--- a/browser/base/content/tabbrowser.js
+++ b/browser/base/content/tabbrowser.js
@@ -5095,18 +5095,18 @@ class TabProgressListener {
   }
   /* eslint-enable complexity */
 
   onLocationChange(aWebProgress, aRequest, aLocation, aFlags) {
     // OnLocationChange is called for both the top-level content
     // and the subframes.
     let topLevel = aWebProgress.isTopLevel;
 
+    let isSameDocument = !!(aFlags & Ci.nsIWebProgressListener.LOCATION_CHANGE_SAME_DOCUMENT);
     if (topLevel) {
-      let isSameDocument = !!(aFlags & Ci.nsIWebProgressListener.LOCATION_CHANGE_SAME_DOCUMENT);
       let isReload = !!(aFlags & Ci.nsIWebProgressListener.LOCATION_CHANGE_RELOAD);
       let isErrorPage = !!(aFlags & Ci.nsIWebProgressListener.LOCATION_CHANGE_ERROR_PAGE);
 
       // We need to clear the typed value
       // if the document failed to load, to make sure the urlbar reflects the
       // failed URI (particularly for SSL errors). However, don't clear the value
       // if the error page's URI is about:blank, because that causes complete
       // loss of urlbar contents for invalid URI errors (see bug 867957).
@@ -5194,20 +5194,22 @@ class TabProgressListener {
           gBrowser._getSwitcher().cleanUpTabAfterEviction(this.mTab);
         }
       }
     }
 
     if (!this.mBlank) {
       this._callProgressListeners("onLocationChange",
                                   [aWebProgress, aRequest, aLocation, aFlags]);
-      // Include the true final argument to indicate that this event is
-      // simulated (instead of being observed by the webProgressListener).
-      this._callProgressListeners("onContentBlockingEvent",
-                                  [aWebProgress, null, 0, true]);
+      if (topLevel && !isSameDocument) {
+        // Include the true final argument to indicate that this event is
+        // simulated (instead of being observed by the webProgressListener).
+        this._callProgressListeners("onContentBlockingEvent",
+                                    [aWebProgress, null, 0, true]);
+      }
     }
 
     if (topLevel) {
       this.mBrowser.lastURI = aLocation;
       this.mBrowser.lastLocationChange = Date.now();
     }
   }
 

--- a/dom/base/nsContentUtils.cpp
+++ b/dom/base/nsContentUtils.cpp
@@ -232,17 +232,17 @@
 #include "mozilla/dom/TabGroup.h"
 #include "nsIWebNavigationInfo.h"
 #include "nsPluginHost.h"
 #include "nsIBrowser.h"
 #include "mozilla/HangAnnotations.h"
 #include "mozilla/Encoding.h"
 #include "nsXULElement.h"
 #include "mozilla/RecordReplay.h"
-
+#include "nsThreadManager.h"
 #include "nsIBidiKeyboard.h"
 
 #if defined(XP_WIN)
 // Undefine LoadImage to prevent naming conflict with Windows.
 #  undef LoadImage
 #endif
 
 extern "C" int MOZ_XMLTranslateEntity(const char* ptr, const char* end,
@@ -10430,16 +10430,30 @@ static bool JSONCreator(const char16_t* 
   nsAutoString serializedValue;
   NS_ENSURE_TRUE(JS_Stringify(aCx, &value, nullptr, JS::NullHandleValue,
                               JSONCreator, &serializedValue),
                  false);
   aOutStr = serializedValue;
   return true;
 }
 
+/* static */
+bool nsContentUtils::HighPriorityEventPendingForTopLevelDocumentBeforeContentfulPaint(
+    Document* aDocument) {
+  if (!aDocument) {
+    return false;
+  }
+
+  Document* topLevel = aDocument->GetTopLevelContentDocument();
+  return topLevel && topLevel->GetShell() &&
+         topLevel->GetShell()->GetPresContext() &&
+         !topLevel->GetShell()->GetPresContext()->HadContentfulPaint() &&
+         nsThreadManager::MainThreadHasPendingHighPriorityEvents();
+}
+
 /* static */ bool nsContentUtils::IsURIInPrefList(nsIURI* aURI,
                                                   const char* aPrefName) {
   MOZ_ASSERT(aPrefName);
 
   nsAutoCString blackList;
   Preferences::GetCString(aPrefName, blackList);
   ToLowerCase(blackList);
   return IsURIInList(aURI, blackList);

--- a/dom/base/nsContentUtils.h
+++ b/dom/base/nsContentUtils.h
@@ -3299,16 +3299,24 @@ class nsContentUtils {
    *
    * Usage:
    *   nsAutoString serializedValue;
    *   nsContentUtils::StringifyJSON(cx, &value, serializedValue);
    */
   static bool StringifyJSON(JSContext* aCx, JS::MutableHandle<JS::Value> vp,
                             nsAString& aOutStr);
 
+  /**
+   * Returns true if the top level ancestor content document of aDocument hasn't
+   * yet had the first contentful paint and there is a high priority event
+   * pending in the main thread.
+   */
+  static bool HighPriorityEventPendingForTopLevelDocumentBeforeContentfulPaint(
+      Document* aDocument);
+
  private:
   static bool InitializeEventTable();
 
   static nsresult EnsureStringBundle(PropertiesFile aFile);
 
   static bool CanCallerAccess(nsIPrincipal* aSubjectPrincipal,
                               nsIPrincipal* aPrincipal);
 

--- a/gfx/layers/wr/WebRenderCommandBuilder.cpp
+++ b/gfx/layers/wr/WebRenderCommandBuilder.cpp
@@ -2008,17 +2008,17 @@ WebRenderCommandBuilder::GenerateFallbac
     paintBounds = aItem->GetClippedBounds(aDisplayListBuilder);
   }
 
   // nsDisplayItem::Paint() may refer the variables that come from
   // ComputeVisibility(). So we should call ComputeVisibility() before painting.
   // e.g.: nsDisplayBoxShadowInner uses mPaintRect in Paint() and mPaintRect is
   // computed in nsDisplayBoxShadowInner::ComputeVisibility().
   nsRegion visibleRegion(paintBounds);
-  aItem->SetPaintRect(paintBounds);
+  aItem->SetPaintRect(aItem->GetBuildingRect().Intersect(paintBounds));
   aItem->ComputeVisibility(aDisplayListBuilder, &visibleRegion);
 
   const int32_t appUnitsPerDevPixel =
       aItem->Frame()->PresContext()->AppUnitsPerDevPixel();
   auto bounds =
       LayoutDeviceRect::FromAppUnits(paintBounds, appUnitsPerDevPixel);
   if (bounds.IsEmpty()) {
     return nullptr;
@@ -2027,19 +2027,35 @@ WebRenderCommandBuilder::GenerateFallbac
   gfx::Size scale = aSc.GetInheritedScale();
   gfx::Size oldScale = fallbackData->GetScale();
   // We tolerate slight changes in scale so that we don't, for example,
   // rerasterize on MotionMark
   bool differentScale = gfx::FuzzyEqual(scale.width, oldScale.width, 1e-6f) &&
                         gfx::FuzzyEqual(scale.height, oldScale.height, 1e-6f);
 
   LayoutDeviceToLayerScale2D layerScale(scale.width, scale.height);
-  auto scaledBounds = bounds * layerScale;
-  auto dtRect = RoundedOut(scaledBounds);
+
+  auto trans =
+      ViewAs<LayerPixel>(aSc.GetSnappingSurfaceTransform().GetTranslation());
+  auto snappedTrans = LayerIntPoint::Floor(trans);
+  LayerPoint residualOffset = trans - snappedTrans;
+
+  auto dtRect = LayerIntRect::FromUnknownRect(
+      ScaleToOutsidePixelsOffset(paintBounds, scale.width, scale.height,
+                                 appUnitsPerDevPixel, residualOffset));
   auto dtSize = dtRect.Size();
+
+  auto visibleRect = LayerIntRect::FromUnknownRect(
+                         ScaleToOutsidePixelsOffset(
+                             aItem->GetBuildingRect(), scale.width,
+                             scale.height, appUnitsPerDevPixel, residualOffset))
+                         .Intersect(dtRect);
+  // visibleRect is relative to the blob origin so adjust for that
+  visibleRect -= dtRect.TopLeft();
+
   if (dtSize.IsEmpty()) {
     return nullptr;
   }
 
   aImageRect = dtRect / layerScale;
 
   auto offset = aImageRect.TopLeft();
 
@@ -2137,16 +2153,20 @@ WebRenderCommandBuilder::GenerateFallbac
         fallbackData->SetFonts(fonts);
       } else {
         // If there is no invalidation region and we don't have a image key,
         // it means we don't need to push image for the item.
         if (!fallbackData->GetBlobImageKey().isSome()) {
           return nullptr;
         }
       }
+      aResources.SetBlobImageVisibleArea(
+          fallbackData->GetBlobImageKey().value(),
+          ViewAs<ImagePixel>(visibleRect,
+                             PixelCastJustification::LayerIsImage));
     } else {
       fallbackData->CreateImageClientIfNeeded();
       RefPtr<ImageClient> imageClient = fallbackData->GetImageClient();
       RefPtr<ImageContainer> imageContainer =
           LayerManager::CreateImageContainer();
       bool isInvalidated = false;
 
       {

--- a/security/sandbox/moz.build
+++ b/security/sandbox/moz.build
@@ -154,17 +154,17 @@ elif CONFIG['OS_ARCH'] == 'WINNT':
         SOURCES += [
             'chromium/sandbox/win/src/resolver_32.cc',
             'chromium/sandbox/win/src/service_resolver_32.cc',
         ]
 
     for var in ('UNICODE', '_UNICODE', 'NS_NO_XPCOM',
                 '_CRT_RAND_S', 'CHROMIUM_SANDBOX_BUILD'):
         DEFINES[var] = True
-    if CONFIG['CC_TYPE'] != 'gcc':
+    if CONFIG['CC_TYPE'] not in ('gcc', 'clang'):
         DEFINES['SANDBOX_EXPORTS'] = True
 
     LOCAL_INCLUDES += ['/security/sandbox/chromium-shim']
     LOCAL_INCLUDES += ['/security/sandbox/chromium']
     LOCAL_INCLUDES += ['/nsprpub']
 
     DisableStlWrapping()