HTML Standard Tracker

Filter

File a bug

SVNBugCommentTime (UTC)
2529[Conformance Checkers] [Gecko] [Internet Explorer] [Opera] [Webkit] [Google Gears] [Tools] MAJOR CHANGES: Revamp the way scripts are specified, along with their interaction with resolving relative URLs, etc. Give enough detail to justify objects in the DOM not being garbage collected randomly when still in use. Define script groups, to handle scripts going away during document.open() and session history navigation. Define why and how setTimeout(), database transactions, etc, handle page transitions. Drop the terms 'with' and 'without' script, use script is 'enabled'/'disabled' instead. Define 'unload' and 'beforeunload'. Rework how onfoo='' and .onfoo event handler attributes are defined. Rework how the content model of <noscript> is defined. Reword the way javascript: is defined to use the new terminology. Add a few notes of things that came up while I was doing all that.2008-12-12 08:46
@@ -421,21 +421,21 @@
   way a document is rendered to the user. These terms are not meant to
   imply a visual medium; they must be considered to apply to other
   media in equivalent ways.</p>
 
   <p>Some of the algorithms in this specification, for historical
   reasons, require the user agent to <dfn>pause</dfn> until some
   condition has been met. While a user agent is paused, it must ensure
   that no scripts execute (e.g. no event handlers, no timers,
   etc). User agents should remain responsive to user input while
   paused, however, albeit without letting the user interact with Web
-  pages where that would involve invoking any script.</p>
+  pages where that would involve invoking any <span title="concept-script">script</span>.</p>
 
 
   <h4>XML</h4>
 
   <p id="html-namespace">To ease migration from HTML to XHTML, UAs
   conforming to this specification will place elements in HTML in the
   <code>http://www.w3.org/1999/xhtml</code> namespace, at least for
   the purposes of the DOM and CSS. The term "<dfn>elements in the HTML
   namespace</dfn>", or "<dfn>HTML elements</dfn>" for short, when used
   in this specification, thus refers to both HTML and XHTML
@@ -3327,27 +3327,21 @@
 
   <p>This specification defines the term <span>URL</span>, and defines
   various algorithms for dealing with URLs, because for historical
   reasons the rules defined by the URI and IRI specifications are not
   a complete description of what HTML user agents need to implement to
   be compatible with Web content.</p>
 
 
   <h4>Terminology</h4>
 
-  <p>A <dfn>URL</dfn> is a string used to identify a resource. <span
-  id="urldoc">A <span>URL</span> is always associated with a
-  <code>Document</code>, either explicitly when the URL is created or
-  defined; or through a DOM node, in which case the associated
-  <code>Document</code> is the node's <code>Document</code>; or
-  through a script, in which case the associated <code>Document</code>
-  is the script's <span>script document context</span>.</span></p>
+  <p>A <dfn>URL</dfn> is a string used to identify a resource.</p>
 
   <p>A <span>URL</span> is a <dfn>valid URL</dfn> if at least one of
   the following conditions holds:</p>
 
   <ul>
 
    <li><p>The <span>URL</span> is a valid URI reference <a
    href="#refsRFC3986">[RFC3986]</a>.</p></li>
 
    <li><p>The <span>URL</span> is a valid IRI reference and it has no
@@ -3357,20 +3351,43 @@
    component contains no unescaped non-ASCII characters. <a
    href="#refsRFC3987">[RFC3987]</a></p></li>
 
    <li><p>The <span>URL</span> is a valid IRI reference and the <span
    title="document's character encoding">character encoding</span> of
    the URL's <code>Document</code> is UTF-8 or UTF-16. <a
    href="#refsRFC3987">[RFC3987]</a></p></li>
 
   </ul>
 
+  <p>A <span>URL</span> has an associated <dfn>URL character
+  encoding</dfn>, determined as follows:</p>
+
+  <dl class="switch">
+
+   <dt>If the URL came from a script (e.g. as an argument to a
+   method)</dt>
+
+   <dd>The URL character encoding is the <span>script's character
+   encoding</span>.</dd>
+
+   <dt>If the URL came from a DOM node (e.g. from an element)</dt>
+
+   <dd>The node has a <code>Document</code>, and the URL character
+   encoding is the <span>document's character encoding</span>.</dd>
+
+   <dt>If the URL had a character encoding defined when the URL was
+   created or defined</dt>
+
+   <dd>The URL character encoding is as defined.</dd>
+
+  </dl>
+
   <p class="note">The term "URL" in this specification is used in a
   manner distinct from the precise technical meaning it is given in
   RFC 3986. Readers familiar with that RFC will find it easier to read
   <em>this</em> specification if they pretend the term "URL" as used
   herein is really called something else altogether.</p>
 
 
   <h4>Parsing URLs</h4>
 
   <p>To <dfn>parse a URL</dfn> <var title="">url</var> into its
@@ -3515,22 +3532,21 @@
   <h4>Resolving URLs</h4>
 
   <p>Relative URLs are resolved relative to a base URL. The <dfn>base
   URL</dfn> of a <span>URL</span> is the <span>absolute URL</span>
   obtained as follows:</p>
 
   <dl class="switch">
 
    <dt>If the URL to be resolved was passed to an API</dt>
 
-   <dd><p>The base URL is the <span>document base URL</span> of the
-   script's <span>script document context</span>.</p></dd>
+   <dd><p>The base URL is the <span>script's base URL</span>.</p></dd>
 
    <dt>If the URL to be resolved is from the value of a content
    attribute</dt>
 
    <dd>
 
     <p>The base URL is the <i>base URI of the element</i> that the
     attribute is on, as defined by the XML Base specification, with
     <i>the base URI of the document entity</i> being defined as the
     <span>document base URL</span> of the <code>Document</code> that
@@ -3587,27 +3603,22 @@
 
   <p>To <dfn>resolve a URL</dfn> to an <span>absolute URL</span> the
   user agent must use the following steps. Resolving a URL can result
   in an error, in which case the URL is not resolvable.</p>
 
   <ol>
 
    <li><p>Let <var title="">url</var> be the <span>URL</span> being
    resolved.</p></li>
 
-   <li><p>Let <var title="">document</var> be the
-   <code>Document</code> <a href="#urldoc">associated with</a> <var
-   title="">url</var>.</p></li>
-
-   <li><p>Let <var title="">encoding</var> be the <span
-   title="document's character encoding">character encoding</span> of
-   <var title="">document</var>.</p></li>
+   <li><p>Let <var title="">encoding</var> be the <span>URL character
+   encoding</span>.</p></li>
 
    <li><p>If <var title="">encoding</var> is UTF-16, then change it to
    UTF-8.</p></li>
 
    <li><p>Let <var title="">base</var> be the <span>base URL</span>
    for <var title="">url</var>. (This is an <span>absolute
    URL</span>.)</p></li>
 
    <li><p><span title="parse a URL">Parse</span> <var
    title="">url</var> into its component parts.</p></li>
@@ -5602,65 +5613,92 @@ http://software.hixie.ch/utilities/js/live-dom-viewer/?%3C%21DOCTYPE%20html%3E..
    <li value="13"><dfn><code>INVALID_MODIFICATION_ERR</code></dfn></li>
    <li value="14"><dfn><code>NAMESPACE_ERR</code></dfn></li>
    <li value="15"><dfn><code>INVALID_ACCESS_ERR</code></dfn></li>
    <li value="16"><dfn><code>VALIDATION_ERR</code></dfn></li>
    <li value="17"><dfn><code>TYPE_MISMATCH_ERR</code></dfn></li>
    <li value="18"><dfn><code>SECURITY_ERR</code></dfn></li> <!-- actually in XHR for now -->
    <li value="19"><dfn><code>NETWORK_ERR</code></dfn></li> <!-- actually in XHR for now -->
    <li value="20"><dfn><code>ABORT_ERR</code></dfn></li> <!-- actually in XHR for now -->
    <li value="21"><dfn><code>URL_MISMATCH_ERR</code></dfn></li> <!-- actually in workers for now -->
    <li value="22"><dfn><code>QUOTA_EXCEEDED_ERR</code></dfn></li> <!-- actually defined right here for now -->
+   <li value="23"><dfn><code>UNAVAILABLE_SCRIPT_ERR</code></dfn></li> <!-- actually defined right here for now -->
    <li value="81"><dfn><code>PARSE_ERR</code></dfn></li> <!-- actually defined in dom3ls -->
    <li value="82"><dfn><code>SERIALISE_ERR</code></dfn></li> <!-- actually defined in dom3ls -->
   </ol>
 
 
+  <h4>Garbage collection</h4>
+
+  <p>There is an <dfn>implied strong reference</dfn> from any DOM
+  attribute that returns a pre-existing object to that object.</p>
+
+  <div class="example">
+
+   <p>For example, the <code>document.defaultView</code> attribute
+   means that there is a strong reference from a <code>Document</code>
+   object to its <code>Window</code> object. Similarly, there is
+   always a strong reference from a <code>Document</code> to any
+   descendant nodes, and from any node to its owner
+   <code>Document</code>.</p>
+
+  </div>
+
+
 
 
   <h2 id="dom">Semantics and structure of HTML documents</h2>
 
   <h3 id="semantics-intro">Introduction</h3>
 
   <p><em>This section is non-normative.</em></p>
 
   <p class="XXX">An introduction to marking up a document.</p>
 
 
   <h3>Documents</h3>
 
   <p>Every XML and HTML document in an HTML UA is represented by a
   <code>Document</code> object. <a
   href="#refsDOM3CORE">[DOM3CORE]</a></p>
 
   <p><dfn>The document's address</dfn> is an <span>absolute URL</span>
   that is set when the <code>Document</code> is created.</p>
 
-  <p>When a <code>Document</code> is created by a script using the
-  <code title="">createDocument()</code> API, <span>the document's
+  <p>When a <code>Document</code> is created by a <span
+  title="concept-script">script</span> using the <code
+  title="">createDocument()</code> API, <span>the document's
   address</span> is the same as <span>the document's address</span> of
-  the <span>script document context</span> of that script.</p>
+  the <span>active document</span> of the <span>script's browsing
+  context</span>.</p>
 
   <p><code>Document</code> objects are assumed to be <dfn>XML
   documents</dfn> unless they are flagged as being <dfn>HTML
   documents</dfn> when they are created. Whether a document is an
   <span title="HTML documents">HTML document</span> or an <span
   title="XML documents">XML document</span> affects the behavior of
   certain APIs, as well as a few CSS rendering rules. <a
   href="#refsCSS21">[CSS21]</a></p>
 
   <p class="note">A <code>Document</code> object created by the <code
   title="">createDocument()</code> API on the
   <code>DOMImplementation</code> object is initially an <span
   title="XML documents">XML document</span>, but can be made into an
   <span title="HTML documents">HTML document</span> by calling <code
   title="dom-document-open">document.open()</code> on it.</p>
 
+  <p>When a <code>Document</code> is first created, a new <span>script
+  group</span> must be created. This is the <code>Document</code>'s
+  <dfn>current script group</dfn> until the script group is changed
+  (which can happen if <code
+  title="dom-document-open">document.open()</code> is invoked on the
+  <code>Document</code>).</p>
+
 
 
   <h4>Documents in the DOM</h4>
 
   <p>All <code>Document</code> objects (in user agents implementing
   this specification) must also implement the
   <code>HTMLDocument</code> interface, available using
   binding-specific methods. (This is the case whether or not the
   document in question is an <span title="HTML documents">HTML
   document</span> or indeed whether it contains any <span>HTML
@@ -7443,22 +7481,22 @@ http://software.hixie.ch/utilities/js/live-dom-viewer/?%3C%21DOCTYPE%20HTML%3E%0
 
   </dl>
 
 
   <h3><dfn>Dynamic markup insertion</dfn></h3>
 
   <p>APIs for dynamically inserting markup into the document interact
   with the parser, and thus their behavior varies depending on whether
   they are used with <span>HTML documents</span> (and the <span>HTML
   parser</span>) or XHTML in <span>XML documents</span> (and the
-  <span>XML parser</span>). The following table cross-references the
-  various versions of these APIs.</p>
+  <span>XML parser</span><!-- XXX xref -->). The following table
+  cross-references the various versions of these APIs.</p>
 
   <table>
    <thead>
     <tr>
      <td></td>
      <th>For documents that are <span>HTML documents</span></th>
      <th>For documents that are <span>XML documents</span></th>
     </tr>
    </thead>
    <tbody>
@@ -7543,39 +7581,55 @@ http://software.hixie.ch/utilities/js/live-dom-viewer/?%3C%21DOCTYPE%20HTML%3E%0
 
     <p class="note">This basically causes <code
     title="dom-document-open">document.open()</code> to be ignored
     when it's called in an inline script found during the parsing of
     data sent over the network, while still letting it have an effect
     when called asynchronously or on a document that is itself being
     spoon-fed using these APIs.</p>
 
    </li>
 
-   <li><p class="XXX">onbeforeunload, onunload, reset timers, empty event queue, kill any pending transactions, XMLHttpRequests, etc</p></li>
-   <!-- http://software.hixie.ch/utilities/js/live-dom-viewer/?%3C!DOCTYPE%20html%3E...%3Ciframe%20src%3D%22document%22%3E%3C%2Fiframe%3E%0A%3Cscript%3Eonload%20%3D%20function%20()%20{%20f%20%3D%20document.getElementsByTagName(%27iframe%27)[0]%3B%20d%20%3D%20f.contentDocument%3B%20}%3C%2Fscript%3E%0A%3Cinput%20type%3Dbutton%20onclick%3D%22w(d.documentElement.innerHTML)%22%20value%3D%22dump%22%3E%0A%3Cinput%20type%3Dbutton%20onclick%3D%22d.body.bgColor%3D%27red%27%22%20value%3D%22color%22%3E%0A%3Cinput%20type%3Dbutton%20onclick%3D%22f.style.border%3D%27lime%20solid%27%22%20value%3D%22color%20frame%22%3E%0A%3Cinput%20type%3Dbutton%20onclick%3D%22d.open()%3B%20d.write(%27%3Cp%3Etest%3C%2Fp%3E%27)%3B%20d.close()%22%20value%3D%22replace%22%3E%0A%3Cinput%20type%3Dbutton%20onclick%3D%22d.open()%3B%20d.write(%27%3Cp%3E%3Cscript%3Ei%20%3D%200%3B%20setInterval(%26quot%3Bparent.w(i%2B%2B)%26quot%3B%2C%20500)%3C%2Fscript%3E%3C%2Fp%3E%27)%3B%20d.close()%22%20value%3D%22replace%20with%20timer%22%3E%0A -->
+   <li><p><span title="unload a document">Unload</span> the
+   <code>Document</code> object, with the <var title="">recycle</var>
+   parameter set to true. If the user <span>refused to allow the
+   document to be unloaded</span>, then these steps must be
+   aborted.</p></li>
 
    <li><p>If the document has an <span>active parser</span><!--XXX
    xref-->, then stop that parser, and throw away any pending content
    in the input stream. <span class="XXX">what about if it
    doesn't, because it's either like a text/plain, or Atom, or PDF, or
    XHTML, or image document, or something?</span></p></li><!-- XXX see
    also innerHTML in HTML -->
 
+   <li><p>Freeze the document's <span>current script
+   group</span>.</p></li>
+
+   <li><p>Unregister all event listeners registered on the
+   <code>Document</code> node and its descendants.</p>
+
    <li><p>Remove all child nodes of the document, without firing any
    mutation events.</p></li>
 
+   <li><p>Create a new <span>script group</span> and let the
+   document's <span>current script group</span> be that new
+   group. (The old script group is now permanently frozen.)</p></li>
+
+   <!-- http://software.hixie.ch/utilities/js/live-dom-viewer/?%3C!DOCTYPE%20html%3E...%3Ciframe%20src%3D%22document%22%3E%3C%2Fiframe%3E%0A%3Cscript%3Eonload%20%3D%20function%20()%20%7B%20f%20%3D%20document.getElementsByTagName('iframe')%5B0%5D%3B%20d%20%3D%20f.contentWindow.document%3B%20%7D%3C%2Fscript%3E%0A%3Cinput%20type%3Dbutton%20onclick%3D%22w(d.documentElement.innerHTML)%22%20value%3D%22dump%22%3E%0A%3Cinput%20type%3Dbutton%20onclick%3D%22d.open()%3B%20d.write('%3Cscript%3Evar%20x%20%3D%20new%20XMLHttpRequest()%3Bx.open(%26quot%3BGET%26quot%3B%2C%20%26quot%3BGET%26quot%3B)%3Bx.onreadystatechange%3Dfunction()%20%7B%20alert(x.readyState)%3B%20%7D%3Bx.send(null)%3B%3C%2Fscript%3E')%3Bd.close()%3B%20setTimeout(function()%20%7B%20d.open()%3B%20d.write('%3Cp%3Etest%3C%2Fp%3E')%3B%20d.close()%20%7D%2C%200)%3B%22%20value%3D%22xhr%22%3E%0A%3Cinput%20type%3Dbutton%20onclick%3D%22d.onclick%20%3D%20function()%20%7B%20w('click')%20%7D%22%20value%3D%22add%20click%20handler%22%3E%0A%3Cinput%20type%3Dbutton%20onclick%3D%22d.open()%3B%20d.write('%3Cp%3Etest%3C%2Fp%3E')%3B%20d.close()%22%20value%3D%22replace%22%3E%0A%3Cinput%20type%3Dbutton%20onclick%3D%22d.open()%3B%20d.write('%3Cp%3E%3Cscript%3Ei%20%3D%200%3B%20setTimeout(%26quot%3Bparent.w(i%2B%2B)%26quot%3B%2C%202000)%3C%2Fscript%3E%3C%2Fp%3E')%3B%20d.close()%22%20value%3D%22replace%20with%20timer%22%3E -->
+
    <li><p>Change the <span>document's character encoding</span> to
    UTF-16.</p></li>
 
-   <li><p>Change <span>the document's address</span> to the <span
-   title="the document's address">address</span> of the <span>script
-   document context</span> of the script that invoked the <code
+   <li><p>Change <span>the document's address</span> to the <span>the
+   document's address</span> of the <span>active document</span> of
+   the <span title="script's browsing context">browsing context</span>
+   of the <span title="concept-script">script</span> that invoked the <code
    title="dom-document-open">document.open()</code> method.</p></li>
 
    <li><p>Create a new <span>HTML parser</span> and associate it with
    the document. This is a <dfn>script-created parser</dfn> (meaning
    that it can be closed by the <code
    title="dom-document-open">document.open()</code> and <code
    title="dom-document-close">document.close()</code> methods, and
    that the tokeniser will wait for an explicit call to <code
    title="dom-document-close">document.close()</code> before emitting
    an end-of-file token).</p></li>
@@ -7678,22 +7732,24 @@ http://software.hixie.ch/utilities/js/live-dom-viewer/?%3C%21DOCTYPE%20HTML%3E%0
   title="dom-document-write-HTML"><code>document.write(...)</code></dfn>
   method must act as follows:</p>
 
   <ol>
 
    <li>
 
     <p>If the <span>insertion point</span> is undefined, the <code
     title="dom-document-open">open()</code> method must be called
     (with no arguments) on the <code title="Document">document</code>
-    object. The <span>insertion point</span> will point at just before
-    the end of the (empty) <span>input stream</span>.</p>
+    object. If the user <span>refused to allow the document to be
+    unloaded</span>, then these steps must be aborted. Otherwise, the
+    <span>insertion point</span> will point at just before the end of
+    the (empty) <span>input stream</span>.</p>
 
    </li>
 
    <li>
 
     <p>The string consisting of the concatenation of all the arguments
     to the method must be inserted into the <span>input
     stream</span><!-- XXX xref --> just before the <span>insertion
     point</span>.</p>
 
@@ -8186,21 +8242,21 @@ http://software.hixie.ch/utilities/js/live-dom-viewer/?%3C%21DOCTYPE%20HTML%3E%0
 
   <p>On setting, in an XML context, the <code
   title="dom-innerHTML-XML">innerHTML</code> DOM attribute on
   <code>HTMLElement</code>s and <code>HTMLDocument</code>s must run
   the following algorithm:</p>
 
   <ol>
 
    <li>
 
-    <p>The user agent must create a new <span>XML parser</span>.</p>
+    <p>The user agent must create a new <span>XML parser</span><!-- XXX xref -->.</p>
 
    </li>
 
    <li>
 
     <p>If the <code title="dom-innerHTML-XML">innerHTML</code>
     attribute is being set on an element, the user agent must
     <span>feed the parser</span> just created the string corresponding
     to the start tag of that element, declaring all the namespace
     prefixes that are in scope on that element in the DOM, as well as
@@ -9786,27 +9842,27 @@ people expect to have work and what is necessary.
   metadata. The first is a flag indicating whether or not the script
   block has been <dfn>"already executed"</dfn>. Initially,
   <code>script</code> elements must have this flag unset (script
   blocks, when created, are not "already executed"). When a
   <code>script</code> element is cloned, the "already executed" flag,
   if set, must be propagated to the clone when it is created. The
   second is a flag indicating whether the element was
   <dfn>"parser-inserted"</dfn>. This flag is set by the <span>HTML
   parser</span> and is used to handle <code
   title="dom-document-write-HTML">document.write()</code> calls. The
-  third and fourth pieces of metadata are <dfn><var>the script's
-  type</var></dfn> and <dfn><var>the script's character
+  third and fourth pieces of metadata are <dfn><var>the script block's
+  type</var></dfn> and <dfn><var>the script block's character
   encoding</var></dfn>. They are determined when the script is run,
   based on the attributes on the element at that time.</p>
 
-  <p>When an <span>XML parser</span> creates a <code>script</code>
-  element, it must be marked as being
+  <p>When an <span>XML parser</span><!-- XXX xref --> creates a
+  <code>script</code> element, it must be marked as being
   <span>"parser-inserted"</span>. When the element's end tag is
   parsed, the user agent must <span title="running a
   script">run</span> the <code>script</code> element.</p>
 
   <p class="note">Equivalent requirements exist for the <span>HTML
   parser</span>, but they are detailed in that section instead.</p>
 
   <p>When a <code>script</code> element that is marked as neither
   having <span>"already executed"</span> nor being
   <span>"parser-inserted"</span> is <span title="insert an element
@@ -9834,67 +9890,69 @@ people expect to have work and what is necessary.
      title="attr-script-type">type</code> attribute but it has a <code
      title="attr-script-language">language</code> attribute and
      <em>that</em> attribute's value is the empty string, or</li>
 
      <li>the <code>script</code> element has neither a <code
      title="attr-script-type">type</code> attribute nor a <code
      title="attr-script-language">language</code> attribute, then</li>
 
     </ul>
 
-    <p>...let <var>the script's type</var> for this
+    <p>...let <var>the script block's type</var> for this
     <code>script</code> element be "<code
     title="">text/javascript</code>".</p>
 
     <p>Otherwise, if the <code>script</code> element has a <code
     title="attr-script-type">type</code> attribute, let <var>the
-    script's type</var> for this <code>script</code> element be the
-    value of that attribute.</p>
+    script block's type</var> for this <code>script</code> element be
+    the value of that attribute.</p>
 
     <p>Otherwise, the element has a <code
     title="attr-script-language">language</code> attribute; let
-    <var>the script's type</var> for this <code>script</code> element
-    be the concatenation of the string "<code title="">text/</code>"
-    followed by the value of the <code
-    title="attr-script-language">language</code> attribute.</p>
-    <!-- user agents already support, e.g., type="text/javascript1.3",
-    so we don't have to support that separately. -->
+    <var>the script block's type</var> for this <code>script</code>
+    element be the concatenation of the string "<code
+    title="">text/</code>" followed by the value of the <code
+    title="attr-script-language">language</code> attribute.</p> <!--
+    user agents already support, e.g., type="text/javascript1.3", so
+    we don't have to support that separately. -->
 
    </li>
 
    <li>
 
     <p>If the <code>script</code> element has a <code
     title="attr-script-charset">charset</code> attribute, then let
-    <var>the script's character encoding</var> for this
+    <var>the script block's character encoding</var> for this
     <code>script</code> element be the encoding given by the <code
     title="attr-script-charset">charset</code> attribute.</p>
 
-    <p>Otherwise, let <var>the script's character encoding</var> for
-    this <code>script</code> element be the same as <span
+    <p>Otherwise, let <var>the script block's character encoding</var>
+    for this <code>script</code> element be the same as <span
     title="document's character encoding">the encoding of the document
     itself</span>.</p>
 
    </li>
 
    <li>
 
-    <p>If the <code>script</code> element is <span>without
-    script</span>, or if the <code>script</code> element was created
-    by an <span>XML parser</span> that itself was created as part of
+    <p>If <span title="concept-n-noscript">scripting is
+    disabled</span> for the <code>script</code> element, or if the
+    <code>script</code> element was created by an <span>XML
+    parser</span><!-- XXX xref --> that itself was created as part of
     the processing of the <code
     title="dom-innerHTML-XML">innerHTML</code> attribute's setter<!--
     no need to worry about the HTML case, as the HTML parser handles
     that for us -->, or if the user agent does not <span>support the
-    scripting language</span> given by <var>the script's type</var>
-    for this <code>script</code> element, then the user agent must
-    abort these steps at this point. The script is not executed.</p>
+    scripting language</span> given by <var>the script block's
+    type</var> for this <code>script</code> element, then the user
+    agent must abort these steps at this point. The script is not
+    executed.</p>
 
    </li>
 
    <li>
 
     <p>The user agent must set the element's <span>"already
     executed"</span> flag.</p>
 
    </li>
 
@@ -9990,244 +10048,242 @@ people expect to have work and what is necessary.
      <dt>If the element has a <code title="attr-script-src">src</code>
      attribute</dt>
 
      <dd>The element must be added to the end of the <span>list of
      scripts that will execute as soon as possible</span>.</dd>
 
 
      <dt>Otherwise</dt>
 
      <dd>The user agent must immediately <span title="executing a
-     script block">execute the script</span>, even if other scripts
-     are already executing.</dd>
+     script block">execute the script block</span>, even if other
+     scripts are already executing.</dd>
 
     </dl>
 
    </li>
 
   </ol>
 
-  <p><dfn>When a script completes loading</dfn>: If the script's
-  element was added to one of the lists mentioned above and the
-  document is still being parsed, then the parser handles
-  it. Otherwise, the UA must run the following steps as the <span
-  title="concept-task">task</span> that the <span>networking task
-  source</span> places on the <span>task queue</span>:</p>
+  <p><dfn>When a script completes loading</dfn>: If the
+  <code>script</code> element was added to one of the lists mentioned
+  above and the document is still being parsed, then the parser
+  handles it. Otherwise, the UA must run the following steps as the
+  <span title="concept-task">task</span> that the <span>networking
+  task source</span> places on the <span>task queue</span>:</p>
 
   <dl class="switch">
 
-   <dt>If the script's element was added to the <dfn>list of scripts
-   that will execute when the document has finished parsing</dfn>:</dt>
+   <dt>If the <code>script</code> element was added to the <dfn>list
+   of scripts that will execute when the document has finished
+   parsing</dfn>:</dt>
 
    <dd>
 
     <ol>
 
      <li>
 
-      <p>If the script's element is not the first element in the list,
-      then do nothing yet. Stop going through these steps.</p>
+      <p>If the <code>script</code> element is not the first element
+      in the list, then do nothing yet. Stop going through these
+      steps.</p>
 
      </li>
 
      <li>
 
       <p>Otherwise, <span title="executing a script block">execute the
-      script</span> (that is, the script associated with the first
-      element in the list).</p>
+      script block</span> (the first element in the list).</p>
 
      </li>
 
      <li>
 
-      <p>Remove the script's element from the list (i.e. shift out the
-      first entry in the list).</p>
+      <p>Remove the <code>script</code> element from the list
+      (i.e. shift out the first entry in the list).</p>
 
      </li>
 
      <li>
 
       <p>If there are any more entries in the list, and if the script
       associated with the element that is now the first in the list is
       already loaded, then jump back to step two to execute it.</p>
 
      </li>
 
     </ol>
 
    </dd>
 
-   <dt>If the script's element was added to the <dfn>list of scripts
-   that will execute asynchronously</dfn>:</dt>
+   <dt>If the <code>script</code> element was added to the <dfn>list
+   of scripts that will execute asynchronously</dfn>:</dt>
 
    <dd>
 
     <ol>
 
      <li>
 
       <p>If the script is not the first element in the list, then do
       nothing yet. Stop going through these steps.</p>
 
      </li>
 
      <li>
 
-      <p><span title="executing a script block">Execute the
-      script</span> (the script associated with the first element in
-      the list).</p>
+      <p><span title="executing a script block">Execute the script
+      block</span> (the first element in the list).</p>
 
      </li>
 
      <li>
 
-      <p>Remove the script's element from the list (i.e. shift out the
-      first entry in the list).</p>
+      <p>Remove the <code>script</code> element from the list
+      (i.e. shift out the first entry in the list).</p>
 
      </li>
 
      <li>
 
       <p>If there are any more scripts in the list, and the element
       now at the head of the list had no <code
       title="attr-script-src">src</code> attribute when it was added
       to the list, or had one, but its associated script has finished
       loading, then jump back to step two to execute the script
       associated with this element.</p>
 
      </li>
 
     </ol>
 
    </dd>
 
-   <dt>If the script's element was added to the <dfn>list of scripts
-   that will execute as soon as possible</dfn>:</dt>
+   <dt>If the <code>script</code> element was added to the <dfn>list
+   of scripts that will execute as soon as possible</dfn>:</dt>
 
    <dd>
 
     <ol>
 
      <li>
 
       <p><span title="executing a script block">Execute the
-      script</span>.</p>
+      script block</span>.</p>
 
      </li>
 
      <li>
 
-      <p>Remove the script's element from the list.</p>
+      <p>Remove the <code>script</code> element from the list.</p>
 
      </li>
 
     </ol>
 
    </dd>
 
   </dl>
 
   <p>Fetching an external script must <span>delay the <code
   title="event-load">load</code> event</span>.</p>
 
   <p><dfn title="executing a script block">Executing a script
-  block</dfn>: When the steps above require that the script be
+  block</dfn>: When the steps above require that the script block be
   executed, the user agent must act as follows:</p>
 
   <dl class="switch">
 
    <dt>If the load resulted in an error (for example a DNS error, or
    an HTTP 404 error)</dt>
 
-   <dd><p>Executing the script must just consist of <span title="fire
-   an error event">firing an <code title="event-error">error</code>
-   event</span> at the element.</p></dd>
+   <dd><p>Executing the script block must just consist of <span
+   title="fire an error event">firing an <code
+   title="event-error">error</code> event</span> at the
+   element.</p></dd>
 
    <dt>If the load was successful</dt>
 
+   <!-- SCRIPT EXEC -->
    <dd>
 
     <ol>
 
      <li>
 
-      <p>If the <code>script</code> element's <code>Document</code> is
-      the <span>active document</span> in its <span>browsing
-      context</span>, the user agent must execute the script:</p>
+      <p>Initialise <dfn><var>the script block's source</var></dfn> as
+      follows:</p>
 
       <dl class="switch">
 
        <dt>If the script is from an external file</dt>
 
        <dd>
 
-        <p>That file must be used as the file to execute.</p>
+        <p>The contents of that file, interpreted as as string of
+        Unicode characters, are the script source.</p>
 
-        <p>The file must be interpreted using the character encoding
-        given by <var>the script's character encoding</var>, regardless
-        of any metadata given by the file's <span
-        title="Content-Type">Content-Type metadata</span>.</p>
+        <p>The file must be converted to Unicode using the character
+        encoding given by <var>the script block's character
+        encoding</var>, regardless of any metadata given by the file's
+        <span title="Content-Type">Content-Type metadata</span>.</p>
 
         <p class="XXX">This means that a UTF-16 document will
         always assume external scripts are UTF-16...? This applies,
         e.g., to document's created using createDocument()... It also
         means changing document.charSet will affect the character
         encoding used to interpret scripts, is that really what
         happens?</p>
 
        </dd>
 
-       <dt>If the script is inline</dt>
+       <dt>If the script is inline and <var>the script block's type</var> is a text-based language</dt>
+
+       <dd>
+
+        <p>The value of the DOM <code
+        title="dom-script-text">text</code> attribute at the time the
+        "<span>running a script</span>" algorithm was first invoked is
+        the script source.</p>
+
+       </dd>
+
+       <dt>If the script is inline and <var>the script block's type</var> is an XML-based language</dt>
 
        <dd>
 
-        <p>For scripting languages that consist of pure text, user
-        agents must use the value of the DOM <code
-        title="dom-script-text">text</code> attribute (defined below) as
-        the script to execute, and for XML-based scripting languages,
-        user agents must use all the child nodes of the
-        <code>script</code> element as the script to execute.</p>
+        <p>The child nodes of the <code>script</code> element at the
+        time the "<span>running a script</span>" algorithm was first
+        invoked are the script source.</p>
 
        </dd>
 
       </dl>
 
-      <!-- SCRIPT EXEC -->
-      <p>In any case, the user agent must execute the script according to
-      the semantics defined by the language associated with <var>the
-      script's type</var> (see the <a href="#scriptingLanguages">scripting
-      languages</a> section below).</p>
-
-      <p>The <span>script execution context</span> of the script must
-      be the <code>Window</code> object of that <span>browsing
-      context</span>.</p>
-
-      <p>The <span>script document context</span> of the script must
-      be the <code>Document</code> object that owns the
-      <code>script</code> element.</p>
-
-      <p class="note">The element's attributes' values might have changed
-      between when the element was inserted into the document and when the
-      script has finished loading, as may its other attributes; similarly,
-      the element itself might have been taken back out of the DOM, or had
-      other changes made. These changes do not in any way affect the above
-      steps; only the values of the attributes at the time the
-      <code>script</code> element is first inserted into the document
-      matter.</p>
+     </li>
+
+     <li>
+
+      <p><span title="create a script from a node">Create a
+      script</span> from the <code>script</code> element node, using
+      the <var>the script block's source</var> and the <var>the script
+      block's type</var>.</p>
+
+      <p class="note">This is where the script is compiled and
+      actually executed.</p>
 
      </li>
 
      <li>
 
-      <p>Then, the user agent must <span>fire a <code
-      title="event-load">load</code> event</span> at the
-      <code>script</code> element.</p>
+      <p><span>Fire a <code title="event-load">load</code>
+      event</span> at the <code>script</code> element.</p>
 
      </li>
 
     </ol>
 
    </dd>
 
   </dl>
 
   <p>The DOM attributes <dfn
@@ -10268,22 +10324,22 @@ o............A....e
    site's search engine to help users who are looking for particular
    features in their game maps.</p>
 
   </div>
 
 
 
   <h5 id="scriptingLanguages">Scripting languages</h5>
 
   <p>A user agent is said to <dfn>support the scripting language</dfn>
-  if <var>the script's type</var> matches the MIME type of a scripting
-  language that the user agent implements.</p>
+  if <var>the script block's type</var> matches the MIME type of a
+  scripting language that the user agent implements.</p>
 
   <p>The following lists some MIME types and the languages to which
   they refer:</p>
 
   <dl>
 
    <dt><code>text/javascript</code></dt>
    <dt><code>text/javascript1.1</code></dt>
    <dt><code>text/javascript1.2</code></dt>
    <dt><code>text/javascript1.3</code></dt>
@@ -10309,138 +10365,154 @@ o............A....e
   <h4>The <dfn><code>noscript</code></dfn> element</h4>
 
   <dl class="element">
    <dt>Categories</dt>
    <dd><span>Metadata content</span>.</dd>
    <dd><span>Phrasing content</span>.</dd>
    <dt>Contexts in which this element may be used:</dt>
    <dd>In a <code>head</code> element of an <span title="HTML documents">HTML document</span>, if there are no ancestor <code>noscript</code> elements.</dd>
    <dd>Where <span>phrasing content</span> is expected in <span>HTML documents</span>, if there are no ancestor <code>noscript</code> elements.</dd>
    <dt>Content model:</dt>
-   <dd><span>Without script</span>, in a <code>head</code> element: in any order, zero or more <code>link</code> elements, zero or more <code>style</code> elements, and zero or more <code>meta</code> elements.</dd>
-   <dd><span>Without script</span>, not in a <code>head</code> element: <span>transparent</span>, but there must be no <code>noscript</code> element descendants.</dd>
-   <dd><span>With script</span>: text that conforms to the requirements given in the prose.</dd>
+   <dd>When <span title="concept-n-noscript">scripting is disabled</span>, in a <code>head</code> element: in any order, zero or more <code>link</code> elements, zero or more <code>style</code> elements, and zero or more <code>meta</code> elements.</dd>
+   <dd>When <span title="concept-n-noscript">scripting is disabled</span>, not in a <code>head</code> element: <span>transparent</span>, but there must be no <code>noscript</code> element descendants.</dd>
+   <dd>Otherwise: text that conforms to the requirements given in the prose.</dd>
    <dt>Element-specific attributes:</dt>
    <dd>None.</dd>
    <dt>DOM interface:</dt>
    <dd>Uses <code>HTMLElement</code>.</dd>
   </dl>
 
   <p>The <code>noscript</code> element does not represent anything. It
   is used to present different markup to user agents that support
   scripting and those that don't support scripting, by affecting how
   the document is parsed.</p>
 
-  <p>The <code>noscript</code> element must not be used in <span>XML
-  documents</span>.</p>
-
-  <p class="note"><strong>The <code>noscript</code> element is only
-  effective in the <span title="">HTML serialization</span><!-- XXX
-  xref -->, it has no effect in the <span title="">XML
-  serialization</span><!-- XXX xref -->.</strong></p>
-
   <p>When used in <span>HTML documents</span>, the allowed content
   model is as follows:</p>
 
-  <p>In a <code>head</code> element, if the <code>noscript</code>
-  element is <span>without script</span>, then the content model of a
-  <code>noscript</code> element must contain only <code>link</code>,
-  <code>style</code>, and <code>meta</code> elements. If the
-  <code>noscript</code> element is <span>with script</span>, then the
-  content model of a <code>noscript</code> element is text, except
-  that invoking the <span>HTML fragment parsing algorithm</span> with
-  the <code>noscript</code> element as the <var title="">context</var>
-  element and the text contents as the <var title="">input</var> must
-  result in a list of nodes that consists only of <code>link</code>,
-  <code>style</code>, and <code>meta</code> elements.</p>
-
-  <p>Outside of <code>head</code> elements, if the
-  <code>noscript</code> element is <span>without script</span>, then
-  the content model of a <code>noscript</code> element is
-  <span>transparent</span>, with the additional restriction that a
-  <code>noscript</code> element must not have a <code>noscript</code>
-  element as an ancestor (that is, <code>noscript</code> can't be
-  nested).</p>
-
-  <p>Outside of <code>head</code> elements, if the
-  <code>noscript</code> element is <span>with script</span>, then the
-  content model of a <code>noscript</code> element is text, except
-  that the text must be such that running the following algorithm
-  results in a conforming document with no <code>noscript</code>
-  elements and no <code>script</code> elements, and such that no step
-  in the algorithm causes an <span>HTML parser</span> to flag a
-  <span>parse error</span>:</p>
+  <dl>
 
-  <ol>
+   <dt>In a <code>head</code> element, if <span
+   title="concept-n-noscript">scripting is disabled</span> for the
+   <code>noscript</code> element</dt>
+
+   <dd><p>The <code>noscript</code> element must contain only
+   <code>link</code>, <code>style</code>, and <code>meta</code>
+   elements.</p></dd>
+
+   <dt>In a <code>head</code> element, if <span
+   title="concept-n-noscript">scripting is enabled</span> for the
+   <code>noscript</code> element</dt>
 
-   <li>Remove every <code>script</code> element from the
-   document.</li>
+   <dd><p>The <code>noscript</code> element must contain only text,
+   except that invoking the <span>HTML fragment parsing
+   algorithm</span> with the <code>noscript</code> element as the <var
+   title="">context</var> element and the text contents as the <var
+   title="">input</var> must result in a list of nodes that consists
+   only of <code>link</code>, <code>style</code>, and
+   <code>meta</code> elements.</p></dd>
+
+   <dt>Outside of <code>head</code> elements, if <span
+   title="concept-n-noscript">scripting is disabled</span> for the
+   <code>noscript</code> element</dt>
+
+   <dd><p>The <code>noscript</code> element's content model is
+   <span>transparent</span>, with the additional restriction that a
+   <code>noscript</code> element must not have a <code>noscript</code>
+   element as an ancestor (that is, <code>noscript</code> can't be
+   nested).</p></dd>
+
+   <dt>Outside of <code>head</code> elements, if <span
+   title="concept-n-noscript">scripting is enabled</span> for the
+   <code>noscript</code> element</dt>
+
+   <dd>
 
-   <li>Make a list of every <code>noscript</code> element in the
-   document. For every <code>noscript</code> element in that list,
-   perform the following steps:
+    <p>The <code>noscript</code> element must contain only text,
+    except that the text must be such that running the following
+    algorithm results in a conforming document with no
+    <code>noscript</code> elements and no <code>script</code>
+    elements, and such that no step in the algorithm causes an
+    <span>HTML parser</span> to flag a <span>parse error</span>:</p>
 
     <ol>
 
-     <li>Let the <var title="">parent element</var> be the parent
-     element of the <code>noscript</code> element.</li>
+     <li>Remove every <code>script</code> element from the
+     document.</li>
 
-     <li>Take all the children of the <var title="">parent element</var>
-     that come before the <code>noscript</code> element, and call these
-     elements <var title="">the before children</var>.</li>
+     <li>Make a list of every <code>noscript</code> element in the
+     document. For every <code>noscript</code> element in that list,
+     perform the following steps:
 
-     <li>Take all the children of the <var title="">parent element</var>
-     that come <em>after</em> the <code>noscript</code> element, and
-     call these elements <var title="">the after children</var>.</li>
+      <ol>
 
-     <li>Let <var title="">s</var> be the concatenation of all the
-     <span>text node</span> children of the <code>noscript</code>
-     element.</li>
+       <li>Let the <var title="">parent element</var> be the parent
+       element of the <code>noscript</code> element.</li>
 
-     <li>Set the <code title="dom-innerHTML-HTML">innerHTML</code>
-     attribute of the <var title="">parent element</var> to the value
-     of <var title="">s</var>. (This, as a side-effect, causes the
-     <code>noscript</code> element to be removed from the
-     document.)</li>
+       <li>Take all the children of the <var title="">parent element</var>
+       that come before the <code>noscript</code> element, and call these
+       elements <var title="">the before children</var>.</li>
 
-     <li>Insert <var title="">the before children</var> at the start of
-     the <var title="">parent element</var>, preserving their original
-     relative order.</li>
+       <li>Take all the children of the <var title="">parent element</var>
+       that come <em>after</em> the <code>noscript</code> element, and
+       call these elements <var title="">the after children</var>.</li>
 
-     <li>Insert <var title="">the after children</var> at the end of the
-     <var title="">parent element</var>, preserving their original
-     relative order.</li>
+       <li>Let <var title="">s</var> be the concatenation of all the
+       <span>text node</span> children of the <code>noscript</code>
+       element.</li>
 
-    </ol>
+       <li>Set the <code title="dom-innerHTML-HTML">innerHTML</code>
+       attribute of the <var title="">parent element</var> to the value
+       of <var title="">s</var>. (This, as a side-effect, causes the
+       <code>noscript</code> element to be removed from the
+       document.)</li>
 
-   </li>
+       <li>Insert <var title="">the before children</var> at the start of
+       the <var title="">parent element</var>, preserving their original
+       relative order.</li>
 
-  </ol>
+       <li>Insert <var title="">the after children</var> at the end of the
+       <var title="">parent element</var>, preserving their original
+       relative order.</li>
 
-  <p>The <code>noscript</code> element has no other requirements. In
-  particular, children of the <code>noscript</code> element are not
-  exempt from form submission, scripting, and so forth, even when the
-  element is <span>with script</span>.</p>
+      </ol>
+
+     </li>
+
+    </ol>
+
+   </dd>
+
+  </dl>
 
   <p class="note">All these contortions are required because, for
   historical reasons, the <code>noscript</code> element is handled
   differently by the <span>HTML parser</span> based on whether <span
   title="scripting flag">scripting was enabled or not</span> when the
   parser was invoked. The element is not allowed in XML, because in
   XML the parser is not affected by such state, and thus the element
   would not have the desired effect.</p>
 
-  <p class="note">The <code>noscript</code> element interacts poorly
-  with the <code title="dom-document-designMode">designMode</code>
-  feature. Authors are encouraged to not use <code>noscript</code>
-  elements on pages that will have <code
-  title="dom-document-designMode">designMode</code> enabled.</p>
+  <p>The <code>noscript</code> element must not be used in <span>XML
+  documents</span>.</p>
+
+  <p class="note"><strong>The <code>noscript</code> element is only
+  effective in the <span>HTML serialization</span><!-- XXX xref -->,
+  it has no effect in the <span>XML serialization</span><!-- XXX xref
+  -->.</strong></p>
+
+  <p>The <code>noscript</code> element has no other requirements. In
+  particular, children of the <code>noscript</code> element are not
+  exempt from form submission, scripting, and so forth, even when
+  <span title="concept-n-script">scripting is enabled</span> for the
+  element.</p>
+
 
 
   <h4>The <dfn><code>eventsource</code></dfn> element</h4>
 
   <dl class="element">
    <dt>Categories</dt>
    <dd><span>Metadata content</span>.</dd>
    <dd><span>Phrasing content</span>.</dd>
    <dt>Contexts in which this element may be used:</dt>
    <dd>Where <span>metadata content</span> is expected.</dd>
@@ -15589,21 +15661,21 @@ interface <dfn>HTMLImageElement</dfn> : <span>HTMLElement</span> {
   title="dom-img-complete"><code>complete</code></dfn> must return
   true if the user agent has fetched the image specified in the <code
   title="attr-img-src">src</code> attribute, and it is a valid image,
   even if the final <span title="concept-task">task</span> queued by
   the <span>networking task source</span> for the <span
   title="fetch">fetching</span> of the image resource has not yet been
   processed. Otherwise, the attribute must return false.</p>
 
   <p class="note">The value of <code
   title="dom-img-complete">complete</code> can thus change while a
-  script is executing.</p>
+  <span title="concept-script">script</span> is executing.</p>
 
   <p>Three constructors are provided for creating
   <code>HTMLImageElement</code> objects (in addition to the factory
   methods from DOM Core such as <code
   title="">createElement()</code>): <dfn
   title="dom-image"><code>Image()</code></dfn>, <dfn
   title="dom-image-w"><code>Image(<var
   title="">width</var>)</code></dfn>, and <dfn
   title="dom-image-wh"><code>Image(<var title="">width</var>, <var
   title="">height</var>)</code></dfn>. When invoked as constructors,
@@ -16688,20 +16760,26 @@ href="?audio">audio&lt;/a> test instead.)&lt;/p></pre>
 
   <p>While the <code title="attr-iframe-sandbox">sandbox</code>
   attribute is specified, the <code>iframe</code> element's
   <span>nested browsing context</span>, and all the browsing contexts
   <span title="nested browsing context">nested</span> within it
   (either directly or indirectly through other nested browsing
   contexts) must have the following flags set:</p>
 
   <dl>
 
+   <!-- XXX disallow cross-origin loads of any kind (networking
+        override that only allows same-origin URLs or about:,
+        javascript:, data:) -->
+   <!-- XXX block access to 'contentWindow.frames' from iframe owner -->
+   <!-- XXX block access to 'parent.frames' from sandbox -->
+
    <dt>The <dfn>sandboxed navigation browsing context flag</dfn></dt>
 
    <dd>
 
     <p>This flag <a href="#sandboxLinks">prevents content from
     navigating browsing contexts other than the sandboxed browsing
     context itself</a> (or browsing contexts further nested inside
     it).</p>
 
     <p>This flag also <a href="#sandboxWindowOpen">prevents content
@@ -20042,28 +20120,29 @@ interface <dfn>HTMLAudioElement</dfn> : <span>HTMLMediaElement</span> {
   title="dom-media-seek">seeking</span> was used whenever the
   <span>current playback position</span> changes in a discontinuous
   fashion (so that the relevant events fire).</p>
 
 
 
   <h5>User interface</h5>
 
   <p>The <dfn title="attr-media-controls"><code>controls</code></dfn>
   attribute is a <span>boolean attribute</span>. If the attribute is
-  present, or if the <span>media element</span> is <span>without
-  script</span>, then the user agent should <dfn>expose a user
-  interface to the user</dfn>. This user interface should include
-  features to begin playback, pause playback, seek to an arbitrary
-  position in the content (if the content supports arbitrary seeking),
-  change the volume, and show the media content in manners more
-  suitable to the user (e.g. full-screen video or in an independent
-  resizable window). Other controls may also be made available.</p>
+  present, or if <span title="concept-n-noscript">scripting is
+  disabled</span> for the <span>media element</span>, then the user
+  agent should <dfn>expose a user interface to the user</dfn>. This
+  user interface should include features to begin playback, pause
+  playback, seek to an arbitrary position in the content (if the
+  content supports arbitrary seeking), change the volume, and show the
+  media content in manners more suitable to the user (e.g. full-screen
+  video or in an independent resizable window). Other controls may
+  also be made available.</p>
 
   <p>If the attribute is absent, then the user agent should avoid
   making a user interface available that could conflict with an
   author-provided user interface. User agents may make the following
   features available, however, even when the attribute is absent:</p>
 
   <p>User agents may provide controls to affect playback of the media
   resource (e.g. play, pause, seeking, and volume controls), but such
   features should not interfere with the page's normal rendering. For
   example, such features could be exposed in the <span>media
@@ -20363,37 +20442,38 @@ interface <dfn>HTMLAudioElement</dfn> : <span>HTMLMediaElement</span> {
   elements (typically <code>h1</code>) and then styled using CSS and
   supporting technologies such as XBL.</p>
 
   <p>When authors use the <code>canvas</code> element, they should
   also provide content that, when presented to the user, conveys
   essentially the same function or purpose as the bitmap canvas. This
   content may be placed as content of the <code>canvas</code>
   element. The contents of the <code>canvas</code> element, if any,
   are the element's <span>fallback content</span>.</p>
 
-  <p>In interactive visual media, if the <code>canvas</code> element
-  is <span>with script</span>, the <code>canvas</code> element
+  <p>In interactive visual media, if <span
+  title="concept-n-script">scripting is enabled</span> for the
+  <code>canvas</code> element, the <code>canvas</code> element
   represents an embedded element with a dynamically created image.</p>
 
   <p>In non-interactive, static, visual media, if the
   <code>canvas</code> element has been previously painted on (e.g. if
   the page was viewed in an interactive visual medium and is now being
   printed, or if some script that ran during the page layout process
   painted on the element), then the <code>canvas</code> element
   represents <span>embedded content</span> with the current image and
   size. Otherwise, the element represents its <span>fallback
   content</span> instead.</p>
 
-  <p>In non-visual media, and in visual media if the
-  <code>canvas</code> element is <span>without script</span>, the
-  <code>canvas</code> element represents its <span>fallback
-  content</span> instead.</p>
+  <p>In non-visual media, and in visual media if <span
+  title="concept-n-noscript">scripting is disabled</span> for the
+  <code>canvas</code> element, the <code>canvas</code> element
+  represents its <span>fallback content</span> instead.</p>
 
   <p>The <code>canvas</code> element has two attributes to control the
   size of the coordinate space: <dfn
   title="attr-canvas-width"><code>width</code></dfn> and <dfn
   title="attr-canvas-height"><code>height</code></dfn>. These
   attributes, when specified, must have values that are <span
   title="valid non-negative integer">valid non-negative
   integers</span>. The <span>rules for parsing non-negative
   integers</span> must be used to obtain their numeric values. If an
   attribute is missing, or if parsing its value returns an error, then
@@ -37223,28 +37303,29 @@ explain that only direct children of the <menu> matter
            attribute <span>EventListener</span> <span title="handler-onunload">onunload</span>;
 };
 
 // <dfn class="XXX">VoidCallback</dfn> waiting on WebIDL
 </pre>
 
  <!-- XXX http://msdn.microsoft.com/workshop/author/dhtml/reference/objects/obj_window.asp
           http://www.mozilla.org/docs/dom/domref/dom_window_ref.html
           http://lxr.mozilla.org/mozilla/source/dom/public/idl/base/nsIDOMWindow.idl - scrollBy, etc
           http://lxr.mozilla.org/mozilla/source/dom/public/idl/base/nsIDOMWindowInternal.idl - DOM level 0
+      close() focus() blur()
    -->
 
   <p>The <dfn title="dom-window"><code>window</code></dfn>, <dfn
   title="dom-frames"><code>frames</code></dfn>, and <dfn
   title="dom-self"><code>self</code></dfn> DOM attributes must all
   return the <code>Window</code> object itself.</p>
 
-  <p>The <code>Window</code> object also provides the scope for script
+  <p>The <code>Window</code> object also provides the scope for <span title="concept-script">script</span>
   execution. Each <code>Document</code> in a <span>browsing
   context</span> has an associated <dfn>list of added properties</dfn>
   that, when a document is <span title="active
   document">active</span>, are available on the
   <code>Document</code>'s <span>default view</span>'s
   <code>Window</code> object. A <code>Document</code> object's
   <span>list of added properties</span> must be empty when the
   <code>Document</code> object is created.</p>
 
 
@@ -37336,23 +37417,24 @@ explain that only direct children of the <menu> matter
   instead target a new tab.</p>
 
   <p>Then, the user agent must <span>navigate</span> the selected
   <span>browsing context</span> to the <span>absolute URL</span> (or
   error) obtained from <span title="resolve a url">resolving</span>
   <var title="">url</var>. If the <var title="">replace</var> is true,
   then <span title="replacement enabled">replacement must be
   enabled</span>; otherwise, it must not be enabled unless the
   <span>browsing context</span> was just created as part of the
   <span>the rules for choosing a browsing context given a browsing
-  context name</span>. The navigation must be done with the
-  <span>script browsing context</span> of the script that invoked the
-  method as the <span>source browsing context</span>.</p>
+  context name</span>. The navigation must be done with the <span
+  title="script's browsing context">browsing context</span> of the
+  <span title="concept-script">script</span> that invoked the method as the <span>source browsing
+  context</span>.</p>
 
   <p>The method must return the <code>Window</code> object of the
   default view of the <span>browsing context</span> that was
   navigated, or null if no browsing context was navigated.</p>
 
   <p>The <dfn title="dom-name"><code>name</code></dfn> attribute of
   the <code>Window</code> object must, on getting, return the current
   name of the <span>browsing context</span>, and, on setting, set the
   name of the <span>browsing context</span> to the new value.</p>
 
@@ -37371,20 +37453,58 @@ explain that only direct children of the <menu> matter
 
   <p>The <dfn title="dom-XXX4"><code>XXX4(<var
   title="">index</var>)</code></dfn> method must return the <var
   title="">index</var>th <span>child browsing context</span> of the
   <span title="active document">active</span> <code>Document</code>,
   sorted in document order of the elements nesting those browsing
   contexts.</p> <!-- XXX DOMB -->
 
 
 
+  <h4>Garbage collection and browsing contexts</h4>
+
+  <p>A <span>browsing context</span> has a strong reference to each of
+  its <code>Document</code>s and <span title="view">views</span>, and
+  the user agent itself has a strong reference to its <span
+  title="top-level browsing context">top-level browsing
+  contexts</span>.</p>
+
+  <p>When a <span>browsing context</span> is to <dfn>discard a
+  <code>Document</code></dfn>, that means that it is to lose the
+  strong reference from the <code>Document</code>'s <span>browsing
+  context</span> to the <code>Document</code>.</p>
+
+  <p class="note">The <span>browsing context</span>'s <span>default
+  view</span>'s <code>Window</code> object <span title="implied strong
+  reference">has a strong reference of its own</span> to the
+  <code>Document</code> object of the <span>browsing context</span>'s
+  <span>active document</span>.</p>
+
+  <p>When <dfn>a <em><span>browsing context</span></em> is
+  discarded</dfn>, the strong reference from the user agent itself to
+  the <span>browsing context</span> must be severed, and all the
+  <code>Document</code> objects for all the entries in the
+  <span>browsing context</span>'s session history must be <span
+  title="discard a document">discarded</span> as well.</p>
+
+  <p>User agents may <span title="a browsing context is
+  discarded">discard</span> <span title="top-level browsing
+  context">top-level browsing contexts</span> at any time (typically,
+  in response to user requests, e.g. when a user closes a window
+  containing one or more <span title="top-level browsing
+  context">top-level browsing contexts</span>). Other <span
+  title="browsing context">browsing contexts</span> must be discarded
+  once their <code>Window</code> object is eligible for garbage
+  collection.</p>
+
+
+
   <h3>Origin</h3>
   <!-- Hallowed are the Ori -->
 
   <p>The <dfn>origin</dfn> of a resource and the <dfn>effective script
   origin</dfn> of a resource are both either opaque identifiers or
   tuples consisting of a scheme component, a host component, a port
   component, and optionally extra data.</p>
 
   <p class="note">The extra data could include the certificate of the
   site when using encrypted connections, to ensure that if the site's
@@ -37864,20 +37984,22 @@ explain that only direct children of the <menu> matter
   isn't, then the document does not have a domain.</p>
 
   <p class="note">The <code title="dom-document-domain">domain</code>
   attribute is used to enable pages on different hosts of a domain to
   access each others' DOMs.</p>
 
 
 
   <h3 id="scripting">Scripting</h3>
 
+  <h4>Introduction</h4>
+
   <p>Various mechanisms can cause author-provided executable code to
   run in the context of a document. These mechanisms include, but are
   probably not limited to:</p>
 
   <ul>
 
    <li>Processing of <code>script</code> elements.</li>
 
    <li>Processing of inline <code title="javascript
    protocol">javascript:</code> URLs (e.g. the <code
@@ -37888,102 +38010,304 @@ explain that only direct children of the <menu> matter
    <li>Event handlers, whether registered through the DOM using <code
    title="">addEventListener()</code>, by explicit <span>event handler
    content attributes</span>, by <span>event handler DOM
    attributes</span>, or otherwise.</li>
 
    <li>Processing of technologies like XBL or SVG that have their own
    scripting features.</li>
 
   </ul>
 
-  <p>When a script is created<!-- which is marked by SCRIPT EXEC in
-  this spec -->, it is associated with a <span>script execution
-  context</span>, a <span>script browsing context</span>, and a
-  <span>script document context</span>.</p>
 
 
 
-  <!-- SCRIPT EXEC -->
-  <h4>Script execution contexts</h4>
-
-  <p>The <dfn>script execution context</dfn> of a script is defined
-  when that script is created. In this specification, it is either a
-  <code>Window</code> object or an empty object; other specifications
-  might make the script execution context be some other object.</p>
-
-  <p>When the <span>script execution context</span> of a script is an
-  empty object, it can't do anything that interacts with the
-  environment.</p>
-
-  <p>A <span>script execution context</span> always has an associated
-  <span>browsing context</span>, known as the <dfn>script browsing
-  context</dfn>. If the <span>script execution context</span> is a
-  <code>Window</code> object, then that object's <span>browsing
-  context</span> is it. Otherwise, the <span>script execution
-  context</span> is associated explicitly with a <span>browsing
-  context</span> when it is created.</p>
-
-  <p>Every script whose <span>script execution context</span> is a
-  <code>Window</code> object is also associated with a
-  <code>Document</code> object, known as its <dfn>script document
-  context</dfn>. It is used to <span title="resolve a
-  url">resolve</span> URLs. The document is assigned when the script
-  is created, as with the <span>script browsing context</span>.</p>
+  <h4>Enabling and disabling scripting</h4>
+
+  <p><dfn title="concept-bc-script">Scripting is enabled</dfn> in a
+  <em><span>browsing context</span></em> when all of the
+  following conditions are true:</p>
+
+  <ul>
+
+   <li>The user agent supports scripting.</li>
+
+   <li>The user has not disabled scripting for this <span>browsing
+   context</span> at this time. (User agents may provide users with
+   the option to disable scripting globally, or in a finer-grained
+   manner, e.g. on a per-origin basis.)</li>
+
+   <li id="sandboxScriptBlocked">The <span>browsing context</span>
+   does not have the <span>sandboxed scripts browsing context
+   flag</span> set.</li>
+
+  </ul>
+
+  <p><dfn title="concept-bc-noscript">Scripting is disabled</dfn> in a
+  <span>browsing context</span> when any of the above conditions are
+  false (i.e. when scripting is not <span
+  title="concept-bc-script">enabled</span>).</p>
 
   <hr>
 
-  <p>It is said that <dfn>scripting is disabled</dfn> in a
-  <span>script execution context</span> when any of the following
-  conditions are true:</p>
+  <p><dfn title="concept-n-script">Scripting is enabled</dfn> for a
+  <em>node</em> if the <code>Document</code> object of the node (the
+  node itself, if it is itself a <code>Document</code> object) has an
+  associated <span>browsing context</span>, and <span
+  title="concept-bc-script">scripting is enabled</span> in that
+  <span>browsing context</span>.</p>
+
+  <p><dfn title="concept-n-noscript">Scripting is disabled</dfn> for a
+  node if there is no such <span>browsing context</span>, or if <span
+  title="concept-bc-noscript">scripting is disabled</span> in that
+  <span>browsing context</span>.</p>
 
-  <ul>
 
-   <li>The user agent does not support scripting.</li>
 
-   <li>The user has disabled scripting for this <span>script execution
-   context</span>. (User agents may provide users with the option to
-   disable scripting globally, on a per-origin basis, or in other ways
-   down to the granularity of individual <span title="script execution
-   context">script execution contexts</span>.)</li>
+  <!-- SCRIPT EXEC (marks areas related to creation of scripts) -->
+  <h4>Processing model</h4>
 
-   <li id="designModeScriptBlocked">The <span>script execution
-   context</span>'s associated <span>browsing context</span>'s
-   <span>active document</span> has <code
-   title="dom-document-designMode">designMode</code> enabled.</li>
+  <h5>Definitions</h5>
 
-   <li id="sandboxScriptBlocked">The <span>script execution
-   context</span>'s associated <span>browsing context</span> has the
-   <span>sandboxed scripts browsing context flag</span> set.</li>
+  <p>A <dfn title="concept-script">script</dfn> has:</p>
 
-  </ul>
+  <dl>
+
+   <dt>A <dfn>script execution environment</dfn></dt>
 
-  <p>A node is said to be <dfn>without script</dfn> if either the
-  <code>Document</code> object of the node (the node itself, if it is
-  itself a <code>Document</code> object) does not have an associated
-  <span>browsing context</span>, or <span>scripting is disabled</span>
-  in that <span>browsing context</span>.</p>
+   <dd>
+
+    <p>The characteristics of the script execution environment depend
+    on the language, and are not defined by this specification.</p>
+
+    <p class="example">In JavaScript, the script execution environment
+    consists of the interpreter, the stack of <i>execution
+    contexts</i>, the <i>global code</i> and <i>function code</i> and
+    the Function objects resulting, and so forth.</p>
+
+   </dd>
+
+   <dt>A <dfn>list of code entry-points</dfn></dt>
+
+   <dd>
+
+    <p>Each code entry-point represents a block of executable code
+    that the script exposes to other scripts and to the user
+    agent.</p>
+
+    <p class="example">Each Function object in a JavaScript
+    <span>script execution environment</span> has a corresponding code
+    entry-point, for instance.</p>
+
+    <p>The main program code of the script, if any, is the
+    <dfn><i>initial code entry-point</i></dfn>. Typically, the code
+    corresponding to this entry-point is executed immediately after
+    the script is parsed.</p>
+
+    <p class="example">In JavaScript, this corresponds to the
+    execution context of the global code.</p>
+
+   </dd>
+
+   <dt>A relationship with the <dfn>script's global object</dfn></dt>
+
+   <dd>
+
+    <p>An object that provides the APIs that the code can use.</p>
+
+    <p class="example">This is typically a <code>Window</code>
+    object. In JavaScript, this corresponds to the <i>global
+    object</i>.</p>
+
+    <p class="note">When a <span>script's global object</span> is an
+    empty object, it can't do anything that interacts with the
+    environment.</p>
 
-  <p>A node is said to be <dfn>with script</dfn> if it is not
-  <span>without script</span>.</p>
+   </dd>
+
+   <dt>A relationship with the <dfn>script's browsing context</dfn></dt>
+
+   <dd>
+
+    <p>A <span>browsing context</span> that is assigned responsibility
+    for actions taken by the script.</p>
+
+    <p class="example">When a script creates and <span
+    title="navigate">navigates</span> a new <span>top-level browsing
+    context</span>, the <code title="dom-opener">opener</code>
+    attribute of the new <span>browsing context</span>'s
+    <code>Window</code> object will be set to the <span>script's
+    browsing context</span>'s <code>Window</code> object.</p>
+
+   </dd>
+
+   <dt>A <dfn title="script's character encoding">character encoding</dfn></dt>
+
+   <dd>
+
+    <p>A character encoding, set when the script is created, used to
+    encode URLs.  <span id="sce-not-copy">If the character encoding is
+    set from another source, e.g. a <span>document's character
+    encoding</span>, then the <span>script's character encoding</span>
+    must follow the source, so that if the source's changes, so does
+    the script's.</span></p>
+
+   </dd>
+
+   <dt>A <dfn title="script's base URL">base URL</dfn></dt>
 
-  <p class="XXX">If you can find a better pair of terms than
-  "with script" and "without script" let me know. The only things I
-  can find that are less confusing are also way, way longer.</p>
+   <dd>
+
+    <p>A <span>URL</span>, set when the script is created, used to
+    resolve relative URLs. <span id="sbu-not-copy">If the base URL is
+    set from another source, e.g. a <span>document base URL</span>,
+    then the <span>script's base URL</span> must follow the source, so
+    that if the source's changes, so does the script's.</span></p>
 
-  <p>When a script is to be executed in a <span>script execution
-  context</span> in which <span>scripting is disabled</span>, the
-  script must do nothing and return nothing (a void return value).</p>
+   </dd>
 
-  <p class="note">Thus, for instance, enabling <code
-  title="dom-document-designMode">designMode</code> will disable any
-  event handler attributes, event listeners, timeouts, etc, that were
-  set by scripts in the document.</p>
+   <dt>Membership in a <dfn>script group</dfn></dt>
+
+   <dd>
+
+    <p>A group of one or more scripts that are loaded in the same
+    context, which are always disabled as a group. Scripts in a script
+    group all have the same <span title="script's global
+    object">global object</span> and <span title="script's browsing
+    context">browsing context</span>.</p>
+
+    <p>A script group can be <i>frozen</i>. When a script group is
+    frozen, any code defined in that script group will throw an
+    exception when invoked. A frozen script group can be
+    <i>unfrozen</i>, allowing scripts in that script group to run
+    normally again.</p>
+
+   </dd>
+
+  </dl>
+
+
+
+  <h5>Calling scripts</h5>
+
+  <p>When a user agent is to <dfn>jump to a code entry-point</dfn> for
+  a <span title="concept-script">script</span>, if <span
+  title="concept-bc-noscript">scripting is disabled</span> in the
+  <span>script's browsing context</span>, or if the script's
+  <span>script group</span> is <i>frozen</i>, then the user agent must
+  throw an <code>UNAVAILABLE_SCRIPT_ERR</code> exception. Otherwise,
+  the <span title="script execution environment">script execution
+  environment</span> for the <span
+  title="concept-script">script</span> must execute the code for the
+  given code entry-point.</p>
+
+  <p>When executable code in one <span
+  title="concept-script">script</span> makes a call to another <span
+  title="concept-script">script</span>, the user agent must <span
+  title="jump to a code entry-point">jump</span> to the corresponding
+  code entry-point in that second script.</p>
+
+  <p>Any time the user agent to invoke a callback defined in a <span
+  title="concept-script">script</span>, the user agent must <span
+  title="jump to a code entry-point">jump</span> to the corresponding
+  code entry-point in that second script.</p>
+
+
+
+  <h5>Creating scripts</h5>
+
+  <p>When the specification says that a <span
+  title="concept-script">script</span> is to be <dfn title="create a
+  script">created</dfn>, given some script source, its scripting
+  language, a global object, a browsing context, a character encoding,
+  a base URL, and a script group, the user agent must run the
+  following steps:</p>
+
+  <ol>
+
+   <li><p>Set up a <span>script execution environment</span> as
+   appropriate for the scripting language.</p></li>
+
+   <li><p>Parse/compile/initialise the source of the script using the
+   <span>script execution environment</span>, as appropriate for the
+   scripting language, and thus obtain the <span>list of code
+   entry-points</span> for the script. If the semantics of the
+   scripting language and the given source code are such that there is
+   executable code to be immediately run, then the <i>initial code
+   entry-point</i> is the entry-point for that code.</p></li>
+
+   <li><p>Set up the <span>script's global object</span>, the
+   <span>script's browsing context</span>, the <span>script's
+   character encoding</span>, and the <span>script's base URL</span>
+   from the settings passed to this algorithm.</p></li>
+
+   <li><p>Add the <span title="concept-script">script</span> to the given <span>script
+   group</span>.</p></li>
+
+   <li><p><span title="jump to a code entry-point">Jump</span> to the
+   <span title="concept-script">script</span>'s <i>initial code
+   entry-point</i>.</p></li>
+
+  </ol>
+
+  <hr>
+
+  <p>When the user agent is to <dfn>create an impotent script</dfn>,
+  given some script source, its scripting language, and a browsing
+  context, the user agent must <span>create a script</span>, using the
+  given script source and scripting language, using a new empty object
+  as the global object, using the given browsing context as the
+  browsing context, and using a new script group as the script
+  group. The character encoding and base URL for the resulting <span
+  title="concept-script">script</span> are not important as no APIs
+  are exposed to the script.</p>
+
+  <hr>
+
+  <p>When the specification says that a <span
+  title="concept-script">script</span> is to be <dfn title="create a
+  script from a node">created from a node</dfn> <var
+  title="">node</var>, given some script source and its scripting
+  language, the user agent <span>create a script</span>, using the
+  given script source and scripting language, and using <span>the
+  script settings determined from the node</span> <var
+  title="">node</var>.</p>
+
+  <p><dfn>The script settings determined from the node</dfn> <var
+  title="">node</var> are computed as follows:</p>
+
+  <ol>
+
+   <li><p>Let <var title="">document</var> be the
+   <code>Document</code> of <var title="">node</var> (or <var
+   title="">node</var> itself if it is a
+   <code>Document</code>).</p></li>
+
+   <li><p>The browsing context is the <span>browsing context</span> of
+   <var title="">document</var>.</p>
+
+   <li><p>The global object is the <code>Window</code> object of the
+   <span>default view</span> of the <span>browsing context</span> of
+   <var title="">document</var>.</p></li>
+
+   <li><p>The character encoding is the <span title="document's
+   character encoding">character encoding</span> of <var
+   title="">document</var>. (<a href="#sce-not-copy">This is a
+   reference, not a copy</a>.)</p></li>
+
+   <li><p>The base URL is the <span title="document base URL">base
+   URL</span> of <var title="">document</var>. (<a
+   href="#sbu-not-copy">This is a reference, not a copy</a>.)</p></li>
+
+   <li><p>The script group is the <span>current script group</span> of
+   <var title="">document</var>.</p></li>
+
+  </ol>
 
 
 
   <h4>Event loops</h4>
 
   <p>To coordinate events, user interaction, scripts, rendering,
   networking, and so forth, user agents must use <dfn title="event
   loop">event loops</dfn> as described in this section.</p>
 
   <p>There must be at least one <span>event loop</span> per user
@@ -38037,20 +38361,31 @@ explain that only direct children of the <menu> matter
 
 
    <dt>Reacting to DOM manipulation</dt>
 
    <dd><p>Some elements have tasks that trigger in response to DOM
    manipulation, e.g. when that element is <span title="insert an
    element into a document">inserted into the document</span>.</p>
 
   </dl>
 
+  <p>Each <span title="concept-task">task</span> is associated with a
+  <code>Document</code>; if the task was queued in the context of an
+  element, then it is the element's <code>Document</code>; if the task
+  was queued in the context of a <span>browsing context</span>, then
+  it is the <span>browsing context</span>'a <span>active
+  document</span> at the time the task was queued; if the task was
+  queued by or for a <span title="concept-script">script</span> then
+  the document is the script's <span>script's browsing
+  context</span>'s <span>active document</span> at the time the task
+  was queued.</p>
+
   <p>When a user agent is to <dfn>queue a task</dfn>, it must add the
   given task to one of the <span title="task queue">task queues</span>
   of the relevant <span>event loop</span>. All the tasks from one
   particular <dfn>task source</dfn> (e.g. the callbacks generated by
   timers, the events dispatched for mouse movements, the tasks queued
   for the parser) must always be added to the same <span>task
   queue</span>, but tasks from different <span title="task
   source">task sources</span> may be placed in different <span
   title="task queue">task queues</span>.</p>
 
@@ -38062,22 +38397,24 @@ explain that only direct children of the <menu> matter
   interface responsive but not starving other task queues, and never
   processing events from any one <span>task source</span> out of
   order.</p>
 
   <p>An <span>event loop</span> must continually run through the
   following steps for as long as it exists:</p>
 
   <ol>
 
    <li><p>Run the oldest task on one of the <span>event loop</span>'s
-   <span title="task queue">task queues</span>. The user agent may
-   pick any <span>task queue</span>.</p></li>
+   <span title="task queue">task queues</span>, ignoring tasks whose
+   associated <code>Document</code>s are not <span title="active
+   document">active</span>. The user agent may pick any <span>task
+   queue</span>.</p></li>
 
    <li><p>Remove that task from its <span>task queue</span>.</p></li>
 
    <li><p>If necessary, update the rendering or user interface of any
    <code>Document</code> or <span>browsing context</span> to reflect
    the current state.</p></li>
 
    <li><p>Return to the first step of the <span>event
    loop</span>.</p></li>
 
@@ -38135,74 +38472,136 @@ explain that only direct children of the <menu> matter
 
    </dd>
 
   </dl>
 
 
 
   <!-- SCRIPT EXEC -->
   <h4 id="javascript-protocol"><dfn title="javascript protocol">The <code title="">javascript:</code> protocol</dfn></h4>
 
-  <p>A URL using the <code title="">javascript:</code> protocol must,
-  if and when <dfn title="concept-js-deref">dereferenced</dfn>, be
-  evaluated by executing the script obtained using the content
-  retrieval operation defined for <code title="">javascript:</code>
-  URLs. <a href="#refsJSURL">[JSURL]</a></p>
+  <p>When a <span>URL</span> using the <code
+  title="">javascript:</code> protocol is <dfn
+  title="concept-js-deref">dereferenced</dfn>, the user agent must run
+  the following steps:</p>
+
+  <ol>
+
+   <li><p>Let the script source be the string obtained using the
+   content retrieval operation defined for <code
+   title="">javascript:</code> URLs. <a
+   href="#refsJSURL">[JSURL]</a></p></li>
 
 <!--
 JSURL: http://ietfreport.isoc.org/all-ids/draft-hoehrmann-javascript-scheme-00.txt and
        http://www.websitedev.de/ietf/draft-hoehrmann-javascript-scheme-00.txt should be as stable as it gets,
        http://ietfreport.isoc.org/idref/draft-hoehrmann-javascript-scheme/ for the latest version
 -->
 
-  <p>When a <span>browsing context</span> is <span
-  title="navigate">navigated</span> to a <code>javascript:</code> URL,
-  and the <span>active document</span> of that browsing context has
-  the <span>same origin</span> as the script given by that URL, the
-  <span>script execution context</span> must be the
-  <code>Window</code> object of the <span>browsing context</span>
-  being navigated, and the <span>script document context</span> must
-  be that <span>active document</span>.</p>
-
-  <p>When a <span>browsing context</span> is <span
-  title="navigate">navigated</span> to a <code>javascript:</code> URL,
-  and the <span>active document</span> of that browsing context has an
-  <span>origin</span> that is <em>not</em> the <span title="same
-  origin">same</span> as that of the script given by the URL, the
-  <span>script execution context</span> must be an empty object, and
-  the <span>script browsing context</span> must be the <span>browsing
-  context</span> being <span title="navigate">navigated</span>.</p>
-
-  <p>Otherwise, if the <code>Document</code> object of the element,
-  attribute, or style sheet from which the <code>javascript:</code>
-  URL was reached has an associated <span>browsing context</span>, the
-  <span>script execution context</span> must be an empty object, and
-  the <span>script execution context</span>'s associated
-  <span>browsing context</span> must be that <span>browsing
-  context</span>.</p>
+   <li>
+
+    <p>Use the appropriate step from the following list:</p>
+
+    <dl>
+
+     <dt>If a <span>browsing context</span> is being <span
+     title="navigate">navigated</span> to a <code>javascript:</code>
+     URL, and the <span>active document</span> of that browsing
+     context has the <span>same origin</span> as the script given by
+     that URL</dt>
+
+     <dd>
+
+      <p><span title="create a script from a node">Create a
+      script</span> from the <code>Document</code> node of the
+      <span>active document</span>, using the aforementioned script
+      source, and assuming the scripting language is JavaScript.</p>
+
+      <p>Let <var title="">result</var> be the return value of the
+      <i>initial code entry-point</i> of this <span
+      title="concept-script">script</span>. If an exception was
+      raised, let <var title="">result</var> be void instead.</p>
 
-  <p>Otherwise, the script is not executed and its return value is
-  void.</p>
+     </dd>
+
+     <dt>If a <span>browsing context</span> is being <span
+     title="navigate">navigated</span> to a <code>javascript:</code>
+     URL, and the <span>active document</span> of that browsing
+     context has an <span>origin</span> that is <em>not</em> the <span
+     title="same origin">same</span> as that of the script given by
+     the URL</dt>
+
+     <dd>
+
+      <p><span>Create an impotent script</span> using the
+      aforementioned script source, with the scripting language set to
+      JavaScript, and with the <span>browsing context</span> being
+      <span title="navigate">navigated</span> as the browsing
+      context.</p>
+
+      <p>Let <var title="">result</var> be the return value of the
+      <i>initial code entry-point</i> of this <span
+      title="concept-script">script</span>. If an exception was
+      raised, let <var title="">result</var> be void instead.</p>
+
+     </dd>
+
+     <dt>If the <code>Document</code> object of the element,
+     attribute, or style sheet from which the <code>javascript:</code>
+     URL was reached has an associated <span>browsing
+     context</span></dt>
+
+     <dd>
+
+      <p><span>Create an impotent script</span> using the
+      aforementioned script source, with the scripting language set to
+      JavaScript, and with the <code>Document</code>'s object's
+      <span>browsing context</span> as the browsing context.</p>
+
+      <p>Let <var title="">result</var> be the return value of the
+      <i>initial code entry-point</i> of this <span
+      title="concept-script">script</span>. If an exception was
+      raised, let <var title="">result</var> be void instead.</p>
+
+     </dd>
 
-  <p>If the result of executing the script is void (there is no return
-  value), then the URL must be treated in a manner equivalent to an
-  HTTP resource with an HTTP 204 No Content response.</p>
+     <dt>Otherwise</dt>
 
-  <p>Otherwise, the URL must be treated in a manner equivalent to an
-  HTTP resource with a 200 OK response whose <span
-  title="Content-Type">Content-Type metadata</span> is <code
-  title="">text/html</code> and whose response body is the return
-  value converted to a string value.</p>
+     <dd>
 
-  <p class="note">Certain contexts, in particular <code>img</code>
-  elements, ignore the <span title="Content-Type">Content-Type
-  metadata</span>.</p>
+      <p>Let <var title="">result</var> be void.</p>
+
+     </dd>
+
+    </dl>
+
+   </li>
+
+   <li>
+
+    <p>If the result of executing the script is void (there is no
+    return value), then the URL must be treated in a manner equivalent
+    to an HTTP resource with an HTTP 204 No Content response.</p>
+
+    <p>Otherwise, the URL must be treated in a manner equivalent to an
+    HTTP resource with a 200 OK response whose <span
+    title="Content-Type">Content-Type metadata</span> is <code
+    title="">text/html</code> and whose response body is the return
+    value converted to a string value.</p>
+
+    <p class="note">Certain contexts, in particular <code>img</code>
+    elements, ignore the <span title="Content-Type">Content-Type
+    metadata</span>.</p>
+
+   </li>
+
+  </ol>
 
   <div class="example">
 
    <p>So for example a <code title="">javascript:</code> URL for a
    <code title="attr-img-src">src</code> attribute of an
    <code>img</code> element would be evaluated in the context of an
    empty object as soon as the attribute is set; it would then be
    sniffed to determine the image type and decoded as an image.</p>
 
    <p>A <code title="">javascript:</code> URL in an <code
@@ -38212,105 +38611,125 @@ JSURL: http://ietfreport.isoc.org/all-ids/draft-hoehrmann-javascript-scheme-00.t
 
    <p>The <code title="attr-iframe-src">src</code> attribute of an
    <code>iframe</code> element would be evaluated in the context of
    the <code>iframe</code>'s own <span>browsing context</span>; once
    evaluated, its return value (if it was not void) would replace that
    <span>browsing context</span>'s document, thus changing the
    variables visible in that <span>browsing context</span>.</p>
 
   </div>
 
-  <p class="note">The rules for handling script execution in a
-  <span>script execution context</span> include making the script not
-  execute (and just return void) in certain cases, e.g. in a sandbox
-  or when the user has disabled scripting altogether.</p>
+  <p class="note">The rules for <span title="create a script">creating
+  a script</span> include making the script not execute (and just
+  return void) in certain cases, e.g. in a sandbox or when the user
+  has disabled scripting altogether.</p>
 
 
   <h4>Events</h4>
 
   <p class="XXX">We need to define how to handle events that are
   to be fired on a Document that is no longer the active document of
   its browsing context, and for Documents that have no browsing
   context. Do the events fire? Do the handlers in that document not
   fire? Do we just define scripting to be disabled when the document
   isn't active, with events still running as is? See also the
   <code>script</code> element section, which says scripts don't run
   when the document isn't active.</p>
 
 
   <h5 id="event-handler-attributes">Event handler attributes</h5>
 
   <!-- http://software.hixie.ch/utilities/js/live-dom-viewer/?%3C!DOCTYPE%20html%3E%0A...%3Cscript%3E%0Aw(a%3Ddocument.implementation.createDocument(null%2C%20null%2C%20null))%3B%0Aw(a.appendChild(a.createElementNS('http%3A%2F%2Fwww.w3.org%2F1999%2Fxhtml'%2C%20'html')))%3B%0Aw(b%3Da.firstChild.appendChild(a.createElementNS('http%3A%2F%2Fwww.w3.org%2F1999%2Fxhtml'%2C%20'body')))%3B%0Aw(b.test%20%3D%20w)%3B%0Aw(b.setAttribute('onclick'%2C%20'test(%22fire%3A%20%22%20%2B%20event)'))%3B%0Aw(b.onclick)%3B%0Aw(e%3Da.createEvent('Event'))%3B%0Aw(e.initEvent('click'%2C%20false%2C%20false))%3B%0Aw(b.dispatchEvent(e))%3B%0A%3C%2Fscript%3E -->
 
-  <p><span>HTML elements</span> can have <dfn>event handler
-  attributes</dfn> specified. These act as bubbling event listeners
-  for the element on which they are specified.</p>
+  <p>Many objects can have <dfn>event handler attributes</dfn>
+  specified. These act as bubbling event listeners for the element on
+  which they are specified.</p>
 
-  <p>Each event handler attribute has two parts, an <span title="event
-  handler content attributes">event handler content attribute</span>
-  and an <span title="event handler DOM attributes">event handler DOM
-  attribute</span>. Event handler attributes must initially be set to
-  null. When their value changes (through the changing of their event
-  handler content attribute or their event handler DOM attribute),
-  they will either be null, or have an <code>EventListener</code>
-  object assigned to them.</p>
+  <p>On <span>HTML elements</span>, each event handler attribute has
+  two parts, an <span title="event handler content attributes">event
+  handler content attribute</span> and an <span title="event handler
+  DOM attributes">event handler DOM attribute</span>. Event handler
+  attributes must initially be set to null. When their value changes
+  (through the changing of their event handler content attribute or
+  their event handler DOM attribute), they will either be null, or
+  have an <code>EventListener</code> object assigned to them.</p>
 
   <p>Objects other than <code>Element</code> objects, in particular
   <code>Window</code>, only have <span title="event handler DOM
   attributes">event handler DOM attribute</span> (since they have no
   content attributes).</p>
 
+  <hr>
+
   <p><dfn>Event handler content attributes</dfn>, when specified, must
   contain valid ECMAScript code matching the ECMAScript <code
   title="">FunctionBody</code> production. <a
   href="#refsECMA262">[ECMA262]</a></p>
 
   <!-- SCRIPT EXEC -->
   <p>When an event handler content attribute is set, if the element is
   owned by a <code>Document</code> that is in a <span>browsing
-  context</span>, its new value must be interpreted as the body of an
-  anonymous function with a single argument called <code>event</code>,
-  with the new function's scope chain being linked from the activation
-  object of the handler, to the element, to the element's
-  <code>form</code> element if it is a form control, to the
-  <code>Document</code> object, to the <code>Window</code> object of
-  the <span>browsing context</span> of that <code>Document</code>. The
-  function's <code>this</code> parameter must be the
-  <code>Element</code> object representing the element. The resulting
-  function must then be set as the value of the corresponding event
-  handler attribute, and the new value must be set as the value of the
-  content attribute. If the given function body fails to compile, then
-  the corresponding event handler attribute must be set to null
-  instead (the content attribute must still be updated to the new
-  value, though).</p>
-
-  <p class="note">See ECMA262 Edition 3, sections 10.1.6 and 10.2.3,
-  for more details on activation objects. <a
-  href="#refsECMA262">[ECMA262]</a></p>
+  context</span>, the user agent must run the following steps to
+  create a <span title="concept-script">script</span> after setting
+  the content attribute to its new value:</p>
+
+  <ol>
+
+   <li><p>Set up a <span>script execution environment</span> for
+   JavaScript.</p></li>
+
+   <li><p>Using this script execution environment, interpret the
+   attribute's new value as the body of an anonymous function with a
+   single argument called <code>event</code>. Link the new function's
+   scope chain from the activation object of the handler, to the
+   element's object, to the element's <span>form owner</span>, if it
+   has one, to the element's <code>Document</code> object, to the
+   <code>Window</code> object of the <span>browsing context</span> of
+   that <code>Document</code>. Set the function's <code>this</code>
+   parameter to the <code>Element</code> object representing the
+   element. Let this function be the only entry in the script's
+   <span>list of code entry-points</span>.</p>
+
+   <p class="note">See ECMA262 Edition 3, sections 10.1.6 and 10.2.3,
+   for more details on activation objects. <a
+   href="#refsECMA262">[ECMA262]</a></p></li>
+
+   <li><p>If the previous steps failed to compile the script, then set
+   the corresponding event handler attribute to null and abort these
+   steps.</p></li>
+
+   <li><p>Set up the <span>script's global object</span>, the
+   <span>script's browsing context</span>, the <span>script's
+   character encoding</span>, and the <span>script's base URL</span>
+   from <span>the script settings determined from the node</span> on
+   which the attribute is being set, and add the <span title="concept-script">script</span> to the
+   <span>script group</span> determined from that node as
+   well.</p></li>
 
-  <p>The <span>script execution context</span> of the event handler
-  must be the <code>Window</code> object at the end of the scope
-  chain. The <span>script document context</span> of the event handler
-  must be the <code>Document</code> object that owns the event handler
-  content attribute that was set.</p>
+   <li><p>Set the corresponding event handler attribute to the
+   aforementioned function.</p></li>
 
-  <p>When an event handler content attribute is set on an element
-  owned by a <code>Document</code> that is not in a <span>browsing
-  context</span>, the corresponding event handler attribute is not
-  changed.</p>
+  </ol>
+
+  <p class="note">When an event handler content attribute is set on an
+  element owned by a <code>Document</code> that is not in a
+  <span>browsing context</span>, the corresponding event handler
+  attribute is not changed.</p>
 
   <p class="note">Removing an event handler content attribute does not
-  reset the corresponding event handler attribute either.</p>
+  reset the corresponding event handler attribute.</p>
   <!-- http://software.hixie.ch/utilities/js/live-dom-viewer/?%3C!DOCTYPE%20html%3E%0A...%3Cbody%20onload%3D%22w(%27pass%27)%22%3E%0A%3Cscript%3Edocument.body.removeAttribute(%27onload%27)%3B%3C%2Fscript%3E -->
 
   <p class="XXX">How do we allow non-JS event handlers?</p>
 
+  <hr>
+
   <p><dfn>Event handler DOM attributes</dfn>, on setting, must set the
   corresponding event handler attribute to their new value, and on
   getting, must return whatever the current value of the corresponding
   event handler attribute is (possibly null).</p>
 
   <p>The following are the event handler attributes that must be
   supported by all <span>HTML elements</span>, as both content
   attributes and DOM attributes, and on <code>Window</code> objects,
   as DOM attributes:</p>
 
@@ -38548,31 +38967,50 @@ JSURL: http://ietfreport.isoc.org/all-ids/draft-hoehrmann-javascript-scheme-00.t
    <dt><dfn title="handler-onsubmit"><code>onsubmit</code></dfn></dt> <!-- widely used -->
 
    <dd><p>Must be invoked whenever a <code
    title="event-submit">submit</code> event is targeted at or bubbles
    through the element.</p></dd>
 
    <dt><dfn title="handler-onunload"><code>onunload</code></dfn></dt> <!-- widely used -->
 
    <dd><p>Must be invoked whenever an <code
    title="event-unload">unload</code> event is targeted at or bubbles
-   through the element.</p></dd> <!-- XXX need to fire this -->
+   through the element.</p></dd>
 
   </dl>
 
   <p>When an event handler attribute is invoked, its argument must be
-  set to the <code>Event</code> object of the event in question. If
-  the function returns the exact boolean value false, the event's
-  <code>preventDefault()</code> method must then invoked. Exception:
-  for historical reasons, for the HTML <code>mouseover</code> event,
-  the <code>preventDefault()</code> method must be called when the
-  function returns true instead.</p>
+  set to the <code>Event</code> object of the event in question.</p>
+
+  <p>The handler's return value must be processed as follows:</p>
+
+  <dl class="switch">
+
+   <dt>If the event type is <code class="event-mouseover">mouseover</code></dt>
+
+   <dd><p>If the return value is a boolean with the value true, then
+   the event must be canceled.</p></dd>
+
+   <dt>If the event object is a <code>BeforeUnloadEvent</code> object</dt>
+
+   <dd><p>If the return value is a string, and the event object's
+   <code title="dom-BeforeUnloadEvent-returnValue">returnValue</code>
+   attribute's value is the empty string, then set the <code
+   title="dom-BeforeUnloadEvent-returnValue">returnValue</code>
+   attribute's value to the return value.</p></dd>
+
+   <dt>Otherwise</dt>
+
+   <dd><p>If the return value is a boolean with the value false, then
+   the event must be canceled.</p></dd>
+
+  </dl>
 
   <!-- IE actually uncancels the event if the function returns true -->
 
   <p>All event handler attributes on an element, whether set to null
   or to a function, must be registered as event listeners on the
   element, as if the <code
   title="dom-EventTarget-addEventListenerNS">addEventListenerNS()</code>
   method on the <code>Element</code> object's <code>EventTarget</code>
   interface had been invoked when the element was created, with the
   event type (<var title="dom-event-type">type</var> argument) equal
@@ -38913,21 +39351,21 @@ JSURL: http://ietfreport.isoc.org/all-ids/draft-hoehrmann-javascript-scheme-00.t
     <ul>
 
      <li>are part of the same <span>unit of related browsing
      contexts</span> as the browsing context of the
      <code>Window</code> object on which the <code
      title="dom-showModalDialog">showModalDialog()</code> method was
      called, and that</li>
 
      <li>have an <span>active document</span> whose
      <span>origin</span> is the <span title="same origin">same</span>
-     as the <span>origin</span> of the script that called the <code
+     as the <span>origin</span> of the <span title="concept-script">script</span> that called the <code
      title="dom-showModalDialog">showModalDialog()</code> method at
      the time the method was called,</li> <!-- Note that changing
      document.domain to talk to another domain doesn't make you able
      to block that domain -->
 
     </ul>
 
     <p>...as well as any browsing contexts that are nested inside any
     of the browsing contexts matching those conditions.</p>
 
@@ -38962,32 +39400,32 @@ JSURL: http://ietfreport.isoc.org/all-ids/draft-hoehrmann-javascript-scheme-00.t
    <li>
 
     <p>Let the <span>dialog arguments</span> of the new browsing
     context be set to the value of <var title="">arguments</var>.</p>
 
    </li>
 
    <li>
 
     <p>Let the <span>dialog arguments' origin</span> be the
-    <span>origin</span> of the script that called the <code
+    <span>origin</span> of the <span title="concept-script">script</span> that called the <code
     title="dom-showModalDialog">showModalDialog()</code> method.</p>
 
    </li>
 
    <li>
 
     <p><span>Navigate</span> the new browsing context to <var
     title="">url</var>, with <span>replacement enabled</span>, and
-    with the <span>script browsing context</span> of the script that
-    invoked the method as the <span>source browsing
-    context</span>.</p>
+    with the <span title="script's browsing context">browsing
+    context</span> of the <span title="concept-script">script</span> that invoked the method as the
+    <span>source browsing context</span>.</p>
 
    </li>
 
    <li>
 
     <p>Wait for the browsing context to be closed. (The user agent
     must allow the user to indicate that the browsing context is to be
     closed.)</p>
 
    </li>
@@ -39082,32 +39520,33 @@ JSURL: http://ietfreport.isoc.org/all-ids/draft-hoehrmann-javascript-scheme-00.t
   notification sources. Then, mail.example.org and
   calendar.example.org would both be able to show notifications,
   without the user having to flag them individually.</p>
 
   <p>The <dfn title="dom-showNotification"><code>showNotification(<var
   title="">title</var>, <var title="">subtitle</var>, <var
   title="">description</var>, <var
   title="">onclick</var>)</code></dfn> method, when invoked, must
   cause the user agent to show a notification.</p>
 
-  <p id="sandboxNotifications">If the method was invoked from a script
-  whose <span>script browsing context</span> has the <span>sandboxed
-  annoyances browsing context flag</span> set, then the notification
-  must be shown within that <span>browsing context</span>. The
-  notification is said to be a <dfn>sandboxed notification</dfn>.</p>
-
-  <p>Otherwise, if the <span>origin</span> of the <span>script
-  browsing context</span> of the script that invoked the method is
-  <em>not</em> flagged as being a <span>trusted notification
-  source</span>, then the notification should be rendered within the
-  <span>top-level browsing context</span> of the <span>script browsing
-  context</span> of the script that invoked the method. The
+  <p id="sandboxNotifications">If the method was invoked from a <span title="concept-script">script</span>
+  whose <span title="script's browsing context">browsing
+  context</span> has the <span>sandboxed annoyances browsing context
+  flag</span> set, then the notification must be shown within that
+  <span>browsing context</span>. The notification is said to be a
+  <dfn>sandboxed notification</dfn>.</p>
+
+  <p>Otherwise, if the <span>origin</span> of the <span
+  title="script's browsing context">browsing context</span> of the
+  <span title="concept-script">script</span> that invoked the method is <em>not</em> flagged as being a
+  <span>trusted notification source</span>, then the notification
+  should be rendered within the <span>top-level browsing
+  context</span> of the <span>script's browsing context</span>. The
   notification is said to be a <dfn>normal notification</dfn>. User
   agents should provide a way to set the origin's <span>trusted
   notification source</span> flag from the notification, so that the
   user can benefit from notifications even when the user agent is not
   the active application.</p>
 
   <p>Otherwise, the <span>origin</span> is flagged as a <span>trusted
   notification source</span>, and the notification should be shown
   using the platform conventions for system-wide notifications. The
   notification is said to be a <dfn>trusted notification</dfn>. User
@@ -39142,30 +39581,30 @@ JSURL: http://ietfreport.isoc.org/all-ids/draft-hoehrmann-javascript-scheme-00.t
    from the bottom right corner. In others, notifications are shown as
    semi-transparent white-on-grey overlays centered over the
    screen. Other schemes could include simulated ticker tapes, and
    speech-synthesis playback.</p>
 
   </div>
 
   <p>When a <span>normal notification</span> (but not a
   <span>sandboxed notification</span>) is shown, the user agent may
   bring the user's attention to the <span>top-level browsing
-  context</span> of the <span>script browsing context</span> of the
-  script that invoked the method, if that would be useful; but user
-  agents should not use system-wide notification mechanisms to do
-  so.</p>
+  context</span> of the <span title="script's browsing
+  context">browsing context</span> of the <span title="concept-script">script</span> that invoked the
+  method, if that would be useful; but user agents should not use
+  system-wide notification mechanisms to do so.</p>
 
   <p>When a <span>trusted notification</span> is shown, the user agent
-  should bring the user's attention to the notification and the
-  <span>script browsing context</span> of the script that invoked the
-  method, as per the platform conventions for attracting the user's
-  attention to applications.</p>
+  should bring the user's attention to the notification and the <span
+  title="script's browsing context">browsing context</span> of the
+  <span title="concept-script">script</span> that invoked the method, as per the platform conventions for
+  attracting the user's attention to applications.</p>
 
   <div class="example">
 
    <p>In the case of <span title="normal notification">normal
    notifications</span>, typically the only attention-grabbing device
    that would be employed would be something like flashing the tab's
    caption, or making it bold, or some such.</p>
 
    <p>In addition, in the case of a <span>trusted notification</span>,
    the entire window could flash, or the browser's application icon
@@ -39178,22 +39617,23 @@ JSURL: http://ietfreport.isoc.org/all-ids/draft-hoehrmann-javascript-scheme-00.t
 
   <ul>
 
    <li>The <var title="">title</var>, <var title="">subtitle</var>,
    and <var title="">description</var> strings passed to the
    method. They may be truncated or abbreviated if necessary.</li>
 
    <li>The <span title="meta-application-name">application
    name</span>, if available, or else the <span
    title="dom-document-title">document title</span>, of the
-   <span>active document</span> of the <span>script browsing
-   context</span> of the script that invoked the method.</li>
+   <span>active document</span> of the <span title="script's browsing
+   context">browsing context</span> of the <span title="concept-script">script</span> that invoked the
+   method.</li>
 
    <li>An icon chosen from the <span title="external resource
    link">external resource links</span> of type <code
    title="rel-icon">icon</code>, if any are available.</li>
 
   </ul>
 
   <p>If a new notification from one <span>browsing context</span> has
   <var title="">title</var>, <var title="">subtitle</var>, and <var
   title="">description</var> strings that are identical to the <var
@@ -39222,25 +39662,26 @@ JSURL: http://ietfreport.isoc.org/all-ids/draft-hoehrmann-javascript-scheme-00.t
   to see it, so if a notification is spawned for a <span>browsing
   context</span> that is hidden, it should be shown for its complete
   lifetime once the user brings that <span>browsing context</span>
   into view.</p>
 
   <p>User agents should support multiple notifications at once.</p>
 
   <p>User agents should support user interaction with notifications,
   if and as appropriate given the platform conventions. If a user
   activates a notification, and the <var title="">onclick</var>
-  callback argument was present and is not null, then the <span>script
-  browsing context</span> of the function given by <var
-  title="">onclick</var> should be brought to the user's attention,
-  and the <var title="">onclick</var> callback should then be
-  invoked.</p>
+  callback argument was present and is not null, then the <span
+  title="script's browsing context">browsing context</span> of the
+  <span title="concept-script">script</span> of the function given by
+  <var title="">onclick</var> should be brought to the user's
+  attention, and the <var title="">onclick</var> callback should then
+  be invoked.</p>
 
 
 
   <h3>System state and capabilities</h3>
 
   <p>The <dfn title="dom-navigator"><code>navigator</code></dfn>
   attribute of the <code>Window</code> interface must return an
   instance of the <code>Navigator</code> interface, which represents
   the identity and state of the user agent (the client), and allows
   Web pages to register themselves as potential protocol and content
@@ -39418,23 +39859,22 @@ JSURL: http://ietfreport.isoc.org/all-ids/draft-hoehrmann-javascript-scheme-00.t
 
    <dt><var title="">url</var></dt>
 
    <dd>
 
     <p>The <span>URL</span> of the page that will handle the
     requests. When the user agent uses this URL, it must replace the
     first occurrence of the exact literal string "<code>%s</code>"
     with an escaped version of the URL of the content in question (as
     defined below), then <span title="resolve a url">resolve</span>
-    the resulting URL (using the <span>document base URL</span> of the
-    <span>script document context</span> of the script that originally
-    invoked the <code
+    the resulting URL (using the <span title="script's base URL">base
+    URL</span> of the script that originally invoked the <code
     title="dom-navigator-registerContentHandler">registerContentHandler()</code>
     or <code
     title="dom-navigator-registerProtocolHandler">registerProtocolHandler()</code>
     method), and then <span>fetch</span> the resulting URL using the
     GET method (<span title="concept-http-equivalent-get">or
     equivalent</span> for non-HTTP URLs).</p>
 
     <p>To get the escaped version of the URL of the content in
     question, the user agent must <span title="resolve a
     URL">resolve</span> the URL, and then every character in the URL
@@ -41832,22 +42272,23 @@ style/default.css</pre>
 
   <p>When the <dfn title="dom-location-replace"><code>replace(<var
   title="">url</var>)</code></dfn> method is invoked, the UA must
   <span>navigate</span> the <span>browsing context</span> to the
   specified <var title="">url</var> with <span>replacement
   enabled</span>.</p>
 
   <p>Navigation for the <code
   title="dom-location-assign">assign()</code> and <code
   title="dom-location-replace">replace()</code> methods must be done
-  with the <span>script browsing context</span> of the script that
-  invoked the method as the <span>source browsing context</span>.</p>
+  with the <span title="script's browsing context">browsing
+  context</span> of the script that invoked the method as the
+  <span>source browsing context</span>.</p>
 
 <!--XXX
   <dfn title="dom-location-reload"><code>reload()</code></dfn>
   reload during resize event:
   redisplay the current page (without reloading it). This
   theoretically would have no effect but in practice can be useful to
   work around rendering bugs.
 
 reload on shared Document updates all of them
 
@@ -42083,21 +42524,21 @@ user reload must be equivalent to .reload()
    </li>
 
    <li>
 
     <p>If fetching the resource is synchronous (i.e. for <span
     title="javascript protocol"><code title="">javascript:</code>
     URLs</span> and <code>about:blank</code>), then this must be
     synchronous, but if fetching the resource depends on external
     resources, as it usually does for URLs that use HTTP or other
     networking protocols, then at this point the user agents must
-    yield to whatever script invoked the navigation steps, if they
+    yield to whatever <span title="concept-script">script</span> invoked the navigation steps, if they
     were invoked by script.</p>
 
    </li>
 
    <li>
 
     <p>If fetching the resource results in a redirect, return to <a
     href="#navigate-fragid-step">the step labeled "fragment
     identifiers"</a> with the new resource.</p>
 
@@ -42272,32 +42713,24 @@ user reload must be equivalent to .reload()
   history with the new page</dfn>. When a user agent is required to do
   this, it must follows the set of steps given below that is
   appropriate for the situation at hand. From the point of view of any
   script, these steps must occur atomically.</p>
 
   <ol>
 
    <li><p class="XXX">pause for scripts -- but don't use the
    "pause" definition since that involves not running script!</p></li>
 
-   <li><p class="XXX">onbeforeunload, and if present set flag that we will kill document</p></li>
-   <!--
-   when we define onbeforeunload, then we have to say that the JS
-   implementation of EventListener::handleEvent checks for that event,
-   treating the return value as the string to use for the unload warning
-   message if there is a return value, and calling preventDefault if
-   there isn't.
-   -->
-
-   <li><p class="XXX">onunload, and if present set flag that we will kill document</p></li>
-
-   <li><p class="XXX">if flag is set: <span title="discard a document">discard the <code>Document</code></span></p></li>
+   <li><p><span title="unload a document">Unload</span> the
+   <code>Document</code> object of the <span>current entry</span>,
+   with the <var title="">recycle</var> parameter set to
+   false.</p></li>
 
    <li>
 
     <dl>
 
      <dt>If the navigation was initiated for <dfn>entry update</dfn> of
      an entry</dt>
 
      <dd>
 
@@ -42685,22 +43118,22 @@ user reload must be equivalent to .reload()
    <p class="example">For example, some user agents might want to
    persist the scroll position, or the values of form controls.</p>
    </li>
 
    <li><p>If the <i>specified entry</i> has a different
    <code>Document</code> object than the <span>current entry</span>
    then the user agent must run the following substeps:</p>
 
     <ol>
 
-     <li class="XXX">freeze any timers, intervals,
-     XMLHttpRequests, database transactions, etc</li>
+     <li>Freeze the <span>active document</span>'s <span>current
+     script group</span>.</li>
 
      <li>The user agent must move any properties that have been added
      to the browsing context's default view's <code>Window</code>
      object to the <span>active document</span>'s
      <code>Document</code>'s <span>list of added
      properties</span>.</li>
 
      <li>If the browsing context is a <span>top-level browsing
      context</span> (and not an <span>auxiliary browsing
      context</span>), and the <span>origin</span> of the
@@ -42749,22 +43182,22 @@ user reload must be equivalent to .reload()
 
       </ol>
 
      </li>
 
      <li>The user agent must move any properties that have been added
      to the <span>active document</span>'s <code>Document</code>'s
      <span>list of added properties</span> to browsing context's
      default view's <code>Window</code> object.</li>
 
-     <li class="XXX">unfreeze any timers, intervals,
-     XMLHttpRequests, database transactions, etc</li>
+     <li>Unfreeze the <span>active document</span>'s <span>current
+     script group</span>.</li>
 
     </ol>
 
    </li>
 
    <li><p>If there are any entries with state objects between the
    <span>last activated entry</span> for the <code>Document</code> of
    the <i>specified entry</i> and the <i>specified entry</i> itself
    (not inclusive), then the user agent must iterate through every
    entry between that <span>last activated entry</span> and the
@@ -42794,37 +43227,104 @@ user reload must be equivalent to .reload()
 
    <li><p>The <span>current entry</span> is now the <i>specified
    entry</i>.</p></li>
 
   </ol>
 
   <p class="XXX">how does the changing of the global attributes
   affect .watch() when seen from other Windows?</p>
 
 
-  <h4>Closing a browsing context</h4>
 
-  <p class="XXX">Closing a browsing context and discarding it
-  (vs closing it and keeping it around in memory).</p>
+  <h4>Unloading documents</h4>
+
+  <p>When a user agent is to <dfn>unload a document</dfn>, it must run
+  the following steps. These steps are passed an argument, <var
+  title="">recycle</var>, which is either true or false, indicating
+  whether the <code>Document</code> object is going to be
+  re-used. (This is set by the <code
+  title="dom-document-open">document.open()</code> method.)</p>
+
+  <ol>
+
+   <li><p>Set <var title="">salvageable</var> to true.</p></li>
+
+   <li><p>Let <var title="">event</var> be a new
+   <code>BeforeUnloadEvent</code> event object with the name <code
+   title="event-beforeunload">beforeunload</code>, with no namespace,
+   which does not bubble but is cancelable.</p></li>
+
+   <li><p>Dispatch <var title="">event</var> at <span>the
+   <code>body</code> element</span>.</p></li>
+
+   <li><p>If any event listeners were triggered by the previous step,
+   then set <var title="">salvageable</var> to false.</p></li>
+
+   <li>
+
+    <p>If the <code
+    title="dom-BeforeUnloadEvent-returnValue">returnValue</code>
+    attribute of the <var title="">event</var> object is not the empty
+    string, or if the event was canceled, then the user agent should
+    ask the user to confirm that they wish to unload the document.</p>
+
+    <p>The prompt shown by the user agent may include the string of
+    the <code
+    title="dom-BeforeUnloadEvent-returnValue">returnValue</code>
+    attribute, or some leading subset thereof. (A user agent may want
+    to truncate the string to 1024 characters for display, for
+    instance.)</p>
 
-  <p class="XXX">when a browsing context is closed, all session
-  history entries' <code>Document</code> objects must be
-  discarded.</p>
+    <p>The user agent must <span>pause</span> while waiting for the
+    user's response.</p>
 
-  <p class="XXX">When a user agent is to <dfn>discard a
-  <code>Document</code></dfn>, any frozen timers, intervals,
-  XMLHttpRequests, database transactions, etc, must be killed, and any
-  MessagePorts owned by the Window object must be
-  unentangled.</p>
+    <p>If the user <dfn>refused to allow the document to be
+    unloaded</dfn> then these steps must be aborted.</p>
 
-  <p class="XXX">Also, <code title="event-unload">unload</code>
-  events should fire.</p>
+   </li>
+
+   <li><p><span>Fire a simple event</span> called <code
+   title="event-unload">unload</code> at <span>the <code>body</code>
+   element</span>.</p></li>
+
+   <li><p>If any event listeners were triggered by the previous step,
+   then set <var title="">salvageable</var> to false.</p></li>
+
+   <li><p>If there are any outstanding transactions that have
+   callbacks that involve <span title="concept-script">scripts</span>
+   that are in the document's <span>current script group</span>, roll
+   them back (without invoking any of the callbacks) and set <var
+   title="">salvageable</var> to false.</p>
+
+   <li><p>If <var title="">salvageable</var> and <var
+   title="">recycle</var> are both false, <span title="discard a
+   document">discard the <code>Document</code></span>.</p></li>
+
+  </ol>
+
+
+
+  <h5>Event definition</h5>
+
+  <pre class="idl">interface <dfn>BeforeUnloadEvent</dfn> : Event {
+           attribute DOMString <span title="dom-BeforeUnloadEvent-returnValue">returnValue</span>;
+};</pre>
+
+  <p class="note">There are no <code>BeforeUnloadEvent</code>-specific
+  initialization methods.</p>
+
+  <p>The <dfn
+  title="dom-BeforeUnloadEvent-returnValue"><code>returnValue</code></dfn>
+  attribute represents the message to show the user. When the event is
+  created, the attribute must be set to the empty string. On getting,
+  it must return the last value it was set to. On setting, the
+  attribute must be set to the new value.</p>
 
 
 
 
   <h3>Structured client-side storage</h3>
 
   <h4 id="storage">Storing name/value pairs</h4>
 
   <h5>Introduction</h5>
 
@@ -43073,28 +43573,28 @@ user reload must be equivalent to .reload()
   be associated with that <span>origin</span>'s session storage area
   for that <span>top-level browsing context</span>.</p>
 
   <p>When a new <span>top-level browsing context</span> is created by
   cloning an existing <span>browsing context</span>, the new browsing
   context must start with the same session storage areas as the
   original, but the two sets must from that point on be considered
   separate, not affecting each other in any way.</p>
 
   <p>When a new <span>top-level browsing context</span> is created by
-  a script in an existing <span>browsing context</span>, or by the
-  user following a link in an existing browsing context, or in some
-  other way related to a specific <code>HTMLDocument</code>, then the
-  session storage area of the <span>origin</span> of that
-  <code>HTMLDocument</code> must be copied into the new browsing
-  context when it is created.  From that point on, however, the two
-  session storage areas must be considered separate, not affecting
-  each other in any way.</p>
+  a <span title="concept-script">script</span> in an existing
+  <span>browsing context</span>, or by the user following a link in an
+  existing browsing context, or in some other way related to a
+  specific <code>HTMLDocument</code>, then the session storage area of
+  the <span>origin</span> of that <code>HTMLDocument</code> must be
+  copied into the new browsing context when it is created.  From that
+  point on, however, the two session storage areas must be considered
+  separate, not affecting each other in any way.</p>
 
   <p id="sessionStorageEvent">When the <code
   title="dom-Storage-setItem">setItem()</code>, <code
   title="dom-Storage-removeItem">removeItem()</code>, and <code
   title="dom-Storage-clear">clear()</code> methods are called on a
   <code>Storage</code> object <var title="">x</var> that is associated
   with a session storage area, then in every <code>HTMLDocument</code>
   object whose <code>Window</code> object's <code
   title="dom-sessionStorage">sessionStorage</code> attribute's
   <code>Storage</code> object is associated with the same storage
@@ -50199,25 +50699,25 @@ interface <dfn>MessageChannel</dfn> {
   readonly attribute <span>MessagePort</span> <span title="dom-channel-port2">port2</span>;
 };</pre>
 
   <p>When the <dfn
   title="dom-MessageChannel"><code>MessageChannel()</code></dfn>
   constructor is called, it must run the following algorithm:</p>
 
   <ol>
 
    <li><p><span>Create a new <code>MessagePort</code> object</span>
-   owned by the <span>script execution context</span>, and let <var
+   owned by the <span>script's global object</span>, and let <var
    title="">port1</var> be that object.</p></li>
 
    <li><p><span>Create a new <code>MessagePort</code> object</span>
-   owned by the <span>script execution context</span>, and let <var
+   owned by the <span>script's global object</span>, and let <var
    title="">port2</var> be that object.</p></li>
 
    <li><p><span>Entangle</span> the <var title="">port1</var> and <var
    title="">port2</var> objects.</p></li>
 
    <li><p>Instantiate a new <code>MessageChannel</code> object, and
    let <var title="">channel</var> be that object.</p></li>
 
    <li><p>Let the <code title="dom-channel-port1">port1</code>
    attribute of the <var title="">channel</var> object be <var
@@ -50258,22 +50758,22 @@ interface <dfn>MessageChannel</dfn> {
   <p>Objects implementing the <code>MessagePort</code> interface must
   also implement the <code>EventTarget</code> interface.</p>
 
   <p>Each <code>MessagePort</code> object can be entangled with
   another (a symmetric relationship). Each <code>MessagePort</code>
   object also has a <dfn>port message queue</dfn>, initial empty. A
   <span>port message queue</span> can be open or closed, and is
   initially closed.</p>
 
   <p>When the user agent is to <dfn>create a new
-  <code>MessagePort</code> object</dfn> owned by a <span>script
-  execution context</span> object <var title="">owner</var>, it must
+  <code>MessagePort</code> object</dfn> owned by a <span>script's
+  global object</span> object <var title="">owner</var>, it must
   instantiate a new <code>MessagePort</code> object, and let its owner
   be <var title="">owner</var>.</p>
 
   <hr>
 
   <p>When the user agent is to <dfn>entangle</dfn> two
   <code>MessagePort</code> objects, it must run the following
   steps:</p>
 
   <ol>
@@ -50421,21 +50921,21 @@ interface <dfn>MessageChannel</dfn> {
   title="dom-MessagePort-postMessage">postMessage()</code> with one of
   the new ports. When invoked on a port <var title="">source
   port</var>, it must run the following steps:</p>
 
   <ol>
 
    <li><p>Let <var title="">message</var> be the method's first
    argument.</p></li>
 
    <li><p><span>Create a new <code>MessagePort</code> object</span>
-   owned by the <span>script execution context</span>, and let <var
+   owned by the <span>script's global object</span>, and let <var
    title="">port1</var> be that object.</p></li>
 
    <li><p>If the <var title="">source port</var> is not entangled with
    another port, then return <var title="">port1</var> and abort these
    steps.</p></li>
    <!- - we don't raise an exception because this can happen moment's
    notice. listen to onclose if you want to know when things start
    going wonky. (We don't return null because then we'd end up with
    null derefs. better to just let the likely next postMessage call
    fall on the floor) - ->
@@ -50560,31 +51060,31 @@ interface <dfn>MessageChannel</dfn> {
    <dd><p>Must be invoked whenever an <code
    title="event-close">close</code> event is targeted at or bubbles
    through the <code>MessagePort</code> object.</p></dd>
 
   </dl>
 
 
 
 
 
-  <h5>Ports and browsing contexts</h5>
+  <h5 id="message-port-discarding">Ports and browsing contexts</h5>
 
   <p>When a <code>Document</code> is <span title="discard a
   document">discarded</span>, if there are any
   <code>MessagePort</code> objects that:</p>
 
   <ul class="brief">
    <li>are entangled, and</li>
    <li>are owned by the <span>browsing context</span> that contained that <code>Document</code>, and</li>
    <li>were created while that <code>Document</code> was the <span>active document</span> of that <span>browsing context</span>, and</li>
-   <li>are entangled with a port that is either not owned by that <span>browsing context</span> or was not created while that <code>Document</code> was the <span>active document</span> of that <span>browsing context</span>,</li>
+   <li>are entangled with a port that is either not owned by that <span>browsing context</span>, or were not created while that <code>Document</code> was the <span>active document</span> of that <span>browsing context</span>,</li>
   </ul>
 
   <p>...then the user agent must run the following steps for each such
   port:</p>
 
   <ol>
 
    <li><p>Let <var title="">surviving port</var> be the port with
    which the <code>MessagePort</code> object in question is
    entangled.</p></li>
@@ -52707,24 +53207,24 @@ interface <dfn>MessageChannel</dfn> {
 
   <p>The <span><code title="">form</code> element pointer</span>
   points to the last <code>form</code> element that was opened and
   whose end tag has not yet been seen. It is used to make form
   controls associate with forms in the face of dramatically bad
   markup, for historical reasons.</p>
 
 
   <h5>The scripting state</h5>
 
-  <p>The <dfn>scripting flag</dfn> is set to "enabled" if the
-  <code>Document</code> with which the parser is associated was
-  <span>with script</span> when the parser was created, and "disabled"
-  otherwise.</p>
+  <p>The <dfn>scripting flag</dfn> is set to "enabled" if the <span
+  title="concept-n-script">scripting was enabled</span> for the
+  <code>Document</code> with which the parser is associated when the
+  parser was created, and "disabled" otherwise.</p>
 
 
   <h4><dfn>Tokenization</dfn></h4>
 
   <p>Implementations must act as if they used the following state
   machine to tokenise HTML. The state machine must start in the
   <span>data state</span>. Most states consume a single character,
   which may have various side-effects, and either switches the state
   machine to a new state to <em>reconsume</em> the same character, or
   switches it to a new state (to consume the next character), or
@@ -58956,22 +59456,25 @@ interface <dfn>TimeoutHandler</dfn> {
   title="">language</var>])</code></dfn> may be used. This variant
   takes a string instead of a <code>TimeoutHandler</code>
   object. <span class="XXX">define the actual requirements for
   this method, as with the previous one.</span> That string must be
   parsed using the specified <var title="">language</var> (defaulting
   to ECMAScript if the third argument is omitted) and executed in the
   scope of the <span>browsing context</span> associated with the
   <code>Window</code> object on which the <code
   title="setTimeout">setTimeout()</code> method was invoked.</p>
 
-  <p class="XXX">Need to define <var title="">language</var>
-  values.</p>
+  <p class="XXX">Need to define <var title="">language</var> values;
+  need to define that the <span title="concept-script">script</span>
+  corresponding to the <var title="">code</var> argument is created
+  before the timer is set up, so that the rule on pausing the ticker,
+  below, makes sense.</p>
 
   <p>The <dfn
   title="dom-windowtimers-setInterval"><code>setInterval(...)</code></dfn>
   variants must work in the same way as the <code>setTimeout</code>
   variants except that if <var title="">timeout</var> is a value
   greater than zero, the <span title="concept-task">task</span> that
   invokes the <var title="">handler</var> or <code>code</code> must be
   <span title="queue a task">queued</span> again every <var
   title="">timeout</var> milliseconds, not just the once.</p> <!-- so
   setInterval(x) and setInterval(x, 0) are equivalent to setTimeout(x)
@@ -58981,20 +59484,27 @@ interface <dfn>TimeoutHandler</dfn> {
   title="dom-windowtimers-clearTimeout"><code>clearTimeout()</code></dfn>
   and <dfn
   title="dom-windowtimers-clearInterval"><code>clearInterval()</code></dfn>
   methods take one integer (the value returned by <code
   title="dom-windowtimers-setTimeout">setTimeout()</code> and <code
   title="dom-windowtimers-setInterval">setInterval()</code>
   respectively) and must cancel the specified timeout. When called
   with a value that does not correspond to an active timeout or
   interval, the methods must return without doing anything.</p>
 
+  <p>For both <code
+  title="dom-windowtimers-setTimeout">setTimeout()</code> and <code
+  title="dom-windowtimers-setInterval">setInterval()</code>, the clock
+  upon which the timers are based must only tick while the
+  <span>script group</span> of their callbacks is not
+  <i>frozen</i>.</p>
+
 
 
   <h3>Rendering and the DOM</h3>
 
   <p class="XXX">This section is expected to be moved to its own
   specification in due course. It needs a lot of work to actually make
   it into a semi-decent spec.</p>
 
   <p>Any object implement the <code>AbstractView</code> interface must
   also implement the <code>MediaModeAbstractView</code> interface.</p>

|