From 0e6d3b51ba8f555a700301abff81085f31500fea Mon Sep 17 00:00:00 2001
From: Anne van Kesteren <annevk@annevk.nl>
Date: Fri, 22 Feb 2019 17:17:56 +0100
Subject: [PATCH] Introduce browsing context groups

The grouping concepts unit of related browsing contexts and unit of similar-origin browsing contexts were not accurate, due to browsing contexts being able to hold a sequence of (potentially cross-site) documents.

Fixes #4198.
---
 source | 171 ++++++++++++++++++++++++++++++++++++++++++++-------------
 1 file changed, 134 insertions(+), 37 deletions(-)

diff --git a/source b/source
index 681391c26f5..02bfd18e292 100644
--- a/source
+++ b/source
@@ -2637,6 +2637,7 @@ a.setAttribute('href', 'https://example.com/'); // change the content attribute
     <ul class="brief">
      <li><dfn data-x="concept-host" data-x-href="https://url.spec.whatwg.org/#concept-host">host</dfn></li>
      <li><dfn data-x-href="https://url.spec.whatwg.org/#host-public-suffix">public suffix</dfn></li>
+     <li><dfn data-x-href="https://url.spec.whatwg.org/#host-same-site">same site</dfn></li>
      <li><dfn data-x="concept-domain" data-x-href="https://url.spec.whatwg.org/#concept-domain">domain</dfn></li>
      <li><dfn data-x-href="https://url.spec.whatwg.org/#concept-ipv4">IPv4 address</dfn></li>
      <li><dfn data-x-href="https://url.spec.whatwg.org/#concept-ipv6">IPv6 address</dfn></li>
@@ -77202,7 +77203,10 @@ dictionary <dfn>DragEventInit</dfn> : <span>MouseEventInit</span> {
   context</dfn>:</p>
 
   <ol>
-   <li><p>Return the result of <span>creating a new browsing context</span> with null.</p></li>
+   <li><p>Let <var>group</var> be the result of <span>creating a new browsing context
+   group</span>.</p></li>
+
+   <li><p>Return <var>group</var>'s <span>browsing context set</span>[0].</p></li>
   </ol>
 
   <p class="note">This creates a <span>top-level browsing context</span>.</p>
@@ -77214,6 +77218,13 @@ dictionary <dfn>DragEventInit</dfn> : <span>MouseEventInit</span> {
    <li><p>Let <var>browsingContext</var> be the result of <span>creating a new browsing
    context</span> with <var>opener</var>'s <span>active document</span>.</p></li>
 
+   <li><p>Assert: <var>opener</var>'s <span>top-level browsing context</span>'s <span data-x="tlbc
+   group">group</span> is non-null, as <span data-x="navigate">navigating</span> invokes this
+   directly.</p></li>
+
+   <li><p><span data-x="bcg append">Append</span> <var>browsingContext</var> to <var>opener</var>'s
+   <span>top-level browsing context</span>'s <span data-x="tlbc group">group</span>.</p></li>
+
    <li><p>Set <var>browsingContext</var>'s <span>opener browsing context</span> to
    <var>opener</var>.</p></li>
 
@@ -77303,6 +77314,9 @@ dictionary <dfn>DragEventInit</dfn> : <span>MouseEventInit</span> {
   data-export="">top-level browsing context</dfn> for itself and all of the browsing contexts for
   which it is an <span>ancestor browsing context</span>.</p>
 
+  <p>A <span>top-level browsing context</span> has an associated <dfn data-x="tlbc
+  group">group</dfn> (null or a <span>browsing context group</span>). It is initially null.</p>
+
   <p>It is possible to create new browsing contexts that are related to a <span>top-level browsing
   context</span> without being nested through an element. Such browsing contexts are called <dfn
   data-x="auxiliary browsing context" data-lt="auxiliary browsing context" data-export="">auxiliary
@@ -77694,36 +77708,72 @@ console.assert(iframeWindow.frameElement === null);
 
   <h4>Groupings of browsing contexts</h4>
 
-  <p>Each <span>browsing context</span> is defined as having a list of one or more <dfn>directly
-  reachable browsing contexts</dfn>. These are:</p>
+  <p>A user agent holds a <dfn>browsing context group set</dfn> (a <span>set</span> of <span
+  data-x="browsing context group">browsing context groups</span>).</p>
 
-  <ul>
+  <p>A <dfn>browsing context group</dfn> holds a <dfn>browsing context set</dfn> (a <span>set</span>
+  of <span data-x="top-level browsing context">top-level browsing contexts</span>).</p>
+
+  <p>To <dfn data-x="creating a new browsing context group">create a new browsing context
+  group</dfn>, run these steps:</p>
 
-   <li>The <span>browsing context</span> itself.</li>
+  <ol>
+   <li><p>Let <var>group</var> be a new <span>browsing context group</span>.</p></li>
+
+   <li><p><span data-x="set append">Append</span> <var>group</var> to the user agent's
+   <span>browsing context group set</span>.</p></li>
 
-   <li>All the <span>browsing context</span>'s <span data-x="child browsing context">child browsing
-   contexts</span>.</li>
+   <li><p><span data-x="bcg append">Append</span> the result of <span>creating a new browsing
+   context</span> with null to <var>group</var>.</p></li>
 
-   <li>The <span>browsing context</span>'s <span>parent browsing context</span>.</li>
+   <li><p>Return <var>group</var>.</p></li>
+  </ol>
 
-   <li>All the <span data-x="browsing context">browsing contexts</span> that have the <span>browsing
-   context</span> as their <span>opener browsing context</span>.</li>
+  <p>To <dfn data-x="bcg append">append</dfn> a <span>top-level browsing context</span>
+  <var>browsingContext</var> to a <span>browsing context group</span> <var>group</var>, run these
+  steps:</p>
 
-   <li>The <span>browsing context</span>'s <span>opener browsing context</span>.</li>
+  <ol>
+   <li><p><span data-x="set append">Append</span> <var>browsingContext</var> to <var>group</var>'s
+   <span>browsing context set</span>.</p></li>
 
-  </ul>
+   <li><p>Set <var>browsingContext</var>'s <span data-x="tlbc group">group</span> to
+   <var>group</var>.</p></li>
+  </ol>
+
+  <p>To <dfn data-x="bcg remove">remove</dfn> a <span>top-level browsing context</span>
+  <var>browsingContext</var>, run these steps:</p>
+
+  <ol>
+   <li><p>Assert: <var>browsingContext</var>'s <span data-x="tlbc group">group</span> is non-null,
+   because a <span>browsing context</span> only gets <span data-x="a browsing context is
+   discarded">discarded</span> once.</p></li>
+
+   <li><p>Let <var>group</var> be <var>browsingContext</var>'s <span data-x="tlbc
+   group">group</span>.</p></li>
+
+   <li><p>Set <var>browsingContext</var>'s <span data-x="tlbc group">group</span> to null.</p></li>
 
-  <p>The transitive closure of all the <span data-x="browsing context">browsing contexts</span> that
-  are <span>directly reachable browsing contexts</span> forms a <dfn>unit of related browsing
-  contexts</dfn>.</p>
+   <li><p><span data-x="list remove">Remove</span> <var>browsingContext</var> from
+   <var>group</var>'s <span>browsing context set</span>.</p></li>
 
-  <p>Each <span>unit of related browsing contexts</span> is then further divided into the smallest
-  number of groups such that every member of each group has an <span>active document</span> with an
-  <span>origin</span> that, through appropriate manipulation of the <code
-  data-x="dom-document-domain">document.domain</code> attribute, could be made to be <span>same
-  origin-domain</span> with other members of the group, but could not be made the same as members of
-  any other group. Each such group is a <dfn data-export="">unit of related similar-origin browsing
-  contexts</dfn>.</p>
+   <li><p>If <var>group</var>'s <span>browsing context set</span> <span data-x="list is empty">is
+   empty</span>, then <span data-x="list remove">remove</span> <var>group</var> from the user
+   agent's <span>browsing context group set</span>.</p></li>
+  </ol>
+
+  <p class="note"><span data-x="bcg append">Append</span> and <span data-x="bcg
+  remove">remove</span> are primitive operations that help define the lifetime of a <span>browsing
+  context group</span>. They are called from <span>creating a new browsing context group</span>,
+  <span>creating a new auxiliary browsing context</span>, and <span data-x="a browsing context is
+  discarded">discarding a browsing context</span>.</p>
+
+  <hr>
+
+  <p class="note">The HTML Standard used to define "<span
+  id="unit-of-related-browsing-contexts">unit of related browsing contexts</span>" and "<span
+  id="unit-of-related-similar-origin-browsing-contexts">unit of related similar-origin browsing
+  contexts</span>". These have been removed as they were not adequate.</p>
 
   </div>
 
@@ -77919,7 +77969,7 @@ console.assert(iframeWindow.frameElement === null);
     most recently focused, or more closely related.</p>
 
     <p class="&#x0058;&#x0058;&#x0058;">This will be made more precise in <a
-    href="https://github.com/whatwg/html/issues/1440">issue #1440</a>.</p>
+    href="https://github.com/whatwg/html/issues/313">issue #313</a>.</p>
    </li>
 
    <li>
@@ -79007,9 +79057,7 @@ dictionary <dfn>WindowPostMessageOptions</dfn> : <span>PostMessageOptions</span>
   <h4>Garbage collection and browsing contexts</h4>
 
   <p>A <span>browsing context</span> has a strong reference to each of its <code>Document</code>
-  objects (due to its <span>session history</span>) and its <code>WindowProxy</code> object, and the
-  user agent itself has a strong reference to its <span data-x="top-level browsing
-  context">top-level browsing contexts</span>.</p>
+  objects (due to its <span>session history</span>) and its <code>WindowProxy</code> object.</p>
 
   <p>A <code>Document</code> has a strong reference to its <code>Window</code> object.</p>
 
@@ -79057,14 +79105,20 @@ dictionary <dfn>WindowPostMessageOptions</dfn> : <span>PostMessageOptions</span>
 
   </ol>
 
-  <p>When <dfn data-export="">a <em>browsing context</em> is discarded</dfn>, the strong reference
-  from the user agent itself to the <span>browsing context</span> must be severed, and all the
-  <code>Document</code> objects for all the entries in the <span>browsing context</span>'s session
-  history must be <span data-x="discard a document">discarded</span> as well.</p>
+  <p>To <dfn data-export="" data-x="a browsing context is discarded">discard</dfn> a <span>browsing
+  context</span> <var>browsingContext</var>, run these steps:</p>
+
+  <ol>
+   <li><p><span data-x="discard a document">Discard</span> all <code>Document</code> objects for all
+   the entries in <var>browsingContext</var>'s <span>session history</span>.</p></li>
+
+   <li><p>If <var>browsingContext</var> is a <span>top-level browsing context</span>, then
+   <span data-x="bcg remove">remove</span> <var>browsingContext</var>.</p></li>
+  </ol>
 
   <p>User agents may <span data-x="a browsing context is discarded">discard</span> <span
   data-x="top-level browsing context">top-level browsing contexts</span> at any time (typically, in
-  response to user requests, e.g. when a user force-closes a window containing one or more <span
+  response to user requests, e.g., when a user force-closes a window containing one or more <span
   data-x="top-level browsing context">top-level browsing contexts</span>). Other <span
   data-x="browsing context">browsing contexts</span> must be discarded once their
   <code>WindowProxy</code> object is eligible for garbage collection, in addition to the other
@@ -89045,7 +89099,52 @@ import "https://example.com/foo/../module2.mjs";</code></pre>
   <p class="note">Conceptually, the <span>agent</span> concept is an architecture-independent,
   idealized "thread" in which JavaScript code runs. Such code can involve multiple globals/<span
   data-x="concept-global-object-realm">realms</span> that can synchronously access each other, and
-  thus need to run in a single execution thread.</p>
+  thus needs to run in a single execution thread.</p>
+
+  <p>To determine whether a <code>Window</code> object <var>A</var> and a <code>Window</code> object
+  <var>B</var> are considered <dfn>same-agent <code>Window</code> objects</dfn>, run
+  these steps:</p>
+
+  <ol>
+   <li>
+    <p>If <var>A</var>'s <span>relevant settings object</span>'s <span>responsible browsing
+    context</span>'s <span>top-level browsing context</span>'s <span data-x="tlbc
+    group">group</span> is not <var>B</var>'s <span>relevant settings object</span>'s
+    <span>responsible browsing context</span>'s <span>top-level browsing context</span>'s <span
+    data-x="tlbc group">group</span>, then return false.</p>
+
+    <p class="&#x0058;&#x0058;&#x0058;">Unfortunately this model falls apart the moment a
+    <span>browsing context</span> is <span data-x="a browsing context is
+    discarded">discarded</span>. <a href="https://github.com/whatwg/html/issues/4361">Issue
+    #4361</a> sketches a setup that could improve this situation.</p>
+   </li>
+
+   <li><p>Let <var>originA</var> be <var>A</var>'s <span>relevant settings object</span>'s <span
+   data-x="concept-settings-object-origin">origin</span> and <var>originB</var> be <var>B</var>'s
+   <span>relevant settings object</span>'s <span
+   data-x="concept-settings-object-origin">origin</span>.</p></li>
+
+   <li><p>If <var>originA</var> is <span>same origin</span> with <var>originB</var>, then return
+   true.</p></li>
+
+   <li><p>If <var>originA</var> or <var>originB</var> is not a <span
+   data-x="concept-origin-tuple">tuple origin</span>, then return false.</p></li>
+
+   <li><p>If <var>originA</var>'s <span data-x="concept-origin-scheme">scheme</span> is not
+   <var>originB</var>'s <span data-x="concept-origin-scheme">scheme</span>, then return
+   false.</p></li>
+
+   <li><p>If <var>originA</var>'s <span data-x="concept-origin-host">host</span> is <span>same
+   site</span> with <var>originB</var>'s <span data-x="concept-origin-host">host</span>, then return
+   true.</p></li>
+
+   <li><p>Return false.</p></li>
+  </ol>
+
+  <p class="note">All <span>same-agent <code>Window</code> objects</span> together represent a group
+  of <code>Window</code> objects that can synchronously access each other, though sometimes only
+  after setting the <code data-x="dom-document-domain">document.domain</code> attribute
+  (in)appropriately.</p>
 
   <p>Until such a time that this standard has a better handle on lifetimes, it defines five types of
   <span data-x="agent">agents</span> that user agents must allocate at the appropriate time.</p>
@@ -89059,14 +89158,12 @@ import "https://example.com/foo/../module2.mjs";</code></pre>
    <dd>
     <p>An <span>agent</span> whose [[CanBlock]] is false and whose set of <span
     data-x="JavaScript realm">realms</span> consists of all <span
-    data-x="concept-global-object-realm">realms</span> of <code>Window</code> objects whose
-    <span>relevant settings object</span>'s <span>responsible browsing context</span> is in the same
-    <span>unit of related similar-origin browsing contexts</span>.</p>
+    data-x="concept-global-object-realm">realms</span> of all <span>same-agent <code>Window</code>
+    objects</span>.</p>
 
     <p class="note">Two <code>Window</code> objects that are <span>same origin</span> can be in
     different <span data-x="similar-origin window agent">similar-origin window agents</span>, for
-    instance if they are each in their own <span>unit of related similar-origin browsing
-    contexts</span>.</p>
+    instance if they are each in their own <span>browsing context group</span>.</p>
    </dd>
 
    <dt><dfn data-export="">Dedicated worker agent</dfn></dt>