--- a/js/xpconnect/loader/ScriptPreloader.h
+++ b/js/xpconnect/loader/ScriptPreloader.h
@@ -468,17 +468,20 @@ class ScriptPreloader : public nsIObserv
 
   RefPtr<ScriptPreloader> mChildCache;
   ScriptCacheChild* mChildActor = nullptr;
 
   nsString mBaseName;
   nsCString mContentStartupFinishedTopic;
 
   nsCOMPtr<nsIFile> mProfD;
-  nsCOMPtr<nsIThread> mSaveThread;
+  // Note: We use a RefPtr rather than an nsCOMPtr here because the
+  // AssertNoQueryNeeded checks done by getter_AddRefs happen at a time that
+  // violate data access invariants.
+  RefPtr<nsIThread> mSaveThread;
   nsCOMPtr<nsITimer> mSaveTimer;
 
   // The mmapped cache data from this session's cache file.
   AutoMemMap mCacheData;
 
   Monitor mMonitor;
   Monitor mSaveMonitor;
 };