5 files changed, 23 insertions, 35 deletions
diff --git a/dom/base/CustomElementRegistry.cpp b/dom/base/CustomElementRegistry.cpp
index 20eb59e94..25267f5d3 100644
--- a/dom/base/CustomElementRegistry.cpp
+++ b/dom/base/CustomElementRegistry.cpp
@@ -174,30 +174,6 @@ CustomElementRegistry::IsCustomElementEnabled(JSContext* aCx, JSObject* aObject)
          Preferences::GetBool("dom.webcomponents.enabled");
 }
 
-/* static */ already_AddRefed<CustomElementRegistry>
-CustomElementRegistry::Create(nsPIDOMWindowInner* aWindow)
-{
-  MOZ_ASSERT(aWindow);
-  MOZ_ASSERT(aWindow->IsInnerWindow());
-
-  if (!aWindow->GetDocShell()) {
-    return nullptr;
-  }
-
-  if (!IsCustomElementEnabled()) {
-    return nullptr;
-  }
-
-  RefPtr<CustomElementRegistry> customElementRegistry =
-    new CustomElementRegistry(aWindow);
-
-  if (!customElementRegistry->Init()) {
-    return nullptr;
-  }
-
-  return customElementRegistry.forget();
-}
-
 /* static */ void
 CustomElementRegistry::ProcessTopElementQueue()
 {
@@ -240,6 +216,10 @@ CustomElementRegistry::CustomElementRegistry(nsPIDOMWindowInner* aWindow)
  , mIsCustomDefinitionRunning(false)
  , mIsBackupQueueProcessing(false)
 {
+  MOZ_ASSERT(aWindow);
+  MOZ_ASSERT(aWindow->IsInnerWindow());
+  MOZ_ALWAYS_TRUE(mConstructors.init());
+
   mozilla::HoldJSObjects(this);
 
   if (!sProcessingStack) {
@@ -254,12 +234,6 @@ CustomElementRegistry::~CustomElementRegistry()
   mozilla::DropJSObjects(this);
 }
 
-bool
-CustomElementRegistry::Init()
-{
-  return mConstructors.init();
-}
-
 CustomElementDefinition*
 CustomElementRegistry::LookupCustomElementDefinition(const nsAString& aLocalName,
                                                      const nsAString* aIs) const
diff --git a/dom/base/CustomElementRegistry.h b/dom/base/CustomElementRegistry.h
index b3b4d7c0f..8fdf28289 100644
--- a/dom/base/CustomElementRegistry.h
+++ b/dom/base/CustomElementRegistry.h
@@ -178,11 +178,13 @@ public:
 public:
   static bool IsCustomElementEnabled(JSContext* aCx = nullptr,
                                      JSObject* aObject = nullptr);
-  static already_AddRefed<CustomElementRegistry> Create(nsPIDOMWindowInner* aWindow);
+
   static void ProcessTopElementQueue();
 
   static void XPCOMShutdown();
 
+  explicit CustomElementRegistry(nsPIDOMWindowInner* aWindow);
+
   /**
    * Looking up a custom element definition.
    * https://html.spec.whatwg.org/#look-up-a-custom-element-definition
@@ -227,11 +229,8 @@ public:
   void PopAndInvokeElementQueue();
 
 private:
-  explicit CustomElementRegistry(nsPIDOMWindowInner* aWindow);
   ~CustomElementRegistry();
 
-  bool Init();
-
   /**
    * Registers an unresolved custom element that is a candidate for
    * upgrade when the definition is registered via registerElement.
diff --git a/dom/base/crashtests/1341693.html b/dom/base/crashtests/1341693.html
new file mode 100644
index 000000000..677305ba5
--- /dev/null
+++ b/dom/base/crashtests/1341693.html
@@ -0,0 +1,13 @@
+<!DOCTYPE html>
+<html>
+<body>
+<script>
+  var o1 = document.documentElement;
+  var o2 = document.createElement("frame");
+  document.documentElement.appendChild(o2);
+  var o3 = o2.contentWindow;
+  o1.parentNode.removeChild(o1);
+  o3.customElements;
+</script>
+</body>
+</html>
diff --git a/dom/base/crashtests/crashtests.list b/dom/base/crashtests/crashtests.list
index a0739f074..391557b0e 100644
--- a/dom/base/crashtests/crashtests.list
+++ b/dom/base/crashtests/crashtests.list
@@ -209,3 +209,4 @@ load 1230422.html
 load 1251361.html
 load 1304437.html
 pref(clipboard.autocopy,true) load 1385272-1.html
+pref(dom.webcomponents.enabled,true) load 1341693.html
diff --git a/dom/base/nsGlobalWindow.cpp b/dom/base/nsGlobalWindow.cpp
index dd1fe4586..c965d5b97 100644
--- a/dom/base/nsGlobalWindow.cpp
+++ b/dom/base/nsGlobalWindow.cpp
@@ -4241,8 +4241,9 @@ CustomElementRegistry*
 nsGlobalWindow::CustomElements()
 {
   MOZ_RELEASE_ASSERT(IsInnerWindow());
+
   if (!mCustomElements) {
-      mCustomElements = CustomElementRegistry::Create(AsInner());
+    mCustomElements = new CustomElementRegistry(AsInner());
   }
 
   return mCustomElements;