Bug 1671768 - Part 4: Use MOZ_CAN_RUN_SCRIPT for Selection::RemoveAll…

…Ranges r=masayuki Differential Revision: https://phabricator.services.mozilla.com/D103780
dothq · Feb 3, 2021 · 717d5d2 · 717d5d2
1 parent 0ea5caf
commit 717d5d2
Show file tree

Hide file tree

Showing 13 changed files with 26 additions and 19 deletions.
diff --git a/dom/base/Selection.cpp b/dom/base/Selection.cpp
@@ -552,6 +552,7 @@ DocGroup* Selection::GetDocGroup() const {
 
 NS_IMPL_CYCLE_COLLECTION_CLASS(Selection)
 
+MOZ_CAN_RUN_SCRIPT_BOUNDARY
 NS_IMPL_CYCLE_COLLECTION_UNLINK_BEGIN(Selection)
   // Unlink the selection listeners *before* we do RemoveAllRanges since
   // we don't want to notify the listeners during JS GC (they could be
@@ -562,7 +563,7 @@ NS_IMPL_CYCLE_COLLECTION_UNLINK_BEGIN(Selection)
   }
   NS_IMPL_CYCLE_COLLECTION_UNLINK(mSelectionChangeEventDispatcher)
   NS_IMPL_CYCLE_COLLECTION_UNLINK(mSelectionListeners)
-  tmp->RemoveAllRanges(IgnoreErrors());
+  MOZ_KnownLive(tmp)->RemoveAllRanges(IgnoreErrors());
   NS_IMPL_CYCLE_COLLECTION_UNLINK(mFrameSelection)
   NS_IMPL_CYCLE_COLLECTION_UNLINK_PRESERVED_WRAPPER
   NS_IMPL_CYCLE_COLLECTION_UNLINK_WEAK_PTR

diff --git a/dom/base/Selection.h b/dom/base/Selection.h
@@ -354,7 +354,7 @@ class Selection final : public nsSupportsWeakReference,
   MOZ_CAN_RUN_SCRIPT void RemoveRangeAndUnselectFramesAndNotifyListeners(
       nsRange& aRange, mozilla::ErrorResult& aRv);
 
-  MOZ_CAN_RUN_SCRIPT_BOUNDARY void RemoveAllRanges(mozilla::ErrorResult& aRv);
+  MOZ_CAN_RUN_SCRIPT void RemoveAllRanges(mozilla::ErrorResult& aRv);
 
   /**
    * Whether Stringify should flush layout or not.

diff --git a/dom/html/TextControlState.cpp b/dom/html/TextControlState.cpp
@@ -2802,7 +2802,7 @@ bool TextControlState::SetValueWithTextEditor(
     // Since we don't use undo transaction, we don't need to store
     // selection state.  SetText will set selection to tail.
     IgnoredErrorResult ignoredError;
-    selection->RemoveAllRanges(ignoredError);
+    MOZ_KnownLive(selection)->RemoveAllRanges(ignoredError);
     NS_WARNING_ASSERTION(!ignoredError.Failed(),
                          "Selection::RemoveAllRanges() failed, but ignored");
   }

diff --git a/editor/libeditor/EditorBase.cpp b/editor/libeditor/EditorBase.cpp
@@ -4048,7 +4048,7 @@ nsresult EditorBase::ClearSelection() {
   MOZ_ASSERT(IsEditActionDataAvailable());
 
   ErrorResult error;
-  SelectionRefPtr()->RemoveAllRanges(error);
+  MOZ_KnownLive(SelectionRefPtr())->RemoveAllRanges(error);
   NS_WARNING_ASSERTION(!error.Failed(), "Selection::RemoveAllRanges() failed");
   return error.StealNSResult();
 }

diff --git a/editor/libeditor/EditorBase.h b/editor/libeditor/EditorBase.h
@@ -2255,7 +2255,7 @@ class EditorBase : public nsIEditor,
    * When you are using AppendNodeToSelectionAsRange(), call this first to
    * start a new selection.
    */
-  nsresult ClearSelection();
+  MOZ_CAN_RUN_SCRIPT_BOUNDARY nsresult ClearSelection();
 
   /**
    * Initializes selection and caret for the editor.  If aEventTarget isn't

diff --git a/editor/libeditor/HTMLEditor.cpp b/editor/libeditor/HTMLEditor.cpp
@@ -4451,7 +4451,7 @@ void HTMLEditor::DoSplitNode(const EditorDOMPoint& aStartOfRightNode,
 
     // If we have not seen the selection yet, clear all of its ranges.
     if (range.mSelection != previousSelection) {
-      range.mSelection->RemoveAllRanges(aError);
+      MOZ_KnownLive(range.mSelection)->RemoveAllRanges(aError);
       if (aError.Failed()) {
         NS_WARNING("Selection::RemoveAllRanges() failed");
         return;
@@ -4728,7 +4728,7 @@ nsresult HTMLEditor::DoJoinNodes(nsIContent& aContentToKeep,
     // If we have not seen the selection yet, clear all of its ranges.
     if (range.mSelection != previousSelection) {
       ErrorResult error;
-      range.mSelection->RemoveAllRanges(error);
+      MOZ_KnownLive(range.mSelection)->RemoveAllRanges(error);
       if (NS_WARN_IF(Destroyed())) {
         error.SuppressException();
         return NS_ERROR_EDITOR_DESTROYED;

diff --git a/editor/libeditor/HTMLTableEditor.cpp b/editor/libeditor/HTMLTableEditor.cpp
@@ -916,7 +916,7 @@ nsresult HTMLEditor::DeleteTableElementAndChildrenWithTransaction(
     // Select the <table> element after clear current selection.
     if (SelectionRefPtr()->RangeCount()) {
       ErrorResult error;
-      SelectionRefPtr()->RemoveAllRanges(error);
+      MOZ_KnownLive(SelectionRefPtr())->RemoveAllRanges(error);
       if (error.Failed()) {
         NS_WARNING("Selection::RemoveAllRanges() failed");
         return error.StealNSResult();

diff --git a/editor/libeditor/TextEditor.cpp b/editor/libeditor/TextEditor.cpp
@@ -543,7 +543,7 @@ nsresult TextEditor::ReplaceTextAsAction(
   // Select the range but as far as possible, we should not create new range
   // even if it's part of special Selection.
   ErrorResult error;
-  SelectionRefPtr()->RemoveAllRanges(error);
+  MOZ_KnownLive(SelectionRefPtr())->RemoveAllRanges(error);
   if (error.Failed()) {
     NS_WARNING("Selection::RemoveAllRanges() failed");
     return error.StealNSResult();

diff --git a/extensions/spellcheck/src/mozInlineSpellChecker.cpp b/extensions/spellcheck/src/mozInlineSpellChecker.cpp
@@ -545,7 +545,8 @@ mozInlineSpellChecker::Init(nsIEditor* aEditor) {
 //    flushed, which can cause editors to go away which will bring us here.
 //    We can not do anything that will cause DoSpellCheck to freak out.
 
-nsresult mozInlineSpellChecker::Cleanup(bool aDestroyingFrames) {
+MOZ_CAN_RUN_SCRIPT_BOUNDARY nsresult
+mozInlineSpellChecker::Cleanup(bool aDestroyingFrames) {
   mNumWordsInSpellSelection = 0;
   RefPtr<Selection> spellCheckSelection = GetSpellCheckSelection();
   nsresult rv = NS_OK;

diff --git a/extensions/spellcheck/src/mozInlineSpellChecker.h b/extensions/spellcheck/src/mozInlineSpellChecker.h
@@ -204,8 +204,9 @@ class mozInlineSpellChecker final : public nsIInlineSpellChecker,
   nsresult ScheduleSpellCheck(
       mozilla::UniquePtr<mozInlineSpellStatus>&& aStatus);
 
-  nsresult DoSpellCheckSelection(mozInlineSpellWordUtil& aWordUtil,
-                                 mozilla::dom::Selection* aSpellCheckSelection);
+  MOZ_CAN_RUN_SCRIPT_BOUNDARY nsresult
+  DoSpellCheckSelection(mozInlineSpellWordUtil& aWordUtil,
+                        mozilla::dom::Selection* aSpellCheckSelection);
   nsresult DoSpellCheck(mozInlineSpellWordUtil& aWordUtil,
                         mozilla::dom::Selection* aSpellCheckSelection,
                         const mozilla::UniquePtr<mozInlineSpellStatus>& aStatus,

diff --git a/layout/generic/nsFrameSelection.cpp b/layout/generic/nsFrameSelection.cpp
@@ -2161,10 +2161,13 @@ nsITableCellLayout* nsFrameSelection::GetCellLayout(
 
 nsresult nsFrameSelection::ClearNormalSelection() {
   int8_t index = GetIndexFromSelectionType(SelectionType::eNormal);
-  if (!mDomSelections[index]) return NS_ERROR_NULL_POINTER;
+  RefPtr<Selection> selection = mDomSelections[index];
+  if (!selection) {
+    return NS_ERROR_NULL_POINTER;
+  }
 
   ErrorResult err;
-  mDomSelections[index]->RemoveAllRanges(err);
+  selection->RemoveAllRanges(err);
   return err.StealNSResult();
 }
 

diff --git a/layout/generic/nsFrameSelection.h b/layout/generic/nsFrameSelection.h
@@ -734,7 +734,7 @@ class nsFrameSelection final {
   mozilla::PresShell* GetPresShell() const { return mPresShell; }
 
   void DisconnectFromPresShell();
-  nsresult ClearNormalSelection();
+  MOZ_CAN_RUN_SCRIPT_BOUNDARY nsresult ClearNormalSelection();
 
   // Table selection support.
   static nsITableCellLayout* GetCellLayout(const nsIContent* aCellContent);
@@ -969,7 +969,7 @@ class nsFrameSelection final {
     mozilla::Result<FirstAndLastCell, nsresult>
     FindFirstAndLastCellOfRowOrColumn(const nsIContent& aCellContent) const;
 
-    [[nodiscard]] nsresult HandleDragSelecting(
+    [[nodiscard]] MOZ_CAN_RUN_SCRIPT_BOUNDARY nsresult HandleDragSelecting(
         mozilla::TableSelectionMode aTarget, nsIContent* aChildContent,
         const mozilla::WidgetMouseEvent* aMouseEvent,
         mozilla::dom::Selection& aNormalSelection);

diff --git a/toolkit/components/find/nsWebBrowserFind.h b/toolkit/components/find/nsWebBrowserFind.h
@@ -49,15 +49,16 @@ class nsWebBrowserFind : public nsIWebBrowserFind,
 
   bool CanFindNext() { return mSearchString.Length() != 0; }
 
-  nsresult SearchInFrame(nsPIDOMWindowOuter* aWindow, bool aWrapping,
-                         bool* aDidFind);
+  MOZ_CAN_RUN_SCRIPT_BOUNDARY nsresult
+  SearchInFrame(nsPIDOMWindowOuter* aWindow, bool aWrapping, bool* aDidFind);
 
   nsresult OnStartSearchFrame(nsPIDOMWindowOuter* aWindow);
   nsresult OnEndSearchFrame(nsPIDOMWindowOuter* aWindow);
 
   already_AddRefed<mozilla::dom::Selection> GetFrameSelection(
       nsPIDOMWindowOuter* aWindow);
-  nsresult ClearFrameSelection(nsPIDOMWindowOuter* aWindow);
+  MOZ_CAN_RUN_SCRIPT_BOUNDARY nsresult
+  ClearFrameSelection(nsPIDOMWindowOuter* aWindow);
 
   MOZ_CAN_RUN_SCRIPT_BOUNDARY nsresult OnFind(nsPIDOMWindowOuter* aFoundWindow);