From 533388e4cfb5d5dfbbc65e9df16b0d4776d243a4 Mon Sep 17 00:00:00 2001
From: "ginn.chen%sun.com" <ginn.chen%sun.com>
Date: Wed, 25 Jul 2007 06:24:00 +0000
Subject: [PATCH] Bug 388665 Javascript interferes with STATE_EDITABLE
 r=aaronleventhal sr=bzbarsky

---
 accessible/src/html/Makefile.in                  |  2 ++
 .../src/html/nsHTMLFormControlAccessible.cpp     | 16 ++++++++++++++++
 2 files changed, 18 insertions(+)

diff --git a/accessible/src/html/Makefile.in b/accessible/src/html/Makefile.in
index 5fea2a3fb23..4757faab58f 100644
--- a/accessible/src/html/Makefile.in
+++ b/accessible/src/html/Makefile.in
@@ -54,6 +54,7 @@ REQUIRES	= content \
 		  gfx \
 		  imglib2 \
 		  intl \
+		  js \
 		  layout \
 		  locale \
 		  necko \
@@ -61,6 +62,7 @@ REQUIRES	= content \
 		  webshell \
 		  widget \
 		  xpcom \
+		  xpconnect \
 		  $(NULL)
 
 ifeq ($(MOZ_WIDGET_TOOLKIT),gtk2)
diff --git a/accessible/src/html/nsHTMLFormControlAccessible.cpp b/accessible/src/html/nsHTMLFormControlAccessible.cpp
index a142a46adc7..c90711e3680 100644
--- a/accessible/src/html/nsHTMLFormControlAccessible.cpp
+++ b/accessible/src/html/nsHTMLFormControlAccessible.cpp
@@ -51,6 +51,9 @@
 #include "nsIFrame.h"
 #include "nsINameSpaceManager.h"
 #include "nsISelectionController.h"
+#include "jsapi.h"
+#include "nsIJSContextStack.h"
+#include "nsIServiceManager.h"
 #include "nsITextControlFrame.h"
 
 // --- checkbox -----
@@ -556,11 +559,24 @@ void nsHTMLTextFieldAccessible::CheckForEditor()
     return;
   }
 
+  // nsGenericHTMLElement::GetEditor has a security check.
+  // Make sure we're not restricted by the permissions of
+  // whatever script is currently running.
+  nsCOMPtr<nsIJSContextStack> stack =
+    do_GetService("@mozilla.org/js/xpc/ContextStack;1");
+  PRBool pushed = stack && NS_SUCCEEDED(stack->Push(nsnull));
+
   nsCOMPtr<nsIEditor> editor;
   nsresult rv = editableElt->GetEditor(getter_AddRefs(editor));
   if (NS_SUCCEEDED(rv)) {
     SetEditor(editor);
   }
+
+  if (pushed) {
+    JSContext* cx;
+    stack->Pop(&cx);
+    NS_ASSERTION(!cx, "context should be null");
+  }
 }
 
 // --- groupbox  -----