When we turn on the pref security.data_uri.unique_opaque_origin, this test failed because data: URI is treated as cross origin. So I replace the data: URI as a seperate xul.
Yoshi Huang