--- a/docshell/base/nsDocShell.cpp
+++ b/docshell/base/nsDocShell.cpp
@@ -11160,17 +11160,18 @@ nsDocShell::DoURILoad(nsIURI* aURI,
           NS_ShouldCheckAppCache(principal));
       }
     }
   }
 
   // Make sure to give the caller a channel if we managed to create one
   // This is important for correct error page/session history interaction
   if (aRequest) {
-    NS_ADDREF(*aRequest = channel);
+    nsCOMPtr<nsIRequest> req = do_QueryInterface(channel);
+    req.forget(aRequest);
   }
 
   if (aOriginalURI) {
     channel->SetOriginalURI(aOriginalURI);
     // The LOAD_REPLACE flag and its handling here will be removed as part
     // of bug 1319110.  For now preserve its restoration here to not break
     // any code expecting it being set specially on redirected channels.
     // If the flag has originally been set to change result of