diff --git a/dom/base/nsFrameLoader.cpp b/dom/base/nsFrameLoader.cpp
index 88cfae40878a..62c143b3c6ee 100644
--- a/dom/base/nsFrameLoader.cpp
+++ b/dom/base/nsFrameLoader.cpp
@@ -157,7 +157,7 @@ typedef ScrollableLayerGuid::ViewID ViewID;
 
 NS_IMPL_CYCLE_COLLECTION_WRAPPERCACHE(nsFrameLoader, mBrowsingContext,
                                       mMessageManager, mChildMessageManager,
-                                      mParentSHistory)
+                                      mParentSHistory, mRemoteBrowser)
 NS_IMPL_CYCLE_COLLECTING_ADDREF(nsFrameLoader)
 NS_IMPL_CYCLE_COLLECTING_RELEASE(nsFrameLoader)
 
diff --git a/dom/ipc/BrowserBridgeHost.cpp b/dom/ipc/BrowserBridgeHost.cpp
index 11d22cb2d682..5f536256c011 100644
--- a/dom/ipc/BrowserBridgeHost.cpp
+++ b/dom/ipc/BrowserBridgeHost.cpp
@@ -9,6 +9,15 @@
 namespace mozilla {
 namespace dom {
 
+NS_INTERFACE_MAP_BEGIN_CYCLE_COLLECTION(BrowserBridgeHost)
+  NS_INTERFACE_MAP_ENTRY(nsISupports)
+NS_INTERFACE_MAP_END
+
+NS_IMPL_CYCLE_COLLECTION(BrowserBridgeHost)
+
+NS_IMPL_CYCLE_COLLECTING_ADDREF(BrowserBridgeHost)
+NS_IMPL_CYCLE_COLLECTING_RELEASE(BrowserBridgeHost)
+
 BrowserBridgeHost::BrowserBridgeHost(BrowserBridgeChild* aChild)
     : mBridge(aChild) {}
 
diff --git a/dom/ipc/BrowserBridgeHost.h b/dom/ipc/BrowserBridgeHost.h
index 7827431558ae..5dee2198cd7e 100644
--- a/dom/ipc/BrowserBridgeHost.h
+++ b/dom/ipc/BrowserBridgeHost.h
@@ -28,7 +28,8 @@ class BrowserBridgeHost : public RemoteBrowser {
 
   explicit BrowserBridgeHost(BrowserBridgeChild* aChild);
 
-  NS_INLINE_DECL_REFCOUNTING(BrowserBridgeHost, override);
+  NS_DECL_CYCLE_COLLECTING_ISUPPORTS
+  NS_DECL_CYCLE_COLLECTION_CLASS(BrowserBridgeHost)
 
   // Get the IPDL actor for the BrowserBridgeChild.
   BrowserBridgeChild* GetActor() { return mBridge; }
diff --git a/dom/ipc/BrowserHost.cpp b/dom/ipc/BrowserHost.cpp
index a04b768137df..dccd9f746dbb 100644
--- a/dom/ipc/BrowserHost.cpp
+++ b/dom/ipc/BrowserHost.cpp
@@ -12,7 +12,16 @@
 namespace mozilla {
 namespace dom {
 
-NS_IMPL_ISUPPORTS(BrowserHost, nsIRemoteTab)
+NS_INTERFACE_MAP_BEGIN_CYCLE_COLLECTION(BrowserHost)
+  NS_INTERFACE_MAP_ENTRY(nsIRemoteTab)
+  NS_INTERFACE_MAP_ENTRY(nsISupportsWeakReference)
+  NS_INTERFACE_MAP_ENTRY_AMBIGUOUS(nsISupports, RemoteBrowser)
+NS_INTERFACE_MAP_END
+
+NS_IMPL_CYCLE_COLLECTION(BrowserHost, mRoot)
+
+NS_IMPL_CYCLE_COLLECTING_ADDREF(BrowserHost)
+NS_IMPL_CYCLE_COLLECTING_RELEASE(BrowserHost)
 
 BrowserHost::BrowserHost(BrowserParent* aParent) : mRoot(aParent) {
   mRoot->SetBrowserHost(this);
diff --git a/dom/ipc/BrowserHost.h b/dom/ipc/BrowserHost.h
index a6f09c5e2e83..25e71a78c739 100644
--- a/dom/ipc/BrowserHost.h
+++ b/dom/ipc/BrowserHost.h
@@ -32,7 +32,9 @@ class Element;
  * See `dom/docs/Fission-IPC-Diagram.svg` for an overview of the DOM IPC
  * actors.
  */
-class BrowserHost : public RemoteBrowser, public nsIRemoteTab {
+class BrowserHost : public RemoteBrowser,
+                    public nsIRemoteTab,
+                    public nsSupportsWeakReference {
  public:
   typedef mozilla::layers::LayersId LayersId;
 
@@ -40,10 +42,13 @@ class BrowserHost : public RemoteBrowser, public nsIRemoteTab {
 
   static BrowserHost* GetFrom(nsIRemoteTab* aRemoteTab);
 
-  NS_DECL_ISUPPORTS
+  // NS_DECL_ISUPPORTS_INHERITED
+  NS_DECL_CYCLE_COLLECTING_ISUPPORTS
   // nsIRemoteTab
   NS_DECL_NSIREMOTETAB
 
+  NS_DECL_CYCLE_COLLECTION_CLASS_AMBIGUOUS(BrowserHost, RemoteBrowser)
+
   // Get the IPDL actor for the root BrowserParent. This method should be
   // avoided and consumers migrated to use this class.
   BrowserParent* GetActor() { return mRoot; }
diff --git a/dom/ipc/RemoteBrowser.h b/dom/ipc/RemoteBrowser.h
index fe3422b2a049..30185350ca24 100644
--- a/dom/ipc/RemoteBrowser.h
+++ b/dom/ipc/RemoteBrowser.h
@@ -11,6 +11,7 @@
 #include "mozilla/dom/ipc/IdType.h"
 #include "mozilla/layers/LayersTypes.h"
 #include "nsILoadContext.h"
+#include "nsISupports.h"
 #include "nsISupportsImpl.h"
 #include "nsIURI.h"
 #include "nsRect.h"
@@ -33,10 +34,8 @@ class BrowserBridgeHost;
  * nsFrameLoader will use BrowserHost, and a content process nsFrameLoader will
  * use BrowserBridgeHost.
  */
-class RemoteBrowser {
+class RemoteBrowser : public nsISupports {
  public:
-  NS_INLINE_DECL_PURE_VIRTUAL_REFCOUNTING
-
   typedef mozilla::layers::LayersId LayersId;
 
   // Try to cast this RemoteBrowser to a BrowserHost, may return null