--- a/dom/xbl/nsXBLService.cpp
+++ b/dom/xbl/nsXBLService.cpp
@@ -646,17 +646,17 @@ nsXBLService::BindingReady(nsIContent* a
 }
 
 nsresult
 nsXBLService::GetBinding(nsIContent* aBoundElement, nsIURI* aURI,
                          bool aPeekOnly, nsIPrincipal* aOriginPrincipal,
                          bool* aIsReady, nsXBLBinding** aResult)
 {
   // More than 6 binding URIs are rare, see bug 55070 comment 18.
-  nsAutoTArray<nsIURI*, 6> uris;
+  nsAutoTArray<nsCOMPtr<nsIURI>, 6> uris;
   return GetBinding(aBoundElement, aURI, aPeekOnly, aOriginPrincipal, aIsReady,
                     aResult, uris);
 }
 
 static bool
 MayBindToContent(nsXBLPrototypeBinding* aProtoBinding, nsIContent* aBoundElement,
                  nsIURI* aURI)
 {
@@ -703,17 +703,17 @@ MayBindToContent(nsXBLPrototypeBinding* 
   // Disallow.
   return false;
 }
 
 nsresult
 nsXBLService::GetBinding(nsIContent* aBoundElement, nsIURI* aURI,
                          bool aPeekOnly, nsIPrincipal* aOriginPrincipal,
                          bool* aIsReady, nsXBLBinding** aResult,
-                         nsTArray<nsIURI*>& aDontExtendURIs)
+                         nsTArray<nsCOMPtr<nsIURI>>& aDontExtendURIs)
 {
   NS_ASSERTION(aPeekOnly || aResult,
                "Must have non-null out param if not just peeking to see "
                "whether the binding is ready");
 
   if (aResult)
     *aResult = nullptr;
 
@@ -779,17 +779,17 @@ nsXBLService::GetBinding(nsIContent* aBo
     // be notified when the stylesheets and scripts finish loading.
     protoBinding->AddResourceListener(aBoundElement);
     return NS_ERROR_FAILURE; // The binding isn't ready yet.
   }
 
   rv = protoBinding->ResolveBaseBinding();
   NS_ENSURE_SUCCESS(rv, rv);
 
-  nsIURI* baseBindingURI;
+  nsCOMPtr<nsIURI> baseBindingURI;
   nsXBLPrototypeBinding* baseProto = protoBinding->GetBasePrototype();
   if (baseProto) {
     baseBindingURI = baseProto->BindingURI();
   }
   else {
     baseBindingURI = protoBinding->GetBaseBindingURI();
     if (baseBindingURI) {
       uint32_t count = aDontExtendURIs.Length();
@@ -813,28 +813,30 @@ nsXBLService::GetBinding(nsIContent* aBo
           return NS_ERROR_ILLEGAL_VALUE;
         }
       }
     }
   }
 
   nsRefPtr<nsXBLBinding> baseBinding;
   if (baseBindingURI) {
-    nsIContent* child = protoBinding->GetBindingElement();
+    nsCOMPtr<nsIContent> child = protoBinding->GetBindingElement();
     rv = GetBinding(aBoundElement, baseBindingURI, aPeekOnly,
                     child->NodePrincipal(), aIsReady,
                     getter_AddRefs(baseBinding), aDontExtendURIs);
     if (NS_FAILED(rv))
       return rv; // We aren't ready yet.
   }
 
   *aIsReady = true;
 
   if (!aPeekOnly) {
     // Make a new binding
+    protoBinding = docInfo->GetPrototypeBinding(ref);
+    NS_ENSURE_STATE(protoBinding);
     nsXBLBinding *newBinding = new nsXBLBinding(protoBinding);
 
     if (baseBinding) {
       if (!baseProto) {
         protoBinding->SetBasePrototype(baseBinding->PrototypeBinding());
       }
        newBinding->SetBaseBinding(baseBinding);
     }

--- a/dom/xbl/nsXBLService.h
+++ b/dom/xbl/nsXBLService.h
@@ -104,17 +104,17 @@ protected:
    *        and NS_ERROR_ILLEGAL_VALUE is returned.
    *
    * @note This method always calls LoadBindingDocumentInfo(), so it's
    *       enough to funnel all security checks through that function.
    */
   nsresult GetBinding(nsIContent* aBoundElement, nsIURI* aURI,
                       bool aPeekFlag, nsIPrincipal* aOriginPrincipal,
                       bool* aIsReady, nsXBLBinding** aResult,
-                      nsTArray<nsIURI*>& aDontExtendURIs);
+                      nsTArray<nsCOMPtr<nsIURI>>& aDontExtendURIs);
 
 // MEMBER VARIABLES
 public:
   static bool gDisableChromeCache;
   static bool     gAllowDataURIs;            // Whether we should allow data
                                              // urls in -moz-binding. Needed for
                                              // testing.
 };