Various borrow hazard fixes (#33133)

* Reduce the scope of the document tag map borrow.

Signed-off-by: Josh Matthews <josh@joshmatthews.net>

* Reduce scope of borrow when finishing a Response.

Signed-off-by: Josh Matthews <josh@joshmatthews.net>

* Avoid creating a File object while borrowing FormData's data.

Signed-off-by: Josh Matthews <josh@joshmatthews.net>

* Prevent the GC from seeing an uninitialized window proxy slot.

Signed-off-by: Josh Matthews <josh@joshmatthews.net>

---------

Signed-off-by: Josh Matthews <josh@joshmatthews.net>

components/script/dom/document.rs

@@ -4287,15 +4287,15 @@ impl DocumentMethods for Document {
     // https://dom.spec.whatwg.org/#dom-document-getelementsbytagname
     fn GetElementsByTagName(&self, qualified_name: DOMString) -> DomRoot<HTMLCollection> {
         let qualified_name = LocalName::from(&*qualified_name);
-        match self.tag_map.borrow_mut().entry(qualified_name.clone()) {
+        if let Some(entry) = self.tag_map.borrow_mut().get(&qualified_name) {
-            Occupied(entry) => DomRoot::from_ref(entry.get()),
+            return DomRoot::from_ref(entry);
-            Vacant(entry) => {
-                let result =
-                    HTMLCollection::by_qualified_name(&self.window, self.upcast(), qualified_name);
-                entry.insert(Dom::from_ref(&*result));
-                result
-            },
         }
+        let result =
+            HTMLCollection::by_qualified_name(&self.window, self.upcast(), qualified_name.clone());
+        self.tag_map
+            .borrow_mut()
+            .insert(qualified_name, Dom::from_ref(&*result));
+        result
     }
 
     // https://dom.spec.whatwg.org/#dom-document-getelementsbytagnamens

components/script/dom/formdata.rs

@@ -175,6 +175,8 @@ impl FormDataMethods for FormData {
     #[allow(crown::unrooted_must_root)]
     // https://xhr.spec.whatwg.org/#dom-formdata-set
     fn Set_(&self, name: USVString, blob: &Blob, filename: Option<USVString>) {
+        let file = self.create_an_entry(blob, filename);
+
         let mut data = self.data.borrow_mut();
         let local_name = LocalName::from(name.0.clone());
 
@@ -185,9 +187,7 @@ impl FormDataMethods for FormData {
             FormDatum {
                 ty: DOMString::from("file"),
                 name: DOMString::from(name.0),
-                value: FormDatumValue::File(DomRoot::from_ref(
+                value: FormDatumValue::File(file),
-                    &*self.create_an_entry(blob, filename),
-                )),
             },
         ));
     }

components/script/dom/response.rs

@@ -466,7 +466,8 @@ impl Response {
         if let Some(body) = self.body_stream.get() {
             body.close_native();
         }
-        if let Some(stream_consumer) = self.stream_consumer.borrow_mut().take() {
+        let stream_consumer = self.stream_consumer.borrow_mut().take();
+        if let Some(stream_consumer) = stream_consumer {
             stream_consumer.stream_end();
         }
     }

components/script/dom/windowproxy.rs

@@ -644,6 +644,9 @@ impl WindowProxy {
             // because we want to replace the wrapper's `ProxyTraps`, but we
             // don't want to update its identity.
             rooted!(in(*cx) let new_js_proxy = handler.new_window_proxy(&cx, window_jsobject));
+            // Explicitly set this slot to a null pointer in case a GC occurs before we
+            // are ready to set it to a real value.
+            SetProxyReservedSlot(new_js_proxy.get(), 0, &PrivateValue(ptr::null_mut()));
             debug!(
                 "Transplanting proxy from {:p} to {:p}.",
                 old_js_proxy.get(),