--- a/editor/libeditor/base/EditAggregateTxn.cpp
+++ b/editor/libeditor/base/EditAggregateTxn.cpp
@@ -36,98 +36,73 @@
  * ***** END LICENSE BLOCK ***** */
 
 #include "EditAggregateTxn.h"
 #include "nsCOMPtr.h"
 
 EditAggregateTxn::EditAggregateTxn()
   : EditTxn()
 {
-  nsresult res = NS_NewISupportsArray(getter_AddRefs(mChildren));
-  NS_POSTCONDITION(NS_SUCCEEDED(res), "EditAggregateTxn failed in constructor");
 }
 
 NS_IMETHODIMP EditAggregateTxn::DoTransaction(void)
 {
   nsresult result=NS_OK;  // it's legal (but not very useful) to have an empty child list
-  if (mChildren)
+  for (PRUint32 i = 0, length = mChildren.Length(); i < length; ++i)
   {
-    PRInt32 i;
-    PRUint32 count;
-    mChildren->Count(&count);
-    for (i=0; i<((PRInt32)count); i++)
-    {
-      nsCOMPtr<nsITransaction> txn (do_QueryElementAt(mChildren, i));
-      if (!txn) { return NS_ERROR_NULL_POINTER; }
-      result = txn->DoTransaction();
-      if (NS_FAILED(result))
-        break;
-    }  
+    nsITransaction *txn = mChildren[i];
+    if (!txn) { return NS_ERROR_NULL_POINTER; }
+    result = txn->DoTransaction();
+    if (NS_FAILED(result))
+      break;
   }
   return result;
 }
 
 NS_IMETHODIMP EditAggregateTxn::UndoTransaction(void)
 {
   nsresult result=NS_OK;  // it's legal (but not very useful) to have an empty child list
-  if (mChildren)
+  // undo goes through children backwards
+  for (PRUint32 i = mChildren.Length(); i-- != 0; )
   {
-    PRInt32 i;
-    PRUint32 count;
-    mChildren->Count(&count);
-    // undo goes through children backwards
-    for (i=count-1; i>=0; i--)
-    {
-      nsCOMPtr<nsITransaction> txn (do_QueryElementAt(mChildren, i));
-      if (!txn) { return NS_ERROR_NULL_POINTER; }
-      result = txn->UndoTransaction();
-      if (NS_FAILED(result))
-        break;
-    }  
+    nsITransaction *txn = mChildren[i];
+    if (!txn) { return NS_ERROR_NULL_POINTER; }
+    result = txn->UndoTransaction();
+    if (NS_FAILED(result))
+      break;
   }
   return result;
 }
 
 NS_IMETHODIMP EditAggregateTxn::RedoTransaction(void)
 {
   nsresult result=NS_OK;  // it's legal (but not very useful) to have an empty child list
-  if (mChildren)
+  for (PRUint32 i = 0, length = mChildren.Length(); i < length; ++i)
   {
-    PRInt32 i;
-    PRUint32 count;
-    mChildren->Count(&count);
-    for (i=0; i<((PRInt32)count); i++)
-    {
-      nsCOMPtr<nsITransaction> txn (do_QueryElementAt(mChildren, i));
-      if (!txn) { return NS_ERROR_NULL_POINTER; }
-      result = txn->RedoTransaction();
-      if (NS_FAILED(result))
-        break;
-    }  
+    nsITransaction *txn = mChildren[i];
+    if (!txn) { return NS_ERROR_NULL_POINTER; }
+    result = txn->RedoTransaction();
+    if (NS_FAILED(result))
+      break;
   }
   return result;
 }
 
 NS_IMETHODIMP EditAggregateTxn::Merge(nsITransaction *aTransaction, PRBool *aDidMerge)
 {
   nsresult result=NS_OK;  // it's legal (but not very useful) to have an empty child list
   if (aDidMerge)
     *aDidMerge = PR_FALSE;
-  if (mChildren)
+  // FIXME: Is this really intended not to loop?  It looks like the code
+  // that used to be here sort of intended to loop, but didn't.
+  if (mChildren.Length() > 0)
   {
-    PRInt32 i=0;
-    PRUint32 count;
-    mChildren->Count(&count);
-    NS_ASSERTION(count>0, "bad count");
-    if (0<count)
-    {
-      nsCOMPtr<nsITransaction> txn (do_QueryElementAt(mChildren, i));
-      if (!txn) { return NS_ERROR_NULL_POINTER; }
-      result = txn->Merge(aTransaction, aDidMerge);
-    }
+    nsITransaction *txn = mChildren[0];
+    if (!txn) { return NS_ERROR_NULL_POINTER; }
+    result = txn->Merge(aTransaction, aDidMerge);
   }
   return result;
 }
 
 NS_IMETHODIMP EditAggregateTxn::GetTxnDescription(nsAString& aString)
 {
   aString.AssignLiteral("EditAggregateTxn: ");
 
@@ -138,63 +113,57 @@ NS_IMETHODIMP EditAggregateTxn::GetTxnDe
     aString += name;
   }
 
   return NS_OK;
 }
 
 NS_IMETHODIMP EditAggregateTxn::AppendChild(EditTxn *aTxn)
 {
-  if (mChildren && aTxn)
-  {
-    // aaahhhh! broken interfaces drive me crazy!!!
-    nsCOMPtr<nsISupports> isupports;
-    aTxn->QueryInterface(NS_GET_IID(nsISupports), getter_AddRefs(isupports));
-    mChildren->AppendElement(isupports);
-    return NS_OK;
+  if (!aTxn) {
+    return NS_ERROR_NULL_POINTER;
   }
-  return NS_ERROR_NULL_POINTER;
+
+  nsRefPtr<EditTxn> *slot = mChildren.AppendElement();
+  if (!slot) {
+    return NS_ERROR_OUT_OF_MEMORY;
+  }
+
+  *slot = aTxn;
+  return NS_OK;
 }
 
 NS_IMETHODIMP EditAggregateTxn::GetCount(PRUint32 *aCount)
 {
   if (!aCount) {
     return NS_ERROR_NULL_POINTER;
   }
-  *aCount=0;
-  if (mChildren) {
-    mChildren->Count(aCount);
-  }
+  *aCount = mChildren.Length();
   return NS_OK;
 }
 
 NS_IMETHODIMP EditAggregateTxn::GetTxnAt(PRInt32 aIndex, EditTxn **aTxn)
 {
   // preconditions
   NS_PRECONDITION(aTxn, "null out param");
-  NS_PRECONDITION(mChildren, "bad internal state");
 
   if (!aTxn) {
     return NS_ERROR_NULL_POINTER;
   }
   *aTxn = nsnull; // initialize out param as soon as we know it's a valid pointer
-  if (!mChildren) {
-    return NS_ERROR_UNEXPECTED;
-  }
-
   // get the transaction at aIndex
-  PRUint32 txnCount;
-  mChildren->Count(&txnCount);
+  PRUint32 txnCount = mChildren.Length();
   if (0>aIndex || ((PRInt32)txnCount)<=aIndex) {
     return NS_ERROR_UNEXPECTED;
   }
   // ugh, this is all wrong - what a mess we have with editor transaction interfaces
-  mChildren->QueryElementAt(aIndex, EditTxn::GetCID(), (void**)aTxn);
+  *aTxn = mChildren[aIndex];
   if (!*aTxn)
     return NS_ERROR_UNEXPECTED;
+  NS_ADDREF(*aTxn);
   return NS_OK;
 }
 
 
 NS_IMETHODIMP EditAggregateTxn::SetName(nsIAtom *aName)
 {
   mName = do_QueryInterface(aName);
   return NS_OK;

--- a/editor/libeditor/base/EditAggregateTxn.h
+++ b/editor/libeditor/base/EditAggregateTxn.h
@@ -36,17 +36,18 @@
  * ***** END LICENSE BLOCK ***** */
 
 #ifndef EditAggregateTxn_h__
 #define EditAggregateTxn_h__
 
 #include "EditTxn.h"
 #include "nsIAtom.h"
 #include "nsCOMPtr.h"
-#include "nsISupportsArray.h"
+#include "nsTArray.h"
+#include "nsAutoPtr.h"
 
 #define EDIT_AGGREGATE_TXN_CID \
 {/* 345921a0-ac49-11d2-86d8-000064657374 */ \
 0x345921a0, 0xac49, 0x11d2, \
 {0x86, 0xd8, 0x0, 0x0, 0x64, 0x65, 0x73, 0x74} }
 
 
 /**
@@ -83,13 +84,13 @@ public:
   /** set the name assigned to this txn */
   NS_IMETHOD SetName(nsIAtom *aName);
 
   /** get the name assigned to this txn */
   NS_IMETHOD GetName(nsIAtom **aName);
 
 protected:
 
-  nsCOMPtr<nsISupportsArray> mChildren;
+  nsTArray< nsRefPtr<EditTxn> > mChildren;
   nsCOMPtr<nsIAtom> mName;
 };
 
 #endif