From d7f01911b8a2cb056583bbfa50554df97bb35936 Mon Sep 17 00:00:00 2001
From: Moonchild <moonchild@palemoon.org>
Date: Tue, 22 Apr 2025 15:26:41 +0200
Subject: [PATCH 01/10] Issue #2731 - Fix crashes on unknown BigInt types in
 JIT

This only works around the unknown type crashes but doesn't actually fix
attempts at using 64-bit BigInts in Ion.
Resolves #2731
---
 js/src/jit/MacroAssembler.cpp | 1 +
 js/src/jit/MacroAssembler.h   | 5 +++++
 2 files changed, 6 insertions(+)

diff --git a/js/src/jit/MacroAssembler.cpp b/js/src/jit/MacroAssembler.cpp
index 6721dd4419..9519e8f0eb 100644
--- a/js/src/jit/MacroAssembler.cpp
+++ b/js/src/jit/MacroAssembler.cpp
@@ -2124,6 +2124,7 @@ MacroAssembler::convertTypedOrValueToInt(TypedOrValueRegister src, FloatRegister
       case MIRType::String:
       case MIRType::Symbol:
       case MIRType::Object:
+      case MIRType::BigInt:
         jump(fail);
         break;
       default:
diff --git a/js/src/jit/MacroAssembler.h b/js/src/jit/MacroAssembler.h
index f681456396..e5efb475c6 100644
--- a/js/src/jit/MacroAssembler.h
+++ b/js/src/jit/MacroAssembler.h
@@ -1622,6 +1622,11 @@ class MacroAssembler : public MacroAssemblerSpecific
           case Scalar::Uint32:
             store32(value, dest);
             break;
+          case Scalar::BigInt64:
+          case Scalar::BigUint64:
+            //FIXME: storing 64-bit values doesn't actually work yet.
+            // store64(value, dest);
+            break;
           default:
             MOZ_CRASH("Invalid typed array type");
         }

From 0331e633bdbfee89b8c3c1b0e688c8683ef56716 Mon Sep 17 00:00:00 2001
From: Moonchild <moonchild@palemoon.org>
Date: Thu, 24 Apr 2025 14:27:39 +0200
Subject: [PATCH 02/10] Issue #2728 - Remove obsolete CSP referrer policy.

This has been superseded by the dedicated Referrer-policy header.
Resolves #2728
---
 dom/base/nsDocument.cpp                       |  10 --
 .../security/nsIContentSecurityPolicy.idl     |  38 ++---
 dom/security/nsCSPContext.cpp                 |  42 -----
 dom/security/nsCSPParser.cpp                  |  40 -----
 dom/security/nsCSPUtils.cpp                   |  20 +--
 dom/security/nsCSPUtils.h                     |  11 --
 .../test/csp/file_referrerdirective.html      |  55 -------
 .../csp/file_upgrade_insecure_referrer.sjs    |  55 -------
 .../file_upgrade_insecure_referrer_server.sjs |  56 -------
 dom/security/test/csp/mochitest.ini           |   6 -
 .../test/csp/test_referrerdirective.html      | 143 ------------------
 .../csp/test_upgrade_insecure_referrer.html   |  85 -----------
 dom/security/test/gtest/TestCSPParser.cpp     |   6 -
 dom/workers/WorkerPrivate.cpp                 |  20 ---
 netwerk/base/ReferrerPolicy.h                 |  24 ---
 parser/html/nsHtml5TreeOpExecutor.cpp         |   9 --
 16 files changed, 14 insertions(+), 606 deletions(-)
 delete mode 100644 dom/security/test/csp/file_referrerdirective.html
 delete mode 100644 dom/security/test/csp/file_upgrade_insecure_referrer.sjs
 delete mode 100644 dom/security/test/csp/file_upgrade_insecure_referrer_server.sjs
 delete mode 100644 dom/security/test/csp/test_referrerdirective.html
 delete mode 100644 dom/security/test/csp/test_upgrade_insecure_referrer.html

diff --git a/dom/base/nsDocument.cpp b/dom/base/nsDocument.cpp
index 09146b2fe2..079aa0fdae 100644
--- a/dom/base/nsDocument.cpp
+++ b/dom/base/nsDocument.cpp
@@ -2424,16 +2424,6 @@ nsDocument::ApplySettingsFromCSP(bool aSpeculative)
     rv = NodePrincipal()->GetCsp(getter_AddRefs(csp));
     NS_ENSURE_SUCCESS_VOID(rv);
     if (csp) {
-      // Set up any Referrer Policy specified by CSP
-      bool hasReferrerPolicy = false;
-      uint32_t referrerPolicy = mozilla::net::RP_Default;
-      rv = csp->GetReferrerPolicy(&referrerPolicy, &hasReferrerPolicy);
-      NS_ENSURE_SUCCESS_VOID(rv);
-      if (hasReferrerPolicy) {
-        mReferrerPolicy = static_cast<ReferrerPolicy>(referrerPolicy);
-        mReferrerPolicySet = true;
-      }
-
       // Set up 'block-all-mixed-content' if not already inherited
       // from the parent context or set by any other CSP.
       if (!mBlockAllMixedContent) {
diff --git a/dom/interfaces/security/nsIContentSecurityPolicy.idl b/dom/interfaces/security/nsIContentSecurityPolicy.idl
index 191ddb6e4b..40d48f8820 100644
--- a/dom/interfaces/security/nsIContentSecurityPolicy.idl
+++ b/dom/interfaces/security/nsIContentSecurityPolicy.idl
@@ -52,18 +52,17 @@ interface nsIContentSecurityPolicy : nsISerializable
   const unsigned short REFLECTED_XSS_DIRECTIVE        = 12;
   const unsigned short BASE_URI_DIRECTIVE             = 13;
   const unsigned short FORM_ACTION_DIRECTIVE          = 14;
-  const unsigned short REFERRER_DIRECTIVE             = 15;
-  const unsigned short WEB_MANIFEST_SRC_DIRECTIVE     = 16;
-  const unsigned short UPGRADE_IF_INSECURE_DIRECTIVE  = 17;
-  const unsigned short CHILD_SRC_DIRECTIVE            = 18;
-  const unsigned short BLOCK_ALL_MIXED_CONTENT        = 19;
-  const unsigned short REQUIRE_SRI_FOR                = 20;
-  const unsigned short SANDBOX_DIRECTIVE              = 21;
-  const unsigned short WORKER_SRC_DIRECTIVE           = 22;
-  const unsigned short SCRIPT_SRC_ELEM_DIRECTIVE      = 23;
-  const unsigned short SCRIPT_SRC_ATTR_DIRECTIVE      = 24;
-  const unsigned short STYLE_SRC_ELEM_DIRECTIVE       = 25;
-  const unsigned short STYLE_SRC_ATTR_DIRECTIVE       = 26;
+  const unsigned short WEB_MANIFEST_SRC_DIRECTIVE     = 15;
+  const unsigned short UPGRADE_IF_INSECURE_DIRECTIVE  = 16;
+  const unsigned short CHILD_SRC_DIRECTIVE            = 17;
+  const unsigned short BLOCK_ALL_MIXED_CONTENT        = 18;
+  const unsigned short REQUIRE_SRI_FOR                = 19;
+  const unsigned short SANDBOX_DIRECTIVE              = 20;
+  const unsigned short WORKER_SRC_DIRECTIVE           = 21;
+  const unsigned short SCRIPT_SRC_ELEM_DIRECTIVE      = 22;
+  const unsigned short SCRIPT_SRC_ATTR_DIRECTIVE      = 23;
+  const unsigned short STYLE_SRC_ELEM_DIRECTIVE       = 24;
+  const unsigned short STYLE_SRC_ATTR_DIRECTIVE       = 25;
 
   /**
    * Accessor method for a read-only string version of the policy at a given
@@ -105,21 +104,6 @@ interface nsIContentSecurityPolicy : nsISerializable
    */
   readonly attribute bool enforcesFrameAncestors;
 
-  /**
-   * Obtains the referrer policy (as integer) for this browsing context as
-   * specified in CSP.  If there are multiple policies and...
-   *  - only one sets a referrer policy: that policy is returned
-   *  - more than one sets different referrer policies: no-referrer is returned
-   *  - more than one set equivalent policies: that policy is returned
-   * For the enumeration of policies see ReferrerPolicy.h and nsIHttpChannel.
-   *
-   * @param aPolicy
-   *        The referrer policy to use for the protected resource.
-   * @return
-   *        true if a referrer policy is specified, false if it's unspecified.
-   */
-  bool getReferrerPolicy(out unsigned long policy);
-
   /**
    * Parse and install a CSP policy.
    * @param aPolicy
diff --git a/dom/security/nsCSPContext.cpp b/dom/security/nsCSPContext.cpp
index ad9b33bb2e..9a6fa568e2 100644
--- a/dom/security/nsCSPContext.cpp
+++ b/dom/security/nsCSPContext.cpp
@@ -398,48 +398,6 @@ nsCSPContext::GetEnforcesFrameAncestors(bool *outEnforcesFrameAncestors)
   return NS_OK;
 }
 
-NS_IMETHODIMP
-nsCSPContext::GetReferrerPolicy(uint32_t* outPolicy, bool* outIsSet)
-{
-  *outIsSet = false;
-  *outPolicy = mozilla::net::RP_Default;
-  nsAutoString refpol;
-  mozilla::net::ReferrerPolicy previousPolicy = mozilla::net::RP_Default;
-  for (uint32_t i = 0; i < mPolicies.Length(); i++) {
-    mPolicies[i]->getReferrerPolicy(refpol);
-    // only set the referrer policy if not delievered through a CSPRO and
-    // note that and an empty string in refpol means it wasn't set
-    // (that's the default in nsCSPPolicy).
-    if (!mPolicies[i]->getReportOnlyFlag() && !refpol.IsEmpty()) {
-      // Referrer Directive in CSP is no more used and going to be replaced by
-      // Referrer-Policy HTTP header. But we still keep using referrer directive,
-      // and would remove it later.
-      // Referrer Directive specs is not fully compliant with new referrer policy
-      // specs. What we are using here:
-      // - If the value of the referrer directive is invalid, the user agent
-      // should set the referrer policy to no-referrer.
-      // - If there are two policies that specify a referrer policy, then they
-      // must agree or the employed policy is no-referrer.
-      if (!mozilla::net::IsValidReferrerPolicy(refpol)) {
-        *outPolicy = mozilla::net::RP_No_Referrer;
-        *outIsSet = true;
-        return NS_OK;
-      }
-
-      uint32_t currentPolicy = mozilla::net::ReferrerPolicyFromString(refpol);
-      if (*outIsSet && previousPolicy != currentPolicy) {
-        *outPolicy = mozilla::net::RP_No_Referrer;
-        return NS_OK;
-      }
-
-      *outPolicy = currentPolicy;
-      *outIsSet = true;
-    }
-  }
-
-  return NS_OK;
-}
-
 NS_IMETHODIMP
 nsCSPContext::AppendPolicy(const nsAString& aPolicyString,
                            bool aReportOnly,
diff --git a/dom/security/nsCSPParser.cpp b/dom/security/nsCSPParser.cpp
index 85bee16527..faf5edb2c4 100644
--- a/dom/security/nsCSPParser.cpp
+++ b/dom/security/nsCSPParser.cpp
@@ -17,7 +17,6 @@
 #include "nsReadableUtils.h"
 #include "nsServiceManagerUtils.h"
 #include "nsUnicharUtils.h"
-#include "mozilla/net/ReferrerPolicy.h"
 
 using namespace mozilla;
 
@@ -826,38 +825,6 @@ nsCSPParser::sourceList(nsTArray<nsCSPBaseSrc*>& outSrcs)
   }
 }
 
-void
-nsCSPParser::referrerDirectiveValue(nsCSPDirective* aDir)
-{
-  // directive-value   = "none" / "none-when-downgrade" / "origin" / "origin-when-cross-origin" / "unsafe-url"
-  // directive name is token 0, we need to examine the remaining tokens (and
-  // there should only be one token in the value).
-  CSPPARSERLOG(("nsCSPParser::referrerDirectiveValue"));
-
-  if (mCurDir.Length() != 2) {
-    CSPPARSERLOG(("Incorrect number of tokens in referrer directive, got %d expected 1",
-                 mCurDir.Length() - 1));
-    delete aDir;
-    return;
-  }
-
-  if (!mozilla::net::IsValidReferrerPolicy(mCurDir[1])) {
-    CSPPARSERLOG(("invalid value for referrer directive: %s",
-                  NS_ConvertUTF16toUTF8(mCurDir[1]).get()));
-    delete aDir;
-    return;
-  }
-
-  //referrer-directive deprecation warning
-  const char16_t* params[] = { mCurDir[1].get() };
-  logWarningErrorToConsole(nsIScriptError::warningFlag, "deprecatedReferrerDirective",
-                             params, ArrayLength(params));
-
-  // the referrer policy is valid, so go ahead and use it.
-  mPolicy->setReferrerPolicy(&mCurDir[1]);
-  mPolicy->addDirective(aDir);
-}
-
 void
 nsCSPParser::requireSRIForDirectiveValue(nsRequireSRIForDirective* aDir)
 {
@@ -1170,13 +1137,6 @@ nsCSPParser::directive()
     return;
   }
 
-  // special case handling of the referrer directive (since it doesn't contain
-  // source lists)
-  if (cspDir->equals(nsIContentSecurityPolicy::REFERRER_DIRECTIVE)) {
-    referrerDirectiveValue(cspDir);
-    return;
-  }
-
   // special case handling for report-uri directive (since it doesn't contain
   // a valid source list but rather actual URIs)
   if (CSP_IsDirective(mCurDir[0], nsIContentSecurityPolicy::REPORT_URI_DIRECTIVE)) {
diff --git a/dom/security/nsCSPUtils.cpp b/dom/security/nsCSPUtils.cpp
index 70418e70c3..a7eeba9027 100644
--- a/dom/security/nsCSPUtils.cpp
+++ b/dom/security/nsCSPUtils.cpp
@@ -1235,7 +1235,7 @@ nsCSPDirective::toDomCSPStruct(mozilla::dom::CSP& outCSP) const
       outCSP.mScript_src_attr.Value() = mozilla::Move(srcs);
       return;
 
-    // REFERRER_DIRECTIVE and REQUIRE_SRI_FOR are handled in nsCSPPolicy::toDomCSPStruct()
+    // REQUIRE_SRI_FOR is handled in nsCSPPolicy::toDomCSPStruct()
 
     default:
       NS_ASSERTION(false, "cannot find directive to convert CSP to JSON");
@@ -1581,14 +1581,7 @@ nsCSPPolicy::toString(nsAString& outStr) const
 {
   uint32_t length = mDirectives.Length();
   for (uint32_t i = 0; i < length; ++i) {
-
-    if (mDirectives[i]->equals(nsIContentSecurityPolicy::REFERRER_DIRECTIVE)) {
-      outStr.AppendASCII(CSP_CSPDirectiveToString(nsIContentSecurityPolicy::REFERRER_DIRECTIVE));
-      outStr.AppendASCII(" ");
-      outStr.Append(mReferrerPolicy);
-    } else {
-      mDirectives[i]->toString(outStr);
-    }
+    mDirectives[i]->toString(outStr);
     if (i != (length - 1)) {
       outStr.AppendASCII("; ");
     }
@@ -1601,14 +1594,7 @@ nsCSPPolicy::toDomCSPStruct(mozilla::dom::CSP& outCSP) const
   outCSP.mReport_only = mReportOnly;
 
   for (uint32_t i = 0; i < mDirectives.Length(); ++i) {
-    if (mDirectives[i]->equals(nsIContentSecurityPolicy::REFERRER_DIRECTIVE)) {
-      mozilla::dom::Sequence<nsString> srcs;
-      srcs.AppendElement(mReferrerPolicy, mozilla::fallible);
-      outCSP.mReferrer.Construct();
-      outCSP.mReferrer.Value() = srcs;
-    } else {
-      mDirectives[i]->toDomCSPStruct(outCSP);
-    }
+    mDirectives[i]->toDomCSPStruct(outCSP);
   }
 }
 
diff --git a/dom/security/nsCSPUtils.h b/dom/security/nsCSPUtils.h
index 4c0af92620..13747a6b04 100644
--- a/dom/security/nsCSPUtils.h
+++ b/dom/security/nsCSPUtils.h
@@ -134,7 +134,6 @@ static const char* CSPStrDirectives[] = {
   "reflected-xss",             // REFLECTED_XSS_DIRECTIVE
   "base-uri",                  // BASE_URI_DIRECTIVE
   "form-action",               // FORM_ACTION_DIRECTIVE
-  "referrer",                  // REFERRER_DIRECTIVE
   "manifest-src",              // MANIFEST_SRC_DIRECTIVE
   "upgrade-insecure-requests", // UPGRADE_IF_INSECURE_DIRECTIVE
   "child-src",                 // CHILD_SRC_DIRECTIVE
@@ -714,15 +713,6 @@ class nsCSPPolicy {
     inline bool getReportOnlyFlag() const
       { return mReportOnly; }
 
-    inline void setReferrerPolicy(const nsAString* aValue)
-      {
-        mReferrerPolicy = *aValue;
-        ToLowerCase(mReferrerPolicy);
-      }
-
-    inline void getReferrerPolicy(nsAString& outPolicy) const
-      { outPolicy.Assign(mReferrerPolicy); }
-
     void getReportURIs(nsTArray<nsString> &outReportURIs) const;
 
     void getDirectiveStringForContentType(CSPDirective aDirective,
@@ -743,7 +733,6 @@ class nsCSPPolicy {
     nsUpgradeInsecureDirective* mUpgradeInsecDir;
     nsTArray<nsCSPDirective*>   mDirectives;
     bool                        mReportOnly;
-    nsString                    mReferrerPolicy;
 };
 
 #endif /* nsCSPUtils_h___ */
diff --git a/dom/security/test/csp/file_referrerdirective.html b/dom/security/test/csp/file_referrerdirective.html
deleted file mode 100644
index 841ffe0587..0000000000
--- a/dom/security/test/csp/file_referrerdirective.html
+++ /dev/null
@@ -1,55 +0,0 @@
-<!DOCTYPE HTML>
-<html>
-<head>
-<title>Subframe test for bug 965727</title>
-
-<script type="text/javascript">
-// we can get the ID out of the querystring.
-var args = document.location.search.substring(1).split('&');
-var id = "unknown";
-for (var i=0; i < args.length; i++) {
-  var arg = unescape(args[i]);
-  if (arg.indexOf('=') > 0 && arg.indexOf('id') == 0) {
-    id = arg.split('=')[1].trim();
-  }
-}
-
-var results = {
-  'id': id,
-  'referrer': document.location.href,
-  'results': {
-    'sameorigin': false,
-    'crossorigin': false,
-    'downgrade': false
-  }
-};
-
-// this is called back by each script load.
-var postResult = function(loadType, referrerLevel, referrer) {
-  results.results[loadType] = referrerLevel;
-
-  // and then check if all three have loaded.
-  for (var id in results.results) {
-    if (!results.results[id]) {
-      return;
-    }
-  }
-  //finished if we don't return early
-  window.parent.postMessage(JSON.stringify(results), "*");
-  console.log(JSON.stringify(results));
-}
-
-</script>
-</head>
-<body>
-Testing ...
-
-<script src="https://example.com/tests/dom/security/test/csp/referrerdirective.sjs?type=sameorigin&"
-        onerror="postResult('sameorigin', 'error');"></script>
-<script src="https://test2.example.com/tests/dom/security/test/csp/referrerdirective.sjs?type=crossorigin&"
-        onerror="postResult('crossorigin', 'error');"></script>
-<script src="http://example.com/tests/dom/security/test/csp/referrerdirective.sjs?type=downgrade&"
-        onerror="postResult('downgrade', 'error');"></script>
-
-</body>
-</html>
diff --git a/dom/security/test/csp/file_upgrade_insecure_referrer.sjs b/dom/security/test/csp/file_upgrade_insecure_referrer.sjs
deleted file mode 100644
index e149afa4b0..0000000000
--- a/dom/security/test/csp/file_upgrade_insecure_referrer.sjs
+++ /dev/null
@@ -1,55 +0,0 @@
-// special *.sjs specifically customized for the needs of
-// Bug 1139297 and Bug 663570
-
-const PRE_HEAD =
-  "<!DOCTYPE HTML>" +
-  "<html>" +
-  "<head>";
-
- const POST_HEAD =
-   "<meta charset='utf-8'>" +
-   "<title>Bug 1139297 - Implement CSP upgrade-insecure-requests directive</title>" +
-   "</head>" +
-   "<body>" +
-  "<img id='testimage' src='http://example.com/tests/dom/security/test/csp/file_upgrade_insecure_referrer_server.sjs?img'></img>" +
-  "</body>" +
-  "</html>";
-
-const PRE_CSP = "upgrade-insecure-requests; default-src https:; ";
-const CSP_REFERRER_ORIGIN = "referrer origin";
-const CSP_REFEFFER_NO_REFERRER = "referrer no-referrer";
-
-function handleRequest(request, response)
-{
-  // avoid confusing cache behaviors
-  response.setHeader("Cache-Control", "no-cache", false);
-  var queryString = request.queryString;
-
-  if (queryString === "test1") {
-    response.setHeader("Content-Security-Policy", PRE_CSP + CSP_REFERRER_ORIGIN, false);
-    response.write(PRE_HEAD + POST_HEAD);
-  	return;
-  }
-
-  if (queryString === "test2") {
-    response.setHeader("Content-Security-Policy", PRE_CSP + CSP_REFEFFER_NO_REFERRER, false);
-    response.write(PRE_HEAD + POST_HEAD);
-  	return;
-  }
-
-  if (queryString === "test3") {
-  	var metacsp =  "<meta http-equiv=\"Content-Security-Policy\" content = \"" + PRE_CSP + CSP_REFERRER_ORIGIN + "\" >";
-    response.write(PRE_HEAD + metacsp + POST_HEAD);
-  	return;
-  }
-
-  if (queryString === "test4") {
-  	var metacsp =  "<meta http-equiv=\"Content-Security-Policy\" content = \"" + PRE_CSP + CSP_REFEFFER_NO_REFERRER + "\" >";
-    response.write(PRE_HEAD + metacsp + POST_HEAD);
-  	return;
-  }
-
-  // we should never get here, but just in case return
-  // something unexpected
-  response.write("do'h");
-}
diff --git a/dom/security/test/csp/file_upgrade_insecure_referrer_server.sjs b/dom/security/test/csp/file_upgrade_insecure_referrer_server.sjs
deleted file mode 100644
index be1e6da0ca..0000000000
--- a/dom/security/test/csp/file_upgrade_insecure_referrer_server.sjs
+++ /dev/null
@@ -1,56 +0,0 @@
-// Custom *.sjs file specifically for the needs of Bug:
-// Bug 1139297 - Implement CSP upgrade-insecure-requests directive
-
-// small red image
-const IMG_BYTES = atob(
-  "iVBORw0KGgoAAAANSUhEUgAAAAUAAAAFCAYAAACNbyblAAAAHElEQVQI12" +
-  "P4//8/w38GIAXDIBKE0DHxgljNBAAO9TXL0Y4OHwAAAABJRU5ErkJggg==");
-
-function handleRequest(request, response)
-{
-  // avoid confusing cache behaviors
-  response.setHeader("Cache-Control", "no-cache", false);
-  var queryString = request.queryString;
-
-  // (1) lets process the queryresult request async and
-  // wait till we have received the image request.
-  if (queryString == "queryresult") {
-    response.processAsync();
-    setObjectState("queryResult", response);
-    return;
-  }
-
-  // (2) Handle the image request and return the referrer
-  // result back to the stored queryresult request.
-  if (request.queryString == "img") {
-    response.setHeader("Content-Type", "image/png");
-    response.write(IMG_BYTES);
-
-    let referrer = "";
-    try {
-      referrer = request.getHeader("referer");
-    } catch (e) {
-      referrer = "";
-    }
-    // make sure the received image request was upgraded to https,
-    // otherwise we return not only the referrer but also indicate
-    // that the request was not upgraded to https. Note, that
-    // all upgrades happen in the browser before any non-secure
-    // request hits the wire.
-    referrer += (request.scheme == "https") ?
-                 "" : " but request is not https";
-
-    getObjectState("queryResult", function(queryResponse) {
-      if (!queryResponse) {
-        return;
-      }
-      queryResponse.write(referrer);
-      queryResponse.finish();
-    });
-    return;
-  }
-
-  // we should not get here ever, but just in case return
-  // something unexpected.
-  response.write("doh!");
-}
diff --git a/dom/security/test/csp/mochitest.ini b/dom/security/test/csp/mochitest.ini
index 86b7fd0cdc..93c4ee6f06 100644
--- a/dom/security/test/csp/mochitest.ini
+++ b/dom/security/test/csp/mochitest.ini
@@ -125,7 +125,6 @@ support-files =
   file_multi_policy_injection_bypass_2.html^headers^
   file_null_baseuri.html
   file_form-action.html
-  file_referrerdirective.html
   referrerdirective.sjs
   file_upgrade_insecure.html
   file_upgrade_insecure_meta.html
@@ -133,8 +132,6 @@ support-files =
   file_upgrade_insecure_wsh.py
   file_upgrade_insecure_reporting.html
   file_upgrade_insecure_reporting_server.sjs
-  file_upgrade_insecure_referrer.sjs
-  file_upgrade_insecure_referrer_server.sjs
   file_upgrade_insecure_cors.html
   file_upgrade_insecure_cors_server.sjs
   file_report_for_import.css
@@ -266,15 +263,12 @@ skip-if = toolkit == 'android' # Times out, not sure why (bug 1008445)
 [test_leading_wildcard.html]
 [test_multi_policy_injection_bypass.html]
 [test_null_baseuri.html]
-[test_referrerdirective.html]
 [test_dual_header.html]
 [test_upgrade_insecure.html]
 # no ssl support as well as websocket tests do not work (see test_websocket.html)
 skip-if = toolkit == 'android' || (os != 'linux' && !debug) # Bug 1316305, Bug 1183300
 [test_upgrade_insecure_reporting.html]
 skip-if = toolkit == 'android'
-[test_upgrade_insecure_referrer.html]
-skip-if = toolkit == 'android'
 [test_upgrade_insecure_cors.html]
 skip-if = toolkit == 'android'
 [test_report_for_import.html]
diff --git a/dom/security/test/csp/test_referrerdirective.html b/dom/security/test/csp/test_referrerdirective.html
deleted file mode 100644
index f590460a0f..0000000000
--- a/dom/security/test/csp/test_referrerdirective.html
+++ /dev/null
@@ -1,143 +0,0 @@
-<!--
-  Any copyright is dedicated to the Public Domain.
-  http://creativecommons.org/publicdomain/zero/1.0/
--->
-<!DOCTYPE HTML>
-<html>
-<!--
-https://bugzilla.mozilla.org/show_bug.cgi?id=965727
--->
-<head>
-  <meta charset="utf-8">
-  <title>Test for Content Security Policy referrer Directive (Bug 965727)</title>
-  <script type="text/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
-  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" />
-</head>
-<body>
-<div id="content" style="display: none">
-
-</div>
-<pre id="test">
-<script class="testbody" type="application/javascript">
-/*
- * This tests various referrer policies and the referrer-sending behavior when
- * requesting scripts in different ways:
- *  - cross-origin (https://example.com -> https://test2.example.com)
- *  - same-origin (https://example.com -> https://example.com)
- *  - downgrade (https://example.com -> http://example.com)
- *
- * Each test creates an iframe that loads scripts for each of the checks.  If
- * the scripts are blocked, the test fails (they should run).  When loaded,
- * each script updates a results object in the test page, and then when the
- * test page has finished loading all the scripts, it postMessages back to this
- * page.  Once all tests are done, the results are checked.
- */
-
-var testData = {
-  'default': { 'csp': "script-src * 'unsafe-inline'; referrer default",
-          'expected': {  'sameorigin': 'full',
-                        'crossorigin': 'full',
-                          'downgrade': 'none' }},
-
-  'origin':  { 'csp': "script-src * 'unsafe-inline'; referrer origin",
-          'expected': {  'sameorigin': 'origin',
-                        'crossorigin': 'origin',
-                          'downgrade': 'origin' }},
-
-  'origin-when-cross-origin':  { 'csp': "script-src * 'unsafe-inline'; referrer origin-when-cross-origin",
-          'expected': {  'sameorigin': 'full',
-                        'crossorigin': 'origin',
-                          'downgrade': 'origin' }},
-
-  'unsafe-url':  { 'csp': "script-src * 'unsafe-inline'; referrer unsafe-url",
-          'expected': {  'sameorigin': 'full',
-                        'crossorigin': 'full',
-                          'downgrade': 'full' }},
-
-  'none':   { 'csp': "script-src * 'unsafe-inline'; referrer no-referrer",
-          'expected': {  'sameorigin': 'none',
-                        'crossorigin': 'none',
-                          'downgrade': 'none' }},
-
-  // referrer delivered through CSPRO should be ignored
-  'ignore-cspro':  { 'cspro': "script-src * 'unsafe-inline'; referrer origin",
-          'expected': {  'sameorigin': 'full',
-                        'crossorigin': 'full',
-                          'downgrade': 'none' }},
-
-  // referrer delivered through CSPRO should be ignored
-  'ignore-cspro2':   { 'csp'  : "script-src * 'unsafe-inline'; referrer no-referrer",
-                       'cspro': "script-src * 'unsafe-inline'; referrer origin",
-         'expected': {  'sameorigin': 'none',
-                        'crossorigin': 'none',
-                          'downgrade': 'none' }},
-  };
-
-var referrerDirectiveTests = {
-  // called via postMessage when one of the iframes is done running.
-  onIframeComplete: function(event) {
-    try {
-      var results = JSON.parse(event.data);
-      ok(results.hasOwnProperty('id'), "'id' property required in posted message " + event.data);
-
-      ok(testData.hasOwnProperty(results['id']), "Test " + results['id'] + " must be expected.");
-
-      // check all the various load types' referrers.
-      var expected = testData[results['id']].expected;
-      for (var t in expected) {
-        is(results.results[t], expected[t],
-          " referrer must match expected for " + t + " in " + results['id']);
-      }
-      testData[results['id']]['complete'] = true;
-
-    } catch(e) {
-      // fail -- should always be JSON
-      ok(false, "failed to parse posted message + " + event.data);
-      // have to end as well since not all messages were valid.
-      SimpleTest.finish();
-    }
-
-    referrerDirectiveTests.checkForCompletion();
-  },
-
-  // checks to see if all the parallel tests are done and validates results.
-  checkForCompletion: function() {
-    for (var id in testData) {
-      if (!testData[id].hasOwnProperty('complete')) {
-        return;
-      }
-    }
-    SimpleTest.finish();
-  }
-};
-
-SimpleTest.waitForExplicitFinish();
-// have to disable mixed content blocking to test https->http referrers.
-SpecialPowers.pushPrefEnv({
-    'set': [['security.mixed_content.block_active_content',   false],
-            ['security.mixed_content.block_display_content',  false],
-    ]
-    },
-    function() {
-      // each of the iframes we create will call us back when its contents are loaded.
-      window.addEventListener("message", referrerDirectiveTests.onIframeComplete.bind(window), false);
-
-      // one iframe created for each test case
-      for (var id in testData) {
-        var elt = document.createElement("iframe");
-        var src = "https://example.com/tests/dom/security/test/csp/file_testserver.sjs?id=" + id;
-        if (testData[id]['csp']) {
-          src += "&csp=" + escape(testData[id]['csp']);
-        }
-        if (testData[id]['cspro']) {
-          src += "&cspro=" + escape(testData[id]['cspro']);
-        }
-        src += "&file=tests/dom/security/test/csp/file_referrerdirective.html";
-        elt.src = src;
-        document.getElementById("content").appendChild(elt);
-      }
-    });
-</script>
-</pre>
-</body>
-</html>
diff --git a/dom/security/test/csp/test_upgrade_insecure_referrer.html b/dom/security/test/csp/test_upgrade_insecure_referrer.html
deleted file mode 100644
index 890c573350..0000000000
--- a/dom/security/test/csp/test_upgrade_insecure_referrer.html
+++ /dev/null
@@ -1,85 +0,0 @@
-<!DOCTYPE HTML>
-<html>
-<head>
-  <meta charset="utf-8">
-  <title>Bug 1139297 - Implement CSP upgrade-insecure-requests directive</title>
-  <!-- Including SimpleTest.js so we can use waitForExplicitFinish !-->
-  <script type="text/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
-  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" />
-</head>
-<body>
-<iframe style="width:100%;" id="testframe"></iframe>
-
-<script class="testbody" type="text/javascript">
-
-/* Description of the test:
- * We load a page that makes use of the CSP referrer directive as well
- * as upgrade-insecure-requests. The page loads an image over http.
- * The test makes sure the request gets upgraded to https and the
- * correct referrer gets sent.
- */
-
-var tests = [
-  {
-    query: "test1",
-    description: "upgrade insecure request with 'referrer = origin' (CSP in header)",
-    result: "http://example.com/"
-  },
-  {
-    query: "test2",
-    description: "upgrade insecure request with 'referrer = no-referrer' (CSP in header)",
-    result: ""
-  },
-  {
-    query: "test3",
-    description: "upgrade insecure request with 'referrer = origin' (Meta CSP)",
-    result: "http://example.com/"
-  },
-  {
-    query: "test4",
-    description: "upgrade insecure request with 'referrer = no-referrer' (Meta CSP)",
-    result: ""
-  }
-];
-
-var counter = 0;
-var curTest;
-
-function loadTestPage() {
-  curTest = tests[counter++];
-  var src = "http://example.com/tests/dom/security/test/csp/file_upgrade_insecure_referrer.sjs?";
-  // append the query
-  src += curTest.query;
-  document.getElementById("testframe").src = src;
-}
-
-function runNextTest() {
-  // sends a request to the server which is processed async and returns
-  // once the server received the expected image request
-  var myXHR = new XMLHttpRequest();
-  myXHR.open("GET", "file_upgrade_insecure_referrer_server.sjs?queryresult");
-  myXHR.onload = function(e) {
-    is(myXHR.responseText, curTest.result, curTest.description);
-    if (counter == tests.length) {
-      SimpleTest.finish();
-      return;
-    }
-    // move on to the next test by setting off another query request.
-    runNextTest();
-  }
-  myXHR.onerror = function(e) {
-    ok(false, "could not query results from server (" + e.message + ")");
-    SimpleTest.finish();
-  }
-  myXHR.send();
-
-  // give it some time and load the testpage
-  SimpleTest.executeSoon(loadTestPage);
-}
-
-SimpleTest.waitForExplicitFinish();
-runNextTest();
-
-</script>
-</body>
-</html>
diff --git a/dom/security/test/gtest/TestCSPParser.cpp b/dom/security/test/gtest/TestCSPParser.cpp
index 7964bf43a3..a5c2d8d770 100644
--- a/dom/security/test/gtest/TestCSPParser.cpp
+++ b/dom/security/test/gtest/TestCSPParser.cpp
@@ -229,8 +229,6 @@ TEST(CSPParser, Directives)
       "script-src 'nonce-correctscriptnonce'" },
     { "script-src 'sha256-siVR8vAcqP06h2ppeNwqgjr0yZ6yned4X2VF84j4GmI='",
       "script-src 'sha256-siVR8vAcqP06h2ppeNwqgjr0yZ6yned4X2VF84j4GmI='" },
-    { "referrer no-referrer",
-      "referrer no-referrer" },
     { "require-sri-for script style",
       "require-sri-for script style"},
     { "script-src 'nonce-foo' 'unsafe-inline' ",
@@ -305,8 +303,6 @@ TEST(CSPParser, IgnoreUpperLowerCasePolicies)
       "script-src 'nonce-NONCENEEDSTOBEUPPERCASE'" },
     { "script-src 'SHA256-siVR8vAcqP06h2ppeNwqgjr0yZ6yned4X2VF84j4GmI='",
       "script-src 'sha256-siVR8vAcqP06h2ppeNwqgjr0yZ6yned4X2VF84j4GmI='" },
-    { "refERRer No-refeRRer",
-      "referrer no-referrer" },
     { "upgrade-INSECURE-requests",
       "upgrade-insecure-requests" },
     { "sanDBox alloW-foRMs",
@@ -574,8 +570,6 @@ TEST(CSPParser, BadPolicies)
     { "defaut-src asdf", "" },
     { "default-src: aaa", "" },
     { "asdf http://test.com", ""},
-    { "referrer", ""},
-    { "referrer foo", ""},
     { "require-sri-for", ""},
     { "require-sri-for foo", ""},
     { "report-uri", ""},
diff --git a/dom/workers/WorkerPrivate.cpp b/dom/workers/WorkerPrivate.cpp
index bb745ba491..7267329a9d 100644
--- a/dom/workers/WorkerPrivate.cpp
+++ b/dom/workers/WorkerPrivate.cpp
@@ -2419,20 +2419,10 @@ WorkerPrivateParent<Derived>::SetCSPFromHeaderValues(const nsACString& aCSPHeade
   rv = csp->GetAllowsEval(&reportEvalViolations, &evalAllowed);
   NS_ENSURE_SUCCESS(rv, rv);
 
-  // Set ReferrerPolicy, default value is set in GetReferrerPolicy
-  bool hasReferrerPolicy = false;
-  uint32_t rp = mozilla::net::RP_Unset;
-  rv = csp->GetReferrerPolicy(&rp, &hasReferrerPolicy);
-  NS_ENSURE_SUCCESS(rv, rv);
-
   mLoadInfo.mCSP = csp;
   mLoadInfo.mEvalAllowed = evalAllowed;
   mLoadInfo.mReportCSPViolations = reportEvalViolations;
 
-  if (hasReferrerPolicy) {
-    mLoadInfo.mReferrerPolicy = static_cast<net::ReferrerPolicy>(rp);
-  }
-
   return NS_OK;
 }
 
@@ -3696,16 +3686,6 @@ WorkerLoadInfo::SetPrincipalOnMainThread(nsIPrincipal* aPrincipal,
 
   if (mCSP) {
     mCSP->GetAllowsEval(&mReportCSPViolations, &mEvalAllowed);
-    // Set ReferrerPolicy
-    bool hasReferrerPolicy = false;
-    uint32_t rp = mozilla::net::RP_Unset;
-
-    rv = mCSP->GetReferrerPolicy(&rp, &hasReferrerPolicy);
-    NS_ENSURE_SUCCESS(rv, rv);
-
-    if (hasReferrerPolicy) {
-      mReferrerPolicy = static_cast<net::ReferrerPolicy>(rp);
-    }
   } else {
     mEvalAllowed = true;
     mReportCSPViolations = false;
diff --git a/netwerk/base/ReferrerPolicy.h b/netwerk/base/ReferrerPolicy.h
index 591b9daf03..d68a165819 100644
--- a/netwerk/base/ReferrerPolicy.h
+++ b/netwerk/base/ReferrerPolicy.h
@@ -114,30 +114,6 @@ ReferrerPolicyFromString(const nsAString& content)
 
 }
 
-inline bool
-IsValidReferrerPolicy(const nsAString& content)
-{
-  if (content.IsEmpty()) {
-    return true;
-  }
-
-  nsString lowerContent(content);
-  ToLowerCase(lowerContent);
-
-  return lowerContent.EqualsLiteral(kRPS_Never)
-      || lowerContent.EqualsLiteral(kRPS_No_Referrer)
-      || lowerContent.EqualsLiteral(kRPS_Origin)
-      || lowerContent.EqualsLiteral(kRPS_Default)
-      || lowerContent.EqualsLiteral(kRPS_No_Referrer_When_Downgrade)
-      || lowerContent.EqualsLiteral(kRPS_Origin_When_Cross_Origin)
-      || lowerContent.EqualsLiteral(kRPS_Origin_When_Crossorigin)
-      || lowerContent.EqualsLiteral(kRPS_Same_Origin)
-      || lowerContent.EqualsLiteral(kRPS_Strict_Origin)
-      || lowerContent.EqualsLiteral(kRPS_Strict_Origin_When_Cross_Origin)
-      || lowerContent.EqualsLiteral(kRPS_Always)
-      || lowerContent.EqualsLiteral(kRPS_Unsafe_URL);
-}
-
 inline ReferrerPolicy
 AttributeReferrerPolicyFromString(const nsAString& content)
 {
diff --git a/parser/html/nsHtml5TreeOpExecutor.cpp b/parser/html/nsHtml5TreeOpExecutor.cpp
index 7fe1fdd39e..e134b37ba6 100644
--- a/parser/html/nsHtml5TreeOpExecutor.cpp
+++ b/parser/html/nsHtml5TreeOpExecutor.cpp
@@ -1138,15 +1138,6 @@ nsHtml5TreeOpExecutor::AddSpeculationCSP(const nsAString& aCSP)
                                 true); // delivered through the meta tag
   NS_ENSURE_SUCCESS_VOID(rv);
 
-  // Record "speculated" referrer policy for preloads
-  bool hasReferrerPolicy = false;
-  uint32_t referrerPolicy = mozilla::net::RP_Default;
-  rv = preloadCsp->GetReferrerPolicy(&referrerPolicy, &hasReferrerPolicy);
-  NS_ENSURE_SUCCESS_VOID(rv);
-  if (hasReferrerPolicy) {
-    SetSpeculationReferrerPolicy(static_cast<ReferrerPolicy>(referrerPolicy));
-  }
-
   mDocument->ApplySettingsFromCSP(true);
 }
 

From 2ef82632d4674dec595e5a94aeb6686c93d5d1f1 Mon Sep 17 00:00:00 2001
From: Moonchild <moonchild@palemoon.org>
Date: Thu, 24 Apr 2025 14:38:33 +0200
Subject: [PATCH 03/10] Issue #2732 - Part 1: Rename mContainsBlockContents to
 mConsiderWholeSubtree

It is more descriptive of what it actually does.
---
 layout/generic/nsImageMap.cpp | 14 +++++++-------
 layout/generic/nsImageMap.h   |  6 +++++-
 2 files changed, 12 insertions(+), 8 deletions(-)

diff --git a/layout/generic/nsImageMap.cpp b/layout/generic/nsImageMap.cpp
index bc200a345d..ae310d1651 100644
--- a/layout/generic/nsImageMap.cpp
+++ b/layout/generic/nsImageMap.cpp
@@ -676,9 +676,9 @@ void CircleArea::GetRect(nsIFrame* aFrame, nsRect& aRect)
 //----------------------------------------------------------------------
 
 
-nsImageMap::nsImageMap() :
-  mImageFrame(nullptr),
-  mContainsBlockContents(false)
+nsImageMap::nsImageMap()
+  : mImageFrame(nullptr)
+  , mConsiderWholeSubtree(false)
 {
 }
 
@@ -767,7 +767,7 @@ nsImageMap::SearchForAreas(nsIContent* aParent, bool& aFoundArea,
       rv = AddArea(child);
       NS_ENSURE_SUCCESS(rv, rv);
 
-      // Continue to next child. This stops mContainsBlockContents from
+      // Continue to next child. This stops mConsiderWholeSubtree from
       // getting set. It also makes us ignore children of <area>s which
       // is consistent with how we react to dynamic insertion of such
       // children.
@@ -783,7 +783,7 @@ nsImageMap::SearchForAreas(nsIContent* aParent, bool& aFoundArea,
     }
 
     if (child->IsElement()) {
-      mContainsBlockContents = true;
+      mConsiderWholeSubtree = true;
       rv = SearchForAreas(child, aFoundArea, aFoundAnchor);
       NS_ENSURE_SUCCESS(rv, rv);
     }
@@ -800,7 +800,7 @@ nsImageMap::UpdateAreas()
 
   bool foundArea = false;
   bool foundAnchor = false;
-  mContainsBlockContents = false;
+  mConsiderWholeSubtree = false;
 
   nsresult rv = SearchForAreas(mMap, foundArea, foundAnchor);
 #ifdef ACCESSIBILITY
@@ -908,7 +908,7 @@ nsImageMap::Draw(nsIFrame* aFrame, DrawTarget& aDrawTarget,
 void
 nsImageMap::MaybeUpdateAreas(nsIContent *aContent)
 {
-  if (aContent == mMap || mContainsBlockContents) {
+  if (aContent == mMap || mConsiderWholeSubtree) {
     UpdateAreas();
   }
 }
diff --git a/layout/generic/nsImageMap.h b/layout/generic/nsImageMap.h
index 50dd737972..42fc9f333f 100644
--- a/layout/generic/nsImageMap.h
+++ b/layout/generic/nsImageMap.h
@@ -91,7 +91,11 @@ protected:
   nsImageFrame* mImageFrame;  // the frame that owns us
   nsCOMPtr<nsIContent> mMap;
   AutoTArray<Area*, 8> mAreas; // almost always has some entries
-  bool mContainsBlockContents;
+
+  // This is set when we search for all area children and tells us whether we
+  // should consider the whole subtree or just direct children when we get
+  // content notifications about changes inside the map subtree.
+  bool mConsiderWholeSubtree;
 };
 
 #endif /* nsImageMap_h */

From 9f64d0f4b0f086231f1df0beaf995195bbf59a26 Mon Sep 17 00:00:00 2001
From: Moonchild <moonchild@palemoon.org>
Date: Thu, 24 Apr 2025 15:43:32 +0200
Subject: [PATCH 04/10] Issue #2732 - Part 2: Stop accepting <a> as a valid
 image map <area>

This was part of the HTML4 standard but only ever implemented by Mozilla
and removed again in HTML5 due to lack of adoption. Retaining this could
cause web compat issues and unspecified behavior in the layout engine.
---
 layout/generic/nsImageMap.cpp | 62 ++++++++++++++---------------------
 layout/generic/nsImageMap.h   | 11 +++++--
 2 files changed, 33 insertions(+), 40 deletions(-)

diff --git a/layout/generic/nsImageMap.cpp b/layout/generic/nsImageMap.cpp
index ae310d1651..b4291ad4a3 100644
--- a/layout/generic/nsImageMap.cpp
+++ b/layout/generic/nsImageMap.cpp
@@ -9,6 +9,7 @@
 
 #include "mozilla/dom/Element.h"
 #include "mozilla/dom/Event.h" // for nsIDOMEvent::InternalDOMEvent()
+#include "mozilla/dom/HTMLAreaElement.h"
 #include "mozilla/gfx/PathHelpers.h"
 #include "mozilla/UniquePtr.h"
 #include "nsString.h"
@@ -29,10 +30,11 @@
 
 using namespace mozilla;
 using namespace mozilla::gfx;
+using namespace mozilla::dom;
 
 class Area {
 public:
-  explicit Area(nsIContent* aArea);
+  explicit Area(HTMLAreaElement* aArea);
   virtual ~Area();
 
   virtual void ParseCoords(const nsAString& aSpec);
@@ -45,17 +47,17 @@ public:
 
   void HasFocus(bool aHasFocus);
 
-  nsCOMPtr<nsIContent> mArea;
+  RefPtr<HTMLAreaElement> mArea;
   UniquePtr<nscoord[]> mCoords;
   int32_t mNumCoords;
   bool mHasFocus;
 };
 
-Area::Area(nsIContent* aArea)
+Area::Area(HTMLAreaElement* aArea)
   : mArea(aArea)
 {
   MOZ_COUNT_CTOR(Area);
-  NS_PRECONDITION(mArea, "How did that happen?");
+  MOZ_ASSERT(mArea, "How did that happen?");
   mNumCoords = 0;
   mHasFocus = false;
 }
@@ -266,7 +268,7 @@ void Area::HasFocus(bool aHasFocus)
 
 class DefaultArea : public Area {
 public:
-  explicit DefaultArea(nsIContent* aArea);
+  explicit DefaultArea(HTMLAreaElement* aArea);
 
   virtual bool IsInside(nscoord x, nscoord y) const override;
   virtual void Draw(nsIFrame* aFrame, DrawTarget& aDrawTarget,
@@ -275,7 +277,7 @@ public:
   virtual void GetRect(nsIFrame* aFrame, nsRect& aRect) override;
 };
 
-DefaultArea::DefaultArea(nsIContent* aArea)
+DefaultArea::DefaultArea(HTMLAreaElement* aArea)
   : Area(aArea)
 {
 }
@@ -310,7 +312,7 @@ void DefaultArea::GetRect(nsIFrame* aFrame, nsRect& aRect)
 
 class RectArea : public Area {
 public:
-  explicit RectArea(nsIContent* aArea);
+  explicit RectArea(HTMLAreaElement* aArea);
 
   virtual void ParseCoords(const nsAString& aSpec) override;
   virtual bool IsInside(nscoord x, nscoord y) const override;
@@ -320,7 +322,7 @@ public:
   virtual void GetRect(nsIFrame* aFrame, nsRect& aRect) override;
 };
 
-RectArea::RectArea(nsIContent* aArea)
+RectArea::RectArea(HTMLAreaElement* aArea)
   : Area(aArea)
 {
 }
@@ -416,7 +418,7 @@ void RectArea::GetRect(nsIFrame* aFrame, nsRect& aRect)
 
 class PolyArea : public Area {
 public:
-  explicit PolyArea(nsIContent* aArea);
+  explicit PolyArea(HTMLAreaElement* aArea);
 
   virtual void ParseCoords(const nsAString& aSpec) override;
   virtual bool IsInside(nscoord x, nscoord y) const override;
@@ -426,7 +428,7 @@ public:
   virtual void GetRect(nsIFrame* aFrame, nsRect& aRect) override;
 };
 
-PolyArea::PolyArea(nsIContent* aArea)
+PolyArea::PolyArea(HTMLAreaElement* aArea)
   : Area(aArea)
 {
 }
@@ -573,7 +575,7 @@ void PolyArea::GetRect(nsIFrame* aFrame, nsRect& aRect)
 
 class CircleArea : public Area {
 public:
-  explicit CircleArea(nsIContent* aArea);
+  explicit CircleArea(HTMLAreaElement* aArea);
 
   virtual void ParseCoords(const nsAString& aSpec) override;
   virtual bool IsInside(nscoord x, nscoord y) const override;
@@ -583,7 +585,7 @@ public:
   virtual void GetRect(nsIFrame* aFrame, nsRect& aRect) override;
 };
 
-CircleArea::CircleArea(nsIContent* aArea)
+CircleArea::CircleArea(HTMLAreaElement* aArea)
   : Area(aArea)
 {
 }
@@ -750,21 +752,17 @@ nsImageMap::Init(nsImageFrame* aImageFrame, nsIContent* aMap)
 
 
 nsresult
-nsImageMap::SearchForAreas(nsIContent* aParent, bool& aFoundArea,
-                           bool& aFoundAnchor)
+nsImageMap::SearchForAreas(nsIContent* aParent)
 {
   nsresult rv = NS_OK;
-  uint32_t i, n = aParent->GetChildCount();
+  uint32_t n = aParent->GetChildCount();
 
-  // Look for <area> or <a> elements. We'll use whichever type we find first.
-  for (i = 0; i < n; i++) {
-    nsIContent *child = aParent->GetChildAt(i);
-
-    // If we haven't determined that the map element contains an
-    // <a> element yet, then look for <area>.
-    if (!aFoundAnchor && child->IsHTMLElement(nsGkAtoms::area)) {
-      aFoundArea = true;
-      rv = AddArea(child);
+  // Look for <area> elements.
+  for (nsIContent* child = aParent->GetFirstChild();
+       child;
+       child = child->GetNextSibling()) {
+    if (auto* area = static_cast<HTMLAreaElement*>(HTMLAreaElement::FromContent(child))) {
+      rv = AddArea(area);
       NS_ENSURE_SUCCESS(rv, rv);
 
       // Continue to next child. This stops mConsiderWholeSubtree from
@@ -774,17 +772,9 @@ nsImageMap::SearchForAreas(nsIContent* aParent, bool& aFoundArea,
       continue;
     }
 
-    // If we haven't determined that the map element contains an
-    // <area> element yet, then look for <a>.
-    if (!aFoundArea && child->IsHTMLElement(nsGkAtoms::a)) {
-      aFoundAnchor = true;
-      rv = AddArea(child);
-      NS_ENSURE_SUCCESS(rv, rv);
-    }
-
     if (child->IsElement()) {
       mConsiderWholeSubtree = true;
-      rv = SearchForAreas(child, aFoundArea, aFoundAnchor);
+      rv = SearchForAreas(child);
       NS_ENSURE_SUCCESS(rv, rv);
     }
   }
@@ -798,11 +788,9 @@ nsImageMap::UpdateAreas()
   // Get rid of old area data
   FreeAreas();
 
-  bool foundArea = false;
-  bool foundAnchor = false;
   mConsiderWholeSubtree = false;
+  nsresult rv = SearchForAreas(mMap);
 
-  nsresult rv = SearchForAreas(mMap, foundArea, foundAnchor);
 #ifdef ACCESSIBILITY
   if (NS_SUCCEEDED(rv)) {
     nsAccessibilityService* accService = GetAccService();
@@ -815,7 +803,7 @@ nsImageMap::UpdateAreas()
 }
 
 nsresult
-nsImageMap::AddArea(nsIContent* aArea)
+nsImageMap::AddArea(HTMLAreaElement* aArea)
 {
   static nsIContent::AttrValuesArray strings[] =
     {&nsGkAtoms::rect, &nsGkAtoms::rectangle,
diff --git a/layout/generic/nsImageMap.h b/layout/generic/nsImageMap.h
index 42fc9f333f..9a5253bf6c 100644
--- a/layout/generic/nsImageMap.h
+++ b/layout/generic/nsImageMap.h
@@ -21,6 +21,12 @@ class nsIFrame;
 class nsIContent;
 struct nsRect;
 
+namespace mozilla {
+namespace dom {
+class HTMLAreaElement;
+}
+}
+
 class nsImageMap final : public nsStubMutationObserver,
                          public nsIDOMEventListener
 {
@@ -81,10 +87,9 @@ protected:
   void FreeAreas();
 
   nsresult UpdateAreas();
-  nsresult SearchForAreas(nsIContent* aParent, bool& aFoundArea,
-                          bool& aFoundAnchor);
+  nsresult SearchForAreas(nsIContent* aParent);
 
-  nsresult AddArea(nsIContent* aArea);
+  nsresult AddArea(mozilla::dom::HTMLAreaElement* aArea);
  
   void MaybeUpdateAreas(nsIContent *aContent);
 

From 8db40dbbb5e9c2a9ab3fb092e865b851e74eab53 Mon Sep 17 00:00:00 2001
From: Moonchild <moonchild@palemoon.org>
Date: Fri, 25 Apr 2025 09:11:18 +0200
Subject: [PATCH 05/10] No Issue - Modernize nsImageFrame/nsImageMap

Primarily flow control improvements, and removing unused `nsresults`.
---
 layout/generic/nsImageFrame.cpp | 30 ++++++++---------
 layout/generic/nsImageMap.cpp   | 59 +++++++++++----------------------
 layout/generic/nsImageMap.h     |  8 ++---
 3 files changed, 37 insertions(+), 60 deletions(-)

diff --git a/layout/generic/nsImageFrame.cpp b/layout/generic/nsImageFrame.cpp
index 6afdeef618..6a7672a513 100644
--- a/layout/generic/nsImageFrame.cpp
+++ b/layout/generic/nsImageFrame.cpp
@@ -175,17 +175,18 @@ nsImageFrame::AccessibleType()
 void
 nsImageFrame::DisconnectMap()
 {
-  if (mImageMap) {
-    mImageMap->Destroy();
-    mImageMap = nullptr;
+  if (!mImageMap) {
+    return;
+  }
+  
+  mImageMap->Destroy();
+  mImageMap = nullptr;
 
 #ifdef ACCESSIBILITY
-  nsAccessibilityService* accService = GetAccService();
-  if (accService) {
+  if (nsAccessibilityService* accService = GetAccService()) {
     accService->RecreateAccessible(PresContext()->PresShell(), mContent);
   }
 #endif
-  }
 }
 
 void
@@ -1718,8 +1719,7 @@ nsImageFrame::PaintImage(nsRenderingContext& aRenderingContext, nsPoint aPt,
       nsLayoutUtils::GetSamplingFilterForFrame(this), dest, aDirtyRect,
       nullptr, flags, &anchorPoint);
 
-  nsImageMap* map = GetImageMap();
-  if (map) {
+  if (nsImageMap* map = GetImageMap()) {
     gfxPoint devPixelOffset =
       nsLayoutUtils::PointToGfxPoint(dest.TopLeft(),
                                      PresContext()->AppUnitsPerDevPixel());
@@ -1886,8 +1886,7 @@ nsImageMap*
 nsImageFrame::GetImageMap()
 {
   if (!mImageMap) {
-    nsIContent* map = GetMapElement();
-    if (map) {
+    if (nsIContent* map = GetMapElement()) {
       mImageMap = new nsImageMap();
       mImageMap->Init(this, map);
     }
@@ -1975,9 +1974,7 @@ nsImageFrame::GetContentForEvent(WidgetEvent* aEvent,
     return NS_OK;
   }
 
-  nsImageMap* map = GetImageMap();
-
-  if (nullptr != map) {
+  if (nsImageMap* map = GetImageMap()) {
     nsIntPoint p;
     TranslateEventCoords(
       nsLayoutUtils::GetEventCoordinatesRelativeTo(aEvent, this), p);
@@ -2006,7 +2003,7 @@ nsImageFrame::HandleEvent(nsPresContext* aPresContext,
       aEvent->mMessage == eMouseMove) {
     nsImageMap* map = GetImageMap();
     bool isServerMap = IsServerImageMap();
-    if ((nullptr != map) || isServerMap) {
+    if (map || isServerMap) {
       nsIntPoint p;
       TranslateEventCoords(
         nsLayoutUtils::GetEventCoordinatesRelativeTo(aEvent, this), p);
@@ -2015,7 +2012,7 @@ nsImageFrame::HandleEvent(nsPresContext* aPresContext,
       // through content, we need to make sure we're not inside
       // (in case we deal with a case of both client-side and
       // sever-side on the same image - it happens!)
-      if (nullptr != map) {
+      if (map) {
         inside = !!map->GetArea(p.x, p.y);
       }
 
@@ -2063,8 +2060,7 @@ nsresult
 nsImageFrame::GetCursor(const nsPoint& aPoint,
                         nsIFrame::Cursor& aCursor)
 {
-  nsImageMap* map = GetImageMap();
-  if (nullptr != map) {
+  if (nsImageMap* map = GetImageMap()) {
     nsIntPoint p;
     TranslateEventCoords(aPoint, p);
     nsCOMPtr<nsIContent> area = map->GetArea(p.x, p.y);
diff --git a/layout/generic/nsImageMap.cpp b/layout/generic/nsImageMap.cpp
index b4291ad4a3..2a0a09025f 100644
--- a/layout/generic/nsImageMap.cpp
+++ b/layout/generic/nsImageMap.cpp
@@ -715,9 +715,7 @@ nsImageMap::GetBoundsForAreaContent(nsIContent *aContent,
 void
 nsImageMap::FreeAreas()
 {
-  uint32_t i, n = mAreas.Length();
-  for (i = 0; i < n; i++) {
-    Area* area = mAreas.ElementAt(i);
+  for (auto* area : mAreas) {
     if (area->mArea->IsInUncomposedDoc()) {
       NS_ASSERTION(area->mArea->GetPrimaryFrame() == mImageFrame,
                    "Unexpected primary frame");
@@ -731,30 +729,28 @@ nsImageMap::FreeAreas()
                                            false);
     delete area;
   }
+
   mAreas.Clear();
 }
 
-nsresult
+void
 nsImageMap::Init(nsImageFrame* aImageFrame, nsIContent* aMap)
 {
-  NS_PRECONDITION(aMap, "null ptr");
-  if (!aMap) {
-    return NS_ERROR_NULL_POINTER;
-  }
-  mImageFrame = aImageFrame;
+  MOZ_ASSERT(aMap);
+  MOZ_ASSERT(aImageFrame);
 
+  mImageFrame = aImageFrame;
   mMap = aMap;
   mMap->AddMutationObserver(this);
 
   // "Compile" the areas in the map into faster access versions
-  return UpdateAreas();
+  UpdateAreas();
 }
 
 
-nsresult
+void
 nsImageMap::SearchForAreas(nsIContent* aParent)
 {
-  nsresult rv = NS_OK;
   uint32_t n = aParent->GetChildCount();
 
   // Look for <area> elements.
@@ -762,8 +758,7 @@ nsImageMap::SearchForAreas(nsIContent* aParent)
        child;
        child = child->GetNextSibling()) {
     if (auto* area = static_cast<HTMLAreaElement*>(HTMLAreaElement::FromContent(child))) {
-      rv = AddArea(area);
-      NS_ENSURE_SUCCESS(rv, rv);
+      AddArea(area);
 
       // Continue to next child. This stops mConsiderWholeSubtree from
       // getting set. It also makes us ignore children of <area>s which
@@ -774,35 +769,28 @@ nsImageMap::SearchForAreas(nsIContent* aParent)
 
     if (child->IsElement()) {
       mConsiderWholeSubtree = true;
-      rv = SearchForAreas(child);
-      NS_ENSURE_SUCCESS(rv, rv);
+      SearchForAreas(child);
     }
   }
-
-  return NS_OK;
 }
 
-nsresult
+void
 nsImageMap::UpdateAreas()
 {
   // Get rid of old area data
   FreeAreas();
 
   mConsiderWholeSubtree = false;
-  nsresult rv = SearchForAreas(mMap);
+  SearchForAreas(mMap);
 
 #ifdef ACCESSIBILITY
-  if (NS_SUCCEEDED(rv)) {
-    nsAccessibilityService* accService = GetAccService();
-    if (accService) {
-      accService->UpdateImageMap(mImageFrame);
-    }
+  if (nsAccessibilityService* accService = GetAccService()) {
+    accService->UpdateImageMap(mImageFrame);
   }
 #endif
-  return rv;
 }
 
-nsresult
+void
 nsImageMap::AddArea(HTMLAreaElement* aArea)
 {
   static nsIContent::AttrValuesArray strings[] =
@@ -834,17 +822,13 @@ nsImageMap::AddArea(HTMLAreaElement* aArea)
     break;
   default:
     area = nullptr;
-    NS_NOTREACHED("FindAttrValueIn returned an unexpected value.");
+    MOZ_ASSERT_UNREACHABLE("FindAttrValueIn returned an unexpected value.");
     break;
   }
-  if (!area)
-    return NS_ERROR_OUT_OF_MEMORY;
 
   //Add focus listener to track area focus changes
-  aArea->AddSystemEventListener(NS_LITERAL_STRING("focus"), this, false,
-                                false);
-  aArea->AddSystemEventListener(NS_LITERAL_STRING("blur"), this, false,
-                                false);
+  aArea->AddSystemEventListener(NS_LITERAL_STRING("focus"), this, false, false);
+  aArea->AddSystemEventListener(NS_LITERAL_STRING("blur"), this, false, false);
 
   // This is a nasty hack.  It needs to go away: see bug 135040.  Once this is
   // removed, the code added to RestyleManager::RestyleElement,
@@ -857,16 +841,13 @@ nsImageMap::AddArea(HTMLAreaElement* aArea)
   aArea->GetAttr(kNameSpaceID_None, nsGkAtoms::coords, coords);
   area->ParseCoords(coords);
   mAreas.AppendElement(area);
-  return NS_OK;
 }
 
 nsIContent*
 nsImageMap::GetArea(nscoord aX, nscoord aY) const
 {
   NS_ASSERTION(mMap, "Not initialized");
-  uint32_t i, n = mAreas.Length();
-  for (i = 0; i < n; i++) {
-    Area* area = mAreas.ElementAt(i);
+  for (auto* area : mAreas) {
     if (area->IsInside(aX, aY)) {
       return area->mArea;
     }
@@ -1000,7 +981,7 @@ nsImageMap::HandleEvent(nsIDOMEvent* aEvent)
 }
 
 void
-nsImageMap::Destroy(void)
+nsImageMap::Destroy()
 {
   FreeAreas();
   mImageFrame = nullptr;
diff --git a/layout/generic/nsImageMap.h b/layout/generic/nsImageMap.h
index 9a5253bf6c..27c5f7b7d1 100644
--- a/layout/generic/nsImageMap.h
+++ b/layout/generic/nsImageMap.h
@@ -37,7 +37,7 @@ class nsImageMap final : public nsStubMutationObserver,
 public:
   nsImageMap();
 
-  nsresult Init(nsImageFrame* aImageFrame, nsIContent* aMap);
+  void Init(nsImageFrame* aImageFrame, nsIContent* aMap);
 
   /**
    * Return the first area element (in content order) for the given aX,aY pixel
@@ -86,10 +86,10 @@ protected:
 
   void FreeAreas();
 
-  nsresult UpdateAreas();
-  nsresult SearchForAreas(nsIContent* aParent);
+  void UpdateAreas();
+  void SearchForAreas(nsIContent* aParent);
 
-  nsresult AddArea(mozilla::dom::HTMLAreaElement* aArea);
+  void AddArea(mozilla::dom::HTMLAreaElement* aArea);
  
   void MaybeUpdateAreas(nsIContent *aContent);
 

From 8a21d95ea3127b5e3cd91bb82fcca342f9ff4768 Mon Sep 17 00:00:00 2001
From: Moonchild <moonchild@palemoon.org>
Date: Fri, 25 Apr 2025 09:34:34 +0200
Subject: [PATCH 06/10] No issue - restore nullptr-check

---
 layout/generic/nsImageMap.cpp | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/layout/generic/nsImageMap.cpp b/layout/generic/nsImageMap.cpp
index 2a0a09025f..8f306ccba8 100644
--- a/layout/generic/nsImageMap.cpp
+++ b/layout/generic/nsImageMap.cpp
@@ -825,6 +825,10 @@ nsImageMap::AddArea(HTMLAreaElement* aArea)
     MOZ_ASSERT_UNREACHABLE("FindAttrValueIn returned an unexpected value.");
     break;
   }
+  if (!area) {
+    // Possibly OOM, or invalid attr (does not assert in release); early exit
+    return;
+  }
 
   //Add focus listener to track area focus changes
   aArea->AddSystemEventListener(NS_LITERAL_STRING("focus"), this, false, false);

From 8ae2b45691511022d9efc4dd1ac4bea953521e7b Mon Sep 17 00:00:00 2001
From: Moonchild <moonchild@palemoon.org>
Date: Fri, 25 Apr 2025 20:29:05 +0200
Subject: [PATCH 07/10] Issue #2732 - Part 3: Explicitly search for <area>
 only.

Relying on the implicit conversion by `::FromContent` doesn't work for
us because we inherit that from `nsGenericHTMLElement` and isn't specific
to `HTMLAreaElement`, so it would accept other elements.

This also updates the Attribute changed event handler to exclude `<a>`
elements and cleans up an unused variable from the old code.
---
 layout/generic/nsImageMap.cpp | 12 +++++-------
 1 file changed, 5 insertions(+), 7 deletions(-)

diff --git a/layout/generic/nsImageMap.cpp b/layout/generic/nsImageMap.cpp
index 8f306ccba8..6208c56888 100644
--- a/layout/generic/nsImageMap.cpp
+++ b/layout/generic/nsImageMap.cpp
@@ -751,16 +751,15 @@ nsImageMap::Init(nsImageFrame* aImageFrame, nsIContent* aMap)
 void
 nsImageMap::SearchForAreas(nsIContent* aParent)
 {
-  uint32_t n = aParent->GetChildCount();
-
   // Look for <area> elements.
   for (nsIContent* child = aParent->GetFirstChild();
        child;
        child = child->GetNextSibling()) {
-    if (auto* area = static_cast<HTMLAreaElement*>(HTMLAreaElement::FromContent(child))) {
+    if (child->IsHTMLElement(nsGkAtoms::area)) {
+      HTMLAreaElement* area = static_cast<HTMLAreaElement*>(HTMLAreaElement::FromContent(child));
       AddArea(area);
 
-      // Continue to next child. This stops mConsiderWholeSubtree from
+      // Continue to next sibling. This stops mConsiderWholeSubtree from
       // getting set. It also makes us ignore children of <area>s which
       // is consistent with how we react to dynamic insertion of such
       // children.
@@ -895,11 +894,10 @@ nsImageMap::AttributeChanged(nsIDocument*  aDocument,
                              const nsAttrValue* aOldValue)
 {
   // If the parent of the changing content node is our map then update
-  // the map.  But only do this if the node is an HTML <area> or <a>
+  // the map.  But only do this if the node is an HTML <area>
   // and the attribute that's changing is "shape" or "coords" -- those
   // are the only cases we care about.
-  if ((aElement->NodeInfo()->Equals(nsGkAtoms::area) ||
-       aElement->NodeInfo()->Equals(nsGkAtoms::a)) &&
+  if (aElement->NodeInfo()->Equals(nsGkAtoms::area) &&
       aElement->IsHTMLElement() &&
       aNameSpaceID == kNameSpaceID_None &&
       (aAttribute == nsGkAtoms::shape ||

From fd4a224d1d0d55db1e84d0bc71af2d2ebf69deb0 Mon Sep 17 00:00:00 2001
From: Moonchild <moonchild@palemoon.org>
Date: Sun, 27 Apr 2025 18:03:48 +0200
Subject: [PATCH 08/10] Issue #2737 - Part 1: Base implementation of
 `SVGGeometryElement`.

Mostly mechanical changes to generalize path geometry for all SVG draw
elements. No user-exposed changes.
---
 accessible/base/nsAccessibilityService.cpp    |   6 +-
 dom/base/nsGkAtomList.h                       |   2 +-
 dom/svg/SVGCircleElement.cpp                  |   2 +-
 dom/svg/SVGCircleElement.h                    |   8 +-
 dom/svg/SVGEllipseElement.cpp                 |   2 +-
 dom/svg/SVGEllipseElement.h                   |   6 +-
 ...etryElement.cpp => SVGGeometryElement.cpp} |  83 ++++++++--
 ...GeometryElement.h => SVGGeometryElement.h} |  35 +++-
 dom/svg/SVGImageElement.cpp                   |   2 +-
 dom/svg/SVGImageElement.h                     |   8 +-
 dom/svg/SVGLineElement.cpp                    |   2 +-
 dom/svg/SVGLineElement.h                      |   6 +-
 dom/svg/SVGPathData.cpp                       |   2 +-
 dom/svg/SVGPathElement.cpp                    |  51 +-----
 dom/svg/SVGPathElement.h                      |  17 +-
 ...sSVGPolyElement.cpp => SVGPolyElement.cpp} |  40 ++---
 .../{nsSVGPolyElement.h => SVGPolyElement.h}  |  26 +--
 dom/svg/SVGPolygonElement.cpp                 |   6 +-
 dom/svg/SVGPolygonElement.h                   |   8 +-
 dom/svg/SVGPolylineElement.cpp                |   2 +-
 dom/svg/SVGPolylineElement.h                  |   8 +-
 dom/svg/SVGRectElement.cpp                    |   2 +-
 dom/svg/SVGRectElement.h                      |   8 +-
 dom/svg/moz.build                             |   5 +-
 dom/svg/nsSVGElement.cpp                      |   2 +-
 .../mochitest/general/test_interfaces.html    |   2 +
 dom/webidl/SVGGeometryElement.webidl          |  20 +++
 dom/webidl/SVGPathElement.webidl              |   8 +-
 dom/webidl/moz.build                          |   1 +
 layout/base/nsCSSFrameConstructor.cpp         |  16 +-
 layout/base/nsDisplayItemTypesList.h          |   2 +-
 layout/generic/nsFrameIdList.h                |   2 +-
 layout/style/nsStyleStruct.cpp                |  16 +-
 ...GeometryFrame.cpp => SVGGeometryFrame.cpp} | 153 +++++++++---------
 ...PathGeometryFrame.h => SVGGeometryFrame.h} |  35 ++--
 layout/svg/moz.build                          |   2 +-
 layout/svg/nsSVGClipPathFrame.cpp             |  16 +-
 layout/svg/nsSVGEffects.cpp                   |  10 +-
 layout/svg/nsSVGImageFrame.cpp                |  20 +--
 layout/svg/nsSVGMarkerFrame.cpp               |  12 +-
 layout/svg/nsSVGMarkerFrame.h                 |  10 +-
 layout/svg/nsSVGPatternFrame.cpp              |   4 +-
 layout/svg/nsSVGPatternFrame.h                |   4 +-
 layout/svg/nsSVGUtils.cpp                     |  10 +-
 layout/svg/nsSVGUtils.h                       |   5 +-
 45 files changed, 368 insertions(+), 319 deletions(-)
 rename dom/svg/{nsSVGPathGeometryElement.cpp => SVGGeometryElement.cpp} (58%)
 rename dom/svg/{nsSVGPathGeometryElement.h => SVGGeometryElement.h} (88%)
 rename dom/svg/{nsSVGPolyElement.cpp => SVGPolyElement.cpp} (75%)
 rename dom/svg/{nsSVGPolyElement.h => SVGPolyElement.h} (78%)
 create mode 100644 dom/webidl/SVGGeometryElement.webidl
 rename layout/svg/{nsSVGPathGeometryFrame.cpp => SVGGeometryFrame.cpp} (87%)
 rename layout/svg/{nsSVGPathGeometryFrame.h => SVGGeometryFrame.h} (83%)

diff --git a/accessible/base/nsAccessibilityService.cpp b/accessible/base/nsAccessibilityService.cpp
index 90d54e3ab6..77ee03316f 100644
--- a/accessible/base/nsAccessibilityService.cpp
+++ b/accessible/base/nsAccessibilityService.cpp
@@ -56,7 +56,7 @@
 #include "nsIObserverService.h"
 #include "nsLayoutUtils.h"
 #include "nsPluginFrame.h"
-#include "nsSVGPathGeometryFrame.h"
+#include "SVGGeometryFrame.h"
 #include "nsTreeBodyFrame.h"
 #include "nsTreeColumns.h"
 #include "nsTreeUtils.h"
@@ -1161,8 +1161,8 @@ nsAccessibilityService::CreateAccessible(nsINode* aNode,
 
   if (!newAcc) {
     if (content->IsSVGElement()) {
-      nsSVGPathGeometryFrame* pathGeometryFrame = do_QueryFrame(frame);
-      if (pathGeometryFrame) {
+      SVGGeometryFrame* geometryFrame = do_QueryFrame(frame);
+      if (geometryFrame) {
         // A graphic elements: rect, circle, ellipse, line, path, polygon,
         // polyline and image. A 'use' and 'text' graphic elements require
         // special support.
diff --git a/dom/base/nsGkAtomList.h b/dom/base/nsGkAtomList.h
index 617aea60a7..15ff8b0317 100644
--- a/dom/base/nsGkAtomList.h
+++ b/dom/base/nsGkAtomList.h
@@ -2061,6 +2061,7 @@ GK_ATOM(svgFEUnstyledLeafFrame, "SVGFEUnstyledLeafFrame")
 GK_ATOM(svgFilterFrame, "SVGFilterFrame")
 GK_ATOM(svgForeignObjectFrame, "SVGForeignObjectFrame")
 GK_ATOM(svgGenericContainerFrame, "SVGGenericContainerFrame")
+GK_ATOM(svgGeometryFrame, "SVGGeometryFrame")
 GK_ATOM(svgGFrame, "SVGGFrame")
 GK_ATOM(svgGradientFrame, "SVGGradientFrame")
 GK_ATOM(svgImageFrame, "SVGImageFrame")
@@ -2071,7 +2072,6 @@ GK_ATOM(svgMarkerAnonChildFrame, "SVGMarkerAnonChildFrame")
 GK_ATOM(svgMaskFrame, "SVGMaskFrame")
 GK_ATOM(svgOuterSVGFrame, "SVGOuterSVGFrame")
 GK_ATOM(svgOuterSVGAnonChildFrame, "SVGOuterSVGAnonChildFrame")
-GK_ATOM(svgPathGeometryFrame, "SVGPathGeometryFrame")
 GK_ATOM(svgPatternFrame, "SVGPatternFrame")
 GK_ATOM(svgRadialGradientFrame, "SVGRadialGradientFrame")
 GK_ATOM(svgStopFrame, "SVGStopFrame")
diff --git a/dom/svg/SVGCircleElement.cpp b/dom/svg/SVGCircleElement.cpp
index 5f0873c49d..7ef3f513cc 100644
--- a/dom/svg/SVGCircleElement.cpp
+++ b/dom/svg/SVGCircleElement.cpp
@@ -79,7 +79,7 @@ SVGCircleElement::GetLengthInfo()
 }
 
 //----------------------------------------------------------------------
-// nsSVGPathGeometryElement methods
+// SVGGeometryElement methods
 
 bool
 SVGCircleElement::GetGeometryBounds(Rect* aBounds,
diff --git a/dom/svg/SVGCircleElement.h b/dom/svg/SVGCircleElement.h
index 64518b4d95..b946ce7a49 100644
--- a/dom/svg/SVGCircleElement.h
+++ b/dom/svg/SVGCircleElement.h
@@ -6,17 +6,17 @@
 #ifndef mozilla_dom_SVGCircleElement_h
 #define mozilla_dom_SVGCircleElement_h
 
-#include "nsSVGPathGeometryElement.h"
+#include "SVGGeometryElement.h"
 #include "nsSVGLength2.h"
 
 nsresult NS_NewSVGCircleElement(nsIContent **aResult,
                                 already_AddRefed<mozilla::dom::NodeInfo>&& aNodeInfo);
 
-typedef nsSVGPathGeometryElement SVGCircleElementBase;
-
 namespace mozilla {
 namespace dom {
 
+typedef SVGGeometryElement SVGCircleElementBase;
+
 class SVGCircleElement final : public SVGCircleElementBase
 {
 protected:
@@ -29,7 +29,7 @@ public:
   // nsSVGSVGElement methods:
   virtual bool HasValidDimensions() const override;
 
-  // nsSVGPathGeometryElement methods:
+  // SVGGeometryElement methods:
   virtual bool GetGeometryBounds(Rect* aBounds, const StrokeOptions& aStrokeOptions,
                                  const Matrix& aToBoundsSpace,
                                  const Matrix* aToNonScalingStrokeSpace = nullptr) override;
diff --git a/dom/svg/SVGEllipseElement.cpp b/dom/svg/SVGEllipseElement.cpp
index 47528af36c..5c1971be0d 100644
--- a/dom/svg/SVGEllipseElement.cpp
+++ b/dom/svg/SVGEllipseElement.cpp
@@ -90,7 +90,7 @@ SVGEllipseElement::GetLengthInfo()
 }
 
 //----------------------------------------------------------------------
-// nsSVGPathGeometryElement methods
+// SVGGeometryElement methods
 
 bool
 SVGEllipseElement::GetGeometryBounds(Rect* aBounds,
diff --git a/dom/svg/SVGEllipseElement.h b/dom/svg/SVGEllipseElement.h
index 0b1904a329..ab2a0c95de 100644
--- a/dom/svg/SVGEllipseElement.h
+++ b/dom/svg/SVGEllipseElement.h
@@ -6,7 +6,7 @@
 #ifndef mozilla_dom_SVGEllipseElement_h
 #define mozilla_dom_SVGEllipseElement_h
 
-#include "nsSVGPathGeometryElement.h"
+#include "SVGGeometryElement.h"
 #include "nsSVGLength2.h"
 
 nsresult NS_NewSVGEllipseElement(nsIContent **aResult,
@@ -15,7 +15,7 @@ nsresult NS_NewSVGEllipseElement(nsIContent **aResult,
 namespace mozilla {
 namespace dom {
 
-typedef nsSVGPathGeometryElement SVGEllipseElementBase;
+typedef SVGGeometryElement SVGEllipseElementBase;
 
 class SVGEllipseElement final : public SVGEllipseElementBase
 {
@@ -29,7 +29,7 @@ public:
   // nsSVGSVGElement methods:
   virtual bool HasValidDimensions() const override;
 
-  // nsSVGPathGeometryElement methods:
+  // SVGGeometryElement methods:
   virtual bool GetGeometryBounds(Rect* aBounds, const StrokeOptions& aStrokeOptions,
                                  const Matrix& aToBoundsSpace,
                                  const Matrix* aToNonScalingStrokeSpace = nullptr) override;
diff --git a/dom/svg/nsSVGPathGeometryElement.cpp b/dom/svg/SVGGeometryElement.cpp
similarity index 58%
rename from dom/svg/nsSVGPathGeometryElement.cpp
rename to dom/svg/SVGGeometryElement.cpp
index 726ee95786..e59a16ef5e 100644
--- a/dom/svg/nsSVGPathGeometryElement.cpp
+++ b/dom/svg/SVGGeometryElement.cpp
@@ -3,8 +3,9 @@
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
-#include "nsSVGPathGeometryElement.h"
+#include "SVGGeometryElement.h"
 
+#include "DOMSVGPoint.h"
 #include "gfxPlatform.h"
 #include "mozilla/gfx/2D.h"
 #include "nsComputedDOMStyle.h"
@@ -15,16 +16,25 @@
 using namespace mozilla;
 using namespace mozilla::gfx;
 
+nsSVGElement::NumberInfo SVGGeometryElement::sNumberInfo =
+{ &nsGkAtoms::pathLength, 0, false };
+
 //----------------------------------------------------------------------
 // Implementation
 
-nsSVGPathGeometryElement::nsSVGPathGeometryElement(already_AddRefed<mozilla::dom::NodeInfo>& aNodeInfo)
-  : nsSVGPathGeometryElementBase(aNodeInfo)
+SVGGeometryElement::SVGGeometryElement(already_AddRefed<mozilla::dom::NodeInfo>& aNodeInfo)
+  : SVGGeometryElementBase(aNodeInfo)
 {
 }
 
+nsSVGElement::NumberAttributesInfo
+SVGGeometryElement::GetNumberInfo()
+{
+  return NumberAttributesInfo(&mPathLength, &sNumberInfo, 1);
+}
+
 nsresult
-nsSVGPathGeometryElement::AfterSetAttr(int32_t aNamespaceID, nsIAtom* aName,
+SVGGeometryElement::AfterSetAttr(int32_t aNamespaceID, nsIAtom* aName,
                                  const nsAttrValue* aValue,
                                  const nsAttrValue* aOldValue, bool aNotify)
 {
@@ -33,13 +43,17 @@ nsSVGPathGeometryElement::AfterSetAttr(int32_t aNamespaceID, nsIAtom* aName,
       AttributeDefinesGeometry(aName)) {
     mCachedPath = nullptr;
   }
-  return nsSVGPathGeometryElementBase::AfterSetAttr(aNamespaceID, aName,
-                                                    aValue, aOldValue, aNotify);
+  return SVGGeometryElementBase::AfterSetAttr(aNamespaceID, aName,
+                                              aValue, aOldValue, aNotify);
 }
 
 bool
-nsSVGPathGeometryElement::AttributeDefinesGeometry(const nsIAtom *aName)
+SVGGeometryElement::AttributeDefinesGeometry(const nsIAtom *aName)
 {
+  if (aName == nsGkAtoms::pathLength) {
+    return true;
+  }
+
   // Check for nsSVGLength2 attribute
   LengthAttributesInfo info = GetLengthInfo();
   for (uint32_t i = 0; i < info.mLengthCount; i++) {
@@ -52,10 +66,10 @@ nsSVGPathGeometryElement::AttributeDefinesGeometry(const nsIAtom *aName)
 }
 
 bool
-nsSVGPathGeometryElement::GeometryDependsOnCoordCtx()
+SVGGeometryElement::GeometryDependsOnCoordCtx()
 {
   // Check the nsSVGLength2 attribute
-  LengthAttributesInfo info = const_cast<nsSVGPathGeometryElement*>(this)->GetLengthInfo();
+  LengthAttributesInfo info = const_cast<SVGGeometryElement*>(this)->GetLengthInfo();
   for (uint32_t i = 0; i < info.mLengthCount; i++) {
     if (info.mLengths[i].GetSpecifiedUnitType() == nsIDOMSVGLength::SVG_LENGTHTYPE_PERCENTAGE) {
       return true;
@@ -65,19 +79,19 @@ nsSVGPathGeometryElement::GeometryDependsOnCoordCtx()
 }
 
 bool
-nsSVGPathGeometryElement::IsMarkable()
+SVGGeometryElement::IsMarkable()
 {
   return false;
 }
 
 void
-nsSVGPathGeometryElement::GetMarkPoints(nsTArray<nsSVGMark> *aMarks)
+SVGGeometryElement::GetMarkPoints(nsTArray<nsSVGMark> *aMarks)
 {
 }
 
 already_AddRefed<Path>
-nsSVGPathGeometryElement::GetOrBuildPath(const DrawTarget& aDrawTarget,
-                                         FillRule aFillRule)
+SVGGeometryElement::GetOrBuildPath(const DrawTarget& aDrawTarget,
+                                   FillRule aFillRule)
 {
   // We only cache the path if it matches the backend used for screen painting:
   bool cacheable  = aDrawTarget.GetBackendType() ==
@@ -102,13 +116,13 @@ nsSVGPathGeometryElement::GetOrBuildPath(const DrawTarget& aDrawTarget,
 }
 
 already_AddRefed<Path>
-nsSVGPathGeometryElement::GetOrBuildPathForMeasuring()
+SVGGeometryElement::GetOrBuildPathForMeasuring()
 {
   return nullptr;
 }
 
 FillRule
-nsSVGPathGeometryElement::GetFillRule()
+SVGGeometryElement::GetFillRule()
 {
   FillRule fillRule = FillRule::FILL_WINDING; // Equivalent to StyleFillRule::Nonzero
 
@@ -130,3 +144,42 @@ nsSVGPathGeometryElement::GetFillRule()
 
   return fillRule;
 }
+
+float
+SVGGeometryElement::GetTotalLength()
+{
+  RefPtr<Path> flat = GetOrBuildPathForMeasuring();
+  return flat ? flat->ComputeLength() : 0.f;
+}
+
+already_AddRefed<nsISVGPoint>
+SVGGeometryElement::GetPointAtLength(float distance, ErrorResult& rv)
+{
+  RefPtr<Path> path = GetOrBuildPathForMeasuring();
+  if (!path) {
+    rv.Throw(NS_ERROR_FAILURE);
+    return nullptr;
+  }
+
+  float totalLength = path->ComputeLength();
+  if (mPathLength.IsExplicitlySet()) {
+    float pathLength = mPathLength.GetAnimValue();
+    if (pathLength <= 0) {
+      rv.Throw(NS_ERROR_FAILURE);
+      return nullptr;
+    }
+    distance *= totalLength / pathLength;
+  }
+  distance = std::max(0.f,         distance);
+  distance = std::min(totalLength, distance);
+
+  nsCOMPtr<nsISVGPoint> point =
+    new DOMSVGPoint(path->ComputePointAtLength(distance));
+  return point.forget();
+}
+
+already_AddRefed<SVGAnimatedNumber>
+SVGGeometryElement::PathLength()
+{
+  return mPathLength.ToDOMAnimatedNumber(this);
+}
diff --git a/dom/svg/nsSVGPathGeometryElement.h b/dom/svg/SVGGeometryElement.h
similarity index 88%
rename from dom/svg/nsSVGPathGeometryElement.h
rename to dom/svg/SVGGeometryElement.h
index 517d74096e..b19c259e2f 100644
--- a/dom/svg/nsSVGPathGeometryElement.h
+++ b/dom/svg/SVGGeometryElement.h
@@ -3,11 +3,13 @@
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
-#ifndef __NS_SVGPATHGEOMETRYELEMENT_H__
-#define __NS_SVGPATHGEOMETRYELEMENT_H__
+#ifndef mozilla_dom_SVGGeometryElement_h
+#define mozilla_dom_SVGGeometryElement_h
 
 #include "mozilla/gfx/2D.h"
 #include "SVGGraphicsElement.h"
+#include "nsISVGPoint.h"
+#include "nsSVGNumber2.h"
 
 struct nsSVGMark {
   enum Type {
@@ -24,9 +26,14 @@ struct nsSVGMark {
     x(aX), y(aY), angle(aAngle), type(aType) {}
 };
 
-typedef mozilla::dom::SVGGraphicsElement nsSVGPathGeometryElementBase;
+namespace mozilla {
+namespace dom {
 
-class nsSVGPathGeometryElement : public nsSVGPathGeometryElementBase
+class SVGAnimatedNumber;
+
+typedef mozilla::dom::SVGGraphicsElement SVGGeometryElementBase;
+
+class SVGGeometryElement : public SVGGeometryElementBase
 {
 protected:
   typedef mozilla::gfx::CapStyle CapStyle;
@@ -41,7 +48,7 @@ protected:
   typedef mozilla::gfx::StrokeOptions StrokeOptions;
 
 public:
-  explicit nsSVGPathGeometryElement(already_AddRefed<mozilla::dom::NodeInfo>& aNodeInfo);
+  explicit SVGGeometryElement(already_AddRefed<mozilla::dom::NodeInfo>& aNodeInfo);
 
   virtual nsresult AfterSetAttr(int32_t aNamespaceID, nsIAtom* aName,
                                 const nsAttrValue* aValue,
@@ -160,7 +167,7 @@ public:
    * that is created may be cached and returned on subsequent calls.
    */
   virtual already_AddRefed<Path> GetOrBuildPath(const DrawTarget& aDrawTarget,
-                                                     FillRule fillRule);
+                                                FillRule fillRule);
 
   /**
    * The same as GetOrBuildPath, but bypasses the cache (neither returns any
@@ -192,8 +199,22 @@ public:
    */
   FillRule GetFillRule();
 
+  // WebIDL
+  already_AddRefed<SVGAnimatedNumber> PathLength();
+  float GetTotalLength();
+  already_AddRefed<nsISVGPoint>
+    GetPointAtLength(float distance, ErrorResult& rv);
+
 protected:
+  // nsSVGElement method
+  virtual NumberAttributesInfo GetNumberInfo() override;
+
+  nsSVGNumber2 mPathLength;
+  static NumberInfo sNumberInfo;
   mutable RefPtr<Path> mCachedPath;
 };
 
-#endif
+} // namespace dom
+} // namespace mozilla
+
+#endif // mozilla_dom_SVGGeometryElement_h
diff --git a/dom/svg/SVGImageElement.cpp b/dom/svg/SVGImageElement.cpp
index e6d8cc44c0..1b8a8f140f 100644
--- a/dom/svg/SVGImageElement.cpp
+++ b/dom/svg/SVGImageElement.cpp
@@ -235,7 +235,7 @@ SVGImageElement::IsAttributeMapped(const nsIAtom* name) const
 }
 
 //----------------------------------------------------------------------
-// nsSVGPathGeometryElement methods
+// SVGGeometryElement methods
 
 /* For the purposes of the update/invalidation logic pretend to
    be a rectangle. */
diff --git a/dom/svg/SVGImageElement.h b/dom/svg/SVGImageElement.h
index 62e826f963..6663166ad5 100644
--- a/dom/svg/SVGImageElement.h
+++ b/dom/svg/SVGImageElement.h
@@ -8,21 +8,21 @@
 
 #include "nsImageLoadingContent.h"
 #include "nsSVGLength2.h"
-#include "nsSVGPathGeometryElement.h"
 #include "nsSVGString.h"
+#include "SVGGeometryElement.h"
 #include "SVGAnimatedPreserveAspectRatio.h"
 
 nsresult NS_NewSVGImageElement(nsIContent **aResult,
                                already_AddRefed<mozilla::dom::NodeInfo>&& aNodeInfo);
 
-typedef nsSVGPathGeometryElement SVGImageElementBase;
-
 class nsSVGImageFrame;
 
 namespace mozilla {
 namespace dom {
 class DOMSVGAnimatedPreserveAspectRatio;
 
+typedef SVGGeometryElement SVGImageElementBase;
+
 class SVGImageElement : public SVGImageElementBase,
                         public nsImageLoadingContent
 {
@@ -57,7 +57,7 @@ public:
 
   NS_IMETHOD_(bool) IsAttributeMapped(const nsIAtom* name) const override;
 
-  // nsSVGPathGeometryElement methods:
+  // SVGGeometryElement methods:
   virtual bool GetGeometryBounds(Rect* aBounds, const StrokeOptions& aStrokeOptions,
                                  const Matrix& aToBoundsSpace,
                                  const Matrix* aToNonScalingStrokeSpace = nullptr) override;
diff --git a/dom/svg/SVGLineElement.cpp b/dom/svg/SVGLineElement.cpp
index 776c6b04a3..8f43a4317d 100644
--- a/dom/svg/SVGLineElement.cpp
+++ b/dom/svg/SVGLineElement.cpp
@@ -109,7 +109,7 @@ SVGLineElement::GetLengthInfo()
 }
 
 //----------------------------------------------------------------------
-// nsSVGPathGeometryElement methods
+// SVGGeometryElement methods
 
 void
 SVGLineElement::GetMarkPoints(nsTArray<nsSVGMark> *aMarks) {
diff --git a/dom/svg/SVGLineElement.h b/dom/svg/SVGLineElement.h
index 7ff652424d..5a6a94447e 100644
--- a/dom/svg/SVGLineElement.h
+++ b/dom/svg/SVGLineElement.h
@@ -6,7 +6,7 @@
 #ifndef mozilla_dom_SVGLineElement_h
 #define mozilla_dom_SVGLineElement_h
 
-#include "nsSVGPathGeometryElement.h"
+#include "SVGGeometryElement.h"
 #include "nsSVGLength2.h"
 
 nsresult NS_NewSVGLineElement(nsIContent **aResult,
@@ -15,7 +15,7 @@ nsresult NS_NewSVGLineElement(nsIContent **aResult,
 namespace mozilla {
 namespace dom {
 
-typedef nsSVGPathGeometryElement SVGLineElementBase;
+typedef SVGGeometryElement SVGLineElementBase;
 
 class SVGLineElement final : public SVGLineElementBase
 {
@@ -33,7 +33,7 @@ public:
   // nsIContent interface
   NS_IMETHOD_(bool) IsAttributeMapped(const nsIAtom* name) const override;
 
-  // nsSVGPathGeometryElement methods:
+  // SVGGeometryElement methods:
   virtual bool IsMarkable() override { return true; }
   virtual void GetMarkPoints(nsTArray<nsSVGMark> *aMarks) override;
   virtual void GetAsSimplePath(SimplePath* aSimplePath) override;
diff --git a/dom/svg/SVGPathData.cpp b/dom/svg/SVGPathData.cpp
index 493f4d821a..be3912af2a 100644
--- a/dom/svg/SVGPathData.cpp
+++ b/dom/svg/SVGPathData.cpp
@@ -14,10 +14,10 @@
 #include "nsError.h"
 #include "nsString.h"
 #include "nsSVGPathDataParser.h"
-#include "nsSVGPathGeometryElement.h" // for nsSVGMark
 #include <stdarg.h>
 #include "nsStyleConsts.h"
 #include "SVGContentUtils.h"
+#include "SVGGeometryElement.h" // for nsSVGMark
 #include "SVGPathSegUtils.h"
 #include <algorithm>
 
diff --git a/dom/svg/SVGPathElement.cpp b/dom/svg/SVGPathElement.cpp
index 204eb04bde..8f9815dbaa 100644
--- a/dom/svg/SVGPathElement.cpp
+++ b/dom/svg/SVGPathElement.cpp
@@ -9,7 +9,6 @@
 
 #include "DOMSVGPathSeg.h"
 #include "DOMSVGPathSegList.h"
-#include "DOMSVGPoint.h"
 #include "gfx2DGlue.h"
 #include "gfxPlatform.h"
 #include "mozilla/dom/SVGPathElementBinding.h"
@@ -35,9 +34,6 @@ SVGPathElement::WrapNode(JSContext *aCx, JS::Handle<JSObject*> aGivenProto)
   return SVGPathElementBinding::Wrap(aCx, this, aGivenProto);
 }
 
-nsSVGElement::NumberInfo SVGPathElement::sNumberInfo = 
-{ &nsGkAtoms::pathLength, 0, false };
-
 //----------------------------------------------------------------------
 // Implementation
 
@@ -61,45 +57,6 @@ SVGPathElement::SizeOfExcludingThis(mozilla::MallocSizeOf aMallocSizeOf) const
 
 NS_IMPL_ELEMENT_CLONE_WITH_INIT(SVGPathElement)
 
-already_AddRefed<SVGAnimatedNumber>
-SVGPathElement::PathLength()
-{
-  return mPathLength.ToDOMAnimatedNumber(this);
-}
-
-float
-SVGPathElement::GetTotalLength()
-{
-  RefPtr<Path> flat = GetOrBuildPathForMeasuring();
-  return flat ? flat->ComputeLength() : 0.f;
-}
-
-already_AddRefed<nsISVGPoint>
-SVGPathElement::GetPointAtLength(float distance, ErrorResult& rv)
-{
-  RefPtr<Path> path = GetOrBuildPathForMeasuring();
-  if (!path) {
-    rv.Throw(NS_ERROR_FAILURE);
-    return nullptr;
-  }
-
-  float totalLength = path->ComputeLength();
-  if (mPathLength.IsExplicitlySet()) {
-    float pathLength = mPathLength.GetAnimValue();
-    if (pathLength <= 0) {
-      rv.Throw(NS_ERROR_FAILURE);
-      return nullptr;
-    }
-    distance *= totalLength / pathLength;
-  }
-  distance = std::max(0.f,         distance);
-  distance = std::min(totalLength, distance);
-
-  nsCOMPtr<nsISVGPoint> point =
-    new DOMSVGPoint(path->ComputePointAtLength(distance));
-  return point.forget();
-}
-
 uint32_t
 SVGPathElement::GetPathSegAtLength(float distance)
 {
@@ -284,12 +241,6 @@ SVGPathElement::HasValidDimensions() const
   return !mD.GetAnimValue().IsEmpty();
 }
 
-nsSVGElement::NumberAttributesInfo
-SVGPathElement::GetNumberInfo()
-{
-  return NumberAttributesInfo(&mPathLength, &sNumberInfo, 1);
-}
-
 //----------------------------------------------------------------------
 // nsIContent methods
 
@@ -311,7 +262,7 @@ SVGPathElement::GetOrBuildPathForMeasuring()
 }
 
 //----------------------------------------------------------------------
-// nsSVGPathGeometryElement methods
+// SVGGeometryElement methods
 
 bool
 SVGPathElement::AttributeDefinesGeometry(const nsIAtom *aName)
diff --git a/dom/svg/SVGPathElement.h b/dom/svg/SVGPathElement.h
index c7fc238ce0..af35e46985 100644
--- a/dom/svg/SVGPathElement.h
+++ b/dom/svg/SVGPathElement.h
@@ -8,22 +8,21 @@
 
 #include "mozilla/gfx/2D.h"
 #include "mozilla/RefPtr.h"
-#include "nsSVGNumber2.h"
-#include "nsSVGPathGeometryElement.h"
 #include "SVGAnimatedPathSegList.h"
+#include "SVGGeometryElement.h"
 #include "DOMSVGPathSeg.h"
 
 nsresult NS_NewSVGPathElement(nsIContent **aResult,
                               already_AddRefed<mozilla::dom::NodeInfo>&& aNodeInfo);
 
-typedef nsSVGPathGeometryElement SVGPathElementBase;
-
 namespace mozilla {
 
 class nsISVGPoint;
 
 namespace dom {
 
+typedef SVGGeometryElement SVGPathElementBase;
+
 class SVGPathElement final : public SVGPathElementBase
 {
 friend class nsSVGPathFrame;
@@ -46,7 +45,7 @@ public:
   // nsSVGSVGElement methods:
   virtual bool HasValidDimensions() const override;
 
-  // nsSVGPathGeometryElement methods:
+  // SVGGeometryElement methods:
   virtual bool AttributeDefinesGeometry(const nsIAtom *aName) override;
   virtual bool IsMarkable() override;
   virtual void GetMarkPoints(nsTArray<nsSVGMark> *aMarks) override;
@@ -83,9 +82,6 @@ public:
   float GetPathLengthScale(PathLengthScaleForType aFor);
 
   // WebIDL
-  already_AddRefed<SVGAnimatedNumber> PathLength();
-  float GetTotalLength();
-  already_AddRefed<nsISVGPoint> GetPointAtLength(float distance, ErrorResult& rv);
   uint32_t GetPathSegAtLength(float distance);
   already_AddRefed<DOMSVGPathSegClosePath> CreateSVGPathSegClosePath();
   already_AddRefed<DOMSVGPathSegMovetoAbs> CreateSVGPathSegMovetoAbs(float x, float y);
@@ -121,12 +117,7 @@ public:
 
 protected:
 
-  // nsSVGElement method
-  virtual NumberAttributesInfo GetNumberInfo() override;
-
   SVGAnimatedPathSegList mD;
-  nsSVGNumber2 mPathLength;
-  static NumberInfo sNumberInfo;
 };
 
 } // namespace dom
diff --git a/dom/svg/nsSVGPolyElement.cpp b/dom/svg/SVGPolyElement.cpp
similarity index 75%
rename from dom/svg/nsSVGPolyElement.cpp
rename to dom/svg/SVGPolyElement.cpp
index ec45dcb03c..72e3b0be8a 100644
--- a/dom/svg/nsSVGPolyElement.cpp
+++ b/dom/svg/SVGPolyElement.cpp
@@ -3,7 +3,7 @@
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
-#include "nsSVGPolyElement.h"
+#include "SVGPolyElement.h"
 #include "DOMSVGPointList.h"
 #include "mozilla/gfx/2D.h"
 #include "SVGContentUtils.h"
@@ -14,26 +14,26 @@ using namespace mozilla::gfx;
 //----------------------------------------------------------------------
 // nsISupports methods
 
-NS_IMPL_ADDREF_INHERITED(nsSVGPolyElement,nsSVGPolyElementBase)
-NS_IMPL_RELEASE_INHERITED(nsSVGPolyElement,nsSVGPolyElementBase)
+NS_IMPL_ADDREF_INHERITED(SVGPolyElement,SVGPolyElementBase)
+NS_IMPL_RELEASE_INHERITED(SVGPolyElement,SVGPolyElementBase)
 
-NS_INTERFACE_MAP_BEGIN(nsSVGPolyElement)
-NS_INTERFACE_MAP_END_INHERITING(nsSVGPolyElementBase)
+NS_INTERFACE_MAP_BEGIN(SVGPolyElement)
+NS_INTERFACE_MAP_END_INHERITING(SVGPolyElementBase)
 
 //----------------------------------------------------------------------
 // Implementation
 
-nsSVGPolyElement::nsSVGPolyElement(already_AddRefed<mozilla::dom::NodeInfo>& aNodeInfo)
-  : nsSVGPolyElementBase(aNodeInfo)
+SVGPolyElement::SVGPolyElement(already_AddRefed<mozilla::dom::NodeInfo>& aNodeInfo)
+  : SVGPolyElementBase(aNodeInfo)
 {
 }
 
-nsSVGPolyElement::~nsSVGPolyElement()
+SVGPolyElement::~SVGPolyElement()
 {
 }
 
 already_AddRefed<DOMSVGPointList>
-nsSVGPolyElement::Points()
+SVGPolyElement::Points()
 {
   void *key = mPoints.GetBaseValKey();
   RefPtr<DOMSVGPointList> points = DOMSVGPointList::GetDOMWrapper(key, this, false);
@@ -41,7 +41,7 @@ nsSVGPolyElement::Points()
 }
 
 already_AddRefed<DOMSVGPointList>
-nsSVGPolyElement::AnimatedPoints()
+SVGPolyElement::AnimatedPoints()
 {
   void *key = mPoints.GetAnimValKey();
   RefPtr<DOMSVGPointList> points = DOMSVGPointList::GetDOMWrapper(key, this, true);
@@ -53,30 +53,30 @@ nsSVGPolyElement::AnimatedPoints()
 // nsIContent methods
 
 NS_IMETHODIMP_(bool)
-nsSVGPolyElement::IsAttributeMapped(const nsIAtom* name) const
+SVGPolyElement::IsAttributeMapped(const nsIAtom* name) const
 {
   static const MappedAttributeEntry* const map[] = {
     sMarkersMap
   };
   
   return FindAttributeDependence(name, map) ||
-    nsSVGPolyElementBase::IsAttributeMapped(name);
+    SVGPolyElementBase::IsAttributeMapped(name);
 }
 
 //----------------------------------------------------------------------
 // nsSVGElement methods
 
 /* virtual */ bool
-nsSVGPolyElement::HasValidDimensions() const
+SVGPolyElement::HasValidDimensions() const
 {
   return !mPoints.GetAnimValue().IsEmpty();
 }
 
 //----------------------------------------------------------------------
-// nsSVGPathGeometryElement methods
+// SVGGeometryElement methods
 
 bool
-nsSVGPolyElement::AttributeDefinesGeometry(const nsIAtom *aName)
+SVGPolyElement::AttributeDefinesGeometry(const nsIAtom *aName)
 {
   if (aName == nsGkAtoms::points)
     return true;
@@ -85,7 +85,7 @@ nsSVGPolyElement::AttributeDefinesGeometry(const nsIAtom *aName)
 }
 
 void
-nsSVGPolyElement::GetMarkPoints(nsTArray<nsSVGMark> *aMarks)
+SVGPolyElement::GetMarkPoints(nsTArray<nsSVGMark> *aMarks)
 {
   const SVGPointList &points = mPoints.GetAnimValue();
 
@@ -121,10 +121,10 @@ nsSVGPolyElement::GetMarkPoints(nsTArray<nsSVGMark> *aMarks)
 }
 
 bool
-nsSVGPolyElement::GetGeometryBounds(Rect* aBounds,
-                                    const StrokeOptions& aStrokeOptions,
-                                    const Matrix& aToBoundsSpace,
-                                    const Matrix* aToNonScalingStrokeSpace)
+SVGPolyElement::GetGeometryBounds(Rect* aBounds,
+                                  const StrokeOptions& aStrokeOptions,
+                                  const Matrix& aToBoundsSpace,
+                                  const Matrix* aToNonScalingStrokeSpace)
 {
   const SVGPointList &points = mPoints.GetAnimValue();
 
diff --git a/dom/svg/nsSVGPolyElement.h b/dom/svg/SVGPolyElement.h
similarity index 78%
rename from dom/svg/nsSVGPolyElement.h
rename to dom/svg/SVGPolyElement.h
index 69c3fac5f8..5097340ed7 100644
--- a/dom/svg/nsSVGPolyElement.h
+++ b/dom/svg/SVGPolyElement.h
@@ -3,25 +3,26 @@
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
-#ifndef NS_SVGPOLYELEMENT_H_
-#define NS_SVGPOLYELEMENT_H_
+#ifndef __SVGPOLYELEMENT_H_
+#define __SVGPOLYELEMENT_H_
 
 #include "mozilla/Attributes.h"
-#include "nsSVGPathGeometryElement.h"
 #include "SVGAnimatedPointList.h"
-
-typedef nsSVGPathGeometryElement nsSVGPolyElementBase;
+#include "SVGGeometryElement.h"
 
 namespace mozilla {
 class DOMSVGPointList;
-} // namespace mozilla
 
-class nsSVGPolyElement : public nsSVGPolyElementBase
+namespace dom {
+
+typedef SVGGeometryElement SVGPolyElementBase;
+
+class SVGPolyElement : public SVGPolyElementBase
 {
 protected:
-  explicit nsSVGPolyElement(already_AddRefed<mozilla::dom::NodeInfo>& aNodeInfo);
+  explicit SVGPolyElement(already_AddRefed<mozilla::dom::NodeInfo>& aNodeInfo);
 
-  virtual ~nsSVGPolyElement();
+  virtual ~SVGPolyElement();
 
 public:
   //interfaces
@@ -41,7 +42,7 @@ public:
   // nsSVGElement methods:
   virtual bool HasValidDimensions() const override;
 
-  // nsSVGPathGeometryElement methods:
+  // SVGGeometryElement methods:
   virtual bool AttributeDefinesGeometry(const nsIAtom *aName) override;
   virtual bool IsMarkable() override { return true; }
   virtual void GetMarkPoints(nsTArray<nsSVGMark> *aMarks) override;
@@ -57,4 +58,7 @@ protected:
   SVGAnimatedPointList mPoints;
 };
 
-#endif //NS_SVGPOLYELEMENT_H_
+} // namespace dom
+} // namespace mozilla
+
+#endif //__SVGPOLYELEMENT_H_
diff --git a/dom/svg/SVGPolygonElement.cpp b/dom/svg/SVGPolygonElement.cpp
index 62c769edc7..e4259e0e7e 100644
--- a/dom/svg/SVGPolygonElement.cpp
+++ b/dom/svg/SVGPolygonElement.cpp
@@ -36,12 +36,12 @@ SVGPolygonElement::SVGPolygonElement(already_AddRefed<mozilla::dom::NodeInfo>& a
 NS_IMPL_ELEMENT_CLONE_WITH_INIT(SVGPolygonElement)
 
 //----------------------------------------------------------------------
-// nsSVGPathGeometryElement methods
+// SVGGeometryElement methods
 
 void
 SVGPolygonElement::GetMarkPoints(nsTArray<nsSVGMark> *aMarks)
 {
-  nsSVGPolyElement::GetMarkPoints(aMarks);
+  SVGPolyElement::GetMarkPoints(aMarks);
 
   if (aMarks->IsEmpty() || aMarks->LastElement().type != nsSVGMark::eEnd) {
     return;
@@ -55,7 +55,7 @@ SVGPolygonElement::GetMarkPoints(nsTArray<nsSVGMark> *aMarks)
   endMark->angle = SVGContentUtils::AngleBisect(angle, endMark->angle);
   startMark->angle = SVGContentUtils::AngleBisect(angle, startMark->angle);
   // for a polygon (as opposed to a polyline) there's an implicit extra point
-  // co-located with the start point that nsSVGPolyElement::GetMarkPoints
+  // co-located with the start point that SVGPolyElement::GetMarkPoints
   // doesn't return
   aMarks->AppendElement(nsSVGMark(startMark->x, startMark->y, startMark->angle,
                                   nsSVGMark::eEnd));
diff --git a/dom/svg/SVGPolygonElement.h b/dom/svg/SVGPolygonElement.h
index f2d68f1d95..e0bff964e6 100644
--- a/dom/svg/SVGPolygonElement.h
+++ b/dom/svg/SVGPolygonElement.h
@@ -7,16 +7,16 @@
 #define mozilla_dom_SVGPolygonElement_h
 
 #include "mozilla/Attributes.h"
-#include "nsSVGPolyElement.h"
+#include "SVGPolyElement.h"
 
 nsresult NS_NewSVGPolygonElement(nsIContent **aResult,
                                  already_AddRefed<mozilla::dom::NodeInfo>&& aNodeInfo);
 
-typedef nsSVGPolyElement SVGPolygonElementBase;
-
 namespace mozilla {
 namespace dom {
 
+typedef SVGPolyElement SVGPolygonElementBase;
+
 class SVGPolygonElement final : public SVGPolygonElementBase
 {
 protected:
@@ -26,7 +26,7 @@ protected:
                                              already_AddRefed<mozilla::dom::NodeInfo>&& aNodeInfo));
 
 public:
-  // nsSVGPathGeometryElement methods:
+  // SVGGeometryElement methods:
   virtual void GetMarkPoints(nsTArray<nsSVGMark> *aMarks) override;
   virtual already_AddRefed<Path> BuildPath(PathBuilder* aBuilder) override;
 
diff --git a/dom/svg/SVGPolylineElement.cpp b/dom/svg/SVGPolylineElement.cpp
index 4c339216df..6de551306e 100644
--- a/dom/svg/SVGPolylineElement.cpp
+++ b/dom/svg/SVGPolylineElement.cpp
@@ -35,7 +35,7 @@ SVGPolylineElement::SVGPolylineElement(already_AddRefed<mozilla::dom::NodeInfo>&
 NS_IMPL_ELEMENT_CLONE_WITH_INIT(SVGPolylineElement)
 
 //----------------------------------------------------------------------
-// nsSVGPathGeometryElement methods
+// SVGGeometryElement methods
 
 already_AddRefed<Path>
 SVGPolylineElement::BuildPath(PathBuilder* aBuilder)
diff --git a/dom/svg/SVGPolylineElement.h b/dom/svg/SVGPolylineElement.h
index cf223fd74f..e0b2dcd279 100644
--- a/dom/svg/SVGPolylineElement.h
+++ b/dom/svg/SVGPolylineElement.h
@@ -6,16 +6,16 @@
 #ifndef mozilla_dom_SVGPolylineElement_h
 #define mozilla_dom_SVGPolylineElement_h
 
-#include "nsSVGPolyElement.h"
+#include "SVGPolyElement.h"
 
 nsresult NS_NewSVGPolylineElement(nsIContent **aResult,
                                   already_AddRefed<mozilla::dom::NodeInfo>&& aNodeInfo);
 
-typedef nsSVGPolyElement SVGPolylineElementBase;
-
 namespace mozilla {
 namespace dom {
 
+typedef SVGPolyElement SVGPolylineElementBase;
+
 class SVGPolylineElement final : public SVGPolylineElementBase
 {
 protected:
@@ -24,7 +24,7 @@ protected:
   friend nsresult (::NS_NewSVGPolylineElement(nsIContent **aResult,
                                               already_AddRefed<mozilla::dom::NodeInfo>&& aNodeInfo));
 
-  // nsSVGPathGeometryElement methods:
+  // SVGGeometryElement methods:
   virtual already_AddRefed<Path> BuildPath(PathBuilder* aBuilder) override;
 
 public:
diff --git a/dom/svg/SVGRectElement.cpp b/dom/svg/SVGRectElement.cpp
index d201311a5b..2f706a3237 100644
--- a/dom/svg/SVGRectElement.cpp
+++ b/dom/svg/SVGRectElement.cpp
@@ -108,7 +108,7 @@ SVGRectElement::GetLengthInfo()
 }
 
 //----------------------------------------------------------------------
-// nsSVGPathGeometryElement methods
+// SVGGeometryElement methods
 
 bool
 SVGRectElement::GetGeometryBounds(Rect* aBounds,
diff --git a/dom/svg/SVGRectElement.h b/dom/svg/SVGRectElement.h
index 847a1504a8..9cbe8e6180 100644
--- a/dom/svg/SVGRectElement.h
+++ b/dom/svg/SVGRectElement.h
@@ -6,17 +6,17 @@
 #ifndef mozilla_dom_SVGRectElement_h
 #define mozilla_dom_SVGRectElement_h
 
-#include "nsSVGPathGeometryElement.h"
 #include "nsSVGLength2.h"
+#include "SVGGeometryElement.h"
 
 nsresult NS_NewSVGRectElement(nsIContent **aResult,
                               already_AddRefed<mozilla::dom::NodeInfo>&& aNodeInfo);
 
-typedef nsSVGPathGeometryElement SVGRectElementBase;
-
 namespace mozilla {
 namespace dom {
 
+typedef SVGGeometryElement SVGRectElementBase;
+
 class SVGRectElement final : public SVGRectElementBase
 {
 protected:
@@ -29,7 +29,7 @@ public:
   // nsSVGSVGElement methods:
   virtual bool HasValidDimensions() const override;
 
-  // nsSVGPathGeometryElement methods:
+  // SVGGeometryElement methods:
   virtual bool GetGeometryBounds(Rect* aBounds, const StrokeOptions& aStrokeOptions,
                                  const Matrix& aToBoundsSpace,
                                  const Matrix* aToNonScalingStrokeSpace = nullptr) override;
diff --git a/dom/svg/moz.build b/dom/svg/moz.build
index 3af1b8094c..90b7156315 100644
--- a/dom/svg/moz.build
+++ b/dom/svg/moz.build
@@ -65,6 +65,7 @@ EXPORTS.mozilla.dom += [
     'SVGFilterElement.h',
     'SVGForeignObjectElement.h',
     'SVGGElement.h',
+    'SVGGeometryElement.h',
     'SVGGradientElement.h',
     'SVGGraphicsElement.h',
     'SVGImageElement.h',
@@ -131,8 +132,6 @@ UNIFIED_SOURCES += [
     'nsSVGNumber2.cpp',
     'nsSVGNumberPair.cpp',
     'nsSVGPathDataParser.cpp',
-    'nsSVGPathGeometryElement.cpp',
-    'nsSVGPolyElement.cpp',
     'nsSVGString.cpp',
     'nsSVGTransform.cpp',
     'nsSVGViewBox.cpp',
@@ -190,6 +189,7 @@ UNIFIED_SOURCES += [
     'SVGForeignObjectElement.cpp',
     'SVGFragmentIdentifier.cpp',
     'SVGGElement.cpp',
+    'SVGGeometryElement.cpp',
     'SVGGradientElement.cpp',
     'SVGGraphicsElement.cpp',
     'SVGImageElement.cpp',
@@ -218,6 +218,7 @@ UNIFIED_SOURCES += [
     'SVGPatternElement.cpp',
     'SVGPointList.cpp',
     'SVGPointListSMILType.cpp',
+    'SVGPolyElement.cpp',
     'SVGPolygonElement.cpp',
     'SVGPolylineElement.cpp',
     'SVGPreserveAspectRatio.cpp',
diff --git a/dom/svg/nsSVGElement.cpp b/dom/svg/nsSVGElement.cpp
index 77dbcb939d..94cce45bd3 100644
--- a/dom/svg/nsSVGElement.cpp
+++ b/dom/svg/nsSVGElement.cpp
@@ -15,7 +15,6 @@
 #include "nsICSSDeclaration.h"
 #include "nsIDocument.h"
 #include "nsIDOMMutationEvent.h"
-#include "nsSVGPathGeometryElement.h"
 #include "mozilla/InternalMutationEvent.h"
 #include "mozAutoDocUpdate.h"
 #include "nsError.h"
@@ -45,6 +44,7 @@
 #include "SVGAnimatedPointList.h"
 #include "SVGAnimatedPathSegList.h"
 #include "SVGContentUtils.h"
+#include "SVGGeometryElement.h"
 #include "nsIFrame.h"
 #include "nsQueryObject.h"
 #include <stdarg.h>
diff --git a/dom/tests/mochitest/general/test_interfaces.html b/dom/tests/mochitest/general/test_interfaces.html
index 77993a1aff..03101b888c 100644
--- a/dom/tests/mochitest/general/test_interfaces.html
+++ b/dom/tests/mochitest/general/test_interfaces.html
@@ -992,6 +992,8 @@ var interfaceNamesInGlobalScope =
     "SVGForeignObjectElement",
 // IMPORTANT: Do not change this list without review from a DOM peer!
     "SVGGElement",
+// IMPORTANT: Do not change this list without review from a DOM peer!
+    "SVGGeometryElement",
 // IMPORTANT: Do not change this list without review from a DOM peer!
     "SVGGradientElement",
 // IMPORTANT: Do not change this list without review from a DOM peer!
diff --git a/dom/webidl/SVGGeometryElement.webidl b/dom/webidl/SVGGeometryElement.webidl
new file mode 100644
index 0000000000..28029794c6
--- /dev/null
+++ b/dom/webidl/SVGGeometryElement.webidl
@@ -0,0 +1,20 @@
+/* -*- Mode: IDL; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this file,
+ * You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * The origin of this IDL file is
+ * http://www.w3.org/TR/SVG2/
+ *
+ * Copyright © 2012 W3C® (MIT, ERCIM, Keio), All Rights Reserved. W3C
+ * liability, trademark and document use rules apply.
+ */
+
+interface SVGGeometryElement : SVGGraphicsElement {
+  [SameObject]
+  readonly attribute SVGAnimatedNumber pathLength;
+
+  float getTotalLength();
+  [NewObject, Throws]
+  SVGPoint getPointAtLength(float distance);
+};
diff --git a/dom/webidl/SVGPathElement.webidl b/dom/webidl/SVGPathElement.webidl
index 08a9904ec2..9732d3cfe8 100644
--- a/dom/webidl/SVGPathElement.webidl
+++ b/dom/webidl/SVGPathElement.webidl
@@ -9,14 +9,8 @@
  * Copyright © 2012 W3C® (MIT, ERCIM, Keio), All Rights Reserved. W3C
  * liability, trademark and document use rules apply.
  */
-interface SVGPathElement : SVGGraphicsElement {
+interface SVGPathElement : SVGGeometryElement {
 
-  [Constant]
-  readonly attribute SVGAnimatedNumber pathLength;
-
-  float getTotalLength();
-  [NewObject, Throws]
-  SVGPoint getPointAtLength(float distance);
   unsigned long getPathSegAtLength(float distance);
   [NewObject]
   SVGPathSegClosePath createSVGPathSegClosePath();
diff --git a/dom/webidl/moz.build b/dom/webidl/moz.build
index 428d242151..5e3c8f8c1e 100644
--- a/dom/webidl/moz.build
+++ b/dom/webidl/moz.build
@@ -470,6 +470,7 @@ WEBIDL_FILES = [
     'SVGFitToViewBox.webidl',
     'SVGForeignObjectElement.webidl',
     'SVGGElement.webidl',
+    'SVGGeometryElement.webidl',
     'SVGGradientElement.webidl',
     'SVGGraphicsElement.webidl',
     'SVGImageElement.webidl',
diff --git a/layout/base/nsCSSFrameConstructor.cpp b/layout/base/nsCSSFrameConstructor.cpp
index fdeb9f35b9..978727e09c 100644
--- a/layout/base/nsCSSFrameConstructor.cpp
+++ b/layout/base/nsCSSFrameConstructor.cpp
@@ -134,7 +134,7 @@ NS_NewSVGOuterSVGAnonChildFrame(nsIPresShell* aPresShell, nsStyleContext* aConte
 nsIFrame*
 NS_NewSVGInnerSVGFrame(nsIPresShell* aPresShell, nsStyleContext* aContext);
 nsIFrame*
-NS_NewSVGPathGeometryFrame(nsIPresShell* aPresShell, nsStyleContext* aContext);
+NS_NewSVGGeometryFrame(nsIPresShell* aPresShell, nsStyleContext* aContext);
 nsIFrame*
 NS_NewSVGGFrame(nsIPresShell* aPresShell, nsStyleContext* aContext);
 nsIFrame*
@@ -5482,13 +5482,13 @@ nsCSSFrameConstructor::FindSVGData(Element* aElement,
     SIMPLE_SVG_CREATE(svg, NS_NewSVGInnerSVGFrame),
     SIMPLE_SVG_CREATE(g, NS_NewSVGGFrame),
     SIMPLE_SVG_CREATE(svgSwitch, NS_NewSVGSwitchFrame),
-    SIMPLE_SVG_CREATE(polygon, NS_NewSVGPathGeometryFrame),
-    SIMPLE_SVG_CREATE(polyline, NS_NewSVGPathGeometryFrame),
-    SIMPLE_SVG_CREATE(circle, NS_NewSVGPathGeometryFrame),
-    SIMPLE_SVG_CREATE(ellipse, NS_NewSVGPathGeometryFrame),
-    SIMPLE_SVG_CREATE(line, NS_NewSVGPathGeometryFrame),
-    SIMPLE_SVG_CREATE(rect, NS_NewSVGPathGeometryFrame),
-    SIMPLE_SVG_CREATE(path, NS_NewSVGPathGeometryFrame),
+    SIMPLE_SVG_CREATE(polygon, NS_NewSVGGeometryFrame),
+    SIMPLE_SVG_CREATE(polyline, NS_NewSVGGeometryFrame),
+    SIMPLE_SVG_CREATE(circle, NS_NewSVGGeometryFrame),
+    SIMPLE_SVG_CREATE(ellipse, NS_NewSVGGeometryFrame),
+    SIMPLE_SVG_CREATE(line, NS_NewSVGGeometryFrame),
+    SIMPLE_SVG_CREATE(rect, NS_NewSVGGeometryFrame),
+    SIMPLE_SVG_CREATE(path, NS_NewSVGGeometryFrame),
     SIMPLE_SVG_CREATE(defs, NS_NewSVGContainerFrame),
     SIMPLE_SVG_CREATE(generic_, NS_NewSVGGenericContainerFrame),
     { &nsGkAtoms::foreignObject,
diff --git a/layout/base/nsDisplayItemTypesList.h b/layout/base/nsDisplayItemTypesList.h
index cf809817ff..71036dd05c 100644
--- a/layout/base/nsDisplayItemTypesList.h
+++ b/layout/base/nsDisplayItemTypesList.h
@@ -52,7 +52,7 @@ DECLARE_DISPLAY_ITEM_TYPE(SUBDOCUMENT)
 DECLARE_DISPLAY_ITEM_TYPE(MASK)
 DECLARE_DISPLAY_ITEM_TYPE(FILTER)
 DECLARE_DISPLAY_ITEM_TYPE(SVG_OUTER_SVG)
-DECLARE_DISPLAY_ITEM_TYPE(SVG_PATH_GEOMETRY)
+DECLARE_DISPLAY_ITEM_TYPE(SVG_GEOMETRY)
 DECLARE_DISPLAY_ITEM_TYPE(SVG_TEXT)
 DECLARE_DISPLAY_ITEM_TYPE(TABLE_CELL_BACKGROUND)
 DECLARE_DISPLAY_ITEM_TYPE(TABLE_CELL_SELECTION)
diff --git a/layout/generic/nsFrameIdList.h b/layout/generic/nsFrameIdList.h
index 6be4309b81..1c22d7ea7f 100644
--- a/layout/generic/nsFrameIdList.h
+++ b/layout/generic/nsFrameIdList.h
@@ -153,7 +153,7 @@ FRAME_ID(nsSVGMaskFrame)
 FRAME_ID(nsSVGOuterSVGFrame)
 FRAME_ID(nsSVGOuterSVGAnonChildFrame)
 FRAME_ID(nsSVGPaintServerFrame)
-FRAME_ID(nsSVGPathGeometryFrame)
+FRAME_ID(SVGGeometryFrame)
 FRAME_ID(nsSVGPatternFrame)
 FRAME_ID(nsSVGRadialGradientFrame)
 FRAME_ID(nsSVGStopFrame)
diff --git a/layout/style/nsStyleStruct.cpp b/layout/style/nsStyleStruct.cpp
index 9de0f13c00..334a6e99a8 100644
--- a/layout/style/nsStyleStruct.cpp
+++ b/layout/style/nsStyleStruct.cpp
@@ -929,7 +929,7 @@ nsStyleSVG::CalcDifference(const nsStyleSVG& aNewData) const
   if (!DefinitelyEqualURIs(mMarkerEnd, aNewData.mMarkerEnd) ||
       !DefinitelyEqualURIs(mMarkerMid, aNewData.mMarkerMid) ||
       !DefinitelyEqualURIs(mMarkerStart, aNewData.mMarkerStart)) {
-    // Markers currently contribute to nsSVGPathGeometryFrame::mRect,
+    // Markers currently contribute to SVGGeometryFrame::mRect,
     // so we need a reflow as well as a repaint. No intrinsic sizes need
     // to change, so nsChangeHint_NeedReflow is sufficient.
     return nsChangeHint_UpdateEffects |
@@ -950,7 +950,7 @@ nsStyleSVG::CalcDifference(const nsStyleSVG& aNewData) const
       // stroke (in which case whether we have fill or not is significant to frame
       // bounds) and whether we have fill or not just changed. In either case we
       // need to reflow so the frame rect is updated.
-      // XXXperf this is a waste on non nsSVGPathGeometryFrames.
+      // XXXperf this is a waste on non SVGGeometryFrames.
       hint |= nsChangeHint_NeedReflow |
               nsChangeHint_NeedDirtyReflow; // XXX remove me: bug 876085
     }
@@ -960,10 +960,10 @@ nsStyleSVG::CalcDifference(const nsStyleSVG& aNewData) const
     }
   }
 
-  // Stroke currently contributes to nsSVGPathGeometryFrame::mRect, so
+  // Stroke currently contributes to SVGGeometryFrame::mRect, so
   // we need a reflow here. No intrinsic sizes need to change, so
   // nsChangeHint_NeedReflow is sufficient.
-  // Note that stroke-dashoffset does not affect nsSVGPathGeometryFrame::mRect.
+  // Note that stroke-dashoffset does not affect SVGGeometryFrame::mRect.
   // text-anchor changes also require a reflow since it changes frames' rects.
   if (mStrokeWidth           != aNewData.mStrokeWidth           ||
       mStrokeMiterlimit      != aNewData.mStrokeMiterlimit      ||
@@ -1189,9 +1189,9 @@ nsStyleSVGReset::CalcDifference(const nsStyleSVGReset& aNewData) const
     // XXXjwatt: why NS_STYLE_HINT_REFLOW? Isn't that excessive?
     hint |= NS_STYLE_HINT_REFLOW;
   } else if (mVectorEffect  != aNewData.mVectorEffect) {
-    // Stroke currently affects nsSVGPathGeometryFrame::mRect, and
+    // Stroke currently affects SVGGeometryFrame::mRect, and
     // vector-effect affect stroke. As a result we need to reflow if
-    // vector-effect changes in order to have nsSVGPathGeometryFrame::
+    // vector-effect changes in order to have SVGGeometryFrame::
     // ReflowSVG called to update its mRect. No intrinsic sizes need
     // to change so nsChangeHint_NeedReflow is sufficient.
     hint |= nsChangeHint_NeedReflow |
@@ -3962,8 +3962,8 @@ nsStyleUserInterface::CalcDifference(const nsStyleUserInterface& aNewData) const
   }
 
   if (mPointerEvents != aNewData.mPointerEvents) {
-    // nsSVGPathGeometryFrame's mRect depends on stroke _and_ on the value
-    // of pointer-events. See nsSVGPathGeometryFrame::ReflowSVG's use of
+    // SVGGeometryFrame's mRect depends on stroke _and_ on the value
+    // of pointer-events. See SVGGeometryFrame::ReflowSVG's use of
     // GetHitTestFlags. (Only a reflow, no visual change.)
     hint |= nsChangeHint_NeedReflow |
             nsChangeHint_NeedDirtyReflow; // XXX remove me: bug 876085
diff --git a/layout/svg/nsSVGPathGeometryFrame.cpp b/layout/svg/SVGGeometryFrame.cpp
similarity index 87%
rename from layout/svg/nsSVGPathGeometryFrame.cpp
rename to layout/svg/SVGGeometryFrame.cpp
index 50eec2b922..ad1d0e2fc4 100644
--- a/layout/svg/nsSVGPathGeometryFrame.cpp
+++ b/layout/svg/SVGGeometryFrame.cpp
@@ -4,7 +4,7 @@
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 // Main header first:
-#include "nsSVGPathGeometryFrame.h"
+#include "SVGGeometryFrame.h"
 
 // Keep others in (case-insensitive) order:
 #include "gfx2DGlue.h"
@@ -22,7 +22,7 @@
 #include "nsSVGEffects.h"
 #include "nsSVGIntegrationUtils.h"
 #include "nsSVGMarkerFrame.h"
-#include "nsSVGPathGeometryElement.h"
+#include "SVGGeometryElement.h"
 #include "nsSVGUtils.h"
 #include "mozilla/ArrayUtils.h"
 #include "SVGAnimatedTransformList.h"
@@ -37,41 +37,41 @@ using namespace mozilla::image;
 // Implementation
 
 nsIFrame*
-NS_NewSVGPathGeometryFrame(nsIPresShell* aPresShell,
-                           nsStyleContext* aContext)
+NS_NewSVGGeometryFrame(nsIPresShell* aPresShell,
+                       nsStyleContext* aContext)
 {
-  return new (aPresShell) nsSVGPathGeometryFrame(aContext);
+  return new (aPresShell) SVGGeometryFrame(aContext);
 }
 
-NS_IMPL_FRAMEARENA_HELPERS(nsSVGPathGeometryFrame)
+NS_IMPL_FRAMEARENA_HELPERS(SVGGeometryFrame)
 
 //----------------------------------------------------------------------
 // nsQueryFrame methods
 
-NS_QUERYFRAME_HEAD(nsSVGPathGeometryFrame)
+NS_QUERYFRAME_HEAD(SVGGeometryFrame)
   NS_QUERYFRAME_ENTRY(nsISVGChildFrame)
-  NS_QUERYFRAME_ENTRY(nsSVGPathGeometryFrame)
+  NS_QUERYFRAME_ENTRY(SVGGeometryFrame)
 NS_QUERYFRAME_TAIL_INHERITING(nsFrame)
 
 //----------------------------------------------------------------------
 // Display list item:
 
-class nsDisplaySVGPathGeometry : public nsDisplayItem {
+class nsDisplaySVGGeometry : public nsDisplayItem {
 public:
-  nsDisplaySVGPathGeometry(nsDisplayListBuilder* aBuilder,
-                           nsSVGPathGeometryFrame* aFrame)
+  nsDisplaySVGGeometry(nsDisplayListBuilder* aBuilder,
+                       SVGGeometryFrame* aFrame)
     : nsDisplayItem(aBuilder, aFrame)
   {
-    MOZ_COUNT_CTOR(nsDisplaySVGPathGeometry);
+    MOZ_COUNT_CTOR(nsDisplaySVGGeometry);
     MOZ_ASSERT(aFrame, "Must have a frame!");
   }
 #ifdef NS_BUILD_REFCNT_LOGGING
-  virtual ~nsDisplaySVGPathGeometry() {
-    MOZ_COUNT_DTOR(nsDisplaySVGPathGeometry);
+  virtual ~nsDisplaySVGGeometry() {
+    MOZ_COUNT_DTOR(nsDisplaySVGGeometry);
   }
 #endif
 
-  NS_DISPLAY_DECL_NAME("nsDisplaySVGPathGeometry", TYPE_SVG_PATH_GEOMETRY)
+  NS_DISPLAY_DECL_NAME("nsDisplaySVGGeometry", TYPE_SVG_GEOMETRY)
 
   virtual void HitTest(nsDisplayListBuilder* aBuilder, const nsRect& aRect,
                        HitTestState* aState, nsTArray<nsIFrame*> *aOutFrames) override;
@@ -89,10 +89,10 @@ public:
 };
 
 void
-nsDisplaySVGPathGeometry::HitTest(nsDisplayListBuilder* aBuilder, const nsRect& aRect,
-                                  HitTestState* aState, nsTArray<nsIFrame*> *aOutFrames)
+nsDisplaySVGGeometry::HitTest(nsDisplayListBuilder* aBuilder, const nsRect& aRect,
+                              HitTestState* aState, nsTArray<nsIFrame*> *aOutFrames)
 {
-  nsSVGPathGeometryFrame *frame = static_cast<nsSVGPathGeometryFrame*>(mFrame);
+  SVGGeometryFrame *frame = static_cast<SVGGeometryFrame*>(mFrame);
   nsPoint pointRelativeToReferenceFrame = aRect.Center();
   // ToReferenceFrame() includes frame->GetPosition(), our user space position.
   nsPoint userSpacePtInAppUnits = pointRelativeToReferenceFrame -
@@ -106,8 +106,8 @@ nsDisplaySVGPathGeometry::HitTest(nsDisplayListBuilder* aBuilder, const nsRect&
 }
 
 void
-nsDisplaySVGPathGeometry::Paint(nsDisplayListBuilder* aBuilder,
-                                nsRenderingContext* aCtx)
+nsDisplaySVGGeometry::Paint(nsDisplayListBuilder* aBuilder,
+                            nsRenderingContext* aCtx)
 {
   uint32_t appUnitsPerDevPixel = mFrame->PresContext()->AppUnitsPerDevPixel();
 
@@ -122,13 +122,13 @@ nsDisplaySVGPathGeometry::Paint(nsDisplayListBuilder* aBuilder,
   gfxMatrix tm = nsSVGIntegrationUtils::GetCSSPxToDevPxMatrix(mFrame) *
                    gfxMatrix::Translation(devPixelOffset);
   DrawResult result =
-    static_cast<nsSVGPathGeometryFrame*>(mFrame)->PaintSVG(*aCtx->ThebesContext(), tm);
+    static_cast<SVGGeometryFrame*>(mFrame)->PaintSVG(*aCtx->ThebesContext(), tm);
 
   nsDisplayItemGenericImageGeometry::UpdateDrawResult(this, result);
 }
 
 void
-nsDisplaySVGPathGeometry::ComputeInvalidationRegion(
+nsDisplaySVGGeometry::ComputeInvalidationRegion(
   nsDisplayListBuilder* aBuilder,
   const nsDisplayItemGeometry* aGeometry,
   nsRegion* aInvalidRegion)
@@ -145,22 +145,24 @@ nsDisplaySVGPathGeometry::ComputeInvalidationRegion(
   nsDisplayItem::ComputeInvalidationRegion(aBuilder, aGeometry, aInvalidRegion);
 }
 
+namespace mozilla {
+
 //----------------------------------------------------------------------
 // nsIFrame methods
 
 void
-nsSVGPathGeometryFrame::Init(nsIContent*       aContent,
-                             nsContainerFrame* aParent,
-                             nsIFrame*         aPrevInFlow)
+SVGGeometryFrame::Init(nsIContent*       aContent,
+                       nsContainerFrame* aParent,
+                       nsIFrame*         aPrevInFlow)
 {
   AddStateBits(aParent->GetStateBits() & NS_STATE_SVG_CLIPPATH_CHILD);
   nsFrame::Init(aContent, aParent, aPrevInFlow);
 }
 
 nsresult
-nsSVGPathGeometryFrame::AttributeChanged(int32_t         aNameSpaceID,
-                                         nsIAtom*        aAttribute,
-                                         int32_t         aModType)
+SVGGeometryFrame::AttributeChanged(int32_t         aNameSpaceID,
+                                   nsIAtom*        aAttribute,
+                                   int32_t         aModType)
 {
   // We don't invalidate for transform changes (the layers code does that).
   // Also note that SVGTransformableElement::GetAttributeChangeHint will
@@ -168,7 +170,7 @@ nsSVGPathGeometryFrame::AttributeChanged(int32_t         aNameSpaceID,
   // and cause DoApplyRenderingChangeToTree to make the SchedulePaint call.
 
   if (aNameSpaceID == kNameSpaceID_None &&
-      (static_cast<nsSVGPathGeometryElement*>
+      (static_cast<SVGGeometryElement*>
                   (mContent)->AttributeDefinesGeometry(aAttribute))) {
     nsLayoutUtils::PostRestyleEvent(
       mContent->AsElement(), nsRestyleHint(0),
@@ -179,7 +181,7 @@ nsSVGPathGeometryFrame::AttributeChanged(int32_t         aNameSpaceID,
 }
 
 /* virtual */ void
-nsSVGPathGeometryFrame::DidSetStyleContext(nsStyleContext* aOldStyleContext)
+SVGGeometryFrame::DidSetStyleContext(nsStyleContext* aOldStyleContext)
 {
   nsFrame::DidSetStyleContext(aOldStyleContext);
 
@@ -193,8 +195,8 @@ nsSVGPathGeometryFrame::DidSetStyleContext(nsStyleContext* aOldStyleContext)
       InvalidateFrame();
     }
 
-    nsSVGPathGeometryElement* element =
-      static_cast<nsSVGPathGeometryElement*>(mContent);
+    SVGGeometryElement* element =
+      static_cast<SVGGeometryElement*>(mContent);
 
     auto oldStyleSVG = aOldStyleContext->PeekStyleSVG();
     if (oldStyleSVG && !SVGContentUtils::ShapeTypeHasNoCorners(mContent)) {
@@ -222,14 +224,14 @@ nsSVGPathGeometryFrame::DidSetStyleContext(nsStyleContext* aOldStyleContext)
 }
 
 nsIAtom *
-nsSVGPathGeometryFrame::GetType() const
+SVGGeometryFrame::GetType() const
 {
-  return nsGkAtoms::svgPathGeometryFrame;
+  return nsGkAtoms::svgGeometryFrame;
 }
 
 bool
-nsSVGPathGeometryFrame::IsSVGTransformed(gfx::Matrix *aOwnTransform,
-                                         gfx::Matrix *aFromParentTransform) const
+SVGGeometryFrame::IsSVGTransformed(gfx::Matrix *aOwnTransform,
+                                   gfx::Matrix *aFromParentTransform) const
 {
   bool foundTransform = false;
 
@@ -258,8 +260,8 @@ nsSVGPathGeometryFrame::IsSVGTransformed(gfx::Matrix *aOwnTransform,
 }
 
 void
-nsSVGPathGeometryFrame::BuildDisplayList(nsDisplayListBuilder*   aBuilder,
-                                         const nsDisplayListSet& aLists)
+SVGGeometryFrame::BuildDisplayList(nsDisplayListBuilder*   aBuilder,
+                                   const nsDisplayListSet& aLists)
 {
   if (!static_cast<const nsSVGElement*>(mContent)->HasValidDimensions() ||
       (!IsVisibleForPainting(aBuilder) && aBuilder->IsForPainting())) {
@@ -267,16 +269,16 @@ nsSVGPathGeometryFrame::BuildDisplayList(nsDisplayListBuilder*   aBuilder,
   }
   DisplayOutline(aBuilder, aLists);
   aLists.Content()->AppendNewToTop(
-    new (aBuilder) nsDisplaySVGPathGeometry(aBuilder, this));
+    new (aBuilder) nsDisplaySVGGeometry(aBuilder, this));
 }
 
 //----------------------------------------------------------------------
 // nsISVGChildFrame methods
 
 DrawResult
-nsSVGPathGeometryFrame::PaintSVG(gfxContext& aContext,
-                                 const gfxMatrix& aTransform,
-                                 const nsIntRect* aDirtyRect)
+SVGGeometryFrame::PaintSVG(gfxContext& aContext,
+                           const gfxMatrix& aTransform,
+                           const nsIntRect* aDirtyRect)
 {
   if (!StyleVisibility()->IsVisible())
     return DrawResult::SUCCESS;
@@ -322,7 +324,7 @@ nsSVGPathGeometryFrame::PaintSVG(gfxContext& aContext,
 }
 
 nsIFrame*
-nsSVGPathGeometryFrame::GetFrameForPoint(const gfxPoint& aPoint)
+SVGGeometryFrame::GetFrameForPoint(const gfxPoint& aPoint)
 {
   FillRule fillRule;
   uint16_t hitTestFlags;
@@ -346,8 +348,8 @@ nsSVGPathGeometryFrame::GetFrameForPoint(const gfxPoint& aPoint)
 
   bool isHit = false;
 
-  nsSVGPathGeometryElement* content =
-    static_cast<nsSVGPathGeometryElement*>(mContent);
+  SVGGeometryElement* content =
+    static_cast<SVGGeometryElement*>(mContent);
 
   // Using ScreenReferenceDrawTarget() opens us to Moz2D backend specific hit-
   // testing bugs. Maybe we should use a BackendType::CAIRO DT for hit-testing
@@ -387,7 +389,7 @@ nsSVGPathGeometryFrame::GetFrameForPoint(const gfxPoint& aPoint)
 }
 
 nsRect
-nsSVGPathGeometryFrame::GetCoveredRegion()
+SVGGeometryFrame::GetCoveredRegion()
 {
   gfxMatrix canvasTM = GetCanvasTM();
   if (canvasTM.PreservesAxisAlignedRectangles()) {
@@ -409,7 +411,7 @@ nsSVGPathGeometryFrame::GetCoveredRegion()
 }
 
 void
-nsSVGPathGeometryFrame::ReflowSVG()
+SVGGeometryFrame::ReflowSVG()
 {
   NS_ASSERTION(nsSVGUtils::OuterSVGIsCallingReflowSVG(this),
                "This call is probably a wasteful mistake");
@@ -463,7 +465,7 @@ nsSVGPathGeometryFrame::ReflowSVG()
 }
 
 void
-nsSVGPathGeometryFrame::NotifySVGChanged(uint32_t aFlags)
+SVGGeometryFrame::NotifySVGChanged(uint32_t aFlags)
 {
   MOZ_ASSERT(aFlags & (TRANSFORM_CHANGED | COORD_CONTEXT_CHANGED),
              "Invalidation logic may need adjusting");
@@ -487,9 +489,9 @@ nsSVGPathGeometryFrame::NotifySVGChanged(uint32_t aFlags)
     // of stroke-dashoffset since, although that can have a percentage value
     // that is resolved against our coordinate context, it does not affect our
     // mRect.
-    if (static_cast<nsSVGPathGeometryElement*>(mContent)->GeometryDependsOnCoordCtx() ||
+    if (static_cast<SVGGeometryElement*>(mContent)->GeometryDependsOnCoordCtx() ||
         StyleSVG()->mStrokeWidth.HasPercent()) {
-      static_cast<nsSVGPathGeometryElement*>(mContent)->ClearAnyCachedPath();
+      static_cast<SVGGeometryElement*>(mContent)->ClearAnyCachedPath();
       nsSVGUtils::ScheduleReflowSVG(this);
     }
   }
@@ -502,8 +504,8 @@ nsSVGPathGeometryFrame::NotifySVGChanged(uint32_t aFlags)
 }
 
 SVGBBox
-nsSVGPathGeometryFrame::GetBBoxContribution(const Matrix &aToBBoxUserspace,
-                                            uint32_t aFlags)
+SVGGeometryFrame::GetBBoxContribution(const Matrix &aToBBoxUserspace,
+                                      uint32_t aFlags)
 {
   SVGBBox bbox;
 
@@ -512,8 +514,8 @@ nsSVGPathGeometryFrame::GetBBoxContribution(const Matrix &aToBBoxUserspace,
     return bbox;
   }
 
-  nsSVGPathGeometryElement* element =
-    static_cast<nsSVGPathGeometryElement*>(mContent);
+  SVGGeometryElement* element =
+    static_cast<SVGGeometryElement*>(mContent);
 
   bool getFill = (aFlags & nsSVGUtils::eBBoxIncludeFillGeometry) ||
                  ((aFlags & nsSVGUtils::eBBoxIncludeFill) &&
@@ -629,7 +631,7 @@ nsSVGPathGeometryFrame::GetBBoxContribution(const Matrix &aToBBoxUserspace,
       //
       // Second, the way we account for non-scaling-stroke by transforming the
       // path using the transform to the outer-<svg> element is not compatible
-      // with the way that nsSVGPathGeometryFrame::Reflow() inserts a scale
+      // with the way that SVGGeometryFrame::Reflow() inserts a scale
       // into aToBBoxUserspace and then scales the bounds that we return.
       SVGContentUtils::AutoStrokeOptions strokeOptions;
       SVGContentUtils::GetStrokeOptions(&strokeOptions, element,
@@ -666,14 +668,14 @@ nsSVGPathGeometryFrame::GetBBoxContribution(const Matrix &aToBBoxUserspace,
 
   // Account for markers:
   if ((aFlags & nsSVGUtils::eBBoxIncludeMarkers) != 0 &&
-      static_cast<nsSVGPathGeometryElement*>(mContent)->IsMarkable()) {
+      static_cast<SVGGeometryElement*>(mContent)->IsMarkable()) {
 
     float strokeWidth = nsSVGUtils::GetStrokeWidth(this);
     MarkerProperties properties = GetMarkerProperties(this);
 
     if (properties.MarkersExist()) {
       nsTArray<nsSVGMark> marks;
-      static_cast<nsSVGPathGeometryElement*>(mContent)->GetMarkPoints(&marks);
+      static_cast<SVGGeometryElement*>(mContent)->GetMarkPoints(&marks);
       uint32_t num = marks.Length();
 
       // These are in the same order as the nsSVGMark::Type constants.
@@ -703,10 +705,10 @@ nsSVGPathGeometryFrame::GetBBoxContribution(const Matrix &aToBBoxUserspace,
 }
 
 //----------------------------------------------------------------------
-// nsSVGPathGeometryFrame methods:
+// SVGGeometryFrame methods:
 
 gfxMatrix
-nsSVGPathGeometryFrame::GetCanvasTM()
+SVGGeometryFrame::GetCanvasTM()
 {
   NS_ASSERTION(GetParent(), "null parent");
 
@@ -716,8 +718,8 @@ nsSVGPathGeometryFrame::GetCanvasTM()
   return content->PrependLocalTransformsTo(parent->GetCanvasTM());
 }
 
-nsSVGPathGeometryFrame::MarkerProperties
-nsSVGPathGeometryFrame::GetMarkerProperties(nsSVGPathGeometryFrame *aFrame)
+SVGGeometryFrame::MarkerProperties
+SVGGeometryFrame::GetMarkerProperties(SVGGeometryFrame *aFrame)
 {
   NS_ASSERTION(!aFrame->GetPrevContinuation(), "aFrame should be first continuation");
 
@@ -741,7 +743,7 @@ nsSVGPathGeometryFrame::GetMarkerProperties(nsSVGPathGeometryFrame *aFrame)
 }
 
 nsSVGMarkerFrame *
-nsSVGPathGeometryFrame::MarkerProperties::GetMarkerStartFrame()
+SVGGeometryFrame::MarkerProperties::GetMarkerStartFrame()
 {
   if (!mMarkerStart)
     return nullptr;
@@ -750,7 +752,7 @@ nsSVGPathGeometryFrame::MarkerProperties::GetMarkerStartFrame()
 }
 
 nsSVGMarkerFrame *
-nsSVGPathGeometryFrame::MarkerProperties::GetMarkerMidFrame()
+SVGGeometryFrame::MarkerProperties::GetMarkerMidFrame()
 {
   if (!mMarkerMid)
     return nullptr;
@@ -759,7 +761,7 @@ nsSVGPathGeometryFrame::MarkerProperties::GetMarkerMidFrame()
 }
 
 nsSVGMarkerFrame *
-nsSVGPathGeometryFrame::MarkerProperties::GetMarkerEndFrame()
+SVGGeometryFrame::MarkerProperties::GetMarkerEndFrame()
 {
   if (!mMarkerEnd)
     return nullptr;
@@ -768,9 +770,9 @@ nsSVGPathGeometryFrame::MarkerProperties::GetMarkerEndFrame()
 }
 
 void
-nsSVGPathGeometryFrame::Render(gfxContext* aContext,
-                               uint32_t aRenderComponents,
-                               const gfxMatrix& aNewTransform)
+SVGGeometryFrame::Render(gfxContext* aContext,
+                         uint32_t aRenderComponents,
+                         const gfxMatrix& aNewTransform)
 {
   MOZ_ASSERT(!aNewTransform.IsSingular());
 
@@ -780,8 +782,8 @@ nsSVGPathGeometryFrame::Render(gfxContext* aContext,
     nsSVGUtils::ToFillRule((GetStateBits() & NS_STATE_SVG_CLIPPATH_CHILD) ?
                              StyleSVG()->mClipRule : StyleSVG()->mFillRule);
 
-  nsSVGPathGeometryElement* element =
-    static_cast<nsSVGPathGeometryElement*>(mContent);
+  SVGGeometryElement* element =
+    static_cast<SVGGeometryElement*>(mContent);
 
   AntialiasMode aaMode =
     (StyleSVG()->mShapeRendering == NS_STYLE_SHAPE_RENDERING_OPTIMIZESPEED ||
@@ -806,7 +808,7 @@ nsSVGPathGeometryFrame::Render(gfxContext* aContext,
     return;
   }
 
-  nsSVGPathGeometryElement::SimplePath simplePath;
+  SVGGeometryElement::SimplePath simplePath;
   RefPtr<Path> path;
 
   element->GetAsSimplePath(&simplePath);
@@ -882,19 +884,19 @@ nsSVGPathGeometryFrame::Render(gfxContext* aContext,
 }
 
 void
-nsSVGPathGeometryFrame::PaintMarkers(gfxContext& aContext,
-                                     const gfxMatrix& aTransform)
+SVGGeometryFrame::PaintMarkers(gfxContext& aContext,
+                               const gfxMatrix& aTransform)
 {
   SVGContextPaint* contextPaint = SVGContextPaint::GetContextPaint(mContent);
 
-  if (static_cast<nsSVGPathGeometryElement*>(mContent)->IsMarkable()) {
+  if (static_cast<SVGGeometryElement*>(mContent)->IsMarkable()) {
     MarkerProperties properties = GetMarkerProperties(this);
 
     if (properties.MarkersExist()) {
       float strokeWidth = nsSVGUtils::GetStrokeWidth(this, contextPaint);
 
       nsTArray<nsSVGMark> marks;
-      static_cast<nsSVGPathGeometryElement*>
+      static_cast<SVGGeometryElement*>
                  (mContent)->GetMarkPoints(&marks);
 
       uint32_t num = marks.Length();
@@ -921,7 +923,8 @@ nsSVGPathGeometryFrame::PaintMarkers(gfxContext& aContext,
 }
 
 uint16_t
-nsSVGPathGeometryFrame::GetHitTestFlags()
+SVGGeometryFrame::GetHitTestFlags()
 {
   return nsSVGUtils::GetGeometryHitTestFlags(this);
 }
+} // namespace mozilla
diff --git a/layout/svg/nsSVGPathGeometryFrame.h b/layout/svg/SVGGeometryFrame.h
similarity index 83%
rename from layout/svg/nsSVGPathGeometryFrame.h
rename to layout/svg/SVGGeometryFrame.h
index d2d63f0439..f0731379f2 100644
--- a/layout/svg/nsSVGPathGeometryFrame.h
+++ b/layout/svg/SVGGeometryFrame.h
@@ -3,8 +3,8 @@
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
-#ifndef __NS_SVGPATHGEOMETRYFRAME_H__
-#define __NS_SVGPATHGEOMETRYFRAME_H__
+#ifndef __SVGGEOMETRYFRAME_H__
+#define __SVGGEOMETRYFRAME_H__
 
 #include "mozilla/Attributes.h"
 #include "gfxMatrix.h"
@@ -16,13 +16,14 @@
 #include "nsSVGUtils.h"
 
 namespace mozilla {
+class SVGGeometryFrame;
 namespace gfx {
 class DrawTarget;
 } // namespace gfx
 } // namespace mozilla
 
 class gfxContext;
-class nsDisplaySVGPathGeometry;
+class nsDisplaySVGGeometry;
 class nsIAtom;
 class nsIFrame;
 class nsIPresShell;
@@ -32,25 +33,30 @@ class nsSVGMarkerProperty;
 
 struct nsRect;
 
-class nsSVGPathGeometryFrame : public nsFrame
-                             , public nsISVGChildFrame
+nsIFrame*
+NS_NewSVGGeometryFrame(nsIPresShell* aPresShell, nsStyleContext* aContext);
+
+namespace mozilla {
+
+class SVGGeometryFrame : public nsFrame
+                       , public nsISVGChildFrame
 {
   typedef mozilla::gfx::DrawTarget DrawTarget;
 
   friend nsIFrame*
-  NS_NewSVGPathGeometryFrame(nsIPresShell* aPresShell, nsStyleContext* aContext);
+  ::NS_NewSVGGeometryFrame(nsIPresShell* aPresShell, nsStyleContext* aContext);
 
-  friend class nsDisplaySVGPathGeometry;
+  friend class ::nsDisplaySVGGeometry;
 
 protected:
-  explicit nsSVGPathGeometryFrame(nsStyleContext* aContext)
+  explicit SVGGeometryFrame(nsStyleContext* aContext)
     : nsFrame(aContext)
   {
      AddStateBits(NS_FRAME_SVG_LAYOUT | NS_FRAME_MAY_BE_TRANSFORMED);
   }
 
 public:
-  NS_DECL_QUERYFRAME_TARGET(nsSVGPathGeometryFrame)
+  NS_DECL_QUERYFRAME_TARGET(SVGGeometryFrame)
   NS_DECL_QUERYFRAME
   NS_DECL_FRAMEARENA_HELPERS
 
@@ -73,7 +79,7 @@ public:
   /**
    * Get the "type" of the frame
    *
-   * @see nsGkAtoms::svgPathGeometryFrame
+   * @see nsGkAtoms::svgGeometryFrame
    */
   virtual nsIAtom* GetType() const override;
 
@@ -83,14 +89,14 @@ public:
 #ifdef DEBUG_FRAME_DUMP
   virtual nsresult GetFrameName(nsAString& aResult) const override
   {
-    return MakeFrameName(NS_LITERAL_STRING("SVGPathGeometry"), aResult);
+    return MakeFrameName(NS_LITERAL_STRING("SVGGeometry"), aResult);
   }
 #endif
 
   virtual void BuildDisplayList(nsDisplayListBuilder*   aBuilder,
                                 const nsDisplayListSet& aLists) override;
 
-  // nsSVGPathGeometryFrame methods
+  // SVGGeometryFrame methods
   gfxMatrix GetCanvasTM();
 protected:
   // nsISVGChildFrame interface:
@@ -140,7 +146,8 @@ private:
   /**
    * @param aFrame should be the first continuation
    */
-  static MarkerProperties GetMarkerProperties(nsSVGPathGeometryFrame *aFrame);
+  static MarkerProperties GetMarkerProperties(SVGGeometryFrame *aFrame);
 };
+} // namespace mozilla
 
-#endif // __NS_SVGPATHGEOMETRYFRAME_H__
+#endif // __SVGGEOMETRYFRAME_H__
diff --git a/layout/svg/moz.build b/layout/svg/moz.build
index b6575862fa..63e15407bd 100644
--- a/layout/svg/moz.build
+++ b/layout/svg/moz.build
@@ -40,7 +40,6 @@ UNIFIED_SOURCES += [
     'nsSVGMarkerFrame.cpp',
     'nsSVGMaskFrame.cpp',
     'nsSVGOuterSVGFrame.cpp',
-    'nsSVGPathGeometryFrame.cpp',
     'nsSVGPatternFrame.cpp',
     'nsSVGStopFrame.cpp',
     'nsSVGSwitchFrame.cpp',
@@ -51,6 +50,7 @@ UNIFIED_SOURCES += [
     'SVGFEImageFrame.cpp',
     'SVGFELeafFrame.cpp',
     'SVGFEUnstyledLeafFrame.cpp',
+    'SVGGeometryFrame.cpp',
     'SVGTextFrame.cpp',
     'SVGViewFrame.cpp',
 ]
diff --git a/layout/svg/nsSVGClipPathFrame.cpp b/layout/svg/nsSVGClipPathFrame.cpp
index a619ac9a4e..68a091fa40 100644
--- a/layout/svg/nsSVGClipPathFrame.cpp
+++ b/layout/svg/nsSVGClipPathFrame.cpp
@@ -11,8 +11,8 @@
 #include "mozilla/dom/SVGClipPathElement.h"
 #include "nsGkAtoms.h"
 #include "nsSVGEffects.h"
-#include "nsSVGPathGeometryElement.h"
-#include "nsSVGPathGeometryFrame.h"
+#include "SVGGeometryElement.h"
+#include "SVGGeometryFrame.h"
 #include "nsSVGUtils.h"
 
 using namespace mozilla;
@@ -54,10 +54,10 @@ nsSVGClipPathFrame::ApplyClipPath(gfxContext& aContext,
   IsTrivial(&singleClipPathChild);
 
   if (singleClipPathChild) {
-    nsSVGPathGeometryFrame* pathFrame = do_QueryFrame(singleClipPathChild);
+    SVGGeometryFrame* pathFrame = do_QueryFrame(singleClipPathChild);
     if (pathFrame) {
-      nsSVGPathGeometryElement* pathElement =
-        static_cast<nsSVGPathGeometryElement*>(pathFrame->GetContent());
+      SVGGeometryElement* pathElement =
+        static_cast<SVGGeometryElement*>(pathFrame->GetContent());
       gfxMatrix toChildsUserSpace = pathElement->
         PrependLocalTransformsTo(GetClipPathTransform(aClippedFrame) * aMatrix,
                                  eUserSpaceToParent);
@@ -214,7 +214,7 @@ nsSVGClipPathFrame::GetClipMask(gfxContext& aReferenceContext,
         }
 
         // Our children have NS_STATE_SVG_CLIPPATH_CHILD set on them, and
-        // nsSVGPathGeometryFrame::Render checks for that state bit and paints
+        // SVGGeometryFrame::Render checks for that state bit and paints
         // only the geometry (opaque black) if set.
         DrawResult result = SVGFrame->PaintSVG(*ctx, toChildsUserSpace);
         if (aResult) {
@@ -394,7 +394,7 @@ nsSVGClipPathFrame::IsValid()
 
         nsIAtom* grandKidType = grandKid->GetType();
 
-        if (grandKidType != nsGkAtoms::svgPathGeometryFrame &&
+        if (grandKidType != nsGkAtoms::svgGeometryFrame &&
             grandKidType != nsGkAtoms::svgTextFrame) {
           return false;
         }
@@ -402,7 +402,7 @@ nsSVGClipPathFrame::IsValid()
       continue;
     }
 
-    if (kidType != nsGkAtoms::svgPathGeometryFrame &&
+    if (kidType != nsGkAtoms::svgGeometryFrame &&
         kidType != nsGkAtoms::svgTextFrame) {
       return false;
     }
diff --git a/layout/svg/nsSVGEffects.cpp b/layout/svg/nsSVGEffects.cpp
index 63fd215190..0fb68ddd1b 100644
--- a/layout/svg/nsSVGEffects.cpp
+++ b/layout/svg/nsSVGEffects.cpp
@@ -12,11 +12,11 @@
 #include "nsISupportsImpl.h"
 #include "nsSVGClipPathFrame.h"
 #include "nsSVGPaintServerFrame.h"
-#include "nsSVGPathGeometryElement.h"
 #include "nsSVGFilterFrame.h"
 #include "nsSVGMaskFrame.h"
 #include "nsIReflowCallback.h"
 #include "nsCycleCollectionParticipant.h"
+#include "SVGGeometryElement.h"
 #include "SVGUseElement.h"
 
 using namespace mozilla;
@@ -523,8 +523,8 @@ nsSVGMarkerProperty*
 nsSVGEffects::GetMarkerProperty(nsIURI* aURI, nsIFrame* aFrame,
   const mozilla::FramePropertyDescriptor<nsSVGMarkerProperty>* aProperty)
 {
-  MOZ_ASSERT(aFrame->GetType() == nsGkAtoms::svgPathGeometryFrame &&
-             static_cast<nsSVGPathGeometryElement*>(aFrame->GetContent())->IsMarkable(),
+  MOZ_ASSERT(aFrame->GetType() == nsGkAtoms::svgGeometryFrame &&
+             static_cast<SVGGeometryElement*>(aFrame->GetContent())->IsMarkable(),
              "Bad frame");
   return GetEffectProperty(aURI, aFrame, aProperty);
 }
@@ -700,8 +700,8 @@ nsSVGEffects::UpdateEffects(nsIFrame* aFrame)
   // We can't do that in DoUpdate as the referenced frame may not be valid
   GetOrCreateFilterProperty(aFrame);
 
-  if (aFrame->GetType() == nsGkAtoms::svgPathGeometryFrame &&
-      static_cast<nsSVGPathGeometryElement*>(aFrame->GetContent())->IsMarkable()) {
+  if (aFrame->GetType() == nsGkAtoms::svgGeometryFrame &&
+      static_cast<SVGGeometryElement*>(aFrame->GetContent())->IsMarkable()) {
     // Set marker properties here to avoid reference loops
     nsCOMPtr<nsIURI> markerURL =
       GetMarkerURI(aFrame, &nsStyleSVG::mMarkerStart);
diff --git a/layout/svg/nsSVGImageFrame.cpp b/layout/svg/nsSVGImageFrame.cpp
index 2d6f75d267..1d05b023db 100644
--- a/layout/svg/nsSVGImageFrame.cpp
+++ b/layout/svg/nsSVGImageFrame.cpp
@@ -13,10 +13,10 @@
 #include "nsLayoutUtils.h"
 #include "imgINotificationObserver.h"
 #include "nsSVGEffects.h"
-#include "nsSVGPathGeometryFrame.h"
 #include "mozilla/dom/SVGSVGElement.h"
 #include "nsSVGUtils.h"
 #include "SVGContentUtils.h"
+#include "SVGGeometryFrame.h"
 #include "SVGImageContext.h"
 #include "mozilla/dom/SVGImageElement.h"
 #include "nsContentUtils.h"
@@ -46,7 +46,7 @@ private:
   nsSVGImageFrame *mFrame;
 };
 
-class nsSVGImageFrame : public nsSVGPathGeometryFrame
+class nsSVGImageFrame : public SVGGeometryFrame
                       , public nsIReflowCallback
 {
   friend nsIFrame*
@@ -54,7 +54,7 @@ class nsSVGImageFrame : public nsSVGPathGeometryFrame
 
 protected:
   explicit nsSVGImageFrame(nsStyleContext* aContext)
-    : nsSVGPathGeometryFrame(aContext)
+    : SVGGeometryFrame(aContext)
     , mReflowCallbackPosted(false)
   {
     EnableVisibilityTracking();
@@ -72,7 +72,7 @@ public:
   virtual nsIFrame* GetFrameForPoint(const gfxPoint& aPoint) override;
   virtual void ReflowSVG() override;
 
-  // nsSVGPathGeometryFrame methods:
+  // SVGGeometryFrame methods:
   virtual uint16_t GetHitTestFlags() override;
 
   // nsIFrame interface:
@@ -154,7 +154,7 @@ nsSVGImageFrame::Init(nsIContent*       aContent,
   NS_ASSERTION(aContent->IsSVGElement(nsGkAtoms::image),
                "Content is not an SVG image!");
 
-  nsSVGPathGeometryFrame::Init(aContent, aParent, aPrevInFlow);
+  SVGGeometryFrame::Init(aContent, aParent, aPrevInFlow);
 
   if (GetStateBits() & NS_FRAME_IS_NONDISPLAY) {
     // Non-display frames are likely to be patterns, masks or the like.
@@ -246,8 +246,8 @@ nsSVGImageFrame::AttributeChanged(int32_t         aNameSpaceID,
     }
   }
 
-  return nsSVGPathGeometryFrame::AttributeChanged(aNameSpaceID,
-                                                  aAttribute, aModType);
+  return SVGGeometryFrame::AttributeChanged(aNameSpaceID,
+                                            aAttribute, aModType);
 }
 
 void
@@ -256,13 +256,13 @@ nsSVGImageFrame::OnVisibilityChange(Visibility aNewVisibility,
 {
   nsCOMPtr<nsIImageLoadingContent> imageLoader = do_QueryInterface(mContent);
   if (!imageLoader) {
-    nsSVGPathGeometryFrame::OnVisibilityChange(aNewVisibility, aNonvisibleAction);
+    SVGGeometryFrame::OnVisibilityChange(aNewVisibility, aNonvisibleAction);
     return;
   }
 
   imageLoader->OnVisibilityChange(aNewVisibility, aNonvisibleAction);
 
-  nsSVGPathGeometryFrame::OnVisibilityChange(aNewVisibility, aNonvisibleAction);
+  SVGGeometryFrame::OnVisibilityChange(aNewVisibility, aNonvisibleAction);
 }
 
 gfx::Matrix
@@ -505,7 +505,7 @@ nsSVGImageFrame::GetType() const
 }
 
 //----------------------------------------------------------------------
-// nsSVGPathGeometryFrame methods:
+// SVGGeometryFrame methods:
 
 // Lie about our fill/stroke so that covered region and hit detection work properly
 
diff --git a/layout/svg/nsSVGMarkerFrame.cpp b/layout/svg/nsSVGMarkerFrame.cpp
index af19cc0251..195b2304f3 100644
--- a/layout/svg/nsSVGMarkerFrame.cpp
+++ b/layout/svg/nsSVGMarkerFrame.cpp
@@ -10,8 +10,8 @@
 #include "gfxContext.h"
 #include "nsSVGEffects.h"
 #include "mozilla/dom/SVGMarkerElement.h"
-#include "nsSVGPathGeometryElement.h"
-#include "nsSVGPathGeometryFrame.h"
+#include "SVGGeometryElement.h"
+#include "SVGGeometryFrame.h"
 
 using namespace mozilla::dom;
 using namespace mozilla::gfx;
@@ -73,7 +73,7 @@ nsSVGMarkerFrame::GetType() const
 gfxMatrix
 nsSVGMarkerFrame::GetCanvasTM()
 {
-  NS_ASSERTION(mMarkedFrame, "null nsSVGPathGeometry frame");
+  NS_ASSERTION(mMarkedFrame, "null SVGGeometry frame");
 
   if (mInUse2) {
     // We're going to be bailing drawing the marker, so return an identity.
@@ -105,7 +105,7 @@ GetAnonymousChildFrame(nsIFrame* aFrame)
 nsresult
 nsSVGMarkerFrame::PaintMark(gfxContext& aContext,
                             const gfxMatrix& aToMarkedFrameUserSpace,
-                            nsSVGPathGeometryFrame *aMarkedFrame,
+                            SVGGeometryFrame *aMarkedFrame,
                             nsSVGMark *aMark, float aStrokeWidth)
 {
   // If the flag is set when we get here, it means this marker frame
@@ -166,7 +166,7 @@ nsSVGMarkerFrame::PaintMark(gfxContext& aContext,
 SVGBBox
 nsSVGMarkerFrame::GetMarkBBoxContribution(const Matrix &aToBBoxUserspace,
                                           uint32_t aFlags,
-                                          nsSVGPathGeometryFrame *aMarkedFrame,
+                                          SVGGeometryFrame *aMarkedFrame,
                                           const nsSVGMark *aMark,
                                           float aStrokeWidth)
 {
@@ -227,7 +227,7 @@ nsSVGMarkerFrame::SetParentCoordCtxProvider(SVGSVGElement *aContext)
 
 nsSVGMarkerFrame::AutoMarkerReferencer::AutoMarkerReferencer(
     nsSVGMarkerFrame *aFrame,
-    nsSVGPathGeometryFrame *aMarkedFrame
+    SVGGeometryFrame *aMarkedFrame
     MOZ_GUARD_OBJECT_NOTIFIER_PARAM_IN_IMPL)
       : mFrame(aFrame)
 {
diff --git a/layout/svg/nsSVGMarkerFrame.h b/layout/svg/nsSVGMarkerFrame.h
index 187aed1403..9205064475 100644
--- a/layout/svg/nsSVGMarkerFrame.h
+++ b/layout/svg/nsSVGMarkerFrame.h
@@ -16,9 +16,9 @@
 #include "nsSVGUtils.h"
 
 class gfxContext;
-class nsSVGPathGeometryFrame;
 
 namespace mozilla {
+class SVGGeometryFrame;
 namespace dom {
 class SVGSVGElement;
 } // namespace dom
@@ -83,19 +83,19 @@ public:
   // nsSVGMarkerFrame methods:
   nsresult PaintMark(gfxContext& aContext,
                      const gfxMatrix& aToMarkedFrameUserSpace,
-                     nsSVGPathGeometryFrame *aMarkedFrame,
+                     SVGGeometryFrame *aMarkedFrame,
                      nsSVGMark *aMark,
                      float aStrokeWidth);
 
   SVGBBox GetMarkBBoxContribution(const Matrix &aToBBoxUserspace,
                                   uint32_t aFlags,
-                                  nsSVGPathGeometryFrame *aMarkedFrame,
+                                  SVGGeometryFrame *aMarkedFrame,
                                   const nsSVGMark *aMark,
                                   float aStrokeWidth);
 
 private:
   // stuff needed for callback
-  nsSVGPathGeometryFrame *mMarkedFrame;
+  SVGGeometryFrame *mMarkedFrame;
   float mStrokeWidth, mX, mY, mAutoAngle;
   bool mIsStart;  // whether the callback is for a marker-start marker
 
@@ -111,7 +111,7 @@ private:
   {
   public:
     AutoMarkerReferencer(nsSVGMarkerFrame *aFrame,
-                         nsSVGPathGeometryFrame *aMarkedFrame
+                         SVGGeometryFrame *aMarkedFrame
                          MOZ_GUARD_OBJECT_NOTIFIER_PARAM);
     ~AutoMarkerReferencer();
   private:
diff --git a/layout/svg/nsSVGPatternFrame.cpp b/layout/svg/nsSVGPatternFrame.cpp
index 2cd7eeaadf..43162274b9 100644
--- a/layout/svg/nsSVGPatternFrame.cpp
+++ b/layout/svg/nsSVGPatternFrame.cpp
@@ -18,7 +18,7 @@
 #include "nsISVGChildFrame.h"
 #include "nsStyleContext.h"
 #include "nsSVGEffects.h"
-#include "nsSVGPathGeometryFrame.h"
+#include "SVGGeometryFrame.h"
 #include "mozilla/dom/SVGPatternElement.h"
 #include "nsSVGUtils.h"
 #include "nsSVGAnimatedTransformList.h"
@@ -392,7 +392,7 @@ nsSVGPatternFrame::PaintPattern(const DrawTarget* aDrawTarget,
 
   if (aSource->IsFrameOfType(nsIFrame::eSVGGeometry)) {
     // Set the geometrical parent of the pattern we are rendering
-    patternWithChildren->mSource = static_cast<nsSVGPathGeometryFrame*>(aSource);
+    patternWithChildren->mSource = static_cast<SVGGeometryFrame*>(aSource);
   }
 
   // Delay checking NS_FRAME_DRAWING_AS_PAINTSERVER bit until here so we can
diff --git a/layout/svg/nsSVGPatternFrame.h b/layout/svg/nsSVGPatternFrame.h
index 7c3cd1ad18..0b90bc0f04 100644
--- a/layout/svg/nsSVGPatternFrame.h
+++ b/layout/svg/nsSVGPatternFrame.h
@@ -15,11 +15,11 @@
 
 class nsIFrame;
 class nsSVGLength2;
-class nsSVGPathGeometryFrame;
 class nsSVGViewBox;
 
 namespace mozilla {
 class SVGAnimatedPreserveAspectRatio;
+class SVGGeometryFrame;
 class nsSVGAnimatedTransformList;
 } // namespace mozilla
 
@@ -142,7 +142,7 @@ private:
   // this is a *temporary* reference to the frame of the element currently
   // referencing our pattern.  This must be temporary because different
   // referencing frames will all reference this one frame
-  nsSVGPathGeometryFrame           *mSource;
+  SVGGeometryFrame                 *mSource;
   nsAutoPtr<gfxMatrix>              mCTM;
 
 protected:
diff --git a/layout/svg/nsSVGUtils.cpp b/layout/svg/nsSVGUtils.cpp
index 103a4ce1ad..fb1a8f3b9f 100644
--- a/layout/svg/nsSVGUtils.cpp
+++ b/layout/svg/nsSVGUtils.cpp
@@ -46,8 +46,8 @@
 #include "nsSVGOuterSVGFrame.h"
 #include "mozilla/dom/SVGClipPathElement.h"
 #include "mozilla/dom/SVGPathElement.h"
-#include "nsSVGPathGeometryElement.h"
-#include "nsSVGPathGeometryFrame.h"
+#include "SVGGeometryElement.h"
+#include "SVGGeometryFrame.h"
 #include "nsSVGPaintServerFrame.h"
 #include "mozilla/dom/SVGSVGElement.h"
 #include "nsTextFrame.h"
@@ -415,7 +415,7 @@ nsSVGUtils::GetCanvasTM(nsIFrame *aFrame)
     return containerFrame->GetCanvasTM();
   }
 
-  return static_cast<nsSVGPathGeometryFrame*>(aFrame)->GetCanvasTM();
+  return static_cast<SVGGeometryFrame*>(aFrame)->GetCanvasTM();
 }
 
 gfxMatrix
@@ -1223,7 +1223,7 @@ nsSVGUtils::CanOptimizeOpacity(nsIFrame *aFrame)
   }
   nsIAtom *type = aFrame->GetType();
   if (type != nsGkAtoms::svgImageFrame &&
-      type != nsGkAtoms::svgPathGeometryFrame) {
+      type != nsGkAtoms::svgGeometryFrame) {
     return false;
   }
   if (aFrame->StyleEffects()->HasFilters()) {
@@ -1329,7 +1329,7 @@ nsSVGUtils::PathExtentsToMaxStrokeExtents(const gfxRect& aPathExtents,
 
 /*static*/ gfxRect
 nsSVGUtils::PathExtentsToMaxStrokeExtents(const gfxRect& aPathExtents,
-                                          nsSVGPathGeometryFrame* aFrame,
+                                          SVGGeometryFrame* aFrame,
                                           const gfxMatrix& aMatrix)
 {
   bool strokeMayHaveCorners =
diff --git a/layout/svg/nsSVGUtils.h b/layout/svg/nsSVGUtils.h
index edfc43bee7..efcde8326a 100644
--- a/layout/svg/nsSVGUtils.h
+++ b/layout/svg/nsSVGUtils.h
@@ -39,7 +39,6 @@ class nsSVGElement;
 class nsSVGEnum;
 class nsSVGLength2;
 class nsSVGOuterSVGFrame;
-class nsSVGPathGeometryFrame;
 class nsTextFrame;
 
 struct nsStyleSVG;
@@ -48,6 +47,7 @@ struct nsRect;
 namespace mozilla {
 class SVGContextPaint;
 struct SVGContextPaintImpl;
+class SVGGeometryFrame;
 namespace dom {
 class Element;
 class UserSpaceMetrics;
@@ -186,6 +186,7 @@ public:
   typedef mozilla::gfx::Size Size;
   typedef mozilla::SVGContextPaint SVGContextPaint;
   typedef mozilla::SVGContextPaintImpl SVGContextPaintImpl;
+  typedef mozilla::SVGGeometryFrame SVGGeometryFrame;
   typedef mozilla::image::DrawResult DrawResult;
 
   static void Init();
@@ -482,7 +483,7 @@ public:
                                                nsTextFrame* aFrame,
                                                const gfxMatrix& aMatrix);
   static gfxRect PathExtentsToMaxStrokeExtents(const gfxRect& aPathExtents,
-                                               nsSVGPathGeometryFrame* aFrame,
+                                               SVGGeometryFrame* aFrame,
                                                const gfxMatrix& aMatrix);
 
   /**

From be9a6ed2acec811158b236c281007984ce141d28 Mon Sep 17 00:00:00 2001
From: Moonchild <moonchild@palemoon.org>
Date: Tue, 29 Apr 2025 23:52:20 +0200
Subject: [PATCH 09/10] [NSS] Improve locking in nssPKIObject_GetInstances.

---
 security/nss/lib/pki/pkibase.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/security/nss/lib/pki/pkibase.c b/security/nss/lib/pki/pkibase.c
index f58a262cf2..22159773a8 100644
--- a/security/nss/lib/pki/pkibase.c
+++ b/security/nss/lib/pki/pkibase.c
@@ -333,10 +333,11 @@ nssPKIObject_GetInstances(
 {
     nssCryptokiObject **instances = NULL;
     PRUint32 i;
+    nssPKIObject_Lock(object);
     if (object->numInstances == 0) {
+        nssPKIObject_Unlock(object);
         return (nssCryptokiObject **)NULL;
     }
-    nssPKIObject_Lock(object);
     instances = nss_ZNEWARRAY(NULL, nssCryptokiObject *,
                               object->numInstances + 1);
     if (instances) {

From ba3a5074c723df674a200b970dc0f37f3729bf2f Mon Sep 17 00:00:00 2001
From: Moonchild <moonchild@palemoon.org>
Date: Wed, 30 Apr 2025 11:42:20 +0200
Subject: [PATCH 10/10] [devtools] Escape some more characters for copying as
 cURL on Posix.

---
 devtools/client/shared/curl.js | 1 +
 1 file changed, 1 insertion(+)

diff --git a/devtools/client/shared/curl.js b/devtools/client/shared/curl.js
index 5375bd634d..843d7d0a62 100644
--- a/devtools/client/shared/curl.js
+++ b/devtools/client/shared/curl.js
@@ -389,6 +389,7 @@ const CurlUtils = {
                         .replace(/\n/g, "\\n")
                         .replace(/\r/g, "\\r")
                         .replace(/!/g, "\\041")
+                        .replace(/([&\|])/g, "^$1")
                         .replace(/[^\x20-\x7E]/g, escapeCharacter) + "'";
     }