--- a/dom/canvas/WebGLTextureUpload.cpp
+++ b/dom/canvas/WebGLTextureUpload.cpp
@@ -349,17 +349,30 @@ WebGLContext::FromDomElem(const char* fu
     //////
 
     // While it's counter-intuitive, the shape of the SFEResult API means that we should
     // try to pull out a surface first, and then, if we do pull out a surface, check
     // CORS/write-only/etc..
 
     if (!sfer.mCORSUsed) {
         auto& srcPrincipal = sfer.mPrincipal;
-        nsIPrincipal* dstPrincipal = GetCanvas()->NodePrincipal();
+        nsIPrincipal* dstPrincipal;
+        if (mOffscreenCanvas) {
+          MOZ_ASSERT(NS_IsMainThread());
+          nsCOMPtr<nsIGlobalObject> global = mOffscreenCanvas->GetParentObject();
+          nsCOMPtr<nsPIDOMWindowInner> window = do_QueryInterface(global);
+          if (!window || !window->GetDoc()) {
+            out_error->Throw(NS_ERROR_FAILURE);
+            return nullptr;
+          }
+
+          dstPrincipal = window->GetDoc()->NodePrincipal();
+        } else {
+          dstPrincipal = GetCanvas()->NodePrincipal();
+        }
 
         if (!dstPrincipal->Subsumes(srcPrincipal)) {
             GenerateWarning("%s: Cross-origin elements require CORS.", funcName);
             out_error->Throw(NS_ERROR_DOM_SECURITY_ERR);
             return nullptr;
         }
     }