Bug 1380292 - Don't turn on object resizer, inline table editor and etc when element isn't into editor. r=masayuki, a=jcristau
authorMakoto Kato <m_kato@ga2.so-net.ne.jp>
Sat, 09 Sep 2017 10:49:56 -0400
changeset 356323 1a02f11c6efecd6b5550ffcffdb4e38e6fe170cf
parent 356322 24db61862c543397c5da17cb09a34c3d95061509
child 356324 002686d9536fabc0ded331cafc669dcc7d99caf8
push id7299
push userryanvm@gmail.com
push dateMon, 11 Sep 2017 16:46:57 +0000
treeherdermozilla-esr52@002686d9536f [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersmasayuki, jcristau
bugs1380292
milestone52.3.1
Bug 1380292 - Don't turn on object resizer, inline table editor and etc when element isn't into editor. r=masayuki, a=jcristau
editor/libeditor/HTMLAbsPositionEditor.cpp
editor/libeditor/HTMLEditorObjectResizer.cpp
editor/libeditor/HTMLInlineTableEditor.cpp
--- a/editor/libeditor/HTMLAbsPositionEditor.cpp
+++ b/editor/libeditor/HTMLAbsPositionEditor.cpp
@@ -304,16 +304,20 @@ HTMLEditor::HideGrabber()
 }
 
 NS_IMETHODIMP
 HTMLEditor::ShowGrabberOnElement(nsIDOMElement* aElement)
 {
   nsCOMPtr<Element> element = do_QueryInterface(aElement);
   NS_ENSURE_ARG_POINTER(element);
 
+  if (NS_WARN_IF(!IsDescendantOfEditorRoot(element))) {
+    return NS_ERROR_UNEXPECTED;
+  }
+
   if (mGrabber) {
     NS_ERROR("call HideGrabber first");
     return NS_ERROR_UNEXPECTED;
   }
 
   nsAutoString classValue;
   nsresult rv = CheckPositionedElementBGandFG(aElement, classValue);
   NS_ENSURE_SUCCESS(rv, rv);
--- a/editor/libeditor/HTMLEditorObjectResizer.cpp
+++ b/editor/libeditor/HTMLEditorObjectResizer.cpp
@@ -308,16 +308,22 @@ HTMLEditor::ShowResizersInner(nsIDOMElem
   nsCOMPtr<nsIDOMNode> parentNode;
   nsresult rv = aResizedElement->GetParentNode(getter_AddRefs(parentNode));
   NS_ENSURE_SUCCESS(rv, rv);
 
   if (mResizedObject) {
     NS_ERROR("call HideResizers first");
     return NS_ERROR_UNEXPECTED;
   }
+
+  nsCOMPtr<nsINode> resizedNode = do_QueryInterface(aResizedElement);
+  if (NS_WARN_IF(!IsDescendantOfEditorRoot(resizedNode))) {
+    return NS_ERROR_UNEXPECTED;
+  }
+
   mResizedObject = do_QueryInterface(aResizedElement);
   NS_ENSURE_STATE(mResizedObject);
 
   // The resizers and the shadow will be anonymous siblings of the element.
   mTopLeftHandle = CreateResizer(nsIHTMLObjectResizer::eTopLeft, parentNode);
   NS_ENSURE_TRUE(mTopLeftHandle, NS_ERROR_FAILURE);
   mTopHandle = CreateResizer(nsIHTMLObjectResizer::eTop, parentNode);
   NS_ENSURE_TRUE(mTopHandle, NS_ERROR_FAILURE);
--- a/editor/libeditor/HTMLInlineTableEditor.cpp
+++ b/editor/libeditor/HTMLInlineTableEditor.cpp
@@ -43,19 +43,24 @@ HTMLEditor::GetInlineTableEditingEnabled
 }
 
 NS_IMETHODIMP
 HTMLEditor::ShowInlineTableEditingUI(nsIDOMElement* aCell)
 {
   NS_ENSURE_ARG_POINTER(aCell);
 
   // do nothing if aCell is not a table cell...
-  if (!HTMLEditUtils::IsTableCell(aCell)) {
+  nsCOMPtr<Element> cell = do_QueryInterface(aCell);
+  if (!cell || !HTMLEditUtils::IsTableCell(cell)) {
     return NS_OK;
   }
+ 
+  if (NS_WARN_IF(!IsDescendantOfEditorRoot(cell))) {
+    return NS_ERROR_UNEXPECTED;
+  }
 
   if (mInlineEditedCell) {
     NS_ERROR("call HideInlineTableEditingUI first");
     return NS_ERROR_UNEXPECTED;
   }
 
   // the resizers and the shadow will be anonymous children of the body
   nsCOMPtr<nsIDOMElement> bodyElement = do_QueryInterface(GetRoot());