diff --git a/dom/html/nsTextEditorState.cpp b/dom/html/nsTextEditorState.cpp
index 5f4a3c8f06ec..92f748c46b83 100644
--- a/dom/html/nsTextEditorState.cpp
+++ b/dom/html/nsTextEditorState.cpp
@@ -979,7 +979,6 @@ nsTextEditorState::nsTextEditorState(nsITextControlElement* aOwningElement)
   : mTextCtrlElement(aOwningElement),
     mRestoringSelection(nullptr),
     mBoundFrame(nullptr),
-    mTextListener(nullptr),
     mEverInited(false),
     mEditorInitialized(false),
     mInitializing(false),
@@ -1012,7 +1011,7 @@ nsTextEditorState::Clear()
     // for us.
     DestroyEditor();
   }
-  NS_IF_RELEASE(mTextListener);
+  mTextListener = nullptr;
 }
 
 void nsTextEditorState::Unlink()
@@ -1125,8 +1124,8 @@ nsTextEditorState::BindToFrame(nsTextControlFrame* aFrame)
 
   // Create a SelectionController
   mSelCon = new nsTextInputSelectionImpl(frameSel, shell, rootNode);
+  MOZ_ASSERT(!mTextListener, "Should not overwrite the object");
   mTextListener = new nsTextInputListener(mTextCtrlElement);
-  NS_ADDREF(mTextListener);
 
   mTextListener->SetFrame(mBoundFrame);
   mSelCon->SetDisplaySelection(nsISelectionController::SELECTION_ON);
@@ -1647,7 +1646,6 @@ nsTextEditorState::UnbindFromFrame(nsTextControlFrame* aFrame)
         TrustedEventsAtSystemGroupBubble());
     }
 
-    NS_RELEASE(mTextListener);
     mTextListener = nullptr;
   }
 
diff --git a/dom/html/nsTextEditorState.h b/dom/html/nsTextEditorState.h
index ab1d37171dce..bf43a7831ca7 100644
--- a/dom/html/nsTextEditorState.h
+++ b/dom/html/nsTextEditorState.h
@@ -276,7 +276,7 @@ private:
   nsCOMPtr<mozilla::dom::Element> mRootNode;
   nsCOMPtr<mozilla::dom::Element> mPlaceholderDiv;
   nsTextControlFrame* mBoundFrame;
-  nsTextInputListener* mTextListener;
+  nsRefPtr<nsTextInputListener> mTextListener;
   nsAutoPtr<nsCString> mValue;
   nsRefPtr<nsAnonDivObserver> mMutationObserver;
   mutable nsString mCachedValue; // Caches non-hard-wrapped value on a multiline control.