--- a/intl/locale/nsLanguageAtomService.cpp
+++ b/intl/locale/nsLanguageAtomService.cpp
@@ -65,16 +65,17 @@ nsIAtom*
 nsLanguageAtomService::GetLanguageGroup(nsIAtom* aLanguage,
                                         nsresult* aError)
 {
   nsIAtom* retVal;
 
   retVal = mLangToGroup.GetWeak(aLanguage);
 
   if (!retVal) {
+    MOZ_ASSERT(NS_IsMainThread(), "Should not append to cache off main thread");
     nsCOMPtr<nsIAtom> uncached = GetUncachedLanguageGroup(aLanguage, aError);
     retVal = uncached.get();
 
     // The hashtable will keep an owning reference to the atom
     mLangToGroup.Put(aLanguage, uncached);
   }
 
   return retVal;

--- a/js/src/devtools/rootAnalysis/analyzeHeapWrites.js
+++ b/js/src/devtools/rootAnalysis/analyzeHeapWrites.js
@@ -207,16 +207,17 @@ function treatAsSafeArgument(entry, varN
         ["Gecko_ClearWillChange", "aDisplay", null],
         ["Gecko_AppendWillChange", "aDisplay", null],
         ["Gecko_CopyWillChangeFrom", "aDest", null],
         ["Gecko_InitializeImageCropRect", "aImage", null],
         ["Gecko_CopyShapeSourceFrom", "aDst", null],
         ["Gecko_DestroyShapeSource", "aShape", null],
         ["Gecko_StyleShapeSource_SetURLValue", "aShape", null],
         ["Gecko_nsFont_InitSystem", "aDest", null],
+        ["Gecko_nsStyleFont_FixupNoneGeneric", "aFont", null],
         ["Gecko_StyleTransition_SetUnsupportedProperty", "aTransition", null],
     ];
     for (var [entryMatch, varMatch, csuMatch] of whitelist) {
         assert(entryMatch || varMatch || csuMatch);
         if (entryMatch && !nameMatches(entry.name, entryMatch))
             continue;
         if (varMatch && !nameMatches(varName, varMatch))
             continue;

--- a/layout/base/StaticPresData.cpp
+++ b/layout/base/StaticPresData.cpp
@@ -277,21 +277,23 @@ StaticPresData::GetFontPrefsForLangHelpe
       if (prefs->mLangGroup == langGroupAtom) {
         return prefs;
       }
       if (!prefs->mNext) {
         break;
       }
       prefs = prefs->mNext;
     }
-
+    MOZ_ASSERT(NS_IsMainThread(), "Should not append to cache off main thread");
     // nothing cached, so go on and fetch the prefs for this lang group:
     prefs = prefs->mNext = new LangGroupFontPrefs;
   }
 
+  MOZ_ASSERT(NS_IsMainThread(), "Should not append to cache off main thread");
+
   prefs->Initialize(langGroupAtom);
 
   return prefs;
 }
 
 const nsFont*
 StaticPresData::GetDefaultFontHelper(uint8_t aFontID, nsIAtom *aLanguage,
                                      const LangGroupFontPrefs* aPrefs) const

--- a/layout/style/ServoSpecifiedValues.cpp
+++ b/layout/style/ServoSpecifiedValues.cpp
@@ -43,16 +43,22 @@ ServoSpecifiedValues::PropertyIsSet(nsCS
 }
 
 void
 ServoSpecifiedValues::SetIdentStringValue(nsCSSPropertyID aId,
                                           const nsString& aValue)
 {
   nsCOMPtr<nsIAtom> atom = NS_Atomize(aValue);
   Servo_DeclarationBlock_SetIdentStringValue(mDecl, aId, atom);
+  if (aId == eCSSProperty__x_lang) {
+    // This forces the lang prefs result to be cached
+    // so that we can access them off main thread during traversal
+    mPresContext->GetDefaultFont(kPresContext_DefaultVariableFont_ID,
+                                 atom);
+  }
 }
 
 void
 ServoSpecifiedValues::SetKeywordValue(nsCSSPropertyID aId, int32_t aValue)
 {
   Servo_DeclarationBlock_SetKeywordValue(mDecl, aId, aValue);
 }