2 files changed, 8 insertions, 2 deletions
diff --git a/gfx/ipc/InProcessCompositorSession.cpp b/gfx/ipc/InProcessCompositorSession.cpp
index f5f94461cb..9efb83b57a 100644
--- a/gfx/ipc/InProcessCompositorSession.cpp
+++ b/gfx/ipc/InProcessCompositorSession.cpp
@@ -61,7 +61,10 @@ RefPtr<InProcessCompositorSession> InProcessCompositorSession::Create(
 }
 
 void InProcessCompositorSession::NotifySessionLost() {
-  mWidget->NotifyCompositorSessionLost(this);
+  // Hold a reference to mWidget since NotifyCompositorSessionLost may
+  // release the last reference mid-execution.
+  RefPtr<nsBaseWidget> widget(mWidget);
+  widget->NotifyCompositorSessionLost(this);
 }
 
 CompositorBridgeParent* InProcessCompositorSession::GetInProcessBridge() const {
diff --git a/gfx/ipc/RemoteCompositorSession.cpp b/gfx/ipc/RemoteCompositorSession.cpp
index bbd8ddd13f..34b7cd4856 100644
--- a/gfx/ipc/RemoteCompositorSession.cpp
+++ b/gfx/ipc/RemoteCompositorSession.cpp
@@ -46,10 +46,13 @@ RemoteCompositorSession::~RemoteCompositorSession() {
 }
 
 void RemoteCompositorSession::NotifySessionLost() {
+  // Hold a reference to mWidget since NotifyCompositorSessionLost may
+  // release the last reference mid-execution.
+  RefPtr<nsBaseWidget> widget(mWidget);
   // Re-entrancy should be impossible: when we are being notified of a lost
   // session, we have by definition not shut down yet. We will shutdown, but
   // then will be removed from the notification list.
-  mWidget->NotifyCompositorSessionLost(this);
+  widget->NotifyCompositorSessionLost(this);
 }
 
 CompositorBridgeParent* RemoteCompositorSession::GetInProcessBridge() const {