--- a/dom/base/nsGlobalWindow.cpp
+++ b/dom/base/nsGlobalWindow.cpp
@@ -3683,23 +3683,23 @@ nsGlobalWindow::GetContent(JSContext* aC
 
   // Something tries to get .content on a ChromeWindow, try to fetch the CPOW.
   nsCOMPtr<nsIDocShellTreeOwner> treeOwner = GetTreeOwner();
   if (!treeOwner) {
     aError.Throw(NS_ERROR_FAILURE);
     return nullptr;
   }
 
-  JS::Rooted<JS::Value> val(aCx);
+  JS::Rooted<JS::Value> val(aCx, JS::NullValue());
   aError = treeOwner->GetContentWindow(aCx, val.address());
   if (aError.Failed()) {
     return nullptr;
   }
 
-  return &val.toObject();
+  return val.toObjectOrNull();
 }
 
 already_AddRefed<nsIDOMWindow>
 nsGlobalWindow::GetContentInternal(ErrorResult& aError)
 {
   // First check for a named frame named "content"
   nsCOMPtr<nsIDOMWindow> domWindow =
     GetChildWindow(NS_LITERAL_STRING("content"));

--- a/dom/webidl/Window.webidl
+++ b/dom/webidl/Window.webidl
@@ -327,14 +327,14 @@ partial interface Window {
    * arguments, plus any additional arguments are passed on as
    * arguments on the dialog's window object (window.arguments).
    */
   [Throws] WindowProxy? openDialog(optional DOMString url = "",
                                    optional DOMString name = "",
                                    optional DOMString options = "",
                                    any... extraArguments);
 
-  [Replaceable, Throws] readonly attribute object content;
+  [Replaceable, Throws] readonly attribute object? content;
 };
 
 Window implements TouchEventHandlers;
 
 Window implements OnErrorEventHandlerForWindow;