diff --git a/dom/cache/StreamControl.cpp b/dom/cache/StreamControl.cpp
index aab1766662..69a72d0b61 100644
--- a/dom/cache/StreamControl.cpp
+++ b/dom/cache/StreamControl.cpp
@@ -68,7 +68,8 @@ StreamControl::CloseAllReadStreams()
 {
   AssertOwningThread();
 
-  ReadStreamList::ForwardIterator iter(mReadStreamList);
+  auto readStreamList = mReadStreamList;
+  ReadStreamList::ForwardIterator iter(readStreamList);
   while (iter.HasMore()) {
     iter.GetNext()->CloseStream();
   }
diff --git a/extensions/auth/nsHttpNegotiateAuth.cpp b/extensions/auth/nsHttpNegotiateAuth.cpp
index adea54b850..8b6be915e9 100644
--- a/extensions/auth/nsHttpNegotiateAuth.cpp
+++ b/extensions/auth/nsHttpNegotiateAuth.cpp
@@ -530,8 +530,11 @@ nsHttpNegotiateAuth::GenerateCredentials(nsIHttpAuthenticableChannel *authChanne
             challenge++;
         len = strlen(challenge);
 
+        if (!len)
+            return NS_ERROR_UNEXPECTED;
+
         // strip off any padding (see bug 230351)
-        while (challenge[len - 1] == '=')
+        while (len && challenge[len - 1] == '=')
             len--;
 
         //
diff --git a/js/public/RootingAPI.h b/js/public/RootingAPI.h
index 9f6ed89433..ca35ea4a5c 100644
--- a/js/public/RootingAPI.h
+++ b/js/public/RootingAPI.h
@@ -274,6 +274,12 @@ class MOZ_NON_MEMMOVABLE Heap : public js::HeapBase<T>
 
     T* unsafeGet() { return &ptr; }
 
+    void set(const T& newPtr) {
+        T tmp = ptr;
+        ptr = newPtr;
+        post(tmp, ptr);
+    }
+
     explicit operator bool() const {
         return bool(js::BarrierMethods<T>::asGCThingOrNull(ptr));
     }
@@ -287,12 +293,6 @@ class MOZ_NON_MEMMOVABLE Heap : public js::HeapBase<T>
         post(GCPolicy<T>::initial(), ptr);
     }
 
-    void set(const T& newPtr) {
-        T tmp = ptr;
-        ptr = newPtr;
-        post(tmp, ptr);
-    }
-
     void post(const T& prev, const T& next) {
         js::BarrierMethods<T>::postBarrier(&ptr, prev, next);
     }
@@ -1172,13 +1172,13 @@ class PersistentRooted : public js::PersistentRootedBase<T>,
         return ptr;
     }
 
-  private:
     template <typename U>
     void set(U&& value) {
         MOZ_ASSERT(initialized());
         ptr = mozilla::Forward<U>(value);
     }
 
+  private:
     // See the comment above Rooted::ptr.
     using MaybeWrapped = typename mozilla::Conditional<
         MapTypeToRootKind<T>::kind == JS::RootKind::Traceable,
diff --git a/js/public/Value.h b/js/public/Value.h
index 7c4f833e3d..272d9b478d 100644
--- a/js/public/Value.h
+++ b/js/public/Value.h
@@ -399,25 +399,21 @@ class MOZ_NON_PARAM alignas(8) Value
         data.asBits = bitsFromTagAndPayload(JSVAL_TAG_MAGIC, payload);
     }
 
-    bool setNumber(uint32_t ui) {
+    void setNumber(uint32_t ui) {
         if (ui > JSVAL_INT_MAX) {
             setDouble((double)ui);
-            return false;
         } else {
             setInt32((int32_t)ui);
-            return true;
         }
     }
 
-    bool setNumber(double d) {
+    void setNumber(double d) {
         int32_t i;
         if (mozilla::NumberIsInt32(d, &i)) {
             setInt32(i);
-            return true;
+        } else {
+            setDouble(d);
         }
-
-        setDouble(d);
-        return false;
     }
 
     void setObjectOrNull(JSObject* arg) {
@@ -1406,25 +1402,29 @@ class ValueOperations
 template <class Outer>
 class MutableValueOperations : public ValueOperations<Outer>
 {
-    JS::Value& value() { return static_cast<Outer*>(this)->get(); }
+  protected:
+    void set(const JS::Value& v) {
+      // Call Outer::set to trigger any barriers.
+      static_cast<Outer*>(this)->set(v);
+    }
 
   public:
-    void setNull() { value().setNull(); }
-    void setUndefined() { value().setUndefined(); }
-    void setInt32(int32_t i) { value().setInt32(i); }
-    void setDouble(double d) { value().setDouble(d); }
+    void setNull() { set(JS::NullValue()); }
+    void setUndefined() { set(JS::UndefinedValue()); }
+    void setInt32(int32_t i) { set(JS::Int32Value(i)); }
+    void setDouble(double d) { set(JS::DoubleValue(d)); }
     void setNaN() { setDouble(JS::GenericNaN()); }
-    void setBoolean(bool b) { value().setBoolean(b); }
-    void setMagic(JSWhyMagic why) { value().setMagic(why); }
-    bool setNumber(uint32_t ui) { return value().setNumber(ui); }
-    bool setNumber(double d) { return value().setNumber(d); }
-    void setString(JSString* str) { this->value().setString(str); }
-    void setSymbol(JS::Symbol* sym) { this->value().setSymbol(sym); }
-    void setObject(JSObject& obj) { this->value().setObject(obj); }
-    void setObjectOrNull(JSObject* arg) { this->value().setObjectOrNull(arg); }
-    void setPrivate(void* ptr) { this->value().setPrivate(ptr); }
-    void setPrivateUint32(uint32_t ui) { this->value().setPrivateUint32(ui); }
-    void setPrivateGCThing(js::gc::Cell* cell) { this->value().setPrivateGCThing(cell); }
+    void setBoolean(bool b) { set(JS::BooleanValue(b)); }
+    void setMagic(JSWhyMagic why) { set(JS::MagicValue(why)); }
+    void setNumber(uint32_t ui) { set(JS::NumberValue(ui)); }
+    void setNumber(double d) { set(JS::NumberValue(d)); }
+    void setString(JSString* str) { set(JS::StringValue(str)); }
+    void setSymbol(JS::Symbol* sym) { set(JS::SymbolValue(sym)); }
+    void setObject(JSObject& obj) { set(JS::ObjectValue(obj)); }
+    void setObjectOrNull(JSObject* arg) { set(JS::ObjectOrNullValue(arg)); }
+    void setPrivate(void* ptr) { set(JS::PrivateValue(ptr)); }
+    void setPrivateUint32(uint32_t ui) { set(JS::PrivateUint32Value(ui)); }
+    void setPrivateGCThing(js::gc::Cell* cell) { set(JS::PrivateGCThingValue(cell)); }
 };
 
 /*
@@ -1432,55 +1432,28 @@ class MutableValueOperations : public ValueOperations<Outer>
  * type-querying, value-extracting, and mutating operations.
  */
 template <>
-class HeapBase<JS::Value> : public ValueOperations<JS::Heap<JS::Value> >
+class HeapBase<JS::Value> : public MutableValueOperations<JS::Heap<JS::Value> >
 {
     typedef JS::Heap<JS::Value> Outer;
 
     friend class ValueOperations<Outer>;
 
-    void setBarriered(const JS::Value& v) {
-        *static_cast<JS::Heap<JS::Value>*>(this) = v;
-    }
-
   public:
-    void setNull() { setBarriered(JS::NullValue()); }
-    void setUndefined() { setBarriered(JS::UndefinedValue()); }
-    void setInt32(int32_t i) { setBarriered(JS::Int32Value(i)); }
-    void setDouble(double d) { setBarriered(JS::DoubleValue(d)); }
-    void setNaN() { setDouble(JS::GenericNaN()); }
-    void setBoolean(bool b) { setBarriered(JS::BooleanValue(b)); }
-    void setMagic(JSWhyMagic why) { setBarriered(JS::MagicValue(why)); }
-    void setString(JSString* str) { setBarriered(JS::StringValue(str)); }
-    void setSymbol(JS::Symbol* sym) { setBarriered(JS::SymbolValue(sym)); }
-    void setObject(JSObject& obj) { setBarriered(JS::ObjectValue(obj)); }
-    void setPrivateGCThing(js::gc::Cell* cell) { setBarriered(JS::PrivateGCThingValue(cell)); }
-
-    bool setNumber(uint32_t ui) {
+    void setNumber(uint32_t ui) {
         if (ui > JSVAL_INT_MAX) {
-            setDouble((double)ui);
-            return false;
+            this->setDouble((double)ui);
         } else {
-            setInt32((int32_t)ui);
-            return true;
+            this->setInt32((int32_t)ui);
         }
     }
 
-    bool setNumber(double d) {
+    void setNumber(double d) {
         int32_t i;
         if (mozilla::NumberIsInt32(d, &i)) {
-            setInt32(i);
-            return true;
+            this->setInt32(i);
+        } else {
+            this->setDouble(d);
         }
-
-        setDouble(d);
-        return false;
-    }
-
-    void setObjectOrNull(JSObject* arg) {
-        if (arg)
-            setObject(*arg);
-        else
-            setNull();
     }
 };
 
diff --git a/netwerk/protocol/http/nsHttpNTLMAuth.cpp b/netwerk/protocol/http/nsHttpNTLMAuth.cpp
index aa5b1f8f7e..86bfcf4d13 100644
--- a/netwerk/protocol/http/nsHttpNTLMAuth.cpp
+++ b/netwerk/protocol/http/nsHttpNTLMAuth.cpp
@@ -486,8 +486,8 @@ nsHttpNTLMAuth::GenerateCredentials(nsIHttpAuthenticableChannel *authChannel,
         len -= 5;
 
         // strip off any padding (see bug 230351)
-        while (challenge[len - 1] == '=')
-          len--;
+        while (len && challenge[len - 1] == '=')
+            len--;
 
         // decode into the input secbuffer
         rv = Base64Decode(challenge, len, (char**)&inBuf, &inBufLen);
diff --git a/security/manager/ssl/TransportSecurityInfo.cpp b/security/manager/ssl/TransportSecurityInfo.cpp
index 3c7023302b..3f4bf4a904 100644
--- a/security/manager/ssl/TransportSecurityInfo.cpp
+++ b/security/manager/ssl/TransportSecurityInfo.cpp
@@ -8,6 +8,7 @@
 
 #include "PSMRunnable.h"
 #include "mozilla/Casting.h"
+#include "mozilla/net/DNS.h"
 #include "nsComponentManagerUtils.h"
 #include "nsIArray.h"
 #include "nsICertOverrideService.h"
@@ -681,8 +682,10 @@ GetSubjectAltNames(CERTCertificate* nssCert, nsString& allNames)
 
       case certIPAddress:
         {
-          char buf[INET6_ADDRSTRLEN];
+          // According to DNS.h, this includes space for the null-terminator
+          char buf[net::kNetAddrMaxCStrBufSize] = {0};
           PRNetAddr addr;
+          memset(&addr, 0, sizeof(addr));
           if (current->name.other.len == 4) {
             addr.inet.family = PR_AF_INET;
             memcpy(&addr.inet.ip, current->name.other.data, current->name.other.len);
diff --git a/security/manager/ssl/nsNSSCertHelper.cpp b/security/manager/ssl/nsNSSCertHelper.cpp
index 64c87ad2f9..efcb8747a3 100644
--- a/security/manager/ssl/nsNSSCertHelper.cpp
+++ b/security/manager/ssl/nsNSSCertHelper.cpp
@@ -11,6 +11,7 @@
 #include "mozilla/NotNull.h"
 #include "mozilla/Sprintf.h"
 #include "mozilla/UniquePtr.h"
+#include "mozilla/net/DNS.h"
 #include "nsCOMPtr.h"
 #include "nsComponentManagerUtils.h"
 #include "nsDateTimeFormatCID.h"
@@ -1006,8 +1007,9 @@ ProcessGeneralName(const UniquePLArenaPool& arena, CERTGeneralName* current,
     break;
   case certIPAddress:
     {
-      char buf[INET6_ADDRSTRLEN];
       PRStatus status = PR_FAILURE;
+      // According to DNS.h, this includes space for the null-terminator
+      char buf[net::kNetAddrMaxCStrBufSize] = {0};
       PRNetAddr addr;
       memset(&addr, 0, sizeof(addr));
       nssComponent->GetPIPNSSBundleString("CertDumpIPAddress", key);