--- a/dom/bluetooth/bluedroid/BluetoothOppManager.cpp
+++ b/dom/bluetooth/bluedroid/BluetoothOppManager.cpp
@@ -375,17 +375,16 @@ BluetoothOppManager::Listen()
   return true;
 }
 
 void
 BluetoothOppManager::StartSendingNextFile()
 {
   MOZ_ASSERT(NS_IsMainThread());
 
-  MOZ_ASSERT(!IsConnected());
   MOZ_ASSERT(!mBatches.IsEmpty());
   MOZ_ASSERT((int)mBatches[0].mBlobs.Length() > mCurrentBlobIndex + 1);
 
   mBlob = mBatches[0].mBlobs[++mCurrentBlobIndex];
 
   // Before sending content, we have to send a header including
   // information such as file name, file length and content type.
   ExtractBlobHeaders();
@@ -468,16 +467,17 @@ BluetoothOppManager::DiscardBlobsToSend(
     FileTransferComplete();
   }
 }
 
 bool
 BluetoothOppManager::ProcessNextBatch()
 {
   MOZ_ASSERT(NS_IsMainThread());
+  MOZ_ASSERT(!IsConnected());
 
   // Remove the processed batch.
   // A batch is processed if we've incremented mCurrentBlobIndex for it.
   if (mCurrentBlobIndex >= 0) {
     ClearQueue();
     mBatches.RemoveElementAt(0);
     BT_LOGR("REMOVE. %d remaining", mBatches.Length());
   }
@@ -600,19 +600,21 @@ BluetoothOppManager::AfterOppDisconnecte
     mInputStream = nullptr;
   }
 
   if (mOutputStream) {
     mOutputStream->Close();
     mOutputStream = nullptr;
   }
 
-  if (mReadFileThread) {
-    mReadFileThread->Shutdown();
-    mReadFileThread = nullptr;
+  // Store local pointer of |mReadFileThread| to avoid shutdown reentry crash
+  // See bug 1191715 comment 19 for more details.
+  nsCOMPtr<nsIThread> thread = mReadFileThread.forget();
+  if (thread) {
+    thread->Shutdown();
   }
 
   // Release the mount lock if file transfer completed
   if (mMountLock) {
     // The mount lock will be implicitly unlocked
     mMountLock = nullptr;
   }
 }
@@ -785,17 +787,17 @@ BluetoothOppManager::RetrieveSentFileNam
   mFileName.Truncate();
 
   nsRefPtr<File> file = static_cast<Blob*>(mBlob.get())->ToFile();
   if (file) {
     file->GetName(mFileName);
   }
 
   /**
-   * We try our best to get the file extention to avoid interoperability issues.
+   * We try our best to get the file extension to avoid interoperability issues.
    * However, once we found that we are unable to get suitable extension or
    * information about the content type, sending a pre-defined file name without
    * extension would be fine.
    */
   if (mFileName.IsEmpty()) {
     mFileName.AssignLiteral("Unknown");
   }
 

--- a/dom/bluetooth/bluez/BluetoothOppManager.cpp
+++ b/dom/bluetooth/bluez/BluetoothOppManager.cpp
@@ -362,17 +362,16 @@ BluetoothOppManager::Listen()
   return true;
 }
 
 void
 BluetoothOppManager::StartSendingNextFile()
 {
   MOZ_ASSERT(NS_IsMainThread());
 
-  MOZ_ASSERT(!IsConnected());
   MOZ_ASSERT(!mBatches.IsEmpty());
   MOZ_ASSERT((int)mBatches[0].mBlobs.Length() > mCurrentBlobIndex + 1);
 
   mBlob = mBatches[0].mBlobs[++mCurrentBlobIndex];
 
   // Before sending content, we have to send a header including
   // information such as file name, file length and content type.
   ExtractBlobHeaders();
@@ -455,16 +454,17 @@ BluetoothOppManager::DiscardBlobsToSend(
     FileTransferComplete();
   }
 }
 
 bool
 BluetoothOppManager::ProcessNextBatch()
 {
   MOZ_ASSERT(NS_IsMainThread());
+  MOZ_ASSERT(!IsConnected());
 
   // Remove the processed batch.
   // A batch is processed if we've incremented mCurrentBlobIndex for it.
   if (mCurrentBlobIndex >= 0) {
     ClearQueue();
     mBatches.RemoveElementAt(0);
     BT_LOGR("REMOVE. %d remaining", mBatches.Length());
   }
@@ -587,19 +587,21 @@ BluetoothOppManager::AfterOppDisconnecte
     mInputStream = nullptr;
   }
 
   if (mOutputStream) {
     mOutputStream->Close();
     mOutputStream = nullptr;
   }
 
-  if (mReadFileThread) {
-    mReadFileThread->Shutdown();
-    mReadFileThread = nullptr;
+  // Store local pointer of |mReadFileThread| to avoid shutdown reentry crash
+  // See bug 1191715 comment 19 for more details.
+  nsCOMPtr<nsIThread> thread = mReadFileThread.forget();
+  if (thread) {
+    thread->Shutdown();
   }
 
   // Release the mount lock if file transfer completed
   if (mMountLock) {
     // The mount lock will be implicitly unlocked
     mMountLock = nullptr;
   }
 }
@@ -772,17 +774,17 @@ BluetoothOppManager::RetrieveSentFileNam
   mFileName.Truncate();
 
   nsRefPtr<File> file = mBlob->ToFile();
   if (file) {
     file->GetName(mFileName);
   }
 
   /**
-   * We try our best to get the file extention to avoid interoperability issues.
+   * We try our best to get the file extension to avoid interoperability issues.
    * However, once we found that we are unable to get suitable extension or
    * information about the content type, sending a pre-defined file name without
    * extension would be fine.
    */
   if (mFileName.IsEmpty()) {
     mFileName.AssignLiteral("Unknown");
   }