--- a/layout/style/FontFaceSet.cpp
+++ b/layout/style/FontFaceSet.cpp
@@ -101,28 +101,47 @@ FontFaceSet::FontFaceSet(nsPIDOMWindowIn
   : DOMEventTargetHelper(aWindow)
   , mDocument(aDocument)
   , mResolveLazilyCreatedReadyPromise(false)
   , mStatus(FontFaceSetLoadStatus::Loaded)
   , mNonRuleFacesDirty(false)
   , mHasLoadingFontFaces(false)
   , mHasLoadingFontFacesIsDirty(false)
   , mDelayedLoadCheck(false)
+  , mBypassCache(false)
 {
   MOZ_ASSERT(mDocument, "We should get a valid document from the caller!");
 
   nsCOMPtr<nsIGlobalObject> global = do_QueryInterface(aWindow);
 
   // If the pref is not set, don't create the Promise (which the page wouldn't
   // be able to get to anyway) as it causes the window.FontFaceSet constructor
   // to be created.
   if (global && PrefEnabled()) {
     mResolveLazilyCreatedReadyPromise = true;
   }
 
+  // Record the state of the "bypass cache" flags from the docshell now,
+  // since we want to look at them from style worker threads, and we can
+  // only get to the docshell through a weak pointer (which is only
+  // possible on the main thread).
+  //
+  // In theory the load type of a docshell could change after the document
+  // is loaded, but handling that doesn't seem too important.
+  if (nsCOMPtr<nsIDocShell> docShell = mDocument->GetDocShell()) {
+    uint32_t loadType;
+    uint32_t flags;
+    if ((NS_SUCCEEDED(docShell->GetLoadType(&loadType)) &&
+         ((loadType >> 16) & nsIWebNavigation::LOAD_FLAGS_BYPASS_CACHE)) ||
+        (NS_SUCCEEDED(docShell->GetDefaultLoadFlags(&flags)) &&
+         (flags & nsIRequest::LOAD_BYPASS_CACHE))) {
+      mBypassCache = true;
+    }
+  }
+
   if (!mDocument->DidFireDOMContentLoaded()) {
     mDocument->AddSystemEventListener(NS_LITERAL_STRING("DOMContentLoaded"),
                                       this, false, false);
   }
 
   mDocument->CSSLoader()->AddObserver(this);
 
   mUserFontSet = new UserFontSet(this);
@@ -1322,33 +1341,17 @@ FontFaceSet::CheckFontLoad(const gfxFont
   *aPrincipal = mDocument->NodePrincipal();
 
   NS_ASSERTION(aFontFaceSrc->mOriginPrincipal,
                "null origin principal in @font-face rule");
   if (aFontFaceSrc->mUseOriginPrincipal) {
     *aPrincipal = aFontFaceSrc->mOriginPrincipal;
   }
 
-  *aBypassCache = false;
-
-  nsCOMPtr<nsIDocShell> docShell = mDocument->GetDocShell();
-  if (docShell) {
-    uint32_t loadType;
-    if (NS_SUCCEEDED(docShell->GetLoadType(&loadType))) {
-      if ((loadType >> 16) & nsIWebNavigation::LOAD_FLAGS_BYPASS_CACHE) {
-        *aBypassCache = true;
-      }
-    }
-    uint32_t flags;
-    if (NS_SUCCEEDED(docShell->GetDefaultLoadFlags(&flags))) {
-      if (flags & nsIRequest::LOAD_BYPASS_CACHE) {
-        *aBypassCache = true;
-      }
-    }
-  }
+  *aBypassCache = mBypassCache;
 
   return NS_OK;
 }
 
 // @arg aPrincipal: generally this is mDocument->NodePrincipal() but
 // might also be the original principal which enables user stylesheets
 // to load font files via @font-face rules.
 bool

--- a/layout/style/FontFaceSet.h
+++ b/layout/style/FontFaceSet.h
@@ -350,14 +350,18 @@ private:
   bool mHasLoadingFontFaces;
 
   // This variable is only valid when mLoadingDirty is false.
   bool mHasLoadingFontFacesIsDirty;
 
   // Whether CheckLoadingFinished calls should be ignored.  See comment in
   // OnFontFaceStatusChanged.
   bool mDelayedLoadCheck;
+
+  // Whether the docshell for our document indicated that loads should
+  // bypass the cache.
+  bool mBypassCache;
 };
 
 } // namespace dom
 } // namespace mozilla
 
 #endif // !defined(mozilla_dom_FontFaceSet_h)