--- a/security/manager/ssl/tests/unit/test_pkcs11_module.js
+++ b/security/manager/ssl/tests/unit/test_pkcs11_module.js
@@ -97,16 +97,36 @@ function run_test() {
 
   // Check that finding the test slot by name is possible, and that trying to
   // find a non-present slot fails.
   notEqual(testModule.findSlotByName("Test PKCS11 Slot"), null,
            "Test slot should be findable by name");
   throws(() => testModule.findSlotByName("Not Present"), /NS_ERROR_FAILURE/,
          "Non-present slot should not be findable by name");
 
+  // Check that the strangely named nsIPKCS11ModuleDB.findSlotByName() works.
+  // In particular, a comment in nsPKCS11Slot.cpp notes that the method
+  // "is essentially the same as nsIPK11Token::findTokenByName, except that it
+  //  returns an nsIPKCS11Slot".
+  let strBundleSvc = Cc["@mozilla.org/intl/stringbundle;1"]
+                       .getService(Ci.nsIStringBundleService);
+  let bundle =
+    strBundleSvc.createBundle("chrome://pipnss/locale/pipnss.properties");
+  let internalTokenName = bundle.GetStringFromName("PrivateTokenDescription");
+  let internalTokenAsSlot = gModuleDB.findSlotByName(internalTokenName);
+  notEqual(internalTokenAsSlot, null,
+           "Internal 'slot' should be findable by name via the module DB");
+  ok(internalTokenAsSlot instanceof Ci.nsIPKCS11Slot,
+     "Module DB findSlotByName() should return a token as an nsIPKCS11Slot");
+  equal(internalTokenAsSlot.name,
+        bundle.GetStringFromName("PrivateSlotDescription"),
+        "Spot check: actual and expected internal 'slot' names should be equal");
+  throws(() => gModuleDB.findSlotByName("Not Present"), /NS_ERROR_FAILURE/,
+         "Non-present 'slot' should not be findable by name via the module DB");
+
   // Check that deleting the test module makes it disappear from the module list.
   pkcs11.deleteModule("PKCS11 Test Module");
   checkTestModuleNotPresent();
 
   // Check miscellaneous module DB methods and attributes.
   notEqual(gModuleDB.getInternal(), null,
            "The internal module should be present");
   notEqual(gModuleDB.getInternalFIPS(), null,

--- a/security/manager/ssl/tests/unit/test_pkcs11_slot.js
+++ b/security/manager/ssl/tests/unit/test_pkcs11_slot.js
@@ -34,9 +34,16 @@ function run_test() {
   equal(testSlot.HWVersion, "0.0",
         "Actual and expected hardware version should match");
   equal(testSlot.FWVersion, "0.0",
         "Actual and expected firmware version should match");
   // Note: testSlot.status is not tested because the implementation calls
   //       PK11_IsPresent(), which checks whether the test token is present.
   //       The test module inserts and removes the test token in a tight loop,
   //       so the result might not be deterministic.
+
+  // Note: testSlot.tokenName isn't tested for the same reason testSlot.status
+  //       isn't.
+  let testToken = testSlot.getToken();
+  notEqual(testToken, null, "getToken() should succeed");
+  equal(testToken.tokenLabel, "Test PKCS11 Tokeñ Label",
+        "Spot check: the actual and expected test token labels should be equal");
 }

--- a/security/manager/ssl/tests/unit/test_pkcs11_token.js
+++ b/security/manager/ssl/tests/unit/test_pkcs11_token.js
@@ -69,37 +69,47 @@ function checkPasswordFeaturesAndResetPa
      "Token should be logged out after an incorrect password was given");
   ok(!token.needsUserInit,
      "Token should still be init with a password even if an incorrect " +
      "password was given");
 
   token.reset();
   ok(token.needsUserInit,
      "Token should need password init after reset");
+  ok(!token.isLoggedIn(), "Token should be logged out of after reset");
 }
 
 function run_test() {
   let tokenDB = Cc["@mozilla.org/security/pk11tokendb;1"]
                   .getService(Ci.nsIPK11TokenDB);
   let token = tokenDB.getInternalKeyToken();
   notEqual(token, null, "The internal token should be present");
 
   checkBasicAttributes(token);
 
   ok(!token.isLoggedIn(), "Token should not be logged into yet");
-  let initialPW = "foo 1234567890`~!#$%^&*()-_=+{[}]|\\:;'\",<.>/?";
+  // Test that attempting to log out even when the token was not logged into
+  // does not result in an error.
+  token.logoutSimple();
+  ok(!token.isLoggedIn(), "Token should still not be logged into");
+
+  let initialPW = "foo 1234567890`~!@#$%^&*()-_=+{[}]|\\:;'\",<.>/? 一二三";
   token.initPassword(initialPW);
   token.login(/*force*/ false);
   ok(token.isLoggedIn(), "Token should now be logged into");
 
   checkPasswordFeaturesAndResetPassword(token, initialPW);
 
   // We reset the password previously, so we need to initialize again.
   token.initPassword("arbitrary");
+  ok(token.isLoggedIn(),
+     "Token should be logged into after initializing password again");
   token.logoutSimple();
   ok(!token.isLoggedIn(),
      "Token should be logged out after calling logoutSimple()");
 
   ok(!token.isHardwareToken(),
      "The internal token should not be considered a hardware token");
   ok(token.isFriendly(),
      "The internal token should always be considered friendly");
+  ok(token.needsLogin(),
+     "The internal token should always need authentication");
 }