diff --git a/xpinstall/src/nsXPITriggerInfo.cpp b/xpinstall/src/nsXPITriggerInfo.cpp
index 36abce80887..0079f645985 100644
--- a/xpinstall/src/nsXPITriggerInfo.cpp
+++ b/xpinstall/src/nsXPITriggerInfo.cpp
@@ -94,6 +94,13 @@ nsXPITriggerItem::SetPrincipal(nsIPrincipal* aPrincipal)
 {
     mPrincipal = aPrincipal;
 
+    // aPrincipal can be null for various failure cases.
+    // see bug 213894 for an example.
+    // nsXPInstallManager::OnCertAvailable can be called with a null principal
+    // and it can also force a null principal.
+    if (!aPrincipal)
+        return;
+
     PRBool hasCert;
     aPrincipal->GetHasCertificate(&hasCert);
     if (hasCert) {