Limit editor's editability to the correct subtree.

editor/libeditor/nsHTMLEditor.cpp

@@ -3182,12 +3182,33 @@ nsHTMLEditor::ContentInserted(nsIDocument *aDocument, nsIContent* aContainer,
                     eInserted);
 }
 
+bool
+nsHTMLEditor::IsInObservedSubtree(nsIDocument* aDocument,
+                                  nsIContent* aContainer,
+                                  nsIContent* aChild)
+{
+  if (!aChild) {
+    return false;
+  }
+
+  Element* root = GetRoot();
+  // To be super safe here, check both ChromeOnlyAccess and GetBindingParent.
+  // That catches (also unbound) native anonymous content, XBL and ShadowDOM.
+  if (root &&
+      (root->ChromeOnlyAccess() != aChild->ChromeOnlyAccess() ||
+       root->GetBindingParent() != aChild->GetBindingParent())) {
+    return false;
+  }
+
+  return !aChild->ChromeOnlyAccess() && !aChild->GetBindingParent();
+}
+
 void
 nsHTMLEditor::DoContentInserted(nsIDocument* aDocument, nsIContent* aContainer,
                                 nsIContent* aChild, int32_t aIndexInContainer,
                                 InsertedOrAppended aInsertedOrAppended)
 {
-  if (!aChild) {
+  if (!IsInObservedSubtree(aDocument, aContainer, aChild)) {
     return;
   }
 
@@ -3233,6 +3254,10 @@ nsHTMLEditor::ContentRemoved(nsIDocument *aDocument, nsIContent* aContainer,
                              nsIContent* aChild, int32_t aIndexInContainer,
                              nsIContent* aPreviousSibling)
 {
+  if (!IsInObservedSubtree(aDocument, aContainer, aChild)) {
+    return;
+  }
+
   nsCOMPtr<nsIHTMLEditor> kungFuDeathGrip(this);
 
   if (SameCOMIdentity(aChild, mRootElement)) {

editor/libeditor/nsHTMLEditor.h

@@ -806,6 +806,10 @@ protected:
                                     int32_t & aMarginLeft,
                                     int32_t & aMarginTop);
 
+  bool IsInObservedSubtree(nsIDocument* aDocument,
+                           nsIContent* aContainer,
+                           nsIContent* aChild);
+
   /* PACKED BOOLEANS FOR RESIZING, ABSOLUTE POSITIONING AND */
   /* INLINE TABLE EDITING */