--- a/chrome/src/nsChromeProtocolHandler.cpp
+++ b/chrome/src/nsChromeProtocolHandler.cpp
@@ -37,16 +37,17 @@
  * ***** END LICENSE BLOCK ***** */
 
 /*
 
   A protocol handler for ``chrome:''
 
 */
 
+#include "nsAutoPtr.h"
 #include "nsChromeProtocolHandler.h"
 #include "nsChromeRegistry.h"
 #include "nsCOMPtr.h"
 #include "nsContentCID.h"
 #include "nsCRT.h"
 #include "nsThreadUtils.h"
 #include "nsIChannel.h"
 #include "nsIChromeRegistry.h"
@@ -95,16 +96,20 @@ static NS_DEFINE_CID(kXULPrototypeCacheC
 //  Each is done asynchronously to allow the stack to unwind back to
 //  the main event loop. This avoids any weird re-entrancy that occurs
 //  if we try to immediately fire the On[Start|Stop]Request().
 //
 //  For logging information, NSPR_LOG_MODULES=nsCachedChromeChannel:5
 //
 #define LOG(args) PR_LOG(gLog, PR_LOG_DEBUG, args)
 
+#define NS_CACHEDCHROMECHANNEL_IMPL_IID \
+{ 0x281371d3, 0x6bc2, 0x499f, \
+  { 0x8d, 0x70, 0xcb, 0xfc, 0x01, 0x1b, 0xa0, 0x43 } }
+
 class nsCachedChromeChannel : public nsIChannel
 {
 protected:
     ~nsCachedChromeChannel();
 
     nsCOMPtr<nsIURI>            mURI;
     nsCOMPtr<nsIURI>            mOriginalURI;
     nsCOMPtr<nsILoadGroup>      mLoadGroup;
@@ -118,16 +123,18 @@ protected:
     static PRLogModuleInfo* gLog;
 #endif
 
     void HandleLoadEvent();
 
 public:
     nsCachedChromeChannel(nsIURI* aURI);
 
+    NS_DECLARE_STATIC_IID_ACCESSOR(nsCachedChromeChannel)
+
     NS_DECL_ISUPPORTS
 
     // nsIRequest
     NS_IMETHOD GetName(nsACString &result) { return mURI->GetSpec(result); }
     NS_IMETHOD IsPending(PRBool *_retval) { *_retval = (mListener != nsnull); return NS_OK; }
     NS_IMETHOD GetStatus(nsresult *status) { *status = mStatus; return NS_OK; }
     NS_IMETHOD Cancel(nsresult status)  { mStatus = status; return NS_OK; }
     NS_IMETHOD Suspend(void) { return NS_OK; } // XXX technically wrong
@@ -136,21 +143,25 @@ public:
     NS_IMETHOD SetLoadGroup(nsILoadGroup *);
     NS_IMETHOD GetLoadFlags(nsLoadFlags *);
     NS_IMETHOD SetLoadFlags(nsLoadFlags);
 
     // nsIChannel
     NS_DECL_NSICHANNEL
 };
 
+NS_DEFINE_STATIC_IID_ACCESSOR(nsCachedChromeChannel,
+                              NS_CACHEDCHROMECHANNEL_IMPL_IID)
+
 #ifdef PR_LOGGING
 PRLogModuleInfo* nsCachedChromeChannel::gLog;
 #endif
 
-NS_IMPL_ISUPPORTS2(nsCachedChromeChannel, nsIChannel, nsIRequest)
+NS_IMPL_ISUPPORTS3(nsCachedChromeChannel, nsIChannel, nsIRequest,
+                   nsCachedChromeChannel)
 
 nsCachedChromeChannel::nsCachedChromeChannel(nsIURI* aURI)
     : mURI(aURI)
     , mLoadFlags(nsIRequest::LOAD_NORMAL)
     , mStatus(NS_OK)
 {
 #ifdef PR_LOGGING
     if (! gLog)
@@ -557,19 +568,24 @@ nsChromeProtocolHandler::NewChannel(nsIU
                 printf("Chrome file doesn't exist: %s\n", path.get());
             }
 #endif
         }
         else {
             nsCOMPtr<nsIJARChannel> jarChan
                 (do_QueryInterface(result));
             if (!jarChan) {
-                NS_WARNING("Remote chrome not allowed! Only file:, resource:, and jar: are valid.\n");
-                result = nsnull;
-                return NS_ERROR_FAILURE;
+                nsRefPtr<nsCachedChromeChannel> cachedChannel;
+                if (NS_FAILED(CallQueryInterface(result.get(),
+                        static_cast<nsCachedChromeChannel**>(
+                            getter_AddRefs(cachedChannel))))) {
+                    NS_WARNING("Remote chrome not allowed! Only file:, resource:, jar:, and cached chrome channels are valid.\n");
+                    result = nsnull;
+                    return NS_ERROR_FAILURE;
+                }
             }
         }
 
         // Make sure that the channel remembers where it was
         // originally loaded from.
         rv = result->SetOriginalURI(aURI);
         if (NS_FAILED(rv)) return rv;