diff --git a/fxjs/cjs_field.cpp b/fxjs/cjs_field.cpp
index f090062c4d..e864a1804b 100644
--- a/fxjs/cjs_field.cpp
+++ b/fxjs/cjs_field.cpp
@@ -1272,12 +1272,18 @@ CJS_Result CJS_Field::set_display(CJS_Runtime* pRuntime,
     return CJS_Result::Failure(JSMessage::kReadOnlyError);
   }
 
+  // ToInt32() may run arbitrary script via valueOf(); hoist it onto its own
+  // statement so |form_fill_env_| (an ObservedPtr) is read afterwards and can
+  // be liveness-checked, instead of being captured as a sibling argument.
+  const int number = pRuntime->ToInt32(vp);
   if (delay_) {
-    AddDelay_Int(FP_DISPLAY, pRuntime->ToInt32(vp));
-  } else {
-    SetDisplay(form_fill_env_.Get(), field_name_, form_control_index_,
-               pRuntime->ToInt32(vp));
+    AddDelay_Int(FP_DISPLAY, number);
+    return CJS_Result::Success();
+  }
+  if (!form_fill_env_) {
+    return CJS_Result::Failure(JSMessage::kBadObjectError);
   }
+  SetDisplay(form_fill_env_.Get(), field_name_, form_control_index_, number);
   return CJS_Result::Success();
 }
 
@@ -1541,12 +1547,18 @@ CJS_Result CJS_Field::set_line_width(CJS_Runtime* pRuntime,
     return CJS_Result::Failure(JSMessage::kReadOnlyError);
   }
 
+  // ToInt32() may run arbitrary script via valueOf(); hoist it onto its own
+  // statement so |form_fill_env_| (an ObservedPtr) is read afterwards and can
+  // be liveness-checked, instead of being captured as a sibling argument.
+  const int number = pRuntime->ToInt32(vp);
   if (delay_) {
-    AddDelay_Int(FP_LINEWIDTH, pRuntime->ToInt32(vp));
-  } else {
-    SetLineWidth(form_fill_env_.Get(), field_name_, form_control_index_,
-                 pRuntime->ToInt32(vp));
+    AddDelay_Int(FP_LINEWIDTH, number);
+    return CJS_Result::Success();
+  }
+  if (!form_fill_env_) {
+    return CJS_Result::Failure(JSMessage::kBadObjectError);
   }
+  SetLineWidth(form_fill_env_.Get(), field_name_, form_control_index_, number);
   return CJS_Result::Success();
 }