Don't allow javascript: favicons. b=290036 r=dveditz sr=brendan a=chase

suite/browser/tabbrowser.xml

@@ -697,6 +697,9 @@
             var origURIStr = safeGetProperty(targetDoc, "documentURI");
             var origURI = ioService.newURI(origURIStr, docCharset, null);
 
+            if (uri.schemeIs("javascript"))
+              return;
+
             const nsIScriptSecMan =
               Components.interfaces.nsIScriptSecurityManager;