diff --git a/mozilla/dom/src/base/nsGlobalWindow.h b/mozilla/dom/src/base/nsGlobalWindow.h
index 4acba9be1d9..19a8a6f5e36 100644
--- a/mozilla/dom/src/base/nsGlobalWindow.h
+++ b/mozilla/dom/src/base/nsGlobalWindow.h
@@ -756,7 +756,8 @@ protected:
   nsresult SetHrefWithContext(JSContext* cx, const nsAString& aHref,
                               PRBool aReplace);
 
-  nsresult GetSourceURL(JSContext* cx, nsIURI** sourceURL);
+  nsresult GetSourceURL(JSContext* cx, nsIPrincipal* callerPrincipal,
+                        nsIURI** sourceURL);
   nsresult GetSourceBaseURL(JSContext* cx, nsIURI** sourceURL);
   nsresult GetSourceDocument(JSContext* cx, nsIDocument** aDocument);
 
diff --git a/mozilla/dom/src/base/nsLocation.cpp b/mozilla/dom/src/base/nsLocation.cpp
index dad92491d0d..8abba06fd74 100644
--- a/mozilla/dom/src/base/nsLocation.cpp
+++ b/mozilla/dom/src/base/nsLocation.cpp
@@ -220,7 +220,7 @@ nsLocation::CheckURL(nsIURI* aURI, nsIDocShellLoadInfo** aLoadInfo)
       return NS_ERROR_FAILURE;
     owner = do_QueryInterface(principal);
 
-    GetSourceURL(cx, getter_AddRefs(sourceURI));
+    GetSourceURL(cx, principal, getter_AddRefs(sourceURI));
   }
 
   // Create load info
@@ -1026,14 +1026,24 @@ nsLocation::GetSourceBaseURL(JSContext* cx, nsIURI** sourceURL)
 }
 
 nsresult
-nsLocation::GetSourceURL(JSContext* cx, nsIURI** sourceURL)
+nsLocation::GetSourceURL(JSContext* cx, nsIPrincipal* callerPrincipal,
+                         nsIURI** sourceURL)
 {
+  NS_PRECONDITION(callerPrincipal, "Must have caller principal here");
+  
+  *sourceURL = nsnull;
+  
   nsCOMPtr<nsIDocument> doc;
   nsresult rv = GetSourceDocument(cx, getter_AddRefs(doc));
   if (doc) {
-    NS_IF_ADDREF(*sourceURL = doc->GetDocumentURI());
-  } else {
-    *sourceURL = nsnull;
+    nsIPrincipal* docPrincipal = doc->GetPrincipal();
+    if (docPrincipal) {
+      PRBool subsumes;
+      rv = callerPrincipal->Subsumes(docPrincipal, &subsumes);
+      if (NS_SUCCEEDED(rv) && subsumes) {
+        NS_IF_ADDREF(*sourceURL = doc->GetDocumentURI());
+      }
+    }
   }
 
   return rv;