diff --git a/dom/script/ScriptLoader.cpp b/dom/script/ScriptLoader.cpp
index 3ee49a70d3..70b48f2c4f 100644
--- a/dom/script/ScriptLoader.cpp
+++ b/dom/script/ScriptLoader.cpp
@@ -2363,11 +2363,14 @@ ScriptLoader::EvaluateScript(ScriptLoadRequest* aRequest)
              JS::Rooted<JSScript*> script(cx);
              script = exec.GetScript();
 
-             // Create a ClassicScript object and associate it with the
-             // JSScript.
-             RefPtr<ClassicScript> classicScript = new ClassicScript(
-                 aRequest->mFetchOptions, aRequest->mBaseURL);
-             classicScript->AssociateWithScript(script);
+             // With scripts disabled GetScript() will return nullptr
+             if (script) {
+                 // Create a ClassicScript object and associate it with the
+                 // JSScript.
+                 RefPtr<ClassicScript> classicScript = new ClassicScript(
+                     aRequest->mFetchOptions, aRequest->mBaseURL);
+                 classicScript->AssociateWithScript(script);
+             }
 
              rv = exec.ExecScript();
           }
diff --git a/dom/xbl/nsBindingManager.cpp b/dom/xbl/nsBindingManager.cpp
index b50c86c002..5245821776 100644
--- a/dom/xbl/nsBindingManager.cpp
+++ b/dom/xbl/nsBindingManager.cpp
@@ -717,8 +717,9 @@ nsBindingManager::WalkRules(nsIStyleRuleProcessor::EnumFunc aFunc,
       aData->mTreeMatchContext.mIsTopmostScope = (index == 0);
       binding->WalkRules(aFunc, aData);
     }
-    aData->mTreeMatchContext.mForAssignedSlot = false;
 
+    aData->mTreeMatchContext.mForAssignedSlot = false;
+    aData->mTreeMatchContext.mIsTopmostScope = false;
     aData->mTreeMatchContext.mRestrictToSlottedPseudo = false;
   }
 
diff --git a/layout/style/nsCSSRuleProcessor.cpp b/layout/style/nsCSSRuleProcessor.cpp
index f19aa572c0..ff3661c73d 100644
--- a/layout/style/nsCSSRuleProcessor.cpp
+++ b/layout/style/nsCSSRuleProcessor.cpp
@@ -680,7 +680,11 @@ void RuleHash::EnumerateAllRules(Element* aElement, ElementDependentRuleProcesso
       aData->mTreeMatchContext.mAncestorFilter.HasFilter() ?
         &aData->mTreeMatchContext.mAncestorFilter : nullptr;
 #ifdef DEBUG
-    if (filter) {
+    bool isRestricted = (aData->mTreeMatchContext.mShadowHosts.Length() > 0 ||
+      aData->mTreeMatchContext.mRestrictToSlottedPseudo ||
+      aData->mTreeMatchContext.mOnlyMatchHostPseudo ||
+      aData->mTreeMatchContext.mForAssignedSlot);
+    if (filter && !isRestricted) {
       filter->AssertHasAllAncestors(aElement);
     }
 #endif
@@ -1732,7 +1736,13 @@ static bool SelectorMatches(Element* aElement,
 
   Element* targetElement = aElement;
   if (aTreeMatchContext.mForAssignedSlot) {
-    targetElement = aElement->GetAssignedSlot()->AsElement();
+    HTMLSlotElement* slot = aElement->GetAssignedSlot();
+    // We're likely testing the slottable's ancestors and it might
+    // not have an assigned slot, so return early.
+    if (!slot) {
+      return false;
+    }
+    targetElement = slot->AsElement();
   }
 
   // namespace/tag match