--- a/dom/base/Element.cpp
+++ b/dom/base/Element.cpp
@@ -443,27 +443,25 @@ Element::GetBindingURL(nsIDocument *aDoc
   // (i.e. object, embed, or applet).
   bool isXULorPluginElement = (IsXULElement() ||
                                IsHTMLElement(nsGkAtoms::object) ||
                                IsHTMLElement(nsGkAtoms::embed) ||
                                IsHTMLElement(nsGkAtoms::applet));
   nsCOMPtr<nsIPresShell> shell = aDocument->GetShell();
   if (!shell || GetPrimaryFrame() || !isXULorPluginElement) {
     *aResult = nullptr;
-
     return true;
   }
 
   // Get the computed -moz-binding directly from the style context
   RefPtr<nsStyleContext> sc =
     nsComputedDOMStyle::GetStyleContextForElementNoFlush(this, nullptr, shell);
   NS_ENSURE_TRUE(sc, false);
 
-  *aResult = sc->StyleDisplay()->mBinding;
-
+  NS_IF_ADDREF(*aResult = sc->StyleDisplay()->mBinding);
   return true;
 }
 
 JSObject*
 Element::WrapObject(JSContext *aCx, JS::Handle<JSObject*> aGivenProto)
 {
   JS::Rooted<JSObject*> givenProto(aCx, aGivenProto);
   JS::Rooted<JSObject*> customProto(aCx);
@@ -530,18 +528,18 @@ Element::WrapObject(JSContext *aCx, JS::
     // run script if we also removed the binding from the PAQ queue, but that
     // seems like a scary change that would mosly just add more
     // inconsistencies.
     return obj;
   }
 
   // Make sure the style context goes away _before_ we load the binding
   // since that can destroy the relevant presshell.
-  mozilla::css::URLValue *bindingURL;
-  bool ok = GetBindingURL(doc, &bindingURL);
+  RefPtr<css::URLValue> bindingURL;
+  bool ok = GetBindingURL(doc, getter_AddRefs(bindingURL));
   if (!ok) {
     dom::Throw(aCx, NS_ERROR_FAILURE);
     return nullptr;
   }
 
   if (!bindingURL) {
     // No binding, nothing left to do here.
     return obj;

--- a/dom/base/Element.h
+++ b/dom/base/Element.h
@@ -382,17 +382,17 @@ public:
      * SetDirectionality for every element, and UpdateState is very very slow
      * for some elements.
      */
     if (aNotify) {
       UpdateState(true);
     }
   }
 
-  bool GetBindingURL(nsIDocument *aDocument, css::URLValue **aResult);
+  bool GetBindingURL(nsIDocument* aDocument, css::URLValue **aResult);
 
   // The bdi element defaults to dir=auto if it has no dir attribute set.
   // Other elements will only have dir=auto if they have an explicit dir=auto,
   // which will mean that HasValidDir() returns true but HasFixedDir() returns
   // false
   inline bool HasDirAuto() const {
     return (!HasFixedDir() &&
             (HasValidDir() || IsHTMLElement(nsGkAtoms::bdi)));