Merge branch 'master' into Basilisk-release

18 files changed, 191 insertions, 124 deletions

diff --git a/layout/base/FrameLayerBuilder.cpp b/layout/base/FrameLayerBuilder.cpp
index 183285439..9aaa28fb5 100644
--- a/layout/base/FrameLayerBuilder.cpp
+++ b/layout/base/FrameLayerBuilder.cpp
@@ -3648,6 +3648,10 @@ PaintedLayerData::AccumulateEventRegions(ContainerState* aState, nsDisplayLayerE
   if (alreadyHadRegions) {
     mDispatchToContentHitRegion.OrWith(CombinedTouchActionRegion());
   }
+  
+  // Avoid quadratic performance as a result of the region growing to include
+  // and arbitrarily large number of rects, which can happen on some pages.
+  mMaybeHitRegion.SimplifyOutward(8);
 
   // Calculate scaled versions of the bounds of mHitRegion and mMaybeHitRegion
   // for quick access in FindPaintedLayerFor().
diff --git a/layout/base/nsDisplayList.cpp b/layout/base/nsDisplayList.cpp
index d619576ba..a55ec1e39 100644
--- a/layout/base/nsDisplayList.cpp
+++ b/layout/base/nsDisplayList.cpp
@@ -1096,7 +1096,6 @@ void
 nsDisplayListBuilder::MarkFramesForDisplayList(nsIFrame* aDirtyFrame,
                                                const nsFrameList& aFrames,
                                                const nsRect& aDirtyRect) {
-  mFramesMarkedForDisplay.SetCapacity(mFramesMarkedForDisplay.Length() + aFrames.GetLength());
   for (nsIFrame* e : aFrames) {
     // Skip the AccessibleCaret frame when building no caret.
     if (!IsBuildingCaret()) {
@@ -1108,6 +1107,7 @@ nsDisplayListBuilder::MarkFramesForDisplayList(nsIFrame* aDirtyFrame,
         }
       }
     }
+    
     mFramesMarkedForDisplay.AppendElement(e);
     MarkOutOfFlowFrameForDisplay(aDirtyFrame, e, aDirtyRect);
   }
@@ -3808,12 +3808,14 @@ nsDisplayLayerEventRegions::AddFrame(nsDisplayListBuilder* aBuilder,
     // region on scrollbar frames that won't be placed in their own layer. See
     // bug 1213324 for details.
     mDispatchToContentHitRegion.Or(mDispatchToContentHitRegion, borderBox);
+    mDispatchToContentHitRegion.SimplifyOutward(8);
   } else if (aFrame->GetType() == nsGkAtoms::objectFrame) {
     // If the frame is a plugin frame and wants to handle wheel events as
     // default action, we should add the frame to dispatch-to-content region.
     nsPluginFrame* pluginFrame = do_QueryFrame(aFrame);
     if (pluginFrame && pluginFrame->WantsToHandleWheelEventAsDefaultAction()) {
       mDispatchToContentHitRegion.Or(mDispatchToContentHitRegion, borderBox);
+      mDispatchToContentHitRegion.SimplifyOutward(8);
     }
   }
 
@@ -3850,6 +3852,7 @@ nsDisplayLayerEventRegions::AddFrame(nsDisplayListBuilder* aBuilder,
     }
     if (alreadyHadRegions) {
       mDispatchToContentHitRegion.OrWith(CombinedTouchActionRegion());
+      mDispatchToContentHitRegion.SimplifyOutward(8);
     }
   }
 }
@@ -3859,6 +3862,7 @@ nsDisplayLayerEventRegions::AddInactiveScrollPort(const nsRect& aRect)
 {
   mHitRegion.Or(mHitRegion, aRect);
   mDispatchToContentHitRegion.Or(mDispatchToContentHitRegion, aRect);
+  mDispatchToContentHitRegion.SimplifyOutward(8);
 }
 
 bool
diff --git a/layout/base/nsDisplayList.h b/layout/base/nsDisplayList.h
index c9f773f5b..fcdc9e4fc 100644
--- a/layout/base/nsDisplayList.h
+++ b/layout/base/nsDisplayList.h
@@ -1200,7 +1200,7 @@ private:
   PLArenaPool                    mPool;
   nsCOMPtr<nsISelection>         mBoundingSelection;
   AutoTArray<PresShellState,8> mPresShellStates;
-  AutoTArray<nsIFrame*,100>    mFramesMarkedForDisplay;
+  AutoTArray<nsIFrame*,400>    mFramesMarkedForDisplay;
   AutoTArray<ThemeGeometry,2>  mThemeGeometries;
   nsDisplayTableItem*            mCurrentTableItem;
   DisplayListClipState           mClipState;
diff --git a/layout/base/nsLayoutUtils.cpp b/layout/base/nsLayoutUtils.cpp
index 07befdc81..17ece8e61 100644
--- a/layout/base/nsLayoutUtils.cpp
+++ b/layout/base/nsLayoutUtils.cpp
@@ -8,6 +8,7 @@
 
 #include "mozilla/ArrayUtils.h"
 #include "mozilla/BasicEvents.h"
+#include "mozilla/dom/CanvasUtils.h"
 #include "mozilla/ClearOnShutdown.h"
 #include "mozilla/EffectCompositor.h"
 #include "mozilla/EffectSet.h"
@@ -7285,10 +7286,10 @@ nsLayoutUtils::SurfaceFromElement(nsIImageLoadingContent* aElement,
   }
 
   result.mPrincipal = principal.forget();
-  // no images, including SVG images, can load content from another domain.
-  result.mIsWriteOnly = false;
   result.mImageRequest = imgRequest.forget();
   return result;
+  result.mIsWriteOnly =
+      CanvasUtils::CheckWriteOnlySecurity(result.mCORSUsed, result.mPrincipal);  
 }
 
 nsLayoutUtils::SurfaceFromElementResult
@@ -7400,7 +7401,8 @@ nsLayoutUtils::SurfaceFromElement(HTMLVideoElement* aElement,
   result.mHasSize = true;
   result.mSize = result.mLayersImage->GetSize();
   result.mPrincipal = principal.forget();
-  result.mIsWriteOnly = false;
+  result.mIsWriteOnly =
+      CanvasUtils::CheckWriteOnlySecurity(result.mCORSUsed, result.mPrincipal);
 
   return result;
 }
diff --git a/layout/base/nsPresShell.cpp b/layout/base/nsPresShell.cpp
index 5dfbb8dba..d4fbebbf2 100644
--- a/layout/base/nsPresShell.cpp
+++ b/layout/base/nsPresShell.cpp
@@ -8192,6 +8192,9 @@ PresShell::HandleEventInternal(WidgetEvent* aEvent,
           }
         }
       }
+      if (aEvent->mMessage == eKeyDown) {
+        mIsLastKeyDownCanceled = aEvent->mFlags.mDefaultPrevented;
+      }
       break;
     }
     case eMouseUp:
@@ -8981,6 +8984,9 @@ PresShell::FireOrClearDelayedEvents(bool aFireEvents)
            !doc->EventHandlingSuppressed()) {
       nsAutoPtr<DelayedEvent> ev(mDelayedEvents[0].forget());
       mDelayedEvents.RemoveElementAt(0);
+      if (ev->IsKeyPressEvent() && mIsLastKeyDownCanceled) {
+        continue;
+      }
       ev->Dispatch();
     }
     if (!doc->EventHandlingSuppressed()) {
@@ -9775,6 +9781,12 @@ PresShell::DelayedKeyEvent::DelayedKeyEvent(WidgetKeyboardEvent* aEvent) :
   mEvent = keyEvent;
 }
 
+bool
+PresShell::DelayedKeyEvent::IsKeyPressEvent()
+{
+  return mEvent->mMessage == eKeyPress;
+}
+
 // Start of DEBUG only code
 
 #ifdef DEBUG
diff --git a/layout/base/nsPresShell.h b/layout/base/nsPresShell.h
index 7a9056a38..1a8dd3fef 100644
--- a/layout/base/nsPresShell.h
+++ b/layout/base/nsPresShell.h
@@ -617,6 +617,7 @@ protected:
   public:
     virtual ~DelayedEvent() { }
     virtual void Dispatch() { }
+    virtual bool IsKeyPressEvent() { return false; }
   };
 
   class DelayedInputEvent : public DelayedEvent
@@ -641,6 +642,7 @@ protected:
   {
   public:
     explicit DelayedKeyEvent(mozilla::WidgetKeyboardEvent* aEvent);
+    virtual bool IsKeyPressEvent() override;
   };
 
   // Check if aEvent is a mouse event and record the mouse location for later
@@ -951,6 +953,8 @@ protected:
   // Whether the widget has received a paint message yet.
   bool                      mHasReceivedPaintMessage : 1;
 
+  bool                      mIsLastKeyDownCanceled : 1;
+
   static bool               sDisableNonTestMouseEvents;
 };
 
diff --git a/layout/generic/nsLineBox.h b/layout/generic/nsLineBox.h
index 8f42b9e93..962279df6 100644
--- a/layout/generic/nsLineBox.h
+++ b/layout/generic/nsLineBox.h
@@ -857,29 +857,47 @@ class nsLineList_iterator {
       return --copy;
     }
 
-    // Passing by value rather than by reference and reference to const
-    // to keep AIX happy.
-    bool operator==(const iterator_self_type aOther) const
+    bool operator==(const iterator_self_type& aOther) const
     {
       MOZ_ASSERT(mListLink == aOther.mListLink, "comparing iterators over different lists");
       return mCurrent == aOther.mCurrent;
     }
-    bool operator!=(const iterator_self_type aOther) const
+    bool operator!=(const iterator_self_type& aOther) const
     {
       MOZ_ASSERT(mListLink == aOther.mListLink, "comparing iterators over different lists");
       return mCurrent != aOther.mCurrent;
     }
-    bool operator==(const iterator_self_type aOther)
+    bool operator==(const iterator_self_type& aOther)
     {
       MOZ_ASSERT(mListLink == aOther.mListLink, "comparing iterators over different lists");
       return mCurrent == aOther.mCurrent;
     }
-    bool operator!=(const iterator_self_type aOther)
+    bool operator!=(const iterator_self_type& aOther)
     {
       MOZ_ASSERT(mListLink == aOther.mListLink, "comparing iterators over different lists");
       return mCurrent != aOther.mCurrent;
     }
-
+    bool operator==(iterator_self_type& aOther) const
+    {
+      MOZ_ASSERT(mListLink == aOther.mListLink, "comparing iterators over different lists");
+      return mCurrent == aOther.mCurrent;
+    }
+    bool operator!=(iterator_self_type& aOther) const
+    {
+      MOZ_ASSERT(mListLink == aOther.mListLink, "comparing iterators over different lists");
+      return mCurrent != aOther.mCurrent;
+    }
+    bool operator==(iterator_self_type& aOther)
+    {
+      MOZ_ASSERT(mListLink == aOther.mListLink, "comparing iterators over different lists");
+      return mCurrent == aOther.mCurrent;
+    }
+    bool operator!=(iterator_self_type& aOther)
+    {
+      MOZ_ASSERT(mListLink == aOther.mListLink, "comparing iterators over different lists");
+      return mCurrent != aOther.mCurrent;
+    }
+    
   private:
     link_type *mCurrent;
 #ifdef DEBUG
@@ -992,24 +1010,42 @@ class nsLineList_reverse_iterator {
     }
 #endif /* !__MWERKS__ */
 
-    // Passing by value rather than by reference and reference to const
-    // to keep AIX happy.
-    bool operator==(const iterator_self_type aOther) const
+    bool operator==(const iterator_self_type& aOther) const
     {
       NS_ASSERTION(mListLink == aOther.mListLink, "comparing iterators over different lists");
       return mCurrent == aOther.mCurrent;
     }
-    bool operator!=(const iterator_self_type aOther) const
+    bool operator!=(const iterator_self_type& aOther) const
     {
       NS_ASSERTION(mListLink == aOther.mListLink, "comparing iterators over different lists");
       return mCurrent != aOther.mCurrent;
     }
-    bool operator==(const iterator_self_type aOther)
+    bool operator==(const iterator_self_type& aOther)
     {
       NS_ASSERTION(mListLink == aOther.mListLink, "comparing iterators over different lists");
       return mCurrent == aOther.mCurrent;
     }
-    bool operator!=(const iterator_self_type aOther)
+    bool operator!=(const iterator_self_type& aOther)
+    {
+      NS_ASSERTION(mListLink == aOther.mListLink, "comparing iterators over different lists");
+      return mCurrent != aOther.mCurrent;
+    }
+    bool operator==(iterator_self_type& aOther) const
+    {
+      NS_ASSERTION(mListLink == aOther.mListLink, "comparing iterators over different lists");
+      return mCurrent == aOther.mCurrent;
+    }
+    bool operator!=(iterator_self_type& aOther) const
+    {
+      NS_ASSERTION(mListLink == aOther.mListLink, "comparing iterators over different lists");
+      return mCurrent != aOther.mCurrent;
+    }
+    bool operator==(iterator_self_type& aOther)
+    {
+      NS_ASSERTION(mListLink == aOther.mListLink, "comparing iterators over different lists");
+      return mCurrent == aOther.mCurrent;
+    }
+    bool operator!=(iterator_self_type& aOther)
     {
       NS_ASSERTION(mListLink == aOther.mListLink, "comparing iterators over different lists");
       return mCurrent != aOther.mCurrent;
@@ -1126,24 +1162,42 @@ class nsLineList_const_iterator {
       return --copy;
     }
 
-    // Passing by value rather than by reference and reference to const
-    // to keep AIX happy.
-    bool operator==(const iterator_self_type aOther) const
+    bool operator==(const iterator_self_type& aOther) const
     {
       NS_ASSERTION(mListLink == aOther.mListLink, "comparing iterators over different lists");
       return mCurrent == aOther.mCurrent;
     }
-    bool operator!=(const iterator_self_type aOther) const
+    bool operator!=(const iterator_self_type& aOther) const
     {
       NS_ASSERTION(mListLink == aOther.mListLink, "comparing iterators over different lists");
       return mCurrent != aOther.mCurrent;
     }
-    bool operator==(const iterator_self_type aOther)
+    bool operator==(const iterator_self_type& aOther)
     {
       NS_ASSERTION(mListLink == aOther.mListLink, "comparing iterators over different lists");
       return mCurrent == aOther.mCurrent;
     }
-    bool operator!=(const iterator_self_type aOther)
+    bool operator!=(const iterator_self_type& aOther)
+    {
+      NS_ASSERTION(mListLink == aOther.mListLink, "comparing iterators over different lists");
+      return mCurrent != aOther.mCurrent;
+    }
+    bool operator==(iterator_self_type& aOther) const
+    {
+      NS_ASSERTION(mListLink == aOther.mListLink, "comparing iterators over different lists");
+      return mCurrent == aOther.mCurrent;
+    }
+    bool operator!=(iterator_self_type& aOther) const
+    {
+      NS_ASSERTION(mListLink == aOther.mListLink, "comparing iterators over different lists");
+      return mCurrent != aOther.mCurrent;
+    }
+    bool operator==(iterator_self_type& aOther)
+    {
+      NS_ASSERTION(mListLink == aOther.mListLink, "comparing iterators over different lists");
+      return mCurrent == aOther.mCurrent;
+    }
+    bool operator!=(iterator_self_type& aOther)
     {
       NS_ASSERTION(mListLink == aOther.mListLink, "comparing iterators over different lists");
       return mCurrent != aOther.mCurrent;
diff --git a/layout/reftests/css-parsing/invalid-url-handling.xhtml b/layout/reftests/css-parsing/invalid-url-handling.xhtml
index da1709b01..e6b85a81c 100644
--- a/layout/reftests/css-parsing/invalid-url-handling.xhtml
+++ b/layout/reftests/css-parsing/invalid-url-handling.xhtml
@@ -22,17 +22,16 @@
   #two { background-color: green; }
   </style>
   <style type="text/css">
-  /* not a URI token; the unterminated string ends at end of line, so
-     the brace never matches */
-  #three { background-color: green; }
+  /* not a URI token; bad-url token is consumed until the first closing ) */
   #foo { background: url(foo"bar) }
-  #three { background-color: red; }
+  #three { background-color: green; }
   </style>
   <style type="text/css">
-  /* not a URI token; the unterminated string ends at end of line */
+  /* not a URI token; bad-url token is consumed until the first closing ) */
+  #four { background-color: green; }
   #foo { background: url(foo"bar) }
   ) }
-  #four { background-color: green; }
+  #four { background-color: red; }
   </style>
   <style type="text/css">
   /* not a URI token; the unterminated string ends at end of line, so
@@ -68,18 +67,19 @@
   #eleven { background: url([) green; }
   </style>
   <style type="text/css">
-  /* not a URI token; brace matching should work only after invalid URI token */
-  #twelve { background: url(}{""{)}); background-color: green; }
+  /* not a URI token; bad-url token is consumed until the first closing )
+     so the brace immediately after it closes the declaration block */
+  #twelve { background-color: green; }
+  #twelve { background: url(}{""{)}); background-color: red; }
   </style>
   <style type="text/css">
   /* invalid URI token absorbs the [ */
   #thirteen { background: url([""); background-color: green; }
   </style>
   <style type="text/css">
-  /* not a URI token; the opening ( is never matched */
-  #fourteen { background-color: green; }
+  /* not a URI token; bad-url token is consumed until the first closing ) */
   #foo { background: url(() }
-  #fourteen { background-color: red; }
+  #fourteen { background-color: green; }
   </style>
   <!-- The next three tests test that invalid URI tokens absorb [ and { -->
   <style type="text/css">
diff --git a/layout/reftests/text-svgglyphs/reftest.list b/layout/reftests/text-svgglyphs/reftest.list
index 6f328ab73..7ff341f42 100644
--- a/layout/reftests/text-svgglyphs/reftest.list
+++ b/layout/reftests/text-svgglyphs/reftest.list
@@ -21,3 +21,4 @@ pref(gfx.font_rendering.opentype_svg.enabled,true)    fails == svg-glyph-mask.sv
 pref(gfx.font_rendering.opentype_svg.enabled,true)    == svg-glyph-paint-server.svg svg-glyph-paint-server-ref.svg
 pref(gfx.font_rendering.opentype_svg.enabled,true)    == svg-glyph-transform.svg svg-glyph-transform-ref.svg
 pref(gfx.font_rendering.opentype_svg.enabled,true)    == svg-glyph-extents.html svg-glyph-extents-ref.html
+pref(gfx.font_rendering.opentype_svg.enabled,true)    == svg-glyph-compressed.html svg-glyph-compressed-ref.html
diff --git a/layout/reftests/text-svgglyphs/resources/svg-gz.ttf b/layout/reftests/text-svgglyphs/resources/svg-gz.ttf
new file mode 100644
index 000000000..3a9660224
--- /dev/null
+++ b/layout/reftests/text-svgglyphs/resources/svg-gz.ttf
diff --git a/layout/reftests/text-svgglyphs/svg-glyph-compressed-ref.html b/layout/reftests/text-svgglyphs/svg-glyph-compressed-ref.html
new file mode 100644
index 000000000..9bbfeb748
--- /dev/null
+++ b/layout/reftests/text-svgglyphs/svg-glyph-compressed-ref.html
@@ -0,0 +1,15 @@
+<!DOCTYPE html>
+<html><head>
+<meta http-equiv="content-type" content="text/html; charset=UTF-8"><title>Test for compressed SVG glyphs</title>
+<style>
+  @font-face {
+    font-family: test;
+    src: url(resources/svg.woff); /* uses uncompressed SVG documents */
+  }
+  html { width: 400px; height: 400px; background-color: white; }
+  body { margin: 0; }
+  div { font: 200px test; color: fuchsia; line-height: 1; stroke: none; }
+</style>
+</head><body><div>abcdefg</div>
+<div>LMNOPQR</div>
+</body></html>
\ No newline at end of file
diff --git a/layout/reftests/text-svgglyphs/svg-glyph-compressed.html b/layout/reftests/text-svgglyphs/svg-glyph-compressed.html
new file mode 100644
index 000000000..e8123bba6
--- /dev/null
+++ b/layout/reftests/text-svgglyphs/svg-glyph-compressed.html
@@ -0,0 +1,15 @@
+<!DOCTYPE html>
+<html><head>
+<meta http-equiv="content-type" content="text/html; charset=UTF-8"><title>Test for compressed SVG glyphs</title>
+<style>
+  @font-face {
+    font-family: test;
+    src: url(resources/svg-gz.ttf); /* copy of svg.woff using gzip-compressed SVG documents */
+  }
+  html { width: 400px; height: 400px; background-color: white; }
+  body { margin: 0; }
+  div { font: 200px test; color: fuchsia; line-height: 1; stroke: none; }
+</style>
+</head><body><div>abcdefg</div>
+<div>LMNOPQR</div>
+</body></html>
\ No newline at end of file
diff --git a/layout/style/nsCSSScanner.cpp b/layout/style/nsCSSScanner.cpp
index 771c8936b..2110be78c 100644
--- a/layout/style/nsCSSScanner.cpp
+++ b/layout/style/nsCSSScanner.cpp
@@ -1164,6 +1164,7 @@ nsCSSScanner::NextURL(nsCSSToken& aToken)
   // aToken.mIdent may be "url" at this point; clear that out
   aToken.mIdent.Truncate();
 
+  bool hasString = false;
   int32_t ch = Peek();
   // Do we have a string?
   if (ch == '"' || ch == '\'') {
@@ -1173,7 +1174,7 @@ nsCSSScanner::NextURL(nsCSSToken& aToken)
       return;
     }
     MOZ_ASSERT(aToken.mType == eCSSToken_String, "unexpected token type");
-
+    hasString = true;
   } else {
     // Otherwise, this is the start of a non-quoted url (which may be empty).
     aToken.mSymbol = char16_t(0);
@@ -1193,6 +1194,25 @@ nsCSSScanner::NextURL(nsCSSToken& aToken)
   } else {
     mSeenBadToken = true;
     aToken.mType = eCSSToken_Bad_URL;
+    if (!hasString) {
+      // Consume until before the next right parenthesis, which follows
+      // how <bad-url-token> is consumed in CSS Syntax 3 spec.
+      // Note that, we only do this when "url(" is not followed by a
+      // string, because in the spec, "url(" followed by a string is
+      // handled as a url function rather than a <url-token>, so the
+      // rest of content before ")" should be consumed in balance,
+      // which will be done by the parser.
+      // The closing ")" is not consumed here. It is left to the parser
+      // so that the parser can handle both cases.
+      do {
+        if (IsVertSpace(ch)) {
+          AdvanceLine();
+        } else {
+          Advance();
+        }
+        ch = Peek();
+      } while (ch >= 0 && ch != ')');
+    }
   }
 }
 
diff --git a/layout/style/nsRuleNode.cpp b/layout/style/nsRuleNode.cpp
index 6bcef02a0..08400635b 100644
--- a/layout/style/nsRuleNode.cpp
+++ b/layout/style/nsRuleNode.cpp
@@ -67,9 +67,6 @@
 #define alloca _alloca
 #endif
 #endif
-#ifdef SOLARIS
-#include <alloca.h>
-#endif
 
 using std::max;
 using std::min;
diff --git a/layout/style/test/test_csslexer.js b/layout/style/test/test_csslexer.js
index a71c02d8f..4ba3b9c5c 100644
--- a/layout/style/test/test_csslexer.js
+++ b/layout/style/test/test_csslexer.js
@@ -55,8 +55,7 @@ var LEX_TESTS = [
              ["url:http://example.com"]],
   // In CSS Level 3, this is an ordinary URL, not a BAD_URL.
   ["url(http://example.com", ["url:http://example.com"]],
-  // See bug 1153981 to understand why this gets a SYMBOL token.
-  ["url(http://example.com @", ["bad_url:http://example.com", "symbol:@"]],
+  ["url(http://example.com @", ["bad_url:http://example.com"]],
   ["quo\\ting", ["ident:quoting"]],
   ["'bad string\n", ["bad_string:bad string", "whitespace"]],
   ["~=", ["includes"]],
diff --git a/layout/svg/nsSVGMaskFrame.cpp b/layout/svg/nsSVGMaskFrame.cpp
index b8e4b32ae..a22833d61 100644
--- a/layout/svg/nsSVGMaskFrame.cpp
+++ b/layout/svg/nsSVGMaskFrame.cpp
@@ -274,7 +274,8 @@ nsSVGMaskFrame::GetMaskForMaskedFrame(gfxContext* aContext,
   }
   RefPtr<DataSourceSurface> maskSurface = maskSnapshot->GetDataSurface();
   DataSourceSurface::MappedSurface map;
-  if (!maskSurface->Map(DataSourceSurface::MapType::READ, &map)) {
+  if (!maskSurface ||
+      !maskSurface->Map(DataSourceSurface::MapType::READ, &map)) {
     return nullptr;
   }
 
diff --git a/layout/svg/nsSVGUtils.cpp b/layout/svg/nsSVGUtils.cpp
index 0bded21ff..98e5f9b5f 100644
--- a/layout/svg/nsSVGUtils.cpp
+++ b/layout/svg/nsSVGUtils.cpp
@@ -734,9 +734,12 @@ nsSVGUtils::PaintFrameWithEffects(nsIFrame *aFrame,
     RefPtr<SourceSurface> maskSurface;
 
     if (maskUsage.shouldGenerateMaskLayer) {
-      maskSurface =
-        maskFrame->GetMaskForMaskedFrame(&aContext, aFrame, aTransform,
-                                         maskUsage.opacity, &maskTransform);
+      // Make sure we have a mask frame.
+      if (maskFrame) {
+        maskSurface = 
+          maskFrame->GetMaskForMaskedFrame(&aContext, aFrame, aTransform,
+                                           maskUsage.opacity, &maskTransform);
+      }
 
       if (!maskSurface) {
         // Entire surface is clipped out.
diff --git a/layout/tools/reftest/reftest.jsm b/layout/tools/reftest/reftest.jsm
index bd9976b0f..c885150a4 100644
--- a/layout/tools/reftest/reftest.jsm
+++ b/layout/tools/reftest/reftest.jsm
@@ -277,29 +277,10 @@ this.OnRefTestLoad = function OnRefTestLoad(win)
 
     var prefs = Components.classes["@mozilla.org/preferences-service;1"].
                 getService(Components.interfaces.nsIPrefBranch);
-    try {
-        gBrowserIsRemote = prefs.getBoolPref("browser.tabs.remote.autostart");
-    } catch (e) {
-        gBrowserIsRemote = false;
-    }
-
-    try {
-        gB2GisMulet = prefs.getBoolPref("b2g.is_mulet");
-    } catch (e) {
-        gB2GisMulet = false;
-    }
-
-    try {
-      gBrowserIsIframe = prefs.getBoolPref("reftest.browser.iframe.enabled");
-    } catch (e) {
-      gBrowserIsIframe = false;
-    }
-
-    try {
-      gLogLevel = prefs.getCharPref("reftest.logLevel");
-    } catch (e) {
-      gLogLevel ='info';
-    }
+    gBrowserIsRemote = prefs.getBoolPref("browser.tabs.remote.autostart", false);
+    gB2GisMulet = prefs.getBoolPref("b2g.is_mulet", false);
+    gBrowserIsIframe = prefs.getBoolPref("reftest.browser.iframe.enabled", false);
+    gLogLevel = prefs.getCharPref("reftest.logLevel", "info");
 
     if (win === undefined || win == null) {
       win = window;
@@ -366,11 +347,7 @@ function InitAndStartRefTests()
     } catch (e) {}
 
     /* set the gLoadTimeout */
-    try {
-        gLoadTimeout = prefs.getIntPref("reftest.timeout");
-    } catch(e) {
-        gLoadTimeout = 5 * 60 * 1000; //5 minutes as per bug 479518
-    }
+    gLoadTimeout = prefs.getIntPref("reftest.timeout", 5 * 60 * 1000); //5 minutes as per bug 479518
 
     /* Get the logfile for android tests */
     try {
@@ -381,27 +358,12 @@ function InitAndStartRefTests()
         }
     } catch(e) {}
 
-    try {
-        gRemote = prefs.getBoolPref("reftest.remote");
-    } catch(e) {
-        gRemote = false;
-    }
-
-    try {
-        gIgnoreWindowSize = prefs.getBoolPref("reftest.ignoreWindowSize");
-    } catch(e) {
-        gIgnoreWindowSize = false;
-    }
+    gRemote = prefs.getBoolPref("reftest.remote", false);
+    gIgnoreWindowSize = prefs.getBoolPref("reftest.ignoreWindowSize", false);
 
     /* Support for running a chunk (subset) of tests.  In separate try as this is optional */
-    try {
-        gTotalChunks = prefs.getIntPref("reftest.totalChunks");
-        gThisChunk = prefs.getIntPref("reftest.thisChunk");
-    }
-    catch(e) {
-        gTotalChunks = 0;
-        gThisChunk = 0;
-    }
+    gTotalChunks = prefs.getIntPref("reftest.totalChunks", 0);
+    gThisChunk = prefs.getIntPref("reftest.thisChunk", 0);
 
     try {
         gFocusFilterMode = prefs.getCharPref("reftest.focusFilterMode");
@@ -468,39 +430,17 @@ function StartTests()
         logger.error("EXCEPTION: " + e);
     }
 
-    try {
-        gNoCanvasCache = prefs.getIntPref("reftest.nocache");
-    } catch(e) {
-        gNoCanvasCache = false;
-    }
-
-    try {
-      gShuffle = prefs.getBoolPref("reftest.shuffle");
-    } catch (e) {
-      gShuffle = false;
-    }
-
-    try {
-      gRunUntilFailure = prefs.getBoolPref("reftest.runUntilFailure");
-    } catch (e) {
-      gRunUntilFailure = false;
-    }
+    gNoCanvasCache = prefs.getIntPref("reftest.nocache", false);
+    gShuffle = prefs.getBoolPref("reftest.shuffle", false);
+    gRunUntilFailure = prefs.getBoolPref("reftest.runUntilFailure", false);
 
     // When we repeat this function is called again, so really only want to set
     // gRepeat once.
     if (gRepeat == null) {
-      try {
-        gRepeat = prefs.getIntPref("reftest.repeat");
-      } catch (e) {
-        gRepeat = 0;
-      }
+      gRepeat = prefs.getIntPref("reftest.repeat", 0);
     }
 
-    try {
-        gRunSlowTests = prefs.getIntPref("reftest.skipslowtests");
-    } catch(e) {
-        gRunSlowTests = false;
-    }
+    gRunSlowTests = prefs.getIntPref("reftest.skipslowtests", false);
 
     if (gShuffle) {
         gNoCanvasCache = true;
@@ -737,11 +677,7 @@ function BuildConditionSandbox(aURL) {
 
     var prefs = CC["@mozilla.org/preferences-service;1"].
                 getService(CI.nsIPrefBranch);
-    try {
-        sandbox.nativeThemePref = !prefs.getBoolPref("mozilla.widget.disable-native-theme");
-    } catch (e) {
-        sandbox.nativeThemePref = true;
-    }
+    sandbox.nativeThemePref = !prefs.getBoolPref("mozilla.widget.disable-native-theme", false);
 
     sandbox.prefs = CU.cloneInto({
         getBoolPref: function(p) { return prefs.getBoolPref(p); },