If a function that captures a GC-allocated object is owned by another GC-allocated object, it is more preferable to use JS::HeapFunction. This is because JS::HeapFunction is visited, unlike introducing a new heap root as JS::SafeFunction does.
URL::port()
BrowsingContext
Navigable