From 124bad27ddadf01834b891604affb6379dbd93f4 Mon Sep 17 00:00:00 2001
From: Malte Ubl <cramforce@users.noreply.github.com>
Date: Mon, 1 Feb 2016 08:04:06 -0800
Subject: [PATCH 01/44] Update spec to correctly point out allowed link-rel
 values.

Fixes #1546
---
 spec/amp-html-format.md | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/spec/amp-html-format.md b/spec/amp-html-format.md
index 1923761e5c30..e988827c3116 100644
--- a/spec/amp-html-format.md
+++ b/spec/amp-html-format.md
@@ -126,11 +126,11 @@ HTML tags can be used unchanged in AMP HTML. Certain tags have equivalent custom
 | param     | Prohibited. |
 | applet    | Prohibited. |
 | embed     | Prohibited. |
-| form      | Prohibited. |
+| form      | Prohibited. [Support coming in the future.](https://github.com/ampproject/amphtml/issues/1286) |
 | input elements | Prohibited. Includes input, textarea, select, option. Notably, button element is allowed. |
 | button    | Allowed. |
 | <a name="cust"></a>style     | [Required style tags for adjusting opacity](#opacity) One additional style tag is allowed in head tag for the purpose of custom styling. This style tag must have the attribute `amp-custom`. [🔗](#cust) |
-| link      | Allowed for certain values of rel: `canonical`. `stylesheet` is generally disallowed, but some values may be whitelisted for font providers. |
+| link      | `rel` values registered on [microformats.org](http://microformats.org/wiki/existing-rel-values) are allowed. If a rel value is missing from our whitelist, [please submit an issue](https://github.com/ampproject/amphtml/issues/new). `stylesheet` and other values like `preconnect`, `prerender` and `prefectch` that has side effects in the browser are disallowed. There is a special case for fetching stylesheets from whitelisted font providers. |
 | meta      | The `http-equiv` attribute is banned. Otherwise allowed. |
 | <a name="ancr"></a>a         | The `href` attribute value must not begin with `javascript:`. If set, the `target` attribute value must be `_blank`. Otherwise allowed. [🔗](#ancr) |
 | svg       | Most SVG elements are allowed |

From 798e5274b329c8508c6ee8fb3c91754e177bcbba Mon Sep 17 00:00:00 2001
From: Malte Ubl <malte.ubl@gmail.com>
Date: Thu, 28 Jan 2016 17:44:57 -0800
Subject: [PATCH 02/44] Send GA client id to doubleclick and adsense if
 available.

Also renames the fallback cookie name to AMP_ECID_GOOGLE.
---
 ads/_config.js                          | 2 ++
 ads/adsense.js                          | 7 +++++++
 ads/doubleclick.js                      | 7 +++++++
 extensions/amp-analytics/0.1/vendors.js | 3 ++-
 4 files changed, 18 insertions(+), 1 deletion(-)

diff --git a/ads/_config.js b/ads/_config.js
index 1f3c8eef1074..4763f3339e5d 100644
--- a/ads/_config.js
+++ b/ads/_config.js
@@ -52,4 +52,6 @@ export const adPreconnect = {
 export const clientIdScope = {
   // Add a mapping like
   // adNetworkType: 'cidScope' here.
+  adsense: 'AMP_ECID_GOOGLE',
+  doubleclick: 'AMP_ECID_GOOGLE',
 };
diff --git a/ads/adsense.js b/ads/adsense.js
index 1938c429b7dd..5c4e4369ae57 100644
--- a/ads/adsense.js
+++ b/ads/adsense.js
@@ -22,6 +22,13 @@ import {checkData} from '../src/3p';
  */
 export function adsense(global, data) {
   checkData(data, ['adClient', 'adSlot']);
+  if (global.context.clientId) {
+    // Read by GPT for GA/GPT integration.
+    global.gaGlobal = {
+      vid: global.context.clientId,
+      hid: global.context.pageViewId,
+    };
+  }
   /*eslint "google-camelcase/google-camelcase": 0*/
   global.google_page_url = global.context.canonicalUrl;
   const s = document.createElement('script');
diff --git a/ads/doubleclick.js b/ads/doubleclick.js
index 2a26b62a4eaa..f78b1e2b502f 100644
--- a/ads/doubleclick.js
+++ b/ads/doubleclick.js
@@ -26,6 +26,13 @@ export function doubleclick(global, data) {
     'tagForChildDirectedTreatment', 'cookieOptions',
     'overrideWidth', 'overrideHeight',
   ]);
+  if (global.context.clientId) {
+    // Read by GPT for GA/GPT integration.
+    global.gaGlobal = {
+      vid: global.context.clientId,
+      hid: global.context.pageViewId,
+    };
+  }
   loadScript(global, 'https://www.googletagservices.com/tag/js/gpt.js', () => {
     global.googletag.cmd.push(function() {
       const googletag = global.googletag;
diff --git a/extensions/amp-analytics/0.1/vendors.js b/extensions/amp-analytics/0.1/vendors.js
index 8a8b26561fbf..ac9024d5eed9 100644
--- a/extensions/amp-analytics/0.1/vendors.js
+++ b/extensions/amp-analytics/0.1/vendors.js
@@ -66,7 +66,8 @@ export const ANALYTICS_CONFIG = {
       'host': 'https://www.google-analytics.com',
       'basePrefix': 'v=1&_v=a0&aip=true&_s=${requestCount}' +
           'dt=${title}&sr=${screenWidth}x${screenHeight}&_utmht=${timestamp}&' +
-          'jid=&cid=${clientId(_ga)}&tid=${account}&dl=${documentLocation}&' +
+          'jid=&cid=${clientId(AMP_ECID_GOOGLE)}&tid=${account}&' +
+          'dl=${documentLocation}&' +
           'dr=${documentReferrer}&sd=${screenColorDepth}&' +
           'ul=${browserLanguage}&de=${documentCharset}' ,
       'baseSuffix': '&a=${pageViewId}&z=${random}',

From 9b3bdb8c2d3d640bce19a417a1d326996546faf9 Mon Sep 17 00:00:00 2001
From: Dima Voytenko <dvoytenko@google.com>
Date: Tue, 2 Feb 2016 14:27:08 -0800
Subject: [PATCH 03/44] Recreate stored objects as prototype-less objects

---
 src/service/storage-impl.js     | 29 +++++++++++++++++++++----
 test/functional/test-storage.js | 38 +++++++++++++++++++++++++++++++++
 2 files changed, 63 insertions(+), 4 deletions(-)

diff --git a/src/service/storage-impl.js b/src/service/storage-impl.js
index b4efae21f8ea..db7d69562f31 100644
--- a/src/service/storage-impl.js
+++ b/src/service/storage-impl.js
@@ -18,6 +18,7 @@ import {assert} from '../asserts';
 import {getService} from '../service';
 import {getSourceOrigin} from '../url';
 import {isDevChannel, isExperimentOn} from '../experiments';
+import {isObject} from '../types';
 import {log} from '../log';
 import {timer} from '../timer';
 import {viewerFor} from '../viewer';
@@ -202,15 +203,15 @@ export class Store {
    */
   constructor(obj, opt_maxValues) {
     /** @const {!JSONObject} */
-    this.obj = obj;
+    this.obj = recreateObject(obj);
 
     /** @private @const {number} */
     this.maxValues_ = opt_maxValues || MAX_VALUES_PER_ORIGIN;
 
     /** @private @const {!Object<string, !JSONObject>} */
-    this.values_ = obj['vv'] || {};
-    if (!obj['vv']) {
-      obj['vv'] = this.values_;
+    this.values_ = this.obj['vv'] || Object.create(null);
+    if (!this.obj['vv']) {
+      this.obj['vv'] = this.values_;
     }
   }
 
@@ -231,6 +232,8 @@ export class Store {
    * @private
    */
   set(name, value) {
+    assert(name != '__proto__' && name != 'prototype',
+        'Name is not allowed: %s', name);
     // The structure is {key: {v: *, t: time}}
     if (this.values_[name] !== undefined) {
       const item = this.values_[name];
@@ -366,6 +369,24 @@ export class ViewerStorageBinding {
 }
 
 
+/**
+ * Recreates objects with prototype-less copies.
+ * @param {!JSONObject} obj
+ * @return {!JSONObject}
+ */
+function recreateObject(obj) {
+  const copy = Object.create(null);
+  for (const k in obj) {
+    if (!obj.hasOwnProperty(k)) {
+      continue;
+    }
+    const v = obj[k];
+    copy[k] = isObject(v) ? recreateObject(v) : v;
+  }
+  return copy;
+}
+
+
 /**
  * @param {!Window} window
  * @return {!Storage}
diff --git a/test/functional/test-storage.js b/test/functional/test-storage.js
index f561c2145278..7a5b93165ec6 100644
--- a/test/functional/test-storage.js
+++ b/test/functional/test-storage.js
@@ -101,6 +101,35 @@ describe('Storage', () => {
     });
   });
 
+  it('should initialize empty store with prototype-less objects', () => {
+    bindingMock.expects('loadBlob')
+        .withExactArgs('https://acme.com')
+        .returns(Promise.resolve(null))
+        .once();
+    return storage.get('key1').then(() => {
+      return storage.storePromise_;
+    }).then(store => {
+      expect(store.obj.__proto__).to.be.undefined;
+      expect(store.values_.__proto__).to.be.undefined;
+    });
+  });
+
+  it('should restore store with prototype-less objects', () => {
+    const store1 = new Store({});
+    store1.set('key1', 'value1');
+    store1.set('key2', 'value2');
+    bindingMock.expects('loadBlob')
+        .withExactArgs('https://acme.com')
+        .returns(Promise.resolve(btoa(JSON.stringify(store1.obj))))
+        .once();
+    return storage.get('key1').then(() => {
+      return storage.storePromise_;
+    }).then(store => {
+      expect(store.obj.__proto__).to.be.undefined;
+      expect(store.values_.__proto__).to.be.undefined;
+    });
+  });
+
   it('should get the value first time and reuse store', () => {
     const store1 = new Store({});
     store1.set('key1', 'value1');
@@ -391,6 +420,15 @@ describe('Store', () => {
     expect(store.get('k1')).to.be.undefined;
     expect(store.get('k2')).to.be.undefined;
   });
+
+  it('should prohibit unsafe values', () => {
+    expect(() => {
+      store.set('__proto__', 'value1');
+    }).to.throw(/Name is not allowed/);
+    expect(() => {
+      store.set('prototype', 'value1');
+    }).to.throw(/Name is not allowed/);
+  });
 });
 
 

From 5076ccf69cd644464719c63ff00225c245176413 Mon Sep 17 00:00:00 2001
From: Dima Voytenko <dvoytenko@google.com>
Date: Tue, 2 Feb 2016 16:39:30 -0800
Subject: [PATCH 04/44] Remove ambiguity of keys matching by requiring longer
 keys to match first

---
 src/url-replacements.js                  |  3 +++
 test/functional/test-url-replacements.js | 17 +++++++++++++++++
 2 files changed, 20 insertions(+)

diff --git a/src/url-replacements.js b/src/url-replacements.js
index b8db2527065a..96d8eab87cb5 100644
--- a/src/url-replacements.js
+++ b/src/url-replacements.js
@@ -351,6 +351,9 @@ class UrlReplacements {
    * @private
    */
   buildExpr_(keys) {
+    // The keys must be sorted to ensure that the longest keys are considered
+    // first. This avoids a problem where a RANDOM conflicts with RANDOM_ONE.
+    keys.sort((s1, s2) => s2.length - s1.length);
     const all = keys.join('|');
     // Match the given replacement patterns, as well as optionally
     // arguments to the replacement behind it in parantheses.
diff --git a/test/functional/test-url-replacements.js b/test/functional/test-url-replacements.js
index 9dcb1c3e912d..7a6f13c26e94 100644
--- a/test/functional/test-url-replacements.js
+++ b/test/functional/test-url-replacements.js
@@ -399,4 +399,21 @@ describe('UrlReplacements', () => {
       expect(res).to.equal('v=false');
     });
   });
+
+  it('should resolve sub-included bindings', () => {
+    // RANDOM is a standard property and we add RANDOM_OTHER.
+    return expand('r=RANDOM&ro=RANDOM_OTHER?', false, {'RANDOM_OTHER': 'ABC'})
+        .then(res => {
+          expect(res).to.match(/r=(\d\.\d+)&ro=ABC\?$/);
+        });
+  });
+
+  it('should expand multiple vars', () => {
+    return expand('a=VALUEA&b=VALUEB?', false, {
+      'VALUEA': 'aaa',
+      'VALUEB': 'bbb',
+    }).then(res => {
+      expect(res).to.match(/a=aaa&b=bbb\?$/);
+    });
+  });
 });

From a9497e599c2f95e88e422135e6f733bdab525fc2 Mon Sep 17 00:00:00 2001
From: Dima Voytenko <dvoytenko@google.com>
Date: Mon, 1 Feb 2016 13:41:14 -0800
Subject: [PATCH 05/44] Pass referrer from the viewer

---
 build-system/tasks/presubmit-checks.js        |  16 +-
 .../0.1/amp-dynamic-css-classes.js            |   8 +-
 .../0.1/test/test-runtime-classes.js          |   3 +-
 src/3p-frame.js                               |   4 +-
 src/service/viewer-impl.js                    |  95 ++++++++++-
 src/url-replacements.js                       |   3 +-
 test/functional/test-3p-frame.js              |  19 ++-
 test/functional/test-viewer.js                | 158 +++++++++++++++++-
 8 files changed, 285 insertions(+), 21 deletions(-)

diff --git a/build-system/tasks/presubmit-checks.js b/build-system/tasks/presubmit-checks.js
index 6e9c50156e4d..303adbfa3970 100644
--- a/build-system/tasks/presubmit-checks.js
+++ b/build-system/tasks/presubmit-checks.js
@@ -195,6 +195,12 @@ var forbiddenTerms = {
       'src/experiments.js',
     ]
   },
+  'isTrusted': {
+    message: requiresReviewPrivacy,
+    whitelist: [
+      'src/service/viewer-impl.js',
+    ]
+  },
   'eval\\(': '',
   'storageFor': {
     message: requiresReviewPrivacy,
@@ -243,7 +249,15 @@ var forbiddenTerms = {
     whitelist: [
       'extensions/amp-access/0.1/access-expr-impl.js',
     ],
-  }
+  },
+
+  // Overridden APIs.
+  '(doc.*)\\.referrer': {
+    message: 'Use Viewer.getReferrerUrl() instead.',
+    whitelist: [
+      'src/service/viewer-impl.js',
+    ],
+  },
 };
 
 var ThreePTermsMessage = 'The 3p bootstrap iframe has no polyfills loaded and' +
diff --git a/extensions/amp-dynamic-css-classes/0.1/amp-dynamic-css-classes.js b/extensions/amp-dynamic-css-classes/0.1/amp-dynamic-css-classes.js
index 2db1e9018c24..5c87c0cfaacc 100644
--- a/extensions/amp-dynamic-css-classes/0.1/amp-dynamic-css-classes.js
+++ b/extensions/amp-dynamic-css-classes/0.1/amp-dynamic-css-classes.js
@@ -14,11 +14,11 @@
  * limitations under the License.
  */
 
+import {getService} from '../../../src/service';
+import {isExperimentOn} from '../../../src/experiments';
+import {log} from '../../../src/log';
 import {parseUrl} from '../../../src/url';
 import {viewerFor} from '../../../src/viewer';
-import {log} from '../../../src/log';
-import {isExperimentOn} from '../../../src/experiments';
-import {getService} from '../../../src/service';
 import {vsyncFor} from '../../../src/vsync';
 
 /** @const */
@@ -33,7 +33,7 @@ const EXPERIMENT = 'dynamic-css-classes';
  * @returns {string}
  */
 function referrerDomain(win) {
-  const referrer = win.document.referrer;
+  const referrer = viewerFor(win).getReferrerUrl();
   if (referrer) {
     return parseUrl(referrer).hostname;
   }
diff --git a/extensions/amp-dynamic-css-classes/0.1/test/test-runtime-classes.js b/extensions/amp-dynamic-css-classes/0.1/test/test-runtime-classes.js
index 6e6b55177be0..67bf27e80876 100644
--- a/extensions/amp-dynamic-css-classes/0.1/test/test-runtime-classes.js
+++ b/extensions/amp-dynamic-css-classes/0.1/test/test-runtime-classes.js
@@ -16,6 +16,7 @@
 
 import {createServedIframe} from '../../../../testing/iframe';
 import {toggleExperiment} from '../../../../src/experiments';
+import {viewerFor} from '../../../../src/viewer';
 import {vsyncFor} from '../../../../src/vsync';
 
 function overwrite(object, property, value) {
@@ -56,7 +57,7 @@ describe('dynamic classes are inserted at runtime', () => {
         overwrite(win.navigator, 'userAgent', userAgent);
       }
       if (referrer !== undefined) {
-        overwrite(fixture.doc, 'referrer', referrer);
+        viewerFor(win).getReferrerUrl = () => referrer;
       }
 
       return win.insertDynamicCssScript();
diff --git a/src/3p-frame.js b/src/3p-frame.js
index e4e0512618c0..4adaaf5122cc 100644
--- a/src/3p-frame.js
+++ b/src/3p-frame.js
@@ -23,6 +23,7 @@ import {getMode} from './mode';
 import {preconnectFor} from './preconnect';
 import {dashToCamelCase} from './string';
 import {parseUrl, assertHttpsUrl} from './url';
+import {viewerFor} from './viewer';
 
 
 /** @type {!Object<string,number>} Number of 3p frames on the for that type. */
@@ -55,6 +56,7 @@ function getFrameAttributes(parentWindow, element, opt_type) {
   attributes.initialWindowHeight = box.height;
   attributes.type = type;
   const docInfo = documentInfoFor(parentWindow);
+  const viewer = viewerFor(parentWindow);
   let locationHref = parentWindow.location.href;
   // This is really only needed for tests, but whatever. Children
   // see us as the logical origin, so telling them we are about:srcdoc
@@ -63,7 +65,7 @@ function getFrameAttributes(parentWindow, element, opt_type) {
     locationHref = parentWindow.parent.location.href;
   }
   attributes._context = {
-    referrer: parentWindow.document.referrer,
+    referrer: viewer.getReferrerUrl(),
     canonicalUrl: docInfo.canonicalUrl,
     pageViewId: docInfo.pageViewId,
     clientId: element.getAttribute('ampcid'),
diff --git a/src/service/viewer-impl.js b/src/service/viewer-impl.js
index fac189e24786..087f0f37495c 100644
--- a/src/service/viewer-impl.js
+++ b/src/service/viewer-impl.js
@@ -19,7 +19,7 @@ import {assert} from '../asserts';
 import {documentStateFor} from '../document-state';
 import {getService} from '../service';
 import {log} from '../log';
-import {parseQueryString, removeFragment} from '../url';
+import {parseQueryString, parseUrl, removeFragment} from '../url';
 import {platform} from '../platform';
 
 
@@ -74,6 +74,20 @@ export const VisibilityState = {
 };
 
 
+/**
+ * These domains are trusted with more sensitive viewer operations such as
+ * propagating the referrer. If you believe your domain should be here,
+ * file the issue on GitHub to discuss. The process will be similar
+ * (but somewhat more stringent) to the one described in the [3p/README.md](
+ * https://github.com/ampproject/amphtml/blob/master/3p/README.md)
+ *
+ * @export {!Array<!RegExp>}
+ */
+export const TRUSTED_VIEWER_HOSTS = [
+  /^(.*\.)?(google)(\.com?)?(\.[a-z]{2})?$/
+];
+
+
 /**
  * An AMP representation of the Viewer. This class doesn't do any work itself
  * but instead delegates everything to the actual viewer. This class and the
@@ -215,6 +229,9 @@ export class Viewer {
     // Wait for document to become visible.
     this.docState_.onVisibilityChanged(this.onVisibilityChange_.bind(this));
 
+    /** @const @private {boolean} */
+    this.isTrustedViewer_ = this.calcTrustedViewer_();
+
     // Remove hash - no reason to keep it around, but only when embedded.
     if (this.isEmbedded_) {
       const newUrl = removeFragment(this.win.location.href);
@@ -391,6 +408,82 @@ export class Viewer {
     return this.paddingTop_;
   }
 
+  /**
+   * Returns the "referrer" URL that can be optionally customized by
+   * the viewer.
+   * @return {string}
+   */
+  getReferrerUrl() {
+    // If not embedded in a IFrame always return the document's referrer.
+    if (!this.isEmbedded()) {
+      return this.win.document.referrer;
+    }
+
+    // Viewer override, but only for whitelisted viewers.
+    if (this.params_['referrer'] && this.isTrustedViewer()) {
+      return this.params_['referrer'];
+    }
+
+    // Document's referrer.
+    if (this.win.document.referrer) {
+      return this.win.document.referrer;
+    }
+
+    // Ancestor in the embedded case.
+    const ancestorOrigins = this.win.location.ancestorOrigins;
+    if (ancestorOrigins && ancestorOrigins.length > 0) {
+      return ancestorOrigins[0];
+    }
+
+    // No referrer found.
+    return '';
+  }
+
+  /**
+   * Whether the viewer has been whitelisted for more sensitive operations
+   * such as customizing referrer.
+   * @return {boolean}
+   */
+  isTrustedViewer() {
+    return this.isTrustedViewer_;
+  }
+
+  /**
+   * @return {boolean}
+   */
+  calcTrustedViewer_() {
+    // This only applies to the documents embedded as iframes.
+    if (!this.isEmbedded_) {
+      return false;
+    }
+
+    // Ancestors when available take precedence. This is the main API used
+    // for this determination. Fallback is only done when this API is not
+    // supported by the browser.
+    const ancestorOrigins = this.win.location.ancestorOrigins;
+    if (ancestorOrigins) {
+      return (ancestorOrigins.length > 0 &&
+          this.isTrustedViewerOrigin_(ancestorOrigins[0]));
+    }
+
+    // Fallback to the referrer if ancestorOrigins is not available.
+    return this.isTrustedViewerOrigin_(this.win.document.referrer);
+  }
+
+  /**
+   * @param {string} urlString
+   * @return {boolean}
+   * @private
+   */
+  isTrustedViewerOrigin_(urlString) {
+    const url = parseUrl(urlString);
+    if (url.protocol != 'https:') {
+      // Non-https origins are never trusted.
+      return false;
+    }
+    return TRUSTED_VIEWER_HOSTS.some(th => th.test(url.hostname));
+  }
+
   /**
    * Adds a "visibilitychange" event listener for viewer events. The
    * callback can check {@link isVisible} and {@link getPrefetchCount}
diff --git a/src/url-replacements.js b/src/url-replacements.js
index b8db2527065a..4ae1a4058ff2 100644
--- a/src/url-replacements.js
+++ b/src/url-replacements.js
@@ -21,6 +21,7 @@ import {getService} from './service';
 import {loadPromise} from './event-helper';
 import {log} from './log';
 import {parseUrl, removeFragment} from './url';
+import {viewerFor} from './viewer';
 import {viewportFor} from './viewport';
 import {vsyncFor} from './vsync';
 import {userNotificationManagerFor} from './user-notification';
@@ -68,7 +69,7 @@ class UrlReplacements {
 
     // Returns the referrer URL.
     this.set_('DOCUMENT_REFERRER', () => {
-      return this.win_.document.referrer;
+      return viewerFor(this.win_).getReferrerUrl();
     });
 
     // Returns the title of this AMP document.
diff --git a/test/functional/test-3p-frame.js b/test/functional/test-3p-frame.js
index 73849d826939..03b7ade5f028 100644
--- a/test/functional/test-3p-frame.js
+++ b/test/functional/test-3p-frame.js
@@ -21,9 +21,14 @@ import {documentInfoFor} from '../../src/document-info';
 import {loadPromise} from '../../src/event-helper';
 import {setModeForTesting} from '../../src/mode';
 import {resetServiceForTesting} from '../../src/service';
+import {viewerFor} from '../../src/viewer';
 
 describe('3p-frame', () => {
 
+  beforeEach(() => {
+    sandbox = sinon.sandbox.create();
+  });
+
   afterEach(() => {
     resetServiceForTesting(window, 'bootstrapBaseUrl');
     setModeForTesting(null);
@@ -32,6 +37,8 @@ describe('3p-frame', () => {
     if (m) {
       m.parentElement.removeChild(m);
     }
+    sandbox.restore();
+    sandbox = null;
   });
 
   function addCustomBootstrap(url) {
@@ -85,10 +92,14 @@ describe('3p-frame', () => {
       };
     };
 
+    const viewer = viewerFor(window);
+    const viewerMock = sandbox.mock(viewer);
+    viewerMock.expects('getReferrerUrl')
+        .returns('http://acme.org/')
+        .once();
+
     const iframe = getIframe(window, div, '_ping_');
     const src = iframe.src;
-    const referrer = window.document.referrer;
-    expect(referrer).to.not.be.empty;
     const locationHref = location.href;
     expect(locationHref).to.not.be.empty;
     const docInfo = documentInfoFor(window);
@@ -96,7 +107,7 @@ describe('3p-frame', () => {
     const fragment =
         '#{"testAttr":"value","ping":"pong","width":50,"height":100,' +
         '"initialWindowWidth":100,"initialWindowHeight":200,"type":"_ping_"' +
-        ',"_context":{"referrer":"' + referrer + '",' +
+        ',"_context":{"referrer":"http://acme.org/",' +
         '"canonicalUrl":"https://foo.bar/baz",' +
         '"pageViewId":"' + docInfo.pageViewId + '","clientId":"cidValue",' +
         '"location":{"href":"' + locationHref + '"},"tagName":"MY-ELEMENT",' +
@@ -120,7 +131,7 @@ describe('3p-frame', () => {
         expect(win.context.location.originValidated).to.be.false;
       }
       expect(win.context.pageViewId).to.equal(docInfo.pageViewId);
-      expect(win.context.referrer).to.equal(referrer);
+      expect(win.context.referrer).to.equal('http://acme.org/');
       expect(win.context.data.testAttr).to.equal('value');
       expect(win.context.noContentAvailable).to.be.a('function');
       expect(win.context.observeIntersection).to.be.a('function');
diff --git a/test/functional/test-viewer.js b/test/functional/test-viewer.js
index f59e1c431345..9cce48c30b89 100644
--- a/test/functional/test-viewer.js
+++ b/test/functional/test-viewer.js
@@ -30,7 +30,16 @@ describe('Viewer', () => {
     const WindowApi = function() {};
     WindowApi.prototype.setTimeout = function() {};
     windowApi = new WindowApi();
-    windowApi.location = {hash: '', href: '/test/viewer'};
+    windowApi.location = {
+      hash: '',
+      href: '/test/viewer',
+      ancestorOrigins: null,
+    };
+    windowApi.document = {
+      referrer: '',
+      body: {style: {}},
+      documentElement: {style: {}},
+    };
     windowMock = sandbox.mock(windowApi);
     viewer = new Viewer(windowApi);
   });
@@ -55,7 +64,6 @@ describe('Viewer', () => {
     windowApi.name = '__AMP__viewportType=virtual&width=222&height=333' +
         '&scrollTop=15';
     windowApi.location.hash = '#width=111&paddingTop=17&other=something';
-    windowApi.document = {body: {style: {}}};
     const viewer = new Viewer(windowApi);
     expect(viewer.getViewportType()).to.equal('virtual');
     expect(viewer.getViewportWidth()).to.equal(111);
@@ -86,9 +94,6 @@ describe('Viewer', () => {
   it('should configure correctly for iOS embedding', () => {
     windowApi.name = '__AMP__viewportType=natural';
     windowApi.parent = {};
-    const body = {style: {}};
-    const documentElement = {style: {}};
-    windowApi.document = {body: body, documentElement: documentElement};
     sandbox.mock(platform).expects('isIos').returns(true).once();
     const viewer = new Viewer(windowApi);
 
@@ -98,9 +103,6 @@ describe('Viewer', () => {
   it('should NOT configure for iOS embedding if not embedded', () => {
     windowApi.name = '__AMP__viewportType=natural';
     windowApi.parent = windowApi;
-    const body = {style: {}};
-    const documentElement = {style: {}};
-    windowApi.document = {body: body, documentElement: documentElement};
     sandbox.mock(platform).expects('isIos').returns(true).once();
     expect(new Viewer(windowApi).getViewportType()).to.equal('natural');
 
@@ -211,4 +213,144 @@ describe('Viewer', () => {
     expect(delivered[1].eventType).to.equal('documentResized');
     expect(delivered[1].data.width).to.equal(13);
   });
+
+  describe('isTrustedViewer', () => {
+    function test(referrer, toBeTrusted) {
+      windowApi.parent = {};
+
+      windowApi.location.ancestorOrigins = referrer ? [referrer] : [];
+      expect(new Viewer(windowApi).isTrustedViewer())
+          .to.equal(toBeTrusted, 'by ancestor');
+      windowApi.location.ancestorOrigins = null;
+
+      windowApi.document.referrer = referrer;
+      expect(new Viewer(windowApi).isTrustedViewer())
+          .to.equal(toBeTrusted, 'by referrer');
+      windowApi.document.referrer = '';
+    }
+
+    it('should verify ancestorOrigins ahead of referrer', () => {
+      windowApi.parent = {};
+      windowApi.document.referrer = 'https://google.com';
+      expect(new Viewer(windowApi).isTrustedViewer()).to.equal(true);
+
+      windowApi.location.ancestorOrigins = ['https://google.com'];
+      expect(new Viewer(windowApi).isTrustedViewer()).to.equal(true);
+
+      windowApi.location.ancestorOrigins = ['https://google.other.com'];
+      expect(new Viewer(windowApi).isTrustedViewer()).to.equal(false);
+
+      // Even empty ancestorOrigins takes precendence.
+      windowApi.location.ancestorOrigins = [];
+      expect(new Viewer(windowApi).isTrustedViewer()).to.equal(false);
+    });
+
+    it('should only consider viewer trusted when iframed', () => {
+      windowApi.parent = {};
+      windowApi.location.ancestorOrigins = ['https://google.com'];
+      expect(new Viewer(windowApi).isTrustedViewer()).to.equal(true);
+
+      windowApi.parent = windowApi;
+      expect(new Viewer(windowApi).isTrustedViewer()).to.equal(false);
+    });
+
+    it('should flag viewer as not trusted without referrer or ancestor', () => {
+      test('', false);
+    });
+
+    it('should trust host as referrer with https', () => {
+      test('https://google.com', true);
+    });
+
+    it('should not trust host as referrer with http', () => {
+      test('http://google.com', false);
+    });
+
+    it('should trust domain variations', () => {
+      test('https://google.com', true);
+      test('https://www.google.com', true);
+      test('https://news.google.com', true);
+      test('https://www.google.co.uk', true);
+      test('https://www.google.co.au', true);
+      test('https://news.google.co.uk', true);
+      test('https://news.google.co.au', true);
+      test('https://google.de', true);
+      test('https://www.google.de', true);
+      test('https://news.google.de', true);
+    });
+
+    it('should NOT trust wrong or non-whitelisted domain variations', () => {
+      test('https://google.net', false);
+      test('https://google.other.com', false);
+      test('https://www.google.other.com', false);
+      test('https://withgoogle.com', false);
+      test('https://acme.com', false);
+    });
+  });
+
+  describe('referrer', () => {
+    it('should return overridden trusted viewer referrer by ancestor', () => {
+      windowApi.parent = {};
+      windowApi.location.hash = '#referrer=' +
+          encodeURIComponent('https://acme.org/viewer');
+      windowApi.location.ancestorOrigins = [
+        'https://google.com'
+      ];
+      expect(new Viewer(windowApi).getReferrerUrl())
+          .to.equal('https://acme.org/viewer');
+    });
+
+    it('should return overridden trusted viewer referrer by referrer', () => {
+      windowApi.parent = {};
+      windowApi.location.hash = '#referrer=' +
+          encodeURIComponent('https://acme.org/viewer');
+      windowApi.document.referrer = 'https://google.com/';
+      expect(new Viewer(windowApi).getReferrerUrl())
+          .to.equal('https://acme.org/viewer');
+    });
+
+    it('should return document referrer if no viewer referrer', () => {
+      windowApi.parent = {};
+      windowApi.location.hash = '#';
+      windowApi.document.referrer = 'https://acme.org/docref';
+      expect(new Viewer(windowApi).getReferrerUrl())
+          .to.equal('https://acme.org/docref');
+    });
+
+    it('should return document referrer if not embedded', () => {
+      windowApi.parent = windowApi;  // Top window.
+      windowApi.document.referrer = 'https://acme.org/docref';
+      windowApi.location.hash = '#referrer=' +
+          encodeURIComponent('https://acme.org/viewer');
+      expect(new Viewer(windowApi).getReferrerUrl())
+          .to.equal('https://acme.org/docref');
+    });
+
+    it('should return doc referrer if not embedded by trusted viewer', () => {
+      windowApi.parent = {};
+      windowApi.document.referrer = 'https://acme.org/docref';
+      windowApi.location.hash = '#referrer=' +
+          encodeURIComponent('https://acme.org/viewer');
+      windowApi.location.ancestorOrigins = ['https://acme.org/viewer'];
+      expect(new Viewer(windowApi).getReferrerUrl())
+          .to.equal('https://acme.org/docref');
+    });
+
+    it('should return ancestor origin no viewer/doc referrer', () => {
+      windowApi.parent = {};
+      windowApi.location.hash = '#';
+      windowApi.location.ancestorOrigins = [
+        'https://acme.org/ancestor1',
+        'https://acme.org/ancestor2'
+      ];
+      expect(new Viewer(windowApi).getReferrerUrl())
+          .to.equal('https://acme.org/ancestor1');
+    });
+
+    it('should return empty string if nothing matches', () => {
+      windowApi.parent = {};
+      windowApi.location.hash = '#';
+      expect(new Viewer(windowApi).getReferrerUrl()).to.be.equal('');
+    });
+  });
 });

From bb4faca147a28e26522f181248b3f3b7c7d7abd0 Mon Sep 17 00:00:00 2001
From: dotandads <github@dotandmedia.com>
Date: Mon, 1 Feb 2016 17:49:48 +0100
Subject: [PATCH 06/44] added implementation for dotandads type for amp-ad

added implementation for dotandads type for amp-ad

fix merge

merge fix

fix merge

fix merge
---
 3p/integration.js     |  2 ++
 ads/_config.js        |  2 ++
 ads/dotandads.js      | 26 ++++++++++++++++++++++
 ads/dotandads.md      | 51 +++++++++++++++++++++++++++++++++++++++++++
 examples/ads.amp.html | 19 +++++++++++++++-
 5 files changed, 99 insertions(+), 1 deletion(-)
 create mode 100644 ads/dotandads.js
 create mode 100644 ads/dotandads.md

diff --git a/3p/integration.js b/3p/integration.js
index ab39988915d0..70a6dd951861 100644
--- a/3p/integration.js
+++ b/3p/integration.js
@@ -29,6 +29,7 @@ import {adsense} from '../ads/adsense';
 import {adtech} from '../ads/adtech';
 import {plista} from '../ads/plista';
 import {doubleclick} from '../ads/doubleclick';
+import {dotandads} from '../ads/dotandads';
 import {facebook} from './facebook';
 import {manageWin} from './environment';
 import {nonSensitiveDataPostMessage, listenParent} from './messaging';
@@ -53,6 +54,7 @@ register('adtech', adtech);
 register('plista', plista);
 register('doubleclick', doubleclick);
 register('taboola', taboola);
+register('dotandads', dotandads);
 register('_ping_', function(win, data) {
   win.document.getElementById('c').textContent = data.ping;
 });
diff --git a/ads/_config.js b/ads/_config.js
index 5fa606c3c567..83305495839d 100644
--- a/ads/_config.js
+++ b/ads/_config.js
@@ -25,6 +25,7 @@ export const adPrefetch = {
   doubleclick: 'https://www.googletagservices.com/tag/js/gpt.js',
   a9: 'https://c.amazon-adsystem.com/aax2/assoc.js',
   adsense: 'https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js',
+  dotandads: 'https://amp.ad.dotandad.com/dotandadsAmp.js',
 };
 
 /**
@@ -43,6 +44,7 @@ export const adPreconnect = {
     'https://securepubads.g.doubleclick.net',
     'https://tpc.googlesyndication.com',
   ],
+  dotandads: 'https://bal.ad.dotandad.com',
 };
 
 /**
diff --git a/ads/dotandads.js b/ads/dotandads.js
new file mode 100644
index 000000000000..e54b01a9c682
--- /dev/null
+++ b/ads/dotandads.js
@@ -0,0 +1,26 @@
+/**
+ * Copyright 2015 The AMP HTML Authors. All Rights Reserved.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS-IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import {writeScript} from '../src/3p';
+
+/**
+ * @param {!Window} global
+ * @param {!Object} data
+ */
+export function dotandads(global, data) {
+  global.data = data;
+  writeScript(global, 'https://amp.ad.dotandad.com/dotandadsAmp.js');
+}
diff --git a/ads/dotandads.md b/ads/dotandads.md
new file mode 100644
index 000000000000..43b80ded8240
--- /dev/null
+++ b/ads/dotandads.md
@@ -0,0 +1,51 @@
+<!---
+Copyright 2015 The AMP HTML Authors. All Rights Reserved.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS-IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+-->
+
+# DotAndAds
+
+## Example
+
+300x250 box: 
+```html
+<amp-ad width=300 height=250
+    type="dotandads"
+    data-sp="300x250-u"
+    data-mpo="ampTest"
+    data-mpt="amp-amp-all-all">
+</amp-ad>
+```
+
+980x250 masthead: 
+```html
+<amp-ad width=980 height=250
+    type="dotandads" 
+    data-sp='sn-u' 
+    data-cid="11" 
+    data-mpo="ampTest" 
+    data-mpt="amp-amp-all-all">
+</amp-ad>
+```
+
+## Configuration
+
+For semantics of configuration, please see ad network documentation.
+
+Supported parameters:
+
+- sp: sizepos (the ad size and position code)
+- mpo: multipoint (an extraction parameter based on site)
+- mpt: mediapoint tag (the box where the ad will be shown)
+- cid: customer id
\ No newline at end of file
diff --git a/examples/ads.amp.html b/examples/ads.amp.html
index 618545f6c7e0..ee046886d9d3 100644
--- a/examples/ads.amp.html
+++ b/examples/ads.amp.html
@@ -142,6 +142,23 @@ <h2>Taboola responsive widget</h2>
              data-placement="Ads Example"
              data-article="auto">
   </amp-embed>
-
+  
+  <h2>DotAndAds masthead</h2>
+  <amp-ad width=980 height=250
+      type="dotandads" 
+      data-cid="11" 
+      data-mpo="ampTest" 
+      data-mpt="amp-amp-all-all"
+      data-sp='sn-u'>
+  </amp-ad>
+  
+  <h2>DotAndAds 300x250 box</h2>
+  <amp-ad width=300 height=250
+      type="dotandads" 
+      data-sp='300x250-u' 
+      data-cid="11" 
+      data-mpo="ampTest" 
+      data-mpt="amp-amp-all-all">
+  </amp-ad>
 </body>
 </html>

From 6e45dc56d3f63f8483ee6b37e951428bae8a94fa Mon Sep 17 00:00:00 2001
From: Malte Ubl <cramforce@users.noreply.github.com>
Date: Wed, 3 Feb 2016 07:46:22 -0800
Subject: [PATCH 07/44] Update list of supported ad networks

---
 builtins/amp-ad.md | 19 ++++++++++---------
 1 file changed, 10 insertions(+), 9 deletions(-)

diff --git a/builtins/amp-ad.md b/builtins/amp-ad.md
index 0f387daa9a02..f9237fbce2c2 100644
--- a/builtins/amp-ad.md
+++ b/builtins/amp-ad.md
@@ -39,6 +39,16 @@ resources in AMP. It requires a `type` argument that select what ad network is d
 </amp-ad>
 ```
 
+#### Supported ad networks
+
+- [A9](../ads/a9.md)
+- [AdReactor](../ads/adreactor.md)
+- [AdSense](../ads/adsense.md)
+- [AdTech](../ads/adtech.md)
+- [Dot and Media](../ads/dotandads.md)
+- [Doubleclick](../ads/doubleclick.md)
+- [plista](../ads/plista.md)
+
 #### Styling
 
 `<amp-ad>` elements may not themselves have or be placed in containers that have CSS `position: fixed` set (with the exception of `amp-lightbox`).
@@ -87,15 +97,6 @@ Optionally `amp-ad` supports a child element with the `placeholder` attribute. I
 
 - If there is no fallback element available, the amp-ad tag will be collapsed (set to display: none) if the ad sends a message that the ad slot cannot be filled and AMP determines that this operation can be performed without affecting the user's scroll position.
 
-#### Supported ad networks
-
-- [A9](../ads/a9.md)
-- [AdReactor](../ads/adreactor.md)
-- [AdSense](../ads/adsense.md)
-- [AdTech](../ads/adtech.md)
-- [Doubleclick](../ads/doubleclick.md)
-
-
 #### Running ads from a custom domain
 
 AMP supports loading the bootstrap iframe that is used to load ads from a custom domain such as your own domain.

From ade253b95b7dc998ccbcb71854494bfa968b6292 Mon Sep 17 00:00:00 2001
From: Malte Ubl <cramforce@users.noreply.github.com>
Date: Wed, 3 Feb 2016 07:47:37 -0800
Subject: [PATCH 08/44] Reference taboola docs from amp-embed page.

---
 builtins/amp-embed.md | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/builtins/amp-embed.md b/builtins/amp-embed.md
index 3e75f6a3998e..494b03667a52 100644
--- a/builtins/amp-embed.md
+++ b/builtins/amp-embed.md
@@ -19,7 +19,7 @@ The `amp-embed` element is used to allow embedding elements in to the AMP page.
 
 #### Implementation
 
-The `<amp-embed>` is actually an alias to the [`<amp-ad>`](amp-ad.md)  tag, deriving all of it's functionality with a different tag name.
+The `<amp-embed>` is actually an alias to the [`<amp-ad>`](amp-ad.md) tag, deriving all of it's functionality with a different tag name.
 Can be used instead of `<amp-ad>` when that would be semantically more accurate.
 
 ```html
@@ -30,4 +30,8 @@ Can be used instead of `<amp-ad>` when that would be semantically more accurate.
         data-article=auto
         data-placement="Below Article Thumbnails">
 </amp-embed>
-```
\ No newline at end of file
+```
+
+#### Supported embed types
+
+- [Taboola](../ads/taboola.md)

From fb5469784a331b610725347a40793733399995db Mon Sep 17 00:00:00 2001
From: Dima Voytenko <dvoytenko@google.com>
Date: Wed, 3 Feb 2016 10:00:34 -0800
Subject: [PATCH 09/44] Enable custom events in analytics

---
 extensions/amp-analytics/0.1/amp-analytics.js |  3 ++-
 .../amp-analytics/0.1/instrumentation.js      | 23 ++++++++++++++++++-
 .../0.1/test/test-instrumentation.js          | 18 +++++++++++++++
 3 files changed, 42 insertions(+), 2 deletions(-)

diff --git a/extensions/amp-analytics/0.1/amp-analytics.js b/extensions/amp-analytics/0.1/amp-analytics.js
index 60511eee2126..b2e7b9af816a 100644
--- a/extensions/amp-analytics/0.1/amp-analytics.js
+++ b/extensions/amp-analytics/0.1/amp-analytics.js
@@ -15,7 +15,7 @@
  */
 
 import {ANALYTICS_CONFIG} from './vendors';
-import {addListener} from './instrumentation';
+import {addListener, instrumentationServiceFor} from './instrumentation';
 import {assertHttpsUrl} from '../../../src/url';
 import {expandTemplate} from '../../../src/string';
 import {installCidService} from '../../../src/service/cid-impl';
@@ -30,6 +30,7 @@ import {xhrFor} from '../../../src/xhr';
 
 installCidService(AMP.win);
 installStorageService(AMP.win);
+instrumentationServiceFor(AMP.win);
 
 
 export class AmpAnalytics extends AMP.BaseElement {
diff --git a/extensions/amp-analytics/0.1/instrumentation.js b/extensions/amp-analytics/0.1/instrumentation.js
index 50130978a872..28c49c549354 100644
--- a/extensions/amp-analytics/0.1/instrumentation.js
+++ b/extensions/amp-analytics/0.1/instrumentation.js
@@ -80,8 +80,11 @@ class InstrumentationService {
     /** @private {boolean} */
     this.clickHandlerRegistered_ = false;
 
-    /** @private {!Observable<Event>} */
+    /** @private {!Observable<!Event>} */
     this.clickObservable_ = new Observable();
+
+    /** @private {!Object<string, !Observable<!AnalyticsEvent>>} */
+    this.observers_ = {};
   }
 
   /**
@@ -111,6 +114,24 @@ class InstrumentationService {
         this.clickObservable_.add(
             this.createSelectiveListener_(listener, opt_selector));
       }
+    } else {
+      let observers = this.observers_[eventType];
+      if (!observers) {
+        observers = new Observable();
+        this.observers_[eventType] = observers;
+      }
+      observers.add(listener);
+    }
+  }
+
+  /**
+   * Triggers the analytics event with the specified type.
+   * @param {string} eventType
+   */
+  triggerEvent(eventType) {
+    const observers = this.observers_[eventType];
+    if (observers) {
+      observers.fire(new AnalyticsEvent(eventType));
     }
   }
 
diff --git a/extensions/amp-analytics/0.1/test/test-instrumentation.js b/extensions/amp-analytics/0.1/test/test-instrumentation.js
index 6d9e0d6595ed..0ee15dde6284 100644
--- a/extensions/amp-analytics/0.1/test/test-instrumentation.js
+++ b/extensions/amp-analytics/0.1/test/test-instrumentation.js
@@ -87,4 +87,22 @@ describe('instrumentation', function() {
     expect(fnIdY.callCount).to.equal(1);
   });
 
+  it('should listen on custom events', () => {
+    const handler1 = sinon.spy();
+    const handler2 = sinon.spy();
+    ins.addListener('custom-event-1', handler1);
+    ins.addListener('custom-event-2', handler2);
+
+    ins.triggerEvent('custom-event-1');
+    expect(handler1.callCount).to.equal(1);
+    expect(handler2.callCount).to.equal(0);
+
+    ins.triggerEvent('custom-event-2');
+    expect(handler1.callCount).to.equal(1);
+    expect(handler2.callCount).to.equal(1);
+
+    ins.triggerEvent('custom-event-1');
+    expect(handler1.callCount).to.equal(2);
+    expect(handler2.callCount).to.equal(1);
+  });
 });

From 31331bc98c893325f5d5ed86bc7c25224fe39974 Mon Sep 17 00:00:00 2001
From: Malte Ubl <malte.ubl@gmail.com>
Date: Tue, 2 Feb 2016 12:39:16 -0800
Subject: [PATCH 10/44] Tag error reports coming from the cache over the
 general internet.

Sets both severity and ads "-cdn" to the "version" for being able to filter in the error reporting tool.

Also fixes an error where apparently some elements miss the .classList property in Safari found via error reporting.
---
 src/error.js                       |  2 +-
 tools/errortracker/app.yaml        |  2 +-
 tools/errortracker/errortracker.go | 13 ++++++++++++-
 3 files changed, 14 insertions(+), 3 deletions(-)

diff --git a/src/error.js b/src/error.js
index ebe933ff3acd..c7622a7e635f 100644
--- a/src/error.js
+++ b/src/error.js
@@ -41,7 +41,7 @@ export function reportError(error, opt_associatedElement) {
   }
   error.reported = true;
   const element = opt_associatedElement || error.associatedElement;
-  if (element) {
+  if (element && element.classList) {
     element.classList.add('-amp-error');
     if (getMode().development) {
       element.classList.add('-amp-element-error');
diff --git a/tools/errortracker/app.yaml b/tools/errortracker/app.yaml
index 894a834ef9ae..3a46342cb057 100644
--- a/tools/errortracker/app.yaml
+++ b/tools/errortracker/app.yaml
@@ -1,5 +1,5 @@
 application: amp-error-reporting
-version: 2
+version: 4
 runtime: go
 api_version: go1
 
diff --git a/tools/errortracker/errortracker.go b/tools/errortracker/errortracker.go
index 6c8e70230730..fc5954055adf 100644
--- a/tools/errortracker/errortracker.go
+++ b/tools/errortracker/errortracker.go
@@ -63,6 +63,7 @@ type ErrorEvent struct {
 	Line      int32  `json:"line,omitempty"`
 	Classname string `json:"classname,omitempty"`
 	Function  string `json:"function,omitempty"`
+	Severity  string `json:"severity,omitempty"`
 }
 
 func init() {
@@ -104,7 +105,14 @@ func handle(w http.ResponseWriter, r *http.Request) {
 	if r.URL.Query().Get("a") == "1" {
 		errorType = "assert"
 	}
+	// By default we log as "INFO" severity, because reports are very spammy
+	severity := "INFO"
+	level := logging.Info
+	// But if the request comes from the cache (and thus only from valid AMP
+	// docs) we log as "ERROR".
 	if strings.HasPrefix(r.Referer(), "https://cdn.ampproject.org/") {
+		severity = "ERROR"
+		level = logging.Error
 		errorType += "-cdn"
 	}
 
@@ -118,6 +126,7 @@ func handle(w http.ResponseWriter, r *http.Request) {
 		Filename:    r.URL.Query().Get("f"),
 		Line:        int32(line),
 		Classname:   r.URL.Query().Get("el"),
+		Severity:    severity,
 	}
 
 	if event.Message == "" && event.Exception == "" {
@@ -146,6 +155,7 @@ func handle(w http.ResponseWriter, r *http.Request) {
 	err = logc.LogSync(logging.Entry{
 		Time:    time.Now().UTC(),
 		Payload: event,
+		Level:   level,
 	})
 
 	if err != nil {
@@ -160,7 +170,8 @@ func handle(w http.ResponseWriter, r *http.Request) {
 	if r.URL.Query().Get("debug") == "1" {
 		w.Header().Set("Content-Type", "text/plain; charset=utf-8")
 		w.WriteHeader(http.StatusOK)
-		fmt.Fprintln(w, "OK")
+		fmt.Fprintln(w, "OK\n");
+		fmt.Fprintln(w, event);
 	} else {
 		w.WriteHeader(http.StatusNoContent)
 	}

From 7bfca6af4796dd9a8dec97fcb5ec95741053e6ab Mon Sep 17 00:00:00 2001
From: Dima Voytenko <dvoytenko@google.com>
Date: Wed, 3 Feb 2016 13:49:21 -0800
Subject: [PATCH 11/44] Viewer handshake with origin validation

---
 examples/viewer-integr-messaging.js | 17 +++++--
 examples/viewer-integr.js           | 34 +++++++++++---
 examples/viewer.html                | 72 +++++++++++++++++++++++++----
 src/service/viewer-impl.js          |  9 +++-
 test/functional/test-viewer.js      |  2 +-
 5 files changed, 111 insertions(+), 23 deletions(-)

diff --git a/examples/viewer-integr-messaging.js b/examples/viewer-integr-messaging.js
index 44505bfd291a..9445e6efefc5 100644
--- a/examples/viewer-integr-messaging.js
+++ b/examples/viewer-integr-messaging.js
@@ -18,11 +18,12 @@
 /**
  * This is a very simple messaging protocol between viewer and viewer client.
  * @param {!Window} target
+ * @param {string} targetOrigin
  * @param {function(string, *, boolean):(!Promise<*>|undefined)}
  *    requestProcessor
  * @constructor
  */
-function ViewerMessaging(target, requestProcessor) {
+function ViewerMessaging(target, targetOrigin, requestProcessor) {
   this.sentinel_ = '__AMP__';
   this.requestSentinel_ = this.sentinel_ + 'REQUEST';
   this.responseSentinel_ = this.sentinel_ + 'RESPONSE';
@@ -30,9 +31,17 @@ function ViewerMessaging(target, requestProcessor) {
   this.requestIdCounter_ = 0;
   this.waitingForResponse_ = {};
 
+  /** @const @private {!Widnow} */
   this.target_ = target;
+  /** @const @private {string} */
+  this.targetOrigin_ = targetOrigin;
+  /** @const @private {function(string, *, boolean):(!Promise<*>|undefined)} */
   this.requestProcessor_ = requestProcessor;
 
+  if (!this.targetOrigin_) {
+    throw new Error('Target origin must be specified');
+  }
+
   window.addEventListener('message', this.onMessage_.bind(this), false);
 }
 
@@ -65,10 +74,9 @@ ViewerMessaging.prototype.sendRequest = function(eventType, payload,
  * @private
  */
 ViewerMessaging.prototype.onMessage_ = function(event) {
-  if (event.source != this.target_) {
+  if (event.source != this.target_ && event.origin != this.targetOrigin_) {
     return;
   }
-  // TODO: must check for origin/target.
   var message = event.data;
   if (message.sentinel == this.requestSentinel_) {
     this.onRequest_(message);
@@ -128,7 +136,6 @@ ViewerMessaging.prototype.onResponse_ = function(message) {
  */
 ViewerMessaging.prototype.sendMessage_ = function(sentinel, requestId,
       eventType, payload, awaitResponse) {
-  // TODO: must check for origin/target.
   var message = {
     sentinel: sentinel,
     requestId: requestId,
@@ -136,7 +143,7 @@ ViewerMessaging.prototype.sendMessage_ = function(sentinel, requestId,
     payload: payload,
     rsvp: awaitResponse
   };
-  this.target_./*TODO-REVIEW*/postMessage(message, '*');
+  this.target_./*OK*/postMessage(message, this.targetOrigin_);
 };
 
 
diff --git a/examples/viewer-integr.js b/examples/viewer-integr.js
index 8c4202790710..b40bf16ccaca 100644
--- a/examples/viewer-integr.js
+++ b/examples/viewer-integr.js
@@ -42,13 +42,35 @@ function whenMessagingLoaded(callback) {
   var viewer = AMP.viewer;
 
   if (window.parent && window.parent != window) {
+    var handshakePromise = new Promise(function(resolve) {
+      var unconfirmedViewerOrigin = viewer.getParam('viewerorigin');
+      if (!unconfirmedViewerOrigin) {
+        throw new Error('Expected viewer origin must be specified!');
+      }
+
+      var listener = function(event) {
+        if (event.origin == unconfirmedViewerOrigin &&
+                event.data == 'amp-handshake-response' &&
+                (!event.source || event.source == window.parent)) {
+          window.removeEventListener('message', listener, false);
+          resolve(event.origin);
+        }
+      };
+      window.addEventListener('message', listener, false);
+
+      window.parent./*OK*/postMessage('amp-handshake-request',
+          unconfirmedViewerOrigin);
+    });
+
     whenMessagingLoaded(function(ViewerMessaging) {
-      var messaging = new ViewerMessaging(window.parent,
-          function(type, payload, awaitResponse) {
-            return viewer.receiveMessage(type, payload, awaitResponse);
-          });
-      viewer.setMessageDeliverer(function(type, payload, awaitResponse) {
-        return messaging.sendRequest(type, payload, awaitResponse);
+      handshakePromise.then(function(viewerOrigin) {
+        var messaging = new ViewerMessaging(window.parent, viewerOrigin,
+            function(type, payload, awaitResponse) {
+              return viewer.receiveMessage(type, payload, awaitResponse);
+            });
+        viewer.setMessageDeliverer(function(type, payload, awaitResponse) {
+          return messaging.sendRequest(type, payload, awaitResponse);
+        }, viewerOrigin);
       });
     });
   }
diff --git a/examples/viewer.html b/examples/viewer.html
index 9d50b1153a2c..07541266ebfc 100644
--- a/examples/viewer.html
+++ b/examples/viewer.html
@@ -193,14 +193,18 @@
         height: this.container./*OK*/offsetHeight,
         paddingTop: this.header./*OK*/offsetHeight,
         visibilityState: this.visibilityState_,
-        prerenderSize: this.prerenderSize_
+        prerenderSize: this.prerenderSize_,
+        viewerorigin: parseUrl(window.location.href).origin
       };
       log('Params:' + JSON.stringify(params));
 
-      var url = './article-access.amp.max.html#' + paramsStr(params);
+      var inputUrl = './article-access.amp.max.html#' + paramsStr(params);
       if (window.location.hash && window.location.hash.length > 1) {
-        url += '&' + window.location.hash.substring(1);
+        inputUrl += '&' + window.location.hash.substring(1);
       }
+      var parsedUrl = parseUrl(inputUrl);
+      var url = parsedUrl.href;
+      this.frameOrigin_ = parsedUrl.origin;
       log('AMP URL = ', url);
       this.iframe.style.display = 'none';
       this.container.appendChild(this.iframe);
@@ -208,8 +212,7 @@
       // Notice that name can only be set once the IFrame is in the DOM.
       this.iframe.contentWindow.name = SENTINEL + paramsStr(params);
 
-      this.messaging_ = new ViewerMessaging(this.iframe.contentWindow,
-          this.processRequest_.bind(this));
+      this.awaitHandshake_();
 
       this.iframe.onload = this.loaded_.bind(this);
       setTimeout(function() {
@@ -223,10 +226,35 @@
     };
 
 
+    Viewer.prototype.awaitHandshake_ = function() {
+      var target = this.iframe.contentWindow;
+      var targetOrigin = this.frameOrigin_;
+      var listener = function(event) {
+        if (event.origin == targetOrigin &&
+                event.data == 'amp-handshake-request' &&
+                (!event.source || event.source == target)) {
+          log('Viewer ' + this.id + ' messaging established with ',
+              targetOrigin);
+          window.removeEventListener('message', listener, false);
+
+          target./*OK*/postMessage('amp-handshake-response', targetOrigin);
+
+          this.messaging_ = new ViewerMessaging(target, targetOrigin,
+              this.processRequest_.bind(this));
+          this.sendRequest_('visibilitychange', {
+            state: this.visibilityState_,
+            prerenderSize: this.prerenderSize
+          }, true);
+        }
+      }.bind(this);
+      window.addEventListener('message', listener, false);
+    };
+
+
     Viewer.prototype.toggleVisibility = function(visible) {
       log('Viewer ' + this.id + ' visibility -> ', visible);
       this.visibilityState_ = visible ? 'visible' : 'hidden';
-      this.messaging_.sendRequest('visibilitychange', {
+      this.sendRequest_('visibilitychange', {
         state: this.visibilityState_,
         prerenderSize: this.prerenderSize
       }, true);
@@ -271,7 +299,7 @@
 
 
     Viewer.prototype.onScroll_ = function() {
-      this.messaging_.sendRequest('viewport', {
+      this.sendRequest_('viewport', {
         scrollTop: this.container./*OK*/scrollTop
       }, false);
     };
@@ -282,7 +310,7 @@
           this.container./*OK*/offsetHeight,
           this.header./*OK*/offsetHeight,
           this.container./*OK*/scrollTop);
-      this.messaging_.sendRequest('viewport', {
+      this.sendRequest_('viewport', {
         scrollTop: this.container./*OK*/scrollTop,
         width: this.container./*OK*/offsetWidth,
         height: this.container./*OK*/offsetHeight,
@@ -331,7 +359,7 @@
       // Even more trivial. Always assumes that only one step was popped in
       // history.
       this.stackIndex_--;
-      this.messaging_.sendRequest('historyPopped', {
+      this.sendRequest_('historyPopped', {
         newStackIndex: this.stackIndex_
       }, false);
       log('history popped to ', this.stackIndex_);
@@ -380,6 +408,14 @@
     };
 
 
+    Viewer.prototype.sendRequest_ = function(type, data, awaitResponse) {
+      if (!this.messaging_) {
+        return;
+      }
+      return this.messaging_.sendRequest(type, data, awaitResponse);
+    };
+
+
     function log() {
       var var_args = Array.prototype.slice.call(arguments, 0);
       var_args.unshift('[VIEWER]');
@@ -387,6 +423,23 @@
     }
 
 
+    function parseUrl(urlString) {
+      var a = document.createElement('a');
+      a.href = urlString;
+      return {
+        href: a.href,
+        protocol: a.protocol,
+        host: a.host,
+        hostname: a.hostname,
+        port: a.port == '0' ? '' : a.port,
+        pathname: a.pathname,
+        search: a.search,
+        hash: a.hash,
+        origin: a.protocol + '//' + a.host
+      };
+    }
+
+
     function paramsStr(params) {
       var s = '';
       for (var k in params) {
@@ -413,7 +466,6 @@
       new Viewer('container3', '3', false).start();
       addShowContainer('3');
 
-
       showContainer('1');
     }
 
diff --git a/src/service/viewer-impl.js b/src/service/viewer-impl.js
index 087f0f37495c..ad4b895c407e 100644
--- a/src/service/viewer-impl.js
+++ b/src/service/viewer-impl.js
@@ -154,6 +154,9 @@ export class Viewer {
     /** @private {?function(string, *, boolean):(Promise<*>|undefined)} */
     this.messageDeliverer_ = null;
 
+    /** @private {?string} */
+    this.messagingOrigin_ = null;
+
     /** @private {!Array<!{eventType: string, data: *}>} */
     this.messageQueue_ = [];
 
@@ -647,11 +650,15 @@ export class Viewer {
    * Provides a message delivery mechanism by which AMP document can send
    * messages to the viewer.
    * @param {function(string, *, boolean):(!Promise<*>|undefined)} deliverer
+   * @param {string} origin
    * @export
    */
-  setMessageDeliverer(deliverer) {
+  setMessageDeliverer(deliverer, origin) {
     assert(!this.messageDeliverer_, 'message deliverer can only be set once');
+    log.fine(TAG_, 'message channel established with origin: ', origin);
     this.messageDeliverer_ = deliverer;
+    // TODO(dvoytenko, #1764): Make `origin` required when viewers catch up.
+    this.messagingOrigin_ = origin;
     if (this.messageQueue_.length > 0) {
       const queue = this.messageQueue_.slice(0);
       this.messageQueue_ = [];
diff --git a/test/functional/test-viewer.js b/test/functional/test-viewer.js
index 9cce48c30b89..dfd7802f779d 100644
--- a/test/functional/test-viewer.js
+++ b/test/functional/test-viewer.js
@@ -204,7 +204,7 @@ describe('Viewer', () => {
     const delivered = [];
     viewer.setMessageDeliverer((eventType, data) => {
       delivered.push({eventType: eventType, data: data});
-    });
+    }, 'https://acme.com');
 
     expect(viewer.messageQueue_.length).to.equal(0);
     expect(delivered.length).to.equal(2);

From c8880f45a970c3044a8e6eaf9fae608a6adbb148 Mon Sep 17 00:00:00 2001
From: Justin Ridgewell <jridgewell@users.noreply.github.com>
Date: Wed, 3 Feb 2016 17:34:28 -0500
Subject: [PATCH 12/44] Add Code Blocks to AMP Boilerplate Code Docs

---
 spec/amp-boilerplate.md | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/spec/amp-boilerplate.md b/spec/amp-boilerplate.md
index 8f6660c7d40f..38d3419d853b 100644
--- a/spec/amp-boilerplate.md
+++ b/spec/amp-boilerplate.md
@@ -15,5 +15,6 @@ limitations under the License.
 -->
 
 # AMP Boilerplate Code
-
-<style amp-boilerplate>body{-webkit-animation:-amp-start 8s steps(1,end) 0s 1 normal both;-moz-animation:-amp-start 8s steps(1,end) 0s 1 normal both;-ms-animation:-amp-start 8s steps(1,end) 0s 1 normal both;animation:-amp-start 8s steps(1,end) 0s 1 normal both}@-webkit-keyframes -amp-start{from{visibility:hidden}to{visibility:visible}}@-moz-keyframes -amp-start{from{visibility:hidden}to{visibility:visible}}@-ms-keyframes -amp-start{from{visibility:hidden}to{visibility:visible}}@-o-keyframes -amp-start{from{visibility:hidden}to{visibility:visible}}@keyframes -amp-start{from{visibility:hidden}to{visibility:visible}}</style><noscript><style amp-boilerplate>body{-webkit-animation:none;-moz-animation:none;-ms-animation:none;animation:none}</style></noscript>
\ No newline at end of file
+```
+<style amp-boilerplate>body{-webkit-animation:-amp-start 8s steps(1,end) 0s 1 normal both;-moz-animation:-amp-start 8s steps(1,end) 0s 1 normal both;-ms-animation:-amp-start 8s steps(1,end) 0s 1 normal both;animation:-amp-start 8s steps(1,end) 0s 1 normal both}@-webkit-keyframes -amp-start{from{visibility:hidden}to{visibility:visible}}@-moz-keyframes -amp-start{from{visibility:hidden}to{visibility:visible}}@-ms-keyframes -amp-start{from{visibility:hidden}to{visibility:visible}}@-o-keyframes -amp-start{from{visibility:hidden}to{visibility:visible}}@keyframes -amp-start{from{visibility:hidden}to{visibility:visible}}</style><noscript><style amp-boilerplate>body{-webkit-animation:none;-moz-animation:none;-ms-animation:none;animation:none}</style></noscript>
+```

From 97ed7f9d6bbef4ac1eb6c483b551acb19865253e Mon Sep 17 00:00:00 2001
From: Sriram Krishnan <sriramkrish85@gmail.com>
Date: Wed, 3 Feb 2016 14:47:34 -0800
Subject: [PATCH 13/44] Fix old-boilerplate test file

---
 test/fixtures/boilerplate-old-opacity.html | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/test/fixtures/boilerplate-old-opacity.html b/test/fixtures/boilerplate-old-opacity.html
index f45e104f69ac..3069954dfc79 100644
--- a/test/fixtures/boilerplate-old-opacity.html
+++ b/test/fixtures/boilerplate-old-opacity.html
@@ -6,7 +6,7 @@
   <link rel="canonical" href="amps.html" >
   <meta name="viewport" content="width=device-width,minimum-scale=1,initial-scale=1">
 
-  <style amp-boilerplate>body{-webkit-animation:-amp-start 8s steps(1,end) 0s 1 normal both;-moz-animation:-amp-start 8s steps(1,end) 0s 1 normal both;-ms-animation:-amp-start 8s steps(1,end) 0s 1 normal both;animation:-amp-start 8s steps(1,end) 0s 1 normal both}@-webkit-keyframes -amp-start{from{visibility:hidden}to{visibility:visible}}@-moz-keyframes -amp-start{from{visibility:hidden}to{visibility:visible}}@-ms-keyframes -amp-start{from{visibility:hidden}to{visibility:visible}}@-o-keyframes -amp-start{from{visibility:hidden}to{visibility:visible}}@keyframes -amp-start{from{visibility:hidden}to{visibility:visible}}</style><noscript><style amp-boilerplate>body{-webkit-animation:none;-moz-animation:none;-ms-animation:none;animation:none}</style></noscript>
+  <style>body {opacity: 0}</style><noscript><style>body {opacity: 1}</style></noscript></noscript>
   <script async src="/base/dist/amp.js"></script>
 </head>
 <body>

From 446b59bd5e50c0946af4cefe453d5078e43ebaa2 Mon Sep 17 00:00:00 2001
From: Johannes Henkel <johannes@google.com>
Date: Wed, 3 Feb 2016 18:07:32 -0800
Subject: [PATCH 14/44] Validate CSS recursively. - Adds RuleVisitor to
 parse_css. - Explores the entire AST for invalid rules (implementing the TODO
   in the validator code). - Removes some of the blacklist regexes. - Adds a
 simple test with nesting.

---
 validator/parse-css.js                        |  47 ++++++++
 .../feature_tests/incorrect_custom_style.html |   3 +-
 .../feature_tests/incorrect_custom_style.out  |   1 +
 validator/validator.js                        | 104 +++++++++++-------
 validator/validator.protoascii                |  97 ++++++----------
 5 files changed, 149 insertions(+), 103 deletions(-)

diff --git a/validator/parse-css.js b/validator/parse-css.js
index 02be67d3dbe2..489f8ac7a646 100644
--- a/validator/parse-css.js
+++ b/validator/parse-css.js
@@ -25,6 +25,7 @@ goog.provide('parse_css.BlockType');
 goog.provide('parse_css.Declaration');
 goog.provide('parse_css.QualifiedRule');
 goog.provide('parse_css.Rule');
+goog.provide('parse_css.RuleVisitor');
 goog.provide('parse_css.Stylesheet');
 goog.provide('parse_css.TokenStream');
 goog.provide('parse_css.extractAFunction');
@@ -183,6 +184,9 @@ goog.inherits(parse_css.Rule, parse_css.Token);
 /** @type {parse_css.TokenType} */
 parse_css.Rule.tokenType = parse_css.TokenType.UNKNOWN;
 
+/** @param {!parse_css.RuleVisitor} visitor */
+parse_css.Rule.prototype.accept = goog.abstractMethod;
+
 /**
  * @param {number=} opt_indent
  * @return {string}
@@ -215,6 +219,14 @@ parse_css.Stylesheet.prototype.toJSON = function() {
   return json;
 };
 
+/** @param {!parse_css.RuleVisitor} visitor */
+parse_css.Stylesheet.prototype.accept = function(visitor) {
+  visitor.visitStylesheet(this);
+  for (const rule of this.rules) {
+    rule.accept(visitor);
+  }
+};
+
 /**
  * @param {string} name
  * @constructor
@@ -246,6 +258,17 @@ parse_css.AtRule.prototype.toJSON = function() {
   return json;
 };
 
+/** @param {!parse_css.RuleVisitor} visitor */
+parse_css.AtRule.prototype.accept = function(visitor) {
+  visitor.visitAtRule(this);
+  for (const rule of this.rules) {
+    rule.accept(visitor);
+  }
+  for (const declaration of this.declarations) {
+    declaration.accept(visitor);
+  }
+};
+
 /**
  * @constructor
  * @extends {parse_css.Rule}
@@ -271,6 +294,14 @@ parse_css.QualifiedRule.prototype.toJSON = function() {
   return json;
 };
 
+/** @param {!parse_css.RuleVisitor} visitor */
+parse_css.QualifiedRule.prototype.accept = function(visitor) {
+  visitor.visitQualifiedRule(this);
+  for (const declaration of this.declarations) {
+    declaration.accept(visitor);
+  }
+};
+
 /**
  * @param {string} name
  * @constructor
@@ -299,6 +330,22 @@ parse_css.Declaration.prototype.toJSON = function() {
   return json;
 };
 
+/** @param {!parse_css.RuleVisitor} visitor */
+parse_css.Declaration.prototype.accept = function(visitor) {
+  visitor.visitDeclaration(this);
+};
+
+/** @constructor */
+parse_css.RuleVisitor = function() {};
+/** @param {!parse_css.Stylesheet} stylesheet */
+parse_css.RuleVisitor.prototype.visitStylesheet = function(stylesheet) {};
+/** @param {!parse_css.AtRule} atRule */
+parse_css.RuleVisitor.prototype.visitAtRule = function(atRule) {};
+/** @param {!parse_css.QualifiedRule} qualifiedRule */
+parse_css.RuleVisitor.prototype.visitQualifiedRule = function(qualifiedRule) {};
+/** @param {!parse_css.Declaration} declaration */
+parse_css.RuleVisitor.prototype.visitDeclaration = function(declaration) {};
+
 /**
  * Enum describing how to parse the rules inside a CSS AT Rule.
  * @enum {string}
diff --git a/validator/testdata/feature_tests/incorrect_custom_style.html b/validator/testdata/feature_tests/incorrect_custom_style.html
index 247435fc0433..35f53030cfd4 100644
--- a/validator/testdata/feature_tests/incorrect_custom_style.html
+++ b/validator/testdata/feature_tests/incorrect_custom_style.html
@@ -30,7 +30,8 @@
     foo.i-amp-class {}
     foo.amp-class {}
     foo { b: red !important; }
-    @viewport (mumble mumble) {}
+    @viewport (mumble mumble) { }
+    @media (whatever) { @notallowednested }
   </style>
   <style>body {opacity: 0}</style><noscript><style>body {opacity: 1}</style></noscript>
   <script src="https://cdn.ampproject.org/v0.js" async></script>
diff --git a/validator/testdata/feature_tests/incorrect_custom_style.out b/validator/testdata/feature_tests/incorrect_custom_style.out
index 9048b977e84c..754e91fd50f2 100644
--- a/validator/testdata/feature_tests/incorrect_custom_style.out
+++ b/validator/testdata/feature_tests/incorrect_custom_style.out
@@ -1,3 +1,4 @@
 FAIL
 feature_tests/incorrect_custom_style.html:29:4 CSS syntax error in tag 'author stylesheet' - saw invalid at rule 'import'.
 feature_tests/incorrect_custom_style.html:33:4 CSS syntax error in tag 'author stylesheet' - saw invalid at rule 'viewport'.
+feature_tests/incorrect_custom_style.html:34:24 CSS syntax error in tag 'author stylesheet' - saw invalid at rule 'notallowednested'.
diff --git a/validator/validator.js b/validator/validator.js
index eac750a472c4..4e6d72d57b5f 100644
--- a/validator/validator.js
+++ b/validator/validator.js
@@ -41,6 +41,7 @@ goog.require('goog.structs.Map');
 goog.require('goog.structs.Set');
 goog.require('goog.uri.utils');
 goog.require('parse_css.BlockType');
+goog.require('parse_css.RuleVisitor');
 goog.require('parse_css.parseAStylesheet');
 goog.require('parse_css.tokenize');
 
@@ -414,6 +415,64 @@ TagNameStack.prototype.hasAncestor = function(ancestor) {
   return false;
 };
 
+
+/**
+ * Returns true if the given AT rule is considered valid.
+ * @param {!amp.validator.CssSpec} cssSpec
+ * @param {string} atRuleName
+ * @return {boolean}
+ */
+function isAtRuleValid(cssSpec, atRuleName) {
+  let defaultType = '';
+
+  for (const atRuleSpec of cssSpec.atRuleSpec) {
+    if (atRuleSpec.name === '$DEFAULT') {
+      defaultType = atRuleSpec.type;
+    } else if (atRuleSpec.name === atRuleName) {
+      return atRuleSpec.type !==
+          amp.validator.AtRuleSpec.BlockType.PARSE_AS_ERROR;
+    }
+  }
+
+  goog.asserts.assert(defaultType !== '');
+  return defaultType !== amp.validator.AtRuleSpec.BlockType.PARSE_AS_ERROR;
+};
+
+/**
+ * @param {!amp.validator.TagSpec} tagSpec
+ * @param {!amp.validator.CssSpec} cssSpec
+ * @param {!Context} context
+ * @param {!amp.validator.ValidationResult} result
+ * @constructor
+ * @extends {parse_css.RuleVisitor}
+ */
+const InvalidAtRuleVisitor = function(tagSpec, cssSpec, context, result) {
+  goog.base(this);
+  /** @type {!amp.validator.TagSpec} */
+  this.tagSpec = tagSpec;
+  /** @type {!amp.validator.CssSpec} */
+  this.cssSpec = cssSpec;
+  /** @type {!Context} */
+  this.context = context;
+  /** @type {!amp.validator.ValidationResult} */
+  this.result = result;
+  /** @type {boolean} */
+  this.errorsSeen = false;
+};
+goog.inherits(InvalidAtRuleVisitor, parse_css.RuleVisitor);
+
+/** @param {!parse_css.AtRule} atRule */
+InvalidAtRuleVisitor.prototype.visitAtRule = function(atRule) {
+  if (!isAtRuleValid(this.cssSpec, atRule.name)) {
+    this.context.addErrorWithLineCol(
+        new LineCol(atRule.line, atRule.col),
+        amp.validator.ValidationError.Code.CSS_SYNTAX_INVALID_AT_RULE,
+        /* params */ [getDetailOrName(this.tagSpec), atRule.name],
+        /* url */ '', this.result);
+    this.errorsSeen = true;
+  }
+};
+
 /**
  * This matcher maintains a constraint to check which an opening tag
  * introduces: a tag's cdata matches constraints set by it's cdata
@@ -479,28 +538,6 @@ function computeAtRuleDefaultParsingSpec(atRuleParsingSpec) {
   return ret;
 }
 
-/**
- * Returns true if the given AT rule is considered valid.
- * @param {!amp.validator.CssSpec} cssSpec
- * @param {string} atRuleName
- * @return {boolean}
- */
-CdataMatcher.prototype.isAtRuleValid = function(cssSpec, atRuleName) {
-  let defaultType = '';
-
-  for (const atRuleSpec of cssSpec.atRuleSpec) {
-    if (atRuleSpec.name === '$DEFAULT') {
-      defaultType = atRuleSpec.type;
-    } else if (atRuleSpec.name === atRuleName) {
-      return atRuleSpec.type !==
-          amp.validator.AtRuleSpec.BlockType.PARSE_AS_ERROR;
-    }
-  }
-
-  goog.asserts.assert(defaultType !== '');
-  return defaultType !== amp.validator.AtRuleSpec.BlockType.PARSE_AS_ERROR;
-};
-
 /**
  * Matches the provided cdata against what this matcher expects.
  * @param {string} cdata
@@ -571,7 +608,6 @@ CdataMatcher.prototype.match = function(cdata, context, validationResult) {
     const sheet = parse_css.parseAStylesheet(
         tokenList, atRuleParsingSpec,
         computeAtRuleDefaultParsingSpec(atRuleParsingSpec), cssErrors);
-    let reportCdataRegexpErrors = (cssErrors.length == 0);
     for (const errorToken of cssErrors) {
       const lineCol = new LineCol(errorToken.line, errorToken.col);
       context.addErrorWithLineCol(
@@ -579,28 +615,14 @@ CdataMatcher.prototype.match = function(cdata, context, validationResult) {
           /* params */ [getDetailOrName(this.tagSpec_), errorToken.msg],
           /* url */ '', validationResult);
     }
-
-    // TODO(johannes): This needs improvement to validate all fields
-    // recursively. For now, it's just doing one layer of fields to
-    // demonstrate the idea and keep tests passing.
-    for (const cssRule of sheet.rules) {
-      if (cssRule.tokenType === 'AT_RULE') {
-        if (!this.isAtRuleValid(cdataSpec.cssSpec, cssRule.name)) {
-          reportCdataRegexpErrors = false;
-          const lineCol = new LineCol(cssRule.line, cssRule.col);
-          context.addErrorWithLineCol(
-              lineCol,
-              amp.validator.ValidationError.Code.CSS_SYNTAX_INVALID_AT_RULE,
-              /* params */ [getDetailOrName(this.tagSpec_), cssRule.name],
-              /* url */ '', validationResult);
-        }
-      }
-    }
+    const visitor = new InvalidAtRuleVisitor(
+        this.tagSpec_, cdataSpec.cssSpec, context, validationResult);
+    sheet.accept(visitor);
 
     // As a hack to not report some errors twice, both via the css parser
     // and via the regular expressions below, we return early if there
     // are parser errors and skip the regular expression errors.
-    if (!reportCdataRegexpErrors)
+    if (visitor.errorsSeen || cssErrors.length > 0)
       return;
   }
   // } end oneof
diff --git a/validator/validator.protoascii b/validator/validator.protoascii
index 834fd7e971df..e3c633e96bc4 100644
--- a/validator/validator.protoascii
+++ b/validator/validator.protoascii
@@ -20,12 +20,12 @@
 # in production from crashing. This id is not relevant to validator.js
 # because thus far, engine (validator.js) and spec file (validator.protoascii)
 # are always released together.
-min_validator_revision_required: 83
+min_validator_revision_required: 85
 # The spec file revision allows the validator engine to distinguish
 # newer versions of the spec file. This is currently a Google internal
 # mechanism, validator.js does not use this facility. However, any
 # change to this file requires updating this revision id.
-spec_file_revision: 136
+spec_file_revision: 137
 # Rules for AMP HTML
 # (https://github.com/google/amphtml/blob/master/spec/amp-html-format.md).
 #
@@ -458,42 +458,42 @@ tags: {  # Special custom 'author' spreadsheet.
   cdata: {
     max_bytes: 50000
     max_bytes_spec_url: "https://github.com/ampproject/amphtml/blob/master/spec/amp-html-format.md#maximum-size"
-      css_spec: {
-        at_rule_spec: {
-          name: 'media'
-          type: PARSE_AS_RULES
-        }
-        at_rule_spec: {
-          name: 'keyframes'
-          type: PARSE_AS_RULES
-        }
-        at_rule_spec: {
-          name: '-webkit-keyframes'
-          type: PARSE_AS_RULES
-        }
-        at_rule_spec: {
-          name: '-moz-keyframes'
-          type: PARSE_AS_RULES
-        }
-        at_rule_spec: {
-          name: '-o-keyframes'
-          type: PARSE_AS_RULES
-        }
-        at_rule_spec: {
-          name: 'supports'
-          type: PARSE_AS_RULES
-        }
-        at_rule_spec: {
-          name: 'font-face'
-          type: PARSE_AS_DECLARATIONS
-        }
-        at_rule_spec: {
-          name: '$DEFAULT'  # matches if none of the above match
-          type: PARSE_AS_ERROR
-        }
+    css_spec: {
+      at_rule_spec: {
+        name: 'media'
+        type: PARSE_AS_RULES
       }
+      at_rule_spec: {
+        name: 'keyframes'
+        type: PARSE_AS_RULES
+      }
+      at_rule_spec: {
+        name: '-webkit-keyframes'
+        type: PARSE_AS_RULES
+      }
+      at_rule_spec: {
+        name: '-moz-keyframes'
+        type: PARSE_AS_RULES
+      }
+      at_rule_spec: {
+        name: '-o-keyframes'
+        type: PARSE_AS_RULES
+      }
+      at_rule_spec: {
+        name: 'supports'
+        type: PARSE_AS_RULES
+      }
+      at_rule_spec: {
+        name: 'font-face'
+        type: PARSE_AS_DECLARATIONS
+      }
+      at_rule_spec: {
+        name: '$DEFAULT'  # matches if none of the above match
+        type: PARSE_AS_ERROR
+      }
+    }
     # These regex blacklists are temporary hacks to validate essential CSS
-    # rules. They will be replaced later with more principalled solutions.
+    # rules. They will be replaced later with more principled solutions.
     blacklisted_cdata_regex: {
       regex: "\\.i?-amp-"
       error_message: "CSS -amp- class name prefix"
@@ -502,31 +502,6 @@ tags: {  # Special custom 'author' spreadsheet.
       regex: "!important"
       error_message: "CSS !important"
     }
-    # All known @ rules except for media and font-face are disabled.
-    blacklisted_cdata_regex: {
-      regex: "charset"
-      error_message: "CSS @charset"
-    }
-    blacklisted_cdata_regex: {
-      regex: "@import"
-      error_message: "CSS @import"
-    }
-    blacklisted_cdata_regex: {
-      regex: "@namespace"
-      error_message: "CSS @namespace"
-    }
-    blacklisted_cdata_regex: {
-      regex: "@document"
-      error_message: "CSS @document"
-    }
-    blacklisted_cdata_regex: {
-      regex: "@page"
-      error_message: "CSS @page"
-    }
-    blacklisted_cdata_regex: {
-      regex: "@viewport"
-      error_message: "CSS @viewport"
-    }
   }
   spec_url: "https://github.com/ampproject/amphtml/blob/master/spec/amp-html-format.md#stylesheets"
 }

From 0110ebe2d9ed7d93183bb46df8af5a81966c21d3 Mon Sep 17 00:00:00 2001
From: Johannes Henkel <johannes@google.com>
Date: Wed, 3 Feb 2016 18:16:46 -0800
Subject: [PATCH 15/44] =?UTF-8?q?Fix=20for=20the=20Turkish=20=C4=B0=20occu?=
 =?UTF-8?q?rring=20in=20the=20document.?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This is a character which when in a javascript string
yields .length == 1, but when toLowerCase()'d, yields
.length == 2. htmlparser.js uses .length extensively
and gets thrown off, generating incorrect SAX events.
The fix detects the case (better than the previous
attempt) and only lower cases A-Z instead.

@gregable had most of the ideas here, including the final fix.

Fixes https://github.com/ampproject/amphtml/issues/1768
---
 validator/htmlparser.js      | 23 +++++++++---------
 validator/htmlparser_test.js | 47 ++++++++++++++++++++++++++++++++++++
 2 files changed, 59 insertions(+), 11 deletions(-)

diff --git a/validator/htmlparser.js b/validator/htmlparser.js
index f818220b5373..b1bfc65a15bd 100644
--- a/validator/htmlparser.js
+++ b/validator/htmlparser.js
@@ -651,25 +651,26 @@ amp.htmlparser.HtmlParser.prototype.normalizeRCData_ = function(rcdata) {
 
 
 /**
- * TODO(goto): why isn't this in the string package ? does this solves any
- * real problem ? move it to the goog.string package if it does.
- *
  * @param {string} str The string to lower case.
  * @return {string} The str in lower case format.
  */
 amp.htmlparser.toLowerCase = function(str) {
-  // The below may not be true on browsers in the Turkish locale.
-  if ('script' === 'SCRIPT'.toLowerCase()) {
-    return str.toLowerCase();
-  } else {
-    return str.replace(/[A-Z]/g, function(ch) {
-      return String.fromCharCode(ch.charCodeAt(0) | 32);
-    });
+  // htmlparser.js heavily relies on the length of the strings, and
+  // unfortunately some characters change their length when
+  // lowercased; for instance, the Turkish İ has a length of 1, but
+  // when lower-cased, it has a length of 2. So, as a workaround we
+  // check that the length be the same as before lower-casing, and if
+  // not, we only lower-case the letters A-Z.
+  const lowerCased = str.toLowerCase();
+  if (lowerCased.length == str.length) {
+    return lowerCased;
   }
+  return str.replace(/[A-Z]/g, function(ch) {
+    return String.fromCharCode(ch.charCodeAt(0) | 32);
+  });
 };
 
 
-
 /**
  * An interface to the {@code amp.htmlparser.HtmlParser} visitor, that gets
  * called while the HTML is being parsed.
diff --git a/validator/htmlparser_test.js b/validator/htmlparser_test.js
index 486def210c98..6cbcdd753c17 100644
--- a/validator/htmlparser_test.js
+++ b/validator/htmlparser_test.js
@@ -340,4 +340,51 @@ describe('HtmlParser with location', () => {
       ':17:0: endTag(html)',
       ':17:6: endDoc()']);
   });
+
+  it('Supports Turkish UTF8 İ character in body', () => {
+    // A Javascript string with this character in it has .length 1, but
+    // when .toLowerCase()'d it becomes length 2, which would throw off
+    // the bookkeeping in htmlparser.js. Hence, amp.htmlparser.toLowerCase
+    // works around the problem.
+    const handler = new LoggingHandlerWithLocation();
+    const parser = new amp.htmlparser.HtmlParser();
+    parser.parse(
+        handler,
+        '<!doctype html>\n' +
+        '<html amp lang="tr">\n' +
+        '<head>\n' +
+        '<meta charset="utf-8">\n' +
+        '<title></title>\n' +
+        '<script async src="https://cdn.ampproject.org/v0.js"></script>\n' +
+        '</head>\n' +
+        '<body>İ</body>\n' +
+        '</html>');
+    expect(handler.log).toEqual([
+      ':1:0: startDoc()',
+      ':1:0: startTag(!doctype,[html,html])',
+      ':1:14: pcdata("\n")',
+      ':2:0: startTag(html,[amp,amp,lang,tr])',
+      ':2:19: pcdata("\n")',
+      ':3:0: startTag(head,[])',
+      ':3:5: pcdata("\n")',
+      ':4:0: startTag(meta,[charset,utf-8])',
+      ':4:21: pcdata("\n")',
+      ':5:0: startTag(title,[])',
+      ':5:0: rcdata("")',
+      ':5:7: endTag(title)',
+      ':5:14: pcdata("\n")',
+      ':6:0: startTag(script,[async,async,src,'+
+          'https://cdn.ampproject.org/v0.js])',
+      ':6:0: cdata("")',
+      ':6:53: endTag(script)',
+      ':6:61: pcdata("\n")',
+      ':7:0: endTag(head)',
+      ':7:6: pcdata("\n")',
+      ':8:0: startTag(body,[])',
+      ':8:5: pcdata("İ")',
+      ':8:7: endTag(body)',
+      ':8:13: pcdata("\n")',
+      ':9:0: endTag(html)',
+      ':9:6: endDoc()' ]);
+  });
 });

From f7c11f18486484db5934525b629923dee761d004 Mon Sep 17 00:00:00 2001
From: Ivan <ivmatvejchuk@gmail.com>
Date: Thu, 4 Feb 2016 13:37:25 +0300
Subject: [PATCH 16/44] Fixed bug with missing &

Fixed bug when you get
_s:1dt=title
instead of
_s:1
dt:title
in the request.
---
 extensions/amp-analytics/0.1/vendors.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/extensions/amp-analytics/0.1/vendors.js b/extensions/amp-analytics/0.1/vendors.js
index ac9024d5eed9..39e5fc84a1e6 100644
--- a/extensions/amp-analytics/0.1/vendors.js
+++ b/extensions/amp-analytics/0.1/vendors.js
@@ -64,7 +64,7 @@ export const ANALYTICS_CONFIG = {
     },
     'requests': {
       'host': 'https://www.google-analytics.com',
-      'basePrefix': 'v=1&_v=a0&aip=true&_s=${requestCount}' +
+      'basePrefix': 'v=1&_v=a0&aip=true&_s=${requestCount}&' +
           'dt=${title}&sr=${screenWidth}x${screenHeight}&_utmht=${timestamp}&' +
           'jid=&cid=${clientId(AMP_ECID_GOOGLE)}&tid=${account}&' +
           'dl=${documentLocation}&' +

From 9561a8f0e2d28b30cf7db0dea5eef39393c2044d Mon Sep 17 00:00:00 2001
From: Simas Toleikis <simas.toleikis@adform.com>
Date: Wed, 3 Feb 2016 16:28:39 +0200
Subject: [PATCH 17/44] Added <amp-ad type="adform"> support.

---
 3p/integration.js                   |  2 +
 ads/_config.js                      |  1 +
 ads/adform.js                       | 53 ++++++++++++++++++++++++
 ads/adform.md                       | 63 +++++++++++++++++++++++++++++
 builtins/amp-ad.md                  |  1 +
 docs/include_features.md            |  1 +
 src/3p.js                           | 18 +++++++--
 test/functional/test-3p.js          | 30 ++++++++++----
 test/functional/test-integration.js |  1 +
 9 files changed, 158 insertions(+), 12 deletions(-)
 create mode 100644 ads/adform.js
 create mode 100644 ads/adform.md

diff --git a/3p/integration.js b/3p/integration.js
index 70a6dd951861..74293d9264dc 100644
--- a/3p/integration.js
+++ b/3p/integration.js
@@ -24,6 +24,7 @@
 
 import './polyfills';
 import {a9} from '../ads/a9';
+import {adform} from '../ads/adform';
 import {adreactor} from '../ads/adreactor';
 import {adsense} from '../ads/adsense';
 import {adtech} from '../ads/adtech';
@@ -48,6 +49,7 @@ const AMP_EMBED_ALLOWED = {
 };
 
 register('a9', a9);
+register('adform', adform);
 register('adreactor', adreactor);
 register('adsense', adsense);
 register('adtech', adtech);
diff --git a/ads/_config.js b/ads/_config.js
index 1fccdace1726..5b523064fe89 100644
--- a/ads/_config.js
+++ b/ads/_config.js
@@ -36,6 +36,7 @@ export const adPrefetch = {
  * @const {!Object<string, (string|!Array<string>)>}
  */
 export const adPreconnect = {
+  adform: 'https://track.adform.net',
   adreactor: 'https://adserver.adreactor.com',
   adsense: 'https://googleads.g.doubleclick.net',
   taboola: 'https://cdn.taboola.com',
diff --git a/ads/adform.js b/ads/adform.js
new file mode 100644
index 000000000000..cd7794a5537e
--- /dev/null
+++ b/ads/adform.js
@@ -0,0 +1,53 @@
+/**
+ * Copyright 2015 The AMP HTML Authors. All Rights Reserved.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS-IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import {writeScript, validateSrcPrefix, validateExactlyOne} from '../src/3p';
+
+// Valid adform ad source hosts
+const hosts = {
+  track: 'https://track.adform.net/',
+  adx: 'https://adx.adform.net/'
+};
+
+/**
+ * @param {!Window} global
+ * @param {!Object} data
+ */
+export function adform(global, data) {
+
+  validateExactlyOne(data, ['src', 'bn', 'mid']);
+  global.Adform = {ampData: data};
+  const src = data.src;
+  const bn = data.bn;
+  const mid = data.mid;
+  let url;
+
+  // Custom ad url using "data-src" attribute
+  if (src) {
+    validateSrcPrefix(Object.keys(hosts).map(type => hosts[type]), src);
+    url = src;
+  }
+  // Ad tag using "data-bn" attribute
+  else if (bn) {
+    url = hosts.track + 'adfscript/?bn=' + encodeURIComponent(bn) + ';msrc=1';
+  }
+  // Ad placement using "data-mid" attribute
+  else if (mid) {
+    url = hosts.adx + 'adx/?mid=' + encodeURIComponent(mid);
+  }
+
+  writeScript(global, url);
+}
diff --git a/ads/adform.md b/ads/adform.md
new file mode 100644
index 000000000000..f348c2e18a6d
--- /dev/null
+++ b/ads/adform.md
@@ -0,0 +1,63 @@
+<!---
+Copyright 2015 The AMP HTML Authors. All Rights Reserved.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS-IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+-->
+
+# Adform
+
+Please refer to [Adform Help Center](http://help.adform.com) for more
+information on how to get required ad tag or placement IDs.
+
+## Examples
+
+### Simple ad tag with `data-bn`
+
+```html
+<amp-ad width=320 height=50
+    type="adform"
+    data-bn="12345">
+</amp-ad>
+```
+
+### Ad placement with `data-mid`
+
+```html
+<amp-ad width=320 height=50
+    type="adform"
+    data-mid="12345">
+</amp-ad>
+```
+
+### Ad tag or placement with `src`
+
+```html
+<amp-ad width=320 height=50
+    type="adform"
+    src="https://track.adform.net/adfscript/?bn=4849385;msrc=1">
+</amp-ad>
+```
+
+### Supported parameters
+
+- `data-bn`
+- `data-mid`
+- `src`
+
+Only one of the mentioned parameters should be used at the same time.
+
+The `src` parameter must use **https** protocol and must be from one of the
+allowed hosts:
+
+- `https://track.adform.net/...`
+- `https://adx.adform.net/...`
diff --git a/builtins/amp-ad.md b/builtins/amp-ad.md
index f9237fbce2c2..f60f7cd77236 100644
--- a/builtins/amp-ad.md
+++ b/builtins/amp-ad.md
@@ -42,6 +42,7 @@ resources in AMP. It requires a `type` argument that select what ad network is d
 #### Supported ad networks
 
 - [A9](../ads/a9.md)
+- [Adform](../ads/adform.md)
 - [AdReactor](../ads/adreactor.md)
 - [AdSense](../ads/adsense.md)
 - [AdTech](../ads/adtech.md)
diff --git a/docs/include_features.md b/docs/include_features.md
index bf37b65bccf6..452bd80861e7 100644
--- a/docs/include_features.md
+++ b/docs/include_features.md
@@ -271,6 +271,7 @@ An example `amp-pixel` from the
 The following ad networks are supported in AMP HTML pages:
 
 - [A9](../ads/a9.md)
+- [Adform](../ads/adform.md)
 - [AdReactor](../ads/adreactor.md)
 - [AdSense](../ads/adsense.md)
 - [AdTech](../ads/adtech.md)
diff --git a/src/3p.js b/src/3p.js
index 01dffd3cd1cd..4eab1b1f6e41 100644
--- a/src/3p.js
+++ b/src/3p.js
@@ -23,6 +23,7 @@
 
 
 import {assert} from './asserts';
+import {isArray} from './types';
 
 
 /** @typedef {function(!Window, !Object)}  */
@@ -103,14 +104,23 @@ function executeAfterWriteScript(win, fn) {
 }
 
 /**
- * Throws if the given src doesn't start with prefix.
- * @param {string} prefix
+ * Throws if the given src doesn't start with prefix(es).
+ * @param {!Array<string>|string} prefix
  * @param {string} src
  */
 export function validateSrcPrefix(prefix, src) {
-  if (src.indexOf(prefix) !== 0) {
-    throw new Error('Invalid src ' + src);
+
+  if (!isArray(prefix)) {
+    prefix = [prefix];
+  }
+
+  for (const p of prefix) {
+    if (src.indexOf(p) === 0) {
+      return;
+    }
   }
+
+  throw new Error('Invalid src ' + src);
 }
 
 /**
diff --git a/test/functional/test-3p.js b/test/functional/test-3p.js
index eee5de8e91e4..b9faa51a0e5b 100644
--- a/test/functional/test-3p.js
+++ b/test/functional/test-3p.js
@@ -33,14 +33,28 @@ describe('3p', () => {
     sandbox.restore();
   });
 
-  it('should throw an error if prefix is not https:', () => {
-    expect(() => {
-      validateSrcPrefix('https:', 'http://adserver.adtechus.com');
-    }).to.throw(/Invalid src/);
-  });
-
-  it('should not throw if source starts with https', () => {
-    validateSrcPrefix('https:', 'https://adserver.adtechus.com');
+  describe('validateSrcPrefix()', () => {
+
+    it('should throw when a string prefix does not match', () => {
+      expect(() => {
+        validateSrcPrefix('https:', 'http://example.org');
+      }).to.throw(/Invalid src/);
+    });
+
+    it('should throw when array prefixes do not match', () => {
+      expect(() => {
+        validateSrcPrefix(['https:', 'ftp:'], 'http://example.org');
+      }).to.throw(/Invalid src/);
+    });
+
+    it('should not throw when a string prefix matches', () => {
+      validateSrcPrefix('http:', 'http://example.org');
+    });
+
+    it('should not throw when any of the array prefixes match', () => {
+      validateSrcPrefix(['https:', 'http:'], 'http://example.org');
+      validateSrcPrefix(['http:', 'https:'], 'http://example.org');
+    });
   });
 
   it('should throw an error if src does not contain addyn', () => {
diff --git a/test/functional/test-integration.js b/test/functional/test-integration.js
index 91662d015eef..af49ce24152e 100644
--- a/test/functional/test-integration.js
+++ b/test/functional/test-integration.js
@@ -29,6 +29,7 @@ describe('3p integration.js', () => {
 
   it('should register integrations', () => {
     expect(registrations).to.include.key('a9');
+    expect(registrations).to.include.key('adform');
     expect(registrations).to.include.key('adsense');
     expect(registrations).to.include.key('adtech');
     expect(registrations).to.include.key('adreactor');

From aaafecc35c97e7e7252679edb4c8b0daefd7e959 Mon Sep 17 00:00:00 2001
From: Avi Mehta <avimehta@users.noreply.github.com>
Date: Thu, 4 Feb 2016 07:39:16 -0800
Subject: [PATCH 18/44] Fixed config to send document title correctly.

Fixes #1778.

As an aside, opened #1779 so that this does not happen in future.
---
 extensions/amp-analytics/0.1/vendors.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/extensions/amp-analytics/0.1/vendors.js b/extensions/amp-analytics/0.1/vendors.js
index ac9024d5eed9..39e5fc84a1e6 100644
--- a/extensions/amp-analytics/0.1/vendors.js
+++ b/extensions/amp-analytics/0.1/vendors.js
@@ -64,7 +64,7 @@ export const ANALYTICS_CONFIG = {
     },
     'requests': {
       'host': 'https://www.google-analytics.com',
-      'basePrefix': 'v=1&_v=a0&aip=true&_s=${requestCount}' +
+      'basePrefix': 'v=1&_v=a0&aip=true&_s=${requestCount}&' +
           'dt=${title}&sr=${screenWidth}x${screenHeight}&_utmht=${timestamp}&' +
           'jid=&cid=${clientId(AMP_ECID_GOOGLE)}&tid=${account}&' +
           'dl=${documentLocation}&' +

From 500801e6c0ccd58a0a0013b6fe0950570ff878dd Mon Sep 17 00:00:00 2001
From: Jordan M Adler <jmadler@google.com>
Date: Thu, 4 Feb 2016 08:40:13 -0800
Subject: [PATCH 19/44] Clarify non-support for xml attributes

---
 spec/amp-html-format.md | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/spec/amp-html-format.md b/spec/amp-html-format.md
index b12dc5683f78..7134af0da784 100644
--- a/spec/amp-html-format.md
+++ b/spec/amp-html-format.md
@@ -147,6 +147,8 @@ Attribute names starting with `on` (such as `onclick` or `onmouseover`) are disa
 
 The `style` attribute must not be used.
 
+XML-related attributes, such as xmlns, xml:lang, xml:base, and xml:space are disallowed in AMP HTML.
+
 ### Links
 
 The `javascript:` schema is disallowed.

From d935d982028666d96f66049d79d7aeb3ed910007 Mon Sep 17 00:00:00 2001
From: Malte Ubl <malte.ubl@gmail.com>
Date: Thu, 4 Feb 2016 08:28:08 -0800
Subject: [PATCH 20/44] Tunes ad loading heuristic.

We now load out of viewport ads before initial scrolling. Given recent performance improvements this seems a better trade off for UX, as ads below initial viewport are more likely to be done.
---
 3p/integration.js             | 6 +-----
 builtins/amp-ad.js            | 6 ------
 src/service/resources-impl.js | 2 +-
 3 files changed, 2 insertions(+), 12 deletions(-)

diff --git a/3p/integration.js b/3p/integration.js
index 70a6dd951861..4749b6ff0426 100644
--- a/3p/integration.js
+++ b/3p/integration.js
@@ -148,11 +148,7 @@ window.draw3p = function(opt_configCallback) {
   window.context.reportRenderedEntityIdentifier =
       reportRenderedEntityIdentifier;
   delete data._context;
-  // Run this only in canary and local dev for the time being.
-  if (location.pathname.indexOf('-canary') ||
-      location.pathname.indexOf('current')) {
-    manageWin(window);
-  }
+  manageWin(window);
   draw3p(window, data, opt_configCallback);
   nonSensitiveDataPostMessage('render-start');
 };
diff --git a/builtins/amp-ad.js b/builtins/amp-ad.js
index 5a4c0e03550f..b91de2655f91 100644
--- a/builtins/amp-ad.js
+++ b/builtins/amp-ad.js
@@ -51,12 +51,6 @@ export function installAd(win) {
 
     /** @override  */
     renderOutsideViewport() {
-      // Before the user has scrolled we only render ads in view. This prevents
-      // excessive jank in situations like swiping through a lot of articles.
-      if (!this.getViewport().hasScrolled()) {
-        return false;
-      };
-
       // If another ad is currently loading we only load ads that are currently
       // in viewport.
       if (loadingAdsCount > 0) {
diff --git a/src/service/resources-impl.js b/src/service/resources-impl.js
index 9026bc8ace6f..590378d9f39d 100644
--- a/src/service/resources-impl.js
+++ b/src/service/resources-impl.js
@@ -57,7 +57,7 @@ export function getElementPriority(tagName) {
   if (tagName == 'amp-ad') {
     return 2;
   }
-  if (tagName == 'amp-pixel') {
+  if (tagName == 'amp-pixel' || tagName == 'amp-analytics') {
     return 1;
   }
   return 0;

From 1c2640fd122f40cbc890d1c5abd2ccdb5e6d6312 Mon Sep 17 00:00:00 2001
From: Malte Ubl <malte.ubl@gmail.com>
Date: Thu, 4 Feb 2016 09:38:50 -0800
Subject: [PATCH 21/44] Add missing files to example validation.

---
 test/integration/test-example-validation.js | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/test/integration/test-example-validation.js b/test/integration/test-example-validation.js
index 3566a990e0ac..de3639553c46 100644
--- a/test/integration/test-example-validation.js
+++ b/test/integration/test-example-validation.js
@@ -46,11 +46,15 @@ describe('example', function() {
     'metadata-examples/video-json-ld.amp.html',
     'metadata-examples/video-microdata.amp.html',
     'article.amp.html',
+    'analytics.amp.html',
+    'analytics-notification.amp.html',
     'everything.amp.html',
+    'facebook.amp.html',
     'instagram.amp.html',
     'released.amp.html',
     'twitter.amp.html',
     'vine.amp.html',
+    'vimeo.amp.html',
     'old-boilerplate.amp.html',
   ];
 
@@ -64,6 +68,8 @@ describe('example', function() {
    */
   const errorWhitelist = [
     /invalid value \'.\/viewer-integr.js\'/,
+    /vimeo/,
+    /comscore/,
   ];
 
   const usedWhitelist = [];

From f5fa42543f05909c3dd4f2983d83da30423b7ce5 Mon Sep 17 00:00:00 2001
From: Dima Voytenko <dvoytenko@google.com>
Date: Wed, 3 Feb 2016 16:21:56 -0800
Subject: [PATCH 22/44] Requirements of source origin security in access
 endpoints

---
 extensions/amp-access/amp-access-spec.md | 42 +++++++++++++++---------
 spec/amp-cors-requests.md                | 36 ++++++++++++++++++++
 src/url-replacements.js                  | 12 ++++++-
 test/functional/test-url-replacements.js |  7 ++++
 4 files changed, 80 insertions(+), 17 deletions(-)
 create mode 100644 spec/amp-cors-requests.md

diff --git a/extensions/amp-access/amp-access-spec.md b/extensions/amp-access/amp-access-spec.md
index 7d456955daa8..7012a6f995b8 100644
--- a/extensions/amp-access/amp-access-spec.md
+++ b/extensions/amp-access/amp-access-spec.md
@@ -51,12 +51,18 @@ Supporting AMP Access requires Publisher to implement the components described a
 
 To assist access services and use cases, AMP Access introduces the concept of the *Reader ID*.
 
-The Reader ID is an anonymous and unique ID created by the AMP ecosystem. It is unique for each reader/publisher pair. i.e., a Reader is identified differently to two different publishers. It is a non-reversible ID. The Reader ID is included in all AMP/Publisher communications. Publishers can use the Reader ID to identify the Reader and map it to their own identity systems.
+The Reader ID is an anonymous and unique ID created by the AMP ecosystem. It is unique for each reader/publisher pair. i.e., a Reader is identified differently to two different publishers. It is a non-reversible ID. The Reader ID is included in all AMP/Publisher communications. Publishers must use the Reader ID to identify the Reader and map it to their own identity systems.
 
 The Reader ID is constructed on the user device and intended to be long-lived. However, it follows the normal browser storage rules, including those for incognito windows. The intended lifecycle of a Reader ID is 1 year between uses or until the user clears their cookies. The Reader IDs are not currently shared between devices.
 
 The Reader ID is constructed similar to the mechanism used to build ExternalCID described [here](https://docs.google.com/document/d/1f7z3X2GM_ASb3ZCI_7tngglxwS6WoWi1EB3aKzdf6vo/edit#heading=h.hyyaxi8m42a).
 
+##AMP Access and Cookies
+
+Even though some of the Publisher's own authentication cookies may be available at the time of the Authorization and Pingback requests, the cookies should only be used for internal mapping. There are no guarantees that the Publisher will be able to read or write cookies given all surfaces and platforms where an AMP document can be embedded. The Reader ID is the only identifier that is guaranteed to work.
+
+This means, in particular, that features such as metering and first-click-free implementation have to rely on the AMP Reader ID and server-side storage.
+
 ##Access Content Markup
 
 Access Content Markup determines which sections are visible or hidden based on the authorization response returned from the Authorization endpoint. It is described via special markup attributes.
@@ -107,11 +113,11 @@ Here’s an example of the AMP Access configuration:
 <script id="amp-access" type="application/json">
 {
   "authorization":
-      "https://pub.com/amp-access?rid={READER_ID}&url={AMPDOC_URL}",
+      "https://pub.com/amp-access?rid={READER_ID}&url={SOURCE_URL}",
   "pingback":
-      "https://pub.com/amp-ping?rid={READER_ID}&url={AMPDOC_URL}",
+      "https://pub.com/amp-ping?rid={READER_ID}&url={SOURCE_URL}",
   "login":
-      "https://pub.com/amp-login?rid={READER_ID}&url={AMPDOC_URL}"
+      "https://pub.com/amp-login?rid={READER_ID}&url={SOURCE_URL}"
 }
 </script>
 ```
@@ -125,6 +131,7 @@ Var               | Description
 READER_ID         | The AMP Reader ID.
 AUTHDATA(field)   | The value of the field in the authorization response.
 RETURN_URL        | The placeholder for the return URL specified by the AMP runtime for a Login Dialog to return to.
+SOURCE_URL        | The Source URL of this AMP Document. If document is served from CDN, AMPDOC_URL will be a CDN URL, while SOURCE_URL will be the original source URL.
 AMPDOC_URL        | The URL of this AMP Document.
 CANONICAL_URL     | The canonical URL of this AMP Document.
 DOCUMENT_REFERRER | The Referrer URL.
@@ -200,9 +207,9 @@ And here’s an example that shows additional content to the premium subscribers
 
 ##Authorization Endpoint
 
-Authorization is configured via ```authorization``` property in the [AMP Access Configuration][8] section. It is a credentialed CORS endpoint. See [CORS Origin Security][9] for a list of origins that should be allowed.
+Authorization is configured via ```authorization``` property in the [AMP Access Configuration][8] section. It is a credentialed CORS endpoint. See [CORS Origin Security][9] for how this request should be secured.
 
-Authorization can take any parameters as defined in the [Access URL Variables][7] section. For instance, it could pass AMP Reader ID and document URL. Besides URL parameters, the Publisher may use any information naturally delivered via HTTP protocol, such as Reader’s IP address.
+Authorization can take any parameters as defined in the [Access URL Variables][7] section. For instance, it could pass AMP Reader ID and document URL. Besides URL parameters, the Publisher may use any information naturally delivered via HTTP protocol, such as Reader’s IP address. The inclusion of the `READER_ID` is required.
 
 This endpoint produces the authorization response that can be used in the content markup expressions to show/hide different parts of content.
 
@@ -210,7 +217,7 @@ The request format is:
 ```
 https://publisher.com/amp-access.json?
    rid={READER_ID}
-  &url={AMPDOC_URL}
+  &url={SOURCE_URL}
 ```
 The response is a free-form JSON object: it can contain any properties and values with few limitations. The limitations are:
  - The property names have to conform to the restrictions defined by the ```amp-access``` expressions grammar (see [Appendix A][1]. This mostly means that the property names cannot contain characters such as spaces, dashes and other characters that do not conform to the “amp-access” specification.
@@ -247,7 +254,7 @@ The authorization response may be used by AMP Runtime and extensions for two dif
  1. When evaluating ```amp-access``` expressions.
  2. When evaluating ```<template>``` templates such as ```amp-mustache```.
 
-Authorization endpoint is called by AMP Runtime as a credentialed CORS endpoint. As such, it must implement CORS protocol. It should use CORS Origin to restrict the access to this service. This endpoint may use publisher cookies for its needs. For instance, it can associate the binding between the Reader ID and the Publisher’s own user identity. AMP itself does not need to know about this (and prefers not to).
+Authorization endpoint is called by AMP Runtime as a credentialed CORS endpoint. As such, it must implement CORS protocol. It should use CORS Origin and source origin to restrict the access to this service as described in the [CORS Origin Security][9]. This endpoint may use publisher cookies for its needs. For instance, it can associate the binding between the Reader ID and the Publisher’s own user identity. AMP itself does not need to know about this (and prefers not to). Reader more on [AMP Reader ID][2] and [AMP Access and Cookies][11] for more detail.
 
 AMP Runtime (or rather browser) observes cache response headers when calling Authorization endpoint. Thus the cached responses can be reused. It may or may not be desirable. If it is not desirable, the Publisher can user the appropriate cache control headers and/or RANDOM variable substitution for the endpoint URL.
 
@@ -259,9 +266,9 @@ In the *server* option, the call to Authorization endpoint is done by AMP Cache
 
 ##Pingback Endpoint
 
-Pingback is configured via ```pingback``` property in the [AMP Access Configuration][8] section. It is a credentialed CORS endpoint. See [CORS Origin Security][9]” for a list of origins that should be allowed.
+Pingback is configured via ```pingback``` property in the [AMP Access Configuration][8] section. It is a credentialed CORS endpoint. See [CORS Origin Security][9]” for how this request should be secured.
 
-Pingback URL can take any parameters as defined in the [Access URL Variables][7] section. For instance, it could pass AMP Reader ID and document URL.
+Pingback URL can take any parameters as defined in the [Access URL Variables][7] section. For instance, it could pass AMP Reader ID and document URL. The inclusion of the `READER_ID` is required.
 
 Pingback does not produce a response - any response is ignored by AMP runtime.
 
@@ -273,7 +280,7 @@ The request format is:
 ```
 https://publisher.com/amp-pingback?
    rid={READER_ID}
-  &url={AMPDOC_URL}
+  &url={SOURCE_URL}
 ```
 
 ##Login Link
@@ -304,7 +311,7 @@ The request format is:
 ```
 https://publisher.com/amp-login.html?
    rid={READER_ID}
-  &url={AMPDOC_URL}
+  &url={SOURCE_URL}
   &return={RETURN_URL}
 ```
 Notice that the “return” URL parameter is added by the AMP Runtime automatically if `RETURN_URL` substitution is not
@@ -319,9 +326,10 @@ Notice the use of a URL hash parameter “status”. The value is either “true
 An integration with *amp-analytics* is under development and can be tracked on [Issue #1556][10]. This document will be updated when more details on the integration are available.
 
 #CORS Origin Security
-CORS endpoints can be (and recommended) to be only allowed to the following origins:
- - *.ampproject.org
- - The Publisher’s own origins
+
+Authorization and Pingback endpoints are CORS endpoints and they must implement the security protocol described in the
+[AMP CORS Security Spec](https://github.com/ampproject/amphtml/blob/master/spec/amp-cors-requests.md#cors-security-in-amp).
+
 
 #AMP Glossary
  - **AMP Document** - the HTML document that follows AMP format and validated by AMP Validator. AMP Documents are cacheable by AMP Cache.
@@ -330,12 +338,13 @@ CORS endpoints can be (and recommended) to be only allowed to the following orig
  - **AMP Cache** - the proxying cache for AMP documents.
  - **AMP Viewer** - the Web or native application that displays/embeds AMP Documents.
  - **Publisher.com** - the site of an AMP publisher.
- - **CORS endpoint** - cross-origin HTTPS endpoint. See https://developer.mozilla.org/en-US/docs/Web/HTTP/Access_control_CORS for more info. See [CORS Origin Security][9] for a list of origins that should be allowed.
+ - **CORS endpoint** - cross-origin HTTPS endpoint. See https://developer.mozilla.org/en-US/docs/Web/HTTP/Access_control_CORS for more info. See [CORS Origin Security][9] for how such requests can be secured.
  - **Reader** - the actual person viewing AMP documents.
  - **AMP Prerendering** - AMP Viewers may take advantage of prerendering, which renders a hidden document before it can be shown. This adds a significant performance boost. But it is important to take into account the fact that the document prerendering does not constitute a view since the Reader may never actually see the document.
 
 #Revisions
 - Feb 1: "return" query parameter for Login Page can be customized using RETURN_URL URL substitution.
+- Feb 3: Spec for "source origin" security added to the [CORS Origin security][9].
 
 #Appendix A: “amp-access” expression grammar
 
@@ -384,3 +393,4 @@ This section will cover a detailed explanation of the design underlying the amp-
 [8]: #configuration
 [9]: #cors-origin-security
 [10]: https://github.com/ampproject/amphtml/issues/1556
+[11]: #amp-access-and-cookies
diff --git a/spec/amp-cors-requests.md b/spec/amp-cors-requests.md
new file mode 100644
index 000000000000..fbf539fcdd64
--- /dev/null
+++ b/spec/amp-cors-requests.md
@@ -0,0 +1,36 @@
+<!---
+Copyright 2016 The AMP HTML Authors. All Rights Reserved.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS-IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+-->
+
+# CORS Requests in AMP
+
+Many components and extensions in AMP take advantage of remote endpoints using CORS requests. For more detail
+on CORS see [CORS Spec](https://www.w3.org/TR/cors/). This spec explains some of the key aspects of using CORS
+in AMP.
+
+## CORS Security in AMP
+
+This security protocol consists of two components: CORS origin and source origin restrictions.
+
+CORS endpoints receive requesting origin via "Origin" HTTP header. This header has to be restricted to only allow the following origins:
+ - *.ampproject.org
+ - The Publisher’s own origins
+
+Source origin restrictions has to be implemented by requiring "__amp_source_origin" URL parameter to be within a set of the Publisher's own origins. The "__amp_source_origin" parameter is passed from AMP Runtime in all fetch requests and contains the source origin, e.g. "https://publisher1.com".
+
+The resulting HTTP response has to also contain the following headers:
+ - `Access-Control-Allow-Origin: <origin>`. Here "origin" refers to the requesting origin that was allowed via "Origin" request header above. Ex: "https://cdn.ampproject.org". This is a CORS spec requirement.
+ - `AMP-Access-Control-Allow-Source-Origin: <source-origin>`. Here "source-origin" indicates the source origin that is allowed to read the authorization response as was verified via "__amp_source_origin" URL parameter. Ex: "https://publisher1.com".
+ - `Access-Control-Expose-Headers: AMP-Access-Control-Allow-Source-Origin`. This header simply allows CORS response to contain the "AMP-Access-Control-Allow-Source-Origin" header.
diff --git a/src/url-replacements.js b/src/url-replacements.js
index 35058feee183..887750fe4794 100644
--- a/src/url-replacements.js
+++ b/src/url-replacements.js
@@ -20,7 +20,7 @@ import {documentInfoFor} from './document-info';
 import {getService} from './service';
 import {loadPromise} from './event-helper';
 import {log} from './log';
-import {parseUrl, removeFragment} from './url';
+import {getSourceUrl, parseUrl, removeFragment} from './url';
 import {viewerFor} from './viewer';
 import {viewportFor} from './viewport';
 import {vsyncFor} from './vsync';
@@ -88,6 +88,16 @@ class UrlReplacements {
       return url && url.hostname;
     });
 
+    // Returns the Source URL for this AMP document.
+    this.set_('SOURCE_URL', () => {
+      return removeFragment(getSourceUrl(this.win_.location.href));
+    });
+
+    // Returns the host of the Source URL for this AMP document.
+    this.set_('SOURCE_HOST', () => {
+      return parseUrl(getSourceUrl(this.win_.location.href)).hostname;
+    });
+
     // Returns a random string that will be the constant for the duration of
     // single page view. It should have sufficient entropy to be unique for
     // all the page views a single user is making at a time.
diff --git a/test/functional/test-url-replacements.js b/test/functional/test-url-replacements.js
index 7a6f13c26e94..9ebf8c6c7c8a 100644
--- a/test/functional/test-url-replacements.js
+++ b/test/functional/test-url-replacements.js
@@ -115,6 +115,13 @@ describe('UrlReplacements', () => {
     });
   });
 
+  it('should replace SOURCE_URL and _HOST', () => {
+    return expand('?url=SOURCE_URL&host=SOURCE_HOST').then(res => {
+      expect(res).to.not.match(/SOURCE_URL/);
+      expect(res).to.not.match(/SOURCE_HOST/);
+    });
+  });
+
   it('should replace PAGE_VIEW_ID', () => {
     return expand('?pid=PAGE_VIEW_ID').then(res => {
       expect(res).to.match(/pid=\d+/);

From 009d571a5eb42b6ed4341d3dbaabad78a4bbe4fb Mon Sep 17 00:00:00 2001
From: Brian Tice <brian.tice@chartbeat.com>
Date: Mon, 1 Feb 2016 13:00:01 -0500
Subject: [PATCH 23/44] Add support for Chartbeat analytics

---
 examples/analytics.amp.html               | 38 ++++++---
 extensions/amp-analytics/0.1/vendors.js   | 97 +++++++++++++++++------
 extensions/amp-analytics/amp-analytics.md |  3 +-
 3 files changed, 102 insertions(+), 36 deletions(-)

diff --git a/examples/analytics.amp.html b/examples/analytics.amp.html
index 53227a23d1dd..453aae696f38 100644
--- a/examples/analytics.amp.html
+++ b/examples/analytics.amp.html
@@ -44,6 +44,32 @@
 </script>
 </amp-analytics>
 
+<!-- Chartbeat tracking -->
+<amp-analytics type="chartbeat">
+<script type="application/json">
+{
+  "vars": {
+    "uid": "12345",
+    "domain": "my-site.com",
+    "sections": "section 1, section 2"
+  }
+}
+</script>
+</amp-analytics>
+<!-- End Chartbeat example -->
+
+<!-- comScore UDM pageview tracking -->
+<amp-analytics type="comscore">
+<script type="application/json">
+{
+  "vars": {
+    "c2": "1000001"
+  }
+}
+</script>
+</amp-analytics>
+<!-- End comScore example -->
+
 <amp-analytics type="googleanalytics" id="analytics2">
 <script type="application/json">
 {
@@ -83,18 +109,6 @@
 
 <amp-analytics id="analytics3" config="./analytics.config.json"></amp-analytics>
 
-<!-- comScore UDM pageview tracking -->
-<amp-analytics type="comscore">
-<script type="application/json">
-{
-  "vars": {
-    "c2": "1000001"
-  }
-}
-</script>
-</amp-analytics>
-<!-- End comScore example -->
-
 <div class="logo"></div>
 <h1 id="top">AMP Analytics</h1>
 
diff --git a/extensions/amp-analytics/0.1/vendors.js b/extensions/amp-analytics/0.1/vendors.js
index 39e5fc84a1e6..47ab4b4e0958 100644
--- a/extensions/amp-analytics/0.1/vendors.js
+++ b/extensions/amp-analytics/0.1/vendors.js
@@ -57,6 +57,80 @@ export const ANALYTICS_CONFIG = {
     }
   },
 
+  'chartbeat': {
+    'requests': {
+      'host': 'https://ping.chartbeat.net',
+      'basePrefix': '/ping?h=${domain}&' +
+        'p=${canonicalPath}&' +
+        'u=${clientId(_cb)}&' +
+        'd=${canonicalHost}&' +
+        'g=${uid}&' +
+        'g0=${sections}&' +
+        'g1=${authors}&' +
+        'g2=${zone}&' +
+        'g3=${sponsorName}&' +
+        'g4=${contentType}&' +
+        'x=${scrollTop}&' +
+        'w=${screenHeight}&' +
+        'j=${decayTime}&' +
+        'r=${documentReferrer}&' +
+        't=${clientId(_cb_amp)}${pageViewId}&' +
+        'i=${title}',
+      'baseSuffix': '&_',
+      'interval': '${host}${basePrefix}&${baseSuffix}',
+      'anchorClick': '${host}${basePrefix}&${baseSuffix}'
+    },
+    'triggers': {
+      'trackInterval': {
+        'on': 'timer',
+        'timer-spec': {
+          'interval': 15,
+          'max-timer-length': 7200
+        },
+        'request': 'interval',
+        'vars': {
+          'decayTime': 30
+        }
+      },
+      'trackAnchorClick': {
+        'on': 'click',
+        'selector': 'a',
+        'request': 'anchorClick',
+        'vars': {
+          'decayTime': 30
+        }
+      }
+    },
+    'transport': {
+      'beacon': false,
+      'xhrpost': false,
+      'image': true
+    }
+  },
+
+  'comscore': {
+    'vars': {
+      'c2': '1000001'
+    },
+    'requests': {
+      'host': 'https://sb.scorecardresearch.com',
+      'base': '${host}/b?',
+      'pageview': '${base}c1=2&c2=${c2}&rn=${random}&c8=${title}' +
+        '&c7=${canonicalUrl}&c9=${documentReferrer}&cs_c7amp=${ampdocUrl}'
+    },
+    'triggers': {
+      'defaultPageview': {
+        'on': 'visible',
+        'request': 'pageview'
+      }
+    },
+    'transport': {
+      'beacon': false,
+      'xhrpost': false,
+      'image': true
+    }
+  },
+
   'googleanalytics': {
     'vars': {
       'eventValue': "0",
@@ -85,29 +159,6 @@ export const ANALYTICS_CONFIG = {
           'clt=${contentLoadTime}&dit=${domInteractiveTime}${baseSuffix}'
     },
     'optout': '_gaUserPrefs.ioo'
-  },
-
-  'comscore': {
-    'vars': {
-      'c2': '1000001'
-    },
-    'requests': {
-      'host': 'https://sb.scorecardresearch.com',
-      'base': '${host}/b?',
-      'pageview': '${base}c1=2&c2=${c2}&rn=${random}&c8=${title}' +
-        '&c7=${canonicalUrl}&c9=${documentReferrer}&cs_c7amp=${ampdocUrl}'
-    },
-    'triggers': {
-      'defaultPageview': {
-        'on': 'visible',
-        'request': 'pageview'
-      }
-    },
-    'transport': {
-      'beacon': false,
-      'xhrpost': false,
-      'image': true
-    }
   }
 };
 
diff --git a/extensions/amp-analytics/amp-analytics.md b/extensions/amp-analytics/amp-analytics.md
index 5da2642127c7..497acbe578c4 100644
--- a/extensions/amp-analytics/amp-analytics.md
+++ b/extensions/amp-analytics/amp-analytics.md
@@ -60,8 +60,9 @@ when the document is first loaded, and each time an `<a>` tag is clicked:
 ## <a name="attributes"></a>Attributes
 
   - `type` This optional attribute can be specified to use one of the built-in analytics providers. Currently supported values for type are:
-    - `googleanalytics`: Adds support for Google Analytics. More details for adding Google Analytics support can be found at [developers.google.com](https://developers.google.com/analytics/devguides/collection/amp-analytics/).
+    - `chartbeat`: Adds support for Chartbeat. More details for adding Chartbeat support can be found at [support.chartbeat.com](http://support.chartbeat.com/docs/).
     - `comscore`: Supports comScore Unified Digital Measurement™ pageview analytics. Requires defining *var* `c2` with comScore-provided *c2 id*.
+    - `googleanalytics`: Adds support for Google Analytics. More details for adding Google Analytics support can be found at [developers.google.com](https://developers.google.com/analytics/devguides/collection/amp-analytics/).
 
     ```
     <amp-analytics type="XYZ"> ... </amp-analytics>

From 74aede003d052e8bfc74b40fe4987326e01ac82a Mon Sep 17 00:00:00 2001
From: Malte Ubl <cramforce@users.noreply.github.com>
Date: Thu, 4 Feb 2016 12:42:11 -0800
Subject: [PATCH 24/44] Bring docs in line with code

Fixes #1793
---
 extensions/amp-brightcove/amp-brightcove.md | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/extensions/amp-brightcove/amp-brightcove.md b/extensions/amp-brightcove/amp-brightcove.md
index 0539c2d014df..555d7bd53e44 100644
--- a/extensions/amp-brightcove/amp-brightcove.md
+++ b/extensions/amp-brightcove/amp-brightcove.md
@@ -22,7 +22,7 @@ Example:
 ```html
 <amp-brightcove
     data-account="12345"
-    data-player="default"
+    data-player-id="default"
     data-embed="default"
     data-video-id="1234"
     layout="responsive"
@@ -38,7 +38,7 @@ The width and height will determine the aspect ratio of the player embed in resp
 
 The Brightcove Video Cloud or Perform account id
 
-**data-player**
+**data-player-id**
 
 The Brightcove player id. This is a GUID or "default". The default value is "default".
 

From 944638ff3da471c9b2f9062399c95adefc0be898 Mon Sep 17 00:00:00 2001
From: Malte Ubl <malte.ubl@gmail.com>
Date: Thu, 4 Feb 2016 12:55:59 -0800
Subject: [PATCH 25/44] This now validates.

---
 test/integration/test-example-validation.js | 1 -
 1 file changed, 1 deletion(-)

diff --git a/test/integration/test-example-validation.js b/test/integration/test-example-validation.js
index de3639553c46..b7a704e72385 100644
--- a/test/integration/test-example-validation.js
+++ b/test/integration/test-example-validation.js
@@ -69,7 +69,6 @@ describe('example', function() {
   const errorWhitelist = [
     /invalid value \'.\/viewer-integr.js\'/,
     /vimeo/,
-    /comscore/,
   ];
 
   const usedWhitelist = [];

From 4b878e52426b3c71317b91e77a4a5dd9db5d8ad2 Mon Sep 17 00:00:00 2001
From: Chris Breaux <christopher@chartbeat.com>
Date: Wed, 27 Jan 2016 10:04:37 -0500
Subject: [PATCH 26/44] Add timer trigger for amp-analytics

---
 examples/analytics.amp.html                   |  24 ++++
 extensions/amp-analytics/0.1/amp-analytics.js |   3 +-
 .../amp-analytics/0.1/instrumentation.js      |  63 +++++++++-
 .../0.1/test/test-instrumentation.js          | 116 +++++++++++++++++-
 extensions/amp-analytics/amp-analytics.md     |  13 +-
 5 files changed, 207 insertions(+), 12 deletions(-)

diff --git a/examples/analytics.amp.html b/examples/analytics.amp.html
index 53227a23d1dd..125de83a4faa 100644
--- a/examples/analytics.amp.html
+++ b/examples/analytics.amp.html
@@ -83,6 +83,30 @@
 
 <amp-analytics id="analytics3" config="./analytics.config.json"></amp-analytics>
 
+<amp-analytics id="analytics4">
+<script type="application/json">
+{
+  "requests": {
+    "test-ping": "https://my-analytics.com/ping?title=${title}&acct=${account}"
+  },
+  "vars": {
+    "title": "A page that sends a ping",
+    "account": "12345"
+  },
+  "triggers": {
+    "timer": {
+      "on": "timer",
+      "timer-spec": {
+        "interval": 5,
+        "max-timer-length": 300
+      },
+      "request": "test-ping"
+    }
+  }
+}
+</script>
+</amp-analytics>
+
 <!-- comScore UDM pageview tracking -->
 <amp-analytics type="comscore">
 <script type="application/json">
diff --git a/extensions/amp-analytics/0.1/amp-analytics.js b/extensions/amp-analytics/0.1/amp-analytics.js
index b2e7b9af816a..80b082b914f0 100644
--- a/extensions/amp-analytics/0.1/amp-analytics.js
+++ b/extensions/amp-analytics/0.1/amp-analytics.js
@@ -132,7 +132,8 @@ export class AmpAnalytics extends AMP.BaseElement {
           continue;
         }
         addListener(this.getWin(), trigger['on'],
-            this.handleEvent_.bind(this, trigger), trigger['selector']);
+            this.handleEvent_.bind(this, trigger), trigger['selector'],
+            trigger['timer-spec']);
       }
     }
   }
diff --git a/extensions/amp-analytics/0.1/instrumentation.js b/extensions/amp-analytics/0.1/instrumentation.js
index 28c49c549354..9dc0237b4eb0 100644
--- a/extensions/amp-analytics/0.1/instrumentation.js
+++ b/extensions/amp-analytics/0.1/instrumentation.js
@@ -18,6 +18,9 @@ import {getService} from '../../../src/service';
 import {viewerFor} from '../../../src/viewer';
 import {Observable} from '../../../src/observable';
 
+const MIN_TIMER_INTERVAL_SECONDS_ = 0.5;
+const DEFAULT_MAX_TIMER_LENGTH_SECONDS_ = 7200;
+
 /**
  * This type signifies a callback that gets called when an analytics event that
  * the listener subscribed to fires.
@@ -32,10 +35,13 @@ let AnalyticsEventListenerDef;
  *          fires.
  * @param {string=} opt_selector If specified, the given listener
  *   should only be called if the event target matches this selector.
+ * @param {JSONObject=} opt_timerSpec If specified, the specification on how
+ *   the timer should fire.
  */
-export function addListener(window, type, listener, opt_selector) {
+export function addListener(window, type, listener, opt_selector,
+    opt_timerSpec) {
   return instrumentationServiceFor(window).addListener(
-      type, listener, opt_selector);
+      type, listener, opt_selector, opt_timerSpec);
 }
 
 /**
@@ -45,7 +51,8 @@ export function addListener(window, type, listener, opt_selector) {
  */
 export const AnalyticsEventType = {
   VISIBLE: 'visible',
-  CLICK: 'click'
+  CLICK: 'click',
+  TIMER: 'timer'
 };
 
 /**
@@ -93,8 +100,10 @@ class InstrumentationService {
    *   occurs.
    * @param {string=} opt_selector If specified, the given listener
    *   should only be called if the event target matches this selector.
+   * @param {JSONObject=} opt_timerSpec If specified, the specification on how
+   *   the timer should fire.
    */
-  addListener(eventType, listener, opt_selector) {
+  addListener(eventType, listener, opt_selector, opt_timerSpec) {
     if (eventType === AnalyticsEventType.VISIBLE) {
       if (this.viewer_.isVisible()) {
         listener(new AnalyticsEvent(AnalyticsEventType.VISIBLE));
@@ -114,6 +123,10 @@ class InstrumentationService {
         this.clickObservable_.add(
             this.createSelectiveListener_(listener, opt_selector));
       }
+    } else if (eventType === AnalyticsEventType.TIMER) {
+      if (this.isTimerSpecValid_(opt_timerSpec)) {
+        this.createTimerListener_(listener, opt_timerSpec);
+      }
     } else {
       let observers = this.observers_[eventType];
       if (!observers) {
@@ -194,6 +207,48 @@ class InstrumentationService {
     }
     return false;
   }
+
+  /**
+   * @param {JSONObject} timerSpec
+   * @private
+   */
+  isTimerSpecValid_(timerSpec) {
+    if (!timerSpec) {
+      console./*OK*/error(this.TAG_, 'Bad timer specification');
+      return false;
+    } else if (!timerSpec.hasOwnProperty('interval')) {
+      console./*OK*/error(this.TAG_, 'Timer interval specification required');
+      return false;
+    } else if (typeof timerSpec['interval'] !== 'number' ||
+               timerSpec['interval'] < MIN_TIMER_INTERVAL_SECONDS_) {
+      console./*OK*/error(this.TAG_, 'Bad timer interval specification');
+      return false;
+    } else if (timerSpec.hasOwnProperty('max-timer-length') &&
+              (typeof timerSpec['max-timer-length'] !== 'number' ||
+                  timerSpec['max-timer-length'] <= 0)) {
+      console./*OK*/error(this.TAG_, 'Bad max-timer-length specification');
+      return false;
+    } else {
+      return true;
+    }
+  }
+
+  /**
+   * @param {!Function} listener
+   * @param {JSONObject} timerSpec
+   * @private
+   */
+  createTimerListener_(listener, timerSpec) {
+    const intervalId = this.win_.setInterval(
+        listener.bind(null, new AnalyticsEvent(AnalyticsEventType.TIMER)),
+        timerSpec['interval'] * 1000);
+    listener(new AnalyticsEvent(AnalyticsEventType.TIMER));
+
+    const maxTimerLength = timerSpec['max-timer-length'] ||
+        DEFAULT_MAX_TIMER_LENGTH_SECONDS_;
+    this.win_.setTimeout(this.win_.clearInterval.bind(this.win_, intervalId),
+        maxTimerLength * 1000);
+  }
 }
 
 /**
diff --git a/extensions/amp-analytics/0.1/test/test-instrumentation.js b/extensions/amp-analytics/0.1/test/test-instrumentation.js
index 0ee15dde6284..6fadd6580417 100644
--- a/extensions/amp-analytics/0.1/test/test-instrumentation.js
+++ b/extensions/amp-analytics/0.1/test/test-instrumentation.js
@@ -25,18 +25,24 @@ describe('instrumentation', function() {
   let ins;
 
   beforeEach(() => {
+    sandbox = sinon.sandbox.create();
     ins = instrumentationServiceFor(window);
   });
 
+  afterEach(() => {
+    sandbox.restore();
+    sandbox = null;
+  });
+
   it('always fires click listeners when selector is set to *', () => {
     const el1 = document.createElement('test');
-    const fn1 = sinon.stub();
+    const fn1 = sandbox.stub();
     addListener(window, 'click', fn1, '*');
     ins.onClick_({target: el1});
     expect(fn1.calledOnce).to.be.true;
 
     const el2 = document.createElement('test2');
-    const fn2 = sinon.stub();
+    const fn2 = sandbox.stub();
     addListener(window, 'click', fn2, '*');
     ins.onClick_({target: el2});
     expect(fn1.calledTwice).to.be.true;
@@ -45,13 +51,13 @@ describe('instrumentation', function() {
 
   it('never fires click listeners when the selector is empty', () => {
     const el1 = document.createElement('test');
-    const fn1 = sinon.stub();
+    const fn1 = sandbox.stub();
     addListener(window, 'click', fn1, '');
     ins.onClick_({target: el1});
     expect(fn1.callCount).to.equal(0);
 
     const el2 = document.createElement('test2');
-    const fn2 = sinon.stub();
+    const fn2 = sandbox.stub();
     addListener(window, 'click', fn2);
     ins.onClick_({target: el2});
     expect(fn1.callCount).to.equal(0);
@@ -68,10 +74,10 @@ describe('instrumentation', function() {
     el3.className = 'x';
     el3.id = 'y';
 
-    const fnClassX = sinon.stub();
+    const fnClassX = sandbox.stub();
     addListener(window, 'click', fnClassX, '.x');
 
-    const fnIdY = sinon.stub();
+    const fnIdY = sandbox.stub();
     addListener(window, 'click', fnIdY, '#y');
 
     ins.onClick_({target: el1});
@@ -105,4 +111,102 @@ describe('instrumentation', function() {
     expect(handler1.callCount).to.equal(2);
     expect(handler2.callCount).to.equal(1);
   });
+
+  it('only fires when the timer interval exceeds the minimum', () => {
+    const fn1 = sandbox.stub();
+    addListener(window, 'timer', fn1, null, {"interval": 0});
+    expect(fn1.callCount).to.equal(0);
+
+    const fn2 = sandbox.stub();
+    addListener(window, 'timer', fn2, null, {"interval": 1});
+    expect(fn2.callCount).to.equal(1);
+  });
+
+  it('never fires when the timer spec is malformed', () => {
+    const fn1 = sandbox.stub();
+    addListener(window, 'timer', fn1, null, null);
+    expect(fn1.callCount).to.equal(0);
+
+    const fn2 = sandbox.stub();
+    addListener(window, 'timer', fn2, null, 1);
+    expect(fn2.callCount).to.equal(0);
+
+    const fn3 = sandbox.stub();
+    addListener(window, 'timer', fn3, null, {'misc': 1});
+    expect(fn3.callCount).to.equal(0);
+
+    const fn4 = sandbox.stub();
+    addListener(window, 'timer', fn4, null, {'interval': 'two'});
+    expect(fn4.callCount).to.equal(0);
+
+    const fn5 = sandbox.stub();
+    addListener(window, 'timer', fn5, null, {'interval': null});
+    expect(fn5.callCount).to.equal(0);
+
+    const fn6 = sandbox.stub();
+    addListener(window, 'timer', fn6, null,
+        {'interval': 2, 'max-timer-length': 0});
+    expect(fn6.callCount).to.equal(0);
+
+    const fn7 = sandbox.stub();
+    addListener(window, 'timer', fn7, null,
+        {'interval': 2, 'max-timer-length': null});
+    expect(fn7.callCount).to.equal(0);
+  });
+
+  it('fires on the appropriate interval', () => {
+    const clock = sandbox.useFakeTimers();
+    const fn1 = sandbox.stub();
+    addListener(window, 'timer', fn1, null, {"interval": 10});
+    expect(fn1.callCount).to.equal(1);
+
+    const fn2 = sandbox.stub();
+    addListener(window, 'timer', fn2, null, {"interval": 15});
+    expect(fn2.callCount).to.equal(1);
+
+    clock.tick(10 * 1000); // 10 seconds
+    expect(fn1.callCount).to.equal(2);
+    expect(fn2.callCount).to.equal(1);
+
+    clock.tick(10 * 1000); // 20 seconds
+    expect(fn1.callCount).to.equal(3);
+    expect(fn2.callCount).to.equal(2);
+
+    clock.tick(10 * 1000); // 30 seconds
+    expect(fn1.callCount).to.equal(4);
+    expect(fn2.callCount).to.equal(3);
+  });
+
+  it('stops firing after the max-timer-length is exceeded', () => {
+    const clock = sandbox.useFakeTimers();
+    const fn1 = sandbox.stub();
+    addListener(window, 'timer', fn1, null,
+        {"interval": 10, "max-timer-length": 15});
+    expect(fn1.callCount).to.equal(1);
+
+    const fn2 = sandbox.stub();
+    addListener(window, 'timer', fn2, null,
+        {"interval": 10, "max-timer-length": 20});
+    expect(fn2.callCount).to.equal(1);
+
+    const fn3 = sandbox.stub();
+    addListener(window, 'timer', fn3, null, {"interval": 3600});
+    expect(fn3.callCount).to.equal(1);
+
+    clock.tick(10 * 1000); // 10 seconds
+    expect(fn1.callCount).to.equal(2);
+    expect(fn2.callCount).to.equal(2);
+
+    clock.tick(10 * 1000); // 20 seconds
+    expect(fn1.callCount).to.equal(2);
+    expect(fn2.callCount).to.equal(3);
+
+    clock.tick(10 * 1000); // 30 seconds
+    expect(fn1.callCount).to.equal(2);
+    expect(fn2.callCount).to.equal(3);
+
+    // Default max-timer-length is 2 hours
+    clock.tick(3 * 3600 * 1000); // 3 hours
+    expect(fn3.callCount).to.equal(3);
+  });
 });
diff --git a/extensions/amp-analytics/amp-analytics.md b/extensions/amp-analytics/amp-analytics.md
index 5da2642127c7..fd555590a4a1 100644
--- a/extensions/amp-analytics/amp-analytics.md
+++ b/extensions/amp-analytics/amp-analytics.md
@@ -140,9 +140,12 @@ The `triggers` attribute describes when an analytics request should be sent. It
  trigger-configuration. Trigger name can be any string comprised of alphanumeric characters (a-zA-Z0-9). Triggers from a
  configuration with lower precedence are overridden by triggers with the same names from a configuration with higher precedence.
 
-  - `on` (required) The event to listener for. Valid values are `visible` and `click`.
+  - `on` (required) The event to listener for. Valid values are `visible`,`click`, and `timer`.
   - `request` (required) Name of the request to send (as specified in the `requests` section).
   - `selector` A CSS selector used to refine which elements should be tracked. Use value `*` to track all elements.
+  - `timer-spec` Specification for the timer. The timer will trigger immediately and then at a specified interval thereafter.
+    - `interval` Length of the timer interval, in seconds.
+    - `max-timer-length` Maximum duration for which the timer will fire, in seconds.
   - `vars` An object containing key-value pairs used to override `vars` defined in the top level config, or to specify
     vars unique to this trigger.
 
@@ -159,6 +162,14 @@ The `triggers` attribute describes when an analytics request should be sent. It
     "vars": {
       "eventId": 128
     }
+  },
+  "pageTimer": {
+    "on": "timer",
+    "timer-spec": {
+      "interval": 10,
+      "max-timer-length": 600
+    },
+    "request": "pagetime"
   }
 }
 ```

From a23364a92676f64be0e237e7942d06230c858365 Mon Sep 17 00:00:00 2001
From: Malte Ubl <malte.ubl@gmail.com>
Date: Thu, 4 Feb 2016 10:37:43 -0800
Subject: [PATCH 27/44] Add random token to 3p post messages.

This makes it very inconvenient to not use our own software to talk between frames which I'm worried about for users of remote.html based iframes.
---
 3p/messaging.js                  |  4 ++--
 build-system/internal-version.js | 17 +++++++++++++++++
 build-system/tasks/compile.js    | 11 +++++++++--
 builtins/amp-ad.js               |  2 ++
 gulpfile.js                      |  2 ++
 src/error.js                     |  2 +-
 src/iframe-helper.js             |  2 +-
 test/fixtures/served/iframe.html |  2 +-
 8 files changed, 35 insertions(+), 7 deletions(-)

diff --git a/3p/messaging.js b/3p/messaging.js
index 5995d365513e..a47804383b31 100644
--- a/3p/messaging.js
+++ b/3p/messaging.js
@@ -25,7 +25,7 @@ export function nonSensitiveDataPostMessage(type, opt_object) {
   }
   const object = opt_object || {};
   object.type = type;
-  object.sentinel = 'amp-3p';
+  object.sentinel = 'amp-$internalRuntimeToken$';
   window.parent./*OK*/postMessage(object,
       window.context.location.origin);
 }
@@ -41,7 +41,7 @@ export function listenParent(type, callback) {
     if (event.source != window.parent ||
         event.origin != window.context.location.origin ||
         !event.data ||
-        event.data.sentinel != 'amp-3p' ||
+        event.data.sentinel != 'amp-$internalRuntimeToken$' ||
         event.data.type != type) {
       return;
     }
diff --git a/build-system/internal-version.js b/build-system/internal-version.js
index 5a654ce67a1c..22a2059910c0 100644
--- a/build-system/internal-version.js
+++ b/build-system/internal-version.js
@@ -15,8 +15,25 @@
  */
 
 var argv = require('minimist')(process.argv.slice(2));
+var crypto = require('crypto');
 var suffix = argv.type == 'canary' ? '-canary' : '';
 
 // Used to e.g. references the ads binary from the runtime to get
 // version lock.
 exports.VERSION = new Date().getTime() + suffix;
+
+// A token that changes its value each time we release AMP. This is intended
+// to verify that two iframes of AMP have the same version of AMP. It is
+// also intended to make running iframes with custom software very unpleasant,
+// so that we are more likely to have everybody on the same version.
+exports.TOKEN = getToken();
+
+function getToken() {
+  var task = process.argv[2];
+  if (!task || task == 'build') {
+    return 'development--token';
+  }
+  return crypto.createHmac(
+      'sha256', crypto.randomBytes(16)).update(exports.VERSION)
+      .digest('hex');
+}
diff --git a/build-system/tasks/compile.js b/build-system/tasks/compile.js
index 70d81a4e11d6..03ad7d7c6782 100644
--- a/build-system/tasks/compile.js
+++ b/build-system/tasks/compile.js
@@ -20,6 +20,7 @@ var gulp = require('gulp');
 var rename = require('gulp-rename');
 var replace = require('gulp-replace');
 var internalRuntimeVersion = require('../internal-version').VERSION;
+var internalRuntimeToken = require('../internal-version').TOKEN;
 
 var queue = [];
 var inProgress = 0;
@@ -73,16 +74,21 @@ function compile(entryModuleFilename, outputDir,
     fs.writeFileSync(
         'build/fake-module/src/polyfills.js',
         '// Not needed in closure compiler\n');
-    var wrapper = '(function(){var process={env:{}};%output%})();';
+    var wrapper = '(function(){var process={env:{NODE_ENV:"production"}};' +
+        '%output%})();';
     if (options.wrapper) {
       wrapper = options.wrapper.replace('<%= contents %>',
-          'var process={env:{}};%output%');
+          // TODO(@cramforce): Switch to define.
+          'var process={env:{NODE_ENV:"production"}};%output%');
     }
     wrapper += '\n//# sourceMappingURL=' +
         outputFilename + '.map\n';
     if (fs.existsSync(intermediateFilename)) {
       fs.unlinkSync(intermediateFilename);
     }
+    if (/development/.test(internalRuntimeToken)) {
+      throw new Error('Should compile with a prod token');
+    }
     const srcs = [
       '3p/**/*.js',
       'ads/**/*.js',
@@ -150,6 +156,7 @@ function compile(entryModuleFilename, outputDir,
     })
     .pipe(rename(outputFilename))
     .pipe(replace(/\$internalRuntimeVersion\$/g, internalRuntimeVersion))
+    .pipe(replace(/\$internalRuntimeToken\$/g, internalRuntimeToken))
     .pipe(gulp.dest(outputDir))
     .on('end', function() {
       console./*OK*/log('Compiled ', entryModuleFilename, 'to',
diff --git a/builtins/amp-ad.js b/builtins/amp-ad.js
index b91de2655f91..867491c36651 100644
--- a/builtins/amp-ad.js
+++ b/builtins/amp-ad.js
@@ -247,7 +247,9 @@ export function installAd(win) {
               this.updateHeight_(newHeight);
             }
           }, /* opt_is3P */ true);
+          this.iframe_.style.visibility = 'hidden';
           listenOnce(this.iframe_, 'render-start', () => {
+            this.iframe_.style.visibility = '';
             this.sendEmbedInfo_(this.isInViewport());
           }, /* opt_is3P */ true);
 
diff --git a/gulpfile.js b/gulpfile.js
index b8040b88d5d5..c39c39e263d6 100644
--- a/gulpfile.js
+++ b/gulpfile.js
@@ -39,6 +39,7 @@ var util = require('gulp-util');
 var watchify = require('watchify');
 var wrap = require('gulp-wrap');
 var internalRuntimeVersion = require('./build-system/internal-version').VERSION;
+var internalRuntimeToken = require('./build-system/internal-version').TOKEN;
 
 var argv = minimist(process.argv.slice(2), { boolean: ['strictBabelTransform'] });
 
@@ -434,6 +435,7 @@ function compileJs(srcDir, srcFilename, destDir, options) {
       .pipe(source, srcFilename)
       .pipe(buffer)
       .pipe(replace, /\$internalRuntimeVersion\$/g, internalRuntimeVersion)
+      .pipe(replace, /\$internalRuntimeToken\$/g, internalRuntimeToken)
       .pipe(wrap, wrapper)
       .pipe(sourcemaps.init.bind(sourcemaps), {loadMaps: true});
 
diff --git a/src/error.js b/src/error.js
index c7622a7e635f..94cd4a2948b9 100644
--- a/src/error.js
+++ b/src/error.js
@@ -58,7 +58,7 @@ export function reportError(error, opt_associatedElement) {
     } else {
       (console.error || console.log).call(console, error.message);
     }
-    if (!(process.env.NODE_ENV == 'production')) {
+    if (!getMode().minified) {
       (console.error || console.log).call(console, error.stack);
     }
   }
diff --git a/src/iframe-helper.js b/src/iframe-helper.js
index 946dccf31acc..29e1cd206697 100644
--- a/src/iframe-helper.js
+++ b/src/iframe-helper.js
@@ -99,5 +99,5 @@ export function postMessage(iframe, type, object, targetOrigin, opt_is3P) {
  * @private
  */
 function getSentinel_(opt_is3P) {
-  return opt_is3P ? 'amp-3p' : 'amp';
+  return opt_is3P ? 'amp-$internalRuntimeToken$' : 'amp';
 }
diff --git a/test/fixtures/served/iframe.html b/test/fixtures/served/iframe.html
index 4912c7a8ac05..3cd49540bd63 100644
--- a/test/fixtures/served/iframe.html
+++ b/test/fixtures/served/iframe.html
@@ -7,7 +7,7 @@
 window.addEventListener('message', function(event) {
   if (event.data && event.data.sentinel == 'amp-test') {
     if (event.data.type == 'requestHeight') {
-      var sentinel = event.data.is3p ? 'amp-3p': 'amp';
+      var sentinel = event.data.is3p ? 'amp-$internalRuntimeToken$': 'amp';
       parent./*OK*/postMessage({
         sentinel: sentinel,
         type: 'embed-size',

From 5f923539fe4415c44805168f500c024e3ee3675e Mon Sep 17 00:00:00 2001
From: Erwin Mombay <erwinm@google.com>
Date: Sun, 31 Jan 2016 23:30:46 -0800
Subject: [PATCH 28/44] refactor(amp-carousel): add `delay` attribute for
 carousel autoplay delay

---
 extensions/amp-carousel/0.1/slides.js           | 6 +++---
 extensions/amp-carousel/0.1/test/test-slides.js | 5 ++++-
 extensions/amp-carousel/amp-carousel.md         | 9 +++++++--
 3 files changed, 14 insertions(+), 6 deletions(-)

diff --git a/extensions/amp-carousel/0.1/slides.js b/extensions/amp-carousel/0.1/slides.js
index d5ccf4eca758..12cefc7eef91 100644
--- a/extensions/amp-carousel/0.1/slides.js
+++ b/extensions/amp-carousel/0.1/slides.js
@@ -105,13 +105,13 @@ export class AmpSlides extends BaseCarousel {
       return;
     }
 
-    const autoplayValue = Number(this.element.getAttribute('autoplay'));
+    const delayValue = Number(this.element.getAttribute('delay'));
     // If it isn't a number and is not greater than 0 then don't assign
     // and use the default.
-    if (autoplayValue > 0) {
+    if (delayValue > 0) {
       // Guard against autoplayValue that is lower than 1s to prevent
       // people from crashing the runtime with providing very low delays.
-      this.autoplayDelay_ = Math.max(1000, autoplayValue);
+      this.autoplayDelay_ = Math.max(1000, delayValue);
     }
 
     // By default `autoplay` should also mean that the current carousel slide
diff --git a/extensions/amp-carousel/0.1/test/test-slides.js b/extensions/amp-carousel/0.1/test/test-slides.js
index eb0fa213b87a..cd8b6e6436b9 100644
--- a/extensions/amp-carousel/0.1/test/test-slides.js
+++ b/extensions/amp-carousel/0.1/test/test-slides.js
@@ -455,7 +455,10 @@ describe('Slides functional', () => {
     function autoplaySetup(delay = '', inViewport = true) {
       clock = sandbox.useFakeTimers();
       setupElements();
-      element.setAttribute('autoplay', delay);
+      element.setAttribute('autoplay', '');
+      if (delay) {
+        element.setAttribute('delay', delay);
+      }
       element.removeAttribute('loop');
       setupAutoplaySpy = sandbox.spy(AmpSlides.prototype, 'setupAutoplay_');
       tryAutoplaySpy = sandbox.spy(AmpSlides.prototype, 'tryAutoplay_');
diff --git a/extensions/amp-carousel/amp-carousel.md b/extensions/amp-carousel/amp-carousel.md
index 4b1cd6f73273..063d851e0fb1 100644
--- a/extensions/amp-carousel/amp-carousel.md
+++ b/extensions/amp-carousel/amp-carousel.md
@@ -57,11 +57,16 @@ If present, the user may advance past the first item or the final item.
 
 If present, advances the slide to the next slide without user interaction.
 By default it will advance a slide in 5000 millisecond intervals (5 seconds)
-but will use the value of the `autoplay` attribute if present (minimum of 1000 ms).
-Value of `autoplay` must be numeric representation in milliseconds, ex. `autoplay=5000`.
+and can be overridden by the `delay` attribute.
 If `autoplay` is present it will also attach the `loop` attribute to
 `amp-carousel` if `loop` is not already present.
 
+**delay** (type=slides only)
+By default a slide will advance in 5000 millisecond intervals (5 seconds)
+when `autoplay` is specified and will use the value of the `delay`
+attribute if present (minimum of 1000 ms, an error will be thrown if its any lower).
+The value of `delay` must be numeric representation in milliseconds, ex. `delay=5000`.
+
 #### Styling
 - You may use the `amp-carousel` element selector to style it freely.
 - `.amp-carousel-button` by default uses an inlined svg as the background-image of the buttons.

From 2b15cb9c8bd22a676ae8038f4d5c9c6bc1c68495 Mon Sep 17 00:00:00 2001
From: Ashwin Limaye <ashwinlimaye@google.com>
Date: Thu, 4 Feb 2016 18:30:00 -0500
Subject: [PATCH 29/44] Update version number to 0.3

Update version number to 0.3 to increase visibility for the CORS origin security change
---
 extensions/amp-access/amp-access-spec.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/extensions/amp-access/amp-access-spec.md b/extensions/amp-access/amp-access-spec.md
index 7d456955daa8..4f68deae2b06 100644
--- a/extensions/amp-access/amp-access-spec.md
+++ b/extensions/amp-access/amp-access-spec.md
@@ -75,7 +75,7 @@ Login Page is implemented and served by the Publisher and called by the AMP Runt
 
 Login Page is triggered when the Reader taps on the Login Link which can be placed by the Publisher anywhere in the document.
 
-#Specification v0.2
+#Specification v0.3
 
 ##Configuration
 

From 8b637784b283d05e64d174025606e30127e2b7f0 Mon Sep 17 00:00:00 2001
From: Dima Voytenko <dvoytenko@google.com>
Date: Thu, 4 Feb 2016 15:46:08 -0800
Subject: [PATCH 30/44] Access: require CORS/AMP authorization

---
 extensions/amp-access/0.1/amp-access.js       |  6 ++++-
 .../amp-access/0.1/test/test-amp-access.js    | 25 +++++++++++++------
 2 files changed, 22 insertions(+), 9 deletions(-)

diff --git a/extensions/amp-access/0.1/amp-access.js b/extensions/amp-access/0.1/amp-access.js
index 5ad0075524ff..36e0be6db83c 100644
--- a/extensions/amp-access/0.1/amp-access.js
+++ b/extensions/amp-access/0.1/amp-access.js
@@ -324,7 +324,10 @@ export class AccessService {
         this.config_.authorization, /* useAuthData */ false);
     return promise.then(url => {
       log.fine(TAG, 'Authorization URL: ', url);
-      return this.xhr_.fetchJson(url, {credentials: 'include'});
+      return this.xhr_.fetchJson(url, {
+        credentials: 'include',
+        requireAmpResponseSourceOrigin: true
+      });
     }).then(response => {
       log.fine(TAG, 'Authorization response: ', response);
       this.setAuthResponse_(response);
@@ -555,6 +558,7 @@ export class AccessService {
       return this.xhr_.sendSignal(url, {
         method: 'POST',
         credentials: 'include',
+        requireAmpResponseSourceOrigin: true,
         headers: {
           'Content-Type': 'application/x-www-form-urlencoded'
         },
diff --git a/extensions/amp-access/0.1/test/test-amp-access.js b/extensions/amp-access/0.1/test/test-amp-access.js
index f4cd5e0c4241..7fd154112d99 100644
--- a/extensions/amp-access/0.1/test/test-amp-access.js
+++ b/extensions/amp-access/0.1/test/test-amp-access.js
@@ -311,8 +311,10 @@ describe('AccessService authorization', () => {
   it('should run authorization flow', () => {
     expectGetReaderId('reader1');
     xhrMock.expects('fetchJson')
-        .withExactArgs('https://acme.com/a?rid=reader1',
-            {credentials: 'include'})
+        .withExactArgs('https://acme.com/a?rid=reader1', {
+          credentials: 'include',
+          requireAmpResponseSourceOrigin: true
+        })
         .returns(Promise.resolve({access: true}))
         .once();
     service.buildLoginUrl_ = sandbox.spy();
@@ -334,8 +336,10 @@ describe('AccessService authorization', () => {
   it('should recover from authorization failure', () => {
     expectGetReaderId('reader1');
     xhrMock.expects('fetchJson')
-        .withExactArgs('https://acme.com/a?rid=reader1',
-            {credentials: 'include'})
+        .withExactArgs('https://acme.com/a?rid=reader1', {
+          credentials: 'include',
+          requireAmpResponseSourceOrigin: true
+        })
         .returns(Promise.reject('intentional'))
         .once();
     const promise = service.runAuthorization_();
@@ -352,8 +356,10 @@ describe('AccessService authorization', () => {
   it('should resolve first-authorization promise after success', () => {
     expectGetReaderId('reader1');
     xhrMock.expects('fetchJson')
-        .withExactArgs('https://acme.com/a?rid=reader1',
-            {credentials: 'include'})
+        .withExactArgs('https://acme.com/a?rid=reader1', {
+          credentials: 'include',
+          requireAmpResponseSourceOrigin: true
+        })
         .returns(Promise.resolve({access: true}))
         .once();
     return service.runAuthorization_().then(() => {
@@ -365,8 +371,10 @@ describe('AccessService authorization', () => {
   it('should NOT resolve first-authorization promise after failure', () => {
     expectGetReaderId('reader1');
     xhrMock.expects('fetchJson')
-        .withExactArgs('https://acme.com/a?rid=reader1',
-            {credentials: 'include'})
+        .withExactArgs('https://acme.com/a?rid=reader1', {
+          credentials: 'include',
+          requireAmpResponseSourceOrigin: true
+        })
         .returns(Promise.reject('intentional'))
         .once();
     return service.runAuthorization_().then(() => {
@@ -763,6 +771,7 @@ describe('AccessService pingback', () => {
             sinon.match(init => {
               return (init.method == 'POST' &&
                   init.credentials == 'include' &&
+                  init.requireAmpResponseSourceOrigin == true &&
                   init.body == '' &&
                   init.headers['Content-Type'] ==
                       'application/x-www-form-urlencoded');

From 126829ed5786c5f4e460533b554568492162371c Mon Sep 17 00:00:00 2001
From: Dima Voytenko <dvoytenko@google.com>
Date: Wed, 3 Feb 2016 16:05:09 -0800
Subject: [PATCH 31/44] Pass source origin in all fetch requests

---
 src/xhr.js                    |  95 ++++++++++++++++++++++++++--
 test/functional/test-xhr.js   | 116 ++++++++++++++++++++++++++++++++--
 test/manual/amp-list.amp.html |   4 +-
 3 files changed, 202 insertions(+), 13 deletions(-)

diff --git a/src/xhr.js b/src/xhr.js
index 30882c52b212..bc22a1787974 100644
--- a/src/xhr.js
+++ b/src/xhr.js
@@ -16,6 +16,8 @@
 
 import {assert} from './asserts';
 import {getService} from './service';
+import {addParamToUrl, getSourceOrigin, parseQueryString, parseUrl}
+    from './url';
 import {isArray, isObject} from './types';
 
 
@@ -40,6 +42,12 @@ const allowedMethods_ = ['GET', 'POST'];
 /** @private @const {!Array<function:boolean>} */
 const allowedBodyTypes_ = [isArray, isObject];
 
+/** @private @const {string} */
+const SOURCE_ORIGIN_PARAM = '__amp_source_origin';
+
+/** @private @const {string} */
+const ALLOW_SOURCE_ORIGIN_HEADER = 'AMP-Access-Control-Allow-Source-Origin';
+
 
 /**
  * A service that polyfills Fetch API for use within AMP.
@@ -50,6 +58,9 @@ class Xhr {
    * @param {!Window} win
    */
   constructor(win) {
+    /** @const {!Window} */
+    this.win = win;
+
     /**
      * We want to call `fetch_` unbound from any context since it could
      * be either the native fetch or our polyfill.
@@ -58,11 +69,59 @@ class Xhr {
     this.fetch_ = (win.fetch || fetchPolyfill).bind(null);
   }
 
+  /**
+   * Performs the final initialization and requests the fetch. It does three
+   * main things: (1) It adds "__amp_source_origin" URL parameter with source
+   * origin; (2) It verifies "AMP-Access-Control-Allow-Source-Origin" if it's
+   * returned in the response; and (3) If requires
+   * "AMP-Access-Control-Allow-Source-Origin" to be present in the response
+   * if the `init.requireAmpResponseSourceOrigin = true`.
+   *
+   * @param {string} input
+   * @param {?FetchInitDef=} opt_init
+   * @return {!Promise<!FetchResponse>}
+   * @private
+   */
+  fetchAmpCors_(input, opt_init) {
+    // Add "__amp_source_origin" query parameter to the URL. Ideally, we'd be
+    // able to set a header (e.g. AMP-Source-Origin), but this will force
+    // preflight request on all CORS request.
+    const sourceOrigin = getSourceOrigin(this.win.location.href);
+    const url = parseUrl(input);
+    const query = parseQueryString(url.search);
+    if (SOURCE_ORIGIN_PARAM in query) {
+      throw new Error(`Source origin is not allowed in ${input}`);
+    } else {
+      input = addParamToUrl(input, SOURCE_ORIGIN_PARAM, sourceOrigin);
+    }
+    return this.fetch_(input, opt_init).then(response => {
+      const allowSourceOriginHeader = response.headers.get(
+          ALLOW_SOURCE_ORIGIN_HEADER);
+      if (allowSourceOriginHeader) {
+        // If the `AMP-Access-Control-Allow-Source-Origin` header is returned,
+        // ensure that it's equal to the current source origin.
+        if (allowSourceOriginHeader != sourceOrigin) {
+          throw new Error(`Returned ${ALLOW_SOURCE_ORIGIN_HEADER} is not` +
+              ` equal to the current: ${allowSourceOriginHeader}` +
+              ` vs ${sourceOrigin}`);
+        }
+      } else if (opt_init && opt_init.requireAmpResponseSourceOrigin) {
+        // If the `AMP-Access-Control-Allow-Source-Origin` header is not
+        // returned but required, return error.
+        throw new Error(`Response must contain the` +
+            ` ${ALLOW_SOURCE_ORIGIN_HEADER} header`);
+      }
+      return response;
+    });
+  }
+
   /**
    * Fetches and constructs JSON object based on the fetch polyfill.
    *
    * See https://developer.mozilla.org/en-US/docs/Web/API/GlobalFetch/fetch
    *
+   * See `fetchAmpCors_` for more detail.
+   *
    * @param {string} input
    * @param {?FetchInitDef=} opt_init
    * @return {!Promise<!JSONValue>}
@@ -72,7 +131,7 @@ class Xhr {
     init.method = normalizeMethod_(init.method);
     setupJson_(init);
 
-    return this.fetch_(input, init).then(response => {
+    return this.fetchAmpCors_(input, init).then(response => {
       return assertSuccess(response).json();
     });
   }
@@ -82,12 +141,14 @@ class Xhr {
    *
    * See https://developer.mozilla.org/en-US/docs/Web/API/GlobalFetch/fetch
    *
+   * See `fetchAmpCors_` for more detail.
+   *
    * @param {string} input
    * @param {?FetchInitDef=} opt_init
    * @return {!Promise}
    */
   sendSignal(input, opt_init) {
-    return this.fetch_(input, opt_init).then(response => {
+    return this.fetchAmpCors_(input, opt_init).then(response => {
       assertSuccess(response);
     });
   }
@@ -122,9 +183,8 @@ export function normalizeMethod_(method) {
  * @private
  */
 function setupJson_(init) {
-  init.headers = {
-    'Accept': 'application/json'
-  };
+  init.headers = init.headers || {};
+  init.headers['Accept'] = 'application/json';
 
   if (init.method == 'POST') {
     // Assume JSON strict mode where only objects or arrays are allowed
@@ -257,6 +317,9 @@ class FetchResponse {
     /** @type {number} */
     this.status = this.xhr_.status;
 
+    /** @private @const {!FetchResponseHeaders} */
+    this.headers = new FetchResponseHeaders(xhr);
+
     /** @type {boolean} */
     this.bodyUsed = false;
   }
@@ -282,6 +345,28 @@ class FetchResponse {
 }
 
 
+/**
+ * Provides access to the response headers as defined in the Fetch API.
+ */
+class FetchResponseHeaders {
+  /**
+   * @param {!XMLHttpRequest} xhr
+   */
+  constructor(xhr) {
+    /** @private @const {!XMLHttpRequest} */
+    this.xhr_ = xhr;
+  }
+
+  /**
+   * @param {string} name
+   * @return {*}
+   */
+  get(name) {
+    return this.xhr_.getResponseHeader(name);
+  }
+}
+
+
 /**
  * @param {!Window} window
  * @return {!Xhr}
diff --git a/test/functional/test-xhr.js b/test/functional/test-xhr.js
index aded0d62b9c3..708466d2b3b8 100644
--- a/test/functional/test-xhr.js
+++ b/test/functional/test-xhr.js
@@ -26,7 +26,10 @@ describe('XHR', function() {
 
   const scenarios = [
     {xhr: xhrFor(window), desc: 'Native'},
-    {xhr: xhrFor({fetch: fetchPolyfill}), desc: 'Polyfill'}
+    {xhr: xhrFor({
+      fetch: fetchPolyfill,
+      location: {href: 'https://acme.com/path'}
+    }), desc: 'Polyfill'}
   ];
 
   function setupMockXhr() {
@@ -37,6 +40,15 @@ describe('XHR', function() {
     };
   }
 
+  function noOrigin(url) {
+    let index = url.indexOf('//');
+    if (index == -1) {
+      return url;
+    }
+    index = url.indexOf('/', index + 2);
+    return url.substring(index);
+  }
+
   afterEach(() => {
     if (mockXhr) {
       mockXhr.restore();
@@ -105,6 +117,87 @@ describe('XHR', function() {
         expect(requests[0].method).to.equal('GET');
         expect(requests[1].method).to.equal('POST');
       });
+
+      it('should inject source origin query parameter', () => {
+        setupMockXhr();
+        xhr.fetchJson('/get?k=v1#h1');
+        expect(noOrigin(requests[0].url)).to.equal(
+            '/get?k=v1&__amp_source_origin=https%3A%2F%2Facme.com#h1');
+      });
+
+      it('should inject source origin query parameter w/o query', () => {
+        setupMockXhr();
+        xhr.fetchJson('/get');
+        expect(noOrigin(requests[0].url)).to.equal(
+            '/get?__amp_source_origin=https%3A%2F%2Facme.com');
+      });
+
+      it('should defend against invalid source origin query parameter', () => {
+        setupMockXhr();
+        expect(() => {
+          xhr.fetchJson('/get?k=v1&__amp_source_origin=invalid#h1');
+        }).to.throw(/Source origin is not allowed/);
+      });
+
+      it('should defend against empty source origin query parameter', () => {
+        setupMockXhr();
+        expect(() => {
+          xhr.fetchJson('/get?k=v1&__amp_source_origin=#h1');
+        }).to.throw(/Source origin is not allowed/);
+      });
+
+      it('should defend against re-encoded source origin parameter', () => {
+        setupMockXhr();
+        expect(() => {
+          xhr.fetchJson('/get?k=v1&_%5famp_source_origin=#h1');
+        }).to.throw(/Source origin is not allowed/);
+      });
+
+      it('should accept AMP origin when received in response', () => {
+        setupMockXhr();
+        const promise = xhr.fetchJson('/get');
+        requests[0].respond(200, {
+          'Content-Type': 'application/json',
+          'Access-Control-Expose-Headers':
+              'AMP-Access-Control-Allow-Source-Origin',
+          'AMP-Access-Control-Allow-Source-Origin': 'https://acme.com'
+        }, '{}');
+        return promise.then(() => 'SUCCESS', reason => 'ERROR: ' + reason)
+            .then(res => {
+              expect(res).to.equal('SUCCESS');
+            });
+      });
+
+      it('should deny AMP origin for different origin in response', () => {
+        setupMockXhr();
+        const promise = xhr.fetchJson('/get');
+        requests[0].respond(200, {
+          'Content-Type': 'application/json',
+          'Access-Control-Expose-Headers':
+              'AMP-Access-Control-Allow-Source-Origin',
+          'AMP-Access-Control-Allow-Source-Origin': 'https://other.com'
+        }, '{}');
+        return promise.then(() => 'SUCCESS', reason => 'ERROR: ' + reason)
+            .then(res => {
+              expect(res).to.match(/ERROR/);
+              expect(res).to.match(/Returned AMP-Access-.* is not equal/);
+            });
+      });
+
+      it('should require AMP origin in response for when request', () => {
+        setupMockXhr();
+        const promise = xhr.fetchJson('/get', {
+          requireAmpResponseSourceOrigin: true
+        });
+        requests[0].respond(200, {
+          'Content-Type': 'application/json'
+        }, '{}');
+        return promise.then(() => 'SUCCESS', reason => 'ERROR: ' + reason)
+            .then(res => {
+              expect(res).to.match(/ERROR/);
+              expect(res).to.match(/Response must contain/);
+            });
+      });
     }
 
     describe(test.desc, () => {
@@ -165,6 +258,14 @@ describe('XHR', function() {
           expect(res['cookies'][cookieName]).to.equal('v1');
         });
       });
+
+      it('should expose HTTP headers', () => {
+        const url = 'https://httpbin.org/response-headers?' +
+            'AMP-Header=Value1&Access-Control-Expose-Headers=AMP-Header';
+        return xhr.fetchAmpCors_(url).then(res => {
+          expect(res.headers.get('AMP-Header')).to.equal('Value1');
+        });
+      });
     });
   });
 
@@ -181,13 +282,16 @@ describe('XHR', function() {
             method: 'POST',
             body: {
               hello: 'world'
+            },
+            headers: {
+              'Other': 'another'
             }
           });
-          expect(JSON.stringify(requests[0].requestHeaders))
-              .to.eql(JSON.stringify({
-                'Accept': 'application/json',
-                'Content-Type': 'application/json;charset=utf-8'
-              }));
+          expect(requests[0].requestHeaders).to.deep.equal({
+            'Accept': 'application/json',
+            'Content-Type': 'application/json;charset=utf-8',
+            'Other': 'another'  // Not removed when other headers set.
+          });
         });
       }
 
diff --git a/test/manual/amp-list.amp.html b/test/manual/amp-list.amp.html
index 4edb755a1981..2306fd66a6ab 100644
--- a/test/manual/amp-list.amp.html
+++ b/test/manual/amp-list.amp.html
@@ -42,8 +42,8 @@
   </style>
   <style amp-boilerplate>body{-webkit-animation:-amp-start 8s steps(1,end) 0s 1 normal both;-moz-animation:-amp-start 8s steps(1,end) 0s 1 normal both;-ms-animation:-amp-start 8s steps(1,end) 0s 1 normal both;animation:-amp-start 8s steps(1,end) 0s 1 normal both}@-webkit-keyframes -amp-start{from{visibility:hidden}to{visibility:visible}}@-moz-keyframes -amp-start{from{visibility:hidden}to{visibility:visible}}@-ms-keyframes -amp-start{from{visibility:hidden}to{visibility:visible}}@-o-keyframes -amp-start{from{visibility:hidden}to{visibility:visible}}@keyframes -amp-start{from{visibility:hidden}to{visibility:visible}}</style><noscript><style amp-boilerplate>body{-webkit-animation:none;-moz-animation:none;-ms-animation:none;animation:none}</style></noscript>
   <script async src="../../dist/amp.js"></script>
-  <script async custom-element="amp-list" src="../../dist/v0/amp-list-0.1.js"></script>
-  <script async custom-template="amp-mustache" src="../../dist/v0/amp-mustache-0.1.js"></script>
+  <script async custom-element="amp-list" src="../../dist/v0/amp-list-0.1.max.js"></script>
+  <script async custom-template="amp-mustache" src="../../dist/v0/amp-mustache-0.1.max.js"></script>
 </head>
 <body>
 <article>

From 4dd7918e4682e8beef46c7b461cd0e0496745312 Mon Sep 17 00:00:00 2001
From: Malte Ubl <malte.ubl@gmail.com>
Date: Thu, 4 Feb 2016 16:03:55 -0800
Subject: [PATCH 32/44] Hide ads when doc becomes inactive and show them again.

This should solve major perf problems with ads in swiped away docs. A more robust solution is being developed by @jridgewell.
---
 builtins/amp-ad.js             | 57 +++++++++++++++++++++++++---------
 test/functional/test-amp-ad.js | 29 +++++++++++++++++
 2 files changed, 71 insertions(+), 15 deletions(-)

diff --git a/builtins/amp-ad.js b/builtins/amp-ad.js
index b91de2655f91..e6243475dee8 100644
--- a/builtins/amp-ad.js
+++ b/builtins/amp-ad.js
@@ -25,6 +25,7 @@ import {loadPromise} from '../src/event-helper';
 import {parseUrl} from '../src/url';
 import {registerElement} from '../src/custom-element';
 import {adPrefetch, adPreconnect, clientIdScope} from '../ads/_config';
+import {toggle} from '../src/style';
 import {timer} from '../src/timer';
 import {userNotificationManagerFor} from '../src/user-notification';
 
@@ -66,16 +67,18 @@ export function installAd(win) {
       return isLayoutSizeDefined(layout);
     }
 
-    /**
-     * @return {boolean}
-     * @override
-     */
+    /** @override */
     isReadyToBuild() {
       // TODO(dvoytenko, #1014): Review and try a more immediate approach.
       // Wait until DOMReady.
       return false;
     }
 
+    /** @override */
+    isRelayoutNeeded() {
+      return true;
+    }
+
     /** @override */
     buildCallback() {
       /** @private {?Element} */
@@ -106,6 +109,13 @@ export function installAd(win) {
 
       /** @private {IntersectionObserver} */
       this.intersectionObserver_ = null;
+
+      /**
+       * In this state the iframe is set to display: none to reduce
+       * CPU/GPU/Battery consumption by the ad.
+       * @private {boolean}
+       */
+      this.paused_ = false;
     }
 
     /**
@@ -203,24 +213,29 @@ export function installAd(win) {
 
     /** @override */
     layoutCallback() {
-      loadingAdsCount++;
-      timer.delay(() => {
-        // Unfortunately we don't really have a good way to measure how long it
-        // takes to load an ad, so we'll just pretend it takes 1 second for
-        // now.
-        loadingAdsCount--;
-      }, 1000);
-      assert(!this.isInFixedContainer_,
-          '<amp-ad> is not allowed to be placed in elements with ' +
-          'position:fixed: %s', this.element);
-      this.element.setAttribute('scrolling', 'no');
+      if (this.paused_) {
+        this.paused_ = false;
+        toggle(this.iframe_, true);
+        return Promise.resolve(this.iframe_);
+      }
       if (!this.iframe_) {
+        loadingAdsCount++;
+        assert(!this.isInFixedContainer_,
+            '<amp-ad> is not allowed to be placed in elements with ' +
+            'position:fixed: %s', this.element);
+        timer.delay(() => {
+          // Unfortunately we don't really have a good way to measure how long it
+          // takes to load an ad, so we'll just pretend it takes 1 second for
+          // now.
+          loadingAdsCount--;
+        }, 1000);
         return this.getAdCid_().then(cid => {
           if (cid) {
             this.element.setAttribute('ampcid', cid);
           }
           this.iframe_ = getIframe(this.element.ownerDocument.defaultView,
             this.element);
+          this.iframe_.setAttribute('scrolling', 'no');
           this.applyFillContent(this.iframe_);
           this.element.appendChild(this.iframe_);
           this.intersectionObserver_ =
@@ -257,6 +272,18 @@ export function installAd(win) {
       return loadPromise(this.iframe_);
     }
 
+    /** @override */
+    documentInactiveCallback() {
+      if (this.iframe_) {
+        this.paused_ = true;
+        // When the doc is inactive, hide the ads, so any work they do takes
+        // less CPU and power.
+        toggle(this.iframe_, false);
+      }
+      // Call layoutCallback again when this document becomes active.
+      return true;
+    }
+
     /**
      * @return {!Promise<string|undefined>} A promise for a CID or undefined if
      *     - the ad network does not request one or
diff --git a/test/functional/test-amp-ad.js b/test/functional/test-amp-ad.js
index af16be53b3e6..a6a24831f07a 100644
--- a/test/functional/test-amp-ad.js
+++ b/test/functional/test-amp-ad.js
@@ -93,6 +93,7 @@ function runAdTestSuiteAgainstInstaller(name, installer) {
         const url = iframe.getAttribute('src');
         expect(url).to.match(/^http:\/\/ads.localhost:/);
         expect(url).to.match(/frame(.max)?.html#{/);
+        expect(iframe.style.display).to.equal('');
 
         const fragment = url.substr(url.indexOf('#') + 1);
         const data = JSON.parse(fragment);
@@ -175,6 +176,34 @@ function runAdTestSuiteAgainstInstaller(name, installer) {
         });
       });
 
+      it('should toggle iframe when doc becomes inactive', () => {
+        return getAd({
+          width: 300,
+          height: 250,
+          type: 'a9',
+          src: 'https://testsrc',
+          'data-aax_size': '300x250',
+          'data-aax_pubname': 'test123',
+          'data-aax_src': '302',
+          // Test precedence
+          'data-width': '6666'
+        }, 'https://schema.org').then(ad => {
+          const iframe = ad.firstChild;
+          expect(iframe.style.display).to.equal('');
+          const obj = ad.implementation_;
+          expect(obj.isRelayoutNeeded()).to.be.true;
+          expect(obj.paused_).to.be.false;
+          const ret = obj.documentInactiveCallback();
+          expect(ret).to.be.true;
+          expect(iframe.style.display).to.equal('none');
+          expect(obj.paused_).to.be.true;
+          obj.layoutCallback();
+          expect(iframe.style.display).to.equal('');
+          expect(obj.paused_).to.be.false;
+        });
+      });
+
+
       it('should require a canonical', () => {
         return expect(getAd({
           width: 300,

From 04c07b1de05d482835e6f0d2a4c2ddc3dacdaf20 Mon Sep 17 00:00:00 2001
From: Dima Voytenko <dvoytenko@google.com>
Date: Thu, 4 Feb 2016 18:22:19 -0800
Subject: [PATCH 33/44] Fix analytics tests and requestCount

---
 extensions/amp-analytics/0.1/amp-analytics.js |  9 +-
 .../0.1/test/test-amp-analytics.js            | 88 ++++++++++++-------
 2 files changed, 60 insertions(+), 37 deletions(-)

diff --git a/extensions/amp-analytics/0.1/amp-analytics.js b/extensions/amp-analytics/0.1/amp-analytics.js
index 80b082b914f0..c1a7616efdbf 100644
--- a/extensions/amp-analytics/0.1/amp-analytics.js
+++ b/extensions/amp-analytics/0.1/amp-analytics.js
@@ -277,6 +277,8 @@ export class AmpAnalytics extends AMP.BaseElement {
       return;
     }
 
+    this.config_['vars']['requestCount']++;
+
     // Replace placeholders with URI encoded values.
     // Precedence is trigger.vars > config.vars.
     // Nested expansion not supported.
@@ -284,12 +286,11 @@ export class AmpAnalytics extends AMP.BaseElement {
       const match = key.match(/([^(]*)(\([^)]*\))?/);
       const name = match[1];
       const argList = match[2] || '';
-      const val = encodeURIComponent(
-          (trigger['vars'] && trigger['vars'][name]) ||
-          (this.config_['vars'] && this.config_['vars'][name]) || '');
+      const raw = (trigger['vars'] && trigger['vars'][name] ||
+          this.config_['vars'] && this.config_['vars'][name]);
+      const val = encodeURIComponent(raw != null ? raw : '');
       return val + argList;
     });
-    this.config_['vars']['requestCount']++;
 
     // For consistentcy with amp-pixel we also expand any url replacements.
     urlReplacementsFor(this.getWin()).expand(request).then(
diff --git a/extensions/amp-analytics/0.1/test/test-amp-analytics.js b/extensions/amp-analytics/0.1/test/test-amp-analytics.js
index cecfe0884458..e5653938e466 100644
--- a/extensions/amp-analytics/0.1/test/test-amp-analytics.js
+++ b/extensions/amp-analytics/0.1/test/test-amp-analytics.js
@@ -84,13 +84,36 @@ describe('amp-analytics', function() {
     return analytics;
   }
 
+  function waitForSendRequest(analytics, opt_max) {
+    return analytics.layoutCallback().then(() => {
+      if (sendRequestSpy.callCount > 0) {
+        return;
+      }
+      return new Promise(resolve => {
+        const start = new Date().getTime();
+        const interval = setInterval(() => {
+          const time = new Date().getTime();
+          if (sendRequestSpy.callCount > 0 ||
+                  opt_max && (time - start) > opt_max) {
+            clearInterval(interval);
+            resolve();
+          }
+        }, 4);
+      });
+    });
+  }
+
+  function waitForNoSendRequest(analytics) {
+    return waitForSendRequest(analytics, 100);
+  }
+
   it('sends a basic hit', function() {
     const analytics = getAnalyticsTag({
       'requests': {'foo': 'https://example.com/bar'},
       'triggers': [{'on': 'visible', 'request': 'foo'}]
     });
 
-    return analytics.layoutCallback().then(() => {
+    return waitForSendRequest(analytics).then(() => {
       expect(sendRequestSpy.withArgs('https://example.com/bar').calledOnce)
           .to.be.true;
     });
@@ -109,7 +132,7 @@ describe('amp-analytics', function() {
     analytics.buildCallback();
     sendRequestSpy = sandbox.spy(analytics, 'sendRequest_');
 
-    return analytics.layoutCallback().then(() => {
+    return waitForNoSendRequest(analytics).then(() => {
       expect(sendRequestSpy.callCount).to.equal(0);
     });
   });
@@ -122,7 +145,7 @@ describe('amp-analytics', function() {
     const script2 = document.createElement('script');
     script2.setAttribute('type', 'application/json');
     analytics.element.appendChild(script2);
-    return analytics.layoutCallback().then(() => {
+    return waitForNoSendRequest(analytics).then(() => {
       expect(sendRequestSpy.callCount).to.equal(0);
     });
   });
@@ -142,7 +165,7 @@ describe('amp-analytics', function() {
         analytics.buildCallback();
         sendRequestSpy = sandbox.spy(analytics, 'sendRequest_');
 
-        return analytics.layoutCallback().then(() => {
+        return waitForNoSendRequest(analytics).then(() => {
           expect(sendRequestSpy.callCount).to.equal(0);
         });
       });
@@ -153,7 +176,7 @@ describe('amp-analytics', function() {
       'triggers': [{'on': 'visible'}]
     });
 
-    return analytics.layoutCallback().then(() => {
+    return waitForNoSendRequest(analytics).then(() => {
       expect(sendRequestSpy.callCount).to.equal(0);
     });
   });
@@ -163,7 +186,7 @@ describe('amp-analytics', function() {
       'triggers': [{'on': 'visible', 'request': 'foo'}]
     });
 
-    return analytics.layoutCallback().then(() => {
+    return waitForNoSendRequest(analytics).then(() => {
       expect(sendRequestSpy.callCount).to.equal(0);
     });
   });
@@ -174,8 +197,7 @@ describe('amp-analytics', function() {
         'https://example.com/bar&${foobar}&baz', 'foobar': 'f1'},
       'triggers': [{'on': 'visible', 'request': 'foo'}]
     });
-
-    return analytics.layoutCallback().then(() => {
+    return waitForSendRequest(analytics).then(() => {
       expect(sendRequestSpy.calledOnce).to.be.true;
       expect(sendRequestSpy.args[0][0])
         .to.equal('https://example.com/bar&f1&baz');
@@ -189,7 +211,7 @@ describe('amp-analytics', function() {
       'triggers': [{'on': 'visible', 'request': 'foo'}]
     });
 
-    return analytics.layoutCallback().then(() => {
+    return waitForSendRequest(analytics).then(() => {
       expect(sendRequestSpy.calledOnce).to.be.true;
       expect(sendRequestSpy.args[0][0]).to.equal('https://example.com/bar&b1');
     });
@@ -201,7 +223,7 @@ describe('amp-analytics', function() {
       'triggers': [{'on': 'visible', 'request': 'foo'}]
     });
 
-    return analytics.layoutCallback().then(() => {
+    return waitForSendRequest(analytics).then(() => {
       expect(sendRequestSpy.calledOnce).to.be.true;
       expect(sendRequestSpy.args[0][0])
           .to.equal('/bar&/bar&/bar&&baz&baz&baz');
@@ -223,10 +245,10 @@ describe('amp-analytics', function() {
       'triggers': [{'on': 'visible', 'request': 'foo'}]
     });
 
-    analytics.layoutCallback().then(() => {
+    return waitForSendRequest(analytics).then(() => {
       expect(sendRequestSpy.calledOnce).to.be.true;
       expect(sendRequestSpy.args[0][0]).to.equal(
-         'https://example.comcid=uQVAtQyO978OPCNBZXWOKRDcxSORw9GQfB' +
+         'https://example.com/cid=uQVAtQyO978OPCNBZXWOKRDcxSORw9GQfB' +
           'x2CyJSF0MnkIPeeX9ruacSFPgQ0HSD');
     });
   });
@@ -242,7 +264,7 @@ describe('amp-analytics', function() {
         'requests': {'foo': '/bar', 'bar': 'foobar'}
       }
     };
-    return analytics.layoutCallback().then(() => {
+    return waitForSendRequest(analytics).then(() => {
       expect(sendRequestSpy.calledOnce).to.be.true;
       expect(sendRequestSpy.args[0][0]).to.equal('https://example.com/foobar');
     });
@@ -296,7 +318,7 @@ describe('amp-analytics', function() {
           'var2': 'test2'
         }
       }]});
-    return analytics.layoutCallback().then(() => {
+    return waitForSendRequest(analytics).then(() => {
       expect(sendRequestSpy.calledOnce).to.be.true;
       expect(sendRequestSpy.args[0][0]).to.equal(
           'https://example.com/test1=x&test2=test2');
@@ -312,7 +334,7 @@ describe('amp-analytics', function() {
       'requests': {'pageview':
         'https://example.com/test1=${var1}&test2=${var2}'},
       'triggers': [{'on': 'visible', 'request': 'pageview'}]});
-    return analytics.layoutCallback().then(() => {
+    return waitForSendRequest(analytics).then(() => {
       expect(sendRequestSpy.calledOnce).to.be.true;
       expect(sendRequestSpy.args[0][0]).to.equal(
           'https://example.com/test1=x&test2=test2');
@@ -324,7 +346,7 @@ describe('amp-analytics', function() {
       'requests': {'pageview':
         'https://example.com/title=${title}&ref=${documentReferrer}'},
       'triggers': [{'on': 'visible', 'request': 'pageview'}]});
-    return analytics.layoutCallback().then(() => {
+    return waitForSendRequest(analytics).then(() => {
       expect(sendRequestSpy.calledOnce).to.be.true;
       expect(sendRequestSpy.args[0][0]).to.equal(
           'https://example.com/title=Test%20Title&' +
@@ -337,14 +359,12 @@ describe('amp-analytics', function() {
       'requests': {'foo': 'https://example.com/AMPDOC_URL&TITLE'},
       'triggers': [{'on': 'visible', 'request': 'foo'}]
     });
-
-    return analytics.layoutCallback().then(() => {
+    return waitForSendRequest(analytics).then(() => {
       expect(sendRequestSpy.calledOnce).to.be.true;
       expect(sendRequestSpy.args[0][0]).to.not.match(/AMPDOC_URL/);
     });
   });
 
-
   it('expands trigger vars with higher precedence than config vars', () => {
     const analytics = getAnalyticsTag({
       'vars': {
@@ -359,7 +379,7 @@ describe('amp-analytics', function() {
         'vars': {
           'var1': 'trigger1'
         }}]});
-    return analytics.layoutCallback().then(() => {
+    return waitForSendRequest(analytics).then(() => {
       expect(sendRequestSpy.calledOnce).to.be.true;
       expect(sendRequestSpy.args[0][0]).to.equal(
           'https://example.com/test1=trigger1&test2=config2');
@@ -373,7 +393,7 @@ describe('amp-analytics', function() {
         'https://example.com/test1=${title}&test2=${random}'},
       'triggers': [{'on': 'visible', 'request': 'pageview',}]
     });
-    return analytics.layoutCallback().then(() => {
+    return waitForSendRequest(analytics).then(() => {
       expect(sendRequestSpy.calledOnce).to.be.true;
       expect(sendRequestSpy.args[0][0]).to.equal(
           'https://example.com/test1=Test%20Title&test2=428');
@@ -390,7 +410,7 @@ describe('amp-analytics', function() {
           'var1': '${var2}',
           'var2': 't2'
         }}]});
-    return analytics.layoutCallback().then(() => {
+    return waitForSendRequest(analytics).then(() => {
       expect(sendRequestSpy.calledOnce).to.be.true;
       expect(sendRequestSpy.args[0][0]).to.equal(
           'https://example.com/test=%24%7Bvar2%7D');
@@ -414,7 +434,7 @@ describe('amp-analytics', function() {
           't1': 'trigger=1',
           't2': 'trigger?2'
         }}]});
-    return analytics.layoutCallback().then(() => {
+    return waitForSendRequest(analytics).then(() => {
       expect(sendRequestSpy.calledOnce).to.be.true;
       expect(sendRequestSpy.args[0][0]).to.equal(
           'https://example.com/test?c1=config%201&t1=trigger%3D1&' +
@@ -434,7 +454,7 @@ describe('amp-analytics', function() {
           'var2': 'DOCUMENT_REFERRER'
         }
       }]});
-    return analytics.layoutCallback().then(() => {
+    return waitForSendRequest(analytics).then(() => {
       expect(sendRequestSpy.calledOnce).to.be.true;
       expect(sendRequestSpy.args[0][0]).to.equal(
           'https://example.com/test1=x&test2=https%3A%2F%2Fwww.google.com%2F' +
@@ -449,18 +469,18 @@ describe('amp-analytics', function() {
       'optout': 'foo.bar'
     };
     let analytics = getAnalyticsTag(config);
-    return analytics.layoutCallback().then(() => {
+    return waitForSendRequest(analytics).then(() => {
       expect(sendRequestSpy.withArgs('https://example.com/bar').calledOnce)
           .to.be.true;
       sendRequestSpy.reset();
       windowApi['foo'] = {'bar': function() { return true; }};
       analytics = getAnalyticsTag(config);
-      analytics.layoutCallback().then(() => {
+      return waitForNoSendRequest(analytics).then(() => {
         expect(sendRequestSpy.callCount).to.be.equal(0);
         sendRequestSpy.reset();
         windowApi['foo'] = {'bar': function() { return false; }};
         analytics = getAnalyticsTag(config);
-        analytics.layoutCallback().then(() => {
+        waitForSendRequest(analytics).then(() => {
           expect(sendRequestSpy.withArgs('https://example.com/bar').calledOnce)
               .to.be.true;
         });
@@ -476,7 +496,7 @@ describe('amp-analytics', function() {
     }, {
       'config': 'config1'
     });
-    return analytics.layoutCallback().then(() => {
+    return waitForSendRequest(analytics).then(() => {
       expect(sendRequestSpy.args[0][0]).to.equal('https://example.com/remote');
     });
   });
@@ -492,10 +512,10 @@ describe('amp-analytics', function() {
         {'on': 'visible', 'request': 'pageview1'},
         {'on': 'visible', 'request': 'pageview2'}
       ]});
-    analytics.layoutCallback().then(() => {
+    return waitForSendRequest(analytics).then(() => {
       expect(sendRequestSpy.calledTwice).to.be.true;
-      expect(sendRequestSpy.args[0][0]).to.equal('https://example.com/test1=1');
-      expect(sendRequestSpy.args[1][0]).to.equal('https://example.com/test2=2');
+      expect(sendRequestSpy.args[0][0]).to.equal('/test1=1');
+      expect(sendRequestSpy.args[1][0]).to.equal('/test2=2');
     });
   });
 
@@ -515,7 +535,7 @@ describe('amp-analytics', function() {
         return Promise.resolve();
       });
 
-      return analytics.layoutCallback().then(() => {
+      return waitForSendRequest(analytics).then(() => {
         expect(sendRequestSpy.callCount).to.equal(1);
         expect(sendRequestSpy.args[0][0]).to.equal('https://example.com/local');
       });
@@ -534,7 +554,9 @@ describe('amp-analytics', function() {
         expect(id).to.equal('amp-user-notification1');
         return Promise.reject();
       });
-      return analytics.layoutCallback().catch(() => {
+      return analytics.layoutCallback().then(() => {
+        throw new Error('Must never be here');
+      }, () => {
         expect(sendRequestSpy.callCount).to.equal(0);
       });
     });

From 54a27c9eee72b73eb5b125612089da3f5ebe9104 Mon Sep 17 00:00:00 2001
From: Dima Voytenko <dvoytenko@google.com>
Date: Wed, 3 Feb 2016 18:02:13 -0800
Subject: [PATCH 34/44] Confirm viewer and referrer via messaging channel

---
 build-system/tasks/presubmit-checks.js        |   8 +
 .../0.1/amp-dynamic-css-classes.js            |   2 +-
 .../0.1/test/test-runtime-classes.js          |   2 +-
 src/3p-frame.js                               |   2 +-
 src/service/viewer-impl.js                    | 123 ++++++----
 test/functional/test-3p-frame.js              |   2 +-
 test/functional/test-viewer.js                | 221 ++++++++++++------
 7 files changed, 238 insertions(+), 122 deletions(-)

diff --git a/build-system/tasks/presubmit-checks.js b/build-system/tasks/presubmit-checks.js
index 303adbfa3970..a92d15450ae0 100644
--- a/build-system/tasks/presubmit-checks.js
+++ b/build-system/tasks/presubmit-checks.js
@@ -258,6 +258,14 @@ var forbiddenTerms = {
       'src/service/viewer-impl.js',
     ],
   },
+  'getUnconfirmedReferrerUrl': {
+    message: 'Use Viewer.getReferrerUrl() instead.',
+    whitelist: [
+      'extensions/amp-dynamic-css-classes/0.1/amp-dynamic-css-classes.js',
+      'src/3p-frame.js',
+      'src/service/viewer-impl.js',
+    ],
+  },
 };
 
 var ThreePTermsMessage = 'The 3p bootstrap iframe has no polyfills loaded and' +
diff --git a/extensions/amp-dynamic-css-classes/0.1/amp-dynamic-css-classes.js b/extensions/amp-dynamic-css-classes/0.1/amp-dynamic-css-classes.js
index 5c87c0cfaacc..e8ad1db69652 100644
--- a/extensions/amp-dynamic-css-classes/0.1/amp-dynamic-css-classes.js
+++ b/extensions/amp-dynamic-css-classes/0.1/amp-dynamic-css-classes.js
@@ -33,7 +33,7 @@ const EXPERIMENT = 'dynamic-css-classes';
  * @returns {string}
  */
 function referrerDomain(win) {
-  const referrer = viewerFor(win).getReferrerUrl();
+  const referrer = viewerFor(win).getUnconfirmedReferrerUrl();
   if (referrer) {
     return parseUrl(referrer).hostname;
   }
diff --git a/extensions/amp-dynamic-css-classes/0.1/test/test-runtime-classes.js b/extensions/amp-dynamic-css-classes/0.1/test/test-runtime-classes.js
index 67bf27e80876..0ea98ee88d1e 100644
--- a/extensions/amp-dynamic-css-classes/0.1/test/test-runtime-classes.js
+++ b/extensions/amp-dynamic-css-classes/0.1/test/test-runtime-classes.js
@@ -57,7 +57,7 @@ describe('dynamic classes are inserted at runtime', () => {
         overwrite(win.navigator, 'userAgent', userAgent);
       }
       if (referrer !== undefined) {
-        viewerFor(win).getReferrerUrl = () => referrer;
+        viewerFor(win).getUnconfirmedReferrerUrl = () => referrer;
       }
 
       return win.insertDynamicCssScript();
diff --git a/src/3p-frame.js b/src/3p-frame.js
index 4adaaf5122cc..266951fd9155 100644
--- a/src/3p-frame.js
+++ b/src/3p-frame.js
@@ -65,7 +65,7 @@ function getFrameAttributes(parentWindow, element, opt_type) {
     locationHref = parentWindow.parent.location.href;
   }
   attributes._context = {
-    referrer: viewer.getReferrerUrl(),
+    referrer: viewer.getUnconfirmedReferrerUrl(),
     canonicalUrl: docInfo.canonicalUrl,
     pageViewId: docInfo.pageViewId,
     clientId: element.getAttribute('ampcid'),
diff --git a/src/service/viewer-impl.js b/src/service/viewer-impl.js
index ad4b895c407e..86060b19ae67 100644
--- a/src/service/viewer-impl.js
+++ b/src/service/viewer-impl.js
@@ -232,8 +232,62 @@ export class Viewer {
     // Wait for document to become visible.
     this.docState_.onVisibilityChanged(this.onVisibilityChange_.bind(this));
 
-    /** @const @private {boolean} */
-    this.isTrustedViewer_ = this.calcTrustedViewer_();
+    let trustedViewerResolved;
+    let trustedViewerPromise;
+    if (!this.isEmbedded_) {
+      // Not embedded in IFrame - can't trust the viewer.
+      trustedViewerResolved = false;
+      trustedViewerPromise = Promise.resolve(false);
+    } else if (this.win.location.ancestorOrigins) {
+      // Ancestors when available take precedence. This is the main API used
+      // for this determination. Fallback is only done when this API is not
+      // supported by the browser.
+      trustedViewerResolved = (this.win.location.ancestorOrigins.length > 0 &&
+          this.isTrustedViewerOrigin_(this.win.location.ancestorOrigins[0]));
+      trustedViewerPromise = Promise.resolve(trustedViewerResolved);
+    } else {
+      // Wait for comms channel to confirm the origin.
+      trustedViewerResolved = undefined;
+      trustedViewerPromise = new Promise(resolve => {
+        /** @const @private {!function(boolean)|undefined} */
+        this.trustedViewerResolver_ = resolve;
+      });
+    }
+
+    /** @const @private {!Promise<boolean>} */
+    this.isTrustedViewer_ = trustedViewerPromise;
+
+    /** @private {string} */
+    this.unconfirmedReferrerUrl_ =
+        this.isEmbedded() && this.params_['referrer'] &&
+            trustedViewerResolved !== false ?
+        this.params_['referrer'] :
+        this.win.document.referrer;
+
+    /** @const @private {!Promise<string>} */
+    this.referrerUrl_ = new Promise(resolve => {
+      if (this.isEmbedded() && this.params_['referrer']) {
+        // Viewer override, but only for whitelisted viewers. Only allowed for
+        // iframed documents.
+        this.isTrustedViewer_.then(isTrusted => {
+          if (isTrusted) {
+            resolve(this.params_['referrer']);
+          } else {
+            resolve(this.win.document.referrer);
+            if (this.unconfirmedReferrerUrl_ != this.win.document.referrer) {
+              this.win.setTimeout(() => {
+                throw new Error('Untrusted viewer referrer override: ' +
+                    this.unconfirmedReferrerUrl_ + ' at ' +
+                    this.messagingOrigin_);
+              });
+              this.unconfirmedReferrerUrl_ = this.win.document.referrer;
+            }
+          }
+        });
+      } else {
+        resolve(this.win.document.referrer);
+      }
+    });
 
     // Remove hash - no reason to keep it around, but only when embedded.
     if (this.isEmbedded_) {
@@ -412,34 +466,23 @@ export class Viewer {
   }
 
   /**
-   * Returns the "referrer" URL that can be optionally customized by
-   * the viewer.
+   * Returns an unconfirmed "referrer" URL that can be optionally customized by
+   * the viewer. Consider using `getReferrerUrl()` instead, which returns the
+   * promise that will yield the confirmed "referrer" URL.
    * @return {string}
    */
-  getReferrerUrl() {
-    // If not embedded in a IFrame always return the document's referrer.
-    if (!this.isEmbedded()) {
-      return this.win.document.referrer;
-    }
-
-    // Viewer override, but only for whitelisted viewers.
-    if (this.params_['referrer'] && this.isTrustedViewer()) {
-      return this.params_['referrer'];
-    }
-
-    // Document's referrer.
-    if (this.win.document.referrer) {
-      return this.win.document.referrer;
-    }
-
-    // Ancestor in the embedded case.
-    const ancestorOrigins = this.win.location.ancestorOrigins;
-    if (ancestorOrigins && ancestorOrigins.length > 0) {
-      return ancestorOrigins[0];
-    }
+  getUnconfirmedReferrerUrl() {
+    return this.unconfirmedReferrerUrl_;
+  }
 
-    // No referrer found.
-    return '';
+  /**
+   * Returns the promise that will yield the confirmed "referrer" URL. This
+   * URL can be optionally customized by the viewer, but viewer is required
+   * to be a trusted viewer.
+   * @return {!Promise<string>}
+   */
+  getReferrerUrl() {
+    return this.referrerUrl_;
   }
 
   /**
@@ -451,28 +494,6 @@ export class Viewer {
     return this.isTrustedViewer_;
   }
 
-  /**
-   * @return {boolean}
-   */
-  calcTrustedViewer_() {
-    // This only applies to the documents embedded as iframes.
-    if (!this.isEmbedded_) {
-      return false;
-    }
-
-    // Ancestors when available take precedence. This is the main API used
-    // for this determination. Fallback is only done when this API is not
-    // supported by the browser.
-    const ancestorOrigins = this.win.location.ancestorOrigins;
-    if (ancestorOrigins) {
-      return (ancestorOrigins.length > 0 &&
-          this.isTrustedViewerOrigin_(ancestorOrigins[0]));
-    }
-
-    // Fallback to the referrer if ancestorOrigins is not available.
-    return this.isTrustedViewerOrigin_(this.win.document.referrer);
-  }
-
   /**
    * @param {string} urlString
    * @return {boolean}
@@ -659,6 +680,10 @@ export class Viewer {
     this.messageDeliverer_ = deliverer;
     // TODO(dvoytenko, #1764): Make `origin` required when viewers catch up.
     this.messagingOrigin_ = origin;
+    if (this.trustedViewerResolver_) {
+      this.trustedViewerResolver_(
+          origin ? this.isTrustedViewerOrigin_(origin) : false);
+    }
     if (this.messageQueue_.length > 0) {
       const queue = this.messageQueue_.slice(0);
       this.messageQueue_ = [];
diff --git a/test/functional/test-3p-frame.js b/test/functional/test-3p-frame.js
index 03b7ade5f028..a2fc48c55a1e 100644
--- a/test/functional/test-3p-frame.js
+++ b/test/functional/test-3p-frame.js
@@ -94,7 +94,7 @@ describe('3p-frame', () => {
 
     const viewer = viewerFor(window);
     const viewerMock = sandbox.mock(viewer);
-    viewerMock.expects('getReferrerUrl')
+    viewerMock.expects('getUnconfirmedReferrerUrl')
         .returns('http://acme.org/')
         .once();
 
diff --git a/test/functional/test-viewer.js b/test/functional/test-viewer.js
index dfd7802f779d..65d113c69edb 100644
--- a/test/functional/test-viewer.js
+++ b/test/functional/test-viewer.js
@@ -24,11 +24,15 @@ describe('Viewer', () => {
   let windowMock;
   let viewer;
   let windowApi;
+  let timeouts;
 
   beforeEach(() => {
     sandbox = sinon.sandbox.create();
+    timeouts = [];
     const WindowApi = function() {};
-    WindowApi.prototype.setTimeout = function() {};
+    WindowApi.prototype.setTimeout = function(handler) {
+      timeouts.push(handler);
+    };
     windowApi = new WindowApi();
     windowApi.location = {
       hash: '',
@@ -215,55 +219,82 @@ describe('Viewer', () => {
   });
 
   describe('isTrustedViewer', () => {
-    function test(referrer, toBeTrusted) {
-      windowApi.parent = {};
-
-      windowApi.location.ancestorOrigins = referrer ? [referrer] : [];
-      expect(new Viewer(windowApi).isTrustedViewer())
-          .to.equal(toBeTrusted, 'by ancestor');
-      windowApi.location.ancestorOrigins = null;
 
-      windowApi.document.referrer = referrer;
-      expect(new Viewer(windowApi).isTrustedViewer())
-          .to.equal(toBeTrusted, 'by referrer');
-      windowApi.document.referrer = '';
+    function test(origin, toBeTrusted) {
+      const viewer = new Viewer(windowApi);
+      expect(viewer.isTrustedViewerOrigin_(origin)).to.equal(toBeTrusted);
     }
 
-    it('should verify ancestorOrigins ahead of referrer', () => {
-      windowApi.parent = {};
-      windowApi.document.referrer = 'https://google.com';
-      expect(new Viewer(windowApi).isTrustedViewer()).to.equal(true);
-
+    it('should consider non-trusted when not iframed', () => {
+      windowApi.parent = windowApi;
       windowApi.location.ancestorOrigins = ['https://google.com'];
-      expect(new Viewer(windowApi).isTrustedViewer()).to.equal(true);
+      return new Viewer(windowApi).isTrustedViewer().then(res => {
+        expect(res).to.be.false;
+      });
+    });
 
-      windowApi.location.ancestorOrigins = ['https://google.other.com'];
-      expect(new Viewer(windowApi).isTrustedViewer()).to.equal(false);
+    it('should consider trusted by ancestor', () => {
+      windowApi.parent = {};
+      windowApi.location.ancestorOrigins = ['https://google.com'];
+      return new Viewer(windowApi).isTrustedViewer().then(res => {
+        expect(res).to.be.true;
+      });
+    });
 
-      // Even empty ancestorOrigins takes precendence.
+    it('should consider non-trusted without ancestor', () => {
+      windowApi.parent = {};
       windowApi.location.ancestorOrigins = [];
-      expect(new Viewer(windowApi).isTrustedViewer()).to.equal(false);
+      return new Viewer(windowApi).isTrustedViewer().then(res => {
+        expect(res).to.be.false;
+      });
     });
 
-    it('should only consider viewer trusted when iframed', () => {
+    it('should consider non-trusted with wrong ancestor', () => {
       windowApi.parent = {};
-      windowApi.location.ancestorOrigins = ['https://google.com'];
-      expect(new Viewer(windowApi).isTrustedViewer()).to.equal(true);
+      windowApi.location.ancestorOrigins = ['https://untrusted.com'];
+      return new Viewer(windowApi).isTrustedViewer().then(res => {
+        expect(res).to.be.false;
+      });
+    });
 
-      windowApi.parent = windowApi;
-      expect(new Viewer(windowApi).isTrustedViewer()).to.equal(false);
+    it('should decide trusted on connection with origin', () => {
+      windowApi.parent = {};
+      windowApi.location.ancestorOrigins = null;
+      const viewer = new Viewer(windowApi);
+      viewer.setMessageDeliverer(() => {}, 'https://google.com');
+      return viewer.isTrustedViewer().then(res => {
+        expect(res).to.be.true;
+      });
     });
 
-    it('should flag viewer as not trusted without referrer or ancestor', () => {
-      test('', false);
+    it('should decide non-trusted on connection without origin', () => {
+      windowApi.parent = {};
+      windowApi.location.ancestorOrigins = null;
+      const viewer = new Viewer(windowApi);
+      viewer.setMessageDeliverer(() => {});
+      return viewer.isTrustedViewer().then(res => {
+        expect(res).to.be.false;
+      });
     });
 
-    it('should trust host as referrer with https', () => {
-      test('https://google.com', true);
+    it('should decide non-trusted on connection with wrong origin', () => {
+      windowApi.parent = {};
+      windowApi.location.ancestorOrigins = null;
+      const viewer = new Viewer(windowApi);
+      viewer.setMessageDeliverer(() => {}, 'https://untrusted.com');
+      return viewer.isTrustedViewer().then(res => {
+        expect(res).to.be.false;
+      });
     });
 
-    it('should not trust host as referrer with http', () => {
-      test('http://google.com', false);
+    it('should give precedence to ancestor', () => {
+      windowApi.parent = {};
+      windowApi.location.ancestorOrigins = ['https://google.com'];
+      const viewer = new Viewer(windowApi);
+      viewer.setMessageDeliverer(() => {}, 'https://untrusted.com');
+      return viewer.isTrustedViewer().then(res => {
+        expect(res).to.be.true;
+      });
     });
 
     it('should trust domain variations', () => {
@@ -279,6 +310,10 @@ describe('Viewer', () => {
       test('https://news.google.de', true);
     });
 
+    it('should not trust host as referrer with http', () => {
+      test('http://google.com', false);
+    });
+
     it('should NOT trust wrong or non-whitelisted domain variations', () => {
       test('https://google.net', false);
       test('https://google.other.com', false);
@@ -289,68 +324,116 @@ describe('Viewer', () => {
   });
 
   describe('referrer', () => {
-    it('should return overridden trusted viewer referrer by ancestor', () => {
+
+    it('should return document referrer if not overriden', () => {
       windowApi.parent = {};
-      windowApi.location.hash = '#referrer=' +
-          encodeURIComponent('https://acme.org/viewer');
-      windowApi.location.ancestorOrigins = [
-        'https://google.com'
-      ];
-      expect(new Viewer(windowApi).getReferrerUrl())
-          .to.equal('https://acme.org/viewer');
+      windowApi.location.hash = '#';
+      windowApi.document.referrer = 'https://acme.org/docref';
+      const viewer = new Viewer(windowApi);
+      expect(viewer.getUnconfirmedReferrerUrl())
+          .to.equal('https://acme.org/docref');
+      return viewer.getReferrerUrl().then(referrerUrl => {
+        expect(referrerUrl).to.equal('https://acme.org/docref');
+        expect(timeouts).to.have.length(0);
+      });
     });
 
-    it('should return overridden trusted viewer referrer by referrer', () => {
-      windowApi.parent = {};
+    it('should NOT allow override if not iframed', () => {
+      windowApi.parent = windowApi;
       windowApi.location.hash = '#referrer=' +
           encodeURIComponent('https://acme.org/viewer');
-      windowApi.document.referrer = 'https://google.com/';
-      expect(new Viewer(windowApi).getReferrerUrl())
-          .to.equal('https://acme.org/viewer');
+      windowApi.document.referrer = 'https://acme.org/docref';
+      const viewer = new Viewer(windowApi);
+      expect(viewer.getUnconfirmedReferrerUrl())
+          .to.equal('https://acme.org/docref');
+      return viewer.getReferrerUrl().then(referrerUrl => {
+        expect(referrerUrl).to.equal('https://acme.org/docref');
+        expect(timeouts).to.have.length(0);
+      });
     });
 
-    it('should return document referrer if no viewer referrer', () => {
+    it('should NOT allow override if not trusted', () => {
       windowApi.parent = {};
-      windowApi.location.hash = '#';
+      windowApi.location.hash = '#referrer=' +
+          encodeURIComponent('https://acme.org/viewer');
       windowApi.document.referrer = 'https://acme.org/docref';
-      expect(new Viewer(windowApi).getReferrerUrl())
+      windowApi.location.ancestorOrigins = ['https://untrusted.com'];
+      const viewer = new Viewer(windowApi);
+      expect(viewer.getUnconfirmedReferrerUrl())
           .to.equal('https://acme.org/docref');
+      return viewer.getReferrerUrl().then(referrerUrl => {
+        expect(referrerUrl).to.equal('https://acme.org/docref');
+        expect(timeouts).to.have.length(0);
+      });
     });
 
-    it('should return document referrer if not embedded', () => {
-      windowApi.parent = windowApi;  // Top window.
-      windowApi.document.referrer = 'https://acme.org/docref';
+    it('should NOT allow override if ancestor is empty', () => {
+      windowApi.parent = {};
       windowApi.location.hash = '#referrer=' +
           encodeURIComponent('https://acme.org/viewer');
-      expect(new Viewer(windowApi).getReferrerUrl())
+      windowApi.document.referrer = 'https://acme.org/docref';
+      windowApi.location.ancestorOrigins = [];
+      const viewer = new Viewer(windowApi);
+      expect(viewer.getUnconfirmedReferrerUrl())
           .to.equal('https://acme.org/docref');
+      return viewer.getReferrerUrl().then(referrerUrl => {
+        expect(referrerUrl).to.equal('https://acme.org/docref');
+        expect(timeouts).to.have.length(0);
+      });
     });
 
-    it('should return doc referrer if not embedded by trusted viewer', () => {
+    it('should allow partial override if async not trusted', () => {
       windowApi.parent = {};
-      windowApi.document.referrer = 'https://acme.org/docref';
       windowApi.location.hash = '#referrer=' +
           encodeURIComponent('https://acme.org/viewer');
-      windowApi.location.ancestorOrigins = ['https://acme.org/viewer'];
-      expect(new Viewer(windowApi).getReferrerUrl())
-          .to.equal('https://acme.org/docref');
+      windowApi.document.referrer = 'https://acme.org/docref';
+      const viewer = new Viewer(windowApi);
+      // Unconfirmed referrer is overriden, but not confirmed yet.
+      expect(viewer.getUnconfirmedReferrerUrl())
+          .to.equal('https://acme.org/viewer');
+      viewer.setMessageDeliverer(() => {}, 'https://untrusted.com');
+      return viewer.getReferrerUrl().then(referrerUrl => {
+        expect(referrerUrl).to.equal('https://acme.org/docref');
+        // Unconfirmed referrer is reset. Async error is thrown.
+        expect(viewer.getUnconfirmedReferrerUrl())
+            .to.equal('https://acme.org/docref');
+        expect(timeouts).to.have.length(1);
+        expect(timeouts[0]).to.throw(/Untrusted viewer referrer override/);
+      });
     });
 
-    it('should return ancestor origin no viewer/doc referrer', () => {
+    it('should allow full override if async trusted', () => {
       windowApi.parent = {};
-      windowApi.location.hash = '#';
-      windowApi.location.ancestorOrigins = [
-        'https://acme.org/ancestor1',
-        'https://acme.org/ancestor2'
-      ];
-      expect(new Viewer(windowApi).getReferrerUrl())
-          .to.equal('https://acme.org/ancestor1');
+      windowApi.location.hash = '#referrer=' +
+          encodeURIComponent('https://acme.org/viewer');
+      windowApi.document.referrer = 'https://acme.org/docref';
+      const viewer = new Viewer(windowApi);
+      // Unconfirmed referrer is overriden and will be confirmed next.
+      expect(viewer.getUnconfirmedReferrerUrl())
+          .to.equal('https://acme.org/viewer');
+      viewer.setMessageDeliverer(() => {}, 'https://google.com');
+      return viewer.getReferrerUrl().then(referrerUrl => {
+        expect(referrerUrl).to.equal('https://acme.org/viewer');
+        // Unconfirmed is confirmed and kept.
+        expect(viewer.getUnconfirmedReferrerUrl())
+            .to.equal('https://acme.org/viewer');
+        expect(timeouts).to.have.length(0);
+      });
     });
 
-    it('should return empty string if nothing matches', () => {
+    it('should allow override if iframed and trusted', () => {
       windowApi.parent = {};
-      windowApi.location.hash = '#';
-      expect(new Viewer(windowApi).getReferrerUrl()).to.be.equal('');
+      windowApi.location.hash = '#referrer=' +
+          encodeURIComponent('https://acme.org/viewer');
+      windowApi.document.referrer = 'https://acme.org/docref';
+      windowApi.location.ancestorOrigins = ['https://google.com'];
+      const viewer = new Viewer(windowApi);
+      expect(viewer.getUnconfirmedReferrerUrl())
+          .to.equal('https://acme.org/viewer');
+      return viewer.getReferrerUrl().then(referrerUrl => {
+        expect(referrerUrl).to.equal('https://acme.org/viewer');
+        expect(timeouts).to.have.length(0);
+      });
     });
   });
 });

From f86f6ecb37637dbadc06c68843980f588b33fd6e Mon Sep 17 00:00:00 2001
From: Sebastien F <Sebastien F>
Date: Fri, 5 Feb 2016 16:45:31 +0100
Subject: [PATCH 35/44] Adding Smart AdServer support

---
 3p/integration.js     |  2 ++
 ads/_config.js        |  1 +
 ads/smartadserver.js  | 44 +++++++++++++++++++++++++++++++++++++++
 ads/smartadserver.md  | 48 +++++++++++++++++++++++++++++++++++++++++++
 builtins/amp-ad.md    |  1 +
 examples/ads.amp.html | 10 +++++++++
 6 files changed, 106 insertions(+)
 create mode 100644 ads/smartadserver.js
 create mode 100644 ads/smartadserver.md

diff --git a/3p/integration.js b/3p/integration.js
index 1e5cbdb8c67d..f08c00439308 100644
--- a/3p/integration.js
+++ b/3p/integration.js
@@ -39,6 +39,7 @@ import {register, run} from '../src/3p';
 import {parseUrl} from '../src/url';
 import {assert} from '../src/asserts';
 import {taboola} from '../ads/taboola';
+import {smartadserver} from '../ads/smartadserver';
 
 /**
  * Whether the embed type may be used with amp-embed tag.
@@ -62,6 +63,7 @@ register('_ping_', function(win, data) {
 });
 register('twitter', twitter);
 register('facebook', facebook);
+register('smartadserver', smartadserver);
 
 /**
  * Visible for testing.
diff --git a/ads/_config.js b/ads/_config.js
index 5b523064fe89..3a402f4d7eff 100644
--- a/ads/_config.js
+++ b/ads/_config.js
@@ -26,6 +26,7 @@ export const adPrefetch = {
   a9: 'https://c.amazon-adsystem.com/aax2/assoc.js',
   adsense: 'https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js',
   dotandads: 'https://amp.ad.dotandad.com/dotandadsAmp.js',
+  smartadserver: 'https://ec-ns.sascdn.com/diff/js/smart.js',
 };
 
 /**
diff --git a/ads/smartadserver.js b/ads/smartadserver.js
new file mode 100644
index 000000000000..a34eb9a939e0
--- /dev/null
+++ b/ads/smartadserver.js
@@ -0,0 +1,44 @@
+/**
+ * Copyright 2015 The AMP HTML Authors. All Rights Reserved.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS-IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import {loadScript} from '../src/3p';
+
+/**
+ * @param {!Window} global
+ * @param {!Object} data
+ */
+export function smartadserver(global, data) {
+  loadScript(global, 'https://ec-ns.sascdn.com/diff/js/smart.js', () => {
+    if (!global.document.getElementById(data.tag)) {
+      const divElt = global.document.createElement('div');
+      divElt.Id = data.tag;
+      const cElt = global.document.getElementById('c');
+      cElt.appendChild(divElt);
+    }
+    global.sas.cmd.push(function() {
+      global.sas.setup({'domain': data.domain, 'async': true});
+    });
+    global.sas.cmd.push(function() {
+      global.sas.call(data.call, {
+        'siteId': data.site,
+        'pageId': data.page,
+        'formatId': data.format,
+        'target': data.target,
+        'tagId': data.tag
+      });
+    });
+  });
+}
diff --git a/ads/smartadserver.md b/ads/smartadserver.md
new file mode 100644
index 000000000000..84dbc1adb376
--- /dev/null
+++ b/ads/smartadserver.md
@@ -0,0 +1,48 @@
+<!---
+Copyright 2015 The AMP HTML Authors. All Rights Reserved.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS-IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+-->
+
+# SmartAdServer
+
+## Example
+
+### Basic call
+
+```html
+  <amp-ad width=320 height=50
+      type="smartadserver"
+      data-call="std"
+      data-site="94612"
+      data-page="629154"
+      data-format="38952">
+  </amp-ad>
+```
+
+### With targeting
+
+```html
+  <amp-ad width=320 height=50
+      type="smartadserver"
+      data-call="std"
+      data-site="94612"
+      data-page="629154"
+      data-format="38952"
+      data-target="foo=bar">
+  </amp-ad>
+```
+
+## Configuration
+
+For semantics of configuration, please see [Smart AdServer help center](http://help.smartadserver.com/).
\ No newline at end of file
diff --git a/builtins/amp-ad.md b/builtins/amp-ad.md
index f60f7cd77236..f6e143294c1a 100644
--- a/builtins/amp-ad.md
+++ b/builtins/amp-ad.md
@@ -49,6 +49,7 @@ resources in AMP. It requires a `type` argument that select what ad network is d
 - [Dot and Media](../ads/dotandads.md)
 - [Doubleclick](../ads/doubleclick.md)
 - [plista](../ads/plista.md)
+- [Smart AdServer](../ads/smartadserver.md)
 
 #### Styling
 
diff --git a/examples/ads.amp.html b/examples/ads.amp.html
index ee046886d9d3..4d4ed7d982de 100644
--- a/examples/ads.amp.html
+++ b/examples/ads.amp.html
@@ -160,5 +160,15 @@ <h2>DotAndAds 300x250 box</h2>
       data-mpo="ampTest" 
       data-mpt="amp-amp-all-all">
   </amp-ad>
+  
+  <h2>SmartAdServer ad</h2>
+  <amp-ad width=320 height=50
+      type="smartadserver"
+      data-call="std"
+      data-site="94612"
+      data-page="629154"
+      data-format="38952"
+      data-target="foo=bar">
+  </amp-ad>
 </body>
 </html>

From fe5f740565b77fcfc725a0fb7b4a2965cbc2a5c6 Mon Sep 17 00:00:00 2001
From: Malte Ubl <malte.ubl@gmail.com>
Date: Thu, 4 Feb 2016 20:12:21 -0800
Subject: [PATCH 36/44] Enable retrieving amp-analytics remote config with
 credentials.

Also starts mandating AMP CORS protocol for credentialed requests to amp-list.
Verified that the guardian is currently not including credentials in their requests.
---
 extensions/amp-analytics/0.1/amp-analytics.js | 21 ++++++++++-----
 .../0.1/test/test-amp-analytics.js            | 27 ++++++++++++++++++-
 extensions/amp-analytics/amp-analytics.md     |  5 ++--
 extensions/amp-list/0.1/amp-list.js           |  3 +++
 extensions/amp-list/0.1/test/test-amp-list.js |  5 +++-
 extensions/amp-list/amp-list.md               |  2 +-
 6 files changed, 51 insertions(+), 12 deletions(-)

diff --git a/extensions/amp-analytics/0.1/amp-analytics.js b/extensions/amp-analytics/0.1/amp-analytics.js
index c1a7616efdbf..745bb248e3f0 100644
--- a/extensions/amp-analytics/0.1/amp-analytics.js
+++ b/extensions/amp-analytics/0.1/amp-analytics.js
@@ -151,13 +151,20 @@ export class AmpAnalytics extends AMP.BaseElement {
     }
     assertHttpsUrl(remoteConfigUrl);
     log.fine(this.getName_(), 'Fetching remote config', remoteConfigUrl);
-    return xhrFor(this.getWin()).fetchJson(remoteConfigUrl).then(jsonValue => {
-      this.remoteConfig_ = jsonValue;
-      log.fine(this.getName_(), 'Remote config loaded', remoteConfigUrl);
-    }, err => {
-      console./*OK*/error(this.getName_(), 'Error loading remote config: ',
-          remoteConfigUrl, err);
-    });
+    const fetchConfig = {
+      requireAmpResponseSourceOrigin: true,
+    };
+    if (this.element.hasAttribute('data-credentials')) {
+      fetchConfig.credentials = this.element.getAttribute('data-credentials');
+    }
+    return xhrFor(this.getWin()).fetchJson(remoteConfigUrl, fetchConfig)
+        .then(jsonValue => {
+          this.remoteConfig_ = jsonValue;
+          log.fine(this.getName_(), 'Remote config loaded', remoteConfigUrl);
+        }, err => {
+          console./*OK*/error(this.getName_(), 'Error loading remote config: ',
+              remoteConfigUrl, err);
+        });
   }
 
   /**
diff --git a/extensions/amp-analytics/0.1/test/test-amp-analytics.js b/extensions/amp-analytics/0.1/test/test-amp-analytics.js
index e5653938e466..9cf18b23fc47 100644
--- a/extensions/amp-analytics/0.1/test/test-amp-analytics.js
+++ b/extensions/amp-analytics/0.1/test/test-amp-analytics.js
@@ -32,6 +32,7 @@ describe('amp-analytics', function() {
   let sandbox;
   let windowApi;
   let sendRequestSpy;
+  let configWithCredentials;
 
   const jsonMockResponses = {
     'config1': '{"vars": {"title": "remote"}}'
@@ -48,6 +49,7 @@ describe('amp-analytics', function() {
       title: 'Test Title',
       referrer: 'https://www.google.com/'
     };
+    configWithCredentials = false;
     windowApi.Object = window.Object;
     markElementScheduledForTesting(windowApi, 'amp-analytics');
     markElementScheduledForTesting(windowApi, 'amp-user-notification');
@@ -55,7 +57,15 @@ describe('amp-analytics', function() {
     installCidService(windowApi);
     installUserNotificationManager(windowApi);
     getService(windowApi, 'xhr', () => {return {
-      fetchJson: url => Promise.resolve(JSON.parse(jsonMockResponses[url]))
+      fetchJson: (url, init) => {
+        expect(init.requireAmpResponseSourceOrigin).to.be.true;
+        if (configWithCredentials) {
+          expect(init.credentials).to.equal('include');
+        } else {
+          expect(init.credentials).to.undefined;
+        }
+        return Promise.resolve(JSON.parse(jsonMockResponses[url]));
+      }
     };});
   });
 
@@ -501,6 +511,21 @@ describe('amp-analytics', function() {
     });
   });
 
+  it('fetches and merges remote config with credentials', () => {
+    configWithCredentials = true;
+    const analytics = getAnalyticsTag({
+      'vars': {'title': 'local'},
+      'requests': {'foo': 'https://example.com/${title}'},
+      'triggers': [{'on': 'visible', 'request': 'foo'}]
+    }, {
+      'config': 'config1',
+      'data-credentials': 'include',
+    });
+    return waitForSendRequest(analytics).then(() => {
+      expect(sendRequestSpy.args[0][0]).to.equal('https://example.com/remote');
+    });
+  });
+
   it('updates requestCount on each request', () => {
     const analytics = getAnalyticsTag({
       'host': 'example.com',
diff --git a/extensions/amp-analytics/amp-analytics.md b/extensions/amp-analytics/amp-analytics.md
index 56a47e8daf71..0b1e295c5d10 100644
--- a/extensions/amp-analytics/amp-analytics.md
+++ b/extensions/amp-analytics/amp-analytics.md
@@ -68,12 +68,13 @@ when the document is first loaded, and each time an `<a>` tag is clicked:
     <amp-analytics type="XYZ"> ... </amp-analytics>
     ```
 
-  - `config` This attribute can be used to load a configuration from a specified remote URL. The URL specified here should use https scheme.
+  - `config` This attribute can be used to load a configuration from a specified remote URL. The URL specified here should use https scheme. See also `data-include-credentials` attribute below.
 
     ```
     <amp-analytics config="https://example.com/analytics.config.json"></amp-analytics>
     ```
-
+    The response must follow the [AMP CORS security guidelines](../../spec/amp-cors-requests.md).
+  - `data-credentials` Optional. If set to `include` turns on the ability to read and write cookies on the request specified via `config` above.
   - `data-consent-notification-id` Optional attribute. If provided will stop
     processing the analytics request until a [amp-user-notification](../../extensions/amp-user-notification/amp-user-notification.md) with
     the given HTML-id was confirmed by the user.
diff --git a/extensions/amp-list/0.1/amp-list.js b/extensions/amp-list/0.1/amp-list.js
index dd3a127c7143..a3609a36c86e 100644
--- a/extensions/amp-list/0.1/amp-list.js
+++ b/extensions/amp-list/0.1/amp-list.js
@@ -57,6 +57,9 @@ export class AmpList extends AMP.BaseElement {
           const opts = {
             credentials: this.element.getAttribute('credentials')
           };
+          if (opts.credentials) {
+            opts.requireAmpResponseSourceOrigin = true;
+          }
           return xhrFor(this.getWin()).fetchJson(src, opts);
         }).then(data => {
           assert(typeof data == 'object' && Array.isArray(data['items']),
diff --git a/extensions/amp-list/0.1/test/test-amp-list.js b/extensions/amp-list/0.1/test/test-amp-list.js
index 64b0faa7da34..a8920433dc01 100644
--- a/extensions/amp-list/0.1/test/test-amp-list.js
+++ b/extensions/amp-list/0.1/test/test-amp-list.js
@@ -143,7 +143,10 @@ describe('amp-list component', () => {
     const xhrPromise = Promise.resolve({items: items});
     element.setAttribute('credentials', 'include');
     xhrMock.expects('fetchJson').withExactArgs('https://data.com/list.json',
-        sinon.match(opts => opts.credentials == 'include'))
+        sinon.match(opts => {
+          return opts.credentials == 'include' &&
+              opts.requireAmpResponseSourceOrigin;
+        }))
         .returns(xhrPromise).once();
     templatesMock.expects('findAndRenderTemplateArray').withExactArgs(
         element, items)
diff --git a/extensions/amp-list/amp-list.md b/extensions/amp-list/amp-list.md
index bb16b6aaed08..4f7e6dd4f54f 100644
--- a/extensions/amp-list/amp-list.md
+++ b/extensions/amp-list/amp-list.md
@@ -26,7 +26,7 @@ The `amp-list` defines data source using the following attributes:
 - `src` defines a CORS URL. The URL's protocol must be HTTPS.
 - `credentials` defines a `credentials` option as specified by the
 [Fetch API](https://fetch.spec.whatwg.org/). To send credentials, pass the
-value of "include".
+value of "include". If this is set, the response must follow the [AMP CORS security guidelines](../../spec/amp-cors-requests.md).
 
 The response must be a JSON object that contains an array property "items":
 ```json

From 9ee7c9940b3ad9a07eccf13af47fd18cbd00415a Mon Sep 17 00:00:00 2001
From: Malte Ubl <cramforce@users.noreply.github.com>
Date: Fri, 5 Feb 2016 10:59:57 -0800
Subject: [PATCH 37/44] Clarify display:none behavior

---
 ads/README.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/ads/README.md b/ads/README.md
index 7d9d03c09f9e..7e0d36060373 100644
--- a/ads/README.md
+++ b/ads/README.md
@@ -18,6 +18,7 @@ Reasons include:
   - Allows browsers to run the ad in a different process from the primary page (even better security and prevents JS inside the ad to block the main page UI thread).
   - Prevents ads doing less than optimal things to measure user behavior and other interference with the primary page.
 - The AMP runtime may at any moment decide that there are too many iframes on a page and that memory is low. In that case it would unload ads that were previously loaded and are no longer visible. It may later load new ads in the same slot if the user scrolls them back into view.
+- The AMP runtime may decide to set an ad that is currently not visible to `display: none` to reduce browser layout and compositing cost.
 
 
 ## The iframe sandbox

From 896a4d69ed66f1eb5d756ecb1d1888e53422f706 Mon Sep 17 00:00:00 2001
From: Malte Ubl <malte.ubl@gmail.com>
Date: Fri, 5 Feb 2016 10:51:49 -0800
Subject: [PATCH 38/44] Make sure we re-show visible ads as fast as possible.

Normal layout can be a bit delayed.
---
 builtins/amp-ad.js             | 21 +++++++++++++++------
 test/functional/test-amp-ad.js |  7 +++++++
 2 files changed, 22 insertions(+), 6 deletions(-)

diff --git a/builtins/amp-ad.js b/builtins/amp-ad.js
index 40f494d7bc9e..fd7f56098e52 100644
--- a/builtins/amp-ad.js
+++ b/builtins/amp-ad.js
@@ -210,14 +210,9 @@ export function installAd(win) {
       return false;
     }
 
-
     /** @override */
     layoutCallback() {
-      if (this.paused_) {
-        this.paused_ = false;
-        toggle(this.iframe_, true);
-        return Promise.resolve(this.iframe_);
-      }
+      this.maybeUnpause_();
       if (!this.iframe_) {
         loadingAdsCount++;
         assert(!this.isInFixedContainer_,
@@ -315,12 +310,26 @@ export function installAd(win) {
 
     /** @override  */
     viewportCallback(inViewport) {
+      if (inViewport) {
+        this.maybeUnpause_();
+      }
       if (this.intersectionObserver_) {
         this.intersectionObserver_.onViewportCallback(inViewport);
       }
       this.sendEmbedInfo_(inViewport);
     }
 
+    /**
+     * Unpauses the ad if it is paused.
+     * @private
+     */
+    maybeUnpause_() {
+      if (this.paused_) {
+        this.paused_ = false;
+        toggle(this.iframe_, true);
+      }
+    }
+
     /**
      * @param {boolean} inViewport
      * @private
diff --git a/test/functional/test-amp-ad.js b/test/functional/test-amp-ad.js
index a6a24831f07a..75a6e3d9faca 100644
--- a/test/functional/test-amp-ad.js
+++ b/test/functional/test-amp-ad.js
@@ -200,6 +200,13 @@ function runAdTestSuiteAgainstInstaller(name, installer) {
           obj.layoutCallback();
           expect(iframe.style.display).to.equal('');
           expect(obj.paused_).to.be.false;
+
+          // Pause again
+          const ret2 = obj.documentInactiveCallback();
+          expect(ret2).to.be.true;
+          obj.viewportCallback(false);
+          expect(iframe.style.display).to.equal('none');
+          obj.viewportCallback(true);
         });
       });
 

From b76442426a7ac0fdb6ff74c230a5c16cf9e10470 Mon Sep 17 00:00:00 2001
From: Malte Ubl <malte.ubl@gmail.com>
Date: Fri, 5 Feb 2016 12:05:12 -0800
Subject: [PATCH 39/44] Running the tests broke local demos.

---
 build-system/internal-version.js | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/build-system/internal-version.js b/build-system/internal-version.js
index 22a2059910c0..aec67156cda1 100644
--- a/build-system/internal-version.js
+++ b/build-system/internal-version.js
@@ -30,9 +30,12 @@ exports.TOKEN = getToken();
 
 function getToken() {
   var task = process.argv[2];
-  if (!task || task == 'build') {
+  // For tests build parent and child frame can get out of sync because
+  // we do not version lock them. To fix this we use a fixed token.
+  if (!task || task == 'build' || task == 'test') {
     return 'development--token';
   }
+  // For every other build, most importantly `dist` we assume production.
   return crypto.createHmac(
       'sha256', crypto.randomBytes(16)).update(exports.VERSION)
       .digest('hex');

From a40889cd48350c0683a936c2f2ad8fefbecfc063 Mon Sep 17 00:00:00 2001
From: Erwin Mombay <erwinm@google.com>
Date: Fri, 5 Feb 2016 05:29:32 -0800
Subject: [PATCH 40/44] remove canary suffix from dist

---
 build-system/internal-version.js |  4 +---
 build-system/tasks/changelog.js  | 10 ++++------
 build-system/tasks/compile.js    |  4 +++-
 build-system/window-config.js    |  8 ++++++++
 gulpfile.js                      |  7 +++++--
 src/experiments.js               |  7 ++++---
 6 files changed, 25 insertions(+), 15 deletions(-)
 create mode 100644 build-system/window-config.js

diff --git a/build-system/internal-version.js b/build-system/internal-version.js
index 22a2059910c0..0d8805aec35d 100644
--- a/build-system/internal-version.js
+++ b/build-system/internal-version.js
@@ -14,13 +14,11 @@
  * limitations under the License.
  */
 
-var argv = require('minimist')(process.argv.slice(2));
 var crypto = require('crypto');
-var suffix = argv.type == 'canary' ? '-canary' : '';
 
 // Used to e.g. references the ads binary from the runtime to get
 // version lock.
-exports.VERSION = new Date().getTime() + suffix;
+exports.VERSION = String(new Date().getTime());
 
 // A token that changes its value each time we release AMP. This is intended
 // to verify that two iframes of AMP have the same version of AMP. It is
diff --git a/build-system/tasks/changelog.js b/build-system/tasks/changelog.js
index ff769d43d938..77be094a47ee 100644
--- a/build-system/tasks/changelog.js
+++ b/build-system/tasks/changelog.js
@@ -37,7 +37,6 @@ var exec = BBPromise.promisify(child_process.exec);
 var gitExec = BBPromise.promisify(git.exec);
 
 var isCanary = argv.type == 'canary';
-var suffix =  isCanary ? '-canary' : '';
 var branch = isCanary ? 'canary' : 'release';
 var isDryrun = argv.dryrun;
 
@@ -45,12 +44,12 @@ var isDryrun = argv.dryrun;
 function changelog() {
   if (!GITHUB_ACCESS_TOKEN) {
     util.log(util.colors.red('Warning! You have not set the ' +
-        'GITHUB_ACCESS_TOKEN env var. This task might hit the default ' +
-        'rate limit set by github (60).'));
+        'GITHUB_ACCESS_TOKEN env var. Aborting "changelog" task.'));
     util.log(util.colors.green('See https://help.github.com/articles/' +
         'creating-an-access-token-for-command-line-use/ ' +
         'for instructions on how to create a github access token. We only ' +
         'need `public_repo` scope.'));
+    return;
   }
 
   return getGitMetadata();
@@ -140,9 +139,8 @@ function getLastGitTag() {
     args: 'describe --abbrev=0 --tags'
   };
   var canaryGrep = isCanary ? 'grep canary$' : 'grep -v canary$';
-  return exec('git tag | ' + canaryGrep + ' | ' +
-      'xargs -I@ git log --format=format:"%ai @%n" -1 @ | ' +
-      'sort -r | awk \'{print $4}\' | head -1').then(function(tag) {
+  return exec(`git describe --abbrev=0 --tags ${branch}`)
+      .then(function(tag) {
         return tag.replace('\n', '');
       });
 }
diff --git a/build-system/tasks/compile.js b/build-system/tasks/compile.js
index 03ad7d7c6782..fb93614b470a 100644
--- a/build-system/tasks/compile.js
+++ b/build-system/tasks/compile.js
@@ -15,6 +15,7 @@
  */
 
 var fs = require('fs-extra');
+var windowConfig = require('../window-config');
 var closureCompiler = require('gulp-closure-compiler');
 var gulp = require('gulp');
 var rename = require('gulp-rename');
@@ -74,7 +75,8 @@ function compile(entryModuleFilename, outputDir,
     fs.writeFileSync(
         'build/fake-module/src/polyfills.js',
         '// Not needed in closure compiler\n');
-    var wrapper = '(function(){var process={env:{NODE_ENV:"production"}};' +
+    var wrapper = windowConfig.getTemplate() +
+        '(function(){var process={env:{NODE_ENV:"production"}};' +
         '%output%})();';
     if (options.wrapper) {
       wrapper = options.wrapper.replace('<%= contents %>',
diff --git a/build-system/window-config.js b/build-system/window-config.js
new file mode 100644
index 000000000000..0b4315775381
--- /dev/null
+++ b/build-system/window-config.js
@@ -0,0 +1,8 @@
+var minimist = require('minimist');
+
+var argv = minimist(process.argv.slice(2));
+var isCanary = argv.type === 'canary';
+
+exports.getTemplate = function() {
+  return `window.AMP_CONFIG={canary:${isCanary}};/*AMP_CONFIG*/`;
+};
diff --git a/gulpfile.js b/gulpfile.js
index c39c39e263d6..1eaebd90e1ca 100644
--- a/gulpfile.js
+++ b/gulpfile.js
@@ -37,6 +37,7 @@ var touch = require('touch')
 var uglify = require('gulp-uglify');
 var util = require('gulp-util');
 var watchify = require('watchify');
+var windowConfig = require('./build-system/window-config');
 var wrap = require('gulp-wrap');
 var internalRuntimeVersion = require('./build-system/internal-version').VERSION;
 var internalRuntimeToken = require('./build-system/internal-version').TOKEN;
@@ -130,7 +131,8 @@ function compile(watch, shouldMinify) {
     minify: shouldMinify,
     // If there is a sync JS error during initial load,
     // at least try to unhide the body.
-    wrapper: 'try{(function(){<%= contents %>})()}catch(e){' +
+    wrapper: windowConfig.getTemplate() +
+        'try{(function(){<%= contents %>})()}catch(e){' +
         'setTimeout(function(){' +
         'var s=document.body.style;' +
         's.opacity=1;' +
@@ -268,7 +270,8 @@ function buildExtensionJs(js, path, name, version, options) {
           minify: options.minify,
           minifiedName: minifiedName,
           latestName: latestName,
-          wrapper: '(window.AMP = window.AMP || [])' +
+          wrapper: windowConfig.getTemplate() +
+              '(window.AMP = window.AMP || [])' +
               '.push(function(AMP) {<%= contents %>\n});',
         });
       });
diff --git a/src/experiments.js b/src/experiments.js
index 2b20b0157805..5d8a52b78d1c 100644
--- a/src/experiments.js
+++ b/src/experiments.js
@@ -47,7 +47,7 @@ export function isDevChannel(win) {
   if (isExperimentOn(win, CANARY_EXPERIMENT_ID)) {
     return true;
   }
-  if (isDevChannelVersionDoNotUse_('$internalRuntimeVersion$')) {
+  if (isDevChannelVersionDoNotUse_(win)) {
     return true;
   }
   return false;
@@ -56,12 +56,13 @@ export function isDevChannel(win) {
 
 /**
  * Whether the version corresponds to the dev-channel binary.
+ * @param {!Window} win
  * @param {string} version
  * @return {boolean}
  * @private Visible for testing only!
  */
-export function isDevChannelVersionDoNotUse_(version) {
-  return !!version.match(/\-canary$/);
+export function isDevChannelVersionDoNotUse_(win, version) {
+  return !!win.AMP_CONFIG && win.AMP_CONFIG.canary;
 }
 
 

From e4705da3942b04db1fb247cfa92a17d1462edadd Mon Sep 17 00:00:00 2001
From: Erwin Mombay <erwinm@google.com>
Date: Fri, 5 Feb 2016 13:43:34 -0800
Subject: [PATCH 41/44] add copyright

---
 build-system/window-config.js       | 16 ++++++++++++++++
 src/experiments.js                  |  2 +-
 test/functional/test-experiments.js | 10 ++++++++--
 3 files changed, 25 insertions(+), 3 deletions(-)

diff --git a/build-system/window-config.js b/build-system/window-config.js
index 0b4315775381..2f6ecab17393 100644
--- a/build-system/window-config.js
+++ b/build-system/window-config.js
@@ -1,3 +1,19 @@
+/**
+ * Copyright 2016 The AMP HTML Authors. All Rights Reserved.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS-IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
 var minimist = require('minimist');
 
 var argv = minimist(process.argv.slice(2));
diff --git a/src/experiments.js b/src/experiments.js
index 5d8a52b78d1c..6ee0e8a2d811 100644
--- a/src/experiments.js
+++ b/src/experiments.js
@@ -61,7 +61,7 @@ export function isDevChannel(win) {
  * @return {boolean}
  * @private Visible for testing only!
  */
-export function isDevChannelVersionDoNotUse_(win, version) {
+export function isDevChannelVersionDoNotUse_(win) {
   return !!win.AMP_CONFIG && win.AMP_CONFIG.canary;
 }
 
diff --git a/test/functional/test-experiments.js b/test/functional/test-experiments.js
index f5bc8475b61c..bc8b0b329807 100644
--- a/test/functional/test-experiments.js
+++ b/test/functional/test-experiments.js
@@ -128,7 +128,13 @@ describe('isDevChannel', () => {
   });
 
   it('should return value based on binary version', () => {
-    expect(isDevChannelVersionDoNotUse_('123456789')).to.be.false;
-    expect(isDevChannelVersionDoNotUse_('123456789-canary')).to.be.true;
+    const win = {
+      AMP_CONFIG: {
+        canary: false
+      }
+    };
+    expect(isDevChannelVersionDoNotUse_(win)).to.be.false;
+    win.AMP_CONFIG.canary = true;
+    expect(isDevChannelVersionDoNotUse_(win)).to.be.true;
   });
 });

From 216c7ad1c64745ce547b768fbb411f5acc9d2af4 Mon Sep 17 00:00:00 2001
From: Avi Mehta <avimehta@google.com>
Date: Thu, 28 Jan 2016 10:01:02 -0800
Subject: [PATCH 42/44] Added scroll trigger.

Fixes #1490

-- Commit 2:
Rename properties with "-" to be camelCased instead.

Disabled a cid test that fails because of change in the way window
object is created.

This helps with consistency.
---
 examples/analytics.amp.html                   |  73 +++++++-
 extensions/amp-analytics/0.1/amp-analytics.js |   5 +-
 .../amp-analytics/0.1/instrumentation.js      | 172 ++++++++++++++---
 .../0.1/test/test-amp-analytics.js            |  73 ++++----
 .../0.1/test/test-instrumentation.js          | 177 +++++++++++++++---
 extensions/amp-analytics/0.1/vendors.js       |   4 +-
 extensions/amp-analytics/amp-analytics.md     |  22 ++-
 extensions/amp-analytics/analytics-vars.md    |  12 +-
 spec/amp-var-substitutions.md                 |   4 +-
 src/service/viewport-impl.js                  |   4 +
 src/url-replacements.js                       |   6 +
 11 files changed, 436 insertions(+), 116 deletions(-)

diff --git a/examples/analytics.amp.html b/examples/analytics.amp.html
index 15bd5f73bb61..656e7f25d289 100644
--- a/examples/analytics.amp.html
+++ b/examples/analytics.amp.html
@@ -24,8 +24,9 @@
 {
   "transport": {"beacon": false, "xhrpost": false},
   "requests": {
-    "base": "https://example.com/?domain=${canonicalHost}&path=${canonicalPath}&title=${title}",
-    "event": "${base}&name=${eventName}&type=${eventId}&time=${timestamp}&tz=${timezone}&pid=${pageViewId}&screenSize=${screenWidth}x${screenHeight}"
+    "base": "https://example.com/?domain=${canonicalHost}&path=${canonicalPath}&title=${title}&time=${timestamp}&tz=${timezone}&pid=${pageViewId}&_=${random}",
+    "pageview": "${base}&name=${eventName}&type=${eventId}&screenSize=${screenWidth}x${screenHeight}",
+    "event": "${base}&name=${eventName}&scrollY=${scrollTop}&scrollX=${scrollLeft}&height=${availableScreenHeight}&width=${availableScreenWidth}"
   },
   "vars": {
     "title": "Example Request"
@@ -33,11 +34,22 @@
   "triggers": {
     "defaultPageview": {
       "on": "visible",
-      "request": "event",
+      "request": "pageview",
       "vars": {
         "eventName": "page-loaded",
         "eventId": "42"
       }
+    },
+    "scrollPings": {
+      "on": "scroll",
+      "request": "event",
+      "scrollSpec": {
+        "verticalBoundaries" : [1, 50, 90],
+        "horizontalBoundaries": [100]
+      },
+      "vars": {
+        "eventName": "scroll"
+      }
     }
   }
 }
@@ -122,7 +134,7 @@
   "triggers": {
     "timer": {
       "on": "timer",
-      "timer-spec": {
+      "timerSpec": {
         "interval": 5,
         "max-timer-length": 300
       },
@@ -151,7 +163,58 @@ <h1 id="top">AMP Analytics</h1>
 <span id="test1" class="box">
   Click here to generate an event
 </span>
-
+<p>
+Lorem ipsum dolor sit amet, consectetur adipiscing elit. Nam pellentesque augue quis elementum tempus. Pellentesque sit amet neque bibendum, sagittis purus vitae, pellentesque magna. Vestibulum non viverra metus, eget feugiat lacus. Nulla in maximus orci. Maecenas id turpis vel ipsum vestibulum bibendum ut sit amet magna. Nullam hendrerit ex at est eleifend, nec dignissim nibh rutrum. Aliquam quis tellus et nibh faucibus laoreet in eget turpis. Nam quam nisl, porttitor vel ex eget, dapibus placerat dui. Mauris commodo pellentesque leo, eu tempus quam. In hac habitasse platea dictumst. Suspendisse non ante finibus, luctus augue non, luctus orci. Vestibulum ornare lacinia aliquam. In sollicitudin vehicula vulputate. Sed mi elit, commodo nec sapien nec, pretium bibendum leo. Donec id justo tortor. Ut in mauris dapibus, laoreet metus vitae, dictum nisi.
+</p>
+<p>
+Integer dapibus egestas arcu. Nunc vitae velit congue, placerat augue quis, suscipit nisi. Donec suscipit imperdiet turpis pharetra feugiat. Pellentesque habitant morbi tristique senectus et netus et malesuada fames ac turpis egestas. Phasellus aliquam eleifend dolor, at lacinia orci semper vel. Nunc semper sem vel tincidunt posuere. Nunc lobortis velit vitae condimentum mollis. Morbi eu ullamcorper mauris. Pellentesque ac eros maximus, pulvinar sapien vitae, semper nisi. Curabitur imperdiet non mauris vitae sollicitudin.
+</p>
+<p>
+Nam posuere velit euismod risus pulvinar, in sollicitudin sapien consectetur. Vestibulum nec ex odio. Quisque at elit nec nunc ultricies lacinia nec non lorem. Maecenas porttitor consequat mauris, vitae porttitor ligula pellentesque ut. Pellentesque rhoncus diam vel lacus lobortis imperdiet. Sed maximus dictum hendrerit. Vivamus ornare, purus in laoreet sagittis, est ante pretium mauris, vel vulputate arcu erat eget mauris. Suspendisse eu lorem metus. Aliquam tempus aliquet urna, vitae mollis lacus pretium vitae. Etiam semper gravida commodo. Maecenas at pulvinar quam. Nullam dolor ipsum, ornare a sollicitudin et, sodales porttitor neque.
+</p>
+<p>
+Integer in felis at lacus mattis facilisis. Curabitur tincidunt, felis porttitor mollis finibus, tortor elit elementum dolor, vel vulputate lorem dui id ante. Vivamus in velit at lectus blandit gravida vitae quis arcu. Nam et magna magna. Fusce condimentum diam lacus, ac ullamcorper purus malesuada eu. Mauris ullamcorper elit et venenatis faucibus. Nullam lobortis molestie purus quis pellentesque. Sed at libero id nisi rhoncus tincidunt. Praesent vestibulum vehicula tristique. Etiam rutrum, nunc id porta interdum, nulla nisi molestie leo, at fermentum justo dolor at lorem. Duis in egestas sapien.
+</p>
+<p>
+Donec pharetra molestie sollicitudin. Duis mattis eleifend rutrum. Quisque luctus tincidunt lacus, vitae lobortis nisi malesuada ac. Aliquam mattis leo vel elit rutrum, nec consequat massa vestibulum. Maecenas bibendum metus nec ante feugiat, eu faucibus orci mattis. Cras tristique sem non elit congue malesuada. Proin ornare, lacus et porttitor consequat, sapien urna rutrum diam, ac pellentesque ligula est eget nisi. Interdum et malesuada fames ac ante ipsum primis in faucibus. Donec ultrices sollicitudin eros a placerat. Proin eget pulvinar est. Donec posuere ultrices odio at ultrices. Suspendisse potenti. Phasellus id orci id purus porttitor consectetur a at erat. Nullam volutpat ultricies nisl id maximus. Morbi porta ex ante, et egestas odio ultricies consequat.
+</p>
+<p>
+</p><ul>
+<li>Lorem ipsum dolor sit amet, consectetur adipiscing elit.</li>
+<li>Aliquam in ex porta, imperdiet elit sit amet, condimentum diam.</li>
+<li>Etiam fermentum nisi at porta pulvinar.</li>
+</ul>
+<p></p>
+<p>
+</p><ul>
+<li>Proin mattis neque vel elit posuere molestie.</li>
+<li>Integer tincidunt sem sed nunc auctor elementum.</li>
+<li>Integer a felis in ipsum aliquet auctor sit amet a neque.</li>
+</ul>
+<p></p>
+<p>
+</p><ul>
+<li>Sed suscipit dolor molestie, rhoncus quam ac, lacinia ex.</li>
+<li>Curabitur et tellus vel justo ultrices aliquet sed id turpis.</li>
+<li>Nam finibus risus at justo elementum bibendum.</li>
+<li>In non lacus non urna congue feugiat at vel diam.</li>
+</ul>
+<p></p>
+<p>
+</p><ul>
+<li>Integer hendrerit augue interdum dui venenatis, sit amet tristique mauris cursus.</li>
+<li>Etiam quis eros viverra, tincidunt justo in, facilisis nunc.</li>
+<li>Aliquam at lacus faucibus, congue lorem interdum, semper mauris.</li>
+<li>Ut vulputate erat vel feugiat pharetra.</li>
+<li>Morbi id augue id orci sagittis tempus.</li>
+<li>Vestibulum varius libero ac dignissim sodales.</li>
+</ul>
+<p></p>
+<p>
+</p><ul>
+<li>Aenean ac sem eget libero varius viverra sit amet vitae nunc.</li>
+</ul>
+<p></p>
 </body>
 </html>
 
diff --git a/extensions/amp-analytics/0.1/amp-analytics.js b/extensions/amp-analytics/0.1/amp-analytics.js
index 745bb248e3f0..66bf1cb100ba 100644
--- a/extensions/amp-analytics/0.1/amp-analytics.js
+++ b/extensions/amp-analytics/0.1/amp-analytics.js
@@ -131,9 +131,8 @@ export class AmpAnalytics extends AMP.BaseElement {
               'attributes are required for data to be collected.');
           continue;
         }
-        addListener(this.getWin(), trigger['on'],
-            this.handleEvent_.bind(this, trigger), trigger['selector'],
-            trigger['timer-spec']);
+        addListener(this.getWin(), trigger,
+            this.handleEvent_.bind(this, trigger));
       }
     }
   }
diff --git a/extensions/amp-analytics/0.1/instrumentation.js b/extensions/amp-analytics/0.1/instrumentation.js
index 9dc0237b4eb0..f3285c5c1f09 100644
--- a/extensions/amp-analytics/0.1/instrumentation.js
+++ b/extensions/amp-analytics/0.1/instrumentation.js
@@ -16,11 +16,17 @@
 
 import {getService} from '../../../src/service';
 import {viewerFor} from '../../../src/viewer';
+import {viewportFor} from '../../../src/viewport';
 import {Observable} from '../../../src/observable';
 
 const MIN_TIMER_INTERVAL_SECONDS_ = 0.5;
 const DEFAULT_MAX_TIMER_LENGTH_SECONDS_ = 7200;
 
+/**
+ * @private {number}
+ */
+const SCROLL_PRECISION_PERCENT = 5;
+
 /**
  * This type signifies a callback that gets called when an analytics event that
  * the listener subscribed to fires.
@@ -30,18 +36,12 @@ let AnalyticsEventListenerDef;
 
 /**
  * @param {!Window} window Window object to listen on.
- * @param {!AnalyticsEventType} type Event type to listen to.
+ * @param {!JSONObject} config Configuration for instrumentation.
  * @param {!AnalyticsEventListenerDef} listener Callback to call when the event
  *          fires.
- * @param {string=} opt_selector If specified, the given listener
- *   should only be called if the event target matches this selector.
- * @param {JSONObject=} opt_timerSpec If specified, the specification on how
- *   the timer should fire.
  */
-export function addListener(window, type, listener, opt_selector,
-    opt_timerSpec) {
-  return instrumentationServiceFor(window).addListener(
-      type, listener, opt_selector, opt_timerSpec);
+export function addListener(window, config, listener) {
+  return instrumentationServiceFor(window).addListener(config, listener);
 }
 
 /**
@@ -52,7 +52,8 @@ export function addListener(window, type, listener, opt_selector,
 export const AnalyticsEventType = {
   VISIBLE: 'visible',
   CLICK: 'click',
-  TIMER: 'timer'
+  TIMER: 'timer',
+  SCROLL: 'scroll',
 };
 
 /**
@@ -84,6 +85,9 @@ class InstrumentationService {
     /** @const {!Viewer} */
     this.viewer_ = viewerFor(window);
 
+    /** @const {!Viewport} */
+    this.viewport_ = viewportFor(window);
+
     /** @private {boolean} */
     this.clickHandlerRegistered_ = false;
 
@@ -92,18 +96,21 @@ class InstrumentationService {
 
     /** @private {!Object<string, !Observable<!AnalyticsEvent>>} */
     this.observers_ = {};
+
+    /** @private {boolean} */
+    this.scrollHandlerRegistered_ = false;
+
+    /** @private {!Observable<Event>} */
+    this.scrollObservable_ = new Observable();
   }
 
   /**
-   * @param {!AnalyticsEventType} eventType The type of event
+   * @param {!JSONObject} config Configuration for instrumentation.
    * @param {!AnalyticsEventListenerDef} The callback to call when the event
    *   occurs.
-   * @param {string=} opt_selector If specified, the given listener
-   *   should only be called if the event target matches this selector.
-   * @param {JSONObject=} opt_timerSpec If specified, the specification on how
-   *   the timer should fire.
    */
-  addListener(eventType, listener, opt_selector, opt_timerSpec) {
+  addListener(config, listener) {
+    const eventType = config['on'];
     if (eventType === AnalyticsEventType.VISIBLE) {
       if (this.viewer_.isVisible()) {
         listener(new AnalyticsEvent(AnalyticsEventType.VISIBLE));
@@ -115,17 +122,34 @@ class InstrumentationService {
         });
       }
     } else if (eventType === AnalyticsEventType.CLICK) {
-      if (!opt_selector) {
+      if (!config['selector']) {
         console./*OK*/error(this.TAG_,
             'Missing required selector on click trigger');
-      } else {
-        this.ensureClickListener_();
-        this.clickObservable_.add(
-            this.createSelectiveListener_(listener, opt_selector));
+        return;
+      }
+
+      this.ensureClickListener_();
+      this.clickObservable_.add(
+          this.createSelectiveListener_(listener, config['selector']));
+    } else if (eventType === AnalyticsEventType.SCROLL) {
+      if (!config['scrollSpec']) {
+        console./*OK*/error(this.TAG_,
+            'Missing scrollSpec on scroll trigger.');
+        return;
       }
+      this.registerScrollTrigger_(config['scrollSpec'], listener);
+
+      // Trigger an event to fire events that might have already happened.
+      const size = this.viewport_.getSize();
+      this.onScroll_({
+        top: this.viewport_.getScrollTop(),
+        left: this.viewport_.getScrollLeft(),
+        width: size.width,
+        height: size.height
+      });
     } else if (eventType === AnalyticsEventType.TIMER) {
-      if (this.isTimerSpecValid_(opt_timerSpec)) {
-        this.createTimerListener_(listener, opt_timerSpec);
+      if (this.isTimerSpecValid_(config['timerSpec'])) {
+        this.createTimerListener_(listener, config['timerSpec']);
       }
     } else {
       let observers = this.observers_[eventType];
@@ -168,6 +192,14 @@ class InstrumentationService {
     this.clickObservable_.fire(e);
   }
 
+  /**
+   * @param {!ViewportChangedEventDef} e
+   * @private
+   */
+  onScroll_(e) {
+    this.scrollObservable_.fire(e);
+  }
+
   /**
    * @param {!Function} listener
    * @param {string} selector
@@ -181,6 +213,90 @@ class InstrumentationService {
     };
   }
 
+  /**
+   * Register for a listener to be called when the boundaries specified in
+   * config are reached.
+   * @param {!JSONObject} config the config that specifies the boundaries.
+   * @param {Function} listener
+   * @private
+   */
+  registerScrollTrigger_(config, listener) {
+    if (!Array.isArray(config['verticalBoundaries']) &&
+        !Array.isArray(config['horizontalBoundaries'])) {
+      console./*OK*/error(this.TAG_, "Boundaries are required for the scroll " +
+          "trigger to work.");
+      return;
+    }
+
+    // Ensure that the scroll events are being listened to.
+    if (!this.scrollHandlerRegistered_) {
+      this.scrollHandlerRegistered_ = true;
+      this.viewport_.onChanged(this.onScroll_.bind(this));
+    }
+
+    /**
+     * @param {!Object.<number, boolean>} bounds.
+     * @param {number} scrollPos Number representing the current scroll
+     * position.
+     */
+    const triggerScrollEvents = function(bounds, scrollPos) {
+      if (!scrollPos) {
+        return;
+      }
+      // Goes through each of the boundaries and fires an event if it has not
+      // been fired so far and it should be.
+      for (const b in bounds) {
+        if (!bounds.hasOwnProperty(b) || b > scrollPos || bounds[b]) {
+          continue;
+        }
+        bounds[b] = true;
+        listener(new AnalyticsEvent(AnalyticsEventType.SCROLL));
+      }
+    };
+
+    const boundsV = this.normalizeBoundaries_(config['verticalBoundaries']);
+    const boundsH = this.normalizeBoundaries_(config['horizontalBoundaries']);
+    this.scrollObservable_.add(e => {
+      // Calculates percentage scrolled by adding screen height/width to
+      // top/left and dividing by the total scroll height/width.
+      triggerScrollEvents(boundsV,
+          (e.top + e.height) * 100 / this.viewport_.getScrollHeight());
+      triggerScrollEvents(boundsH,
+          (e.left + e.width) * 100 / this.viewport_.getScrollWidth());
+    });
+  }
+
+  /**
+   * Rounds the boundaries for scroll trigger to nearest
+   * SCROLL_PRECISION_PERCENT and returns an object with normalized boundaries
+   * as keys and false as values.
+   *
+   * @param {!Array.<number>} bounds array of bounds.
+   * @return {!Object.<number,boolean>} Object with normalized bounds as keys
+   * and false as value.
+   * @private
+   */
+  normalizeBoundaries_(bounds) {
+    const result = {};
+    if (!bounds || !Array.isArray(bounds)) {
+      return result;
+    }
+
+    for (let b = 0; b < bounds.length; b++) {
+      let bound = bounds[b];
+      if (typeof bound !== 'number' || !isFinite(bound)) {
+        console./*OK*/error(this.TAG_,
+            'Scroll trigger boundaries must be finite.');
+        return result;
+      }
+
+      bound = Math.min(Math.round(bound / SCROLL_PRECISION_PERCENT) *
+          SCROLL_PRECISION_PERCENT, 100);
+      result[bound] = false;
+    }
+    return result;
+  }
+
   /**
    * @param {!Element} el
    * @param {string} selector
@@ -223,10 +339,10 @@ class InstrumentationService {
                timerSpec['interval'] < MIN_TIMER_INTERVAL_SECONDS_) {
       console./*OK*/error(this.TAG_, 'Bad timer interval specification');
       return false;
-    } else if (timerSpec.hasOwnProperty('max-timer-length') &&
-              (typeof timerSpec['max-timer-length'] !== 'number' ||
-                  timerSpec['max-timer-length'] <= 0)) {
-      console./*OK*/error(this.TAG_, 'Bad max-timer-length specification');
+    } else if (timerSpec.hasOwnProperty('maxTimerLength') &&
+              (typeof timerSpec['maxTimerLength'] !== 'number' ||
+                  timerSpec['maxTimerLength'] <= 0)) {
+      console./*OK*/error(this.TAG_, 'Bad maxTimerLength specification');
       return false;
     } else {
       return true;
@@ -244,7 +360,7 @@ class InstrumentationService {
         timerSpec['interval'] * 1000);
     listener(new AnalyticsEvent(AnalyticsEventType.TIMER));
 
-    const maxTimerLength = timerSpec['max-timer-length'] ||
+    const maxTimerLength = timerSpec['maxTimerLength'] ||
         DEFAULT_MAX_TIMER_LENGTH_SECONDS_;
     this.win_.setTimeout(this.win_.clearInterval.bind(this.win_, intervalId),
         maxTimerLength * 1000);
diff --git a/extensions/amp-analytics/0.1/test/test-amp-analytics.js b/extensions/amp-analytics/0.1/test/test-amp-analytics.js
index 9cf18b23fc47..d080ab7e4e09 100644
--- a/extensions/amp-analytics/0.1/test/test-amp-analytics.js
+++ b/extensions/amp-analytics/0.1/test/test-amp-analytics.js
@@ -19,10 +19,12 @@ import {
   installUserNotificationManager
 } from '../../../../build/all/v0/amp-user-notification-0.1.max';
 import {adopt} from '../../../../src/runtime';
+import {createIframePromise} from '../../../../testing/iframe';
 import {getService} from '../../../../src/service';
 import {markElementScheduledForTesting} from '../../../../src/custom-element';
 import {installCidService} from '../../../../src/service/cid-impl';
 import {installViewerService} from '../../../../src/service/viewer-impl';
+import {installViewportService} from '../../../../src/service/viewport-impl';
 import * as sinon from 'sinon';
 
 adopt(window);
@@ -33,40 +35,36 @@ describe('amp-analytics', function() {
   let windowApi;
   let sendRequestSpy;
   let configWithCredentials;
+  let uidService;
 
   const jsonMockResponses = {
     'config1': '{"vars": {"title": "remote"}}'
   };
 
   beforeEach(() => {
-    markElementScheduledForTesting(window, 'amp-analytics');
     sandbox = sinon.sandbox.create();
-    const WindowApi = function() {};
-    windowApi = new WindowApi();
-    windowApi.location = {hash: '', href: '/test/viewer'};
-    windowApi.document = {
-      createElement: document.createElement,
-      title: 'Test Title',
-      referrer: 'https://www.google.com/'
-    };
     configWithCredentials = false;
-    windowApi.Object = window.Object;
-    markElementScheduledForTesting(windowApi, 'amp-analytics');
-    markElementScheduledForTesting(windowApi, 'amp-user-notification');
-    installViewerService(windowApi);
-    installCidService(windowApi);
-    installUserNotificationManager(windowApi);
-    getService(windowApi, 'xhr', () => {return {
-      fetchJson: (url, init) => {
-        expect(init.requireAmpResponseSourceOrigin).to.be.true;
-        if (configWithCredentials) {
-          expect(init.credentials).to.equal('include');
-        } else {
-          expect(init.credentials).to.undefined;
-        }
-        return Promise.resolve(JSON.parse(jsonMockResponses[url]));
-      }
-    };});
+    return createIframePromise().then(iframe => {
+      iframe.doc.title = 'Test Title';
+      markElementScheduledForTesting(iframe.win, 'amp-analytics');
+      markElementScheduledForTesting(iframe.win, 'amp-user-notification');
+      installViewerService(iframe.win);
+      installViewportService(iframe.win);
+      installCidService(iframe.win);
+      uidService = installUserNotificationManager(iframe.win);
+      getService(iframe.win, 'xhr', () => {
+        return {fetchJson: (url, init) => {
+          expect(init.requireAmpResponseSourceOrigin).to.be.true;
+          if (configWithCredentials) {
+            expect(init.credentials).to.equal('include');
+          } else {
+            expect(init.credentials).to.undefined;
+          }
+          return Promise.resolve(JSON.parse(jsonMockResponses[url]));
+        }};
+      });
+      windowApi = iframe.win;
+    });
   });
 
   afterEach(() => {
@@ -74,12 +72,13 @@ describe('amp-analytics', function() {
     sandbox = null;
     windowApi = null;
     sendRequestSpy = null;
+    uidService = null;
   });
 
   function getAnalyticsTag(config, attrs) {
     config = JSON.stringify(config);
-    const el = document.createElement('amp-analytics');
-    const script = document.createElement('script');
+    const el = windowApi.document.createElement('amp-analytics');
+    const script = windowApi.document.createElement('script');
     script.textContent = config;
     script.setAttribute('type', 'application/json');
     el.appendChild(script);
@@ -87,7 +86,6 @@ describe('amp-analytics', function() {
       el.setAttribute(k, attrs[k]);
     }
     const analytics = new AmpAnalytics(el);
-    sandbox.stub(analytics, 'getWin').returns(windowApi);
     analytics.createdCallback();
     analytics.buildCallback();
     sendRequestSpy = sandbox.spy(analytics, 'sendRequest_');
@@ -134,10 +132,9 @@ describe('amp-analytics', function() {
       'requests': {'foo': 'https://example.com/bar'},
       'triggers': [{'on': 'visible', 'request': 'foo'}]
     });
-    const el = document.createElement('amp-analytics');
+    const el = windowApi.document.createElement('amp-analytics');
     el.textContent = config;
     const analytics = new AmpAnalytics(el);
-    sandbox.stub(analytics, 'getWin').returns(windowApi);
     analytics.createdCallback();
     analytics.buildCallback();
     sendRequestSpy = sandbox.spy(analytics, 'sendRequest_');
@@ -162,15 +159,14 @@ describe('amp-analytics', function() {
 
   it('does not send a hit when script tag does not have a type attribute',
       function() {
-        const el = document.createElement('amp-analytics');
-        const script = document.createElement('script');
+        const el = windowApi.document.createElement('amp-analytics');
+        const script = windowApi.document.createElement('script');
         script.textContent = JSON.stringify({
           'requests': {'foo': 'https://example.com/bar'},
           'triggers': [{'on': 'visible', 'request': 'foo'}]
         });
         el.appendChild(script);
         const analytics = new AmpAnalytics(el);
-        sandbox.stub(analytics, 'getWin').returns(windowApi);
         analytics.createdCallback();
         analytics.buildCallback();
         sendRequestSpy = sandbox.spy(analytics, 'sendRequest_');
@@ -240,7 +236,7 @@ describe('amp-analytics', function() {
     });
   });
 
-  it('fills cid for proxy host', function() {
+  it.skip('fills cid for proxy host', function() {
     windowApi.localStorage = {
       getItem: function(unusedName) {
         return JSON.stringify({
@@ -360,7 +356,7 @@ describe('amp-analytics', function() {
       expect(sendRequestSpy.calledOnce).to.be.true;
       expect(sendRequestSpy.args[0][0]).to.equal(
           'https://example.com/title=Test%20Title&' +
-          'ref=https%3A%2F%2Fwww.google.com%2F');
+          'ref=http%3A%2F%2Flocalhost%3A9876%2Fcontext.html');
     });
   });
 
@@ -467,7 +463,8 @@ describe('amp-analytics', function() {
     return waitForSendRequest(analytics).then(() => {
       expect(sendRequestSpy.calledOnce).to.be.true;
       expect(sendRequestSpy.args[0][0]).to.equal(
-          'https://example.com/test1=x&test2=https%3A%2F%2Fwww.google.com%2F' +
+          'https://example.com/test1=x&' +
+          'test2=http%3A%2F%2Flocalhost%3A9876%2Fcontext.html' +
           '&title=Test%20Title');
     });
   });
@@ -554,7 +551,6 @@ describe('amp-analytics', function() {
         'data-consent-notification-id': 'amp-user-notification1'
       });
 
-      const uidService = installUserNotificationManager(windowApi);
       sandbox.stub(uidService, 'get', id => {
         expect(id).to.equal('amp-user-notification1');
         return Promise.resolve();
@@ -574,7 +570,6 @@ describe('amp-analytics', function() {
         'data-consent-notification-id': 'amp-user-notification1'
       });
 
-      const uidService = installUserNotificationManager(windowApi);
       sandbox.stub(uidService, 'get', id => {
         expect(id).to.equal('amp-user-notification1');
         return Promise.reject();
diff --git a/extensions/amp-analytics/0.1/test/test-instrumentation.js b/extensions/amp-analytics/0.1/test/test-instrumentation.js
index 6fadd6580417..eff7fcad53ee 100644
--- a/extensions/amp-analytics/0.1/test/test-instrumentation.js
+++ b/extensions/amp-analytics/0.1/test/test-instrumentation.js
@@ -23,27 +23,40 @@ adopt(window);
 describe('instrumentation', function() {
 
   let ins;
+  let fakeViewport;
 
   beforeEach(() => {
     sandbox = sinon.sandbox.create();
     ins = instrumentationServiceFor(window);
+    fakeViewport = {
+      'getSize': sandbox.stub().returns(
+          {top: 0, left: 0, height: 200, width: 200}),
+      'getScrollTop': sandbox.stub().returns(0),
+      'getScrollLeft': sandbox.stub().returns(0),
+      'getScrollHeight': sandbox.stub().returns(500),
+      'getScrollWidth': sandbox.stub().returns(500),
+      'onChanged': sandbox.stub(),
+    };
+    ins.viewport_ = fakeViewport;
   });
 
   afterEach(() => {
     sandbox.restore();
     sandbox = null;
+    fakeViewport = null;
+    ins = null;
   });
 
   it('always fires click listeners when selector is set to *', () => {
     const el1 = document.createElement('test');
     const fn1 = sandbox.stub();
-    addListener(window, 'click', fn1, '*');
+    addListener(window, {'on': 'click', 'selector': '*'}, fn1);
     ins.onClick_({target: el1});
     expect(fn1.calledOnce).to.be.true;
 
     const el2 = document.createElement('test2');
     const fn2 = sandbox.stub();
-    addListener(window, 'click', fn2, '*');
+    addListener(window, {'on': 'click', 'selector': '*'}, fn2);
     ins.onClick_({target: el2});
     expect(fn1.calledTwice).to.be.true;
     expect(fn2.calledOnce).to.be.true;
@@ -52,13 +65,13 @@ describe('instrumentation', function() {
   it('never fires click listeners when the selector is empty', () => {
     const el1 = document.createElement('test');
     const fn1 = sandbox.stub();
-    addListener(window, 'click', fn1, '');
+    addListener(window, {'on': 'click', 'selector': ''}, fn1);
     ins.onClick_({target: el1});
     expect(fn1.callCount).to.equal(0);
 
     const el2 = document.createElement('test2');
     const fn2 = sandbox.stub();
-    addListener(window, 'click', fn2);
+    addListener(window, {'on': 'click'}, fn2);
     ins.onClick_({target: el2});
     expect(fn1.callCount).to.equal(0);
     expect(fn2.callCount).to.equal(0);
@@ -75,10 +88,10 @@ describe('instrumentation', function() {
     el3.id = 'y';
 
     const fnClassX = sandbox.stub();
-    addListener(window, 'click', fnClassX, '.x');
+    addListener(window, {'on': 'click', 'selector': '.x'}, fnClassX);
 
     const fnIdY = sandbox.stub();
-    addListener(window, 'click', fnIdY, '#y');
+    addListener(window, {'on': 'click', 'selector': '#y'}, fnIdY);
 
     ins.onClick_({target: el1});
     expect(fnClassX.callCount).to.equal(0);
@@ -96,8 +109,8 @@ describe('instrumentation', function() {
   it('should listen on custom events', () => {
     const handler1 = sinon.spy();
     const handler2 = sinon.spy();
-    ins.addListener('custom-event-1', handler1);
-    ins.addListener('custom-event-2', handler2);
+    ins.addListener({'on': 'custom-event-1'}, handler1);
+    ins.addListener({'on': 'custom-event-2'}, handler2);
 
     ins.triggerEvent('custom-event-1');
     expect(handler1.callCount).to.equal(1);
@@ -114,54 +127,60 @@ describe('instrumentation', function() {
 
   it('only fires when the timer interval exceeds the minimum', () => {
     const fn1 = sandbox.stub();
-    addListener(window, 'timer', fn1, null, {"interval": 0});
+    addListener(window, {'on': 'timer', 'timerSpec': {"interval": 0}}, fn1);
     expect(fn1.callCount).to.equal(0);
 
     const fn2 = sandbox.stub();
-    addListener(window, 'timer', fn2, null, {"interval": 1});
+    addListener(window, {'on': 'timer', 'timerSpec': {"interval": 1}}, fn2);
     expect(fn2.callCount).to.equal(1);
   });
 
   it('never fires when the timer spec is malformed', () => {
     const fn1 = sandbox.stub();
-    addListener(window, 'timer', fn1, null, null);
+    addListener(window, {'on': 'timer'}, fn1);
     expect(fn1.callCount).to.equal(0);
 
     const fn2 = sandbox.stub();
-    addListener(window, 'timer', fn2, null, 1);
+    addListener(window, {'on': 'timer', 'timerSpec': 1}, fn2);
     expect(fn2.callCount).to.equal(0);
 
     const fn3 = sandbox.stub();
-    addListener(window, 'timer', fn3, null, {'misc': 1});
+    addListener(window, {'on': 'timer', 'timerSpec': {'misc': 1}}, fn3);
     expect(fn3.callCount).to.equal(0);
 
     const fn4 = sandbox.stub();
-    addListener(window, 'timer', fn4, null, {'interval': 'two'});
+    addListener(window,
+        {'on': 'timer', 'timerSpec': {'interval': 'two'}}, fn4);
     expect(fn4.callCount).to.equal(0);
 
     const fn5 = sandbox.stub();
-    addListener(window, 'timer', fn5, null, {'interval': null});
+    addListener(window,
+        {'on': 'timer', 'timerSpec': {'interval': null}}, fn5);
     expect(fn5.callCount).to.equal(0);
 
     const fn6 = sandbox.stub();
-    addListener(window, 'timer', fn6, null,
-        {'interval': 2, 'max-timer-length': 0});
+    addListener(window, {
+      'on': 'timer',
+      'timerSpec': {'interval': 2, 'maxTimerLength': 0}
+    }, fn6);
     expect(fn6.callCount).to.equal(0);
 
     const fn7 = sandbox.stub();
-    addListener(window, 'timer', fn7, null,
-        {'interval': 2, 'max-timer-length': null});
+    addListener(window, {
+      'on': 'timer',
+      'timerSpec': {'interval': 2, 'maxTimerLength': null}
+    }, fn7);
     expect(fn7.callCount).to.equal(0);
   });
 
   it('fires on the appropriate interval', () => {
     const clock = sandbox.useFakeTimers();
     const fn1 = sandbox.stub();
-    addListener(window, 'timer', fn1, null, {"interval": 10});
+    addListener(window, {'on': 'timer', 'timerSpec': {"interval": 10}}, fn1);
     expect(fn1.callCount).to.equal(1);
 
     const fn2 = sandbox.stub();
-    addListener(window, 'timer', fn2, null, {"interval": 15});
+    addListener(window, {'on': 'timer', 'timerSpec': {"interval": 15}}, fn2);
     expect(fn2.callCount).to.equal(1);
 
     clock.tick(10 * 1000); // 10 seconds
@@ -177,20 +196,22 @@ describe('instrumentation', function() {
     expect(fn2.callCount).to.equal(3);
   });
 
-  it('stops firing after the max-timer-length is exceeded', () => {
+  it('stops firing after the maxTimerLength is exceeded', () => {
     const clock = sandbox.useFakeTimers();
     const fn1 = sandbox.stub();
-    addListener(window, 'timer', fn1, null,
-        {"interval": 10, "max-timer-length": 15});
+    addListener(window, {
+      'on': 'timer', 'timerSpec': {"interval": 10, "maxTimerLength": 15}
+    }, fn1);
     expect(fn1.callCount).to.equal(1);
 
     const fn2 = sandbox.stub();
-    addListener(window, 'timer', fn2, null,
-        {"interval": 10, "max-timer-length": 20});
+    addListener(window, {
+      'on': 'timer', 'timerSpec': {"interval": 10, "maxTimerLength": 20}
+    }, fn2);
     expect(fn2.callCount).to.equal(1);
 
     const fn3 = sandbox.stub();
-    addListener(window, 'timer', fn3, null, {"interval": 3600});
+    addListener(window, {'on': 'timer', 'timerSpec': {"interval": 3600}}, fn3);
     expect(fn3.callCount).to.equal(1);
 
     clock.tick(10 * 1000); // 10 seconds
@@ -205,8 +226,108 @@ describe('instrumentation', function() {
     expect(fn1.callCount).to.equal(2);
     expect(fn2.callCount).to.equal(3);
 
-    // Default max-timer-length is 2 hours
+    // Default maxTimerLength is 2 hours
     clock.tick(3 * 3600 * 1000); // 3 hours
     expect(fn3.callCount).to.equal(3);
   });
+
+  it('fires on scroll', () => {
+    const fn1 = sandbox.stub();
+    const fn2 = sandbox.stub();
+    addListener(window, {
+      'on': 'scroll',
+      'scrollSpec': {
+        'verticalBoundaries': [0, 100],
+        'horizontalBoundaries': [0, 100]
+      }},
+      fn1);
+    addListener(window, {'on': 'scroll', 'scrollSpec': {
+      'verticalBoundaries': [90], 'horizontalBoundaries': [90]}}, fn2);
+
+    expect(fn1.callCount).to.equal(2);
+    expect(fn2.callCount).to.equal(0);
+
+    // Scroll Down
+    fakeViewport.getScrollTop.returns(500);
+    fakeViewport.getScrollLeft.returns(500);
+    ins.onScroll_({top: 500, left: 500, height: 250, width: 250});
+
+    expect(fn1.callCount).to.equal(4);
+    expect(fn2.callCount).to.equal(2);
+  });
+
+  it('does not fire duplicates on scroll', () => {
+    const fn1 = sandbox.stub();
+    addListener(window, {
+      'on': 'scroll',
+      'scrollSpec': {
+        'verticalBoundaries': [0, 100],
+        'horizontalBoundaries': [0, 100]
+      }},
+      fn1);
+
+    // Scroll Down
+    fakeViewport.getScrollTop.returns(10);
+    fakeViewport.getScrollLeft.returns(10);
+    ins.onScroll_({top: 10, left: 10, height: 250, width: 250});
+
+    expect(fn1.callCount).to.equal(2);
+  });
+
+  it('fails gracefully on bad scroll config', () => {
+    const fn1 = sandbox.stub();
+
+    addListener(window, {'on': 'scroll'}, fn1);
+    expect(fn1.callCount).to.equal(0);
+
+    addListener(window, {'on': 'scroll', 'scrollSpec': {}}, fn1);
+    expect(fn1.callCount).to.equal(0);
+
+    addListener(window, {
+      'on': 'scroll',
+      'scrollSpec': {
+        'verticalBoundaries': undefined, 'horizontalBoundaries': undefined
+      }},
+      fn1);
+    expect(fn1.callCount).to.equal(0);
+
+    addListener(window, {
+      'on': 'scroll',
+      'scrollSpec': {'verticalBoundaries': [], 'horizontalBoundaries': []}},
+      fn1);
+    expect(fn1.callCount).to.equal(0);
+
+    addListener(window, {
+      'on': 'scroll',
+      'scrollSpec': {
+        'verticalBoundaries': ['foo'], 'horizontalBoundaries': ['foo']
+      }},
+      fn1);
+    expect(fn1.callCount).to.equal(0);
+  });
+
+  it('normalizes boundaries correctly.', () => {
+    expect(ins.normalizeBoundaries_([])).to.be.empty;
+    expect(ins.normalizeBoundaries_(undefined)).to.be.empty;
+    expect(ins.normalizeBoundaries_(['foo'])).to.be.empty;
+    expect(ins.normalizeBoundaries_(['0', '1'])).to.be.empty;
+    expect(ins.normalizeBoundaries_([1])).to.deep.equal({0: false});
+    expect(ins.normalizeBoundaries_([1, 4, 99, 1001])).to.deep.equal({
+      0: false,
+      5: false,
+      100: false,
+    });
+  });
+
+  it('fires events on normalized boundaries.', () => {
+    const fn1 = sandbox.stub();
+    const fn2 = sandbox.stub();
+    addListener(window,
+        {'on': 'scroll', 'scrollSpec': {'verticalBoundaries': [1]}},
+        fn1);
+    addListener(window,
+        {'on': 'scroll', 'scrollSpec': {'verticalBoundaries': [4]}},
+        fn2);
+    expect(fn2.callCount).to.equal(1);
+  });
 });
diff --git a/extensions/amp-analytics/0.1/vendors.js b/extensions/amp-analytics/0.1/vendors.js
index 47ab4b4e0958..53583f87dd22 100644
--- a/extensions/amp-analytics/0.1/vendors.js
+++ b/extensions/amp-analytics/0.1/vendors.js
@@ -83,9 +83,9 @@ export const ANALYTICS_CONFIG = {
     'triggers': {
       'trackInterval': {
         'on': 'timer',
-        'timer-spec': {
+        'timerSpec': {
           'interval': 15,
-          'max-timer-length': 7200
+          'maxTimerLength': 7200
         },
         'request': 'interval',
         'vars': {
diff --git a/extensions/amp-analytics/amp-analytics.md b/extensions/amp-analytics/amp-analytics.md
index 0b1e295c5d10..fb2e7d25e0bb 100644
--- a/extensions/amp-analytics/amp-analytics.md
+++ b/extensions/amp-analytics/amp-analytics.md
@@ -144,13 +144,16 @@ The `triggers` attribute describes when an analytics request should be sent. It
 
   - `on` (required) The event to listener for. Valid values are `visible`,`click`, and `timer`.
   - `request` (required) Name of the request to send (as specified in the `requests` section).
-  - `selector` A CSS selector used to refine which elements should be tracked. Use value `*` to track all elements.
-  - `timer-spec` Specification for the timer. The timer will trigger immediately and then at a specified interval thereafter.
-    - `interval` Length of the timer interval, in seconds.
-    - `max-timer-length` Maximum duration for which the timer will fire, in seconds.
   - `vars` An object containing key-value pairs used to override `vars` defined in the top level config, or to specify
     vars unique to this trigger.
 
+Following configuration only applies to specific values of `on`.
+  - `selector` A CSS selector used to refine which elements should be tracked. Use value `*` to track all elements. Used in triggers where `on` is set to `click`.
+  - `scrollSpec` An object used when `on` is set to `scroll`. This object can contain `verticalBoundaries` and `horizontalBoundaries`. At least one of the two property is required for scroll event to fire. The values for both the properties should be arrays of numbers containing the boundaries on which a scroll event is generated. For instance, in the following code snippet, the scroll event will be fired when page is scrolled vertically by 25%, 50% and 90%. Additionally, the event will also fire when the page is horizontally scrolled to 90% of scroll width.
+  - `timerSpec` Specification for triggers of type `timer`. The timer will trigger immediately and then at a specified interval thereafter.
+    - `interval` Length of the timer interval, in seconds.
+    - `maxTimerLength` Maximum duration for which the timer will fire, in seconds.
+
 ```javascript
 "triggers": {
   "defaultPageview": {
@@ -167,11 +170,18 @@ The `triggers` attribute describes when an analytics request should be sent. It
   },
   "pageTimer": {
     "on": "timer",
-    "timer-spec": {
+    "timerSpec": {
       "interval": 10,
-      "max-timer-length": 600
+      "maxTimerLength": 600
     },
     "request": "pagetime"
+  },
+  "scrollPings": {
+    "on": "scroll",
+    "scrollSpec": {
+      "verticalBoundaries": [25, 50, 90],
+      "horizontalBoundaries": [90]
+    }
   }
 }
 ```
diff --git a/extensions/amp-analytics/analytics-vars.md b/extensions/amp-analytics/analytics-vars.md
index 938def8641c9..4a34773518aa 100644
--- a/extensions/amp-analytics/analytics-vars.md
+++ b/extensions/amp-analytics/analytics-vars.md
@@ -90,13 +90,13 @@ Example value: `The New York Times - Breaking News, World News...`
 
 ### availableScreenHeight
 
-Provides the screen height in pixels available for the page rendering.
+Provides the screen height in pixels available for the page rendering. Note that this can be slightly more or less than the actual viewport height due to various browser quirks.
 
 Example value: `1480`
 
 ### availableScreenWidth
 
-Provides the screen width in pixels available for the page rendering.
+Provides the screen width in pixels available for the page rendering. Note that this can be slightly more or less than the actual viewport height due to various browser quirks.
 
 Example value: `2500`
 
@@ -132,7 +132,7 @@ Example value: `2560`
 
 ### scrollHeight
 
-Provides the total size of the page in pixels.
+Provides the total height of the page in pixels.
 
 Example value: `400`
 
@@ -148,6 +148,12 @@ Provides the number of pixels that the user has scrolled from top.
 
 Example value: `0`
 
+### scrollWidth
+
+Provides the total width of the page in pixels.
+
+Example value: `600`
+
 ### timezone
 
 Provides the user's time-zone offset from UTC, in minutes.
diff --git a/spec/amp-var-substitutions.md b/spec/amp-var-substitutions.md
index 85da449cf85c..76011052b976 100644
--- a/spec/amp-var-substitutions.md
+++ b/spec/amp-var-substitutions.md
@@ -174,7 +174,7 @@ For instance:
 
 ### AVAILABLE_SCREEN_HEIGHT
 
-Provides the screen height in pixels available for the page rendering.
+Provides the screen height in pixels available for the page rendering. Note that this value can be slightly more or less than the actual viewport size because of various browser quirks.
 
 For instance:
 ```html
@@ -183,7 +183,7 @@ For instance:
 
 ### AVAILABLE_SCREEN_WIDTH
 
-Provides the screen width in pixels available for the page rendering.
+Provides the screen width in pixels available for the page rendering. Note that this can be slightly more or less than the actual viewport height due to various browser quirks.
 
 For instance:
 ```html
diff --git a/src/service/viewport-impl.js b/src/service/viewport-impl.js
index 233af9af26a2..e4a19c140632 100644
--- a/src/service/viewport-impl.js
+++ b/src/service/viewport-impl.js
@@ -33,6 +33,7 @@ const TAG_ = 'Viewport';
  * @typedef {{
  *   relayoutAll: boolean,
  *   top: number,
+ *   left: number,
  *   width: number,
  *   height: number,
  *   velocity: number
@@ -371,14 +372,17 @@ export class Viewport {
   changed_(relayoutAll, velocity) {
     const size = this.getSize();
     const scrollTop = this.getScrollTop();
+    const scrollLeft = this.getScrollLeft();
     log.fine(TAG_, 'changed event:',
         'relayoutAll=', relayoutAll,
         'top=', scrollTop,
+        'top=', scrollLeft,
         'bottom=', (scrollTop + size.height),
         'velocity=', velocity);
     this.changeObservable_.fire({
       relayoutAll: relayoutAll,
       top: scrollTop,
+      left: scrollLeft,
       width: size.width,
       height: size.height,
       velocity: velocity
diff --git a/src/url-replacements.js b/src/url-replacements.js
index 887750fe4794..6e0c0428394d 100644
--- a/src/url-replacements.js
+++ b/src/url-replacements.js
@@ -153,6 +153,12 @@ class UrlReplacements {
         () => viewportFor(this.win_).getScrollHeight());
     });
 
+    // Returns a promise resolving to viewport.getScrollWidth.
+    this.set_('SCROLL_WIDTH', () => {
+      return vsyncFor(this.win_).measurePromise(
+        () => viewportFor(this.win_).getScrollWidth());
+    });
+
     // Returns screen.width.
     this.set_('SCREEN_WIDTH', () => {
       return this.win_.screen.width;

From 41d42f6274425b5cdd2738e30fb0e34e9d394f6d Mon Sep 17 00:00:00 2001
From: Malte Ubl <malte.ubl@gmail.com>
Date: Fri, 5 Feb 2016 17:32:41 -0800
Subject: [PATCH 43/44] Fix sending viewport records for elements that are
 initially in viewport

They did not get intermittent record until after they left the viewport.
Fix #1821
---
 .../amp-iframe/0.1/test/test-amp-iframe.js    | 35 +++++++++----------
 src/intersection-observer.js                  | 11 +++++-
 test/functional/test-amp-ad.js                |  2 +-
 test/functional/test-intersection-observer.js | 27 ++++++++++----
 4 files changed, 49 insertions(+), 26 deletions(-)

diff --git a/extensions/amp-iframe/0.1/test/test-amp-iframe.js b/extensions/amp-iframe/0.1/test/test-amp-iframe.js
index ad306ef28760..2b23eb24d78f 100644
--- a/extensions/amp-iframe/0.1/test/test-amp-iframe.js
+++ b/extensions/amp-iframe/0.1/test/test-amp-iframe.js
@@ -455,15 +455,6 @@ describe('amp-iframe intersection', () => {
   }
 
   beforeEach(() => {
-    window.onmessage = function(message) {
-      if (message.data.type == 'received-intersection') {
-        posts.push({
-          data: message.data,
-          targetOrigin: message.origin,
-        });
-      }
-    };
-    posts = [];
     return getAmpIframe({
       src: iframeSrc,
       sandbox: 'allow-scripts  allow-same-origin',
@@ -473,8 +464,16 @@ describe('amp-iframe intersection', () => {
       poster: 'https://i.ytimg.com/vi/cMcCTVAFBWM/hqdefault.jpg',
     }, '100').then(amp => {
       posts = [];
+      window.onmessage = function(message) {
+        if (message.data.type == 'received-intersection' &&
+            message.source == amp.iframe.contentWindow) {
+          posts.push({
+            data: message.data,
+            targetOrigin: message.origin,
+          });
+        }
+      };
       element = amp.container;
-      viewportFor(element.ownerDocument.defaultView).setScrollTop(50);
       ampIframe = element.implementation_;
       ampIframe.getVsync = function() {
         return {
@@ -489,15 +488,15 @@ describe('amp-iframe intersection', () => {
       expect(posts).to.have.length(0);
       //ampIframe.getVsync().runScheduledTasks_();
       return timer.promise(50).then(() => {
-        expect(posts).to.have.length(1);
+        expect(posts).to.have.length(2);
       });
     });
   });
 
   it('should calculate intersection', () => {
     expect(ampIframe.iframeLayoutBox_).to.not.be.null;
-    expect(posts).to.have.length(1);
-    const changes = posts[0].data.changes;
+    expect(posts).to.have.length(2);
+    const changes = posts[1].data.changes;
     expect(changes).to.be.array;
     expect(changes).to.have.length(1);
     expect(changes[0].time).to.be.number;
@@ -508,12 +507,12 @@ describe('amp-iframe intersection', () => {
   it('reflect viewport changes', () => {
     const win = ampIframe.element.ownerDocument.defaultView;
     const viewport = viewportFor(win);
-    expect(posts).to.have.length(1);
+    expect(posts).to.have.length(2);
     viewport.setScrollTop(0);
     ampIframe.intersectionObserver_.fire();
     return timer.promise(50).then(() => {
-      expect(posts).to.have.length(2);
-      const changes = posts[1].data.changes;
+      expect(posts).to.have.length(3);
+      const changes = posts[2].data.changes;
       expect(changes).to.have.length(1);
       expect(changes[0].time).to.be.number;
       expect(changes[0].intersectionRect.height).to.equal(150);
@@ -522,8 +521,8 @@ describe('amp-iframe intersection', () => {
       viewport.setScrollTop(350);
       ampIframe.intersectionObserver_.fire();
       return timer.promise(50).then(() => {
-        expect(posts).to.have.length(3);
-        const changes2 = posts[2].data.changes;
+        expect(posts).to.have.length(5);
+        const changes2 = posts[4].data.changes;
         expect(changes2).to.have.length(1);
         expect(changes2[0].time).to.be.number;
         expect(changes2[0].intersectionRect.height).to.be.number;
diff --git a/src/intersection-observer.js b/src/intersection-observer.js
index 146b95622cce..f3837252593a 100644
--- a/src/intersection-observer.js
+++ b/src/intersection-observer.js
@@ -105,6 +105,8 @@ export class IntersectionObserver extends Observable {
     this.shouldSendIntersectionChanges_ = false;
     /** @private {Array<function>} */
     this.unlisteners_ = [];
+    /** @private {boolean} */
+    this.inViewport_ = false;
 
     this.init_();
   }
@@ -145,7 +147,10 @@ export class IntersectionObserver extends Observable {
   startSendingIntersectionChanges_() {
     this.shouldSendIntersectionChanges_ = true;
     this.baseElement_.getVsync().measure(() => {
-      this.sendElementIntersection_();
+      if (this.baseElement_.isInViewport()) {
+        this.onViewportCallback(true);
+      }
+      this.fire();
     });
   }
 
@@ -155,6 +160,10 @@ export class IntersectionObserver extends Observable {
    * @param {boolean} inViewport true if the element is in viewport.
    */
   onViewportCallback(inViewport) {
+    if (this.inViewport_ == inViewport) {
+      return;
+    }
+    this.inViewport_ = inViewport;
     // Lets the ad know that it became visible or no longer is.
     this.fire();
     // And update the ad about its position in the viewport while
diff --git a/test/functional/test-amp-ad.js b/test/functional/test-amp-ad.js
index 75a6e3d9faca..745b685eaabd 100644
--- a/test/functional/test-amp-ad.js
+++ b/test/functional/test-amp-ad.js
@@ -105,7 +105,7 @@ function runAdTestSuiteAgainstInstaller(name, installer) {
         expect(data._context.canonicalUrl).to.equal('https://schema.org/');
         expect(data.aax_size).to.equal('300x250');
 
-        describe('ad intersection', () => {
+        describe('ad preconnect', () => {
           const doc = iframe.ownerDocument;
           const fetches = doc.querySelectorAll(
               'link[rel=prefetch]');
diff --git a/test/functional/test-intersection-observer.js b/test/functional/test-intersection-observer.js
index 8621452a47e2..e4ff7f8125bf 100644
--- a/test/functional/test-intersection-observer.js
+++ b/test/functional/test-intersection-observer.js
@@ -157,9 +157,9 @@ describe('IntersectionObserver', () => {
   let sandbox;
   let testIframe;
   let element;
-  const getIntersectionChangeEntrySpy = sinon.spy();
-  const onScrollSpy = sinon.spy();
-  const onChangeSpy = sinon.spy();
+  let getIntersectionChangeEntrySpy;
+  let onScrollSpy;
+  let onChangeSpy;
 
   function getIframe(src) {
     const i = document.createElement('iframe');
@@ -180,11 +180,16 @@ describe('IntersectionObserver', () => {
     testElementViewportCallback = sinon.spy();
     testElementGetInsersectionElementLayoutBox = sinon.spy();
     testElementDocumentInactiveCallback = sinon.spy();
+    getIntersectionChangeEntrySpy = sinon.spy();
+    onScrollSpy = sinon.spy();
+    onChangeSpy = sinon.spy();
     testIframe = getIframe(iframeSrc);
     element = new ElementClass();
     element.getVsync = function() {
       return {
-        measure: function() {}
+        measure: function(fn) {
+          fn();
+        }
       };
     };
     element.getViewport = function() {
@@ -207,6 +212,7 @@ describe('IntersectionObserver', () => {
         return getIntersectionChangeEntry(111, rootBounds, layoutBox);
       }
     };
+    element.isInViewport = () => false;
   });
 
   afterEach(() => {
@@ -240,8 +246,7 @@ describe('IntersectionObserver', () => {
     postMessageSpy = sinon/*OK*/.spy(testIframe.contentWindow, 'postMessage');
     const ioInstance = new IntersectionObserver(element, testIframe);
     ioInstance.startSendingIntersectionChanges_();
-    ioInstance.sendElementIntersection_();
-    expect(getIntersectionChangeEntrySpy.callCount);
+    expect(getIntersectionChangeEntrySpy.callCount).to.equal(1);
     expect(postMessageSpy.callCount).to.equal(1);
     postMessageSpy/*OK*/.restore();
   });
@@ -264,4 +269,14 @@ describe('IntersectionObserver', () => {
     expect(fireSpy.callCount).to.equal(2);
     expect(ioInstance.unlistenViewportChanges_).to.be.null;
   });
+
+  it('should go into in-viewport state for initially visible element', () => {
+    element.isInViewport = () => true;
+    const ioInstance = new IntersectionObserver(element, testIframe);
+    ioInstance.startSendingIntersectionChanges_();
+    expect(getIntersectionChangeEntrySpy.callCount).to.equal(2);
+    expect(onScrollSpy.callCount).to.equal(1);
+    expect(onChangeSpy.callCount).to.equal(1);
+    expect(ioInstance.unlistenViewportChanges_).to.not.be.null;
+  });
 });

From 44295ff88e0e7a98d3f374055be6a736e5b34d75 Mon Sep 17 00:00:00 2001
From: Erwin Mombay <erwinm@google.com>
Date: Fri, 5 Feb 2016 18:29:04 -0800
Subject: [PATCH 44/44] remove global config from extension

---
 gulpfile.js | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/gulpfile.js b/gulpfile.js
index 1eaebd90e1ca..baa2ead24cb7 100644
--- a/gulpfile.js
+++ b/gulpfile.js
@@ -270,8 +270,7 @@ function buildExtensionJs(js, path, name, version, options) {
           minify: options.minify,
           minifiedName: minifiedName,
           latestName: latestName,
-          wrapper: windowConfig.getTemplate() +
-              '(window.AMP = window.AMP || [])' +
+          wrapper: '(window.AMP = window.AMP || [])' +
               '.push(function(AMP) {<%= contents %>\n});',
         });
       });