--- a/layout/style/nsCSSValue.cpp
+++ b/layout/style/nsCSSValue.cpp
@@ -23,16 +23,32 @@
 #include "nsNetUtil.h"
 #include "nsPresContext.h"
 #include "nsStyleUtil.h"
 #include "nsDeviceContext.h"
 #include "nsStyleSet.h"
 
 using namespace mozilla;
 
+static bool
+IsLocalRefURL(nsStringBuffer* aString)
+{
+  // Find the first non-"C0 controls + space" character.
+  char16_t* current = static_cast<char16_t*>(aString->Data());
+  for (; *current != '\0'; current++) {
+    if (*current > 0x20) {
+      // if the first non-"C0 controls + space" character is '#', this is a
+      // local-ref URL.
+      return *current == '#';
+    }
+  }
+
+  return false;
+}
+
 nsCSSValue::nsCSSValue(int32_t aValue, nsCSSUnit aUnit)
   : mUnit(aUnit)
 {
   MOZ_ASSERT(aUnit == eCSSUnit_Integer || aUnit == eCSSUnit_Enumerated ||
              aUnit == eCSSUnit_EnumColor,
              "not an int value");
   if (aUnit == eCSSUnit_Integer || aUnit == eCSSUnit_Enumerated ||
       aUnit == eCSSUnit_EnumColor) {
@@ -2513,30 +2529,32 @@ css::URLValueData::URLValueData(already_
                                 already_AddRefed<PtrHolder<nsIURI>> aReferrer,
                                 already_AddRefed<PtrHolder<nsIPrincipal>>
                                   aOriginPrincipal)
   : mURI(Move(aURI))
   , mString(aString)
   , mReferrer(Move(aReferrer))
   , mOriginPrincipal(Move(aOriginPrincipal))
   , mURIResolved(true)
+  , mLocalURLFlag(IsLocalRefURL(aString))
 {
   MOZ_ASSERT(mOriginPrincipal, "Must have an origin principal");
 }
 
 css::URLValueData::URLValueData(nsStringBuffer* aString,
                                 already_AddRefed<PtrHolder<nsIURI>> aBaseURI,
                                 already_AddRefed<PtrHolder<nsIURI>> aReferrer,
                                 already_AddRefed<PtrHolder<nsIPrincipal>>
                                   aOriginPrincipal)
   : mURI(Move(aBaseURI))
   , mString(aString)
   , mReferrer(Move(aReferrer))
   , mOriginPrincipal(Move(aOriginPrincipal))
   , mURIResolved(false)
+  , mLocalURLFlag(IsLocalRefURL(aString))
 {
   MOZ_ASSERT(mOriginPrincipal, "Must have an origin principal");
 }
 
 bool
 css::URLValueData::operator==(const URLValueData& aOther) const
 {
   bool eq;

--- a/layout/style/nsCSSValue.h
+++ b/layout/style/nsCSSValue.h
@@ -116,27 +116,32 @@ struct URLValueData
   // mURI member of both URL objects is non-null.  Do NOT call this method
   // unless you're sure this is the case.
   bool URIEquals(const URLValueData& aOther) const;
 
   nsIURI* GetURI() const;
 
   size_t SizeOfExcludingThis(mozilla::MallocSizeOf aMallocSizeOf) const;
 
+  bool GetLocalURLFlag() const { return mLocalURLFlag; }
+
 private:
   // If mURIResolved is false, mURI stores the base URI.
   // If mURIResolved is true, mURI stores the URI we resolve to; this may be
   // null if the URI is invalid.
   mutable PtrHandle<nsIURI> mURI;
 public:
   RefPtr<nsStringBuffer> mString;
   PtrHandle<nsIURI> mReferrer;
   PtrHandle<nsIPrincipal> mOriginPrincipal;
 private:
   mutable bool mURIResolved;
+  // mLocalURLFlag is set when url starts with a U+0023 number
+  // sign(#) character.
+  bool mLocalURLFlag;
 
   URLValueData(const URLValueData& aOther) = delete;
   URLValueData& operator=(const URLValueData& aOther) = delete;
 };
 
 struct URLValue : public URLValueData
 {
   // These two constructors are safe to call only on the main thread.