diff --git a/source b/source
index 0a3fef09ea2..5a98350974c 100644
--- a/source
+++ b/source
@@ -83619,7 +83619,16 @@ interface <dfn>BarProp</dfn> {
   data-x="struct item">items</span>:</p>
 
   <ul>
-   <li><p><dfn data-x="she-url">URL</dfn>, a <span>URL</span></p></li>
+   <li>
+    <p><dfn data-x="she-url">URL</dfn>, a <span>URL</span></p>
+
+    <p class="warning">This <a href="#warning-document-open-url-mismatch">doesn't necessarily
+    match</a> the <span data-x="she-document">document</span>'s <span
+    data-x="concept-document-URL">URL</span>. In general, to find the "current URL" prefer using the
+    appropriate <code>Document</code>'s <span data-x="concept-document-URL">URL</span>; a
+    <span>session history entry</span>'s <span data-x="she-url">URL</span> is only to be used for
+    session history traversal and restoration.</p>
+   </li>
 
    <li>
     <p><dfn data-x="she-document">document</dfn>, a <code>Document</code> or null</p>
@@ -84178,8 +84187,8 @@ interface <dfn>History</dfn> {
    <li><p>Let <var>serializedData</var> be
    <span>StructuredSerializeForStorage</span>(<var>data</var>). Rethrow any exceptions.</p></li>
 
-   <li><p>Let <var>newURL</var> be the <span>session history</span>'s <span>current entry</span>'s
-   <span data-x="she-url">URL</span>.</p></li>
+   <li><p>Let <var>newURL</var> be <var>document</var>'s <span
+   data-x="concept-document-URL">URL</span>.</p></li>
 
    <li>
     <p>If <var>url</var> is not null, then:</p>
@@ -85119,12 +85128,19 @@ interface <dfn>Location</dfn> { // but see also <a href="#the-location-interface
 
    <dt>Otherwise</dt>
 
-   <dd><p><span>Navigate</span><!--DONAV location.reload()--> the <span>browsing context</span> to
-   this <code>Location</code> object's <span>relevant <code>Document</code></span>'s <span
-   data-x="concept-document-url">URL</span>, with <var><span>exceptionsEnabled</span></var> set to
-   true, <var data-x="navigation-hh">historyHandling</var> set to "<code
-   data-x="hh-reload">reload</code>", and the <span>source browsing context</span> set to the
-   <span>browsing context</span> being navigated.</p></dd>
+   <dd>
+    <p><span>Navigate</span><!--DONAV location.reload()--> the <span>browsing context</span> to
+    this <code>Location</code> object's <span>relevant <code>Document</code></span>'s <span
+    data-x="concept-document-url">URL</span>, with <var><span>exceptionsEnabled</span></var> set to
+    true, <var data-x="navigation-hh">historyHandling</var> set to "<code
+    data-x="hh-reload">reload</code>", and the <span>source browsing context</span> set to the
+    <span>browsing context</span> being navigated.</p>
+
+    <p class="note">This is different than navigating to the <span data-x="current entry">current
+    session history entry</span>'s <span data-x="she-url">URL</span>, due to the potential for <a
+    href="#warning-document-open-url-mismatch">mismatches caused by <code
+    data-x="dom-document-open">document.open()</code></a>.</p>
+   </dd>
 
    <!-- It appears that document.reload() always uses GET and does not, e.g., re-POST. Thus the
    difference between using the document's URL here, and "the same resource as that Document" below
@@ -94075,6 +94091,28 @@ document.body.appendChild(frame)</code></pre>
      <li><p>If <var>entryDocument</var> is not <var>document</var>, then set <var>newURL</var>'s
      <span data-x="concept-url-fragment">fragment</span> to null.</p></li>
 
+     <li>
+      <p>Set <var>document</var>'s <span data-x="concept-document-url">URL</span> to
+      <var>newURL</var>.</p>
+
+      <div class="note">
+       <p>The main purpose of this step is to allow code such as the following:</p>
+
+       <pre><code class="js">const w = window.open();
+w.document.open();
+w.document.write("&lt;img src='image.png'>");</code></pre>
+
+       <p>to resolve the <code data-x="">image.png</code> URL relative to the caller, instead of
+       relative to <code>about:blank</code>.</p>
+      </div>
+
+      <p class="warning" id="warning-document-open-url-mismatch">This can cause
+      <var>document</var>'s <span data-x="concept-document-url">URL</span> to mismatch its
+      corresponding <span>session history entry</span>'s <span data-x="she-url">URL</span>. This
+      mismatch is required for web compatibility; see <a
+      href="https://github.com/whatwg/html/issues/6556">issue #6556</a>.</p>
+     </li>
+
      <li><p>Run the <span>URL and history update steps</span> with <var>document</var> and
      <var>newURL</var>.</p></li>
     </ol>