import changes from tenfourfox:

- #375, Bug 1112537 - Optimize String#split('foo').join('bar') pattern. (includes M1235403) r=nbp (36326dfa2)
- #415: M1373195 backport (e880223af)
- #415: M1376936 M1375331 (33344c644)
- #415: M1348095 (consolidated) (d1001e7ef)
- #413: update to HTML colspan/rowspan from M1359822, plus M1271126 + M1373095 (no tests) (6958789e8)
- #416: M1366903 M1371283 M1368576 (baaf2ee89)
- #416: M1368105 (1efa1540f)
- checkin additional JS tests (687ba7579)
- #416: M1374047 M1365413 M1369913 M1371424 M1346590 M1376087 M1322896 M1354796 M1365333 M1373970 M1355168 (1bc1dd390)
- #416: M1265568 M1305036 (257cfd929)
- #419: M1377329 (fb72079d0)
- #418: M1333106 M1337672 (b1cfd7830)
- #416: M1362924 (61ec43889)
- #416: M1365189 M1365875 (d9876efcf)
- #416: M1378147 M1371890 M1380426 (177c87d34)
- #416: note to self on M1377426 (5bcd1c461)
- fix debug bustage, shutdown crash (be4d0ed86)
- #414: new wildcard based blacklist, updated strings (6ccb443e7)
- #416: update certs/pins (797260262)
- fix FontDirWrapper off-by-one bugs and warnings (51e6a2cf9)
- 104fx_copy should also allow copying debug builds (054bbf081)
- #416: M1383000 M1376459 M1372467 M1372383 M1383002 (2f4742e52)
- #416: M1308908 M1342433(no tests) (5757a9534)
- #416: M1368362 (1cf170047)
- #72: additional debugging (0683827d2)
- #416: M1381016 M1371657 (afc820240)
- #416: update certs for FPR2 final (4ca64d74e)
- M1257208 Fix build errors with gcc >= 5 (4c64d8d6d)
with additional nsINode* to nsTextNode* change in ResetDir() in DirectionalityUtils.cpp

docshell/base/nsDocShell.cpp

@@ -11317,6 +11317,21 @@ nsDocShell::OnNewURI(nsIURI* aURI, nsIChannel* aChannel, nsISupports* aOwner,
       (void)AddToSessionHistory(aURI, aChannel, aOwner, aCloneSHChildren,
                                 getter_AddRefs(mLSHE));
     }
+  } else if (mSessionHistory && mLSHE && mURIResultedInDocument) {
+    // Even if we don't add anything to SHistory, ensure the current index
+    // points to the same SHEntry as our mLSHE.
+    int32_t index = 0;
+    mSessionHistory->GetRequestedIndex(&index);
+    if (index == -1) {
+      mSessionHistory->GetIndex(&index);
+    }
+    nsCOMPtr<nsISHEntry> currentSH;
+    mSessionHistory->GetEntryAtIndex(index, false, getter_AddRefs(currentSH));
+    if (currentSH != mLSHE) {
+      nsCOMPtr<nsISHistoryInternal> shPrivate =
+        do_QueryInterface(mSessionHistory);
+      shPrivate->ReplaceEntry(index, mLSHE);
+    }
   }
 
   // If this is a POST request, we do not want to include this in global
@@ -13861,9 +13876,15 @@ DocShellOriginAttributes
 nsDocShell::GetOriginAttributes()
 {
   DocShellOriginAttributes attrs;
+  nsCOMPtr<nsIDocument> doc;
+
+  // It is possible to have a null document. If so, act as if we are
+  // the topmost docshell, since this usually occurs on shutdown.
   RefPtr<nsDocShell> parent = GetParentDocshell();
-  if (parent) {
-    nsCOMPtr<nsIPrincipal> parentPrin = parent->GetDocument()->NodePrincipal();
+  if (MOZ_LIKELY(parent))
+    doc = parent->GetDocument();
+  if (MOZ_LIKELY(doc)) {
+    nsCOMPtr<nsIPrincipal> parentPrin = doc->NodePrincipal();
     PrincipalOriginAttributes poa = BasePrincipal::Cast(parentPrin)->OriginAttributesRef();
     attrs.InheritFromDocToChildDocShell(poa);
   } else {