Bug 1359397 - Don't allow Selection in nodes not in the document; r=m…

…asayuki

This matches the spec and Chrome, and seems to bring us closer to Edge
and WebKit as well.  It also matches our own behavior for addRange(),
which was changed in bug 1341137.

For collapse and selectAllChildren, we match the tests and browsers, but
the spec is incorrect at the time of this writing:
w3c/selection-api#86

The removeAllRanges test hadn't been updated for the spec change.

MozReview-Commit-ID: DTK8283k5IP

dom/base/Selection.cpp

@@ -2481,6 +2481,21 @@ Selection::Collapse(nsINode& aContainer, uint32_t aOffset, ErrorResult& aRv)
     return;
   }
 
+  if (aContainer.NodeType() == nsIDOMNode::DOCUMENT_TYPE_NODE) {
+    aRv.Throw(NS_ERROR_DOM_INVALID_NODE_TYPE_ERR);
+    return;
+  }
+
+  if (aOffset > aContainer.Length()) {
+    aRv.Throw(NS_ERROR_DOM_INDEX_SIZE_ERR);
+    return;
+  }
+
+  if (!HasSameRoot(aContainer)) {
+    // Return with no error
+    return;
+  }
+
   nsCOMPtr<nsINode> container = &aContainer;
 
   RefPtr<nsFrameSelection> frameSelection = mFrameSelection;
@@ -2880,6 +2895,11 @@ Selection::Extend(nsINode& aContainer, uint32_t aOffset, ErrorResult& aRv)
     return;
   }
 
+  if (!HasSameRoot(aContainer)) {
+    // Return with no error
+    return;
+  }
+
   nsresult res;
   if (!IsValidSelectionPoint(mFrameSelection, &aContainer)) {
     aRv.Throw(NS_ERROR_FAILURE);
@@ -3169,6 +3189,16 @@ Selection::SelectAllChildrenJS(nsINode& aNode, ErrorResult& aRv)
 void
 Selection::SelectAllChildren(nsINode& aNode, ErrorResult& aRv)
 {
+  if (aNode.NodeType() == nsIDOMNode::DOCUMENT_TYPE_NODE) {
+    aRv.Throw(NS_ERROR_DOM_INVALID_NODE_TYPE_ERR);
+    return;
+  }
+
+  if (!HasSameRoot(aNode)) {
+    // Return with no error
+    return;
+  }
+
   if (mFrameSelection) {
     mFrameSelection->PostReason(nsISelectionListener::SELECTALL_REASON);
   }
@@ -3971,6 +4001,12 @@ Selection::SetBaseAndExtent(nsINode& aAnchorNode, uint32_t aAnchorOffset,
     return;
   }
 
+  if (!HasSameRoot(aAnchorNode) ||
+      !HasSameRoot(aFocusNode)) {
+    // Return with no error
+    return;
+  }
+
   SelectionBatcher batch(this);
 
   int32_t relativePosition =
@@ -4211,3 +4247,11 @@ AutoHideSelectionChanges::AutoHideSelectionChanges(const nsFrameSelection* aFram
   : AutoHideSelectionChanges(
       aFrame ? aFrame->GetSelection(SelectionType::eNormal) : nullptr)
 {}
+
+bool
+Selection::HasSameRoot(nsINode& aNode)
+{
+  nsINode* root = aNode.SubtreeRoot();
+  nsIDocument* doc = GetParentObject();
+  return doc == root || (root && doc == root->GetComposedDoc());
+}

dom/base/Selection.h

@@ -282,6 +282,9 @@ class Selection final : public nsISelectionPrivate,
   // Note: DoAutoScroll might destroy arbitrary frames etc.
   nsresult DoAutoScroll(nsIFrame *aFrame, nsPoint& aPoint);
 
+  // We are not allowed to be in nodes whose root is not our document
+  bool HasSameRoot(nsINode& aNode);
+
   // XXX Please don't add additional uses of this method, it's only for
   // XXX supporting broken code (bug 1245883) in the following classes:
   friend class ::nsCopySupport;

editor/libeditor/tests/test_bug537046.html

@@ -23,8 +23,6 @@
 
 /** Test for Bug 537046 **/
 
-SimpleTest.expectAssertions(1);
-
 SimpleTest.waitForExplicitFinish();
 addLoadEvent(function() {
   var ed = document.getElementById("editor");