--- a/dom/base/nsDOMWindowList.cpp
+++ b/dom/base/nsDOMWindowList.cpp
@@ -42,38 +42,41 @@ NS_IMETHODIMP
 nsDOMWindowList::SetDocShell(nsIDocShell* aDocShell)
 {
   nsCOMPtr<nsIDocShellTreeNode> docShellAsNode(do_QueryInterface(aDocShell));
   mDocShellNode = docShellAsNode; // Weak Reference
 
   return NS_OK;
 }
 
+void
+nsDOMWindowList::EnsureFresh()
+{
+  nsCOMPtr<nsIWebNavigation> shellAsNav = do_QueryInterface(mDocShellNode);
+
+  if (shellAsNav) {
+    nsCOMPtr<nsIDOMDocument> domdoc;
+    shellAsNav->GetDocument(getter_AddRefs(domdoc));
+
+    nsCOMPtr<nsIDocument> doc = do_QueryInterface(domdoc);
+
+    if (doc) {
+      doc->FlushPendingNotifications(Flush_ContentAndNotify);
+    }
+  }
+}
+
 NS_IMETHODIMP 
 nsDOMWindowList::GetLength(uint32_t* aLength)
 {
   nsresult rv = NS_OK;
 
   *aLength = 0;
 
-  nsCOMPtr<nsIWebNavigation> shellAsNav(do_QueryInterface(mDocShellNode));
-
-  if (shellAsNav) {
-    nsCOMPtr<nsIDOMDocument> domdoc;
-    shellAsNav->GetDocument(getter_AddRefs(domdoc));
-
-    nsCOMPtr<nsIDocument> doc(do_QueryInterface(domdoc));
-
-    if (doc) {
-      doc->FlushPendingNotifications(Flush_ContentAndNotify);
-    }
-  }
-
-  // The above flush might cause mDocShellNode to be cleared, so we
-  // need to check that it's still non-null here.
+  EnsureFresh();
 
   if (mDocShellNode) {
     int32_t length;
     rv = mDocShellNode->GetChildCount(&length);
 
     *aLength = length;
   }
 
@@ -82,31 +85,17 @@ nsDOMWindowList::GetLength(uint32_t* aLe
 
 NS_IMETHODIMP 
 nsDOMWindowList::Item(uint32_t aIndex, nsIDOMWindow** aReturn)
 {
   nsCOMPtr<nsIDocShellTreeItem> item;
 
   *aReturn = nullptr;
 
-  nsCOMPtr<nsIWebNavigation> shellAsNav = do_QueryInterface(mDocShellNode);
-
-  if (shellAsNav) {
-    nsCOMPtr<nsIDOMDocument> domdoc;
-    shellAsNav->GetDocument(getter_AddRefs(domdoc));
-
-    nsCOMPtr<nsIDocument> doc = do_QueryInterface(domdoc);
-
-    if (doc) {
-      doc->FlushPendingNotifications(Flush_ContentAndNotify);
-    }
-  }
-
-  // The above flush might cause mDocShellNode to be cleared, so we
-  // need to check that it's still non-null here.
+  EnsureFresh();
 
   if (mDocShellNode) {
     mDocShellNode->GetChildAt(aIndex, getter_AddRefs(item));
 
     nsCOMPtr<nsIScriptGlobalObject> globalObject(do_GetInterface(item));
     NS_ASSERTION(!item || (item && globalObject),
                  "Couldn't get to the globalObject");
 
@@ -119,31 +108,17 @@ nsDOMWindowList::Item(uint32_t aIndex, n
 
 NS_IMETHODIMP 
 nsDOMWindowList::NamedItem(const nsAString& aName, nsIDOMWindow** aReturn)
 {
   nsCOMPtr<nsIDocShellTreeItem> item;
 
   *aReturn = nullptr;
 
-  nsCOMPtr<nsIWebNavigation> shellAsNav(do_QueryInterface(mDocShellNode));
-
-  if (shellAsNav) {
-    nsCOMPtr<nsIDOMDocument> domdoc;
-    shellAsNav->GetDocument(getter_AddRefs(domdoc));
-
-    nsCOMPtr<nsIDocument> doc(do_QueryInterface(domdoc));
-
-    if (doc) {
-      doc->FlushPendingNotifications(Flush_ContentAndNotify);
-    }
-  }
-
-  // The above flush might cause mDocShellNode to be cleared, so we
-  // need to check that it's still non-null here.
+  EnsureFresh();
 
   if (mDocShellNode) {
     mDocShellNode->FindChildWithName(PromiseFlatString(aName).get(),
                                      false, false, nullptr,
                                      nullptr, getter_AddRefs(item));
 
     nsCOMPtr<nsIScriptGlobalObject> globalObject(do_GetInterface(item));
     if (globalObject) {

--- a/dom/base/nsDOMWindowList.h
+++ b/dom/base/nsDOMWindowList.h
@@ -21,12 +21,15 @@ public:
 
   NS_DECL_ISUPPORTS
   NS_DECL_NSIDOMWINDOWCOLLECTION
 
   //local methods
   NS_IMETHOD SetDocShell(nsIDocShell* aDocShell);
 
 protected:
+  // Note: this function may flush and cause mDocShellNode to become null.
+  void EnsureFresh();
+
   nsIDocShellTreeNode* mDocShellNode; //Weak Reference
 };
 
 #endif // nsDOMWindowList_h___