Bug 1619857 - Early return from GetOopIframeMetrics in cases where either the presshell or the docshell is being destroyed. r=emilio

I gave up writing crash tests for this since it's quite hard to destroy
an OOP iframe during processing IntersectionObserver's update step in the
OOP process.

Differential Revision: https://phabricator.services.mozilla.com/D65417

--HG--
extra : moz-landing-system : lando

dom/base/DOMIntersectionObserver.cpp

@@ -441,7 +441,7 @@ static Maybe<OopIframeMetrics> GetOopIframeMetrics(Document& aDocument) {
   MOZ_ASSERT(rootDoc && !rootDoc->IsTopLevelContentDocument());
 
   PresShell* rootPresShell = rootDoc->GetPresShell();
-  if (!rootPresShell) {
+  if (!rootPresShell || rootPresShell->IsDestroying()) {
     return Nothing();
   }
 
@@ -450,16 +450,18 @@ static Maybe<OopIframeMetrics> GetOopIframeMetrics(Document& aDocument) {
     return Nothing();
   }
 
+  BrowserChild* browserChild = BrowserChild::GetFrom(rootDoc->GetDocShell());
+  if (!browserChild) {
+    return Nothing();
+  }
+  MOZ_DIAGNOSTIC_ASSERT(!browserChild->IsTopLevel());
+
   nsRect inProcessRootRect;
   if (nsIScrollableFrame* scrollFrame =
           rootPresShell->GetRootScrollFrameAsScrollable()) {
     inProcessRootRect = scrollFrame->GetScrollPortRect();
   }
 
-  nsIDocShell* docShell = rootDoc->GetDocShell();
-  BrowserChild* browserChild = BrowserChild::GetFrom(docShell);
-  MOZ_ASSERT(browserChild && !browserChild->IsTopLevel());
-
   Maybe<LayoutDeviceRect> remoteDocumentVisibleRect =
       browserChild->GetTopLevelViewportVisibleRectInSelfCoords();
   if (!remoteDocumentVisibleRect) {