Bug 1543315 - part 17: Mark PresShell::HandleDOMEventWithTarget() as MOZ_CAN_RUN_SCRIPT r=smaug

Differential Revision: https://phabricator.services.mozilla.com/D30494 --HG-- extra : moz-landing-system : lando
2019-05-09 20:21:28 +00:00 · 2019-05-09 20:21:28 +00:00 · 1fb845d129
--- a/dom/base/Document.cpp
+++ b/dom/base/Document.cpp
@ -11051,7 +11051,7 @@ class PointerLockRequest final : public Runnable {
        mDocument(do_GetWeakReference(aElement->OwnerDoc())),
        mUserInputOrChromeCaller(aUserInputOrChromeCaller) {}

-  NS_IMETHOD Run() final;
+  MOZ_CAN_RUN_SCRIPT_BOUNDARY NS_IMETHOD Run() final;

 private:
  nsWeakPtr mElement;
--- a/dom/base/Document.h
+++ b/dom/base/Document.h
@ -1940,8 +1940,9 @@ class Document : public nsINode,
  static bool HandlePendingFullscreenRequests(Document* aDocument);

  void RequestPointerLock(Element* aElement, CallerType);
-  bool SetPointerLock(Element* aElement, StyleCursorKind);
+  MOZ_CAN_RUN_SCRIPT bool SetPointerLock(Element* aElement, StyleCursorKind);

+  MOZ_CAN_RUN_SCRIPT_BOUNDARY
  static void UnlockPointer(Document* aDoc = nullptr);

  // ScreenOrientation related APIs
--- a/dom/base/nsGlobalWindowOuter.h
+++ b/dom/base/nsGlobalWindowOuter.h
@ -325,7 +325,7 @@ class nsGlobalWindowOuter final : public mozilla::dom::EventTarget,
  // Outer windows only.
  virtual void EnsureSizeAndPositionUpToDate() override;

-  virtual void EnterModalState() override;
+  MOZ_CAN_RUN_SCRIPT_BOUNDARY virtual void EnterModalState() override;
  virtual void LeaveModalState() override;

  // Outer windows only.
@ -863,6 +863,7 @@ class nsGlobalWindowOuter final : public mozilla::dom::EventTarget,
                                    nsIPrincipal* aSubjectPrincipal);

  // Outer windows only.
+  MOZ_CAN_RUN_SCRIPT_BOUNDARY
  bool CanMoveResizeWindows(mozilla::dom::CallerType aCallerType);

  // If aDoFlush is true, we'll flush our own layout; otherwise we'll try to
--- a/dom/events/EventStateManager.cpp
+++ b/dom/events/EventStateManager.cpp
@ -1996,7 +1996,7 @@ bool EventStateManager::DoDefaultDragStart(nsPresContext* aPresContext,

  // get any custom drag image that was set
  int32_t imageX, imageY;
-  Element* dragImage = aDataTransfer->GetDragImage(&imageX, &imageY);
+  RefPtr<Element> dragImage = aDataTransfer->GetDragImage(&imageX, &imageY);

  nsCOMPtr<nsIArray> transArray = aDataTransfer->GetTransferables(dragTarget);
  if (!transArray) return false;
--- a/dom/events/EventStateManager.h
+++ b/dom/events/EventStateManager.h
@ -1088,6 +1088,7 @@ class EventStateManager : public nsSupportsWeakReference, public nsIObserver {
   * aPrincipal - the triggering principal of the drag, or null if it's from
   *              browser chrome or OS
   */
+  MOZ_CAN_RUN_SCRIPT
  bool DoDefaultDragStart(nsPresContext* aPresContext,
                          WidgetDragEvent* aDragEvent,
                          dom::DataTransfer* aDataTransfer,
@ -1273,7 +1274,8 @@ class EventStateManager : public nsSupportsWeakReference, public nsIObserver {
  void KillClickHoldTimer();
  void FireContextClick();

-  static void SetPointerLock(nsIWidget* aWidget, nsIContent* aElement);
+  MOZ_CAN_RUN_SCRIPT static void SetPointerLock(nsIWidget* aWidget,
+                                                nsIContent* aElement);
  static void sClickHoldCallback(nsITimer* aTimer, void* aESM);
 };

--- a/dom/html/HTMLButtonElement.h
+++ b/dom/html/HTMLButtonElement.h
@ -51,6 +51,7 @@ class HTMLButtonElement final : public nsGenericHTMLFormElementWithState,

  // EventTarget
  void GetEventTargetParent(EventChainPreVisitor& aVisitor) override;
+  MOZ_CAN_RUN_SCRIPT_BOUNDARY
  virtual nsresult PostHandleEvent(EventChainPostVisitor& aVisitor) override;

  // nsINode
--- a/dom/html/HTMLInputElement.cpp
+++ b/dom/html/HTMLInputElement.cpp
@ -3858,7 +3858,7 @@ nsresult HTMLInputElement::PostHandleEvent(EventChainPostVisitor& aVisitor) {
              case NS_FORM_INPUT_RADIO: {
                // Checkbox and Radio try to submit on Enter press
                if (keyEvent->mKeyCode != NS_VK_SPACE) {
-                  MaybeSubmitForm(aVisitor.mPresContext);
+                  MaybeSubmitForm(MOZ_KnownLive(aVisitor.mPresContext));

                  break;  // If we are submitting, do not send click event
                }
@ -3935,7 +3935,7 @@ nsresult HTMLInputElement::PostHandleEvent(EventChainPostVisitor& aVisitor) {
               mType == NS_FORM_INPUT_NUMBER ||
               IsExperimentalMobileType(mType) || IsDateTimeInputType(mType))) {
            FireChangeEventIfNeeded();
-            rv = MaybeSubmitForm(aVisitor.mPresContext);
+            rv = MaybeSubmitForm(MOZ_KnownLive(aVisitor.mPresContext));
            NS_ENSURE_SUCCESS(rv, rv);
          }

--- a/dom/html/HTMLInputElement.h
+++ b/dom/html/HTMLInputElement.h
@ -1017,7 +1017,7 @@ class HTMLInputElement final : public nsGenericHTMLFormElementWithState,
   * MaybeSubmitForm looks for a submit input or a single text control
   * and submits the form if either is present.
   */
-  nsresult MaybeSubmitForm(nsPresContext* aPresContext);
+  MOZ_CAN_RUN_SCRIPT nsresult MaybeSubmitForm(nsPresContext* aPresContext);

  /**
   * Update mFileList with the currently selected file.
--- a/dom/ipc/BrowserChild.h
+++ b/dom/ipc/BrowserChild.h
@ -359,6 +359,7 @@ class BrowserChild final : public BrowserChildBase,
      const mozilla::WidgetMouseEvent& aEvent, const ScrollableLayerGuid& aGuid,
      const uint64_t& aInputBlockId);

+  MOZ_CAN_RUN_SCRIPT_BOUNDARY
  mozilla::ipc::IPCResult RecvRealDragEvent(const WidgetDragEvent& aEvent,
                                            const uint32_t& aDragAction,
                                            const uint32_t& aDropEffect,
--- a/dom/ipc/ContentChild.h
+++ b/dom/ipc/ContentChild.h
@ -454,6 +454,7 @@ class ContentChild final : public PContentChild,
  mozilla::ipc::IPCResult RecvInvokeDragSession(
      nsTArray<IPCDataTransfer>&& aTransfers, const uint32_t& aAction);

+  MOZ_CAN_RUN_SCRIPT_BOUNDARY
  mozilla::ipc::IPCResult RecvEndDragSession(
      const bool& aDoneDrag, const bool& aUserCancelled,
      const mozilla::LayoutDeviceIntPoint& aEndDragPoint,
--- a/dom/svg/SVGSVGElement.h
+++ b/dom/svg/SVGSVGElement.h
@ -102,7 +102,8 @@ class SVGSVGElement final : public SVGSVGElementBase {
   *
   * XXX SVGZoomEvent is no more, is this needed?
   */
-  void SetCurrentScaleTranslate(float s, float x, float y);
+  MOZ_CAN_RUN_SCRIPT_BOUNDARY void SetCurrentScaleTranslate(float s, float x,
+                                                            float y);

  // nsIContent interface
  void GetEventTargetParent(EventChainPreVisitor& aVisitor) override;
--- a/layout/base/PresShell.h
+++ b/layout/base/PresShell.h
@ -654,16 +654,16 @@ class PresShell final : public nsStubDocumentObserver,

  /**
   * Dispatch event to content only (NOT full processing)
-   * @note The caller must have a strong reference to the PresShell.
   */
+  MOZ_CAN_RUN_SCRIPT
  nsresult HandleDOMEventWithTarget(nsIContent* aTargetContent,
                                    WidgetEvent* aEvent,
                                    nsEventStatus* aStatus);

  /**
   * Dispatch event to content only (NOT full processing)
-   * @note The caller must have a strong reference to the PresShell.
   */
+  MOZ_CAN_RUN_SCRIPT
  nsresult HandleDOMEventWithTarget(nsIContent* aTargetContent,
                                    dom::Event* aEvent, nsEventStatus* aStatus);

--- a/layout/forms/nsComboboxControlFrame.cpp
+++ b/layout/forms/nsComboboxControlFrame.cpp
@ -94,7 +94,7 @@ class nsComboButtonListener final : public nsIDOMEventListener {
 public:
  NS_DECL_ISUPPORTS

-  NS_IMETHOD HandleEvent(dom::Event*) override {
+  MOZ_CAN_RUN_SCRIPT_BOUNDARY NS_IMETHOD HandleEvent(dom::Event*) override {
    mComboBox->ShowDropDown(!mComboBox->IsDroppedDown());
    return NS_OK;
  }
@ -315,7 +315,8 @@ void nsComboboxControlFrame::ShowPopup(bool aShowPopup) {
                           aShowPopup ? eXULPopupShowing : eXULPopupHiding,
                           nullptr, WidgetMouseEvent::eReal);

-    presShell->HandleDOMEventWithTarget(mContent, &event, &status);
+    nsCOMPtr<nsIContent> content = mContent;
+    presShell->HandleDOMEventWithTarget(content, &event, &status);
  }
 }

@ -495,7 +496,7 @@ class nsAsyncRollup : public Runnable {
 public:
  explicit nsAsyncRollup(nsComboboxControlFrame* aFrame)
      : mozilla::Runnable("nsAsyncRollup"), mFrame(aFrame) {}
-  NS_IMETHOD Run() override {
+  MOZ_CAN_RUN_SCRIPT_BOUNDARY NS_IMETHOD Run() override {
    if (mFrame.IsAlive()) {
      static_cast<nsComboboxControlFrame*>(mFrame.GetFrame())->RollupFromList();
    }
--- a/layout/forms/nsComboboxControlFrame.h
+++ b/layout/forms/nsComboboxControlFrame.h
@ -86,6 +86,7 @@ class nsComboboxControlFrame final : public nsBlockFrame,
                      const ReflowInput& aReflowInput,
                      nsReflowStatus& aStatus) override;

+  MOZ_CAN_RUN_SCRIPT_BOUNDARY
  virtual nsresult HandleEvent(nsPresContext* aPresContext,
                               mozilla::WidgetGUIEvent* aEvent,
                               nsEventStatus* aEventStatus) override;
@ -135,16 +136,10 @@ class nsComboboxControlFrame final : public nsBlockFrame,
  virtual void SetFocus(bool aOn, bool aRepaint) override;

  bool IsDroppedDown() { return mDroppedDown; }
-  /**
-   * @note This method might destroy |this|.
-   */
-  void ShowDropDown(bool aDoDropDown);
+  MOZ_CAN_RUN_SCRIPT void ShowDropDown(bool aDoDropDown);
  nsIFrame* GetDropDown();
  void SetDropDown(nsIFrame* aDropDownFrame);
-  /**
-   * @note This method might destroy |this|.
-   */
-  void RollupFromList();
+  MOZ_CAN_RUN_SCRIPT void RollupFromList();

  /**
   * Return the available space before and after this frame for
@ -212,6 +207,7 @@ class nsComboboxControlFrame final : public nsBlockFrame,

  // nsIStatefulFrame
  mozilla::UniquePtr<mozilla::PresState> SaveState() override;
+  MOZ_CAN_RUN_SCRIPT_BOUNDARY
  NS_IMETHOD RestoreState(mozilla::PresState* aState) override;
  NS_IMETHOD GenerateStateKey(nsIContent* aContent,
                              mozilla::dom::Document* aDocument,
@ -261,7 +257,7 @@ class nsComboboxControlFrame final : public nsBlockFrame,
   * Show or hide the dropdown list.
   * @note This method might destroy |this|.
   */
-  void ShowPopup(bool aShowPopup);
+  MOZ_CAN_RUN_SCRIPT void ShowPopup(bool aShowPopup);

  /**
   * Show or hide the dropdown list.
@ -269,7 +265,7 @@ class nsComboboxControlFrame final : public nsBlockFrame,
   * @note This method might destroy |this|.
   * @return false if this frame is destroyed, true if still alive.
   */
-  bool ShowList(bool aShowList);
+  MOZ_CAN_RUN_SCRIPT bool ShowList(bool aShowList);
  void CheckFireOnChange();
  void FireValueChangeEvent();
  nsresult RedisplayText();
--- a/widget/cocoa/nsChildView.mm
+++ b/widget/cocoa/nsChildView.mm
@ -5250,8 +5250,9 @@ static gfx::IntPoint GetIntegerDeltaForEvent(NSEvent* aEvent) {
    if (aMessage == eDragOver) {
      // fire the drag event at the source. Just ignore whether it was
      // cancelled or not as there isn't actually a means to stop the drag
-      mDragService->FireDragEventAtSource(eDrag,
-                                          nsCocoaUtils::ModifiersForEvent([NSApp currentEvent]));
+      nsCOMPtr<nsIDragService> dragService = mDragService;
+      dragService->FireDragEventAtSource(eDrag,
+                                         nsCocoaUtils::ModifiersForEvent([NSApp currentEvent]));
      dragSession->SetCanDrop(false);
    } else if (aMessage == eDrop) {
      // We make the assumption that the dragOver handlers have correctly set
@ -5263,8 +5264,8 @@ static gfx::IntPoint GetIntegerDeltaForEvent(NSEvent* aEvent) {
        nsCOMPtr<nsINode> sourceNode;
        dragSession->GetSourceNode(getter_AddRefs(sourceNode));
        if (!sourceNode) {
-          mDragService->EndDragSession(false,
-                                       nsCocoaUtils::ModifiersForEvent([NSApp currentEvent]));
+          nsCOMPtr<nsIDragService> dragService = mDragService;
+          dragService->EndDragSession(false, nsCocoaUtils::ModifiersForEvent([NSApp currentEvent]));
        }
        return NSDragOperationNone;
      }
@ -5324,8 +5325,8 @@ static gfx::IntPoint GetIntegerDeltaForEvent(NSEvent* aEvent) {
          // initiated in a different app. End the drag session,
          // since we're done with it for now (until the user
          // drags back into mozilla).
-          mDragService->EndDragSession(false,
-                                       nsCocoaUtils::ModifiersForEvent([NSApp currentEvent]));
+          nsCOMPtr<nsIDragService> dragService = mDragService;
+          dragService->EndDragSession(false, nsCocoaUtils::ModifiersForEvent([NSApp currentEvent]));
        }
      }
      default:
@ -5411,7 +5412,7 @@ static gfx::IntPoint GetIntegerDeltaForEvent(NSEvent* aEvent) {

  if (mDragService) {
    // set the dragend point from the current mouse location
-    nsDragService* dragService = static_cast<nsDragService*>(mDragService);
+    RefPtr<nsDragService> dragService = static_cast<nsDragService*>(mDragService);
    FlipCocoaScreenCoordinate(aPoint);
    dragService->SetDragEndPoint(gfx::IntPoint::Round(aPoint.x, aPoint.y));

@ -5434,7 +5435,7 @@ static gfx::IntPoint GetIntegerDeltaForEvent(NSEvent* aEvent) {
      }
    }

-    mDragService->EndDragSession(true, nsCocoaUtils::ModifiersForEvent(currentEvent));
+    dragService->EndDragSession(true, nsCocoaUtils::ModifiersForEvent(currentEvent));
    NS_RELEASE(mDragService);
  }

--- a/widget/cocoa/nsDragService.h
+++ b/widget/cocoa/nsDragService.h
@ -23,11 +23,11 @@ class nsDragService : public nsBaseDragService {
  nsDragService();

  // nsBaseDragService
-  virtual nsresult InvokeDragSessionImpl(nsIArray* anArrayTransferables,
-                                         const mozilla::Maybe<mozilla::CSSIntRegion>& aRegion,
-                                         uint32_t aActionType) override;
+  MOZ_CAN_RUN_SCRIPT virtual nsresult InvokeDragSessionImpl(
+      nsIArray* anArrayTransferables, const mozilla::Maybe<mozilla::CSSIntRegion>& aRegion,
+      uint32_t aActionType) override;
  // nsIDragService
-  NS_IMETHOD EndDragSession(bool aDoneDrag, uint32_t aKeyModifiers) override;
+  MOZ_CAN_RUN_SCRIPT NS_IMETHOD EndDragSession(bool aDoneDrag, uint32_t aKeyModifiers) override;
  NS_IMETHOD UpdateDragImage(nsINode* aImage, int32_t aImageX, int32_t aImageY) override;

  // nsIDragSession
--- a/widget/gtk/nsDragService.h
+++ b/widget/gtk/nsDragService.h
@ -58,17 +58,18 @@ class nsDragService final : public nsBaseDragService, public nsIObserver {
  NS_DECL_NSIOBSERVER

  // nsBaseDragService
-  virtual nsresult InvokeDragSessionImpl(
+  MOZ_CAN_RUN_SCRIPT virtual nsresult InvokeDragSessionImpl(
      nsIArray* anArrayTransferables,
      const mozilla::Maybe<mozilla::CSSIntRegion>& aRegion,
      uint32_t aActionType) override;
  // nsIDragService
-  NS_IMETHOD InvokeDragSession(nsINode* aDOMNode, nsIPrincipal* aPrincipal,
-                               nsIArray* anArrayTransferables,
-                               uint32_t aActionType,
-                               nsContentPolicyType aContentPolicyType) override;
+  MOZ_CAN_RUN_SCRIPT NS_IMETHOD
+  InvokeDragSession(nsINode* aDOMNode, nsIPrincipal* aPrincipal,
+                    nsIArray* anArrayTransferables, uint32_t aActionType,
+                    nsContentPolicyType aContentPolicyType) override;
  NS_IMETHOD StartDragSession() override;
-  NS_IMETHOD EndDragSession(bool aDoneDrag, uint32_t aKeyModifiers) override;
+  MOZ_CAN_RUN_SCRIPT NS_IMETHOD EndDragSession(bool aDoneDrag,
+                                               uint32_t aKeyModifiers) override;

  // nsIDragSession
  NS_IMETHOD SetCanDrop(bool aCanDrop) override;
@ -211,10 +212,10 @@ class nsDragService final : public nsBaseDragService, public nsIObserver {
                    mozilla::LayoutDeviceIntPoint aWindowPoint, guint aTime);

  // Callback for g_idle_add_full() to run mScheduledTask.
-  static gboolean TaskDispatchCallback(gpointer data);
-  gboolean RunScheduledTask();
+  MOZ_CAN_RUN_SCRIPT static gboolean TaskDispatchCallback(gpointer data);
+  MOZ_CAN_RUN_SCRIPT gboolean RunScheduledTask();
  void UpdateDragAction();
-  void DispatchMotionEvents();
+  MOZ_CAN_RUN_SCRIPT void DispatchMotionEvents();
  void ReplyToDragMotion(GdkDragContext* aDragContext);
 #ifdef MOZ_WAYLAND
  void ReplyToDragMotion(nsWaylandDragContext* aDragContext);
--- a/widget/nsBaseDragService.h
+++ b/widget/nsBaseDragService.h
@ -77,7 +77,7 @@ class nsBaseDragService : public nsIDragService, public nsIDragSession {
   * in this process.  This is expected to ensure that StartDragSession() and
   * EndDragSession() get called if the platform drag is successfully invoked.
   */
-  virtual nsresult InvokeDragSessionImpl(
+  MOZ_CAN_RUN_SCRIPT virtual nsresult InvokeDragSessionImpl(
      nsIArray* aTransferableArray,
      const mozilla::Maybe<mozilla::CSSIntRegion>& aRegion,
      uint32_t aActionType) = 0;
--- a/widget/nsIDragService.idl
+++ b/widget/nsIDragService.idl
@ -50,6 +50,7 @@ interface nsIDragService : nsISupports
    *           passed to the loadInfo when creating a new channel
    *           (defaults to TYPE_OTHER)
    */
+  [can_run_script]
  void invokeDragSession (in Node aDOMNode,
                          in nsIPrincipal aPrincipal,
                          in nsIArray aTransferables,
@ -83,7 +84,7 @@ interface nsIDragService : nsISupports
   * The aDragEvent must be supplied as the current screen coordinates of the
   * event are needed to calculate the image location.
   */
-  [noscript]
+  [noscript, can_run_script]
  void invokeDragSessionWithImage(in Node aDOMNode,
                                  in nsIPrincipal aPrincipal,
                                  in nsIArray aTransferableArray,
@ -101,6 +102,7 @@ interface nsIDragService : nsISupports
   *
   * Note: This method is deprecated for non-native code.
   */
+  [can_run_script]
  void invokeDragSessionWithSelection(in Selection aSelection,
                                      in nsIPrincipal aPrincipal,
                                      in nsIArray aTransferableArray,
@ -126,19 +128,22 @@ interface nsIDragService : nsISupports
    * If aDoneDrag is true, the drag has finished, otherwise the drag has
    * just left the window.
    */
+  [can_run_script]
  void endDragSession(in boolean aDoneDrag,
                      [optional] in unsigned long aKeyModifiers);

  /**
   * Fire a drag event at the source of the drag
   */
-  [noscript] void fireDragEventAtSource(in EventMessage aEventMessage,
-                                        in unsigned long aKeyModifiers);
+  [noscript, can_run_script]
+  void fireDragEventAtSource(in EventMessage aEventMessage,
+                             in unsigned long aKeyModifiers);

  /**
   * Increase/decrease dragging suppress level by one.
   * If level is greater than one, dragging is disabled.
   */
+  [can_run_script]
  void suppress();
  void unsuppress();

--- a/widget/windows/nsDragService.cpp
+++ b/widget/windows/nsDragService.cpp
@ -251,9 +251,8 @@ static bool LayoutDevicePointToCSSPoint(const LayoutDevicePoint& aDevPos,
 }

 //-------------------------------------------------------------------------
-NS_IMETHODIMP
-nsDragService::StartInvokingDragSession(IDataObject* aDataObj,
-                                        uint32_t aActionType) {
+nsresult nsDragService::StartInvokingDragSession(IDataObject* aDataObj,
+                                                 uint32_t aActionType) {
  // To do the drag we need to create an object that
  // implements the IDataObject interface (for OLE)
  RefPtr<nsNativeDragSource> nativeDragSrc =
--- a/widget/windows/nsDragService.h
+++ b/widget/windows/nsDragService.h
@ -23,7 +23,7 @@ class nsDragService : public nsBaseDragService {
  virtual ~nsDragService();

  // nsBaseDragService
-  virtual nsresult InvokeDragSessionImpl(
+  MOZ_CAN_RUN_SCRIPT virtual nsresult InvokeDragSessionImpl(
      nsIArray* anArrayTransferables,
      const mozilla::Maybe<mozilla::CSSIntRegion>& aRegion,
      uint32_t aActionType);
@ -33,14 +33,15 @@ class nsDragService : public nsBaseDragService {
  NS_IMETHOD GetNumDropItems(uint32_t* aNumItems) override;
  NS_IMETHOD IsDataFlavorSupported(const char* aDataFlavor,
                                   bool* _retval) override;
-  NS_IMETHOD EndDragSession(bool aDoneDrag, uint32_t aKeyModifiers) override;
+  MOZ_CAN_RUN_SCRIPT NS_IMETHOD EndDragSession(bool aDoneDrag,
+                                               uint32_t aKeyModifiers) override;
  NS_IMETHOD UpdateDragImage(nsINode* aImage, int32_t aImageX,
                             int32_t aImageY) override;

  // native impl.
  NS_IMETHOD SetIDataObject(IDataObject* aDataObj);
-  NS_IMETHOD StartInvokingDragSession(IDataObject* aDataObj,
-                                      uint32_t aActionType);
+  MOZ_CAN_RUN_SCRIPT nsresult StartInvokingDragSession(IDataObject* aDataObj,
+                                                       uint32_t aActionType);

  // A drop occurred within the application vs. outside of it.
  void SetDroppedLocal();
--- a/widget/windows/nsNativeDragTarget.cpp
+++ b/widget/windows/nsNativeDragTarget.cpp
@ -327,7 +327,8 @@ nsNativeDragTarget::DragOver(DWORD grfKeyState, POINTL ptl, LPDWORD pdwEffect) {
  }

  ModifierKeyState modifierKeyState;
-  mDragService->FireDragEventAtSource(eDrag, modifierKeyState.GetModifiers());
+  nsCOMPtr<nsIDragService> dragService = mDragService;
+  dragService->FireDragEventAtSource(eDrag, modifierKeyState.GetModifiers());
  // Now process the native drag state and then dispatch the event
  ProcessDrag(eDragOver, grfKeyState, ptl, pdwEffect);

@ -363,7 +364,8 @@ nsNativeDragTarget::DragLeave() {
      // we're done with it for now (until the user drags back into
      // mozilla).
      ModifierKeyState modifierKeyState;
-      mDragService->EndDragSession(false, modifierKeyState.GetModifiers());
+      nsCOMPtr<nsIDragService> dragService = mDragService;
+      dragService->EndDragSession(false, modifierKeyState.GetModifiers());
    }
  }

@ -385,7 +387,8 @@ void nsNativeDragTarget::DragCancel() {
    }
    if (mDragService) {
      ModifierKeyState modifierKeyState;
-      mDragService->EndDragSession(false, modifierKeyState.GetModifiers());
+      nsCOMPtr<nsIDragService> dragService = mDragService;
+      dragService->EndDragSession(false, modifierKeyState.GetModifiers());
    }
    this->Release();  // matching the AddRef in DragEnter
    mTookOwnRef = false;
--- a/widget/windows/nsNativeDragTarget.h
+++ b/widget/windows/nsNativeDragTarget.h
@ -48,24 +48,27 @@ class nsNativeDragTarget final : public IDropTarget {

  // Similar to DragEnter except it is called frequently while the drag
  // is over this object's window.
-  STDMETHODIMP DragOver(DWORD grfKeyState, POINTL point, DWORD* pEffect);
+  MOZ_CAN_RUN_SCRIPT_BOUNDARY STDMETHODIMP DragOver(DWORD grfKeyState,
+                                                    POINTL point,
+                                                    DWORD* pEffect);

  // Release the drag-drop source and put internal state back to the point
  // before the call to DragEnter. This is called when the drag leaves
  // without a drop occurring.
-  STDMETHODIMP DragLeave();
+  MOZ_CAN_RUN_SCRIPT_BOUNDARY STDMETHODIMP DragLeave();

  // If point is within our region of interest and pSource's data supports
  // one of our formats, get the data and set pEffect according to
  // grfKeyState (DROPEFFECT_MOVE if the control key was not pressed,
  // DROPEFFECT_COPY if the control key was pressed). Otherwise return
  // E_FAIL.
-  STDMETHODIMP Drop(LPDATAOBJECT pSource, DWORD grfKeyState, POINTL point,
-                    DWORD* pEffect);
+  MOZ_CAN_RUN_SCRIPT_BOUNDARY STDMETHODIMP Drop(LPDATAOBJECT pSource,
+                                                DWORD grfKeyState, POINTL point,
+                                                DWORD* pEffect);
  /**
   * Cancel the current drag session, if any.
   */
-  void DragCancel();
+  MOZ_CAN_RUN_SCRIPT_BOUNDARY void DragCancel();

  static void DragImageChanged() { gDragImageChanged = true; }