diff --git a/dom/html/HTMLFormElement.cpp b/dom/html/HTMLFormElement.cpp
index 618ff72ac9d..30379a94dcb 100644
--- a/dom/html/HTMLFormElement.cpp
+++ b/dom/html/HTMLFormElement.cpp
@@ -100,9 +100,6 @@ HTMLFormElement::HTMLFormElement(
     : nsGenericHTMLElement(std::move(aNodeInfo)),
       mControls(new HTMLFormControlsCollection(this)),
       mPendingSubmission(nullptr),
-      mDefaultSubmitElement(nullptr),
-      mFirstSubmitInElements(nullptr),
-      mFirstSubmitNotInElements(nullptr),
       mImageNameLookupTable(FORM_CONTROL_LIST_HASHTABLE_LENGTH),
       mPastNameLookupTable(FORM_CONTROL_LIST_HASHTABLE_LENGTH),
       mSubmitPopupState(PopupBlocker::openAbused),
@@ -138,12 +135,18 @@ NS_IMPL_CYCLE_COLLECTION_TRAVERSE_BEGIN_INHERITED(HTMLFormElement,
   NS_IMPL_CYCLE_COLLECTION_TRAVERSE(mPastNameLookupTable)
   NS_IMPL_CYCLE_COLLECTION_TRAVERSE(mRelList)
   NS_IMPL_CYCLE_COLLECTION_TRAVERSE(mTargetContext)
+  NS_IMPL_CYCLE_COLLECTION_TRAVERSE(mDefaultSubmitElement)
+  NS_IMPL_CYCLE_COLLECTION_TRAVERSE(mFirstSubmitInElements)
+  NS_IMPL_CYCLE_COLLECTION_TRAVERSE(mFirstSubmitNotInElements)
 NS_IMPL_CYCLE_COLLECTION_TRAVERSE_END
 
 NS_IMPL_CYCLE_COLLECTION_UNLINK_BEGIN_INHERITED(HTMLFormElement,
                                                 nsGenericHTMLElement)
   NS_IMPL_CYCLE_COLLECTION_UNLINK(mRelList)
   NS_IMPL_CYCLE_COLLECTION_UNLINK(mTargetContext)
+  NS_IMPL_CYCLE_COLLECTION_UNLINK(mDefaultSubmitElement)
+  NS_IMPL_CYCLE_COLLECTION_UNLINK(mFirstSubmitInElements)
+  NS_IMPL_CYCLE_COLLECTION_UNLINK(mFirstSubmitNotInElements)
   tmp->Clear();
   tmp->mExpandoAndGeneration.OwnerUnlinked();
 NS_IMPL_CYCLE_COLLECTION_UNLINK_END
@@ -1152,7 +1155,7 @@ nsresult HTMLFormElement::AddElement(nsGenericHTMLFormElement* aChild,
     // Update mDefaultSubmitElement, mFirstSubmitInElements,
     // mFirstSubmitNotInElements.
 
-    nsGenericHTMLFormElement** firstSubmitSlot =
+    RefPtr<nsGenericHTMLFormElement>* firstSubmitSlot =
         childInElements ? &mFirstSubmitInElements : &mFirstSubmitNotInElements;
 
     // The new child is the new first submit in its list if the firstSubmitSlot
@@ -1254,7 +1257,7 @@ nsresult HTMLFormElement::RemoveElement(nsGenericHTMLFormElement* aChild,
   controls.RemoveElementAt(index);
 
   // Update our mFirstSubmit* values.
-  nsGenericHTMLFormElement** firstSubmitSlot =
+  RefPtr<nsGenericHTMLFormElement>* firstSubmitSlot =
       childInElements ? &mFirstSubmitInElements : &mFirstSubmitNotInElements;
   if (aChild == *firstSubmitSlot) {
     *firstSubmitSlot = nullptr;
diff --git a/dom/html/HTMLFormElement.h b/dom/html/HTMLFormElement.h
index 95cb185ebca..51f6f186b87 100644
--- a/dom/html/HTMLFormElement.h
+++ b/dom/html/HTMLFormElement.h
@@ -493,14 +493,14 @@ class HTMLFormElement final : public nsGenericHTMLElement {
    * submit, used to be able to block double submits. */
   Maybe<uint64_t> mCurrentLoadId;
 
-  /** The default submit element -- WEAK */
-  nsGenericHTMLFormElement* mDefaultSubmitElement;
+  /** The default submit element */
+  RefPtr<nsGenericHTMLFormElement> mDefaultSubmitElement;
 
-  /** The first submit element in mElements -- WEAK */
-  nsGenericHTMLFormElement* mFirstSubmitInElements;
+  /** The first submit element in mElements */
+  RefPtr<nsGenericHTMLFormElement> mFirstSubmitInElements;
 
-  /** The first submit element in mNotInElements -- WEAK */
-  nsGenericHTMLFormElement* mFirstSubmitNotInElements;
+  /** The first submit element in mNotInElements */
+  RefPtr<nsGenericHTMLFormElement> mFirstSubmitNotInElements;
 
   // This array holds on to all HTMLImageElement(s).
   // This is needed to properly clean up the bi-directional references