diff --git a/mozilla/docshell/base/nsDocShell.cpp b/mozilla/docshell/base/nsDocShell.cpp
index 2d36944179e..4b7ce8f059c 100644
--- a/mozilla/docshell/base/nsDocShell.cpp
+++ b/mozilla/docshell/base/nsDocShell.cpp
@@ -4717,12 +4717,7 @@ nsDocShell::OnRedirectStateChange(nsIChannel* aOldChannel,
         aOldChannel->GetURI(getter_AddRefs(oldURI));
         if (! oldURI)
             return; // nothing to tell anybody about
-
-        nsCOMPtr<nsIHttpChannel> httpchannel(do_QueryInterface(aOldChannel));
-        nsCOMPtr<nsIURI> referrer;
-        if (httpchannel)
-            httpchannel->GetReferrer(getter_AddRefs(referrer));
-        AddToGlobalHistory(oldURI, PR_TRUE, referrer);
+        AddToGlobalHistory(oldURI, PR_TRUE, aOldChannel);
     }
 }
 
@@ -7335,11 +7330,7 @@ nsDocShell::OnNewURI(nsIURI * aURI, nsIChannel * aChannel,
         // Update Global history
         if (aAddToGlobalHistory) {
             // Get the referrer uri from the channel
-            nsCOMPtr<nsIURI> referrer;
-            nsCOMPtr<nsIHttpChannel> httpchannel(do_QueryInterface(aChannel));
-            if (httpchannel)
-                httpchannel->GetReferrer(getter_AddRefs(referrer));
-            AddToGlobalHistory(aURI, PR_FALSE, referrer);
+            AddToGlobalHistory(aURI, PR_FALSE, aChannel);
         }
     }
 
@@ -8082,7 +8073,8 @@ NS_IMETHODIMP nsDocShell::MakeEditable(PRBool inWaitForUriLoad)
 }
 
 nsresult
-nsDocShell::AddToGlobalHistory(nsIURI * aURI, PRBool aRedirect, nsIURI * aReferrer)
+nsDocShell::AddToGlobalHistory(nsIURI * aURI, PRBool aRedirect,
+                               nsIChannel * aChannel)
 {
     if (mItemType != typeContent || !mGlobalHistory)
         return NS_OK;
@@ -8091,8 +8083,19 @@ nsDocShell::AddToGlobalHistory(nsIURI * aURI, PRBool aRedirect, nsIURI * aReferr
     nsresult rv = mGlobalHistory->IsVisited(aURI, &visited);
     if (NS_FAILED(rv))
         return rv;
-    
-    rv = mGlobalHistory->AddURI(aURI, aRedirect, !IsFrame(), aReferrer);
+
+    // Get referrer from the channel. We have to check for a property on a
+    // property bag because the referrer may be empty for security reasons (for
+    // example, when loading a http page with a https referrer).
+    nsCOMPtr<nsIURI> referrer;
+    nsCOMPtr<nsIPropertyBag2> props(do_QueryInterface(aChannel));
+    if (props) {
+        props->GetPropertyAsInterface(NS_LITERAL_STRING("docshell.internalReferrer"),
+                                      NS_GET_IID(nsIURI),
+                                      getter_AddRefs(referrer));
+    }
+
+    rv = mGlobalHistory->AddURI(aURI, aRedirect, !IsFrame(), referrer);
     if (NS_FAILED(rv))
         return rv;
 
diff --git a/mozilla/docshell/base/nsDocShell.h b/mozilla/docshell/base/nsDocShell.h
index a0c2ef54ce5..3a65047e6d5 100644
--- a/mozilla/docshell/base/nsDocShell.h
+++ b/mozilla/docshell/base/nsDocShell.h
@@ -400,7 +400,8 @@ protected:
                                        PRUint32 aStateFlags);
 
     // Global History
-    nsresult AddToGlobalHistory(nsIURI * aURI, PRBool aRedirect, nsIURI * aReferrer);
+    nsresult AddToGlobalHistory(nsIURI * aURI, PRBool aRedirect,
+                                nsIChannel * aChannel);
 
     // Helper Routines
     NS_IMETHOD GetPromptAndStringBundle(nsIPrompt ** aPrompt,