Bug 1524683 - Move all nsIFrameLoaderOwner references to nsFrameLoaderOwner; r=nika
authorKyle Machulis <kyle@nonpolynomial.com>
Fri, 15 Feb 2019 22:20:53 +0000
changeset 459658 a11e3f4d19db673bc84fcc386d992139c5354867
parent 459657 4c8b0589a4c878a01d8f58d43e524226bad98cd1
child 459659 51e0522e1ee97c0c3f3fc43e0f46fd62bd224e07
push id111982
push userccoroiu@mozilla.com
push dateSat, 16 Feb 2019 09:42:42 +0000
treeherdermozilla-inbound@7ab4a0c9980f [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersnika
bugs1524683
milestone67.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 1524683 - Move all nsIFrameLoaderOwner references to nsFrameLoaderOwner; r=nika Depends on D19728 Differential Revision: https://phabricator.services.mozilla.com/D19729
dom/base/InProcessTabChildMessageManager.cpp
dom/base/nsContentAreaDragDrop.cpp
dom/base/nsContentUtils.cpp
dom/base/nsFrameLoader.cpp
dom/base/nsFrameLoader.h
dom/base/nsObjectLoadingContent.cpp
dom/base/nsObjectLoadingContent.h
dom/base/nsOpenURIInFrameParams.cpp
dom/base/nsOpenURIInFrameParams.h
dom/events/EventStateManager.cpp
dom/html/HTMLEmbedElement.cpp
dom/html/HTMLEmbedElement.h
dom/html/HTMLFrameElement.h
dom/html/HTMLObjectElement.cpp
dom/html/HTMLObjectElement.h
dom/html/nsBrowserElement.h
dom/html/nsGenericHTMLFrameElement.cpp
dom/html/nsGenericHTMLFrameElement.h
dom/interfaces/base/nsIBrowserDOMWindow.idl
dom/ipc/ContentParent.cpp
dom/ipc/TabParent.cpp
dom/ipc/WindowGlobalParent.cpp
dom/presentation/PresentationSessionInfo.cpp
dom/webbrowserpersist/WebBrowserPersistLocalDocument.cpp
dom/webidl/MozFrameLoaderOwner.webidl
dom/xul/XULFrameElement.cpp
dom/xul/XULFrameElement.h
layout/generic/nsSubDocumentFrame.cpp
netwerk/base/LoadInfo.cpp
netwerk/base/nsILoadInfo.idl
toolkit/content/widgets/browser-custom-element.js
widget/nsBaseDragService.cpp
xpfe/appshell/nsIXULBrowserWindow.idl
--- a/dom/base/InProcessTabChildMessageManager.cpp
+++ b/dom/base/InProcessTabChildMessageManager.cpp
@@ -223,17 +223,17 @@ InProcessTabChildMessageManager::GetOwne
 
 void InProcessTabChildMessageManager::GetEventTargetParent(
     EventChainPreVisitor& aVisitor) {
   aVisitor.mForceContentDispatch = true;
   aVisitor.mCanHandle = true;
 
 #ifdef DEBUG
   if (mOwner) {
-    nsCOMPtr<nsIFrameLoaderOwner> owner = do_QueryInterface(mOwner);
+    RefPtr<nsFrameLoaderOwner> owner = do_QueryObject(mOwner);
     RefPtr<nsFrameLoader> fl = owner->GetFrameLoader();
     if (fl) {
       NS_ASSERTION(this == fl->GetTabChildMessageManager(),
                    "Wrong event target!");
       NS_ASSERTION(fl->mMessageManager == mChromeMessageManager,
                    "Wrong message manager!");
     }
   }
@@ -288,15 +288,15 @@ void InProcessTabChildMessageManager::Lo
   mLoadingScript = true;
   JS::Rooted<JSObject*> mm(mozilla::dom::RootingCx(), GetOrCreateWrapper());
   LoadScriptInternal(mm, aURL, !aRunInGlobalScope);
   mLoadingScript = tmp;
 }
 
 already_AddRefed<nsFrameLoader>
 InProcessTabChildMessageManager::GetFrameLoader() {
-  nsCOMPtr<nsIFrameLoaderOwner> owner = do_QueryInterface(mOwner);
+  RefPtr<nsFrameLoaderOwner> owner = do_QueryObject(mOwner);
   RefPtr<nsFrameLoader> fl = owner ? owner->GetFrameLoader() : nullptr;
   if (!fl) {
     fl = mFrameLoader;
   }
   return fl.forget();
 }
--- a/dom/base/nsContentAreaDragDrop.cpp
+++ b/dom/base/nsContentAreaDragDrop.cpp
@@ -20,16 +20,17 @@
 #include "nsITransferable.h"
 #include "nsComponentManagerUtils.h"
 #include "nsXPCOM.h"
 #include "nsISupportsPrimitives.h"
 #include "nsServiceManagerUtils.h"
 #include "nsNetUtil.h"
 #include "nsIFile.h"
 #include "nsFrameLoader.h"
+#include "nsFrameLoaderOwner.h"
 #include "nsIWebNavigation.h"
 #include "nsIDocShell.h"
 #include "nsIContent.h"
 #include "nsIContentInlines.h"
 #include "nsIImageLoadingContent.h"
 #include "nsITextControlElement.h"
 #include "nsUnicharUtils.h"
 #include "nsIURL.h"
@@ -48,16 +49,17 @@
 #include "nsIMIMEInfo.h"
 #include "nsRange.h"
 #include "TabParent.h"
 #include "mozilla/dom/Element.h"
 #include "mozilla/dom/HTMLAreaElement.h"
 #include "mozilla/dom/HTMLAnchorElement.h"
 #include "mozilla/dom/Selection.h"
 #include "nsVariant.h"
+#include "nsQueryObject.h"
 
 using namespace mozilla::dom;
 using mozilla::IgnoreErrors;
 
 class MOZ_STACK_CLASS DragDataProducer {
  public:
   DragDataProducer(nsPIDOMWindowOuter* aWindow, nsIContent* aTarget,
                    nsIContent* aSelectionTargetNode, bool aIsAltKeyPressed);
@@ -541,17 +543,17 @@ nsresult DragDataProducer::Produce(DataT
   nsCOMPtr<nsIContent> nodeToSerialize;
 
   nsCOMPtr<nsIDocShellTreeItem> dsti = mWindow->GetDocShell();
   const bool isChromeShell =
       dsti && dsti->ItemType() == nsIDocShellTreeItem::typeChrome;
 
   // In chrome shells, only allow dragging inside editable areas.
   if (isChromeShell && !editingElement) {
-    nsCOMPtr<nsIFrameLoaderOwner> flo = do_QueryInterface(mTarget);
+    RefPtr<nsFrameLoaderOwner> flo = do_QueryObject(mTarget);
     if (flo) {
       RefPtr<nsFrameLoader> fl = flo->GetFrameLoader();
       if (fl) {
         TabParent* tp = static_cast<TabParent*>(fl->GetRemoteBrowser());
         if (tp) {
           // We have a TabParent, so it may have data for dnd in case the child
           // process started a dnd session.
           tp->AddInitialDnDDataTo(aDataTransfer, aPrincipal);
--- a/dom/base/nsContentUtils.cpp
+++ b/dom/base/nsContentUtils.cpp
@@ -114,16 +114,17 @@
 #include "nsDataHashtable.h"
 #include "nsDocShellCID.h"
 #include "nsDOMCID.h"
 #include "mozilla/dom/DataTransfer.h"
 #include "nsDOMJSUtils.h"
 #include "nsDOMMutationObserver.h"
 #include "nsError.h"
 #include "nsFocusManager.h"
+#include "nsFrameLoaderOwner.h"
 #include "nsGenericHTMLElement.h"
 #include "nsGenericHTMLFrameElement.h"
 #include "nsGkAtoms.h"
 #include "nsHtml5Module.h"
 #include "nsHtml5StringParser.h"
 #include "nsHTMLDocument.h"
 #include "nsHTMLTags.h"
 #include "nsIAddonPolicyService.h"
@@ -196,16 +197,17 @@
 #include "nsNetCID.h"
 #include "nsNetUtil.h"
 #include "nsNodeInfoManager.h"
 #include "nsParserCIID.h"
 #include "nsParserConstants.h"
 #include "nsPIDOMWindow.h"
 #include "nsPresContext.h"
 #include "nsPrintfCString.h"
+#include "nsQueryObject.h"
 #include "nsSandboxFlags.h"
 #include "nsScriptSecurityManager.h"
 #include "nsSerializationHelper.h"
 #include "nsStreamUtils.h"
 #include "nsTextEditorState.h"
 #include "nsTextFragment.h"
 #include "nsTextNode.h"
 #include "nsThreadUtils.h"
@@ -10418,17 +10420,17 @@ static Result<Ok, nsresult> ExtractExcep
   }
 
   return aContent->AsElement()->AttrValueIs(kNameSpaceID_XLink, nsGkAtoms::type,
                                             nsGkAtoms::simple, eCaseMatters);
 }
 
 /* static */ already_AddRefed<ContentFrameMessageManager>
 nsContentUtils::TryGetTabChildGlobal(nsISupports* aFrom) {
-  nsCOMPtr<nsIFrameLoaderOwner> frameLoaderOwner = do_QueryInterface(aFrom);
+  RefPtr<nsFrameLoaderOwner> frameLoaderOwner = do_QueryObject(aFrom);
   if (!frameLoaderOwner) {
     return nullptr;
   }
 
   RefPtr<nsFrameLoader> frameLoader = frameLoaderOwner->GetFrameLoader();
   if (!frameLoader) {
     return nullptr;
   }
--- a/dom/base/nsFrameLoader.cpp
+++ b/dom/base/nsFrameLoader.cpp
@@ -30,16 +30,17 @@
 #include "nsIBrowser.h"
 #include "nsContentUtils.h"
 #include "nsIXPConnect.h"
 #include "nsUnicharUtils.h"
 #include "nsIScriptGlobalObject.h"
 #include "nsIScriptSecurityManager.h"
 #include "nsIScrollable.h"
 #include "nsFrameLoader.h"
+#include "nsFrameLoaderOwner.h"
 #include "nsIFrame.h"
 #include "nsIScrollableFrame.h"
 #include "nsSubDocumentFrame.h"
 #include "nsError.h"
 #include "nsISHistory.h"
 #include "nsIXULWindow.h"
 #include "nsIMozBrowserFrame.h"
 #include "nsISHistory.h"
@@ -899,18 +900,18 @@ void nsFrameLoader::ForceLayoutIfNecessa
   if (frame->GetStateBits() & NS_FRAME_FIRST_REFLOW) {
     if (nsCOMPtr<nsIPresShell> shell = presContext->GetPresShell()) {
       shell->FlushPendingNotifications(FlushType::Layout);
     }
   }
 }
 
 nsresult nsFrameLoader::SwapWithOtherRemoteLoader(
-    nsFrameLoader* aOther, nsIFrameLoaderOwner* aThisOwner,
-    nsIFrameLoaderOwner* aOtherOwner) {
+    nsFrameLoader* aOther, nsFrameLoaderOwner* aThisOwner,
+    nsFrameLoaderOwner* aOtherOwner) {
   MOZ_ASSERT(NS_IsMainThread());
 
 #ifdef DEBUG
   RefPtr<nsFrameLoader> first = aThisOwner->GetFrameLoader();
   RefPtr<nsFrameLoader> second = aOtherOwner->GetFrameLoader();
   MOZ_ASSERT(first == this, "aThisOwner must own this");
   MOZ_ASSERT(second == aOther, "aOtherOwner must own aOther");
 #endif
@@ -1077,18 +1078,18 @@ nsresult nsFrameLoader::SwapWithOtherRem
     otherMessageManager->SetCallback(this);
   }
   mMessageManager.swap(aOther->mMessageManager);
 
   // Perform the actual swap of the internal refptrs. We keep a strong reference
   // to ourselves to make sure we don't die while we overwrite our reference to
   // ourself.
   RefPtr<nsFrameLoader> kungFuDeathGrip(this);
-  aThisOwner->InternalSetFrameLoader(aOther);
-  aOtherOwner->InternalSetFrameLoader(kungFuDeathGrip);
+  aThisOwner->SetFrameLoader(aOther);
+  aOtherOwner->SetFrameLoader(kungFuDeathGrip);
 
   ourFrameFrame->EndSwapDocShells(otherFrame);
 
   ourShell->BackingScaleFactorChanged();
   otherShell->BackingScaleFactorChanged();
 
   // Initialize browser API if needed now that owner content has changed.
   InitializeBrowserAPI();
@@ -1160,18 +1161,18 @@ class MOZ_RAII AutoResetInFrameSwap fina
   RefPtr<nsDocShell> mThisDocShell;
   RefPtr<nsDocShell> mOtherDocShell;
   nsCOMPtr<EventTarget> mThisEventTarget;
   nsCOMPtr<EventTarget> mOtherEventTarget;
   MOZ_DECL_USE_GUARD_OBJECT_NOTIFIER
 };
 
 nsresult nsFrameLoader::SwapWithOtherLoader(nsFrameLoader* aOther,
-                                            nsIFrameLoaderOwner* aThisOwner,
-                                            nsIFrameLoaderOwner* aOtherOwner) {
+                                            nsFrameLoaderOwner* aThisOwner,
+                                            nsFrameLoaderOwner* aOtherOwner) {
 #ifdef DEBUG
   RefPtr<nsFrameLoader> first = aThisOwner->GetFrameLoader();
   RefPtr<nsFrameLoader> second = aOtherOwner->GetFrameLoader();
   MOZ_ASSERT(first == this, "aThisOwner must own this");
   MOZ_ASSERT(second == aOther, "aOtherOwner must own aOther");
 #endif
 
   NS_ENSURE_STATE(!mInShow && !aOther->mInShow);
@@ -1483,18 +1484,18 @@ nsresult nsFrameLoader::SwapWithOtherLoa
     aOther->mMessageManager->SetCallback(this);
   }
   mMessageManager.swap(aOther->mMessageManager);
 
   // Perform the actual swap of the internal refptrs. We keep a strong reference
   // to ourselves to make sure we don't die while we overwrite our reference to
   // ourself.
   RefPtr<nsFrameLoader> kungFuDeathGrip(this);
-  aThisOwner->InternalSetFrameLoader(aOther);
-  aOtherOwner->InternalSetFrameLoader(kungFuDeathGrip);
+  aThisOwner->SetFrameLoader(aOther);
+  aOtherOwner->SetFrameLoader(kungFuDeathGrip);
 
   // Drop any cached content viewers in the two session histories.
   if (ourHistory) {
     ourHistory->EvictLocalContentViewers();
   }
   if (otherHistory) {
     otherHistory->EvictLocalContentViewers();
   }
--- a/dom/base/nsFrameLoader.h
+++ b/dom/base/nsFrameLoader.h
@@ -9,17 +9,16 @@
  * handling of loads in it, recursion-checking).
  */
 
 #ifndef nsFrameLoader_h_
 #define nsFrameLoader_h_
 
 #include "nsDocShell.h"
 #include "nsStringFwd.h"
-#include "nsIFrameLoaderOwner.h"
 #include "nsPoint.h"
 #include "nsSize.h"
 #include "nsWrapperCache.h"
 #include "nsIURI.h"
 #include "nsFrameMessageManager.h"
 #include "mozilla/dom/BindingUtils.h"
 #include "mozilla/dom/Element.h"
 #include "mozilla/dom/ParentSHistory.h"
@@ -30,16 +29,17 @@
 #include "nsIFrame.h"
 #include "nsPluginTags.h"
 
 class nsIURI;
 class nsSubDocumentFrame;
 class nsView;
 class AutoResetInShow;
 class AutoResetInFrameSwap;
+class nsFrameLoaderOwner;
 class nsITabParent;
 class nsIDocShellTreeItem;
 class nsIDocShellTreeOwner;
 class nsILoadContext;
 class nsIMessageSender;
 class nsIPrintSettings;
 class nsIWebBrowserPersistDocumentReceiver;
 class nsIWebProgressListener;
@@ -240,26 +240,26 @@ class nsFrameLoader final : public nsStu
    */
   void Hide();
 
   // Used when content is causing a FrameLoader to be created, and
   // needs to try forcing layout to flush in order to get accurate
   // dimensions for the content area.
   void ForceLayoutIfNecessary();
 
-  // The guts of an nsIFrameLoaderOwner::SwapFrameLoader implementation.  A
+  // The guts of an nsFrameLoaderOwner::SwapFrameLoader implementation.  A
   // frame loader owner needs to call this, and pass in the two references to
   // nsRefPtrs for frame loaders that need to be swapped.
   nsresult SwapWithOtherLoader(nsFrameLoader* aOther,
-                               nsIFrameLoaderOwner* aThisOwner,
-                               nsIFrameLoaderOwner* aOtherOwner);
+                               nsFrameLoaderOwner* aThisOwner,
+                               nsFrameLoaderOwner* aOtherOwner);
 
   nsresult SwapWithOtherRemoteLoader(nsFrameLoader* aOther,
-                                     nsIFrameLoaderOwner* aThisOwner,
-                                     nsIFrameLoaderOwner* aOtherOwner);
+                                     nsFrameLoaderOwner* aThisOwner,
+                                     nsFrameLoaderOwner* aOtherOwner);
 
   /**
    * Return the primary frame for our owning content, or null if it
    * can't be found.
    */
   nsIFrame* GetPrimaryFrameOfOwningContent() const {
     return mOwnerContent ? mOwnerContent->GetPrimaryFrame() : nullptr;
   }
--- a/dom/base/nsObjectLoadingContent.cpp
+++ b/dom/base/nsObjectLoadingContent.cpp
@@ -1068,35 +1068,21 @@ nsObjectLoadingContent::OnDataAvailable(
   MOZ_ASSERT_UNREACHABLE(
       "Got data for channel with no connected final "
       "listener");
   mChannel = nullptr;
 
   return NS_ERROR_UNEXPECTED;
 }
 
-// nsIFrameLoaderOwner
-NS_IMETHODIMP_(already_AddRefed<nsFrameLoader>)
-nsObjectLoadingContent::GetFrameLoader() {
-  RefPtr<nsFrameLoader> loader = mFrameLoader;
-  return loader.forget();
-}
-
 void nsObjectLoadingContent::PresetOpenerWindow(
     const Nullable<WindowProxyHolder>& aOpenerWindow, ErrorResult& aRv) {
   aRv.Throw(NS_ERROR_FAILURE);
 }
 
-void nsObjectLoadingContent::InternalSetFrameLoader(
-    nsFrameLoader* aNewFrameLoader) {
-  MOZ_CRASH(
-      "You shouldn't be calling this function, it doesn't make any sense on "
-      "this type.");
-}
-
 NS_IMETHODIMP
 nsObjectLoadingContent::GetActualType(nsACString& aType) {
   aType = mContentType;
   return NS_OK;
 }
 
 NS_IMETHODIMP
 nsObjectLoadingContent::GetDisplayedType(uint32_t* aType) {
--- a/dom/base/nsObjectLoadingContent.h
+++ b/dom/base/nsObjectLoadingContent.h
@@ -18,17 +18,17 @@
 #include "nsImageLoadingContent.h"
 #include "nsIStreamListener.h"
 #include "nsIChannelEventSink.h"
 #include "nsIContentPolicy.h"
 #include "nsIObjectLoadingContent.h"
 #include "nsIRunnable.h"
 #include "nsIThreadInternal.h"
 #include "nsIFrame.h"
-#include "nsIFrameLoaderOwner.h"
+#include "nsFrameLoaderOwner.h"
 
 class nsAsyncInstantiateEvent;
 class nsStopPluginRunnable;
 class AutoSetInstantiatingToFalse;
 class nsIPrincipal;
 class nsFrameLoader;
 class nsPluginFrame;
 class nsPluginInstanceOwner;
@@ -43,17 +43,17 @@ template <typename T>
 struct Nullable;
 class WindowProxyHolder;
 class XULFrameElement;
 }  // namespace dom
 }  // namespace mozilla
 
 class nsObjectLoadingContent : public nsImageLoadingContent,
                                public nsIStreamListener,
-                               public nsIFrameLoaderOwner,
+                               public nsFrameLoaderOwner,
                                public nsIObjectLoadingContent,
                                public nsIChannelEventSink {
   friend class AutoSetInstantiatingToFalse;
   friend class AutoSetLoadingToFalse;
   friend class CheckPluginStopEvent;
   friend class nsStopPluginRunnable;
   friend class nsAsyncInstantiateEvent;
 
@@ -111,17 +111,16 @@ class nsObjectLoadingContent : public ns
         nsIObjectLoadingContent::PLUGIN_CLICK_TO_PLAY_QUIET,
   };
 
   nsObjectLoadingContent();
   virtual ~nsObjectLoadingContent();
 
   NS_DECL_NSIREQUESTOBSERVER
   NS_DECL_NSISTREAMLISTENER
-  NS_DECL_NSIFRAMELOADEROWNER
   NS_DECL_NSIOBJECTLOADINGCONTENT
   NS_DECL_NSICHANNELEVENTSINK
 
   /**
    * Object state. This is a bitmask of NS_EVENT_STATEs epresenting the
    * current state of the object.
    */
   mozilla::EventStates ObjectState() const;
@@ -605,19 +604,16 @@ class nsObjectLoadingContent : public ns
                                     JS::MutableHandle<JSObject*> plugin_proto);
 
   // Utility for firing an error event, if we're an <object>.
   void MaybeFireErrorEvent();
 
   // The final listener for mChannel (uriloader, pluginstreamlistener, etc.)
   nsCOMPtr<nsIStreamListener> mFinalListener;
 
-  // Frame loader, for content documents we load.
-  RefPtr<nsFrameLoader> mFrameLoader;
-
   // Track if we have a pending AsyncInstantiateEvent
   nsCOMPtr<nsIRunnable> mPendingInstantiateEvent;
 
   // Tracks if we have a pending CheckPluginStopEvent
   nsCOMPtr<nsIRunnable> mPendingCheckPluginStopEvent;
 
   // The content type of our current load target, updated by
   // UpdateObjectParameters(). Takes the channel's type into account once
--- a/dom/base/nsOpenURIInFrameParams.cpp
+++ b/dom/base/nsOpenURIInFrameParams.cpp
@@ -16,17 +16,17 @@ NS_INTERFACE_MAP_END
 
 NS_IMPL_CYCLE_COLLECTION(nsOpenURIInFrameParams, mOpenerBrowser)
 
 NS_IMPL_CYCLE_COLLECTING_ADDREF(nsOpenURIInFrameParams)
 NS_IMPL_CYCLE_COLLECTING_RELEASE(nsOpenURIInFrameParams)
 
 nsOpenURIInFrameParams::nsOpenURIInFrameParams(
     const mozilla::OriginAttributes& aOriginAttributes,
-    nsIFrameLoaderOwner* aOpener)
+    Element* aOpener)
     : mOpenerOriginAttributes(aOriginAttributes),
       mOpenerBrowser(aOpener),
       mReferrerPolicy(mozilla::net::RP_Unset) {}
 
 nsOpenURIInFrameParams::~nsOpenURIInFrameParams() {}
 
 NS_IMETHODIMP
 nsOpenURIInFrameParams::GetReferrer(nsAString& aReferrer) {
@@ -69,19 +69,19 @@ nsOpenURIInFrameParams::GetTriggeringPri
 NS_IMETHODIMP
 nsOpenURIInFrameParams::SetTriggeringPrincipal(
     nsIPrincipal* aTriggeringPrincipal) {
   NS_ENSURE_TRUE(aTriggeringPrincipal, NS_ERROR_INVALID_ARG);
   mTriggeringPrincipal = aTriggeringPrincipal;
   return NS_OK;
 }
 
-NS_IMETHODIMP
-nsOpenURIInFrameParams::GetOpenerBrowser(nsIFrameLoaderOwner** aOpenerBrowser) {
-  nsCOMPtr<nsIFrameLoaderOwner> owner = mOpenerBrowser;
+nsresult
+nsOpenURIInFrameParams::GetOpenerBrowser(Element** aOpenerBrowser) {
+  RefPtr<Element> owner = mOpenerBrowser;
   owner.forget(aOpenerBrowser);
   return NS_OK;
 }
 
 NS_IMETHODIMP
 nsOpenURIInFrameParams::GetOpenerOriginAttributes(
     JSContext* aCx, JS::MutableHandle<JS::Value> aValue) {
   bool ok = ToJSValue(aCx, mOpenerOriginAttributes, aValue);
--- a/dom/base/nsOpenURIInFrameParams.h
+++ b/dom/base/nsOpenURIInFrameParams.h
@@ -2,34 +2,34 @@
 /* vim: set ts=8 sts=2 et sw=2 tw=80: */
 /* This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 #include "mozilla/BasePrincipal.h"
 #include "nsCycleCollectionParticipant.h"
 #include "nsIBrowserDOMWindow.h"
-#include "nsIFrameLoaderOwner.h"
+#include "nsFrameLoaderOwner.h"
 #include "nsString.h"
 
 namespace mozilla {
 class OriginAttributes;
 }
 
 class nsOpenURIInFrameParams final : public nsIOpenURIInFrameParams {
  public:
   NS_DECL_CYCLE_COLLECTION_CLASS(nsOpenURIInFrameParams)
   NS_DECL_CYCLE_COLLECTING_ISUPPORTS
   NS_DECL_NSIOPENURIINFRAMEPARAMS
 
   explicit nsOpenURIInFrameParams(
       const mozilla::OriginAttributes& aOriginAttributes,
-      nsIFrameLoaderOwner* aOpener);
+      Element* aOpener);
 
  private:
   ~nsOpenURIInFrameParams();
 
   mozilla::OriginAttributes mOpenerOriginAttributes;
-  nsCOMPtr<nsIFrameLoaderOwner> mOpenerBrowser;
+  RefPtr<Element> mOpenerBrowser;
   nsString mReferrer;
   uint32_t mReferrerPolicy;
   nsCOMPtr<nsIPrincipal> mTriggeringPrincipal;
 };
--- a/dom/events/EventStateManager.cpp
+++ b/dom/events/EventStateManager.cpp
@@ -37,16 +37,17 @@
 #include "nsCopySupport.h"
 #include "nsFocusManager.h"
 #include "nsGenericHTMLElement.h"
 #include "nsIClipboard.h"
 #include "nsIContent.h"
 #include "nsIContentInlines.h"
 #include "mozilla/dom/Document.h"
 #include "nsIFrame.h"
+#include "nsFrameLoaderOwner.h"
 #include "nsITextControlElement.h"
 #include "nsIWidget.h"
 #include "nsPresContext.h"
 #include "nsIPresShell.h"
 #include "nsGkAtoms.h"
 #include "nsIFormControl.h"
 #include "nsComboboxControlFrame.h"
 #include "nsIScrollableFrame.h"
@@ -1338,17 +1339,17 @@ bool EventStateManager::HandleCrossProce
   if (targets.Length() == 0) {
     return false;
   }
 
   // Look up the frame loader for all the remote targets we found, and
   // then dispatch the event to the remote content they represent.
   for (uint32_t i = 0; i < targets.Length(); ++i) {
     nsIContent* target = targets[i];
-    nsCOMPtr<nsIFrameLoaderOwner> loaderOwner = do_QueryInterface(target);
+    RefPtr<nsFrameLoaderOwner> loaderOwner = do_QueryObject(target);
     if (!loaderOwner) {
       continue;
     }
 
     RefPtr<nsFrameLoader> frameLoader = loaderOwner->GetFrameLoader();
     if (!frameLoader) {
       continue;
     }
--- a/dom/html/HTMLEmbedElement.cpp
+++ b/dom/html/HTMLEmbedElement.cpp
@@ -49,17 +49,17 @@ NS_IMPL_CYCLE_COLLECTION_CLASS(HTMLEmbed
 
 NS_IMPL_CYCLE_COLLECTION_TRAVERSE_BEGIN_INHERITED(HTMLEmbedElement,
                                                   nsGenericHTMLElement)
   nsObjectLoadingContent::Traverse(tmp, cb);
 NS_IMPL_CYCLE_COLLECTION_TRAVERSE_END
 
 NS_IMPL_ISUPPORTS_CYCLE_COLLECTION_INHERITED(
     HTMLEmbedElement, nsGenericHTMLElement, nsIRequestObserver,
-    nsIStreamListener, nsIFrameLoaderOwner, nsIObjectLoadingContent,
+    nsIStreamListener, nsFrameLoaderOwner, nsIObjectLoadingContent,
     imgINotificationObserver, nsIImageLoadingContent, nsIChannelEventSink)
 
 NS_IMPL_ELEMENT_CLONE(HTMLEmbedElement)
 
 #ifdef XP_MACOSX
 
 NS_IMETHODIMP
 HTMLEmbedElement::PostHandleEvent(EventChainPostVisitor& aVisitor) {
--- a/dom/html/HTMLEmbedElement.h
+++ b/dom/html/HTMLEmbedElement.h
@@ -99,18 +99,16 @@ class HTMLEmbedElement final : public ns
     return GetContentDocument(aSubjectPrincipal);
   }
 
   /**
    * Calls LoadObject with the correct arguments to start the plugin load.
    */
   void StartObjectLoad(bool aNotify, bool aForceLoad);
 
-  NS_FORWARD_NSIFRAMELOADEROWNER(nsObjectLoadingContent::)
-
  protected:
   // Override for nsImageLoadingContent.
   nsIContent* AsContent() override { return this; }
 
   virtual nsresult AfterSetAttr(int32_t aNamespaceID, nsAtom* aName,
                                 const nsAttrValue* aValue,
                                 const nsAttrValue* aOldValue,
                                 nsIPrincipal* aSubjectPrincipal,
--- a/dom/html/HTMLFrameElement.h
+++ b/dom/html/HTMLFrameElement.h
@@ -85,18 +85,16 @@ class HTMLFrameElement final : public ns
   void SetSrc(const nsAString& aSrc, nsIPrincipal* aTriggeringPrincipal,
               ErrorResult& aError) {
     SetHTMLAttr(nsGkAtoms::src, aSrc, aTriggeringPrincipal, aError);
   }
 
   using nsGenericHTMLFrameElement::GetContentDocument;
   using nsGenericHTMLFrameElement::GetContentWindow;
 
-  NS_FORWARD_NSIFRAMELOADEROWNER(nsGenericHTMLFrameElement::)
-
  protected:
   virtual ~HTMLFrameElement();
 
   virtual JSObject* WrapNode(JSContext* aCx,
                              JS::Handle<JSObject*> aGivenProto) override;
 
  private:
   static void MapAttributesIntoRule(const nsMappedAttributes* aAttributes,
--- a/dom/html/HTMLObjectElement.cpp
+++ b/dom/html/HTMLObjectElement.cpp
@@ -82,17 +82,17 @@ NS_IMPL_CYCLE_COLLECTION_TRAVERSE_END
 
 NS_IMPL_CYCLE_COLLECTION_UNLINK_BEGIN_INHERITED(HTMLObjectElement,
                                                 nsGenericHTMLFormElement)
   NS_IMPL_CYCLE_COLLECTION_UNLINK(mValidity)
 NS_IMPL_CYCLE_COLLECTION_UNLINK_END
 
 NS_IMPL_ISUPPORTS_CYCLE_COLLECTION_INHERITED(
     HTMLObjectElement, nsGenericHTMLFormElement, imgINotificationObserver,
-    nsIRequestObserver, nsIStreamListener, nsIFrameLoaderOwner,
+    nsIRequestObserver, nsIStreamListener, nsFrameLoaderOwner,
     nsIObjectLoadingContent, nsIImageLoadingContent, nsIChannelEventSink,
     nsIConstraintValidation)
 
 NS_IMPL_ELEMENT_CLONE(HTMLObjectElement)
 
 #ifdef XP_MACOSX
 
 static nsIWidget* GetWidget(Element* aElement) {
--- a/dom/html/HTMLObjectElement.h
+++ b/dom/html/HTMLObjectElement.h
@@ -181,18 +181,16 @@ class HTMLObjectElement final : public n
     return GetContentDocument(aSubjectPrincipal);
   }
 
   /**
    * Calls LoadObject with the correct arguments to start the plugin load.
    */
   void StartObjectLoad(bool aNotify, bool aForceLoad);
 
-  NS_FORWARD_NSIFRAMELOADEROWNER(nsObjectLoadingContent::)
-
  protected:
   // Override for nsImageLoadingContent.
   nsIContent* AsContent() override { return this; }
 
   virtual nsresult AfterSetAttr(int32_t aNamespaceID, nsAtom* aName,
                                 const nsAttrValue* aValue,
                                 const nsAttrValue* aOldValue,
                                 nsIPrincipal* aSubjectPrincipal,
--- a/dom/html/nsBrowserElement.h
+++ b/dom/html/nsBrowserElement.h
@@ -37,17 +37,17 @@ class nsBrowserElement {
   void GoForward(ErrorResult& aRv);
   void Reload(bool aHardReload, ErrorResult& aRv);
   void Stop(ErrorResult& aRv);
 
   already_AddRefed<dom::Promise> GetCanGoBack(ErrorResult& aRv);
   already_AddRefed<dom::Promise> GetCanGoForward(ErrorResult& aRv);
 
  protected:
-  NS_IMETHOD_(already_AddRefed<nsFrameLoader>) GetFrameLoader() = 0;
+  virtual already_AddRefed<nsFrameLoader> GetFrameLoader() = 0;
 
   void InitBrowserElementAPI();
   void DestroyBrowserElementFrameScripts();
   nsCOMPtr<nsIBrowserElementAPI> mBrowserElementAPI;
 
  private:
   bool IsBrowserElementOrThrow(ErrorResult& aRv);
 };
--- a/dom/html/nsGenericHTMLFrameElement.cpp
+++ b/dom/html/nsGenericHTMLFrameElement.cpp
@@ -44,17 +44,17 @@ NS_IMPL_CYCLE_COLLECTION_UNLINK_BEGIN_IN
   }
 
   NS_IMPL_CYCLE_COLLECTION_UNLINK(mFrameLoader)
   NS_IMPL_CYCLE_COLLECTION_UNLINK(mOpenerWindow)
   NS_IMPL_CYCLE_COLLECTION_UNLINK(mBrowserElementAPI)
 NS_IMPL_CYCLE_COLLECTION_UNLINK_END
 
 NS_IMPL_ISUPPORTS_CYCLE_COLLECTION_INHERITED(
-    nsGenericHTMLFrameElement, nsGenericHTMLElement, nsIFrameLoaderOwner,
+    nsGenericHTMLFrameElement, nsGenericHTMLElement, nsFrameLoaderOwner,
     nsIDOMMozBrowserFrame, nsIMozBrowserFrame, nsGenericHTMLFrameElement)
 
 NS_IMETHODIMP
 nsGenericHTMLFrameElement::GetMozbrowser(bool* aValue) {
   *aValue = GetBoolAttr(nsGkAtoms::mozbrowser);
   return NS_OK;
 }
 NS_IMETHODIMP
@@ -150,51 +150,40 @@ nsresult nsGenericHTMLFrameElement::Crea
     // for the iframe creation. Therefore the subdoc frame didn't have a
     // frameloader when UpdatePositionAndSize was supposed to be called in
     // ReflowFinished, and we need to do it properly now.
     mFrameLoader->UpdatePositionAndSize(subdocFrame);
   }
   return NS_OK;
 }
 
-NS_IMETHODIMP_(already_AddRefed<nsFrameLoader>)
-nsGenericHTMLFrameElement::GetFrameLoader() {
-  RefPtr<nsFrameLoader> loader = mFrameLoader;
-  return loader.forget();
-}
-
 void nsGenericHTMLFrameElement::PresetOpenerWindow(
     const Nullable<WindowProxyHolder>& aOpenerWindow, ErrorResult& aRv) {
   MOZ_ASSERT(!mFrameLoader);
   mOpenerWindow =
       aOpenerWindow.IsNull() ? nullptr : aOpenerWindow.Value().get();
 }
 
-void nsGenericHTMLFrameElement::InternalSetFrameLoader(
-    nsFrameLoader* aNewFrameLoader) {
-  mFrameLoader = aNewFrameLoader;
-}
-
 void nsGenericHTMLFrameElement::SwapFrameLoaders(
     HTMLIFrameElement& aOtherLoaderOwner, ErrorResult& rv) {
   if (&aOtherLoaderOwner == this) {
     // nothing to do
     return;
   }
 
   aOtherLoaderOwner.SwapFrameLoaders(this, rv);
 }
 
 void nsGenericHTMLFrameElement::SwapFrameLoaders(
     XULFrameElement& aOtherLoaderOwner, ErrorResult& rv) {
   aOtherLoaderOwner.SwapFrameLoaders(this, rv);
 }
 
 void nsGenericHTMLFrameElement::SwapFrameLoaders(
-    nsIFrameLoaderOwner* aOtherLoaderOwner, mozilla::ErrorResult& rv) {
+    nsFrameLoaderOwner* aOtherLoaderOwner, mozilla::ErrorResult& rv) {
   RefPtr<nsFrameLoader> loader = GetFrameLoader();
   RefPtr<nsFrameLoader> otherLoader = aOtherLoaderOwner->GetFrameLoader();
   if (!loader || !otherLoader) {
     rv.Throw(NS_ERROR_NOT_IMPLEMENTED);
     return;
   }
 
   rv = loader->SwapWithOtherLoader(otherLoader, this, aOtherLoaderOwner);
--- a/dom/html/nsGenericHTMLFrameElement.h
+++ b/dom/html/nsGenericHTMLFrameElement.h
@@ -7,19 +7,19 @@
 #ifndef nsGenericHTMLFrameElement_h
 #define nsGenericHTMLFrameElement_h
 
 #include "mozilla/Attributes.h"
 #include "mozilla/ErrorResult.h"
 #include "mozilla/dom/nsBrowserElement.h"
 
 #include "nsFrameLoader.h"
+#include "nsFrameLoaderOwner.h"
 #include "nsGenericHTMLElement.h"
 #include "nsIDOMEventListener.h"
-#include "nsIFrameLoaderOwner.h"
 #include "nsIMozBrowserFrame.h"
 
 namespace mozilla {
 namespace dom {
 template <typename>
 struct Nullable;
 class WindowProxyHolder;
 class XULFrameElement;
@@ -32,34 +32,33 @@ class XULFrameElement;
       0x94, 0x26, 0x87, 0x5f, 0x5a, 0x8a, 0x2a, 0xe5 \
     }                                                \
   }
 
 /**
  * A helper class for frame elements
  */
 class nsGenericHTMLFrameElement : public nsGenericHTMLElement,
-                                  public nsIFrameLoaderOwner,
+                                  public nsFrameLoaderOwner,
                                   public mozilla::nsBrowserElement,
                                   public nsIMozBrowserFrame {
  public:
   nsGenericHTMLFrameElement(
       already_AddRefed<mozilla::dom::NodeInfo>&& aNodeInfo,
       mozilla::dom::FromParser aFromParser)
       : nsGenericHTMLElement(std::move(aNodeInfo)),
         nsBrowserElement(),
         mSrcLoadHappened(false),
         mNetworkCreated(aFromParser == mozilla::dom::FROM_PARSER_NETWORK),
         mBrowserFrameListenersRegistered(false),
         mFrameLoaderCreationDisallowed(false),
         mReallyIsBrowser(false) {}
 
   NS_DECL_ISUPPORTS_INHERITED
 
-  NS_DECL_NSIFRAMELOADEROWNER
   NS_DECL_NSIDOMMOZBROWSERFRAME
   NS_DECL_NSIMOZBROWSERFRAME
 
   NS_DECLARE_STATIC_IID_ACCESSOR(NS_GENERICHTMLFRAMEELEMENT_IID)
 
   // nsIContent
   virtual bool IsHTMLFocusable(bool aWithMouse, bool* aIsFocusable,
                                int32_t* aTabIndex) override;
@@ -79,17 +78,17 @@ class nsGenericHTMLFrameElement : public
                                            nsGenericHTMLElement)
 
   void SwapFrameLoaders(mozilla::dom::HTMLIFrameElement& aOtherLoaderOwner,
                         mozilla::ErrorResult& aError);
 
   void SwapFrameLoaders(mozilla::dom::XULFrameElement& aOtherLoaderOwner,
                         mozilla::ErrorResult& aError);
 
-  void SwapFrameLoaders(nsIFrameLoaderOwner* aOtherLoaderOwner,
+  void SwapFrameLoaders(nsFrameLoaderOwner* aOtherLoaderOwner,
                         mozilla::ErrorResult& rv);
 
   void PresetOpenerWindow(const mozilla::dom::Nullable<
                               mozilla::dom::WindowProxyHolder>& aOpenerWindow,
                           mozilla::ErrorResult& aRv);
 
   static void InitStatics();
   static bool BrowserFramesEnabled();
@@ -103,16 +102,20 @@ class nsGenericHTMLFrameElement : public
    * @return nsIScrollable::Scrollbar_Never or nsIScrollable::Scrollbar_Auto
    */
   static int32_t MapScrollingAttribute(const nsAttrValue* aValue);
 
   nsIPrincipal* GetSrcTriggeringPrincipal() const {
     return mSrcTriggeringPrincipal;
   }
 
+  // Needed for nsBrowserElement
+  already_AddRefed<nsFrameLoader> GetFrameLoader() override {
+    return nsFrameLoaderOwner::GetFrameLoader();
+  }
  protected:
   virtual ~nsGenericHTMLFrameElement();
 
   // This doesn't really ensure a frame loader in all cases, only when
   // it makes sense.
   void EnsureFrameLoader();
   void LoadSrc();
   Document* GetContentDocument(nsIPrincipal& aSubjectPrincipal);
@@ -122,17 +125,16 @@ class nsGenericHTMLFrameElement : public
                                 const nsAttrValue* aValue,
                                 const nsAttrValue* aOldValue,
                                 nsIPrincipal* aSubjectPrincipal,
                                 bool aNotify) override;
   virtual nsresult OnAttrSetButNotChanged(int32_t aNamespaceID, nsAtom* aName,
                                           const nsAttrValueOrString& aValue,
                                           bool aNotify) override;
 
-  RefPtr<nsFrameLoader> mFrameLoader;
   RefPtr<mozilla::dom::BrowsingContext> mOpenerWindow;
 
   nsCOMPtr<nsIPrincipal> mSrcTriggeringPrincipal;
 
   /**
    * True if we have already loaded the frame's original src
    */
   bool mSrcLoadHappened;
--- a/dom/interfaces/base/nsIBrowserDOMWindow.idl
+++ b/dom/interfaces/base/nsIBrowserDOMWindow.idl
@@ -3,30 +3,30 @@
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 #include "nsISupports.idl"
 
 interface mozIDOMWindowProxy;
 interface nsIDOMWindow;
 interface nsIURI;
-interface nsIFrameLoaderOwner;
 interface nsIPrincipal;
+webidl Element;
 
 [scriptable, uuid(e774db14-79ac-4156-a7a3-aa3fd0a22c10)]
 interface nsIOpenURIInFrameParams : nsISupports
 {
   attribute AString referrer;
   attribute unsigned long referrerPolicy;
   readonly attribute boolean isPrivate;
   attribute nsIPrincipal triggeringPrincipal;
 
   // The browser or frame element in the parent process which holds the
   // opener window in the content process. May be null.
-  readonly attribute nsIFrameLoaderOwner openerBrowser;
+  readonly attribute Element openerBrowser;
 
   [implicit_jscontext]
   readonly attribute jsval openerOriginAttributes;
 };
 
 [scriptable, uuid(2a9bb880-5d73-40f3-8152-c60c8d137a14)]
 
 /**
@@ -108,24 +108,25 @@ interface nsIBrowserDOMWindow : nsISuppo
    * @return the window into which the URI would have been opened.
   */
   mozIDOMWindowProxy
   createContentWindow(in nsIURI aURI, in mozIDOMWindowProxy aOpener,
                       in short aWhere, in long aFlags,
                       in nsIPrincipal aTriggeringPrincipal);
 
   /**
-   * As above, but return the nsIFrameLoaderOwner for the new window.
+   * As above, but return the nsFrameLoaderOwner for the new window. Value is
+   * returned as Element, QI'd back to nsFrameLoaderOwner as needed.
    *
    * Additional Parameters:
    * @param aNextTabParentId The TabParent to associate the window with.
    * @param aName The name to give the window opened in the new tab.
-   * @return The nsIFrameLoaderOwner for the newly opened window.
+   * @return The frame element for the newly opened window.
    */
-  nsIFrameLoaderOwner
+  Element
   createContentWindowInFrame(in nsIURI aURI, in nsIOpenURIInFrameParams params,
                              in short aWhere, in long aFlags,
                              in unsigned long long aNextTabParentId,
                              in AString aName);
 
   /**
    * Load a URI.
 
@@ -139,26 +140,27 @@ interface nsIBrowserDOMWindow : nsISuppo
    * @param aTriggeringPrincipal the principal that triggered the load of aURI.
    * @return the window into which the URI was opened.
   */
   mozIDOMWindowProxy
   openURI(in nsIURI aURI, in mozIDOMWindowProxy aOpener,
           in short aWhere, in long aFlags, in nsIPrincipal aTriggeringPrincipal);
 
   /**
-   * As above, but return the nsIFrameLoaderOwner for the new window.
+   * As above, but return the nsFrameLoaderOwner for the new window. Value is
+   * returned as Element, QI'd back to nsFrameLoaderOwner as needed.
    *
    * Additional Parameters:
    * @param aNextTabParentId The TabParent to associate the window with.
    * @param aName The name to give the window opened in the new tab.
-   * @return The nsIFrameLoaderOwner for the newly opened window.
+   * @return The frame element for the newly opened window.
    // XXXbz is this the right API?
    // See bug 537428
    */
-  nsIFrameLoaderOwner
+  Element
   openURIInFrame(in nsIURI aURI, in nsIOpenURIInFrameParams params,
                  in short aWhere, in long aFlags,
                  in unsigned long long aNextTabParentId,
                  in AString aName);
 
   /**
    * @param  aWindow the window to test.
    * @return whether the window is the main content window for any
--- a/dom/ipc/ContentParent.cpp
+++ b/dom/ipc/ContentParent.cpp
@@ -173,16 +173,17 @@
 #include "nsThread.h"
 #include "nsWindowWatcher.h"
 #include "nsIXULRuntime.h"
 #include "mozilla/dom/ParentProcessMessageManager.h"
 #include "mozilla/dom/ProcessMessageManager.h"
 #include "mozilla/dom/nsMixedContentBlocker.h"
 #include "nsMemoryInfoDumper.h"
 #include "nsMemoryReporterManager.h"
+#include "nsQueryObject.h"
 #include "nsScriptError.h"
 #include "nsServiceManagerUtils.h"
 #include "nsStyleSheetService.h"
 #include "nsThreadUtils.h"
 #include "nsWidgetsCID.h"
 #include "PreallocatedProcessManager.h"
 #include "ProcessPriorityManager.h"
 #include "SandboxHal.h"
@@ -4675,35 +4676,37 @@ mozilla::ipc::IPCResult ContentParent::C
   }
 
   if (aOpenLocation == nsIBrowserDOMWindow::OPEN_NEWTAB) {
     if (NS_WARN_IF(!browserDOMWin)) {
       aResult = NS_ERROR_ABORT;
       return IPC_OK();
     }
 
-    nsCOMPtr<nsIFrameLoaderOwner> opener = do_QueryInterface(frame);
+    RefPtr<Element> openerElement = do_QueryObject(frame);
 
     nsCOMPtr<nsIOpenURIInFrameParams> params =
-        new nsOpenURIInFrameParams(openerOriginAttributes, opener);
+        new nsOpenURIInFrameParams(openerOriginAttributes, openerElement);
     params->SetReferrer(NS_ConvertUTF8toUTF16(aBaseURI));
     MOZ_ASSERT(aTriggeringPrincipal, "need a valid triggeringPrincipal");
     params->SetTriggeringPrincipal(aTriggeringPrincipal);
     params->SetReferrerPolicy(aReferrerPolicy);
 
-    nsCOMPtr<nsIFrameLoaderOwner> frameLoaderOwner;
+    RefPtr<Element> el;
+
     if (aLoadURI) {
       aResult = browserDOMWin->OpenURIInFrame(
           aURIToLoad, params, aOpenLocation, nsIBrowserDOMWindow::OPEN_NEW,
-          aNextTabParentId, aName, getter_AddRefs(frameLoaderOwner));
+          aNextTabParentId, aName, getter_AddRefs(el));
     } else {
       aResult = browserDOMWin->CreateContentWindowInFrame(
           aURIToLoad, params, aOpenLocation, nsIBrowserDOMWindow::OPEN_NEW,
-          aNextTabParentId, aName, getter_AddRefs(frameLoaderOwner));
+          aNextTabParentId, aName, getter_AddRefs(el));
     }
+    RefPtr<nsFrameLoaderOwner> frameLoaderOwner = do_QueryObject(el);
     if (NS_SUCCEEDED(aResult) && frameLoaderOwner) {
       RefPtr<nsFrameLoader> frameLoader = frameLoaderOwner->GetFrameLoader();
       if (frameLoader) {
         aNewTabParent = frameLoader->GetTabParent();
         // At this point, it's possible the inserted frameloader hasn't gone
         // through layout yet. To ensure that the dimensions that we send down
         // when telling the frameloader to display will be correct (instead of
         // falling back to a 10x10 default), we force layout if necessary to get
@@ -4747,18 +4750,18 @@ mozilla::ipc::IPCResult ContentParent::C
   // dimensions. See bug 1358712 for details.
   //
   // This involves doing a bit of gymnastics in order to get at the FrameLoader,
   // so we scope this to avoid polluting the main function scope.
   {
     nsCOMPtr<Element> frameElement =
         TabParent::GetFrom(aNewTabParent)->GetOwnerElement();
     MOZ_ASSERT(frameElement);
-    nsCOMPtr<nsIFrameLoaderOwner> frameLoaderOwner =
-        do_QueryInterface(frameElement);
+    RefPtr<nsFrameLoaderOwner> frameLoaderOwner =
+        do_QueryObject(frameElement);
     MOZ_ASSERT(frameLoaderOwner);
     RefPtr<nsFrameLoader> frameLoader = frameLoaderOwner->GetFrameLoader();
     MOZ_ASSERT(frameLoader);
     frameLoader->ForceLayoutIfNecessary();
   }
 
   // If we were passed a name for the window which would override the default,
   // we should send it down to the new tab.
--- a/dom/ipc/TabParent.cpp
+++ b/dom/ipc/TabParent.cpp
@@ -44,16 +44,17 @@
 #include "mozilla/UniquePtr.h"
 #include "mozilla/Unused.h"
 #include "nsCOMPtr.h"
 #include "nsContentAreaDragDrop.h"
 #include "nsContentUtils.h"
 #include "nsDebug.h"
 #include "nsFocusManager.h"
 #include "nsFrameLoader.h"
+#include "nsFrameLoaderOwner.h"
 #include "nsFrameManager.h"
 #include "nsIBaseWindow.h"
 #include "nsIBrowser.h"
 #include "nsIContent.h"
 #include "nsIDocShell.h"
 #include "nsIDocShellTreeOwner.h"
 #include "nsIDOMWindow.h"
 #include "nsIDOMWindowUtils.h"
@@ -71,16 +72,17 @@
 #include "nsVariant.h"
 #include "nsIWidget.h"
 #include "nsNetUtil.h"
 #ifndef XP_WIN
 #  include "nsJARProtocolHandler.h"
 #endif
 #include "nsPIDOMWindow.h"
 #include "nsPrintfCString.h"
+#include "nsQueryObject.h"
 #include "nsServiceManagerUtils.h"
 #include "nsThreadUtils.h"
 #include "PermissionMessageUtils.h"
 #include "StructuredCloneData.h"
 #include "ColorPickerParent.h"
 #include "FilePickerParent.h"
 #include "TabChild.h"
 #include "LoadContext.h"
@@ -450,17 +452,17 @@ void TabParent::ActorDestroy(ActorDestro
     nsCOMPtr<Element> frameElement(mFrameElement);
     ReceiveMessage(CHILD_PROCESS_SHUTDOWN_MESSAGE, false, nullptr, nullptr,
                    nullptr);
     frameLoader->DestroyComplete();
 
     if (why == AbnormalShutdown && os) {
       os->NotifyObservers(ToSupports(frameLoader), "oop-frameloader-crashed",
                           nullptr);
-      nsCOMPtr<nsIFrameLoaderOwner> owner = do_QueryInterface(frameElement);
+      RefPtr<nsFrameLoaderOwner> owner = do_QueryObject(frameElement);
       if (owner) {
         RefPtr<nsFrameLoader> currentFrameLoader = owner->GetFrameLoader();
         // It's possible that the frameloader owner has already moved on
         // and created a new frameloader. If so, we don't fire the event,
         // since the frameloader owner has clearly moved on.
         if (currentFrameLoader == frameLoader) {
           MessageChannel* channel = GetIPCChannel();
           if (channel && !channel->DoBuildIDsMatch()) {
@@ -1736,20 +1738,27 @@ mozilla::ipc::IPCResult TabParent::RecvS
                                                    const uint32_t& aY,
                                                    const nsString& aTooltip,
                                                    const nsString& aDirection) {
   nsCOMPtr<nsIXULBrowserWindow> xulBrowserWindow = GetXULBrowserWindow();
   if (!xulBrowserWindow) {
     return IPC_OK();
   }
 
-  nsCOMPtr<nsIFrameLoaderOwner> frame = do_QueryInterface(mFrameElement);
-  if (!frame) return IPC_OK();
-
-  xulBrowserWindow->ShowTooltip(aX, aY, aTooltip, aDirection, frame);
+  // ShowTooltip will end up accessing XULElement properties in JS (specifically
+  // BoxObject). However, to get it to JS, we need to make sure we're a
+  // nsFrameLoaderOwner, which implies we're a XULFrameElement. We can then
+  // safely pass Element into JS.
+  RefPtr<nsFrameLoaderOwner> flo  = do_QueryObject(mFrameElement);
+  if (!flo) return IPC_OK();
+
+  nsCOMPtr<Element> el = do_QueryInterface(flo);
+  if (!el) return IPC_OK();
+
+  xulBrowserWindow->ShowTooltip(aX, aY, aTooltip, aDirection, el);
   return IPC_OK();
 }
 
 mozilla::ipc::IPCResult TabParent::RecvHideTooltip() {
   nsCOMPtr<nsIXULBrowserWindow> xulBrowserWindow = GetXULBrowserWindow();
   if (!xulBrowserWindow) {
     return IPC_OK();
   }
@@ -2242,17 +2251,17 @@ bool TabParent::SendPasteTransferable(
   return static_cast<TabParent*>(aTabParent);
 }
 
 /*static*/ TabParent* TabParent::GetFrom(PBrowserParent* aTabParent) {
   return static_cast<TabParent*>(aTabParent);
 }
 
 /*static*/ TabParent* TabParent::GetFrom(nsIContent* aContent) {
-  nsCOMPtr<nsIFrameLoaderOwner> loaderOwner = do_QueryInterface(aContent);
+  RefPtr<nsFrameLoaderOwner> loaderOwner = do_QueryObject(aContent);
   if (!loaderOwner) {
     return nullptr;
   }
   RefPtr<nsFrameLoader> frameLoader = loaderOwner->GetFrameLoader();
   return GetFrom(frameLoader);
 }
 
 /*static*/ TabId TabParent::GetTabIdFrom(nsIDocShell* docShell) {
@@ -2454,18 +2463,18 @@ already_AddRefed<nsFrameLoader> TabParen
   if (mIsDestroyed && !aUseCachedFrameLoaderAfterDestroy) {
     return nullptr;
   }
 
   if (mFrameLoader) {
     RefPtr<nsFrameLoader> fl = mFrameLoader;
     return fl.forget();
   }
-  nsCOMPtr<nsIFrameLoaderOwner> frameLoaderOwner =
-      do_QueryInterface(mFrameElement);
+  RefPtr<nsFrameLoaderOwner> frameLoaderOwner =
+      do_QueryObject(mFrameElement);
   return frameLoaderOwner ? frameLoaderOwner->GetFrameLoader() : nullptr;
 }
 
 void TabParent::TryCacheDPIAndScale() {
   if (mDPI > 0) {
     return;
   }
 
--- a/dom/ipc/WindowGlobalParent.cpp
+++ b/dom/ipc/WindowGlobalParent.cpp
@@ -7,16 +7,17 @@
 #include "mozilla/dom/WindowGlobalParent.h"
 #include "mozilla/ipc/InProcessParent.h"
 #include "mozilla/dom/CanonicalBrowsingContext.h"
 #include "mozilla/dom/WindowGlobalActorsBinding.h"
 #include "mozilla/dom/ChromeUtils.h"
 #include "mozJSComponentLoader.h"
 #include "nsContentUtils.h"
 #include "nsError.h"
+#include "nsQueryObject.h"
 
 #include "mozilla/dom/JSWindowActorBinding.h"
 #include "mozilla/dom/JSWindowActorParent.h"
 #include "mozilla/dom/JSWindowActorService.h"
 
 using namespace mozilla::ipc;
 
 namespace mozilla {
@@ -92,17 +93,17 @@ void WindowGlobalParent::Init(const Wind
   } else {
     // In the cross-process case, we can get the frame element from our manager.
     MOZ_ASSERT(Manager()->GetProtocolTypeId() == PBrowserMsgStart);
     frameElement = static_cast<TabParent*>(Manager())->GetOwnerElement();
   }
 
   // Extract the nsFrameLoader from the current frame element. We may not have a
   // nsFrameLoader if we are a chrome document.
-  nsCOMPtr<nsIFrameLoaderOwner> flOwner = do_QueryInterface(frameElement);
+  RefPtr<nsFrameLoaderOwner> flOwner = do_QueryObject(frameElement);
   if (flOwner) {
     mFrameLoader = flOwner->GetFrameLoader();
   }
 
   nsCOMPtr<nsIObserverService> obs = services::GetObserverService();
   if (obs) {
     obs->NotifyObservers(this, "window-global-created", nullptr);
   }
--- a/dom/presentation/PresentationSessionInfo.cpp
+++ b/dom/presentation/PresentationSessionInfo.cpp
@@ -9,21 +9,23 @@
 #include "mozilla/dom/TabParent.h"
 #include "mozilla/Logging.h"
 #include "mozilla/Move.h"
 #include "mozilla/Preferences.h"
 #include "nsContentUtils.h"
 #include "nsGlobalWindow.h"
 #include "nsIDocShell.h"
 #include "nsFrameLoader.h"
+#include "nsFrameLoaderOwner.h"
 #include "nsIMutableArray.h"
 #include "nsINetAddr.h"
 #include "nsISocketTransport.h"
 #include "nsISupportsPrimitives.h"
 #include "nsNetCID.h"
+#include "nsQueryObject.h"
 #include "nsServiceManagerUtils.h"
 #include "nsThreadUtils.h"
 #include "PresentationLog.h"
 #include "PresentationService.h"
 #include "PresentationSessionInfo.h"
 
 #ifdef MOZ_WIDGET_ANDROID
 #  include "nsIPresentationNetworkHelper.h"
@@ -1484,17 +1486,17 @@ void PresentationPresentingInfo::Resolve
   // Use Element to support both HTMLIFrameElement and nsXULElement.
   Element* frame = nullptr;
   nsresult rv = UNWRAP_OBJECT(Element, &obj, frame);
   if (NS_WARN_IF(!frame)) {
     ReplyError(NS_ERROR_DOM_OPERATION_ERR);
     return;
   }
 
-  nsCOMPtr<nsIFrameLoaderOwner> owner = do_QueryInterface(frame);
+  RefPtr<nsFrameLoaderOwner> owner = do_QueryObject(frame);
   if (NS_WARN_IF(!owner)) {
     ReplyError(NS_ERROR_DOM_OPERATION_ERR);
     return;
   }
 
   RefPtr<nsFrameLoader> frameLoader = owner->GetFrameLoader();
   if (NS_WARN_IF(!frameLoader)) {
     ReplyError(NS_ERROR_DOM_OPERATION_ERR);
--- a/dom/webbrowserpersist/WebBrowserPersistLocalDocument.cpp
+++ b/dom/webbrowserpersist/WebBrowserPersistLocalDocument.cpp
@@ -40,16 +40,17 @@
 #include "nsISHEntry.h"
 #include "nsISupportsPrimitives.h"
 #include "nsITabParent.h"
 #include "nsIURIMutator.h"
 #include "nsIWebBrowserPersist.h"
 #include "nsIWebNavigation.h"
 #include "nsIWebPageDescriptor.h"
 #include "nsNetUtil.h"
+#include "nsQueryObject.h"
 
 namespace mozilla {
 
 NS_IMPL_CYCLE_COLLECTING_ADDREF(WebBrowserPersistLocalDocument)
 NS_IMPL_CYCLE_COLLECTING_RELEASE(WebBrowserPersistLocalDocument)
 
 NS_INTERFACE_MAP_BEGIN_CYCLE_COLLECTION(WebBrowserPersistLocalDocument)
   NS_INTERFACE_MAP_ENTRY(nsIWebBrowserPersistDocument)
@@ -278,17 +279,17 @@ void ResourceReader::DocumentDone(nsresu
     mEndStatus = aStatus;
   }
   if (--mOutstandingDocuments == 0) {
     mVisitor->EndVisit(mParent, mEndStatus);
   }
 }
 
 nsresult ResourceReader::OnWalkSubframe(nsINode* aNode) {
-  nsCOMPtr<nsIFrameLoaderOwner> loaderOwner = do_QueryInterface(aNode);
+  RefPtr<nsFrameLoaderOwner> loaderOwner = do_QueryObject(aNode);
   NS_ENSURE_STATE(loaderOwner);
   RefPtr<nsFrameLoader> loader = loaderOwner->GetFrameLoader();
   NS_ENSURE_STATE(loader);
 
   ++mOutstandingDocuments;
   // Pass in 0 as the outer window ID so that we start
   // persisting the root of this subframe, and not some other
   // subframe child of this subframe.
--- a/dom/webidl/MozFrameLoaderOwner.webidl
+++ b/dom/webidl/MozFrameLoaderOwner.webidl
@@ -1,9 +1,14 @@
-// And the things from nsIFrameLoaderOwner
+/* -*- Mode: IDL; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this file,
+ * You can obtain one at http://mozilla.org/MPL/2.0/.
+ */
+
 [NoInterfaceObject]
 interface MozFrameLoaderOwner {
   [ChromeOnly]
   readonly attribute FrameLoader? frameLoader;
 
   [ChromeOnly, Throws]
   void presetOpenerWindow(WindowProxy? window);
 
--- a/dom/xul/XULFrameElement.cpp
+++ b/dom/xul/XULFrameElement.cpp
@@ -26,17 +26,17 @@ NS_IMPL_CYCLE_COLLECTION_TRAVERSE_END
 NS_IMPL_CYCLE_COLLECTION_UNLINK_BEGIN_INHERITED(XULFrameElement, nsXULElement)
   if (tmp->mFrameLoader) {
     tmp->mFrameLoader->Destroy();
   }
   NS_IMPL_CYCLE_COLLECTION_UNLINK(mFrameLoader, mOpener)
 NS_IMPL_CYCLE_COLLECTION_UNLINK_END
 
 NS_IMPL_ISUPPORTS_CYCLE_COLLECTION_INHERITED(XULFrameElement, nsXULElement,
-                                             nsIFrameLoaderOwner)
+                                             nsFrameLoaderOwner)
 
 JSObject* XULFrameElement::WrapNode(JSContext* aCx,
                                     JS::Handle<JSObject*> aGivenProto) {
   return XULFrameElement_Binding::Wrap(aCx, this, aGivenProto);
 }
 
 nsDocShell* XULFrameElement::GetDocShell() {
   RefPtr<nsFrameLoader> frameLoader = GetFrameLoader();
@@ -116,17 +116,17 @@ void XULFrameElement::SwapFrameLoaders(X
   if (&aOtherLoaderOwner == this) {
     // nothing to do
     return;
   }
 
   aOtherLoaderOwner.SwapFrameLoaders(this, rv);
 }
 
-void XULFrameElement::SwapFrameLoaders(nsIFrameLoaderOwner* aOtherLoaderOwner,
+void XULFrameElement::SwapFrameLoaders(nsFrameLoaderOwner* aOtherLoaderOwner,
                                        mozilla::ErrorResult& rv) {
   RefPtr<nsFrameLoader> loader = GetFrameLoader();
   RefPtr<nsFrameLoader> otherLoader = aOtherLoaderOwner->GetFrameLoader();
   if (!loader || !otherLoader) {
     rv.Throw(NS_ERROR_NOT_IMPLEMENTED);
     return;
   }
 
--- a/dom/xul/XULFrameElement.h
+++ b/dom/xul/XULFrameElement.h
@@ -11,59 +11,50 @@
 #include "mozilla/ErrorResult.h"
 #include "mozilla/dom/Nullable.h"
 #include "mozilla/dom/WindowProxyHolder.h"
 #include "js/TypeDecls.h"
 #include "nsCycleCollectionParticipant.h"
 #include "nsWrapperCache.h"
 #include "nsString.h"
 #include "nsXULElement.h"
+#include "nsFrameLoaderOwner.h"
 
 class nsIWebNavigation;
 class nsFrameLoader;
 
 namespace mozilla {
 namespace dom {
 
 class BrowsingContext;
 
-class XULFrameElement final : public nsXULElement, public nsIFrameLoaderOwner {
+class XULFrameElement final : public nsXULElement, public nsFrameLoaderOwner {
  public:
   explicit XULFrameElement(already_AddRefed<mozilla::dom::NodeInfo>&& aNodeInfo)
       : nsXULElement(std::move(aNodeInfo)) {}
 
   NS_DECL_ISUPPORTS_INHERITED
   NS_DECL_CYCLE_COLLECTION_CLASS_INHERITED(XULFrameElement, nsXULElement)
 
   // XULFrameElement.webidl
   nsDocShell* GetDocShell();
   already_AddRefed<nsIWebNavigation> GetWebNavigation();
   Nullable<WindowProxyHolder> GetContentWindow();
   Document* GetContentDocument();
 
-  // nsIFrameLoaderOwner / MozFrameLoaderOwner
-  NS_IMETHOD_(already_AddRefed<nsFrameLoader>) GetFrameLoader() override {
-    return do_AddRef(mFrameLoader);
-  }
-
-  NS_IMETHOD_(void)
-  InternalSetFrameLoader(nsFrameLoader* aFrameLoader) override {
-    mFrameLoader = aFrameLoader;
-  }
-
   void PresetOpenerWindow(const Nullable<WindowProxyHolder>& aWindow,
                           ErrorResult& aRv) {
     mOpener = aWindow.IsNull() ? nullptr : aWindow.Value().get();
   }
 
   void SwapFrameLoaders(mozilla::dom::HTMLIFrameElement& aOtherLoaderOwner,
                         mozilla::ErrorResult& rv);
   void SwapFrameLoaders(XULFrameElement& aOtherLoaderOwner,
                         mozilla::ErrorResult& rv);
-  void SwapFrameLoaders(nsIFrameLoaderOwner* aOtherLoaderOwner,
+  void SwapFrameLoaders(nsFrameLoaderOwner* aOtherLoaderOwner,
                         mozilla::ErrorResult& rv);
 
   // nsIContent
   virtual nsresult BindToTree(Document* aDocument, nsIContent* aParent,
                               nsIContent* aBindingParent) override;
   virtual void UnbindFromTree(bool aDeep, bool aNullParent) override;
   virtual void DestroyContent() override;
 
@@ -71,17 +62,16 @@ class XULFrameElement final : public nsX
                                 const nsAttrValue* aValue,
                                 const nsAttrValue* aOldValue,
                                 nsIPrincipal* aSubjectPrincipal,
                                 bool aNotify) override;
 
  protected:
   virtual ~XULFrameElement() {}
 
-  RefPtr<nsFrameLoader> mFrameLoader;
   RefPtr<BrowsingContext> mOpener;
 
   JSObject* WrapNode(JSContext* aCx,
                      JS::Handle<JSObject*> aGivenProto) override;
 
   void LoadSrc();
 };
 
--- a/layout/generic/nsSubDocumentFrame.cpp
+++ b/layout/generic/nsSubDocumentFrame.cpp
@@ -36,16 +36,17 @@
 #include "nsIScrollableFrame.h"
 #include "nsIObjectLoadingContent.h"
 #include "nsLayoutUtils.h"
 #include "FrameLayerBuilder.h"
 #include "nsPluginFrame.h"
 #include "nsContentUtils.h"
 #include "nsIPermissionManager.h"
 #include "nsServiceManagerUtils.h"
+#include "nsQueryObject.h"
 #include "mozilla/Preferences.h"
 #include "mozilla/dom/HTMLFrameElement.h"
 #include "RetainedDisplayListBuilder.h"
 
 using namespace mozilla;
 using mozilla::dom::Document;
 using mozilla::layout::RenderFrame;
 
@@ -982,17 +983,17 @@ CSSIntSize nsSubDocumentFrame::GetMargin
   return result;
 }
 
 nsFrameLoader* nsSubDocumentFrame::FrameLoader() const {
   nsIContent* content = GetContent();
   if (!content) return nullptr;
 
   if (!mFrameLoader) {
-    nsCOMPtr<nsIFrameLoaderOwner> loaderOwner = do_QueryInterface(content);
+    RefPtr<nsFrameLoaderOwner> loaderOwner = do_QueryObject(content);
     if (loaderOwner) {
       mFrameLoader = loaderOwner->GetFrameLoader();
     }
   }
   return mFrameLoader;
 }
 
 // XXX this should be called ObtainDocShell or something like that,
--- a/netwerk/base/LoadInfo.cpp
+++ b/netwerk/base/LoadInfo.cpp
@@ -11,28 +11,29 @@
 #include "mozilla/dom/ClientSource.h"
 #include "mozilla/dom/PerformanceStorage.h"
 #include "mozilla/dom/TabChild.h"
 #include "mozilla/dom/ToJSValue.h"
 #include "mozilla/dom/BrowsingContext.h"
 #include "mozilla/NullPrincipal.h"
 #include "mozIThirdPartyUtil.h"
 #include "nsFrameLoader.h"
+#include "nsFrameLoaderOwner.h"
 #include "nsIContentSecurityPolicy.h"
 #include "nsIDocShell.h"
 #include "mozilla/dom/Document.h"
-#include "nsIFrameLoaderOwner.h"
 #include "nsIInterfaceRequestorUtils.h"
 #include "nsISupportsImpl.h"
 #include "nsISupportsUtils.h"
 #include "nsIXPConnect.h"
 #include "nsContentUtils.h"
 #include "nsDocShell.h"
 #include "nsGlobalWindow.h"
 #include "nsMixedContentBlocker.h"
+#include "nsQueryObject.h"
 #include "nsRedirectHistoryEntry.h"
 #include "nsSandboxFlags.h"
 #include "LoadInfo.h"
 
 using namespace mozilla::dom;
 
 namespace mozilla {
 namespace net {
@@ -217,18 +218,18 @@ LoadInfo::LoadInfo(
 
     // When the element being loaded is a frame, we choose the frame's window
     // for the window ID and the frame element's window as the parent
     // window. This is the behavior that Chrome exposes to add-ons.
     // NB: If the frameLoaderOwner doesn't have a frame loader, then the load
     // must be coming from an object (such as a plugin) that's loaded into it
     // instead of a document being loaded. In that case, treat this object like
     // any other non-document-loading element.
-    nsCOMPtr<nsIFrameLoaderOwner> frameLoaderOwner =
-        do_QueryInterface(aLoadingContext);
+    RefPtr<nsFrameLoaderOwner> frameLoaderOwner =
+        do_QueryObject(aLoadingContext);
     RefPtr<nsFrameLoader> fl =
         frameLoaderOwner ? frameLoaderOwner->GetFrameLoader() : nullptr;
     if (fl) {
       nsCOMPtr<nsIDocShell> docShell = fl->GetDocShell(IgnoreErrors());
       if (docShell) {
         nsCOMPtr<nsPIDOMWindowOuter> outerWindow = do_GetInterface(docShell);
         if (outerWindow) {
           mFrameOuterWindowID = outerWindow->WindowID();
--- a/netwerk/base/nsILoadInfo.idl
+++ b/netwerk/base/nsILoadInfo.idl
@@ -615,17 +615,17 @@ interface nsILoadInfo : nsISupports
    */
   [infallible] readonly attribute unsigned long long innerWindowID;
   [infallible] readonly attribute unsigned long long outerWindowID;
   [infallible] readonly attribute unsigned long long parentOuterWindowID;
   [infallible] readonly attribute unsigned long long topOuterWindowID;
 
   /**
    * Only when the element being loaded is <frame src="foo.html">
-   * (or, more generally, if the element QIs to nsIFrameLoaderOwner),
+   * (or, more generally, if the element QIs to nsFrameLoaderOwner),
    * the frameOuterWindowID is the outer window containing the
    * foo.html document.
    *
    * Note: For other cases, frameOuterWindowID is 0.
    */
   [infallible] readonly attribute unsigned long long frameOuterWindowID;
 
   /**
--- a/toolkit/content/widgets/browser-custom-element.js
+++ b/toolkit/content/widgets/browser-custom-element.js
@@ -1877,11 +1877,11 @@ class MozBrowser extends MozElementMixin
       return this.frameLoader.tabParent.getContentBlockingLog();
     }
     return this.docShell ?
       this.docShell.getContentBlockingLog() :
       Promise.reject("docshell isn't available");
   }
 }
 
-MozXULElement.implementCustomInterface(MozBrowser, [Ci.nsIBrowser, Ci.nsIFrameLoaderOwner]);
+MozXULElement.implementCustomInterface(MozBrowser, [Ci.nsIBrowser]);
 customElements.define("browser", MozBrowser);
 }
--- a/widget/nsBaseDragService.cpp
+++ b/widget/nsBaseDragService.cpp
@@ -10,16 +10,17 @@
 #include "nsIServiceManager.h"
 #include "nsITransferable.h"
 #include "nsSize.h"
 #include "nsXPCOM.h"
 #include "nsISupportsPrimitives.h"
 #include "nsCOMPtr.h"
 #include "nsIInterfaceRequestorUtils.h"
 #include "nsIFrame.h"
+#include "nsFrameLoaderOwner.h"
 #include "mozilla/dom/Document.h"
 #include "nsIContent.h"
 #include "nsIPresShell.h"
 #include "nsViewManager.h"
 #include "nsINode.h"
 #include "nsPresContext.h"
 #include "nsIImageLoadingContent.h"
 #include "imgIContainer.h"
@@ -535,17 +536,17 @@ nsresult nsBaseDragService::DrawDrag(nsI
   // get the presshell for the node being dragged. If the drag image is not in
   // a document or has no frame, get the presshell from the source drag node
   nsIPresShell* presShell = GetPresShellForContent(dragNode);
   if (!presShell && mImage) presShell = GetPresShellForContent(aDOMNode);
   if (!presShell) return NS_ERROR_FAILURE;
 
   *aPresContext = presShell->GetPresContext();
 
-  nsCOMPtr<nsIFrameLoaderOwner> flo = do_QueryInterface(dragNode);
+  RefPtr<nsFrameLoaderOwner> flo = do_QueryObject(dragNode);
   if (flo) {
     RefPtr<nsFrameLoader> fl = flo->GetFrameLoader();
     if (fl) {
       auto* tp = static_cast<mozilla::dom::TabParent*>(fl->GetRemoteBrowser());
       if (tp && tp->TakeDragVisualization(*aSurface, aScreenDragRect)) {
         if (mImage) {
           // Just clear the surface if chrome has overridden it with an image.
           *aSurface = nullptr;
--- a/xpfe/appshell/nsIXULBrowserWindow.idl
+++ b/xpfe/appshell/nsIXULBrowserWindow.idl
@@ -6,21 +6,19 @@
 
 #include "nsISupports.idl"
 #include "nsIURI.idl"
 
 interface nsIBrowser;
 interface nsIRequest;
 interface nsIInputStream;
 interface nsIDocShell;
-interface nsIFrameLoaderOwner;
 interface nsITabParent;
 interface nsIPrincipal;
 interface mozIDOMWindowProxy;
-
 webidl Element;
 webidl Node;
 
 /**
  * The nsIXULBrowserWindow supplies the methods that may be called from the
  * internals of the browser area to tell the containing xul window to update
  * its ui. 
  */
@@ -68,17 +66,17 @@ interface nsIXULBrowserWindow : nsISuppo
                      in nsIURI         aURI,
                      in nsIURI         aReferrer,
                      in boolean        aHasPostData,
                      in nsIPrincipal   aTriggeringPrincipal);
   /**
    * Show/hide a tooltip (when the user mouses over a link, say).
    */
   void showTooltip(in long x, in long y, in AString tooltip, in AString direction,
-                   in nsIFrameLoaderOwner browser);
+                   in Element browser);
   void hideTooltip();
 
   /**
    * Return the number of tabs in this window.
    */
   uint32_t getTabCount();
 
   /**