The attached HTML file sets location.hash to "test" on body.onload and window.onhashchange. If the path has a space in it and you set the URL to end in #, the URL will get mangled. It doesn't happen in any other situation.
1. Open the attached file. URL bar shows file:///C:/Temp/a a.html, it correctly gets changed to file:///C:/Temp/a a.html#test.
2. Open file:///C:/Temp/a a.html#foo, it correctly gets changed to file:///C:/Temp/a a.html#test
3. Open file:///C:/Temp/a a.html#, it incorrectly gets changed to file:///C:/Temp/a a.htmtestl#
4. If the file is renamed to aa.html, opening file:///C:/Temp/aa.html# makes it correctly get changed to file:///C:/Temp/aa.html#test
5. If the file is renamed to a a a.html, opening file:///C:/Temp/a a a.html# makes it incorrectly change to file:///c:/temp/a a a.htesttml#
Since adding a space made it shift left two characters and two spaces shifted it four, I'm guessing the code for the special case of "#" is taking a string index from the unescaped URL and using it to insert into an escaped URL string.
Using Firefox 4.0.1.
Created attachment 531987 [details]
jesup, I assume your recent patch fixed this, right?
Er, and ccing rjesup. See comment 2.
This is the same problem as bug 622981 - the space gets encoded causing the issue. Tried it on a trunk build (on linux though) and the problem does not appear.
*** This bug has been marked as a duplicate of bug 622981 ***