diff --git a/gfx/thebes/gfxFontEntry.h b/gfx/thebes/gfxFontEntry.h
index c83803091e1..b8961bfdd4a 100644
--- a/gfx/thebes/gfxFontEntry.h
+++ b/gfx/thebes/gfxFontEntry.h
@@ -326,12 +326,11 @@ class gfxFontEntry {
     if (map) {
       if (mShmemFace && TrySetShmemCharacterMap()) {
         // Forget our temporary local copy, now we can use the shared cmap.
-        // Ignore the MOZ_GUARDED_BY of mCharacterMap as we're doing an
-        // atomic exchange.
-        MOZ_PUSH_IGNORE_THREAD_SAFETY
-        auto* oldCmap = mCharacterMap.exchange(nullptr);
-        MOZ_POP_THREAD_SAFETY
-        NS_IF_RELEASE(oldCmap);
+        {
+          mozilla::AutoWriteLock lock(mLock);
+          auto* oldCmap = mCharacterMap.exchange(nullptr);
+          NS_IF_RELEASE(oldCmap);
+        }
         return GetShmemCharacterMap()->test(ch);
       }
       if (map->test(ch)) {
@@ -591,7 +590,8 @@ class gfxFontEntry {
 
   // Return a new strong ref to mCharacterMap. This can safely be dereferenced
   // by the caller as long as it keeps its reference alive.
-  already_AddRefed<gfxCharacterMap> GetCharacterMapAddRefed() const {
+  already_AddRefed<gfxCharacterMap> GetCharacterMapAddRefed() const
+      MOZ_EXCLUDES(mLock) {
     mozilla::AutoReadLock lock(mLock);
     RefPtr map = static_cast<gfxCharacterMap*>(mCharacterMap);
     return map.forget();
@@ -600,7 +600,7 @@ class gfxFontEntry {
   // Check for presence of either shmem or local charmap.
   bool HasCharacterMap() const MOZ_NO_THREAD_SAFETY_ANALYSIS {
     // Although mCharacterMap is MOZ_GUARDED_BY(mLock), we don't lock here
-    // as it is an atomic var, and we're not holding on to dereferencing it,
+    // as it is an atomic var, and we're not holding on to or dereferencing it,
     // just checking whether it's non-null.
     return mShmemCharacterMap || mCharacterMap;
   }