for a media element are as follows: + The internal pause steps for a media element are as follows:
        -
      1. Set the media element's autoplaying flag to false.
      2. +
      3. Set the media element's autoplaying flag to false.
      4. -
      5. If the media element's paused attribute +
      6. If the media element's paused attribute is false, run the following steps:
          @@ -8419,24 +8418,24 @@ zero or more <{track}> elements, then -
        1. If the media element has a current media controller, then - report the controller state for the media element's current media +
        2. If the media element has a current media controller, then + report the controller state for the media element's current media controller.

        - The effective playback rate is not necessarily the element's playbackRate. When a media element has a + The effective playback rate is not necessarily the element's playbackRate. When a media element has a current media controller, its effective playback rate is the MediaController's media controller playback rate. Otherwise, the effective playback rate is just the element's playbackRate. Thus, the current media - controller overrides the media element. + controller overrides the media element. If the effective playback rate is positive or zero, then the direction of playback is forwards. Otherwise, it is backwards. - When a media element is potentially playing and + When a media element is potentially playing and its {{Document}} is a fully active {{Document}}, its current playback position must increase monotonically at effective playback rate units of media time per unit time of the media timeline's clock. (This specification always @@ -8468,7 +8467,7 @@ zero or more <{track}> elements, then rate is not 1.0, the user agent may apply pitch adjustments to the audio as necessary to render it faithfully. - Media elements that are potentially playing + Media elements that are potentially playing while not in a Document must not play any video, but should play any audio component. Media elements must not stop playing just because all references to them have been removed; only once a media element is in a state where no further audio could ever be played @@ -8486,22 +8485,22 @@ zero or more <{track}> elements, then
        - Each media element has a list of newly introduced cues, which must be + Each media element has a list of newly introduced cues, which must be initially empty. Whenever a text track cue is added to the list of cues of a text track that is in the list of text - tracks for a media element, that cue must - be added to the media element's list of newly introduced cues. Whenever - a text track is added to the list of text tracks for a media element, all of the cues in that text + tracks for a media element, that cue must + be added to the media element's list of newly introduced cues. Whenever + a text track is added to the list of text tracks for a media element, all of the cues in that text track's list of cues must be added to the - media element's list of newly introduced cues. When a media element's list of newly introduced cues has new cues added while the - media element's show poster flag is not set, then the user agent must + media element's list of newly introduced cues. When a media element's list of newly introduced cues has new cues added while the + media element's show poster flag is not set, then the user agent must run the time marches on steps. When a text track cue is removed from the list of cues of a text track that is in the list of text - tracks for a media element, and whenever a text track is removed - from the list of text tracks of a media element, if the media element's show poster flag is not set, then the user agent must run the + tracks for a media element, and whenever a text track is removed + from the list of text tracks of a media element, if the media element's show poster flag is not set, then the user agent must run the time marches on steps. - When the current playback position of a media element changes (e.g., + When the current playback position of a media element changes (e.g., due to playback or seeking), the user agent must run the time marches on steps. If the current playback position changes while the steps are running, then the user agent must wait for the steps to complete, and then must immediately rerun the steps. (These steps are @@ -8514,15 +8513,15 @@ zero or more <{track}> elements, then
        1. Let current cues be a list of cues, initialized to contain all the cues of all - the hidden or showing text tracks of the media element (not the disabled ones) whose start times are less than or equal to the current + the hidden or showing text tracks of the media element (not the disabled ones) whose start times are less than or equal to the current playback position and whose end times are greater than the current playback position.
        2. Let other cues be a list of cues, - initialized to contain all the cues of hidden and showing text tracks of the media element that are not present in current cues.
        3. + initialized to contain all the cues of hidden and showing text tracks of the media element that are not present in current cues.
        4. Let last time be the current playback position at the - time this algorithm was last run for this media element, if this is not the first + time this algorithm was last run for this media element, if this is not the first time it has run.
        5. If the current playback position has, since the last time this algorithm was @@ -8531,7 +8530,7 @@ zero or more <{track}> elements, then Otherwise, let missed cues be an empty list.
        6. Remove all the cues in missed cues - that are also in the media element's list of newly introduced cues, and + that are also in the media element's list of newly introduced cues, and then empty the element's list of newly introduced cues.
        7. If the time was reached through the usual monotonic increase of the current playback @@ -8559,7 +8558,7 @@ zero or more <{track}> elements, then position during normal playback, and there are cues in other cues that have their text track cue pause-on-exit flag set and that either have their text track cue active flag set or are also in missed cues, then immediately pause the - media element. + media element.

          In the other cases, such as explicit seeks, playback is not paused by going past @@ -8629,7 +8628,7 @@ zero or more <{track}> elements, then

        8. Queue each task in events, in list order.
        9. -
        10. Sort affected tracks in the same order as the text tracks appear in the media element's list of text +
        11. Sort affected tracks in the same order as the text tracks appear in the media element's list of text tracks, and remove duplicates.
        12. For each text track in affected tracks, in the list @@ -8655,25 +8654,25 @@ zero or more <{track}> elements, then merely if it is associated with the text track.

          - If the media element's node document stops being a + If the media element's node document stops being a fully active document, then the playback will stop until the document is active again.

          - When a media element is removed + When a media element is removed from a Document, the user agent must run the following steps:
            -
          1. Await a stable state, allowing the task that removed the media element from the +
          2. Await a stable state, allowing the task that removed the media element from the {{Document}} to continue. The synchronous section consists of all the remaining steps of this algorithm. (Steps in the synchronous section are marked with ⌛.)
          3. -
          4. ⌛ If the media element is in a Document, +
          5. ⌛ If the media element is in a Document, abort these steps.
          6. -
          7. ⌛ Run the internal pause steps for the media element. +
          8. ⌛ Run the internal pause steps for the media element.
    @@ -8728,9 +8727,9 @@ zero or more <{track}> elements, then
      -
    1. Set the media element's show poster flag to false.
    2. +
    3. Set the media element's show poster flag to false.
    4. -
    5. If the media element's readyState +
    6. If the media element's readyState is HAVE_NOTHING, abort these steps.
    7. If the element's seeking IDL attribute is true, @@ -8780,7 +8779,7 @@ zero or more <{track}> elements, then position.

      - If the media element was potentially playing + If the media element was potentially playing immediately before it started seeking, but seeking caused its readyState attribute to change to a value lower than HAVE_FUTURE_DATA, then a waiting event will be fired at the element.

      @@ -8858,9 +8857,9 @@ zero or more <{track}> elements, then restart the video and watch it all the way through just to get to an earlier unbuffered spot.

      Media resources might be internally scripted or - interactive. Thus, a media element could play in a non-linear fashion. If this + interactive. Thus, a media element could play in a non-linear fashion. If this happens, the user agent must act as if the algorithm for seeking was used whenever the current playback position - changes in a discontinuous fashion (so that the relevant events fire). If the media element has a current media controller, then the user agent must seek + changes in a discontinuous fashion (so that the relevant events fire). If the media element has a current media controller, then the user agent must seek the media controller appropriately instead.
    @@ -8897,18 +8896,18 @@ zero or more <{track}> elements, then
    The audioTracks attribute of a - media element must return a live AudioTrackList object - representing the audio tracks available in the media element's media + media element must return a live AudioTrackList object + representing the audio tracks available in the media element's media resource. The videoTracks attribute of a - media element must return a live VideoTrackList object - representing the video tracks available in the media element's media + media element must return a live VideoTrackList object + representing the video tracks available in the media element's media resource.

    There are only ever one AudioTrackList object and one - VideoTrackList object per media element, even if another media + VideoTrackList object per media element, even if another media resource is loaded into the element: the objects are reused. (The AudioTrack and VideoTrack objects are not, though.)

    @@ -9340,20 +9339,20 @@ zero or more <{track}> elements, then
    Introduction
    - Each media element can have a MediaController. A - MediaController is an object that coordinates the playback of multiple media elements, for instance so that a sign-language interpreter + Each media element can have a MediaController. A + MediaController is an object that coordinates the playback of multiple media elements, for instance so that a sign-language interpreter track can be overlaid on a video track, with the two being kept synchronized. - By default, a media element has no MediaController. An implicit + By default, a media element has no MediaController. An implicit MediaController can be assigned using the mediagroup content attribute. An explicit MediaController can be assigned directly using the controller IDL attribute. - Media elements with a MediaController are said + Media elements with a MediaController are said to be slaved to their controller. The MediaController modifies the playback - rate and the playback volume of each of the media elements - slaved to it, and ensures that when any of its slaved media elements unexpectedly stall, the others are stopped at the same time. + rate and the playback volume of each of the media elements + slaved to it, and ensures that when any of its slaved media elements unexpectedly stall, the others are stopped at the same time. - When a media element is slaved to a MediaController, its playback + When a media element is slaved to a MediaController, its playback rate is fixed to that of the other tracks in the same MediaController, and any looping is disabled. @@ -9418,7 +9417,7 @@ zero or more <{track}> elements, then
    - Returns the current MediaController for the media element, if any, + Returns the current MediaController for the media element, if any, or null otherwise. Can be set, to set an explicit MediaController. Doing so removes the mediagroup attribute, if any. @@ -9431,7 +9430,7 @@ zero or more <{track}> elements, then Returns the state that the MediaController was in the last time it fired events as a result of reporting the controller state. - The values of this attribute are the same as for the readyState attribute of media elements. + The values of this attribute are the same as for the readyState attribute of media elements.
    @@ -9440,7 +9439,7 @@ zero or more <{track}> elements, then
    Returns a TimeRanges object that represents the intersection of the time ranges - for which the user agent has all relevant media data for all the slaved media elements. + for which the user agent has all relevant media data for all the slaved media elements.
    @@ -9449,7 +9448,7 @@ zero or more <{track}> elements, then
    Returns a TimeRanges object that represents the intersection of the time ranges - into which the user agent can seek for all the slaved media elements. + into which the user agent can seek for all the slaved media elements.
    @@ -9479,7 +9478,7 @@ zero or more <{track}> elements, then
    Returns true if playback is paused; false otherwise. When this attribute is true, any - media element slaved to this controller will be stopped. + media element slaved to this controller will be stopped.
    @@ -9527,7 +9526,7 @@ zero or more <{track}> elements, then
    Returns a TimeRanges object that represents the union of the time ranges in all - the slaved media elements that have been played. + the slaved media elements that have been played.
    @@ -9574,7 +9573,7 @@ zero or more <{track}> elements, then
    Returns true if all audio is muted (regardless of other attributes either on the controller - or on any media elements slaved to this controller), and + or on any media elements slaved to this controller), and false otherwise. Can be set, to change whether the audio is muted or not. @@ -9585,12 +9584,12 @@ zero or more <{track}> elements, then
    - A media element can have a current media controller, which is a - MediaController object. When a media element is created without a mediagroup attribute, it does not have a current media + A media element can have a current media controller, which is a + MediaController object. When a media element is created without a mediagroup attribute, it does not have a current media controller. (If it is created with such an attribute, then that attribute initializes the current media controller, as defined below.) - The slaved media elements of a MediaController are the media elements whose current media controller is that + The slaved media elements of a MediaController are the media elements whose current media controller is that MediaController. All the slaved media elements of a MediaController must use the same clock for their definition of their media timeline's unit time. When the user agent is required to act on each slaved media element in turn, they must be processed in the order that they @@ -9598,12 +9597,12 @@ zero or more <{track}> elements, then
    - The controller attribute on a media element, on getting, must return the element's current media controller, if + The controller attribute on a media element, on getting, must return the element's current media controller, if any, or null otherwise. On setting, the user agent must run the following steps:
      -
    1. Let m be the media element in question.
    2. +
    3. Let m be the media element in question.
    4. Let old controller be m's current media controller, if it currently has one, and null otherwise.
    5. @@ -9776,7 +9775,7 @@ zero or more <{track}> elements, then with the earliest defined point on the timeline of the media resource with the earliest timeline offset). - The media resource end position of a media resource in a media element is defined as follows: if the media resource has a finite and known + The media resource end position of a media resource in a media element is defined as follows: if the media resource has a finite and known duration, the media resource end position is the duration of the media resource's timeline (the last defined position on that timeline); otherwise, the media resource's duration is infinite or unknown, and the media resource end @@ -9799,8 +9798,8 @@ zero or more <{track}> elements, then slaved media elements. When a MediaController is created, its media controller position is initially zero. - When the user agent is to bring a media element up to speed with its new media controller, it must seek that media element to the - MediaController's media controller position relative to the media element's timeline. + When the user agent is to bring a media element up to speed with its new media controller, it must seek that media element to the + MediaController's media controller position relative to the media element's timeline. When the user agent is to seek the media controller to a particular new playback position, it must follow these steps: @@ -9816,7 +9815,7 @@ zero or more <{track}> elements, then position.
    6. Seek each slaved - media element to the new playback position relative to the media element timeline.
    7. + media element to the new playback position relative to the media element timeline.
    @@ -9827,7 +9826,7 @@ zero or more <{track}> elements, then flag is true still have their paused attribute set to true, or if all of its slaved media elements have their paused attribute set to true. - A media element is blocked on its media controller if the + A media element is blocked on its media controller if the MediaController is a blocked media controller, or if its media controller position is either before the media resource's earliest possible position relative to the MediaController's timeline or after the end @@ -9856,7 +9855,7 @@ zero or more <{track}> elements, then
    A MediaController has a most recently reported readiness state, which - is a number from 0 to 4 derived from the numbers used for the media element readyState attribute, and a most recently reported + is a number from 0 to 4 derived from the numbers used for the media element readyState attribute, and a most recently reported playback state, which is either playing, waiting, or ended. When a MediaController is created, its most recently reported readiness @@ -10069,19 +10068,19 @@ zero or more <{track}> elements, then
    Assigning a media controller declaratively
    - The mediagroup content attribute on
    media elements can be used to link multiple media elements together by implicitly creating a MediaController. The - value is text; media elements with the same value are + The mediagroup content attribute on media elements can be used to link multiple media elements together by implicitly creating a MediaController. The + value is text; media elements with the same value are automatically linked by the user agent.
    - When a media element is created with a mediagroup attribute, and when a media element's + When a media element is created with a mediagroup attribute, and when a media element's mediagroup attribute is set, changed, or removed, the user agent must run the following steps:
      -
    1. Let m be the media element in question.
    2. +
    3. Let m be the media element in question.
    4. Let old controller be m's current media controller, if it currently has one, and null otherwise.
    5. @@ -10096,12 +10095,12 @@ zero or more <{track}> elements, then
    6. - If there is another media element whose {{Document}} is the same as + If there is another media element whose {{Document}} is the same as m's node document (even if one or both of these elements are not actually in the Document), and which also has a mediagroup attribute, and whose mediagroup attribute has the same value as the new value of m's mediagroup attribute, then - let controller be that media element's current media + let controller be that media element's current media controller. Otherwise, let controller be a newly created @@ -10131,12 +10130,12 @@ zero or more <{track}> elements, then
    - The mediaGroup IDL attribute on media elements must reflect the mediagroup content attribute. + The mediaGroup IDL attribute on media elements must reflect the mediagroup content attribute.
    - Multiple media elements referencing the same media + Multiple media elements referencing the same media resource will share a single network request. This can be used to efficiently play two (video) tracks from the same media resource in two different places on the screen. Used with the mediagroup attribute, these elements can @@ -10167,13 +10166,13 @@ zero or more <{track}> elements, then
    Text track model
    - A media element can have a group of associated text - tracks, known as the media element's list of text tracks. The text tracks are sorted as follows: + A media element can have a group of associated text + tracks, known as the media element's list of text tracks. The text tracks are sorted as follows:
    1. The text tracks corresponding to <{track}> element - children of the media element, in tree order.
    2. + children of the media element, in tree order.
    3. Any text tracks added using the addTextTrack() method, in the order they were added, oldest first.
    4. @@ -10375,12 +10374,12 @@ zero or more <{track}> elements, then
      - Each media element has a list of pending text tracks, which must + Each media element has a list of pending text tracks, which must initially be empty, a blocked-on-parser flag, which must initially be false, and a did-perform-automatic-track-selection flag, which must also initially be false. When the user agent is required to populate the list of pending text tracks of a - media element, the user agent must add to the element's list of pending text + media element, the user agent must add to the element's list of pending text tracks each text track in the element's list of text tracks whose text track mode is not disabled and whose text track readiness state is loading. @@ -10393,29 +10392,29 @@ zero or more <{track}> elements, then loaded or failed to load, the user agent must remove it from any list of pending text tracks that it is in. - When a media element is created by an HTML parser or XML + When a media element is created by an HTML parser or XML parser, the user agent must set the element's blocked-on-parser flag to true. - When a media element is popped off the stack of open elements of an + When a media element is popped off the stack of open elements of an HTML parser or XML parser, the user agent must honor user preferences for automatic text track selection, populate the list of pending text tracks, and set the element's blocked-on-parser flag to false. - The text tracks of a media element are ready when both the element's list of pending text + The text tracks of a media element are ready when both the element's list of pending text tracks is empty and the element's blocked-on-parser flag is false. - Each media element has a pending text track change notification flag, + Each media element has a pending text track change notification flag, which must initially be unset. - Whenever a text track that is in a media element's list of text + Whenever a text track that is in a media element's list of text tracks has its text track mode change value, the user agent must run the - following steps for the media element: + following steps for the media element:
        -
      1. If the media element's pending text track change notification +
      2. If the media element's pending text track change notification flag is set, abort these steps.
      3. -
      4. Set the media element's pending text track change notification +
      5. Set the media element's pending text track change notification flag.
      6. @@ -10424,18 +10423,18 @@ zero or more <{track}> elements, then
          -
        1. Unset the media element's pending text track change notification +
        2. Unset the media element's pending text track change notification flag.
        3. Fire a simple event named change at - the media element's textTracks + the media element's textTracks attribute's TextTrackList object.
      7. -
      8. If the media element's show poster flag is not set, run the +
      9. If the media element's show poster flag is not set, run the time marches on steps.
      @@ -10519,8 +10518,8 @@ zero or more <{track}> elements, then The user agent must immediately unset this flag whenever the text track cue is removed from its text track's text track list of cues; whenever the - text track itself is removed from its media element's list of - text tracks or has its text track mode changed to disabled; and whenever the media element's readyState is changed back to HAVE_NOTHING. When the flag is unset in this way for one + text track itself is removed from its media element's list of + text tracks or has its text track mode changed to disabled; and whenever the media element's readyState is changed back to HAVE_NOTHING. When the flag is unset in this way for one or more cues in text tracks that were showing prior to the relevant incident, the user agent must, after having unset the flag for all the affected cues, apply the rules for updating the text track rendering of those text tracks. For example, for text tracks based on WebVTT, the rules for updating @@ -10537,10 +10536,10 @@ zero or more <{track}> elements, then - The text track cues of a media element's + The text track cues of a media element's text tracks are ordered relative to each other in the text track cue order, which is determined as follows: first group the cues by their text track, with the groups being sorted in the same order - as their text tracks appear in the media element's + as their text tracks appear in the media element's list of text tracks; then, within each group, cues must be sorted by their start time, earliest first; then, any cues with the same start time must be sorted by their end time, latest first; and finally, any cues with identical end @@ -10667,13 +10666,13 @@ zero or more <{track}> elements, then -
    5. Add the new text track to the media element's list of text +
    6. Add the new text track to the media element's list of text tracks.
    7. Fire a trusted event with the name addtrack, that does not bubble and is not cancelable, and that uses the TrackEvent interface, with the track attribute initialized to the text track's TextTrack object, at the - media element's textTracks attribute's + media element's textTracks attribute's TextTrackList object.
    @@ -10735,25 +10734,25 @@ zero or more <{track}> elements, then track rendering appropriate for the format in question; for WebVTT, this is the rules for updating the display of WebVTT text tracks. [[WEBVTT]] - When a <{track}> element's parent element changes and the new parent is a media element, then the user agent must add the <{track}> element's corresponding - text track to the media element's list of text tracks, and + When a <{track}> element's parent element changes and the new parent is a media element, then the user agent must add the <{track}> element's corresponding + text track to the media element's list of text tracks, and then queue a task to fire a trusted event with the name addtrack, that does not bubble and is not cancelable, and that uses the TrackEvent interface, with the track attribute initialized to the text track's TextTrack object, at the - media element's textTracks attribute's + media element's textTracks attribute's TextTrackList object. - When a <{track}> element's parent element changes and the old parent was a media element, then the user agent must remove the <{track}> element's corresponding - text track from the media element's list of text tracks, + When a <{track}> element's parent element changes and the old parent was a media element, then the user agent must remove the <{track}> element's corresponding + text track from the media element's list of text tracks, and then queue a task to fire a trusted event with the name removetrack, that does not bubble and is not cancelable, and that uses the TrackEvent interface, with the track attribute initialized to the text track's - TextTrack object, at the media element's textTracks attribute's TextTrackList object. + TextTrack object, at the media element's textTracks attribute's TextTrackList object.
    When a text track corresponding to a <{track}> element is added to a - media element's list of text tracks, the user agent must queue a - task to run the following steps for the media element: + media element's list of text tracks, the user agent must queue a + task to run the following steps for the media element:
      @@ -10768,7 +10767,7 @@ zero or more <{track}> elements, then
    When the user agent is required to honor user preferences for automatic text track - selection for a media element, the user agent must run the following steps: + selection for a media element, the user agent must run the following steps:
      @@ -10778,7 +10777,7 @@ zero or more <{track}> elements, then
    1. Perform automatic text track selection for chapters.
    2. -
    3. If there are any text tracks in the media element's list of text tracks whose text track kind is metadata that correspond to track +
    4. If there are any text tracks in the media element's list of text tracks whose text track kind is metadata that correspond to track elements with a default attribute set whose text track mode is set to disabled, then set the text track mode of all such tracks to hidden
    5. @@ -10793,7 +10792,7 @@ zero or more <{track}> elements, then
        -
      1. Let candidates be a list consisting of the text tracks in the media element's list of text tracks +
      2. Let candidates be a list consisting of the text tracks in the media element's list of text tracks whose text track kind is one of the kinds that were passed to the algorithm, if any, in the order given in the list of text tracks.
      3. @@ -10832,7 +10831,7 @@ zero or more <{track}> elements, then
      4. The text track has its text track mode changed.
      5. -
      6. The <{track}> element's parent element changes and the new parent is a media element.
      7. +
      8. The <{track}> element's parent element changes and the new parent is a media element.
      9. @@ -10851,7 +10850,7 @@ zero or more <{track}> elements, then
      10. If the text track's text track mode is not set to one of hidden or showing, abort these steps.
      11. -
      12. If the text track's <{track}> element does not have a media element as a parent, abort these steps.
      13. +
      14. If the text track's <{track}> element does not have a media element as a parent, abort these steps.
      15. Run the remainder of these steps in parallel, allowing whatever caused these steps to run to continue.
      16. @@ -10865,9 +10864,9 @@ zero or more <{track}> elements, then
      17. ⌛ Let URL be the track URL of the <{track}> element.
      18. -
      19. ⌛ If the <{track}> element's parent is a media element then - let corsAttributeState be the state of the parent media element's crossorigin content attribute. Otherwise, let - corsAttributeState be No CORS.
      20. +
      21. ⌛ If the <{track}> element's parent is a media element then + let corsAttributeState be the state of the parent media element's crossorigin content attribute. Otherwise, let + corsAttributeState be No CORS.
      22. End the synchronous section, continuing the remaining steps in parallel.
      23. @@ -11024,12 +11023,12 @@ zero or more <{track}> elements, then
        media . textTracks . length
        - Returns the number of text tracks associated with the media element (e.g., from <{track}> elements). This is the number of text tracks in the media element's list of text tracks. + Returns the number of text tracks associated with the media element (e.g., from <{track}> elements). This is the number of text tracks in the media element's list of text tracks.
        media . textTracks[ n ]
        - Returns the TextTrack object representing the nth text track in the media element's list of text tracks. + Returns the TextTrack object representing the nth text track in the media element's list of text tracks.
        textTrack = media . textTracks . getTrackById( id )
        @@ -11046,9 +11045,9 @@ zero or more <{track}> elements, then A TextTrackList object represents a dynamically updating list of text tracks in a given order. - The textTracks attribute of media elements must return a TextTrackList object + The textTracks attribute of media elements must return a TextTrackList object representing the TextTrack objects of the text tracks - in the media element's list of text tracks, in the same order as in the + in the media element's list of text tracks, in the same order as in the list of text tracks. The length attribute of a @@ -11105,7 +11104,7 @@ zero or more <{track}> elements, then
        Creates and returns a new TextTrack object, which is also added to the - media element's list of text tracks. + media element's list of text tracks.
        @@ -11203,7 +11202,7 @@ zero or more <{track}> elements, then
        - The addTextTrack(kind, label, language) method of media elements, when invoked, must run the following steps: + The addTextTrack(kind, label, language) method of media elements, when invoked, must run the following steps:
          @@ -11229,7 +11228,7 @@ zero or more <{track}> elements, then
        1. - Add the new text track to the media element's list of text + Add the new text track to the media element's list of text tracks.
        2. @@ -11238,7 +11237,7 @@ zero or more <{track}> elements, then Queue a task to fire a trusted event with the name addtrack, that does not bubble and is not cancelable, and that uses the TrackEvent interface, with the track attribute initialized to the new text - track's TextTrack object, at the media element's textTracks attribute's TextTrackList + track's TextTrack object, at the media element's textTracks attribute's TextTrackList object. @@ -11551,7 +11550,7 @@ window.onbeforeunload = function () { cue start time must be set to the new value, interpreted in seconds; then, if the TextTrackCue object's text track cue is in a text track's list of cues, and that text track is in - a media element's list of text tracks, and the media element's show poster flag is not set, then run the time marches on steps for that media element. + a media element's list of text tracks, and the media element's show poster flag is not set, then run the time marches on steps for that media element. The endTime attribute, on getting, must return the text track cue end time of the text track cue that the @@ -11559,7 +11558,7 @@ window.onbeforeunload = function () { time must be set to the new value, interpreted in seconds; then, if the TextTrackCue object's text track cue is in a text track's list of cues, and that text track is in - a media element's list of text tracks, and the media element's show poster flag is not set, then run the time marches on steps for that media element. + a media element's list of text tracks, and the media element's show poster flag is not set, then run the time marches on steps for that media element. The pauseOnExit attribute, on getting, must return true if the text track cue pause-on-exit flag of the text @@ -11863,31 +11862,31 @@ red:89
          If the attribute is present, or if scripting is - disabled for the media element, then the user agent should expose a user interface to the user. This user interface should include features to begin playback, pause + disabled for the media element, then the user agent should expose a user interface to the user. This user interface should include features to begin playback, pause playback, seek to an arbitrary position in the content (if the content supports arbitrary seeking), change the volume, change the display of closed captions or embedded sign-language tracks, select different audio tracks or turn on audio descriptions, and show the media content in manners more suitable to the user (e.g., full-screen video or in an independent resizable window). Other controls may also be made available. - If the media element has a current media controller, then the user + If the media element has a current media controller, then the user agent should expose audio tracks from all the slaved media elements (although avoiding duplicates if the same media resource is being used several times). If a media resource's audio track exposed in this way has no known name, and it is the - only audio track for a particular media element, the user agent should use the + only audio track for a particular media element, the user agent should use the element's title attribute, if any, as the name (or as part of the name) of that track. Even when the attribute is absent, however, user agents may provide controls to affect playback of the media resource (e.g., play, pause, seeking, track selection, and volume controls), but such features should not interfere with the page's normal rendering. For example, such features - could be exposed in the media element's context menu, platform + could be exposed in the media element's context menu, platform media keys, or a remote control. The user agent may implement this simply by exposing a user interface to the user as described above (as if the <{mediaelements/controls}> attribute was present). If the user agent exposes a user interface to - the user by displaying controls over the media element, then the user agent + the user by displaying controls over the media element, then the user agent should suppress any user interaction events while the user agent is interacting with this interface. (For example, if the user clicks on a video's playback control, mousedown events and so forth would not simultaneously be fired at elements on the page.) @@ -11898,40 +11897,40 @@ red:89 interface features exposed by the user agent must be implemented in terms of the DOM API described above, so that, e.g., all the same events fire. - When a media element has a current media controller, the user agent's + When a media element has a current media controller, the user agent's user interface for pausing and unpausing playback, for seeking, for changing the rate of playback, for fast-forwarding or rewinding, and for muting or changing the volume of audio of the entire group must be implemented in terms of the MediaController API exposed on that - current media controller. When a media element has a current media + current media controller. When a media element has a current media controller, and all the slaved media elements of that MediaController are paused, the user agent should also unpause all the slaved media elements when the user invokes a user agent interface control for beginning playback. The "play" function in the user agent's interface must set the playbackRate attribute to the value of the defaultPlaybackRate attribute before invoking the play() - method. When a media element has a current media controller, the + method. When a media element has a current media controller, the attributes and method with those names on that MediaController object must be used. - Otherwise, the attributes and method with those names on the media element itself + Otherwise, the attributes and method with those names on the media element itself must be used. Features such as fast-forward or rewind must be implemented by only changing the playbackRate attribute (and not the defaultPlaybackRate - attribute). Again, when a media element has a current media controller, + attribute). Again, when a media element has a current media controller, the attributes with those names on that MediaController object must be used; - otherwise, the attributes with those names on the media element itself must be used. + otherwise, the attributes with those names on the media element itself must be used. - When a media element has a current media controller, seeking must be + When a media element has a current media controller, seeking must be implemented in terms of the currentTime attribute on that MediaController object. Otherwise, the user agent must directly - seek to the requested position in the media element's media timeline. For media resources where seeking to an arbitrary + seek to the requested position in the media element's media timeline. For media resources where seeking to an arbitrary position would be slow, user agents are encouraged to use the approximate-for-speed flag when seeking in response to the user manipulating an approximate position interface such as a seek bar. - When a media element has a current media controller, user agents may - additionally provide the user with controls that directly manipulate an individual media element without affecting the MediaController, but such features are + When a media element has a current media controller, user agents may + additionally provide the user with controls that directly manipulate an individual media element without affecting the MediaController, but such features are considered relatively advanced and unlikely to be useful to most users. - For the purposes of listing chapters in the media resource, only text tracks in the media element's list of text tracks + For the purposes of listing chapters in the media resource, only text tracks in the media element's list of text tracks that are showing and whose text track kind is chapters should be used. Such tracks must be interpreted according to the rules for constructing the chapter tree from a text @@ -11976,30 +11975,30 @@ red:89
          - A media element has a playback volume, which is a fraction in the range 0.0 (silent) to 1.0 (loudest). + A media element has a playback volume, which is a fraction in the range 0.0 (silent) to 1.0 (loudest). Initially, the volume should be 1.0, but user agents may remember the last set value across sessions, on a per-site basis or otherwise, so the volume may start at other values. The volume IDL attribute must return the playback volume of any audio portions of the - media element. On setting, if the new value is in the range 0.0 to 1.0 inclusive, the - media element's playback volume must be + media element. On setting, if the new value is in the range 0.0 to 1.0 inclusive, the + media element's playback volume must be set to the new value. If the new value is outside the range 0.0 to 1.0 inclusive, then, on setting, an IndexSizeError exception must be thrown instead. - A media element can also be muted. If + A media element can also be muted. If anything is muting the element, then it is muted. (For example, when the direction of playback is backwards, the element is muted.) The muted IDL attribute must return the value - to which it was last set. When a media element is created, if the element has a muted content attribute specified, then the muted IDL attribute should be set to true; otherwise, the user + to which it was last set. When a media element is created, if the element has a muted content attribute specified, then the muted IDL attribute should be set to true; otherwise, the user agents may set the value to the user's preferred value (e.g., remembering the last set value across sessions, on a per-site basis or otherwise). While the muted - IDL attribute is set to true, the media element must be muted. + IDL attribute is set to true, the media element must be muted. Whenever either of the values that would be returned by the volume and muted IDL attributes change, the user agent must queue a task to fire a simple - event named volumechange at the media element. + event named volumechange at the media element. An element's effective media volume is determined as follows: @@ -12017,7 +12016,7 @@ red:89 element's effective media volume is zero. Abort these steps.
        3. Let volume be the playback - volume of the audio portions of the media element, in range 0.0 (silent) to + volume of the audio portions of the media element, in range 0.0 (silent) to 1.0 (loudest).
        4. If the element has a current media controller, multiply volume by that MediaController object's media controller @@ -12034,7 +12033,7 @@ red:89
        5. - The muted content attribute on media elements is a boolean attribute that controls the + The muted content attribute on media elements is a boolean attribute that controls the default state of the audio output of the media resource, potentially overriding user preferences. @@ -12136,7 +12135,7 @@ red:89 (adjacent ranges are folded into one bigger range). A range can be empty (referencing just a single moment in time), e.g., to indicate that only one frame is currently buffered in the case that the user agent has discarded the entire media resource except for the current - frame, when a media element is paused. + frame, when a media element is paused. Ranges in a TimeRanges object must be inclusive. @@ -12145,7 +12144,7 @@ red:89 zero would have a start equal to zero and an end equal to the duration of the timeline.

          The timelines used by the objects returned by the buffered, seekable and - played IDL attributes of media elements must be that element's media timeline. + played IDL attributes of media elements must be that element's media timeline.
          @@ -12187,7 +12186,7 @@ red:89 This section is non-normative. - The following events fire on media elements as part of the + The following events fire on media elements as part of the processing model described above: @@ -12256,7 +12255,7 @@ red:89 @@ -12808,7 +12807,7 @@ red:89 Playing audio and video resources on small devices such as set-top boxes or mobile phones is often constrained by limited hardware resources in the device. For example, a device might only support three simultaneous videos. For this reason, it is a good practice to release resources - held by media elements when they are done playing, either by + held by media elements when they are done playing, either by being very careful about removing all references to the element and allowing it to be garbage collected, or, even better, by removing the element's src attribute and any <{source}> element descendants, and invoking the element's load() method. @@ -12822,7 +12821,7 @@ red:89 This section is non-normative. - How accurately various aspects of the media element API are implemented is + How accurately various aspects of the media element API are implemented is considered a quality-of-implementation issue. For example, when implementing the buffered attribute, @@ -12830,7 +12829,7 @@ red:89 the user agent inspects the data. Since the API reports ranges as times, but the data is obtained in byte streams, a user agent receiving a variable-bit-rate stream might only be able to determine precise times by actually decoding all of the data. User agents aren't required to do this, - however; they can instead return estimates (e.g., based on the average bit rate seen so far) which + however; they can instead return estimates (e.g., based on the average bitrate seen so far) which get revised as more information becomes available. As a general rule, user agents are urged to be conservative rather than optimistic. For @@ -12858,9 +12857,9 @@ red:89
          - When a media element that is paused is removed from a document and not reinserted before the next time the event loop reaches step 1, implementations that are resource constrained are encouraged to take + When a media element that is paused is removed from a document and not reinserted before the next time the event loop reaches step 1, implementations that are resource constrained are encouraged to take that opportunity to release all hardware resources (like video planes, networking resources, and - data buffers) used by the media element. (User agents still have to keep track of the + data buffers) used by the media element. (User agents still have to keep track of the playback position and so forth, though, in case playback is later restarted.) diff --git a/sections/semantics-forms.include b/sections/semantics-forms.include index 27843f2c26..a85dcb35ba 100644 --- a/sections/semantics-forms.include +++ b/sections/semantics-forms.include @@ -5867,12 +5867,12 @@ input { height: 75px; width: 49px; background: #D5CCBB; color: black; } then unless the user agent cannot support images, or its support for images has been disabled, or the user agent only fetches images on demand, or the <{input/src}> - attribute's value is the empty string, the user agent must resolve the value of the <{input/src}> + attribute's value is the empty string, the user agent must parse the value of the <{input/src}> attribute value, relative to the element, and if that is successful, run these substeps:
          1. Let request be a new request whose - URL is the resulting parsed URL, + URL is the resulting URL string, client is the element's node document's Window object's environment settings object, type is "image", destination is "subresource", omit-Origin-header flag is set, credentials mode is "include", and whose use-URL-credentials flag is set.
          2. @@ -6754,7 +6754,8 @@ You cannot submit this form when the field is incorrect. attribute as described below. The <{input/step}> attribute, if specified, must either have a - value that is a valid floating-point number that parses to a number that is greater than zero, or must have a + value that is a valid floating-point number that parses to a number + that is greater than zero, or must have a value that is an ASCII case-insensitive match for the string "any".
            @@ -10913,9 +10914,9 @@ out of 233 257 824 bytes available</meter></p> The invalid value default for these attributes is the GET state. The missing value default for the <{form/method}> attribute is also the GET state. (There is no missing value default for the <{submitbuttonelements/formmethod}> attribute.) - The method of an element is one of those states. If the element is a - submit button and has a <{submitbuttonelements/formmethod}> - attribute, then the element's method is that attribute's state; otherwise, it + The method of an element is one of those states. If the element is a + submit button and has a <{submitbuttonelements/formmethod}> + attribute, then the element's method is that attribute's state; otherwise, it is the form owner's <{form/method}> attribute's state.
            @@ -14048,15 +14049,15 @@ fur -
          3. Resolve the URL action, relative to the submitter element. If this fails, +
          4. Parse the URL action, relative to the submitter element. If this fails, abort these steps.
          5. -
          6. Let action be the resulting absolute URL.
          7. +
          8. Let action be the resulting URL string.
          9. -
          10. Let action components be the resulting parsed URL.
          11. +
          12. Let action components be the resulting URL record.
          13. -
          14. Let scheme be the scheme of - the resulting parsed URL.
          15. +
          16. Let scheme be the scheme of + the resulting URL record.
          17. Let enctype be the submitter element's enctype.
          18. @@ -14173,7 +14174,7 @@ fur application/x-www-form-urlencoded encoding algorithm, interpreted as a US-ASCII string. - Set parsed action's query component to query. + Set parsed action's query component to query. Let destination be a new URL formed by applying the URL serializer algorithm to parsed action. @@ -14200,8 +14201,8 @@ fur :: Let MIME type be "text/plain". Otherwise, plan to navigate to a new request whose URL is - action, method is method, header list - consists of Content-Type/MIME type, and body is + action, method is method, header list + consists of Content-Type/MIME type, and body is entity body. : Get action URL diff --git a/sections/semantics-interactive-elements.include b/sections/semantics-interactive-elements.include index 82e8631a89..394fc9ebcc 100644 --- a/sections/semantics-interactive-elements.include +++ b/sections/semantics-interactive-elements.include @@ -514,7 +514,7 @@ valid non-empty URL potentially surrounded by spaces. To obtain the absolute URL of the icon when the attribute's value is not the empty string, the attribute's value must be resolved relative to the element. - When the attribute is absent, or its value is the empty string, or resolving its value fails, there is no icon. + When the attribute is absent, or its value is the empty string, or parsing its value fails, there is no icon. The disabled attribute is a boolean attribute that, if present, indicates that the command is not available in @@ -1154,7 +1154,7 @@ -
            dialog . returnValue [ = result ]
            +
            dialog . {{HTMLDialogElement/returnValue}} [ = result ]
            @@ -1284,7 +1284,7 @@
          19. Remove subject's open attribute.
          20. -
          21. If the argument result was provided, then set the returnValue attribute to the value of result.
          22. +
          23. If the argument result was provided, then set the {{HTMLDialogElement/returnValue}} attribute to the value of result.
          24. diff --git a/sections/semantics-links.include b/sections/semantics-links.include index e93d8b5043..e4e122f63f 100644 --- a/sections/semantics-links.include +++ b/sections/semantics-links.include @@ -213,9 +213,9 @@

            An element implementing the HTMLHyperlinkElementUtils mixin has an associated url (null or a URL). It is initially null.

            An element implementing the HTMLHyperlinkElementUtils mixin has an associated set the url algorithm, which sets this - element's URL to the resulting parsed URL - of resolving this element's href content attribute value relative to this element. If - resolving was aborted with an error, set this element's URL to null.

            + element's URL to the resulting URL string + of parsing this element's href content attribute value relative to this element. If + parsing was aborted with an error, set this element's URL to null.

            When elements implementing the HTMLHyperlinkElementUtils mixin are created, and whenever those elements have their href content @@ -281,7 +281,7 @@

          25. If this element's URL is null, return ":".
          26. -
          27. Return this element's URL's scheme, followed by ":".
          28. +
          29. Return this element's URL's scheme, followed by ":".

          The protocol attribute's setter must run these @@ -369,10 +369,10 @@

        6. If url or url's host is null, return the empty string.
        7. -
        8. If url's port is null, return +
        9. If url's port is null, return url's host, serialized.
        10. -
        11. Return url's host, serialized, followed by ":" and url's port, serialized.
        12. +
        13. Return url's host, serialized, followed by ":" and url's port, serialized.
        14. The host attribute's setter must run these steps:

          @@ -432,10 +432,10 @@
        15. Let url be this element's URL.
        16. -
        17. If url or url's port is null, +
        18. If url or url's port is null, return the empty string.
        19. -
        20. Return url's port, serialized.
        21. +
        22. Return url's port, serialized.
        23. The port attribute's setter must run these steps:

          @@ -446,7 +446,7 @@
        24. Let url be this element's URL.
        25. If url or url's host is null, - url's non-relative flag is set, or url's scheme is "file", terminate these + url's non-relative flag is set, or url's scheme is "file", terminate these steps.
        26. Basic URL parse the given value, with @@ -502,10 +502,10 @@
        27. Let url be this element's URL.
        28. -
        29. If url is null, or url's query is either null or the empty string, return the empty +
        30. If url is null, or url's query is either null or the empty string, return the empty string.
        31. -
        32. Return "?", followed by url's query.
        33. +
        34. Return "?", followed by url's query.
        35. The search attribute's setter must run these @@ -518,7 +518,7 @@

        36. If url is null, terminate these steps.
        37. -
        38. If the given value is the empty string, set url's query to null. +
        39. If the given value is the empty string, set url's query to null.
        40. Otherwise, run these substeps:

          @@ -527,7 +527,7 @@
        41. Let input be the given value with a single leading "?" removed, if any.
        42. -
        43. Set url's query to the empty +
        44. Set url's query to the empty string.
        45. Basic URL parse input, with @@ -548,10 +548,10 @@
        46. Let url be this element's URL.
        47. -
        48. If url is null, or url's fragment is either null or the empty string, return the +
        49. If url is null, or url's fragment is either null or the empty string, return the empty string.
        50. -
        51. Return "#", followed by url's fragment.
        52. +
        53. Return "#", followed by url's fragment.
        54. The hash attribute's setter must run these steps:

          @@ -561,10 +561,10 @@
        55. Let url be this element's URL.
        56. -
        57. If url is null or url's scheme is "javascript", terminate these +
        58. If url is null or url's scheme is "javascript", terminate these steps.
        59. -
        60. If the given value is the empty string, set url's fragment to null. +
        61. If the given value is the empty string, set url's fragment to null.
        62. Otherwise, run these substeps:

          @@ -573,7 +573,7 @@
        63. Let input be the given value with a single leading "#" removed, if any.
        64. -
        65. Set url's fragment to the empty +
        66. Set url's fragment to the empty string.
        67. Basic URL parse input, with @@ -629,16 +629,15 @@
        68. -
        69. Resolve the URL given by +
        70. Parse the URL given by subject's <{links/href}> attribute, relative to - subject.
        71. + subject's node document.
        72. - If that is successful, let URL be the resulting absolute - URL. + If that is successful, let URL be the resulting URL string. - Otherwise, if resolving the URL failed, the + Otherwise, if parsing the URL failed, the user agent may report the error to the user in a user-agent-specific manner, may queue a task to navigate the target browsing context to an error page to report the error, or may ignore the error and @@ -688,16 +687,16 @@
            -
          1. Resolve the URL given by +
          2. Parse the URL given by subject's <{links/href}> attribute, relative to subject.
          3. -
          4. If resolving the URL fails, the user agent +
          5. If parsing the URL fails, the user agent may report the error to the user in a user-agent-specific manner, may navigate to an error page to report the error, or may ignore the error and do nothing. In either case, the user agent must abort these steps. -
          6. Otherwise, let URL be the resulting absolute URL.
          7. +
          8. Otherwise, let URL be the resulting URL string.
          9. If there is a hyperlink suffix, append it to URL.
          10. @@ -734,7 +733,7 @@ navigate action resulting in the download was initiated, if any.
          11. Let resource origin be the origin of the URL of the - resource being downloaded, unless that URL's scheme + resource being downloaded, unless that URL's scheme component is data, in which case let resource origin be the same as the interface origin, if any.
          12. @@ -1515,7 +1514,7 @@ :: text/css : location - :: The resulting absolute URL determined during the obtain algorithm. + :: The resulting URL string determined during the obtain algorithm.

            This is before any redirects get applied.

            : owner node @@ -1682,8 +1681,7 @@ The actual value being defined. The value should not be confusingly similar to any other defined value (e.g., differing only in case). - If the value contains a U+003A COLON character (:), it must also be an absolute - URL. + If the value contains a U+003A COLON character (:), it must also be an absolute URL. diff --git a/sections/semantics-root.include b/sections/semantics-root.include index c233a75707..7a2531e23f 100644 --- a/sections/semantics-root.include +++ b/sections/semantics-root.include @@ -53,7 +53,7 @@

            For the purposes of application cache selection, later <{base}> elements cannot - affect the resolving of relative URLs in manifest attributes, as the + affect the parsing of relative URLs in manifest attributes, as the attributes are processed before those elements are seen.

            diff --git a/sections/semantics-scriptings.include b/sections/semantics-scriptings.include index 7505c3e65c..51e565d34a 100644 --- a/sections/semantics-scriptings.include +++ b/sections/semantics-scriptings.include @@ -89,7 +89,7 @@ giving a JavaScript MIME type. * Setting the attribute to an ASCII case-insensitive match for the string "`module`" means that the script is a module script, to be interpreted - according to the JavaScript Module top-level production. Module scripts are + according to the JavaScript Module top-level production. Module scripts are not affected by the <{script/charset}> and <{script/defer}> attributes. * Setting the attribute to any other value means that the script is a data block, which is not processed. None of the @@ -106,11 +106,11 @@ Classic scripts and module scripts may either be embedded inline or may be imported from an external file using the src attribute, - which if specified gives the URL of the external script resource to use. If <{script/src}> + which if specified gives the URL of the external script resource to use. If <{script/src}> is specified, it must be a valid non-empty URL potentially surrounded by spaces. The contents of inline <{script}> elements, or the external script resource, must conform with the requirements of the JavaScript specification's Script or - Module productions, for classic scripts and module scripts + Module productions, for classic scripts and module scripts respectively. [[ECMA-262]] When used to include data blocks, the data must be embedded inline, the format of the data @@ -153,7 +153,7 @@ This is all summarized in the following schematic diagram: - With <script>, parsing is interrupted by fetching and execution. With <script defer>, fetching is parallel to parsing and execution takes place after all parsing has finished. And with <script async>, fetching is parallel to parsing but once it finishes parsing is interrupted to execute the script. The story for <script type= is similar to <script defer>, but the dependencies will be fetched as well, and the story for <script type="module" async> is similar to <script async> with the extra dependency fetching." /> + With <script>, parsing is interrupted by fetching and execution. With <script defer>, fetching is parallel to parsing and execution takes place after all parsing has finished. And with <script async>, fetching is parallel to parsing but once it finishes parsing is interrupted to execute the script. The story for <script type="module"> is similar to <script defer>, but the dependencies will be fetched as well, and the story for <script type="module" async> is similar to <script async> with the extra dependency fetching.

            The exact processing details for these attributes are, for mostly historical @@ -384,7 +384,7 @@ o............A....e the script is ready. When a <{script}> element that is not marked as being "parser-inserted" experiences one of - the events listed in the following list, the user agent must immediately prepare the + the events listed in the following list, the user agent must immediately prepare the <{script}> element: * The <{script}> element gets inserted into a document, at the time the node @@ -396,7 +396,8 @@ o............A....e * The <{script}> element is in a Document and has a src attribute set where previously the element had no such attribute. - To prepare a script, the user agent must act as follows: + To prepare a script, the user agent must act + as follows: 1. If the <{script}> element is marked as having "already started", then the user agent must abort these steps at this point. The script is not executed. @@ -416,8 +417,8 @@ o............A....e 4. If the element has no <{script/src}> attribute, and its child nodes, if any, consist only of comment nodes and empty {{Text}} nodes, then abort these steps at this point. The script is not executed. - 5. If the element is not in a `Document`, then the user agent must abort these steps at - this point. The script is not executed. + 5. If the element is not in a Document, then the user agent must abort these + steps at this point. The script is not executed. 6. If either: * the <{script}> element has a <{script/type}> attribute and its value is the empty string, or @@ -426,7 +427,8 @@ o............A....e * the <{script}> element has neither a <{script/type}> attribute nor a <{script/language}> attribute, then - ...let the script block's type for this <{script}> element be "<`text/javascript`". + ...let the script block's type string for this <{script}> element be + "`text/javascript`". Otherwise, if the <{script}> element has a <{script/type}> attribute, let the script block's type string for this <{script}> element be the value of that @@ -488,7 +490,7 @@ o............A....e 14. Let CORS setting be the current state of the element's <{script/crossorigin}> content attribute. 15. If the <{script}> element has a <{script/nonce}> attribute, then let - crytographic nonce be that attribute's value. + cryptographic nonce be that attribute's value. Otherwise, let cryptographic nonce be the empty string. 16. Let parser state be "`parser-inserted`" if the <{script}> element has been flagged @@ -501,7 +503,7 @@ o............A....e 2. If src is the empty string, queue a task to fire a simple event named error at the element, and abort these steps. 3. Set the element's from an external file flag. - 4. Resolve src relative to the element's node document. + 4. Parse src relative to the element's node document. 5. If the previous step failed, queue a task to fire a simple event named error at the element, and abort these steps. @@ -518,13 +520,13 @@ o............A....e 1. Let credentials mode be determined by switching on CORS setting:

            -
            No CORS
            +
            No CORS
            `"omit"`
            -
            Anonymous
            +
            Anonymous
            `"same-origin"`
            -
            Use Credentials
            +
            Use Credentials
            `"include"`
            2. Fetch a module script tree given url, @@ -790,7 +792,7 @@ o............A....e node document's {{Document/currentScript}} object was most recently set. 5. Switch on the script's type:
            -
            `classic`
            +
            `"classic"`
            1. Set the <{script}> element's node document's {{Document/currentScript}} attribute to the <{script}> element. @@ -801,17 +803,17 @@ o............A....e 2. Run the classic script given by the script's script.
            -
            `module`
            +
            `"module"`
            1. Set the <{script}> element's node document's {{Document/currentScript}} attribute to null. 2. Run the module script given by the script's script.
            - 6. Set the <{script}> element's node document's {{Document/currentScript}} object to + 6. Set the <{script}> element's node document's {{Document/currentScript}} object to old script element. - 7. Decrement the ignore-destructive-writes counter of neutralized doc, if it was + 7. Decrement the ignore-destructive-writes counter of neutralized doc, if it was incremented in the earlier step. - 8. If the script's type is "`classic`" and the script is from an external file, + 8. If the script's type is "`classic`" and the script is from an external file, fire a simple event named `load` at the <{script}> element. Otherwise queue a task to fire a simple event named `load` at the <{script}> @@ -843,12 +845,12 @@ o............A....e User agents must recognize all JavaScript MIME types. - User agents may support other MIME types for other languages, but must not support other + User agents may support other MIME types for other languages, but must not support other MIME types for the languages in the list above. User agents are not required to support JavaScript. The processing model for languages other than JavaScript is outside the scope of this specification. - The following MIME types (with or without parameters) must not be interpreted as scripting + The following MIME types (with or without parameters) must not be interpreted as scripting languages: * `text/plain` @@ -863,20 +865,20 @@ o............A....e When examining types to determine if they represent supported languages, user agents must not ignore MIME parameters. Types are to be compared including all parameters. -

            For example, types that include the charset parameter will not be +

            For example, types that include the charset parameter will not be recognized as referencing any of the scripting languages listed above.

            Restrictions for contents of <{script}> elements

            The easiest and safest way to avoid the rather strange restrictions described in - this section is to always escape "`<!--`" as "`<\!--`", "`<script`" as "`<\script`", - and "`</script`" as "`<\/script`" when these sequences appear in literals in scripts (e.g., - in strings, regular expressions, or comments), and to avoid writing code that uses such constructs + this section is to always escape "`<!--`" as "`<\!--`", "`<script`" as "`<\script`", + and "`</script`" as "`<\/script`" when these sequences appear in literals in scripts (e.g., + in strings, regular expressions, or comments), and to avoid writing code that uses such constructs in expressions. Doing so avoids the pitfalls that the restrictions in this section are prone to - triggering: namely, that, for historical reasons, parsing of <{script}> blocks in HTML is a + triggering: namely, that, for historical reasons, parsing of <{script}> blocks in HTML is a strange and exotic practice that acts unintuitively in the face of these sequences.

            - The {{Node/textContent}} of a <{script}> element must match the script production in + The {{Node/textContent}} of a <{script}> element must match the script production in the following ABNF, the character set for which is Unicode. [[!ABNF]]
            @@ -912,7 +914,7 @@ o............A....e
                 tag-end       =/ %x003E ; U+003E GREATER-THAN SIGN (>)
               
            - When a <{script}> element contains script documentation, there are further restrictions on + When a <{script}> element contains script documentation, there are further restrictions on the contents of the element, as described in the section below.
            @@ -936,9 +938,9 @@ o............A....e The bigger problem, though, and the reason why it would violate those restrictions, is that actually the script would get parsed weirdly: the script block above is not terminated. - That is, what looks like a "`</script>`" end tag in this snippet is actually still part of - the <{script}> block. The script doesn't execute (since it's not terminated); if it somehow were - to execute, as it might if the markup looked as follows, it would fail because the script is not + That is, what looks like a "`</script>`" end tag in this snippet is actually still part of + the <{script}> block. The script doesn't execute (since it's not terminated); if it somehow were + to execute, as it might if the markup looked as follows, it would fail because the script is not valid JavaScript:
            @@ -952,8 +954,8 @@ o............A....e
                   </script>
                 
            - What is going on here is that for legacy reasons, "`<!--`" and "`<script`" strings in - <{script}> elements in HTML need to be balanced in order for the parser to consider closing the + What is going on here is that for legacy reasons, "`<!--`" and "`<script`" strings in + <{script}> elements in HTML need to be balanced in order for the parser to consider closing the block. By escaping the problematic strings as mentioned at the top of this section, the problem is @@ -990,16 +992,16 @@ o............A....e Doing this also avoids a different pitfall as well: for related historical reasons, the string - "`<!--`" in classic scripts is actually treated as a line comment start, just like + "`<!--`" in classic scripts is actually treated as a line comment start, just like "`//`".
            Inline documentation for external scripts
            - If a <{script}> element's <{script/src}> attribute is specified, then the contents of the - <{script}> element, if any, must be such that the value of the {{HTMLScriptElement/text}} IDL - attribute, which is derived from the element's contents, matches the `documentation` production in + If a <{script}> element's <{script/src}> attribute is specified, then the contents of the + <{script}> element, if any, must be such that the value of the {{HTMLScriptElement/text}} IDL + attribute, which is derived from the element's contents, matches the `documentation` production in the following ABNF, the character set for which is Unicode. [[!ABNF]]
            @@ -1054,22 +1056,22 @@ o............A....e
               However, in the absence of another specification actually defining this, here are some guidelines
               for implementors, based on existing implementations:
             
            -  * When an XSLT transformation program is triggered by an `<?xml-stylesheet?>` processing 
            -     instruction and the browser implements a direct-to-DOM transformation, <{script}> elements 
            -     created by the XSLT processor need to be marked "parser-inserted" and run in document 
            -     order (modulo scripts marked <{script/defer}> or <{script/async}>), immediately, as the 
            +  * When an XSLT transformation program is triggered by an `<?xml-stylesheet?>` processing
            +     instruction and the browser implements a direct-to-DOM transformation, <{script}> elements
            +     created by the XSLT processor need to be marked "parser-inserted" and run in document
            +     order (modulo scripts marked <{script/defer}> or <{script/async}>), immediately, as the
                  transformation is occurring.
            -  * The XSLTProcessor.transformToDocument() method adds elements to a {{Document}} that 
            -     is not in a browsing context, and, accordingly, any <{script}> elements they create need 
            -     to have their "already started" flag set in the prepare a script algorithm and 
            -     never get executed (scripting is disabled). Such <{script}> elements still need to be 
            -     marked "parser-inserted", though, such that their {{HTMLScriptElement/async}} IDL 
            +  * The XSLTProcessor.transformToDocument() method adds elements to a {{Document}} that
            +     is not in a browsing context, and, accordingly, any <{script}> elements they create need
            +     to have their "already started" flag set in the prepare a script algorithm and
            +     never get executed (scripting is disabled). Such <{script}> elements still need to be
            +     marked "parser-inserted", though, such that their {{HTMLScriptElement/async}} IDL
                  attribute will return false in the absence of an <{script/async}> content attribute.
            -  * The XSLTProcessor.transformToFragment() method needs to create a fragment that is 
            -     equivalent to one built manually by creating the elements using 
            -     {{Document/createElementNS()|document.createElementNS()}}. For instance, it needs to create 
            -     <{script}> elements that aren't "parser-inserted" and that don't have their 
            -     "already started" flag set, so that they will execute when the fragment is 
            +  * The XSLTProcessor.transformToFragment() method needs to create a fragment that is
            +     equivalent to one built manually by creating the elements using
            +     {{Document/createElementNS()|document.createElementNS()}}. For instance, it needs to create
            +     <{script}> elements that aren't "parser-inserted" and that don't have their
            +     "already started" flag set, so that they will execute when the fragment is
                  inserted into a document.
             
               The main distinction between the first two cases and the last case is that the first two
            @@ -1101,7 +1103,7 @@ o............A....e
                 
            Uses {{HTMLElement}}.
            - The <{noscript}> element represents nothing if scripting is enabled, and + The <{noscript}> element represents nothing if scripting is enabled, and represents its children if scripting is disabled. It is used to present different markup to user agents that support scripting and those that don't support scripting, by affecting how the document is parsed. @@ -1114,46 +1116,46 @@ o............A....e : In a <{head}> element, if scripting is enabled for the <{noscript}> element :: The <{noscript}> element must contain only text, except that invoking the HTML fragment parsing algorithm with the <{noscript}> element as the context - element and the text contents as the input must result in a list of nodes that - consists only of <{link}>, <{style}>, and <{meta}> elements that would be conforming if they - were children of the <{noscript}> element, and no + element and the text contents as the input must result in a list of nodes that + consists only of <{link}>, <{style}>, and <{meta}> elements that would be conforming if they + were children of the <{noscript}> element, and no parse errors. : Outside of <{head}> elements, if scripting is disabled for the <{noscript}> element - :: The <{noscript}> element's content model is transparent, with the additional restriction - that a <{noscript}> element must not have a <{noscript}> element as an ancestor (that is, + :: The <{noscript}> element's content model is transparent, with the additional restriction + that a <{noscript}> element must not have a <{noscript}> element as an ancestor (that is, <{noscript}> can't be nested). : Outside of <{head}> elements, if scripting is enabled for the <{noscript}> element - :: The <{noscript}> element must contain only text, except that the text must be such that running - the following algorithm results in a conforming document with - no <{noscript}> elements and no <{script}> elements, and such that no step in the algorithm + :: The <{noscript}> element must contain only text, except that the text must be such that running + the following algorithm results in a conforming document with + no <{noscript}> elements and no <{script}> elements, and such that no step in the algorithm throws an exception or causes an HTML parser to flag a parse error: 1. Remove every <{script}> element from the document. - 2. Make a list of every <{noscript}> element in the document. For every <{noscript}> element + 2. Make a list of every <{noscript}> element in the document. For every <{noscript}> element in that list, perform the following steps: - 1. Let s be the concatenation of all the {{Text}} node children of the + 1. Let s be the concatenation of all the {{Text}} node children of the <{noscript}> element. - 2. Set the outerHTML attribute of the <{noscript}> element to the value of - s. (This, as a side-effect, causes the <{noscript}> element to be removed + 2. Set the outerHTML attribute of the <{noscript}> element to the value of + s. (This, as a side-effect, causes the <{noscript}> element to be removed from the document.) [[!DOMPARSING]] -

            All these contortions are required because, for historical reasons, the - <{noscript}> element is handled differently by the HTML parser based on whether +

            All these contortions are required because, for historical reasons, the + <{noscript}> element is handled differently by the HTML parser based on whether scripting was enabled or not when the parser was invoked.

            The <{noscript}> element must not be used in XML documents. -

            The <{noscript}> element is only effective in - the HTML syntax, it has no effect in the XHTML syntax. - This is because the way it works is by essentially "turning off" the parser when scripts are - enabled, so that the contents of the element are treated as pure text and not as real elements. +

            The <{noscript}> element is only effective in + the HTML syntax, it has no effect in the XHTML syntax. + This is because the way it works is by essentially "turning off" the parser when scripts are + enabled, so that the contents of the element are treated as pure text and not as real elements. XML does not define a mechanism by which to do this.

            - The <{noscript}> element has no other requirements. In particular, children of the <{noscript}> - element are not exempt from [[#forms-form-submission]], scripting, and so forth, even when + The <{noscript}> element has no other requirements. In particular, children of the <{noscript}> + element are not exempt from [[#forms-form-submission]], scripting, and so forth, even when scripting is enabled for the element.
            diff --git a/sections/syntax.include b/sections/syntax.include index d6009f4c2a..6ca4a2fe90 100644 --- a/sections/syntax.include +++ b/sections/syntax.include @@ -1042,9 +1042,12 @@
            This specification defines the parsing rules for HTML documents, whether they are syntactically - correct or not. Certain points in the parsing algorithm are said to be parse errors. The error handling for parse errors is well-defined (that's the + correct or not. Certain points in the parsing algorithm are said to be + parse errors. The error handling for + parse errors is well-defined (that's the processing rules described throughout this specification), but user agents, while parsing an HTML - document, may abort the parser at the first parse error that they encounter for which they do not wish to apply the rules described in this + document, may abort the parser at the first parse error that they + encounter for which they do not wish to apply the rules described in this specification. Conformance checkers must report at least one parse error condition to the user if one or more @@ -1053,8 +1056,8 @@ than one parse error condition exists in the document.

            - Parse errors are only errors with the syntax of HTML. In addition to - checking for parse errors, conformance checkers will also verify that the document obeys all the + Parse errors are only errors with the syntax of HTML. In addition to + checking for parse errors, conformance checkers will also verify that the document obeys all the other conformance requirements described in this specification.

            @@ -1926,7 +1929,7 @@ characters U+000B, U+FFFE, U+FFFF, U+1FFFE, U+1FFFF, U+2FFFE, U+2FFFF, U+3FFFE, U+3FFFF, U+4FFFE, U+4FFFF, U+5FFFE, U+5FFFF, U+6FFFE, U+6FFFF, U+7FFFE, U+7FFFF, U+8FFFE, U+8FFFF, U+9FFFE, U+9FFFF, U+AFFFE, U+AFFFF, U+BFFFE, U+BFFFF, U+CFFFE, U+CFFFF, U+DFFFE, U+DFFFF, U+EFFFE, U+EFFFF, U+FFFFE, - U+FFFFF, U+10FFFE, and U+10FFFF are parse errors. These are all + U+FFFFF, U+10FFFE, and U+10FFFF are parse errors. These are all control characters or permanently undefined Unicode characters (noncharacters). Any character that is a not a Unicode character, i.e., any isolated @@ -5295,10 +5298,10 @@
            1. If the newly created element has a manifest - attribute whose value is not the empty string, then resolve the value of that attribute, relative to the newly created element, and + attribute whose value is not the empty string, then parse the value of that attribute, relative to the newly created element, and if that is successful, run the application cache selection algorithm passing the {{Document}} object with the result of applying the URL serializer algorithm to the - resulting parsed URL with the exclude fragment flag set.
            2. + resulting URL string with the exclude fragment flag set.
            3. Otherwise, run the application cache selection algorithm passing the {{Document}} object with no manifest.
            4. diff --git a/sections/webappapis.include b/sections/webappapis.include index bf4e54db6b..f6ce933eda 100644 --- a/sections/webappapis.include +++ b/sections/webappapis.include @@ -92,7 +92,7 @@ An environment settings object specifies algorithms for obtaining the following: - : A realm execution context + : A realm execution context :: A JavaScript execution context shared by all <{script}> elements that use this settings object, i.e. all scripts in a given JavaScript realm. When we run a classic script or run a module script, this execution context becomes the top of the @@ -203,8 +203,8 @@ 8. If response's Content Type metadata, if any, specifies a character encoding, and the user agent supports that encoding, then set character encoding to that encoding (ignoring the passed-in value). - 9. Let source text be the result of decoding response's - body to Unicode, using character encoding as the fallback + 9. Let source text be the result of decoding response's + body to Unicode, using character encoding as the fallback encoding.

              The decode algorithm overrides character encoding if the @@ -272,7 +272,7 @@ The following algorithms are used when fetching a module script tree, and are not meant to be used directly by other specifications (or by other parts of this specification). - To fetch the descendants of a module script module script, given a + To fetch the descendants of a module script module script, given a destination and an ancestor list, run these steps. The algorithm will asynchronously complete with either null (on failure) or with module script (on success). @@ -339,8 +339,8 @@ * response's type is "error" * response's status is not an ok status - * The result of extracting a MIME type from response's - header list (ignoring parameters) is not a + * The result of extracting a MIME type from response's + header list (ignoring parameters) is not a JavaScript MIME type.

              For historical reasons, fetching a classic script does not include @@ -379,8 +379,9 @@ flag. 5. Return script. -To create a module script, given some script source, an environment settings -object, a script base URL, a credentials mode, a cryptographic nonce, and a parser state: +To create a module script, +given some script source, an environment settings object, a script base URL, +a credentials mode, a cryptographic nonce, and a parser state: 1. Let script be a new module script that this algorithm will subsequently initialise. @@ -404,8 +405,8 @@ object, a script base URL, a credentials mode, a cryptographic nonce, and a

              Calling scripts
              - To run a classic script given a - classic script s and an optional rethrow errors flag: + To run a classic script + given a classic script s and an optional rethrow errors flag: 1. Let settings be the settings object of s. 2. Check if we can run script with settings. If this returns "do not run", then @@ -437,7 +438,8 @@ object, a script base URL, a credentials mode, a cryptographic nonce, and a because an error occurred during parsing, or an exception occurred during evaluation, or because it was aborted prematurely. - To run a module script given a module script s: + To run a module script given a + module script s: 1. Let settings be the settings object of s. 2. Check if we can run script with settings. If this returns "do not run" then @@ -999,8 +1001,8 @@ object, a script base URL, a credentials mode, a cryptographic nonce, and a 4. Initialise event's {{PromiseRejectionEvent/reason}} attribute to the value of p's \[[PromiseResult]] internal slot. 5. Dispatch event at settings object's global object. - 6. If the event was canceled, then the promise rejection is handled. Otherwise, the - promise rejection is not handled. + 6. If the event was canceled, then the promise rejection is handled. + Otherwise, the promise rejection is not handled. 7. If p's \[[PromiseIsHandled]] internal slot is false, add p to settings object's outstanding rejected promises weak set. @@ -1538,9 +1540,9 @@ object, a script base URL, a credentials mode, a cryptographic nonce, and a If the return value is null, then cancel the event. - Otherwise, if the {{Event}} object E is a BeforeUnloadEvent object, - and the {{Event}} object E's {{Event/returnValue}} attribute's value is the - empty string, then set the {{Event/returnValue}} attribute's value to + Otherwise, if the {{Event}} object E is a {{BeforeUnloadEvent}} object, + and the {{Event}} object E's {{BeforeUnloadEvent/returnValue}} attribute's value + is the empty string, then set the {{BeforeUnloadEvent/returnValue}} attribute's value to return value. @@ -1577,7 +1579,7 @@ object, a script base URL, a credentials mode, a cryptographic nonce, and a beforeunload events, the value is instead used to determine whether or not to prompt about unloading the document.

              - For historical reasons, the {{Window/onerror}} handler has different arguments: + For historical reasons, the {{GlobalEventHandlers/onerror}} handler has different arguments:
                   [TreatNonObjectAsNull]
              @@ -1585,7 +1587,7 @@ object, a script base URL, a credentials mode, a cryptographic nonce, and a
                   typedef OnErrorEventHandlerNonNull? OnErrorEventHandler;
                 
              - Similarly, the {{Window/onbeforeunload}} handler has a different return value: + Similarly, the {{OnBeforeUnloadEventHandler/onbeforeunload}} handler has a different return value:
                   [TreatNonObjectAsNull]
              @@ -1643,8 +1645,8 @@ object, a script base URL, a credentials mode, a cryptographic nonce, and a
               
                         : ParameterList
                         :: 
              -
              If H is an {{Window/onerror}} event handler of a {{Window}} - object
              +
              If H is an {{GlobalEventHandlers/onerror}} event handler of a + {{Window}} object
              Let the function have five arguments, named event, source, lineno, colno, and error.
              @@ -1934,9 +1936,9 @@ object, a script base URL, a credentials mode, a cryptographic nonce, and a {{MouseEvent/clientX}, {{MouseEvent/clientY}}, and {{MouseEvent/button}} attributes initialized to 0, its {{MouseEvent/ctrlKey}}, {{MouseEvent/shiftKey}}, {{MouseEvent/altKey}}, and {{MouseEvent/metaKey}} attributes initialized according to the current state of the key input - device, if any (false for any keys that are not available), its {{MouseEvent/detail}} attribute + device, if any (false for any keys that are not available), its {{UIEvent/detail}} attribute initialized to 1, its {{MouseEvent/relatedTarget}} attribute initialized to null (except where - otherwise stated), and its {{MouseEvent/view}} attribute initialized to the {{Window}} object of + otherwise stated), and its {{UIEvent/view}} attribute initialized to the {{Window}} object of the {{Document}} object of the given target node, if any, or else null. The {{MouseEvent/getModifierState()}} method on the object must return values appropriately describing the state of the key input device at the time the event is created. @@ -2918,12 +2920,12 @@ object, a script base URL, a credentials mode, a cryptographic nonce, and a

              - Logic that depends on tasks or microtasks, such as media elements + Logic that depends on tasks or microtasks, such as media elements loading their media data, are stalled when these methods are invoked.

              - The alert(message) method, when - invoked, must run the following steps: + The alert(message) + method, when invoked, must run the following steps:
                @@ -3113,7 +3115,7 @@ object, a script base URL, a credentials mode, a cryptographic nonce, and a
              1. - Resolve url relative to the + Parse url relative to the API base URL specified by the entry settings object. If this fails, then throw a SyntaxError exception and abort these steps. @@ -3235,7 +3237,7 @@ object, a script base URL, a credentials mode, a cryptographic nonce, and a
              2. Navigate the new browsing context to - the absolute URL that resulted from resolving + the absolute URL that resulted from parsing url earlier, with replacement enabled, and with the responsible browsing context specified by the incumbent settings object as the source browsing context. @@ -3294,7 +3296,7 @@ object, a script base URL, a credentials mode, a cryptographic nonce, and a
                -
                window . dialogArguments
                +
                window . {{WindowModal/dialogArguments}}
                @@ -3302,7 +3304,7 @@ object, a script base URL, a credentials mode, a cryptographic nonce, and a
                -
                window . returnValue [ = value ]
                +
                window . {{WindowModal/returnValue}} [ = value ]
                @@ -3736,17 +3738,18 @@ object, a script base URL, a credentials mode, a cryptographic nonce, and a argument passed to one of these methods does not contain the exact literal string "%s". - User agents must throw a SyntaxError exception if resolving the url argument relative to the API base - URL specified by the entry settings object is not successful. + User agents must throw a SyntaxError exception if parsing the url + argument relative to the API base URL specified by the entry settings object is + not successful.

                - The resulting absolute URL would by definition not be a valid - URL as it would include the string "%s" which is not a valid + The resulting URL string would by definition not be a valid URL + as it would include the string "%s" which is not a valid component in a URL.

                - User agents must throw a SecurityError exception if the resulting absolute - URL has an origin that differs from the origin specified by the + User agents must throw a SecurityError exception if the resulting + absolute URL has an origin that differs from the origin specified by the entry settings object.

                @@ -3754,13 +3757,13 @@ object, a script base URL, a credentials mode, a cryptographic nonce, and a scheme, host, or port parts of the URL.

                - The resulting absolute URL is the proto-URL. It identifies the + The resulting URL string is the proto-URL. It identifies the handler for the purposes of the methods described below. When the user agent uses this handler, it must replace the first occurrence of the exact literal string "%s" in the url argument with an escaped version of the absolute URL of the content in question (as defined below), - then resolve the resulting URL, relative to the API + then parse the resulting URL, relative to the API base URL specified by the entry settings object at the time the registerContentHandler() or registerProtocolHandler() methods were invoked, and then navigate an appropriate browsing context to the resulting URL. @@ -3981,25 +3984,14 @@ object, a script base URL, a credentials mode, a cryptographic nonce, and a The second argument of the four methods described above must be preprocessed as follows: -
                  - -
                1. If the string does not contain the substring "%s", abort these - steps. There's no matching handler.
                2. - -
                3. Resolve the string relative to the API base - URL specified by the entry settings object.
                4. - -
                5. If this fails, then throw a SyntaxError exception, aborting the - method.
                6. - -
                7. If the resulting absolute URL's origin is not the same - origin as the origin specified by the entry settings object, - throw a SecurityError exception, aborting the method.
                8. - -
                9. Return the resulting absolute URL as the result of preprocessing the - argument.
                10. - -
                + 1. If the string does not contain the substring "%s", abort these steps. There's no + matching handler. + 2. Parse the string relative to the entry settings object. If this fails, then + throw a "SyntaxError" {{DOMException}}. + 3. If the resulting URL record's origin is not the same origin as the origin + specified by the entry settings object, throw a "SecurityError" + {{DOMException}}. + 4. Return the resulting URL string as the result of preprocessing the argument.
                Security and privacy
                @@ -4600,13 +4592,13 @@ object, a script base URL, a credentials mode, a cryptographic nonce, and a never does anything, or may arbitrarily ignore invocations with particular arguments for security, privacy, or usability reasons.
              3. -
              4. Resolve the value of the method's first argument +
              5. Parse the value of the method's first argument relative to the API base URL specified by the entry settings object.
              6. If this fails, abort these steps.
              7. -
              8. Process the resulting absolute URL as the URL to an OpenSearch +
              9. Process the resulting URL string as the URL to an OpenSearch description document. [[!OPENSEARCH]]
              @@ -4626,14 +4618,14 @@ object, a script base URL, a credentials mode, a cryptographic nonce, and a
            5. Let host1 be the host component of the origin specified by the entry settings object.
            6. -
            7. Resolve the scriptURL argument +
            8. Parse the scriptURL argument relative to the API base URL specified by the entry settings object.
            9. If this fails, return 0 and abort these steps.
            10. Let host2 be the host component - of the resulting parsed URL.
            11. + of the resulting URL string.
            12. @@ -4646,8 +4638,8 @@ object, a script base URL, a credentials mode, a cryptographic nonce, and a
            13. Let search engines be the list of search engines known by the user - agent and made available to the user by the user agent for which the resulting absolute - URL is a prefix match of the search engine's URL, if any. For + agent and made available to the user by the user agent for which the resulting + absolute URL is a prefix match of the search engine's URL, if any. For search engines registered using OpenSearch description documents, the URL of the search engine corresponds to the URL given in a Url element whose rel attribute is "results" (the default). [[!OPENSEARCH]]
            14. diff --git a/single-page.bs b/single-page.bs index 9125047ae3..4e2da69cf2 100644 --- a/single-page.bs +++ b/single-page.bs @@ -109,26 +109,6 @@ url: http://www.w3.org/TR/xml/#sec-white-space; type: dfn; spec: XML; text: xml:space url: http://www.w3.org/TR/xml-stylesheet/#the-xml-stylesheet-processing-instruction; type: dfn; spec: xml-stylesheet; text: -urlPrefix: https://url.spec.whatwg.org/#concept-; type: dfn; spec: url; - text: domain - text: url parser - text: basic url parser -urlPrefix: https://url.spec.whatwg.org/#concept-url-; type: dfn; for: url; - text: url -url: https://url.spec.whatwg.org/#url-parsing; type: dfn; spec: url; - text: parsed url - text: parsed urls -urlPrefix: https://url.spec.whatwg.org/#; type: dfn; spec: url; - text: non-relative-flag - text: percent encode - text: default encode set - text: utf-8 percent encode -url: https://url.spec.whatwg.org/#syntax-url-scheme-relative; type: dfn; spec: url; - text: relative schemes -url: https://url.spec.whatwg.org/#syntax-url-scheme; type: dfn; spec: url; - text: scheme data -url: https://url.spec.whatwg.org/#syntax-violation; type: dfn; for: url; - text: Parse errors url: https://encoding.spec.whatwg.org/#error; type: dfn; spec: encoding; text: decoder error url: http://tools.ietf.org/html/rfc7231#section-5.3.2; type: dfn; spec: rfc7231; @@ -248,32 +228,6 @@ urlPrefix: http://www.w3.org/TR/MathML/chapter3.html#presm.; type: element; spec text: mtext url: http://www.w3.org/TR/MathML/chapter5.html#mixing.elements.annotation.xml; type: element; spec: mathml; text: annotation-xml -urlPrefix: http://www.w3.org/TR/uievents/#event-type-; type: event; spec: uievents; - text: click - text: dblclick - text: mousedown - text: mouseenter - text: mouseleave - text: mousemove - text: mouseout - text: mouseover - text: mouseup - text: mousewheel; url: wheel - text: keydown - text: keyup - text: keypress - text: resize - text: scroll -urlPrefix: http://www.w3.org/TR/uievents/#interface-; type: interface; spec: uievents; - text: MouseEvent; url: MouseEvent - text: FocusEvent; url: FocusEvent - text: UIEvent; url: UIEvent -url: http://www.w3.org/TR/uievents/#idl-def-MouseEventInit; type: dictionary; spec: uievents; - text: MouseEventInit -url: http://www.w3.org/TR/uievents/#widl-FocusEvent-relatedTarget; type: attribute; for: FocusEvent; spec: uievents; - text: relatedTarget -url: http://www.w3.org/TR/uievents/#widl-UIEvent-detail; type: attribute; for: UIEvent; spec: uievents; - text: detail url: http://www.w3.org/TR/2dcontext/#canvasrenderingcontext2d; type: dfn; text: 2D Canvas APIs url: http://www.w3.org/TR/touch-events/#dfn-touch-point; type: dfn; spec: touch-events; @@ -396,7 +350,7 @@ urlPrefix: http://www.w3.org/TR/hr-time/#dom-; type: interface; spec: hr-time-2; url: http://www.w3.org/TR/hr-time/#the-performance-interface; type: interface; spec: hr-time-2; text: Performance urlPrefix: http://www.w3.org/TR/hr-time/#dom-performance-; type: method; spec: hr-time-2; for: Performance; - text: now + text: now() urlPrefix: https://w3c.github.io/mediacapture-main/getusermedia.html#idl-def-; type: interface; spec: mediacapture-streams; text: MediaStream; url: MediaStream url: https://w3c.github.io/media-source/#idl-def-MediaSource; type: interface; spec: mediasource; @@ -405,7 +359,7 @@ urlPrefix: https://xhr.spec.whatwg.org/#interface-; type: interface; spec: xhr; text: XMLHttpRequest text: ProgressEvent text: FormData -url: https://xhr.spec.whatwg.org/#the-responsexml-attribute; type: attribute; spec: xhr; +url: https://xhr.spec.whatwg.org/#the-responsexml-attribute; type: attribute; spec: xhr; for: XMLHttpRequest; text: responseXML urlPrefix: https://xhr.spec.whatwg.org/#dom-progressevent-; type: attribute; spec: xhr; text: lengthcomputable @@ -576,8 +530,8 @@ url: https://tc39.github.io/ecma262/#sec-functioncreate; type: dfn; spec: ecma-2 text: FunctionCreate url: https://tc39.github.io/ecma262/#sec-get-o-p; type: dfn; spec: ecma-262; for: ecma; text: Get -url: https://tc39.github.io/ecma262/#sec-getactivescriptormodule; type: dfn; spec: ecma-262; - text: GetActiveScriptOrModule +url: https://tc39.github.io/ecma262/#sec-getactivescriptormodule; type: method; spec: ecma-262; + text: GetActiveScriptOrModule() url: https://tc39.github.io/ecma262/#sec-getfunctionrealm; type: dfn; spec: ecma-262; text: GetFunctionRealm url: https://tc39.github.io/ecma262/#sec-hasownproperty; type: dfn; spec: ecma-262; @@ -648,6 +602,10 @@ url: https://tc39.github.io/ecma262/#sec-typeof-operator; type: dfn; spec: ecma- text: typeof url: https://tc39.github.io/ecma262/#table-49; type: dfn; spec: ecma-262; text: The TypedArray Constructors + + +urlPrefix: http://www.w3.org/TR/DOM-Parsing/#; spec: DOMPARSING; + text: DOMParser; url: the-domparser-interface; type: interface @@ -712,6 +670,78 @@ urlPrefix: https://fetch.spec.whatwg.org/#; type: dfn; spec: FETCH; text: synchronous flag text: unsafe-request flag + + +urlPrefix: http://www.w3.org/TR/uievents/#; spec: UIEVENTS + urlPrefix: event-type-; type: event; + text: click + text: dblclick + text: mousedown + text: mouseenter + text: mouseleave + text: mousemove + text: mouseout + text: mouseover + text: mouseup + text: mousewheel; url: wheel + text: keydown + text: keyup + text: keypress + text: resize + text: scroll + urlPrefix: idl-def-; type: dictionary; + text: MouseEventInit + urlPrefix: interface-; type: interface; + text: MouseEvent + text: FocusEvent + text: UIEvent + urlPrefix: widl-; + urlPrefix: FocusEvent-; type: attribute; for: FocusEvent; + text: relatedTarget + urlPrefix: MouseEvent-; for: MouseEvent; + text: relatedTarget; type: attribute; + text: button; type: attribute; + text: altKey; type: attribute; + text: ctrlKey; type: attribute; + text: shiftKey; type: attribute; + text: metaKey; type: attribute; + url: getModifierState; type: method; + text: getModifierState() + urlPrefix: UIEvent-; type: attribute; for: UIEvent; + text: detail + text: view + + + +urlPrefix: https://url.spec.whatwg.org/#; type: dfn; spec: URL; + urlPrefix: concept-; + text: basic url parser + text: domain + text: host + text: serialization; url: url-serializer; for: url + text: url parser + urlPrefix: url-; for: url; + text: fragment + text: host + text: origin + text: path + text: port + text: query + text: scheme + text: url + text: username + text: default encode set + text: non-relative-flag + text: percent encode + urlPrefix: syntax- + text: relative schemes; url: url-scheme-relative + text: scheme data; url: url-scheme + text: Parse errors; url: violation; for: url + url: url-parsing; + text: parsed url + text: parsed urls + text: utf-8 percent encode + urlPrefix: https://www.w3.org/TR/workers/; type: interface; spec: WORKERS; @@ -775,7 +805,13 @@ spec:webidl; type:interface; "status": "ED", "publisher": "W3C" }, - "HTTP": "HTTP is the union of a set of RFCs:" + "HTTP": "HTTP is the union of a set of RFCs:", + "XKCD-1288": { + "authors": [ "Randall Munroe" ], + "href": "https://xkcd.com/1288/", + "title": "Substitutions", + "publisher": "xkcd" + } }
              From 0bfcc34590d40104dbcdc5fca51dfdfbc767059a Mon Sep 17 00:00:00 2001 From: Travis Leithead Date: Thu, 12 May 2016 16:13:09 -0700 Subject: [PATCH 11/19] Further reducing linking issues --- sections/browsers.include | 361 ++++++++++------------------ sections/dom.include | 70 +++--- sections/events.include | 4 +- sections/infrastructure.include | 123 +++++----- sections/introduction.include | 2 +- sections/semantics-forms.include | 6 +- sections/semantics-links.include | 34 +-- sections/syntax.include | 6 +- sections/webappapis.include | 132 ++++++----- single-page.bs | 390 ++++++++++++++----------------- 10 files changed, 492 insertions(+), 636 deletions(-) diff --git a/sections/browsers.include b/sections/browsers.include index a828101592..c8f611399d 100644 --- a/sections/browsers.include +++ b/sections/browsers.include @@ -37,7 +37,7 @@ history contains the {{Document}}, if any. (A {{Document}} created using an API such as {{DOMImplementation/createDocument()}} has no browsing context.) Each {{Document}} in a browsing context is - associated with + associated with a {{Window}} object.

              @@ -71,7 +71,7 @@ To create a new browsing context: - 1. Call the JavaScript InitializeHostDefinedRealm() abstract operation with the following + 1. Call the JavaScript InitializeHostDefinedRealm() abstract operation with the following customizations: * For the global object, create a new {{Window}} object window. @@ -205,8 +205,6 @@ -

              - The top IDL attribute on the Window object of a Document in a browsing context b must return the WindowProxy object of its top-level browsing context (which would be @@ -214,31 +212,26 @@ itself), if it has one, or its own WindowProxy object otherwise (e.g., if it was a detached nested browsing context). - The parent IDL attribute on the Window - object of a Document in a browsing context b must - return the WindowProxy object of the parent browsing context, if there - is one (i.e., if b is a child browsing context), or the - WindowProxy object of the browsing context b itself, - otherwise (i.e., if it is a top-level browsing context or a detached nested browsing context). - - The frameElement IDL attribute on the - Window object of a Document d, on getting, must run - the following algorithm: - -
                - -
              1. If d is not a Document in a nested browsing context, return null and abort these steps.
              2. - -
              3. If the browsing context container's node document does not have the - same effective script origin as the - effective script origin specified by the entry settings object, then - return null and abort these steps.
              4. - -
              5. Return the browsing context container for b.
              6. - -
              - -
              + The parent IDL attribute on the {{Window}} object + of a {{Document}} that has a browsing context b must return the {{WindowProxy}} + object of the parent browsing context, if there is one (i.e., if b is a + child browsing context), or the {{WindowProxy}} object of the browsing context + b itself, otherwise (i.e., if it is a top-level browsing context or a detached + nested browsing context). + + The frameElement IDL attribute on the {{Window}} + object of a {{Document}} d, on getting, must run the following algorithm: + + 1. Let d be the {{Window}} object's + associated Document. + 2. Let context be d's browsing context. + 3. If context is not a nested browsing context, return null and abort these + steps. + 4. Let container be context's browsing context container. + 5. If container's node document's origin is not + same origin-domain with the entry settings object's origin, then return + null and abort these steps. + 6. Return container.

              Auxiliary browsing contexts

              @@ -341,46 +334,31 @@ -
              -

              Groupings of browsing contexts

              - Each browsing context is defined as having a list of one or more directly - reachable browsing contexts. These are: - - - - The transitive closure of all the browsing contexts that - are directly reachable browsing contexts forms a unit of related browsing - contexts. - - Each unit of related browsing contexts is then further divided into the smallest - number of groups such that every member of each group has an active document with an - effective script origin that, through appropriate manipulation of the document.domain attribute, could be made to be the same as - other members of the group, but could not be made the same as members of any other group. Each - such group is a unit of related similar-origin browsing contexts. - -

              - There is also at most one event loop per unit of related - similar-origin browsing contexts (though several units of related similar-origin browsing contexts can - have a shared event loop). -

              + Each unit of related browsing contexts is then further divided into the smallest number of + groups such that every member of each group has an active document with an origin + that, through appropriate manipulation of the {{Document/domain|document.domain}} attribute, could + be made to be same origin-domain with other members of the group, but could not be made the + same as members of any other group. Each such group is a + unit of related similar-origin browsing contexts. -
              +

              There is also at most one event loop per + unit of related similar-origin browsing contexts (though several + units of related similar-origin browsing contexts can have a shared event loop).

              Browsing context names

              @@ -959,9 +937,8 @@

              If this abstract operation returns undefined and there is no custom behavior, the caller needs to throw a "SecurityError" {{DOMException}}.

              - 1. If P is @@toStringTag, - @@hasInstance, or - @@isConcatSpreadable, then return PropertyDescriptor + 1. If P is @@toStringTag, @@hasInstance, or @@isConcatSpreadable, + then return PropertyDescriptor { \[[Value]]: undefined, \[[Writable]]: false, \[[Enumerable]]: false, \[[Configurable]]: true }. 2. Let crossOriginKey be a tuple consisting of the current settings object's @@ -1147,7 +1124,8 @@ WindowProxy object. The document IDL attribute must return - the Window object's newest Document object. + the Window object's newest + Document object.

              The Document object associated with a Window object can @@ -1168,73 +1146,6 @@ -

              - -

              Security

              - -

              This section describes a security model that is underdefined, imperfect, and - does not match implementations. Work is ongoing to attempt to resolve this, but in the meantime, - please do not rely on this section for precision. Implementors are urged to send their feedback on - how cross-origin cross-global access to Window and Location objects - should work. - - User agents must throw a SecurityError exception whenever any - properties of a Window object are accessed when the incumbent settings - object specifies an effective script origin that is not the same as the Window object's - Document's effective script origin, with the following - exceptions: - -

                - -
              • The location attribute - -
              • The postMessage() method - -
              • The window attribute - -
              • The frames attribute - -
              • The self attribute - -
              • The top attribute - -
              • The parent attribute - -
              • The opener attribute - -
              • The closed attribute - -
              • The close() method - -
              • The blur() method - -
              • The focus() method - -
              • The dynamic nested browsing context properties - -
              - - When the incumbent settings object specifies an effective script - origin that is different than a Window - object's Document's effective script origin, the user agent must - act as if any changes to that Window object's properties, getters, setters, etc, were - not present, and as if all the properties of that Window object had their \[[Enumerable]] attribute set to false. - - For members that return objects (including function objects), each distinct effective - script origin that is not the same as the Window object's - Document's effective script origin must be provided with a separate set - of objects. These objects must have the prototype chain appropriate for the script for which the - objects are created (not those that would be appropriate for scripts whose global - object, as specified by their settings object, is the Window - object in question). - -
              - For instance, if two frames containing Documents from different origins access the same Window object's postMessage() method, they will get distinct objects that - are not equal. -
              - -
              -

              APIs for creating and navigating browsing contexts by name

              @@ -1456,53 +1367,25 @@

              Accessing other browsing contexts

              - -
              window . length
              - -
              - - Returns the number of child browsing - contexts. - -
              +
              window . {{Window/length}}
              +
              Returns the number of child browsing contexts.
              window[index]
              - -
              - - Returns the indicated child browsing context. - -
              - +
              Returns the indicated child browsing context.
              -
              - - The length IDL attribute on the Window - interface must return the number of child browsing - contexts that are nested through - elements that are in the Document that is the - active document of that Window object, if that Window's - browsing context shares the same event loop as the responsible - document specified by the entry settings object accessing the IDL attribute; - otherwise, it must return zero. - - The supported property indices on the Window object at any instant - are the numbers in the range 0 .. n-1, where n is the number returned by the length IDL - attribute. If n is zero then there are no supported property - indices. - - To determine the value of an indexed property index of a Window object, the user agent must return the - WindowProxy object of the indexth child browsing - context of the Document that is nested through an element that is in the - Document, sorted in the order that the elements nesting those browsing contexts were most recently inserted into the - {{Document}}, the WindowProxy object of the most recently inserted - browsing context container's nested browsing context being last. - - These properties are the dynamic nested browsing context properties. - -
              - + The number of child browsing contexts of a {{Window}} object W is the number + of child browsing contexts that are nested through elements that are in a + {{Document}} that is the active document of the {{Window}} object's associated + {{Document}} object's browsing context. + + The length IDL attribute's getter must return the + number of child browsing contexts of this {{Window}} object. + +

              Indexed access to child browsing contexts is defined through the + \[[GetOwnProperty]] internal method of the {{WindowProxy}} + object.

              +

              Named access on the Window object

              @@ -1511,7 +1394,7 @@ As a general rule, relying on this will lead to brittle code. Which IDs end up mapping to this API can vary over time, as new features are added to the Web platform, for example. Instead - of this, use {{Document/getElementById()|document.getElementById()}} or + of this, use {{NonElementParentNode/getElementById()|document.getElementById()}} or document.querySelector().
              @@ -1837,7 +1720,7 @@ The {{WindowProxy}} object internal methods are described in the subsections below. -
              \[[GetPrototypeOf]] ( )
              +
              \[[GetPrototypeOf]] ( )
              1. Let W be the value of the \[[Window]] internal slot of this. @@ -1845,19 +1728,19 @@ OrdinaryGetPrototypeOf(W). 3. Return null. -
              \[[SetPrototypeOf]] ( V )
              +
              \[[SetPrototypeOf]] ( V )
              1. Return false. -
              \[[IsExtensible]] ( )
              +
              \[[IsExtensible]] ( )
              1. Return true. -
              \[[PreventExtensions]] ( )
              +
              \[[PreventExtensions]] ( )
              1. Return false. -
              \[[GetOwnProperty]] ( P )
              +
              \[[GetOwnProperty]] ( P )
              1. Let W be the value of the \[[Window]] internal slot of this. @@ -1891,7 +1774,7 @@ \[[Writable]]: false, \[[Configurable]]: true }. 7. Throw a "SecurityError" {{DOMException}}. -
              \[[DefineOwnProperty]] ( P, Desc )
              +
              \[[DefineOwnProperty]] ( P, Desc )
              1. If P is an array index property name, return false. 2. Let W be the value of the \[[Window]] internal slot of @@ -1902,7 +1785,7 @@

              See above about how this violates JavaScript's internal method invariants.

              4. Return false. -
              \[[Get]] ( P, Receiver )
              +
              \[[Get]] ( P, Receiver )
              1. Let W be the value of the \[[Window]] internal slot of this. @@ -1910,7 +1793,7 @@ OrdinaryGet(this, P, Receiver). 3. Return ? CrossOriginGet(this, P, Receiver). -
              \[[Set]] ( P, V, Receiver )
              +
              \[[Set]] ( P, V, Receiver )
              1. Let W be the value of the \[[Window]] internal slot of this. @@ -1918,7 +1801,7 @@ OrdinarySet(W, this, Receiver). 3. Return CrossOriginSet(this, P, V, Receiver). -
              \[[Delete]] ( P )
              +
              \[[Delete]] ( P )
              1. If P is an array index property name, return false. 2. Let W be the value of the \[[Window]] internal slot of @@ -1927,7 +1810,7 @@ OrdinaryDelete(W, P). 4. Return false. -
              \[[OwnPropertyKeys]] ( )
              +
              \[[OwnPropertyKeys]] ( )
              1. Let W be the value of the \[[Window]] internal slot of this. @@ -1942,7 +1825,7 @@ 7. Return the concatenation of keys and ! CrossOriginOwnPropertyKeys(W). -

              Origin

              +

              Origin

              Origins are the fundamental currency of the Web's security model. Two actors in the Web platform that share an origin are assumed to trust each other and to have the same authority. @@ -1956,7 +1839,7 @@
              - An origin is one of the following: + An origin is one of the following: : An opaque origin :: An internal value, with no serialisation, for which the only meaningful operation is testing @@ -2079,13 +1962,13 @@ 4. Let unicodeOrigin be a new tuple origin consisting origin's scheme, unicodeHost, and origin's port. - 5. Return the ASCII serialisation of an origin, given unicodeOrigin. + 5. Return the ASCII serialization of an origin, given unicodeOrigin. -

              The name ASCII serialisation of an origin is misleading, as it merely +

              The name ASCII serialization of an origin is misleading, as it merely serialises an origin, which are all ASCII by default due to the URL parser.

              - The Unicode serialisation of ("https", "xn--maraa-rta.example", + The Unicode serialization of ("https", "xn--maraa-rta.example", null, null) is "https://maraña.example".
              @@ -2123,6 +2006,9 @@ domains are identical and null, then return true. 3. Return false. +
              + The following table shows how A and B are related: +
        73. Event - A media element whose networkState + A media element whose networkState was previously not in the NETWORK_EMPTY state has just switched to that state (either because of a fatal error during load that's about to be reported, or because the load() method was invoked while @@ -12456,7 +12455,7 @@ red:89 One or both of the videoWidth and videoHeight attributes have just been updated. - Media element is a <{video}> element; readyState is not HAVE_NOTHING + Media element is a <{video}> element; readyState is not HAVE_NOTHING
          @@ -2159,38 +2045,30 @@
          +

        Relaxing the same-origin restriction

        +
        document . {{Document/domain}} [ = domain ]
        +
        Returns the current domain used for security checks. -
        document . domain [ = domain ]
        - -
        - - Returns the current domain used for security checks. - - Can be set to a value that removes subdomains, to change the effective script - origin to allow pages on other subdomains of the same domain (if they do the same thing) - to access each other. (Can't be set in sandboxed iframes.) - + Can be set to a value that removes subdomains, to change the origin's + domain to allow pages on other subdomains of the same domain (if they + do the same thing) to access each other. (Can't be set in sandboxed <{iframe}>s.)
        -
        -
        - - The domain attribute on - Document objects must be initialized to the document's domain, if it has - one, and the empty string otherwise. If the document's domain starts with a U+005B - LEFT SQUARE BRACKET character ([) and ends with a U+005D RIGHT SQUARE BRACKET character (]), it is - an IPv6 address; these square brackets must be omitted when initializing the attribute's - value. - - On getting, the attribute must return its current value, unless the Document has - no browsing context, in which case it must return the empty string. - - On setting, the user agent must run the following algorithm: + The domain attribute's getter must run these + steps: + + 1. If this {{Document}} object does not have a browsing context, then return the empty + string. + 2. Let effectiveDomain be this {{Document}}'s origin's effective domain. + 3. If effectiveDomain is an opaque origin, then return the empty string. + 4. Return effectiveDomain, serialised. + + The {{Document/domain}} attribute on setting must run these steps:
          @@ -2215,12 +2093,12 @@ value. Otherwise, strictly split the new value on - U+002E FULL STOP characters (.), apply the domain to ASCII algorithm to each + U+002E FULL STOP characters (.), apply the domain to ASCII algorithm to each returned token, and let new value be the result of concatenating the results of applying that algorithm to each token, in the same order, separated by U+002E FULL STOP characters (.). [[!URL]] - If the domain to ASCII algorithm returns failure, e.g., because a component is too long or because it contains + If the domain to ASCII algorithm returns failure, e.g., because a component is too long or because it contains invalid characters, then throw a SecurityError exception and abort these steps. @@ -2259,7 +2137,7 @@ steps. [[!PSL]] Suffixes must be compared in an ASCII case-insensitive manner, after applying - the domain to ASCII algorithm to their individual components, . [[!URL]] + the domain to ASCII algorithm to their individual components, . [[!URL]] @@ -2307,11 +2185,10 @@
        - The domain of a Document is the host part + The domain of a Document is the host part of the document's origin, if the value of that origin is a scheme/host/port tuple. If it isn't, then the document does not have a domain. -

        The domain attribute is used to enable @@ -3447,7 +3324,7 @@

      24. Let copyURL be a copy of this Location object's URL.
      25. Let possibleFailure be the result of basic URL parsing the given value, followed by ":", with copyURL - as url and scheme start state as state override.
      26. + as url and scheme start state as state override.
      27. If possibleFailure is failure, throw a TypeError exception.
      28. @@ -3463,13 +3340,13 @@
        1. Let url be this Location object's URL.
        2. -
        3. If url's host is null, return the empty +
        4. If url's host is null, return the empty string.
        5. If url's port is null, return - url's host, serialized.
        6. + url's host, serialized. -
        7. Return url's host, serialized, followed by ":" and url's port, serialized.
        8. +
        9. Return url's host, serialized, followed by ":" and url's port, serialized.
        The host attribute's setter must run these steps: @@ -3481,7 +3358,7 @@ steps.
      29. Basic URL parse the given value, with - copyURL as url and host state as state + copyURL as url and host state as state override.
      30. Location-object-setter navigate to copyURL.
      31. @@ -3492,9 +3369,9 @@
        1. If this Location object's URL's - host is null, return the empty string.
        2. + host is null, return the empty string. -
        3. Return this Location object's URL's host, serialized.
        4. +
        5. Return this Location object's URL's host, serialized.
        The hostname attribute's setter must run these @@ -3507,7 +3384,7 @@ steps.
      32. Basic URL parse the given value, with - copyURL as url and hostname state as state + copyURL as url and hostname state as state override.
      33. Location-object-setter navigate to copyURL.
      34. @@ -3528,12 +3405,12 @@
        1. Let copyURL be a copy of this Location object's URL.
        2. -
        3. If copyURL's host is null, +
        4. If copyURL's host is null, copyURL's non-relative flag is set, or copyURL's scheme is "file", terminate these steps.
        5. Basic URL parse the given value, with - copyURL as url and port state as state + copyURL as url and port state as state override.
        6. Location-object-setter navigate to copyURL.
        7. @@ -3565,7 +3442,7 @@ list.
        8. Basic URL parse the given value, with - copyURL as url and path start state as state + copyURL as url and path start state as state override.
        9. Location-object-setter navigate to copyURL.
        10. @@ -3601,7 +3478,7 @@ string.
        11. Basic URL parse input, with - copyURL as url and query state as state override, + copyURL as url and query state as state override, and the relevant Document's document's character encoding as encoding override.
        @@ -3641,7 +3518,7 @@ empty string.
      35. Basic URL parse input, with - copyURL as url and fragment state as state + copyURL as url and fragment state as state override.
      @@ -4041,7 +3918,7 @@ urlRecord's fragment component to script source. 7. Replace script source with the result of applying the - percent decode algorithm to script source. + percent decode algorithm to script source. 8. Replace script source with the result of applying the UTF-8 decode algorithm to script source. 9. Let address be the address of the active document of the @@ -4597,7 +4474,7 @@ whose value is not the empty string, then, as soon as the element is inserted into the document, the user agent must parse the value of that attribute relative to that element, and if - that is successful, must apply the URL serializer + that is successful, must apply the URL serializer algorithm to the resulting URL record with the exclude fragment flag set to obtain manifest URL, and then run the application cache selection algorithm with manifest URL as the manifest URL, passing in the @@ -6323,7 +6200,7 @@ If the resulting URL record has a different scheme component than base URL (the manifest's URL), then jump back to the step labeled start of line. - Let new URL be the result of applying the URL serializer + Let new URL be the result of applying the URL serializer algorithm to the resulting parsed URL, with the exclude fragment flag set. Add new URL to the explicit URLs. @@ -6352,10 +6229,10 @@ If manifest path is not a prefix match for part one path, then jump back to the step labeled start of line. - Let part one be the result of applying the URL serializer + Let part one be the result of applying the URL serializer algorithm to the first resulting parsed URL, with the exclude fragment flag set. - Let part two be the result of applying the URL serializer + Let part two be the result of applying the URL serializer algorithm to the second resulting parsed URL, with the exclude fragment flag set. @@ -6386,7 +6263,7 @@ If urlRecord has a different scheme component than base URL (the manifest's URL), then jump back to the step labeled start of line. - Let new URL be the result of applying the URL serializer + Let new URL be the result of applying the URL serializer algorithm to the resulting parsed URL, with the exclude fragment flag set. Add new URL to the online safelist namespaces. @@ -6693,7 +6570,7 @@ algorithm to the resource's URL results in a resulting URL record that has a non-null fragment component, the URL used for the entry in cache must instead be the absolute URL - obtained from applying the URL serializer + obtained from applying the URL serializer algorithm to the resulting URL record with the exclude fragment flag set (application caches never include fragment identifiers). diff --git a/sections/dom.include b/sections/dom.include index f0ef72c2a3..7820af4d97 100644 --- a/sections/dom.include +++ b/sections/dom.include @@ -157,49 +157,47 @@
    -
    - The cookie attribute represents the cookies of the resource identified - by the document's address. + The cookie attribute represents the cookies of + the resource identified by the document's address. - A {{Document}} object that falls into one of the following conditions is a - cookie-averse {{Document}} object: + A {{Document}} object that falls into one of the following conditions is a + cookie-averse {{Document}} object: - * A {{Document}} that has no browsing context. + * A {{Document}} that has no browsing context. - * A {{Document}} whose address does not use a server-based naming - authority. + * A {{Document}} whose address does not use a server-based naming + authority. - On getting, if the document is a cookie-averse Document object, then - the user agent must return the empty string. Otherwise, if the {{Document}}'s - origin is an opaque origin, the user agent must throw a - SecurityError exception. Otherwise, the user agent must return the - cookie-string for the document's address for a "non-HTTP" API, decoded - using the UTF-8 decoder. - [[!COOKIES]] - (This is a fingerprinting vector.) + On getting, if the document is a cookie-averse Document object, then + the user agent must return the empty string. Otherwise, if the {{Document}}'s + origin is an opaque origin, the user agent must throw a + SecurityError exception. Otherwise, the user agent must return the + cookie-string for the document's address for a "non-HTTP" API, decoded + using the UTF-8 decoder. + [[!COOKIES]] + (This is a fingerprinting vector.) - On setting, if the document is a cookie-averse Document object, then - the user agent must do nothing. Otherwise, if the {{Document}}'s origin is - an opaque origin, the user agent must throw a SecurityError exception. - Otherwise, the user agent must act as it would when receiving a set-cookie-string for the document's address - via a "non-HTTP" API, consisting of the new value encoded as UTF-8. [[!COOKIES]] [[!ENCODING]] + On setting, if the document is a cookie-averse Document object, then + the user agent must do nothing. Otherwise, if the {{Document}}'s origin is + an opaque origin, the user agent must throw a SecurityError exception. + Otherwise, the user agent must act as it would when receiving a set-cookie-string for the document's address + via a "non-HTTP" API, consisting of the new value encoded as UTF-8. [[!COOKIES]] [[!ENCODING]] -

    - Since the cookie attribute is accessible across frames, the path restrictions on - cookies are only a tool to help manage which cookies are sent to which parts of the site, and - are not in any way a security feature. -

    +

    + Since the cookie attribute is accessible across frames, the path restrictions on + cookies are only a tool to help manage which cookies are sent to which parts of the site, and + are not in any way a security feature. +

    -

    - The cookie attribute's getter and setter synchronously access shared state. Since - there is no locking mechanism, other browsing contexts in a multiprocess user agent can modify - cookies while scripts are running. A site could, for instance, try to read a cookie, increment - its value, then write it back out, using the new value of the cookie as a unique identifier - for the session; if the site does this twice in two different browser windows at the same - time, it might end up using the same "unique" identifier for both sessions, with potentially - disastrous effects. -

    -
    +

    + The cookie attribute's getter and setter synchronously access shared state. Since + there is no locking mechanism, other browsing contexts in a multiprocess user agent can modify + cookies while scripts are running. A site could, for instance, try to read a cookie, increment + its value, then write it back out, using the new value of the cookie as a unique identifier + for the session; if the site does this twice in two different browser windows at the same + time, it might end up using the same "unique" identifier for both sessions, with potentially + disastrous effects. +


    diff --git a/sections/events.include b/sections/events.include index e2c5afbc1d..4d6ad28db0 100644 --- a/sections/events.include +++ b/sections/events.include @@ -106,7 +106,7 @@ error {{Event}} - Global scope objects, Worker objects, elements, networking-related objects + Global scope objects, {{Worker}} objects, elements, networking-related objects Fired when unexpected errors occur (e.g., networking errors, script errors, decoding errors) @@ -160,7 +160,7 @@ message MessageEvent - {{Window}}, EventSource, WebSocket, MessagePort, BroadcastChannel, DedicatedWorkerGlobalScope, Worker + {{Window}}, EventSource, WebSocket, MessagePort, BroadcastChannel, DedicatedWorkerGlobalScope, {{Worker}} Fired at an object when it receives a message diff --git a/sections/infrastructure.include b/sections/infrastructure.include index d44f1fa2af..7e3a7d7f37 100644 --- a/sections/infrastructure.include +++ b/sections/infrastructure.include @@ -612,44 +612,45 @@ : URLs :: The following terms are defined in the WHATWG URL standard: [[!URL]] - * domain + * host + * domain * URL * Origin of URLs * Absolute URL * Relative URL * Relative schemes * The URL parser and basic URL parser as well as these parser states: - * scheme start state - * host state - * hostname state - * port state - * path start state - * query state - * fragment state - * URL record - * The scheme component of a URL record - * The scheme data component of a URL record - * The username component of a URL record - * The password component of a URL record - * The host component of a URL record - * The port component of a URL record - * The path component of a URL record - * The query component of a URL record - * The fragment component of a URL record - * non-relative flag - * Parse errors from the URL parser - * The URL serializer - * The host serializer - * The serialize an integer + * scheme start state + * host state + * hostname state + * port state + * path start state + * query state + * fragment state + * URL record, as well as its individual components: + * scheme + * username + * password + * host + * port + * path + * query + * fragment + * A network scheme + * The URL serializer + * The host serializer + * The serialize an integer * Default encode set * Percent encode * UTF-8 percent encode - * Percent decode + * Percent decode * Decoder error - * set the username - * set the password - * The domain to ASCII algorithm - * The domain to Unicode algorithm + * set the username + * set the password + * The domain to ASCII algorithm + * The domain to Unicode algorithm + * non-relative flag + * Parse errors from the URL parser A number of schemes and protocols are referenced by this specification also: @@ -671,7 +672,6 @@ * Content-Disposition header * Content-Language header * Content-Length header - * Host header * Last-Modified header * Referer header @@ -759,7 +759,6 @@ The Web IDL specification also defines the following types that are used in Web IDL fragments in this specification: - * ArrayBuffer * ArrayBufferView * boolean * DOMString @@ -769,8 +768,6 @@ * Function * long * object - * RegExp - * Uint8ClampedArray * unrestricted double * unsigned long @@ -833,10 +830,10 @@ * The current Realm Record * Use Strict Directive * Well-Known Symbols, including: - * @@hasInstance - * @@isConcatSpreadable - * @@toPrimitive - * @@toStringTag + * @@hasInstance + * @@isConcatSpreadable + * @@toPrimitive + * @@toStringTag * Well-Known Intrinsic Objects, including: * %ArrayBuffer% * %ArrayPrototype% @@ -860,13 +857,13 @@ * The EnqueueJob abstract operation * The FunctionCreate abstract operation * The Get abstract operation - * The GetActiveScriptOrModule() abstract operation + * The GetActiveScriptOrModule abstract operation * The GetFunctionRealm abstract operation * The HasOwnProperty abstract operation * The HostEnsureCanCompileStrings abstract operation * The HostPromiseRejectionTracker abstract operation * The HostResolveImportedModule abstract operation - * The InitializeHostDefinedRealm() abstract operation + * The InitializeHostDefinedRealm abstract operation * The IsAccessorDescriptor abstract operation * The IsCallable abstract operation * The IsConstructor abstract operation @@ -894,10 +891,12 @@ * The TypedArrayCreate abstract operation * The Abstract Equality Comparison algorithm * The Strict Equality Comparison algorithm + * The {{ArrayBuffer}} object * The {{Date}} object * The {{SyntaxError}} object * The {{TypeError}} object * The {{RangeError}} object + * The {{RegExp}} object * The typeof operator * The TypedArray Constructors table @@ -1160,18 +1159,31 @@ * CSSStyleDeclaration * cssText attribute of CSSStyleDeclaration * StyleSheet - * The terms create a CSS style sheet, remove a CSS style sheet, and - associated CSS style sheet - * CSS style sheets and their properties: type, location, - parent CSS style sheet, owner node, owner CSS rule, - media, title, alternate flag, disabled flag, - CSS rules, origin-clean flag + * create a CSS style sheet + * remove a CSS style sheet + * associated CSS style sheet + * CSS style sheets and their properties: + type, + location, + parent CSS style sheet, + owner node, + owner CSS rule, + media, + title, + alternate flag, + disabled flag, + CSS rules, + origin-clean flag * Alternative style sheet sets and the preferred style sheet set * Serializing a CSS value + * run the resize steps + * run the scroll steps + * evaluate media queries and report changes * Scroll an element into view * Scroll to the beginning of the document * The resize event * The scroll event + * The features argument of window.open The following features and terms are defined in the CSS Syntax specifications: [[!CSS-SYNTAX-3]] @@ -1791,7 +1803,7 @@ HYPHEN-MINUS (-) prefix represents the number represented in base ten by the string of digits that follows the U+002D HYPHEN-MINUS, subtracted from zero. - The rules for parsing integers are as given in the following algorithm. When + The rules for parsing integers are as given in the following algorithm. When invoked, the steps must be followed in the order given, aborting at the first step that returns a value. This algorithm will return either an integer or an error. @@ -3317,7 +3329,7 @@ 3. Let urlRecord be the result of applying the URL parser to url, with baseURL and encoding. 4. If urlRecord is failure, then abort these steps with an error. - 5. Let urlString be the result of applying the URL serializer to + 5. Let urlString be the result of applying the URL serializer to urlRecord. 6. Return urlString as the resulting URL string and urlRecord as the resulting URL record. @@ -3440,7 +3452,7 @@ 5. Let referrer be the document's address of document. 6. Clean referrer: Apply the URL parser to referrer and let parsed referrer be the resulting URL record. - 7. Let referrer be the result of applying the URL serializer to + 7. Let referrer be the result of applying the URL serializer to parsed referrer, with the exclude fragment flag set. 8. If referrer is not the empty string, is not a data: URL, and is not the URL "about:blank", then generate the address of the @@ -3600,7 +3612,8 @@

    Determining the type of a resource

    - The Content-Type metadata of a resource must be obtained and interpreted in a manner + The Content-Type metadata + of a resource must be obtained and interpreted in a manner consistent with the requirements of the MIME Sniffing specification. [[!MIMESNIFF]] The sniffed type of a resource must be found in a manner consistent with the @@ -4382,8 +4395,8 @@ and non-idempotent operation; once an object has been transferred, it cannot be transferred, or indeed used, again.) - To transfer an ArrayBuffer object old to a new owner - owner, a user agent must create a new ArrayBuffer object pointing at the + To transfer an {{ArrayBuffer}} object old to a new owner + owner, a user agent must create a new {{ArrayBuffer}} object pointing at the same underlying data as old, thus obtaining new, must neuter the old object, and must finally return new. [[!ECMA-262]] @@ -4423,7 +4436,7 @@ 3. Let deep clone be none. 4. The input value is an object. Jump to the appropriate step below:
    -
    If input is a Boolean object
    +
    If input is a {{Boolean}} object
    Let output be a newly constructed Boolean object with the same value as input. @@ -4447,9 +4460,9 @@ value as input.
    -
    If input is a RegExp object
    +
    If input is a {{RegExp}} object
    - Let output be a newly constructed RegExp object with the same + Let output be a newly constructed {{RegExp}} object with the same pattern and flags as input.

    The value of the lastIndex property is not copied.

    @@ -4486,11 +4499,11 @@ data is a copy of input's bitmap data.
    -
    If input is an ArrayBuffer object
    +
    If input is an {{ArrayBuffer}} object
    If input has been neutered, throw a DataCloneError exception and abort the overall structured clone algorithm. Otherwise, let - output be a newly constructed ArrayBuffer object whose contents + output be a newly constructed {{ArrayBuffer}} object whose contents are a copy of input's contents, with the same length.
    diff --git a/sections/introduction.include b/sections/introduction.include index 80d1788830..da37f4973b 100644 --- a/sections/introduction.include +++ b/sections/introduction.include @@ -170,7 +170,7 @@ To avoid exposing Web authors to the complexities of multithreading, the HTML and DOM APIs are designed such that no script can ever detect the simultaneous execution of other scripts. Even - with {{worker|workers}}, the intent is that the behavior of implementations + with {{Worker|workers}}, the intent is that the behavior of implementations can be thought of as completely serializing the execution of all scripts in all browsing contexts. diff --git a/sections/semantics-forms.include b/sections/semantics-forms.include index a85dcb35ba..85abef2b10 100644 --- a/sections/semantics-forms.include +++ b/sections/semantics-forms.include @@ -6754,8 +6754,8 @@ You cannot submit this form when the field is incorrect.
  • attribute as described below. The <{input/step}> attribute, if specified, must either have a - value that is a valid floating-point number that parses to a number - that is greater than zero, or must have a + value that is a valid floating-point number that parses + to a number that is greater than zero, or must have a value that is an ASCII case-insensitive match for the string "any".
    @@ -14177,7 +14177,7 @@ fur Set parsed action's query component to query. Let destination be a new URL formed by applying the - URL serializer algorithm to parsed action. + URL serializer algorithm to parsed action. Plan to navigate to destination. diff --git a/sections/semantics-links.include b/sections/semantics-links.include index e4e122f63f..fec86c8807 100644 --- a/sections/semantics-links.include +++ b/sections/semantics-links.include @@ -295,7 +295,7 @@
  • Basic URL parse the given value, followed by :", with this element's URL as - url and scheme start state as state override.
  • + url and scheme start state as state override.
  • Update href.
  • @@ -320,10 +320,10 @@
  • Let url be this element's URL.
  • -
  • If url or url's host is null, +
  • If url or url's host is null, or url's non-relative flag is set, terminate these steps.
  • -
  • set the username, given url and the given value.
  • +
  • set the username, given url and the given value.
  • Update href.
  • @@ -350,10 +350,10 @@
  • Let url be this element's URL.
  • -
  • If url or url's host is null, +
  • If url or url's host is null, or url's non-relative flag is set, terminate these steps.
  • -
  • Set the password, given url and the given value.
  • +
  • Set the password, given url and the given value.
  • Update href.
  • @@ -366,13 +366,13 @@
  • Let url be this element's URL.
  • -
  • If url or url's host is null, +
  • If url or url's host is null, return the empty string.
  • If url's port is null, return - url's host, serialized.
  • + url's host, serialized. -
  • Return url's host, serialized, followed by ":" and url's port, serialized.
  • +
  • Return url's host, serialized, followed by ":" and url's port, serialized.
  • The host attribute's setter must run these steps:

    @@ -386,7 +386,7 @@ terminate these steps.
  • Basic URL parse the given value, with - url as url and host state as state + url as url and host state as state override.
  • Update href.
  • @@ -400,10 +400,10 @@
  • Let url be this element's URL.
  • -
  • If url or url's host is null, +
  • If url or url's host is null, return the empty string.
  • -
  • Return url's host, serialized.
  • +
  • Return url's host, serialized.
  • The hostname attribute's setter must run these @@ -418,7 +418,7 @@ terminate these steps.

  • Basic URL parse the given value, with - url as url and hostname state as state + url as url and hostname state as state override.
  • Update href.
  • @@ -445,12 +445,12 @@
  • Let url be this element's URL.
  • -
  • If url or url's host is null, +
  • If url or url's host is null, url's non-relative flag is set, or url's scheme is "file", terminate these steps.
  • Basic URL parse the given value, with - url as url and port state as state + url as url and port state as state override.
  • Update href.
  • @@ -488,7 +488,7 @@ list.
  • Basic URL parse the given value, with - url as url and path start state as state + url as url and path start state as state override.
  • Update href.
  • @@ -531,7 +531,7 @@ string.
  • Basic URL parse input, with - url as url and query state as state override, and + url as url and query state as state override, and this element's node document's document's character encoding as encoding override.
  • @@ -577,7 +577,7 @@ string.
  • Basic URL parse input, with - url as url and fragment state as state + url as url and fragment state as state override.
  • diff --git a/sections/syntax.include b/sections/syntax.include index 6ca4a2fe90..f51974b4f3 100644 --- a/sections/syntax.include +++ b/sections/syntax.include @@ -5300,7 +5300,7 @@
  • If the newly created element has a manifest attribute whose value is not the empty string, then parse the value of that attribute, relative to the newly created element, and if that is successful, run the application cache selection algorithm passing the {{Document}} object with the result of - applying the URL serializer algorithm to the + applying the URL serializer algorithm to the resulting URL string with the exclude fragment flag set.
  • Otherwise, run the application cache selection algorithm passing the {{Document}} object with no manifest.
  • @@ -7034,8 +7034,8 @@
  • Block the tokenizer for this instance of the HTML parser, such that the event loop will not run tasks that invoke the tokenizer.
  • -
  • If the parser's Document has a style sheet that is blocking - scripts or the script's "ready to be parser-executed" +
  • If the parser's Document has a style sheet that is blocking scripts + or the script's "ready to be parser-executed" flag is not set: spin the event loop until the parser's Document has no style sheet that is blocking scripts and the script's "ready to be parser-executed" flag is set.
  • diff --git a/sections/webappapis.include b/sections/webappapis.include index f6ce933eda..2a2418c00a 100644 --- a/sections/webappapis.include +++ b/sections/webappapis.include @@ -174,7 +174,8 @@
    - To fetch a classic script for a <{script}> element element, given a + To fetch a classic script + for a <{script}> element element, given a url, a CORS setting, a cryptographic nonce, a parser state, a settings object, and a character encoding, run these steps. The algorithm will asynchronously complete with either null (on failure) or a new @@ -200,7 +201,7 @@ 7. If the caller specified custom steps to process the response, perform them on response. If they return false, complete this algorithm with null, and abort these steps. - 8. If response's Content Type metadata, if any, specifies a character encoding, + 8. If response's Content-Type metadata, if any, specifies a character encoding, and the user agent supports that encoding, then set character encoding to that encoding (ignoring the passed-in value). 9. Let source text be the result of decoding response's @@ -244,26 +245,29 @@ text and settings object. 9. Asynchronously complete this algorithm with script. - To fetch a module script tree given a url, a credentials mode, a + To fetch a module script tree + given a url, a credentials mode, a cryptographic nonce, a parser state, a destination, a - settings object, and an optional ancestor list, run these steps. The - algorithm will asynchronously complete with either null (on failure) or a new + fetch client settings object, and an optional ancestor list, run these + steps. The algorithm will asynchronously complete with either null (on failure) or a new module script (on success). 1. If ancestor list is not given, let it be an empty list. - 2. Fetch a single module script given url, credentials mode, + 2. If module map settings object is not given, let it be fetch client settings + object. + 3. Fetch a single module script given url, credentials mode, cryptographic nonce, parser state, destination, and - settings object. If the caller of this algorithm specified custom set up the - request or process the response steps, pass those along while fetching a single - module script. - 3. Return from this algorithm and run the following steps when fetching a single module + module map settings object. If the caller of this algorithm specified custom + set up the request or process the response steps, pass those along while + fetching a single module script. + 4. Return from this algorithm and run the following steps when fetching a single module script asynchronously completes with result: - 4. If result is null, asynchronously complete this algorithm with null and abort these + 5. If result is null, asynchronously complete this algorithm with null and abort these steps. - 5. Otherwise, result is a module script. Fetch the descendants of + 6. Otherwise, result is a module script. Fetch the descendants of result given destination and an ancestor list obtained by appending url to ancestor list. - 6. When fetching the descendants of a module script asynchronously completes with + 7. When fetching the descendants of a module script asynchronously completes with descendants result, asynchronously complete this algorithm with descendants result. @@ -272,7 +276,8 @@ The following algorithms are used when fetching a module script tree, and are not meant to be used directly by other specifications (or by other parts of this specification). - To fetch the descendants of a module script module script, given a + To fetch the descendants of a module script + module script, given a destination and an ancestor list, run these steps. The algorithm will asynchronously complete with either null (on failure) or with module script (on success). @@ -307,7 +312,8 @@ Once all of the fetch a module script tree invocations asynchronously complete with a module script, asynchronously complete this algorithm with module script. - To fetch a single module script, given a url, a + To fetch a single module script, + given a url, a credentials mode, a cryptographic nonce, a parser state, a destination, and a settings object, run these steps. The algorithm will asynchronously complete with either null (on failure) or a module script (on success). @@ -403,9 +409,9 @@ a credentials mode, a cryptographic nonce, and a parser state: 11. Set script's parser state to the parser state. 12. Return script. -
    Calling scripts
    +
    Calling scripts
    - To run a classic script + To run a classic script given a classic script s and an optional rethrow errors flag: 1. Let settings be the settings object of s. @@ -526,8 +532,9 @@ a credentials mode, a cryptographic nonce, and a parser state: object. * A JavaScript realm has a \[[GlobalObject]] field, which contains the Realm's global object. - * Each global object in this specification is created during the initialization of a - corresponding JavaScript realm, known as the global object's Realm. + * Each global object in this specification is created during the + initialization of a corresponding + JavaScript realm, known as the global object's Realm. * Each global object in this specification is created alongside a corresponding environment settings object, known as its relevant settings object. * An environment settings object's realm execution context's Realm component is @@ -675,8 +682,8 @@ a credentials mode, a cryptographic nonce, and a parser state:
    Entry
    All realm execution contexts must contain, as part of their code evaluation state, an - entrance counter value, which is initially zero. In the process of calling - scripts, this value will be incremented and decremented. + entrance counter value, which is initially zero. In the process of calling scripts, + this value will be incremented and decremented. With this in hand, we define the entry execution context to be the most recently pushed entry in the JavaScript execution context stack whose entrance counter value is @@ -693,7 +700,7 @@ a credentials mode, a cryptographic nonce, and a parser state: The incumbent settings object is determined as follows: - 1. Let scriptOrModule be the result of JavaScript's GetActiveScriptOrModule() + 1. Let scriptOrModule be the result of JavaScript's GetActiveScriptOrModule() abstract operation. 2. If scriptOrModule is null, abort these steps; there is no incumbent settings object. @@ -747,10 +754,11 @@ a credentials mode, a cryptographic nonce, and a parser state:
    Killing scripts
    Although the JavaScript specification does not account for this possibility, it's sometimes - necessary to abort a running script. This causes any ScriptEvaluation or - ModuleEvaluation to cease immediately, emptying the JavaScript execution context - stack without triggering any of the normal mechanisms like finally blocks. - [[ECMA-262]] + necessary to + abort a running script. + This causes any ScriptEvaluation or ModuleEvaluation to cease immediately, emptying + the JavaScript execution context stack without triggering any of the normal mechanisms like + finally blocks. [[ECMA-262]] User agents may impose resource limitations on scripts, for example CPU quotas, memory limits, total execution time limits, or bandwidth limitations. When a script exceeds a limit, the user @@ -838,7 +846,7 @@ a credentials mode, a cryptographic nonce, and a parser state: A module map is a map of absolute URLs to values that are either a module script, null, or a placeholder value "fetching". Module maps are used to ensure that imported JavaScript modules are only fetched, parsed, and evaluated once per - {{Document}} or worker. + {{Document}} or {{Worker}}. To resolve a module specifier given a module script script and a string specifier, perform the @@ -876,7 +884,8 @@ a credentials mode, a cryptographic nonce, and a parser state:
    Runtime script errors
    - When the user agent is required to report an error for a + When the user agent is required to + report an error for a particular script script with a particular position line:col, using a particular target target, it must run these steps, after which the error is either handled or @@ -930,7 +939,7 @@ a credentials mode, a cryptographic nonce, and a parser state: When the user agent is to report an exception E, the - user agent must report the error for the relevant script, with the + user agent must report the error for the relevant script, with the problematic position (line number and column number) in the resource containing the script, using the global object specified by the script's settings object as the target. If the error is still not handled after this, then the error may be reported to a @@ -1072,7 +1081,7 @@ a credentials mode, a cryptographic nonce, and a parser state: To coordinate events, user interaction, scripts, rendering, networking, and so forth, user agents must use event loops as described in this section. There are two kinds of event loops: those for browsing contexts, and those for - {{worker|workers}}. + {{Worker|workers}}. There must be at least one browsing context event loop per user agent, and at most one per unit of related similar-origin browsing contexts. @@ -1127,7 +1136,7 @@ a credentials mode, a cryptographic nonce, and a parser state: responsible document specified by the script's settings object. A task is intended for a specific event loop: the event loop that is handling - tasks for the task's associated {{Document}} or {{worker}}. + tasks for the task's associated {{Document}} or {{Worker}}. When a user agent is to queue a task, it must add the given task to one of the task queues of the relevant event loop. @@ -1148,9 +1157,9 @@ a credentials mode, a cryptographic nonce, and a parser state:

    Each event loop has a currently running task. Initially, this is null. - It is used to handle reentrancy. Each event loop also has a performing a - microtask checkpoint flag, which must initially be false. It is used to prevent reentrant - invocation of the perform a microtask checkpoint algorithm. + It is used to handle reentrancy. Each event loop also has a + performing a microtask checkpoint flag, which must initially be false. It is used to + prevent reentrant invocation of the perform a microtask checkpoint algorithm.
    Processing model
    @@ -1167,7 +1176,7 @@ a credentials mode, a cryptographic nonce, and a parser state: 5. Remove the task that was run in the Run step above from its task queue. 6. Microtasks: Perform a microtask checkpoint. 7. Update the rendering: If this event loop is a browsing context - event loop (as opposed to a {{worker}} event loop), then run the following + event loop (as opposed to a {{Worker}} event loop), then run the following substeps. 1. Let now be the value that would be returned by the {{Performance}} object's @@ -1203,9 +1212,9 @@ a credentials mode, a cryptographic nonce, and a parser state:

    Another example of why a browser might skip updating the rendering is to ensure certain tasks are executed immediately after each other, with only - microtask checkpoints interleaved (and without, e.g., animation frame - callbacks interleaved). For example, a user agent might wish to coalesce timer - callbacks together, with no intermediate rendering updates.

    + microtask checkpoints interleaved (and without, e.g., + animation frame callbacks interleaved). For example, a user agent might wish to + coalesce timer callbacks together, with no intermediate rendering updates.

    4. If there are a nested browsing contexts B that the user agent believes would not benefit from having their rendering updated at this time, then remove from docs all {{Document}} objects whose browsing context is in B. @@ -1223,21 +1232,22 @@ a credentials mode, a cryptographic nonce, and a parser state: 7. For each fully active {{Document}} in docs, evaluate media queries and report changes for that {{Document}}, passing in now as the timestamp. [[!CSSOM-VIEW]] - 8. For each fully active {{Document}} in docs, run CSS animations and - send events for that {{Document}}, passing in now as the timestamp. - [[CSS3-ANIMATIONS]] - 9. For each fully active {{Document}} in docs, run the fullscreen - rendering steps for that {{Document}}, passing in now as the timestamp. - [[!FULLSCREEN]] - 10. For each fully active {{Document}} in docs, run the animation frame - callbacks for that {{Document}}, passing in now as the timestamp. - 11. For each fully active {{Document}} in docs, run the update - intersection observations steps for that {{Document}}, passing in now as - the timestamp. + 8. For each fully active {{Document}} in docs, + run CSS animations and send events for that {{Document}}, passing in + now as the timestamp. [[CSS3-ANIMATIONS]] + 9. For each fully active {{Document}} in docs, + run the fullscreen rendering steps for that {{Document}}, passing in + now as the timestamp. [[!FULLSCREEN]] + 10. For each fully active {{Document}} in docs, + run the animation frame callbacks for that {{Document}}, passing in + now as the timestamp. + 11. For each fully active {{Document}} in docs, + run the update intersection observations steps for that {{Document}}, passing in + now as the timestamp. 12. For each fully active {{Document}} in docs, update the rendering or user interface of that {{Document}} and its browsing context to reflect the current state. - 8. If this is a {{worker}} event loop (i.e., one running for a {{WorkerGlobalScope}}), but + 8. If this is a {{Worker}} event loop (i.e., one running for a {{WorkerGlobalScope}}), but there are no tasks in the event loop's task queues and the {{WorkerGlobalScope}} object's closing flag is true, then destroy the event loop, aborting these steps, resuming the run a worker steps. @@ -1265,11 +1275,11 @@ a credentials mode, a cryptographic nonce, and a parser state: microtask is irrelevant.

    When a user agent is to - perform a microtask checkpoint, - if the performing a microtask checkpoint flag is false, then the user agent must run the + perform a microtask checkpoint, + if the performing a microtask checkpoint flag is false, then the user agent must run the following steps: - 1. Let the performing a microtask checkpoint flag be true. + 1. Let the performing a microtask checkpoint flag be true. 2. Microtask queue handling: If the event loop's microtask queue is empty, jump to the Done step below. 3. Select the oldest microtask on the event loop's microtask queue. @@ -1278,16 +1288,16 @@ a credentials mode, a cryptographic nonce, and a parser state: 5. Run: Run the selected task.

    This might involve invoking scripted callbacks, which eventually calls the - clean up after running script steps, which call this perform a microtask - checkpoint algorithm again, which is why we use the performing a microtask - checkpoint flag to avoid reentrancy.

    + clean up after running script steps, which call this + perform a microtask checkpoint algorithm again, which is why we use the + performing a microtask checkpoint flag to avoid reentrancy.

    6. Set the event loop's currently running task back to null. 7. Remove the microtask run in the step above from the microtask queue, and return to the Microtask queue handling step. 8. Done: For each environment settings object whose responsible event loop is this event loop, notify about rejected promises on that environment settings object. - 9. Let the performing a microtask checkpoint flag be false. + 9. Let the performing a microtask checkpoint flag be false. If, while a compound microtask is running, the user agent is required to execute a compound microtask subtask @@ -1632,7 +1642,7 @@ a credentials mode, a cryptographic nonce, and a parser state: 2. Report the error for the appropriate script and with the appropriate position (line number and column number) given by location, using the global object specified by script settings as the target. - If the error is still not handled after this, then the error + If the error is still not handled after this, then the error may be reported to a developer console. 3. Return null. 8. If body begins with a Directive Prologue that contains a Use Strict @@ -3326,8 +3336,8 @@ a credentials mode, a cryptographic nonce, and a parser state: origin. If it is, then the browsing context's dialog arguments must be returned unchanged. Otherwise, the IDL attribute must return undefined. - These browsing contexts also have an associated return value and return value - origin. As with the previous two values, these values are set by the showModalDialog() method in the algorithm above, when the + These browsing contexts also have an associated return value and + return value origin. As with the previous two values, these values are set by the showModalDialog() method in the algorithm above, when the browsing context is created. The returnValue IDL attribute, on @@ -4624,7 +4634,7 @@ a credentials mode, a cryptographic nonce, and a parser state:
  • If this fails, return 0 and abort these steps.
  • -
  • Let host2 be the host component +
  • Let host2 be the host component of the resulting URL string.
  • diff --git a/single-page.bs b/single-page.bs index 4e2da69cf2..aacd824d46 100644 --- a/single-page.bs +++ b/single-page.bs @@ -33,8 +33,7 @@ Ignored Vars: this, object, variable, optionalArgument, name, value, e, oldParen urlPrefix: http://validator.w3.org/nu/; url:; type:dfn; text: Nu Markup Validation Service; -urlPrefix: http://www.w3.org/TR/cssom-view/; type: interface; spec: cssom-view; - text: screen; + urlPrefix: http://www.whatwg.org/specs/web-apps/current-work/; url:; type: dfn; spec: WHATWG; text: WHATWG HTML specification; url: http://www.w3.org/TR/REC-xml-names#NT-QName; type: dfn; @@ -169,34 +168,6 @@ url: http://www.w3.org/TR/WebIDL-1/#idl-DOMString; type: interface; text: DOMString[] url: http://www.w3.org/TR/WebIDL-1/#TreatNullAs; type: interface; spec: webidl; text: EmptyString -url: http://www.ecma-international.org/ecma-262/6.0/#sec-array-constructor; type: dfn; spec: ecma-262; - text: Array -url: http://www.ecma-international.org/ecma-262/6.0/#sec-boolean-constructor; type: dfn; spec: ecma-262; - text: Boolean -url: http://www.ecma-international.org/ecma-262/6.0/#sec-date-constructor; type: interface; spec: ecma-262; - text: Date -url: http://www.ecma-international.org/ecma-262/6.0/#sec-function-constructor; type: dfn; spec: ecma-262; - text: Function -url: http://www.ecma-international.org/ecma-262/6.0/#sec-map-constructor; type: dfn; spec: ecma-262; - text: Map -url: http://www.ecma-international.org/ecma-262/6.0/#sec-number-constructor; type: dfn; spec: ecma-262; - text: Number -url: http://www.ecma-international.org/ecma-262/6.0/#sec-object-constructor; type: dfn; spec: ecma-262; - text: Object -url: http://www.ecma-international.org/ecma-262/6.0/#sec-regexp-constructor; type: dfn; spec: ecma-262; - text: Regexp -url: http://www.ecma-international.org/ecma-262/6.0/#sec-set-constructor; type: type; spec: ecma-262; - text: Set -url: http://www.ecma-international.org/ecma-262/6.0/#sec-string-constructor; type: dfn; spec: ecma-262; - text: String -urlPrefix: http://www.ecma-international.org/ecma-262/6.0/#sec-native-error-types-used-in-this-standard-; type: interface; spec: ecma-262; for: ecma; - text: TypeError - text: SyntaxError - text: RangeError -url: http://www.ecma-international.org/ecma-262/6.0/#sec-typedarray-constructors; type: dfn; spec: ecma-262; - text: Uint8ClampedArray -url: http://www.ecma-international.org/ecma-262/6.0/#sec-arraybuffer-constructor; type: dfn; spec: ecma-262; - text: ArrayBuffer url: http://www.w3.org/TR/webmessaging/#messageport; type: interface; spec: html-ls; text: MessagePort urlPrefix: http://www.w3.org/TR/dom/#concept-node-; type: dfn; for: Node; spec: dom; @@ -243,24 +214,6 @@ urlPrefix: https://w3c.github.io/DOM-Parsing/#widl-Element-; type: attribute; fo text: outerHTML; url: outerHTML url: https://fullscreen.spec.whatwg.org/#dom-element-requestfullscreen; type: method; for: Element; spec: fullscreen; text: requestFullscreen() -urlPrefix: https://drafts.csswg.org/cssom/#concept-css-style-sheet-; type: dfn; spec: cssom; for: stylesheet; - text: alternate flag - text: disabled flag - text: CSS rules - text: origin-clean flag -urlPrefix: https://drafts.csswg.org/cssom/#dom-stylesheet-; type: dfn; spec: cssom; for: stylesheet; - text: type - text: owner node; url: ownernode - text: parent CSS style sheet; url: parentstylesheet - text: media - text: title -url: https://drafts.csswg.org/cssom/#dom-cssstylesheet-ownerrule; type: dfn; spec: cssom; for: cssstylesheet; - text: owner CSS rule -url: https://drafts.csswg.org/cssom/#enabled-css-style-sheet-set; type: dfn; spec: cssom; - text: Alternative style sheet sets - text: preferred style sheet set -url: https://drafts.csswg.org/cssom/#serializing-css-values; type: dfn; spec: cssom; - text: Serializing a CSS value url: http://www.w3.org/TR/CSS21/ui.html#system-colors; type: dfn; spec: css21 text: CSS2 System Colors url: http://www.w3.org/TR/CSS21/box.html#value-def-margin-width; type: value; spec: css21; for: margin-left; @@ -383,10 +336,6 @@ url: http://www.w3.org/TR/jlreq/#positioning_of_jukugoruby; type: dfn; spec: jlr text: jukugo ruby rendering url: https://w3c.github.io/aria-in-html/#rec; type: dfn; spec: aria-in-html; text: Recommendations Table -url: https://tc39.github.io/ecma262/#directive-prologue; type: dfn; spec: ecma-262; - text: Directive Prologue -url: https://tc39.github.io/ecma262/#sec-code-realms; type: dfn; spec: ecma-262; - text: JavaScript realm url: https://wiki.whatwg.org/wiki/PragmaExtensions#content; type: dfn; text: WHATWG Wiki PragmaExtensions page url: http://www.w3.org/TR/WCAG20/#text-altdef; type: dfn; @@ -424,14 +373,9 @@ url: http://wiki.whatwg.org/wiki/CanvasContexts#content; type: dfn; text: WHATWG Wiki CanvasContexts page url: http://www.whatwg.org/demos/offline/clock/live-demo/clock.html#clock; type: dfn; text: view this example online -url: https://tc39.github.io/ecma262/#execution-context-stack; type: dfn; - text: javascript execution context stack url: https://html.spec.whatwg.org/#run-the-animation-frame-callbacks; type: dfn; text: run the animation frame callbacks - -url: https://tc39.github.io/ecma262/#sec-functioncreate; type: dfn; - text: FunctionCreate - + text: animation frame callbacks url: http://www.w3.org/TR/2dcontext/#imagedata; type: interface; text: ImageData url: https://www.w3.org/TR/CSP3/#policy; type: dfn; @@ -461,152 +405,143 @@ url: https://w3c.github.io/webappsec-csp/#initialize-document-csp; type: dfn; url: https://w3c.github.io/webappsec-csp/#should-block-inline; type: dfn; text: Should element's inline behavior be blocked by Content Security Policy? -url: https://tc39.github.io/ecma262/#sec-automatic-semicolon-insertion; type: dfn; spec: ecma-262; - text: automatic semicolon insertion -url: https://tc39.github.io/ecma262/#early-error-rule; type: dfn; spec: ecma-262; - text: early error -url: https://tc39.github.io/ecma262/#directive-prologue; type: dfn; spec: ecma-262; - text: Directive Prologue -url: https://tc39.github.io/ecma262/#sec-execution-contexts; type: dfn; spec: ecma-262; - text: JavaScript execution context -url: https://tc39.github.io/ecma262/#execution-context-stack; type: dfn; spec: ecma-262; - text: JavaScript execution context stack -url: https://tc39.github.io/ecma262/#running-execution-context; type: dfn; spec: ecma-262; - text: running JavaScript execution context -url: https://tc39.github.io/ecma262/#sec-code-realms; type: dfn; spec: ecma-262; - text: JavaScript realm -url: https://tc39.github.io/ecma262/#current-realm; type: dfn; spec: ecma-262; - text: current Realm Record -url: https://tc39.github.io/ecma262/#use-strict-directive; type: dfn; spec: ecma-262; - text: Use Strict Directive -url: https://tc39.github.io/ecma262/#sec-well-known-symbols; type: dfn; spec: ecma-262; - text: Well-Known Symbols -url: https://tc39.github.io/ecma262/#sec-well-known-intrinsic-objects; type: dfn; spec: ecma-262; - text: Well-Known Intrinsic Objects -url: https://tc39.github.io/ecma262/#sec-arraybuffer-constructor; type: dfn; spec: ecma-262; - text: %ArrayBuffer% -url: https://tc39.github.io/ecma262/#sec-properties-of-the-array-prototype-object; type: dfn; spec: ecma-262; - text: %ArrayPrototype% -url: https://tc39.github.io/ecma262/#sec-object.prototype.tostring; type: dfn; spec: ecma-262; - text: %ObjProto_toString% -url: https://tc39.github.io/ecma262/#sec-object.prototype.valueof; type: dfn; spec: ecma-262; - text: %ObjProto_valueOf% -url: https://tc39.github.io/ecma262/#prod-FunctionBody; type: dfn; spec: ecma-262; - text: FunctionBody -url: https://tc39.github.io/ecma262/#prod-Module; type: dfn; spec: ecma-262; - text: Module -url: https://tc39.github.io/ecma262/#prod-Pattern; type: dfn; spec: ecma-262; - text: Pattern -url: https://tc39.github.io/ecma262/#prod-Script; type: dfn; spec: ecma-262; for: ecma; - text: Script -url: https://tc39.github.io/ecma262/#sec-ecmascript-data-types-and-values; type: dfn; spec: ecma-262; for: ecma; - text: Type -url: https://tc39.github.io/ecma262/#sec-list-and-record-specification-type; type: dfn; spec: ecma-262; for: ecma; - text: List - text: Record -url: https://tc39.github.io/ecma262/#sec-property-descriptor-specification-type; type: dfn; spec: ecma-262; - text: Property Descriptor -url: https://tc39.github.io/ecma262/#sec-source-text-module-records; type: dfn; spec: ecma-262; - text: Source Text Module Record -url: https://tc39.github.io/ecma262/#sec-moduleevaluation; type: dfn; spec: ecma-262; - text: ModuleEvaluation -url: https://tc39.github.io/ecma262/#sec-moduledeclarationinstantiation; type: dfn; spec: ecma-262; - text: ModuleDeclarationInstantiation -url: https://tc39.github.io/ecma262/#sec-arraycreate; type: dfn; spec: ecma-262; - text: ArrayCreate -url: https://tc39.github.io/ecma262/#sec-call; type: dfn; spec: ecma-262; - text: Call -url: https://tc39.github.io/ecma262/#sec-clonearraybuffer; type: dfn; spec: ecma-262; - text: CloneArrayBuffer -url: https://tc39.github.io/ecma262/#sec-construct; type: dfn; spec: ecma-262; - text: Construct -url: https://tc39.github.io/ecma262/#sec-createdataproperty; type: dfn; spec: ecma-262; - text: CreateDataProperty -url: https://tc39.github.io/ecma262/#sec-detacharraybuffer; type: dfn; spec: ecma-262; - text: DetachArrayBuffer -url: https://tc39.github.io/ecma262/#sec-enqueuejob; type: dfn; spec: ecma-262; - text: EnqueueJob -url: https://tc39.github.io/ecma262/#sec-functioncreate; type: dfn; spec: ecma-262; - text: FunctionCreate -url: https://tc39.github.io/ecma262/#sec-get-o-p; type: dfn; spec: ecma-262; for: ecma; - text: Get -url: https://tc39.github.io/ecma262/#sec-getactivescriptormodule; type: method; spec: ecma-262; - text: GetActiveScriptOrModule() -url: https://tc39.github.io/ecma262/#sec-getfunctionrealm; type: dfn; spec: ecma-262; - text: GetFunctionRealm -url: https://tc39.github.io/ecma262/#sec-hasownproperty; type: dfn; spec: ecma-262; - text: HasOwnProperty -url: https://tc39.github.io/ecma262/#sec-hostensurecancompilestrings; type: dfn; spec: ecma-262; - text: HostEnsureCanCompileStrings -url: https://tc39.github.io/ecma262/#sec-host-promise-rejection-tracker; type: dfn; spec: ecma-262; - text: HostPromiseRejectionTracker -url: https://tc39.github.io/ecma262/#sec-hostresolveimportedmodule; type: dfn; spec: ecma-262; - text: HostResolveImportedModule -url: https://tc39.github.io/ecma262/#sec-initializehostdefinedrealm; type: method; spec: ecma-262; - text: InitializeHostDefinedRealm() -url: https://tc39.github.io/ecma262/#sec-isaccessordescriptor; type: dfn; spec: ecma-262; - text: IsAccessorDescriptor -url: https://tc39.github.io/ecma262/#sec-iscallable; type: dfn; spec: ecma-262; - text: IsCallable -url: https://tc39.github.io/ecma262/#sec-isconstructor; type: dfn; spec: ecma-262; - text: IsConstructor -url: https://tc39.github.io/ecma262/#sec-isdatadescriptor; type: dfn; spec: ecma-262; - text: IsDataDescriptor -url: https://tc39.github.io/ecma262/#sec-isdetachedbuffer; type: dfn; spec: ecma-262; - text: IsDetachedBuffer -url: https://tc39.github.io/ecma262/#sec-newobjectenvironment; type: dfn; spec: ecma-262; - text: NewObjectEnvironment -url: https://tc39.github.io/ecma262/#sec-ordinarygetprototypeof; type: dfn; spec: ecma-262; - text: OrdinaryGetPrototypeOf -url: https://tc39.github.io/ecma262/#sec-ordinarysetprototypeof; type: dfn; spec: ecma-262; - text: OrdinarySetPrototypeOf -url: https://tc39.github.io/ecma262/#sec-ordinaryisextensible; type: dfn; spec: ecma-262; - text: OrdinaryIsExtensible -url: https://tc39.github.io/ecma262/#sec-ordinarypreventextensions; type: dfn; spec: ecma-262; - text: OrdinaryPreventExtensions -url: https://tc39.github.io/ecma262/#sec-ordinarygetownproperty; type: dfn; spec: ecma-262; - text: OrdinaryGetOwnProperty -url: https://tc39.github.io/ecma262/#sec-ordinarydefineownproperty; type: dfn; spec: ecma-262; - text: OrdinaryDefineOwnProperty -url: https://tc39.github.io/ecma262/#sec-ordinaryget; type: dfn; spec: ecma-262; - text: OrdinaryGet -url: https://tc39.github.io/ecma262/#sec-ordinaryset; type: dfn; spec: ecma-262; - text: OrdinarySet -url: https://tc39.github.io/ecma262/#sec-ordinarydelete; type: dfn; spec: ecma-262; - text: OrdinaryDelete -url: https://tc39.github.io/ecma262/#sec-ordinaryownpropertykeys; type: dfn; spec: ecma-262; - text: OrdinaryOwnPropertyKeys -url: https://tc39.github.io/ecma262/#sec-parsemodule; type: dfn; spec: ecma-262; - text: ParseModule -url: https://tc39.github.io/ecma262/#sec-parse-script; type: dfn; spec: ecma-262; - text: ParseScript -url: https://tc39.github.io/ecma262/#sec-runjobs; type: dfn; spec: ecma-262; - text: RunJobs -url: https://tc39.github.io/ecma262/#sec-samevalue; type: dfn; spec: ecma-262; - text: SameValue -url: https://tc39.github.io/ecma262/#sec-runtime-semantics-scriptevaluation; type: dfn; spec: ecma-262; - text: ScriptEvaluation -url: https://tc39.github.io/ecma262/#sec-toboolean; type: dfn; spec: ecma-262; - text: ToBoolean -url: https://tc39.github.io/ecma262/#sec-tostring; type: dfn; spec: ecma-262; - text: ToString -url: https://tc39.github.io/ecma262/#sec-touint32; type: dfn; spec: ecma-262; - text: ToUint32 -url: https://tc39.github.io/ecma262/#typedarray-create; type: dfn; spec: ecma-262; - text: TypedArrayCreate -url: https://tc39.github.io/ecma262/#sec-abstract-equality-comparison; type: dfn; spec: ecma-262; - text: Abstract Equality Comparison -url: https://tc39.github.io/ecma262/#sec-strict-equality-comparison; type: dfn; spec: ecma-262; - text: Strict Equality Comparison -url: https://tc39.github.io/ecma262/#sec-typeof-operator; type: dfn; spec: ecma-262; - text: typeof -url: https://tc39.github.io/ecma262/#table-49; type: dfn; spec: ecma-262; - text: The TypedArray Constructors + + +urlPrefix: http://www.w3.org/TR/cssom-view/#; type: interface; spec: CSSOM-VIEW; + text: screen; + +urlPrefix: https://drafts.csswg.org/cssom/#; spec: CSSOM-VIEW; + urlPrefix: concept-css-style-sheet-; type: dfn; for: stylesheet; + text: alternate flag + text: disabled flag + text: CSS rules + text: origin-clean flag + urlPrefix: dom-; type: dfn; + urlPrefix: cssstylesheet-; for: cssstylesheet; + text: owner CSS rule; url: ownerrule + urlPrefix: stylesheet-; for: stylesheet; + text: type + text: owner node; url: ownernode + text: parent CSS style sheet; url: parentstylesheet + text: media + text: title + url: enabled-css-style-sheet-set; type: dfn; + text: Alternative style sheet sets + text: preferred style sheet set + text: evaluate media queries and report changes; type: dfn + text: run the resize steps; type: dfn + text: run the scroll steps; type: dfn + text: Serializing a CSS value; url: serializing-css-values; type: dfn + text: the features argument of window.open; url: the-features-argument-to-the-open()-method; type: dfn + urlPrefix: http://www.w3.org/TR/DOM-Parsing/#; spec: DOMPARSING; text: DOMParser; url: the-domparser-interface; type: interface + + +urlPrefix: http://www.ecma-international.org/ecma-262/6.0/#; spec: ECMA-262; + urlPrefix: sec-; type: interface; + text: Array; url: array-constructor + text: ArrayBuffer; url: arraybuffer-constructor + text: Boolean; url: boolean-constructor + text: Date; url: date-constructor + text: Error; url: error-constructor + text: Function; url: function-constructor + text: Map; url: map-constructor + urlPrefix: native-error-types-used-in-this-standard-; + text: RangeError + text: SyntaxError + text: TypeError + text: Number; url: number-constructor + text: Object; url: object-constructor + text: RegExp; url: regexp-constructor + text: Set; url: set-constructor + text: String; url: string-constructor + +urlPrefix: https://tc39.github.io/ecma262/#; type: dfn; spec: ECMA-262; + url: current-realm + text: current Realm Record + text: current Realm + text: Directive Prologue + text: early error; url: early-error-rule + urlPrefix: prod-; + text: FunctionBody + text: Module + text: Pattern + text: Script; for: ecma + urlPrefix: sec-; + text: Abstract Equality Comparison + text: %ArrayBuffer%; url: arraybuffer-constructor + text: ArrayCreate + text: %ArrayPrototype%; url: properties-of-the-array-prototype-object + text: automatic semicolon insertion + text: Call + text: CloneArrayBuffer + url: code-realms + text: JavaScript realm + text: Realm + text: Construct + text: CreateDataProperty + text: DetachArrayBuffer + text: EnqueueJob + text: FunctionCreate + text: Get; url: get-o-p; for: ecma + text: GetActiveScriptOrModule + text: GetFunctionRealm + text: HasOwnProperty + text: HostEnsureCanCompileStrings + text: HostPromiseRejectionTracker; url: host-promise-rejection-tracker + text: HostResolveImportedModule + text: InitializeHostDefinedRealm + text: IsAccessorDescriptor + text: IsCallable + text: IsConstructor + text: IsDataDescriptor + text: IsDetachedBuffer + text: JavaScript execution context; url: execution-contexts + text: JavaScript execution context stack; url: execution-context-stack + url: list-and-record-specification-type; for: ecma + text: List + text: Record + text: ModuleDeclarationInstantiation + text: ModuleEvaluation + text: NewObjectEnvironment + text: %ObjProto_toString%; url: object.prototype.tostring + text: %ObjProto_valueOf%; url: object.prototype.valueof + text: OrdinaryGetPrototypeOf + text: OrdinarySetPrototypeOf + text: OrdinaryIsExtensible + text: OrdinaryPreventExtensions + text: OrdinaryGetOwnProperty + text: OrdinaryDefineOwnProperty + text: OrdinaryGet + text: OrdinarySet + text: OrdinaryDelete + text: OrdinaryOwnPropertyKeys + text: ParseModule + text: ParseScript; url: parse-script + url: property-descriptor-specification-type + text: Property Descriptor + text: PropertyDescriptor + text: RunJobs + text: running JavaScript execution context; url: running-execution-context + text: SameValue + text: ScriptEvaluation; url: runtime-semantics-scriptevaluation + text: Source Text Module Record; url: source-text-module-records + text: Strict Equality Comparison + text: ToBoolean + text: ToString + text: ToUint32 + text: Type; url: ecmascript-data-types-and-values; for: ecma + text: typeof; url: typeof-operator + text: Well-Known Intrinsic Objects + text: Well-Known Symbols + text: The TypedArray Constructors; url: table-49 + text: TypedArrayCreate; url: typedarray-create + text: Use Strict Directive + urlPrefix: https://fetch.spec.whatwg.org/#; type: dfn; spec: FETCH; @@ -619,7 +554,9 @@ urlPrefix: https://fetch.spec.whatwg.org/#; type: dfn; spec: FETCH; urlPrefix: fetch-; text: terminate urlPrefix: header-; - text: extract a MIME type; url: extract-mime-type + url: extract-mime-type + text: extract a MIME type + text: extracting a MIME type urlPrefix: list-; for: header list text: set text: header list @@ -627,7 +564,9 @@ urlPrefix: https://fetch.spec.whatwg.org/#; type: dfn; spec: FETCH; text: internal response text: method text: referrer policy + text: response url text: request + text: request url urlPrefix: request-; for: request text: body text: cache mode @@ -670,6 +609,11 @@ urlPrefix: https://fetch.spec.whatwg.org/#; type: dfn; spec: FETCH; text: synchronous flag text: unsafe-request flag + + +urlPrefix: https://wicg.github.io/IntersectionObserver/#; spec: INTERSECTION-OBSERVER; type: dfn; + text: run the update intersection observations steps + urlPrefix: http://www.w3.org/TR/uievents/#; spec: UIEVENTS @@ -712,14 +656,20 @@ urlPrefix: http://www.w3.org/TR/uievents/#; spec: UIEVENTS text: view - + urlPrefix: https://url.spec.whatwg.org/#; type: dfn; spec: URL; urlPrefix: concept-; text: basic url parser - text: domain - text: host - text: serialization; url: url-serializer; for: url + text: domain; for: url + text: domain to ascii + text: domain to unicode + text: host; for: host-concept + text: host serializer text: url parser + url: url-serializer; for: url + text: serialization + text: serialized + text: URL serializer urlPrefix: url-; for: url; text: fragment text: host @@ -731,11 +681,22 @@ urlPrefix: https://url.spec.whatwg.org/#; type: dfn; spec: URL; text: url text: username text: default encode set + text: fragment state + text: network scheme + text: host state + text: hostname state text: non-relative-flag + text: path start state + text: percent decode text: percent encode + text: port state + text: query state + text: scheme start state + text: serialize an integer + text: set the username + text: set the password urlPrefix: syntax- text: relative schemes; url: url-scheme-relative - text: scheme data; url: url-scheme text: Parse errors; url: violation; for: url url: url-parsing; text: parsed url @@ -744,15 +705,14 @@ urlPrefix: https://url.spec.whatwg.org/#; type: dfn; spec: URL; -urlPrefix: https://www.w3.org/TR/workers/; type: interface; spec: WORKERS; - text: worker - text: WorkerGlobalScope -urlPrefix: https://www.w3.org/TR/workers/#; type: dfn; spec: WORKERS; - text: run a worker -url: https://www.w3.org/TR/workers/#the-event-loop; type: dfn; spec: WORKERS; - text: Worker event loops -url: https://www.w3.org/TR/workers/#processing-model; type: dfn; spec: WORKERS; - text: worker processing model +urlPrefix: https://www.w3.org/TR/workers/#; spec: WORKERS; + text: closing; url: dom-workerglobalscope-closing; type: dfn + text: run a worker; type: dfn + text: Worker; type: interface + text: Worker event loops; url: the-event-loop; type: dfn + text: worker processing model; url: processing-model; type: dfn + text: WorkerGlobalScope; url: workerglobalscope; type: interface + From 969657213f392a313aa0f1f354deafa160799a46 Mon Sep 17 00:00:00 2001 From: Travis Leithead Date: Thu, 12 May 2016 18:24:30 -0700 Subject: [PATCH 12/19] fixes more linking issues --- sections/browsers.include | 1159 ++++++++----------- sections/infrastructure.include | 4 +- sections/obsolete.include | 9 +- sections/semantics-embedded-content.include | 18 +- sections/webappapis.include | 8 +- single-page.bs | 78 +- 6 files changed, 555 insertions(+), 721 deletions(-) diff --git a/sections/browsers.include b/sections/browsers.include index c8f611399d..df102b00cf 100644 --- a/sections/browsers.include +++ b/sections/browsers.include @@ -104,7 +104,7 @@

    Nested browsing contexts

    Certain elements (for example, <{iframe}> elements) can instantiate further browsing contexts. These are called nested browsing contexts. If a browsing context P has a - Document D with an element E that nests + {{Document}} D with an element E that nests another browsing context C inside it, then C is said to be nested through D, and E is said to be the browsing context container of C. If the browsing context container element E is in the Document D, then P is @@ -124,7 +124,7 @@ The transitive closure of parent browsing contexts for a nested browsing context gives the list of ancestor browsing contexts. - The list of the descendant browsing contexts of a Document d is the (ordered) list returned by the following algorithm: + The list of the descendant browsing contexts of a {{Document}} d is the (ordered) list returned by the following algorithm:
      @@ -151,27 +151,27 @@
    - A Document is said to be fully active when it has a browsing context and it is the active document of - that browsing context, and either its browsing context is a top-level browsing context, or it has a parent browsing context and the Document + A {{Document}} is said to be fully active when it has a browsing context and it is the active document of + that browsing context, and either its browsing context is a top-level browsing context, or it has a parent browsing context and the {{Document}} through which it is nested is itself fully active. Because they are nested through an element, child browsing - contexts are always tied to a specific Document in their parent browsing - context. User agents must not allow the user to interact with child browsing contexts of elements that are in Documents that are + contexts are always tied to a specific {{Document}} in their parent browsing + context. User agents must not allow the user to interact with child browsing contexts of elements that are in {{Document}}s that are not themselves fully active. A nested browsing context can have a seamless browsing context flag set, if it is embedded through an <{iframe}> element with a seamless attribute. A nested browsing context can be put into a delaying load events mode. This is used when it is navigated, to delay the load event of the browsing - context container before the new Document is created. + context container before the new {{Document}} is created. The document family of a browsing context consists of the union of all - the Document objects in that browsing context's session + the {{Document}} objects in that browsing context's session history and the document families of all those - Document objects. The document family of a Document object + {{Document}} objects. The document family of a {{Document}} object consists of the union of all the document families of the - browsing contexts that are nested through the Document object. + browsing contexts that are nested through the {{Document}} object. @@ -206,30 +206,30 @@ The top IDL attribute on the Window object - of a Document in a browsing context b must return + of a {{Document}} in a browsing context b must return the WindowProxy object of its top-level browsing context (which would be its own WindowProxy object if it was a top-level browsing context itself), if it has one, or its own WindowProxy object otherwise (e.g., if it was a detached nested browsing context). - The parent IDL attribute on the {{Window}} object + The parent IDL attribute on the {{Window}} object of a {{Document}} that has a browsing context b must return the {{WindowProxy}} - object of the parent browsing context, if there is one (i.e., if b is a - child browsing context), or the {{WindowProxy}} object of the browsing context - b itself, otherwise (i.e., if it is a top-level browsing context or a detached + object of the parent browsing context, if there is one (i.e., if b is a + child browsing context), or the {{WindowProxy}} object of the browsing context + b itself, otherwise (i.e., if it is a top-level browsing context or a detached nested browsing context). - The frameElement IDL attribute on the {{Window}} + The frameElement IDL attribute on the {{Window}} object of a {{Document}} d, on getting, must run the following algorithm: - 1. Let d be the {{Window}} object's + 1. Let d be the {{Window}} object's associated Document. 2. Let context be d's browsing context. - 3. If context is not a nested browsing context, return null and abort these + 3. If context is not a nested browsing context, return null and abort these steps. 4. Let container be context's browsing context container. - 5. If container's node document's origin is not - same origin-domain with the entry settings object's origin, then return + 5. If container's node document's origin is not + same origin-domain with the entry settings object's origin, then return null and abort these steps. 6. Return container. @@ -313,7 +313,7 @@
  • Otherwise, if B is a top-level browsing context, and is neither A nor one of the ancestor browsing contexts of A, and A's - Document's active sandboxing flag set has its sandboxed + {{Document}}'s active sandboxing flag set has its sandboxed navigation browsing context flag set, and A is not the one permitted sandboxed navigator of B, then abort these steps negatively.
  • @@ -324,9 +324,9 @@
    - An element has a browsing context scope origin if its Document's + An element has a browsing context scope origin if its {{Document}}'s browsing context is a top-level browsing context or if all of its - Document's ancestor browsing contexts + {{Document}}'s ancestor browsing contexts all have active documents whose origin are the same origin as the element's node document's origin. If an element has a browsing context scope origin, then its value is the @@ -336,28 +336,28 @@

    Groupings of browsing contexts

    - Each browsing context is defined as having a list of one or more + Each browsing context is defined as having a list of one or more directly reachable browsing contexts. These are: * The browsing context itself. * All the browsing context's child browsing contexts. * The browsing context's parent browsing context. - * All the browsing contexts that have the browsing context as their + * All the browsing contexts that have the browsing context as their opener browsing context. * The browsing context's opener browsing context. - The transitive closure of all the browsing contexts that are + The transitive closure of all the browsing contexts that are directly reachable browsing contexts forms a unit of related browsing contexts. - Each unit of related browsing contexts is then further divided into the smallest number of - groups such that every member of each group has an active document with an origin - that, through appropriate manipulation of the {{Document/domain|document.domain}} attribute, could - be made to be same origin-domain with other members of the group, but could not be made the - same as members of any other group. Each such group is a + Each unit of related browsing contexts is then further divided into the smallest number of + groups such that every member of each group has an active document with an origin + that, through appropriate manipulation of the {{Document/domain|document.domain}} attribute, could + be made to be same origin-domain with other members of the group, but could not be made the + same as members of any other group. Each such group is a unit of related similar-origin browsing contexts. -

    There is also at most one event loop per - unit of related similar-origin browsing contexts (though several +

    There is also at most one event loop per + unit of related similar-origin browsing contexts (though several units of related similar-origin browsing contexts can have a shared event loop).

    Browsing context names

    @@ -806,7 +806,7 @@ 5. Set realm's \[[HostDefined]] field to settings object. 6. Return settings object. -

    Security infrastructure for Window, WindowProxy, and Location objects

    +

    Security infrastructure for Window, WindowProxy, and {{Location}} objects

    Although typically objects cannot be accessed across origins, the web platform would not be true to itself if it did not have some legacy exceptions to that rule that the web depends upon. @@ -937,9 +937,9 @@

    If this abstract operation returns undefined and there is no custom behavior, the caller needs to throw a "SecurityError" {{DOMException}}.

    - 1. If P is @@toStringTag, @@hasInstance, or @@isConcatSpreadable, - then return PropertyDescriptor - { \[[Value]]: undefined, \[[Writable]]: false, \[[Enumerable]]: false, + 1. If P is @@toStringTag, @@hasInstance, or @@isConcatSpreadable, + then return PropertyDescriptor + { \[[Value]]: undefined, \[[Writable]]: false, \[[Enumerable]]: false, \[[Configurable]]: true }. 2. Let crossOriginKey be a tuple consisting of the current settings object's origin's effective domain, O's relevant settings object's @@ -1098,7 +1098,7 @@
    - Returns the Document associated with window. + Returns the {{Document}} associated with window.
    @@ -1116,7 +1116,7 @@ The Window has an HTTPS state, which represents the security properties of the network channel used to deliver the - Document with which the Window is associated. The value will be one of + {{Document}} with which the Window is associated. The value will be one of "modern", "deprecated", or "none". If it is not explicitly set, then its value is "none". The window, frames, and self @@ -1124,25 +1124,25 @@ WindowProxy object. The document IDL attribute must return - the Window object's newest - Document object. + the Window object's newest + {{Document}} object.

    - The Document object associated with a Window object can - change in exactly one case: when the navigate algorithm initializes a new Document object for the first page loaded + The {{Document}} object associated with a Window object can + change in exactly one case: when the navigate algorithm initializes a new {{Document}} object for the first page loaded in a browsing context. In that specific case, the Window object of the - original about:blank page is reused and gets a new Document object. + original about:blank page is reused and gets a new {{Document}} object.

    The defaultView IDL attribute of the - Document interface must return the Document's browsing + {{Document}} interface must return the {{Document}}'s browsing context's WindowProxy object, if there is one, or null otherwise.
    For historical reasons, Window objects must also have a writable, configurable, non-enumerable property named HTMLDocument whose value is the - Document interface object. + {{Document}} interface object.
    @@ -1301,7 +1301,7 @@ a task to fire a simple event named load at target browsing context's Window object, with target override set to target browsing context's Window object's - Document object. + {{Document}} object. Otherwise, navigate target browsing context to resource, with exceptions enabled. If new is true, then @@ -1374,18 +1374,18 @@
    Returns the indicated child browsing context.
    - The number of child browsing contexts of a {{Window}} object W is the number - of child browsing contexts that are nested through elements that are in a - {{Document}} that is the active document of the {{Window}} object's associated + The number of child browsing contexts of a {{Window}} object W is the number + of child browsing contexts that are nested through elements that are in a + {{Document}} that is the active document of the {{Window}} object's associated {{Document}} object's browsing context. - + The length IDL attribute's getter must return the number of child browsing contexts of this {{Window}} object. - -

    Indexed access to child browsing contexts is defined through the + +

    Indexed access to child browsing contexts is defined through the \[[GetOwnProperty]] internal method of the {{WindowProxy}} object.

    - +

    Named access on the Window object

    @@ -1394,28 +1394,28 @@ As a general rule, relying on this will lead to brittle code. Which IDs end up mapping to this API can vary over time, as new features are added to the Web platform, for example. Instead - of this, use {{NonElementParentNode/getElementById()|document.getElementById()}} or + of this, use {{NonElementParentNode/getElementById()|document.getElementById()}} or document.querySelector().
    - The child browsing context name property set consists of the + The child browsing context name property set consists of the browsing context names of any child browsing context of the active document whose name is not the empty string, with duplicates omitted. - - The Window interface supports named properties. - The supported property names at any moment consist of the following, in tree order, + + The Window interface supports named properties. + The supported property names at any moment consist of the following, in tree order, ignoring later duplicates: * the child browsing context name property set. - * the value of the name content attribute for all <{a}>, <{applet}>, <{area}>, - <{embed}>, <{form}>, <{frameset}>, <{img}>, and <{object}> elements in the + * the value of the name content attribute for all <{a}>, <{applet}>, <{area}>, + <{embed}>, <{form}>, <{frameset}>, <{img}>, and <{object}> elements in the active document that have a non-empty name content attribute, and - * the value of the id content attribute of any HTML element in the + * the value of the id content attribute of any HTML element in the active document with a non-empty id content attribute. - To determine the value of a named property name when - the Window object is indexed for property retrieval, the user agent must + To determine the value of a named property name when + the Window object is indexed for property retrieval, the user agent must return the value obtained using the following steps:
      @@ -1448,7 +1448,7 @@
    1. - Otherwise return an HTMLCollection rooted at the Document node, + Otherwise return an HTMLCollection rooted at the {{Document}} node, whose filter matches only named objects with the name name. (By definition, these will all be elements.) @@ -1476,14 +1476,14 @@

      Garbage collection and browsing contexts

      - A browsing context has a strong reference to each of its Documents + A browsing context has a strong reference to each of its {{Document}}s and its WindowProxy object, and the user agent itself has a strong reference to its top-level browsing contexts. - A Document has a strong reference to its Window object. + A {{Document}} has a strong reference to its Window object. -

      A Window object has a strong reference to its Document object through its document attribute. Thus, references from other scripts to either of - those objects will keep both alive. Similarly, both Document and Window +

      A Window object has a strong reference to its {{Document}} object through its document attribute. Thus, references from other scripts to either of + those objects will keep both alive. Similarly, both {{Document}} and Window objects have implied strong references to the WindowProxy object.

      @@ -1498,31 +1498,31 @@
        -
      1. Set the Document's salvageable state to false.
      2. +
      3. Set the {{Document}}'s salvageable state to false.
      4. -
      5. Run any unloading document cleanup steps for the Document that +
      6. Run any unloading document cleanup steps for the {{Document}} that are defined by this specification and other applicable specifications.
      7. Abort the Document.
      8. Remove any tasks associated with the - Document in any task source, without running those tasks.
      9. + {{Document}} in any task source, without running those tasks.
      10. Discard all the child browsing contexts of the {{Document}}.
      11. -
      12. Lose the strong reference from the Document's browsing context +
      13. Lose the strong reference from the {{Document}}'s browsing context to the {{Document}}.

      - Whenever a Document object is discarded, it is also removed from the list of the worker's + Whenever a {{Document}} object is discarded, it is also removed from the list of the worker's Documents of each worker whose list contains that {{Document}}.

      When a browsing context is discarded, the strong reference from the user agent itself to the browsing context must be severed, and all the - Document objects for all the entries in the browsing context's session + {{Document}} objects for all the entries in the browsing context's session history must be discarded as well. User agents may discard top-level browsing contexts at any time (typically, in @@ -1612,7 +1612,7 @@ true or a value determined by the user agent to most accurately represent the visibility state of the user interface element that the object represents, as described below. - The following BarProp objects exist for each Document object in a + The following BarProp objects exist for each {{Document}} object in a browsing context. Some of the user interface elements represented by these objects might have no equivalent in some user agents; for those user agents, except when otherwise specified, the object must act as if it was present and visible (i.e., its visible attribute must return true). @@ -1687,26 +1687,26 @@

      The WindowProxy object

      - A WindowProxy is an exotic object that wraps a {{Window}} - ordinary object, indirecting most operations through to the wrapped object. Each + A WindowProxy is an exotic object that wraps a {{Window}} + ordinary object, indirecting most operations through to the wrapped object. Each browsing context has an associated {{WindowProxy}} object. When the browsing context - is navigated, the {{Window}} object wrapped by the browsing context's associated + is navigated, the {{Window}} object wrapped by the browsing context's associated {{WindowProxy}} object is changed. - + There is no {{WindowProxy}} interface object. - Every {{WindowProxy}} object has a \[[Window]] internal slot + Every {{WindowProxy}} object has a \[[Window]] internal slot representing the wrapped {{Window}} object. -

      Although {{WindowProxy}} is named as a "proxy", it does not do polymorphic - dispatch on its target's internal methods as a real proxy would, due to a desire to reuse - machinery between {{WindowProxy}} and {{Location}} objects. As long as the {{Window}} object +

      Although {{WindowProxy}} is named as a "proxy", it does not do polymorphic + dispatch on its target's internal methods as a real proxy would, due to a desire to reuse + machinery between {{WindowProxy}} and {{Location}} objects. As long as the {{Window}} object remains an ordinary object this is unobservable and can be implemented either way.

      - In the following example, the variable x is set to the {{WindowProxy}} object - returned by the {{Window/window}} accessor on the global object. All of the - expressions following the assignment return true, because the {{WindowProxy}} object passes + In the following example, the variable x is set to the {{WindowProxy}} object + returned by the {{Window/window}} accessor on the global object. All of the + expressions following the assignment return true, because the {{WindowProxy}} object passes most operations through to the underlying ordinary {{Window}} object.
      @@ -1722,9 +1722,9 @@
       
       
      \[[GetPrototypeOf]] ( )
      - 1. Let W be the value of the \[[Window]] internal slot of + 1. Let W be the value of the \[[Window]] internal slot of this. - 2. If IsPlatformObjectSameOrigin(W) is true, then return ! + 2. If IsPlatformObjectSameOrigin(W) is true, then return ! OrdinaryGetPrototypeOf(W). 3. Return null. @@ -1742,44 +1742,44 @@
      \[[GetOwnProperty]] ( P )
      - 1. Let W be the value of the \[[Window]] internal slot of + 1. Let W be the value of the \[[Window]] internal slot of this. 2. If P is an array index property name, then: 1. Let index be ToUint32(P). - 2. Let maxProperties be the number of child browsing contexts of + 2. Let maxProperties be the number of child browsing contexts of W. 3. Let value be undefined. - 4. If maxProperties is greater than 0 and index is less than + 4. If maxProperties is greater than 0 and index is less than maxProperties, then: - 1. Set value to the {{WindowProxy}} object of the indexth - child browsing context of the {{Document}} that is - nested through an element that is in W's {{Document}}, sorted in the - order that the elements nesting those browsing contexts were most recently - inserted into the {{Document}}, the {{WindowProxy}} object of the most recently - inserted browsing context container's nested browsing context being + 1. Set value to the {{WindowProxy}} object of the indexth + child browsing context of the {{Document}} that is + nested through an element that is in W's {{Document}}, sorted in the + order that the elements nesting those browsing contexts were most recently + inserted into the {{Document}}, the {{WindowProxy}} object of the most recently + inserted browsing context container's nested browsing context being last. - 5. Return PropertyDescriptor{ \[[Value]]: value, \[[Writable]]: false, + 5. Return PropertyDescriptor{ \[[Value]]: value, \[[Writable]]: false, \[[Enumerable]]: false, \[[Configurable]]: true }. - 3. If IsPlatformObjectSameOrigin(W) is true, then return + 3. If IsPlatformObjectSameOrigin(W) is true, then return OrdinaryGetOwnProperty(W, P). - +

      This violates JavaScript's internal method invariants.

      4. Let property be CrossOriginGetOwnPropertyHelper(W, P). 5. If property is not undefined, return property. - 6. If property is undefined and P is in the + 6. If property is undefined and P is in the child browsing context name property set, then: - 1. Let value be the {{WindowProxy}} object of the named object with the name + 1. Let value be the {{WindowProxy}} object of the named object with the name P. - 2. Return PropertyDescriptor{ \[[Value]]: value, \[[Enumerable]]: false, + 2. Return PropertyDescriptor{ \[[Value]]: value, \[[Enumerable]]: false, \[[Writable]]: false, \[[Configurable]]: true }. 7. Throw a "SecurityError" {{DOMException}}.
      \[[DefineOwnProperty]] ( P, Desc )
      1. If P is an array index property name, return false. - 2. Let W be the value of the \[[Window]] internal slot of + 2. Let W be the value of the \[[Window]] internal slot of this. - 3. If IsPlatformObjectSameOrigin(W) is true, then return + 3. If IsPlatformObjectSameOrigin(W) is true, then return OrdinaryDefineOwnProperty(W, P, Desc).

      See above about how this violates JavaScript's internal method invariants.

      @@ -1787,32 +1787,32 @@
      \[[Get]] ( P, Receiver )
      - 1. Let W be the value of the \[[Window]] internal slot of + 1. Let W be the value of the \[[Window]] internal slot of this. - 2. If IsPlatformObjectSameOrigin(W) is true, then return + 2. If IsPlatformObjectSameOrigin(W) is true, then return OrdinaryGet(this, P, Receiver). 3. Return ? CrossOriginGet(this, P, Receiver).
      \[[Set]] ( P, V, Receiver )
      - 1. Let W be the value of the \[[Window]] internal slot of + 1. Let W be the value of the \[[Window]] internal slot of this. - 2. If IsPlatformObjectSameOrigin(W) is true, then return + 2. If IsPlatformObjectSameOrigin(W) is true, then return OrdinarySet(W, this, Receiver). 3. Return CrossOriginSet(this, P, V, Receiver).
      \[[Delete]] ( P )
      1. If P is an array index property name, return false. - 2. Let W be the value of the \[[Window]] internal slot of + 2. Let W be the value of the \[[Window]] internal slot of this. - 3. If IsPlatformObjectSameOrigin(W) is true, then return + 3. If IsPlatformObjectSameOrigin(W) is true, then return OrdinaryDelete(W, P). 4. Return false.
      \[[OwnPropertyKeys]] ( )
      - 1. Let W be the value of the \[[Window]] internal slot of + 1. Let W be the value of the \[[Window]] internal slot of this. 2. Let keys be a new empty List. 3. Let maxProperties be the number of child browsing contexts of W. @@ -1820,11 +1820,11 @@ 5. Repeat while index < maxProperties, 1. Add ! ToString(index) as the last element of keys. 2. Increment index by 1. - 6. If IsPlatformObjectSameOrigin(W) is true, then return the concatenation of + 6. If IsPlatformObjectSameOrigin(W) is true, then return the concatenation of keys and ! OrdinaryOwnPropertyKeys(W). - 7. Return the concatenation of keys and ! + 7. Return the concatenation of keys and ! CrossOriginOwnPropertyKeys(W). - +

      Origin

      Origins are the fundamental currency of the Web's security model. Two actors in the Web @@ -1893,7 +1893,7 @@
      If the {{Document}} is a non-initial "about:blank" document
      If the {{Document}} was generated from a data: URL - found in another Document or in a script
      + found in another {{Document}} or in a script
      The origin of the incumbent settings object when the navigate algorithm was invoked, or, if no script was involved, of the node document of the element that initiated the navigation to that @@ -2008,7 +2008,7 @@
      The following table shows how A and B are related: - + @@ -2053,154 +2053,59 @@
      document . {{Document/domain}} [ = domain ]
      Returns the current domain used for security checks. - Can be set to a value that removes subdomains, to change the origin's - domain to allow pages on other subdomains of the same domain (if they + Can be set to a value that removes subdomains, to change the origin's + domain to allow pages on other subdomains of the same domain (if they do the same thing) to access each other. (Can't be set in sandboxed <{iframe}>s.)
      - The domain attribute's getter must run these + The domain attribute's getter must run these steps: - - 1. If this {{Document}} object does not have a browsing context, then return the empty + + 1. If this {{Document}} object does not have a browsing context, then return the empty string. 2. Let effectiveDomain be this {{Document}}'s origin's effective domain. 3. If effectiveDomain is an opaque origin, then return the empty string. 4. Return effectiveDomain, serialised. - - The {{Document/domain}} attribute on setting must run these steps: - -
        - -
      1. - - If the Document has no browsing context, throw a - SecurityError exception and abort these steps. - -
      2. - -
      3. - If the Document's active sandboxing flag set has its - sandboxed document.domain browsing context - flag set, throw a SecurityError exception and abort these steps. - -
      4. - -
      5. - - If the new value is an IPv4 or IPv6 address, let new value be the new - value. - - Otherwise, strictly split the new value on - U+002E FULL STOP characters (.), apply the domain to ASCII algorithm to each - returned token, and let new value be the result of concatenating the - results of applying that algorithm to each token, in the same order, separated by U+002E FULL - STOP characters (.). [[!URL]] - - If the domain to ASCII algorithm returns failure, e.g., because a component is too long or because it contains - invalid characters, then throw a SecurityError exception and abort these steps. - -
      6. - -
      7. - - If new value is not exactly equal to the current value of the document.domain attribute, then run these substeps: - -
          - -
        1. - - If the current value is an IPv4 or IPv6 address, throw a SecurityError - exception and abort these steps. - -
        2. - -
        3. - - If new value, prefixed by a U+002E FULL STOP (.), does not exactly - match the end of the current value, throw a SecurityError exception and abort - these steps. - -

          - If the new value is an IPv4 or IPv6 address, it cannot - match the new value in this way and thus an exception will be thrown - here. -

          - -
        4. - -
        5. - - If new value matches a suffix in the Public Suffix List, or, if new value, prefixed by a U+002E FULL STOP (.), matches the end of a suffix in - the Public Suffix List, then throw a SecurityError exception and abort these - steps. [[!PSL]] - - Suffixes must be compared in an ASCII case-insensitive manner, after applying - the domain to ASCII algorithm to their individual components, . [[!URL]] - -
        6. - -
        - -
      8. - -
      9. - - Set the attribute's value to new value. - -
      10. - -
      11. - - If the effective script origin of the Document is an alias, set it to the value of the effective script - origin (essentially de-aliasing the effective script origin). - -
      12. - -
      13. - - If new value is not the empty string, then run these substeps: - -
          - -
        1. - - Set the host part of the effective script origin tuple of the - Document to new value. - -
        2. - -
        3. - - Set the port part of the effective script origin tuple of the - Document to "manual override" (a value that, for the purposes of comparing origins, is identical to "manual override" but not - identical to any other value). - -
        4. - -
        - -
      14. - -
      - - The domain of a Document is the host part - of the document's origin, if the value of that origin is a - scheme/host/port tuple. If it isn't, then the document does not have a domain. - - -

      - The domain attribute is used to enable - pages on different hosts of a domain to access each others' DOMs. -

      + The {{Document/domain}} attribute on setting must run these steps: -

      Do not use the document.domain - attribute when using shared hosting. If an untrusted third party is able to host an HTTP server at - the same IP address but on a different port, then the same-origin protection that normally - protects two different sites on the same host will fail, as the ports are ignored when comparing - origins after the document.domain attribute has been - used.

      + 1. If this {{Document}} object has no browsing context, throw a + "SecurityError" {{DOMException}}. + 2. If this {{Document}} object's active sandboxing flag set has its + sandboxed document.domain browsing context flag set, then throw a + "SecurityError" {{DOMException}}. + 3. If the given value is the empty string, then throw a "SecurityError" + {{DOMException}}. + 4. Let host be the result of parsing the given value. + 5. If host is failure, then throw a "SecurityError" {{DOMException}}. + 6. Let effectiveDomain be this {{Document}} object's origin's + effective domain. + 7. If host is not equal to effectiveDomain, then run + these substeps: + 1. If host or effectiveDomain is not domain, then throw + a "SecurityError" {{DOMException}}. + +

      This is meant to exclude hosts that are an + IPv4 address or an IPv6 address. + 2. If host, prefixed by a U+002E FULL STOP (.), does not exactly match + the effectiveDomain, then throw a "SecurityError" + {{DOMException}}. + 3. If host matches a suffix in the Public Suffix List, or, if host, + prefixed by a U+002E FULL STOP (.), matches the end of a suffix in the Public Suffix List, + then throw a "SecurityError" {{DOMException}}. [[!PSL]] + + Suffixes must be compared after applying the host parser algorithm. [[!URL]] + 8. Set origin's domain to host. + +

      The {{Document/domain|document.domain}} attribute is used to enable pages on + different hosts of a domain to access each others' DOMs.

      + +

      Do not use the {{Document/domain|document.domain}} attribute when using shared + hosting. If an untrusted third party is able to host an HTTP server at the same IP address but on + a different port, then the same-origin protection that normally protects two different sites on + the same host will fail, as the ports are ignored when comparing origins after the + {{Document/domain|document.domain}} attribute has been used.

      Sandboxing

      @@ -2342,12 +2247,7 @@
      The sandboxed document.domain browsing context flag
      -
      - - This flag prevents content from using the document.domain feature to change the effective script - origin. - -
      +
      This flag prevents content from using the {{Document/domain|document.domain}} setter.
      The sandbox propagates to auxiliary browsing contexts flag
      @@ -2478,8 +2378,8 @@ set, which is a sandboxing flag set. Which flags in a nested browsing context's iframe sandboxing flag set are set at any particular time is determined by the <{iframe}> element's sandbox attribute. - Every Document has an active sandboxing flag set, which is a - sandboxing flag set. When the Document is created, its active + Every {{Document}} has an active sandboxing flag set, which is a + sandboxing flag set. When the {{Document}} is created, its active sandboxing flag set must be empty. It is populated by the navigation algorithm. @@ -2496,23 +2396,23 @@
      When a user agent is to implement the sandboxing for a {{Document}}, it - must populate Document's active sandboxing flag set with the union of + must populate {{Document}}'s active sandboxing flag set with the union of the flags that are present in the following sandboxing flag - sets at the time the Document object is created: + sets at the time the {{Document}} object is created: @@ -2521,19 +2421,19 @@

      The session history of browsing contexts

      - The sequence of Documents in a browsing context is its session + The sequence of {{Document}}s in a browsing context is its session history. Each browsing context, including nested browsing contexts, has a distinct session history. A browsing context's session history consists of a flat list of session history entries. Each session history entry consists, at a minimum, of a URL, and each entry may in addition have a state object, a - title, a Document object, form data, a scroll restoration mode, a scroll + title, a {{Document}} object, form data, a scroll restoration mode, a scroll position, and other information associated with it.

      Each entry, when first created, has a {{Document}}. However, when a - Document is not active, it's possible for it to be + {{Document}} is not active, it's possible for it to be discarded to free resources. The URL and other data in a session history entry is then used to bring a new - Document into being to take the place of the original, should the user agent find + {{Document}} into being to take the place of the original, should the user agent find itself having to reactivate that {{Document}}.

      @@ -2549,14 +2449,14 @@
      - Each Document object in a browsing context's session + Each {{Document}} object in a browsing context's session history is associated with a unique History object which must all model the same underlying session history.
      The history attribute of the Window interface must return the object implementing the History interface for that {{Window}} - object's newest Document. + object's newest {{Document}}.

      @@ -2574,8 +2474,8 @@ case an author doesn't have to do the parsing (though one would still need the parsing for handling URLs passed around by users, so it's only a minor optimization), and second, so that the author can store state that one wouldn't store in the URL - because it only applies to the current Document instance and it would have to be - reconstructed if a new Document were opened. + because it only applies to the current {{Document}} instance and it would have to be + reconstructed if a new {{Document}} were opened. An example of the latter would be something like keeping track of the precise coordinate from which a pop-up div was made to animate, so that if the user goes back, it can be @@ -2629,33 +2529,33 @@ "auto".

      Entries that consist of state objects share the same - Document as the entry for the page that was active when they were added. + {{Document}} as the entry for the page that was active when they were added. Contiguous entries that differ just by fragment identifier also share the same {{Document}}.

      - All entries that share the same Document (and that are therefore + All entries that share the same {{Document}} (and that are therefore merely different states of one particular document) are contiguous by definition.

      - Each Document in a browsing context can also have a latest - entry. This is the entry for that Document to which the browsing + Each {{Document}} in a browsing context can also have a latest + entry. This is the entry for that {{Document}} to which the browsing context's session history was most recently traversed. When a - Document is created, it initially has no latest entry. + {{Document}} is created, it initially has no latest entry.
      - User agents may discard the Document + User agents may discard the {{Document}} objects of entries other than the current entry that are not referenced from any script, reloading the pages afresh when the user or script navigates back to such pages. This - specification does not specify when user agents should discard Document objects and + specification does not specify when user agents should discard {{Document}} objects and when they should cache them. - Entries that have had their Document objects discarded must, for the purposes of + Entries that have had their {{Document}} objects discarded must, for the purposes of the algorithms given below, act as if they had not. When the user or script navigates back or forwards to a page which has no in-memory DOM objects, any other entries that shared the same - Document object with it must share the new object as well. + {{Document}} object with it must share the new object as well.
      @@ -2758,7 +2658,7 @@ The joint session history of a top-level browsing context is the union - of all the session histories of all browsing contexts of all the fully active Document + of all the session histories of all browsing contexts of all the fully active {{Document}} objects that share that top-level browsing context, with all the entries that are current entries in their respective session histories removed except for the current entry of the joint session history. @@ -2772,7 +2672,7 @@ consecutively increasing integers (1, 2, 3, etc).

      - Since each Document in a browsing context might have a + Since each {{Document}} in a browsing context might have a different event loop, the actual state of the joint session history can be somewhat nebulous. For example, two sibling <{iframe}> elements could both traverse from one unique origin to another at the same time, so their precise order might not be well-defined; similarly, since they might only find out about @@ -2785,7 +2685,7 @@ The length attribute of the History interface, on getting, must return the number of entries in the top-level browsing context's joint session history. If this - History object is associated with a Document that is not + History object is associated with a {{Document}} that is not fully active, getting must instead throw a SecurityError. The actual entries are not accessible from script. @@ -2793,13 +2693,13 @@

      The scrollRestoration attribute of the History interface, on getting, must return the scroll restoration mode of the current entry in the session history. On setting, the scroll restoration mode of the current entry in the session history must be set to the new - value. If this History object is associated with a Document that is + value. If this History object is associated with a {{Document}} that is not fully active, both getting and setting must instead throw a SecurityError.

      The state attribute of the History interface, on getting, must return the last value it was set to by the user - agent. If this History object is associated with a Document that is + agent. If this History object is associated with a {{Document}} that is not fully active, getting must instead throw a SecurityError. Initially, its value must be null. @@ -2807,18 +2707,18 @@ invoked, if delta is zero, the user agent must act as if the location.reload() method was called instead. Otherwise, the user agent must traverse the history by a delta whose value is - delta If this History object is associated with a Document + delta If this History object is associated with a {{Document}} that is not fully active, invoking must instead throw a SecurityError. When the back() method is invoked, the user agent must traverse the history by a delta −1. If this History - object is associated with a Document that is not fully active, + object is associated with a {{Document}} that is not fully active, invoking must instead throw a SecurityError. When the forward()method is invoked, the user agent must traverse the history by a delta +1. If this History - object is associated with a Document that is not fully active, + object is associated with a {{Document}} that is not fully active, invoking must instead throw a SecurityError.
      @@ -2881,13 +2781,13 @@
    2. If there is an ongoing attempt to navigate specified browsing context that has not yet matured (i.e., it has not passed the - point of making its Document the active document), then cancel that + point of making its {{Document}} the active document), then cancel that attempt to navigate the browsing context.
    3. If the specified browsing context's active document is not - the same Document as the Document of the specified + the same {{Document}} as the {{Document}} of the specified entry, then run these substeps:
        @@ -3106,41 +3006,78 @@ -

        The Location interface

        - - Each Document object in a browsing context's session history is - associated with a unique instance of a Location object. +

        Implementation notes for session history

        -
        + This section is non-normative. -
        document . location [ = value ]
        -
        window . location [ = value ]
        + The {{History}} interface is not meant to place restrictions on how implementations represent the + session history to the user. -
        + For example, session history could be implemented in a tree-like manner, with each page having + multiple "forward" pages. This specification doesn't define how the linear list of pages in the + {{Window/history}} object are derived from the actual session history as seen from the user's + perspective. - Returns a Location object with the current page's location. + Similarly, a page containing two <{iframe}>s has a {{Window/history}} object distinct from the + <{iframe}>s' {{Window/history}} objects, despite the fact that typical Web browsers present the + user with just one "Back" button, with a session history that interleaves the navigation of the + two inner frames and the outer page. - Can be set, to navigate to another page. + Security: It is suggested that to avoid letting a page "hijack" the history navigation + facilities of a UA by abusing {{History/pushState()}}, the UA provide the user with a way to jump + back to the previous page (rather than just going back to the previous state). For example, the + back button could have a drop down showing just the pages in the session history, and not showing + any of the states. Similarly, an aural browser could have two "back" commands, one that goes back + to the previous state, and one that jumps straight back to the previous page. -
        + For both {{History/pushState()}} and {{History/replaceState()}}, user agents are encouraged to + prevent abuse of these APIs via too-frequent calls or over-large state objects. As detailed above, + the algorithm explicitly allows user agents to ignore any such calls when appropriate. -
        +

        The Location interface

        -
        + Each {{Window}} object is associated with a unique instance of a {{Location}} object, allocated + when the {{Window}} object is created. + + To create a {{Location}} object, run these steps: + + 1. Let location be a new {{Location}} platform object. + 2. Perform ! location.\[[DefineOwnProperty]]("toString", { + \[[Value]]: %ObjProto_toString%, \[[Writable]]: false, \[[Enumerable]]: false, + \[[Configurable]]: false }). + 3. Perform ! location.\[[DefineOwnProperty]]("toJSON", { + \[[Value]]: undefined, \[[Writable]]: false, \[[Enumerable]]: false, + \[[Configurable]]: false }). + 4. Perform ! location.\[[DefineOwnProperty]]("valueOf", { + \[[Value]]: %ObjProto_valueOf%, \[[Writable]]: false, \[[Enumerable]]: false, + \[[Configurable]]: false }). + 5. Perform ! location.\[[DefineOwnProperty]](@@toPrimitive, { + \[[Value]]: undefined, \[[Writable]]: false, \[[Enumerable]]: false, + \[[Configurable]]: false }). + 6. Set the value of the \[[DefaultProperties]] internal slot of location to + location.\[[OwnPropertyKeys]](). + 7. Return location. + +
        +
        document . {{Document/location}} [ = value ]
        +
        window . {{Window/location}} [ = value ]
        +
        Returns a {{Location}} object with the current page's location. - The location attribute of the - {{Document}} interface must return the {{Location}} object for that - {{Document}} object, if it is in a browsing context, and null otherwise. + Can be set, to navigate to another page. +
        +
        - The location attribute of the {{Window}} - interface must return the {{Location}} object for that {{Window}} object's - {{Document}}. + The location attribute of the {{Document}} + interface must return the {{Location}} object for that {{Document}} object's global object, + if it has a browsing context, and null otherwise. -
        + The location attribute of the {{Window}} interface + must return the {{Location}} object for that {{Window}} object. - Location objects provide a representation of the address of the active document of their Document's - browsing context, and allow the current entry of the browsing - context's session history to be changed, by adding or replacing entries in the history object. + {{Location}} objects provide a representation of the URL of the + active document of their {{Document}}'s browsing context, and allow the + current entry of the browsing context's session history to be changed, by adding or + replacing entries in the {{Window/history}} object.
             [Unforgeable]
        @@ -3165,136 +3102,127 @@
         
           
        location . toString()
        -
        location . href
        -
        - Returns the Location object's URL. +
        location . {{Location/href}}
        +
        Returns the {{Location}} object's URL. + Can be set, to navigate to the given URL.
        -
        location . origin
        -
        - Returns the Location object's URL's origin. -
        +
        location . {{Location/origin}}
        +
        Returns the {{Location}} object's URL's origin.
        -
        location . protocol
        -
        - Returns the Location object's URL's scheme. +
        location . {{Location/protocol}}
        +
        Returns the {{Location}} object's URL's scheme. + Can be set, to navigate to the same URL with a changed scheme.
        -
        location . host
        -
        - Returns the Location object's URL's host and port (if different from the default - port for the scheme). +
        location . {{Location/host}}
        +
        Returns the {{Location}} object's URL's host and port (if different from the default port + for the scheme). + Can be set, to navigate to the same URL with a changed host and port.
        -
        location . hostname
        -
        - Returns the Location object's URL's host. +
        location . {{Location/hostname}}
        +
        Returns the {{Location}} object's URL's host. + Can be set, to navigate to the same URL with a changed host.
        -
        location . port
        -
        - Returns the Location object's URL's port. +
        location . {{Location/port}}
        +
        Returns the {{Location}} object's URL's port. + Can be set, to navigate to the same URL with a changed port.
        -
        location . pathname
        -
        - Returns the Location object's URL's path. +
        location . {{Location/pathname}}
        +
        Returns the {{Location}} object's URL's path. + Can be set, to navigate to the same URL with a changed path.
        -
        location . search
        -
        - Returns the Location object's URL's query (includes leading "?" if non-empty). +
        location . {{Location/search}}
        +
        Returns the {{Location}} object's URL's query (includes leading "?" if + non-empty). + Can be set, to navigate to the same URL with a changed query (ignores leading "?").
        -
        location . hash
        -
        - Returns the Location object's URL's fragment (includes leading "#" if non-empty). - Can be set, to navigate to the same URL with a changed fragment (ignores leading "#"). -
        - -
        location . assign(url)
        -
        - Navigates to the given URL. +
        location . {{Location/hash}}
        +
        Returns the {{Location}} object's URL's fragment (includes leading "#" if + non-empty). + + Can be set, to navigate to the same URL with a changed fragment (ignores leading + "#").
        -
        location . replace(url)
        -
        - Removes the current page from the session history and navigates to the given URL. -
        +
        location . {{Location/assign(url)}}
        +
        Navigates to the given URL.
        -
        location . reload()
        +
        location . {{Location/replace(url)}}
        +
        Removes the current page from the session history and navigates to the given URL.
        -
        - Reloads the current page. -
        +
        location . {{Location/reload()}}
        +
        Reloads the current page.
        -
        location . ancestorOrigins
        -
        - Returns an array whose values are the origins of the ancestor browsing contexts, from the parent browsing context to the - top-level browsing context. -
        +
        location . {{Location/ancestorOrigins}}
        +
        Returns an array whose values are the origins of the ancestor browsing contexts, from + the parent browsing context to the top-level browsing context.
        -
        - - A Location object has an associated relevant - Document, which is this Location object's associated - Document object's browsing context's active document. - - A Location object has an associated url, which is this Location object's - relevant Document's address. - - A Location object has an associated Location-object-setter navigate algorithm, which given a url, runs these steps: - -
          -
        1. - If any of the following conditions are met, let replacement flag be unset; - otherwise, let it be set: - - -
        2. - -
        3. Location-object navigate, given url and - replacement flag.
        4. -
        + A {{Location}} object has an associated relevant Document, which is this + {{Location}} object's associated {{Document}} object's browsing context's + active document. + + A {{Location}} object has an associated url, which is this {{Location}} + object's relevant Document's URL. + + A {{Location}} object has an associated ancestor origins array. When a {{Location}} + object is created, its ancestor origins array must be set to a array created from the list + of strings that the following steps would produce: + + 1. Let output be an empty ordered list of strings. + 2. Let current be the browsing context of the {{Document}} with which the + {{Location}} object is associated. + 3. Loop: If current has no parent browsing context, jump to + the step labeled End. + 4. Let current be current's parent browsing context. + 5. Append the Unicode serialization of current's active document's + origin to output as a new value. + 6. Return to the step labeled Loop. + 7. End: Return output. + + A {{Location}} object has an associated Location-object-setter navigate + algorithm, which given a url, runs these steps: + + 1. If any of the following conditions are met, let replacement flag be unset; + otherwise, let it be set: + + * This {{Location}} object's relevant Document has + completely loaded, or + * In the task in which the algorithm is running, an activation behavior is + currently being processed whose click event was trusted, or + * In the task in which the algorithm is running, the event listener for a + trusted click event is being handled. + 2. Location-object navigate, given url and + replacement flag. To Location-object navigate, given a url and replacement flag, run these steps: -
          -
        1. The source browsing context is the responsible browsing context - specified by the incumbent settings object.
        2. - -
        3. - Navigate the browsing context to - url, with exceptions enabled. + 1. The source browsing context is the responsible browsing context specified by the + incumbent settings object. + 2. Navigate the browsing context to url, with exceptions enabled. + Rethrow any exceptions. - If the replacement flag is set or the browsing context's - session history contains only one {{Document}}, and that was the - about:blank Document created when the browsing context - was created, then the navigation must be done with replacement enabled. - -
        4. -
        + If the replacement flag is set or the browsing context's + session history contains only one {{Document}}, and that was the + about:blank {{Document}} created when the browsing context was created, + then the navigation must be done with replacement enabled. The href attribute's getter must return this - Location object's URL, serialized. + {{Location}} object's URL, serialized. The href attribute's setter must run these steps: @@ -3309,19 +3237,19 @@ The origin attribute's getter must return the Unicode serialization of this - Location object's URL's origin. + {{Location}} object's URL's origin.

        It returns the Unicode rather than the ASCII serialization for compatibility with MessageEvent. The protocol attribute's getter must - return this Location object's URL's scheme, followed by ":". + return this {{Location}} object's URL's scheme, followed by ":". The {{Location/protocol}} attribute's setter must run these steps:

          -
        1. Let copyURL be a copy of this Location object's URL.
        2. +
        3. Let copyURL be a copy of this {{Location}} object's URL.
        4. Let possibleFailure be the result of basic URL parsing the given value, followed by ":", with copyURL as url and scheme start state as state override.
        5. @@ -3338,7 +3266,7 @@ steps:
            -
          1. Let url be this Location object's URL.
          2. +
          3. Let url be this {{Location}} object's URL.
          4. If url's host is null, return the empty string.
          5. @@ -3352,7 +3280,7 @@ The host attribute's setter must run these steps:
              -
            1. Let copyURL be a copy of this Location object's URL.
            2. +
            3. Let copyURL be a copy of this {{Location}} object's URL.
            4. If copyURL's non-relative flag is set, terminate these steps.
            5. @@ -3368,17 +3296,17 @@ run these steps:
                -
              1. If this Location object's URL's +
              2. If this {{Location}} object's URL's host is null, return the empty string.
              3. -
              4. Return this Location object's URL's host, serialized.
              5. +
              6. Return this {{Location}} object's URL's host, serialized.
              The hostname attribute's setter must run these steps:
                -
              1. Let copyURL be a copy of this Location object's URL.
              2. +
              3. Let copyURL be a copy of this {{Location}} object's URL.
              4. If copyURL's non-relative flag is set, terminate these steps.
              5. @@ -3394,16 +3322,16 @@ steps:
                  -
                1. If this Location object's URL's +
                2. If this {{Location}} object's URL's port is null, return the empty string.
                3. -
                4. Return this Location object's URL's port, serialized.
                5. +
                6. Return this {{Location}} object's URL's port, serialized.
                The port attribute's setter must run these steps:
                  -
                1. Let copyURL be a copy of this Location object's URL.
                2. +
                3. Let copyURL be a copy of this {{Location}} object's URL.
                4. If copyURL's host is null, copyURL's non-relative flag is set, or copyURL's scheme is "file", terminate these @@ -3420,7 +3348,7 @@ run these steps:
                    -
                  1. Let url be this Location object's URL.
                  2. +
                  3. Let url be this {{Location}} object's URL.
                  4. If url's non-relative flag is set, return the first string in url's path.
                  5. @@ -3433,7 +3361,7 @@ steps:
                      -
                    1. Let copyURL be a copy of this Location object's URL.
                    2. +
                    3. Let copyURL be a copy of this {{Location}} object's URL.
                    4. If copyURL's non-relative flag is set, terminate these steps.
                    5. @@ -3452,18 +3380,18 @@ these steps:
                        -
                      1. If this Location object's URL's +
                      2. If this {{Location}} object's URL's query is either null or the empty string, return the empty string.
                      3. -
                      4. Return "?", followed by this Location object's URL's query.
                      5. +
                      6. Return "?", followed by this {{Location}} object's URL's query.
                      The search attribute's setter must run these steps:
                        -
                      1. Let copyURL be a copy of this Location object's URL.
                      2. +
                      3. Let copyURL be a copy of this {{Location}} object's URL.
                      4. If the given value is the empty string, set copyURL's query to null. @@ -3491,17 +3419,17 @@ steps:
                          -
                        1. If this Location object's URL's +
                        2. If this {{Location}} object's URL's fragment is either null or the empty string, return the empty string.
                        3. -
                        4. Return "#", followed by this Location object's URL's fragment.
                        5. +
                        6. Return "#", followed by this {{Location}} object's URL's fragment.
                        The hash attribute's setter must run these steps:
                          -
                        1. Let copyURL be a copy of this Location object's URL.
                        2. +
                        3. Let copyURL be a copy of this {{Location}} object's URL.
                        4. If copyURL's scheme is "javascript", terminate these steps.
                        5. @@ -3528,7 +3456,7 @@
                          - When the assign(url) + When the assign(url) method is invoked, the user agent must run the following steps:
                            @@ -3548,7 +3476,7 @@
                          - When the replace(url) + When the replace(url) method is invoked, the user agent must run the following steps:
                            @@ -3612,121 +3540,22 @@ described in this paragraph (with the browsing context being reloaded as the source browsing context). -
                            - - The ancestorOrigins attribute, on - getting, must return a read only array whose values are - determined as follows. The same object must be returned each time the attribute's value is - obtained for any particular Location object. - -
                              - -
                            1. Let output be an empty ordered list of strings. - -
                            2. Let current be the browsing context of the Document - with which the Location object is associated.
                            3. - -
                            4. Loop: If current has no parent browsing context, jump to - the step labeled end.
                            5. - -
                            6. Let current be current's parent browsing - context.
                            7. - -
                            8. Append the Unicode serialization - of current's active document's origin to output - as a new value.
                            9. - -
                            10. Return to the step labeled loop.
                            11. - -
                            12. End: Let output be the values of the array, in the same order.
                            13. - -
                            - -
        - -
        - -
        Security
        - -

        This section describes a security model that is underdefined, imperfect, and - does not match implementations. Work is ongoing to attempt to resolve this, but in the meantime, - please do not rely on this section for precision. Implementors are urged to send their feedback on - how cross-origin cross-global access to Window and Location objects - should work. - - User agents must throw a SecurityError exception whenever any - properties of a Location object are accessed when the entry settings - object specifies an effective script origin that is not the same as the Location object's associated Document's - browsing context's active document's effective script - origin, with the following exceptions: - -

        - - When the effective script origin specified by the entry settings - object is different than a Location object's associated - Document's effective script origin, the user agent must act as if any - changes to that Location object's properties, getters, setters, etc, were not - present, and as if all the properties of that Location object had their \[[Enumerable]] attribute set to false. - - For members that return objects (including function objects), each distinct effective - script origin that is not the same origin as the Location - object's Document's effective script origin must be provided with a - separate set of objects. These objects must have the prototype chain appropriate for the script - for which the objects are created (not those that would be appropriate for scripts whose - settings object specifies a global object that is the - Location object's Document's Window object). - -
        - -
        - -

        Implementation notes for session history

        - - This section is non-normative. - - The History interface is not meant to place restrictions on how implementations - represent the session history to the user. - - For example, session history could be implemented in a tree-like manner, with each page having - multiple "forward" pages. This specification doesn't define how the linear list of pages in the - history object are derived from the actual session history as - seen from the user's perspective. + The ancestorOrigins attribute's getter must run + these steps: - Similarly, a page containing two iframes has a history object distinct from the iframes' history objects, despite the fact that typical Web browsers present the - user with just one "Back" button, with a session history that interleaves the navigation of the - two inner frames and the outer page. + 1. If this {{Location}} object's relevant Document's origin is not + same origin-domain with the entry settings object's origin, then throw a + "SecurityError" {{DOMException}}. + 2. Otherwise, return this {{Location}} object's ancestor origins array. - Security: It is suggested that to avoid letting a page "hijack" the history - navigation facilities of a user agent by abusing pushState(), - the user agent provide the user with a way to jump back to the previous page (rather than just going back - to the previous state). For example, the back button could have a drop down showing just the pages - in the session history, and not showing any of the states. Similarly, an aural browser could have - two "back" commands, one that goes back to the previous state, and one that jumps straight back to - the previous page. + The {{Location}} object requires additional logic beyond IDL for security purposes. The internal + slot and internal methods {{Location}} objects must implement are defined below. - In addition, a user agent could ignore calls to pushState() that are invoked on a timer, or from event - listeners that are not triggered in response to a clear user action, or that are invoked in rapid - succession. + Every {{Location}} object has a \[[DefaultProperties]] internal slot representing its + own properties at time of its creation. -
        +

        Browsing the Web

        @@ -3831,8 +3660,8 @@
      1. If gone async is false, cancel any preexisting but not yet mature attempt to navigate the browsing context, including canceling any instances of the fetch algorithm started by those attempts. If one of those attempts - has already created and initialized a new Document object, abort that - Document also. (Navigation attempts that have matured already have session history entries, and are + has already created and initialized a new {{Document}} object, abort that + {{Document}} also. (Navigation attempts that have matured already have session history entries, and are therefore handled during the update the session history with the new page algorithm, later.)
      2. @@ -3843,7 +3672,7 @@
      3. If gone async is false, prompt - to unload the Document object. If the user refused to allow the + to unload the {{Document}} object. If the user refused to allow the document to be unloaded, then abort these steps. If this instance of the navigation algorithm gets canceled @@ -4082,7 +3911,7 @@

        This does not affect the address of the resource from which Request-URIs are obtained, as used to set the document's referrer in the initialize the - Document object steps below; they still use the value as computed by the + {{Document}} object steps below; they still use the value as computed by the original fetch algorithm.

        @@ -4117,7 +3946,7 @@

        This does not affect the address of the resource from which Request-URIs are obtained, as used to set the document's referrer in the initialize the - Document object steps below; they still use the value as computed by the + {{Document}} object steps below; they still use the value as computed by the original fetch algorithm.

        @@ -4222,10 +4051,10 @@ handler (e.g., one registered using registerContentHandler()). Setting the document's address: If there is no - override URL, then any Document created by these steps must have its + override URL, then any {{Document}} created by these steps must have its address set to the URL that was originally to be fetched, ignoring any other data that was used to obtain the resource. However, - if there is an override URL, then any Document created by + if there is an override URL, then any {{Document}} created by these steps must have its address set to that URL instead. @@ -4235,18 +4064,18 @@

        Initializing a new Document - object: when a Document is created as part of the above steps, the user agent + object: when a {{Document}} is created as part of the above steps, the user agent will be required to additionally run the following algorithm after creating the new object:
        1. Create a new Window object, and associate it with the {{Document}}, with one exception: if the browsing context's only entry in - its session history is the about:blank Document that was + its session history is the about:blank {{Document}} that was added when the browsing context was created, and navigation is occurring with - replacement enabled, and that Document has the same + replacement enabled, and that {{Document}} has the same origin as the new {{Document}}, then use the Window object of that - Document instead, and change the document + {{Document}} instead, and change the {{Document}} attribute of the {{Window}} object to point to the new {{Document}}.
        2. Set the Window object's HTTPS @@ -4262,18 +4091,18 @@
        3. - If the active sandboxing flag set of the Document's + If the active sandboxing flag set of the {{Document}}'s browsing context or any of its ancestor browsing contexts (if any) have the sandboxed fullscreen browsing context flag set, then skip this step. - If the Document's browsing context has a browsing context + If the {{Document}}'s browsing context has a browsing context container and either it is not an <{iframe}> element, or it does not have the allowfullscreen attribute specified, or its - Document does not have the fullscreen enabled flag set, then also + {{Document}} does not have the fullscreen enabled flag set, then also skip this step. - Otherwise, set the Document's fullscreen enabled flag. + Otherwise, set the {{Document}}'s fullscreen enabled flag.
        @@ -4318,14 +4147,14 @@ Some of the sections below, to which the above algorithm defers in certain cases, require the user agent to update the session history with the new page. When a user agent is - required to do this, it must queue a task (associated with the Document + required to do this, it must queue a task (associated with the {{Document}} object of the current entry, not the new one) to run the following steps:
        1. - Unload the Document object of the + Unload the {{Document}} object of the current entry, with the recycle parameter set to false. If this instance of the navigation algorithm is canceled while @@ -4346,7 +4175,7 @@
            -
          1. Replace the Document of the entry being updated, and any other entries +
          2. Replace the {{Document}} of the entry being updated, and any other entries that referenced the same document as that entry, with the new {{Document}}.
          3. Traverse the history to the new entry.
          4. @@ -4356,7 +4185,7 @@

            This can only happen if the entry being updated is not the current entry, and can never happen with replacement enabled. (It happens when the - user tried to traverse to a session history entry that no longer had a Document + user tried to traverse to a session history entry that no longer had a {{Document}} object.)

            @@ -4382,7 +4211,7 @@
          5. Append a new entry at the end of the History object representing the new - resource and its Document object, related state, and the default scroll + resource and its {{Document}} object, related state, and the default scroll restoration mode of "auto".
          6. Traverse the history to the new entry. If the navigation was initiated @@ -4405,7 +4234,7 @@ amount of time, as desired by the user agent implementor. (This is intended to allow the user agent to optimize the user experience in the face of performance concerns.)
          7. -
          8. If the Document object has no parser, or its parser has stopped parsing, or the user agent has reason to believe the user is no longer +
          9. If the {{Document}} object has no parser, or its parser has stopped parsing, or the user agent has reason to believe the user is no longer interested in scrolling to the fragment identifier, then abort these steps.
          10. Scroll to the fragment identifier given in the document's @@ -4421,8 +4250,8 @@

            Page load processing model for HTML files

            When an HTML document is to be loaded in a
            browsing context, the user agent must - queue a task to create a Document object, mark it as being an HTML document, set its content type to "text/html", - initialize the Document object, and finally create an HTML + queue a task to create a {{Document}} object, mark it as being an HTML document, set its content type to "text/html", + initialize the {{Document}} object, and finally create an HTML parser and associate it with the {{Document}}. Each task that the networking task source places on the task queue while fetching runs must then fill the parser's input byte stream with the fetched bytes and cause the HTML parser to perform the @@ -4438,7 +4267,7 @@ When no more bytes are available, the user agent must queue a task for the parser to process the implied EOF character, which eventually causes a load event to be fired. - After creating the Document object, but before any script execution, certainly + After creating the {{Document}} object, but before any script execution, certainly before the parser stops, the user agent must update the session history with the new page. @@ -4453,15 +4282,15 @@ When faced with displaying an XML file inline, user agents must follow the requirements defined in the XML and Namespaces in XML recommendations, RFC 7303, DOM, and other relevant specifications - to create a Document object and a corresponding XML parser. [[!XML]] [[!XML-NAMES]] [[!RFC7303]] [[!DOM]] + to create a {{Document}} object and a corresponding XML parser. [[!XML]] [[!XML-NAMES]] [[!RFC7303]] [[!DOM]]

            At the time of writing, the XML specification community had not actually yet specified how XML and the DOM interact.

            - After the Document is created, the user agent must initialize the - Document object. + After the {{Document}} is created, the user agent must initialize the + {{Document}} object. The actual HTTP headers and other metadata, not the headers as mutated or implied by the algorithms given in this specification, are the ones that must be used when determining the @@ -4490,7 +4319,7 @@

            User agents may examine the namespace of the root {{Element}} node of this - Document object to perform namespace-based dispatch to alternative processing tools, + {{Document}} object to perform namespace-based dispatch to alternative processing tools, e.g., determining that the content is actually a syndication feed and passing it to a feed handler. If such processing is to take place, abort the steps in this section, and jump to the next step (labeled non-document content) in the navigate steps above. @@ -4506,9 +4335,9 @@

            Page load processing model for text files

            When a plain text document is to be loaded in a browsing context, the user agent - must queue a task to create a Document object, mark it as being an HTML document, set its content type to the sniffed MIME type of the + must queue a task to create a {{Document}} object, mark it as being an HTML document, set its content type to the sniffed MIME type of the resource (type in the navigate algorithm), initialize the - Document object, create an HTML parser, associate it with the + {{Document}} object, create an HTML parser, associate it with the {{Document}}, act as if the tokenizer had emitted a start tag token with the tag name "pre" followed by a single U+000A LINE FEED (LF) character, and switch the HTML parser's tokenizer to the [[#plaintext-state]]. Each task that @@ -4523,13 +4352,13 @@ The document's character encoding must be set to the character encoding used to decode the document. - Upon creation of the Document object, the user agent must run the application cache selection algorithm with no manifest, and + Upon creation of the {{Document}} object, the user agent must run the application cache selection algorithm with no manifest, and passing in the newly-created {{Document}}. When no more bytes are available, the user agent must queue a task for the parser to process the implied EOF character, which eventually causes a load event to be fired. - After creating the Document object, but potentially before the page has finished + After creating the {{Document}} object, but potentially before the page has finished parsing, the user agent must update the session history with the new page. User agents may add content to the <{head}> element of the {{Document}}, e.g., @@ -4555,7 +4384,7 @@ For each body part obtained from the resource, the user agent must run a new instance of the navigate algorithm, starting from the resource handling step, using the new body part as the resource being navigated, with replacement enabled if a previous - body part from the same resource resulted in a Document object being created and + body part from the same resource resulted in a {{Document}} object being created and initialized, and otherwise using the same setup as the navigate attempt that caused this section to be invoked in the first place. @@ -4571,9 +4400,9 @@

            Page load processing model for media

            When an image, video, or audio resource is to be loaded in a browsing context, the - user agent should create a Document object, mark it as being an HTML document, set its content + user agent should create a {{Document}} object, mark it as being an HTML document, set its content type to the sniffed MIME type of the resource (type in the - navigate algorithm), initialize the Document object, append + navigate algorithm), initialize the {{Document}} object, append an <{html}> element to the {{Document}}, append a <{head}> element and a <{body}> element to the <{html}> element, append an element host element for the media, as described below, to the <{body}> element, and set the appropriate attribute of the element host element, as described @@ -4602,10 +4431,10 @@ Then, the user agent must act as if it had stopped parsing. - Upon creation of the Document object, the user agent must run the application cache selection algorithm with no manifest, and + Upon creation of the {{Document}} object, the user agent must run the application cache selection algorithm with no manifest, and passing in the newly-created {{Document}}. - After creating the Document object, but potentially before the page has finished + After creating the {{Document}} object, but potentially before the page has finished fully loading, the user agent must update the session history with the new page. User agents may add content to the <{head}> element of the {{Document}}, or @@ -4616,11 +4445,11 @@

            Page load processing model for content that uses plugins

            When a resource that requires an external resource to be rendered is to be loaded in a - browsing context, the user agent should create a Document object, mark + browsing context, the user agent should create a {{Document}} object, mark it as being an HTML document and mark it as being a plugin document, set its content type to the sniffed MIME type of the resource (type in the - navigate algorithm), initialize the Document object, append + navigate algorithm), initialize the {{Document}} object, append an <{html}> element to the {{Document}}, append a <{head}> element and a <{body}> element to the <{html}> element, append an embed to the <{body}> element, and set the src attribute of the @@ -4635,10 +4464,10 @@ Then, the user agent must act as if it had stopped parsing. - Upon creation of the Document object, the user agent must run the application cache selection algorithm with no manifest, and + Upon creation of the {{Document}} object, the user agent must run the application cache selection algorithm with no manifest, and passing in the newly-created {{Document}}. - After creating the Document object, but potentially before the page has finished + After creating the {{Document}} object, but potentially before the page has finished fully loading, the user agent must update the session history with the new page. User agents may add content to the <{head}> element of the {{Document}}, or @@ -4646,7 +4475,7 @@ to give the document a title.

            - If the Document's active sandboxing + If the {{Document}}'s active sandboxing flag set has its sandboxed plugins browsing context flag set, the synthesized <{embed}> element will fail to render the content if the relevant plugin cannot be secured. @@ -4655,18 +4484,18 @@

            Page load processing model for inline content that doesn't have a DOM

            When the user agent is to display a user agent page inline in a browsing context, - the user agent should create a Document object, mark it as being an HTML document, set its content type to "text/html", - initialize the Document object, and then either associate that - Document with a custom rendering that is not rendered using the normal - Document rendering rules, or mutate that Document until it represents + the user agent should create a {{Document}} object, mark it as being an HTML document, set its content type to "text/html", + initialize the {{Document}} object, and then either associate that + {{Document}} with a custom rendering that is not rendered using the normal + {{Document}} rendering rules, or mutate that {{Document}} until it represents the content the user agent wants to render. Once the page has been set up, the user agent must act as if it had stopped parsing. - Upon creation of the Document object, the user agent must run the application cache selection algorithm with no manifest, + Upon creation of the {{Document}} object, the user agent must run the application cache selection algorithm with no manifest, passing in the newly-created {{Document}}. - After creating the Document object, but potentially before the page has been + After creating the {{Document}} object, but potentially before the page has been completely set up, the user agent must update the session history with the new page. @@ -4691,11 +4520,11 @@
          11. Remove any tasks queued by the history traversal - task source that are associated with any Document objects in the + task source that are associated with any {{Document}} objects in the top-level browsing context's document family.
          12. Append a new entry at the end of the History object representing the new - resource and its Document object, related state, and current history scroll restoration preference. Its URL must be set to the address to which the user + resource and its {{Document}} object, related state, and current history scroll restoration preference. Its URL must be set to the address to which the user agent was navigating. The title must be left unset.
          13. Traverse the history to the new entry, with the non-blocking events flag @@ -4730,7 +4559,7 @@
          14. Use the scroll an element into view algorithm to scroll target into view, with the align to top flag set. [[!CSSOM-VIEW]]
          15. -
          16. Run the focusing steps for that element, with the Document's +
          17. Run the focusing steps for that element, with the {{Document}}'s viewport as the fallback target.
          18. Move the sequential focus navigation starting point to @@ -4741,7 +4570,7 @@ The indicated part of the document is the one that the fragment identifier, if any, identifies. The semantics of the fragment identifier in terms of mapping it to a specific DOM Node is defined by the specification that defines the MIME type used by the - Document (for example, the processing of fragment identifiers for XML MIME types is the responsibility of RFC7303). [[!RFC7303]] + {{Document}} (for example, the processing of fragment identifiers for XML MIME types is the responsibility of RFC7303). [[!RFC7303]] For HTML documents (and HTML MIME types), the following processing model must be followed to determine what the indicated part of the @@ -4807,11 +4636,11 @@
          19. - If there is no longer a Document object for the entry in question, + If there is no longer a {{Document}} object for the entry in question, navigate the browsing context to the resource for that entry to perform an entry update of that entry, and abort these steps. The "navigate" algorithm reinvokes this "traverse" - algorithm to complete the traversal, at which point there is a Document + algorithm to complete the traversal, at which point there is a {{Document}} object and so this step gets skipped. The navigation must be done using the same source browsing context as was used the first time this entry was created. (This can never happen with replacement enabled.) @@ -4830,30 +4659,30 @@ returned by the document.title IDL attribute.
          20. If appropriate, update the current entry in the browsing - context's Document object's History object to reflect any state + context's {{Document}} object's History object to reflect any state that the user agent wishes to persist. The entry is then said to be an entry with persisted user state.
          21. -
          22. If the specified entry has a different Document object +
          23. If the specified entry has a different {{Document}} object than the current entry, then run the following substeps:
            1. Remove any tasks queued by the history traversal - task source that are associated with any Document objects in the + task source that are associated with any {{Document}} objects in the top-level browsing context's document family.
            2. - If the origin of the Document of the specified + If the origin of the {{Document}} of the specified entry is not the same as the origin of the - Document of the current entry, then run the following + {{Document}} of the current entry, then run the following sub-sub-steps:
              1. The current browsing context name must be stored with all the entries in - the history that are associated with Document objects with the same + the history that are associated with {{Document}} objects with the same origin as the active document and that are contiguous with the current entry.
              2. @@ -4866,7 +4695,7 @@
              3. Make the specified entry's - Document object the active document of the browsing + {{Document}} object the active document of the browsing context.
              4. @@ -4880,7 +4709,7 @@ the specified entry.
              5. Clear any browsing context names stored - with all entries in the history that are associated with Document objects with + with all entries in the history that are associated with {{Document}} objects with the same origin as the new active document and that are contiguous with the specified entry.
              6. @@ -4889,24 +4718,24 @@
              7. If the specified entry's - Document has any form controls whose autofill field name is "off", invoke the reset algorithm of each of those elements.
              8. + {{Document}} has any form controls whose autofill field name is "off", invoke the reset algorithm of each of those elements.
              9. If the current document readiness of the specified entry's - Document is "complete", queue a task to run + {{Document}} is "complete", queue a task to run the following sub-sub-steps:
                  -
                1. If the Document's page showing flag is true, then abort this +
                2. If the {{Document}}'s page showing flag is true, then abort this task (i.e., don't fire the event below).
                3. -
                4. Set the Document's page showing flag to true.
                5. +
                6. Set the {{Document}}'s page showing flag to true.
                7. - Run any session history document visibility change steps for Document that + Run any session history document visibility change steps for {{Document}} that are defined by other applicable specifications.

                  @@ -4916,7 +4745,7 @@

                8. Fire a trusted event with the name pageshow at the Window object of that - {{Document}}, with target override set to the Document + {{Document}}, with target override set to the {{Document}} object, using the PageTransitionEvent interface, with the persisted attribute initialized to true. This event must not bubble, must not be cancelable, and has no default action.
                9. @@ -4934,7 +4763,7 @@
                10. If the specified entry has a URL whose fragment identifier differs from that of the current entry's when compared in a case-sensitive - manner, and the two share the same Document object, then let hash + manner, and the two share the same {{Document}} object, then let hash changed be true, and let old URL be the URL of the current entry and new URL be the URL of the specified entry. Otherwise, let hash changed be false.
                11. @@ -4956,9 +4785,9 @@
                12. Set history.state to state.
                13. -
                14. Let state changed be true if the Document of the specified entry has a latest entry, and that entry is not the specified entry; otherwise let it be false. +
                15. Let state changed be true if the {{Document}} of the specified entry has a latest entry, and that entry is not the specified entry; otherwise let it be false. -
                16. Let the latest entry of the Document of the specified entry be the specified entry.
                17. +
                18. Let the latest entry of the {{Document}} of the specified entry be the specified entry.
                19. @@ -5166,7 +4995,7 @@
                  - A Document has a salvageable state, which must initially be + A {{Document}} has a salvageable state, which must initially be true, a fired unload flag, which must initially be false, and a page showing flag, which must initially be false. The page showing flag is used to ensure that scripts receive pageshow and pagehide events in a consistent manner (e.g., that they never @@ -5184,19 +5013,19 @@
                20. Increase the event loop's termination nesting level by one.
                21. -
                22. Increase the Document's ignore-opens-during-unload counter by +
                23. Increase the {{Document}}'s ignore-opens-during-unload counter by one.
                24. Let event be a new trusted BeforeUnloadEvent event object with the name beforeunload, which does not bubble but is cancelable.
                25. -
                26. Dispatch: Dispatch event at the Document's Window object.
                27. +
                28. Dispatch: Dispatch event at the {{Document}}'s Window object.
                29. Decrease the event loop's termination nesting level by one.
                30. If any event listeners were triggered by the earlier dispatch step, then set the - Document's salvageable state to + {{Document}}'s salvageable state to false.
                31. @@ -5244,14 +5073,14 @@
                32. -
                33. End: Decrease the Document's ignore-opens-during-unload +
                34. End: Decrease the {{Document}}'s ignore-opens-during-unload counter by one.
                When a user agent is to unload a document, it must run the following steps. These steps are passed an argument, recycle, which is either true or false, - indicating whether the Document object is going to be re-used. (This is set by the + indicating whether the {{Document}} object is going to be re-used. (This is set by the document.open() method.)
                  @@ -5259,25 +5088,25 @@
                1. Increase the event loop's termination nesting level by one.
                2. -
                3. Increase the Document's ignore-opens-during-unload counter by +
                4. Increase the {{Document}}'s ignore-opens-during-unload counter by one.
                5. -
                6. If the Document's page showing flag is false, then jump to the +
                7. If the {{Document}}'s page showing flag is false, then jump to the step labeled unload event below (i.e., skip firing the pagehide event and don't rerun the unloading document visibility change steps).
                8. -
                9. Set the Document's page showing flag to false.
                10. +
                11. Set the {{Document}}'s page showing flag to false.
                12. Fire a trusted event with the name pagehide at the Window object of the - {{Document}}, with target override set to the Document + {{Document}}, with target override set to the {{Document}} object, using the PageTransitionEvent interface, with the persisted attribute initialized - to true if the Document object's salvageable state is true, and false otherwise. This + to true if the {{Document}} object's salvageable state is true, and false otherwise. This event must not bubble, must not be cancelable, and has no default action.
                13. - Run any unloading document visibility change steps for Document that + Run any unloading document visibility change steps for {{Document}} that are defined by other applicable specifications.

                  @@ -5286,19 +5115,19 @@

                14. -
                15. Unload event: If the Document's fired unload flag is +
                16. Unload event: If the {{Document}}'s fired unload flag is false, fire a simple event named unload at the - Document's Window object, with target override set to the - Document object.
                17. + {{Document}}'s Window object, with target override set to the + {{Document}} object.
                18. Decrease the event loop's termination nesting level by one.
                19. If any event listeners were triggered by the earlier unload event step, then set - the Document object's salvageable state - to false and set the Document's fired unload flag to true.
                20. + the {{Document}} object's salvageable state + to false and set the {{Document}}'s fired unload flag to true. -
                21. Run any unloading document cleanup steps for Document that are +
                22. Run any unloading document cleanup steps for {{Document}} that are defined by this specification and other applicable specifications.
                23. If this algorithm was invoked by another instance of the "unload a document" algorithm @@ -5329,10 +5158,10 @@
                24. -
                25. If both the Document's salvageable state and recycle are - false, then the Document's browsing context must discard the Document.
                26. +
                27. If both the {{Document}}'s salvageable state and recycle are + false, then the {{Document}}'s browsing context must discard the Document.
                28. -
                29. End: Decrease the Document's ignore-opens-during-unload +
                30. End: Decrease the {{Document}}'s ignore-opens-during-unload counter by one.
                @@ -5345,19 +5174,19 @@
              10. Make disappear any WebSocket objects that were created by the WebSocket() constructor from the - Document's Window object. + {{Document}}'s Window object. - If this affected any WebSocket objects, then set Document's salvageable state to false. + If this affected any WebSocket objects, then set {{Document}}'s salvageable state to false.
              11. -
              12. If the Document's salvageable +
              13. If the {{Document}}'s salvageable state is false, forcibly close any EventSource objects that whose constructor was invoked from the - Document's Window object.
              14. + {{Document}}'s Window object. -
              15. If the Document's salvageable - state is false, empty the Document's Window's list of active +
              16. If the {{Document}}'s salvageable + state is false, empty the {{Document}}'s Window's list of active timers.
              @@ -5403,32 +5232,32 @@

              Aborting a document load

              - If a Document is aborted, the user agent must + If a {{Document}} is aborted, the user agent must run the following steps:
              1. Abort the active documents of every child browsing context. If this results in any of those - Document objects having their salvageable state set to false, then set this - Document's salvageable state to false + {{Document}} objects having their salvageable state set to false, then set this + {{Document}}'s salvageable state to false also.
              2. Cancel any instances of the fetch algorithm in the context of this {{Document}}, discarding any tasks queued for them, and discarding any further data received from the network for them. If this resulted in any instances of the fetch algorithm being canceled or any queued tasks or any network data getting - discarded, then set the Document's salvageable state to false.
              3. + discarded, then set the {{Document}}'s salvageable state to false. -
              4. If the Document has an active parser, then abort that parser and set the Document's salvageable state to false.
              5. +
              6. If the {{Document}} has an active parser, then abort that parser and set the {{Document}}'s salvageable state to false.
              User agents may allow users to explicitly invoke the abort a document algorithm for a {{Document}}. If the user does so, then, if that - Document is an active document, the user agent should queue a + {{Document}} is an active document, the user agent should queue a task to fire a simple event named abort at - that Document's Window object before invoking the abort algorithm. + that {{Document}}'s Window object before invoking the abort algorithm.
      4. @@ -5755,7 +5584,7 @@ A relevant application cache is an application cache that is the newest in its group to be complete. Each application cache group has a list of pending master entries. Each entry in this - list consists of a resource and a corresponding Document object. It is used during + list consists of a resource and a corresponding {{Document}} object. It is used during the application cache download process to ensure that new master entries are cached even if the application cache download process was already running for their application cache group when they were loaded. @@ -5765,12 +5594,12 @@
        - A cache host is a Document or a SharedWorkerGlobalScope + A cache host is a {{Document}} or a SharedWorkerGlobalScope object. A cache host can be associated with an application cache. [[!WEBWORKERS]] - A Document initially is not associated with an application cache, but + A {{Document}} initially is not associated with an application cache, but can become associated with one early during the page load process, when steps in the parser and in the navigation sections cause cache selection to occur. @@ -6490,7 +6319,7 @@
        1. Mark cache group as obsolete. This cache group no - longer exists for any purpose other than the processing of Document objects + longer exists for any purpose other than the processing of {{Document}} objects already associated with an application cache in the cache group.
        2. @@ -6506,7 +6335,7 @@
        3. For each entry in cache group's list of pending master entries, create a task to fire a simple event that is cancelable named error (not obsolete!) at the ApplicationCache - singleton of the Document for this entry, if there still is one, and append it to + singleton of the {{Document}} for this entry, if there still is one, and append it to task list. The default action of this event must be, if the user agent shows caching progress, the display of some sort of user interface indicating to the user that the user agent failed to save the application for offline use.
        4. @@ -6560,12 +6389,12 @@ error, the connection times out, or the user cancels the download), or if the resource is labeled with the "no-store" cache directive, then create a task to fire a simple event that is cancelable named error at the ApplicationCache - singleton of the Document for this entry, if there still is one, and append it to + singleton of the {{Document}} for this entry, if there still is one, and append it to task list. The default action of this event must be, if the user agent shows caching progress, the display of some sort of user interface indicating to the user that the user agent failed to save the application for offline use. - Otherwise, associate the Document for this entry with cache; store the resource for this entry in cache, if it + Otherwise, associate the {{Document}} for this entry with cache; store the resource for this entry in cache, if it isn't already there, and categorize its entry as a master entry. If applying the URL parser algorithm to the resource's URL results in a resulting URL record that has a non-null fragment component, the URL @@ -6605,7 +6434,7 @@ flag to incomplete.
        5. For each entry in cache group's list of pending master entries, associate the - Document for this entry with new cache.
        6. + {{Document}} for this entry with new cache.
        7. Set the status of cache group to downloading.
        8. @@ -6813,12 +6642,12 @@
            -
          1. Unassociate the Document for this entry from new +
          2. Unassociate the {{Document}} for this entry from new cache.
          3. Queue a post-load task to fire a simple event that is cancelable named error at the - ApplicationCache singleton of the Document for this entry, if there + ApplicationCache singleton of the {{Document}} for this entry, if there still is one. The default action of this event must be, if the user agent shows caching progress, the display of some sort of user interface indicating to the user that the user agent failed to save the application for offline use. @@ -6942,12 +6771,12 @@
          4. Wait for the resource for this entry to have either completely downloaded or failed. -
          5. Unassociate the Document for this entry from its application +
          6. Unassociate the {{Document}} for this entry from its application cache, if it has one.
          7. Create a task to fire a simple event that is cancelable named error at the - ApplicationCache singleton of the Document for this entry, if there + ApplicationCache singleton of the {{Document}} for this entry, if there still is one, and append it to task list. The default action of these events must be, if the user agent shows caching progress, the display of some sort of user interface indicating to the user that the user agent failed to save the application for @@ -6996,8 +6825,8 @@
            - Each Document has a list of pending application cache download process - tasks that is used to delay events fired by the algorithm above until the document's load event has fired. When the Document is created, the + Each {{Document}} has a list of pending application cache download process + tasks that is used to delay events fired by the algorithm above until the document's load event has fired. When the {{Document}} is created, the list must be empty. When the steps above say to queue a post-load task task, where @@ -7042,7 +6871,7 @@

            The application cache selection algorithm

            When the application cache selection algorithm - algorithm is invoked with a Document document and optionally a + algorithm is invoked with a {{Document}} document and optionally a manifest URL manifest URL, the user agent must run the first applicable set of steps from the following list: @@ -7106,7 +6935,7 @@
            - The Document is not associated with any application cache. + The {{Document}} is not associated with any application cache. If there was a manifest URL, the user agent may report to the user that it was ignored, to aid in application development. diff --git a/sections/infrastructure.include b/sections/infrastructure.include index 7e3a7d7f37..7e32a33e1a 100644 --- a/sections/infrastructure.include +++ b/sections/infrastructure.include @@ -638,8 +638,10 @@ * fragment * A network scheme * The URL serializer + * The host parser * The host serializer - * The serialize an integer + * Host equals + * serialize an integer * Default encode set * Percent encode * UTF-8 percent encode diff --git a/sections/obsolete.include b/sections/obsolete.include index e459c19316..159f796932 100644 --- a/sections/obsolete.include +++ b/sections/obsolete.include @@ -840,11 +840,10 @@ The noResize IDL attribute of the <{frame}> element must reflect the element's noresize content attribute. - The contentDocument IDL attribute of the <{frame}> element must - return the {{Document}} object of the active document of the frame - element's nested browsing context, if any and if its effective script origin is the - same origin as the effective script origin specified by the incumbent settings - object, or null otherwise. + The contentDocument IDL attribute must + return the {{Document}} object of the active document of the <{frame}> element's + nested browsing context, if any and if its origin is the same origin-domain + as the origin specified by the incumbent settings object, or null otherwise. The contentWindow IDL attribute must return the WindowProxy object of the <{frame}> element's nested browsing context. diff --git a/sections/semantics-embedded-content.include b/sections/semantics-embedded-content.include index 8d82dc01c1..c4d20e9187 100644 --- a/sections/semantics-embedded-content.include +++ b/sections/semantics-embedded-content.include @@ -4082,11 +4082,10 @@ My <img src="heart.png" alt="heart"> breaks. must reflect the allowfullscreen content attribute. - The contentDocument IDL attribute - must return the {{Document}} object of the active document of the - <{iframe}> element's nested browsing context, if any and if its - effective script origin is the same origin as the effective script - origin specified by the incumbent settings object, or null otherwise. + The contentDocument IDL attribute must + return the {{Document}} object of the active document of the <{iframe}> element's + nested browsing context, if any and if its origin is the same origin-domain + as the origin specified by the incumbent settings object, or null otherwise. The contentWindow IDL attribute must return the WindowProxy object of the <{iframe}> element's nested browsing context, if any, or null otherwise. @@ -5040,11 +5039,10 @@ attribute's value is a type that a plugin supports, then the value of the attribute. The {{HTMLObjectElement/useMap}} IDL attribute must reflect the <{object/usemap}> content attribute. - The {{HTMLObjectElement/contentDocument}} IDL attribute - must return the {{Document}} object of the active document of the - <{object}> element's nested browsing context, if any and if its - effective script origin is the same origin as the effective script - origin specified by the incumbent settings object, or null otherwise. + The {{HTMLObjectElement/contentDocument}} IDL attribute must return the {{Document}} object of the + active document of the <{object}> element's nested browsing context, if any and if + its origin is the same origin-domain as the origin specified by the + incumbent settings object, or null otherwise. The {{HTMLObjectElement/contentWindow}} IDL attribute must return the WindowProxy object of the <{object}> element's nested browsing context, if it has one; otherwise, it must return null. diff --git a/sections/webappapis.include b/sections/webappapis.include index 2a2418c00a..12328c2b9b 100644 --- a/sections/webappapis.include +++ b/sections/webappapis.include @@ -3162,7 +3162,7 @@ a credentials mode, a cryptographic nonce, and a parser state:
          8. - Let incumbent origin be the effective script origin + Let incumbent origin be the origin specified by the incumbent settings object at the time the showModalDialog() method was called.
          9. @@ -3332,9 +3332,9 @@ a credentials mode, a cryptographic nonce, and a parser state: The dialogArguments IDL attribute, on getting, must check whether its browsing context's active document's - effective script origin is the same as the dialog arguments' - origin. If it is, then the browsing context's dialog arguments must be - returned unchanged. Otherwise, the IDL attribute must return undefined. + origin is the same origin-domain as the dialog arguments' origin. If it is, + then the browsing context's dialog arguments must be returned unchanged. Otherwise, the + IDL attribute must return undefined. These browsing contexts also have an associated return value and return value origin. As with the previous two values, these values are set by the showModalDialog() method in the algorithm above, when the diff --git a/single-page.bs b/single-page.bs index aacd824d46..6f92e82712 100644 --- a/single-page.bs +++ b/single-page.bs @@ -33,7 +33,6 @@ Ignored Vars: this, object, variable, optionalArgument, name, value, e, oldParen urlPrefix: http://validator.w3.org/nu/; url:; type:dfn; text: Nu Markup Validation Service; - urlPrefix: http://www.whatwg.org/specs/web-apps/current-work/; url:; type: dfn; spec: WHATWG; text: WHATWG HTML specification; url: http://www.w3.org/TR/REC-xml-names#NT-QName; type: dfn; @@ -58,19 +57,6 @@ url: https://tools.ietf.org/html/rfc7231#section-3.1.1.1; type: dfn; text: media-type url: http://www.w3.org/TR/xml/#NT-Name; type: dfn; spec: XML; for: XML; text: Name -url: http://www.w3.org/TR/dom/#concept-node-insert-ext; type: concept; spec: dom; - text: insertion step - text: insertion steps -urlPrefix: http://www.w3.org/TR/dom/#concept-document-; type: dfn; spec: dom; - text: encoding - text: document's character encoding; url: encoding - text: content type -url: http://www.w3.org/TR/dom/#interface-element; type: dfn; for: Element; - text: Element -urlPrefix: http://www.w3.org/TR/dom/#concept-; type: dfn; spec: dom; - text: collection -urlPrefix: http://www.w3.org/TR/dom/; type: dfn; spec: dom; - text: represented by the collection urlPrefix: https://www.w3.org/TR/WebIDL-1/; type: dfn; text: DOMException text: IndexSizeError @@ -170,22 +156,6 @@ url: http://www.w3.org/TR/WebIDL-1/#TreatNullAs; type: interface; spec: webidl; text: EmptyString url: http://www.w3.org/TR/webmessaging/#messageport; type: interface; spec: html-ls; text: MessagePort -urlPrefix: http://www.w3.org/TR/dom/#concept-node-; type: dfn; for: Node; spec: dom; - text: insert - text: append - text: remove - text: replace - text: adopt - text: clone -urlPrefix: http://www.w3.org/TR/dom/#concept-; type: dfn; spec: dom; - text: element attribute - text: cd data - text: event listener - text: id - text: range - text: range start - text: range end - text: range bp url: http://www.w3.org/TR/uievents/#event-types; type: dfn; spec: uievents; text: type url: http://www.w3.org/TR/MathML/chapter2.html#interf.toplevel; type: element; spec: mathml; @@ -209,9 +179,6 @@ urlPrefix: https://fullscreen.spec.whatwg.org/#; type: dfn; spec: fullscreen; text: fully exit fullscreen url: http://www.w3.org/TR/touch-events/#idl-def-TouchEvent; type: interface; spec: touch-events; text: Touch -urlPrefix: https://w3c.github.io/DOM-Parsing/#widl-Element-; type: attribute; for: Element; spec: dom-parsing - text: innerHTML; url: innerHTML - text: outerHTML; url: outerHTML url: https://fullscreen.spec.whatwg.org/#dom-element-requestfullscreen; type: method; for: Element; spec: fullscreen; text: requestFullscreen() url: http://www.w3.org/TR/CSS21/ui.html#system-colors; type: dfn; spec: css21 @@ -433,12 +400,49 @@ urlPrefix: https://drafts.csswg.org/cssom/#; spec: CSSOM-VIEW; text: run the scroll steps; type: dfn text: Serializing a CSS value; url: serializing-css-values; type: dfn text: the features argument of window.open; url: the-features-argument-to-the-open()-method; type: dfn + + + +urlPrefix: http://www.w3.org/TR/dom/#; spec: DOM; + urlPrefix: concept-; type: dfn + text: cd data + text: collection + urlPrefix: document-; + text: encoding + text: document's character encoding; url: encoding + text: content type + text: document url + text: element attribute + text: event listener + text: id + urlPrefix: node-; for: Node; + text: adopt + text: append + text: clone + text: insert + text: remove + text: replace + url: node-insert-ext + text: insertion step + text: insertion steps + text: range + text: range bp + text: range end + text: range start + + text: represented by the collection; type: dfn -urlPrefix: http://www.w3.org/TR/DOM-Parsing/#; spec: DOMPARSING; +urlPrefix: http://www.w3.org/TR/DOM-Parsing/#; spec: DOM-PARSING; text: DOMParser; url: the-domparser-interface; type: interface +urlPrefix: https://w3c.github.io/DOM-Parsing/#; spec: DOM-PARSING + urlPrefix: widl-Element-; type: attribute; for: Element; + text: innerHTML + text: outerHTML + urlPrefix: http://www.ecma-international.org/ecma-262/6.0/#; spec: ECMA-262; @@ -664,7 +668,11 @@ urlPrefix: https://url.spec.whatwg.org/#; type: dfn; spec: URL; text: domain to ascii text: domain to unicode text: host; for: host-concept + text: Host equals + text: host parser text: host serializer + text: ipv4 + text: ipv6 text: url parser url: url-serializer; for: url text: serialization @@ -744,8 +752,6 @@ spec:css-overflow-3; type:value; for:overflow; text: scroll spec:svg; type:interface; text:SVGMatrix -spec:dom-ls; type:interface; - text: element spec:css21; type:property; text:border-collapse spec:css21; type:property; From 400aa8fa593029204568f18e96e9d093c5f05469 Mon Sep 17 00:00:00 2001 From: Travis Leithead Date: Fri, 13 May 2016 15:14:42 -0700 Subject: [PATCH 13/19] Finally builds CLEAN! --- sections/attributes.include | 2 +- sections/browsers.include | 310 +++++----- sections/dom.include | 22 +- sections/iana.include | 14 +- sections/infrastructure.include | 554 +++++++++--------- sections/obsolete.include | 5 +- sections/rendering.include | 2 +- sections/semantics-embedded-content.include | 36 +- sections/semantics-forms.include | 9 +- .../semantics-interactive-elements.include | 12 +- sections/semantics-links.include | 10 +- sections/semantics-scriptings.include | 33 +- sections/syntax.include | 49 +- sections/webappapis.include | 60 +- single-page.bs | 6 +- 15 files changed, 562 insertions(+), 562 deletions(-) diff --git a/sections/attributes.include b/sections/attributes.include index b5f798879f..472546eae9 100644 --- a/sections/attributes.include +++ b/sections/attributes.include @@ -158,7 +158,7 @@
    4. - + diff --git a/sections/browsers.include b/sections/browsers.include index df102b00cf..6d8492bbf2 100644 --- a/sections/browsers.include +++ b/sections/browsers.include @@ -65,9 +65,9 @@ If a browsing context A has a creator browsing context, then the creator origin, creator URL, and creator base URL are the - origin, URL, and base URL, respectively, of the {{Document}} that - was the active document of that creator browsing context at the time A - was created. + origin, URL, and base URL, respectively, of + the {{Document}} that was the active document of that creator browsing context at + the time A was created. To create a new browsing context: @@ -85,12 +85,12 @@ about:blank, which is marked as being an HTML document, whose character encoding is UTF-8, and which is both ready for post-load tasks and completely loaded immediately. - 4. Set the origin of document: + 4. Set the origin of document: * If the new browsing context has a creator browsing context, then the - origin of document is the creator origin. - * Otherwise, the origin of document is a unique opaque origin - assigned when the new browsing context is created. + origin of document is the creator origin. + * Otherwise, the origin of document is a unique + opaque origin assigned when the new browsing context is created. 5. If the new browsing context has a creator browsing context, then set document's referrer to the creator URL. 6. Ensure that document has a single child <{html}> node, which itself has two empty @@ -228,9 +228,9 @@ 3. If context is not a nested browsing context, return null and abort these steps. 4. Let container be context's browsing context container. - 5. If container's node document's origin is not - same origin-domain with the entry settings object's origin, then return - null and abort these steps. + 5. If container's node document's origin is not + same origin-domain with the entry settings object's origin, + then return null and abort these steps. 6. Return container.

      Auxiliary browsing contexts

      @@ -274,8 +274,8 @@ @@ -327,10 +327,10 @@ An element has a browsing context scope origin if its {{Document}}'s browsing context is a top-level browsing context or if all of its {{Document}}'s ancestor browsing contexts - all have active documents whose origin are the - same origin as the element's node document's origin. If an + all have active documents whose origin are the + same origin as the element's node document's origin. If an element has a browsing context scope origin, then its value is the - origin of the element's node document. + origin of the element's node document. @@ -350,10 +350,11 @@ directly reachable browsing contexts forms a unit of related browsing contexts. Each unit of related browsing contexts is then further divided into the smallest number of - groups such that every member of each group has an active document with an origin - that, through appropriate manipulation of the {{Document/domain|document.domain}} attribute, could - be made to be same origin-domain with other members of the group, but could not be made the - same as members of any other group. Each such group is a + groups such that every member of each group has an active document with an + origin that, through appropriate manipulation of the + {{Document/domain|document.domain}} attribute, could be made to be same origin-domain with + other members of the group, but could not be made the same as members of any other group. Each + such group is a unit of related similar-origin browsing contexts.

      There is also at most one event loop per @@ -793,9 +794,9 @@ :: Return the current base URL of the {{Document}} with which window is currently associated. - : The origin - :: Return the origin of the {{Document}} with which window is currently - associated. + : The origin + :: Return the origin of the {{Document}} with which window is + currently associated. : The creation URL :: Return url. @@ -929,8 +930,9 @@

      IsPlatformObjectSameOrigin ( O )
      - 1. Return true if the current settings object's origin is same origin-domain - with O's relevant settings object's origin, and false otherwise. + 1. Return true if the current settings object's origin is + same origin-domain with O's relevant settings object's + origin, and false otherwise.
      CrossOriginGetOwnPropertyHelper ( O, P )
      @@ -942,8 +944,8 @@ { \[[Value]]: undefined, \[[Writable]]: false, \[[Enumerable]]: false, \[[Configurable]]: true }. 2. Let crossOriginKey be a tuple consisting of the current settings object's - origin's effective domain, O's relevant settings object's - origin's effective domain, and P. + origin's effective domain, O's relevant settings + object's origin's effective domain, and P. 3. Repeat for each e that is an element of CrossOriginProperties(O): 1. If SameValue(e.\[[Property]], P) is true, then: 1. If the value of the \[[CrossOriginPropertyDescriptorMap]] internal slot of @@ -994,7 +996,7 @@ 2. Let wrappedFunction be the \[[Wrapped]] internal slot of F. 3. Return Call(wrappedFunction, this, argumentsList). -

      Due to this being invoked from a different origin, a +

      Due to this being invoked from a different origin, a cross-origin wrapper function will have a different value for Function.prototype from the function being wrapped. This follows from how JavaScript creates anonymous built-in functions.

      @@ -1119,13 +1121,14 @@ {{Document}} with which the Window is associated. The value will be one of "modern", "deprecated", or "none". If it is not explicitly set, then its value is "none". - The window, frames, and self - IDL attributes must all return the Window object's browsing context's - WindowProxy object. + The window, + frames, and + self + IDL attributes must all return the {{Window}} object's browsing context's {{WindowProxy}} + object. The document IDL attribute must return - the Window object's newest - {{Document}} object. + the Window object's newest Document object.

      The {{Document}} object associated with a Window object can @@ -1839,7 +1842,7 @@


      - An origin is one of the following: + An origin is one of the following: : An opaque origin :: An internal value, with no serialisation, for which the only meaningful operation is testing @@ -1855,19 +1858,20 @@ stated otherwise.

      Origins can be shared, e.g., among multiple {{Document}} objects. Furthermore, - origins are generally immutable. Only the domain of a + origins are generally immutable. Only the domain of a tuple origin can be changed, and only through the {{Document/domain|document.domain}} API.

      - The effective domain of an origin origin is computed as follows: + The effective domain of an origin origin is computed as + follows: 1. If origin is an opaque origin, then return origin. 2. If origin's domain is non-null, then return origin's domain. 3. Return origin's host. - Various specification objects are defined to have an origin. These origins are - determined as follows: + Various specification objects are defined to have an origin. These + origins are determined as follows: : For {{Document}} objects :: @@ -1879,34 +1883,34 @@
      If the {{Document}}'s URL's scheme is a network scheme
      -
      A copy of the {{Document}}'s URL's origin assigned when the - {{Document}} is created. +
      A copy of the {{Document}}'s URL's origin assigned + when the {{Document}} is created.

      The {{Document/open()|document.open()}} method can change the {{Document}}'s - URL to "about:blank". Therefore the origin is assigned - when the {{Document}} is created.

      + URL to "about:blank". Therefore the + origin is assigned when the {{Document}} is created.

      If the {{Document}} is the initial "about:blank" document
      -
      The one it was assigned when its browsing context was created. -
      +
      The one it was assigned when its browsing context + was created.
      If the {{Document}} is a non-initial "about:blank" document
      If the {{Document}} was generated from a data: URL found in another {{Document}} or in a script
      -
      The origin of the incumbent settings object when the navigate - algorithm was invoked, or, if no script was involved, of the - node document of the element that initiated the navigation to that +
      The origin of the incumbent settings object when the + navigate algorithm was invoked, or, if no script was involved, + of the node document of the element that initiated the navigation to that URL.
      If the {{Document}} was created as part of the processing for javascript: URLs
      -
      The origin of the active document of the browsing context being - navigated when the navigate algorithm was invoked.
      +
      The origin of the active document of the + browsing context being navigated when the navigate algorithm was invoked.
      If the {{Document}} is an iframe srcdoc document
      -
      The origin of the {{Document}}'s browsing context's +
      The origin of the {{Document}}'s browsing context's browsing context container's node document.
      If the {{Document}} was obtained in some other manner (e.g., a @@ -1915,8 +1919,8 @@ {{DOMImplementation/createDocument()}} API, etc)
      The default behavior as defined in the DOM standard applies. [[!DOM]]. -

      The origin is a unique opaque origin assigned when the - {{Document}} is created.

      +

      The origin is a unique opaque origin assigned + when the {{Document}} is created.

      : For images of <{img}> elements @@ -1926,7 +1930,7 @@
      A unique opaque origin assigned when the image is created.
      If the image data is CORS-same-origin
      -
      The <{img}> element's node document's origin.
      +
      The <{img}> element's node document's origin.
      : For <{audio}> and <{video}> elements :: @@ -1935,15 +1939,17 @@
      A unique opaque origin assigned when the media data is fetched.
      If the media data is CORS-same-origin
      -
      The media element's node document's origin. +
      The media element's node document's + origin.
      : For fonts - :: For a downloadable Web font it is a copy of the origin of the URL record used to - obtain the font (after any redirects). [[!CSS-FONTS-3]] [[CSS-FONT-LOADING-3]] + :: For a downloadable Web font it is a copy of the origin of the + URL record used to obtain the font (after any redirects). [[!CSS-FONTS-3]] + [[CSS-FONT-LOADING-3]] - For a locally installed system font it is the origin of the {{Document}} in which that - font is being used. + For a locally installed system font it is the origin of the {{Document}} + in which that font is being used. Other specifications can override the above definitions by themselves specifying the origin of a particular {{Document}} object, image, media element, or font. @@ -1951,8 +1957,8 @@
      The Unicode serialization of an origin - is the string obtained by applying the following algorithm to the given origin - origin: + is the string obtained by applying the following algorithm to the given + origin origin: 1. If origin is an opaque origin, then return "null". 2. Let host be origin's host. @@ -1973,7 +1979,7 @@ The ASCII serialization of an origin is the string obtained by applying the - following algorithm to the given origin origin: + following algorithm to the given origin origin: 1. If origin is an opaque origin, then return "null". 2. Otherwise, let result be origin's scheme. @@ -1985,7 +1991,7 @@ serialized, to result. 6. Return result. - Two origins A and B are said to be + Two origins A and B are said to be same origin if the following algorithm returns true: @@ -1995,7 +2001,7 @@ ports are identical, then return true. 3. Return false. - Two origins A and B are said to be + Two origins A and B are said to be same origin-domain if the following algorithm returns true: 1. If A and B are the same opaque origin, then return true. @@ -2053,7 +2059,7 @@
      document . {{Document/domain}} [ = domain ]
      Returns the current domain used for security checks. - Can be set to a value that removes subdomains, to change the origin's + Can be set to a value that removes subdomains, to change the origin's domain to allow pages on other subdomains of the same domain (if they do the same thing) to access each other. (Can't be set in sandboxed <{iframe}>s.)
      @@ -2064,7 +2070,8 @@ 1. If this {{Document}} object does not have a browsing context, then return the empty string. - 2. Let effectiveDomain be this {{Document}}'s origin's effective domain. + 2. Let effectiveDomain be this {{Document}}'s origin's + effective domain. 3. If effectiveDomain is an opaque origin, then return the empty string. 4. Return effectiveDomain, serialised. @@ -2079,7 +2086,7 @@ {{DOMException}}. 4. Let host be the result of parsing the given value. 5. If host is failure, then throw a "SecurityError" {{DOMException}}. - 6. Let effectiveDomain be this {{Document}} object's origin's + 6. Let effectiveDomain be this {{Document}} object's origin's effective domain. 7. If host is not equal to effectiveDomain, then run these substeps: @@ -2188,7 +2195,7 @@
      This flag forces content into a unique origin, thus preventing - it from accessing other content from the same origin. + it from accessing other content from the same origin. This flag also prevents script from reading from or writing to the document.cookie IDL attribute, and blocks access to @@ -2844,12 +2851,12 @@ these two URL records differ other than the path, query, and fragment components, then throw a "SecurityError" {{DOMException}} and abort these steps. - 5. If the origin of new URL is not the same as the origin of the - responsible document specified by the entry settings object, and either the - path or query components of the two URL records - compared in the previous step differ, throw a "SecurityError" - {{DOMException}} and abort these steps. (This prevents sandboxed content from spoofing - other pages on the same origin.) + 5. If the origin of new URL is not the same as the + origin of the responsible document specified by the + entry settings object, and either the path or query + components of the two URL records compared in the previous step differ, throw a + "SecurityError" {{DOMException}} and abort these steps. (This prevents + sandboxed content from spoofing other pages on the same origin.) 6. If the third argument is null, then let new URL be the URL of the current entry. 7. If the method invoked was the {{History/pushState()}} method: @@ -3189,7 +3196,7 @@ the step labeled End. 4. Let current be current's parent browsing context. 5. Append the Unicode serialization of current's active document's - origin to output as a new value. + origin to output as a new value. 6. Return to the step labeled Loop. 7. End: Return output. @@ -3237,7 +3244,7 @@ The origin attribute's getter must return the Unicode serialization of this - {{Location}} object's URL's origin. + {{Location}} object's URL's origin.

      It returns the Unicode rather than the ASCII serialization for compatibility with MessageEvent. @@ -3543,8 +3550,9 @@ The ancestorOrigins attribute's getter must run these steps: - 1. If this {{Location}} object's relevant Document's origin is not - same origin-domain with the entry settings object's origin, then throw a + 1. If this {{Location}} object's relevant Document's + origin is not same origin-domain with the + entry settings object's origin, then throw a "SecurityError" {{DOMException}}. 2. Otherwise, return this {{Location}} object's ancestor origins array. @@ -3619,10 +3627,10 @@

    5. If there is a preexisting attempt to navigate the browsing context, and the source browsing context is the same as the browsing context being navigated, and that attempt is currently running the unload a document algorithm, - and the origin of the URL of the resource being loaded in that - navigation is not the same origin as the origin of the URL - of the resource being loaded in this navigation, then abort these steps without - affecting the preexisting attempt to navigate the browsing context.
    6. + and the origin of the URL of the resource being loaded in + that navigation is not the same origin as the origin of the + URL of the resource being loaded in this navigation, then abort these + steps without affecting the preexisting attempt to navigate the browsing context.
    7. If a task queued by the traverse the history by a delta algorithm is running the unload a document algorithm for the @@ -3730,8 +3738,8 @@ these "javascript: URL" steps, associated with the active document of the browsing context being navigated: - 1. If the origin of the source browsing context is not the same origin as - the origin of the active document of the browsing context being + 1. If the origin of the source browsing context is not the same origin as + the origin of the active document of the browsing context being navigated, then let result be undefined, and jump to the step labeled process results below. 2. Let urlRecord be the result of running the URL parser on the @@ -3831,14 +3839,14 @@
    8. If request's method is not GET, or, if the navigation algorithm was invoked as a result of the form submission - algorithm, then if there is an origin of the active document + algorithm, then if there is an origin of the active document of the source browsing context, unset request's omit-Origin-header flag.
    9. Otherwise, if the browsing context being navigated is a child browsing context, and the browsing context container of the browsing context being navigated has a browsing context scope - origin, set request's origin + origin, set request's origin to that browsing context scope origin and unset request's omit-Origin-header flag.
    10. @@ -4133,7 +4141,7 @@ When a resource is handled by passing its URL or data to an external software package separate from the user agent (e.g., handing a mailto: URL to a mail client, or a Word document to a word processor), user agents should attempt to mitigate the risk that this is an attempt to exploit the target software, e.g., by prompting the user to confirm that the source browsing - context's active document's origin is to be allowed to invoke the + context's active document's origin is to be allowed to invoke the specified software. In particular, if the navigate algorithm, when it was invoked, was not allowed to show a popup, the user agent should not invoke the external software package without prior user confirmation. @@ -4304,7 +4312,7 @@ inserted into the document, the user agent must parse the value of that attribute relative to that element, and if that is successful, must apply the URL serializer - algorithm to the resulting URL record with the exclude fragment flag set to + algorithm to the resulting URL record with the exclude fragment flag set to obtain manifest URL, and then run the application cache selection algorithm with manifest URL as the manifest URL, passing in the newly-created {{Document}}. Otherwise, if the attribute is absent, its value is the empty @@ -4674,10 +4682,9 @@
    11. - If the origin of the {{Document}} of the specified - entry is not the same as the origin of the - {{Document}} of the current entry, then run the following - sub-sub-steps: + If the origin of the {{Document}} of the specified entry is not the same as + the origin of the {{Document}} of the current entry, then run the + following sub-sub-steps:
        @@ -4776,11 +4783,12 @@ identifier.
      1. If the entry is an entry with persisted user state, the user agent may - restore persisted user state and update - aspects of the document and its rendering.
      2. + restore persisted user state and update aspects of the document and its rendering. -
      3. If the entry is a state object entry, let state be a - structured clone of that state object. Otherwise, let state be +
      4. Let targetRealm be the current Realm Record.
      5. + +
      6. If the entry is a state object entry, let state be + StructuredClone(that state object, targetRealm) of that state object. Otherwise, let state be null.
      7. Set history.state to state.
      8. @@ -5948,7 +5956,7 @@
      9. Let mode be "explicit".
      10. -
      11. Start of line: If position is past the end of input, then jump to the last step. Otherwise, collect a sequence of +
      12. Start of line: If position is past the end of input, then jump to the last step. Otherwise, collect a sequence of characters that are U+000A LINE FEED (LF), U+000D CARRIAGE RETURN (CR), U+0020 SPACE, or U+0009 CHARACTER TABULATION (tab) characters.
      13. @@ -5962,25 +5970,25 @@ of line.
      14. If the first character in line is a U+0023 NUMBER SIGN character (#), - then jump back to the step labeled start of line.
      15. + then jump back to the step labeled Start of line.
      16. If line equals "CACHE:" (the word "CACHE" followed by a U+003A COLON character (:)), then set mode to "explicit" and jump back to the step labeled - start of line.
      17. + Start of line.
      18. If line equals "FALLBACK:" (the word "FALLBACK" followed by a U+003A COLON character (:)), then set mode to "fallback" and jump back to the step - labeled start of line.
      19. + labeled Start of line.
      20. If line equals "NETWORK:" (the word "NETWORK" followed by a U+003A COLON character (:)), then set mode to "online safelist" and jump back to - the step labeled start of line.
      21. + the step labeled Start of line.
      22. If line equals "SETTINGS:" (the word "SETTINGS" followed by a U+003A COLON character (:)), then set mode to "settings" and jump back to the step - labeled start of line.
      23. + labeled Start of line. -
      24. If line ends with a U+003A COLON character (:), then set mode to "unknown" and jump back to the step labeled start of line.
      25. +
      26. If line ends with a U+003A COLON character (:), then set mode to "unknown" and jump back to the step labeled Start of line.
      27. This is either a data line or it is syntactically incorrect.
      28. @@ -6020,17 +6028,18 @@
        - Parse the first item in tokens, - relative to base URL, with the URL character encoding set to UTF-8; - ignore the rest. + Let urlRecord be the result of parsing the first item in + tokens, with base URL; ignore the rest. - If this fails, then jump back to the step labeled start of line. + If urlRecord is failure, then jump back to the step labeled + Start of line. - If the resulting URL record has a different scheme component than base URL (the - manifest's URL), then jump back to the step labeled start of line. + If urlRecord has a different scheme component than + base URL (the manifest's URL), then jump back to the step labeled + Start of line. - Let new URL be the result of applying the URL serializer - algorithm to the resulting parsed URL, with the exclude fragment flag set. + Let new URL be the result of applying the URL serializer algorithm to + urlRecord, with the exclude fragment flag set. Add new URL to the explicit URLs. @@ -6038,41 +6047,38 @@
        If mode is "fallback"
        -
        - - Let part one be the first token in tokens, and let +
        Let part one be the first token in tokens, and let part two be the second token in tokens. - Parse part one and part two, relative to base URL, with the URL character - encoding set to UTF-8. + Let urlRecordOne be the result of parsing + part one with base URL. - If either fails, then jump back to the step labeled start of line. + Let urlRecordTwo be the result of parsing + part two with base URL. + + If either urlRecordOne or urlRecordTwo is failure, then jump back to the + step labeled Start of line. - If the absolute URL corresponding to either part one or - part two does not have the same origin as the manifest's URL, - then jump back to the step labeled start of line. + If the origin of either urlRecordOne or urlRecordTwo is + not same origin with the manifest's URL origin, then jump back to the + step labeled Start of line. - Let part one path be the path component - of the resulting URL record for part one. + Let part one path be the path component of urlRecordOne. - If manifest path is not a prefix match for part one - path, then jump back to the step labeled start of line. + If manifest path is not a prefix match for part one path, then + jump back to the step labeled Start of line. - Let part one be the result of applying the URL serializer - algorithm to the first resulting parsed URL, with the exclude fragment flag set. + Let part one be the result of applying the URL serializer algorithm to + urlRecordOne, with the exclude fragment flag set. - Let part two be the result of applying the URL serializer - algorithm to the second resulting parsed URL, with the exclude fragment flag - set. + Let part two be the result of applying the URL serializer algorithm to + urlRecordTwo, with the exclude fragment flag set. - If part one is already in the fallback URLs mapping - as a fallback namespace, then jump back to - the step labeled start of line. + If part one is already in the fallback URLs mapping as a + fallback namespace, then jump back to the step labeled Start of line. - Otherwise, add part one to the fallback URLs - mapping as a fallback namespace, mapped to - part two as the fallback - entry. + Otherwise, add part one to the fallback URLs mapping as a + fallback namespace, mapped to part two as the fallback entry.
        @@ -6082,18 +6088,18 @@ If the first item in tokens is a U+002A ASTERISK character (*), then set online safelist wildcard flag to open and jump back - to the step labeled start of line. + to the step labeled Start of line. Otherwise, let urlRecord be the result of parsing the first item in tokens with base URL. - If urlRecord is failure, then jump back to the step labeled start of line. + If urlRecord is failure, then jump back to the step labeled Start of line. If urlRecord has a different scheme component than base URL (the - manifest's URL), then jump back to the step labeled start of line. + manifest's URL), then jump back to the step labeled Start of line. - Let new URL be the result of applying the URL serializer - algorithm to the resulting parsed URL, with the exclude fragment flag set. + Let new URL be the result of applying the URL serializer algorithm to + urlRecord, with the exclude fragment flag set. Add new URL to the online safelist namespaces. @@ -6106,7 +6112,7 @@ If tokens contains a single token, and that token is a case-sensitive match for the string "prefer-online", then set cache mode flag to prefer-online and jump back to the - step labeled start of line. + step labeled Start of line. Otherwise, the line is an unsupported setting: do nothing; the line is ignored. @@ -6124,7 +6130,7 @@ -
      29. Jump back to the step labeled start of line. (That step jumps to the next, and last, +
      30. Jump back to the step labeled Start of line. (That step jumps to the next, and last, step when the end of the file is reached.)
      31. Return the explicit URLs list, the fallback URLs @@ -6400,7 +6406,7 @@ non-null fragment component, the URL used for the entry in cache must instead be the absolute URL obtained from applying the URL serializer - algorithm to the resulting URL record with the exclude fragment flag set + algorithm to the resulting URL record with the exclude fragment flag set (application caches never include fragment identifiers).
      32. @@ -6501,9 +6507,12 @@ in preparation for updating the application. [[!XHR]]
      33. Let request be a new request whose - URL is URL, client is null, destination is "subresource", origin is - manifest URL's origin, referrer is "no-referrer", - synchronous flag is set, credentials mode is "include", use-URL-credentials flag is set, and redirect mode is "manual".
      34. + URL is URL, client is null, destination is + "subresource", origin is + manifest URL's origin, referrer is + "no-referrer", synchronous flag is set, credentials mode is + "include", use-URL-credentials flag is set, and redirect mode is + "manual".
      35. Fetch request. If this is an upgrade attempt, then use the newest application cache in cache @@ -6973,11 +6982,10 @@ then: Fetch the resource normally. If this results in a redirect to a resource with another - origin (indicative of a captive portal), or a 4xx or 5xx status code, or if there - were network errors (but not if the user canceled the download), then instead get, from the - cache, the resource of the fallback entry - corresponding to the fallback namespace - f. Abort these steps. + origin (indicative of a captive portal), or a 4xx or 5xx status code, or if + there were network errors (but not if the user canceled the download), then instead get, from + the cache, the resource of the fallback entry corresponding to the + fallback namespace f. Abort these steps.
      36. diff --git a/sections/dom.include b/sections/dom.include index 7820af4d97..208343545c 100644 --- a/sections/dom.include +++ b/sections/dom.include @@ -170,7 +170,7 @@ On getting, if the document is a cookie-averse Document object, then the user agent must return the empty string. Otherwise, if the {{Document}}'s - origin is an opaque origin, the user agent must throw a + origin is an opaque origin, the user agent must throw a SecurityError exception. Otherwise, the user agent must return the cookie-string for the document's address for a "non-HTTP" API, decoded using the UTF-8 decoder. @@ -178,7 +178,7 @@ (This is a fingerprinting vector.) On setting, if the document is a cookie-averse Document object, then - the user agent must do nothing. Otherwise, if the {{Document}}'s origin is + the user agent must do nothing. Otherwise, if the {{Document}}'s origin is an opaque origin, the user agent must throw a SecurityError exception. Otherwise, the user agent must act as it would when receiving a set-cookie-string for the document's address via a "non-HTTP" API, consisting of the new value encoded as UTF-8. [[!COOKIES]] [[!ENCODING]] @@ -565,9 +565,9 @@ 2. Parse url, relative to the entry settings object. If this is not successful, throw a "SyntaxError" {{DOMException}} and abort these steps. Otherwise, let urlRecord be the resulting URL record. - 3. If urlRecord's origin is not the same as the origin of - document, throw a "SecurityError" {{DOMException}} and abort these - steps. + 3. If urlRecord's origin is not the same as the + origin of document, throw a "SecurityError" + {{DOMException}} and abort these steps. 4. Remove all child nodes of document, without firing any mutation events. 5. Set the current document readiness of document to "loading". 6. Run the remainder of these steps in parallel, and return true from the method. @@ -846,8 +846,8 @@

        Content models

        Each element defined in this specification has a content model: a description of the element's - expected contents. An HTML element must have contents that match the requirements - described in the element's content model. The contents of an element are its children + expected contents. An HTML element must have contents that match the requirements + described in the element's content model. The contents of an element are its children in the DOM, except for <{template}> elements, where the children are those in the template contents (a separate DocumentFragment assigned to the element when the element is created). @@ -1259,7 +1259,7 @@
        Palpable content
        As a general rule, elements whose content model allows any flow content or - phrasing content should have at least one node in its contents that is + phrasing content should have at least one node in its contents that is palpable content and that does not have the hidden attribute specified.

        @@ -1471,7 +1471,7 @@

        Let view be a view of the DOM that replaces all <{a}>, <{ins}>, <{del}>, and <{map}> elements in the document with their - contents. Then, in view, for each run of sibling phrasing content + contents. Then, in view, for each run of sibling phrasing content nodes uninterrupted by other types of content, in an element that accepts content other than phrasing content as well as phrasing content, let first be the first node of the run, and let last be the last node of the run. For each such run that @@ -1587,7 +1587,7 @@ * accesskey * class * contenteditable - * contextmenu + * <{global/contextmenu}> * <{global/dir}> * draggable * dropzone @@ -2515,7 +2515,7 @@ Authoring conformance criteria for bidirectional-algorithm formatting characters - Text content in html elements with Text nodes in their contents, + Text content in html elements with Text nodes in their contents, and text in attributes of html elements that allow free-form text, may contain characters in the ranges U+202A to U+202E and U+2066 to U+2069 (the bidirectional-algorithm formatting characters). However, the use of these characters is restricted so that any embedding or overrides diff --git a/sections/iana.include b/sections/iana.include index 8d983be026..7c1bf80f50 100644 --- a/sections/iana.include +++ b/sections/iana.include @@ -52,15 +52,15 @@ not be able to determine. HTML relies on a compartmentalization scheme sometimes known as the same-origin policy. - An origin in most cases consists of all the pages served from the same host, on the - same port, using the same protocol. + An origin in most cases consists of all the pages served from the same + host, on the same port, using the same protocol. It is critical, therefore, to ensure that any untrusted content that forms part of a site be - hosted on a different origin than any sensitive content on that site. Untrusted - content can easily spoof any other page on the same origin, read data from that origin, cause - scripts in that origin to execute, submit forms to and from that origin even if they are - protected from cross-site request forgery attacks by unique tokens, and make use of any - third-party resources exposed to or rights granted to that origin. + hosted on a different origin than any sensitive content on that site. + Untrusted content can easily spoof any other page on the same origin, read data from that + origin, cause scripts in that origin to execute, submit forms to and from that origin even if + they are protected from cross-site request forgery attacks by unique tokens, and make use of + any third-party resources exposed to or rights granted to that origin. : Interoperability considerations: :: Rules for processing both conforming and non-conforming content are defined in this specification. diff --git a/sections/infrastructure.include b/sections/infrastructure.include index 7e32a33e1a..7a02bc1d6c 100644 --- a/sections/infrastructure.include +++ b/sections/infrastructure.include @@ -615,7 +615,7 @@ * host * domain * URL - * Origin of URLs + * Origin of URLs * Absolute URL * Relative URL * Relative schemes @@ -3449,10 +3449,11 @@ 3. While document is an iframe srcdoc document, let document be document's browsing context's browsing context container's {{Document}} instead. - 4. If the origin of Document is not a scheme/host/port tuple, then set - referrer to the empty string and jump to the step labeled clean referrer. + 4. If the origin of Document is not a scheme/host/port tuple, then + set referrer to the empty string and jump to the step labeled + Clean referrer. 5. Let referrer be the document's address of document. - 6. Clean referrer: Apply the URL parser to referrer and let + 6. Clean referrer: Apply the URL parser to referrer and let parsed referrer be the resulting URL record. 7. Let referrer be the result of applying the URL serializer to parsed referrer, with the exclude fragment flag set. @@ -4373,292 +4374,6 @@ be implemented for those languages.

        -

        Transferable objects

        - - Some objects support being copied and closed in one operation. This is called transferring - the object, and is used in particular to transfer ownership of unsharable or expensive resources - across document and worker boundaries, including across documents of different origins. - - The following Transferable types exist: - - * {{ArrayBuffer}} [[!ECMA-262]] - * {{CanvasProxy}} (defined in this specification) - * {{MessagePort}} - - The following IDL block formalizes this: - -
        -    typedef (ArrayBuffer or CanvasProxy or MessagePort) Transferable;
        -  
        - - To transfer a Transferable object to a new owner, the user agent must run - the steps defined for the type of object in question. The steps will return a new object of the - same type, and will permanently neuter the original object. (This is an irreversible - and non-idempotent operation; once an object has been transferred, it cannot be transferred, or - indeed used, again.) - - To transfer an {{ArrayBuffer}} object old to a new owner - owner, a user agent must create a new {{ArrayBuffer}} object pointing at the - same underlying data as old, thus obtaining new, must neuter the - old object, and must finally return new. [[!ECMA-262]] - -

        - Rules for how to transfer a CanvasProxy object and how to - transfer a MessagePort object are given in the relevant sections of this - specification. -

        - -

        Safe passing of structured data

        - - When a user agent is required to obtain a structured clone of a value, optionally with - a transfer map, it must run the following algorithm, which either returns a separate value, - or throws an exception. If a transfer map is provided, it consists of an association list - of Transferable objects to placeholder objects. - - 1. Let input be the value being cloned. - 2. Let transfer map be the transfer map passed to the algorithm, if any, or the - empty list otherwise. - 3. Let memory be an association list of pairs of objects, initially empty. This is used - to handle duplicate references. In each pair of objects, one is called the source - object and the other the destination object. - 4. For each mapping in transfer map, add a mapping from the Transferable - object (the source object) to the placeholder object (the destination object) to - memory. - 5. Let output be the value resulting from calling the internal structured cloning - algorithm with input as the "input" argument, and - memory as the "memory" argument. - 6. Return output. - - The internal structured cloning algorithm is always called with two arguments, - input and memory, and its behavior is as follows: - - 1. If input is the source object of a pair of objects in memory, then return - the destination object in that pair of objects and abort these steps. - 2. If input is a primitive value, then return that value and abort these steps. - 3. Let deep clone be none. - 4. The input value is an object. Jump to the appropriate step below: -
        -
        If input is a {{Boolean}} object
        -
        - Let output be a newly constructed Boolean object with the same value as - input. -
        - -
        If input is a Number object
        -
        - Let output be a newly constructed Number object with the same value as - input. -
        - -
        If input is a String object
        -
        - Let output be a newly constructed String object with the same value as - input. -
        - -
        If input is a {{Date}} object
        -
        - Let output be a newly constructed {{Date}} object with the same - value as input. -
        - -
        If input is a {{RegExp}} object
        -
        - Let output be a newly constructed {{RegExp}} object with the same - pattern and flags as input. - -

        The value of the lastIndex property is not copied.

        -
        - -
        If input is a Blob object
        -
        - If input has been disabled through the close() method, throw a - DataCloneError exception and abort the overall structured clone - algorithm. Otherwise, let output be a newly constructed object of the same - class as input, corresponding to the same underlying data. -
        - -
        If input is a FileList object
        -
        - Let output be a newly constructed FileList object containing a - list of newly constructed File objects corresponding to the same underlying - data as those in input, maintaining their relative order. -
        - -
        If input is an ImageData object
        -
        - Let output be a newly constructed ImageData object whose - width and height have values equal to the corresponding - attributes on input, and whose data attribute has the value - obtained from invoking the internal structured cloning algorithm recursively with - the value of the data attribute on input as the new - "input" argument and memory as the new "memory" argument. -
        - -
        If input is an ImageBitmap object
        -
        - Let output be a newly constructed ImageBitmap object whose bitmap - data is a copy of input's bitmap data. -
        - -
        If input is an {{ArrayBuffer}} object
        -
        - If input has been neutered, throw a DataCloneError - exception and abort the overall structured clone algorithm. Otherwise, let - output be a newly constructed {{ArrayBuffer}} object whose contents - are a copy of input's contents, with the same length. -
        - -
        If input is an object with a \[[DataView]] internal slot
        -
        - Let output be a newly constructed object of the same class as input, - with its \[[DataView]] internal property present, its - \[[ViewedArrayBuffer]] internal property set to the value obtained from invoking - the internal structured cloning algorithm recursively with the value of the - internal property on input as the new "input" argument and - memory as the new "memory" argument, and with the - \[[ByteLength]] and \[[ByteOffset]] internal properties set to the same - value as their counterparts on input. -
        - -
        If input is an Array object
        -
        - Let output be a newly constructed empty Array object whose - length is equal to the length of input, and set - deep clone to own. - -

        This means that the length of sparse arrays is preserved.

        -
        - -
        If input is an Object object
        -
        - Let output be a newly constructed empty Object object, and set - deep clone to own. -
        - -
        If input is a Map object
        -
        - Let output be a newly constructed empty Map object, and set - deep clone to map. -
        - -
        If input is a Set object
        -
        - Let output be a newly constructed empty Set object, and set - deep clone to set. -
        - -
        If input is an object that another specification defines how to clone
        -
        - Let output be a clone of the object as defined by the other specification. -
        - -
        - If input is another native object type (e.g., Error, - Function) -
        -
        Ifinput is a host object (e.g., a DOM node)
        -
        - Throw a DataCloneError exception and abort the overall - structured clone algorithm. -
        -
        - - For the purposes of the algorithm above, an object is a particular type of object - class if its \[[Class]] internal property is equal to class. - -

        - For example, "input is an Object object" if input's - \[[Class]] internal property is equal to the string "Object". -

        - 5. Add a mapping from input (the source object) to output (the destination - object) to memory. - 6. If deep clone is set to map, then run these substeps. These substeps use the - terminology and typographic conventions used in the JavaScript specification's definition of - Maps. [[!ECMA-262]] - - 1. Let original be the List that is the value of input's - \[[MapData]] internal slot. [[!ECMA-262]] - 2. Let source be a new empty List. - 3. For each Record {\[[key]], \[[value]]} entry that is an - element of original, run the following substeps: - 1. Let new entry be the Record {\[[key]]: entry. - \[[key]], \[[value]]: entry.\[[value]]}. - 2. If new entry.\[[key]] is not empty, append new entry as - the last element of source. - 4. Let target be the List that is the value of output's - \[[MapData]] internal slot. - 5. For each Record {\[[key]], \[[value]]} entry that is an - element of source, run the following substeps: - 1. Let key have the value obtained from invoking the - internal structured cloning algorithm recursively with entry. - \[[key]] as the new "input" argument and memory as the - new "memory" argument. - 2. Let value have the value obtained from invoking the - internal structured cloning algorithm recursively with entry. - \[[value]] as the new "input" argument and memory as - the new "memory" argument. - 3. Let new entry be the Record {\[[key]]: key, - \[[value]]: value}. - 4. Append new entry as the last element of target. - - 6. Set deep clone to own. - 7. If deep clone is set to set, then run these substeps. These substeps use the - terminology and typographic conventions used in the JavaScript specification's definition of - Sets. [[!ECMA-262]] - 1. Let source be a copy of the List that is the value of input's - \[[SetData]] internal slot. [[!ECMA-262]] - 2. Let target be the List that is the value of output's - \[[SetData]] internal slot. - 3. For each entry that is an element of source that is not empty, - run the following substeps: - 1. Let new entry have the value obtained from invoking the - internal structured cloning algorithm recursively with entry as - the new "input" argument and memory as the new - "memory" argument. - 2. Append new entry as the last element of target. - 4. Set deep clone to own. - 8. If deep clone is set to own, then, for each enumerable own property in - input, run the following steps: - 1. Let name be the name of the property. - 2. Let source value be the result of calling the \[[Get]] internal method - of input with the argument name. If the \[[Get]] internal - method of a property involved executing script, and that script threw an uncaught - exception, then abort the overall structured clone algorithm, with that exception - being passed through to the caller. - 3. Let cloned value be the result of invoking the - internal structured cloning algorithm recursively with source value as - the "input" argument and memory as the "memory" argument. - If this results in an exception, then abort the overall structured clone algorithm, - with that exception being passed through to the caller. - 4. Add a new property to output having the name name, and having the - value cloned value, using CreateDataProperty(output, - name, cloned value). - - The order of the properties in the input and output objects must be the - same, and any properties whose \[[Get]] internal method involves running script must be - processed in that same order. - -

        This does not walk the prototype chain.

        - -

        - Property descriptors, setters, getters, and analogous features are not copied in this - process. For example, the property in the input could be marked as read-only, but in the - output it would just have the default state (typically read-write, though that could depend - on the scripting environment). -

        - -

        - Properties of Array objects are not treated any differently than those of other Objects. In - particular, this means that non-index properties of arrays are copied as well. -

        - - 9. Return output. - -

        - This algorithm preserves cycles and preserves the identity of duplicate objects in graphs. -

        -

        Garbage collection

        There is an implied strong reference from any IDL attribute that returns a pre-existing @@ -4699,4 +4414,263 @@ effect as in XML. For instance, the colon has no special meaning in HTML element names.

        +

        Safe passing of structured data

        + + This section uses the terminology and typographic conventions from the JavaScript specification. + [[ECMA-262]] + +

        Cloneable objects

        + + Cloneable objects support being cloned across event loops. That is, they support + being cloned across {{Document}} and {{Worker}} boundaries, including across {{Document}}s of + different origins. Not all objects are cloneable objects and not all + aspects of objects that are cloneable objects are necessarily preserved when cloned. + + Platform objects have the following internal method: + + \[[Clone]] ( targetRealm, memory ) + + Unless specified otherwise, invoking the \[[Clone]] internal method must + throw a "{{DataCloneError}}" {{DOMException}}. (By default, platform objects are not + cloneable objects.) + + Platform objects that are cloneable objects have a \[[Clone]] + internal method which is specified to run a series of steps. The result of running those steps + must be a thrown exception or a clone of this, created in targetRealm. It is + up such objects to define what cloning means for them. + + Objects defined in the JavaScript specification are handled by the StructuredClone abstract + operation directly. + +

        Transferable objects

        + + Transferable objects support being transferred across event loops. Transferring is + effectively recreating the object while sharing a reference to the underlying data and then + detaching the object being transferred. This is useful to transfer ownership of expensive + resources. Not all objects are transferable objects and not all aspects of objects that are + transferable objects are necessarily preserved when transferred. + +

        Transferring is an irreversible and non-idempotent operation. Once an object has + been transferred, it cannot be transferred, or indeed used, again.

        + + Platform objects that are transferable objects have a \[[Detached]] + internal slot and the following internal method: + + \[[Transfer]] ( targetRealm ) + +

        Whereas all platform objects have a \[[Clone]] + internal method, not all have a \[[Detached]] internal slot and a \[[Transfer]] + internal method.

        + + Platform objects that are transferable objects must define the \[[Transfer]] + internal method such that it either throws an exception or returns a clone of this, + created in targetRealm, with this's underlying data shared with the return + value, and this's \[[Detached]] internal slot value set to true. It is up to such + objects to define what transfering means for them. + + Objects defined in the JavaScript specification are handled by the + StructuredCloneWithTransfer abstract operation directly. (Technically, by + IsTransferable and TransferHelper.) + +

        StructuredCloneWithTransfer ( input, transferList, targetRealm )

        + + 1. Let memory be an empty map. +

        The purpose of the memory map, both here and in the StructuredClone + abstract operation, is to avoid cloning objects twice. This ends up preserving cycles and the + identity of duplicate objects in graphs.

        + 2. For each object transferable in transferList: + 1. If IsTransferable(transferable) is false, then throw a + "{{DataCloneError}}" {{DOMException}}. + 2. Let placeholder be a user-agent-defined placeholder object. + 3. Create an entry in memory with key transferable and value + placeholder. + 3. Let clone be the result of ? StructuredClone(input, + targetRealm, memory). + 4. Let outputTransferList be a new empty List. + 5. For each object transferable in transferList: + 1. Let placeholderResult be the value of the entry in memory whose key + is transferable. + 2. Let transferResult be ? TransferHelper(transferable, + targetRealm). + 3. Within clone, replace references to placeholderResult with + transferResult, such that everything holding a reference to + placeholderResult, now holds a reference to transferResult. + +

        This is a rather unusual low-level operation for which no primitives are defined by JavaScript.

        + 4. Add transferResult as the last element of outputTransferList. + 6. Return { \[[Clone]]: clone, \[[transferList]]: + outputTransferList }. + +

        Originally the StructuredCloneWithTransfer abstract operation was known as + the "structured clone" algorithm. The StructuredClone abstract operation was known as the + "internal structured clone" algorithm. Transferring objects, now handled by the + StructuredCloneWithTransfer abstract operation, were formerly handled by parts of the + algorithm of the postMessage() method on the {{Window}} object and the + Window/postMessage() method on the {{MessagePort}} object.

        + +

        StructuredClone ( input, targetRealm [ , memory ] )

        + + 1. If memory was not supplied, let memory be an empty map. + 2. If memory contains an entry with key input, then return that entry's + value. + 3. If Type(input) is Undefined, Null, Boolean, String, or Number, then return + input. + 4. If Type(input) is Symbol, then throw a "{{DataCloneError}}" {{DOMException}}. + 5. Let deepClone be false. + 6. If input has a \[[BooleanData]] internal slot, then let output be a new + Boolean object in targetRealm whose \[[BooleanData]] internal slot value is the + \[[BooleanData]] internal slot value of input. + 7. Otherwise, if input has a \[[NumberData]] internal slot, then let output + be a new Number object in targetRealm whose [NumberData]] internal slot value is + the \[[NumberData]] internal slot value of input. + 8. Otherwise, if input has a \[[StringData]] internal slot, then let output + be a new String object in targetRealm whose \[[StringData]] internal slot value is + the \[[StringData]] internal slot value of input. + 9. Otherwise, if input has a \[[DateValue]] internal slot, then let output + be a new Date object in targetRealm whose \[[DateValue]] internal slot value is the + \[[DateValue]] internal slot value of input. + 10. Otherwise, if input has a \[[RegExpMatcher]] internal slot, then let + output be a new RegExp object in targetRealm whose \[[RegExpMatcher]] + internal slot value is the \[[RegExpMatcher]] internal slot value of input, whose + \[[OriginalSource]] internal slot value is the \[[OriginalSource]] internal slot value of + input, and whose whose \[[OriginalFlags]] internal slot value is the + \[[OriginalFlags]] internal slot value of input. + 11. Otherwise, if input has an \[[ArrayBufferData]] internal slot, then: + 1. If IsDetachedBuffer(input) is true, then throw a "{{DataCloneError}}" + {{DOMException}}. + 2. Let outputArrayBuffer be the %ArrayBuffer% intrinsic object in + targetRealm. + 3. Let output be ? CloneArrayBuffer(input, 0, + outputArrayBuffer). + 12. Otherwise, if input has a \[[ViewedArrayBuffer]] internal slot, then: + 1. Let buffer be the value of input's \[[ViewedArrayBuffer]] internal + slot. + 2. Let bufferClone be ? StructuredClone(buffer, + targetRealm, memory)}}. + 3. If input has a \[[DataView]] internal slot, then let output be a + new DataView object in targetRealm whose \[[DataView]] internal slot value is + true, whose \[[ViewedArrayBuffer]] internal slot value is bufferClone, whose + \[[ByteLength]] internal slot value is the \[[ByteLength]] internal slot value of + input, and whose \[[ByteOffset]] internal slot value is the \[[ByteOffset]] + internal slot value of input. + 4. Otherwise: + 1. Assert: input has a \[[TypedArrayName]] internal slot. + 2. Let constructor be the intrinsic object listed in column one of + The TypedArray Constructors table for the value of + input's \[[TypedArrayName]] internal slot in targetRealm. + 3. Let byteOffset be input's \[[ByteOffset]] internal slot value. + 4. Let length be input's \[[ArrayLength]] internal slot value. + 5. Let output be ? TypedArrayCreate(constructor, + « bufferClone, byteOffset, length »). + 13. Otherwise, if input has \[[MapData]] internal slot, then: + 1. Let output be a new Map object in targetRealm whose \[[MapData]] + internal slot value is a new empty List. + 2. Set deepClone to true. + 14. Otherwise, if input has \[[SetData]] internal slot, then: + 1. Let output be a new Set object in targetRealm whose \[[SetData]] + internal slot value is a new empty List. + 2. Set deepClone to true. + 15. Otherwise, if input is an Array exotic object, then: + 1. Let inputLen be OrdinaryGetOwnProperty(input, + "length").\[[Value]]. + 2. Let outputProto be the %ArrayPrototype% intrinsic object in + targetRealm. + 3. Let output be ! ArrayCreate(inputLen, + outputProto). + 4. Set deepClone to true. + 16. Otherwise, if input has a \[[Clone]] internal method, then + let output be ? + input.\[[Clone]](targetRealm, + memory). + 17. Otherwise, if IsCallable(input)}} is true, then throw a + "{{DataCloneError}}" {{DOMException}}. + 18. Otherwise, if input has any internal slot other than \[[Prototype]] or + \[[Extensible]], then throw a "{{DataCloneError}}" {{DOMException}}. +

        For instance, a \[[PromiseState]] or \[[WeakMapData]] internal slot.

        + 19. Otherwise, if input is an exotic object, then throw a "{{DataCloneError}}" + {{DOMException}}. +

        For instance, a proxy object.

        + 20. Otherwise: + 1. Let output be a new Object in targetRealm. + 2. Set deepClone to true. + 21. Create an entry in memory whose key is input and value is + output. + 22. If deepClone is true, then: + 1. If input has a \[[MapData]] internal slot, then: + 1. Let inputList the value of input's \[[MapData]] internal slot. + 2. Let copiedList be a new empty List. + 3. Repeat for each Record { \[[Key]], \[[Value]] } entry that is an + element of inputList, + 1. Let copiedEntry be a new Record { \[[Key]]: + entry.\[[Key]], \[[Value]]: entry.\[[Value]] }. + 2. If copiedEntry.\[[Key]] is not empty, append copiedEntry as + the last element of copiedList. + 4. Let outputList be the value of output's \[[MapData]] internal + slot. + 5. For each Record { \[[Key]], \[[Value]] } entry that is an element of + copiedList, + 1. Let outputKey be ? StructuredClone(entry.\[[Key]], + targetRealm, memory). + 2. Let outputValue be ? + StructuredClone(entry.\[[Value]], targetRealm, + memory). + 3. Add { \[[Key]]: outputKey, \[[Value]]: outputValue } as the + last element of outputList. + 2. Otherwise, if input has a \[[SetData]] internal slot, then: + 1. Let copiedList be a copy of the value of input's \[[SetData]] + internal slot. + 2. Let outputList be the value of output's \[[SetData]] internal + slot. + 3. For each entry that is an element of copiedList that is not + empty, + 1. Let outputEntry be ? StructuredClone(entry, + targetRealm, memory). + 2. Add outputEntry as the last element of outputList. + 3. Otherwise: + 1. Let enumerableKeys be a new empty List. + 2. For each key in ! input.\[[OwnPropertyKeys]](): + 1. If Type(key) is String, then: + 1. Let inputDesc be ! + input.\[[GetOwnProperty]](key). + 2. If inputDesc.\[[Enumerable]] is true, then add key as + the last element of enumerableKeys. + 3. For each key in enumerableKeys: + 1. If ! HasOwnProperty(input, key) is true, then: + 1. Let inputValue be ? input.\[[Get]](key, + input). + 2. Let outputValue be ? StructuredClone(inputValue, + targetRealm, memory). + 3. Perform ? CreateDataProperty(output, key, + outputValue). + 23. Return output. + +

        + In general implementations will need to use some kind of serialization and marshalling to + implement the creation of objects in targetRealm, as targetRealm could be + in a different event loop and not easily accessible to the code that invokes + StructuredCloneWithTransfer or StructuredClone. +

        + +

        IsTransferable ( O )

        + + 1. Assert: Type(O) is Object. + 2. If O has an \[[ArrayBufferData]] internal slot, then: + 1. If IsDetachedBuffer(O) is true, then return false. + 2. Return true. + 3. Otherwise, if O has a \[[Detached]] internal slot, then: + 1. If O's \[[Detached]] internal slot value is true, then return false. + 2. Return true. + 4. Return false. + +

        TransferHelper ( input, targetRealm )

        + + 1. If input has an \[[ArrayBufferData]] internal slot, then: + 1. Let output be a new {{ArrayBuffer}} object in targetRealm whose + \[[ArrayBufferByteLength]] internal slot value is the \[[ArrayBufferByteLength]] internal + slot value of input, and whose \[[ArrayBufferData]] internal slot value is the + \[[ArrayBufferData]] internal slot value of input. + 2. Perform ! DetachArrayBuffer(input). + 3. Return output. + 2. Return ? input.\[[Transfer]](targetRealm). + diff --git a/sections/obsolete.include b/sections/obsolete.include index 159f796932..cca604a38a 100644 --- a/sections/obsolete.include +++ b/sections/obsolete.include @@ -842,8 +842,9 @@ The contentDocument IDL attribute must return the {{Document}} object of the active document of the <{frame}> element's - nested browsing context, if any and if its origin is the same origin-domain - as the origin specified by the incumbent settings object, or null otherwise. + nested browsing context, if any and if its origin is the + same origin-domain as the origin specified by the + incumbent settings object, or null otherwise. The contentWindow IDL attribute must return the WindowProxy object of the <{frame}> element's nested browsing context. diff --git a/sections/rendering.include b/sections/rendering.include index c3b4187978..a1b1c5b526 100644 --- a/sections/rendering.include +++ b/sections/rendering.include @@ -193,7 +193,7 @@ or <{iframe}> element. Otherwise, there is no container frame element.

        The above requirements imply that a page can change the margins of another page - (including one from another origin) using, for example, an <{iframe}>. This + (including one from another origin) using, for example, an <{iframe}>. This is potentially a security risk, as it might in some cases allow an attack to contrive a situation in which a page is rendered not as the author intended, possibly for the purposes of phishing or otherwise misleading the user.

        diff --git a/sections/semantics-embedded-content.include b/sections/semantics-embedded-content.include index c4d20e9187..173bc6b366 100644 --- a/sections/semantics-embedded-content.include +++ b/sections/semantics-embedded-content.include @@ -828,7 +828,7 @@ was an English <a href="/wiki/Music_hall">music hall</a> singer, ... Each {{Document}} object must have a list of available images. Each image in this list is identified by a tuple consisting of an absolute URL, a CORS settings attribute mode, and, if the mode is not No CORS, an - origin. + origin. Each image furthermore has an ignore higher-layer caching flag. User agents may copy entries from one {{Document}} object's list of available images to another at any time (e.g., when the @@ -911,7 +911,7 @@ was an English <a href="/wiki/Music_hall">music hall</a> singer, ...
      37. Let key be a tuple consisting of the resulting absolute URL, the <{img}> element's crossorigin attribute's mode, and, if that mode is not No CORS, - the node document's origin.
      38. + the node document's origin.
      39. @@ -1066,7 +1066,7 @@ was an English <a href="/wiki/Music_hall">music hall</a> singer, ... The resource obtained in this fashion, if any, is image request's image data. It can be either CORS-same-origin or CORS-cross-origin; this affects - the origin of the image itself (e.g., when used on a canvas). + the origin of the image itself (e.g., when used on a canvas). Fetching the image must delay the load event of the element's node document until the task that is queued by the @@ -1895,9 +1895,11 @@ was an English <a href="/wiki/Music_hall">music hall</a> singer, ... resulting URL string. If that is not successful, abort these steps.
      40. -
      41. ⌛ Let corsAttributeState be the state of the element's crossorigin content attribute.
      42. +
      43. ⌛ Let corsAttributeState be the state of the element's + crossorigin content attribute.
      44. -
      45. ⌛ Let origin be the origin of the <{img}> element's node document.
      46. +
      47. ⌛ Let origin be the origin of the <{img}> element's + node document.
      48. ⌛ Let client be the <{img}> element's node document's Window object's environment settings object.
      49. @@ -1941,7 +1943,8 @@ was an English <a href="/wiki/Music_hall">music hall</a> singer, ...
      50. Otherwise, response's unsafe response is image request's image data. It can be either CORS-same-origin or CORS-cross-origin; this affects the - origin of the image itself (e.g., when used on a canvas).
      51. + origin of the image itself (e.g., when used on a + canvas).
    12. @@ -3736,7 +3739,8 @@ My <img src="heart.png" alt="heart"> breaks. must be an unordered set of unique space-separated tokens that are ASCII case-insensitive. The allowed values are allow-forms, allow-pointer-lock, allow-popups, allow-same-origin, allow-scripts, and allow-top-navigation. - When the attribute is set, the content is treated as being from a unique origin, + When the attribute is set, the content is treated as being from a unique + origin, forms, scripts, and various potentially annoying APIs are disabled, links are prevented from targeting other browsing contexts, and plugins are secured. The allow-same-origin keyword causes @@ -3990,8 +3994,8 @@ My <img src="heart.png" alt="heart"> breaks. - If the attribute is not specified, or if the origin conditions listed above are - not met, then the user agent should render the nested browsing context in a manner + If the attribute is not specified, or if the origin conditions listed above + are not met, then the user agent should render the nested browsing context in a manner that is clearly distinguishable as a separate browsing context, and the seamless browsing context flag must be set to false for that browsing context. @@ -4056,7 +4060,8 @@ My <img src="heart.png" alt="heart"> breaks. When used in HTML documents, the allowed content model of <{iframe}> elements is text, except that invoking the HTML fragment parsing - algorithm with the <{iframe}> element as the context element and the text contents as the input must result in a list of nodes that are all phrasing content, + algorithm with the <{iframe}> element as the context element and the text contents as + the input must result in a list of nodes that are all phrasing content, with no parse errors having occurred, with no script elements being anywhere in the list or as descendants of elements in the list, and with all the elements in the list (including their descendants) being themselves conforming. @@ -4084,8 +4089,9 @@ My <img src="heart.png" alt="heart"> breaks. The contentDocument IDL attribute must return the {{Document}} object of the active document of the <{iframe}> element's - nested browsing context, if any and if its origin is the same origin-domain - as the origin specified by the incumbent settings object, or null otherwise. + nested browsing context, if any and if its origin is the + same origin-domain as the origin specified by the + incumbent settings object, or null otherwise. The contentWindow IDL attribute must return the WindowProxy object of the <{iframe}> element's nested browsing context, if any, or null otherwise. @@ -4528,7 +4534,7 @@ attribute's value is a type that a plugin supports, then the value of the address of the resource. If present, the attribute must be a valid non-empty URL potentially surrounded by spaces. -

      Authors who reference resources from other origins +

      Authors who reference resources from other origins that they do not trust are urged to use the typemustmatch attribute defined below. Without that attribute, it is possible in certain cases for an attacker on the remote host to use the plugin mechanism to run arbitrary scripts, even if the author has used features such as the Flash @@ -5041,8 +5047,8 @@ attribute's value is a type that a plugin supports, then the value of the The {{HTMLObjectElement/contentDocument}} IDL attribute must return the {{Document}} object of the active document of the <{object}> element's nested browsing context, if any and if - its origin is the same origin-domain as the origin specified by the - incumbent settings object, or null otherwise. + its origin is the same origin-domain as the + origin specified by the incumbent settings object, or null otherwise. The {{HTMLObjectElement/contentWindow}} IDL attribute must return the WindowProxy object of the <{object}> element's nested browsing context, if it has one; otherwise, it must return null. diff --git a/sections/semantics-forms.include b/sections/semantics-forms.include index 85abef2b10..daa02defb0 100644 --- a/sections/semantics-forms.include +++ b/sections/semantics-forms.include @@ -11112,11 +11112,14 @@ out of 233 257 824 bytes available</meter></p>

    13. If target's active sandboxing flag set has the sandboxed automatic features browsing context flag, abort these steps.
    14. -
    15. If target's origin is not the same as the origin of the node document of the currently +
    16. If target's origin is not the same as the + origin of the node document of the currently focused element in target's top-level browsing context, abort these steps.
    17. -
    18. If target's origin is not the same as the origin of the active document of target's top-level browsing context, abort these steps.
    19. +
    20. If target's origin is not the same as the + origin of the active document of target's + top-level browsing context, abort these steps.
    21. If the user agent has already reached the last step of this list of steps in response to an element being inserted into a @@ -12834,7 +12837,7 @@ out of 233 257 824 bytes available</meter></p> attribute is in the off state
    22. the user has disabled this feature for this form's - node document's origin
    23. + node document's origin
    24. the user agent does not support this form's fields (e.g., the form has different fields whose autofill scope use different "section-*" tokens)
    25. diff --git a/sections/semantics-interactive-elements.include b/sections/semantics-interactive-elements.include index 394fc9ebcc..df87bf6b90 100644 --- a/sections/semantics-interactive-elements.include +++ b/sections/semantics-interactive-elements.include @@ -249,7 +249,7 @@ If a <{menu}> element's type attribute is in the popup menu state, then the element represents the commands of a popup menu, and the user can only examine and interact with the commands if that - popup menu is activated through some other element, either via the contextmenu attribute or the <{button}> element's menu attribute. + popup menu is activated through some other element, either via the <{global/contextmenu}> attribute or the <{button}> element's menu attribute. If a <{menu}> element's type attribute is in the toolbar state, then the element represents a @@ -630,13 +630,13 @@
      Declaring a context menu
      - The contextmenu attribute gives the element's + The contextmenu attribute gives the element's context menu. The value must be the ID of a <{menu}> element in the same home subtree whose type attribute is in the popup menu state.

      - When a user right-clicks on an element with a contextmenu attribute, the user agent will first fire a contextmenu event at the element, and then, if that event is not + When a user right-clicks on an element with a <{global/contextmenu}> attribute, the user agent will first fire a contextmenu event at the element, and then, if that event is not canceled, a show event at the <{menu}> element.

      @@ -663,8 +663,8 @@
      Processing model
      - Each element has an assigned context menu, which can be null. If an element A has a contextmenu attribute, and there is - an element with the ID given by A's contextmenu attribute's value in A's + Each element has an assigned context menu, which can be null. If an element A has a <{global/contextmenu}> attribute, and there is + an element with the ID given by A's <{global/contextmenu}> attribute's value in A's home subtree, and the first such element in tree order is a <{menu}> element whose type attribute is in the popup menu state, then A's assigned context menu is that element. Otherwise, if A has a parent element, @@ -734,7 +734,7 @@
      The contextMenu IDL attribute must - reflect the contextmenu content attribute. + reflect the <{global/contextmenu}> content attribute. diff --git a/sections/semantics-links.include b/sections/semantics-links.include index fec86c8807..8a2a7b49da 100644 --- a/sections/semantics-links.include +++ b/sections/semantics-links.include @@ -222,8 +222,8 @@ attribute set, changed, or removed, the user agent must set the url.

      This is only observable for blob: URLs as - parsing them involves the structured clone - algorithm.

      + parsing them involves the StructuredClone + abstract algorithm.

      An element implementing the HTMLHyperlinkElementUtils mixin has an associated reinitialise url algorithm, which runs these steps:

      @@ -266,7 +266,7 @@ empty string.
    26. Return the Unicode serialization - of this element's URL's origin.
    27. + of this element's URL's origin.

      It returns the Unicode rather than the ASCII serialisation for @@ -728,11 +728,11 @@ header includes file name information, then let filename have the value specified by the header, and jump to the step labeled sanitize below. [[!RFC6266]] -

    28. Let interface origin be the origin of the +
    29. Let interface origin be the origin of the {{Document}} in which the download or navigate action resulting in the download was initiated, if any.
    30. -
    31. Let resource origin be the origin of the URL of the +
    32. Let resource origin be the origin of the URL of the resource being downloaded, unless that URL's scheme component is data, in which case let resource origin be the same as the interface origin, if any.
    33. diff --git a/sections/semantics-scriptings.include b/sections/semantics-scriptings.include index 51e565d34a..7c34719187 100644 --- a/sections/semantics-scriptings.include +++ b/sections/semantics-scriptings.include @@ -172,8 +172,8 @@ The crossorigin attribute is a CORS settings attribute. For classic scripts, it controls whether error information - will be exposed, when the script is obtained from other origins. For module scripts, - it controls the credentials mode used for cross-origin requests. + will be exposed, when the script is obtained from other origins. For + module scripts, it controls the credentials mode used for cross-origin requests.

      Unlike classic scripts, module scripts require the use of the CORS protocol for cross-origin fetching.

      @@ -1115,7 +1115,7 @@ o............A....e : In a <{head}> element, if scripting is enabled for the <{noscript}> element :: The <{noscript}> element must contain only text, except that invoking the - HTML fragment parsing algorithm with the <{noscript}> element as the context + HTML fragment parsing algorithm with the <{noscript}> element as the context element and the text contents as the input must result in a list of nodes that consists only of <{link}>, <{style}>, and <{meta}> elements that would be conforming if they were children of the <{noscript}> element, and no @@ -1399,8 +1399,8 @@ o............A....e - The content IDL attribute must return the - <{template}> element's template contents. + The content IDL attribute must return + the <{template}> element's template contents.
      @@ -1410,15 +1410,14 @@ o............A....e
        -
      1. If the clone children flag is not set in the calling clone algorithm, abort these steps.
      2. +
      3. If the clone children flag is not set in the calling clone algorithm, abort these steps.
      4. -
      5. Let copied contents be the result of cloning all the children of node's +
      6. Let copied contents be the result of cloning all the children of node's template contents, with document set to copy's template contents's node document, and with the clone children flag set.
      7. -
      8. Append copied contents to copy's template - contents.
      9. +
      10. Append copied contents to copy's template contents.
      @@ -1964,8 +1963,8 @@ o............A....e
      Returns a CanvasProxy object that can be used to transfer control for this - canvas over to another document (e.g., an iframe from another origin) - or to a worker. + canvas over to another document (e.g., an iframe from another + origin) or to a worker. Throws an InvalidStateError exception if the getContext() or setContext() methods have been used. @@ -1979,7 +1978,7 @@ o............A....e the given object. Throws an InvalidStateError exception if the CanvasProxy has been - transferred. + transferred.
      @@ -2002,8 +2001,8 @@ o............A....e - A CanvasProxy object can be neutered (like any Transferable object), - meaning it can no longer be transferred, and + A CanvasProxy object can be neutered (like any Transferable object), + meaning it can no longer be transferred, and can be disabled, meaning it can no longer be bound to rendering contexts. When first created, a CanvasProxy object must be neither. @@ -2019,7 +2018,7 @@ o............A....e
    34. If the CanvasProxy object has been disabled, throw an InvalidStateError exception and abort these steps.
    35. -
    36. If the CanvasProxy object has not been neutered, then neuter it.
    37. +
    38. If the CanvasProxy object has not been neutered, then neuter it.
    39. If context's context bitmap mode is fixed, then throw an @@ -2040,7 +2039,7 @@ o............A....e To transfer a CanvasProxy object old to a new owner owner, a user agent must create a new CanvasProxy object linked to the same <{canvas}> element as old, thus obtaining new, - must neuter and disable the old object, and must + must neuter and disable the old object, and must finally return new.
      @@ -2184,7 +2183,7 @@ onmessage = function (event) { This section is non-normative. - Information leakage can occur if scripts from one origin can + Information leakage can occur if scripts from one origin can access information (e.g., read pixels) from images from another origin (one that isn't the same). To mitigate this, bitmaps used with <{canvas}> elements and ImageBitmap diff --git a/sections/syntax.include b/sections/syntax.include index f51974b4f3..d95b27e07f 100644 --- a/sections/syntax.include +++ b/sections/syntax.include @@ -220,7 +220,7 @@ either have a start tag and an end tag, or a start tag that is marked as self-closing, in which case they must not have an end tag. - The contents of the element must be placed between + The contents of the element must be placed between just after the start tag (which might be implied, in certain cases) and just before the end tag (which again, might be implied, in certain cases). The exact allowed contents of each individual element depend on @@ -241,8 +241,9 @@ (since, again, as there's no end tag, no content can be put between the start tag and the end tag). Foreign elements whose start tag is not marked as self-closing can have text, character - references, CDATA sections, other elements, and comments, but - the text must not contain the character U+003C LESS-THAN SIGN (<) or an ambiguous ampersand. + references, CDATA sections, other elements, and + comments, but the text must not contain the character U+003C LESS-THAN SIGN (<) or an + ambiguous ampersand.
      @@ -270,8 +271,10 @@
      - Normal elements can have text, character references, other elements, and comments, but - the text must not contain the character U+003C LESS-THAN SIGN (<) or an ambiguous ampersand. Some normal elements + Normal elements can have text, character references, other + elements, and comments, but + the text must not contain the character U+003C LESS-THAN SIGN (<) or an + ambiguous ampersand. Some normal elements also have yet more restrictions on what content they are allowed to hold, beyond the restrictions imposed by the content model and those described in this paragraph. Those restrictions are described below. @@ -1042,11 +1045,11 @@
      This specification defines the parsing rules for HTML documents, whether they are syntactically - correct or not. Certain points in the parsing algorithm are said to be - parse errors. The error handling for + correct or not. Certain points in the parsing algorithm are said to be + parse errors. The error handling for parse errors is well-defined (that's the processing rules described throughout this specification), but user agents, while parsing an HTML - document, may abort the parser at the first parse error that they + document, may abort the parser at the first parse error that they encounter for which they do not wish to apply the rules described in this specification. @@ -1294,8 +1297,8 @@ nested (the active document of the parent browsing context of new document).
    40. -
    41. If parent document's origin is not the same - origin as new document's origin, then abort these +
    42. If parent document's origin is not the same + origin as new document's origin, then abort these substeps.
    43. If parent document's character encoding is not an ASCII-compatible encoding, then @@ -2025,7 +2028,8 @@
    44. Loop: If node is the first node in the stack of open elements, then set last to true, and, if the parser was originally created as part of - the HTML fragment parsing algorithm (fragment case), set node to the context + the HTML fragment parsing algorithm (fragment case), set node to the + context element passed to that algorithm.
    45. @@ -2150,7 +2154,7 @@ The current node is the bottommost node in this stack of open elements. - The adjusted current node is the context + The adjusted current node is the context element if the parser was created by the HTML fragment parsing algorithm and the stack of open elements has only one element in it (fragment case); otherwise, the adjusted current node is the current node. @@ -4606,7 +4610,7 @@

      - If the node in question is the context element passed to the HTML fragment + If the node in question is the context element passed to the HTML fragment parsing algorithm, then the start tag token for that element is the "fake" token created during by that HTML fragment parsing algorithm.

      @@ -4716,8 +4720,8 @@
    46. If the adjusted insertion location is inside a template - element, let it instead be inside the <{template}> element's template - contents, after its last child (if any). + element, let it instead be inside the <{template}> element's template contents, after its + last child (if any).
    47. @@ -7034,7 +7038,7 @@
    48. Block the tokenizer for this instance of the HTML parser, such that the event loop will not run tasks that invoke the tokenizer.
    49. -
    50. If the parser's Document has a style sheet that is blocking scripts +
    51. If the parser's Document has a style sheet that is blocking scripts or the script's "ready to be parser-executed" flag is not set: spin the event loop until the parser's Document has no style sheet that is blocking scripts and the script's @@ -9125,8 +9129,8 @@
    52. Let s be a string, and initialize it to the empty string.
    53. -
    54. If the node is a <{template}> element, then let the node instead be the <{template}> element's template - contents (a DocumentFragment node).
    55. +
    56. If the node is a <{template}> element, then let the node instead be the <{template}> element's + template contents (a DocumentFragment node).
    57. @@ -9341,10 +9345,11 @@

      Parsing HTML fragments

      - The following steps form the HTML fragment parsing algorithm. The algorithm - takes as input an {{Element}} node, referred to as the context element, which gives the context for - the parser, as well as input, a string to parse, and returns a list of zero or - more nodes. + The following steps form the + HTML fragment parsing algorithm. + The algorithm takes as input an {{Element}} node, referred to as the context element, + which gives the context for the parser, as well as input, a string to parse, and + returns a list of zero or more nodes.

      Parts marked fragment case in algorithms in the parser section are diff --git a/sections/webappapis.include b/sections/webappapis.include index 12328c2b9b..67da991a97 100644 --- a/sections/webappapis.include +++ b/sections/webappapis.include @@ -133,7 +133,7 @@ :: An absolute URL used by APIs called by scripts that use this environment settings object to resolve relative URLs. - : An origin + : An origin :: An instrument used in security checks. : A creation URL @@ -3162,7 +3162,7 @@ a credentials mode, a cryptographic nonce, and a parser state:

    58. - Let incumbent origin be the origin + Let incumbent origin be the origin specified by the incumbent settings object at the time the showModalDialog() method was called.
    59. @@ -3177,7 +3177,7 @@ a credentials mode, a cryptographic nonce, and a parser state:
    60. are part of the same unit of related browsing contexts as the browsing context of the Window object on which the showModalDialog() method was called, and that
    61. -
    62. have an active document whose origin is the same as incumbent origin,
    63. +
    64. have an active document whose origin is the same as incumbent origin,
    65. @@ -3332,7 +3332,7 @@ a credentials mode, a cryptographic nonce, and a parser state: The dialogArguments IDL attribute, on getting, must check whether its browsing context's active document's - origin is the same origin-domain as the dialog arguments' origin. If it is, + origin is the same origin-domain as the dialog arguments' origin. If it is, then the browsing context's dialog arguments must be returned unchanged. Otherwise, the IDL attribute must return undefined. @@ -3341,13 +3341,12 @@ a credentials mode, a cryptographic nonce, and a parser state: browsing context is created. The returnValue IDL attribute, on - getting, must check whether its browsing context's active document's effective - script origin is the same as the current return - value origin. If it is, then the browsing context's return value must be - returned unchanged. Otherwise, the IDL attribute must return undefined. On setting, the - attribute must set the return value to the given new value, and the return - value origin to the browsing context's active document's effective - script origin. + getting, must check whether its browsing context's active document's + origin is the same origin-domain as the current return value origin. If it + is, then the browsing context's return value must be returned unchanged. Otherwise, + the IDL attribute must return undefined. On setting, the attribute must set the + return value to the given new value, and the return value origin to the + browsing context's active document's origin.

      The window.close() method can be used to @@ -3759,8 +3758,8 @@ a credentials mode, a cryptographic nonce, and a parser state:

      User agents must throw a SecurityError exception if the resulting - absolute URL has an origin that differs from the origin specified by the - entry settings object. + absolute URL has an origin that differs from the + origin specified by the entry settings object.

      This is forcibly the case if the %s placeholder is in the @@ -3998,9 +3997,9 @@ a credentials mode, a cryptographic nonce, and a parser state: matching handler. 2. Parse the string relative to the entry settings object. If this fails, then throw a "SyntaxError" {{DOMException}}. - 3. If the resulting URL record's origin is not the same origin as the origin - specified by the entry settings object, throw a "SecurityError" - {{DOMException}}. + 3. If the resulting URL record's origin is not the same origin as the + origin specified by the entry settings object, throw a + "SecurityError" {{DOMException}}. 4. Return the resulting URL string as the result of preprocessing the argument.

      Security and privacy
      @@ -4622,10 +4621,10 @@ a credentials mode, a cryptographic nonce, and a parser state: stub method that never returns a non-zero value, or may arbitrarily ignore invocations with particular arguments for security, privacy, or usability reasons. -
    66. If the origin specified by the entry settings object is an +
    67. If the origin specified by the entry settings object is an opaque identifier (i.e., it has no host component), then return 0 and abort these steps.
    68. -
    69. Let host1 be the host component of the origin specified +
    70. Let host1 be the host component of the origin specified by the entry settings object.
    71. Parse the scriptURL argument @@ -4723,10 +4722,10 @@ a credentials mode, a cryptographic nonce, and a parser state: Rejects the promise with an InvalidStateError exception if the source image is not in a valid state (e.g., an <{img}> element that hasn't finished loading, or a CanvasRenderingContext2D object whose bitmap data has zero length along one or both - dimensions, or an ImageData object whose data is data attribute has been neutered). Rejects the promise with a SecurityError + dimensions, or an ImageData object whose data is data attribute has been neutered). Rejects the promise with a SecurityError exception if the script is not allowed to access the image data of the source image (e.g., a video that is CORS-cross-origin, or a canvas being drawn - on by a script in a worker from another origin). + on by a script in a worker from another origin). @@ -4754,7 +4753,7 @@ a credentials mode, a cryptographic nonce, and a parser state: An ImageBitmap object's bitmap has an origin-clean flag, which indicates whether the - bitmap is tainted by content from a different origin. The flag is initially set to + bitmap is tainted by content from a different origin. The flag is initially set to true and may be changed to false by the steps of createImageBitmap(). An ImageBitmap object can be obtained from a variety of different objects, using @@ -4785,9 +4784,10 @@ a credentials mode, a cryptographic nonce, and a parser state: supported or is disabled), or, if there is no such image, the first frame of the animation.
    72. -
    73. If the origin of the <{img}> element's image is not the same - origin as the origin specified by the entry settings object, - then set the origin-clean flag of the ImageBitmap object's bitmap to false.
    74. +
    75. If the origin of the <{img}> element's image is not the + same origin as the origin specified by the + entry settings object, then set the origin-clean flag of the + ImageBitmap object's bitmap to false.
    76. Return a new promise, but continue running these steps in parallel.
    77. @@ -4813,9 +4813,10 @@ a credentials mode, a cryptographic nonce, and a parser state: current playback position, at the media resource's intrinsic width and intrinsic height (i.e., after any aspect-ratio correction has been applied), cropped to the source rectangle. -
    78. If the origin of the <{video}> element's image is not the same - origin as the origin specified by the entry settings object, - then set the origin-clean flag of the ImageBitmap object's bitmap to false.
    79. +
    80. If the origin of the <{video}> element's image is not the + same origin as the origin specified by the + entry settings object, then set the origin-clean flag of the + ImageBitmap object's bitmap to false.
    81. Return a new promise, but continue running these steps in parallel.
    82. @@ -4839,7 +4840,8 @@ a credentials mode, a cryptographic nonce, and a parser state: <{canvas}> element's bitmap data, cropped to the source rectangle. -
    83. Set the origin of the ImageBitmap object's bitmap to the same value as the origin-clean flag of the <{canvas}> element's bitmap.
    84. +
    85. Set the origin of the ImageBitmap object's bitmap to the + same value as the origin-clean flag of the <{canvas}> element's bitmap.
    86. Return a new promise, but continue running these steps in parallel.
    87. @@ -4891,7 +4893,7 @@ a credentials mode, a cryptographic nonce, and a parser state: but zero, return a promise rejected with an IndexSizeError exception and abort these steps.
    88. If the image object's data - attribute has been neutered, return a promise rejected with an + attribute has been neutered, return a promise rejected with an InvalidStateError exception and abort these steps.
    89. Create a new ImageBitmap object.
    90. diff --git a/single-page.bs b/single-page.bs index 6f92e82712..cb5ed8cf86 100644 --- a/single-page.bs +++ b/single-page.bs @@ -419,6 +419,8 @@ urlPrefix: http://www.w3.org/TR/dom/#; spec: DOM; text: adopt text: append text: clone + url: clone; + text: cloning text: insert text: remove text: replace @@ -429,8 +431,8 @@ urlPrefix: http://www.w3.org/TR/dom/#; spec: DOM; text: range bp text: range end text: range start - + urlPrefix: interface-; type: interface + text: Element text: represented by the collection; type: dfn From 98c3afdd325dc639555a9fe51b8a7a4aef94e314 Mon Sep 17 00:00:00 2001 From: Travis Leithead Date: Fri, 13 May 2016 16:13:36 -0700 Subject: [PATCH 14/19] Adding some missing CSP changes --- sections/browsers.include | 105 ++++++++++++++------------ sections/semantics-scriptings.include | 7 +- sections/webappapis.include | 14 ++++ 3 files changed, 72 insertions(+), 54 deletions(-) diff --git a/sections/browsers.include b/sections/browsers.include index 6d8492bbf2..75ce53b312 100644 --- a/sections/browsers.include +++ b/sections/browsers.include @@ -1379,8 +1379,9 @@ The number of child browsing contexts of a {{Window}} object W is the number of child browsing contexts that are nested through elements that are in a - {{Document}} that is the active document of the {{Window}} object's associated - {{Document}} object's browsing context. + {{Document}} that is the active document of the {{Window}} object's + associated {{Document}} object's + browsing context. The length IDL attribute's getter must return the number of child browsing contexts of this {{Window}} object. @@ -3701,9 +3702,9 @@ content and abort these steps.

      - In the case of a registered handler being used, the algorithm will be reinvoked + In the case of a registered handler being used, the algorithm will be reinvoked with a new URL to handle the request. -

      +

      @@ -4067,53 +4068,57 @@ URL instead.

      - An override URL is set when dereferencing a javascript: URL and when + An override URL is set when dereferencing a javascript: URL and when performing an overridden reload. -

      - - Initializing a new Document - object: when a {{Document}} is created as part of the above steps, the user agent - will be required to additionally run the following algorithm after creating the new object: - -
        - -
      1. Create a new Window object, and associate it with the - {{Document}}, with one exception: if the browsing context's only entry in - its session history is the about:blank {{Document}} that was - added when the browsing context was created, and navigation is occurring with - replacement enabled, and that {{Document}} has the same - origin as the new {{Document}}, then use the Window object of that - {{Document}} instead, and change the {{Document}} - attribute of the {{Window}} object to point to the new {{Document}}. - -
      2. Set the Window object's HTTPS - state to the HTTPS state of the - resource used to generate the document.
      3. - -
      4. Set the document's referrer to the address of the resource from which - Request-URIs are obtained as determined when the fetch algorithm obtained the resource, if - that algorithm was used and determined such a value; otherwise, set it to the empty - string.
      5. - -
      6. Implement the sandboxing for the {{Document}}.
      7. - -
      8. - - If the active sandboxing flag set of the {{Document}}'s - browsing context or any of its ancestor - browsing contexts (if any) have the sandboxed fullscreen browsing context - flag set, then skip this step. - - If the {{Document}}'s browsing context has a browsing context - container and either it is not an <{iframe}> element, or it does not have the - allowfullscreen attribute specified, or its - {{Document}} does not have the fullscreen enabled flag set, then also - skip this step. +

        + + Initializing a new Document object: when a {{Document}} is created as part + of the above steps, the user agent will be required to additionally run the following algorithm + after creating the new object: + + 1. If browsingContext's only entry in its session history is the + about:blank {{Document}} that was added when browsingContext was + created, and navigation is occurring with + replacement enabled, and that {{Document}} has the same origin as the new + {{Document}}, then + 1. Let window be the {{Window}} object of that {{Document}}. + 2. Change the {{Window/document}} attribute of window to point to the new + {{Document}}. + 2. Otherwise, + 1. Call the JavaScript InitializeHostDefinedRealm() abstract operation with the + following customizations: + + * For the global object, create a new {{Window}} object window. + * For the global this value, use browsingContext's {{WindowProxy}} + object. + * Let realm execution context be the created + JavaScript execution context. + * Do not obtain any source texts for scripts or modules. + 2. Set up a browsing context environment settings object with + realm execution context, and let settings object be the result. + 3. Set window's associated Document to the new {{Document}}. + 3. Set browsingContext's {{WindowProxy}} object's [[Window]] internal slot value to + window. + 4. Set the {{Document}}'s HTTPS state to the HTTPS state of the resource used to + generate the document. + 5. Execute the Initialize a Document's CSP list algorithm on the {{Document}} + object and the resource used to generate the document. [[CSP3]] + 6. Set the document's referrer to the + address of the resource from which Request-URIs are obtained as determined when the + fetch algorithm obtained the resource, if that algorithm was used and determined such a value; + otherwise, set it to the empty string. + 7. Implement the sandboxing for the {{Document}}. + 8. If the active sandboxing flag set of the {{Document}}'s browsing context or any + of its ancestor browsing contexts (if any) have the + sandboxed fullscreen browsing context flag set, then skip this step. + + If the {{Document}}'s browsing context has a browsing context container and + either it is not an <{iframe}> element, or it does not have the allowfullscreen + attribute specified, or its {{Document}} does not have the fullscreen enabled flag set, + then also skip this step. Otherwise, set the {{Document}}'s fullscreen enabled flag. - -
      - +
    91. @@ -4126,9 +4131,9 @@ then abort these steps.

      - In the case of a registered handler being used, the algorithm will be reinvoked + In the case of a registered handler being used, the algorithm will be reinvoked with a new URL to handle the request. -

      +

    92. diff --git a/sections/semantics-scriptings.include b/sections/semantics-scriptings.include index 7c34719187..ce0eccbbc0 100644 --- a/sections/semantics-scriptings.include +++ b/sections/semantics-scriptings.include @@ -1339,8 +1339,8 @@ o............A....e
    93. - If doc does not yet have an associated inert template - document then run these substeps: + If doc does not yet have an associated inert template document then run + these substeps:
        @@ -1358,8 +1358,7 @@ o............A....e -
      1. Set doc to doc's associated inert - template document.
      2. +
      3. Set doc to doc's associated inert template document.
      diff --git a/sections/webappapis.include b/sections/webappapis.include index 67da991a97..5c7f35d4f4 100644 --- a/sections/webappapis.include +++ b/sections/webappapis.include @@ -1073,6 +1073,15 @@ a credentials mode, a cryptographic nonce, and a parser state: The reason attribute must return the value it was initialized to. It represents the rejection reason for the promise. + +
      HostEnsureCanCompileStrings(callerRealm, calleeRealm)
      + + JavaScript contains an implementation-defined + HostEnsureCanCompileStrings(callerRealm, calleeRealm) abstract operation. + User agents must use the following implementation: [[ECMA-262]] + + 1. Perform ? EnsureCSPDoesNotBlockStringCompilation(callerRealm, + calleeRealm). [[CSP3]]

      Event loops

      @@ -2724,6 +2733,9 @@ a credentials mode, a cryptographic nonce, and a parser state:
    94. If previous handle was not provided, add an entry to the list of active timers for handle.
    95. +
    96. Let callerRealm be the current Realm Record, and + calleeRealm be method context's JavaScript realm.
    97. +
    98. Let task be a task that runs the @@ -2755,6 +2767,8 @@ a credentials mode, a cryptographic nonce, and a parser state:
        +
      1. Perform HostEnsureCanCompileStrings(callerRealm, + calleeRealm). If this throws an exception, report the exception.
      2. Let script source be the first method argument.
      3. From 46fefdd4a2797cdaf8a3c539813c012230f290fb Mon Sep 17 00:00:00 2001 From: Travis Leithead Date: Fri, 13 May 2016 18:21:52 -0700 Subject: [PATCH 15/19] Adding a few more CSP dependencies --- sections/attributes.include | 6 +++ sections/browsers.include | 12 ++--- sections/dom.include | 44 +++++++++++------- sections/elements.include | 4 +- sections/infrastructure.include | 8 ++-- sections/semantics-document-metadata.include | 9 +++- sections/semantics-embedded-content.include | 11 +++-- sections/syntax.include | 2 +- sections/webappapis.include | 2 +- single-page.bs | 47 +++++++++----------- 10 files changed, 86 insertions(+), 59 deletions(-) diff --git a/sections/attributes.include b/sections/attributes.include index 472546eae9..7519ae2751 100644 --- a/sections/attributes.include +++ b/sections/attributes.include @@ -558,6 +558,12 @@
    99. + + + + + + diff --git a/sections/browsers.include b/sections/browsers.include index 75ce53b312..f388ce793b 100644 --- a/sections/browsers.include +++ b/sections/browsers.include @@ -772,8 +772,8 @@ :: Return execution context. : The module map - :: Return the module map of the {{Document}} with which window is currently - associated. + :: Return the module map of the {{Document}} with which + window is currently associated. : The responsible browsing context :: Return the browsing context with which window is associated. @@ -802,8 +802,8 @@ :: Return url. : The HTTPS state - :: Return the HTTPS state of the {{Document}} with which window is currently - associated. + :: Return the HTTPS state of the {{Document}} with which + window is currently associated. 5. Set realm's \[[HostDefined]] field to settings object. 6. Return settings object. @@ -4096,7 +4096,9 @@ * Do not obtain any source texts for scripts or modules. 2. Set up a browsing context environment settings object with realm execution context, and let settings object be the result. - 3. Set window's associated Document to the new {{Document}}. + 3. Set window's + associated Document to the new + {{Document}}. 3. Set browsingContext's {{WindowProxy}} object's [[Window]] internal slot value to window. 4. Set the {{Document}}'s HTTPS state to the HTTPS state of the resource used to diff --git a/sections/dom.include b/sections/dom.include index 208343545c..3e4e76b640 100644 --- a/sections/dom.include +++ b/sections/dom.include @@ -48,23 +48,24 @@ 1. Let source be the value of the browsing context's active document's - reload override buffer. - + reload override buffer. 2. Let address be the browsing context's active document's - address. - - 3. Let HTTPS state be the HTTPS state of the browsing context's - active document's {{Window}}. - - 4. Navigate the browsing context to a new response whose <{body}> is - source and HTTPS state is HTTPS state, with - replacement enabled and exceptions enabled. The source browsing context - is that given to the overridden reload algorithm. When the navigate algorithm - creates a {{Document}} object for this purpose, set that {{Document}}'s - reload override flag and set its reload override buffer to source. - - When it comes time to set the document's address in the navigation algorithm, - use address as the override URL. + URL. + 3. Let HTTPS state be the HTTPS state of the + browsing context's active document. + 4. Let CSP list be the CSP list of the browsing context's + active document. + 5. Navigate the browsing context to a new response whose + body is source, CSP list is + CSP list and HTTPS state is HTTPS state, with the + exceptions enabled flag and replacement enabled. The + source browsing context is that given to the overridden reload algorithm. When + the navigate algorithm creates a {{Document}} object for this purpose, set that + {{Document}}'s reload override flag and set its reload override buffer to + source. Rethrow any exceptions. + + When it comes time to set the document's address in the navigation algorithm, + use address as the override URL.

      The Document object

      @@ -124,6 +125,17 @@ Document implements GlobalEventHandlers; + The {{Document}} has an HTTPS state (an HTTPS state value), + initially "none", which represents the security properties of the network channel + used to deliver the {{Document}}'s data. + + The {{Document}} has a CSP list, which is a list of + Content Security Policy objects active in this context. The list is empty unless otherwise + specified. + + The {{Document}} has a module map, which is a + module map, initially empty. +

      Resource metadata management

      diff --git a/sections/elements.include b/sections/elements.include index e02f06492f..4b6d162899 100644 --- a/sections/elements.include +++ b/sections/elements.include @@ -1187,7 +1187,8 @@ <{script/charset}>; <{script/async}>; <{script/defer}>; - <{script/crossorigin}> + <{script/crossorigin}> + <{script/nonce}>
      @@ -1302,6 +1303,7 @@ diff --git a/sections/infrastructure.include b/sections/infrastructure.include index 7a02bc1d6c..e348cdcc78 100644 --- a/sections/infrastructure.include +++ b/sections/infrastructure.include @@ -711,8 +711,8 @@ * header list * body * internal response - * CSP list - * HTTPS state + * CSP list + * HTTPS state * request and its associated: * url * method @@ -3278,11 +3278,11 @@ A string is a valid non-empty URL potentially surrounded by spaces if, after stripping leading and trailing whitespace from it, it is a valid non-empty URL. - This specification defines the URL about:legacy-compat as a reserved, + This specification defines the URL about:legacy-compat as a reserved, though unresolvable, about: URL, for use in DOCTYPEs in HTML documents when needed for compatibility with XML tools. [[!RFC6694]] - This specification defines the URL about:srcdoc as a reserved, though + This specification defines the URL about:srcdoc as a reserved, though unresolvable, about: URL, that is used as the document's address of iframe srcdoc documents. [[!RFC6694]] diff --git a/sections/semantics-document-metadata.include b/sections/semantics-document-metadata.include index 40cf0dbf5b..37eac1f35b 100644 --- a/sections/semantics-document-metadata.include +++ b/sections/semantics-document-metadata.include @@ -1384,6 +1384,7 @@
      Content attributes:
      Global attributes
      media — Applicable media
      +
      <{style/nonce}> - Cryptographic nonce used in Content Security Policy checks [[CSP3]]
      type — Type of embedded resource
      scoped — Whether the styles apply to the entire document or just the parent @@ -1402,6 +1403,7 @@
               interface HTMLStyleElement : HTMLElement {
                 attribute DOMString media;
      +          attribute DOMString nonce;
                 attribute DOMString type;
                 attribute boolean scoped;
               };
      @@ -1464,6 +1466,11 @@
         and has a parent node that is an element is scoped, with the scoping root being the
         <{style}> element's parent element. [[!CSS-SCOPING-1]]
       
      +  The nonce attribute represents a cryptographic 
      +  nonce ("number used once") which can be used by Content Security Policy to determine 
      +  whether or not the style specified by an element will be applied to the document. The value is 
      +  text. [[CSP3]]
      +  
         The title attribute on <{style}> elements defines
         alternative style sheet sets. If the <{style}> element has no title
         attribute, then it has no title; the title attribute of ancestors does not apply to
      @@ -1573,7 +1580,7 @@
         

      - The {{HTMLStyleElement/media}}, {{HTMLStyleElement/type}} and + The {{HTMLStyleElement/media}}, {{HTMLStyleElement/nonce}}, {{HTMLStyleElement/type}} and {{HTMLStyleElement/scoped}} IDL attributes must reflect the respective content attributes of the same name.
      diff --git a/sections/semantics-embedded-content.include b/sections/semantics-embedded-content.include index 173bc6b366..f96075c947 100644 --- a/sections/semantics-embedded-content.include +++ b/sections/semantics-embedded-content.include @@ -3576,12 +3576,15 @@ My <img src="heart.png" alt="heart"> breaks.
      Navigate the element's child browsing context to a new response whose - url list consists of about:srcdoc, header list + url list consists of about:srcdoc, header list consists of Content-Type/text/html, - body is the value of the attribute, and HTTPS state is the - HTTPS state of the <{iframe}> element's node document's {{Window}}. + body is the value of the attribute, CSP list is the + CSP list of the <{iframe}> element's node document, and + HTTPS state is the HTTPS state of the <{iframe}> + element's node document. - The resulting {{Document}} must be considered an iframe srcdoc document. + The resulting {{Document}} must be considered + an iframe srcdoc document.
      diff --git a/sections/syntax.include b/sections/syntax.include index d95b27e07f..b64136eaa3 100644 --- a/sections/syntax.include +++ b/sections/syntax.include @@ -5116,7 +5116,7 @@ If the DOCTYPE token's name is not a case-sensitive match for the string "html", or the token's public identifier is not missing, or the token's system identifier is neither missing nor a case-sensitive match for the string - "about:legacy-compat", and none of the sets of conditions in the following list are + "about:legacy-compat", and none of the sets of conditions in the following list are matched, then there is a parse error.
        diff --git a/sections/webappapis.include b/sections/webappapis.include index 5c7f35d4f4..5a3df3b7b5 100644 --- a/sections/webappapis.include +++ b/sections/webappapis.include @@ -142,7 +142,7 @@ responsible document's address, due to mechanisms such as history.pushState(). - : An HTTPS state + : An HTTPS state :: A value representing the security properties of the network channel used to deliver the resource with which the environment settings object is associated. The value will be one of "modern", "deprecated", or "none". diff --git a/single-page.bs b/single-page.bs index cb5ed8cf86..5dbc57b1fa 100644 --- a/single-page.bs +++ b/single-page.bs @@ -345,33 +345,28 @@ url: https://html.spec.whatwg.org/#run-the-animation-frame-callbacks; type: dfn; text: animation frame callbacks url: http://www.w3.org/TR/2dcontext/#imagedata; type: interface; text: ImageData -url: https://www.w3.org/TR/CSP3/#policy; type: dfn; - text: Content Security Policy -url: https://www.w3.org/TR/CSP3/#directives; type: dfn; - text: Content Security Policy directive -url: https://www.w3.org/TR/CSP3/#grammardef-serialized-policy; type: dfn; - text: Content Security Policy syntax -url: https://www.w3.org/TR/CSP3/#enforced; type: dfn; - text: enforce the policy -url: https://www.w3.org/TR/CSP3/#parse-serialized-policy; type: dfn; - text: parse a serialized Content Security Policy -url: https://w3c.github.io/webappsec-csp/document/#frame-ancestors; type: dfn; - text: frame-ancestors directive -url: https://w3c.github.io/webappsec-csp/document/#allow-base-for-document; type: dfn; - text: Is base allowed for Document? -url: https://w3c.github.io/webappsec-csp/document/#sandbox; type: dfn; - text: sandbox directive -url: https://www.w3.org/TR/CSP3/#report-uri; type: dfn; - text: report-uri directive -url: https://www.w3.org/TR/CSP3/#can-compile-strings; type: dfn; - text: EnsureCSPDoesNotBlockStringCompilation -url: https://w3c.github.io/webappsec-csp/#initialize-global-object-csp; type: dfn; - text: Initialize a global object's CSP list -url: https://w3c.github.io/webappsec-csp/#initialize-document-csp; type: dfn; - text: Initialize a Document's CSP list -url: https://w3c.github.io/webappsec-csp/#should-block-inline; type: dfn; - text: Should element's inline behavior be blocked by Content Security Policy? + + +urlPrefix: https://w3c.github.io/webappsec-csp/#; type: dfn; spec: CSP + text: Initialize a global object's CSP list; url: initialize-global-object-csp + text: Initialize a Document's CSP list; url: initialize-document-csp + text: Should element's inline behavior be blocked by Content Security Policy?; url: should-block-inline + +urlPrefix: https://w3c.github.io/webappsec-csp/document/#; type: dfn; spec: CSP + text: frame-ancestors directive; url: frame-ancestors + text: Is base allowed for Document?; url: allow-base-for-document + text: sandbox directive; url: sandbox + +urlPrefix: https://www.w3.org/TR/CSP3/#; type: dfn; spec: CSP + text: Content Security Policy; url: policy + text: Content Security Policy directive; url: directives + text: Content Security Policy syntax; url: grammardef-serialized-policy + text: enforce the policy; url: enforced + text: EnsureCSPDoesNotBlockStringCompilation; url: can-compile-strings + text: parse a serialized Content Security Policy; url: parse-serialized-policy + text: report-uri directive; url: report-uri + urlPrefix: http://www.w3.org/TR/cssom-view/#; type: interface; spec: CSSOM-VIEW; From 3364ec9318e90bc771d923fc19e46bdad8703c2c Mon Sep 17 00:00:00 2001 From: Travis Leithead Date: Sat, 14 May 2016 00:41:20 -0700 Subject: [PATCH 16/19] All CSP changes validated and builds clean --- sections/browsers.include | 55 ++- sections/dom.include | 7 +- sections/infrastructure.include | 3 +- sections/semantics-document-metadata.include | 49 ++- sections/webappapis.include | 375 ++++++++----------- single-page.bs | 12 +- 6 files changed, 226 insertions(+), 275 deletions(-) diff --git a/sections/browsers.include b/sections/browsers.include index f388ce793b..f01ca094b0 100644 --- a/sections/browsers.include +++ b/sections/browsers.include @@ -801,7 +801,7 @@ : The creation URL :: Return url. - : The HTTPS state + : The HTTPS state :: Return the HTTPS state of the {{Document}} with which window is currently associated. 5. Set realm's \[[HostDefined]] field to settings object. @@ -1114,13 +1114,6 @@ -
        - - The Window has an HTTPS state, - which represents the security properties of the network channel used to deliver the - {{Document}} with which the Window is associated. The value will be one of - "modern", "deprecated", or "none". If it is not explicitly set, then its value is "none". - The window, frames, and self @@ -1130,25 +1123,21 @@ The document IDL attribute must return the Window object's newest Document object. -

        - The {{Document}} object associated with a Window object can - change in exactly one case: when the navigate algorithm initializes a new {{Document}} object for the first page loaded - in a browsing context. In that specific case, the Window object of the - original about:blank page is reused and gets a new {{Document}} object. -

        +

        The {{Document}} object associated with a Window object can change in + exactly one case: when the navigate algorithm initializes a new {{Document}} object for the + first page loaded in a browsing context. In that specific case, the {{Window}} object of + the original about:blank page is reused and gets a new {{Document}} object.

        - The defaultView IDL attribute of the - {{Document}} interface must return the {{Document}}'s browsing - context's WindowProxy object, if there is one, or null otherwise. + The defaultView IDL attribute of the {{Document}} + interface must return the {{Document}}'s browsing context's {{WindowProxy}} object, if + there is one, or null otherwise.
        - For historical reasons, Window objects must also have a writable, configurable, + For historical reasons, {{Window}} objects must also have a writable, configurable, non-enumerable property named HTMLDocument whose value is the {{Document}} interface object. -
        -

        APIs for creating and navigating browsing contexts by name

        @@ -1307,7 +1296,7 @@ {{Document}} object. Otherwise, navigate target browsing context - to resource, with exceptions enabled. If new is true, then + to resource, with the exceptions enabled flag set. If new is true, then replacement must be enabled also. The source browsing context is source browsing context. @@ -3221,8 +3210,8 @@ 1. The source browsing context is the responsible browsing context specified by the incumbent settings object. - 2. Navigate the browsing context to url, with exceptions enabled. - Rethrow any exceptions. + 2. Navigate the browsing context to url, with the + exceptions enabled flag set. Rethrow any exceptions. If the replacement flag is set or the browsing context's session history contains only one {{Document}}, and that was the @@ -3530,10 +3519,10 @@
        Otherwise
        -
        Navigate the browsing context to - the document's address with replacement enabled and exceptions - enabled. The source browsing context must be the browsing - context being navigated. This is a reload-triggered navigation.
        +
        Navigate the browsing context to the document's URL + with the exceptions enabled flag set and replacement enabled. + The source browsing context must be the browsing context being navigated. This is + a reload-triggered navigation. Rethrow any exceptions.
        @@ -3611,7 +3600,8 @@ author's explicit request to sandbox the content.

        - If the navigate algorithm was invoked with exceptions enabled, and it + If the navigate algorithm was invoked optionally with an + exceptions enabled flag, and it is aborted on this step, then in addition to aborting this algorithm, the user agent must also throw a SecurityError exception. @@ -3775,8 +3765,9 @@ Otherwise, the result of obtaining the resource for the URL is a response whose header list consists of Content-Type/text/html and whose - body is result, and whose HTTPS state is - settings's HTTPS state. + body is result, and whose + HTTPS state is settings's + HTTPS state. When it comes time to set the document's address in the navigation algorithm, use address as the override URL. @@ -4101,8 +4092,8 @@ {{Document}}. 3. Set browsingContext's {{WindowProxy}} object's [[Window]] internal slot value to window. - 4. Set the {{Document}}'s HTTPS state to the HTTPS state of the resource used to - generate the document. + 4. Set the {{Document}}'s HTTPS state to the + HTTPS state of the resource used to generate the document. 5. Execute the Initialize a Document's CSP list algorithm on the {{Document}} object and the resource used to generate the document. [[CSP3]] 6. Set the document's referrer to the diff --git a/sections/dom.include b/sections/dom.include index 3e4e76b640..8c69254b53 100644 --- a/sections/dom.include +++ b/sections/dom.include @@ -2310,16 +2310,15 @@ CSS styling attribute as defined by the CSS Styling Attribute Syntax specification. [[!CSS-STYLE-ATTR]] -
        In user agents that support CSS, the attribute's value must be parsed when the attribute is added or has its value changed, according to the rules given for CSS styling attributes. [[!CSS-STYLE-ATTR]] - However, if the Should element's inline behavior be blocked by Content Security - Policy? algorithm returns "Blocked" when executed upon the + However, if the + Should element's inline behavior be blocked by Content Security Policy? algorithm returns + "Blocked" when executed upon the attribute's element and "style attribute", then the style rules defined in the attribute's value must not be applied to the element. [[!CSP3]] -
        Documents that use <{global/style}> attributes on any of their elements must still be comprehensible and usable if those attributes were removed. diff --git a/sections/infrastructure.include b/sections/infrastructure.include index e348cdcc78..454d0bc01f 100644 --- a/sections/infrastructure.include +++ b/sections/infrastructure.include @@ -1352,7 +1352,8 @@ * The Initialize a global object's CSP list algorithm * The Initialize a Document's CSP list algorithm * The Should element's inline behavior be blocked by Content Security Policy? algorithm - * The report-uri directive + * The report-uri, frame-ancestors, and + sandbox directives * The EnsureCSPDoesNotBlockStringCompilation abstract algorithm * The Is base allowed for Document? algorithm :: The following terms are defined in Content Security Policy: Document Features diff --git a/sections/semantics-document-metadata.include b/sections/semantics-document-metadata.include index 37eac1f35b..a08099efb4 100644 --- a/sections/semantics-document-metadata.include +++ b/sections/semantics-document-metadata.include @@ -1218,7 +1218,6 @@
        <meta http-equiv="Refresh" content="20; URL=page4.html">
        -
        : Cookie setter (http-equiv="set-cookie") :: This pragma sets an HTTP cookie. [[!COOKIES]] @@ -1229,8 +1228,38 @@ 2. Act as if receiving a set-cookie-string for the document's address via a "non-HTTP" API, consisting of the value of the element's content attribute encoded as UTF-8. [[!COOKIES]] [[!ENCODING]] -
        + : Content security policy state (http-equiv="content-security-policy") + :: This pragma enforces a Content Security Policy on a {{Document}}. + [[CSP3]] + + 1. If the <{meta}> element is not a child of a <{head}> element, abort these steps. + 2. If the <{meta}> element has no <{meta/content}> attribute, or if that attribute's value + is the empty string, then abort these steps. + 3. Let policy be the result of executing Content Security Policy's + parse a serialized Content Security Policy algorithm on the <{meta}> element's + <{meta/content}> attribute's value. + 4. Remove all occurrences of the report-uri, + frame-ancestors, and sandbox directives + from policy. + 5. Enforce the policy policy. + + For <{meta}> elements with an <{meta/http-equiv}> attribute in the + Content security policy state, the <{meta/content}> attribute + must have a value consisting of a valid Content Security Policy, but must not contain + any report-uri, frame-ancestors, or + sandbox directives. The Content Security Policy given in + the <{meta/content}> attribute will be enforced upon the current document. [[CSP3]] + +
        + A page might choose to mitigate the risk of cross-site scripting attacks by preventing the + execution of inline JavaScript, as well as blocking all plugin content, using a policy such + as the following: +
        +            <meta http-equiv="Content-Security-Policy" content="script-src 'self'; object-src 'none'">
        +          
        +
        + There must not be more than one <{meta}> element with any particular state in the document at a time. @@ -1497,8 +1526,10 @@
        - Whenever one of the following conditions occur for an element whose {{Document}} is in - a browsing context: + The user agent must run the update a style block algorithm that + applies for the style sheet language specified by the <{style}> element's <{style/type}> + attribute, passing it the element's style data, whenever one of the following + conditions occur: * the element is popped off the stack of open elements of an HTML parser or XML parser, @@ -1508,10 +1539,6 @@ * the element is not on the stack of open elements of an HTML parser or XML parser, and one of its child nodes is modified by a script, - ...the user agent must run the update a style block algorithm that - applies for the style sheet language specified by the element's type attribute, - passing it the element's style data. - For styling languages that consist of pure text (as opposed to XML), a style element's style data is the concatenation of the contents of all the Text nodes that are children of the <{style}> element (not any other nodes such as comments @@ -1526,7 +1553,11 @@ remove the CSS style sheet in question. 3. If element is not in a Document, then abort these steps. - 4. create a CSS style sheet with the following properties: + 4. If the Should element's inline behavior be blocked by Content Security Policy? + algorithm returns "Blocked" when executed upon the <{style}> element, + "style", and the <{style}> element's style data, then abort these steps. + [[CSP3]] + 5. create a CSS style sheet with the following properties: : <{style/type}> :: text/css diff --git a/sections/webappapis.include b/sections/webappapis.include index 5a3df3b7b5..f3bb504e85 100644 --- a/sections/webappapis.include +++ b/sections/webappapis.include @@ -143,15 +143,9 @@ history.pushState(). : An HTTPS state - :: A value representing the security properties of the network channel used to deliver the - resource with which the environment settings object is associated. The value will - be one of "modern", "deprecated", or "none". - -

        Resources delivered over HTTPS will generally have an HTTPS state of - "modern". A user agent can use "deprecated" during transitional - periods where rejecting the response entirely would be inappropriate (e.g., while removing - support for a hash function or cypher suite).

        - + :: An HTTPS state value representing the security properties of the network channel used to + deliver the resource with which the environment settings object is associated. + An environment settings object also has an outstanding rejected promises weak set and an about-to-be-notified rejected promises list, used to track @@ -1454,7 +1448,7 @@ a credentials mode, a cryptographic nonce, and a parser state: When an event handler content attribute is set, execute the following steps: - 1. If the Should element's inline behavior be blocked by Content Security Policy? algorithm + 1. If the Should element's inline behavior be blocked by Content Security Policy? algorithm returns "Blocked" when executed upon the attribute's element "script attribute", and the attribute's value, then abort these steps. [[!CSP3]] 2. Set the corresponding event handler to an internal raw uncompiled handler @@ -2201,235 +2195,163 @@ a credentials mode, a cryptographic nonce, and a parser state:

        Opening the input stream

        - The open() method comes in several variants - with different numbers of arguments. + The + open() + method comes in several variants with different numbers of arguments.
        - -
        document = document . open( [ type [, replace ] ] )
        - -
        - - Causes the Document to be replaced in-place, as if it was a new - Document object, but reusing the previous object, which is then returned. +
        document = document . {{Document/open()|open}}( [ type [, replace ] ] )
        +
        Causes the {{Document}} to be replaced in-place, as if it was a new {{Document}} object, but + reusing the previous object, which is then returned. If the type argument is omitted or has the value - "text/html", then the resulting Document has an HTML parser associated - with it, which can be given data to parse using document.write(). Otherwise, all content passed to document.write() will be parsed as plain text. - - If the replace argument is present and has the value "replace", the existing entries in the session history for the - Document object are removed. + "text/html", then the resulting {{Document}} has an HTML + parser associated with it, which can be given data to parse using + {{Document/write()|document.write()}}. Otherwise, all content passed to + {{Document/write()|document.write()}} will be parsed as plain text. - The method has no effect if the Document is still being parsed. - - Throws an InvalidStateError exception if the Document is an XML document. - -
        - -
        window = document . open( url, name, features [, replace ] )
        - -
        + If the replace argument is present and has the value "replace", the + existing entries in the session history for the {{Document}} object are removed. - Works like the window.open() method. + The method has no effect if the {{Document}} is still being parsed. + Throws an "{{InvalidStateError}}" {{DOMException}} if the {{Document}} is an + XML document.
        +
        window = document . {{Document/open()|open}}( url, name, features [, replace ] )
        +
        Works like the {{Window/open()|window.open()}} method.
        - Document objects have an ignore-opens-during-unload counter, which is - used to prevent scripts from invoking the document.open() - method (directly or indirectly) while the document is being unloaded. Initially, the counter must be set to zero. - - When called with two arguments (or fewer), the document.open() - method must act as follows: - -
          - -
        1. If the Document object is not flagged as an HTML - document, throw an InvalidStateError exception and abort these steps.
        2. - -
        3. If the Document object is not an active document, then abort - these steps.
        4. - -
        5. Let type be the value of the first argument.
        6. - -
        7. - - If the second argument is an ASCII case-insensitive match for the value - "replace", then let replace be true. - - Otherwise, if the browsing context's session history contains only - one {{Document}}, and that was the about:blank Document - created when the browsing context was created, and that Document has - never had the unload a document algorithm invoked on it (e.g., by a previous call to - document.open()), then let replace be - true. - - Otherwise, let replace be false. - -
        8. - -
        9. - - If the Document has an active parser whose script nesting - level is greater than zero, then the method does nothing. Abort these steps and return - the Document object on which the method was invoked. - -

          - This basically causes document.open() to - be ignored when it's called in an inline script found during parsing, while still letting it - have an effect when called from a non-parser task such as a timer callback or event handler. -

          - -
        10. - -
        11. - - Similarly, if the Document's ignore-opens-during-unload counter is - greater than zero, then the method does nothing. Abort these steps and return the - Document object on which the method was invoked. - -

          - This basically causes document.open() to - be ignored when it's called from a beforeunload pagehide, or unload event - handler while the Document is being unloaded. -

          - -
        12. - -
        13. Set the Document's salvageable state to false.
        14. - -
        15. Prompt to unload the - Document object. If the user refused to allow the document to be unloaded, then abort these steps and return the Document object on which the - method was invoked.
        16. - -
        17. Unload the Document object, with the - recycle parameter set to true.
        18. - -
        19. Abort the {{Document}}.
        20. - -
        21. Unregister all event listeners registered on the Document node and its - descendants. + {{Document}} objects have an ignore-opens-during-unload counter, which is used to + prevent scripts from invoking the {{Document/open()|document.open()}} method (directly or + indirectly) while the document is being unloaded. Initially, the counter must be set to + zero. -
        22. Remove any tasks associated with the - Document in any task source.
        23. + When called with two arguments (or fewer), the {{Document/open()|document.open()}} method must act + as follows: -
        24. Remove all child nodes of the document, without firing any mutation events.
        25. - -
        26. - - Replace the Document's singleton objects with new instances of those objects. - (This includes in particular the {{Window}}, Location, - History, ApplicationCache, and Navigator, objects, the - various BarProp objects, the two Storage objects, the various - HTMLCollection objects, and objects defined by other specifications, like - Selection. It also includes all the Web - IDL prototypes in the JavaScript binding, including the Document object's - prototype.) - -

          - The new Window object has a new environment settings - object. -

          - -
        27. - -
        28. Set the new Window object's HTTPS - state to the HTTPS state of the - Window object of the responsible document specified by the entry - settings object.
        29. - -
        30. Change the document's character encoding to UTF-8.
        31. - -
        32. If the Document is ready for post-load tasks, then set the - Document object's reload override flag and set the - Document's reload override buffer to the empty string.
        33. - -
        34. Set the Document's salvageable state back to true.
        35. - -
        36. Change the document's address to the address of the responsible document specified by the entry - settings object.
        37. - -
        38. If the Document's iframe load in progress flag is set, set the - Document's mute iframe load flag.
        39. - -
        40. Create a new HTML parser and associate it with the document. This is a - script-created parser (meaning that it can be closed by the document.open() and document.close() methods, and that the tokenizer will wait for - an explicit call to document.close() before emitting an - end-of-file token). The encoding confidence is - irrelevant.
        41. - -
        42. Set the current document readiness of the document to "loading".
        43. - -
        44. - - If type is an ASCII case-insensitive match for the string - "replace", then, for historical reasons, set it to the string "text/html". - - Otherwise: - - If the type string contains a U+003B SEMICOLON character (;), remove the - first such character and all characters from it up to the end of the string. - - Strip leading and trailing whitespace from type. - -
        45. - -
        46. - - If type is not now an ASCII case-insensitive match - for the string "text/html", then act as if the tokenizer had emitted a start tag - token with the tag name "pre" followed by a single U+000A LINE FEED (LF) character, then switch the - HTML parser's tokenizer to the [[#plaintext-state]]. - -
        47. - -
        48. - - Remove all the entries in the browsing context's session history - after the current entry. If the current entry is the last entry in the - session history, then no entries are removed. - -

          - This doesn't necessarily have to affect the user - agent's user interface. -

          - -
        49. - -
        50. Remove any tasks queued by the history traversal - task source that are associated with any Document objects in the - top-level browsing context's document family.
        51. - -
        52. Remove any earlier entries that share the same {{Document}}.
        53. - -
        54. If replace is false, then add a new entry, just before the last entry, - and associate with the new entry the text that was parsed by the previous parser associated with - the Document object, as well as the state of the document at the start of these - steps. This allows the user to step backwards in the session history to see the page before it - was blown away by the document.open() call. This new entry - does not have a Document object, so a new one will be created if the session history - is traversed to that entry.
        55. - -
        56. Finally, set the insertion point to point at just before the end of the - input stream (which at this point will be empty).
        57. - -
        58. Return the Document on which the method was invoked.
        59. - -
        - -

        - The document.open() method does not affect - whether a Document is ready for post-load tasks or completely - loaded. -

        - - When called with four arguments, the open() method on - the Document object must call the open() method on the - Window object of the Document object, with the same arguments as the - original call to the open() method, and return whatever - that method returned. If the Document object has no Window object, then - the method must throw an InvalidAccessError exception. + 1. If the {{Document}} object is an XML document, then throw an "{{InvalidStateError}}" + {{DOMException}} and abort these steps. + 2. If the {{Document}} object is not an active document, then abort these steps. + 3. If the origin of the {{Document}} is not equal to the + origin of the responsible document specified by the + entry settings object, throw a "{{SecurityError}}" {{DOMException}} and abort these + steps. + 4. Let type be the value of the first argument. + 5. If the second argument is an ASCII case-insensitive match for the value + "replace", then let replace be true. + + Otherwise, if the browsing context's session history contains only one + {{Document}}, and that was the about:blank {{Document}} created + when the browsing context was created, and + that {{Document}} has never had the unload a document algorithm invoked on it (e.g., + by a previous call to {{Document/open()|document.open()}}), then let replace be + true. + + Otherwise, let replace be false. + 6. If the {{Document}} has an active parser whose script nesting level is greater + than zero, then the method does nothing. Abort these steps and return the {{Document}} object + on which the method was invoked. + +

        This basically causes {{Document/open()|document.open()}} to be ignored when + it's called in an inline script found during parsing, while still letting it have an effect + when called from a non-parser task such as a timer callback or event handler.

        + 7. Similarly, if the {{Document}}'s ignore-opens-during-unload counter is greater than + zero, then the method does nothing. Abort these steps and return the {{Document}} object on + which the method was invoked. + +

        This basically causes {{Document/open()|document.open()}} to be ignored when + it's called from a beforeunload pagehide, or unload + event handler while the {{Document}} is being unloaded.

        + 8. Set the {{Document}}'s salvageable state to false. + 9. Prompt to unload the {{Document}} object. If the user + refused to allow the document to be unloaded, then abort these steps and return the + {{Document}} object on which the method was invoked. + 10. Unload the {{Document}} object, with the recycle parameter set to true. + 11. Abort the {{Document}}. + 12. Unregister all event listeners registered on the {{Document}} node and its descendants. + 13. Remove any tasks associated with the {{Document}} in any task source. + 14. Remove all child nodes of the document, without firing any mutation events. + 15. Call the JavaScript InitializeHostDefinedRealm() abstract operation with the following + customizations: + + * For the global object, create a new {{Window}} object window. + * For the global this value, use the current browsing context's associated + {{WindowProxy}}. + * Let realm execution context be the created JavaScript execution context. + 16. Set window's + associated Document to the + {{Document}}. + 17. Set up a browsing context environment settings object with + realm execution context. + 18. Replace the {{Document}}'s singleton objects with new instances of those objects, created in + window's Realm. (This includes in particular the {{Window}}, {{Location}}, + {{History}}, {{ApplicationCache}}, and {{Navigator}}, objects, the various {{BarProp}} + objects, the two Storage objects, the various {{HTMLCollection}} objects, and + objects defined by other specifications, like Selection. It also includes all + the Web IDL prototypes in the JavaScript binding, including the {{Document}} object's + prototype.) + 19. Change the document's character encoding to UTF-8. + 20. If the {{Document}} is ready for post-load tasks, then set the {{Document}} object's + reload override flag and set the {{Document}}'s reload override buffer to the + empty string. + 21. Set the {{Document}}'s salvageable state back to true. + 22. Change the document's URL to the URL of the + responsible document specified by the entry settings object. + 23. If the {{Document}}'s iframe load in progress flag is set, set the {{Document}}'s + mute iframe load flag. + 24. Create a new HTML parser and associate it with the document. This is a + script-created parser (meaning that it can be closed by the + {{Document/open()|document.open()}} and {{Document/close()|document.close()}} methods, and + that the tokenizer will wait for an explicit call to {{Document/close()|document.close()}} + before emitting an end-of-file token). The encoding confidence is irrelevant. + 25. Set the current document readiness of the document to "loading". + 26. If type is an ASCII case-insensitive match for the string + "replace", then, for historical reasons, set it to the string + "text/html". + + Otherwise: + + If the type string contains a U+003B SEMICOLON character (;), remove the first + such character and all characters from it up to the end of the string. + + Strip leading and trailing whitespace from type. + 27. If type is not now an ASCII case-insensitive match for the string + "text/html", then act as if the tokenizer had emitted a + start tag token with the tag name "pre" followed by a single U+000A LINE FEED (LF) character, + then switch the HTML parser's tokenizer to the [[#plaintext-state]]. + 28. Remove all the entries in the browsing context's session history after the + current entry. If the current entry is the last entry in the session history, + then no entries are removed. + +

        This doesn't necessarily have to affect the user agent's user + interface.

        + 29. Remove any tasks queued by the history traversal task source that are associated + with any {{Document}} objects in the top-level browsing context's + document family. + 30. Remove any earlier entries that share the same {{Document}}. + 31. If replace is false, then add a new entry, just before the last entry, and + associate with the new entry the text that was parsed by the previous parser associated with + the {{Document}} object, as well as the state of the document at the start of these steps. + This allows the user to step backwards in the session history to see the page before it was + blown away by the {{Document/open()|document.open()}} call. This new entry does not have a + {{Document}} object, so a new one will be created if the session history is traversed to that + entry. + 32. Set the {{Document}}'s fired unload flag to false. (It could have been set to true + during the unload step above.) + 33. Finally, set the insertion point to point at just before the end of the + input stream (which at this point will be empty). + 34. Return the {{Document}} on which the method was invoked. + +

        The {{Document/open()|document.open()}} method does not affect whether a + {{Document}} is ready for post-load tasks or completely loaded.

        + + When called with four arguments, the {{Document/open()}} method on the {{Document}} object must + call the {{Window/open()}} method on the {{Window}} object of the {{Document}} object, with the + same arguments as the original call to the {{Document/open()}} method, and return whatever that + method returned. If the {{Document}} object has no {{Window}} object, then the method must throw + an "{{InvalidAccessError}}" {{DOMException}}.

        Closing the input stream

        @@ -5033,3 +4955,4 @@ a credentials mode, a cryptographic nonce, and a parser state:
        + diff --git a/single-page.bs b/single-page.bs index 5dbc57b1fa..e0638a5eea 100644 --- a/single-page.bs +++ b/single-page.bs @@ -349,10 +349,12 @@ url: http://www.w3.org/TR/2dcontext/#imagedata; type: interface; urlPrefix: https://w3c.github.io/webappsec-csp/#; type: dfn; spec: CSP + text: enforced text: Initialize a global object's CSP list; url: initialize-global-object-csp text: Initialize a Document's CSP list; url: initialize-document-csp text: Should element's inline behavior be blocked by Content Security Policy?; url: should-block-inline - + text: valid Content Security Policy; url: grammardef-serialized-policy + urlPrefix: https://w3c.github.io/webappsec-csp/document/#; type: dfn; spec: CSP text: frame-ancestors directive; url: frame-ancestors text: Is base allowed for Document?; url: allow-base-for-document @@ -360,12 +362,16 @@ urlPrefix: https://w3c.github.io/webappsec-csp/document/#; type: dfn; spec: CSP urlPrefix: https://www.w3.org/TR/CSP3/#; type: dfn; spec: CSP text: Content Security Policy; url: policy - text: Content Security Policy directive; url: directives + url: directives; + text: Content Security Policy directive + text: directives text: Content Security Policy syntax; url: grammardef-serialized-policy text: enforce the policy; url: enforced text: EnsureCSPDoesNotBlockStringCompilation; url: can-compile-strings text: parse a serialized Content Security Policy; url: parse-serialized-policy - text: report-uri directive; url: report-uri + text: report-uri + text: frame-ancestors + text: sandbox From 07b96eb7252dabf9ae4902ae4ce2675caaf2cf5f Mon Sep 17 00:00:00 2001 From: Travis Leithead Date: Mon, 16 May 2016 00:08:33 -0700 Subject: [PATCH 17/19] Removed script modules --- images/asyncdefer.svg | 177 ++++++------------ sections/browsers.include | 6 +- sections/dom.include | 3 - sections/infrastructure.include | 5 - sections/semantics-scriptings.include | 166 ++--------------- sections/webappapis.include | 258 +------------------------- 6 files changed, 84 insertions(+), 531 deletions(-) diff --git a/images/asyncdefer.svg b/images/asyncdefer.svg index 456fe78b4d..3be33a2a6d 100644 --- a/images/asyncdefer.svg +++ b/images/asyncdefer.svg @@ -1,5 +1,7 @@ - - - - - - - - - - - - - - + ]]> + + + Layer 1 + + + + + + + - - - - - - - - - - - - - - - <script> - - - Scripting: - HTML Parser: - - - - - - - + + <script> + + Scripting: + HTML Parser: + + + + + + + - - - <script defer> - - - Scripting: - HTML Parser: - - - - - + + <script defer> + + Scripting: + HTML Parser: + + + + + - - - <script async> - - - Scripting: - HTML Parser: - - - - - - - + + <script async> + + Scripting: + HTML Parser: + + + + + + + - - - <script type="module"> - - - Scripting: - HTML Parser: - - - - - - - - - - + + + parser + + fetch + + execution - - - <script type="module" async> - - - Scripting: - HTML Parser: - - - - - - - - - - - - - - - - - parser - - - fetch - - - execution - - - runtime → - + runtime → + + \ No newline at end of file diff --git a/sections/browsers.include b/sections/browsers.include index 3ac19c191e..a94efada85 100644 --- a/sections/browsers.include +++ b/sections/browsers.include @@ -691,10 +691,6 @@ : The realm execution context :: Return execution context. - : The module map - :: Return the module map of the {{Document}} with which - window is currently associated. - : The responsible browsing context :: Return the browsing context with which window is associated. @@ -3979,7 +3975,7 @@ object. * Let realm execution context be the created JavaScript execution context. - * Do not obtain any source texts for scripts or modules. + * Do not obtain any source texts for scripts. 2. Set up a browsing context environment settings object with realm execution context, and let settings object be the result. 3. Set window's diff --git a/sections/dom.include b/sections/dom.include index 6581fadabc..c46b8c4296 100644 --- a/sections/dom.include +++ b/sections/dom.include @@ -133,9 +133,6 @@ Content Security Policy objects active in this context. The list is empty unless otherwise specified. - The {{Document}} has a module map, which is a - module map, initially empty. -

        Resource metadata management

        diff --git a/sections/infrastructure.include b/sections/infrastructure.include index 8bfc20c8a5..d727fdeb14 100644 --- a/sections/infrastructure.include +++ b/sections/infrastructure.include @@ -842,14 +842,11 @@ * %ObjProto_toString% * %ObjProto_valueOf% * The FunctionBody production - * The Module production * The Pattern production * The Script production * The Type notation * The List and Record specification types * The Property Descriptor specification type - * The Source Text Module Record specification type and its ModuleEvaluation - and ModuleDeclarationInstantiation methods * The ArrayCreate abstract operation * The Call abstract operation * The CloneArrayBuffer abstract operation @@ -864,7 +861,6 @@ * The HasOwnProperty abstract operation * The HostEnsureCanCompileStrings abstract operation * The HostPromiseRejectionTracker abstract operation - * The HostResolveImportedModule abstract operation * The InitializeHostDefinedRealm abstract operation * The IsAccessorDescriptor abstract operation * The IsCallable abstract operation @@ -882,7 +878,6 @@ * The OrdinarySet abstract operation * The OrdinaryDelete abstract operation * The OrdinaryOwnPropertyKeys abstract operation - * The ParseModule abstract operation * The ParseScript abstract operation * The RunJobs abstract operation * The SameValue abstract operation diff --git a/sections/semantics-scriptings.include b/sections/semantics-scriptings.include index ce0eccbbc0..a6b8bada21 100644 --- a/sections/semantics-scriptings.include +++ b/sections/semantics-scriptings.include @@ -87,10 +87,6 @@ top-level production. Classic scripts are affected by the <{script/charset}>, <{script/async}>, and <{script/defer}> attributes. Authors should omit the attribute, instead of redundantly giving a JavaScript MIME type. - * Setting the attribute to an ASCII case-insensitive match for the string - "`module`" means that the script is a module script, to be interpreted - according to the JavaScript Module top-level production. Module scripts are - not affected by the <{script/charset}> and <{script/defer}> attributes. * Setting the attribute to any other value means that the script is a data block, which is not processed. None of the <{script}> attributes (except <{script/type}> itself) have any effect on data blocks. @@ -100,18 +96,17 @@

        The requirement that data blocks must be denoted using a valid MIME type is in place to avoid potential future collisions. If this specification ever adds additional types of script, they will be triggered by setting the - <{script/type}> attribute to something which is not a MIME type, like how the "`module`" value - denotes module scripts. By using a valid MIME type now, you ensure that your data block + <{script/type}> attribute to something which is not a MIME type. + By using a valid MIME type now, you ensure that your data block will not ever be reinterpreted as a different script type, even in future user agents.

        - Classic scripts and module scripts may either be embedded inline or may be imported + Classic scripts may either be embedded inline or may be imported from an external file using the src attribute, which if specified gives the URL of the external script resource to use. If <{script/src}> is specified, it must be a valid non-empty URL potentially surrounded by spaces. The contents of inline <{script}> elements, or the external script resource, must conform with the - requirements of the JavaScript specification's Script or - Module productions, for classic scripts and module scripts - respectively. [[ECMA-262]] + requirements of the JavaScript specification's Script + production for classic scripts. [[ECMA-262]] When used to include data blocks, the data must be embedded inline, the format of the data must be given using the <{script/type}> attribute, and the contents of the <{script}> element must @@ -122,7 +117,7 @@ The charset attribute gives the character encoding of the external script resource. The attribute must not be specified if the <{script/src}> attribute is not present, or if the script is not a classic script. - (Module scripts are always interpreted as UTF-8.) If the attribute is set, its value + If the attribute is set, its value must be an ASCII case-insensitive match for one of the labels of an encoding, and must specify the same encoding as the `charset` parameter of the Content-Type metadata of the external @@ -131,7 +126,7 @@ The async and defer attributes are boolean attributes that indicate how the script should be executed. Classic scripts may specify - <{script/defer}> or <{script/async}>; module scripts may specify <{script/async}>. + <{script/defer}> or <{script/async}>. There are several possible modes that can be selected using these attributes, and depending on the script's <{script/type}>. @@ -144,16 +139,9 @@ present, then the script is fetched and evaluated immediately, blocking parsing until these are both complete. - For module scripts, if the <{script/async}> attribute is present, then the module script - and all its dependencies will be fetched in parallel to parsing, and the module script will - be evaluated as soon as it is available (potentially before parsing completes). Otherwise, the - module script and its dependencies will be fetched in parallel to parsing and evaluated - when the page has finished parsing. (The <{script/defer}> attribute has no effect on module - scripts.) - This is all summarized in the following schematic diagram: - With <script>, parsing is interrupted by fetching and execution. With <script defer>, fetching is parallel to parsing and execution takes place after all parsing has finished. And with <script async>, fetching is parallel to parsing but once it finishes parsing is interrupted to execute the script. The story for <script type="module"> is similar to <script defer>, but the dependencies will be fetched as well, and the story for <script type="module" async> is similar to <script async> with the extra dependency fetching. + With <script>, parsing is interrupted by fetching and execution. With <script defer>, fetching is parallel to parsing and execution takes place after all parsing has finished. And with <script async>, fetching is parallel to parsing but once it finishes parsing is interrupted to execute the script.

        The exact processing details for these attributes are, for mostly historical @@ -172,11 +160,7 @@ The crossorigin attribute is a CORS settings attribute. For classic scripts, it controls whether error information - will be exposed, when the script is obtained from other origins. For - module scripts, it controls the credentials mode used for cross-origin requests. - -

        Unlike classic scripts, module scripts require the use of the - CORS protocol for cross-origin fetching.

        + will be exposed, when the script is obtained from other origins. The nonce attribute represents a cryptographic nonce ("number used once") which can be used by Content Security Policy to @@ -285,62 +269,6 @@ o............A....e
      -
      - The following sample shows how a <{script}> element can be used to include an external - module script. - -
      -      <script type="module" src="app.js"></script>
      -    
      - - This module, and all its dependencies (expressed through JavaScript `import` statements in the - source file), will be fetched. Once the entire resulting module tree has been imported, and the - document has finished parsing, the contents of `app.js` will be evaluated. -
      - -
      - The following sample shows how a <{script}> element can be used to write an inline - module script that performs a number of substitutions on the document's text, in order to - make for a more interesting reading experience (e.g. on a news site): [[XKCD-1288]] - -
      -      <script type="module">
      -       import { walkAllTextNodeDescendants } from "./dom-utils.js";
      -
      -       const substitutions = new Map([
      -         ["witnesses", "these dudes I know"]
      -         ["allegedly", "kinda probably"]
      -         ["new study", "Tumblr post"]
      -         ["rebuild", "avenge"]
      -         ["space", "spaaace"]
      -         ["Google glass", "Virtual Boy"]
      -         ["smartphone", "Pokédex"]
      -         ["electric", "atomic"]
      -         ["Senator", "Elf-Lord"]
      -         ["car", "cat"]
      -         ["election", "eating contest"]
      -         ["Congressional leaders", "river spirits"]
      -         ["homeland security", "Homestar Runner"]
      -         ["could not be reached for comment", "is guilty and everyone knows it"]
      -       ]);
      -
      -       function substitute(textNode) {
      -         for (const [before, after] of substitutions.entries()) {
      -           textNode.data = textNode.data.replace(new RegExp(`\\b${before}\\b`, "ig"), after);
      -         }
      -       }
      -
      -       walkAllTextNodeDescendants(document.body, substitute);
      -      </script>
      -    
      - - Some notable features gained by using a module script include the ability to import - functions from other JavaScript modules, strict mode by default, and how top-level declarations - do not introduce new properties onto the global object. Also note that no matter where - this <{script}> element appears in the document, it will not be evaluated until both document - parsing has complete and its dependency (`dom-utils.js`) has been fetched and evaluated. -
      -
      Processing model
      A <{script}> element has several associated pieces of state. @@ -367,7 +295,7 @@ o............A....e elements that are also "parser-inserted", to let the parser know when to execute the script. - The fifth is the script's type, which is either "`classic`" or "`module`". It is + The fifth is the script's type, which is "`classic`". It is determined when the script is prepared, based on the <{script/type}> attribute of the element at that time. Initially, <{script}> elements must have this flag unset. @@ -377,7 +305,7 @@ o............A....e Finally, a <{script}> element has the script's script, which is a <{script}> resulting from preparing the element. This is set asynchronously after the - classic script or module tree is fetched. Once it is set, either to a <{script}> in the + classic script is fetched. Once it is set, either to a <{script}> in the case of success or to null in the case of failure, the fetching algorithms will note that the script is ready, which can trigger other actions. The user agent must delay the load event of the element's node document until @@ -445,8 +373,6 @@ o............A....e * If the script block's type string is an ASCII case-insensitive match for any JavaScript MIME type, the script's type is "`classic`". - * If the script block's type string is an ASCII case-insensitive match for - the string "`module`", the script's type is "`module`". * If neither of the above conditions are true, then abort these steps at this point. No script is executed. 7. If was-parser-inserted is true, then flag the element as "parser-inserted" @@ -485,8 +411,6 @@ o............A....e If the <{script}> element does not have a <{script/charset}> attribute, or if getting an encoding failed, let encoding be the same as the encoding of the document itself. - -

      If the script's type is "`module`", this encoding will be ignored.

      14. Let CORS setting be the current state of the element's <{script/crossorigin}> content attribute. 15. If the <{script}> element has a <{script/nonce}> attribute, then let @@ -514,30 +438,11 @@ o............A....e
      Fetch a classic script given url, CORS setting, cryptographic nonce, parser state, settings, and encoding. - -
      `"module"`
      -
      - 1. Let credentials mode be determined by switching on - CORS setting: -
      -
      No CORS
      -
      `"omit"`
      - -
      Anonymous
      -
      `"same-origin"`
      - -
      Use Credentials
      -
      `"include"`
      -
      - 2. Fetch a module script tree given url, - credentials mode, cryptographic nonce, - parser state, "`script`", and settings. -
      When the chosen algorithm asynchronously completes, set the script's script to the result. At that time, the script is ready. - For performance reasons, user agents may start fetching the classic script or module tree + For performance reasons, user agents may start fetching the classic script (as defined above) as the <{script/src}> attribute is set, instead, in the hope that the element will be inserted into the document (and that the <{script/crossorigin}> attribute won't change value in the meantime). Either way, once @@ -559,24 +464,11 @@ o............A....e 2. Set the script's script to script. 3. The script is ready. - -
      `"module"`
      -
      - 1. Let base URL be the <{script}> element's node document's - document base URL. - 2. Let script be the result of creating a module script using - source text, settings, base URL, and - CORS setting. - 3. If this returns null, set the script's script to null and abort these - substeps; the script is ready. - 4. Fetch the descendants of script. When this asynchronously - completes, set the script's script to the result. At that time, - the script is ready. -
      20. Then, follow the first of the following options that describes the situation:
      +
      "true"; "false"
      contextmenu<{global/contextmenu}> HTML elements The element's context menu ID*Name of parameter Text
      nonce<{script}>; <{style}>Cryptographic nonce used in Content Security Policy checks [[CSP3]]Text
      <{form/novalidate}> <{form}>{{HTMLScriptElement}}
      varies* globals; <{style/media}>; + <{style/nonce}>; <{style/type}>; <{style/scoped}> {{HTMLStyleElement}}
      @@ -595,15 +487,9 @@ o............A....e - -
      no element flagged as "parser-inserted"
      `"module"` - yes or no - n/a - no - element flagged as "parser-inserted" -
      +
      Add the element to the end of the list of scripts that will execute when the document has finished parsing associated with the {{Document}} of the parser that @@ -661,13 +547,6 @@ o............A....e no "non-blocking" flag not set on element - - `"module"` - yes or no - n/a - no - "non-blocking" flag not set on element - @@ -710,13 +589,6 @@ o............A....e yes or no n/a - - `"module"` - yes or no - n/a - yes or no - n/a - @@ -740,7 +612,7 @@ o............A....e - `"classic"` or `"module"` + `"classic"` no yes or no yes or no @@ -785,7 +657,7 @@ o............A....e is not the {{Document}} of the parser that created the element, then abort these steps. 2. If the script's script is null, fire a simple event named `error` at the element, and abort these steps. - 3. If the script is from an external file, or the script's type is "`module`", then + 3. If the script is from an external file, then increment the ignore-destructive-writes counter of the <{script}> element's node document. Let neutralized doc be that {{Document}}. 4. Let old script element be the value to which the <{script}> element's @@ -803,12 +675,6 @@ o............A....e 2. Run the classic script given by the script's script.
      -
      `"module"`
      -
      - 1. Set the <{script}> element's node document's {{Document/currentScript}} - attribute to null. - 2. Run the module script given by the script's script. -
      6. Set the <{script}> element's node document's {{Document/currentScript}} object to old script element. 7. Decrement the ignore-destructive-writes counter of neutralized doc, if it was diff --git a/sections/webappapis.include b/sections/webappapis.include index 53dd86d92b..a9e910424d 100644 --- a/sections/webappapis.include +++ b/sections/webappapis.include @@ -69,25 +69,6 @@ :: A flag which, if set, means that error information will not be provided for errors in this script (used to mute errors for cross-origin scripts, since that can leak private information). - A module script additionally has: - - : A module record - :: A Source Text Module Record representing the parsed module, ready to be evaluated. - - : A base URL - :: A base URL used for resolving module specifiers when resolving a module specifier. This - will either be the URL from which the script was obtained, for external module scripts, or the - document base URL of the containing document, for inline module scripts. - - : A credentials mode - :: A credentials mode used to fetch imported modules. - - : A cryptographic nonce - :: A cryptographic nonce used to fetch imported modules. - - : A parser state - :: The parser metadata used to fetch imported modules. -
      An environment settings object specifies algorithms for obtaining the following: @@ -95,13 +76,10 @@ : A realm execution context :: A JavaScript execution context shared by all <{script}> elements that use this settings object, i.e. all scripts in a given JavaScript realm. When we run a classic - script or run a module script, this execution context becomes the top of the + script this execution context becomes the top of the JavaScript execution context stack, on top of which another execution context specific - to the script in question is pushed. (This setup ensures ParseScript and - ModuleEvaluation know which Realm to use.) - - : A module map - :: Used when importing JavaScript modules. + to the script in question is pushed. (This setup ensures ParseScript + knows which Realm to use.) : A responsible browsing context :: A browsing context that is assigned responsibility for actions taken by the scripts that @@ -239,129 +217,6 @@ text and settings object. 9. Asynchronously complete this algorithm with script. - To fetch a module script tree - given a url, a credentials mode, a - cryptographic nonce, a parser state, a destination, a - fetch client settings object, and an optional ancestor list, run these - steps. The algorithm will asynchronously complete with either null (on failure) or a new - module script (on success). - - 1. If ancestor list is not given, let it be an empty list. - 2. If module map settings object is not given, let it be fetch client settings - object. - 3. Fetch a single module script given url, credentials mode, - cryptographic nonce, parser state, destination, and - module map settings object. If the caller of this algorithm specified custom - set up the request or process the response steps, pass those along while - fetching a single module script. - 4. Return from this algorithm and run the following steps when fetching a single module - script asynchronously completes with result: - 5. If result is null, asynchronously complete this algorithm with null and abort these - steps. - 6. Otherwise, result is a module script. Fetch the descendants of - result given destination and an ancestor list obtained by appending - url to ancestor list. - 7. When fetching the descendants of a module script asynchronously completes with - descendants result, asynchronously complete this algorithm with descendants - result. - -
      - - The following algorithms are used when fetching a module script tree, and are not meant to - be used directly by other specifications (or by other parts of this specification). - - To fetch the descendants of a module script - module script, given a - destination and an ancestor list, run these steps. The algorithm will - asynchronously complete with either null (on failure) or with module script - (on success). - - 1. Let record be module script's module record. - 2. If record.\[[RequestedModules]] is empty, asynchronously complete this algorithm - with module script. - 3. Let urls be a new empty list. - 4. For each string requested of record.\[[RequestedModules]]: - 1. Let url be the result of resolving a module specifier given - module script and requested. - 2. If the result is error: - 1. Let error be a new {{TypeError}} exception. - 2. Report the exception error for module script. - 3. Abort this algorithm, and asynchronously complete it with null. - 3. Otherwise, if url is not in ancestor list, add url to - urls. - 5. For each url in urls, fetch a module script tree given - url, module script's credentials mode, - module script's cryptographic nonce, module script's - parser state, destination, module script's - settings object, and ancestor list. - -

      It is intentional that no custom set up the request or process the - response steps are passed along here. Those hooks only apply to the top-level fetch at - the root of the module script tree.

      - - If any of the fetch a module script tree invocations asynchronously complete with - null, the user agent may terminate any or all of the other fetches, and must then - asynchronously complete this algorithm with null. - - Once all of the fetch a module script tree invocations asynchronously complete with a - module script, asynchronously complete this algorithm with module script. - - To fetch a single module script, - given a url, a - credentials mode, a cryptographic nonce, a parser state, - a destination, and a settings object, run these steps. The algorithm will - asynchronously complete with either null (on failure) or a module script (on success). - - 1. Let module map be settings object's module map. - 2. If module map contains an entry with key url whose value is - "fetching", wait (in parallel) until that entry's value changes, then - proceed to the next step. - 3. If module map contains an entry with key url, asynchronously complete - this algorithm with that entry's value, and abort these steps. - 4. Create an entry in module map with key url and value - "fetching". - 5. Let request be a new request whose url is - url, destination is destination, type is - "script", mode is "cors", - credentials mode is credentials mode, cryptographic nonce metadata - is cryptographic nonce, parser metadata is parser state and - client is settings object. - 6. If the caller specified custom steps to set up the request, perform them on - request. - 7. Fetch request. - 8. Return from this algorithm, and run the remaining steps as part of the fetch's - process response for the response response. - -

      response is always CORS-same-origin.

      - 9. If any of the following conditions are met, set the value of the entry in - module map whose key is url to null, asynchronously complete this - algorithm with null, and abort these steps: - - * response's type is "error" - * response's status is not an ok status - * The result of extracting a MIME type from response's - header list (ignoring parameters) is not a - JavaScript MIME type. - -

      For historical reasons, fetching a classic script does not include - MIME type checking. In contrast, module scripts will fail to load if they are not of a - correct MIME type.

      - * The caller specified custom steps to process the response, which when performed on - response return false. - 10. Let source text be the result of UTF-8 decoding response's - body. - 11. Let module script be the result of creating a module script given - source text, settings object, response's - url, credentials mode, and cryptographic nonce. - 12. Set the value of the entry in module map whose key is url to - module script, and asynchronously complete this algorithm with - module script. - -

      It is intentional that the module map is keyed by the - request URL, whereas the base URL for the module script is set to the - response URL. The former is used to deduplicate fetches, while the latter is used for - URL resolution. -

      Creating scripts
      To create a classic script, @@ -379,30 +234,6 @@ flag. 5. Return script. -To create a module script, -given some script source, an environment settings object, a script base URL, -a credentials mode, a cryptographic nonce, and a parser state: - - 1. Let script be a new module script that this algorithm will subsequently - initialise. - 2. Set script's settings object to the environment settings object - provided. - 3. Let realm be the provided environment settings object's Realm. - 4. If scripting is disabled for the given environment settings object's - responsible browsing context, then let script source be the empty string. - Otherwise, let script source be the provided script source. - 5. Let result be ParseModule(script source, realm, - script). - 6. If result is a List of errors, report the exception given - by the first element of result for script, return null, and abort these - steps. - 7. Set script's module record to result. - 8. Set script's base URL to the script base URL provided. - 9. Set script's credentials mode to the credentials mode provided. - 10. Set script's cryptographic nonce to the cryptographic nonce provided. - 11. Set script's parser state to the parser state. - 12. Return script. -
      Calling scripts
      To run a classic script @@ -438,29 +269,6 @@ a credentials mode, a cryptographic nonce, and a parser state: because an error occurred during parsing, or an exception occurred during evaluation, or because it was aborted prematurely. - To run a module script given a - module script s: - - 1. Let settings be the settings object of s. - 2. Check if we can run script with settings. If this returns "do not run" then - abort these steps. - 3. Let record be s's module record. - 4. Let instantiationStatus be - record.ModuleDeclarationInstantiation(). - -

      This step will recursively instantiate all of the module's dependencies.

      - 5. If instantiationStatus is an abrupt completion, report the exception given by - instantiationStatus.\[[Value]] for s and abort these steps. - 6. Prepare to run script given settings. - 7. Let evaluationStatus be record.ModuleEvaluation(). - -

      This step will recursively evaluate all of the module's dependencies.

      - 8. If evaluationStatus is an abrupt completion, report the exception given by - evaluationStatus.\[[Value]] for s. (Do not perform this step if - ScriptEvaluation fails to complete as a result of the user agent aborting the - running script.) - 9. Clean up after running script with settings. - The steps to check if we can run script with an environment settings object settings are as follows. They return either "run" or "do not run". @@ -499,7 +307,7 @@ a credentials mode, a cryptographic nonce, and a parser state: event listeners registered.

      - The running script is the script in the \[[HostDefined]] field in the ScriptOrModule + The running script is the script in the \[[HostDefined]] field in the Script component of the running JavaScript execution context. Each unit of related similar-origin browsing contexts has a global script @@ -694,11 +502,11 @@ a credentials mode, a cryptographic nonce, and a parser state: The incumbent settings object is determined as follows: - 1. Let scriptOrModule be the result of JavaScript's GetActiveScriptOrModule() + 1. Let script be the result of JavaScript's GetActiveScriptOrModule() abstract operation. - 2. If scriptOrModule is null, abort these steps; there is no incumbent settings + 2. If script is null, abort these steps; there is no incumbent settings object. - 3. Return the settings object of the <{script}> in scriptOrModule's + 3. Return the settings object of the <{script}> in script's \[[HostDefined]] field. Then, the incumbent Realm is the Realm of the incumbent settings object. @@ -750,7 +558,7 @@ a credentials mode, a cryptographic nonce, and a parser state: Although the JavaScript specification does not account for this possibility, it's sometimes necessary to abort a running script. - This causes any ScriptEvaluation or ModuleEvaluation to cease immediately, emptying + This causes any ScriptEvaluation to cease immediately, emptying the JavaScript execution context stack without triggering any of the normal mechanisms like finally blocks. [[ECMA-262]] @@ -826,56 +634,6 @@ a credentials mode, a cryptographic nonce, and a parser state: 5. If result is an abrupt completion, report the exception given by result.\[[Value]]. -
      Integration with the JavaScript module system
      - - The JavaScript specification defines a syntax for modules, as well as some host-agnostic parts of - their processing model. This specification defines the rest of their processing model: how the - module system is bootstrapped, via the <{script}> element with <{script/type}> attribute set to - "module", and how modules are fetched, resolved, and executed. [[ECMA-262]] - -

      Although the JavaScript specification speaks in terms of "scripts" versus - "modules", in general this specification speaks in terms of classic scripts versus - module scripts, since both of them use the <{script}> element.

      - - A module map is a map of absolute URLs to values that are either a module - script, null, or a placeholder value "fetching". Module maps are used to - ensure that imported JavaScript modules are only fetched, parsed, and evaluated once per - {{Document}} or {{Worker}}. - - To resolve a module specifier - given a module script script and a string specifier, perform the - following steps. It will return either an absolute URL or failure. - - 1. Apply the URL parser to specifier. If the result is not failure, return the - result. - 2. If specifier does not start with the character U+002F SOLIDUS (/), the two-character - sequence U+002E FULL STOP, U+002F SOLIDUS (./), or the three-character sequence - U+002E FULL STOP, U+002E FULL STOP, U+002F SOLIDUS (../), return failure and abort these - steps. - -

      This restriction is in place so that in the future we can allow custom module - loaders to give special meaning to "bare" import specifiers, like import "jquery" - or import "web/crypto". For now any such imports will fail, instead of being - treated as relative URLs.

      - 3. Return the result of applying the URL parser to specifier with - script's base URL as the base URL. - -
      HostResolveImportedModule(referencingModule, specifier)
      - - JavaScript contains an implementation-defined HostResolveImportedModule abstract operation. - User agents must use the following implementation: [[ECMA-262]] - - 1. Let referencing module script be referencingModule.\[[HostDefined]]. - 2. Let module map be referencing module script's settings object's - module map. - 3. Let url be the result of resolving a module specifier given referencing - module script and specifier. If the result is failure, throw a {{TypeError}} - exception and abort these steps. - 4. Let resolved module script be the value of the entry in module map whose - key is url. If no such entry exists, or if the value is null or - "fetching", throw a {{TypeError}} exception and abort these steps. - 5. Return resolved module script's module record. -
      Runtime script errors
      When the user agent is required to From 9a01e131297c0787b1cdf133f32b77161648873e Mon Sep 17 00:00:00 2001 From: Travis Leithead Date: Mon, 16 May 2016 08:00:53 -0700 Subject: [PATCH 18/19] tables in DTs don't render nicely; also fixed backtick use in a few places --- sections/semantics-scriptings.include | 271 +++++++++++++------------- 1 file changed, 134 insertions(+), 137 deletions(-) diff --git a/sections/semantics-scriptings.include b/sections/semantics-scriptings.include index a6b8bada21..f87e6b3ff0 100644 --- a/sections/semantics-scriptings.include +++ b/sections/semantics-scriptings.include @@ -120,7 +120,7 @@ If the attribute is set, its value must be an ASCII case-insensitive match for one of the labels of an encoding, and must specify the same - encoding as the `charset` parameter of the Content-Type metadata of the external + encoding as the charset parameter of the Content-Type metadata of the external file, if any. [[!ENCODING]] The async and @@ -295,7 +295,7 @@ o............A....e elements that are also "parser-inserted", to let the parser know when to execute the script. - The fifth is the script's type, which is "`classic`". It is + The fifth is the script's type, which is "classic". It is determined when the script is prepared, based on the <{script/type}> attribute of the element at that time. Initially, <{script}> elements must have this flag unset. @@ -372,7 +372,7 @@ o............A....e Determine the script's type as follows: * If the script block's type string is an ASCII case-insensitive match for - any JavaScript MIME type, the script's type is "`classic`". + any JavaScript MIME type, the script's type is "classic". * If neither of the above conditions are true, then abort these steps at this point. No script is executed. 7. If was-parser-inserted is true, then flag the element as "parser-inserted" @@ -391,19 +391,19 @@ o............A....e using the {{DOMImplementation/createDocument()}} API. [[!XHR]] [[!DOMPARSING]] [[!DOM]]

      11. If the <{script}> element does not have a <{script/src}> content attribute, and the Should element's inline behavior be blocked by Content Security Policy? algorithm - returns "`Blocked`" when executed upon the <{script}> element, "`script`", and the <{script}> + returns "Blocked" when executed upon the <{script}> element, "script", and the <{script}> element's child text content, then abort these steps. The script is not executed. [[CSP3]] 12. If the <{script}> element has an <{script/event}> attribute and a <{script/for}> attribute, - and the script's type is "`classic`", then run these substeps: + and the script's type is "classic", then run these substeps: 1. Let for be the value of the <{script/for}> attribute. 2. Let event be the value of the <{script/event}> attribute. 3. Strip leading and trailing whitespace from event and for. - 4. If for is not an ASCII case-insensitive match for the string "`window`", + 4. If for is not an ASCII case-insensitive match for the string "window", then the user agent must abort these steps at this point. The script is not executed. 5. If event is not an ASCII case-insensitive match for either the string - "`onload`" or the string "`onload()`", then the user agent must abort these steps at this + "onload" or the string "`onload()`", then the user agent must abort these steps at this point. The script is not executed. 13. If the <{script}> element has a <{script/charset}> attribute, then let encoding be the result of getting an encoding from the value of the <{script/charset}> attribute. @@ -417,7 +417,7 @@ o............A....e cryptographic nonce be that attribute's value. Otherwise, let cryptographic nonce be the empty string. - 16. Let parser state be "`parser-inserted`" if the <{script}> element has been flagged + 16. Let parser state be "parser-inserted" if the <{script}> element has been flagged as "parser-inserted", and "`not parser-inserted`" otherwise. 17. Let settings be the element's node document's {{Window}} object's environment settings object. @@ -467,60 +467,58 @@ o............A....e 20. Then, follow the first of the following options that describes the situation:
      -
      -
      - - - - - - - - - -
      the script's type - <{script/src}> present? - <{script/defer}> present? - <{script/async}> present? - other conditions -
      `"classic"` - yes - yes - no - element flagged as "parser-inserted" -
      -
      -
      -
      Add the element to the end of the list of scripts that will execute when the +
      +
      + + + + + + + + + +
      the script's type + <{script/src}> present? + <{script/defer}> present? + <{script/async}> present? + other conditions +
      `"classic"` + yes + yes + no + element flagged as "parser-inserted" +
      + Add the element to the end of the list of scripts that will execute when the document has finished parsing associated with the {{Document}} of the parser that created the element. When the the script is ready, set the element's "ready to be parser-executed" flag. The parser will handle executing the script.
      -
      - - - - - - - - - -
      the script's type - <{script/src}> present? - <{script/defer}> present? - <{script/async}> present? - other conditions -
      `"classic"` - yes - no - no - element flagged as "parser-inserted" -
      -
      -
      The element is the pending parsing-blocking script of the {{Document}} of the +
      +
      + + + + + + + + + +
      the script's type + <{script/src}> present? + <{script/defer}> present? + <{script/async}> present? + other conditions +
      `"classic"` + yes + no + no + element flagged as "parser-inserted" +
      + The element is the pending parsing-blocking script of the {{Document}} of the parser that created the element. (There can only be one such script per {{Document}} at a time.) @@ -528,29 +526,29 @@ o............A....e flag. The parser will handle executing the script.
      -
      - - - - - - - - - -
      the script's type - <{script/src}> present? - <{script/defer}> present? - <{script/async}> present? - other conditions -
      `"classic"` - yes - yes or no - no - "non-blocking" flag not set on element -
      -
      -
      Add the element to the end of the list of scripts that will execute in order +
      +
      + + + + + + + + + +
      the script's type + <{script/src}> present? + <{script/defer}> present? + <{script/async}> present? + other conditions +
      `"classic"` + yes + yes or no + no + "non-blocking" flag not set on element +
      + Add the element to the end of the list of scripts that will execute in order as soon as possible associated with the node document of the <{script}> element at the time the prepare a script algorithm started. @@ -570,65 +568,64 @@ o............A....e
      -
      - - - - - - - - - -
      the script's type - <{script/src}> present? - <{script/defer}> present? - <{script/async}> present? - other conditions -
      `"classic"` - yes - yes or no - yes or no - n/a -
      -
      -
      The element must be added to the +
      +
      + + + + + + + + + +
      the script's type + <{script/src}> present? + <{script/defer}> present? + <{script/async}> present? + other conditions +
      `"classic"` + yes + yes or no + yes or no + n/a +
      + The element must be added to the set of scripts that will execute as soon as possible of the node document of the <{script}> element at the time the prepare a script algorithm started. When the script is ready, execute the script block and then remove the element from the set of scripts that will execute as soon as possible.
      -
      - - - - - - - - - -
      the script's type - <{script/src}> present? - <{script/defer}> present? - <{script/async}> present? - other conditions -
      `"classic"` - no - yes or no - yes or no - All of the following: - - * element flagged as "parser-inserted" - * an XML parser or an HTML parser whose - script nesting level is not greater than one created the <{script}> - * the {{Document}} of the XML parser or HTML parser that created - the <{script}> has a style sheet that is blocking scripts - -
      -
      -
      The element is the pending parsing-blocking script of the {{Document}} of the +
      +
      + + + + + + + + + +
      the script's type + <{script/src}> present? + <{script/defer}> present? + <{script/async}> present? + other conditions +
      `"classic"` + no + yes or no + yes or no + All of the following: + + * element flagged as "parser-inserted" + * an XML parser or an HTML parser whose + script nesting level is not greater than one created the <{script}> + * the {{Document}} of the XML parser or HTML parser that created + the <{script}> has a style sheet that is blocking scripts +
      + The element is the pending parsing-blocking script of the {{Document}} of the parser that created the element. (There can only be one such script per {{Document}} at a time.) @@ -655,7 +652,7 @@ o............A....e 1. If the element is flagged as "parser-inserted", but the element's node document is not the {{Document}} of the parser that created the element, then abort these steps. - 2. If the script's script is null, fire a simple event named `error` at the element, + 2. If the script's script is null, fire a simple event named error at the element, and abort these steps. 3. If the script is from an external file, then increment the ignore-destructive-writes counter of the <{script}> element's @@ -679,10 +676,10 @@ o............A....e old script element. 7. Decrement the ignore-destructive-writes counter of neutralized doc, if it was incremented in the earlier step. - 8. If the script's type is "`classic`" and the script is from an external file, - fire a simple event named `load` at the <{script}> element. + 8. If the script's type is "classic" and the script is from an external file, + fire a simple event named load at the <{script}> element. - Otherwise queue a task to fire a simple event named `load` at the <{script}> + Otherwise queue a task to fire a simple event named load at the <{script}> element.
      Scripting languages
      @@ -867,7 +864,7 @@ o............A....e If a <{script}> element's <{script/src}> attribute is specified, then the contents of the <{script}> element, if any, must be such that the value of the {{HTMLScriptElement/text}} IDL - attribute, which is derived from the element's contents, matches the `documentation` production in + attribute, which is derived from the element's contents, matches the documentation production in the following ABNF, the character set for which is Unicode. [[!ABNF]]
      
      From f38143c8c09f6b0fe204baa2a56523190f916395 Mon Sep 17 00:00:00 2001
      From: Travis Leithead 
      Date: Mon, 16 May 2016 13:05:04 -0700
      Subject: [PATCH 19/19] Fixes for @arronei's PR feedback
      
      ---
       images/asyncdefer.svg                 |  2 +-
       sections/browsers.include             | 56 +++++++++++++--------------
       sections/dom.include                  | 16 ++++----
       sections/editing.include              |  4 +-
       sections/semantics-scriptings.include |  6 +--
       sections/webappapis.include           | 24 ++++++------
       sections/xhtml.include                |  8 ++--
       7 files changed, 55 insertions(+), 61 deletions(-)
      
      diff --git a/images/asyncdefer.svg b/images/asyncdefer.svg
      index 3be33a2a6d..eb70aa28f6 100644
      --- a/images/asyncdefer.svg
      +++ b/images/asyncdefer.svg
      @@ -1,5 +1,5 @@
       
      -
      +