--- a/dom/base/DocumentFragment.h
+++ b/dom/base/DocumentFragment.h
@@ -102,16 +102,16 @@ public:
 
 protected:
   virtual ~DocumentFragment()
   {
   }
 
   nsresult Clone(mozilla::dom::NodeInfo *aNodeInfo, nsINode **aResult,
                  bool aPreallocateChildren) const override;
-  nsCOMPtr<Element> mHost;
+  RefPtr<Element> mHost;
 };
 
 } // namespace dom
 } // namespace mozilla
 
 
 #endif // mozilla_dom_DocumentFragment_h__

--- a/dom/base/ShadowRoot.cpp
+++ b/dom/base/ShadowRoot.cpp
@@ -466,26 +466,16 @@ ShadowRoot::GetInnerHTML(nsAString& aInn
 }
 
 void
 ShadowRoot::SetInnerHTML(const nsAString& aInnerHTML, ErrorResult& aError)
 {
   SetInnerHTMLInternal(aInnerHTML, aError);
 }
 
-Element*
-ShadowRoot::Host()
-{
-  nsIContent* host = GetHost();
-  MOZ_ASSERT(host && host->IsElement(),
-             "ShadowRoot host should always be an element, "
-             "how else did we create this ShadowRoot?");
-  return host->AsElement();
-}
-
 void
 ShadowRoot::AttributeChanged(nsIDocument* aDocument,
                              Element* aElement,
                              int32_t aNameSpaceID,
                              nsAtom* aAttribute,
                              int32_t aModType,
                              const nsAttrValue* aOldValue)
 {

--- a/dom/base/ShadowRoot.h
+++ b/dom/base/ShadowRoot.h
@@ -60,17 +60,23 @@ public:
   NS_DECL_NSIMUTATIONOBSERVER_CONTENTINSERTED
   NS_DECL_NSIMUTATIONOBSERVER_CONTENTREMOVED
 
   ShadowRoot(Element* aElement, bool aClosed,
              already_AddRefed<mozilla::dom::NodeInfo>&& aNodeInfo,
              nsXBLPrototypeBinding* aProtoBinding);
 
   // Shadow DOM v1
-  Element* Host();
+  Element* Host() const
+  {
+    MOZ_ASSERT(GetHost(), "ShadowRoot always has a host, how did we create "
+                          "this ShadowRoot?");
+    return GetHost();
+  }
+
   ShadowRootMode Mode() const
   {
     return mMode;
   }
   bool IsClosed() const
   {
     return mMode == ShadowRootMode::Closed;
   }