Don't allow javascript: favicons. b=290036 r=dveditz sr=brendan a=chase

browser/base/content/tabbrowser.xml

@@ -751,6 +751,9 @@
             var origURIStr = safeGetProperty(targetDoc, "documentURI");
             var origURI = ioService.newURI(origURIStr, docCharset, null);
 
+            if (uri.schemeIs("javascript"))
+              return;
+
             const nsIScriptSecMan =
               Components.interfaces.nsIScriptSecurityManager;