Bug 1503744 - Make HTMLEditor::SetHTMLBackgroundColorWithTransaction() not refer RefPtr after moving it r=m_kato

Simple fix of crash caused by referring nullptr.

Differential Revision: https://phabricator.services.mozilla.com/D10705

--HG--
extra : moz-landing-system : lando

editor/libeditor/HTMLEditor.cpp

@@ -3240,8 +3240,8 @@ HTMLEditor::SetHTMLBackgroundColorWithTransaction(const nsAString& aColor)
     // web apps can select <tr> and <td> at same time. With <table>, looks
     // odd, though.
     if (isCellSelected ||
-        cellOrRowOrTableElement->IsAnyOfHTMLElements(nsGkAtoms::table,
-                                                    nsGkAtoms::tr)) {
+        rootElementOfBackgroundColor->IsAnyOfHTMLElements(nsGkAtoms::table,
+                                                          nsGkAtoms::tr)) {
       IgnoredErrorResult ignoredError;
       RefPtr<Element> cellElement =
         GetFirstSelectedTableCellElement(ignoredError);