diff --git a/docshell/base/nsDSURIContentListener.cpp b/docshell/base/nsDSURIContentListener.cpp
index 68a768248a5..93954704c9b 100644
--- a/docshell/base/nsDSURIContentListener.cpp
+++ b/docshell/base/nsDSURIContentListener.cpp
@@ -49,8 +49,9 @@
 //***    nsDSURIContentListener: Object Management
 //*****************************************************************************
 
-nsDSURIContentListener::nsDSURIContentListener() : mDocShell(nsnull), 
-    mParentContentListener(nsnull)
+nsDSURIContentListener::nsDSURIContentListener(nsDocShell* aDocShell)
+    : mDocShell(aDocShell), 
+      mParentContentListener(nsnull)
 {
 }
 
@@ -210,7 +211,7 @@ nsDSURIContentListener::CanHandleContent(const char* aContentType,
 NS_IMETHODIMP
 nsDSURIContentListener::GetLoadCookie(nsISupports ** aLoadCookie)
 {
-    NS_ADDREF(*aLoadCookie = NS_STATIC_CAST(nsIDocumentLoader*, mDocShell));
+    NS_IF_ADDREF(*aLoadCookie = NS_STATIC_CAST(nsIDocumentLoader*, mDocShell));
     return NS_OK;
 }
 
@@ -267,20 +268,3 @@ nsDSURIContentListener::SetParentContentListener(nsIURIContentListener*
     return NS_OK;
 }
 
-//*****************************************************************************
-// nsDSURIContentListener: Helpers
-//*****************************************************************************   
-
-//*****************************************************************************
-// nsDSURIContentListener: Accessors
-//*****************************************************************************   
-
-void nsDSURIContentListener::DocShell(nsDocShell* aDocShell)
-{
-    mDocShell = aDocShell;
-}
-
-nsDocShell* nsDSURIContentListener::DocShell()
-{
-    return mDocShell;
-}
diff --git a/docshell/base/nsDSURIContentListener.h b/docshell/base/nsDSURIContentListener.h
index b19cfa81e81..af94543148d 100644
--- a/docshell/base/nsDSURIContentListener.h
+++ b/docshell/base/nsDSURIContentListener.h
@@ -61,11 +61,12 @@ public:
     nsresult Init();
 
 protected:
-    nsDSURIContentListener();
+    nsDSURIContentListener(nsDocShell* aDocShell);
     virtual ~nsDSURIContentListener();
 
-    void DocShell(nsDocShell* aDocShell);
-    nsDocShell* DocShell();
+    void DropDocShellreference() {
+        mDocShell = nsnull;
+    }
 
 protected:
     nsDocShell*                      mDocShell;
diff --git a/docshell/base/nsDocShell.cpp b/docshell/base/nsDocShell.cpp
index 6cacf5821bf..fb2f487d234 100644
--- a/docshell/base/nsDocShell.cpp
+++ b/docshell/base/nsDocShell.cpp
@@ -257,7 +257,6 @@ nsDocShell::nsDocShell():
     mMarginWidth(0),
     mMarginHeight(0),
     mItemType(typeContent),
-    mContentListener(nsnull),
     mDefaultScrollbarPref(Scrollbar_Auto, Scrollbar_Auto),
     mEditorData(nsnull),
     mTreeOwner(nsnull),
@@ -297,6 +296,12 @@ nsDocShell::Init()
 
     NS_ASSERTION(mLoadGroup, "Something went wrong!");
 
+    mContentListener = new nsDSURIContentListener(this);
+    NS_ENSURE_TRUE(mContentListener, NS_ERROR_OUT_OF_MEMORY);
+
+    rv = mContentListener->Init();
+    NS_ENSURE_SUCCESS(rv, rv);
+
     // We want to hold a strong ref to the loadgroup, so it better hold a weak
     // ref to us...  use an InterfaceRequestorProxy to do this.
     nsCOMPtr<InterfaceRequestorProxy> proxy =
@@ -370,8 +375,7 @@ NS_IMETHODIMP nsDocShell::GetInterface(const nsIID & aIID, void **aSink)
 
     *aSink = nsnull;
 
-    if (aIID.Equals(NS_GET_IID(nsIURIContentListener)) &&
-        NS_SUCCEEDED(EnsureContentListener())) {
+    if (aIID.Equals(NS_GET_IID(nsIURIContentListener))) {
         *aSink = mContentListener;
     }
     else if (aIID.Equals(NS_GET_IID(nsIScriptGlobalObject)) &&
@@ -1316,8 +1320,7 @@ nsDocShell::GetChromeEventHandler(nsIChromeEventHandler ** aChromeEventHandler)
 NS_IMETHODIMP
 nsDocShell::GetParentURIContentListener(nsIURIContentListener ** aParent)
 {
-    NS_ENSURE_ARG_POINTER(aParent);
-    NS_ENSURE_SUCCESS(EnsureContentListener(), NS_ERROR_FAILURE);
+    NS_PRECONDITION(aParent, "Null out param?");
 
     return mContentListener->GetParentContentListener(aParent);
 }
@@ -1325,8 +1328,6 @@ nsDocShell::GetParentURIContentListener(nsIURIContentListener ** aParent)
 NS_IMETHODIMP
 nsDocShell::SetParentURIContentListener(nsIURIContentListener * aParent)
 {
-    NS_ENSURE_SUCCESS(EnsureContentListener(), NS_ERROR_FAILURE);
-
     return mContentListener->SetParentContentListener(aParent);
 }
 
@@ -3414,10 +3415,11 @@ nsDocShell::Destroy()
     mSessionHistory = nsnull;
     SetTreeOwner(nsnull);
 
+    // Note: mContentListener can be null if Init() failed and we're being
+    // called from the destructor.
     if (mContentListener) {
-        mContentListener->DocShell(nsnull);
+        mContentListener->DropDocShellreference();
         mContentListener->SetParentContentListener(nsnull);
-        NS_RELEASE(mContentListener);
     }
 
     return NS_OK;
@@ -6976,27 +6978,6 @@ nsDocShell::GetRootScrollableView(nsIScrollableView ** aOutScrollView)
     return NS_OK;
 }
 
-NS_IMETHODIMP
-nsDocShell::EnsureContentListener()
-{
-    nsresult rv = NS_OK;
-    if (mContentListener)
-        return NS_OK;
-
-    mContentListener = new nsDSURIContentListener();
-    NS_ENSURE_TRUE(mContentListener, NS_ERROR_OUT_OF_MEMORY);
-
-    NS_ADDREF(mContentListener);
-
-    rv = mContentListener->Init();
-    if (NS_FAILED(rv))
-        return rv;
-
-    mContentListener->DocShell(this);
-
-    return NS_OK;
-}
-
 NS_IMETHODIMP
 nsDocShell::EnsureScriptEnvironment()
 {
diff --git a/docshell/base/nsDocShell.h b/docshell/base/nsDocShell.h
index a6050137fc0..615433c8dd8 100644
--- a/docshell/base/nsDocShell.h
+++ b/docshell/base/nsDocShell.h
@@ -70,6 +70,7 @@
 #include "nsCOMPtr.h"
 #include "nsPoint.h" // mCurrent/mDefaultScrollbarPreferences
 #include "nsString.h"
+#include "nsAutoPtr.h"
 
 // Threshold value in ms for META refresh based redirects
 #define REFRESH_REDIRECT_TIMER 15000
@@ -319,7 +320,6 @@ protected:
     NS_IMETHOD GetChildOffset(nsIDOMNode * aChild, nsIDOMNode * aParent,
         PRInt32 * aOffset);
     NS_IMETHOD GetRootScrollableView(nsIScrollableView ** aOutScrollView);
-    NS_IMETHOD EnsureContentListener();
     NS_IMETHOD EnsureScriptEnvironment();
     NS_IMETHOD EnsureEditorData();
     nsresult   EnsureTransferableHookData();
@@ -425,7 +425,7 @@ protected:
      */
     nsCString                  mContentTypeHint;
     nsCOMPtr<nsISupportsArray> mRefreshURIList;
-    nsDSURIContentListener *   mContentListener;
+    nsRefPtr<nsDSURIContentListener> mContentListener;
     nsRect                     mBounds; // Dimensions of the docshell
     nsCOMPtr<nsIContentViewer> mContentViewer;
     nsCOMPtr<nsIDocumentCharsetInfo> mDocumentCharsetInfo;