Bug 1619617: part 1) Annotate `RemoveRangeAndUnselectFramesAndNotifyListeners` with `MOZ_CAN_RUN_SCRIPT`. r=smaug

Differential Revision: https://phabricator.services.mozilla.com/D65511

--HG--
extra : moz-landing-system : lando

accessible/generic/HyperTextAccessible.cpp

@@ -1283,7 +1283,7 @@ nsresult HyperTextAccessible::SetSelectionRange(int32_t aStartPos,
   // some input controls
   if (isFocusable) TakeFocus();
 
-  dom::Selection* domSel = DOMSelection();
+  RefPtr<dom::Selection> domSel = DOMSelection();
   NS_ENSURE_STATE(domSel);
 
   // Set up the selection.
@@ -1577,7 +1577,7 @@ bool HyperTextAccessible::SetSelectionBoundsAt(int32_t aSelectionNum,
     return false;
   }
 
-  dom::Selection* domSel = DOMSelection();
+  RefPtr<dom::Selection> domSel = DOMSelection();
   if (!domSel) return false;
 
   RefPtr<nsRange> range;
@@ -1615,7 +1615,7 @@ bool HyperTextAccessible::SetSelectionBoundsAt(int32_t aSelectionNum,
 }
 
 bool HyperTextAccessible::RemoveFromSelection(int32_t aSelectionNum) {
-  dom::Selection* domSel = DOMSelection();
+  RefPtr<dom::Selection> domSel = DOMSelection();
   if (!domSel) return false;
 
   if (aSelectionNum < 0 ||

accessible/generic/HyperTextAccessible.h

@@ -341,8 +341,10 @@ class HyperTextAccessible : public AccessibleWrap {
    * Changes the start and end offset of the specified selection.
    * @return true if succeeded
    */
-  bool SetSelectionBoundsAt(int32_t aSelectionNum, int32_t aStartOffset,
+  // TODO: annotate this with `MOZ_CAN_RUN_SCRIPT` instead.
-                            int32_t aEndOffset);
+  MOZ_CAN_RUN_SCRIPT_BOUNDARY bool SetSelectionBoundsAt(int32_t aSelectionNum,
+                                                        int32_t aStartOffset,
+                                                        int32_t aEndOffset);
 
   /**
    * Adds a selection bounded by the specified offsets.
@@ -354,7 +356,8 @@ class HyperTextAccessible : public AccessibleWrap {
    * Removes the specified selection.
    * @return true if succeeded
    */
-  bool RemoveFromSelection(int32_t aSelectionNum);
+  // TODO: annotate this with `MOZ_CAN_RUN_SCRIPT` instead.
+  MOZ_CAN_RUN_SCRIPT_BOUNDARY bool RemoveFromSelection(int32_t aSelectionNum);
 
   /**
    * Scroll the given text range into view.
@@ -508,7 +511,9 @@ class HyperTextAccessible : public AccessibleWrap {
   void GetSelectionDOMRanges(SelectionType aSelectionType,
                              nsTArray<nsRange*>* aRanges);
 
-  nsresult SetSelectionRange(int32_t aStartPos, int32_t aEndPos);
+  // TODO: annotate this with `MOZ_CAN_RUN_SCRIPT` instead.
+  MOZ_CAN_RUN_SCRIPT_BOUNDARY nsresult SetSelectionRange(int32_t aStartPos,
+                                                         int32_t aEndPos);
 
   /**
    * Convert the given DOM point to a DOM point in non-generated contents.

dom/base/Selection.h

@@ -307,8 +307,7 @@ class Selection final : public nsSupportsWeakReference,
   /**
    * Callers need to keep `aRange` alive.
    */
-  MOZ_CAN_RUN_SCRIPT_BOUNDARY
+  MOZ_CAN_RUN_SCRIPT void RemoveRangeAndUnselectFramesAndNotifyListeners(
-  void RemoveRangeAndUnselectFramesAndNotifyListeners(
       nsRange& aRange, mozilla::ErrorResult& aRv);
 
   MOZ_CAN_RUN_SCRIPT_BOUNDARY void RemoveAllRanges(mozilla::ErrorResult& aRv);

dom/base/nsRange.cpp

@@ -943,9 +943,11 @@ void nsRange::SetSelection(mozilla::dom::Selection* aSelection) {
 
   // Extra step in case our parent failed to ensure the above
   // invariant.
+  RefPtr<nsRange> range{this};
   if (aSelection && mSelection) {
-    mSelection->RemoveRangeAndUnselectFramesAndNotifyListeners(*this,
+    RefPtr<Selection> selection{mSelection};
-                                                               IgnoreErrors());
+    selection->RemoveRangeAndUnselectFramesAndNotifyListeners(*range,
+                                                              IgnoreErrors());
   }
 
   mSelection = aSelection;

dom/base/nsRange.h

@@ -100,7 +100,9 @@ class nsRange final : public mozilla::dom::AbstractRange,
   /**
    * Called when the range is added/removed from a Selection.
    */
-  void SetSelection(mozilla::dom::Selection* aSelection);
+  // TODO: annotate this with `MOZ_CAN_RUN_SCRIPT` instead.
+  MOZ_CAN_RUN_SCRIPT_BOUNDARY void SetSelection(
+      mozilla::dom::Selection* aSelection);
 
   /**
    * Returns pointer to a Selection if the range is associated with a Selection.

editor/libeditor/HTMLTableEditor.cpp

@@ -2622,8 +2622,9 @@ HTMLEditor::JoinTableCells(bool aMergeNonContiguousContents) {
       RefPtr<Element> deletedCell;
       HTMLEditor::GetCellFromRange(range, getter_AddRefs(deletedCell));
       if (!deletedCell) {
-        SelectionRefPtr()->RemoveRangeAndUnselectFramesAndNotifyListeners(
+        MOZ_KnownLive(SelectionRefPtr())
-            *range, IgnoreErrors());
+            ->RemoveRangeAndUnselectFramesAndNotifyListeners(*range,
+                                                             IgnoreErrors());
         rangeCount--;
         i--;
       }

extensions/spellcheck/src/mozInlineSpellChecker.cpp

@@ -1605,8 +1605,9 @@ nsresult mozInlineSpellChecker::RemoveRange(Selection* aSpellCheckSelection,
   NS_ENSURE_ARG_POINTER(aRange);
 
   ErrorResult rv;
-  aSpellCheckSelection->RemoveRangeAndUnselectFramesAndNotifyListeners(*aRange,
+  RefPtr<nsRange> range{aRange};
-                                                                       rv);
+  RefPtr<Selection> selection{aSpellCheckSelection};
+  selection->RemoveRangeAndUnselectFramesAndNotifyListeners(*range, rv);
   if (!rv.Failed() && mNumWordsInSpellSelection) mNumWordsInSpellSelection--;
 
   return rv.StealNSResult();

extensions/spellcheck/src/mozInlineSpellChecker.h

@@ -222,8 +222,10 @@ class mozInlineSpellChecker final : public nsIInlineSpellChecker,
   /**
    * @param aRange needs to be kept alive by the caller.
    */
-  nsresult RemoveRange(mozilla::dom::Selection* aSpellCheckSelection,
+  // TODO: annotate with `MOZ_CAN_RUN_SCRIPT` instead
-                       nsRange* aRange);
+  // (https://bugzilla.mozilla.org/show_bug.cgi?id=1620540).
+  MOZ_CAN_RUN_SCRIPT_BOUNDARY nsresult
+  RemoveRange(mozilla::dom::Selection* aSpellCheckSelection, nsRange* aRange);
   nsresult AddRange(mozilla::dom::Selection* aSpellCheckSelection,
                     nsRange* aRange);
   bool SpellCheckSelectionIsFull() {

layout/generic/nsFrameSelection.h

@@ -820,6 +820,8 @@ class nsFrameSelection final {
     // (according to GetFirstCellNodeInRange).
     nsRange* GetNextCellRange(const mozilla::dom::Selection& aNormalSelection);
 
+    // TODO: annotate this with `MOZ_CAN_RUN_SCRIPT` instead.
+    MOZ_CAN_RUN_SCRIPT_BOUNDARY
     nsresult HandleSelection(nsINode* aParentContent, int32_t aContentOffset,
                              mozilla::TableSelectionMode aTarget,
                              mozilla::WidgetMouseEvent* aMouseEvent,
@@ -833,11 +835,11 @@ class nsFrameSelection final {
                                mozilla::dom::Selection& aNormalSelection);
 
     // TODO: mark as `MOZ_CAN_RUN_SCRIPT`.
-    nsresult UnselectCells(nsIContent* aTable, int32_t aStartRowIndex,
+    MOZ_CAN_RUN_SCRIPT_BOUNDARY nsresult
-                           int32_t aStartColumnIndex, int32_t aEndRowIndex,
+    UnselectCells(nsIContent* aTable, int32_t aStartRowIndex,
-                           int32_t aEndColumnIndex,
+                  int32_t aStartColumnIndex, int32_t aEndRowIndex,
-                           bool aRemoveOutsideOfCellRange,
+                  int32_t aEndColumnIndex, bool aRemoveOutsideOfCellRange,
-                           mozilla::dom::Selection& aNormalSelection);
+                  mozilla::dom::Selection& aNormalSelection);
 
     nsCOMPtr<nsINode> mCellParent;  // used to snap to table selection
     nsCOMPtr<nsIContent> mStartSelectedCell;