Bug 1625902 - part 1: Mark nsContentUtils::Dispatch*Event as MOZ_CAN_RUN_SCRIPT except for chrome r=smaug,dom-core-reviewers,geckoview-reviewers,media-playback-reviewers,win-reviewers,padenot,handyman,m_kato

This patch does not fix the methods in xslt and content sink because
they require a lot of `MOZ_CAN_RUN_SCRIPT` but I think most of them
do not make sense because working in a specific period.

Differential Revision: https://phabricator.services.mozilla.com/D310971

docshell/base/BrowsingContext.cpp

@@ -2700,8 +2700,9 @@ void BrowsingContext::Close(CallerType aCallerType, ErrorResult& aError) {
   }
 
   if (GetDOMWindow()) {
-    nsGlobalWindowOuter::Cast(GetDOMWindow())
-        ->CloseOuter(aCallerType == CallerType::System);
+    const RefPtr<nsGlobalWindowOuter> win =
+        nsGlobalWindowOuter::Cast(GetDOMWindow());
+    win->CloseOuter(aCallerType == CallerType::System);
     return;
   }
 
@@ -3347,36 +3348,39 @@ void BrowsingContext::DidSet(FieldIndex<IDX_HasOrientationOverride>,
   OrientationType type = GetCurrentOrientationType();
   float angle = GetCurrentOrientationAngle();
 
-  PreOrderWalk([&](BrowsingContext* aBrowsingContext) {
-    if (RefPtr<WindowContext> windowContext =
-            aBrowsingContext->GetCurrentWindowContext()) {
-      if (nsCOMPtr<nsPIDOMWindowInner> window =
-              windowContext->GetInnerWindow()) {
-        ScreenOrientation* orientation =
-            nsGlobalWindowInner::Cast(window)->Screen()->Orientation();
+  PreOrderWalk(
+      [&](BrowsingContext* aBrowsingContext)
+          MOZ_CAN_RUN_SCRIPT_BOUNDARY_LAMBDA {
+            if (RefPtr<WindowContext> windowContext =
+                    aBrowsingContext->GetCurrentWindowContext()) {
+              if (nsCOMPtr<nsPIDOMWindowInner> window =
+                      windowContext->GetInnerWindow()) {
+                const RefPtr<ScreenOrientation> orientation =
+                    nsGlobalWindowInner::Cast(window)->Screen()->Orientation();
 
-        float screenOrientationAngle =
-            orientation->DeviceAngle(CallerType::System);
-        OrientationType screenOrientationType =
-            orientation->DeviceType(CallerType::System);
+                float screenOrientationAngle =
+                    orientation->DeviceAngle(CallerType::System);
+                OrientationType screenOrientationType =
+                    orientation->DeviceType(CallerType::System);
 
-        bool overrideIsDifferentThanDevice =
-            screenOrientationType != type || screenOrientationAngle != angle;
+                bool overrideIsDifferentThanDevice =
+                    screenOrientationType != type ||
+                    screenOrientationAngle != angle;
 
-        // Reset orientation override.
-        if (!hasOrientationOverride && aOldValue) {
-          (void)aBrowsingContext->SetCurrentOrientation(screenOrientationType,
-                                                        screenOrientationAngle);
-        } else if (!aBrowsingContext->IsTop()) {
-          // Sync orientation override in the existing frames.
-          (void)aBrowsingContext->SetCurrentOrientation(type, angle);
-        }
+                // Reset orientation override.
+                if (!hasOrientationOverride && aOldValue) {
+                  (void)aBrowsingContext->SetCurrentOrientation(
+                      screenOrientationType, screenOrientationAngle);
+                } else if (!aBrowsingContext->IsTop()) {
+                  // Sync orientation override in the existing frames.
+                  (void)aBrowsingContext->SetCurrentOrientation(type, angle);
+                }
 
-        orientation->MaybeDispatchEventsForOverride(
-            aBrowsingContext, aOldValue, overrideIsDifferentThanDevice);
-      }
-    }
-  });
+                orientation->MaybeDispatchEventsForOverride(
+                    aBrowsingContext, aOldValue, overrideIsDifferentThanDevice);
+              }
+            }
+          });
 }
 
 void BrowsingContext::DidSet(FieldIndex<IDX_ForceDesktopViewport>,
@@ -4363,15 +4367,17 @@ void BrowsingContext::DidSet(FieldIndex<IDX_ForceOffline>, bool aOldValue) {
   if (newValue == aOldValue) {
     return;
   }
-  PreOrderWalk([&](BrowsingContext* aBrowsingContext) {
-    if (RefPtr<WindowContext> windowContext =
-            aBrowsingContext->GetCurrentWindowContext()) {
-      if (nsCOMPtr<nsPIDOMWindowInner> window =
-              windowContext->GetInnerWindow()) {
-        nsGlobalWindowInner::Cast(window)->FireOfflineStatusEventIfChanged();
-      }
-    }
-  });
+  PreOrderWalk([&](BrowsingContext* aBrowsingContext)
+                   MOZ_CAN_RUN_SCRIPT_BOUNDARY_LAMBDA {
+                     if (RefPtr<WindowContext> windowContext =
+                             aBrowsingContext->GetCurrentWindowContext()) {
+                       if (const RefPtr<nsGlobalWindowInner> window =
+                               nsGlobalWindowInner::Cast(
+                                   windowContext->GetInnerWindow())) {
+                         window->FireOfflineStatusEventIfChanged();
+                       }
+                     }
+                   });
 }
 
 bool BrowsingContext::IsPopupAllowed() {

docshell/base/BrowsingContext.h

@@ -868,7 +868,7 @@ class BrowsingContext : public nsILoadContext, public nsWrapperCache {
   BrowsingContext* Self() { return this; }
   void Location(JSContext* aCx, JS::MutableHandle<JSObject*> aLocation,
                 ErrorResult& aError);
-  void Close(CallerType aCallerType, ErrorResult& aError);
+  MOZ_CAN_RUN_SCRIPT void Close(CallerType aCallerType, ErrorResult& aError);
   bool GetClosed(ErrorResult&) { return GetClosed(); }
   void Focus(CallerType aCallerType, ErrorResult& aError);
   void Blur(CallerType aCallerType, ErrorResult& aError);

docshell/base/nsDSURIContentListener.cpp

@@ -87,11 +87,11 @@ MaybeCloseWindowHelper::ChooseNewBrowsingContext(BrowsingContext* aBC) {
 }
 
 NS_IMETHODIMP
-MaybeCloseWindowHelper::Notify(nsITimer* timer) {
+MaybeCloseWindowHelper::Notify(nsITimer* timer) MOZ_CAN_RUN_SCRIPT_BOUNDARY {
   NS_ASSERTION(mBCToClose, "No window to close after timer fired");
 
-  mBCToClose->Close(CallerType::System, IgnoreErrors());
-  mBCToClose = nullptr;
+  const RefPtr<BrowsingContext> bc = std::move(mBCToClose);
+  bc->Close(CallerType::System, IgnoreErrors());
   mTimer = nullptr;
 
   return NS_OK;
@@ -120,11 +120,10 @@ NS_INTERFACE_MAP_BEGIN(nsDSURIContentListener)
 NS_INTERFACE_MAP_END
 
 NS_IMETHODIMP
-nsDSURIContentListener::DoContent(const nsACString& aContentType,
-                                  bool aIsContentPreferred,
-                                  nsIRequest* aRequest,
-                                  nsIStreamListener** aContentHandler,
-                                  bool* aAbortProcess) {
+nsDSURIContentListener::DoContent(
+    const nsACString& aContentType, bool aIsContentPreferred,
+    nsIRequest* aRequest, nsIStreamListener** aContentHandler,
+    bool* aAbortProcess) MOZ_CAN_RUN_SCRIPT_BOUNDARY {
   nsresult rv;
   NS_ENSURE_ARG_POINTER(aContentHandler);
   NS_ENSURE_TRUE(mDocShell, NS_ERROR_FAILURE);

docshell/base/nsDocShell.cpp

@@ -6720,7 +6720,8 @@ nsresult nsDocShell::CreateAboutBlankDocumentViewer(
         if (mLoadingEntry && mBrowsingContext->IsTop()) {
           mLoadingEntry->mInfo.SetTransient();
         }
-        rv = Embed(viewer, aActor, true, nullptr, mCurrentURI);
+        const nsCOMPtr<nsIURI> uri = mCurrentURI;
+        rv = Embed(viewer, aActor, true, nullptr, uri);
         NS_ENSURE_SUCCESS(rv, rv);
 
         SetCurrentURI(blankDoc->GetDocumentURI(), nullptr,
@@ -7258,7 +7259,8 @@ nsresult nsDocShell::SetupNewViewer(nsIDocumentViewer* aNewViewer,
 
   mDocumentViewer->SetNavigationTiming(mTiming);
 
-  nsresult rv = mDocumentViewer->Init(widget, bounds, aWindowActor);
+  nsresult rv =
+      MOZ_KnownLive(mDocumentViewer)->Init(widget, bounds, aWindowActor);
   if (NS_FAILED(rv)) {
     nsCOMPtr<nsIDocumentViewer> viewer = mDocumentViewer;
     viewer->Close();
@@ -9821,7 +9823,8 @@ nsresult nsDocShell::DoURILoad(nsDocShellLoadState* aLoadState,
     // - We also set IsDocumentPiP on chrome but the spec doesn't apply to it.
     if (Document* doc = GetExtantDocument()) {
       NS_DispatchToMainThread(NS_NewRunnableFunction(
-          "Close PIP window on navigate", [doc = RefPtr(doc)]() {
+          "Close PIP window on navigate",
+          [doc = RefPtr(doc)]() MOZ_CAN_RUN_SCRIPT_BOUNDARY_LAMBDA {
             doc->CloseAnyAssociatedDocumentPiPWindows();
           }));
     }

docshell/base/nsDocShell.h

@@ -559,9 +559,9 @@ class nsDocShell final : public nsDocLoader,
       bool aTryToSaveOldPresentation = true, bool aCheckPermitUnload = true,
       mozilla::dom::WindowGlobalChild* aActor = nullptr);
 
-  nsresult CreateDocumentViewer(const nsACString& aContentType,
-                                nsIRequest* aRequest,
-                                nsIStreamListener** aContentHandler);
+  MOZ_CAN_RUN_SCRIPT nsresult
+  CreateDocumentViewer(const nsACString& aContentType, nsIRequest* aRequest,
+                       nsIStreamListener** aContentHandler);
 
   nsresult NewDocumentViewerObj(const nsACString& aContentType,
                                 nsIRequest* aRequest, nsILoadGroup* aLoadGroup,
@@ -570,9 +570,9 @@ class nsDocShell final : public nsDocLoader,
 
   already_AddRefed<nsILoadURIDelegate> GetLoadURIDelegate();
 
-  nsresult SetupNewViewer(
-      nsIDocumentViewer* aNewViewer,
-      mozilla::dom::WindowGlobalChild* aWindowActor = nullptr);
+  MOZ_CAN_RUN_SCRIPT nsresult
+  SetupNewViewer(nsIDocumentViewer* aNewViewer,
+                 mozilla::dom::WindowGlobalChild* aWindowActor = nullptr);
 
   // Finds the target browsing context for this load according to
   // aLoadState->Target() and sets aLoadState->TargetBrowsingContext() to it.
@@ -960,10 +960,10 @@ class nsDocShell final : public nsDocLoader,
   nsresult EnsureCommandHandler();
   nsresult RefreshURIFromQueue();
   void RefreshURIToQueue();
-  nsresult Embed(nsIDocumentViewer* aDocumentViewer,
-                 mozilla::dom::WindowGlobalChild* aWindowActor,
-                 bool aIsTransientAboutBlank, nsIRequest* aRequest,
-                 nsIURI* aPreviousURI);
+  MOZ_CAN_RUN_SCRIPT nsresult Embed(
+      nsIDocumentViewer* aDocumentViewer,
+      mozilla::dom::WindowGlobalChild* aWindowActor,
+      bool aIsTransientAboutBlank, nsIRequest* aRequest, nsIURI* aPreviousURI);
   nsPresContext* GetEldestPresContext();
   nsresult CheckLoadingPermissions();
 

docshell/base/nsIDocumentViewer.idl

@@ -45,9 +45,9 @@ class RemotePrintJobChild;
 [scriptable, builtinclass, uuid(48118355-e9a5-4452-ab18-59cc426fb817)]
 interface nsIDocumentViewer : nsISupports
 {
-  [noscript] void init(in nsIWidgetPtr aParentWidget,
-                       [const] in LayoutDeviceIntRectRef aBounds,
-                       in WindowGlobalChildPtr aWindowActor);
+  [noscript,can_run_script] void init(in nsIWidgetPtr aParentWidget,
+                                      [const] in LayoutDeviceIntRectRef aBounds,
+                                      in WindowGlobalChildPtr aWindowActor);
 
   attribute nsIDocShell container;
 
@@ -153,7 +153,7 @@ interface nsIDocumentViewer : nsISupports
   /**
    * Allows setting the document.
    */
-  [noscript,nostdcall] void setDocument(in Document aDocument);
+  [noscript,nostdcall,can_run_script] void setDocument(in Document aDocument);
 
   [noscript] void getBounds(in LayoutDeviceIntRectRef aBounds);
   [noscript] void setBounds([const] in LayoutDeviceIntRectRef aBounds);
@@ -180,6 +180,7 @@ interface nsIDocumentViewer : nsISupports
   /**
    * Attach the content viewer to its DOM window and docshell.
    */
+  [can_run_script]
   void open();
 
   /**
@@ -192,6 +193,7 @@ interface nsIDocumentViewer : nsISupports
    * Change the layout to view the document with page layout (like print preview), but
    * dynamic and editable (like Galley layout).
    */
+  [can_run_script]
   void setPageModeForTesting(in boolean aPageMode,
                              in nsIPrintSettings aPrintSettings);
 
@@ -223,8 +225,8 @@ interface nsIDocumentViewer : nsISupports
   // presContext can be null.
   [notxpcom,nostdcall] readonly attribute nsPresContextPtr presContext;
   // aDocument must not be null.
-  [noscript] void setDocumentInternal(in Document aDocument,
-                                      in boolean aForceReuseInnerWindow);
+  [noscript,can_run_script] void setDocumentInternal(in Document aDocument,
+                                                     in boolean aForceReuseInnerWindow);
   /**
    * Find the view to use as the container view for MakeWindow. Returns
    * null if this will be the root of a view manager hierarchy. In that

dom/base/AutoPrintEventDispatcher.h

@@ -14,33 +14,6 @@
 namespace mozilla::dom {
 
 class AutoPrintEventDispatcher {
-  // NOTE(emilio): For fission iframes, we dispatch this event in
-  // RecvCloneDocumentTreeIntoSelf.
-  static void CollectInProcessSubdocuments(
-      Document& aDoc, nsTArray<nsCOMPtr<Document>>& aDocs) {
-    aDoc.EnumerateSubDocuments([&aDocs](Document& aSubDoc) {
-      aDocs.AppendElement(&aSubDoc);
-      CollectInProcessSubdocuments(aSubDoc, aDocs);
-      return CallState::Continue;
-    });
-  }
-
-  MOZ_CAN_RUN_SCRIPT void DispatchEvent(bool aBefore) {
-    for (auto& doc : mDocuments) {
-      nsContentUtils::DispatchTrustedEvent(
-          doc, nsGlobalWindowOuter::Cast(doc->GetWindow()),
-          aBefore ? u"beforeprint"_ns : u"afterprint"_ns, CanBubble::eNo,
-          Cancelable::eNo, nullptr);
-      if (RefPtr<nsPresContext> presContext = doc->GetPresContext()) {
-        presContext->EmulateMedium(aBefore ? nsGkAtoms::print : nullptr);
-        // Ensure media query listeners fire.
-        // FIXME(emilio): This is hacky, at best, but is required for compat
-        // with some pages, see bug 774398.
-        doc->EvaluateMediaQueriesAndReportChanges();
-      }
-    }
-  }
-
  public:
   MOZ_CAN_RUN_SCRIPT explicit AutoPrintEventDispatcher(Document& aDoc) {
     if (!aDoc.IsStaticDocument()) {
@@ -53,6 +26,38 @@ class AutoPrintEventDispatcher {
 
   MOZ_CAN_RUN_SCRIPT ~AutoPrintEventDispatcher() { DispatchEvent(false); }
 
+ private:
+  // NOTE(emilio): For fission iframes, we dispatch this event in
+  // RecvCloneDocumentTreeIntoSelf.
+  static void CollectInProcessSubdocuments(
+      Document& aDoc, nsTArray<nsCOMPtr<Document>>& aDocs) {
+    aDoc.EnumerateSubDocuments([&aDocs](Document& aSubDoc) {
+      aDocs.AppendElement(&aSubDoc);
+      CollectInProcessSubdocuments(aSubDoc, aDocs);
+      return CallState::Continue;
+    });
+  }
+
+  MOZ_CAN_RUN_SCRIPT void DispatchEvent(bool aBefore) {
+    for (const auto& doc : mDocuments) {
+      const RefPtr<nsGlobalWindowOuter> window =
+          nsGlobalWindowOuter::Cast(doc->GetWindow());
+      // mDocuments won't be modified. Therefore, we can use MOZ_KnownLive(doc)
+      // here.
+      nsContentUtils::DispatchTrustedEvent(
+          MOZ_KnownLive(doc), window,
+          aBefore ? u"beforeprint"_ns : u"afterprint"_ns, CanBubble::eNo,
+          Cancelable::eNo, nullptr);
+      if (RefPtr<nsPresContext> presContext = doc->GetPresContext()) {
+        presContext->EmulateMedium(aBefore ? nsGkAtoms::print : nullptr);
+        // Ensure media query listeners fire.
+        // FIXME(emilio): This is hacky, at best, but is required for compat
+        // with some pages, see bug 774398.
+        doc->EvaluateMediaQueriesAndReportChanges();
+      }
+    }
+  }
+
   AutoTArray<nsCOMPtr<Document>, 8> mDocuments;
   const nsSize mPageSize;
   nsRect mVisibleAreaToRestore;

dom/base/Document.cpp

@@ -1119,7 +1119,8 @@ void ExternalResourceMap::ShowViewers() {
   }
 }
 
-void TransferShowingState(Document* aFromDoc, Document* aToDoc) {
+void TransferShowingState(Document* aFromDoc,
+                          Document* aToDoc) MOZ_CAN_RUN_SCRIPT {
   MOZ_ASSERT(aFromDoc && aToDoc, "transferring showing state from/to null doc");
 
   if (aFromDoc->IsShowing()) {
@@ -1188,7 +1189,8 @@ NS_IMPL_ISUPPORTS(ExternalResourceMap::PendingLoad, nsIStreamListener,
                   nsIRequestObserver)
 
 NS_IMETHODIMP
-ExternalResourceMap::PendingLoad::OnStartRequest(nsIRequest* aRequest) {
+ExternalResourceMap::PendingLoad::OnStartRequest(nsIRequest* aRequest)
+    MOZ_CAN_RUN_SCRIPT_BOUNDARY {
   ExternalResourceMap& map = mDisplayDocument->ExternalResourceMap();
   if (map.HaveShutDown()) {
     return NS_BINDING_ABORTED;
@@ -1200,8 +1202,10 @@ ExternalResourceMap::PendingLoad::OnStartRequest(nsIRequest* aRequest) {
       SetupViewer(aRequest, getter_AddRefs(viewer), getter_AddRefs(loadGroup));
 
   // Make sure to do this no matter what
+  const nsCOMPtr<nsIURI> uri = mURI;
+  const RefPtr<Document> displayDocument = mDisplayDocument;
   nsresult rv2 =
-      map.AddExternalResource(mURI, viewer, loadGroup, mDisplayDocument);
+      map.AddExternalResource(uri, viewer, loadGroup, displayDocument);
   if (NS_FAILED(rv)) {
     return rv;
   }
@@ -8591,7 +8595,8 @@ void Document::SetScriptGlobalObject(
 
   // The global in the template contents owner document should be the same.
   if (mTemplateContentsOwner && mTemplateContentsOwner != this) {
-    mTemplateContentsOwner->SetScriptGlobalObject(aScriptGlobalObject);
+    const RefPtr<Document> anotherDoc = mTemplateContentsOwner;
+    anotherDoc->SetScriptGlobalObject(aScriptGlobalObject);
   }
 
   // Tell the script loader about the new global object.
@@ -10354,9 +10359,9 @@ Document* Document::RequestExternalResource(
   MOZ_ASSERT(aURI, "Must have a URI");
   MOZ_ASSERT(aRequestingNode, "Must have a node");
   MOZ_ASSERT(aReferrerInfo, "Must have a referrerInfo");
-  if (mDisplayDocument) {
-    return mDisplayDocument->RequestExternalResource(
-        aURI, aReferrerInfo, aRequestingNode, aPendingLoad);
+  if (const RefPtr<Document> displayDoc = mDisplayDocument) {
+    return displayDoc->RequestExternalResource(aURI, aReferrerInfo,
+                                               aRequestingNode, aPendingLoad);
   }
 
   return mExternalResourceMap.RequestResource(
@@ -12493,7 +12498,7 @@ bool Document::CanSavePresentation(nsIRequest* aNewRequest,
 
 // https://wicg.github.io/document-picture-in-picture/#close-any-associated-document-picture-in-picture-windows
 void Document::CloseAnyAssociatedDocumentPiPWindows() {
-  BrowsingContext* bc = GetBrowsingContext();
+  const RefPtr<BrowsingContext> bc = GetBrowsingContext();
   if (!bc || !bc->IsTop()) {
     return;
   }
@@ -12856,10 +12861,12 @@ void Document::OnPageShow(bool aPersisted, EventTarget* aDispatchStartTarget,
 
   NotifyActivityChanged();
 
-  EnumerateExternalResources([aPersisted](Document& aExternalResource) {
-    aExternalResource.OnPageShow(aPersisted, nullptr);
-    return CallState::Continue;
-  });
+  EnumerateExternalResources([aPersisted](Document& aExternalResource)
+                                 MOZ_CAN_RUN_SCRIPT_BOUNDARY_LAMBDA {
+                                   aExternalResource.OnPageShow(aPersisted,
+                                                                nullptr);
+                                   return CallState::Continue;
+                                 });
 
   if (mAnimationController) {
     mAnimationController->OnPageShow();
@@ -12976,10 +12983,12 @@ void Document::OnPageHide(bool aPersisted, EventTarget* aDispatchStartTarget,
     UpdateVisibilityState();
   }
 
-  EnumerateExternalResources([aPersisted](Document& aExternalResource) {
-    aExternalResource.OnPageHide(aPersisted, nullptr);
-    return CallState::Continue;
-  });
+  EnumerateExternalResources([aPersisted](Document& aExternalResource)
+                                 MOZ_CAN_RUN_SCRIPT_BOUNDARY_LAMBDA {
+                                   aExternalResource.OnPageHide(aPersisted,
+                                                                nullptr);
+                                   return CallState::Continue;
+                                 });
   NotifyActivityChanged();
 
   ClearPendingFullscreenRequests(this);
@@ -14587,8 +14596,9 @@ already_AddRefed<Document> Document::CreateStaticClone(
 
     clone.mElement->SetFrameLoader(frameLoader);
 
+    const RefPtr<nsFrameLoader> frameLoaderOfClone = clone.mStaticCloneOf;
     nsresult rv = frameLoader->FinishStaticClone(
-        clone.mStaticCloneOf, aPrintSettings, aOutHasInProcessPrintCallbacks);
+        frameLoaderOfClone, aPrintSettings, aOutHasInProcessPrintCallbacks);
     (void)NS_WARN_IF(NS_FAILED(rv));
   }
 
@@ -14967,7 +14977,7 @@ void Document::DoUpdateSVGUseElementShadowTrees() {
         MOZ_ASSERT(useElementsToUpdate.Length() > 1);
         continue;
       }
-      useElement->UpdateShadowTree();
+      MOZ_KnownLive(useElement)->UpdateShadowTree();
     }
   } while (!mSVGUseElementsNeedingShadowTreeUpdate.IsEmpty());
 }
@@ -15858,13 +15868,13 @@ already_AddRefed<Promise> Document::ExitPictureInPicture(ErrorResult& aRv) {
   return p.forget();
 }
 
-static void AskWindowToExitFullscreen(Document* aDoc) {
+static void AskWindowToExitFullscreen(Document* aDoc) MOZ_CAN_RUN_SCRIPT {
   if (XRE_GetProcessType() == GeckoProcessType_Content) {
     nsContentUtils::DispatchEventOnlyToChrome(
         aDoc, aDoc, u"MozDOMFullscreen:Exit"_ns, CanBubble::eYes,
         Cancelable::eNo, /* DefaultAction */ nullptr);
   } else {
-    if (nsPIDOMWindowOuter* win = aDoc->GetWindow()) {
+    if (const RefPtr<nsPIDOMWindowOuter> win = aDoc->GetWindow()) {
       win->SetFullscreenInternal(FullscreenReason::ForFullscreenAPI, false);
     }
   }
@@ -15875,7 +15885,7 @@ class nsCallExitFullscreen : public Runnable {
   explicit nsCallExitFullscreen(Document* aDoc)
       : mozilla::Runnable("nsCallExitFullscreen"), mDoc(aDoc) {}
 
-  NS_IMETHOD Run() final {
+  MOZ_CAN_RUN_SCRIPT_BOUNDARY NS_IMETHOD Run() final {
     if (!mDoc) {
       FullscreenRoots::ForEach(&AskWindowToExitFullscreen);
     } else {
@@ -15885,7 +15895,7 @@ class nsCallExitFullscreen : public Runnable {
   }
 
  private:
-  nsCOMPtr<Document> mDoc;
+  MOZ_KNOWN_LIVE const nsCOMPtr<Document> mDoc;
 };
 
 /* static */
@@ -15963,7 +15973,7 @@ class ExitFullscreenScriptRunnable : public Runnable {
         mRoot(aRoot),
         mLeaf(aLeaf) {}
 
-  NS_IMETHOD Run() override {
+  MOZ_CAN_RUN_SCRIPT_BOUNDARY NS_IMETHOD Run() override {
     // Dispatch MozDOMFullscreen:Exited to the original fullscreen leaf
     // document since we want this event to follow the same path that
     // MozDOMFullscreen:Entered was dispatched.
@@ -15972,7 +15982,7 @@ class ExitFullscreenScriptRunnable : public Runnable {
         Cancelable::eNo, /* DefaultAction */ nullptr);
     // Ensure the window exits fullscreen, as long as we don't have
     // pending fullscreen requests.
-    if (nsPIDOMWindowOuter* win = mRoot->GetWindow()) {
+    if (const RefPtr<nsPIDOMWindowOuter> win = mRoot->GetWindow()) {
       if (!mRoot->HasPendingFullscreenRequests()) {
         win->SetFullscreenInternal(FullscreenReason::ForForceExitFullscreen,
                                    false);
@@ -15982,8 +15992,8 @@ class ExitFullscreenScriptRunnable : public Runnable {
   }
 
  private:
-  nsCOMPtr<Document> mRoot;
-  nsCOMPtr<Document> mLeaf;
+  MOZ_KNOWN_LIVE const nsCOMPtr<Document> mRoot;
+  MOZ_KNOWN_LIVE const nsCOMPtr<Document> mLeaf;
 };
 
 /* static */

dom/base/Document.h

@@ -399,10 +399,9 @@ class ExternalResourceMap {
    * Request an external resource document.  This does exactly what
    * Document::RequestExternalResource is documented to do.
    */
-  Document* RequestResource(nsIURI* aURI, nsIReferrerInfo* aReferrerInfo,
-                            nsINode* aRequestingNode,
-                            Document* aDisplayDocument,
-                            ExternalResourceLoad** aPendingLoad);
+  MOZ_CAN_RUN_SCRIPT Document* RequestResource(
+      nsIURI* aURI, nsIReferrerInfo* aReferrerInfo, nsINode* aRequestingNode,
+      Document* aDisplayDocument, ExternalResourceLoad** aPendingLoad);
 
   /**
    * Enumerate the resource documents.  See
@@ -526,9 +525,10 @@ class ExternalResourceMap {
    * function makes sure to remove the pending load for aURI, if any, from our
    * hashtable, and to notify its observers, if any.
    */
-  nsresult AddExternalResource(nsIURI* aURI, nsIDocumentViewer* aViewer,
-                               nsILoadGroup* aLoadGroup,
-                               Document* aDisplayDocument);
+  MOZ_CAN_RUN_SCRIPT nsresult AddExternalResource(nsIURI* aURI,
+                                                  nsIDocumentViewer* aViewer,
+                                                  nsILoadGroup* aLoadGroup,
+                                                  Document* aDisplayDocument);
 
   nsClassHashtable<nsURIHashKey, ExternalResource> mMap;
   nsRefPtrHashtable<nsURIHashKey, PendingLoad> mPendingLoads;
@@ -1854,7 +1854,11 @@ class Document : public nsINode,
    */
   AttributeStyles* GetAttributeStyles() const { return mAttributeStyles.get(); }
 
-  virtual void SetScriptGlobalObject(nsIScriptGlobalObject* aGlobalObject);
+  // This calls UpdateVisibilityState with DispatchVisibilityChange::No. Then,
+  // UpdateVisibilityState does not run script. Additionally, this needs to be
+  // called by Unlink(). Therefore, we mark this as MOZ_CAN_RUN_SCRIPT_BOUNDARY.
+  MOZ_CAN_RUN_SCRIPT_BOUNDARY virtual void SetScriptGlobalObject(
+      nsIScriptGlobalObject* aGlobalObject);
 
   /**
    * Get/set the object from which the context for the event/script handling can
@@ -1995,13 +1999,15 @@ class Document : public nsINode,
    * the <iframe> or <browser> that contains this document is also mode
    * fullscreen. This happens recursively in all ancestor documents.
    */
-  void RequestFullscreen(UniquePtr<FullscreenRequest> aRequest,
-                         bool aApplyFullscreenDirectly = false);
+  MOZ_CAN_RUN_SCRIPT void RequestFullscreen(
+      UniquePtr<FullscreenRequest> aRequest,
+      bool aApplyFullscreenDirectly = false);
 
  private:
   void RequestFullscreenInContentProcess(UniquePtr<FullscreenRequest> aRequest,
                                          bool aApplyFullscreenDirectly);
-  void RequestFullscreenInParentProcess(UniquePtr<FullscreenRequest> aRequest);
+  MOZ_CAN_RUN_SCRIPT void RequestFullscreenInParentProcess(
+      UniquePtr<FullscreenRequest> aRequest);
 
   // Pushes aElement onto the top layer
   void TopLayerPush(Element&);
@@ -2080,8 +2086,8 @@ class Document : public nsINode,
    * aFrameElement is the frame element which contains the child-process
    * fullscreen document.
    */
-  void RemoteFrameFullscreenChanged(Element* aFrameElement,
-                                    bool aFullscreenKeyboardLockEnabled);
+  MOZ_CAN_RUN_SCRIPT void RemoteFrameFullscreenChanged(
+      Element* aFrameElement, bool aFullscreenKeyboardLockEnabled);
 
   /**
    * Called when a frame in a remote child document has rolled back fullscreen
@@ -2092,14 +2098,15 @@ class Document : public nsINode,
    * fullscreen document has a parent and that parent isn't fullscreen. We
    * preserve this property across process boundaries.
    */
-  void RemoteFrameFullscreenReverted();
+  MOZ_CAN_RUN_SCRIPT void RemoteFrameFullscreenReverted();
 
   /**
    * Restores the previous fullscreen element to fullscreen status. If there
    * is no former fullscreen element, this exits fullscreen, moving the
    * top-level browser window out of fullscreen mode.
    */
-  void RestorePreviousFullscreenState(UniquePtr<FullscreenExit>);
+  MOZ_CAN_RUN_SCRIPT void RestorePreviousFullscreenState(
+      UniquePtr<FullscreenExit>);
 
   /**
    * Returns true if this document is a fullscreen leaf document, i.e. it
@@ -2273,7 +2280,7 @@ class Document : public nsINode,
   void RemoveWorkerDocumentListener(WorkerDocumentListener* aListener);
 
   // Triggers an update of <svg:use> element shadow trees.
-  void UpdateSVGUseElementShadowTrees() {
+  MOZ_CAN_RUN_SCRIPT void UpdateSVGUseElementShadowTrees() {
     if (mSVGUseElementsNeedingShadowTreeUpdate.IsEmpty()) {
       return;
     }
@@ -2570,7 +2577,7 @@ class Document : public nsINode,
   virtual void Destroy();
 
   // https://wicg.github.io/document-picture-in-picture/#close-on-destroy
-  void CloseAnyAssociatedDocumentPiPWindows();
+  MOZ_CAN_RUN_SCRIPT void CloseAnyAssociatedDocumentPiPWindows();
 
   /**
    * Notify the document that its associated DocumentViewer is no longer
@@ -2623,8 +2630,9 @@ class Document : public nsINode,
    * Note: if aDispatchStartTarget isn't null, the showing state of the
    * document won't be altered.
    */
-  virtual void OnPageShow(bool aPersisted, EventTarget* aDispatchStartTarget,
-                          bool aOnlySystemGroup = false);
+  MOZ_CAN_RUN_SCRIPT virtual void OnPageShow(bool aPersisted,
+                                             EventTarget* aDispatchStartTarget,
+                                             bool aOnlySystemGroup = false);
 
   /**
    * Notification that the page has been hidden, for documents which are loaded
@@ -2639,8 +2647,9 @@ class Document : public nsINode,
    * Note: if aDispatchStartTarget isn't null, the showing state of the
    * document won't be altered.
    */
-  void OnPageHide(bool aPersisted, EventTarget* aDispatchStartTarget,
-                  bool aOnlySystemGroup = false);
+  MOZ_CAN_RUN_SCRIPT void OnPageHide(bool aPersisted,
+                                     EventTarget* aDispatchStartTarget,
+                                     bool aOnlySystemGroup = false);
 
   /*
    * We record the set of links in the document that are relevant to
@@ -2827,10 +2836,9 @@ class Document : public nsINode,
    * @param aRequestingNode the node making the request
    * @param aPendingLoad the pending load for this request, if any
    */
-  Document* RequestExternalResource(nsIURI* aURI,
-                                    nsIReferrerInfo* aReferrerInfo,
-                                    nsINode* aRequestingNode,
-                                    ExternalResourceLoad** aPendingLoad);
+  MOZ_CAN_RUN_SCRIPT Document* RequestExternalResource(
+      nsIURI* aURI, nsIReferrerInfo* aReferrerInfo, nsINode* aRequestingNode,
+      ExternalResourceLoad** aPendingLoad);
 
   /**
    * Enumerate the external resource documents associated with this document.
@@ -3133,7 +3141,7 @@ class Document : public nsINode,
    * @param aPrintSettings The print settings for this clone.
    * @param aOutHasInProcessPrintCallbacks Self-descriptive.
    */
-  already_AddRefed<Document> CreateStaticClone(
+  MOZ_CAN_RUN_SCRIPT already_AddRefed<Document> CreateStaticClone(
       nsIDocShell* aCloneContainer, nsIDocumentViewer* aDocumentViewer,
       nsIPrintSettings* aPrintSettings, bool* aOutHasInProcessPrintCallbacks);
 
@@ -3455,7 +3463,7 @@ class Document : public nsINode,
   //
   // Whether the event fires is controlled by the argument.
   enum class DispatchVisibilityChange { No, Yes };
-  void UpdateVisibilityState(
+  MOZ_CAN_RUN_SCRIPT void UpdateVisibilityState(
       DispatchVisibilityChange = DispatchVisibilityChange::Yes);
 
   // Posts an event to call UpdateVisibilityState.
@@ -3755,7 +3763,7 @@ class Document : public nsINode,
   // Return the fullscreen element in the top layer
   Element* GetUnretargetedFullscreenElement() const;
   bool Fullscreen() const { return !!GetUnretargetedFullscreenElement(); }
-  already_AddRefed<Promise> ExitFullscreen(ErrorResult&);
+  MOZ_CAN_RUN_SCRIPT already_AddRefed<Promise> ExitFullscreen(ErrorResult&);
   void ExitPointerLock() {
     PointerLockManager::Unlock("Document::ExitPointerLock", this);
   }
@@ -4597,7 +4605,7 @@ class Document : public nsINode,
   // page use counters to.
   WindowContext* GetWindowContextForPageUseCounters() const;
 
-  void DoUpdateSVGUseElementShadowTrees();
+  MOZ_CAN_RUN_SCRIPT void DoUpdateSVGUseElementShadowTrees();
 
   already_AddRefed<nsIPrincipal> MaybeDowngradePrincipal(
       nsIPrincipal* aPrincipal);

dom/base/Element.cpp

@@ -5132,7 +5132,8 @@ already_AddRefed<Promise> Element::RequestFullscreen(
   if (const char* error = GetFullscreenError(aCallerType, OwnerDoc())) {
     request->Reject(error);
   } else {
-    OwnerDoc()->RequestFullscreen(std::move(request));
+    const RefPtr<Document> doc = OwnerDoc();
+    doc->RequestFullscreen(std::move(request));
   }
   return promise.forget();
 }

dom/base/Element.h

@@ -1654,8 +1654,8 @@ class Element : public FragmentOrElement {
 
   void ReleaseCapture();
 
-  already_AddRefed<Promise> RequestFullscreen(const FullscreenOptions&,
-                                              CallerType, ErrorResult&);
+  MOZ_CAN_RUN_SCRIPT already_AddRefed<Promise> RequestFullscreen(
+      const FullscreenOptions&, CallerType, ErrorResult&);
   already_AddRefed<Promise> RequestPointerLock(
       const PointerLockOptions& aOptions, CallerType aCallerType,
       ErrorResult& aRv);

dom/base/IDTracker.cpp

@@ -94,8 +94,9 @@ void IDTracker::ResetToExternalResource(nsIURI* aURI,
   Unlink();
 
   RefPtr<Document::ExternalResourceLoad> load;
-  Document* resourceDoc = aFrom.OwnerDoc()->RequestExternalResource(
-      aURI, aReferrerInfo, &aFrom, getter_AddRefs(load));
+  const RefPtr<Document> doc = aFrom.OwnerDoc();
+  Document* resourceDoc = doc->RequestExternalResource(
+      aURI, aReferrerInfo, MOZ_KnownLive(&aFrom), getter_AddRefs(load));
   if (!resourceDoc) {
     if (!load) {
       // Nothing will ever happen here
@@ -173,7 +174,8 @@ void IDTracker::ResetToLocalFragmentID(Element& aFrom,
   }
 
   RefPtr<nsAtom> refAtom = NS_Atomize(unescaped);
-  if (nsIURI* resourceUri = GetExternalResourceURIIfNeeded(aBaseURI, aFrom)) {
+  if (const nsCOMPtr<nsIURI> resourceUri =
+          GetExternalResourceURIIfNeeded(aBaseURI, aFrom)) {
     return ResetToExternalResource(resourceUri, aReferrerInfo, refAtom, aFrom,
                                    aReferenceImage);
   }

dom/base/IDTracker.h

@@ -69,9 +69,9 @@ class IDTracker {
    *   property (that is, we're creating a reference an "image element", which
    *   is subject to the document's mozSetImageElement overriding mechanism).
    */
-  void ResetToURIWithFragmentID(Element& aFrom, nsIURI* aURI,
-                                nsIReferrerInfo* aReferrerInfo,
-                                bool aReferenceImage = false);
+  MOZ_CAN_RUN_SCRIPT void ResetToURIWithFragmentID(
+      Element& aFrom, nsIURI* aURI, nsIReferrerInfo* aReferrerInfo,
+      bool aReferenceImage = false);
 
   /**
    * A variation on ResetToURIWithFragmentID() to set up a reference that
@@ -87,10 +87,9 @@ class IDTracker {
    *   the referenced element is in an external resource document.
    * @param aReferenceImage See above.
    */
-  void ResetToLocalFragmentID(Element& aFrom, const nsAString& aLocalRef,
-                              nsIURI* aBaseURI = nullptr,
-                              nsIReferrerInfo* aReferrerInfo = nullptr,
-                              bool aReferenceImage = false);
+  MOZ_CAN_RUN_SCRIPT void ResetToLocalFragmentID(
+      Element& aFrom, const nsAString& aLocalRef, nsIURI* aBaseURI = nullptr,
+      nsIReferrerInfo* aReferrerInfo = nullptr, bool aReferenceImage = false);
 
   /**
    * A variation on ResetToURIWithFragmentID() to set up a reference that
@@ -113,9 +112,9 @@ class IDTracker {
 
  protected:
   /** Requests and maybe watches an external resource doc. */
-  void ResetToExternalResource(nsIURI* aURI, nsIReferrerInfo* aReferrerInfo,
-                               nsAtom* aRef, Element& aFrom,
-                               bool aReferenceImage);
+  MOZ_CAN_RUN_SCRIPT void ResetToExternalResource(
+      nsIURI* aURI, nsIReferrerInfo* aReferrerInfo, nsAtom* aRef,
+      Element& aFrom, bool aReferenceImage);
 
   /**
    * Override this to be notified of element changes. Don't forget

dom/base/ScreenOrientation.h

@@ -36,9 +36,9 @@ class ScreenOrientation final : public DOMEventTargetHelper {
 
   // Called when we might need to dispatch orientation change events
   // in case of orientation override being set, updated or removed.
-  void MaybeDispatchEventsForOverride(BrowsingContext* aBrowsingContext,
-                                      bool aOldHasOrientationOverride,
-                                      bool aOverrideIsDifferentThanDevice);
+  MOZ_CAN_RUN_SCRIPT void MaybeDispatchEventsForOverride(
+      BrowsingContext* aBrowsingContext, bool aOldHasOrientationOverride,
+      bool aOverrideIsDifferentThanDevice);
 
  private:
   ScreenOrientation(nsPIDOMWindowInner* aWindow, nsScreen* aScreen);

dom/base/Selection.cpp

@@ -1208,8 +1208,8 @@ static nsINode* DetermineSelectstartEventTarget(const nsRange& aRange) {
 /**
  * @return true, iff the default action should be executed.
  */
-static bool MaybeDispatchSelectstartEvent(const nsRange& aRange,
-                                          Document* aDocument) {
+static bool MaybeDispatchSelectstartEvent(
+    const nsRange& aRange, Document* aDocument) MOZ_CAN_RUN_SCRIPT {
   nsCOMPtr<nsINode> selectstartEventTarget =
       DetermineSelectstartEventTarget(aRange);
 
@@ -1260,7 +1260,7 @@ nsresult Selection::AddRangesForUserSelectableNodes(
     aOutIndex->emplace(mStyledRanges.Length() - 1);
   }
 
-  Document* doc = GetDocument();
+  const RefPtr<Document> doc = GetDocument();
 
   if (aDispatchSelectstartEvent == DispatchSelectstartEvent::Maybe &&
       mSelectionType == SelectionType::eNormal && IsCollapsed() &&

dom/base/nsContentSink.cpp

@@ -220,7 +220,8 @@ nsContentSink::StyleSheetLoaded(StyleSheet* aSheet, bool aWasDeferred,
 
     if (loadedAllSheets &&
         mDocument->GetReadyStateEnum() >= Document::READYSTATE_INTERACTIVE) {
-      mScriptLoader->DeferCheckpointReached();
+      const RefPtr<ScriptLoader> scriptLoader = mScriptLoader;
+      scriptLoader->DeferCheckpointReached();
     }
   }
 
@@ -848,10 +849,10 @@ void nsContentSink::DidBuildModelImpl(bool aTerminated) {
              "Bad readyState");
   mDocument->SetReadyStateInternal(Document::READYSTATE_INTERACTIVE);
 
-  if (mScriptLoader) {
-    mScriptLoader->ParsingComplete(aTerminated);
+  if (const RefPtr<ScriptLoader> scriptLoader = mScriptLoader) {
+    scriptLoader->ParsingComplete(aTerminated);
     if (!mPendingSheetCount) {
-      mScriptLoader->DeferCheckpointReached();
+      scriptLoader->DeferCheckpointReached();
     }
   }
 

dom/base/nsContentSink.h

@@ -90,8 +90,9 @@ class nsContentSink : public nsICSSLoaderObserver,
   NS_DECL_NSINAMED
 
   // nsICSSLoaderObserver
-  NS_IMETHOD StyleSheetLoaded(mozilla::StyleSheet* aSheet, bool aWasDeferred,
-                              nsresult aStatus) override;
+  MOZ_CAN_RUN_SCRIPT_BOUNDARY NS_IMETHOD
+  StyleSheetLoaded(mozilla::StyleSheet* aSheet, bool aWasDeferred,
+                   nsresult aStatus) override;
 
   // nsIContentSink implementation helpers
   nsresult WillParseImpl(void);
@@ -99,7 +100,7 @@ class nsContentSink : public nsICSSLoaderObserver,
   void WillResumeImpl();
   nsresult DidProcessATokenImpl(void);
   void WillBuildModelImpl(void);
-  void DidBuildModelImpl(bool aTerminated);
+  MOZ_CAN_RUN_SCRIPT void DidBuildModelImpl(bool aTerminated);
   void DropParserAndPerfHint(void);
   bool IsScriptExecutingImpl();
   void ContinueParsingDocumentAfterCurrentScriptImpl();
@@ -123,13 +124,13 @@ class nsContentSink : public nsICSSLoaderObserver,
 
   nsresult ProcessHTTPHeaders(nsIChannel* aChannel);
   // aEarlyHintPreloaderId zero means no early hint channel to connect back
-  nsresult ProcessLinkFromHeader(const mozilla::net::LinkHeader& aHeader,
-                                 uint64_t aEarlyHintPreloaderId);
+  MOZ_CAN_RUN_SCRIPT_BOUNDARY nsresult ProcessLinkFromHeader(
+      const mozilla::net::LinkHeader& aHeader, uint64_t aEarlyHintPreloaderId);
 
   // @param aFetchPriority Accepts a case-insensitive fetch priority keyword and
   //                       other values too, see
   //                       <https://html.spec.whatwg.org/#fetch-priority-attribute>.
-  virtual nsresult ProcessStyleLinkFromHeader(
+  MOZ_CAN_RUN_SCRIPT_BOUNDARY virtual nsresult ProcessStyleLinkFromHeader(
       const nsAString& aHref, bool aAlternate, const nsAString& aTitle,
       const nsAString& aIntegrity, const nsAString& aType,
       const nsAString& aMedia, const nsAString& aReferrerPolicy,

dom/base/nsContentUtils.cpp

@@ -6297,6 +6297,10 @@ nsresult nsContentUtils::DispatchEvent(
   event->WidgetEventPtr()->mFlags.mOnlySystemGroupDispatch =
       aSystemGroupOnly == SystemGroupOnly::eYes;
 
+  // For the performance reason, aDoc may be set to a raw pointer because it's
+  // used only before dispatching the event. Therefore, we should not use aDoc
+  // anymore.
+  aDoc = nullptr;
   bool doDefault = aTarget->DispatchEvent(*event, CallerType::System, err);
   if (aDefaultAction) {
     *aDefaultAction = doDefault;
@@ -6305,13 +6309,10 @@ nsresult nsContentUtils::DispatchEvent(
 }
 
 // static
-nsresult nsContentUtils::DispatchEvent(Document* aDoc, EventTarget* aTarget,
-                                       WidgetEvent& aEvent,
-                                       EventMessage aEventMessage,
-                                       CanBubble aCanBubble,
-                                       Cancelable aCancelable, Trusted aTrusted,
-                                       bool* aDefaultAction,
-                                       ChromeOnlyDispatch aOnlyChromeDispatch) {
+nsresult nsContentUtils::DispatchEvent(
+    EventTarget* aTarget, WidgetEvent& aEvent, EventMessage aEventMessage,
+    CanBubble aCanBubble, Cancelable aCancelable, Trusted aTrusted,
+    bool* aDefaultAction, ChromeOnlyDispatch aOnlyChromeDispatch) {
   MOZ_ASSERT_IF(aOnlyChromeDispatch == ChromeOnlyDispatch::eYes,
                 aTrusted == Trusted::eYes);
 
@@ -10687,8 +10688,8 @@ void nsContentUtils::FirePageHideEventForFrameLoaderSwap(
 
   for (uint32_t i = 0; i < kids.Length(); ++i) {
     if (kids[i]) {
-      FirePageHideEventForFrameLoaderSwap(kids[i], aChromeEventHandler,
-                                          aOnlySystemGroup);
+      FirePageHideEventForFrameLoaderSwap(
+          MOZ_KnownLive(kids[i]), aChromeEventHandler, aOnlySystemGroup);
     }
   }
 }
@@ -10711,8 +10712,9 @@ void nsContentUtils::FirePageShowEventForFrameLoaderSwap(
 
   for (uint32_t i = 0; i < kids.Length(); ++i) {
     if (kids[i]) {
-      FirePageShowEventForFrameLoaderSwap(kids[i], aChromeEventHandler,
-                                          aFireIfShowing, aOnlySystemGroup);
+      FirePageShowEventForFrameLoaderSwap(MOZ_KnownLive(kids[i]),
+                                          aChromeEventHandler, aFireIfShowing,
+                                          aOnlySystemGroup);
     }
   }
 

dom/base/nsContentUtils.h

@@ -1618,17 +1618,13 @@ class nsContentUtils {
    * @param aDefaultAction Set to true if default action should be taken,
    *                       see EventTarget::DispatchEvent.
    */
-  // TODO: annotate with `MOZ_CAN_RUN_SCRIPT`
-  // (https://bugzilla.mozilla.org/show_bug.cgi?id=1625902).
-  static nsresult DispatchTrustedEvent(
+  MOZ_CAN_RUN_SCRIPT static nsresult DispatchTrustedEvent(
       Document* aDoc, mozilla::dom::EventTarget* aTarget,
       const nsAString& aEventName, CanBubble, Cancelable,
       Composed aComposed = Composed::eDefault, bool* aDefaultAction = nullptr,
       SystemGroupOnly aSystemGroupOnly = SystemGroupOnly::eNo);
 
-  // TODO: annotate with `MOZ_CAN_RUN_SCRIPT`
-  // (https://bugzilla.mozilla.org/show_bug.cgi?id=1625902).
-  static nsresult DispatchTrustedEvent(
+  MOZ_CAN_RUN_SCRIPT static nsresult DispatchTrustedEvent(
       Document* aDoc, mozilla::dom::EventTarget* aTarget,
       const nsAString& aEventName, CanBubble aCanBubble, Cancelable aCancelable,
       bool* aDefaultAction,
@@ -1649,16 +1645,15 @@ class nsContentUtils {
    *                       see EventTarget::DispatchEvent.
    */
   template <class WidgetEventType>
-  static nsresult DispatchTrustedEvent(
-      Document* aDoc, mozilla::dom::EventTarget* aTarget,
-      EventMessage aEventMessage, CanBubble aCanBubble, Cancelable aCancelable,
+  MOZ_CAN_RUN_SCRIPT static nsresult DispatchTrustedEvent(
+      mozilla::dom::EventTarget* aTarget, EventMessage aEventMessage,
+      CanBubble aCanBubble, Cancelable aCancelable,
       bool* aDefaultAction = nullptr,
       ChromeOnlyDispatch aOnlyChromeDispatch = ChromeOnlyDispatch::eNo) {
     WidgetEventType event(true, aEventMessage);
     MOZ_ASSERT(GetEventClassIDFromMessage(aEventMessage) == event.mClass);
-    return DispatchEvent(aDoc, aTarget, event, aEventMessage, aCanBubble,
-                         aCancelable, Trusted::eYes, aDefaultAction,
-                         aOnlyChromeDispatch);
+    return DispatchEvent(aTarget, event, aEventMessage, aCanBubble, aCancelable,
+                         Trusted::eYes, aDefaultAction, aOnlyChromeDispatch);
   }
 
   /**
@@ -1710,11 +1705,10 @@ class nsContentUtils {
    * @param aDefaultAction Set to true if default action should be taken,
    *                       see EventTarget::DispatchEvent.
    */
-  static nsresult DispatchUntrustedEvent(Document* aDoc,
-                                         mozilla::dom::EventTarget* aTarget,
-                                         const nsAString& aEventName, CanBubble,
-                                         Cancelable,
-                                         bool* aDefaultAction = nullptr);
+  MOZ_CAN_RUN_SCRIPT static nsresult DispatchUntrustedEvent(
+      Document* aDoc, mozilla::dom::EventTarget* aTarget,
+      const nsAString& aEventName, CanBubble, Cancelable,
+      bool* aDefaultAction = nullptr);
 
   /**
    * This method creates and dispatches a untrusted event using an event
@@ -1728,16 +1722,15 @@ class nsContentUtils {
    *                       see EventTarget::DispatchEvent.
    */
   template <class WidgetEventType>
-  static nsresult DispatchUntrustedEvent(
-      Document* aDoc, mozilla::dom::EventTarget* aTarget,
-      EventMessage aEventMessage, CanBubble aCanBubble, Cancelable aCancelable,
+  MOZ_CAN_RUN_SCRIPT static nsresult DispatchUntrustedEvent(
+      mozilla::dom::EventTarget* aTarget, EventMessage aEventMessage,
+      CanBubble aCanBubble, Cancelable aCancelable,
       bool* aDefaultAction = nullptr,
       ChromeOnlyDispatch aOnlyChromeDispatch = ChromeOnlyDispatch::eNo) {
     WidgetEventType event(false, aEventMessage);
     MOZ_ASSERT(GetEventClassIDFromMessage(aEventMessage) == event.mClass);
-    return DispatchEvent(aDoc, aTarget, event, aEventMessage, aCanBubble,
-                         aCancelable, Trusted::eNo, aDefaultAction,
-                         aOnlyChromeDispatch);
+    return DispatchEvent(aTarget, event, aEventMessage, aCanBubble, aCancelable,
+                         Trusted::eNo, aDefaultAction, aOnlyChromeDispatch);
   }
 
   /**
@@ -1790,17 +1783,15 @@ class nsContentUtils {
    * @param aDefaultAction Set to true if default action should be taken,
    *                       see EventTarget::DispatchEvent.
    */
-  static nsresult DispatchEventOnlyToChrome(
+  MOZ_CAN_RUN_SCRIPT_BOUNDARY static nsresult DispatchEventOnlyToChrome(
       Document* aDoc, mozilla::dom::EventTarget* aTarget,
       const nsAString& aEventName, CanBubble, Cancelable,
       Composed aComposed = Composed::eDefault, bool* aDefaultAction = nullptr);
 
-  static nsresult DispatchEventOnlyToChrome(Document* aDoc,
-                                            mozilla::dom::EventTarget* aTarget,
-                                            const nsAString& aEventName,
-                                            CanBubble aCanBubble,
-                                            Cancelable aCancelable,
-                                            bool* aDefaultAction) {
+  MOZ_CAN_RUN_SCRIPT_BOUNDARY static nsresult DispatchEventOnlyToChrome(
+      Document* aDoc, mozilla::dom::EventTarget* aTarget,
+      const nsAString& aEventName, CanBubble aCanBubble, Cancelable aCancelable,
+      bool* aDefaultAction) {
     return DispatchEventOnlyToChrome(aDoc, aTarget, aEventName, aCanBubble,
                                      aCancelable, Composed::eDefault,
                                      aDefaultAction);
@@ -3138,12 +3129,12 @@ class nsContentUtils {
       const mozilla::dom::Optional<
           mozilla::OwningNonNull<mozilla::dom::VoidFunction>>& aCallback);
 
-  static void FirePageShowEventForFrameLoaderSwap(
+  MOZ_CAN_RUN_SCRIPT static void FirePageShowEventForFrameLoaderSwap(
       nsIDocShellTreeItem* aItem,
       mozilla::dom::EventTarget* aChromeEventHandler, bool aFireIfShowing,
       bool aOnlySystemGroup = false);
 
-  static void FirePageHideEventForFrameLoaderSwap(
+  MOZ_CAN_RUN_SCRIPT static void FirePageHideEventForFrameLoaderSwap(
       nsIDocShellTreeItem* aItem,
       mozilla::dom::EventTarget* aChromeEventHandler,
       bool aOnlySystemGroup = false);
@@ -3681,19 +3672,17 @@ class nsContentUtils {
                              JS::MutableHandle<JS::Value> vp,
                              bool aAllowWrapping);
 
-  // TODO: Convert this to MOZ_CAN_RUN_SCRIPT (bug 1415230)
-  MOZ_CAN_RUN_SCRIPT_BOUNDARY static nsresult DispatchEvent(
+  MOZ_CAN_RUN_SCRIPT static nsresult DispatchEvent(
       Document* aDoc, mozilla::dom::EventTarget* aTarget,
       const nsAString& aEventName, CanBubble, Cancelable, Composed, Trusted,
       bool* aDefaultAction = nullptr,
       ChromeOnlyDispatch = ChromeOnlyDispatch::eNo,
       SystemGroupOnly = SystemGroupOnly::eNo);
 
-  // TODO: Convert this to MOZ_CAN_RUN_SCRIPT (bug 1415230)
-  MOZ_CAN_RUN_SCRIPT_BOUNDARY static nsresult DispatchEvent(
-      Document* aDoc, mozilla::dom::EventTarget* aTarget,
-      mozilla::WidgetEvent& aWidgetEvent, EventMessage aEventMessage, CanBubble,
-      Cancelable, Trusted, bool* aDefaultAction = nullptr,
+  MOZ_CAN_RUN_SCRIPT static nsresult DispatchEvent(
+      mozilla::dom::EventTarget* aTarget, mozilla::WidgetEvent& aWidgetEvent,
+      EventMessage aEventMessage, CanBubble, Cancelable, Trusted,
+      bool* aDefaultAction = nullptr,
       ChromeOnlyDispatch = ChromeOnlyDispatch::eNo);
 
   static void InitializeModifierStrings();

dom/base/nsDOMMutationObserver.cpp

@@ -873,7 +873,7 @@ void nsDOMMutationObserver::HandleMutationsInternal(AutoSlowOperation& aAso) {
   // Fire slotchange event for each slot in signalLists.
   for (const nsTArray<RefPtr<HTMLSlotElement>>& signalList : signalLists) {
     for (const RefPtr<HTMLSlotElement>& signal : signalList) {
-      signal->FireSlotChangeEvent();
+      MOZ_KnownLive(signal)->FireSlotChangeEvent();
     }
   }
 }

dom/base/nsFrameLoader.cpp

@@ -1401,11 +1401,12 @@ nsresult nsFrameLoader::SwapWithOtherRemoteLoader(
 
 class MOZ_RAII AutoResetInFrameSwap final {
  public:
-  AutoResetInFrameSwap(nsFrameLoader* aThisFrameLoader,
-                       nsFrameLoader* aOtherFrameLoader,
-                       nsDocShell* aThisDocShell, nsDocShell* aOtherDocShell,
-                       EventTarget* aThisEventTarget,
-                       EventTarget* aOtherEventTarget)
+  MOZ_CAN_RUN_SCRIPT AutoResetInFrameSwap(nsFrameLoader* aThisFrameLoader,
+                                          nsFrameLoader* aOtherFrameLoader,
+                                          nsDocShell* aThisDocShell,
+                                          nsDocShell* aOtherDocShell,
+                                          EventTarget* aThisEventTarget,
+                                          EventTarget* aOtherEventTarget)
       : mThisFrameLoader(aThisFrameLoader),
         mOtherFrameLoader(aOtherFrameLoader),
         mThisDocShell(aThisDocShell),
@@ -1430,7 +1431,7 @@ class MOZ_RAII AutoResetInFrameSwap final {
                                                         mOtherEventTarget);
   }
 
-  ~AutoResetInFrameSwap() {
+  MOZ_CAN_RUN_SCRIPT ~AutoResetInFrameSwap() {
     nsContentUtils::FirePageShowEventForFrameLoaderSwap(mThisDocShell,
                                                         mThisEventTarget, true);
     nsContentUtils::FirePageShowEventForFrameLoaderSwap(
@@ -1452,12 +1453,12 @@ class MOZ_RAII AutoResetInFrameSwap final {
   }
 
  private:
-  RefPtr<nsFrameLoader> mThisFrameLoader;
-  RefPtr<nsFrameLoader> mOtherFrameLoader;
-  RefPtr<nsDocShell> mThisDocShell;
-  RefPtr<nsDocShell> mOtherDocShell;
-  nsCOMPtr<EventTarget> mThisEventTarget;
-  nsCOMPtr<EventTarget> mOtherEventTarget;
+  MOZ_KNOWN_LIVE const RefPtr<nsFrameLoader> mThisFrameLoader;
+  MOZ_KNOWN_LIVE const RefPtr<nsFrameLoader> mOtherFrameLoader;
+  MOZ_KNOWN_LIVE const RefPtr<nsDocShell> mThisDocShell;
+  MOZ_KNOWN_LIVE const RefPtr<nsDocShell> mOtherDocShell;
+  MOZ_KNOWN_LIVE const nsCOMPtr<EventTarget> mThisEventTarget;
+  MOZ_KNOWN_LIVE const nsCOMPtr<EventTarget> mOtherEventTarget;
 };
 
 nsresult nsFrameLoader::SwapWithOtherLoader(nsFrameLoader* aOther,

dom/base/nsFrameLoader.h

@@ -161,9 +161,9 @@ class nsFrameLoader final : public nsStubMutationObserver,
   // After the parent document has been fully cloned, a new frameloader will be
   // created for the cloned iframe, and `FinishStaticClone` will be called on
   // it, which will clone the inner document of the source nsFrameLoader.
-  nsresult FinishStaticClone(nsFrameLoader* aStaticCloneOf,
-                             nsIPrintSettings* aPrintSettings,
-                             bool* aOutHasInProcessPrintCallbacks);
+  MOZ_CAN_RUN_SCRIPT nsresult FinishStaticClone(
+      nsFrameLoader* aStaticCloneOf, nsIPrintSettings* aPrintSettings,
+      bool* aOutHasInProcessPrintCallbacks);
 
   nsresult DoRemoteStaticClone(nsFrameLoader* aStaticCloneOf,
                                nsIPrintSettings* aPrintSettings);
@@ -300,9 +300,9 @@ class nsFrameLoader final : public nsStubMutationObserver,
   // The guts of an nsFrameLoaderOwner::SwapFrameLoader implementation.  A
   // frame loader owner needs to call this, and pass in the two references to
   // nsRefPtrs for frame loaders that need to be swapped.
-  nsresult SwapWithOtherLoader(nsFrameLoader* aOther,
-                               nsFrameLoaderOwner* aThisOwner,
-                               nsFrameLoaderOwner* aOtherOwner);
+  MOZ_CAN_RUN_SCRIPT nsresult
+  SwapWithOtherLoader(nsFrameLoader* aOther, nsFrameLoaderOwner* aThisOwner,
+                      nsFrameLoaderOwner* aOtherOwner);
 
   nsresult SwapWithOtherRemoteLoader(nsFrameLoader* aOther,
                                      nsFrameLoaderOwner* aThisOwner,

dom/base/nsGlobalWindowInner.cpp

@@ -436,10 +436,12 @@ class nsGlobalWindowObserver final : public nsIObserver,
   explicit nsGlobalWindowObserver(nsGlobalWindowInner* aWindow)
       : mWindow(aWindow) {}
   NS_DECL_ISUPPORTS
-  NS_IMETHOD Observe(nsISupports* aSubject, const char* aTopic,
-                     const char16_t* aData) override {
+  MOZ_CAN_RUN_SCRIPT_BOUNDARY NS_IMETHOD
+  Observe(nsISupports* aSubject, const char* aTopic,
+          const char16_t* aData) override {
     if (!mWindow) return NS_OK;
-    return mWindow->Observe(aSubject, aTopic, aData);
+    const RefPtr<nsGlobalWindowInner> win = mWindow;
+    return win->Observe(aSubject, aTopic, aData);
   }
   void Forget() { mWindow = nullptr; }
   NS_IMETHOD GetInterface(const nsIID& aIID, void** aResult) override {
@@ -5204,8 +5206,11 @@ void nsGlobalWindowInner::FireOfflineStatusEventIfChanged() {
   } else {
     name.AssignLiteral("online");
   }
-  nsContentUtils::DispatchTrustedEvent(mDoc, this, name, CanBubble::eNo,
-                                       Cancelable::eNo);
+  // mDoc is used only for considering the event target. Therefore,
+  // MOZ_KnownLive is safe here.
+  nsContentUtils::DispatchTrustedEvent(MOZ_KnownLive(mDoc), this, name,
+                                       CanBubble::eNo, Cancelable::eNo);
+  // Be aware! mDoc may have been changed.
 }
 
 nsGlobalWindowInner::SlowScriptResponse
@@ -6256,8 +6261,8 @@ nsresult nsGlobalWindowInner::FireDelayedDOMEvents(bool aIncludeSubWindows) {
     }
 
     for (const nsCOMPtr<nsIDocShellTreeItem>& childShell : children) {
-      if (nsCOMPtr<nsPIDOMWindowOuter> pWin = childShell->GetWindow()) {
-        auto* win = nsGlobalWindowOuter::Cast(pWin);
+      if (const RefPtr<nsGlobalWindowOuter> win =
+              nsGlobalWindowOuter::Cast(childShell->GetWindow())) {
         win->FireDelayedDOMEvents(true);
       }
     }

dom/base/nsGlobalWindowInner.h

@@ -383,7 +383,8 @@ class nsGlobalWindowInner final : public mozilla::dom::EventTarget,
 
   void NoteDOMContentLoaded();
 
-  virtual nsresult FireDelayedDOMEvents(bool aIncludeSubWindows) override;
+  MOZ_CAN_RUN_SCRIPT virtual nsresult FireDelayedDOMEvents(
+      bool aIncludeSubWindows) override;
 
   virtual void MaybeUpdateTouchState() override;
 
@@ -451,8 +452,8 @@ class nsGlobalWindowInner final : public mozilla::dom::EventTarget,
   // frame.
   mozilla::ScrollContainerFrame* GetScrollContainerFrame();
 
-  nsresult Observe(nsISupports* aSubject, const char* aTopic,
-                   const char16_t* aData);
+  MOZ_CAN_RUN_SCRIPT nsresult Observe(nsISupports* aSubject, const char* aTopic,
+                                      const char16_t* aData);
 
   void ObserveStorageNotification(mozilla::dom::StorageEvent* aEvent,
                                   const char16_t* aStorageType,
@@ -620,9 +621,9 @@ class nsGlobalWindowInner final : public mozilla::dom::EventTarget,
   mozilla::dom::BarProp* GetToolbar(mozilla::ErrorResult& aError);
   void GetStatus(nsAString& aStatus, mozilla::ErrorResult& aError);
   void SetStatus(const nsAString& aStatus, mozilla::ErrorResult& aError);
-  void Close(mozilla::dom::CallerType aCallerType,
-             mozilla::ErrorResult& aError);
-  nsresult Close() override;
+  MOZ_CAN_RUN_SCRIPT void Close(mozilla::dom::CallerType aCallerType,
+                                mozilla::ErrorResult& aError);
+  MOZ_CAN_RUN_SCRIPT nsresult Close() override;
   bool GetClosed(mozilla::ErrorResult& aError);
   void Stop(mozilla::ErrorResult& aError);
   void Focus(mozilla::dom::CallerType aCallerType,
@@ -873,8 +874,9 @@ class nsGlobalWindowInner final : public mozilla::dom::EventTarget,
   bool GetFullScreen(mozilla::dom::CallerType aCallerType,
                      mozilla::ErrorResult& aError);
   bool GetFullScreen() override;
-  void SetFullScreen(bool aFullscreen, mozilla::dom::CallerType aCallerType,
-                     mozilla::ErrorResult& aError);
+  MOZ_CAN_RUN_SCRIPT void SetFullScreen(bool aFullscreen,
+                                        mozilla::dom::CallerType aCallerType,
+                                        mozilla::ErrorResult& aError);
   bool Find(const nsAString& aString, bool aCaseSensitive, bool aBackwards,
             bool aWrapAround, bool aWholeWord, bool aSearchInFrames,
             bool aShowDialog, mozilla::ErrorResult& aError);
@@ -1111,7 +1113,7 @@ class nsGlobalWindowInner final : public mozilla::dom::EventTarget,
   already_AddRefed<nsIWebBrowserChrome> GetWebBrowserChrome();
   bool IsPrivateBrowsing();
 
-  void FireOfflineStatusEventIfChanged();
+  MOZ_CAN_RUN_SCRIPT void FireOfflineStatusEventIfChanged();
 
  public:
   // Inner windows only.

dom/base/nsGlobalWindowOuter.cpp

@@ -276,6 +276,16 @@ static inline nsGlobalWindowInner* GetCurrentInnerWindowInternal(
   return GetCurrentInnerWindowInternal(this)->method args; \
   PR_END_MACRO
 
+#define FORWARD_TO_INNER_SAFE(method, args, err_rval)          \
+  PR_BEGIN_MACRO                                               \
+  if (!mInnerWindow) {                                         \
+    NS_WARNING("No inner window available!");                  \
+    return err_rval;                                           \
+  }                                                            \
+  const RefPtr innerWin = GetCurrentInnerWindowInternal(this); \
+  return innerWin->method args;                                \
+  PR_END_MACRO
+
 #define FORWARD_TO_INNER_WITH_STRONG_REF(method, args, err_rval)           \
   PR_BEGIN_MACRO                                                           \
   if (!mInnerWindow) {                                                     \
@@ -3840,15 +3850,18 @@ bool nsGlobalWindowOuter::DispatchCustomEvent(
     const nsAString& aEventName, ChromeOnlyDispatch aChromeOnlyDispatch) {
   bool defaultActionEnabled = true;
 
+  // mDoc will be used only for considering the event target before dispatching
+  // the event. Therefore, we can use MOZ_KnownLive(mDoc) here.
   if (aChromeOnlyDispatch == ChromeOnlyDispatch::eYes) {
-    nsContentUtils::DispatchEventOnlyToChrome(mDoc, this, aEventName,
-                                              CanBubble::eYes, Cancelable::eYes,
-                                              &defaultActionEnabled);
+    nsContentUtils::DispatchEventOnlyToChrome(
+        MOZ_KnownLive(mDoc), this, aEventName, CanBubble::eYes,
+        Cancelable::eYes, &defaultActionEnabled);
   } else {
-    nsContentUtils::DispatchTrustedEvent(mDoc, this, aEventName,
+    nsContentUtils::DispatchTrustedEvent(MOZ_KnownLive(mDoc), this, aEventName,
                                          CanBubble::eYes, Cancelable::eYes,
                                          &defaultActionEnabled);
   }
+  // Be aware, mDoc may have been changed.
 
   return defaultActionEnabled;
 }
@@ -3955,7 +3968,7 @@ class FullscreenTransitionTask : public Runnable {
         mStage(eBeforeToggle),
         mFullscreen(aFullscreen) {}
 
-  NS_IMETHOD Run() override;
+  MOZ_CAN_RUN_SCRIPT_BOUNDARY NS_IMETHOD Run() override;
 
  private:
   ~FullscreenTransitionTask() override = default;
@@ -4008,7 +4021,7 @@ class FullscreenTransitionTask : public Runnable {
    private:
     ~Observer() = default;
 
-    RefPtr<FullscreenTransitionTask> mTask;
+    MOZ_KNOWN_LIVE const RefPtr<FullscreenTransitionTask> mTask;
   };
 
   static const char* const kPaintedTopic;
@@ -4058,7 +4071,8 @@ FullscreenTransitionTask::Run() {
                                       mFullscreen, mWidget)) {
       // Fail to setup the widget, call FinishFullscreenChange to
       // complete fullscreen change directly.
-      mWindow->FinishFullscreenChange(mFullscreen);
+      const RefPtr<nsGlobalWindowOuter> win = mWindow;
+      win->FinishFullscreenChange(mFullscreen);
     }
     // Set observer for the next content paint.
     nsCOMPtr<nsIObserver> observer = new Observer(this);
@@ -4102,9 +4116,9 @@ FullscreenTransitionTask::Run() {
 NS_IMPL_ISUPPORTS(FullscreenTransitionTask::Observer, nsIObserver, nsINamed)
 
 NS_IMETHODIMP
-FullscreenTransitionTask::Observer::Observe(nsISupports* aSubject,
-                                            const char* aTopic,
-                                            const char16_t* aData) {
+FullscreenTransitionTask::Observer::Observe(
+    nsISupports* aSubject, const char* aTopic,
+    const char16_t* aData) MOZ_CAN_RUN_SCRIPT_BOUNDARY {
   bool shouldContinue = false;
   if (strcmp(aTopic, FullscreenTransitionTask::kPaintedTopic) == 0) {
     nsCOMPtr<nsPIDOMWindowInner> win(do_QueryInterface(aSubject));
@@ -6724,8 +6738,8 @@ bool nsGlobalWindowOuter::IsFrozen() const {
 }
 
 nsresult nsGlobalWindowOuter::FireDelayedDOMEvents(bool aIncludeSubWindows) {
-  FORWARD_TO_INNER(FireDelayedDOMEvents, (aIncludeSubWindows),
-                   NS_ERROR_UNEXPECTED);
+  FORWARD_TO_INNER_SAFE(FireDelayedDOMEvents, (aIncludeSubWindows),
+                        NS_ERROR_UNEXPECTED);
 }
 
 //*****************************************************************************

dom/base/nsGlobalWindowOuter.h

@@ -283,7 +283,8 @@ class nsGlobalWindowOuter final : public mozilla::dom::EventTarget,
   virtual bool IsSuspended() const override;
   virtual bool IsFrozen() const override;
 
-  virtual nsresult FireDelayedDOMEvents(bool aIncludeSubWindows) override;
+  MOZ_CAN_RUN_SCRIPT virtual nsresult FireDelayedDOMEvents(
+      bool aIncludeSubWindows) override;
 
   // Outer windows only.
   bool WouldReuseInnerWindow(Document* aNewDocument);
@@ -293,7 +294,7 @@ class nsGlobalWindowOuter final : public mozilla::dom::EventTarget,
   // aState is only non-null if we are restoring from the bfcache.
   // aForceReuseInnerWindow is only true if we are being triggered via XSLT.
   // aActor is only non-null if the new document is about:blank.
-  virtual nsresult SetNewDocument(
+  MOZ_CAN_RUN_SCRIPT nsresult SetNewDocument(
       Document* aDocument, nsISupports* aState, bool aForceReuseInnerWindow,
       mozilla::dom::WindowGlobalChild* aActor = nullptr) override;
 
@@ -315,10 +316,10 @@ class nsGlobalWindowOuter final : public mozilla::dom::EventTarget,
 
   // Outer windows only.
   virtual bool CanClose() override;
-  virtual void ForceClose() override;
+  MOZ_CAN_RUN_SCRIPT void ForceClose() override;
 
   // Outer windows only.
-  virtual bool DispatchCustomEvent(
+  MOZ_CAN_RUN_SCRIPT bool DispatchCustomEvent(
       const nsAString& aEventName,
       mozilla::ChromeOnlyDispatch aChromeOnlyDispatch) override;
 
@@ -326,10 +327,10 @@ class nsGlobalWindowOuter final : public mozilla::dom::EventTarget,
   friend class FullscreenTransitionTask;
 
   // Outer windows only.
-  nsresult SetFullscreenInternal(FullscreenReason aReason,
-                                 bool aIsFullscreen) final;
-  void FullscreenWillChange(bool aIsFullscreen) final;
-  void FinishFullscreenChange(bool aIsFullscreen) final;
+  MOZ_CAN_RUN_SCRIPT nsresult SetFullscreenInternal(FullscreenReason aReason,
+                                                    bool aIsFullscreen) final;
+  MOZ_CAN_RUN_SCRIPT void FullscreenWillChange(bool aIsFullscreen) final;
+  MOZ_CAN_RUN_SCRIPT void FinishFullscreenChange(bool aIsFullscreen) final;
   void ForceFullScreenInWidget() final;
   void MacFullscreenMenubarOverlapChanged(
       mozilla::DesktopCoord aOverlapAmount) final;
@@ -501,8 +502,8 @@ class nsGlobalWindowOuter final : public mozilla::dom::EventTarget,
   mozilla::dom::Location* GetLocation() override;
   void GetStatusOuter(nsAString& aStatus);
   void SetStatusOuter(const nsAString& aStatus);
-  void CloseOuter(bool aTrustedCaller);
-  nsresult Close() override;
+  MOZ_CAN_RUN_SCRIPT void CloseOuter(bool aTrustedCaller);
+  MOZ_CAN_RUN_SCRIPT nsresult Close() override;
   bool GetClosedOuter();
   bool Closed() override;
   void StopOuter(mozilla::ErrorResult& aError);
@@ -602,8 +603,9 @@ class nsGlobalWindowOuter final : public mozilla::dom::EventTarget,
   float GetMozInnerScreenYOuter(mozilla::dom::CallerType aCallerType);
   bool GetFullscreenOuter();
   bool GetFullScreen() override;
-  void SetFullscreenOuter(bool aFullscreen, mozilla::ErrorResult& aError);
-  nsresult SetFullScreen(bool aFullscreen) override;
+  MOZ_CAN_RUN_SCRIPT void SetFullscreenOuter(bool aFullscreen,
+                                             mozilla::ErrorResult& aError);
+  MOZ_CAN_RUN_SCRIPT nsresult SetFullScreen(bool aFullscreen) override;
   bool FindOuter(const nsAString& aString, bool aCaseSensitive, bool aBackwards,
                  bool aWrapAround, bool aWholeWord, bool aSearchInFrames,
                  bool aShowDialog, mozilla::ErrorResult& aError);
@@ -966,8 +968,8 @@ class nsGlobalWindowOuter final : public mozilla::dom::EventTarget,
   nsISerialEventTarget* SerialEventTarget() const final;
 
  protected:
-  nsresult ProcessWidgetFullscreenRequest(FullscreenReason aReason,
-                                          bool aFullscreen);
+  MOZ_CAN_RUN_SCRIPT nsresult
+  ProcessWidgetFullscreenRequest(FullscreenReason aReason, bool aFullscreen);
 
   // Indicates whether browser window should be in fullscreen mode and the
   // reason, e.g. browser fullscreen mode or DOM fullscreen API, which should

dom/base/nsPIDOMWindow.h

@@ -405,7 +405,8 @@ class nsPIDOMWindowInner : public mozIDOMWindow {
 
   // Fire any DOM notification events related to things that happened while
   // the window was frozen.
-  virtual nsresult FireDelayedDOMEvents(bool aIncludeSubWindows) = 0;
+  MOZ_CAN_RUN_SCRIPT virtual nsresult FireDelayedDOMEvents(
+      bool aIncludeSubWindows) = 0;
 
   /**
    * Get the docshell in this window.
@@ -602,7 +603,7 @@ class nsPIDOMWindowInner : public mozIDOMWindow {
   virtual bool GetFullScreen() = 0;
 
   virtual nsresult Focus(mozilla::dom::CallerType aCallerType) = 0;
-  virtual nsresult Close() = 0;
+  MOZ_CAN_RUN_SCRIPT virtual nsresult Close() = 0;
 
   mozilla::dom::DocGroup* GetDocGroup() const;
 
@@ -892,7 +893,8 @@ class nsPIDOMWindowOuter : public mozIDOMWindowProxy {
 
   // Fire any DOM notification events related to things that happened while
   // the window was frozen.
-  virtual nsresult FireDelayedDOMEvents(bool aIncludeSubWindows) = 0;
+  MOZ_CAN_RUN_SCRIPT virtual nsresult FireDelayedDOMEvents(
+      bool aIncludeSubWindows) = 0;
 
   /**
    * Get the docshell in this window.
@@ -917,7 +919,7 @@ class nsPIDOMWindowOuter : public mozIDOMWindowProxy {
    *
    * aDocument must not be null.
    */
-  virtual nsresult SetNewDocument(
+  MOZ_CAN_RUN_SCRIPT virtual nsresult SetNewDocument(
       Document* aDocument, nsISupports* aState, bool aForceReuseInnerWindow,
       mozilla::dom::WindowGlobalChild* aActor = nullptr) = 0;
 
@@ -947,15 +949,15 @@ class nsPIDOMWindowOuter : public mozIDOMWindowProxy {
   virtual void LeaveModalState() = 0;
 
   virtual bool CanClose() = 0;
-  virtual void ForceClose() = 0;
+  MOZ_CAN_RUN_SCRIPT virtual void ForceClose() = 0;
 
   /**
    * Moves the top-level window into fullscreen mode if aIsFullScreen is true,
    * otherwise exits fullscreen.
    */
-  virtual nsresult SetFullscreenInternal(FullscreenReason aReason,
-                                         bool aIsFullscreen) = 0;
-  virtual void FullscreenWillChange(bool aIsFullscreen) = 0;
+  MOZ_CAN_RUN_SCRIPT virtual nsresult SetFullscreenInternal(
+      FullscreenReason aReason, bool aIsFullscreen) = 0;
+  MOZ_CAN_RUN_SCRIPT virtual void FullscreenWillChange(bool aIsFullscreen) = 0;
   /**
    * This function should be called when the fullscreen state is flipped.
    * If no widget is involved the fullscreen change, this method is called
@@ -964,7 +966,8 @@ class nsPIDOMWindowOuter : public mozIDOMWindowProxy {
    *
    * @param aIsFullscreen indicates whether the widget is in fullscreen.
    */
-  virtual void FinishFullscreenChange(bool aIsFullscreen) = 0;
+  MOZ_CAN_RUN_SCRIPT virtual void FinishFullscreenChange(
+      bool aIsFullscreen) = 0;
 
   virtual void ForceFullScreenInWidget() = 0;
 
@@ -1038,7 +1041,7 @@ class nsPIDOMWindowOuter : public mozIDOMWindowProxy {
    *
    * Outer windows only.
    */
-  virtual bool DispatchCustomEvent(
+  MOZ_CAN_RUN_SCRIPT virtual bool DispatchCustomEvent(
       const nsAString& aEventName,
       mozilla::ChromeOnlyDispatch aChromeOnlyDispatch =
           mozilla::ChromeOnlyDispatch::eNo) = 0;
@@ -1098,10 +1101,10 @@ class nsPIDOMWindowOuter : public mozIDOMWindowProxy {
 
   virtual bool Closed() = 0;
   virtual bool GetFullScreen() = 0;
-  virtual nsresult SetFullScreen(bool aFullscreen) = 0;
+  MOZ_CAN_RUN_SCRIPT virtual nsresult SetFullScreen(bool aFullscreen) = 0;
 
   virtual nsresult Focus(mozilla::dom::CallerType aCallerType) = 0;
-  virtual nsresult Close() = 0;
+  MOZ_CAN_RUN_SCRIPT virtual nsresult Close() = 0;
 
   virtual nsresult MoveBy(int32_t aXDif, int32_t aYDif) = 0;
 

dom/canvas/CanvasRenderingContext2D.cpp

@@ -1415,7 +1415,8 @@ void CanvasRenderingContext2D::OnRemoteCanvasLost() {
   // We dispatch because it isn't safe to call into the script event handlers,
   // and we don't want to mutate our state in CanvasShutdownManager.
   NS_DispatchToCurrentThread(NS_NewCancelableRunnableFunction(
-      "CanvasRenderingContext2D::OnRemoteCanvasLost", [self = RefPtr{this}] {
+      "CanvasRenderingContext2D::OnRemoteCanvasLost",
+      [self = RefPtr{this}]() MOZ_CAN_RUN_SCRIPT_BOUNDARY_LAMBDA {
         // 4. Let shouldRestore be the result of firing an event named
         // contextlost at canvas, with the cancelable attribute initialized to
         // true.
@@ -1438,7 +1439,7 @@ void CanvasRenderingContext2D::OnRemoteCanvasRestored() {
   // and we don't want to mutate our state in CanvasShutdownManager.
   NS_DispatchToCurrentThread(NS_NewCancelableRunnableFunction(
       "CanvasRenderingContext2D::OnRemoteCanvasRestored",
-      [self = RefPtr{this}] {
+      [self = RefPtr{this}]() MOZ_CAN_RUN_SCRIPT_BOUNDARY_LAMBDA {
         // 5. If shouldRestore is false, then abort these steps.
         if (!self->mHasShutdown && self->mIsContextLost &&
             self->mAllowContextRestore) {

dom/canvas/ClientWebGLContext.cpp

@@ -260,16 +260,20 @@ bool ClientWebGLContext::DispatchEvent(const nsAString& eventName) const {
   bool useDefaultHandler = true;
 
   if (mCanvasElement) {
-    nsContentUtils::DispatchTrustedEvent(mCanvasElement->OwnerDoc(),
-                                         mCanvasElement, eventName, kCanBubble,
-                                         kIsCancelable, &useDefaultHandler);
+    // We can use MOZ_KnownLive(mCanvasElement->OwnerDoc()) here because it's
+    // used only for computing the event target before dispatching the event.
+    const RefPtr<dom::HTMLCanvasElement> canvasElement = mCanvasElement;
+    nsContentUtils::DispatchTrustedEvent(
+        MOZ_KnownLive(mCanvasElement->OwnerDoc()), canvasElement, eventName,
+        kCanBubble, kIsCancelable, &useDefaultHandler);
   } else if (mOffscreenCanvas) {
     // OffscreenCanvas case
-    RefPtr<dom::Event> event =
+    const RefPtr<dom::Event> event =
         new dom::Event(mOffscreenCanvas, nullptr, nullptr);
     event->InitEvent(eventName, kCanBubble, kIsCancelable);
     event->SetTrusted(true);
-    useDefaultHandler = mOffscreenCanvas->DispatchEvent(
+    const RefPtr<dom::OffscreenCanvas> offscreenCanvas = mOffscreenCanvas;
+    useDefaultHandler = offscreenCanvas->DispatchEvent(
         *event, dom::CallerType::System, IgnoreErrors());
   }
   return useDefaultHandler;
@@ -318,7 +322,7 @@ void ClientWebGLContext::OnContextLoss(
   }
 
   const auto weak = WeakPtr<const ClientWebGLContext>(this);
-  const auto fnRun = [weak]() {
+  const auto fnRun = [weak]() MOZ_CAN_RUN_SCRIPT_BOUNDARY_LAMBDA {
     const auto strong = RefPtr<const ClientWebGLContext>(weak);
     if (!strong) return;
     strong->Event_webglcontextlost();
@@ -356,7 +360,7 @@ void ClientWebGLContext::RestoreContext(
   mAwaitingRestore = true;
 
   const auto weak = WeakPtr<const ClientWebGLContext>(this);
-  const auto fnRun = [weak]() {
+  const auto fnRun = [weak]() MOZ_CAN_RUN_SCRIPT_BOUNDARY {
     const auto strong = RefPtr<const ClientWebGLContext>(weak);
     if (!strong) return;
     strong->Event_webglcontextrestored();

dom/canvas/ClientWebGLContext.h

@@ -822,9 +822,9 @@ class ClientWebGLContext final : public nsICanvasRenderingContextInternal,
   void RestoreContext(webgl::LossStatus requiredStatus) const;
 
  private:
-  bool DispatchEvent(const nsAString&) const;
-  void Event_webglcontextlost() const;
-  void Event_webglcontextrestored() const;
+  MOZ_CAN_RUN_SCRIPT bool DispatchEvent(const nsAString&) const;
+  MOZ_CAN_RUN_SCRIPT void Event_webglcontextlost() const;
+  MOZ_CAN_RUN_SCRIPT void Event_webglcontextrestored() const;
 
   bool CreateHostContext(const uvec2& requestedSize);
   void ThrowEvent_WebGLContextCreationError(const std::string&) const;
@@ -2431,10 +2431,11 @@ class ClientWebGLContext final : public nsICanvasRenderingContextInternal,
     Run_WithDestArgTypes(std::move(noGc), method, info, args...);
   }
 
+  // FIXME: This should be marked as MOZ_CAN_RUN_SCRIPT
   template <typename MethodT, typename... DestArgs>
-  void Run_WithDestArgTypes(std::optional<JS::AutoCheckCannotGC>&&, MethodT,
-                            const WebGLMethodInfo info,
-                            const DestArgs&...) const;
+  MOZ_CAN_RUN_SCRIPT_BOUNDARY void Run_WithDestArgTypes(
+      std::optional<JS::AutoCheckCannotGC>&&, MethodT,
+      const WebGLMethodInfo info, const DestArgs&...) const;
 
   // -------------------------------------------------------------------------
   // Helpers for DOM operations, composition, actors, etc

dom/canvas/WebGLChild.cpp

@@ -157,7 +157,8 @@ mozilla::ipc::IPCResult WebGLChild::RecvJsWarning(
 mozilla::ipc::IPCResult WebGLChild::RecvOnContextLoss(
     const webgl::ContextLossReason reason) const {
   if (!mContext) return IPC_OK();
-  mContext->OnContextLoss(reason);
+  const RefPtr<ClientWebGLContext> context = mContext.get();
+  context->OnContextLoss(reason);
   return IPC_OK();
 }
 

dom/canvas/WebGLChild.h

@@ -56,7 +56,8 @@ class WebGLChild final : public PWebGLChild, public SupportsWeakPtr {
 
  public:
   mozilla::ipc::IPCResult RecvJsWarning(const std::string&) const;
-  mozilla::ipc::IPCResult RecvOnContextLoss(webgl::ContextLossReason) const;
+  MOZ_CAN_RUN_SCRIPT_BOUNDARY mozilla::ipc::IPCResult RecvOnContextLoss(
+      webgl::ContextLossReason) const;
   mozilla::ipc::IPCResult RecvOnSyncComplete(webgl::ObjectId) const;
 };
 

dom/canvas/nsICanvasRenderingContextInternal.cpp

@@ -218,16 +218,21 @@ bool nsICanvasRenderingContextInternal::DispatchEvent(
   bool useDefaultHandler = true;
 
   if (mCanvasElement) {
-    nsContentUtils::DispatchTrustedEvent(mCanvasElement->OwnerDoc(),
-                                         mCanvasElement, eventName, aCanBubble,
-                                         aIsCancelable, &useDefaultHandler);
+    const RefPtr<mozilla::dom::Document> doc = mCanvasElement->OwnerDoc();
+    const RefPtr<mozilla::dom::HTMLCanvasElement> canvasElement =
+        mCanvasElement;
+    nsContentUtils::DispatchTrustedEvent(doc, canvasElement, eventName,
+                                         aCanBubble, aIsCancelable,
+                                         &useDefaultHandler);
   } else if (mOffscreenCanvas) {
     // OffscreenCanvas case
     auto event = mozilla::MakeRefPtr<mozilla::dom::Event>(mOffscreenCanvas,
                                                           nullptr, nullptr);
     event->InitEvent(eventName, aCanBubble, aIsCancelable);
     event->SetTrusted(true);
-    useDefaultHandler = mOffscreenCanvas->DispatchEvent(
+    const RefPtr<mozilla::dom::OffscreenCanvas> offscreenCanvas =
+        mOffscreenCanvas;
+    useDefaultHandler = offscreenCanvas->DispatchEvent(
         *event, mozilla::dom::CallerType::System, mozilla::IgnoreErrors());
   }
   return useDefaultHandler;

dom/canvas/nsICanvasRenderingContextInternal.h

@@ -234,8 +234,9 @@ class nsICanvasRenderingContextInternal : public nsISupports,
   // Checking if fingerprinting protection is enable for the given target.
   bool ShouldResistFingerprinting(mozilla::RFPTarget aTarget) const;
 
-  bool DispatchEvent(const nsAString& eventName, mozilla::CanBubble aCanBubble,
-                     mozilla::Cancelable aIsCancelable) const;
+  MOZ_CAN_RUN_SCRIPT bool DispatchEvent(
+      const nsAString& eventName, mozilla::CanBubble aCanBubble,
+      mozilla::Cancelable aIsCancelable) const;
 
   void RecordCanvasUsage(mozilla::CanvasExtractionAPI aAPI,
                          mozilla::CSSIntSize size) const;

dom/credentialmanagement/identity/IdentityProvider.cpp

@@ -58,11 +58,12 @@ already_AddRefed<Promise> IdentityProvider::Resolve(
   identityHandler->ResolveContinuationWindow(aToken, aOptions)
       ->Then(
           GetCurrentSerialEventTarget(), __func__,
-          [promise, window](nsresult aSuccess) {
-            MOZ_ASSERT(NS_SUCCEEDED(aSuccess));
-            promise->MaybeResolveWithUndefined();
-            window->Close();
-          },
+          [promise, window](nsresult aSuccess)
+              MOZ_CAN_RUN_SCRIPT_BOUNDARY_LAMBDA {
+                MOZ_ASSERT(NS_SUCCEEDED(aSuccess));
+                promise->MaybeResolveWithUndefined();
+                window->Close();
+              },
           [promise](nsresult aFailure) {
             promise->MaybeRejectWithNotAllowedError(
                 "IdentityProvider.resolve could not find a pending request to "

dom/credentialmanagement/identity/IdentityProvider.h

@@ -25,7 +25,7 @@ class IdentityProvider : public nsWrapperCache {
   virtual JSObject* WrapObject(JSContext* aCx,
                                JS::Handle<JSObject*> aGivenProto) override;
 
-  static void Close(const GlobalObject& aGlobal);
+  MOZ_CAN_RUN_SCRIPT static void Close(const GlobalObject& aGlobal);
   static already_AddRefed<Promise> Resolve(
       const GlobalObject& aGlobal, const nsACString& aToken,
       const IdentityResolveOptions& aOptions, ErrorResult& aRv);

dom/documentpip/DocumentPictureInPicture.h

@@ -24,7 +24,7 @@ class DocumentPictureInPicture final : public DOMEventTargetHelper,
   JSObject* WrapObject(JSContext* aCx,
                        JS::Handle<JSObject*> aGivenProto) override;
 
-  already_AddRefed<Promise> RequestWindow(
+  MOZ_CAN_RUN_SCRIPT already_AddRefed<Promise> RequestWindow(
       const DocumentPictureInPictureOptions& aOptions, ErrorResult& aRv);
 
   // Get the current PiP window, exposed as webidl property

dom/events/AsyncEventDispatcher.cpp

@@ -50,7 +50,7 @@ AsyncEventDispatcher::Run() {
   if (mEventMessage != eUnidentifiedEvent) {
     MOZ_ASSERT(mComposed == Composed::eDefault);
     return nsContentUtils::DispatchTrustedEvent<WidgetEvent>(
-        node->OwnerDoc(), mTarget, mEventMessage, mCanBubble, Cancelable::eNo,
+        mTarget, mEventMessage, mCanBubble, Cancelable::eNo,
         nullptr /* aDefaultAction */, mOnlyChromeDispatch);
   }
   // MOZ_KnownLives because this instance shouldn't be touched while running.

dom/events/AsyncEventDispatcher.h

@@ -164,7 +164,7 @@ class AsyncEventDispatcher : public CancelableRunnable {
       Composed aComposed);
 
  public:
-  nsCOMPtr<dom::EventTarget> mTarget;
+  MOZ_KNOWN_LIVE const nsCOMPtr<dom::EventTarget> mTarget;
   RefPtr<dom::Event> mEvent;
   // If mEventType is set, mEventMessage will be eUnidentifiedEvent.
   // If mEventMessage is set, mEventType will be void.

dom/events/PendingFullscreenEvent.h

@@ -44,7 +44,8 @@ class PendingFullscreenEvent {
         name = u"fullscreenerror"_ns;
         break;
     }
-    nsINode* target = mTarget->GetComposedDoc() == aDoc ? mTarget.get() : aDoc;
+    const nsCOMPtr<nsINode> target =
+        mTarget->GetComposedDoc() == aDoc ? mTarget.get() : aDoc;
     (void)nsContentUtils::DispatchTrustedEvent(
         aDoc, target, name, CanBubble::eYes, Cancelable::eNo, Composed::eYes);
   }

dom/html/ConstraintValidation.h

@@ -18,7 +18,7 @@ class ConstraintValidation : public nsIConstraintValidation {
   // Web IDL binding methods
   void GetValidationMessage(nsAString& aValidationMessage,
                             mozilla::ErrorResult& aError);
-  bool CheckValidity();
+  MOZ_CAN_RUN_SCRIPT bool CheckValidity();
 
  protected:
   // You can't instantiate an object from that class.

dom/html/ElementInternals.cpp

@@ -284,7 +284,8 @@ bool ElementInternals::CheckValidity(ErrorResult& aRv) {
         "Target element is not a form-associated custom element");
     return false;
   }
-  return nsIConstraintValidation::CheckValidity(*mTarget);
+  const OwningNonNull<HTMLElement> target = *mTarget;
+  return nsIConstraintValidation::CheckValidity(target);
 }
 
 // https://html.spec.whatwg.org/#dom-elementinternals-reportvalidity
@@ -298,7 +299,8 @@ bool ElementInternals::ReportValidity(ErrorResult& aRv) {
   }
 
   bool defaultAction = true;
-  if (nsIConstraintValidation::CheckValidity(*mTarget, &defaultAction)) {
+  const OwningNonNull<HTMLElement> target = *mTarget;
+  if (nsIConstraintValidation::CheckValidity(target, &defaultAction)) {
     return true;
   }
 
@@ -307,10 +309,10 @@ bool ElementInternals::ReportValidity(ErrorResult& aRv) {
   }
 
   AutoTArray<RefPtr<Element>, 1> invalidElements;
-  invalidElements.AppendElement(mTarget);
+  invalidElements.AppendElement(target);
 
   AutoJSAPI jsapi;
-  if (!jsapi.Init(mTarget->GetRelevantGlobal())) {
+  if (!jsapi.Init(target->GetRelevantGlobal())) {
     return false;
   }
   JS::Rooted<JS::Value> detail(jsapi.cx());
@@ -319,13 +321,13 @@ bool ElementInternals::ReportValidity(ErrorResult& aRv) {
   }
 
   RefPtr<CustomEvent> event =
-      NS_NewDOMCustomEvent(mTarget->OwnerDoc(), nullptr, nullptr);
+      NS_NewDOMCustomEvent(target->OwnerDoc(), nullptr, nullptr);
   event->InitCustomEvent(jsapi.cx(), u"MozInvalidForm"_ns,
                          /* CanBubble */ true,
                          /* Cancelable */ true, detail);
   event->SetTrusted(true);
   event->WidgetEventPtr()->mFlags.mOnlyChromeDispatch = true;
-  mTarget->DispatchEvent(*event);
+  target->DispatchEvent(*event);
 
   return false;
 }

dom/html/ElementInternals.h

@@ -84,8 +84,8 @@ class ElementInternals final : public nsIFormControl,
   ValidityState* GetValidity(ErrorResult& aRv);
   void GetValidationMessage(nsAString& aValidationMessage,
                             ErrorResult& aRv) const;
-  bool CheckValidity(ErrorResult& aRv);
-  bool ReportValidity(ErrorResult& aRv);
+  MOZ_CAN_RUN_SCRIPT bool CheckValidity(ErrorResult&);
+  MOZ_CAN_RUN_SCRIPT bool ReportValidity(ErrorResult&);
   already_AddRefed<NodeList> GetLabels(ErrorResult& aRv) const;
   nsGenericHTMLElement* GetValidationAnchor(ErrorResult& aRv) const;
   CustomStateSet* States();

dom/html/HTMLDialogElement.cpp

@@ -48,7 +48,8 @@ class DialogCloseWatcherListener : public nsIDOMEventListener {
   }
 
   // https://html.spec.whatwg.org/#set-the-dialog-close-watcher
-  NS_IMETHODIMP HandleEvent(Event* aEvent) override {
+  MOZ_CAN_RUN_SCRIPT_BOUNDARY NS_IMETHODIMP
+  HandleEvent(Event* aEvent) override {
     RefPtr<nsINode> node = do_QueryReferent(mDialog);
     if (HTMLDialogElement* dialog = HTMLDialogElement::FromNodeOrNull(node)) {
       nsAutoString eventType;
@@ -60,7 +61,8 @@ class DialogCloseWatcherListener : public nsIDOMEventListener {
         bool defaultAction = true;
         auto cancelable =
             aEvent->Cancelable() ? Cancelable::eYes : Cancelable::eNo;
-        nsContentUtils::DispatchTrustedEvent(dialog->OwnerDoc(), dialog,
+        const RefPtr<Document> doc = dialog->OwnerDoc();
+        nsContentUtils::DispatchTrustedEvent(doc, MOZ_KnownLive(dialog),
                                              u"cancel"_ns, CanBubble::eNo,
                                              cancelable, &defaultAction);
         if (!defaultAction) {

dom/html/HTMLFormElement.cpp

@@ -1673,7 +1673,8 @@ bool HTMLFormElement::CheckFormValidity(
     nsCOMPtr<nsIConstraintValidation> cvElmt =
         do_QueryObject(sortedControls[i]);
     bool defaultAction = true;
-    if (cvElmt && !cvElmt->CheckValidity(*sortedControls[i], &defaultAction)) {
+    if (cvElmt && !cvElmt->CheckValidity(MOZ_KnownLive(*sortedControls[i]),
+                                         &defaultAction)) {
       ret = false;
 
       // Add all unhandled invalid controls to aInvalidElements if the caller

dom/html/HTMLFormElement.h

@@ -320,7 +320,7 @@ class HTMLFormElement final : public nsGenericHTMLElement {
 
   MOZ_CAN_RUN_SCRIPT void Reset();
 
-  bool CheckValidity() { return CheckFormValidity(nullptr); }
+  MOZ_CAN_RUN_SCRIPT bool CheckValidity() { return CheckFormValidity(nullptr); }
 
   MOZ_CAN_RUN_SCRIPT
   bool ReportValidity() { return CheckValidFormSubmission(); }
@@ -420,7 +420,8 @@ class HTMLFormElement final : public nsGenericHTMLElement {
    *
    * @return Whether the form is currently valid.
    */
-  bool CheckFormValidity(nsTArray<RefPtr<Element>>* aInvalidElements) const;
+  MOZ_CAN_RUN_SCRIPT bool CheckFormValidity(
+      nsTArray<RefPtr<Element>>* aInvalidElements) const;
 
   // Clear the mImageNameLookupTable and mImageElements.
   void Clear();

dom/html/HTMLInputElement.cpp

@@ -248,21 +248,19 @@ class DispatchChangeEventCallback final : public GetFilesCallback {
     (void)NS_WARN_IF(NS_FAILED(DispatchEvents()));
   }
 
-  MOZ_CAN_RUN_SCRIPT_BOUNDARY
-  nsresult DispatchEvents() {
-    RefPtr<HTMLInputElement> inputElement(mInputElement);
-    nsresult rv = nsContentUtils::DispatchInputEvent(inputElement);
+  MOZ_CAN_RUN_SCRIPT_BOUNDARY nsresult DispatchEvents() {
+    nsresult rv = nsContentUtils::DispatchInputEvent(mInputElement);
     NS_WARNING_ASSERTION(NS_SUCCEEDED(rv), "Failed to dispatch input event");
     mInputElement->SetUserInteracted(true);
-    rv = nsContentUtils::DispatchTrustedEvent(mInputElement->OwnerDoc(),
-                                              mInputElement, u"change"_ns,
+    const RefPtr<Document> doc = mInputElement->OwnerDoc();
+    rv = nsContentUtils::DispatchTrustedEvent(doc, mInputElement, u"change"_ns,
                                               CanBubble::eYes, Cancelable::eNo);
 
     return rv;
   }
 
  private:
-  RefPtr<HTMLInputElement> mInputElement;
+  MOZ_KNOWN_LIVE const RefPtr<HTMLInputElement> mInputElement;
 };
 
 struct HTMLInputElement::FileData {
@@ -453,10 +451,9 @@ HTMLInputElement::nsFilePickerShownCallback::Done(
   mInput->PickerClosed();
 
   if (aResult == nsIFilePicker::returnCancel) {
-    RefPtr<HTMLInputElement> inputElement(mInput);
+    const RefPtr<Document> doc = mInput->OwnerDoc();
     return nsContentUtils::DispatchTrustedEvent(
-        inputElement->OwnerDoc(), inputElement, u"cancel"_ns, CanBubble::eYes,
-        Cancelable::eNo);
+        doc, mInput, u"cancel"_ns, CanBubble::eYes, Cancelable::eNo);
   }
 
   mInput->OwnerDoc()->NotifyUserGestureActivation();
@@ -643,7 +640,7 @@ class nsColorPickerShownCallback final : public nsIColorPickerShownCallback {
   MOZ_CAN_RUN_SCRIPT
   nsresult UpdateInternal(const nsAString& aColor, bool aTrustedUpdate);
 
-  RefPtr<HTMLInputElement> mInput;
+  MOZ_KNOWN_LIVE const RefPtr<HTMLInputElement> mInput;
   nsCOMPtr<nsIColorPicker> mColorPicker;
   bool mValueChanged;
 };
@@ -705,9 +702,9 @@ nsColorPickerShownCallback::Done(const nsAString& aColor) {
 
   if (mValueChanged) {
     mInput->SetUserInteracted(true);
-    rv = nsContentUtils::DispatchTrustedEvent(
-        mInput->OwnerDoc(), static_cast<Element*>(mInput.get()), u"change"_ns,
-        CanBubble::eYes, Cancelable::eNo);
+    const RefPtr<Document> doc = mInput->OwnerDoc();
+    rv = nsContentUtils::DispatchTrustedEvent(doc, mInput, u"change"_ns,
+                                              CanBubble::eYes, Cancelable::eNo);
   }
 
   return rv;
@@ -4284,7 +4281,7 @@ void HTMLInputElement::ActivationBehavior(EventChainPostVisitor& aVisitor) {
 
     // FIXME: Why is this different than every other change event?
     nsContentUtils::DispatchTrustedEvent<WidgetEvent>(
-        OwnerDoc(), static_cast<Element*>(this), eFormChange, CanBubble::eYes,
+        static_cast<Element*>(this), eFormChange, CanBubble::eYes,
         Cancelable::eNo);
   }
 

dom/html/HTMLInputElement.h

@@ -398,7 +398,7 @@ class HTMLInputElement final : public TextControlElement,
    * if a change event may be fired on bluring.
    * Sets mFocusedValue to value, if a change event is fired.
    */
-  void FireChangeEventIfNeeded();
+  MOZ_CAN_RUN_SCRIPT void FireChangeEventIfNeeded();
 
   /**
    * Returns the input element's value as a Decimal.
@@ -827,7 +827,7 @@ class HTMLInputElement final : public TextControlElement,
 
   void StartNumberControlSpinnerSpin();
   enum SpinnerStopState { eAllowDispatchingEvents, eDisallowDispatchingEvents };
-  void StopNumberControlSpinnerSpin(
+  MOZ_CAN_RUN_SCRIPT void StopNumberControlSpinnerSpin(
       SpinnerStopState aState = eAllowDispatchingEvents);
   MOZ_CAN_RUN_SCRIPT
   void StepNumberControlForUserEvent(int32_t aDirection);
@@ -1727,11 +1727,12 @@ class HTMLInputElement final : public TextControlElement,
                               nsIFilePicker* aFilePicker);
     NS_DECL_ISUPPORTS
 
-    NS_IMETHOD Done(nsIFilePicker::ResultCode aResult) override;
+    MOZ_CAN_RUN_SCRIPT_BOUNDARY NS_IMETHOD
+        Done(nsIFilePicker::ResultCode) override;
 
    private:
-    nsCOMPtr<nsIFilePicker> mFilePicker;
-    const RefPtr<HTMLInputElement> mInput;
+    MOZ_KNOWN_LIVE const nsCOMPtr<nsIFilePicker> mFilePicker;
+    MOZ_KNOWN_LIVE const RefPtr<HTMLInputElement> mInput;
   };
 };
 

dom/html/HTMLScriptElement.h

@@ -53,7 +53,8 @@ class HTMLScriptElement final : public nsGenericHTMLElement,
   virtual mozilla::dom::ReferrerPolicy GetReferrerPolicy() override;
 
   // nsIContent
-  virtual nsresult BindToTree(BindContext&, nsINode& aParent) override;
+  MOZ_CAN_RUN_SCRIPT_BOUNDARY nsresult BindToTree(BindContext&,
+                                                  nsINode& aParent) override;
   virtual void UnbindFromTree(UnbindContext&) override;
   virtual bool ParseAttribute(int32_t aNamespaceID, nsAtom* aAttribute,
                               const nsAString& aValue,

dom/html/HTMLSlotElement.cpp

@@ -426,7 +426,8 @@ void HTMLSlotElement::EnqueueSlotChangeEvent() {
 }
 
 void HTMLSlotElement::FireSlotChangeEvent() {
-  nsContentUtils::DispatchTrustedEvent(OwnerDoc(), this, u"slotchange"_ns,
+  const RefPtr<Document> doc = OwnerDoc();
+  nsContentUtils::DispatchTrustedEvent(doc, this, u"slotchange"_ns,
                                        CanBubble::eYes, Cancelable::eNo);
 }
 

dom/html/HTMLSlotElement.h

@@ -67,7 +67,7 @@ class HTMLSlotElement final : public nsGenericHTMLElement {
     mInSignalSlotList = false;
   }
 
-  void FireSlotChangeEvent();
+  MOZ_CAN_RUN_SCRIPT void FireSlotChangeEvent();
 
   void RemoveManuallyAssignedNode(nsIContent&);
 

dom/html/HTMLTextAreaElement.cpp

@@ -437,8 +437,12 @@ void HTMLTextAreaElement::FireChangeEventIfNeeded() {
 
   // Dispatch the change event.
   mFocusedValue = std::move(value);
-  nsContentUtils::DispatchTrustedEvent(OwnerDoc(), this, u"change"_ns,
-                                       CanBubble::eYes, Cancelable::eNo);
+  // We can use MOZ_KnownLive(OwnerDoc()) here because it's used only for
+  // considering the event target before dispatching the event and here may be
+  // in a hot path.
+  nsContentUtils::DispatchTrustedEvent(MOZ_KnownLive(OwnerDoc()), this,
+                                       u"change"_ns, CanBubble::eYes,
+                                       Cancelable::eNo);
 }
 
 nsresult HTMLTextAreaElement::PostHandleEvent(EventChainPostVisitor& aVisitor) {

dom/html/HTMLTextAreaElement.h

@@ -310,7 +310,7 @@ class HTMLTextAreaElement final : public TextControlElement,
   nsContentUtils::AutocompleteAttrState mAutocompleteAttrState;
   nsContentUtils::AutocompleteAttrState mAutocompleteInfoState;
 
-  void FireChangeEventIfNeeded();
+  MOZ_CAN_RUN_SCRIPT void FireChangeEventIfNeeded();
 
   nsString mFocusedValue;
 

dom/html/ImageDocument.h

@@ -39,8 +39,9 @@ class ImageDocument final : public MediaDocument,
 
   void SetScriptGlobalObject(nsIScriptGlobalObject*) override;
   void Destroy() override;
-  void OnPageShow(bool aPersisted, EventTarget* aDispatchStartTarget,
-                  bool aOnlySystemGroup = false) override;
+  MOZ_CAN_RUN_SCRIPT void OnPageShow(bool aPersisted,
+                                     EventTarget* aDispatchStartTarget,
+                                     bool aOnlySystemGroup = false) override;
 
   NS_DECL_IMGINOTIFICATIONOBSERVER
 

dom/html/nsGenericHTMLFrameElement.h

@@ -54,14 +54,16 @@ class nsGenericHTMLFrameElement : public nsGenericHTMLElement,
   NS_DECL_CYCLE_COLLECTION_CLASS_INHERITED(nsGenericHTMLFrameElement,
                                            nsGenericHTMLElement)
 
-  void SwapFrameLoaders(mozilla::dom::HTMLIFrameElement& aOtherLoaderOwner,
-                        mozilla::ErrorResult& aError);
+  MOZ_CAN_RUN_SCRIPT void SwapFrameLoaders(
+      mozilla::dom::HTMLIFrameElement& aOtherLoaderOwner,
+      mozilla::ErrorResult& aError);
 
-  void SwapFrameLoaders(mozilla::dom::XULFrameElement& aOtherLoaderOwner,
-                        mozilla::ErrorResult& aError);
+  MOZ_CAN_RUN_SCRIPT void SwapFrameLoaders(
+      mozilla::dom::XULFrameElement& aOtherLoaderOwner,
+      mozilla::ErrorResult& aError);
 
-  void SwapFrameLoaders(nsFrameLoaderOwner* aOtherLoaderOwner,
-                        mozilla::ErrorResult& rv);
+  MOZ_CAN_RUN_SCRIPT void SwapFrameLoaders(
+      nsFrameLoaderOwner* aOtherLoaderOwner, mozilla::ErrorResult& rv);
 
   /**
    * Helper method to map a HTML 'scrolling' attribute value (which can be null)

dom/html/nsIConstraintValidation.cpp

@@ -41,9 +41,10 @@ bool nsIConstraintValidation::CheckValidity(nsIContent& aEventTarget,
     return true;
   }
 
-  nsContentUtils::DispatchTrustedEvent(
-      aEventTarget.OwnerDoc(), &aEventTarget, u"invalid"_ns, CanBubble::eNo,
-      Cancelable::eYes, Composed::eDefault, aEventDefaultAction);
+  const RefPtr<Document> doc = aEventTarget.OwnerDoc();
+  nsContentUtils::DispatchTrustedEvent(doc, &aEventTarget, u"invalid"_ns,
+                                       CanBubble::eNo, Cancelable::eYes,
+                                       Composed::eDefault, aEventDefaultAction);
   return false;
 }
 

dom/html/nsIConstraintValidation.h

@@ -68,13 +68,13 @@ class nsIConstraintValidation : public nsISupports {
    *                       see EventTarget::DispatchEvent.
    * @return whether it's valid.
    */
-  bool CheckValidity(nsIContent& aEventTarget,
-                     bool* aEventDefaultAction = nullptr) const;
+  MOZ_CAN_RUN_SCRIPT bool CheckValidity(
+      nsIContent& aEventTarget, bool* aEventDefaultAction = nullptr) const;
 
   // Web IDL binding methods
   bool WillValidate() const { return IsCandidateForConstraintValidation(); }
   mozilla::dom::ValidityState* Validity();
-  bool ReportValidity();
+  MOZ_CAN_RUN_SCRIPT bool ReportValidity();
 
  protected:
   // You can't instantiate an object from that class.

dom/interfaces/base/nsIDOMWindowUtils.idl

@@ -1257,6 +1257,7 @@ interface nsIDOMWindowUtils : nsISupports {
    * aFrameElement is the iframe element which contains the child-process
    * fullscreen document.
    */
+  [can_run_script]
   void remoteFrameFullscreenChanged(
     in Element aFrameElement,
     [optional] in boolean aFullscreenKeyboardLockEnabled);
@@ -1265,6 +1266,7 @@ interface nsIDOMWindowUtils : nsISupports {
    * Called when the remote frame has popped all fullscreen elements off its
    * stack, so that the operation can complete on the parent side.
    */
+  [can_run_script]
   void remoteFrameFullscreenReverted();
 
   /**

dom/ipc/BrowserChild.h

@@ -426,10 +426,10 @@ class BrowserChild final : public nsMessageManagerScriptExecutor,
   mozilla::ipc::IPCResult RecvLoadRemoteScript(const nsAString& aURL,
                                                const bool& aRunInGlobalScope);
 
-  mozilla::ipc::IPCResult RecvAsyncMessage(const nsAString& aMessage,
-                                           NotNull<StructuredCloneData*> aData);
-  mozilla::ipc::IPCResult RecvSwappedWithOtherRemoteLoader(
-      const IPCTabContext& aContext);
+  MOZ_CAN_RUN_SCRIPT_BOUNDARY mozilla::ipc::IPCResult RecvAsyncMessage(
+      const nsAString& aMessage, NotNull<StructuredCloneData*> aData);
+  MOZ_CAN_RUN_SCRIPT_BOUNDARY mozilla::ipc::IPCResult
+  RecvSwappedWithOtherRemoteLoader(const IPCTabContext& aContext);
 
   mozilla::ipc::IPCResult RecvSafeAreaInsetsChanged(
       const mozilla::LayoutDeviceIntMargin& aSafeAreaInsets);
@@ -538,7 +538,7 @@ class BrowserChild final : public nsMessageManagerScriptExecutor,
       const MaybeDiscardedBrowsingContext&, const PrintData&,
       const MaybeDiscardedBrowsingContext&);
 
-  mozilla::ipc::IPCResult RecvDestroyPrintClone(
+  MOZ_CAN_RUN_SCRIPT_BOUNDARY mozilla::ipc::IPCResult RecvDestroyPrintClone(
       const MaybeDiscardedBrowsingContext&);
 
   mozilla::ipc::IPCResult RecvUpdateNativeWindowHandle(

dom/ipc/ContentChild.cpp

@@ -3879,7 +3879,8 @@ mozilla::ipc::IPCResult ContentChild::RecvWindowClose(
     return IPC_OK();
   }
 
-  nsCOMPtr<nsPIDOMWindowOuter> window = aContext.get()->GetDOMWindow();
+  const RefPtr<nsGlobalWindowOuter> window =
+      nsGlobalWindowOuter::Cast(aContext.get()->GetDOMWindow());
   if (!window) {
     MOZ_LOG(
         BrowsingContext::GetLog(), LogLevel::Debug,
@@ -3897,7 +3898,7 @@ mozilla::ipc::IPCResult ContentChild::RecvWindowClose(
     return IPC_OK();
   }
 
-  nsGlobalWindowOuter::Cast(window)->CloseOuter(aTrustedCaller);
+  window->CloseOuter(aTrustedCaller);
   return IPC_OK();
 }
 

dom/ipc/ContentChild.h

@@ -680,7 +680,7 @@ class ContentChild final : public PContentChild,
   mozilla::ipc::IPCResult RecvSetUseOriginAgentCluster(
       uint64_t aGroupId, nsIPrincipal* aPrincipal, bool aUseOriginAgentCluster);
 
-  mozilla::ipc::IPCResult RecvWindowClose(
+  MOZ_CAN_RUN_SCRIPT_BOUNDARY mozilla::ipc::IPCResult RecvWindowClose(
       const MaybeDiscarded<BrowsingContext>& aContext, bool aTrustedCaller);
   mozilla::ipc::IPCResult RecvWindowFocus(
       const MaybeDiscarded<BrowsingContext>& aContext, CallerType aCallerType,

dom/media/doctor/DecoderDoctorDiagnostics.cpp

@@ -417,7 +417,8 @@ static void ReportToConsole(dom::Document* aDocument,
       aParams.Length() < 2 ? "" : ", ...");
   if (StaticPrefs::media_decoder_doctor_testing()) {
     NS_DispatchToCurrentThread(NS_NewRunnableFunction(
-        "mozreportmediaerror", [doc = RefPtr{aDocument}] {
+        "mozreportmediaerror",
+        [doc = RefPtr{aDocument}]() MOZ_CAN_RUN_SCRIPT_BOUNDARY_LAMBDA {
           (void)nsContentUtils::DispatchTrustedEvent(
               doc, doc, u"mozreportmediaerror"_ns, CanBubble::eNo,
               Cancelable::eNo);

dom/media/utils/MediaElementEventRunners.cpp

@@ -10,6 +10,7 @@
 #include "mozilla/Casting.h"
 #include "mozilla/FlowMarkers.h"
 #include "mozilla/ProfilerState.h"
+#include "mozilla/dom/Document.h"
 #include "mozilla/dom/HTMLMediaElement.h"
 #include "mozilla/dom/HTMLVideoElement.h"
 #include "mozilla/dom/MediaError.h"
@@ -175,9 +176,10 @@ NS_IMETHODIMP nsSourceErrorEventRunner::Run() {
                         {}, ErrorMarker{}, mErrorDetails,
                         Flow::FromPointer(mElement.get()));
   }
-  return nsContentUtils::DispatchTrustedEvent(mElement->OwnerDoc(), mSource,
-                                              u"error"_ns, CanBubble::eNo,
-                                              Cancelable::eNo);
+  const RefPtr<Document> doc = mElement->OwnerDoc();
+  const nsCOMPtr<nsIContent> source = mSource;
+  return nsContentUtils::DispatchTrustedEvent(doc, source, u"error"_ns,
+                                              CanBubble::eNo, Cancelable::eNo);
 }
 
 NS_IMPL_CYCLE_COLLECTION_INHERITED(nsSourceErrorEventRunner, nsMediaEventRunner,

dom/media/utils/MediaElementEventRunners.h

@@ -171,7 +171,7 @@ class nsSourceErrorEventRunner : public nsMediaEventRunner {
       : nsMediaEventRunner("nsSourceErrorEventRunner", aElement),
         mSource(aSource),
         mErrorDetails(NS_ConvertUTF8toUTF16(aErrorDetails)) {}
-  NS_IMETHOD Run() override;
+  MOZ_CAN_RUN_SCRIPT_BOUNDARY NS_IMETHOD Run() override;
 
  private:
   virtual ~nsSourceErrorEventRunner() = default;

dom/media/webaudio/AudioContext.cpp

@@ -55,6 +55,7 @@
 #include "mozilla/dom/ContentChild.h"
 #include "mozilla/dom/ConvolverNodeBinding.h"
 #include "mozilla/dom/DelayNodeBinding.h"
+#include "mozilla/dom/Document.h"
 #include "mozilla/dom/DynamicsCompressorNodeBinding.h"
 #include "mozilla/dom/GainNodeBinding.h"
 #include "mozilla/dom/HTMLMediaElement.h"
@@ -822,14 +823,13 @@ class OnStateChangeTask final : public Runnable {
   explicit OnStateChangeTask(AudioContext* aAudioContext)
       : Runnable("dom::OnStateChangeTask"), mAudioContext(aAudioContext) {}
 
-  NS_IMETHODIMP
-  Run() override {
+  MOZ_CAN_RUN_SCRIPT_BOUNDARY NS_IMETHODIMP Run() override {
     nsGlobalWindowInner* win = mAudioContext->GetOwnerWindow();
     if (!win) {
       return NS_ERROR_FAILURE;
     }
 
-    Document* doc = win->GetExtantDoc();
+    const RefPtr<Document> doc = win->GetExtantDoc();
     if (!doc) {
       return NS_ERROR_FAILURE;
     }
@@ -839,7 +839,7 @@ class OnStateChangeTask final : public Runnable {
   }
 
  private:
-  RefPtr<AudioContext> mAudioContext;
+  MOZ_KNOWN_LIVE const RefPtr<AudioContext> mAudioContext;
 };
 
 void AudioContext::Dispatch(already_AddRefed<nsIRunnable> aRunnable) {
@@ -1174,13 +1174,14 @@ void AudioContext::ReportBlocked() {
   }
 
   RefPtr<nsIRunnable> r = NS_NewRunnableFunction(
-      "AudioContext::AutoplayBlocked", [self = RefPtr{this}]() {
+      "AudioContext::AutoplayBlocked",
+      [self = RefPtr{this}]() MOZ_CAN_RUN_SCRIPT_BOUNDARY_LAMBDA {
         nsGlobalWindowInner* win = self->GetOwnerWindow();
         if (!win) {
           return;
         }
 
-        Document* doc = win->GetExtantDoc();
+        const RefPtr<Document> doc = win->GetExtantDoc();
         if (!doc) {
           return;
         }

dom/media/webvtt/HTMLTrackElement.cpp

@@ -471,7 +471,7 @@ void HTMLTrackElement::DispatchTrackRunnable(const nsString& aEventName) {
 }
 
 void HTMLTrackElement::DispatchTrustedEvent(const nsAString& aName) {
-  Document* doc = OwnerDoc();
+  const RefPtr<Document> doc = OwnerDoc();
   if (!doc) {
     return;
   }

dom/media/webvtt/HTMLTrackElement.h

@@ -91,8 +91,8 @@ class HTMLTrackElement final : public nsGenericHTMLElement {
                             bool aNotify) override;
 
   void DispatchTrackRunnable(const nsString& aEventName);
-  void DispatchTrustedEvent(const nsAString& aName);
-  void DispatchTestEvent(const nsAString& aName);
+  MOZ_CAN_RUN_SCRIPT void DispatchTrustedEvent(const nsAString& aName);
+  MOZ_CAN_RUN_SCRIPT void DispatchTestEvent(const nsAString& aName);
 
   void CancelChannelAndListener(bool aCheckRFP);
 

dom/media/webvtt/WebVTTListener.cpp

@@ -87,13 +87,15 @@ WebVTTListener::AsyncOnChannelRedirect(nsIChannel* aOldChannel,
 }
 
 NS_IMETHODIMP
-WebVTTListener::OnStartRequest(nsIRequest* aRequest) {
+WebVTTListener::OnStartRequest(nsIRequest* aRequest)
+    MOZ_CAN_RUN_SCRIPT_BOUNDARY {
   if (IsCanceled()) {
     return NS_OK;
   }
 
   LOG("OnStartRequest");
-  mElement->DispatchTestEvent(u"mozStartedLoadingTextTrack"_ns);
+  const RefPtr<HTMLTrackElement> element = mElement;
+  element->DispatchTestEvent(u"mozStartedLoadingTextTrack"_ns);
   return NS_OK;
 }
 

dom/prototype/PrototypeDocumentContentSink.cpp

@@ -660,9 +660,9 @@ nsresult PrototypeDocumentContentSink::DoneWalking() {
                                               CanBubble::eYes, Cancelable::eNo);
   }
 
-  if (mScriptLoader) {
-    mScriptLoader->ParsingComplete(false);
-    mScriptLoader->DeferCheckpointReached();
+  if (const RefPtr<ScriptLoader> scriptLoader = mScriptLoader) {
+    scriptLoader->ParsingComplete(false);
+    scriptLoader->DeferCheckpointReached();
   }
 
   StartLayout();

dom/prototype/PrototypeDocumentContentSink.h

@@ -212,7 +212,7 @@ class PrototypeDocumentContentSink final : public nsIStreamLoaderObserver,
    * Expects that both the prototype document walk is complete and
    * all referenced stylesheets finished loading.
    */
-  nsresult DoneWalking();
+  MOZ_CAN_RUN_SCRIPT_BOUNDARY nsresult DoneWalking();
 
   /**
    * Create a delegate content model element from a prototype.
@@ -243,7 +243,7 @@ class PrototypeDocumentContentSink final : public nsIStreamLoaderObserver,
   nsresult InsertXMLStylesheetPI(const nsXULPrototypePI* aProtoPI,
                                  nsINode* aParent,
                                  XMLStylesheetProcessingInstruction* aPINode);
-  void CloseElement(Element* aElement);
+  MOZ_CAN_RUN_SCRIPT_BOUNDARY void CloseElement(Element* aElement);
 };
 
 }  // namespace mozilla::dom

dom/script/ModuleLoader.cpp

@@ -161,8 +161,9 @@ void ModuleLoader::ExecuteInlineModule(ModuleLoadRequest* aRequest) {
   if (aRequest->GetScriptLoadContext()->GetParserCreated() == NOT_FROM_PARSER) {
     GetScriptLoader()->RunScriptWhenSafe(aRequest);
   } else {
-    GetScriptLoader()->MaybeMoveToLoadedList(aRequest);
-    GetScriptLoader()->ProcessPendingRequests();
+    const RefPtr<ScriptLoader> scriptLoader = GetScriptLoader();
+    scriptLoader->MaybeMoveToLoadedList(aRequest);
+    scriptLoader->ProcessPendingRequests();
   }
 
   aRequest->GetScriptLoadContext()->MaybeUnblockOnload();

dom/script/ModuleLoader.h

@@ -82,7 +82,7 @@ class ModuleLoader final : public JS::loader::ModuleLoaderBase {
   }
 
   void AsyncExecuteInlineModule(ModuleLoadRequest* aRequest);
-  void ExecuteInlineModule(ModuleLoadRequest* aRequest);
+  MOZ_CAN_RUN_SCRIPT void ExecuteInlineModule(ModuleLoadRequest* aRequest);
 
  private:
   nsresult CompileJavaScriptOrWasmModule(

dom/script/ScriptElement.cpp

@@ -47,6 +47,8 @@ ScriptElement::ScriptAvailable(nsresult aResult, nsIScriptElement* aElement,
     if (parser) {
       parser->IncrementScriptNestingLevel();
     }
+    // XXX Cannot dispatch the error event asynchronously? Then, we can drop
+    // MOZ_CAN_RUN_SCRIPT from the script loaders.
     nsresult rv = FireErrorEvent();
     if (parser) {
       parser->DecrementScriptNestingLevel();
@@ -58,10 +60,10 @@ ScriptElement::ScriptAvailable(nsresult aResult, nsIScriptElement* aElement,
 
 /* virtual */
 nsresult ScriptElement::FireErrorEvent() {
-  nsIContent* cont = GetAsContent();
-
-  return nsContentUtils::DispatchTrustedEvent(
-      cont->OwnerDoc(), cont, u"error"_ns, CanBubble::eNo, Cancelable::eNo);
+  const nsCOMPtr<nsIContent> cont = GetAsContent();
+  const RefPtr<Document> doc = cont->OwnerDoc();
+  return nsContentUtils::DispatchTrustedEvent(doc, cont, u"error"_ns,
+                                              CanBubble::eNo, Cancelable::eNo);
 }
 
 NS_IMETHODIMP
@@ -87,7 +89,8 @@ ScriptElement::ScriptEvaluated(nsresult aResult, nsIScriptElement* aElement,
 }
 
 void ScriptElement::CharacterDataChanged(nsIContent* aContent,
-                                         const CharacterDataChangeInfo& aInfo) {
+                                         const CharacterDataChangeInfo& aInfo)
+    MOZ_CAN_RUN_SCRIPT_BOUNDARY {
   if (!nsContentUtils::IsInSameAnonymousTree(GetAsContent(), aContent)) {
     return;
   }
@@ -97,7 +100,8 @@ void ScriptElement::CharacterDataChanged(nsIContent* aContent,
 
 void ScriptElement::AttributeChanged(Element* aElement, int32_t aNameSpaceID,
                                      nsAtom* aAttribute, AttrModType aModType,
-                                     const nsAttrValue* aOldValue) {
+                                     const nsAttrValue* aOldValue)
+    MOZ_CAN_RUN_SCRIPT_BOUNDARY {
   if (aElement != GetAsContent()) {
     return;
   }
@@ -123,7 +127,8 @@ void ScriptElement::AttributeChanged(Element* aElement, int32_t aNameSpaceID,
 }
 
 void ScriptElement::ContentAppended(nsIContent* aFirstNewContent,
-                                    const ContentAppendInfo& aInfo) {
+                                    const ContentAppendInfo& aInfo)
+    MOZ_CAN_RUN_SCRIPT_BOUNDARY {
   if (!nsContentUtils::IsInSameAnonymousTree(GetAsContent(),
                                              aFirstNewContent)) {
     return;
@@ -137,7 +142,8 @@ void ScriptElement::ContentAppended(nsIContent* aFirstNewContent,
 }
 
 void ScriptElement::ContentInserted(nsIContent* aChild,
-                                    const ContentInsertInfo& aInfo) {
+                                    const ContentInsertInfo& aInfo)
+    MOZ_CAN_RUN_SCRIPT_BOUNDARY {
   if (!nsContentUtils::IsInSameAnonymousTree(GetAsContent(), aChild)) {
     return;
   }

dom/script/ScriptElement.h

@@ -35,7 +35,7 @@ class ScriptElement : public nsIScriptElement, public nsStubMutationObserver {
   explicit ScriptElement(FromParser aFromParser)
       : nsIScriptElement(aFromParser) {}
 
-  virtual nsresult FireErrorEvent() override;
+  MOZ_CAN_RUN_SCRIPT nsresult FireErrorEvent() override;
 
   virtual bool GetScriptType(nsAString& aType) override;
 
@@ -47,16 +47,17 @@ class ScriptElement : public nsIScriptElement, public nsStubMutationObserver {
    */
   virtual bool HasExternalScriptContent() = 0;
 
-  virtual bool MaybeProcessScript(nsCOMPtr<nsIParser> aParser) override;
+  MOZ_CAN_RUN_SCRIPT bool MaybeProcessScript(
+      nsCOMPtr<nsIParser> aParser) override;
 
-  virtual MOZ_CAN_RUN_SCRIPT nsresult
+  MOZ_CAN_RUN_SCRIPT nsresult
   GetTrustedTypesCompliantInlineScriptText(nsString& aSourceText) override;
 
  private:
   // https://github.com/w3c/trusted-types/pull/579
   void UpdateTrustWorthiness(MutationEffectOnScript aMutationEffectOnScript);
 
-  bool MaybeProcessScript(const nsAString& aSourceText);
+  MOZ_CAN_RUN_SCRIPT bool MaybeProcessScript(const nsAString& aSourceText);
 };
 
 }  // namespace mozilla::dom

dom/script/ScriptLoadHandler.cpp

@@ -404,8 +404,8 @@ nsresult ScriptLoadHandler::EnsureKnownDataType(nsIChannel* aChannel) {
 NS_IMETHODIMP
 ScriptLoadHandler::OnStreamComplete(nsIIncrementalStreamLoader* aLoader,
                                     nsISupports* aContext, nsresult aStatus,
-                                    uint32_t aDataLength,
-                                    const uint8_t* aData) {
+                                    uint32_t aDataLength, const uint8_t* aData)
+    MOZ_CAN_RUN_SCRIPT_BOUNDARY {
   nsCOMPtr<nsIRequest> channelRequest;
   aLoader->GetRequest(getter_AddRefs(channelRequest));
   nsCOMPtr<nsIChannel> channel = do_QueryInterface(channelRequest);
@@ -450,7 +450,7 @@ ScriptLoadHandler::OnStreamComplete(nsIIncrementalStreamLoader* aLoader,
       GetCurrentSerialEventTarget(), __func__,
       [self = RefPtr{this}, channel = std::move(channel),
        integrity = RefPtr{integrity}, computedHash = std::move(computedHash),
-       aStatus, aDataLength, aData](bool) {
+       aStatus, aDataLength, aData](bool) MOZ_CAN_RUN_SCRIPT_BOUNDARY {
         MOZ_LOG_FMT(gWaictLog, LogLevel::Debug,
                     "ScriptLoadHandler::OnStreamComplete: WaitForManifestLoad "
                     "promise resolved");
@@ -590,8 +590,10 @@ nsresult ScriptLoadHandler::DoOnStreamComplete(nsIChannel* aChannel,
   // Everything went well, keep the CacheInfoChannel alive such that we can
   // later save the serialized stencil on the cache entry.
   // we have to mediate and use mRequest.
-  rv = mScriptLoader->OnStreamComplete(aChannel, mRequest, aStatus, mSRIStatus,
-                                       mSRIDataVerifier.get());
+  const RefPtr<ScriptLoader> scriptLoader = mScriptLoader;
+  const RefPtr<JS::loader::ScriptLoadRequest> request = mRequest;
+  rv = scriptLoader->OnStreamComplete(aChannel, request, aStatus, mSRIStatus,
+                                      mSRIDataVerifier.get());
 
   return rv;
 }

dom/script/ScriptLoadHandler.h

@@ -83,8 +83,10 @@ class ScriptLoadHandler final : public nsIIncrementalStreamLoaderObserver,
  private:
   virtual ~ScriptLoadHandler();
 
-  nsresult DoOnStreamComplete(nsIChannel* aChannel, nsresult aStatus,
-                              uint32_t aDataLength, const uint8_t* aData);
+  MOZ_CAN_RUN_SCRIPT nsresult DoOnStreamComplete(nsIChannel* aChannel,
+                                                 nsresult aStatus,
+                                                 uint32_t aDataLength,
+                                                 const uint8_t* aData);
 
   /*
    * Discover the charset by looking at the stream data, the script tag, and

dom/script/ScriptLoader.cpp

@@ -274,7 +274,8 @@ ScriptLoader::~ScriptLoader() {
   mObservers.Clear();
 
   if (mParserBlockingRequest) {
-    FireScriptAvailable(NS_ERROR_ABORT, mParserBlockingRequest);
+    const RefPtr<ScriptLoadRequest> parserBlockRequest = mParserBlockingRequest;
+    FireScriptAvailable(NS_ERROR_ABORT, parserBlockRequest);
   }
 
   for (ScriptLoadRequest* req = mXSLTRequests.getFirst(); req;
@@ -640,15 +641,17 @@ nsIURI* ScriptLoader::GetBaseURI() const {
 
 class ScriptRequestProcessor : public Runnable {
  private:
-  RefPtr<ScriptLoader> mLoader;
-  RefPtr<ScriptLoadRequest> mRequest;
+  MOZ_KNOWN_LIVE const RefPtr<ScriptLoader> mLoader;
+  MOZ_KNOWN_LIVE const RefPtr<ScriptLoadRequest> mRequest;
 
  public:
   ScriptRequestProcessor(ScriptLoader* aLoader, ScriptLoadRequest* aRequest)
       : Runnable("dom::ScriptRequestProcessor"),
         mLoader(aLoader),
         mRequest(aRequest) {}
-  NS_IMETHOD Run() override { return mLoader->ProcessRequest(mRequest); }
+  MOZ_CAN_RUN_SCRIPT_BOUNDARY NS_IMETHOD Run() override {
+    return mLoader->ProcessRequest(mRequest);
+  }
 };
 
 void ScriptLoader::RunScriptWhenSafe(ScriptLoadRequest* aRequest) {
@@ -1864,7 +1867,7 @@ bool ScriptLoader::ProcessInlineScript(nsIScriptElement* aElement,
       mModuleLoader->DisallowImportMaps();
     }
 
-    ModuleLoadRequest* modReq = request->AsModuleRequest();
+    ModuleLoadRequest* const modReq = request->AsModuleRequest();
     if (aElement->GetParserCreated() != NOT_FROM_PARSER) {
       if (aElement->GetScriptAsync()) {
         AddAsyncRequest(modReq);
@@ -1878,7 +1881,7 @@ bool ScriptLoader::ProcessInlineScript(nsIScriptElement* aElement,
     nsresult rv = modReq->OnFetchComplete(NS_OK);
     if (NS_FAILED(rv)) {
       ReportErrorToConsole(modReq, rv);
-      HandleLoadError(modReq, rv);
+      HandleLoadError(MOZ_KnownLive(modReq), rv);
     }
 
     return false;
@@ -2196,7 +2199,7 @@ class OffThreadCompilationCompleteTask : public Task {
   }
 #endif
 
-  TaskResult Run() override {
+  MOZ_CAN_RUN_SCRIPT_BOUNDARY TaskResult Run() override {
     MOZ_ASSERT(NS_IsMainThread());
 
     RefPtr<ScriptLoadContext> context = mRequest->GetScriptLoadContext();
@@ -2224,10 +2227,9 @@ class OffThreadCompilationCompleteTask : public Task {
                            profilerLabelString);
     }
 
-    (void)mLoader->ProcessOffThreadRequest(mRequest);
-
-    mRequest = nullptr;
-    mLoader = nullptr;
+    const RefPtr<ScriptLoadRequest> request = std::move(mRequest);
+    const RefPtr<ScriptLoader> loader = std::move(mLoader);
+    (void)loader->ProcessOffThreadRequest(request);
     return TaskResult::Complete;
   }
 
@@ -2802,21 +2804,21 @@ nsresult ScriptLoader::ProcessRequest(ScriptLoadRequest* aRequest) {
 
 void ScriptLoader::FireScriptAvailable(nsresult aResult,
                                        ScriptLoadRequest* aRequest) {
+  const nsCOMPtr<nsIScriptElement> scriptElement =
+      aRequest->GetScriptLoadContext()->GetScriptElementForObserver();
+  const nsCOMPtr<nsIURI> uri = aRequest->URI();
   for (int32_t i = 0; i < mObservers.Count(); i++) {
     nsCOMPtr<nsIScriptLoaderObserver> obs = mObservers[i];
-    obs->ScriptAvailable(
-        aResult,
-        aRequest->GetScriptLoadContext()->GetScriptElementForObserver(),
-        aRequest->GetScriptLoadContext()->mIsInline, aRequest->URI(),
-        aRequest->GetScriptLoadContext()->mLineNo);
+    obs->ScriptAvailable(aResult, scriptElement,
+                         aRequest->GetScriptLoadContext()->mIsInline, uri,
+                         aRequest->GetScriptLoadContext()->mLineNo);
   }
 
-  bool isInlineClassicScript = aRequest->GetScriptLoadContext()->mIsInline &&
-                               !aRequest->IsModuleRequest();
-  RefPtr<nsIScriptElement> scriptElement =
-      aRequest->GetScriptLoadContext()->GetScriptElementForObserver();
+  const bool isInlineClassicScript =
+      aRequest->GetScriptLoadContext()->mIsInline &&
+      !aRequest->IsModuleRequest();
   scriptElement->ScriptAvailable(aResult, scriptElement, isInlineClassicScript,
-                                 aRequest->URI(),
+                                 uri,
                                  aRequest->GetScriptLoadContext()->mLineNo);
 }
 
@@ -4349,7 +4351,8 @@ void ScriptLoader::ProcessPendingRequestsAsync() {
   }
 }
 
-void ProcessPendingRequestsCallback(nsITimer* aTimer, void* aClosure) {
+void ProcessPendingRequestsCallback(nsITimer* aTimer, void* aClosure)
+    MOZ_CAN_RUN_SCRIPT_BOUNDARY {
   RefPtr<ScriptLoader> sl = static_cast<ScriptLoader*>(aClosure);
   sl->ProcessPendingRequests(true);
 }

dom/script/ScriptLoader.h

@@ -224,8 +224,8 @@ class ScriptLoader final : public JS::loader::ScriptLoaderInterface {
    * application of the default Trusted Types policy, a void string otherwise.
    * See https://html.spec.whatwg.org/#prepare-the-script-element
    */
-  bool ProcessScriptElement(nsIScriptElement* aElement,
-                            const nsAString& aSourceText);
+  MOZ_CAN_RUN_SCRIPT bool ProcessScriptElement(nsIScriptElement* aElement,
+                                               const nsAString& aSourceText);
 
   /**
    * Gets the currently executing script. This is useful if you want to
@@ -356,9 +356,10 @@ class ScriptLoader final : public JS::loader::ScriptLoaderInterface {
    * loading the script. The streamed content is expected to be stored on the
    * aRequest argument.
    */
-  nsresult OnStreamComplete(nsIChannel* aChannel, ScriptLoadRequest* aRequest,
-                            nsresult aChannelStatus, nsresult aSRIStatus,
-                            SRICheckDataVerifier* aSRIDataVerifier);
+  MOZ_CAN_RUN_SCRIPT nsresult
+  OnStreamComplete(nsIChannel* aChannel, ScriptLoadRequest* aRequest,
+                   nsresult aChannelStatus, nsresult aSRIStatus,
+                   SRICheckDataVerifier* aSRIDataVerifier);
 
   /**
    * Returns wether any request is queued, and not executed yet.
@@ -373,7 +374,8 @@ class ScriptLoader final : public JS::loader::ScriptLoaderInterface {
   /**
    * Processes any pending requests that are ready for processing.
    */
-  void ProcessPendingRequests(bool aAllowBypassingParserBlocking = false);
+  MOZ_CAN_RUN_SCRIPT void ProcessPendingRequests(
+      bool aAllowBypassingParserBlocking = false);
 
   /**
    * Starts deferring deferred scripts and puts them in the mDeferredRequests
@@ -386,7 +388,7 @@ class ScriptLoader final : public JS::loader::ScriptLoaderInterface {
    * this will drop any pending scripts that haven't run yet, otherwise it will
    * do nothing.
    */
-  void ParsingComplete(bool aTerminated);
+  MOZ_CAN_RUN_SCRIPT void ParsingComplete(bool aTerminated);
 
   /**
    * Notifies the script loader that the checkpoint to begin execution of defer
@@ -400,7 +402,7 @@ class ScriptLoader final : public JS::loader::ScriptLoaderInterface {
    * WARNING: This function will synchronously execute content scripts, so be
    * prepared that the world might change around you.
    */
-  void DeferCheckpointReached();
+  MOZ_CAN_RUN_SCRIPT void DeferCheckpointReached();
 
   /**
    * Returns the number of pending scripts, deferred or not.
@@ -435,7 +437,8 @@ class ScriptLoader final : public JS::loader::ScriptLoaderInterface {
    * Process a request that was deferred so that the script could be compiled
    * off thread.
    */
-  nsresult ProcessOffThreadRequest(ScriptLoadRequest* aRequest);
+  MOZ_CAN_RUN_SCRIPT nsresult
+  ProcessOffThreadRequest(ScriptLoadRequest* aRequest);
 
   bool AddPendingChildLoader(ScriptLoader* aChild) {
     // XXX(Bug 1631371) Check if this should use a fallible operation as it
@@ -479,7 +482,7 @@ class ScriptLoader final : public JS::loader::ScriptLoaderInterface {
   nsIURI* GetBaseURI() const override;
 
  private:
-  ~ScriptLoader();
+  MOZ_CAN_RUN_SCRIPT_BOUNDARY ~ScriptLoader();
 
   already_AddRefed<ScriptLoadRequest> CreateLoadRequest(
       JS::loader::ScriptKind aKind, nsIURI* aURI, nsIScriptElement* aElement,
@@ -518,15 +521,16 @@ class ScriptLoader final : public JS::loader::ScriptLoaderInterface {
   /**
    * Asynchronously resumes the creator parser of the parser-blocking scripts.
    */
-  void ContinueParserAsync(ScriptLoadRequest* aParserBlockingRequest);
+  MOZ_CAN_RUN_SCRIPT void ContinueParserAsync(
+      ScriptLoadRequest* aParserBlockingRequest);
 
-  bool ProcessExternalScript(nsIScriptElement* aElement,
-                             JS::loader::ScriptKind aScriptKind,
-                             nsIContent* aScriptContent);
+  MOZ_CAN_RUN_SCRIPT bool ProcessExternalScript(
+      nsIScriptElement* aElement, JS::loader::ScriptKind aScriptKind,
+      nsIContent* aScriptContent);
 
-  bool ProcessInlineScript(nsIScriptElement* aElement,
-                           JS::loader::ScriptKind aScriptKind,
-                           const nsAString& aSourceText);
+  MOZ_CAN_RUN_SCRIPT bool ProcessInlineScript(
+      nsIScriptElement* aElement, JS::loader::ScriptKind aScriptKind,
+      const nsAString& aSourceText);
 
   enum class CacheBehavior : uint8_t {
     DoNothingDisabled,
@@ -582,8 +586,9 @@ class ScriptLoader final : public JS::loader::ScriptLoaderInterface {
   nsresult StartClassicLoad(ScriptLoadRequest* aRequest,
                             const Maybe<nsAutoString>& aCharsetForPreload);
 
-  void OnDelayedReady(ScriptLoadRequest* aRequest,
-                      const Maybe<nsAutoString>& aCharsetForPreload);
+  MOZ_CAN_RUN_SCRIPT void OnDelayedReady(
+      ScriptLoadRequest* aRequest,
+      const Maybe<nsAutoString>& aCharsetForPreload);
 
   static void PrepareCacheInfoChannel(nsIChannel* aChannel,
                                       ScriptLoadRequest* aRequest);
@@ -626,10 +631,11 @@ class ScriptLoader final : public JS::loader::ScriptLoaderInterface {
    */
   nsresult RestartLoad(ScriptLoadRequest* aRequest);
 
-  void HandleLoadError(ScriptLoadRequest* aRequest, nsresult aResult);
+  MOZ_CAN_RUN_SCRIPT void HandleLoadError(ScriptLoadRequest* aRequest,
+                                          nsresult aResult);
 
-  void HandleLoadErrorAndProcessPendingRequests(ScriptLoadRequest* aRequest,
-                                                nsresult aResult);
+  MOZ_CAN_RUN_SCRIPT void HandleLoadErrorAndProcessPendingRequests(
+      ScriptLoadRequest* aRequest, nsresult aResult);
 
   /**
    * Process any pending requests asynchronously (i.e. off an event) if there
@@ -692,9 +698,11 @@ class ScriptLoader final : public JS::loader::ScriptLoaderInterface {
                                JS::CompileOptions& aOptions,
                                CompileOrDecodeTask** aCompileOrDecodeTask);
 
-  nsresult ProcessRequest(ScriptLoadRequest* aRequest);
-  nsresult CompileOffThreadOrProcessRequest(ScriptLoadRequest* aRequest);
-  void FireScriptAvailable(nsresult aResult, ScriptLoadRequest* aRequest);
+  MOZ_CAN_RUN_SCRIPT nsresult ProcessRequest(ScriptLoadRequest* aRequest);
+  MOZ_CAN_RUN_SCRIPT nsresult
+  CompileOffThreadOrProcessRequest(ScriptLoadRequest* aRequest);
+  MOZ_CAN_RUN_SCRIPT void FireScriptAvailable(nsresult aResult,
+                                              ScriptLoadRequest* aRequest);
   // TODO: Convert this to MOZ_CAN_RUN_SCRIPT (bug 1415230)
   MOZ_CAN_RUN_SCRIPT_BOUNDARY void FireScriptEvaluated(
       nsresult aResult, ScriptLoadRequest* aRequest);

dom/script/nsIScriptElement.h

@@ -224,7 +224,7 @@ class nsIScriptElement : public nsIScriptLoaderObserver {
    * @return whether a non-null aParser would be blocked while this script is
    *         being loaded.
    */
-  bool AttemptToExecute(nsCOMPtr<nsIParser> aParser);
+  MOZ_CAN_RUN_SCRIPT bool AttemptToExecute(nsCOMPtr<nsIParser> aParser);
 
   /**
    * Get the CORS mode of the script element
@@ -249,7 +249,7 @@ class nsIScriptElement : public nsIScriptLoaderObserver {
   /**
    * Fire an error event
    */
-  virtual nsresult FireErrorEvent() = 0;
+  MOZ_CAN_RUN_SCRIPT virtual nsresult FireErrorEvent() = 0;
 
   /**
    * This must be called on scripts with mIsTrusted set to false in
@@ -276,7 +276,8 @@ class nsIScriptElement : public nsIScriptLoaderObserver {
    * @return whether the parser will be blocked while this script is being
    *         loaded
    */
-  virtual bool MaybeProcessScript(nsCOMPtr<nsIParser> aParser) = 0;
+  MOZ_CAN_RUN_SCRIPT virtual bool MaybeProcessScript(
+      nsCOMPtr<nsIParser> aParser) = 0;
 
   /**
    * Since we've removed the XPCOM interface to HTML elements, we need a way to

dom/script/nsIScriptLoaderObserver.h

@@ -34,11 +34,9 @@ class NS_NO_VTABLE nsIScriptLoaderObserver : public nsISupports {
    * @param aLineNo At what line does the script appear (generally 1
    *        if it is a loaded script).
    */
-  JS_HAZ_CAN_RUN_SCRIPT NS_IMETHOD ScriptAvailable(nsresult aResult,
-                                                   nsIScriptElement* aElement,
-                                                   bool aIsInlineClassicScript,
-                                                   nsIURI* aURI,
-                                                   uint32_t aLineNo) = 0;
+  JS_HAZ_CAN_RUN_SCRIPT MOZ_CAN_RUN_SCRIPT NS_IMETHOD ScriptAvailable(
+      nsresult aResult, nsIScriptElement* aElement, bool aIsInlineClassicScript,
+      nsIURI* aURI, uint32_t aLineNo) = 0;
 
   /**
    * The script has been evaluated.
@@ -52,11 +50,11 @@ class NS_NO_VTABLE nsIScriptLoaderObserver : public nsISupports {
       nsresult aResult, nsIScriptElement* aElement, bool aIsInline) = 0;
 };
 
-#define NS_DECL_NSISCRIPTLOADEROBSERVER                                    \
-  NS_IMETHOD ScriptAvailable(nsresult aResult, nsIScriptElement* aElement, \
-                             bool aIsInlineClassicScript, nsIURI* aURI,    \
-                             uint32_t aLineNo) override;                   \
-  MOZ_CAN_RUN_SCRIPT NS_IMETHOD ScriptEvaluated(                           \
+#define NS_DECL_NSISCRIPTLOADEROBSERVER                                      \
+  MOZ_CAN_RUN_SCRIPT NS_IMETHOD ScriptAvailable(                             \
+      nsresult aResult, nsIScriptElement* aElement,                          \
+      bool aIsInlineClassicScript, nsIURI* aURI, uint32_t aLineNo) override; \
+  MOZ_CAN_RUN_SCRIPT NS_IMETHOD ScriptEvaluated(                             \
       nsresult aResult, nsIScriptElement* aElement, bool aIsInline) override;
 
 #endif  // MOZILLA_DOM_SCRIPT_NSISCRIPTLOADEROBSERVER_H_

dom/svg/SVGAnimationElement.h

@@ -37,7 +37,8 @@ class SVGAnimationElement : public SVGAnimationElementBase, public SVGTests {
   nsresult Clone(dom::NodeInfo*, nsINode** aResult) const override = 0;
 
   // nsIContent specializations
-  nsresult BindToTree(BindContext&, nsINode& aParent) override;
+  MOZ_CAN_RUN_SCRIPT_BOUNDARY nsresult BindToTree(BindContext&,
+                                                  nsINode& aParent) override;
   void UnbindFromTree(UnbindContext&) override;
 
   // Element specializations
@@ -45,9 +46,12 @@ class SVGAnimationElement : public SVGAnimationElementBase, public SVGTests {
                       const nsAString& aValue,
                       nsIPrincipal* aMaybeScriptedPrincipal,
                       nsAttrValue& aResult) override;
-  void AfterSetAttr(int32_t aNamespaceID, nsAtom* aName,
-                    const nsAttrValue* aValue, const nsAttrValue* aOldValue,
-                    nsIPrincipal* aSubjectPrincipal, bool aNotify) override;
+  MOZ_CAN_RUN_SCRIPT_BOUNDARY void AfterSetAttr(int32_t aNamespaceID,
+                                                nsAtom* aName,
+                                                const nsAttrValue* aValue,
+                                                const nsAttrValue* aOldValue,
+                                                nsIPrincipal* aSubjectPrincipal,
+                                                bool aNotify) override;
 
   Element* GetTargetElementContent();
   virtual bool GetTargetAttributeName(int32_t* aNamespaceID,
@@ -106,7 +110,7 @@ class SVGAnimationElement : public SVGAnimationElementBase, public SVGTests {
  protected:
   // SVGElement overrides
 
-  void UpdateHrefTarget(const nsAString& aHrefStr);
+  MOZ_CAN_RUN_SCRIPT void UpdateHrefTarget(const nsAString& aHrefStr);
   void AnimationTargetChanged();
 
   /**

dom/svg/SVGScriptElement.h

@@ -46,7 +46,8 @@ class SVGScriptElement final : public SVGScriptElementBase,
   bool HasExternalScriptContent() override;
 
   // nsIContent specializations:
-  nsresult BindToTree(BindContext&, nsINode& aParent) override;
+  MOZ_CAN_RUN_SCRIPT_BOUNDARY nsresult BindToTree(BindContext&,
+                                                  nsINode& aParent) override;
   bool ParseAttribute(int32_t aNamespaceID, nsAtom* aAttribute,
                       const nsAString& aValue,
                       nsIPrincipal* aMaybeScriptedPrincipal,

dom/svg/SVGUseElement.cpp

@@ -563,7 +563,7 @@ void SVGUseElement::LookupHref() {
     return;
   }
 
-  Element* treeToWatch = mOriginal ? mOriginal.get() : this;
+  const RefPtr<Element> treeToWatch = mOriginal ? mOriginal.get() : this;
   if (nsContentUtils::IsLocalRefURL(href)) {
     mReferencedElementTracker.ResetToLocalFragmentID(*treeToWatch, href);
     return;
@@ -583,7 +583,7 @@ void SVGUseElement::LookupHref() {
     return;
   }
 
-  nsIReferrerInfo* referrer =
+  const nsCOMPtr<nsIReferrerInfo> referrer =
       OwnerDoc()->ReferrerInfoForInternalCSSAndSVGResources();
   mReferencedElementTracker.ResetToURIWithFragmentID(*treeToWatch, targetURI,
                                                      referrer);

dom/svg/SVGUseElement.h

@@ -85,7 +85,7 @@ class SVGUseElement final : public SVGUseElementBase,
 
   // Updates the internal shadow tree to be an up-to-date clone of the
   // referenced element.
-  void UpdateShadowTree();
+  MOZ_CAN_RUN_SCRIPT void UpdateShadowTree();
 
   // Shared code between AfterSetAttr and SVGUseFrame::AttributeChanged.
   //
@@ -153,7 +153,7 @@ class SVGUseElement final : public SVGUseElementBase,
    */
   bool OurWidthAndHeightAreUsed() const;
   void SyncWidthOrHeight(nsAtom* aName);
-  void LookupHref();
+  MOZ_CAN_RUN_SCRIPT void LookupHref();
   void TriggerReclone();
   void UnlinkSource();
 

dom/xml/nsXMLContentSink.h

@@ -58,7 +58,8 @@ class nsXMLContentSink : public nsContentSink,
   // nsIContentSink
   NS_IMETHOD WillParse(void) override;
   NS_IMETHOD WillBuildModel() override;
-  NS_IMETHOD DidBuildModel(bool aTerminated) override;
+  MOZ_CAN_RUN_SCRIPT_BOUNDARY NS_IMETHOD
+  DidBuildModel(bool aTerminated) override;
   NS_IMETHOD WillInterrupt(void) override;
   void WillResume() override;
   NS_IMETHOD SetParser(nsParserBase* aParser) override;
@@ -77,11 +78,12 @@ class nsXMLContentSink : public nsContentSink,
   }
 
   // nsITransformObserver
-  nsresult OnDocumentCreated(mozilla::dom::Document* aSourceDocument,
-                             mozilla::dom::Document* aResultDocument) override;
-  nsresult OnTransformDone(mozilla::dom::Document* aSourceDocument,
-                           nsresult aResult,
-                           mozilla::dom::Document* aResultDocument) override;
+  MOZ_CAN_RUN_SCRIPT_BOUNDARY nsresult
+  OnDocumentCreated(mozilla::dom::Document* aSourceDocument,
+                    mozilla::dom::Document* aResultDocument) override;
+  MOZ_CAN_RUN_SCRIPT_BOUNDARY nsresult
+  OnTransformDone(mozilla::dom::Document* aSourceDocument, nsresult aResult,
+                  mozilla::dom::Document* aResultDocument) override;
 
   // nsICSSLoaderObserver
   NS_IMETHOD StyleSheetLoaded(mozilla::StyleSheet* aSheet, bool aWasDeferred,
@@ -124,7 +126,8 @@ class nsXMLContentSink : public nsContentSink,
 
   // aParent is allowed to be null here if this is the root content
   // being closed
-  virtual nsresult CloseElement(nsIContent* aContent);
+  MOZ_CAN_RUN_SCRIPT_BOUNDARY virtual nsresult CloseElement(
+      nsIContent* aContent);
 
   virtual nsresult FlushText(bool aReleaseTextNode = true);
 
@@ -147,7 +150,7 @@ class nsXMLContentSink : public nsContentSink,
   }
 
   // nsContentSink override
-  virtual nsresult ProcessStyleLinkFromHeader(
+  MOZ_CAN_RUN_SCRIPT_BOUNDARY virtual nsresult ProcessStyleLinkFromHeader(
       const nsAString& aHref, bool aAlternate, const nsAString& aTitle,
       const nsAString& aIntegrity, const nsAString& aType,
       const nsAString& aMedia, const nsAString& aReferrerPolicy,

dom/xslt/xslt/txMozillaXMLOutput.cpp

@@ -190,7 +190,8 @@ nsresult txMozillaXMLOutput::comment(const nsString& aData) {
   return error.StealNSResult();
 }
 
-nsresult txMozillaXMLOutput::endDocument(nsresult aResult) {
+nsresult txMozillaXMLOutput::endDocument(nsresult aResult)
+    MOZ_CAN_RUN_SCRIPT_BOUNDARY {
   TX_ENSURE_CURRENTNODE;
 
   if (NS_FAILED(aResult)) {
@@ -215,7 +216,7 @@ nsresult txMozillaXMLOutput::endDocument(nsresult aResult) {
     MOZ_ASSERT(mDocument->GetReadyStateEnum() == Document::READYSTATE_LOADING,
                "Bad readyState");
     mDocument->SetReadyStateInternal(Document::READYSTATE_INTERACTIVE);
-    if (ScriptLoader* loader = mDocument->GetScriptLoader()) {
+    if (const RefPtr<ScriptLoader> loader = mDocument->GetScriptLoader()) {
       loader->ParsingComplete(false);
     }
   }
@@ -227,7 +228,7 @@ nsresult txMozillaXMLOutput::endDocument(nsresult aResult) {
   return NS_OK;
 }
 
-nsresult txMozillaXMLOutput::endElement() {
+nsresult txMozillaXMLOutput::endElement() MOZ_CAN_RUN_SCRIPT_BOUNDARY {
   TX_ENSURE_CURRENTNODE;
 
   if (mBadChildLevel) {
@@ -923,7 +924,8 @@ void txTransformNotifier::SignalTransformEnd(nsresult aResult) {
   nsCOMPtr<nsIScriptLoaderObserver> kungFuDeathGrip(this);
 
   if (mDocument) {
-    if (dom::ScriptLoader* scriptLoader = mDocument->GetScriptLoader()) {
+    if (const RefPtr<dom::ScriptLoader> scriptLoader =
+            mDocument->GetScriptLoader()) {
       scriptLoader->DeferCheckpointReached();
       scriptLoader->RemoveObserver(this);
       // XXX Maybe we want to cancel script loads if NS_FAILED(rv)?

dom/xslt/xslt/txMozillaXMLOutput.h

@@ -46,7 +46,7 @@ class txTransformNotifier final : public nsIScriptLoaderObserver,
 
  private:
   ~txTransformNotifier();
-  void SignalTransformEnd(nsresult aResult = NS_OK);
+  MOZ_CAN_RUN_SCRIPT_BOUNDARY void SignalTransformEnd(nsresult aResult = NS_OK);
 
   nsCOMPtr<mozilla::dom::Document> mSourceDocument;
   nsCOMPtr<mozilla::dom::Document> mDocument;

dom/xul/XULFrameElement.h

@@ -42,12 +42,13 @@ class XULFrameElement final : public nsXULElement, public nsFrameLoaderOwner {
   nsIOpenWindowInfo* GetOpenWindowInfo() const;
   void SetOpenWindowInfo(nsIOpenWindowInfo* aInfo);
 
-  void SwapFrameLoaders(mozilla::dom::HTMLIFrameElement& aOtherLoaderOwner,
-                        mozilla::ErrorResult& rv);
-  void SwapFrameLoaders(XULFrameElement& aOtherLoaderOwner,
-                        mozilla::ErrorResult& rv);
-  void SwapFrameLoaders(nsFrameLoaderOwner* aOtherLoaderOwner,
-                        mozilla::ErrorResult& rv);
+  MOZ_CAN_RUN_SCRIPT void SwapFrameLoaders(
+      mozilla::dom::HTMLIFrameElement& aOtherLoaderOwner,
+      mozilla::ErrorResult& rv);
+  MOZ_CAN_RUN_SCRIPT void SwapFrameLoaders(XULFrameElement& aOtherLoaderOwner,
+                                           mozilla::ErrorResult& rv);
+  MOZ_CAN_RUN_SCRIPT void SwapFrameLoaders(
+      nsFrameLoaderOwner* aOtherLoaderOwner, mozilla::ErrorResult& rv);
 
   // nsIContent
   nsresult BindToTree(BindContext&, nsINode& aParent) override;

gfx/thebes/gfxSVGGlyphs.cpp

@@ -321,8 +321,8 @@ gfxSVGGlyphsDocument::gfxSVGGlyphsDocument(const uint8_t* aBuffer,
 }
 
 gfxSVGGlyphsDocument::~gfxSVGGlyphsDocument() {
-  if (mDocument) {
-    mDocument->OnPageHide(false, nullptr);
+  if (const RefPtr<Document> doc = std::move(mDocument)) {
+    doc->OnPageHide(false, nullptr);
   }
   if (mPresShell) {
     mPresShell->RemovePostRefreshObserver(this);

gfx/thebes/gfxSVGGlyphs.h

@@ -40,12 +40,13 @@ class gfxSVGGlyphsDocument final : public nsAPostRefreshObserver {
   typedef mozilla::dom::Element Element;
 
  public:
-  gfxSVGGlyphsDocument(const uint8_t* aBuffer, uint32_t aBufLen,
-                       gfxSVGGlyphs* aSVGGlyphs);
+  MOZ_CAN_RUN_SCRIPT gfxSVGGlyphsDocument(const uint8_t* aBuffer,
+                                          uint32_t aBufLen,
+                                          gfxSVGGlyphs* aSVGGlyphs);
 
   Element* GetGlyphElement(uint32_t aGlyphId);
 
-  ~gfxSVGGlyphsDocument();
+  MOZ_CAN_RUN_SCRIPT ~gfxSVGGlyphsDocument();
 
   void DidRefresh() override;
 
@@ -54,7 +55,7 @@ class gfxSVGGlyphsDocument final : public nsAPostRefreshObserver {
  private:
   nsresult ParseDocument(const uint8_t* aBuffer, uint32_t aBufLen);
 
-  nsresult SetupPresentation();
+  MOZ_CAN_RUN_SCRIPT nsresult SetupPresentation();
 
   void FindGlyphElements(Element* aElement);
 

image/SVGDocumentWrapper.cpp

@@ -54,7 +54,8 @@ SVGDocumentWrapper::~SVGDocumentWrapper() {
 void SVGDocumentWrapper::DestroyViewer() {
   MOZ_ASSERT(NS_IsMainThread());
   if (mViewer) {
-    mViewer->GetDocument()->OnPageHide(false, nullptr);
+    const RefPtr<Document> doc = mViewer->GetDocument();
+    doc->OnPageHide(false, nullptr);
     mViewer->Close();
     mViewer->Destroy();
     mViewer = nullptr;
@@ -217,7 +218,8 @@ SVGDocumentWrapper::OnDataAvailable(nsIRequest* aRequest, nsIInputStream* inStr,
 /** nsIRequestObserver methods **/
 
 NS_IMETHODIMP
-SVGDocumentWrapper::OnStartRequest(nsIRequest* aRequest) {
+SVGDocumentWrapper::OnStartRequest(nsIRequest* aRequest)
+    MOZ_CAN_RUN_SCRIPT_BOUNDARY {
   nsresult rv = SetupViewer(aRequest, getter_AddRefs(mViewer),
                             getter_AddRefs(mLoadGroup));
 
@@ -226,9 +228,10 @@ SVGDocumentWrapper::OnStartRequest(nsIRequest* aRequest) {
     mViewer->GetDocument()->SetIsBeingUsedAsImage();
     StopAnimation();  // otherwise animations start automatically in helper doc
 
-    rv = mViewer->Init(nullptr, LayoutDeviceIntRect(), nullptr);
+    const nsCOMPtr<nsIDocumentViewer> viewer = mViewer;
+    rv = viewer->Init(nullptr, LayoutDeviceIntRect(), nullptr);
     if (NS_SUCCEEDED(rv)) {
-      rv = mViewer->Open();
+      rv = viewer->Open();
     }
   }
   return rv;
@@ -247,7 +250,7 @@ SVGDocumentWrapper::OnStopRequest(nsIRequest* aRequest, nsresult status) {
 /** nsIObserver Methods **/
 NS_IMETHODIMP
 SVGDocumentWrapper::Observe(nsISupports* aSubject, const char* aTopic,
-                            const char16_t* aData) {
+                            const char16_t* aData) MOZ_CAN_RUN_SCRIPT_BOUNDARY {
   if (!strcmp(aTopic, NS_XPCOM_SHUTDOWN_OBSERVER_ID)) {
     // Sever ties from rendering observers to helper-doc's root SVG node
     SVGSVGElement* svgElem = GetSVGRootElement();

image/SVGDocumentWrapper.h

@@ -123,11 +123,11 @@ class SVGDocumentWrapper final : public nsIStreamListener,
  private:
   friend class AutoRestoreSVGState;
 
-  ~SVGDocumentWrapper();
+  MOZ_CAN_RUN_SCRIPT ~SVGDocumentWrapper();
 
   nsresult SetupViewer(nsIRequest* aRequest, nsIDocumentViewer** aViewer,
                        nsILoadGroup** aLoadGroup);
-  void DestroyViewer();
+  MOZ_CAN_RUN_SCRIPT void DestroyViewer();
   void RegisterForXPCOMShutdown();
   void UnregisterForXPCOMShutdown();
 

layout/base/PresShell.cpp

@@ -4589,21 +4589,23 @@ void PresShell::DoFlushPendingNotifications(mozilla::ChangesToFlush aFlush) {
     return;
   }
 
+  const RefPtr<Document> doc = mDocument;
+
   // We need to make sure external resource documents are flushed too (for
   // example, svg filters that reference a filter in an external document
   // need the frames in the external document to be constructed for the
   // filter to work). We only need external resources to be flushed when the
   // main document is flushing >= FlushType::Frames, so we flush external
   // resources here instead of Document::FlushPendingNotifications.
-  mDocument->FlushExternalResources(flushType);
+  doc->FlushExternalResources(flushType);
 
   // Force flushing of any pending content notifications that might have
   // queued up while our event was pending.  That will ensure that we don't
   // construct frames for content right now that's still waiting to be
   // notified on,
-  mDocument->FlushPendingNotifications(FlushType::ContentAndNotify);
+  doc->FlushPendingNotifications(FlushType::ContentAndNotify);
 
-  mDocument->UpdateSVGUseElementShadowTrees();
+  doc->UpdateSVGUseElementShadowTrees();
 
   // Process pending restyles, since any flush of the presshell wants
   // up-to-date style data.
@@ -4620,7 +4622,7 @@ void PresShell::DoFlushPendingNotifications(mozilla::ChangesToFlush aFlush) {
     // Flush any pending update of the user font set, since that could
     // cause style changes (for updating ex/ch units, and to cause a
     // reflow).
-    mDocument->FlushUserFontSet();
+    doc->FlushUserFontSet();
 
     mPresContext->FlushCounterStyles();
 
@@ -4629,8 +4631,8 @@ void PresShell::DoFlushPendingNotifications(mozilla::ChangesToFlush aFlush) {
     mPresContext->FlushFontPaletteValues();
 
     // Flush any requested SMIL samples.
-    if (mDocument->HasAnimationController()) {
-      mDocument->GetAnimationController()->FlushResampleRequests();
+    if (doc->HasAnimationController()) {
+      doc->GetAnimationController()->FlushResampleRequests();
     }
   }
 
@@ -4643,7 +4645,7 @@ void PresShell::DoFlushPendingNotifications(mozilla::ChangesToFlush aFlush) {
 
     nsAutoScriptBlocker scriptBlocker;
     Maybe<uint64_t> innerWindowID;
-    if (auto* window = mDocument->GetInnerWindow()) {
+    if (auto* window = doc->GetInnerWindow()) {
       innerWindowID = Some(window->WindowID());
     }
     AutoProfilerStyleMarker tracingStyleFlush(std::move(mStyleCause),

layout/base/nsDocumentViewer.cpp

@@ -323,11 +323,10 @@ class nsDocumentViewer final : public nsIDocumentViewer,
    * FIXME(emilio): aNeedMakeCX makes no sense, it only influences whether
    * aDoInitialReflow is true.
    */
-  nsresult InitInternal(nsIWidget* aParentWidget,
-                        mozilla::dom::WindowGlobalChild* aActor,
-                        const LayoutDeviceIntRect& aBounds, bool aDoCreation,
-                        bool aNeedMakeCX = true,
-                        bool aForceSetNewDocument = true);
+  MOZ_CAN_RUN_SCRIPT nsresult InitInternal(
+      nsIWidget* aParentWidget, mozilla::dom::WindowGlobalChild* aActor,
+      const LayoutDeviceIntRect& aBounds, bool aDoCreation,
+      bool aNeedMakeCX = true, bool aForceSetNewDocument = true);
   /**
    * @param aDoInitialReflow set to true if you want to kick off the initial
    * reflow
@@ -782,7 +781,8 @@ nsresult nsDocumentViewer::InitInternal(nsIWidget* aParentWidget,
     if (window) {
       nsCOMPtr<Document> curDoc = window->GetExtantDoc();
       if (aForceSetNewDocument || curDoc != mDocument) {
-        nsresult rv = window->SetNewDocument(mDocument, nullptr, false, aActor);
+        const RefPtr<Document> doc = mDocument.get();
+        nsresult rv = window->SetNewDocument(doc, nullptr, false, aActor);
         if (NS_FAILED(rv)) {
           Destroy();
           return rv;
@@ -834,7 +834,8 @@ nsDocumentViewer::LoadComplete(nsresult aStatus) {
   NS_ENSURE_TRUE(mDocument, NS_ERROR_NOT_AVAILABLE);
 
   // First, get the window from the document...
-  nsCOMPtr<nsPIDOMWindowOuter> window = mDocument->GetWindow();
+  RefPtr<nsGlobalWindowOuter> window =
+      nsGlobalWindowOuter::Cast(mDocument->GetWindow());
   RefPtr<nsDocShell> docShell = nsDocShell::Cast(window->GetDocShell());
 
   mLoaded = true;
@@ -950,13 +951,14 @@ nsDocumentViewer::LoadComplete(nsresult aStatus) {
   if (mDocument && mDocument->IsCurrentActiveDocument() &&
       aStatus != NS_BINDING_ABORTED) {
     // Re-get window, since it might have changed during above firing of onload
-    window = mDocument->GetWindow();
+    window = nsGlobalWindowOuter::Cast(mDocument->GetWindow());
     if (window) {
       docShell = nsDocShell::Cast(window->GetDocShell());
       bool isInUnload;
       if (docShell && NS_SUCCEEDED(docShell->GetIsInUnload(&isInUnload)) &&
           !isInUnload) {
-        mDocument->OnPageShow(restoring, nullptr);
+        const RefPtr<Document> doc = mDocument.get();
+        doc->OnPageShow(restoring, nullptr);
       }
     }
   }
@@ -1024,9 +1026,8 @@ nsDocumentViewer::LoadComplete(nsresult aStatus) {
 #ifdef NS_PRINTING
   // Check to see if someone tried to print during the load
   if (window) {
-    auto* outerWin = nsGlobalWindowOuter::Cast(window);
-    outerWin->StopDelayingPrintingUntilAfterLoad();
-    if (outerWin->DelayedPrintUntilAfterLoad()) {
+    window->StopDelayingPrintingUntilAfterLoad();
+    if (window->DelayedPrintUntilAfterLoad()) {
       // We call into the inner because it ensures there's an active document
       // and such, and it also waits until the whole thing completes, which is
       // nice because it allows us to close if needed right here.
@@ -1034,11 +1035,11 @@ nsDocumentViewer::LoadComplete(nsresult aStatus) {
               nsGlobalWindowInner::Cast(window->GetCurrentInnerWindow())) {
         inner->Print(IgnoreErrors());
       }
-      if (outerWin->DelayedCloseForPrinting()) {
-        outerWin->Close();
+      if (window->DelayedCloseForPrinting()) {
+        window->Close();
       }
     } else {
-      MOZ_ASSERT(!outerWin->DelayedCloseForPrinting());
+      MOZ_ASSERT(!window->DelayedCloseForPrinting());
     }
   }
 #endif
@@ -1260,7 +1261,7 @@ nsDocumentViewer::PageHide(bool aIsUnload) {
   // and decrement it again when it goes out of scope.
   IgnoreOpensDuringUnload ignoreOpens(mDocument);
 
-  mDocument->OnPageHide(!aIsUnload, nullptr);
+  MOZ_KnownLive(mDocument)->OnPageHide(!aIsUnload, nullptr);
 
   // inform the window so that the focus state is reset.
   NS_ENSURE_STATE(mDocument);
@@ -1316,7 +1317,10 @@ nsDocumentViewer::Open() {
     mDocument->SetContainer(mContainer);
   }
 
-  MOZ_TRY(InitInternal(mParentWidget, nullptr, mBounds, false));
+  {
+    const nsCOMPtr<nsIWidget> parentWidget = mParentWidget;
+    MOZ_TRY(InitInternal(parentWidget, nullptr, mBounds, false));
+  }
 
   mHidden = false;
 
@@ -1578,7 +1582,8 @@ nsDocumentViewer::SetDocumentInternal(Document* aDocument,
     DestroyPresContext();
 
     mWindow = nullptr;
-    MOZ_TRY(InitInternal(mParentWidget, nullptr, mBounds, true, true, false));
+    const nsCOMPtr<nsIWidget> parentWidget = mParentWidget;
+    MOZ_TRY(InitInternal(parentWidget, nullptr, mBounds, true, true, false));
   }
 
   return NS_OK;
@@ -2939,7 +2944,8 @@ NS_IMETHODIMP nsDocumentViewer::SetPageModeForTesting(
     mPresContext->SetPageScale(1.0f);
   }
 
-  MOZ_TRY(InitInternal(mParentWidget, nullptr, mBounds, true, false, false));
+  const nsCOMPtr<nsIWidget> parentWidget = mParentWidget;
+  MOZ_TRY(InitInternal(parentWidget, nullptr, mBounds, true, false, false));
 
   Show();
   return NS_OK;

layout/base/nsIDocumentViewerPrint.h

@@ -39,7 +39,7 @@ class nsIDocumentViewerPrint : public nsISupports {
   virtual void IncrementDestroyBlockedCount() = 0;
   virtual void DecrementDestroyBlockedCount() = 0;
 
-  virtual void OnDonePrinting() = 0;
+  MOZ_CAN_RUN_SCRIPT virtual void OnDonePrinting() = 0;
 
   /**
    * Replaces the current presentation with print preview presentation.
@@ -55,7 +55,7 @@ class nsIDocumentViewerPrint : public nsISupports {
   bool GetIsPrintPreview() const override;                      \
   void IncrementDestroyBlockedCount() override;                 \
   void DecrementDestroyBlockedCount() override;                 \
-  void OnDonePrinting() override;                               \
+  MOZ_CAN_RUN_SCRIPT void OnDonePrinting() override;            \
   void SetPrintPreviewPresentation(nsPresContext* aPresContext, \
                                    mozilla::PresShell* aPresShell) override;
 

layout/generic/nsVideoFrame.cpp

@@ -173,15 +173,16 @@ class DispatchControlsResizeEvent final : public Runnable {
  public:
   explicit DispatchControlsResizeEvent(nsIContent* aContent)
       : Runnable("DispatchControlsResizeEvent"), mContent(aContent) {}
-  NS_IMETHOD Run() override {
+  MOZ_CAN_RUN_SCRIPT_BOUNDARY NS_IMETHOD Run() override {
     // This is ok-ish because we're dispatching it in the shadow dom so it
     // doesn't propagate up to the <video>.
-    nsContentUtils::DispatchTrustedEvent(mContent->OwnerDoc(), mContent,
+    const RefPtr<Document> doc = mContent->OwnerDoc();
+    nsContentUtils::DispatchTrustedEvent(doc, mContent,
                                          u"resizevideocontrols"_ns,
                                          CanBubble::eNo, Cancelable::eNo);
     return NS_OK;
   }
-  nsCOMPtr<nsIContent> mContent;
+  MOZ_KNOWN_LIVE const nsCOMPtr<nsIContent> mContent;
 };
 
 bool nsVideoFrame::ReflowFinished() {

layout/printing/nsPrintJob.cpp

@@ -2020,7 +2020,7 @@ class nsPrintCompletionEvent : public Runnable {
     NS_ASSERTION(mDocViewerPrint, "mDocViewerPrint is null.");
   }
 
-  NS_IMETHOD Run() override {
+  MOZ_CAN_RUN_SCRIPT_BOUNDARY NS_IMETHOD Run() override {
     if (mDocViewerPrint) {
       mDocViewerPrint->OnDonePrinting();
     }
@@ -2028,7 +2028,7 @@ class nsPrintCompletionEvent : public Runnable {
   }
 
  private:
-  nsCOMPtr<nsIDocumentViewerPrint> mDocViewerPrint;
+  MOZ_KNOWN_LIVE const nsCOMPtr<nsIDocumentViewerPrint> mDocViewerPrint;
 };
 
 //-----------------------------------------------------------

layout/svg/SVGObserverUtils.cpp

@@ -353,7 +353,7 @@ class SVGIDRenderingObserver : public SVGRenderingObserver {
   // observer. Note that this may be called during construction, before the
   // deriving class is fully constructed.
   using TargetIsValidCallback = bool (*)(const Element&);
-  SVGIDRenderingObserver(
+  MOZ_CAN_RUN_SCRIPT_BOUNDARY SVGIDRenderingObserver(
       SVGReference* aReference, Element* aObservingElement,
       bool aReferenceImage,
       uint32_t aCallbacks = kAttributeChanged | kContentAppended |
@@ -461,14 +461,16 @@ SVGIDRenderingObserver::SVGIDRenderingObserver(
       mTargetIsValidCallback(aTargetIsValidCallback) {
   // Start watching the target element
   if (aReference) {
+    const nsCOMPtr<nsIURI> uri = aReference->GetURI();
+    const nsCOMPtr<nsIReferrerInfo> referrerInfo =
+        aReference->GetReferrerInfo();
     if (aReference->IsLocalRef()) {
       mObservedElementTracker.ResetToLocalFragmentID(
-          *aObservingElement, aReference->GetLocalRef(), aReference->GetURI(),
-          aReference->GetReferrerInfo(), aReferenceImage);
+          *aObservingElement, aReference->GetLocalRef(), uri, referrerInfo,
+          aReferenceImage);
     } else {
       mObservedElementTracker.ResetToURIWithFragmentID(
-          *aObservingElement, aReference->GetURI(),
-          aReference->GetReferrerInfo(), aReferenceImage);
+          *aObservingElement, uri, referrerInfo, aReferenceImage);
     }
   } else {
     mObservedElementTracker.Unlink();

layout/tools/layout-debug/src/nsLayoutDebuggingTools.cpp

@@ -96,7 +96,8 @@ nsLayoutDebuggingTools::SetReflowCounts(bool aShow) {
 }
 
 NS_IMETHODIMP
-nsLayoutDebuggingTools::SetPagedMode(bool aPagedMode) {
+nsLayoutDebuggingTools::SetPagedMode(bool aPagedMode)
+    MOZ_CAN_RUN_SCRIPT_BOUNDARY {
   nsCOMPtr<nsIPrintSettingsService> printSettingsService =
       do_GetService("@mozilla.org/gfx/printsettings-service;1");
   nsCOMPtr<nsIPrintSettings> printSettings;

parser/html/nsHtml5TreeOpExecutor.h

@@ -118,7 +118,8 @@ class nsHtml5TreeOpExecutor final
   /**
    * Emits EOF.
    */
-  NS_IMETHOD DidBuildModel(bool aTerminated) override;
+  MOZ_CAN_RUN_SCRIPT_BOUNDARY NS_IMETHOD
+  DidBuildModel(bool aTerminated) override;
 
   /**
    * Forwards to nsContentSink
@@ -219,7 +220,8 @@ class nsHtml5TreeOpExecutor final
   bool IsInFlushLoop() { return mRunFlushLoopOnStack; }
 #endif
 
-  void RunScript(nsIContent* aScriptElement, bool aMayDocumentWriteOrBlock);
+  MOZ_CAN_RUN_SCRIPT_BOUNDARY void RunScript(nsIContent* aScriptElement,
+                                             bool aMayDocumentWriteOrBlock);
 
   /**
    * Flush the operations from the tree operations from the argument