From bb5f0a72d4f5db6ccbdb6bdfd3b2aad824c7f366 Mon Sep 17 00:00:00 2001
From: Domenic Denicola <d@domenic.me>
Date: Wed, 15 Feb 2017 18:14:46 -0500
Subject: [PATCH 1/4] Agents and agent clusters

---
 source | 69 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 69 insertions(+)

diff --git a/source b/source
index a02b4f19405..010abb22336 100644
--- a/source
+++ b/source
@@ -2865,6 +2865,8 @@ a.setAttribute('href', 'https://example.com/'); // change the content attribute
 
     <ul class="brief">
      <li><dfn data-x-href="https://tc39.github.io/ecma262/#active-function-object">active function object</dfn></li>
+     <li><dfn data-x-href="https://tc39.github.io/ecma262/#sec-agents">agent</dfn> and
+         <dfn data-x-href="https://tc39.github.io/ecma262/#sec-agent-clusters">agent cluster</dfn></li>
      <li><dfn data-x-href="https://tc39.github.io/ecma262/#sec-automatic-semicolon-insertion">automatic semicolon insertion</dfn></li>
      <li>The <dfn data-x-href="https://tc39.github.io/ecma262/#current-realm">current Realm Record</dfn></li>
      <li><dfn data-x-href="https://tc39.github.io/ecma262/#early-error-rule">early error</dfn></li>
@@ -2944,6 +2946,7 @@ a.setAttribute('href', 'https://example.com/'); // change the content attribute
      <li>The <dfn data-x="js-abstract-equality" data-x-href="https://tc39.github.io/ecma262/#sec-abstract-equality-comparison">Abstract Equality Comparison</dfn> algorithm</li>
      <li>The <dfn data-x="js-strict-equality" data-x-href="https://tc39.github.io/ecma262/#sec-strict-equality-comparison">Strict Equality Comparison</dfn> algorithm</li>
      <li>The <dfn data-x-href="https://tc39.github.io/ecma262/#sec-date-objects"><code>Date</code></dfn> class</li>
+     <li>The <dfn data-x-href="https://tc39.github.io/ecma262/#sec-sharedarraybuffer-objects"><code>SharedArrayBuffer</code></dfn> class</li>
      <li>The <dfn data-x-href="https://tc39.github.io/ecma262/#sec-native-error-types-used-in-this-standard-typeerror"><code>TypeError</code></dfn> class</li>
      <li>The <dfn data-x="js-RangeError" data-x-href="https://tc39.github.io/ecma262/#sec-native-error-types-used-in-this-standard-rangeerror"><code>RangeError</code></dfn> class</li>
      <li>The <dfn data-x="js-typeof" data-x-href="https://tc39.github.io/ecma262/#sec-typeof-operator"><code>typeof</code></dfn> operator</li>
@@ -87910,6 +87913,72 @@ import "https://example.com/foo/../module2.js";</pre>
    data-x="concept-module-script-module-record">module record</span>.</p></li>
   </ol>
 
+  <h5>Integration with the JavaScript agent formalism</h5>
+
+  <p>JavaScript defines the concept of an <span>agent</span>. This corresponds, in a 1-to-1 manner,
+  with this specification's concept of an <span>event loop</span>.</p>
+
+  <p>To determine the manifestation of JavaScript's <span>agent cluster</span> concept in user
+  agents, we first define the set of <dfn>directly share-to-able event loops</dfn> for a given
+  <span>event loop</span> <var>loop</var>:</p>
+
+  <dl class="switch">
+   <dt>For a <span>browsing context</span> <span>event loop</span></dt>
+   <dd>The set containing <var>loop</var>, plus the <a href="#worker-event-loop">worker event
+   loops</a> of any worker whose <span>environment settings object</span>'s <span>responsible
+   browsing context</span> is one of <var>loop</var>'s <span data-x="browsing context">browsing
+   contexts</span></dd>
+
+   <dt>For a <a href="#worker-event-loop">worker event loop</a> of a dedicated worker</dt>
+   <dd>The set containing <var>loop</var>, plus the worker's <span>environment settings
+   object</span>'s <span>responsible browsing context</span>'s <span>event loop</span>, plus the
+   <a href="#worker-event-loop">worker event loops</a> of each of <span>the worker's
+   workers</span></dd>
+
+   <dt>For a <a href="#worker-event-loop">worker event loop</a> of any other type of worker</dt>
+   <dd>The set containing <var>loop</var>, plus the <a href="#worker-event-loop">worker event
+   loops</a> of each of <span>the worker's workers</span></dd>
+  </dl>
+
+  <p>Then, the transitive closure of all <span data-x="event loop">event loops</span> that are
+  <span>directly share-to-able event loops</span> forms a <dfn>unit of share-within-able event
+  loops</dfn>, and a JavaScript <span>agent cluster</span> consists of all the corresponding <span
+  data-x="agent">agents</span>.</p>
+
+  <p class="note">The <span>agent cluster</span> concept is crucial for defining the JavaScript
+  memory model, and in particular among which <span data-x="agent">agents</span> the backing data of
+  <code>SharedArrayBuffer</code> objects can be shared.</p>
+
+  <div class="example">
+   <p>The following pairs of global objects are each within the same <span>unit of share-within-able
+   event loops</span>, and thus can use <code>SharedArrayBuffer</code> instances to share memory
+   with each other:</p>
+
+   <ul class="brief">
+    <li>A <code>Window</code> and a dedicated worker that it created</li>
+
+    <li>A <code>Window</code> and the <code>Window</code> of a <span>same origin-domain</span>
+    <code>iframe</code></li>
+
+    <li>A <code>Window</code> and the <code>Window</code> that opened it</li>
+
+    <li>A worker (of any type) and any nested workers it creates</li>
+   </ul>
+
+   <p>The following pairs of global objects are <em>not</em> within the same <span>unit of
+   share-within-able event loops</span>, and thus cannot share memory:</p>
+
+   <ul class="brief">
+    <li>A <code>Window</code> and a shared worker it creates</li>
+
+    <li>A <code>Window</code> and a service worker it creates</li>
+
+    <li>A <code>Window</code> and the <code>Window</code> of a non-<span>same origin-domain</span>
+    <code>iframe</code></li>
+   </ul>
+
+  </div>
+
   </div>
 
 

From a4946cf6d0cdfaf922cdca95f67fc2fbaccda8ac Mon Sep 17 00:00:00 2001
From: Domenic Denicola <d@domenic.me>
Date: Wed, 15 Feb 2017 19:31:11 -0500
Subject: [PATCH 2/4] Structured clone of SABs

---
 source | 37 +++++++++++++++++++++++++++++++++----
 1 file changed, 33 insertions(+), 4 deletions(-)

diff --git a/source b/source
index 010abb22336..351475e17eb 100644
--- a/source
+++ b/source
@@ -2921,6 +2921,7 @@ a.setAttribute('href', 'https://example.com/'); // change the content attribute
      <li>The <dfn data-x-href="https://tc39.github.io/ecma262/#sec-isconstructor">IsConstructor</dfn> abstract operation</li>
      <li>The <dfn data-x-href="https://tc39.github.io/ecma262/#sec-isdatadescriptor">IsDataDescriptor</dfn> abstract operation</li>
      <li>The <dfn data-x-href="https://tc39.github.io/ecma262/#sec-isdetachedbuffer">IsDetachedBuffer</dfn> abstract operation</li>
+     <li>The <dfn data-x-href="https://tc39.github.io/ecma262/#sec-issharedarraybuffer">IsSharedArrayBuffer</dfn> abstract operation</li>
      <li>The <dfn data-x="js-NewObjectEnvironment" data-x-href="https://tc39.github.io/ecma262/#sec-newobjectenvironment">NewObjectEnvironment</dfn> abstract operation</li>
      <!-- the next set of Ordinary* abstract operations are in order of appearance -->
      <li>The <dfn data-x-href="https://tc39.github.io/ecma262/#sec-ordinarygetprototypeof">OrdinaryGetPrototypeOf</dfn> abstract operation</li>
@@ -7794,11 +7795,35 @@ interface <dfn>DOMStringList</dfn> {
      <li><p>If <span>IsDetachedBuffer</span>(<var>input</var>) is true, then throw a
      <span>"<code>DataCloneError</code>"</span> <code>DOMException</code>.</p></li>
 
-     <li><p>Let <var>outputArrayBuffer</var> be the <span>%ArrayBuffer%</span> intrinsic object in
-     <var>targetRealm</var>.
+     <li>
+      <p>If <span>IsSharedArrayBuffer</span>(<var>input</var>) is true, then:</p>
+
+      <ol>
+       <li><p>If <var>targetRealm</var>'s <span data-x="concept-realm-settings-object">settings
+       object</span>'s <span>responsible event loop</span> is not in the same <span>unit of
+       share-within-able event loops</span> as the <span>current Realm Record</span>'s <span
+       data-x="concept-realm-settings-object">settings object</span>'s <span>responsible event
+       loop</span>, then throw a <span>"<code>DataCloneError</code>"</span>
+       <code>DOMException</code>.</p></li>
+
+       <li><p>Let <var>output</var> be a new SharedArrayBuffer object in <var>targetRealm</var>
+       whose [[ArrayBufferData]] internal slot value is <var>input</var>.[[ArrayBufferData]] and
+       whose [[ArrayBufferByteLength]] internal slot value is
+       <var>input</var>.[[ArrayBufferByteLength]].</p></li>
+      </ol>
+     </li>
+
+     <li>
+      <p>Otherwise:</p>
+
+      <ol>
+       <li><p>Let <var>outputConstructor</var> be the <span>%ArrayBuffer%</span> intrinsic object in
+       <var>targetRealm</var>.</p></li>
 
-     <li><p>Let <var>output</var> be ? <span>CloneArrayBuffer</span>(<var>input</var>, 0,
-     <var>outputArrayBuffer</var>).</p></li>
+       <li><p>Let <var>output</var> be ? <span>CloneArrayBuffer</span>(<var>input</var>, 0,
+       <var>outputConstructor</var>).</p></li>
+      </ol>
+     </li>
     </ol>
    </li>
 
@@ -8067,6 +8092,8 @@ interface <dfn>DOMStringList</dfn> {
     <ol>
      <li><p>If <span>IsDetachedBuffer</span>(<var>O</var>) is true, then return false.</p></li>
 
+     <li><p>If <span>IsSharedArrayBuffer</span>(<var>O</var>) is true, then return false.</p></li>
+
      <li><p>Return true.</p></li>
     </ol>
    </li>
@@ -8089,6 +8116,8 @@ interface <dfn>DOMStringList</dfn> {
   data-x="transfer-abstract-op">Transfer</dfn> ( <var>input</var>, <var>targetRealm</var> )</h4>
 
   <ol>
+   <li><p>Assert: <span>IsTransferable</span>(<var>input</var>) is true.</p></li>
+
    <li>
     <p>If <var>input</var> has an [[ArrayBufferData]] internal slot, then:</p>
 

From d0555e2a1d4aeb4391f409363b9b86225bf5eb58 Mon Sep 17 00:00:00 2001
From: Domenic Denicola <d@domenic.me>
Date: Wed, 15 Feb 2017 19:46:15 -0500
Subject: [PATCH 3/4] zero-length SABs for the error case

---
 source | 45 +++++++++++++++++++++++++++++++++------------
 1 file changed, 33 insertions(+), 12 deletions(-)

diff --git a/source b/source
index 351475e17eb..03679ba7d20 100644
--- a/source
+++ b/source
@@ -2884,8 +2884,9 @@ a.setAttribute('href', 'https://example.com/'); // change the content attribute
          <dfn>@@toStringTag</dfn></li>
      <li><dfn data-x-href="https://tc39.github.io/ecma262/#sec-well-known-intrinsic-objects">Well-Known Intrinsic Objects</dfn>, including
          <dfn data-x-href="https://tc39.github.io/ecma262/#sec-arraybuffer-constructor">%ArrayBuffer%</dfn>,
-         <dfn data-x-href="https://tc39.github.io/ecma262/#sec-properties-of-the-array-prototype-object">%ArrayPrototype%</dfn>, and
-         <dfn data-x-href="https://tc39.github.io/ecma262/#sec-object.prototype.valueof">%ObjProto_valueOf%</dfn></li>
+         <dfn data-x-href="https://tc39.github.io/ecma262/#sec-properties-of-the-array-prototype-object">%ArrayPrototype%</dfn>,
+         <dfn data-x-href="https://tc39.github.io/ecma262/#sec-object.prototype.valueof">%ObjProto_valueOf%</dfn>, and
+         <dfn data-x-href="https://tc39.github.io/ecma262/#sec-sharedarraybuffer-constructor">%SharedArrayBuffer%</dfn></li>
 
      <li>The <dfn data-x="js-prod-FunctionBody" data-x-href="https://tc39.github.io/ecma262/#prod-FunctionBody"><i>FunctionBody</i></dfn> production</li>
      <li>The <dfn data-x="js-prod-Module" data-x-href="https://tc39.github.io/ecma262/#prod-Module"><i>Module</i></dfn> production</li>
@@ -2900,6 +2901,7 @@ a.setAttribute('href', 'https://example.com/'); // change the content attribute
              <dfn data-x="js-ModuleEvaluation" data-x-href="https://tc39.github.io/ecma262/#sec-moduleevaluation">ModuleEvaluation</dfn> and
              <dfn data-x="js-ModuleDeclarationInstantiation" data-x-href="https://tc39.github.io/ecma262/#sec-moduledeclarationinstantiation">ModuleDeclarationInstantiation</dfn> methods</li>
 
+     <li>The <dfn data-x-href="https://tc39.github.io/ecma262/#sec-allocatesharedarraybuffer">AllocateSharedArrayBuffer</dfn> abstract operation</li>
      <li>The <dfn data-x-href="https://tc39.github.io/ecma262/#sec-arraycreate">ArrayCreate</dfn> abstract operation</li>
      <li>The <dfn data-x-href="https://tc39.github.io/ecma262/#sec-call">Call</dfn> abstract operation</li>
      <li>The <dfn data-x-href="https://tc39.github.io/ecma262/#sec-clonearraybuffer">CloneArrayBuffer</dfn> abstract operation</li>
@@ -7799,17 +7801,36 @@ interface <dfn>DOMStringList</dfn> {
       <p>If <span>IsSharedArrayBuffer</span>(<var>input</var>) is true, then:</p>
 
       <ol>
-       <li><p>If <var>targetRealm</var>'s <span data-x="concept-realm-settings-object">settings
-       object</span>'s <span>responsible event loop</span> is not in the same <span>unit of
-       share-within-able event loops</span> as the <span>current Realm Record</span>'s <span
-       data-x="concept-realm-settings-object">settings object</span>'s <span>responsible event
-       loop</span>, then throw a <span>"<code>DataCloneError</code>"</span>
-       <code>DOMException</code>.</p></li>
+       <li>
+        <p>If <var>targetRealm</var>'s <span data-x="concept-realm-settings-object">settings
+        object</span>'s <span>responsible event loop</span> is not in the same <span>unit of
+        share-within-able event loops</span> as the <span>current Realm Record</span>'s <span
+        data-x="concept-realm-settings-object">settings object</span>'s <span>responsible event
+        loop</span>, then:</p>
+
+        <ol>
+         <li><p>Let <var>outputConstructor</var> be the <span>%SharedArrayBuffer%</span> intrinsic
+         object in <var>targetRealm</var>.</p></li>
+
+         <li><p>Let <var>output</var> be !
+         <span>AllocateSharedArrayBuffer</span>(<var>outputConstructor</var>, 0).</p></li>
+        </ol>
+
+        <p class="note">The reason that this step creates a zero-length
+        <code>SharedArrayBuffer</code> instance, instead of throwing an error, is due to the fact
+        that at the time <span>StructuredCloneWithTransfer</span> is performed, the
+        <var>targetRealm</var> is not always known, so we cannot synchronously throw an error to the
+        caller. (An example is when we use <code
+        data-x="dom-MessagePort-postMessage">postMessage()</code> on a <code>MessagePort</code>
+        whose messages are initially paused.) This subtlety is unfortunately obfuscated by the
+        current <span>StructuredCloneWithTransfer</span> algorithm; see <a
+        href="https://github.com/whatwg/html/issues/935">issue #935</a>.</p>
+       </li>
 
-       <li><p>Let <var>output</var> be a new SharedArrayBuffer object in <var>targetRealm</var>
-       whose [[ArrayBufferData]] internal slot value is <var>input</var>.[[ArrayBufferData]] and
-       whose [[ArrayBufferByteLength]] internal slot value is
-       <var>input</var>.[[ArrayBufferByteLength]].</p></li>
+       <li><p>Otherwise, let <var>output</var> be a new SharedArrayBuffer object in
+       <var>targetRealm</var> whose [[ArrayBufferData]] internal slot value is
+       <var>input</var>.[[ArrayBufferData]] and whose [[ArrayBufferByteLength]] internal slot value
+       is <var>input</var>.[[ArrayBufferByteLength]].</p></li>
       </ol>
      </li>
 

From 8f2105fd720777af42c88e197b0c62fa46d03ee1 Mon Sep 17 00:00:00 2001
From: Domenic Denicola <d@domenic.me>
Date: Wed, 15 Feb 2017 20:23:14 -0500
Subject: [PATCH 4/4] "Serializability of script execution" needs updating

---
 source | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/source b/source
index 03679ba7d20..58cfc9fca0a 100644
--- a/source
+++ b/source
@@ -495,6 +495,13 @@
   be thought of as completely serializing the execution of all scripts in all <span data-x="browsing
   context">browsing contexts</span>.</p>
 
+  <p>The exception to this general design principle is the JavaScript <code>SharedArrayBuffer</code>
+  class. Using <code>SharedArrayBuffer</code>s, it can in fact be observed that scripts in other
+  <span data-x="event loop">event loops</span> are executing simultaneously. Furthermore, due to the
+  JavaScript memory model, there are situations which not only are un-representable via serialized
+  <em>script</em> execution, but also un-representable via serialized <em>statement</em> execution
+  among those scripts.</p>
+
   </div>