diff --git a/spec.html b/spec.html
index 504dbfdee8b..ff4a84b701b 100644
--- a/spec.html
+++ b/spec.html
@@ -28902,7 +28902,7 @@ <h1>
           1. If _x_ is not a String, return _x_.
           1. Let _evalRealm_ be the current Realm Record.
           1. NOTE: In the case of a direct eval, _evalRealm_ is the realm of both the caller of `eval` and of the `eval` function itself.
-          1. Perform ? HostEnsureCanCompileStrings(_evalRealm_).
+          1. Perform ? HostEnsureCanCompileStrings(_evalRealm_, |Script|, _x_).
           1. Let _inFunction_ be *false*.
           1. Let _inMethod_ be *false*.
           1. Let _inDerivedConstructor_ be *false*.
@@ -28965,6 +28965,8 @@ <h1>
         <h1>
           HostEnsureCanCompileStrings (
             _calleeRealm_: a Realm Record,
+            _goal_: a grammar symbol,
+            _bodyText_: an ECMAScript language value,
           ): either a normal completion containing ~unused~ or a throw completion
         </h1>
         <dl class="header">
@@ -28972,6 +28974,18 @@ <h1>
           <dd>It allows host environments to block certain ECMAScript functions which allow developers to interpret and evaluate strings as ECMAScript code.</dd>
         </dl>
         <p>The default implementation of HostEnsureCanCompileStrings is to return NormalCompletion(~unused~).</p>
+
+        <emu-note>
+          <p>
+            _goal_ is the nonterminal which will be used to parse _bodyText_.
+            For example, if called via %Function% it might be the grammar symbol |FunctionBody[~Yield, ~Await]| and from %eval% it might be the grammar symbol |Script|.
+          </p>
+        </emu-note>
+
+        <ul>
+          <li>Implementations of HostEnsureCanCompileStrings should not coerce _bodyText_ to a string, since callers will do that later, and HostEnsureCanCompileStrings must not base security decisions on both coercions producing the same string.</li>
+          <li>Clients may base security decisions on internal slots.</li>
+        </ul>
       </emu-clause>
 
       <emu-clause id="sec-evaldeclarationinstantiation" type="abstract operation">
@@ -30157,8 +30171,6 @@ <h1>
             <dd>_constructor_ is the constructor function that is performing this action. _newTarget_ is the constructor that `new` was initially applied to. _parameterArgs_ and _bodyArg_ reflect the argument values that were passed to _constructor_.</dd>
           </dl>
           <emu-alg>
-            1. Let _currentRealm_ be the current Realm Record.
-            1. Perform ? HostEnsureCanCompileStrings(_currentRealm_).
             1. If _newTarget_ is *undefined*, set _newTarget_ to _constructor_.
             1. If _kind_ is ~normal~, then
               1. Let _prefix_ be *"function"*.
@@ -30185,6 +30197,8 @@ <h1>
               1. Let _bodySym_ be the grammar symbol |AsyncGeneratorBody|.
               1. Let _parameterSym_ be the grammar symbol |FormalParameters[+Yield, +Await]|.
               1. Let _fallbackProto_ be *"%AsyncGeneratorFunction.prototype%"*.
+            1. Let _currentRealm_ be the current Realm Record.
+            1. Perform ? HostEnsureCanCompileStrings(_currentRealm_, _bodySym_, _bodyArg_).
             1. Let _argCount_ be the number of elements in _parameterArgs_.
             1. Let _P_ be the empty String.
             1. If _argCount_ > 0, then