--- a/browser/config/mozconfigs/linux64/source
+++ b/browser/config/mozconfigs/linux64/source
@@ -1,4 +1,5 @@
 # The source "build" only needs a mozconfig because we use the build system as
 # our script for generating it. This allows us to run configure without any
 # extra dependencies on specific toolchains, e.g. gtk3.
 ac_add_options --disable-compile-environment
+ac_add_options --disable-nodejs

--- a/build/moz.configure/warnings.configure
+++ b/build/moz.configure/warnings.configure
@@ -26,16 +26,19 @@ add_gcc_warning('-Wempty-body')
 add_gcc_warning('-Wignored-qualifiers')
 
 # function declaration hides virtual function from base class
 add_gcc_warning('-Woverloaded-virtual', cxx_compiler)
 
 # catches pointer arithmetic using NULL or sizeof(void)
 add_gcc_warning('-Wpointer-arith')
 
+# catch modifying constructor parameter that shadows member variable
+check_and_add_gcc_warning('-Wshadow-field-in-constructor-modified')
+
 # catches comparing signed/unsigned ints
 add_gcc_warning('-Wsign-compare')
 
 # catches overflow bugs, few false positives
 add_gcc_warning('-Wtype-limits')
 
 # catches some dead code
 add_gcc_warning('-Wunreachable-code')
@@ -45,21 +48,26 @@ check_and_add_gcc_warning('-Wunreachable
 add_gcc_warning('-Wwrite-strings', cxx_compiler)
 
 # turned on by -Wall, but we use offsetof on non-POD types frequently
 add_gcc_warning('-Wno-invalid-offsetof', cxx_compiler)
 
 # catches objects passed by value to variadic functions.
 check_and_add_gcc_warning('-Wclass-varargs')
 
+# catches some implicit conversion of floats to ints
+check_and_add_gcc_warning('-Wfloat-overflow-conversion')
+check_and_add_gcc_warning('-Wfloat-zero-conversion')
+
 # catches issues around loops
 check_and_add_gcc_warning('-Wloop-analysis')
 
 # catches C++ version forward-compat issues
 check_and_add_gcc_warning('-Wc++1z-compat', cxx_compiler)
+check_and_add_gcc_warning('-Wc++2a-compat', cxx_compiler)
 
 # catches possible misuse of the comma operator
 check_and_add_gcc_warning('-Wcomma', cxx_compiler)
 
 # catches duplicated conditions in if-else-if chains
 check_and_add_gcc_warning('-Wduplicated-cond')
 
 # catches unintentional switch case fallthroughs
@@ -74,16 +82,19 @@ check_and_add_gcc_warning('-Wimplicit-fa
 # --enable-warnings-as-errors is specified so that no unexpected fatal
 # warnings are produced.
 check_and_add_gcc_warning('-Werror=non-literal-null-conversion',
                           when='--enable-warnings-as-errors')
 
 # catches string literals used in boolean expressions
 check_and_add_gcc_warning('-Wstring-conversion')
 
+# catches overlapping range comparisons that are always true or false
+check_and_add_gcc_warning('-Wtautological-overlap-compare')
+
 # we inline 'new' and 'delete' in mozalloc
 check_and_add_gcc_warning('-Wno-inline-new-delete', cxx_compiler)
 
 # Prevent the following GCC warnings from being treated as errors:
 # too many false positives
 check_and_add_gcc_warning('-Wno-error=maybe-uninitialized')
 
 # we don't want our builds held hostage when a platform-specific API

--- a/gfx/layers/wr/WebRenderCommandBuilder.cpp
+++ b/gfx/layers/wr/WebRenderCommandBuilder.cpp
@@ -383,16 +383,21 @@ struct DIGroup
       iter.Remove();
       delete data;
     }
   }
 
   static IntRect
   ToDeviceSpace(nsRect aBounds, Matrix& aMatrix, int32_t aAppUnitsPerDevPixel, LayerIntPoint aOffset)
   {
+    // RoundedOut can convert empty rectangles to non-empty ones
+    // so special case them here
+    if (aBounds.IsEmpty()) {
+      return IntRect();
+    }
     return RoundedOut(aMatrix.TransformBounds(ToRect(nsLayoutUtils::RectToGfxRect(aBounds, aAppUnitsPerDevPixel)))) - aOffset.ToUnknownPoint();
   }
 
   void ComputeGeometryChange(nsDisplayItem* aItem, BlobItemData* aData, Matrix& aMatrix, nsDisplayListBuilder* aBuilder)
   {
     // If the frame is marked as invalidated, and didn't specify a rect to invalidate then we want to
     // invalidate both the old and new bounds, otherwise we only want to invalidate the changed areas.
     // If we do get an invalid rect, then we want to add this on top of the change areas.

--- a/js/src/frontend/ForOfLoopControl.cpp
+++ b/js/src/frontend/ForOfLoopControl.cpp
@@ -119,16 +119,25 @@ ForOfLoopControl::emitIteratorCloseInSco
                                        allowSelfHosted_))
     {
         return false;
     }
     ptrdiff_t end = bce->offset();
     return bce->tryNoteList.append(JSTRY_FOR_OF_ITERCLOSE, 0, start, end);
 }
 
+// Since we're in the middle of emitting code that will leave
+// |bce->innermostEmitterScope()|, passing the innermost emitter scope to
+// emitIteratorCloseInScope and looking up .generator there would be very,
+// very wrong.  We'd find .generator in the function environment, and we'd
+// compute a NameLocation with the correct slot, but we'd compute a
+// hop-count to the function environment that was too big.  At runtime we'd
+// either crash, or we'd find a user-controllable value in that slot, and
+// Very Bad Things would ensue as we reinterpreted that value as an
+// iterator.
 bool
 ForOfLoopControl::emitPrepareForNonLocalJumpFromScope(BytecodeEmitter* bce,
                                                       EmitterScope& currentScope,
                                                       bool isTarget)
 {
     // Pop unnecessary value from the stack.  Effectively this means
     // leaving try-catch block.  However, the performing IteratorClose can
     // reach the depth for try-catch, and effectively re-enter the

new file mode 100644
--- /dev/null
+++ b/js/src/jit-test/tests/auto-regress/bug1454285.js
@@ -0,0 +1,86 @@
+// IteratorClose in for-await-of with block-scoped function.
+
+// Non-local-jump without target.
+
+(async function() {
+    for await (let c of []) {
+        function f() {};
+        return;
+    }
+})();
+(async function() {
+    for await (let c of []) {
+        function f() {};
+        break;
+    }
+})();
+(async function() {
+    for await (let c of []) {
+        function f() {};
+        continue;
+    }
+})();
+
+// Non-local-jump with target.
+
+(async function() {
+    for (let x of []) {
+        x: for (let y of []) {
+            for await (let c of []) {
+                function f() {};
+                return;
+            }
+        }
+    }
+})();
+(async function() {
+    for (let x of []) {
+        x: for (let y of []) {
+            for await (let c of []) {
+                function f() {};
+                break x;
+            }
+        }
+    }
+})();
+(async function() {
+    for (let x of []) {
+        x: for (let y of []) {
+            for await (let c of []) {
+                function f() {};
+                continue x;
+            }
+        }
+    }
+})();
+
+(async function() {
+    for await (let x of []) {
+        x: for await (let y of []) {
+            for await (let c of []) {
+                function f() {};
+                return;
+            }
+        }
+    }
+})();
+(async function() {
+    for await (let x of []) {
+        x: for await (let y of []) {
+            for await (let c of []) {
+                function f() {};
+                break x;
+            }
+        }
+    }
+})();
+(async function() {
+    for await (let x of []) {
+        x: for await (let y of []) {
+            for await (let c of []) {
+                function f() {};
+                continue x;
+            }
+        }
+    }
+})();

deleted file mode 100644
--- a/js/src/jit-test/tests/debug/Debugger-findScripts-21.js
+++ /dev/null
@@ -1,21 +0,0 @@
-// Test that delazification works after compartment merging.
-
-if (helperThreadCount() === 0)
-  quit(0);
-
-var g = newGlobal();
-var dbg = new Debugger(g);
-
-var log;
-dbg.onNewScript = function (s) {
-  log += "s";
-  log += dbg.findScripts({ source: s.source }).length;
-}
-
-// Delazify everything just in case before we start the off-thread compile.
-dbg.findScripts();
-
-log = "";
-g.offThreadCompileScript("function inner() { function inner2() { print('inner2'); } print('inner'); }");
-g.runOffThreadScript();
-assertEq(log, "s3");