diff --git a/mozilla/mailnews/compose/src/nsMsgAttachmentHandler.cpp b/mozilla/mailnews/compose/src/nsMsgAttachmentHandler.cpp
index 4072928d931..321bf6183ea 100644
--- a/mozilla/mailnews/compose/src/nsMsgAttachmentHandler.cpp
+++ b/mozilla/mailnews/compose/src/nsMsgAttachmentHandler.cpp
@@ -806,13 +806,6 @@ nsMsgAttachmentHandler::SnarfAttachment(nsMsgCompFields *compFields)
       PR_FREEIF(obj->buff);               /* free the working buff.   */
       PR_FREEIF(obj);
 
-
-      //
-      // Now that we have morphed this file, we need to change where mURL is pointing.
-      //
-      NS_RELEASE(mURL);
-      mURL = nsnull;
-
       char *newURLSpec = nsMsgPlatformFileToURL(*mAppleFileSpec);
 
       if (!newURLSpec) 
@@ -822,7 +815,7 @@ nsMsgAttachmentHandler::SnarfAttachment(nsMsgCompFields *compFields)
         return NS_ERROR_OUT_OF_MEMORY;
       }
 
-      if (NS_FAILED(nsMsgNewURL(&mURL, newURLSpec)))
+      if (NS_FAILED(nsMsgNewURL(getter_AddRefs(mURL), newURLSpec)))
       {
         PR_FREEIF(src_filename);
         PR_FREEIF(separator);
@@ -830,7 +823,6 @@ nsMsgAttachmentHandler::SnarfAttachment(nsMsgCompFields *compFields)
         return NS_ERROR_OUT_OF_MEMORY;
       }
   
-      NS_ADDREF(mURL);
       PR_FREEIF(newURLSpec);
       
       // Now after conversion, also patch the types.
@@ -879,7 +871,6 @@ nsMsgAttachmentHandler::SnarfAttachment(nsMsgCompFields *compFields)
   // in the temp file
   //
   // Create a fetcher for the URL attachment...
-  NS_ADDREF(mURL);
 
   nsresult rv;
   nsCOMPtr<nsIURLFetcher> fetcher = do_CreateInstance(NS_URLFETCHER_CONTRACTID, &rv);
diff --git a/mozilla/mailnews/compose/src/nsMsgAttachmentHandler.h b/mozilla/mailnews/compose/src/nsMsgAttachmentHandler.h
index fc18bc27442..b7f605e1315 100644
--- a/mozilla/mailnews/compose/src/nsMsgAttachmentHandler.h
+++ b/mozilla/mailnews/compose/src/nsMsgAttachmentHandler.h
@@ -95,7 +95,7 @@ private:
   //////////////////////////////////////////////////////////////////////
   //
 public:
-  nsIURI                *mURL;
+  nsCOMPtr <nsIURI> mURL;
   nsFileSpec            *mFileSpec;         // The temp file to which we save it 
   nsCOMPtr<nsIFileOutputStream>  mOutFile;          
   nsIRequest            *mRequest;          // The live request used while fetching an attachment
diff --git a/mozilla/mailnews/compose/src/nsMsgSend.cpp b/mozilla/mailnews/compose/src/nsMsgSend.cpp
index 1a8232b09ab..5766405bb50 100644
--- a/mozilla/mailnews/compose/src/nsMsgSend.cpp
+++ b/mozilla/mailnews/compose/src/nsMsgSend.cpp
@@ -367,11 +367,7 @@ nsMsgComposeAndSend::Clear()
         m_attachments [i].m_encoder_data = 0;
       }
 
-      if (m_attachments[i].mURL)
-      {
-        NS_RELEASE(m_attachments[i].mURL);
-        m_attachments[i].mURL = nsnull;
-      }
+      m_attachments[i].mURL = nsnull;
 
       PR_FREEIF (m_attachments [i].m_type);
       PR_FREEIF (m_attachments [i].m_charset);
@@ -629,14 +625,13 @@ nsMsgComposeAndSend::GatherMimeAttachments()
     m_plaintext->m_bogus_attachment = PR_TRUE;
 
     char *tempURL = nsMsgPlatformFileToURL (*mHTMLFileSpec);
-    if (!tempURL || NS_FAILED(nsMsgNewURL(&(m_plaintext->mURL), tempURL)))
+    if (!tempURL || NS_FAILED(nsMsgNewURL(getter_AddRefs(m_plaintext->mURL), tempURL)))
     {
       delete m_plaintext;
       m_plaintext = nsnull;
       goto FAILMEM;
     }
   
-    NS_IF_ADDREF(m_plaintext->mURL);
     PR_FREEIF(tempURL);
 
     PR_FREEIF(m_plaintext->m_type);
@@ -1828,8 +1823,6 @@ nsMsgComposeAndSend::ProcessMultipartRelated(PRInt32 *aMailboxCount, PRInt32 *aN
     // Now we have to get all of the interesting information from
     // the nsIDOMNode we have in hand...
     
-    if (m_attachments[i].mURL)
-      NS_RELEASE(m_attachments[i].mURL);
     m_attachments[i].mURL = attachment.url;
     
     PR_FREEIF(m_attachments[i].m_override_type);
@@ -2090,9 +2083,7 @@ nsMsgComposeAndSend::AddCompFieldLocalAttachments()
         //
         m_attachments[newLoc].mDeleteFile = PR_FALSE;
 
-        if (m_attachments[newLoc].mURL)
-          NS_RELEASE(m_attachments[newLoc].mURL);
-          nsMsgNewURL(&(m_attachments[newLoc].mURL), url.get());
+        nsMsgNewURL(getter_AddRefs(m_attachments[newLoc].mURL), url.get());
 
         if (m_attachments[newLoc].mFileSpec)
         {
@@ -2236,10 +2227,7 @@ nsMsgComposeAndSend::AddCompFieldRemoteAttachments(PRUint32   aStartLocation,
         m_attachments[newLoc].m_done = PR_FALSE;
         m_attachments[newLoc].SetMimeDeliveryState(this);
 
-        if (m_attachments[newLoc].mURL)
-          NS_RELEASE(m_attachments[newLoc].mURL);
-
-        nsMsgNewURL(&(m_attachments[newLoc].mURL), url.get());
+        nsMsgNewURL(getter_AddRefs(m_attachments[newLoc].mURL), url.get());
 
         PR_FREEIF(m_attachments[newLoc].m_charset);
         m_attachments[newLoc].m_charset = PL_strdup(mCompFields->GetCharacterSet());
@@ -2358,8 +2346,6 @@ nsMsgComposeAndSend::HackAttachments(const nsMsgAttachmentData *attachments,
       m_attachments[i].m_done = PR_TRUE;
       NS_ASSERTION (preloaded_attachments[i].orig_url, "null url");
 
-      if (m_attachments[i].mURL)
-        NS_RELEASE(m_attachments[i].mURL);
       m_attachments[i].mURL = preloaded_attachments[i].orig_url;
 
       PR_FREEIF(m_attachments[i].m_type);
@@ -2466,8 +2452,6 @@ nsMsgComposeAndSend::HackAttachments(const nsMsgAttachmentData *attachments,
       m_attachments[i].SetMimeDeliveryState(this);
       NS_ASSERTION (attachments[locCount].url, "null url");
 
-      if (m_attachments[i].mURL)
-        NS_RELEASE(m_attachments[i].mURL);
       m_attachments[i].mURL = attachments[locCount].url;
 
       PR_FREEIF(m_attachments[i].m_override_type);