Backed out 2 changesets (bug 1619914) for causing gtest failures regarding TransactionManager.
authorMihai Alexandru Michis <malexandru@mozilla.com>
Fri, 03 Apr 2020 07:57:06 +0300
changeset 521965 efd779b64b3fadfea4b6569490a3cd5546acba1a
parent 521964 a53090faed21d421996463f51a85422b4b03e010
child 521966 d760fa6a7936e342b59220987466e4b32d8c185a
push id37280
push useropoprus@mozilla.com
push dateFri, 03 Apr 2020 21:40:10 +0000
treeherdermozilla-central@cf48e59e88de [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
bugs1619914
milestone76.0a1
backs outd3816f82c0b9d4ceca0bb2ad177694164ed0921f
876b1031a6ae41a87ed146976f279b96bde9c7f6
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Backed out 2 changesets (bug 1619914) for causing gtest failures regarding TransactionManager. CLOSED TREE Backed out changeset d3816f82c0b9 (bug 1619914) Backed out changeset 876b1031a6ae (bug 1619914)
editor/libeditor/CSSEditUtils.cpp
editor/libeditor/ChangeAttributeTransaction.cpp
editor/libeditor/ChangeAttributeTransaction.h
editor/libeditor/ChangeStyleTransaction.cpp
editor/libeditor/ChangeStyleTransaction.h
editor/libeditor/CompositionTransaction.cpp
editor/libeditor/CompositionTransaction.h
editor/libeditor/CreateElementTransaction.cpp
editor/libeditor/CreateElementTransaction.h
editor/libeditor/DeleteNodeTransaction.cpp
editor/libeditor/DeleteNodeTransaction.h
editor/libeditor/DeleteRangeTransaction.cpp
editor/libeditor/DeleteRangeTransaction.h
editor/libeditor/DeleteTextTransaction.cpp
editor/libeditor/EditAggregateTransaction.cpp
editor/libeditor/EditAggregateTransaction.h
editor/libeditor/EditTransactionBase.h
editor/libeditor/EditorBase.cpp
editor/libeditor/EditorBase.h
editor/libeditor/EditorEventListener.cpp
editor/libeditor/EditorEventListener.h
editor/libeditor/EditorUtils.h
editor/libeditor/HTMLEditor.cpp
editor/libeditor/InsertNodeTransaction.cpp
editor/libeditor/InsertTextTransaction.cpp
editor/libeditor/JoinNodeTransaction.cpp
editor/libeditor/JoinNodeTransaction.h
editor/libeditor/PlaceholderTransaction.h
editor/libeditor/SplitNodeTransaction.cpp
editor/libeditor/SplitNodeTransaction.h
editor/nsIEditor.idl
editor/txmgr/TransactionItem.cpp
editor/txmgr/TransactionItem.h
editor/txmgr/TransactionManager.cpp
editor/txmgr/TransactionManager.h
editor/txmgr/nsITransaction.idl
editor/txmgr/nsITransactionManager.idl
editor/txmgr/tests/TestTXMgr.cpp
--- a/editor/libeditor/CSSEditUtils.cpp
+++ b/editor/libeditor/CSSEditUtils.cpp
@@ -378,22 +378,18 @@ bool CSSEditUtils::IsCSSEditableProperty
   return false;
 }
 
 // The lowest level above the transaction; adds the CSS declaration
 // "aProperty : aValue" to the inline styles carried by aElement
 nsresult CSSEditUtils::SetCSSProperty(Element& aElement, nsAtom& aProperty,
                                       const nsAString& aValue,
                                       bool aSuppressTxn) {
-  nsCOMPtr<nsStyledElement> styledElement = do_QueryInterface(&aElement);
-  if (NS_WARN_IF(!styledElement)) {
-    return NS_ERROR_INVALID_ARG;
-  }
   RefPtr<ChangeStyleTransaction> transaction =
-      ChangeStyleTransaction::Create(*styledElement, aProperty, aValue);
+      ChangeStyleTransaction::Create(aElement, aProperty, aValue);
   if (aSuppressTxn) {
     return transaction->DoTransaction();
   }
   if (NS_WARN_IF(!mHTMLEditor)) {
     return NS_ERROR_NOT_AVAILABLE;
   }
   RefPtr<HTMLEditor> htmlEditor(mHTMLEditor);
   nsresult rv = htmlEditor->DoTransactionInternal(transaction);
@@ -415,22 +411,18 @@ nsresult CSSEditUtils::SetCSSPropertyPix
 }
 
 // The lowest level above the transaction; removes the value aValue from the
 // list of values specified for the CSS property aProperty, or totally remove
 // the declaration if this property accepts only one value
 nsresult CSSEditUtils::RemoveCSSProperty(Element& aElement, nsAtom& aProperty,
                                          const nsAString& aValue,
                                          bool aSuppressTxn) {
-  nsCOMPtr<nsStyledElement> styledElement = do_QueryInterface(&aElement);
-  if (NS_WARN_IF(!styledElement)) {
-    return NS_ERROR_INVALID_ARG;
-  }
   RefPtr<ChangeStyleTransaction> transaction =
-      ChangeStyleTransaction::CreateToRemove(*styledElement, aProperty, aValue);
+      ChangeStyleTransaction::CreateToRemove(aElement, aProperty, aValue);
   if (aSuppressTxn) {
     nsresult rv = transaction->DoTransaction();
     NS_WARNING_ASSERTION(NS_SUCCEEDED(rv),
                          "ChangeStyleTransaction::DoTransaction() failed");
     return rv;
   }
   if (NS_WARN_IF(!mHTMLEditor)) {
     return NS_ERROR_NOT_AVAILABLE;
--- a/editor/libeditor/ChangeAttributeTransaction.cpp
+++ b/editor/libeditor/ChangeAttributeTransaction.cpp
@@ -58,55 +58,43 @@ NS_IMETHODIMP ChangeAttributeTransaction
   // XXX: hack until attribute-was-set code is implemented
   if (!mUndoValue.IsEmpty()) {
     mAttributeWasSet = true;
   }
   // XXX: end hack
 
   // Now set the attribute to the new value
   if (mRemoveAttribute) {
-    OwningNonNull<Element> element = *mElement;
-    nsresult rv = element->UnsetAttr(kNameSpaceID_None, mAttribute, true);
+    nsresult rv = mElement->UnsetAttr(kNameSpaceID_None, mAttribute, true);
     NS_WARNING_ASSERTION(NS_SUCCEEDED(rv), "Element::UnsetAttr() failed");
     return rv;
   }
 
-  OwningNonNull<Element> element = *mElement;
-  nsresult rv = element->SetAttr(kNameSpaceID_None, mAttribute, mValue, true);
+  nsresult rv = mElement->SetAttr(kNameSpaceID_None, mAttribute, mValue, true);
   NS_WARNING_ASSERTION(NS_SUCCEEDED(rv), "Element::SetAttr() failed");
   return rv;
 }
 
 NS_IMETHODIMP ChangeAttributeTransaction::UndoTransaction() {
-  if (NS_WARN_IF(!mElement)) {
-    return NS_ERROR_NOT_AVAILABLE;
-  }
   if (mAttributeWasSet) {
-    OwningNonNull<Element> element = *mElement;
     nsresult rv =
-        element->SetAttr(kNameSpaceID_None, mAttribute, mUndoValue, true);
+        mElement->SetAttr(kNameSpaceID_None, mAttribute, mUndoValue, true);
     NS_WARNING_ASSERTION(NS_SUCCEEDED(rv), "Element::SetAttr() failed");
     return rv;
   }
-  OwningNonNull<Element> element = *mElement;
-  nsresult rv = element->UnsetAttr(kNameSpaceID_None, mAttribute, true);
+  nsresult rv = mElement->UnsetAttr(kNameSpaceID_None, mAttribute, true);
   NS_WARNING_ASSERTION(NS_SUCCEEDED(rv), "Element::UnsetAttr() failed");
   return rv;
 }
 
 NS_IMETHODIMP ChangeAttributeTransaction::RedoTransaction() {
-  if (NS_WARN_IF(!mElement)) {
-    return NS_ERROR_NOT_AVAILABLE;
-  }
   if (mRemoveAttribute) {
-    OwningNonNull<Element> element = *mElement;
-    nsresult rv = element->UnsetAttr(kNameSpaceID_None, mAttribute, true);
+    nsresult rv = mElement->UnsetAttr(kNameSpaceID_None, mAttribute, true);
     NS_WARNING_ASSERTION(NS_SUCCEEDED(rv), "Element::UnsetAttr() failed");
     return rv;
   }
 
-  OwningNonNull<Element> element = *mElement;
-  nsresult rv = element->SetAttr(kNameSpaceID_None, mAttribute, mValue, true);
+  nsresult rv = mElement->SetAttr(kNameSpaceID_None, mAttribute, mValue, true);
   NS_WARNING_ASSERTION(NS_SUCCEEDED(rv), "Element::SetAttr() failed");
   return rv;
 }
 
 }  // namespace mozilla
--- a/editor/libeditor/ChangeAttributeTransaction.h
+++ b/editor/libeditor/ChangeAttributeTransaction.h
@@ -53,17 +53,17 @@ class ChangeAttributeTransaction final :
       dom::Element& aElement, nsAtom& aAttribute);
 
   NS_DECL_ISUPPORTS_INHERITED
   NS_DECL_CYCLE_COLLECTION_CLASS_INHERITED(ChangeAttributeTransaction,
                                            EditTransactionBase)
 
   NS_DECL_EDITTRANSACTIONBASE
 
-  MOZ_CAN_RUN_SCRIPT NS_IMETHOD RedoTransaction() override;
+  NS_IMETHOD RedoTransaction() override;
 
  private:
   virtual ~ChangeAttributeTransaction() = default;
 
   // The element to operate upon
   nsCOMPtr<dom::Element> mElement;
 
   // The attribute to change
--- a/editor/libeditor/ChangeStyleTransaction.cpp
+++ b/editor/libeditor/ChangeStyleTransaction.cpp
@@ -19,50 +19,48 @@
 #include "nsUnicharUtils.h"       // for nsCaseInsensitiveStringComparator
 
 namespace mozilla {
 
 using namespace dom;
 
 // static
 already_AddRefed<ChangeStyleTransaction> ChangeStyleTransaction::Create(
-    nsStyledElement& aStyledElement, nsAtom& aProperty,
-    const nsAString& aValue) {
+    Element& aElement, nsAtom& aProperty, const nsAString& aValue) {
   RefPtr<ChangeStyleTransaction> transaction =
-      new ChangeStyleTransaction(aStyledElement, aProperty, aValue, false);
+      new ChangeStyleTransaction(aElement, aProperty, aValue, false);
   return transaction.forget();
 }
 
 // static
 already_AddRefed<ChangeStyleTransaction> ChangeStyleTransaction::CreateToRemove(
-    nsStyledElement& aStyledElement, nsAtom& aProperty,
-    const nsAString& aValue) {
+    Element& aElement, nsAtom& aProperty, const nsAString& aValue) {
   RefPtr<ChangeStyleTransaction> transaction =
-      new ChangeStyleTransaction(aStyledElement, aProperty, aValue, true);
+      new ChangeStyleTransaction(aElement, aProperty, aValue, true);
   return transaction.forget();
 }
 
-ChangeStyleTransaction::ChangeStyleTransaction(nsStyledElement& aStyledElement,
+ChangeStyleTransaction::ChangeStyleTransaction(Element& aElement,
                                                nsAtom& aProperty,
                                                const nsAString& aValue,
                                                bool aRemove)
     : EditTransactionBase(),
-      mStyledElement(&aStyledElement),
+      mElement(&aElement),
       mProperty(&aProperty),
       mValue(aValue),
+      mRemoveProperty(aRemove),
       mUndoValue(),
       mRedoValue(),
-      mRemoveProperty(aRemove),
       mUndoAttributeWasSet(false),
       mRedoAttributeWasSet(false) {}
 
 #define kNullCh (char16_t('\0'))
 
 NS_IMPL_CYCLE_COLLECTION_INHERITED(ChangeStyleTransaction, EditTransactionBase,
-                                   mStyledElement)
+                                   mElement)
 
 NS_INTERFACE_MAP_BEGIN_CYCLE_COLLECTION(ChangeStyleTransaction)
 NS_INTERFACE_MAP_END_INHERITING(EditTransactionBase)
 
 NS_IMPL_ADDREF_INHERITED(ChangeStyleTransaction, EditTransactionBase)
 NS_IMPL_RELEASE_INHERITED(ChangeStyleTransaction, EditTransactionBase)
 
 // Answers true if aValue is in the string list of white-space separated values
@@ -138,30 +136,30 @@ void ChangeStyleTransaction::RemoveValue
     }
 
     start = ++end;
   }
   aValues.Assign(outString);
 }
 
 NS_IMETHODIMP ChangeStyleTransaction::DoTransaction() {
-  if (NS_WARN_IF(!mStyledElement)) {
-    return NS_ERROR_NOT_AVAILABLE;
+  // TODO: Change mElement to RefPtr<nsStyleElement>.
+  nsCOMPtr<nsStyledElement> inlineStyles = do_QueryInterface(mElement);
+  if (NS_WARN_IF(!inlineStyles)) {
+    return NS_ERROR_INVALID_ARG;
   }
 
-  OwningNonNull<nsStyledElement> styledElement = *mStyledElement;
-  nsCOMPtr<nsICSSDeclaration> cssDecl = styledElement->Style();
+  nsCOMPtr<nsICSSDeclaration> cssDecl = inlineStyles->Style();
 
   // FIXME(bug 1606994): Using atoms forces a string copy here which is not
   // great.
   nsAutoCString propertyNameString;
   mProperty->ToUTF8String(propertyNameString);
 
-  mUndoAttributeWasSet =
-      mStyledElement->HasAttr(kNameSpaceID_None, nsGkAtoms::style);
+  mUndoAttributeWasSet = mElement->HasAttr(kNameSpaceID_None, nsGkAtoms::style);
 
   nsAutoString values;
   nsresult rv = cssDecl->GetPropertyValue(propertyNameString, values);
   if (NS_FAILED(rv)) {
     NS_WARNING("nsICSSDeclaration::GetPropertyPriorityValue() failed");
     return rv;
   }
   mUndoValue.Assign(values);
@@ -218,45 +216,43 @@ NS_IMETHODIMP ChangeStyleTransaction::Do
       return error.StealNSResult();
     }
   }
 
   // Let's be sure we don't keep an empty style attribute
   uint32_t length = cssDecl->Length();
   if (!length) {
     nsresult rv =
-        styledElement->UnsetAttr(kNameSpaceID_None, nsGkAtoms::style, true);
+        mElement->UnsetAttr(kNameSpaceID_None, nsGkAtoms::style, true);
     if (NS_FAILED(rv)) {
       NS_WARNING("Element::UnsetAttr(nsGkAtoms::style) failed");
       return rv;
     }
   } else {
     mRedoAttributeWasSet = true;
   }
 
   rv = cssDecl->GetPropertyValue(propertyNameString, mRedoValue);
   NS_WARNING_ASSERTION(NS_SUCCEEDED(rv),
                        "nsICSSDeclaration::GetPropertyValue() failed");
   return rv;
 }
 
 nsresult ChangeStyleTransaction::SetStyle(bool aAttributeWasSet,
                                           nsAString& aValue) {
-  if (NS_WARN_IF(!mStyledElement)) {
-    return NS_ERROR_NOT_AVAILABLE;
-  }
-
   if (aAttributeWasSet) {
-    OwningNonNull<nsStyledElement> styledElement = *mStyledElement;
-
     // The style attribute was not empty, let's recreate the declaration
     nsAutoCString propertyNameString;
     mProperty->ToUTF8String(propertyNameString);
 
-    nsCOMPtr<nsICSSDeclaration> cssDecl = styledElement->Style();
+    nsCOMPtr<nsStyledElement> inlineStyles = do_QueryInterface(mElement);
+    if (NS_WARN_IF(!inlineStyles)) {
+      return NS_ERROR_INVALID_ARG;
+    }
+    nsCOMPtr<nsICSSDeclaration> cssDecl = inlineStyles->Style();
 
     ErrorResult error;
     if (aValue.IsEmpty()) {
       // An empty value means we have to remove the property
       nsAutoString returnString;
       cssDecl->RemoveProperty(propertyNameString, returnString, error);
       if (error.Failed()) {
         NS_WARNING("nsICSSDeclaration::RemoveProperty() failed");
@@ -267,20 +263,17 @@ nsresult ChangeStyleTransaction::SetStyl
     nsAutoString priority;
     cssDecl->GetPropertyPriority(propertyNameString, priority);
     cssDecl->SetProperty(propertyNameString, NS_ConvertUTF16toUTF8(aValue),
                          priority, error);
     NS_WARNING_ASSERTION(!error.Failed(),
                          "nsICSSDeclaration::SetProperty() failed");
     return error.StealNSResult();
   }
-
-  OwningNonNull<nsStyledElement> styledElement = *mStyledElement;
-  nsresult rv =
-      styledElement->UnsetAttr(kNameSpaceID_None, nsGkAtoms::style, true);
+  nsresult rv = mElement->UnsetAttr(kNameSpaceID_None, nsGkAtoms::style, true);
   NS_WARNING_ASSERTION(NS_SUCCEEDED(rv),
                        "Element::UnsetAttr(nsGkAtoms::style) failed");
   return rv;
 }
 
 NS_IMETHODIMP ChangeStyleTransaction::UndoTransaction() {
   nsresult rv = SetStyle(mUndoAttributeWasSet, mUndoValue);
   NS_WARNING_ASSERTION(NS_SUCCEEDED(rv),
--- a/editor/libeditor/ChangeStyleTransaction.h
+++ b/editor/libeditor/ChangeStyleTransaction.h
@@ -7,64 +7,61 @@
 #define mozilla_ChangeStyleTransaction_h
 
 #include "mozilla/EditTransactionBase.h"   // base class
 #include "nsCOMPtr.h"                      // nsCOMPtr members
 #include "nsCycleCollectionParticipant.h"  // various macros
 #include "nsString.h"                      // nsString members
 
 class nsAtom;
-class nsStyledElement;
 
 namespace mozilla {
 
 namespace dom {
 class Element;
 }  // namespace dom
 
 /**
  * A transaction that changes the value of a CSS inline style of a content
  * node.  This transaction covers add, remove, and change a property's value.
  */
 class ChangeStyleTransaction final : public EditTransactionBase {
  protected:
-  ChangeStyleTransaction(nsStyledElement& aStyledElement, nsAtom& aProperty,
+  ChangeStyleTransaction(dom::Element& aElement, nsAtom& aProperty,
                          const nsAString& aValue, bool aRemove);
 
  public:
   /**
    * Creates a change style transaction.  This never returns nullptr.
    *
-   * @param aStyledElement  The node whose style attribute will be changed.
-   * @param aProperty       The name of the property to change.
-   * @param aValue          New value for aProperty.
+   * @param aNode       The node whose style attribute will be changed.
+   * @param aProperty   The name of the property to change.
+   * @param aValue      New value for aProperty.
    */
   static already_AddRefed<ChangeStyleTransaction> Create(
-      nsStyledElement& aStyledElement, nsAtom& aProperty,
-      const nsAString& aValue);
+      dom::Element& aElement, nsAtom& aProperty, const nsAString& aValue);
 
   /**
    * Creates a change style transaction.  This never returns nullptr.
    *
-   * @param aStyledElement  The node whose style attribute will be changed.
-   * @param aProperty       The name of the property to change.
-   * @param aValue          The value to remove from aProperty.
+   * @param aNode       The node whose style attribute will be changed.
+   * @param aProperty   The name of the property to change.
+   * @param aValue      The value to remove from aProperty.
    */
   static already_AddRefed<ChangeStyleTransaction> CreateToRemove(
-      nsStyledElement& aStyledElement, nsAtom& aProperty,
-      const nsAString& aValue);
+      dom::Element& aElement, nsAtom& aProperty, const nsAString& aValue);
 
   NS_DECL_CYCLE_COLLECTION_CLASS_INHERITED(ChangeStyleTransaction,
                                            EditTransactionBase)
 
   NS_DECL_ISUPPORTS_INHERITED
 
   NS_DECL_EDITTRANSACTIONBASE
 
-  MOZ_CAN_RUN_SCRIPT NS_IMETHOD RedoTransaction() override;
+  NS_IMETHOD RedoTransaction() override;
 
   /**
    * Returns true if the list of white-space separated values contains aValue
    *
    * @param aValueList      [IN] a list of white-space separated values
    * @param aValue          [IN] the value to look for in the list
    * @return                true if the value is in the list of values
    */
@@ -101,36 +98,34 @@ class ChangeStyleTransaction final : pub
                                    const nsAString& aRemoveValue);
 
   /**
    * If the boolean is true and if the value is not the empty string,
    * set the property in the transaction to that value; if the value
    * is empty, remove the property from element's styles. If the boolean
    * is false, just remove the style attribute.
    */
-  MOZ_CAN_RUN_SCRIPT nsresult SetStyle(bool aAttributeWasSet,
-                                       nsAString& aValue);
+  nsresult SetStyle(bool aAttributeWasSet, nsAString& aValue);
 
   // The element to operate upon.
-  RefPtr<nsStyledElement> mStyledElement;
+  nsCOMPtr<dom::Element> mElement;
 
   // The CSS property to change.
   RefPtr<nsAtom> mProperty;
 
   // The value to set the property to (ignored if mRemoveProperty==true).
   nsString mValue;
 
+  // true if the operation is to remove mProperty from mElement.
+  bool mRemoveProperty;
+
   // The value to set the property to for undo.
   nsString mUndoValue;
   // The value to set the property to for redo.
   nsString mRedoValue;
-
-  // true if the operation is to remove mProperty from mElement.
-  bool mRemoveProperty;
-
   // True if the style attribute was present and not empty before DoTransaction.
   bool mUndoAttributeWasSet;
   // True if the style attribute is present and not empty after DoTransaction.
   bool mRedoAttributeWasSet;
 };
 
 }  // namespace mozilla
 
--- a/editor/libeditor/CompositionTransaction.cpp
+++ b/editor/libeditor/CompositionTransaction.cpp
@@ -74,104 +74,105 @@ NS_IMPL_CYCLE_COLLECTION_INHERITED(Compo
 
 NS_INTERFACE_MAP_BEGIN_CYCLE_COLLECTION(CompositionTransaction)
   NS_INTERFACE_MAP_ENTRY_CONCRETE(CompositionTransaction)
 NS_INTERFACE_MAP_END_INHERITING(EditTransactionBase)
 
 NS_IMPL_ADDREF_INHERITED(CompositionTransaction, EditTransactionBase)
 NS_IMPL_RELEASE_INHERITED(CompositionTransaction, EditTransactionBase)
 
-NS_IMETHODIMP CompositionTransaction::DoTransaction() {
-  if (NS_WARN_IF(!mEditorBase) || NS_WARN_IF(!mTextNode)) {
-    return NS_ERROR_NOT_AVAILABLE;
+MOZ_CAN_RUN_SCRIPT_BOUNDARY NS_IMETHODIMP
+CompositionTransaction::DoTransaction() {
+  if (NS_WARN_IF(!mEditorBase)) {
+    return NS_ERROR_NOT_INITIALIZED;
   }
 
   // Fail before making any changes if there's no selection controller
   if (NS_WARN_IF(!mEditorBase->GetSelectionController())) {
-    return NS_ERROR_NOT_AVAILABLE;
+    return NS_ERROR_NOT_INITIALIZED;
   }
 
-  OwningNonNull<EditorBase> editorBase = *mEditorBase;
-  OwningNonNull<Text> textNode = *mTextNode;
+  RefPtr<EditorBase> editorBase = mEditorBase;
+  RefPtr<Text> textNode = mTextNode;
 
   // Advance caret: This requires the presentation shell to get the selection.
   if (mReplaceLength == 0) {
     ErrorResult error;
-    editorBase->DoInsertText(textNode, mOffset, mStringToInsert, error);
+    editorBase->DoInsertText(*textNode, mOffset, mStringToInsert, error);
     if (error.Failed()) {
       NS_WARNING("EditorBase::DoInsertText() failed");
       return error.StealNSResult();
     }
-    editorBase->RangeUpdaterRef().SelAdjInsertText(textNode, mOffset,
+    editorBase->RangeUpdaterRef().SelAdjInsertText(*textNode, mOffset,
                                                    mStringToInsert);
   } else {
     uint32_t replaceableLength = textNode->TextLength() - mOffset;
     ErrorResult error;
-    editorBase->DoReplaceText(textNode, mOffset, mReplaceLength,
+    editorBase->DoReplaceText(*textNode, mOffset, mReplaceLength,
                               mStringToInsert, error);
     if (error.Failed()) {
       NS_WARNING("EditorBase::DoReplaceText() failed");
       return error.StealNSResult();
     }
     DebugOnly<nsresult> rvIgnored =
-        editorBase->RangeUpdaterRef().SelAdjDeleteText(textNode, mOffset,
+        editorBase->RangeUpdaterRef().SelAdjDeleteText(*textNode, mOffset,
                                                        mReplaceLength);
     NS_WARNING_ASSERTION(
         NS_SUCCEEDED(rvIgnored),
         "RangeUpdater::SelAdjDeleteText() failed, but ignored");
-    editorBase->RangeUpdaterRef().SelAdjInsertText(textNode, mOffset,
+    editorBase->RangeUpdaterRef().SelAdjInsertText(*textNode, mOffset,
                                                    mStringToInsert);
 
     // If IME text node is multiple node, ReplaceData doesn't remove all IME
     // text.  So we need remove remained text into other text node.
     // XXX I think that this shouldn't occur.  Composition string should be
     //     in a text node.
     if (replaceableLength < mReplaceLength) {
       int32_t remainLength = mReplaceLength - replaceableLength;
+      nsCOMPtr<nsINode> node = textNode->GetNextSibling();
       IgnoredErrorResult ignoredError;
-      for (nsIContent* nextSibling = textNode->GetNextSibling();
-           nextSibling && nextSibling->IsText() && remainLength;
-           nextSibling = nextSibling->GetNextSibling()) {
-        OwningNonNull<Text> textNode = *static_cast<Text*>(nextSibling);
+      while (node && node->IsText() && remainLength > 0) {
+        RefPtr<Text> textNode = static_cast<Text*>(node.get());
         uint32_t textLength = textNode->TextLength();
-        editorBase->DoDeleteText(textNode, 0, remainLength, ignoredError);
+        editorBase->DoDeleteText(*textNode, 0, remainLength, ignoredError);
         NS_WARNING_ASSERTION(!ignoredError.Failed(),
                              "EditorBase::DoDeleteText() failed, but ignored");
         ignoredError.SuppressException();
-        // XXX Needs to check whether the text is deleted as expected.
-        editorBase->RangeUpdaterRef().SelAdjDeleteText(textNode, 0,
+        editorBase->RangeUpdaterRef().SelAdjDeleteText(*textNode, 0,
                                                        remainLength);
         remainLength -= textLength;
+        node = node->GetNextSibling();
       }
     }
   }
 
   nsresult rv = SetSelectionForRanges();
   NS_WARNING_ASSERTION(
       NS_SUCCEEDED(rv),
       "CompositionTransaction::SetSelectionForRanges() failed");
   return rv;
 }
 
-NS_IMETHODIMP CompositionTransaction::UndoTransaction() {
-  if (NS_WARN_IF(!mEditorBase) || NS_WARN_IF(!mTextNode)) {
-    return NS_ERROR_NOT_AVAILABLE;
+MOZ_CAN_RUN_SCRIPT_BOUNDARY NS_IMETHODIMP
+CompositionTransaction::UndoTransaction() {
+  if (NS_WARN_IF(!mEditorBase)) {
+    return NS_ERROR_NOT_INITIALIZED;
   }
 
   // Get the selection first so we'll fail before making any changes if we
   // can't get it
   RefPtr<Selection> selection = mEditorBase->GetSelection();
   if (NS_WARN_IF(!selection)) {
-    return NS_ERROR_NOT_AVAILABLE;
+    return NS_ERROR_NOT_INITIALIZED;
   }
 
-  OwningNonNull<EditorBase> editorBase = *mEditorBase;
-  OwningNonNull<Text> textNode = *mTextNode;
+  RefPtr<EditorBase> editorBase = mEditorBase;
+  RefPtr<Text> textNode = mTextNode;
   ErrorResult error;
-  editorBase->DoDeleteText(textNode, mOffset, mStringToInsert.Length(), error);
+  editorBase->DoDeleteText(*textNode, mOffset, mStringToInsert.Length(), error);
   if (error.Failed()) {
     NS_WARNING("EditorBase::DoDeleteText() failed");
     return error.StealNSResult();
   }
 
   // set the selection to the insertion point where the string was removed
   nsresult rv = selection->Collapse(textNode, mOffset);
   NS_ASSERTION(NS_SUCCEEDED(rv), "Selection::Collapse() failed");
@@ -205,24 +206,21 @@ NS_IMETHODIMP CompositionTransaction::Me
   return NS_OK;
 }
 
 void CompositionTransaction::MarkFixed() { mFixed = true; }
 
 /* ============ private methods ================== */
 
 nsresult CompositionTransaction::SetSelectionForRanges() {
-  if (NS_WARN_IF(!mEditorBase) || NS_WARN_IF(!mTextNode)) {
-    return NS_ERROR_NOT_AVAILABLE;
+  if (NS_WARN_IF(!mEditorBase)) {
+    return NS_ERROR_NOT_INITIALIZED;
   }
-  OwningNonNull<EditorBase> editorBase = *mEditorBase;
-  OwningNonNull<Text> textNode = *mTextNode;
-  RefPtr<TextRangeArray> ranges = mRanges;
-  nsresult rv = SetIMESelection(editorBase, textNode, mOffset,
-                                mStringToInsert.Length(), ranges);
+  nsresult rv = SetIMESelection(*mEditorBase, mTextNode, mOffset,
+                                mStringToInsert.Length(), mRanges);
   NS_WARNING_ASSERTION(NS_SUCCEEDED(rv),
                        "CompositionTransaction::SetIMESelection() failed");
   return rv;
 }
 
 // static
 nsresult CompositionTransaction::SetIMESelection(
     EditorBase& aEditorBase, Text* aTextNode, uint32_t aOffsetInNode,
--- a/editor/libeditor/CompositionTransaction.h
+++ b/editor/libeditor/CompositionTransaction.h
@@ -66,24 +66,24 @@ class CompositionTransaction final : pub
   NS_DECL_ISUPPORTS_INHERITED
 
   NS_DECL_EDITTRANSACTIONBASE
 
   NS_IMETHOD Merge(nsITransaction* aTransaction, bool* aDidMerge) override;
 
   void MarkFixed();
 
-  MOZ_CAN_RUN_SCRIPT static nsresult SetIMESelection(
+  MOZ_CAN_RUN_SCRIPT_BOUNDARY static nsresult SetIMESelection(
       EditorBase& aEditorBase, dom::Text* aTextNode, uint32_t aOffsetInNode,
       uint32_t aLengthOfCompositionString, const TextRangeArray* aRanges);
 
  private:
   virtual ~CompositionTransaction() = default;
 
-  MOZ_CAN_RUN_SCRIPT nsresult SetSelectionForRanges();
+  nsresult SetSelectionForRanges();
 
   // The text element to operate upon.
   RefPtr<dom::Text> mTextNode;
 
   // The offsets into mTextNode where the insertion should be placed.
   uint32_t mOffset;
 
   uint32_t mReplaceLength;
--- a/editor/libeditor/CreateElementTransaction.cpp
+++ b/editor/libeditor/CreateElementTransaction.cpp
@@ -49,47 +49,44 @@ already_AddRefed<CreateElementTransactio
 
 template <typename PT, typename CT>
 CreateElementTransaction::CreateElementTransaction(
     EditorBase& aEditorBase, nsAtom& aTag,
     const EditorDOMPointBase<PT, CT>& aPointToInsert)
     : EditTransactionBase(),
       mEditorBase(&aEditorBase),
       mTag(&aTag),
-      mPointToInsert(aPointToInsert) {
-  MOZ_ASSERT(!mPointToInsert.IsInDataNode());
-  // We only need the child node at inserting new node.
-  AutoEditorDOMPointOffsetInvalidator lockChild(mPointToInsert);
-}
+      mPointToInsert(aPointToInsert) {}
 
 NS_IMPL_CYCLE_COLLECTION_INHERITED(CreateElementTransaction,
                                    EditTransactionBase, mEditorBase,
-                                   mPointToInsert, mNewElement)
+                                   mPointToInsert, mNewNode)
 
 NS_IMPL_ADDREF_INHERITED(CreateElementTransaction, EditTransactionBase)
 NS_IMPL_RELEASE_INHERITED(CreateElementTransaction, EditTransactionBase)
 NS_INTERFACE_MAP_BEGIN_CYCLE_COLLECTION(CreateElementTransaction)
 NS_INTERFACE_MAP_END_INHERITING(EditTransactionBase)
 
-NS_IMETHODIMP CreateElementTransaction::DoTransaction() {
+MOZ_CAN_RUN_SCRIPT_BOUNDARY NS_IMETHODIMP
+CreateElementTransaction::DoTransaction() {
   if (NS_WARN_IF(!mEditorBase) || NS_WARN_IF(!mTag) ||
       NS_WARN_IF(!mPointToInsert.IsSet())) {
     return NS_ERROR_NOT_INITIALIZED;
   }
 
-  OwningNonNull<EditorBase> editorBase = *mEditorBase;
+  RefPtr<EditorBase> editorBase(mEditorBase);
 
-  mNewElement = editorBase->CreateHTMLContent(mTag);
-  if (!mNewElement) {
+  mNewNode = editorBase->CreateHTMLContent(mTag);
+  if (!mNewNode) {
     NS_WARNING("EditorBase::CreateHTMLContent() failed");
     return NS_ERROR_FAILURE;
   }
 
   // Try to insert formatting whitespace for the new node:
-  OwningNonNull<Element> newElement = *mNewElement;
+  OwningNonNull<Element> newElement(*mNewNode);
   nsresult rv = editorBase->MarkElementDirty(newElement);
   if (NS_WARN_IF(rv == NS_ERROR_EDITOR_DESTROYED)) {
     return EditorBase::ToGenericNSResult(rv);
   }
   NS_WARNING_ASSERTION(NS_SUCCEEDED(rv),
                        "EditorBase::MarkElementDirty() failed, but ignored");
 
   // Insert the new node
@@ -106,94 +103,85 @@ NS_IMETHODIMP CreateElementTransaction::
     return NS_OK;
   }
 
   RefPtr<Selection> selection = editorBase->GetSelection();
   if (NS_WARN_IF(!selection)) {
     return NS_ERROR_FAILURE;
   }
 
-  EditorRawDOMPoint afterNewNode(EditorRawDOMPoint::After(newElement));
+  EditorRawDOMPoint afterNewNode(EditorRawDOMPoint::After(mNewNode));
   if (NS_WARN_IF(!afterNewNode.IsSet())) {
     // If mutation observer or mutation event listener moved or removed the
     // new node, we hit this case.  Should we use script blocker while we're
     // in this method?
     return NS_ERROR_FAILURE;
   }
   IgnoredErrorResult ignoredError;
   selection->Collapse(afterNewNode, ignoredError);
   NS_WARNING_ASSERTION(!ignoredError.Failed(),
                        "Selection::Collapse() failed, but ignored");
   return NS_OK;
 }
 
 void CreateElementTransaction::InsertNewNode(ErrorResult& aError) {
-  MOZ_ASSERT(mNewElement);
-  MOZ_ASSERT(mPointToInsert.IsSet());
-
   if (mPointToInsert.IsSetAndValid()) {
     if (mPointToInsert.IsEndOfContainer()) {
-      OwningNonNull<nsINode> container = *mPointToInsert.GetContainer();
-      OwningNonNull<Element> newElement = *mNewElement;
-      container->AppendChild(newElement, aError);
+      mPointToInsert.GetContainer()->AppendChild(*mNewNode, aError);
       NS_WARNING_ASSERTION(!aError.Failed(),
                            "nsINode::AppendChild() failed, but ignored");
       return;
     }
-    MOZ_ASSERT(mPointToInsert.GetChild());
-    OwningNonNull<nsINode> container = *mPointToInsert.GetContainer();
-    OwningNonNull<nsIContent> child = *mPointToInsert.GetChild();
-    OwningNonNull<Element> newElement = *mNewElement;
-    container->InsertBefore(newElement, child, aError);
+    mPointToInsert.GetContainer()->InsertBefore(
+        *mNewNode, mPointToInsert.GetChild(), aError);
     NS_WARNING_ASSERTION(!aError.Failed(),
                          "nsINode::InsertBefore() failed, but ignored");
     return;
   }
 
-  if (NS_WARN_IF(mPointToInsert.GetContainer() !=
-                 mPointToInsert.GetChild()->GetParentNode())) {
+  if (NS_WARN_IF(mPointToInsert.GetChild() &&
+                 mPointToInsert.GetContainer() !=
+                     mPointToInsert.GetChild()->GetParentNode())) {
     aError.Throw(NS_ERROR_FAILURE);
     return;
   }
 
   // If mPointToInsert has only offset and it's not valid, we need to treat
   // it as pointing end of the container.
-  OwningNonNull<nsINode> container = *mPointToInsert.GetContainer();
-  OwningNonNull<Element> newElement = *mNewElement;
-  container->AppendChild(newElement, aError);
+  mPointToInsert.GetContainer()->AppendChild(*mNewNode, aError);
   NS_WARNING_ASSERTION(!aError.Failed(),
                        "nsINode::AppendChild() failed, but ignored");
 }
 
 NS_IMETHODIMP CreateElementTransaction::UndoTransaction() {
-  if (NS_WARN_IF(!mEditorBase) || NS_WARN_IF(!mPointToInsert.IsSet()) ||
-      NS_WARN_IF(!mNewElement)) {
-    return NS_ERROR_NOT_AVAILABLE;
+  if (NS_WARN_IF(!mEditorBase) || NS_WARN_IF(!mPointToInsert.IsSet())) {
+    return NS_ERROR_NOT_INITIALIZED;
   }
 
-  OwningNonNull<Element> newElement = *mNewElement;
-  OwningNonNull<nsINode> containerNode = *mPointToInsert.GetContainer();
   ErrorResult error;
-  containerNode->RemoveChild(newElement, error);
+  mPointToInsert.GetContainer()->RemoveChild(*mNewNode, error);
   NS_WARNING_ASSERTION(!error.Failed(), "nsINode::RemoveChild() failed");
   return error.StealNSResult();
 }
 
 NS_IMETHODIMP CreateElementTransaction::RedoTransaction() {
-  if (NS_WARN_IF(!mEditorBase) || NS_WARN_IF(!mPointToInsert.IsSet()) ||
-      NS_WARN_IF(!mNewElement)) {
-    return NS_ERROR_NOT_AVAILABLE;
+  if (NS_WARN_IF(!mEditorBase) || NS_WARN_IF(!mPointToInsert.IsSet())) {
+    return NS_ERROR_NOT_INITIALIZED;
   }
 
-  // First, reset mNewElement so it has no attributes or content
-  // XXX We never actually did this, we only cleared mNewElement's contents if
-  // it was a CharacterData node (which it's not, it's an Element)
+  // First, reset mNewNode so it has no attributes or content
+  // XXX We never actually did this, we only cleared mNewNode's contents if it
+  // was a CharacterData node (which it's not, it's an Element)
   // XXX Don't we need to set selection like DoTransaction()?
 
-  // Now, reinsert mNewElement
+  // Now, reinsert mNewNode
   ErrorResult error;
   InsertNewNode(error);
   NS_WARNING_ASSERTION(!error.Failed(),
                        "CreateElementTransaction::InsertNewNode() failed");
   return error.StealNSResult();
 }
 
+already_AddRefed<Element> CreateElementTransaction::GetNewNode() {
+  return nsCOMPtr<Element>(mNewNode).forget();
+}
+
 }  // namespace mozilla
--- a/editor/libeditor/CreateElementTransaction.h
+++ b/editor/libeditor/CreateElementTransaction.h
@@ -3,29 +3,33 @@
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 #ifndef CreateElementTransaction_h
 #define CreateElementTransaction_h
 
 #include "mozilla/EditorDOMPoint.h"
 #include "mozilla/EditTransactionBase.h"
-#include "mozilla/RefPtr.h"
-#include "mozilla/dom/Element.h"
+#include "nsCOMPtr.h"
 #include "nsCycleCollectionParticipant.h"
 #include "nsISupportsImpl.h"
 
 class nsAtom;
+class nsIContent;
+class nsINode;
 
 /**
  * A transaction that creates a new node in the content tree.
  */
 namespace mozilla {
 
 class EditorBase;
+namespace dom {
+class Element;
+}  // namespace dom
 
 class CreateElementTransaction final : public EditTransactionBase {
  protected:
   template <typename PT, typename CT>
   CreateElementTransaction(EditorBase& aEditorBase, nsAtom& aTag,
                            const EditorDOMPointBase<PT, CT>& aPointToInsert);
 
  public:
@@ -46,36 +50,36 @@ class CreateElementTransaction final : p
       const EditorDOMPointBase<PT, CT>& aPointToInsert);
 
   NS_DECL_ISUPPORTS_INHERITED
   NS_DECL_CYCLE_COLLECTION_CLASS_INHERITED(CreateElementTransaction,
                                            EditTransactionBase)
 
   NS_DECL_EDITTRANSACTIONBASE
 
-  MOZ_CAN_RUN_SCRIPT NS_IMETHOD RedoTransaction() override;
+  NS_IMETHOD RedoTransaction() override;
 
-  dom::Element* GetNewElement() const { return mNewElement; }
+  already_AddRefed<dom::Element> GetNewNode();
 
  protected:
   virtual ~CreateElementTransaction() = default;
 
   /**
    * InsertNewNode() inserts mNewNode before the child node at mPointToInsert.
    */
-  MOZ_CAN_RUN_SCRIPT void InsertNewNode(ErrorResult& aError);
+  void InsertNewNode(ErrorResult& aError);
 
   // The document into which the new node will be inserted.
   RefPtr<EditorBase> mEditorBase;
 
   // The tag (mapping to object type) for the new element.
   RefPtr<nsAtom> mTag;
 
   // The DOM point we will insert mNewNode.
   EditorDOMPoint mPointToInsert;
 
   // The new node to insert.
-  RefPtr<dom::Element> mNewElement;
+  nsCOMPtr<dom::Element> mNewNode;
 };
 
 }  // namespace mozilla
 
 #endif  // #ifndef CreateElementTransaction_h
--- a/editor/libeditor/DeleteNodeTransaction.cpp
+++ b/editor/libeditor/DeleteNodeTransaction.cpp
@@ -9,97 +9,93 @@
 #include "nsDebug.h"
 #include "nsError.h"
 #include "nsAString.h"
 
 namespace mozilla {
 
 // static
 already_AddRefed<DeleteNodeTransaction> DeleteNodeTransaction::MaybeCreate(
-    EditorBase& aEditorBase, nsIContent& aContentToDelete) {
+    EditorBase& aEditorBase, nsINode& aNodeToDelete) {
   RefPtr<DeleteNodeTransaction> transaction =
-      new DeleteNodeTransaction(aEditorBase, aContentToDelete);
+      new DeleteNodeTransaction(aEditorBase, aNodeToDelete);
   if (NS_WARN_IF(!transaction->CanDoIt())) {
     return nullptr;
   }
   return transaction.forget();
 }
 
 DeleteNodeTransaction::DeleteNodeTransaction(EditorBase& aEditorBase,
-                                             nsIContent& aContentToDelete)
+                                             nsINode& aNodeToDelete)
     : mEditorBase(&aEditorBase),
-      mContentToDelete(&aContentToDelete),
-      mParentNode(aContentToDelete.GetParentNode()) {}
+      mNodeToDelete(&aNodeToDelete),
+      mParentNode(aNodeToDelete.GetParentNode()) {}
 
 NS_IMPL_CYCLE_COLLECTION_INHERITED(DeleteNodeTransaction, EditTransactionBase,
-                                   mEditorBase, mContentToDelete, mParentNode,
-                                   mRefContent)
+                                   mEditorBase, mNodeToDelete, mParentNode,
+                                   mRefNode)
 
 NS_IMPL_ADDREF_INHERITED(DeleteNodeTransaction, EditTransactionBase)
 NS_IMPL_RELEASE_INHERITED(DeleteNodeTransaction, EditTransactionBase)
 NS_INTERFACE_MAP_BEGIN_CYCLE_COLLECTION(DeleteNodeTransaction)
 NS_INTERFACE_MAP_END_INHERITING(EditTransactionBase)
 
 bool DeleteNodeTransaction::CanDoIt() const {
-  if (NS_WARN_IF(!mContentToDelete) || NS_WARN_IF(!mEditorBase) ||
-      !mParentNode || !mEditorBase->IsModifiableNode(*mParentNode)) {
+  if (NS_WARN_IF(!mNodeToDelete) || NS_WARN_IF(!mEditorBase) || !mParentNode ||
+      !mEditorBase->IsModifiableNode(*mParentNode)) {
     return false;
   }
   return true;
 }
 
 NS_IMETHODIMP DeleteNodeTransaction::DoTransaction() {
   if (NS_WARN_IF(!CanDoIt())) {
     return NS_OK;
   }
 
-  if (!mEditorBase->AsHTMLEditor() && mContentToDelete->IsText()) {
-    uint32_t length = mContentToDelete->AsText()->TextLength();
+  if (!mEditorBase->AsHTMLEditor() && mNodeToDelete->IsText()) {
+    uint32_t length = mNodeToDelete->AsText()->TextLength();
     if (length > 0) {
       mEditorBase->AsTextEditor()->WillDeleteText(length, 0, length);
     }
   }
 
-  // Remember which child mContentToDelete was (by remembering which child was
-  // next).  Note that mRefContent can be nullptr.
-  mRefContent = mContentToDelete->GetNextSibling();
+  // Remember which child mNodeToDelete was (by remembering which child was
+  // next).  Note that mRefNode can be nullptr.
+  mRefNode = mNodeToDelete->GetNextSibling();
 
   // give range updater a chance.  SelAdjDeleteNode() needs to be called
   // *before* we do the action, unlike some of the other RangeItem update
   // methods.
-  mEditorBase->RangeUpdaterRef().SelAdjDeleteNode(*mContentToDelete);
+  mEditorBase->RangeUpdaterRef().SelAdjDeleteNode(*mNodeToDelete);
 
-  OwningNonNull<nsINode> parentNode = *mParentNode;
-  OwningNonNull<nsIContent> contentToDelete = *mContentToDelete;
   ErrorResult error;
-  parentNode->RemoveChild(contentToDelete, error);
+  mParentNode->RemoveChild(*mNodeToDelete, error);
   NS_WARNING_ASSERTION(!error.Failed(), "nsINode::RemoveChild() failed");
   return error.StealNSResult();
 }
 
 MOZ_CAN_RUN_SCRIPT_BOUNDARY NS_IMETHODIMP
 DeleteNodeTransaction::UndoTransaction() {
   if (NS_WARN_IF(!CanDoIt())) {
     // This is a legal state, the transaction is a no-op.
     return NS_OK;
   }
   ErrorResult error;
-  OwningNonNull<EditorBase> editorBase = *mEditorBase;
-  OwningNonNull<nsINode> parentNode = *mParentNode;
-  OwningNonNull<nsIContent> contentToDelete = *mContentToDelete;
-  nsCOMPtr<nsIContent> refContent = mRefContent;
-  // XXX Perhaps, we should check `refContent` is a child of `parentNode`,
-  //     and if it's not, we should stop undoing or something.
-  parentNode->InsertBefore(contentToDelete, refContent, error);
+  RefPtr<EditorBase> editorBase = mEditorBase;
+  nsCOMPtr<nsINode> parent = mParentNode;
+  nsCOMPtr<nsINode> nodeToDelete = mNodeToDelete;
+  nsCOMPtr<nsIContent> refNode = mRefNode;
+  parent->InsertBefore(*nodeToDelete, refNode, error);
   if (error.Failed()) {
     NS_WARNING("nsINode::InsertBefore() failed");
     return error.StealNSResult();
   }
-  if (!editorBase->AsHTMLEditor() && contentToDelete->IsText()) {
-    uint32_t length = contentToDelete->AsText()->TextLength();
+  if (!editorBase->AsHTMLEditor() && nodeToDelete->IsText()) {
+    uint32_t length = nodeToDelete->AsText()->TextLength();
     if (length > 0) {
       nsresult rv = MOZ_KnownLive(editorBase->AsTextEditor())
                         ->DidInsertText(length, 0, length);
       if (NS_FAILED(rv)) {
         NS_WARNING("TextEditor::DidInsertText() failed");
         return rv;
       }
     }
@@ -108,26 +104,24 @@ DeleteNodeTransaction::UndoTransaction()
 }
 
 NS_IMETHODIMP DeleteNodeTransaction::RedoTransaction() {
   if (NS_WARN_IF(!CanDoIt())) {
     // This is a legal state, the transaction is a no-op.
     return NS_OK;
   }
 
-  if (!mEditorBase->AsHTMLEditor() && mContentToDelete->IsText()) {
-    uint32_t length = mContentToDelete->AsText()->TextLength();
+  if (!mEditorBase->AsHTMLEditor() && mNodeToDelete->IsText()) {
+    uint32_t length = mNodeToDelete->AsText()->TextLength();
     if (length > 0) {
       mEditorBase->AsTextEditor()->WillDeleteText(length, 0, length);
     }
   }
 
-  mEditorBase->RangeUpdaterRef().SelAdjDeleteNode(*mContentToDelete);
+  mEditorBase->RangeUpdaterRef().SelAdjDeleteNode(*mNodeToDelete);
 
-  OwningNonNull<nsINode> parentNode = *mParentNode;
-  OwningNonNull<nsIContent> contentToDelete = *mContentToDelete;
   ErrorResult error;
-  parentNode->RemoveChild(contentToDelete, error);
+  mParentNode->RemoveChild(*mNodeToDelete, error);
   NS_WARNING_ASSERTION(!error.Failed(), "nsINode::RemoveChild() failed");
   return error.StealNSResult();
 }
 
 }  // namespace mozilla
--- a/editor/libeditor/DeleteNodeTransaction.h
+++ b/editor/libeditor/DeleteNodeTransaction.h
@@ -18,54 +18,54 @@ namespace mozilla {
 
 class EditorBase;
 
 /**
  * A transaction that deletes a single element
  */
 class DeleteNodeTransaction final : public EditTransactionBase {
  protected:
-  DeleteNodeTransaction(EditorBase& aEditorBase, nsIContent& aContentToDelete);
+  DeleteNodeTransaction(EditorBase& aEditorBase, nsINode& aNodeToDelete);
 
  public:
   /**
    * Creates a delete node transaction instance.  This returns nullptr if
    * it cannot remove the node from its parent.
    *
    * @param aEditorBase         The editor.
-   * @param aContentToDelete    The node to be removed from the DOM tree.
+   * @param aNodeToDelete       The node to be removed from the DOM tree.
    */
   static already_AddRefed<DeleteNodeTransaction> MaybeCreate(
-      EditorBase& aEditorBase, nsIContent& aContentToDelete);
+      EditorBase& aEditorBase, nsINode& aNodeToDelete);
 
   /**
    * CanDoIt() returns true if there are enough members and can modify the
    * parent.  Otherwise, false.
    */
   bool CanDoIt() const;
 
   NS_DECL_ISUPPORTS_INHERITED
   NS_DECL_CYCLE_COLLECTION_CLASS_INHERITED(DeleteNodeTransaction,
                                            EditTransactionBase)
 
   NS_DECL_EDITTRANSACTIONBASE
 
-  MOZ_CAN_RUN_SCRIPT NS_IMETHOD RedoTransaction() override;
+  NS_IMETHOD RedoTransaction() override;
 
  protected:
   virtual ~DeleteNodeTransaction() = default;
 
   // The editor for this transaction.
   RefPtr<EditorBase> mEditorBase;
 
   // The element to delete.
-  nsCOMPtr<nsIContent> mContentToDelete;
+  nsCOMPtr<nsINode> mNodeToDelete;
 
   // Parent of node to delete.
   nsCOMPtr<nsINode> mParentNode;
 
   // Next sibling to remember for undo/redo purposes.
-  nsCOMPtr<nsIContent> mRefContent;
+  nsCOMPtr<nsIContent> mRefNode;
 };
 
 }  // namespace mozilla
 
 #endif  // #ifndef DeleteNodeTransaction_h
--- a/editor/libeditor/DeleteRangeTransaction.cpp
+++ b/editor/libeditor/DeleteRangeTransaction.cpp
@@ -125,17 +125,17 @@ nsresult DeleteRangeTransaction::CreateT
     return NS_ERROR_INVALID_ARG;
   }
 
   if (NS_WARN_IF(!mEditorBase)) {
     return NS_ERROR_NOT_AVAILABLE;
   }
 
   // see what kind of node we have
-  if (Text* textNode = Text::FromNode(aStart.Container())) {
+  if (RefPtr<Text> textNode = Text::FromNode(aStart.Container())) {
     // if the node is a chardata node, then delete chardata content
     int32_t numToDel;
     if (aStart == aEnd) {
       numToDel = 1;
     } else {
       numToDel = *aEnd.Offset(RawRangeBoundary::OffsetFilter::kValidOffsets) -
                  *aStart.Offset(RawRangeBoundary::OffsetFilter::kValidOffsets);
       MOZ_DIAGNOSTIC_ASSERT(numToDel > 0);
@@ -188,17 +188,17 @@ nsresult DeleteRangeTransaction::CreateT
   if (NS_WARN_IF(!aPoint.IsSetAndValid())) {
     return NS_ERROR_INVALID_ARG;
   }
 
   if (NS_WARN_IF(!mEditorBase)) {
     return NS_ERROR_NOT_AVAILABLE;
   }
 
-  Text* textNode = Text::FromNode(aPoint.Container());
+  RefPtr<Text> textNode = Text::FromNode(aPoint.Container());
   if (!textNode) {
     return NS_OK;
   }
 
   // If the node is a chardata node, then delete chardata content
   uint32_t startOffset, numToDelete;
   if (nsIEditor::eNext == aAction) {
     startOffset = *aPoint.Offset(RawRangeBoundary::OffsetFilter::kValidOffsets);
@@ -238,23 +238,23 @@ nsresult DeleteRangeTransaction::CreateT
   ContentSubtreeIterator subtreeIter;
   nsresult rv = subtreeIter.Init(aRangeToDelete);
   if (NS_FAILED(rv)) {
     NS_WARNING("ContentSubtreeIterator::Init() failed");
     return rv;
   }
 
   for (; !subtreeIter.IsDone(); subtreeIter.Next()) {
-    nsINode* node = subtreeIter.GetCurrentNode();
-    if (NS_WARN_IF(!node) || NS_WARN_IF(!node->IsContent())) {
-      return NS_ERROR_FAILURE;
+    nsCOMPtr<nsINode> node = subtreeIter.GetCurrentNode();
+    if (NS_WARN_IF(!node)) {
+      return NS_ERROR_NULL_POINTER;
     }
 
     RefPtr<DeleteNodeTransaction> deleteNodeTransaction =
-        DeleteNodeTransaction::MaybeCreate(*mEditorBase, *node->AsContent());
+        DeleteNodeTransaction::MaybeCreate(*mEditorBase, *node);
     // XXX This is odd handling.  Even if some nodes in the range are not
     //     editable, editor should append transactions because they could
     //     at undoing/redoing.  Additionally, if the transaction needs to
     //     delete/restore all nodes, it should at undoing/redoing.
     if (!deleteNodeTransaction) {
       NS_WARNING("DeleteNodeTransaction::MaybeCreate() failed");
       return NS_ERROR_FAILURE;
     }
--- a/editor/libeditor/DeleteRangeTransaction.h
+++ b/editor/libeditor/DeleteRangeTransaction.h
@@ -44,17 +44,17 @@ class DeleteRangeTransaction final : pub
   }
 
   NS_DECL_CYCLE_COLLECTION_CLASS_INHERITED(DeleteRangeTransaction,
                                            EditAggregateTransaction)
   NS_IMETHOD QueryInterface(REFNSIID aIID, void** aInstancePtr) override;
 
   NS_DECL_EDITTRANSACTIONBASE
 
-  MOZ_CAN_RUN_SCRIPT NS_IMETHOD RedoTransaction() override;
+  NS_IMETHOD RedoTransaction() override;
 
  protected:
   /**
    * CreateTxnsToDeleteBetween() creates a DeleteTextTransaction or some
    * DeleteNodeTransactions to remove text or nodes between aStart and aEnd
    * and appends the created transactions to the array.
    *
    * @param aStart      Must be set and valid point.
--- a/editor/libeditor/DeleteTextTransaction.cpp
+++ b/editor/libeditor/DeleteTextTransaction.cpp
@@ -92,39 +92,40 @@ NS_INTERFACE_MAP_END_INHERITING(EditTran
 
 bool DeleteTextTransaction::CanDoIt() const {
   if (NS_WARN_IF(!mTextNode) || NS_WARN_IF(!mEditorBase)) {
     return false;
   }
   return mEditorBase->IsModifiableNode(*mTextNode);
 }
 
-NS_IMETHODIMP DeleteTextTransaction::DoTransaction() {
-  if (NS_WARN_IF(!CanDoIt())) {
+MOZ_CAN_RUN_SCRIPT_BOUNDARY NS_IMETHODIMP
+DeleteTextTransaction::DoTransaction() {
+  if (NS_WARN_IF(!mEditorBase) || NS_WARN_IF(!mTextNode)) {
     return NS_ERROR_NOT_AVAILABLE;
   }
 
   // Get the text that we're about to delete
   ErrorResult error;
   mTextNode->SubstringData(mOffset, mLengthToDelete, mDeletedText, error);
   if (error.Failed()) {
     NS_WARNING("Text::SubstringData() failed");
     return error.StealNSResult();
   }
 
-  OwningNonNull<EditorBase> editorBase = *mEditorBase;
-  OwningNonNull<Text> textNode = *mTextNode;
-  editorBase->DoDeleteText(textNode, mOffset, mLengthToDelete, error);
+  RefPtr<EditorBase> editorBase = mEditorBase;
+  RefPtr<Text> textNode = mTextNode;
+  editorBase->DoDeleteText(*textNode, mOffset, mLengthToDelete, error);
   if (error.Failed()) {
     NS_WARNING("EditorBase::DoDeleteText() failed");
     return error.StealNSResult();
   }
 
   DebugOnly<nsresult> rvIgnored =
-      editorBase->RangeUpdaterRef().SelAdjDeleteText(textNode, mOffset,
+      editorBase->RangeUpdaterRef().SelAdjDeleteText(*textNode, mOffset,
                                                      mLengthToDelete);
   NS_WARNING_ASSERTION(NS_SUCCEEDED(rvIgnored),
                        "RangeUpdater::SelAdjDeleteText() failed, but ignored");
 
   if (!editorBase->AllowsTransactionsToChangeSelection()) {
     return NS_OK;
   }
 
@@ -134,19 +135,20 @@ NS_IMETHODIMP DeleteTextTransaction::DoT
   }
   selection->Collapse(EditorRawDOMPoint(textNode, mOffset), error);
   NS_WARNING_ASSERTION(!error.Failed(), "Selection::Collapse() failed");
   return error.StealNSResult();
 }
 
 // XXX: We may want to store the selection state and restore it properly.  Was
 //     it an insertion point or an extended selection?
-NS_IMETHODIMP DeleteTextTransaction::UndoTransaction() {
-  if (NS_WARN_IF(!CanDoIt())) {
-    return NS_ERROR_NOT_AVAILABLE;
+MOZ_CAN_RUN_SCRIPT_BOUNDARY NS_IMETHODIMP
+DeleteTextTransaction::UndoTransaction() {
+  if (NS_WARN_IF(!mTextNode) || NS_WARN_IF(!mEditorBase)) {
+    return NS_ERROR_NOT_INITIALIZED;
   }
   RefPtr<EditorBase> editorBase = mEditorBase;
   RefPtr<Text> textNode = mTextNode;
   ErrorResult error;
   editorBase->DoInsertText(*textNode, mOffset, mDeletedText, error);
   NS_WARNING_ASSERTION(!error.Failed(), "EditorBase::DoInsertText() failed");
   return error.StealNSResult();
 }
--- a/editor/libeditor/EditAggregateTransaction.cpp
+++ b/editor/libeditor/EditAggregateTransaction.cpp
@@ -19,46 +19,45 @@ NS_IMPL_CYCLE_COLLECTION_INHERITED(EditA
 NS_IMPL_ADDREF_INHERITED(EditAggregateTransaction, EditTransactionBase)
 NS_IMPL_RELEASE_INHERITED(EditAggregateTransaction, EditTransactionBase)
 NS_INTERFACE_MAP_BEGIN_CYCLE_COLLECTION(EditAggregateTransaction)
 NS_INTERFACE_MAP_END_INHERITING(EditTransactionBase)
 
 NS_IMETHODIMP EditAggregateTransaction::DoTransaction() {
   // FYI: It's legal (but not very useful) to have an empty child list.
   AutoTArray<OwningNonNull<EditTransactionBase>, 10> children(mChildren);
-  for (OwningNonNull<EditTransactionBase>& childTransaction : children) {
-    nsresult rv = MOZ_KnownLive(childTransaction)->DoTransaction();
+  for (auto& childTransaction : children) {
+    nsresult rv = childTransaction->DoTransaction();
     if (NS_FAILED(rv)) {
       NS_WARNING("EditTransactionBase::DoTransaction() failed");
       return rv;
     }
   }
   return NS_OK;
 }
 
 NS_IMETHODIMP EditAggregateTransaction::UndoTransaction() {
   // FYI: It's legal (but not very useful) to have an empty child list.
   // Undo goes through children backwards.
   AutoTArray<OwningNonNull<EditTransactionBase>, 10> children(mChildren);
-  for (OwningNonNull<EditTransactionBase>& childTransaction :
-       Reversed(children)) {
-    nsresult rv = MOZ_KnownLive(childTransaction)->UndoTransaction();
+  for (auto& childTransaction : Reversed(children)) {
+    nsresult rv = childTransaction->UndoTransaction();
     if (NS_FAILED(rv)) {
       NS_WARNING("EditTransactionBase::UndoTransaction() failed");
       return rv;
     }
   }
   return NS_OK;
 }
 
 NS_IMETHODIMP EditAggregateTransaction::RedoTransaction() {
   // It's legal (but not very useful) to have an empty child list.
   AutoTArray<OwningNonNull<EditTransactionBase>, 10> children(mChildren);
-  for (OwningNonNull<EditTransactionBase>& childTransaction : children) {
-    nsresult rv = MOZ_KnownLive(childTransaction)->RedoTransaction();
+  for (auto& childTransaction : children) {
+    nsresult rv = childTransaction->RedoTransaction();
     if (NS_FAILED(rv)) {
       NS_WARNING("EditTransactionBase::RedoTransaction() failed");
       return rv;
     }
   }
   return NS_OK;
 }
 
--- a/editor/libeditor/EditAggregateTransaction.h
+++ b/editor/libeditor/EditAggregateTransaction.h
@@ -38,17 +38,17 @@ class EditAggregateTransaction : public 
   }
 
   NS_DECL_ISUPPORTS_INHERITED
   NS_DECL_CYCLE_COLLECTION_CLASS_INHERITED(EditAggregateTransaction,
                                            EditTransactionBase)
 
   NS_DECL_EDITTRANSACTIONBASE
 
-  MOZ_CAN_RUN_SCRIPT NS_IMETHOD RedoTransaction() override;
+  NS_IMETHOD RedoTransaction() override;
   NS_IMETHOD Merge(nsITransaction* aTransaction, bool* aDidMerge) override;
 
   /**
    * Append a transaction to this aggregate.
    */
   NS_IMETHOD AppendChild(EditTransactionBase* aTransaction);
 
   /**
--- a/editor/libeditor/EditTransactionBase.h
+++ b/editor/libeditor/EditTransactionBase.h
@@ -16,23 +16,23 @@ namespace mozilla {
 /**
  * Base class for all document editing transactions.
  */
 class EditTransactionBase : public nsITransaction {
  public:
   NS_DECL_CYCLE_COLLECTING_ISUPPORTS
   NS_DECL_CYCLE_COLLECTION_CLASS_AMBIGUOUS(EditTransactionBase, nsITransaction)
 
-  MOZ_CAN_RUN_SCRIPT NS_IMETHOD RedoTransaction(void) override;
+  NS_IMETHOD RedoTransaction(void) override;
   NS_IMETHOD GetIsTransient(bool* aIsTransient) override;
   NS_IMETHOD Merge(nsITransaction* aTransaction, bool* aDidMerge) override;
 
  protected:
   virtual ~EditTransactionBase() = default;
 };
 
 }  // namespace mozilla
 
-#define NS_DECL_EDITTRANSACTIONBASE                       \
-  MOZ_CAN_RUN_SCRIPT NS_IMETHOD DoTransaction() override; \
-  MOZ_CAN_RUN_SCRIPT NS_IMETHOD UndoTransaction() override;
+#define NS_DECL_EDITTRANSACTIONBASE    \
+  NS_IMETHOD DoTransaction() override; \
+  NS_IMETHOD UndoTransaction() override;
 
 #endif  // #ifndef mozilla_EditTransactionBase_h
--- a/editor/libeditor/EditorBase.cpp
+++ b/editor/libeditor/EditorBase.cpp
@@ -355,17 +355,17 @@ nsresult EditorBase::PostCreate() {
     NS_WARNING_ASSERTION(NS_SUCCEEDED(rvIgnored),
                          "EditorBase::NotifyDocumentListeners("
                          "eDocumentStateChanged) failed, but ignored");
   }
 
   // update nsTextStateManager and caret if we have focus
   nsCOMPtr<nsIContent> focusedContent = GetFocusedContent();
   if (focusedContent) {
-    DebugOnly<nsresult> rvIgnored = InitializeSelection(*focusedContent);
+    DebugOnly<nsresult> rvIgnored = InitializeSelection(focusedContent);
     NS_WARNING_ASSERTION(
         NS_SUCCEEDED(rvIgnored),
         "EditorBase::InitializeSelection() failed, but ignored");
 
     // If the text control gets reframed during focus, Focus() would not be
     // called, so take a chance here to see if we need to spell check the text
     // control.
     mEventListener->SpellCheckIfNeeded();
@@ -1442,17 +1442,17 @@ already_AddRefed<Element> EditorBase::Cr
     NS_WARNING("EditorBase::DoTransactionInternal() failed");
     // XXX Why do we do this even when DoTransaction() returned error?
     DebugOnly<nsresult> rvIgnored =
         RangeUpdaterRef().SelAdjCreateNode(aPointToInsert);
     NS_WARNING_ASSERTION(
         NS_SUCCEEDED(rvIgnored),
         "Rangeupdater::SelAdjCreateNode() failed, but ignored");
   } else {
-    newElement = transaction->GetNewElement();
+    newElement = transaction->GetNewNode();
     MOZ_ASSERT(newElement);
 
     // If we succeeded to create and insert new element, we need to adjust
     // ranges in RangeUpdaterRef().  It currently requires offset of the new
     // node.  So, let's call it with original offset.  Note that if
     // aPointToInsert stores child node, it may not be at the offset since new
     // element must be inserted before the old child.  Although, mutation
     // observer can do anything, but currently, we don't check it.
@@ -1662,54 +1662,53 @@ already_AddRefed<nsIContent> EditorBase:
   Unused << aStartOfRightNode.Offset();
 
   RefPtr<SplitNodeTransaction> transaction =
       SplitNodeTransaction::Create(*this, aStartOfRightNode);
   aError = DoTransactionInternal(transaction);
   NS_WARNING_ASSERTION(!aError.Failed(),
                        "EditorBase::DoTransactionInternal() failed");
 
-  nsCOMPtr<nsIContent> newLeftContent = transaction->GetNewLeftContent();
-  NS_WARNING_ASSERTION(newLeftContent, "Failed to create a new left node");
-
-  if (newLeftContent) {
+  nsCOMPtr<nsIContent> newContent = transaction->GetNewNode();
+  NS_WARNING_ASSERTION(newContent, "Failed to create a new left node");
+
+  if (newContent) {
     // XXX Some other transactions manage range updater by themselves.
     //     Why doesn't SplitNodeTransaction do it?
     DebugOnly<nsresult> rvIgnored = RangeUpdaterRef().SelAdjSplitNode(
-        *aStartOfRightNode.GetContainerAsContent(), *newLeftContent);
+        *aStartOfRightNode.GetContainerAsContent(), *newContent);
     NS_WARNING_ASSERTION(NS_SUCCEEDED(rvIgnored),
                          "RangeUpdater::SelAdjSplitNode() failed, but ignored");
   }
-  if (AsHTMLEditor() && newLeftContent) {
+  if (AsHTMLEditor() && newContent) {
     TopLevelEditSubActionDataRef().DidSplitContent(
-        *this, *aStartOfRightNode.GetContainerAsContent(), *newLeftContent);
+        *this, *aStartOfRightNode.GetContainerAsContent(), *newContent);
   }
 
   if (mInlineSpellChecker) {
     RefPtr<mozInlineSpellChecker> spellChecker = mInlineSpellChecker;
-    spellChecker->DidSplitNode(aStartOfRightNode.GetContainer(),
-                               newLeftContent);
+    spellChecker->DidSplitNode(aStartOfRightNode.GetContainer(), newContent);
   }
 
   if (!mActionListeners.IsEmpty()) {
     AutoActionListenerArray listeners(mActionListeners);
     for (auto& listener : listeners) {
-      DebugOnly<nsresult> rvIgnored = listener->DidSplitNode(
-          aStartOfRightNode.GetContainer(), newLeftContent);
+      DebugOnly<nsresult> rvIgnored =
+          listener->DidSplitNode(aStartOfRightNode.GetContainer(), newContent);
       NS_WARNING_ASSERTION(
           NS_SUCCEEDED(rvIgnored),
           "nsIEditActionListener::DidSplitNode() failed, but ignored");
     }
   }
 
   if (aError.Failed()) {
     return nullptr;
   }
 
-  return newLeftContent.forget();
+  return newContent.forget();
 }
 
 nsresult EditorBase::JoinNodesWithTransaction(nsINode& aLeftNode,
                                               nsINode& aRightNode) {
   MOZ_ASSERT(IsEditActionDataAvailable());
   MOZ_ASSERT(aLeftNode.IsContent());
   MOZ_ASSERT(aRightNode.IsContent());
 
@@ -1732,18 +1731,18 @@ nsresult EditorBase::JoinNodesWithTransa
   // Find the number of children of the lefthand node
   uint32_t oldLeftNodeLen = aLeftNode.Length();
 
   if (AsHTMLEditor()) {
     TopLevelEditSubActionDataRef().WillJoinContents(
         *this, *aLeftNode.AsContent(), *aRightNode.AsContent());
   }
 
-  RefPtr<JoinNodeTransaction> transaction = JoinNodeTransaction::MaybeCreate(
-      *this, *aLeftNode.AsContent(), *aRightNode.AsContent());
+  RefPtr<JoinNodeTransaction> transaction =
+      JoinNodeTransaction::MaybeCreate(*this, aLeftNode, aRightNode);
   NS_WARNING_ASSERTION(
       transaction, "JoinNodeTransaction::MaybeCreate() failed, but ignored");
 
   nsresult rv = NS_OK;
   if (transaction) {
     rv = DoTransactionInternal(transaction);
     NS_WARNING_ASSERTION(NS_SUCCEEDED(rv),
                          "EditorBase::DoTransactionInternal() failed");
@@ -1821,17 +1820,17 @@ nsresult EditorBase::DeleteNodeWithTrans
 
   if (AsHTMLEditor()) {
     TopLevelEditSubActionDataRef().WillDeleteContent(*this, *aNode.AsContent());
   }
 
   // FYI: DeleteNodeTransaction grabs aNode while it's alive.  So, it's safe
   //      to refer aNode even after calling DoTransaction().
   RefPtr<DeleteNodeTransaction> deleteNodeTransaction =
-      DeleteNodeTransaction::MaybeCreate(*this, *aNode.AsContent());
+      DeleteNodeTransaction::MaybeCreate(*this, aNode);
   NS_WARNING_ASSERTION(deleteNodeTransaction,
                        "DeleteNodeTransaction::MaybeCreate() failed");
   nsresult rv;
   if (deleteNodeTransaction) {
     rv = DoTransactionInternal(deleteNodeTransaction);
     NS_WARNING_ASSERTION(NS_SUCCEEDED(rv),
                          "EditorBase::DoTransactionInternal() failed");
 
@@ -4793,81 +4792,78 @@ already_AddRefed<EditTransactionBase> Ed
     *aOffset = deleteTextTransaction->Offset();
     *aLength = deleteTextTransaction->LengthToDelete();
     node.forget(aRemovingNode);
     return deleteTextTransaction.forget();
   }
 
   // we're either deleting a node or chardata, need to dig into the next/prev
   // node to find out
-  nsCOMPtr<nsIContent> selectedContent;
+  nsCOMPtr<nsINode> selectedNode;
   if (aAction == ePrevious) {
-    selectedContent =
+    selectedNode =
         GetPreviousEditableNode(EditorRawDOMPoint(node, child, offset));
   } else if (aAction == eNext) {
-    selectedContent =
-        GetNextEditableNode(EditorRawDOMPoint(node, child, offset));
-  }
-
-  while (selectedContent && selectedContent->IsCharacterData() &&
-         !selectedContent->Length()) {
+    selectedNode = GetNextEditableNode(EditorRawDOMPoint(node, child, offset));
+  }
+
+  while (selectedNode && selectedNode->IsCharacterData() &&
+         !selectedNode->Length()) {
     // Can't delete an empty chardata node (bug 762183)
     if (aAction == ePrevious) {
-      selectedContent = GetPreviousEditableNode(*selectedContent);
+      selectedNode = GetPreviousEditableNode(*selectedNode);
     } else if (aAction == eNext) {
-      selectedContent = GetNextEditableNode(*selectedContent);
+      selectedNode = GetNextEditableNode(*selectedNode);
     }
   }
 
-  if (NS_WARN_IF(!selectedContent)) {
+  if (NS_WARN_IF(!selectedNode)) {
     return nullptr;
   }
 
-  if (RefPtr<Text> selectedTextNode = Text::FromNode(selectedContent)) {
+  if (RefPtr<Text> selectedNodeAsText = Text::FromNode(selectedNode)) {
     if (NS_WARN_IF(aAction != ePrevious && aAction != eNext)) {
       return nullptr;
     }
     // we are deleting from a chardata node, so do a character deletion
     uint32_t position = 0;
     if (aAction == ePrevious) {
-      position = selectedTextNode->Length();
+      position = selectedNode->Length();
     }
     RefPtr<DeleteTextTransaction> deleteTextTransaction;
     if (aAction == ePrevious) {
       deleteTextTransaction =
           DeleteTextTransaction::MaybeCreateForPreviousCharacter(
-              *this, *selectedTextNode, position);
+              *this, *selectedNodeAsText, position);
       NS_WARNING_ASSERTION(
           deleteTextTransaction,
           "DeleteTextTransaction::MaybeCreateForPreviousCharacter() failed");
     } else {
       deleteTextTransaction =
           DeleteTextTransaction::MaybeCreateForNextCharacter(
-              *this, *selectedTextNode, position);
+              *this, *selectedNodeAsText, position);
       NS_WARNING_ASSERTION(
           deleteTextTransaction,
           "DeleteTextTransaction::MaybeCreateForNextCharacter() failed");
     }
     if (!deleteTextTransaction) {
       return nullptr;
     }
     *aOffset = deleteTextTransaction->Offset();
     *aLength = deleteTextTransaction->LengthToDelete();
-    nsCOMPtr<nsINode> removingNode(selectedTextNode);
-    removingNode.forget(aRemovingNode);
+    selectedNode.forget(aRemovingNode);
     return deleteTextTransaction.forget();
   }
 
   RefPtr<DeleteNodeTransaction> deleteNodeTransaction =
-      DeleteNodeTransaction::MaybeCreate(*this, *selectedContent);
+      DeleteNodeTransaction::MaybeCreate(*this, *selectedNode);
   if (NS_WARN_IF(!deleteNodeTransaction)) {
     return nullptr;
   }
-  nsCOMPtr<nsINode> removingNode(selectedContent);
-  removingNode.forget(aRemovingNode);
+  selectedNode.forget(aRemovingNode);
   return deleteNodeTransaction.forget();
 }
 
 nsresult EditorBase::CreateRange(nsINode* aStartContainer, int32_t aStartOffset,
                                  nsINode* aEndContainer, int32_t aEndOffset,
                                  nsRange** aRange) {
   RefPtr<nsRange> range = nsRange::Create(
       aStartContainer, aStartOffset, aEndContainer, aEndOffset, IgnoreErrors());
@@ -5069,21 +5065,24 @@ Element* EditorBase::FindSelectionRoot(n
 }
 
 void EditorBase::InitializeSelectionAncestorLimit(nsIContent& aAncestorLimit) {
   MOZ_ASSERT(IsEditActionDataAvailable());
 
   SelectionRefPtr()->SetAncestorLimiter(&aAncestorLimit);
 }
 
-nsresult EditorBase::InitializeSelection(nsINode& aFocusEventTargetNode) {
+nsresult EditorBase::InitializeSelection(EventTarget* aFocusEventTarget) {
   MOZ_ASSERT(IsEditActionDataAvailable());
 
-  nsCOMPtr<nsIContent> selectionRootContent =
-      FindSelectionRoot(&aFocusEventTargetNode);
+  nsCOMPtr<nsINode> targetNode = do_QueryInterface(aFocusEventTarget);
+  if (NS_WARN_IF(!targetNode)) {
+    return NS_ERROR_INVALID_ARG;
+  }
+  nsCOMPtr<nsIContent> selectionRootContent = FindSelectionRoot(targetNode);
   if (!selectionRootContent) {
     return NS_OK;
   }
 
   nsCOMPtr<nsISelectionController> selectionController =
       GetSelectionController();
   if (NS_WARN_IF(!selectionController)) {
     return NS_ERROR_FAILURE;
@@ -5105,18 +5104,17 @@ nsresult EditorBase::InitializeSelection
       NS_SUCCEEDED(rvIgnored),
       "nsISelectionController::SetCaretEnabled() failed, but ignored");
   // NOTE(emilio): It's important for this call to be after
   // SetCaretEnabled(true), since that would override mIgnoreUserModify to true.
   //
   // Also, make sure to always ignore it for designMode, since that effectively
   // overrides everything and we allow to edit stuff with
   // contenteditable="false" subtrees in such a document.
-  caret->SetIgnoreUserModify(
-      aFocusEventTargetNode.OwnerDoc()->HasFlag(NODE_IS_EDITABLE));
+  caret->SetIgnoreUserModify(targetNode->OwnerDoc()->HasFlag(NODE_IS_EDITABLE));
 
   // Init selection
   rvIgnored =
       selectionController->SetSelectionFlags(nsISelectionDisplay::DISPLAY_ALL);
   NS_WARNING_ASSERTION(
       NS_SUCCEEDED(rvIgnored),
       "nsISelectionController::SetSelectionFlags() failed, but ignored");
 
@@ -5141,26 +5139,25 @@ nsresult EditorBase::InitializeSelection
     // XXX If selection is changed during reframe, this doesn't work well!
     nsRange* firstRange = SelectionRefPtr()->GetRangeAt(0);
     if (NS_WARN_IF(!firstRange)) {
       return NS_ERROR_FAILURE;
     }
     EditorRawDOMPoint atStartOfFirstRange(firstRange->StartRef());
     EditorRawDOMPoint betterInsertionPoint =
         FindBetterInsertionPoint(atStartOfFirstRange);
-    RefPtr<Text> textNode = betterInsertionPoint.GetContainerAsText();
+    Text* textNode = betterInsertionPoint.GetContainerAsText();
     MOZ_ASSERT(textNode,
                "There must be text node if composition string is not empty");
     if (textNode) {
       MOZ_ASSERT(textNode->Length() >= mComposition->XPEndOffsetInTextNode(),
                  "The text node must be different from the old text node");
-      RefPtr<TextRangeArray> ranges = mComposition->GetRanges();
       DebugOnly<nsresult> rvIgnored = CompositionTransaction::SetIMESelection(
           *this, textNode, mComposition->XPOffsetInTextNode(),
-          mComposition->XPLengthInTextNode(), ranges);
+          mComposition->XPLengthInTextNode(), mComposition->GetRanges());
       NS_WARNING_ASSERTION(
           NS_SUCCEEDED(rvIgnored),
           "CompositionTransaction::SetIMESelection() failed, but ignored");
     }
   }
 
   return NS_OK;
 }
@@ -5209,17 +5206,17 @@ void EditorBase::ReinitializeSelection(E
     return;
   }
 
   AutoEditActionDataSetter editActionData(*this, EditAction::eNotEditing);
   if (NS_WARN_IF(!editActionData.CanHandle())) {
     return;
   }
 
-  OnFocus(aElement);
+  OnFocus(&aElement);
 
   // If previous focused editor turn on spellcheck and this editor doesn't
   // turn on it, spellcheck state is mismatched.  So we need to re-sync it.
   SyncRealTimeSpell();
 
   nsPresContext* context = GetPresContext();
   if (NS_WARN_IF(!context)) {
     return;
@@ -5487,23 +5484,23 @@ bool EditorBase::IsAcceptableInputEvent(
     return false;
   }
 
   // Otherwise, we shouldn't handle any input events when we're not an active
   // element of the DOM window.
   return IsActiveInDOMWindow();
 }
 
-void EditorBase::OnFocus(nsINode& aFocusEventTargetNode) {
+void EditorBase::OnFocus(EventTarget* aFocusEventTarget) {
   AutoEditActionDataSetter editActionData(*this, EditAction::eNotEditing);
   if (NS_WARN_IF(!editActionData.CanHandle())) {
     return;
   }
 
-  InitializeSelection(aFocusEventTargetNode);
+  InitializeSelection(aFocusEventTarget);
   mSpellCheckerDictionaryUpdated = false;
   if (mInlineSpellChecker && CanEnableSpellCheck()) {
     DebugOnly<nsresult> rvIgnored =
         mInlineSpellChecker->UpdateCurrentDictionary();
     NS_WARNING_ASSERTION(
         NS_SUCCEEDED(rvIgnored),
         "mozInlineSpellCHecker::UpdateCurrentDictionary() failed, but ignored");
     mSpellCheckerDictionaryUpdated = true;
--- a/editor/libeditor/EditorBase.h
+++ b/editor/libeditor/EditorBase.h
@@ -585,31 +585,31 @@ class EditorBase : public nsIEditor,
    */
   virtual Element* FindSelectionRoot(nsINode* aNode) const;
 
   /**
    * This method has to be called by EditorEventListener::Focus.
    * All actions that have to be done when the editor is focused needs to be
    * added here.
    */
-  MOZ_CAN_RUN_SCRIPT void OnFocus(nsINode& aFocusEventTargetNode);
+  void OnFocus(dom::EventTarget* aFocusEventTarget);
 
   /** Resyncs spellchecking state (enabled/disabled).  This should be called
    * when anything that affects spellchecking state changes, such as the
    * spellcheck attribute value.
    */
   void SyncRealTimeSpell();
 
   /**
    * This method re-initializes the selection and caret state that are for
    * current editor state. When editor session is destroyed, it always reset
    * selection state even if this has no focus.  So if destroying editor,
    * we have to call this method for focused editor to set selection state.
    */
-  MOZ_CAN_RUN_SCRIPT void ReinitializeSelection(Element& aElement);
+  void ReinitializeSelection(Element& aElement);
 
   /**
    * InsertTextAsAction() inserts aStringToInsert at selection.
    * Although this method is implementation of nsIEditor.insertText(),
    * this treats the input is an edit action.  If you'd like to insert text
    * as part of edit action, you probably should use InsertTextAsSubAction().
    *
    * @param aStringToInsert     The string to insert.
@@ -2356,17 +2356,17 @@ class EditorBase : public nsIEditor,
 
   /**
    * Used by AutoTransactionBatch.  After calling BeginTransactionInternal(),
    * all transactions will be treated as an atomic transaction.  I.e.,
    * two or more transactions are undid once.
    * XXX What's the difference with PlaceholderTransaction? Should we always
    *     use it instead?
    */
-  MOZ_CAN_RUN_SCRIPT void BeginTransactionInternal();
+  void BeginTransactionInternal();
   MOZ_CAN_RUN_SCRIPT void EndTransactionInternal();
 
  protected:  // Shouldn't be used by friend classes
   /**
    * The default destructor. This should suffice. Should this be pure virtual
    * for someone to derive from the EditorBase later? I don't believe so.
    */
   virtual ~EditorBase();
@@ -2578,17 +2578,17 @@ class EditorBase : public nsIEditor,
    */
   nsresult ClearSelection();
 
   /**
    * Initializes selection and caret for the editor.  If aEventTarget isn't
    * a host of the editor, i.e., the editor doesn't get focus, this does
    * nothing.
    */
-  MOZ_CAN_RUN_SCRIPT nsresult InitializeSelection(nsINode& aFocusEventTarget);
+  nsresult InitializeSelection(dom::EventTarget* aFocusEventTarget);
 
   enum NotificationForEditorObservers {
     eNotifyEditorObserversOfEnd,
     eNotifyEditorObserversOfBefore,
     eNotifyEditorObserversOfCancel
   };
   MOZ_CAN_RUN_SCRIPT void NotifyEditorObservers(
       NotificationForEditorObservers aNotification);
@@ -2633,17 +2633,17 @@ class EditorBase : public nsIEditor,
    *        AutoPlaceholderBatch instead.
    */
   class MOZ_RAII AutoTransactionBatch final {
    public:
     MOZ_CAN_RUN_SCRIPT explicit AutoTransactionBatch(
         EditorBase& aEditorBase MOZ_GUARD_OBJECT_NOTIFIER_PARAM)
         : mEditorBase(aEditorBase) {
       MOZ_GUARD_OBJECT_NOTIFIER_INIT;
-      MOZ_KnownLive(mEditorBase).BeginTransactionInternal();
+      mEditorBase.BeginTransactionInternal();
     }
 
     MOZ_CAN_RUN_SCRIPT ~AutoTransactionBatch() {
       MOZ_KnownLive(mEditorBase).EndTransactionInternal();
     }
 
    protected:
     EditorBase& mEditorBase;
--- a/editor/libeditor/EditorEventListener.cpp
+++ b/editor/libeditor/EditorEventListener.cpp
@@ -1170,17 +1170,17 @@ nsresult EditorEventListener::Focus(Inte
       if (!SameCOMIdentity(
               focusedContent->FindFirstNonChromeOnlyAccessContent(),
               originalTargetAsContent->FindFirstNonChromeOnlyAccessContent())) {
         return NS_OK;
       }
     }
   }
 
-  editorBase->OnFocus(*eventTargetNode);
+  editorBase->OnFocus(target);
   if (DetachedFromEditorOrDefaultPrevented(aFocusEvent)) {
     return NS_OK;
   }
 
   nsPresContext* presContext = GetPresContext();
   if (NS_WARN_IF(!presContext)) {
     return NS_OK;
   }
--- a/editor/libeditor/EditorEventListener.h
+++ b/editor/libeditor/EditorEventListener.h
@@ -70,17 +70,17 @@ class EditorEventListener : public nsIDO
   MOZ_CAN_RUN_SCRIPT void HandleEndComposition(
       WidgetCompositionEvent* aCompositionEvent);
   MOZ_CAN_RUN_SCRIPT virtual nsresult MouseDown(dom::MouseEvent* aMouseEvent);
   MOZ_CAN_RUN_SCRIPT virtual nsresult MouseUp(dom::MouseEvent* aMouseEvent) {
     return NS_OK;
   }
   MOZ_CAN_RUN_SCRIPT virtual nsresult MouseClick(
       WidgetMouseEvent* aMouseClickEvent);
-  MOZ_CAN_RUN_SCRIPT nsresult Focus(InternalFocusEvent* aFocusEvent);
+  nsresult Focus(InternalFocusEvent* aFocusEvent);
   nsresult Blur(InternalFocusEvent* aBlurEvent);
   MOZ_CAN_RUN_SCRIPT nsresult DragEnter(dom::DragEvent* aDragEvent);
   MOZ_CAN_RUN_SCRIPT nsresult DragOverOrDrop(dom::DragEvent* aDragEvent);
   nsresult DragExit(dom::DragEvent* aDragEvent);
 
   void RefuseToDropAndHideCaret(DragEvent* aDragEvent);
   bool DragEventHasSupportingData(DragEvent* aDragEvent) const;
   MOZ_CAN_RUN_SCRIPT bool CanInsertAtDropPosition(DragEvent* aDragEvent);
--- a/editor/libeditor/EditorUtils.h
+++ b/editor/libeditor/EditorUtils.h
@@ -695,17 +695,17 @@ class MOZ_STACK_CLASS SplitRangeOffResul
  * methods.
  ***************************************************************************/
 class MOZ_RAII AutoTransactionBatchExternal final {
  public:
   MOZ_CAN_RUN_SCRIPT explicit AutoTransactionBatchExternal(
       EditorBase& aEditorBase MOZ_GUARD_OBJECT_NOTIFIER_PARAM)
       : mEditorBase(aEditorBase) {
     MOZ_GUARD_OBJECT_NOTIFIER_INIT;
-    MOZ_KnownLive(mEditorBase).BeginTransaction();
+    mEditorBase.BeginTransaction();
   }
 
   MOZ_CAN_RUN_SCRIPT ~AutoTransactionBatchExternal() {
     MOZ_KnownLive(mEditorBase).EndTransaction();
   }
 
  private:
   EditorBase& mEditorBase;
--- a/editor/libeditor/HTMLEditor.cpp
+++ b/editor/libeditor/HTMLEditor.cpp
@@ -5177,17 +5177,17 @@ void HTMLEditor::NotifyRootChanged() {
         "but ignored");
     return;
   }
 
   // When this editor has focus, we need to reset the selection limiter to
   // new root.  Otherwise, that is going to be done when this gets focus.
   nsCOMPtr<nsINode> node = GetFocusedNode();
   if (node) {
-    DebugOnly<nsresult> rvIgnored = InitializeSelection(*node);
+    DebugOnly<nsresult> rvIgnored = InitializeSelection(node);
     NS_WARNING_ASSERTION(
         NS_SUCCEEDED(rvIgnored),
         "EditorBase::InitializeSelection() failed, but ignored");
   }
 
   SyncRealTimeSpell();
 }
 
--- a/editor/libeditor/InsertNodeTransaction.cpp
+++ b/editor/libeditor/InsertNodeTransaction.cpp
@@ -55,20 +55,21 @@ NS_IMPL_CYCLE_COLLECTION_INHERITED(Inser
                                    mEditorBase, mContentToInsert,
                                    mPointToInsert)
 
 NS_IMPL_ADDREF_INHERITED(InsertNodeTransaction, EditTransactionBase)
 NS_IMPL_RELEASE_INHERITED(InsertNodeTransaction, EditTransactionBase)
 NS_INTERFACE_MAP_BEGIN_CYCLE_COLLECTION(InsertNodeTransaction)
 NS_INTERFACE_MAP_END_INHERITING(EditTransactionBase)
 
-NS_IMETHODIMP InsertNodeTransaction::DoTransaction() {
+MOZ_CAN_RUN_SCRIPT_BOUNDARY NS_IMETHODIMP
+InsertNodeTransaction::DoTransaction() {
   if (NS_WARN_IF(!mEditorBase) || NS_WARN_IF(!mContentToInsert) ||
       NS_WARN_IF(!mPointToInsert.IsSet())) {
-    return NS_ERROR_NOT_AVAILABLE;
+    return NS_ERROR_NOT_INITIALIZED;
   }
 
   if (!mPointToInsert.IsSetAndValid()) {
     // It seems that DOM tree has been changed after first DoTransaction()
     // and current RedoTranaction() call.
     if (mPointToInsert.GetChild()) {
       EditorDOMPoint newPointToInsert(mPointToInsert.GetChild());
       if (!newPointToInsert.IsSet()) {
@@ -83,32 +84,32 @@ NS_IMETHODIMP InsertNodeTransaction::DoT
     } else {
       mPointToInsert.SetToEndOf(mPointToInsert.GetContainer());
       if (NS_WARN_IF(!mPointToInsert.IsSet())) {
         return NS_ERROR_FAILURE;
       }
     }
   }
 
-  OwningNonNull<EditorBase> editorBase = *mEditorBase;
-  OwningNonNull<nsIContent> contentToInsert = *mContentToInsert;
-  OwningNonNull<nsINode> container = *mPointToInsert.GetContainer();
+  RefPtr<EditorBase> editorBase = mEditorBase;
+  nsCOMPtr<nsIContent> contentToInsert = mContentToInsert;
+  nsCOMPtr<nsINode> container = mPointToInsert.GetContainer();
   nsCOMPtr<nsIContent> refChild = mPointToInsert.GetChild();
   if (contentToInsert->IsElement()) {
     nsresult rv = editorBase->MarkElementDirty(
         MOZ_KnownLive(*contentToInsert->AsElement()));
     if (NS_WARN_IF(rv == NS_ERROR_EDITOR_DESTROYED)) {
       return EditorBase::ToGenericNSResult(rv);
     }
     NS_WARNING_ASSERTION(NS_SUCCEEDED(rv),
                          "EditorBase::MarkElementDirty() failed, but ignored");
   }
 
   ErrorResult error;
-  container->InsertBefore(contentToInsert, refChild, error);
+  container->InsertBefore(*contentToInsert, refChild, error);
   if (error.Failed()) {
     NS_WARNING("nsINode::InsertBefore() failed");
     return error.StealNSResult();
   }
 
   if (!editorBase->AsHTMLEditor() && contentToInsert->IsText()) {
     uint32_t length = contentToInsert->AsText()->TextLength();
     if (length > 0) {
@@ -126,20 +127,20 @@ NS_IMETHODIMP InsertNodeTransaction::DoT
   }
 
   RefPtr<Selection> selection = mEditorBase->GetSelection();
   if (NS_WARN_IF(!selection)) {
     return NS_ERROR_FAILURE;
   }
 
   // Place the selection just after the inserted element.
-  EditorRawDOMPoint afterInsertedNode(
-      EditorRawDOMPoint::After(contentToInsert));
-  NS_WARNING_ASSERTION(afterInsertedNode.IsSet(),
-                       "Failed to set after the inserted node");
+  EditorRawDOMPoint afterInsertedNode(mContentToInsert);
+  DebugOnly<bool> advanced = afterInsertedNode.AdvanceOffset();
+  NS_WARNING_ASSERTION(advanced,
+                       "Failed to advance offset after the inserted node");
   IgnoredErrorResult ignoredError;
   selection->Collapse(afterInsertedNode, ignoredError);
   NS_WARNING_ASSERTION(!ignoredError.Failed(),
                        "Selection::Collapse() failed, but ignored");
   return NS_OK;
 }
 
 NS_IMETHODIMP InsertNodeTransaction::UndoTransaction() {
@@ -150,17 +151,15 @@ NS_IMETHODIMP InsertNodeTransaction::Und
   if (!mEditorBase->AsHTMLEditor() && mContentToInsert->IsText()) {
     uint32_t length = mContentToInsert->TextLength();
     if (length > 0) {
       mEditorBase->AsTextEditor()->WillDeleteText(length, 0, length);
     }
   }
   // XXX If the inserted node has been moved to different container node or
   //     just removed from the DOM tree, this always fails.
-  OwningNonNull<nsINode> container = *mPointToInsert.GetContainer();
-  OwningNonNull<nsIContent> contentToInsert = *mContentToInsert;
   ErrorResult error;
-  container->RemoveChild(contentToInsert, error);
+  mPointToInsert.GetContainer()->RemoveChild(*mContentToInsert, error);
   NS_WARNING("nsINode::RemoveChild() failed");
   return error.StealNSResult();
 }
 
 }  // namespace mozilla
--- a/editor/libeditor/InsertTextTransaction.cpp
+++ b/editor/libeditor/InsertTextTransaction.cpp
@@ -40,26 +40,27 @@ NS_IMPL_CYCLE_COLLECTION_INHERITED(Inser
                                    mEditorBase, mTextNode)
 
 NS_IMPL_ADDREF_INHERITED(InsertTextTransaction, EditTransactionBase)
 NS_IMPL_RELEASE_INHERITED(InsertTextTransaction, EditTransactionBase)
 NS_INTERFACE_MAP_BEGIN_CYCLE_COLLECTION(InsertTextTransaction)
   NS_INTERFACE_MAP_ENTRY_CONCRETE(InsertTextTransaction)
 NS_INTERFACE_MAP_END_INHERITING(EditTransactionBase)
 
-NS_IMETHODIMP InsertTextTransaction::DoTransaction() {
+MOZ_CAN_RUN_SCRIPT_BOUNDARY NS_IMETHODIMP
+InsertTextTransaction::DoTransaction() {
   if (NS_WARN_IF(!mEditorBase) || NS_WARN_IF(!mTextNode)) {
     return NS_ERROR_NOT_AVAILABLE;
   }
 
-  OwningNonNull<EditorBase> editorBase = *mEditorBase;
-  OwningNonNull<Text> textNode = *mTextNode;
+  RefPtr<EditorBase> editorBase = mEditorBase;
+  RefPtr<Text> textNode = mTextNode;
 
   ErrorResult error;
-  editorBase->DoInsertText(textNode, mOffset, mStringToInsert, error);
+  editorBase->DoInsertText(*textNode, mOffset, mStringToInsert, error);
   if (error.Failed()) {
     NS_WARNING("EditorBase::DoInsertText() failed");
     return error.StealNSResult();
   }
 
   // Only set selection to insertion point if editor gives permission
   if (editorBase->AllowsTransactionsToChangeSelection()) {
     RefPtr<Selection> selection = editorBase->GetSelection();
@@ -70,30 +71,31 @@ NS_IMETHODIMP InsertTextTransaction::DoT
         selection->Collapse(textNode, mOffset + mStringToInsert.Length());
     NS_ASSERTION(NS_SUCCEEDED(rvIgnored),
                  "Selection::Collapse() failed, but ignored");
   } else {
     // Do nothing - DOM Range gravity will adjust selection
   }
   // XXX Other transactions do not do this but its callers do.
   //     Why do this transaction do this by itself?
-  editorBase->RangeUpdaterRef().SelAdjInsertText(textNode, mOffset,
+  editorBase->RangeUpdaterRef().SelAdjInsertText(*textNode, mOffset,
                                                  mStringToInsert);
 
   return NS_OK;
 }
 
-NS_IMETHODIMP InsertTextTransaction::UndoTransaction() {
+MOZ_CAN_RUN_SCRIPT_BOUNDARY NS_IMETHODIMP
+InsertTextTransaction::UndoTransaction() {
   if (NS_WARN_IF(!mEditorBase) || NS_WARN_IF(!mTextNode)) {
     return NS_ERROR_NOT_INITIALIZED;
   }
-  OwningNonNull<EditorBase> editorBase = *mEditorBase;
-  OwningNonNull<Text> textNode = *mTextNode;
+  RefPtr<EditorBase> editorBase = mEditorBase;
+  RefPtr<Text> textNode = mTextNode;
   ErrorResult error;
-  editorBase->DoDeleteText(textNode, mOffset, mStringToInsert.Length(), error);
+  editorBase->DoDeleteText(*textNode, mOffset, mStringToInsert.Length(), error);
   NS_WARNING_ASSERTION(!error.Failed(), "EditorBase::DoDeleteText() failed");
   return error.StealNSResult();
 }
 
 NS_IMETHODIMP InsertTextTransaction::Merge(nsITransaction* aTransaction,
                                            bool* aDidMerge) {
   if (NS_WARN_IF(!aTransaction) || NS_WARN_IF(!aDidMerge)) {
     return NS_ERROR_INVALID_ARG;
--- a/editor/libeditor/JoinNodeTransaction.cpp
+++ b/editor/libeditor/JoinNodeTransaction.cpp
@@ -14,125 +14,117 @@
 #include "nsISupportsImpl.h"  // for QueryInterface, etc.
 
 namespace mozilla {
 
 using namespace dom;
 
 // static
 already_AddRefed<JoinNodeTransaction> JoinNodeTransaction::MaybeCreate(
-    EditorBase& aEditorBase, nsIContent& aLeftContent,
-    nsIContent& aRightContent) {
+    EditorBase& aEditorBase, nsINode& aLeftNode, nsINode& aRightNode) {
   RefPtr<JoinNodeTransaction> transaction =
-      new JoinNodeTransaction(aEditorBase, aLeftContent, aRightContent);
+      new JoinNodeTransaction(aEditorBase, aLeftNode, aRightNode);
   if (NS_WARN_IF(!transaction->CanDoIt())) {
     return nullptr;
   }
   return transaction.forget();
 }
 
 JoinNodeTransaction::JoinNodeTransaction(EditorBase& aEditorBase,
-                                         nsIContent& aLeftContent,
-                                         nsIContent& aRightContent)
+                                         nsINode& aLeftNode,
+                                         nsINode& aRightNode)
     : mEditorBase(&aEditorBase),
-      mLeftContent(&aLeftContent),
-      mRightContent(&aRightContent),
+      mLeftNode(&aLeftNode),
+      mRightNode(&aRightNode),
       mOffset(0) {}
 
 NS_IMPL_CYCLE_COLLECTION_INHERITED(JoinNodeTransaction, EditTransactionBase,
-                                   mEditorBase, mLeftContent, mRightContent,
-                                   mParentNode)
+                                   mEditorBase, mLeftNode, mRightNode, mParent)
 
 NS_INTERFACE_MAP_BEGIN_CYCLE_COLLECTION(JoinNodeTransaction)
 NS_INTERFACE_MAP_END_INHERITING(EditTransactionBase)
 
 bool JoinNodeTransaction::CanDoIt() const {
-  if (NS_WARN_IF(!mLeftContent) || NS_WARN_IF(!mRightContent) ||
-      NS_WARN_IF(!mEditorBase) || !mLeftContent->GetParentNode()) {
+  if (NS_WARN_IF(!mLeftNode) || NS_WARN_IF(!mRightNode) ||
+      NS_WARN_IF(!mEditorBase) || !mLeftNode->GetParentNode()) {
     return false;
   }
-  return mEditorBase->IsModifiableNode(*mLeftContent->GetParentNode());
+  return mEditorBase->IsModifiableNode(*mLeftNode->GetParentNode());
 }
 
 // After DoTransaction() and RedoTransaction(), the left node is removed from
 // the content tree and right node remains.
-NS_IMETHODIMP JoinNodeTransaction::DoTransaction() {
-  if (NS_WARN_IF(!mEditorBase) || NS_WARN_IF(!mLeftContent) ||
-      NS_WARN_IF(!mRightContent)) {
-    return NS_ERROR_NOT_AVAILABLE;
+MOZ_CAN_RUN_SCRIPT_BOUNDARY NS_IMETHODIMP JoinNodeTransaction::DoTransaction() {
+  if (NS_WARN_IF(!mEditorBase) || NS_WARN_IF(!mLeftNode) ||
+      NS_WARN_IF(!mRightNode)) {
+    return NS_ERROR_NOT_INITIALIZED;
   }
 
   // Get the parent node
-  nsCOMPtr<nsINode> leftContentParent = mLeftContent->GetParentNode();
-  if (NS_WARN_IF(!leftContentParent)) {
-    return NS_ERROR_NOT_AVAILABLE;
+  nsCOMPtr<nsINode> leftNodeParent = mLeftNode->GetParentNode();
+  if (NS_WARN_IF(!leftNodeParent)) {
+    return NS_ERROR_FAILURE;
   }
 
-  // Verify that mLeftContent and mRightContent have the same parent
-  if (leftContentParent != mRightContent->GetParentNode()) {
+  // Verify that mLeftNode and mRightNode have the same parent
+  if (leftNodeParent != mRightNode->GetParentNode()) {
     NS_ASSERTION(false, "Nodes do not have same parent");
-    return NS_ERROR_NOT_AVAILABLE;
+    return NS_ERROR_INVALID_ARG;
   }
 
-  // Set this instance's mParentNode.  Other methods will see a non-null
-  // mParentNode and know all is well
-  mParentNode = leftContentParent;
-  mOffset = mLeftContent->Length();
+  // Set this instance's mParent.  Other methods will see a non-null mParent
+  // and know all is well
+  mParent = leftNodeParent;
+  mOffset = mLeftNode->Length();
 
-  OwningNonNull<EditorBase> editorBase = *mEditorBase;
-  OwningNonNull<nsINode> leftNode = *mLeftContent;
-  OwningNonNull<nsINode> rightNode = *mRightContent;
-  nsresult rv = editorBase->DoJoinNodes(rightNode, leftNode, leftContentParent);
+  RefPtr<EditorBase> editorBase = mEditorBase;
+  nsCOMPtr<nsINode> leftNode = mLeftNode;
+  nsCOMPtr<nsINode> rightNode = mRightNode;
+  nsresult rv = editorBase->DoJoinNodes(rightNode, leftNode, leftNodeParent);
   NS_WARNING_ASSERTION(NS_SUCCEEDED(rv), "EditorBase::DoJoinNodes() failed");
   return rv;
 }
 
 // XXX: What if instead of split, we just deleted the unneeded children of
 //     mRight and re-inserted mLeft?
-NS_IMETHODIMP JoinNodeTransaction::UndoTransaction() {
-  if (NS_WARN_IF(!mParentNode) || NS_WARN_IF(!mLeftContent) ||
-      NS_WARN_IF(!mRightContent) || NS_WARN_IF(!mEditorBase)) {
-    return NS_ERROR_NOT_AVAILABLE;
+MOZ_CAN_RUN_SCRIPT_BOUNDARY NS_IMETHODIMP
+JoinNodeTransaction::UndoTransaction() {
+  if (NS_WARN_IF(!mParent) || NS_WARN_IF(!mLeftNode) ||
+      NS_WARN_IF(!mRightNode) || NS_WARN_IF(!mEditorBase)) {
+    return NS_ERROR_NOT_INITIALIZED;
   }
 
-  OwningNonNull<nsIContent> leftContent = *mLeftContent;
-  OwningNonNull<nsIContent> rightContent = *mRightContent;
-  OwningNonNull<nsINode> parentNode = *mParentNode;
-
   // First, massage the existing node so it is in its post-split state
   ErrorResult error;
-  if (Text* rightTextNode = rightContent->GetAsText()) {
-    OwningNonNull<EditorBase> editorBase = *mEditorBase;
-    editorBase->DoDeleteText(MOZ_KnownLive(*rightTextNode), 0, mOffset, error);
+  if (mRightNode->GetAsText()) {
+    RefPtr<EditorBase> editorBase = mEditorBase;
+    RefPtr<Text> rightNodeAsText = mRightNode->GetAsText();
+    editorBase->DoDeleteText(*rightNodeAsText, 0, mOffset, error);
     if (error.Failed()) {
       NS_WARNING("EditorBase::DoDeleteText() failed");
       return error.StealNSResult();
     }
   } else {
-    AutoTArray<OwningNonNull<nsIContent>, 24> movingChildren;
-    if (nsIContent* child = mRightContent->GetFirstChild()) {
-      movingChildren.AppendElement(*child);
-      for (uint32_t i = 0; i < mOffset; i++) {
-        child = child->GetNextSibling();
-        if (!child) {
-          break;
-        }
-        movingChildren.AppendElement(*child);
-      }
-    }
-    for (OwningNonNull<nsIContent>& child : movingChildren) {
-      leftContent->AppendChild(child, error);
+    nsCOMPtr<nsIContent> child = mRightNode->GetFirstChild();
+    for (uint32_t i = 0; i < mOffset; i++) {
       if (error.Failed()) {
-        NS_WARNING("nsINode::AppendChild() failed");
         return error.StealNSResult();
       }
+      if (!child) {
+        return NS_ERROR_NULL_POINTER;
+      }
+      nsCOMPtr<nsIContent> nextSibling = child->GetNextSibling();
+      mLeftNode->AppendChild(*child, error);
+      NS_WARNING_ASSERTION(!error.Failed(), "nsINode::AppendChild() failed");
+      child = nextSibling;
     }
   }
 
   NS_WARNING_ASSERTION(!error.Failed(), "The previous error was ignored");
 
   // Second, re-insert the left node into the tree
-  parentNode->InsertBefore(leftContent, rightContent, error);
+  nsCOMPtr<nsINode> refNode = mRightNode;
+  mParent->InsertBefore(*mLeftNode, refNode, error);
   NS_WARNING_ASSERTION(!error.Failed(), "nsINode::InsertBefore() failed");
   return error.StealNSResult();
 }
 
 }  // namespace mozilla
--- a/editor/libeditor/JoinNodeTransaction.h
+++ b/editor/libeditor/JoinNodeTransaction.h
@@ -7,71 +7,69 @@
 #define JoinNodeTransaction_h
 
 #include "mozilla/EditTransactionBase.h"  // for EditTransactionBase, etc.
 #include "nsCOMPtr.h"                     // for nsCOMPtr
 #include "nsCycleCollectionParticipant.h"
 #include "nsID.h"    // for REFNSIID
 #include "nscore.h"  // for NS_IMETHOD
 
-class nsIContent;
 class nsINode;
 
 namespace mozilla {
 
 class EditorBase;
 
 /**
  * A transaction that joins two nodes E1 (left node) and E2 (right node) into a
  * single node E.  The children of E are the children of E1 followed by the
  * children of E2.  After DoTransaction() and RedoTransaction(), E1 is removed
  * from the content tree and E2 remains.
  */
 class JoinNodeTransaction final : public EditTransactionBase {
  protected:
-  JoinNodeTransaction(EditorBase& aEditorBase, nsIContent& aLeftContent,
-                      nsIContent& aRightContent);
+  JoinNodeTransaction(EditorBase& aEditorBase, nsINode& aLeftNode,
+                      nsINode& aRightNode);
 
  public:
   /**
    * Creates a join node transaction.  This returns nullptr if cannot join the
    * nodes.
    *
    * @param aEditorBase     The provider of core editing operations.
-   * @param aLeftContent    The first of two nodes to join.
-   * @param aRightContent   The second of two nodes to join.
+   * @param aLeftNode       The first of two nodes to join.
+   * @param aRightNode      The second of two nodes to join.
    */
   static already_AddRefed<JoinNodeTransaction> MaybeCreate(
-      EditorBase& aEditorBase, nsIContent& aLeftContent,
-      nsIContent& aRightContent);
+      EditorBase& aEditorBase, nsINode& aLeftNode, nsINode& aRightNode);
 
   /**
    * CanDoIt() returns true if there are enough members and can join or
    * restore the nodes.  Otherwise, false.
    */
   bool CanDoIt() const;
 
   NS_DECL_CYCLE_COLLECTION_CLASS_INHERITED(JoinNodeTransaction,
                                            EditTransactionBase)
   NS_IMETHOD QueryInterface(REFNSIID aIID, void** aInstancePtr) override;
 
   NS_DECL_EDITTRANSACTIONBASE
 
  protected:
   RefPtr<EditorBase> mEditorBase;
 
-  // The nodes to operate upon.  After the merge, mRightContent remains and
-  // mLeftContent is removed from the content tree.
-  nsCOMPtr<nsIContent> mLeftContent;
-  nsCOMPtr<nsIContent> mRightContent;
+  // The nodes to operate upon.  After the merge, mRightNode remains and
+  // mLeftNode is removed from the content tree.
+  nsCOMPtr<nsINode> mLeftNode;
+  nsCOMPtr<nsINode> mRightNode;
 
   // The offset into mNode where the children of mElement are split (for
   // undo). mOffset is the index of the first child in the right node.  -1
   // means the left node had no children.
   uint32_t mOffset;
 
-  // The parent node containing mLeftContent and mRightContent.
-  nsCOMPtr<nsINode> mParentNode;
+  // The parent node containing mLeftNode and mRightNode.
+  nsCOMPtr<nsINode> mParent;
 };
 
 }  // namespace mozilla
 
 #endif  // #ifndef JoinNodeTransaction_h
--- a/editor/libeditor/PlaceholderTransaction.h
+++ b/editor/libeditor/PlaceholderTransaction.h
@@ -50,17 +50,17 @@ class PlaceholderTransaction final : pub
   NS_DECL_ISUPPORTS_INHERITED
 
   NS_DECL_CYCLE_COLLECTION_CLASS_INHERITED(PlaceholderTransaction,
                                            EditAggregateTransaction)
   // ------------ EditAggregateTransaction -----------------------
 
   NS_DECL_EDITTRANSACTIONBASE
 
-  MOZ_CAN_RUN_SCRIPT NS_IMETHOD RedoTransaction() override;
+  NS_IMETHOD RedoTransaction() override;
   NS_IMETHOD Merge(nsITransaction* aTransaction, bool* aDidMerge) override;
 
   // ------------ nsIAbsorbingTransaction -----------------------
 
   NS_IMETHOD GetTxnName(nsAtom** aName) override;
 
   NS_IMETHOD_(bool) StartSelectionEquals(SelectionState& aSelState) override;
 
--- a/editor/libeditor/SplitNodeTransaction.cpp
+++ b/editor/libeditor/SplitNodeTransaction.cpp
@@ -13,92 +13,92 @@
 #include "nsError.h"     // for NS_ERROR_NOT_INITIALIZED, etc.
 #include "nsIContent.h"  // for nsIContent
 
 namespace mozilla {
 
 using namespace dom;
 
 template already_AddRefed<SplitNodeTransaction> SplitNodeTransaction::Create(
-    EditorBase& aEditorBase, const EditorDOMPoint& aStartOfRightContent);
+    EditorBase& aEditorBase, const EditorDOMPoint& aStartOfRightNode);
 template already_AddRefed<SplitNodeTransaction> SplitNodeTransaction::Create(
-    EditorBase& aEditorBase, const EditorRawDOMPoint& aStartOfRightContent);
+    EditorBase& aEditorBase, const EditorRawDOMPoint& aStartOfRightNode);
 
 // static
 template <typename PT, typename CT>
 already_AddRefed<SplitNodeTransaction> SplitNodeTransaction::Create(
     EditorBase& aEditorBase,
-    const EditorDOMPointBase<PT, CT>& aStartOfRightContent) {
+    const EditorDOMPointBase<PT, CT>& aStartOfRightNode) {
   RefPtr<SplitNodeTransaction> transaction =
-      new SplitNodeTransaction(aEditorBase, aStartOfRightContent);
+      new SplitNodeTransaction(aEditorBase, aStartOfRightNode);
   return transaction.forget();
 }
 
 template <typename PT, typename CT>
 SplitNodeTransaction::SplitNodeTransaction(
     EditorBase& aEditorBase,
-    const EditorDOMPointBase<PT, CT>& aStartOfRightContent)
-    : mEditorBase(&aEditorBase), mStartOfRightContent(aStartOfRightContent) {
-  MOZ_DIAGNOSTIC_ASSERT(aStartOfRightContent.IsSet());
-  MOZ_DIAGNOSTIC_ASSERT(aStartOfRightContent.GetContainerAsContent());
+    const EditorDOMPointBase<PT, CT>& aStartOfRightNode)
+    : mEditorBase(&aEditorBase), mStartOfRightNode(aStartOfRightNode) {
+  MOZ_DIAGNOSTIC_ASSERT(aStartOfRightNode.IsSet());
+  MOZ_DIAGNOSTIC_ASSERT(aStartOfRightNode.GetContainerAsContent());
 }
 
 NS_IMPL_CYCLE_COLLECTION_INHERITED(SplitNodeTransaction, EditTransactionBase,
-                                   mEditorBase, mStartOfRightContent,
-                                   mContainerParentNode, mNewLeftContent)
+                                   mEditorBase, mStartOfRightNode, mParent,
+                                   mNewLeftNode)
 
 NS_IMPL_ADDREF_INHERITED(SplitNodeTransaction, EditTransactionBase)
 NS_IMPL_RELEASE_INHERITED(SplitNodeTransaction, EditTransactionBase)
 NS_INTERFACE_MAP_BEGIN_CYCLE_COLLECTION(SplitNodeTransaction)
 NS_INTERFACE_MAP_END_INHERITING(EditTransactionBase)
 
-NS_IMETHODIMP SplitNodeTransaction::DoTransaction() {
-  if (NS_WARN_IF(!mEditorBase) || NS_WARN_IF(!mStartOfRightContent.IsSet())) {
-    return NS_ERROR_NOT_AVAILABLE;
+MOZ_CAN_RUN_SCRIPT_BOUNDARY NS_IMETHODIMP
+SplitNodeTransaction::DoTransaction() {
+  if (NS_WARN_IF(!mEditorBase) || NS_WARN_IF(!mStartOfRightNode.IsSet())) {
+    return NS_ERROR_NOT_INITIALIZED;
   }
-  MOZ_ASSERT(mStartOfRightContent.IsSetAndValid());
+  MOZ_ASSERT(mStartOfRightNode.IsSetAndValid());
 
   // Create a new node
   ErrorResult error;
   // Don't use .downcast directly because AsContent has an assertion we want
   nsCOMPtr<nsINode> cloneOfRightContainer =
-      mStartOfRightContent.GetContainer()->CloneNode(false, error);
+      mStartOfRightNode.GetContainer()->CloneNode(false, error);
   if (error.Failed()) {
     NS_WARNING("nsINode::CloneNode() failed");
     return error.StealNSResult();
   }
   if (NS_WARN_IF(!cloneOfRightContainer)) {
     return NS_ERROR_UNEXPECTED;
   }
 
-  mNewLeftContent = cloneOfRightContainer->AsContent();
-
-  mContainerParentNode = mStartOfRightContent.GetContainerParent();
-  if (!mContainerParentNode) {
-    NS_WARNING("Right container was an orphan node");
-    return NS_ERROR_NOT_AVAILABLE;
-  }
+  RefPtr<EditorBase> editorBase(mEditorBase);
 
-  OwningNonNull<EditorBase> editorBase = *mEditorBase;
-  OwningNonNull<nsIContent> newLeftContent = *mNewLeftContent;
-  OwningNonNull<nsINode> containerParentNode = *mContainerParentNode;
-  EditorDOMPoint startOfRightContent(mStartOfRightContent);
-
+  mNewLeftNode = cloneOfRightContainer->AsContent();
   if (RefPtr<Element> startOfRightNode =
-          startOfRightContent.GetContainerAsElement()) {
+          mStartOfRightNode.GetContainerAsElement()) {
     nsresult rv = editorBase->MarkElementDirty(*startOfRightNode);
     if (NS_WARN_IF(rv == NS_ERROR_EDITOR_DESTROYED)) {
       return EditorBase::ToGenericNSResult(rv);
     }
     NS_WARNING_ASSERTION(NS_SUCCEEDED(rv),
                          "EditorBase::MarkElementDirty() failed, but ignored");
   }
 
+  // Get the parent node
+  mParent = mStartOfRightNode.GetContainerParent();
+  if (!mParent) {
+    NS_WARNING("Right container was an orphan node");
+    return NS_ERROR_FAILURE;
+  }
+
   // Insert the new node
-  editorBase->DoSplitNode(startOfRightContent, newLeftContent, error);
+  nsCOMPtr<nsIContent> newLeftNode = mNewLeftNode;
+  editorBase->DoSplitNode(EditorDOMPoint(mStartOfRightNode), *newLeftNode,
+                          error);
   if (error.Failed()) {
     NS_WARNING("EditorBase::DoSplitNode() failed");
     return error.StealNSResult();
   }
 
   if (!editorBase->AllowsTransactionsToChangeSelection()) {
     return NS_OK;
   }
@@ -106,90 +106,94 @@ NS_IMETHODIMP SplitNodeTransaction::DoTr
   NS_WARNING_ASSERTION(
       !editorBase->Destroyed(),
       "The editor has gone but SplitNodeTransaction keeps trying to modify "
       "Selection");
   RefPtr<Selection> selection = editorBase->GetSelection();
   if (NS_WARN_IF(!selection)) {
     return NS_ERROR_FAILURE;
   }
-  EditorRawDOMPoint atEndOfLeftNode(EditorRawDOMPoint::AtEndOf(newLeftContent));
+  EditorRawDOMPoint atEndOfLeftNode(EditorRawDOMPoint::AtEndOf(mNewLeftNode));
   selection->Collapse(atEndOfLeftNode, error);
   NS_WARNING_ASSERTION(!error.Failed(), "Selection::Collapse() failed");
   return error.StealNSResult();
 }
 
-NS_IMETHODIMP SplitNodeTransaction::UndoTransaction() {
-  if (NS_WARN_IF(!mEditorBase) || NS_WARN_IF(!mNewLeftContent) ||
-      NS_WARN_IF(!mContainerParentNode) ||
-      NS_WARN_IF(!mStartOfRightContent.IsSet())) {
-    return NS_ERROR_NOT_AVAILABLE;
+MOZ_CAN_RUN_SCRIPT_BOUNDARY NS_IMETHODIMP
+SplitNodeTransaction::UndoTransaction() {
+  if (NS_WARN_IF(!mEditorBase) || NS_WARN_IF(!mNewLeftNode) ||
+      NS_WARN_IF(!mParent) || NS_WARN_IF(!mStartOfRightNode.IsSet())) {
+    return NS_ERROR_NOT_INITIALIZED;
   }
 
   // This assumes Do inserted the new node in front of the prior existing node
   // XXX Perhaps, we should reset mStartOfRightNode with current first child
   //     of the right node.
-  OwningNonNull<EditorBase> editorBase = *mEditorBase;
-  OwningNonNull<nsINode> containerNode = *mStartOfRightContent.GetContainer();
-  OwningNonNull<nsINode> newLeftContent = *mNewLeftContent;
-  OwningNonNull<nsINode> containerParentNode = *mContainerParentNode;
-  nsresult rv = editorBase->DoJoinNodes(containerNode, newLeftContent,
-                                        containerParentNode);
+  RefPtr<EditorBase> editorBase = mEditorBase;
+  nsCOMPtr<nsINode> container = mStartOfRightNode.GetContainer();
+  nsCOMPtr<nsINode> newLeftNode = mNewLeftNode;
+  nsCOMPtr<nsINode> parent = mParent;
+  nsresult rv = editorBase->DoJoinNodes(container, newLeftNode, parent);
   NS_WARNING_ASSERTION(NS_SUCCEEDED(rv), "EditorBase::DoJoinNodes() failed");
   return rv;
 }
 
 /* Redo cannot simply resplit the right node, because subsequent transactions
  * on the redo stack may depend on the left node existing in its previous
  * state.
  */
-NS_IMETHODIMP SplitNodeTransaction::RedoTransaction() {
-  if (NS_WARN_IF(!mNewLeftContent) || NS_WARN_IF(!mContainerParentNode) ||
-      NS_WARN_IF(!mStartOfRightContent.IsSet()) || NS_WARN_IF(!mEditorBase)) {
-    return NS_ERROR_NOT_AVAILABLE;
+MOZ_CAN_RUN_SCRIPT_BOUNDARY NS_IMETHODIMP
+SplitNodeTransaction::RedoTransaction() {
+  if (NS_WARN_IF(!mNewLeftNode) || NS_WARN_IF(!mParent) ||
+      NS_WARN_IF(!mStartOfRightNode.IsSet()) || NS_WARN_IF(!mEditorBase)) {
+    return NS_ERROR_NOT_INITIALIZED;
   }
 
-  OwningNonNull<EditorBase> editorBase = *mEditorBase;
-  OwningNonNull<nsINode> newLeftContent = *mNewLeftContent;
-  OwningNonNull<nsINode> containerParentNode = *mContainerParentNode;
-  EditorDOMPoint startOfRightContent(mStartOfRightContent);
-
   // First, massage the existing node so it is in its post-split state
   ErrorResult error;
-  if (startOfRightContent.IsInTextNode()) {
-    Text* rightTextNode = startOfRightContent.ContainerAsText();
-    editorBase->DoDeleteText(MOZ_KnownLive(*rightTextNode), 0,
-                             startOfRightContent.Offset(), error);
+  if (mStartOfRightNode.IsInTextNode()) {
+    RefPtr<EditorBase> editorBase = mEditorBase;
+    RefPtr<Text> rightNodeAsText = mStartOfRightNode.GetContainerAsText();
+    MOZ_DIAGNOSTIC_ASSERT(rightNodeAsText);
+    editorBase->DoDeleteText(*rightNodeAsText, 0, mStartOfRightNode.Offset(),
+                             error);
     if (error.Failed()) {
       NS_WARNING("EditorBase::DoDeleteText() failed");
       return error.StealNSResult();
     }
   } else {
-    AutoTArray<OwningNonNull<nsIContent>, 24> movingChildren;
-    if (nsIContent* child =
-            startOfRightContent.GetContainer()->GetFirstChild()) {
-      movingChildren.AppendElement(*child);
-      for (uint32_t i = 0; i < startOfRightContent.Offset(); i++) {
-        child = child->GetNextSibling();
-        if (!child) {
-          break;
-        }
-        movingChildren.AppendElement(*child);
+    nsCOMPtr<nsIContent> child =
+        mStartOfRightNode.GetContainer()->GetFirstChild();
+    nsCOMPtr<nsIContent> nextSibling;
+    ErrorResult error;
+    for (uint32_t i = 0; i < mStartOfRightNode.Offset(); i++) {
+      // XXX This must be bad behavior.  Perhaps, we should work with
+      //     mStartOfRightNode::GetChild().  Even if some children
+      //     before the right node have been inserted or removed, we should
+      //     move all children before the right node because user must focus
+      //     on the right node, so, it must be the expected behavior.
+      if (NS_WARN_IF(!child)) {
+        return NS_ERROR_NULL_POINTER;
       }
-    }
-    ErrorResult error;
-    for (OwningNonNull<nsIContent>& child : movingChildren) {
-      newLeftContent->AppendChild(child, error);
+      nextSibling = child->GetNextSibling();
+      mStartOfRightNode.GetContainer()->RemoveChild(*child, error);
+      if (error.Failed()) {
+        NS_WARNING("nsINode::RemoveChild() failed");
+        return error.StealNSResult();
+      }
+      mNewLeftNode->AppendChild(*child, error);
       if (error.Failed()) {
         NS_WARNING("nsINode::AppendChild() failed");
         return error.StealNSResult();
       }
+      child = nextSibling;
     }
   }
   MOZ_ASSERT(!error.Failed());
   // Second, re-insert the left node into the tree
-  containerParentNode->InsertBefore(newLeftContent,
-                                    startOfRightContent.GetContainer(), error);
+  mParent->InsertBefore(*mNewLeftNode, mStartOfRightNode.GetContainer(), error);
   NS_WARNING_ASSERTION(!error.Failed(), "nsINode::InsertBefore() failed");
   return error.StealNSResult();
 }
 
+nsIContent* SplitNodeTransaction::GetNewNode() { return mNewLeftNode; }
+
 }  // namespace mozilla
--- a/editor/libeditor/SplitNodeTransaction.h
+++ b/editor/libeditor/SplitNodeTransaction.h
@@ -5,72 +5,74 @@
 
 #ifndef SplitNodeTransaction_h
 #define SplitNodeTransaction_h
 
 #include "mozilla/EditorDOMPoint.h"  // for RangeBoundary, EditorRawDOMPoint
 #include "mozilla/EditTransactionBase.h"  // for EditTxn, etc.
 #include "nsCOMPtr.h"                     // for nsCOMPtr
 #include "nsCycleCollectionParticipant.h"
-#include "nsIContent.h"
 #include "nsISupportsImpl.h"  // for NS_DECL_ISUPPORTS_INHERITED
 #include "nscore.h"           // for NS_IMETHOD
 
+class nsIContent;
+class nsINode;
+
 namespace mozilla {
 
 class EditorBase;
 
 /**
  * A transaction that splits a node into two identical nodes, with the children
  * divided between the new nodes.
  */
 class SplitNodeTransaction final : public EditTransactionBase {
  private:
   template <typename PT, typename CT>
   SplitNodeTransaction(EditorBase& aEditorBase,
-                       const EditorDOMPointBase<PT, CT>& aStartOfRightContent);
+                       const EditorDOMPointBase<PT, CT>& aStartOfRightNode);
 
  public:
   /**
    * Creates a transaction to create a new node (left node) identical to an
    * existing node (right node), and split the contents between the same point
    * in both nodes.
    *
-   * @param aEditorBase             The provider of core editing operations.
-   * @param aStartOfRightContent    The point to split.  Its container will be
-   *                                the right node, i.e., become the new node's
-   *                                next sibling.  And the point will be start
-   *                                of the right node.
+   * @param aEditorBase         The provider of core editing operations.
+   * @param aStartOfRightNode   The point to split.  Its container will be
+   *                            the right node, i.e., become the new node's
+   *                            next sibling.  And the point will be start
+   *                            of the right node.
    */
   template <typename PT, typename CT>
   static already_AddRefed<SplitNodeTransaction> Create(
       EditorBase& aEditorBase,
-      const EditorDOMPointBase<PT, CT>& aStartOfRightContent);
+      const EditorDOMPointBase<PT, CT>& aStartOfRightNode);
 
   NS_DECL_ISUPPORTS_INHERITED
   NS_DECL_CYCLE_COLLECTION_CLASS_INHERITED(SplitNodeTransaction,
                                            EditTransactionBase)
 
   NS_DECL_EDITTRANSACTIONBASE
 
-  MOZ_CAN_RUN_SCRIPT NS_IMETHOD RedoTransaction() override;
+  NS_IMETHOD RedoTransaction() override;
 
-  nsIContent* GetNewLeftContent() const { return mNewLeftContent; }
+  nsIContent* GetNewNode();
 
  protected:
   virtual ~SplitNodeTransaction() = default;
 
   RefPtr<EditorBase> mEditorBase;
 
   // The container is existing right node (will be split).
   // The point referring this is start of the right node after it's split.
-  EditorDOMPoint mStartOfRightContent;
+  EditorDOMPoint mStartOfRightNode;
 
-  // The node we create when splitting mExistingRightContent.
-  nsCOMPtr<nsIContent> mNewLeftContent;
+  // The node we create when splitting mExistingRightNode.
+  nsCOMPtr<nsIContent> mNewLeftNode;
 
-  // The parent shared by mExistingRightContent and mNewLeftContent.
-  nsCOMPtr<nsINode> mContainerParentNode;
+  // The parent shared by mExistingRightNode and mNewLeftNode.
+  nsCOMPtr<nsINode> mParent;
 };
 
 }  // namespace mozilla
 
 #endif  // #ifndef SplitNodeTransaction_h
--- a/editor/nsIEditor.idl
+++ b/editor/nsIEditor.idl
@@ -256,17 +256,16 @@ interface nsIEditor  : nsISupports
     * that should be treated as a single logical operation,
     * in the most efficient way possible.<br>
     * All transactions executed between a call to beginTransaction and
     * endTransaction will be undoable as an atomic action.<br>
     * endTransaction must be called after beginTransaction.<br>
     * Calls to beginTransaction can be nested, as long as endTransaction
     * is called once per beginUpdate.
     */
-  [can_run_script]
   void beginTransaction();
 
   /** endTransaction is a signal to the editor that the caller is
     * finished updating the content model.<br>
     * beginUpdate must be called before endTransaction is called.<br>
     * Calls to beginTransaction can be nested, as long as endTransaction
     * is called once per beginTransaction.
     */
--- a/editor/txmgr/TransactionItem.cpp
+++ b/editor/txmgr/TransactionItem.cpp
@@ -1,17 +1,16 @@
 /* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
 /* This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 #include "TransactionItem.h"
 
 #include "mozilla/mozalloc.h"
-#include "mozilla/OwningNonNull.h"
 #include "mozilla/TransactionManager.h"
 #include "mozilla/TransactionStack.h"
 #include "nsCOMPtr.h"
 #include "nsDebug.h"
 #include "nsError.h"
 #include "nsISupportsImpl.h"
 #include "nsITransaction.h"
 
@@ -72,18 +71,17 @@ nsresult TransactionItem::AddChild(Trans
 already_AddRefed<nsITransaction> TransactionItem::GetTransaction() {
   return do_AddRef(mTransaction);
 }
 
 nsresult TransactionItem::DoTransaction() {
   if (!mTransaction) {
     return NS_OK;
   }
-  OwningNonNull<nsITransaction> transaction = *mTransaction;
-  nsresult rv = transaction->DoTransaction();
+  nsresult rv = mTransaction->DoTransaction();
   NS_WARNING_ASSERTION(NS_SUCCEEDED(rv),
                        "nsITransaction::DoTransaction() failed");
   return rv;
 }
 
 nsresult TransactionItem::UndoTransaction(
     TransactionManager* aTransactionManager) {
   nsresult rv = UndoChildren(aTransactionManager);
@@ -94,18 +92,17 @@ nsresult TransactionItem::UndoTransactio
                          "TransactionItem::RecoverFromUndoError() failed");
     return rv;
   }
 
   if (!mTransaction) {
     return NS_OK;
   }
 
-  OwningNonNull<nsITransaction> transaction = *mTransaction;
-  rv = transaction->UndoTransaction();
+  rv = mTransaction->UndoTransaction();
   if (NS_SUCCEEDED(rv)) {
     return NS_OK;
   }
 
   NS_WARNING("TransactionItem::UndoTransaction() failed");
   DebugOnly<nsresult> rvIgnored = RecoverFromUndoError(aTransactionManager);
   NS_WARNING_ASSERTION(NS_SUCCEEDED(rvIgnored),
                        "TransactionItem::RecoverFromUndoError() failed");
@@ -255,31 +252,29 @@ nsresult TransactionItem::RecoverFromUnd
   nsresult rv = RedoChildren(aTransactionManager);
   NS_WARNING_ASSERTION(NS_SUCCEEDED(rv),
                        "TransactionItem::RedoChildren() failed");
   return rv;
 }
 
 nsresult TransactionItem::RecoverFromRedoError(
     TransactionManager* aTransactionManager) {
-  OwningNonNull<nsITransaction> transaction = *mTransaction;
-
   // If this method gets called, we already successfully called
   // RedoTransaction() for the transaction item itself. Undo all
   // the children that successfully called RedoTransaction(),
   // then undo the transaction item itself.
   nsresult rv = UndoChildren(aTransactionManager);
   if (NS_FAILED(rv)) {
     NS_WARNING("TransactionItem::UndoChildren() failed");
     return rv;
   }
 
   if (!mTransaction) {
     return NS_OK;
   }
 
-  rv = transaction->UndoTransaction();
+  rv = mTransaction->UndoTransaction();
   NS_WARNING_ASSERTION(NS_SUCCEEDED(rv),
                        "nsITransaction::UndoTransaction() failed");
   return rv;
 }
 
 }  // namespace mozilla
--- a/editor/txmgr/TransactionItem.h
+++ b/editor/txmgr/TransactionItem.h
@@ -29,34 +29,28 @@ class TransactionItem final {
 
   nsresult AddChild(TransactionItem& aTransactionItem);
   already_AddRefed<nsITransaction> GetTransaction();
   size_t NumberOfChildren() const {
     return NumberOfUndoItems() + NumberOfRedoItems();
   }
   nsresult GetChild(size_t aIndex, TransactionItem** aChild);
 
-  MOZ_CAN_RUN_SCRIPT nsresult DoTransaction();
-  MOZ_CAN_RUN_SCRIPT nsresult
-  UndoTransaction(TransactionManager* aTransactionManager);
-  MOZ_CAN_RUN_SCRIPT nsresult
-  RedoTransaction(TransactionManager* aTransactionManager);
+  nsresult DoTransaction();
+  nsresult UndoTransaction(TransactionManager* aTransactionManager);
+  nsresult RedoTransaction(TransactionManager* aTransactionManager);
 
   nsCOMArray<nsISupports>& GetData() { return mData; }
 
  private:
-  MOZ_CAN_RUN_SCRIPT nsresult
-  UndoChildren(TransactionManager* aTransactionManager);
-  MOZ_CAN_RUN_SCRIPT nsresult
-  RedoChildren(TransactionManager* aTransactionManager);
+  nsresult UndoChildren(TransactionManager* aTransactionManager);
+  nsresult RedoChildren(TransactionManager* aTransactionManager);
 
-  MOZ_CAN_RUN_SCRIPT nsresult
-  RecoverFromUndoError(TransactionManager* aTransactionManager);
-  MOZ_CAN_RUN_SCRIPT nsresult
-  RecoverFromRedoError(TransactionManager* aTransactionManager);
+  nsresult RecoverFromUndoError(TransactionManager* aTransactionManager);
+  nsresult RecoverFromRedoError(TransactionManager* aTransactionManager);
 
   size_t NumberOfUndoItems() const;
   size_t NumberOfRedoItems() const;
 
   void CleanUp();
 
   ~TransactionItem();
 
--- a/editor/txmgr/TransactionManager.cpp
+++ b/editor/txmgr/TransactionManager.cpp
@@ -206,17 +206,17 @@ nsresult TransactionManager::BeginBatchI
   if (NS_FAILED(rv)) {
     NS_WARNING("TransactionManager::WillBeginBatchNotify() failed");
     return rv;
   }
   if (doInterrupt) {
     return NS_OK;
   }
 
-  rv = BeginTransaction(nullptr, aData);
+  rv = BeginTransaction(0, aData);
   NS_WARNING_ASSERTION(NS_SUCCEEDED(rv),
                        "TransactionManager::BeginTransaction() failed");
 
   nsresult rv2 = DidBeginBatchNotify(rv);
   NS_WARNING_ASSERTION(NS_SUCCEEDED(rv2),
                        "TransactionManager::DidBeginBatchNotify() failed");
 
   // XXX The result of BeginTransaction() or DidBeginBatchNotify() if
--- a/editor/txmgr/TransactionManager.h
+++ b/editor/txmgr/TransactionManager.h
@@ -30,18 +30,18 @@ class TransactionManager final : public 
   NS_DECL_CYCLE_COLLECTION_CLASS_AMBIGUOUS(TransactionManager,
                                            nsITransactionManager)
 
   NS_DECL_NSITRANSACTIONMANAGER
 
   already_AddRefed<nsITransaction> PeekUndoStack();
   already_AddRefed<nsITransaction> PeekRedoStack();
 
-  MOZ_CAN_RUN_SCRIPT nsresult Undo();
-  MOZ_CAN_RUN_SCRIPT nsresult Redo();
+  nsresult Undo();
+  nsresult Redo();
 
   size_t NumberOfUndoItems() const { return mUndoStack.GetSize(); }
   size_t NumberOfRedoItems() const { return mRedoStack.GetSize(); }
 
   int32_t NumberOfMaximumTransactions() const { return mMaxTransactionCount; }
 
   bool EnableUndoRedo(int32_t aMaxTransactionCount = -1);
   bool DisableUndoRedo() { return EnableUndoRedo(0); }
@@ -57,52 +57,41 @@ class TransactionManager final : public 
   bool AddTransactionListener(nsITransactionListener& aListener) {
     // XXX Shouldn't we check if aListener has already been in mListeners?
     return mListeners.AppendObject(&aListener);
   }
   bool RemoveTransactionListener(nsITransactionListener& aListener) {
     return mListeners.RemoveObject(&aListener);
   }
 
-  // FYI: We don't need to treat the following methods as `MOZ_CAN_RUN_SCRIPT`
-  //      for now because only ComposerCommandUpdater is the listener and it
-  //      does not do something dangerous synchronously.
-  MOZ_CAN_RUN_SCRIPT_BOUNDARY nsresult
-  WillDoNotify(nsITransaction* aTransaction, bool* aInterrupt);
-  MOZ_CAN_RUN_SCRIPT_BOUNDARY nsresult DidDoNotify(nsITransaction* aTransaction,
-                                                   nsresult aExecuteResult);
-  MOZ_CAN_RUN_SCRIPT_BOUNDARY nsresult
-  WillUndoNotify(nsITransaction* aTransaction, bool* aInterrupt);
-  MOZ_CAN_RUN_SCRIPT_BOUNDARY nsresult
-  DidUndoNotify(nsITransaction* aTransaction, nsresult aUndoResult);
-  MOZ_CAN_RUN_SCRIPT_BOUNDARY nsresult
-  WillRedoNotify(nsITransaction* aTransaction, bool* aInterrupt);
-  MOZ_CAN_RUN_SCRIPT_BOUNDARY nsresult
-  DidRedoNotify(nsITransaction* aTransaction, nsresult aRedoResult);
-  MOZ_CAN_RUN_SCRIPT_BOUNDARY nsresult WillBeginBatchNotify(bool* aInterrupt);
-  MOZ_CAN_RUN_SCRIPT_BOUNDARY nsresult DidBeginBatchNotify(nsresult aResult);
-  MOZ_CAN_RUN_SCRIPT_BOUNDARY nsresult WillEndBatchNotify(bool* aInterrupt);
-  MOZ_CAN_RUN_SCRIPT_BOUNDARY nsresult DidEndBatchNotify(nsresult aResult);
-  MOZ_CAN_RUN_SCRIPT_BOUNDARY nsresult WillMergeNotify(
-      nsITransaction* aTop, nsITransaction* aTransaction, bool* aInterrupt);
-  MOZ_CAN_RUN_SCRIPT_BOUNDARY nsresult
-  DidMergeNotify(nsITransaction* aTop, nsITransaction* aTransaction,
-                 bool aDidMerge, nsresult aMergeResult);
+  nsresult WillDoNotify(nsITransaction* aTransaction, bool* aInterrupt);
+  nsresult DidDoNotify(nsITransaction* aTransaction, nsresult aExecuteResult);
+  nsresult WillUndoNotify(nsITransaction* aTransaction, bool* aInterrupt);
+  nsresult DidUndoNotify(nsITransaction* aTransaction, nsresult aUndoResult);
+  nsresult WillRedoNotify(nsITransaction* aTransaction, bool* aInterrupt);
+  nsresult DidRedoNotify(nsITransaction* aTransaction, nsresult aRedoResult);
+  nsresult WillBeginBatchNotify(bool* aInterrupt);
+  nsresult DidBeginBatchNotify(nsresult aResult);
+  nsresult WillEndBatchNotify(bool* aInterrupt);
+  nsresult DidEndBatchNotify(nsresult aResult);
+  nsresult WillMergeNotify(nsITransaction* aTop, nsITransaction* aTransaction,
+                           bool* aInterrupt);
+  nsresult DidMergeNotify(nsITransaction* aTop, nsITransaction* aTransaction,
+                          bool aDidMerge, nsresult aMergeResult);
 
   /**
    * Exposing non-virtual methods of nsITransactionManager methods.
    */
-  MOZ_CAN_RUN_SCRIPT nsresult BeginBatchInternal(nsISupports* aData);
+  nsresult BeginBatchInternal(nsISupports* aData);
   nsresult EndBatchInternal(bool aAllowEmpty);
 
  private:
   virtual ~TransactionManager() = default;
 
-  MOZ_CAN_RUN_SCRIPT nsresult BeginTransaction(nsITransaction* aTransaction,
-                                               nsISupports* aData);
+  nsresult BeginTransaction(nsITransaction* aTransaction, nsISupports* aData);
   nsresult EndTransaction(bool aAllowEmpty);
 
   int32_t mMaxTransactionCount;
   TransactionStack mDoStack;
   TransactionStack mUndoStack;
   TransactionStack mRedoStack;
   nsCOMArray<nsITransactionListener> mListeners;
 };
--- a/editor/txmgr/nsITransaction.idl
+++ b/editor/txmgr/nsITransaction.idl
@@ -12,33 +12,30 @@
  * execute some behavior that must be tracked by the transaction manager.
  */
 [scriptable, uuid(58e330c1-7b48-11d2-98b9-00805f297d89)]
 interface nsITransaction : nsISupports
 {
   /**
    * Executes the transaction.
    */
-  [can_run_script]
   void doTransaction();
 
   /**
    * Restores the state to what it was before the transaction was executed.
    */
-  [can_run_script]
   void undoTransaction();
 
   /**
    * Executes the transaction again. Can only be called on a transaction that
    * was previously undone.
    * <P>
    * In most cases, the redoTransaction() method will actually call the
    * doTransaction() method to execute the transaction again.
    */
-  [can_run_script]
   void redoTransaction();
 
   /**
    * The transaction's transient state. This attribute is checked by
    * the transaction manager after the transaction's Execute() method is called.
    * If the transient state is false, a reference to the transaction is
    * held by the transaction manager so that the transactions' undoTransaction()
    * and redoTransaction() methods can be called. If the transient state is
--- a/editor/txmgr/nsITransactionManager.idl
+++ b/editor/txmgr/nsITransactionManager.idl
@@ -26,31 +26,28 @@ interface nsITransactionManager : nsISup
    * Calls a transaction's doTransaction() method, then pushes it on the
    * undo stack.
    * <P>
    * This method calls the transaction's AddRef() method.
    * The transaction's Release() method will be called when the undo or redo
    * stack is pruned or when the transaction manager is destroyed.
    * @param aTransaction the transaction to do.
    */
-  [can_run_script]
   void doTransaction(in nsITransaction aTransaction);
 
   /**
    * Pops the topmost transaction on the undo stack, calls its
    * undoTransaction() method, then pushes it on the redo stack.
    */
-  [can_run_script]
   void undoTransaction();
 
   /**
    * Pops the topmost transaction on the redo stack, calls its
    * redoTransaction() method, then pushes it on the undo stack.
    */
-  [can_run_script]
   void redoTransaction();
 
   /**
    * Clears the undo and redo stacks.
    */
   void clear();
 
   /**
@@ -67,17 +64,16 @@ interface nsITransactionManager : nsISup
    * Turns on the transaction manager's batch mode, forcing all transactions
    * executed by the transaction manager's doTransaction() method to be
    * aggregated together until EndBatch() is called.  This mode allows an
    * application to execute and group together several independent transactions
    * so they can be undone with a single call to undoTransaction().
    * @param aData An arbitrary nsISupports object that is associated with the
    * batch. Can be retrieved from the undo or redo stacks.
    */
-  [can_run_script]
   void beginBatch(in nsISupports aData);
 
   /**
    * Turns off the transaction manager's batch mode.
    * @param aAllowEmpty If true, a batch containing no children will be
    * pushed onto the undo stack. Otherwise, ending a batch with no
    * children will result in no transactions being pushed on the undo stack.
    */
--- a/editor/txmgr/tests/TestTXMgr.cpp
+++ b/editor/txmgr/tests/TestTXMgr.cpp
@@ -265,49 +265,49 @@ class SimpleTransaction : public TestTra
   int32_t mFlags;
 
  public:
   explicit SimpleTransaction(int32_t aFlags = NONE_FLAG)
       : mVal(++sConstructorCount), mFlags(aFlags) {}
 
   ~SimpleTransaction() override = default;
 
-  MOZ_CAN_RUN_SCRIPT NS_IMETHOD DoTransaction() override {
+  NS_IMETHOD DoTransaction() override {
     //
     // Make sure DoTransaction() is called in the order we expect!
     // Notice that we don't check to see if we go past the end of the array.
     // This is done on purpose since we want to crash if the order array is out
     // of date.
     //
     if (sDoOrderArr) {
       EXPECT_EQ(mVal, sDoOrderArr[sDoCount]);
     }
 
     ++sDoCount;
 
     return (mFlags & THROWS_DO_ERROR_FLAG) ? NS_ERROR_FAILURE : NS_OK;
   }
 
-  MOZ_CAN_RUN_SCRIPT NS_IMETHOD UndoTransaction() override {
+  NS_IMETHOD UndoTransaction() override {
     //
     // Make sure UndoTransaction() is called in the order we expect!
     // Notice that we don't check to see if we go past the end of the array.
     // This is done on purpose since we want to crash if the order array is out
     // of date.
     //
     if (sUndoOrderArr) {
       EXPECT_EQ(mVal, sUndoOrderArr[sUndoCount]);
     }
 
     ++sUndoCount;
 
     return (mFlags & THROWS_UNDO_ERROR_FLAG) ? NS_ERROR_FAILURE : NS_OK;
   }
 
-  MOZ_CAN_RUN_SCRIPT NS_IMETHOD RedoTransaction() override {
+  NS_IMETHOD RedoTransaction() override {
     //
     // Make sure RedoTransaction() is called in the order we expect!
     // Notice that we don't check to see if we go past the end of the array.
     // This is done on purpose since we want to crash if the order array is out
     // of date.
     //
     if (sRedoOrderArr) {
       EXPECT_EQ(mVal, sRedoOrderArr[sRedoCount]);
@@ -367,17 +367,17 @@ class AggregateTransaction : public Simp
     mErrorFlags = aFlags & ALL_ERROR_FLAGS;
     mTXMgr = aTXMgr;
     mMaxLevel = aMaxLevel;
     mNumChildrenPerNode = aNumChildrenPerNode;
   }
 
   ~AggregateTransaction() override = default;
 
-  MOZ_CAN_RUN_SCRIPT NS_IMETHOD DoTransaction() override {
+  NS_IMETHOD DoTransaction() override {
     if (mLevel >= mMaxLevel) {
       // Only leaf nodes can throw errors!
       mFlags |= mErrorFlags;
     }
 
     nsresult rv = SimpleTransaction::DoTransaction();
     if (NS_FAILED(rv)) {
       // fail("QueryInterface() failed for transaction level %d. (%d)\n",
@@ -385,17 +385,17 @@ class AggregateTransaction : public Simp
       return rv;
     }
 
     if (mLevel >= mMaxLevel) {
       return NS_OK;
     }
 
     if (mFlags & BATCH_FLAG) {
-      rv = MOZ_KnownLive(mTXMgr)->BeginBatch(nullptr);
+      rv = mTXMgr->BeginBatch(nullptr);
       if (NS_FAILED(rv)) {
         return rv;
       }
     }
 
     int32_t cLevel = mLevel + 1;
 
     for (int i = 1; i <= mNumChildrenPerNode; i++) {
@@ -411,17 +411,17 @@ class AggregateTransaction : public Simp
         mErrorFlags = mErrorFlags & (~THROWS_UNDO_ERROR_FLAG);
       }
 
       flags |= mFlags & BATCH_FLAG;
 
       RefPtr<AggregateTransaction> tximpl = new AggregateTransaction(
           mTXMgr, cLevel, i, mMaxLevel, mNumChildrenPerNode, flags);
 
-      rv = MOZ_KnownLive(mTXMgr)->DoTransaction(tximpl);
+      rv = mTXMgr->DoTransaction(tximpl);
       if (NS_FAILED(rv)) {
         if (mFlags & BATCH_FLAG) {
           mTXMgr->EndBatch(false);
         }
         return rv;
       }
     }
 
@@ -477,32 +477,32 @@ void reset_globals() {
 
   sRedoCount = 0;
   sRedoOrderArr = 0;
 }
 
 /**
  * Test behaviors in non-batch mode.
  **/
-MOZ_CAN_RUN_SCRIPT_BOUNDARY void quick_test(TestTransactionFactory* factory) {
+void quick_test(TestTransactionFactory* factory) {
   /*******************************************************************
    *
    * Create a transaction manager implementation:
    *
    *******************************************************************/
 
   nsCOMPtr<nsITransactionManager> mgr = new TransactionManager();
 
   /*******************************************************************
    *
    * Call DoTransaction() with a null transaction:
    *
    *******************************************************************/
 
-  nsresult rv = mgr->DoTransaction(nullptr);
+  nsresult rv = mgr->DoTransaction(0);
   EXPECT_EQ(rv, NS_ERROR_NULL_POINTER);
 
   /*******************************************************************
    *
    * Call UndoTransaction() with an empty undo stack:
    *
    *******************************************************************/
 
@@ -1224,18 +1224,17 @@ TEST(TestTXMgr, AggregationTest)
   AggregateTransactionFactory factory(3, 2);
 
   quick_test(&factory);
 }
 
 /**
  * Test behaviors in batch mode.
  **/
-MOZ_CAN_RUN_SCRIPT_BOUNDARY void quick_batch_test(
-    TestTransactionFactory* factory) {
+void quick_batch_test(TestTransactionFactory* factory) {
   /*******************************************************************
    *
    * Create a transaction manager implementation:
    *
    *******************************************************************/
 
   nsCOMPtr<nsITransactionManager> mgr = new TransactionManager();
 
@@ -1854,18 +1853,17 @@ TEST(TestTXMgr, AggregationBatchTest)
 
   quick_batch_test(&factory);
 }
 
 /**
  * Create 'iterations * (iterations + 1) / 2' transactions;
  * do/undo/redo/undo them.
  **/
-MOZ_CAN_RUN_SCRIPT_BOUNDARY void stress_test(TestTransactionFactory* factory,
-                                             int32_t iterations) {
+void stress_test(TestTransactionFactory* factory, int32_t iterations) {
   /*******************************************************************
    *
    * Create a transaction manager:
    *
    *******************************************************************/
 
   nsCOMPtr<nsITransactionManager> mgr = new TransactionManager();