--- a/dom/base/nsGlobalWindowInner.cpp
+++ b/dom/base/nsGlobalWindowInner.cpp
@@ -3072,17 +3072,18 @@ nsGlobalWindowInner::GetOwnPropertyNames
     aRv.NoteJSContextException(aCx);
   }
 }
 
 /* static */ bool
 nsGlobalWindowInner::IsPrivilegedChromeWindow(JSContext* aCx, JSObject* aObj)
 {
   // For now, have to deal with XPConnect objects here.
-  return xpc::WindowOrNull(aObj)->IsChromeWindow() &&
+  auto* win = xpc::WindowOrNull(aObj);
+  return win && win->IsChromeWindow() &&
          nsContentUtils::ObjectPrincipal(aObj) == nsContentUtils::GetSystemPrincipal();
 }
 
 /* static */ bool
 nsGlobalWindowInner::OfflineCacheAllowedForContext(JSContext* aCx, JSObject* aObj)
 {
   return IsSecureContextOrObjectIsFromSecureContext(aCx, aObj) ||
          Preferences::GetBool("browser.cache.offline.insecure.enable");

--- a/js/xpconnect/src/Sandbox.cpp
+++ b/js/xpconnect/src/Sandbox.cpp
@@ -53,16 +53,17 @@
 #endif
 #include "mozilla/dom/FileReaderBinding.h"
 #include "mozilla/dom/ScriptSettings.h"
 #include "mozilla/dom/TextDecoderBinding.h"
 #include "mozilla/dom/TextEncoderBinding.h"
 #include "mozilla/dom/UnionConversions.h"
 #include "mozilla/dom/URLBinding.h"
 #include "mozilla/dom/URLSearchParamsBinding.h"
+#include "mozilla/dom/WindowBinding.h"
 #include "mozilla/dom/XMLHttpRequest.h"
 #include "mozilla/dom/XMLSerializerBinding.h"
 #include "mozilla/dom/FormDataBinding.h"
 #include "mozilla/DeferredFinalize.h"
 
 using namespace mozilla;
 using namespace JS;
 using namespace xpc;
@@ -835,16 +836,18 @@ xpc::GlobalProperties::Parse(JSContext* 
         } else if (!strcmp(name.ptr(), "TextDecoder")) {
             TextDecoder = true;
         } else if (!strcmp(name.ptr(), "TextEncoder")) {
             TextEncoder = true;
         } else if (!strcmp(name.ptr(), "URL")) {
             URL = true;
         } else if (!strcmp(name.ptr(), "URLSearchParams")) {
             URLSearchParams = true;
+        } else if (!strcmp(name.ptr(), "Window")) {
+            Window = true;
         } else if (!strcmp(name.ptr(), "XMLHttpRequest")) {
             XMLHttpRequest = true;
         } else if (!strcmp(name.ptr(), "XMLSerializer")) {
             XMLSerializer = true;
         } else if (!strcmp(name.ptr(), "atob")) {
             atob = true;
         } else if (!strcmp(name.ptr(), "btoa")) {
             btoa = true;
@@ -940,16 +943,20 @@ xpc::GlobalProperties::Define(JSContext*
     if (URL &&
         !dom::URLBinding::GetConstructorObject(cx))
         return false;
 
     if (URLSearchParams &&
         !dom::URLSearchParamsBinding::GetConstructorObject(cx))
         return false;
 
+    if (Window &&
+        !dom::WindowBinding::GetConstructorObject(cx))
+        return false;
+
     if (XMLHttpRequest &&
         !dom::XMLHttpRequestBinding::GetConstructorObject(cx))
         return false;
 
     if (XMLSerializer &&
         !dom::XMLSerializerBinding::GetConstructorObject(cx))
         return false;
 

--- a/js/xpconnect/src/xpcprivate.h
+++ b/js/xpconnect/src/xpcprivate.h
@@ -2542,16 +2542,17 @@ struct GlobalProperties {
     bool FormData : 1;
     bool InspectorUtils : 1;
     bool MessageChannel: 1;
     bool NodeFilter : 1;
     bool TextDecoder : 1;
     bool TextEncoder : 1;
     bool URL : 1;
     bool URLSearchParams : 1;
+    bool Window : 1;
     bool XMLHttpRequest : 1;
     bool XMLSerializer : 1;
 
     // Ad-hoc property names we implement.
     bool atob : 1;
     bool btoa : 1;
     bool caches : 1;
     bool crypto : 1;