--- a/chrome/nsChromeProtocolHandler.cpp
+++ b/chrome/nsChromeProtocolHandler.cpp
@@ -8,16 +8,17 @@
 
   A protocol handler for ``chrome:''
 
 */
 
 #include "nsChromeProtocolHandler.h"
 #include "nsChromeRegistry.h"
 #include "nsCOMPtr.h"
+#include "nsContentUtils.h"
 #include "nsThreadUtils.h"
 #include "nsIChannel.h"
 #include "nsIChromeRegistry.h"
 #include "nsIFile.h"
 #include "nsIFileChannel.h"
 #include "nsIIOService.h"
 #include "nsILoadGroup.h"
 #include "nsIScriptSecurityManager.h"
@@ -181,28 +182,18 @@ nsChromeProtocolHandler::NewChannel2(nsI
     rv = result->SetOriginalURI(aURI);
     if (NS_FAILED(rv)) return rv;
 
     // Get a system principal for content files and set the owner
     // property of the result
     nsCOMPtr<nsIURL> url = do_QueryInterface(aURI);
     nsAutoCString path;
     rv = url->GetPath(path);
-    if (StringBeginsWith(path, NS_LITERAL_CSTRING("/content/")))
-    {
-        nsCOMPtr<nsIScriptSecurityManager> securityManager =
-                 do_GetService(NS_SCRIPTSECURITYMANAGER_CONTRACTID, &rv);
-        if (NS_FAILED(rv)) return rv;
-
-        nsCOMPtr<nsIPrincipal> principal;
-        rv = securityManager->GetSystemPrincipal(getter_AddRefs(principal));
-        if (NS_FAILED(rv)) return rv;
-
-        nsCOMPtr<nsISupports> owner = do_QueryInterface(principal);
-        result->SetOwner(owner);
+    if (StringBeginsWith(path, NS_LITERAL_CSTRING("/content/"))) {
+        result->SetOwner(nsContentUtils::GetSystemPrincipal());
     }
 
     // XXX Removed dependency-tracking code from here, because we're not
     // tracking them anyways (with fastload we checked only in DEBUG
     // and with startupcache not at all), but this is where we would start
     // if we need to re-add.
     // See bug 531886, bug 533038.
     result->SetContentCharset(NS_LITERAL_CSTRING("UTF-8"));

--- a/dom/base/test/gtest/TestNativeXMLHttpRequest.cpp
+++ b/dom/base/test/gtest/TestNativeXMLHttpRequest.cpp
@@ -23,25 +23,17 @@ TEST(NativeXMLHttpRequest, Test)
   nsCOMPtr<nsIXMLHttpRequest> xhr =
     do_CreateInstance(NS_XMLHTTPREQUEST_CONTRACTID, &rv);
   ASSERT_TRUE(NS_SUCCEEDED(rv)) << "Couldn't create nsIXMLHttpRequest instance";
 
   NS_NAMED_LITERAL_CSTRING(getString, "GET");
   NS_NAMED_LITERAL_CSTRING(testURL, TEST_URL);
   const nsAString& empty = EmptyString();
 
-  nsCOMPtr<nsIScriptSecurityManager> secman =
-    do_GetService(NS_SCRIPTSECURITYMANAGER_CONTRACTID, &rv);
-  ASSERT_TRUE(NS_SUCCEEDED(rv)) << "Couldn't get script security manager";
-
-  nsCOMPtr<nsIPrincipal> systemPrincipal;
-  rv = secman->GetSystemPrincipal(getter_AddRefs(systemPrincipal));
-  ASSERT_TRUE(NS_SUCCEEDED(rv)) << "Couldn't get system principal";
-
-  rv = xhr->Init(systemPrincipal, nullptr, nullptr, nullptr);
+  rv = xhr->Init(nsContentUtils::GetSystemPrincipal(), nullptr, nullptr, nullptr);
   ASSERT_TRUE(NS_SUCCEEDED(rv)) << "Couldn't initialize the XHR";
 
   rv = xhr->Open(getString, testURL, false, empty, empty);
   ASSERT_TRUE(NS_SUCCEEDED(rv)) << "Open failed";
 
   rv = xhr->Send(nullptr);
   ASSERT_TRUE(NS_SUCCEEDED(rv)) << "Send failed";
 

--- a/media/webrtc/signaling/src/peerconnection/PeerConnectionMedia.cpp
+++ b/media/webrtc/signaling/src/peerconnection/PeerConnectionMedia.cpp
@@ -23,16 +23,17 @@
 #include "signaling/src/jsep/JsepSession.h"
 #include "signaling/src/jsep/JsepTransport.h"
 
 #include "MediaSegment.h"
 #include "MediaStreamGraph.h"
 
 #include "MediaStreamGraphImpl.h"
 
+#include "nsContentUtils.h"
 #include "nsNetCID.h"
 #include "nsNetUtil.h"
 #include "nsIURI.h"
 #include "nsIScriptSecurityManager.h"
 #include "nsICancelable.h"
 #include "nsILoadInfo.h"
 #include "nsIContentPolicy.h"
 #include "nsIProxyInfo.h"
@@ -336,36 +337,20 @@ PeerConnectionMedia::InitProxy()
   // "example.com" is guaranteed to be unallocated and should return the best default.
   nsCOMPtr<nsIURI> fakeHttpsLocation;
   rv = NS_NewURI(getter_AddRefs(fakeHttpsLocation), "https://example.com");
   if (NS_FAILED(rv)) {
     CSFLogError(logTag, "%s: Failed to set URI: %d", __FUNCTION__, (int)rv);
     return NS_ERROR_FAILURE;
   }
 
-  nsCOMPtr<nsIScriptSecurityManager> secMan(
-      do_GetService(NS_SCRIPTSECURITYMANAGER_CONTRACTID, &rv));
-  if (NS_FAILED(rv)) {
-    CSFLogError(logTag, "%s: Failed to get IOService: %d",
-        __FUNCTION__, (int)rv);
-    CSFLogError(logTag, "%s: Failed to get securityManager: %d", __FUNCTION__, (int)rv);
-    return NS_ERROR_FAILURE;
-  }
-
-  nsCOMPtr<nsIPrincipal> systemPrincipal;
-  rv = secMan->GetSystemPrincipal(getter_AddRefs(systemPrincipal));
-  if (NS_FAILED(rv)) {
-    CSFLogError(logTag, "%s: Failed to get systemPrincipal: %d", __FUNCTION__, (int)rv);
-    return NS_ERROR_FAILURE;
-  }
-
   nsCOMPtr<nsIChannel> channel;
   rv = NS_NewChannel(getter_AddRefs(channel),
                      fakeHttpsLocation,
-                     systemPrincipal,
+                     nsContentUtils::GetSystemPrincipal(),
                      nsILoadInfo::SEC_ALLOW_CROSS_ORIGIN_DATA_IS_NULL,
                      nsIContentPolicy::TYPE_OTHER);
 
   if (NS_FAILED(rv)) {
     CSFLogError(logTag, "%s: Failed to get channel from URI: %d",
                 __FUNCTION__, (int)rv);
     return NS_ERROR_FAILURE;
   }

--- a/netwerk/base/nsIOService.cpp
+++ b/netwerk/base/nsIOService.cpp
@@ -1849,24 +1849,20 @@ nsIOService::SpeculativeConnectInternal(
     nsCOMPtr<nsIProtocolProxyService> pps =
             do_GetService(NS_PROTOCOLPROXYSERVICE_CONTRACTID, &rv);
     NS_ENSURE_SUCCESS(rv, rv);
 
     nsCOMPtr<nsIPrincipal> loadingPrincipal = aPrincipal;
 
     NS_ASSERTION(aPrincipal, "We expect passing a principal here.");
 
-    // If the principal is given, we use this prinicpal directly. Otherwise,
+    // If the principal is given, we use this principal directly. Otherwise,
     // we fallback to use the system principal.
     if (!aPrincipal) {
-        nsCOMPtr<nsIScriptSecurityManager> secMan(
-            do_GetService(NS_SCRIPTSECURITYMANAGER_CONTRACTID, &rv));
-        NS_ENSURE_SUCCESS(rv, rv);
-        rv = secMan->GetSystemPrincipal(getter_AddRefs(loadingPrincipal));
-        NS_ENSURE_SUCCESS(rv, rv);
+        loadingPrincipal = nsContentUtils::GetSystemPrincipal();
     }
 
     // dummy channel used to create a TCP connection.
     // we perform security checks on the *real* channel, responsible
     // for any network loads. this real channel just checks the TCP
     // pool if there is an available connection created by the
     // channel we create underneath - hence it's safe to use
     // the systemPrincipal as the loadingPrincipal for this channel.

--- a/netwerk/base/nsProtocolProxyService.cpp
+++ b/netwerk/base/nsProtocolProxyService.cpp
@@ -16,16 +16,17 @@
 #include "nsIProtocolProxyCallback.h"
 #include "nsIChannel.h"
 #include "nsICancelable.h"
 #include "nsIDNSService.h"
 #include "nsPIDNSService.h"
 #include "nsIScriptSecurityManager.h"
 #include "nsIPrefService.h"
 #include "nsIPrefBranch.h"
+#include "nsContentUtils.h"
 #include "nsThreadUtils.h"
 #include "nsQueryObject.h"
 #include "nsSOCKSIOLayer.h"
 #include "nsString.h"
 #include "nsNetUtil.h"
 #include "nsNetCID.h"
 #include "plstr.h"
 #include "prnetdb.h"
@@ -1410,29 +1411,22 @@ nsProtocolProxyService::AsyncResolve(nsI
     // Check if we got a channel:
     nsCOMPtr<nsIChannel> channel = do_QueryInterface(channelOrURI);
     if (!channel) {
         nsCOMPtr<nsIURI> uri = do_QueryInterface(channelOrURI);
         if (!uri) {
             return NS_ERROR_NO_INTERFACE;
         }
 
-        nsCOMPtr<nsIScriptSecurityManager> secMan(
-            do_GetService(NS_SCRIPTSECURITYMANAGER_CONTRACTID, &rv));
-        NS_ENSURE_SUCCESS(rv, rv);
-        nsCOMPtr<nsIPrincipal> systemPrincipal;
-        rv = secMan->GetSystemPrincipal(getter_AddRefs(systemPrincipal));
-        NS_ENSURE_SUCCESS(rv, rv);
-
         // creating a temporary channel from the URI which is not
         // used to perform any network loads, hence its safe to
         // use systemPrincipal as the loadingPrincipal.
         rv = NS_NewChannel(getter_AddRefs(channel),
                            uri,
-                           systemPrincipal,
+                           nsContentUtils::GetSystemPrincipal(),
                            nsILoadInfo::SEC_ALLOW_CROSS_ORIGIN_DATA_IS_NULL,
                            nsIContentPolicy::TYPE_OTHER);
         NS_ENSURE_SUCCESS(rv, rv);
     }
 
     return AsyncResolveInternal(channel, flags, callback,
                                 result, false, mainThreadEventTarget);
 }

--- a/netwerk/test/TestUDPSocket.cpp
+++ b/netwerk/test/TestUDPSocket.cpp
@@ -7,16 +7,17 @@
 #include "nsIUDPSocket.h"
 #include "nsISocketTransportService.h"
 #include "nsISocketTransport.h"
 #include "nsIOutputStream.h"
 #include "nsIInputStream.h"
 #include "nsINetAddr.h"
 #include "nsIScriptSecurityManager.h"
 #include "nsITimer.h"
+#include "nsContentUtils.h"
 #include "mozilla/net/DNS.h"
 #include "prerror.h"
 
 #define REQUEST  0x68656c6f
 #define RESPONSE 0x6f6c6568
 #define MULTICAST_TIMEOUT 2000
 
 enum TestPhase {
@@ -253,23 +254,17 @@ TEST(TestUDPSocket, TestUDPSocketMain)
   client = do_CreateInstance("@mozilla.org/network/udp-socket;1", &rv);
   ASSERT_TRUE(NS_SUCCEEDED(rv));
 
   RefPtr<WaitForCondition> waiter = new WaitForCondition();
 
   // Create UDPServerListener to process UDP packets
   RefPtr<UDPServerListener> serverListener = new UDPServerListener(waiter);
 
-  nsCOMPtr<nsIScriptSecurityManager> secman =
-    do_GetService(NS_SCRIPTSECURITYMANAGER_CONTRACTID, &rv);
-  ASSERT_TRUE(NS_SUCCEEDED(rv));
-
-  nsCOMPtr<nsIPrincipal> systemPrincipal;
-  rv = secman->GetSystemPrincipal(getter_AddRefs(systemPrincipal));
-  ASSERT_TRUE(NS_SUCCEEDED(rv));
+  nsCOMPtr<nsIPrincipal> systemPrincipal = nsContentUtils::GetSystemPrincipal();
 
   // Bind server socket to 0.0.0.0
   rv = server->Init(0, false, systemPrincipal, true, 0);
   ASSERT_TRUE(NS_SUCCEEDED(rv));
   int32_t serverPort;
   server->GetPort(&serverPort);
   server->AsyncListen(serverListener);