Bug 1555786 - Get inner window from doc directly for resize observer. r=smaug

In Notify(), we should guarantee that the inner window we get is for the document, and avoid using null outer window pointer. Differential Revision: https://phabricator.services.mozilla.com/D35727 --HG-- extra : moz-landing-system : lando
2019-06-25 20:07:03 +00:00 · 2019-06-25 20:07:03 +00:00 · 65d67a409f
--- a/dom/base/ResizeObserverController.cpp
+++ b/dom/base/ResizeObserverController.cpp
@ -147,10 +147,7 @@ void ResizeObserverController::Notify() {

    nsEventStatus status = nsEventStatus_eIgnore;

-    nsCOMPtr<nsPIDOMWindowInner> window =
-        doc->GetWindow()->GetCurrentInnerWindow();
-
-    if (window) {
+    if (nsCOMPtr<nsPIDOMWindowInner> window = doc->GetInnerWindow()) {
      nsCOMPtr<nsIScriptGlobalObject> sgo = do_QueryInterface(window);
      MOZ_ASSERT(sgo);

--- a/dom/base/crashtests/1555786.html
+++ b/dom/base/crashtests/1555786.html
@ -0,0 +1,23 @@
+<html>
+<head>
+  <script>
+    function start() {
+      const xhr = new XMLHttpRequest();
+      const observer = new ResizeObserver(entries => {
+        xhr.open('GET', '', false);
+        xhr.send();
+        typeof entries[0].borderBoxSize;
+        typeof entries[0].contentRect;
+        typeof entries[0].borderBoxSize;
+      })
+      observer.observe(document.getElementById('list'), {});
+      window.close();
+    }
+
+    document.addEventListener('DOMContentLoaded', start);
+  </script>
+</head>
+<body>
+  <li class="" id="list">
+</body>
+</html>
--- a/dom/base/crashtests/crashtests.list
+++ b/dom/base/crashtests/crashtests.list
@ -250,3 +250,4 @@ load structured_clone_container_throws.html
 load xhr_empty_datauri.html
 load xhr_html_nullresponse.html
 load xhr-with-pagehide-1.html
+pref(layout.css.resizeobserver.enabled,true) load 1555786.html