Tweak the injection logic to work around bugs.

1) Attach event listener to content windows (not appcontent element), so location.replace('#anything') works.
2) Also attach a load (as well as DOMContentLoaded) listener, for non-DOM loads like images.

Fixes #1584
Refs #1675

components/greasemonkey.js

@@ -423,6 +423,10 @@ service.prototype.observe = function(aSubject, aTopic, aData) {
       if (!GM_util.isGreasemonkeyable(doc.location.href)) break;
       var win = doc.defaultView;
       this.runScripts('document-start', win);
+      win.addEventListener(
+          'DOMContentLoaded', GM_util.hitch(this, this.contentLoad), true);
+      win.addEventListener(
+          'load', GM_util.hitch(this, this.contentLoad), true);
       break;
   }
 };
@@ -460,6 +464,33 @@ service.prototype.contentFrozen = function(contentWindowId) {
       function(index, command) { command.frozen = true; });
 };
 
+service.prototype.contentLoad = function(event) {
+  event.target.removeEventListener(event.type, arguments.callee, true);
+
+  if (!GM_util.getEnabled()) return;
+
+  var safeWin = event.target.defaultView;
+  var href = safeWin.location.href;
+
+  // Make sure we are still on the page that fired this event, see issue #1083.
+  // But ignore differences in formats; see issue #1445 and #1631.
+  var comparisonHref = href.replace(/#.*/, '');
+  var comparsionUri = event.target.documentURI
+      .replace(/#.*/, '')
+      .replace(/\/\/[^\/:]+:[^\/@]+@/, '//');
+  if (comparisonHref == comparsionUri) {
+    // Via an expando property on the *safe* window object (our wrapper of the
+    // real window, not the wrapper that content sees), record a property to
+    // note we've done injection into this window.  If we get a "load" after
+    // "DOMContentLoaded" then we won't run twice.  But if we never get
+    // "DOMContentLoaded" (i.e. for images) then we run at "load" time.
+    if (safeWin._greasemonkey_has_run_document_end) return;
+
+    safeWin._greasemonkey_has_run_document_end = true;
+    this.runScripts('document-end', safeWin);
+  }
+};
+
 service.prototype.contentThawed = function(contentWindowId) {
   if (!contentWindowId) return;
   this.withAllMenuCommandsForWindowId(contentWindowId,

content/browser.js

@@ -39,14 +39,13 @@ GM_BrowserUI.chromeLoad = function(e) {
   GM_prefRoot.watch("enabled", GM_BrowserUI.refreshStatus);
   GM_BrowserUI.refreshStatus();
 
-  // Use the appcontent element specifically, see #1344.
-  document.getElementById("appcontent")
-      .addEventListener("DOMContentLoaded", GM_BrowserUI.contentLoad, true);
   gBrowser.addEventListener("pagehide", GM_BrowserUI.pagehide, true);
   gBrowser.addEventListener("pageshow", GM_BrowserUI.pageshow, true);
 
   var sidebar = document.getElementById("sidebar");
-  sidebar.addEventListener("DOMContentLoaded", GM_BrowserUI.contentLoad, true);
+  var svc = GM_util.getService();
+  sidebar.addEventListener(
+      "DOMContentLoaded", GM_util.hitch(svc, svc.contentLoad), true);
   sidebar.addEventListener("pagehide", GM_BrowserUI.pagehide, true);
   sidebar.addEventListener("pageshow", GM_BrowserUI.pageshow, true);
 
@@ -74,23 +73,6 @@ GM_BrowserUI.chromeLoad = function(e) {
   Components.utils.import('resource://greasemonkey/stats.js');
 };
 
-GM_BrowserUI.contentLoad = function(event) {
-  if (!GM_util.getEnabled()) return;
-
-  var safeWin = event.target.defaultView;
-  var href = safeWin.location.href;
-
-  // Make sure we are still on the page that fired this event, see issue #1083.
-  // But ignore differences in formats; see issue #1445 and #1631.
-  var comparisonHref = href.replace(/#.*/, '');
-  var comparsionUri = event.target.documentURI
-      .replace(/#.*/, '')
-      .replace(/\/\/[^\/:]+:[^\/@]+@/, '//');
-  if (comparisonHref == comparsionUri) {
-    GM_BrowserUI.gmSvc.runScripts('document-end', safeWin);
-  }
-};
-
 GM_BrowserUI.pagehide = function(aEvent) {
   var windowId = GM_util.windowIdForEvent(aEvent);
   if (aEvent.persisted) {