Bug 1380292 - Don't turn on object resizer, inline table editor and etc when element isn't into editor. r=masayuki, a=abillings
authorMakoto Kato <m_kato@ga2.so-net.ne.jp>
Sat, 09 Sep 2017 10:49:56 -0400
changeset 421628 d669c5ad9dd46e446f445991b365ec4a8a03af4f
parent 421627 f01d58e60d69ab8352a6bfee9cb3a7f03176e2a4
child 421629 47a217676e96585fad92152ec0e74061a8a1f5a0
push id7730
push userryanvm@gmail.com
push dateSat, 09 Sep 2017 16:32:53 +0000
treeherdermozilla-beta@d669c5ad9dd4 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersmasayuki, abillings
bugs1380292
milestone56.0
Bug 1380292 - Don't turn on object resizer, inline table editor and etc when element isn't into editor. r=masayuki, a=abillings
editor/libeditor/HTMLAbsPositionEditor.cpp
editor/libeditor/HTMLEditorObjectResizer.cpp
editor/libeditor/HTMLInlineTableEditor.cpp
--- a/editor/libeditor/HTMLAbsPositionEditor.cpp
+++ b/editor/libeditor/HTMLAbsPositionEditor.cpp
@@ -296,16 +296,20 @@ HTMLEditor::HideGrabber()
 }
 
 NS_IMETHODIMP
 HTMLEditor::ShowGrabberOnElement(nsIDOMElement* aElement)
 {
   nsCOMPtr<Element> element = do_QueryInterface(aElement);
   NS_ENSURE_ARG_POINTER(element);
 
+  if (NS_WARN_IF(!IsDescendantOfEditorRoot(element))) {
+    return NS_ERROR_UNEXPECTED;
+  }
+
   if (mGrabber) {
     NS_ERROR("call HideGrabber first");
     return NS_ERROR_UNEXPECTED;
   }
 
   nsAutoString classValue;
   nsresult rv = CheckPositionedElementBGandFG(aElement, classValue);
   NS_ENSURE_SUCCESS(rv, rv);
--- a/editor/libeditor/HTMLEditorObjectResizer.cpp
+++ b/editor/libeditor/HTMLEditorObjectResizer.cpp
@@ -292,16 +292,22 @@ HTMLEditor::ShowResizersInner(nsIDOMElem
   nsCOMPtr<nsIDOMNode> parentNode;
   nsresult rv = aResizedElement->GetParentNode(getter_AddRefs(parentNode));
   NS_ENSURE_SUCCESS(rv, rv);
 
   if (mResizedObject) {
     NS_ERROR("call HideResizers first");
     return NS_ERROR_UNEXPECTED;
   }
+
+  nsCOMPtr<nsINode> resizedNode = do_QueryInterface(aResizedElement);
+  if (NS_WARN_IF(!IsDescendantOfEditorRoot(resizedNode))) {
+    return NS_ERROR_UNEXPECTED;
+  }
+
   mResizedObject = do_QueryInterface(aResizedElement);
   NS_ENSURE_STATE(mResizedObject);
 
   // The resizers and the shadow will be anonymous siblings of the element.
   mTopLeftHandle = CreateResizer(nsIHTMLObjectResizer::eTopLeft, parentNode);
   NS_ENSURE_TRUE(mTopLeftHandle, NS_ERROR_FAILURE);
   mTopHandle = CreateResizer(nsIHTMLObjectResizer::eTop, parentNode);
   NS_ENSURE_TRUE(mTopHandle, NS_ERROR_FAILURE);
--- a/editor/libeditor/HTMLInlineTableEditor.cpp
+++ b/editor/libeditor/HTMLInlineTableEditor.cpp
@@ -43,19 +43,24 @@ HTMLEditor::GetInlineTableEditingEnabled
 }
 
 NS_IMETHODIMP
 HTMLEditor::ShowInlineTableEditingUI(nsIDOMElement* aCell)
 {
   NS_ENSURE_ARG_POINTER(aCell);
 
   // do nothing if aCell is not a table cell...
-  if (!HTMLEditUtils::IsTableCell(aCell)) {
+  nsCOMPtr<Element> cell = do_QueryInterface(aCell);
+  if (!cell || !HTMLEditUtils::IsTableCell(cell)) {
     return NS_OK;
   }
+ 
+  if (NS_WARN_IF(!IsDescendantOfEditorRoot(cell))) {
+    return NS_ERROR_UNEXPECTED;
+  }
 
   if (mInlineEditedCell) {
     NS_ERROR("call HideInlineTableEditingUI first");
     return NS_ERROR_UNEXPECTED;
   }
 
   // the resizers and the shadow will be anonymous children of the body
   nsCOMPtr<nsIDOMElement> bodyElement = do_QueryInterface(GetRoot());