Previously, we used the obs_documentCreated observer message fired by editor.
However, this is fired when an editor is created anywhere in the document, even if it's for a descendant.
This meant that we were firing an editable state change on the document when a descendant became contentEditable.
In turn, this resulted in the document always having the editable state in the cache if there was a contentEditable descendant.
This message also isn't fired if an editor already exists (e.g. for a contentEditable descendant) and designMode is turned on for the document.
This meant that we wouldn't fire an event in that case, resulting in an incorrect cache.
There is no usable equivalent to detect when designMode is turned off.
While there is obs_documentWillBeDestroyed, that doesn't ever seem to get fired.
This meant that we didn't fire a state change when designMode was turned off, also resulting in an incorrect cache.
To fix all of these issues, we now watch for NS_EVENT_STATE_READWRITE changes on the root element of the document.
Because we use the root element (not the body), this should avoid duplicate state changes for contentEditable changes on the body, which get handled by LocalAccessible::DOMAttributeChanged.
Finally, we previously fired only an editable state change, but changing the editable state of a document also impacts the read-only state.
This too resulted in an incorrect cache.
We now fire a read-only state change as well.