--- a/content/media/MediaRecorder.cpp
+++ b/content/media/MediaRecorder.cpp
@@ -449,17 +449,18 @@ private:
         return;
       }
     }
 
     // In case source media stream does not notify track end, recieve
     // shutdown notification and stop Read Thread.
     nsContentUtils::RegisterShutdownObserver(this);
 
-    nsRefPtr<nsIRunnable> event = new ExtractRunnable(this);
+    already_AddRefed<Session> session(this); // addref in MediaRecorder::Start
+    nsRefPtr<nsIRunnable> event = new ExtractRunnable(Move(session));
     if (NS_FAILED(mReadThread->Dispatch(event, NS_DISPATCH_NORMAL))) {
       NS_WARNING("Failed to dispatch ExtractRunnable at beginning");
     }
   }
   // application should get blob and onstop event
   void DoSessionEndTask(nsresult rv)
   {
     MOZ_ASSERT(NS_IsMainThread());
@@ -467,17 +468,18 @@ private:
       mRecorder->NotifyError(rv);
     }
 
     CleanupStreams();
     if (NS_FAILED(NS_DispatchToMainThread(new PushBlobRunnable(this)))) {
       MOZ_ASSERT(false, "NS_DispatchToMainThread PushBlobRunnable failed");
     }
     // Destroy this session object in main thread.
-    if (NS_FAILED(NS_DispatchToMainThread(new DestroyRunnable(this)))) {
+    already_AddRefed<Session> session(this); // addref in MediaRecorder::Start
+    if (NS_FAILED(NS_DispatchToMainThread(new DestroyRunnable(Move(session))))) {
       MOZ_ASSERT(false, "NS_DispatchToMainThread DestroyRunnable failed");
     }
   }
   void CleanupStreams()
   {
     if (mInputPort.get()) {
       mInputPort->Destroy();
       mInputPort = nullptr;