diff --git a/netwerk/protocol/about/src/nsAboutProtocolHandler.cpp b/netwerk/protocol/about/src/nsAboutProtocolHandler.cpp
index 312c59fccbd..e9407fca27a 100644
--- a/netwerk/protocol/about/src/nsAboutProtocolHandler.cpp
+++ b/netwerk/protocol/about/src/nsAboutProtocolHandler.cpp
@@ -285,7 +285,11 @@ nsNestedAboutURI::Read(nsIObjectInputStream* aStream)
     if (NS_FAILED(rv)) return rv;
 
     if (haveBase) {
-        rv = aStream->ReadObject(PR_TRUE, getter_AddRefs(mBaseURI));
+        nsCOMPtr<nsISupports> supports;
+        rv = aStream->ReadObject(PR_TRUE, getter_AddRefs(supports));
+        if (NS_FAILED(rv)) return rv;
+
+        mBaseURI = do_QueryInterface(supports, &rv);
         if (NS_FAILED(rv)) return rv;
     }
 
@@ -302,7 +306,16 @@ nsNestedAboutURI::Write(nsIObjectOutputStream* aStream)
     if (NS_FAILED(rv)) return rv;
 
     if (mBaseURI) {
-        rv = aStream->WriteObject(mBaseURI, PR_TRUE);
+        // A previous iteration of this code wrote out mBaseURI as nsISupports
+        // and then read it in as nsIURI, which is non-kosher when mBaseURI
+        // implements more than just a single line of interfaces and the
+        // canonical nsISupports* isn't the one a static_cast<> of mBaseURI
+        // would produce.  For backwards compatibility with existing
+        // serializations we continue to write mBaseURI as nsISupports but
+        // switch to reading it as nsISupports, with a post-read QI to get to
+        // nsIURI.
+        rv = aStream->WriteCompoundObject(mBaseURI, NS_GET_IID(nsISupports),
+                                          PR_TRUE);
         if (NS_FAILED(rv)) return rv;
     }
 
diff --git a/netwerk/test/unit/test_nestedabout_serialize.js b/netwerk/test/unit/test_nestedabout_serialize.js
new file mode 100644
index 00000000000..bae233099ff
--- /dev/null
+++ b/netwerk/test/unit/test_nestedabout_serialize.js
@@ -0,0 +1,38 @@
+const Cc = Components.classes;
+const Ci = Components.interfaces;
+
+const BinaryInputStream =
+  Components.Constructor("@mozilla.org/binaryinputstream;1",
+                         "nsIBinaryInputStream", "setInputStream");
+const BinaryOutputStream =
+  Components.Constructor("@mozilla.org/binaryoutputstream;1",
+                         "nsIBinaryOutputStream", "setOutputStream");
+
+const Pipe =
+  Components.Constructor("@mozilla.org/pipe;1", "nsIPipe", "init");
+
+const kNestedAboutCID = "{2f277c00-0eaf-4ddb-b936-41326ba48aae}";
+
+function run_test()
+{
+  var ios = Cc["@mozilla.org/network/io-service;1"].createInstance(Ci.nsIIOService);
+
+  var baseURI = ios.newURI("http://example.com/", "UTF-8", null);
+
+  // This depends on the redirector for about:license having the
+  // nsIAboutModule::URI_SAFE_FOR_UNTRUSTED_CONTENT flag.
+  var aboutLicense = ios.newURI("about:license", "UTF-8", baseURI);
+
+  var pipe = new Pipe(false, false, 0, 0, null);
+  var output = new BinaryOutputStream(pipe.outputStream);
+  var input = new BinaryInputStream(pipe.inputStream);
+  output.QueryInterface(Ci.nsIObjectOutputStream);
+  input.QueryInterface(Ci.nsIObjectInputStream);
+
+  output.writeCompoundObject(aboutLicense, Ci.nsIURI, true);
+  var copy = input.readObject(true);
+  copy.QueryInterface(Ci.nsIURI);
+
+  do_check_eq(copy.asciiSpec, aboutLicense.asciiSpec);
+  do_check_true(copy.equals(aboutLicense));
+}