Bug 1450691: Flushing the parent document can kill our shell. r=xidorn

Bug 1443492 made us flush the parent document for cross-doc getComputedStyle
situations. That can kill the shell we're flushing, let's handle that case
gracefully.

MozReview-Commit-ID: HpFsPQvjKcZ

layout/style/crashtests/1450691.html

@@ -0,0 +1,12 @@
+<script>
+  o0 = document.createElement('iframe');
+  o1 = document.createElement('iframe');
+  document.documentElement.appendChild(o0);
+  o2 = o0.getSVGDocument();
+  o3 = o2.childNodes[0];
+  o3.appendChild(o1);
+  o3.scrollHeight;
+  o3.hidden = true;
+  o4 = window.getComputedStyle(o1.contentDocument.childNodes[0].childNodes[1], ":z");
+  o4.length;
+</script>

layout/style/crashtests/crashtests.list

@@ -272,3 +272,4 @@ load 1426312.html
 load 1439793.html
 load 1409183.html
 pref(dom.webcomponents.shadowdom.enabled,true) load 1445682.html
+load 1450691.html

layout/style/nsComputedDOMStyle.cpp

@@ -858,6 +858,9 @@ nsComputedDOMStyle::UpdateCurrentStyleSources(bool aNeedsLayoutFlush)
     nsContentUtils::GetPresShellForContent(mContent);
   if (presShellForContent && presShellForContent->GetDocument() != document) {
     presShellForContent->GetDocument()->FlushPendingNotifications(FlushType::Style);
+    if (presShellForContent->IsDestroying()) {
+      presShellForContent = nullptr;
+    }
   }
 
   mPresShell = document->GetShell();