diff --git a/gfx/thebes/gfxFontEntry.cpp b/gfx/thebes/gfxFontEntry.cpp
index e8bb39e689..bfc7cee2f7 100644
--- a/gfx/thebes/gfxFontEntry.cpp
+++ b/gfx/thebes/gfxFontEntry.cpp
@@ -495,7 +495,7 @@ public:
 
 private:
     // The font table data block
-    nsTArray<uint8_t> mTableData;
+    const nsTArray<uint8_t> mTableData;
 
     // The blob destroy function needs to know the owning font entry
     // so that it can hold the font-entry's reference while modifying the
@@ -591,11 +591,16 @@ gfxFontEntry::ShareFontTableAndGetBlob(uint32_t aTag,
       mFontTableCache = MakeUnique<nsTHashtable<FontTableHashEntry>>(8);
     }
 
-    FontTableHashEntry *entry = mFontTableCache->PutEntry(aTag);
-    if (MOZ_UNLIKELY(!entry)) { // OOM
-        return nullptr;
+    FontTableHashEntry* entry;
+    if (MOZ_UNLIKELY(entry = mFontTableCache->GetEntry(aTag))) {
+      // We must have been racing with another GetFontTable for the same table,
+      // and it won the race and filled in the entry before us.
+      // Ignore `aBuffer` in that case, and return a reference to the existing blob.
+      return entry->GetBlob();
     }
 
+    entry = mFontTableCache->PutEntry(aTag);
+
     if (!aBuffer) {
         // ensure the entry is null
         entry->Clear();
diff --git a/gfx/thebes/gfxFontEntry.h b/gfx/thebes/gfxFontEntry.h
index 162fe4f083..04f27a3799 100644
--- a/gfx/thebes/gfxFontEntry.h
+++ b/gfx/thebes/gfxFontEntry.h
@@ -265,7 +265,7 @@ public:
     // unregisters the table from the font entry.
     //
     // Pass nullptr for aBuffer to indicate that the table is not present and
-    // nullptr will be returned.  Also returns nullptr on OOM.
+    // nullptr will be returned.
     hb_blob_t *ShareFontTableAndGetBlob(uint32_t aTag,
                                         nsTArray<uint8_t>* aTable);
 
diff --git a/js/src/jsnativestack.cpp b/js/src/jsnativestack.cpp
index d83e06c241..81f3d510ee 100644
--- a/js/src/jsnativestack.cpp
+++ b/js/src/jsnativestack.cpp
@@ -107,15 +107,14 @@ js::GetNativeStackBaseImpl()
     pthread_t thread = pthread_self();
     pthread_attr_t sattr;
     pthread_attr_init(&sattr);
-    pthread_getattr_np(thread, &sattr);
+    int rc = pthread_getattr_np(thread, &sattr);
+    MOZ_RELEASE_ASSERT(rc == 0, "Call to pthread_getattr_np failed.");
 
     // stackBase will be the *lowest* address on all architectures.
     void* stackBase = nullptr;
     size_t stackSize = 0;
-    int rc = pthread_attr_getstack(&sattr, &stackBase, &stackSize);
-    if (rc) {
-        MOZ_CRASH("Call to pthread_attr_getstack failed, unable to setup stack range for JS.");
-    }
+    rc = pthread_attr_getstack(&sattr, &stackBase, &stackSize);
+    MOZ_RELEASE_ASSERT(rc == 0, "Call to pthread_attr_getstack failed, unable to setup stack range for JS.");
     MOZ_RELEASE_ASSERT(stackBase, "Invalid stack base, unable to setup stack range for JS.");
     pthread_attr_destroy(&sattr);
 
@@ -131,6 +130,7 @@ js::GetNativeStackBaseImpl()
 void*
 js::GetNativeStackBaseImpl()
 {
+    int rc;
     pthread_t thread = pthread_self();
 # if defined(XP_DARWIN) || defined(DARWIN)
     return pthread_get_stackaddr_np(thread);
@@ -148,14 +148,15 @@ js::GetNativeStackBaseImpl()
      * FIXME: this function is non-portable;
      * other POSIX systems may have different np alternatives
      */
-    pthread_getattr_np(thread, &sattr);
+    rc = pthread_getattr_np(thread, &sattr);
+    MOZ_RELEASE_ASSERT(rc == 0, "Call to pthread_getattr_np failed.");
 #  endif
 
     void* stackBase = 0;
     size_t stackSize = 0;
-    int rc;
 # if defined(__OpenBSD__)
     rc = pthread_stackseg_np(pthread_self(), &ss);
+    MOZ_RELEASE_ASSERT(rc == 0, "Call to pthread_stackseg_np failed, unable to setup stack range for JS.");
     stackBase = (void*)((size_t) ss.ss_sp - ss.ss_size);
     stackSize = ss.ss_size;
 # elif defined(ANDROID)
@@ -198,10 +199,8 @@ js::GetNativeStackBaseImpl()
     // differs between libc implementations and could imply /proc access etc.
     // which may not work in restricted environments.
     rc = pthread_attr_getstack(&sattr, &stackBase, &stackSize);
+    MOZ_RELEASE_ASSERT(rc == 0, "Call to pthread_attr_getstack failed, unable to setup stack range for JS.");
 # endif
-    if (rc) {
-        MOZ_CRASH("Call to pthread_attr_getstack failed, unable to setup stack range for JS.");
-    }
     MOZ_RELEASE_ASSERT(stackBase, "Invalid stack base, unable to setup stack range for JS.");
     pthread_attr_destroy(&sattr);
 
diff --git a/security/nss/lib/pkcs12/p12d.c b/security/nss/lib/pkcs12/p12d.c
index d148d48d5f..3474acb87a 100644
--- a/security/nss/lib/pkcs12/p12d.c
+++ b/security/nss/lib/pkcs12/p12d.c
@@ -829,6 +829,7 @@ sec_pkcs12_decoder_asafes_notify(void *arg, PRBool before, void *dest,
                 safeContentsCtx->safeContentsA1Dcx = NULL;
             }
             cinfo = SEC_PKCS7DecoderFinish(p12dcx->currentASafeP7Dcx);
+            SEC_ASN1DecoderClearFilterProc(p12dcx->aSafeA1Dcx);
             p12dcx->currentASafeP7Dcx = NULL;
             if (!cinfo) {
                 p12dcx->errorValue = PORT_GetError();