Ignore document.open/write after the active parser has been aborted

Fixes #4723.

source

@@ -85474,7 +85474,6 @@ interface <dfn>BeforeUnloadEvent</dfn> : <span>Event</span> {
   <p>To <dfn data-x="abort a document">abort</dfn> a <code>Document</code> <var>document</var>:</p>
 
   <ol>
-
    <li><p><span data-x="abort a document">Abort</span> the <span data-x="active document">active
    documents</span> of every <span>child browsing context</span>. If this results in any of those
    <code>Document</code> objects having their <i
@@ -85491,12 +85490,18 @@ interface <dfn>BeforeUnloadEvent</dfn> : <span>Event</span> {
    discarded, then set <var>document</var>'s <i
    data-x="concept-document-salvageable">salvageable</i> state to false.</p></li>
 
-   <li><p>If <var>document</var> has an <span>active parser</span>, then <span data-x="abort a
-   parser">abort that parser</span> and set <var>document</var>'s <i
-   data-x="concept-document-salvageable">salvageable</i> state to false.</p></li>
+   <li>
+    <p>If <var>document</var> has an <span>active parser</span>, then:</p>
+
+    <ol>
+     <li><p>Set <var>document</var>'s <span>active parser was aborted</span> to true.</p></li>
 
-   <!-- we could also stop all script, or stop animations -->
+     <li><p><span data-x="abort a parser">Abort that parser</span>.</p></li>
 
+     <li><p>Set <var>document</var>'s <i data-x="concept-document-salvageable">salvageable</i> state
+     to false.</p></li>
+    </ol>
+   </li>
   </ol>
 
   <p>User agents may allow users to explicitly invoke the <span data-x="abort a document">abort a
@@ -93444,6 +93449,11 @@ document.body.appendChild(frame)</code></pre>
   method (directly or indirectly) while the document is <span data-x="unload a document">being
   unloaded</span>. Initially, the counter must be set to zero.</p>
 
+  <p><code>Document</code> objects have an <dfn>active parser was aborted</dfn> boolean, which is
+  used to prevent scripts from invoking the <code data-x="dom-document-open">document.open()</code>
+  and <code data-x="dom-document-write">document.write()</code> methods (directly or indirectly)
+  after the document's <span>active parser</span> has been aborted. It is initially false.</p>
+
   <p>The <dfn>document open steps</dfn>, given a <var>document</var>, are as follows:</p>
 
   <ol>
@@ -93480,6 +93490,16 @@ document.body.appendChild(frame)</code></pre>
     handler while the <code>Document</code> is being unloaded.</p>
    </li>
 
+   <li>
+    <p>If <var>document</var>'s <span>active parser was aborted</span> is true, then return
+    <var>document</var>.</p>
+
+    <p class="note">This notably causes <code data-x="dom-document-open">document.open()</code> to
+    be ignored if it is called after a <span data-x="navigate">navigation</span> has started, but
+    only during the initial parse. See <a href="https://github.com/whatwg/html/issues/4723">issue
+    #4723</a> for more background.</p>
+   </li>
+
    <li>
     <p>If <var>document</var>'s <span data-x="concept-document-bc">browsing context</span> is
     non-null and there is an existing attempt to <span>navigate</span> <var>document</var>'s <span
@@ -93692,6 +93712,9 @@ document.body.appendChild(frame)</code></pre>
    than 0, then throw an <span>"<code>InvalidStateError</code>"</span>
    <code>DOMException</code>.</p></li>
 
+   <li><p>If <var>document</var>'s <span>active parser was aborted</span> is true, then
+   return.</p></li>
+
    <li>
     <p>If the <span>insertion point</span> is undefined, then: