Jed Davis suggested in bug 1308400: "It occurs to me that we don't need to let the client normalize the path in the first place — we can return `EINVAL` (not a symlink) instead. The question then is whether there are any cases where we still need to do an actual `readlink`, given that we can `realpath` on the server side if we need to." There's a few tricks here, and bug 1290896 might come back to us, but it's worth a shot.

As soon as stat() lies about the existence of symlinks, some tests like dom/xhr/tests/browser_blobFromFile.js start failing. It's not very clear to me why that is the case because there's no clear error - the test just times out.