fix: a `Request` whose URL is a revoked blob URL should still fetch (#11947)

In the spec, a URL record has an associated "blob URL entry", which for
`blob:` URLs is populated during parsing to contain a reference to the
`Blob` object that backs that object URL. It is this blob URL entry that
the `fetch` API uses to resolve an object URL.

Therefore, since the `Request` constructor parses URL inputs, it will
have an associated blob URL entry which will be used when fetching, even
if the object URL has been revoked since the construction of the
`Request` object. (The `Request` constructor takes the URL as a string
and parses it, so the object URL must be live at the time it is called.)

This PR adds a new `blobFromObjectUrl` JS function (backed by a new
`op_blob_from_object_url` op) that, if the URL is a valid object URL,
returns a new `Blob` object whose parts are references to the same Rust
`BlobPart`s used by the original `Blob` object. It uses this function to
add a new `blobUrlEntry` field to inner requests, which will be `null`
or such a `Blob`, and then uses `Blob.prototype.stream()` as the
response's body. As a result of this, the `blob:` URL resolution from
`op_fetch` is now useless, and has been removed.

1 files changed, 41 insertions, 3 deletions

diff --git a/ext/web/09_file.js b/ext/web/09_file.js
index 43d9ffcb3..64cdb7b8a 100644
--- a/ext/web/09_file.js
+++ b/ext/web/09_file.js
@@ -167,11 +167,12 @@
     return bag;
   }
 
+  const _type = Symbol("Type");
   const _size = Symbol("Size");
   const _parts = Symbol("Parts");
 
   class Blob {
-    #type = "";
+    [_type] = "";
     [_size] = 0;
     [_parts];
 
@@ -199,7 +200,7 @@
 
       this[_parts] = parts;
       this[_size] = size;
-      this.#type = normalizeType(options.type);
+      this[_type] = normalizeType(options.type);
     }
 
     /** @returns {number} */
@@ -211,7 +212,7 @@
     /** @returns {string} */
     get type() {
       webidl.assertBranded(this, Blob);
-      return this.#type;
+      return this[_type];
     }
 
     /**
@@ -561,7 +562,44 @@
     }
   }
 
+  /**
+   * Construct a new Blob object from an object URL.
+   *
+   * This new object will not duplicate data in memory with the original Blob
+   * object from which this URL was created or with other Blob objects created
+   * from the same URL, but they will be different objects.
+   *
+   * The object returned from this function will not be a File object, even if
+   * the original object from which the object URL was constructed was one. This
+   * means that the `name` and `lastModified` properties are lost.
+   *
+   * @param {string} url
+   * @returns {Blob | null}
+   */
+  function blobFromObjectUrl(url) {
+    const blobData = core.opSync("op_blob_from_object_url", url);
+    if (blobData === null) {
+      return null;
+    }
+
+    /** @type {BlobReference[]} */
+    const parts = [];
+    let totalSize = 0;
+
+    for (const { uuid, size } of blobData.parts) {
+      ArrayPrototypePush(parts, new BlobReference(uuid, size));
+      totalSize += size;
+    }
+
+    const blob = webidl.createBranded(Blob);
+    blob[_type] = blobData.media_type;
+    blob[_size] = totalSize;
+    blob[_parts] = parts;
+    return blob;
+  }
+
   window.__bootstrap.file = {
+    blobFromObjectUrl,
     getParts,
     Blob,
     File,