diff --git a/modules/libjar/nsZipArchive.cpp b/modules/libjar/nsZipArchive.cpp
index b28fddc181..1ee3839baa 100644
--- a/modules/libjar/nsZipArchive.cpp
+++ b/modules/libjar/nsZipArchive.cpp
@@ -885,15 +885,22 @@ nsZipHandle* nsZipArchive::GetFD()
 uint32_t nsZipArchive::GetDataOffset(nsZipItem* aItem)
 {
   MOZ_ASSERT(aItem);
+  uint32_t offset;
 MOZ_WIN_MEM_TRY_BEGIN
   //-- read local header to get variable length values and calculate
   //-- the real data offset
   uint32_t len = mFd->mLen;
   const uint8_t* data = mFd->mFileData;
-  uint32_t offset = aItem->LocalOffset();
+  offset = aItem->LocalOffset();
   if (len < ZIPLOCAL_SIZE || offset > len - ZIPLOCAL_SIZE)
     return 0;
 
+  // Check there's enough space for the signature
+  if (offset > mFd->mLen) {
+    NS_WARNING("Corrupt local offset in JAR file");
+    return 0;
+  }
+
   // -- check signature before using the structure, in case the zip file is corrupt
   ZipLocal* Local = (ZipLocal*)(data + offset);
   if ((xtolong(Local->signature) != LOCALSIG))
@@ -906,8 +913,14 @@ MOZ_WIN_MEM_TRY_BEGIN
             xtoint(Local->filename_len) +
             xtoint(Local->extrafield_len);
 
-  return offset;
+  // Check data points inside the file.
+  if (offset > mFd->mLen) {
+    NS_WARNING("Corrupt data offset in JAR file");
+    return 0;
+  }
 MOZ_WIN_MEM_TRY_CATCH(return 0)
+  // Can't be 0
+  return offset;
 }
 
 //---------------------------------------------
diff --git a/netwerk/cookie/nsCookieService.cpp b/netwerk/cookie/nsCookieService.cpp
index 828b8920c2..2c8a5612f3 100644
--- a/netwerk/cookie/nsCookieService.cpp
+++ b/netwerk/cookie/nsCookieService.cpp
@@ -3356,25 +3356,14 @@ nsCookieService::SetCookieInternal(nsIURI                        *aHostURI,
 
   // Reject cookie if value contains an RFC 6265 disallowed character.
   // See RFC 6265 section 4.1.1
-  // XXX: For now we allow for web compatibility (see issue #357):
-  // 0x20 (Space)
-  // 0x22 (DQUOTE)
-  // 0x2C (Comma)
-  // 0x5C (Backslash)
+  // 0x09 (htab) Explicitly allowed per RFC 6265 (bis) section 5.6. Chrome erroneously rejects this.
+  // 0x3B (;) forbidden to avoid cookie-spoofing by adding a separator inside a name or value
   //
-  // FIXME: Before removing DQUOTE from the exceptions list:
-  // DQUOTE *cookie-octet DQUOTE is permitted and would fail if just removed.
-  // This needs better checking for first and last character allowing
-  // DQUOTE but not in the actual value.
-  //
-  // This only applies to cookies set via the Set-Cookie header, since
-  // document.cookie is defined to be UTF-8.
   const char illegalCharacters[] = { 
-      0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0A, 0x0B,
+      0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x0A, 0x0B,
       0x0C, 0x0D, 0x0E, 0x0F, 0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16,
-      0x17, 0x18, 0x19, 0x1A, 0x1B, 0x1C, 0x1D, 0x1E, 0x1F, /* 0x20, 0x22, */
-      /* 0x2C, */ 0x3B, /* 0x5C, */ 0x7F, 0x00 };
-  if (aFromHttp && (cookieAttributes.value.FindCharInSet(illegalCharacters, 0) != -1)) {
+      0x17, 0x18, 0x19, 0x1A, 0x1B, 0x1C, 0x1D, 0x1E, 0x1F, 0x3B, 0x7F, 0x00 };
+  if (cookieAttributes.value.FindCharInSet(illegalCharacters, 0) != -1) {
     COOKIE_LOGFAILURE(SET_COOKIE, aHostURI, savedCookieHeader, "invalid value character");
     return newCookie;
   }
diff --git a/netwerk/protocol/websocket/BaseWebSocketChannel.cpp b/netwerk/protocol/websocket/BaseWebSocketChannel.cpp
index 67a578a828..88c691cdf0 100644
--- a/netwerk/protocol/websocket/BaseWebSocketChannel.cpp
+++ b/netwerk/protocol/websocket/BaseWebSocketChannel.cpp
@@ -62,6 +62,11 @@ BaseWebSocketChannel::BaseWebSocketChannel()
   mSerial = (processBits << kWebSocketIDWebSocketBits) | webSocketBits;
 }
 
+BaseWebSocketChannel::~BaseWebSocketChannel() {
+  NS_ReleaseOnMainThread(mLoadGroup.forget());
+  NS_ReleaseOnMainThread(mLoadInfo.forget());
+}
+
 //-----------------------------------------------------------------------------
 // BaseWebSocketChannel::nsIWebSocketChannel
 //-----------------------------------------------------------------------------
diff --git a/netwerk/protocol/websocket/BaseWebSocketChannel.h b/netwerk/protocol/websocket/BaseWebSocketChannel.h
index 7498ae0bf6..154f5c80a7 100644
--- a/netwerk/protocol/websocket/BaseWebSocketChannel.h
+++ b/netwerk/protocol/websocket/BaseWebSocketChannel.h
@@ -79,6 +79,7 @@ class BaseWebSocketChannel : public nsIWebSocketChannel,
   };
 
  protected:
+  virtual ~BaseWebSocketChannel();
   nsCOMPtr<nsIURI>                mOriginalURI;
   nsCOMPtr<nsIURI>                mURI;
   RefPtr<ListenerAndContextContainer> mListenerMT;
diff --git a/netwerk/protocol/websocket/WebSocketChannel.cpp b/netwerk/protocol/websocket/WebSocketChannel.cpp
index 679252500f..058dc46417 100644
--- a/netwerk/protocol/websocket/WebSocketChannel.cpp
+++ b/netwerk/protocol/websocket/WebSocketChannel.cpp
@@ -1243,8 +1243,6 @@ WebSocketChannel::~WebSocketChannel()
 
   mListenerMT = nullptr;
 
-  NS_ReleaseOnMainThread(mLoadGroup.forget());
-  NS_ReleaseOnMainThread(mLoadInfo.forget());
   NS_ReleaseOnMainThread(mService.forget());
 }
 
diff --git a/netwerk/protocol/websocket/WebSocketChannel.h b/netwerk/protocol/websocket/WebSocketChannel.h
index 94a50fd958..bd75ca3a81 100644
--- a/netwerk/protocol/websocket/WebSocketChannel.h
+++ b/netwerk/protocol/websocket/WebSocketChannel.h
@@ -124,7 +124,7 @@ public:
   const static uint8_t kPayloadLengthBitsMask = 0x7F;
 
 protected:
-  virtual ~WebSocketChannel();
+  ~WebSocketChannel() override;
 
 private:
   friend class OutboundEnqueuer;
diff --git a/toolkit/fonts/moz.build b/toolkit/fonts/moz.build
index a2a37879d9..bfdff9e075 100644
--- a/toolkit/fonts/moz.build
+++ b/toolkit/fonts/moz.build
@@ -3,5 +3,5 @@
 # License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, You can obtain one at http://mozilla.org/MPL/2.0/.
 
-if CONFIG['OS_ARCH'] in ('WINNT', 'Linux'):
+if CONFIG['MOZ_WIDGET_TOOLKIT'] in ('windows', 'gtk2', 'gtk3'):
     FINAL_TARGET_FILES.fonts += ['TwemojiMozilla.ttf']