Bug 1251229 P1 Strip fragment from request URL when creating FetchEvent. r=ehsan

dom/fetch/InternalRequest.h

@@ -141,6 +141,12 @@ public:
     , mUnsafeRequest(false)
     , mUseURLCredentials(false)
   {
+    // Normally we strip the fragment from the URL in Request::Constructor.
+    // If internal code is directly constructing this object they must
+    // strip the fragment first.  Since these should be well formed URLs we
+    // can use a simple check for a fragment here.  The full parser is
+    // difficult to use off the main thread.
+    MOZ_ASSERT(mURL.Find(NS_LITERAL_CSTRING("#")) == kNotFound);
   }
 
   already_AddRefed<InternalRequest> Clone();

dom/workers/ServiceWorkerPrivate.cpp

@@ -1044,7 +1044,15 @@ public:
     rv = mInterceptedChannel->GetSecureUpgradedChannelURI(getter_AddRefs(uri));
     NS_ENSURE_SUCCESS(rv, rv);
 
-    rv = uri->GetSpec(mSpec);
+    // Normally we rely on the Request constructor to strip the fragment, but
+    // when creating the FetchEvent we bypass the constructor.  So strip the
+    // fragment manually here instead.  We can't do it later when we create
+    // the Request because that code executes off the main thread.
+    nsCOMPtr<nsIURI> uriNoFragment;
+    rv = uri->CloneIgnoringRef(getter_AddRefs(uriNoFragment));
+    NS_ENSURE_SUCCESS(rv, rv);
+
+    rv = uriNoFragment->GetSpec(mSpec);
     NS_ENSURE_SUCCESS(rv, rv);
 
     uint32_t loadFlags;