From 012ef9e1c1fba44bfea9bd75f59c2d09c95321d5 Mon Sep 17 00:00:00 2001
From: Makoto Kato <m_kato@ga2.so-net.ne.jp>
Date: Sat, 9 Sep 2017 10:49:02 -0400
Subject: [PATCH] Bug 1380292 - Don't turn on object resizer, inline table
 editor and etc when element isn't into editor. r=masayuki

---
 editor/libeditor/HTMLAbsPositionEditor.cpp   | 4 ++++
 editor/libeditor/HTMLEditorObjectResizer.cpp | 4 ++++
 editor/libeditor/HTMLInlineTableEditor.cpp   | 7 ++++++-
 3 files changed, 14 insertions(+), 1 deletion(-)

diff --git a/editor/libeditor/HTMLAbsPositionEditor.cpp b/editor/libeditor/HTMLAbsPositionEditor.cpp
index 5f290874798d..56008e3b73eb 100644
--- a/editor/libeditor/HTMLAbsPositionEditor.cpp
+++ b/editor/libeditor/HTMLAbsPositionEditor.cpp
@@ -327,6 +327,10 @@ HTMLEditor::ShowGrabberOnElement(nsIDOMElement* aElement)
   nsCOMPtr<Element> element = do_QueryInterface(aElement);
   NS_ENSURE_ARG_POINTER(element);
 
+  if (NS_WARN_IF(!IsDescendantOfEditorRoot(element))) {
+    return NS_ERROR_UNEXPECTED;
+  }
+
   if (mGrabber) {
     NS_ERROR("call HideGrabber first");
     return NS_ERROR_UNEXPECTED;
diff --git a/editor/libeditor/HTMLEditorObjectResizer.cpp b/editor/libeditor/HTMLEditorObjectResizer.cpp
index 56b94e2b444f..d81a813f0b91 100644
--- a/editor/libeditor/HTMLEditorObjectResizer.cpp
+++ b/editor/libeditor/HTMLEditorObjectResizer.cpp
@@ -304,6 +304,10 @@ HTMLEditor::ShowResizersInner(Element& aResizedElement)
    return NS_ERROR_FAILURE;
   }
 
+  if (NS_WARN_IF(!IsDescendantOfEditorRoot(&aResizedElement))) {
+    return NS_ERROR_UNEXPECTED;
+  }
+
   mResizedObject = &aResizedElement;
 
   // The resizers and the shadow will be anonymous siblings of the element.
diff --git a/editor/libeditor/HTMLInlineTableEditor.cpp b/editor/libeditor/HTMLInlineTableEditor.cpp
index ecb23db00374..830b1e9d797c 100644
--- a/editor/libeditor/HTMLInlineTableEditor.cpp
+++ b/editor/libeditor/HTMLInlineTableEditor.cpp
@@ -48,10 +48,15 @@ HTMLEditor::ShowInlineTableEditingUI(nsIDOMElement* aCell)
   NS_ENSURE_ARG_POINTER(aCell);
 
   // do nothing if aCell is not a table cell...
-  if (!HTMLEditUtils::IsTableCell(aCell)) {
+  nsCOMPtr<Element> cell = do_QueryInterface(aCell);
+  if (!cell || !HTMLEditUtils::IsTableCell(cell)) {
     return NS_OK;
   }
 
+  if (NS_WARN_IF(!IsDescendantOfEditorRoot(cell))) {
+    return NS_ERROR_UNEXPECTED;
+  }
+
   if (mInlineEditedCell) {
     NS_ERROR("call HideInlineTableEditingUI first");
     return NS_ERROR_UNEXPECTED;