--- a/editor/libeditor/DeleteRangeTransaction.cpp
+++ b/editor/libeditor/DeleteRangeTransaction.cpp
@@ -19,23 +19,20 @@
 #include "nsIContentIterator.h"
 #include "nsINode.h"
 #include "nsAString.h"
 
 namespace mozilla {
 
 using namespace dom;
 
-// note that aEditorBase is not refcounted
 DeleteRangeTransaction::DeleteRangeTransaction(EditorBase& aEditorBase,
-                                               nsRange& aRangeToDelete,
-                                               RangeUpdater* aRangeUpdater)
+                                               nsRange& aRangeToDelete)
   : mEditorBase(&aEditorBase)
   , mRangeToDelete(aRangeToDelete.CloneRange())
-  , mRangeUpdater(aRangeUpdater)
 {
 }
 
 NS_IMPL_CYCLE_COLLECTION_INHERITED(DeleteRangeTransaction,
                                    EditAggregateTransaction,
                                    mEditorBase,
                                    mRangeToDelete)
 

--- a/editor/libeditor/DeleteRangeTransaction.h
+++ b/editor/libeditor/DeleteRangeTransaction.h
@@ -22,39 +22,44 @@ namespace mozilla {
 class EditorBase;
 class RangeUpdater;
 
 /**
  * A transaction that deletes an entire range in the content tree
  */
 class DeleteRangeTransaction final : public EditAggregateTransaction
 {
+protected:
+  DeleteRangeTransaction(EditorBase& aEditorBase,
+                         nsRange& aRangeToDelete);
+
 public:
   /**
+   * Creates a delete range transaction.  This never returns nullptr.
+   *
    * @param aEditorBase         The object providing basic editing operations.
    * @param aRangeToDelete      The range to delete.
    */
-  DeleteRangeTransaction(EditorBase& aEditorBase,
-                         nsRange& aRangeToDelete,
-                         RangeUpdater* aRangeUpdater);
+  static already_AddRefed<DeleteRangeTransaction>
+  Create(EditorBase& aEditorBase,
+         nsRange& aRangeToDelete)
+  {
+    RefPtr<DeleteRangeTransaction> transaction =
+      new DeleteRangeTransaction(aEditorBase, aRangeToDelete);
+    return transaction.forget();
+  }
 
   NS_DECL_CYCLE_COLLECTION_CLASS_INHERITED(DeleteRangeTransaction,
                                            EditAggregateTransaction)
   NS_IMETHOD QueryInterface(REFNSIID aIID, void** aInstancePtr) override;
 
   NS_DECL_EDITTRANSACTIONBASE
 
   NS_IMETHOD RedoTransaction() override;
 
-  virtual void LastRelease() override
-  {
-    mRangeToDelete = nullptr;
-    EditAggregateTransaction::LastRelease();
-  }
-
 protected:
   /**
    * CreateTxnsToDeleteBetween() creates a DeleteTextTransaction or some
    * DeleteNodeTransactions to remove text or nodes between aStart and aEnd
    * and appends the created transactions to the array.
    *
    * @param aStart      Must be set and valid point.
    * @param aEnd        Must be set and valid point.  Additionally, the
@@ -101,16 +106,13 @@ protected:
                                      nsIEditor::EDirection aAction);
 
   // The editor for this transaction.
   RefPtr<EditorBase> mEditorBase;
 
   // P1 in the range.  This is only non-null until DoTransaction is called and
   // we convert it into child transactions.
   RefPtr<nsRange> mRangeToDelete;
-
-  // Range updater object.
-  RangeUpdater* mRangeUpdater;
 };
 
 } // namespace mozilla
 
 #endif // #ifndef DeleteRangeTransaction_h

--- a/editor/libeditor/EditAggregateTransaction.h
+++ b/editor/libeditor/EditAggregateTransaction.h
@@ -19,18 +19,29 @@ class nsITransaction;
 namespace mozilla {
 
 /**
  * base class for all document editing transactions that require aggregation.
  * provides a list of child transactions.
  */
 class EditAggregateTransaction : public EditTransactionBase
 {
+protected:
+  EditAggregateTransaction();
+
 public:
-  EditAggregateTransaction();
+  /**
+   * Creates an edit aggregate transaction.  This never returns nullptr.
+   */
+  static already_AddRefed<EditAggregateTransaction> Create()
+  {
+    RefPtr<EditAggregateTransaction> transaction =
+      new EditAggregateTransaction();
+    return transaction.forget();
+  }
 
   NS_DECL_ISUPPORTS_INHERITED
   NS_DECL_CYCLE_COLLECTION_CLASS_INHERITED(EditAggregateTransaction,
                                            EditTransactionBase)
 
   NS_DECL_EDITTRANSACTIONBASE
 
   NS_IMETHOD RedoTransaction() override;

--- a/editor/libeditor/EditTransactionBase.cpp
+++ b/editor/libeditor/EditTransactionBase.cpp
@@ -18,18 +18,17 @@ NS_IMPL_CYCLE_COLLECTION_TRAVERSE_END
 
 NS_INTERFACE_MAP_BEGIN_CYCLE_COLLECTION(EditTransactionBase)
   NS_INTERFACE_MAP_ENTRY(nsITransaction)
   NS_INTERFACE_MAP_ENTRY(nsPIEditorTransaction)
   NS_INTERFACE_MAP_ENTRY_AMBIGUOUS(nsISupports, nsITransaction)
 NS_INTERFACE_MAP_END
 
 NS_IMPL_CYCLE_COLLECTING_ADDREF(EditTransactionBase)
-NS_IMPL_CYCLE_COLLECTING_RELEASE_WITH_LAST_RELEASE(EditTransactionBase,
-                                                   LastRelease())
+NS_IMPL_CYCLE_COLLECTING_RELEASE(EditTransactionBase)
 
 EditTransactionBase::~EditTransactionBase()
 {
 }
 
 NS_IMETHODIMP
 EditTransactionBase::RedoTransaction()
 {

--- a/editor/libeditor/EditTransactionBase.h
+++ b/editor/libeditor/EditTransactionBase.h
@@ -19,18 +19,16 @@ namespace mozilla {
  */
 class EditTransactionBase : public nsITransaction
                           , public nsPIEditorTransaction
 {
 public:
   NS_DECL_CYCLE_COLLECTING_ISUPPORTS
   NS_DECL_CYCLE_COLLECTION_CLASS_AMBIGUOUS(EditTransactionBase, nsITransaction)
 
-  virtual void LastRelease() {}
-
   NS_IMETHOD RedoTransaction(void) override;
   NS_IMETHOD GetIsTransient(bool* aIsTransient) override;
   NS_IMETHOD Merge(nsITransaction* aTransaction, bool* aDidMerge) override;
 
 protected:
   virtual ~EditTransactionBase();
 };
 

--- a/editor/libeditor/EditorBase.cpp
+++ b/editor/libeditor/EditorBase.cpp
@@ -698,17 +698,17 @@ EditorBase::DoTransaction(nsITransaction
   return DoTransaction(nullptr, aTxn);
 }
 
 nsresult
 EditorBase::DoTransaction(Selection* aSelection, nsITransaction* aTxn)
 {
   if (mPlaceholderBatch && !mPlaceholderTransaction) {
     mPlaceholderTransaction =
-      new PlaceholderTransaction(*this, mPlaceholderName, Move(mSelState));
+      PlaceholderTransaction::Create(*this, mPlaceholderName, Move(mSelState));
     MOZ_ASSERT(mSelState.isNothing());
 
     // We will recurse, but will not hit this case in the nested call
     DoTransaction(mPlaceholderTransaction);
 
     if (mTxnMgr) {
       nsCOMPtr<nsITransaction> topTransaction = mTxnMgr->PeekUndoStack();
       nsCOMPtr<nsIAbsorbingTransaction> topAbsorbingTransaction =
@@ -4602,29 +4602,29 @@ EditorBase::CreateTxnForDeleteSelection(
 
   // Check whether the selection is collapsed and we should do nothing:
   if (NS_WARN_IF(selection->Collapsed() && aAction == eNone)) {
     return nullptr;
   }
 
   // allocate the out-param transaction
   RefPtr<EditAggregateTransaction> aggregateTransaction =
-    new EditAggregateTransaction();
+    EditAggregateTransaction::Create();
 
   for (uint32_t rangeIdx = 0; rangeIdx < selection->RangeCount(); ++rangeIdx) {
     RefPtr<nsRange> range = selection->GetRangeAt(rangeIdx);
     if (NS_WARN_IF(!range)) {
       return nullptr;
     }
 
     // Same with range as with selection; if it is collapsed and action
     // is eNone, do nothing.
     if (!range->Collapsed()) {
       RefPtr<DeleteRangeTransaction> deleteRangeTransaction =
-        new DeleteRangeTransaction(*this, *range, &mRangeUpdater);
+        DeleteRangeTransaction::Create(*this, *range);
       // XXX Oh, not checking if deleteRangeTransaction can modify the range...
       aggregateTransaction->AppendChild(deleteRangeTransaction);
     } else if (aAction != eNone) {
       // we have an insertion point.  delete the thing in front of it or
       // behind it, depending on aAction
       // XXX Odd, when there are two or more ranges, this returns the last
       //     range information with aRemovingNode, aOffset and aLength.
       RefPtr<EditTransactionBase> deleteRangeTransaction =

--- a/editor/libeditor/PlaceholderTransaction.cpp
+++ b/editor/libeditor/PlaceholderTransaction.cpp
@@ -15,26 +15,23 @@
 namespace mozilla {
 
 using namespace dom;
 
 PlaceholderTransaction::PlaceholderTransaction(
                           EditorBase& aEditorBase,
                           nsAtom* aName,
                           Maybe<SelectionState>&& aSelState)
-  : mAbsorb(true)
+  : mEditorBase(&aEditorBase)
   , mForwarding(nullptr)
   , mCompositionTransaction(nullptr)
+  , mStartSel(*Move(aSelState))
+  , mAbsorb(true)
   , mCommitted(false)
-  , mEditorBase(&aEditorBase)
 {
-  // Make sure to move aSelState into a local variable to null out the original
-  // Maybe<SelectionState> variable.
-  Maybe<SelectionState> selState(Move(aSelState));
-  mStartSel = *selState;
   mName = aName;
 }
 
 PlaceholderTransaction::~PlaceholderTransaction()
 {
 }
 
 NS_IMPL_CYCLE_COLLECTION_CLASS(PlaceholderTransaction)

--- a/editor/libeditor/PlaceholderTransaction.h
+++ b/editor/libeditor/PlaceholderTransaction.h
@@ -24,21 +24,43 @@ class CompositionTransaction;
  * But it absorbs other transactions via merge, and can undo/redo the
  * transactions it has absorbed.
  */
 
 class PlaceholderTransaction final
  : public EditAggregateTransaction
  , public nsIAbsorbingTransaction
 {
-public:
-  NS_DECL_ISUPPORTS_INHERITED
+protected:
+  PlaceholderTransaction(EditorBase& aEditorBase,
+                         nsAtom* aName,
+                         Maybe<SelectionState>&& aSelState);
 
-  PlaceholderTransaction(EditorBase& aEditorBase, nsAtom* aName,
-                         Maybe<SelectionState>&& aSelState);
+public:
+  /**
+   * Creates a placeholder transaction.  This never returns nullptr.
+   *
+   * @param aEditorBase     The editor.
+   * @param aName           The name of creating transaction.
+   * @param aSelState       The selection state of aEditorBase.
+   */
+  static already_AddRefed<PlaceholderTransaction>
+  Create(EditorBase& aEditorBase,
+         nsAtom* aName,
+         Maybe<SelectionState>&& aSelState)
+  {
+    // Make sure to move aSelState into a local variable to null out the original
+    // Maybe<SelectionState> variable.
+    Maybe<SelectionState> selState(Move(aSelState));
+    RefPtr<PlaceholderTransaction> transaction =
+      new PlaceholderTransaction(aEditorBase, aName, Move(selState));
+    return transaction.forget();
+  }
+
+  NS_DECL_ISUPPORTS_INHERITED
 
   NS_DECL_CYCLE_COLLECTION_CLASS_INHERITED(PlaceholderTransaction,
                                            EditAggregateTransaction)
 // ------------ EditAggregateTransaction -----------------------
 
   NS_DECL_EDITTRANSACTIONBASE
 
   NS_IMETHOD RedoTransaction() override;
@@ -63,31 +85,32 @@ public:
     return this;
   }
 
   nsresult RememberEndingSelection();
 
 protected:
   virtual ~PlaceholderTransaction();
 
-  // Do we auto absorb any and all transaction?
-  bool mAbsorb;
+  // The editor for this transaction.
+  RefPtr<EditorBase> mEditorBase;
+
   nsWeakPtr mForwarding;
   // First IME txn in this placeholder - used for IME merging.
   mozilla::CompositionTransaction* mCompositionTransaction;
-  // Do we stop auto absorbing any matching placeholder transactions?
-  bool mCommitted;
 
   // These next two members store the state of the selection in a safe way.
   // Selection at the start of the transaction is stored, as is the selection
   // at the end.  This is so that UndoTransaction() and RedoTransaction() can
   // restore the selection properly.
 
   SelectionState mStartSel;
   SelectionState mEndSel;
 
-  // The editor for this transaction.
-  RefPtr<EditorBase> mEditorBase;
+  // Do we auto absorb any and all transaction?
+  bool mAbsorb;
+  // Do we stop auto absorbing any matching placeholder transactions?
+  bool mCommitted;
 };
 
 } // namespace mozilla
 
 #endif // #ifndef PlaceholderTransaction_h