diff --git a/layout/style/nsCSSValue.h b/layout/style/nsCSSValue.h
index 09fb7bdb25d..cc53a25b49c 100644
--- a/layout/style/nsCSSValue.h
+++ b/layout/style/nsCSSValue.h
@@ -319,10 +319,18 @@ public:
     }
 
     void AddRef() {
+      if (mRefCnt == PR_UINT16_MAX) {
+        NS_WARNING("refcount overflow, leaking nsCSSValue::Array");
+        return;
+      }
       ++mRefCnt;
       NS_LOG_ADDREF(this, mRefCnt, "nsCSSValue::Array", sizeof(*this));
     }
     void Release() {
+      if (mRefCnt == PR_UINT16_MAX) {
+        NS_WARNING("refcount overflow, leaking nsCSSValue::Array");
+        return;
+      }
       --mRefCnt;
       NS_LOG_RELEASE(this, mRefCnt, "nsCSSValue::Array");
       if (mRefCnt == 0)
diff --git a/rdf/base/src/nsInMemoryDataSource.cpp b/rdf/base/src/nsInMemoryDataSource.cpp
index 6680eea5c23..b34d2040e1a 100644
--- a/rdf/base/src/nsInMemoryDataSource.cpp
+++ b/rdf/base/src/nsInMemoryDataSource.cpp
@@ -157,11 +157,22 @@ public:
 
     ~Assertion();
 
-    void AddRef() { ++mRefCnt; }
+    void AddRef() {
+        if (mRefCnt == PR_UINT16_MAX) {
+            NS_WARNING("refcount overflow, leaking Assertion");
+            return;
+        }
+        ++mRefCnt;
+    }
 
     void Release(nsFixedSizeAllocator& aAllocator) {
+        if (mRefCnt == PR_UINT16_MAX) {
+            NS_WARNING("refcount overflow, leaking Assertion");
+            return;
+        }
         if (--mRefCnt == 0)
-            Destroy(aAllocator, this); }
+            Destroy(aAllocator, this);
+    }
 
     // For nsIRDFPurgeableDataSource
     inline  void    Mark()      { u.as.mMarked = PR_TRUE; }
@@ -194,7 +205,7 @@ public:
     // also shared between hash/as (see the union above)
     // but placed after union definition to ensure that
     // all 32-bit entries are long aligned
-    PRInt16                     mRefCnt;
+    PRUint16                    mRefCnt;
     PRPackedBool                mHashEntry;
 
 private: