From 2c5a41b73c4b8d2f3dbf176bb880a7e67443be30 Mon Sep 17 00:00:00 2001
From: Domenic Denicola <d@domenic.me>
Date: Thu, 10 Apr 2025 11:08:29 +0900
Subject: [PATCH] Fix document access in shared history push/replace steps
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Closes #11199.

As discussed there, there are deeper issues around whether a History object is associated with a Window vs. History object, and how that intersects with #3267 around Window object reuse.

However, in the meantime, this makes the traversal from History → Document consistent with the rest of the specification, and stops using the undefined concept of "history's associated Document".
---
 source | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/source b/source
index 17ac4d82005..bd365640f77 100644
--- a/source
+++ b/source
@@ -93756,7 +93756,8 @@ interface <dfn interface>History</dfn> {
   <var>url</var>, and a <span>history handling behavior</span> <var>historyHandling</var>, are:</p>
 
   <ol>
-   <li><p>Let <var>document</var> be <var>history</var>'s associated <code>Document</code>.</p></li>
+   <li><p>Let <var>document</var> be <var>history</var>'s <span>relevant global object</span>'s
+   <span data-x="concept-document-window">associated <code>Document</code></span>.</p></li>
 
    <li><p>If <var>document</var> is not <span>fully active</span>, then throw a
    <span>"<code>SecurityError</code>"</span> <code>DOMException</code>.</p></li>