document.open() simplifications, part 2

The current behavior of adding a new entry to the session history is
removed, with the "replace" parameter behavior made the only option. To
fix #3885, we now reuse history.replaceState()'s history model, which
keeps the document's URL and the history entry URL in sync.

At the same time, we restrict the history state update (including
setting the document's URL) to be only run with fully active documents.
Firefox already bails out for non-fully active documents (including
those that are active documents), and it's not expected that there would
be much usage of the URL of non-fully active documents anyway.

This allows us to additionally remove the seldom implemented "replace"
parameter in document.open(), whose behavior is now the default
(aligning with with Chrome and Safari). The IDL is modified accordingly.

Tests: web-platform-tests/wpt#12555
Tests: web-platform-tests/wpt#12634
Tests: web-platform-tests/wpt#12636
Tests: web-platform-tests/wpt#12650

Fixes #3564.
Fixes #3885.

source

@@ -9168,7 +9168,7 @@ partial interface <dfn id="document" data-lt="">Document</dfn> {
   readonly attribute <span>HTMLOrSVGScriptElement</span>? <span data-x="dom-document-currentScript">currentScript</span>; // classic scripts in a document tree only
 
   // <span>dynamic markup insertion</span>
-  [<span>CEReactions</span>] <span>Document</span> <span data-x="dom-document-open">open</span>(optional DOMString type, optional DOMString replace = ""); // type is ignored
+  [<span>CEReactions</span>] <span>Document</span> <span data-x="dom-document-open">open</span>(optional DOMString type, optional DOMString replace); // both type and replace are ignored
   <span>WindowProxy</span> <span data-x="dom-document-open-window">open</span>(USVString url, DOMString name, DOMString features);
   [<span>CEReactions</span>] void <span data-x="dom-document-close">close</span>();
   [<span>CEReactions</span>] void <span data-x="dom-document-write">write</span>(DOMString... text);
@@ -90915,8 +90915,7 @@ document.body.appendChild(frame)</code></pre>
   unloaded</span>. Initially, the counter must be set to zero.</p> <!--
   https://www.hixie.ch/tests/adhoc/dom/level0/document/open/unload/ -->
 
-  <p>The <dfn>document open steps</dfn>, given a <var>document</var> and <var>replaceInput</var>,
-  are as follows:</p>
+  <p>The <dfn>document open steps</dfn>, given a <var>document</var>, are as follows:</p>
 
   <ol>
    <li><p>If <var>document</var> is an <span data-x="XML documents">XML document</span>, then throw
@@ -90932,10 +90931,12 @@ document.body.appendChild(frame)</code></pre>
    <li><p>Let <var>window</var> be <var>document</var>'s <span>relevant global
    object</span>.</p></li>
 
-   <li><p>If <var>document</var>'s <span>origin</span> is not <span>same origin</span> to the
-   <span>origin</span> of the <span>responsible document</span> specified by the <span>entry
-   settings object</span>, then throw a <span>"<code>SecurityError</code>"</span>
-   <code>DOMException</code>.</p></li>
+   <li><p>Let <var>entryDocument</var> be the <span>responsible document</span> specified by the
+   <span>entry settings object</span>.</p></li>
+
+   <li><p>If <var>document</var>'s <span>origin</span> is not <span>same origin</span> to
+   <var>entryDocument</var>'s <span>origin</span>, then throw a
+   <span>"<code>SecurityError</code>"</span> <code>DOMException</code>.</p></li>
 
    <li>
     <p>If <var>document</var> has an <span>active parser</span> whose <span>script nesting
@@ -90958,20 +90959,6 @@ document.body.appendChild(frame)</code></pre>
     handler while the <code>Document</code> is being unloaded.</p>
    </li>
 
-   <li><p>Let <var>replace</var> be false.
-
-   <li>
-    <p>If <var>replaceInput</var> is an <span>ASCII case-insensitive</span> match for "<code
-    data-x="">replace</code>", then set <var>replace</var> to true.</p>
-
-    <p>Otherwise, if <var>document</var>'s <span>browsing context</span>'s <span>session
-    history</span> contains only one <code>Document</code> object, and that was the
-    <code>about:blank</code> <code>Document</code> created when <var>document</var>'s <span>browsing
-    context</span> was <span data-x="creating a new browsing context">created</span>, and that
-    <code>Document</code> object has never had the <span>unload a document</span> algorithm invoked
-    on it, then set <var>replace</var> to true.</p>
-   </li>
-
    <li><p><span data-x="abort a document">Abort</span> <var>document</var>.</p></li>
 
    <li><p>For each <span>shadow-including inclusive descendant</span> <var>node</var> of
@@ -90983,9 +90970,9 @@ document.body.appendChild(frame)</code></pre>
    <li><p><span data-x="concept-node-replace-all">Replace all</span> with null within
    <var>document</var>, without firing any mutation events.</p></li>
 
-   <li><p>Change <var>document</var>'s <span data-x="concept-document-url">URL</span> to the
-   <span data-x="concept-document-url">URL</span> of the <span>responsible document</span> specified
-   by the <span>entry settings object</span>.</p></li>
+   <li><p>If <var>document</var> is <span>fully active</span>, then run the <span>URL and history
+   update steps</span> with <var>document</var> and <var>entryDocument</var>'s <span
+   data-x="concept-document-url">URL</span>.</p></li>
 
    <!-- <span>the document's referrer</span> stays the same -->
 
@@ -91003,44 +90990,20 @@ document.body.appendChild(frame)</code></pre>
    <li><p>Set the <span>current document readiness</span> of <var>document</var> to "<code
    data-x="">loading</code>".</p></li>
 
-   <li><p>Remove any <span data-x="concept-task">tasks</span> queued by the <span>history traversal
-   task source</span> that are associated with any <code>Document</code> objects in the
-   <span>top-level browsing context</span>'s <span>document family</span>.</p></li>
-
-   <li>
-    <p>Remove all the entries in the <span>browsing context</span>'s <span>session history</span>
-    after the <span>current entry</span>. If the <span>current entry</span> is the last entry in the
-    session history, then no entries are removed.</p>
-
-    <p class="note">This <a href="#history-notes">doesn't necessarily have to affect</a> the user
-    agent's user interface.</p>
-   </li>
-
-   <li><p>Remove any earlier entries whose <code>Document</code> object is
-   <var>document</var>.</p></li>
-
-   <li><p>If <var>replace</var> is false, then add a new entry, just before the last entry,
-   and associate with the new entry the text that was parsed by the previous parser associated with
-   <var>document</var>, as well as the state of <var>document</var> at the start of these steps.
-   This allows the user to step backwards in the session history to see the page before it was blown
-   away by the <code data-x="dom-document-open">document.open(<var>type</var>,
-   <var>replace</var>)</code> call. This new entry does not have a <code>Document</code> object, so
-   a new one will be created if the session history is traversed to that entry.</p></li>
-
    <li><p>Finally, set the <span>insertion point</span> to point at just before the end of the
    <span>input stream</span> (which at this point will be empty).</p></li>
 
    <li><p>Return <var>document</var>.</p></li>
   </ol>
 
+  <p class="note">The <span>document open steps</span> do not affect whether a <code>Document</code>
+  is <span>ready for post-load tasks</span> or <span>completely loaded</span>.</p>
+
   <p>The <dfn data-x="dom-document-open"><code>open(<var>type</var>,
   <var>replace</var>)</code></dfn> method must return the result of running the <span>document open
-  steps</span> with this <code>Document</code> object and <var>replace</var>.
+  steps</span> with this <code>Document</code> object.
 
-  <p class="note">The <var>type</var> argument is ignored. Also, the <code
-  data-x="dom-document-open">document.open(<var>type</var>, <var>replace</var>)</code> method does
-  not affect whether a <code>Document</code> is <span>ready for post-load tasks</span> or
-  <span>completely loaded</span>.</p>
+  <p class="note">The <var>type</var> argument is ignored.</p>
 
   <p>The <dfn data-x="dom-document-open-window"><code>open(<var>url</var>, <var>name</var>,
   <var>features</var>)</code></dfn> method must run these steps:</p>
@@ -91185,10 +91148,7 @@ document.body.appendChild(frame)</code></pre>
      0 or <var>document</var>'s <span>ignore-destructive-writes counter</span> is greater than 0,
      then return.</p></li>
 
-     <li><p>Run the <span>document open steps</span> with <var>document</var> and the empty string.
-     If the user <span>refused to allow the document to be unloaded</span>, then return. Otherwise,
-     the <span>insertion point</span> will point at just before the end of the (empty) <span>input
-     stream</span>.</p></li>
+     <li><p>Run the <span>document open steps</span> with <var>document</var>.</p></li>
     </ol>
    </li>