Support noreferrer for window.open()

Tests: ...

Fixes #4111.

source

@@ -78445,13 +78445,20 @@ dictionary <dfn>WindowPostMessageOptions</dfn> : <span>PostMessageOptions</span>
    <li><p>Let <var>tokenizedFeatures</var> be the result of <span
    data-x="concept-window-open-features-tokenize">tokenizing</span> <var>features</var>.</p></li>
 
-   <li><p>Let <var>noopener</var> be false.</p></li>
+   <li><p>Let <var>noopener</var> and <var>noreferrer</var> be false.</p></li>
 
    <li><p>If <var>tokenizedFeatures</var> <span data-x="map exists">contains</span> an entry with
    the key "<code data-x="">noopener</code>", then set <var>noopener</var> to the result of <span
    data-x="concept-window-open-features-parse-boolean">parsing
    <var>tokenizedFeatures["noopener"]</var> as a boolean feature</span>.</p></li>
 
+   <li><p>If <var>tokenizedFeatures</var> <span data-x="map exists">contains</span> an entry with
+   the key "<code data-x="">noreferrer</code>", then set <var>noreferrer</var> to the result of
+   <span data-x="concept-window-open-features-parse-boolean">parsing
+   <var>tokenizedFeatures["noreferrer"]</var> as a boolean feature</span>.</p></li>
+
+   <li><p>If <var>noreferrer</var> is true, then set <var>noopener</var> to true.</p></li>
+
    <li>
     <p>Let <var>target browsing context</var> and <var>new</var> be the result of applying <span>the
     rules for choosing a browsing context</span> given <var>target</var>, <var>source browsing
@@ -78471,24 +78478,31 @@ dictionary <dfn>WindowPostMessageOptions</dfn> : <span>PostMessageOptions</span>
    <var>target browsing context</var> given <var>tokenizedFeatures</var>. <ref
    spec="CSSOMVIEW"></p></li>
 
-   <li><p>Let <var>resource</var> be the <span>URL</span> "<code>about:blank</code>".</p></li>
+   <li><p>Let <var>urlRecord</var> be the <span>URL</span> "<code>about:blank</code>".</p></li>
 
    <li>
     <p>If <var>url</var> is not the empty string or <var>new</var> is true, then:
 
     <ol>
      <li><p>If <var>url</var> is not the empty string, then <span data-x="parse a url">parse</span>
-     <var>url</var> relative to <var>entry settings</var>, and set <var>resource</var> to the
+     <var>url</var> relative to <var>entry settings</var>, and set <var>urlRecord</var> to the
      <span>resulting URL record</span>, if any. If the <span>parse a URL</span> algorithm failed,
      then throw a <span>"<code>SyntaxError</code>"</span> <code>DOMException</code>.</p></li>
 
-     <li><p>If <var>resource</var> is "<code>about:blank</code>" and <var>new</var> is true, then
+     <li><p>Let <var>request</var> be a new <span data-x="concept-request">request</span> whose
+     <span data-x="concept-request-url">URL</span> is <var>urlRecord</var>.</p></li>
+
+     <li><p>If <var>noreferrer</var> is true, then set <var>request</var>'s <span
+     data-x="concept-request-referrer">referrer</span> to "<code
+     data-x="">noreferrer</code>".</p></li>
+
+     <li><p>If <var>urlRecord</var> is "<code>about:blank</code>" and <var>new</var> is true, then
      <span>queue a task</span> to <span data-x="concept-event-fire">fire an event</span> named <code
      data-x="event-load">load</code> at <var>target browsing context</var>'s <code>Window</code>
      object, with the <var>legacy target override flag</var> set.</p>
 
      <li><p>Otherwise, <span>navigate</span><!--DONAV window.open()--> <var>target browsing
-     context</var> to <var>resource</var>, with the <var><span>exceptions enabled flag</span></var>
+     context</var> to <var>request</var>, with the <var><span>exceptions enabled flag</span></var>
      set. If <var>new</var> is true, then <span data-x="replacement enabled">replacement must be
      enabled</span>. The <span>source browsing context</span> is <var>source browsing context</var>.
      Rethrow any exceptions.</p></li>