Looks like the methods in nsHTML***Element calls nsTextControlFrame
which gets editor from nsHTML***Element and takes the necessary data from
There shouldn't be no need for the nsTextControlFrame part
Hmm, well, the editor gets the selection information from layout. Does bug 674820 cover what you were aiming for here?