diff --git a/src/cairo-device.c b/src/cairo-device.c
index 1e5bf0f19..f8a499e3b 100644
--- a/src/cairo-device.c
+++ b/src/cairo-device.c
@@ -182,6 +182,8 @@ slim_hidden_def (cairo_device_finish);
 void
 cairo_device_destroy (cairo_device_t *device)
 {
+    cairo_user_data_array_t user_data;
+
     if (device == NULL ||
 	CAIRO_REFERENCE_COUNT_IS_INVALID (&device->ref_count))
     {
@@ -194,12 +196,15 @@ cairo_device_destroy (cairo_device_t *device)
 
     cairo_device_finish (device);
 
-    _cairo_user_data_array_fini (&device->user_data);
-
     assert (device->mutex_depth == 0);
     CAIRO_MUTEX_FINI (device->mutex);
 
+    user_data = device->user_data;
+
     device->backend->destroy (device);
+
+    _cairo_user_data_array_fini (&user_data);
+
 }
 slim_hidden_def (cairo_device_destroy);
 
diff --git a/src/cairo-surface.c b/src/cairo-surface.c
index e676b9280..cf7e05423 100644
--- a/src/cairo-surface.c
+++ b/src/cairo-surface.c
@@ -592,11 +592,11 @@ cairo_surface_destroy (cairo_surface_t *surface)
     /* paranoid check that nobody took a reference whilst finishing */
     assert (! CAIRO_REFERENCE_COUNT_HAS_REFERENCE (&surface->ref_count));
 
-    cairo_device_destroy (surface->device);
-
     _cairo_user_data_array_fini (&surface->user_data);
     _cairo_user_data_array_fini (&surface->mime_data);
 
+    cairo_device_destroy (surface->device);
+
     free (surface);
 }
 slim_hidden_def(cairo_surface_destroy);