diff --git a/spec/index.bs b/spec/index.bs
index e023b1be..535cdf28 100644
--- a/spec/index.bs
+++ b/spec/index.bs
@@ -1248,23 +1248,15 @@ partial interface mixin WindowOrWorkerGlobalScope {
};
-To the [[HTML5#timer-initialisation-steps|timer initialization steps algorithm]],
-add this step between 7.1 and 7.2:
-
-1. If the first operation argument is not a {{Function}}, set the first operation argument to the result of executing
- the [$Get Trusted Type compliant string$] algorithm, with
- * |global| set to the [=this=] value's [=relevant global object=].
- * |input| set to the first method argument, and
- * |expectedType| set to {{TrustedScript}}.
- * |sink| set to `Window setInterval` if repeat is true, `Window setTimeout` otherwise.
- * |sinkGroup| set to `'script'`.
-
- Note: This matches the logic that the extended attribute would apply.
-
Note: This makes sure that a {{TrustedScript}} is passed to timer
functions in place of a string when Trusted Types are enforced, but
also unconditionally accepts any {{Function}} object.
+To the [[HTML5#timer-initialisation-steps|timer initialization steps algorithm]],
+change step 8.4.3 as follows:
+
+1. Perform HostEnsureCanCompileStringsEnsureCSPDoesNotBlockStringCompilation(realm, « », handler, false, handler, ~timer~, « », handler). If this throws an exception, catch it, report the exception, and abort these steps.
+
### Enforcement in event handler content attributes ### {#enforcement-in-event-handler-content-attributes}
This document modifies the
@@ -1668,32 +1660,35 @@ The Trusted Types portion of this algorithm uses |calleeRealm| and its CSP setti
Given a [[ECMA-262#realm|realm]] (|calleeRealm|), a list of strings (|parameterStrings|), a string (|bodyString|), a string (|source|), an enum (|compilationType|), a list of ECMAScript language values (|parameterArgs|), and an ECMAScript language value (|bodyArg|), this algorithm returns normally if compilation is allowed, and
throws an "`EvalError`" if not:
-1. Let |compilationSink| be `"Function"` if |compilationType| is `*FUNCTION*`, otherwise `"Eval"`.
-1. Let |isTrusted| be `true`.
-1. If |bodyArg| is not a {{TrustedScript}} object, set |isTrusted| to `false`.
-1. If |isTrusted| is `true` then:
- 1. If |bodyString| is not equal to |bodyArg|'s [=TrustedScript/[[Data]]=] internal slot, set |isTrusted| to `false`.
-1. If |isTrusted| is `true`, then:
- 1. For each |arg| in |parameterArgs|:
- 1. Let |index| be the index of |arg| in |parameterArgs|.
- 1. If |arg| is not a {{TrustedScript}} object, set |isTrusted| to `false`.
- 1. If |isTrusted| is `true`, then:
- 1. if |parameterStrings|[|index|] is not equal to |arg|'s [=TrustedScript/[[Data]]=] internal slot, set |isTrusted| to `false`.
-1. If |isTrusted| is `true`, let |sourceToValidate| be a new instance of
- the {{TrustedScript}} interface, with its [=TrustedScript/[[Data]]=] internal slot value
- set to |source|. Otherwise, let |sourceToValidate| be |source|.
-
-1. Let |sourceString| be the result of executing the
- [$Get Trusted Type compliant string$] algorithm, with:
- * |calleeRealm| as |global|,
- * |sourceToValidate| as |input|,
- * |compilationSink| as |sink|,
- * `'script'` as |sinkGroup|,
- * {{TrustedScript}} as |expectedType|.
-
-1. If the algorithm throws an error, throw an {{EvalError}}.
-
-1. If |sourceString| is not equal to |source|, throw an {{EvalError}}.
+1. If |compilationType| is `*TIMER*`, then:
+ 1. Let |sourceString| be |source|.
+1. Else:
+ 1. Let |compilationSink| be `"Function"` if |compilationType| is `*FUNCTION*`, otherwise `"Eval"`.
+ 1. Let |isTrusted| be `true`.
+ 1. If |bodyArg| is not a {{TrustedScript}} object, set |isTrusted| to `false`.
+ 1. If |isTrusted| is `true` then:
+ 1. If |bodyString| is not equal to |bodyArg|'s [=TrustedScript/[[Data]]=] internal slot, set |isTrusted| to `false`.
+ 1. If |isTrusted| is `true`, then:
+ 1. For each |arg| in |parameterArgs|:
+ 1. Let |index| be the index of |arg| in |parameterArgs|.
+ 1. If |arg| is not a {{TrustedScript}} object, set |isTrusted| to `false`.
+ 1. If |isTrusted| is `true`, then:
+ 1. if |parameterStrings|[|index|] is not equal to |arg|'s [=TrustedScript/[[Data]]=] internal slot, set |isTrusted| to `false`.
+ 1. If |isTrusted| is `true`, let |sourceToValidate| be a new instance of
+ the {{TrustedScript}} interface, with its [=TrustedScript/[[Data]]=] internal slot value
+ set to |source|. Otherwise, let |sourceToValidate| be |source|.
+
+ 1. Let |sourceString| be the result of executing the
+ [$Get Trusted Type compliant string$] algorithm, with:
+ * |calleeRealm| as |global|,
+ * |sourceToValidate| as |input|,
+ * |compilationSink| as |sink|,
+ * `'script'` as |sinkGroup|,
+ * {{TrustedScript}} as |expectedType|.
+
+ 1. If the algorithm throws an error, throw an {{EvalError}}.
+
+ 1. If |sourceString| is not equal to |source|, throw an {{EvalError}}.
1. Let |global| be a |calleeRealm|'s [=realm/global object=].