9 files changed, 43 insertions, 3 deletions
diff --git a/dom/base/ChildIterator.cpp b/dom/base/ChildIterator.cpp
index 7a0a705da9..7d3375fef0 100644
--- a/dom/base/ChildIterator.cpp
+++ b/dom/base/ChildIterator.cpp
@@ -12,6 +12,7 @@
 #include "nsIAnonymousContentCreator.h"
 #include "nsIFrame.h"
 #include "nsCSSAnonBoxes.h"
+#include "nsDocument.h"
 
 namespace mozilla {
 namespace dom {
@@ -66,7 +67,8 @@ ExplicitChildIterator::ExplicitChildIterator(const nsIContent* aParent,
     mIsFirst(aStartAtBeginning),
     mIndexInInserted(0)
 {
-  mParentAsSlot = HTMLSlotElement::FromContent(mParent);
+  mParentAsSlot = nsDocument::IsWebComponentsEnabled(mParent) ?
+    HTMLSlotElement::FromContent(mParent) : nullptr;
 }
 
 nsIContent*
diff --git a/dom/base/crashtests/1422931.html b/dom/base/crashtests/1422931.html
new file mode 100644
index 0000000000..9f09f41efd
--- /dev/null
+++ b/dom/base/crashtests/1422931.html
@@ -0,0 +1,6 @@
+<!DOCTYPE html>
+<html>
+<body>
+<!-- Testing slot element with "dom.webcomponents.enabled" set to false -->
+<slot><div></div></slot>
+</html>
diff --git a/dom/base/crashtests/crashtests.list b/dom/base/crashtests/crashtests.list
index 8b115fd4de..d451d93848 100644
--- a/dom/base/crashtests/crashtests.list
+++ b/dom/base/crashtests/crashtests.list
@@ -211,3 +211,4 @@ load 1304437.html
 pref(clipboard.autocopy,true) load 1385272-1.html
 pref(dom.webcomponents.customelements.enabled,true) load 1341693.html
 pref(dom.webcomponents.enabled,true) load 1419799.html
+pref(dom.webcomponents.enabled,false) load 1422931.html
diff --git a/dom/base/nsContentUtils.cpp b/dom/base/nsContentUtils.cpp
index 502c409778..fa34063df8 100644
--- a/dom/base/nsContentUtils.cpp
+++ b/dom/base/nsContentUtils.cpp
@@ -7034,7 +7034,7 @@ nsContentUtils::IsContentInsertionPoint(nsIContent* aContent)
 bool
 nsContentUtils::HasDistributedChildren(nsIContent* aContent)
 {
-  if (!aContent) {
+  if (!aContent || !nsDocument::IsWebComponentsEnabled(aContent)) {
     return false;
   }
 
diff --git a/dom/base/nsDocument.cpp b/dom/base/nsDocument.cpp
index d69fff8637..459ad6bddb 100644
--- a/dom/base/nsDocument.cpp
+++ b/dom/base/nsDocument.cpp
@@ -1332,6 +1332,10 @@ nsIDocument::nsIDocument()
 {
   SetIsInDocument();
 
+  // Set this when document is created and value stays the same for the lifetime
+  // of the document.
+  mIsWebComponentsEnabled = nsContentUtils::IsWebComponentsEnabled();
+
   PR_INIT_CLIST(&mDOMMediaQueryLists);
 }
 
@@ -5686,6 +5690,12 @@ nsDocument::IsWebComponentsEnabled(JSContext* aCx, JSObject* aObject)
 }
 
 bool
+nsDocument::IsWebComponentsEnabled(const nsINode* aNode)
+{
+  return aNode->OwnerDoc()->IsWebComponentsEnabled();
+}
+
+bool
 nsDocument::IsWebComponentsEnabled(dom::NodeInfo* aNodeInfo)
 {
   if (nsContentUtils::IsWebComponentsEnabled()) {
diff --git a/dom/base/nsDocument.h b/dom/base/nsDocument.h
index de2d19cdf9..931bdd89d8 100644
--- a/dom/base/nsDocument.h
+++ b/dom/base/nsDocument.h
@@ -793,7 +793,6 @@ public:
 
   virtual void NotifyLayerManagerRecreated() override;
 
-
 private:
   void AddOnDemandBuiltInUASheet(mozilla::StyleSheet* aSheet);
   nsRadioGroupStruct* GetRadioGroupInternal(const nsAString& aName) const;
@@ -1383,6 +1382,9 @@ protected:
 public:
   // Check whether web components are enabled for the global of aObject.
   static bool IsWebComponentsEnabled(JSContext* aCx, JSObject* aObject);
+  // Check whether web components are enabled for the document this node belongs
+  // to.
+  static bool IsWebComponentsEnabled(const nsINode* aNode);
   // Check whether web components are enabled for the global of the document
   // this nodeinfo comes from.
   static bool IsWebComponentsEnabled(mozilla::dom::NodeInfo* aNodeInfo);
diff --git a/dom/base/nsIDocument.h b/dom/base/nsIDocument.h
index 3088736bd2..297a207fcb 100644
--- a/dom/base/nsIDocument.h
+++ b/dom/base/nsIDocument.h
@@ -2885,6 +2885,11 @@ public:
     --mThrowOnDynamicMarkupInsertionCounter;
   }
 
+  bool IsWebComponentsEnabled() const
+  {
+    return mIsWebComponentsEnabled;
+  }
+
 protected:
   bool GetUseCounter(mozilla::UseCounter aUseCounter)
   {
@@ -3028,6 +3033,9 @@ protected:
   // container for per-context fonts (downloadable, SVG, etc.)
   RefPtr<mozilla::dom::FontFaceSet> mFontFaceSet;
 
+  // True if dom.webcomponents.enabled pref is set when document is created.
+  bool mIsWebComponentsEnabled : 1;
+
   // Compatibility mode
   nsCompatibility mCompatMode;
 
diff --git a/dom/base/nsTextNode.cpp b/dom/base/nsTextNode.cpp
index 25c2d35256..b488c85b75 100644
--- a/dom/base/nsTextNode.cpp
+++ b/dom/base/nsTextNode.cpp
@@ -21,6 +21,7 @@
 #ifdef DEBUG
 #include "nsRange.h"
 #endif
+#include "nsDocument.h"
 
 using namespace mozilla;
 using namespace mozilla::dom;
@@ -155,6 +156,12 @@ void nsTextNode::UnbindFromTree(bool aDeep, bool aNullParent)
   nsGenericDOMDataNode::UnbindFromTree(aDeep, aNullParent);
 }
 
+bool
+nsTextNode::IsWebComponentsEnabled(JSContext* aCx, JSObject* aObject)
+{
+  return nsDocument::IsWebComponentsEnabled(aCx, aObject);
+}
+
 #ifdef DEBUG
 void
 nsTextNode::List(FILE* out, int32_t aIndent) const
diff --git a/dom/base/nsTextNode.h b/dom/base/nsTextNode.h
index 488540a826..94b8dbd1d7 100644
--- a/dom/base/nsTextNode.h
+++ b/dom/base/nsTextNode.h
@@ -75,6 +75,10 @@ public:
 
   virtual nsIDOMNode* AsDOMNode() override { return this; }
 
+  // Need to have a copy here because including nsDocument.h in this file will
+  // fail to build on Windows.
+  static bool IsWebComponentsEnabled(JSContext* aCx, JSObject* aObject);
+
 #ifdef DEBUG
   virtual void List(FILE* out, int32_t aIndent) const override;
   virtual void DumpContent(FILE* out, int32_t aIndent, bool aDumpAll) const override;