From 0cd5e99066a0824aa58a2ecae1c37eba51676c70 Mon Sep 17 00:00:00 2001
From: Timothy Flynn <trflynn89@pm.me>
Date: Wed, 30 Apr 2025 07:31:15 -0400
Subject: [PATCH] LibWeb: Use the correct target realm to tee a stream

We currently store Web::Fetch::Infrastructure::Response objects in the
HTTP cache. They are associated with their original realm, but when we
use a cached response, we clone it into the target realm. For example,
two <iframe> objects loading the same HTML will be in different realms.

When we clone the response, we must use the target realm throughout the
entire cloning process. We neglected to do this for the cloned response
body stream, which is cloned via teeing. The result was the the stream
for the "cloned" response was created in the original realm, causing
issues down the line when reading from that stream tried to handle read
promises on behalf of the original realm. There are protections in place
to prevent this from happening, and the cached response read would never
complete.
---
 Libraries/LibWeb/Fetch/Infrastructure/HTTP/Bodies.cpp | 2 +-
 Libraries/LibWeb/Streams/ReadableStream.cpp           | 7 +++++--
 Libraries/LibWeb/Streams/ReadableStream.h             | 2 +-
 3 files changed, 7 insertions(+), 4 deletions(-)
diff --git a/Libraries/LibWeb/Fetch/Infrastructure/HTTP/Bodies.cpp b/Libraries/LibWeb/Fetch/Infrastructure/HTTP/Bodies.cpp
index 36b60d245c4..3da29a57dfe 100644
--- a/Libraries/LibWeb/Fetch/Infrastructure/HTTP/Bodies.cpp
+++ b/Libraries/LibWeb/Fetch/Infrastructure/HTTP/Bodies.cpp
@@ -54,7 +54,7 @@ GC::Ref<Body> Body::clone(JS::Realm& realm)
 
     // To clone a body body, run these steps:
     // 1. Let « out1, out2 » be the result of teeing body’s stream.
-    auto [out1, out2] = m_stream->tee().release_value_but_fixme_should_propagate_errors();
+    auto [out1, out2] = m_stream->tee(&realm).release_value_but_fixme_should_propagate_errors();
 
     // 2. Set body’s stream to out1.
     m_stream = out1;
diff --git a/Libraries/LibWeb/Streams/ReadableStream.cpp b/Libraries/LibWeb/Streams/ReadableStream.cpp
index d1bb21b7fb5..4c61f264a73 100644
--- a/Libraries/LibWeb/Streams/ReadableStream.cpp
+++ b/Libraries/LibWeb/Streams/ReadableStream.cpp
@@ -173,10 +173,13 @@ GC::Ref<WebIDL::Promise> ReadableStream::pipe_to(WritableStream& destination, St
 }
 
 // https://streams.spec.whatwg.org/#readablestream-tee
-WebIDL::ExceptionOr<ReadableStreamPair> ReadableStream::tee()
+WebIDL::ExceptionOr<ReadableStreamPair> ReadableStream::tee(GC::Ptr<JS::Realm> target_realm)
 {
+    if (!target_realm)
+        target_realm = &realm();
+
     // To tee a ReadableStream stream, return ? ReadableStreamTee(stream, true).
-    return TRY(readable_stream_tee(realm(), *this, true));
+    return TRY(readable_stream_tee(*target_realm, *this, true));
 }
 
 // https://streams.spec.whatwg.org/#readablestream-close
diff --git a/Libraries/LibWeb/Streams/ReadableStream.h b/Libraries/LibWeb/Streams/ReadableStream.h
index a82c7b161e6..ebb63435e08 100644
--- a/Libraries/LibWeb/Streams/ReadableStream.h
+++ b/Libraries/LibWeb/Streams/ReadableStream.h
@@ -80,7 +80,7 @@ public:
     WebIDL::ExceptionOr<ReadableStreamReader> get_reader(ReadableStreamGetReaderOptions const& = {});
     WebIDL::ExceptionOr<GC::Ref<ReadableStream>> pipe_through(ReadableWritablePair transform, StreamPipeOptions const& = {});
     GC::Ref<WebIDL::Promise> pipe_to(WritableStream& destination, StreamPipeOptions const& = {});
-    WebIDL::ExceptionOr<ReadableStreamPair> tee();
+    WebIDL::ExceptionOr<ReadableStreamPair> tee(GC::Ptr<JS::Realm> target_realm = {});
 
     void close();
     void error(JS::Value);
