The problems of HTML5's session history modeling. Keynote available at https://www.icloud.com/keynote/0EXRQ8g5KCa2HRc5gYZLijLMw#shistory

1. Session History Modeling
in HTML5, Servo & Gecko
Samael Wang

2. HTML5 Modeling

3. HTML5 Terminology
0

4. HTML5 Terminology
10

5. HTML5 Terminology
1 2
3
0

6. HTML5 Terminology
1 2
3
0
§7.7.1 The session history of browsing contexts
The sequence of Documents in a browsing context
is its session history.
Each browsing context, including nested browsing
contexts, has a distinct session history.
A browsing context's session history consists of a
flat list of session history entries.

7. HTML5 Terminology
1 2
3
0
§7.7.1 The session history of browsing contexts
The sequence of Documents in a browsing context
is its session history.
Each browsing context, including nested browsing
contexts, has a distinct session history.
A browsing context's session history consists of a
flat list of session history entries.
session history of top-level browsing context
session history of a nested browsing context

8. HTML5 Terminology
1 2
3
0
§7.7.1 The session history of browsing contexts
At any point, one of the entries in the session
history is the current entry. This is the entry
representing the active document of the browsing
context.

9. HTML5 Terminology
1 2
3
0
§7.7.1 The session history of browsing contexts
At any point, one of the entries in the session
history is the current entry. This is the entry
representing the active document of the browsing
context.
current entry / active document
current entry / active document

10. HTML5 Terminology
1 2
3 4
0

11. HTML5 Terminology
21
3
5
4
0

12. HTML5 Terminology
21
3
5
4
0
§7.7.2 The History interface
A Document is said to be fully active when it has a
browsing context and it is the active document of
that browsing context, and either its browsing
context is a top-level browsing context, or it has a
parent browsing context and the Document
through which it is nested is itself fully active.

13. HTML5 Terminology
21
3
5
4
0
§7.7.2 The History interface
A Document is said to be fully active when it has a
browsing context and it is the active document of
that browsing context, and either its browsing
context is a top-level browsing context, or it has a
parent browsing context and the Document
through which it is nested is itself fully active.
active
fully active

14. HTML5 Terminology
21
3
5
4
0
active
fully active
§7.7.2 The History interface
The joint session history of a top-level browsing
context is the union of all the session histories of
all browsing contexts of all the fully active
Document objects that share that top-level
browsing context, …

15. HTML5 Terminology
21
3
5
4
0
active
fully active
§7.7.2 The History interface
The joint session history of a top-level browsing
context is the union of all the session histories of
all browsing contexts of all the fully active
Document objects that share that top-level
browsing context, …
0 1 2 5
joint session history

16. HTML5 Terminology
21
3
5
4
0
0 1 2 5
joint session history
§7.7.2 The History interface
To traverse the history by a delta delta, …
…
2. Let specified entry be the entry in the joint
session history whose index is the sum of delta
and the index of the current entry of the joint
session history.
3. Let specified browsing context be the browsing
context of the specified entry.
…
5.3. Traverse the history of the specified browsing
context to the specified entry.

17. HTML5 Terminology
2
4
51
3
0
0 1 2 5
joint session history

18. HTML5 Terminology
2
4
51
3
0
0 1 2 5
joint session history
§7.7.2 The History interface
The joint session history of a top-level browsing
context is the union of all the session histories of
all browsing contexts of all the fully active
Document objects that share that top-level
browsing context, with all the entries that are
current entries in their respective session
histories removed except for the current entry of
the joint session history.
The current entry of the joint session history is the
entry that most recently became a current entry in
its session history.
Entries in the joint session history are ordered
chronologically by the time they were added to
their respective session histories.

19. 0 1 32 5
HTML5 Terminology
2
4
51
3
0
joint session history
§7.7.2 The History interface
The joint session history of a top-level browsing
context is the union of all the session histories of
all browsing contexts of all the fully active
Document objects that share that top-level
browsing context, with all the entries that are
current entries in their respective session
histories removed except for the current entry of
the joint session history.
The current entry of the joint session history is the
entry that most recently became a current entry in
its session history.
Entries in the joint session history are ordered
chronologically by the time they were added to
their respective session histories.
0 1 3 4 5
?

20. 4
2
Defined by “A model of navigation history”
Join Session Past / Future
51
3
0
The session past of a browsing context is the
entries added before current entry. The session
future is the entries added after current entry.
The joint session past of a top-level browsing
context is the union of session pasts of all
browsing contexts of all the fully active Document
objects that share that top-level browsing context.
The joint session future is the union of session
futures of these browsing contexts. Both are
ordered chronologically by the time they were
added to their respective session histories.

21. 4
2
Defined by “A model of navigation history”
Join Session Past / Future
51
3
0
0 1 3 joint session past
The session past of a browsing context is the
entries added before current entry. The session
future is the entries added after current entry.
The joint session past of a top-level browsing
context is the union of session pasts of all
browsing contexts of all the fully active Document
objects that share that top-level browsing context.
The joint session future is the union of session
futures of these browsing contexts. Both are
ordered chronologically by the time they were
added to their respective session histories.

22. 4
2
Defined by “A model of navigation history”
Join Session Past / Future
51
3
0
0 1 3 joint session past
5joint session future
The session past of a browsing context is the
entries added before current entry. The session
future is the entries added after current entry.
The joint session past of a top-level browsing
context is the union of session pasts of all
browsing contexts of all the fully active Document
objects that share that top-level browsing context.
The joint session future is the union of session
futures of these browsing contexts. Both are
ordered chronologically by the time they were
added to their respective session histories.

23. Legend / Terminology
30
21
1
2 3
0
0
2
3
inactive
current entry / active
current entry / fully active
Number-ordered entries
Parent / child relationship
1
3
0
2
• current entry
• active document
• fully active document
• session past / future
• joint session past / future
• traverse the history by a delta
• traverse the history
(of a browsing context)
Terminology

24. Problems of HTML5
Modeling
https://arxiv.org/abs/1608.05444

25. 0
Traverse-then-traverse Example 1
1
2
3
42
1
0
1
2
3
42
1
history.go(1); history.go(1); history.go(2);
3 4joint session future 3 4joint session future

26. 0
Traverse-then-traverse Example 1
1
2
3
42
0
1
2
3
42
1
history.go(1); history.go(1); history.go(2);
3
3 4joint session future 3 4joint session future

27. 0
Traverse-then-traverse Example 1
1
2
3
42
0
1
2
3
42
1
history.go(1); history.go(1); history.go(2);
3
4joint session future 3 4joint session future

28. 0
Traverse-then-traverse Example 1
1
2
3
4
0
1
2
3
42
1
history.go(1); history.go(1); history.go(2);
3
4
4joint session future 3 4joint session future

29. 0
Traverse-then-traverse Example 1
1
2
3
4
0
1
2
3
4
1
history.go(1); history.go(1); history.go(2);
3
4 4
4joint session future 3 4joint session future

30. 0
Traverse-then-traverse Example 1
1
2
3
4
0
1
2
3
4
1
history.go(1); history.go(1); history.go(2);
3
4 4
4joint session future 3 4joint session future
This counterexample is caused by the definition of ‘traverses the history by δ’ which only
traverses one document’s session history. Instead, we should traverse the history of all δ
documents.

31. 3
0
3
Traverse-then-traverse Example 2
1 2
4
5 0
2
4
5
history.go(1); history.go(1); history.go(2);
0
1
2 5
joint session future joint session future
2 5
11

32. 3
0
3
Traverse-then-traverse Example 2
1 2
4
5 0
2
4
5
history.go(1); history.go(1); history.go(2);
0
2 5
joint session future joint session future
2 5
2 11

33. 3
0
3
Traverse-then-traverse Example 2
1 2
4
5 0
2
4
5
history.go(1); history.go(1); history.go(2);
0
5
joint session future joint session future
2 5
2
4
11

34. 0
3
Traverse-then-traverse Example 2
1 2
3 4
5 0
2
4
5
history.go(1); history.go(1); history.go(2);
0
5
joint session future joint session future
2 5
2
4
4
11

35. 0
3
Traverse-then-traverse Example 2
1 2
3 4
5 0
2
4
5
history.go(1); history.go(1); history.go(2);
5
joint session future joint session future
2 5
2
5
4
4
1

36. 0
3
Traverse-then-traverse Example 2
1 2
3 4
5 0
2
4
5
history.go(1); history.go(1); history.go(2);
5
joint session future joint session future
2 5
2
5
4
4
1
The problem this time is that the definition of ‘joint session history’ only includes the fully
active documents, not all active documents.

37. 2
4
22 33
0
Symmetric Example 1
1
3
4
history.go(-1); history.go(1);
1
joint session past
4
33
0
1
3

38. 2
4
22 33
0
Symmetric Example 1
1
3
4
history.go(-1); history.go(1);
1
joint session past
1
33
0
1
3

39. 2
4
22
joint session future
33
0
Symmetric Example 1
1
3
4
history.go(-1); history.go(1);
43
1
33
0
1
3

40. 2
4
2
joint session future
33
0
Symmetric Example 1
1
3
4
history.go(-1); history.go(1);
4
3
3
1
33
0
1
3

41. 2
4
2
joint session future
33
0
Symmetric Example 1
1
3
4
history.go(-1); history.go(1);
4
3
3
1
33
0
1
3
This counterexample is caused by an asymmetry in the definition of traversal: it is defined in
terms of navigating to a document d, and not navigating from a document.

42. 1
2 4
1
4
Symmetric Example 2
history.go(-1); history.go(1);
2
joint session past
0
2
31
4
0
2
3

43. 1
2 4
1
4
Symmetric Example 2
history.go(-1); history.go(1);
2
joint session past
0
2
31
0
3
2

44. 1
2 4
1
4
joint session future
Symmetric Example 2
history.go(-1); history.go(1);
43
0
2
31
0
3
2

45. 1
2 4
1
4
joint session future
Symmetric Example 2
history.go(-1); history.go(1);
43
0
2
3
0
33

46. 1
2 4
1
4
joint session future
Symmetric Example 2
history.go(-1); history.go(1);
43
0
2
3
0
33
The definition of navigation histories allows malformed state.

47. 2
1
1
4
Malformed Examples
2
3 3
4
1 2
3 4

48. 2
1
1
4
Malformed Examples
2
3 3
4
1 2
3 4
Definition: A navigation history is well formed whenever for any a ≲ b and c ≲ d,
if a ∈ A and d ∈ A then d ≤ b.
Translate: Documents in any session future should not be chronologically earlier than any
other active documents sharing the same root browsing context.

49. Navigation-causes-malformed Example
1
0
2
3
2

50. Navigation-causes-malformed Example
1
4
0
2
3

51. Navigation-causes-malformed Example
1
4
0
2
3
The joint session future should be deleted before adding any new document.

52. Servo’s Solution

53. Remove the definition of joint session history and current entry of the joint session history, and add
the following:
• The session past of a browsing context is the entries of the session history added before the
current entry (and does not include the current entry).
• The session future of a browsing context is the entries of the session history added after the
current entry (and does not include the current entry).
• If an entry has a next entry in the chronologically ordered session history, it is its successor.
• If an entry has a previous entry in the chronologically ordered session history, it is its predecessor.
• The joint session past of a top-level browsing context is the union of all the session pasts of all
browsing contexts that share that top-level browsing context. Entries in the joint session past are
in decreasing chronological order of the time they were added to their respective session histories.
• The joint session future of a top-level browsing context is the union of all the session futures of all
browsing contexts that share that top-level browsing context. Entries in the joint session future
are in increasing chronological order of the time their predecessor were added to their respective
session histories.

54. To traverse the history by a delta delta, …
1. Define the entry sequence as follows:
1. If delta is a positive integer +n, … let the entry sequence be the first n entries of the joint session future.
2. If delta is a negative integer −n, … let the entry sequence be the first n entries of the joint session past.
2. A session entry is said to become active when it is a member of the entry sequence, and no session entry after
it in the entry sequence has the same browsing context.
3. A session entry is said to stay active when it it the current entry of its browsing context, and there are no
members of the entry sequence with the same browsing context.
4. A session entry is said to be activating when either it will become active or stay active.
Note: the activating documents will be active after traversal has finished.
5. A session entry is said to be fully activating if is activating, and either its browsing context is a top-level
browsing context, or it has a parent browsing context and the session entry through which it is nested is itself
fully activating.
Note: the fully activating documents will be fully active after traversal has finished.

55. (cont’d)
For each specified entry in the entry sequence, run the following substeps
1. Let specified browsing context be the browsing context of the specified entry.
…
4. If the specified entry is activating but not fully activating, then set the current
entry of the session history of specified browsing context to be the specified entry.
5. If the specified entry is fully activating, then traverse the history of the specified
browsing context to the specified entry.
Note: in this case, the document will be fully active, so should be loaded.

56. Yet It Ain’t Perfect

57. §7.1.1 Nested browsing contexts
Certain elements (for example, iframe elements) can
instantiate further browsing contexts. These elements are
called browsing context containers.
Each browsing context container has a nested browsing
context, which is either a browsing context or null.
§7.7.1 The session history of
browsing contexts
A browsing context's session history consists of a flat list of
session history entries. Each session history entry consists, at
a minimum, of a URL, and each entry may in addition have …
1
0
2
3
4
nbc1
nbc2
Who’s holding nested browsing
context nbc1 & nbc2?

58. §7.3.4 Garbage collection and
browsing contexts
When a browsing context is to discard a Document, the user
agent must run the following steps:
…
5. Discard all the child browsing contexts of the Document.
6. Lose the strong reference from the Document's browsing
context to the Document.
When a browsing context is discarded, the strong reference
from the user agent itself to the browsing context must be
severed, and all the Document objects for all the entries in
the browsing context's session history must be discarded as
well.
1
0
2
3
4
nbc1
nbc2
Who’s holding nested browsing
context nbc1 & nbc2?

59. The lifetime of session history is bound to its
browsing context, not root browsing context.
When a document is discarded, it essentially
drops all nested session histories.
Browsers with no bfcache would have no
nested session history at all after root
navigation if it tries to align with the spec.
How long do we want to keep documents /
browsing contexts alive in a user agent?
Characteristics of Joint Session History

60. The lifetime of session history is bound to its
browsing context, not root browsing context.
When a document is discarded, it essentially
drops all nested session histories.
Browsers with no bfcache would have no
nested session history at all after root
navigation if it tries to align with the spec.
How long do we want to keep documents /
browsing contexts alive in a user agent?
About servo:
“In Servo, we don't ever
unload any documents
that are still in the
session history, but we
are working on adding
this.”
Characteristics of Joint Session History

61. Gecko's
Implementation

62. Both Chrome & Firefox are using a tree-structured model
2
Tree-structured Model
1
0
2
3
4
nbc1
nbc2
4
1
0
3
0
nbc1
nbc2
Entries matching nested browsing contexts,
but lifetime bound to root.

63. Tree-structured Model in Gecko
0

64. Tree-structured Model in Gecko
10

65. 3
2
Tree-structured Model in Gecko
10

66. 3
2
4
2
Tree-structured Model in Gecko
10
CloneAndReplaceChild

67. 3
2
4
2
Tree-structured Model in Gecko
10 5
CloneAndReplaceChild

68. 4
2
3
2
Tree-structured Model in Gecko
10 5
CloneAndReplaceChild

69. • Nested browsing context matching is tricky as there’s
no precious way to identify an iframe.
• Chrome generates a unique name for iframe with
window.name or position + some extra process.
• Gecko uses iframe ordering to match static iframes,
and doesn’t keep dynamic iframe entries after the
document is discarded (i.e. bound to bfcache).
• Deletion of an iframe causes redundant parent entries.
Drawbacks of Tree-structured Model

70. 40
Deletion of an iFrame Handling
0 0 0
31 1
nbc1
2
nbc2
console.log(history.length());
iframe.remove();
console.log(history.length());
Output?

71. 40
Deletion of an iFrame Handling
0 0 0 console.log(history.length());
iframe.remove();
console.log(history.length());
Output?

72. 40
Deletion of an iFrame Handling
console.log(history.length());
iframe.remove();
console.log(history.length());
Output?
RemoveDuplicate

73. 40
Deletion of an iFrame Handling
console.log(history.length());
iframe.remove();
console.log(history.length());
Output?
RemoveDuplicate
Without removing duplicate entries with current root
document, forward & backward navigation of the same
document would take no effect.

74. S
Deletion + Dynamic iFrame Handling

75. F1
AS
Deletion + Dynamic iFrame Handling

76. F2
A
F1
AS
Deletion + Dynamic iFrame Handling

77. F3
A
F2
A
F1
AS
Deletion + Dynamic iFrame Handling

78. F3
A
F2
A
F1
AS
Deletion + Dynamic iFrame Handlingvar ifr = window.frameElement;
var p = ifr.parentNode;
p.innerHTML =
'<h3>Top level page A, with replaced iframe</h3>' +
'<iframe height=400 width=300 src=A_iframe_3_replaced.html class=replaced></iframe>';

79. F3
A
F2
A
F1
AS
Deletion + Dynamic iFrame Handlingvar ifr = window.frameElement;
var p = ifr.parentNode;
p.innerHTML =
'<h3>Top level page A, with replaced iframe</h3>' +
'<iframe height=400 width=300 src=A_iframe_3_replaced.html class=replaced></iframe>';

80. AS
Deletion + Dynamic iFrame Handlingvar ifr = window.frameElement;
var p = ifr.parentNode;
p.innerHTML =
'<h3>Top level page A, with replaced iframe</h3>' +
'<iframe height=400 width=300 src=A_iframe_3_replaced.html class=replaced></iframe>';

81. AS
Fd
Deletion + Dynamic iFrame Handlingvar ifr = window.frameElement;
var p = ifr.parentNode;
p.innerHTML =
'<h3>Top level page A, with replaced iframe</h3>' +
'<iframe height=400 width=300 src=A_iframe_3_replaced.html class=replaced></iframe>';
The entries of dynamic iframe
will later be discarded when
bfcache dropped.

82. Fd
ASS
Deletion + Dynamic iFrame Handling
The entries of dynamic iframe
will later be discarded when
bfcache dropped.

83. F3
A
F2
A
F1
AS
BFCache

84. F3
A
F2
A
F1
AS
BFCache nsSHEntryShared Entries for the same
document point to a shared
instance of nsSHEntryShared
(nsIBFCacheEntry)

85. Document A iframe
DocShell
Content Viewer
Content Veiwer
Document F3
F3
A
F2
A
F1
AS
BFCache nsSHEntryShared Entries for the same
document point to a shared
instance of nsSHEntryShared
(nsIBFCacheEntry)
Root nsSHEntryShared holds the content viewer,
which holds the document, which holds its
frames & corresponding docshells / content
viewers / sub-documents of these frames.

86. F3
A
F2
A
F1
AS
BFCache
nsSHEntryShared
Nested nsSHEntryShared doesn’t
hold content viewer & document.
(unless you try to enable a feature
which we disabled 12yrs ago)

87. Find the spec issue:
https://github.com/whatwg/html/issues/
1454
If You’re Interested

89. Backup

90. §7.7.2 The History interface
To traverse the history by a delta delta, …
…
2. Let specified entry be the entry in the joint session history whose index is the sum
of delta and the index of the current entry of the joint session history.
3. Let specified browsing context be the browsing context of the specified entry.
…
5.3. Traverse the history of the specified browsing context to the specified entry.
History Traversal in HTML5

91. A navigation history H = (D, A, →, ≤, ∼) consists of:
• a finite set D (the documents),
• a subset A ⊆ D (the active documents),
• a forest (D, →) (the child relationship),
• a total order (D, ≤) (the chronological order), and
• an equivalence relation (D, ∼) (the same-session equivalence).
such that:
• for every d there is a unique d′ ∈ A such that d ∼ d′,
• for every d → e ∼ e′ we have d → e′, and
• for every d → e, we have d ≤ e.
Definition of Navigation History (1)

92. In such a navigation history, we define:
• d0 is the unique active root document,
• d ↠ e when d → e and e ∈ A (the active child relationship),
• FA = {d | d0 ↠
∗
d} (the fully active documents),
• d ≲ e whenever d ∼ e and d < e,
• the session future of d is {e | d ≲ e},
• the session past of d is {e | d ≳ e},
• the joint session future is {e | ∃d ∈ FA. d ≲ e},
• the joint session past is {e | ∃d ∈ FA. d ≳ e}
Definition of Navigation History (2)