Make noopener stop the copying of session storage

This was discussed in #2681.

Tests: https://bugzilla.mozilla.org/show_bug.cgi?id=1372662

Also fixes #2681's original issue by relocating the copying logic to the
place where new browsing contexts are actually created, instead of it
being located in the session storage portions of the spec.

source

@@ -22955,16 +22955,18 @@ interface <dfn>HTMLHyperlinkElementUtils</dfn> {
    <code>base</code> element.</p></li>
    <!-- c.f. concept-fs-target -->
 
+   <li><p>Let <var>noopener</var> be true if <var>subject</var>'s <a href="#linkTypes">link
+   types</a> include the <code data-x="rel-noreferrer">noreferrer</code>
+   or <code data-x="rel-noopener">noopener</code> keyword</p></li>
+
    <li><p>Let <var>target</var> and <var>replace</var> be the result of applying <span>the rules for
-   choosing a browsing context</span> given <var>targetAttributeValue</var> and
-   <var>source</var>.</p></li>
+   choosing a browsing context</span> given <var>targetAttributeValue</var>, <var>source</var>, and
+   <var>noopener</var>.</p></li>
 
    <li><p>If <var>target</var> is null, then return.</p></li>
 
-   <li><p>If <var>subject</var>'s <a href="#linkTypes">link types</a> include the <code
-   data-x="rel-noreferrer">noreferrer</code> or <code data-x="rel-noopener">noopener</code> keyword,
-   and <var>replace</var> is true, then <span data-x="disowned its opener">disown
-   <var>target</var>'s opener</span>.</p></li>
+   <li><p>If <var>noopener</var> and <var>replace</var> are true, then
+   <span data-x="disowned its opener">disown <var>target</var>'s opener</span>.</p></li>
 
    <li><p><span data-x="parse a url">Parse</span> the <span>URL</span> given by <var>subject</var>'s
    <code data-x="attr-hyperlink-href">href</code> attribute, relative to <var>subject</var>'s
@@ -76946,9 +76948,12 @@ dictionary <dfn>DragEventInit</dfn> : <span>MouseEventInit</span> {
 
   <div w-nodev>
 
-  <p>To <dfn data-x="creating a new browsing context">create a new browsing context</dfn>:</p>
+  <p>To <dfn data-x="creating a new browsing context">create a new browsing context</dfn>,
+  optionally given <var>noopener</var>:</p>
 
   <ol>
+   <li><p>If <var>noopener</var> was not given, let it be false.</p></li>
+
    <li><p>Let <var>browsingContext</var> be a new <span>browsing context</span>.</p></li>
 
    <li>
@@ -77010,6 +77015,19 @@ dictionary <dfn>DragEventInit</dfn> : <span>MouseEventInit</span> {
    <li><p>Add <var>document</var> to <var>browsingContext</var>'s <span>session
    history</span>.</p></li>
 
+   <!--
+    NOTE: Clean up this logic in the future. SessionStorage ownership is unclear.
+    https://github.com/whatwg/html/pull/2832#issuecomment-315239343
+   -->
+
+   <li id="copy-session-storage"><p>If <var>noopener</var> is false, <var>browsingContext</var> is a
+   <span>top-level browsing context</span>, and <span>creator origin</span> is <span>same
+   origin</span> with <var>document</var>'s <span>origin</span>, then copy the <code
+   data-x="dom-sessionStorage">sessionStorage</code> storage area of the <span>creator origin</span>
+   from the <span>creator browsing context</span> into <var>browsingContext</var>'s set of session
+   storage areas. These areas must be considered separate, not affecting each other in any
+   way.</p></li>
+
    <li><p>Return <var>browsingContext</var>.</p></li>
   </ol>
 
@@ -77625,7 +77643,8 @@ console.assert(iframeWindow.frameElement === null);
 
   <p><dfn id="the-rules-for-choosing-a-browsing-context-given-a-browsing-context-name">The rules for
   choosing a browsing context</dfn>, given null or a <span>browsing context name</span>
-  <var>name</var> and a <span>browsing context</span> <var>current</var>, are as follows:</p>
+  <var>name</var>, a <span>browsing context</span> <var>current</var>, and a
+  boolean <var>noopener</var> are as follows:</p>
 
   <ol>
    <li><p>Let <var>chosen</var> be null.</p></li>
@@ -77678,7 +77697,8 @@ console.assert(iframeWindow.frameElement === null);
 
       <ol>
        <li><p>Set <var>chosen</var> to a <span data-x="creating a new browsing context">new</span>
-       <span>top-level browsing context</span> and <var>new</var> to true.</p></li>
+       <span>top-level browsing context</span> given <var>noopener</var>, and set <var>new</var> to
+       true.</p></li>
 
        <li><p>Set <var>chosen</var> to an existing <span>top-level browsing context</span>.</p>
       </ol>
@@ -77695,11 +77715,11 @@ console.assert(iframeWindow.frameElement === null);
 
      <dd>
       <p>Set <var>chosen</var> to a <span data-x="creating a new browsing context">new</span>
-      <span>auxiliary browsing context</span>, with the <span>opener browsing context</span> being
-      <var>current</var>, and set <var>new</var> to true. If <var>name</var> is not an <span>ASCII
-      case-insensitive</span> match for "<code data-x="">_blank</code>", then <var>chosen</var>'s
-      <span data-x="browsing context name">name</span> must be set to <var>name</var> (otherwise, it
-      has no name).</p>
+      <span>auxiliary browsing context</span> given <var>noopener</var> with the <span>opener
+      browsing context</span> being <var>current</var>, and set <var>new</var> to true. If
+      <var>name</var> is not an <span>ASCII case-insensitive</span> match for "<code
+      data-x="">_blank</code>", then <var>chosen</var>'s <span data-x="browsing context
+      name">name</span> must be set to <var>name</var> (otherwise, it has no name).</p>
 
       <p class="note">If the newly created <span>browsing context</span> is immediately <span
       data-x="navigate">navigated</span>, then the navigation will be done with <span>replacement
@@ -78239,10 +78259,13 @@ callback <dfn>FrameRequestCallback</dfn> = void (<span>DOMHighResTimeStamp</span
    <li><p>If <var>target</var> is the empty string, then set <var>target</var> to "<code
    data-x="">_blank</code>".</p></li>
 
+   <li><p>Let <var>noopener</var> be true if <var>tokenizedFeatures</var> <span data-x="map
+   exists">contains</span> an entry with the key "<code data-x="">noopener</code>"</p></li>
+
    <li>
-    <p>Let <var>target browsing context</var> and <var>new</var> be the result of applying
-    <span>the rules for choosing a browsing context</span> given <var>target</var> and
-    <var>source browsing context</var>.
+    <p>Let <var>target browsing context</var> and <var>new</var> be the result of applying <span>the
+    rules for choosing a browsing context</span> given <var>target</var>, <var>source browsing
+    context</var>, and <var>noopener</var>.
 
     <p class="example">If there is a user agent that supports control-clicking a link to open it in
     a new tab, and the user control-clicks on an element whose <code
@@ -78281,9 +78304,8 @@ callback <dfn>FrameRequestCallback</dfn> = void (<span>DOMHighResTimeStamp</span
     </ol>
    </li>
 
-   <li><p>If <var>tokenizedFeatures</var> <span data-x="map exists">contains</span> an entry with
-   the key "<code data-x="">noopener</code>", then <span data-x="disowned its opener">disown
-   <var>target browsing context</var>'s opener</span> and return null.</p></li>
+   <li><p>If <var>noopener</var> is true, then <span data-x="disowned its opener">disown <var>target
+   browsing context</var>'s opener</span> and return null.</p></li>
 
    <li><p>Return <var>target browsing context</var>'s <code>WindowProxy</code> object.</p></li>
   </ol>
@@ -98311,18 +98333,8 @@ interface <dfn>WindowSessionStorage</dfn> {
   object for its <code>Window</code>'s <code data-x="dom-sessionStorage">sessionStorage</code>
   attribute.</p>
 
-  <p>When a new <span>top-level browsing context</span> is created by cloning an existing
-  <span>browsing context</span>, the new browsing context must start with the same session storage
-  areas as the original, but the two sets must from that point on be considered separate, not
-  affecting each other in any way.</p>
-
-  <p>When a new <span>top-level browsing context</span> is created by a <span
-  data-x="concept-script">script</span> in an existing <span>browsing context</span>, or by the user
-  following a link in an existing browsing context, or in some other way related to a specific
-  <code>Document</code>, and the creation is not a new start for session storage, then the session
-  storage area of the <span>origin</span> of that <code>Document</code> must be copied into the new
-  browsing context when it is created. From that point on, however, the two session storage areas
-  must be considered separate, not affecting each other in any way.</p>
+  <p>While <span>creating a new browsing context</span>, the session storage area <a
+  href="#copy-session-storage">is sometimes copied</a> over.</p>
 
   <p id="sessionStorageEvent">When the <code data-x="dom-Storage-setItem">setItem()</code>, <code
   data-x="dom-Storage-removeItem">removeItem()</code>, and <code