diff --git a/Cargo.lock b/Cargo.lock
index 70ed90cb92ae..fab46e1ca19c 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -4847,9 +4847,9 @@ checksum = "75ce4f9dc4a41b4c3476cc925f1efb11b66df373a8fde5d4b8915fa91b5d995e"
 
 [[package]]
 name = "smallvec"
-version = "1.8.0"
+version = "1.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f2dd574626839106c320a323308629dcb1acfc96e32a8cba364ddc61ac23ee83"
+checksum = "2fd0db749597d91ff862fd1d55ea87f7855a744a8425a64695b6fca237d1dad1"
 dependencies = [
  "serde",
 ]
diff --git a/supply-chain/audits.toml b/supply-chain/audits.toml
index b8ea6d3a4c28..ed65a9d95dfd 100644
--- a/supply-chain/audits.toml
+++ b/supply-chain/audits.toml
@@ -602,6 +602,11 @@ who = "Mike Hommey <mh+mozilla@glandium.org>"
 criteria = "safe-to-deploy"
 delta = "0.4.6 -> 0.4.7"
 
+[[audits.smallvec]]
+who = "Mike Hommey <mh+mozilla@glandium.org>"
+criteria = "safe-to-deploy"
+delta = "1.8.0 -> 1.9.0"
+
 [[audits.svg_fmt]]
 who = "Bobby Holley <bobbyholley@gmail.com>"
 criteria = "safe-to-deploy"
diff --git a/third_party/rust/smallvec/.cargo-checksum.json b/third_party/rust/smallvec/.cargo-checksum.json
index 36c34f3a92f2..8f4d7bf91387 100644
--- a/third_party/rust/smallvec/.cargo-checksum.json
+++ b/third_party/rust/smallvec/.cargo-checksum.json
@@ -1 +1 @@
-{"files":{"Cargo.toml":"94a908a090a75ef2e262dd128e46129628873c13d7fdbf57d9718efd3ac59567","LICENSE-APACHE":"a60eea817514531668d7e00765731449fe14d059d3249e0bc93b36de45f759f2","LICENSE-MIT":"0b28172679e0009b655da42797c03fd163a3379d5cfa67ba1f1655e974a2a1a9","README.md":"a01127c37308457e8d396b176fb790846be0978c173be3f13260b62efcef011b","benches/bench.rs":"ede0ed2f95612e90261d473f42e26e7b4acb98e9675d051767821391497cd20b","scripts/run_miri.sh":"0d0b8c54c73fa9da1217d29ed0984f8328dd9fb61bb5a02db44458c360cdc3c4","src/arbitrary.rs":"22e55cfbf60374945b30e6d0855129eff67cd8b878cef6fa997e1f4be67b9e3d","src/lib.rs":"87e1ca95b06bde34f330f0253ddc8074785a6204be96fe0317747bfed611aed3","src/specialization.rs":"46433586203399251cba496d67b88d34e1be3c2b591986b77463513da1c66471","src/tests.rs":"2bcf69dc0597e4e8a59a92566a3dd5c82ec3a1ea563aa006ea0f4a2722cb2d17","tests/macro.rs":"22ad4f6f104a599fdcba19cad8834105b8656b212fb6c7573a427d447f5db14f"},"package":"f2dd574626839106c320a323308629dcb1acfc96e32a8cba364ddc61ac23ee83"}
\ No newline at end of file
+{"files":{"Cargo.toml":"03ae7e6a133c5fd1685687aee67bc841642a4fd0deeb0d4d88b9fe27af37ba9e","LICENSE-APACHE":"a60eea817514531668d7e00765731449fe14d059d3249e0bc93b36de45f759f2","LICENSE-MIT":"0b28172679e0009b655da42797c03fd163a3379d5cfa67ba1f1655e974a2a1a9","README.md":"a01127c37308457e8d396b176fb790846be0978c173be3f13260b62efcef011b","benches/bench.rs":"e2a235d68be20996014c00468b369887d2041ce95486625de3cef35b8f2e4acd","scripts/run_miri.sh":"0d0b8c54c73fa9da1217d29ed0984f8328dd9fb61bb5a02db44458c360cdc3c4","src/arbitrary.rs":"22e55cfbf60374945b30e6d0855129eff67cd8b878cef6fa997e1f4be67b9e3d","src/lib.rs":"264a6e6863aeb21cd779588c2add8421ea1a5861a9bb8ef49e9dc529be8d3b20","src/specialization.rs":"46433586203399251cba496d67b88d34e1be3c2b591986b77463513da1c66471","src/tests.rs":"2bcf69dc0597e4e8a59a92566a3dd5c82ec3a1ea563aa006ea0f4a2722cb2d17","tests/macro.rs":"22ad4f6f104a599fdcba19cad8834105b8656b212fb6c7573a427d447f5db14f"},"package":"2fd0db749597d91ff862fd1d55ea87f7855a744a8425a64695b6fca237d1dad1"}
\ No newline at end of file
diff --git a/third_party/rust/smallvec/Cargo.toml b/third_party/rust/smallvec/Cargo.toml
index 7ff65deb7f36..fd490da15e41 100644
--- a/third_party/rust/smallvec/Cargo.toml
+++ b/third_party/rust/smallvec/Cargo.toml
@@ -12,14 +12,14 @@
 [package]
 edition = "2018"
 name = "smallvec"
-version = "1.8.0"
+version = "1.9.0"
 authors = ["The Servo Project Developers"]
 description = "'Small vector' optimization: store up to a small number of items on the stack"
 documentation = "https://docs.rs/smallvec/"
 readme = "README.md"
 keywords = ["small", "vec", "vector", "stack", "no_std"]
 categories = ["data-structures"]
-license = "MIT/Apache-2.0"
+license = "MIT OR Apache-2.0"
 repository = "https://github.com/servo/rust-smallvec"
 [package.metadata.docs.rs]
 all-features = true
diff --git a/third_party/rust/smallvec/benches/bench.rs b/third_party/rust/smallvec/benches/bench.rs
index ad73226f6b0e..b52ee155047a 100644
--- a/third_party/rust/smallvec/benches/bench.rs
+++ b/third_party/rust/smallvec/benches/bench.rs
@@ -96,6 +96,8 @@ make_benches! {
     SmallVec<[u64; VEC_SIZE]> {
         bench_push => gen_push(SPILLED_SIZE as _),
         bench_push_small => gen_push(VEC_SIZE as _),
+        bench_insert_push => gen_insert_push(SPILLED_SIZE as _),
+        bench_insert_push_small => gen_insert_push(VEC_SIZE as _),
         bench_insert => gen_insert(SPILLED_SIZE as _),
         bench_insert_small => gen_insert(VEC_SIZE as _),
         bench_remove => gen_remove(SPILLED_SIZE as _),
@@ -118,6 +120,8 @@ make_benches! {
     Vec<u64> {
         bench_push_vec => gen_push(SPILLED_SIZE as _),
         bench_push_vec_small => gen_push(VEC_SIZE as _),
+        bench_insert_push_vec => gen_insert_push(SPILLED_SIZE as _),
+        bench_insert_push_vec_small => gen_insert_push(VEC_SIZE as _),
         bench_insert_vec => gen_insert(SPILLED_SIZE as _),
         bench_insert_vec_small => gen_insert(VEC_SIZE as _),
         bench_remove_vec => gen_remove(SPILLED_SIZE as _),
@@ -151,6 +155,21 @@ fn gen_push<V: Vector<u64>>(n: u64, b: &mut Bencher) {
     });
 }
 
+fn gen_insert_push<V: Vector<u64>>(n: u64, b: &mut Bencher) {
+    #[inline(never)]
+    fn insert_push_noinline<V: Vector<u64>>(vec: &mut V, x: u64) {
+        vec.insert(x as usize, x);
+    }
+
+    b.iter(|| {
+        let mut vec = V::new();
+        for x in 0..n {
+            insert_push_noinline(&mut vec, x);
+        }
+        vec
+    });
+}
+
 fn gen_insert<V: Vector<u64>>(n: u64, b: &mut Bencher) {
     #[inline(never)]
     fn insert_noinline<V: Vector<u64>>(vec: &mut V, p: usize, x: u64) {
diff --git a/third_party/rust/smallvec/src/lib.rs b/third_party/rust/smallvec/src/lib.rs
index 1699a712509e..921347af8d2f 100644
--- a/third_party/rust/smallvec/src/lib.rs
+++ b/third_party/rust/smallvec/src/lib.rs
@@ -392,8 +392,11 @@ impl<'a, T: 'a + Array> Drop for Drain<'a, T> {
                 let start = source_vec.len();
                 let tail = self.tail_start;
                 if tail != start {
-                    let src = source_vec.as_ptr().add(tail);
-                    let dst = source_vec.as_mut_ptr().add(start);
+                    // as_mut_ptr creates a &mut, invalidating other pointers.
+                    // This pattern avoids calling it with a pointer already present.
+                    let ptr = source_vec.as_mut_ptr();
+                    let src = ptr.add(tail);
+                    let dst = ptr.add(start);
                     ptr::copy(src, dst, self.tail_len);
                 }
                 source_vec.set_len(start + self.tail_len);
@@ -813,13 +816,14 @@ impl<A: Array> SmallVec<A> {
         unsafe {
             self.set_len(start);
 
-            let range_slice = slice::from_raw_parts_mut(self.as_mut_ptr().add(start), end - start);
+            let range_slice = slice::from_raw_parts(self.as_ptr().add(start), end - start);
 
             Drain {
                 tail_start: end,
                 tail_len: len - end,
                 iter: range_slice.iter(),
-                vec: NonNull::from(self),
+                // Since self is a &mut, passing it to a function would invalidate the slice iterator.
+                vec: NonNull::new_unchecked(self as *mut _),
             }
         }
     }
@@ -1064,17 +1068,22 @@ impl<A: Array> SmallVec<A> {
 
     /// Insert an element at position `index`, shifting all elements after it to the right.
     ///
-    /// Panics if `index` is out of bounds.
+    /// Panics if `index > len`.
     pub fn insert(&mut self, index: usize, element: A::Item) {
         self.reserve(1);
 
         unsafe {
             let (mut ptr, len_ptr, _) = self.triple_mut();
             let len = *len_ptr;
-            assert!(index <= len);
-            *len_ptr = len + 1;
             ptr = ptr.add(index);
-            ptr::copy(ptr, ptr.add(1), len - index);
+            if index < len {
+                ptr::copy(ptr, ptr.add(1), len - index);
+            } else if index == len {
+                // No elements need shifting.
+            } else {
+                panic!("index exceeds length");
+            }
+            *len_ptr = len + 1;
             ptr::write(ptr, element);
         }
     }
@@ -1112,6 +1121,10 @@ impl<A: Array> SmallVec<A> {
                 len: old_len + lower_size_bound,
             };
 
+            // The set_len above invalidates the previous pointers, so we must re-create them.
+            let start = self.as_mut_ptr();
+            let ptr = start.add(index);
+
             while num_added < lower_size_bound {
                 let element = match iter.next() {
                     Some(x) => x,
@@ -1219,6 +1232,15 @@ impl<A: Array> SmallVec<A> {
         self.truncate(len - del);
     }
 
+    /// Retains only the elements specified by the predicate.
+    ///
+    /// This method is identical in behaviour to [`retain`]; it is included only
+    /// to maintain api-compatability with `std::Vec`, where the methods are
+    /// separate for historical reasons.
+    pub fn retain_mut<F: FnMut(&mut A::Item) -> bool>(&mut self, f: F) {
+        self.retain(f)
+    }
+
     /// Removes consecutive duplicate elements.
     pub fn dedup(&mut self)
     where