LibWeb: Move Web prototypes and constructors to new Intrinsics object

This Intrinsics object hangs off of a new HostDefined struct that takes
the place of EnvironmentSettingsObject as the true [[HostDefined]] slot
on JS::Realm objects created by LibWeb.

This gets the intrinsics off of the GlobalObject, Window, similar to the
previous refactor of LibJS to move the intrinsics into the Realm's
[[Intrinics]] internal slot.

A side effect of this change is that we cannot fully initialize a Window
object until the [[HostDefined]] slot has been installed into the realm,
which happens with the creation of the WindowEnvironmentSettingsObject.

As such, any Window usage that has not been funned through a WindowESO
will not have any cached Web prototyped or constructors, and will not
have Window APIs available to javascript code. Currently this seems
limited to usage of Window in the CSS parser, but a subsequent commit
will clean those up to take Realm as well. However, this commit compiles
so let's cut it off here :^).

21 files changed, 238 insertions, 58 deletions

diff --git a/Userland/Libraries/LibWeb/Bindings/HostDefined.cpp b/Userland/Libraries/LibWeb/Bindings/HostDefined.cpp
new file mode 100644
index 0000000000..3d4a8d6ac4
--- /dev/null
+++ b/Userland/Libraries/LibWeb/Bindings/HostDefined.cpp
@@ -0,0 +1,22 @@
+/*
+ * Copyright (c) 2022, Andrew Kaster <akaster@serenityos.org>
+ *
+ * SPDX-License-Identifier: BSD-2-Clause
+ */
+
+#include <LibJS/Heap/Cell.h>
+#include <LibJS/Runtime/Realm.h>
+#include <LibWeb/Bindings/HostDefined.h>
+#include <LibWeb/Bindings/Intrinsics.h>
+#include <LibWeb/HTML/Scripting/Environments.h>
+
+namespace Web::Bindings {
+
+void HostDefined::visit_edges(JS::Cell::Visitor& visitor)
+{
+    JS::Realm::HostDefined::visit_edges(visitor);
+    visitor.visit(environment_settings_object);
+    visitor.visit(*intrinsics);
+}
+
+}
diff --git a/Userland/Libraries/LibWeb/Bindings/HostDefined.h b/Userland/Libraries/LibWeb/Bindings/HostDefined.h
new file mode 100644
index 0000000000..d4152bb517
--- /dev/null
+++ b/Userland/Libraries/LibWeb/Bindings/HostDefined.h
@@ -0,0 +1,35 @@
+/*
+ * Copyright (c) 2022, Andrew Kaster <akaster@serenityos.org>
+ *
+ * SPDX-License-Identifier: BSD-2-Clause
+ */
+
+#pragma once
+
+#include <AK/TypeCasts.h>
+#include <LibJS/Heap/GCPtr.h>
+#include <LibJS/Runtime/Realm.h>
+#include <LibWeb/Forward.h>
+
+namespace Web::Bindings {
+
+struct HostDefined : public JS::Realm::HostDefined {
+    HostDefined(JS::GCPtr<HTML::EnvironmentSettingsObject> eso, JS::NonnullGCPtr<Intrinsics> intrinsics)
+        : environment_settings_object(eso)
+        , intrinsics(intrinsics)
+    {
+    }
+    virtual ~HostDefined() override = default;
+    virtual void visit_edges(JS::Cell::Visitor& visitor) override;
+
+    // NOTE: Only the root execution environment in the main thread VM ever sets this to nullptr
+    JS::GCPtr<HTML::EnvironmentSettingsObject> environment_settings_object;
+    JS::NonnullGCPtr<Intrinsics> intrinsics;
+};
+
+inline HTML::EnvironmentSettingsObject& host_defined_environment_settings_object(JS::Realm& realm)
+{
+    return *verify_cast<HostDefined>(realm.host_defined())->environment_settings_object;
+}
+
+}
diff --git a/Userland/Libraries/LibWeb/Bindings/Intrinsics.cpp b/Userland/Libraries/LibWeb/Bindings/Intrinsics.cpp
new file mode 100644
index 0000000000..e133374317
--- /dev/null
+++ b/Userland/Libraries/LibWeb/Bindings/Intrinsics.cpp
@@ -0,0 +1,36 @@
+/*
+ * Copyright (c) 2022, Andrew Kaster <akaster@serenityos.org>
+ *
+ * SPDX-License-Identifier: BSD-2-Clause
+ */
+
+#include <AK/HashMap.h>
+#include <AK/String.h>
+#include <LibJS/Forward.h>
+#include <LibJS/Runtime/NativeFunction.h>
+#include <LibJS/Runtime/Object.h>
+#include <LibWeb/Bindings/Intrinsics.h>
+
+namespace Web::Bindings {
+
+JS::Object& Intrinsics::cached_web_prototype(String const& class_name)
+{
+    auto it = m_prototypes.find(class_name);
+    if (it == m_prototypes.end()) {
+        dbgln("Missing prototype: {}", class_name);
+    }
+    VERIFY(it != m_prototypes.end());
+    return *it->value;
+}
+
+void Intrinsics::visit_edges(JS::Cell::Visitor& visitor)
+{
+    Base::visit_edges(visitor);
+
+    for (auto& it : m_prototypes)
+        visitor.visit(it.value);
+    for (auto& it : m_constructors)
+        visitor.visit(it.value);
+}
+
+}
diff --git a/Userland/Libraries/LibWeb/Bindings/Intrinsics.h b/Userland/Libraries/LibWeb/Bindings/Intrinsics.h
new file mode 100644
index 0000000000..02f0601da8
--- /dev/null
+++ b/Userland/Libraries/LibWeb/Bindings/Intrinsics.h
@@ -0,0 +1,85 @@
+/*
+ * Copyright (c) 2022, Andrew Kaster <akaster@serenityos.org>
+ *
+ * SPDX-License-Identifier: BSD-2-Clause
+ */
+
+#pragma once
+
+#include <AK/Forward.h>
+#include <AK/HashMap.h>
+#include <LibJS/Forward.h>
+#include <LibJS/Heap/Cell.h>
+#include <LibJS/Heap/Heap.h>
+#include <LibJS/Runtime/VM.h>
+#include <LibWeb/Bindings/HostDefined.h>
+
+namespace Web::Bindings {
+
+class Intrinsics final : public JS::Cell {
+    JS_CELL(Intrinsics, JS::Cell);
+
+public:
+    Intrinsics(JS::Realm& realm)
+        : m_realm(realm)
+    {
+    }
+
+    JS::Object& cached_web_prototype(String const& class_name);
+
+    template<typename T>
+    JS::Object& ensure_web_prototype(String const& class_name)
+    {
+        auto it = m_prototypes.find(class_name);
+        if (it != m_prototypes.end())
+            return *it->value;
+        auto& realm = *m_realm;
+        auto* prototype = heap().allocate<T>(realm, realm);
+        m_prototypes.set(class_name, prototype);
+        return *prototype;
+    }
+
+    template<typename T>
+    JS::NativeFunction& ensure_web_constructor(String const& class_name)
+    {
+        auto it = m_constructors.find(class_name);
+        if (it != m_constructors.end())
+            return *it->value;
+        auto& realm = *m_realm;
+        auto* constructor = heap().allocate<T>(realm, realm);
+        m_constructors.set(class_name, constructor);
+        return *constructor;
+    }
+
+private:
+    virtual void visit_edges(JS::Cell::Visitor&) override;
+
+    HashMap<String, JS::Object*> m_prototypes;
+    HashMap<String, JS::NativeFunction*> m_constructors;
+
+    JS::NonnullGCPtr<JS::Realm> m_realm;
+};
+
+inline Intrinsics& host_defined_intrinsics(JS::Realm& realm)
+{
+    return *verify_cast<HostDefined>(realm.host_defined())->intrinsics;
+}
+
+template<typename T>
+JS::Object& ensure_web_prototype(JS::Realm& realm, String const& class_name)
+{
+    return host_defined_intrinsics(realm).ensure_web_prototype<T>(class_name);
+}
+
+template<typename T>
+JS::NativeFunction& ensure_web_constructor(JS::Realm& realm, String const& class_name)
+{
+    return host_defined_intrinsics(realm).ensure_web_constructor<T>(class_name);
+}
+
+inline JS::Object& cached_web_prototype(JS::Realm& realm, String const& class_name)
+{
+    return host_defined_intrinsics(realm).cached_web_prototype(class_name);
+}
+
+}
diff --git a/Userland/Libraries/LibWeb/Bindings/MainThreadVM.cpp b/Userland/Libraries/LibWeb/Bindings/MainThreadVM.cpp
index 421e580ddf..8e90f654ae 100644
--- a/Userland/Libraries/LibWeb/Bindings/MainThreadVM.cpp
+++ b/Userland/Libraries/LibWeb/Bindings/MainThreadVM.cpp
@@ -11,6 +11,7 @@
 #include <LibJS/Runtime/FinalizationRegistry.h>
 #include <LibJS/Runtime/NativeFunction.h>
 #include <LibJS/Runtime/VM.h>
+#include <LibWeb/Bindings/Intrinsics.h>
 #include <LibWeb/Bindings/LocationObject.h>
 #include <LibWeb/Bindings/MainThreadVM.h>
 #include <LibWeb/DOM/Document.h>
@@ -181,7 +182,7 @@ JS::VM& main_thread_vm()
             // 2. Queue a global task on the JavaScript engine task source given global to perform the following steps:
             HTML::queue_global_task(HTML::Task::Source::JavaScriptEngine, global, [&finalization_registry]() mutable {
                 // 1. Let entry be finalizationRegistry.[[CleanupCallback]].[[Callback]].[[Realm]]'s environment settings object.
-                auto& entry = verify_cast<HTML::EnvironmentSettingsObject>(*finalization_registry.cleanup_callback().callback.cell()->realm()->host_defined());
+                auto& entry = host_defined_environment_settings_object(*finalization_registry.cleanup_callback().callback.cell()->realm());
 
                 // 2. Check if we can run script with entry. If this returns "do not run", then return.
                 if (entry.can_run_script() == HTML::RunScriptDecision::DoNotRun)
@@ -207,7 +208,7 @@ JS::VM& main_thread_vm()
             // 1. If realm is not null, then let job settings be the settings object for realm. Otherwise, let job settings be null.
             HTML::EnvironmentSettingsObject* job_settings { nullptr };
             if (realm)
-                job_settings = verify_cast<HTML::EnvironmentSettingsObject>(realm->host_defined());
+                job_settings = &host_defined_environment_settings_object(*realm);
 
             // IMPLEMENTATION DEFINED: The JS spec says we must take implementation defined steps to make the currently active script or module at the time of HostEnqueuePromiseJob being invoked
             //                         also be the active script or module of the job at the time of its invocation.
@@ -312,6 +313,11 @@ JS::VM& main_thread_vm()
             },
             nullptr));
 
+        auto* root_realm = custom_data.root_execution_context->realm;
+        auto* intrinsics = root_realm->heap().allocate<Intrinsics>(*root_realm, *root_realm);
+        auto host_defined = make<HostDefined>(nullptr, *intrinsics);
+        root_realm->set_host_defined(move(host_defined));
+
         vm->push_execution_context(*custom_data.root_execution_context);
     }
     return *vm;
diff --git a/Userland/Libraries/LibWeb/Bindings/WindowObjectHelper.h b/Userland/Libraries/LibWeb/Bindings/WindowObjectHelper.h
index 84f60d0932..50fcfda5c0 100644
--- a/Userland/Libraries/LibWeb/Bindings/WindowObjectHelper.h
+++ b/Userland/Libraries/LibWeb/Bindings/WindowObjectHelper.h
@@ -394,8 +394,9 @@
 
 #define ADD_WINDOW_OBJECT_CONSTRUCTOR_AND_PROTOTYPE(interface_name, constructor_name, prototype_name)                                \
     {                                                                                                                                \
-        auto& prototype = ensure_web_prototype<Bindings::prototype_name>(#interface_name);                                           \
-        auto& constructor = ensure_web_constructor<Bindings::constructor_name>(#interface_name);                                     \
+        auto& prototype = Bindings::ensure_web_prototype<Bindings::prototype_name>(realm, #interface_name);                          \
+        auto& constructor = Bindings::ensure_web_constructor<Bindings::constructor_name>(realm, #interface_name);                    \
+        define_direct_property(#interface_name, &constructor, JS::Attribute::Writable | JS::Attribute::Configurable);                \
         prototype.define_direct_property(vm.names.constructor, &constructor, JS::Attribute::Writable | JS::Attribute::Configurable); \
         constructor.define_direct_property(vm.names.name, js_string(vm, #interface_name), JS::Attribute::Configurable);              \
     }
@@ -405,6 +406,7 @@
 
 #define ADD_WINDOW_OBJECT_INTERFACES                                                                \
     auto& vm = this->vm();                                                                          \
+    auto& realm = this->realm();                                                                    \
     ADD_WINDOW_OBJECT_INTERFACE(AbortController)                                                    \
     ADD_WINDOW_OBJECT_INTERFACE(AbortSignal)                                                        \
     ADD_WINDOW_OBJECT_INTERFACE(AbstractRange)                                                      \
diff --git a/Userland/Libraries/LibWeb/CMakeLists.txt b/Userland/Libraries/LibWeb/CMakeLists.txt
index 0633930fea..867988cc29 100644
--- a/Userland/Libraries/LibWeb/CMakeLists.txt
+++ b/Userland/Libraries/LibWeb/CMakeLists.txt
@@ -3,7 +3,9 @@ include(libweb_generators)
 set(SOURCES
     Bindings/AudioConstructor.cpp
     Bindings/CSSNamespace.cpp
+    Bindings/HostDefined.cpp
     Bindings/ImageConstructor.cpp
+    Bindings/Intrinsics.cpp
     Bindings/LegacyPlatformObject.cpp
     Bindings/LocationConstructor.cpp
     Bindings/LocationObject.cpp
diff --git a/Userland/Libraries/LibWeb/DOM/Document.cpp b/Userland/Libraries/LibWeb/DOM/Document.cpp
index 317fb3163d..e2c5ca2c0d 100644
--- a/Userland/Libraries/LibWeb/DOM/Document.cpp
+++ b/Userland/Libraries/LibWeb/DOM/Document.cpp
@@ -1087,7 +1087,7 @@ Color Document::visited_link_color() const
 HTML::EnvironmentSettingsObject& Document::relevant_settings_object()
 {
     // Then, the relevant settings object for a platform object o is the environment settings object of the relevant Realm for o.
-    return verify_cast<HTML::EnvironmentSettingsObject>(*realm().host_defined());
+    return Bindings::host_defined_environment_settings_object(realm());
 }
 
 JS::Value Document::run_javascript(StringView source, StringView filename)
diff --git a/Userland/Libraries/LibWeb/DOM/EventTarget.cpp b/Userland/Libraries/LibWeb/DOM/EventTarget.cpp
index df1b6855ef..244cad529e 100644
--- a/Userland/Libraries/LibWeb/DOM/EventTarget.cpp
+++ b/Userland/Libraries/LibWeb/DOM/EventTarget.cpp
@@ -556,7 +556,7 @@ void EventTarget::activate_event_handler(FlyString const& name, HTML::EventHandl
         0, "", &realm);
 
     // NOTE: As per the spec, the callback context is arbitrary.
-    auto* callback = realm.heap().allocate_without_realm<WebIDL::CallbackType>(*callback_function, verify_cast<HTML::EnvironmentSettingsObject>(*realm.host_defined()));
+    auto* callback = realm.heap().allocate_without_realm<WebIDL::CallbackType>(*callback_function, Bindings::host_defined_environment_settings_object(realm));
 
     // 5. Let listener be a new event listener whose type is the event handler event type corresponding to eventHandler and callback is callback.
     auto* listener = realm.heap().allocate_without_realm<DOMEventListener>();
diff --git a/Userland/Libraries/LibWeb/Forward.h b/Userland/Libraries/LibWeb/Forward.h
index d2f0b3c791..f225fdd09a 100644
--- a/Userland/Libraries/LibWeb/Forward.h
+++ b/Userland/Libraries/LibWeb/Forward.h
@@ -473,6 +473,7 @@ class URLSearchParamsIterator;
 }
 
 namespace Web::Bindings {
+class Intrinsics;
 class LocationObject;
 class OptionConstructor;
 class RangePrototype;
diff --git a/Userland/Libraries/LibWeb/HTML/BrowsingContext.cpp b/Userland/Libraries/LibWeb/HTML/BrowsingContext.cpp
index e90f88cae1..674dca3d5a 100644
--- a/Userland/Libraries/LibWeb/HTML/BrowsingContext.cpp
+++ b/Userland/Libraries/LibWeb/HTML/BrowsingContext.cpp
@@ -164,7 +164,7 @@ NonnullRefPtr<BrowsingContext> BrowsingContext::create_a_new_browsing_context(Pa
     auto load_timing_info = DOM::DocumentLoadTimingInfo();
     load_timing_info.navigation_start_time = HighResolutionTime::coarsen_time(
         unsafe_context_creation_time,
-        verify_cast<WindowEnvironmentSettingsObject>(window->realm().host_defined())->cross_origin_isolated_capability() == CanUseCrossOriginIsolatedAPIs::Yes);
+        verify_cast<WindowEnvironmentSettingsObject>(Bindings::host_defined_environment_settings_object(window->realm())).cross_origin_isolated_capability() == CanUseCrossOriginIsolatedAPIs::Yes);
 
     // 13. Let coop be a new cross-origin opener policy.
     auto coop = CrossOriginOpenerPolicy {};
diff --git a/Userland/Libraries/LibWeb/HTML/Scripting/Environments.cpp b/Userland/Libraries/LibWeb/HTML/Scripting/Environments.cpp
index b35390f70d..e28b49922d 100644
--- a/Userland/Libraries/LibWeb/HTML/Scripting/Environments.cpp
+++ b/Userland/Libraries/LibWeb/HTML/Scripting/Environments.cpp
@@ -286,7 +286,7 @@ EnvironmentSettingsObject& incumbent_settings_object()
     }
 
     // 3. Return context's Realm component's settings object.
-    return verify_cast<EnvironmentSettingsObject>(*context->realm->host_defined());
+    return Bindings::host_defined_environment_settings_object(*context->realm);
 }
 
 // https://html.spec.whatwg.org/multipage/webappapis.html#concept-incumbent-realm
@@ -310,7 +310,7 @@ EnvironmentSettingsObject& current_settings_object()
     auto& vm = event_loop.vm();
 
     // Then, the current settings object is the environment settings object of the current Realm Record.
-    return verify_cast<EnvironmentSettingsObject>(*vm.current_realm()->host_defined());
+    return Bindings::host_defined_environment_settings_object(*vm.current_realm());
 }
 
 // https://html.spec.whatwg.org/multipage/webappapis.html#current-global-object
@@ -334,7 +334,7 @@ JS::Realm& relevant_realm(JS::Object const& object)
 EnvironmentSettingsObject& relevant_settings_object(JS::Object const& object)
 {
     // Then, the relevant settings object for a platform object o is the environment settings object of the relevant Realm for o.
-    return verify_cast<EnvironmentSettingsObject>(*relevant_realm(object).host_defined());
+    return Bindings::host_defined_environment_settings_object(relevant_realm(object));
 }
 
 EnvironmentSettingsObject& relevant_settings_object(DOM::Node const& node)
diff --git a/Userland/Libraries/LibWeb/HTML/Scripting/Environments.h b/Userland/Libraries/LibWeb/HTML/Scripting/Environments.h
index c8fee5dd64..c2f34b1466 100644
--- a/Userland/Libraries/LibWeb/HTML/Scripting/Environments.h
+++ b/Userland/Libraries/LibWeb/HTML/Scripting/Environments.h
@@ -54,7 +54,9 @@ enum class RunScriptDecision {
 // https://html.spec.whatwg.org/multipage/webappapis.html#environment-settings-object
 struct EnvironmentSettingsObject
     : public Environment
-    , public JS::Realm::HostDefined {
+    , public JS::Cell {
+    JS_CELL(EnvironmentSettingsObject, JS::Cell);
+
     virtual ~EnvironmentSettingsObject() override;
 
     // https://html.spec.whatwg.org/multipage/webappapis.html#concept-environment-target-browsing-context
diff --git a/Userland/Libraries/LibWeb/HTML/Scripting/WindowEnvironmentSettingsObject.cpp b/Userland/Libraries/LibWeb/HTML/Scripting/WindowEnvironmentSettingsObject.cpp
index ad343bc023..94e861c64b 100644
--- a/Userland/Libraries/LibWeb/HTML/Scripting/WindowEnvironmentSettingsObject.cpp
+++ b/Userland/Libraries/LibWeb/HTML/Scripting/WindowEnvironmentSettingsObject.cpp
@@ -4,6 +4,8 @@
  * SPDX-License-Identifier: BSD-2-Clause
  */
 
+#include <LibWeb/Bindings/HostDefined.h>
+#include <LibWeb/Bindings/Intrinsics.h>
 #include <LibWeb/DOM/Document.h>
 #include <LibWeb/HTML/Scripting/WindowEnvironmentSettingsObject.h>
 #include <LibWeb/HTML/Window.h>
@@ -36,7 +38,7 @@ void WindowEnvironmentSettingsObject::setup(AK::URL const& creation_url, Nonnull
 
     // 3. Let settings object be a new environment settings object whose algorithms are defined as follows:
     // NOTE: See the functions defined for this class.
-    auto settings_object = adopt_own(*new WindowEnvironmentSettingsObject(window, move(execution_context)));
+    auto* settings_object = realm->heap().allocate<WindowEnvironmentSettingsObject>(*realm, window, move(execution_context));
 
     // 4. If reservedEnvironment is non-null, then:
     if (reserved_environment.has_value()) {
@@ -68,7 +70,14 @@ void WindowEnvironmentSettingsObject::setup(AK::URL const& creation_url, Nonnull
     settings_object->top_level_origin = top_level_origin;
 
     // 7. Set realm's [[HostDefined]] field to settings object.
-    realm->set_host_defined(move(settings_object));
+    // Non-Standard: We store the ESO next to the web intrinsics in a custom HostDefined object
+    auto* intrinsics = realm->heap().allocate<Bindings::Intrinsics>(*realm, *realm);
+    auto host_defined = make<Bindings::HostDefined>(*settings_object, *intrinsics);
+    realm->set_host_defined(move(host_defined));
+
+    // Non-Standard: We cannot fully initialize window object until *after* the we set up
+    //    the realm's [[HostDefined]] internal slot as the internal slot contains the web platform intrinsics
+    window.initialize_web_interfaces({});
 }
 
 // https://html.spec.whatwg.org/multipage/window-object.html#script-settings-for-window-objects:responsible-document
diff --git a/Userland/Libraries/LibWeb/HTML/Scripting/WindowEnvironmentSettingsObject.h b/Userland/Libraries/LibWeb/HTML/Scripting/WindowEnvironmentSettingsObject.h
index 48f3196d0e..47c25d9e85 100644
--- a/Userland/Libraries/LibWeb/HTML/Scripting/WindowEnvironmentSettingsObject.h
+++ b/Userland/Libraries/LibWeb/HTML/Scripting/WindowEnvironmentSettingsObject.h
@@ -12,6 +12,8 @@
 namespace Web::HTML {
 
 class WindowEnvironmentSettingsObject final : public EnvironmentSettingsObject {
+    JS_CELL(WindowEnvironmentSettingsObject, EnvironmentSettingsObject);
+
 public:
     static void setup(AK::URL const& creation_url, NonnullOwnPtr<JS::ExecutionContext>, Optional<Environment>, AK::URL top_level_creation_url, Origin top_level_origin);
 
diff --git a/Userland/Libraries/LibWeb/HTML/Scripting/WorkerEnvironmentSettingsObject.h b/Userland/Libraries/LibWeb/HTML/Scripting/WorkerEnvironmentSettingsObject.h
index 8631a88cd8..cac5fb546a 100644
--- a/Userland/Libraries/LibWeb/HTML/Scripting/WorkerEnvironmentSettingsObject.h
+++ b/Userland/Libraries/LibWeb/HTML/Scripting/WorkerEnvironmentSettingsObject.h
@@ -13,23 +13,27 @@
 namespace Web::HTML {
 
 class WorkerEnvironmentSettingsObject final
-    : public EnvironmentSettingsObject
-    , public Weakable<WorkerEnvironmentSettingsObject> {
+    : public EnvironmentSettingsObject {
+    JS_CELL(WindowEnvironmentSettingsObject, EnvironmentSettingsObject);
+
 public:
     WorkerEnvironmentSettingsObject(NonnullOwnPtr<JS::ExecutionContext> execution_context)
         : EnvironmentSettingsObject(move(execution_context))
     {
     }
 
-    static WeakPtr<WorkerEnvironmentSettingsObject> setup(NonnullOwnPtr<JS::ExecutionContext> execution_context /* FIXME: null or an environment reservedEnvironment, a URL topLevelCreationURL, and an origin topLevelOrigin */)
+    static JS::NonnullGCPtr<WorkerEnvironmentSettingsObject> setup(NonnullOwnPtr<JS::ExecutionContext> execution_context /* FIXME: null or an environment reservedEnvironment, a URL topLevelCreationURL, and an origin topLevelOrigin */)
     {
         auto* realm = execution_context->realm;
         VERIFY(realm);
-        auto settings_object = adopt_own(*new WorkerEnvironmentSettingsObject(move(execution_context)));
+        auto settings_object = realm->heap().allocate<WorkerEnvironmentSettingsObject>(*realm, move(execution_context));
         settings_object->target_browsing_context = nullptr;
-        realm->set_host_defined(move(settings_object));
 
-        return static_cast<WorkerEnvironmentSettingsObject*>(realm->host_defined());
+        auto* intrinsics = realm->heap().allocate<Bindings::Intrinsics>(*realm, *realm);
+        auto host_defined = make<Bindings::HostDefined>(*settings_object, *intrinsics);
+        realm->set_host_defined(move(host_defined));
+
+        return *settings_object;
     }
 
     virtual ~WorkerEnvironmentSettingsObject() override = default;
diff --git a/Userland/Libraries/LibWeb/HTML/Window.cpp b/Userland/Libraries/LibWeb/HTML/Window.cpp
index 29e911bb8c..22a5c0cfaa 100644
--- a/Userland/Libraries/LibWeb/HTML/Window.cpp
+++ b/Userland/Libraries/LibWeb/HTML/Window.cpp
@@ -96,26 +96,12 @@ void Window::visit_edges(JS::Cell::Visitor& visitor)
     visitor.visit(m_screen.ptr());
     visitor.visit(m_location_object);
     visitor.visit(m_crypto);
-    for (auto& it : m_prototypes)
-        visitor.visit(it.value);
-    for (auto& it : m_constructors)
-        visitor.visit(it.value);
     for (auto& it : m_timers)
         visitor.visit(it.value.ptr());
 }
 
 Window::~Window() = default;
 
-JS::Object& Window::cached_web_prototype(String const& class_name)
-{
-    auto it = m_prototypes.find(class_name);
-    if (it == m_prototypes.end()) {
-        dbgln("Missing prototype: {}", class_name);
-    }
-    VERIFY(it != m_prototypes.end());
-    return *it->value;
-}
-
 HighResolutionTime::Performance& Window::performance()
 {
     if (!m_performance)
@@ -750,7 +736,10 @@ void Window::initialize(JS::Realm& realm)
 
     // FIXME: This is a hack..
     realm.set_global_object(this, this);
+}
 
+void Window::initialize_web_interfaces(Badge<WindowEnvironmentSettingsObject>)
+{
     ADD_WINDOW_OBJECT_INTERFACES;
 
     Object::set_prototype(&ensure_web_prototype<Bindings::WindowPrototype>("Window"));
diff --git a/Userland/Libraries/LibWeb/HTML/Window.h b/Userland/Libraries/LibWeb/HTML/Window.h
index 0f9c09e464..22f855564a 100644
--- a/Userland/Libraries/LibWeb/HTML/Window.h
+++ b/Userland/Libraries/LibWeb/HTML/Window.h
@@ -13,6 +13,7 @@
 #include <AK/TypeCasts.h>
 #include <AK/URL.h>
 #include <LibJS/Heap/Heap.h>
+#include <LibWeb/Bindings/Intrinsics.h>
 #include <LibWeb/DOM/EventTarget.h>
 #include <LibWeb/Forward.h>
 #include <LibWeb/HTML/AnimationFrameCallbackDriver.h>
@@ -123,6 +124,8 @@ public:
     // https://html.spec.whatwg.org/multipage/interaction.html#transient-activation
     bool has_transient_activation() const;
 
+    void initialize_web_interfaces(Badge<WindowEnvironmentSettingsObject>);
+
 private:
     explicit Window(JS::Realm&);
     virtual void initialize(JS::Realm&) override;
@@ -170,34 +173,18 @@ public:
     Bindings::LocationObject* location_object() { return m_location_object; }
     Bindings::LocationObject const* location_object() const { return m_location_object; }
 
-    JS::Object* web_prototype(String const& class_name) { return m_prototypes.get(class_name).value_or(nullptr); }
-    JS::NativeFunction* web_constructor(String const& class_name) { return m_constructors.get(class_name).value_or(nullptr); }
-
-    JS::Object& cached_web_prototype(String const& class_name);
+    JS::Object& cached_web_prototype(String const& class_name) { return Bindings::cached_web_prototype(realm(), class_name); }
 
     template<typename T>
     JS::Object& ensure_web_prototype(String const& class_name)
     {
-        auto it = m_prototypes.find(class_name);
-        if (it != m_prototypes.end())
-            return *it->value;
-        auto& realm = shape().realm();
-        auto* prototype = heap().allocate<T>(realm, realm);
-        m_prototypes.set(class_name, prototype);
-        return *prototype;
+        return Bindings::ensure_web_prototype<T>(realm(), class_name);
     }
 
     template<typename T>
     JS::NativeFunction& ensure_web_constructor(String const& class_name)
     {
-        auto it = m_constructors.find(class_name);
-        if (it != m_constructors.end())
-            return *it->value;
-        auto& realm = shape().realm();
-        auto* constructor = heap().allocate<T>(realm, realm);
-        m_constructors.set(class_name, constructor);
-        define_direct_property(class_name, JS::Value(constructor), JS::Attribute::Writable | JS::Attribute::Configurable);
-        return *constructor;
+        return Bindings::ensure_web_constructor<T>(realm(), class_name);
     }
 
     virtual JS::ThrowCompletionOr<bool> internal_set_prototype_of(JS::Object* prototype) override;
@@ -283,9 +270,6 @@ private:
 
     Bindings::LocationObject* m_location_object { nullptr };
 
-    HashMap<String, JS::Object*> m_prototypes;
-    HashMap<String, JS::NativeFunction*> m_constructors;
-
     // [[CrossOriginPropertyDescriptorMap]], https://html.spec.whatwg.org/multipage/browsers.html#crossoriginpropertydescriptormap
     CrossOriginPropertyDescriptorMap m_cross_origin_property_descriptor_map;
 };
diff --git a/Userland/Libraries/LibWeb/HTML/Worker.h b/Userland/Libraries/LibWeb/HTML/Worker.h
index d3c92d616b..f24dbe64bc 100644
--- a/Userland/Libraries/LibWeb/HTML/Worker.h
+++ b/Userland/Libraries/LibWeb/HTML/Worker.h
@@ -78,7 +78,7 @@ private:
 
     NonnullRefPtr<JS::VM> m_worker_vm;
     NonnullOwnPtr<JS::Interpreter> m_interpreter;
-    WeakPtr<WorkerEnvironmentSettingsObject> m_inner_settings;
+    JS::GCPtr<WorkerEnvironmentSettingsObject> m_inner_settings;
     JS::VM::InterpreterExecutionScope m_interpreter_scope;
     RefPtr<WorkerDebugConsoleClient> m_console;
 
diff --git a/Userland/Libraries/LibWeb/WebIDL/AbstractOperations.cpp b/Userland/Libraries/LibWeb/WebIDL/AbstractOperations.cpp
index 438ad3a8ab..aa7312d250 100644
--- a/Userland/Libraries/LibWeb/WebIDL/AbstractOperations.cpp
+++ b/Userland/Libraries/LibWeb/WebIDL/AbstractOperations.cpp
@@ -108,7 +108,7 @@ JS::Completion invoke_callback(WebIDL::CallbackType& callback, Optional<JS::Valu
     auto& realm = function_object.shape().realm();
 
     // 6. Let relevant settings be realm’s settings object.
-    auto& relevant_settings = verify_cast<HTML::EnvironmentSettingsObject>(*realm.host_defined());
+    auto& relevant_settings = Bindings::host_defined_environment_settings_object(realm);
 
     // 7. Let stored settings be value’s callback context.
     auto& stored_settings = callback.callback_context;
diff --git a/Userland/Libraries/LibWeb/WebIDL/AbstractOperations.h b/Userland/Libraries/LibWeb/WebIDL/AbstractOperations.h
index db0fc28ddc..c33fcdc7e3 100644
--- a/Userland/Libraries/LibWeb/WebIDL/AbstractOperations.h
+++ b/Userland/Libraries/LibWeb/WebIDL/AbstractOperations.h
@@ -11,6 +11,7 @@
 #include <LibJS/Forward.h>
 #include <LibJS/Runtime/AbstractOperations.h>
 #include <LibJS/Runtime/FunctionObject.h>
+#include <LibWeb/Bindings/HostDefined.h>
 #include <LibWeb/HTML/Scripting/Environments.h>
 #include <LibWeb/WebIDL/CallbackType.h>
 
@@ -60,7 +61,7 @@ JS::Completion call_user_object_operation(WebIDL::CallbackType& callback, String
     auto& realm = object.shape().realm();
 
     // 5. Let relevant settings be realm’s settings object.
-    auto& relevant_settings = verify_cast<HTML::EnvironmentSettingsObject>(*realm.host_defined());
+    auto& relevant_settings = Bindings::host_defined_environment_settings_object(realm);
 
     // 6. Let stored settings be value’s callback context.
     auto& stored_settings = callback.callback_context;