diff --git a/content/base/src/nsGenericElement.cpp b/content/base/src/nsGenericElement.cpp
index 6fd4e34b50f5..458171a2b9a2 100644
--- a/content/base/src/nsGenericElement.cpp
+++ b/content/base/src/nsGenericElement.cpp
@@ -1225,7 +1225,7 @@ nsGenericElement::TriggerLink(nsIPresContext& aPresContext,
       if (NS_FAILED(rv)) return;
 
       char *absUrl = nsnull;
-      const char *uriStr = aURLSpec.ToNewCString();
+      char *uriStr = aURLSpec.ToNewCString();
 
       rv = service->MakeAbsolute(uriStr, baseUri, &absUrl);
       nsCRT::free(uriStr);
diff --git a/layout/base/src/nsGenericElement.cpp b/layout/base/src/nsGenericElement.cpp
index 6fd4e34b50f5..458171a2b9a2 100644
--- a/layout/base/src/nsGenericElement.cpp
+++ b/layout/base/src/nsGenericElement.cpp
@@ -1225,7 +1225,7 @@ nsGenericElement::TriggerLink(nsIPresContext& aPresContext,
       if (NS_FAILED(rv)) return;
 
       char *absUrl = nsnull;
-      const char *uriStr = aURLSpec.ToNewCString();
+      char *uriStr = aURLSpec.ToNewCString();
 
       rv = service->MakeAbsolute(uriStr, baseUri, &absUrl);
       nsCRT::free(uriStr);
diff --git a/layout/html/base/src/nsHTMLImageLoader.cpp b/layout/html/base/src/nsHTMLImageLoader.cpp
index 005a45dcc578..68c67f4a6c5c 100644
--- a/layout/html/base/src/nsHTMLImageLoader.cpp
+++ b/layout/html/base/src/nsHTMLImageLoader.cpp
@@ -93,9 +93,10 @@ nsHTMLImageLoader::SetURL(const nsString& aNewSpec)
     if (NS_FAILED(rv)) return;
 
     char *absUrl = nsnull;
-    const char *urlSpec = mURLSpec.GetBuffer();
+    char *urlSpec = mURLSpec.ToNewCString();
     rv = service->MakeAbsolute(urlSpec, baseUri, &absUrl);
     NS_RELEASE(baseUri);
+    nsCRT::free(urlSpec);
     mURL = absUrl;
     delete [] absUrl;
 #endif // NECKO