diff --git a/mozilla/xpinstall/src/nsXPITriggerInfo.cpp b/mozilla/xpinstall/src/nsXPITriggerInfo.cpp
index 0301b269f30..248f9511175 100644
--- a/mozilla/xpinstall/src/nsXPITriggerInfo.cpp
+++ b/mozilla/xpinstall/src/nsXPITriggerInfo.cpp
@@ -133,6 +133,7 @@ void nsXPITriggerInfo::SaveCallback( JSContext *aCx, jsval aVal )
 
 static void  destroyTriggerEvent(XPITriggerEvent* event)
 {
+    JS_RemoveRoot( event->cx, &event->cbval );
     delete event;
 }
 
@@ -194,6 +195,12 @@ void nsXPITriggerInfo::SendStatus(const PRUnichar* URL, PRInt32 status)
                     event->global   = OBJECT_TO_JSVAL(obj);
 
                     event->cbval    = mCbval;
+                    JS_AddNamedRoot( event->cx, &event->cbval,
+                                     "XPITriggerEvent::cbval" );
+
+                    // Hold a strong reference to keep the underlying
+                    // JSContext from dying before we handle this event.
+                    event->ref      = mGlobalWrapper;
 
                     eq->PostEvent(&event->e);
                 }
diff --git a/mozilla/xpinstall/src/nsXPITriggerInfo.h b/mozilla/xpinstall/src/nsXPITriggerInfo.h
index ecc2e7f084e..b9dbf3214c1 100644
--- a/mozilla/xpinstall/src/nsXPITriggerInfo.h
+++ b/mozilla/xpinstall/src/nsXPITriggerInfo.h
@@ -47,6 +47,7 @@ typedef struct XPITriggerEvent {
     JSContext*  cx;
     jsval       global;
     jsval       cbval;
+    nsCOMPtr<nsISupports> ref;
 } XPITriggerEvent;