diff --git a/application/basilisk/extensions/pdfjs/content/PdfJsNetwork.jsm b/application/basilisk/extensions/pdfjs/content/PdfJsNetwork.jsm
index c3aefecb26..4f85188c99 100644
--- a/application/basilisk/extensions/pdfjs/content/PdfJsNetwork.jsm
+++ b/application/basilisk/extensions/pdfjs/content/PdfJsNetwork.jsm
@@ -95,6 +95,7 @@ var NetworkManager = (function NetworkManagerClosure() {
         var rangeStr = args.begin + '-' + (args.end - 1);
         xhr.setRequestHeader('Range', 'bytes=' + rangeStr);
         pendingRequest.expectedStatus = 206;
+        xhr.channel.QueryInterface(Ci.nsIHttpChannel).redirectionLimit = 0;
       } else {
         pendingRequest.expectedStatus = 200;
       }
diff --git a/dom/base/nsContentUtils.cpp b/dom/base/nsContentUtils.cpp
index a347525545..107daaede6 100644
--- a/dom/base/nsContentUtils.cpp
+++ b/dom/base/nsContentUtils.cpp
@@ -9341,62 +9341,6 @@ nsContentUtils::SetScrollbarsVisibility(nsIDocShell* aDocShell, bool aVisible)
   }
 }
 
-/* static */ void
-nsContentUtils::GetPresentationURL(nsIDocShell* aDocShell, nsAString& aPresentationUrl)
-{
-  MOZ_ASSERT(aDocShell);
-
-  // Simulate receiver context for web platform test
-  if (Preferences::GetBool("dom.presentation.testing.simulate-receiver")) {
-    nsCOMPtr<nsIDocument> doc;
-
-    nsCOMPtr<nsPIDOMWindowOuter> docShellWin =
-      do_QueryInterface(aDocShell->GetScriptGlobalObject());
-    if (docShellWin) {
-      doc = docShellWin->GetExtantDoc();
-    }
-
-    if (NS_WARN_IF(!doc)) {
-      return;
-    }
-
-    nsCOMPtr<nsIURI> uri = doc->GetDocumentURI();
-    if (NS_WARN_IF(!uri)) {
-      return;
-    }
-
-    nsAutoCString uriStr;
-    uri->GetSpec(uriStr);
-    aPresentationUrl = NS_ConvertUTF8toUTF16(uriStr);
-    return;
-  }
-
-  if (XRE_IsContentProcess()) {
-    nsCOMPtr<nsIDocShellTreeItem> sameTypeRoot;
-    aDocShell->GetSameTypeRootTreeItem(getter_AddRefs(sameTypeRoot));
-    nsCOMPtr<nsIDocShellTreeItem> root;
-    aDocShell->GetRootTreeItem(getter_AddRefs(root));
-    if (sameTypeRoot.get() == root.get()) {
-      // presentation URL is stored in TabChild for the top most
-      // <iframe mozbrowser> in content process.
-      TabChild* tabChild = TabChild::GetFrom(aDocShell);
-      if (tabChild) {
-        aPresentationUrl = tabChild->PresentationURL();
-      }
-      return;
-    }
-  }
-
-  nsCOMPtr<nsILoadContext> loadContext(do_QueryInterface(aDocShell));
-  nsCOMPtr<nsIDOMElement> topFrameElement;
-  loadContext->GetTopFrameElement(getter_AddRefs(topFrameElement));
-  if (!topFrameElement) {
-    return;
-  }
-
-  topFrameElement->GetAttribute(NS_LITERAL_STRING("mozpresentation"), aPresentationUrl);
-}
-
 /* static */ nsIDocShell*
 nsContentUtils::GetDocShellForEventTarget(EventTarget* aTarget)
 {
diff --git a/dom/base/nsContentUtils.h b/dom/base/nsContentUtils.h
index e0c023fff4..83ee417403 100644
--- a/dom/base/nsContentUtils.h
+++ b/dom/base/nsContentUtils.h
@@ -2679,12 +2679,6 @@ public:
 
   static void SetScrollbarsVisibility(nsIDocShell* aDocShell, bool aVisible);
 
-  /*
-   * Return the associated presentation URL of the presented content.
-   * Will return empty string if the docshell is not in a presented content.
-   */
-  static void GetPresentationURL(nsIDocShell* aDocShell, nsAString& aPresentationUrl);
-
   /*
    * Try to find the docshell corresponding to the given event target.
    */
diff --git a/dom/base/nsFrameLoader.cpp b/dom/base/nsFrameLoader.cpp
index 5b7ec7b706..c4ecff5c8c 100644
--- a/dom/base/nsFrameLoader.cpp
+++ b/dom/base/nsFrameLoader.cpp
@@ -3106,14 +3106,6 @@ nsFrameLoader::ApplySandboxFlags(uint32_t sandboxFlags)
     // The child can only add restrictions, never remove them.
     sandboxFlags |= parentSandboxFlags;
 
-    // If this frame is a receiving browsing context, we should add
-    // sandboxed auxiliary navigation flag to sandboxFlags. See
-    // https://w3c.github.io/presentation-api/#creating-a-receiving-browsing-context
-    nsAutoString presentationURL;
-    nsContentUtils::GetPresentationURL(mDocShell, presentationURL);
-    if (!presentationURL.IsEmpty()) {
-      sandboxFlags |= SANDBOXED_AUXILIARY_NAVIGATION;
-    }
     mDocShell->SetSandboxFlags(sandboxFlags);
   }
 }
@@ -3431,11 +3423,6 @@ nsFrameLoader::GetNewTabContext(MutableTabContext* aTabContext,
   rv = PopulateUserContextIdFromAttribute(attrs);
   NS_ENSURE_SUCCESS(rv, rv);
 
-  nsAutoString presentationURLStr;
-  mOwnerContent->GetAttr(kNameSpaceID_None,
-                         nsGkAtoms::mozpresentation,
-                         presentationURLStr);
-
   nsCOMPtr<nsIDocShell> docShell = mOwnerContent->OwnerDoc()->GetDocShell();
   nsCOMPtr<nsILoadContext> parentContext = do_QueryInterface(docShell);
   NS_ENSURE_STATE(parentContext);
@@ -3463,8 +3450,7 @@ nsFrameLoader::GetNewTabContext(MutableTabContext* aTabContext,
                                containingApp,
                                showAccelerators,
                                showFocusRings,
-                               attrs,
-                               presentationURLStr);
+                               attrs);
   NS_ENSURE_STATE(tabContextUpdated);
 
   return NS_OK;
diff --git a/dom/base/nsGkAtomList.h b/dom/base/nsGkAtomList.h
index 0f70f070a2..08f5c4fc1d 100644
--- a/dom/base/nsGkAtomList.h
+++ b/dom/base/nsGkAtomList.h
@@ -1039,7 +1039,6 @@ GK_ATOM(predicate, "predicate")
 GK_ATOM(prefix, "prefix")
 GK_ATOM(preload, "preload")
 GK_ATOM(prerendered, "prerendered")
-GK_ATOM(mozpresentation, "mozpresentation")
 GK_ATOM(preserve, "preserve")
 GK_ATOM(preserveSpace, "preserve-space")
 GK_ATOM(preventdefault, "preventdefault")
diff --git a/dom/canvas/ImageBitmap.cpp b/dom/canvas/ImageBitmap.cpp
index e4b145d461..62de20763b 100644
--- a/dom/canvas/ImageBitmap.cpp
+++ b/dom/canvas/ImageBitmap.cpp
@@ -930,7 +930,7 @@ ImageBitmap::CreateInternal(nsIGlobalObject* aGlobal, ImageData& aImageData,
                             const Maybe<IntRect>& aCropRect, ErrorResult& aRv)
 {
   // Copy data into SourceSurface.
-  dom::Uint8ClampedArray array;
+  RootedTypedArray<Uint8ClampedArray> array(RootingCx());
   DebugOnly<bool> inited = array.Init(aImageData.GetDataObject());
   MOZ_ASSERT(inited);
 
@@ -952,13 +952,17 @@ ImageBitmap::CreateInternal(nsIGlobalObject* aGlobal, ImageData& aImageData,
 
   // Create and Crop the raw data into a layers::Image
   RefPtr<layers::Image> data;
+
+  // The data could move during a GC; copy it out into a local buffer.
+  uint8_t* fixedData = array.Data();
+
   if (NS_IsMainThread()) {
     data = CreateImageFromRawData(imageSize, imageStride, FORMAT,
-                                  array.Data(), dataLength,
+                                  fixedData, dataLength,
                                   aCropRect);
   } else {
     RefPtr<CreateImageFromRawDataInMainThreadSyncTask> task
-      = new CreateImageFromRawDataInMainThreadSyncTask(array.Data(),
+      = new CreateImageFromRawDataInMainThreadSyncTask(fixedData,
                                                        dataLength,
                                                        imageStride,
                                                        FORMAT,
diff --git a/dom/html/HTMLMenuElement.cpp b/dom/html/HTMLMenuElement.cpp
index 6c096084ac..a099a5289e 100644
--- a/dom/html/HTMLMenuElement.cpp
+++ b/dom/html/HTMLMenuElement.cpp
@@ -137,9 +137,9 @@ HTMLMenuElement::ParseAttribute(int32_t aNamespaceID,
                                 const nsAString& aValue,
                                 nsAttrValue& aResult)
 {
-  if (aNamespaceID == kNameSpaceID_None && aAttribute == nsGkAtoms::type) {
-    bool success = aResult.ParseEnumValue(aValue, kMenuTypeTable,
-                                            false);
+  if (aNamespaceID == kNameSpaceID_None && aAttribute == nsGkAtoms::type &&
+      Preferences::GetBool("dom.menuitem.enabled")) {
+    bool success = aResult.ParseEnumValue(aValue, kMenuTypeTable, false);
     if (success) {
       mType = aResult.GetEnumValue();
     } else {
diff --git a/dom/html/HTMLMenuItemElement.cpp b/dom/html/HTMLMenuItemElement.cpp
index 5c5cf8d767..6cf4eb40c2 100644
--- a/dom/html/HTMLMenuItemElement.cpp
+++ b/dom/html/HTMLMenuItemElement.cpp
@@ -7,12 +7,22 @@
 
 #include "mozilla/BasicEvents.h"
 #include "mozilla/EventDispatcher.h"
+#include "mozilla/Preferences.h"
 #include "mozilla/dom/HTMLMenuItemElementBinding.h"
+#include "mozilla/dom/HTMLUnknownElement.h"
 #include "nsAttrValueInlines.h"
 #include "nsContentUtils.h"
 
-
-NS_IMPL_NS_NEW_HTML_ELEMENT_CHECK_PARSER(MenuItem)
+nsGenericHTMLElement*
+NS_NewHTMLMenuItemElement(already_AddRefed<mozilla::dom::NodeInfo>&& aNodeInfo,
+                          mozilla::dom::FromParser aFromParser) {
+  RefPtr<mozilla::dom::NodeInfo> nodeInfo(aNodeInfo);
+  if (mozilla::Preferences::GetBool("dom.menuitem.enabled")) {
+    return new mozilla::dom::HTMLMenuItemElement(nodeInfo.forget(), aFromParser);
+  } else {
+    return new mozilla::dom::HTMLUnknownElement(nodeInfo.forget());
+  }
+}
 
 namespace mozilla {
 namespace dom {
diff --git a/dom/html/test/browser_content_contextmenu_userinput.js b/dom/html/test/browser_content_contextmenu_userinput.js
index 7d0387715b..845ba718e3 100644
--- a/dom/html/test/browser_content_contextmenu_userinput.js
+++ b/dom/html/test/browser_content_contextmenu_userinput.js
@@ -4,6 +4,9 @@ const kPage = "http://example.org/browser/" +
               "dom/html/test/file_content_contextmenu.html";
 
 add_task(function* () {
+  yield SpecialPowers.pushPrefEnv({
+    set: [["dom.menuitem.enabled", true]],
+  });
   yield BrowserTestUtils.withNewTab({
     gBrowser,
     url: kPage
diff --git a/dom/html/test/mochitest.ini b/dom/html/test/mochitest.ini
index 5c9c66e614..dcbb73840a 100644
--- a/dom/html/test/mochitest.ini
+++ b/dom/html/test/mochitest.ini
@@ -1,4 +1,6 @@
 [DEFAULT]
+prefs = 
+  dom.menuitem.enabled=true # only for test_bug617528.html
 support-files =
   347174transform.xsl
   347174transformable.xml
diff --git a/dom/ipc/PTabContext.ipdlh b/dom/ipc/PTabContext.ipdlh
index 72cd90e2af..62d6ec0f35 100644
--- a/dom/ipc/PTabContext.ipdlh
+++ b/dom/ipc/PTabContext.ipdlh
@@ -48,11 +48,6 @@ struct FrameIPCTabContext
   // Whether this TabContext should work in prerender mode.
   bool isPrerendered;
 
-  // The requested presentation URL.
-  // This value would be empty if the TabContext isn't created for
-  // presented content.
-  nsString presentationURL;
-
   // Keyboard indicator state inherited from the parent.
   UIStateChangeType showAccelerators;
   UIStateChangeType showFocusRings;
diff --git a/dom/ipc/TabChild.cpp b/dom/ipc/TabChild.cpp
index 182aa628b4..caae91fa54 100644
--- a/dom/ipc/TabChild.cpp
+++ b/dom/ipc/TabChild.cpp
@@ -770,11 +770,6 @@ TabChild::NotifyTabContextUpdated(bool aIsPreallocated)
   if (aIsPreallocated)  {
     nsDocShell::Cast(docShell)->SetOriginAttributes(OriginAttributesRef());
   }
-
-  // Set SANDBOXED_AUXILIARY_NAVIGATION flag if this is a receiver page.
-  if (!PresentationURL().IsEmpty()) {
-    docShell->SetSandboxFlags(SANDBOXED_AUXILIARY_NAVIGATION);
-  }
 }
 
 void
diff --git a/dom/ipc/TabContext.cpp b/dom/ipc/TabContext.cpp
index 66a2790520..b313da0ffa 100644
--- a/dom/ipc/TabContext.cpp
+++ b/dom/ipc/TabContext.cpp
@@ -190,12 +190,6 @@ TabContext::OriginAttributesRef() const
   return mOriginAttributes;
 }
 
-const nsAString&
-TabContext::PresentationURL() const
-{
-  return mPresentationURL;
-}
-
 UIStateChangeType
 TabContext::ShowAccelerators() const
 {
@@ -215,8 +209,7 @@ TabContext::SetTabContext(bool aIsMozBrowserElement,
                           mozIApplication* aAppFrameOwnerApp,
                           UIStateChangeType aShowAccelerators,
                           UIStateChangeType aShowFocusRings,
-                          const DocShellOriginAttributes& aOriginAttributes,
-                          const nsAString& aPresentationURL)
+                          const DocShellOriginAttributes& aOriginAttributes)
 {
   NS_ENSURE_FALSE(mInitialized, false);
 
@@ -248,7 +241,6 @@ TabContext::SetTabContext(bool aIsMozBrowserElement,
   mContainingAppId = containingAppId;
   mOwnApp = aOwnApp;
   mContainingApp = aAppFrameOwnerApp;
-  mPresentationURL = aPresentationURL;
   mShowAccelerators = aShowAccelerators;
   mShowFocusRings = aShowFocusRings;
   return true;
@@ -261,7 +253,6 @@ TabContext::AsIPCTabContext() const
                                           mContainingAppId,
                                           mIsMozBrowserElement,
                                           mIsPrerendered,
-                                          mPresentationURL,
                                           mShowAccelerators,
                                           mShowFocusRings));
 }
@@ -285,7 +276,6 @@ MaybeInvalidTabContext::MaybeInvalidTabContext(const IPCTabContext& aParams)
   bool isPrerendered = false;
   uint32_t containingAppId = NO_APP_ID;
   DocShellOriginAttributes originAttributes;
-  nsAutoString presentationURL;
   UIStateChangeType showAccelerators = UIStateChangeType_NoChange;
   UIStateChangeType showFocusRings = UIStateChangeType_NoChange;
 
@@ -348,7 +338,6 @@ MaybeInvalidTabContext::MaybeInvalidTabContext(const IPCTabContext& aParams)
       isMozBrowserElement = ipcContext.isMozBrowserElement();
       isPrerendered = ipcContext.isPrerendered();
       containingAppId = ipcContext.frameOwnerAppId();
-      presentationURL = ipcContext.presentationURL();
       showAccelerators = ipcContext.showAccelerators();
       showFocusRings = ipcContext.showFocusRings();
       originAttributes = ipcContext.originAttributes();
@@ -395,8 +384,7 @@ MaybeInvalidTabContext::MaybeInvalidTabContext(const IPCTabContext& aParams)
                                  containingApp,
                                  showAccelerators,
                                  showFocusRings,
-                                 originAttributes,
-                                 presentationURL);
+                                 originAttributes);
   if (!rv) {
     mInvalidReason = "Couldn't initialize TabContext.";
   }
diff --git a/dom/ipc/TabContext.h b/dom/ipc/TabContext.h
index 1507a0dc8b..e0b6f0d963 100644
--- a/dom/ipc/TabContext.h
+++ b/dom/ipc/TabContext.h
@@ -125,12 +125,6 @@ public:
    */
   const DocShellOriginAttributes& OriginAttributesRef() const;
 
-  /**
-   * Returns the presentation URL associated with the tab if this tab is
-   * created for presented content
-   */
-  const nsAString& PresentationURL() const;
-
   UIStateChangeType ShowAccelerators() const;
   UIStateChangeType ShowFocusRings() const;
 
@@ -169,8 +163,7 @@ protected:
                      mozIApplication* aAppFrameOwnerApp,
                      UIStateChangeType aShowAccelerators,
                      UIStateChangeType aShowFocusRings,
-                     const DocShellOriginAttributes& aOriginAttributes,
-                     const nsAString& aPresentationURL);
+                     const DocShellOriginAttributes& aOriginAttributes);
 
   /**
    * Modify this TabContext to match the given TabContext.  This is a special
@@ -225,11 +218,6 @@ private:
    */
   DocShellOriginAttributes mOriginAttributes;
 
-  /**
-   * The requested presentation URL.
-   */
-  nsString mPresentationURL;
-
   /**
    * Keyboard indicator state (focus rings, accelerators).
    */
@@ -257,8 +245,7 @@ public:
                 mozIApplication* aAppFrameOwnerApp,
                 UIStateChangeType aShowAccelerators,
                 UIStateChangeType aShowFocusRings,
-                const DocShellOriginAttributes& aOriginAttributes,
-                const nsAString& aPresentationURL = EmptyString())
+                const DocShellOriginAttributes& aOriginAttributes)
   {
     return TabContext::SetTabContext(aIsMozBrowserElement,
                                      aIsPrerendered,
@@ -266,8 +253,7 @@ public:
                                      aAppFrameOwnerApp,
                                      aShowAccelerators,
                                      aShowFocusRings,
-                                     aOriginAttributes,
-                                     aPresentationURL);
+                                     aOriginAttributes);
   }
 };
 
diff --git a/dom/media/webaudio/blink/ReverbInputBuffer.cpp b/dom/media/webaudio/blink/ReverbInputBuffer.cpp
index 8221f8151d..6b8e642d27 100644
--- a/dom/media/webaudio/blink/ReverbInputBuffer.cpp
+++ b/dom/media/webaudio/blink/ReverbInputBuffer.cpp
@@ -42,19 +42,20 @@ ReverbInputBuffer::ReverbInputBuffer(size_t length)
 
 void ReverbInputBuffer::write(const float* sourceP, size_t numberOfFrames)
 {
-    size_t bufferLength = m_buffer.Length();
-    bool isCopySafe = m_writeIndex + numberOfFrames <= bufferLength;
-    MOZ_ASSERT(isCopySafe);
-    if (!isCopySafe)
-        return;
+  // m_writeIndex is atomic and checked by other threads, so only touch
+  // it at the start and end.
+  size_t index = m_writeIndex;
 
-    memcpy(m_buffer.Elements() + m_writeIndex, sourceP, sizeof(float) * numberOfFrames);
+  size_t bufferLength = m_buffer.Length();
+  size_t newIndex = index + numberOfFrames;
 
-    m_writeIndex += numberOfFrames;
-    MOZ_ASSERT(m_writeIndex <= bufferLength);
+  MOZ_RELEASE_ASSERT(newIndex <= bufferLength);
 
-    if (m_writeIndex >= bufferLength)
-        m_writeIndex = 0;
+  memcpy(m_buffer.Elements() + index, sourceP, sizeof(float) * numberOfFrames);
+
+  if (newIndex >= bufferLength) {
+    m_writeIndex = 0;
+  }
 }
 
 float* ReverbInputBuffer::directReadFrom(int* readIndex, size_t numberOfFrames)
diff --git a/dom/media/webaudio/blink/ReverbInputBuffer.h b/dom/media/webaudio/blink/ReverbInputBuffer.h
index 906021c0d1..f51aa30916 100644
--- a/dom/media/webaudio/blink/ReverbInputBuffer.h
+++ b/dom/media/webaudio/blink/ReverbInputBuffer.h
@@ -30,6 +30,7 @@
 #define ReverbInputBuffer_h
 
 #include "nsTArray.h"
+#include "mozilla/Atomics.h"
 #include "mozilla/MemoryReporting.h"
 
 namespace WebCore {
@@ -63,7 +64,7 @@ public:
 
 private:
     nsTArray<float> m_buffer;
-    size_t m_writeIndex;
+    mozilla::Atomic<size_t, mozilla::ReleaseAcquire> m_writeIndex;
 };
 
 } // namespace WebCore
diff --git a/dom/messagechannel/MessagePortParent.h b/dom/messagechannel/MessagePortParent.h
index 4cbebe29b4..23195c3a7b 100644
--- a/dom/messagechannel/MessagePortParent.h
+++ b/dom/messagechannel/MessagePortParent.h
@@ -5,6 +5,7 @@
 #ifndef mozilla_dom_MessagePortParent_h
 #define mozilla_dom_MessagePortParent_h
 
+#include "mozilla/WeakPtr.h"
 #include "mozilla/dom/PMessagePortParent.h"
 
 namespace mozilla {
@@ -12,7 +13,8 @@ namespace dom {
 
 class MessagePortService;
 
-class MessagePortParent final : public PMessagePortParent
+class MessagePortParent final : public PMessagePortParent,
+                                public SupportsWeakPtr<MessagePortParent>
 {
 public:
   explicit MessagePortParent(const nsID& aUUID);
@@ -40,6 +42,8 @@ public:
                          const nsID& aDestinationUUID,
                          const uint32_t& aSequenceID);
 
+  MOZ_DECLARE_WEAKREFERENCE_TYPENAME(MessagePortParent)
+  
 private:
   virtual bool RecvPostMessages(nsTArray<MessagePortMessage>&& aMessages)
                                                                        override;
diff --git a/dom/messagechannel/MessagePortService.cpp b/dom/messagechannel/MessagePortService.cpp
index c76d9382b1..85d0d42e97 100644
--- a/dom/messagechannel/MessagePortService.cpp
+++ b/dom/messagechannel/MessagePortService.cpp
@@ -9,6 +9,7 @@
 #include "mozilla/ipc/BackgroundParent.h"
 #include "mozilla/StaticPtr.h"
 #include "mozilla/Unused.h"
+#include "mozilla/WeakPtr.h"
 #include "nsTArray.h"
 
 using mozilla::ipc::AssertIsOnBackgroundThread;
@@ -59,7 +60,7 @@ public:
   {
     uint32_t mSequenceID;
     // MessagePortParent keeps the service alive, and we don't want a cycle.
-    MessagePortParent* mParent;
+    WeakPtr<MessagePortParent> mParent;
   };
 
   FallibleTArray<NextParent> mNextParents;
@@ -275,9 +276,13 @@ MessagePortService::CloseAll(const nsID& aUUID, bool aForced)
     data->mParent->Close();
   }
 
-  for (const MessagePortServiceData::NextParent& parent : data->mNextParents) {
-    parent.mParent->CloseAndDelete();
+  for (const MessagePortServiceData::NextParent& nextParent : data->mNextParents) {
+    MessagePortParent* const parent = nextParent.mParent;
+    if (parent) {
+      parent->CloseAndDelete();
+    }
   }
+  data->mNextParents.Clear();
 
   nsID destinationUUID = data->mDestinationUUID;
 
diff --git a/dom/tests/mochitest/general/test_interfaces.html b/dom/tests/mochitest/general/test_interfaces.html
index eb09f5962a..5eb47d1018 100644
--- a/dom/tests/mochitest/general/test_interfaces.html
+++ b/dom/tests/mochitest/general/test_interfaces.html
@@ -496,8 +496,6 @@ var interfaceNamesInGlobalScope =
     "HTMLMediaElement",
 // IMPORTANT: Do not change this list without review from a DOM peer!
     "HTMLMenuElement",
-// IMPORTANT: Do not change this list without review from a DOM peer!
-    "HTMLMenuItemElement",
 // IMPORTANT: Do not change this list without review from a DOM peer!
     "HTMLMetaElement",
 // IMPORTANT: Do not change this list without review from a DOM peer!
diff --git a/dom/tests/mochitest/webcomponents/htmlconstructor_builtin_tests.js b/dom/tests/mochitest/webcomponents/htmlconstructor_builtin_tests.js
index dd65151482..50fc351631 100644
--- a/dom/tests/mochitest/webcomponents/htmlconstructor_builtin_tests.js
+++ b/dom/tests/mochitest/webcomponents/htmlconstructor_builtin_tests.js
@@ -72,7 +72,6 @@
   ['mark', ''],
   ['marquee', 'Div'],
   ['menu', 'Menu'],
-  ['menuitem', 'MenuItem'],
   ['meta', 'Meta'],
   ['meter', 'Meter'],
   ['nav', ''],
diff --git a/dom/webidl/EventHandler.webidl b/dom/webidl/EventHandler.webidl
index 484a8e95cd..e7dc4931bd 100644
--- a/dom/webidl/EventHandler.webidl
+++ b/dom/webidl/EventHandler.webidl
@@ -82,6 +82,7 @@ interface GlobalEventHandlers {
            attribute EventHandler onseeked;
            attribute EventHandler onseeking;
            attribute EventHandler onselect;
+           [Pref="dom.menuitem.enabled"]
            attribute EventHandler onshow;
            //(Not implemented)attribute EventHandler onsort;
            attribute EventHandler onstalled;
diff --git a/dom/webidl/HTMLElement.webidl b/dom/webidl/HTMLElement.webidl
index 815f4a3bd0..cd1fd7d6aa 100644
--- a/dom/webidl/HTMLElement.webidl
+++ b/dom/webidl/HTMLElement.webidl
@@ -49,10 +49,8 @@ interface HTMLElement : Element {
            attribute DOMString contentEditable;
   [Pure]
   readonly attribute boolean isContentEditable;
-  [Pure]
+  [Pure, Pref="dom.menuitem.enabled"]
   readonly attribute HTMLMenuElement? contextMenu;
-  //[SetterThrows]
-  //         attribute HTMLMenuElement? contextMenu;
   [CEReactions, SetterThrows, Pure]
            attribute boolean spellcheck;
 
diff --git a/dom/webidl/HTMLMenuElement.webidl b/dom/webidl/HTMLMenuElement.webidl
index 1194226c5b..dc9a78ae8a 100644
--- a/dom/webidl/HTMLMenuElement.webidl
+++ b/dom/webidl/HTMLMenuElement.webidl
@@ -17,9 +17,9 @@ interface MenuBuilder;
 // http://www.whatwg.org/specs/web-apps/current-work/#the-menu-element
 [HTMLConstructor]
 interface HTMLMenuElement : HTMLElement {
-           [CEReactions, SetterThrows]
+           [CEReactions, SetterThrows, Pref="dom.menuitem.enabled"]
            attribute DOMString type;
-           [CEReactions, SetterThrows]
+           [CEReactions, SetterThrows, Pref="dom.menuitem.enabled"]
            attribute DOMString label;
 };
 
diff --git a/dom/webidl/HTMLMenuItemElement.webidl b/dom/webidl/HTMLMenuItemElement.webidl
index f091045017..6005bd7d2f 100644
--- a/dom/webidl/HTMLMenuItemElement.webidl
+++ b/dom/webidl/HTMLMenuItemElement.webidl
@@ -12,7 +12,7 @@
  */
 
 // http://www.whatwg.org/specs/web-apps/current-work/#the-menuitem-element
-[HTMLConstructor]
+[HTMLConstructor, Pref="dom.menuitem.enabled"]
 interface HTMLMenuItemElement : HTMLElement {
            [CEReactions, SetterThrows]
            attribute DOMString type;
diff --git a/dom/workers/WorkerPrivate.cpp b/dom/workers/WorkerPrivate.cpp
index 860bf8468e..1f8b3b70c4 100644
--- a/dom/workers/WorkerPrivate.cpp
+++ b/dom/workers/WorkerPrivate.cpp
@@ -6392,7 +6392,7 @@ WorkerPrivate::GarbageCollectInternal(JSContext* aCx, bool aShrinking,
   if (aShrinking || aCollectChildren) {
     JS::PrepareForFullGC(aCx);
 
-    if (aShrinking) {
+    if (aShrinking && mSyncLoopStack.IsEmpty()) {
       JS::GCForReason(aCx, GC_SHRINK, JS::gcreason::DOM_WORKER);
 
       if (!aCollectChildren) {
diff --git a/js/src/jsapi.cpp b/js/src/jsapi.cpp
index e9f86bde10..f4b3c98545 100644
--- a/js/src/jsapi.cpp
+++ b/js/src/jsapi.cpp
@@ -873,6 +873,9 @@ JS_TransplantObject(JSContext* cx, HandleObject origobj, HandleObject target)
     AutoDisableCompactingGC nocgc(cx);
 
     AutoDisableProxyCheck adpc(cx->runtime());
+    
+    // Transplanting is never OOM-safe.
+    AutoEnterOOMUnsafeRegion oomUnsafe;
 
     JSCompartment* destination = target->compartment();
 
@@ -905,19 +908,22 @@ JS_TransplantObject(JSContext* cx, HandleObject origobj, HandleObject target)
     // Now, iterate through other scopes looking for references to the
     // old object, and update the relevant cross-compartment wrappers.
     if (!RemapAllWrappersForObject(cx, origobj, newIdentity))
-        MOZ_CRASH();
+        oomUnsafe.crash("JS_TransplantObject");
 
     // Lastly, update the original object to point to the new one.
     if (origobj->compartment() != destination) {
         RootedObject newIdentityWrapper(cx, newIdentity);
         AutoCompartment ac(cx, origobj);
-        if (!JS_WrapObject(cx, &newIdentityWrapper))
-            MOZ_CRASH();
+        if (!JS_WrapObject(cx, &newIdentityWrapper)) {
+          MOZ_RELEASE_ASSERT(cx->isThrowingOutOfMemory() ||
+                             cx->isThrowingOverRecursed());
+          oomUnsafe.crash("JS_TransplantObject");
+        }
         MOZ_ASSERT(Wrapper::wrappedObject(newIdentityWrapper) == newIdentity);
         if (!JSObject::swap(cx, origobj, newIdentityWrapper))
             MOZ_CRASH();
         if (!origobj->compartment()->putWrapper(cx, CrossCompartmentKey(newIdentity), origv))
-            MOZ_CRASH();
+            oomUnsafe.crash("JS_TransplantObject");
     }
 
     // The new identity object might be one of several things. Return it to avoid
diff --git a/layout/style/res/html.css b/layout/style/res/html.css
index 4f43f3134f..8593abaab7 100644
--- a/layout/style/res/html.css
+++ b/layout/style/res/html.css
@@ -577,8 +577,10 @@ ul, menu, dir {
   padding-inline-start: 40px;
 }
 
-menu[type="context"] {
-  display: none !important;
+@supports -moz-bool-pref("dom.menuitem.enabled") {
+  menu[type="context"] {
+    display: none !important;
+  }
 }
 
 ol {
diff --git a/layout/xul/tree/nsTreeBodyFrame.cpp b/layout/xul/tree/nsTreeBodyFrame.cpp
index b31d1de367..ec054a234e 100644
--- a/layout/xul/tree/nsTreeBodyFrame.cpp
+++ b/layout/xul/tree/nsTreeBodyFrame.cpp
@@ -1826,12 +1826,17 @@ nsTreeBodyFrame::RowCountChanged(int32_t aIndex, int32_t aCount)
     FireRowCountChangedEvent(aIndex, aCount);
 #endif
 
+  nsWeakFrame weakFrame(this);
+  
   // Adjust our selection.
+  nsCOMPtr<nsITreeView> view = mView;
   nsCOMPtr<nsITreeSelection> sel;
-  mView->GetSelection(getter_AddRefs(sel));
+  view->GetSelection(getter_AddRefs(sel));
   if (sel)
     sel->AdjustSelection(aIndex, aCount);
 
+  NS_ENSURE_STATE (weakFrame.IsAlive());
+  
   if (mUpdateBatchNest)
     return NS_OK;
 
diff --git a/media/webrtc/signaling/src/sdp/sipcc/sdp_attr.c b/media/webrtc/signaling/src/sdp/sipcc/sdp_attr.c
index e3afa26377..b1c7f0faae 100644
--- a/media/webrtc/signaling/src/sdp/sipcc/sdp_attr.c
+++ b/media/webrtc/signaling/src/sdp/sipcc/sdp_attr.c
@@ -2825,7 +2825,7 @@ sdp_result_e sdp_parse_attr_cpar (sdp_t *sdp_p, sdp_attr_t *attr_p,
     sdp_mca_t    *cap_p;
     sdp_attr_t   *cap_attr_p = NULL;
     sdp_attr_t   *prev_attr_p;
-    char          tmp[SDP_MAX_STRING_LEN];
+    char          tmp[SDP_MAX_STRING_LEN] = {0};
 
     /* Make sure we've processed a valid X-cap/cdsc attr prior to this and
      * if so, get the cap pointer. */
@@ -2882,8 +2882,8 @@ sdp_result_e sdp_parse_attr_cpar (sdp_t *sdp_p, sdp_attr_t *attr_p,
 
     if ((result != SDP_SUCCESS) || (tmp[0] != 'a') || (tmp[1] != '\0')) {
         sdp_parse_error(sdp_p,
-            "%s Warning: Invalid token type (%s) in %s "
-            "attribute, unable to parse", sdp_p->debug_str, tmp,
+            "%s Warning: Invalid token type in %s "
+            "attribute, unable to parse", sdp_p->debug_str,
             sdp_get_attr_name(attr_p->type));
         sdp_p->conf_p->num_invalid_param++;
         return (SDP_INVALID_PARAMETER);
diff --git a/modules/libpref/init/all.js b/modules/libpref/init/all.js
index f88b48f44c..b028339229 100644
--- a/modules/libpref/init/all.js
+++ b/modules/libpref/init/all.js
@@ -2886,11 +2886,8 @@ pref("svg.marker-improvements.enabled", true);
 // See https://svgwg.org/svg2-draft/single-page.html#types-SVGBoundingBoxOptions
 pref("svg.new-getBBox.enabled", false);
 
-#ifdef RELEASE_OR_BETA
-pref("svg.transform-box.enabled", false);
-#else
+// Is support for the transform-box property of SVG enabled?
 pref("svg.transform-box.enabled", true);
-#endif // RELEASE_OR_BETA
 
 // Default font types and sizes by locale
 pref("font.default.ar", "sans-serif");
@@ -4753,11 +4750,7 @@ pref("dom.abortController.enabled", true);
 
 // Push
 pref("dom.push.enabled", false);
-
 pref("dom.push.loglevel", "error");
-
-pref("dom.getRootNode.enabled", false);
-
 pref("dom.push.serverURL", "wss://push.services.mozilla.com/");
 pref("dom.push.userAgentID", "");
 
@@ -4794,6 +4787,9 @@ pref("dom.push.http2.reset_retry_count_after_ms", 60000);
 pref("dom.push.http2.maxRetries", 2);
 pref("dom.push.http2.retryInterval", 5000);
 
+// Whether WC getRootNode is available
+pref("dom.getRootNode.enabled", false);
+
 // WebNetworkStats
 pref("dom.mozNetworkStats.enabled", false);
 
@@ -4978,18 +4974,19 @@ pref("captivedetect.maxWaitingTime", 5000);
 pref("captivedetect.pollingTime", 3000);
 pref("captivedetect.maxRetryCount", 5);
 
-#ifdef RELEASE_OR_BETA
-pref("dom.forms.inputmode", false);
-#else
+// Enable support for specifying inputmode for soft keyboards
 pref("dom.forms.inputmode", true);
-#endif
 
 // InputMethods for soft keyboards in B2G
+// XXX: is this still used?
 pref("dom.mozInputMethod.enabled", false);
 
 // Enable mapped array buffer by default.
 pref("dom.mapped_arraybuffer.enabled", true);
 
+// Whether <menuitem> is a thing or not.
+pref("dom.menuitem.enabled", false);
+
 #ifdef MOZ_SAFE_BROWSING
 // The tables used for Safebrowsing phishing and malware checks.
 pref("urlclassifier.malwareTable", "goog-malware-shavar,goog-unwanted-shavar,test-malware-simple,test-unwanted-simple");
@@ -5181,24 +5178,9 @@ pref("dom.udpsocket.enabled", false);
 // Disable before keyboard events and after keyboard events by default.
 pref("dom.beforeAfterKeyboardEvent.enabled", false);
 
-// Presentation API
-pref("dom.presentation.enabled", false);
-pref("dom.presentation.controller.enabled", false);
-pref("dom.presentation.receiver.enabled", false);
-
-// Presentation Device
-pref("dom.presentation.tcp_server.debug", false);
-pref("dom.presentation.discovery.enabled", false);
-pref("dom.presentation.discovery.legacy.enabled", false);
-pref("dom.presentation.discovery.timeout_ms", 10000);
-pref("dom.presentation.discoverable", false);
-pref("dom.presentation.discoverable.encrypted", true);
-pref("dom.presentation.discoverable.retry_ms", 5000);
-pref("dom.presentation.session_transport.data_channel.enable", false);
-
 #ifdef XP_MACOSX
-#if !defined(RELEASE_OR_BETA) || defined(DEBUG)
-// In non-release builds we crash by default on insecure text input (when a
+#if defined(DEBUG)
+// In debug builds we crash by default on insecure text input (when a
 // password editor has focus but secure event input isn't enabled).  The
 // following pref, when turned on, disables this behavior.  See bug 1188425.
 pref("intl.allow-insecure-text-input", false);
@@ -5410,24 +5392,18 @@ pref("media.default_volume", "1.0");
 
 pref("media.seekToNextFrame.enabled", true);
 
-// return the maximum number of cores that navigator.hardwareCurrency returns
+// return the maximum number of cores that navigator.hardwareConcurrency returns
 pref("dom.maxHardwareConcurrency", 16);
 
-// Shutdown the osfile worker if its no longer needed.
-#if !defined(RELEASE_OR_BETA)
+// Shutdown the async osfile worker if it's no longer needed.
 pref("osfile.reset_worker_delay", 30000);
-#endif
 
 #if !defined(MOZ_WIDGET_ANDROID)
 pref("dom.webkitBlink.dirPicker.enabled", true);
 pref("dom.webkitBlink.filesystem.enabled", true);
 #endif
 
-#ifdef NIGHTLY_BUILD
 pref("media.block-autoplay-until-in-foreground", true);
-#else
-pref("media.block-autoplay-until-in-foreground", false);
-#endif
 
 #ifdef MOZ_STYLO
 // Is the Servo-backed style system enabled?
@@ -5443,12 +5419,8 @@ pref("security.data_uri.block_toplevel_data_uri_navigations", true);
 // If true, all FTP subresource loads will be blocked.
 pref("security.block_ftp_subresources", true);
 
-// Disable Storage api in release builds.
-#ifdef NIGHTLY_BUILD
-pref("dom.storageManager.enabled", true);
-#else
+// Disable Storage api by default. This needs specific front-end parts to be usable.
 pref("dom.storageManager.enabled", false);
-#endif
 
 // DoS protection for HTTP Auth prompt spawning.
 // -1 = completely disable HTTP Auth prompting. (careful!)
diff --git a/netwerk/protocol/http/nsHttpTransaction.cpp b/netwerk/protocol/http/nsHttpTransaction.cpp
index e7f3ca0eff..9c5895cb07 100644
--- a/netwerk/protocol/http/nsHttpTransaction.cpp
+++ b/netwerk/protocol/http/nsHttpTransaction.cpp
@@ -765,7 +765,10 @@ nsHttpTransaction::ReadSegments(nsAHttpSegmentReader *reader,
 
     if (!mConnected && !m0RTTInProgress) {
         mConnected = true;
-        mConnection->GetSecurityInfo(getter_AddRefs(mSecurityInfo));
+        nsCOMPtr<nsISupports> info;
+        mConnection->GetSecurityInfo(getter_AddRefs(info));
+        MutexAutoLock lock(mLock);
+        mSecurityInfo = std::move(info);
     }
 
     mDeferredSendProgress = false;
@@ -1314,7 +1317,10 @@ nsHttpTransaction::Restart()
         seekable->Seek(nsISeekableStream::NS_SEEK_SET, 0);
 
     // clear old connection state...
-    mSecurityInfo = nullptr;
+    {
+      MutexAutoLock lock(mLock);
+      mSecurityInfo = nullptr;
+    }
     if (mConnection) {
         if (!mReuseOnRestart) {
             mConnection->DontReuse();
@@ -2489,7 +2495,10 @@ nsHttpTransaction::Finish0RTT(bool aRestart, bool aAlpnChanged /* ignored */)
     } else if (!mConnected) {
         // this is code that was skipped in ::ReadSegments while in 0RTT
         mConnected = true;
-        mConnection->GetSecurityInfo(getter_AddRefs(mSecurityInfo));
+        nsCOMPtr<nsISupports> info;
+        mConnection->GetSecurityInfo(getter_AddRefs(info));
+        MutexAutoLock lock(mLock);
+        mSecurityInfo = std::move(info);
     }
     return NS_OK;
 }