--- a/dom/events/Event.cpp
+++ b/dom/events/Event.cpp
@@ -253,30 +253,30 @@ Event::IsChrome(JSContext* aCx) const
     xpc::AccessCheck::isChrome(js::GetContextCompartment(aCx)) :
     mozilla::dom::workers::IsCurrentThreadRunningChromeWorker();
 }
 
 // nsIDOMEventInterface
 NS_METHOD
 Event::GetType(nsAString& aType)
 {
-  if (!mIsMainThreadEvent || !mEvent->typeString.IsEmpty()) {
-    aType = mEvent->typeString;
+  if (!mIsMainThreadEvent || !mEvent->mSpecifiedEventTypeString.IsEmpty()) {
+    aType = mEvent->mSpecifiedEventTypeString;
     return NS_OK;
   }
   const char* name = GetEventName(mEvent->mMessage);
 
   if (name) {
     CopyASCIItoUTF16(name, aType);
     return NS_OK;
   } else if (mEvent->mMessage == eUnidentifiedEvent &&
              mEvent->mSpecifiedEventType) {
     // Remove "on"
     aType = Substring(nsDependentAtomString(mEvent->mSpecifiedEventType), 2);
-    mEvent->typeString = aType;
+    mEvent->mSpecifiedEventTypeString = aType;
     return NS_OK;
   }
 
   aType.Truncate();
   return NS_OK;
 }
 
 static EventTarget*
@@ -544,24 +544,24 @@ Event::PreventDefaultInternal(bool aCall
     dragEvent->mDefaultPreventedOnContent = true;
   }
 }
 
 void
 Event::SetEventType(const nsAString& aEventTypeArg)
 {
   if (mIsMainThreadEvent) {
-    mEvent->typeString.Truncate();
+    mEvent->mSpecifiedEventTypeString.Truncate();
     mEvent->mSpecifiedEventType =
       nsContentUtils::GetEventMessageAndAtom(aEventTypeArg, mEvent->mClass,
                                              &(mEvent->mMessage));
   } else {
     mEvent->mSpecifiedEventType = nullptr;
     mEvent->mMessage = eUnidentifiedEvent;
-    mEvent->typeString = aEventTypeArg;
+    mEvent->mSpecifiedEventTypeString = aEventTypeArg;
   }
 }
 
 void
 Event::InitEvent(const nsAString& aEventTypeArg,
                  bool aCanBubbleArg,
                  bool aCancelableArg)
 {

--- a/dom/events/Event.h
+++ b/dom/events/Event.h
@@ -298,17 +298,17 @@ public:
     : mEvent(aEvent->InternalDOMEvent()),
       mOrigMessage(mEvent->mEvent->mMessage)
   {
     MOZ_ASSERT(aOverridingMessage != mOrigMessage,
                "Don't use this class if you're not actually overriding");
     MOZ_ASSERT(aOverridingMessage != eUnidentifiedEvent,
                "Only use this class with a valid overriding EventMessage");
     MOZ_ASSERT(mOrigMessage != eUnidentifiedEvent &&
-               mEvent->mEvent->typeString.IsEmpty(),
+               mEvent->mEvent->mSpecifiedEventTypeString.IsEmpty(),
                "Only use this class on events whose overridden type is "
                "known (so we can restore it properly)");
 
     mEvent->mEvent->mMessage = aOverridingMessage;
   }
 
   ~EventMessageAutoOverride()
   {

--- a/dom/events/EventListenerManager.cpp
+++ b/dom/events/EventListenerManager.cpp
@@ -671,17 +671,17 @@ EventListenerManager::ListenerCanHandle(
   // the same
   if (aListener->mAllEvents) {
     return true;
   }
   if (aEvent->mMessage == eUnidentifiedEvent) {
     if (mIsMainThreadELM) {
       return aListener->mTypeAtom == aEvent->mSpecifiedEventType;
     }
-    return aListener->mTypeString.Equals(aEvent->typeString);
+    return aListener->mTypeString.Equals(aEvent->mSpecifiedEventTypeString);
   }
   MOZ_ASSERT(mIsMainThreadELM);
   return aListener->mEventMessage == aEventMessage;
 }
 
 void
 EventListenerManager::AddEventListenerByType(
                         const EventListenerHolder& aListenerHolder,

--- a/widget/BasicEvents.h
+++ b/widget/BasicEvents.h
@@ -335,33 +335,36 @@ public:
   // See BaseEventFlags definition for the detail.
   BaseEventFlags mFlags;
 
   // If JS creates an event with unknown event type or known event type but
   // for different event interface, the event type is stored to this.
   // NOTE: This is always used if the instance is a WidgetCommandEvent instance.
   nsCOMPtr<nsIAtom> mSpecifiedEventType;
 
-  nsString typeString; // always set on non-main-thread events
+  // nsIAtom isn't available on non-main thread due to unsafe.  Therefore,
+  // mSpecifiedEventTypeString is used instead of mSpecifiedEventType if
+  // the event is created in non-main thread.
+  nsString mSpecifiedEventTypeString;
 
   // Event targets, needed by DOM Events
   nsCOMPtr<dom::EventTarget> target;
   nsCOMPtr<dom::EventTarget> currentTarget;
   nsCOMPtr<dom::EventTarget> originalTarget;
 
   void AssignEventData(const WidgetEvent& aEvent, bool aCopyTargets)
   {
     // mClass should be initialized with the constructor.
     // mMessage should be initialized with the constructor.
     mRefPoint = aEvent.mRefPoint;
     // mLastRefPoint doesn't need to be copied.
     AssignEventTime(aEvent);
     // mFlags should be copied manually if it's necessary.
     mSpecifiedEventType = aEvent.mSpecifiedEventType;
-    // typeString should be copied manually if it's necessary.
+    // mSpecifiedEventTypeString should be copied manually if it's necessary.
     target = aCopyTargets ? aEvent.target : nullptr;
     currentTarget = aCopyTargets ? aEvent.currentTarget : nullptr;
     originalTarget = aCopyTargets ? aEvent.originalTarget : nullptr;
   }
 
   /**
    * Helper methods for methods of DOM Event.
    */