Bug 1623918 - part 2: Mark `nsINode::GetSelectionRootContent()` and its root callers as `MOZ_CAN_RUN_SCRIPT` as far as possible r=smaug

This patch tries to mark root callers of `nsINode::GetSelectionRootContent()` which calls `nsINode::GetAnonymousRootElementOfTextEditor()` as far as possible (and reasonable). It's used by `ContentEventHandler` so that a lot of methods of `EventStateManager`, `ContentEventHandler`, `IMEContentObserver` which are main users of it are also marked as `MOZ_CAN_RUN_SCRIPT`. I think that this is reasonable. On the other hand, it might not be reasonable to mark `IMEStateManager` methods as `MOZ_CAN_RUN_SCRIPT` for initializing `IMEContentObserver` because `IMEStateManager` may be able to initialize `IMEContentObserver` asynchronously and its root callers are in XUL layout code. Therefore, this patch uses `MOZ_CAN_RUN_SCRIPT_BOUNDARY` for `IMEStateManager` at least for now. Differential Revision: https://phabricator.services.mozilla.com/D92730
2020-10-09 02:37:47 +00:00 · 2020-10-09 02:37:47 +00:00 · 2fde14a338
--- a/dom/base/nsINode.h
+++ b/dom/base/nsINode.h
@ -1446,7 +1446,7 @@ class nsINode : public mozilla::dom::EventTarget {
   * node. Be aware that if this node and the computed selection limiter are
   * not in same subtree, this returns the root content of the closeset subtree.
   */
-  MOZ_CAN_RUN_SCRIPT_BOUNDARY nsIContent* GetSelectionRootContent(
+  MOZ_CAN_RUN_SCRIPT nsIContent* GetSelectionRootContent(
      mozilla::PresShell* aPresShell);

  nsINodeList* ChildNodes();
--- a/dom/events/ContentEventHandler.cpp
+++ b/dom/events/ContentEventHandler.cpp
@ -283,7 +283,7 @@ nsresult ContentEventHandler::InitRootContent(Selection* aNormalSelection) {
  // selection range still keeps storing the nodes.  If the active element of
  // the deactive window is <input> or <textarea>, we can compute the
  // selection root from them.
-  nsINode* startNode = range->GetStartContainer();
+  nsCOMPtr<nsINode> startNode = range->GetStartContainer();
  nsINode* endNode = range->GetEndContainer();
  if (NS_WARN_IF(!startNode) || NS_WARN_IF(!endNode)) {
    return NS_ERROR_FAILURE;
@ -297,7 +297,8 @@ nsresult ContentEventHandler::InitRootContent(Selection* aNormalSelection) {
  NS_ASSERTION(startNode->GetComposedDoc() == endNode->GetComposedDoc(),
               "firstNormalSelectionRange crosses the document boundary");

-  mRootContent = startNode->GetSelectionRootContent(mDocument->GetPresShell());
+  RefPtr<PresShell> presShell = mDocument->GetPresShell();
+  mRootContent = startNode->GetSelectionRootContent(presShell);
  if (NS_WARN_IF(!mRootContent)) {
    return NS_ERROR_FAILURE;
  }
--- a/dom/events/ContentEventHandler.h
+++ b/dom/events/ContentEventHandler.h
@ -102,32 +102,40 @@ class MOZ_STACK_CLASS ContentEventHandler {
  explicit ContentEventHandler(nsPresContext* aPresContext);

  // Handle aEvent in the current process.
-  nsresult HandleQueryContentEvent(WidgetQueryContentEvent* aEvent);
+  MOZ_CAN_RUN_SCRIPT nsresult
+  HandleQueryContentEvent(WidgetQueryContentEvent* aEvent);

  // eQuerySelectedText event handler
-  nsresult OnQuerySelectedText(WidgetQueryContentEvent* aEvent);
+  MOZ_CAN_RUN_SCRIPT nsresult
+  OnQuerySelectedText(WidgetQueryContentEvent* aEvent);
  // eQueryTextContent event handler
-  nsresult OnQueryTextContent(WidgetQueryContentEvent* aEvent);
+  MOZ_CAN_RUN_SCRIPT nsresult
+  OnQueryTextContent(WidgetQueryContentEvent* aEvent);
  // eQueryCaretRect event handler
-  nsresult OnQueryCaretRect(WidgetQueryContentEvent* aEvent);
+  MOZ_CAN_RUN_SCRIPT nsresult OnQueryCaretRect(WidgetQueryContentEvent* aEvent);
  // eQueryTextRect event handler
-  nsresult OnQueryTextRect(WidgetQueryContentEvent* aEvent);
+  MOZ_CAN_RUN_SCRIPT nsresult OnQueryTextRect(WidgetQueryContentEvent* aEvent);
  // eQueryTextRectArray event handler
-  nsresult OnQueryTextRectArray(WidgetQueryContentEvent* aEvent);
+  MOZ_CAN_RUN_SCRIPT nsresult
+  OnQueryTextRectArray(WidgetQueryContentEvent* aEvent);
  // eQueryEditorRect event handler
-  nsresult OnQueryEditorRect(WidgetQueryContentEvent* aEvent);
+  MOZ_CAN_RUN_SCRIPT nsresult
+  OnQueryEditorRect(WidgetQueryContentEvent* aEvent);
  // eQueryContentState event handler
-  nsresult OnQueryContentState(WidgetQueryContentEvent* aEvent);
+  MOZ_CAN_RUN_SCRIPT nsresult
+  OnQueryContentState(WidgetQueryContentEvent* aEvent);
  // eQuerySelectionAsTransferable event handler
-  nsresult OnQuerySelectionAsTransferable(WidgetQueryContentEvent* aEvent);
+  MOZ_CAN_RUN_SCRIPT nsresult
+  OnQuerySelectionAsTransferable(WidgetQueryContentEvent* aEvent);
  // eQueryCharacterAtPoint event handler
-  nsresult OnQueryCharacterAtPoint(WidgetQueryContentEvent* aEvent);
+  MOZ_CAN_RUN_SCRIPT nsresult
+  OnQueryCharacterAtPoint(WidgetQueryContentEvent* aEvent);
  // eQueryDOMWidgetHittest event handler
-  nsresult OnQueryDOMWidgetHittest(WidgetQueryContentEvent* aEvent);
+  MOZ_CAN_RUN_SCRIPT nsresult
+  OnQueryDOMWidgetHittest(WidgetQueryContentEvent* aEvent);

  // NS_SELECTION_* event
-  MOZ_CAN_RUN_SCRIPT
-  nsresult OnSelectionEvent(WidgetSelectionEvent* aEvent);
+  MOZ_CAN_RUN_SCRIPT nsresult OnSelectionEvent(WidgetSelectionEvent* aEvent);

 protected:
  RefPtr<dom::Document> mDocument;
@ -140,19 +148,20 @@ class MOZ_STACK_CLASS ContentEventHandler {
  RawRange mFirstSelectedRawRange;
  nsCOMPtr<nsIContent> mRootContent;

-  nsresult Init(WidgetQueryContentEvent* aEvent);
-  nsresult Init(WidgetSelectionEvent* aEvent);
+  MOZ_CAN_RUN_SCRIPT nsresult Init(WidgetQueryContentEvent* aEvent);
+  MOZ_CAN_RUN_SCRIPT nsresult Init(WidgetSelectionEvent* aEvent);

  nsresult InitBasic(bool aRequireFlush = true);
-  nsresult InitCommon(SelectionType aSelectionType = SelectionType::eNormal,
-                      bool aRequireFlush = true);
+  MOZ_CAN_RUN_SCRIPT nsresult
+  InitCommon(SelectionType aSelectionType = SelectionType::eNormal,
+             bool aRequireFlush = true);
  /**
   * InitRootContent() computes the root content of current focused editor.
   *
   * @param aNormalSelection    This must be a Selection instance whose type is
   *                            SelectionType::eNormal.
   */
-  nsresult InitRootContent(Selection* aNormalSelection);
+  MOZ_CAN_RUN_SCRIPT nsresult InitRootContent(Selection* aNormalSelection);

 public:
  // FlatText means the text that is generated from DOM tree. The BR elements
--- a/dom/events/EventStateManager.h
+++ b/dom/events/EventStateManager.h
@ -1081,7 +1081,8 @@ class EventStateManager : public nsSupportsWeakReference, public nsIObserver {

  void ReleaseCurrentIMEContentObserver();

-  void HandleQueryContentEvent(WidgetQueryContentEvent* aEvent);
+  MOZ_CAN_RUN_SCRIPT void HandleQueryContentEvent(
+      WidgetQueryContentEvent* aEvent);

 private:
  // Removes a node from the :hover / :active chain if needed, notifying if the
--- a/dom/events/IMEContentObserver.cpp
+++ b/dom/events/IMEContentObserver.cpp
@ -242,7 +242,7 @@ bool IMEContentObserver::InitWithEditor(nsPresContext* aPresContext,
    return false;
  }

-  PresShell* presShell = aPresContext->GetPresShell();
+  RefPtr<PresShell> presShell = aPresContext->GetPresShell();

  // get selection and root content
  nsCOMPtr<nsISelectionController> selCon;
@ -272,10 +272,11 @@ bool IMEContentObserver::InitWithEditor(nsPresContext* aPresContext,
      return false;
    }

-    mRootContent =
-        selRange->GetStartContainer()->GetSelectionRootContent(presShell);
+    nsCOMPtr<nsINode> startContainer = selRange->GetStartContainer();
+    mRootContent = startContainer->GetSelectionRootContent(presShell);
  } else {
-    mRootContent = mEditableNode->GetSelectionRootContent(presShell);
+    nsCOMPtr<nsINode> editableNode = mEditableNode;
+    mRootContent = editableNode->GetSelectionRootContent(presShell);
  }
  if (!mRootContent && mEditableNode->IsDocument()) {
    // The document node is editable, but there are no contents, this document
--- a/dom/events/IMEContentObserver.h
+++ b/dom/events/IMEContentObserver.h
@ -67,10 +67,11 @@ class IMEContentObserver final : public nsStubMutationObserver,
   */
  void OnSelectionChange(dom::Selection& aSelection);

-  bool OnMouseButtonEvent(nsPresContext* aPresContext,
-                          WidgetMouseEvent* aMouseEvent);
+  MOZ_CAN_RUN_SCRIPT bool OnMouseButtonEvent(nsPresContext* aPresContext,
+                                             WidgetMouseEvent* aMouseEvent);

-  nsresult HandleQueryContentEvent(WidgetQueryContentEvent* aEvent);
+  MOZ_CAN_RUN_SCRIPT nsresult
+  HandleQueryContentEvent(WidgetQueryContentEvent* aEvent);

  /**
   * Init() initializes the instance, i.e., retrieving necessary objects and
@ -90,8 +91,8 @@ class IMEContentObserver final : public nsStubMutationObserver,
   *                        Otherwise, i.e., this will observe a plugin content,
   *                        should be nullptr.
   */
-  void Init(nsIWidget* aWidget, nsPresContext* aPresContext,
-            nsIContent* aContent, EditorBase* aEditorBase);
+  MOZ_CAN_RUN_SCRIPT void Init(nsIWidget* aWidget, nsPresContext* aPresContext,
+                               nsIContent* aContent, EditorBase* aEditorBase);

  /**
   * Destroy() finalizes the instance, i.e., stops observing contents and
@ -124,8 +125,10 @@ class IMEContentObserver final : public nsStubMutationObserver,
   * @return            Returns true if the instance is managing the content.
   *                    Otherwise, false.
   */
-  bool MaybeReinitialize(nsIWidget* aWidget, nsPresContext* aPresContext,
-                         nsIContent* aContent, EditorBase* aEditorBase);
+  MOZ_CAN_RUN_SCRIPT bool MaybeReinitialize(nsIWidget* aWidget,
+                                            nsPresContext* aPresContext,
+                                            nsIContent* aContent,
+                                            EditorBase* aEditorBase);

  bool IsManaging(nsPresContext* aPresContext, nsIContent* aContent) const;
  bool IsManaging(const TextComposition* aTextComposition) const;
@ -179,8 +182,9 @@ class IMEContentObserver final : public nsStubMutationObserver,
    eState_Observing
  };
  State GetState() const;
-  bool InitWithEditor(nsPresContext* aPresContext, nsIContent* aContent,
-                      EditorBase* aEditorBase);
+  MOZ_CAN_RUN_SCRIPT bool InitWithEditor(nsPresContext* aPresContext,
+                                         nsIContent* aContent,
+                                         EditorBase* aEditorBase);
  bool InitWithPlugin(nsPresContext* aPresContext, nsIContent* aContent);
  bool IsInitializedWithPlugin() const { return !mEditorBase; }
  void OnIMEReceivedFocus();
@ -292,7 +296,7 @@ class IMEContentObserver final : public nsStubMutationObserver,
   *
   * Note that this does nothing if WasInitializedWithPlugin() returns true.
   */
-  bool UpdateSelectionCache(bool aRequireFlush = true);
+  MOZ_CAN_RUN_SCRIPT bool UpdateSelectionCache(bool aRequireFlush = true);

  nsCOMPtr<nsIWidget> mWidget;
  // mFocusedWidget has the editor observed by the instance.  E.g., if the
@ -351,13 +355,13 @@ class IMEContentObserver final : public nsStubMutationObserver,
    explicit IMENotificationSender(IMEContentObserver* aIMEContentObserver)
        : AChangeEvent("IMENotificationSender", aIMEContentObserver),
          mIsRunning(false) {}
-    NS_IMETHOD Run() override;
+    MOZ_CAN_RUN_SCRIPT_BOUNDARY NS_IMETHOD Run() override;

    void Dispatch(nsIDocShell* aDocShell);

   private:
-    void SendFocusSet();
-    void SendSelectionChange();
+    MOZ_CAN_RUN_SCRIPT void SendFocusSet();
+    MOZ_CAN_RUN_SCRIPT void SendSelectionChange();
    void SendTextChange();
    void SendPositionChange();
    void SendCompositionEventHandled();
--- a/dom/events/IMEStateManager.cpp
+++ b/dom/events/IMEStateManager.cpp
@ -651,8 +651,8 @@ bool IMEStateManager::OnMouseButtonEventInEditor(
    return false;
  }

-  bool consumed =
-      sActiveIMEContentObserver->OnMouseButtonEvent(aPresContext, aMouseEvent);
+  RefPtr<IMEContentObserver> observer = sActiveIMEContentObserver;
+  bool consumed = observer->OnMouseButtonEvent(aPresContext, aMouseEvent);

  if (MOZ_LOG_TEST(sISMLog, LogLevel::Info)) {
    nsAutoString eventType;
@ -877,6 +877,10 @@ void IMEStateManager::UpdateIMEState(const IMEState& aNewIMEState,
  MOZ_ASSERT(!sPresContext->GetTextInputHandlingWidget() ||
             sPresContext->GetTextInputHandlingWidget() == widget);

+  // TODO: Investigate if we could put off to initialize IMEContentObserver
+  //       later because a lot of callers need to be marked as
+  //       MOZ_CAN_RUN_SCRIPT otherwise.
+
  // Even if there is active IMEContentObserver, it may not be observing the
  // editor with current editable root content due to reframed.  In such case,
  // We should try to reinitialize the IMEContentObserver.
@ -885,7 +889,8 @@ void IMEStateManager::UpdateIMEState(const IMEState& aNewIMEState,
            ("  UpdateIMEState(), try to reinitialize the "
             "active IMEContentObserver"));
    RefPtr<IMEContentObserver> contentObserver = sActiveIMEContentObserver;
-    if (!contentObserver->MaybeReinitialize(widget, sPresContext, aContent,
+    RefPtr<nsPresContext> presContext = sPresContext;
+    if (!contentObserver->MaybeReinitialize(widget, presContext, aContent,
                                            aEditorBase)) {
      MOZ_LOG(sISMLog, LogLevel::Error,
              ("  UpdateIMEState(), failed to reinitialize the "
@ -1855,7 +1860,9 @@ void IMEStateManager::CreateIMEContentObserver(EditorBase* aEditorBase) {
  // We should hold the current instance here.
  RefPtr<IMEContentObserver> activeIMEContentObserver(
      sActiveIMEContentObserver);
-  activeIMEContentObserver->Init(widget, sPresContext, sContent, aEditorBase);
+  RefPtr<nsPresContext> presContext = sPresContext;
+  RefPtr<nsIContent> content = sContent;
+  activeIMEContentObserver->Init(widget, presContext, content, aEditorBase);
 }

 // static
--- a/dom/events/IMEStateManager.h
+++ b/dom/events/IMEStateManager.h
@ -164,15 +164,19 @@ class IMEStateManager {
  // isn't changed by the new state, this method does nothing.
  // Note that this method changes the IME state of the active element in the
  // widget.  So, the caller must have focus.
-  static void UpdateIMEState(const IMEState& aNewIMEState, nsIContent* aContent,
-                             EditorBase* aEditorBase);
+  // XXX Changing this to MOZ_CAN_RUN_SCRIPT requires too many callers to be
+  //     marked too.  Probably, we should initialize IMEContentObserver
+  //     asynchronously.
+  MOZ_CAN_RUN_SCRIPT_BOUNDARY static void UpdateIMEState(
+      const IMEState& aNewIMEState, nsIContent* aContent,
+      EditorBase* aEditorBase);

  // This method is called when user operates mouse button in focused editor
  // and before the editor handles it.
  // Returns true if IME consumes the event.  Otherwise, false.
-  static bool OnMouseButtonEventInEditor(nsPresContext* aPresContext,
-                                         nsIContent* aContent,
-                                         WidgetMouseEvent* aMouseEvent);
+  MOZ_CAN_RUN_SCRIPT static bool OnMouseButtonEventInEditor(
+      nsPresContext* aPresContext, nsIContent* aContent,
+      WidgetMouseEvent* aMouseEvent);

  // This method is called when user clicked in an editor.
  // aContent must be:
@ -203,7 +207,7 @@ class IMEStateManager {
   * events must be fired the stored target.  If the stored composition event
   * target is destroying, this removes the stored composition automatically.
   */
-  static void DispatchCompositionEvent(
+  MOZ_CAN_RUN_SCRIPT static void DispatchCompositionEvent(
      nsINode* aEventTargetNode, nsPresContext* aPresContext,
      BrowserParent* aBrowserParent, WidgetCompositionEvent* aCompositionEvent,
      nsEventStatus* aStatus, EventDispatchingCallback* aCallBack,
@ -282,7 +286,13 @@ class IMEStateManager {
                                 nsIContent* aContent);

  static void EnsureTextCompositionArray();
-  static void CreateIMEContentObserver(EditorBase* aEditorBase);
+
+  // XXX Changing this to MOZ_CAN_RUN_SCRIPT requires too many callers to be
+  //     marked too.  Probably, we should initialize IMEContentObserver
+  //     asynchronously.
+  MOZ_CAN_RUN_SCRIPT_BOUNDARY static void CreateIMEContentObserver(
+      EditorBase* aEditorBase);
+
  static void DestroyIMEContentObserver();

  static bool IsEditable(nsINode* node);
--- a/dom/events/TextComposition.cpp
+++ b/dom/events/TextComposition.cpp
@ -807,6 +807,8 @@ TextComposition::CompositionEventDispatcher::Run() {
  }

  RefPtr<nsPresContext> presContext = mTextComposition->mPresContext;
+  nsCOMPtr<nsINode> eventTarget = mEventTarget;
+  RefPtr<BrowserParent> browserParent = mTextComposition->mBrowserParent;
  nsEventStatus status = nsEventStatus_eIgnore;
  switch (mEventMessage) {
    case eCompositionStart: {
@ -820,8 +822,8 @@ TextComposition::CompositionEventDispatcher::Run() {
      compStart.mFlags.mIsSynthesizedForTests =
          mTextComposition->IsSynthesizedForTests();
      IMEStateManager::DispatchCompositionEvent(
-          mEventTarget, presContext, mTextComposition->mBrowserParent,
-          &compStart, &status, nullptr, mIsSynthesizedEvent);
+          eventTarget, presContext, browserParent, &compStart, &status, nullptr,
+          mIsSynthesizedEvent);
      break;
    }
    case eCompositionChange:
@ -835,8 +837,8 @@ TextComposition::CompositionEventDispatcher::Run() {
      compEvent.mFlags.mIsSynthesizedForTests =
          mTextComposition->IsSynthesizedForTests();
      IMEStateManager::DispatchCompositionEvent(
-          mEventTarget, presContext, mTextComposition->mBrowserParent,
-          &compEvent, &status, nullptr, mIsSynthesizedEvent);
+          eventTarget, presContext, browserParent, &compEvent, &status, nullptr,
+          mIsSynthesizedEvent);
      break;
    }
    default:
--- a/dom/events/TextComposition.h
+++ b/dom/events/TextComposition.h
@ -448,19 +448,18 @@ class TextComposition final {
   * DispatchCompositionEvent() dispatches the aCompositionEvent to the mContent
   * synchronously. The caller must ensure that it's safe to dispatch the event.
   */
-  void DispatchCompositionEvent(WidgetCompositionEvent* aCompositionEvent,
-                                nsEventStatus* aStatus,
-                                EventDispatchingCallback* aCallBack,
-                                bool aIsSynthesized);
+  MOZ_CAN_RUN_SCRIPT void DispatchCompositionEvent(
+      WidgetCompositionEvent* aCompositionEvent, nsEventStatus* aStatus,
+      EventDispatchingCallback* aCallBack, bool aIsSynthesized);

  /**
   * Simply calling EventDispatcher::Dispatch() with plugin event.
   * If dispatching event has no orginal clone, aOriginalEvent can be null.
   */
-  void DispatchEvent(WidgetCompositionEvent* aDispatchEvent,
-                     nsEventStatus* aStatus,
-                     EventDispatchingCallback* aCallback,
-                     const WidgetCompositionEvent* aOriginalEvent = nullptr);
+  MOZ_CAN_RUN_SCRIPT void DispatchEvent(
+      WidgetCompositionEvent* aDispatchEvent, nsEventStatus* aStatus,
+      EventDispatchingCallback* aCallback,
+      const WidgetCompositionEvent* aOriginalEvent = nullptr);

  /**
   * HandleSelectionEvent() sends the selection event to ContentEventHandler
@ -483,7 +482,7 @@ class TextComposition final {
   * @return Returns false if dispatching the compositionupdate event caused
   *         destroying this composition.
   */
-  bool MaybeDispatchCompositionUpdate(
+  MOZ_CAN_RUN_SCRIPT bool MaybeDispatchCompositionUpdate(
      const WidgetCompositionEvent* aCompositionEvent);

  /**
@ -492,10 +491,10 @@ class TextComposition final {
   *
   * @return Returns BaseEventFlags which is the result of dispatched event.
   */
-  BaseEventFlags CloneAndDispatchAs(
-      const WidgetCompositionEvent* aCompositionEvent, EventMessage aMessage,
-      nsEventStatus* aStatus = nullptr,
-      EventDispatchingCallback* aCallBack = nullptr);
+  MOZ_CAN_RUN_SCRIPT BaseEventFlags
+  CloneAndDispatchAs(const WidgetCompositionEvent* aCompositionEvent,
+                     EventMessage aMessage, nsEventStatus* aStatus = nullptr,
+                     EventDispatchingCallback* aCallBack = nullptr);

  /**
   * If IME has already dispatched compositionend event but it was discarded
@ -516,7 +515,7 @@ class TextComposition final {
   * OnCompositionEventDispatched() is called after a composition event is
   * dispatched.
   */
-  void OnCompositionEventDispatched(
+  MOZ_CAN_RUN_SCRIPT void OnCompositionEventDispatched(
      const WidgetCompositionEvent* aDispatchEvent);

  /**
@ -532,7 +531,7 @@ class TextComposition final {
   * editor which has this composition.
   * If it failed or lost focus, this would return 0.
   */
-  uint32_t GetSelectionStartOffset();
+  MOZ_CAN_RUN_SCRIPT uint32_t GetSelectionStartOffset();

  /**
   * OnStartOffsetUpdatedInChild() is called when composition start offset
@ -554,7 +553,7 @@ class TextComposition final {
                               EventMessage aEventMessage,
                               const nsAString& aData,
                               bool aIsSynthesizedEvent = false);
-    NS_IMETHOD Run() override;
+    MOZ_CAN_RUN_SCRIPT_BOUNDARY NS_IMETHOD Run() override;

   private:
    RefPtr<TextComposition> mTextComposition;
--- a/dom/html/TextControlState.cpp
+++ b/dom/html/TextControlState.cpp
@ -111,8 +111,8 @@ TextControlElement::GetTextControlElementFromEditingHost(nsIContent* aHost) {

 using ValueChangeKind = TextControlElement::ValueChangeKind;

-inline nsresult SetEditorFlagsIfNecessary(EditorBase& aEditorBase,
-                                          uint32_t aFlags) {
+MOZ_CAN_RUN_SCRIPT inline nsresult SetEditorFlagsIfNecessary(
+    EditorBase& aEditorBase, uint32_t aFlags) {
  if (aEditorBase.Flags() == aFlags) {
    return NS_OK;
  }
@ -200,7 +200,7 @@ class RestoreSelectionState : public Runnable {

 class MOZ_RAII AutoRestoreEditorState final {
 public:
-  explicit AutoRestoreEditorState(TextEditor* aTextEditor)
+  MOZ_CAN_RUN_SCRIPT explicit AutoRestoreEditorState(TextEditor* aTextEditor)
      : mTextEditor(aTextEditor),
        mSavedFlags(mTextEditor->Flags()),
        mSavedMaxLength(mTextEditor->MaxTextLength()) {
@ -214,14 +214,18 @@ class MOZ_RAII AutoRestoreEditorState final {
    flags &= ~(nsIEditor::eEditorReadonlyMask);
    flags |= nsIEditor::eEditorDontEchoPassword;
    if (mSavedFlags != flags) {
-      mTextEditor->SetFlags(flags);
+      // It's aTextEditor and whose lifetime must be guaranteed by the caller.
+      MOZ_KnownLive(mTextEditor)->SetFlags(flags);
    }
    mTextEditor->SetMaxTextLength(-1);
  }

-  ~AutoRestoreEditorState() {
+  MOZ_CAN_RUN_SCRIPT ~AutoRestoreEditorState() {
    mTextEditor->SetMaxTextLength(mSavedMaxLength);
-    SetEditorFlagsIfNecessary(*mTextEditor, mSavedFlags);
+    // mTextEditor's lifetime must be guaranteed by owner of the instance
+    // since the constructor is marked as `MOZ_CAN_RUN_SCRIPT` and this is
+    // a stack only class.
+    SetEditorFlagsIfNecessary(MOZ_KnownLive(*mTextEditor), mSavedFlags);
  }

 private:
--- a/editor/libeditor/EditorBase.cpp
+++ b/editor/libeditor/EditorBase.cpp
@ -384,7 +384,11 @@ nsresult EditorBase::PostCreate() {
    // If the text control gets reframed during focus, Focus() would not be
    // called, so take a chance here to see if we need to spell check the text
    // control.
-    mEventListener->SpellCheckIfNeeded();
+    RefPtr<EditorEventListener> eventListener = mEventListener;
+    eventListener->SpellCheckIfNeeded();
+    if (NS_WARN_IF(Destroyed())) {
+      return EditorBase::ToGenericNSResult(NS_ERROR_EDITOR_DESTROYED);
+    }

    IMEState newState;
    nsresult rv = GetPreferredIMEState(&newState);
@ -4344,12 +4348,12 @@ void EditorBase::ReinitializeSelection(Element& aElement) {
  // turn on it, spellcheck state is mismatched.  So we need to re-sync it.
  SyncRealTimeSpell();

-  nsPresContext* context = GetPresContext();
-  if (NS_WARN_IF(!context)) {
+  RefPtr<nsPresContext> presContext = GetPresContext();
+  if (NS_WARN_IF(!presContext)) {
    return;
  }
  nsCOMPtr<nsIContent> focusedContent = GetFocusedContentForIME();
-  IMEStateManager::OnFocusInEditor(context, focusedContent, *this);
+  IMEStateManager::OnFocusInEditor(presContext, focusedContent, *this);
 }

 Element* EditorBase::GetEditorRoot() const { return GetRoot(); }
--- a/editor/libeditor/EditorBase.h
+++ b/editor/libeditor/EditorBase.h
@ -447,7 +447,7 @@ class EditorBase : public nsIEditor,
   */
  uint32_t Flags() const { return mFlags; }

-  nsresult AddFlags(uint32_t aFlags) {
+  MOZ_CAN_RUN_SCRIPT nsresult AddFlags(uint32_t aFlags) {
    const uint32_t kOldFlags = Flags();
    const uint32_t kNewFlags = (kOldFlags | aFlags);
    if (kNewFlags == kOldFlags) {
@ -455,7 +455,7 @@ class EditorBase : public nsIEditor,
    }
    return SetFlags(kNewFlags);  // virtual call and may be expensive.
  }
-  nsresult RemoveFlags(uint32_t aFlags) {
+  MOZ_CAN_RUN_SCRIPT nsresult RemoveFlags(uint32_t aFlags) {
    const uint32_t kOldFlags = Flags();
    const uint32_t kNewFlags = (kOldFlags & ~aFlags);
    if (kNewFlags == kOldFlags) {
@ -463,7 +463,8 @@ class EditorBase : public nsIEditor,
    }
    return SetFlags(kNewFlags);  // virtual call and may be expensive.
  }
-  nsresult AddAndRemoveFlags(uint32_t aAddingFlags, uint32_t aRemovingFlags) {
+  MOZ_CAN_RUN_SCRIPT nsresult AddAndRemoveFlags(uint32_t aAddingFlags,
+                                                uint32_t aRemovingFlags) {
    MOZ_ASSERT(!(aAddingFlags & aRemovingFlags),
               "Same flags are specified both adding and removing");
    const uint32_t kOldFlags = Flags();
--- a/editor/libeditor/EditorEventListener.cpp
+++ b/editor/libeditor/EditorEventListener.cpp
@ -744,12 +744,13 @@ bool EditorEventListener::NotifyIMEOfMouseButtonEvent(
    return false;
  }

-  nsPresContext* presContext = GetPresContext();
+  RefPtr<nsPresContext> presContext = GetPresContext();
  if (NS_WARN_IF(!presContext)) {
    return false;
  }
+  nsCOMPtr<nsIContent> focusedRootContent = GetFocusedRootContent();
  return IMEStateManager::OnMouseButtonEventInEditor(
-      presContext, GetFocusedRootContent(), aMouseEvent);
+      presContext, focusedRootContent, aMouseEvent);
 }

 nsresult EditorEventListener::MouseDown(MouseEvent* aMouseEvent) {
@ -1101,9 +1102,7 @@ nsresult EditorEventListener::Focus(InternalFocusEvent* aFocusEvent) {

  // Spell check a textarea the first time that it is focused.
  SpellCheckIfNeeded();
-  if (!editorBase) {
-    // In e10s, this can cause us to flush notifications, which can destroy
-    // the node we're about to focus.
+  if (DetachedFromEditor()) {
    return NS_OK;
  }

@ -1160,7 +1159,7 @@ nsresult EditorEventListener::Focus(InternalFocusEvent* aFocusEvent) {
    return NS_OK;
  }

-  nsPresContext* presContext = GetPresContext();
+  RefPtr<nsPresContext> presContext = GetPresContext();
  if (NS_WARN_IF(!presContext)) {
    return NS_OK;
  }
--- a/editor/libeditor/EditorEventListener.h
+++ b/editor/libeditor/EditorEventListener.h
@ -51,7 +51,7 @@ class EditorEventListener : public nsIDOMEventListener {
  // nsIDOMEventListener
  MOZ_CAN_RUN_SCRIPT NS_IMETHOD HandleEvent(dom::Event* aEvent) override;

-  void SpellCheckIfNeeded();
+  MOZ_CAN_RUN_SCRIPT void SpellCheckIfNeeded();

 protected:
  virtual ~EditorEventListener();
@ -89,7 +89,8 @@ class EditorEventListener : public nsIDOMEventListener {
  nsPresContext* GetPresContext() const;
  nsIContent* GetFocusedRootContent();
  // Returns true if IME consumes the mouse event.
-  bool NotifyIMEOfMouseButtonEvent(WidgetMouseEvent* aMouseEvent);
+  MOZ_CAN_RUN_SCRIPT bool NotifyIMEOfMouseButtonEvent(
+      WidgetMouseEvent* aMouseEvent);
  bool EditorHasFocus();
  bool IsFileControlTextBox();
  bool ShouldHandleNativeKeyBindings(WidgetKeyboardEvent* aKeyboardEvent);
--- a/editor/libeditor/HTMLEditor.cpp
+++ b/editor/libeditor/HTMLEditor.cpp
@ -3819,7 +3819,7 @@ nsresult HTMLEditor::SelectAllInternal() {
    return NS_ERROR_FAILURE;
  }

-  nsIContent* anchorContent = anchorNode->AsContent();
+  nsCOMPtr<nsIContent> anchorContent = anchorNode->AsContent();
  nsIContent* rootContent;
  if (anchorContent->HasIndependentSelection()) {
    SelectionRefPtr()->SetAncestorLimiter(nullptr);
--- a/editor/libeditor/HTMLEditor.h
+++ b/editor/libeditor/HTMLEditor.h
@ -143,7 +143,7 @@ class HTMLEditor final : public TextEditor,
                                           uint32_t aFlags,
                                           const nsAString& aValue) override;
  MOZ_CAN_RUN_SCRIPT_BOUNDARY NS_IMETHOD BeginningOfDocument() override;
-  NS_IMETHOD SetFlags(uint32_t aFlags) override;
+  MOZ_CAN_RUN_SCRIPT NS_IMETHOD SetFlags(uint32_t aFlags) override;

  /**
   * IsEmpty() checks whether the editor is empty.  If editor has only padding
--- a/editor/libeditor/HTMLEditorDocumentCommands.cpp
+++ b/editor/libeditor/HTMLEditorDocumentCommands.cpp
@ -88,8 +88,8 @@ nsresult SetDocumentStateCommand::DoCommandParam(
      return rv;
    }
    case Command::SetDocumentUseCSS: {
-      nsresult rv =
-          aTextEditor.AsHTMLEditor()->SetIsCSSEnabled(aBoolParam.value());
+      nsresult rv = MOZ_KnownLive(aTextEditor.AsHTMLEditor())
+                        ->SetIsCSSEnabled(aBoolParam.value());
      NS_WARNING_ASSERTION(NS_SUCCEEDED(rv),
                           "HTMLEditor::SetIsCSSEnabled() failed");
      return rv;
--- a/editor/nsIEditor.idl
+++ b/editor/nsIEditor.idl
@ -109,7 +109,7 @@ interface nsIEditor  : nsISupports
                                   in boolean aSuppressTransaction);

  /** edit flags for this editor.  May be set at any time. */
-  attribute unsigned long flags;
+  [setter_can_run_script] attribute unsigned long flags;

  /**
   * the MimeType of the document
--- a/editor/nsIHTMLEditor.idl
+++ b/editor/nsIHTMLEditor.idl
@ -348,7 +348,7 @@ interface nsIHTMLEditor : nsISupports
   *
   * @return    true if CSS handled and enabled
   */
-  attribute boolean isCSSEnabled;
+  [setter_can_run_script] attribute boolean isCSSEnabled;

  /**
   * checkSelectionStateForAnonymousButtons() may refresh editing UI such as
--- a/layout/base/AccessibleCaretManager.h
+++ b/layout/base/AccessibleCaretManager.h
@ -213,7 +213,7 @@ class AccessibleCaretManager {
      nsIContent** aOutContent = nullptr,
      int32_t* aOutContentOffset = nullptr) const;

-  nsresult DragCaretInternal(const nsPoint& aPoint);
+  MOZ_CAN_RUN_SCRIPT nsresult DragCaretInternal(const nsPoint& aPoint);
  nsPoint AdjustDragBoundary(const nsPoint& aPoint) const;

  // Start the selection scroll timer if the caret is being dragged out of
--- a/layout/base/PresShell.cpp
+++ b/layout/base/PresShell.cpp
@ -8666,11 +8666,14 @@ nsresult PresShell::EventHandler::DispatchEventToDOM(
    }

    if (aEvent->mClass == eCompositionEventClass) {
+      RefPtr<nsPresContext> presContext = GetPresContext();
+      RefPtr<BrowserParent> browserParent = BrowserParent::GetFocused();
      IMEStateManager::DispatchCompositionEvent(
-          eventTarget, GetPresContext(), BrowserParent::GetFocused(),
-          aEvent->AsCompositionEvent(), aEventStatus, eventCBPtr);
+          eventTarget, presContext, browserParent, aEvent->AsCompositionEvent(),
+          aEventStatus, eventCBPtr);
    } else {
-      EventDispatcher::Dispatch(eventTarget, GetPresContext(), aEvent, nullptr,
+      RefPtr<nsPresContext> presContext = GetPresContext();
+      EventDispatcher::Dispatch(eventTarget, presContext, aEvent, nullptr,
                                aEventStatus, eventCBPtr);
    }
  }
--- a/layout/base/PresShell.h
+++ b/layout/base/PresShell.h
@ -2602,11 +2602,10 @@ class PresShell final : public nsStubDocumentObserver,
     * @param aEventStatus              [in/out] The status of aEvent.
     * @param aOverrideClickTarget      Override click event target.
     */
-    MOZ_CAN_RUN_SCRIPT
-    nsresult DispatchEvent(EventStateManager* aEventStateManager,
-                           WidgetEvent* aEvent, bool aTouchIsNew,
-                           nsEventStatus* aEventStatus,
-                           nsIContent* aOverrideClickTarget);
+    MOZ_CAN_RUN_SCRIPT nsresult
+    DispatchEvent(EventStateManager* aEventStateManager, WidgetEvent* aEvent,
+                  bool aTouchIsNew, nsEventStatus* aEventStatus,
+                  nsIContent* aOverrideClickTarget);

    /**
     * DispatchEventToDOM() actually dispatches aEvent into the DOM tree.
@ -2616,9 +2615,9 @@ class PresShell final : public nsStubDocumentObserver,
     * @param aEventCB          The callback kicked when the event moves
     *                          from the default group to the system group.
     */
-    nsresult DispatchEventToDOM(WidgetEvent* aEvent,
-                                nsEventStatus* aEventStatus,
-                                nsPresShellEventCB* aEventCB);
+    MOZ_CAN_RUN_SCRIPT nsresult
+    DispatchEventToDOM(WidgetEvent* aEvent, nsEventStatus* aEventStatus,
+                       nsPresShellEventCB* aEventCB);

    /**
     * DispatchTouchEventToDOM() dispatches touch events into the DOM tree.
@ -2632,10 +2631,9 @@ class PresShell final : public nsStubDocumentObserver,
     *                          and it's newly touched.  Then, the "touchmove"
     *                          event becomes cancelable.
     */
-    void DispatchTouchEventToDOM(WidgetEvent* aEvent,
-                                 nsEventStatus* aEventStatus,
-                                 nsPresShellEventCB* aEventCB,
-                                 bool aTouchIsNew);
+    MOZ_CAN_RUN_SCRIPT void DispatchTouchEventToDOM(
+        WidgetEvent* aEvent, nsEventStatus* aEventStatus,
+        nsPresShellEventCB* aEventCB, bool aTouchIsNew);

    /**
     * FinalizeHandlingEvent() should be called after calling DispatchEvent()
--- a/layout/forms/nsTextControlFrame.h
+++ b/layout/forms/nsTextControlFrame.h
@ -177,8 +177,8 @@ class nsTextControlFrame : public nsContainerFrame,
  //==== OVERLOAD of nsIFrame

  /** handler for attribute changes to mContent */
-  nsresult AttributeChanged(int32_t aNameSpaceID, nsAtom* aAttribute,
-                            int32_t aModType) override;
+  MOZ_CAN_RUN_SCRIPT_BOUNDARY nsresult AttributeChanged(
+      int32_t aNameSpaceID, nsAtom* aAttribute, int32_t aModType) override;

  void GetText(nsString& aText);

--- a/layout/generic/nsFrameSelection.cpp
+++ b/layout/generic/nsFrameSelection.cpp
@ -530,17 +530,18 @@ nsresult nsFrameSelection::ConstrainFrameAndPointToAnchorSubtree(
  //

  NS_ENSURE_STATE(mPresShell);
-  nsIContent* anchorRoot = anchorContent->GetSelectionRootContent(mPresShell);
+  RefPtr<PresShell> presShell = mPresShell;
+  nsIContent* anchorRoot = anchorContent->GetSelectionRootContent(presShell);
  NS_ENSURE_TRUE(anchorRoot, NS_ERROR_UNEXPECTED);

  //
  // Now find the root of the subtree containing aFrame's content.
  //

-  nsIContent* content = aFrame->GetContent();
+  nsCOMPtr<nsIContent> content = aFrame->GetContent();

  if (content) {
-    nsIContent* contentRoot = content->GetSelectionRootContent(mPresShell);
+    nsIContent* contentRoot = content->GetSelectionRootContent(presShell);
    NS_ENSURE_TRUE(contentRoot, NS_ERROR_UNEXPECTED);

    if (anchorRoot == contentRoot) {
@ -554,18 +555,18 @@ nsresult nsFrameSelection::ConstrainFrameAndPointToAnchorSubtree(
      // Find the frame under the mouse cursor with the root frame.
      // At this time, don't use the anchor's frame because it may not have
      // fixed positioned frames.
-      nsIFrame* rootFrame = mPresShell->GetRootFrame();
+      nsIFrame* rootFrame = presShell->GetRootFrame();
      nsPoint ptInRoot = aPoint + aFrame->GetOffsetTo(rootFrame);
      nsIFrame* cursorFrame =
          nsLayoutUtils::GetFrameForPoint(RelativeTo{rootFrame}, ptInRoot);

      // If the mouse cursor in on a frame which is descendant of same
      // selection root, we can expand the selection to the frame.
-      if (cursorFrame && cursorFrame->PresShell() == mPresShell) {
-        nsIContent* cursorContent = cursorFrame->GetContent();
+      if (cursorFrame && cursorFrame->PresShell() == presShell) {
+        nsCOMPtr<nsIContent> cursorContent = cursorFrame->GetContent();
        NS_ENSURE_TRUE(cursorContent, NS_ERROR_FAILURE);
        nsIContent* cursorContentRoot =
-            cursorContent->GetSelectionRootContent(mPresShell);
+            cursorContent->GetSelectionRootContent(presShell);
        NS_ENSURE_TRUE(cursorContentRoot, NS_ERROR_UNEXPECTED);
        if (cursorContentRoot == anchorRoot) {
          *aRetFrame = cursorFrame;
--- a/layout/generic/nsFrameSelection.h
+++ b/layout/generic/nsFrameSelection.h
@ -257,8 +257,7 @@ class nsFrameSelection final {
   * @param aPoint is relative to aFrame
   */
  // TODO: replace with `MOZ_CAN_RUN_SCRIPT`.
-  MOZ_CAN_RUN_SCRIPT_BOUNDARY void HandleDrag(nsIFrame* aFrame,
-                                              const nsPoint& aPoint);
+  MOZ_CAN_RUN_SCRIPT void HandleDrag(nsIFrame* aFrame, const nsPoint& aPoint);

  /**
   * HandleTableSelection will set selection to a table, cell, etc
@ -714,10 +713,9 @@ class nsFrameSelection final {
   */
  nsresult MaintainSelection(nsSelectionAmount aAmount = eSelectNoAmount);

-  nsresult ConstrainFrameAndPointToAnchorSubtree(nsIFrame* aFrame,
-                                                 const nsPoint& aPoint,
-                                                 nsIFrame** aRetFrame,
-                                                 nsPoint& aRetPoint) const;
+  MOZ_CAN_RUN_SCRIPT nsresult ConstrainFrameAndPointToAnchorSubtree(
+      nsIFrame* aFrame, const nsPoint& aPoint, nsIFrame** aRetFrame,
+      nsPoint& aRetPoint) const;

  /**
   * @param aPresShell is the parameter to be used for most of the other calls