diff --git a/mozilla/layout/base/nsImageLoader.cpp b/mozilla/layout/base/nsImageLoader.cpp
index 71a362e9656..33492d82790 100644
--- a/mozilla/layout/base/nsImageLoader.cpp
+++ b/mozilla/layout/base/nsImageLoader.cpp
@@ -81,11 +81,14 @@ nsImageLoader::Destroy()
 }
 
 nsresult
-nsImageLoader::Load(const nsAReadableString &aURI)
+nsImageLoader::Load(nsIURI *aURI)
 {
   if (!mFrame)
     return NS_ERROR_NOT_INITIALIZED;
 
+  if (!aURI)
+    return NS_ERROR_FAILURE;
+
   nsCOMPtr<nsILoadGroup> loadGroup;
   nsCOMPtr<nsIURI> uri;
   nsCOMPtr<nsIURI> baseURI;
@@ -101,20 +104,11 @@ nsImageLoader::Load(const nsAReadableString &aURI)
   // Get the document's loadgroup
   doc->GetDocumentLoadGroup(getter_AddRefs(loadGroup));
 
-  doc->GetBaseURL(*getter_AddRefs(baseURI));
-
-  NS_NewURI(getter_AddRefs(uri), aURI, baseURI);
-
-  // NS_NewURI can fail to return a uri instance
-  if (uri == nsnull) {
-    return NS_ERROR_FAILURE;
-  }
-
   if (mRequest) {
     nsCOMPtr<nsIURI> oldURI;
     mRequest->GetURI(getter_AddRefs(oldURI));
     PRBool eq = PR_FALSE;
-    uri->Equals(oldURI, &eq);
+    aURI->Equals(oldURI, &eq);
     if (eq) {
       return NS_OK;
     }
@@ -123,7 +117,7 @@ nsImageLoader::Load(const nsAReadableString &aURI)
   nsCOMPtr<imgILoader> il(do_GetService("@mozilla.org/image/loader;1", &rv));
   if (NS_FAILED(rv)) return rv;
 
-  return il->LoadImage(uri, loadGroup, NS_STATIC_CAST(imgIDecoderObserver *, this), 
+  return il->LoadImage(aURI, loadGroup, NS_STATIC_CAST(imgIDecoderObserver *, this), 
                        nsnull, nsIRequest::LOAD_BACKGROUND, nsnull, nsnull, getter_AddRefs(mRequest));
 }
 
diff --git a/mozilla/layout/base/nsImageLoader.h b/mozilla/layout/base/nsImageLoader.h
index bc72251db43..4bda491e9d9 100644
--- a/mozilla/layout/base/nsImageLoader.h
+++ b/mozilla/layout/base/nsImageLoader.h
@@ -25,8 +25,7 @@
 
 class nsIPresContext;
 class nsIFrame;
-
-#include "nsString.h"
+class nsIURI;
 
 #include "imgIRequest.h"
 #include "nsCOMPtr.h"
@@ -42,7 +41,7 @@ public:
   NS_DECL_IMGICONTAINEROBSERVER
 
   void Init(nsIFrame *aFrame, nsIPresContext *aPresContext);
-  nsresult Load(const nsAReadableString &aURI);
+  nsresult Load(nsIURI *aURI);
 
   void Destroy();
 
diff --git a/mozilla/layout/base/nsPresContext.cpp b/mozilla/layout/base/nsPresContext.cpp
index 27cd4ea8e55..078b9330c51 100644
--- a/mozilla/layout/base/nsPresContext.cpp
+++ b/mozilla/layout/base/nsPresContext.cpp
@@ -67,6 +67,9 @@
 #include "nsXPIDLString.h"
 
 #include "prprf.h"
+#include "nsContentPolicyUtils.h"
+#include "nsIScriptGlobalObject.h"
+#include "nsIDOMDocument.h"
 #ifdef IBMBIDI
 #include "nsBidiPresUtils.h"
 #endif // IBMBIDI
@@ -1473,10 +1476,50 @@ nsPresContext::LoadImage(const nsString& aURL,
 {
   // look and see if we have a loader for the target frame.
 
+  nsresult rv;
+
   nsVoidKey key(aTargetFrame);
   nsImageLoader *loader = NS_REINTERPRET_CAST(nsImageLoader*, mImageLoaders.Get(&key)); // addrefs
 
+  nsCOMPtr<nsIDocument> doc;
+  rv = mShell->GetDocument(getter_AddRefs(doc));
+  if (NS_FAILED(rv)) return rv;
+
+  nsCOMPtr<nsIURI> baseURI;
+  doc->GetBaseURL(*getter_AddRefs(baseURI));
+
+  nsCOMPtr<nsIURI> uri;
+  NS_NewURI(getter_AddRefs(uri), aURL, baseURI);
+
   if (!loader) {
+    nsCOMPtr<nsIContent> content;
+    aTargetFrame->GetContent(getter_AddRefs(content));
+
+    // Check with the content-policy things to make sure this load is permitted.
+    nsresult rv;
+    nsCOMPtr<nsIDOMElement> element(do_QueryInterface(content));
+
+    if (!element) // this would seem bad(tm)
+      return NS_ERROR_FAILURE;
+
+    if (content) {
+      nsCOMPtr<nsIDocument> document;
+      rv = content->GetDocument(*getter_AddRefs(document));
+      if (NS_FAILED(rv)) return rv;
+
+      nsCOMPtr<nsIScriptGlobalObject> globalScript;
+      rv = document->GetScriptGlobalObject(getter_AddRefs(globalScript));
+      if (NS_FAILED(rv)) return rv;
+
+      nsCOMPtr<nsIDOMWindow> domWin(do_QueryInterface(globalScript));
+
+      PRBool shouldLoad = PR_TRUE;
+      rv = NS_CheckContentLoadPolicy(nsIContentPolicy::IMAGE,
+                                     uri, element, domWin, &shouldLoad);
+      if (NS_SUCCEEDED(rv) && !shouldLoad)
+        return NS_ERROR_FAILURE;
+    }
+
     nsImageLoader *newLoader = new nsImageLoader();
     if (!newLoader)
       return NS_ERROR_OUT_OF_MEMORY;
@@ -1502,7 +1545,7 @@ nsPresContext::LoadImage(const nsString& aURL,
     aTargetFrame->SetFrameState(state);
   }
 
-  loader->Load(aURL);
+  loader->Load(uri);
 
   loader->GetRequest(aRequest);
 
diff --git a/mozilla/layout/base/src/nsImageLoader.cpp b/mozilla/layout/base/src/nsImageLoader.cpp
index 71a362e9656..33492d82790 100644
--- a/mozilla/layout/base/src/nsImageLoader.cpp
+++ b/mozilla/layout/base/src/nsImageLoader.cpp
@@ -81,11 +81,14 @@ nsImageLoader::Destroy()
 }
 
 nsresult
-nsImageLoader::Load(const nsAReadableString &aURI)
+nsImageLoader::Load(nsIURI *aURI)
 {
   if (!mFrame)
     return NS_ERROR_NOT_INITIALIZED;
 
+  if (!aURI)
+    return NS_ERROR_FAILURE;
+
   nsCOMPtr<nsILoadGroup> loadGroup;
   nsCOMPtr<nsIURI> uri;
   nsCOMPtr<nsIURI> baseURI;
@@ -101,20 +104,11 @@ nsImageLoader::Load(const nsAReadableString &aURI)
   // Get the document's loadgroup
   doc->GetDocumentLoadGroup(getter_AddRefs(loadGroup));
 
-  doc->GetBaseURL(*getter_AddRefs(baseURI));
-
-  NS_NewURI(getter_AddRefs(uri), aURI, baseURI);
-
-  // NS_NewURI can fail to return a uri instance
-  if (uri == nsnull) {
-    return NS_ERROR_FAILURE;
-  }
-
   if (mRequest) {
     nsCOMPtr<nsIURI> oldURI;
     mRequest->GetURI(getter_AddRefs(oldURI));
     PRBool eq = PR_FALSE;
-    uri->Equals(oldURI, &eq);
+    aURI->Equals(oldURI, &eq);
     if (eq) {
       return NS_OK;
     }
@@ -123,7 +117,7 @@ nsImageLoader::Load(const nsAReadableString &aURI)
   nsCOMPtr<imgILoader> il(do_GetService("@mozilla.org/image/loader;1", &rv));
   if (NS_FAILED(rv)) return rv;
 
-  return il->LoadImage(uri, loadGroup, NS_STATIC_CAST(imgIDecoderObserver *, this), 
+  return il->LoadImage(aURI, loadGroup, NS_STATIC_CAST(imgIDecoderObserver *, this), 
                        nsnull, nsIRequest::LOAD_BACKGROUND, nsnull, nsnull, getter_AddRefs(mRequest));
 }
 
diff --git a/mozilla/layout/base/src/nsImageLoader.h b/mozilla/layout/base/src/nsImageLoader.h
index bc72251db43..4bda491e9d9 100644
--- a/mozilla/layout/base/src/nsImageLoader.h
+++ b/mozilla/layout/base/src/nsImageLoader.h
@@ -25,8 +25,7 @@
 
 class nsIPresContext;
 class nsIFrame;
-
-#include "nsString.h"
+class nsIURI;
 
 #include "imgIRequest.h"
 #include "nsCOMPtr.h"
@@ -42,7 +41,7 @@ public:
   NS_DECL_IMGICONTAINEROBSERVER
 
   void Init(nsIFrame *aFrame, nsIPresContext *aPresContext);
-  nsresult Load(const nsAReadableString &aURI);
+  nsresult Load(nsIURI *aURI);
 
   void Destroy();
 
diff --git a/mozilla/layout/base/src/nsPresContext.cpp b/mozilla/layout/base/src/nsPresContext.cpp
index 27cd4ea8e55..078b9330c51 100644
--- a/mozilla/layout/base/src/nsPresContext.cpp
+++ b/mozilla/layout/base/src/nsPresContext.cpp
@@ -67,6 +67,9 @@
 #include "nsXPIDLString.h"
 
 #include "prprf.h"
+#include "nsContentPolicyUtils.h"
+#include "nsIScriptGlobalObject.h"
+#include "nsIDOMDocument.h"
 #ifdef IBMBIDI
 #include "nsBidiPresUtils.h"
 #endif // IBMBIDI
@@ -1473,10 +1476,50 @@ nsPresContext::LoadImage(const nsString& aURL,
 {
   // look and see if we have a loader for the target frame.
 
+  nsresult rv;
+
   nsVoidKey key(aTargetFrame);
   nsImageLoader *loader = NS_REINTERPRET_CAST(nsImageLoader*, mImageLoaders.Get(&key)); // addrefs
 
+  nsCOMPtr<nsIDocument> doc;
+  rv = mShell->GetDocument(getter_AddRefs(doc));
+  if (NS_FAILED(rv)) return rv;
+
+  nsCOMPtr<nsIURI> baseURI;
+  doc->GetBaseURL(*getter_AddRefs(baseURI));
+
+  nsCOMPtr<nsIURI> uri;
+  NS_NewURI(getter_AddRefs(uri), aURL, baseURI);
+
   if (!loader) {
+    nsCOMPtr<nsIContent> content;
+    aTargetFrame->GetContent(getter_AddRefs(content));
+
+    // Check with the content-policy things to make sure this load is permitted.
+    nsresult rv;
+    nsCOMPtr<nsIDOMElement> element(do_QueryInterface(content));
+
+    if (!element) // this would seem bad(tm)
+      return NS_ERROR_FAILURE;
+
+    if (content) {
+      nsCOMPtr<nsIDocument> document;
+      rv = content->GetDocument(*getter_AddRefs(document));
+      if (NS_FAILED(rv)) return rv;
+
+      nsCOMPtr<nsIScriptGlobalObject> globalScript;
+      rv = document->GetScriptGlobalObject(getter_AddRefs(globalScript));
+      if (NS_FAILED(rv)) return rv;
+
+      nsCOMPtr<nsIDOMWindow> domWin(do_QueryInterface(globalScript));
+
+      PRBool shouldLoad = PR_TRUE;
+      rv = NS_CheckContentLoadPolicy(nsIContentPolicy::IMAGE,
+                                     uri, element, domWin, &shouldLoad);
+      if (NS_SUCCEEDED(rv) && !shouldLoad)
+        return NS_ERROR_FAILURE;
+    }
+
     nsImageLoader *newLoader = new nsImageLoader();
     if (!newLoader)
       return NS_ERROR_OUT_OF_MEMORY;
@@ -1502,7 +1545,7 @@ nsPresContext::LoadImage(const nsString& aURL,
     aTargetFrame->SetFrameState(state);
   }
 
-  loader->Load(aURL);
+  loader->Load(uri);
 
   loader->GetRequest(aRequest);