--- a/toolkit/content/tests/browser/browser_crash_previous_frameloader.js
+++ b/toolkit/content/tests/browser/browser_crash_previous_frameloader.js
@@ -86,29 +86,23 @@ add_task(function* test_crash_in_previou
 
       let dies = function() {
         privateNoteIntentionalCrash();
         let zero = new ctypes.intptr_t(8);
         let badptr = ctypes.cast(zero, ctypes.PointerType(ctypes.int32_t));
         badptr.contents
       };
 
-      // Use a timeout to give the parent a little extra time
-      // to flip the remoteness of the browser. This has the
-      // potential to be a bit race-y, since in theory, the
-      // setTimeout could complete before the parent finishes
-      // the remoteness flip, which would mean we'd get the
-      // oop-browser-crashed event, and we'll fail here.
-      // Unfortunately, I can't find a way around that right
-      // now, since you cannot send a frameloader a message
-      // once its been replaced.
-      setTimeout(() => {
+      // When the parent flips the remoteness of the browser, the
+      // page should receive the pagehide event, which we'll then
+      // use to crash the frameloader.
+      addEventListener("pagehide", function() {
         dump("\nEt tu, Brute?\n");
         dies();
-      }, 0);
+      });
     });
 
     gBrowser.updateBrowserRemoteness(browser, false);
     info("Waiting for content process to go away.");
     let [subject /* , data */] = yield contentProcessGone;
 
     // If we don't clean up the minidump, the harness will
     // complain.