From a17049feac766115812f14b5809d3da683bbff9b Mon Sep 17 00:00:00 2001
From: Peter Van der Beken <peterv@propagandism.org>
Date: Wed, 2 Jan 2019 13:26:56 +0000
Subject: [PATCH] Bug 1353867 - Change WindowProxy type. r=bzbarsky

Add a WindowProxyHolder type and generate binding code that takes or returns it whenever
the WebIDL refers to the WindowProxy type. This patch just makes the WindowProxyHolder
hold a strong reference to a nsPIDOMWindowOuter.

Differential Revision: https://phabricator.services.mozilla.com/D12650

--HG--
extra : moz-landing-system : lando
---
 dom/base/ContentFrameMessageManager.h         |  7 +-
 dom/base/InProcessTabChildMessageManager.cpp  | 10 ++-
 dom/base/InProcessTabChildMessageManager.h    |  3 +-
 dom/base/WindowProxyHolder.h                  | 67 +++++++++++++++++++
 dom/base/moz.build                            |  1 +
 dom/base/nsDocument.cpp                       |  9 +++
 dom/base/nsGlobalWindowInner.cpp              | 15 +++--
 dom/base/nsGlobalWindowInner.h                | 17 ++---
 dom/base/nsGlobalWindowOuter.cpp              | 53 +++++++++------
 dom/base/nsGlobalWindowOuter.h                | 15 ++---
 dom/base/nsIDocument.h                        |  3 +-
 dom/base/nsINode.cpp                          |  2 +-
 dom/base/nsINode.h                            |  2 +-
 dom/base/nsObjectLoadingContent.cpp           |  4 +-
 dom/base/nsObjectLoadingContent.h             |  6 +-
 dom/base/nsWindowRoot.cpp                     |  2 +-
 dom/base/nsWindowRoot.h                       |  2 +-
 dom/bindings/BindingUtils.cpp                 | 11 ++-
 dom/bindings/BindingUtils.h                   | 15 ++---
 dom/bindings/Bindings.conf                    |  3 +-
 dom/bindings/Codegen.py                       | 60 +++++++++++++++--
 dom/browser-element/BrowserElementParent.cpp  |  4 +-
 dom/events/DOMEventTargetHelper.h             |  2 +-
 dom/events/EventTarget.cpp                    | 11 +++
 dom/events/EventTarget.h                      |  6 +-
 dom/events/MessageEvent.cpp                   |  4 +-
 dom/events/UIEvent.h                          |  9 ++-
 dom/html/HTMLObjectElement.cpp                |  7 +-
 dom/html/HTMLObjectElement.h                  |  5 +-
 dom/html/nsGenericHTMLFrameElement.cpp        | 18 +++--
 dom/html/nsGenericHTMLFrameElement.h          | 12 +++-
 dom/html/nsHTMLDocument.cpp                   |  7 +-
 dom/html/nsHTMLDocument.h                     |  5 +-
 dom/ipc/TabChild.cpp                          |  9 ++-
 dom/ipc/TabChild.h                            |  3 +-
 dom/smil/TimeEvent.h                          |  9 ++-
 .../WebBrowserPersistLocalDocument.cpp        |  4 +-
 dom/xul/XULFrameElement.cpp                   | 16 +++--
 dom/xul/XULFrameElement.h                     |  9 ++-
 .../antitracking/AntiTrackingCommon.cpp       |  2 +-
 .../extensions/WebExtensionContentScript.h    |  5 +-
 .../extensions/WebExtensionPolicy.cpp         |  7 +-
 .../extensions/WebExtensionPolicy.h           |  3 +-
 .../sessionstore/nsSessionStoreUtils.cpp      |  2 +-
 44 files changed, 344 insertions(+), 122 deletions(-)
 create mode 100644 dom/base/WindowProxyHolder.h

diff --git a/dom/base/ContentFrameMessageManager.h b/dom/base/ContentFrameMessageManager.h
index d1d529a5a8e6..2591e78cb064 100644
--- a/dom/base/ContentFrameMessageManager.h
+++ b/dom/base/ContentFrameMessageManager.h
@@ -15,6 +15,10 @@
 namespace mozilla {
 namespace dom {
 
+template <typename>
+struct Nullable;
+class WindowProxyHolder;
+
 #define NS_CONTENTFRAMEMESSAGEMANAGER_IID            \
   {                                                  \
     0x97e192a6, 0xab7a, 0x4c8f, {                    \
@@ -33,8 +37,7 @@ class ContentFrameMessageManager : public DOMEventTargetHelper,
 
   NS_DECLARE_STATIC_IID_ACCESSOR(NS_CONTENTFRAMEMESSAGEMANAGER_IID)
 
-  virtual already_AddRefed<nsPIDOMWindowOuter> GetContent(
-      ErrorResult& aError) = 0;
+  virtual Nullable<WindowProxyHolder> GetContent(ErrorResult& aError) = 0;
   virtual already_AddRefed<nsIDocShell> GetDocShell(ErrorResult& aError) = 0;
   virtual already_AddRefed<nsIEventTarget> GetTabEventTarget() = 0;
   virtual uint64_t ChromeOuterWindowID() = 0;
diff --git a/dom/base/InProcessTabChildMessageManager.cpp b/dom/base/InProcessTabChildMessageManager.cpp
index a9ef37bf1666..ef7bff5637d9 100644
--- a/dom/base/InProcessTabChildMessageManager.cpp
+++ b/dom/base/InProcessTabChildMessageManager.cpp
@@ -19,6 +19,7 @@
 #include "mozilla/dom/MessageManagerBinding.h"
 #include "mozilla/dom/SameProcessMessageQueue.h"
 #include "mozilla/dom/ScriptLoader.h"
+#include "mozilla/dom/WindowProxyHolder.h"
 
 using namespace mozilla;
 using namespace mozilla::dom;
@@ -147,13 +148,16 @@ void InProcessTabChildMessageManager::CacheFrameLoader(
   mFrameLoader = aFrameLoader;
 }
 
-already_AddRefed<nsPIDOMWindowOuter>
-InProcessTabChildMessageManager::GetContent(ErrorResult& aError) {
+Nullable<WindowProxyHolder> InProcessTabChildMessageManager::GetContent(
+    ErrorResult& aError) {
   nsCOMPtr<nsPIDOMWindowOuter> content;
   if (mDocShell) {
     content = mDocShell->GetWindow();
   }
-  return content.forget();
+  if (!content) {
+    return nullptr;
+  }
+  return WindowProxyHolder(content);
 }
 
 already_AddRefed<nsIEventTarget>
diff --git a/dom/base/InProcessTabChildMessageManager.h b/dom/base/InProcessTabChildMessageManager.h
index 3c9c74d68c0b..9175b3092a34 100644
--- a/dom/base/InProcessTabChildMessageManager.h
+++ b/dom/base/InProcessTabChildMessageManager.h
@@ -65,8 +65,7 @@ class InProcessTabChildMessageManager final
   virtual JSObject* WrapObject(JSContext* aCx,
                                JS::Handle<JSObject*> aGivenProto) override;
 
-  virtual already_AddRefed<nsPIDOMWindowOuter> GetContent(
-      ErrorResult& aError) override;
+  Nullable<WindowProxyHolder> GetContent(ErrorResult& aError) override;
   virtual already_AddRefed<nsIDocShell> GetDocShell(
       ErrorResult& aError) override {
     nsCOMPtr<nsIDocShell> docShell(mDocShell);
diff --git a/dom/base/WindowProxyHolder.h b/dom/base/WindowProxyHolder.h
new file mode 100644
index 000000000000..dee00fc4183c
--- /dev/null
+++ b/dom/base/WindowProxyHolder.h
@@ -0,0 +1,67 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#ifndef mozilla_dom_WindowProxyHolder_h__
+#define mozilla_dom_WindowProxyHolder_h__
+
+#include "nsPIDOMWindow.h"
+
+namespace mozilla {
+namespace dom {
+
+/**
+ * This class is used for passing arguments and the return value for WebIDL
+ * binding code that takes/returns a WindowProxy object and for WebIDL
+ * unions/dictionaries that contain a WindowProxy member. It should never
+ * contain null; if the value in WebIDL is nullable the binding code will use a
+ * Nullable<WindowProxyHolder>.
+ */
+class WindowProxyHolder {
+ public:
+  WindowProxyHolder() = default;
+  explicit WindowProxyHolder(nsPIDOMWindowOuter* aWin) : mWindow(aWin) {
+    MOZ_ASSERT(mWindow, "Don't set WindowProxyHolder to null.");
+  }
+  explicit WindowProxyHolder(already_AddRefed<nsPIDOMWindowOuter>&& aWin)
+      : mWindow(std::move(aWin)) {
+    MOZ_ASSERT(mWindow, "Don't set WindowProxyHolder to null.");
+  }
+  WindowProxyHolder& operator=(nsPIDOMWindowOuter* aWin) {
+    mWindow = aWin;
+    MOZ_ASSERT(mWindow, "Don't set WindowProxyHolder to null.");
+    return *this;
+  }
+  WindowProxyHolder& operator=(already_AddRefed<nsPIDOMWindowOuter>&& aWin) {
+    mWindow = std::move(aWin);
+    MOZ_ASSERT(mWindow, "Don't set WindowProxyHolder to null.");
+    return *this;
+  }
+
+  nsPIDOMWindowOuter* get() const {
+    MOZ_ASSERT(mWindow, "WindowProxyHolder hasn't been initialized.");
+    return mWindow;
+  }
+
+ private:
+  friend void ImplCycleCollectionUnlink(WindowProxyHolder& aProxy);
+
+  nsCOMPtr<nsPIDOMWindowOuter> mWindow;
+};
+
+inline void ImplCycleCollectionTraverse(
+    nsCycleCollectionTraversalCallback& aCallback, WindowProxyHolder& aProxy,
+    const char* aName, uint32_t aFlags = 0) {
+  CycleCollectionNoteChild(aCallback, aProxy.get(), "mWindow", aFlags);
+}
+
+inline void ImplCycleCollectionUnlink(WindowProxyHolder& aProxy) {
+  aProxy.mWindow = nullptr;
+}
+
+}  // namespace dom
+}  // namespace mozilla
+
+#endif /* mozilla_dom_WindowProxyHolder_h__ */
diff --git a/dom/base/moz.build b/dom/base/moz.build
index 70df15720190..24221b84c57b 100644
--- a/dom/base/moz.build
+++ b/dom/base/moz.build
@@ -235,6 +235,7 @@ EXPORTS.mozilla.dom += [
     'VisualViewport.h',
     'WebKitCSSMatrix.h',
     'WindowOrientationObserver.h',
+    'WindowProxyHolder.h',
 ]
 
 if CONFIG['FUZZING']:
diff --git a/dom/base/nsDocument.cpp b/dom/base/nsDocument.cpp
index 7becb4b62a35..d19b9f55a3cf 100644
--- a/dom/base/nsDocument.cpp
+++ b/dom/base/nsDocument.cpp
@@ -294,6 +294,7 @@
 #include "mozilla/net/ChannelEventQueue.h"
 #include "mozilla/net/RequestContextService.h"
 #include "StorageAccessPermissionRequest.h"
+#include "mozilla/dom/WindowProxyHolder.h"
 
 #define XML_DECLARATION_BITS_DECLARATION_EXISTS (1 << 0)
 #define XML_DECLARATION_BITS_ENCODING_EXISTS (1 << 1)
@@ -3366,6 +3367,14 @@ nsresult nsIDocument::GetSrcdocData(nsAString& aSrcdocData) {
   return NS_OK;
 }
 
+Nullable<WindowProxyHolder> nsIDocument::GetDefaultView() const {
+  nsPIDOMWindowOuter* win = GetWindow();
+  if (!win) {
+    return nullptr;
+  }
+  return WindowProxyHolder(win);
+}
+
 Element* nsIDocument::GetActiveElement() {
   // Get the focused element.
   Element* focusedElement = GetRetargetedFocusedElement();
diff --git a/dom/base/nsGlobalWindowInner.cpp b/dom/base/nsGlobalWindowInner.cpp
index d6cf2971f1b0..327806412f80 100644
--- a/dom/base/nsGlobalWindowInner.cpp
+++ b/dom/base/nsGlobalWindowInner.cpp
@@ -2546,7 +2546,7 @@ bool nsGlobalWindowInner::HasActiveSpeechSynthesis() {
 
 #endif
 
-already_AddRefed<nsPIDOMWindowOuter> nsGlobalWindowInner::GetParent(
+Nullable<WindowProxyHolder> nsGlobalWindowInner::GetParent(
     ErrorResult& aError) {
   FORWARD_TO_OUTER_OR_THROW(GetParentOuter, (), aError, nullptr);
 }
@@ -3306,7 +3306,7 @@ double nsGlobalWindowInner::GetScrollY(ErrorResult& aError) {
 
 uint32_t nsGlobalWindowInner::Length() { FORWARD_TO_OUTER(Length, (), 0); }
 
-already_AddRefed<nsPIDOMWindowOuter> nsGlobalWindowInner::GetTop(
+Nullable<WindowProxyHolder> nsGlobalWindowInner::GetTop(
     mozilla::ErrorResult& aError) {
   FORWARD_TO_OUTER_OR_THROW(GetTopOuter, (), aError, nullptr);
 }
@@ -3684,14 +3684,15 @@ void nsGlobalWindowInner::ReleaseEvents() {
   }
 }
 
-already_AddRefed<nsPIDOMWindowOuter> nsGlobalWindowInner::Open(
-    const nsAString& aUrl, const nsAString& aName, const nsAString& aOptions,
-    ErrorResult& aError) {
+Nullable<WindowProxyHolder> nsGlobalWindowInner::Open(const nsAString& aUrl,
+                                                      const nsAString& aName,
+                                                      const nsAString& aOptions,
+                                                      ErrorResult& aError) {
   FORWARD_TO_OUTER_OR_THROW(OpenOuter, (aUrl, aName, aOptions, aError), aError,
                             nullptr);
 }
 
-already_AddRefed<nsPIDOMWindowOuter> nsGlobalWindowInner::OpenDialog(
+Nullable<WindowProxyHolder> nsGlobalWindowInner::OpenDialog(
     JSContext* aCx, const nsAString& aUrl, const nsAString& aName,
     const nsAString& aOptions, const Sequence<JS::Value>& aExtraArgument,
     ErrorResult& aError) {
@@ -3881,7 +3882,7 @@ void nsGlobalWindowInner::Btoa(const nsAString& aBinaryData,
 // EventTarget
 //*****************************************************************************
 
-nsPIDOMWindowOuter* nsGlobalWindowInner::GetOwnerGlobalForBindings() {
+nsPIDOMWindowOuter* nsGlobalWindowInner::GetOwnerGlobalForBindingsInternal() {
   return nsPIDOMWindowOuter::GetFromCurrentInner(this);
 }
 
diff --git a/dom/base/nsGlobalWindowInner.h b/dom/base/nsGlobalWindowInner.h
index 1d09baa2101f..c19322a309cd 100644
--- a/dom/base/nsGlobalWindowInner.h
+++ b/dom/base/nsGlobalWindowInner.h
@@ -306,7 +306,7 @@ class nsGlobalWindowInner final : public mozilla::dom::EventTarget,
 
   bool ComputeDefaultWantsUntrusted(mozilla::ErrorResult& aRv) final;
 
-  virtual nsPIDOMWindowOuter* GetOwnerGlobalForBindings() override;
+  virtual nsPIDOMWindowOuter* GetOwnerGlobalForBindingsInternal() override;
 
   virtual nsIGlobalObject* GetOwnerGlobal() const override;
 
@@ -623,7 +623,8 @@ class nsGlobalWindowInner final : public mozilla::dom::EventTarget,
   nsDOMWindowList* GetFrames() final;
   already_AddRefed<nsPIDOMWindowOuter> GetFrames(mozilla::ErrorResult& aError);
   uint32_t Length();
-  already_AddRefed<nsPIDOMWindowOuter> GetTop(mozilla::ErrorResult& aError);
+  mozilla::dom::Nullable<mozilla::dom::WindowProxyHolder> GetTop(
+      mozilla::ErrorResult& aError);
 
  protected:
   explicit nsGlobalWindowInner(nsGlobalWindowOuter* aOuterWindow);
@@ -637,15 +638,15 @@ class nsGlobalWindowInner final : public mozilla::dom::EventTarget,
   void SetOpener(JSContext* aCx, JS::Handle<JS::Value> aOpener,
                  mozilla::ErrorResult& aError);
   void GetEvent(JSContext* aCx, JS::MutableHandle<JS::Value> aRetval);
-  already_AddRefed<nsPIDOMWindowOuter> GetParent(mozilla::ErrorResult& aError);
+  mozilla::dom::Nullable<mozilla::dom::WindowProxyHolder> GetParent(
+      mozilla::ErrorResult& aError);
   nsPIDOMWindowOuter* GetScriptableParent() override;
   mozilla::dom::Element* GetFrameElement(nsIPrincipal& aSubjectPrincipal,
                                          mozilla::ErrorResult& aError);
   mozilla::dom::Element* GetFrameElement() override;
-  already_AddRefed<nsPIDOMWindowOuter> Open(const nsAString& aUrl,
-                                            const nsAString& aName,
-                                            const nsAString& aOptions,
-                                            mozilla::ErrorResult& aError);
+  mozilla::dom::Nullable<mozilla::dom::WindowProxyHolder> Open(
+      const nsAString& aUrl, const nsAString& aName, const nsAString& aOptions,
+      mozilla::ErrorResult& aError);
   nsDOMOfflineResourceList* GetApplicationCache(mozilla::ErrorResult& aError);
   nsDOMOfflineResourceList* GetApplicationCache() override;
 
@@ -857,7 +858,7 @@ class nsGlobalWindowInner final : public mozilla::dom::EventTarget,
 
   bool ShouldResistFingerprinting();
 
-  already_AddRefed<nsPIDOMWindowOuter> OpenDialog(
+  mozilla::dom::Nullable<mozilla::dom::WindowProxyHolder> OpenDialog(
       JSContext* aCx, const nsAString& aUrl, const nsAString& aName,
       const nsAString& aOptions,
       const mozilla::dom::Sequence<JS::Value>& aExtraArgument,
diff --git a/dom/base/nsGlobalWindowOuter.cpp b/dom/base/nsGlobalWindowOuter.cpp
index 458de55cb0b6..7c89ce13c0ab 100644
--- a/dom/base/nsGlobalWindowOuter.cpp
+++ b/dom/base/nsGlobalWindowOuter.cpp
@@ -38,6 +38,7 @@
 #include "mozilla/dom/Timeout.h"
 #include "mozilla/dom/TimeoutHandler.h"
 #include "mozilla/dom/TimeoutManager.h"
+#include "mozilla/dom/WindowProxyHolder.h"
 #include "mozilla/IntegerPrintfMacros.h"
 #if defined(MOZ_WIDGET_ANDROID)
 #include "mozilla/dom/WindowOrientationObserver.h"
@@ -2624,19 +2625,13 @@ bool nsPIDOMWindowOuter::GetServiceWorkersTestingEnabled() {
   return topWindow->mServiceWorkersTestingEnabled;
 }
 
-already_AddRefed<nsPIDOMWindowOuter> nsGlobalWindowOuter::GetParentOuter() {
-  if (!mDocShell) {
+Nullable<WindowProxyHolder> nsGlobalWindowOuter::GetParentOuter() {
+  nsPIDOMWindowOuter* parent = GetScriptableParent();
+  if (!parent) {
     return nullptr;
   }
 
-  nsCOMPtr<nsPIDOMWindowOuter> parent;
-  if (mDocShell->GetIsMozBrowser()) {
-    parent = this;
-  } else {
-    parent = GetParent();
-  }
-
-  return parent.forget();
+  return WindowProxyHolder(parent);
 }
 
 /**
@@ -2647,8 +2642,16 @@ already_AddRefed<nsPIDOMWindowOuter> nsGlobalWindowOuter::GetParentOuter() {
  * mozbrowser>, we will return |this| as its own parent.
  */
 nsPIDOMWindowOuter* nsGlobalWindowOuter::GetScriptableParent() {
-  nsCOMPtr<nsPIDOMWindowOuter> parent = GetParentOuter();
-  return parent.get();
+  if (!mDocShell) {
+    return nullptr;
+  }
+
+  if (mDocShell->GetIsMozBrowser()) {
+    return this;
+  }
+
+  nsCOMPtr<nsPIDOMWindowOuter> parent = GetParent();
+  return parent;
 }
 
 /**
@@ -2769,7 +2772,8 @@ already_AddRefed<nsPIDOMWindowOuter> nsGlobalWindowOuter::GetContentInternal(
   // If we're contained in <iframe mozbrowser>, then GetContent is the same as
   // window.top.
   if (mDocShell && mDocShell->GetIsInMozBrowser()) {
-    return GetTopOuter();
+    domWindow = GetScriptableTop();
+    return domWindow.forget();
   }
 
   nsCOMPtr<nsIDocShellTreeItem> primaryContent;
@@ -3550,9 +3554,12 @@ uint32_t nsGlobalWindowOuter::Length() {
   return windows ? windows->GetLength() : 0;
 }
 
-already_AddRefed<nsPIDOMWindowOuter> nsGlobalWindowOuter::GetTopOuter() {
+Nullable<WindowProxyHolder> nsGlobalWindowOuter::GetTopOuter() {
   nsCOMPtr<nsPIDOMWindowOuter> top = GetScriptableTop();
-  return top.forget();
+  if (!top) {
+    return nullptr;
+  }
+  return WindowProxyHolder(top.forget());
 }
 
 nsPIDOMWindowOuter* nsGlobalWindowOuter::GetChildWindow(
@@ -5227,12 +5234,15 @@ void nsGlobalWindowOuter::FireAbuseEvents(
                         aPopupWindowFeatures);
 }
 
-already_AddRefed<nsPIDOMWindowOuter> nsGlobalWindowOuter::OpenOuter(
+Nullable<WindowProxyHolder> nsGlobalWindowOuter::OpenOuter(
     const nsAString& aUrl, const nsAString& aName, const nsAString& aOptions,
     ErrorResult& aError) {
   nsCOMPtr<nsPIDOMWindowOuter> window;
   aError = OpenJS(aUrl, aName, aOptions, getter_AddRefs(window));
-  return window.forget();
+  if (!window) {
+    return nullptr;
+  }
+  return WindowProxyHolder(window.forget());
 }
 
 nsresult nsGlobalWindowOuter::Open(const nsAString& aUrl,
@@ -5302,7 +5312,7 @@ nsresult nsGlobalWindowOuter::OpenDialog(const nsAString& aUrl,
                       _retval);
 }
 
-already_AddRefed<nsPIDOMWindowOuter> nsGlobalWindowOuter::OpenDialogOuter(
+Nullable<WindowProxyHolder> nsGlobalWindowOuter::OpenDialogOuter(
     JSContext* aCx, const nsAString& aUrl, const nsAString& aName,
     const nsAString& aOptions, const Sequence<JS::Value>& aExtraArgument,
     ErrorResult& aError) {
@@ -5325,7 +5335,10 @@ already_AddRefed<nsPIDOMWindowOuter> nsGlobalWindowOuter::OpenDialogOuter(
                         nullptr,             // aLoadState
                         false,               // aForceNoOpener
                         getter_AddRefs(dialog));
-  return dialog.forget();
+  if (!dialog) {
+    return nullptr;
+  }
+  return WindowProxyHolder(dialog.forget());
 }
 
 already_AddRefed<nsPIDOMWindowOuter> nsGlobalWindowOuter::GetFramesOuter() {
@@ -6090,7 +6103,7 @@ bool nsGlobalWindowOuter::FindOuter(const nsAString& aString,
 // EventTarget
 //*****************************************************************************
 
-nsPIDOMWindowOuter* nsGlobalWindowOuter::GetOwnerGlobalForBindings() {
+nsPIDOMWindowOuter* nsGlobalWindowOuter::GetOwnerGlobalForBindingsInternal() {
   return this;
 }
 
diff --git a/dom/base/nsGlobalWindowOuter.h b/dom/base/nsGlobalWindowOuter.h
index 9446c1e47ffa..ffcdae9583a2 100644
--- a/dom/base/nsGlobalWindowOuter.h
+++ b/dom/base/nsGlobalWindowOuter.h
@@ -271,7 +271,7 @@ class nsGlobalWindowOuter final : public mozilla::dom::EventTarget,
 
   bool ComputeDefaultWantsUntrusted(mozilla::ErrorResult& aRv) final;
 
-  virtual nsPIDOMWindowOuter* GetOwnerGlobalForBindings() override;
+  virtual nsPIDOMWindowOuter* GetOwnerGlobalForBindingsInternal() override;
 
   virtual nsIGlobalObject* GetOwnerGlobal() const override;
 
@@ -529,7 +529,7 @@ class nsGlobalWindowOuter final : public mozilla::dom::EventTarget,
   already_AddRefed<nsPIDOMWindowOuter> GetFramesOuter();
   nsDOMWindowList* GetFrames() final;
   uint32_t Length();
-  already_AddRefed<nsPIDOMWindowOuter> GetTopOuter();
+  mozilla::dom::Nullable<mozilla::dom::WindowProxyHolder> GetTopOuter();
 
   nsresult GetPrompter(nsIPrompt** aPrompt) override;
 
@@ -542,16 +542,15 @@ class nsGlobalWindowOuter final : public mozilla::dom::EventTarget,
   nsPIDOMWindowOuter* GetSanitizedOpener(nsPIDOMWindowOuter* aOpener);
 
   already_AddRefed<nsPIDOMWindowOuter> GetOpener() override;
-  already_AddRefed<nsPIDOMWindowOuter> GetParentOuter();
+  mozilla::dom::Nullable<mozilla::dom::WindowProxyHolder> GetParentOuter();
   already_AddRefed<nsPIDOMWindowOuter> GetParent() override;
   nsPIDOMWindowOuter* GetScriptableParent() override;
   nsPIDOMWindowOuter* GetScriptableParentOrNull() override;
   mozilla::dom::Element* GetFrameElementOuter(nsIPrincipal& aSubjectPrincipal);
   mozilla::dom::Element* GetFrameElement() override;
-  already_AddRefed<nsPIDOMWindowOuter> OpenOuter(const nsAString& aUrl,
-                                                 const nsAString& aName,
-                                                 const nsAString& aOptions,
-                                                 mozilla::ErrorResult& aError);
+  mozilla::dom::Nullable<mozilla::dom::WindowProxyHolder> OpenOuter(
+      const nsAString& aUrl, const nsAString& aName, const nsAString& aOptions,
+      mozilla::ErrorResult& aError);
   nsresult Open(const nsAString& aUrl, const nsAString& aName,
                 const nsAString& aOptions, nsDocShellLoadState* aLoadState,
                 bool aForceNoOpener, nsPIDOMWindowOuter** _retval) override;
@@ -615,7 +614,7 @@ class nsGlobalWindowOuter final : public mozilla::dom::EventTarget,
 
   bool ShouldResistFingerprinting();
 
-  already_AddRefed<nsPIDOMWindowOuter> OpenDialogOuter(
+  mozilla::dom::Nullable<mozilla::dom::WindowProxyHolder> OpenDialogOuter(
       JSContext* aCx, const nsAString& aUrl, const nsAString& aName,
       const nsAString& aOptions,
       const mozilla::dom::Sequence<JS::Value>& aExtraArgument,
diff --git a/dom/base/nsIDocument.h b/dom/base/nsIDocument.h
index 589dc4a43839..349cbea44444 100644
--- a/dom/base/nsIDocument.h
+++ b/dom/base/nsIDocument.h
@@ -3079,7 +3079,8 @@ class nsIDocument : public nsINode,
     return GetFuncStringContentList<nsCachableElementsByNameNodeList>(
         this, MatchNameAttribute, nullptr, UseExistingNameString, aName);
   }
-  nsPIDOMWindowOuter* GetDefaultView() const { return GetWindow(); }
+  mozilla::dom::Nullable<mozilla::dom::WindowProxyHolder> GetDefaultView()
+      const;
   Element* GetActiveElement();
   bool HasFocus(mozilla::ErrorResult& rv) const;
   nsIHTMLCollection* Applets();
diff --git a/dom/base/nsINode.cpp b/dom/base/nsINode.cpp
index 0295e5bd3a51..260078572cb5 100644
--- a/dom/base/nsINode.cpp
+++ b/dom/base/nsINode.cpp
@@ -1047,7 +1047,7 @@ EventListenerManager* nsINode::GetExistingListenerManager() const {
   return nsContentUtils::GetExistingListenerManagerForNode(this);
 }
 
-nsPIDOMWindowOuter* nsINode::GetOwnerGlobalForBindings() {
+nsPIDOMWindowOuter* nsINode::GetOwnerGlobalForBindingsInternal() {
   bool dummy;
   auto* window = static_cast<nsGlobalWindowInner*>(
       OwnerDoc()->GetScriptHandlingObject(dummy));
diff --git a/dom/base/nsINode.h b/dom/base/nsINode.h
index c422fffbcb3c..43b46de21109 100644
--- a/dom/base/nsINode.h
+++ b/dom/base/nsINode.h
@@ -944,7 +944,7 @@ class nsINode : public mozilla::dom::EventTarget {
 
   virtual bool IsApzAware() const override;
 
-  virtual nsPIDOMWindowOuter* GetOwnerGlobalForBindings() override;
+  virtual nsPIDOMWindowOuter* GetOwnerGlobalForBindingsInternal() override;
   virtual nsIGlobalObject* GetOwnerGlobal() const override;
 
   using mozilla::dom::EventTarget::DispatchEvent;
diff --git a/dom/base/nsObjectLoadingContent.cpp b/dom/base/nsObjectLoadingContent.cpp
index 205bbeaa2ed4..ecfc0b1566a2 100644
--- a/dom/base/nsObjectLoadingContent.cpp
+++ b/dom/base/nsObjectLoadingContent.cpp
@@ -1077,8 +1077,8 @@ nsObjectLoadingContent::GetFrameLoader() {
   return loader.forget();
 }
 
-void nsObjectLoadingContent::PresetOpenerWindow(mozIDOMWindowProxy* aWindow,
-                                                mozilla::ErrorResult& aRv) {
+void nsObjectLoadingContent::PresetOpenerWindow(
+    const Nullable<WindowProxyHolder>& aOpenerWindow, ErrorResult& aRv) {
   aRv.Throw(NS_ERROR_FAILURE);
 }
 
diff --git a/dom/base/nsObjectLoadingContent.h b/dom/base/nsObjectLoadingContent.h
index 86af042fe9e5..0c5774e35e52 100644
--- a/dom/base/nsObjectLoadingContent.h
+++ b/dom/base/nsObjectLoadingContent.h
@@ -39,6 +39,9 @@ template <typename T>
 class Sequence;
 struct MozPluginParameter;
 class HTMLIFrameElement;
+template <typename T>
+struct Nullable;
+class WindowProxyHolder;
 class XULFrameElement;
 }  // namespace dom
 }  // namespace mozilla
@@ -235,7 +238,8 @@ class nsObjectLoadingContent : public nsImageLoadingContent,
 
   bool IsRewrittenYoutubeEmbed() const { return mRewrittenYoutubeEmbed; }
 
-  void PresetOpenerWindow(mozIDOMWindowProxy* aOpenerWindow,
+  void PresetOpenerWindow(const mozilla::dom::Nullable<
+                              mozilla::dom::WindowProxyHolder>& aOpenerWindow,
                           mozilla::ErrorResult& aRv);
 
  protected:
diff --git a/dom/base/nsWindowRoot.cpp b/dom/base/nsWindowRoot.cpp
index 789800d94a21..1dce0f3b245d 100644
--- a/dom/base/nsWindowRoot.cpp
+++ b/dom/base/nsWindowRoot.cpp
@@ -106,7 +106,7 @@ nsresult nsWindowRoot::PostHandleEvent(EventChainPostVisitor& aVisitor) {
   return NS_OK;
 }
 
-nsPIDOMWindowOuter* nsWindowRoot::GetOwnerGlobalForBindings() {
+nsPIDOMWindowOuter* nsWindowRoot::GetOwnerGlobalForBindingsInternal() {
   return GetWindow();
 }
 
diff --git a/dom/base/nsWindowRoot.h b/dom/base/nsWindowRoot.h
index ef349c81c4ad..a0e0081282f2 100644
--- a/dom/base/nsWindowRoot.h
+++ b/dom/base/nsWindowRoot.h
@@ -60,7 +60,7 @@ class nsWindowRoot final : public nsPIWindowRoot {
   virtual mozilla::dom::EventTarget* GetParentTarget() override {
     return mParent;
   }
-  virtual nsPIDOMWindowOuter* GetOwnerGlobalForBindings() override;
+  virtual nsPIDOMWindowOuter* GetOwnerGlobalForBindingsInternal() override;
   virtual nsIGlobalObject* GetOwnerGlobal() const override;
 
   nsIGlobalObject* GetParentObject();
diff --git a/dom/bindings/BindingUtils.cpp b/dom/bindings/BindingUtils.cpp
index d57f76bedd3e..1d7feb3e2769 100644
--- a/dom/bindings/BindingUtils.cpp
+++ b/dom/bindings/BindingUtils.cpp
@@ -1126,6 +1126,11 @@ bool VariantToJsval(JSContext* aCx, nsIVariant* aVariant,
   return true;
 }
 
+bool WrapObject(JSContext* cx, const WindowProxyHolder& p,
+                JS::MutableHandle<JS::Value> rval) {
+  return ToJSValue(cx, p.get(), rval);
+}
+
 static int CompareIdsAtIndices(const void* aElement1, const void* aElement2,
                                void* aClosure) {
   const uint16_t index1 = *static_cast<const uint16_t*>(aElement1);
@@ -3223,14 +3228,14 @@ nsresult UnwrapArgImpl(JSContext* cx, JS::Handle<JSObject*> src,
   return wrappedJS->QueryInterface(iid, ppArg);
 }
 
-nsresult UnwrapWindowProxyImpl(JSContext* cx, JS::Handle<JSObject*> src,
-                               nsPIDOMWindowOuter** ppArg) {
+nsresult UnwrapWindowProxyArg(JSContext* cx, JS::Handle<JSObject*> src,
+                              WindowProxyHolder& ppArg) {
   nsCOMPtr<nsPIDOMWindowInner> inner;
   nsresult rv = UnwrapArg<nsPIDOMWindowInner>(cx, src, getter_AddRefs(inner));
   NS_ENSURE_SUCCESS(rv, rv);
 
   nsCOMPtr<nsPIDOMWindowOuter> outer = inner->GetOuterWindow();
-  outer.forget(ppArg);
+  ppArg = outer.forget();
   return NS_OK;
 }
 
diff --git a/dom/bindings/BindingUtils.h b/dom/bindings/BindingUtils.h
index 67ff49f224f3..ca0a30969803 100644
--- a/dom/bindings/BindingUtils.h
+++ b/dom/bindings/BindingUtils.h
@@ -54,13 +54,11 @@ class CustomElementReactionsStack;
 class MessageManagerGlobal;
 template <typename KeyType, typename ValueType>
 class Record;
+class WindowProxyHolder;
 
 nsresult UnwrapArgImpl(JSContext* cx, JS::Handle<JSObject*> src,
                        const nsIID& iid, void** ppArg);
 
-nsresult UnwrapWindowProxyImpl(JSContext* cx, JS::Handle<JSObject*> src,
-                               nsPIDOMWindowOuter** ppArg);
-
 /** Convert a jsval to an XPCOM pointer. Caller must not assume that src will
     keep the XPCOM pointer rooted. */
 template <class Interface>
@@ -70,12 +68,8 @@ inline nsresult UnwrapArg(JSContext* cx, JS::Handle<JSObject*> src,
                        reinterpret_cast<void**>(ppArg));
 }
 
-template <>
-inline nsresult UnwrapArg<nsPIDOMWindowOuter>(JSContext* cx,
-                                              JS::Handle<JSObject*> src,
-                                              nsPIDOMWindowOuter** ppArg) {
-  return UnwrapWindowProxyImpl(cx, src, ppArg);
-}
+nsresult UnwrapWindowProxyArg(JSContext* cx, JS::Handle<JSObject*> src,
+                              WindowProxyHolder& ppArg);
 
 bool ThrowInvalidThis(JSContext* aCx, const JS::CallArgs& aArgs,
                       bool aSecurityError, const char* aInterfaceName);
@@ -1424,6 +1418,9 @@ inline bool WrapObject(JSContext* cx, JSObject& p,
   return true;
 }
 
+bool WrapObject(JSContext* cx, const WindowProxyHolder& p,
+                JS::MutableHandle<JS::Value> rval);
+
 // Given an object "p" that inherits from nsISupports, wrap it and return the
 // result.  Null is returned on wrapping failure.  This is somewhat similar to
 // WrapObject() above, but does NOT allow Xrays around the result, since we
diff --git a/dom/bindings/Bindings.conf b/dom/bindings/Bindings.conf
index be271435c915..12099888bfb2 100644
--- a/dom/bindings/Bindings.conf
+++ b/dom/bindings/Bindings.conf
@@ -1487,8 +1487,7 @@ DOMInterfaces = {
 },
 
 'WindowProxy': {
-    'nativeType': 'nsPIDOMWindowOuter',
-    'headerFile': 'nsPIDOMWindow.h',
+    'nativeType': 'mozilla::dom::WindowProxyHolder',
     'concrete': False
 },
 
diff --git a/dom/bindings/Codegen.py b/dom/bindings/Codegen.py
index a620d5009d2a..df73a94f635a 100644
--- a/dom/bindings/Codegen.py
+++ b/dom/bindings/Codegen.py
@@ -1388,6 +1388,11 @@ def UnionTypes(unionTypes, config):
                             # refs, so we'll need the header to handler
                             # those.
                             headers.add(typeDesc.headerFile)
+                        elif typeDesc.interface.identifier.name == "WindowProxy":
+                            # In UnionTypes.h we need to see the declaration of the
+                            # WindowProxyHolder that we use to store the WindowProxy, so
+                            # we have its sizeof and know how big to make our union.
+                            headers.add(typeDesc.headerFile)
                         else:
                             declarations.add((typeDesc.nativeType, False))
                             implheaders.add(typeDesc.headerFile)
@@ -5491,6 +5496,28 @@ def getJSToNativeConversionInfo(type, descriptorProvider, failureCode=None,
                                             declArgs=declArgs,
                                             dealWithOptional=isOptional)
 
+        if descriptor.interface.identifier.name == "WindowProxy":
+            declType = CGGeneric("mozilla::dom::WindowProxyHolder")
+            if type.nullable():
+                declType = CGTemplatedType("Nullable", declType)
+                windowProxyHolderRef = "${declName}.SetValue()"
+            else:
+                windowProxyHolderRef = "${declName}"
+
+            failureCode = onFailureBadType(failureCode, descriptor.interface.identifier.name).define()
+            templateBody = fill("""
+                JS::Rooted<JSObject*> source(cx, &$${val}.toObject());
+                if (NS_FAILED(UnwrapWindowProxyArg(cx, source, ${windowProxyHolderRef}))) {
+                    $*{onFailure}
+                }
+                """,
+                windowProxyHolderRef=windowProxyHolderRef,
+                onFailure=failureCode)
+            templateBody = wrapObjectTemplate(templateBody, type,
+                                              "${declName}.SetNull();\n", failureCode)
+            return JSToNativeConversionInfo(templateBody, declType=declType,
+                                            dealWithOptional=isOptional)
+
         # This is an interface that we implement as a concrete class
         # or an XPCOM interface.
 
@@ -6675,6 +6702,16 @@ def getWrapTemplateForType(type, descriptorProvider, result, successCode,
     if type.isGeckoInterface() and not type.isCallbackInterface():
         descriptor = descriptorProvider.getDescriptor(type.unroll().inner.identifier.name)
         if type.nullable():
+            if descriptor.interface.identifier.name == "WindowProxy":
+                template, infal = getWrapTemplateForType(type.inner, descriptorProvider,
+                                                         "%s.Value()" % result, successCode,
+                                                         returnsNewObject, exceptionCode,
+                                                         spiderMonkeyInterfacesAreStructs)
+                return ("if (%s.IsNull()) {\n" % result +
+                        indent(setNull()) +
+                        "}\n" +
+                        template, infal)
+
             wrappingCode = ("if (!%s) {\n" % (result) +
                             indent(setNull()) +
                             "}\n")
@@ -6996,8 +7033,14 @@ def getRetvalDeclarationForType(returnType, descriptorProvider,
         return result, None, None, None, None
     if returnType.isGeckoInterface() or returnType.isPromise():
         if returnType.isGeckoInterface():
-            typeName = descriptorProvider.getDescriptor(
-                returnType.unroll().inner.identifier.name).nativeType
+            typeName = returnType.unroll().inner.identifier.name
+            if typeName == "WindowProxy":
+                result = CGGeneric("WindowProxyHolder")
+                if returnType.nullable():
+                    result = CGTemplatedType("Nullable", result)
+                return result, None, None, None, None
+
+            typeName = descriptorProvider.getDescriptor(typeName).nativeType
         else:
             typeName = "Promise"
         if isMember:
@@ -9834,11 +9877,13 @@ def getUnionAccessorSignatureType(type, descriptorProvider):
         descriptor = descriptorProvider.getDescriptor(
             type.unroll().inner.identifier.name)
         typeName = CGGeneric(descriptor.nativeType)
-        # Allow null pointers for old-binding classes.
-        if type.unroll().inner.isExternal():
-            typeName = CGWrapper(typeName, post="*")
-        else:
+        if not type.unroll().inner.isExternal():
             typeName = CGWrapper(typeName, post="&")
+        elif descriptor.interface.identifier.name == "WindowProxy":
+            typeName = CGGeneric("WindowProxyHolder const&")
+        else:
+            # Allow null pointers for old-binding classes.
+            typeName = CGWrapper(typeName, post="*")
         return typeName
 
     if type.isSpiderMonkeyInterface():
@@ -14476,6 +14521,9 @@ class CGNativeMember(ClassMethod):
 
         if type.isGeckoInterface() and not type.isCallbackInterface():
             iface = type.unroll().inner
+            if iface.identifier.name == "WindowProxy":
+                return "WindowProxyHolder", True, False
+
             argIsPointer = type.nullable() or iface.isExternal()
             forceOwningType = (iface.isCallback() or isMember)
             if argIsPointer:
diff --git a/dom/browser-element/BrowserElementParent.cpp b/dom/browser-element/BrowserElementParent.cpp
index 677f1e9c9982..3cc5c1a2e9ae 100644
--- a/dom/browser-element/BrowserElementParent.cpp
+++ b/dom/browser-element/BrowserElementParent.cpp
@@ -18,6 +18,7 @@
 #include "mozilla/EventDispatcher.h"
 #include "mozilla/dom/HTMLIFrameElement.h"
 #include "mozilla/dom/ToJSValue.h"
+#include "mozilla/dom/WindowProxyHolder.h"
 #include "nsIInterfaceRequestorUtils.h"
 #include "nsVariant.h"
 #include "mozilla/dom/BrowserElementDictionariesBinding.h"
@@ -234,7 +235,8 @@ BrowserElementParent::OpenWindowInProcess(nsPIDOMWindowOuter* aOpenerWindow,
 
   if (!aForceNoOpener) {
     ErrorResult res;
-    popupFrameElement->PresetOpenerWindow(aOpenerWindow, res);
+    popupFrameElement->PresetOpenerWindow(WindowProxyHolder(aOpenerWindow),
+                                          res);
     MOZ_ASSERT(!res.Failed());
   }
 
diff --git a/dom/events/DOMEventTargetHelper.h b/dom/events/DOMEventTargetHelper.h
index be8bc1ed22c8..eade90474310 100644
--- a/dom/events/DOMEventTargetHelper.h
+++ b/dom/events/DOMEventTargetHelper.h
@@ -128,7 +128,7 @@ class DOMEventTargetHelper : public dom::EventTarget,
     return mListenerManager && mListenerManager->HasListenersFor(aTypeWithOn);
   }
 
-  virtual nsPIDOMWindowOuter* GetOwnerGlobalForBindings() override {
+  virtual nsPIDOMWindowOuter* GetOwnerGlobalForBindingsInternal() override {
     return nsPIDOMWindowOuter::GetFromCurrentInner(GetOwner());
   }
 
diff --git a/dom/events/EventTarget.cpp b/dom/events/EventTarget.cpp
index f4092c0f779f..5d84c92845d0 100644
--- a/dom/events/EventTarget.cpp
+++ b/dom/events/EventTarget.cpp
@@ -8,6 +8,8 @@
 #include "mozilla/dom/EventTarget.h"
 #include "mozilla/dom/EventTargetBinding.h"
 #include "mozilla/dom/ConstructibleEventTarget.h"
+#include "mozilla/dom/Nullable.h"
+#include "mozilla/dom/WindowProxyHolder.h"
 #include "nsIGlobalObject.h"
 #include "nsThreadUtils.h"
 
@@ -182,5 +184,14 @@ void EventTarget::DispatchEvent(Event& aEvent, ErrorResult& aRv) {
   Unused << DispatchEvent(aEvent, CallerType::NonSystem, IgnoreErrors());
 }
 
+Nullable<WindowProxyHolder> EventTarget::GetOwnerGlobalForBindings() {
+  nsPIDOMWindowOuter* win = GetOwnerGlobalForBindingsInternal();
+  if (!win) {
+    return nullptr;
+  }
+
+  return WindowProxyHolder(win);
+}
+
 }  // namespace dom
 }  // namespace mozilla
diff --git a/dom/events/EventTarget.h b/dom/events/EventTarget.h
index 58b635b52041..189e2742b53e 100644
--- a/dom/events/EventTarget.h
+++ b/dom/events/EventTarget.h
@@ -34,6 +34,9 @@ class EventListener;
 class EventListenerOptionsOrBoolean;
 class EventHandlerNonNull;
 class GlobalObject;
+template <typename>
+struct Nullable;
+class WindowProxyHolder;
 
 // IID for the dom::EventTarget interface
 #define NS_EVENTTARGET_IID                           \
@@ -175,7 +178,8 @@ class EventTarget : public nsISupports, public nsWrapperCache {
   // Returns an outer window that corresponds to the inner window this event
   // target is associated with.  Will return null if the inner window is not the
   // current inner or if there is no window around at all.
-  virtual nsPIDOMWindowOuter* GetOwnerGlobalForBindings() = 0;
+  Nullable<WindowProxyHolder> GetOwnerGlobalForBindings();
+  virtual nsPIDOMWindowOuter* GetOwnerGlobalForBindingsInternal() = 0;
 
   // The global object this event target is associated with, if any.
   // This may be an inner window or some other global object.  This
diff --git a/dom/events/MessageEvent.cpp b/dom/events/MessageEvent.cpp
index 9ef41279be0f..09a53eee8bf2 100644
--- a/dom/events/MessageEvent.cpp
+++ b/dom/events/MessageEvent.cpp
@@ -108,7 +108,7 @@ void MessageEvent::GetSource(
 
   if (!aParam.mSource.IsNull()) {
     if (aParam.mSource.Value().IsWindowProxy()) {
-      event->mWindowSource = aParam.mSource.Value().GetAsWindowProxy();
+      event->mWindowSource = aParam.mSource.Value().GetAsWindowProxy().get();
     } else if (aParam.mSource.Value().IsMessagePort()) {
       event->mPortSource = aParam.mSource.Value().GetAsMessagePort();
     } else {
@@ -144,7 +144,7 @@ void MessageEvent::InitMessageEvent(
 
   if (!aSource.IsNull()) {
     if (aSource.Value().IsWindowProxy()) {
-      mWindowSource = aSource.Value().GetAsWindowProxy();
+      mWindowSource = aSource.Value().GetAsWindowProxy().get();
     } else if (aSource.Value().IsMessagePort()) {
       mPortSource = &aSource.Value().GetAsMessagePort();
     } else {
diff --git a/dom/events/UIEvent.h b/dom/events/UIEvent.h
index a3cfc85f8057..929128e7c46c 100644
--- a/dom/events/UIEvent.h
+++ b/dom/events/UIEvent.h
@@ -9,7 +9,9 @@
 
 #include "mozilla/Attributes.h"
 #include "mozilla/dom/Event.h"
+#include "mozilla/dom/Nullable.h"
 #include "mozilla/dom/UIEventBinding.h"
+#include "mozilla/dom/WindowProxyHolder.h"
 #include "nsDeviceContext.h"
 #include "nsLayoutUtils.h"
 #include "nsPresContext.h"
@@ -47,7 +49,12 @@ class UIEvent : public Event {
                    bool cancelableArg, nsGlobalWindowInner* viewArg,
                    int32_t detailArg);
 
-  nsPIDOMWindowOuter* GetView() const { return mView; }
+  Nullable<WindowProxyHolder> GetView() const {
+    if (!mView) {
+      return nullptr;
+    }
+    return WindowProxyHolder(mView);
+  }
 
   int32_t Detail() const { return mDetail; }
 
diff --git a/dom/html/HTMLObjectElement.cpp b/dom/html/HTMLObjectElement.cpp
index cd3941f369a5..42f7fb43de4f 100644
--- a/dom/html/HTMLObjectElement.cpp
+++ b/dom/html/HTMLObjectElement.cpp
@@ -374,11 +374,14 @@ int32_t HTMLObjectElement::TabIndexDefault() {
   return IsFocusableForTabIndex() ? 0 : -1;
 }
 
-nsPIDOMWindowOuter* HTMLObjectElement::GetContentWindow(
+Nullable<WindowProxyHolder> HTMLObjectElement::GetContentWindow(
     nsIPrincipal& aSubjectPrincipal) {
   nsIDocument* doc = GetContentDocument(aSubjectPrincipal);
   if (doc) {
-    return doc->GetWindow();
+    nsPIDOMWindowOuter* win = doc->GetWindow();
+    if (win) {
+      return WindowProxyHolder(win);
+    }
   }
 
   return nullptr;
diff --git a/dom/html/HTMLObjectElement.h b/dom/html/HTMLObjectElement.h
index e3714340ba55..5c9642e7fe20 100644
--- a/dom/html/HTMLObjectElement.h
+++ b/dom/html/HTMLObjectElement.h
@@ -16,6 +16,9 @@ namespace mozilla {
 namespace dom {
 
 class HTMLFormSubmission;
+template <typename T>
+struct Nullable;
+class WindowProxyHolder;
 
 class HTMLObjectElement final : public nsGenericHTMLFormElement,
                                 public nsObjectLoadingContent,
@@ -121,7 +124,7 @@ class HTMLObjectElement final : public nsGenericHTMLFormElement,
   }
   using nsObjectLoadingContent::GetContentDocument;
 
-  nsPIDOMWindowOuter* GetContentWindow(nsIPrincipal& aSubjectPrincipal);
+  Nullable<WindowProxyHolder> GetContentWindow(nsIPrincipal& aSubjectPrincipal);
 
   using nsIConstraintValidation::GetValidationMessage;
   using nsIConstraintValidation::SetCustomValidity;
diff --git a/dom/html/nsGenericHTMLFrameElement.cpp b/dom/html/nsGenericHTMLFrameElement.cpp
index 5daac948c789..5db66252d5e1 100644
--- a/dom/html/nsGenericHTMLFrameElement.cpp
+++ b/dom/html/nsGenericHTMLFrameElement.cpp
@@ -71,7 +71,7 @@ nsGenericHTMLFrameElement::~nsGenericHTMLFrameElement() {
 
 nsIDocument* nsGenericHTMLFrameElement::GetContentDocument(
     nsIPrincipal& aSubjectPrincipal) {
-  nsCOMPtr<nsPIDOMWindowOuter> win = GetContentWindow();
+  nsCOMPtr<nsPIDOMWindowOuter> win = GetContentWindowInternal();
   if (!win) {
     return nullptr;
   }
@@ -89,7 +89,7 @@ nsIDocument* nsGenericHTMLFrameElement::GetContentDocument(
 }
 
 already_AddRefed<nsPIDOMWindowOuter>
-nsGenericHTMLFrameElement::GetContentWindow() {
+nsGenericHTMLFrameElement::GetContentWindowInternal() {
   EnsureFrameLoader();
 
   if (!mFrameLoader) {
@@ -107,12 +107,15 @@ nsGenericHTMLFrameElement::GetContentWindow() {
   }
 
   nsCOMPtr<nsPIDOMWindowOuter> win = doc_shell->GetWindow();
+  return win.forget();
+}
 
+Nullable<WindowProxyHolder> nsGenericHTMLFrameElement::GetContentWindow() {
+  nsCOMPtr<nsPIDOMWindowOuter> win = GetContentWindowInternal();
   if (!win) {
     return nullptr;
   }
-
-  return win.forget();
+  return WindowProxyHolder(win.forget());
 }
 
 void nsGenericHTMLFrameElement::EnsureFrameLoader() {
@@ -150,10 +153,11 @@ nsGenericHTMLFrameElement::GetFrameLoader() {
   return loader.forget();
 }
 
-void nsGenericHTMLFrameElement::PresetOpenerWindow(mozIDOMWindowProxy* aWindow,
-                                                   ErrorResult& aRv) {
+void nsGenericHTMLFrameElement::PresetOpenerWindow(
+    const Nullable<WindowProxyHolder>& aOpenerWindow, ErrorResult& aRv) {
   MOZ_ASSERT(!mFrameLoader);
-  mOpenerWindow = nsPIDOMWindowOuter::From(aWindow);
+  mOpenerWindow =
+      aOpenerWindow.IsNull() ? nullptr : aOpenerWindow.Value().get();
 }
 
 void nsGenericHTMLFrameElement::InternalSetFrameLoader(
diff --git a/dom/html/nsGenericHTMLFrameElement.h b/dom/html/nsGenericHTMLFrameElement.h
index efa4d4630b80..89a4f2ad3d76 100644
--- a/dom/html/nsGenericHTMLFrameElement.h
+++ b/dom/html/nsGenericHTMLFrameElement.h
@@ -19,8 +19,11 @@
 
 namespace mozilla {
 namespace dom {
+template <typename>
+struct Nullable;
+class WindowProxyHolder;
 class XULFrameElement;
-}
+}  // namespace dom
 }  // namespace mozilla
 
 #define NS_GENERICHTMLFRAMEELEMENT_IID               \
@@ -84,7 +87,8 @@ class nsGenericHTMLFrameElement : public nsGenericHTMLElement,
   void SwapFrameLoaders(nsIFrameLoaderOwner* aOtherLoaderOwner,
                         mozilla::ErrorResult& rv);
 
-  void PresetOpenerWindow(mozIDOMWindowProxy* aOpenerWindow,
+  void PresetOpenerWindow(const mozilla::dom::Nullable<
+                              mozilla::dom::WindowProxyHolder>& aOpenerWindow,
                           mozilla::ErrorResult& aRv);
 
   static void InitStatics();
@@ -112,7 +116,7 @@ class nsGenericHTMLFrameElement : public nsGenericHTMLElement,
   void EnsureFrameLoader();
   void LoadSrc();
   nsIDocument* GetContentDocument(nsIPrincipal& aSubjectPrincipal);
-  already_AddRefed<nsPIDOMWindowOuter> GetContentWindow();
+  mozilla::dom::Nullable<mozilla::dom::WindowProxyHolder> GetContentWindow();
 
   virtual nsresult AfterSetAttr(int32_t aNameSpaceID, nsAtom* aName,
                                 const nsAttrValue* aValue,
@@ -165,6 +169,8 @@ class nsGenericHTMLFrameElement : public nsGenericHTMLElement,
                             const nsAttrValueOrString* aValue,
                             nsIPrincipal* aMaybeScriptedPrincipal,
                             bool aNotify);
+
+  already_AddRefed<nsPIDOMWindowOuter> GetContentWindowInternal();
 };
 
 NS_DEFINE_STATIC_IID_ACCESSOR(nsGenericHTMLFrameElement,
diff --git a/dom/html/nsHTMLDocument.cpp b/dom/html/nsHTMLDocument.cpp
index 1c839aa380e4..2be615fa53a4 100644
--- a/dom/html/nsHTMLDocument.cpp
+++ b/dom/html/nsHTMLDocument.cpp
@@ -1138,7 +1138,7 @@ void nsHTMLDocument::SetCookie(const nsAString& aCookie, ErrorResult& rv) {
   }
 }
 
-already_AddRefed<nsPIDOMWindowOuter> nsHTMLDocument::Open(
+mozilla::dom::Nullable<mozilla::dom::WindowProxyHolder> nsHTMLDocument::Open(
     JSContext* /* unused */, const nsAString& aURL, const nsAString& aName,
     const nsAString& aFeatures, bool aReplace, ErrorResult& rv) {
   MOZ_ASSERT(nsContentUtils::CanCallerAccess(this),
@@ -1159,7 +1159,10 @@ already_AddRefed<nsPIDOMWindowOuter> nsHTMLDocument::Open(
   nsCOMPtr<nsPIDOMWindowOuter> newWindow;
   // XXXbz We ignore aReplace for now.
   rv = win->OpenJS(aURL, aName, aFeatures, getter_AddRefs(newWindow));
-  return newWindow.forget();
+  if (!newWindow) {
+    return nullptr;
+  }
+  return WindowProxyHolder(newWindow.forget());
 }
 
 already_AddRefed<nsIDocument> nsHTMLDocument::Open(
diff --git a/dom/html/nsHTMLDocument.h b/dom/html/nsHTMLDocument.h
index 2d706f179f76..5b801e806735 100644
--- a/dom/html/nsHTMLDocument.h
+++ b/dom/html/nsHTMLDocument.h
@@ -30,6 +30,9 @@ class nsILoadGroup;
 namespace mozilla {
 namespace dom {
 class HTMLAllCollection;
+template <typename T>
+struct Nullable;
+class WindowProxyHolder;
 }  // namespace dom
 }  // namespace mozilla
 
@@ -150,7 +153,7 @@ class nsHTMLDocument : public nsIDocument, public nsIHTMLDocument {
   already_AddRefed<nsIDocument> Open(
       JSContext* cx, const mozilla::dom::Optional<nsAString>& /* unused */,
       const nsAString& aReplace, mozilla::ErrorResult& aError);
-  already_AddRefed<nsPIDOMWindowOuter> Open(
+  mozilla::dom::Nullable<mozilla::dom::WindowProxyHolder> Open(
       JSContext* cx, const nsAString& aURL, const nsAString& aName,
       const nsAString& aFeatures, bool aReplace, mozilla::ErrorResult& rv);
   void Close(mozilla::ErrorResult& rv);
diff --git a/dom/ipc/TabChild.cpp b/dom/ipc/TabChild.cpp
index a2a4b73475b3..e332004bc443 100644
--- a/dom/ipc/TabChild.cpp
+++ b/dom/ipc/TabChild.cpp
@@ -25,7 +25,9 @@
 #include "mozilla/dom/indexedDB/PIndexedDBPermissionRequestChild.h"
 #include "mozilla/dom/MessageManagerBinding.h"
 #include "mozilla/dom/MouseEventBinding.h"
+#include "mozilla/dom/Nullable.h"
 #include "mozilla/dom/PaymentRequestChild.h"
+#include "mozilla/dom/WindowProxyHolder.h"
 #include "mozilla/gfx/CrossProcessPaint.h"
 #include "mozilla/IMEStateManager.h"
 #include "mozilla/ipc/URIUtils.h"
@@ -3259,7 +3261,7 @@ void TabChildMessageManager::MarkForCC() {
   MessageManagerGlobal::MarkForCC();
 }
 
-already_AddRefed<nsPIDOMWindowOuter> TabChildMessageManager::GetContent(
+Nullable<WindowProxyHolder> TabChildMessageManager::GetContent(
     ErrorResult& aError) {
   if (!mTabChild) {
     aError.Throw(NS_ERROR_NULL_POINTER);
@@ -3267,7 +3269,10 @@ already_AddRefed<nsPIDOMWindowOuter> TabChildMessageManager::GetContent(
   }
   nsCOMPtr<nsPIDOMWindowOuter> window =
       do_GetInterface(mTabChild->WebNavigation());
-  return window.forget();
+  if (!window) {
+    return nullptr;
+  }
+  return WindowProxyHolder(window.forget());
 }
 
 already_AddRefed<nsIDocShell> TabChildMessageManager::GetDocShell(
diff --git a/dom/ipc/TabChild.h b/dom/ipc/TabChild.h
index f295240573f6..ca128ac025b4 100644
--- a/dom/ipc/TabChild.h
+++ b/dom/ipc/TabChild.h
@@ -94,8 +94,7 @@ class TabChildMessageManager : public ContentFrameMessageManager,
   JSObject* WrapObject(JSContext* aCx,
                        JS::Handle<JSObject*> aGivenProto) override;
 
-  virtual already_AddRefed<nsPIDOMWindowOuter> GetContent(
-      ErrorResult& aError) override;
+  virtual Nullable<WindowProxyHolder> GetContent(ErrorResult& aError) override;
   virtual already_AddRefed<nsIDocShell> GetDocShell(
       ErrorResult& aError) override;
   virtual already_AddRefed<nsIEventTarget> GetTabEventTarget() override;
diff --git a/dom/smil/TimeEvent.h b/dom/smil/TimeEvent.h
index bf9696daabe9..c1a365794e11 100644
--- a/dom/smil/TimeEvent.h
+++ b/dom/smil/TimeEvent.h
@@ -9,6 +9,8 @@
 
 #include "mozilla/dom/Event.h"
 #include "mozilla/dom/TimeEventBinding.h"
+#include "mozilla/dom/Nullable.h"
+#include "mozilla/dom/WindowProxyHolder.h"
 
 class nsGlobalWindowInner;
 
@@ -34,7 +36,12 @@ class TimeEvent final : public Event {
 
   int32_t Detail() const { return mDetail; }
 
-  nsPIDOMWindowOuter* GetView() const { return mView; }
+  Nullable<WindowProxyHolder> GetView() const {
+    if (!mView) {
+      return nullptr;
+    }
+    return WindowProxyHolder(mView);
+  }
 
   TimeEvent* AsTimeEvent() final { return this; }
 
diff --git a/dom/webbrowserpersist/WebBrowserPersistLocalDocument.cpp b/dom/webbrowserpersist/WebBrowserPersistLocalDocument.cpp
index 739ddc44fc0d..8d9b8b1bf4f9 100644
--- a/dom/webbrowserpersist/WebBrowserPersistLocalDocument.cpp
+++ b/dom/webbrowserpersist/WebBrowserPersistLocalDocument.cpp
@@ -133,7 +133,7 @@ WebBrowserPersistLocalDocument::GetReferrer(nsAString& aReferrer) {
 
 NS_IMETHODIMP
 WebBrowserPersistLocalDocument::GetContentDisposition(nsAString& aCD) {
-  nsCOMPtr<nsPIDOMWindowOuter> window = mDocument->GetDefaultView();
+  nsCOMPtr<nsPIDOMWindowOuter> window = mDocument->GetWindow();
   if (NS_WARN_IF(!window)) {
     aCD.SetIsVoid(true);
     return NS_OK;
@@ -176,7 +176,7 @@ WebBrowserPersistLocalDocument::GetPrincipal(nsIPrincipal** aPrincipal) {
 }
 
 already_AddRefed<nsISHEntry> WebBrowserPersistLocalDocument::GetHistory() {
-  nsCOMPtr<nsPIDOMWindowOuter> window = mDocument->GetDefaultView();
+  nsCOMPtr<nsPIDOMWindowOuter> window = mDocument->GetWindow();
   if (NS_WARN_IF(!window)) {
     return nullptr;
   }
diff --git a/dom/xul/XULFrameElement.cpp b/dom/xul/XULFrameElement.cpp
index 328ba7eedf88..252b13eb0695 100644
--- a/dom/xul/XULFrameElement.cpp
+++ b/dom/xul/XULFrameElement.cpp
@@ -48,19 +48,27 @@ already_AddRefed<nsIWebNavigation> XULFrameElement::GetWebNavigation() {
   return webnav.forget();
 }
 
-already_AddRefed<nsPIDOMWindowOuter> XULFrameElement::GetContentWindow() {
+Nullable<WindowProxyHolder> XULFrameElement::GetContentWindow() {
   nsCOMPtr<nsIDocShell> docShell = GetDocShell();
   if (docShell) {
     nsCOMPtr<nsPIDOMWindowOuter> win = docShell->GetWindow();
-    return win.forget();
+    if (win) {
+      return WindowProxyHolder(win.forget());
+    }
   }
 
   return nullptr;
 }
 
 nsIDocument* XULFrameElement::GetContentDocument() {
-  nsCOMPtr<nsPIDOMWindowOuter> win = GetContentWindow();
-  return win ? win->GetDoc() : nullptr;
+  nsCOMPtr<nsIDocShell> docShell = GetDocShell();
+  if (docShell) {
+    nsCOMPtr<nsPIDOMWindowOuter> win = docShell->GetWindow();
+    if (win) {
+      return win->GetDoc();
+    }
+  }
+  return nullptr;
 }
 
 void XULFrameElement::LoadSrc() {
diff --git a/dom/xul/XULFrameElement.h b/dom/xul/XULFrameElement.h
index 097e053a0ba9..49c72c72a99f 100644
--- a/dom/xul/XULFrameElement.h
+++ b/dom/xul/XULFrameElement.h
@@ -9,6 +9,8 @@
 
 #include "mozilla/Attributes.h"
 #include "mozilla/ErrorResult.h"
+#include "mozilla/dom/Nullable.h"
+#include "mozilla/dom/WindowProxyHolder.h"
 #include "js/TypeDecls.h"
 #include "nsCycleCollectionParticipant.h"
 #include "nsWrapperCache.h"
@@ -32,7 +34,7 @@ class XULFrameElement final : public nsXULElement, public nsIFrameLoaderOwner {
   // XULFrameElement.webidl
   nsIDocShell* GetDocShell();
   already_AddRefed<nsIWebNavigation> GetWebNavigation();
-  already_AddRefed<nsPIDOMWindowOuter> GetContentWindow();
+  Nullable<WindowProxyHolder> GetContentWindow();
   nsIDocument* GetContentDocument();
 
   // nsIFrameLoaderOwner / MozFrameLoaderOwner
@@ -45,8 +47,9 @@ class XULFrameElement final : public nsXULElement, public nsIFrameLoaderOwner {
     mFrameLoader = aFrameLoader;
   }
 
-  void PresetOpenerWindow(mozIDOMWindowProxy* aWindow, ErrorResult& aRv) {
-    mOpener = do_QueryInterface(aWindow);
+  void PresetOpenerWindow(const Nullable<WindowProxyHolder>& aWindow,
+                          ErrorResult& aRv) {
+    mOpener = aWindow.IsNull() ? nullptr : aWindow.Value().get();
   }
 
   void SwapFrameLoaders(mozilla::dom::HTMLIFrameElement& aOtherLoaderOwner,
diff --git a/toolkit/components/antitracking/AntiTrackingCommon.cpp b/toolkit/components/antitracking/AntiTrackingCommon.cpp
index 23ab5abf551a..e9ba6c26c9b8 100644
--- a/toolkit/components/antitracking/AntiTrackingCommon.cpp
+++ b/toolkit/components/antitracking/AntiTrackingCommon.cpp
@@ -396,7 +396,7 @@ already_AddRefed<nsPIDOMWindowOuter> GetTopWindow(nsPIDOMWindowInner* aWindow) {
   nsCOMPtr<nsPIDOMWindowOuter> pwin;
   auto* outer = nsGlobalWindowOuter::Cast(aWindow->GetOuterWindow());
   if (outer) {
-    pwin = outer->GetTopOuter();
+    pwin = outer->GetScriptableTop();
   }
 
   if (!pwin) {
diff --git a/toolkit/components/extensions/WebExtensionContentScript.h b/toolkit/components/extensions/WebExtensionContentScript.h
index efbb8268147b..2a15943b5c0d 100644
--- a/toolkit/components/extensions/WebExtensionContentScript.h
+++ b/toolkit/components/extensions/WebExtensionContentScript.h
@@ -13,6 +13,7 @@
 
 #include "mozilla/Maybe.h"
 #include "mozilla/Variant.h"
+#include "mozilla/dom/WindowProxyHolder.h"
 #include "mozilla/extensions/MatchGlob.h"
 #include "mozilla/extensions/MatchPattern.h"
 #include "nsCOMPtr.h"
@@ -113,8 +114,8 @@ class MozDocumentMatcher : public nsISupports, public nsWrapperCache {
   bool MatchesLoadInfo(const URLInfo& aURL, nsILoadInfo* aLoadInfo) const {
     return Matches({aURL, aLoadInfo});
   }
-  bool MatchesWindow(nsPIDOMWindowOuter* aWindow) const {
-    return Matches(aWindow);
+  bool MatchesWindow(const dom::WindowProxyHolder& aWindow) const {
+    return Matches(aWindow.get());
   }
 
   WebExtensionPolicy* GetExtension() { return mExtension; }
diff --git a/toolkit/components/extensions/WebExtensionPolicy.cpp b/toolkit/components/extensions/WebExtensionPolicy.cpp
index 9c66bd471a47..008f72958146 100644
--- a/toolkit/components/extensions/WebExtensionPolicy.cpp
+++ b/toolkit/components/extensions/WebExtensionPolicy.cpp
@@ -445,12 +445,13 @@ bool WebExtensionPolicy::CanAccessContext(nsILoadContext* aContext) const {
   return mPrivateBrowsingAllowed || !aContext->UsePrivateBrowsing();
 }
 
-bool WebExtensionPolicy::CanAccessWindow(nsPIDOMWindowOuter* aWindow) const {
+bool WebExtensionPolicy::CanAccessWindow(
+    const dom::WindowProxyHolder& aWindow) const {
   if (mPrivateBrowsingAllowed) {
     return true;
   }
   // match browsing mode with policy
-  nsIDocShell* docShell = aWindow->GetDocShell();
+  nsIDocShell* docShell = aWindow.get()->GetDocShell();
   nsCOMPtr<nsILoadContext> loadContext = do_QueryInterface(docShell);
   return !(loadContext && loadContext->UsePrivateBrowsing());
 }
@@ -674,7 +675,7 @@ void DocumentObserver::Disconnect() {
 void DocumentObserver::NotifyMatch(MozDocumentMatcher& aMatcher,
                                    nsPIDOMWindowOuter* aWindow) {
   IgnoredErrorResult rv;
-  mCallbacks->OnNewDocument(aMatcher, aWindow, rv);
+  mCallbacks->OnNewDocument(aMatcher, dom::WindowProxyHolder(aWindow), rv);
 }
 
 void DocumentObserver::NotifyMatch(MozDocumentMatcher& aMatcher,
diff --git a/toolkit/components/extensions/WebExtensionPolicy.h b/toolkit/components/extensions/WebExtensionPolicy.h
index f82a2643df5e..176dd715c526 100644
--- a/toolkit/components/extensions/WebExtensionPolicy.h
+++ b/toolkit/components/extensions/WebExtensionPolicy.h
@@ -9,6 +9,7 @@
 #include "mozilla/dom/BindingDeclarations.h"
 #include "mozilla/dom/Nullable.h"
 #include "mozilla/dom/WebExtensionPolicyBinding.h"
+#include "mozilla/dom/WindowProxyHolder.h"
 #include "mozilla/extensions/MatchPattern.h"
 
 #include "jspubtd.h"
@@ -128,7 +129,7 @@ class WebExtensionPolicy final : public nsISupports,
 
   bool CanAccessContext(nsILoadContext* aContext) const;
 
-  bool CanAccessWindow(nsPIDOMWindowOuter* aWindow) const;
+  bool CanAccessWindow(const dom::WindowProxyHolder& aWindow) const;
 
   static void GetActiveExtensions(
       dom::GlobalObject& aGlobal,
diff --git a/toolkit/components/sessionstore/nsSessionStoreUtils.cpp b/toolkit/components/sessionstore/nsSessionStoreUtils.cpp
index dfeb4b26134f..4bb06e2a1b63 100644
--- a/toolkit/components/sessionstore/nsSessionStoreUtils.cpp
+++ b/toolkit/components/sessionstore/nsSessionStoreUtils.cpp
@@ -45,7 +45,7 @@ class DynamicFrameEventFilter final : public nsIDOMEventListener {
       return false;
     }
 
-    nsPIDOMWindowOuter* outer = target->GetOwnerGlobalForBindings();
+    nsPIDOMWindowOuter* outer = target->GetOwnerGlobalForBindingsInternal();
     if (!outer) {
       return false;
     }