Fix one crash

mozilla-release/patches/1425866-61a1.patch

@@ -0,0 +1,36 @@
+# HG changeset patch
+# User Emilio Cobos Alvarez <emilio@crisal.io>
+# Date 1524786410 -7200
+# Node ID a42293258ab3dffb794f3a1e8fe2c3937dd81bb5
+# Parent  18e58f90f23b4ee1d14078787e2409bd80eba945
+Bug 1425866: Just null-check the CSS Loader for now. r=heycam
+
+After discussing with Olli there isn't any kind of severe problem out of this.
+Shadow subtrees will be disconnected just like the rest, and they shouldn't
+assume that the document hasn't been disconnected first.
+
+MozReview-Commit-ID: CX4fXOqEIFj
+
+diff --git a/dom/base/nsStyleLinkElement.cpp b/dom/base/nsStyleLinkElement.cpp
+--- a/dom/base/nsStyleLinkElement.cpp
++++ b/dom/base/nsStyleLinkElement.cpp
+@@ -254,17 +254,18 @@ nsStyleLinkElement::DoUpdateStyleSheet(n
+   // When static documents are created, stylesheets are cloned manually.
+   if (mDontLoadStyle || !mUpdatesEnabled ||
+       thisContent->OwnerDoc()->IsStaticDocument()) {
+     return Update { };
+   }
+ 
+   nsCOMPtr<nsIDocument> doc = thisContent->IsInShadowTree() ?
+     thisContent->OwnerDoc() : thisContent->GetUncomposedDoc();
+-  if (!doc || !doc->CSSLoader()->GetEnabled()) {
++  // Loader could be null during unlink, see bug 1425866.
++  if (!doc || !doc->CSSLoader() || !doc->CSSLoader()->GetEnabled()) {
+     return Update { };
+   }
+ 
+   bool isInline;
+   nsCOMPtr<nsIPrincipal> triggeringPrincipal;
+   nsCOMPtr<nsIURI> uri = GetStyleSheetURL(&isInline, getter_AddRefs(triggeringPrincipal));
+   if (aForceUpdate == ForceUpdate::No && mStyleSheet && !isInline && uri) {
+     if (nsIURI* oldURI = mStyleSheet->GetSheetURI()) {

mozilla-release/patches/series

@@ -6308,3 +6308,4 @@ TOP-NOBUG-killtelemetry-debugger-25319.patch
 1826791-121a1.patch
 WIP-1729459-comment25.patch
 1660223-11507.patch
+1425866-61a1.patch