--- a/layout/generic/nsBlockFrame.h
+++ b/layout/generic/nsBlockFrame.h
@@ -110,25 +110,25 @@ class nsIntervalSet;
 
 // see nsHTMLParts.h for the public block state bits
 
 /**
  * Something in the block has changed that requires Bidi resolution to be
  * performed on the block. This flag must be either set on all blocks in a 
  * continuation chain or none of them.
  */
-#define NS_BLOCK_NEEDS_BIDI_RESOLUTION      0x00100000 
-#define NS_BLOCK_HAS_LINE_CURSOR            0x01000000
-#define NS_BLOCK_HAS_OVERFLOW_LINES         0x02000000
-#define NS_BLOCK_HAS_OVERFLOW_OUT_OF_FLOWS  0x04000000
+#define NS_BLOCK_NEEDS_BIDI_RESOLUTION      NS_FRAME_STATE_BIT(20)
+#define NS_BLOCK_HAS_LINE_CURSOR            NS_FRAME_STATE_BIT(24)
+#define NS_BLOCK_HAS_OVERFLOW_LINES         NS_FRAME_STATE_BIT(25)
+#define NS_BLOCK_HAS_OVERFLOW_OUT_OF_FLOWS  NS_FRAME_STATE_BIT(26)
 
 // Set on any block that has descendant frames in the normal
 // flow with 'clear' set to something other than 'none'
 // (including <BR CLEAR="..."> frames)
-#define NS_BLOCK_HAS_CLEAR_CHILDREN         0x08000000
+#define NS_BLOCK_HAS_CLEAR_CHILDREN         NS_FRAME_STATE_BIT(27)
 
 #define nsBlockFrameSuper nsHTMLContainerFrame
 
 /*
  * Base class for block and inline frames.
  * The block frame has an additional named child list:
  * - "Absolute-list" which contains the absolutely positioned frames
  *

--- a/layout/generic/nsFrame.cpp
+++ b/layout/generic/nsFrame.cpp
@@ -6414,17 +6414,17 @@ nsFrame::BoxReflow(nsBoxLayoutState&    
     if (parentSize.width != NS_INTRINSICSIZE)
       parentSize.width += margin.LeftRight();
 
     nsIFrame *parentFrame = GetParent();
     nsFrameState savedState = parentFrame->GetStateBits();
     nsHTMLReflowState parentReflowState(aPresContext, parentFrame,
                                         aRenderingContext,
                                         parentSize);
-    parentFrame->RemoveStateBits(0xffffffff);
+    parentFrame->RemoveStateBits(~nsFrameState(0));
     parentFrame->AddStateBits(savedState);
 
     // This may not do very much useful, but it's probably worth trying.
     if (parentSize.width != NS_INTRINSICSIZE)
       parentReflowState.SetComputedWidth(NS_MAX(parentSize.width, 0));
     if (parentSize.height != NS_INTRINSICSIZE)
       parentReflowState.SetComputedHeight(NS_MAX(parentSize.height, 0));
     parentReflowState.mComputedMargin.SizeTo(0, 0, 0, 0);

--- a/layout/generic/nsHTMLParts.h
+++ b/layout/generic/nsHTMLParts.h
@@ -37,16 +37,17 @@
 
 /* factory functions for rendering object classes */
 
 #ifndef nsHTMLParts_h___
 #define nsHTMLParts_h___
 
 #include "nscore.h"
 #include "nsISupports.h"
+#include "nsIFrame.h"
 class nsIAtom;
 class nsNodeInfoManager;
 class nsIContent;
 class nsIContentIterator;
 class nsIDocument;
 class nsIFrame;
 class nsIHTMLContentSink;
 class nsIFragmentContentSink;
@@ -64,25 +65,30 @@ class nsTableColFrame;
  * NS_BLOCK_HAS_FIRST_LETTER_STYLE means that the block has first-letter style,
  *  even if it has no actual first-letter frame among its descendants.
  *
  * NS_BLOCK_HAS_FIRST_LETTER_CHILD means that there is an inflow first-letter
  *  frame among the block's descendants. If there is a floating first-letter
  *  frame, or the block has first-letter style but has no first letter, this
  *  bit is not set. This bit is set on the first continuation only.
  */
-#define NS_BLOCK_NO_AUTO_MARGINS            0x00200000
-#define NS_BLOCK_MARGIN_ROOT                0x00400000
-#define NS_BLOCK_FLOAT_MGR                  0x00800000
-#define NS_BLOCK_HAS_FIRST_LETTER_STYLE     0x20000000
-#define NS_BLOCK_FRAME_HAS_OUTSIDE_BULLET   0x40000000
-#define NS_BLOCK_HAS_FIRST_LETTER_CHILD     0x80000000
+#define NS_BLOCK_NO_AUTO_MARGINS          NS_FRAME_STATE_BIT(21)
+#define NS_BLOCK_MARGIN_ROOT              NS_FRAME_STATE_BIT(22)
+#define NS_BLOCK_FLOAT_MGR                NS_FRAME_STATE_BIT(23)
+#define NS_BLOCK_HAS_FIRST_LETTER_STYLE   NS_FRAME_STATE_BIT(29)
+#define NS_BLOCK_FRAME_HAS_OUTSIDE_BULLET NS_FRAME_STATE_BIT(30)
+#define NS_BLOCK_HAS_FIRST_LETTER_CHILD   NS_FRAME_STATE_BIT(31)
 // These are the bits that get inherited from a block frame to its
 // next-in-flows and are not private to blocks
-#define NS_BLOCK_FLAGS_MASK                 0xF0E00000 
+#define NS_BLOCK_FLAGS_MASK               (NS_BLOCK_NO_AUTO_MARGINS | \
+                                           NS_BLOCK_MARGIN_ROOT | \
+                                           NS_BLOCK_FLOAT_MGR | \
+                                           NS_BLOCK_HAS_FIRST_LETTER_STYLE | \
+                                           NS_BLOCK_FRAME_HAS_OUTSIDE_BULLET | \
+                                           NS_BLOCK_HAS_FIRST_LETTER_CHILD)
 
 // Factory methods for creating html layout objects
 
 // Create a frame that supports "display: block" layout behavior
 nsIFrame*
 NS_NewBlockFrame(nsIPresShell* aPresShell, nsStyleContext* aContext, PRUint32 aFlags = 0);
 
 // Special Generated Content Node. It contains text taken from an

--- a/layout/generic/nsIFrame.h
+++ b/layout/generic/nsIFrame.h
@@ -139,138 +139,140 @@ typedef PRUint32 nsSplittableType;
 //----------------------------------------------------------------------
 
 /**
  * Frame state bits. Any bits not listed here are reserved for future
  * extensions, but must be stored by the frames.
  */
 typedef PRUint32 nsFrameState;
 
+#define NS_FRAME_STATE_BIT(n_) (nsFrameState(1) << (n_))
+
 enum {
-  NS_FRAME_IN_REFLOW =                          0x00000001,
+  NS_FRAME_IN_REFLOW =                          NS_FRAME_STATE_BIT(0),
 
   // This is only set during painting
-  NS_FRAME_FORCE_DISPLAY_LIST_DESCEND_INTO =    0x00000001,
+  NS_FRAME_FORCE_DISPLAY_LIST_DESCEND_INTO =    NS_FRAME_STATE_BIT(0),
 
   // This bit is set when a frame is created. After it has been reflowed
   // once (during the DidReflow with a finished state) the bit is
   // cleared.
-  NS_FRAME_FIRST_REFLOW =                       0x00000002,
+  NS_FRAME_FIRST_REFLOW =                       NS_FRAME_STATE_BIT(1),
 
   // For a continuation frame, if this bit is set, then this a "fluid" 
   // continuation, i.e., across a line boundary. Otherwise it's a "hard"
   // continuation, e.g. a bidi continuation.
-  NS_FRAME_IS_FLUID_CONTINUATION =              0x00000004,
+  NS_FRAME_IS_FLUID_CONTINUATION =              NS_FRAME_STATE_BIT(2),
 
 /*
  * This bit is obsolete, replaced by HasOverflowRect().
  * The definition is left here as a placeholder for now, to remind us
  * that this bit is now free to allocate for other purposes.
  * // This bit is set when the frame's overflow rect is
  * // different from its border rect (i.e. GetOverflowRect() != GetRect())
- * NS_FRAME_OUTSIDE_CHILDREN =                   0x00000008,
+ * NS_FRAME_OUTSIDE_CHILDREN =                   NS_FRAME_STATE_BIT(3),
  */
 
   // If this bit is set, then a reference to the frame is being held
   // elsewhere.  The frame may want to send a notification when it is
   // destroyed to allow these references to be cleared.
-  NS_FRAME_EXTERNAL_REFERENCE =                 0x00000010,
+  NS_FRAME_EXTERNAL_REFERENCE =                 NS_FRAME_STATE_BIT(4),
 
   // If this bit is set, this frame or one of its descendants has a
   // percentage height that depends on an ancestor of this frame.
   // (Or it did at one point in the past, since we don't necessarily clear
   // the bit when it's no longer needed; it's an optimization.)
-  NS_FRAME_CONTAINS_RELATIVE_HEIGHT =           0x00000020,
+  NS_FRAME_CONTAINS_RELATIVE_HEIGHT =           NS_FRAME_STATE_BIT(5),
 
   // If this bit is set, then the frame corresponds to generated content
-  NS_FRAME_GENERATED_CONTENT =                  0x00000040,
+  NS_FRAME_GENERATED_CONTENT =                  NS_FRAME_STATE_BIT(6),
 
   // If this bit is set the frame is a continuation that is holding overflow,
   // i.e. it is a next-in-flow created to hold overflow after the box's
   // height has ended. This means the frame should be a) at the top of the
   // page and b) invisible: no borders, zero height, ignored in margin
   // collapsing, etc. See nsContainerFrame.h
-  NS_FRAME_IS_OVERFLOW_CONTAINER =              0x00000080,
+  NS_FRAME_IS_OVERFLOW_CONTAINER =              NS_FRAME_STATE_BIT(7),
 
   // If this bit is set, then the frame has been moved out of the flow,
   // e.g., it is absolutely positioned or floated
-  NS_FRAME_OUT_OF_FLOW =                        0x00000100,
+  NS_FRAME_OUT_OF_FLOW =                        NS_FRAME_STATE_BIT(8),
 
   // If this bit is set, then the frame reflects content that may be selected
-  NS_FRAME_SELECTED_CONTENT =                   0x00000200,
+  NS_FRAME_SELECTED_CONTENT =                   NS_FRAME_STATE_BIT(9),
 
   // If this bit is set, then the frame is dirty and needs to be reflowed.
   // This bit is set when the frame is first created.
   // This bit is cleared by DidReflow after the required call to Reflow has
   // finished.
   // Do not set this bit yourself if you plan to pass the frame to
   // nsIPresShell::FrameNeedsReflow.  Pass the right arguments instead.
-  NS_FRAME_IS_DIRTY =                           0x00000400,
+  NS_FRAME_IS_DIRTY =                           NS_FRAME_STATE_BIT(10),
 
   // If this bit is set then the frame is too deep in the frame tree, and
   // we'll stop updating it and its children, to prevent stack overflow
   // and the like.
-  NS_FRAME_TOO_DEEP_IN_FRAME_TREE =             0x00000800,
+  NS_FRAME_TOO_DEEP_IN_FRAME_TREE =             NS_FRAME_STATE_BIT(11),
 
   // If this bit is set, either:
   //  1. the frame has children that have either NS_FRAME_IS_DIRTY or
   //     NS_FRAME_HAS_DIRTY_CHILDREN, or
   //  2. the frame has had descendants removed.
   // It means that Reflow needs to be called, but that Reflow will not
   // do as much work as it would if NS_FRAME_IS_DIRTY were set.
   // This bit is cleared by DidReflow after the required call to Reflow has
   // finished.
   // Do not set this bit yourself if you plan to pass the frame to
   // nsIPresShell::FrameNeedsReflow.  Pass the right arguments instead.
-  NS_FRAME_HAS_DIRTY_CHILDREN =                 0x00001000,
+  NS_FRAME_HAS_DIRTY_CHILDREN =                 NS_FRAME_STATE_BIT(12),
 
   // If this bit is set, the frame has an associated view
-  NS_FRAME_HAS_VIEW =                           0x00002000,
+  NS_FRAME_HAS_VIEW =                           NS_FRAME_STATE_BIT(13),
 
   // If this bit is set, the frame was created from anonymous content.
-  NS_FRAME_INDEPENDENT_SELECTION =              0x00004000,
+  NS_FRAME_INDEPENDENT_SELECTION =              NS_FRAME_STATE_BIT(14),
 
   // If this bit is set, the frame is "special" (lame term, I know),
   // which means that it is part of the mangled frame hierarchy that
   // results when an inline has been split because of a nested block.
   // See the comments in nsCSSFrameConstructor::ConstructInline for
   // more details.
-  NS_FRAME_IS_SPECIAL =                         0x00008000,
+  NS_FRAME_IS_SPECIAL =                         NS_FRAME_STATE_BIT(15),
 
   // If this bit is set, the frame may have a transform that it applies
   // to its coordinate system (e.g. CSS transform, SVG foreignObject).
   // This is used primarily in GetTransformMatrix to optimize for the
   // common case.
   // ALSO, if this bit is set, the frame's first-continuation may
   // have an associated nsSVGRenderingObserverList.
-  NS_FRAME_MAY_BE_TRANSFORMED_OR_HAVE_RENDERING_OBSERVERS = 0x00010000,
+  NS_FRAME_MAY_BE_TRANSFORMED_OR_HAVE_RENDERING_OBSERVERS =
+                                                NS_FRAME_STATE_BIT(16),
 
 #ifdef IBMBIDI
   // If this bit is set, the frame itself is a bidi continuation,
   // or is incomplete (its next sibling is a bidi continuation)
-  NS_FRAME_IS_BIDI =                            0x00020000,
+  NS_FRAME_IS_BIDI =                            NS_FRAME_STATE_BIT(17),
 #endif
 
   // If this bit is set the frame has descendant with a view
-  NS_FRAME_HAS_CHILD_WITH_VIEW =                0x00040000,
+  NS_FRAME_HAS_CHILD_WITH_VIEW =                NS_FRAME_STATE_BIT(18),
 
   // If this bit is set, then reflow may be dispatched from the current
   // frame instead of the root frame.
-  NS_FRAME_REFLOW_ROOT =                        0x00080000,
+  NS_FRAME_REFLOW_ROOT =                        NS_FRAME_STATE_BIT(19),
 
-  // The lower 20 bits of the frame state word are reserved by this API.
-  NS_FRAME_RESERVED =                           0x000FFFFF,
+  // Bits 20-31 of the frame state are reserved for implementations.
+  NS_FRAME_IMPL_RESERVED =                      nsFrameState(0xFFF00000),
 
-  // The upper 12 bits of the frame state word are reserved for frame
-  // implementations.
-  NS_FRAME_IMPL_RESERVED =                      0xFFF00000,
+  // The lower 20 bits of the frame state are reserved by this API.
+  NS_FRAME_RESERVED =                           ~NS_FRAME_IMPL_RESERVED,
 
   // Box layout bits
-  NS_STATE_IS_HORIZONTAL =                      0x00400000,
-  NS_STATE_IS_DIRECTION_NORMAL =                0x80000000
+  NS_STATE_IS_HORIZONTAL =                      NS_FRAME_STATE_BIT(22),
+  NS_STATE_IS_DIRECTION_NORMAL =                NS_FRAME_STATE_BIT(31)
 };
 
 // Helper macros
 #define NS_SUBTREE_DIRTY(_frame)  \
   (((_frame)->GetStateBits() &      \
     (NS_FRAME_IS_DIRTY | NS_FRAME_HAS_DIRTY_CHILDREN)) != 0)
 
 //----------------------------------------------------------------------

--- a/layout/generic/nsImageFrame.h
+++ b/layout/generic/nsImageFrame.h
@@ -82,18 +82,18 @@ public:
   NS_IMETHOD FrameChanged(imgIContainer *aContainer, nsIntRect * dirtyRect);
 
   void SetFrame(nsImageFrame *frame) { mFrame = frame; }
 
 private:
   nsImageFrame *mFrame;
 };
 
-#define IMAGE_SIZECONSTRAINED       0x00100000
-#define IMAGE_GOTINITIALREFLOW      0x00200000
+#define IMAGE_SIZECONSTRAINED       NS_FRAME_STATE_BIT(20)
+#define IMAGE_GOTINITIALREFLOW      NS_FRAME_STATE_BIT(21)
 
 #define ImageFrameSuper nsSplittableFrame
 
 class nsImageFrame : public ImageFrameSuper, public nsIImageFrame {
 public:
   NS_DECL_FRAMEARENA_HELPERS
 
   nsImageFrame(nsStyleContext* aContext);

--- a/layout/generic/nsInlineFrame.h
+++ b/layout/generic/nsInlineFrame.h
@@ -49,28 +49,28 @@ class nsAnonymousBlockFrame;
 #define nsInlineFrameSuper nsHTMLContainerFrame
 
 // NS_INLINE_FRAME_HARD_TEXT_OFFSETS is used for access keys, where what
 // would normally be 1 text frame is split into 3 sets of an inline parent 
 // and text child (the pre access key text, the underlined key text, and
 // the post access key text). The offsets of the 3 text frame children
 // are set in nsCSSFrameConstructor
 
-#define NS_INLINE_FRAME_HARD_TEXT_OFFSETS            0x00100000
+#define NS_INLINE_FRAME_HARD_TEXT_OFFSETS            NS_FRAME_STATE_BIT(20)
 
 /**  In Bidi left (or right) margin/padding/border should be applied to left
  *  (or right) most frame (or a continuation frame).
  *  This state value shows if this frame is left (or right) most continuation
  *  or not.
  */
-#define NS_INLINE_FRAME_BIDI_VISUAL_STATE_IS_SET     0x00200000
+#define NS_INLINE_FRAME_BIDI_VISUAL_STATE_IS_SET     NS_FRAME_STATE_BIT(21)
 
-#define NS_INLINE_FRAME_BIDI_VISUAL_IS_LEFT_MOST     0x00400000
+#define NS_INLINE_FRAME_BIDI_VISUAL_IS_LEFT_MOST     NS_FRAME_STATE_BIT(22)
 
-#define NS_INLINE_FRAME_BIDI_VISUAL_IS_RIGHT_MOST    0x00800000
+#define NS_INLINE_FRAME_BIDI_VISUAL_IS_RIGHT_MOST    NS_FRAME_STATE_BIT(23)
 
 /**
  * Inline frame class.
  *
  * This class manages a list of child frames that are inline frames. Working with
  * nsLineLayout, the class will reflow and place inline frames on a line.
  */
 class nsInlineFrame : public nsInlineFrameSuper

--- a/layout/generic/nsPlaceholderFrame.h
+++ b/layout/generic/nsPlaceholderFrame.h
@@ -70,21 +70,24 @@
 #include "nsGkAtoms.h"
 
 nsIFrame* NS_NewPlaceholderFrame(nsIPresShell* aPresShell,
                                  nsStyleContext* aContext,
                                  nsFrameState aTypeBit);
 
 // Frame state bits that are used to keep track of what this is a
 // placeholder for.
-#define PLACEHOLDER_FOR_FLOAT    0x00100000
-#define PLACEHOLDER_FOR_ABSPOS   0x00200000
-#define PLACEHOLDER_FOR_FIXEDPOS 0x00400000
-#define PLACEHOLDER_FOR_POPUP    0x00800000
-#define PLACEHOLDER_TYPE_MASK    0x00F00000
+#define PLACEHOLDER_FOR_FLOAT    NS_FRAME_STATE_BIT(20)
+#define PLACEHOLDER_FOR_ABSPOS   NS_FRAME_STATE_BIT(21)
+#define PLACEHOLDER_FOR_FIXEDPOS NS_FRAME_STATE_BIT(22)
+#define PLACEHOLDER_FOR_POPUP    NS_FRAME_STATE_BIT(23)
+#define PLACEHOLDER_TYPE_MASK    (PLACEHOLDER_FOR_FLOAT | \
+                                  PLACEHOLDER_FOR_ABSPOS | \
+                                  PLACEHOLDER_FOR_FIXEDPOS | \
+                                  PLACEHOLDER_FOR_POPUP)
 
 /**
  * Implementation of a frame that's used as a placeholder for a frame that
  * has been moved out of the flow
  */
 class nsPlaceholderFrame : public nsFrame {
 public:
   NS_DECL_FRAMEARENA_HELPERS

--- a/layout/generic/nsTextFrame.h
+++ b/layout/generic/nsTextFrame.h
@@ -57,17 +57,17 @@
 #include "gfxSkipChars.h"
 #include "gfxContext.h"
 
 class nsTextPaintStyle;
 class PropertyProvider;
 
 // This state bit is set on frames that have some non-collapsed characters after
 // reflow
-#define TEXT_HAS_NONCOLLAPSED_CHARACTERS 0x80000000
+#define TEXT_HAS_NONCOLLAPSED_CHARACTERS NS_FRAME_STATE_BIT(31)
 
 class nsTextFrame : public nsFrame {
 public:
   NS_DECL_FRAMEARENA_HELPERS
 
   friend class nsContinuingTextFrame;
 
   nsTextFrame(nsStyleContext* aContext) : nsFrame(aContext)

--- a/layout/generic/nsTextFrameThebes.cpp
+++ b/layout/generic/nsTextFrameThebes.cpp
@@ -139,55 +139,56 @@ static void DestroyTabWidth(void* aPrope
 }
 
 NS_DECLARE_FRAME_PROPERTY(TabWidthProperty, DestroyTabWidth)
 
 // The following flags are set during reflow
 
 // This bit is set on the first frame in a continuation indicating
 // that it was chopped short because of :first-letter style.
-#define TEXT_FIRST_LETTER    0x00100000
+#define TEXT_FIRST_LETTER    NS_FRAME_STATE_BIT(20)
 // This bit is set on frames that are logically adjacent to the start of the
 // line (i.e. no prior frame on line with actual displayed in-flow content).
-#define TEXT_START_OF_LINE   0x00200000
+#define TEXT_START_OF_LINE   NS_FRAME_STATE_BIT(21)
 // This bit is set on frames that are logically adjacent to the end of the
 // line (i.e. no following on line with actual displayed in-flow content).
-#define TEXT_END_OF_LINE     0x00400000
+#define TEXT_END_OF_LINE     NS_FRAME_STATE_BIT(22)
 // This bit is set on frames that end with a hyphenated break.
-#define TEXT_HYPHEN_BREAK    0x00800000
+#define TEXT_HYPHEN_BREAK    NS_FRAME_STATE_BIT(23)
 // This bit is set on frames that trimmed trailing whitespace characters when
 // calculating their width during reflow.
-#define TEXT_TRIMMED_TRAILING_WHITESPACE 0x01000000
+#define TEXT_TRIMMED_TRAILING_WHITESPACE NS_FRAME_STATE_BIT(24)
 // This bit is set on frames that have justification enabled. We record
 // this in a state bit because we don't always have the containing block
 // easily available to check text-align on.
-#define TEXT_JUSTIFICATION_ENABLED       0x02000000
+#define TEXT_JUSTIFICATION_ENABLED       NS_FRAME_STATE_BIT(25)
 // Set this bit if the textframe has overflow area for IME/spellcheck underline.
-#define TEXT_SELECTION_UNDERLINE_OVERFLOWED 0x04000000
+#define TEXT_SELECTION_UNDERLINE_OVERFLOWED NS_FRAME_STATE_BIT(26)
 
 #define TEXT_REFLOW_FLAGS    \
   (TEXT_FIRST_LETTER|TEXT_START_OF_LINE|TEXT_END_OF_LINE|TEXT_HYPHEN_BREAK| \
    TEXT_TRIMMED_TRAILING_WHITESPACE|TEXT_JUSTIFICATION_ENABLED| \
    TEXT_HAS_NONCOLLAPSED_CHARACTERS|TEXT_SELECTION_UNDERLINE_OVERFLOWED)
 
 // Cache bits for IsEmpty().
 // Set this bit if the textframe is known to be only collapsible whitespace.
-#define TEXT_IS_ONLY_WHITESPACE    0x08000000
+#define TEXT_IS_ONLY_WHITESPACE    NS_FRAME_STATE_BIT(27)
 // Set this bit if the textframe is known to be not only collapsible whitespace.
-#define TEXT_ISNOT_ONLY_WHITESPACE 0x10000000
-
-#define TEXT_WHITESPACE_FLAGS      0x18000000
+#define TEXT_ISNOT_ONLY_WHITESPACE NS_FRAME_STATE_BIT(28)
+
+#define TEXT_WHITESPACE_FLAGS      (TEXT_IS_ONLY_WHITESPACE | \
+                                    TEXT_ISNOT_ONLY_WHITESPACE)
 // This bit is set while the frame is registered as a blinking frame.
-#define TEXT_BLINK_ON              0x20000000
+#define TEXT_BLINK_ON              NS_FRAME_STATE_BIT(29)
 
 // Set when this text frame is mentioned in the userdata for a textrun
-#define TEXT_IN_TEXTRUN_USER_DATA  0x40000000
+#define TEXT_IN_TEXTRUN_USER_DATA  NS_FRAME_STATE_BIT(30)
 
 // nsTextFrame.h has
-// #define TEXT_HAS_NONCOLLAPSED_CHARACTERS 0x80000000
+// #define TEXT_HAS_NONCOLLAPSED_CHARACTERS NS_FRAME_STATE_BIT(31)
 
 /*
  * Some general notes
  * 
  * Text frames delegate work to gfxTextRun objects. The gfxTextRun object
  * transforms text to positioned glyphs. It can report the geometry of the
  * glyphs and paint them. Text frames configure gfxTextRuns by providing text,
  * spacing, language, and other information.

--- a/layout/svg/base/src/nsSVGUtils.h
+++ b/layout/svg/base/src/nsSVGUtils.h
@@ -86,24 +86,24 @@ class Element;
 } // namespace dom
 } // namespace mozilla
 
 #ifndef M_PI
 #define M_PI 3.14159265358979323846
 #endif
 
 // SVG Frame state bits
-#define NS_STATE_IS_OUTER_SVG         0x00100000
+#define NS_STATE_IS_OUTER_SVG         NS_FRAME_STATE_BIT(20)
 
-#define NS_STATE_SVG_DIRTY            0x00200000
+#define NS_STATE_SVG_DIRTY            NS_FRAME_STATE_BIT(21)
 
 /* are we the child of a non-display container? */
-#define NS_STATE_SVG_NONDISPLAY_CHILD 0x00400000
+#define NS_STATE_SVG_NONDISPLAY_CHILD NS_FRAME_STATE_BIT(22)
 
-#define NS_STATE_SVG_PROPAGATE_TRANSFORM 0x00800000
+#define NS_STATE_SVG_PROPAGATE_TRANSFORM NS_FRAME_STATE_BIT(23)
 
 /**
  * Byte offsets of channels in a native packed gfxColor or cairo image surface.
  */
 #ifdef IS_BIG_ENDIAN
 #define GFX_ARGB32_OFFSET_A 0
 #define GFX_ARGB32_OFFSET_R 1
 #define GFX_ARGB32_OFFSET_G 2

--- a/layout/tables/nsTableCellFrame.h
+++ b/layout/tables/nsTableCellFrame.h
@@ -47,19 +47,19 @@
 #include "nsLayoutUtils.h"
 #include "nsTArray.h"
 
 class nsTableFrame;
 
 /**
  * Additional frame-state bits
  */
-#define NS_TABLE_CELL_CONTENT_EMPTY       0x80000000
-#define NS_TABLE_CELL_HAD_SPECIAL_REFLOW  0x20000000
-#define NS_TABLE_CELL_HAS_PCT_OVER_HEIGHT 0x10000000
+#define NS_TABLE_CELL_CONTENT_EMPTY       NS_FRAME_STATE_BIT(31)
+#define NS_TABLE_CELL_HAD_SPECIAL_REFLOW  NS_FRAME_STATE_BIT(29)
+#define NS_TABLE_CELL_HAS_PCT_OVER_HEIGHT NS_FRAME_STATE_BIT(28)
 
 /**
  * nsTableCellFrame
  * data structure to maintain information about a single table cell's frame
  *
  * NOTE:  frames are not ref counted.  We expose addref and release here
  * so we can change that decsion in the future.  Users of nsITableCellLayout
  * should refcount correctly as if this object is being ref counted, though

--- a/layout/tables/nsTableColFrame.cpp
+++ b/layout/tables/nsTableColFrame.cpp
@@ -41,20 +41,25 @@
 #include "nsStyleContext.h"
 #include "nsStyleConsts.h"
 #include "nsPresContext.h"
 #include "nsGkAtoms.h"
 #include "nsCSSRendering.h"
 #include "nsIContent.h"
 #include "nsIDOMHTMLTableColElement.h"
 
-#define COL_TYPE_BITS                 0xF0000000 // uses bits 29-32 from mState
+#define COL_TYPE_BITS                 (NS_FRAME_STATE_BIT(28) | \
+                                       NS_FRAME_STATE_BIT(29) | \
+                                       NS_FRAME_STATE_BIT(30) | \
+                                       NS_FRAME_STATE_BIT(31))
 #define COL_TYPE_OFFSET               28
 
-#define COL_CONSTRAINT_BITS           0x07000000 // uses bits 25-27
+#define COL_CONSTRAINT_BITS           (NS_FRAME_STATE_BIT(24) | \
+                                       NS_FRAME_STATE_BIT(25) | \
+                                       NS_FRAME_STATE_BIT(26))
 #define COL_CONSTRAINT_OFFSET         24
 
 nsTableColFrame::nsTableColFrame(nsStyleContext* aContext) :
   nsSplittableFrame(aContext)
 {
   SetColType(eColContent);
   ResetIntrinsics();
   ResetSpanIntrinsics();

--- a/layout/tables/nsTableColGroupFrame.cpp
+++ b/layout/tables/nsTableColGroupFrame.cpp
@@ -42,17 +42,18 @@
 #include "nsStyleConsts.h"
 #include "nsPresContext.h"
 #include "nsHTMLParts.h"
 #include "nsGkAtoms.h"
 #include "nsCOMPtr.h"
 #include "nsCSSRendering.h"
 #include "nsIPresShell.h"
 
-#define COL_GROUP_TYPE_BITS          0xC0000000 // uses bits 31-32 from mState
+#define COL_GROUP_TYPE_BITS          (NS_FRAME_STATE_BIT(30) | \
+                                      NS_FRAME_STATE_BIT(31))
 #define COL_GROUP_TYPE_OFFSET        30
 
 nsTableColGroupType 
 nsTableColGroupFrame::GetColType() const 
 {
   return (nsTableColGroupType)((mState & COL_GROUP_TYPE_BITS) >> COL_GROUP_TYPE_OFFSET);
 }
 

--- a/layout/tables/nsTableRowFrame.h
+++ b/layout/tables/nsTableRowFrame.h
@@ -41,23 +41,23 @@
 #include "nsHTMLContainerFrame.h"
 #include "nsTablePainter.h"
 
 class  nsTableFrame;
 class  nsTableCellFrame;
 struct nsTableCellReflowState;
 
 // This is also used on rows, from nsTableRowGroupFrame.h
-// #define NS_REPEATED_ROW_OR_ROWGROUP      0x10000000
+// #define NS_REPEATED_ROW_OR_ROWGROUP      NS_FRAME_STATE_BIT(28)
 
 // Indicates whether this row has any cells that have
 // non-auto-height and rowspan=1
-#define NS_ROW_HAS_CELL_WITH_STYLE_HEIGHT   0x20000000
+#define NS_ROW_HAS_CELL_WITH_STYLE_HEIGHT   NS_FRAME_STATE_BIT(29)
 
-#define NS_TABLE_ROW_HAS_UNPAGINATED_HEIGHT 0x40000000
+#define NS_TABLE_ROW_HAS_UNPAGINATED_HEIGHT NS_FRAME_STATE_BIT(30)
 
 /**
  * nsTableRowFrame is the frame that maps table rows 
  * (HTML tag TR). This class cannot be reused
  * outside of an nsTableRowGroupFrame.  It assumes that its parent is an nsTableRowGroupFrame,  
  * and its children are nsTableCellFrames.
  * 
  * @see nsTableFrame

--- a/layout/tables/nsTableRowGroupFrame.h
+++ b/layout/tables/nsTableRowGroupFrame.h
@@ -69,21 +69,21 @@ struct nsRowGroupReflowState {
   }
 
   ~nsRowGroupReflowState() {}
 };
 
 // use the following bits from nsFrame's frame state 
 
 // thead or tfoot should be repeated on every printed page
-#define NS_ROWGROUP_REPEATABLE           0x80000000
-#define NS_ROWGROUP_HAS_STYLE_HEIGHT     0x40000000
+#define NS_ROWGROUP_REPEATABLE           NS_FRAME_STATE_BIT(31)
+#define NS_ROWGROUP_HAS_STYLE_HEIGHT     NS_FRAME_STATE_BIT(30)
 // the next is also used on rows (see nsTableRowGroupFrame::InitRepeatedFrame)
-#define NS_REPEATED_ROW_OR_ROWGROUP      0x10000000
-#define NS_ROWGROUP_HAS_ROW_CURSOR       0x08000000
+#define NS_REPEATED_ROW_OR_ROWGROUP      NS_FRAME_STATE_BIT(28)
+#define NS_ROWGROUP_HAS_ROW_CURSOR       NS_FRAME_STATE_BIT(27)
 
 #define MIN_ROWS_NEEDING_CURSOR 20
 
 /**
  * nsTableRowGroupFrame is the frame that maps row groups 
  * (HTML tags THEAD, TFOOT, and TBODY). This class cannot be reused
  * outside of an nsTableFrame.  It assumes that its parent is an nsTableFrame, and 
  * its children are nsTableRowFrames.

--- a/layout/xul/base/src/nsBox.h
+++ b/layout/xul/base/src/nsBox.h
@@ -39,19 +39,19 @@
 #define nsBox_h___
 
 #include "nsIFrame.h"
 
 class nsITheme;
 
 #define DEFAULT_ORDINAL_GROUP 1
 
-#define NS_STATE_IS_ROOT        0x01000000
-#define NS_STATE_SET_TO_DEBUG   0x04000000
-#define NS_STATE_DEBUG_WAS_SET  0x08000000
+#define NS_STATE_IS_ROOT        NS_FRAME_STATE_BIT(24)
+#define NS_STATE_SET_TO_DEBUG   NS_FRAME_STATE_BIT(26)
+#define NS_STATE_DEBUG_WAS_SET  NS_FRAME_STATE_BIT(27)
 
 class nsBox : public nsIFrame {
 
 public:
 
   friend class nsIFrame;
 
   static void Shutdown();

--- a/layout/xul/base/src/nsBoxFrame.h
+++ b/layout/xul/base/src/nsBoxFrame.h
@@ -46,28 +46,28 @@
 #ifndef nsBoxFrame_h___
 #define nsBoxFrame_h___
 
 #include "nsCOMPtr.h"
 #include "nsContainerFrame.h"
 class nsBoxLayoutState;
 
 // flags from box
-#define NS_STATE_BOX_CHILD_RESERVED      0x00100000
-#define NS_STATE_STACK_NOT_POSITIONED    0x00200000
-//#define NS_STATE_IS_HORIZONTAL           0x00400000  moved to nsIFrame.h
-#define NS_STATE_AUTO_STRETCH            0x00800000
-//#define NS_STATE_IS_ROOT                 0x01000000  moved to nsBox.h
-#define NS_STATE_CURRENTLY_IN_DEBUG      0x02000000
-//#define NS_STATE_SET_TO_DEBUG            0x04000000  moved to nsBox.h
-//#define NS_STATE_DEBUG_WAS_SET           0x08000000  moved to nsBox.h
-//                                         0x10000000  not used anymore
-#define NS_STATE_BOX_WRAPS_KIDS_IN_BLOCK 0x20000000
-#define NS_STATE_EQUAL_SIZE              0x40000000
-//#define NS_STATE_IS_DIRECTION_NORMAL     0x80000000  moved to nsIFrame.h
+#define NS_STATE_BOX_CHILD_RESERVED      NS_FRAME_STATE_BIT(20)
+#define NS_STATE_STACK_NOT_POSITIONED    NS_FRAME_STATE_BIT(21)
+//#define NS_STATE_IS_HORIZONTAL           NS_FRAME_STATE_BIT(22)  moved to nsIFrame.h
+#define NS_STATE_AUTO_STRETCH            NS_FRAME_STATE_BIT(23)
+//#define NS_STATE_IS_ROOT                 NS_FRAME_STATE_BIT(24)  moved to nsBox.h
+#define NS_STATE_CURRENTLY_IN_DEBUG      NS_FRAME_STATE_BIT(25)
+//#define NS_STATE_SET_TO_DEBUG            NS_FRAME_STATE_BIT(26)  moved to nsBox.h
+//#define NS_STATE_DEBUG_WAS_SET           NS_FRAME_STATE_BIT(27)  moved to nsBox.h
+//                                         NS_FRAME_STATE_BIT(28)  not used anymore
+#define NS_STATE_BOX_WRAPS_KIDS_IN_BLOCK NS_FRAME_STATE_BIT(29)
+#define NS_STATE_EQUAL_SIZE              NS_FRAME_STATE_BIT(30)
+//#define NS_STATE_IS_DIRECTION_NORMAL     NS_FRAME_STATE_BIT(31)  moved to nsIFrame.h
 
 nsIFrame* NS_NewBoxFrame(nsIPresShell* aPresShell,
                          nsStyleContext* aContext,
                          PRBool aIsRoot,
                          nsIBoxLayout* aLayoutManager);
 nsIFrame* NS_NewBoxFrame(nsIPresShell* aPresShell,
                          nsStyleContext* aContext);
 

--- a/layout/xul/base/src/nsTextBoxFrame.cpp
+++ b/layout/xul/base/src/nsTextBoxFrame.cpp
@@ -78,17 +78,17 @@
 #endif // IBMBIDI
 
 #define CROP_LEFT   "left"
 #define CROP_RIGHT  "right"
 #define CROP_CENTER "center"
 #define CROP_START  "start"
 #define CROP_END    "end"
 
-#define NS_STATE_NEED_LAYOUT 0x01000000
+#define NS_STATE_NEED_LAYOUT NS_FRAME_STATE_BIT(24)
 
 class nsAccessKeyInfo
 {
 public:
     PRInt32 mAccesskeyIndex;
     nscoord mBeforeWidth, mAccessWidth, mAccessUnderlineSize, mAccessOffset;
 };