Right now, the only script execution in the spec that considers the "scripting is enabled" state seems to be execution of a <script> element.  At least the following cases should probably also consider it:

1)  on* attributes.
2)  setTimeout and event handler execution (which raises the question of whether
    the relevant script enabled state is that of the Window or Node the
    timeout/handler is set on, or that of the Window the Function comes from).
3)  Event listener execution (same question here as #2).

And in general, any time a script entry point is involved... maybe part of this should live in WebIDL or something?

It feels to me like most of this should go in Scripting section of the HTML spec, but one thing we could have in Web IDL is a definition for the parenthesized part of your (2).

We could, but it might turn out that we need different answers for #2 in different cases due to web compat issues...  See https://bugzilla.mozilla.org/show_bug.cgi?id=827035

The HTML spec doesn't compile scripts when scripting is disabled. Once a script is compiled, if scripting is later disabled, the previously compiled scripts still run, except that "if scripting is disabled while a script is executing, the script should be terminated immediately".

Could you elaborate on what precisely you think the spec should say here?

> The HTML spec doesn't compile scripts when scripting is disabled

Hmm.  I didn't see where this was specified.  I now see it's at <http://www.whatwg.org/specs/web-apps/current-work/#create-a-script>, right?

> Once a script is compiled, if scripting is later disabled, the previously
> compiled scripts still run

That's the behavior Gecko has right now (e.g. for event listeners), and users hate it.  They want scripts to turn off when they turn off scripts.  So we're planning to switch behavior where we keep script-enabled state per global and for every script entry point we check whether the corresponding global has script enabled before calling it.

It's worth checking what other UAs do or plan to do, of course.

Yeah, that makes more sense.

Should we still act as if we compile scripts when scripting is disabled? So that when they re-enable scripting, things work? Or should that require a reload?

Hmm.  We should probably not compile them if scripting is disabled to avoid confusing syntax errors if nothing else...

Fair enough.

Checked in as WHATWG revision r7917.
Check-in comment: Disabling scripting should actually disable scripting.
http://html5.org/tools/web-apps-tracker?from=7916&to=7917