And here I am, using a forum like a bug tracker, again. In any case, I installed Flagfox into Tor in debug mode and error messages tell the story, e.g.:
[CACHE] fetched & cached favicon: "https://www.virustotal.com/favicon.ico
Blocked moz-extension://596cfc7a-0384-4468-9cb0-122d535367b8/_generated_background_page.html in page moz-extension://596cfc7a-0384-4468-9cb0-122d535367b8/_generated_background_page.html from extracting canvas data because no user input was detected. moz-extension://596cfc7a-0384-4468-9cb0-122d535367b8/cache.js:325.
So, it looks like Tor has decided to put some extra unknown security requirements in place that break everything here. I tested both with the initial prefetch and after clearing the cache and thus making the menu load do it over. Neither works, which also means that the user input detection it seems to want doesn't detect the menu API properly, somehow.
Digging deeper, it looks like this is controlled by the "privacy.resistFingerprinting" pref in "about:config". There is another pref in there explicitly for canvases, which is what it's complaining about, but toggling that does nothing helpful here, unfortunately. If you chose to disable this feature, you'll need to follow up by clearing the cached "favicons" it got from those errors, as it's returning placeholder transparent icons instead of breaking completely, it seems. You can do this via the browser preferences (either from menu, or "about:preferences"), under the Privacy & Security tab, in the second section, on the right side, is a Clear History button. You'll want to clear cookies OR offline website data to make things take effect (strangely, either works here, because localStorage is considered sorta both). You'll probably want to have only one of those checked and the timeframe set to everything. Do that, with this Tor feature disabled, and the icons can show in the Flagfox options page with a refresh. The menu will only update if it's the first time this session or you change it, which you can do by just toggling any action on/off with its checkbox, to force menu regen on next open. After this, so long as the option is off, it should work the same as it does in normal Firefox. All that said
, I'm not sure I'd recommend you do this unless you understand what you're disabling. Without getting into too much detail, they've come up with a system to protect users from a way of tracking people by abusing a certain feature in a weird way, and this is collateral damage. Everything else should work without the icons, so you can just turn them off and live in a more grey world, but it will all work.
I don't know if there's any simple way to work around this Tor limitation, but I'll look into it at some point. I do not suspect it'd be easy, however. No promises there, but at least we know what's going on now. In the pantheon of my never-ending Flagfox todo list, reintroducing an in-addon help page is much higher on that list than getting favicons to work in a secondary supported web browser.