LibWeb: Make the paint tree GC-allocated

This simplifies the ownership model between DOM/layout/paint nodes
immensely by deferring to the garbage collector for figuring out what's
live and what's not.

64 files changed, 148 insertions, 108 deletions

diff --git a/Userland/Libraries/LibWeb/Layout/BlockContainer.cpp b/Userland/Libraries/LibWeb/Layout/BlockContainer.cpp
index 4f0fd21ab6..98e2f28350 100644
--- a/Userland/Libraries/LibWeb/Layout/BlockContainer.cpp
+++ b/Userland/Libraries/LibWeb/Layout/BlockContainer.cpp
@@ -41,7 +41,7 @@ Painting::PaintableWithLines const* BlockContainer::paint_box() const
     return static_cast<Painting::PaintableWithLines const*>(Box::paint_box());
 }
 
-RefPtr<Painting::Paintable> BlockContainer::create_paintable() const
+JS::GCPtr<Painting::Paintable> BlockContainer::create_paintable() const
 {
     return Painting::PaintableWithLines::create(*this);
 }
diff --git a/Userland/Libraries/LibWeb/Layout/BlockContainer.h b/Userland/Libraries/LibWeb/Layout/BlockContainer.h
index 90888ae974..54e6cd88d5 100644
--- a/Userland/Libraries/LibWeb/Layout/BlockContainer.h
+++ b/Userland/Libraries/LibWeb/Layout/BlockContainer.h
@@ -31,7 +31,7 @@ public:
 
     Painting::PaintableWithLines const* paint_box() const;
 
-    virtual RefPtr<Painting::Paintable> create_paintable() const override;
+    virtual JS::GCPtr<Painting::Paintable> create_paintable() const override;
 
 private:
     virtual bool is_block_container() const final { return true; }
diff --git a/Userland/Libraries/LibWeb/Layout/Box.cpp b/Userland/Libraries/LibWeb/Layout/Box.cpp
index a2ace652f8..927c804351 100644
--- a/Userland/Libraries/LibWeb/Layout/Box.cpp
+++ b/Userland/Libraries/LibWeb/Layout/Box.cpp
@@ -40,7 +40,7 @@ bool Box::is_body() const
     return dom_node() && dom_node() == document().body();
 }
 
-RefPtr<Painting::Paintable> Box::create_paintable() const
+JS::GCPtr<Painting::Paintable> Box::create_paintable() const
 {
     return Painting::PaintableBox::create(*this);
 }
diff --git a/Userland/Libraries/LibWeb/Layout/Box.h b/Userland/Libraries/LibWeb/Layout/Box.h
index 5c0db9a6a9..21a492c661 100644
--- a/Userland/Libraries/LibWeb/Layout/Box.h
+++ b/Userland/Libraries/LibWeb/Layout/Box.h
@@ -39,7 +39,7 @@ public:
 
     virtual void did_set_rect() { }
 
-    virtual RefPtr<Painting::Paintable> create_paintable() const override;
+    virtual JS::GCPtr<Painting::Paintable> create_paintable() const override;
 
 protected:
     Box(DOM::Document&, DOM::Node*, NonnullRefPtr<CSS::StyleProperties>);
diff --git a/Userland/Libraries/LibWeb/Layout/ButtonBox.cpp b/Userland/Libraries/LibWeb/Layout/ButtonBox.cpp
index 1a944b9f03..45e90a9706 100644
--- a/Userland/Libraries/LibWeb/Layout/ButtonBox.cpp
+++ b/Userland/Libraries/LibWeb/Layout/ButtonBox.cpp
@@ -30,7 +30,7 @@ void ButtonBox::prepare_for_replaced_layout()
     }
 }
 
-RefPtr<Painting::Paintable> ButtonBox::create_paintable() const
+JS::GCPtr<Painting::Paintable> ButtonBox::create_paintable() const
 {
     return Painting::ButtonPaintable::create(*this);
 }
diff --git a/Userland/Libraries/LibWeb/Layout/ButtonBox.h b/Userland/Libraries/LibWeb/Layout/ButtonBox.h
index c1b0c1f106..ea0274ee2a 100644
--- a/Userland/Libraries/LibWeb/Layout/ButtonBox.h
+++ b/Userland/Libraries/LibWeb/Layout/ButtonBox.h
@@ -21,7 +21,7 @@ public:
     virtual void prepare_for_replaced_layout() override;
 
 private:
-    virtual RefPtr<Painting::Paintable> create_paintable() const override;
+    virtual JS::GCPtr<Painting::Paintable> create_paintable() const override;
 };
 
 }
diff --git a/Userland/Libraries/LibWeb/Layout/CanvasBox.cpp b/Userland/Libraries/LibWeb/Layout/CanvasBox.cpp
index 9c4b44e18f..9a7a9a672d 100644
--- a/Userland/Libraries/LibWeb/Layout/CanvasBox.cpp
+++ b/Userland/Libraries/LibWeb/Layout/CanvasBox.cpp
@@ -23,7 +23,7 @@ void CanvasBox::prepare_for_replaced_layout()
     set_intrinsic_height(dom_node().height());
 }
 
-RefPtr<Painting::Paintable> CanvasBox::create_paintable() const
+JS::GCPtr<Painting::Paintable> CanvasBox::create_paintable() const
 {
     return Painting::CanvasPaintable::create(*this);
 }
diff --git a/Userland/Libraries/LibWeb/Layout/CanvasBox.h b/Userland/Libraries/LibWeb/Layout/CanvasBox.h
index 89ec2c3da1..1a93bce7e4 100644
--- a/Userland/Libraries/LibWeb/Layout/CanvasBox.h
+++ b/Userland/Libraries/LibWeb/Layout/CanvasBox.h
@@ -22,7 +22,7 @@ public:
 
     const HTML::HTMLCanvasElement& dom_node() const { return static_cast<const HTML::HTMLCanvasElement&>(ReplacedBox::dom_node()); }
 
-    virtual RefPtr<Painting::Paintable> create_paintable() const override;
+    virtual JS::GCPtr<Painting::Paintable> create_paintable() const override;
 };
 
 }
diff --git a/Userland/Libraries/LibWeb/Layout/CheckBox.cpp b/Userland/Libraries/LibWeb/Layout/CheckBox.cpp
index 473f8a1a9e..0a36e7cf5f 100644
--- a/Userland/Libraries/LibWeb/Layout/CheckBox.cpp
+++ b/Userland/Libraries/LibWeb/Layout/CheckBox.cpp
@@ -22,7 +22,7 @@ CheckBox::CheckBox(DOM::Document& document, HTML::HTMLInputElement& element, Non
 
 CheckBox::~CheckBox() = default;
 
-RefPtr<Painting::Paintable> CheckBox::create_paintable() const
+JS::GCPtr<Painting::Paintable> CheckBox::create_paintable() const
 {
     return Painting::CheckBoxPaintable::create(*this);
 }
diff --git a/Userland/Libraries/LibWeb/Layout/CheckBox.h b/Userland/Libraries/LibWeb/Layout/CheckBox.h
index a43911cad3..cc48ff4398 100644
--- a/Userland/Libraries/LibWeb/Layout/CheckBox.h
+++ b/Userland/Libraries/LibWeb/Layout/CheckBox.h
@@ -19,7 +19,7 @@ public:
     virtual ~CheckBox() override;
 
 private:
-    virtual RefPtr<Painting::Paintable> create_paintable() const override;
+    virtual JS::GCPtr<Painting::Paintable> create_paintable() const override;
 };
 
 }
diff --git a/Userland/Libraries/LibWeb/Layout/FrameBox.cpp b/Userland/Libraries/LibWeb/Layout/FrameBox.cpp
index 1285ccfac0..910b043573 100644
--- a/Userland/Libraries/LibWeb/Layout/FrameBox.cpp
+++ b/Userland/Libraries/LibWeb/Layout/FrameBox.cpp
@@ -36,7 +36,7 @@ void FrameBox::did_set_rect()
     dom_node().nested_browsing_context()->set_size(paint_box()->content_size());
 }
 
-RefPtr<Painting::Paintable> FrameBox::create_paintable() const
+JS::GCPtr<Painting::Paintable> FrameBox::create_paintable() const
 {
     return Painting::NestedBrowsingContextPaintable::create(*this);
 }
diff --git a/Userland/Libraries/LibWeb/Layout/FrameBox.h b/Userland/Libraries/LibWeb/Layout/FrameBox.h
index 2fd465213b..4f225fae5d 100644
--- a/Userland/Libraries/LibWeb/Layout/FrameBox.h
+++ b/Userland/Libraries/LibWeb/Layout/FrameBox.h
@@ -23,7 +23,7 @@ public:
     const HTML::HTMLIFrameElement& dom_node() const { return verify_cast<HTML::HTMLIFrameElement>(ReplacedBox::dom_node()); }
     HTML::HTMLIFrameElement& dom_node() { return verify_cast<HTML::HTMLIFrameElement>(ReplacedBox::dom_node()); }
 
-    virtual RefPtr<Painting::Paintable> create_paintable() const override;
+    virtual JS::GCPtr<Painting::Paintable> create_paintable() const override;
 
 private:
     virtual void did_set_rect() override;
diff --git a/Userland/Libraries/LibWeb/Layout/ImageBox.cpp b/Userland/Libraries/LibWeb/Layout/ImageBox.cpp
index 3d0b435596..f763e738db 100644
--- a/Userland/Libraries/LibWeb/Layout/ImageBox.cpp
+++ b/Userland/Libraries/LibWeb/Layout/ImageBox.cpp
@@ -97,7 +97,7 @@ void ImageBox::browsing_context_did_set_viewport_rect(CSSPixelRect const& viewpo
     m_image_loader.set_visible_in_viewport(paint_box() && viewport_rect.intersects(paint_box()->absolute_rect()));
 }
 
-RefPtr<Painting::Paintable> ImageBox::create_paintable() const
+JS::GCPtr<Painting::Paintable> ImageBox::create_paintable() const
 {
     return Painting::ImagePaintable::create(*this);
 }
diff --git a/Userland/Libraries/LibWeb/Layout/ImageBox.h b/Userland/Libraries/LibWeb/Layout/ImageBox.h
index 111f585a5d..f37de8a4ab 100644
--- a/Userland/Libraries/LibWeb/Layout/ImageBox.h
+++ b/Userland/Libraries/LibWeb/Layout/ImageBox.h
@@ -27,7 +27,7 @@ public:
 
     bool renders_as_alt_text() const;
 
-    virtual RefPtr<Painting::Paintable> create_paintable() const override;
+    virtual JS::GCPtr<Painting::Paintable> create_paintable() const override;
 
     auto const& image_loader() const { return m_image_loader; }
 
diff --git a/Userland/Libraries/LibWeb/Layout/InlineNode.cpp b/Userland/Libraries/LibWeb/Layout/InlineNode.cpp
index f288aeed7e..a630a45e26 100644
--- a/Userland/Libraries/LibWeb/Layout/InlineNode.cpp
+++ b/Userland/Libraries/LibWeb/Layout/InlineNode.cpp
@@ -21,7 +21,7 @@ InlineNode::InlineNode(DOM::Document& document, DOM::Element* element, NonnullRe
 
 InlineNode::~InlineNode() = default;
 
-RefPtr<Painting::Paintable> InlineNode::create_paintable() const
+JS::GCPtr<Painting::Paintable> InlineNode::create_paintable() const
 {
     return Painting::InlinePaintable::create(*this);
 }
diff --git a/Userland/Libraries/LibWeb/Layout/InlineNode.h b/Userland/Libraries/LibWeb/Layout/InlineNode.h
index e670180e93..c06733cc85 100644
--- a/Userland/Libraries/LibWeb/Layout/InlineNode.h
+++ b/Userland/Libraries/LibWeb/Layout/InlineNode.h
@@ -17,7 +17,7 @@ public:
     InlineNode(DOM::Document&, DOM::Element*, NonnullRefPtr<CSS::StyleProperties>);
     virtual ~InlineNode() override;
 
-    virtual RefPtr<Painting::Paintable> create_paintable() const override;
+    virtual JS::GCPtr<Painting::Paintable> create_paintable() const override;
 };
 
 }
diff --git a/Userland/Libraries/LibWeb/Layout/ListItemMarkerBox.cpp b/Userland/Libraries/LibWeb/Layout/ListItemMarkerBox.cpp
index 14b7d4b281..80724b6124 100644
--- a/Userland/Libraries/LibWeb/Layout/ListItemMarkerBox.cpp
+++ b/Userland/Libraries/LibWeb/Layout/ListItemMarkerBox.cpp
@@ -51,7 +51,7 @@ ListItemMarkerBox::ListItemMarkerBox(DOM::Document& document, CSS::ListStyleType
 
 ListItemMarkerBox::~ListItemMarkerBox() = default;
 
-RefPtr<Painting::Paintable> ListItemMarkerBox::create_paintable() const
+JS::GCPtr<Painting::Paintable> ListItemMarkerBox::create_paintable() const
 {
     return Painting::MarkerPaintable::create(*this);
 }
diff --git a/Userland/Libraries/LibWeb/Layout/ListItemMarkerBox.h b/Userland/Libraries/LibWeb/Layout/ListItemMarkerBox.h
index 9a57921c90..152c000c50 100644
--- a/Userland/Libraries/LibWeb/Layout/ListItemMarkerBox.h
+++ b/Userland/Libraries/LibWeb/Layout/ListItemMarkerBox.h
@@ -20,7 +20,7 @@ public:
 
     DeprecatedString const& text() const { return m_text; }
 
-    virtual RefPtr<Painting::Paintable> create_paintable() const override;
+    virtual JS::GCPtr<Painting::Paintable> create_paintable() const override;
 
     CSS::ListStyleType list_style_type() const { return m_list_style_type; }
 
diff --git a/Userland/Libraries/LibWeb/Layout/Node.cpp b/Userland/Libraries/LibWeb/Layout/Node.cpp
index aa741a1f40..ae59a86446 100644
--- a/Userland/Libraries/LibWeb/Layout/Node.cpp
+++ b/Userland/Libraries/LibWeb/Layout/Node.cpp
@@ -36,6 +36,7 @@ void Node::visit_edges(Cell::Visitor& visitor)
 {
     Base::visit_edges(visitor);
     visitor.visit(m_dom_node);
+    visitor.visit(m_paintable);
     visitor.visit(m_browsing_context);
     TreeNode::visit_edges(visitor);
 }
@@ -679,12 +680,12 @@ void NodeWithStyle::reset_table_box_computed_values_used_by_wrapper_to_init_valu
     mutable_computed_values.set_margin({ CSS::Length::make_px(0), CSS::Length::make_px(0), CSS::Length::make_px(0), CSS::Length::make_px(0) });
 }
 
-void Node::set_paintable(RefPtr<Painting::Paintable> paintable)
+void Node::set_paintable(JS::GCPtr<Painting::Paintable> paintable)
 {
     m_paintable = move(paintable);
 }
 
-RefPtr<Painting::Paintable> Node::create_paintable() const
+JS::GCPtr<Painting::Paintable> Node::create_paintable() const
 {
     return nullptr;
 }
diff --git a/Userland/Libraries/LibWeb/Layout/Node.h b/Userland/Libraries/LibWeb/Layout/Node.h
index baf01d4490..4a0c51d42d 100644
--- a/Userland/Libraries/LibWeb/Layout/Node.h
+++ b/Userland/Libraries/LibWeb/Layout/Node.h
@@ -51,9 +51,9 @@ public:
 
     Painting::Paintable* paintable() { return m_paintable; }
     Painting::Paintable const* paintable() const { return m_paintable; }
-    void set_paintable(RefPtr<Painting::Paintable>);
+    void set_paintable(JS::GCPtr<Painting::Paintable>);
 
-    virtual RefPtr<Painting::Paintable> create_paintable() const;
+    virtual JS::GCPtr<Painting::Paintable> create_paintable() const;
 
     DOM::Document& document();
     DOM::Document const& document() const;
@@ -150,7 +150,7 @@ private:
     friend class NodeWithStyle;
 
     JS::NonnullGCPtr<DOM::Node> m_dom_node;
-    RefPtr<Painting::Paintable> m_paintable;
+    JS::GCPtr<Painting::Paintable> m_paintable;
 
     JS::NonnullGCPtr<HTML::BrowsingContext> m_browsing_context;
 
diff --git a/Userland/Libraries/LibWeb/Layout/Progress.cpp b/Userland/Libraries/LibWeb/Layout/Progress.cpp
index d081e14897..7363400e3c 100644
--- a/Userland/Libraries/LibWeb/Layout/Progress.cpp
+++ b/Userland/Libraries/LibWeb/Layout/Progress.cpp
@@ -17,7 +17,7 @@ Progress::Progress(DOM::Document& document, HTML::HTMLProgressElement& element,
 
 Progress::~Progress() = default;
 
-RefPtr<Painting::Paintable> Progress::create_paintable() const
+JS::GCPtr<Painting::Paintable> Progress::create_paintable() const
 {
     return Painting::ProgressPaintable::create(*this);
 }
diff --git a/Userland/Libraries/LibWeb/Layout/Progress.h b/Userland/Libraries/LibWeb/Layout/Progress.h
index a55ed6860b..a3f65a233f 100644
--- a/Userland/Libraries/LibWeb/Layout/Progress.h
+++ b/Userland/Libraries/LibWeb/Layout/Progress.h
@@ -21,7 +21,7 @@ public:
     const HTML::HTMLProgressElement& dom_node() const { return static_cast<const HTML::HTMLProgressElement&>(LabelableNode::dom_node()); }
     HTML::HTMLProgressElement& dom_node() { return static_cast<HTML::HTMLProgressElement&>(LabelableNode::dom_node()); }
 
-    virtual RefPtr<Painting::Paintable> create_paintable() const override;
+    virtual JS::GCPtr<Painting::Paintable> create_paintable() const override;
 };
 
 }
diff --git a/Userland/Libraries/LibWeb/Layout/RadioButton.cpp b/Userland/Libraries/LibWeb/Layout/RadioButton.cpp
index d3a434f4dd..c6ad8e8a2a 100644
--- a/Userland/Libraries/LibWeb/Layout/RadioButton.cpp
+++ b/Userland/Libraries/LibWeb/Layout/RadioButton.cpp
@@ -21,7 +21,7 @@ RadioButton::RadioButton(DOM::Document& document, HTML::HTMLInputElement& elemen
 
 RadioButton::~RadioButton() = default;
 
-RefPtr<Painting::Paintable> RadioButton::create_paintable() const
+JS::GCPtr<Painting::Paintable> RadioButton::create_paintable() const
 {
     return Painting::RadioButtonPaintable::create(*this);
 }
diff --git a/Userland/Libraries/LibWeb/Layout/RadioButton.h b/Userland/Libraries/LibWeb/Layout/RadioButton.h
index bf30e2dde3..6bbb135bb9 100644
--- a/Userland/Libraries/LibWeb/Layout/RadioButton.h
+++ b/Userland/Libraries/LibWeb/Layout/RadioButton.h
@@ -19,7 +19,7 @@ public:
     virtual ~RadioButton() override;
 
 private:
-    virtual RefPtr<Painting::Paintable> create_paintable() const override;
+    virtual JS::GCPtr<Painting::Paintable> create_paintable() const override;
 };
 
 }
diff --git a/Userland/Libraries/LibWeb/Layout/SVGGeometryBox.cpp b/Userland/Libraries/LibWeb/Layout/SVGGeometryBox.cpp
index 04b3a2defb..0a24def385 100644
--- a/Userland/Libraries/LibWeb/Layout/SVGGeometryBox.cpp
+++ b/Userland/Libraries/LibWeb/Layout/SVGGeometryBox.cpp
@@ -46,7 +46,7 @@ CSSPixelPoint SVGGeometryBox::viewbox_origin() const
     return { svg_box->view_box().value().min_x, svg_box->view_box().value().min_y };
 }
 
-RefPtr<Painting::Paintable> SVGGeometryBox::create_paintable() const
+JS::GCPtr<Painting::Paintable> SVGGeometryBox::create_paintable() const
 {
     return Painting::SVGGeometryPaintable::create(*this);
 }
diff --git a/Userland/Libraries/LibWeb/Layout/SVGGeometryBox.h b/Userland/Libraries/LibWeb/Layout/SVGGeometryBox.h
index 2f7f415028..ee01454cae 100644
--- a/Userland/Libraries/LibWeb/Layout/SVGGeometryBox.h
+++ b/Userland/Libraries/LibWeb/Layout/SVGGeometryBox.h
@@ -24,7 +24,7 @@ public:
     float viewbox_scaling() const;
     CSSPixelPoint viewbox_origin() const;
 
-    virtual RefPtr<Painting::Paintable> create_paintable() const override;
+    virtual JS::GCPtr<Painting::Paintable> create_paintable() const override;
 
 private:
     virtual bool is_svg_geometry_box() const final { return true; }
diff --git a/Userland/Libraries/LibWeb/Layout/SVGSVGBox.cpp b/Userland/Libraries/LibWeb/Layout/SVGSVGBox.cpp
index 7b6289fbef..53d1b4967a 100644
--- a/Userland/Libraries/LibWeb/Layout/SVGSVGBox.cpp
+++ b/Userland/Libraries/LibWeb/Layout/SVGSVGBox.cpp
@@ -17,7 +17,7 @@ SVGSVGBox::SVGSVGBox(DOM::Document& document, SVG::SVGSVGElement& element, Nonnu
 {
 }
 
-RefPtr<Painting::Paintable> SVGSVGBox::create_paintable() const
+JS::GCPtr<Painting::Paintable> SVGSVGBox::create_paintable() const
 {
     return Painting::SVGSVGPaintable::create(*this);
 }
diff --git a/Userland/Libraries/LibWeb/Layout/SVGSVGBox.h b/Userland/Libraries/LibWeb/Layout/SVGSVGBox.h
index ee681c23c1..d63052879e 100644
--- a/Userland/Libraries/LibWeb/Layout/SVGSVGBox.h
+++ b/Userland/Libraries/LibWeb/Layout/SVGSVGBox.h
@@ -22,7 +22,7 @@ public:
 
     virtual bool can_have_children() const override { return true; }
 
-    virtual RefPtr<Painting::Paintable> create_paintable() const override;
+    virtual JS::GCPtr<Painting::Paintable> create_paintable() const override;
 
     virtual void prepare_for_replaced_layout() override;
 };
diff --git a/Userland/Libraries/LibWeb/Layout/TextNode.cpp b/Userland/Libraries/LibWeb/Layout/TextNode.cpp
index cb866d021a..67ccb5d15f 100644
--- a/Userland/Libraries/LibWeb/Layout/TextNode.cpp
+++ b/Userland/Libraries/LibWeb/Layout/TextNode.cpp
@@ -188,7 +188,7 @@ Optional<TextNode::Chunk> TextNode::ChunkIterator::try_commit_chunk(Utf8View::It
     return {};
 }
 
-RefPtr<Painting::Paintable> TextNode::create_paintable() const
+JS::GCPtr<Painting::Paintable> TextNode::create_paintable() const
 {
     return Painting::TextPaintable::create(*this);
 }
diff --git a/Userland/Libraries/LibWeb/Layout/TextNode.h b/Userland/Libraries/LibWeb/Layout/TextNode.h
index 933e63f22b..0ec5fd84ef 100644
--- a/Userland/Libraries/LibWeb/Layout/TextNode.h
+++ b/Userland/Libraries/LibWeb/Layout/TextNode.h
@@ -50,7 +50,7 @@ public:
 
     void compute_text_for_rendering(bool collapse);
 
-    virtual RefPtr<Painting::Paintable> create_paintable() const override;
+    virtual JS::GCPtr<Painting::Paintable> create_paintable() const override;
 
 private:
     virtual bool is_text_node() const final { return true; }
diff --git a/Userland/Libraries/LibWeb/Page/EventHandler.cpp b/Userland/Libraries/LibWeb/Page/EventHandler.cpp
index e196773ed0..c493602cb1 100644
--- a/Userland/Libraries/LibWeb/Page/EventHandler.cpp
+++ b/Userland/Libraries/LibWeb/Page/EventHandler.cpp
@@ -160,7 +160,7 @@ bool EventHandler::handle_mousewheel(CSSPixelPoint position, unsigned button, un
 
     bool handled_event = false;
 
-    RefPtr<Painting::Paintable> paintable;
+    JS::GCPtr<Painting::Paintable> paintable;
     if (m_mouse_event_tracking_layout_node) {
         paintable = m_mouse_event_tracking_layout_node->paintable();
     } else {
@@ -208,7 +208,7 @@ bool EventHandler::handle_mouseup(CSSPixelPoint position, unsigned button, unsig
 
     bool handled_event = false;
 
-    RefPtr<Painting::Paintable> paintable;
+    JS::GCPtr<Painting::Paintable> paintable;
     if (m_mouse_event_tracking_layout_node) {
         paintable = m_mouse_event_tracking_layout_node->paintable();
     } else {
@@ -327,7 +327,7 @@ bool EventHandler::handle_mousedown(CSSPixelPoint position, unsigned button, uns
     JS::GCPtr<DOM::Node> node;
 
     {
-        RefPtr<Painting::Paintable> paintable;
+        JS::GCPtr<Painting::Paintable> paintable;
         if (m_mouse_event_tracking_layout_node) {
             paintable = m_mouse_event_tracking_layout_node->paintable();
         } else {
@@ -422,7 +422,7 @@ bool EventHandler::handle_mousemove(CSSPixelPoint position, unsigned buttons, un
     bool is_hovering_link = false;
     Gfx::StandardCursor hovered_node_cursor = Gfx::StandardCursor::None;
 
-    RefPtr<Painting::Paintable> paintable;
+    JS::GCPtr<Painting::Paintable> paintable;
     Optional<int> start_index;
     if (m_mouse_event_tracking_layout_node) {
         paintable = m_mouse_event_tracking_layout_node->paintable();
@@ -530,7 +530,7 @@ bool EventHandler::handle_doubleclick(CSSPixelPoint position, unsigned button, u
     if (!paint_root())
         return false;
 
-    RefPtr<Painting::Paintable> paintable;
+    JS::GCPtr<Painting::Paintable> paintable;
     if (m_mouse_event_tracking_layout_node) {
         paintable = m_mouse_event_tracking_layout_node->paintable();
     } else {
diff --git a/Userland/Libraries/LibWeb/Painting/ButtonPaintable.cpp b/Userland/Libraries/LibWeb/Painting/ButtonPaintable.cpp
index 04ce0b3d1d..60a0f03596 100644
--- a/Userland/Libraries/LibWeb/Painting/ButtonPaintable.cpp
+++ b/Userland/Libraries/LibWeb/Painting/ButtonPaintable.cpp
@@ -13,9 +13,9 @@
 
 namespace Web::Painting {
 
-NonnullRefPtr<ButtonPaintable> ButtonPaintable::create(Layout::ButtonBox const& layout_box)
+JS::NonnullGCPtr<ButtonPaintable> ButtonPaintable::create(Layout::ButtonBox const& layout_box)
 {
-    return adopt_ref(*new ButtonPaintable(layout_box));
+    return layout_box.heap().allocate_without_realm<ButtonPaintable>(layout_box);
 }
 
 ButtonPaintable::ButtonPaintable(Layout::ButtonBox const& layout_box)
diff --git a/Userland/Libraries/LibWeb/Painting/ButtonPaintable.h b/Userland/Libraries/LibWeb/Painting/ButtonPaintable.h
index 890641a309..ea974b3790 100644
--- a/Userland/Libraries/LibWeb/Painting/ButtonPaintable.h
+++ b/Userland/Libraries/LibWeb/Painting/ButtonPaintable.h
@@ -12,8 +12,10 @@
 namespace Web::Painting {
 
 class ButtonPaintable final : public LabelablePaintable {
+    JS_CELL(ButtonPaintable, LabelablePaintable);
+
 public:
-    static NonnullRefPtr<ButtonPaintable> create(Layout::ButtonBox const&);
+    static JS::NonnullGCPtr<ButtonPaintable> create(Layout::ButtonBox const&);
 
     virtual void paint(PaintContext&, PaintPhase) const override;
 
diff --git a/Userland/Libraries/LibWeb/Painting/CanvasPaintable.cpp b/Userland/Libraries/LibWeb/Painting/CanvasPaintable.cpp
index f472d41dab..034c474903 100644
--- a/Userland/Libraries/LibWeb/Painting/CanvasPaintable.cpp
+++ b/Userland/Libraries/LibWeb/Painting/CanvasPaintable.cpp
@@ -8,9 +8,9 @@
 
 namespace Web::Painting {
 
-NonnullRefPtr<CanvasPaintable> CanvasPaintable::create(Layout::CanvasBox const& layout_box)
+JS::NonnullGCPtr<CanvasPaintable> CanvasPaintable::create(Layout::CanvasBox const& layout_box)
 {
-    return adopt_ref(*new CanvasPaintable(layout_box));
+    return layout_box.heap().allocate_without_realm<CanvasPaintable>(layout_box);
 }
 
 CanvasPaintable::CanvasPaintable(Layout::CanvasBox const& layout_box)
diff --git a/Userland/Libraries/LibWeb/Painting/CanvasPaintable.h b/Userland/Libraries/LibWeb/Painting/CanvasPaintable.h
index 8b369b16f5..6a867e5c78 100644
--- a/Userland/Libraries/LibWeb/Painting/CanvasPaintable.h
+++ b/Userland/Libraries/LibWeb/Painting/CanvasPaintable.h
@@ -12,8 +12,10 @@
 namespace Web::Painting {
 
 class CanvasPaintable final : public PaintableBox {
+    JS_CELL(CanvasPaintable, PaintableBox);
+
 public:
-    static NonnullRefPtr<CanvasPaintable> create(Layout::CanvasBox const&);
+    static JS::NonnullGCPtr<CanvasPaintable> create(Layout::CanvasBox const&);
 
     virtual void paint(PaintContext&, PaintPhase) const override;
 
diff --git a/Userland/Libraries/LibWeb/Painting/CheckBoxPaintable.cpp b/Userland/Libraries/LibWeb/Painting/CheckBoxPaintable.cpp
index b2a479bf8a..b566a4d2b2 100644
--- a/Userland/Libraries/LibWeb/Painting/CheckBoxPaintable.cpp
+++ b/Userland/Libraries/LibWeb/Painting/CheckBoxPaintable.cpp
@@ -14,9 +14,9 @@
 
 namespace Web::Painting {
 
-NonnullRefPtr<CheckBoxPaintable> CheckBoxPaintable::create(Layout::CheckBox const& layout_box)
+JS::NonnullGCPtr<CheckBoxPaintable> CheckBoxPaintable::create(Layout::CheckBox const& layout_box)
 {
-    return adopt_ref(*new CheckBoxPaintable(layout_box));
+    return layout_box.heap().allocate_without_realm<CheckBoxPaintable>(layout_box);
 }
 
 CheckBoxPaintable::CheckBoxPaintable(Layout::CheckBox const& layout_box)
diff --git a/Userland/Libraries/LibWeb/Painting/CheckBoxPaintable.h b/Userland/Libraries/LibWeb/Painting/CheckBoxPaintable.h
index 1d3ac98b62..262ad8eade 100644
--- a/Userland/Libraries/LibWeb/Painting/CheckBoxPaintable.h
+++ b/Userland/Libraries/LibWeb/Painting/CheckBoxPaintable.h
@@ -12,8 +12,10 @@
 namespace Web::Painting {
 
 class CheckBoxPaintable final : public LabelablePaintable {
+    JS_CELL(CheckBoxPaintable, LabelablePaintable);
+
 public:
-    static NonnullRefPtr<CheckBoxPaintable> create(Layout::CheckBox const&);
+    static JS::NonnullGCPtr<CheckBoxPaintable> create(Layout::CheckBox const&);
 
     virtual void paint(PaintContext&, PaintPhase) const override;
 
diff --git a/Userland/Libraries/LibWeb/Painting/ImagePaintable.cpp b/Userland/Libraries/LibWeb/Painting/ImagePaintable.cpp
index f572a41bfe..01c084a8f2 100644
--- a/Userland/Libraries/LibWeb/Painting/ImagePaintable.cpp
+++ b/Userland/Libraries/LibWeb/Painting/ImagePaintable.cpp
@@ -13,9 +13,9 @@
 
 namespace Web::Painting {
 
-NonnullRefPtr<ImagePaintable> ImagePaintable::create(Layout::ImageBox const& layout_box)
+JS::NonnullGCPtr<ImagePaintable> ImagePaintable::create(Layout::ImageBox const& layout_box)
 {
-    return adopt_ref(*new ImagePaintable(layout_box));
+    return layout_box.heap().allocate_without_realm<ImagePaintable>(layout_box);
 }
 
 ImagePaintable::ImagePaintable(Layout::ImageBox const& layout_box)
diff --git a/Userland/Libraries/LibWeb/Painting/ImagePaintable.h b/Userland/Libraries/LibWeb/Painting/ImagePaintable.h
index 377a4e377c..ac8db5ddff 100644
--- a/Userland/Libraries/LibWeb/Painting/ImagePaintable.h
+++ b/Userland/Libraries/LibWeb/Painting/ImagePaintable.h
@@ -12,8 +12,10 @@
 namespace Web::Painting {
 
 class ImagePaintable final : public PaintableBox {
+    JS_CELL(ImagePaintable, PaintableBox);
+
 public:
-    static NonnullRefPtr<ImagePaintable> create(Layout::ImageBox const&);
+    static JS::NonnullGCPtr<ImagePaintable> create(Layout::ImageBox const&);
 
     virtual void paint(PaintContext&, PaintPhase) const override;
 
diff --git a/Userland/Libraries/LibWeb/Painting/InlinePaintable.cpp b/Userland/Libraries/LibWeb/Painting/InlinePaintable.cpp
index 1ddd5ae2cc..2350e841d0 100644
--- a/Userland/Libraries/LibWeb/Painting/InlinePaintable.cpp
+++ b/Userland/Libraries/LibWeb/Painting/InlinePaintable.cpp
@@ -14,9 +14,9 @@
 
 namespace Web::Painting {
 
-NonnullRefPtr<InlinePaintable> InlinePaintable::create(Layout::InlineNode const& layout_node)
+JS::NonnullGCPtr<InlinePaintable> InlinePaintable::create(Layout::InlineNode const& layout_node)
 {
-    return adopt_ref(*new InlinePaintable(layout_node));
+    return layout_node.heap().allocate_without_realm<InlinePaintable>(layout_node);
 }
 
 InlinePaintable::InlinePaintable(Layout::InlineNode const& layout_node)
diff --git a/Userland/Libraries/LibWeb/Painting/InlinePaintable.h b/Userland/Libraries/LibWeb/Painting/InlinePaintable.h
index 5d5750fa5a..f53e20fcb4 100644
--- a/Userland/Libraries/LibWeb/Painting/InlinePaintable.h
+++ b/Userland/Libraries/LibWeb/Painting/InlinePaintable.h
@@ -12,8 +12,10 @@
 namespace Web::Painting {
 
 class InlinePaintable final : public Paintable {
+    JS_CELL(InlinePaintable, Paintable);
+
 public:
-    static NonnullRefPtr<InlinePaintable> create(Layout::InlineNode const&);
+    static JS::NonnullGCPtr<InlinePaintable> create(Layout::InlineNode const&);
 
     virtual void paint(PaintContext&, PaintPhase) const override;
 
diff --git a/Userland/Libraries/LibWeb/Painting/LabelablePaintable.cpp b/Userland/Libraries/LibWeb/Painting/LabelablePaintable.cpp
index 8becfa0812..c9e09ad5ab 100644
--- a/Userland/Libraries/LibWeb/Painting/LabelablePaintable.cpp
+++ b/Userland/Libraries/LibWeb/Painting/LabelablePaintable.cpp
@@ -81,10 +81,6 @@ void LabelablePaintable::handle_associated_label_mousedown(Badge<Layout::Label>)
 
 void LabelablePaintable::handle_associated_label_mouseup(Badge<Layout::Label>)
 {
-    // NOTE: Handling the click may run arbitrary JS, which could disappear this node.
-    NonnullRefPtr protected_this = *this;
-    JS::NonnullGCPtr protected_browsing_context { browsing_context() };
-
     set_being_pressed(false);
 }
 
diff --git a/Userland/Libraries/LibWeb/Painting/LabelablePaintable.h b/Userland/Libraries/LibWeb/Painting/LabelablePaintable.h
index c64555c127..c5f931aefd 100644
--- a/Userland/Libraries/LibWeb/Painting/LabelablePaintable.h
+++ b/Userland/Libraries/LibWeb/Painting/LabelablePaintable.h
@@ -16,6 +16,8 @@ namespace Web::Painting {
 // FIXME: Splinter this into FormAssociatedLabelablePaintable once
 //        ProgressPaintable switches over to this.
 class LabelablePaintable : public PaintableBox {
+    JS_CELL(LabelablePaintable, PaintableBox);
+
 public:
     Layout::FormAssociatedLabelableNode const& layout_box() const;
     Layout::FormAssociatedLabelableNode& layout_box();
diff --git a/Userland/Libraries/LibWeb/Painting/MarkerPaintable.cpp b/Userland/Libraries/LibWeb/Painting/MarkerPaintable.cpp
index e16cb39d69..4fe591a181 100644
--- a/Userland/Libraries/LibWeb/Painting/MarkerPaintable.cpp
+++ b/Userland/Libraries/LibWeb/Painting/MarkerPaintable.cpp
@@ -11,9 +11,9 @@
 
 namespace Web::Painting {
 
-NonnullRefPtr<MarkerPaintable> MarkerPaintable::create(Layout::ListItemMarkerBox const& layout_box)
+JS::NonnullGCPtr<MarkerPaintable> MarkerPaintable::create(Layout::ListItemMarkerBox const& layout_box)
 {
-    return adopt_ref(*new MarkerPaintable(layout_box));
+    return layout_box.heap().allocate_without_realm<MarkerPaintable>(layout_box);
 }
 
 MarkerPaintable::MarkerPaintable(Layout::ListItemMarkerBox const& layout_box)
diff --git a/Userland/Libraries/LibWeb/Painting/MarkerPaintable.h b/Userland/Libraries/LibWeb/Painting/MarkerPaintable.h
index 77e8edee1d..5f18c6a48f 100644
--- a/Userland/Libraries/LibWeb/Painting/MarkerPaintable.h
+++ b/Userland/Libraries/LibWeb/Painting/MarkerPaintable.h
@@ -12,8 +12,10 @@
 namespace Web::Painting {
 
 class MarkerPaintable final : public PaintableBox {
+    JS_CELL(MarkerPaintable, PaintableBox);
+
 public:
-    static NonnullRefPtr<MarkerPaintable> create(Layout::ListItemMarkerBox const&);
+    static JS::NonnullGCPtr<MarkerPaintable> create(Layout::ListItemMarkerBox const&);
 
     virtual void paint(PaintContext&, PaintPhase) const override;
 
diff --git a/Userland/Libraries/LibWeb/Painting/NestedBrowsingContextPaintable.cpp b/Userland/Libraries/LibWeb/Painting/NestedBrowsingContextPaintable.cpp
index 7db227ba02..229c71aa8b 100644
--- a/Userland/Libraries/LibWeb/Painting/NestedBrowsingContextPaintable.cpp
+++ b/Userland/Libraries/LibWeb/Painting/NestedBrowsingContextPaintable.cpp
@@ -13,9 +13,9 @@
 
 namespace Web::Painting {
 
-NonnullRefPtr<NestedBrowsingContextPaintable> NestedBrowsingContextPaintable::create(Layout::FrameBox const& layout_box)
+JS::NonnullGCPtr<NestedBrowsingContextPaintable> NestedBrowsingContextPaintable::create(Layout::FrameBox const& layout_box)
 {
-    return adopt_ref(*new NestedBrowsingContextPaintable(layout_box));
+    return layout_box.heap().allocate_without_realm<NestedBrowsingContextPaintable>(layout_box);
 }
 
 NestedBrowsingContextPaintable::NestedBrowsingContextPaintable(Layout::FrameBox const& layout_box)
diff --git a/Userland/Libraries/LibWeb/Painting/NestedBrowsingContextPaintable.h b/Userland/Libraries/LibWeb/Painting/NestedBrowsingContextPaintable.h
index 559f0ff15c..ca0e1bbbb8 100644
--- a/Userland/Libraries/LibWeb/Painting/NestedBrowsingContextPaintable.h
+++ b/Userland/Libraries/LibWeb/Painting/NestedBrowsingContextPaintable.h
@@ -12,8 +12,10 @@
 namespace Web::Painting {
 
 class NestedBrowsingContextPaintable final : public PaintableBox {
+    JS_CELL(NestedBrowsingContextPaintable, PaintableBox);
+
 public:
-    static NonnullRefPtr<NestedBrowsingContextPaintable> create(Layout::FrameBox const&);
+    static JS::NonnullGCPtr<NestedBrowsingContextPaintable> create(Layout::FrameBox const&);
 
     virtual void paint(PaintContext&, PaintPhase) const override;
 
diff --git a/Userland/Libraries/LibWeb/Painting/Paintable.cpp b/Userland/Libraries/LibWeb/Painting/Paintable.cpp
index 37154bc3d2..61ce2b96c9 100644
--- a/Userland/Libraries/LibWeb/Painting/Paintable.cpp
+++ b/Userland/Libraries/LibWeb/Painting/Paintable.cpp
@@ -10,6 +10,12 @@
 
 namespace Web::Painting {
 
+void Paintable::visit_edges(Cell::Visitor& visitor)
+{
+    Base::visit_edges(visitor);
+    visitor.visit(m_layout_node);
+}
+
 Paintable::DispatchEventOfSameName Paintable::handle_mousedown(Badge<EventHandler>, CSSPixelPoint, unsigned, unsigned)
 {
     return DispatchEventOfSameName::Yes;
@@ -48,7 +54,7 @@ Optional<HitTestResult> Paintable::hit_test(CSSPixelPoint, HitTestType) const
 
 Paintable const* Paintable::first_child() const
 {
-    auto* layout_child = m_layout_node.first_child();
+    auto* layout_child = m_layout_node->first_child();
     for (; layout_child && !layout_child->paintable(); layout_child = layout_child->next_sibling())
         ;
     return layout_child ? layout_child->paintable() : nullptr;
@@ -56,7 +62,7 @@ Paintable const* Paintable::first_child() const
 
 Paintable const* Paintable::next_sibling() const
 {
-    auto* layout_node = m_layout_node.next_sibling();
+    auto* layout_node = m_layout_node->next_sibling();
     for (; layout_node && !layout_node->paintable(); layout_node = layout_node->next_sibling())
         ;
     return layout_node ? layout_node->paintable() : nullptr;
@@ -64,7 +70,7 @@ Paintable const* Paintable::next_sibling() const
 
 Paintable const* Paintable::last_child() const
 {
-    auto* layout_child = m_layout_node.last_child();
+    auto* layout_child = m_layout_node->last_child();
     for (; layout_child && !layout_child->paintable(); layout_child = layout_child->previous_sibling())
         ;
     return layout_child ? layout_child->paintable() : nullptr;
@@ -72,7 +78,7 @@ Paintable const* Paintable::last_child() const
 
 Paintable const* Paintable::previous_sibling() const
 {
-    auto* layout_node = m_layout_node.previous_sibling();
+    auto* layout_node = m_layout_node->previous_sibling();
     for (; layout_node && !layout_node->paintable(); layout_node = layout_node->previous_sibling())
         ;
     return layout_node ? layout_node->paintable() : nullptr;
diff --git a/Userland/Libraries/LibWeb/Painting/Paintable.h b/Userland/Libraries/LibWeb/Painting/Paintable.h
index e791aa6c63..9214208313 100644
--- a/Userland/Libraries/LibWeb/Painting/Paintable.h
+++ b/Userland/Libraries/LibWeb/Painting/Paintable.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2022, Andreas Kling <kling@serenityos.org>
+ * Copyright (c) 2022-2023, Andreas Kling <kling@serenityos.org>
  *
  * SPDX-License-Identifier: BSD-2-Clause
  */
@@ -28,7 +28,7 @@ enum class PaintPhase {
 };
 
 struct HitTestResult {
-    NonnullRefPtr<Painting::Paintable> paintable;
+    JS::Handle<Painting::Paintable> paintable;
     int index_in_node { 0 };
 
     enum InternalPosition {
@@ -48,9 +48,8 @@ enum class HitTestType {
     TextCursor, // Clicking past the right/bottom edge of text will still hit the text
 };
 
-class Paintable : public RefCounted<Paintable> {
-    AK_MAKE_NONMOVABLE(Paintable);
-    AK_MAKE_NONCOPYABLE(Paintable);
+class Paintable : public JS::Cell {
+    JS_CELL(Paintable, Cell);
 
 public:
     virtual ~Paintable() = default;
@@ -108,24 +107,24 @@ public:
     virtual bool handle_mousewheel(Badge<EventHandler>, CSSPixelPoint, unsigned buttons, unsigned modifiers, int wheel_delta_x, int wheel_delta_y);
 
     Layout::Node const& layout_node() const { return m_layout_node; }
-    Layout::Node& layout_node() { return const_cast<Layout::Node&>(m_layout_node); }
+    Layout::Node& layout_node() { return const_cast<Layout::Node&>(*m_layout_node); }
 
     DOM::Node* dom_node() { return layout_node().dom_node(); }
     DOM::Node const* dom_node() const { return layout_node().dom_node(); }
 
-    auto const& computed_values() const { return m_layout_node.computed_values(); }
+    auto const& computed_values() const { return m_layout_node->computed_values(); }
 
     bool visible_for_hit_testing() const { return computed_values().pointer_events() != CSS::PointerEvents::None; }
 
-    HTML::BrowsingContext const& browsing_context() const { return m_layout_node.browsing_context(); }
+    HTML::BrowsingContext const& browsing_context() const { return m_layout_node->browsing_context(); }
     HTML::BrowsingContext& browsing_context() { return layout_node().browsing_context(); }
 
-    void set_needs_display() const { const_cast<Layout::Node&>(m_layout_node).set_needs_display(); }
+    void set_needs_display() const { const_cast<Layout::Node&>(*m_layout_node).set_needs_display(); }
 
     Layout::BlockContainer const* containing_block() const
     {
         if (!m_containing_block.has_value())
-            m_containing_block = const_cast<Layout::Node&>(m_layout_node).containing_block();
+            m_containing_block = m_layout_node->containing_block();
         return *m_containing_block;
     }
 
@@ -138,8 +137,10 @@ protected:
     {
     }
 
+    virtual void visit_edges(Cell::Visitor&) override;
+
 private:
-    Layout::Node const& m_layout_node;
+    JS::NonnullGCPtr<Layout::Node> m_layout_node;
     Optional<Layout::BlockContainer*> mutable m_containing_block;
 };
 
@@ -154,6 +155,6 @@ inline DOM::Node const* HitTestResult::dom_node() const
 }
 
 template<>
-inline bool Paintable::fast_is<PaintableBox>() const { return m_layout_node.is_box(); }
+inline bool Paintable::fast_is<PaintableBox>() const { return m_layout_node->is_box(); }
 
 }
diff --git a/Userland/Libraries/LibWeb/Painting/PaintableBox.cpp b/Userland/Libraries/LibWeb/Painting/PaintableBox.cpp
index 5021dd6819..213e36a2cd 100644
--- a/Userland/Libraries/LibWeb/Painting/PaintableBox.cpp
+++ b/Userland/Libraries/LibWeb/Painting/PaintableBox.cpp
@@ -19,9 +19,14 @@
 
 namespace Web::Painting {
 
-NonnullRefPtr<PaintableBox> PaintableBox::create(Layout::Box const& layout_box)
+JS::NonnullGCPtr<PaintableWithLines> PaintableWithLines::create(Layout::BlockContainer const& block_container)
 {
-    return adopt_ref(*new PaintableBox(layout_box));
+    return block_container.heap().allocate_without_realm<PaintableWithLines>(block_container);
+}
+
+JS::NonnullGCPtr<PaintableBox> PaintableBox::create(Layout::Box const& layout_box)
+{
+    return layout_box.heap().allocate_without_realm<PaintableBox>(layout_box);
 }
 
 PaintableBox::PaintableBox(Layout::Box const& layout_box)
@@ -679,7 +684,7 @@ Optional<HitTestResult> PaintableBox::hit_test(CSSPixelPoint position, HitTestTy
             continue;
         return result;
     }
-    return HitTestResult { *this };
+    return HitTestResult { const_cast<PaintableBox&>(*this) };
 }
 
 Optional<HitTestResult> PaintableWithLines::hit_test(CSSPixelPoint position, HitTestType type) const
@@ -700,7 +705,7 @@ Optional<HitTestResult> PaintableWithLines::hit_test(CSSPixelPoint position, Hit
             if (fragment_absolute_rect.contains(position)) {
                 if (is<Layout::BlockContainer>(fragment.layout_node()) && fragment.layout_node().paintable())
                     return fragment.layout_node().paintable()->hit_test(position, type);
-                return HitTestResult { *fragment.layout_node().paintable(), fragment.text_index_at(position.x()) };
+                return HitTestResult { const_cast<Paintable&>(const_cast<Paintable&>(*fragment.layout_node().paintable())), fragment.text_index_at(position.x()) };
             }
 
             // If we reached this point, the position is not within the fragment. However, the fragment start or end might be the place to place the cursor.
@@ -709,14 +714,14 @@ Optional<HitTestResult> PaintableWithLines::hit_test(CSSPixelPoint position, Hit
             // We arbitrarily choose to consider the end of the line above and ignore the beginning of the line below.
             // If we knew the direction of selection, we could make a better choice.
             if (fragment_absolute_rect.bottom() <= position.y()) { // fully below the fragment
-                last_good_candidate = HitTestResult { *fragment.layout_node().paintable(), fragment.start() + fragment.length() };
+                last_good_candidate = HitTestResult { const_cast<Paintable&>(*fragment.layout_node().paintable()), fragment.start() + fragment.length() };
             } else if (fragment_absolute_rect.top() <= position.y()) { // vertically within the fragment
                 if (position.x() < fragment_absolute_rect.left()) {    // left of the fragment
                     if (!last_good_candidate.has_value()) {            // first fragment of the line
-                        last_good_candidate = HitTestResult { *fragment.layout_node().paintable(), fragment.start() };
+                        last_good_candidate = HitTestResult { const_cast<Paintable&>(*fragment.layout_node().paintable()), fragment.start() };
                     }
                 } else { // right of the fragment
-                    last_good_candidate = HitTestResult { *fragment.layout_node().paintable(), fragment.start() + fragment.length() };
+                    last_good_candidate = HitTestResult { const_cast<Paintable&>(*fragment.layout_node().paintable()), fragment.start() + fragment.length() };
                 }
             }
         }
@@ -725,7 +730,7 @@ Optional<HitTestResult> PaintableWithLines::hit_test(CSSPixelPoint position, Hit
     if (type == HitTestType::TextCursor && last_good_candidate.has_value())
         return last_good_candidate;
     if (is_visible() && absolute_border_box_rect().contains(position.x(), position.y()))
-        return HitTestResult { *this };
+        return HitTestResult { const_cast<PaintableWithLines&>(*this) };
     return {};
 }
 
diff --git a/Userland/Libraries/LibWeb/Painting/PaintableBox.h b/Userland/Libraries/LibWeb/Painting/PaintableBox.h
index e2f140f394..f814e86a65 100644
--- a/Userland/Libraries/LibWeb/Painting/PaintableBox.h
+++ b/Userland/Libraries/LibWeb/Painting/PaintableBox.h
@@ -14,8 +14,10 @@
 namespace Web::Painting {
 
 class PaintableBox : public Paintable {
+    JS_CELL(PaintableBox, Paintable);
+
 public:
-    static NonnullRefPtr<PaintableBox> create(Layout::Box const&);
+    static JS::NonnullGCPtr<PaintableBox> create(Layout::Box const&);
     virtual ~PaintableBox();
 
     virtual void paint(PaintContext&, PaintPhase) const override;
@@ -162,11 +164,10 @@ private:
 };
 
 class PaintableWithLines : public PaintableBox {
+    JS_CELL(PaintableWithLines, PaintableBox);
+
 public:
-    static NonnullRefPtr<PaintableWithLines> create(Layout::BlockContainer const& block_container)
-    {
-        return adopt_ref(*new PaintableWithLines(block_container));
-    }
+    static JS::NonnullGCPtr<PaintableWithLines> create(Layout::BlockContainer const&);
     virtual ~PaintableWithLines() override;
 
     Layout::BlockContainer const& layout_box() const;
diff --git a/Userland/Libraries/LibWeb/Painting/ProgressPaintable.cpp b/Userland/Libraries/LibWeb/Painting/ProgressPaintable.cpp
index 58db36fd33..dc97977c45 100644
--- a/Userland/Libraries/LibWeb/Painting/ProgressPaintable.cpp
+++ b/Userland/Libraries/LibWeb/Painting/ProgressPaintable.cpp
@@ -9,9 +9,9 @@
 
 namespace Web::Painting {
 
-NonnullRefPtr<ProgressPaintable> ProgressPaintable::create(Layout::Progress const& layout_box)
+JS::NonnullGCPtr<ProgressPaintable> ProgressPaintable::create(Layout::Progress const& layout_box)
 {
-    return adopt_ref(*new ProgressPaintable(layout_box));
+    return layout_box.heap().allocate_without_realm<ProgressPaintable>(layout_box);
 }
 
 ProgressPaintable::ProgressPaintable(Layout::Progress const& layout_box)
diff --git a/Userland/Libraries/LibWeb/Painting/ProgressPaintable.h b/Userland/Libraries/LibWeb/Painting/ProgressPaintable.h
index 162f4a2473..bd70698d8e 100644
--- a/Userland/Libraries/LibWeb/Painting/ProgressPaintable.h
+++ b/Userland/Libraries/LibWeb/Painting/ProgressPaintable.h
@@ -15,8 +15,10 @@ namespace Web::Painting {
 //        LabelablePaintable should be split into FormAssociatedLabelablePaintable once this
 //        happens.
 class ProgressPaintable final : public PaintableBox {
+    JS_CELL(ProgressPaintable, PaintableBox);
+
 public:
-    static NonnullRefPtr<ProgressPaintable> create(Layout::Progress const&);
+    static JS::NonnullGCPtr<ProgressPaintable> create(Layout::Progress const&);
 
     virtual void paint(PaintContext&, PaintPhase) const override;
 
diff --git a/Userland/Libraries/LibWeb/Painting/RadioButtonPaintable.cpp b/Userland/Libraries/LibWeb/Painting/RadioButtonPaintable.cpp
index 8534e3fe73..1aef4d2155 100644
--- a/Userland/Libraries/LibWeb/Painting/RadioButtonPaintable.cpp
+++ b/Userland/Libraries/LibWeb/Painting/RadioButtonPaintable.cpp
@@ -15,9 +15,9 @@
 
 namespace Web::Painting {
 
-NonnullRefPtr<RadioButtonPaintable> RadioButtonPaintable::create(Layout::RadioButton const& layout_box)
+JS::NonnullGCPtr<RadioButtonPaintable> RadioButtonPaintable::create(Layout::RadioButton const& layout_box)
 {
-    return adopt_ref(*new RadioButtonPaintable(layout_box));
+    return layout_box.heap().allocate_without_realm<RadioButtonPaintable>(layout_box);
 }
 
 RadioButtonPaintable::RadioButtonPaintable(Layout::RadioButton const& layout_box)
diff --git a/Userland/Libraries/LibWeb/Painting/RadioButtonPaintable.h b/Userland/Libraries/LibWeb/Painting/RadioButtonPaintable.h
index 7d929b994b..a0252b8b36 100644
--- a/Userland/Libraries/LibWeb/Painting/RadioButtonPaintable.h
+++ b/Userland/Libraries/LibWeb/Painting/RadioButtonPaintable.h
@@ -12,8 +12,10 @@
 namespace Web::Painting {
 
 class RadioButtonPaintable final : public LabelablePaintable {
+    JS_CELL(RadioButtonPaintable, LabelablePaintable);
+
 public:
-    static NonnullRefPtr<RadioButtonPaintable> create(Layout::RadioButton const&);
+    static JS::NonnullGCPtr<RadioButtonPaintable> create(Layout::RadioButton const&);
 
     virtual void paint(PaintContext&, PaintPhase) const override;
 
diff --git a/Userland/Libraries/LibWeb/Painting/SVGGeometryPaintable.cpp b/Userland/Libraries/LibWeb/Painting/SVGGeometryPaintable.cpp
index c8f20d5fa9..8a5edd8ce9 100644
--- a/Userland/Libraries/LibWeb/Painting/SVGGeometryPaintable.cpp
+++ b/Userland/Libraries/LibWeb/Painting/SVGGeometryPaintable.cpp
@@ -11,9 +11,9 @@
 
 namespace Web::Painting {
 
-NonnullRefPtr<SVGGeometryPaintable> SVGGeometryPaintable::create(Layout::SVGGeometryBox const& layout_box)
+JS::NonnullGCPtr<SVGGeometryPaintable> SVGGeometryPaintable::create(Layout::SVGGeometryBox const& layout_box)
 {
-    return adopt_ref(*new SVGGeometryPaintable(layout_box));
+    return layout_box.heap().allocate_without_realm<SVGGeometryPaintable>(layout_box);
 }
 
 SVGGeometryPaintable::SVGGeometryPaintable(Layout::SVGGeometryBox const& layout_box)
diff --git a/Userland/Libraries/LibWeb/Painting/SVGGeometryPaintable.h b/Userland/Libraries/LibWeb/Painting/SVGGeometryPaintable.h
index c39b8453ed..a77ca45ee7 100644
--- a/Userland/Libraries/LibWeb/Painting/SVGGeometryPaintable.h
+++ b/Userland/Libraries/LibWeb/Painting/SVGGeometryPaintable.h
@@ -12,8 +12,10 @@
 namespace Web::Painting {
 
 class SVGGeometryPaintable : public SVGGraphicsPaintable {
+    JS_CELL(SVGGeometryPaintable, SVGGraphicsPaintable);
+
 public:
-    static NonnullRefPtr<SVGGeometryPaintable> create(Layout::SVGGeometryBox const&);
+    static JS::NonnullGCPtr<SVGGeometryPaintable> create(Layout::SVGGeometryBox const&);
 
     virtual void paint(PaintContext&, PaintPhase) const override;
 
diff --git a/Userland/Libraries/LibWeb/Painting/SVGGraphicsPaintable.h b/Userland/Libraries/LibWeb/Painting/SVGGraphicsPaintable.h
index 56b1a2e488..61c7ad01b0 100644
--- a/Userland/Libraries/LibWeb/Painting/SVGGraphicsPaintable.h
+++ b/Userland/Libraries/LibWeb/Painting/SVGGraphicsPaintable.h
@@ -12,6 +12,8 @@
 namespace Web::Painting {
 
 class SVGGraphicsPaintable : public SVGPaintable {
+    JS_CELL(SVGGraphicsPaintable, SVGPaintable);
+
 public:
     virtual void before_children_paint(PaintContext&, PaintPhase) const override;
 
diff --git a/Userland/Libraries/LibWeb/Painting/SVGPaintable.h b/Userland/Libraries/LibWeb/Painting/SVGPaintable.h
index 0369ea12e0..f634b85030 100644
--- a/Userland/Libraries/LibWeb/Painting/SVGPaintable.h
+++ b/Userland/Libraries/LibWeb/Painting/SVGPaintable.h
@@ -12,6 +12,8 @@
 namespace Web::Painting {
 
 class SVGPaintable : public PaintableBox {
+    JS_CELL(SVGPaintable, PaintableBox);
+
 public:
     virtual void before_children_paint(PaintContext&, PaintPhase) const override;
     virtual void after_children_paint(PaintContext&, PaintPhase) const override;
diff --git a/Userland/Libraries/LibWeb/Painting/SVGSVGPaintable.cpp b/Userland/Libraries/LibWeb/Painting/SVGSVGPaintable.cpp
index d428af681a..61b6947547 100644
--- a/Userland/Libraries/LibWeb/Painting/SVGSVGPaintable.cpp
+++ b/Userland/Libraries/LibWeb/Painting/SVGSVGPaintable.cpp
@@ -9,9 +9,9 @@
 
 namespace Web::Painting {
 
-NonnullRefPtr<SVGSVGPaintable> SVGSVGPaintable::create(Layout::SVGSVGBox const& layout_box)
+JS::NonnullGCPtr<SVGSVGPaintable> SVGSVGPaintable::create(Layout::SVGSVGBox const& layout_box)
 {
-    return adopt_ref(*new SVGSVGPaintable(layout_box));
+    return layout_box.heap().allocate_without_realm<SVGSVGPaintable>(layout_box);
 }
 
 SVGSVGPaintable::SVGSVGPaintable(Layout::SVGSVGBox const& layout_box)
diff --git a/Userland/Libraries/LibWeb/Painting/SVGSVGPaintable.h b/Userland/Libraries/LibWeb/Painting/SVGSVGPaintable.h
index 443747abaa..dc7c6f1766 100644
--- a/Userland/Libraries/LibWeb/Painting/SVGSVGPaintable.h
+++ b/Userland/Libraries/LibWeb/Painting/SVGSVGPaintable.h
@@ -12,8 +12,10 @@
 namespace Web::Painting {
 
 class SVGSVGPaintable : public PaintableBox {
+    JS_CELL(SVGSVGPaintable, PaintableBox);
+
 public:
-    static NonnullRefPtr<SVGSVGPaintable> create(Layout::SVGSVGBox const&);
+    static JS::NonnullGCPtr<SVGSVGPaintable> create(Layout::SVGSVGBox const&);
 
     virtual void before_children_paint(PaintContext&, PaintPhase) const override;
     virtual void after_children_paint(PaintContext&, PaintPhase) const override;
diff --git a/Userland/Libraries/LibWeb/Painting/StackingContext.cpp b/Userland/Libraries/LibWeb/Painting/StackingContext.cpp
index 01ddd1f536..2b54e1e43b 100644
--- a/Userland/Libraries/LibWeb/Painting/StackingContext.cpp
+++ b/Userland/Libraries/LibWeb/Painting/StackingContext.cpp
@@ -578,7 +578,7 @@ Optional<HitTestResult> StackingContext::hit_test(CSSPixelPoint position, HitTes
     // 1. the background and borders of the element forming the stacking context.
     if (paintable().absolute_border_box_rect().contains(transformed_position.x().value(), transformed_position.y().value())) {
         return HitTestResult {
-            .paintable = paintable(),
+            .paintable = const_cast<PaintableBox&>(paintable()),
         };
     }
 
diff --git a/Userland/Libraries/LibWeb/Painting/TextPaintable.cpp b/Userland/Libraries/LibWeb/Painting/TextPaintable.cpp
index b7e6a146c2..09aa19ed60 100644
--- a/Userland/Libraries/LibWeb/Painting/TextPaintable.cpp
+++ b/Userland/Libraries/LibWeb/Painting/TextPaintable.cpp
@@ -12,9 +12,9 @@
 
 namespace Web::Painting {
 
-NonnullRefPtr<TextPaintable> TextPaintable::create(Layout::TextNode const& layout_node)
+JS::NonnullGCPtr<TextPaintable> TextPaintable::create(Layout::TextNode const& layout_node)
 {
-    return adopt_ref(*new TextPaintable(layout_node));
+    return layout_node.heap().allocate_without_realm<TextPaintable>(layout_node);
 }
 
 TextPaintable::TextPaintable(Layout::TextNode const& layout_node)
diff --git a/Userland/Libraries/LibWeb/Painting/TextPaintable.h b/Userland/Libraries/LibWeb/Painting/TextPaintable.h
index dd99ea2e7a..e27ecb6b79 100644
--- a/Userland/Libraries/LibWeb/Painting/TextPaintable.h
+++ b/Userland/Libraries/LibWeb/Painting/TextPaintable.h
@@ -11,8 +11,10 @@
 namespace Web::Painting {
 
 class TextPaintable : public Paintable {
+    JS_CELL(TextPaintable, Paintable);
+
 public:
-    static NonnullRefPtr<TextPaintable> create(Layout::TextNode const&);
+    static JS::NonnullGCPtr<TextPaintable> create(Layout::TextNode const&);
 
     Layout::TextNode const& layout_node() const { return static_cast<Layout::TextNode const&>(Paintable::layout_node()); }