The current strategy of looking for controllers based on which interface they implimement is not reliable. When each of the 2 default controllers are created in nsEditingSession::SetupFrameControllers(), the resulting IDs should be obtained by nsIControllers::GetControllerId() and stored as member vars. I suggest adding something like these to nsIEditingSession.idl : readonly attribute nsIBaseEditorController baseEditorController; readonly attribute nsIBaseEditorController composerController; and use nsIControllers::GetControllerById() to get the appropriate controller.
You can't use nsIBaseEditorController in nsIEditingSession. Any interface in a frozen API has itself to be frozen. I'm not sure controllers should be accessible via nsIEditingSession at all; it's polluting this api with unrelated stuff.
Fixed as part of work on bug 174439