--- a/dom/bindings/CallbackFunction.h
+++ b/dom/bindings/CallbackFunction.h
@@ -22,16 +22,17 @@
 #include "jsapi.h"
 #include "jswrapper.h"
 #include "mozilla/Assertions.h"
 #include "mozilla/Util.h"
 #include "nsContentUtils.h"
 #include "nsWrapperCache.h"
 #include "nsJSEnvironment.h"
 #include "xpcpublic.h"
+#include "nsLayoutStatics.h"
 
 namespace mozilla {
 namespace dom {
 
 class CallbackFunction : public nsISupports
 {
 public:
   NS_DECL_CYCLE_COLLECTING_ISUPPORTS
@@ -58,16 +59,18 @@ public:
         *aInited = false;
         return;
       }
     }
 
     // Set mCallable before we hold, on the off chance that a GC could somehow
     // happen in there... (which would be pretty odd, granted).
     mCallable = aCallable;
+    // Make sure we'll be able to drop as needed
+    nsLayoutStatics::AddRef();
     NS_HOLD_JS_OBJECTS(this, CallbackFunction);
     *aInited = true;
   }
 
   virtual ~CallbackFunction()
   {
     DropCallback();
   }
@@ -85,16 +88,17 @@ public:
   }
 
 protected:
   void DropCallback()
   {
     if (mCallable) {
       NS_DROP_JS_OBJECTS(this, CallbackFunction);
       mCallable = nullptr;
+      nsLayoutStatics::Release();
     }
   }
 
   JSObject* mCallable;
 
   class NS_STACK_CLASS CallSetup
   {
     /**