LibWeb/Streams: Make ReadRequest GC-allocated

This allows it to keep its edges alive. Fixes an intermittent crash seen
by UBSAN on CI. :^)

Userland/Libraries/LibWeb/Streams/AbstractOperations.cpp

@@ -320,7 +320,7 @@ void readable_stream_error(ReadableStream& stream, JS::Value error)
 }
 
 // https://streams.spec.whatwg.org/#readable-stream-add-read-request
-void readable_stream_add_read_request(ReadableStream& stream, ReadRequest const& read_request)
+void readable_stream_add_read_request(ReadableStream& stream, ReadRequest& read_request)
 {
     // 1. Assert: stream.[[reader]] implements ReadableStreamDefaultReader.
     VERIFY(stream.reader().has_value() && stream.reader()->has<JS::NonnullGCPtr<ReadableStreamDefaultReader>>());
@@ -1032,7 +1032,7 @@ void readable_byte_stream_controller_error(ReadableByteStreamController& control
 }
 
 // https://streams.spec.whatwg.org/#abstract-opdef-readablebytestreamcontrollerfillreadrequestfromqueue
-WebIDL::ExceptionOr<void> readable_byte_stream_controller_fill_read_request_from_queue(ReadableByteStreamController& controller, NonnullRefPtr<ReadRequest> read_request)
+WebIDL::ExceptionOr<void> readable_byte_stream_controller_fill_read_request_from_queue(ReadableByteStreamController& controller, JS::NonnullGCPtr<ReadRequest> read_request)
 {
     auto& vm = controller.vm();
     auto& realm = controller.realm();

Userland/Libraries/LibWeb/Streams/AbstractOperations.h

@@ -37,7 +37,7 @@ WebIDL::ExceptionOr<double> extract_high_water_mark(QueuingStrategy const&, doub
 
 void readable_stream_close(ReadableStream&);
 void readable_stream_error(ReadableStream&, JS::Value error);
-void readable_stream_add_read_request(ReadableStream&, ReadRequest const&);
+void readable_stream_add_read_request(ReadableStream&, ReadRequest&);
 WebIDL::ExceptionOr<JS::NonnullGCPtr<WebIDL::Promise>> readable_stream_cancel(ReadableStream&, JS::Value reason);
 void readable_stream_fulfill_read_request(ReadableStream&, JS::Value chunk, bool done);
 size_t readable_stream_get_num_read_into_requests(ReadableStream const&);
@@ -84,7 +84,7 @@ void readable_byte_stream_controller_clear_algorithms(ReadableByteStreamControll
 void readable_byte_stream_controller_clear_pending_pull_intos(ReadableByteStreamController&);
 WebIDL::ExceptionOr<void> readable_byte_stream_controller_close(ReadableByteStreamController&);
 void readable_byte_stream_controller_error(ReadableByteStreamController&, JS::Value error);
-WebIDL::ExceptionOr<void> readable_byte_stream_controller_fill_read_request_from_queue(ReadableByteStreamController&, NonnullRefPtr<ReadRequest>);
+WebIDL::ExceptionOr<void> readable_byte_stream_controller_fill_read_request_from_queue(ReadableByteStreamController&, JS::NonnullGCPtr<ReadRequest>);
 Optional<double> readable_byte_stream_controller_get_desired_size(ReadableByteStreamController const&);
 WebIDL::ExceptionOr<void> readable_byte_stream_controller_handle_queue_drain(ReadableByteStreamController&);
 void readable_byte_stream_controller_invalidate_byob_request(ReadableByteStreamController&);

Userland/Libraries/LibWeb/Streams/ReadableByteStreamController.cpp

@@ -69,7 +69,7 @@ WebIDL::ExceptionOr<JS::NonnullGCPtr<WebIDL::Promise>> ReadableByteStreamControl
 }
 
 // https://streams.spec.whatwg.org/#rbs-controller-private-pull
-WebIDL::ExceptionOr<void> ReadableByteStreamController::pull_steps(NonnullRefPtr<ReadRequest> read_request)
+WebIDL::ExceptionOr<void> ReadableByteStreamController::pull_steps(JS::NonnullGCPtr<ReadRequest> read_request)
 {
     auto& vm = this->vm();
     auto& realm = this->realm();
@@ -86,7 +86,6 @@ WebIDL::ExceptionOr<void> ReadableByteStreamController::pull_steps(NonnullRefPtr
 
         // 2. Perform ! ReadableByteStreamControllerFillReadRequestFromQueue(this, readRequest).
         TRY(readable_byte_stream_controller_fill_read_request_from_queue(*this, read_request));
-
         // 3. Return.
         return {};
     }

Userland/Libraries/LibWeb/Streams/ReadableByteStreamController.h

@@ -119,7 +119,7 @@ public:
     void set_stream(JS::GCPtr<ReadableStream> stream) { m_stream = stream; }
 
     WebIDL::ExceptionOr<JS::NonnullGCPtr<WebIDL::Promise>> cancel_steps(JS::Value reason);
-    WebIDL::ExceptionOr<void> pull_steps(NonnullRefPtr<ReadRequest>);
+    WebIDL::ExceptionOr<void> pull_steps(JS::NonnullGCPtr<ReadRequest>);
     WebIDL::ExceptionOr<void> release_steps();
 
 private:

Userland/Libraries/LibWeb/Streams/ReadableStreamDefaultReader.cpp

@@ -23,6 +23,13 @@
 
 namespace Web::Streams {
 
+void ReadLoopReadRequest::visit_edges(Visitor& visitor)
+{
+    Base::visit_edges(visitor);
+    visitor.visit(m_realm);
+    visitor.visit(m_reader);
+}
+
 // https://streams.spec.whatwg.org/#default-reader-constructor
 WebIDL::ExceptionOr<JS::NonnullGCPtr<ReadableStreamDefaultReader>> ReadableStreamDefaultReader::construct_impl(JS::Realm& realm, JS::NonnullGCPtr<ReadableStream> stream)
 {
@@ -50,6 +57,8 @@ void ReadableStreamDefaultReader::visit_edges(Cell::Visitor& visitor)
 {
     Base::visit_edges(visitor);
     ReadableStreamGenericReaderMixin::visit_edges(visitor);
+    for (auto& request : m_read_requests)
+        visitor.visit(request);
 }
 
 // https://streams.spec.whatwg.org/#read-loop
@@ -108,7 +117,9 @@ void ReadLoopReadRequest::on_error(JS::Value error)
     m_failure_steps(error);
 }
 
-class DefaultReaderReadRequest : public ReadRequest {
+class DefaultReaderReadRequest final : public ReadRequest {
+    JS_CELL(DefaultReaderReadRequest, Cell);
+
 public:
     DefaultReaderReadRequest(JS::Realm& realm, WebIDL::Promise& promise)
         : m_realm(realm)
@@ -132,6 +143,13 @@ public:
     }
 
 private:
+    virtual void visit_edges(Visitor& visitor) override
+    {
+        Base::visit_edges(visitor);
+        visitor.visit(m_realm);
+        visitor.visit(m_promise);
+    }
+
     JS::Realm& m_realm;
     WebIDL::Promise& m_promise;
 };
@@ -158,7 +176,7 @@ WebIDL::ExceptionOr<JS::NonnullGCPtr<JS::Promise>> ReadableStreamDefaultReader::
     //        Resolve promise with «[ "value" → undefined, "done" → true ]».
     //    error steps, given e
     //        Reject promise with e.
-    auto read_request = adopt_ref(*new DefaultReaderReadRequest(realm, promise_capability));
+    auto read_request = heap().allocate_without_realm<DefaultReaderReadRequest>(realm, promise_capability);
 
     // 4. Perform ! ReadableStreamDefaultReaderRead(this, readRequest).
     TRY(readable_stream_default_reader_read(*this, read_request));
@@ -175,7 +193,7 @@ WebIDL::ExceptionOr<void> ReadableStreamDefaultReader::read_all_bytes(ReadLoopRe
 
     // 1. Let readRequest be a new read request with the following items:
     //    NOTE: items and steps in ReadLoopReadRequest.
-    auto read_request = adopt_ref(*new ReadLoopReadRequest(vm, realm, *this, move(success_steps), move(failure_steps)));
+    auto read_request = heap().allocate_without_realm<ReadLoopReadRequest>(vm, realm, *this, move(success_steps), move(failure_steps));
 
     // 2. Perform ! ReadableStreamDefaultReaderRead(this, readRequest).
     TRY(readable_stream_default_reader_read(*this, read_request));

Userland/Libraries/LibWeb/Streams/ReadableStreamDefaultReader.h

@@ -20,7 +20,9 @@ struct ReadableStreamReadResult {
     bool done;
 };
 
-class ReadRequest : public RefCounted<ReadRequest> {
+class ReadRequest : public JS::Cell {
+    JS_CELL(ReadRequest, JS::Cell);
+
 public:
     virtual ~ReadRequest() = default;
 
@@ -29,7 +31,9 @@ public:
     virtual void on_error(JS::Value error) = 0;
 };
 
-class ReadLoopReadRequest : public ReadRequest {
+class ReadLoopReadRequest final : public ReadRequest {
+    JS_CELL(ReadLoopReadRequest, JS::Cell);
+
 public:
     // successSteps, which is an algorithm accepting a byte sequence
     using SuccessSteps = JS::SafeFunction<void(ByteBuffer)>;
@@ -46,6 +50,8 @@ public:
     virtual void on_error(JS::Value error) override;
 
 private:
+    virtual void visit_edges(Visitor&) override;
+
     JS::VM& m_vm;
     JS::Realm& m_realm;
     ReadableStreamDefaultReader& m_reader;
@@ -72,7 +78,7 @@ public:
 
     WebIDL::ExceptionOr<void> release_lock();
 
-    SinglyLinkedList<NonnullRefPtr<ReadRequest>>& read_requests() { return m_read_requests; }
+    SinglyLinkedList<JS::NonnullGCPtr<ReadRequest>>& read_requests() { return m_read_requests; }
 
 private:
     explicit ReadableStreamDefaultReader(JS::Realm&);
@@ -81,7 +87,7 @@ private:
 
     virtual void visit_edges(Cell::Visitor&) override;
 
-    SinglyLinkedList<NonnullRefPtr<ReadRequest>> m_read_requests;
+    SinglyLinkedList<JS::NonnullGCPtr<ReadRequest>> m_read_requests;
 };
 
 }