--- a/caps/include/nsPrincipal.h
+++ b/caps/include/nsPrincipal.h
@@ -148,16 +148,21 @@ public:
                               const char* aDeniedList,
                               nsISupports* aCert,
                               bool aIsCert,
                               bool aTrusted);
 
   virtual void GetScriptLocation(nsACString& aStr) MOZ_OVERRIDE;
   void SetURI(nsIURI* aURI);
 
+  /**
+   * Computes the puny-encoded origin of aURI.
+   */
+  static nsresult GetOriginForURI(nsIURI* aURI, char **aOrigin);
+
   nsCOMPtr<nsIURI> mDomain;
   nsCOMPtr<nsIURI> mCodebase;
   // If mCodebaseImmutable is true, mCodebase is non-null and immutable
   bool mCodebaseImmutable;
   bool mDomainImmutable;
   bool mInitialized;
 };
 

--- a/caps/src/nsPrincipal.cpp
+++ b/caps/src/nsPrincipal.cpp
@@ -651,78 +651,86 @@ nsPrincipal::GetScriptLocation(nsACStrin
 {
   if (mCert) {
     aStr.Assign(mCert->fingerprint);
   } else {
     mCodebase->GetSpec(aStr);
   }
 }
 
-NS_IMETHODIMP
-nsPrincipal::GetOrigin(char **aOrigin)
+/* static */ nsresult
+nsPrincipal::GetOriginForURI(nsIURI* aURI, char **aOrigin)
 {
+  if (!aURI) {
+    return NS_ERROR_FAILURE;
+  }
+
   *aOrigin = nsnull;
 
-  nsCOMPtr<nsIURI> origin;
-  if (mCodebase) {
-    origin = NS_GetInnermostURI(mCodebase);
-  }
-  
+  nsCOMPtr<nsIURI> origin = NS_GetInnermostURI(aURI);
   if (!origin) {
-    NS_ASSERTION(mCert, "No Domain or Codebase for a non-cert principal");
     return NS_ERROR_FAILURE;
   }
 
   nsCAutoString hostPort;
 
   // chrome: URLs don't have a meaningful origin, so make
   // sure we just get the full spec for them.
   // XXX this should be removed in favor of the solution in
   // bug 160042.
   bool isChrome;
   nsresult rv = origin->SchemeIs("chrome", &isChrome);
   if (NS_SUCCEEDED(rv) && !isChrome) {
     rv = origin->GetAsciiHost(hostPort);
     // Some implementations return an empty string, treat it as no support
     // for asciiHost by that implementation.
-    if (hostPort.IsEmpty())
+    if (hostPort.IsEmpty()) {
       rv = NS_ERROR_FAILURE;
+    }
   }
 
   PRInt32 port;
   if (NS_SUCCEEDED(rv) && !isChrome) {
     rv = origin->GetPort(&port);
   }
 
   if (NS_SUCCEEDED(rv) && !isChrome) {
     if (port != -1) {
       hostPort.AppendLiteral(":");
       hostPort.AppendInt(port, 10);
     }
 
     nsCAutoString scheme;
     rv = origin->GetScheme(scheme);
     NS_ENSURE_SUCCESS(rv, rv);
+
     *aOrigin = ToNewCString(scheme + NS_LITERAL_CSTRING("://") + hostPort);
   }
   else {
     // Some URIs (e.g., nsSimpleURI) don't support asciiHost. Just
     // get the full spec.
     nsCAutoString spec;
     // XXX nsMozIconURI and nsJARURI don't implement this correctly, they
     // both fall back to GetSpec.  That needs to be fixed.
     rv = origin->GetAsciiSpec(spec);
     NS_ENSURE_SUCCESS(rv, rv);
+
     *aOrigin = ToNewCString(spec);
   }
 
   return *aOrigin ? NS_OK : NS_ERROR_OUT_OF_MEMORY;
 }
 
 NS_IMETHODIMP
+nsPrincipal::GetOrigin(char **aOrigin)
+{
+  return GetOriginForURI(mCodebase, aOrigin);
+}
+
+NS_IMETHODIMP
 nsPrincipal::Equals(nsIPrincipal *aOther, bool *aResult)
 {
   if (!aOther) {
     NS_WARNING("Need a principal to compare this to!");
     *aResult = false;
     return NS_OK;
   }