--- a/docshell/base/nsDocShell.cpp
+++ b/docshell/base/nsDocShell.cpp
@@ -131,16 +131,17 @@
 #include "nsITabChild.h"
 #include "nsITextToSubURI.h"
 #include "nsITimedChannel.h"
 #include "nsITimer.h"
 #include "nsITransportSecurityInfo.h"
 #include "nsIUploadChannel.h"
 #include "nsIURIFixup.h"
 #include "nsIURILoader.h"
+#include "nsIURIMutator.h"
 #include "nsIURL.h"
 #include "nsIViewSourceChannel.h"
 #include "nsIWebBrowserChrome.h"
 #include "nsIWebBrowserChrome3.h"
 #include "nsIWebBrowserChromeFocus.h"
 #include "nsIWebBrowserFind.h"
 #include "nsIWebProgress.h"
 #include "nsIWidget.h"
@@ -1036,23 +1037,21 @@ nsDocShell::LoadStream(nsIInputStream* a
 
   // if the caller doesn't pass in a URI we need to create a dummy URI. necko
   // currently requires a URI in various places during the load. Some consumers
   // do as well.
   nsCOMPtr<nsIURI> uri = aURI;
   if (!uri) {
     // HACK ALERT
     nsresult rv = NS_OK;
-    uri = do_CreateInstance(NS_SIMPLEURI_CONTRACTID, &rv);
-    if (NS_FAILED(rv)) {
-      return rv;
-    }
     // Make sure that the URI spec "looks" like a protocol and path...
     // For now, just use a bogus protocol called "internal"
-    rv = uri->SetSpec(NS_LITERAL_CSTRING("internal:load-stream"));
+    rv = NS_MutateURI(NS_SIMPLEURIMUTATOR_CONTRACTID)
+           .SetSpec(NS_LITERAL_CSTRING("internal:load-stream"))
+           .Finalize(uri);
     if (NS_FAILED(rv)) {
       return rv;
     }
   }
 
   uint32_t loadType = LOAD_NORMAL;
   nsCOMPtr<nsIPrincipal> triggeringPrincipal;
   if (aLoadInfo) {

--- a/layout/generic/nsImageFrame.cpp
+++ b/layout/generic/nsImageFrame.cpp
@@ -52,16 +52,17 @@
 #include "nsIDOMNode.h"
 #include "nsLayoutUtils.h"
 #include "nsDisplayList.h"
 #include "nsIContent.h"
 #include "nsIDocument.h"
 #include "FrameLayerBuilder.h"
 #include "nsISelectionController.h"
 #include "nsISelection.h"
+#include "nsIURIMutator.h"
 
 #include "imgIContainer.h"
 #include "imgLoader.h"
 #include "imgRequestProxy.h"
 
 #include "nsCSSFrameConstructor.h"
 #include "nsIDOMRange.h"
 
@@ -2104,17 +2105,19 @@ nsImageFrame::HandleEvent(nsPresContext*
           if (p.x < 0) p.x = 0;
           if (p.y < 0) p.y = 0;
 
           nsAutoCString spec;
           nsresult rv = uri->GetSpec(spec);
           NS_ENSURE_SUCCESS(rv, rv);
 
           spec += nsPrintfCString("?%d,%d", p.x, p.y);
-          rv = uri->SetSpec(spec);
+          rv = NS_MutateURI(uri)
+                 .SetSpec(spec)
+                 .Finalize(uri);
           NS_ENSURE_SUCCESS(rv, rv);
 
           bool clicked = false;
           if (aEvent->mMessage == eMouseClick && !aEvent->DefaultPrevented()) {
             *aEventStatus = nsEventStatus_eConsumeDoDefault;
             clicked = true;
           }
           nsContentUtils::TriggerLink(anchorNode, aPresContext, uri, target,

--- a/netwerk/base/nsIURIMutatorUtils.cpp
+++ b/netwerk/base/nsIURIMutatorUtils.cpp
@@ -14,9 +14,10 @@ GetURIMutator(nsIURI* aURI, nsIURIMutato
 NS_MutateURI::NS_MutateURI(nsIURI* aURI)
 {
   mStatus = GetURIMutator(aURI, getter_AddRefs(mMutator));
 }
 
 NS_MutateURI::NS_MutateURI(const char * aContractID)
 {
   mMutator = do_CreateInstance(aContractID, &mStatus);
+  MOZ_ASSERT(NS_SUCCEEDED(mStatus), "Called with wrong aContractID");
 }

--- a/netwerk/protocol/ftp/FTPChannelChild.cpp
+++ b/netwerk/protocol/ftp/FTPChannelChild.cpp
@@ -17,16 +17,17 @@
 #include "nsStringStream.h"
 #include "nsNetUtil.h"
 #include "base/compiler_specific.h"
 #include "mozilla/ipc/IPCStreamUtils.h"
 #include "mozilla/ipc/URIUtils.h"
 #include "SerializedLoadContext.h"
 #include "mozilla/ipc/BackgroundUtils.h"
 #include "nsIPrompt.h"
+#include "nsIURIMutator.h"
 
 using mozilla::dom::ContentChild;
 using namespace mozilla::ipc;
 
 #undef LOG
 #define LOG(args) MOZ_LOG(gFTPLog, mozilla::LogLevel::Debug, args)
 
 namespace mozilla {
@@ -323,17 +324,20 @@ FTPChannelChild::DoOnStartRequest(const 
   SetContentType(aContentType);
   mLastModifiedTime = aLastModified;
   mEntityID = aEntityID;
 
   nsCString spec;
   nsCOMPtr<nsIURI> uri = DeserializeURI(aURI);
   nsresult rv = uri->GetSpec(spec);
   if (NS_SUCCEEDED(rv)) {
-    rv = nsBaseChannel::URI()->SetSpec(spec);
+    // Changes nsBaseChannel::URI()
+    rv = NS_MutateURI(mURI)
+           .SetSpec(spec)
+           .Finalize(mURI);
     if (NS_FAILED(rv)) {
       Cancel(rv);
     }
   } else {
     Cancel(rv);
   }
 
   AutoEventEnqueuer ensureSerialDispatch(mEventQ);

--- a/netwerk/protocol/wyciwyg/nsWyciwygProtocolHandler.cpp
+++ b/netwerk/protocol/wyciwyg/nsWyciwygProtocolHandler.cpp
@@ -8,16 +8,17 @@
 #include "nsWyciwyg.h"
 #include "nsWyciwygChannel.h"
 #include "nsWyciwygProtocolHandler.h"
 #include "nsNetCID.h"
 #include "nsServiceManagerUtils.h"
 #include "plstr.h"
 #include "nsIObserverService.h"
 #include "nsIURI.h"
+#include "nsIURIMutator.h"
 
 #include "mozilla/net/NeckoChild.h"
 
 using namespace mozilla::net;
 #include "mozilla/net/WyciwygChannelChild.h"
 
 ////////////////////////////////////////////////////////////////////////////////
 
@@ -60,27 +61,19 @@ nsWyciwygProtocolHandler::AllowPort(int3
 }
 
 NS_IMETHODIMP
 nsWyciwygProtocolHandler::NewURI(const nsACString &aSpec,
                                  const char *aCharset, // ignored
                                  nsIURI *aBaseURI,
                                  nsIURI **result)
 {
-  nsresult rv;
-
-  nsCOMPtr<nsIURI> url = do_CreateInstance(NS_SIMPLEURI_CONTRACTID, &rv);
-  NS_ENSURE_SUCCESS(rv, rv);
-
-  rv = url->SetSpec(aSpec);
-  NS_ENSURE_SUCCESS(rv, rv);
-
-  url.forget(result);
-
-  return rv;
+  return NS_MutateURI(NS_SIMPLEURIMUTATOR_CONTRACTID)
+           .SetSpec(aSpec)
+           .Finalize(result);
 }
 
 NS_IMETHODIMP
 nsWyciwygProtocolHandler::NewChannel2(nsIURI* url,
                                       nsILoadInfo* aLoadInfo,
                                       nsIChannel** result)
 {
   if (mozilla::net::IsNeckoChild())

--- a/toolkit/components/places/nsAnnoProtocolHandler.cpp
+++ b/toolkit/components/places/nsAnnoProtocolHandler.cpp
@@ -18,16 +18,17 @@
 #include "nsIChannel.h"
 #include "nsIInputStreamChannel.h"
 #include "nsILoadGroup.h"
 #include "nsIStandardURL.h"
 #include "nsIStringStream.h"
 #include "nsIInputStream.h"
 #include "nsISupportsUtils.h"
 #include "nsIURI.h"
+#include "nsIURIMutator.h"
 #include "nsNetUtil.h"
 #include "nsIOutputStream.h"
 #include "nsInputStreamPump.h"
 #include "nsContentUtils.h"
 #include "nsServiceManagerUtils.h"
 #include "nsStringStream.h"
 #include "SimpleChannel.h"
 #include "mozilla/ScopeExit.h"
@@ -220,25 +221,20 @@ nsAnnoProtocolHandler::GetProtocolFlags(
 
 // nsAnnoProtocolHandler::NewURI
 
 NS_IMETHODIMP
 nsAnnoProtocolHandler::NewURI(const nsACString& aSpec,
                               const char *aOriginCharset,
                               nsIURI *aBaseURI, nsIURI **_retval)
 {
-  nsCOMPtr <nsIURI> uri = do_CreateInstance(NS_SIMPLEURI_CONTRACTID);
-  if (!uri)
-    return NS_ERROR_OUT_OF_MEMORY;
-  nsresult rv = uri->SetSpec(aSpec);
-  NS_ENSURE_SUCCESS(rv, rv);
-
   *_retval = nullptr;
-  uri.swap(*_retval);
-  return NS_OK;
+  return NS_MutateURI(NS_SIMPLEURIMUTATOR_CONTRACTID)
+           .SetSpec(aSpec)
+           .Finalize(_retval);
 }
 
 
 // nsAnnoProtocolHandler::NewChannel
 //
 
 NS_IMETHODIMP
 nsAnnoProtocolHandler::NewChannel2(nsIURI* aURI,

--- a/toolkit/components/thumbnails/PageThumbsProtocol.cpp
+++ b/toolkit/components/thumbnails/PageThumbsProtocol.cpp
@@ -54,22 +54,19 @@ PageThumbsProtocol::GetProtocolFlags(uin
 
 // PageThumbsProtocol::NewURI
 
 NS_IMETHODIMP
 PageThumbsProtocol::NewURI(const nsACString& aSpec,
                            const char *aOriginCharset,
                            nsIURI *aBaseURI, nsIURI **_retval)
 {
-  nsCOMPtr <nsIURI> uri = do_CreateInstance(NS_SIMPLEURI_CONTRACTID);
-  nsresult rv = uri->SetSpec(aSpec);
-  if (NS_WARN_IF(NS_FAILED(rv))) return rv;
-
-  uri.forget(_retval);
-  return rv;
+  return NS_MutateURI(NS_SIMPLEURIMUTATOR_CONTRACTID)
+           .SetSpec(aSpec)
+           .Finalize(_retval);
 }
 
 // PageThumbsProtocol::NewChannel
 
 NS_IMETHODIMP
 PageThumbsProtocol::NewChannel2(nsIURI* aURI,
                                 nsILoadInfo *aLoadInfo,
                                 nsIChannel** _retval)

--- a/uriloader/exthandler/nsExternalProtocolHandler.cpp
+++ b/uriloader/exthandler/nsExternalProtocolHandler.cpp
@@ -14,16 +14,17 @@
 #include "nsContentUtils.h"
 #include "nsIServiceManager.h"
 #include "nsServiceManagerUtils.h"
 #include "nsIInterfaceRequestor.h"
 #include "nsIInterfaceRequestorUtils.h"
 #include "nsIStringBundle.h"
 #include "nsIPrefService.h"
 #include "nsIPrompt.h"
+#include "nsIURIMutator.h"
 #include "nsNetUtil.h"
 #include "nsContentSecurityManager.h"
 #include "nsExternalHelperAppService.h"
 
 // used to dispatch urls to default protocol handlers
 #include "nsCExternalHandlerService.h"
 #include "nsIExternalProtocolService.h"
 #include "nsIChildChannel.h"
@@ -536,25 +537,19 @@ NS_IMETHODIMP nsExternalProtocolHandler:
     return NS_OK;
 }
 
 NS_IMETHODIMP nsExternalProtocolHandler::NewURI(const nsACString &aSpec,
                                                 const char *aCharset, // ignore charset info
                                                 nsIURI *aBaseURI,
                                                 nsIURI **_retval)
 {
-  nsresult rv;
-  nsCOMPtr<nsIURI> uri = do_CreateInstance(NS_SIMPLEURI_CONTRACTID, &rv);
-  NS_ENSURE_SUCCESS(rv, rv);
-  
-  rv = uri->SetSpec(aSpec);
-  NS_ENSURE_SUCCESS(rv, rv);
-
-  NS_ADDREF(*_retval = uri);
-  return NS_OK;
+  return NS_MutateURI(NS_SIMPLEURIMUTATOR_CONTRACTID)
+           .SetSpec(aSpec)
+           .Finalize(_retval);
 }
 
 NS_IMETHODIMP
 nsExternalProtocolHandler::NewChannel2(nsIURI* aURI,
                                        nsILoadInfo* aLoadInfo,
                                        nsIChannel** aRetval)
 {
   NS_ENSURE_TRUE(aURI, NS_ERROR_UNKNOWN_PROTOCOL);