diff --git a/mozilla/xpcom/ds/nsCOMArray.cpp b/mozilla/xpcom/ds/nsCOMArray.cpp
index d66a729f041..9a2702232ec 100644
--- a/mozilla/xpcom/ds/nsCOMArray.cpp
+++ b/mozilla/xpcom/ds/nsCOMArray.cpp
@@ -115,8 +115,9 @@ nsCOMArray_base::ReplaceObjectAt(nsISupports* aObject, PRInt32 aIndex)
     // ReplaceElementAt could fail, such as if the array grows
     // so only release the existing object if the replacement succeeded
     if (result) {
-        NS_IF_RELEASE(oldObject);
+        // Make sure to addref first, in case aObject == oldObject
         NS_IF_ADDREF(aObject);
+        NS_IF_RELEASE(oldObject);
     }
     return result;
 }