diff --git a/dom/base/Attr.cpp b/dom/base/Attr.cpp
index f991694bfa9e..abe2002bb378 100644
--- a/dom/base/Attr.cpp
+++ b/dom/base/Attr.cpp
@@ -182,7 +182,7 @@ nsresult Attr::Clone(dom::NodeInfo* aNodeInfo, nsINode** aResult) const {
   return NS_OK;
 }
 
-already_AddRefed<nsIURI> Attr::GetBaseURI(bool aTryUseXHRDocBaseURI) const {
+nsIURI* Attr::GetBaseURI(bool aTryUseXHRDocBaseURI) const {
   Element* parent = GetElement();
 
   return parent ? parent->GetBaseURI(aTryUseXHRDocBaseURI) : nullptr;
diff --git a/dom/base/Attr.h b/dom/base/Attr.h
index 95248a6e0b16..8142570774b7 100644
--- a/dom/base/Attr.h
+++ b/dom/base/Attr.h
@@ -67,8 +67,7 @@ class Attr final : public nsINode {
   // nsINode interface
   virtual bool IsNodeOfType(uint32_t aFlags) const override;
   virtual nsresult Clone(dom::NodeInfo*, nsINode** aResult) const override;
-  virtual already_AddRefed<nsIURI> GetBaseURI(
-      bool aTryUseXHRDocBaseURI = false) const override;
+  nsIURI* GetBaseURI(bool aTryUseXHRDocBaseURI = false) const override;
 
   static void Initialize();
   static void Shutdown();
diff --git a/dom/base/Document.cpp b/dom/base/Document.cpp
index 71f1386e7add..9ece837bb425 100644
--- a/dom/base/Document.cpp
+++ b/dom/base/Document.cpp
@@ -5705,15 +5705,12 @@ void Document::ReleaseCapture() const {
   }
 }
 
-already_AddRefed<nsIURI> Document::GetBaseURI(bool aTryUseXHRDocBaseURI) const {
-  nsCOMPtr<nsIURI> uri;
+nsIURI* Document::GetBaseURI(bool aTryUseXHRDocBaseURI) const {
   if (aTryUseXHRDocBaseURI && mChromeXHRDocBaseURI) {
-    uri = mChromeXHRDocBaseURI;
-  } else {
-    uri = GetDocBaseURI();
+    return mChromeXHRDocBaseURI;
   }
 
-  return uri.forget();
+  return GetDocBaseURI();
 }
 
 void Document::SetBaseURI(nsIURI* aURI) {
diff --git a/dom/base/Document.h b/dom/base/Document.h
index b2f5441c3099..06a42f346c2a 100644
--- a/dom/base/Document.h
+++ b/dom/base/Document.h
@@ -666,7 +666,9 @@ class Document : public nsINode,
   virtual void NotifyPossibleTitleChange(bool aBoundTitleElement);
 
   /**
-   * Return the URI for the document. May return null.
+   * Return the URI for the document. May return null.  If it ever stops being
+   * able to return null, we can make sure nsINode::GetBaseURI/GetBaseURIObject
+   * also never return null.
    *
    * The value returned corresponds to the "document's address" in
    * HTML5.  As such, it may change over the lifetime of the document, for
@@ -901,8 +903,7 @@ class Document : public nsINode,
     return GetFallbackBaseURI();
   }
 
-  already_AddRefed<nsIURI> GetBaseURI(
-      bool aTryUseXHRDocBaseURI = false) const final;
+  nsIURI* GetBaseURI(bool aTryUseXHRDocBaseURI = false) const final;
 
   void SetBaseURI(nsIURI* aURI);
 
diff --git a/dom/base/FragmentOrElement.cpp b/dom/base/FragmentOrElement.cpp
index 056bd3c30c9b..7ce14bfcdebc 100644
--- a/dom/base/FragmentOrElement.cpp
+++ b/dom/base/FragmentOrElement.cpp
@@ -327,19 +327,14 @@ nsAtom* nsIContent::GetLang() const {
   return nullptr;
 }
 
-already_AddRefed<nsIURI> nsIContent::GetBaseURI(
-    bool aTryUseXHRDocBaseURI) const {
+nsIURI* nsIContent::GetBaseURI(bool aTryUseXHRDocBaseURI) const {
   if (SVGUseElement* use = GetContainingSVGUseShadowHost()) {
     if (URLExtraData* data = use->GetContentURLData()) {
-      return do_AddRef(data->BaseURI());
+      return data->BaseURI();
     }
   }
 
-  Document* doc = OwnerDoc();
-  // Start with document base
-  nsCOMPtr<nsIURI> base = doc->GetBaseURI(aTryUseXHRDocBaseURI);
-
-  return base.forget();
+  return OwnerDoc()->GetBaseURI(aTryUseXHRDocBaseURI);
 }
 
 nsIURI* nsIContent::GetBaseURIForStyleAttr() const {
diff --git a/dom/base/Location.cpp b/dom/base/Location.cpp
index e67cf6e133d6..bc561f839fbc 100644
--- a/dom/base/Location.cpp
+++ b/dom/base/Location.cpp
@@ -810,7 +810,7 @@ void Location::Assign(const nsAString& aUrl, nsIPrincipal& aSubjectPrincipal,
   DoSetHref(aUrl, aSubjectPrincipal, false, aRv);
 }
 
-already_AddRefed<nsIURI> Location::GetSourceBaseURL() {
+nsIURI* Location::GetSourceBaseURL() {
   Document* doc = GetEntryDocument();
   // If there's no entry document, we either have no Script Entry Point or one
   // that isn't a DOM Window.  This doesn't generally happen with the DOM, but
diff --git a/dom/base/Location.h b/dom/base/Location.h
index 237370793a50..72fd0b610181 100644
--- a/dom/base/Location.h
+++ b/dom/base/Location.h
@@ -152,7 +152,7 @@ class Location final : public nsISupports, public nsWrapperCache {
 
   // Get the base URL we should be using for our relative URL
   // resolution for SetHref/Assign/Replace.
-  already_AddRefed<nsIURI> GetSourceBaseURL();
+  nsIURI* GetSourceBaseURL();
 
   // Check whether it's OK to load the given url with the given subject
   // principal, and if so construct the right nsDocShellLoadInfo for the load
diff --git a/dom/base/nsIContent.h b/dom/base/nsIContent.h
index 7de0255e2c5d..620458fac1f6 100644
--- a/dom/base/nsIContent.h
+++ b/dom/base/nsIContent.h
@@ -675,8 +675,7 @@ class nsIContent : public nsINode {
   }
 
   // Overloaded from nsINode
-  virtual already_AddRefed<nsIURI> GetBaseURI(
-      bool aTryUseXHRDocBaseURI = false) const override;
+  nsIURI* GetBaseURI(bool aTryUseXHRDocBaseURI = false) const override;
 
   // Returns base URI for style attribute.
   nsIURI* GetBaseURIForStyleAttr() const;
diff --git a/dom/base/nsINode.cpp b/dom/base/nsINode.cpp
index a8c10a7123e8..7b9a19d85135 100644
--- a/dom/base/nsINode.cpp
+++ b/dom/base/nsINode.cpp
@@ -611,7 +611,7 @@ nsresult nsINode::GetBaseURI(nsAString& aURI) const {
 
 void nsINode::GetBaseURIFromJS(nsAString& aURI, CallerType aCallerType,
                                ErrorResult& aRv) const {
-  nsCOMPtr<nsIURI> baseURI = GetBaseURI(aCallerType == CallerType::System);
+  nsIURI* baseURI = GetBaseURI(aCallerType == CallerType::System);
   nsAutoCString spec;
   if (baseURI) {
     nsresult res = baseURI->GetSpec(spec);
@@ -623,9 +623,7 @@ void nsINode::GetBaseURIFromJS(nsAString& aURI, CallerType aCallerType,
   CopyUTF8toUTF16(spec, aURI);
 }
 
-already_AddRefed<nsIURI> nsINode::GetBaseURIObject() const {
-  return GetBaseURI(true);
-}
+nsIURI* nsINode::GetBaseURIObject() const { return GetBaseURI(true); }
 
 void nsINode::LookupPrefix(const nsAString& aNamespaceURI, nsAString& aPrefix) {
   Element* element = GetNameSpaceElement();
diff --git a/dom/base/nsINode.h b/dom/base/nsINode.h
index 26d9ca2af9eb..32bba1a31b55 100644
--- a/dom/base/nsINode.h
+++ b/dom/base/nsINode.h
@@ -1211,14 +1211,12 @@ class nsINode : public mozilla::dom::EventTarget {
   /**
    * Get the base URI for any relative URIs within this piece of
    * content. Generally, this is the document's base URI, but certain
-   * content carries a local base for backward compatibility, and XML
-   * supports setting a per-node base URI.
+   * content carries a local base for backward compatibility.
    *
-   * @return the base URI
+   * @return the base URI.  May return null.
    */
-  virtual already_AddRefed<nsIURI> GetBaseURI(
-      bool aTryUseXHRDocBaseURI = false) const = 0;
-  already_AddRefed<nsIURI> GetBaseURIObject() const;
+  virtual nsIURI* GetBaseURI(bool aTryUseXHRDocBaseURI = false) const = 0;
+  nsIURI* GetBaseURIObject() const;
 
   /**
    * Return true if the node may be apz aware. There are two cases. One is that
diff --git a/dom/plugins/base/nsPluginInstanceOwner.cpp b/dom/plugins/base/nsPluginInstanceOwner.cpp
index 225503cdd210..48695e9bd09d 100644
--- a/dom/plugins/base/nsPluginInstanceOwner.cpp
+++ b/dom/plugins/base/nsPluginInstanceOwner.cpp
@@ -3225,7 +3225,7 @@ NS_IMETHODIMP nsPluginInstanceOwner::PrivateModeChanged(bool aEnabled) {
   return mInstance ? mInstance->PrivateModeStateChanged(aEnabled) : NS_OK;
 }
 
-already_AddRefed<nsIURI> nsPluginInstanceOwner::GetBaseURI() const {
+nsIURI* nsPluginInstanceOwner::GetBaseURI() const {
   nsCOMPtr<nsIContent> content = do_QueryReferent(mContent);
   if (!content) {
     return nullptr;
diff --git a/dom/plugins/base/nsPluginInstanceOwner.h b/dom/plugins/base/nsPluginInstanceOwner.h
index e2103e88aa05..303edcd56a24 100644
--- a/dom/plugins/base/nsPluginInstanceOwner.h
+++ b/dom/plugins/base/nsPluginInstanceOwner.h
@@ -251,7 +251,7 @@ class nsPluginInstanceOwner final : public nsIPluginInstanceOwner,
 
   bool UseAsyncRendering();
 
-  already_AddRefed<nsIURI> GetBaseURI() const;
+  nsIURI* GetBaseURI() const;
 
   bool GetCompositionString(uint32_t aIndex, nsTArray<uint8_t>* aString,
                             int32_t* aLength);
diff --git a/dom/svg/SVGElement.cpp b/dom/svg/SVGElement.cpp
index b2f9f6439d3c..2ba2ced457a3 100644
--- a/dom/svg/SVGElement.cpp
+++ b/dom/svg/SVGElement.cpp
@@ -1063,8 +1063,8 @@ namespace {
 
 class MOZ_STACK_CLASS MappedAttrParser {
  public:
-  MappedAttrParser(css::Loader* aLoader, nsIURI* aDocURI,
-                   already_AddRefed<nsIURI> aBaseURI, SVGElement* aElement);
+  MappedAttrParser(css::Loader* aLoader, nsIURI* aDocURI, nsIURI* aBaseURI,
+                   SVGElement* aElement);
   ~MappedAttrParser();
 
   // Parses a mapped attribute value.
@@ -1096,8 +1096,7 @@ class MOZ_STACK_CLASS MappedAttrParser {
 };
 
 MappedAttrParser::MappedAttrParser(css::Loader* aLoader, nsIURI* aDocURI,
-                                   already_AddRefed<nsIURI> aBaseURI,
-                                   SVGElement* aElement)
+                                   nsIURI* aBaseURI, SVGElement* aElement)
     : mLoader(aLoader),
       mDocURI(aDocURI),
       mBaseURI(aBaseURI),
diff --git a/dom/webbrowserpersist/WebBrowserPersistLocalDocument.cpp b/dom/webbrowserpersist/WebBrowserPersistLocalDocument.cpp
index b98e300b438b..1f22bca8899f 100644
--- a/dom/webbrowserpersist/WebBrowserPersistLocalDocument.cpp
+++ b/dom/webbrowserpersist/WebBrowserPersistLocalDocument.cpp
@@ -208,7 +208,7 @@ uint32_t WebBrowserPersistLocalDocument::GetPersistFlags() const {
   return mPersistFlags;
 }
 
-already_AddRefed<nsIURI> WebBrowserPersistLocalDocument::GetBaseURI() const {
+nsIURI* WebBrowserPersistLocalDocument::GetBaseURI() const {
   return mDocument->GetBaseURI();
 }
 
diff --git a/dom/webbrowserpersist/WebBrowserPersistLocalDocument.h b/dom/webbrowserpersist/WebBrowserPersistLocalDocument.h
index a5e4bae6b0b8..7ecff598a069 100644
--- a/dom/webbrowserpersist/WebBrowserPersistLocalDocument.h
+++ b/dom/webbrowserpersist/WebBrowserPersistLocalDocument.h
@@ -25,7 +25,7 @@ class WebBrowserPersistLocalDocument final
 
   NotNull<const Encoding*> GetCharacterSet() const;
   uint32_t GetPersistFlags() const;
-  already_AddRefed<nsIURI> GetBaseURI() const;
+  nsIURI* GetBaseURI() const;
 
   NS_DECL_CYCLE_COLLECTING_ISUPPORTS
   NS_DECL_NSIWEBBROWSERPERSISTDOCUMENT