Bug 1511563 - Don't make NAC editable by default. r=masayuki

I think this is a more consistent fix for the issue.

Differential Revision: https://phabricator.services.mozilla.com/D16521

dom/base/Element.cpp

@@ -282,41 +282,20 @@ void Element::UpdateState(bool aNotify) {
 }  // namespace mozilla
 
 void nsIContent::UpdateEditableState(bool aNotify) {
-  // Guaranteed to be non-element content
-  NS_ASSERTION(!IsElement(), "What happened here?");
   nsIContent* parent = GetParent();
 
-  // Skip over unknown native anonymous content to avoid setting a flag we
+  // Don't implicitly set the flag on the root of a native anonymous subtree.
-  // can't clear later
+  // This needs to be set explicitly, see for example
-  bool isUnknownNativeAnon = false;
+  // nsTextControlFrame::CreateRootNode().
-  if (IsInNativeAnonymousSubtree()) {
-    isUnknownNativeAnon = true;
-    nsCOMPtr<nsIContent> root = this;
-    while (root && !root->IsRootOfNativeAnonymousSubtree()) {
-      root = root->GetParent();
-    }
-    // root should always be true here, but isn't -- bug 999416
-    if (root) {
-      nsIFrame* rootFrame = root->GetPrimaryFrame();
-      if (rootFrame) {
-        nsContainerFrame* parentFrame = rootFrame->GetParent();
-        nsITextControlFrame* textCtrl = do_QueryFrame(parentFrame);
-        isUnknownNativeAnon = !textCtrl;
-      }
-    }
-  }
-
   SetEditableFlag(parent && parent->HasFlag(NODE_IS_EDITABLE) &&
-                  !isUnknownNativeAnon);
+                  !IsRootOfNativeAnonymousSubtree());
 }
 
 namespace mozilla {
 namespace dom {
 
 void Element::UpdateEditableState(bool aNotify) {
-  nsIContent* parent = GetParent();
+  nsIContent::UpdateEditableState(aNotify);
-
-  SetEditableFlag(parent && parent->HasFlag(NODE_IS_EDITABLE));
   if (aNotify) {
     UpdateState(aNotify);
   } else {

dom/base/nsIContentInlines.h

@@ -153,9 +153,14 @@ inline bool nsINode::IsEditable() const {
     return true;
   }
 
-  Document* doc = GetUncomposedDoc();
+  // All editable anonymous content should be made explicitly editable via the
+  // NODE_IS_EDITABLE flag.
+  if (IsInNativeAnonymousSubtree()) {
+    return false;
+  }
 
   // Check if the node is in a document and the document is in designMode.
+  Document* doc = GetUncomposedDoc();
   return doc && doc->HasFlag(NODE_IS_EDITABLE);
 }
 

layout/base/crashtests/1511563.html

@@ -0,0 +1,8 @@
+<script>
+document.addEventListener("DOMContentLoaded", function(){
+  document.designMode='on'
+  window.getSelection().modify('move', 'right', 'line')
+})
+</script>
+<br>
+<keygen>

layout/base/crashtests/crashtests.list

@@ -556,3 +556,4 @@ pref(layout.css.column-span.enabled,true) load 1507244.html
 load 1510080.html
 load 1510485.html
 pref(layout.css.column-span.enabled,true) load 1511535.html
+load 1511563.html

widget/tests/test_imestate.html

@@ -406,7 +406,7 @@ function runBasicTest(aIsEditable, aInDesignMode, aDescription)
       description: "input[type=file]",
       focusable: !aInDesignMode,
       focusEventNotFired: aIsEditable && !aInDesignMode,
-      expectedEnabled: kEnabledStateOnNonEditableElement },
+      expectedEnabled: kEnabledStateOnReadonlyField },
     { id: "button",
       description: "input[type=button]",
       focusable: !aInDesignMode,