diff --git a/dom/media/ChannelMediaResource.cpp b/dom/media/ChannelMediaResource.cpp
index c73a2a8b8116..ce35987e7974 100644
--- a/dom/media/ChannelMediaResource.cpp
+++ b/dom/media/ChannelMediaResource.cpp
@@ -619,6 +619,15 @@ already_AddRefed<BaseMediaResource> ChannelMediaResource::CloneData(
 void ChannelMediaResource::CloseChannel() {
   NS_ASSERTION(NS_IsMainThread(), "Only call on main thread");
 
+  // Revoking listener should be done before canceling the channel, because
+  // canceling the channel might cause the input stream to release its buffer.
+  // If we don't do revoke first, it's possible that `OnDataAvailable` would be
+  // called later and then incorrectly access that released buffer.
+  if (mListener) {
+    mListener->Revoke();
+    mListener = nullptr;
+  }
+
   if (mChannel) {
     mSuspendAgent.Revoke();
     // The status we use here won't be passed to the decoder, since
@@ -631,11 +640,6 @@ void ChannelMediaResource::CloseChannel() {
     mChannel->Cancel(NS_ERROR_PARSED_DATA_CACHED);
     mChannel = nullptr;
   }
-
-  if (mListener) {
-    mListener->Revoke();
-    mListener = nullptr;
-  }
 }
 
 nsresult ChannelMediaResource::ReadFromCache(char* aBuffer, int64_t aOffset,