There are three call sites of nsLayoutUtils::GetReferenceFrame;

1. In CreateAnimationData
2. In nsImageFrame::MaybeDecodeForPredictedSize
3. In ScrollFrameHelper::GetScrolledRect

1 is a piece of code for the layers backend and only used in the case of
disabling retained-display-list, so it's not a problem at all for Fission.
2 is used for predecting image frame size, since bug 1724808 we properly handle
cases where ancestor documents get scaled, so it's fine now.
3 was introduced to avoid redundant paints due to a pixel snapping issue in bug 1012752, the reference frame is used for obtaining the offset from the reference frame to the scroll frame in app units, so it looks fine, that said the offset will be scaled by the value returned from GetPaintedLayerScaleForFrame and in fact the scale value doesn't what we want if it gets called inside OOP iframes, I filed bug 1727228 for the issue

Thus we can replace the GetCrossDocParentFrame call in nsLayoutUtils::GetReferenceFrame.

There are three call sites of nsLayoutUtils::GetReferenceFrame;

1. In CreateAnimationData [1]

2. In nsImageFrame::MaybeDecodeForPredictedSize [2]

3. In ScrollFrameHelper::GetScrolledRect [3]

4. is a piece of code for the layers backend and only used in the case of
   disabling retained-display-list, so it's not a problem at all for Fission.

5. is used for predecting image frame size, since bug 1724808 we properly handle
   cases where ancestor documents get scaled, so it's fine now.

6. was introduced to avoid redundant paints due to a pixel snapping issue in bug
   1012752 (I am thinking it's not only for fixing the redundant paints though),
   the reference frame is used for obtaining the offset from the reference to
   the scroll frame, that's fine on Fission, there's another problem in the pixel
   snapping code in GetPaintedLayerScaleForFrame which will be handled in bug
   1727228.

[1] https://searchfox.org/mozilla-central/rev/912ff8d38996365e8b843cd82ddce348d8b7f78b/gfx/layers/AnimationInfo.cpp#809
[2] https://searchfox.org/mozilla-central/rev/912ff8d38996365e8b843cd82ddce348d8b7f78b/layout/generic/nsImageFrame.cpp#1076
[3] https://searchfox.org/mozilla-central/rev/912ff8d38996365e8b843cd82ddce348d8b7f78b/layout/generic/nsGfxScrollFrame.cpp#7090

The numbering format looks wrong in the bugzilla comment. :)

https://hg.mozilla.org/mozilla-central/rev/904be768f201

Setting status-firefox92=wontfix because we won't need to uplift this fix. It just changes the function call to be more obvious that the code only works in-process.