--- a/netwerk/cache/src/nsCacheEntryDescriptor.cpp
+++ b/netwerk/cache/src/nsCacheEntryDescriptor.cpp
@@ -317,31 +317,41 @@ nsCacheEntryDescriptor::GetAccessGranted
 
 NS_IMETHODIMP
 nsCacheEntryDescriptor::GetStoragePolicy(nsCacheStoragePolicy *result)
 {
     NS_ENSURE_ARG_POINTER(result);
     nsCacheServiceAutoLock lock;
     if (!mCacheEntry)  return NS_ERROR_NOT_AVAILABLE;
     
-    return mCacheEntry->StoragePolicy();
+    *result = mCacheEntry->StoragePolicy();
+    return NS_OK;
 }
 
 
 NS_IMETHODIMP
 nsCacheEntryDescriptor::SetStoragePolicy(nsCacheStoragePolicy policy)
 {
     nsCacheServiceAutoLock lock;
     if (!mCacheEntry)  return NS_ERROR_NOT_AVAILABLE;
     // XXX validate policy against session?
     
     PRBool      storageEnabled = PR_FALSE;
     storageEnabled = nsCacheService::IsStorageEnabledForPolicy_Locked(policy);
     if (!storageEnabled)    return NS_ERROR_FAILURE;
+
+    // Don't change the storage policy of entries we can't write
+    if (!(mAccessGranted & ACCESS_WRITE))
+        return NS_ERROR_NOT_AVAILABLE;
     
+    // Don't allow a cache entry to move from memory-only to anything else
+    if (mCacheEntry->StoragePolicy() == nsICache::STORE_IN_MEMORY &&
+        policy != nsICache::STORE_IN_MEMORY)
+        return NS_ERROR_NOT_AVAILABLE;
+        
     mCacheEntry->SetStoragePolicy(policy);
     mCacheEntry->MarkEntryDirty();
     return NS_OK;
 }
 
 
 NS_IMETHODIMP
 nsCacheEntryDescriptor::GetFile(nsIFile ** result)