Ignore dangling markup in target name

source

@@ -2222,6 +2222,7 @@ a.setAttribute('href', 'https://example.com/'); // change the content attribute
      <li><dfn data-x-href="https://infra.spec.whatwg.org/#scalar-value-string">scalar value string</dfn></li>
      <li><dfn data-x-href="https://infra.spec.whatwg.org/#javascript-string-convert">convert</dfn></li>
      <li><dfn data-x-href="https://infra.spec.whatwg.org/#ascii-string">ASCII string</dfn></li>
+     <li><dfn data-x-href="https://infra.spec.whatwg.org/#ascii-tab-or-newline">ASCII tab or newline</dfn></li>
      <li><dfn id="space-characters" data-x-href="https://infra.spec.whatwg.org/#ascii-whitespace">ASCII whitespace</dfn></li>
      <li><dfn data-x-href="https://infra.spec.whatwg.org/#control">control</dfn></li>
      <li><dfn data-x="ASCII digits" data-x-href="https://infra.spec.whatwg.org/#ascii-digit">ASCII digit</dfn></li>
@@ -14643,18 +14644,27 @@ interface <dfn interface>HTMLBaseElement</dfn> : <span>HTMLElement</span> {
   data-x="attr-base-target">target</code> attributes, all but the first are ignored.</p>
 
   <p>To <dfn>get an element's target</dfn>, given an <code>a</code>, <code>area</code>, or
-  <code>form</code> element <var>element</var>, run these steps:
+  <code>form</code> element <var>element</var>, and an optional string-or-null <var>target</var>
+  (default null), run these steps:
 
   <ol>
-   <li><p>If <var>element</var> has a <code data-x="">target</code> attribute, then return that
-   attribute's value.</p></li>
+   <li><p>If <var>target</var> is null, then:</p>
+    <ol>
+     <li><p>If <var>element</var> has a <code data-x="">target</code> attribute, then set
+     <var>target</var> to that attribute's value.</p></li>
 
-   <li><p>If <var>element</var>'s <span>node document</span> contains a <code>base</code> element
-   with a <code data-x="attr-base-target">target</code> attribute, then return the value of the
-   <code data-x="attr-base-target">target</code> attribute of the first such <code>base</code>
-   element.</p></li>
+     <li><p>Otherwise, if <var>element</var>'s <span>node document</span> contains a
+     <code>base</code> element with a <code data-x="attr-base-target">target</code> attribute,
+     set <var>target</var> to the value of the <code
+     data-x="attr-base-target">target</code> attribute of the first such <code>base</code>
+     element.</p></li>
+    </ol>
+   </li>
 
-   <li><p>Return the empty string.</p></li>
+   <li><p>If <var>target</var> contains an <span>ASCII tab or newline</span> and a U+003C
+   (&lt;), then set <var>target</var> to "<code data-x="">_blank</code>".</p></li>
+
+   <li><p>Return <var>target</var>.</p></li>
   </ol>
 
   <hr>
@@ -58666,11 +58676,16 @@ fur
    <li><p>Let <var>enctype</var> be the <var>submitter</var> element's <span
    data-x="concept-fs-enctype">enctype</span>.</p></li>
 
-   <li><p>Let <var>target</var> be the <var>submitter</var> element's <code
-   data-x="attr-fs-formtarget">formtarget</code> attribute value, if the element is a <span
-   data-x="concept-submit-button">submit button</span> and has such an attribute. Otherwise, let it
-   be the result of <span data-x="get an element's target">getting an element's target</span> given
-   <var>submitter</var>'s <span>form owner</span>.</p></li>
+   <li><p>Let <var>formTarget</var> be null.</p></li>
+
+   <li><p>If the <var>submitter</var> element is a <span
+   data-x="concept-submit-button">submit button</span> and it has a <code
+   data-x="attr-fs-formtarget">formtarget</code> attribute, then set <var>formTarget</var> to
+   the <code data-x="attr-fs-formtarget">formtarget</code> attribute value.</p></li>
+
+   <li><p>Let <var>target</var> be the result of <span
+   data-x="get an element's target">getting an element's target</span> given
+   <var>submitter</var>'s <span>form owner</span> and <var>formTarget</var>.</p></li>
 
    <li><p>Let <var>noopener</var> be the result of <span data-x="get an element's noopener">getting
    an element's noopener</span> with <var>form</var> and <var>target</var>.</p></li>
@@ -89926,8 +89941,9 @@ interface <dfn interface>BeforeUnloadEvent</dfn> : <span>Event</span> {
   data-x="navigate">navigations</span> at that navigable.</p>
 
   <p id="valid-browsing-context-name">A <dfn>valid navigable target name</dfn> is any string with
-  at least one character that does not start with a U+005F LOW LINE character. (Names starting with
-  an underscore are reserved for special keywords.)</p>
+  at least one character that does not start with a U+005F LOW LINE character (Names starting with
+  an underscore are reserved for special keywords.), and it does not contain both
+  an <span>ASCII tab or newline</span> and a U+003C (&lt;).</p>
 
   <p id="valid-browsing-context-name-or-keyword">A <dfn>valid navigable target name or
   keyword</dfn> is any string that is either a <span>valid navigable target name</span> or that is