--- a/accessible/public/nsIAccessibilityService.h
+++ b/accessible/public/nsIAccessibilityService.h
@@ -10,17 +10,16 @@
 #include "nsIAccessibleRetrieval.h"
 #include "nsIAccessibleEvent.h"
 
 #include "nsAutoPtr.h"
 
 class Accessible;
 class nsINode;
 class nsIContent;
-class nsIDocument;
 class nsIFrame;
 class nsIPresShell;
 class nsObjectFrame;
 
 // 10ff6dca-b219-4b64-9a4c-67a62b86edce
 #define NS_IACCESSIBILITYSERVICE_IID \
 { 0x84dd9182, 0x6639, 0x4377, \
  { 0xa4, 0x13, 0xad, 0xe1, 0xae, 0x4e, 0x52, 0xdd } }

--- a/accessible/src/atk/ApplicationAccessibleWrap.cpp
+++ b/accessible/src/atk/ApplicationAccessibleWrap.cpp
@@ -890,16 +890,20 @@ bool
 ShouldA11yBeEnabled()
 {
   static bool sChecked = false, sShouldEnable = false;
   if (sChecked)
     return sShouldEnable;
 
   sChecked = true;
 
+  EPlatformDisabledState disabledState = PlatformDisabledState();
+  if (disabledState == ePlatformIsDisabled)
+    return sShouldEnable = false;
+
   // check if accessibility enabled/disabled by environment variable
   const char* envValue = PR_GetEnv(sAccEnv);
   if (envValue)
     return sShouldEnable = !!atoi(envValue);
 
 #ifdef MOZ_ENABLE_DBUS
   PreInit();
   bool dbusSuccess = false;

--- a/accessible/src/base/AccEvent.cpp
+++ b/accessible/src/base/AccEvent.cpp
@@ -8,17 +8,16 @@
 #include "ApplicationAccessibleWrap.h"
 #include "nsAccessibilityService.h"
 #include "nsAccUtils.h"
 #include "DocAccessible.h"
 #include "nsIAccessibleText.h"
 #include "nsAccEvent.h"
 #include "States.h"
 
-#include "nsIDOMDocument.h"
 #include "nsEventStateManager.h"
 #include "nsIServiceManager.h"
 #ifdef MOZ_XUL
 #include "nsIDOMXULMultSelectCntrlEl.h"
 #endif
 
 using namespace mozilla::a11y;
 

--- a/accessible/src/base/nsAccessibilityService.cpp
+++ b/accessible/src/base/nsAccessibilityService.cpp
@@ -37,35 +37,24 @@
 #include "nsHTMLWin32ObjectAccessible.h"
 #endif
 #include "TextLeafAccessibleWrap.h"
 
 #ifdef DEBUG
 #include "Logging.h"
 #endif
 
-#include "nsCURILoader.h"
-#include "nsEventStates.h"
-#include "nsIContentViewer.h"
 #include "nsIDOMDocument.h"
-#include "nsIDOMHTMLAreaElement.h"
-#include "nsIDOMHTMLLegendElement.h"
 #include "nsIDOMHTMLObjectElement.h"
-#include "nsIDOMHTMLOptGroupElement.h"
-#include "nsIDOMHTMLOptionElement.h"
 #include "nsIDOMXULElement.h"
-#include "nsIHTMLDocument.h"
 #include "nsImageFrame.h"
-#include "nsILink.h"
 #include "nsIObserverService.h"
 #include "nsLayoutUtils.h"
 #include "nsNPAPIPluginInstance.h"
-#include "nsISupportsUtils.h"
 #include "nsObjectFrame.h"
-#include "nsTextFragment.h"
 #include "mozilla/FunctionTimer.h"
 #include "mozilla/dom/Element.h"
 #include "mozilla/Preferences.h"
 #include "mozilla/Services.h"
 #include "mozilla/Util.h"
 
 #ifdef MOZ_XUL
 #include "XULAlertAccessible.h"

--- a/accessible/src/base/nsCoreUtils.cpp
+++ b/accessible/src/base/nsCoreUtils.cpp
@@ -253,55 +253,46 @@ nsCoreUtils::IsAncestorOf(nsINode *aPoss
     if (parentNode == aPossibleAncestorNode)
       return true;
   }
 
   return false;
 }
 
 nsresult
-nsCoreUtils::ScrollSubstringTo(nsIFrame *aFrame,
-                               nsIDOMNode *aStartNode, PRInt32 aStartIndex,
-                               nsIDOMNode *aEndNode, PRInt32 aEndIndex,
+nsCoreUtils::ScrollSubstringTo(nsIFrame* aFrame, nsRange* aRange,
                                PRUint32 aScrollType)
 {
   nsIPresShell::ScrollAxis vertical, horizontal;
   ConvertScrollTypeToPercents(aScrollType, &vertical, &horizontal);
 
-  return ScrollSubstringTo(aFrame, aStartNode, aStartIndex, aEndNode, aEndIndex,
-                           vertical, horizontal);
+  return ScrollSubstringTo(aFrame, aRange, vertical, horizontal);
 }
 
 nsresult
-nsCoreUtils::ScrollSubstringTo(nsIFrame *aFrame,
-                               nsIDOMNode *aStartNode, PRInt32 aStartIndex,
-                               nsIDOMNode *aEndNode, PRInt32 aEndIndex,
+nsCoreUtils::ScrollSubstringTo(nsIFrame* aFrame, nsRange* aRange,
                                nsIPresShell::ScrollAxis aVertical,
                                nsIPresShell::ScrollAxis aHorizontal)
 {
-  if (!aFrame || !aStartNode || !aEndNode)
+  if (!aFrame)
     return NS_ERROR_FAILURE;
 
   nsPresContext *presContext = aFrame->PresContext();
 
-  nsRefPtr<nsIDOMRange> scrollToRange = new nsRange();
   nsCOMPtr<nsISelectionController> selCon;
   aFrame->GetSelectionController(presContext, getter_AddRefs(selCon));
   NS_ENSURE_TRUE(selCon, NS_ERROR_FAILURE);
 
-  scrollToRange->SetStart(aStartNode, aStartIndex);
-  scrollToRange->SetEnd(aEndNode, aEndIndex);
-
   nsCOMPtr<nsISelection> selection;
   selCon->GetSelection(nsISelectionController::SELECTION_ACCESSIBILITY,
                        getter_AddRefs(selection));
 
   nsCOMPtr<nsISelectionPrivate> privSel(do_QueryInterface(selection));
   selection->RemoveAllRanges();
-  selection->AddRange(scrollToRange);
+  selection->AddRange(aRange);
 
   privSel->ScrollIntoViewInternal(
     nsISelectionController::SELECTION_ANCHOR_REGION,
     true, aVertical, aHorizontal);
 
   selection->CollapseToStart();
 
   return NS_OK;

--- a/accessible/src/base/nsCoreUtils.h
+++ b/accessible/src/base/nsCoreUtils.h
@@ -16,16 +16,18 @@
 #include "nsIFrame.h"
 #include "nsIDocShellTreeItem.h"
 #include "nsIDOMCSSStyleDeclaration.h"
 #include "nsIDOMDOMStringList.h"
 #include "nsIMutableArray.h"
 #include "nsPoint.h"
 #include "nsTArray.h"
 
+class nsRange;
+
 /**
  * Core utils.
  */
 class nsCoreUtils
 {
 public:
   /**
    * Return true if the given node has registered click, mousedown or mouseup
@@ -124,41 +126,31 @@ public:
                               nsINode *aPossibleDescendantNode,
                               nsINode *aRootNode = nsnull);
 
   /**
    * Helper method to scroll range into view, used for implementation of
    * nsIAccessibleText::scrollSubstringTo().
    *
    * @param aFrame        the frame for accessible the range belongs to.
-   * @param aStartNode    start node of a range
-   * @param aStartOffset  an offset inside the start node
-   * @param aEndNode      end node of a range
-   * @param aEndOffset    an offset inside the end node
+   * @param aRange    the range to scroll to
    * @param aScrollType   the place a range should be scrolled to
    */
-  static nsresult ScrollSubstringTo(nsIFrame *aFrame,
-                                    nsIDOMNode *aStartNode, PRInt32 aStartIndex,
-                                    nsIDOMNode *aEndNode, PRInt32 aEndIndex,
+  static nsresult ScrollSubstringTo(nsIFrame* aFrame, nsRange* aRange,
                                     PRUint32 aScrollType);
 
   /** Helper method to scroll range into view, used for implementation of
    * nsIAccessibleText::scrollSubstringTo[Point]().
    *
    * @param aFrame        the frame for accessible the range belongs to.
-   * @param aStartNode    start node of a range
-   * @param aStartOffset  an offset inside the start node
-   * @param aEndNode      end node of a range
-   * @param aEndOffset    an offset inside the end node
+   * @param aRange    the range to scroll to
    * @param aVertical     how to align vertically, specified in percents, and when.
    * @param aHorizontal     how to align horizontally, specified in percents, and when.
    */
-  static nsresult ScrollSubstringTo(nsIFrame *aFrame,
-                                    nsIDOMNode *aStartNode, PRInt32 aStartIndex,
-                                    nsIDOMNode *aEndNode, PRInt32 aEndIndex,
+  static nsresult ScrollSubstringTo(nsIFrame* aFrame, nsRange* aRange,
                                     nsIPresShell::ScrollAxis aVertical,
                                     nsIPresShell::ScrollAxis aHorizontal);
 
   /**
    * Scrolls the given frame to the point, used for implememntation of
    * nsIAccessible::scrollToPoint and nsIAccessibleText::scrollSubstringToPoint.
    *
    * @param aScrollableFrame  the scrollable frame

--- a/accessible/src/generic/HyperTextAccessible.cpp
+++ b/accessible/src/generic/HyperTextAccessible.cpp
@@ -11,34 +11,31 @@
 #include "DocAccessible.h"
 #include "Role.h"
 #include "States.h"
 #include "TextAttrs.h"
 
 #include "nsIClipboard.h"
 #include "nsContentUtils.h"
 #include "nsFocusManager.h"
-#include "nsIDOMCharacterData.h"
-#include "nsIDOMDocument.h"
 #include "nsIDOMRange.h"
-#include "nsIDOMXULDocument.h"
 #include "nsIEditingSession.h"
 #include "nsIEditor.h"
 #include "nsIFrame.h"
 #include "nsFrameSelection.h"
 #include "nsILineIterator.h"
 #include "nsIInterfaceRequestorUtils.h"
 #include "nsIPlaintextEditor.h"
 #include "nsIScrollableFrame.h"
-#include "nsISelectionPrivate.h"
 #include "nsIServiceManager.h"
 #include "nsTextFragment.h"
 #include "mozilla/Selection.h"
 #include "gfxSkipChars.h"
 
+using namespace mozilla;
 using namespace mozilla::a11y;
 
 ////////////////////////////////////////////////////////////////////////////////
 // HyperTextAccessible
 ////////////////////////////////////////////////////////////////////////////////
 
 HyperTextAccessible::
   HyperTextAccessible(nsIContent* aNode, DocAccessible* aDoc) :
@@ -517,19 +514,17 @@ HyperTextAccessible::DOMPointToHypertext
 
   if (aNodeOffset == -1) {
     findNode = aNode;
 
   } else if (aNode->IsNodeOfType(nsINode::eTEXT)) {
     // For text nodes, aNodeOffset comes in as a character offset
     // Text offset will be added at the end, if we find the offset in this hypertext
     // We want the "skipped" offset into the text (rendered text without the extra whitespace)
-    nsCOMPtr<nsIContent> content = do_QueryInterface(aNode);
-    NS_ASSERTION(content, "No nsIContent for dom node");
-    nsIFrame *frame = content->GetPrimaryFrame();
+    nsIFrame *frame = aNode->AsContent()->GetPrimaryFrame();
     NS_ENSURE_TRUE(frame, nsnull);
     nsresult rv = ContentToRenderedOffset(frame, aNodeOffset, &addTextOffset);
     NS_ENSURE_SUCCESS(rv, nsnull);
     // Get the child node and 
     findNode = aNode;
 
   } else {
     // findNode could be null if aNodeOffset == # of child nodes, which means
@@ -630,101 +625,66 @@ HyperTextAccessible::DOMPointToHypertext
       return childAccAtOffset;
     }
   }
 
   return nsnull;
 }
 
 nsresult
-HyperTextAccessible::HypertextOffsetToDOMPoint(PRInt32 aHTOffset,
-                                               nsIDOMNode** aNode,
-                                               PRInt32* aOffset)
-{
-  nsCOMPtr<nsIDOMNode> endNode;
-  PRInt32 endOffset;
-
-  return HypertextOffsetsToDOMRange(aHTOffset, aHTOffset, aNode, aOffset,
-                                    getter_AddRefs(endNode), &endOffset);
-}
-
-nsresult
 HyperTextAccessible::HypertextOffsetsToDOMRange(PRInt32 aStartHTOffset,
                                                 PRInt32 aEndHTOffset,
-                                                nsIDOMNode** aStartNode,
-                                                PRInt32* aStartOffset,
-                                                nsIDOMNode** aEndNode,
-                                                PRInt32* aEndOffset)
+                                                nsRange* aRange)
 {
-  NS_ENSURE_ARG_POINTER(aStartNode);
-  *aStartNode = nsnull;
-
-  NS_ENSURE_ARG_POINTER(aStartOffset);
-  *aStartOffset = -1;
-
-  NS_ENSURE_ARG_POINTER(aEndNode);
-  *aEndNode = nsnull;
-
-  NS_ENSURE_ARG_POINTER(aEndOffset);
-  *aEndOffset = -1;
-
   // If the given offsets are 0 and associated editor is empty then return
   // collapsed range with editor root element as range container.
   if (aStartHTOffset == 0 && aEndHTOffset == 0) {
     nsCOMPtr<nsIEditor> editor = GetEditor();
     if (editor) {
       bool isEmpty = false;
       editor->GetDocumentIsEmpty(&isEmpty);
       if (isEmpty) {
         nsCOMPtr<nsIDOMElement> editorRootElm;
         editor->GetRootElement(getter_AddRefs(editorRootElm));
 
-        nsCOMPtr<nsIDOMNode> editorRoot(do_QueryInterface(editorRootElm));
+        nsCOMPtr<nsINode> editorRoot(do_QueryInterface(editorRootElm));
         if (editorRoot) {
-          *aStartOffset = *aEndOffset = 0;
-          NS_ADDREF(*aStartNode = editorRoot);
-          NS_ADDREF(*aEndNode = editorRoot);
+          aRange->SetStart(editorRoot, 0);
+          aRange->SetEnd(editorRoot, 0);
 
           return NS_OK;
         }
       }
     }
   }
 
   nsRefPtr<Accessible> startAcc, endAcc;
   PRInt32 startOffset = aStartHTOffset, endOffset = aEndHTOffset;
   nsIFrame *startFrame = nsnull, *endFrame = nsnull;
 
   startFrame = GetPosAndText(startOffset, endOffset, nsnull, &endFrame, nsnull,
                              getter_AddRefs(startAcc), getter_AddRefs(endAcc));
   if (!startAcc || !endAcc)
     return NS_ERROR_FAILURE;
 
-  nsCOMPtr<nsIDOMNode> startNode, endNode;
+  DOMPoint startPoint, endPoint;
   nsresult rv = GetDOMPointByFrameOffset(startFrame, startOffset, startAcc,
-                                         getter_AddRefs(startNode),
-                                         &startOffset);
+                                         &startPoint);
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  rv = aRange->SetStart(startPoint.node, startPoint.idx);
   NS_ENSURE_SUCCESS(rv, rv);
 
-  if (aStartHTOffset != aEndHTOffset) {
-    rv = GetDOMPointByFrameOffset(endFrame, endOffset, endAcc,
-                                  getter_AddRefs(endNode), &endOffset);
-    NS_ENSURE_SUCCESS(rv, rv);
-  } else {
-    endNode = startNode;
-    endOffset = startOffset;
-  }
+  if (aStartHTOffset == aEndHTOffset)
+    return aRange->SetEnd(startPoint.node, startPoint.idx);
 
-  NS_ADDREF(*aStartNode = startNode);
-  *aStartOffset = startOffset;
+  rv = GetDOMPointByFrameOffset(endFrame, endOffset, endAcc, &endPoint);
+  NS_ENSURE_SUCCESS(rv, rv);
 
-  NS_ADDREF(*aEndNode = endNode);
-  *aEndOffset = endOffset;
-
-  return NS_OK;
+  return aRange->SetEnd(endPoint.node, endPoint.idx);
 }
 
 PRInt32
 HyperTextAccessible::GetRelativeOffset(nsIPresShell* aPresShell,
                                        nsIFrame* aFromFrame,
                                        PRInt32 aFromOffset,
                                        Accessible* aFromAccessible,
                                        nsSelectionAmount aAmount,
@@ -1550,28 +1510,22 @@ HyperTextAccessible::SetSelectionRange(P
   // Set the selection
   SetSelectionBounds(0, aStartPos, aEndPos);
 
   // If range 0 was successfully set, clear any additional selection 
   // ranges remaining from previous selection
   nsRefPtr<nsFrameSelection> frameSelection = FrameSelection();
   NS_ENSURE_STATE(frameSelection);
 
-  nsCOMPtr<nsISelection> domSel =
+  Selection* domSel =
     frameSelection->GetSelection(nsISelectionController::SELECTION_NORMAL);
   NS_ENSURE_STATE(domSel);
 
-  PRInt32 numRanges = 0;
-  domSel->GetRangeCount(&numRanges);
-
-  for (PRInt32 count = 0; count < numRanges - 1; count ++) {
-    nsCOMPtr<nsIDOMRange> range;
-    domSel->GetRangeAt(1, getter_AddRefs(range));
-    domSel->RemoveRange(range);
-  }
+  for (PRInt32 idx = domSel->GetRangeCount() - 1; idx > 0; idx--)
+    domSel->RemoveRange(domSel->GetRangeAt(idx));
 
   // When selection is done, move the focus to the selection if accessible is
   // not focusable. That happens when selection is set within hypertext
   // accessible.
   if (isFocusable)
     return NS_OK;
 
   nsFocusManager* DOMFocusManager = nsFocusManager::GetFocusManager();
@@ -1620,31 +1574,25 @@ HyperTextAccessible::GetCaretOffset(PRIn
   if (focusDisp == FocusManager::eNone)
     return NS_OK;
 
   // Turn the focus node and offset of the selection into caret hypretext
   // offset.
   nsRefPtr<nsFrameSelection> frameSelection = FrameSelection();
   NS_ENSURE_STATE(frameSelection);
 
-  nsISelection* domSel =
+  Selection* domSel =
     frameSelection->GetSelection(nsISelectionController::SELECTION_NORMAL);
   NS_ENSURE_STATE(domSel);
 
-  nsCOMPtr<nsIDOMNode> focusDOMNode;
-  nsresult rv = domSel->GetFocusNode(getter_AddRefs(focusDOMNode));
-  NS_ENSURE_SUCCESS(rv, rv);
-
-  PRInt32 focusOffset;
-  rv = domSel->GetFocusOffset(&focusOffset);
-  NS_ENSURE_SUCCESS(rv, rv);
+  nsINode* focusNode = domSel->GetFocusNode();
+  PRInt32 focusOffset = domSel->GetFocusOffset();
 
   // No caret if this DOM node is inside of focused node but the selection's
   // focus point is not inside of this DOM node.
-  nsCOMPtr<nsINode> focusNode(do_QueryInterface(focusDOMNode));
   if (focusDisp == FocusManager::eContainedByFocus) {
     nsINode *resultNode =
       nsCoreUtils::GetDOMNodeFromDOMPoint(focusNode, focusOffset);
 
     nsINode* thisNode = GetNode();
     if (resultNode != thisNode &&
         !nsCoreUtils::IsAncestorOf(thisNode, resultNode))
       return NS_OK;
@@ -1658,29 +1606,31 @@ PRInt32
 HyperTextAccessible::CaretLineNumber()
 {
   // Provide the line number for the caret, relative to the
   // currently focused node. Use a 1-based index
   nsRefPtr<nsFrameSelection> frameSelection = FrameSelection();
   if (!frameSelection)
     return -1;
 
-  nsISelection* domSel =
+  Selection* domSel =
     frameSelection->GetSelection(nsISelectionController::SELECTION_NORMAL);
   if (!domSel)
     return - 1;
 
-  nsCOMPtr<nsIDOMNode> caretNode;
-  domSel->GetFocusNode(getter_AddRefs(caretNode));
-  nsCOMPtr<nsIContent> caretContent = do_QueryInterface(caretNode);
-  if (!caretContent || !nsCoreUtils::IsAncestorOf(GetNode(), caretContent))
+  nsINode* caretNode = domSel->GetFocusNode();
+  if (!caretNode || !caretNode->IsContent())
     return -1;
 
-  PRInt32 caretOffset, returnOffsetUnused;
-  domSel->GetFocusOffset(&caretOffset);
+  nsIContent* caretContent = caretNode->AsContent();
+  if (!nsCoreUtils::IsAncestorOf(GetNode(), caretContent))
+    return -1;
+
+  PRInt32 returnOffsetUnused;
+  PRInt32 caretOffset = domSel->GetFocusOffset();
   nsFrameSelection::HINT hint = frameSelection->GetHint();
   nsIFrame *caretFrame = frameSelection->GetFrameForNodeOffset(caretContent, caretOffset,
                                                                hint, &returnOffsetUnused);
   NS_ENSURE_TRUE(caretFrame, -1);
 
   PRInt32 lineNumber = 1;
   nsAutoLineIterator lineIterForCaret;
   nsIContent *hyperTextContent = IsContent() ? mContent.get() : nsnull;
@@ -1731,35 +1681,34 @@ HyperTextAccessible::FrameSelection()
 void
 HyperTextAccessible::GetSelectionDOMRanges(PRInt16 aType,
                                            nsTArray<nsRange*>* aRanges)
 {
   nsRefPtr<nsFrameSelection> frameSelection = FrameSelection();
   if (!frameSelection)
     return;
 
-  nsISelection* domSel = frameSelection->GetSelection(aType);
+  Selection* domSel = frameSelection->GetSelection(aType);
   if (!domSel)
     return;
 
   nsCOMPtr<nsINode> startNode = GetNode();
 
   nsCOMPtr<nsIEditor> editor = GetEditor();
   if (editor) {
     nsCOMPtr<nsIDOMElement> editorRoot;
     editor->GetRootElement(getter_AddRefs(editorRoot));
     startNode = do_QueryInterface(editorRoot);
   }
 
   if (!startNode)
     return;
 
   PRUint32 childCount = startNode->GetChildCount();
-  nsCOMPtr<nsISelectionPrivate> privSel(do_QueryInterface(domSel));
-  nsresult rv = privSel->
+  nsresult rv = domSel->
     GetRangesForIntervalArray(startNode, 0, startNode, childCount, true, aRanges);
   NS_ENSURE_SUCCESS(rv,);
 
   // Remove collapsed ranges
   PRUint32 numRanges = aRanges->Length();
   for (PRUint32 idx = 0; idx < numRanges; idx ++) {
     if ((*aRanges)[idx]->Collapsed()) {
       aRanges->RemoveElementAt(idx);
@@ -1837,53 +1786,42 @@ HyperTextAccessible::GetSelectionBounds(
 /*
  * Changes the start and end offset of the specified selection.
  */
 NS_IMETHODIMP
 HyperTextAccessible::SetSelectionBounds(PRInt32 aSelectionNum,
                                         PRInt32 aStartOffset,
                                         PRInt32 aEndOffset)
 {
+  if (IsDefunct())
+    return NS_ERROR_FAILURE;
+
+  if (aSelectionNum < 0)
+    return NS_ERROR_INVALID_ARG;
+
   nsRefPtr<nsFrameSelection> frameSelection = FrameSelection();
   NS_ENSURE_STATE(frameSelection);
 
-  nsCOMPtr<nsISelection> domSel =
+  Selection* domSel =
     frameSelection->GetSelection(nsISelectionController::SELECTION_NORMAL);
   NS_ENSURE_STATE(domSel);
 
+  PRUint32 rangeCount = domSel->GetRangeCount();
+  if (rangeCount < static_cast<PRUint32>(aSelectionNum))
+    return NS_ERROR_INVALID_ARG;
+
   // Caret is a collapsed selection
   bool isOnlyCaret = (aStartOffset == aEndOffset);
-
-  PRInt32 rangeCount = 0;
-  domSel->GetRangeCount(&rangeCount);
-  nsCOMPtr<nsIDOMRange> range;
-  if (aSelectionNum == rangeCount) { // Add a range
+  nsRefPtr<nsRange> range;
+  if (aSelectionNum == rangeCount)
     range = new nsRange();
-  }
-  else if (aSelectionNum < 0 || aSelectionNum > rangeCount) {
-    return NS_ERROR_INVALID_ARG;
-  }
-  else {
-    domSel->GetRangeAt(aSelectionNum, getter_AddRefs(range));
-    NS_ENSURE_TRUE(range, NS_ERROR_FAILURE);
-  }
+  else
+    range = domSel->GetRangeAt(aSelectionNum);
 
-  PRInt32 startOffset = 0, endOffset = 0;
-  nsCOMPtr<nsIDOMNode> startNode, endNode;
-
-  nsresult rv = HypertextOffsetsToDOMRange(aStartOffset, aEndOffset,
-                                           getter_AddRefs(startNode), &startOffset,
-                                           getter_AddRefs(endNode), &endOffset);
-  NS_ENSURE_SUCCESS(rv, rv);
-
-  rv = range->SetStart(startNode, startOffset);
-  NS_ENSURE_SUCCESS(rv, rv);
-
-  rv = isOnlyCaret ? range->Collapse(true) :
-                     range->SetEnd(endNode, endOffset);
+  nsresult rv = HypertextOffsetsToDOMRange(aStartOffset, aEndOffset, range);
   NS_ENSURE_SUCCESS(rv, rv);
 
   // If new range was created then add it, otherwise notify selection listeners
   // that existing selection range was changed.
   if (aSelectionNum == rangeCount)
     return domSel->AddRange(range);
 
   domSel->RemoveRange(range);
@@ -1895,68 +1833,57 @@ HyperTextAccessible::SetSelectionBounds(
  * Adds a selection bounded by the specified offsets.
  */
 NS_IMETHODIMP
 HyperTextAccessible::AddSelection(PRInt32 aStartOffset, PRInt32 aEndOffset)
 {
   nsRefPtr<nsFrameSelection> frameSelection = FrameSelection();
   NS_ENSURE_STATE(frameSelection);
 
-  nsCOMPtr<nsISelection> domSel =
+  Selection* domSel =
     frameSelection->GetSelection(nsISelectionController::SELECTION_NORMAL);
   NS_ENSURE_STATE(domSel);
 
-  PRInt32 rangeCount = 0;
-  domSel->GetRangeCount(&rangeCount);
-
-  return SetSelectionBounds(rangeCount, aStartOffset, aEndOffset);
+  return SetSelectionBounds(domSel->GetRangeCount(), aStartOffset, aEndOffset);
 }
 
 /*
  * Removes the specified selection.
  */
 NS_IMETHODIMP
 HyperTextAccessible::RemoveSelection(PRInt32 aSelectionNum)
 {
   nsRefPtr<nsFrameSelection> frameSelection = FrameSelection();
   NS_ENSURE_STATE(frameSelection);
 
-  nsCOMPtr<nsISelection> domSel =
+  Selection* domSel =
     frameSelection->GetSelection(nsISelectionController::SELECTION_NORMAL);
   NS_ENSURE_STATE(domSel);
 
-  PRInt32 rangeCount;
-  domSel->GetRangeCount(&rangeCount);
-  if (aSelectionNum < 0 || aSelectionNum >= rangeCount)
+  if (aSelectionNum < 0 || aSelectionNum >= domSel->GetRangeCount())
     return NS_ERROR_INVALID_ARG;
 
-  nsCOMPtr<nsIDOMRange> range;
-  domSel->GetRangeAt(aSelectionNum, getter_AddRefs(range));
-  return domSel->RemoveRange(range);
+  return domSel->RemoveRange(domSel->GetRangeAt(aSelectionNum));
 }
 
 // void nsIAccessibleText::
 //   scrollSubstringTo(in long startIndex, in long endIndex,
 //                     in unsigned long scrollType);
 NS_IMETHODIMP
 HyperTextAccessible::ScrollSubstringTo(PRInt32 aStartIndex, PRInt32 aEndIndex,
                                        PRUint32 aScrollType)
 {
-  PRInt32 startOffset, endOffset;
-  nsCOMPtr<nsIDOMNode> startNode, endNode;
+  if (IsDefunct())
+    return NS_ERROR_FAILURE;
 
-  nsresult rv = HypertextOffsetsToDOMRange(aStartIndex, aEndIndex,
-                                           getter_AddRefs(startNode),
-                                           &startOffset,
-                                           getter_AddRefs(endNode),
-                                           &endOffset);
+  nsRefPtr<nsRange> range = new nsRange();
+  nsresult rv = HypertextOffsetsToDOMRange(aStartIndex, aEndIndex, range);
   NS_ENSURE_SUCCESS(rv, rv);
 
-  return nsCoreUtils::ScrollSubstringTo(GetFrame(), startNode, startOffset,
-                                        endNode, endOffset, aScrollType);
+  return nsCoreUtils::ScrollSubstringTo(GetFrame(), range, aScrollType);
 }
 
 // void nsIAccessibleText::
 //   scrollSubstringToPoint(in long startIndex, in long endIndex,
 //                          in unsigned long coordinateType,
 //                          in long x, in long y);
 NS_IMETHODIMP
 HyperTextAccessible::ScrollSubstringToPoint(PRInt32 aStartIndex,
@@ -1968,22 +1895,18 @@ HyperTextAccessible::ScrollSubstringToPo
   if (!frame)
     return NS_ERROR_FAILURE;
 
   nsIntPoint coords;
   nsresult rv = nsAccUtils::ConvertToScreenCoords(aX, aY, aCoordinateType,
                                                   this, &coords);
   NS_ENSURE_SUCCESS(rv, rv);
 
-  PRInt32 startOffset, endOffset;
-  nsCOMPtr<nsIDOMNode> startNode, endNode;
-
-  rv = HypertextOffsetsToDOMRange(aStartIndex, aEndIndex,
-                                  getter_AddRefs(startNode), &startOffset,
-                                  getter_AddRefs(endNode), &endOffset);
+  nsRefPtr<nsRange> range = new nsRange();
+  rv = HypertextOffsetsToDOMRange(aStartIndex, aEndIndex, range);
   NS_ENSURE_SUCCESS(rv, rv);
 
   nsPresContext *presContext = frame->PresContext();
 
   bool initialScrolled = false;
   nsIFrame *parentFrame = frame;
   while ((parentFrame = parentFrame->GetParent())) {
     nsIScrollableFrame *scrollableFrame = do_QueryFrame(parentFrame);
@@ -2002,19 +1925,17 @@ HyperTextAccessible::ScrollSubstringToPo
 
         // avoid divide by zero
         size.width = size.width ? size.width : 1;
         size.height = size.height ? size.height : 1;
 
         PRInt16 hPercent = offsetPoint.x * 100 / size.width;
         PRInt16 vPercent = offsetPoint.y * 100 / size.height;
 
-        rv = nsCoreUtils::ScrollSubstringTo(GetFrame(), startNode, startOffset,
-                                            endNode, endOffset,
-                                            vPercent, hPercent);
+        rv = nsCoreUtils::ScrollSubstringTo(frame, range, vPercent, hPercent);
         NS_ENSURE_SUCCESS(rv, rv);
 
         initialScrolled = true;
       } else {
         // Substring was scrolled to the given point already inside its closest
         // scrollable area. If there are nested scrollable areas then make
         // sure we scroll lower areas to the given point inside currently
         // traversed scrollable area.
@@ -2224,62 +2145,57 @@ HyperTextAccessible::GetChildIndexAtOffs
 
   return -1;
 }
 
 ////////////////////////////////////////////////////////////////////////////////
 // HyperTextAccessible protected
 
 nsresult
-HyperTextAccessible::GetDOMPointByFrameOffset(nsIFrame* aFrame,
-                                              PRInt32 aOffset,
+HyperTextAccessible::GetDOMPointByFrameOffset(nsIFrame* aFrame, PRInt32 aOffset,
                                               Accessible* aAccessible,
-                                              nsIDOMNode** aNode,
-                                              PRInt32* aNodeOffset)
+                                              DOMPoint* aPoint)
 {
   NS_ENSURE_ARG(aAccessible);
 
-  nsCOMPtr<nsIDOMNode> node;
-
   if (!aFrame) {
     // If the given frame is null then set offset after the DOM node of the
     // given accessible.
     NS_ASSERTION(!aAccessible->IsDoc(), 
                  "Shouldn't be called on document accessible!");
 
     nsIContent* content = aAccessible->GetContent();
     NS_ASSERTION(content, "Shouldn't operate on defunct accessible!");
 
     nsIContent* parent = content->GetParent();
 
-    *aNodeOffset = parent->IndexOf(content) + 1;
-    node = do_QueryInterface(parent);
+    aPoint->idx = parent->IndexOf(content) + 1;
+    aPoint->node = parent;
 
   } else if (aFrame->GetType() == nsGkAtoms::textFrame) {
-    nsCOMPtr<nsIContent> content(aFrame->GetContent());
+    nsIContent* content = aFrame->GetContent();
     NS_ENSURE_STATE(content);
 
     nsIFrame *primaryFrame = content->GetPrimaryFrame();
-    nsresult rv = RenderedToContentOffset(primaryFrame, aOffset, aNodeOffset);
+    nsresult rv = RenderedToContentOffset(primaryFrame, aOffset, &(aPoint->idx));
     NS_ENSURE_SUCCESS(rv, rv);
 
-    node = do_QueryInterface(content);
+    aPoint->node = content;
 
   } else {
-    nsCOMPtr<nsIContent> content(aFrame->GetContent());
+    nsIContent* content = aFrame->GetContent();
     NS_ENSURE_STATE(content);
 
-    nsCOMPtr<nsIContent> parent(content->GetParent());
+    nsIContent* parent = content->GetParent();
     NS_ENSURE_STATE(parent);
 
-    *aNodeOffset = parent->IndexOf(content);
-    node = do_QueryInterface(parent);
+    aPoint->idx = parent->IndexOf(content);
+    aPoint->node = parent;
   }
 
-  NS_IF_ADDREF(*aNode = node);
   return NS_OK;
 }
 
 // HyperTextAccessible
 nsresult
 HyperTextAccessible::RangeBoundToHypertextOffset(nsRange* aRange,
                                                  bool aIsStartBound,
                                                  bool aIsStartHTOffset,

--- a/accessible/src/generic/HyperTextAccessible.h
+++ b/accessible/src/generic/HyperTextAccessible.h
@@ -11,16 +11,25 @@
 #include "nsIAccessibleEditableText.h"
 
 #include "AccCollector.h"
 #include "AccessibleWrap.h"
 
 #include "nsFrameSelection.h"
 #include "nsISelectionController.h"
 
+namespace mozilla {
+namespace a11y {
+struct DOMPoint {
+  nsINode* node;
+  PRInt32 idx;
+};
+}
+}
+
 enum EGetTextType { eGetBefore=-1, eGetAt=0, eGetAfter=1 };
 
 // This character marks where in the text returned via nsIAccessibleText(),
 // that embedded object characters exist
 const PRUnichar kEmbeddedObjectChar = 0xfffc;
 const PRUnichar kImaginaryEmbeddedObjectChar = ' ';
 const PRUnichar kForcedNewLineChar = '\n';
 
@@ -126,42 +135,25 @@ public:
     *                       otherwise nsnull
     */
   Accessible* DOMPointToHypertextOffset(nsINode *aNode,
                                         PRInt32 aNodeOffset,
                                         PRInt32* aHypertextOffset,
                                         bool aIsEndOffset = false);
 
   /**
-   * Turn a hypertext offsets into DOM point.
-   *
-   * @param  aHTOffset  [in] the given start hypertext offset
-   * @param  aNode      [out] start node
-   * @param  aOffset    [out] offset inside the start node
-   */
-  nsresult HypertextOffsetToDOMPoint(PRInt32 aHTOffset,
-                                     nsIDOMNode **aNode,
-                                     PRInt32 *aOffset);
-
-  /**
    * Turn a start and end hypertext offsets into DOM range.
    *
    * @param  aStartHTOffset  [in] the given start hypertext offset
    * @param  aEndHTOffset    [in] the given end hypertext offset
-   * @param  aStartNode      [out] start node of the range
-   * @param  aStartOffset    [out] start offset of the range
-   * @param  aEndNode        [out] end node of the range
-   * @param  aEndOffset      [out] end offset of the range
+   * @param  aRange      [out] the range whose bounds to set
    */
   nsresult HypertextOffsetsToDOMRange(PRInt32 aStartHTOffset,
                                       PRInt32 aEndHTOffset,
-                                      nsIDOMNode **aStartNode,
-                                      PRInt32 *aStartOffset,
-                                      nsIDOMNode **aEndNode,
-                                      PRInt32 *aEndOffset);
+                                      nsRange* aRange);
 
   /**
    * Return true if the used ARIA role (if any) allows the hypertext accessible
    * to expose text interfaces.
    */
   bool IsTextRole();
 
   //////////////////////////////////////////////////////////////////////////////
@@ -350,17 +342,17 @@ protected:
    */
   void GetSelectionDOMRanges(PRInt16 aType, nsTArray<nsRange*>* aRanges);
 
   nsresult SetSelectionRange(PRInt32 aStartPos, PRInt32 aEndPos);
 
   // Helpers
   nsresult GetDOMPointByFrameOffset(nsIFrame* aFrame, PRInt32 aOffset,
                                     Accessible* aAccessible,
-                                    nsIDOMNode** aNode, PRInt32* aNodeOffset);
+                                    mozilla::a11y::DOMPoint* aPoint);
 
   
   /**
    * Return hyper text offset for the specified bound of the given DOM range.
    * If the bound is outside of the hyper text then offset value is either
    * 0 or number of characters of hyper text, it depends on type of requested
    * offset. The method is a wrapper for DOMPointToHypertextOffset.
    *

--- a/accessible/src/generic/ImageAccessible.cpp
+++ b/accessible/src/generic/ImageAccessible.cpp
@@ -14,17 +14,16 @@
 #include "imgIRequest.h"
 #include "nsGenericHTMLElement.h"
 #include "nsIDocument.h"
 #include "nsIImageLoadingContent.h"
 #include "nsILink.h"
 #include "nsIPresShell.h"
 #include "nsIServiceManager.h"
 #include "nsIDOMHTMLImageElement.h"
-#include "nsIDOMDocument.h"
 #include "nsPIDOMWindow.h"
 
 using namespace mozilla::a11y;
 
 ////////////////////////////////////////////////////////////////////////////////
 // ImageAccessible
 ////////////////////////////////////////////////////////////////////////////////
 

--- a/accessible/src/generic/RootAccessible.cpp
+++ b/accessible/src/generic/RootAccessible.cpp
@@ -38,19 +38,17 @@
 #include "nsIDOMHTMLSelectElement.h"
 #include "nsIDOMDataContainerEvent.h"
 #include "nsIDOMNSEvent.h"
 #include "nsIDOMXULMultSelectCntrlEl.h"
 #include "nsIDOMXULPopupElement.h"
 #include "nsIDocument.h"
 #include "nsEventListenerManager.h"
 #include "nsIFrame.h"
-#include "nsIHTMLDocument.h"
 #include "nsIInterfaceRequestorUtils.h"
-#include "nsISelectionPrivate.h"
 #include "nsIServiceManager.h"
 #include "nsPIDOMWindow.h"
 #include "nsIWebBrowserChrome.h"
 #include "nsReadableUtils.h"
 #include "nsFocusManager.h"
 
 #ifdef MOZ_XUL
 #include "nsIXULDocument.h"

--- a/accessible/src/html/HTMLFormControlAccessible.cpp
+++ b/accessible/src/html/HTMLFormControlAccessible.cpp
@@ -10,17 +10,16 @@
 #include "nsARIAMap.h"
 #include "nsTextEquivUtils.h"
 #include "Relation.h"
 #include "Role.h"
 #include "States.h"
 
 #include "nsContentList.h"
 #include "nsIAccessibleRelation.h"
-#include "nsIDOMDocument.h"
 #include "nsIDOMHTMLInputElement.h"
 #include "nsIDOMNSEditableElement.h"
 #include "nsIDOMHTMLFormElement.h"
 #include "nsIDOMHTMLLegendElement.h"
 #include "nsIDOMHTMLTextAreaElement.h"
 #include "nsIDOMNodeList.h"
 #include "nsIEditor.h"
 #include "nsIFormControl.h"

--- a/accessible/src/msaa/AccessibleWrap.cpp
+++ b/accessible/src/msaa/AccessibleWrap.cpp
@@ -25,17 +25,16 @@
 #include "AccessibleStates.h"
 #include "RootAccessible.h"
 
 #ifdef DEBUG
 #include "Logging.h"
 #endif
 
 #include "nsIMutableArray.h"
-#include "nsIDOMDocument.h"
 #include "nsIFrame.h"
 #include "nsIScrollableFrame.h"
 #include "nsINameSpaceManager.h"
 #include "nsINodeInfo.h"
 #include "nsIServiceManager.h"
 #include "nsTextFormatter.h"
 #include "nsIView.h"
 #include "nsIViewManager.h"

--- a/accessible/src/msaa/HyperTextAccessibleWrap.cpp
+++ b/accessible/src/msaa/HyperTextAccessibleWrap.cpp
@@ -7,20 +7,41 @@
 
 #include "HyperTextAccessibleWrap.h"
 
 #include "nsEventShell.h"
 
 NS_IMPL_ISUPPORTS_INHERITED0(HyperTextAccessibleWrap,
                              HyperTextAccessible)
 
-IMPL_IUNKNOWN_INHERITED2(HyperTextAccessibleWrap,
-                         AccessibleWrap,
-                         ia2AccessibleHypertext,
-                         ia2AccessibleEditableText);
+STDMETHODIMP
+HyperTextAccessibleWrap::QueryInterface(REFIID aIID, void** aInstancePtr)
+{
+  if (!aInstancePtr)
+    return E_FAIL;
+
+  *aInstancePtr = NULL;
+
+  if (IsTextRole()) {
+    if (aIID == IID_IAccessibleText)
+      *aInstancePtr =
+        static_cast<IAccessibleText*>(static_cast<ia2AccessibleText*>(this));
+    else if (aIID == IID_IAccessibleHypertext)
+      *aInstancePtr = static_cast<IAccessibleHypertext*>(this);
+    else if (aIID == IID_IAccessibleEditableText)
+      *aInstancePtr = static_cast<IAccessibleEditableText*>(this);
+
+    if (*aInstancePtr) {
+      AddRef();
+      return S_OK;
+    }
+  }
+
+  return AccessibleWrap::QueryInterface(aIID, aInstancePtr);
+}
 
 nsresult
 HyperTextAccessibleWrap::HandleAccEvent(AccEvent* aEvent)
 {
   PRUint32 eventType = aEvent->GetEventType();
 
   if (eventType == nsIAccessibleEvent::EVENT_TEXT_REMOVED ||
       eventType == nsIAccessibleEvent::EVENT_TEXT_INSERTED) {

--- a/accessible/src/msaa/TextLeafAccessibleWrap.cpp
+++ b/accessible/src/msaa/TextLeafAccessibleWrap.cpp
@@ -150,20 +150,25 @@ STDMETHODIMP
 TextLeafAccessibleWrap::scrollToSubstring(
     /* [in] */ unsigned int aStartIndex,
     /* [in] */ unsigned int aEndIndex)
 {
 __try {
   if (IsDefunct())
     return E_FAIL;
 
-  nsCOMPtr<nsIDOMNode> DOMNode(do_QueryInterface(mContent));
+  nsRefPtr<nsRange> range = new nsRange();
+  if (NS_FAILED(range->SetStart(mContent, aStartIndex)))
+      return E_FAIL;
+
+  if (NS_FAILED(range->SetEnd(mContent, aEndIndex)))
+  return E_FAIL;
+
   nsresult rv =
-    nsCoreUtils::ScrollSubstringTo(GetFrame(), DOMNode, aStartIndex,
-                                   DOMNode, aEndIndex,
+    nsCoreUtils::ScrollSubstringTo(GetFrame(), range,
                                    nsIAccessibleScrollType::SCROLL_TYPE_ANYWHERE);
   if (NS_FAILED(rv))
     return E_FAIL;
 } __except(FilterA11yExceptions(::GetExceptionCode(), GetExceptionInformation())) { }
   return S_OK;
 }
 
 nsIFrame*

--- a/accessible/src/msaa/ia2AccessibleEditableText.cpp
+++ b/accessible/src/msaa/ia2AccessibleEditableText.cpp
@@ -8,35 +8,16 @@
 #include "ia2AccessibleEditableText.h"
 
 #include "AccessibleEditableText_i.c"
 #include "HyperTextAccessibleWrap.h"
 
 #include "nsCOMPtr.h"
 #include "nsString.h"
 
-// IUnknown
-
-STDMETHODIMP
-ia2AccessibleEditableText::QueryInterface(REFIID iid, void** ppv)
-{
-  *ppv = NULL;
-
-  if (IID_IAccessibleEditableText == iid) {
-    nsCOMPtr<nsIAccessibleEditableText> editTextAcc(do_QueryObject(this));
-    if (!editTextAcc)
-      return E_NOINTERFACE;
-    *ppv = static_cast<IAccessibleEditableText*>(this);
-    (reinterpret_cast<IUnknown*>(*ppv))->AddRef(); 
-    return S_OK;
-  }
-
-  return E_NOINTERFACE;
-}
-
 // IAccessibleEditableText
 
 STDMETHODIMP
 ia2AccessibleEditableText::copyText(long aStartOffset, long aEndOffset)
 {
 __try {
   HyperTextAccessible* textAcc = static_cast<HyperTextAccessibleWrap*>(this);
   if (textAcc->IsDefunct())

--- a/accessible/src/msaa/ia2AccessibleEditableText.h
+++ b/accessible/src/msaa/ia2AccessibleEditableText.h
@@ -12,19 +12,16 @@
 #include "nsIAccessibleEditableText.h"
 
 #include "AccessibleEditableText.h"
 
 class ia2AccessibleEditableText: public IAccessibleEditableText
 {
 public:
 
-  // IUnknown
-  STDMETHODIMP QueryInterface(REFIID, void**);
-
   // IAccessibleEditableText
   virtual HRESULT STDMETHODCALLTYPE copyText(
       /* [in] */ long startOffset,
       /* [in] */ long endOffset);
 
   virtual HRESULT STDMETHODCALLTYPE deleteText(
       /* [in] */ long startOffset,
       /* [in] */ long endOffset);

--- a/accessible/src/msaa/ia2AccessibleHypertext.cpp
+++ b/accessible/src/msaa/ia2AccessibleHypertext.cpp
@@ -6,35 +6,16 @@
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 #include "ia2AccessibleHypertext.h"
 
 #include "AccessibleHypertext_i.c"
 
 #include "HyperTextAccessibleWrap.h"
 
-// IUnknown
-
-STDMETHODIMP
-ia2AccessibleHypertext::QueryInterface(REFIID iid, void** ppv)
-{
-  *ppv = NULL;
-  if (IID_IAccessibleHypertext == iid) {
-    HyperTextAccessibleWrap* hyperAcc = static_cast<HyperTextAccessibleWrap*>(this);
-    if (hyperAcc->IsTextRole()) {
-      *ppv = static_cast<IAccessibleHypertext*>(this);
-      (reinterpret_cast<IUnknown*>(*ppv))->AddRef();
-      return S_OK;
-    }
-    return E_NOINTERFACE;
-  }
-
-  return ia2AccessibleText::QueryInterface(iid, ppv);
-}
-
 // IAccessibleHypertext
 
 STDMETHODIMP
 ia2AccessibleHypertext::get_nHyperlinks(long* aHyperlinkCount)
 {
 __try {
   *aHyperlinkCount = 0;
 

--- a/accessible/src/msaa/ia2AccessibleHypertext.h
+++ b/accessible/src/msaa/ia2AccessibleHypertext.h
@@ -13,19 +13,16 @@
 #include "ia2AccessibleText.h"
 #include "AccessibleHypertext.h"
 
 class ia2AccessibleHypertext : public ia2AccessibleText,
                                public IAccessibleHypertext
 {
 public:
 
-  // IUnknown
-  STDMETHODIMP QueryInterface(REFIID, void**);
-
   // IAccessibleText
   FORWARD_IACCESSIBLETEXT(ia2AccessibleText)
 
   // IAccessibleHypertext
   virtual /* [propget] */ HRESULT STDMETHODCALLTYPE get_nHyperlinks(
       /* [retval][out] */ long* hyperlinkCount);
 
   virtual /* [propget] */ HRESULT STDMETHODCALLTYPE get_hyperlink(

--- a/accessible/src/msaa/ia2AccessibleText.cpp
+++ b/accessible/src/msaa/ia2AccessibleText.cpp
@@ -9,36 +9,16 @@
 
 #include "Accessible2.h"
 #include "AccessibleText_i.c"
 
 #include "HyperTextAccessibleWrap.h"
 
 #include "nsIPersistentProperties2.h"
 
-// IUnknown
-
-STDMETHODIMP
-ia2AccessibleText::QueryInterface(REFIID iid, void** ppv)
-{
-  *ppv = NULL;
-
-  if (IID_IAccessibleText == iid) {
-    nsCOMPtr<nsIAccessibleText> textAcc(do_QueryObject(this));
-    if (!textAcc) {
-      return E_NOINTERFACE;
-    }
-    *ppv = static_cast<IAccessibleText*>(this);
-    (reinterpret_cast<IUnknown*>(*ppv))->AddRef();
-    return S_OK;
-  }
-
-  return E_NOINTERFACE;
-}
-
 // IAccessibleText
 
 STDMETHODIMP
 ia2AccessibleText::addSelection(long aStartOffset, long aEndOffset)
 {
 __try {
   HyperTextAccessible* textAcc = static_cast<HyperTextAccessibleWrap*>(this);
   if (textAcc->IsDefunct())

--- a/accessible/src/msaa/ia2AccessibleText.h
+++ b/accessible/src/msaa/ia2AccessibleText.h
@@ -12,19 +12,16 @@
 #include "nsIAccessibleText.h"
 
 #include "AccessibleText.h"
 
 class ia2AccessibleText: public IAccessibleText
 {
 public:
 
-  // IUnknown
-  STDMETHODIMP QueryInterface(REFIID, void**);
-
   // IAccessibleText
   virtual HRESULT STDMETHODCALLTYPE addSelection(
       /* [in] */ long startOffset,
       /* [in] */ long endOffset);
 
   virtual /* [propget] */ HRESULT STDMETHODCALLTYPE get_attributes(
       /* [in] */ long offset,
       /* [out] */ long *startOffset,

--- a/accessible/src/msaa/nsAccessNodeWrap.cpp
+++ b/accessible/src/msaa/nsAccessNodeWrap.cpp
@@ -12,17 +12,16 @@
 #include "Compatibility.h"
 #include "nsAccessibilityService.h"
 #include "nsCoreUtils.h"
 #include "nsWinUtils.h"
 #include "RootAccessible.h"
 #include "Statistics.h"
 
 #include "nsAttrName.h"
-#include "nsIDocument.h"
 #include "nsIDOMNodeList.h"
 #include "nsIDOMHTMLElement.h"
 #include "nsIFrame.h"
 #include "nsINameSpaceManager.h"
 #include "nsPIDOMWindow.h"
 #include "nsIServiceManager.h"
 
 #include "mozilla/Preferences.h"

--- a/accessible/src/msaa/nsWinUtils.cpp
+++ b/accessible/src/msaa/nsWinUtils.cpp
@@ -8,16 +8,18 @@
 #include "nsWinUtils.h"
 
 #include "Compatibility.h"
 #include "DocAccessible.h"
 #include "nsCoreUtils.h"
 
 #include "mozilla/Preferences.h"
 #include "nsArrayUtils.h"
+#include "nsIArray.h"
+#include "nsIDocument.h"
 #include "nsIDocShellTreeItem.h"
 
 using namespace mozilla;
 using namespace mozilla::a11y;
 
 // Window property used by ipc related code in identifying accessible
 // tab windows.
 const PRUnichar* kPropNameTabContent = L"AccessibleTabWindow";

--- a/accessible/src/msaa/nsWinUtils.h
+++ b/accessible/src/msaa/nsWinUtils.h
@@ -4,19 +4,21 @@
 /* This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 #ifndef nsWinUtils_h_
 #define nsWinUtils_h_
 
 #include "Accessible2.h"
+#include "nsIDOMCSSStyleDeclaration.h"
+#include "nsCOMPtr.h"
 
-#include "nsIArray.h"
-#include "nsIDocument.h"
+class nsIArray;
+class nsIContent;
 
 const LPCWSTR kClassNameRoot = L"MozillaUIWindowClass";
 const LPCWSTR kClassNameTabContent = L"MozillaContentWindowClass";
 
 class nsWinUtils
 {
 public:
   /**

--- a/b2g/Makefile.in
+++ b/b2g/Makefile.in
@@ -4,16 +4,18 @@
 
 DEPTH      = ..
 topsrcdir  = @top_srcdir@
 srcdir     = @srcdir@
 VPATH      = @srcdir@
 
 include $(DEPTH)/config/autoconf.mk
 
-DIRS = chrome components locales app
+DIRS = chrome components locales
 
 ifeq ($(OS_ARCH),WINNT)
 DIRS += $(DEPTH)/xulrunner/tools/redit
 endif
 
+DIRS += app
+
 include $(topsrcdir)/config/rules.mk
 include $(topsrcdir)/testing/testsuite-targets.mk

--- a/b2g/chrome/content/shell.js
+++ b/b2g/chrome/content/shell.js
@@ -329,16 +329,27 @@ nsBrowserAccess.prototype = {
     throw new Error('Not Implemented');
   },
 
   isTabContentWindow: function isTabContentWindow(contentWindow) {
     return contentWindow == window;
   }
 };
 
+// Listen for system messages and relay them to Gaia.
+Services.obs.addObserver(function(aSubject, aTopic, aData) {
+  let msg = JSON.parse(aData);
+  let origin = Services.io.newURI(msg.manifest, null, null).prePath;
+  shell.sendEvent(shell.contentBrowser.contentWindow,
+                  "mozChromeEvent", { type: "open-app",
+                                      url: msg.uri,
+                                      origin: origin,
+                                      manifest: msg.manifest } );
+}, "system-messages-open-app", false);
+
 (function Repl() {
   if (!Services.prefs.getBoolPref('b2g.remote-js.enabled')) {
     return;
   }
   const prompt = 'JS> ';
   let output;
   let reader = {
     onInputStreamReady : function repl_readInput(input) {
@@ -385,17 +396,17 @@ var CustomEventManager = {
     window.addEventListener("ContentStart", (function(evt) {
       let content = shell.contentBrowser.contentWindow;
       content.addEventListener("mozContentEvent", this, false, true);
     }).bind(this), false);
   },
 
   handleEvent: function custevt_handleEvent(evt) {
     let detail = evt.detail;
-    dump('XXX FIXME : Got a mozContentEvent: ' + detail.type);
+    dump('XXX FIXME : Got a mozContentEvent: ' + detail.type + "\n");
 
     switch(detail.type) {
       case 'desktop-notification-click':
       case 'desktop-notification-close':
         AlertsHelper.handleEvent(detail);
         break;
       case 'webapps-install-granted':
       case 'webapps-install-denied':

deleted file mode 100644
--- a/b2g/config/mozconfigs/linux32/debug
+++ /dev/null
@@ -1,23 +0,0 @@
-#GONK_TOOLCHAIN_VERSION=0
-#TOOLCHAIN_HOST=linux-x86
-#export GONK_PRODUCT=generic
-#gonk="/home/cjones/mozilla/gonk-toolchain-$GONK_TOOLCHAIN_VERSION"
-
-mk_add_options MOZ_OBJDIR=@TOPSRCDIR@/obj-b2g
-
-mk_add_options MOZ_MAKE_FLAGS="-j8"
-
-ac_add_options --enable-application=b2g
-
-ac_add_options --target=arm-android-eabi
-ac_add_options --with-gonk="$gonk"
-ac_add_options --with-gonk-toolchain-prefix="$gonk/prebuilt/$TOOLCHAIN_HOST/toolchain/arm-eabi-4.4.3/bin/arm-eabi-"
-ac_add_options --with-endian=little
-ac_add_options --disable-elf-hack
-ac_add_options --enable-debug-symbols
-ac_add_options --enable-profiling
-ac_add_options --with-ccache
-ac_add_options --enable-marionette
-
-# Enable dump() from JS.
-export CXXFLAGS=-DMOZ_ENABLE_JS_DUMP

deleted file mode 100644
--- a/b2g/config/mozconfigs/linux32/nightly
+++ /dev/null
@@ -1,23 +0,0 @@
-#GONK_TOOLCHAIN_VERSION=0
-#TOOLCHAIN_HOST=linux-x86
-#export GONK_PRODUCT=generic
-#gonk="/home/cjones/mozilla/gonk-toolchain-$GONK_TOOLCHAIN_VERSION"
-
-mk_add_options MOZ_OBJDIR=@TOPSRCDIR@/obj-b2g
-
-mk_add_options MOZ_MAKE_FLAGS="-j8"
-
-ac_add_options --enable-application=b2g
-
-ac_add_options --target=arm-android-eabi
-ac_add_options --with-gonk="$gonk"
-ac_add_options --with-gonk-toolchain-prefix="$gonk/prebuilt/$TOOLCHAIN_HOST/toolchain/arm-eabi-4.4.3/bin/arm-eabi-"
-ac_add_options --with-endian=little
-ac_add_options --disable-elf-hack
-ac_add_options --enable-debug-symbols
-ac_add_options --enable-profiling
-ac_add_options --with-ccache
-ac_add_options --enable-marionette
-
-# Enable dump() from JS.
-export CXXFLAGS=-DMOZ_ENABLE_JS_DUMP

rename from b2g/config/mozconfigs/desktop/linux32/nightly
rename to b2g/config/mozconfigs/linux32_gecko/nightly
--- a/b2g/config/mozconfigs/desktop/linux32/nightly
+++ b/b2g/config/mozconfigs/linux32_gecko/nightly
@@ -1,18 +1,16 @@
 ac_add_options --enable-update-channel=${MOZ_UPDATE_CHANNEL}
 ac_add_options --enable-update-packaging
 ac_add_options --enable-codesighs
 ac_add_options --enable-signmar
 
 # Nightlies only since this has a cost in performance
 #ac_add_options --enable-js-diagnostics
 
-. $topsrcdir/build/unix/mozconfig.linux
-
 # Avoid dependency on libstdc++ 4.5
 ac_add_options --enable-stdcxx-compat
 
 # This will overwrite the default of stripping everything and keep the symbol table.
 # This is useful for profiling and debugging and only increases the package size
 # by 2 MBs.
 STRIP_FLAGS="--strip-debug"
 

rename from b2g/config/mozconfigs/desktop/linux64/nightly
rename to b2g/config/mozconfigs/linux64_gecko/nightly

rename from b2g/config/mozconfigs/desktop/macosx64/nightly
rename to b2g/config/mozconfigs/macosx64_gecko/nightly

rename from b2g/config/mozconfigs/desktop/win32/nightly
rename to b2g/config/mozconfigs/win32_gecko/nightly

--- a/b2g/confvars.sh
+++ b/b2g/confvars.sh
@@ -32,8 +32,10 @@ MOZ_XULRUNNER=1
 else
 MOZ_XULRUNNER=
 MOZ_PLACES=1
 fi
 
 MOZ_APP_ID={3c2e2abc-06d4-11e1-ac3b-374f68613e61}
 MOZ_EXTENSION_MANAGER=1
 ENABLE_MARIONETTE=1
+
+MOZ_SYS_MSG=1

--- a/b2g/installer/package-manifest.in
+++ b/b2g/installer/package-manifest.in
@@ -173,16 +173,17 @@
 @BINPATH@/components/dom_html.xpt
 @BINPATH@/components/dom_indexeddb.xpt
 @BINPATH@/components/dom_offline.xpt
 @BINPATH@/components/dom_json.xpt
 #ifdef MOZ_B2G_RIL
 @BINPATH@/components/dom_mms.xpt
 #endif
 @BINPATH@/components/dom_browserelement.xpt
+@BINPATH@/components/dom_messages.xpt
 @BINPATH@/components/dom_power.xpt
 @BINPATH@/components/dom_range.xpt
 @BINPATH@/components/dom_settings.xpt
 @BINPATH@/components/dom_sidebar.xpt
 @BINPATH@/components/dom_sms.xpt
 @BINPATH@/components/dom_storage.xpt
 @BINPATH@/components/dom_stylesheets.xpt
 @BINPATH@/components/dom_threads.xpt
@@ -458,16 +459,20 @@
 #endif
 @BINPATH@/components/TelemetryPing.js
 @BINPATH@/components/TelemetryPing.manifest
 @BINPATH@/components/Webapps.js
 @BINPATH@/components/Webapps.manifest
 @BINPATH@/components/AppsService.js
 @BINPATH@/components/AppsService.manifest
 
+@BINPATH@/components/SystemMessageInternal.js
+@BINPATH@/components/SystemMessageManager.js
+@BINPATH@/components/SystemMessageManager.manifest
+
 ; Modules
 @BINPATH@/modules/*
 
 ; Safe Browsing
 @BINPATH@/components/nsURLClassifier.manifest
 @BINPATH@/components/nsUrlClassifierHashCompleter.js
 @BINPATH@/components/nsUrlClassifierListManager.js
 @BINPATH@/components/nsUrlClassifierLib.js

--- a/browser/base/content/pageinfo/pageInfo.xul
+++ b/browser/base/content/pageinfo/pageInfo.xul
@@ -349,33 +349,28 @@
               <radio id="geo#2" command="cmd_geoToggle" label="&permBlock;"/>
             </radiogroup>
           </hbox>
         </vbox>
         <vbox class="permission">
           <label class="permissionLabel" id="permIndexedDBLabel"
                  value="&permIndexedDB;" control="indexedDBRadioGroup"/>
           <hbox role="group" aria-labelledby="permIndexedDBLabel">
-            <checkbox id="indexedDBDef" command="cmd_indexedDBDef" label="&permUseDefault;"/>
+            <checkbox id="indexedDBDef" command="cmd_indexedDBDef" label="&permAskAlways;"/>
             <spacer flex="1"/>
+            <vbox pack="center">
+              <label id="indexedDBStatus" control="indexedDBClear"/>
+            </vbox>
+            <button id="indexedDBClear" label="&permClearStorage;"
+                    accesskey="&permClearStorage.accesskey;" onclick="onIndexedDBClear();"/>
             <radiogroup id="indexedDBRadioGroup" orient="horizontal">
-              <!-- Ask and Allow are purposefully reversed here! -->
-              <radio id="indexedDB#1" command="cmd_indexedDBToggle" label="&permAskAlways;"/>
-              <radio id="indexedDB#0" command="cmd_indexedDBToggle" label="&permAllow;"/>
+              <radio id="indexedDB#1" command="cmd_indexedDBToggle" label="&permAllow;"/>
               <radio id="indexedDB#2" command="cmd_indexedDBToggle" label="&permBlock;"/>
             </radiogroup>
           </hbox>
-          <hbox>
-            <spacer flex="1"/>
-            <vbox pack="center">
-              <label id="indexedDBStatus" control="indexedDBClear" hidden="true"/>
-            </vbox>
-            <button id="indexedDBClear" label="&permClearStorage;" hidden="true"
-                    accesskey="&permClearStorage.accesskey;" onclick="onIndexedDBClear();"/>
-          </hbox>
         </vbox>
         <vbox class="permission" id="permPluginsRow">
           <label class="permissionLabel" id="permPluginsLabel"
                  value="&permPlugins;" control="pluginsRadioGroup"/>
           <hbox role="group" aria-labelledby="permPluginsLabel">
             <checkbox id="pluginsDef" command="cmd_pluginsDef" label="&permAskAlways;"/>
             <spacer flex="1"/>
             <radiogroup id="pluginsRadioGroup" orient="horizontal">