Bug 1380292 - Don't turn on object resizer, inline table editor and etc when element isn't into editor. r=masayuki
authorMakoto Kato <m_kato@ga2.so-net.ne.jp>
Sat, 09 Sep 2017 10:49:02 -0400
changeset 429421 c5cb3aad36f8614f0a9f445007accb3725b66b66
parent 429420 0998107850f7973d1667e1c924a196decdbd7435
child 429422 a3eabb355005004ed389e96ae310f2dcca1de0dc
push id7761
push userjlund@mozilla.com
push dateFri, 15 Sep 2017 00:19:52 +0000
treeherdermozilla-beta@c38455951db4 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersmasayuki
bugs1380292
milestone57.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 1380292 - Don't turn on object resizer, inline table editor and etc when element isn't into editor. r=masayuki
editor/libeditor/HTMLAbsPositionEditor.cpp
editor/libeditor/HTMLEditorObjectResizer.cpp
editor/libeditor/HTMLInlineTableEditor.cpp
--- a/editor/libeditor/HTMLAbsPositionEditor.cpp
+++ b/editor/libeditor/HTMLAbsPositionEditor.cpp
@@ -322,16 +322,20 @@ HTMLEditor::HideGrabber()
 }
 
 NS_IMETHODIMP
 HTMLEditor::ShowGrabberOnElement(nsIDOMElement* aElement)
 {
   nsCOMPtr<Element> element = do_QueryInterface(aElement);
   NS_ENSURE_ARG_POINTER(element);
 
+  if (NS_WARN_IF(!IsDescendantOfEditorRoot(element))) {
+    return NS_ERROR_UNEXPECTED;
+  }
+
   if (mGrabber) {
     NS_ERROR("call HideGrabber first");
     return NS_ERROR_UNEXPECTED;
   }
 
   nsAutoString classValue;
   nsresult rv = CheckPositionedElementBGandFG(aElement, classValue);
   NS_ENSURE_SUCCESS(rv, rv);
--- a/editor/libeditor/HTMLEditorObjectResizer.cpp
+++ b/editor/libeditor/HTMLEditorObjectResizer.cpp
@@ -299,16 +299,20 @@ HTMLEditor::ShowResizersInner(Element& a
     return NS_ERROR_UNEXPECTED;
   }
 
   nsCOMPtr<nsIContent> parentContent = aResizedElement.GetParent();
   if (NS_WARN_IF(!parentContent)) {
    return NS_ERROR_FAILURE;
   }
 
+  if (NS_WARN_IF(!IsDescendantOfEditorRoot(&aResizedElement))) {
+    return NS_ERROR_UNEXPECTED;
+  }
+
   mResizedObject = &aResizedElement;
 
   // The resizers and the shadow will be anonymous siblings of the element.
   mTopLeftHandle =
     CreateResizer(nsIHTMLObjectResizer::eTopLeft, *parentContent);
   NS_ENSURE_TRUE(mTopLeftHandle, NS_ERROR_FAILURE);
   mTopHandle = CreateResizer(nsIHTMLObjectResizer::eTop, *parentContent);
   NS_ENSURE_TRUE(mTopHandle, NS_ERROR_FAILURE);
--- a/editor/libeditor/HTMLInlineTableEditor.cpp
+++ b/editor/libeditor/HTMLInlineTableEditor.cpp
@@ -43,20 +43,25 @@ HTMLEditor::GetInlineTableEditingEnabled
 }
 
 NS_IMETHODIMP
 HTMLEditor::ShowInlineTableEditingUI(nsIDOMElement* aCell)
 {
   NS_ENSURE_ARG_POINTER(aCell);
 
   // do nothing if aCell is not a table cell...
-  if (!HTMLEditUtils::IsTableCell(aCell)) {
+  nsCOMPtr<Element> cell = do_QueryInterface(aCell);
+  if (!cell || !HTMLEditUtils::IsTableCell(cell)) {
     return NS_OK;
   }
 
+  if (NS_WARN_IF(!IsDescendantOfEditorRoot(cell))) {
+    return NS_ERROR_UNEXPECTED;
+  }
+
   if (mInlineEditedCell) {
     NS_ERROR("call HideInlineTableEditingUI first");
     return NS_ERROR_UNEXPECTED;
   }
 
   // the resizers and the shadow will be anonymous children of the body
   RefPtr<Element> bodyElement = GetRoot();
   NS_ENSURE_TRUE(bodyElement, NS_ERROR_NULL_POINTER);