--- a/dom/ipc/TabChild.cpp
+++ b/dom/ipc/TabChild.cpp
@@ -1076,16 +1076,20 @@ TabChild::DestroyWindow()
         mPuppetWidget->Destroy();
     }
 
     if (mRemoteFrame) {
         mRemoteFrame->Destroy();
         mRemoteFrame = nullptr;
     }
 
+    if (mApzcTreeManager) {
+      mApzcTreeManager->Destroy();
+      mApzcTreeManager = nullptr;
+    }
 
     if (mLayersId.IsValid()) {
       StaticMutexAutoLock lock(sTabChildrenMutex);
 
       MOZ_ASSERT(sTabChildren);
       sTabChildren->Remove(uint64_t(mLayersId));
       if (!sTabChildren->Count()) {
         delete sTabChildren;

--- a/gfx/layers/apz/public/IAPZCTreeManager.h
+++ b/gfx/layers/apz/public/IAPZCTreeManager.h
@@ -131,16 +131,18 @@ public:
    * Returns an APZInputBridge interface that can be used to send input
    * events to APZ in a synchronous manner. This will always be non-null, and
    * the returned object's lifetime will match the lifetime of this
    * IAPZCTreeManager implementation.
    * It is only valid to call this function in the UI process.
    */
   virtual APZInputBridge* InputBridge() = 0;
 
+  virtual void Destroy() {}
+
 protected:
 
   // Discourage destruction outside of decref
 
   virtual ~IAPZCTreeManager() { }
 };
 
 } // namespace layers

--- a/gfx/layers/ipc/APZCTreeManagerChild.cpp
+++ b/gfx/layers/ipc/APZCTreeManagerChild.cpp
@@ -46,16 +46,17 @@ APZCTreeManagerChild::SetInputBridge(APZ
 void
 APZCTreeManagerChild::Destroy()
 {
   MOZ_ASSERT(NS_IsMainThread());
   if (mInputBridge) {
     mInputBridge->Destroy();
     mInputBridge = nullptr;
   }
+  Send__delete__(this);
 }
 
 void
 APZCTreeManagerChild::SetKeyboardMap(const KeyboardMap& aKeyboardMap)
 {
   SendSetKeyboardMap(aKeyboardMap);
 }
 

--- a/gfx/layers/ipc/APZCTreeManagerChild.h
+++ b/gfx/layers/ipc/APZCTreeManagerChild.h
@@ -21,17 +21,18 @@ class APZCTreeManagerChild
   : public IAPZCTreeManager
   , public PAPZCTreeManagerChild
 {
 public:
   APZCTreeManagerChild();
 
   void SetCompositorSession(RemoteCompositorSession* aSession);
   void SetInputBridge(APZInputBridgeChild* aInputBridge);
-  void Destroy();
+
+  void Destroy() override;
 
   void
   SetKeyboardMap(const KeyboardMap& aKeyboardMap) override;
 
   void
   ZoomToRect(
           const ScrollableLayerGuid& aGuid,
           const CSSRect& aRect,

--- a/gfx/layers/ipc/PAPZCTreeManager.ipdl
+++ b/gfx/layers/ipc/PAPZCTreeManager.ipdl
@@ -30,16 +30,21 @@ namespace layers {
 /**
  * PAPZCTreeManager is a protocol for remoting an IAPZCTreeManager. PAPZCTreeManager
  * lives on the PCompositorBridge protocol which either connects to the compositor
  * thread in the main process, or to the compositor thread in the gpu processs.
  *
  * PAPZCTreeManagerParent lives in the compositor thread, while PAPZCTreeManagerChild
  * lives in the main thread of the main or the content process. APZCTreeManagerParent
  * and APZCTreeManagerChild implement this protocol.
+ *
+ * There is one instance of PAPZCTreeManager for each top-level window, plus one
+ * instance for each tab. The child instances are managed by the RemoteCompositorSession
+ * and TabChild classes, respectively. The parent instances are held in the
+ * compositor's sIndirectLayerTrees structure.
  */
 protocol PAPZCTreeManager
 {
 manager PCompositorBridge;
 
 parent:
 
   // These messages correspond to the methods