Bug 1599971 - part 3: Mark nsITextControlFrame::SetSelectionRange() as MOZ_CAN_RUN_SCRIPT r=m_kato

Similar to the previous patch, it may notify selection listeners of native
anonymous tree in `<input>` and `<textarea>` element.

Differential Revision: https://phabricator.services.mozilla.com/D55774

dom/html/TextControlState.cpp

@@ -153,7 +153,7 @@ class RestoreSelectionState : public Runnable {
         mFrame(aFrame),
         mTextControlState(aState) {}
 
-  NS_IMETHOD Run() override {
+  MOZ_CAN_RUN_SCRIPT_BOUNDARY NS_IMETHOD Run() override {
     if (!mTextControlState) {
       return NS_OK;
     }
@@ -1989,6 +1989,7 @@ void TextControlState::SetSelectionProperties(
   if (mBoundFrame) {
     mBoundFrame->SetSelectionRange(aProps.GetStart(), aProps.GetEnd(),
                                    aProps.GetDirection());
+    // The instance may have already been deleted here.
   } else {
     mSelectionProperties = aProps;
   }