--- a/docshell/base/nsDefaultURIFixup.cpp
+++ b/docshell/base/nsDefaultURIFixup.cpp
@@ -65,35 +65,17 @@ nsDefaultURIFixup::CreateExposableURI(ns
     *aReturn = aURI;
     NS_ADDREF(*aReturn);
     return NS_OK;
   }
 
   // Rats, we have to massage the URI
   nsCOMPtr<nsIURI> uri;
   if (isWyciwyg) {
-    nsAutoCString path;
-    nsresult rv = aURI->GetPathQueryRef(path);
-    NS_ENSURE_SUCCESS(rv, rv);
-
-    uint32_t pathLength = path.Length();
-    if (pathLength <= 2) {
-      return NS_ERROR_FAILURE;
-    }
-
-    // Path is of the form "//123/http://foo/bar", with a variable number of
-    // digits. To figure out where the "real" URL starts, search path for a '/',
-    // starting at the third character.
-    int32_t slashIndex = path.FindChar('/', 2);
-    if (slashIndex == kNotFound) {
-      return NS_ERROR_FAILURE;
-    }
-
-    rv = NS_NewURI(getter_AddRefs(uri),
-                   Substring(path, slashIndex + 1, pathLength - slashIndex - 1));
+    nsresult rv = nsContentUtils::RemoveWyciwygScheme(aURI, getter_AddRefs(uri));
     NS_ENSURE_SUCCESS(rv, rv);
   } else {
     // clone the URI so zapping user:pass doesn't change the original
     nsresult rv = aURI->Clone(getter_AddRefs(uri));
     NS_ENSURE_SUCCESS(rv, rv);
   }
 
   // hide user:pass unless overridden by pref

--- a/dom/base/nsContentUtils.cpp
+++ b/dom/base/nsContentUtils.cpp
@@ -756,16 +756,44 @@ nsContentUtils::Init()
   uio->Init();
   uio.forget(&sUserInteractionObserver);
 
   sInitialized = true;
 
   return NS_OK;
 }
 
+nsresult nsContentUtils::RemoveWyciwygScheme(nsIURI* aURI, nsIURI** aReturn)
+{
+#ifdef DEBUG
+  bool isWyciwyg = false;
+  aURI->SchemeIs("wyciwyg", &isWyciwyg);
+  NS_PRECONDITION(isWyciwyg, "Scheme should be wyciwyg");
+#endif
+  nsAutoCString path;
+  nsresult rv = aURI->GetPathQueryRef(path);
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  uint32_t pathLength = path.Length();
+  if (pathLength <= 2) {
+    return NS_ERROR_FAILURE;
+  }
+
+  // Path is of the form "//123/http://foo/bar", with a variable number of
+  // digits. To figure out where the "real" URL starts, search path for a '/',
+  // starting at the third character.
+  int32_t slashIndex = path.FindChar('/', 2);
+  if (slashIndex == kNotFound) {
+    return NS_ERROR_FAILURE;
+  }
+
+  return NS_NewURI(aReturn,
+    Substring(path, slashIndex + 1, pathLength - slashIndex - 1));
+}
+
 void
 nsContentUtils::GetShiftText(nsAString& text)
 {
   if (!sShiftText)
     InitializeModifierStrings();
   text.Assign(*sShiftText);
 }
 

--- a/dom/base/nsContentUtils.h
+++ b/dom/base/nsContentUtils.h
@@ -204,16 +204,19 @@ class nsContentUtils
 {
   friend class nsAutoScriptBlockerSuppressNodeRemoved;
   typedef mozilla::dom::Element Element;
   typedef mozilla::TimeDuration TimeDuration;
 
 public:
   static nsresult Init();
 
+  // Strip off "wyciwyg://n/" part of a URL. aURI must have "wyciwyg" scheme.
+  static nsresult RemoveWyciwygScheme(nsIURI* aURI, nsIURI** aReturn);
+
   static bool     IsCallerChrome();
   static bool     ThreadsafeIsCallerChrome();
   static bool     IsCallerContentXBL();
 
   // The APIs for checking whether the caller is system (in the sense of system
   // principal) should only be used when the JSContext is known to accurately
   // represent the caller.  In practice, that means you should only use them in
   // two situations at the moment: