--- a/dom/html/HTMLInputElement.cpp
+++ b/dom/html/HTMLInputElement.cpp
@@ -4124,17 +4124,17 @@ HTMLInputElement::SetValueOfRangeForUser
 
 void
 HTMLInputElement::StartNumberControlSpinnerSpin()
 {
   MOZ_ASSERT(!mNumberControlSpinnerIsSpinning);
 
   mNumberControlSpinnerIsSpinning = true;
 
-  nsRepeatService::GetInstance()->Start(HandleNumberControlSpin, this,
+  nsRepeatService::GetInstance()->Start(HandleNumberControlSpin, this, OwnerDoc(),
                                         NS_LITERAL_CSTRING("HandleNumberControlSpin"));
 
   // Capture the mouse so that we can tell if the pointer moves from one
   // spin button to the other, or to some other element:
   nsIPresShell::SetCapturingContent(this, CAPTURE_IGNOREALLOWED);
 
   nsNumberControlFrame* numberControlFrame =
     do_QueryFrame(GetPrimaryFrame());

--- a/layout/xul/nsRepeatService.cpp
+++ b/layout/xul/nsRepeatService.cpp
@@ -7,16 +7,17 @@
 // Eric Vaughan
 // Netscape Communications
 //
 // See documentation in associated header file
 //
 
 #include "nsRepeatService.h"
 #include "mozilla/StaticPtr.h"
+#include "nsIDocument.h"
 #include "nsIServiceManager.h"
 
 using namespace mozilla;
 
 static StaticAutoPtr<nsRepeatService> gRepeatService;
 
 nsRepeatService::nsRepeatService()
 : mCallback(nullptr), mCallbackData(nullptr)
@@ -40,29 +41,30 @@ nsRepeatService::GetInstance()
 /*static*/ void
 nsRepeatService::Shutdown()
 {
   gRepeatService = nullptr;
 }
 
 void
 nsRepeatService::Start(Callback aCallback, void* aCallbackData,
-                       const nsACString& aCallbackName,
+                       nsIDocument* aDocument, const nsACString& aCallbackName,
                        uint32_t aInitialDelay)
 {
   NS_PRECONDITION(aCallback != nullptr, "null ptr");
 
   mCallback = aCallback;
   mCallbackData = aCallbackData;
   mCallbackName = aCallbackName;
 
   nsresult rv;
   mRepeatTimer = do_CreateInstance("@mozilla.org/timer;1", &rv);
 
   if (NS_SUCCEEDED(rv))  {
+    mRepeatTimer->SetTarget(aDocument->EventTargetFor(TaskCategory::Other));
     InitTimerCallback(aInitialDelay);
   }
 }
 
 void nsRepeatService::Stop(Callback aCallback, void* aCallbackData)
 {
   if (mCallback != aCallback || mCallbackData != aCallbackData)
     return;

--- a/layout/xul/nsRepeatService.h
+++ b/layout/xul/nsRepeatService.h
@@ -15,33 +15,37 @@
 #define INITAL_REPEAT_DELAY 250
 
 #ifdef XP_MACOSX
 #define REPEAT_DELAY        25
 #else
 #define REPEAT_DELAY        50
 #endif
 
+class nsIDocument;
 class nsITimer;
 
 class nsRepeatService final
 {
 public:
   typedef void (* Callback)(void* aData);
 
   ~nsRepeatService();
 
   // Start dispatching timer events to the callback. There is no memory
   // management of aData here; it is the caller's responsibility to call
   // Stop() before aData's memory is released.
   //
   // aCallbackName is the label of the callback, used to pass to
   // InitWithNamedCallbackFunc.
+  //
+  // aDocument is used to get the event target in Start(). We need an event
+  // target to init mRepeatTimer.
   void Start(Callback aCallback, void* aCallbackData,
-             const nsACString& aCallbackName,
+             nsIDocument* aDocument, const nsACString& aCallbackName,
              uint32_t aInitialDelay = INITAL_REPEAT_DELAY);
   // Stop dispatching timer events to the callback. If the repeat service
   // is not currently configured with the given callback and data, this
   // is just ignored.
   void Stop(Callback aCallback, void* aData);
 
   static nsRepeatService* GetInstance();
   static void Shutdown();

--- a/layout/xul/nsScrollBoxFrame.cpp
+++ b/layout/xul/nsScrollBoxFrame.cpp
@@ -43,20 +43,22 @@ public:
 protected:
   explicit nsAutoRepeatBoxFrame(nsStyleContext* aContext):
     nsButtonBoxFrame(aContext) {}
   
   void StartRepeat() {
     if (IsActivatedOnHover()) {
       // No initial delay on hover.
       nsRepeatService::GetInstance()->Start(Notify, this,
+                                            mContent->OwnerDoc(),
                                             NS_LITERAL_CSTRING("DoMouseClick"),
                                             0);
     } else {
       nsRepeatService::GetInstance()->Start(Notify, this,
+                                            mContent->OwnerDoc(),
                                             NS_LITERAL_CSTRING("DoMouseClick"));
     }
   }
   void StopRepeat() {
     nsRepeatService::GetInstance()->Stop(Notify, this);
   }
   void Notify();
   static void Notify(void* aData) {

--- a/layout/xul/nsScrollbarButtonFrame.h
+++ b/layout/xul/nsScrollbarButtonFrame.h
@@ -61,16 +61,17 @@ public:
                            mozilla::WidgetGUIEvent* aEvent,
                            nsEventStatus* aEventStatus) override;
 
 protected:
   virtual void MouseClicked(mozilla::WidgetGUIEvent* aEvent) override;
 
   void StartRepeat() {
     nsRepeatService::GetInstance()->Start(Notify, this,
+                                          mContent->OwnerDoc(),
                                           NS_LITERAL_CSTRING("nsScrollbarButtonFrame"));
   }
   void StopRepeat() {
     nsRepeatService::GetInstance()->Stop(Notify, this);
   }
   void Notify();
   static void Notify(void* aData) {
     static_cast<nsScrollbarButtonFrame*>(aData)->Notify();

--- a/layout/xul/nsSliderFrame.h
+++ b/layout/xul/nsSliderFrame.h
@@ -163,16 +163,17 @@ private:
   void RemoveListener();
   bool isDraggingThumb();
 
   void SuppressDisplayport();
   void UnsuppressDisplayport();
 
   void StartRepeat() {
     nsRepeatService::GetInstance()->Start(Notify, this,
+                                          mContent->OwnerDoc(),
                                           NS_LITERAL_CSTRING("nsSliderFrame"));
   }
   void StopRepeat() {
     nsRepeatService::GetInstance()->Stop(Notify, this);
   }
   void Notify();
   static void Notify(void* aData) {
     (static_cast<nsSliderFrame*>(aData))->Notify();