--- a/toolkit/identity/IdentityCryptoService.cpp
+++ b/toolkit/identity/IdentityCryptoService.cpp
@@ -6,16 +6,17 @@
 
 #include "nsIIdentityCryptoService.h"
 #include "mozilla/ModuleUtils.h"
 #include "nsServiceManagerUtils.h"
 #include "nsNSSShutDown.h"
 #include "nsIThread.h"
 #include "nsThreadUtils.h"
 #include "nsCOMPtr.h"
+#include "nsProxyRelease.h"
 #include "nsStringGlue.h"
 #include "mozilla/Base64.h"
 #include "mozilla/Util.h" // ArrayLength
 #include "ScopedNSSTypes.h"
 
 #include "nss.h"
 #include "pk11pub.h"
 #include "secmod.h"
@@ -132,17 +133,17 @@ private:
     nsNSSShutDownPreventionLock locker;
     if (isAlreadyShutDown())
       return;
 
      mKeyPair = NULL;
   }
 
   const KeyType mKeyType; // in
-  nsCOMPtr<nsIIdentityKeyGenCallback> mCallback; // in
+  nsMainThreadPtrHandle<nsIIdentityKeyGenCallback> mCallback; // in
   nsresult mRv; // out
   nsCOMPtr<KeyPair> mKeyPair; // out
 
   KeyGenRunnable(const KeyGenRunnable &) MOZ_DELETE;
   void operator=(const KeyGenRunnable &) MOZ_DELETE;
 };
 
 class SignRunnable : public nsRunnable, public nsNSSShutDownObject
@@ -329,17 +330,17 @@ KeyPair::Sign(const nsACString & textToS
   nsCOMPtr<nsIThread> thread;
   nsresult rv = NS_NewThread(getter_AddRefs(thread), r);
   return rv;
 }
 
 KeyGenRunnable::KeyGenRunnable(KeyType keyType,
                                nsIIdentityKeyGenCallback * callback)
   : mKeyType(keyType)
-  , mCallback(callback)
+  , mCallback(new nsMainThreadPtrHolder<nsIIdentityKeyGenCallback>(callback))
   , mRv(NS_ERROR_NOT_INITIALIZED)
 {
 }
 
 MOZ_WARN_UNUSED_RESULT nsresult
 GenerateKeyPair(PK11SlotInfo * slot,
                 SECKEYPrivateKey ** privateKey,
                 SECKEYPublicKey ** publicKey,