diff --git a/src/document/html/parser/general.c b/src/document/html/parser/general.c
index 9a854a8ff..c96b79cf5 100644
--- a/src/document/html/parser/general.c
+++ b/src/document/html/parser/general.c
@@ -362,7 +362,7 @@ imported:
 			return;
 		add_bytes_to_string(&code, html, *end - html);
 
-		ecmascript_eval(interpreter, &code);
+		ecmascript_eval(interpreter, &code, &ret);
 		done_string(&code);
 	
 #if 0
diff --git a/src/document/renderer.c b/src/document/renderer.c
index 4ec6163c1..379460325 100644
--- a/src/document/renderer.c
+++ b/src/document/renderer.c
@@ -129,7 +129,7 @@ process_snippets(struct ecmascript_interpreter *interpreter,
 
 		if (*string->source != '^') {
 			/* Evaluate <script>code</script> snippet */
-			ecmascript_eval(interpreter, string);
+			ecmascript_eval(interpreter, string, NULL);
 			continue;
 		}
 
@@ -194,7 +194,7 @@ process_snippets(struct ecmascript_interpreter *interpreter,
 		if (fragment) {
 			struct string code = INIT_STRING(fragment->data, fragment->length);
 
-			ecmascript_eval(interpreter, &code);
+			ecmascript_eval(interpreter, &code, NULL);
 		}
 	}
 }
diff --git a/src/ecmascript/ecmascript.c b/src/ecmascript/ecmascript.c
index 1ec1a87e9..065c65c11 100644
--- a/src/ecmascript/ecmascript.c
+++ b/src/ecmascript/ecmascript.c
@@ -119,15 +119,15 @@ ecmascript_put_interpreter(struct ecmascript_interpreter *interpreter)
 
 void
 ecmascript_eval(struct ecmascript_interpreter *interpreter,
-                struct string *code)
+                struct string *code, struct string *ret)
 {
 	if (!get_ecmascript_enable())
 		return;
 	assert(interpreter);
 #ifdef CONFIG_ECMASCRIPT_SEE
-	see_eval(interpreter, code);
+	see_eval(interpreter, code, ret);
 #else
-	spidermonkey_eval(interpreter, code);
+	spidermonkey_eval(interpreter, code, ret);
 #endif
 }
 
diff --git a/src/ecmascript/ecmascript.h b/src/ecmascript/ecmascript.h
index 58429e039..002683e17 100644
--- a/src/ecmascript/ecmascript.h
+++ b/src/ecmascript/ecmascript.h
@@ -18,6 +18,8 @@ struct view_state;
 struct ecmascript_interpreter {
 	struct view_state *vs;
 	void *backend_data;
+	/* Used by document.write() */
+	struct string *ret;
 	time_t exec_start;
 
 	/* This is a cross-rerenderings accumulator of
@@ -57,7 +59,7 @@ void ecmascript_put_interpreter(struct ecmascript_interpreter *interpreter);
 
 void ecmascript_reset_state(struct view_state *vs);
 
-void ecmascript_eval(struct ecmascript_interpreter *interpreter, struct string *code);
+void ecmascript_eval(struct ecmascript_interpreter *interpreter, struct string *code, struct string *ret);
 unsigned char *ecmascript_eval_stringback(struct ecmascript_interpreter *interpreter, struct string *code);
 /* Returns -1 if undefined. */
 int ecmascript_eval_boolback(struct ecmascript_interpreter *interpreter, struct string *code);
diff --git a/src/ecmascript/see.c b/src/ecmascript/see.c
index d86548536..dbe1aeba0 100644
--- a/src/ecmascript/see.c
+++ b/src/ecmascript/see.c
@@ -96,7 +96,7 @@ see_put_interpreter(struct ecmascript_interpreter *interpreter)
 
 void
 see_eval(struct ecmascript_interpreter *interpreter,
-                  struct string *code)
+                  struct string *code, struct string *ret)
 {
 
 	struct SEE_interpreter *interp = interpreter->backend_data;
@@ -106,6 +106,7 @@ see_eval(struct ecmascript_interpreter *interpreter,
 	struct SEE_value result;
 
 	g->exec_start = time(NULL);
+	g->ret = ret;
 	SEE_TRY(interp, try_ctxt) {
 		SEE_Global_eval(interp, input, &result);
 	}
@@ -130,6 +131,7 @@ see_eval_stringback(struct ecmascript_interpreter *interpreter,
 	unsigned char *volatile string = NULL;
 
 	g->exec_start = time(NULL);
+	g->ret = NULL;
 	SEE_TRY(interp, try_ctxt) {
 		SEE_Global_eval(interp, input, &result);
 		if (SEE_VALUE_GET_TYPE(&result) != SEE_NULL)
@@ -158,6 +160,7 @@ see_eval_boolback(struct ecmascript_interpreter *interpreter,
 	SEE_int32_t volatile res = 0;
 
 	g->exec_start = time(NULL);
+	g->ret = NULL;
 	SEE_TRY(interp, try_ctxt) {
 		SEE_Global_eval(interp, input, &result);
 		/* history.back() returns SEE_NULL */
diff --git a/src/ecmascript/see.h b/src/ecmascript/see.h
index 8d75c6e28..0c7a08b59 100644
--- a/src/ecmascript/see.h
+++ b/src/ecmascript/see.h
@@ -10,7 +10,7 @@ void see_done();
 void *see_get_interpreter(struct ecmascript_interpreter *interpreter);
 void see_put_interpreter(struct ecmascript_interpreter *interpreter);
 
-void see_eval(struct ecmascript_interpreter *interpreter, struct string *code);
+void see_eval(struct ecmascript_interpreter *interpreter, struct string *code, struct string *ret);
 unsigned char *see_eval_stringback(struct ecmascript_interpreter *interpreter, struct string *code);
 int see_eval_boolback(struct ecmascript_interpreter *interpreter, struct string *code);
 
diff --git a/src/ecmascript/see/window.h b/src/ecmascript/see/window.h
index 0e52e6518..f7a7e4d13 100644
--- a/src/ecmascript/see/window.h
+++ b/src/ecmascript/see/window.h
@@ -17,6 +17,7 @@ struct js_window_object {
 struct global_object {
 	struct SEE_interpreter interp;
 	struct js_window_object *win;
+	struct string *ret;
 	int exec_start;
 	int max_exec_time;
 };
diff --git a/src/ecmascript/spidermonkey.c b/src/ecmascript/spidermonkey.c
index 5d2aad3f1..85d7e9d32 100644
--- a/src/ecmascript/spidermonkey.c
+++ b/src/ecmascript/spidermonkey.c
@@ -239,7 +239,7 @@ spidermonkey_put_interpreter(struct ecmascript_interpreter *interpreter)
 
 void
 spidermonkey_eval(struct ecmascript_interpreter *interpreter,
-                  struct string *code)
+                  struct string *code, struct string *ret)
 {
 	JSContext *ctx;
 	jsval rval;
@@ -247,6 +247,7 @@ spidermonkey_eval(struct ecmascript_interpreter *interpreter,
 	assert(interpreter);
 	ctx = interpreter->backend_data;
 	setup_safeguard(interpreter, ctx);
+	interpreter->ret = ret;
 	JS_EvaluateScript(ctx, JS_GetGlobalObject(ctx),
 	                  code->source, code->length, "", 0, &rval);
 }
@@ -262,6 +263,7 @@ spidermonkey_eval_stringback(struct ecmascript_interpreter *interpreter,
 	assert(interpreter);
 	ctx = interpreter->backend_data;
 	setup_safeguard(interpreter, ctx);
+	interpreter->ret = NULL;
 	if (JS_EvaluateScript(ctx, JS_GetGlobalObject(ctx),
 			      code->source, code->length, "", 0, &rval)
 	    == JS_FALSE) {
@@ -287,6 +289,7 @@ spidermonkey_eval_boolback(struct ecmascript_interpreter *interpreter,
 	assert(interpreter);
 	ctx = interpreter->backend_data;
 	setup_safeguard(interpreter, ctx);
+	interpreter->ret = NULL;
 	ret = JS_EvaluateScript(ctx, JS_GetGlobalObject(ctx),
 			  code->source, code->length, "", 0, &rval);
 	if (ret == 2) { /* onClick="history.back()" */
diff --git a/src/ecmascript/spidermonkey.h b/src/ecmascript/spidermonkey.h
index b9f2b6352..e0920229d 100644
--- a/src/ecmascript/spidermonkey.h
+++ b/src/ecmascript/spidermonkey.h
@@ -10,7 +10,7 @@ void spidermonkey_done();
 void *spidermonkey_get_interpreter(struct ecmascript_interpreter *interpreter);
 void spidermonkey_put_interpreter(struct ecmascript_interpreter *interpreter);
 
-void spidermonkey_eval(struct ecmascript_interpreter *interpreter, struct string *code);
+void spidermonkey_eval(struct ecmascript_interpreter *interpreter, struct string *code, struct string *ret);
 unsigned char *spidermonkey_eval_stringback(struct ecmascript_interpreter *interpreter, struct string *code);
 int spidermonkey_eval_boolback(struct ecmascript_interpreter *interpreter, struct string *code);