#433: M1380292 M1371657 M1393624 M1386905

dom/html/nsTextEditorState.cpp

@@ -1699,6 +1699,8 @@ nsTextEditorState::UnbindFromFrame(nsTextControlFrame* aFrame)
   }
 
   mBoundFrame = nullptr;
+  // Clear mRootNode so that we don't unexpectedly notify below.
+  nsCOMPtr<Element> rootNode = mRootNode.forget();
 
   // Now that we don't have a frame any more, store the value in the text buffer.
   // The only case where we don't do this is if a value transfer is in progress.
@@ -1708,15 +1710,15 @@ nsTextEditorState::UnbindFromFrame(nsTextControlFrame* aFrame)
     NS_ENSURE_TRUE_VOID(success);
   }
 
-  if (mRootNode && mMutationObserver) {
+  if (rootNode && mMutationObserver) {
-    mRootNode->RemoveMutationObserver(mMutationObserver);
+    rootNode->RemoveMutationObserver(mMutationObserver);
     mMutationObserver = nullptr;
   }
 
   // Unbind the anonymous content from the tree.
   // We actually hold a reference to the content nodes so that
   // they're not actually destroyed.
-  nsContentUtils::DestroyAnonymousContent(&mRootNode);
+  nsContentUtils::DestroyAnonymousContent(&rootNode);
   nsContentUtils::DestroyAnonymousContent(&mPlaceholderDiv);
 }
 

editor/libeditor/nsHTMLAbsPosition.cpp

@@ -310,6 +310,10 @@ nsHTMLEditor::ShowGrabberOnElement(nsIDOMElement * aElement)
   nsCOMPtr<Element> element = do_QueryInterface(aElement);
   NS_ENSURE_ARG_POINTER(element);
 
+  if (NS_WARN_IF(!IsDescendantOfEditorRoot(element))) {
+    return NS_ERROR_UNEXPECTED;
+  }
+
   if (mGrabber) {
     NS_ERROR("call HideGrabber first");
     return NS_ERROR_UNEXPECTED;

editor/libeditor/nsHTMLEditor.cpp

@@ -253,6 +253,10 @@ nsHTMLEditor::Init(nsIDOMDocument *aDoc,
     nsCOMPtr<nsINode> document = do_QueryInterface(aDoc);
     document->AddMutationObserverUnlessExists(this);
 
+    if (!mRootElement) {
+      UpdateRootElement();
+    }
+
     // disable Composer-only features
     if (IsMailEditor())
     {
@@ -328,45 +332,27 @@ nsHTMLEditor::PreDestroy(bool aDestroyingFrames)
   return nsPlaintextEditor::PreDestroy(aDestroyingFrames);
 }
 
-NS_IMETHODIMP
+void
-nsHTMLEditor::GetRootElement(nsIDOMElement **aRootElement)
+nsHTMLEditor::UpdateRootElement()
 {
-  NS_ENSURE_ARG_POINTER(aRootElement);
-
-  if (mRootElement) {
-    return nsEditor::GetRootElement(aRootElement);
-  }
-
-  *aRootElement = nullptr;
-
   // Use the HTML documents body element as the editor root if we didn't
   // get a root element during initialization.
 
   nsCOMPtr<nsIDOMElement> rootElement;
   nsCOMPtr<nsIDOMHTMLElement> bodyElement;
-  nsresult rv = GetBodyElement(getter_AddRefs(bodyElement));
+  GetBodyElement(getter_AddRefs(bodyElement));
-  NS_ENSURE_SUCCESS(rv, rv);
-
   if (bodyElement) {
     rootElement = bodyElement;
   } else {
     // If there is no HTML body element,
     // we should use the document root element instead.
     nsCOMPtr<nsIDOMDocument> doc = do_QueryReferent(mDocWeak);
-    NS_ENSURE_TRUE(doc, NS_ERROR_NOT_INITIALIZED);
+    if (doc) {
-
+      doc->GetDocumentElement(getter_AddRefs(rootElement));
-    rv = doc->GetDocumentElement(getter_AddRefs(rootElement));
-    NS_ENSURE_SUCCESS(rv, rv);
-    // Document can have no elements
-    if (!rootElement) {
-      return NS_ERROR_NOT_AVAILABLE;
     }
   }
 
   mRootElement = do_QueryInterface(rootElement);
-  rootElement.forget(aRootElement);
-
-  return NS_OK;
 }
 
 already_AddRefed<nsIContent>
@@ -3208,8 +3194,9 @@ nsHTMLEditor::DoContentInserted(nsIDocument* aDocument, nsIContent* aContainer,
   nsCOMPtr<nsIHTMLEditor> kungFuDeathGrip(this);
 
   if (ShouldReplaceRootElement()) {
+    UpdateRootElement();
     nsContentUtils::AddScriptRunner(NS_NewRunnableMethod(
-      this, &nsHTMLEditor::ResetRootElementAndEventTarget));
+      this, &nsHTMLEditor::NotifyRootChanged));
   }
   // We don't need to handle our own modifications
   else if (!mAction && (aContainer ? aContainer->IsEditable() : aDocument->IsEditable())) {
@@ -3254,8 +3241,9 @@ nsHTMLEditor::ContentRemoved(nsIDocument *aDocument, nsIContent* aContainer,
   nsCOMPtr<nsIHTMLEditor> kungFuDeathGrip(this);
 
   if (SameCOMIdentity(aChild, mRootElement)) {
+    mRootElement = nullptr;
     nsContentUtils::AddScriptRunner(NS_NewRunnableMethod(
-      this, &nsHTMLEditor::ResetRootElementAndEventTarget));
+      this, &nsHTMLEditor::NotifyRootChanged));
   }
   // We don't need to handle our own modifications
   else if (!mAction && (aContainer ? aContainer->IsEditable() : aDocument->IsEditable())) {
@@ -5093,24 +5081,18 @@ nsHTMLEditor::ShouldReplaceRootElement()
 }
 
 void
-nsHTMLEditor::ResetRootElementAndEventTarget()
+nsHTMLEditor::NotifyRootChanged()
 {
   nsCOMPtr<nsIMutationObserver> kungFuDeathGrip(this);
 
-  // Need to remove the event listeners first because BeginningOfDocument
-  // could set a new root (and event target is set by InstallEventListeners())
-  // and we won't be able to remove them from the old event target then.
   RemoveEventListeners();
-  mRootElement = nullptr;
   nsresult rv = InstallEventListeners();
   if (NS_FAILED(rv)) {
     return;
   }
 
-  // We must have mRootElement now.
+  UpdateRootElement();
-  nsCOMPtr<nsIDOMElement> root;
+  if (!mRootElement) {
-  rv = GetRootElement(getter_AddRefs(root));
-  if (NS_FAILED(rv) || !mRootElement) {
     return;
   }
 

editor/libeditor/nsHTMLEditor.h

@@ -330,8 +330,6 @@ public:
 
   NS_IMETHOD SelectAll() override;
 
-  NS_IMETHOD GetRootElement(nsIDOMElement **aRootElement) override;
-
   /* ------------ nsICSSLoaderObserver -------------- */
   NS_IMETHOD StyleSheetLoaded(mozilla::CSSStyleSheet* aSheet,
                               bool aWasAlternate, nsresult aStatus) override;
@@ -414,7 +412,7 @@ protected:
   virtual void RemoveEventListeners() override;
 
   bool ShouldReplaceRootElement();
-  void ResetRootElementAndEventTarget();
+  void NotifyRootChanged();
   nsresult GetBodyElement(nsIDOMHTMLElement** aBody);
   // Get the focused node of this editor.
   // @return    If the editor has focus, this returns the focused node.
@@ -819,6 +817,8 @@ protected:
                            nsIContent* aContainer,
                            nsIContent* aChild);
 
+  void UpdateRootElement();
+
   // resizing
   bool mIsObjectResizingEnabled;
   bool mIsResizing;

editor/libeditor/nsHTMLInlineTableEditor.cpp

@@ -46,9 +46,14 @@ nsHTMLEditor::ShowInlineTableEditingUI(nsIDOMElement * aCell)
   NS_ENSURE_ARG_POINTER(aCell);
 
   // do nothing if aCell is not a table cell...
-  if (!nsHTMLEditUtils::IsTableCell(aCell))
+  nsCOMPtr<Element> cell = do_QueryInterface(aCell);
+  if (!cell || !nsHTMLEditUtils::IsTableCell(aCell))
     return NS_OK;
 
+  if (NS_WARN_IF(!IsDescendantOfEditorRoot(cell))) {
+    return NS_ERROR_UNEXPECTED;
+  }
+
   if (mInlineEditedCell) {
     NS_ERROR("call HideInlineTableEditingUI first");
     return NS_ERROR_UNEXPECTED;

editor/libeditor/nsHTMLObjectResizer.cpp

@@ -322,6 +322,12 @@ nsHTMLEditor::ShowResizersInner(nsIDOMElement *aResizedElement)
     NS_ERROR("call HideResizers first");
     return NS_ERROR_UNEXPECTED;
   }
+
+  nsCOMPtr<nsINode> resizedNode = do_QueryInterface(aResizedElement);
+  if (NS_WARN_IF(!IsDescendantOfEditorRoot(resizedNode))) {
+    return NS_ERROR_UNEXPECTED;
+  }
+
   mResizedObject = do_QueryInterface(aResizedElement);
   NS_ENSURE_STATE(mResizedObject);
 

gfx/thebes/gfxMacPlatformFontList.mm

@@ -224,18 +224,27 @@ if (!mIsDataUserFont || mIsLocalUserFont) {
             }
         }
 
-        // Bug 1360309: several of Apple's Chinese fonts have spurious blank
+        // Bug 1360309, 1393624: several of Apple's Chinese fonts have spurious
-        // glyphs for obscure Tibetan codepoints. Blacklist these so that font
+        // blank glyphs for obscure Tibetan and Arabic-script codepoints.
-        // fallback will not use them.
+        // Blacklist these so that font fallback will not use them.
         // (It is not likely to encounter these on 10.4 or 10.5.)
         if (mRequiresAAT && (FamilyName().EqualsLiteral("Songti SC") ||
                              FamilyName().EqualsLiteral("Songti TC") ||
+                             FamilyName().EqualsLiteral("STSong") ||
         // Bug 1390980: on 10.11, the Kaiti fonts are also affected.
         // Again, this is mostly here if someone copied them from a later Mac.
                              FamilyName().EqualsLiteral("Kaiti SC") ||
                              FamilyName().EqualsLiteral("Kaiti TC") ||
                              FamilyName().EqualsLiteral("STKaiti"))) {
+            charmap->ClearRange(0x0f6b, 0x0f70);
             charmap->ClearRange(0x0f8c, 0x0f8f);
+            charmap->clear(0x0f98);
+            charmap->clear(0x0fbd);
+            charmap->ClearRange(0x0fcd, 0x0fff);
+            charmap->clear(0x0620);
+            charmap->clear(0x065f);
+            charmap->ClearRange(0x06ee, 0x06ef);
+            charmap->clear(0x06ff);
         }
     }