diff --git a/image/decoders/nsJPEGDecoder.cpp b/image/decoders/nsJPEGDecoder.cpp
index 7fc749890f..1ac25fc6e2 100644
--- a/image/decoders/nsJPEGDecoder.cpp
+++ b/image/decoders/nsJPEGDecoder.cpp
@@ -154,6 +154,10 @@ nsJPEGDecoder::InitInternal()
   mSourceMgr.skip_input_data = skip_input_data;
   mSourceMgr.resync_to_restart = jpeg_resync_to_restart;
   mSourceMgr.term_source = term_source;
+  
+  // Limit the maximum allocation to the maximum our surface cache can hold.
+  mInfo.mem->max_memory_to_use = static_cast<long>(
+      std::min<size_t>(SurfaceCache::MaximumCapacity(), LONG_MAX));
 
   // Record app markers for ICC data
   for (uint32_t m = 0; m < 16; m++) {
diff --git a/modules/libpref/init/all.js b/modules/libpref/init/all.js
index 1a3b2f324c..31f0411f72 100644
--- a/modules/libpref/init/all.js
+++ b/modules/libpref/init/all.js
@@ -1398,6 +1398,8 @@ pref("network.protocol-handler.external.shell", false);
 pref("network.protocol-handler.external.vbscript", false);
 pref("network.protocol-handler.external.vnd.ms.radio", false);
 #ifdef XP_WIN
+pref("network.protocol-handler.external.ms-cxh", false);
+pref("network.protocol-handler.external.ms-cxh-full", false);
 pref("network.protocol-handler.external.ms-help", false);
 pref("network.protocol-handler.external.ms-msdt", false);
 pref("network.protocol-handler.external.search", false);
diff --git a/mozglue/build/WindowsDllBlocklist.cpp b/mozglue/build/WindowsDllBlocklist.cpp
index 859114321c..4eafc27c32 100644
--- a/mozglue/build/WindowsDllBlocklist.cpp
+++ b/mozglue/build/WindowsDllBlocklist.cpp
@@ -201,9 +201,11 @@ static DllBlockInfo sWindowsDllBlocklist[] = {
   // ESET, bug 1229252
   { "eoppmonitor.dll", ALL_VERSIONS },
 
-  // SS2OSD, bug 1262348
+  // SS2OSD, Sonic Studio, bugs 1262348, 1540883
   { "ss2osd.dll", ALL_VERSIONS },
+  { "ss3osd.dll", ALL_VERSIONS }, 
   { "ss2devprops.dll", ALL_VERSIONS },
+  { "ss3devprops.dll", ALL_VERSIONS },
 
   // NHASUSSTRIXOSD.DLL, bug 1269244
   { "nhasusstrixosd.dll", ALL_VERSIONS },
diff --git a/widget/windows/nsDataObj.cpp b/widget/windows/nsDataObj.cpp
index 7d46551fca..f47052cd47 100644
--- a/widget/windows/nsDataObj.cpp
+++ b/widget/windows/nsDataObj.cpp
@@ -121,25 +121,48 @@ nsDataObj::CStream::OnDataAvailable(nsIRequest *aRequest,
                                     uint64_t aOffset, // offset within the stream
                                     uint32_t aCount) // bytes available on this call
 {
-    // Extend the write buffer for the incoming data.
-    uint8_t* buffer = mChannelData.AppendElements(aCount, fallible);
-    if (!buffer) {
-      return NS_ERROR_OUT_OF_MEMORY;
-    }
-    NS_ASSERTION((mChannelData.Length() == (aOffset + aCount)),
-      "stream length mismatch w/write buffer");
-
-    // Read() may not return aCount on a single call, so loop until we've
-    // accumulated all the data OnDataAvailable has promised.
-    nsresult rv;
-    uint32_t odaBytesReadTotal = 0;
-    do {
-      uint32_t bytesReadByCall = 0;
-      rv = aInputStream->Read((char*)(buffer + odaBytesReadTotal),
-                              aCount, &bytesReadByCall);
-      odaBytesReadTotal += bytesReadByCall;
-    } while (aCount < odaBytesReadTotal && NS_SUCCEEDED(rv));
+  // If we've been asked to read zero bytes, call `Read` once, just to ensure
+  // any side-effects take place, and return immediately.
+  if (aCount == 0) {
+    char buffer[1] = {0};
+    uint32_t bytesReadByCall = 0;
+    nsresult rv = aInputStream->Read(buffer, 0, &bytesReadByCall);
+    MOZ_ASSERT(bytesReadByCall == 0);
     return rv;
+  }
+
+  // Extend the write buffer for the incoming data.
+  size_t oldLength = mChannelData.Length();
+  char* buffer = reinterpret_cast<char*>(mChannelData.AppendElements(aCount, fallible));
+  if (!buffer) {
+    return NS_ERROR_OUT_OF_MEMORY;
+  }
+  MOZ_ASSERT(mChannelData.Length() == (aOffset + aCount),
+             "stream length mismatch w/write buffer");
+
+  // Read() may not return aCount on a single call, so loop until we've
+  // accumulated all the data OnDataAvailable has promised.
+  uint32_t bytesRead = 0;
+  while (bytesRead < aCount) {
+    uint32_t bytesReadByCall = 0;
+    nsresult rv = aInputStream->Read(buffer + bytesRead, aCount - bytesRead,
+                                     &bytesReadByCall);
+    bytesRead += bytesReadByCall;
+
+    if (bytesReadByCall == 0) {
+      // A `bytesReadByCall` of zero indicates EOF without failure... but we
+      // were promised `aCount` elements and haven't gotten them. Return a
+      // generic failure.
+      rv = NS_ERROR_FAILURE;
+    }
+
+    if (NS_FAILED(rv)) {
+      // Drop any trailing uninitialized elements before erroring out.
+      mChannelData.RemoveElementsAt(oldLength + bytesRead, aCount - bytesRead);
+      return rv;
+    }
+  }
+  return NS_OK;
 }
 
 NS_IMETHODIMP nsDataObj::CStream::OnStartRequest(nsIRequest *aRequest,