diff --git a/content/base/src/nsDocument.cpp b/content/base/src/nsDocument.cpp
index 5c45d197600..9382b96545c 100644
--- a/content/base/src/nsDocument.cpp
+++ b/content/base/src/nsDocument.cpp
@@ -529,7 +529,6 @@ nsDocument::nsDocument() : mSubDocuments(nsnull),
   mHeaderData = nsnull;
   mChildNodes = nsnull;
   mModCount = 0;
-  mPrincipal = nsnull;
   mNextContentID = NS_CONTENT_ID_COUNTER_BASE;
   mDTD = 0;
   mBoxObjectTable = nsnull;
@@ -567,7 +566,7 @@ nsDocument::~nsDocument()
     }
   }
 
-  NS_IF_RELEASE(mPrincipal);
+  mPrincipal = nsnull;
   mDocumentLoadGroup = nsnull;
 
   mParentDocument = nsnull;
@@ -752,7 +751,7 @@ nsDocument::Reset(nsIChannel* aChannel, nsILoadGroup* aLoadGroup)
     nsCOMPtr<nsISupports> owner;
     aChannel->GetOwner(getter_AddRefs(owner));
     if (owner)
-      owner->QueryInterface(NS_GET_IID(nsIPrincipal), (void**)&mPrincipal);
+      mPrincipal = do_QueryInterface(owner);
   }
 
   return rv;
@@ -766,7 +765,7 @@ nsDocument::ResetToURI(nsIURI *aURI, nsILoadGroup *aLoadGroup)
   mDocumentTitle.Truncate();
 
   NS_IF_RELEASE(mDocumentURL);
-  NS_IF_RELEASE(mPrincipal);
+  mPrincipal = nsnull;
   mDocumentLoadGroup = nsnull;
 
   // Delete references to sub-documents and kill the subdocument map,
@@ -924,7 +923,7 @@ nsDocument::GetPrincipal(nsIPrincipal **aPrincipal)
         return rv;
     NS_WARN_IF_FALSE(mDocumentURL, "no URL!");
     if (NS_FAILED(rv = securityManager->GetCodebasePrincipal(mDocumentURL, 
-                                                             &mPrincipal)))
+                                                  getter_AddRefs(mPrincipal))))
         return rv;
   }
 
diff --git a/content/base/src/nsDocument.h b/content/base/src/nsDocument.h
index e2e80ad41ad..59837e31a22 100644
--- a/content/base/src/nsDocument.h
+++ b/content/base/src/nsDocument.h
@@ -615,7 +615,7 @@ protected:
   nsString mDocumentTitle;
   nsIURI* mDocumentURL;
   nsCOMPtr<nsIURI> mDocumentBaseURL;
-  nsIPrincipal* mPrincipal;
+  nsCOMPtr<nsIPrincipal> mPrincipal;
   nsWeakPtr mDocumentLoadGroup;
   nsWeakPtr mDocumentContainer;
 
diff --git a/content/html/document/src/nsHTMLDocument.cpp b/content/html/document/src/nsHTMLDocument.cpp
index 57c0a97f6df..20068033950 100644
--- a/content/html/document/src/nsHTMLDocument.cpp
+++ b/content/html/document/src/nsHTMLDocument.cpp
@@ -2703,9 +2703,7 @@ nsHTMLDocument::ScriptWriteCommon(PRBool aNewlineTerminate)
         mDocumentURL = subjectURI;
         NS_ADDREF(mDocumentURL);
 
-        NS_IF_RELEASE(mPrincipal);
         mPrincipal = subject;
-        NS_ADDREF(mPrincipal);
       }
     }
   }
diff --git a/content/xml/document/src/nsXMLDocument.cpp b/content/xml/document/src/nsXMLDocument.cpp
index 9dfb5f2e383..e5aff278132 100644
--- a/content/xml/document/src/nsXMLDocument.cpp
+++ b/content/xml/document/src/nsXMLDocument.cpp
@@ -394,14 +394,13 @@ nsXMLDocument::Load(const nsAString& aUrl)
 
   // Partial Reset, need to restore principal for security reasons and
   // event listener manager so that load listeners etc. will remain.
-  nsCOMPtr<nsIPrincipal> principal(dont_QueryInterface(mPrincipal));
-  nsCOMPtr<nsIEventListenerManager> elm(dont_QueryInterface(mListenerManager));
+  nsCOMPtr<nsIPrincipal> principal = mPrincipal;
+  nsCOMPtr<nsIEventListenerManager> elm = mListenerManager;
 
   Reset(nsnull, nsnull);
   
   mPrincipal = principal;
   mListenerManager = elm;
-  NS_IF_ADDREF(mPrincipal);
   NS_IF_ADDREF(mListenerManager);
   
   SetDocumentURL(uri);
@@ -433,15 +432,15 @@ nsXMLDocument::Load(const nsAString& aUrl)
   if (NS_FAILED(rv)) return rv;
 
   // Set a principal for this document
-  NS_IF_RELEASE(mPrincipal);
+  mPrincipal = nsnull;
   nsCOMPtr<nsISupports> channelOwner;
   rv = channel->GetOwner(getter_AddRefs(channelOwner));
   if (NS_SUCCEEDED(rv) && channelOwner)
-      rv = channelOwner->QueryInterface(NS_GET_IID(nsIPrincipal), (void**)&mPrincipal);
+      mPrincipal = do_QueryInterface(channelOwner, &rv);
 
   if (NS_FAILED(rv) || !channelOwner)
   {
-    rv = secMan->GetCodebasePrincipal(uri, &mPrincipal);
+    rv = secMan->GetCodebasePrincipal(uri, getter_AddRefs(mPrincipal));
     if (!mPrincipal) return rv;
   }