Allow importScripts() only in the install event's listeners' context.

spec/service_worker/index.html

@@ -321,7 +321,7 @@ <h1><code>postMessage(<var>message</var>, <var>transfer</var>)</code></h1>
             <li>Else if <var>globalObject</var> is a <a href="https://html.spec.whatwg.org/multipage/browsers.html#window">Window</a> object, let the <a href="https://html.spec.whatwg.org/multipage/comms.html#dom-messageevent-source">source</a> attribute of <var>e</var> be initialized to a new <code><a href="#window-client-interface">WindowClient</a></code> object that represents <var>globalObject</var>'s <a href="https://html.spec.whatwg.org/multipage/browsers.html#browsing-context">browsing context</a>.</li>
             <li>Else, let it be initialized to a new <code><a href="#client-interface">Client</a></code> object that represents <var>globalObject</var>'s <a href="https://html.spec.whatwg.org/multipage/webappapis.html#worker-environment">worker environment</a>.</li>
             <li>Let the <a href="https://html.spec.whatwg.org/multipage/comms.html#dom-messageevent-ports">ports</a> attribute of <var>e</var> be initialized to <var>newPorts</var>.</li>
-            <li><a href="https://html.spec.whatwg.org/multipage/infrastructure.html#concept-event-dispatch">Dispatch</a> <var>e</var> at <var>destination</var>.</li>
+            <li><a href="https://dom.spec.whatwg.org/#concept-event-dispatch">Dispatch</a> <var>e</var> at <var>destination</var>.</li>
           </ol>
           <p>The <a href="https://html.spec.whatwg.org/multipage/webappapis.html#concept-task">task</a> <em class="rfc2119" title="MUST">must</em> use the <a href="https://html.spec.whatwg.org/multipage/webappapis.html#dom-manipulation-task-source">DOM manipulation task source</a>.</p>
         </li>
@@ -873,7 +873,7 @@ <h1><code>ServiceWorkerGlobalScope</code></h1>
 };
 </spec-idl>
 
-    <p>A <code><a href="#service-worker-global-scope-interface">ServiceWorkerGlobalScope</a></code> object represents the global execution context of a <a href="#dfn-service-worker">service worker</a>. A <code><a href="#service-worker-global-scope-interface">ServiceWorkerGlobalScope</a></code> object has an associated <dfn id="dfn-service-worker-global-scope-service-worker">service worker</dfn> (a <a href="#dfn-service-worker">service worker</a>).</p>
+    <p>A <code><a href="#service-worker-global-scope-interface">ServiceWorkerGlobalScope</a></code> object represents the global execution context of a <a href="#dfn-service-worker">service worker</a>. A <code><a href="#service-worker-global-scope-interface">ServiceWorkerGlobalScope</a></code> object has an associated <dfn id="dfn-service-worker-global-scope-service-worker">service worker</dfn> (a <a href="#dfn-service-worker">service worker</a>). A <code><a href="#service-worker-global-scope-interface">ServiceWorkerGlobalScope</a></code> object has an associated <dfn id="service-worker-global-scope-importscripts-allowed-flag">importscripts allowed flag</dfn>. It is initially unset.</p>
     <p class="note"><code><a href="#service-worker-global-scope-interface">ServiceWorkerGlobalScope</a></code> object provides generic, event-driven, time-limited script execution contexts that run at an origin. Once successfully <a href="#navigator-service-worker-register">registered</a>, a <a href="#dfn-service-worker">service worker</a> is started, kept alive and killed by their relationship to events, not <a href="#dfn-service-worker-client">service worker clients</a>. Any type of synchronous requests must not be initiated inside of a <a href="#dfn-service-worker">service worker</a>.</p>
 
     <p id="service-worker-global-scope-close-method" class="note">The <code><a href="http://www.w3.org/TR/workers/#dom-workerglobalscope-close">close()</a></code> method inherited from <code><a href="http://www.w3.org/TR/workers/#workerglobalscope">WorkerGlobalScope</a></code>, when called on the <a href="https://dom.spec.whatwg.org/#context-object">context object</a>, should <a href="http://heycam.github.io/webidl/#dfn-throw">throw</a> an "<code><a href="http://heycam.github.io/webidl/#invalidaccesserror">InvalidAccessError</a></code>" exception.</p>
@@ -1046,7 +1046,7 @@ <h1><code>postMessage(<var>message</var>, <var>transfer</var>)</code></h1>
             <li>Let the <a href="https://html.spec.whatwg.org/multipage/comms.html#dom-messageevent-origin">origin</a> attribute of <var>e</var> be initialized to the <a href="https://html.spec.whatwg.org/multipage/browsers.html#unicode-serialisation-of-an-origin">Unicode serialisation</a> of the <a href="https://html.spec.whatwg.org/multipage/browsers.html#origin-2">origin</a> specified by the <a href="https://html.spec.whatwg.org/multipage/webappapis.html#incumbent-settings-object">incumbent settings object</a>.</li>
             <li>Let the <a href="https://html.spec.whatwg.org/multipage/comms.html#dom-messageevent-source">source</a> attribute of <var>e</var> be initialized to a <code><a href="#service-worker-interface">ServiceWorker</a></code> object, setting its <a href="#dfn-service-worker-interface-client">service worker client</a> to <var>destination</var>'s <a href="#dfn-service-worker-container-interface-client">service worker client</a>, which represents the <a href="#dfn-service-worker-global-scope-service-worker">service worker</a> associated with the <a href="https://html.spec.whatwg.org/multipage/webappapis.html#global-object">global object</a> specified by the <a href="https://html.spec.whatwg.org/multipage/webappapis.html#incumbent-settings-object">incumbent settings object</a>.</li>
             <li>Let the <a href="https://html.spec.whatwg.org/multipage/comms.html#dom-messageevent-ports">ports</a> attribute of <var>e</var> be initialized to <var>newPorts</var>.</li>
-            <li><a href="https://html.spec.whatwg.org/multipage/infrastructure.html#concept-event-dispatch">Dispatch</a> <var>e</var> at <var>destination</var>.</li>
+            <li><a href="https://dom.spec.whatwg.org/#concept-event-dispatch">Dispatch</a> <var>e</var> at <var>destination</var>.</li>
           </ol>
           <p>The <a href="https://html.spec.whatwg.org/multipage/webappapis.html#concept-task">task</a> <em class="rfc2119" title="MUST">must</em> use the <a href="https://html.spec.whatwg.org/multipage/webappapis.html#dom-manipulation-task-source">DOM manipulation task source</a>, and, for those where the <a href="https://html.spec.whatwg.org/multipage/webappapis.html#event-loop">event loop</a> specified by the target <code><a href="#service-worker-container-interface">ServiceWorkerContainer</a></code> object's <a href="#dfn-service-worker-container-interface-client">service worker client</a> is a <a href="https://html.spec.whatwg.org/multipage/browsers.html#browsing-context">browsing context</a> <a href="https://html.spec.whatwg.org/multipage/webappapis.html#event-loop">event loop</a>, <em class="rfc2119" title="MUST">must</em> be associated with the <a href="https://html.spec.whatwg.org/multipage/webappapis.html#responsible-document">responsible document</a> specified by that target <code><a href="#service-worker-container-interface">ServiceWorkerContainer</a></code> object's <a href="#dfn-service-worker-container-interface-client">service worker client</a>.</p>
         </li>
@@ -2246,7 +2246,17 @@ <h1><code>importScripts(<var>urls</var>)</code></h1>
 
       <p class="fixme">The <a href="https://html.spec.whatwg.org/multipage/workers.html#dom-workerglobalscope-importscripts">importScripts(<var>urls</var>)</a> method is defined on the <a href="https://html.spec.whatwg.org/multipage/workers.html#workerglobalscope">WorkerGlobalScope</a> interface. The following algorithm steps monkey patch the method to embrace the <a href="#service-worker-environment">service worker environment</a>. The corresponding change request has been filed in HTML: <a href="https://www.w3.org/Bugs/Public/show_bug.cgi?id=28737">Issue 28737</a>.</p>
 
-      <p>When the <dfn id="importscripts-method"><code>importScripts(<var>urls</var>)</code></dfn> method is called on a <code><a href="#service-worker-global-scope-interface">ServiceWorkerGlobalScope</a></code> object, the following steps, or their <a href="#dfn-processing-equivalence">equivalent</a>, <em class="rfc2119" title="MUST">must</em> be run replacing the step 5 of <a href="https://html.spec.whatwg.org/multipage/workers.html#dom-workerglobalscope-importscripts">importScripts(<var>urls</var>)</a>:</p>
+      <p>When the <dfn id="importscripts-method"><code>importScripts(<var>urls</var>)</code></dfn> method is called on a <code><a href="#service-worker-global-scope-interface">ServiceWorkerGlobalScope</a></code> object, the following steps, or their <a href="#dfn-processing-equivalence">equivalent</a>, <em class="rfc2119" title="MUST">must</em> be run as follows.</p>
+
+      <p>The following steps, or their <a href="#dfn-processing-equivalence">equivalent</a>, <em class="rfc2119" title="MUST">must</em> be run preceded by the step 1 of <a href="https://html.spec.whatwg.org/multipage/workers.html#dom-workerglobalscope-importscripts">importScripts(<var>urls</var>)</a>:</p>
+
+      <spec-algorithm>
+      <ol>
+        <li>If the <a href="https://html.spec.whatwg.org/multipage/webappapis.html#incumbent-settings-object">incumbent settings object</a>'s <a href="https://html.spec.whatwg.org/multipage/webappapis.html#global-object">global object</a>'s <a href="#service-worker-global-scope-importscripts-allowed-flag">importscripts allowed flag</a> is unset, <a href="http://heycam.github.io/webidl/#dfn-throw">throw</a> an "<code><a href="http://heycam.github.io/webidl/#invalidstateerror">InvalidStateError</a></code>" exception and abort these steps.</li>
+      </ol>
+      </spec-algorithm>
+
+      <p>The following steps, or their <a href="#dfn-processing-equivalence">equivalent</a>, <em class="rfc2119" title="MUST">must</em> be run replacing the step 5 of <a href="https://html.spec.whatwg.org/multipage/workers.html#dom-workerglobalscope-importscripts">importScripts(<var>urls</var>)</a>:</p>
 
       <spec-algorithm>
       <ol>
@@ -2281,14 +2291,6 @@ <h1><code>importScripts(<var>urls</var>)</code></h1>
         </li>
       </ol>
       </spec-algorithm>
-
-      <p>The following step, or its <a href="#dfn-processing-equivalence">equivalent</a>, <em class="rfc2119" title="MUST">must</em> be run as the step 7 of <a href="https://html.spec.whatwg.org/multipage/workers.html#dom-workerglobalscope-importscripts">importScripts(<var>urls</var>)</a>:</p>
-
-      <spec-algorithm>
-      <ol>
-        <li>Set <var>serviceWorker</var>'s <a href="#dfn-imported-scripts-updated-flag">imported scripts updated flag</a> if all the attempts have succeeded without any error.</li>
-      </ol>
-      </spec-algorithm>
     </spec-section>
   </spec-section>
 
@@ -2672,7 +2674,7 @@ <h1>Install</h1>
       <li><a href="https://html.spec.whatwg.org/multipage/webappapis.html#queue-a-task">Queue a task</a> <var>task</var> to run the following substeps:
         <ol>
           <li>Create a <a href="https://html.spec.whatwg.org/#concept-events-trusted">trusted</a> event <var>e</var> that uses the <code><a href="#extendable-event-interface">ExtendableEvent</a></code> interface, with the event type <code><a href="#service-worker-global-scope-install-event">install</a></code>, which does not bubble, is not cancelable, and has no default action.</li>
-          <li><a href="https://html.spec.whatwg.org/multipage/infrastructure.html#concept-event-dispatch">Dispatch</a> <var>e</var> at <var>installingWorker</var>'s <a href="https://html.spec.whatwg.org/multipage/webappapis.html#environment-settings-object"> environment settings object</a>'s <a href="https://html.spec.whatwg.org/multipage/webappapis.html#global-object">global object</a>.</li>
+          <li><a href="https://dom.spec.whatwg.org/#concept-event-dispatch">Dispatch</a> <var>e</var> at <var>installingWorker</var>'s <a href="https://html.spec.whatwg.org/multipage/webappapis.html#environment-settings-object"> environment settings object</a>'s <a href="https://html.spec.whatwg.org/multipage/webappapis.html#global-object">global object</a> <var>globalObject</var>. During the execution of <a href="https://dom.spec.whatwg.org/#concept-event-dispatch">dispatch</a> algorithm, set <var>globalObject</var>'s <a href="#service-worker-global-scope-importscripts-allowed-flag">importscripts allowed flag</a> when <var>e</var>'s <a href="https://dom.spec.whatwg.org/#dispatch-flag">dispatch flag</a> is set, and unset <var>globalObject</var>'s <a href="#service-worker-global-scope-importscripts-allowed-flag">importscripts allowed flag</a> when <var>e</var>'s <a href="https://dom.spec.whatwg.org/#dispatch-flag">dispatch flag</a> is unset.</li>
           <li>Let <var>extendLifetimePromises</var> be an empty array.</li>
           <li>For each <a href="https://dom.spec.whatwg.org/#concept-event-listener">event listener</a> <a href="https://dom.spec.whatwg.org/#concept-event-listener-invoke">invoked</a>:
             <ol>
@@ -2739,6 +2741,7 @@ <h1>Install</h1>
           <li>Abort these steps.</li>
         </ol>
       </li>
+      <li>Set <var>registration</var>'s <a href="#dfn-installing-worker">installing worker</a>'s <a href="#dfn-imported-scripts-updated-flag">imported scripts updated flag</a>.</li>
       <li>If <var>registration</var>'s <a href="#dfn-waiting-worker">waiting worker</a> is not null, then:
         <ol>
           <li><a href="https://html.spec.whatwg.org/multipage/workers.html#terminate-a-worker">Terminate</a> <var>registration</var>'s <a href="#dfn-waiting-worker">waiting worker</a>.</li>
@@ -2846,7 +2849,7 @@ <h1>Activate</h1>
       <li><a href="https://html.spec.whatwg.org/multipage/webappapis.html#queue-a-task">Queue a task</a> <var>task</var> to run the following substeps:
         <ol>
           <li>Create a <a href="https://html.spec.whatwg.org/#concept-events-trusted">trusted</a> event <var>e</var> that uses the <code><a href="#extendable-event-interface">ExtendableEvent</a></code> interface, with the event type <code><a href="#service-worker-global-scope-activate-event">activate</a></code>, which does not bubble, is not cancelable, and has no default action.</li>
-          <li><a href="https://html.spec.whatwg.org/multipage/infrastructure.html#concept-event-dispatch">Dispatch</a> <var>e</var> at <var>activeWorker</var>'s <a href="https://html.spec.whatwg.org/multipage/webappapis.html#environment-settings-object"> environment settings object</a>'s <a href="https://html.spec.whatwg.org/multipage/webappapis.html#global-object">global object</a>.</li>
+          <li><a href="https://dom.spec.whatwg.org/#concept-event-dispatch">Dispatch</a> <var>e</var> at <var>activeWorker</var>'s <a href="https://html.spec.whatwg.org/multipage/webappapis.html#environment-settings-object"> environment settings object</a>'s <a href="https://html.spec.whatwg.org/multipage/webappapis.html#global-object">global object</a>.</li>
           <li>Let <var>extendLifetimePromises</var> be an empty array.</li>
           <li>For each <a href="https://dom.spec.whatwg.org/#concept-event-listener">event listener</a> <a href="https://dom.spec.whatwg.org/#concept-event-listener-invoke">invoked</a>:
             <ol>
@@ -2982,7 +2985,7 @@ <h1>Handle Fetch</h1>
           <li>Else, set <var>c</var> to a <code><a href="#client-interface">Client</a></code> object that represents <var>request</var>'s <a href="https://fetch.spec.whatwg.org/#concept-request-client">client</a>.</li>
           <li>Let the <a href="#fetch-event-client-attribute">client</a> attribute of <var>e</var> be initialized to <var>c</var>.</li>
           <li>Let the <a href="#fetch-event-isreload-attribute">isReload</a> attribute of <var>e</var> be initialized to <code>true</code> if <var>request</var>'s <a href="https://fetch.spec.whatwg.org/#concept-request-client">client</a> is a <a href="#dfn-window-client">window client</a> and the event was dispatched with the user's intention for the page reload, and <code>false</code> otherwise.</li>
-          <li><a href="https://html.spec.whatwg.org/multipage/infrastructure.html#concept-event-dispatch">Dispatch</a> <var>e</var> at <var>activeWorker</var>'s <a href="https://html.spec.whatwg.org/multipage/webappapis.html#environment-settings-object"> environment settings object</a>'s <a href="https://html.spec.whatwg.org/multipage/webappapis.html#global-object">global object</a>.</li>
+          <li><a href="https://dom.spec.whatwg.org/#concept-event-dispatch">Dispatch</a> <var>e</var> at <var>activeWorker</var>'s <a href="https://html.spec.whatwg.org/multipage/webappapis.html#environment-settings-object"> environment settings object</a>'s <a href="https://html.spec.whatwg.org/multipage/webappapis.html#global-object">global object</a>.</li>
           <li>For each <a href="https://dom.spec.whatwg.org/#concept-event-listener">event listener</a> <a href="https://dom.spec.whatwg.org/#concept-event-listener-invoke">invoked</a>:
             <ol>
               <li>If any uncaught runtime script error occurs, then: