Back out fee79a593fd3 and 2c8930343985 (bug 825341) for having probably needed-clobber

accessible/src/generic/HyperTextAccessible.cpp

@@ -1824,7 +1824,7 @@ HyperTextAccessible::SetSelectionBounds(int32_t aSelectionNum,
 
   nsRefPtr<nsRange> range;
   if (aSelectionNum == rangeCount)
-    range = new nsRange(mContent);
+    range = new nsRange();
   else
     range = domSel->GetRangeAt(aSelectionNum);
 
@@ -1886,7 +1886,7 @@ HyperTextAccessible::ScrollSubstringTo(int32_t aStartIndex, int32_t aEndIndex,
   if (IsDefunct())
     return NS_ERROR_FAILURE;
 
-  nsRefPtr<nsRange> range = new nsRange(mContent);
+  nsRefPtr<nsRange> range = new nsRange();
   nsresult rv = HypertextOffsetsToDOMRange(aStartIndex, aEndIndex, range);
   NS_ENSURE_SUCCESS(rv, rv);
 
@@ -1910,7 +1910,7 @@ HyperTextAccessible::ScrollSubstringToPoint(int32_t aStartIndex,
   nsIntPoint coords = nsAccUtils::ConvertToScreenCoords(aX, aY, aCoordinateType,
                                                         this);
 
-  nsRefPtr<nsRange> range = new nsRange(mContent);
+  nsRefPtr<nsRange> range = new nsRange();
   nsresult rv = HypertextOffsetsToDOMRange(aStartIndex, aEndIndex, range);
   NS_ENSURE_SUCCESS(rv, rv);
 

accessible/src/windows/msaa/TextLeafAccessibleWrap.cpp

@@ -158,7 +158,7 @@ TextLeafAccessibleWrap::scrollToSubstring(
   if (IsDefunct())
     return E_FAIL;
 
-  nsRefPtr<nsRange> range = new nsRange(mContent);
+  nsRefPtr<nsRange> range = new nsRange();
   if (NS_FAILED(range->SetStart(mContent, aStartIndex)))
       return E_FAIL;
 

content/base/public/nsContentUtils.h

@@ -112,7 +112,6 @@ namespace layers {
 } // namespace layers
 
 namespace dom {
-class DocumentFragment;
 class Element;
 } // namespace dom
 
@@ -367,7 +366,6 @@ public:
 
   // Check if the (JS) caller can access aNode.
   static bool CanCallerAccess(nsIDOMNode *aNode);
-  static bool CanCallerAccess(nsINode* aNode);
 
   // Check if the (JS) caller can access aWindow.
   // aWindow can be either outer or inner window.
@@ -1086,10 +1084,6 @@ public:
                                            const nsAString& aFragment,
                                            bool aPreventScriptExecution,
                                            nsIDOMDocumentFragment** aReturn);
-  static already_AddRefed<mozilla::dom::DocumentFragment>
-  CreateContextualFragment(nsINode* aContextNode, const nsAString& aFragment,
-                           bool aPreventScriptExecution,
-                           mozilla::ErrorResult& aRv);
 
   /**
    * Invoke the fragment parsing algorithm (innerHTML) using the HTML parser.

content/base/public/nsIDocument.h

@@ -2472,10 +2472,6 @@ nsresult
 NS_NewVideoDocument(nsIDocument** aInstancePtrResult);
 #endif
 
-already_AddRefed<mozilla::dom::DocumentFragment>
-NS_NewDocumentFragment(nsNodeInfoManager* aNodeInfoManager,
-                       mozilla::ErrorResult& aRv);
-
 nsresult
 NS_NewDocumentFragment(nsIDOMDocumentFragment** aInstancePtrResult,
                        nsNodeInfoManager *aNodeInfoManager);

content/base/src/DocumentFragment.cpp

@@ -21,34 +21,21 @@
 nsresult
 NS_NewDocumentFragment(nsIDOMDocumentFragment** aInstancePtrResult,
                        nsNodeInfoManager *aNodeInfoManager)
-{
-  mozilla::ErrorResult rv;
-  *aInstancePtrResult = NS_NewDocumentFragment(aNodeInfoManager, rv).get();
-  return rv.ErrorCode();
-}
-
-already_AddRefed<mozilla::dom::DocumentFragment>
-NS_NewDocumentFragment(nsNodeInfoManager* aNodeInfoManager,
-                       mozilla::ErrorResult& aRv)
 {
   using namespace mozilla::dom;
 
-  if (!aNodeInfoManager) {
+  NS_ENSURE_ARG(aNodeInfoManager);
-    aRv.Throw(NS_ERROR_INVALID_ARG);
-    return nullptr;
-  }
 
-  nsCOMPtr<nsINodeInfo> nodeInfo =
+  nsCOMPtr<nsINodeInfo> nodeInfo;
-    aNodeInfoManager->GetNodeInfo(nsGkAtoms::documentFragmentNodeName,
+  nodeInfo = aNodeInfoManager->GetNodeInfo(nsGkAtoms::documentFragmentNodeName,
                                            nullptr, kNameSpaceID_None,
                                            nsIDOMNode::DOCUMENT_FRAGMENT_NODE);
-  if (!nodeInfo) {
+  NS_ENSURE_TRUE(nodeInfo, NS_ERROR_OUT_OF_MEMORY);
-    aRv.Throw(NS_ERROR_OUT_OF_MEMORY);
-    return nullptr;
-  }
 
-  nsRefPtr<DocumentFragment> it = new DocumentFragment(nodeInfo.forget());
+  DocumentFragment *it = new DocumentFragment(nodeInfo.forget());
-  return it.forget();
+  NS_ADDREF(*aInstancePtrResult = it);
+
+  return NS_OK;
 }
 
 namespace mozilla {

content/base/src/nsContentUtils.cpp

@@ -168,7 +168,6 @@
 #include "nsSVGFeatures.h"
 #include "MediaDecoder.h"
 #include "DecoderTraits.h"
-#include "mozilla/dom/DocumentFragment.h"
 
 #include "nsWrapperCacheInlines.h"
 #include "nsViewportInfo.h"
@@ -1589,15 +1588,6 @@ nsContentUtils::CanCallerAccess(nsIPrincipal* aSubjectPrincipal,
 // static
 bool
 nsContentUtils::CanCallerAccess(nsIDOMNode *aNode)
-{
-  nsCOMPtr<nsINode> node = do_QueryInterface(aNode);
-  NS_ENSURE_TRUE(node, false);
-  return CanCallerAccess(node);
-}
-
-// static
-bool
-nsContentUtils::CanCallerAccess(nsINode* aNode)
 {
   // XXXbz why not check the IsCapabilityEnabled thing up front, and not bother
   // with the system principal games?  But really, there should be a simpler
@@ -1612,7 +1602,10 @@ nsContentUtils::CanCallerAccess(nsINode* aNode)
     return true;
   }
 
-  return CanCallerAccess(subjectPrincipal, aNode->NodePrincipal());
+  nsCOMPtr<nsINode> node = do_QueryInterface(aNode);
+  NS_ENSURE_TRUE(node, false);
+
+  return CanCallerAccess(subjectPrincipal, node->NodePrincipal());
 }
 
 // static
@@ -4052,22 +4045,8 @@ nsContentUtils::CreateContextualFragment(nsINode* aContextNode,
                                          bool aPreventScriptExecution,
                                          nsIDOMDocumentFragment** aReturn)
 {
-  ErrorResult rv;
+  *aReturn = nullptr;
-  *aReturn = CreateContextualFragment(aContextNode, aFragment,
+  NS_ENSURE_ARG(aContextNode);
-                                      aPreventScriptExecution, rv).get();
-  return rv.ErrorCode();
-}
-
-already_AddRefed<DocumentFragment>
-nsContentUtils::CreateContextualFragment(nsINode* aContextNode,
-                                         const nsAString& aFragment,
-                                         bool aPreventScriptExecution,
-                                         ErrorResult& aRv)
-{
-  if (!aContextNode) {
-    aRv.Throw(NS_ERROR_INVALID_ARG);
-    return nullptr;
-  }
 
   // If we don't have a document here, we can't get the right security context
   // for compiling event handlers... so just bail out.
@@ -4079,8 +4058,8 @@ nsContentUtils::CreateContextualFragment(nsINode* aContextNode,
 #endif
 
   if (isHTML) {
-    nsRefPtr<DocumentFragment> frag =
+    nsCOMPtr<nsIDOMDocumentFragment> frag;
-      NS_NewDocumentFragment(document->NodeInfoManager(), aRv);
+    NS_NewDocumentFragment(getter_AddRefs(frag), document->NodeInfoManager());
     
     nsCOMPtr<nsIContent> contextAsContent = do_QueryInterface(aContextNode);
     if (contextAsContent && !contextAsContent->IsElement()) {
@@ -4091,15 +4070,19 @@ nsContentUtils::CreateContextualFragment(nsINode* aContextNode,
       }
     }
     
+    nsresult rv;
+    nsCOMPtr<nsIContent> fragment = do_QueryInterface(frag);
     if (contextAsContent && !contextAsContent->IsHTML(nsGkAtoms::html)) {
-      aRv = ParseFragmentHTML(aFragment, frag,
+      rv = ParseFragmentHTML(aFragment,
+                             fragment,
                              contextAsContent->Tag(),
                              contextAsContent->GetNameSpaceID(),
                              (document->GetCompatibilityMode() ==
                                eCompatibility_NavQuirks),
                              aPreventScriptExecution);
     } else {
-      aRv = ParseFragmentHTML(aFragment, frag,
+      rv = ParseFragmentHTML(aFragment,
+                             fragment,
                              nsGkAtoms::body,
                              kNameSpaceID_XHTML,
                              (document->GetCompatibilityMode() ==
@@ -4107,7 +4090,8 @@ nsContentUtils::CreateContextualFragment(nsINode* aContextNode,
                              aPreventScriptExecution);
     }
 
-    return frag.forget();
+    frag.forget(aReturn);
+    return rv;
   }
 
   nsAutoTArray<nsString, 32> tagStack;
@@ -4119,10 +4103,7 @@ nsContentUtils::CreateContextualFragment(nsINode* aContextNode,
 
   while (content && content->IsElement()) {
     nsString& tagName = *tagStack.AppendElement();
-    if (!&tagName) {
+    NS_ENSURE_TRUE(&tagName, NS_ERROR_OUT_OF_MEMORY);
-      aRv.Throw(NS_ERROR_OUT_OF_MEMORY);
-      return nullptr;
-    }
 
     tagName = content->NodeInfo()->QualifiedName();
 
@@ -4168,10 +4149,11 @@ nsContentUtils::CreateContextualFragment(nsINode* aContextNode,
     content = content->GetParent();
   }
 
-  nsCOMPtr<nsIDOMDocumentFragment> frag;
+  return ParseFragmentXML(aFragment,
-  aRv = ParseFragmentXML(aFragment, document, tagStack,
+                          document,
-                         aPreventScriptExecution, getter_AddRefs(frag));
+                          tagStack,
-  return static_cast<DocumentFragment*>(frag.forget().get());
+                          aPreventScriptExecution,
+                          aReturn);
 }
 
 /* static */

content/base/src/nsCopySupport.cpp

@@ -294,7 +294,7 @@ nsCopySupport::GetTransferableForNode(nsINode* aNode,
   NS_ENSURE_SUCCESS(rv, rv);
   nsCOMPtr<nsIDOMNode> node = do_QueryInterface(aNode);
   NS_ENSURE_TRUE(node, NS_ERROR_FAILURE);
-  nsRefPtr<nsRange> range = new nsRange(aNode);
+  nsRefPtr<nsRange> range = new nsRange();
   rv = range->SelectNode(node);
   NS_ENSURE_SUCCESS(rv, rv);
   rv = selection->AddRange(range);

content/base/src/nsDocument.cpp

@@ -5573,7 +5573,7 @@ nsDocument::CreateRange(nsIDOMRange** aReturn)
 already_AddRefed<nsRange>
 nsIDocument::CreateRange(ErrorResult& rv)
 {
-  nsRefPtr<nsRange> range = new nsRange(this);
+  nsRefPtr<nsRange> range = new nsRange();
   nsresult res = range->Set(this, 0, this, 0);
   if (NS_FAILED(res)) {
     rv.Throw(res);

content/base/src/nsRange.h

@@ -12,32 +12,17 @@
 
 #include "nsIDOMRange.h"
 #include "nsCOMPtr.h"
+#include "nsIDOMDocumentFragment.h"
 #include "nsINode.h"
-#include "nsIDocument.h"
 #include "nsIDOMNode.h"
 #include "prmon.h"
 #include "nsStubMutationObserver.h"
-#include "nsWrapperCache.h"
-#include "mozilla/Attributes.h"
 
-class nsClientRectList;
+class nsRange : public nsIDOMRange,
-class nsIDOMDocumentFragment;
+                public nsStubMutationObserver
-
-namespace mozilla {
-class ErrorResult;
-namespace dom {
-class DocumentFragment;
-}
-}
-
-class nsRange MOZ_FINAL : public nsIDOMRange,
-                          public nsStubMutationObserver,
-                          public nsWrapperCache
 {
-  typedef mozilla::ErrorResult ErrorResult;
-
 public:
-  nsRange(nsINode* aNode)
+  nsRange()
     : mRoot(nullptr)
     , mStartOffset(0)
     , mEndOffset(0)
@@ -51,11 +36,7 @@ public:
     , mAssertNextInsertOrAppendIndex(-1)
     , mAssertNextInsertOrAppendNode(nullptr)
 #endif
-  {
+  {}
-    SetIsDOMBinding();
-    MOZ_ASSERT(aNode, "range isn't in a document!");
-    mOwner = aNode->OwnerDoc();
-  }
   virtual ~nsRange();
 
   static nsresult CreateRange(nsIDOMNode* aStartParent, int32_t aStartOffset,
@@ -66,7 +47,7 @@ public:
                               nsIDOMRange** aRange);
 
   NS_DECL_CYCLE_COLLECTING_ISUPPORTS
-  NS_DECL_CYCLE_COLLECTION_SCRIPT_HOLDER_CLASS_AMBIGUOUS(nsRange, nsIDOMRange)
+  NS_DECL_CYCLE_COLLECTION_CLASS_AMBIGUOUS(nsRange, nsIDOMRange)
 
   // nsIDOMRange interface
   NS_DECL_NSIDOMRANGE
@@ -101,6 +82,12 @@ public:
     return mIsPositioned;
   }
 
+  bool Collapsed() const
+  {
+    return mIsPositioned && mStartParent == mEndParent &&
+           mStartOffset == mEndOffset;
+  }
+
   void SetMaySpanAnonymousSubtrees(bool aMaySpanAnonymousSubtrees)
   {
     mMaySpanAnonymousSubtrees = aMaySpanAnonymousSubtrees;
@@ -159,45 +146,6 @@ public:
   NS_DECL_NSIMUTATIONOBSERVER_PARENTCHAINCHANGED
   NS_DECL_NSIMUTATIONOBSERVER_CONTENTAPPENDED
 
-  // WebIDL
-  bool Collapsed() const
-  {
-    return mIsPositioned && mStartParent == mEndParent &&
-           mStartOffset == mEndOffset;
-  }
-  already_AddRefed<mozilla::dom::DocumentFragment>
-  CreateContextualFragment(const nsAString& aString, ErrorResult& aError);
-  already_AddRefed<mozilla::dom::DocumentFragment>
-  CloneContents(ErrorResult& aErr);
-  int16_t CompareBoundaryPoints(uint16_t aHow, nsRange& aOther,
-                                ErrorResult& aErr);
-  int16_t ComparePoint(nsINode& aParent, uint32_t aOffset, ErrorResult& aErr);
-  void DeleteContents(ErrorResult& aRv);
-  already_AddRefed<mozilla::dom::DocumentFragment>
-    ExtractContents(ErrorResult& aErr);
-  nsINode* GetCommonAncestorContainer(ErrorResult& aRv) const;
-  nsINode* GetStartContainer(ErrorResult& aRv) const;
-  uint32_t GetStartOffset(ErrorResult& aRv) const;
-  nsINode* GetEndContainer(ErrorResult& aRv) const;
-  uint32_t GetEndOffset(ErrorResult& aRv) const;
-  void InsertNode(nsINode& aNode, ErrorResult& aErr);
-  bool IntersectsNode(nsINode& aNode, ErrorResult& aRv);
-  bool IsPointInRange(nsINode& aParent, uint32_t aOffset, ErrorResult& aErr);
-  void SelectNode(nsINode& aNode, ErrorResult& aErr);
-  void SelectNodeContents(nsINode& aNode, ErrorResult& aErr);
-  void SetEnd(nsINode& aNode, uint32_t aOffset, ErrorResult& aErr);
-  void SetEndAfter(nsINode& aNode, ErrorResult& aErr);
-  void SetEndBefore(nsINode& aNode, ErrorResult& aErr);
-  void SetStart(nsINode& aNode, uint32_t aOffset, ErrorResult& aErr);
-  void SetStartAfter(nsINode& aNode, ErrorResult& aErr);
-  void SetStartBefore(nsINode& aNode, ErrorResult& aErr);
-  void SurroundContents(nsINode& aNode, ErrorResult& aErr);
-  already_AddRefed<nsIDOMClientRect> GetBoundingClientRect();
-  already_AddRefed<nsClientRectList> GetClientRects(ErrorResult& aErr);
-
-  nsINode* GetParentObject() const { return mOwner; }
-  virtual JSObject* WrapObject(JSContext* cx, JSObject* scope) MOZ_OVERRIDE MOZ_FINAL;
-
 private:
   // no copy's or assigns
   nsRange(const nsRange&);
@@ -209,7 +157,7 @@ private:
    * @param aFragment nsIDOMDocumentFragment containing the nodes.
    *                  May be null to indicate the caller doesn't want a fragment.
    */
-  nsresult CutContents(mozilla::dom::DocumentFragment** frag);
+  nsresult CutContents(nsIDOMDocumentFragment** frag);
 
   static nsresult CloneParentsBetween(nsIDOMNode *aAncestor,
                                       nsIDOMNode *aNode,
@@ -277,7 +225,6 @@ protected:
     static bool mIsNested;
   };
   
-  nsCOMPtr<nsIDocument> mOwner;
   nsCOMPtr<nsINode> mRoot;
   nsCOMPtr<nsINode> mStartParent;
   nsCOMPtr<nsINode> mEndParent;

content/events/src/nsContentEventHandler.cpp

@@ -515,7 +515,7 @@ nsContentEventHandler::OnQueryTextContent(nsQueryContentEvent* aEvent)
   NS_ASSERTION(aEvent->mReply.mString.IsEmpty(),
                "The reply string must be empty");
 
-  nsRefPtr<nsRange> range = new nsRange(mRootContent);
+  nsRefPtr<nsRange> range = new nsRange();
   rv = SetRangeFromFlatTextOffset(range, aEvent->mInput.mOffset,
                                   aEvent->mInput.mLength, false);
   NS_ENSURE_SUCCESS(rv, rv);
@@ -572,7 +572,7 @@ nsContentEventHandler::OnQueryTextRect(nsQueryContentEvent* aEvent)
   if (NS_FAILED(rv))
     return rv;
 
-  nsRefPtr<nsRange> range = new nsRange(mRootContent);
+  nsRefPtr<nsRange> range = new nsRange();
   rv = SetRangeFromFlatTextOffset(range, aEvent->mInput.mOffset,
                                   aEvent->mInput.mLength, true);
   NS_ENSURE_SUCCESS(rv, rv);
@@ -716,7 +716,7 @@ nsContentEventHandler::OnQueryCaretRect(nsQueryContentEvent* aEvent)
   }
 
   // Otherwise, we should set the guessed caret rect.
-  nsRefPtr<nsRange> range = new nsRange(mRootContent);
+  nsRefPtr<nsRange> range = new nsRange();
   rv = SetRangeFromFlatTextOffset(range, aEvent->mInput.mOffset, 0, true);
   NS_ENSURE_SUCCESS(rv, rv);
 
@@ -899,10 +899,9 @@ nsContentEventHandler::GetFlatTextOffsetOfRange(nsIContent* aRootContent,
                                                 int32_t aNodeOffset,
                                                 uint32_t* aNativeOffset)
 {
-  NS_ENSURE_STATE(aRootContent);
   NS_ASSERTION(aNativeOffset, "param is invalid");
 
-  nsRefPtr<nsRange> prev = new nsRange(aRootContent);
+  nsRefPtr<nsRange> prev = new nsRange();
   nsCOMPtr<nsIDOMNode> rootDOMNode(do_QueryInterface(aRootContent));
   prev->SetStart(rootDOMNode, 0);
 
@@ -1034,7 +1033,7 @@ nsContentEventHandler::OnSelectionEvent(nsSelectionEvent* aEvent)
   }
 
   // Get range from offset and length
-  nsRefPtr<nsRange> range = new nsRange(mRootContent);
+  nsRefPtr<nsRange> range = new nsRange();
   NS_ENSURE_TRUE(range, NS_ERROR_OUT_OF_MEMORY);
   rv = SetRangeFromFlatTextOffset(range, aEvent->mOffset, aEvent->mLength,
                                   aEvent->mExpandToClusterBoundary);

content/html/content/src/nsHTMLMediaElement.cpp

@@ -3161,7 +3161,7 @@ nsIContent* nsHTMLMediaElement::GetNextSource()
   nsresult rv = NS_OK;
   if (!mSourcePointer) {
     // First time this has been run, create a selection to cover children.
-    mSourcePointer = new nsRange(this);
+    mSourcePointer = new nsRange();
 
     rv = mSourcePointer->SelectNodeContents(thisDomNode);
     if (NS_FAILED(rv)) return nullptr;

content/html/document/src/nsHTMLDocument.cpp

@@ -2605,7 +2605,7 @@ nsHTMLDocument::DeferredContentEditableCountChange(nsIContent *aElement)
       nsCOMPtr<nsIEditor> editor;
       docshell->GetEditor(getter_AddRefs(editor));
       if (editor) {
-        nsRefPtr<nsRange> range = new nsRange(aElement);
+        nsRefPtr<nsRange> range = new nsRange();
         rv = range->SelectNode(node);
         if (NS_FAILED(rv)) {
           // The node might be detached from the document at this point,

content/test/unit/test_range.js

@@ -363,7 +363,7 @@ function run_miscellaneous_tests() {
       baseRange.setStart(null, 0);
       do_throw("Should have thrown NOT_OBJECT_ERR!");
     } catch (e) {
-      do_check_eq(e instanceof TypeError, true);
+      do_check_eq(e.name, "NS_ERROR_DOM_NOT_OBJECT_ERR");
     }
 
     // Invalid start node
@@ -371,7 +371,7 @@ function run_miscellaneous_tests() {
       baseRange.setStart({}, 0);
       do_throw("Should have thrown SecurityError!");
     } catch (e) {
-      do_check_true(e instanceof TypeError);
+      do_check_eq(e.name, "SecurityError");
     }
 
     // Invalid index

dom/bindings/Bindings.conf

@@ -572,14 +572,6 @@ DOMInterfaces = {
     'resultNotAddRefed': [ 'item' ]
 },
 
-'Range': {
-    'nativeType': 'nsRange',
-    'resultNotAddRefed': [ 'startContainer', 'endContainer', 'commonAncestorContainer' ],
-    'binaryNames': {
-        '__stringifier': 'ToString'
-    }
-},
-
 'Rect': {
     'nativeType': 'nsDOMCSSRect',
     'resultNotAddRefed': [ 'top', 'right', 'bottom', 'left' ]
@@ -1234,6 +1226,7 @@ addExternalIface('OutputStream', nativeType='nsIOutputStream',
                  notflattened=True)
 addExternalIface('Principal', nativeType='nsIPrincipal',
                  headerFile='nsIPrincipal.h', notflattened=True)
+addExternalIface('Range', nativeType='nsRange')
 addExternalIface('Selection', nativeType='nsISelection')
 addExternalIface('StyleSheet', nativeType='nsIStyleSheet')
 addExternalIface('StyleSheetList')

dom/imptests/failures/webapps/DOMCore/tests/approved/test_interfaces.html.json

@@ -75,6 +75,45 @@
   "CharacterData interface: document.createTextNode(\"abc\") must inherit property \"remove\" with the proper type (7)": true,
   "CharacterData interface: xmlDoc.createProcessingInstruction(\"abc\", \"def\") must inherit property \"remove\" with the proper type (7)": true,
   "CharacterData interface: document.createComment(\"abc\") must inherit property \"remove\" with the proper type (7)": true,
+  "Range interface: existence and properties of interface object": true,
+  "Range interface: existence and properties of interface prototype object": true,
+  "Range interface: existence and properties of interface prototype object's \"constructor\" property": true,
+  "Range interface: attribute startContainer": true,
+  "Range interface: attribute startOffset": true,
+  "Range interface: attribute endContainer": true,
+  "Range interface: attribute endOffset": true,
+  "Range interface: attribute collapsed": true,
+  "Range interface: attribute commonAncestorContainer": true,
+  "Range interface: calling setStart(Node,unsigned long) on document.createRange() with too few arguments must throw TypeError": true,
+  "Range interface: calling setEnd(Node,unsigned long) on document.createRange() with too few arguments must throw TypeError": true,
+  "Range interface: calling setStartBefore(Node) on document.createRange() with too few arguments must throw TypeError": true,
+  "Range interface: calling setStartAfter(Node) on document.createRange() with too few arguments must throw TypeError": true,
+  "Range interface: calling setEndBefore(Node) on document.createRange() with too few arguments must throw TypeError": true,
+  "Range interface: calling setEndAfter(Node) on document.createRange() with too few arguments must throw TypeError": true,
+  "Range interface: calling collapse(boolean) on document.createRange() with too few arguments must throw TypeError": true,
+  "Range interface: calling selectNode(Node) on document.createRange() with too few arguments must throw TypeError": true,
+  "Range interface: calling selectNodeContents(Node) on document.createRange() with too few arguments must throw TypeError": true,
+  "Range interface: calling compareBoundaryPoints(unsigned short,Range) on document.createRange() with too few arguments must throw TypeError": true,
+  "Range interface: calling insertNode(Node) on document.createRange() with too few arguments must throw TypeError": true,
+  "Range interface: calling surroundContents(Node) on document.createRange() with too few arguments must throw TypeError": true,
+  "Range interface: calling isPointInRange(Node,unsigned long) on document.createRange() with too few arguments must throw TypeError": true,
+  "Range interface: calling comparePoint(Node,unsigned long) on document.createRange() with too few arguments must throw TypeError": true,
+  "Range interface: calling intersectsNode(Node) on document.createRange() with too few arguments must throw TypeError": true,
+  "Range interface: calling setStart(Node,unsigned long) on detachedRange with too few arguments must throw TypeError": true,
+  "Range interface: calling setEnd(Node,unsigned long) on detachedRange with too few arguments must throw TypeError": true,
+  "Range interface: calling setStartBefore(Node) on detachedRange with too few arguments must throw TypeError": true,
+  "Range interface: calling setStartAfter(Node) on detachedRange with too few arguments must throw TypeError": true,
+  "Range interface: calling setEndBefore(Node) on detachedRange with too few arguments must throw TypeError": true,
+  "Range interface: calling setEndAfter(Node) on detachedRange with too few arguments must throw TypeError": true,
+  "Range interface: calling collapse(boolean) on detachedRange with too few arguments must throw TypeError": true,
+  "Range interface: calling selectNode(Node) on detachedRange with too few arguments must throw TypeError": true,
+  "Range interface: calling selectNodeContents(Node) on detachedRange with too few arguments must throw TypeError": true,
+  "Range interface: calling compareBoundaryPoints(unsigned short,Range) on detachedRange with too few arguments must throw TypeError": true,
+  "Range interface: calling insertNode(Node) on detachedRange with too few arguments must throw TypeError": true,
+  "Range interface: calling surroundContents(Node) on detachedRange with too few arguments must throw TypeError": true,
+  "Range interface: calling isPointInRange(Node,unsigned long) on detachedRange with too few arguments must throw TypeError": true,
+  "Range interface: calling comparePoint(Node,unsigned long) on detachedRange with too few arguments must throw TypeError": true,
+  "Range interface: calling intersectsNode(Node) on detachedRange with too few arguments must throw TypeError": true,
   "NodeFilter interface: existence and properties of interface object": true,
   "NodeFilter interface: existence and properties of interface prototype object": true,
   "NodeFilter interface: existence and properties of interface prototype object's \"constructor\" property": true,

dom/imptests/failures/webapps/DOMCore/tests/submissions/Ms2ger/Makefile.in

@@ -25,6 +25,7 @@ MOCHITEST_FILES := \
   test_Range-commonAncestorContainer.html.json \
   test_Range-comparePoint.html.json \
   test_Range-detach.html.json \
+  test_Range-intersectsNode-binding.html.json \
   test_attributes.html.json \
   test_case.html.json \
   test_historical.html.json \

dom/imptests/failures/webapps/DOMCore/tests/submissions/Ms2ger/test_Range-comparePoint.html.json

@@ -1,3 +1,4 @@
 {
-  "Range.comparePoint": true
+  "Range.comparePoint": true,
+  "Range.comparePoint 1": true
 }

dom/imptests/failures/webapps/DOMCore/tests/submissions/Ms2ger/test_Range-intersectsNode-binding.html.json

@@ -0,0 +1,3 @@
+{
+  "Calling intersectsNode without an argument or with an invalid argument should throw a TypeError.": true
+}

dom/interfaces/core/nsIDOMDocumentFragment.idl

@@ -14,7 +14,7 @@
  * http://www.w3.org/TR/DOM-Level-2-Core/
  */
 
-[scriptable, builtinclass, uuid(b098fc8f-9ef4-4de8-bbd0-4a0fc712dd6e)]
+[scriptable, uuid(b098fc8f-9ef4-4de8-bbd0-4a0fc712dd6e)]
 interface nsIDOMDocumentFragment : nsIDOMNode
 {
 };

dom/webidl/Document.webidl

@@ -17,6 +17,7 @@
 
 interface Attr;
 interface Comment;
+interface Range;
 interface StyleSheetList;
 interface Touch;
 interface TouchList;

dom/webidl/Range.webidl

@@ -4,87 +4,49 @@
  * You can obtain one at http://mozilla.org/MPL/2.0/.
  *
  * The origin of this IDL file is
- * http://dom.spec.whatwg.org/#range
+ * http://www.w3.org/TR/2012/WD-dom-20120105/
- * http://domparsing.spec.whatwg.org/#dom-range-createcontextualfragment
- * http://dvcs.w3.org/hg/csswg/raw-file/tip/cssom-view/Overview.html#extensions-to-the-range-interface
  *
  * Copyright © 2012 W3C® (MIT, ERCIM, Keio), All Rights Reserved. W3C
  * liability, trademark and document use rules apply.
  */
 
-interface ClientRect;
-
 interface Range {
-  [Throws]
   readonly attribute Node startContainer;
-  [Throws]
   readonly attribute unsigned long startOffset;
-  [Throws]
   readonly attribute Node endContainer;
-  [Throws]
   readonly attribute unsigned long endOffset;
   readonly attribute boolean collapsed;
-  [Throws]
   readonly attribute Node commonAncestorContainer;
 
-  [Throws]
   void setStart(Node refNode, unsigned long offset);
-  [Throws]
   void setEnd(Node refNode, unsigned long offset);
-  [Throws]
   void setStartBefore(Node refNode);
-  [Throws]
   void setStartAfter(Node refNode);
-  [Throws]
   void setEndBefore(Node refNode);
-  [Throws]
   void setEndAfter(Node refNode);
   void collapse(boolean toStart);
-  [Throws]
   void selectNode(Node refNode);
-  [Throws]
   void selectNodeContents(Node refNode);
 
   const unsigned short START_TO_START = 0;
   const unsigned short START_TO_END = 1;
   const unsigned short END_TO_END = 2;
   const unsigned short END_TO_START = 3;
-  [Throws]
   short compareBoundaryPoints(unsigned short how, Range sourceRange);
-  [Throws]
+
   void deleteContents();
-  [Throws]
   DocumentFragment extractContents();
-  [Throws]
   DocumentFragment cloneContents();
-  [Throws]
   void insertNode(Node node);
-  [Throws]
   void surroundContents(Node newParent);
 
   Range cloneRange();
   void detach();
 
-  [Throws]
   boolean isPointInRange(Node node, unsigned long offset);
-  [Throws]
   short comparePoint(Node node, unsigned long offset);
 
-  [Throws]
   boolean intersectsNode(Node node);
 
   stringifier;
 };
-
-// http://domparsing.spec.whatwg.org/#dom-range-createcontextualfragment
-partial interface Range {
-  [Throws]
-  DocumentFragment createContextualFragment(DOMString fragment);
-};
-
-// http://dvcs.w3.org/hg/csswg/raw-file/tip/cssom-view/Overview.html#extensions-to-the-range-interface
-partial interface Range {
-  [Throws]
-  ClientRectList getClientRects();
-  ClientRect getBoundingClientRect();
-};

dom/webidl/WebIDL.mk

@@ -133,7 +133,6 @@ webidl_files = \
   PerformanceNavigation.webidl \
   PerformanceTiming.webidl \
   ProcessingInstruction.webidl \
-  Range.webidl \
   Rect.webidl \
   RGBColor.webidl \
   RTCConfiguration.webidl \

editor/libeditor/base/IMETextTxn.cpp

@@ -314,13 +314,8 @@ NS_IMETHODIMP IMETextTxn::CollapseTextSelection(void)
              if(NS_FAILED(result))
                 break;
 
-             nsCOMPtr<nsIContent> content = do_QueryInterface(mElement);
+             nsRefPtr<nsRange> newRange = new nsRange();
-             if (!content) {
+             result = newRange->SetStart(mElement,mOffset+selectionStart);
-               break;
-          }
-
-             nsRefPtr<nsRange> newRange = new nsRange(content);
-             result = newRange->SetStart(content, mOffset+selectionStart);
              NS_ASSERTION(NS_SUCCEEDED(result), "Cannot SetStart");
              if(NS_FAILED(result))
                 break;

editor/libeditor/html/nsHTMLEditRules.cpp

@@ -247,26 +247,20 @@ nsHTMLEditRules::Init(nsPlaintextEditor *aEditor)
   mReturnInEmptyLIKillsList = !returnInEmptyLIKillsList.EqualsLiteral("false");
 
   // make a utility range for use by the listenter
-  nsCOMPtr<nsINode> node = mHTMLEditor->GetRoot();
+  mUtilRange = new nsRange();
-  if (!node) {
-    node = mHTMLEditor->GetDocument();
-  }
-
-  NS_ENSURE_STATE(node);
-
-  mUtilRange = new nsRange(node);
    
   // set up mDocChangeRange to be whole doc
+  nsCOMPtr<nsIDOMElement> rootElem = do_QueryInterface(mHTMLEditor->GetRoot());
+  if (rootElem)
+  {
     // temporarily turn off rules sniffing
     nsAutoLockRulesSniffing lockIt((nsTextEditRules*)this);
-  if (!mDocChangeRange) {
+    if (!mDocChangeRange)
-    mDocChangeRange = new nsRange(node);
+    {
+      mDocChangeRange = new nsRange();
     }
-
+    mDocChangeRange->SelectNode(rootElem);
-  if (node->IsElement()) {
+    res = AdjustSpecialBreaks();
-    ErrorResult rv;
-    mDocChangeRange->SelectNode(*node, rv);
-    res = AdjustSpecialBreaks(node);
     NS_ENSURE_SUCCESS(res, res);
   }
 
@@ -1446,9 +1440,7 @@ nsHTMLEditRules::WillInsertText(EditAction aAction,
     // the correct portion of the document.
     if (!mDocChangeRange)
     {
-      nsCOMPtr<nsINode> node = do_QueryInterface(selNode);
+      mDocChangeRange = new nsRange();
-      NS_ENSURE_STATE(node);
-      mDocChangeRange = new nsRange(node);
     }
     res = mDocChangeRange->SetStart(selNode, selOffset);
     NS_ENSURE_SUCCESS(res, res);
@@ -5077,9 +5069,7 @@ nsHTMLEditRules::ExpandSelectionForDeletion(nsISelection *aSelection)
     bool nodeBefore=false, nodeAfter=false;
     
     // create a range that represents expanded selection
-    nsCOMPtr<nsINode> node = do_QueryInterface(selStartNode);
+    nsRefPtr<nsRange> range = new nsRange();
-    NS_ENSURE_STATE(node);
-    nsRefPtr<nsRange> range = new nsRange(node);
     res = range->SetStart(selStartNode, selStartOffset);
     NS_ENSURE_SUCCESS(res, res);
     res = range->SetEnd(selEndNode, selEndOffset);
@@ -6126,9 +6116,7 @@ nsHTMLEditRules::GetNodesFromPoint(DOMPoint point,
   point.GetPoint(node, offset);
   
   // use it to make a range
-  nsCOMPtr<nsINode> nativeNode = do_QueryInterface(node);
+  nsRefPtr<nsRange> range = new nsRange();
-  NS_ENSURE_STATE(nativeNode);
-  nsRefPtr<nsRange> range = new nsRange(nativeNode);
   res = range->SetStart(node, offset);
   NS_ENSURE_SUCCESS(res, res);
   /* SetStart() will also set the end for this new range
@@ -7308,9 +7296,7 @@ nsHTMLEditRules::PinSelectionToNewBlock(nsISelection *aSelection)
   temp = selNode;
   
   // use ranges and sRangeHelper to compare sel point to new block
-  nsCOMPtr<nsINode> node = do_QueryInterface(selNode);
+  nsRefPtr<nsRange> range = new nsRange();
-  NS_ENSURE_STATE(node);
-  nsRefPtr<nsRange> range = new nsRange(node);
   res = range->SetStart(selNode, selOffset);
   NS_ENSURE_SUCCESS(res, res);
   res = range->SetEnd(selNode, selOffset);

editor/libeditor/html/nsHTMLEditor.cpp

@@ -3253,7 +3253,7 @@ nsHTMLEditor::ContentInserted(nsIDocument *aDocument, nsIContent* aContainer,
 
     // Update spellcheck for only the newly-inserted node (bug 743819)
     if (mInlineSpellChecker) {
-      nsRefPtr<nsRange> range = new nsRange(aChild);
+      nsRefPtr<nsRange> range = new nsRange();
       nsresult res = range->Set(aContainer, aIndexInContainer,
                                 aContainer, aIndexInContainer + 1);
       if (NS_SUCCEEDED(res)) {

editor/libeditor/html/nsWSRunObject.cpp

@@ -1484,10 +1484,8 @@ nsWSRunObject::DeleteChars(nsIDOMNode *aStartNode, int32_t aStartOffset,
     {
       if (!range)
       {
-        nsCOMPtr<nsINode> startNode = do_QueryInterface(aStartNode);
+        range = new nsRange();
-        NS_ENSURE_STATE(startNode);
+        res = range->SetStart(aStartNode, aStartOffset);
-        range = new nsRange(startNode);
-        res = range->SetStart(startNode, aStartOffset);
         NS_ENSURE_SUCCESS(res, res);
         res = range->SetEnd(aEndNode, aEndOffset);
         NS_ENSURE_SUCCESS(res, res);

editor/libeditor/html/tests/test_bug629845.html

@@ -26,12 +26,10 @@ function command(aName)
 {
   var frame = document.getElementsByTagName('iframe')[0];
 
-  is(frame.contentDocument.designMode, "on", "design mode should be on!");
   var caught = false;
   try {
     frame.contentDocument.execCommand(aName, false, null);
   } catch (e) {
-    ok(false, "exception " + e + " was thrown");
     caught = true;
   }
 

editor/txtsvc/src/nsFilteredContentIterator.cpp

@@ -57,14 +57,13 @@ NS_IMPL_CYCLE_COLLECTION_5(nsFilteredContentIterator,
 nsresult
 nsFilteredContentIterator::Init(nsINode* aRoot)
 {
-  NS_ENSURE_ARG_POINTER(aRoot);
   NS_ENSURE_TRUE(mPreIterator, NS_ERROR_FAILURE);
   NS_ENSURE_TRUE(mIterator, NS_ERROR_FAILURE);
   mIsOutOfRange    = false;
   mDirection       = eForward;
   mCurrentIterator = mPreIterator;
 
-  mRange = new nsRange(aRoot);
+  mRange = new nsRange();
   nsCOMPtr<nsIDOMNode> domNode(do_QueryInterface(aRoot));
   if (domNode) {
     mRange->SelectNode(domNode);

editor/txtsvc/src/nsTextServicesDocument.cpp

@@ -2070,10 +2070,7 @@ nsTextServicesDocument::CreateDocumentContentRange(nsIDOMRange **aRange)
   NS_ENSURE_SUCCESS(rv, rv);
   NS_ENSURE_TRUE(node, NS_ERROR_NULL_POINTER);
 
-  nsCOMPtr<nsINode> nativeNode = do_QueryInterface(node);
+  nsRefPtr<nsRange> range = new nsRange();
-  NS_ENSURE_STATE(nativeNode);
-
-  nsRefPtr<nsRange> range = new nsRange(nativeNode);
 
   rv = range->SelectNodeContents(node);
   NS_ENSURE_SUCCESS(rv, rv);

embedding/components/find/src/nsFind.cpp

@@ -147,8 +147,6 @@ nsresult
 nsFindContentIterator::Init(nsIDOMNode* aStartNode, int32_t aStartOffset,
                             nsIDOMNode* aEndNode, int32_t aEndOffset)
 {
-  NS_ENSURE_ARG_POINTER(aStartNode);
-  NS_ENSURE_ARG_POINTER(aEndNode);
   if (!mOuterIterator) {
     if (mFindBackward) {
       // Use post-order in the reverse case, so we get parents
@@ -276,10 +274,7 @@ nsFindContentIterator::Reset()
   // Note: OK to just set up the outer iterator here; if our range has a native
   // anonymous endpoint we'll end up setting up an inner iterator, and
   // reset the outer one in the process.
-  nsCOMPtr<nsINode> node = do_QueryInterface(mStartNode);
+  nsCOMPtr<nsIDOMRange> range = nsFind::CreateRange();
-  NS_ENSURE_TRUE_VOID(node);
-
-  nsCOMPtr<nsIDOMRange> range = nsFind::CreateRange(node);
   range->SetStart(mStartNode, mStartOffset);
   range->SetEnd(mEndNode, mEndOffset);
   mOuterIterator->Init(range);
@@ -371,9 +366,10 @@ nsFindContentIterator::SetupInnerIterator(nsIContent* aContent)
 
   nsCOMPtr<nsIDOMElement> rootElement;
   editor->GetRootElement(getter_AddRefs(rootElement));
+  nsCOMPtr<nsIContent> rootContent(do_QueryInterface(rootElement));
 
-  nsCOMPtr<nsIDOMRange> innerRange = nsFind::CreateRange(aContent);
+  nsCOMPtr<nsIDOMRange> innerRange = nsFind::CreateRange();
-  nsCOMPtr<nsIDOMRange> outerRange = nsFind::CreateRange(aContent);
+  nsCOMPtr<nsIDOMRange> outerRange = nsFind::CreateRange();
   if (!innerRange || !outerRange) {
     return;
   }
@@ -1145,7 +1141,7 @@ nsFind::Find(const PRUnichar *aPatText, nsIDOMRange* aSearchRange,
         // Make the range:
         nsCOMPtr<nsIDOMNode> startParent;
         nsCOMPtr<nsIDOMNode> endParent;
-        nsCOMPtr<nsIDOMRange> range = CreateRange(tc);
+        nsCOMPtr<nsIDOMRange> range = CreateRange();
         if (range)
         {
           int32_t matchStartOffset, matchEndOffset;
@@ -1259,9 +1255,9 @@ nsFind::Find(const PRUnichar *aPatText, nsIDOMRange* aSearchRange,
 
 /* static */
 already_AddRefed<nsIDOMRange>
-nsFind::CreateRange(nsINode* aNode)
+nsFind::CreateRange()
 {
-  nsRefPtr<nsRange> range = new nsRange(aNode);
+  nsRefPtr<nsRange> range = new nsRange();
   range->SetMaySpanAnonymousSubtrees(true);
   return range.forget();
 }

embedding/components/find/src/nsFind.h

@@ -35,7 +35,7 @@ public:
   nsFind();
   virtual ~nsFind();
 
-  static already_AddRefed<nsIDOMRange> CreateRange(nsINode* aNode);
+  static already_AddRefed<nsIDOMRange> CreateRange();
 
 protected:
   // Parameters set from the interface:

embedding/components/find/src/nsWebBrowserFind.cpp

@@ -727,11 +727,11 @@ nsresult nsWebBrowserFind::SearchInFrame(nsIDOMWindow* aWindow,
     GetFrameSelection(aWindow, getter_AddRefs(sel));
     NS_ENSURE_ARG_POINTER(sel);
 
-    nsCOMPtr<nsIDOMRange> searchRange = nsFind::CreateRange(theDoc);
+    nsCOMPtr<nsIDOMRange> searchRange = nsFind::CreateRange();
     NS_ENSURE_ARG_POINTER(searchRange);
-    nsCOMPtr<nsIDOMRange> startPt  = nsFind::CreateRange(theDoc);
+    nsCOMPtr<nsIDOMRange> startPt  = nsFind::CreateRange();
     NS_ENSURE_ARG_POINTER(startPt);
-    nsCOMPtr<nsIDOMRange> endPt  = nsFind::CreateRange(theDoc);
+    nsCOMPtr<nsIDOMRange> endPt  = nsFind::CreateRange();
     NS_ENSURE_ARG_POINTER(endPt);
 
     nsCOMPtr<nsIDOMRange> foundRange;

extensions/spellcheck/src/mozInlineSpellChecker.cpp

@@ -132,10 +132,7 @@ mozInlineSpellStatus::InitForEditorChange(
   mOp = eOpChange;
 
   // range to check
-  nsCOMPtr<nsINode> prevNode = do_QueryInterface(aPreviousNode);
+  mRange = new nsRange();
-  NS_ENSURE_STATE(prevNode);
-
-  mRange = new nsRange(prevNode);
 
   // ...we need to put the start and end in the correct order
   int16_t cmpResult;

extensions/spellcheck/src/mozInlineSpellWordUtil.cpp

@@ -317,11 +317,10 @@ nsresult
 mozInlineSpellWordUtil::MakeRange(NodeOffset aBegin, NodeOffset aEnd,
                                   nsRange** aRange)
 {
-  NS_ENSURE_ARG_POINTER(aBegin.mNode);
   if (!mDOMDocument)
     return NS_ERROR_NOT_INITIALIZED;
 
-  nsRefPtr<nsRange> range = new nsRange(aBegin.mNode);
+  nsRefPtr<nsRange> range = new nsRange();
   nsresult rv = range->Set(aBegin.mNode, aBegin.mOffset,
                            aEnd.mNode, aEnd.mOffset);
   NS_ENSURE_SUCCESS(rv, rv);

layout/base/nsPresShell.cpp

@@ -2914,7 +2914,7 @@ PresShell::GoToAnchor(const nsAString& aAnchorName, bool aScroll)
     // Even if select anchor pref is false, we must still move the
     // caret there. That way tabbing will start from the new
     // location
-    nsRefPtr<nsIDOMRange> jumpToRange = new nsRange(mDocument);
+    nsRefPtr<nsIDOMRange> jumpToRange = new nsRange();
     while (content && content->GetFirstChild()) {
       content = content->GetFirstChild();
     }
@@ -4816,7 +4816,7 @@ PresShell::RenderNode(nsIDOMNode* aNode,
   if (!node->IsInDoc())
     return nullptr;
   
-  nsRefPtr<nsRange> range = new nsRange(node);
+  nsRefPtr<nsRange> range = new nsRange();
   if (NS_FAILED(range->SelectNode(aNode)))
     return nullptr;
 

layout/forms/nsTextControlFrame.cpp

@@ -778,7 +778,7 @@ nsTextControlFrame::SetSelectionInternal(nsIDOMNode *aStartNode,
   // Note that we use a new range to avoid having to do
   // isIncreasing checks to avoid possible errors.
 
-  nsRefPtr<nsRange> range = new nsRange(mContent);
+  nsRefPtr<nsRange> range = new nsRange();
   nsresult rv = range->SetStart(aStartNode, aStartOffset);
   NS_ENSURE_SUCCESS(rv, rv);
 

layout/generic/nsSelection.cpp

@@ -1466,7 +1466,7 @@ nsFrameSelection::TakeFocus(nsIContent *aNewFocus,
       // non-anchor/focus collapsed ranges.
       mDomSelections[index]->RemoveCollapsedRanges();
 
-      nsRefPtr<nsRange> newRange = new nsRange(aNewFocus);
+      nsRefPtr<nsRange> newRange = new nsRange();
 
       newRange->SetStart(aNewFocus, aContentOffset);
       newRange->SetEnd(aNewFocus, aContentOffset);
@@ -2866,7 +2866,7 @@ nsFrameSelection::CreateAndAddRange(nsINode *aParentNode, int32_t aOffset)
 {
   if (!aParentNode) return NS_ERROR_NULL_POINTER;
 
-  nsRefPtr<nsRange> range = new nsRange(aParentNode);
+  nsRefPtr<nsRange> range = new nsRange();
 
   // Set range around child at given offset
   nsresult result = range->SetStart(aParentNode, aOffset);
@@ -3276,7 +3276,7 @@ Selection::SubtractRange(RangeData* aRange, nsRange* aSubtract,
   if (cmp2 > 0) {
     // We need to add a new RangeData to the output, running from
     // the end of aSubtract to the end of range
-    nsRefPtr<nsRange> postOverlap = new nsRange(aSubtract->GetEndParent());
+    nsRefPtr<nsRange> postOverlap = new nsRange();
 
     rv =
       postOverlap->SetStart(aSubtract->GetEndParent(), aSubtract->EndOffset());
@@ -3294,7 +3294,7 @@ Selection::SubtractRange(RangeData* aRange, nsRange* aSubtract,
   if (cmp < 0) {
     // We need to add a new RangeData to the output, running from
     // the start of the range to the start of aSubtract
-    nsRefPtr<nsRange> preOverlap = new nsRange(range->GetStartParent());
+    nsRefPtr<nsRange> preOverlap = new nsRange();
 
     nsresult rv =
      preOverlap->SetStart(range->GetStartParent(), range->StartOffset());
@@ -4398,7 +4398,7 @@ Selection::Collapse(nsINode* aParentNode, int32_t aOffset)
   // Turn off signal for table selection
   mFrameSelection->ClearTableCellSelection();
 
-  nsRefPtr<nsRange> range = new nsRange(aParentNode);
+  nsRefPtr<nsRange> range = new nsRange();
   result = range->SetEnd(aParentNode, aOffset);
   if (NS_FAILED(result))
     return result;
@@ -4654,7 +4654,7 @@ Selection::Extend(nsINode* aParentNode, int32_t aOffset)
                                                   &disconnected);
 
   nsRefPtr<nsPresContext>  presContext = GetPresContext();
-  nsRefPtr<nsRange> difRange = new nsRange(aParentNode);
+  nsRefPtr<nsRange> difRange = new nsRange();
   if ((result1 == 0 && result3 < 0) || (result1 <= 0 && result2 < 0)){//a1,2  a,1,2
     //select from 1 to 2 unless they are collapsed
     res = range->SetEnd(aParentNode, aOffset);

layout/printing/nsPrintEngine.cpp

@@ -2430,11 +2430,8 @@ CloneRangeToSelection(nsRange* aRange, nsIDocument* aDoc,
   nsCOMPtr<nsIDOMNode> newEnd = GetEqualNodeInCloneTree(endContainer, aDoc);
   NS_ENSURE_TRUE_VOID(newStart && newEnd);
 
-  nsCOMPtr<nsINode> newStartNode = do_QueryInterface(newStart);
+  nsRefPtr<nsRange> range = new nsRange();
-  NS_ENSURE_TRUE_VOID(newStartNode);
+  nsresult rv = range->SetStart(newStart, startOffset);
-
-  nsRefPtr<nsRange> range = new nsRange(newStartNode);
-  nsresult rv = range->SetStart(newStartNode, startOffset);
   NS_ENSURE_SUCCESS_VOID(rv);
   rv = range->SetEnd(newEnd, endOffset);
   NS_ENSURE_SUCCESS_VOID(rv);

toolkit/components/typeaheadfind/nsTypeAheadFind.cpp

@@ -94,12 +94,9 @@ nsresult
 nsTypeAheadFind::Init(nsIDocShell* aDocShell)
 {
   nsCOMPtr<nsIPrefBranch> prefInternal(do_GetService(NS_PREFSERVICE_CONTRACTID));
-  nsIPresShell* presShell = aDocShell->GetPresShell();
+  mSearchRange = new nsRange();
-  NS_ENSURE_STATE(presShell);
+  mStartPointRange = new nsRange();
-
+  mEndPointRange = new nsRange();
-  mSearchRange = nullptr;
-  mStartPointRange = nullptr;
-  mEndPointRange = nullptr;
   if (!prefInternal || !EnsureFind())
     return NS_ERROR_FAILURE;
 
@@ -172,9 +169,9 @@ nsTypeAheadFind::SetDocShell(nsIDocShell* aDocShell)
   mPresShell = do_GetWeakReference(presShell);      
 
   mStartFindRange = nullptr;
-  mStartPointRange = nullptr;
+  mStartPointRange = new nsRange();
-  mSearchRange = nullptr;
+  mSearchRange = new nsRange();
-  mEndPointRange = nullptr;
+  mEndPointRange = new nsRange();
 
   mFoundLink = nullptr;
   mFoundEditable = nullptr;
@@ -364,10 +361,6 @@ nsTypeAheadFind::FindItNow(nsIPresShell *aPresShell, bool aIsLinksOnly,
   }
 
   int16_t rangeCompareResult = 0;
-  if (!mStartPointRange) {
-    mStartPointRange = new nsRange(presShell->GetDocument());
-  }
-
   mStartPointRange->CompareBoundaryPoints(nsIDOMRange::START_TO_START, mSearchRange, &rangeCompareResult);
   // No need to wrap find in doc if starting at beginning
   bool hasWrapped = (rangeCompareResult < 0);
@@ -628,10 +621,6 @@ nsTypeAheadFind::FindItNow(nsIPresShell *aPresShell, bool aIsLinksOnly,
         // at end of document and go to beginning
         nsCOMPtr<nsIDOMRange> tempRange;
         mStartPointRange->CloneRange(getter_AddRefs(tempRange));
-        if (!mEndPointRange) {
-          mEndPointRange = new nsRange(presShell->GetDocument());
-        }
-
         mStartPointRange = mEndPointRange;
         mEndPointRange = tempRange;
       }
@@ -730,14 +719,6 @@ nsTypeAheadFind::GetSearchContainers(nsISupports *aContainer,
 
   uint32_t childCount = rootContent->GetChildCount();
 
-  if (!mSearchRange) {
-    mSearchRange = new nsRange(rootContent);
-  }
-
-  if (!mEndPointRange) {
-    mEndPointRange = new nsRange(rootContent);
-  }
-
   mSearchRange->SelectNodeContents(rootNode);
 
   mEndPointRange->SetEnd(rootNode, childCount);
@@ -755,10 +736,6 @@ nsTypeAheadFind::GetSearchContainers(nsISupports *aContainer,
       selection->GetRangeAt(0, getter_AddRefs(currentSelectionRange));
   }
 
-  if (!mStartPointRange) {
-    mStartPointRange = new nsRange(doc);
-  }
-
   if (!currentSelectionRange) {
     // Ensure visible range, move forward if necessary
     // This uses ignores the return value, but usese the side effect of