Merge inbound to mozilla-central. a=merge FIREFOX_NIGHTLY_67_END
authorOana Pop Rus <opoprus@mozilla.com>
Mon, 18 Mar 2019 11:53:46 +0200
changeset 464726 9421b477d67cfc4c9e03350cd554a9e6acc7f435
parent 464725 58a76dfcf9d8014cc383b0399db2d1f1a21bace7 (diff)
parent 464710 568561a463a712c04d212d0ffab89c8f4d029474 (current diff)
child 464727 e32c47d47ff98180edc749214ef62ea1d071f4de
child 464759 c712c4153146bb7e8c689d7162e9f22dd9b6deb3
push id112470
push useropoprus@mozilla.com
push dateMon, 18 Mar 2019 10:13:23 +0000
treeherdermozilla-inbound@9421b477d67c [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersmerge
milestone67.0a1
first release with
nightly linux32
9421b477d67c / 67.0a1 / 20190318095354 / files
nightly linux64
9421b477d67c / 67.0a1 / 20190318095354 / files
nightly mac
9421b477d67c / 67.0a1 / 20190318095354 / files
nightly win32
9421b477d67c / 67.0a1 / 20190318095354 / files
nightly win64
9421b477d67c / 67.0a1 / 20190318095354 / files
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
releases
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Merge inbound to mozilla-central. a=merge
js/src/jit-test/tests/ion/spreadcall-not-optimized-dynamic-2.js
js/src/jit-test/tests/ion/spreadcall-not-optimized-static-2.js
--- a/browser/components/about/components.conf
+++ b/browser/components/about/components.conf
@@ -16,17 +16,16 @@ pages = [
     'pocket-signup',
     'policies',
     'preferences',
     'privatebrowsing',
     'reader',
     'restartrequired',
     'rights',
     'robots',
-    'searchreset',
     'sessionrestore',
     'tabcrashed',
     'welcome',
     'welcomeback',
 ]
 
 if defined('NIGHTLY_BUILD'):
     pages.append('config')
--- a/docshell/test/moz.build
+++ b/docshell/test/moz.build
@@ -1,19 +1,19 @@
 with Files('**'):
     BUG_COMPONENT = ('Core', 'Document Navigation')
 
 with Files('browser/*_bug234628*'):
     BUG_COMPONENT = ('Core', 'Internationalization')
 
 with Files('browser/*_bug349769*'):
-    BUG_COMPONENT = ('Core', 'DOM')
+    BUG_COMPONENT = ('Core', 'DOM: Core & HTML')
 
 with Files('browser/*_bug388121*'):
-    BUG_COMPONENT = ('Core', 'DOM')
+    BUG_COMPONENT = ('Core', 'DOM: Core & HTML')
 
 with Files('browser/*_bug655270*'):
     BUG_COMPONENT = ('Toolkit', 'Places')
 
 with Files('browser/*_bug655273*'):
     BUG_COMPONENT = ('Firefox', 'Menus')
 
 with Files('browser/*_bug852909*'):
@@ -42,70 +42,70 @@ with Files('chrome/*303267*'):
 
 with Files('chrome/*453650*'):
     BUG_COMPONENT = ('Core', 'Layout')
 
 with Files('chrome/*565388*'):
     BUG_COMPONENT = ('Core', 'Widget')
 
 with Files('chrome/*582176*'):
-    BUG_COMPONENT = ('Core', 'DOM')
+    BUG_COMPONENT = ('Core', 'DOM: Core & HTML')
 
 with Files('chrome/*608669*'):
-    BUG_COMPONENT = ('Core', 'DOM')
+    BUG_COMPONENT = ('Core', 'DOM: Core & HTML')
 
 with Files('chrome/*690056*'):
-    BUG_COMPONENT = ('Core', 'DOM')
+    BUG_COMPONENT = ('Core', 'DOM: Core & HTML')
 
 with Files('chrome/*92598*'):
     BUG_COMPONENT = ('Core', 'Networking: HTTP')
 
 with Files('chrome/*private_hidden_window*'):
     BUG_COMPONENT = ('Firefox', 'Private Browsing')
 
 
 with Files('iframesandbox/**'):
     BUG_COMPONENT = ('Core', 'Security')
 
 with Files('iframesandbox/*marquee_event_handlers*'):
     BUG_COMPONENT = ('Core', 'DOM: Security')
 
 
 with Files('mochitest/*1045096*'):
-    BUG_COMPONENT = ('Core', 'DOM')
+    BUG_COMPONENT = ('Core', 'DOM: Core & HTML')
 
 with Files('mochitest/*1151421*'):
     BUG_COMPONENT = ('Core', 'DOM: Core & HTML')
 
 with Files('mochitest/*402210*'):
     BUG_COMPONENT = ('Core', 'DOM: Security')
 
 with Files('mochitest/*509055*'):
     BUG_COMPONENT = ('Core', 'History: Global')
 
 with Files('mochitest/*511449*'):
     BUG_COMPONENT = ('Core', 'Widget: Cocoa')
 
 with Files('mochitest/*551225*'):
-    BUG_COMPONENT = ('Core', 'DOM')
+    BUG_COMPONENT = ('Core', 'DOM: Core & HTML')
 
 with Files('mochitest/*570341*'):
-    BUG_COMPONENT = ('Core', 'DOM')
+    BUG_COMPONENT = ('Core', 'DOM: Core & HTML')
 
 with Files('mochitest/*580069*'):
-    BUG_COMPONENT = ('Core', 'DOM')
+    BUG_COMPONENT = ('Core', 'DOM: Core & HTML')
 
 with Files('mochitest/*637644*'):
     BUG_COMPONENT = ('Core', 'DOM: Core & HTML')
 
 with Files('mochitest/*640387*'):
     BUG_COMPONENT = ('Core', 'DOM: Events')
 
 with Files('mochitest/*668513*'):
-    BUG_COMPONENT = ('Core', 'DOM')
+    BUG_COMPONENT = ('Core', 'DOM: Core & HTML')
 
 with Files('mochitest/*797909*'):
     BUG_COMPONENT = ('Core', 'DOM: Core & HTML')
 
 with Files('mochitest/*forceinheritprincipal*'):
     BUG_COMPONENT = ('Core', 'DOM: Security')
 
 
@@ -114,17 +114,17 @@ with Files('navigation/*13871.html'):
 
 with Files('navigation/*386782*'):
     BUG_COMPONENT = ('Core', 'Editor')
 
 with Files('navigation/*430624*'):
     BUG_COMPONENT = ('Core', 'Editor')
 
 with Files('navigation/*430723*'):
-    BUG_COMPONENT = ('Core', 'Keyboard: Navigation')
+    BUG_COMPONENT = ('Core', 'User events and focus handling')
 
 with Files('navigation/*child*'):
     BUG_COMPONENT = ('Core', 'Security')
 
 with Files('navigation/*opener*'):
     BUG_COMPONENT = ('Core', 'Security')
 
 with Files('navigation/*reserved*'):
--- a/dom/abort/moz.build
+++ b/dom/abort/moz.build
@@ -1,16 +1,16 @@
 # -*- Mode: python; indent-tabs-mode: nil; tab-width: 40 -*-
 # vim: set filetype=python:
 # This Source Code Form is subject to the terms of the Mozilla Public
 # License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, You can obtain one at http://mozilla.org/MPL/2.0/.
 
 with Files("**"):
-    BUG_COMPONENT = ("Core", "DOM")
+    BUG_COMPONENT = ("Core", "DOM: Core & HTML")
 
 TEST_DIRS += ['tests']
 
 EXPORTS.mozilla.dom += [
     'AbortController.h',
     'AbortSignal.h',
 ]
 
--- a/dom/audiochannel/moz.build
+++ b/dom/audiochannel/moz.build
@@ -1,16 +1,16 @@
 # -*- Mode: python; indent-tabs-mode: nil; tab-width: 40 -*-
 # vim: set filetype=python:
 # This Source Code Form is subject to the terms of the Mozilla Public
 # License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, You can obtain one at http://mozilla.org/MPL/2.0/.
 
 with Files("**"):
-    BUG_COMPONENT = ("Core", "DOM")
+    BUG_COMPONENT = ("Core", "DOM: Core & HTML")
 
 XPIDL_SOURCES += [
     'nsIAudioChannelAgent.idl',
 ]
 
 XPIDL_MODULE = 'dom_audiochannel'
 
 EXPORTS += [
--- a/dom/base/Selection.cpp
+++ b/dom/base/Selection.cpp
@@ -2758,24 +2758,22 @@ void Selection::SelectAllChildren(nsINod
   if (!HasSameRoot(aNode)) {
     // Return with no error
     return;
   }
 
   if (mFrameSelection) {
     mFrameSelection->PostReason(nsISelectionListener::SELECTALL_REASON);
   }
-  SelectionBatcher batch(this);
-
-  Collapse(aNode, 0, aRv);
-  if (aRv.Failed()) {
-    return;
-  }
-
-  Extend(aNode, aNode.GetChildCount(), aRv);
+
+  // Chrome moves focus when aNode is outside of active editing host.
+  // So, we don't need to respect the limiter with this method.
+  SetStartAndEndInternal(InLimiter::eNo, RawRangeBoundary(&aNode, 0),
+                         RawRangeBoundary(&aNode, aNode.GetChildCount()),
+                         eDirNext, aRv);
 }
 
 bool Selection::ContainsNode(nsINode& aNode, bool aAllowPartial,
                              ErrorResult& aRv) {
   nsresult rv;
   if (mRanges.Length() == 0) {
     return false;
   }
@@ -3385,53 +3383,96 @@ void Selection::Modify(const nsAString& 
 void Selection::SetBaseAndExtentJS(nsINode& aAnchorNode, uint32_t aAnchorOffset,
                                    nsINode& aFocusNode, uint32_t aFocusOffset,
                                    ErrorResult& aRv) {
   AutoRestore<bool> calledFromJSRestorer(mCalledByJS);
   mCalledByJS = true;
   SetBaseAndExtent(aAnchorNode, aAnchorOffset, aFocusNode, aFocusOffset, aRv);
 }
 
-void Selection::SetBaseAndExtent(nsINode& aAnchorNode, uint32_t aAnchorOffset,
-                                 nsINode& aFocusNode, uint32_t aFocusOffset,
-                                 ErrorResult& aRv) {
+void Selection::SetBaseAndExtentInternal(InLimiter aInLimiter,
+                                         const RawRangeBoundary& aAnchorRef,
+                                         const RawRangeBoundary& aFocusRef,
+                                         ErrorResult& aRv) {
   if (!mFrameSelection) {
     return;
   }
 
-  if (!HasSameRoot(aAnchorNode) || !HasSameRoot(aFocusNode)) {
+  if (NS_WARN_IF(!aAnchorRef.IsSet()) || NS_WARN_IF(!aFocusRef.IsSet())) {
+    aRv.Throw(NS_ERROR_INVALID_ARG);
+    return;
+  }
+
+  if (!HasSameRoot(*aAnchorRef.Container()) ||
+      !HasSameRoot(*aFocusRef.Container())) {
     // Return with no error
     return;
   }
 
+  // Prevent "selectionchange" event temporarily because it should be fired
+  // after we set the direction.
+  // XXX If they are disconnected, shouldn't we return error before allocating
+  //     new nsRange instance?
   SelectionBatcher batch(this);
-
-  int32_t relativePosition = nsContentUtils::ComparePoints(
-      &aAnchorNode, aAnchorOffset, &aFocusNode, aFocusOffset);
-  nsINode* start = &aAnchorNode;
-  nsINode* end = &aFocusNode;
-  uint32_t startOffset = aAnchorOffset;
-  uint32_t endOffset = aFocusOffset;
-  if (relativePosition > 0) {
-    start = &aFocusNode;
-    end = &aAnchorNode;
-    startOffset = aFocusOffset;
-    endOffset = aAnchorOffset;
+  if (nsContentUtils::ComparePoints(aAnchorRef, aFocusRef) <= 0) {
+    SetStartAndEndInternal(aInLimiter, aAnchorRef, aFocusRef, eDirNext, aRv);
+    return;
+  }
+
+  SetStartAndEndInternal(aInLimiter, aFocusRef, aAnchorRef, eDirPrevious, aRv);
+}
+
+void Selection::SetStartAndEndInternal(InLimiter aInLimiter,
+                                       const RawRangeBoundary& aStartRef,
+                                       const RawRangeBoundary& aEndRef,
+                                       nsDirection aDirection,
+                                       ErrorResult& aRv) {
+  if (NS_WARN_IF(!aStartRef.IsSet()) || NS_WARN_IF(!aEndRef.IsSet())) {
+    aRv.Throw(NS_ERROR_INVALID_ARG);
+    return;
+  }
+
+  // Don't fire "selectionchange" event until everything done.
+  SelectionBatcher batch(this);
+
+  if (aInLimiter == InLimiter::eYes) {
+    if (!IsValidSelectionPoint(mFrameSelection, aStartRef.Container())) {
+      aRv.Throw(NS_ERROR_FAILURE);
+      return;
+    }
+    if (aStartRef.Container() != aEndRef.Container() &&
+        !IsValidSelectionPoint(mFrameSelection, aEndRef.Container())) {
+      aRv.Throw(NS_ERROR_FAILURE);
+      return;
+    }
+  }
+
+  // If we're not called by JS, we can remove all ranges first.  Then, we
+  // may be able to reuse one of current ranges for reducing the cost of
+  // nsRange allocation.  Note that if this is called by
+  // SetBaseAndExtentJS(), when we fail to initialize new range, we
+  // shouldn't remove current ranges.  Therefore, we need to check whether
+  // we're called by JS or internally.
+  if (!mCalledByJS && !mCachedRange) {
+    nsresult rv = RemoveAllRangesTemporarily();
+    if (NS_WARN_IF(NS_FAILED(rv))) {
+      aRv.Throw(rv);
+      return;
+    }
   }
 
   // If there is cached range, we should reuse it for saving the allocation
-  // const (and some other cost in nsRange::DoSetRange().
+  // const (and some other cost in nsRange::DoSetRange()).
   RefPtr<nsRange> newRange = std::move(mCachedRange);
 
   nsresult rv = NS_OK;
   if (newRange) {
-    rv = newRange->SetStartAndEnd(start, startOffset, end, endOffset);
+    rv = newRange->SetStartAndEnd(aStartRef, aEndRef);
   } else {
-    rv = nsRange::CreateRange(start, startOffset, end, endOffset,
-                              getter_AddRefs(newRange));
+    rv = nsRange::CreateRange(aStartRef, aEndRef, getter_AddRefs(newRange));
   }
 
   // nsRange::SetStartAndEnd() and nsRange::CreateRange() returns
   // IndexSizeError if any offset is out of bounds.
   if (NS_FAILED(rv)) {
     aRv.Throw(rv);
     return;
   }
@@ -3441,17 +3482,17 @@ void Selection::SetBaseAndExtent(nsINode
     return;
   }
 
   AddRange(*newRange, aRv);
   if (aRv.Failed()) {
     return;
   }
 
-  SetDirection(relativePosition > 0 ? eDirPrevious : eDirNext);
+  SetDirection(aDirection);
 }
 
 /** SelectionLanguageChange modifies the cursor Bidi level after a change in
  * keyboard direction
  *  @param aLangRTL is true if the new language is right-to-left or false if the
  * new language is left-to-right
  */
 nsresult Selection::SelectionLanguageChange(bool aLangRTL) {
--- a/dom/base/Selection.h
+++ b/dom/base/Selection.h
@@ -344,16 +344,17 @@ class Selection final : public nsSupport
    * @throws NS_ERROR_NOT_IMPLEMENTED if the granularity is "sentence",
    * "sentenceboundary", "paragraph", "paragraphboundary", or
    * "documentboundary".  Throws NS_ERROR_INVALID_ARG if alter, direction,
    * or granularity has an unrecognized value.
    */
   void Modify(const nsAString& aAlter, const nsAString& aDirection,
               const nsAString& aGranularity, mozilla::ErrorResult& aRv);
 
+  MOZ_CAN_RUN_SCRIPT
   void SetBaseAndExtentJS(nsINode& aAnchorNode, uint32_t aAnchorOffset,
                           nsINode& aFocusNode, uint32_t aFocusOffset,
                           mozilla::ErrorResult& aRv);
 
   bool GetInterlinePosition(mozilla::ErrorResult& aRv);
   void SetInterlinePosition(bool aValue, mozilla::ErrorResult& aRv);
 
   Nullable<int16_t> GetCaretBidiLevel(mozilla::ErrorResult& aRv) const;
@@ -439,19 +440,94 @@ class Selection final : public nsSupport
 
   /**
    * Adds all children of the specified node to the selection.
    * @param aNode the parent of the children to be added to the selection.
    */
   MOZ_CAN_RUN_SCRIPT_BOUNDARY
   void SelectAllChildren(nsINode& aNode, mozilla::ErrorResult& aRv);
 
+  /**
+   * SetStartAndEnd() removes all ranges and sets new range as given range.
+   * Different from SetBaseAndExtent(), this won't compare the DOM points of
+   * aStartRef and aEndRef for performance nor set direction to eDirPrevious.
+   * Note that this may reset the limiter and move focus.  If you don't want
+   * that, use SetStartAndEndInLimiter() instead.
+   */
+  MOZ_CAN_RUN_SCRIPT
+  void SetStartAndEnd(const RawRangeBoundary& aStartRef,
+                      const RawRangeBoundary& aEndRef, ErrorResult& aRv) {
+    SetStartAndEndInternal(InLimiter::eNo, aStartRef, aEndRef, eDirNext, aRv);
+  }
+  MOZ_CAN_RUN_SCRIPT
+  void SetStartAndEnd(nsINode& aStartContainer, uint32_t aStartOffset,
+                      nsINode& aEndContainer, uint32_t aEndOffset,
+                      ErrorResult& aRv) {
+    SetStartAndEnd(RawRangeBoundary(&aStartContainer, aStartOffset),
+                   RawRangeBoundary(&aEndContainer, aEndOffset), aRv);
+  }
+
+  /**
+   * SetStartAndEndInLimiter() is similar to SetStartAndEnd(), but this respects
+   * the selection limiter.  If all or part of given range is not in the
+   * limiter, this returns error.
+   */
+  MOZ_CAN_RUN_SCRIPT
+  void SetStartAndEndInLimiter(const RawRangeBoundary& aStartRef,
+                               const RawRangeBoundary& aEndRef,
+                               ErrorResult& aRv) {
+    SetStartAndEndInternal(InLimiter::eYes, aStartRef, aEndRef, eDirNext, aRv);
+  }
+  MOZ_CAN_RUN_SCRIPT
+  void SetStartAndEndInLimiter(nsINode& aStartContainer, uint32_t aStartOffset,
+                               nsINode& aEndContainer, uint32_t aEndOffset,
+                               ErrorResult& aRv) {
+    SetStartAndEndInLimiter(RawRangeBoundary(&aStartContainer, aStartOffset),
+                            RawRangeBoundary(&aEndContainer, aEndOffset), aRv);
+  }
+
+  /**
+   * SetBaseAndExtent() is alternative of the JS API for internal use.
+   * Different from SetStartAndEnd(), this sets anchor and focus points as
+   * specified, then if anchor point is after focus node, this sets the
+   * direction to eDirPrevious.
+   * Note that this may reset the limiter and move focus.  If you don't want
+   * that, use SetBaseAndExtentInLimier() instead.
+   */
+  MOZ_CAN_RUN_SCRIPT
   void SetBaseAndExtent(nsINode& aAnchorNode, uint32_t aAnchorOffset,
                         nsINode& aFocusNode, uint32_t aFocusOffset,
-                        mozilla::ErrorResult& aRv);
+                        ErrorResult& aRv) {
+    SetBaseAndExtent(RawRangeBoundary(&aAnchorNode, aAnchorOffset),
+                     RawRangeBoundary(&aFocusNode, aFocusOffset), aRv);
+  }
+  MOZ_CAN_RUN_SCRIPT
+  void SetBaseAndExtent(const RawRangeBoundary& aAnchorRef,
+                        const RawRangeBoundary& aFocusRef, ErrorResult& aRv) {
+    SetBaseAndExtentInternal(InLimiter::eNo, aAnchorRef, aFocusRef, aRv);
+  }
+
+  /**
+   * SetBaseAndExtentInLimier() is similar to SetBaseAndExtent(), but this
+   * respects the selection limiter.  If all or part of given range is not in
+   * the limiter, this returns error.
+   */
+  MOZ_CAN_RUN_SCRIPT
+  void SetBaseAndExtentInLimiter(nsINode& aAnchorNode, uint32_t aAnchorOffset,
+                                 nsINode& aFocusNode, uint32_t aFocusOffset,
+                                 ErrorResult& aRv) {
+    SetBaseAndExtentInLimiter(RawRangeBoundary(&aAnchorNode, aAnchorOffset),
+                              RawRangeBoundary(&aFocusNode, aFocusOffset), aRv);
+  }
+  MOZ_CAN_RUN_SCRIPT
+  void SetBaseAndExtentInLimiter(const RawRangeBoundary& aAnchorRef,
+                                 const RawRangeBoundary& aFocusRef,
+                                 ErrorResult& aRv) {
+    SetBaseAndExtentInternal(InLimiter::eYes, aAnchorRef, aFocusRef, aRv);
+  }
 
   void AddSelectionChangeBlocker();
   void RemoveSelectionChangeBlocker();
   bool IsBlockingSelectionChangeEvents() const;
 
   // Whether this selection is focused in an editable element.
   bool IsEditorSelection() const;
 
@@ -531,16 +607,35 @@ class Selection final : public nsSupport
                                                nsIFrame** aReturnFrame,
                                                int32_t* aOffsetUsed,
                                                bool aVisual) const;
 
   // Get the cached value for nsTextFrame::GetPointFromOffset.
   nsresult GetCachedFrameOffset(nsIFrame* aFrame, int32_t inOffset,
                                 nsPoint& aPoint);
 
+  enum class InLimiter {
+    // If eYes, the method may reset selection limiter and move focus if the
+    // given range is out of the limiter.
+    eYes,
+    // If eNo, the method won't reset selection limiter.  So, if given range
+    // is out of bounds, the method may return error.
+    eNo,
+  };
+  MOZ_CAN_RUN_SCRIPT
+  void SetStartAndEndInternal(InLimiter aInLimiter,
+                              const RawRangeBoundary& aStartRef,
+                              const RawRangeBoundary& aEndRef,
+                              nsDirection aDirection, ErrorResult& aRv);
+  MOZ_CAN_RUN_SCRIPT
+  void SetBaseAndExtentInternal(InLimiter aInLimiter,
+                                const RawRangeBoundary& aAnchorRef,
+                                const RawRangeBoundary& aFocusRef,
+                                ErrorResult& aRv);
+
  public:
   SelectionType GetType() const { return mSelectionType; }
   void SetType(SelectionType aSelectionType) {
     mSelectionType = aSelectionType;
   }
 
   SelectionCustomColors* GetCustomColors() const { return mCustomColors.get(); }
 
--- a/dom/base/moz.build
+++ b/dom/base/moz.build
@@ -3,17 +3,17 @@
 # This Source Code Form is subject to the terms of the Mozilla Public
 # License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, You can obtain one at http://mozilla.org/MPL/2.0/.
 
 with Files('*Selection*'):
     BUG_COMPONENT = ('Core', 'Selection')
 
 with Files("**"):
-    BUG_COMPONENT = ("Core", "DOM")
+    BUG_COMPONENT = ("Core", "DOM: Core & HTML")
 
 TEST_DIRS += ['test']
 
 XPIDL_SOURCES += [
     'mozIDOMWindow.idl',
     'nsIContentPolicy.idl',
     'nsIDocumentEncoder.idl',
     'nsIDOMRequestService.idl',
--- a/dom/bindings/moz.build
+++ b/dom/bindings/moz.build
@@ -1,16 +1,16 @@
 # -*- Mode: python; indent-tabs-mode: nil; tab-width: 40 -*-
 # vim: set filetype=python:
 # This Source Code Form is subject to the terms of the Mozilla Public
 # License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, You can obtain one at http://mozilla.org/MPL/2.0/.
 
 with Files("**"):
-    BUG_COMPONENT = ("Core", "DOM")
+    BUG_COMPONENT = ("Core", "DOM: Core & HTML")
 
 TEST_DIRS += ['test']
 
 XPIDL_SOURCES += [
     'nsIScriptError.idl'
 ]
 
 XPIDL_MODULE = 'dom_bindings'
--- a/dom/broadcastchannel/moz.build
+++ b/dom/broadcastchannel/moz.build
@@ -1,16 +1,16 @@
 # -*- Mode: python; indent-tabs-mode: nil; tab-width: 40 -*-
 # vim: set filetype=python:
 # This Source Code Form is subject to the terms of the Mozilla Public
 # License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, You can obtain one at http://mozilla.org/MPL/2.0/.
 
 with Files("**"):
-    BUG_COMPONENT = ("Core", "DOM")
+    BUG_COMPONENT = ("Core", "DOM: Core & HTML")
 
 EXPORTS.mozilla.dom += [
     'BroadcastChannel.h',
 ]
 
 UNIFIED_SOURCES += [
     'BroadcastChannel.cpp',
     'BroadcastChannelChild.cpp',
--- a/dom/browser-element/moz.build
+++ b/dom/browser-element/moz.build
@@ -1,16 +1,16 @@
 # -*- Mode: python; indent-tabs-mode: nil; tab-width: 40 -*-
 # vim: set filetype=python:
 # This Source Code Form is subject to the terms of the Mozilla Public
 # License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, You can obtain one at http://mozilla.org/MPL/2.0/.
 
 with Files("**"):
-    BUG_COMPONENT = ("Core", "DOM")
+    BUG_COMPONENT = ("Core", "DOM: Core & HTML")
 
 EXPORTS.mozilla += [
     'BrowserElementParent.h',
 ]
 
 SOURCES += [
     'BrowserElementParent.cpp',
 ]
--- a/dom/cache/moz.build
+++ b/dom/cache/moz.build
@@ -1,17 +1,17 @@
 # -*- Mode: python; indent-tabs-mode: nil; tab-width: 40 -*-
 # vim: set filetype=python:
 # This Source Code Form is subject to the terms of the Mozilla Public
 # License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, You can obtain one at http://mozilla.org/MPL/2.0/.
 
 
 with Files("**"):
-    BUG_COMPONENT = ("Core", "DOM")
+    BUG_COMPONENT = ("Core", "DOM: Core & HTML")
 
 EXPORTS.mozilla.dom.cache += [
     'Action.h',
     'ActorChild.h',
     'ActorUtils.h',
     'AutoUtils.h',
     'Cache.h',
     'CacheChild.h',
--- a/dom/chrome-webidl/moz.build
+++ b/dom/chrome-webidl/moz.build
@@ -1,16 +1,16 @@
 # -*- Mode: python; indent-tabs-mode: nil; tab-width: 40 -*-
 # vim: set filetype=python:
 # This Source Code Form is subject to the terms of the Mozilla Public
 # License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, You can obtain one at http://mozilla.org/MPL/2.0/.
 
 with Files("**"):
-    BUG_COMPONENT = ("Core", "DOM")
+    BUG_COMPONENT = ("Core", "DOM: Core & HTML")
 
 with Files("ChannelWrapper.webidl"):
     BUG_COMPONENT = ("WebExtensions", "Request Handling")
 
 with Files("Flex.webidl"):
     BUG_COMPONENT = ("Core", "CSS Parsing and Computation")
 
 with Files("HeapSnapshot.webidl"):
--- a/dom/console/moz.build
+++ b/dom/console/moz.build
@@ -1,16 +1,16 @@
 # -*- Mode: python; indent-tabs-mode: nil; tab-width: 40 -*-
 # vim: set filetype=python:
 # This Source Code Form is subject to the terms of the Mozilla Public
 # License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, You can obtain one at http://mozilla.org/MPL/2.0/.
 
 with Files("**"):
-    BUG_COMPONENT = ("Core", "DOM")
+    BUG_COMPONENT = ("Core", "DOM: Core & HTML")
 
 XPIDL_SOURCES += [
     'nsIConsoleAPIStorage.idl',
 ]
 
 XPIDL_MODULE = 'dom'
 
 EXPORTS += [
--- a/dom/events/ContentEventHandler.cpp
+++ b/dom/events/ContentEventHandler.cpp
@@ -2976,42 +2976,38 @@ nsresult ContentEventHandler::OnSelectio
   int32_t endNodeOffset = rawRange.EndOffset();
   AdjustRangeForSelection(mRootContent, &startNode, &startNodeOffset);
   AdjustRangeForSelection(mRootContent, &endNode, &endNodeOffset);
   if (NS_WARN_IF(!startNode) || NS_WARN_IF(!endNode) ||
       NS_WARN_IF(startNodeOffset < 0) || NS_WARN_IF(endNodeOffset < 0)) {
     return NS_ERROR_UNEXPECTED;
   }
 
-  mSelection->StartBatchChanges();
-
-  // Clear selection first before setting
-  rv = mSelection->RemoveAllRangesTemporarily();
-  // Need to call EndBatchChanges at the end even if call failed
-  if (NS_SUCCEEDED(rv)) {
-    if (aEvent->mReversed) {
-      rv = mSelection->Collapse(endNode, endNodeOffset);
-    } else {
-      rv = mSelection->Collapse(startNode, startNodeOffset);
+  if (aEvent->mReversed) {
+    nsCOMPtr<nsINode> startNodeStrong(startNode);
+    nsCOMPtr<nsINode> endNodeStrong(endNode);
+    ErrorResult error;
+    MOZ_KnownLive(mSelection)
+        ->SetBaseAndExtentInLimiter(*endNodeStrong, endNodeOffset,
+                                    *startNodeStrong, startNodeOffset, error);
+    if (NS_WARN_IF(error.Failed())) {
+      return error.StealNSResult();
     }
-    if (NS_SUCCEEDED(rv) &&
-        (startNode != endNode || startNodeOffset != endNodeOffset)) {
-      if (aEvent->mReversed) {
-        rv = mSelection->Extend(startNode, startNodeOffset);
-      } else {
-        rv = mSelection->Extend(endNode, endNodeOffset);
-      }
+  } else {
+    nsCOMPtr<nsINode> startNodeStrong(startNode);
+    nsCOMPtr<nsINode> endNodeStrong(endNode);
+    ErrorResult error;
+    MOZ_KnownLive(mSelection)
+        ->SetBaseAndExtentInLimiter(*startNodeStrong, startNodeOffset,
+                                    *endNodeStrong, endNodeOffset, error);
+    if (NS_WARN_IF(error.Failed())) {
+      return error.StealNSResult();
     }
   }
 
-  // Pass the eSetSelection events reason along with the BatchChange-end
-  // selection change notifications.
-  mSelection->EndBatchChanges(aEvent->mReason);
-  NS_ENSURE_SUCCESS(rv, rv);
-
   mSelection->ScrollIntoView(nsISelectionController::SELECTION_FOCUS_REGION,
                              nsIPresShell::ScrollAxis(),
                              nsIPresShell::ScrollAxis(), 0);
   aEvent->mSucceeded = true;
   return NS_OK;
 }
 
 nsRect ContentEventHandler::FrameRelativeRect::RectRelativeTo(
--- a/dom/events/ContentEventHandler.h
+++ b/dom/events/ContentEventHandler.h
@@ -118,16 +118,17 @@ class MOZ_STACK_CLASS ContentEventHandle
   // eQuerySelectionAsTransferable event handler
   nsresult OnQuerySelectionAsTransferable(WidgetQueryContentEvent* aEvent);
   // eQueryCharacterAtPoint event handler
   nsresult OnQueryCharacterAtPoint(WidgetQueryContentEvent* aEvent);
   // eQueryDOMWidgetHittest event handler
   nsresult OnQueryDOMWidgetHittest(WidgetQueryContentEvent* aEvent);
 
   // NS_SELECTION_* event
+  MOZ_CAN_RUN_SCRIPT
   nsresult OnSelectionEvent(WidgetSelectionEvent* aEvent);
 
  protected:
   RefPtr<dom::Document> mDocument;
   // mSelection is typically normal selection but if OnQuerySelectedText()
   // is called, i.e., handling eQuerySelectedText, it's the specified selection
   // by WidgetQueryContentEvent::mInput::mSelectionType.
   RefPtr<Selection> mSelection;
--- a/dom/events/EventStateManager.cpp
+++ b/dom/events/EventStateManager.cpp
@@ -745,20 +745,22 @@ nsresult EventStateManager::PreHandleEve
 
       // Init lineOrPageDelta values for line scroll events for some devices
       // on some platforms which might dispatch wheel events which don't have
       // lineOrPageDelta values.  And also, if delta values are customized by
       // prefs, this recomputes them.
       DeltaAccumulator::GetInstance()->InitLineOrPageDelta(aTargetFrame, this,
                                                            wheelEvent);
     } break;
-    case eSetSelection:
-      IMEStateManager::HandleSelectionEvent(aPresContext, GetFocusedContent(),
+    case eSetSelection: {
+      nsCOMPtr<nsIContent> focusedContent = GetFocusedContent();
+      IMEStateManager::HandleSelectionEvent(aPresContext, focusedContent,
                                             aEvent->AsSelectionEvent());
       break;
+    }
     case eContentCommandCut:
     case eContentCommandCopy:
     case eContentCommandPaste:
     case eContentCommandDelete:
     case eContentCommandUndo:
     case eContentCommandRedo:
     case eContentCommandPasteTransferable:
     case eContentCommandLookUpDictionary:
--- a/dom/events/IMEStateManager.h
+++ b/dom/events/IMEStateManager.h
@@ -200,16 +200,17 @@ class IMEStateManager {
       WidgetCompositionEvent* aCompositionEvent, nsEventStatus* aStatus,
       EventDispatchingCallback* aCallBack, bool aIsSynthesized = false);
 
   /**
    * All selection events must be handled via HandleSelectionEvent()
    * because they must be handled by same target as composition events when
    * there is a composition.
    */
+  MOZ_CAN_RUN_SCRIPT
   static void HandleSelectionEvent(nsPresContext* aPresContext,
                                    nsIContent* aEventTargetContent,
                                    WidgetSelectionEvent* aSelectionEvent);
 
   /**
    * This is called when PresShell ignores a composition event due to not safe
    * to dispatch events.
    */
--- a/dom/events/TextComposition.h
+++ b/dom/events/TextComposition.h
@@ -451,19 +451,23 @@ class TextComposition final {
                      nsEventStatus* aStatus,
                      EventDispatchingCallback* aCallback,
                      const WidgetCompositionEvent* aOriginalEvent = nullptr);
 
   /**
    * HandleSelectionEvent() sends the selection event to ContentEventHandler
    * or dispatches it to the focused child process.
    */
+  MOZ_CAN_RUN_SCRIPT
   void HandleSelectionEvent(WidgetSelectionEvent* aSelectionEvent) {
-    HandleSelectionEvent(mPresContext, mTabParent, aSelectionEvent);
+    RefPtr<nsPresContext> presContext(mPresContext);
+    RefPtr<TabParent> tabParent(mTabParent);
+    HandleSelectionEvent(presContext, tabParent, aSelectionEvent);
   }
+  MOZ_CAN_RUN_SCRIPT
   static void HandleSelectionEvent(nsPresContext* aPresContext,
                                    TabParent* aTabParent,
                                    WidgetSelectionEvent* aSelectionEvent);
 
   /**
    * MaybeDispatchCompositionUpdate() may dispatch a compositionupdate event
    * if aCompositionEvent changes composition string.
    * @return Returns false if dispatching the compositionupdate event caused
--- a/dom/fetch/moz.build
+++ b/dom/fetch/moz.build
@@ -1,16 +1,16 @@
 # -*- Mode: python; indent-tabs-mode: nil; tab-width: 40 -*-
 # vim: set filetype=python:
 # This Source Code Form is subject to the terms of the Mozilla Public
 # License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, You can obtain one at http://mozilla.org/MPL/2.0/.
 
 with Files("**"):
-    BUG_COMPONENT = ("Core", "DOM")
+    BUG_COMPONENT = ("Core", "DOM: Core & HTML")
 
 EXPORTS.mozilla.dom += [
     'BodyExtractor.h',
     'ChannelInfo.h',
     'Fetch.h',
     'FetchDriver.h',
     'FetchIPCTypes.h',
     'FetchObserver.h',
--- a/dom/filehandle/moz.build
+++ b/dom/filehandle/moz.build
@@ -1,16 +1,16 @@
 # -*- Mode: python; indent-tabs-mode: nil; tab-width: 40 -*-
 # vim: set filetype=python:
 # This Source Code Form is subject to the terms of the Mozilla Public
 # License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, You can obtain one at http://mozilla.org/MPL/2.0/.
 
 with Files("**"):
-    BUG_COMPONENT = ("Core", "DOM")
+    BUG_COMPONENT = ("Core", "DOM: Core & HTML")
 
 EXPORTS.mozilla.dom.filehandle += [
     'ActorsParent.h',
     'SerializationHelpers.h',
 ]
 
 EXPORTS.mozilla.dom += [
     'FileHandleStorage.h',
--- a/dom/html/moz.build
+++ b/dom/html/moz.build
@@ -1,16 +1,16 @@
 # -*- Mode: python; indent-tabs-mode: nil; tab-width: 40 -*-
 # vim: set filetype=python:
 # This Source Code Form is subject to the terms of the Mozilla Public
 # License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, You can obtain one at http://mozilla.org/MPL/2.0/.
 
 with Files("**"):
-    BUG_COMPONENT = ("Core", "DOM")
+    BUG_COMPONENT = ("Core", "DOM: Core & HTML")
 
 DIRS += ['input']
 
 MOCHITEST_MANIFESTS += [
     'test/forms/mochitest.ini',
     'test/mochitest.ini',
 ]
 
--- a/dom/html/nsTextEditorState.cpp
+++ b/dom/html/nsTextEditorState.cpp
@@ -2296,17 +2296,19 @@ bool nsTextEditorState::SetValue(const n
 
           if (aFlags & eSetValue_BySetUserInput) {
             // If the caller inserts text as part of user input, for example,
             // autocomplete, we need to replace the text as "insert string"
             // because undo should cancel only this operation (i.e., previous
             // transactions typed by user shouldn't be merged with this).
             // In this case, we need to dispatch "input" event because
             // web apps may need to know the user's operation.
-            DebugOnly<nsresult> rv = textEditor->ReplaceTextAsAction(newValue);
+            RefPtr<nsRange> range;  // See bug 1506439
+            DebugOnly<nsresult> rv =
+                textEditor->ReplaceTextAsAction(newValue, range);
             NS_WARNING_ASSERTION(NS_SUCCEEDED(rv),
                                  "Failed to set the new value");
           } else if (aFlags & eSetValue_ForXUL) {
             // When setting value of XUL <textbox>, we shouldn't dispatch
             // "input" event.
             suppressInputEventDispatching.Init();
 
             // On XUL <textbox> element, we need to preserve existing undo
--- a/dom/imptests/moz.build
+++ b/dom/imptests/moz.build
@@ -1,16 +1,16 @@
 # -*- Mode: python; indent-tabs-mode: nil; tab-width: 40 -*-
 # vim: set filetype=python:
 # This Source Code Form is subject to the terms of the Mozilla Public
 # License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, You can obtain one at http://mozilla.org/MPL/2.0/.
 
 with Files("**"):
-    BUG_COMPONENT = ("Core", "DOM")
+    BUG_COMPONENT = ("Core", "DOM: Core & HTML")
 
 with Files("html/webgl/**"):
     BUG_COMPONENT = ("Core", "Canvas: 2D")
 
 with Files("html/typedarrays/**"):
     BUG_COMPONENT = ("Core", "JavaScript: Standard Library")
 
 with Files("html/js/**"):
--- a/dom/interfaces/base/moz.build
+++ b/dom/interfaces/base/moz.build
@@ -1,16 +1,16 @@
 # -*- Mode: python; indent-tabs-mode: nil; tab-width: 40 -*-
 # vim: set filetype=python:
 # This Source Code Form is subject to the terms of the Mozilla Public
 # License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, You can obtain one at http://mozilla.org/MPL/2.0/.
 
 with Files("**"):
-    BUG_COMPONENT = ("Core", "DOM")
+    BUG_COMPONENT = ("Core", "DOM: Core & HTML")
 
 XPIDL_SOURCES += [
     'domstubs.idl',
     'nsIBrowser.idl',
     'nsIBrowserDOMWindow.idl',
     'nsIContentPermissionPrompt.idl',
     'nsIContentPrefService2.idl',
     'nsIContentProcess.idl',
--- a/dom/interfaces/html/moz.build
+++ b/dom/interfaces/html/moz.build
@@ -1,16 +1,16 @@
 # -*- Mode: python; indent-tabs-mode: nil; tab-width: 40 -*-
 # vim: set filetype=python:
 # This Source Code Form is subject to the terms of the Mozilla Public
 # License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, You can obtain one at http://mozilla.org/MPL/2.0/.
 
 with Files("**"):
-    BUG_COMPONENT = ("Core", "DOM")
+    BUG_COMPONENT = ("Core", "DOM: Core & HTML")
 
 XPIDL_SOURCES += [
     'nsIDOMMozBrowserFrame.idl',
     'nsIMozBrowserFrame.idl',
 ]
 
 XPIDL_MODULE = 'dom_html'
 
--- a/dom/interfaces/notification/moz.build
+++ b/dom/interfaces/notification/moz.build
@@ -1,15 +1,15 @@
 # -*- Mode: python; indent-tabs-mode: nil; tab-width: 40 -*-
 # vim: set filetype=python:
 # This Source Code Form is subject to the terms of the Mozilla Public
 # License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, You can obtain one at http://mozilla.org/MPL/2.0/.
 
 with Files("**"):
-    BUG_COMPONENT = ("Core", "DOM")
+    BUG_COMPONENT = ("Core", "DOM: Core & HTML")
 
 XPIDL_SOURCES += [
     'nsINotificationStorage.idl',
 ]
 
 XPIDL_MODULE = 'dom_notification'
 
--- a/dom/interfaces/sidebar/moz.build
+++ b/dom/interfaces/sidebar/moz.build
@@ -1,15 +1,15 @@
 # -*- Mode: python; indent-tabs-mode: nil; tab-width: 40 -*-
 # vim: set filetype=python:
 # This Source Code Form is subject to the terms of the Mozilla Public
 # License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, You can obtain one at http://mozilla.org/MPL/2.0/.
 
 with Files("**"):
-    BUG_COMPONENT = ("Core", "DOM")
+    BUG_COMPONENT = ("Core", "DOM: Core & HTML")
 
 XPIDL_SOURCES += [
     'nsIWebProtocolHandlerRegistrar.idl',
 ]
 
 XPIDL_MODULE = 'dom_sidebar'
 
--- a/dom/interfaces/storage/moz.build
+++ b/dom/interfaces/storage/moz.build
@@ -1,15 +1,15 @@
 # -*- Mode: python; indent-tabs-mode: nil; tab-width: 40 -*-
 # vim: set filetype=python:
 # This Source Code Form is subject to the terms of the Mozilla Public
 # License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, You can obtain one at http://mozilla.org/MPL/2.0/.
 
 with Files("**"):
-    BUG_COMPONENT = ("Core", "DOM")
+    BUG_COMPONENT = ("Core", "DOM: Core & HTML")
 
 XPIDL_SOURCES += [
     'nsIDOMStorageManager.idl',
     'nsIStorageActivityService.idl',
 ]
 
 XPIDL_MODULE = 'dom_storage'
--- a/dom/locales/moz.build
+++ b/dom/locales/moz.build
@@ -1,25 +1,25 @@
 # -*- Mode: python; indent-tabs-mode: nil; tab-width: 40 -*-
 # vim: set filetype=python:
 # This Source Code Form is subject to the terms of the Mozilla Public
 # License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, You can obtain one at http://mozilla.org/MPL/2.0/.
 
 with Files("**"):
-    BUG_COMPONENT = ("Core", "DOM")
+    BUG_COMPONENT = ("Core", "DOM: Core & HTML")
 
 with Files("en-US/chrome/accessibility/**"):
     BUG_COMPONENT = ("Core", "Disability Access APIs")
 
 with Files("en-US/chrome/dom/**"):
-    BUG_COMPONENT = ("Core", "DOM")
+    BUG_COMPONENT = ("Core", "DOM: Core & HTML")
 
 with Files("en-US/chrome/layout/**"):
-    BUG_COMPONENT = ("Core", "DOM")
+    BUG_COMPONENT = ("Core", "DOM: Core & HTML")
 
 with Files("en-US/chrome/layout/css.properties"):
     BUG_COMPONENT = ("Core", "CSS Parsing and Computation")
 
 with Files("en-US/chrome/layout/htmlparser.properties"):
     BUG_COMPONENT = ("Core", "HTML: Parser")
 
 with Files("en-US/chrome/layout/layout_errors.properties"):
--- a/dom/manifest/moz.build
+++ b/dom/manifest/moz.build
@@ -1,16 +1,16 @@
 # -*- Mode: python; indent-tabs-mode: nil; tab-width: 40 -*-
 # vim: set filetype=python:
 # This Source Code Form is subject to the terms of the Mozilla Public
 # License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, You can obtain one at http://mozilla.org/MPL/2.0/.
 
 with Files("**"):
-    BUG_COMPONENT = ("Core", "DOM")
+    BUG_COMPONENT = ("Core", "DOM: Core & HTML")
 
 EXTRA_JS_MODULES += [
     'ImageObjectProcessor.jsm',
     'Manifest.jsm',
     'ManifestFinder.jsm',
     'ManifestIcons.jsm',
     'ManifestObtainer.jsm',
     'ManifestProcessor.jsm',
--- a/dom/messagechannel/moz.build
+++ b/dom/messagechannel/moz.build
@@ -1,16 +1,16 @@
 # -*- Mode: python; indent-tabs-mode: nil; tab-width: 40 -*-
 # vim: set filetype=python:
 # This Source Code Form is subject to the terms of the Mozilla Public
 # License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, You can obtain one at http://mozilla.org/MPL/2.0/.
 
 with Files("**"):
-    BUG_COMPONENT = ("Core", "DOM")
+    BUG_COMPONENT = ("Core", "DOM: Core & HTML")
 
 TEST_DIRS += ['tests']
 
 EXPORTS.mozilla.dom += [
     'MessageChannel.h',
     'MessagePort.h',
     'MessagePortChild.h',
     'MessagePortParent.h',
--- a/dom/moz.build
+++ b/dom/moz.build
@@ -1,17 +1,17 @@
 # -*- Mode: python; indent-tabs-mode: nil; tab-width: 40 -*-
 # vim: set filetype=python:
 # This Source Code Form is subject to the terms of the Mozilla Public
 # License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, You can obtain one at http://mozilla.org/MPL/2.0/.
 
 # interfaces/*/ are annotated per directory, this is for new files
 with Files("**"):
-    BUG_COMPONENT = ("Core", "DOM")
+    BUG_COMPONENT = ("Core", "DOM: Core & HTML")
 
 with Files("plugins/**"):
     BUG_COMPONENT = ("Core", "Plug-ins")
 
 JAR_MANIFESTS += ['jar.mn']
 
 interfaces = [
     'base',
--- a/dom/performance/moz.build
+++ b/dom/performance/moz.build
@@ -1,16 +1,16 @@
 # -*- Mode: python; indent-tabs-mode: nil; tab-width: 40 -*-
 # vim: set filetype=python:
 # This Source Code Form is subject to the terms of the Mozilla Public
 # License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, You can obtain one at http://mozilla.org/MPL/2.0/.
 
 with Files("**"):
-    BUG_COMPONENT = ("Core", "DOM")
+    BUG_COMPONENT = ("Core", "DOM: Core & HTML")
 
 EXPORTS.mozilla.dom += [
     'Performance.h',
     'PerformanceEntry.h',
     'PerformanceMark.h',
     'PerformanceMeasure.h',
     'PerformanceNavigation.h',
     'PerformanceNavigationTiming.h',
--- a/dom/permission/moz.build
+++ b/dom/permission/moz.build
@@ -1,16 +1,16 @@
 # -*- Mode: python; indent-tabs-mode: nil; tab-width: 40 -*-
 # vim: set filetype=python:
 # This Source Code Form is subject to the terms of the Mozilla Public
 # License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, You can obtain one at http://mozilla.org/MPL/2.0/.
 
 with Files("**"):
-    BUG_COMPONENT = ("Core", "DOM")
+    BUG_COMPONENT = ("Core", "DOM: Core & HTML")
 
 EXPORTS.mozilla.dom += [
     'Permissions.h',
     'PermissionStatus.h',
 ]
 
 UNIFIED_SOURCES += [
     'PermissionObserver.cpp',
--- a/dom/power/moz.build
+++ b/dom/power/moz.build
@@ -1,16 +1,16 @@
 # -*- Mode: python; indent-tabs-mode: nil; tab-width: 40 -*-
 # vim: set filetype=python:
 # This Source Code Form is subject to the terms of the Mozilla Public
 # License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, You can obtain one at http://mozilla.org/MPL/2.0/.
 
 with Files("**"):
-    BUG_COMPONENT = ("Core", "DOM")
+    BUG_COMPONENT = ("Core", "DOM: Core & HTML")
 
 XPIDL_SOURCES += [
     'nsIDOMWakeLockListener.idl',
     'nsIPowerManagerService.idl',
     'nsIWakeLock.idl',
 ]
 
 XPIDL_MODULE = 'dom_power'
--- a/dom/presentation/moz.build
+++ b/dom/presentation/moz.build
@@ -1,16 +1,16 @@
 # -*- Mode: python; indent-tabs-mode: nil; tab-width: 40 -*-
 # vim: set filetype=python:
 # This Source Code Form is subject to the terms of the Mozilla Public
 # License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, You can obtain one at http://mozilla.org/MPL/2.0/.
 
 with Files("**"):
-    BUG_COMPONENT = ("Core", "DOM")
+    BUG_COMPONENT = ("Core", "DOM: Core & HTML")
 
 DIRS += ['interfaces', 'provider']
 
 XPCSHELL_TESTS_MANIFESTS += ['tests/xpcshell/xpcshell.ini']
 MOCHITEST_MANIFESTS += ['tests/mochitest/mochitest.ini']
 MOCHITEST_CHROME_MANIFESTS += ['tests/mochitest/chrome.ini']
 
 EXPORTS.mozilla.dom += [
--- a/dom/prio/moz.build
+++ b/dom/prio/moz.build
@@ -1,16 +1,16 @@
 # -*- Mode: python; indent-tabs-mode: nil; tab-width: 40 -*-
 # vim: set filetype=python:
 # This Source Code Form is subject to the terms of the Mozilla Public
 # License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, You can obtain one at http://mozilla.org/MPL/2.0/.
 
 with Files("**"):
-    BUG_COMPONENT = ("Core", "DOM")
+    BUG_COMPONENT = ("Core", "DOM: Core & HTML")
 
 LOCAL_INCLUDES += [
     '/third_party/msgpack/include'
 ]
 
 EXPORTS.mozilla.dom += [
     'PrioEncoder.h',
 ]
--- a/dom/promise/moz.build
+++ b/dom/promise/moz.build
@@ -1,16 +1,16 @@
 # -*- Mode: python; indent-tabs-mode: nil; tab-width: 40 -*-
 # vim: set filetype=python:
 # This Source Code Form is subject to the terms of the Mozilla Public
 # License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, You can obtain one at http://mozilla.org/MPL/2.0/.
 
 with Files("**"):
-    BUG_COMPONENT = ("Core", "DOM")
+    BUG_COMPONENT = ("Core", "DOM: Core & HTML")
 
 EXPORTS.mozilla.dom += [
     'Promise-inl.h',
     'Promise.h',
     'PromiseDebugging.h',
     'PromiseNativeHandler.h',
     'PromiseWorkerProxy.h',
 ]
--- a/dom/script/moz.build
+++ b/dom/script/moz.build
@@ -1,16 +1,16 @@
 # -*- Mode: python; indent-tabs-mode: nil; tab-width: 40 -*-
 # vim: set filetype=python:
 # This Source Code Form is subject to the terms of the Mozilla Public
 # License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, You can obtain one at http://mozilla.org/MPL/2.0/.
 
 with Files("**"):
-    BUG_COMPONENT = ("Core", "DOM")
+    BUG_COMPONENT = ("Core", "DOM: Core & HTML")
 
 XPIDL_SOURCES += [
     'nsIScriptLoaderObserver.idl',
 ]
 
 XPIDL_MODULE = 'dom'
 
 EXPORTS += [
--- a/dom/smil/SMILTimedElement.cpp
+++ b/dom/smil/SMILTimedElement.cpp
@@ -1708,17 +1708,17 @@ SMILTimeValue SMILTimedElement::CalcActi
   }
 
   return result;
 }
 
 SMILTimeValue SMILTimedElement::GetRepeatDuration() const {
   SMILTimeValue multipliedDuration;
   if (mRepeatCount.IsDefinite() && mSimpleDur.IsDefinite()) {
-    if (mRepeatCount * double(mSimpleDur.GetMillis()) <=
+    if (mRepeatCount * double(mSimpleDur.GetMillis()) <
         std::numeric_limits<SMILTime>::max()) {
       multipliedDuration.SetMillis(
           SMILTime(mRepeatCount * mSimpleDur.GetMillis()));
     }
   } else {
     multipliedDuration.SetIndefinite();
   }
 
new file mode 100644
--- /dev/null
+++ b/dom/smil/crashtests/1413319-1.html
@@ -0,0 +1,2 @@
+<svg width=''>
+<animate dur='2ms' repeatCount='4611686018427387903' fill='freeze'/>
--- a/dom/smil/crashtests/crashtests.list
+++ b/dom/smil/crashtests/crashtests.list
@@ -54,8 +54,9 @@ load 720103-1.svg
 load 849593-1.xhtml
 load 1010681-1.svg
 load 1322770-1.svg
 load 1322849-1.svg
 load 1343357-1.html
 load 1375596-1.svg
 load 1402547-1.html
 load 1411963-1.html
+load 1413319-1.html
--- a/dom/system/moz.build
+++ b/dom/system/moz.build
@@ -1,17 +1,17 @@
 # -*- Mode: python; indent-tabs-mode: nil; tab-width: 40 -*-
 # vim: set filetype=python:
 # This Source Code Form is subject to the terms of the Mozilla Public
 # License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, You can obtain one at http://mozilla.org/MPL/2.0/.
 
 # This picks up *hapticfeedback* which is graveyard
 with Files("**"):
-    BUG_COMPONENT = ("Core", "DOM")
+    BUG_COMPONENT = ("Core", "DOM: Core & HTML")
 
 with Files("*OSFile*"):
     BUG_COMPONENT = ("Toolkit", "OS.File")
 
 with Files("*ocationProvider*"):
     BUG_COMPONENT = ("Core", "Geolocation")
 
 with Files("windows/*LocationProvider*"):
--- a/dom/tests/moz.build
+++ b/dom/tests/moz.build
@@ -1,16 +1,16 @@
 # -*- Mode: python; indent-tabs-mode: nil; tab-width: 40 -*-
 # vim: set filetype=python:
 # This Source Code Form is subject to the terms of the Mozilla Public
 # License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, You can obtain one at http://mozilla.org/MPL/2.0/.
 
 with Files("browser/**"):
-    BUG_COMPONENT = ("Core", "DOM")
+    BUG_COMPONENT = ("Core", "DOM: Core & HTML")
 
 with Files("browser/*onsole*"):
     BUG_COMPONENT = ("DevTools", "General")
 
 with Files("browser/*autofocus*"):
     BUG_COMPONENT = ("Core", "DOM: Core & HTML")
 
 with Files("browser/*unload*"):
@@ -21,125 +21,125 @@ with Files("browser/*1238427*"):
 
 with Files("browser/*Geolocation*"):
     BUG_COMPONENT = ("Core", "Geolocation")
 
 with Files("browser/*geo_*"):
     BUG_COMPONENT = ("Core", "Geolocation")
 
 with Files("browser/browser_cancel_keydown_keypress_event.js"):
-    BUG_COMPONENT = ("Core", "Event Handling")
+    BUG_COMPONENT = ("Core", "User events and focus handling")
 
 with Files("browser/*local*"):
-    BUG_COMPONENT = ("Core", "DOM")
+    BUG_COMPONENT = ("Core", "DOM: Core & HTML")
 
 with Files("browser/browser_test_focus_after_modal_state.js"):
-    BUG_COMPONENT = ("Core", "Event Handling")
+    BUG_COMPONENT = ("Core", "User events and focus handling")
 
 with Files("mochitest/ajax/**"):
     BUG_COMPONENT = ("Testing", "Mochitest")
 
 with Files("mochitest/ajax/offline/**"):
     BUG_COMPONENT = ("Core", "Networking: Cache")
 
 with Files("mochitest/beacon/**"):
-    BUG_COMPONENT = ("Core", "DOM")
+    BUG_COMPONENT = ("Core", "DOM: Core & HTML")
 
 # big mix of components here
 with Files("mochitest/bugs/**"):
-    BUG_COMPONENT = ("Core", "DOM")
+    BUG_COMPONENT = ("Core", "DOM: Core & HTML")
 
 # TODO: big mix of components here
 with Files("mochitest/chrome/**"):
-    BUG_COMPONENT = ("Core", "DOM")
+    BUG_COMPONENT = ("Core", "DOM: Core & HTML")
 
 with Files("mochitest/crypto/**"):
     BUG_COMPONENT = ("Core", "DOM: Security")
 
 with Files("mochitest/dom-level0/**"):
-    BUG_COMPONENT = ("Core", "DOM")
+    BUG_COMPONENT = ("Core", "DOM: Core & HTML")
 
 with Files("mochitest/dom-level1-core/**"):
     BUG_COMPONENT = ("Core", "DOM: Core & HTML")
 
 with Files("mochitest/dom-level2-core/**"):
     BUG_COMPONENT = ("Core", "DOM: Core & HTML")
 
 with Files("mochitest/dom-level2-html/**"):
     BUG_COMPONENT = ("Core", "DOM: Core & HTML")
 
 with Files("mochitest/fetch/**"):
-    BUG_COMPONENT = ("Core", "DOM")
+    BUG_COMPONENT = ("Core", "DOM: Core & HTML")
 
 with Files("mochitest/gamepad/**"):
     BUG_COMPONENT = ("Core", "DOM: Device Interfaces")
 
 # TODO: big mix of components here
 with Files("mochitest/general/**"):
-    BUG_COMPONENT = ("Core", "DOM")
+    BUG_COMPONENT = ("Core", "DOM: Core & HTML")
 
 with Files("mochitest/geolocation/**"):
     BUG_COMPONENT = ("Core", "Geolocation")
 
 with Files("mochitest/localstorage/**"):
     BUG_COMPONENT = ("Core", "DOM: Web Storage")
 
 with Files("mochitest/orientation/**"):
     BUG_COMPONENT = ("Core", "DOM: Device Interfaces")
 
 with Files("mochitest/orientation/*507902*"):
     BUG_COMPONENT = ("Core", "Layout: Images, Video, and HTML Frames")
 
 with Files("mochitest/pointerlock/**"):
-    BUG_COMPONENT = ("Core", "DOM")
+    BUG_COMPONENT = ("Core", "DOM: Core & HTML")
 
 with Files("mochitest/script/**"):
     BUG_COMPONENT = ("Core", "DOM: Core & HTML")
 
 with Files("mochitest/sessionstorage/**"):
     BUG_COMPONENT = ("Core", "DOM: Web Storage")
 
 with Files("mochitest/storageevent/**"):
     BUG_COMPONENT = ("Core", "DOM: Web Storage")
 
 with Files("mochitest/webcomponents/**"):
-    BUG_COMPONENT = ("Core", "DOM")
+    BUG_COMPONENT = ("Core", "DOM: Core & HTML")
 
 with Files("mochitest/whatwg/**"):
-    BUG_COMPONENT = ("Core", "DOM")
+    BUG_COMPONENT = ("Core", "DOM: Core & HTML")
 
 with Files("reftest/**"):
-    BUG_COMPONENT = ("Core", "DOM")
+    BUG_COMPONENT = ("Core", "DOM: Core & HTML")
 
 with Files("reftest/*456008*"):
     BUG_COMPONENT = ("Core", "XML")
 
 with Files("reftest/*439965*"):
     BUG_COMPONENT = ("Core", "Editor")
 
 with Files("reftest/*427779*"):
     BUG_COMPONENT = ("Core", "XML")
 
 with Files("reftest/*559996*"):
-    BUG_COMPONENT = ("Core", "DOM")
+    BUG_COMPONENT = ("Core", "DOM: Core & HTML")
 
 with Files("reftest/*591981*"):
-    BUG_COMPONENT = ("Core", "DOM")
+    BUG_COMPONENT = ("Core", "DOM: Core & HTML")
 
 with Files("reftest/*592366*"):
-    BUG_COMPONENT = ("Core", "DOM")
+    BUG_COMPONENT = ("Core", "DOM: Core & HTML")
 
 with Files("reftest/*798068*"):
     BUG_COMPONENT = ("Core", "Layout")
 
 with Files("reftest/xml-stylesheet/**"):
     BUG_COMPONENT = ("Core", "XSLT")
 
 with Files("unit/**"):
-    BUG_COMPONENT = ("Core", "DOM")
+    BUG_COMPONENT = ("Core", "DOM: Core & HTML")
 
 with Files("unit/*geolocation*"):
     BUG_COMPONENT = ("Core", "Geolocation")
 
 with Files("unit/test_bug465752.js"):
     BUG_COMPONENT = ("Core", "CSS Parsing and Computation")
 
 with Files("unit/test_PromiseDebugging.js"):
--- a/dom/url/moz.build
+++ b/dom/url/moz.build
@@ -1,16 +1,16 @@
 # -*- Mode: python; indent-tabs-mode: nil; tab-width: 40 -*-
 # vim: set filetype=python:
 # This Source Code Form is subject to the terms of the Mozilla Public
 # License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, You can obtain one at http://mozilla.org/MPL/2.0/.
 
 with Files("**"):
-    BUG_COMPONENT = ("Core", "DOM")
+    BUG_COMPONENT = ("Core", "DOM: Core & HTML")
 
 EXPORTS.mozilla.dom += [
     'URL.h',
     'URLSearchParams.h',
 ]
 
 UNIFIED_SOURCES += [
     'URL.cpp',
--- a/dom/webbrowserpersist/moz.build
+++ b/dom/webbrowserpersist/moz.build
@@ -1,17 +1,17 @@
 # -*- Mode: python; indent-tabs-mode: nil; tab-width: 40 -*-
 # vim: set filetype=python:
 # This Source Code Form is subject to the terms of the Mozilla Public
 # License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, You can obtain one at http://mozilla.org/MPL/2.0/.
 
 # moved from embedding/components/webbrowserpersist Jan 13, 2017
 with Files("**"):
-    BUG_COMPONENT = ("Core", "DOM")
+    BUG_COMPONENT = ("Core", "DOM: Core & HTML")
 
 XPIDL_SOURCES += [
     'nsIWebBrowserPersist.idl',
     'nsIWebBrowserPersistDocument.idl',
 ]
 
 XPIDL_MODULE = 'webbrowserpersist'
 
--- a/dom/webidl/moz.build
+++ b/dom/webidl/moz.build
@@ -1,16 +1,16 @@
 # -*- Mode: python; indent-tabs-mode: nil; tab-width: 40 -*-
 # vim: set filetype=python:
 # This Source Code Form is subject to the terms of the Mozilla Public
 # License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, You can obtain one at http://mozilla.org/MPL/2.0/.
 
 with Files("**"):
-    BUG_COMPONENT = ("Core", "DOM")
+    BUG_COMPONENT = ("Core", "DOM: Core & HTML")
 
 with Files("APZTestData.webidl"):
     BUG_COMPONENT = ("Core", "Panning and Zooming")
 
 with Files("AccessibleNode.webidl"):
     BUG_COMPONENT = ("Core", "Disability Access APIs")
 
 with Files("Addon*"):
@@ -33,17 +33,17 @@ with Files("BaseKeyframeTypes.webidl"):
 
 with Files("BatteryManager.webidl"):
     BUG_COMPONENT = ("Core", "DOM: Device Interfaces")
 
 with Files("BiquadFilterNode.webidl"):
     BUG_COMPONENT = ("Core", "Web Audio")
 
 with Files("BrowserElement*"):
-    BUG_COMPONENT = ("Core", "DOM")
+    BUG_COMPONENT = ("Core", "DOM: Core & HTML")
 
 with Files("CSP*"):
     BUG_COMPONENT = ("Core", "DOM: Security")
 
 with Files("CSS*"):
     BUG_COMPONENT = ("Core", "CSS Parsing and Computation")
 
 with Files("Canvas*"):
@@ -141,17 +141,17 @@ with Files("HiddenPluginEvent.webidl"):
 
 with Files("IDB*"):
     BUG_COMPONENT = ("Core", "DOM: IndexedDB")
 
 with Files("IIRFilterNode.webidl"):
     BUG_COMPONENT = ("Core", "Web Audio")
 
 with Files("Image*"):
-    BUG_COMPONENT = ("Core", "DOM")
+    BUG_COMPONENT = ("Core", "DOM: Core & HTML")
 
 with Files("ImageCapture*"):
     BUG_COMPONENT = ("Core", "Audio/Video")
 
 with Files("InputEvent.webidl"):
     BUG_COMPONENT = ("Core", "DOM: Events")
 
 with Files("InstallTrigger.webidl"):
--- a/dom/websocket/moz.build
+++ b/dom/websocket/moz.build
@@ -1,16 +1,16 @@
 # -*- Mode: python; indent-tabs-mode: nil; tab-width: 40 -*-
 # vim: set filetype=python:
 # This Source Code Form is subject to the terms of the Mozilla Public
 # License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, You can obtain one at http://mozilla.org/MPL/2.0/.
 
 with Files("**"):
-    BUG_COMPONENT = ("Core", "DOM")
+    BUG_COMPONENT = ("Core", "DOM: Core & HTML")
 
 EXPORTS.mozilla.dom += [
     'WebSocket.h',
 ]
 
 UNIFIED_SOURCES += [
     'WebSocket.cpp',
 ]
--- a/dom/worklet/moz.build
+++ b/dom/worklet/moz.build
@@ -1,16 +1,16 @@
 # -*- Mode: python; indent-tabs-mode: nil; tab-width: 40 -*-
 # vim: set filetype=python:
 # This Source Code Form is subject to the terms of the Mozilla Public
 # License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, You can obtain one at http://mozilla.org/MPL/2.0/.
 
 with Files("**"):
-    BUG_COMPONENT = ("Core", "DOM")
+    BUG_COMPONENT = ("Core", "DOM: Core & HTML")
 
 EXPORTS.mozilla.dom += [
     'Worklet.h',
     'WorkletGlobalScope.h',
     'WorkletImpl.h',
     'WorkletPrincipal.h',
     'WorkletThread.h',
 ]
--- a/dom/xhr/moz.build
+++ b/dom/xhr/moz.build
@@ -1,16 +1,16 @@
 # -*- Mode: python; indent-tabs-mode: nil; tab-width: 40 -*-
 # vim: set filetype=python:
 # This Source Code Form is subject to the terms of the Mozilla Public
 # License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, You can obtain one at http://mozilla.org/MPL/2.0/.
 
 with Files("**"):
-    BUG_COMPONENT = ("Core", "DOM")
+    BUG_COMPONENT = ("Core", "DOM: Core & HTML")
 
 EXPORTS.mozilla.dom += [
     'XMLHttpRequest.h',
     'XMLHttpRequestEventTarget.h',
     'XMLHttpRequestMainThread.h',
     'XMLHttpRequestString.h',
     'XMLHttpRequestUpload.h',
 ]
--- a/editor/libeditor/EditorBase.cpp
+++ b/editor/libeditor/EditorBase.cpp
@@ -2655,29 +2655,16 @@ nsresult EditorBase::InsertTextIntoTextN
       mComposition->OnTextNodeRemoved();
       static_cast<CompositionTransaction*>(transaction.get())->MarkFixed();
     }
   }
 
   return rv;
 }
 
-nsresult EditorBase::SelectEntireDocument() {
-  MOZ_ASSERT(IsEditActionDataAvailable());
-
-  Element* rootElement = GetRoot();
-  if (!rootElement) {
-    return NS_ERROR_NOT_INITIALIZED;
-  }
-
-  ErrorResult errorResult;
-  SelectionRefPtr()->SelectAllChildren(*rootElement, errorResult);
-  return errorResult.StealNSResult();
-}
-
 nsINode* EditorBase::GetFirstEditableNode(nsINode* aRoot) {
   MOZ_ASSERT(aRoot);
 
   nsIContent* node = GetLeftmostChild(aRoot);
   if (node && !IsEditable(node)) {
     node = GetNextEditableNode(*node);
   }
 
--- a/editor/libeditor/EditorBase.h
+++ b/editor/libeditor/EditorBase.h
@@ -384,16 +384,17 @@ class EditorBase : public nsIEditor,
   }
   bool RemoveTransactionListener(nsITransactionListener& aListener) {
     if (!mTransactionManager) {
       return false;
     }
     return mTransactionManager->RemoveTransactionListener(aListener);
   }
 
+  MOZ_CAN_RUN_SCRIPT
   virtual nsresult HandleKeyPressEvent(WidgetKeyboardEvent* aKeyboardEvent);
 
   virtual dom::EventTarget* GetDOMEventTarget() = 0;
 
   /**
    * Accessor methods to flags.
    */
   uint32_t Flags() const { return mFlags; }
@@ -1811,16 +1812,17 @@ class EditorBase : public nsIEditor,
    */
   nsresult GetDocumentCharsetInternal(nsACString& aCharset) const;
 
   /**
    * SelectAllInternal() should be used instead of SelectAll() in editor
    * because SelectAll() creates AutoEditActionSetter but we should avoid
    * to create it as far as possible.
    */
+  MOZ_CAN_RUN_SCRIPT
   virtual nsresult SelectAllInternal();
 
   nsresult DetermineCurrentDirection();
 
   /**
    * FireInputEvent() dispatches an "input" event synchronously or
    * asynchronously if it's not safe to dispatch.
    */
@@ -1855,17 +1857,18 @@ class EditorBase : public nsIEditor,
     eDocumentStateChanged
   };
   nsresult NotifyDocumentListeners(
       TDocumentListenerNotification aNotificationType);
 
   /**
    * Make the given selection span the entire document.
    */
-  virtual nsresult SelectEntireDocument();
+  MOZ_CAN_RUN_SCRIPT
+  virtual nsresult SelectEntireDocument() = 0;
 
   /**
    * Helper method for scrolling the selection into view after
    * an edit operation. aScrollToAnchor should be true if you
    * want to scroll to the point where the selection was started.
    * If false, it attempts to scroll the end of the selection into view.
    *
    * Editor methods *should* call this method instead of the versions
--- a/editor/libeditor/EditorCommands.cpp
+++ b/editor/libeditor/EditorCommands.cpp
@@ -690,17 +690,17 @@ NS_IMETHODIMP
 SelectAllCommand::DoCommand(const char* aCommandName,
                             nsISupports* aCommandRefCon) {
   nsCOMPtr<nsIEditor> editor = do_QueryInterface(aCommandRefCon);
   if (!editor) {
     return NS_ERROR_FAILURE;
   }
   TextEditor* textEditor = editor->AsTextEditor();
   MOZ_ASSERT(textEditor);
-  return textEditor->SelectAll();
+  return MOZ_KnownLive(textEditor)->SelectAll();
 }
 
 NS_IMETHODIMP
 SelectAllCommand::DoCommandParams(const char* aCommandName,
                                   nsICommandParams* aParams,
                                   nsISupports* aCommandRefCon) {
   return DoCommand(aCommandName, aCommandRefCon);
 }
--- a/editor/libeditor/HTMLEditRules.cpp
+++ b/editor/libeditor/HTMLEditRules.cpp
@@ -1726,17 +1726,18 @@ EditActionResult HTMLEditRules::WillInse
 
   if (host == blockParent && separator != ParagraphSeparator::br) {
     // Insert a new block first
     MOZ_ASSERT(separator == ParagraphSeparator::div ||
                separator == ParagraphSeparator::p);
     // MakeBasicBlock() creates AutoSelectionRestorer.
     // Therefore, even if it returns NS_OK, editor might have been destroyed
     // at restoring Selection.
-    nsresult rv = MakeBasicBlock(ParagraphSeparatorElement(separator));
+    OwningNonNull<nsAtom> separatorTag = ParagraphSeparatorElement(separator);
+    nsresult rv = MakeBasicBlock(separatorTag);
     if (NS_WARN_IF(rv == NS_ERROR_EDITOR_DESTROYED) ||
         NS_WARN_IF(!CanHandleEditAction())) {
       return EditActionIgnored(NS_ERROR_EDITOR_DESTROYED);
     }
     // We warn on failure, but don't handle it, because it might be harmless.
     // Instead we just check that a new block was actually created.
     NS_WARNING_ASSERTION(NS_SUCCEEDED(rv),
                          "HTMLEditRules::MakeBasicBlock() failed");
@@ -2216,17 +2217,18 @@ nsresult HTMLEditRules::WillDeleteSelect
   }
 
   // First check for table selection mode.  If so, hand off to table editor.
   ErrorResult error;
   RefPtr<Element> cellElement =
       HTMLEditorRef().GetFirstSelectedTableCellElement(error);
   if (cellElement) {
     error.SuppressException();
-    nsresult rv = HTMLEditorRef().DeleteTableCellContentsWithTransaction();
+    nsresult rv =
+        MOZ_KnownLive(HTMLEditorRef()).DeleteTableCellContentsWithTransaction();
     if (NS_WARN_IF(!CanHandleEditAction())) {
       return NS_ERROR_EDITOR_DESTROYED;
     }
     *aHandled = true;
     return rv;
   }
   nsresult rv = error.StealNSResult();
   cellElement = nullptr;
@@ -6503,23 +6505,16 @@ nsresult HTMLEditRules::ExpandSelectionF
         }
         selEndNode = wsObj.mEndReasonNode->GetParentNode();
         selEndOffset = 1 + selEndNode->ComputeIndexOf(wsObj.mEndReasonNode);
       } else {
         break;
       }
     }
   }
-  // Now set the selection to the new range
-  DebugOnly<nsresult> rv =
-      SelectionRefPtr()->Collapse(selStartNode, selStartOffset);
-  if (NS_WARN_IF(!CanHandleEditAction())) {
-    return NS_ERROR_EDITOR_DESTROYED;
-  }
-  NS_WARNING_ASSERTION(NS_SUCCEEDED(rv), "Failed to collapse selection");
 
   // Expand selection endpoint only if we didn't pass a <br>, or if we really
   // needed to pass that <br> (i.e., its block is now totally selected).
   bool doEndExpansion = true;
   if (firstBRParent) {
     // Find block node containing <br>.
     nsCOMPtr<Element> brBlock = HTMLEditor::GetBlock(*firstBRParent);
     bool nodeBefore = false, nodeAfter = false;
@@ -6537,36 +6532,30 @@ nsresult HTMLEditRules::ExpandSelectionF
       nsRange::CompareNodeToRange(brBlock, range, &nodeBefore, &nodeAfter);
     }
 
     // If block isn't contained, forgo grabbing the <br> in expanded selection.
     if (nodeBefore || nodeAfter) {
       doEndExpansion = false;
     }
   }
-  if (doEndExpansion) {
-    nsresult rv = SelectionRefPtr()->Extend(selEndNode, selEndOffset);
-    if (NS_WARN_IF(!CanHandleEditAction())) {
-      return NS_ERROR_EDITOR_DESTROYED;
-    }
-    if (NS_WARN_IF(NS_FAILED(rv))) {
-      return rv;
-    }
-  } else {
-    // Only expand to just before <br>.
-    nsresult rv = SelectionRefPtr()->Extend(firstBRParent, firstBROffset);
-    if (NS_WARN_IF(!CanHandleEditAction())) {
-      return NS_ERROR_EDITOR_DESTROYED;
-    }
-    if (NS_WARN_IF(NS_FAILED(rv))) {
-      return rv;
-    }
-  }
-
-  return NS_OK;
+
+  EditorRawDOMPoint newSelectionStart(selStartNode, selStartOffset);
+  EditorRawDOMPoint newSelectionEnd(
+      doEndExpansion ? selEndNode : firstBRParent,
+      doEndExpansion ? selEndOffset : firstBROffset);
+  ErrorResult error;
+  MOZ_KnownLive(SelectionRefPtr())
+      ->SetStartAndEndInLimiter(newSelectionStart, newSelectionEnd, error);
+  if (NS_WARN_IF(!CanHandleEditAction())) {
+    error.SuppressException();
+    return NS_ERROR_EDITOR_DESTROYED;
+  }
+  NS_WARNING_ASSERTION(!error.Failed(), "Failed to set selection for deletion");
+  return error.StealNSResult();
 }
 
 nsresult HTMLEditRules::NormalizeSelection() {
   MOZ_ASSERT(IsEditorDataAvailable());
 
   // NormalizeSelection() tweaks non-collapsed selections to be more "natural".
   // Idea here is to adjust selection endpoint so that they do not cross breaks
   // or block boundaries unless something editable beyond that boundary is also
@@ -6709,30 +6698,28 @@ nsresult HTMLEditRules::NormalizeSelecti
     return NS_OK;  // New end before old start.
   }
   comp = nsContentUtils::ComparePoints(newStartNode, newStartOffset, endNode,
                                        endOffset);
   if (comp == 1) {
     return NS_OK;  // New start after old end.
   }
 
-  // otherwise set selection to new values.
-  // XXX Why don't we use SetBaseAndExtent()?
-  DebugOnly<nsresult> rv =
-      SelectionRefPtr()->Collapse(newStartNode, newStartOffset);
+  // Otherwise set selection to new values.  Note that end point may be prior
+  // to start point.  So, we cannot use Selection::SetStartAndEndInLimit() here.
+  ErrorResult error;
+  MOZ_KnownLive(SelectionRefPtr())
+      ->SetBaseAndExtentInLimiter(*newStartNode, newStartOffset, *newEndNode,
+                                  newEndOffset, error);
   if (NS_WARN_IF(!CanHandleEditAction())) {
+    error.SuppressException();
     return NS_ERROR_EDITOR_DESTROYED;
   }
-  NS_WARNING_ASSERTION(NS_SUCCEEDED(rv), "Failed to collapse selection");
-  rv = SelectionRefPtr()->Extend(newEndNode, newEndOffset);
-  if (NS_WARN_IF(!CanHandleEditAction())) {
-    return NS_ERROR_EDITOR_DESTROYED;
-  }
-  NS_WARNING_ASSERTION(NS_SUCCEEDED(rv), "Failed to extend selection");
-  return NS_OK;
+  NS_WARNING_ASSERTION(!error.Failed(), "Failed to set selection");
+  return error.StealNSResult();
 }
 
 EditorDOMPoint HTMLEditRules::GetPromotedPoint(RulesEndpoint aWhere,
                                                nsINode& aNode, int32_t aOffset,
                                                EditSubAction aEditSubAction) {
   MOZ_ASSERT(IsEditorDataAvailable());
 
   // we do one thing for text actions, something else entirely for other
--- a/editor/libeditor/HTMLEditRules.h
+++ b/editor/libeditor/HTMLEditRules.h
@@ -225,16 +225,17 @@ class HTMLEditRules : public TextEditRul
    * Called before deleting selected contents.  This method actually removes
    * selected contents.
    *
    * @param aAction             Direction of the deletion.
    * @param aStripWrappers      Must be eStrip or eNoStrip.
    * @param aCancel             Returns true if the operation is canceled.
    * @param aHandled            Returns true if the edit action is handled.
    */
+  MOZ_CAN_RUN_SCRIPT
   MOZ_MUST_USE nsresult WillDeleteSelection(
       nsIEditor::EDirection aAction, nsIEditor::EStripWrappers aStripWrappers,
       bool* aCancel, bool* aHandled);
 
   /**
    * Called after deleting selected content.
    * This method removes unnecessary empty nodes and/or inserts <br> if
    * necessary.
@@ -369,77 +370,84 @@ class HTMLEditRules : public TextEditRul
    *
    */
   MOZ_MUST_USE nsresult
   DeleteElementsExceptTableRelatedElements(nsINode& aNode);
 
   /**
    * XXX Should document what this does.
    */
+  MOZ_CAN_RUN_SCRIPT
   MOZ_MUST_USE nsresult WillMakeList(const nsAString* aListType,
                                      bool aEntireList,
                                      const nsAString* aBulletType,
                                      bool* aCancel, bool* aHandled,
                                      const nsAString* aItemType = nullptr);
 
   /**
    * Called before removing a list element.  This method actually removes
    * list elements and list item elements at Selection.  And move contents
    * in them where the removed list was.
    *
    * @param aCancel             Returns true if the operation is canceled.
    * @param aHandled            Returns true if the edit action is handled.
    */
+  MOZ_CAN_RUN_SCRIPT
   MOZ_MUST_USE nsresult WillRemoveList(bool* aCancel, bool* aHandled);
 
   /**
    * Called before indenting around Selection.  This method actually tries to
    * indent the contents.
    *
    * @param aCancel             Returns true if the operation is canceled.
    * @param aHandled            Returns true if the edit action is handled.
    */
+  MOZ_CAN_RUN_SCRIPT
   MOZ_MUST_USE nsresult WillIndent(bool* aCancel, bool* aHandled);
 
   /**
    * Called before indenting around Selection and it's in CSS mode.
    * This method actually tries to indent the contents.
    *
    * @param aCancel             Returns true if the operation is canceled.
    * @param aHandled            Returns true if the edit action is handled.
    */
+  MOZ_CAN_RUN_SCRIPT
   MOZ_MUST_USE nsresult WillCSSIndent(bool* aCancel, bool* aHandled);
 
   /**
    * Called before indenting around Selection and it's not in CSS mode.
    * This method actually tries to indent the contents.
    *
    * @param aCancel             Returns true if the operation is canceled.
    * @param aHandled            Returns true if the edit action is handled.
    */
+  MOZ_CAN_RUN_SCRIPT
   MOZ_MUST_USE nsresult WillHTMLIndent(bool* aCancel, bool* aHandled);
 
   /**
    * Called before outdenting around Selection.  This method actually tries
    * to indent the contents.
    *
    * @param aCancel             Returns true if the operation is canceled.
    * @param aHandled            Returns true if the edit action is handled.
    */
+  MOZ_CAN_RUN_SCRIPT
   MOZ_MUST_USE nsresult WillOutdent(bool* aCancel, bool* aHandled);
 
   /**
    * Called before aligning contents around Selection.  This method actually
    * sets align attributes to align contents.
    *
    * @param aAlignType          New align attribute value where the contents
    *                            should be aligned to.
    * @param aCancel             Returns true if the operation is canceled.
    * @param aHandled            Returns true if the edit action is handled.
    */
+  MOZ_CAN_RUN_SCRIPT
   nsresult WillAlign(const nsAString& aAlignType, bool* aCancel,
                      bool* aHandled);
 
   /**
    * Called before changing absolute positioned element to static positioned.
    * This method actually changes the position property of nearest absolute
    * positioned element.  Therefore, this might cause destroying the HTML
    * editor.
@@ -468,44 +476,47 @@ class HTMLEditRules : public TextEditRul
    * method just calls WillMakeList() with "dl" as aListType and
    * aDefinitionListItemTag as aItemType.
    *
    * @param aDefinitionListItemTag  Should be "dt" or "dd".
    * @param aEntireList             XXX not sure
    * @param aCancel                 Returns true if the operation is canceled.
    * @param aHandled                Returns true if the edit action is handled.
    */
+  MOZ_CAN_RUN_SCRIPT
   MOZ_MUST_USE nsresult WillMakeDefListItem(const nsAString* aBlockType,
                                             bool aEntireList, bool* aCancel,
                                             bool* aHandled);
 
   /**
    * WillMakeBasicBlock() called before changing block style around Selection.
    * This method actually does something with calling MakeBasicBlock().
    *
    * @param aBlockType          Necessary block style as string.
    * @param aCancel             Returns true if the operation is canceled.
    * @param aHandled            Returns true if the edit action is handled.
    */
+  MOZ_CAN_RUN_SCRIPT
   MOZ_MUST_USE nsresult WillMakeBasicBlock(const nsAString& aBlockType,
                                            bool* aCancel, bool* aHandled);
 
   /**
    * MakeBasicBlock() applies or clears block style around Selection.
    * This method creates AutoSelectionRestorer.  Therefore, each caller
    * need to check if the editor is still available even if this returns
    * NS_OK.
    *
    * @param aBlockType          New block tag name.
    *                            If nsGkAtoms::normal or nsGkAtoms::_empty,
    *                            RemoveBlockStyle() will be called.
    *                            If nsGkAtoms::blockquote, MakeBlockquote()
    *                            will be called.
    *                            Otherwise, ApplyBlockStyle() will be called.
    */
+  MOZ_CAN_RUN_SCRIPT
   MOZ_MUST_USE nsresult MakeBasicBlock(nsAtom& aBlockType);
 
   /**
    * Called after creating a basic block, indenting, outdenting or aligning
    * contents.  This method inserts moz-<br> element if start container of
    * Selection needs it.
    */
   MOZ_MUST_USE nsresult DidMakeBasicBlock();
@@ -514,16 +525,17 @@ class HTMLEditRules : public TextEditRul
    * Called before changing an element to absolute positioned.
    * This method only prepares the operation since DidAbsolutePosition() will
    * change it actually later.  mNewBlock is set to the target element and
    * if necessary, some ancestor nodes of selection may be split.
    *
    * @param aCancel             Returns true if the operation is canceled.
    * @param aHandled            Returns true if the edit action is handled.
    */
+  MOZ_CAN_RUN_SCRIPT
   MOZ_MUST_USE nsresult WillAbsolutePosition(bool* aCancel, bool* aHandled);
 
   /**
    * PrepareToMakeElementAbsolutePosition() is helper method of
    * WillAbsolutePosition() since in some cases, needs to restore selection
    * with AutoSelectionRestorer.  So, all callers have to check if
    * CanHandleEditAction() still returns true after a call of this method.
    * XXX Should be documented outline of this method.
@@ -843,24 +855,26 @@ class HTMLEditRules : public TextEditRul
                                int32_t aOffset = 0);
 
   /**
    * ExpandSelectionForDeletion() may expand Selection range if it's not
    * collapsed and there is only one range.  This may expand to include
    * invisible <br> element for preventing delete action handler to keep
    * unexpected nodes.
    */
+  MOZ_CAN_RUN_SCRIPT
   MOZ_MUST_USE nsresult ExpandSelectionForDeletion();
 
   /**
    * NormalizeSelection() adjust Selection if it's not collapsed and there is
    * only one range.  If range start and/or end point is <br> node or something
    * non-editable point, they should be moved to nearest text node or something
    * where the other methods easier to handle edit action.
    */
+  MOZ_CAN_RUN_SCRIPT
   MOZ_MUST_USE nsresult NormalizeSelection();
 
   /**
    * GetPromotedPoint() figures out where a start or end point for a block
    * operation really is.
    */
   EditorDOMPoint GetPromotedPoint(RulesEndpoint aWhere, nsINode& aNode,
                                   int32_t aOffset,
--- a/editor/libeditor/HTMLEditor.cpp
+++ b/editor/libeditor/HTMLEditor.cpp
@@ -1722,53 +1722,43 @@ HTMLEditor::SelectElement(Element* aElem
     return NS_ERROR_INVALID_ARG;
   }
 
   AutoEditActionDataSetter editActionData(*this, EditAction::eNotEditing);
   if (NS_WARN_IF(!editActionData.CanHandle())) {
     return NS_ERROR_NOT_INITIALIZED;
   }
 
-  nsresult rv = SelectContentInternal(*aElement);
+  nsresult rv = SelectContentInternal(MOZ_KnownLive(*aElement));
   if (NS_WARN_IF(NS_FAILED(rv))) {
     return rv;
   }
   return NS_OK;
 }
 
 nsresult HTMLEditor::SelectContentInternal(nsIContent& aContentToSelect) {
   MOZ_ASSERT(IsEditActionDataAvailable());
 
   // Must be sure that element is contained in the document body
   if (!IsDescendantOfEditorRoot(&aContentToSelect)) {
     return NS_ERROR_FAILURE;
   }
 
-  nsINode* parent = aContentToSelect.GetParentNode();
-  if (NS_WARN_IF(!parent)) {
+  EditorRawDOMPoint newSelectionStart(&aContentToSelect);
+  if (NS_WARN_IF(!newSelectionStart.IsSet())) {
     return NS_ERROR_FAILURE;
   }
-
-  // Don't notify selection change at collapse.
-  AutoUpdateViewBatch notifySelectionChangeOnce(*this);
-
-  // XXX Perhaps, Selection should have SelectNode(nsIContent&).
-  int32_t offsetInParent = parent->ComputeIndexOf(&aContentToSelect);
-
-  // Collapse selection to just before desired element,
-  nsresult rv = SelectionRefPtr()->Collapse(parent, offsetInParent);
-  if (NS_WARN_IF(NS_FAILED(rv))) {
-    return rv;
-  }
-  // then extend it to just after
-  rv = SelectionRefPtr()->Extend(parent, offsetInParent + 1);
-  if (NS_WARN_IF(NS_FAILED(rv))) {
-    return rv;
-  }
-  return NS_OK;
+  EditorRawDOMPoint newSelectionEnd(&aContentToSelect);
+  MOZ_ASSERT(newSelectionEnd.IsSet());
+  DebugOnly<bool> advanced = newSelectionEnd.AdvanceOffset();
+  ErrorResult error;
+  MOZ_KnownLive(SelectionRefPtr())
+      ->SetStartAndEndInLimiter(newSelectionStart, newSelectionEnd, error);
+  NS_WARNING_ASSERTION(!error.Failed(), "Failed to select the given content");
+  return error.StealNSResult();
 }
 
 NS_IMETHODIMP
 HTMLEditor::SetCaretAfterElement(Element* aElement) {
   if (NS_WARN_IF(!aElement)) {
     return NS_ERROR_INVALID_ARG;
   }
 
@@ -3598,33 +3588,41 @@ bool HTMLEditor::IsContainer(nsINode* aN
 
 nsresult HTMLEditor::SelectEntireDocument() {
   MOZ_ASSERT(IsEditActionDataAvailable());
 
   if (!mRules) {
     return NS_ERROR_NULL_POINTER;
   }
 
+  RefPtr<Element> rootElement = GetRoot();
+  if (NS_WARN_IF(!rootElement)) {
+    return NS_ERROR_NOT_INITIALIZED;
+  }
+
   // Protect the edit rules object from dying
   RefPtr<TextEditRules> rules(mRules);
 
-  // is doc empty?
+  // If we're empty, don't select all children because that would select the
+  // bogus node.
   if (rules->DocumentIsEmpty()) {
-    // get editor root node
-    Element* rootElement = GetRoot();
-
-    // if its empty dont select entire doc - that would select the bogus node
     nsresult rv = SelectionRefPtr()->Collapse(rootElement, 0);
-    if (NS_WARN_IF(NS_FAILED(rv))) {
-      return rv;
-    }
-    return NS_OK;
-  }
-
-  return EditorBase::SelectEntireDocument();
+    NS_WARNING_ASSERTION(
+        NS_SUCCEEDED(rv),
+        "Failed to move caret to start of the editor root element");
+    return rv;
+  }
+
+  // Otherwise, select all children.
+  ErrorResult error;
+  SelectionRefPtr()->SelectAllChildren(*rootElement, error);
+  NS_WARNING_ASSERTION(
+      !error.Failed(),
+      "Failed to select all children of the editor root element");
+  return error.StealNSResult();
 }
 
 nsresult HTMLEditor::SelectAllInternal() {
   MOZ_ASSERT(IsEditActionDataAvailable());
 
   CommitComposition();
   if (NS_WARN_IF(Destroyed())) {
     return NS_ERROR_EDITOR_DESTROYED;
--- a/editor/libeditor/HTMLEditor.h
+++ b/editor/libeditor/HTMLEditor.h
@@ -136,16 +136,17 @@ class HTMLEditor final : public TextEdit
 
   MOZ_CAN_RUN_SCRIPT
   NS_IMETHOD PasteTransferable(nsITransferable* aTransferable) override;
 
   NS_IMETHOD DeleteNode(nsINode* aNode) override;
 
   NS_IMETHOD InsertLineBreak() override;
 
+  MOZ_CAN_RUN_SCRIPT
   virtual nsresult HandleKeyPressEvent(
       WidgetKeyboardEvent* aKeyboardEvent) override;
   virtual nsIContent* GetFocusedContent() override;
   virtual already_AddRefed<nsIContent> GetFocusedContentForIME() override;
   virtual bool IsActiveInDOMWindow() override;
   virtual dom::EventTarget* GetDOMEventTarget() override;
   virtual Element* FindSelectionRoot(nsINode* aNode) const override;
   virtual bool IsAcceptableInputEvent(WidgetGUIEvent* aGUIEvent) override;
@@ -418,16 +419,17 @@ class HTMLEditor final : public TextEdit
     mDefaultParagraphSeparator = aSep;
   }
 
   /**
    * Modifies the table containing the selection according to the
    * activation of an inline table editing UI element
    * @param aUIAnonymousElement [IN] the inline table editing UI element
    */
+  MOZ_CAN_RUN_SCRIPT
   nsresult DoInlineTableEditingAction(const Element& aUIAnonymousElement);
 
   /**
    * GetElementOrParentByTagName() looks for an element node whose name matches
    * aTagName from aNode or anchor node of Selection to <body> element.
    *
    * @param aTagName        The tag name which you want to look for.
    *                        Must not be nsGkAtoms::_empty.
@@ -636,16 +638,17 @@ class HTMLEditor final : public TextEdit
 
   /**
    * DeleteTableCellContentsWithTransaction() removes any contents in cell
    * elements.  If two or more cell elements are selected, this removes
    * all selected cells' contents.  Otherwise, this removes contents of
    * a cell which contains first selection range.  This does not return
    * error even if selection is not in cell element, just does nothing.
    */
+  MOZ_CAN_RUN_SCRIPT
   nsresult DeleteTableCellContentsWithTransaction();
 
   void IsNextCharInNodeWhitespace(nsIContent* aContent, int32_t aOffset,
                                   bool* outIsSpace, bool* outIsNBSP,
                                   nsIContent** outNode = nullptr,
                                   int32_t* outOffset = 0);
   void IsPrevCharInNodeWhitespace(nsIContent* aContent, int32_t aOffset,
                                   bool* outIsSpace, bool* outIsNBSP,
@@ -950,24 +953,26 @@ class HTMLEditor final : public TextEdit
   virtual ~HTMLEditor();
 
   /**
    * InsertParagraphSeparatorAsSubAction() inserts a line break if it's
    * HTMLEditor and it's possible.
    */
   nsresult InsertParagraphSeparatorAsSubAction();
 
+  MOZ_CAN_RUN_SCRIPT
   virtual nsresult SelectAllInternal() override;
 
   /**
    * SelectContentInternal() sets Selection to aContentToSelect to
    * aContentToSelect + 1 in parent of aContentToSelect.
    *
    * @param aContentToSelect    The content which should be selected.
    */
+  MOZ_CAN_RUN_SCRIPT
   nsresult SelectContentInternal(nsIContent& aContentToSelect);
 
   /**
    * CollapseSelectionAfter() collapses Selection after aElement.
    * If aElement is an orphan node or not in editing host, returns error.
    */
   nsresult CollapseSelectionAfter(Element& aElement);
 
@@ -1516,16 +1521,17 @@ class HTMLEditor final : public TextEdit
   nsresult SetHTMLBackgroundColorWithTransaction(const nsAString& aColor);
 
   virtual void InitializeSelectionAncestorLimit(
       nsIContent& aAncestorLimit) override;
 
   /**
    * Make the given selection span the entire document.
    */
+  MOZ_CAN_RUN_SCRIPT
   virtual nsresult SelectEntireDocument() override;
 
   /**
    * Use this to assure that selection is set after attribute nodes when
    * trying to collapse selection at begining of a block node
    * e.g., when setting at beginning of a table cell
    * This will stop at a table, however, since we don't want to
    * "drill down" into nested tables.
@@ -1658,16 +1664,17 @@ class HTMLEditor final : public TextEdit
 
   virtual already_AddRefed<Element> GetInputEventTargetElement() override;
 
   /**
    * Return TRUE if aElement is a table-related elemet and caret was set.
    */
   bool SetCaretInTableCell(dom::Element* aElement);
 
+  MOZ_CAN_RUN_SCRIPT
   nsresult TabInTable(bool inIsShift, bool* outHandled);
 
   /**
    * InsertPosition is an enum to indicate where the method should insert to.
    */
   enum class InsertPosition {
     // Before selected cell or a cell containing first selection range.
     eBeforeSelectedCell,
@@ -1689,46 +1696,49 @@ class HTMLEditor final : public TextEdit
    * for keeping table rectangle.
    * If first selection range is not in table cell element, this does nothing
    * but does not return error.
    *
    * @param aNumberOfCellssToInsert     Number of cells to insert.
    * @param aInsertPosition             Before or after the target cell which
    *                                    contains first selection range.
    */
+  MOZ_CAN_RUN_SCRIPT
   nsresult InsertTableCellsWithTransaction(int32_t aNumberOfCellsToInsert,
                                            InsertPosition aInsertPosition);
 
   /**
    * InsertTableColumnsWithTransaction() inserts columns before or after
    * a cell element containing first selection range.  I.e., if the cell
    * spans columns and aInsertPosition is eAfterSelectedCell, new columns
    * will be inserted after the right-most row which contains the cell.
    * If first selection range is not in table cell element, this does nothing
    * but does not return error.
    *
    * @param aNumberOfColumnsToInsert    Number of columns to insert.
    * @param aInsertPosition             Before or after the target cell which
    *                                    contains first selection range.
    */
+  MOZ_CAN_RUN_SCRIPT
   nsresult InsertTableColumnsWithTransaction(int32_t aNumberOfColumnsToInsert,
                                              InsertPosition aInsertPosition);
 
   /**
    * InsertTableRowsWithTransaction() inserts <tr> elements before or after
    * a cell element containing first selection range.  I.e., if the cell
    * spans rows and aInsertPosition is eAfterSelectedCell, new rows will be
    * inserted after the most-bottom row which contains the cell.  If first
    * selection range is not in table cell element, this does nothing but
    * does not return error.
    *
    * @param aNumberOfRowsToInsert       Number of rows to insert.
    * @param aInsertPosition             Before or after the target cell which
    *                                    contains first selection range.
    */
+  MOZ_CAN_RUN_SCRIPT
   nsresult InsertTableRowsWithTransaction(int32_t aNumberOfRowsToInsert,
                                           InsertPosition aInsertPosition);
 
   /**
    * Insert a new cell after or before supplied aCell.
    * Optional: If aNewCell supplied, returns the newly-created cell (addref'd,
    * of course)
    * This doesn't change or use the current selection.
@@ -1748,31 +1758,33 @@ class HTMLEditor final : public TextEdit
    * If selection is not in a cell element, this does not return error,
    * just does nothing.
    * WARNING: This does not remove <col> nor <colgroup> elements.
    *
    * @param aNumberOfColumnsToDelete    Number of columns to remove.  This is
    *                                    ignored if 2 ore more cells are
    *                                    selected.
    */
+  MOZ_CAN_RUN_SCRIPT
   nsresult DeleteSelectedTableColumnsWithTransaction(
       int32_t aNumberOfColumnsToDelete);
 
   /**
    * DeleteTableColumnWithTransaction() removes cell elements which belong
    * to the specified column.
    * This method adjusts colspan attribute value if cells spanning the
    * column to delete.
    * WARNING: This does not remove <col> nor <colgroup> elements.
    *
    * @param aTableElement       The <table> element which contains the
    *                            column which you want to remove.
    * @param aRowIndex           Index of the column which you want to remove.
    *                            0 is the first column.
    */
+  MOZ_CAN_RUN_SCRIPT
   nsresult DeleteTableColumnWithTransaction(Element& aTableElement,
                                             int32_t aColumnIndex);
 
   /**
    * DeleteSelectedTableRowsWithTransaction() removes <tr> elements.
    * If only one cell element is selected or first selection range is
    * in a cell, removes <tr> elements starting from a <tr> element
    * containing the selected cell or first selection range.
@@ -1781,30 +1793,32 @@ class HTMLEditor final : public TextEdit
    * is ignored.
    * If there is no selection ranges, returns error.
    * If selection is not in a cell element, this does not return error,
    * just does nothing.
    *
    * @param aNumberOfRowsToDelete   Number of rows to remove.  This is ignored
    *                                if 2 or more cells are selected.
    */
+  MOZ_CAN_RUN_SCRIPT
   nsresult DeleteSelectedTableRowsWithTransaction(
       int32_t aNumberOfRowsToDelete);
 
   /**
    * DeleteTableRowWithTransaction() removes a <tr> element whose index in
    * the <table> is aRowIndex.
    * This method adjusts rowspan attribute value if the <tr> element contains
    * cells which spans rows.
    *
    * @param aTableElement       The <table> element which contains the
    *                            <tr> element which you want to remove.
    * @param aRowIndex           Index of the <tr> element which you want to
    *                            remove.  0 is the first row.
    */
+  MOZ_CAN_RUN_SCRIPT
   nsresult DeleteTableRowWithTransaction(Element& aTableElement,
                                          int32_t aRowIndex);
 
   /**
    * DeleteTableCellWithTransaction() removes table cell elements.  If two or
    * more cell elements are selected, this removes all selected cell elements.
    * Otherwise, this removes some cell elements starting from selected cell
    * element or a cell containing first selection range.  When this removes
@@ -1812,16 +1826,17 @@ class HTMLEditor final : public TextEdit
    * <table> too.  Note that when removing a cell causes number of its row
    * becomes less than the others, this method does NOT fill the place with
    * rowspan nor colspan.  This does not return error even if selection is not
    * in cell element, just does nothing.
    *
    * @param aNumberOfCellsToDelete  Number of cells to remove.  This is ignored
    *                                if 2 or more cells are selected.
    */
+  MOZ_CAN_RUN_SCRIPT
   nsresult DeleteTableCellWithTransaction(int32_t aNumberOfCellsToDelete);
 
   /**
    * DeleteAllChildrenWithTransaction() removes all children of aElement from
    * the tree.
    *
    * @param aElement        The element whose children you want to remove.
    */
@@ -2115,16 +2130,17 @@ class HTMLEditor final : public TextEdit
    *                    row (ePreviousRow) or don't search for another cell
    *                    (aNoSearch).  If no cell is found, caret is place just
    *                    before table; and if that fails, at beginning of
    *                    document.  Thus we generally don't worry about the
    *                    return value and can use the
    *                    AutoSelectionSetterAfterTableEdit stack-based object to
    *                    insure we reset the caret in a table-editing method.
    */
+  MOZ_CAN_RUN_SCRIPT
   void SetSelectionAfterTableEdit(Element* aTable, int32_t aRow, int32_t aCol,
                                   int32_t aDirection, bool aSelected);
 
   void RemoveListenerAndDeleteRef(const nsAString& aEvent,
                                   nsIDOMEventListener* aListener,
                                   bool aUseCapture, ManualNACPtr aElement,
                                   PresShell* aPresShell);
   void DeleteRefToAnonymousNode(ManualNACPtr aContent, PresShell* aPresShell);
--- a/editor/libeditor/HTMLEditorEventListener.cpp
+++ b/editor/libeditor/HTMLEditorEventListener.cpp
@@ -253,17 +253,17 @@ nsresult HTMLEditorEventListener::MouseD
   // point.  Then, we won't be able to commit the composition.
   if (!EnsureCommitComposition()) {
     return NS_OK;
   }
 
   WidgetMouseEvent* mousedownEvent =
       aMouseEvent->WidgetEventPtr()->AsMouseEvent();
 
-  HTMLEditor* htmlEditor = mEditorBase->AsHTMLEditor();
+  RefPtr<HTMLEditor> htmlEditor = mEditorBase->AsHTMLEditor();
   MOZ_ASSERT(htmlEditor);
 
   // Contenteditable should disregard mousedowns outside it.
   // IsAcceptableInputEvent() checks it for a mouse event.
   if (!htmlEditor->IsAcceptableInputEvent(mousedownEvent)) {
     return EditorEventListener::MouseDown(aMouseEvent);
   }
 
--- a/editor/libeditor/HTMLTableEditor.cpp
+++ b/editor/libeditor/HTMLTableEditor.cpp
@@ -58,20 +58,22 @@ class MOZ_STACK_CLASS AutoSelectionSette
                                     int32_t aDirection, bool aSelected)
       : mHTMLEditor(&aHTMLEditor),
         mTable(aTable),
         mCol(aCol),
         mRow(aRow),
         mDirection(aDirection),
         mSelected(aSelected) {}
 
+  MOZ_CAN_RUN_SCRIPT
   ~AutoSelectionSetterAfterTableEdit() {
     if (mHTMLEditor) {
-      mHTMLEditor->SetSelectionAfterTableEdit(mTable, mRow, mCol, mDirection,
-                                              mSelected);
+      MOZ_KnownLive(mHTMLEditor)
+          ->SetSelectionAfterTableEdit(MOZ_KnownLive(mTable), mRow, mCol,
+                                       mDirection, mSelected);
     }
   }
 
   // This is needed to abort the caret reset in the destructor
   // when one method yields control to another
   void CancelSetCaret() {
     mHTMLEditor = nullptr;
     mTable = nullptr;
--- a/editor/libeditor/TextEditRules.cpp
+++ b/editor/libeditor/TextEditRules.cpp
@@ -1700,30 +1700,24 @@ nsresult TextEditRules::HideLastPassword
     return NS_OK;
   }
 
   selNode->GetAsText()->ReplaceData(mLastStart, mLastLength, hiddenText,
                                     IgnoreErrors());
   if (NS_WARN_IF(!CanHandleEditAction())) {
     return NS_ERROR_EDITOR_DESTROYED;
   }
-  // XXXbz Selection::Collapse/Extend take int32_t, but there are tons of
-  // callsites... Converting all that is a battle for another day.
-  DebugOnly<nsresult> rv = SelectionRefPtr()->Collapse(selNode, start);
+  IgnoredErrorResult ignoredError;
+  MOZ_KnownLive(SelectionRefPtr())
+      ->SetStartAndEndInLimiter(RawRangeBoundary(selNode, start),
+                                RawRangeBoundary(selNode, end), ignoredError);
   if (NS_WARN_IF(!CanHandleEditAction())) {
     return NS_ERROR_EDITOR_DESTROYED;
   }
-  NS_WARNING_ASSERTION(NS_SUCCEEDED(rv), "Failed to collapse selection");
-  if (start != end) {
-    rv = SelectionRefPtr()->Extend(selNode, end);
-    if (NS_WARN_IF(!CanHandleEditAction())) {
-      return NS_ERROR_EDITOR_DESTROYED;
-    }
-    NS_WARNING_ASSERTION(NS_SUCCEEDED(rv), "Failed to extend selection");
-  }
+  NS_WARNING_ASSERTION(!ignoredError.Failed(), "Failed to set selection");
   return NS_OK;
 }
 
 // static
 void TextEditRules::FillBufWithPWChars(nsAString* aOutString, int32_t aLength) {
   MOZ_ASSERT(aOutString);
 
   // change the output to the platform password character
--- a/editor/libeditor/TextEditor.cpp
+++ b/editor/libeditor/TextEditor.cpp
@@ -1193,28 +1193,35 @@ nsresult TextEditor::SetTextAsSubAction(
     return NS_OK;
   }
   if (!handled) {
     // Note that do not notify selectionchange caused by selecting all text
     // because it's preparation of our delete implementation so web apps
     // shouldn't receive such selectionchange before the first mutation.
     AutoUpdateViewBatch preventSelectionChangeEvent(*this);
 
+    Element* rootElement = GetRoot();
+    if (NS_WARN_IF(!rootElement)) {
+      return NS_ERROR_FAILURE;
+    }
+
     // We want to select trailing BR node to remove all nodes to replace all,
     // but TextEditor::SelectEntireDocument doesn't select that BR node.
     if (rules->DocumentIsEmpty()) {
-      // if it's empty, don't select entire doc - that would select
-      // the bogus node
-      Element* rootElement = GetRoot();
-      if (NS_WARN_IF(!rootElement)) {
-        return NS_ERROR_FAILURE;
-      }
       rv = SelectionRefPtr()->Collapse(rootElement, 0);
+      NS_WARNING_ASSERTION(
+          NS_SUCCEEDED(rv),
+          "Failed to move caret to start of the editor root element");
     } else {
-      rv = EditorBase::SelectEntireDocument();
+      ErrorResult error;
+      SelectionRefPtr()->SelectAllChildren(*rootElement, error);
+      NS_WARNING_ASSERTION(
+          !error.Failed(),
+          "Failed to select all children of the editor root element");
+      rv = error.StealNSResult();
     }
     if (NS_SUCCEEDED(rv)) {
       rv = ReplaceSelectionAsSubAction(aString);
       NS_WARNING_ASSERTION(NS_SUCCEEDED(rv),
                            "Failed to replace selection with new string");
     }
   }
   // post-process
@@ -2138,56 +2145,62 @@ void TextEditor::OnEndHandlingTopLevelEd
 
 nsresult TextEditor::SelectEntireDocument() {
   MOZ_ASSERT(IsEditActionDataAvailable());
 
   if (!mRules) {
     return NS_ERROR_NULL_POINTER;
   }
 
+  Element* rootElement = GetRoot();
+  if (NS_WARN_IF(!rootElement)) {
+    return NS_ERROR_NOT_INITIALIZED;
+  }
+
   // Protect the edit rules object from dying
   RefPtr<TextEditRules> rules(mRules);
 
-  // is doc empty?
+  // If we're empty, don't select all children because that would select the
+  // bogus node.
   if (rules->DocumentIsEmpty()) {
-    // get root node
-    Element* rootElement = GetRoot();
-    if (NS_WARN_IF(!rootElement)) {
-      return NS_ERROR_FAILURE;
-    }
-
-    // if it's empty don't select entire doc - that would select the bogus node
-    return SelectionRefPtr()->Collapse(rootElement, 0);
-  }
-
-  SelectionBatcher selectionBatcher(SelectionRefPtr());
-  nsresult rv = EditorBase::SelectEntireDocument();
-  if (NS_WARN_IF(NS_FAILED(rv))) {
+    nsresult rv = SelectionRefPtr()->Collapse(rootElement, 0);
+    NS_WARNING_ASSERTION(
+        NS_SUCCEEDED(rv),
+        "Failed to move caret to start of the editor root element");
     return rv;
   }
 
   // Don't select the trailing BR node if we have one
   nsCOMPtr<nsIContent> childNode;
-  rv = EditorBase::GetEndChildNode(*SelectionRefPtr(),
-                                   getter_AddRefs(childNode));
+  nsresult rv = EditorBase::GetEndChildNode(*SelectionRefPtr(),
+                                            getter_AddRefs(childNode));
   if (NS_WARN_IF(NS_FAILED(rv))) {
     return rv;
   }
   if (childNode) {
     childNode = childNode->GetPreviousSibling();
   }
 
   if (childNode && TextEditUtils::IsMozBR(childNode)) {
-    int32_t parentOffset;
-    nsINode* parentNode = GetNodeLocation(childNode, &parentOffset);
-
-    return SelectionRefPtr()->Extend(parentNode, parentOffset);
+    ErrorResult error;
+    MOZ_KnownLive(SelectionRefPtr())
+        ->SetStartAndEndInLimiter(RawRangeBoundary(rootElement, 0),
+                                  EditorRawDOMPoint(childNode), error);
+    NS_WARNING_ASSERTION(!error.Failed(),
+                         "Failed to select all children of the editor root "
+                         "element except the moz-<br> element");
+    return error.StealNSResult();
   }
 
-  return NS_OK;
+  ErrorResult error;
+  SelectionRefPtr()->SelectAllChildren(*rootElement, error);
+  NS_WARNING_ASSERTION(
+      !error.Failed(),
+      "Failed to select all children of the editor root element");
+  return error.StealNSResult();
 }
 
 EventTarget* TextEditor::GetDOMEventTarget() { return mEventTarget; }
 
 nsresult TextEditor::SetAttributeOrEquivalent(Element* aElement,
                                               nsAtom* aAttribute,
                                               const nsAString& aValue,
                                               bool aSuppressTransaction) {
--- a/editor/libeditor/TextEditor.h
+++ b/editor/libeditor/TextEditor.h
@@ -100,16 +100,17 @@ class TextEditor : public EditorBase, pu
   bool IsEmpty() const {
     bool isEmpty = false;
     nsresult rv = IsEmpty(&isEmpty);
     NS_WARNING_ASSERTION(NS_SUCCEEDED(rv),
                          "Checking whether the editor is empty failed");
     return NS_SUCCEEDED(rv) && isEmpty;
   }
 
+  MOZ_CAN_RUN_SCRIPT
   virtual nsresult HandleKeyPressEvent(
       WidgetKeyboardEvent* aKeyboardEvent) override;
 
   virtual dom::EventTarget* GetDOMEventTarget() override;
 
   /**
    * PasteAsAction() pastes clipboard content to Selection.  This method
    * may dispatch ePaste event first.  If its defaultPrevent() is called,
@@ -168,26 +169,28 @@ class TextEditor : public EditorBase, pu
   void SetMaxTextLength(int32_t aLength) { mMaxTextLength = aLength; }
 
   /**
    * Replace existed string with a string.
    * This is fast path to replace all string when using single line control.
    *
    * @ param aString   the string to be set
    */
+  MOZ_CAN_RUN_SCRIPT
   nsresult SetText(const nsAString& aString);
 
   /**
    * Replace text in aReplaceRange or all text in this editor with aString and
    * treat the change as inserting the string.
    *
    * @param aString             The string to set.
    * @param aReplaceRange       The range to be replaced.
    *                            If nullptr, all contents will be replaced.
    */
+  MOZ_CAN_RUN_SCRIPT
   nsresult ReplaceTextAsAction(const nsAString& aString,
                                nsRange* aReplaceRange = nullptr);
 
   /**
    * InsertLineBreakAsAction() is called when user inputs a line break with
    * Enter or something.
    */
   virtual nsresult InsertLineBreakAsAction();
@@ -360,16 +363,17 @@ class TextEditor : public EditorBase, pu
  protected:  // Shouldn't be used by friend classes
   virtual ~TextEditor();
 
   int32_t WrapWidth() const { return mWrapColumn; }
 
   /**
    * Make the given selection span the entire document.
    */
+  MOZ_CAN_RUN_SCRIPT
   virtual nsresult SelectEntireDocument() override;
 
   /**
    * OnInputText() is called when user inputs text with keyboard or something.
    *
    * @param aStringToInsert     The string to insert.
    */
   nsresult OnInputText(const nsAString& aStringToInsert);
--- a/editor/libeditor/tests/test_bug430392.html
+++ b/editor/libeditor/tests/test_bug430392.html
@@ -33,19 +33,17 @@ function test() {
   // it's neither the original value nor expectedValue.
   var tests = [["adding returns", () => {
     getSelection().collapse(edit.firstChild, 0);
     synthesizeKey("KEY_ArrowRight");
     synthesizeKey("KEY_Enter");
     synthesizeKey("KEY_Enter");
     synthesizeKey("KEY_Backspace");
     synthesizeKey("KEY_Backspace");
-  // For some reason this test fails if the separator is not "br"
-  }, () => document.queryCommandValue("defaultParagraphSeparator") == "br"
-           ? undefined : " A; B ; C "],
+  }],
   ["adding shift-returns", () => {
     getSelection().collapse(edit.firstChild, 0);
     synthesizeKey("KEY_ArrowRight");
     synthesizeKey("KEY_Enter", {shiftKey: true});
     synthesizeKey("KEY_Enter", {shiftKey: true});
     synthesizeKey("KEY_Backspace");
     synthesizeKey("KEY_Backspace");
   }]];
--- a/editor/nsIEditor.idl
+++ b/editor/nsIEditor.idl
@@ -300,16 +300,17 @@ interface nsIEditor  : nsISupports
   /** Can we paste? True if the doc is modifiable, and we have
     * pasteable data in the clipboard.
     */
   boolean canPaste(in long aSelectionType);
 
   /* ------------ Selection methods -------------- */
 
   /** sets the document selection to the entire contents of the document */
+  [can_run_script]
   void selectAll();
 
   /**
    * Collapses selection at start of the document.  If it's an HTML editor,
    * collapses selection at start of current editing host (<body> element if
    * it's in designMode) instead.  If there is a non-editable node before any
    * editable text nodes or inline elements which can have text nodes as their
    * children, collapses selection at start of the editing host.  If there is
--- a/editor/nsIEditorMailSupport.idl
+++ b/editor/nsIEditorMailSupport.idl
@@ -25,11 +25,12 @@ interface nsIEditorMailSupport : nsISupp
   Node insertAsCitedQuotation(in AString aQuotedText,
                               in AString aCitation,
                               in boolean aInsertHTML);
 
   /**
    * Rewrap the selected part of the document, re-quoting if necessary.
    * @param aRespectNewlines  Try to maintain newlines in the original?
    */
+  [can_run_script]
   void rewrap(in boolean aRespectNewlines);
 };
 
--- a/editor/nsIEditorSpellCheck.idl
+++ b/editor/nsIEditorSpellCheck.idl
@@ -31,16 +31,17 @@ interface nsIEditorSpellCheck : nsISuppo
 
   /**
    * When interactively spell checking the document, this will return the
    * value of the next word that is misspelled. This also computes the
    * suggestions which you can get by calling GetSuggestedWord.
    *
    * @see mozSpellChecker::GetNextMisspelledWord
    */
+  [can_run_script]
   AString       GetNextMisspelledWord();
 
   /**
    * Used to get suggestions for the last word that was checked and found to
    * be misspelled. The first call will give you the first (best) suggestion.
    * Subsequent calls will iterate through all the suggestions, allowing you
    * to build a list. When there are no more suggestions, an empty string
    * (not a null pointer) will be returned.
@@ -59,16 +60,17 @@ interface nsIEditorSpellCheck : nsISuppo
    */
   boolean       CheckCurrentWord(in AString suggestedWord);
 
   /**
    * Use when modally checking the document to replace a word.
    *
    * @see mozSpellChecker::CheckCurrentWord
    */
+  [can_run_script]
   void          ReplaceWord(in AString misspelledWord, in AString replaceWord, in boolean allOccurrences);
 
   /**
    * @see mozSpellChecker::IgnoreAll
    */
   void          IgnoreWordAllOccurrences(in AString word);
 
   /**
--- a/editor/nsIHTMLEditor.idl
+++ b/editor/nsIHTMLEditor.idl
@@ -142,16 +142,17 @@ interface nsIHTMLEditor : nsISupports
   void pasteNoFormatting(in long aSelectionType);
 
   /**
    *  Rebuild the entire document from source HTML
    *  Needed to be able to edit HEAD and other outside-of-BODY content
    *
    *  @param aSourceString   HTML source string of the entire new document
    */
+  [can_run_script]
   void rebuildDocumentFromSource(in AString aSourceString);
 
   /**
     * Insert an element, which may have child nodes, at the selection
     * Used primarily to insert a new element for various insert element dialogs,
     *   but it enforces the HTML 4.0 DTD "CanContain" rules, so it should
     *   be useful for other elements.
     *
@@ -177,16 +178,17 @@ interface nsIHTMLEditor : nsISupports
   /* ------------ Selection manipulation -------------- */
   /* Should these be moved to Selection? */
 
   /**
     * Set the selection at the suppled element
     *
     * @param aElement   An element in the document
     */
+  [can_run_script]
   void selectElement(in Element aElement);
 
   /**
     * Create a collapsed selection just after aElement
     *
     * XXX could we parameterize SelectElement(before/select/after>?
     *
     * The selection is set to parent-of-aElement with an
--- a/editor/nsITableEditor.idl
+++ b/editor/nsITableEditor.idl
@@ -32,84 +32,90 @@ interface nsITableEditor : nsISupports
    * If first selection range is not in table cell element, this does nothing
    * without exception.
    *
    * @param aNumberOfCellssToInsert     Number of cells to insert.
    * @param aInsertAfterSelectedCell    true if new cells should be inserted
    *                                    before current cell.  Otherwise, will
    *                                    be inserted after the cell.
    */
+  [can_run_script]
   void insertTableCell(in long aNumberOfColumnsToInsert,
                        in boolean aInsertAfterSelectedCell);
 
   /**
    * insertTableColumn() inserts columns before or after a cell element
    * containing first selection range.  I.e., if the cell spans columns and
    * aInsertAfterSelectedCell is tre, new columns will be inserted after the
    * right-most column which contains the cell.  If first selection range is
    * not in table cell element, this does nothing without exception.
    *
    * @param aNumberOfColumnsToInsert    Number of columns to insert.
    * @param aInsertAfterSelectedCell    true if new columns will be inserted
    *                                    before current cell.  Otherwise, will
    *                                    be inserted after the cell.
    */
+  [can_run_script]
   void insertTableColumn(in long aNumberOfColumnsToInsert,
                          in boolean aInsertAfterSelectedCell);
 
   /*
    * insertTableRow() inserts <tr> elements before or after a <td> element
    * containing first selection range.  I.e., if the cell spans rows and
    * aInsertAfterSelectedCell is true, new rows will be inserted after the
    * bottom-most row which contains the cell.  If first selection range is
    * not in table cell element, this does nothing without exception.
    *
    * @param aNumberOfRowsToInsert       Number of rows to insert.
    * @param aInsertAfterSelectedCell    true if new rows will be inserted
    *                                    before current cell.  Otherwise, will
    *                                    be inserted after the cell.
    */
+  [can_run_script]
   void insertTableRow(in long aNumberOfRowsToInsert,
                       in boolean aInsertAfterSelectedCell);
 
   /** Delete table methods
     * Delete starting at the selected cell or the
     *  cell (or table) enclosing the selection anchor
     * The selection is collapsed and is left in the
     *  cell at the same row,col location as
     *  the previous selection anchor, if possible,
     *  else in the closest neigboring cell
     *
     * @param aNumber    Number of items to insert/delete
     */
+  [can_run_script]
   void deleteTable();
 
   /**
    * deleteTableCellContents() removes any contents in cell elements.  If two
    * or more cell elements are selected, this removes all selected cells'
    * contents.  Otherwise, this removes contents of a cell which contains
    * first selection range.  This does nothing without exception if selection
    * is not in cell element.
    */
+  [can_run_script]
   void deleteTableCellContents();
 
   /**
    * deleteTableCell() removes table cell elements.  If two or more cell
    * elements are selected, this removes all selected cell elements.
    * Otherwise, this removes some cell elements starting from selected cell
    * element or a cell containing first selection range.  When this removes
    * last cell element in <tr> or <table>, this removes the <tr> or the
    * <table> too.  Note that when removing a cell causes number of its row
    * becomes less than the others, this method does NOT fill the place with
    * rowspan nor colspan.  This does nothing without exception if selection is
    * not in cell element.
    *
    * @param aNumberOfCellsToDelete  Number of cells to remove.  This is ignored
    *                                if 2 or more cells are selected.
    */
+  [can_run_script]
   void deleteTableCell(in long aNumberOfCellsToDelete);
 
   /**
    * deleteTableColumn() removes cell elements which belong to same columns
    * of selected cell elements.
    * If only one cell element is selected or first selection range is
    * in a cell, removes cell elements which belong to same column.
    * If 2 or more cell elements are selected, removes cell elements which
@@ -119,16 +125,17 @@ interface nsITableEditor : nsISupports
    * If selection is not in a cell element, just does nothing without
    * throwing exception.
    * WARNING: This does not remove <col> nor <colgroup> elements.
    *
    * @param aNumberOfColumnsToDelete    Number of columns to remove.  This is
    *                                    ignored if 2 ore more cells are
    *                                    selected.
    */
+  [can_run_script]
   void deleteTableColumn(in long aNumberOfColumnsToDelete);
 
   /**
    * deleteTableRow() removes <tr> elements.
    * If only one cell element is selected or first selection range is
    * in a cell, removes <tr> elements starting from a <tr> element
    * containing the selected cell or first selection range.
    * If 2 or more cell elements are selected, all <tr> elements
@@ -136,48 +143,56 @@ interface nsITableEditor : nsISupports
    * is ignored.
    * If there is no selection ranges, throws exception.
    * If selection is not in a cell element, just does nothing without
    * throwing exception.
    *
    * @param aNumberOfRowsToDelete   Number of rows to remove.  This is ignored
    *                                if 2 or more cells are selected.
    */
+  [can_run_script]
   void deleteTableRow(in long aNumberOfRowsToDelete);
 
   /** Table Selection methods
     * Selecting a row or column actually
     * selects all cells (not TR in the case of rows)
     */
+  [can_run_script]
   void selectTableCell();
 
   /** Select a rectangular block of cells:
     *  all cells falling within the row/column index of aStartCell
     *  to through the row/column index of the aEndCell
     *  aStartCell can be any location relative to aEndCell,
     *   as long as they are in the same table
     *  @param aStartCell  starting cell in block
     *  @param aEndCell    ending cell in block
     */
+  [can_run_script]
   void selectBlockOfCells(in Element aStartCell,
                           in Element aEndCell);
 
+  [can_run_script]
   void selectTableRow();
+  [can_run_script]
   void selectTableColumn();
+  [can_run_script]
   void selectTable();
+  [can_run_script]
   void selectAllTableCells();
 
   /** Create a new TD or TH element, the opposite type of the supplied aSourceCell
     *   1. Copy all attributes from aSourceCell to the new cell
     *   2. Move all contents of aSourceCell to the new cell
     *   3. Replace aSourceCell in the table with the new cell
     *
     *  @param aSourceCell   The cell to be replaced
     *  @return              The new cell that replaces aSourceCell
     */
+  [can_run_script]
   Element switchTableCellHeaderType(in Element aSourceCell);
 
   /** Merges contents of all selected cells
     * for selected cells that are adjacent,
     * this will result in a larger cell with appropriate
     * rowspan and colspan, and original cells are deleted
     * The resulting cell is in the location of the
     *   cell at the upper-left corner of the adjacent
@@ -190,36 +205,39 @@ interface nsITableEditor : nsISupports
     *         to the upper-left cell
     *       If false: contiguous cells are ignored
     *
     * If there are no selected cells,
     *   and selection or caret is in a cell,
     *   that cell and the one to the right
     *   are merged
     */
+  [can_run_script]
   void joinTableCells(in boolean aMergeNonContiguousContents);
 
   /** Split a cell that has rowspan and/or colspan > 0
     *   into cells such that all new cells have
     *   rowspan = 1 and colspan = 1
     *  All of the contents are not touched --
     *   they will appear to be in the upper-left cell
     */
+  [can_run_script]
   void splitTableCell();
 
   /** Scan through all rows and add cells as needed so
     *   all locations in the cellmap are occupied.
     *   Used after inserting single cells or pasting
     *   a collection of cells that extend past the
     *   previous size of the table
     * If aTable is null, it uses table enclosing the selection anchor
     * This doesn't doesn't change the selection,
     *   thus it can be used to fixup all tables
     *   in a page independent of the selection
     */
+  [can_run_script]
   void normalizeTable(in Element aTable);
 
   /**
    * getCellIndexes() computes row index and column index of a table cell.
    * Note that this depends on layout information.  Therefore, all pending
    * layout should've been flushed before calling this.
    *
    * @param aCellElement        If not null, this computes indexes of the cell.
--- a/editor/spellchecker/EditorSpellCheck.cpp
+++ b/editor/spellchecker/EditorSpellCheck.cpp
@@ -402,18 +402,19 @@ EditorSpellCheck::InitSpellChecker(nsIEd
 
 NS_IMETHODIMP
 EditorSpellCheck::GetNextMisspelledWord(nsAString& aNextMisspelledWord) {
   NS_ENSURE_TRUE(mSpellChecker, NS_ERROR_NOT_INITIALIZED);
 
   DeleteSuggestedWordList();
   // Beware! This may flush notifications via synchronous
   // ScrollSelectionIntoView.
-  return mSpellChecker->NextMisspelledWord(aNextMisspelledWord,
-                                           &mSuggestedWordList);
+  RefPtr<mozSpellChecker> spellChecker(mSpellChecker);
+  return spellChecker->NextMisspelledWord(aNextMisspelledWord,
+                                          &mSuggestedWordList);
 }
 
 NS_IMETHODIMP
 EditorSpellCheck::GetSuggestedWord(nsAString& aSuggestedWord) {
   // XXX This is buggy if mSuggestedWordList.Length() is over INT32_MAX.
   if (mSuggestedWordIndex < static_cast<int32_t>(mSuggestedWordList.Length())) {
     aSuggestedWord = mSuggestedWordList[mSuggestedWordIndex];
     mSuggestedWordIndex++;
@@ -445,17 +446,18 @@ RefPtr<CheckWordPromise> EditorSpellChec
 }
 
 NS_IMETHODIMP
 EditorSpellCheck::ReplaceWord(const nsAString& aMisspelledWord,
                               const nsAString& aReplaceWord,
                               bool aAllOccurrences) {
   NS_ENSURE_TRUE(mSpellChecker, NS_ERROR_NOT_INITIALIZED);
 
-  return mSpellChecker->Replace(aMisspelledWord, aReplaceWord, aAllOccurrences);
+  RefPtr<mozSpellChecker> spellChecker(mSpellChecker);
+  return spellChecker->Replace(aMisspelledWord, aReplaceWord, aAllOccurrences);
 }
 
 NS_IMETHODIMP
 EditorSpellCheck::IgnoreWordAllOccurrences(const nsAString& aWord) {
   NS_ENSURE_TRUE(mSpellChecker, NS_ERROR_NOT_INITIALIZED);
 
   return mSpellChecker->IgnoreAll(aWord);
 }
--- a/editor/spellchecker/TextServicesDocument.cpp
+++ b/editor/spellchecker/TextServicesDocument.cpp
@@ -1661,17 +1661,20 @@ bool TextServicesDocument::HasSameBlockN
 bool TextServicesDocument::IsTextNode(nsIContent* aContent) {
   NS_ENSURE_TRUE(aContent, false);
   return nsINode::TEXT_NODE == aContent->NodeType();
 }
 
 nsresult TextServicesDocument::SetSelectionInternal(int32_t aOffset,
                                                     int32_t aLength,
                                                     bool aDoUpdate) {
-  NS_ENSURE_TRUE(mSelCon && aOffset >= 0 && aLength >= 0, NS_ERROR_FAILURE);
+  if (NS_WARN_IF(!mSelCon) || NS_WARN_IF(aOffset < 0) ||
+      NS_WARN_IF(aLength < 0)) {
+    return NS_ERROR_INVALID_ARG;
+  }
 
   nsCOMPtr<nsINode> startNode;
   int32_t startNodeOffset = 0;
   OffsetEntry* entry;
 
   // Find start of selection in node offset terms:
 
   for (size_t i = 0; !startNode && i < mOffsetTable.Length(); i++) {
@@ -1723,36 +1726,32 @@ nsresult TextServicesDocument::SetSelect
   }
 
   NS_ENSURE_TRUE(startNode, NS_ERROR_FAILURE);
 
   // XXX: If we ever get a SetSelection() method in nsIEditor, we should
   //      use it.
 
   RefPtr<Selection> selection;
-
   if (aDoUpdate) {
     selection = mSelCon->GetSelection(nsISelectionController::SELECTION_NORMAL);
-    NS_ENSURE_STATE(selection);
-
-    nsresult rv = selection->Collapse(startNode, startNodeOffset);
-    NS_ENSURE_SUCCESS(rv, rv);
+    if (NS_WARN_IF(!selection)) {
+      return NS_ERROR_FAILURE;
+    }
   }
 
-  if (aLength <= 0) {
-    // We have a collapsed selection. (Caret)
-
+  if (!aLength) {
+    if (aDoUpdate) {
+      nsresult rv = selection->Collapse(startNode, startNodeOffset);
+      if (NS_WARN_IF(NS_FAILED(rv))) {
+        return rv;
+      }
+    }
     mSelEndIndex = mSelStartIndex;
     mSelEndOffset = mSelStartOffset;
-
-    //**** KDEBUG ****
-    // printf("\n* Sel: (%2d, %4d) (%2d, %4d)\n", mSelStartIndex,
-    //        mSelStartOffset, mSelEndIndex, mSelEndOffset);
-    //**** KDEBUG ****
-
     return NS_OK;
   }
 
   // Find the end of the selection in node offset terms:
   nsCOMPtr<nsINode> endNode;
   int32_t endNodeOffset = 0;
   int32_t endOffset = aOffset + aLength;
   for (int32_t i = mOffsetTable.Length() - 1; !endNode && i >= 0; i--) {
@@ -1775,28 +1774,32 @@ nsresult TextServicesDocument::SetSelect
 
       if (endNode) {
         mSelEndIndex = i;
         mSelEndOffset = endOffset;
       }
     }
   }
 
-  if (aDoUpdate && endNode) {
-    nsresult rv = selection->Extend(endNode, endNodeOffset);
-
-    NS_ENSURE_SUCCESS(rv, rv);
+  if (!aDoUpdate) {
+    return NS_OK;
   }
 
-  //**** KDEBUG ****
-  // printf("\n * Sel: (%2d, %4d) (%2d, %4d)\n", mSelStartIndex,
-  //        mSelStartOffset, mSelEndIndex, mSelEndOffset);
-  //**** KDEBUG ****
-
-  return NS_OK;
+  if (!endNode) {
+    nsresult rv = selection->Collapse(startNode, startNodeOffset);
+    NS_WARNING_ASSERTION(NS_SUCCEEDED(rv), "Failed to collapse selection");
+    return rv;
+  }
+
+  ErrorResult error;
+  selection->SetStartAndEndInLimiter(
+      RawRangeBoundary(startNode, startNodeOffset),
+      RawRangeBoundary(endNode, endNodeOffset), error);
+  NS_WARNING_ASSERTION(!error.Failed(), "Failed to set selection");
+  return error.StealNSResult();
 }
 
 nsresult TextServicesDocument::GetSelection(BlockSelectionStatus* aSelStatus,
                                             int32_t* aSelOffset,
                                             int32_t* aSelLength) {
   NS_ENSURE_TRUE(aSelStatus && aSelOffset && aSelLength, NS_ERROR_NULL_POINTER);
 
   *aSelStatus = BlockSelectionStatus::eBlockNotFound;
--- a/editor/spellchecker/TextServicesDocument.h
+++ b/editor/spellchecker/TextServicesDocument.h
@@ -145,16 +145,17 @@ class TextServicesDocument final : publi
    * @param aSelectionStatus    [OUT] This will contain the text block
    *                            selection status.
    * @param aSelectionOffset    [OUT] This will contain the offset into the
    *                            string returned by GetCurrentTextBlock() where
    *                            the selection begins.
    * @param aLength             [OUT] This will contain the number of
    *                            characters that are selected in the string.
    */
+  MOZ_CAN_RUN_SCRIPT
   nsresult LastSelectedBlock(BlockSelectionStatus* aSelStatus,
                              int32_t* aSelOffset, int32_t* aSelLength);
 
   /**
    * Tells the document to point to the text block before the current one.
    * This method will return NS_OK, even if there is no previous block.
    * Callers should call IsDone() to check if we have gone beyond the first
    * text block in the document.
@@ -184,34 +185,37 @@ class TextServicesDocument final : publi
    * into the string returned by GetCurrentTextBlock().  A length of zero
    * places the cursor at that offset. A positive non-zero length "n" selects
    * n characters in the string.
    *
    * @param aOffset             Offset into string returned by
    *                            GetCurrentTextBlock().
    * @param aLength             Number of characters selected.
    */
+  MOZ_CAN_RUN_SCRIPT
   nsresult SetSelection(int32_t aOffset, int32_t aLength);
 
   /**
    * Scrolls the document so that the current selection is visible.
    */
   nsresult ScrollSelectionIntoView();
 
   /**
    * Deletes the text selected by SetSelection(). Calling DeleteSelection()
    * with nothing selected, or with a collapsed selection (cursor) does
    * nothing and returns NS_OK.
    */
+  MOZ_CAN_RUN_SCRIPT
   nsresult DeleteSelection();
 
   /**
    * Inserts the given text at the current cursor position.  If there is a
    * selection, it will be deleted before the text is inserted.
    */
+  MOZ_CAN_RUN_SCRIPT
   nsresult InsertText(const nsString* aText);
 
   /**
    * nsIEditActionListener method implementations.
    */
   NS_DECL_NSIEDITACTIONLISTENER
 
   /**
@@ -262,20 +266,23 @@ class TextServicesDocument final : publi
   static bool IsTextNode(nsIContent* aContent);
 
   static bool DidSkip(FilteredContentIterator* aFilteredIter);
   static void ClearDidSkip(FilteredContentIterator* aFilteredIter);
 
   static bool HasSameBlockNodeParent(nsIContent* aContent1,
                                      nsIContent* aContent2);
 
+  MOZ_CAN_RUN_SCRIPT
   nsresult SetSelectionInternal(int32_t aOffset, int32_t aLength,
                                 bool aDoUpdate);
+  MOZ_CAN_RUN_SCRIPT
   nsresult GetSelection(BlockSelectionStatus* aSelStatus, int32_t* aSelOffset,
                         int32_t* aSelLength);
+  MOZ_CAN_RUN_SCRIPT
   nsresult GetCollapsedSelection(BlockSelectionStatus* aSelStatus,
                                  int32_t* aSelOffset, int32_t* aSelLength);
   nsresult GetUncollapsedSelection(BlockSelectionStatus* aSelStatus,
                                    int32_t* aSelOffset, int32_t* aSelLength);
 
   bool SelectionIsCollapsed();
   bool SelectionIsValid();
 
--- a/editor/spellchecker/nsIInlineSpellChecker.idl
+++ b/editor/spellchecker/nsIInlineSpellChecker.idl
@@ -20,16 +20,17 @@ interface nsIInlineSpellChecker : nsISup
   void init(in nsIEditor aEditor);
   void cleanup(in boolean aDestroyingFrames);
 
   attribute boolean enableRealTimeSpell;
 
   void spellCheckRange(in Range aSelection);
 
   Range getMisspelledWord(in Node aNode, in long aOffset);
+  [can_run_script]
   void replaceWord(in Node aNode, in long aOffset, in AString aNewword);
   void addWordToDictionary(in AString aWord);
   void removeWordFromDictionary(in AString aWord);
 
   void ignoreWord(in AString aWord);
   void ignoreWords([array, size_is(aCount)] in wstring aWordsToIgnore, in unsigned long aCount);
   void updateCurrentDictionary();
 
--- a/extensions/permissions/moz.build
+++ b/extensions/permissions/moz.build
@@ -10,9 +10,9 @@ UNIFIED_SOURCES += [
 
 XPCOM_MANIFESTS += [
     'components.conf',
 ]
 
 FINAL_LIBRARY = 'xul'
 
 with Files('**'):
-    BUG_COMPONENT = ('Core', 'DOM')
+    BUG_COMPONENT = ('Core', 'DOM: Core & HTML')
--- a/extensions/spellcheck/src/mozInlineSpellChecker.cpp
+++ b/extensions/spellcheck/src/mozInlineSpellChecker.cpp
@@ -864,17 +864,18 @@ mozInlineSpellChecker::ReplaceWord(nsINo
   RefPtr<nsRange> range;
   nsresult res = GetMisspelledWord(aNode, aOffset, getter_AddRefs(range));
   NS_ENSURE_SUCCESS(res, res);
 
   if (!range) {
     return NS_OK;
   }
 
-  DebugOnly<nsresult> rv = mTextEditor->ReplaceTextAsAction(newword, range);
+  RefPtr<TextEditor> textEditor(mTextEditor);
+  DebugOnly<nsresult> rv = textEditor->ReplaceTextAsAction(newword, range);
   NS_WARNING_ASSERTION(NS_SUCCEEDED(rv), "Failed to insert the new word");
   return NS_OK;
 }
 
 // mozInlineSpellChecker::AddWordToDictionary
 
 NS_IMETHODIMP
 mozInlineSpellChecker::AddWordToDictionary(const nsAString& word) {
--- a/extensions/spellcheck/src/mozSpellChecker.cpp
+++ b/extensions/spellcheck/src/mozSpellChecker.cpp
@@ -95,17 +95,18 @@ nsresult mozSpellChecker::NextMisspelled
     do {
       result = mConverter->FindNextWord(str.get(), str.Length(), selOffset,
                                         &begin, &end);
       if (NS_SUCCEEDED(result) && begin != -1) {
         const nsAString &currWord = Substring(str, begin, end - begin);
         result = CheckWord(currWord, &isMisspelled, aSuggestions);
         if (isMisspelled) {
           aWord = currWord;
-          mTextServicesDocument->SetSelection(begin, end - begin);
+          MOZ_KnownLive(mTextServicesDocument)
+              ->SetSelection(begin, end - begin);
           // After ScrollSelectionIntoView(), the pending notifications might
           // be flushed and PresShell/PresContext/Frames may be dead.
           // See bug 418470.
           mTextServicesDocument->ScrollSelectionIntoView();
           return NS_OK;
         }
       }
       selOffset = end;
@@ -219,18 +220,19 @@ nsresult mozSpellChecker::Replace(const 
             // block move the selection point forwards
             if (currentBlock == startBlock && begin < selOffset) {
               selOffset +=
                   int32_t(aNewWord.Length()) - int32_t(aOldWord.Length());
               if (selOffset < begin) {
                 selOffset = begin;
               }
             }
-            mTextServicesDocument->SetSelection(begin, end - begin);
-            mTextServicesDocument->InsertText(&newWord);
+            MOZ_KnownLive(mTextServicesDocument)
+                ->SetSelection(begin, end - begin);
+            MOZ_KnownLive(mTextServicesDocument)->InsertText(&newWord);
             mTextServicesDocument->GetCurrentTextBlock(&str);
             end += (aNewWord.Length() -
                     aOldWord.Length());  // recursion was cute in GEB, not here.
           }
         }
         currOffset = end;
       } while (currOffset != -1);
       mTextServicesDocument->NextBlock();
@@ -262,23 +264,23 @@ nsresult mozSpellChecker::Replace(const 
       result = mConverter->FindNextWord(str.get(), str.Length(), selOffset,
                                         &begin, &end);
       if (end == -1) {
         mTextServicesDocument->NextBlock();
         selOffset = 0;
         result = mTextServicesDocument->GetCurrentTextBlock(&str);
         result = mConverter->FindNextWord(str.get(), str.Length(), selOffset,
                                           &begin, &end);
-        mTextServicesDocument->SetSelection(begin, 0);
+        MOZ_KnownLive(mTextServicesDocument)->SetSelection(begin, 0);
       } else {
-        mTextServicesDocument->SetSelection(begin, 0);
+        MOZ_KnownLive(mTextServicesDocument)->SetSelection(begin, 0);
       }
     }
   } else {
-    mTextServicesDocument->InsertText(&newWord);
+    MOZ_KnownLive(mTextServicesDocument)->InsertText(&newWord);
   }
   return NS_OK;
 }
 
 nsresult mozSpellChecker::IgnoreAll(const nsAString &aWord) {
   if (mPersonalDictionary) {
     mPersonalDictionary->IgnoreWord(aWord);
   }
@@ -456,18 +458,18 @@ nsresult mozSpellChecker::SetupDoc(int32
   nsresult rv;
 
   TextServicesDocument::BlockSelectionStatus blockStatus;
   int32_t selOffset;
   int32_t selLength;
   *outBlockOffset = 0;
 
   if (!mFromStart) {
-    rv = mTextServicesDocument->LastSelectedBlock(&blockStatus, &selOffset,
-                                                  &selLength);
+    rv = MOZ_KnownLive(mTextServicesDocument)
+             ->LastSelectedBlock(&blockStatus, &selOffset, &selLength);
     if (NS_SUCCEEDED(rv) &&
         blockStatus !=
             TextServicesDocument::BlockSelectionStatus::eBlockNotFound) {
       switch (blockStatus) {
         // No TB in S, but found one before/after S.
         case TextServicesDocument::BlockSelectionStatus::eBlockOutside:
         // S begins or ends in TB but extends outside of TB.
         case TextServicesDocument::BlockSelectionStatus::eBlockPartial:
--- a/extensions/spellcheck/src/mozSpellChecker.h
+++ b/extensions/spellcheck/src/mozSpellChecker.h
@@ -46,16 +46,17 @@ class mozSpellChecker final {
                        bool aFromStartofDoc);
 
   /**
    * Selects (hilites) the next misspelled word in the document.
    * @param aWord will contain the misspelled word.
    * @param aSuggestions is an array of nsStrings, that represent the
    * suggested replacements for the misspelled word.
    */
+  MOZ_CAN_RUN_SCRIPT
   nsresult NextMisspelledWord(nsAString& aWord,
                               nsTArray<nsString>* aSuggestions);
 
   /**
    * Checks if a word is misspelled. No document is required to use this method.
    * @param aWord is the word to check.
    * @param aIsMisspelled will be set to true if the word is misspelled.
    * @param aSuggestions is an array of nsStrings which represent the
@@ -76,16 +77,17 @@ class mozSpellChecker final {
   /**
    * Replaces the old word with the specified new word.
    * @param aOldWord is the word to be replaced.
    * @param aNewWord is the word that is to replace old word.
    * @param aAllOccurrences will replace all occurrences of old
    * word, in the document, with new word when it is true. If
    * false, it will replace the 1st occurrence only!
    */
+  MOZ_CAN_RUN_SCRIPT
   nsresult Replace(const nsAString& aOldWord, const nsAString& aNewWord,
                    bool aAllOccurrences);
 
   /**
    * Ignores all occurrences of the specified word in the document.
    * @param aWord is the word to ignore.
    */
   nsresult IgnoreAll(const nsAString& aWord);
@@ -157,16 +159,17 @@ class mozSpellChecker final {
   RefPtr<mozilla::TextServicesDocument> mTextServicesDocument;
   nsCOMPtr<mozIPersonalDictionary> mPersonalDictionary;
 
   nsCOMPtr<mozISpellCheckingEngine> mSpellCheckingEngine;
   bool mFromStart;
 
   nsString mCurrentDictionary;
 
+  MOZ_CAN_RUN_SCRIPT
   nsresult SetupDoc(int32_t* outBlockOffset);
 
   nsresult GetCurrentBlockIndex(
       mozilla::TextServicesDocument* aTextServicesDocument,
       int32_t* aOutBlockIndex);
 
   nsresult GetEngineList(nsCOMArray<mozISpellCheckingEngine>* aDictionaryList);
 
--- a/gfx/wr/webrender/src/clip_scroll_tree.rs
+++ b/gfx/wr/webrender/src/clip_scroll_tree.rs
@@ -525,59 +525,16 @@ impl ClipScrollTree {
 
     #[allow(dead_code)]
     pub fn print(&self) {
         if !self.spatial_nodes.is_empty() {
             let mut pt = PrintTree::new("clip_scroll tree");
             self.print_with(&mut pt);
         }
     }
-
-    /// Return true if this is a guaranteed identity transform. This
-    /// is conservative, it assumes not identity if a property
-    /// binding animation, or scroll frame is found, for example.
-    pub fn node_is_identity(
-        &self,
-        spatial_node_index: SpatialNodeIndex,
-    ) -> bool {
-        let mut current = spatial_node_index;
-
-        while current != ROOT_SPATIAL_NODE_INDEX {
-            let node = &self.spatial_nodes[current.0 as usize];
-
-            match node.node_type {
-                SpatialNodeType::ReferenceFrame(ref info) => {
-                    match info.source_transform {
-                        PropertyBinding::Value(transform) => {
-                            if transform != LayoutTransform::identity() {
-                                return false;
-                            }
-                        }
-                        PropertyBinding::Binding(..) => {
-                            // Assume not identity since it may change with animation.
-                            return false;
-                        }
-                    }
-                }
-                SpatialNodeType::ScrollFrame(ref info) => {
-                    // Assume not identity since it may change with scrolling.
-                    if let ScrollFrameKind::Explicit = info.frame_kind {
-                        return false;
-                    }
-                }
-                SpatialNodeType::StickyFrame(..) => {
-                    // Assume not identity since it may change with scrolling.
-                    return false;
-                }
-            }
-            current = node.parent.unwrap();
-        }
-
-        true
-    }
 }
 
 impl PrintableTree for ClipScrollTree {
     fn print_with<T: PrintTreePrinter>(&self, pt: &mut T) {
         if !self.spatial_nodes.is_empty() {
             self.print_node(self.root_reference_frame_index(), pt);
         }
     }
--- a/gfx/wr/webrender/src/display_list_flattener.rs
+++ b/gfx/wr/webrender/src/display_list_flattener.rs
@@ -1429,20 +1429,17 @@ impl<'a> DisplayListFlattener<'a> {
         // (a) It's an optimization to reduce picture count and allocations, as display lists
         //     often contain a lot of these stacking contexts that don't require pictures or
         //     off-screen surfaces.
         // (b) It's useful for the initial version of picture caching in gecko, by enabling
         //     is to just look for interesting scroll roots on the root stacking context,
         //     without having to consider cuts at stacking context boundaries.
         let parent_is_empty = match self.sc_stack.last_mut() {
             Some(parent_sc) => {
-                if stacking_context.is_redundant(
-                    parent_sc,
-                    self.clip_scroll_tree,
-                ) {
+                if stacking_context.is_redundant(parent_sc) {
                     // If the parent context primitives list is empty, it's faster
                     // to assign the storage of the popped context instead of paying
                     // the copying cost for extend.
                     if parent_sc.primitives.is_empty() {
                         parent_sc.primitives = stacking_context.primitives;
                     } else {
                         parent_sc.primitives.extend(stacking_context.primitives);
                     }
@@ -2732,17 +2729,16 @@ impl FlattenedStackingContext {
     pub fn is_3d(&self) -> bool {
         self.transform_style == TransformStyle::Preserve3D && self.composite_ops.is_empty()
     }
 
     /// Return true if the stacking context isn't needed.
     pub fn is_redundant(
         &self,
         parent: &FlattenedStackingContext,
-        clip_scroll_tree: &ClipScrollTree,
     ) -> bool {
         // Any 3d context is required
         if let Picture3DContext::In { .. } = self.context_3d {
             return false;
         }
 
         // If there are filters / mix-blend-mode
         if !self.composite_ops.filters.is_empty() {
@@ -2771,21 +2767,16 @@ impl FlattenedStackingContext {
             return false;
         }
 
         // If need to isolate in surface due to clipping / mix-blend-mode
         if !self.blit_reason.is_empty() {
             return false;
         }
 
-        // If represents a transform, it may affect backface visibility of children
-        if !clip_scroll_tree.node_is_identity(self.spatial_node_index) {
-            return false;
-        }
-
         // If this stacking context gets picture caching, we need it.
         if self.create_tile_cache {
             return false;
         }
 
         // It is redundant!
         true
     }
--- a/layout/reftests/moz.build
+++ b/layout/reftests/moz.build
@@ -203,17 +203,17 @@ with Files('margin-collapsing/**'):
     BUG_COMPONENT = ('Core', 'Layout: Block and Inline')
 with Files('marquee/**'):
     BUG_COMPONENT = ('Core', 'CSS Parsing and Computation')
 with Files('mathml/**'):
     BUG_COMPONENT = ('Core', 'MathML')
 with Files('native-theme/**'):
     BUG_COMPONENT = ('Core', 'Layout')
 with Files('object/**'):
-    BUG_COMPONENT = ('Core', 'DOM')
+    BUG_COMPONENT = ('Core', 'DOM: Core & HTML')
 with Files('ogg-video/**'):
     BUG_COMPONENT = ('Core', 'Audio/Video')
 with Files('outline/**'):
     BUG_COMPONENT = ('Core', 'Layout')
 with Files('pagination/**'):
     BUG_COMPONENT = ('Core', 'Layout')
 with Files('percent-overflow-sizing/**'):
     BUG_COMPONENT = ('Core', 'Layout')
@@ -303,17 +303,17 @@ with Files('w3c-css/submitted/text-decor
     BUG_COMPONENT = ('Core', 'Layout: Block and Inline')
 with Files('w3c-css/submitted/ui3/**'):
     BUG_COMPONENT = ('Core', 'Layout')
 with Files('w3c-css/submitted/values3/**'):
     BUG_COMPONENT = ('Core', 'CSS Parsing and Computation')
 with Files('w3c-css/submitted/variables/**'):
     BUG_COMPONENT = ('Core', 'CSS Parsing and Computation')
 with Files('webcomponents/**'):
-    BUG_COMPONENT = ('Core', 'DOM')
+    BUG_COMPONENT = ('Core', 'DOM: Core & HTML')
 with Files('webm-video/**'):
     BUG_COMPONENT = ('Core', 'Audio/Video')
 with Files('writing-mode/**'):
     BUG_COMPONENT = ('Core', 'Layout: Block and Inline')
 with Files('xul/**'):
     BUG_COMPONENT = ('Core', 'XUL')
 with Files('xul-document-load/**'):
     BUG_COMPONENT = ('Core', 'XUL')
--- a/mobile/android/chrome/content/browser.js
+++ b/mobile/android/chrome/content/browser.js
@@ -1320,17 +1320,17 @@ var BrowserApp = {
     }
 
     let step = (fromPosition < toPosition) ? 1 : -1;
     for (let i = fromPosition; i != toPosition; i += step) {
       this._tabs[i] = this._tabs[i + step];
     }
     this._tabs[toPosition] = movedTab;
 
-    let evt = new UIEvent("TabMove", {"bubbles":true, "cancellable":false, "view":window, "detail":fromPosition});
+    let evt = new UIEvent("TabMove", {"bubbles":true, "cancelable":false, "view":window, "detail":fromPosition});
     this.tabs[toPosition].browser.dispatchEvent(evt);
   },
 
   // Use this method to select a tab from JS. This method sends a message
   // to Java to select the tab in the Java UI (we'll get a Tab:Selected message
   // back from Java when that happens).
   selectTab: function selectTab(aTab) {
     if (!aTab) {
--- a/mobile/android/config/mozconfigs/android-api-16-gradle-dependencies/nightly
+++ b/mobile/android/config/mozconfigs/android-api-16-gradle-dependencies/nightly
@@ -28,19 +28,16 @@ ac_add_options --disable-tests
 # advertise a bad API level. This may confuse people. As an example, please look at bug 1384482.
 # If you think you can't handle the whole set of changes, please reach out to the Release
 # Engineering team.
 ac_add_options --with-android-min-sdk=16
 ac_add_options --target=arm-linux-androideabi
 
 ac_add_options --with-branding=mobile/android/branding/nightly
 
-# Pull code coverage dependencies too.
-ac_add_options --enable-java-coverage
-
 export MOZILLA_OFFICIAL=1
 export MOZ_TELEMETRY_REPORTING=1
 export MOZ_ANDROID_MMA=1
 export MOZ_ANDROID_POCKET=1
 
 . "$topsrcdir/mobile/android/config/mozconfigs/common.override"
 
 # End ../android-api-16-frontend/nightly.
--- a/modules/libpref/init/all.js
+++ b/modules/libpref/init/all.js
@@ -2691,17 +2691,17 @@ pref("font.blacklist.underline_offset", 
 
 pref("security.directory",              "");
 
 // security-sensitive dialogs should delay button enabling. In milliseconds.
 pref("security.dialog_enable_delay", 1000);
 pref("security.notification_enable_delay", 500);
 
 #if defined(DEBUG) && !defined(ANDROID)
-pref("csp.about_uris_without_csp", "blank,printpreview,srcdoc,about,addons,cache-entry,config,crashes,debugging,devtools,downloads,home,memory,networking,newtab,performance,plugins,policies,profiles,restartrequired,searchreset,serviceworkers,sessionrestore,support,sync-log,telemetry,url-classifier,webrtc,welcomeback");
+pref("csp.about_uris_without_csp", "blank,printpreview,srcdoc,about,addons,cache-entry,config,crashes,debugging,devtools,downloads,home,memory,networking,newtab,performance,plugins,policies,profiles,restartrequired,serviceworkers,sessionrestore,support,sync-log,telemetry,url-classifier,webrtc,welcomeback");
 // the following prefs are for testing purposes only.
 pref("csp.overrule_about_uris_without_csp_whitelist", false);
 pref("csp.skip_about_page_has_csp_assert", false);
 // assertion flag will be set to false after fixing Bug 1473549
 pref("security.allow_eval_with_system_principal", false);
 pref("security.uris_using_eval_with_system_principal", "autocomplete.xml,redux.js,react-redux.js,content-task.js,content-task.js,tree.xml,dialog.xml,preferencesbindings.js,wizard.xml,lodash.js,jszip.js,sinon-7.2.7.js,ajv-4.1.1.js,updates.js,setup,jsol.js,parent_utils.js,chrometask_chromescript");
 #endif
 
@@ -4633,36 +4633,80 @@ pref("font.name-list.emoji", "Noto Color
 pref("font.name-list.serif.ar", "Noto Naskh Arabic, Noto Serif, Droid Serif");
 pref("font.name-list.sans-serif.ar", "Noto Naskh Arabic, Roboto, Google Sans, Droid Sans");
 pref("font.name-list.monospace.ar", "Noto Naskh Arabic");
 
 pref("font.name-list.serif.el", "Droid Serif, Noto Serif"); // not Charis SIL Compact, only has a few Greek chars
 pref("font.name-list.sans-serif.el", "Roboto, Google Sans, Droid Sans");
 pref("font.name-list.monospace.el", "Droid Sans Mono");
 
-pref("font.name-list.serif.he", "Droid Serif, Noto Serif");
-pref("font.name-list.sans-serif.he", "Roboto, Google Sans, Droid Sans Hebrew, Droid Sans, Arial");
+pref("font.name-list.serif.he", "Droid Serif, Noto Serif, Noto Serif Hebrew");
+pref("font.name-list.sans-serif.he", "Roboto, Google Sans, Noto Sans Hebrew, Droid Sans Hebrew, Droid Sans, Arial");
 pref("font.name-list.monospace.he", "Droid Sans Mono");
 
 pref("font.name-list.serif.ja", "Charis SIL Compact, Noto Serif CJK JP, Noto Serif, Droid Serif");
 pref("font.name-list.sans-serif.ja", "Roboto, Google Sans, Droid Sans, MotoyaLMaru, MotoyaLCedar, Noto Sans JP, Noto Sans CJK JP, Droid Sans Japanese");
 pref("font.name-list.monospace.ja", "MotoyaLMaru, MotoyaLCedar, Noto Sans Mono CJK JP, Droid Sans Mono");
 
 pref("font.name-list.serif.ko", "Charis SIL Compact, Noto Serif CJK KR, Noto Serif, Droid Serif, HYSerif");
 pref("font.name-list.sans-serif.ko", "Roboto, Google Sans, SmartGothic, NanumGothic, Noto Sans KR, Noto Sans CJK KR, DroidSansFallback, Droid Sans Fallback");
 pref("font.name-list.monospace.ko", "Droid Sans Mono, Noto Sans Mono CJK KR");
 
-pref("font.name-list.serif.th", "Charis SIL Compact, Noto Serif, Droid Serif");
-pref("font.name-list.sans-serif.th", "Roboto, Google Sans, Droid Sans Thai, Droid Sans");
+pref("font.name-list.serif.th", "Charis SIL Compact, Noto Serif, Noto Serif Thai, Droid Serif");
+pref("font.name-list.sans-serif.th", "Roboto, Google Sans, Noto Sans Thai, Droid Sans Thai, Droid Sans");
 pref("font.name-list.monospace.th", "Droid Sans Mono");
 
+pref("font.name-list.serif.x-armn", "Noto Serif Armenian");
+pref("font.name-list.sans-serif.x-armn", "Noto Sans Armenian");
+
+pref("font.name-list.serif.x-beng", "Noto Serif Bengali");
+pref("font.name-list.sans-serif.x-beng", "Noto Sans Bengali");
+
 pref("font.name-list.serif.x-cyrillic", "Charis SIL Compact, Noto Serif, Droid Serif");
 pref("font.name-list.sans-serif.x-cyrillic", "Roboto, Google Sans, Droid Sans");
 pref("font.name-list.monospace.x-cyrillic", "Droid Sans Mono");
 
+pref("font.name-list.serif.x-devanagari", "Noto Serif Devanagari");
+pref("font.name-list.sans-serif.x-devanagari", "Noto Sans Devanagari");
+
+pref("font.name-list.serif.x-ethi", "Noto Serif Ethiopic");
+pref("font.name-list.sans-serif.x-ethi", "Noto Sans Ethiopic");
+
+pref("font.name-list.serif.x-geor", "Noto Serif Georgian");
+pref("font.name-list.sans-serif.x-geor", "Noto Sans Georgian");
+
+pref("font.name-list.serif.x-gujr", "Noto Serif Gujarati");
+pref("font.name-list.sans-serif.x-gujr", "Noto Sans Gujarati");
+
+pref("font.name-list.serif.x-guru", "Noto Serif Gurmukhi");
+pref("font.name-list.sans-serif.x-guru", "Noto Sans Gurmukhi");
+
+pref("font.name-list.serif.x-khmr", "Noto Serif Khmer");
+pref("font.name-list.sans-serif.x-khmr", "Noto Sans Khmer");
+
+pref("font.name-list.serif.x-knda", "Noto Serif Kannada");
+pref("font.name-list.sans-serif.x-knda", "Noto Sans Kannada");
+
+pref("font.name-list.serif.x-mlym", "Noto Serif Malayalam");
+pref("font.name-list.sans-serif.x-mlym", "Noto Sans Malayalam");
+
+pref("font.name-list.sans-serif.x-orya", "Noto Sans Oriya");
+
+pref("font.name-list.serif.x-sinh", "Noto Serif Sinhala");
+pref("font.name-list.sans-serif.x-sinh", "Noto Sans Sinhala");
+
+pref("font.name-list.serif.x-tamil", "Noto Serif Tamil");
+pref("font.name-list.sans-serif.x-tamil", "Noto Sans Tamil");
+
+pref("font.name-list.serif.x-telu", "Noto Serif Telugu");
+pref("font.name-list.sans-serif.x-telu", "Noto Sans Telugu");
+
+pref("font.name-list.serif.x-tibt", "Noto Serif Tibetan");
+pref("font.name-list.sans-serif.x-tibt", "Noto Sans Tibetan");
+
 pref("font.name-list.serif.x-unicode", "Charis SIL Compact, Noto Serif, Droid Serif");
 pref("font.name-list.sans-serif.x-unicode", "Roboto, Google Sans, Droid Sans");
 pref("font.name-list.monospace.x-unicode", "Droid Sans Mono");
 
 pref("font.name-list.serif.x-western", "Charis SIL Compact, Noto Serif, Droid Serif");
 pref("font.name-list.sans-serif.x-western", "Roboto, Google Sans, Droid Sans");
 pref("font.name-list.monospace.x-western", "Droid Sans Mono");
 
--- a/testing/talos/moz.build
+++ b/testing/talos/moz.build
@@ -16,17 +16,17 @@ with Files("talos/tests/tresize/**"):
 
 with Files("talos/tests/a11y/**"):
     BUG_COMPONENT = ("Core", "Disability Access APIs")
 
 with Files("talos/tests/cpstartup/**"):
     BUG_COMPONENT = ("Firefox", "Tabbed Browser")
 
 with Files("talos/tests/dromaeo/**"):
-    BUG_COMPONENT = ("Core", "DOM")
+    BUG_COMPONENT = ("Core", "DOM: Core & HTML")
 
 with Files("talos/tests/kraken/**"):
     BUG_COMPONENT = ("Core", "JavaScript Engine")
 
 with Files("talos/tests/scroll/**"):
     BUG_COMPONENT = ("Core", "Graphics")
 
 with Files("talos/tests/svg*"):
--- a/testing/web-platform/moz.build
+++ b/testing/web-platform/moz.build
@@ -49,35 +49,35 @@ with Files("outbound/tests/placeholder")
 
 with Files("mozilla/README"):
     BUG_COMPONENT = ("Testing", "web-platform-tests")
 
 with Files("mozilla/meta/**"):
     BUG_COMPONENT = ("Testing", "web-platform-tests")
 
 with Files("mozilla/tests/dom/**"):
-    BUG_COMPONENT = ("Core", "DOM")
+    BUG_COMPONENT = ("Core", "DOM: Core & HTML")
 
 with Files("mozilla/tests/editor/**"):
     BUG_COMPONENT = ("Core", "Editor")
 
 with Files("mozilla/tests/fetch/**"):
-    BUG_COMPONENT = ("Core", "DOM")
+    BUG_COMPONENT = ("Core", "DOM: Core & HTML")
 
 with Files("mozilla/tests/focus/**"):
     BUG_COMPONENT = ("Core", "Editor")
 
 with Files("mozilla/tests/html/**"):
-    BUG_COMPONENT = ("Core", "DOM")
+    BUG_COMPONENT = ("Core", "DOM: Core & HTML")
 
 with Files("mozilla/tests/html/semantics/forms/**"):
     BUG_COMPONENT = ("Core", "Layout: Form Controls")
 
 with Files("mozilla/tests/html/semantics/scripting-1/**"):
-    BUG_COMPONENT = ("Core", "DOM")
+    BUG_COMPONENT = ("Core", "DOM: Core & HTML")
 
 with Files("mozilla/tests/placeholder"):
     BUG_COMPONENT = ("Testing", "web-platform-tests")
 
 with Files("mozilla/tests/wasm/**"):
     BUG_COMPONENT = ("Core", "Javascript: Web Assembly")
 
 with Files("update/**"):
@@ -120,29 +120,29 @@ with Files("tests/wpt"):
 with Files("tests/wpt.py"):
     BUG_COMPONENT = ("Testing", "web-platform-tests")
 
 
 with Files("tests/2dcontext/**"):
     BUG_COMPONENT = ("Core", "Canvas: 2D")
 
 with Files("tests/FileAPI/**"):
-    BUG_COMPONENT = ("Core", "DOM")
+    BUG_COMPONENT = ("Core", "DOM: Core & HTML")
 
 with Files("tests/IndexedDB/**"):
     BUG_COMPONENT = ("Core", "DOM: IndexedDB")
 
 with Files("tests/WebCryptoAPI/**"):
     BUG_COMPONENT = ("Core", "DOM: Security")
 
 with Files("tests/WebIDL/**"):
-    BUG_COMPONENT = ("Core", "DOM")
+    BUG_COMPONENT = ("Core", "DOM: Core & HTML")
 
 with Files("tests/xhr/**"):
-    BUG_COMPONENT = ("Core", "DOM")
+    BUG_COMPONENT = ("Core", "DOM: Core & HTML")
 
 with Files("tests/accelerometer/**"):
     BUG_COMPONENT = ("Core", "DOM: Device Interfaces")
 
 with Files("tests/ambient-light/**"):
     BUG_COMPONENT = ("Core", "DOM: Device Interfaces")
 
 with Files("tests/annotation-model/**"):
@@ -162,26 +162,26 @@ with Files("tests/audio-output/**"):
 
 with Files("tests/background-fetch/**"):
     BUG_COMPONENT = ("Core", "DOM: Service Workers")
 
 with Files("tests/battery-status/**"):
     BUG_COMPONENT = ("Core", "DOM: Device Interfaces")
 
 with Files("tests/beacon/**"):
-    BUG_COMPONENT = ("Core", "DOM")
+    BUG_COMPONENT = ("Core", "DOM: Core & HTML")
 
 with Files("tests/bluetooth/**"):
     BUG_COMPONENT = ("Core", "DOM: Device Interfaces")
 
 with Files("tests/clear-site-data/**"):
     BUG_COMPONENT = ("Core", "DOM: Security")
 
 with Files("tests/clipboard-apis/**"):
-    BUG_COMPONENT = ("Core", "DOM")
+    BUG_COMPONENT = ("Core", "DOM: Core & HTML")
 
 with Files("tests/common/**"):
     BUG_COMPONENT = ("Testing", "web-platform-tests")
 
 # Appears to be testing -webkit specific css properties
 with Files("tests/compat/**"):
     BUG_COMPONENT = ("Core", "Layout")
 
@@ -244,26 +244,26 @@ with Files("tests/css/cssom/**"):
 
 with Files("tests/css/cssom-view/**"):
     BUG_COMPONENT = ("Core", "DOM: CSS Object Model")
 
 with Files("tests/css/selectors/**"):
     BUG_COMPONENT = ("Core", "CSS Parsing and Computation")
 
 with Files("tests/custom-elements/**"):
-    BUG_COMPONENT = ("Core", "DOM")
+    BUG_COMPONENT = ("Core", "DOM: Core & HTML")
 
 with Files("tests/docs/**"):
     BUG_COMPONENT = ("Testing", "web-platform-tests")
 
 with Files("tests/dom/**"):
-    BUG_COMPONENT = ("Core", "DOM")
+    BUG_COMPONENT = ("Core", "DOM: Core & HTML")
 
 with Files("tests/domparsing/**"):
-    BUG_COMPONENT = ("Core", "DOM")
+    BUG_COMPONENT = ("Core", "DOM: Core & HTML")
 
 with Files("tests/domxpath/**"):
     BUG_COMPONENT = ("Core", "XSLT")
 
 with Files("tests/dpub-aam/**"):
     BUG_COMPONENT = ("Core", "Disability Access APIs")
 
 with Files("tests/dpub-aria/**"):
@@ -275,51 +275,51 @@ with Files("tests/editing/**"):
 # as per Bug 746911
 with Files("tests/encoding/**"):
     BUG_COMPONENT = ("Core", "Internationalization")
 
 with Files("tests/encrypted-media/**"):
     BUG_COMPONENT = ("Core", "Audio/Video: Playback")
 
 with Files("tests/entries-api/**"):
-    BUG_COMPONENT = ("Core", "DOM")
+    BUG_COMPONENT = ("Core", "DOM: Core & HTML")
 
 with Files("tests/eventsource/**"):
-    BUG_COMPONENT = ("Core", "DOM")
+    BUG_COMPONENT = ("Core", "DOM: Core & HTML")
 
 with Files("tests/feature-policy/**"):
-    BUG_COMPONENT = ("Core", "DOM")
+    BUG_COMPONENT = ("Core", "DOM: Core & HTML")
 
 with Files("tests/fetch/**"):
-    BUG_COMPONENT = ("Core", "DOM")
+    BUG_COMPONENT = ("Core", "DOM: Core & HTML")
 
 with Files("tests/fonts/**"):
     BUG_COMPONENT = ("Testing", "web-platform-tests")
 
 with Files("tests/fonts/math/**"):
     BUG_COMPONENT = ("Core", "MathML")
 
 with Files("tests/fullscreen/**"):
-    BUG_COMPONENT = ("Core", "DOM")
+    BUG_COMPONENT = ("Core", "DOM: Core & HTML")
 
 with Files("tests/gamepad/**"):
     BUG_COMPONENT = ("Core", "DOM: Device Interfaces")
 
 # Bug 1359076 - Deleting this feature due to security
 with Files("tests/geolocation-API/**"):
     BUG_COMPONENT = ("Core", "Geolocation")
 
 with Files("tests/gyroscope/**"):
     BUG_COMPONENT = ("Core", "DOM: Device Interfaces")
 
 with Files("tests/hr-time/**"):
-    BUG_COMPONENT = ("Core", "DOM")
+    BUG_COMPONENT = ("Core", "DOM: Core & HTML")
 
 with Files("tests/html/**"):
-    BUG_COMPONENT = ("Core", "DOM")
+    BUG_COMPONENT = ("Core", "DOM: Core & HTML")
 
 with Files("tests/html-longdesc/**"):
     BUG_COMPONENT = ("Core", "DOM: Core & HTML")
 
 # Not implemented yet, see Bug 741393
 with Files("tests/html-media-capture/**"):
     BUG_COMPONENT = ("Core", "DOM: Core & HTML")
 
@@ -331,47 +331,47 @@ with Files("tests/images/**"):
 
 with Files("tests/infrastructure/**"):
     BUG_COMPONENT = ("Testing", "web-platform-tests")
 
 with Files("tests/input-events/**"):
     BUG_COMPONENT = ("Core", "General")
 
 with Files("tests/interfaces/**"):
-    BUG_COMPONENT = ("Core", "DOM")
+    BUG_COMPONENT = ("Core", "DOM: Core & HTML")
 
 with Files("tests/intersection-observer/**"):
     BUG_COMPONENT = ("Core", "Layout")
 
 with Files("tests/js/**"):
     BUG_COMPONENT = ("Core", "JavaScript Engine")
 
 # To be implemented in bug 1348405
 with Files("tests/keyboard-lock/**"):
     BUG_COMPONENT = ("Core", "DOM: Core & HTML")
 
 # No reference to longtask in bugzilla or codebase
 with Files("tests/longtask-timing/**"):
-    BUG_COMPONENT = ("Core", "DOM")
+    BUG_COMPONENT = ("Core", "DOM: Core & HTML")
 
 # depends on generic-sensor, check bug 1359076
 with Files("tests/magnetometer/**"):
     BUG_COMPONENT = ("Core", "DOM: Device Interfaces")
 
 with Files("tests/mathml/**"):
     BUG_COMPONENT = ("Core", "MathML")
 
 with Files("tests/media/**"):
     BUG_COMPONENT = ("Core", "Audio/Video: Playback")
 
 with Files("tests/media-capabilities/**"):
     BUG_COMPONENT = ("Core", "WebRTC: Audio/Video")
 
 with Files("tests/mediasession/**"):
-    BUG_COMPONENT = ("Core", "DOM")
+    BUG_COMPONENT = ("Core", "DOM: Core & HTML")
 
 with Files("tests/media-source/**"):
     BUG_COMPONENT = ("Core", "Audio/Video: Playback")
 
 with Files("tests/mediacapture-fromelement/**"):
     BUG_COMPONENT = ("Core", "Audio/Video: Recording")
 
 with Files("tests/mediacapture-image/**"):
@@ -382,17 +382,17 @@ with Files("tests/mediacapture-record/**
 
 with Files("tests/mediacapture-streams/**"):
     BUG_COMPONENT = ("Core", "Audio/Video: MediaStreamGraph")
 
 with Files("tests/mixed-content/**"):
     BUG_COMPONENT = ("Core", "DOM: Security")
 
 with Files("tests/navigation-timing/**"):
-    BUG_COMPONENT = ("Core", "DOM")
+    BUG_COMPONENT = ("Core", "DOM: Core & HTML")
 
 with Files("tests/netinfo/**"):
     BUG_COMPONENT = ("Core", "DOM: Device Interfaces")
 
 with Files("tests/notifications/**"):
     BUG_COMPONENT = ("Toolkit", "Notifications and Alerts")
 
 with Files("tests/offscreen-canvas/**"):
@@ -410,20 +410,20 @@ with Files("tests/old-tests/submission/M
 
 with Files("tests/orientation-event/**"):
     BUG_COMPONENT = ("Core", "DOM: Device Interfaces")
 
 with Files("tests/orientation-sensor/**"):
     BUG_COMPONENT = ("Core", "DOM: Device Interfaces")
 
 with Files("tests/page-visibility/**"):
-    BUG_COMPONENT = ("Core", "DOM")
+    BUG_COMPONENT = ("Core", "DOM: Core & HTML")
 
 with Files("tests/paint-timing/**"):
-    BUG_COMPONENT = ("Core", "DOM")
+    BUG_COMPONENT = ("Core", "DOM: Core & HTML")
 
 # No tests in here
 with Files("tests/payment-handler/**"):
     BUG_COMPONENT = ("Core", "DOM: Web Payments")
 
 # No tests in here
 with Files("tests/payment-method-basic-card/**"):
     BUG_COMPONENT = ("Core", "DOM: Web Payments")
@@ -431,114 +431,114 @@ with Files("tests/payment-method-basic-c
 # No tests in here
 with Files("tests/payment-method-id/**"):
     BUG_COMPONENT = ("Core", "DOM: Web Payments")
 
 with Files("tests/payment-request/**"):
     BUG_COMPONENT = ("Core", "DOM: Web Payments")
 
 with Files("tests/performance-timeline/**"):
-    BUG_COMPONENT = ("Core", "DOM")
+    BUG_COMPONENT = ("Core", "DOM: Core & HTML")
 
 with Files("tests/pointerevents/**"):
     BUG_COMPONENT = ("Core", "DOM: Events")
 
 with Files("tests/pointerlock/**"):
     BUG_COMPONENT = ("Core", "DOM: Events")
 
 with Files("tests/preload/**"):
     BUG_COMPONENT = ("Core", "DOM: Core & Html")
 
 with Files("tests/presentation-api/**"):
-    BUG_COMPONENT = ("Core", "DOM")
+    BUG_COMPONENT = ("Core", "DOM: Core & HTML")
 
 with Files("tests/proximity/**"):
     BUG_COMPONENT = ("Core", "DOM: Device Interfaces")
 
 with Files("tests/quirks/**"):
     BUG_COMPONENT = ("Core", "Layout")
 
 with Files("tests/remote-playback/**"):
     BUG_COMPONENT = ("Core", "Audio/Video: Playback")
 
 with Files("tests/referrer-policy/**"):
     BUG_COMPONENT = ("Core", "DOM: Security")
 
 with Files("tests/requestidlecallback/**"):
-    BUG_COMPONENT = ("Core", "DOM")
+    BUG_COMPONENT = ("Core", "DOM: Core & HTML")
 
 # To be implemented in bug 1272409
 with Files("tests/resize-observer/**"):
     BUG_COMPONENT = ("Core", "Layout")
 
 with Files("tests/resource-timing/**"):
-    BUG_COMPONENT = ("Core", "DOM")
+    BUG_COMPONENT = ("Core", "DOM: Core & HTML")
 
 with Files("tests/resources/**"):
     BUG_COMPONENT = ("Testing", "web-platform-tests")
 
 with Files("tests/screen-orientation/**"):
-    BUG_COMPONENT = ("Core", "DOM")
+    BUG_COMPONENT = ("Core", "DOM: Core & HTML")
 
 with Files("tests/secure-contexts/**"):
-    BUG_COMPONENT = ("Core", "DOM")
+    BUG_COMPONENT = ("Core", "DOM: Core & HTML")
 
 with Files("tests/selection/**"):
     BUG_COMPONENT = ("Core", "Selection")
 
 with Files("tests/server-timing/**"):
-    BUG_COMPONENT = ("Core", "DOM")
+    BUG_COMPONENT = ("Core", "DOM: Core & HTML")
 
 with Files("tests/service-workers/**"):
     BUG_COMPONENT = ("Core", "DOM: Service Workers")
 
 with Files("tests/shadow-dom/**"):
-    BUG_COMPONENT = ("Core", "DOM")
+    BUG_COMPONENT = ("Core", "DOM: Core & HTML")
 
 with Files("tests/speech-api/**"):
     BUG_COMPONENT = ("Core", "Web Speech")
 
 with Files("tests/storage/**"):
-    BUG_COMPONENT = ("Core", "DOM")
+    BUG_COMPONENT = ("Core", "DOM: Core & HTML")
 
 with Files("tests/streams/**"):
-    BUG_COMPONENT = ("Core", "DOM")
+    BUG_COMPONENT = ("Core", "DOM: Core & HTML")
 
 with Files("tests/subresource-integrity/**"):
     BUG_COMPONENT = ("Core", "DOM: Security")
 
 with Files("tests/svg/**"):
     BUG_COMPONENT = ("Core", "SVG")
 
 with Files("tests/svg-aam/**"):
     BUG_COMPONENT = ("Core", "SVG")
 
 with Files("tests/touch-events/**"):
-    BUG_COMPONENT = ("Core", "DOM")
+    BUG_COMPONENT = ("Core", "DOM: Core & HTML")
 
 with Files("tests/tools/**"):
     BUG_COMPONENT = ("Testing", "web-platform-tests")
 
 with Files("tests/trusted-types/**"):
     BUG_COMPONENT = ("Core", "DOM: Security")
 
 with Files("tests/uievents/**"):
     BUG_COMPONENT = ("Core", "DOM: Events")
 
 with Files("tests/upgrade-insecure-requests/**"):
     BUG_COMPONENT = ("Core", "DOM: Security")
 
 with Files("tests/url/**"):
-    BUG_COMPONENT = ("Core", "DOM")
+    BUG_COMPONENT = ("Core", "DOM: Core & HTML")
 
 with Files("tests/user-timing/**"):
-    BUG_COMPONENT = ("Core", "DOM")
+    BUG_COMPONENT = ("Core", "DOM: Core & HTML")
 
 with Files("tests/vibration/**"):
-    BUG_COMPONENT = ("Core", "DOM")
+    BUG_COMPONENT = ("Core", "DOM: Core & HTML")
 
 with Files("tests/visual-viewport/**"):
     BUG_COMPONENT = ("Core", "Layout")
 
 with Files("tests/wai-aria/**"):
     BUG_COMPONENT = ("Core", "Disability Access APIs")
 
 with Files("tests/wasm/**"):
@@ -555,43 +555,43 @@ with Files("tests/webauthn/**"):
 
 with Files("tests/webdriver/**"):
     BUG_COMPONENT = ("Testing", "geckodriver")
 
 with Files("tests/webgl/**"):
     BUG_COMPONENT = ("Core", "Canvas: WebGL")
 
 with Files("tests/webmessaging/**"):
-    BUG_COMPONENT = ("Core", "DOM")
+    BUG_COMPONENT = ("Core", "DOM: Core & HTML")
 
 with Files("tests/web-nfc/**"):
     BUG_COMPONENT = ("Core", "DOM: Device Interfaces")
 
 with Files("tests/webrtc/**"):
     BUG_COMPONENT = ("Core", "WebRTC")
 
 with Files("tests/web-share/**"):
-    BUG_COMPONENT = ("Core", "DOM")
+    BUG_COMPONENT = ("Core", "DOM: Core & HTML")
 
 with Files("tests/websockets/**"):
     BUG_COMPONENT = ("Core", "Networking: WebSockets")
 
 with Files("tests/webstorage/**"):
     BUG_COMPONENT = ("Core", "DOM: Web Storage")
 
 with Files("tests/webusb/**"):
     BUG_COMPONENT = ("Core", "DOM: Device Interfaces")
 
 with Files("tests/webvr/**"):
-    BUG_COMPONENT = ("Core", "DOM")
+    BUG_COMPONENT = ("Core", "DOM: Core & HTML")
 
 with Files("tests/webvtt/**"):
     BUG_COMPONENT = ("Core", "Audio/Video: Playback")
 
 with Files("tests/workers/**"):
     BUG_COMPONENT = ("Core", "DOM: Workers")
 
 # to be implemented in bug 1315239
 with Files("tests/worklets/**"):
-    BUG_COMPONENT = ("Core", "DOM")
+    BUG_COMPONENT = ("Core", "DOM: Core & HTML")
 
 with Files("tests/x-frame-options/**"):
     BUG_COMPONENT = ("Core", "DOM: Security")
deleted file mode 100644
--- a/testing/web-platform/mozilla/meta/focus/Selection_selectAllChildren.html.ini
+++ /dev/null
@@ -1,41 +0,0 @@
-[Selection_selectAllChildren.html]
-  type: testharness
-  [Active element should be 'editor' after Selection.selectAllChildren() to select the children of 'staticBefore' when active element is 'editor']
-    expected: FAIL
-
-  [Active element should be 'outerEditor' after Selection.selectAllChildren() to select the children of 'outerEditor' when active element is 'editor']
-    expected: FAIL
-
-  [Active element should be 'editor' after Selection.selectAllChildren() to select the children of 'staticInEditor' when active element is 'editor']
-    expected: FAIL
-
-  [Active element should be 'innerEditor' after Selection.selectAllChildren() to select the children of 'innerEditor' when active element is 'editor']
-    expected: FAIL
-
-  [Active element should be 'editor' after Selection.selectAllChildren() to select the children of 'anchor' when active element is 'editor']
-    expected: FAIL
-
-  [Active element should be 'outerEditor' after Selection.selectAllChildren() to select the children of 'staticBefore' when active element is 'outerEditor']
-    expected: FAIL
-
-  [Active element should be 'editor' after Selection.selectAllChildren() to select the children of 'editor' when active element is 'outerEditor']
-    expected: FAIL
-
-  [Active element should be 'outerEditor' after Selection.selectAllChildren() to select the children of 'anchor' when active element is 'outerEditor']
-    expected: FAIL
-
-  [Active element should be 'innerEditor' after Selection.selectAllChildren() to select the children of 'staticBefore' when active element is 'innerEditor']
-    expected: FAIL
-
-  [Active element should be 'editor' after Selection.selectAllChildren() to select the children of 'editor' when active element is 'innerEditor']
-    expected: FAIL
-
-  [Active element should be 'outerEditor' after Selection.selectAllChildren() to select the children of 'outerEditor' when active element is 'innerEditor']
-    expected: FAIL
-
-  [Active element should be 'innerEditor' after Selection.selectAllChildren() to select the children of 'staticInEditor' when active element is 'innerEditor']
-    expected: FAIL
-
-  [Active element should be 'innerEditor' after Selection.selectAllChildren() to select the children of 'anchor' when active element is 'innerEditor']
-    expected: FAIL
-
--- a/toolkit/components/search/SearchService.jsm
+++ b/toolkit/components/search/SearchService.jsm
@@ -18,21 +18,17 @@ XPCOMUtils.defineLazyModuleGetters(this,
 
 XPCOMUtils.defineLazyServiceGetters(this, {
   gEnvironment: ["@mozilla.org/process/environment;1", "nsIEnvironment"],
   gChromeReg: ["@mozilla.org/chrome/chrome-registry;1", "nsIChromeRegistry"],
 });
 
 const BROWSER_SEARCH_PREF = "browser.search.";
 
-XPCOMUtils.defineLazyPreferenceGetter(this, "resetStatus", BROWSER_SEARCH_PREF + "reset.status", "");
 XPCOMUtils.defineLazyPreferenceGetter(this, "loggingEnabled", BROWSER_SEARCH_PREF + "log", false);
-XPCOMUtils.defineLazyGetter(this, "resetEnabled", () => {
-  return Services.prefs.getDefaultBranch(BROWSER_SEARCH_PREF).getBoolPref("reset.enabled");
-});
 // Can't use defineLazyPreferenceGetter because we want the value
 // from the default branch
 XPCOMUtils.defineLazyGetter(this, "distroID", () => {
   return Services.prefs.getDefaultBranch("distribution.").getCharPref("id", "");
 });
 
 const BinaryInputStream = Components.Constructor(
   "@mozilla.org/binaryinputstream;1",
@@ -2320,37 +2316,16 @@ Engine.prototype = {
 
   // from nsISearchEngine
   getSubmission: function SRCH_ENG_getSubmission(aData, aResponseType, aPurpose) {
     if (!aResponseType) {
       aResponseType = AppConstants.platform == "android" ? this._defaultMobileResponseType :
                                                            URLTYPE_SEARCH_HTML;
     }
 
-    let resetPending;
-    if (aResponseType == URLTYPE_SEARCH_HTML &&
-        ((resetPending = resetStatus == "pending") ||
-         resetEnabled) &&
-        this.name == Services.search.defaultEngine.name &&
-        !this._isDefault &&
-        this.name != Services.search.originalDefaultEngine.name &&
-        (resetPending || !this.getAttr("loadPathHash") ||
-         this.getAttr("loadPathHash") != getVerificationHash(this._loadPath)) &&
-        !this._isWhiteListed) {
-      let url = "about:searchreset";
-      let data = [];
-      if (aData)
-        data.push("data=" + encodeURIComponent(aData));
-      if (aPurpose)
-        data.push("purpose=" + aPurpose);
-      if (data.length)
-        url += "?" + data.join("&");
-      return new Submission(makeURI(url));
-    }
-
     var url = this._getURLOfType(aResponseType);
 
     if (!url)
       return null;
 
     if (!aData) {
       // Return a dummy submission object with our searchForm attribute
       return new Submission(makeURI(this._getSearchFormWithPurpose(aPurpose)));
--- a/toolkit/content/moz.build
+++ b/toolkit/content/moz.build
@@ -171,17 +171,17 @@ with Files('tests/chrome/*findbar*'):
 
 with Files('tests/chrome/test_preferences*'):
     BUG_COMPONENT = ('Toolkit', 'Preferences')
 
 with Files('tests/mochitest/*autocomplete*'):
     BUG_COMPONENT = ('Toolkit', 'Autocomplete')
 
 with Files('tests/mochitest/*mousecapture*'):
-    BUG_COMPONENT = ('Core', 'Event Handling')
+    BUG_COMPONENT = ('Core', 'User events and focus handling')
 
 with Files('tests/reftests/*multiline*'):
     BUG_COMPONENT = ('Core', 'XBL')
 
 with Files('tests/reftests/*videocontrols*'):
     BUG_COMPONENT = ('Toolkit', 'Video/Audio Controls')
 
 with Files('tests/unit/**'):
@@ -198,17 +198,17 @@ with Files('tests/widgets/*contextmenu*'
 
 with Files('tests/widgets/*editor*'):
     BUG_COMPONENT = ('Core', 'XUL')
 
 with Files('tests/widgets/*menubar*'):
     BUG_COMPONENT = ('Core', 'XUL')
 
 with Files('tests/widgets/*capture*'):
-    BUG_COMPONENT = ('Core', 'Event Handling')
+    BUG_COMPONENT = ('Core', 'User events and focus handling')
 
 with Files('tests/widgets/*popup*'):
     BUG_COMPONENT = ('Toolkit', 'XUL Widgets')
 with Files('tests/widgets/*tree*'):
     BUG_COMPONENT = ('Toolkit', 'XUL Widgets')
 
 with Files('tests/widgets/*videocontrols*'):
     BUG_COMPONENT = ('Toolkit', 'Video/Audio Controls')
--- a/widget/gtk/IMContextWrapper.cpp
+++ b/widget/gtk/IMContextWrapper.cpp
@@ -2460,44 +2460,66 @@ already_AddRefed<TextRangeArray> IMConte
              "be allocated",
              this));
     pango_attr_list_unref(feedback_list);
     g_free(preedit_string);
     return textRangeArray.forget();
   }
 
   uint32_t minOffsetOfClauses = aCompositionString.Length();
+  uint32_t maxOffsetOfClauses = 0;
   do {
     TextRange range;
     if (!SetTextRange(iter, preedit_string, caretOffsetInUTF16, range)) {
       continue;
     }
     MOZ_ASSERT(range.Length());
     minOffsetOfClauses = std::min(minOffsetOfClauses, range.mStartOffset);
+    maxOffsetOfClauses = std::max(maxOffsetOfClauses, range.mEndOffset);
     textRangeArray->AppendElement(range);
   } while (pango_attr_iterator_next(iter));
 
   // If the IME doesn't define clause from the start of the composition,
   // we should insert dummy clause information since TextRangeArray assumes
   // that there must be a clause whose start is 0 when there is one or
   // more clauses.
   if (minOffsetOfClauses) {
     TextRange dummyClause;
     dummyClause.mStartOffset = 0;
     dummyClause.mEndOffset = minOffsetOfClauses;
     dummyClause.mRangeType = TextRangeType::eRawClause;
     textRangeArray->InsertElementAt(0, dummyClause);
+    maxOffsetOfClauses = std::max(maxOffsetOfClauses, dummyClause.mEndOffset);
     MOZ_LOG(gGtkIMLog, LogLevel::Warning,
             ("0x%p   CreateTextRangeArray(), inserting a dummy clause "
              "at the beginning of the composition string mStartOffset=%u, "
              "mEndOffset=%u, mRangeType=%s",
              this, dummyClause.mStartOffset, dummyClause.mEndOffset,
              ToChar(dummyClause.mRangeType)));
   }
 
+  // If the IME doesn't define clause at end of the composition, we should
+  // insert dummy clause information since TextRangeArray assumes that there
+  // must be a clase whose end is the length of the composition string when
+  // there is one or more clauses.
+  if (!textRangeArray->IsEmpty() &&
+      maxOffsetOfClauses < aCompositionString.Length()) {
+    TextRange dummyClause;
+    dummyClause.mStartOffset = maxOffsetOfClauses;
+    dummyClause.mEndOffset = aCompositionString.Length();
+    dummyClause.mRangeType = TextRangeType::eRawClause;
+    textRangeArray->AppendElement(dummyClause);
+    MOZ_LOG(gGtkIMLog, LogLevel::Warning,
+            ("0x%p   CreateTextRangeArray(), inserting a dummy clause "
+             "at the end of the composition string mStartOffset=%u, "
+             "mEndOffset=%u, mRangeType=%s",
+             this, dummyClause.mStartOffset, dummyClause.mEndOffset,
+             ToChar(dummyClause.mRangeType)));
+  }
+
   TextRange range;
   range.mStartOffset = range.mEndOffset = caretOffsetInUTF16;
   range.mRangeType = TextRangeType::eCaret;
   textRangeArray->AppendElement(range);
   MOZ_LOG(
       gGtkIMLog, LogLevel::Debug,
       ("0x%p   CreateTextRangeArray(), mStartOffset=%u, "
        "mEndOffset=%u, mRangeType=%s",
@@ -2657,24 +2679,16 @@ bool IMContextWrapper::SetTextRange(Pang
    *
    * However, this rules are odd since there can be two or more selected
    * clauses.  Additionally, our old rules caused that IME developers/users
    * cannot specify composition string style as they want.
    *
    * So, we shouldn't guess the meaning from its visual style.
    */
 
-  if (!attrUnderline && !attrForeground && !attrBackground) {
-    MOZ_LOG(gGtkIMLog, LogLevel::Warning,
-            ("0x%p   SetTextRange(), FAILED, due to no attr, "
-             "aTextRange= { mStartOffset=%u, mEndOffset=%u }",
-             this, aTextRange.mStartOffset, aTextRange.mEndOffset));
-    return false;
-  }
-
   // If the range covers whole of composition string and the caret is at
   // the end of the composition string, the range is probably not converted.
   if (!utf8ClauseStart &&
       utf8ClauseEnd == static_cast<gint>(strlen(aUTF8CompositionString)) &&
       aTextRange.mEndOffset == aUTF16CaretOffset) {
     aTextRange.mRangeType = TextRangeType::eRawClause;
   }
   // Typically, the caret is set at the start of the selected clause.
--- a/widget/tests/moz.build
+++ b/widget/tests/moz.build
@@ -15,17 +15,17 @@ with Files("unit/*taskbar_jumplistitems*
 
 with Files("TestAppShellSteadyState.cpp"):
     BUG_COMPONENT = ("Core", "DOM: IndexedDB")
 
 with Files("TestChromeMargin.cpp"):
     BUG_COMPONENT = ("Core", "Widget: Win32")
 
 with Files("*1151186*"):
-    BUG_COMPONENT = ("Core", "Event Handling")
+    BUG_COMPONENT = ("Core", "User events and focus handling")
 
 with Files("*413277*"):
     BUG_COMPONENT = ("Core", "Widget: Cocoa")
 
 with Files("*428405*"):
     BUG_COMPONENT = ("Core", "Widget: Cocoa")
 
 with Files("*429954*"):
@@ -33,17 +33,17 @@ with Files("*429954*"):
 
 with Files("*444800*"):
     BUG_COMPONENT = ("Core", "Widget: Win32")
 
 with Files("*466599*"):
     BUG_COMPONENT = ("Core", "Widget: Cocoa")
 
 with Files("*478536*"):
-    BUG_COMPONENT = ("Core", "Event Handling")
+    BUG_COMPONENT = ("Core", "User events and focus handling")
 
 with Files("*485118*"):
     BUG_COMPONENT = ("Toolkit", "XUL Widgets")
 
 with Files("*517396*"):
     BUG_COMPONENT = ("Toolkit", "XUL Widgets")
 
 with Files("*522217*"):
@@ -57,26 +57,26 @@ with Files("*565392*"):
 
 with Files("*586713*"):
     BUG_COMPONENT = ("Core", "Widget: Cocoa")
 
 with Files("*593307*"):
     BUG_COMPONENT = ("Core", "Widget: Win32")
 
 with Files("*596600*"):
-    BUG_COMPONENT = ("Core", "Event Handling")
+    BUG_COMPONENT = ("Core", "User events and focus handling")
 
 with Files("*673301*"):
     BUG_COMPONENT = ("Firefox", "Bookmarks & History")
 
 with Files("test_assign_event_data.html"):
-    BUG_COMPONENT = ("Core", "Event Handling")
+    BUG_COMPONENT = ("Core", "User events and focus handling")
 
 with Files("test_input_events_on_deactive_window.xul"):
-    BUG_COMPONENT = ("Core", "Event Handling")
+    BUG_COMPONENT = ("Core", "User events and focus handling")
 
 with Files("*chrome_context_menus_win*"):
     BUG_COMPONENT = ("Core", "General")
 
 with Files("*composition_text_querycontent*"):
     BUG_COMPONENT = ("Core", "Internationalization")
 
 with Files("*key_event_counts*"):
@@ -111,17 +111,17 @@ with Files("test_sizemode_events.xul"):
 
 with Files("*system_status_bar*"):
     BUG_COMPONENT = ("Core", "Widget: Cocoa")
 
 with Files("*taskbar_progress*"):
     BUG_COMPONENT = ("Core", "Widget: Win32")
 
 with Files("*wheeltransaction*"):
-    BUG_COMPONENT = ("Core", "Event Handling")
+    BUG_COMPONENT = ("Core", "User events and focus handling")
 
 
 XPCSHELL_TESTS_MANIFESTS += ['unit/xpcshell.ini']
 MOCHITEST_MANIFESTS += ['mochitest.ini']
 MOCHITEST_CHROME_MANIFESTS += ['chrome.ini']
 BROWSER_CHROME_MANIFESTS += ['browser/browser.ini']
 
 # if CONFIG['MOZ_WIDGET_TOOLKIT'] == 'windows':