diff --git a/dom/base/nsDocument.cpp b/dom/base/nsDocument.cpp
index 26c1025646..09146b2fe2 100644
--- a/dom/base/nsDocument.cpp
+++ b/dom/base/nsDocument.cpp
@@ -995,7 +995,8 @@ nsExternalResourceMap::PendingLoad::OnDataAvailable(nsIRequest* aRequest,
                                                     uint64_t aOffset,
                                                     uint32_t aCount)
 {
-  NS_PRECONDITION(mTargetListener, "Shouldn't be getting called!");
+  // mTargetListener might be null if SetupViewer or AddExternalResource failed.
+  NS_ENSURE_TRUE(mTargetListener, NS_ERROR_FAILURE);
   if (mDisplayDocument->ExternalResourceMap().HaveShutDown()) {
     return NS_BINDING_ABORTED;
   }
diff --git a/js/src/jit/MIR.h b/js/src/jit/MIR.h
index 62f49c8bad..a6b0b169af 100644
--- a/js/src/jit/MIR.h
+++ b/js/src/jit/MIR.h
@@ -7064,10 +7064,8 @@ class MRegExpMatcher
     TRIVIAL_NEW_WRAPPERS
     NAMED_OPERANDS((0, regexp), (1, string), (2, lastIndex))
 
-    MOZ_MUST_USE bool writeRecoverData(CompactBufferWriter& writer) const override;
-
     bool canRecoverOnBailout() const override {
-        return true;
+        return false;
     }
 
     bool possiblyCalls() const override {
@@ -7102,7 +7100,7 @@ class MRegExpSearcher
     MOZ_MUST_USE bool writeRecoverData(CompactBufferWriter& writer) const override;
 
     bool canRecoverOnBailout() const override {
-        return true;
+        return false;
     }
 
     bool possiblyCalls() const override {
diff --git a/js/src/jit/Recover.cpp b/js/src/jit/Recover.cpp
index 4d04c653be..6144462b4d 100644
--- a/js/src/jit/Recover.cpp
+++ b/js/src/jit/Recover.cpp
@@ -13,7 +13,6 @@
 #include "jsobj.h"
 #include "jsstr.h"
 
-#include "builtin/RegExp.h"
 #include "builtin/TypedObject.h"
 
 #include "gc/Heap.h"
@@ -1082,32 +1081,6 @@ RNaNToZero::recover(JSContext* cx, SnapshotIterator& iter) const
     return true;
 }
 
-bool
-MRegExpMatcher::writeRecoverData(CompactBufferWriter& writer) const
-{
-    MOZ_ASSERT(canRecoverOnBailout());
-    writer.writeUnsigned(uint32_t(RInstruction::Recover_RegExpMatcher));
-    return true;
-}
-
-RRegExpMatcher::RRegExpMatcher(CompactBufferReader& reader)
-{}
-
-bool
-RRegExpMatcher::recover(JSContext* cx, SnapshotIterator& iter) const
-{
-    RootedObject regexp(cx, &iter.read().toObject());
-    RootedString input(cx, iter.read().toString());
-    int32_t lastIndex = iter.read().toInt32();
-
-    RootedValue result(cx);
-    if (!RegExpMatcherRaw(cx, regexp, input, lastIndex, nullptr, &result))
-        return false;
-
-    iter.storeInstructionResult(result);
-    return true;
-}
-
 bool
 MRegExpSearcher::writeRecoverData(CompactBufferWriter& writer) const
 {
diff --git a/js/src/jit/Recover.h b/js/src/jit/Recover.h
index 1f58e6b06b..78776178b6 100644
--- a/js/src/jit/Recover.h
+++ b/js/src/jit/Recover.h
@@ -90,7 +90,6 @@ namespace jit {
     _(Random)                                   \
     _(StringSplit)                              \
     _(NaNToZero)                                \
-    _(RegExpMatcher)                            \
     _(RegExpSearcher)                           \
     _(RegExpTester)                             \
     _(StringReplace)                            \
@@ -486,14 +485,6 @@ class RNaNToZero final : public RInstruction
     bool recover(JSContext* cx, SnapshotIterator& iter) const;
 };
 
-class RRegExpMatcher final : public RInstruction
-{
-  public:
-    RINSTRUCTION_HEADER_NUM_OP_(RegExpMatcher, 3)
-
-    MOZ_MUST_USE bool recover(JSContext* cx, SnapshotIterator& iter) const;
-};
-
 class RRegExpSearcher final : public RInstruction
 {
   public:
diff --git a/js/src/wasm/WasmIonCompile.cpp b/js/src/wasm/WasmIonCompile.cpp
index f443c05cc1..34ea7a22ba 100644
--- a/js/src/wasm/WasmIonCompile.cpp
+++ b/js/src/wasm/WasmIonCompile.cpp
@@ -158,8 +158,6 @@ class FunctionCompiler
     const CompileInfo&         info_;
     MIRGenerator&              mirGen_;
 
-    MInstruction*              dummyIns_;
-
     MBasicBlock*               curBlock_;
     CallCompileStateVector     callStack_;
     uint32_t                   maxStackArgBytes_;
@@ -189,7 +187,6 @@ class FunctionCompiler
         graph_(mirGen.graph()),
         info_(mirGen.info()),
         mirGen_(mirGen),
-        dummyIns_(nullptr),
         curBlock_(nullptr),
         maxStackArgBytes_(0),
         loopDepth_(0),
@@ -259,9 +256,6 @@ class FunctionCompiler
                 return false;
         }
 
-        dummyIns_ = MConstant::New(alloc(), Int32Value(0), MIRType::Int32);
-        curBlock_->add(dummyIns_);
-
         addInterruptCheck();
 
         return true;
@@ -977,45 +971,13 @@ class FunctionCompiler
             curBlock_->push(def);
     }
 
-    MDefinition* popDefIfPushed(bool shouldReturn = true)
+    MDefinition* popDefIfPushed()
     {
         if (!hasPushed(curBlock_))
             return nullptr;
         MDefinition* def = curBlock_->pop();
-        MOZ_ASSERT_IF(def->type() == MIRType::Value, !shouldReturn);
-        return shouldReturn ? def : nullptr;
-    }
-
-    template <typename GetBlock>
-    bool ensurePushInvariants(const GetBlock& getBlock, size_t numBlocks)
-    {
-        // Preserve the invariant that, for every iterated MBasicBlock, either:
-        // every MBasicBlock has a pushed expression with the same type (to
-        // prevent creating used phis with type Value) OR no MBasicBlock has any
-        // pushed expression. This is required by MBasicBlock::addPredecessor.
-        if (numBlocks < 2)
-            return true;
-
-        MBasicBlock* block = getBlock(0);
-
-        bool allPushed = hasPushed(block);
-        if (allPushed) {
-            MIRType type = peekPushedDef(block)->type();
-            for (size_t i = 1; allPushed && i < numBlocks; i++) {
-                block = getBlock(i);
-                allPushed = hasPushed(block) && peekPushedDef(block)->type() == type;
-            }
-        }
-
-        if (!allPushed) {
-            for (size_t i = 0; i < numBlocks; i++) {
-                block = getBlock(i);
-                if (!hasPushed(block))
-                    block->push(dummyIns_);
-            }
-        }
-
-        return allPushed;
+        MOZ_ASSERT(def->type() != MIRType::Value);
+        return def;
     }
 
   private:
@@ -1085,9 +1047,6 @@ class FunctionCompiler
             if (elseJoinPred)
                 blocks[numJoinPreds++] = elseJoinPred;
 
-            auto getBlock = [&](size_t i) -> MBasicBlock* { return blocks[i]; };
-            bool yieldsValue = ensurePushInvariants(getBlock, numJoinPreds);
-
             if (numJoinPreds == 0) {
                 *def = nullptr;
                 return true;
@@ -1102,7 +1061,7 @@ class FunctionCompiler
             }
 
             curBlock_ = join;
-            *def = popDefIfPushed(yieldsValue);
+            *def = popDefIfPushed();
         }
 
         return true;
@@ -1406,18 +1365,10 @@ class FunctionCompiler
         }
 
         ControlFlowPatchVector& patches = blockPatches_[absolute];
-
-        auto getBlock = [&](size_t i) -> MBasicBlock* {
-            if (i < patches.length())
-                return patches[i].ins->block();
-            return curBlock_;
-        };
-
-        bool yieldsValue = ensurePushInvariants(getBlock, patches.length() + !!curBlock_);
-
-        MBasicBlock* join = nullptr;
         MControlInstruction* ins = patches[0].ins;
         MBasicBlock* pred = ins->block();
+
+        MBasicBlock* join = nullptr;
         if (!newBlock(pred, &join))
             return false;
 
@@ -1446,7 +1397,7 @@ class FunctionCompiler
 
         curBlock_ = join;
 
-        *def = popDefIfPushed(yieldsValue);
+        *def = popDefIfPushed();
 
         patches.clear();
         return true;
diff --git a/toolkit/fonts/TwemojiMozilla.ttf b/toolkit/fonts/TwemojiMozilla.ttf
index c10c52e926..ed2919b45e 100644
Binary files a/toolkit/fonts/TwemojiMozilla.ttf and b/toolkit/fonts/TwemojiMozilla.ttf differ