diff --git a/accessible/base/nsAccessibilityService.cpp b/accessible/base/nsAccessibilityService.cpp
index 90d54e3ab6..77ee03316f 100644
--- a/accessible/base/nsAccessibilityService.cpp
+++ b/accessible/base/nsAccessibilityService.cpp
@@ -56,7 +56,7 @@
 #include "nsIObserverService.h"
 #include "nsLayoutUtils.h"
 #include "nsPluginFrame.h"
-#include "nsSVGPathGeometryFrame.h"
+#include "SVGGeometryFrame.h"
 #include "nsTreeBodyFrame.h"
 #include "nsTreeColumns.h"
 #include "nsTreeUtils.h"
@@ -1161,8 +1161,8 @@ nsAccessibilityService::CreateAccessible(nsINode* aNode,
 
   if (!newAcc) {
     if (content->IsSVGElement()) {
-      nsSVGPathGeometryFrame* pathGeometryFrame = do_QueryFrame(frame);
-      if (pathGeometryFrame) {
+      SVGGeometryFrame* geometryFrame = do_QueryFrame(frame);
+      if (geometryFrame) {
         // A graphic elements: rect, circle, ellipse, line, path, polygon,
         // polyline and image. A 'use' and 'text' graphic elements require
         // special support.
diff --git a/devtools/client/shared/curl.js b/devtools/client/shared/curl.js
index 5375bd634d..843d7d0a62 100644
--- a/devtools/client/shared/curl.js
+++ b/devtools/client/shared/curl.js
@@ -389,6 +389,7 @@ const CurlUtils = {
                         .replace(/\n/g, "\\n")
                         .replace(/\r/g, "\\r")
                         .replace(/!/g, "\\041")
+                        .replace(/([&\|])/g, "^$1")
                         .replace(/[^\x20-\x7E]/g, escapeCharacter) + "'";
     }
 
diff --git a/dom/base/nsDocument.cpp b/dom/base/nsDocument.cpp
index 09146b2fe2..079aa0fdae 100644
--- a/dom/base/nsDocument.cpp
+++ b/dom/base/nsDocument.cpp
@@ -2424,16 +2424,6 @@ nsDocument::ApplySettingsFromCSP(bool aSpeculative)
     rv = NodePrincipal()->GetCsp(getter_AddRefs(csp));
     NS_ENSURE_SUCCESS_VOID(rv);
     if (csp) {
-      // Set up any Referrer Policy specified by CSP
-      bool hasReferrerPolicy = false;
-      uint32_t referrerPolicy = mozilla::net::RP_Default;
-      rv = csp->GetReferrerPolicy(&referrerPolicy, &hasReferrerPolicy);
-      NS_ENSURE_SUCCESS_VOID(rv);
-      if (hasReferrerPolicy) {
-        mReferrerPolicy = static_cast<ReferrerPolicy>(referrerPolicy);
-        mReferrerPolicySet = true;
-      }
-
       // Set up 'block-all-mixed-content' if not already inherited
       // from the parent context or set by any other CSP.
       if (!mBlockAllMixedContent) {
diff --git a/dom/base/nsGkAtomList.h b/dom/base/nsGkAtomList.h
index 617aea60a7..15ff8b0317 100644
--- a/dom/base/nsGkAtomList.h
+++ b/dom/base/nsGkAtomList.h
@@ -2061,6 +2061,7 @@ GK_ATOM(svgFEUnstyledLeafFrame, "SVGFEUnstyledLeafFrame")
 GK_ATOM(svgFilterFrame, "SVGFilterFrame")
 GK_ATOM(svgForeignObjectFrame, "SVGForeignObjectFrame")
 GK_ATOM(svgGenericContainerFrame, "SVGGenericContainerFrame")
+GK_ATOM(svgGeometryFrame, "SVGGeometryFrame")
 GK_ATOM(svgGFrame, "SVGGFrame")
 GK_ATOM(svgGradientFrame, "SVGGradientFrame")
 GK_ATOM(svgImageFrame, "SVGImageFrame")
@@ -2071,7 +2072,6 @@ GK_ATOM(svgMarkerAnonChildFrame, "SVGMarkerAnonChildFrame")
 GK_ATOM(svgMaskFrame, "SVGMaskFrame")
 GK_ATOM(svgOuterSVGFrame, "SVGOuterSVGFrame")
 GK_ATOM(svgOuterSVGAnonChildFrame, "SVGOuterSVGAnonChildFrame")
-GK_ATOM(svgPathGeometryFrame, "SVGPathGeometryFrame")
 GK_ATOM(svgPatternFrame, "SVGPatternFrame")
 GK_ATOM(svgRadialGradientFrame, "SVGRadialGradientFrame")
 GK_ATOM(svgStopFrame, "SVGStopFrame")
diff --git a/dom/interfaces/security/nsIContentSecurityPolicy.idl b/dom/interfaces/security/nsIContentSecurityPolicy.idl
index 191ddb6e4b..40d48f8820 100644
--- a/dom/interfaces/security/nsIContentSecurityPolicy.idl
+++ b/dom/interfaces/security/nsIContentSecurityPolicy.idl
@@ -52,18 +52,17 @@ interface nsIContentSecurityPolicy : nsISerializable
   const unsigned short REFLECTED_XSS_DIRECTIVE        = 12;
   const unsigned short BASE_URI_DIRECTIVE             = 13;
   const unsigned short FORM_ACTION_DIRECTIVE          = 14;
-  const unsigned short REFERRER_DIRECTIVE             = 15;
-  const unsigned short WEB_MANIFEST_SRC_DIRECTIVE     = 16;
-  const unsigned short UPGRADE_IF_INSECURE_DIRECTIVE  = 17;
-  const unsigned short CHILD_SRC_DIRECTIVE            = 18;
-  const unsigned short BLOCK_ALL_MIXED_CONTENT        = 19;
-  const unsigned short REQUIRE_SRI_FOR                = 20;
-  const unsigned short SANDBOX_DIRECTIVE              = 21;
-  const unsigned short WORKER_SRC_DIRECTIVE           = 22;
-  const unsigned short SCRIPT_SRC_ELEM_DIRECTIVE      = 23;
-  const unsigned short SCRIPT_SRC_ATTR_DIRECTIVE      = 24;
-  const unsigned short STYLE_SRC_ELEM_DIRECTIVE       = 25;
-  const unsigned short STYLE_SRC_ATTR_DIRECTIVE       = 26;
+  const unsigned short WEB_MANIFEST_SRC_DIRECTIVE     = 15;
+  const unsigned short UPGRADE_IF_INSECURE_DIRECTIVE  = 16;
+  const unsigned short CHILD_SRC_DIRECTIVE            = 17;
+  const unsigned short BLOCK_ALL_MIXED_CONTENT        = 18;
+  const unsigned short REQUIRE_SRI_FOR                = 19;
+  const unsigned short SANDBOX_DIRECTIVE              = 20;
+  const unsigned short WORKER_SRC_DIRECTIVE           = 21;
+  const unsigned short SCRIPT_SRC_ELEM_DIRECTIVE      = 22;
+  const unsigned short SCRIPT_SRC_ATTR_DIRECTIVE      = 23;
+  const unsigned short STYLE_SRC_ELEM_DIRECTIVE       = 24;
+  const unsigned short STYLE_SRC_ATTR_DIRECTIVE       = 25;
 
   /**
    * Accessor method for a read-only string version of the policy at a given
@@ -105,21 +104,6 @@ interface nsIContentSecurityPolicy : nsISerializable
    */
   readonly attribute bool enforcesFrameAncestors;
 
-  /**
-   * Obtains the referrer policy (as integer) for this browsing context as
-   * specified in CSP.  If there are multiple policies and...
-   *  - only one sets a referrer policy: that policy is returned
-   *  - more than one sets different referrer policies: no-referrer is returned
-   *  - more than one set equivalent policies: that policy is returned
-   * For the enumeration of policies see ReferrerPolicy.h and nsIHttpChannel.
-   *
-   * @param aPolicy
-   *        The referrer policy to use for the protected resource.
-   * @return
-   *        true if a referrer policy is specified, false if it's unspecified.
-   */
-  bool getReferrerPolicy(out unsigned long policy);
-
   /**
    * Parse and install a CSP policy.
    * @param aPolicy
diff --git a/dom/security/nsCSPContext.cpp b/dom/security/nsCSPContext.cpp
index 2eeca7d5f6..44a72ff4b6 100644
--- a/dom/security/nsCSPContext.cpp
+++ b/dom/security/nsCSPContext.cpp
@@ -398,48 +398,6 @@ nsCSPContext::GetEnforcesFrameAncestors(bool *outEnforcesFrameAncestors)
   return NS_OK;
 }
 
-NS_IMETHODIMP
-nsCSPContext::GetReferrerPolicy(uint32_t* outPolicy, bool* outIsSet)
-{
-  *outIsSet = false;
-  *outPolicy = mozilla::net::RP_Default;
-  nsAutoString refpol;
-  mozilla::net::ReferrerPolicy previousPolicy = mozilla::net::RP_Default;
-  for (uint32_t i = 0; i < mPolicies.Length(); i++) {
-    mPolicies[i]->getReferrerPolicy(refpol);
-    // only set the referrer policy if not delievered through a CSPRO and
-    // note that and an empty string in refpol means it wasn't set
-    // (that's the default in nsCSPPolicy).
-    if (!mPolicies[i]->getReportOnlyFlag() && !refpol.IsEmpty()) {
-      // Referrer Directive in CSP is no more used and going to be replaced by
-      // Referrer-Policy HTTP header. But we still keep using referrer directive,
-      // and would remove it later.
-      // Referrer Directive specs is not fully compliant with new referrer policy
-      // specs. What we are using here:
-      // - If the value of the referrer directive is invalid, the user agent
-      // should set the referrer policy to no-referrer.
-      // - If there are two policies that specify a referrer policy, then they
-      // must agree or the employed policy is no-referrer.
-      if (!mozilla::net::IsValidReferrerPolicy(refpol)) {
-        *outPolicy = mozilla::net::RP_No_Referrer;
-        *outIsSet = true;
-        return NS_OK;
-      }
-
-      uint32_t currentPolicy = mozilla::net::ReferrerPolicyFromString(refpol);
-      if (*outIsSet && previousPolicy != currentPolicy) {
-        *outPolicy = mozilla::net::RP_No_Referrer;
-        return NS_OK;
-      }
-
-      *outPolicy = currentPolicy;
-      *outIsSet = true;
-    }
-  }
-
-  return NS_OK;
-}
-
 NS_IMETHODIMP
 nsCSPContext::AppendPolicy(const nsAString& aPolicyString,
                            bool aReportOnly,
diff --git a/dom/security/nsCSPParser.cpp b/dom/security/nsCSPParser.cpp
index 85bee16527..faf5edb2c4 100644
--- a/dom/security/nsCSPParser.cpp
+++ b/dom/security/nsCSPParser.cpp
@@ -17,7 +17,6 @@
 #include "nsReadableUtils.h"
 #include "nsServiceManagerUtils.h"
 #include "nsUnicharUtils.h"
-#include "mozilla/net/ReferrerPolicy.h"
 
 using namespace mozilla;
 
@@ -826,38 +825,6 @@ nsCSPParser::sourceList(nsTArray<nsCSPBaseSrc*>& outSrcs)
   }
 }
 
-void
-nsCSPParser::referrerDirectiveValue(nsCSPDirective* aDir)
-{
-  // directive-value   = "none" / "none-when-downgrade" / "origin" / "origin-when-cross-origin" / "unsafe-url"
-  // directive name is token 0, we need to examine the remaining tokens (and
-  // there should only be one token in the value).
-  CSPPARSERLOG(("nsCSPParser::referrerDirectiveValue"));
-
-  if (mCurDir.Length() != 2) {
-    CSPPARSERLOG(("Incorrect number of tokens in referrer directive, got %d expected 1",
-                 mCurDir.Length() - 1));
-    delete aDir;
-    return;
-  }
-
-  if (!mozilla::net::IsValidReferrerPolicy(mCurDir[1])) {
-    CSPPARSERLOG(("invalid value for referrer directive: %s",
-                  NS_ConvertUTF16toUTF8(mCurDir[1]).get()));
-    delete aDir;
-    return;
-  }
-
-  //referrer-directive deprecation warning
-  const char16_t* params[] = { mCurDir[1].get() };
-  logWarningErrorToConsole(nsIScriptError::warningFlag, "deprecatedReferrerDirective",
-                             params, ArrayLength(params));
-
-  // the referrer policy is valid, so go ahead and use it.
-  mPolicy->setReferrerPolicy(&mCurDir[1]);
-  mPolicy->addDirective(aDir);
-}
-
 void
 nsCSPParser::requireSRIForDirectiveValue(nsRequireSRIForDirective* aDir)
 {
@@ -1170,13 +1137,6 @@ nsCSPParser::directive()
     return;
   }
 
-  // special case handling of the referrer directive (since it doesn't contain
-  // source lists)
-  if (cspDir->equals(nsIContentSecurityPolicy::REFERRER_DIRECTIVE)) {
-    referrerDirectiveValue(cspDir);
-    return;
-  }
-
   // special case handling for report-uri directive (since it doesn't contain
   // a valid source list but rather actual URIs)
   if (CSP_IsDirective(mCurDir[0], nsIContentSecurityPolicy::REPORT_URI_DIRECTIVE)) {
diff --git a/dom/security/nsCSPUtils.cpp b/dom/security/nsCSPUtils.cpp
index 70418e70c3..a7eeba9027 100644
--- a/dom/security/nsCSPUtils.cpp
+++ b/dom/security/nsCSPUtils.cpp
@@ -1235,7 +1235,7 @@ nsCSPDirective::toDomCSPStruct(mozilla::dom::CSP& outCSP) const
       outCSP.mScript_src_attr.Value() = mozilla::Move(srcs);
       return;
 
-    // REFERRER_DIRECTIVE and REQUIRE_SRI_FOR are handled in nsCSPPolicy::toDomCSPStruct()
+    // REQUIRE_SRI_FOR is handled in nsCSPPolicy::toDomCSPStruct()
 
     default:
       NS_ASSERTION(false, "cannot find directive to convert CSP to JSON");
@@ -1581,14 +1581,7 @@ nsCSPPolicy::toString(nsAString& outStr) const
 {
   uint32_t length = mDirectives.Length();
   for (uint32_t i = 0; i < length; ++i) {
-
-    if (mDirectives[i]->equals(nsIContentSecurityPolicy::REFERRER_DIRECTIVE)) {
-      outStr.AppendASCII(CSP_CSPDirectiveToString(nsIContentSecurityPolicy::REFERRER_DIRECTIVE));
-      outStr.AppendASCII(" ");
-      outStr.Append(mReferrerPolicy);
-    } else {
-      mDirectives[i]->toString(outStr);
-    }
+    mDirectives[i]->toString(outStr);
     if (i != (length - 1)) {
       outStr.AppendASCII("; ");
     }
@@ -1601,14 +1594,7 @@ nsCSPPolicy::toDomCSPStruct(mozilla::dom::CSP& outCSP) const
   outCSP.mReport_only = mReportOnly;
 
   for (uint32_t i = 0; i < mDirectives.Length(); ++i) {
-    if (mDirectives[i]->equals(nsIContentSecurityPolicy::REFERRER_DIRECTIVE)) {
-      mozilla::dom::Sequence<nsString> srcs;
-      srcs.AppendElement(mReferrerPolicy, mozilla::fallible);
-      outCSP.mReferrer.Construct();
-      outCSP.mReferrer.Value() = srcs;
-    } else {
-      mDirectives[i]->toDomCSPStruct(outCSP);
-    }
+    mDirectives[i]->toDomCSPStruct(outCSP);
   }
 }
 
diff --git a/dom/security/nsCSPUtils.h b/dom/security/nsCSPUtils.h
index 4c0af92620..13747a6b04 100644
--- a/dom/security/nsCSPUtils.h
+++ b/dom/security/nsCSPUtils.h
@@ -134,7 +134,6 @@ static const char* CSPStrDirectives[] = {
   "reflected-xss",             // REFLECTED_XSS_DIRECTIVE
   "base-uri",                  // BASE_URI_DIRECTIVE
   "form-action",               // FORM_ACTION_DIRECTIVE
-  "referrer",                  // REFERRER_DIRECTIVE
   "manifest-src",              // MANIFEST_SRC_DIRECTIVE
   "upgrade-insecure-requests", // UPGRADE_IF_INSECURE_DIRECTIVE
   "child-src",                 // CHILD_SRC_DIRECTIVE
@@ -714,15 +713,6 @@ class nsCSPPolicy {
     inline bool getReportOnlyFlag() const
       { return mReportOnly; }
 
-    inline void setReferrerPolicy(const nsAString* aValue)
-      {
-        mReferrerPolicy = *aValue;
-        ToLowerCase(mReferrerPolicy);
-      }
-
-    inline void getReferrerPolicy(nsAString& outPolicy) const
-      { outPolicy.Assign(mReferrerPolicy); }
-
     void getReportURIs(nsTArray<nsString> &outReportURIs) const;
 
     void getDirectiveStringForContentType(CSPDirective aDirective,
@@ -743,7 +733,6 @@ class nsCSPPolicy {
     nsUpgradeInsecureDirective* mUpgradeInsecDir;
     nsTArray<nsCSPDirective*>   mDirectives;
     bool                        mReportOnly;
-    nsString                    mReferrerPolicy;
 };
 
 #endif /* nsCSPUtils_h___ */
diff --git a/dom/security/test/csp/file_referrerdirective.html b/dom/security/test/csp/file_referrerdirective.html
deleted file mode 100644
index 841ffe0587..0000000000
--- a/dom/security/test/csp/file_referrerdirective.html
+++ /dev/null
@@ -1,55 +0,0 @@
-<!DOCTYPE HTML>
-<html>
-<head>
-<title>Subframe test for bug 965727</title>
-
-<script type="text/javascript">
-// we can get the ID out of the querystring.
-var args = document.location.search.substring(1).split('&');
-var id = "unknown";
-for (var i=0; i < args.length; i++) {
-  var arg = unescape(args[i]);
-  if (arg.indexOf('=') > 0 && arg.indexOf('id') == 0) {
-    id = arg.split('=')[1].trim();
-  }
-}
-
-var results = {
-  'id': id,
-  'referrer': document.location.href,
-  'results': {
-    'sameorigin': false,
-    'crossorigin': false,
-    'downgrade': false
-  }
-};
-
-// this is called back by each script load.
-var postResult = function(loadType, referrerLevel, referrer) {
-  results.results[loadType] = referrerLevel;
-
-  // and then check if all three have loaded.
-  for (var id in results.results) {
-    if (!results.results[id]) {
-      return;
-    }
-  }
-  //finished if we don't return early
-  window.parent.postMessage(JSON.stringify(results), "*");
-  console.log(JSON.stringify(results));
-}
-
-</script>
-</head>
-<body>
-Testing ...
-
-<script src="https://example.com/tests/dom/security/test/csp/referrerdirective.sjs?type=sameorigin&"
-        onerror="postResult('sameorigin', 'error');"></script>
-<script src="https://test2.example.com/tests/dom/security/test/csp/referrerdirective.sjs?type=crossorigin&"
-        onerror="postResult('crossorigin', 'error');"></script>
-<script src="http://example.com/tests/dom/security/test/csp/referrerdirective.sjs?type=downgrade&"
-        onerror="postResult('downgrade', 'error');"></script>
-
-</body>
-</html>
diff --git a/dom/security/test/csp/file_upgrade_insecure_referrer.sjs b/dom/security/test/csp/file_upgrade_insecure_referrer.sjs
deleted file mode 100644
index e149afa4b0..0000000000
--- a/dom/security/test/csp/file_upgrade_insecure_referrer.sjs
+++ /dev/null
@@ -1,55 +0,0 @@
-// special *.sjs specifically customized for the needs of
-// Bug 1139297 and Bug 663570
-
-const PRE_HEAD =
-  "<!DOCTYPE HTML>" +
-  "<html>" +
-  "<head>";
-
- const POST_HEAD =
-   "<meta charset='utf-8'>" +
-   "<title>Bug 1139297 - Implement CSP upgrade-insecure-requests directive</title>" +
-   "</head>" +
-   "<body>" +
-  "<img id='testimage' src='http://example.com/tests/dom/security/test/csp/file_upgrade_insecure_referrer_server.sjs?img'></img>" +
-  "</body>" +
-  "</html>";
-
-const PRE_CSP = "upgrade-insecure-requests; default-src https:; ";
-const CSP_REFERRER_ORIGIN = "referrer origin";
-const CSP_REFEFFER_NO_REFERRER = "referrer no-referrer";
-
-function handleRequest(request, response)
-{
-  // avoid confusing cache behaviors
-  response.setHeader("Cache-Control", "no-cache", false);
-  var queryString = request.queryString;
-
-  if (queryString === "test1") {
-    response.setHeader("Content-Security-Policy", PRE_CSP + CSP_REFERRER_ORIGIN, false);
-    response.write(PRE_HEAD + POST_HEAD);
-  	return;
-  }
-
-  if (queryString === "test2") {
-    response.setHeader("Content-Security-Policy", PRE_CSP + CSP_REFEFFER_NO_REFERRER, false);
-    response.write(PRE_HEAD + POST_HEAD);
-  	return;
-  }
-
-  if (queryString === "test3") {
-  	var metacsp =  "<meta http-equiv=\"Content-Security-Policy\" content = \"" + PRE_CSP + CSP_REFERRER_ORIGIN + "\" >";
-    response.write(PRE_HEAD + metacsp + POST_HEAD);
-  	return;
-  }
-
-  if (queryString === "test4") {
-  	var metacsp =  "<meta http-equiv=\"Content-Security-Policy\" content = \"" + PRE_CSP + CSP_REFEFFER_NO_REFERRER + "\" >";
-    response.write(PRE_HEAD + metacsp + POST_HEAD);
-  	return;
-  }
-
-  // we should never get here, but just in case return
-  // something unexpected
-  response.write("do'h");
-}
diff --git a/dom/security/test/csp/file_upgrade_insecure_referrer_server.sjs b/dom/security/test/csp/file_upgrade_insecure_referrer_server.sjs
deleted file mode 100644
index be1e6da0ca..0000000000
--- a/dom/security/test/csp/file_upgrade_insecure_referrer_server.sjs
+++ /dev/null
@@ -1,56 +0,0 @@
-// Custom *.sjs file specifically for the needs of Bug:
-// Bug 1139297 - Implement CSP upgrade-insecure-requests directive
-
-// small red image
-const IMG_BYTES = atob(
-  "iVBORw0KGgoAAAANSUhEUgAAAAUAAAAFCAYAAACNbyblAAAAHElEQVQI12" +
-  "P4//8/w38GIAXDIBKE0DHxgljNBAAO9TXL0Y4OHwAAAABJRU5ErkJggg==");
-
-function handleRequest(request, response)
-{
-  // avoid confusing cache behaviors
-  response.setHeader("Cache-Control", "no-cache", false);
-  var queryString = request.queryString;
-
-  // (1) lets process the queryresult request async and
-  // wait till we have received the image request.
-  if (queryString == "queryresult") {
-    response.processAsync();
-    setObjectState("queryResult", response);
-    return;
-  }
-
-  // (2) Handle the image request and return the referrer
-  // result back to the stored queryresult request.
-  if (request.queryString == "img") {
-    response.setHeader("Content-Type", "image/png");
-    response.write(IMG_BYTES);
-
-    let referrer = "";
-    try {
-      referrer = request.getHeader("referer");
-    } catch (e) {
-      referrer = "";
-    }
-    // make sure the received image request was upgraded to https,
-    // otherwise we return not only the referrer but also indicate
-    // that the request was not upgraded to https. Note, that
-    // all upgrades happen in the browser before any non-secure
-    // request hits the wire.
-    referrer += (request.scheme == "https") ?
-                 "" : " but request is not https";
-
-    getObjectState("queryResult", function(queryResponse) {
-      if (!queryResponse) {
-        return;
-      }
-      queryResponse.write(referrer);
-      queryResponse.finish();
-    });
-    return;
-  }
-
-  // we should not get here ever, but just in case return
-  // something unexpected.
-  response.write("doh!");
-}
diff --git a/dom/security/test/csp/mochitest.ini b/dom/security/test/csp/mochitest.ini
index 86b7fd0cdc..93c4ee6f06 100644
--- a/dom/security/test/csp/mochitest.ini
+++ b/dom/security/test/csp/mochitest.ini
@@ -125,7 +125,6 @@ support-files =
   file_multi_policy_injection_bypass_2.html^headers^
   file_null_baseuri.html
   file_form-action.html
-  file_referrerdirective.html
   referrerdirective.sjs
   file_upgrade_insecure.html
   file_upgrade_insecure_meta.html
@@ -133,8 +132,6 @@ support-files =
   file_upgrade_insecure_wsh.py
   file_upgrade_insecure_reporting.html
   file_upgrade_insecure_reporting_server.sjs
-  file_upgrade_insecure_referrer.sjs
-  file_upgrade_insecure_referrer_server.sjs
   file_upgrade_insecure_cors.html
   file_upgrade_insecure_cors_server.sjs
   file_report_for_import.css
@@ -266,15 +263,12 @@ skip-if = toolkit == 'android' # Times out, not sure why (bug 1008445)
 [test_leading_wildcard.html]
 [test_multi_policy_injection_bypass.html]
 [test_null_baseuri.html]
-[test_referrerdirective.html]
 [test_dual_header.html]
 [test_upgrade_insecure.html]
 # no ssl support as well as websocket tests do not work (see test_websocket.html)
 skip-if = toolkit == 'android' || (os != 'linux' && !debug) # Bug 1316305, Bug 1183300
 [test_upgrade_insecure_reporting.html]
 skip-if = toolkit == 'android'
-[test_upgrade_insecure_referrer.html]
-skip-if = toolkit == 'android'
 [test_upgrade_insecure_cors.html]
 skip-if = toolkit == 'android'
 [test_report_for_import.html]
diff --git a/dom/security/test/csp/test_referrerdirective.html b/dom/security/test/csp/test_referrerdirective.html
deleted file mode 100644
index f590460a0f..0000000000
--- a/dom/security/test/csp/test_referrerdirective.html
+++ /dev/null
@@ -1,143 +0,0 @@
-<!--
-  Any copyright is dedicated to the Public Domain.
-  http://creativecommons.org/publicdomain/zero/1.0/
--->
-<!DOCTYPE HTML>
-<html>
-<!--
-https://bugzilla.mozilla.org/show_bug.cgi?id=965727
--->
-<head>
-  <meta charset="utf-8">
-  <title>Test for Content Security Policy referrer Directive (Bug 965727)</title>
-  <script type="text/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
-  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" />
-</head>
-<body>
-<div id="content" style="display: none">
-
-</div>
-<pre id="test">
-<script class="testbody" type="application/javascript">
-/*
- * This tests various referrer policies and the referrer-sending behavior when
- * requesting scripts in different ways:
- *  - cross-origin (https://example.com -> https://test2.example.com)
- *  - same-origin (https://example.com -> https://example.com)
- *  - downgrade (https://example.com -> http://example.com)
- *
- * Each test creates an iframe that loads scripts for each of the checks.  If
- * the scripts are blocked, the test fails (they should run).  When loaded,
- * each script updates a results object in the test page, and then when the
- * test page has finished loading all the scripts, it postMessages back to this
- * page.  Once all tests are done, the results are checked.
- */
-
-var testData = {
-  'default': { 'csp': "script-src * 'unsafe-inline'; referrer default",
-          'expected': {  'sameorigin': 'full',
-                        'crossorigin': 'full',
-                          'downgrade': 'none' }},
-
-  'origin':  { 'csp': "script-src * 'unsafe-inline'; referrer origin",
-          'expected': {  'sameorigin': 'origin',
-                        'crossorigin': 'origin',
-                          'downgrade': 'origin' }},
-
-  'origin-when-cross-origin':  { 'csp': "script-src * 'unsafe-inline'; referrer origin-when-cross-origin",
-          'expected': {  'sameorigin': 'full',
-                        'crossorigin': 'origin',
-                          'downgrade': 'origin' }},
-
-  'unsafe-url':  { 'csp': "script-src * 'unsafe-inline'; referrer unsafe-url",
-          'expected': {  'sameorigin': 'full',
-                        'crossorigin': 'full',
-                          'downgrade': 'full' }},
-
-  'none':   { 'csp': "script-src * 'unsafe-inline'; referrer no-referrer",
-          'expected': {  'sameorigin': 'none',
-                        'crossorigin': 'none',
-                          'downgrade': 'none' }},
-
-  // referrer delivered through CSPRO should be ignored
-  'ignore-cspro':  { 'cspro': "script-src * 'unsafe-inline'; referrer origin",
-          'expected': {  'sameorigin': 'full',
-                        'crossorigin': 'full',
-                          'downgrade': 'none' }},
-
-  // referrer delivered through CSPRO should be ignored
-  'ignore-cspro2':   { 'csp'  : "script-src * 'unsafe-inline'; referrer no-referrer",
-                       'cspro': "script-src * 'unsafe-inline'; referrer origin",
-         'expected': {  'sameorigin': 'none',
-                        'crossorigin': 'none',
-                          'downgrade': 'none' }},
-  };
-
-var referrerDirectiveTests = {
-  // called via postMessage when one of the iframes is done running.
-  onIframeComplete: function(event) {
-    try {
-      var results = JSON.parse(event.data);
-      ok(results.hasOwnProperty('id'), "'id' property required in posted message " + event.data);
-
-      ok(testData.hasOwnProperty(results['id']), "Test " + results['id'] + " must be expected.");
-
-      // check all the various load types' referrers.
-      var expected = testData[results['id']].expected;
-      for (var t in expected) {
-        is(results.results[t], expected[t],
-          " referrer must match expected for " + t + " in " + results['id']);
-      }
-      testData[results['id']]['complete'] = true;
-
-    } catch(e) {
-      // fail -- should always be JSON
-      ok(false, "failed to parse posted message + " + event.data);
-      // have to end as well since not all messages were valid.
-      SimpleTest.finish();
-    }
-
-    referrerDirectiveTests.checkForCompletion();
-  },
-
-  // checks to see if all the parallel tests are done and validates results.
-  checkForCompletion: function() {
-    for (var id in testData) {
-      if (!testData[id].hasOwnProperty('complete')) {
-        return;
-      }
-    }
-    SimpleTest.finish();
-  }
-};
-
-SimpleTest.waitForExplicitFinish();
-// have to disable mixed content blocking to test https->http referrers.
-SpecialPowers.pushPrefEnv({
-    'set': [['security.mixed_content.block_active_content',   false],
-            ['security.mixed_content.block_display_content',  false],
-    ]
-    },
-    function() {
-      // each of the iframes we create will call us back when its contents are loaded.
-      window.addEventListener("message", referrerDirectiveTests.onIframeComplete.bind(window), false);
-
-      // one iframe created for each test case
-      for (var id in testData) {
-        var elt = document.createElement("iframe");
-        var src = "https://example.com/tests/dom/security/test/csp/file_testserver.sjs?id=" + id;
-        if (testData[id]['csp']) {
-          src += "&csp=" + escape(testData[id]['csp']);
-        }
-        if (testData[id]['cspro']) {
-          src += "&cspro=" + escape(testData[id]['cspro']);
-        }
-        src += "&file=tests/dom/security/test/csp/file_referrerdirective.html";
-        elt.src = src;
-        document.getElementById("content").appendChild(elt);
-      }
-    });
-</script>
-</pre>
-</body>
-</html>
diff --git a/dom/security/test/csp/test_upgrade_insecure_referrer.html b/dom/security/test/csp/test_upgrade_insecure_referrer.html
deleted file mode 100644
index 890c573350..0000000000
--- a/dom/security/test/csp/test_upgrade_insecure_referrer.html
+++ /dev/null
@@ -1,85 +0,0 @@
-<!DOCTYPE HTML>
-<html>
-<head>
-  <meta charset="utf-8">
-  <title>Bug 1139297 - Implement CSP upgrade-insecure-requests directive</title>
-  <!-- Including SimpleTest.js so we can use waitForExplicitFinish !-->
-  <script type="text/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
-  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" />
-</head>
-<body>
-<iframe style="width:100%;" id="testframe"></iframe>
-
-<script class="testbody" type="text/javascript">
-
-/* Description of the test:
- * We load a page that makes use of the CSP referrer directive as well
- * as upgrade-insecure-requests. The page loads an image over http.
- * The test makes sure the request gets upgraded to https and the
- * correct referrer gets sent.
- */
-
-var tests = [
-  {
-    query: "test1",
-    description: "upgrade insecure request with 'referrer = origin' (CSP in header)",
-    result: "http://example.com/"
-  },
-  {
-    query: "test2",
-    description: "upgrade insecure request with 'referrer = no-referrer' (CSP in header)",
-    result: ""
-  },
-  {
-    query: "test3",
-    description: "upgrade insecure request with 'referrer = origin' (Meta CSP)",
-    result: "http://example.com/"
-  },
-  {
-    query: "test4",
-    description: "upgrade insecure request with 'referrer = no-referrer' (Meta CSP)",
-    result: ""
-  }
-];
-
-var counter = 0;
-var curTest;
-
-function loadTestPage() {
-  curTest = tests[counter++];
-  var src = "http://example.com/tests/dom/security/test/csp/file_upgrade_insecure_referrer.sjs?";
-  // append the query
-  src += curTest.query;
-  document.getElementById("testframe").src = src;
-}
-
-function runNextTest() {
-  // sends a request to the server which is processed async and returns
-  // once the server received the expected image request
-  var myXHR = new XMLHttpRequest();
-  myXHR.open("GET", "file_upgrade_insecure_referrer_server.sjs?queryresult");
-  myXHR.onload = function(e) {
-    is(myXHR.responseText, curTest.result, curTest.description);
-    if (counter == tests.length) {
-      SimpleTest.finish();
-      return;
-    }
-    // move on to the next test by setting off another query request.
-    runNextTest();
-  }
-  myXHR.onerror = function(e) {
-    ok(false, "could not query results from server (" + e.message + ")");
-    SimpleTest.finish();
-  }
-  myXHR.send();
-
-  // give it some time and load the testpage
-  SimpleTest.executeSoon(loadTestPage);
-}
-
-SimpleTest.waitForExplicitFinish();
-runNextTest();
-
-</script>
-</body>
-</html>
diff --git a/dom/security/test/gtest/TestCSPParser.cpp b/dom/security/test/gtest/TestCSPParser.cpp
index 7964bf43a3..a5c2d8d770 100644
--- a/dom/security/test/gtest/TestCSPParser.cpp
+++ b/dom/security/test/gtest/TestCSPParser.cpp
@@ -229,8 +229,6 @@ TEST(CSPParser, Directives)
       "script-src 'nonce-correctscriptnonce'" },
     { "script-src 'sha256-siVR8vAcqP06h2ppeNwqgjr0yZ6yned4X2VF84j4GmI='",
       "script-src 'sha256-siVR8vAcqP06h2ppeNwqgjr0yZ6yned4X2VF84j4GmI='" },
-    { "referrer no-referrer",
-      "referrer no-referrer" },
     { "require-sri-for script style",
       "require-sri-for script style"},
     { "script-src 'nonce-foo' 'unsafe-inline' ",
@@ -305,8 +303,6 @@ TEST(CSPParser, IgnoreUpperLowerCasePolicies)
       "script-src 'nonce-NONCENEEDSTOBEUPPERCASE'" },
     { "script-src 'SHA256-siVR8vAcqP06h2ppeNwqgjr0yZ6yned4X2VF84j4GmI='",
       "script-src 'sha256-siVR8vAcqP06h2ppeNwqgjr0yZ6yned4X2VF84j4GmI='" },
-    { "refERRer No-refeRRer",
-      "referrer no-referrer" },
     { "upgrade-INSECURE-requests",
       "upgrade-insecure-requests" },
     { "sanDBox alloW-foRMs",
@@ -574,8 +570,6 @@ TEST(CSPParser, BadPolicies)
     { "defaut-src asdf", "" },
     { "default-src: aaa", "" },
     { "asdf http://test.com", ""},
-    { "referrer", ""},
-    { "referrer foo", ""},
     { "require-sri-for", ""},
     { "require-sri-for foo", ""},
     { "report-uri", ""},
diff --git a/dom/svg/SVGCircleElement.cpp b/dom/svg/SVGCircleElement.cpp
index 5f0873c49d..7ef3f513cc 100644
--- a/dom/svg/SVGCircleElement.cpp
+++ b/dom/svg/SVGCircleElement.cpp
@@ -79,7 +79,7 @@ SVGCircleElement::GetLengthInfo()
 }
 
 //----------------------------------------------------------------------
-// nsSVGPathGeometryElement methods
+// SVGGeometryElement methods
 
 bool
 SVGCircleElement::GetGeometryBounds(Rect* aBounds,
diff --git a/dom/svg/SVGCircleElement.h b/dom/svg/SVGCircleElement.h
index 64518b4d95..b946ce7a49 100644
--- a/dom/svg/SVGCircleElement.h
+++ b/dom/svg/SVGCircleElement.h
@@ -6,17 +6,17 @@
 #ifndef mozilla_dom_SVGCircleElement_h
 #define mozilla_dom_SVGCircleElement_h
 
-#include "nsSVGPathGeometryElement.h"
+#include "SVGGeometryElement.h"
 #include "nsSVGLength2.h"
 
 nsresult NS_NewSVGCircleElement(nsIContent **aResult,
                                 already_AddRefed<mozilla::dom::NodeInfo>&& aNodeInfo);
 
-typedef nsSVGPathGeometryElement SVGCircleElementBase;
-
 namespace mozilla {
 namespace dom {
 
+typedef SVGGeometryElement SVGCircleElementBase;
+
 class SVGCircleElement final : public SVGCircleElementBase
 {
 protected:
@@ -29,7 +29,7 @@ public:
   // nsSVGSVGElement methods:
   virtual bool HasValidDimensions() const override;
 
-  // nsSVGPathGeometryElement methods:
+  // SVGGeometryElement methods:
   virtual bool GetGeometryBounds(Rect* aBounds, const StrokeOptions& aStrokeOptions,
                                  const Matrix& aToBoundsSpace,
                                  const Matrix* aToNonScalingStrokeSpace = nullptr) override;
diff --git a/dom/svg/SVGEllipseElement.cpp b/dom/svg/SVGEllipseElement.cpp
index 47528af36c..5c1971be0d 100644
--- a/dom/svg/SVGEllipseElement.cpp
+++ b/dom/svg/SVGEllipseElement.cpp
@@ -90,7 +90,7 @@ SVGEllipseElement::GetLengthInfo()
 }
 
 //----------------------------------------------------------------------
-// nsSVGPathGeometryElement methods
+// SVGGeometryElement methods
 
 bool
 SVGEllipseElement::GetGeometryBounds(Rect* aBounds,
diff --git a/dom/svg/SVGEllipseElement.h b/dom/svg/SVGEllipseElement.h
index 0b1904a329..ab2a0c95de 100644
--- a/dom/svg/SVGEllipseElement.h
+++ b/dom/svg/SVGEllipseElement.h
@@ -6,7 +6,7 @@
 #ifndef mozilla_dom_SVGEllipseElement_h
 #define mozilla_dom_SVGEllipseElement_h
 
-#include "nsSVGPathGeometryElement.h"
+#include "SVGGeometryElement.h"
 #include "nsSVGLength2.h"
 
 nsresult NS_NewSVGEllipseElement(nsIContent **aResult,
@@ -15,7 +15,7 @@ nsresult NS_NewSVGEllipseElement(nsIContent **aResult,
 namespace mozilla {
 namespace dom {
 
-typedef nsSVGPathGeometryElement SVGEllipseElementBase;
+typedef SVGGeometryElement SVGEllipseElementBase;
 
 class SVGEllipseElement final : public SVGEllipseElementBase
 {
@@ -29,7 +29,7 @@ public:
   // nsSVGSVGElement methods:
   virtual bool HasValidDimensions() const override;
 
-  // nsSVGPathGeometryElement methods:
+  // SVGGeometryElement methods:
   virtual bool GetGeometryBounds(Rect* aBounds, const StrokeOptions& aStrokeOptions,
                                  const Matrix& aToBoundsSpace,
                                  const Matrix* aToNonScalingStrokeSpace = nullptr) override;
diff --git a/dom/svg/nsSVGPathGeometryElement.cpp b/dom/svg/SVGGeometryElement.cpp
similarity index 58%
rename from dom/svg/nsSVGPathGeometryElement.cpp
rename to dom/svg/SVGGeometryElement.cpp
index 726ee95786..e59a16ef5e 100644
--- a/dom/svg/nsSVGPathGeometryElement.cpp
+++ b/dom/svg/SVGGeometryElement.cpp
@@ -3,8 +3,9 @@
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
-#include "nsSVGPathGeometryElement.h"
+#include "SVGGeometryElement.h"
 
+#include "DOMSVGPoint.h"
 #include "gfxPlatform.h"
 #include "mozilla/gfx/2D.h"
 #include "nsComputedDOMStyle.h"
@@ -15,16 +16,25 @@
 using namespace mozilla;
 using namespace mozilla::gfx;
 
+nsSVGElement::NumberInfo SVGGeometryElement::sNumberInfo =
+{ &nsGkAtoms::pathLength, 0, false };
+
 //----------------------------------------------------------------------
 // Implementation
 
-nsSVGPathGeometryElement::nsSVGPathGeometryElement(already_AddRefed<mozilla::dom::NodeInfo>& aNodeInfo)
-  : nsSVGPathGeometryElementBase(aNodeInfo)
+SVGGeometryElement::SVGGeometryElement(already_AddRefed<mozilla::dom::NodeInfo>& aNodeInfo)
+  : SVGGeometryElementBase(aNodeInfo)
 {
 }
 
+nsSVGElement::NumberAttributesInfo
+SVGGeometryElement::GetNumberInfo()
+{
+  return NumberAttributesInfo(&mPathLength, &sNumberInfo, 1);
+}
+
 nsresult
-nsSVGPathGeometryElement::AfterSetAttr(int32_t aNamespaceID, nsIAtom* aName,
+SVGGeometryElement::AfterSetAttr(int32_t aNamespaceID, nsIAtom* aName,
                                  const nsAttrValue* aValue,
                                  const nsAttrValue* aOldValue, bool aNotify)
 {
@@ -33,13 +43,17 @@ nsSVGPathGeometryElement::AfterSetAttr(int32_t aNamespaceID, nsIAtom* aName,
       AttributeDefinesGeometry(aName)) {
     mCachedPath = nullptr;
   }
-  return nsSVGPathGeometryElementBase::AfterSetAttr(aNamespaceID, aName,
-                                                    aValue, aOldValue, aNotify);
+  return SVGGeometryElementBase::AfterSetAttr(aNamespaceID, aName,
+                                              aValue, aOldValue, aNotify);
 }
 
 bool
-nsSVGPathGeometryElement::AttributeDefinesGeometry(const nsIAtom *aName)
+SVGGeometryElement::AttributeDefinesGeometry(const nsIAtom *aName)
 {
+  if (aName == nsGkAtoms::pathLength) {
+    return true;
+  }
+
   // Check for nsSVGLength2 attribute
   LengthAttributesInfo info = GetLengthInfo();
   for (uint32_t i = 0; i < info.mLengthCount; i++) {
@@ -52,10 +66,10 @@ nsSVGPathGeometryElement::AttributeDefinesGeometry(const nsIAtom *aName)
 }
 
 bool
-nsSVGPathGeometryElement::GeometryDependsOnCoordCtx()
+SVGGeometryElement::GeometryDependsOnCoordCtx()
 {
   // Check the nsSVGLength2 attribute
-  LengthAttributesInfo info = const_cast<nsSVGPathGeometryElement*>(this)->GetLengthInfo();
+  LengthAttributesInfo info = const_cast<SVGGeometryElement*>(this)->GetLengthInfo();
   for (uint32_t i = 0; i < info.mLengthCount; i++) {
     if (info.mLengths[i].GetSpecifiedUnitType() == nsIDOMSVGLength::SVG_LENGTHTYPE_PERCENTAGE) {
       return true;
@@ -65,19 +79,19 @@ nsSVGPathGeometryElement::GeometryDependsOnCoordCtx()
 }
 
 bool
-nsSVGPathGeometryElement::IsMarkable()
+SVGGeometryElement::IsMarkable()
 {
   return false;
 }
 
 void
-nsSVGPathGeometryElement::GetMarkPoints(nsTArray<nsSVGMark> *aMarks)
+SVGGeometryElement::GetMarkPoints(nsTArray<nsSVGMark> *aMarks)
 {
 }
 
 already_AddRefed<Path>
-nsSVGPathGeometryElement::GetOrBuildPath(const DrawTarget& aDrawTarget,
-                                         FillRule aFillRule)
+SVGGeometryElement::GetOrBuildPath(const DrawTarget& aDrawTarget,
+                                   FillRule aFillRule)
 {
   // We only cache the path if it matches the backend used for screen painting:
   bool cacheable  = aDrawTarget.GetBackendType() ==
@@ -102,13 +116,13 @@ nsSVGPathGeometryElement::GetOrBuildPath(const DrawTarget& aDrawTarget,
 }
 
 already_AddRefed<Path>
-nsSVGPathGeometryElement::GetOrBuildPathForMeasuring()
+SVGGeometryElement::GetOrBuildPathForMeasuring()
 {
   return nullptr;
 }
 
 FillRule
-nsSVGPathGeometryElement::GetFillRule()
+SVGGeometryElement::GetFillRule()
 {
   FillRule fillRule = FillRule::FILL_WINDING; // Equivalent to StyleFillRule::Nonzero
 
@@ -130,3 +144,42 @@ nsSVGPathGeometryElement::GetFillRule()
 
   return fillRule;
 }
+
+float
+SVGGeometryElement::GetTotalLength()
+{
+  RefPtr<Path> flat = GetOrBuildPathForMeasuring();
+  return flat ? flat->ComputeLength() : 0.f;
+}
+
+already_AddRefed<nsISVGPoint>
+SVGGeometryElement::GetPointAtLength(float distance, ErrorResult& rv)
+{
+  RefPtr<Path> path = GetOrBuildPathForMeasuring();
+  if (!path) {
+    rv.Throw(NS_ERROR_FAILURE);
+    return nullptr;
+  }
+
+  float totalLength = path->ComputeLength();
+  if (mPathLength.IsExplicitlySet()) {
+    float pathLength = mPathLength.GetAnimValue();
+    if (pathLength <= 0) {
+      rv.Throw(NS_ERROR_FAILURE);
+      return nullptr;
+    }
+    distance *= totalLength / pathLength;
+  }
+  distance = std::max(0.f,         distance);
+  distance = std::min(totalLength, distance);
+
+  nsCOMPtr<nsISVGPoint> point =
+    new DOMSVGPoint(path->ComputePointAtLength(distance));
+  return point.forget();
+}
+
+already_AddRefed<SVGAnimatedNumber>
+SVGGeometryElement::PathLength()
+{
+  return mPathLength.ToDOMAnimatedNumber(this);
+}
diff --git a/dom/svg/nsSVGPathGeometryElement.h b/dom/svg/SVGGeometryElement.h
similarity index 88%
rename from dom/svg/nsSVGPathGeometryElement.h
rename to dom/svg/SVGGeometryElement.h
index 517d74096e..b19c259e2f 100644
--- a/dom/svg/nsSVGPathGeometryElement.h
+++ b/dom/svg/SVGGeometryElement.h
@@ -3,11 +3,13 @@
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
-#ifndef __NS_SVGPATHGEOMETRYELEMENT_H__
-#define __NS_SVGPATHGEOMETRYELEMENT_H__
+#ifndef mozilla_dom_SVGGeometryElement_h
+#define mozilla_dom_SVGGeometryElement_h
 
 #include "mozilla/gfx/2D.h"
 #include "SVGGraphicsElement.h"
+#include "nsISVGPoint.h"
+#include "nsSVGNumber2.h"
 
 struct nsSVGMark {
   enum Type {
@@ -24,9 +26,14 @@ struct nsSVGMark {
     x(aX), y(aY), angle(aAngle), type(aType) {}
 };
 
-typedef mozilla::dom::SVGGraphicsElement nsSVGPathGeometryElementBase;
+namespace mozilla {
+namespace dom {
 
-class nsSVGPathGeometryElement : public nsSVGPathGeometryElementBase
+class SVGAnimatedNumber;
+
+typedef mozilla::dom::SVGGraphicsElement SVGGeometryElementBase;
+
+class SVGGeometryElement : public SVGGeometryElementBase
 {
 protected:
   typedef mozilla::gfx::CapStyle CapStyle;
@@ -41,7 +48,7 @@ protected:
   typedef mozilla::gfx::StrokeOptions StrokeOptions;
 
 public:
-  explicit nsSVGPathGeometryElement(already_AddRefed<mozilla::dom::NodeInfo>& aNodeInfo);
+  explicit SVGGeometryElement(already_AddRefed<mozilla::dom::NodeInfo>& aNodeInfo);
 
   virtual nsresult AfterSetAttr(int32_t aNamespaceID, nsIAtom* aName,
                                 const nsAttrValue* aValue,
@@ -160,7 +167,7 @@ public:
    * that is created may be cached and returned on subsequent calls.
    */
   virtual already_AddRefed<Path> GetOrBuildPath(const DrawTarget& aDrawTarget,
-                                                     FillRule fillRule);
+                                                FillRule fillRule);
 
   /**
    * The same as GetOrBuildPath, but bypasses the cache (neither returns any
@@ -192,8 +199,22 @@ public:
    */
   FillRule GetFillRule();
 
+  // WebIDL
+  already_AddRefed<SVGAnimatedNumber> PathLength();
+  float GetTotalLength();
+  already_AddRefed<nsISVGPoint>
+    GetPointAtLength(float distance, ErrorResult& rv);
+
 protected:
+  // nsSVGElement method
+  virtual NumberAttributesInfo GetNumberInfo() override;
+
+  nsSVGNumber2 mPathLength;
+  static NumberInfo sNumberInfo;
   mutable RefPtr<Path> mCachedPath;
 };
 
-#endif
+} // namespace dom
+} // namespace mozilla
+
+#endif // mozilla_dom_SVGGeometryElement_h
diff --git a/dom/svg/SVGImageElement.cpp b/dom/svg/SVGImageElement.cpp
index e6d8cc44c0..1b8a8f140f 100644
--- a/dom/svg/SVGImageElement.cpp
+++ b/dom/svg/SVGImageElement.cpp
@@ -235,7 +235,7 @@ SVGImageElement::IsAttributeMapped(const nsIAtom* name) const
 }
 
 //----------------------------------------------------------------------
-// nsSVGPathGeometryElement methods
+// SVGGeometryElement methods
 
 /* For the purposes of the update/invalidation logic pretend to
    be a rectangle. */
diff --git a/dom/svg/SVGImageElement.h b/dom/svg/SVGImageElement.h
index 62e826f963..6663166ad5 100644
--- a/dom/svg/SVGImageElement.h
+++ b/dom/svg/SVGImageElement.h
@@ -8,21 +8,21 @@
 
 #include "nsImageLoadingContent.h"
 #include "nsSVGLength2.h"
-#include "nsSVGPathGeometryElement.h"
 #include "nsSVGString.h"
+#include "SVGGeometryElement.h"
 #include "SVGAnimatedPreserveAspectRatio.h"
 
 nsresult NS_NewSVGImageElement(nsIContent **aResult,
                                already_AddRefed<mozilla::dom::NodeInfo>&& aNodeInfo);
 
-typedef nsSVGPathGeometryElement SVGImageElementBase;
-
 class nsSVGImageFrame;
 
 namespace mozilla {
 namespace dom {
 class DOMSVGAnimatedPreserveAspectRatio;
 
+typedef SVGGeometryElement SVGImageElementBase;
+
 class SVGImageElement : public SVGImageElementBase,
                         public nsImageLoadingContent
 {
@@ -57,7 +57,7 @@ public:
 
   NS_IMETHOD_(bool) IsAttributeMapped(const nsIAtom* name) const override;
 
-  // nsSVGPathGeometryElement methods:
+  // SVGGeometryElement methods:
   virtual bool GetGeometryBounds(Rect* aBounds, const StrokeOptions& aStrokeOptions,
                                  const Matrix& aToBoundsSpace,
                                  const Matrix* aToNonScalingStrokeSpace = nullptr) override;
diff --git a/dom/svg/SVGLineElement.cpp b/dom/svg/SVGLineElement.cpp
index 776c6b04a3..8f43a4317d 100644
--- a/dom/svg/SVGLineElement.cpp
+++ b/dom/svg/SVGLineElement.cpp
@@ -109,7 +109,7 @@ SVGLineElement::GetLengthInfo()
 }
 
 //----------------------------------------------------------------------
-// nsSVGPathGeometryElement methods
+// SVGGeometryElement methods
 
 void
 SVGLineElement::GetMarkPoints(nsTArray<nsSVGMark> *aMarks) {
diff --git a/dom/svg/SVGLineElement.h b/dom/svg/SVGLineElement.h
index 7ff652424d..5a6a94447e 100644
--- a/dom/svg/SVGLineElement.h
+++ b/dom/svg/SVGLineElement.h
@@ -6,7 +6,7 @@
 #ifndef mozilla_dom_SVGLineElement_h
 #define mozilla_dom_SVGLineElement_h
 
-#include "nsSVGPathGeometryElement.h"
+#include "SVGGeometryElement.h"
 #include "nsSVGLength2.h"
 
 nsresult NS_NewSVGLineElement(nsIContent **aResult,
@@ -15,7 +15,7 @@ nsresult NS_NewSVGLineElement(nsIContent **aResult,
 namespace mozilla {
 namespace dom {
 
-typedef nsSVGPathGeometryElement SVGLineElementBase;
+typedef SVGGeometryElement SVGLineElementBase;
 
 class SVGLineElement final : public SVGLineElementBase
 {
@@ -33,7 +33,7 @@ public:
   // nsIContent interface
   NS_IMETHOD_(bool) IsAttributeMapped(const nsIAtom* name) const override;
 
-  // nsSVGPathGeometryElement methods:
+  // SVGGeometryElement methods:
   virtual bool IsMarkable() override { return true; }
   virtual void GetMarkPoints(nsTArray<nsSVGMark> *aMarks) override;
   virtual void GetAsSimplePath(SimplePath* aSimplePath) override;
diff --git a/dom/svg/SVGPathData.cpp b/dom/svg/SVGPathData.cpp
index 493f4d821a..be3912af2a 100644
--- a/dom/svg/SVGPathData.cpp
+++ b/dom/svg/SVGPathData.cpp
@@ -14,10 +14,10 @@
 #include "nsError.h"
 #include "nsString.h"
 #include "nsSVGPathDataParser.h"
-#include "nsSVGPathGeometryElement.h" // for nsSVGMark
 #include <stdarg.h>
 #include "nsStyleConsts.h"
 #include "SVGContentUtils.h"
+#include "SVGGeometryElement.h" // for nsSVGMark
 #include "SVGPathSegUtils.h"
 #include <algorithm>
 
diff --git a/dom/svg/SVGPathElement.cpp b/dom/svg/SVGPathElement.cpp
index 204eb04bde..8f9815dbaa 100644
--- a/dom/svg/SVGPathElement.cpp
+++ b/dom/svg/SVGPathElement.cpp
@@ -9,7 +9,6 @@
 
 #include "DOMSVGPathSeg.h"
 #include "DOMSVGPathSegList.h"
-#include "DOMSVGPoint.h"
 #include "gfx2DGlue.h"
 #include "gfxPlatform.h"
 #include "mozilla/dom/SVGPathElementBinding.h"
@@ -35,9 +34,6 @@ SVGPathElement::WrapNode(JSContext *aCx, JS::Handle<JSObject*> aGivenProto)
   return SVGPathElementBinding::Wrap(aCx, this, aGivenProto);
 }
 
-nsSVGElement::NumberInfo SVGPathElement::sNumberInfo = 
-{ &nsGkAtoms::pathLength, 0, false };
-
 //----------------------------------------------------------------------
 // Implementation
 
@@ -61,45 +57,6 @@ SVGPathElement::SizeOfExcludingThis(mozilla::MallocSizeOf aMallocSizeOf) const
 
 NS_IMPL_ELEMENT_CLONE_WITH_INIT(SVGPathElement)
 
-already_AddRefed<SVGAnimatedNumber>
-SVGPathElement::PathLength()
-{
-  return mPathLength.ToDOMAnimatedNumber(this);
-}
-
-float
-SVGPathElement::GetTotalLength()
-{
-  RefPtr<Path> flat = GetOrBuildPathForMeasuring();
-  return flat ? flat->ComputeLength() : 0.f;
-}
-
-already_AddRefed<nsISVGPoint>
-SVGPathElement::GetPointAtLength(float distance, ErrorResult& rv)
-{
-  RefPtr<Path> path = GetOrBuildPathForMeasuring();
-  if (!path) {
-    rv.Throw(NS_ERROR_FAILURE);
-    return nullptr;
-  }
-
-  float totalLength = path->ComputeLength();
-  if (mPathLength.IsExplicitlySet()) {
-    float pathLength = mPathLength.GetAnimValue();
-    if (pathLength <= 0) {
-      rv.Throw(NS_ERROR_FAILURE);
-      return nullptr;
-    }
-    distance *= totalLength / pathLength;
-  }
-  distance = std::max(0.f,         distance);
-  distance = std::min(totalLength, distance);
-
-  nsCOMPtr<nsISVGPoint> point =
-    new DOMSVGPoint(path->ComputePointAtLength(distance));
-  return point.forget();
-}
-
 uint32_t
 SVGPathElement::GetPathSegAtLength(float distance)
 {
@@ -284,12 +241,6 @@ SVGPathElement::HasValidDimensions() const
   return !mD.GetAnimValue().IsEmpty();
 }
 
-nsSVGElement::NumberAttributesInfo
-SVGPathElement::GetNumberInfo()
-{
-  return NumberAttributesInfo(&mPathLength, &sNumberInfo, 1);
-}
-
 //----------------------------------------------------------------------
 // nsIContent methods
 
@@ -311,7 +262,7 @@ SVGPathElement::GetOrBuildPathForMeasuring()
 }
 
 //----------------------------------------------------------------------
-// nsSVGPathGeometryElement methods
+// SVGGeometryElement methods
 
 bool
 SVGPathElement::AttributeDefinesGeometry(const nsIAtom *aName)
diff --git a/dom/svg/SVGPathElement.h b/dom/svg/SVGPathElement.h
index c7fc238ce0..af35e46985 100644
--- a/dom/svg/SVGPathElement.h
+++ b/dom/svg/SVGPathElement.h
@@ -8,22 +8,21 @@
 
 #include "mozilla/gfx/2D.h"
 #include "mozilla/RefPtr.h"
-#include "nsSVGNumber2.h"
-#include "nsSVGPathGeometryElement.h"
 #include "SVGAnimatedPathSegList.h"
+#include "SVGGeometryElement.h"
 #include "DOMSVGPathSeg.h"
 
 nsresult NS_NewSVGPathElement(nsIContent **aResult,
                               already_AddRefed<mozilla::dom::NodeInfo>&& aNodeInfo);
 
-typedef nsSVGPathGeometryElement SVGPathElementBase;
-
 namespace mozilla {
 
 class nsISVGPoint;
 
 namespace dom {
 
+typedef SVGGeometryElement SVGPathElementBase;
+
 class SVGPathElement final : public SVGPathElementBase
 {
 friend class nsSVGPathFrame;
@@ -46,7 +45,7 @@ public:
   // nsSVGSVGElement methods:
   virtual bool HasValidDimensions() const override;
 
-  // nsSVGPathGeometryElement methods:
+  // SVGGeometryElement methods:
   virtual bool AttributeDefinesGeometry(const nsIAtom *aName) override;
   virtual bool IsMarkable() override;
   virtual void GetMarkPoints(nsTArray<nsSVGMark> *aMarks) override;
@@ -83,9 +82,6 @@ public:
   float GetPathLengthScale(PathLengthScaleForType aFor);
 
   // WebIDL
-  already_AddRefed<SVGAnimatedNumber> PathLength();
-  float GetTotalLength();
-  already_AddRefed<nsISVGPoint> GetPointAtLength(float distance, ErrorResult& rv);
   uint32_t GetPathSegAtLength(float distance);
   already_AddRefed<DOMSVGPathSegClosePath> CreateSVGPathSegClosePath();
   already_AddRefed<DOMSVGPathSegMovetoAbs> CreateSVGPathSegMovetoAbs(float x, float y);
@@ -121,12 +117,7 @@ public:
 
 protected:
 
-  // nsSVGElement method
-  virtual NumberAttributesInfo GetNumberInfo() override;
-
   SVGAnimatedPathSegList mD;
-  nsSVGNumber2 mPathLength;
-  static NumberInfo sNumberInfo;
 };
 
 } // namespace dom
diff --git a/dom/svg/nsSVGPolyElement.cpp b/dom/svg/SVGPolyElement.cpp
similarity index 75%
rename from dom/svg/nsSVGPolyElement.cpp
rename to dom/svg/SVGPolyElement.cpp
index ec45dcb03c..72e3b0be8a 100644
--- a/dom/svg/nsSVGPolyElement.cpp
+++ b/dom/svg/SVGPolyElement.cpp
@@ -3,7 +3,7 @@
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
-#include "nsSVGPolyElement.h"
+#include "SVGPolyElement.h"
 #include "DOMSVGPointList.h"
 #include "mozilla/gfx/2D.h"
 #include "SVGContentUtils.h"
@@ -14,26 +14,26 @@ using namespace mozilla::gfx;
 //----------------------------------------------------------------------
 // nsISupports methods
 
-NS_IMPL_ADDREF_INHERITED(nsSVGPolyElement,nsSVGPolyElementBase)
-NS_IMPL_RELEASE_INHERITED(nsSVGPolyElement,nsSVGPolyElementBase)
+NS_IMPL_ADDREF_INHERITED(SVGPolyElement,SVGPolyElementBase)
+NS_IMPL_RELEASE_INHERITED(SVGPolyElement,SVGPolyElementBase)
 
-NS_INTERFACE_MAP_BEGIN(nsSVGPolyElement)
-NS_INTERFACE_MAP_END_INHERITING(nsSVGPolyElementBase)
+NS_INTERFACE_MAP_BEGIN(SVGPolyElement)
+NS_INTERFACE_MAP_END_INHERITING(SVGPolyElementBase)
 
 //----------------------------------------------------------------------
 // Implementation
 
-nsSVGPolyElement::nsSVGPolyElement(already_AddRefed<mozilla::dom::NodeInfo>& aNodeInfo)
-  : nsSVGPolyElementBase(aNodeInfo)
+SVGPolyElement::SVGPolyElement(already_AddRefed<mozilla::dom::NodeInfo>& aNodeInfo)
+  : SVGPolyElementBase(aNodeInfo)
 {
 }
 
-nsSVGPolyElement::~nsSVGPolyElement()
+SVGPolyElement::~SVGPolyElement()
 {
 }
 
 already_AddRefed<DOMSVGPointList>
-nsSVGPolyElement::Points()
+SVGPolyElement::Points()
 {
   void *key = mPoints.GetBaseValKey();
   RefPtr<DOMSVGPointList> points = DOMSVGPointList::GetDOMWrapper(key, this, false);
@@ -41,7 +41,7 @@ nsSVGPolyElement::Points()
 }
 
 already_AddRefed<DOMSVGPointList>
-nsSVGPolyElement::AnimatedPoints()
+SVGPolyElement::AnimatedPoints()
 {
   void *key = mPoints.GetAnimValKey();
   RefPtr<DOMSVGPointList> points = DOMSVGPointList::GetDOMWrapper(key, this, true);
@@ -53,30 +53,30 @@ nsSVGPolyElement::AnimatedPoints()
 // nsIContent methods
 
 NS_IMETHODIMP_(bool)
-nsSVGPolyElement::IsAttributeMapped(const nsIAtom* name) const
+SVGPolyElement::IsAttributeMapped(const nsIAtom* name) const
 {
   static const MappedAttributeEntry* const map[] = {
     sMarkersMap
   };
   
   return FindAttributeDependence(name, map) ||
-    nsSVGPolyElementBase::IsAttributeMapped(name);
+    SVGPolyElementBase::IsAttributeMapped(name);
 }
 
 //----------------------------------------------------------------------
 // nsSVGElement methods
 
 /* virtual */ bool
-nsSVGPolyElement::HasValidDimensions() const
+SVGPolyElement::HasValidDimensions() const
 {
   return !mPoints.GetAnimValue().IsEmpty();
 }
 
 //----------------------------------------------------------------------
-// nsSVGPathGeometryElement methods
+// SVGGeometryElement methods
 
 bool
-nsSVGPolyElement::AttributeDefinesGeometry(const nsIAtom *aName)
+SVGPolyElement::AttributeDefinesGeometry(const nsIAtom *aName)
 {
   if (aName == nsGkAtoms::points)
     return true;
@@ -85,7 +85,7 @@ nsSVGPolyElement::AttributeDefinesGeometry(const nsIAtom *aName)
 }
 
 void
-nsSVGPolyElement::GetMarkPoints(nsTArray<nsSVGMark> *aMarks)
+SVGPolyElement::GetMarkPoints(nsTArray<nsSVGMark> *aMarks)
 {
   const SVGPointList &points = mPoints.GetAnimValue();
 
@@ -121,10 +121,10 @@ nsSVGPolyElement::GetMarkPoints(nsTArray<nsSVGMark> *aMarks)
 }
 
 bool
-nsSVGPolyElement::GetGeometryBounds(Rect* aBounds,
-                                    const StrokeOptions& aStrokeOptions,
-                                    const Matrix& aToBoundsSpace,
-                                    const Matrix* aToNonScalingStrokeSpace)
+SVGPolyElement::GetGeometryBounds(Rect* aBounds,
+                                  const StrokeOptions& aStrokeOptions,
+                                  const Matrix& aToBoundsSpace,
+                                  const Matrix* aToNonScalingStrokeSpace)
 {
   const SVGPointList &points = mPoints.GetAnimValue();
 
diff --git a/dom/svg/nsSVGPolyElement.h b/dom/svg/SVGPolyElement.h
similarity index 78%
rename from dom/svg/nsSVGPolyElement.h
rename to dom/svg/SVGPolyElement.h
index 69c3fac5f8..5097340ed7 100644
--- a/dom/svg/nsSVGPolyElement.h
+++ b/dom/svg/SVGPolyElement.h
@@ -3,25 +3,26 @@
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
-#ifndef NS_SVGPOLYELEMENT_H_
-#define NS_SVGPOLYELEMENT_H_
+#ifndef __SVGPOLYELEMENT_H_
+#define __SVGPOLYELEMENT_H_
 
 #include "mozilla/Attributes.h"
-#include "nsSVGPathGeometryElement.h"
 #include "SVGAnimatedPointList.h"
-
-typedef nsSVGPathGeometryElement nsSVGPolyElementBase;
+#include "SVGGeometryElement.h"
 
 namespace mozilla {
 class DOMSVGPointList;
-} // namespace mozilla
 
-class nsSVGPolyElement : public nsSVGPolyElementBase
+namespace dom {
+
+typedef SVGGeometryElement SVGPolyElementBase;
+
+class SVGPolyElement : public SVGPolyElementBase
 {
 protected:
-  explicit nsSVGPolyElement(already_AddRefed<mozilla::dom::NodeInfo>& aNodeInfo);
+  explicit SVGPolyElement(already_AddRefed<mozilla::dom::NodeInfo>& aNodeInfo);
 
-  virtual ~nsSVGPolyElement();
+  virtual ~SVGPolyElement();
 
 public:
   //interfaces
@@ -41,7 +42,7 @@ public:
   // nsSVGElement methods:
   virtual bool HasValidDimensions() const override;
 
-  // nsSVGPathGeometryElement methods:
+  // SVGGeometryElement methods:
   virtual bool AttributeDefinesGeometry(const nsIAtom *aName) override;
   virtual bool IsMarkable() override { return true; }
   virtual void GetMarkPoints(nsTArray<nsSVGMark> *aMarks) override;
@@ -57,4 +58,7 @@ protected:
   SVGAnimatedPointList mPoints;
 };
 
-#endif //NS_SVGPOLYELEMENT_H_
+} // namespace dom
+} // namespace mozilla
+
+#endif //__SVGPOLYELEMENT_H_
diff --git a/dom/svg/SVGPolygonElement.cpp b/dom/svg/SVGPolygonElement.cpp
index 62c769edc7..e4259e0e7e 100644
--- a/dom/svg/SVGPolygonElement.cpp
+++ b/dom/svg/SVGPolygonElement.cpp
@@ -36,12 +36,12 @@ SVGPolygonElement::SVGPolygonElement(already_AddRefed<mozilla::dom::NodeInfo>& a
 NS_IMPL_ELEMENT_CLONE_WITH_INIT(SVGPolygonElement)
 
 //----------------------------------------------------------------------
-// nsSVGPathGeometryElement methods
+// SVGGeometryElement methods
 
 void
 SVGPolygonElement::GetMarkPoints(nsTArray<nsSVGMark> *aMarks)
 {
-  nsSVGPolyElement::GetMarkPoints(aMarks);
+  SVGPolyElement::GetMarkPoints(aMarks);
 
   if (aMarks->IsEmpty() || aMarks->LastElement().type != nsSVGMark::eEnd) {
     return;
@@ -55,7 +55,7 @@ SVGPolygonElement::GetMarkPoints(nsTArray<nsSVGMark> *aMarks)
   endMark->angle = SVGContentUtils::AngleBisect(angle, endMark->angle);
   startMark->angle = SVGContentUtils::AngleBisect(angle, startMark->angle);
   // for a polygon (as opposed to a polyline) there's an implicit extra point
-  // co-located with the start point that nsSVGPolyElement::GetMarkPoints
+  // co-located with the start point that SVGPolyElement::GetMarkPoints
   // doesn't return
   aMarks->AppendElement(nsSVGMark(startMark->x, startMark->y, startMark->angle,
                                   nsSVGMark::eEnd));
diff --git a/dom/svg/SVGPolygonElement.h b/dom/svg/SVGPolygonElement.h
index f2d68f1d95..e0bff964e6 100644
--- a/dom/svg/SVGPolygonElement.h
+++ b/dom/svg/SVGPolygonElement.h
@@ -7,16 +7,16 @@
 #define mozilla_dom_SVGPolygonElement_h
 
 #include "mozilla/Attributes.h"
-#include "nsSVGPolyElement.h"
+#include "SVGPolyElement.h"
 
 nsresult NS_NewSVGPolygonElement(nsIContent **aResult,
                                  already_AddRefed<mozilla::dom::NodeInfo>&& aNodeInfo);
 
-typedef nsSVGPolyElement SVGPolygonElementBase;
-
 namespace mozilla {
 namespace dom {
 
+typedef SVGPolyElement SVGPolygonElementBase;
+
 class SVGPolygonElement final : public SVGPolygonElementBase
 {
 protected:
@@ -26,7 +26,7 @@ protected:
                                              already_AddRefed<mozilla::dom::NodeInfo>&& aNodeInfo));
 
 public:
-  // nsSVGPathGeometryElement methods:
+  // SVGGeometryElement methods:
   virtual void GetMarkPoints(nsTArray<nsSVGMark> *aMarks) override;
   virtual already_AddRefed<Path> BuildPath(PathBuilder* aBuilder) override;
 
diff --git a/dom/svg/SVGPolylineElement.cpp b/dom/svg/SVGPolylineElement.cpp
index 4c339216df..6de551306e 100644
--- a/dom/svg/SVGPolylineElement.cpp
+++ b/dom/svg/SVGPolylineElement.cpp
@@ -35,7 +35,7 @@ SVGPolylineElement::SVGPolylineElement(already_AddRefed<mozilla::dom::NodeInfo>&
 NS_IMPL_ELEMENT_CLONE_WITH_INIT(SVGPolylineElement)
 
 //----------------------------------------------------------------------
-// nsSVGPathGeometryElement methods
+// SVGGeometryElement methods
 
 already_AddRefed<Path>
 SVGPolylineElement::BuildPath(PathBuilder* aBuilder)
diff --git a/dom/svg/SVGPolylineElement.h b/dom/svg/SVGPolylineElement.h
index cf223fd74f..e0b2dcd279 100644
--- a/dom/svg/SVGPolylineElement.h
+++ b/dom/svg/SVGPolylineElement.h
@@ -6,16 +6,16 @@
 #ifndef mozilla_dom_SVGPolylineElement_h
 #define mozilla_dom_SVGPolylineElement_h
 
-#include "nsSVGPolyElement.h"
+#include "SVGPolyElement.h"
 
 nsresult NS_NewSVGPolylineElement(nsIContent **aResult,
                                   already_AddRefed<mozilla::dom::NodeInfo>&& aNodeInfo);
 
-typedef nsSVGPolyElement SVGPolylineElementBase;
-
 namespace mozilla {
 namespace dom {
 
+typedef SVGPolyElement SVGPolylineElementBase;
+
 class SVGPolylineElement final : public SVGPolylineElementBase
 {
 protected:
@@ -24,7 +24,7 @@ protected:
   friend nsresult (::NS_NewSVGPolylineElement(nsIContent **aResult,
                                               already_AddRefed<mozilla::dom::NodeInfo>&& aNodeInfo));
 
-  // nsSVGPathGeometryElement methods:
+  // SVGGeometryElement methods:
   virtual already_AddRefed<Path> BuildPath(PathBuilder* aBuilder) override;
 
 public:
diff --git a/dom/svg/SVGRectElement.cpp b/dom/svg/SVGRectElement.cpp
index d201311a5b..2f706a3237 100644
--- a/dom/svg/SVGRectElement.cpp
+++ b/dom/svg/SVGRectElement.cpp
@@ -108,7 +108,7 @@ SVGRectElement::GetLengthInfo()
 }
 
 //----------------------------------------------------------------------
-// nsSVGPathGeometryElement methods
+// SVGGeometryElement methods
 
 bool
 SVGRectElement::GetGeometryBounds(Rect* aBounds,
diff --git a/dom/svg/SVGRectElement.h b/dom/svg/SVGRectElement.h
index 847a1504a8..9cbe8e6180 100644
--- a/dom/svg/SVGRectElement.h
+++ b/dom/svg/SVGRectElement.h
@@ -6,17 +6,17 @@
 #ifndef mozilla_dom_SVGRectElement_h
 #define mozilla_dom_SVGRectElement_h
 
-#include "nsSVGPathGeometryElement.h"
 #include "nsSVGLength2.h"
+#include "SVGGeometryElement.h"
 
 nsresult NS_NewSVGRectElement(nsIContent **aResult,
                               already_AddRefed<mozilla::dom::NodeInfo>&& aNodeInfo);
 
-typedef nsSVGPathGeometryElement SVGRectElementBase;
-
 namespace mozilla {
 namespace dom {
 
+typedef SVGGeometryElement SVGRectElementBase;
+
 class SVGRectElement final : public SVGRectElementBase
 {
 protected:
@@ -29,7 +29,7 @@ public:
   // nsSVGSVGElement methods:
   virtual bool HasValidDimensions() const override;
 
-  // nsSVGPathGeometryElement methods:
+  // SVGGeometryElement methods:
   virtual bool GetGeometryBounds(Rect* aBounds, const StrokeOptions& aStrokeOptions,
                                  const Matrix& aToBoundsSpace,
                                  const Matrix* aToNonScalingStrokeSpace = nullptr) override;
diff --git a/dom/svg/moz.build b/dom/svg/moz.build
index 3af1b8094c..90b7156315 100644
--- a/dom/svg/moz.build
+++ b/dom/svg/moz.build
@@ -65,6 +65,7 @@ EXPORTS.mozilla.dom += [
     'SVGFilterElement.h',
     'SVGForeignObjectElement.h',
     'SVGGElement.h',
+    'SVGGeometryElement.h',
     'SVGGradientElement.h',
     'SVGGraphicsElement.h',
     'SVGImageElement.h',
@@ -131,8 +132,6 @@ UNIFIED_SOURCES += [
     'nsSVGNumber2.cpp',
     'nsSVGNumberPair.cpp',
     'nsSVGPathDataParser.cpp',
-    'nsSVGPathGeometryElement.cpp',
-    'nsSVGPolyElement.cpp',
     'nsSVGString.cpp',
     'nsSVGTransform.cpp',
     'nsSVGViewBox.cpp',
@@ -190,6 +189,7 @@ UNIFIED_SOURCES += [
     'SVGForeignObjectElement.cpp',
     'SVGFragmentIdentifier.cpp',
     'SVGGElement.cpp',
+    'SVGGeometryElement.cpp',
     'SVGGradientElement.cpp',
     'SVGGraphicsElement.cpp',
     'SVGImageElement.cpp',
@@ -218,6 +218,7 @@ UNIFIED_SOURCES += [
     'SVGPatternElement.cpp',
     'SVGPointList.cpp',
     'SVGPointListSMILType.cpp',
+    'SVGPolyElement.cpp',
     'SVGPolygonElement.cpp',
     'SVGPolylineElement.cpp',
     'SVGPreserveAspectRatio.cpp',
diff --git a/dom/svg/nsSVGElement.cpp b/dom/svg/nsSVGElement.cpp
index 77dbcb939d..94cce45bd3 100644
--- a/dom/svg/nsSVGElement.cpp
+++ b/dom/svg/nsSVGElement.cpp
@@ -15,7 +15,6 @@
 #include "nsICSSDeclaration.h"
 #include "nsIDocument.h"
 #include "nsIDOMMutationEvent.h"
-#include "nsSVGPathGeometryElement.h"
 #include "mozilla/InternalMutationEvent.h"
 #include "mozAutoDocUpdate.h"
 #include "nsError.h"
@@ -45,6 +44,7 @@
 #include "SVGAnimatedPointList.h"
 #include "SVGAnimatedPathSegList.h"
 #include "SVGContentUtils.h"
+#include "SVGGeometryElement.h"
 #include "nsIFrame.h"
 #include "nsQueryObject.h"
 #include <stdarg.h>
diff --git a/dom/tests/mochitest/general/test_interfaces.html b/dom/tests/mochitest/general/test_interfaces.html
index 77993a1aff..03101b888c 100644
--- a/dom/tests/mochitest/general/test_interfaces.html
+++ b/dom/tests/mochitest/general/test_interfaces.html
@@ -992,6 +992,8 @@ var interfaceNamesInGlobalScope =
     "SVGForeignObjectElement",
 // IMPORTANT: Do not change this list without review from a DOM peer!
     "SVGGElement",
+// IMPORTANT: Do not change this list without review from a DOM peer!
+    "SVGGeometryElement",
 // IMPORTANT: Do not change this list without review from a DOM peer!
     "SVGGradientElement",
 // IMPORTANT: Do not change this list without review from a DOM peer!
diff --git a/dom/webidl/SVGGeometryElement.webidl b/dom/webidl/SVGGeometryElement.webidl
new file mode 100644
index 0000000000..28029794c6
--- /dev/null
+++ b/dom/webidl/SVGGeometryElement.webidl
@@ -0,0 +1,20 @@
+/* -*- Mode: IDL; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this file,
+ * You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * The origin of this IDL file is
+ * http://www.w3.org/TR/SVG2/
+ *
+ * Copyright © 2012 W3C® (MIT, ERCIM, Keio), All Rights Reserved. W3C
+ * liability, trademark and document use rules apply.
+ */
+
+interface SVGGeometryElement : SVGGraphicsElement {
+  [SameObject]
+  readonly attribute SVGAnimatedNumber pathLength;
+
+  float getTotalLength();
+  [NewObject, Throws]
+  SVGPoint getPointAtLength(float distance);
+};
diff --git a/dom/webidl/SVGPathElement.webidl b/dom/webidl/SVGPathElement.webidl
index 08a9904ec2..9732d3cfe8 100644
--- a/dom/webidl/SVGPathElement.webidl
+++ b/dom/webidl/SVGPathElement.webidl
@@ -9,14 +9,8 @@
  * Copyright © 2012 W3C® (MIT, ERCIM, Keio), All Rights Reserved. W3C
  * liability, trademark and document use rules apply.
  */
-interface SVGPathElement : SVGGraphicsElement {
+interface SVGPathElement : SVGGeometryElement {
 
-  [Constant]
-  readonly attribute SVGAnimatedNumber pathLength;
-
-  float getTotalLength();
-  [NewObject, Throws]
-  SVGPoint getPointAtLength(float distance);
   unsigned long getPathSegAtLength(float distance);
   [NewObject]
   SVGPathSegClosePath createSVGPathSegClosePath();
diff --git a/dom/webidl/moz.build b/dom/webidl/moz.build
index 366366ac31..a62d760380 100644
--- a/dom/webidl/moz.build
+++ b/dom/webidl/moz.build
@@ -478,6 +478,7 @@ WEBIDL_FILES = [
     'SVGFitToViewBox.webidl',
     'SVGForeignObjectElement.webidl',
     'SVGGElement.webidl',
+    'SVGGeometryElement.webidl',
     'SVGGradientElement.webidl',
     'SVGGraphicsElement.webidl',
     'SVGImageElement.webidl',
diff --git a/dom/workers/WorkerPrivate.cpp b/dom/workers/WorkerPrivate.cpp
index 23fb103a10..177b09f2e3 100644
--- a/dom/workers/WorkerPrivate.cpp
+++ b/dom/workers/WorkerPrivate.cpp
@@ -2419,20 +2419,10 @@ WorkerPrivateParent<Derived>::SetCSPFromHeaderValues(const nsACString& aCSPHeade
   rv = csp->GetAllowsEval(&reportEvalViolations, &evalAllowed);
   NS_ENSURE_SUCCESS(rv, rv);
 
-  // Set ReferrerPolicy, default value is set in GetReferrerPolicy
-  bool hasReferrerPolicy = false;
-  uint32_t rp = mozilla::net::RP_Unset;
-  rv = csp->GetReferrerPolicy(&rp, &hasReferrerPolicy);
-  NS_ENSURE_SUCCESS(rv, rv);
-
   mLoadInfo.mCSP = csp;
   mLoadInfo.mEvalAllowed = evalAllowed;
   mLoadInfo.mReportCSPViolations = reportEvalViolations;
 
-  if (hasReferrerPolicy) {
-    mLoadInfo.mReferrerPolicy = static_cast<net::ReferrerPolicy>(rp);
-  }
-
   return NS_OK;
 }
 
@@ -3696,16 +3686,6 @@ WorkerLoadInfo::SetPrincipalOnMainThread(nsIPrincipal* aPrincipal,
 
   if (mCSP) {
     mCSP->GetAllowsEval(&mReportCSPViolations, &mEvalAllowed);
-    // Set ReferrerPolicy
-    bool hasReferrerPolicy = false;
-    uint32_t rp = mozilla::net::RP_Unset;
-
-    rv = mCSP->GetReferrerPolicy(&rp, &hasReferrerPolicy);
-    NS_ENSURE_SUCCESS(rv, rv);
-
-    if (hasReferrerPolicy) {
-      mReferrerPolicy = static_cast<net::ReferrerPolicy>(rp);
-    }
   } else {
     mEvalAllowed = true;
     mReportCSPViolations = false;
diff --git a/js/src/jit/MacroAssembler.cpp b/js/src/jit/MacroAssembler.cpp
index 6721dd4419..9519e8f0eb 100644
--- a/js/src/jit/MacroAssembler.cpp
+++ b/js/src/jit/MacroAssembler.cpp
@@ -2124,6 +2124,7 @@ MacroAssembler::convertTypedOrValueToInt(TypedOrValueRegister src, FloatRegister
       case MIRType::String:
       case MIRType::Symbol:
       case MIRType::Object:
+      case MIRType::BigInt:
         jump(fail);
         break;
       default:
diff --git a/js/src/jit/MacroAssembler.h b/js/src/jit/MacroAssembler.h
index f681456396..e5efb475c6 100644
--- a/js/src/jit/MacroAssembler.h
+++ b/js/src/jit/MacroAssembler.h
@@ -1622,6 +1622,11 @@ class MacroAssembler : public MacroAssemblerSpecific
           case Scalar::Uint32:
             store32(value, dest);
             break;
+          case Scalar::BigInt64:
+          case Scalar::BigUint64:
+            //FIXME: storing 64-bit values doesn't actually work yet.
+            // store64(value, dest);
+            break;
           default:
             MOZ_CRASH("Invalid typed array type");
         }
diff --git a/layout/base/nsCSSFrameConstructor.cpp b/layout/base/nsCSSFrameConstructor.cpp
index fdeb9f35b9..978727e09c 100644
--- a/layout/base/nsCSSFrameConstructor.cpp
+++ b/layout/base/nsCSSFrameConstructor.cpp
@@ -134,7 +134,7 @@ NS_NewSVGOuterSVGAnonChildFrame(nsIPresShell* aPresShell, nsStyleContext* aConte
 nsIFrame*
 NS_NewSVGInnerSVGFrame(nsIPresShell* aPresShell, nsStyleContext* aContext);
 nsIFrame*
-NS_NewSVGPathGeometryFrame(nsIPresShell* aPresShell, nsStyleContext* aContext);
+NS_NewSVGGeometryFrame(nsIPresShell* aPresShell, nsStyleContext* aContext);
 nsIFrame*
 NS_NewSVGGFrame(nsIPresShell* aPresShell, nsStyleContext* aContext);
 nsIFrame*
@@ -5482,13 +5482,13 @@ nsCSSFrameConstructor::FindSVGData(Element* aElement,
     SIMPLE_SVG_CREATE(svg, NS_NewSVGInnerSVGFrame),
     SIMPLE_SVG_CREATE(g, NS_NewSVGGFrame),
     SIMPLE_SVG_CREATE(svgSwitch, NS_NewSVGSwitchFrame),
-    SIMPLE_SVG_CREATE(polygon, NS_NewSVGPathGeometryFrame),
-    SIMPLE_SVG_CREATE(polyline, NS_NewSVGPathGeometryFrame),
-    SIMPLE_SVG_CREATE(circle, NS_NewSVGPathGeometryFrame),
-    SIMPLE_SVG_CREATE(ellipse, NS_NewSVGPathGeometryFrame),
-    SIMPLE_SVG_CREATE(line, NS_NewSVGPathGeometryFrame),
-    SIMPLE_SVG_CREATE(rect, NS_NewSVGPathGeometryFrame),
-    SIMPLE_SVG_CREATE(path, NS_NewSVGPathGeometryFrame),
+    SIMPLE_SVG_CREATE(polygon, NS_NewSVGGeometryFrame),
+    SIMPLE_SVG_CREATE(polyline, NS_NewSVGGeometryFrame),
+    SIMPLE_SVG_CREATE(circle, NS_NewSVGGeometryFrame),
+    SIMPLE_SVG_CREATE(ellipse, NS_NewSVGGeometryFrame),
+    SIMPLE_SVG_CREATE(line, NS_NewSVGGeometryFrame),
+    SIMPLE_SVG_CREATE(rect, NS_NewSVGGeometryFrame),
+    SIMPLE_SVG_CREATE(path, NS_NewSVGGeometryFrame),
     SIMPLE_SVG_CREATE(defs, NS_NewSVGContainerFrame),
     SIMPLE_SVG_CREATE(generic_, NS_NewSVGGenericContainerFrame),
     { &nsGkAtoms::foreignObject,
diff --git a/layout/base/nsDisplayItemTypesList.h b/layout/base/nsDisplayItemTypesList.h
index cf809817ff..71036dd05c 100644
--- a/layout/base/nsDisplayItemTypesList.h
+++ b/layout/base/nsDisplayItemTypesList.h
@@ -52,7 +52,7 @@ DECLARE_DISPLAY_ITEM_TYPE(SUBDOCUMENT)
 DECLARE_DISPLAY_ITEM_TYPE(MASK)
 DECLARE_DISPLAY_ITEM_TYPE(FILTER)
 DECLARE_DISPLAY_ITEM_TYPE(SVG_OUTER_SVG)
-DECLARE_DISPLAY_ITEM_TYPE(SVG_PATH_GEOMETRY)
+DECLARE_DISPLAY_ITEM_TYPE(SVG_GEOMETRY)
 DECLARE_DISPLAY_ITEM_TYPE(SVG_TEXT)
 DECLARE_DISPLAY_ITEM_TYPE(TABLE_CELL_BACKGROUND)
 DECLARE_DISPLAY_ITEM_TYPE(TABLE_CELL_SELECTION)
diff --git a/layout/generic/nsFrameIdList.h b/layout/generic/nsFrameIdList.h
index 6be4309b81..1c22d7ea7f 100644
--- a/layout/generic/nsFrameIdList.h
+++ b/layout/generic/nsFrameIdList.h
@@ -153,7 +153,7 @@ FRAME_ID(nsSVGMaskFrame)
 FRAME_ID(nsSVGOuterSVGFrame)
 FRAME_ID(nsSVGOuterSVGAnonChildFrame)
 FRAME_ID(nsSVGPaintServerFrame)
-FRAME_ID(nsSVGPathGeometryFrame)
+FRAME_ID(SVGGeometryFrame)
 FRAME_ID(nsSVGPatternFrame)
 FRAME_ID(nsSVGRadialGradientFrame)
 FRAME_ID(nsSVGStopFrame)
diff --git a/layout/generic/nsImageFrame.cpp b/layout/generic/nsImageFrame.cpp
index 6afdeef618..6a7672a513 100644
--- a/layout/generic/nsImageFrame.cpp
+++ b/layout/generic/nsImageFrame.cpp
@@ -175,17 +175,18 @@ nsImageFrame::AccessibleType()
 void
 nsImageFrame::DisconnectMap()
 {
-  if (mImageMap) {
-    mImageMap->Destroy();
-    mImageMap = nullptr;
+  if (!mImageMap) {
+    return;
+  }
+  
+  mImageMap->Destroy();
+  mImageMap = nullptr;
 
 #ifdef ACCESSIBILITY
-  nsAccessibilityService* accService = GetAccService();
-  if (accService) {
+  if (nsAccessibilityService* accService = GetAccService()) {
     accService->RecreateAccessible(PresContext()->PresShell(), mContent);
   }
 #endif
-  }
 }
 
 void
@@ -1718,8 +1719,7 @@ nsImageFrame::PaintImage(nsRenderingContext& aRenderingContext, nsPoint aPt,
       nsLayoutUtils::GetSamplingFilterForFrame(this), dest, aDirtyRect,
       nullptr, flags, &anchorPoint);
 
-  nsImageMap* map = GetImageMap();
-  if (map) {
+  if (nsImageMap* map = GetImageMap()) {
     gfxPoint devPixelOffset =
       nsLayoutUtils::PointToGfxPoint(dest.TopLeft(),
                                      PresContext()->AppUnitsPerDevPixel());
@@ -1886,8 +1886,7 @@ nsImageMap*
 nsImageFrame::GetImageMap()
 {
   if (!mImageMap) {
-    nsIContent* map = GetMapElement();
-    if (map) {
+    if (nsIContent* map = GetMapElement()) {
       mImageMap = new nsImageMap();
       mImageMap->Init(this, map);
     }
@@ -1975,9 +1974,7 @@ nsImageFrame::GetContentForEvent(WidgetEvent* aEvent,
     return NS_OK;
   }
 
-  nsImageMap* map = GetImageMap();
-
-  if (nullptr != map) {
+  if (nsImageMap* map = GetImageMap()) {
     nsIntPoint p;
     TranslateEventCoords(
       nsLayoutUtils::GetEventCoordinatesRelativeTo(aEvent, this), p);
@@ -2006,7 +2003,7 @@ nsImageFrame::HandleEvent(nsPresContext* aPresContext,
       aEvent->mMessage == eMouseMove) {
     nsImageMap* map = GetImageMap();
     bool isServerMap = IsServerImageMap();
-    if ((nullptr != map) || isServerMap) {
+    if (map || isServerMap) {
       nsIntPoint p;
       TranslateEventCoords(
         nsLayoutUtils::GetEventCoordinatesRelativeTo(aEvent, this), p);
@@ -2015,7 +2012,7 @@ nsImageFrame::HandleEvent(nsPresContext* aPresContext,
       // through content, we need to make sure we're not inside
       // (in case we deal with a case of both client-side and
       // sever-side on the same image - it happens!)
-      if (nullptr != map) {
+      if (map) {
         inside = !!map->GetArea(p.x, p.y);
       }
 
@@ -2063,8 +2060,7 @@ nsresult
 nsImageFrame::GetCursor(const nsPoint& aPoint,
                         nsIFrame::Cursor& aCursor)
 {
-  nsImageMap* map = GetImageMap();
-  if (nullptr != map) {
+  if (nsImageMap* map = GetImageMap()) {
     nsIntPoint p;
     TranslateEventCoords(aPoint, p);
     nsCOMPtr<nsIContent> area = map->GetArea(p.x, p.y);
diff --git a/layout/generic/nsImageMap.cpp b/layout/generic/nsImageMap.cpp
index bc200a345d..6208c56888 100644
--- a/layout/generic/nsImageMap.cpp
+++ b/layout/generic/nsImageMap.cpp
@@ -9,6 +9,7 @@
 
 #include "mozilla/dom/Element.h"
 #include "mozilla/dom/Event.h" // for nsIDOMEvent::InternalDOMEvent()
+#include "mozilla/dom/HTMLAreaElement.h"
 #include "mozilla/gfx/PathHelpers.h"
 #include "mozilla/UniquePtr.h"
 #include "nsString.h"
@@ -29,10 +30,11 @@
 
 using namespace mozilla;
 using namespace mozilla::gfx;
+using namespace mozilla::dom;
 
 class Area {
 public:
-  explicit Area(nsIContent* aArea);
+  explicit Area(HTMLAreaElement* aArea);
   virtual ~Area();
 
   virtual void ParseCoords(const nsAString& aSpec);
@@ -45,17 +47,17 @@ public:
 
   void HasFocus(bool aHasFocus);
 
-  nsCOMPtr<nsIContent> mArea;
+  RefPtr<HTMLAreaElement> mArea;
   UniquePtr<nscoord[]> mCoords;
   int32_t mNumCoords;
   bool mHasFocus;
 };
 
-Area::Area(nsIContent* aArea)
+Area::Area(HTMLAreaElement* aArea)
   : mArea(aArea)
 {
   MOZ_COUNT_CTOR(Area);
-  NS_PRECONDITION(mArea, "How did that happen?");
+  MOZ_ASSERT(mArea, "How did that happen?");
   mNumCoords = 0;
   mHasFocus = false;
 }
@@ -266,7 +268,7 @@ void Area::HasFocus(bool aHasFocus)
 
 class DefaultArea : public Area {
 public:
-  explicit DefaultArea(nsIContent* aArea);
+  explicit DefaultArea(HTMLAreaElement* aArea);
 
   virtual bool IsInside(nscoord x, nscoord y) const override;
   virtual void Draw(nsIFrame* aFrame, DrawTarget& aDrawTarget,
@@ -275,7 +277,7 @@ public:
   virtual void GetRect(nsIFrame* aFrame, nsRect& aRect) override;
 };
 
-DefaultArea::DefaultArea(nsIContent* aArea)
+DefaultArea::DefaultArea(HTMLAreaElement* aArea)
   : Area(aArea)
 {
 }
@@ -310,7 +312,7 @@ void DefaultArea::GetRect(nsIFrame* aFrame, nsRect& aRect)
 
 class RectArea : public Area {
 public:
-  explicit RectArea(nsIContent* aArea);
+  explicit RectArea(HTMLAreaElement* aArea);
 
   virtual void ParseCoords(const nsAString& aSpec) override;
   virtual bool IsInside(nscoord x, nscoord y) const override;
@@ -320,7 +322,7 @@ public:
   virtual void GetRect(nsIFrame* aFrame, nsRect& aRect) override;
 };
 
-RectArea::RectArea(nsIContent* aArea)
+RectArea::RectArea(HTMLAreaElement* aArea)
   : Area(aArea)
 {
 }
@@ -416,7 +418,7 @@ void RectArea::GetRect(nsIFrame* aFrame, nsRect& aRect)
 
 class PolyArea : public Area {
 public:
-  explicit PolyArea(nsIContent* aArea);
+  explicit PolyArea(HTMLAreaElement* aArea);
 
   virtual void ParseCoords(const nsAString& aSpec) override;
   virtual bool IsInside(nscoord x, nscoord y) const override;
@@ -426,7 +428,7 @@ public:
   virtual void GetRect(nsIFrame* aFrame, nsRect& aRect) override;
 };
 
-PolyArea::PolyArea(nsIContent* aArea)
+PolyArea::PolyArea(HTMLAreaElement* aArea)
   : Area(aArea)
 {
 }
@@ -573,7 +575,7 @@ void PolyArea::GetRect(nsIFrame* aFrame, nsRect& aRect)
 
 class CircleArea : public Area {
 public:
-  explicit CircleArea(nsIContent* aArea);
+  explicit CircleArea(HTMLAreaElement* aArea);
 
   virtual void ParseCoords(const nsAString& aSpec) override;
   virtual bool IsInside(nscoord x, nscoord y) const override;
@@ -583,7 +585,7 @@ public:
   virtual void GetRect(nsIFrame* aFrame, nsRect& aRect) override;
 };
 
-CircleArea::CircleArea(nsIContent* aArea)
+CircleArea::CircleArea(HTMLAreaElement* aArea)
   : Area(aArea)
 {
 }
@@ -676,9 +678,9 @@ void CircleArea::GetRect(nsIFrame* aFrame, nsRect& aRect)
 //----------------------------------------------------------------------
 
 
-nsImageMap::nsImageMap() :
-  mImageFrame(nullptr),
-  mContainsBlockContents(false)
+nsImageMap::nsImageMap()
+  : mImageFrame(nullptr)
+  , mConsiderWholeSubtree(false)
 {
 }
 
@@ -713,9 +715,7 @@ nsImageMap::GetBoundsForAreaContent(nsIContent *aContent,
 void
 nsImageMap::FreeAreas()
 {
-  uint32_t i, n = mAreas.Length();
-  for (i = 0; i < n; i++) {
-    Area* area = mAreas.ElementAt(i);
+  for (auto* area : mAreas) {
     if (area->mArea->IsInUncomposedDoc()) {
       NS_ASSERTION(area->mArea->GetPrimaryFrame() == mImageFrame,
                    "Unexpected primary frame");
@@ -729,93 +729,68 @@ nsImageMap::FreeAreas()
                                            false);
     delete area;
   }
+
   mAreas.Clear();
 }
 
-nsresult
+void
 nsImageMap::Init(nsImageFrame* aImageFrame, nsIContent* aMap)
 {
-  NS_PRECONDITION(aMap, "null ptr");
-  if (!aMap) {
-    return NS_ERROR_NULL_POINTER;
-  }
-  mImageFrame = aImageFrame;
+  MOZ_ASSERT(aMap);
+  MOZ_ASSERT(aImageFrame);
 
+  mImageFrame = aImageFrame;
   mMap = aMap;
   mMap->AddMutationObserver(this);
 
   // "Compile" the areas in the map into faster access versions
-  return UpdateAreas();
+  UpdateAreas();
 }
 
 
-nsresult
-nsImageMap::SearchForAreas(nsIContent* aParent, bool& aFoundArea,
-                           bool& aFoundAnchor)
+void
+nsImageMap::SearchForAreas(nsIContent* aParent)
 {
-  nsresult rv = NS_OK;
-  uint32_t i, n = aParent->GetChildCount();
+  // Look for <area> elements.
+  for (nsIContent* child = aParent->GetFirstChild();
+       child;
+       child = child->GetNextSibling()) {
+    if (child->IsHTMLElement(nsGkAtoms::area)) {
+      HTMLAreaElement* area = static_cast<HTMLAreaElement*>(HTMLAreaElement::FromContent(child));
+      AddArea(area);
 
-  // Look for <area> or <a> elements. We'll use whichever type we find first.
-  for (i = 0; i < n; i++) {
-    nsIContent *child = aParent->GetChildAt(i);
-
-    // If we haven't determined that the map element contains an
-    // <a> element yet, then look for <area>.
-    if (!aFoundAnchor && child->IsHTMLElement(nsGkAtoms::area)) {
-      aFoundArea = true;
-      rv = AddArea(child);
-      NS_ENSURE_SUCCESS(rv, rv);
-
-      // Continue to next child. This stops mContainsBlockContents from
+      // Continue to next sibling. This stops mConsiderWholeSubtree from
       // getting set. It also makes us ignore children of <area>s which
       // is consistent with how we react to dynamic insertion of such
       // children.
       continue;
     }
 
-    // If we haven't determined that the map element contains an
-    // <area> element yet, then look for <a>.
-    if (!aFoundArea && child->IsHTMLElement(nsGkAtoms::a)) {
-      aFoundAnchor = true;
-      rv = AddArea(child);
-      NS_ENSURE_SUCCESS(rv, rv);
-    }
-
     if (child->IsElement()) {
-      mContainsBlockContents = true;
-      rv = SearchForAreas(child, aFoundArea, aFoundAnchor);
-      NS_ENSURE_SUCCESS(rv, rv);
+      mConsiderWholeSubtree = true;
+      SearchForAreas(child);
     }
   }
-
-  return NS_OK;
 }
 
-nsresult
+void
 nsImageMap::UpdateAreas()
 {
   // Get rid of old area data
   FreeAreas();
 
-  bool foundArea = false;
-  bool foundAnchor = false;
-  mContainsBlockContents = false;
+  mConsiderWholeSubtree = false;
+  SearchForAreas(mMap);
 
-  nsresult rv = SearchForAreas(mMap, foundArea, foundAnchor);
 #ifdef ACCESSIBILITY
-  if (NS_SUCCEEDED(rv)) {
-    nsAccessibilityService* accService = GetAccService();
-    if (accService) {
-      accService->UpdateImageMap(mImageFrame);
-    }
+  if (nsAccessibilityService* accService = GetAccService()) {
+    accService->UpdateImageMap(mImageFrame);
   }
 #endif
-  return rv;
 }
 
-nsresult
-nsImageMap::AddArea(nsIContent* aArea)
+void
+nsImageMap::AddArea(HTMLAreaElement* aArea)
 {
   static nsIContent::AttrValuesArray strings[] =
     {&nsGkAtoms::rect, &nsGkAtoms::rectangle,
@@ -846,17 +821,17 @@ nsImageMap::AddArea(nsIContent* aArea)
     break;
   default:
     area = nullptr;
-    NS_NOTREACHED("FindAttrValueIn returned an unexpected value.");
+    MOZ_ASSERT_UNREACHABLE("FindAttrValueIn returned an unexpected value.");
     break;
   }
-  if (!area)
-    return NS_ERROR_OUT_OF_MEMORY;
+  if (!area) {
+    // Possibly OOM, or invalid attr (does not assert in release); early exit
+    return;
+  }
 
   //Add focus listener to track area focus changes
-  aArea->AddSystemEventListener(NS_LITERAL_STRING("focus"), this, false,
-                                false);
-  aArea->AddSystemEventListener(NS_LITERAL_STRING("blur"), this, false,
-                                false);
+  aArea->AddSystemEventListener(NS_LITERAL_STRING("focus"), this, false, false);
+  aArea->AddSystemEventListener(NS_LITERAL_STRING("blur"), this, false, false);
 
   // This is a nasty hack.  It needs to go away: see bug 135040.  Once this is
   // removed, the code added to RestyleManager::RestyleElement,
@@ -869,16 +844,13 @@ nsImageMap::AddArea(nsIContent* aArea)
   aArea->GetAttr(kNameSpaceID_None, nsGkAtoms::coords, coords);
   area->ParseCoords(coords);
   mAreas.AppendElement(area);
-  return NS_OK;
 }
 
 nsIContent*
 nsImageMap::GetArea(nscoord aX, nscoord aY) const
 {
   NS_ASSERTION(mMap, "Not initialized");
-  uint32_t i, n = mAreas.Length();
-  for (i = 0; i < n; i++) {
-    Area* area = mAreas.ElementAt(i);
+  for (auto* area : mAreas) {
     if (area->IsInside(aX, aY)) {
       return area->mArea;
     }
@@ -908,7 +880,7 @@ nsImageMap::Draw(nsIFrame* aFrame, DrawTarget& aDrawTarget,
 void
 nsImageMap::MaybeUpdateAreas(nsIContent *aContent)
 {
-  if (aContent == mMap || mContainsBlockContents) {
+  if (aContent == mMap || mConsiderWholeSubtree) {
     UpdateAreas();
   }
 }
@@ -922,11 +894,10 @@ nsImageMap::AttributeChanged(nsIDocument*  aDocument,
                              const nsAttrValue* aOldValue)
 {
   // If the parent of the changing content node is our map then update
-  // the map.  But only do this if the node is an HTML <area> or <a>
+  // the map.  But only do this if the node is an HTML <area>
   // and the attribute that's changing is "shape" or "coords" -- those
   // are the only cases we care about.
-  if ((aElement->NodeInfo()->Equals(nsGkAtoms::area) ||
-       aElement->NodeInfo()->Equals(nsGkAtoms::a)) &&
+  if (aElement->NodeInfo()->Equals(nsGkAtoms::area) &&
       aElement->IsHTMLElement() &&
       aNameSpaceID == kNameSpaceID_None &&
       (aAttribute == nsGkAtoms::shape ||
@@ -1012,7 +983,7 @@ nsImageMap::HandleEvent(nsIDOMEvent* aEvent)
 }
 
 void
-nsImageMap::Destroy(void)
+nsImageMap::Destroy()
 {
   FreeAreas();
   mImageFrame = nullptr;
diff --git a/layout/generic/nsImageMap.h b/layout/generic/nsImageMap.h
index 50dd737972..27c5f7b7d1 100644
--- a/layout/generic/nsImageMap.h
+++ b/layout/generic/nsImageMap.h
@@ -21,6 +21,12 @@ class nsIFrame;
 class nsIContent;
 struct nsRect;
 
+namespace mozilla {
+namespace dom {
+class HTMLAreaElement;
+}
+}
+
 class nsImageMap final : public nsStubMutationObserver,
                          public nsIDOMEventListener
 {
@@ -31,7 +37,7 @@ class nsImageMap final : public nsStubMutationObserver,
 public:
   nsImageMap();
 
-  nsresult Init(nsImageFrame* aImageFrame, nsIContent* aMap);
+  void Init(nsImageFrame* aImageFrame, nsIContent* aMap);
 
   /**
    * Return the first area element (in content order) for the given aX,aY pixel
@@ -80,18 +86,21 @@ protected:
 
   void FreeAreas();
 
-  nsresult UpdateAreas();
-  nsresult SearchForAreas(nsIContent* aParent, bool& aFoundArea,
-                          bool& aFoundAnchor);
+  void UpdateAreas();
+  void SearchForAreas(nsIContent* aParent);
 
-  nsresult AddArea(nsIContent* aArea);
+  void AddArea(mozilla::dom::HTMLAreaElement* aArea);
  
   void MaybeUpdateAreas(nsIContent *aContent);
 
   nsImageFrame* mImageFrame;  // the frame that owns us
   nsCOMPtr<nsIContent> mMap;
   AutoTArray<Area*, 8> mAreas; // almost always has some entries
-  bool mContainsBlockContents;
+
+  // This is set when we search for all area children and tells us whether we
+  // should consider the whole subtree or just direct children when we get
+  // content notifications about changes inside the map subtree.
+  bool mConsiderWholeSubtree;
 };
 
 #endif /* nsImageMap_h */
diff --git a/layout/style/nsStyleStruct.cpp b/layout/style/nsStyleStruct.cpp
index 9de0f13c00..334a6e99a8 100644
--- a/layout/style/nsStyleStruct.cpp
+++ b/layout/style/nsStyleStruct.cpp
@@ -929,7 +929,7 @@ nsStyleSVG::CalcDifference(const nsStyleSVG& aNewData) const
   if (!DefinitelyEqualURIs(mMarkerEnd, aNewData.mMarkerEnd) ||
       !DefinitelyEqualURIs(mMarkerMid, aNewData.mMarkerMid) ||
       !DefinitelyEqualURIs(mMarkerStart, aNewData.mMarkerStart)) {
-    // Markers currently contribute to nsSVGPathGeometryFrame::mRect,
+    // Markers currently contribute to SVGGeometryFrame::mRect,
     // so we need a reflow as well as a repaint. No intrinsic sizes need
     // to change, so nsChangeHint_NeedReflow is sufficient.
     return nsChangeHint_UpdateEffects |
@@ -950,7 +950,7 @@ nsStyleSVG::CalcDifference(const nsStyleSVG& aNewData) const
       // stroke (in which case whether we have fill or not is significant to frame
       // bounds) and whether we have fill or not just changed. In either case we
       // need to reflow so the frame rect is updated.
-      // XXXperf this is a waste on non nsSVGPathGeometryFrames.
+      // XXXperf this is a waste on non SVGGeometryFrames.
       hint |= nsChangeHint_NeedReflow |
               nsChangeHint_NeedDirtyReflow; // XXX remove me: bug 876085
     }
@@ -960,10 +960,10 @@ nsStyleSVG::CalcDifference(const nsStyleSVG& aNewData) const
     }
   }
 
-  // Stroke currently contributes to nsSVGPathGeometryFrame::mRect, so
+  // Stroke currently contributes to SVGGeometryFrame::mRect, so
   // we need a reflow here. No intrinsic sizes need to change, so
   // nsChangeHint_NeedReflow is sufficient.
-  // Note that stroke-dashoffset does not affect nsSVGPathGeometryFrame::mRect.
+  // Note that stroke-dashoffset does not affect SVGGeometryFrame::mRect.
   // text-anchor changes also require a reflow since it changes frames' rects.
   if (mStrokeWidth           != aNewData.mStrokeWidth           ||
       mStrokeMiterlimit      != aNewData.mStrokeMiterlimit      ||
@@ -1189,9 +1189,9 @@ nsStyleSVGReset::CalcDifference(const nsStyleSVGReset& aNewData) const
     // XXXjwatt: why NS_STYLE_HINT_REFLOW? Isn't that excessive?
     hint |= NS_STYLE_HINT_REFLOW;
   } else if (mVectorEffect  != aNewData.mVectorEffect) {
-    // Stroke currently affects nsSVGPathGeometryFrame::mRect, and
+    // Stroke currently affects SVGGeometryFrame::mRect, and
     // vector-effect affect stroke. As a result we need to reflow if
-    // vector-effect changes in order to have nsSVGPathGeometryFrame::
+    // vector-effect changes in order to have SVGGeometryFrame::
     // ReflowSVG called to update its mRect. No intrinsic sizes need
     // to change so nsChangeHint_NeedReflow is sufficient.
     hint |= nsChangeHint_NeedReflow |
@@ -3962,8 +3962,8 @@ nsStyleUserInterface::CalcDifference(const nsStyleUserInterface& aNewData) const
   }
 
   if (mPointerEvents != aNewData.mPointerEvents) {
-    // nsSVGPathGeometryFrame's mRect depends on stroke _and_ on the value
-    // of pointer-events. See nsSVGPathGeometryFrame::ReflowSVG's use of
+    // SVGGeometryFrame's mRect depends on stroke _and_ on the value
+    // of pointer-events. See SVGGeometryFrame::ReflowSVG's use of
     // GetHitTestFlags. (Only a reflow, no visual change.)
     hint |= nsChangeHint_NeedReflow |
             nsChangeHint_NeedDirtyReflow; // XXX remove me: bug 876085
diff --git a/layout/svg/nsSVGPathGeometryFrame.cpp b/layout/svg/SVGGeometryFrame.cpp
similarity index 87%
rename from layout/svg/nsSVGPathGeometryFrame.cpp
rename to layout/svg/SVGGeometryFrame.cpp
index 50eec2b922..ad1d0e2fc4 100644
--- a/layout/svg/nsSVGPathGeometryFrame.cpp
+++ b/layout/svg/SVGGeometryFrame.cpp
@@ -4,7 +4,7 @@
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 // Main header first:
-#include "nsSVGPathGeometryFrame.h"
+#include "SVGGeometryFrame.h"
 
 // Keep others in (case-insensitive) order:
 #include "gfx2DGlue.h"
@@ -22,7 +22,7 @@
 #include "nsSVGEffects.h"
 #include "nsSVGIntegrationUtils.h"
 #include "nsSVGMarkerFrame.h"
-#include "nsSVGPathGeometryElement.h"
+#include "SVGGeometryElement.h"
 #include "nsSVGUtils.h"
 #include "mozilla/ArrayUtils.h"
 #include "SVGAnimatedTransformList.h"
@@ -37,41 +37,41 @@ using namespace mozilla::image;
 // Implementation
 
 nsIFrame*
-NS_NewSVGPathGeometryFrame(nsIPresShell* aPresShell,
-                           nsStyleContext* aContext)
+NS_NewSVGGeometryFrame(nsIPresShell* aPresShell,
+                       nsStyleContext* aContext)
 {
-  return new (aPresShell) nsSVGPathGeometryFrame(aContext);
+  return new (aPresShell) SVGGeometryFrame(aContext);
 }
 
-NS_IMPL_FRAMEARENA_HELPERS(nsSVGPathGeometryFrame)
+NS_IMPL_FRAMEARENA_HELPERS(SVGGeometryFrame)
 
 //----------------------------------------------------------------------
 // nsQueryFrame methods
 
-NS_QUERYFRAME_HEAD(nsSVGPathGeometryFrame)
+NS_QUERYFRAME_HEAD(SVGGeometryFrame)
   NS_QUERYFRAME_ENTRY(nsISVGChildFrame)
-  NS_QUERYFRAME_ENTRY(nsSVGPathGeometryFrame)
+  NS_QUERYFRAME_ENTRY(SVGGeometryFrame)
 NS_QUERYFRAME_TAIL_INHERITING(nsFrame)
 
 //----------------------------------------------------------------------
 // Display list item:
 
-class nsDisplaySVGPathGeometry : public nsDisplayItem {
+class nsDisplaySVGGeometry : public nsDisplayItem {
 public:
-  nsDisplaySVGPathGeometry(nsDisplayListBuilder* aBuilder,
-                           nsSVGPathGeometryFrame* aFrame)
+  nsDisplaySVGGeometry(nsDisplayListBuilder* aBuilder,
+                       SVGGeometryFrame* aFrame)
     : nsDisplayItem(aBuilder, aFrame)
   {
-    MOZ_COUNT_CTOR(nsDisplaySVGPathGeometry);
+    MOZ_COUNT_CTOR(nsDisplaySVGGeometry);
     MOZ_ASSERT(aFrame, "Must have a frame!");
   }
 #ifdef NS_BUILD_REFCNT_LOGGING
-  virtual ~nsDisplaySVGPathGeometry() {
-    MOZ_COUNT_DTOR(nsDisplaySVGPathGeometry);
+  virtual ~nsDisplaySVGGeometry() {
+    MOZ_COUNT_DTOR(nsDisplaySVGGeometry);
   }
 #endif
 
-  NS_DISPLAY_DECL_NAME("nsDisplaySVGPathGeometry", TYPE_SVG_PATH_GEOMETRY)
+  NS_DISPLAY_DECL_NAME("nsDisplaySVGGeometry", TYPE_SVG_GEOMETRY)
 
   virtual void HitTest(nsDisplayListBuilder* aBuilder, const nsRect& aRect,
                        HitTestState* aState, nsTArray<nsIFrame*> *aOutFrames) override;
@@ -89,10 +89,10 @@ public:
 };
 
 void
-nsDisplaySVGPathGeometry::HitTest(nsDisplayListBuilder* aBuilder, const nsRect& aRect,
-                                  HitTestState* aState, nsTArray<nsIFrame*> *aOutFrames)
+nsDisplaySVGGeometry::HitTest(nsDisplayListBuilder* aBuilder, const nsRect& aRect,
+                              HitTestState* aState, nsTArray<nsIFrame*> *aOutFrames)
 {
-  nsSVGPathGeometryFrame *frame = static_cast<nsSVGPathGeometryFrame*>(mFrame);
+  SVGGeometryFrame *frame = static_cast<SVGGeometryFrame*>(mFrame);
   nsPoint pointRelativeToReferenceFrame = aRect.Center();
   // ToReferenceFrame() includes frame->GetPosition(), our user space position.
   nsPoint userSpacePtInAppUnits = pointRelativeToReferenceFrame -
@@ -106,8 +106,8 @@ nsDisplaySVGPathGeometry::HitTest(nsDisplayListBuilder* aBuilder, const nsRect&
 }
 
 void
-nsDisplaySVGPathGeometry::Paint(nsDisplayListBuilder* aBuilder,
-                                nsRenderingContext* aCtx)
+nsDisplaySVGGeometry::Paint(nsDisplayListBuilder* aBuilder,
+                            nsRenderingContext* aCtx)
 {
   uint32_t appUnitsPerDevPixel = mFrame->PresContext()->AppUnitsPerDevPixel();
 
@@ -122,13 +122,13 @@ nsDisplaySVGPathGeometry::Paint(nsDisplayListBuilder* aBuilder,
   gfxMatrix tm = nsSVGIntegrationUtils::GetCSSPxToDevPxMatrix(mFrame) *
                    gfxMatrix::Translation(devPixelOffset);
   DrawResult result =
-    static_cast<nsSVGPathGeometryFrame*>(mFrame)->PaintSVG(*aCtx->ThebesContext(), tm);
+    static_cast<SVGGeometryFrame*>(mFrame)->PaintSVG(*aCtx->ThebesContext(), tm);
 
   nsDisplayItemGenericImageGeometry::UpdateDrawResult(this, result);
 }
 
 void
-nsDisplaySVGPathGeometry::ComputeInvalidationRegion(
+nsDisplaySVGGeometry::ComputeInvalidationRegion(
   nsDisplayListBuilder* aBuilder,
   const nsDisplayItemGeometry* aGeometry,
   nsRegion* aInvalidRegion)
@@ -145,22 +145,24 @@ nsDisplaySVGPathGeometry::ComputeInvalidationRegion(
   nsDisplayItem::ComputeInvalidationRegion(aBuilder, aGeometry, aInvalidRegion);
 }
 
+namespace mozilla {
+
 //----------------------------------------------------------------------
 // nsIFrame methods
 
 void
-nsSVGPathGeometryFrame::Init(nsIContent*       aContent,
-                             nsContainerFrame* aParent,
-                             nsIFrame*         aPrevInFlow)
+SVGGeometryFrame::Init(nsIContent*       aContent,
+                       nsContainerFrame* aParent,
+                       nsIFrame*         aPrevInFlow)
 {
   AddStateBits(aParent->GetStateBits() & NS_STATE_SVG_CLIPPATH_CHILD);
   nsFrame::Init(aContent, aParent, aPrevInFlow);
 }
 
 nsresult
-nsSVGPathGeometryFrame::AttributeChanged(int32_t         aNameSpaceID,
-                                         nsIAtom*        aAttribute,
-                                         int32_t         aModType)
+SVGGeometryFrame::AttributeChanged(int32_t         aNameSpaceID,
+                                   nsIAtom*        aAttribute,
+                                   int32_t         aModType)
 {
   // We don't invalidate for transform changes (the layers code does that).
   // Also note that SVGTransformableElement::GetAttributeChangeHint will
@@ -168,7 +170,7 @@ nsSVGPathGeometryFrame::AttributeChanged(int32_t         aNameSpaceID,
   // and cause DoApplyRenderingChangeToTree to make the SchedulePaint call.
 
   if (aNameSpaceID == kNameSpaceID_None &&
-      (static_cast<nsSVGPathGeometryElement*>
+      (static_cast<SVGGeometryElement*>
                   (mContent)->AttributeDefinesGeometry(aAttribute))) {
     nsLayoutUtils::PostRestyleEvent(
       mContent->AsElement(), nsRestyleHint(0),
@@ -179,7 +181,7 @@ nsSVGPathGeometryFrame::AttributeChanged(int32_t         aNameSpaceID,
 }
 
 /* virtual */ void
-nsSVGPathGeometryFrame::DidSetStyleContext(nsStyleContext* aOldStyleContext)
+SVGGeometryFrame::DidSetStyleContext(nsStyleContext* aOldStyleContext)
 {
   nsFrame::DidSetStyleContext(aOldStyleContext);
 
@@ -193,8 +195,8 @@ nsSVGPathGeometryFrame::DidSetStyleContext(nsStyleContext* aOldStyleContext)
       InvalidateFrame();
     }
 
-    nsSVGPathGeometryElement* element =
-      static_cast<nsSVGPathGeometryElement*>(mContent);
+    SVGGeometryElement* element =
+      static_cast<SVGGeometryElement*>(mContent);
 
     auto oldStyleSVG = aOldStyleContext->PeekStyleSVG();
     if (oldStyleSVG && !SVGContentUtils::ShapeTypeHasNoCorners(mContent)) {
@@ -222,14 +224,14 @@ nsSVGPathGeometryFrame::DidSetStyleContext(nsStyleContext* aOldStyleContext)
 }
 
 nsIAtom *
-nsSVGPathGeometryFrame::GetType() const
+SVGGeometryFrame::GetType() const
 {
-  return nsGkAtoms::svgPathGeometryFrame;
+  return nsGkAtoms::svgGeometryFrame;
 }
 
 bool
-nsSVGPathGeometryFrame::IsSVGTransformed(gfx::Matrix *aOwnTransform,
-                                         gfx::Matrix *aFromParentTransform) const
+SVGGeometryFrame::IsSVGTransformed(gfx::Matrix *aOwnTransform,
+                                   gfx::Matrix *aFromParentTransform) const
 {
   bool foundTransform = false;
 
@@ -258,8 +260,8 @@ nsSVGPathGeometryFrame::IsSVGTransformed(gfx::Matrix *aOwnTransform,
 }
 
 void
-nsSVGPathGeometryFrame::BuildDisplayList(nsDisplayListBuilder*   aBuilder,
-                                         const nsDisplayListSet& aLists)
+SVGGeometryFrame::BuildDisplayList(nsDisplayListBuilder*   aBuilder,
+                                   const nsDisplayListSet& aLists)
 {
   if (!static_cast<const nsSVGElement*>(mContent)->HasValidDimensions() ||
       (!IsVisibleForPainting(aBuilder) && aBuilder->IsForPainting())) {
@@ -267,16 +269,16 @@ nsSVGPathGeometryFrame::BuildDisplayList(nsDisplayListBuilder*   aBuilder,
   }
   DisplayOutline(aBuilder, aLists);
   aLists.Content()->AppendNewToTop(
-    new (aBuilder) nsDisplaySVGPathGeometry(aBuilder, this));
+    new (aBuilder) nsDisplaySVGGeometry(aBuilder, this));
 }
 
 //----------------------------------------------------------------------
 // nsISVGChildFrame methods
 
 DrawResult
-nsSVGPathGeometryFrame::PaintSVG(gfxContext& aContext,
-                                 const gfxMatrix& aTransform,
-                                 const nsIntRect* aDirtyRect)
+SVGGeometryFrame::PaintSVG(gfxContext& aContext,
+                           const gfxMatrix& aTransform,
+                           const nsIntRect* aDirtyRect)
 {
   if (!StyleVisibility()->IsVisible())
     return DrawResult::SUCCESS;
@@ -322,7 +324,7 @@ nsSVGPathGeometryFrame::PaintSVG(gfxContext& aContext,
 }
 
 nsIFrame*
-nsSVGPathGeometryFrame::GetFrameForPoint(const gfxPoint& aPoint)
+SVGGeometryFrame::GetFrameForPoint(const gfxPoint& aPoint)
 {
   FillRule fillRule;
   uint16_t hitTestFlags;
@@ -346,8 +348,8 @@ nsSVGPathGeometryFrame::GetFrameForPoint(const gfxPoint& aPoint)
 
   bool isHit = false;
 
-  nsSVGPathGeometryElement* content =
-    static_cast<nsSVGPathGeometryElement*>(mContent);
+  SVGGeometryElement* content =
+    static_cast<SVGGeometryElement*>(mContent);
 
   // Using ScreenReferenceDrawTarget() opens us to Moz2D backend specific hit-
   // testing bugs. Maybe we should use a BackendType::CAIRO DT for hit-testing
@@ -387,7 +389,7 @@ nsSVGPathGeometryFrame::GetFrameForPoint(const gfxPoint& aPoint)
 }
 
 nsRect
-nsSVGPathGeometryFrame::GetCoveredRegion()
+SVGGeometryFrame::GetCoveredRegion()
 {
   gfxMatrix canvasTM = GetCanvasTM();
   if (canvasTM.PreservesAxisAlignedRectangles()) {
@@ -409,7 +411,7 @@ nsSVGPathGeometryFrame::GetCoveredRegion()
 }
 
 void
-nsSVGPathGeometryFrame::ReflowSVG()
+SVGGeometryFrame::ReflowSVG()
 {
   NS_ASSERTION(nsSVGUtils::OuterSVGIsCallingReflowSVG(this),
                "This call is probably a wasteful mistake");
@@ -463,7 +465,7 @@ nsSVGPathGeometryFrame::ReflowSVG()
 }
 
 void
-nsSVGPathGeometryFrame::NotifySVGChanged(uint32_t aFlags)
+SVGGeometryFrame::NotifySVGChanged(uint32_t aFlags)
 {
   MOZ_ASSERT(aFlags & (TRANSFORM_CHANGED | COORD_CONTEXT_CHANGED),
              "Invalidation logic may need adjusting");
@@ -487,9 +489,9 @@ nsSVGPathGeometryFrame::NotifySVGChanged(uint32_t aFlags)
     // of stroke-dashoffset since, although that can have a percentage value
     // that is resolved against our coordinate context, it does not affect our
     // mRect.
-    if (static_cast<nsSVGPathGeometryElement*>(mContent)->GeometryDependsOnCoordCtx() ||
+    if (static_cast<SVGGeometryElement*>(mContent)->GeometryDependsOnCoordCtx() ||
         StyleSVG()->mStrokeWidth.HasPercent()) {
-      static_cast<nsSVGPathGeometryElement*>(mContent)->ClearAnyCachedPath();
+      static_cast<SVGGeometryElement*>(mContent)->ClearAnyCachedPath();
       nsSVGUtils::ScheduleReflowSVG(this);
     }
   }
@@ -502,8 +504,8 @@ nsSVGPathGeometryFrame::NotifySVGChanged(uint32_t aFlags)
 }
 
 SVGBBox
-nsSVGPathGeometryFrame::GetBBoxContribution(const Matrix &aToBBoxUserspace,
-                                            uint32_t aFlags)
+SVGGeometryFrame::GetBBoxContribution(const Matrix &aToBBoxUserspace,
+                                      uint32_t aFlags)
 {
   SVGBBox bbox;
 
@@ -512,8 +514,8 @@ nsSVGPathGeometryFrame::GetBBoxContribution(const Matrix &aToBBoxUserspace,
     return bbox;
   }
 
-  nsSVGPathGeometryElement* element =
-    static_cast<nsSVGPathGeometryElement*>(mContent);
+  SVGGeometryElement* element =
+    static_cast<SVGGeometryElement*>(mContent);
 
   bool getFill = (aFlags & nsSVGUtils::eBBoxIncludeFillGeometry) ||
                  ((aFlags & nsSVGUtils::eBBoxIncludeFill) &&
@@ -629,7 +631,7 @@ nsSVGPathGeometryFrame::GetBBoxContribution(const Matrix &aToBBoxUserspace,
       //
       // Second, the way we account for non-scaling-stroke by transforming the
       // path using the transform to the outer-<svg> element is not compatible
-      // with the way that nsSVGPathGeometryFrame::Reflow() inserts a scale
+      // with the way that SVGGeometryFrame::Reflow() inserts a scale
       // into aToBBoxUserspace and then scales the bounds that we return.
       SVGContentUtils::AutoStrokeOptions strokeOptions;
       SVGContentUtils::GetStrokeOptions(&strokeOptions, element,
@@ -666,14 +668,14 @@ nsSVGPathGeometryFrame::GetBBoxContribution(const Matrix &aToBBoxUserspace,
 
   // Account for markers:
   if ((aFlags & nsSVGUtils::eBBoxIncludeMarkers) != 0 &&
-      static_cast<nsSVGPathGeometryElement*>(mContent)->IsMarkable()) {
+      static_cast<SVGGeometryElement*>(mContent)->IsMarkable()) {
 
     float strokeWidth = nsSVGUtils::GetStrokeWidth(this);
     MarkerProperties properties = GetMarkerProperties(this);
 
     if (properties.MarkersExist()) {
       nsTArray<nsSVGMark> marks;
-      static_cast<nsSVGPathGeometryElement*>(mContent)->GetMarkPoints(&marks);
+      static_cast<SVGGeometryElement*>(mContent)->GetMarkPoints(&marks);
       uint32_t num = marks.Length();
 
       // These are in the same order as the nsSVGMark::Type constants.
@@ -703,10 +705,10 @@ nsSVGPathGeometryFrame::GetBBoxContribution(const Matrix &aToBBoxUserspace,
 }
 
 //----------------------------------------------------------------------
-// nsSVGPathGeometryFrame methods:
+// SVGGeometryFrame methods:
 
 gfxMatrix
-nsSVGPathGeometryFrame::GetCanvasTM()
+SVGGeometryFrame::GetCanvasTM()
 {
   NS_ASSERTION(GetParent(), "null parent");
 
@@ -716,8 +718,8 @@ nsSVGPathGeometryFrame::GetCanvasTM()
   return content->PrependLocalTransformsTo(parent->GetCanvasTM());
 }
 
-nsSVGPathGeometryFrame::MarkerProperties
-nsSVGPathGeometryFrame::GetMarkerProperties(nsSVGPathGeometryFrame *aFrame)
+SVGGeometryFrame::MarkerProperties
+SVGGeometryFrame::GetMarkerProperties(SVGGeometryFrame *aFrame)
 {
   NS_ASSERTION(!aFrame->GetPrevContinuation(), "aFrame should be first continuation");
 
@@ -741,7 +743,7 @@ nsSVGPathGeometryFrame::GetMarkerProperties(nsSVGPathGeometryFrame *aFrame)
 }
 
 nsSVGMarkerFrame *
-nsSVGPathGeometryFrame::MarkerProperties::GetMarkerStartFrame()
+SVGGeometryFrame::MarkerProperties::GetMarkerStartFrame()
 {
   if (!mMarkerStart)
     return nullptr;
@@ -750,7 +752,7 @@ nsSVGPathGeometryFrame::MarkerProperties::GetMarkerStartFrame()
 }
 
 nsSVGMarkerFrame *
-nsSVGPathGeometryFrame::MarkerProperties::GetMarkerMidFrame()
+SVGGeometryFrame::MarkerProperties::GetMarkerMidFrame()
 {
   if (!mMarkerMid)
     return nullptr;
@@ -759,7 +761,7 @@ nsSVGPathGeometryFrame::MarkerProperties::GetMarkerMidFrame()
 }
 
 nsSVGMarkerFrame *
-nsSVGPathGeometryFrame::MarkerProperties::GetMarkerEndFrame()
+SVGGeometryFrame::MarkerProperties::GetMarkerEndFrame()
 {
   if (!mMarkerEnd)
     return nullptr;
@@ -768,9 +770,9 @@ nsSVGPathGeometryFrame::MarkerProperties::GetMarkerEndFrame()
 }
 
 void
-nsSVGPathGeometryFrame::Render(gfxContext* aContext,
-                               uint32_t aRenderComponents,
-                               const gfxMatrix& aNewTransform)
+SVGGeometryFrame::Render(gfxContext* aContext,
+                         uint32_t aRenderComponents,
+                         const gfxMatrix& aNewTransform)
 {
   MOZ_ASSERT(!aNewTransform.IsSingular());
 
@@ -780,8 +782,8 @@ nsSVGPathGeometryFrame::Render(gfxContext* aContext,
     nsSVGUtils::ToFillRule((GetStateBits() & NS_STATE_SVG_CLIPPATH_CHILD) ?
                              StyleSVG()->mClipRule : StyleSVG()->mFillRule);
 
-  nsSVGPathGeometryElement* element =
-    static_cast<nsSVGPathGeometryElement*>(mContent);
+  SVGGeometryElement* element =
+    static_cast<SVGGeometryElement*>(mContent);
 
   AntialiasMode aaMode =
     (StyleSVG()->mShapeRendering == NS_STYLE_SHAPE_RENDERING_OPTIMIZESPEED ||
@@ -806,7 +808,7 @@ nsSVGPathGeometryFrame::Render(gfxContext* aContext,
     return;
   }
 
-  nsSVGPathGeometryElement::SimplePath simplePath;
+  SVGGeometryElement::SimplePath simplePath;
   RefPtr<Path> path;
 
   element->GetAsSimplePath(&simplePath);
@@ -882,19 +884,19 @@ nsSVGPathGeometryFrame::Render(gfxContext* aContext,
 }
 
 void
-nsSVGPathGeometryFrame::PaintMarkers(gfxContext& aContext,
-                                     const gfxMatrix& aTransform)
+SVGGeometryFrame::PaintMarkers(gfxContext& aContext,
+                               const gfxMatrix& aTransform)
 {
   SVGContextPaint* contextPaint = SVGContextPaint::GetContextPaint(mContent);
 
-  if (static_cast<nsSVGPathGeometryElement*>(mContent)->IsMarkable()) {
+  if (static_cast<SVGGeometryElement*>(mContent)->IsMarkable()) {
     MarkerProperties properties = GetMarkerProperties(this);
 
     if (properties.MarkersExist()) {
       float strokeWidth = nsSVGUtils::GetStrokeWidth(this, contextPaint);
 
       nsTArray<nsSVGMark> marks;
-      static_cast<nsSVGPathGeometryElement*>
+      static_cast<SVGGeometryElement*>
                  (mContent)->GetMarkPoints(&marks);
 
       uint32_t num = marks.Length();
@@ -921,7 +923,8 @@ nsSVGPathGeometryFrame::PaintMarkers(gfxContext& aContext,
 }
 
 uint16_t
-nsSVGPathGeometryFrame::GetHitTestFlags()
+SVGGeometryFrame::GetHitTestFlags()
 {
   return nsSVGUtils::GetGeometryHitTestFlags(this);
 }
+} // namespace mozilla
diff --git a/layout/svg/nsSVGPathGeometryFrame.h b/layout/svg/SVGGeometryFrame.h
similarity index 83%
rename from layout/svg/nsSVGPathGeometryFrame.h
rename to layout/svg/SVGGeometryFrame.h
index d2d63f0439..f0731379f2 100644
--- a/layout/svg/nsSVGPathGeometryFrame.h
+++ b/layout/svg/SVGGeometryFrame.h
@@ -3,8 +3,8 @@
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
-#ifndef __NS_SVGPATHGEOMETRYFRAME_H__
-#define __NS_SVGPATHGEOMETRYFRAME_H__
+#ifndef __SVGGEOMETRYFRAME_H__
+#define __SVGGEOMETRYFRAME_H__
 
 #include "mozilla/Attributes.h"
 #include "gfxMatrix.h"
@@ -16,13 +16,14 @@
 #include "nsSVGUtils.h"
 
 namespace mozilla {
+class SVGGeometryFrame;
 namespace gfx {
 class DrawTarget;
 } // namespace gfx
 } // namespace mozilla
 
 class gfxContext;
-class nsDisplaySVGPathGeometry;
+class nsDisplaySVGGeometry;
 class nsIAtom;
 class nsIFrame;
 class nsIPresShell;
@@ -32,25 +33,30 @@ class nsSVGMarkerProperty;
 
 struct nsRect;
 
-class nsSVGPathGeometryFrame : public nsFrame
-                             , public nsISVGChildFrame
+nsIFrame*
+NS_NewSVGGeometryFrame(nsIPresShell* aPresShell, nsStyleContext* aContext);
+
+namespace mozilla {
+
+class SVGGeometryFrame : public nsFrame
+                       , public nsISVGChildFrame
 {
   typedef mozilla::gfx::DrawTarget DrawTarget;
 
   friend nsIFrame*
-  NS_NewSVGPathGeometryFrame(nsIPresShell* aPresShell, nsStyleContext* aContext);
+  ::NS_NewSVGGeometryFrame(nsIPresShell* aPresShell, nsStyleContext* aContext);
 
-  friend class nsDisplaySVGPathGeometry;
+  friend class ::nsDisplaySVGGeometry;
 
 protected:
-  explicit nsSVGPathGeometryFrame(nsStyleContext* aContext)
+  explicit SVGGeometryFrame(nsStyleContext* aContext)
     : nsFrame(aContext)
   {
      AddStateBits(NS_FRAME_SVG_LAYOUT | NS_FRAME_MAY_BE_TRANSFORMED);
   }
 
 public:
-  NS_DECL_QUERYFRAME_TARGET(nsSVGPathGeometryFrame)
+  NS_DECL_QUERYFRAME_TARGET(SVGGeometryFrame)
   NS_DECL_QUERYFRAME
   NS_DECL_FRAMEARENA_HELPERS
 
@@ -73,7 +79,7 @@ public:
   /**
    * Get the "type" of the frame
    *
-   * @see nsGkAtoms::svgPathGeometryFrame
+   * @see nsGkAtoms::svgGeometryFrame
    */
   virtual nsIAtom* GetType() const override;
 
@@ -83,14 +89,14 @@ public:
 #ifdef DEBUG_FRAME_DUMP
   virtual nsresult GetFrameName(nsAString& aResult) const override
   {
-    return MakeFrameName(NS_LITERAL_STRING("SVGPathGeometry"), aResult);
+    return MakeFrameName(NS_LITERAL_STRING("SVGGeometry"), aResult);
   }
 #endif
 
   virtual void BuildDisplayList(nsDisplayListBuilder*   aBuilder,
                                 const nsDisplayListSet& aLists) override;
 
-  // nsSVGPathGeometryFrame methods
+  // SVGGeometryFrame methods
   gfxMatrix GetCanvasTM();
 protected:
   // nsISVGChildFrame interface:
@@ -140,7 +146,8 @@ private:
   /**
    * @param aFrame should be the first continuation
    */
-  static MarkerProperties GetMarkerProperties(nsSVGPathGeometryFrame *aFrame);
+  static MarkerProperties GetMarkerProperties(SVGGeometryFrame *aFrame);
 };
+} // namespace mozilla
 
-#endif // __NS_SVGPATHGEOMETRYFRAME_H__
+#endif // __SVGGEOMETRYFRAME_H__
diff --git a/layout/svg/moz.build b/layout/svg/moz.build
index b6575862fa..63e15407bd 100644
--- a/layout/svg/moz.build
+++ b/layout/svg/moz.build
@@ -40,7 +40,6 @@ UNIFIED_SOURCES += [
     'nsSVGMarkerFrame.cpp',
     'nsSVGMaskFrame.cpp',
     'nsSVGOuterSVGFrame.cpp',
-    'nsSVGPathGeometryFrame.cpp',
     'nsSVGPatternFrame.cpp',
     'nsSVGStopFrame.cpp',
     'nsSVGSwitchFrame.cpp',
@@ -51,6 +50,7 @@ UNIFIED_SOURCES += [
     'SVGFEImageFrame.cpp',
     'SVGFELeafFrame.cpp',
     'SVGFEUnstyledLeafFrame.cpp',
+    'SVGGeometryFrame.cpp',
     'SVGTextFrame.cpp',
     'SVGViewFrame.cpp',
 ]
diff --git a/layout/svg/nsSVGClipPathFrame.cpp b/layout/svg/nsSVGClipPathFrame.cpp
index a619ac9a4e..68a091fa40 100644
--- a/layout/svg/nsSVGClipPathFrame.cpp
+++ b/layout/svg/nsSVGClipPathFrame.cpp
@@ -11,8 +11,8 @@
 #include "mozilla/dom/SVGClipPathElement.h"
 #include "nsGkAtoms.h"
 #include "nsSVGEffects.h"
-#include "nsSVGPathGeometryElement.h"
-#include "nsSVGPathGeometryFrame.h"
+#include "SVGGeometryElement.h"
+#include "SVGGeometryFrame.h"
 #include "nsSVGUtils.h"
 
 using namespace mozilla;
@@ -54,10 +54,10 @@ nsSVGClipPathFrame::ApplyClipPath(gfxContext& aContext,
   IsTrivial(&singleClipPathChild);
 
   if (singleClipPathChild) {
-    nsSVGPathGeometryFrame* pathFrame = do_QueryFrame(singleClipPathChild);
+    SVGGeometryFrame* pathFrame = do_QueryFrame(singleClipPathChild);
     if (pathFrame) {
-      nsSVGPathGeometryElement* pathElement =
-        static_cast<nsSVGPathGeometryElement*>(pathFrame->GetContent());
+      SVGGeometryElement* pathElement =
+        static_cast<SVGGeometryElement*>(pathFrame->GetContent());
       gfxMatrix toChildsUserSpace = pathElement->
         PrependLocalTransformsTo(GetClipPathTransform(aClippedFrame) * aMatrix,
                                  eUserSpaceToParent);
@@ -214,7 +214,7 @@ nsSVGClipPathFrame::GetClipMask(gfxContext& aReferenceContext,
         }
 
         // Our children have NS_STATE_SVG_CLIPPATH_CHILD set on them, and
-        // nsSVGPathGeometryFrame::Render checks for that state bit and paints
+        // SVGGeometryFrame::Render checks for that state bit and paints
         // only the geometry (opaque black) if set.
         DrawResult result = SVGFrame->PaintSVG(*ctx, toChildsUserSpace);
         if (aResult) {
@@ -394,7 +394,7 @@ nsSVGClipPathFrame::IsValid()
 
         nsIAtom* grandKidType = grandKid->GetType();
 
-        if (grandKidType != nsGkAtoms::svgPathGeometryFrame &&
+        if (grandKidType != nsGkAtoms::svgGeometryFrame &&
             grandKidType != nsGkAtoms::svgTextFrame) {
           return false;
         }
@@ -402,7 +402,7 @@ nsSVGClipPathFrame::IsValid()
       continue;
     }
 
-    if (kidType != nsGkAtoms::svgPathGeometryFrame &&
+    if (kidType != nsGkAtoms::svgGeometryFrame &&
         kidType != nsGkAtoms::svgTextFrame) {
       return false;
     }
diff --git a/layout/svg/nsSVGEffects.cpp b/layout/svg/nsSVGEffects.cpp
index 63fd215190..0fb68ddd1b 100644
--- a/layout/svg/nsSVGEffects.cpp
+++ b/layout/svg/nsSVGEffects.cpp
@@ -12,11 +12,11 @@
 #include "nsISupportsImpl.h"
 #include "nsSVGClipPathFrame.h"
 #include "nsSVGPaintServerFrame.h"
-#include "nsSVGPathGeometryElement.h"
 #include "nsSVGFilterFrame.h"
 #include "nsSVGMaskFrame.h"
 #include "nsIReflowCallback.h"
 #include "nsCycleCollectionParticipant.h"
+#include "SVGGeometryElement.h"
 #include "SVGUseElement.h"
 
 using namespace mozilla;
@@ -523,8 +523,8 @@ nsSVGMarkerProperty*
 nsSVGEffects::GetMarkerProperty(nsIURI* aURI, nsIFrame* aFrame,
   const mozilla::FramePropertyDescriptor<nsSVGMarkerProperty>* aProperty)
 {
-  MOZ_ASSERT(aFrame->GetType() == nsGkAtoms::svgPathGeometryFrame &&
-             static_cast<nsSVGPathGeometryElement*>(aFrame->GetContent())->IsMarkable(),
+  MOZ_ASSERT(aFrame->GetType() == nsGkAtoms::svgGeometryFrame &&
+             static_cast<SVGGeometryElement*>(aFrame->GetContent())->IsMarkable(),
              "Bad frame");
   return GetEffectProperty(aURI, aFrame, aProperty);
 }
@@ -700,8 +700,8 @@ nsSVGEffects::UpdateEffects(nsIFrame* aFrame)
   // We can't do that in DoUpdate as the referenced frame may not be valid
   GetOrCreateFilterProperty(aFrame);
 
-  if (aFrame->GetType() == nsGkAtoms::svgPathGeometryFrame &&
-      static_cast<nsSVGPathGeometryElement*>(aFrame->GetContent())->IsMarkable()) {
+  if (aFrame->GetType() == nsGkAtoms::svgGeometryFrame &&
+      static_cast<SVGGeometryElement*>(aFrame->GetContent())->IsMarkable()) {
     // Set marker properties here to avoid reference loops
     nsCOMPtr<nsIURI> markerURL =
       GetMarkerURI(aFrame, &nsStyleSVG::mMarkerStart);
diff --git a/layout/svg/nsSVGImageFrame.cpp b/layout/svg/nsSVGImageFrame.cpp
index 2d6f75d267..1d05b023db 100644
--- a/layout/svg/nsSVGImageFrame.cpp
+++ b/layout/svg/nsSVGImageFrame.cpp
@@ -13,10 +13,10 @@
 #include "nsLayoutUtils.h"
 #include "imgINotificationObserver.h"
 #include "nsSVGEffects.h"
-#include "nsSVGPathGeometryFrame.h"
 #include "mozilla/dom/SVGSVGElement.h"
 #include "nsSVGUtils.h"
 #include "SVGContentUtils.h"
+#include "SVGGeometryFrame.h"
 #include "SVGImageContext.h"
 #include "mozilla/dom/SVGImageElement.h"
 #include "nsContentUtils.h"
@@ -46,7 +46,7 @@ private:
   nsSVGImageFrame *mFrame;
 };
 
-class nsSVGImageFrame : public nsSVGPathGeometryFrame
+class nsSVGImageFrame : public SVGGeometryFrame
                       , public nsIReflowCallback
 {
   friend nsIFrame*
@@ -54,7 +54,7 @@ class nsSVGImageFrame : public nsSVGPathGeometryFrame
 
 protected:
   explicit nsSVGImageFrame(nsStyleContext* aContext)
-    : nsSVGPathGeometryFrame(aContext)
+    : SVGGeometryFrame(aContext)
     , mReflowCallbackPosted(false)
   {
     EnableVisibilityTracking();
@@ -72,7 +72,7 @@ public:
   virtual nsIFrame* GetFrameForPoint(const gfxPoint& aPoint) override;
   virtual void ReflowSVG() override;
 
-  // nsSVGPathGeometryFrame methods:
+  // SVGGeometryFrame methods:
   virtual uint16_t GetHitTestFlags() override;
 
   // nsIFrame interface:
@@ -154,7 +154,7 @@ nsSVGImageFrame::Init(nsIContent*       aContent,
   NS_ASSERTION(aContent->IsSVGElement(nsGkAtoms::image),
                "Content is not an SVG image!");
 
-  nsSVGPathGeometryFrame::Init(aContent, aParent, aPrevInFlow);
+  SVGGeometryFrame::Init(aContent, aParent, aPrevInFlow);
 
   if (GetStateBits() & NS_FRAME_IS_NONDISPLAY) {
     // Non-display frames are likely to be patterns, masks or the like.
@@ -246,8 +246,8 @@ nsSVGImageFrame::AttributeChanged(int32_t         aNameSpaceID,
     }
   }
 
-  return nsSVGPathGeometryFrame::AttributeChanged(aNameSpaceID,
-                                                  aAttribute, aModType);
+  return SVGGeometryFrame::AttributeChanged(aNameSpaceID,
+                                            aAttribute, aModType);
 }
 
 void
@@ -256,13 +256,13 @@ nsSVGImageFrame::OnVisibilityChange(Visibility aNewVisibility,
 {
   nsCOMPtr<nsIImageLoadingContent> imageLoader = do_QueryInterface(mContent);
   if (!imageLoader) {
-    nsSVGPathGeometryFrame::OnVisibilityChange(aNewVisibility, aNonvisibleAction);
+    SVGGeometryFrame::OnVisibilityChange(aNewVisibility, aNonvisibleAction);
     return;
   }
 
   imageLoader->OnVisibilityChange(aNewVisibility, aNonvisibleAction);
 
-  nsSVGPathGeometryFrame::OnVisibilityChange(aNewVisibility, aNonvisibleAction);
+  SVGGeometryFrame::OnVisibilityChange(aNewVisibility, aNonvisibleAction);
 }
 
 gfx::Matrix
@@ -505,7 +505,7 @@ nsSVGImageFrame::GetType() const
 }
 
 //----------------------------------------------------------------------
-// nsSVGPathGeometryFrame methods:
+// SVGGeometryFrame methods:
 
 // Lie about our fill/stroke so that covered region and hit detection work properly
 
diff --git a/layout/svg/nsSVGMarkerFrame.cpp b/layout/svg/nsSVGMarkerFrame.cpp
index af19cc0251..195b2304f3 100644
--- a/layout/svg/nsSVGMarkerFrame.cpp
+++ b/layout/svg/nsSVGMarkerFrame.cpp
@@ -10,8 +10,8 @@
 #include "gfxContext.h"
 #include "nsSVGEffects.h"
 #include "mozilla/dom/SVGMarkerElement.h"
-#include "nsSVGPathGeometryElement.h"
-#include "nsSVGPathGeometryFrame.h"
+#include "SVGGeometryElement.h"
+#include "SVGGeometryFrame.h"
 
 using namespace mozilla::dom;
 using namespace mozilla::gfx;
@@ -73,7 +73,7 @@ nsSVGMarkerFrame::GetType() const
 gfxMatrix
 nsSVGMarkerFrame::GetCanvasTM()
 {
-  NS_ASSERTION(mMarkedFrame, "null nsSVGPathGeometry frame");
+  NS_ASSERTION(mMarkedFrame, "null SVGGeometry frame");
 
   if (mInUse2) {
     // We're going to be bailing drawing the marker, so return an identity.
@@ -105,7 +105,7 @@ GetAnonymousChildFrame(nsIFrame* aFrame)
 nsresult
 nsSVGMarkerFrame::PaintMark(gfxContext& aContext,
                             const gfxMatrix& aToMarkedFrameUserSpace,
-                            nsSVGPathGeometryFrame *aMarkedFrame,
+                            SVGGeometryFrame *aMarkedFrame,
                             nsSVGMark *aMark, float aStrokeWidth)
 {
   // If the flag is set when we get here, it means this marker frame
@@ -166,7 +166,7 @@ nsSVGMarkerFrame::PaintMark(gfxContext& aContext,
 SVGBBox
 nsSVGMarkerFrame::GetMarkBBoxContribution(const Matrix &aToBBoxUserspace,
                                           uint32_t aFlags,
-                                          nsSVGPathGeometryFrame *aMarkedFrame,
+                                          SVGGeometryFrame *aMarkedFrame,
                                           const nsSVGMark *aMark,
                                           float aStrokeWidth)
 {
@@ -227,7 +227,7 @@ nsSVGMarkerFrame::SetParentCoordCtxProvider(SVGSVGElement *aContext)
 
 nsSVGMarkerFrame::AutoMarkerReferencer::AutoMarkerReferencer(
     nsSVGMarkerFrame *aFrame,
-    nsSVGPathGeometryFrame *aMarkedFrame
+    SVGGeometryFrame *aMarkedFrame
     MOZ_GUARD_OBJECT_NOTIFIER_PARAM_IN_IMPL)
       : mFrame(aFrame)
 {
diff --git a/layout/svg/nsSVGMarkerFrame.h b/layout/svg/nsSVGMarkerFrame.h
index 187aed1403..9205064475 100644
--- a/layout/svg/nsSVGMarkerFrame.h
+++ b/layout/svg/nsSVGMarkerFrame.h
@@ -16,9 +16,9 @@
 #include "nsSVGUtils.h"
 
 class gfxContext;
-class nsSVGPathGeometryFrame;
 
 namespace mozilla {
+class SVGGeometryFrame;
 namespace dom {
 class SVGSVGElement;
 } // namespace dom
@@ -83,19 +83,19 @@ public:
   // nsSVGMarkerFrame methods:
   nsresult PaintMark(gfxContext& aContext,
                      const gfxMatrix& aToMarkedFrameUserSpace,
-                     nsSVGPathGeometryFrame *aMarkedFrame,
+                     SVGGeometryFrame *aMarkedFrame,
                      nsSVGMark *aMark,
                      float aStrokeWidth);
 
   SVGBBox GetMarkBBoxContribution(const Matrix &aToBBoxUserspace,
                                   uint32_t aFlags,
-                                  nsSVGPathGeometryFrame *aMarkedFrame,
+                                  SVGGeometryFrame *aMarkedFrame,
                                   const nsSVGMark *aMark,
                                   float aStrokeWidth);
 
 private:
   // stuff needed for callback
-  nsSVGPathGeometryFrame *mMarkedFrame;
+  SVGGeometryFrame *mMarkedFrame;
   float mStrokeWidth, mX, mY, mAutoAngle;
   bool mIsStart;  // whether the callback is for a marker-start marker
 
@@ -111,7 +111,7 @@ private:
   {
   public:
     AutoMarkerReferencer(nsSVGMarkerFrame *aFrame,
-                         nsSVGPathGeometryFrame *aMarkedFrame
+                         SVGGeometryFrame *aMarkedFrame
                          MOZ_GUARD_OBJECT_NOTIFIER_PARAM);
     ~AutoMarkerReferencer();
   private:
diff --git a/layout/svg/nsSVGPatternFrame.cpp b/layout/svg/nsSVGPatternFrame.cpp
index 2cd7eeaadf..43162274b9 100644
--- a/layout/svg/nsSVGPatternFrame.cpp
+++ b/layout/svg/nsSVGPatternFrame.cpp
@@ -18,7 +18,7 @@
 #include "nsISVGChildFrame.h"
 #include "nsStyleContext.h"
 #include "nsSVGEffects.h"
-#include "nsSVGPathGeometryFrame.h"
+#include "SVGGeometryFrame.h"
 #include "mozilla/dom/SVGPatternElement.h"
 #include "nsSVGUtils.h"
 #include "nsSVGAnimatedTransformList.h"
@@ -392,7 +392,7 @@ nsSVGPatternFrame::PaintPattern(const DrawTarget* aDrawTarget,
 
   if (aSource->IsFrameOfType(nsIFrame::eSVGGeometry)) {
     // Set the geometrical parent of the pattern we are rendering
-    patternWithChildren->mSource = static_cast<nsSVGPathGeometryFrame*>(aSource);
+    patternWithChildren->mSource = static_cast<SVGGeometryFrame*>(aSource);
   }
 
   // Delay checking NS_FRAME_DRAWING_AS_PAINTSERVER bit until here so we can
diff --git a/layout/svg/nsSVGPatternFrame.h b/layout/svg/nsSVGPatternFrame.h
index 7c3cd1ad18..0b90bc0f04 100644
--- a/layout/svg/nsSVGPatternFrame.h
+++ b/layout/svg/nsSVGPatternFrame.h
@@ -15,11 +15,11 @@
 
 class nsIFrame;
 class nsSVGLength2;
-class nsSVGPathGeometryFrame;
 class nsSVGViewBox;
 
 namespace mozilla {
 class SVGAnimatedPreserveAspectRatio;
+class SVGGeometryFrame;
 class nsSVGAnimatedTransformList;
 } // namespace mozilla
 
@@ -142,7 +142,7 @@ private:
   // this is a *temporary* reference to the frame of the element currently
   // referencing our pattern.  This must be temporary because different
   // referencing frames will all reference this one frame
-  nsSVGPathGeometryFrame           *mSource;
+  SVGGeometryFrame                 *mSource;
   nsAutoPtr<gfxMatrix>              mCTM;
 
 protected:
diff --git a/layout/svg/nsSVGUtils.cpp b/layout/svg/nsSVGUtils.cpp
index 103a4ce1ad..fb1a8f3b9f 100644
--- a/layout/svg/nsSVGUtils.cpp
+++ b/layout/svg/nsSVGUtils.cpp
@@ -46,8 +46,8 @@
 #include "nsSVGOuterSVGFrame.h"
 #include "mozilla/dom/SVGClipPathElement.h"
 #include "mozilla/dom/SVGPathElement.h"
-#include "nsSVGPathGeometryElement.h"
-#include "nsSVGPathGeometryFrame.h"
+#include "SVGGeometryElement.h"
+#include "SVGGeometryFrame.h"
 #include "nsSVGPaintServerFrame.h"
 #include "mozilla/dom/SVGSVGElement.h"
 #include "nsTextFrame.h"
@@ -415,7 +415,7 @@ nsSVGUtils::GetCanvasTM(nsIFrame *aFrame)
     return containerFrame->GetCanvasTM();
   }
 
-  return static_cast<nsSVGPathGeometryFrame*>(aFrame)->GetCanvasTM();
+  return static_cast<SVGGeometryFrame*>(aFrame)->GetCanvasTM();
 }
 
 gfxMatrix
@@ -1223,7 +1223,7 @@ nsSVGUtils::CanOptimizeOpacity(nsIFrame *aFrame)
   }
   nsIAtom *type = aFrame->GetType();
   if (type != nsGkAtoms::svgImageFrame &&
-      type != nsGkAtoms::svgPathGeometryFrame) {
+      type != nsGkAtoms::svgGeometryFrame) {
     return false;
   }
   if (aFrame->StyleEffects()->HasFilters()) {
@@ -1329,7 +1329,7 @@ nsSVGUtils::PathExtentsToMaxStrokeExtents(const gfxRect& aPathExtents,
 
 /*static*/ gfxRect
 nsSVGUtils::PathExtentsToMaxStrokeExtents(const gfxRect& aPathExtents,
-                                          nsSVGPathGeometryFrame* aFrame,
+                                          SVGGeometryFrame* aFrame,
                                           const gfxMatrix& aMatrix)
 {
   bool strokeMayHaveCorners =
diff --git a/layout/svg/nsSVGUtils.h b/layout/svg/nsSVGUtils.h
index edfc43bee7..efcde8326a 100644
--- a/layout/svg/nsSVGUtils.h
+++ b/layout/svg/nsSVGUtils.h
@@ -39,7 +39,6 @@ class nsSVGElement;
 class nsSVGEnum;
 class nsSVGLength2;
 class nsSVGOuterSVGFrame;
-class nsSVGPathGeometryFrame;
 class nsTextFrame;
 
 struct nsStyleSVG;
@@ -48,6 +47,7 @@ struct nsRect;
 namespace mozilla {
 class SVGContextPaint;
 struct SVGContextPaintImpl;
+class SVGGeometryFrame;
 namespace dom {
 class Element;
 class UserSpaceMetrics;
@@ -186,6 +186,7 @@ public:
   typedef mozilla::gfx::Size Size;
   typedef mozilla::SVGContextPaint SVGContextPaint;
   typedef mozilla::SVGContextPaintImpl SVGContextPaintImpl;
+  typedef mozilla::SVGGeometryFrame SVGGeometryFrame;
   typedef mozilla::image::DrawResult DrawResult;
 
   static void Init();
@@ -482,7 +483,7 @@ public:
                                                nsTextFrame* aFrame,
                                                const gfxMatrix& aMatrix);
   static gfxRect PathExtentsToMaxStrokeExtents(const gfxRect& aPathExtents,
-                                               nsSVGPathGeometryFrame* aFrame,
+                                               SVGGeometryFrame* aFrame,
                                                const gfxMatrix& aMatrix);
 
   /**
diff --git a/netwerk/base/ReferrerPolicy.h b/netwerk/base/ReferrerPolicy.h
index 591b9daf03..d68a165819 100644
--- a/netwerk/base/ReferrerPolicy.h
+++ b/netwerk/base/ReferrerPolicy.h
@@ -114,30 +114,6 @@ ReferrerPolicyFromString(const nsAString& content)
 
 }
 
-inline bool
-IsValidReferrerPolicy(const nsAString& content)
-{
-  if (content.IsEmpty()) {
-    return true;
-  }
-
-  nsString lowerContent(content);
-  ToLowerCase(lowerContent);
-
-  return lowerContent.EqualsLiteral(kRPS_Never)
-      || lowerContent.EqualsLiteral(kRPS_No_Referrer)
-      || lowerContent.EqualsLiteral(kRPS_Origin)
-      || lowerContent.EqualsLiteral(kRPS_Default)
-      || lowerContent.EqualsLiteral(kRPS_No_Referrer_When_Downgrade)
-      || lowerContent.EqualsLiteral(kRPS_Origin_When_Cross_Origin)
-      || lowerContent.EqualsLiteral(kRPS_Origin_When_Crossorigin)
-      || lowerContent.EqualsLiteral(kRPS_Same_Origin)
-      || lowerContent.EqualsLiteral(kRPS_Strict_Origin)
-      || lowerContent.EqualsLiteral(kRPS_Strict_Origin_When_Cross_Origin)
-      || lowerContent.EqualsLiteral(kRPS_Always)
-      || lowerContent.EqualsLiteral(kRPS_Unsafe_URL);
-}
-
 inline ReferrerPolicy
 AttributeReferrerPolicyFromString(const nsAString& content)
 {
diff --git a/parser/html/nsHtml5TreeOpExecutor.cpp b/parser/html/nsHtml5TreeOpExecutor.cpp
index 7fe1fdd39e..e134b37ba6 100644
--- a/parser/html/nsHtml5TreeOpExecutor.cpp
+++ b/parser/html/nsHtml5TreeOpExecutor.cpp
@@ -1138,15 +1138,6 @@ nsHtml5TreeOpExecutor::AddSpeculationCSP(const nsAString& aCSP)
                                 true); // delivered through the meta tag
   NS_ENSURE_SUCCESS_VOID(rv);
 
-  // Record "speculated" referrer policy for preloads
-  bool hasReferrerPolicy = false;
-  uint32_t referrerPolicy = mozilla::net::RP_Default;
-  rv = preloadCsp->GetReferrerPolicy(&referrerPolicy, &hasReferrerPolicy);
-  NS_ENSURE_SUCCESS_VOID(rv);
-  if (hasReferrerPolicy) {
-    SetSpeculationReferrerPolicy(static_cast<ReferrerPolicy>(referrerPolicy));
-  }
-
   mDocument->ApplySettingsFromCSP(true);
 }
 
diff --git a/security/nss/lib/pki/pkibase.c b/security/nss/lib/pki/pkibase.c
index f58a262cf2..22159773a8 100644
--- a/security/nss/lib/pki/pkibase.c
+++ b/security/nss/lib/pki/pkibase.c
@@ -333,10 +333,11 @@ nssPKIObject_GetInstances(
 {
     nssCryptokiObject **instances = NULL;
     PRUint32 i;
+    nssPKIObject_Lock(object);
     if (object->numInstances == 0) {
+        nssPKIObject_Unlock(object);
         return (nssCryptokiObject **)NULL;
     }
-    nssPKIObject_Lock(object);
     instances = nss_ZNEWARRAY(NULL, nssCryptokiObject *,
                               object->numInstances + 1);
     if (instances) {