diff -Nru firefox-85.0+build1/debian/changelog firefox-85.0+build1/debian/changelog
--- firefox-85.0+build1/debian/changelog	2021-01-18 21:10:17.000000000 +0000
+++ firefox-85.0+build1/debian/changelog	2021-02-02 20:16:16.000000000 +0000
@@ -1,3 +1,10 @@
+firefox (85.0+build1-0ubuntu0.20.10.2) groovy; urgency=medium
+
+  * Cherry-pick an upstream commit to address a startup hang (LP: #1914147)
+    - debian/patches/upstream-fix-startup-hang.patch
+
+ -- Olivier Tilloy <olivier.tilloy@canonical.com>  Tue, 02 Feb 2021 21:16:16 +0100
+
 firefox (85.0+build1-0ubuntu0.20.10.1) groovy; urgency=medium
 
   * New upstream release (85.0+build1)
diff -Nru firefox-85.0+build1/debian/patches/series firefox-85.0+build1/debian/patches/series
--- firefox-85.0+build1/debian/patches/series	2021-01-18 21:08:17.000000000 +0000
+++ firefox-85.0+build1/debian/patches/series	2021-02-02 20:16:11.000000000 +0000
@@ -15,3 +15,4 @@
 s390x-fix-hidden-symbol.patch
 armhf-clang-no-integrated-as-for-neon.patch
 armhf-do-not-build-qcms-with-neon.patch
+upstream-fix-startup-hang.patch
diff -Nru firefox-85.0+build1/debian/patches/upstream-fix-startup-hang.patch firefox-85.0+build1/debian/patches/upstream-fix-startup-hang.patch
--- firefox-85.0+build1/debian/patches/upstream-fix-startup-hang.patch	1970-01-01 00:00:00.000000000 +0000
+++ firefox-85.0+build1/debian/patches/upstream-fix-startup-hang.patch	2021-02-02 20:15:57.000000000 +0000
@@ -0,0 +1,36 @@
+
+# HG changeset patch
+# User Kershaw Chang <kershaw@mozilla.com>
+# Date 1610706521 0
+# Node ID 5f0a8b3326e78e83da476c8d34842a5b3390072d
+# Parent  3ff621cea4dcd1b0c87391f689d272deea70c4b2
+Bug 1679933 - Call EnsureNSSInitializedChromeOrContent() during nsHttpHandler initialization r=necko-reviewers,dragana
+
+Differential Revision: https://phabricator.services.mozilla.com/D101782
+
+diff --git a/netwerk/base/nsNetUtil.cpp b/netwerk/base/nsNetUtil.cpp
+--- a/netwerk/base/nsNetUtil.cpp
++++ b/netwerk/base/nsNetUtil.cpp
+@@ -2709,19 +2709,18 @@ void net_EnsurePSMInit() {
+   if (XRE_IsSocketProcess()) {
+     EnsureNSSInitializedChromeOrContent();
+     return;
+   }
+ 
+   MOZ_ASSERT(XRE_IsParentProcess());
+   MOZ_ASSERT(NS_IsMainThread());
+ 
+-  nsresult rv;
+-  nsCOMPtr<nsISupports> psm = do_GetService(PSM_COMPONENT_CONTRACTID, &rv);
+-  MOZ_ASSERT(NS_SUCCEEDED(rv));
++  DebugOnly<bool> rv = EnsureNSSInitializedChromeOrContent();
++  MOZ_ASSERT(rv);
+ 
+ #ifndef MOZ_NEW_CERT_STORAGE
+   nsCOMPtr<nsISupports> cbl = do_GetService(NS_CERTBLOCKLIST_CONTRACTID);
+ #endif
+ }
+ 
+ bool NS_IsAboutBlank(nsIURI* uri) {
+   // GetSpec can be expensive for some URIs, so check the scheme first.
+