HTML

When perform a security check is invoked, with a platformObject, identifier, and type, run these steps:

1. If platformObject is not a Window or Location object, then return.

2. For each e of CrossOriginProperties(platformObject):

   1. If SameValue(e.[[Property]], identifier) is true, then:

      1. If type is "method" and e has neither [[NeedsGet]] nor [[NeedsSet]], then return.

      2. Otherwise, if type is "getter" and e.[[NeedsGet]] is true, then return.

      3. Otherwise, if type is "setter" and e.[[NeedsSet]] is true, then return.

3. If IsPlatformObjectSameOrigin(platformObject) is false, then throw a "SecurityError" DOMException.

The [[CrossOriginPropertyDescriptorMap]] internal slot contains a map with entries whose keys are (currentGlobal, objectGlobal, propertyKey)-tuples and values are property descriptors, as a memoization of what is visible to scripts when currentGlobal inspects a Window or Location object from objectGlobal. It is filled lazily by CrossOriginGetOwnPropertyHelper, which consults it on future lookups.

7.2.1.3.1 CrossOriginProperties ( O )

1. Assert: O is a Location or Window object.

2. If O is a Location object, then return « { [[Property]]: "href", [[NeedsGet]]: false, [[NeedsSet]]: true }, { [[Property]]: "replace" } ».

3. Return « { [[Property]]: "window", [[NeedsGet]]: true, [[NeedsSet]]: false }, { [[Property]]: "self", [[NeedsGet]]: true, [[NeedsSet]]: false }, { [[Property]]: "location", [[NeedsGet]]: true, [[NeedsSet]]: true }, { [[Property]]: "close" }, { [[Property]]: "closed", [[NeedsGet]]: true, [[NeedsSet]]: false }, { [[Property]]: "focus" }, { [[Property]]: "blur" }, { [[Property]]: "frames", [[NeedsGet]]: true, [[NeedsSet]]: false }, { [[Property]]: "length", [[NeedsGet]]: true, [[NeedsSet]]: false }, { [[Property]]: "top", [[NeedsGet]]: true, [[NeedsSet]]: false }, { [[Property]]: "opener", [[NeedsGet]]: true, [[NeedsSet]]: false }, { [[Property]]: "parent", [[NeedsGet]]: true, [[NeedsSet]]: false }, { [[Property]]: "postMessage" } ».

A JavaScript property name P is a cross-origin accessible window property name if it is "window", "self", "location", "close", "closed", "focus", "blur", "frames", "length", "top", "opener", "parent", "postMessage", or an array index property name.

7.2.1.3.2 CrossOriginPropertyFallback ( P )

1. If P is "then", %Symbol.toStringTag%, %Symbol.hasInstance%, or %Symbol.isConcatSpreadable%, then return PropertyDescriptor { [[Value]]: undefined, [[Writable]]: false, [[Enumerable]]: false, [[Configurable]]: true }.

2. Throw a "SecurityError" DOMException.

7.2.1.3.3 IsPlatformObjectSameOrigin ( O )

1. Return true if the current settings object's origin is same origin-domain with O's relevant settings object's origin, and false otherwise.

7.2.1.3.4 CrossOriginGetOwnPropertyHelper ( O, P )

If this abstract operation returns undefined and there is no custom behavior, the caller needs to throw a "SecurityError" DOMException. In practice this is handled by the caller calling CrossOriginPropertyFallback.

1. Let crossOriginKey be a tuple consisting of the current settings object, O's relevant settings object, and P.

2. For each e of CrossOriginProperties(O):

   1. If SameValue(e.[[Property]], P) is true, then:

      1. If the value of the [[CrossOriginPropertyDescriptorMap]] internal slot of O contains an entry whose key is crossOriginKey, then return that entry's value.

      2. Let originalDesc be OrdinaryGetOwnProperty(O, P).

      3. Let crossOriginDesc be undefined.

      4. If e.[[NeedsGet]] and e.[[NeedsSet]] are absent, then:

         1. Let value be originalDesc.[[Value]].

         2. If IsCallable(value) is true, then set value to an anonymous built-in function, created in the current realm, that performs the same steps as the IDL operation P on object O.

         3. Set crossOriginDesc to PropertyDescriptor { [[Value]]: value, [[Enumerable]]: false, [[Writable]]: false, [[Configurable]]: true }.

      5. Otherwise:

         1. Let crossOriginGet be undefined.

         2. If e.[[NeedsGet]] is true, then set crossOriginGet to an anonymous built-in function, created in the current realm, that performs the same steps as the getter of the IDL attribute P on object O.

         3. Let crossOriginSet be undefined.

         4. If e.[[NeedsSet]] is true, then set crossOriginSet to an anonymous built-in function, created in the current realm, that performs the same steps as the setter of the IDL attribute P on object O.

         5. Set crossOriginDesc to PropertyDescriptor { [[Get]]: crossOriginGet, [[Set]]: crossOriginSet, [[Enumerable]]: false, [[Configurable]]: true }.

      6. Create an entry in the value of the [[CrossOriginPropertyDescriptorMap]] internal slot of O with key crossOriginKey and value crossOriginDesc.

      7. Return crossOriginDesc.

3. Return undefined.

7.2.1.3.5 CrossOriginGet ( O, P, Receiver )

1. Let desc be ? O.[[GetOwnProperty]](P).

2. Assert: desc is not undefined.

3. If IsDataDescriptor(desc) is true, then return desc.[[Value]].

4. Assert: IsAccessorDescriptor(desc) is true.

5. Let getter be desc.[[Get]].

6. If getter is undefined, then throw a "SecurityError" DOMException.

7. Return ? Call(getter, Receiver).

7.2.1.3.6 CrossOriginSet ( O, P, V, Receiver )

1. Let desc be ? O.[[GetOwnProperty]](P).

2. Assert: desc is not undefined.

3. If desc.[[Set]] is present and its value is not undefined, then:

   1. Perform ? Call(desc.[[Set]], Receiver, « V »).

   2. Return true.

4. Throw a "SecurityError" DOMException.

7.2.1.3.7 CrossOriginOwnPropertyKeys ( O )

1. Let keys be a new empty List.

2. For each e of CrossOriginProperties(O), append e.[[Property]] to keys.

3. Return the concatenation of keys and « "then", %Symbol.toStringTag%, %Symbol.hasInstance%, %Symbol.isConcatSpreadable% ».

A Window's browsing context is its associated Document's browsing context. It is either null or a browsing context.

A Window's navigable is the navigable whose active document is the Window's associated Document's, or null if there is no such navigable.

The window, frames, and self getter steps are to return this's relevant realm.[[GlobalEnv]].[[GlobalThisValue]].

The document getter steps are to return this's associated Document.

The defaultView getter steps are:

1. If this's browsing context is null, then return null.

2. Return this's browsing context's WindowProxy object.

To get noopener for window open, given a Document sourceDocument, an ordered map tokenizedFeatures, and a URL record-or-null url, perform the following steps. They return a boolean.

1. If url is not null and url's blob URL entry is not null:

   1. Let blobOrigin be url's blob URL entry's environment's origin.

   2. Let topLevelOrigin be sourceDocument's relevant settings object's top-level origin.

   3. If blobOrigin is not same site with topLevelOrigin, then return true.

2. Let noopener be false.

3. If tokenizedFeatures["noopener"] exists, then set noopener to the result of parsing tokenizedFeatures["noopener"] as a boolean feature.

4. Return noopener.

The window open steps, given a string url, a string target, and a string features, are as follows:

1. If the event loop's termination nesting level is nonzero, then return null.

2. Let sourceDocument be the entry global object's associated Document.

3. Let urlRecord be null.

4. If url is not the empty string, then:

   1. Set urlRecord to the result of encoding-parsing a URL given url, relative to sourceDocument.

   2. If urlRecord is failure, then throw a "SyntaxError" DOMException.

5. If target is the empty string, then set target to "_blank".

6. Let tokenizedFeatures be the result of tokenizing features.

7. Let noreferrer be false.

8. If tokenizedFeatures["noreferrer"] exists, then set noreferrer to the result of parsing tokenizedFeatures["noreferrer"] as a boolean feature.

9. Let noopener be the result of getting noopener for window open with sourceDocument, tokenizedFeatures, and urlRecord.

10. Remove tokenizedFeatures["noopener"] and tokenizedFeatures["noreferrer"].

11. Let referrerPolicy be the empty string.

12. If noreferrer is true, then set noopener to true and set referrerPolicy to "no-referrer".

13. Let targetNavigable and windowType be the result of applying the rules for choosing a navigable given target, sourceDocument's node navigable, and noopener.

    If there is a user agent that supports control-clicking a link to open it in a new tab, and the user control-clicks on an element whose onclick handler uses the window.open() API to open a page in an iframe element, the user agent could override the selection of the target browsing context to instead target a new tab.

14. If targetNavigable is null, then return null.

15. If windowType is either "new and unrestricted" or "new with no opener", then:

    1. Set targetNavigable's active browsing context's is popup to the result of checking if a popup window is requested, given tokenizedFeatures.

    2. Set up browsing context features for targetNavigable's active browsing context given tokenizedFeatures. [CSSOMVIEW]

    3. If urlRecord is null, then set urlRecord to a URL record representing about:blank.

    4. If urlRecord matches about:blank, then perform the URL and history update steps given targetNavigable's active document and urlRecord.

       This is necessary in case url is something like about:blank?foo. If url is just plain about:blank, this will do nothing.

    5. Otherwise, navigate targetNavigable to urlRecord using sourceDocument, with referrerPolicy set to referrerPolicy and exceptionsEnabled set to true.

16. Otherwise:

    1. If urlRecord is not null, then navigate targetNavigable to urlRecord using sourceDocument, with referrerPolicy set to referrerPolicy and exceptionsEnabled set to true.

    2. If noopener is false, then set targetNavigable's active browsing context's opener browsing context to sourceDocument's browsing context.

17. If noopener is true or windowType is "new with no opener", then return null.

18. Return targetNavigable's active WindowProxy.

The open(url, target, features) method steps are to run the window open steps with url, target, and features.

To tokenize the features argument:

1. Let tokenizedFeatures be a new ordered map.

2. Let position point at the first code point of features.

3. While position is not past the end of features:

   1. Let name be the empty string.

   2. Let value be the empty string.

   3. Collect a sequence of code points that are feature separators from features given position. This skips past leading separators before the name.

   4. Collect a sequence of code points that are not feature separators from features given position. Set name to the collected characters, converted to ASCII lowercase.

   5. Set name to the result of normalizing the feature name name.

   6. While position is not past the end of features and the code point at position in features is not U+003D (=):

      1. If the code point at position in features is U+002C (,), or if it is not a feature separator, then break.

      2. Advance position by 1.

      This skips to the first U+003D (=) but does not skip past a U+002C (,) or a non-separator.

   7. If the code point at position in features is a feature separator:

      1. While position is not past the end of features and the code point at position in features is a feature separator:

         1. If the code point at position in features is U+002C (,), then break.

         2. Advance position by 1.

         This skips to the first non-separator but does not skip past a U+002C (,).

      2. Collect a sequence of code points that are not feature separators code points from features given position. Set value to the collected code points, converted to ASCII lowercase.

   8. If name is not the empty string, then set tokenizedFeatures[name] to value.

4. Return tokenizedFeatures.

To check if a window feature is set, given tokenizedFeatures, featureName, and defaultValue:

1. If tokenizedFeatures[featureName] exists, then return the result of parsing tokenizedFeatures[featureName] as a boolean feature.

2. Return defaultValue.

To check if a popup window is requested, given tokenizedFeatures:

1. If tokenizedFeatures is empty, then return false.

2. If tokenizedFeatures["popup"] exists, then return the result of parsing tokenizedFeatures["popup"] as a boolean feature.

3. Let location be the result of checking if a window feature is set, given tokenizedFeatures, "location", and false.

4. Let toolbar be the result of checking if a window feature is set, given tokenizedFeatures, "toolbar", and false.

5. If location and toolbar are both false, then return true.

6. Let menubar be the result of checking if a window feature is set, given tokenizedFeatures, "menubar", and false.

7. If menubar is false, then return true.

8. Let resizable be the result of checking if a window feature is set, given tokenizedFeatures, "resizable", and true.

9. If resizable is false, then return true.

10. Let scrollbars be the result of checking if a window feature is set, given tokenizedFeatures, "scrollbars", and false.

11. If scrollbars is false, then return true.

12. Let status be the result of checking if a window feature is set, given tokenizedFeatures, "status", and false.

13. If status is false, then return true.

14. Return false.

A code point is a feature separator if it is ASCII whitespace, U+003D (=), or U+002C (,).

For legacy reasons, there are some aliases of some feature names. To normalize a feature name name, switch on name:

"screenx"

Return "left".

"screeny"

Return "top".

"innerwidth"

Return "width".

"innerheight"

Return "height".

Anything else

Return name.

To parse a boolean feature given a string value:

1. If value is the empty string, then return true.

2. If value is "yes", then return true.

3. If value is "true", then return true.

4. Let parsed be the result of parsing value as an integer.

5. If parsed is an error, then set it to 0.

6. Return false if parsed is 0, and true otherwise.

The name getter steps are:

1. If this's navigable is null, then return the empty string.

2. Return this's navigable's target name.

The name setter steps are:

1. If this's navigable is null, then return.

2. Set this's navigable's active session history entry's document state's navigable target name to the given value.

The close() method steps are:

1. Let thisTraversable be this's navigable.

2. If thisTraversable is not a top-level traversable, then return.

3. If thisTraversable's is closing is true, then return.

4. Let browsingContext be thisTraversable's active browsing context.

5. Let sourceSnapshotParams be the result of snapshotting source snapshot params given thisTraversable's active document.

6. If all the following are true:

   • thisTraversable is script-closable;

   • the incumbent global object's browsing context is familiar with browsingContext; and

   • the incumbent global object's navigable is allowed by sandboxing to navigate thisTraversable, given sourceSnapshotParams,

   then:

   1. Set thisTraversable's is closing to true.

   2. Queue a task on the DOM manipulation task source to definitely close thisTraversable.

A navigable is script-closable if it is a top-level traversable, and any of the following are true:

• its is created by web content is true; or
• its session history entries's size is 1.

The closed getter steps are to return true if this's browsing context is null or its is closing is true; otherwise false.

The stop() method steps are:

1. If this's navigable is null, then return.

2. Stop loading this's navigable.

The length getter steps are to return this's associated Document's document-tree child navigables's size.

The document-tree child navigable target name property set of a Window object window is the return value of running these steps:

1. Let children be the document-tree child navigables of window's associated Document.

2. Let firstNamedChildren be an empty ordered set.

3. For each navigable of children:

   1. Let name be navigable's target name.

   2. If name is the empty string, then continue.

   3. If firstNamedChildren contains a navigable whose target name is name, then continue.

   4. Append navigable to firstNamedChildren.

4. Let names be an empty ordered set.

5. For each navigable of firstNamedChildren:

   1. Let name be navigable's target name.

   2. If navigable's active document's origin is same origin with window's relevant settings object's origin, then append name to names.

6. Return names.

The Window object supports named properties. The supported property names of a Window object window at any moment consist of the following, in tree order according to the element that contributed them, ignoring later duplicates:

• window's document-tree child navigable target name property set;

• the value of the name content attribute for all embed, form, img, and object elements that have a non-empty name content attribute and are in a document tree with window's associated Document as their root; and

• the value of the id content attribute for all HTML elements that have a non-empty id content attribute and are in a document tree with window's associated Document as their root.

To determine the value of a named property name in a Window object window, the user agent must return the value obtained using the following steps:

1. Let objects be the list of named objects of window with the name name.

   There will be at least one such object, since the algorithm would otherwise not have been invoked by Web IDL.

2. If objects contains a navigable, then:

   1. Let container be the first navigable container in window's associated Document's descendants whose content navigable is in objects.

   2. Return container's content navigable's active WindowProxy.

3. Otherwise, if objects has only one element, return that element.

4. Otherwise, return an HTMLCollection rooted at window's associated Document, whose filter matches only named objects of window with the name name. (By definition, these will all be elements.)

Named objects of Window object window with the name name, for the purposes of the above algorithm, consist of the following:

• document-tree child navigables of window's associated Document whose target name is name;

• embed, form, img, or object elements that have a name content attribute whose value is name and are in a document tree with window's associated Document as their root; and

• HTML elements that have an id content attribute whose value is name and are in a document tree with window's associated Document as their root.

The top getter steps are:

1. If this's navigable is null, then return null.

2. Return this's navigable's top-level traversable's active WindowProxy.

The opener getter steps are:

1. Let current be this's browsing context.

2. If current is null, then return null.

3. If current's opener browsing context is null, then return null.

4. Return current's opener browsing context's WindowProxy object.

The opener setter steps are:

1. If the given value is null and this's browsing context is non-null, then set this's browsing context's opener browsing context to null.

2. If the given value is non-null, then perform ? DefinePropertyOrThrow(this, "opener", { [[Value]]: the given value, [[Writable]]: true, [[Enumerable]]: true, [[Configurable]]: true }).

The parent getter steps are:

1. Let navigable be this's navigable.

2. If navigable is null, then return null.

3. If navigable's parent is not null, then set navigable to navigable's parent.

4. Return navigable's active WindowProxy.

The frameElement getter steps are:

1. Let current be this's node navigable.

2. If current is null, then return null.

3. Let container be current's container.

4. If container is null, then return null.

5. If container's node document's origin is not same origin-domain with the current settings object's origin, then return null.

6. Return container.

The visible getter steps are:

1. Let browsingContext be this's relevant global object's browsing context.

2. If browsingContext is null, then return true.

3. Return the negation of browsingContext's top-level browsing context's is popup.

The locationbar attribute must return the location bar BarProp object.

The menubar attribute must return the menu bar BarProp object.

The personalbar attribute must return the personal bar BarProp object.

The scrollbars attribute must return the scrollbar BarProp object.

The statusbar attribute must return the status bar BarProp object.

The toolbar attribute must return the toolbar BarProp object.

For historical reasons, the status attribute on the Window object must, on getting, return the last string it was set to, and on setting, must set itself to the new value. When the Window object is created, the attribute must be set to the empty string. It does not do anything else.

To set up a window environment settings object, given a URL creationURL, a JavaScript execution context execution context, null or an environment reservedEnvironment, a URL topLevelCreationURL, and an origin topLevelOrigin, run these steps:

1. Let realm be the value of execution context's Realm component.

2. Let window be realm's global object.

3. Let settings object be a new environment settings object whose algorithms are defined as follows:

   The realm execution context

   Return execution context.

   The module map

   Return the module map of window's associated Document.

   The API base URL

   Return the current base URL of window's associated Document.

   The origin

   Return the origin of window's associated Document.

   The has cross-site ancestor

   1. If window's navigable's parent is null, then return false.

   2. Let parentDocument be window's navigable's parent's active document.

   3. If parentDocument's relevant settings object's has cross-site ancestor is true, then return true.

   4. If parentDocument's origin is not same site with window's associated Document's origin, then return true.

   5. Return false.

   The policy container

   Return the policy container of window's associated Document.

   The cross-origin isolated capability

   Return true if both of the following hold, and false otherwise:

   • realm's agent cluster's cross-origin-isolation mode is "concrete", and

   • window's associated Document is allowed to use the "cross-origin-isolated" feature.

   The time origin

   Return window's associated Document's load timing info's navigation start time.

4. If reservedEnvironment is non-null, then:

   1. Set settings object's id to reservedEnvironment's id, target browsing context to reservedEnvironment's target browsing context, and active service worker to reservedEnvironment's active service worker.

   2. Set reservedEnvironment's id to the empty string.

      The identity of the reserved environment is considered to be fully transferred to the created environment settings object. The reserved environment is not searchable by the environment’s id from this point on.

5. Otherwise, set settings object's id to a new unique opaque string, settings object's target browsing context to null, and settings object's active service worker to null.

6. Set settings object's creation URL to creationURL, settings object's top-level creation URL to topLevelCreationURL, and settings object's top-level origin to topLevelOrigin.

7. Set realm's [[HostDefined]] field to settings object.

7.2.3.1 [[GetPrototypeOf]] ( )

1. Let W be the value of the [[Window]] internal slot of this.

2. If IsPlatformObjectSameOrigin(W) is true, then return ! OrdinaryGetPrototypeOf(W).

3. Return null.

7.2.3.2 [[SetPrototypeOf]] ( V )

1. Return ! SetImmutablePrototype(this, V).

7.2.3.3 [[IsExtensible]] ( )

1. Return true.

7.2.3.4 [[PreventExtensions]] ( )

1. Return false.

7.2.3.5 [[GetOwnProperty]] ( P )

1. Let W be the value of the [[Window]] internal slot of this.

2. If P is an array index property name, then:

   1. Let index be ! ToUint32(P).

   2. Let children be the document-tree child navigables of W's associated Document.

   3. Let value be undefined.

   4. If index is less than children's size, then:

      1. Sort children in ascending order, with navigableA being less than navigableB if navigableA's container was inserted into W's associated Document earlier than navigableB's container was.

      2. Set value to children[index]'s active WindowProxy.

   5. If value is undefined, then:

      1. If IsPlatformObjectSameOrigin(W) is true, then return undefined.

      2. Throw a "SecurityError" DOMException.

   6. Return PropertyDescriptor { [[Value]]: value, [[Writable]]: false, [[Enumerable]]: true, [[Configurable]]: true }.

3. If IsPlatformObjectSameOrigin(W) is true, then return ! OrdinaryGetOwnProperty(W, P).

   This is a willful violation of the JavaScript specification's invariants of the essential internal methods to maintain compatibility with existing web content. See tc39/ecma262 issue #672 for more information. [JAVASCRIPT]

4. Let property be CrossOriginGetOwnPropertyHelper(W, P).

5. If property is not undefined, then return property.

6. If property is undefined and P is in W's document-tree child navigable target name property set, then:

   1. Let value be the active WindowProxy of the named object of W with the name P.

   2. Return PropertyDescriptor { [[Value]]: value, [[Enumerable]]: false, [[Writable]]: false, [[Configurable]]: true }.

      The reason the property descriptors are non-enumerable, despite this mismatching the same-origin behavior, is for compatibility with existing web content. See issue #3183 for details.

7. Return ? CrossOriginPropertyFallback(P).

7.2.3.6 [[DefineOwnProperty]] ( P, Desc )

1. Let W be the value of the [[Window]] internal slot of this.

2. If IsPlatformObjectSameOrigin(W) is true, then:

   1. If P is an array index property name, return false.

   2. Return ? OrdinaryDefineOwnProperty(W, P, Desc).

      This is a willful violation of the JavaScript specification's invariants of the essential internal methods to maintain compatibility with existing web content. See tc39/ecma262 issue #672 for more information. [JAVASCRIPT]

3. Throw a "SecurityError" DOMException.

7.2.3.7 [[Get]] ( P, Receiver )

1. Let W be the value of the [[Window]] internal slot of this.

2. Check if an access between two browsing contexts should be reported, given the current global object's browsing context, W's browsing context, P, and the current settings object.

3. If IsPlatformObjectSameOrigin(W) is true, then return ? OrdinaryGet(this, P, Receiver).

4. Return ? CrossOriginGet(this, P, Receiver).

this is passed rather than W as OrdinaryGet and CrossOriginGet will invoke the [[GetOwnProperty]] internal method.

7.2.3.8 [[Set]] ( P, V, Receiver )

1. Let W be the value of the [[Window]] internal slot of this.

2. Check if an access between two browsing contexts should be reported, given the current global object's browsing context, W's browsing context, P, and the current settings object.

3. If IsPlatformObjectSameOrigin(W) is true, then:

   1. If P is an array index property name, then return false.

   2. Return ? OrdinarySet(W, P, V, Receiver).

4. Return ? CrossOriginSet(this, P, V, Receiver).

   this is passed rather than W as CrossOriginSet will invoke the [[GetOwnProperty]] internal method.

7.2.3.9 [[Delete]] ( P )

1. Let W be the value of the [[Window]] internal slot of this.

2. If IsPlatformObjectSameOrigin(W) is true, then:

   1. If P is an array index property name, then:

      1. Let desc be ! this.[[GetOwnProperty]](P).

      2. If desc is undefined, then return true.

      3. Return false.

   2. Return ? OrdinaryDelete(W, P).

3. Throw a "SecurityError" DOMException.

7.2.3.10 [[OwnPropertyKeys]] ( )

1. Let W be the value of the [[Window]] internal slot of this.

2. Let maxProperties be W's associated Document's document-tree child navigables's size.

3. Let keys be the range 0 to maxProperties, exclusive.

4. If IsPlatformObjectSameOrigin(W) is true, then return the concatenation of keys and OrdinaryOwnPropertyKeys(W).

5. Return the concatenation of keys and ! CrossOriginOwnPropertyKeys(W).

To create a Location object, run these steps:

1. Let location be a new Location platform object.

2. Let valueOf be location's relevant realm.[[Intrinsics]].[[%Object.prototype.valueOf%]].

3. Perform ! location.[[DefineOwnProperty]]("valueOf", { [[Value]]: valueOf, [[Writable]]: false, [[Enumerable]]: false, [[Configurable]]: false }).

4. Perform ! location.[[DefineOwnProperty]](%Symbol.toPrimitive%, { [[Value]]: undefined, [[Writable]]: false, [[Enumerable]]: false, [[Configurable]]: false }).

5. Set the value of the [[DefaultProperties]] internal slot of location to location.[[OwnPropertyKeys]]().

6. Return location.

The Document object's location getter steps are to return this's relevant global object's Location object, if this is fully active, and null otherwise.

The Window object's location getter steps are to return this's Location object.

A Location object has an associated relevant Document, which is its relevant global object's browsing context's active document, if this Location object's relevant global object's browsing context is non-null, and null otherwise.

A Location object has an associated url, which is this Location object's relevant Document's URL, if this Location object's relevant Document is non-null, and about:blank otherwise.

A Location object has an associated ancestor origins list. When a Location object is created, its ancestor origins list must be set to a DOMStringList object whose associated list is the list of strings that the following steps would produce:

1. Let output be a new list of strings.

2. Let current be the Location object's relevant Document.

3. While current's container document is non-null:

   1. Set current to current's container document.

   2. Append the serialization of current's origin to output.

4. Return output.

To Location-object navigate a Location object location to a URL url, optionally given a NavigationHistoryBehavior historyHandling (default "auto"):

1. Let navigable be location's relevant global object's navigable.

2. Let sourceDocument be the incumbent global object's associated Document.

3. If location's relevant Document is not yet completely loaded, and the incumbent global object does not have transient activation, then set historyHandling to "replace".

4. Navigate navigable to url using sourceDocument, with exceptionsEnabled set to true and historyHandling set to historyHandling.

The href getter steps are:

1. If this's relevant Document is non-null and its origin is not same origin-domain with the entry settings object's origin, then throw a "SecurityError" DOMException.

2. Return this's url, serialized.

The href setter steps are:

1. If this's relevant Document is null, then return.

2. Let url be the result of encoding-parsing a URL given the given value, relative to the entry settings object.

3. If url is failure, then throw a "SyntaxError" DOMException.

4. Location-object navigate this to url.

The origin getter steps are:

1. If this's relevant Document is non-null and its origin is not same origin-domain with the entry settings object's origin, then throw a "SecurityError" DOMException.

2. Return the serialization of this's url's origin.

The protocol getter steps are:

1. If this's relevant Document is non-null and its origin is not same origin-domain with the entry settings object's origin, then throw a "SecurityError" DOMException.

2. Return this's url's scheme, followed by ":".

The protocol setter steps are:

1. If this's relevant Document is null, then return.

2. If this's relevant Document's origin is not same origin-domain with the entry settings object's origin, then throw a "SecurityError" DOMException.

3. Let copyURL be a copy of this's url.

4. Let possibleFailure be the result of basic URL parsing the given value, followed by ":", with copyURL as url and scheme start state as state override.

   Because the URL parser ignores multiple consecutive colons, providing a value of "https:" (or even "https::::") is the same as providing a value of "https".

5. If possibleFailure is failure, then throw a "SyntaxError" DOMException.

6. If copyURL's scheme is not an HTTP(S) scheme, then terminate these steps.

7. Location-object navigate this to copyURL.

The host getter steps are:

1. If this's relevant Document is non-null and its origin is not same origin-domain with the entry settings object's origin, then throw a "SecurityError" DOMException.

2. Let url be this's url.

3. If url's host is null, return the empty string.

4. If url's port is null, return url's host, serialized.

5. Return url's host, serialized, followed by ":" and url's port, serialized.

The host setter steps are:

1. If this's relevant Document is null, then return.

2. If this's relevant Document's origin is not same origin-domain with the entry settings object's origin, then throw a "SecurityError" DOMException.

3. Let copyURL be a copy of this's url.

4. If copyURL has an opaque path, then return.

5. Basic URL parse the given value, with copyURL as url and host state as state override.

6. Location-object navigate this to copyURL.

The hostname getter steps are:

1. If this's relevant Document is non-null and its origin is not same origin-domain with the entry settings object's origin, then throw a "SecurityError" DOMException.

2. If this's url's host is null, return the empty string.

3. Return this's url's host, serialized.

The hostname setter steps are:

1. If this's relevant Document is null, then return.

2. If this's relevant Document's origin is not same origin-domain with the entry settings object's origin, then throw a "SecurityError" DOMException.

3. Let copyURL be a copy of this's url.

4. If copyURL has an opaque path, then return.

5. Basic URL parse the given value, with copyURL as url and hostname state as state override.

6. Location-object navigate this to copyURL.

The port getter steps are:

1. If this's relevant Document is non-null and its origin is not same origin-domain with the entry settings object's origin, then throw a "SecurityError" DOMException.

2. If this's url's port is null, return the empty string.

3. Return this's url's port, serialized.

The port setter steps are:

1. If this's relevant Document is null, then return.

2. If this's relevant Document's origin is not same origin-domain with the entry settings object's origin, then throw a "SecurityError" DOMException.

3. Let copyURL be a copy of this's url.

4. If copyURL cannot have a username/password/port, then return.

5. If the given value is the empty string, then set copyURL's port to null.

6. Otherwise, basic URL parse the given value, with copyURL as url and port state as state override.

7. Location-object navigate this to copyURL.

The pathname getter steps are:

1. If this's relevant Document is non-null and its origin is not same origin-domain with the entry settings object's origin, then throw a "SecurityError" DOMException.

2. Return the result of URL path serializing this Location object's url.

The pathname setter steps are:

1. If this's relevant Document is null, then return.

2. If this's relevant Document's origin is not same origin-domain with the entry settings object's origin, then throw a "SecurityError" DOMException.

3. Let copyURL be a copy of this's url.

4. If copyURL has an opaque path, then return.

5. Set copyURL's path to the empty list.

6. Basic URL parse the given value, with copyURL as url and path start state as state override.

7. Location-object navigate this to copyURL.

The search getter steps are:

1. If this's relevant Document is non-null and its origin is not same origin-domain with the entry settings object's origin, then throw a "SecurityError" DOMException.

2. If this's url's query is either null or the empty string, return the empty string.

3. Return "?", followed by this's url's query.

The search setter steps are:

1. If this's relevant Document is null, then return.

2. If this's relevant Document's origin is not same origin-domain with the entry settings object's origin, then throw a "SecurityError" DOMException.

3. Let copyURL be a copy of this's url.

4. If the given value is the empty string, set copyURL's query to null.

5. Otherwise, run these substeps:

   1. Let input be the given value with a single leading "?" removed, if any.

   2. Set copyURL's query to the empty string.

   3. Basic URL parse input, with null, the relevant Document's document's character encoding, copyURL as url, and query state as state override.

6. Location-object navigate this to copyURL.

The hash getter steps are:

1. If this's relevant Document is non-null and its origin is not same origin-domain with the entry settings object's origin, then throw a "SecurityError" DOMException.

2. If this's url's fragment is either null or the empty string, return the empty string.

3. Return "#", followed by this's url's fragment.

The hash setter steps are:

1. If this's relevant Document is null, then return.

2. If this's relevant Document's origin is not same origin-domain with the entry settings object's origin, then throw a "SecurityError" DOMException.

3. Let copyURL be a copy of this's url.

4. Let thisURLFragment be copyURL's fragment if it is non-null; otherwise the empty string.

5. Let input be the given value with a single leading "#" removed, if any.

6. Set copyURL's fragment to the empty string.

7. Basic URL parse input, with copyURL as url and fragment state as state override.

8. If copyURL's fragment is thisURLFragment, then return.

   This bailout is necessary for compatibility with deployed content, which redundantly sets location.hash on scroll. It does not apply to other mechanisms of fragment navigation, such as the location.href setter or location.assign().

9. Location-object navigate this to copyURL.

The assign(url) method steps are:

1. If this's relevant Document is null, then return.

2. If this's relevant Document's origin is not same origin-domain with the entry settings object's origin, then throw a "SecurityError" DOMException.

3. Let urlRecord be the result of encoding-parsing a URL given url, relative to the entry settings object.

4. If urlRecord is failure, then throw a "SyntaxError" DOMException.

5. Location-object navigate this to urlRecord.

The replace(url) method steps are:

1. If this's relevant Document is null, then return.

2. Let urlRecord be the result of encoding-parsing a URL given url, relative to the entry settings object.

3. If urlRecord is failure, then throw a "SyntaxError" DOMException.

4. Location-object navigate this to urlRecord given "replace".

The reload() method steps are:

1. Let document be this's relevant Document.

2. If document is null, then return.

3. If document's origin is not same origin-domain with the entry settings object's origin, then throw a "SecurityError" DOMException.

4. Reload document's node navigable.

The ancestorOrigins getter steps are:

1. If this's relevant Document is null, then return an empty list.

2. If this's relevant Document's origin is not same origin-domain with the entry settings object's origin, then throw a "SecurityError" DOMException.

3. Otherwise, return this's ancestor origins list.

7.2.4.1 [[GetPrototypeOf]] ( )

1. If IsPlatformObjectSameOrigin(this) is true, then return ! OrdinaryGetPrototypeOf(this).

2. Return null.

7.2.4.2 [[SetPrototypeOf]] ( V )

1. Return ! SetImmutablePrototype(this, V).

7.2.4.3 [[IsExtensible]] ( )

1. Return true.

7.2.4.4 [[PreventExtensions]] ( )

1. Return false.

7.2.4.5 [[GetOwnProperty]] ( P )

1. If IsPlatformObjectSameOrigin(this) is true, then:

   1. Let desc be OrdinaryGetOwnProperty(this, P).

   2. If the value of the [[DefaultProperties]] internal slot of this contains P, then set desc.[[Configurable]] to true.

   3. Return desc.

2. Let property be CrossOriginGetOwnPropertyHelper(this, P).

3. If property is not undefined, then return property.

4. Return ? CrossOriginPropertyFallback(P).

7.2.4.6 [[DefineOwnProperty]] ( P, Desc )

1. If IsPlatformObjectSameOrigin(this) is true, then:

   1. If the value of the [[DefaultProperties]] internal slot of this contains P, then return false.

   2. Return ? OrdinaryDefineOwnProperty(this, P, Desc).

2. Throw a "SecurityError" DOMException.

7.2.4.7 [[Get]] ( P, Receiver )

1. If IsPlatformObjectSameOrigin(this) is true, then return ? OrdinaryGet(this, P, Receiver).

2. Return ? CrossOriginGet(this, P, Receiver).

7.2.4.8 [[Set]] ( P, V, Receiver )

1. If IsPlatformObjectSameOrigin(this) is true, then return ? OrdinarySet(this, P, V, Receiver).

2. Return ? CrossOriginSet(this, P, V, Receiver).

7.2.4.9 [[Delete]] ( P )

1. If IsPlatformObjectSameOrigin(this) is true, then return ? OrdinaryDelete(this, P).

2. Throw a "SecurityError" DOMException.

7.2.4.10 [[OwnPropertyKeys]] ( )

1. If IsPlatformObjectSameOrigin(this) is true, then return OrdinaryOwnPropertyKeys(this).

2. Return CrossOriginOwnPropertyKeys(this).

The history getter steps are to return this's associated Document's history object.

The length getter steps are:

1. If this's relevant global object's associated Document is not fully active, then throw a "SecurityError" DOMException.

2. Return this's length.

The scrollRestoration getter steps are:

1. If this's relevant global object's associated Document is not fully active, then throw a "SecurityError" DOMException.

2. Return this's relevant global object's navigable's active session history entry's scroll restoration mode.

The scrollRestoration setter steps are:

1. If this's relevant global object's associated Document is not fully active, then throw a "SecurityError" DOMException.

2. Set this's relevant global object's navigable's active session history entry's scroll restoration mode to the given value.

The state getter steps are:

1. If this's relevant global object's associated Document is not fully active, then throw a "SecurityError" DOMException.

2. Return this's state.

The go(delta) method steps are to delta traverse this given delta.

The back() method steps are to delta traverse this given −1.

The forward() method steps are to delta traverse this given +1.

To delta traverse a History object history given an integer delta:

1. Let document be history's relevant global object's associated Document.

2. If document is not fully active, then throw a "SecurityError" DOMException.

3. If delta is 0, then reload document's node navigable, and return.

4. Traverse the history by a delta given document's node navigable's traversable navigable, delta, and with sourceDocument set to document.

The pushState(data, unused, url) method steps are to run the shared history push/replace state steps given this, data, url, and "push".

The replaceState(data, unused, url) method steps are to run the shared history push/replace state steps given this, data, url, and "replace".

The shared history push/replace state steps, given a History history, a value data, a scalar value string-or-null url, and a history handling behavior historyHandling, are:

1. Let document be history's relevant global object's associated Document.

2. If document is not fully active, then throw a "SecurityError" DOMException.

3. Optionally, throw a "SecurityError" DOMException. (For example, the user agent might disallow calls to these methods that are invoked on a timer, or from event listeners that are not triggered in response to a clear user action, or that are invoked in rapid succession.)

4. Let serializedData be StructuredSerializeForStorage(data). Rethrow any exceptions.

5. Let newURL be document's URL.

6. If url is not null or the empty string, then:

   1. Set newURL to the result of encoding-parsing a URL given url, relative to the relevant settings object of history.

   2. If newURL is failure, then throw a "SecurityError" DOMException.

   3. If document cannot have its URL rewritten to newURL, then throw a "SecurityError" DOMException.

   The special case for the empty string here is historical, and leads to different resulting URLs when comparing code such as location.href = "" (which performs URL parsing on the empty string) versus history.pushState(null, "", "") (which bypasses it).

7. Let navigation be history's relevant global object's navigation API.

8. Let continue be the result of firing a push/replace/reload navigate event at navigation with navigationType set to historyHandling, isSameDocument set to true, destinationURL set to newURL, and classicHistoryAPIState set to serializedData.

9. If continue is false, then return.

10. Run the URL and history update steps given document and newURL, with serializedData set to serializedData and historyHandling set to historyHandling.

User agents may limit the number of state objects added to the session history per page. If a page hits the implementation-defined limit, user agents must remove the entry immediately after the first entry for that Document object in the session history after having added the new entry. (Thus the state history acts as a FIFO buffer for eviction, but as a LIFO buffer for navigation.)

A Document document can have its URL rewritten to a URL targetURL if the following algorithm returns true:

1. Let documentURL be document's URL.

2. If targetURL and documentURL differ in their scheme, username, password, host, or port components, then return false.

3. If targetURL's scheme is an HTTP(S) scheme, then return true.

   Differences in path, query, and fragment are allowed for http: and https: URLs.

4. If targetURL's scheme is "file", then:

   1. If targetURL and documentURL differ in their path component, then return false.

   2. Return true.

   Differences in query and fragment are allowed for file: URLs.

5. If targetURL and documentURL differ in their path component or query components, then return false.

   Only differences in fragment are allowed for other types of URLs.

6. Return true.

Each Window has an associated navigation API, which is a Navigation object. Upon creation of the Window object, its navigation API must be set to a new Navigation object created in the Window object's relevant realm.

The navigation getter steps are to return this's navigation API.

The current entry of a Navigation navigation is the result of running the following steps:

1. If navigation has entries and events disabled, then return null.

2. Assert: navigation's current entry index is not −1.

3. Return navigation's entry list[navigation's current entry index].

A Navigation navigation has entries and events disabled if the following steps return true:

1. Let document be navigation's relevant global object's associated Document.

2. If document is not fully active, then return true.

3. If document's is initial about:blank is true, then return true.

4. If document's origin is opaque, then return true.

5. Return false.

To get the navigation API entry index of a session history entry she within a Navigation navigation:

1. Let index be 0.

2. For each nhe of navigation's entry list:

   1. If nhe's session history entry is equal to she, then return index.

   2. Increment index by 1.

3. Return −1.

To initialize the navigation API entries for a new document given a Navigation navigation, a list of session history entries newSHEs, and a session history entry initialSHE:

1. Assert: navigation's entry list is empty.

2. Assert: navigation's current entry index is −1.

3. If navigation has entries and events disabled, then return.

4. For each newSHE of newSHEs:

   1. Let newNHE be a new NavigationHistoryEntry created in the relevant realm of navigation.

   2. Set newNHE's session history entry to newSHE.

   3. Append newNHE to navigation's entry list.

   newSHEs will have originally come from getting session history entries for the navigation API, and thus each newSHE will be contiguous same origin with initialSHE.

5. Set navigation's current entry index to the result of getting the navigation API entry index of initialSHE within navigation.