Bug 1380292 - Don't turn on object resizer, inline table editor and etc when element isn't into editor. r=masayuki

editor/libeditor/HTMLAbsPositionEditor.cpp

@@ -327,6 +327,10 @@ HTMLEditor::ShowGrabberOnElement(nsIDOMElement* aElement)
   nsCOMPtr<Element> element = do_QueryInterface(aElement);
   NS_ENSURE_ARG_POINTER(element);
 
+  if (NS_WARN_IF(!IsDescendantOfEditorRoot(element))) {
+    return NS_ERROR_UNEXPECTED;
+  }
+
   if (mGrabber) {
     NS_ERROR("call HideGrabber first");
     return NS_ERROR_UNEXPECTED;

editor/libeditor/HTMLEditorObjectResizer.cpp

@@ -304,6 +304,10 @@ HTMLEditor::ShowResizersInner(Element& aResizedElement)
    return NS_ERROR_FAILURE;
   }
 
+  if (NS_WARN_IF(!IsDescendantOfEditorRoot(&aResizedElement))) {
+    return NS_ERROR_UNEXPECTED;
+  }
+
   mResizedObject = &aResizedElement;
 
   // The resizers and the shadow will be anonymous siblings of the element.

editor/libeditor/HTMLInlineTableEditor.cpp

@@ -48,10 +48,15 @@ HTMLEditor::ShowInlineTableEditingUI(nsIDOMElement* aCell)
   NS_ENSURE_ARG_POINTER(aCell);
 
   // do nothing if aCell is not a table cell...
-  if (!HTMLEditUtils::IsTableCell(aCell)) {
+  nsCOMPtr<Element> cell = do_QueryInterface(aCell);
+  if (!cell || !HTMLEditUtils::IsTableCell(cell)) {
     return NS_OK;
   }
 
+  if (NS_WARN_IF(!IsDescendantOfEditorRoot(cell))) {
+    return NS_ERROR_UNEXPECTED;
+  }
+
   if (mInlineEditedCell) {
     NS_ERROR("call HideInlineTableEditingUI first");
     return NS_ERROR_UNEXPECTED;