--- a/caps/NullPrincipalURI.h
+++ b/caps/NullPrincipalURI.h
@@ -73,17 +73,20 @@ public:
     NS_IMETHOD Finalize(nsIURI** aURI) override
     {
       mURI.forget(aURI);
       return NS_OK;
     }
 
     NS_IMETHOD SetSpec(const nsACString & aSpec, nsIURIMutator** aMutator) override
     {
-      NS_ADDREF(*aMutator = this);
+      if (aMutator) {
+        nsCOMPtr<nsIURIMutator> mutator = this;
+        mutator.forget(aMutator);
+      }
       return NS_ERROR_NOT_IMPLEMENTED;
     }
 
     explicit Mutator() { }
   private:
     virtual ~Mutator() { }
 
     friend class NullPrincipalURI;

--- a/image/decoders/icon/nsIconURI.h
+++ b/image/decoders/icon/nsIconURI.h
@@ -64,18 +64,22 @@ public:
     }
 
     NS_IMETHOD Finalize(nsIURI** aURI) override
     {
       mURI.forget(aURI);
       return NS_OK;
     }
 
-    NS_IMETHOD SetSpec(const nsACString & aSpec, nsIURIMutator** aMutator) override {
-      NS_ADDREF(*aMutator = this);
+    NS_IMETHOD SetSpec(const nsACString & aSpec, nsIURIMutator** aMutator) override
+    {
+      if (aMutator) {
+        nsCOMPtr<nsIURIMutator> mutator = this;
+        mutator.forget(aMutator);
+      }
       return InitFromSpec(aSpec);
     }
 
     explicit Mutator() { }
   private:
     virtual ~Mutator() { }
 
     friend class nsMozIconURI;