--- a/accessible/src/atk/AccessibleWrap.cpp
+++ b/accessible/src/atk/AccessibleWrap.cpp
@@ -6,16 +6,17 @@
 
 #include "AccessibleWrap.h"
 
 #include "Accessible-inl.h"
 #include "ApplicationAccessibleWrap.h"
 #include "InterfaceInitFuncs.h"
 #include "nsAccUtils.h"
 #include "nsIAccessibleRelation.h"
+#include "nsIAccessibleTable.h"
 #include "RootAccessible.h"
 #include "nsIAccessibleValue.h"
 #include "nsMai.h"
 #include "nsMaiHyperlink.h"
 #include "nsString.h"
 #include "nsAutoPtr.h"
 #include "prprf.h"
 #include "nsStateMap.h"

--- a/accessible/src/base/FocusManager.cpp
+++ b/accessible/src/base/FocusManager.cpp
@@ -55,17 +55,17 @@ FocusManager::IsFocused(const Accessible
     // accessible creation for temporary about:blank document. Without this
     // peculiarity we would end up with plain implementation based on
     // FocusedAccessible() method call. Make sure this issue is fixed in
     // bug 638465.
     if (focusedNode->OwnerDoc() == aAccessible->GetNode()->OwnerDoc()) {
       DocAccessible* doc = 
         GetAccService()->GetDocAccessible(focusedNode->OwnerDoc());
       return aAccessible ==
-	(doc ? doc->GetAccessibleOrContainer(focusedNode) : nullptr);
+        (doc ? doc->GetAccessibleOrContainer(focusedNode) : nullptr);
     }
   }
   return false;
 }
 
 bool
 FocusManager::IsFocusWithin(const Accessible* aContainer) const
 {

--- a/accessible/src/base/nsAccUtils.cpp
+++ b/accessible/src/base/nsAccUtils.cpp
@@ -18,17 +18,17 @@
 #include "nsIMutableArray.h"
 
 #include "nsIDOMXULContainerElement.h"
 #include "nsIDOMXULSelectCntrlEl.h"
 #include "nsIDOMXULSelectCntrlItemEl.h"
 #include "nsWhitespaceTokenizer.h"
 #include "nsComponentManagerUtils.h"
 
-namespace dom = mozilla::dom;
+using namespace mozilla;
 using namespace mozilla::a11y;
 
 void
 nsAccUtils::GetAccAttr(nsIPersistentProperties *aAttributes,
                        nsIAtom *aAttrName, nsAString& aAttrValue)
 {
   aAttrValue.Truncate();
 
@@ -475,66 +475,8 @@ nsAccUtils::MustPrune(Accessible* aAcces
     role == roles::FLAT_EQUATION ||
     role == roles::PASSWORD_TEXT ||
     role == roles::TOGGLE_BUTTON ||
     role == roles::GRAPHIC ||
     role == roles::SLIDER ||
     role == roles::PROGRESSBAR ||
     role == roles::SEPARATOR;
 }
-
-nsresult
-nsAccUtils::GetHeaderCellsFor(nsIAccessibleTable *aTable,
-                              nsIAccessibleTableCell *aCell,
-                              int32_t aRowOrColHeaderCells, nsIArray **aCells)
-{
-  nsresult rv = NS_OK;
-  nsCOMPtr<nsIMutableArray> cells = do_CreateInstance(NS_ARRAY_CONTRACTID, &rv);
-  NS_ENSURE_SUCCESS(rv, rv);
-
-  int32_t rowIdx = -1;
-  rv = aCell->GetRowIndex(&rowIdx);
-  NS_ENSURE_SUCCESS(rv, rv);
-
-  int32_t colIdx = -1;
-  rv = aCell->GetColumnIndex(&colIdx);
-  NS_ENSURE_SUCCESS(rv, rv);
-
-  bool moveToLeft = aRowOrColHeaderCells == eRowHeaderCells;
-
-  // Move to the left or top to find row header cells or column header cells.
-  int32_t index = (moveToLeft ? colIdx : rowIdx) - 1;
-  for (; index >= 0; index--) {
-    int32_t curRowIdx = moveToLeft ? rowIdx : index;
-    int32_t curColIdx = moveToLeft ? index : colIdx;
-
-    nsCOMPtr<nsIAccessible> cell;
-    rv = aTable->GetCellAt(curRowIdx, curColIdx, getter_AddRefs(cell));
-    NS_ENSURE_SUCCESS(rv, rv);
-
-    nsCOMPtr<nsIAccessibleTableCell> tableCellAcc =
-      do_QueryInterface(cell);
-
-    // GetCellAt should always return an nsIAccessibleTableCell (XXX Bug 587529)
-    NS_ENSURE_STATE(tableCellAcc);
-
-    int32_t origIdx = 1;
-    if (moveToLeft)
-      rv = tableCellAcc->GetColumnIndex(&origIdx);
-    else
-      rv = tableCellAcc->GetRowIndex(&origIdx);
-    NS_ENSURE_SUCCESS(rv, rv);
-
-    if (origIdx == index) {
-      // Append original header cells only.
-      uint32_t role = Role(cell);
-      bool isHeader = moveToLeft ?
-        role == nsIAccessibleRole::ROLE_ROWHEADER :
-        role == nsIAccessibleRole::ROLE_COLUMNHEADER;
-
-      if (isHeader)
-        cells->AppendElement(cell, false);
-    }
-  }
-
-  NS_ADDREF(*aCells = cells);
-  return NS_OK;
-}

--- a/accessible/src/base/nsAccUtils.h
+++ b/accessible/src/base/nsAccUtils.h
@@ -4,17 +4,16 @@
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 #ifndef nsAccUtils_h_
 #define nsAccUtils_h_
 
 #include "nsIAccessible.h"
 #include "nsIAccessibleRole.h"
 #include "nsIAccessibleText.h"
-#include "nsIAccessibleTable.h"
 
 #include "nsAccessibilityService.h"
 #include "nsCoreUtils.h"
 
 #include "mozilla/dom/Element.h"
 #include "nsIDocShell.h"
 #include "nsIDocShellTreeItem.h"
 #include "nsIDOMNode.h"
@@ -288,37 +287,11 @@ public:
       *aState2 = static_cast<uint32_t>(aState64 >> 31);
   }
 
   /**
    * Return true if the given accessible can't have children. Used when exposing
    * to platform accessibility APIs, should the children be pruned off?
    */
   static bool MustPrune(Accessible* aAccessible);
-
-  /**
-   * Search hint enum constants. Used by GetHeaderCellsFor() method.
-   */
-  enum {
-    // search for row header cells, left direction
-    eRowHeaderCells,
-    // search for column header cells, top direction
-    eColumnHeaderCells
-  };
-
-  /**
-   * Return an array of row or column header cells for the given cell.
-   *
-   * @param aTable                [in] table accessible
-   * @param aCell                 [in] cell accessible within the given table to
-   *                               get header cells
-   * @param aRowOrColHeaderCells  [in] specifies whether column or row header
-   *                               cells are returned (see enum constants
-   *                               above)
-   * @param aCells                [out] array of header cell accessibles
-   */
-  static nsresult GetHeaderCellsFor(nsIAccessibleTable *aTable,
-                                    nsIAccessibleTableCell *aCell,
-                                    int32_t aRowOrColHeaderCells,
-                                    nsIArray **aCells);
 };
 
 #endif

--- a/accessible/src/base/nsAccessibilityService.cpp
+++ b/accessible/src/base/nsAccessibilityService.cpp
@@ -1605,22 +1605,19 @@ nsAccessibilityService::CreateHTMLAccess
       return accessible;
     }
 
     Accessible* accessible = new HTMLLinkAccessible(aContent, aDoc);
     NS_IF_ADDREF(accessible);
     return accessible;
   }
 
-  if (tag == nsGkAtoms::dt ||
-      (tag == nsGkAtoms::li &&
-       aFrame->GetType() != nsGkAtoms::blockFrame)) {
-    // Normally for li, it is created by the list item frame (in nsBlockFrame)
-    // which knows about the bullet frame; however, in this case the list item
-    // must have been styled using display: foo
+  if (tag == nsGkAtoms::dt || tag == nsGkAtoms::li) {
+    // Create list item accessible unconditionally by tag name. nsBlockFrame
+    // creates the list item accessible for other elements styled as list items.
     Accessible* accessible = new HTMLLIAccessible(aContent, aDoc);
     NS_IF_ADDREF(accessible);
     return accessible;
   }
 
   if (tag == nsGkAtoms::abbr ||
       tag == nsGkAtoms::acronym ||
       tag == nsGkAtoms::blockquote ||

--- a/accessible/src/generic/ARIAGridAccessible.cpp
+++ b/accessible/src/generic/ARIAGridAccessible.cpp
@@ -540,151 +540,57 @@ ARIAGridCellAccessible::
 
 NS_IMPL_ISUPPORTS_INHERITED1(ARIAGridCellAccessible,
                              HyperTextAccessible,
                              nsIAccessibleTableCell)
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsIAccessibleTableCell
 
-NS_IMETHODIMP
-ARIAGridCellAccessible::GetTable(nsIAccessibleTable** aTable)
+TableAccessible*
+ARIAGridCellAccessible::Table() const
 {
-  NS_ENSURE_ARG_POINTER(aTable);
-  *aTable = nullptr;
-
   Accessible* table = TableFor(Row());
-  if (table)
-    CallQueryInterface(table, aTable);
-
-  return NS_OK;
+  return table ? table->AsTable() : nullptr;
 }
 
-NS_IMETHODIMP
-ARIAGridCellAccessible::GetColumnIndex(int32_t* aColumnIndex)
+uint32_t
+ARIAGridCellAccessible::ColIdx() const
 {
-  NS_ENSURE_ARG_POINTER(aColumnIndex);
-  *aColumnIndex = -1;
-
-  if (IsDefunct())
-    return NS_ERROR_FAILURE;
-
-  Accessible* row = Parent();
+  Accessible* row = Row();
   if (!row)
-    return NS_OK;
-
-  *aColumnIndex = 0;
+    return 0;
 
   int32_t indexInRow = IndexInParent();
+  uint32_t colIdx = 0;
   for (int32_t idx = 0; idx < indexInRow; idx++) {
     Accessible* cell = row->GetChildAt(idx);
     roles::Role role = cell->Role();
     if (role == roles::GRID_CELL || role == roles::ROWHEADER ||
         role == roles::COLUMNHEADER)
-      (*aColumnIndex)++;
+      colIdx++;
   }
 
-  return NS_OK;
-}
-
-NS_IMETHODIMP
-ARIAGridCellAccessible::GetRowIndex(int32_t* aRowIndex)
-{
-  NS_ENSURE_ARG_POINTER(aRowIndex);
-  *aRowIndex = -1;
-
-  if (IsDefunct())
-    return NS_ERROR_FAILURE;
-
-  *aRowIndex = RowIndexFor(Row());
-  return NS_OK;
-}
-
-NS_IMETHODIMP
-ARIAGridCellAccessible::GetColumnExtent(int32_t* aExtentCount)
-{
-  NS_ENSURE_ARG_POINTER(aExtentCount);
-  *aExtentCount = 0;
-
-  if (IsDefunct())
-    return NS_ERROR_FAILURE;
-
-  *aExtentCount = 1;
-  return NS_OK;
-}
-
-NS_IMETHODIMP
-ARIAGridCellAccessible::GetRowExtent(int32_t* aExtentCount)
-{
-  NS_ENSURE_ARG_POINTER(aExtentCount);
-  *aExtentCount = 0;
-
-  if (IsDefunct())
-    return NS_ERROR_FAILURE;
-
-  *aExtentCount = 1;
-  return NS_OK;
+  return colIdx;
 }
 
-NS_IMETHODIMP
-ARIAGridCellAccessible::GetColumnHeaderCells(nsIArray** aHeaderCells)
+uint32_t
+ARIAGridCellAccessible::RowIdx() const
 {
-  NS_ENSURE_ARG_POINTER(aHeaderCells);
-  *aHeaderCells = nullptr;
-
-  if (IsDefunct())
-    return NS_ERROR_FAILURE;
-
-  nsCOMPtr<nsIAccessibleTable> table;
-  GetTable(getter_AddRefs(table));
-  if (!table)
-    return NS_OK;
-
-  return nsAccUtils::GetHeaderCellsFor(table, this,
-                                       nsAccUtils::eColumnHeaderCells,
-                                       aHeaderCells);
+  return RowIndexFor(Row());
 }
 
-NS_IMETHODIMP
-ARIAGridCellAccessible::GetRowHeaderCells(nsIArray** aHeaderCells)
+bool
+ARIAGridCellAccessible::Selected()
 {
-  NS_ENSURE_ARG_POINTER(aHeaderCells);
-  *aHeaderCells = nullptr;
-
-  if (IsDefunct())
-    return NS_ERROR_FAILURE;
-
-  nsCOMPtr<nsIAccessibleTable> table;
-  GetTable(getter_AddRefs(table));
-  if (!table)
-    return NS_OK;
-
-  return nsAccUtils::GetHeaderCellsFor(table, this,
-                                       nsAccUtils::eRowHeaderCells,
-                                       aHeaderCells);
-}
+  Accessible* row = Row();
+  if (!row)
+    return false;
 
-NS_IMETHODIMP
-ARIAGridCellAccessible::IsSelected(bool* aIsSelected)
-{
-  NS_ENSURE_ARG_POINTER(aIsSelected);
-  *aIsSelected = false;
-
-  if (IsDefunct())
-    return NS_ERROR_FAILURE;
-
-  Accessible* row = Parent();
-  if (!row || row->Role() != roles::ROW)
-    return NS_OK;
-
-  if (!nsAccUtils::IsARIASelected(row) && !nsAccUtils::IsARIASelected(this))
-    return NS_OK;
-
-  *aIsSelected = true;
-  return NS_OK;
+  return nsAccUtils::IsARIASelected(row) || nsAccUtils::IsARIASelected(this);
 }
 
 ////////////////////////////////////////////////////////////////////////////////
 // Accessible
 
 void
 ARIAGridCellAccessible::ApplyARIAState(uint64_t* aState) const
 {

--- a/accessible/src/generic/ARIAGridAccessible.h
+++ b/accessible/src/generic/ARIAGridAccessible.h
@@ -53,16 +53,17 @@ public:
   virtual void SelectedCells(nsTArray<Accessible*>* aCells);
   virtual void SelectedCellIndices(nsTArray<uint32_t>* aCells);
   virtual void SelectedColIndices(nsTArray<uint32_t>* aCols);
   virtual void SelectedRowIndices(nsTArray<uint32_t>* aRows);
   virtual void SelectCol(uint32_t aColIdx);
   virtual void SelectRow(uint32_t aRowIdx);
   virtual void UnselectCol(uint32_t aColIdx);
   virtual void UnselectRow(uint32_t aRowIdx);
+  virtual Accessible* AsAccessible() { return this; }
 
 protected:
 
   /**
    * Return true if the given row index is valid.
    */
   bool IsValidRow(int32_t aRow);
 
@@ -104,19 +105,20 @@ class ARIAGridCellAccessible : public Hy
 {
 public:
   ARIAGridCellAccessible(nsIContent* aContent, DocAccessible* aDoc);
 
   // nsISupports
   NS_DECL_ISUPPORTS_INHERITED
 
   // nsIAccessibleTableCell
-  NS_DECL_OR_FORWARD_NSIACCESSIBLETABLECELL_WITH_XPCACCESSIBLETABLECELL
+  NS_FORWARD_NSIACCESSIBLETABLECELL(xpcAccessibleTableCell::)
 
   // Accessible
+  virtual TableCellAccessible* AsTableCell() { return this; }
   virtual void Shutdown();
   virtual void ApplyARIAState(uint64_t* aState) const;
   virtual nsresult GetAttributesInternal(nsIPersistentProperties *aAttributes);
 
 protected:
 
   /**
    * Return a containing row.
@@ -131,14 +133,20 @@ protected:
    * Return a table for the given row.
    */
   Accessible* TableFor(Accessible* aRow) const;
 
   /**
    * Return index of the given row.
    */
   int32_t RowIndexFor(Accessible* aRow) const;
+
+  // TableCellAccessible
+  virtual TableAccessible* Table() const MOZ_OVERRIDE;
+  virtual uint32_t ColIdx() const MOZ_OVERRIDE;
+  virtual uint32_t RowIdx() const MOZ_OVERRIDE;
+  virtual bool Selected() MOZ_OVERRIDE;
 };
 
 } // namespace a11y
 } // namespace mozilla
 
 #endif

--- a/accessible/src/generic/Accessible.cpp
+++ b/accessible/src/generic/Accessible.cpp
@@ -2841,17 +2841,31 @@ bool
 Accessible::IsWidget() const
 {
   return false;
 }
 
 bool
 Accessible::IsActiveWidget() const
 {
-  return FocusMgr()->IsFocused(this);
+  if (FocusMgr()->HasDOMFocus(mContent))
+    return true;
+
+  // If text entry of combobox widget has a focus then the combobox widget is
+  // active.
+  if (mRoleMapEntry && mRoleMapEntry->Is(nsGkAtoms::combobox)) {
+    uint32_t childCount = ChildCount();
+    for (uint32_t idx = 0; idx < childCount; idx++) {
+      Accessible* child = mChildren.ElementAt(idx);
+      if (child->Role() == roles::ENTRY)
+        return FocusMgr()->HasDOMFocus(child->GetContent());
+    }
+  }
+
+  return false;
 }
 
 bool
 Accessible::AreItemsOperable() const
 {
   return mContent->HasAttr(kNameSpaceID_None, nsGkAtoms::aria_activedescendant);
 }
 

--- a/accessible/src/generic/Accessible.h
+++ b/accessible/src/generic/Accessible.h
@@ -32,16 +32,17 @@ namespace mozilla {
 namespace a11y {
 
 class EmbeddedObjCollector;
 class HTMLImageMapAccessible;
 class HTMLLIAccessible;
 class ImageAccessible;
 class Relation;
 class TableAccessible;
+class TableCellAccessible;
 class TextLeafAccessible;
 class XULTreeAccessible;
 
 /**
  * Name type flags.
  */
 enum ENameValueFlag {
   /**
@@ -509,16 +510,18 @@ public:
 
   inline bool IsMenuPopup() const { return mFlags & eMenuPopupAccessible; }
 
   inline bool IsRoot() const { return mFlags & eRootAccessible; }
   mozilla::a11y::RootAccessible* AsRoot();
 
   virtual mozilla::a11y::TableAccessible* AsTable() { return nullptr; }
 
+  virtual mozilla::a11y::TableCellAccessible* AsTableCell() { return nullptr; }
+
   inline bool IsTextLeaf() const { return mFlags & eTextLeafAccessible; }
   mozilla::a11y::TextLeafAccessible* AsTextLeaf();
 
   //////////////////////////////////////////////////////////////////////////////
   // ActionAccessible
 
   /**
    * Return the number of actions that can be performed on this accessible.

--- a/accessible/src/generic/DocAccessible.cpp
+++ b/accessible/src/generic/DocAccessible.cpp
@@ -1216,21 +1216,21 @@ DocAccessible::ARIAAttributeChanged(nsIC
                                aContent);
     return;
   }
 }
 
 void
 DocAccessible::ARIAActiveDescendantChanged(nsIContent* aElm)
 {
-  if (FocusMgr()->HasDOMFocus(aElm)) {
+  Accessible* widget = GetAccessible(aElm);
+  if (widget && widget->IsActiveWidget()) {
     nsAutoString id;
     if (aElm->GetAttr(kNameSpaceID_None, nsGkAtoms::aria_activedescendant, id)) {
-      nsIDocument* DOMDoc = aElm->OwnerDoc();
-      dom::Element* activeDescendantElm = DOMDoc->GetElementById(id);
+      dom::Element* activeDescendantElm = aElm->OwnerDoc()->GetElementById(id);
       if (activeDescendantElm) {
         Accessible* activeDescendant = GetAccessible(activeDescendantElm);
         if (activeDescendant) {
           FocusMgr()->ActiveItemChanged(activeDescendant, false);
           A11YDEBUG_FOCUS_ACTIVEITEMCHANGE_CAUSE("ARIA activedescedant changed",
                                                  activeDescendant)
         }
       }

--- a/accessible/src/generic/Makefile.in
+++ b/accessible/src/generic/Makefile.in
@@ -20,16 +20,17 @@ CPPSRCS = \
   ARIAGridAccessible.cpp \
   BaseAccessibles.cpp \
   DocAccessible.cpp \
   FormControlAccessible.cpp \
   HyperTextAccessible.cpp \
   ImageAccessible.cpp \
   OuterDocAccessible.cpp \
   RootAccessible.cpp \
+  TableCellAccessible.cpp \
   TextLeafAccessible.cpp \
   $(NULL)
 
 EXPORTS_NAMESPACES = mozilla/a11y
 
 EXPORTS_mozilla/a11y = \
   Accessible.h \
   DocAccessible.h \

--- a/accessible/src/generic/TableAccessible.h
+++ b/accessible/src/generic/TableAccessible.h
@@ -170,14 +170,19 @@ public:
    * Unselect the given row leaving other selected rows selected.
    */
   virtual void UnselectRow(uint32_t aRowIdx) {}
 
   /**
    * Return true if the table is probably for layout.
    */
   virtual bool IsProbablyLayoutTable() { return false; }
+
+  /**
+   * Convert the table to an Accessible*.
+   */
+  virtual Accessible* AsAccessible() = 0;
 };
 
 } // namespace a11y
 } // namespace mozilla
 
 #endif

new file mode 100644
--- /dev/null
+++ b/accessible/src/generic/TableCellAccessible.cpp
@@ -0,0 +1,67 @@
+/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this file,
+ * You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "TableCellAccessible.h"
+
+#include "Accessible-inl.h"
+#include "TableAccessible.h"
+
+using namespace mozilla;
+using namespace mozilla::a11y;
+
+void
+TableCellAccessible::RowHeaderCells(nsTArray<Accessible*>* aCells)
+{
+  uint32_t rowIdx = RowIdx(), colIdx = ColIdx();
+  TableAccessible* table = Table();
+  if (!table)
+    return;
+
+  // Move to the left to find row header cells
+  for (uint32_t curColIdx = colIdx - 1; curColIdx < colIdx; curColIdx--) {
+    Accessible* cell = table->CellAt(rowIdx, curColIdx);
+    if (!cell)
+      continue;
+
+    // CellAt should always return a TableCellAccessible (XXX Bug 587529)
+    TableCellAccessible* tableCell = cell->AsTableCell();
+    NS_ASSERTION(tableCell, "cell should be a table cell!");
+    if (!tableCell)
+      continue;
+
+    // Avoid addding cells multiple times, if this cell spans more columns
+    // we'll get it later.
+    if (tableCell->ColIdx() == curColIdx && cell->Role() == roles::ROWHEADER)
+      aCells->AppendElement(cell);
+  }
+}
+
+void
+TableCellAccessible::ColHeaderCells(nsTArray<Accessible*>* aCells)
+{
+  uint32_t rowIdx = RowIdx(), colIdx = ColIdx();
+  TableAccessible* table = Table();
+  if (!table)
+    return;
+
+  // Move to the left to find row header cells
+  for (uint32_t curRowIdx = rowIdx - 1; curRowIdx < rowIdx; curRowIdx--) {
+    Accessible* cell = table->CellAt(curRowIdx, colIdx);
+    if (!cell)
+      continue;
+
+    // CellAt should always return a TableCellAccessible (XXX Bug 587529)
+    TableCellAccessible* tableCell = cell->AsTableCell();
+    NS_ASSERTION(tableCell, "cell should be a table cell!");
+    if (!tableCell)
+      continue;
+
+    // Avoid addding cells multiple times, if this cell spans more rows
+    // we'll get it later.
+    if (tableCell->RowIdx() == curRowIdx && cell->Role() == roles::COLUMNHEADER)
+      aCells->AppendElement(cell);
+  }
+}

--- a/accessible/src/generic/TableCellAccessible.h
+++ b/accessible/src/generic/TableCellAccessible.h
@@ -10,62 +10,62 @@
 #include "nsTArray.h"
 #include "mozilla/StandardInteger.h"
 
 class Accessible;
 
 namespace mozilla {
 namespace a11y {
 
-  class TableAccessible;
+class TableAccessible;
 
 /**
- * abstract interface implemented by table cell accessibles.
+ * Abstract interface implemented by table cell accessibles.
  */
 class TableCellAccessible
 {
 public:
 
   /**
    * Return the table this cell is in.
    */
-  virtual TableAccessible* Table() { return nullptr; }
+  virtual TableAccessible* Table() const = 0;
 
   /**
-   * Return the Column of the table this cell is in.
+   * Return the column of the table this cell is in.
    */
-  virtual uint32_t ColIdx() { return 0; }
+  virtual uint32_t ColIdx() const = 0;
 
   /**
-   * Return the the row of the table this cell is in.
+   * Return the row of the table this cell is in.
    */
-  virtual uint32_t RowIdx() { return 0; }
+  virtual uint32_t RowIdx() const = 0;
 
   /**
    * Return the column extent of this cell.
    */
-  virtual uint32_t ColExtent() { return 0; }
+  virtual uint32_t ColExtent() const { return 1; }
 
   /**
    * Return the row extent of this cell.
    */
-  virtual uint32_t RowExtent() { return 0; }
+  virtual uint32_t RowExtent() const { return 1; }
 
   /**
    * Return the column header cells for this cell.
    */
-  virtual void ColHeaderCells(nsTArray<Accessible*>* aCells) { }
+  virtual void ColHeaderCells(nsTArray<Accessible*>* aCells);
 
   /**
    * Return the row header cells for this cell.
    */
-  virtual void RowHeaderCells(nsTArray<Accessible*>* aCells) { }
+  virtual void RowHeaderCells(nsTArray<Accessible*>* aCells);
 
   /**
    * Returns true if this cell is selected.
    */
-  virtual bool Selected() { return false; }
+  virtual bool Selected() = 0;
 };
 
-}
-}
+} // namespace a11y
+} // namespace mozilla
 
 #endif // mozilla_a11y_TableCellAccessible_h__

--- a/accessible/src/html/HTMLTableAccessible.cpp
+++ b/accessible/src/html/HTMLTableAccessible.cpp
@@ -55,18 +55,18 @@ HTMLTableCellAccessible::
 
 NS_IMPL_ISUPPORTS_INHERITED1(HTMLTableCellAccessible,
                              HyperTextAccessible,
                              nsIAccessibleTableCell)
 
 ////////////////////////////////////////////////////////////////////////////////
 // HTMLTableCellAccessible: Accessible implementation
 
-  void
-  HTMLTableCellAccessible::Shutdown()
+void
+HTMLTableCellAccessible::Shutdown()
 {
   mTableCell = nullptr;
   HyperTextAccessibleWrap::Shutdown();
 }
 
 role
 HTMLTableCellAccessible::NativeRole()
 {
@@ -98,30 +98,26 @@ HTMLTableCellAccessible::GetAttributesIn
 {
   if (IsDefunct())
     return NS_ERROR_FAILURE;
 
   nsresult rv = HyperTextAccessibleWrap::GetAttributesInternal(aAttributes);
   NS_ENSURE_SUCCESS(rv, rv);
 
   // table-cell-index attribute
-  nsCOMPtr<nsIAccessibleTable> tableAcc(GetTableAccessible());
-  if (!tableAcc)
+  TableAccessible* table = Table();
+  if (!table)
     return NS_OK;
 
   int32_t rowIdx = -1, colIdx = -1;
   rv = GetCellIndexes(rowIdx, colIdx);
   NS_ENSURE_SUCCESS(rv, rv);
 
-  int32_t idx = -1;
-  rv = tableAcc->GetCellIndexAt(rowIdx, colIdx, &idx);
-  NS_ENSURE_SUCCESS(rv, rv);
-
   nsAutoString stringIdx;
-  stringIdx.AppendInt(idx);
+  stringIdx.AppendInt(table->CellIndexAt(rowIdx, colIdx));
   nsAccUtils::SetAccAttr(aAttributes, nsGkAtoms::tableCellIndex, stringIdx);
 
   // abbr attribute
 
   // Pick up object attribute from abbr DOM element (a child of the cell) or
   // from abbr DOM attribute.
   nsAutoString abbrText;
   if (ChildCount() == 1) {
@@ -145,213 +141,133 @@ HTMLTableCellAccessible::GetAttributesIn
     nsAccUtils::SetAccAttr(aAttributes, nsGkAtoms::axis, axisText);
 
   return NS_OK;
 }
 
 ////////////////////////////////////////////////////////////////////////////////
 // HTMLTableCellAccessible: nsIAccessibleTableCell implementation
 
-NS_IMETHODIMP
-HTMLTableCellAccessible::GetTable(nsIAccessibleTable** aTable)
+TableAccessible*
+HTMLTableCellAccessible::Table() const
 {
-  NS_ENSURE_ARG_POINTER(aTable);
-  *aTable = nullptr;
+  Accessible* parent = const_cast<HTMLTableCellAccessible*>(this);
+  while ((parent = parent->Parent())) {
+    roles::Role role = parent->Role();
+    if (role == roles::TABLE || role == roles::TREE_TABLE)
+      return parent->AsTable();
+  }
 
-  if (IsDefunct())
-    return NS_OK;
-
-  nsCOMPtr<nsIAccessibleTable> table = GetTableAccessible();
-  table.swap(*aTable);
-
-  return NS_OK;
+  return nullptr;
 }
 
-NS_IMETHODIMP
-HTMLTableCellAccessible::GetColumnIndex(int32_t* aColumnIndex)
+uint32_t
+HTMLTableCellAccessible::ColIdx() const
 {
-  NS_ENSURE_ARG_POINTER(aColumnIndex);
-  *aColumnIndex = -1;
+  nsITableCellLayout* cellLayout = GetCellLayout();
+  NS_ENSURE_TRUE(cellLayout, 0);
 
-  if (IsDefunct())
-    return NS_ERROR_FAILURE;
-
-  nsITableCellLayout* cellLayout = GetCellLayout();
-  NS_ENSURE_STATE(cellLayout);
-
-  return cellLayout->GetColIndex(*aColumnIndex);
+  int32_t colIdx = 0;
+  cellLayout->GetColIndex(colIdx);
+  return colIdx > 0 ? static_cast<uint32_t>(colIdx) : 0;
 }
 
-NS_IMETHODIMP
-HTMLTableCellAccessible::GetRowIndex(int32_t* aRowIndex)
+uint32_t
+HTMLTableCellAccessible::RowIdx() const
 {
-  NS_ENSURE_ARG_POINTER(aRowIndex);
-  *aRowIndex = -1;
+  nsITableCellLayout* cellLayout = GetCellLayout();
+  NS_ENSURE_TRUE(cellLayout, 0);
 
-  if (IsDefunct())
-    return NS_ERROR_FAILURE;
-
-  nsITableCellLayout* cellLayout = GetCellLayout();
-  NS_ENSURE_STATE(cellLayout);
-
-  return cellLayout->GetRowIndex(*aRowIndex);
+  int32_t rowIdx = 0;
+  cellLayout->GetRowIndex(rowIdx);
+  return rowIdx > 0 ? static_cast<uint32_t>(rowIdx) : 0;
 }
 
-NS_IMETHODIMP
-HTMLTableCellAccessible::GetColumnExtent(int32_t* aExtentCount)
+uint32_t
+HTMLTableCellAccessible::ColExtent() const
 {
-  NS_ENSURE_ARG_POINTER(aExtentCount);
-  *aExtentCount = 1;
-
   int32_t rowIdx = -1, colIdx = -1;
   GetCellIndexes(rowIdx, colIdx);
 
-  nsCOMPtr<nsIAccessibleTable> table = GetTableAccessible();
-  NS_ENSURE_STATE(table);
+  TableAccessible* table = Table();
+  NS_ASSERTION(table, "cell not in a table!");
+  if (!table)
+    return 0;
 
-  return table->GetColumnExtentAt(rowIdx, colIdx, aExtentCount);
+  return table->ColExtentAt(rowIdx, colIdx);
 }
 
-NS_IMETHODIMP
-HTMLTableCellAccessible::GetRowExtent(int32_t* aExtentCount)
+uint32_t
+HTMLTableCellAccessible::RowExtent() const
 {
-  NS_ENSURE_ARG_POINTER(aExtentCount);
-  *aExtentCount = 1;
-
   int32_t rowIdx = -1, colIdx = -1;
   GetCellIndexes(rowIdx, colIdx);
 
-  nsCOMPtr<nsIAccessibleTable> table = GetTableAccessible();
-  NS_ENSURE_STATE(table);
-
-  return table->GetRowExtentAt(rowIdx, colIdx, aExtentCount);
-}
+  TableAccessible* table = Table();
+  NS_ASSERTION(table, "cell not in atable!");
+  if (!table)
+    return 0;
 
-NS_IMETHODIMP
-HTMLTableCellAccessible::GetColumnHeaderCells(nsIArray** aHeaderCells)
-{
-  NS_ENSURE_ARG_POINTER(aHeaderCells);
-  *aHeaderCells = nullptr;
-
-  if (IsDefunct())
-    return NS_ERROR_FAILURE;
-
-  return GetHeaderCells(nsAccUtils::eColumnHeaderCells, aHeaderCells);
+  return table->RowExtentAt(rowIdx, colIdx);
 }
 
-NS_IMETHODIMP
-HTMLTableCellAccessible::GetRowHeaderCells(nsIArray** aHeaderCells)
+void
+HTMLTableCellAccessible::ColHeaderCells(nsTArray<Accessible*>* aCells)
 {
-  NS_ENSURE_ARG_POINTER(aHeaderCells);
-  *aHeaderCells = nullptr;
+  IDRefsIterator itr(mDoc, mContent, nsGkAtoms::headers);
+  while (Accessible* cell = itr.Next())
+    if (cell->Role() == roles::COLUMNHEADER)
+      aCells->AppendElement(cell);
 
-  if (IsDefunct())
-    return NS_ERROR_FAILURE;
-
-  return GetHeaderCells(nsAccUtils::eRowHeaderCells, aHeaderCells);
+  if (aCells->IsEmpty())
+    TableCellAccessible::ColHeaderCells(aCells);
 }
 
-NS_IMETHODIMP
-HTMLTableCellAccessible::IsSelected(bool* aIsSelected)
+void
+HTMLTableCellAccessible::RowHeaderCells(nsTArray<Accessible*>* aCells)
 {
-  NS_ENSURE_ARG_POINTER(aIsSelected);
-  *aIsSelected = false;
+  IDRefsIterator itr(mDoc, mContent, nsGkAtoms::headers);
+  while (Accessible* cell = itr.Next())
+    if (cell->Role() == roles::ROWHEADER)
+      aCells->AppendElement(cell);
 
-  if (IsDefunct())
-    return NS_ERROR_FAILURE;
+  if (aCells->IsEmpty())
+    TableCellAccessible::RowHeaderCells(aCells);
+}
 
+bool
+HTMLTableCellAccessible::Selected()
+{
   int32_t rowIdx = -1, colIdx = -1;
   GetCellIndexes(rowIdx, colIdx);
 
-  nsCOMPtr<nsIAccessibleTable> table = GetTableAccessible();
-  NS_ENSURE_STATE(table);
+  TableAccessible* table = Table();
+  NS_ENSURE_TRUE(table, false);
 
-  return table->IsCellSelected(rowIdx, colIdx, aIsSelected);
+  return table->IsCellSelected(rowIdx, colIdx);
 }
 
 ////////////////////////////////////////////////////////////////////////////////
 // HTMLTableCellAccessible: protected implementation
 
-already_AddRefed<nsIAccessibleTable>
-HTMLTableCellAccessible::GetTableAccessible()
+nsITableCellLayout*
+HTMLTableCellAccessible::GetCellLayout() const
 {
-  Accessible* parent = this;
-  while ((parent = parent->Parent())) {
-    roles::Role role = parent->Role();
-    if (role == roles::TABLE || role == roles::TREE_TABLE) {
-      nsIAccessibleTable* tableAcc = nullptr;
-      CallQueryInterface(parent, &tableAcc);
-      return tableAcc;
-    }
-  }
-
-  return nullptr;
-}
-
-nsITableCellLayout*
-HTMLTableCellAccessible::GetCellLayout()
-{
-  nsIFrame *frame = mContent->GetPrimaryFrame();
-  NS_ASSERTION(frame, "The frame cannot be obtaied for HTML table cell.");
-  if (!frame)
-    return nullptr;
-
-  nsITableCellLayout *cellLayout = do_QueryFrame(frame);
-  return cellLayout;
+  return do_QueryFrame(mContent->GetPrimaryFrame());
 }
 
 nsresult
-HTMLTableCellAccessible::GetCellIndexes(int32_t& aRowIndex, int32_t& aColIndex)
+HTMLTableCellAccessible::GetCellIndexes(int32_t& aRowIdx, int32_t& aColIdx) const
 {
   nsITableCellLayout *cellLayout = GetCellLayout();
   NS_ENSURE_STATE(cellLayout);
 
-  return cellLayout->GetCellIndexes(aRowIndex, aColIndex);
+  return cellLayout->GetCellIndexes(aRowIdx, aColIdx);
 }
 
-nsresult
-HTMLTableCellAccessible::GetHeaderCells(int32_t aRowOrColumnHeaderCell,
-                                        nsIArray** aHeaderCells)
-{
-  // Get header cells from @header attribute.
-  IDRefsIterator iter(mDoc, mContent, nsGkAtoms::headers);
-  nsIContent* headerCellElm = iter.NextElem();
-  if (headerCellElm) {
-    nsresult rv = NS_OK;
-    nsCOMPtr<nsIMutableArray> headerCells =
-      do_CreateInstance(NS_ARRAY_CONTRACTID, &rv);
-    NS_ENSURE_SUCCESS(rv, rv);
-    roles::Role desiredRole = static_cast<roles::Role>(-1) ;
-    if (aRowOrColumnHeaderCell == nsAccUtils::eRowHeaderCells)
-      desiredRole = roles::ROWHEADER;
-    else if (aRowOrColumnHeaderCell == nsAccUtils::eColumnHeaderCells)
-      desiredRole = roles::COLUMNHEADER;
-
-    do {
-      Accessible* headerCell = mDoc->GetAccessible(headerCellElm);
-
-      if (headerCell && headerCell->Role() == desiredRole)
-        headerCells->AppendElement(static_cast<nsIAccessible*>(headerCell),
-                                   false);
-    } while ((headerCellElm = iter.NextElem()));
-
-    NS_ADDREF(*aHeaderCells = headerCells);
-    return NS_OK;
-  }
-
-  // Otherwise calculate header cells from hierarchy (see 11.4.3 "Algorithm to
-  // find heading information" of w3c HTML 4.01).
-  nsCOMPtr<nsIAccessibleTable> table = GetTableAccessible();
-  if (table) {
-    return nsAccUtils::GetHeaderCellsFor(table, this, aRowOrColumnHeaderCell,
-                                         aHeaderCells);
-  }
-
-  return NS_OK;
-}
 
 ////////////////////////////////////////////////////////////////////////////////
 // HTMLTableHeaderCellAccessible
 ////////////////////////////////////////////////////////////////////////////////
 
 HTMLTableHeaderCellAccessible::
   HTMLTableHeaderCellAccessible(nsIContent* aContent, DocAccessible* aDoc) :
   HTMLTableCellAccessible(aContent, aDoc)

--- a/accessible/src/html/HTMLTableAccessible.h
+++ b/accessible/src/html/HTMLTableAccessible.h
@@ -29,46 +29,51 @@ class HTMLTableCellAccessible : public H
 {
 public:
   HTMLTableCellAccessible(nsIContent* aContent, DocAccessible* aDoc);
 
   // nsISupports
   NS_DECL_ISUPPORTS_INHERITED
 
   // nsIAccessibleTableCell
-  NS_DECL_OR_FORWARD_NSIACCESSIBLETABLECELL_WITH_XPCACCESSIBLETABLECELL
+  NS_FORWARD_NSIACCESSIBLETABLECELL(xpcAccessibleTableCell::)
 
   // Accessible
+  virtual TableCellAccessible* AsTableCell() { return this; }
   virtual void Shutdown();
   virtual a11y::role NativeRole();
   virtual uint64_t NativeState();
   virtual uint64_t NativeInteractiveState() const;
   virtual nsresult GetAttributesInternal(nsIPersistentProperties *aAttributes);
 
+  // TableCellAccessible
+  virtual TableAccessible* Table() const MOZ_OVERRIDE;
+  virtual uint32_t ColIdx() const MOZ_OVERRIDE;
+  virtual uint32_t RowIdx() const MOZ_OVERRIDE;
+  virtual uint32_t ColExtent() const MOZ_OVERRIDE;
+  virtual uint32_t RowExtent() const MOZ_OVERRIDE;
+  virtual void ColHeaderCells(nsTArray<Accessible*>* aCells) MOZ_OVERRIDE;
+  virtual void RowHeaderCells(nsTArray<Accessible*>* aCells) MOZ_OVERRIDE;
+  virtual bool Selected() MOZ_OVERRIDE;
+
 protected:
   /**
    * Return host table accessible.
    */
   already_AddRefed<nsIAccessibleTable> GetTableAccessible();
 
   /**
    * Return nsITableCellLayout of the table cell frame.
    */
-  nsITableCellLayout* GetCellLayout();
+  nsITableCellLayout* GetCellLayout() const;
 
   /**
    * Return row and column indices of the cell.
    */
-  nsresult GetCellIndexes(int32_t& aRowIdx, int32_t& aColIdx);
-
-  /**
-   * Return an array of row or column header cells.
-   */
-  nsresult GetHeaderCells(int32_t aRowOrColumnHeaderCell,
-                          nsIArray **aHeaderCells);
+  nsresult GetCellIndexes(int32_t& aRowIdx, int32_t& aColIdx) const;
 };
 
 
 /**
  * HTML table row/column header accessible (html:th or html:td@scope).
  */
 class HTMLTableHeaderCellAccessible : public HTMLTableCellAccessible
 {
@@ -125,16 +130,17 @@ public:
   virtual void SelectedCellIndices(nsTArray<uint32_t>* aCells);
   virtual void SelectedColIndices(nsTArray<uint32_t>* aCols);
   virtual void SelectedRowIndices(nsTArray<uint32_t>* aRows);
   virtual void SelectCol(uint32_t aColIdx);
   virtual void SelectRow(uint32_t aRowIdx);
   virtual void UnselectCol(uint32_t aColIdx);
   virtual void UnselectRow(uint32_t aRowIdx);
   virtual bool IsProbablyLayoutTable();
+  virtual Accessible* AsAccessible() { return this; }
 
   // nsAccessNode
   virtual void Shutdown();
 
   // Accessible
   virtual TableAccessible* AsTable() { return this; }
   virtual void Description(nsString& aDescription);
   virtual nsresult GetNameInternal(nsAString& aName);

--- a/accessible/src/msaa/TextLeafAccessibleWrap.cpp
+++ b/accessible/src/msaa/TextLeafAccessibleWrap.cpp
@@ -132,19 +132,19 @@ TextLeafAccessibleWrap::get_unclippedSub
     /* [out] */ int __RPC_FAR *aHeight)
 {
 __try {
   *aX = *aY = *aWidth = *aHeight = 0;
 
   if (IsDefunct())
     return E_FAIL;
 
-  if (NS_FAILED(GetCharacterExtents(aStartIndex, aEndIndex, 
-                                    aX, aY, aWidth, aHeight))) {
-    return NS_ERROR_FAILURE;
+  if (FAILED(GetCharacterExtents(aStartIndex, aEndIndex,
+                                 aX, aY, aWidth, aHeight))) {
+    return E_FAIL;
   }
 } __except(FilterA11yExceptions(::GetExceptionCode(), GetExceptionInformation())) { }
 
   return S_OK;
 }
 
 STDMETHODIMP
 TextLeafAccessibleWrap::scrollToSubstring(
@@ -186,33 +186,33 @@ TextLeafAccessibleWrap::GetPointFromOffs
 
   textFrame->GetPointFromOffset(aOffset, &aOutPoint);
   return textFrame;
 }
 
 /*
  * Given an offset, the x, y, width, and height values are filled appropriately.
  */
-nsresult
+HRESULT
 TextLeafAccessibleWrap::GetCharacterExtents(int32_t aStartOffset,
                                             int32_t aEndOffset,
                                             int32_t* aX,
                                             int32_t* aY,
                                             int32_t* aWidth,
                                             int32_t* aHeight)
 {
   *aX = *aY = *aWidth = *aHeight = 0;
 
   if (IsDefunct())
     return CO_E_OBJNOTCONNECTED;
 
   nsPresContext* presContext = mDoc->PresContext();
 
   nsIFrame *frame = GetFrame();
-  NS_ENSURE_TRUE(frame, NS_ERROR_FAILURE);
+  NS_ENSURE_TRUE(frame, E_FAIL);
 
   nsPoint startPoint, endPoint;
   nsIFrame *startFrame = GetPointFromOffset(frame, aStartOffset, true, startPoint);
   nsIFrame *endFrame = GetPointFromOffset(frame, aEndOffset, false, endPoint);
   if (!startFrame || !endFrame) {
     return E_FAIL;
   }
   
@@ -229,17 +229,17 @@ TextLeafAccessibleWrap::GetCharacterExte
     sum.UnionRect(sum, rect);
   }
 
   *aX      = sum.x;
   *aY      = sum.y;
   *aWidth  = sum.width;
   *aHeight = sum.height;
 
-  return NS_OK;
+  return S_OK;
 }
 
 STDMETHODIMP
 TextLeafAccessibleWrap::get_fontFamily(
     /* [retval][out] */ BSTR __RPC_FAR *aFontFamily)
 {
 __try {
   *aFontFamily = NULL;

--- a/accessible/src/msaa/TextLeafAccessibleWrap.h
+++ b/accessible/src/msaa/TextLeafAccessibleWrap.h
@@ -50,19 +50,19 @@ public:
     virtual HRESULT STDMETHODCALLTYPE scrollToSubstring( 
         /* [in] */ unsigned int startIndex,
         /* [in] */ unsigned int endIndex);
 
     virtual /* [propget] */ HRESULT STDMETHODCALLTYPE get_fontFamily( 
         /* [retval][out] */ BSTR __RPC_FAR *fontFamily);
     
   protected:
-    nsresult GetCharacterExtents(int32_t aStartOffset, int32_t aEndOffset,
-                                 int32_t* aX, int32_t* aY, 
-                                 int32_t* aWidth, int32_t* aHeight);
+    HRESULT GetCharacterExtents(int32_t aStartOffset, int32_t aEndOffset,
+                                int32_t* aX, int32_t* aY,
+                                int32_t* aWidth, int32_t* aHeight);
 
     // Return child frame containing offset on success
     nsIFrame* GetPointFromOffset(nsIFrame *aContainingFrame,
                                  int32_t aOffset, bool aPreferNext, nsPoint& aOutPoint);
 };
 
 } // namespace a11y
 } // namespace mozilla

--- a/accessible/src/msaa/nsAccessNodeWrap.cpp
+++ b/accessible/src/msaa/nsAccessNodeWrap.cpp
@@ -51,17 +51,18 @@ NS_IMPL_ISUPPORTS_INHERITED1(nsAccessNod
 
 //-----------------------------------------------------
 // nsIWinAccessNode methods
 //-----------------------------------------------------
 
 NS_IMETHODIMP
 nsAccessNodeWrap::QueryNativeInterface(REFIID aIID, void** aInstancePtr)
 {
-  return QueryInterface(aIID, aInstancePtr);
+  // XXX Wrong for E_NOINTERFACE
+  return static_cast<nsresult>(QueryInterface(aIID, aInstancePtr));
 }
 
 //-----------------------------------------------------
 // IUnknown interface methods - see iunknown.h for documentation
 //-----------------------------------------------------
 
 STDMETHODIMP nsAccessNodeWrap::QueryInterface(REFIID iid, void** ppv)
 {

--- a/accessible/src/xpcom/Makefile.in
+++ b/accessible/src/xpcom/Makefile.in
@@ -13,16 +13,17 @@ include $(DEPTH)/config/autoconf.mk
 MODULE = accessibility
 LIBRARY_NAME = accessibility_xpcom_s
 LIBXUL_LIBRARY = 1
 
 CPPSRCS = \
   nsAccEvent.cpp \
   nsAccessibleRelation.cpp \
   xpcAccessibleTable.cpp \
+  xpcAccessibleTableCell.cpp \
   $(NULL)
 
 # we don't want the shared lib, but we want to force the creation of a static lib.
 FORCE_STATIC_LIB = 1
 
 include $(topsrcdir)/config/rules.mk
 
 LOCAL_INCLUDES = \

new file mode 100644
--- /dev/null
+++ b/accessible/src/xpcom/xpcAccessibleTableCell.cpp
@@ -0,0 +1,158 @@
+/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this file,
+ * You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "xpcAccessibleTableCell.h"
+
+#include "Accessible.h"
+#include "TableAccessible.h"
+#include "TableCellAccessible.h"
+
+#include "nsIAccessibleTable.h"
+
+#include "nsComponentManagerUtils.h"
+#include "nsIMutableArray.h"
+
+using namespace mozilla;
+using namespace mozilla::a11y;
+
+nsresult
+xpcAccessibleTableCell::GetTable(nsIAccessibleTable** aTable)
+{
+  NS_ENSURE_ARG_POINTER(aTable);
+  *aTable = nullptr;
+
+  if (!mTableCell)
+    return NS_ERROR_FAILURE;
+
+  TableAccessible* table = mTableCell->Table();
+  if (!table)
+    return NS_ERROR_FAILURE;
+
+  nsCOMPtr<nsIAccessibleTable> xpcTable =
+    do_QueryInterface(static_cast<nsIAccessible*>(table->AsAccessible()));
+  xpcTable.forget(aTable);
+
+  return NS_OK;
+}
+
+nsresult
+xpcAccessibleTableCell::GetColumnIndex(int32_t* aColIdx)
+{
+  NS_ENSURE_ARG_POINTER(aColIdx);
+  *aColIdx = -1;
+
+  if (!mTableCell)
+    return NS_ERROR_FAILURE;
+
+  *aColIdx = mTableCell->ColIdx();
+  return NS_OK;
+}
+
+nsresult
+xpcAccessibleTableCell::GetRowIndex(int32_t* aRowIdx)
+{
+  NS_ENSURE_ARG_POINTER(aRowIdx);
+  *aRowIdx = -1;
+
+  if (!mTableCell)
+    return NS_ERROR_FAILURE;
+
+  *aRowIdx = mTableCell->RowIdx();
+
+  return NS_OK;
+}
+
+nsresult
+xpcAccessibleTableCell::GetColumnExtent(int32_t* aExtent)
+{
+  NS_ENSURE_ARG_POINTER(aExtent);
+  *aExtent = -1;
+
+  if (!mTableCell)
+    return NS_ERROR_FAILURE;
+
+  *aExtent = mTableCell->ColExtent();
+
+  return NS_OK;
+}
+
+nsresult
+xpcAccessibleTableCell::GetRowExtent(int32_t* aExtent)
+{
+  NS_ENSURE_ARG_POINTER(aExtent);
+  *aExtent = -1;
+
+  if (!mTableCell)
+    return NS_ERROR_FAILURE;
+
+  *aExtent = mTableCell->RowExtent();
+
+  return NS_OK;
+}
+
+nsresult
+xpcAccessibleTableCell::GetColumnHeaderCells(nsIArray** aHeaderCells)
+{
+  NS_ENSURE_ARG_POINTER(aHeaderCells);
+  *aHeaderCells = nullptr;
+
+  if (!mTableCell)
+    return NS_ERROR_FAILURE;
+
+  nsAutoTArray<Accessible*, 10> headerCells;
+  mTableCell->ColHeaderCells(&headerCells);
+
+  nsCOMPtr<nsIMutableArray> cells = do_CreateInstance(NS_ARRAY_CONTRACTID);
+  NS_ENSURE_TRUE(cells, NS_ERROR_FAILURE);
+
+  for (uint32_t idx = 0; idx < headerCells.Length(); idx++) {
+    cells->
+      AppendElement(static_cast<nsIAccessible*>(headerCells.ElementAt(idx)),
+                    false);
+  }
+
+  NS_ADDREF(*aHeaderCells = cells);
+  return NS_OK;
+}
+
+nsresult
+xpcAccessibleTableCell::GetRowHeaderCells(nsIArray** aHeaderCells)
+{
+  NS_ENSURE_ARG_POINTER(aHeaderCells);
+  *aHeaderCells = nullptr;
+
+  if (!mTableCell)
+    return NS_ERROR_FAILURE;
+
+  nsAutoTArray<Accessible*, 10> headerCells;
+  mTableCell->RowHeaderCells(&headerCells);
+
+  nsCOMPtr<nsIMutableArray> cells = do_CreateInstance(NS_ARRAY_CONTRACTID);
+  NS_ENSURE_TRUE(cells, NS_ERROR_FAILURE);
+
+  for (uint32_t idx = 0; idx < headerCells.Length(); idx++) {
+    cells->
+      AppendElement(static_cast<nsIAccessible*>(headerCells.ElementAt(idx)),
+                    false);
+  }
+
+  NS_ADDREF(*aHeaderCells = cells);
+  return NS_OK;
+}
+
+nsresult
+xpcAccessibleTableCell::IsSelected(bool* aSelected)
+{
+  NS_ENSURE_ARG_POINTER(aSelected);
+  *aSelected = false;
+
+  if (!mTableCell)
+    return NS_ERROR_FAILURE;
+
+  *aSelected = mTableCell->Selected();
+
+  return NS_OK;
+}

--- a/accessible/src/xpcom/xpcAccessibleTableCell.h
+++ b/accessible/src/xpcom/xpcAccessibleTableCell.h
@@ -1,37 +1,46 @@
 /* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
 /* vim: set ts=2 et sw=2 tw=80: */
 /* This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this file,
  * You can obtain one at http://mozilla.org/MPL/2.0/. */
 
-#ifndef MOZILLA_A11Y_XPCOM_XPACESSIBLETABLECELL_H_
-#define MOZILLA_A11Y_XPCOM_XPACESSIBLETABLECELL_H_
+#ifndef mozilla_a11y_xpcom_xpcAccessibletableCell_h_
+#define mozilla_a11y_xpcom_xpcAccessibletableCell_h_
+
+#include "nscore.h"
+
+class nsIAccessibleTable;
+class nsIArray;
 
 namespace mozilla {
 namespace a11y {
+
 class TableAccessible;
 class TableCellAccessible;
-}
-}
 
+/**
+ * This class provides an implementation of the nsIAccessibleTableCell
+ * interface's methods.
+ */
 class xpcAccessibleTableCell
 {
 public:
   xpcAccessibleTableCell(mozilla::a11y::TableCellAccessible* aTableCell) :
     mTableCell(aTableCell) { }
 
+  nsresult GetTable(nsIAccessibleTable** aTable);
+  nsresult GetColumnIndex(int32_t* aColIdx);
+  nsresult GetRowIndex(int32_t* aRowIdx);
+  nsresult GetColumnExtent(int32_t* aExtent);
+  nsresult GetRowExtent(int32_t* aExtent);
+  nsresult GetColumnHeaderCells(nsIArray** aHeaderCells);
+  nsresult GetRowHeaderCells(nsIArray** aHeaderCells);
+  nsresult IsSelected(bool* aSelected);
+
 protected:
   mozilla::a11y::TableCellAccessible* mTableCell;
 };
+} // namespace a11y
+} // namespace mozilla
 
-#define NS_DECL_OR_FORWARD_NSIACCESSIBLETABLECELL_WITH_XPCACCESSIBLETABLECELL \
-  NS_IMETHOD GetTable(nsIAccessibleTable * *aTable); \
-  NS_IMETHOD GetColumnIndex(int32_t *aColumnIndex); \
-  NS_IMETHOD GetRowIndex(int32_t *aRowIndex); \
-  NS_IMETHOD GetColumnExtent(int32_t *aColumnExtent); \
-  NS_IMETHOD GetRowExtent(int32_t *aRowExtent); \
-  NS_IMETHOD GetColumnHeaderCells(nsIArray * *aColumnHeaderCells); \
-  NS_IMETHOD GetRowHeaderCells(nsIArray * *aRowHeaderCells); \
-  NS_IMETHOD IsSelected(bool *_retval ); 
-
-#endif // MOZILLA_A11Y_XPCOM_XPACESSIBLETABLECELL_H_
+#endif // mozilla_a11y_xpcom_xpcAccessibletableCell_h_

--- a/accessible/src/xul/XULListboxAccessible.cpp
+++ b/accessible/src/xul/XULListboxAccessible.cpp
@@ -737,204 +737,112 @@ XULListCellAccessible::
 
 NS_IMPL_ISUPPORTS_INHERITED1(XULListCellAccessible,
                              HyperTextAccessible,
                              nsIAccessibleTableCell)
 
 ////////////////////////////////////////////////////////////////////////////////
 // XULListCellAccessible: nsIAccessibleTableCell implementation
 
-NS_IMETHODIMP
-XULListCellAccessible::GetTable(nsIAccessibleTable** aTable)
+TableAccessible*
+XULListCellAccessible::Table() const
 {
-  NS_ENSURE_ARG_POINTER(aTable);
-  *aTable = nullptr;
-
-  if (IsDefunct())
-    return NS_ERROR_FAILURE;
-
   Accessible* thisRow = Parent();
   if (!thisRow || thisRow->Role() != roles::ROW)
-    return NS_OK;
+    return nullptr;
 
   Accessible* table = thisRow->Parent();
   if (!table || table->Role() != roles::TABLE)
-    return NS_OK;
+    return nullptr;
 
-  CallQueryInterface(table, aTable);
-  return NS_OK;
+  return table->AsTable();
 }
 
-NS_IMETHODIMP
-XULListCellAccessible::GetColumnIndex(int32_t* aColumnIndex)
+uint32_t
+XULListCellAccessible::ColIdx() const
 {
-  NS_ENSURE_ARG_POINTER(aColumnIndex);
-  *aColumnIndex = -1;
-
-  if (IsDefunct())
-    return NS_ERROR_FAILURE;
-
   Accessible* row = Parent();
   if (!row)
-    return NS_OK;
-
-  *aColumnIndex = 0;
+    return 0;
 
   int32_t indexInRow = IndexInParent();
+  uint32_t colIdx = 0;
   for (int32_t idx = 0; idx < indexInRow; idx++) {
     Accessible* cell = row->GetChildAt(idx);
     roles::Role role = cell->Role();
     if (role == roles::CELL || role == roles::GRID_CELL ||
         role == roles::ROWHEADER || role == roles::COLUMNHEADER)
-      (*aColumnIndex)++;
+      colIdx++;
   }
 
-  return NS_OK;
+  return colIdx;
 }
 
-NS_IMETHODIMP
-XULListCellAccessible::GetRowIndex(int32_t* aRowIndex)
+uint32_t
+XULListCellAccessible::RowIdx() const
 {
-  NS_ENSURE_ARG_POINTER(aRowIndex);
-  *aRowIndex = -1;
-
-  if (IsDefunct())
-    return NS_ERROR_FAILURE;
-
   Accessible* row = Parent();
   if (!row)
-    return NS_OK;
+    return 0;
 
   Accessible* table = row->Parent();
   if (!table)
-    return NS_OK;
-
-  *aRowIndex = 0;
+    return 0;
 
   int32_t indexInTable = row->IndexInParent();
+  uint32_t rowIdx = 0;
   for (int32_t idx = 0; idx < indexInTable; idx++) {
     row = table->GetChildAt(idx);
     if (row->Role() == roles::ROW)
-      (*aRowIndex)++;
+      rowIdx++;
   }
 
-  return NS_OK;
-}
-
-NS_IMETHODIMP
-XULListCellAccessible::GetColumnExtent(int32_t* aExtentCount)
-{
-  NS_ENSURE_ARG_POINTER(aExtentCount);
-  *aExtentCount = 0;
-
-  if (IsDefunct())
-    return NS_ERROR_FAILURE;
-
-  *aExtentCount = 1;
-  return NS_OK;
+  return rowIdx;
 }
 
-NS_IMETHODIMP
-XULListCellAccessible::GetRowExtent(int32_t* aExtentCount)
+void
+XULListCellAccessible::ColHeaderCells(nsTArray<Accessible*>* aCells)
 {
-  NS_ENSURE_ARG_POINTER(aExtentCount);
-  *aExtentCount = 0;
-
-  if (IsDefunct())
-    return NS_ERROR_FAILURE;
-
-  *aExtentCount = 1;
-  return NS_OK;
-}
-
-NS_IMETHODIMP
-XULListCellAccessible::GetColumnHeaderCells(nsIArray** aHeaderCells)
-{
-  NS_ENSURE_ARG_POINTER(aHeaderCells);
-  *aHeaderCells = nullptr;
-
-  if (IsDefunct())
-    return NS_ERROR_FAILURE;
-
-  nsCOMPtr<nsIAccessibleTable> table;
-  GetTable(getter_AddRefs(table));
-  NS_ENSURE_STATE(table); // we expect to be in a listbox (table)
+  TableAccessible* table = Table();
+  NS_ASSERTION(table, "cell not in a table!");
+  if (!table)
+    return;
 
   // Get column header cell from XUL listhead.
   Accessible* list = nullptr;
 
-  nsRefPtr<Accessible> tableAcc(do_QueryObject(table));
+  Accessible* tableAcc = table->AsAccessible();
   uint32_t tableChildCount = tableAcc->ChildCount();
   for (uint32_t childIdx = 0; childIdx < tableChildCount; childIdx++) {
     Accessible* child = tableAcc->GetChildAt(childIdx);
     if (child->Role() == roles::LIST) {
       list = child;
       break;
     }
   }
 
   if (list) {
-    int32_t colIdx = -1;
-    GetColumnIndex(&colIdx);
-
-    nsIAccessible *headerCell = list->GetChildAt(colIdx);
+    Accessible* headerCell = list->GetChildAt(ColIdx());
     if (headerCell) {
-      nsresult rv = NS_OK;
-      nsCOMPtr<nsIMutableArray> headerCells =
-        do_CreateInstance(NS_ARRAY_CONTRACTID, &rv);
-      NS_ENSURE_SUCCESS(rv, rv);
-
-      headerCells->AppendElement(headerCell, false);
-      NS_ADDREF(*aHeaderCells = headerCells);
-      return NS_OK;
+      aCells->AppendElement(headerCell);
+      return;
     }
   }
 
   // No column header cell from XUL markup, try to get it from ARIA markup.
-  return nsAccUtils::GetHeaderCellsFor(table, this,
-                                       nsAccUtils::eColumnHeaderCells,
-                                       aHeaderCells);
+  TableCellAccessible::ColHeaderCells(aCells);
 }
 
-NS_IMETHODIMP
-XULListCellAccessible::GetRowHeaderCells(nsIArray** aHeaderCells)
+bool
+XULListCellAccessible::Selected()
 {
-  NS_ENSURE_ARG_POINTER(aHeaderCells);
-  *aHeaderCells = nullptr;
-
-  if (IsDefunct())
-    return NS_ERROR_FAILURE;
-
-  nsCOMPtr<nsIAccessibleTable> table;
-  GetTable(getter_AddRefs(table));
-  NS_ENSURE_STATE(table); // we expect to be in a listbox (table)
+  TableAccessible* table = Table();
+  NS_ENSURE_TRUE(table, false); // we expect to be in a listbox (table)
 
-  // Calculate row header cells from ARIA markup.
-  return nsAccUtils::GetHeaderCellsFor(table, this,
-                                       nsAccUtils::eRowHeaderCells,
-                                       aHeaderCells);
-}
-
-NS_IMETHODIMP
-XULListCellAccessible::IsSelected(bool* aIsSelected)
-{
-  NS_ENSURE_ARG_POINTER(aIsSelected);
-  *aIsSelected = false;
-
-  if (IsDefunct())
-    return NS_ERROR_FAILURE;
-
-  nsCOMPtr<nsIAccessibleTable> table;
-  GetTable(getter_AddRefs(table));
-  NS_ENSURE_STATE(table); // we expect to be in a listbox (table)
-
-  int32_t rowIdx = -1;
-  GetRowIndex(&rowIdx);
-
-  return table->IsRowSelected(rowIdx, aIsSelected);
+  return table->IsRowSelected(RowIdx());
 }
 
 ////////////////////////////////////////////////////////////////////////////////
 // XULListCellAccessible. Accessible implementation
 
 void
 XULListCellAccessible::Shutdown()
 {
@@ -952,27 +860,18 @@ nsresult
 XULListCellAccessible::GetAttributesInternal(nsIPersistentProperties* aAttributes)
 {
   NS_ENSURE_ARG_POINTER(aAttributes);
 
   if (IsDefunct())
     return NS_ERROR_FAILURE;
 
   // "table-cell-index" attribute
-  nsCOMPtr<nsIAccessibleTable> table;
-  GetTable(getter_AddRefs(table));
+  TableAccessible* table = Table();
   NS_ENSURE_STATE(table); // we expect to be in a listbox (table)
 
-  int32_t rowIdx = -1;
-  GetRowIndex(&rowIdx);
-  int32_t colIdx = -1;
-  GetColumnIndex(&colIdx);
-
-  int32_t cellIdx = -1;
-  table->GetCellIndexAt(rowIdx, colIdx, &cellIdx);
-
   nsAutoString stringIdx;
-  stringIdx.AppendInt(cellIdx);
+  stringIdx.AppendInt(table->CellIndexAt(RowIdx(), ColIdx()));
   nsAccUtils::SetAccAttr(aAttributes, nsGkAtoms::tableCellIndex,
                          stringIdx);
 
   return NS_OK;
 }

--- a/accessible/src/xul/XULListboxAccessible.h
+++ b/accessible/src/xul/XULListboxAccessible.h
@@ -85,16 +85,17 @@ public:
   virtual uint32_t SelectedColCount();
   virtual uint32_t SelectedRowCount();
   virtual void SelectedCells(nsTArray<Accessible*>* aCells);
   virtual void SelectedCellIndices(nsTArray<uint32_t>* aCells);
   virtual void SelectedColIndices(nsTArray<uint32_t>* aCols);
   virtual void SelectedRowIndices(nsTArray<uint32_t>* aRows);
   virtual void SelectRow(uint32_t aRowIdx);
   virtual void UnselectRow(uint32_t aRowIdx);
+  virtual Accessible* AsAccessible() { return this; }
 
   // nsAccessNode
   virtual void Shutdown();
 
   // Accessible
   virtual void Value(nsString& aValue);
   virtual TableAccessible* AsTable() { return this; }
   virtual a11y::role NativeRole();
@@ -159,20 +160,28 @@ class XULListCellAccessible : public Hyp
 {
 public:
   XULListCellAccessible(nsIContent* aContent, DocAccessible* aDoc);
 
   // nsISupports
   NS_DECL_ISUPPORTS_INHERITED
 
   // nsIAccessibleTableCell
-  NS_DECL_OR_FORWARD_NSIACCESSIBLETABLECELL_WITH_XPCACCESSIBLETABLECELL
+  NS_FORWARD_NSIACCESSIBLETABLECELL(xpcAccessibleTableCell::)
 
   // Accessible
+  virtual TableCellAccessible* AsTableCell() { return this; }
   virtual void Shutdown();
   virtual nsresult GetAttributesInternal(nsIPersistentProperties *aAttributes);
   virtual a11y::role NativeRole();
+
+  // TableCellAccessible
+  virtual TableAccessible* Table() const MOZ_OVERRIDE;
+  virtual uint32_t ColIdx() const MOZ_OVERRIDE;
+  virtual uint32_t RowIdx() const MOZ_OVERRIDE;
+  virtual void ColHeaderCells(nsTArray<Accessible*>* aHeaderCells) MOZ_OVERRIDE;
+  virtual bool Selected() MOZ_OVERRIDE;
 };
 
 } // namespace a11y
 } // namespace mozilla
 
 #endif

--- a/accessible/src/xul/XULTreeGridAccessible.cpp
+++ b/accessible/src/xul/XULTreeGridAccessible.cpp
@@ -495,18 +495,18 @@ NS_INTERFACE_TABLE_HEAD_CYCLE_COLLECTION
                                 XULTreeGridCellAccessible)
 NS_INTERFACE_TABLE_TAIL_INHERITING(LeafAccessible)
 NS_IMPL_ADDREF_INHERITED(XULTreeGridCellAccessible, LeafAccessible)
 NS_IMPL_RELEASE_INHERITED(XULTreeGridCellAccessible, LeafAccessible)
 
 ////////////////////////////////////////////////////////////////////////////////
 // XULTreeGridCellAccessible: nsIAccessible implementation
 
-  void
-  XULTreeGridCellAccessible::Shutdown()
+void
+XULTreeGridCellAccessible::Shutdown()
 {
   mTableCell = nullptr;
   LeafAccessible::Shutdown();
 }
 
 Accessible*
 XULTreeGridCellAccessible::FocusedChild()
 {
@@ -650,136 +650,65 @@ XULTreeGridCellAccessible::DoAction(uint
   }
 
   return NS_ERROR_INVALID_ARG;
 }
 
 ////////////////////////////////////////////////////////////////////////////////
 // XULTreeGridCellAccessible: nsIAccessibleTableCell implementation
 
-NS_IMETHODIMP
-XULTreeGridCellAccessible::GetTable(nsIAccessibleTable** aTable)
+TableAccessible*
+XULTreeGridCellAccessible::Table() const
 {
-  NS_ENSURE_ARG_POINTER(aTable);
-  *aTable = nullptr;
-
-  if (IsDefunct())
-    return NS_OK;
-
   Accessible* grandParent = mParent->Parent();
   if (grandParent)
-    CallQueryInterface(grandParent, aTable);
-
-  return NS_OK;
-}
+    return grandParent->AsTable();
 
-NS_IMETHODIMP
-XULTreeGridCellAccessible::GetColumnIndex(int32_t* aColumnIndex)
-{
-  NS_ENSURE_ARG_POINTER(aColumnIndex);
-  *aColumnIndex = -1;
-
-  if (IsDefunct())
-    return NS_ERROR_FAILURE;
-
-  *aColumnIndex = GetColumnIndex();
-  return NS_OK;
+  return nullptr;
 }
 
-NS_IMETHODIMP
-XULTreeGridCellAccessible::GetRowIndex(int32_t* aRowIndex)
+uint32_t
+XULTreeGridCellAccessible::ColIdx() const
 {
-  NS_ENSURE_ARG_POINTER(aRowIndex);
-  *aRowIndex = -1;
-
-  if (IsDefunct())
-    return NS_ERROR_FAILURE;
+  uint32_t colIdx = 0;
+  nsCOMPtr<nsITreeColumn> column = mColumn;
+  while ((column = nsCoreUtils::GetPreviousSensibleColumn(column)))
+    colIdx++;
 
-  *aRowIndex = mRow;
-  return NS_OK;
-}
-
-NS_IMETHODIMP
-XULTreeGridCellAccessible::GetColumnExtent(int32_t* aExtentCount)
-{
-  NS_ENSURE_ARG_POINTER(aExtentCount);
-  *aExtentCount = 1;
-
-  return NS_OK;
+  return colIdx;
 }
 
-NS_IMETHODIMP
-XULTreeGridCellAccessible::GetRowExtent(int32_t* aExtentCount)
+uint32_t
+XULTreeGridCellAccessible::RowIdx() const
 {
-  NS_ENSURE_ARG_POINTER(aExtentCount);
-  *aExtentCount = 1;
-
-  return NS_OK;
+  return mRow;
 }
 
-NS_IMETHODIMP
-XULTreeGridCellAccessible::GetColumnHeaderCells(nsIArray** aHeaderCells)
+void
+XULTreeGridCellAccessible::ColHeaderCells(nsTArray<Accessible*>* aHeaderCells)
 {
-  NS_ENSURE_ARG_POINTER(aHeaderCells);
-  *aHeaderCells = nullptr;
-
-  if (IsDefunct() || !mDoc)
-    return NS_ERROR_FAILURE;
-
-  nsresult rv = NS_OK;
-  nsCOMPtr<nsIMutableArray> headerCells =
-    do_CreateInstance(NS_ARRAY_CONTRACTID, &rv);
-  NS_ENSURE_SUCCESS(rv, rv);
-
   nsCOMPtr<nsIDOMElement> columnElm;
   mColumn->GetElement(getter_AddRefs(columnElm));
 
   nsCOMPtr<nsIContent> columnContent(do_QueryInterface(columnElm));
   Accessible* headerCell = mDoc->GetAccessible(columnContent);
-
   if (headerCell)
-    headerCells->AppendElement(static_cast<nsIAccessible*>(headerCell),
-                               false);
-
-  NS_ADDREF(*aHeaderCells = headerCells);
-  return NS_OK;
+    aHeaderCells->AppendElement(headerCell);
 }
 
-NS_IMETHODIMP
-XULTreeGridCellAccessible::GetRowHeaderCells(nsIArray** aHeaderCells)
+bool
+XULTreeGridCellAccessible::Selected()
 {
-  NS_ENSURE_ARG_POINTER(aHeaderCells);
-  *aHeaderCells = nullptr;
-
-  if (IsDefunct())
-    return NS_ERROR_FAILURE;
-
-  nsresult rv = NS_OK;
-  nsCOMPtr<nsIMutableArray> headerCells =
-    do_CreateInstance(NS_ARRAY_CONTRACTID, &rv);
-  NS_ENSURE_SUCCESS(rv, rv);
-
-  NS_ADDREF(*aHeaderCells = headerCells);
-  return NS_OK;
-}
-
-NS_IMETHODIMP
-XULTreeGridCellAccessible::IsSelected(bool* aIsSelected)
-{
-  NS_ENSURE_ARG_POINTER(aIsSelected);
-  *aIsSelected = false;
-
-  if (IsDefunct() || !mTreeView)
-    return NS_ERROR_FAILURE;
-
   nsCOMPtr<nsITreeSelection> selection;
   nsresult rv = mTreeView->GetSelection(getter_AddRefs(selection));
-  NS_ENSURE_SUCCESS(rv, rv);
+  NS_ENSURE_SUCCESS(rv, false);
 
-  return selection->IsSelected(mRow, aIsSelected);
+  bool selected = false;
+  selection->IsSelected(mRow, &selected);
+  return selected;
 }
 
 ////////////////////////////////////////////////////////////////////////////////
 // XULTreeGridCellAccessible: nsAccessNode implementation
 
 void
 XULTreeGridCellAccessible::Init()
 {
@@ -802,35 +731,23 @@ nsresult
 XULTreeGridCellAccessible::GetAttributesInternal(nsIPersistentProperties* aAttributes)
 {
   NS_ENSURE_ARG_POINTER(aAttributes);
 
   if (IsDefunct())
     return NS_ERROR_FAILURE;
 
   // "table-cell-index" attribute
-  Accessible* grandParent = mParent->Parent();
-  if (!grandParent)
-    return NS_OK;
-
-  nsCOMPtr<nsIAccessibleTable> tableAccessible = do_QueryObject(grandParent);
-
-  // XXX - temp fix for crash bug 516047
-  if (!tableAccessible)
+  TableAccessible* table = Table();
+  if (!table)
     return NS_ERROR_FAILURE;
 
-  int32_t colIdx = GetColumnIndex();
-
-  int32_t cellIdx = -1;
-  tableAccessible->GetCellIndexAt(mRow, colIdx, &cellIdx);
-
   nsAutoString stringIdx;
-  stringIdx.AppendInt(cellIdx);
-  nsAccUtils::SetAccAttr(aAttributes, nsGkAtoms::tableCellIndex,
-                         stringIdx);
+  stringIdx.AppendInt(table->CellIndexAt(mRow, ColIdx()));
+  nsAccUtils::SetAccAttr(aAttributes, nsGkAtoms::tableCellIndex, stringIdx);
 
   // "cycles" attribute
   bool isCycler = false;
   nsresult rv = mColumn->GetCycler(&isCycler);
   if (NS_SUCCEEDED(rv) && isCycler)
     nsAccUtils::SetAccAttr(aAttributes, nsGkAtoms::cycles,
                            NS_LITERAL_STRING("true"));
 
@@ -879,43 +796,28 @@ uint64_t
 XULTreeGridCellAccessible::NativeInteractiveState() const
 {
   return states::SELECTABLE;
 }
 
 int32_t
 XULTreeGridCellAccessible::IndexInParent() const
 {
-  return GetColumnIndex();
+  return ColIdx();
 }
 
 Relation
 XULTreeGridCellAccessible::RelationByType(uint32_t aType)
 {
   return Relation();
 }
 
 ////////////////////////////////////////////////////////////////////////////////
 // XULTreeGridCellAccessible: public implementation
 
-int32_t
-XULTreeGridCellAccessible::GetColumnIndex() const
-{
-  int32_t index = 0;
-  nsCOMPtr<nsITreeColumn> column = mColumn;
-  while (true) {
-    column = nsCoreUtils::GetPreviousSensibleColumn(column);
-    if (!column)
-      break;
-    index++;
-  }
-
-  return index;
-}
-
 void
 XULTreeGridCellAccessible::CellInvalidated()
 {
   if (!mTreeView)
     return;
 
   nsAutoString textEquiv;
 

--- a/accessible/src/xul/XULTreeGridAccessible.h
+++ b/accessible/src/xul/XULTreeGridAccessible.h
@@ -44,16 +44,17 @@ public:
   virtual uint32_t SelectedColCount();
   virtual uint32_t SelectedRowCount();
   virtual void SelectedCells(nsTArray<Accessible*>* aCells);
   virtual void SelectedCellIndices(nsTArray<uint32_t>* aCells);
   virtual void SelectedColIndices(nsTArray<uint32_t>* aCols);
   virtual void SelectedRowIndices(nsTArray<uint32_t>* aRows);
   virtual void SelectRow(uint32_t aRowIdx);
   virtual void UnselectRow(uint32_t aRowIdx);
+  virtual Accessible* AsAccessible() { return this; }
 
   // nsAccessNode
   virtual void Shutdown();
 
   // Accessible
   virtual TableAccessible* AsTable() { return this; }
   virtual a11y::role NativeRole();
 
@@ -142,44 +143,48 @@ public:
 
   NS_IMETHOD GetBounds(int32_t* aX, int32_t* aY,
                        int32_t* aWidth, int32_t* aHeight);
 
   NS_IMETHOD GetActionName(uint8_t aIndex, nsAString& aName);
   NS_IMETHOD DoAction(uint8_t aIndex);
 
   // nsIAccessibleTableCell
-  NS_DECL_OR_FORWARD_NSIACCESSIBLETABLECELL_WITH_XPCACCESSIBLETABLECELL
+  NS_FORWARD_NSIACCESSIBLETABLECELL(xpcAccessibleTableCell::)
 
   // nsAccessNode
   virtual void Init();
 
   // Accessible
+  virtual TableCellAccessible* AsTableCell() { return this; }
   virtual void Shutdown();
   virtual ENameValueFlag Name(nsString& aName);
   virtual Accessible* FocusedChild();
   virtual nsresult GetAttributesInternal(nsIPersistentProperties* aAttributes);
   virtual int32_t IndexInParent() const;
   virtual Relation RelationByType(uint32_t aType);
   virtual a11y::role NativeRole();
   virtual uint64_t NativeState();
   virtual uint64_t NativeInteractiveState() const;
 
   // ActionAccessible
   virtual uint8_t ActionCount();
 
+  // TableCellAccessible
+  virtual TableAccessible* Table() const MOZ_OVERRIDE;
+  virtual uint32_t ColIdx() const MOZ_OVERRIDE;
+  virtual uint32_t RowIdx() const MOZ_OVERRIDE;
+  virtual void ColHeaderCells(nsTArray<Accessible*>* aHeaderCells) MOZ_OVERRIDE;
+  virtual void RowHeaderCells(nsTArray<Accessible*>* aCells) MOZ_OVERRIDE { }
+  virtual bool Selected() MOZ_OVERRIDE;
+
   // XULTreeGridCellAccessible
   NS_DECLARE_STATIC_IID_ACCESSOR(XULTREEGRIDCELLACCESSIBLE_IMPL_CID)
 
   /**
-   * Return index of the column.
-   */
-  int32_t GetColumnIndex() const;
-
-  /**
    * Fire name or state change event if the accessible text or value has been
    * changed.
    */
   void CellInvalidated();
 
 protected:
   // Accessible
   virtual Accessible* GetSiblingAtOffset(int32_t aOffset,

--- a/accessible/tests/mochitest/events/test_focus_aria_activedescendant.html
+++ b/accessible/tests/mochitest/events/test_focus_aria_activedescendant.html
@@ -65,16 +65,20 @@ https://bugzilla.mozilla.org/show_bug.cg
 
     var gQueue = null;
     function doTest()
     {
       gQueue = new eventQueue();
 
       gQueue.push(new synthFocus("container", new focusChecker("item1")));
       gQueue.push(new changeARIAActiveDescendant("container", "item2"));
+
+      gQueue.push(new synthFocus("combobox_entry", new focusChecker("combobox_entry")));
+      gQueue.push(new changeARIAActiveDescendant("combobox", "combobox_option2"));
+
       todo(false, "No focus for inserted element, bug 687011");
       //gQueue.push(new insertItemNFocus("container", "item3"));
 
       gQueue.invoke(); // Will call SimpleTest.finish();
     }
 
     SimpleTest.waitForExplicitFinish();
     addA11yLoadEvent(doTest);
@@ -82,19 +86,32 @@ https://bugzilla.mozilla.org/show_bug.cg
 </head>
 <body>
 
   <a target="_blank"
      href="https://bugzilla.mozilla.org/show_bug.cgi?id=429547"
      title="Support aria-activedescendant usage in nsIAccesible::TakeFocus()">
     Mozilla Bug 429547
   </a>
+  <a target="_blank"
+     href="https://bugzilla.mozilla.org/show_bug.cgi?id=761102"
+     title="Focus may be missed when ARIA active-descendant is changed on active composite widget">
+    Mozilla Bug 761102
+  </a>
   <p id="display"></p>
   <div id="content" style="display: none"></div>
   <pre id="test">
   </pre>
 
   <div role="listbox" aria-activedescendant="item1" id="container" tabindex="1">
     <div role="listitem" id="item1">item1</div>
     <div role="listitem" id="item2">item2</div>
   </div>
+
+  <div role="combobox" id="combobox">
+    <input id="combobox_entry">
+    <ul>
+      <li role="option" id="combobox_option1">option1</li>
+      <li role="option" id="combobox_option2">option2</li>
+    </ul>
+  </div>
 </body>
 </html>

--- a/accessible/tests/mochitest/tree/test_list.html
+++ b/accessible/tests/mochitest/tree/test_list.html
@@ -118,31 +118,63 @@
                 { TEXT_LEAF: [] }
               ] }
             ] }
           ] }
         ] };
 
       testAccessibleTree("list6", tree);
 
+      // li having no display:list-item style
+      var tree =
+        { LIST: [ // ul
+          { LISTITEM: [ // li
+            { TEXT_LEAF: [] },
+          ] },
+          { TEXT_LEAF: [] },
+          { LISTITEM: [ // li
+            { TEXT_LEAF: [] }
+          ] }
+        ] };
+      testAccessibleTree("list7", tree);
+
+      var tree =
+        { LIST: [ // ul
+          { LISTITEM: [ // li
+            { TEXT_LEAF: [] },
+          ] },
+          { LISTITEM: [ // li
+            { TEXT_LEAF: [] }
+          ] }
+        ] };
+      testAccessibleTree("list8", tree);
+
+      // span having display:list-item style
+      testAccessibleTree("list9", discAccTree);
+
       SimpleTest.finish();
     }
 
     SimpleTest.waitForExplicitFinish();
     addA11yLoadEvent(doTest);
   </script>
 </head>
 <body>
 
   <a target="_blank"
      title="Fix O(n^2) access to all the children of a container"
      href="https://bugzilla.mozilla.org/show_bug.cgi?id=342045">
     Mozilla Bug 342045
   </a>
   <a target="_blank"
+     title="Wrong accessible is created for HTML:li having block display style"
+     href="https://bugzilla.mozilla.org/show_bug.cgi?id=507555">
+    Mozilla Bug 507555
+  </a>
+  <a target="_blank"
      title="Bullets of nested not ordered lists have one and the same character."
      href="https://bugzilla.mozilla.org/show_bug.cgi?id=604587">
     Mozilla Bug 604587
   </a>
   <a target="_blank"
      title="Fix list bullets for DL list (crash [@ nsBulletFrame::GetListItemText])"
      href="https://bugzilla.mozilla.org/show_bug.cgi?id=629114">
     Mozilla Bug 629114
@@ -188,10 +220,28 @@
 
   <ol id="list6">
     <li>
       <dl id="dl">
         <dt>item1</dt><dd>description</dd>
       </dl>
     </li>
   </ol>
+
+  <!-- display style different than list-item -->
+  <ul id="list7">
+    <li id="l7_li1" style="display:inline-block;">Oranges</li>
+    <li id="l7_li2" style="display:inline-block;">Apples</li>
+  </ul>
+
+  <ul id="list8">
+    <li id="l8_li1" style="display:inline; float:right;">Oranges</li>
+    <li id="l8_li2" style="display:inline; float:right;">Apples</li>
+  </ul>
+
+  <!-- list-item display style -->
+  <ul id="list9">
+    <span id="l9_li1" style="display:list-item">Oranges</span>
+    <span id="l9_li2" style="display:list-item">Apples</span>
+    <span id="l9_li3" style="display:list-item">Bananas</span>
+  </ul>
 </body>
 </html>