diff --git a/dom/html/TextControlState.cpp b/dom/html/TextControlState.cpp
index 0e406fe6ba7..89ea36d49c6 100644
--- a/dom/html/TextControlState.cpp
+++ b/dom/html/TextControlState.cpp
@@ -743,6 +743,8 @@ void TextInputListener::OnSelectionChange(Selection& aSelection,
     return;
   }
 
+  RefPtr<TextControlElement> txtCtrlElement = mTxtCtrlElement;
+
   // Fire the select event
   // The specs don't exactly say when we should fire the select event.
   // IE: Whenever you add/remove a character to/from the selection. Also
@@ -765,12 +767,13 @@ void TextInputListener::OnSelectionChange(Selection& aSelection,
   if (!collapsed && (aReason & (nsISelectionListener::MOUSEUP_REASON |
                                 nsISelectionListener::KEYPRESS_REASON |
                                 nsISelectionListener::SELECTALL_REASON))) {
-    if (nsCOMPtr<nsIContent> content = mTxtCtrlElement) {
-      if (auto* frame = content->GetPrimaryFrame()) {
+    if (txtCtrlElement) {
+      if (auto* frame = txtCtrlElement->GetPrimaryFrame()) {
         RefPtr<PresShell> presShell = frame->PresShell();
         nsEventStatus status = nsEventStatus_eIgnore;
         WidgetEvent event(true, eFormSelect);
-        presShell->HandleEventWithTarget(&event, frame, content, &status);
+        presShell->HandleEventWithTarget(&event, frame, txtCtrlElement,
+                                         &status);
       }
     }
   }
@@ -782,7 +785,7 @@ void TextInputListener::OnSelectionChange(Selection& aSelection,
 
   mSelectionWasCollapsed = collapsed;
 
-  if (nsFocusManager::GetFocusedElementStatic() != mTxtCtrlElement) {
+  if (nsFocusManager::GetFocusedElementStatic() != txtCtrlElement) {
     return;
   }
 
@@ -965,6 +968,9 @@ TextInputListener::HandleEvent(Event* aEvent) {
 }
 
 nsresult TextInputListener::OnEditActionHandled(TextEditor& aTextEditor) {
+  // UpdateTextInputCommands may run script
+  const RefPtr<TextControlElement> kungFuDeathGrip(mTxtCtrlElement);
+
   // Update the undo / redo menus
   //
   size_t numUndoItems = aTextEditor.NumberOfUndoItems();
diff --git a/dom/html/TextInputListener.h b/dom/html/TextInputListener.h
index 1d4059dcd34..557a3ffe827 100644
--- a/dom/html/TextInputListener.h
+++ b/dom/html/TextInputListener.h
@@ -63,7 +63,8 @@ class TextInputListener final : public nsIDOMEventListener,
  protected:
   virtual ~TextInputListener() = default;
 
-  nsresult UpdateTextInputCommands(const nsAString& aCommandsToUpdate);
+  MOZ_CAN_RUN_SCRIPT nsresult
+  UpdateTextInputCommands(const nsAString& aCommandsToUpdate);
 
  protected:
   TextControlElement* const mTxtCtrlElement;