diff --git a/docshell/base/nsDSURIContentListener.cpp b/docshell/base/nsDSURIContentListener.cpp
index 2eccb74da93..4270c53035a 100644
--- a/docshell/base/nsDSURIContentListener.cpp
+++ b/docshell/base/nsDSURIContentListener.cpp
@@ -131,7 +131,7 @@ nsDSURIContentListener::DoContent(const nsACString& aContentType,
   nsresult rv;
   NS_ENSURE_ARG_POINTER(aContentHandler);
   NS_ENSURE_TRUE(mDocShell, NS_ERROR_FAILURE);
-  RefPtr<nsDocShell> docShell = mDocShell;
+  RefPtr<nsDocShell> docShell = mDocShell.get();
 
   *aAbortProcess = false;
 
diff --git a/docshell/base/nsDSURIContentListener.h b/docshell/base/nsDSURIContentListener.h
index 61ed36456f2..4d0c77d6974 100644
--- a/docshell/base/nsDSURIContentListener.h
+++ b/docshell/base/nsDSURIContentListener.h
@@ -11,8 +11,9 @@
 #include "nsIURIContentListener.h"
 #include "nsWeakReference.h"
 #include "nsITimer.h"
+#include "mozilla/WeakPtr.h"
+#include "nsDocShell.h"
 
-class nsDocShell;
 class nsIInterfaceRequestor;
 class nsIWebNavigationInfo;
 class nsPIDOMWindowOuter;
@@ -85,7 +86,7 @@ class nsDSURIContentListener final : public nsIURIContentListener,
   }
 
  protected:
-  nsDocShell* mDocShell;
+  mozilla::MainThreadWeakPtr<nsDocShell> mDocShell;
   // Hack to handle multipart images without creating a new viewer
   nsCOMPtr<nsIStreamListener> mExistingJPEGStreamListener;
   nsCOMPtr<nsIChannel> mExistingJPEGRequest;
diff --git a/docshell/base/nsDocShellEditorData.cpp b/docshell/base/nsDocShellEditorData.cpp
index 6fe132a9775..b2bbdc25318 100644
--- a/docshell/base/nsDocShellEditorData.cpp
+++ b/docshell/base/nsDocShellEditorData.cpp
@@ -17,7 +17,7 @@
 using namespace mozilla;
 using namespace mozilla::dom;
 
-nsDocShellEditorData::nsDocShellEditorData(nsIDocShell* aOwningDocShell)
+nsDocShellEditorData::nsDocShellEditorData(nsDocShell* aOwningDocShell)
     : mDocShell(aOwningDocShell),
       mDetachedEditingState(Document::EditingState::eOff),
       mMakeEditable(false),
@@ -121,7 +121,7 @@ nsresult nsDocShellEditorData::DetachFromWindow() {
   return NS_OK;
 }
 
-nsresult nsDocShellEditorData::ReattachToWindow(nsIDocShell* aDocShell) {
+nsresult nsDocShellEditorData::ReattachToWindow(nsDocShell* aDocShell) {
   mDocShell = aDocShell;
 
   nsCOMPtr<nsPIDOMWindowOuter> domWindow =
diff --git a/docshell/base/nsDocShellEditorData.h b/docshell/base/nsDocShellEditorData.h
index 27f840675bd..371d7908914 100644
--- a/docshell/base/nsDocShellEditorData.h
+++ b/docshell/base/nsDocShellEditorData.h
@@ -12,8 +12,9 @@
 
 #include "mozilla/RefPtr.h"
 #include "mozilla/dom/Document.h"
+#include "mozilla/WeakPtr.h"
+#include "nsDocShell.h"
 
-class nsIDocShell;
 class nsEditingSession;
 
 namespace mozilla {
@@ -22,7 +23,7 @@ class HTMLEditor;
 
 class nsDocShellEditorData {
  public:
-  explicit nsDocShellEditorData(nsIDocShell* aOwningDocShell);
+  explicit nsDocShellEditorData(nsDocShell* aOwningDocShell);
   ~nsDocShellEditorData();
 
   MOZ_CAN_RUN_SCRIPT_BOUNDARY nsresult MakeEditable(bool aWaitForUriLoad);
@@ -33,14 +34,14 @@ class nsDocShellEditorData {
   SetHTMLEditor(mozilla::HTMLEditor* aHTMLEditor);
   MOZ_CAN_RUN_SCRIPT_BOUNDARY void TearDownEditor();
   nsresult DetachFromWindow();
-  nsresult ReattachToWindow(nsIDocShell* aDocShell);
+  nsresult ReattachToWindow(nsDocShell* aDocShell);
   bool WaitingForLoad() const { return mMakeEditable; }
 
  protected:
   void EnsureEditingSession();
 
   // The doc shell that owns us. Weak ref, since it always outlives us.
-  nsIDocShell* mDocShell;
+  mozilla::WeakPtr<nsDocShell> mDocShell;
 
   // Only present for the content root docShell. Session is owned here.
   RefPtr<nsEditingSession> mEditingSession;