Fix for bug 28283. Crash setting window.innerHeight - fixed typo in setter. r=travis, a=chofmann

dom/src/base/nsGlobalWindow.cpp

@@ -883,7 +883,7 @@ NS_IMETHODIMP GlobalWindowImpl::SetInnerHeight(PRInt32 aInnerHeight)
    if(!docShellParent) 
       {
       nsCOMPtr<nsIDocShellTreeOwner> treeOwner;
-      docShellParent->GetTreeOwner(getter_AddRefs(treeOwner));
+      docShellAsItem->GetTreeOwner(getter_AddRefs(treeOwner));
       NS_ENSURE_TRUE(treeOwner, NS_ERROR_FAILURE);
 
       nsCOMPtr<nsIBaseWindow> docShellAsWin(do_QueryInterface(mDocShell));