diff --git a/xpcom/build/mozPoisonWrite.h b/xpcom/build/mozPoisonWrite.h
index ce70207850a3..f186793f3c38 100644
--- a/xpcom/build/mozPoisonWrite.h
+++ b/xpcom/build/mozPoisonWrite.h
@@ -26,6 +26,7 @@ enum ShutdownChecksMode {
 };
 extern ShutdownChecksMode gShutdownChecks;
 
+void InitWritePoisoning();
 void PoisonWrite();
 void DisableWritePoisoning();
 void EnableWritePoisoning();
diff --git a/xpcom/build/mozPoisonWriteBase.cpp b/xpcom/build/mozPoisonWriteBase.cpp
index 08173642d72a..b98b7eb0837e 100644
--- a/xpcom/build/mozPoisonWriteBase.cpp
+++ b/xpcom/build/mozPoisonWriteBase.cpp
@@ -41,7 +41,7 @@ std::vector<int>& getDebugFDs() {
   return *DebugFDs;
 }
 
-void PoisonWriteBase()
+void InitWritePoisoning()
 {
   nsCOMPtr<nsIFile> mozFile;
   NS_GetSpecialDirectory(NS_APP_USER_PROFILE_50_DIR, getter_AddRefs(mozFile));
diff --git a/xpcom/build/mozPoisonWriteBase.h b/xpcom/build/mozPoisonWriteBase.h
index 84a2431c06a8..3d7565164a0f 100644
--- a/xpcom/build/mozPoisonWriteBase.h
+++ b/xpcom/build/mozPoisonWriteBase.h
@@ -44,7 +44,6 @@ public:
 };
 
 bool PoisonWriteEnabled();
-void PoisonWriteBase();
 bool ValidWriteAssert(bool ok);
 void BaseCleanup();
 // This method should always be called with the debugFDs lock.
diff --git a/xpcom/build/mozPoisonWriteMac.cpp b/xpcom/build/mozPoisonWriteMac.cpp
index 7e4e520e3da7..133308507ba4 100644
--- a/xpcom/build/mozPoisonWriteMac.cpp
+++ b/xpcom/build/mozPoisonWriteMac.cpp
@@ -247,8 +247,6 @@ void PoisonWrite() {
     if (!PoisonWriteEnabled())
         return;
 
-    PoisonWriteBase();
-
     for (int i = 0; i < NumFunctions; ++i) {
         FuncData *d = Functions[i];
         if (!d->Function)
diff --git a/xpcom/build/mozPoisonWriteWin.cpp b/xpcom/build/mozPoisonWriteWin.cpp
index aa3654ff5c9c..b125367eb0c0 100644
--- a/xpcom/build/mozPoisonWriteWin.cpp
+++ b/xpcom/build/mozPoisonWriteWin.cpp
@@ -48,8 +48,6 @@ void PoisonWrite() {
   if (!PoisonWriteEnabled())
     return;
 
-  PoisonWriteBase();
-
   sNtDllInterceptor.Init("ntdll.dll");
   sNtDllInterceptor.AddHook("NtFlushBuffersFile", reinterpret_cast<intptr_t>(patched_FlushBuffersFile), reinterpret_cast<void**>(&gOriginalFlushBuffersFile));
 }
diff --git a/xpcom/build/nsXPComInit.cpp b/xpcom/build/nsXPComInit.cpp
index 7ed4425056dc..41da88e3b16f 100644
--- a/xpcom/build/nsXPComInit.cpp
+++ b/xpcom/build/nsXPComInit.cpp
@@ -600,6 +600,10 @@ ShutdownXPCOM(nsIServiceManager* servMgr)
     // observers themselves might call ClearOnShutdown().
     mozilla::KillClearOnShutdown();
 
+    // Write poisoning needs to find the profile directory, so it has to
+    // be initialized before mozilla::services::Shutdown.
+    InitWritePoisoning();
+
     // XPCOM is officially in shutdown mode NOW
     // Set this only after the observers have been notified as this
     // will cause servicemanager to become inaccessible.