Fixed some minor issues in scratchpad and gcli devtools.

Fixed an error initializing the browser due to trying to restore scratchpad data from a stored session when having switched from a version with devtools to a version without devtools, and the previous version had scratchpad data saved.

Fixed the occurrence of 'null' titles in bookmarks dragged from special folders.

Slightly changed the address bar shading on secure sites to be more subtle and easily-blended.

This is a minor bugfix and security release.

(CVE-2016-5254) Heap-use-after-free in nsXULPopupManager::KeyDown.

Fixed potentially exploitable crash caused by badly formatted ICO files.

Fixed potentially exploitable crash in the array splice implementation.

(CVE-2016-5266) Outgoing dataTransfer items are not properly filtered.

(CVE-2016-5251)Potential URL spoofing in the address bar.

Linux: Improved optimization and GCC6 compatibility (Note: compiling with GCC 6 is still not recommended and it may or may not work, depending on your environment).

Download= properties of links are now honored from the context menu 'Save' option.

Added a blocking rule for F-Secure's 64-bit deepguard library to prevent crashes.

Updated the graphite font library to 1.3.9.Fixed the calculation of standalone SVG embeds width and height, which should solve some reported issues with html5 graphs being displayed incorrectly.contains() function is retained for compatibility with web and extension scripts that adhere to the ES6 pre-release specification up to and including RC3.

contains() function for checking if a string contains another string. includes() function in addition to the pre-existing.

This should make a number of websites happy. Fixed the URL API to allow 'stringification' of the object per specification.If desired, you can manually install it (or other search engines) after the update by following the steps in the Manage Search Enginestopic. Removed Google Search as a bundled search provider.

Pale moon portable