Backout 0b205d34aefc (bug 673405), 3327d251ce49 (bug 672504) for mochitest-other leaks
authorEd Morley <bmo@edmorley.co.uk>
Wed, 08 Feb 2012 01:23:12 +0000
changeset 86392 3e7875d6ee517d26d8fbfb77fd667d6909879764
parent 86391 0b1fad0b73541fdc665bbaa01a41a51e5ff44d6e
child 86393 9dde014a4b3fe281a2ce5faf8de0edfbc49e4a05
push id22015
push userbmo@edmorley.co.uk
push dateWed, 08 Feb 2012 12:23:25 +0000
treeherdermozilla-central@06b063c001b6 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
bugs673405, 672504
milestone13.0a1
backs out0b205d34aefcedb5542752b76f139ce6fc229239
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Backout 0b205d34aefc (bug 673405), 3327d251ce49 (bug 672504) for mochitest-other leaks
accessible/src/atk/AtkSocketAccessible.cpp
accessible/src/atk/AtkSocketAccessible.h
accessible/src/atk/nsAccessNodeWrap.cpp
accessible/src/atk/nsAccessNodeWrap.h
accessible/src/atk/nsAccessibleWrap.cpp
accessible/src/atk/nsAccessibleWrap.h
accessible/src/base/FocusManager.cpp
accessible/src/base/NotificationController.cpp
accessible/src/base/nsARIAGridAccessible.cpp
accessible/src/base/nsARIAGridAccessible.h
accessible/src/base/nsAccUtils.cpp
accessible/src/base/nsAccUtils.h
accessible/src/base/nsAccessNode.cpp
accessible/src/base/nsAccessNode.h
accessible/src/base/nsAccessibilityService.cpp
accessible/src/base/nsAccessibilityService.h
accessible/src/base/nsAccessible.cpp
accessible/src/base/nsAccessible.h
accessible/src/base/nsBaseWidgetAccessible.cpp
accessible/src/base/nsBaseWidgetAccessible.h
accessible/src/base/nsCaretAccessible.cpp
accessible/src/base/nsDocAccessible.cpp
accessible/src/base/nsDocAccessible.h
accessible/src/base/nsFormControlAccessible.cpp
accessible/src/base/nsFormControlAccessible.h
accessible/src/base/nsOuterDocAccessible.cpp
accessible/src/base/nsOuterDocAccessible.h
accessible/src/base/nsRootAccessible.cpp
accessible/src/base/nsTextAccessible.cpp
accessible/src/base/nsTextAccessible.h
accessible/src/html/nsHTMLCanvasAccessible.cpp
accessible/src/html/nsHTMLCanvasAccessible.h
accessible/src/html/nsHTMLFormControlAccessible.cpp
accessible/src/html/nsHTMLFormControlAccessible.h
accessible/src/html/nsHTMLImageAccessible.cpp
accessible/src/html/nsHTMLImageAccessible.h
accessible/src/html/nsHTMLImageMapAccessible.cpp
accessible/src/html/nsHTMLImageMapAccessible.h
accessible/src/html/nsHTMLLinkAccessible.cpp
accessible/src/html/nsHTMLLinkAccessible.h
accessible/src/html/nsHTMLSelectAccessible.cpp
accessible/src/html/nsHTMLSelectAccessible.h
accessible/src/html/nsHTMLTableAccessible.cpp
accessible/src/html/nsHTMLTableAccessible.h
accessible/src/html/nsHTMLTextAccessible.cpp
accessible/src/html/nsHTMLTextAccessible.h
accessible/src/html/nsHyperTextAccessible.cpp
accessible/src/html/nsHyperTextAccessible.h
accessible/src/mac/mozAccessible.mm
accessible/src/mac/nsAccessNodeWrap.h
accessible/src/mac/nsAccessNodeWrap.mm
accessible/src/mac/nsAccessibleWrap.h
accessible/src/mac/nsAccessibleWrap.mm
accessible/src/msaa/nsARIAGridAccessibleWrap.h
accessible/src/msaa/nsAccessNodeWrap.cpp
accessible/src/msaa/nsAccessNodeWrap.h
accessible/src/msaa/nsAccessibleWrap.cpp
accessible/src/msaa/nsAccessibleWrap.h
accessible/src/msaa/nsHTMLImageAccessibleWrap.h
accessible/src/msaa/nsHTMLTableAccessibleWrap.h
accessible/src/msaa/nsHTMLWin32ObjectAccessible.cpp
accessible/src/msaa/nsHTMLWin32ObjectAccessible.h
accessible/src/msaa/nsHyperTextAccessibleWrap.h
accessible/src/msaa/nsTextAccessibleWrap.cpp
accessible/src/msaa/nsTextAccessibleWrap.h
accessible/src/msaa/nsXULListboxAccessibleWrap.cpp
accessible/src/msaa/nsXULListboxAccessibleWrap.h
accessible/src/msaa/nsXULMenuAccessibleWrap.cpp
accessible/src/msaa/nsXULMenuAccessibleWrap.h
accessible/src/msaa/nsXULTreeGridAccessibleWrap.cpp
accessible/src/msaa/nsXULTreeGridAccessibleWrap.h
accessible/src/other/nsAccessNodeWrap.cpp
accessible/src/other/nsAccessNodeWrap.h
accessible/src/other/nsAccessibleWrap.cpp
accessible/src/other/nsAccessibleWrap.h
accessible/src/xforms/nsXFormsAccessible.cpp
accessible/src/xforms/nsXFormsAccessible.h
accessible/src/xforms/nsXFormsFormControlsAccessible.cpp
accessible/src/xforms/nsXFormsFormControlsAccessible.h
accessible/src/xforms/nsXFormsWidgetsAccessible.cpp
accessible/src/xforms/nsXFormsWidgetsAccessible.h
accessible/src/xul/XULSelectControlAccessible.cpp
accessible/src/xul/XULSelectControlAccessible.h
accessible/src/xul/nsXULAlertAccessible.cpp
accessible/src/xul/nsXULAlertAccessible.h
accessible/src/xul/nsXULColorPickerAccessible.cpp
accessible/src/xul/nsXULColorPickerAccessible.h
accessible/src/xul/nsXULComboboxAccessible.cpp
accessible/src/xul/nsXULComboboxAccessible.h
accessible/src/xul/nsXULFormControlAccessible.cpp
accessible/src/xul/nsXULFormControlAccessible.h
accessible/src/xul/nsXULListboxAccessible.cpp
accessible/src/xul/nsXULListboxAccessible.h
accessible/src/xul/nsXULMenuAccessible.cpp
accessible/src/xul/nsXULMenuAccessible.h
accessible/src/xul/nsXULSliderAccessible.cpp
accessible/src/xul/nsXULSliderAccessible.h
accessible/src/xul/nsXULTabAccessible.cpp
accessible/src/xul/nsXULTabAccessible.h
accessible/src/xul/nsXULTextAccessible.cpp
accessible/src/xul/nsXULTextAccessible.h
accessible/src/xul/nsXULTreeAccessible.cpp
accessible/src/xul/nsXULTreeAccessible.h
accessible/src/xul/nsXULTreeGridAccessible.cpp
accessible/src/xul/nsXULTreeGridAccessible.h
--- a/accessible/src/atk/AtkSocketAccessible.cpp
+++ b/accessible/src/atk/AtkSocketAccessible.cpp
@@ -157,19 +157,19 @@ mai_atk_socket_get_extents(AtkComponent*
   if (!MAI_IS_ATK_SOCKET(aComponent))
     return;
 
   getExtentsHelper(MAI_ATK_SOCKET(aComponent)->accWrap,
                    aX, aY, aWidth, aHeight, aCoordType);
 }
 
 AtkSocketAccessible::AtkSocketAccessible(nsIContent* aContent,
-                                         nsDocAccessible* aDoc,
+                                         nsIWeakReference* aShell,
                                          const nsCString& aPlugId) :
-  nsAccessibleWrap(aContent, aDoc)
+  nsAccessibleWrap(aContent, aShell)
 {
   mAtkObject = mai_atk_socket_new(this);
   if (!mAtkObject)
     return;
 
   // Embeds the children of an AtkPlug, specified by plugId, as the children of
   // this socket.
   // Using G_TYPE macros instead of ATK_SOCKET macros to avoid undefined
--- a/accessible/src/atk/AtkSocketAccessible.h
+++ b/accessible/src/atk/AtkSocketAccessible.h
@@ -67,17 +67,17 @@ public:
   static const char* sATKSocketGetTypeSymbol;
 
   /*
    * True if the current Atk version supports AtkSocket and it was correctly
    * loaded.
    */
   static bool gCanEmbed;
 
-  AtkSocketAccessible(nsIContent* aContent, nsDocAccessible* aDoc,
+  AtkSocketAccessible(nsIContent* aContent, nsIWeakReference* aShell,
                       const nsCString& aPlugId);
 
   // nsAccessNode
   virtual void Shutdown();
 
   // nsIAccessible
   NS_IMETHODIMP GetNativeInterface(void** aOutAccessible);
 };
--- a/accessible/src/atk/nsAccessNodeWrap.cpp
+++ b/accessible/src/atk/nsAccessNodeWrap.cpp
@@ -50,18 +50,18 @@
 // nsAccessNodeWrap
 ////////////////////////////////////////////////////////////////////////////////
 
 //-----------------------------------------------------
 // construction 
 //-----------------------------------------------------
 
 nsAccessNodeWrap::
-  nsAccessNodeWrap(nsIContent* aContent, nsDocAccessible* aDoc) :
-  nsAccessNode(aContent, aDoc)
+    nsAccessNodeWrap(nsIContent *aContent, nsIWeakReference *aShell) :
+    nsAccessNode(aContent, aShell)
 {
 }
 
 //-----------------------------------------------------
 // destruction
 //-----------------------------------------------------
 nsAccessNodeWrap::~nsAccessNodeWrap()
 {
--- a/accessible/src/atk/nsAccessNodeWrap.h
+++ b/accessible/src/atk/nsAccessNodeWrap.h
@@ -44,16 +44,17 @@
 #ifndef _nsAccessNodeWrap_H_
 #define _nsAccessNodeWrap_H_
 
 #include "nsAccessNode.h"
 
 class nsAccessNodeWrap :  public nsAccessNode
 {
 public: // construction, destruction
-  nsAccessNodeWrap(nsIContent* aContent, nsDocAccessible* aDoc);
-  virtual ~nsAccessNodeWrap();
+    nsAccessNodeWrap(nsIContent *aContent, nsIWeakReference *aShell);
+    virtual ~nsAccessNodeWrap();
 
-  static void InitAccessibility();
-  static void ShutdownAccessibility();
+    static void InitAccessibility();
+    static void ShutdownAccessibility();
+
 };
 
 #endif
--- a/accessible/src/atk/nsAccessibleWrap.cpp
+++ b/accessible/src/atk/nsAccessibleWrap.cpp
@@ -276,18 +276,18 @@ mai_atk_object_get_type(void)
 }
 
 #ifdef MAI_LOGGING
 PRInt32 nsAccessibleWrap::mAccWrapCreated = 0;
 PRInt32 nsAccessibleWrap::mAccWrapDeleted = 0;
 #endif
 
 nsAccessibleWrap::
-  nsAccessibleWrap(nsIContent* aContent, nsDocAccessible* aDoc) :
-  nsAccessible(aContent, aDoc), mAtkObject(nsnull)
+    nsAccessibleWrap(nsIContent *aContent, nsIWeakReference *aShell) :
+    nsAccessible(aContent, aShell), mAtkObject(nsnull)
 {
 #ifdef MAI_LOGGING
     ++mAccWrapCreated;
 #endif
     MAI_LOG_DEBUG(("==nsAccessibleWrap creating: this=%p,total=%d left=%d\n",
                    (void*)this, mAccWrapCreated,
                   (mAccWrapCreated-mAccWrapDeleted)));
 }
@@ -357,17 +357,17 @@ void nsAccessibleWrap::SetMaiHyperlink(M
     }
 }
 
 NS_IMETHODIMP nsAccessibleWrap::GetNativeInterface(void **aOutAccessible)
 {
     *aOutAccessible = nsnull;
 
     if (!mAtkObject) {
-        if (IsDefunct() || !nsAccUtils::IsEmbeddedObject(this)) {
+        if (!mWeakShell || !nsAccUtils::IsEmbeddedObject(this)) {
             // We don't create ATK objects for node which has been shutdown, or
             // nsIAccessible plain text leaves
             return NS_ERROR_FAILURE;
         }
 
         GType type = GetMaiAtkType(CreateMaiInterfaces());
         NS_ENSURE_TRUE(type, NS_ERROR_FAILURE);
         mAtkObject =
--- a/accessible/src/atk/nsAccessibleWrap.h
+++ b/accessible/src/atk/nsAccessibleWrap.h
@@ -79,17 +79,17 @@ class MaiHyperlink;
 
 /**
  * nsAccessibleWrap, and its descendents in atk directory provide the
  * implementation of AtkObject.
  */
 class nsAccessibleWrap: public nsAccessible
 {
 public:
-  nsAccessibleWrap(nsIContent* aContent, nsDocAccessible* aDoc);
+    nsAccessibleWrap(nsIContent *aContent, nsIWeakReference *aShell);
     virtual ~nsAccessibleWrap();
     void ShutdownAtkObject();
 
     // nsAccessNode
     virtual void Shutdown();
 
 #ifdef MAI_LOGGING
     virtual void DumpnsAccessibleWrapInfo(int aDepth) {}
--- a/accessible/src/base/FocusManager.cpp
+++ b/accessible/src/base/FocusManager.cpp
@@ -58,21 +58,18 @@ FocusManager::~FocusManager()
 
 nsAccessible*
 FocusManager::FocusedAccessible() const
 {
   if (mActiveItem)
     return mActiveItem;
 
   nsINode* focusedNode = FocusedDOMNode();
-  if (focusedNode) {
-    nsDocAccessible* doc = 
-      GetAccService()->GetDocAccessible(focusedNode->OwnerDoc());
-    return doc ? doc->GetAccessibleOrContainer(focusedNode) : nsnull;
-  }
+  if (focusedNode)
+    return GetAccService()->GetAccessibleOrContainer(focusedNode, nsnull);
 
   return nsnull;
 }
 
 bool
 FocusManager::IsFocused(const nsAccessible* aAccessible) const
 {
   if (mActiveItem)
@@ -82,20 +79,18 @@ FocusManager::IsFocused(const nsAccessib
   if (focusedNode) {
     // XXX: Before getting an accessible for node having a DOM focus make sure
     // they belong to the same document because it can trigger unwanted document
     // accessible creation for temporary about:blank document. Without this
     // peculiarity we would end up with plain implementation based on
     // FocusedAccessible() method call. Make sure this issue is fixed in
     // bug 638465.
     if (focusedNode->OwnerDoc() == aAccessible->GetNode()->OwnerDoc()) {
-      nsDocAccessible* doc = 
-        GetAccService()->GetDocAccessible(focusedNode->OwnerDoc());
       return aAccessible ==
-	(doc ? doc->GetAccessibleOrContainer(focusedNode) : nsnull);
+        GetAccService()->GetAccessibleOrContainer(focusedNode, nsnull);
     }
   }
   return false;
 }
 
 bool
 FocusManager::IsFocusWithin(const nsAccessible* aContainer) const
 {
@@ -209,17 +204,17 @@ FocusManager::ActiveItemChanged(nsAccess
   }
   mActiveItem = aItem;
 
   // If active item is changed then fire accessible focus event on it, otherwise
   // if there's no an active item then fire focus event to accessible having
   // DOM focus.
   nsAccessible* target = FocusedAccessible();
   if (target)
-    DispatchFocusEvent(target->Document(), target);
+    DispatchFocusEvent(target->GetDocAccessible(), target);
 }
 
 void
 FocusManager::ForceFocusEvent()
 {
   nsINode* focusedNode = FocusedDOMNode();
   if (focusedNode) {
     nsDocAccessible* document =
@@ -251,21 +246,21 @@ FocusManager::ProcessDOMFocus(nsINode* a
 {
   A11YDEBUG_FOCUS_NOTIFICATION_DOMTARGET("Process DOM focus",
                                          "Notification target", aTarget)
 
   nsDocAccessible* document =
     GetAccService()->GetDocAccessible(aTarget->OwnerDoc());
 
   nsAccessible* target = document->GetAccessibleOrContainer(aTarget);
-  if (target && document) {
+  if (target) {
     // Check if still focused. Otherwise we can end up with storing the active
     // item for control that isn't focused anymore.
     nsAccessible* DOMFocus =
-      document->GetAccessibleOrContainer(FocusedDOMNode());
+      GetAccService()->GetAccessibleOrContainer(FocusedDOMNode(), nsnull);
     if (target != DOMFocus)
       return;
 
     nsAccessible* activeItem = target->CurrentItem();
     if (activeItem) {
       mActiveItem = activeItem;
       target = activeItem;
     }
@@ -285,18 +280,17 @@ FocusManager::ProcessFocusEvent(AccEvent
 
   // Emit focus event if event target is the active item. Otherwise then check
   // if it's still focused and then update active item and emit focus event.
   nsAccessible* target = aEvent->GetAccessible();
   if (target != mActiveItem) {
     // Check if still focused. Otherwise we can end up with storing the active
     // item for control that isn't focused anymore.
     nsAccessible* DOMFocus =
-      GetAccService()->GetAccessibleOrContainer(FocusedDOMNode(),
-	                                        aEvent->GetDocAccessible());
+      GetAccService()->GetAccessibleOrContainer(FocusedDOMNode(), nsnull);
     if (target != DOMFocus)
       return;
 
     nsAccessible* activeItem = target->CurrentItem();
     if (activeItem) {
       mActiveItem = activeItem;
       target = activeItem;
     }
@@ -342,17 +336,17 @@ FocusManager::ProcessFocusEvent(AccEvent
 
   nsRefPtr<AccEvent> focusEvent =
     new AccEvent(nsIAccessibleEvent::EVENT_FOCUS, target, fromUserInputFlag);
   nsEventShell::FireEvent(focusEvent);
 
   // Fire scrolling_start event when the document receives the focus if it has
   // an anchor jump. If an accessible within the document receive the focus
   // then null out the anchor jump because it no longer applies.
-  nsDocAccessible* targetDocument = target->Document();
+  nsDocAccessible* targetDocument = target->GetDocAccessible();
   nsAccessible* anchorJump = targetDocument->AnchorJump();
   if (anchorJump) {
     if (target == targetDocument) {
       // XXX: bug 625699, note in some cases the node could go away before we
       // we receive focus event, for example if the node is removed from DOM.
       nsEventShell::FireEvent(nsIAccessibleEvent::EVENT_SCROLLING_START,
                               anchorJump, fromUserInputFlag);
     }
--- a/accessible/src/base/NotificationController.cpp
+++ b/accessible/src/base/NotificationController.cpp
@@ -666,17 +666,17 @@ NotificationController::CoalesceTextChan
   aTailEvent->mTextChangeEvent.swap(aThisEvent->mTextChangeEvent);
 }
 
 void
 NotificationController::CreateTextChangeEventFor(AccMutationEvent* aEvent)
 {
   nsAccessible* container =
     GetAccService()->GetContainerAccessible(aEvent->mNode,
-                                            aEvent->GetDocAccessible());
+                                            aEvent->mAccessible->GetWeakShell());
   if (!container)
     return;
 
   nsHyperTextAccessible* textAccessible = container->AsHyperText();
   if (!textAccessible)
     return;
 
   // Don't fire event for the first html:br in an editor.
--- a/accessible/src/base/nsARIAGridAccessible.cpp
+++ b/accessible/src/base/nsARIAGridAccessible.cpp
@@ -52,18 +52,18 @@ using namespace mozilla::a11y;
 // nsARIAGridAccessible
 ////////////////////////////////////////////////////////////////////////////////
 
 
 ////////////////////////////////////////////////////////////////////////////////
 // Constructor
 
 nsARIAGridAccessible::
-  nsARIAGridAccessible(nsIContent* aContent, nsDocAccessible* aDoc) :
-  nsAccessibleWrap(aContent, aDoc)
+  nsARIAGridAccessible(nsIContent *aContent, nsIWeakReference *aShell) :
+  nsAccessibleWrap(aContent, aShell)
 {
 }
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsISupports
 
 NS_IMPL_ISUPPORTS_INHERITED1(nsARIAGridAccessible,
                              nsAccessible,
@@ -927,18 +927,18 @@ nsARIAGridAccessible::GetSelectedColumns
 // nsARIAGridCellAccessible
 ////////////////////////////////////////////////////////////////////////////////
 
 
 ////////////////////////////////////////////////////////////////////////////////
 // Constructor
 
 nsARIAGridCellAccessible::
-  nsARIAGridCellAccessible(nsIContent* aContent, nsDocAccessible* aDoc) :
-  nsHyperTextAccessibleWrap(aContent, aDoc)
+  nsARIAGridCellAccessible(nsIContent *aContent, nsIWeakReference *aShell) :
+  nsHyperTextAccessibleWrap(aContent, aShell)
 {
 }
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsISupports
 
 NS_IMPL_ISUPPORTS_INHERITED1(nsARIAGridCellAccessible,
                              nsHyperTextAccessible,
--- a/accessible/src/base/nsARIAGridAccessible.h
+++ b/accessible/src/base/nsARIAGridAccessible.h
@@ -45,17 +45,17 @@
 
 /**
  * Accessible for ARIA grid and treegrid.
  */
 class nsARIAGridAccessible : public nsAccessibleWrap,
                              public nsIAccessibleTable
 {
 public:
-  nsARIAGridAccessible(nsIContent* aContent, nsDocAccessible* aDoc);
+  nsARIAGridAccessible(nsIContent *aContent, nsIWeakReference *aShell);
 
   // nsISupports
   NS_DECL_ISUPPORTS_INHERITED
 
   // nsIAccessibleTable
   NS_DECL_NSIACCESSIBLETABLE
 
 protected:
@@ -105,17 +105,17 @@ protected:
 
 /**
  * Accessible for ARIA gridcell and rowheader/columnheader.
  */
 class nsARIAGridCellAccessible : public nsHyperTextAccessibleWrap,
                                  public nsIAccessibleTableCell
 {
 public:
-  nsARIAGridCellAccessible(nsIContent* aContent, nsDocAccessible* aDoc);
+  nsARIAGridCellAccessible(nsIContent *aContent, nsIWeakReference *aShell);
 
   // nsISupports
   NS_DECL_ISUPPORTS_INHERITED
 
   // nsIAccessibleTableCell
   NS_DECL_NSIACCESSIBLETABLECELL
 
   // nsAccessible
--- a/accessible/src/base/nsAccUtils.cpp
+++ b/accessible/src/base/nsAccUtils.cpp
@@ -348,21 +348,21 @@ nsAccUtils::GetARIAToken(dom::Element* a
   PRInt32 idx = aElement->FindAttrValueIn(kNameSpaceID_None,
                                           aAttr, tokens, eCaseMatters);
   if (idx >= 0)
     return *(tokens[idx]);
 
   return nsnull;
 }
 
-nsAccessible*
+nsAccessible *
 nsAccUtils::GetAncestorWithRole(nsAccessible *aDescendant, PRUint32 aRole)
 {
-  nsAccessible* document = aDescendant->Document();
-  nsAccessible* parent = aDescendant;
+  nsAccessible *document = aDescendant->GetDocAccessible();
+  nsAccessible *parent = aDescendant;
   while ((parent = parent->Parent())) {
     PRUint32 testRole = parent->Role();
     if (testRole == aRole)
       return parent;
 
     if (parent == document)
       break;
   }
@@ -420,22 +420,21 @@ nsAccUtils::GetTextAccessibleFromSelecti
     return nsnull;
 
   PRInt32 focusOffset = 0;
   aSelection->GetFocusOffset(&focusOffset);
 
   nsCOMPtr<nsINode> focusNode(do_QueryInterface(focusDOMNode));
   nsCOMPtr<nsINode> resultNode =
     nsCoreUtils::GetDOMNodeFromDOMPoint(focusNode, focusOffset);
+  nsCOMPtr<nsIWeakReference> weakShell(nsCoreUtils::GetWeakShellFor(resultNode));
 
   // Get text accessible containing the result node.
-  nsDocAccessible* doc = 
-    GetAccService()->GetDocAccessible(resultNode->OwnerDoc());
-  nsAccessible* accessible = doc ? 
-    doc->GetAccessibleOrContainer(resultNode) : nsnull;
+  nsAccessible* accessible =
+    GetAccService()->GetAccessibleOrContainer(resultNode, weakShell);
   if (!accessible) {
     NS_NOTREACHED("No nsIAccessibleText for selection change event!");
     return nsnull;
   }
 
   do {
     nsHyperTextAccessible* textAcc = accessible->AsHyperText();
     if (textAcc)
@@ -521,18 +520,19 @@ nsIntPoint
 nsAccUtils::GetScreenCoordsForWindow(nsAccessNode *aAccessNode)
 {
   return nsCoreUtils::GetScreenCoordsForWindow(aAccessNode->GetNode());
 }
 
 nsIntPoint
 nsAccUtils::GetScreenCoordsForParent(nsAccessNode *aAccessNode)
 {
-  nsDocAccessible* document = aAccessNode->Document();
-  nsAccessible* parent = document->GetContainerAccessible(aAccessNode->GetNode());
+  nsAccessible *parent =
+    GetAccService()->GetContainerAccessible(aAccessNode->GetNode(),
+                                            aAccessNode->GetWeakShell());
   if (!parent)
     return nsIntPoint(0, 0);
 
   nsIFrame *parentFrame = parent->GetFrame();
   if (!parentFrame)
     return nsIntPoint(0, 0);
 
   nsIntRect parentRect = parentFrame->GetScreenRectExternal();
--- a/accessible/src/base/nsAccUtils.h
+++ b/accessible/src/base/nsAccUtils.h
@@ -151,20 +151,21 @@ public:
   /**
    * Return atomic value of ARIA attribute of boolean or NMTOKEN type.
    */
   static nsIAtom* GetARIAToken(mozilla::dom::Element* aElement, nsIAtom* aAttr);
 
   /**
    * Return document accessible for the given presshell.
    */
-  static nsDocAccessible* GetDocAccessibleFor(const nsIPresShell* aPresShell)
+  static nsDocAccessible *GetDocAccessibleFor(nsIWeakReference *aWeakShell)
   {
-    return aPresShell ?
-      GetAccService()->GetDocAccessible(aPresShell->GetDocument()) : nsnull;
+    nsCOMPtr<nsIPresShell> presShell(do_QueryReferent(aWeakShell));
+    return presShell ?
+      GetAccService()->GetDocAccessible(presShell->GetDocument()) : nsnull;
   }
 
   /**
    * Return document accessible for the given DOM node.
    */
   static nsDocAccessible *GetDocAccessibleFor(nsINode *aNode)
   {
     nsIPresShell *presShell = nsCoreUtils::GetPresShellFor(aNode);
--- a/accessible/src/base/nsAccessNode.cpp
+++ b/accessible/src/base/nsAccessNode.cpp
@@ -84,35 +84,35 @@ NS_INTERFACE_MAP_END
  
 NS_IMPL_CYCLE_COLLECTING_ADDREF(nsAccessNode)
 NS_IMPL_CYCLE_COLLECTING_RELEASE_WITH_DESTROY(nsAccessNode, LastRelease())
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsAccessNode construction/desctruction
 
 nsAccessNode::
-  nsAccessNode(nsIContent* aContent, nsDocAccessible* aDoc) :
-  mContent(aContent), mDoc(aDoc)
+  nsAccessNode(nsIContent *aContent, nsIWeakReference *aShell) :
+  mContent(aContent), mWeakShell(aShell)
 {
 #ifdef DEBUG_A11Y
   mIsInitialized = false;
 #endif
 }
 
 nsAccessNode::~nsAccessNode()
 {
-  NS_ASSERTION(!mDoc, "LastRelease was never called!?!");
+  NS_ASSERTION(!mWeakShell, "LastRelease was never called!?!");
 }
 
 void nsAccessNode::LastRelease()
 {
   // First cleanup if needed...
-  if (mDoc) {
+  if (mWeakShell) {
     Shutdown();
-    NS_ASSERTION(!mDoc, "A Shutdown() impl forgot to call its parent's Shutdown?");
+    NS_ASSERTION(!mWeakShell, "A Shutdown() impl forgot to call its parent's Shutdown?");
   }
   // ... then die.
   delete this;
 }
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsAccessNode public
 
@@ -128,17 +128,17 @@ nsAccessNode::Init()
   return true;
 }
 
 
 void
 nsAccessNode::Shutdown()
 {
   mContent = nsnull;
-  mDoc = nsnull;
+  mWeakShell = nsnull;
 }
 
 nsApplicationAccessible*
 nsAccessNode::GetApplicationAccessible()
 {
   NS_ASSERTION(!nsAccessibilityService::IsShutdown(),
                "Accessibility wasn't initialized!");
 
@@ -210,25 +210,41 @@ void nsAccessNode::ShutdownXPAccessibili
   if (gApplicationAccessible) {
     gApplicationAccessible->Shutdown();
     NS_RELEASE(gApplicationAccessible);
   }
 
   NotifyA11yInitOrShutdown(false);
 }
 
+already_AddRefed<nsIPresShell>
+nsAccessNode::GetPresShell()
+{
+  nsIPresShell* presShell = nsnull;
+  if (mWeakShell)
+    CallQueryReferent(mWeakShell.get(), &presShell);
+
+  return presShell;
+}
+
 // nsAccessNode protected
 nsPresContext* nsAccessNode::GetPresContext()
 {
-  if (IsDefunct())
+  nsCOMPtr<nsIPresShell> presShell(GetPresShell());
+  if (!presShell) {
     return nsnull;
+  }
+  return presShell->GetPresContext();
+}
 
-  nsIPresShell* presShell(mDoc->PresShell());
-
-  return presShell ? presShell->GetPresContext() : nsnull;
+nsDocAccessible *
+nsAccessNode::GetDocAccessible() const
+{
+  return mContent ?
+    GetAccService()->GetDocAccessible(mContent->OwnerDoc()) : nsnull;
 }
 
 nsRootAccessible*
 nsAccessNode::RootAccessible() const
 {
   nsCOMPtr<nsIDocShellTreeItem> docShellTreeItem =
     nsCoreUtils::GetDocShellTreeItemFor(mContent);
   NS_ASSERTION(docShellTreeItem, "No docshell tree item for mContent");
@@ -260,17 +276,17 @@ nsAccessNode::IsPrimaryForNode() const
 
 ////////////////////////////////////////////////////////////////////////////////
 void
 nsAccessNode::ScrollTo(PRUint32 aScrollType)
 {
   if (IsDefunct())
     return;
 
-  nsIPresShell* shell = mDoc->PresShell();
+  nsCOMPtr<nsIPresShell> shell(GetPresShell());
   if (!shell)
     return;
 
   nsIFrame *frame = GetFrame();
   if (!frame)
     return;
 
   nsIContent* content = frame->GetContent();
@@ -284,17 +300,19 @@ nsAccessNode::ScrollTo(PRUint32 aScrollT
 }
 
 // nsAccessNode public
 already_AddRefed<nsINode>
 nsAccessNode::GetCurrentFocus()
 {
   // XXX: consider to use nsFocusManager directly, it allows us to avoid
   // unnecessary query interface calls.
-  nsIDocument* doc = GetDocumentNode();
+  nsCOMPtr<nsIPresShell> shell = GetPresShell();
+  NS_ENSURE_TRUE(shell, nsnull);
+  nsIDocument *doc = shell->GetDocument();
   NS_ENSURE_TRUE(doc, nsnull);
 
   nsIDOMWindow* win = doc->GetWindow();
 
   nsCOMPtr<nsIDOMWindow> focusedWindow;
   nsCOMPtr<nsIDOMElement> focusedElement;
   nsCOMPtr<nsIFocusManager> fm = do_GetService(FOCUSMANAGER_CONTRACTID);
   if (fm)
--- a/accessible/src/base/nsAccessNode.h
+++ b/accessible/src/base/nsAccessNode.h
@@ -66,34 +66,34 @@ class nsIDocShellTreeItem;
 
 #define ACCESSIBLE_BUNDLE_URL "chrome://global-platform/locale/accessible.properties"
 #define PLATFORM_KEYS_BUNDLE_URL "chrome://global-platform/locale/platformKeys.properties"
 
 class nsAccessNode: public nsISupports
 {
 public:
 
-  nsAccessNode(nsIContent* aContent, nsDocAccessible* aDoc);
+  nsAccessNode(nsIContent *aContent, nsIWeakReference *aShell);
   virtual ~nsAccessNode();
 
     NS_DECL_CYCLE_COLLECTING_ISUPPORTS
     NS_DECL_CYCLE_COLLECTION_CLASS(nsAccessNode)
 
     static void InitXPAccessibility();
     static void ShutdownXPAccessibility();
 
   /**
    * Return an application accessible.
    */
   static nsApplicationAccessible* GetApplicationAccessible();
 
   /**
    * Return the document accessible for this access node.
    */
-  nsDocAccessible* Document() const { return mDoc; }
+  nsDocAccessible *GetDocAccessible() const;
 
   /**
    * Return the root document accessible for this accessnode.
    */
   nsRootAccessible* RootAccessible() const;
 
   /**
    * Return focused node within accessible window.
@@ -143,16 +143,26 @@ public:
     return node && node->IsElement();
   }
   bool IsDocumentNode() const
   {
     return GetNode() && GetNode()->IsNodeOfType(nsINode::eDOCUMENT);
   }
 
   /**
+   * Return the corresponding press shell for this accessible.
+   */
+  already_AddRefed<nsIPresShell> GetPresShell();
+
+  /**
+   * Return presentation shell for the accessible.
+   */
+  nsIWeakReference* GetWeakShell() const { return mWeakShell; }
+
+  /**
    * Return the unique identifier of the accessible.
    */
   void* UniqueID() { return static_cast<void*>(this); }
 
   /**
    * Return true if the accessible is primary accessible for the given DOM node.
    *
    * Accessible hierarchy may be complex for single DOM node, in this case
@@ -174,17 +184,17 @@ public:
   void ScrollTo(PRUint32 aType);
 
 protected:
     nsPresContext* GetPresContext();
 
     void LastRelease();
 
   nsCOMPtr<nsIContent> mContent;
-  nsDocAccessible* mDoc;
+  nsCOMPtr<nsIWeakReference> mWeakShell;
 
     /**
      * Notify global nsIObserver's that a11y is getting init'd or shutdown
      */
     static void NotifyA11yInitOrShutdown(bool aIsInit);
 
     // Static data, we do our own refcounting for our static data
     static nsIStringBundle *gStringBundle;
--- a/accessible/src/base/nsAccessibilityService.cpp
+++ b/accessible/src/base/nsAccessibilityService.cpp
@@ -200,168 +200,154 @@ nsAccessibilityService::GetRootDocumentA
       }
 
       return aCanCreate ?
         GetDocAccessible(documentNode) : GetDocAccessibleFromCache(documentNode);
     }
   }
   return nsnull;
 }
- 
+
 already_AddRefed<nsAccessible>
 nsAccessibilityService::CreateOuterDocAccessible(nsIContent* aContent,
                                                  nsIPresShell* aPresShell)
 {
-  nsAccessible* accessible = 
-    new nsOuterDocAccessible(aContent, 
-                             nsAccUtils::GetDocAccessibleFor(aPresShell));
-  NS_ADDREF(accessible);
+  nsCOMPtr<nsIWeakReference> weakShell(do_GetWeakReference(aPresShell));
+  nsAccessible* accessible = new nsOuterDocAccessible(aContent, weakShell);
+  NS_IF_ADDREF(accessible);
   return accessible;
 }
 
 already_AddRefed<nsAccessible>
 nsAccessibilityService::CreateHTML4ButtonAccessible(nsIContent* aContent,
                                                     nsIPresShell* aPresShell)
 {
-  nsAccessible* accessible = 
-    new nsHTML4ButtonAccessible(aContent, 
-                                nsAccUtils::GetDocAccessibleFor(aPresShell));
-  NS_ADDREF(accessible);
+  nsCOMPtr<nsIWeakReference> weakShell(do_GetWeakReference(aPresShell));
+  nsAccessible* accessible = new nsHTML4ButtonAccessible(aContent, weakShell);
+  NS_IF_ADDREF(accessible);
   return accessible;
 }
 
 already_AddRefed<nsAccessible>
 nsAccessibilityService::CreateHTMLButtonAccessible(nsIContent* aContent,
                                                    nsIPresShell* aPresShell)
 {
-  nsAccessible* accessible = 
-    new nsHTMLButtonAccessible(aContent, 
-                               nsAccUtils::GetDocAccessibleFor(aPresShell));
-  NS_ADDREF(accessible);
+  nsCOMPtr<nsIWeakReference> weakShell(do_GetWeakReference(aPresShell));
+  nsAccessible* accessible = new nsHTMLButtonAccessible(aContent, weakShell);
+  NS_IF_ADDREF(accessible);
   return accessible;
 }
 
 already_AddRefed<nsAccessible>
 nsAccessibilityService::CreateHTMLLIAccessible(nsIContent* aContent,
                                                nsIPresShell* aPresShell)
 {
-  nsAccessible* accessible = 
-    new nsHTMLLIAccessible(aContent, 
-                           nsAccUtils::GetDocAccessibleFor(aPresShell));
-  NS_ADDREF(accessible);
+  nsCOMPtr<nsIWeakReference> weakShell(do_GetWeakReference(aPresShell));
+  nsAccessible* accessible = new nsHTMLLIAccessible(aContent, weakShell);
+  NS_IF_ADDREF(accessible);
   return accessible;
 }
 
 already_AddRefed<nsAccessible>
 nsAccessibilityService::CreateHyperTextAccessible(nsIContent* aContent,
                                                   nsIPresShell* aPresShell)
 {
-  nsAccessible* accessible = 
-    new nsHyperTextAccessibleWrap(aContent, 
-                                  nsAccUtils::GetDocAccessibleFor(aPresShell));
-  NS_ADDREF(accessible);
+  nsCOMPtr<nsIWeakReference> weakShell(do_GetWeakReference(aPresShell));
+  nsAccessible* accessible = new nsHyperTextAccessibleWrap(aContent, weakShell);
+  NS_IF_ADDREF(accessible);
   return accessible;
 }
 
 already_AddRefed<nsAccessible>
 nsAccessibilityService::CreateHTMLCheckboxAccessible(nsIContent* aContent,
                                                      nsIPresShell* aPresShell)
 {
-  nsAccessible* accessible = 
-    new nsHTMLCheckboxAccessible(aContent, 
-                                 nsAccUtils::GetDocAccessibleFor(aPresShell));
-  NS_ADDREF(accessible);
+  nsCOMPtr<nsIWeakReference> weakShell(do_GetWeakReference(aPresShell));
+  nsAccessible* accessible = new nsHTMLCheckboxAccessible(aContent, weakShell);
+  NS_IF_ADDREF(accessible);
   return accessible;
 }
 
 already_AddRefed<nsAccessible>
 nsAccessibilityService::CreateHTMLComboboxAccessible(nsIContent* aContent,
                                                      nsIPresShell* aPresShell)
 {
-  nsAccessible* accessible = 
-    new nsHTMLComboboxAccessible(aContent, 
-                                 nsAccUtils::GetDocAccessibleFor(aPresShell));
-  NS_ADDREF(accessible);
+  nsCOMPtr<nsIWeakReference> weakShell(do_GetWeakReference(aPresShell));
+  nsAccessible* accessible = new nsHTMLComboboxAccessible(aContent, weakShell);
+  NS_IF_ADDREF(accessible);
   return accessible;
 }
 
 already_AddRefed<nsAccessible>
 nsAccessibilityService::CreateHTMLCanvasAccessible(nsIContent* aContent,
                                                    nsIPresShell* aPresShell)
 {
-  nsAccessible* accessible = 
-    new nsHTMLCanvasAccessible(aContent, 
-                               nsAccUtils::GetDocAccessibleFor(aPresShell));
-  NS_ADDREF(accessible);
+  nsCOMPtr<nsIWeakReference> weakShell(do_GetWeakReference(aPresShell));
+  nsAccessible* accessible = new nsHTMLCanvasAccessible(aContent, weakShell);
+  NS_IF_ADDREF(accessible);
   return accessible;
 }
 
 already_AddRefed<nsAccessible>
 nsAccessibilityService::CreateHTMLFileInputAccessible(nsIContent* aContent,
                                                       nsIPresShell* aPresShell)
 {
-  nsAccessible* accessible = 
-    new nsHTMLFileInputAccessible(aContent, 
-                                  nsAccUtils::GetDocAccessibleFor(aPresShell));
-  NS_ADDREF(accessible);
+  nsCOMPtr<nsIWeakReference> weakShell(do_GetWeakReference(aPresShell));
+  nsAccessible* accessible = new nsHTMLFileInputAccessible(aContent, weakShell);
+  NS_IF_ADDREF(accessible);
   return accessible;
 }
 
 already_AddRefed<nsAccessible>
 nsAccessibilityService::CreateHTMLImageAccessible(nsIContent* aContent,
                                                   nsIPresShell* aPresShell)
 {
   nsAutoString mapElmName;
   aContent->GetAttr(kNameSpaceID_None, nsGkAtoms::usemap, mapElmName);
   nsCOMPtr<nsIDOMHTMLMapElement> mapElm;
   if (nsIDocument* document = aContent->GetCurrentDoc()) {
     mapElm = do_QueryInterface(document->FindImageMap(mapElmName));
   }
 
+  nsCOMPtr<nsIWeakReference> weakShell(do_GetWeakReference(aPresShell));
   nsAccessible* accessible = mapElm ?
-    new nsHTMLImageMapAccessible(aContent, 
-                                 nsAccUtils::GetDocAccessibleFor(aPresShell), 
-                                 mapElm) :
-    new nsHTMLImageAccessibleWrap(aContent, 
-                                  nsAccUtils::GetDocAccessibleFor(aPresShell));
-  NS_ADDREF(accessible);
+    new nsHTMLImageMapAccessible(aContent, weakShell, mapElm) :
+    new nsHTMLImageAccessibleWrap(aContent, weakShell);
+  NS_IF_ADDREF(accessible);
   return accessible;
 }
 
 already_AddRefed<nsAccessible>
 nsAccessibilityService::CreateHTMLGroupboxAccessible(nsIContent* aContent,
                                                      nsIPresShell* aPresShell)
 {
-  nsAccessible* accessible = 
-    new nsHTMLGroupboxAccessible(aContent, 
-                                 nsAccUtils::GetDocAccessibleFor(aPresShell));
-  NS_ADDREF(accessible);
+  nsCOMPtr<nsIWeakReference> weakShell(do_GetWeakReference(aPresShell));
+  nsAccessible* accessible = new nsHTMLGroupboxAccessible(aContent, weakShell);
+  NS_IF_ADDREF(accessible);
   return accessible;
 }
 
 already_AddRefed<nsAccessible>
 nsAccessibilityService::CreateHTMLListboxAccessible(nsIContent* aContent,
                                                     nsIPresShell* aPresShell)
 {
-  nsAccessible* accessible = 
-    new nsHTMLSelectListAccessible(aContent, 
-                                   nsAccUtils::GetDocAccessibleFor(aPresShell));
-  NS_ADDREF(accessible);
+  nsCOMPtr<nsIWeakReference> weakShell(do_GetWeakReference(aPresShell));
+  nsAccessible* accessible = new nsHTMLSelectListAccessible(aContent, weakShell);
+  NS_IF_ADDREF(accessible);
   return accessible;
 }
 
 already_AddRefed<nsAccessible>
 nsAccessibilityService::CreateHTMLMediaAccessible(nsIContent* aContent,
                                                   nsIPresShell* aPresShell)
 {
-  nsAccessible* accessible = 
-    new nsEnumRoleAccessible(aContent, 
-                             nsAccUtils::GetDocAccessibleFor(aPresShell),
-                             roles::GROUPING);
-  NS_ADDREF(accessible);
+  nsCOMPtr<nsIWeakReference> weakShell(do_GetWeakReference(aPresShell));
+  nsAccessible* accessible = new nsEnumRoleAccessible(aContent, weakShell,
+                                                      roles::GROUPING);
+  NS_IF_ADDREF(accessible);
   return accessible;
 }
 
 already_AddRefed<nsAccessible>
 nsAccessibilityService::CreateHTMLObjectFrameAccessible(nsObjectFrame* aFrame,
                                                         nsIContent* aContent,
                                                         nsIPresShell* aPresShell)
 {
@@ -371,16 +357,17 @@ nsAccessibilityService::CreateHTMLObject
   // 2) web content that uses a plugin, which means we will have to go to
   //    the plugin to get the accessible content;
   // 3) an image or imagemap, where the image frame points back to the object
   //    element DOMNode.
 
   if (aFrame->GetRect().IsEmpty())
     return nsnull;
 
+  nsCOMPtr<nsIWeakReference> weakShell(do_GetWeakReference(aPresShell));
 
   // 1) for object elements containing either HTML or TXT documents
   nsCOMPtr<nsIDOMHTMLObjectElement> obj(do_QueryInterface(aContent));
   if (obj) {
     nsCOMPtr<nsIDOMDocument> domDoc;
     obj->GetContentDocument(getter_AddRefs(domDoc));
     if (domDoc)
       return CreateOuterDocAccessible(aContent, aPresShell);
@@ -391,145 +378,134 @@ nsAccessibilityService::CreateHTMLObject
   nsRefPtr<nsNPAPIPluginInstance> pluginInstance;
   if (NS_SUCCEEDED(aFrame->GetPluginInstance(getter_AddRefs(pluginInstance))) &&
       pluginInstance) {
 #ifdef XP_WIN
     // Note: pluginPort will be null if windowless.
     HWND pluginPort = nsnull;
     aFrame->GetPluginPort(&pluginPort);
 
-    nsAccessible* accessible = 
-      new nsHTMLWin32ObjectOwnerAccessible(aContent,
-                                           nsAccUtils::GetDocAccessibleFor(aPresShell),
-                                           pluginPort);
-    NS_ADDREF(accessible);
+    nsAccessible* accessible = new nsHTMLWin32ObjectOwnerAccessible(aContent,
+                                                                    weakShell,
+                                                                    pluginPort);
+    NS_IF_ADDREF(accessible);
     return accessible;
 
 #elif MOZ_ACCESSIBILITY_ATK
     if (!AtkSocketAccessible::gCanEmbed)
       return nsnull;
 
     nsCString plugId;
     nsresult rv = pluginInstance->GetValueFromPlugin(
       NPPVpluginNativeAccessibleAtkPlugId, &plugId);
     if (NS_SUCCEEDED(rv) && !plugId.IsEmpty()) {
       AtkSocketAccessible* socketAccessible =
-        new AtkSocketAccessible(aContent, 
-                                nsAccUtils::GetDocAccessibleFor(aPresShell), 
-                                plugId);
+        new AtkSocketAccessible(aContent, weakShell, plugId);
 
-      NS_ADDREF(socketAccessible);
+      NS_IF_ADDREF(socketAccessible);
       return socketAccessible;
     }
 #endif
   }
 #endif
 
   // 3) for images and imagemaps, or anything else with a child frame
   // we have the object frame, get the image frame
   nsIFrame* frame = aFrame->GetFirstPrincipalChild();
   return frame ? frame->CreateAccessible() : nsnull;
 }
 
 already_AddRefed<nsAccessible>
 nsAccessibilityService::CreateHTMLRadioButtonAccessible(nsIContent* aContent,
                                                         nsIPresShell* aPresShell)
 {
-  nsAccessible* accessible = 
-    new nsHTMLRadioButtonAccessible(aContent, 
-                                    nsAccUtils::GetDocAccessibleFor(aPresShell));
-  NS_ADDREF(accessible);
+  nsCOMPtr<nsIWeakReference> weakShell(do_GetWeakReference(aPresShell));
+  nsAccessible* accessible = new nsHTMLRadioButtonAccessible(aContent, weakShell);
+  NS_IF_ADDREF(accessible);
   return accessible;
 }
 
 already_AddRefed<nsAccessible>
 nsAccessibilityService::CreateHTMLTableAccessible(nsIContent* aContent,
                                                   nsIPresShell* aPresShell)
 {
-  nsAccessible* accessible = 
-    new nsHTMLTableAccessibleWrap(aContent, 
-                                  nsAccUtils::GetDocAccessibleFor(aPresShell));
-  NS_ADDREF(accessible);
+  nsCOMPtr<nsIWeakReference> weakShell(do_GetWeakReference(aPresShell));
+  nsAccessible* accessible = new nsHTMLTableAccessibleWrap(aContent, weakShell);
+  NS_IF_ADDREF(accessible);
   return accessible;
 }
 
 already_AddRefed<nsAccessible>
 nsAccessibilityService::CreateHTMLTableCellAccessible(nsIContent* aContent,
                                                       nsIPresShell* aPresShell)
 {
-  nsAccessible* accessible = 
-    new nsHTMLTableCellAccessibleWrap(aContent,
-                                      nsAccUtils::GetDocAccessibleFor(aPresShell));
-  NS_ADDREF(accessible);
+  nsCOMPtr<nsIWeakReference> weakShell(do_GetWeakReference(aPresShell));
+  nsAccessible* accessible = new nsHTMLTableCellAccessibleWrap(aContent,
+                                                               weakShell);
+  NS_IF_ADDREF(accessible);
   return accessible;
 }
 
 already_AddRefed<nsAccessible>
 nsAccessibilityService::CreateHTMLTextAccessible(nsIContent* aContent,
                                                  nsIPresShell* aPresShell)
 {
-  nsAccessible* accessible = 
-    new nsHTMLTextAccessible(aContent, 
-                             nsAccUtils::GetDocAccessibleFor(aPresShell));
-  NS_ADDREF(accessible);
+  nsCOMPtr<nsIWeakReference> weakShell(do_GetWeakReference(aPresShell));
+  nsAccessible* accessible = new nsHTMLTextAccessible(aContent, weakShell);
+  NS_IF_ADDREF(accessible);
   return accessible;
 }
 
 already_AddRefed<nsAccessible>
 nsAccessibilityService::CreateHTMLTextFieldAccessible(nsIContent* aContent,
                                                       nsIPresShell* aPresShell)
 {
-  nsAccessible* accessible = 
-    new nsHTMLTextFieldAccessible(aContent, 
-                                  nsAccUtils::GetDocAccessibleFor(aPresShell));
-  NS_ADDREF(accessible);
+  nsCOMPtr<nsIWeakReference> weakShell(do_GetWeakReference(aPresShell));
+  nsAccessible* accessible = new nsHTMLTextFieldAccessible(aContent, weakShell);
+  NS_IF_ADDREF(accessible);
   return accessible;
 }
 
 already_AddRefed<nsAccessible>
 nsAccessibilityService::CreateHTMLLabelAccessible(nsIContent* aContent,
                                                   nsIPresShell* aPresShell)
 {
-  nsAccessible* accessible = 
-    new nsHTMLLabelAccessible(aContent, 
-                              nsAccUtils::GetDocAccessibleFor(aPresShell));
-  NS_ADDREF(accessible);
+  nsCOMPtr<nsIWeakReference> weakShell(do_GetWeakReference(aPresShell));
+  nsAccessible* accessible = new nsHTMLLabelAccessible(aContent, weakShell);
+  NS_IF_ADDREF(accessible);
   return accessible;
 }
 
 already_AddRefed<nsAccessible>
 nsAccessibilityService::CreateHTMLHRAccessible(nsIContent* aContent,
                                                nsIPresShell* aPresShell)
 {
-  nsAccessible* accessible = 
-    new nsHTMLHRAccessible(aContent, 
-                           nsAccUtils::GetDocAccessibleFor(aPresShell));
-  NS_ADDREF(accessible);
+  nsCOMPtr<nsIWeakReference> weakShell(do_GetWeakReference(aPresShell));
+  nsAccessible* accessible = new nsHTMLHRAccessible(aContent, weakShell);
+  NS_IF_ADDREF(accessible);
   return accessible;
 }
 
 already_AddRefed<nsAccessible>
 nsAccessibilityService::CreateHTMLBRAccessible(nsIContent* aContent,
                                                nsIPresShell* aPresShell)
 {
-  nsAccessible* accessible = 
-    new nsHTMLBRAccessible(aContent, 
-                           nsAccUtils::GetDocAccessibleFor(aPresShell));
-  NS_ADDREF(accessible);
+  nsCOMPtr<nsIWeakReference> weakShell(do_GetWeakReference(aPresShell));
+  nsAccessible* accessible = new nsHTMLBRAccessible(aContent, weakShell);
+  NS_IF_ADDREF(accessible);
   return accessible;
 }
 
 already_AddRefed<nsAccessible>
 nsAccessibilityService::CreateHTMLCaptionAccessible(nsIContent* aContent,
                                                     nsIPresShell* aPresShell)
 {
-  nsAccessible* accessible = 
-    new nsHTMLCaptionAccessible(aContent, 
-                                nsAccUtils::GetDocAccessibleFor(aPresShell));
-  NS_ADDREF(accessible);
+  nsCOMPtr<nsIWeakReference> weakShell(do_GetWeakReference(aPresShell));
+  nsAccessible* accessible = new nsHTMLCaptionAccessible(aContent, weakShell);
+  NS_IF_ADDREF(accessible);
   return accessible;
 }
 
 void
 nsAccessibilityService::ContentRangeInserted(nsIPresShell* aPresShell,
                                              nsIContent* aContainer,
                                              nsIContent* aStartChild,
                                              nsIContent* aEndChild)
@@ -926,24 +902,25 @@ nsAccessibilityService::GetAccessible(ns
 {
   NS_PRECONDITION(aNode, "Getting an accessible for null node! Crash.");
 
   nsDocAccessible* document = GetDocAccessible(aNode->OwnerDoc());
   return document ? document->GetAccessible(aNode) : nsnull;
 }
 
 nsAccessible*
-nsAccessibilityService::GetAccessibleOrContainer(nsINode* aNode, nsDocAccessible* aDoc)
+nsAccessibilityService::GetAccessibleOrContainer(nsINode* aNode,
+                                                 nsIWeakReference* aWeakShell)
 {
   if (!aNode)
     return nsnull;
 
-  NS_PRECONDITION(aDoc, "Must pass a document accessible.");
-
-  return aDoc ? aDoc->GetAccessibleOrContainer(aNode) : nsnull;
+  // XXX: weak shell is ignored until multiple shell documents are supported.
+  nsDocAccessible* document = GetDocAccessible(aNode->OwnerDoc());
+  return document ? document->GetAccessibleOrContainer(aNode) : nsnull;
 }
 
 static bool HasRelatedContent(nsIContent *aContent)
 {
   nsAutoString id;
   if (!aContent || !nsCoreUtils::GetID(aContent, id) || id.IsEmpty()) {
     return false;
   }
@@ -1075,17 +1052,17 @@ nsAccessibilityService::GetOrCreateAcces
     if (nsLayoutUtils::GetAllInFlowRectsUnion(weakFrame,
                                               weakFrame->GetParent()).IsEmpty()) {
       if (aIsSubtreeHidden)
         *aIsSubtreeHidden = true;
 
       return nsnull;
     }
 
-    newAcc = new nsHyperTextAccessibleWrap(content, docAcc);
+    newAcc = new nsHyperTextAccessibleWrap(content, aWeakShell);
     if (docAcc->BindToDocument(newAcc, nsAccUtils::GetRoleMapEntry(aNode)))
       return newAcc;
     return nsnull;
   }
 
   nsRoleMapEntry *roleMapEntry = nsAccUtils::GetRoleMapEntry(aNode);
   if (roleMapEntry && !nsCRT::strcmp(roleMapEntry->roleString, "presentation")) {
     // Ignore presentation role if element is focusable (focus event shouldn't
@@ -1169,34 +1146,34 @@ nsAccessibilityService::GetOrCreateAcces
     if (roleMapEntry) {
       // Create ARIA grid/treegrid accessibles if node is not of a child or
       // valid child of HTML table and is not a HTML table.
       if ((!partOfHTMLTable || !tryTagNameOrFrame) &&
           frameType != nsGkAtoms::tableOuterFrame) {
 
         if (roleMapEntry->role == roles::TABLE ||
             roleMapEntry->role == roles::TREE_TABLE) {
-          newAcc = new nsARIAGridAccessibleWrap(content, docAcc);
+          newAcc = new nsARIAGridAccessibleWrap(content, aWeakShell);
 
         } else if (roleMapEntry->role == roles::GRID_CELL ||
             roleMapEntry->role == roles::ROWHEADER ||
             roleMapEntry->role == roles::COLUMNHEADER) {
-          newAcc = new nsARIAGridCellAccessibleWrap(content, docAcc);
+          newAcc = new nsARIAGridCellAccessibleWrap(content, aWeakShell);
         }
       }
     }
 
     if (!newAcc && tryTagNameOrFrame) {
       // Prefer to use markup (mostly tag name, perhaps attributes) to
       // decide if and what kind of accessible to create.
       // The method creates accessibles for table related content too therefore
       // we do not call it if accessibles for table related content are
       // prevented above.
       newAcc = CreateHTMLAccessibleByMarkup(weakFrame.GetFrame(), content,
-                                            docAcc);
+                                            aWeakShell);
 
       if (!newAcc) {
         // Do not create accessible object subtrees for non-rendered table
         // captions. This could not be done in
         // nsTableCaptionFrame::GetAccessible() because the descendants of
         // the table caption would still be created. By setting
         // *aIsSubtreeHidden = true we ensure that no descendant accessibles
         // are created.
@@ -1218,55 +1195,55 @@ nsAccessibilityService::GetOrCreateAcces
         newAcc = f->CreateAccessible();
       }
     }
   }
 
   if (!newAcc) {
     // Elements may implement nsIAccessibleProvider via XBL. This allows them to
     // say what kind of accessible to create.
-    newAcc = CreateAccessibleByType(content, docAcc);
+    newAcc = CreateAccessibleByType(content, aWeakShell);
   }
 
   if (!newAcc) {
     // Create generic accessibles for SVG and MathML nodes.
     if (content->IsSVG(nsGkAtoms::svg)) {
-      newAcc = new nsEnumRoleAccessible(content, docAcc,
+      newAcc = new nsEnumRoleAccessible(content, aWeakShell,
                                         roles::DIAGRAM);
     }
     else if (content->IsMathML(nsGkAtoms::math)) {
-      newAcc = new nsEnumRoleAccessible(content, docAcc,
+      newAcc = new nsEnumRoleAccessible(content, aWeakShell,
                                         roles::EQUATION);
     }
   }
 
   if (!newAcc) {
     newAcc = CreateAccessibleForDeckChild(weakFrame.GetFrame(), content,
-                                          docAcc);
+                                          aWeakShell);
   }
 
   // If no accessible, see if we need to create a generic accessible because
   // of some property that makes this object interesting
   // We don't do this for <body>, <html>, <window>, <dialog> etc. which 
   // correspond to the doc accessible and will be created in any case
   if (!newAcc && content->Tag() != nsGkAtoms::body && content->GetParent() && 
       ((weakFrame.GetFrame() && weakFrame.GetFrame()->IsFocusable()) ||
        (isHTML && nsCoreUtils::HasClickListener(content)) ||
        HasUniversalAriaProperty(content) || roleMapEntry ||
        HasRelatedContent(content) || nsCoreUtils::IsXLink(content))) {
     // This content is focusable or has an interesting dynamic content accessibility property.
     // If it's interesting we need it in the accessibility hierarchy so that events or
     // other accessibles can point to it, or so that it can hold a state, etc.
     if (isHTML) {
       // Interesting HTML container which may have selectable text and/or embedded objects
-      newAcc = new nsHyperTextAccessibleWrap(content, docAcc);
+      newAcc = new nsHyperTextAccessibleWrap(content, aWeakShell);
     }
     else {  // XUL, SVG, MathML etc.
       // Interesting generic non-HTML container
-      newAcc = new nsAccessibleWrap(content, docAcc);
+      newAcc = new nsAccessibleWrap(content, aWeakShell);
     }
   }
 
   return docAcc->BindToDocument(newAcc, roleMapEntry) ? newAcc : nsnull;
 }
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsAccessibilityService private
@@ -1337,413 +1314,415 @@ nsAccessibilityService::HasUniversalAria
          aContent->HasAttr(kNameSpaceID_None, nsGkAtoms::aria_labelledby) ||
          nsAccUtils::HasDefinedARIAToken(aContent, nsGkAtoms::aria_live) ||
          nsAccUtils::HasDefinedARIAToken(aContent, nsGkAtoms::aria_owns) ||
          nsAccUtils::HasDefinedARIAToken(aContent, nsGkAtoms::aria_relevant);
 }
 
 already_AddRefed<nsAccessible>
 nsAccessibilityService::CreateAccessibleByType(nsIContent* aContent,
-                                               nsDocAccessible* aDoc)
+                                               nsIWeakReference* aWeakShell)
 {
   nsCOMPtr<nsIAccessibleProvider> accessibleProvider(do_QueryInterface(aContent));
   if (!accessibleProvider)
     return nsnull;
 
   PRInt32 type;
   nsresult rv = accessibleProvider->GetAccessibleType(&type);
   if (NS_FAILED(rv))
     return nsnull;
 
   if (type == nsIAccessibleProvider::OuterDoc) {
-    nsAccessible* accessible = new nsOuterDocAccessible(aContent, aDoc);
+    nsAccessible* accessible = new nsOuterDocAccessible(aContent, aWeakShell);
     NS_IF_ADDREF(accessible);
     return accessible;
   }
 
   nsAccessible* accessible = nsnull;
   switch (type)
   {
 #ifdef MOZ_XUL
     case nsIAccessibleProvider::NoAccessible:
       return nsnull;
 
     // XUL controls
     case nsIAccessibleProvider::XULAlert:
-      accessible = new nsXULAlertAccessible(aContent, aDoc);
+      accessible = new nsXULAlertAccessible(aContent, aWeakShell);
       break;
 
     case nsIAccessibleProvider::XULButton:
-      accessible = new nsXULButtonAccessible(aContent, aDoc);
+      accessible = new nsXULButtonAccessible(aContent, aWeakShell);
       break;
 
     case nsIAccessibleProvider::XULCheckbox:
-      accessible = new nsXULCheckboxAccessible(aContent, aDoc);
+      accessible = new nsXULCheckboxAccessible(aContent, aWeakShell);
       break;
 
     case nsIAccessibleProvider::XULColorPicker:
-      accessible = new nsXULColorPickerAccessible(aContent, aDoc);
+      accessible = new nsXULColorPickerAccessible(aContent, aWeakShell);
       break;
 
     case nsIAccessibleProvider::XULColorPickerTile:
-      accessible = new nsXULColorPickerTileAccessible(aContent, aDoc);
+      accessible = new nsXULColorPickerTileAccessible(aContent, aWeakShell);
       break;
 
     case nsIAccessibleProvider::XULCombobox:
-      accessible = new nsXULComboboxAccessible(aContent, aDoc);
+      accessible = new nsXULComboboxAccessible(aContent, aWeakShell);
       break;
 
     case nsIAccessibleProvider::XULDropmarker:
-      accessible = new nsXULDropmarkerAccessible(aContent, aDoc);
+      accessible = new nsXULDropmarkerAccessible(aContent, aWeakShell);
       break;
 
     case nsIAccessibleProvider::XULGroupbox:
-      accessible = new nsXULGroupboxAccessible(aContent, aDoc);
+      accessible = new nsXULGroupboxAccessible(aContent, aWeakShell);
       break;
 
     case nsIAccessibleProvider::XULImage:
     {
       // Don't include nameless images in accessible tree.
       if (!aContent->HasAttr(kNameSpaceID_None,
                              nsGkAtoms::tooltiptext))
         return nsnull;
 
-      accessible = new nsHTMLImageAccessibleWrap(aContent, aDoc);
+      accessible = new nsHTMLImageAccessibleWrap(aContent, aWeakShell);
       break;
 
     }
     case nsIAccessibleProvider::XULLink:
-      accessible = new nsXULLinkAccessible(aContent, aDoc);
+      accessible = new nsXULLinkAccessible(aContent, aWeakShell);
       break;
 
     case nsIAccessibleProvider::XULListbox:
-      accessible = new nsXULListboxAccessibleWrap(aContent, aDoc);
+      accessible = new nsXULListboxAccessibleWrap(aContent, aWeakShell);
       break;
 
     case nsIAccessibleProvider::XULListCell:
-      accessible = new nsXULListCellAccessibleWrap(aContent, aDoc);
+      accessible = new nsXULListCellAccessibleWrap(aContent, aWeakShell);
       break;
 
     case nsIAccessibleProvider::XULListHead:
-      accessible = new nsXULColumnsAccessible(aContent, aDoc);
+      accessible = new nsXULColumnsAccessible(aContent, aWeakShell);
       break;
 
     case nsIAccessibleProvider::XULListHeader:
-      accessible = new nsXULColumnItemAccessible(aContent, aDoc);
+      accessible = new nsXULColumnItemAccessible(aContent, aWeakShell);
       break;
 
     case nsIAccessibleProvider::XULListitem:
-      accessible = new nsXULListitemAccessible(aContent, aDoc);
+      accessible = new nsXULListitemAccessible(aContent, aWeakShell);
       break;
 
     case nsIAccessibleProvider::XULMenubar:
-      accessible = new nsXULMenubarAccessible(aContent, aDoc);
+      accessible = new nsXULMenubarAccessible(aContent, aWeakShell);
       break;
 
     case nsIAccessibleProvider::XULMenuitem:
-      accessible = new nsXULMenuitemAccessibleWrap(aContent, aDoc);
+      accessible = new nsXULMenuitemAccessibleWrap(aContent, aWeakShell);
       break;
 
     case nsIAccessibleProvider::XULMenupopup:
     {
 #ifdef MOZ_ACCESSIBILITY_ATK
       // ATK considers this node to be redundant when within menubars, and it makes menu
       // navigation with assistive technologies more difficult
       // XXX In the future we will should this for consistency across the nsIAccessible
       // implementations on each platform for a consistent scripting environment, but
       // then strip out redundant accessibles in the nsAccessibleWrap class for each platform.
       nsIContent *parent = aContent->GetParent();
       if (parent && parent->NodeInfo()->Equals(nsGkAtoms::menu,
                                                kNameSpaceID_XUL))
         return nsnull;
 #endif
-      accessible = new nsXULMenupopupAccessible(aContent, aDoc);
+      accessible = new nsXULMenupopupAccessible(aContent, aWeakShell);
       break;
 
     }
     case nsIAccessibleProvider::XULMenuSeparator:
-      accessible = new nsXULMenuSeparatorAccessible(aContent, aDoc);
+      accessible = new nsXULMenuSeparatorAccessible(aContent, aWeakShell);
       break;
 
     case nsIAccessibleProvider::XULPane:
-      accessible = new nsEnumRoleAccessible(aContent, aDoc,
+      accessible = new nsEnumRoleAccessible(aContent, aWeakShell,
                                             roles::PANE);
       break;
 
     case nsIAccessibleProvider::XULProgressMeter:
-      accessible = new XULProgressMeterAccessible(aContent, aDoc);
+      accessible = new XULProgressMeterAccessible(aContent, aWeakShell);
       break;
 
     case nsIAccessibleProvider::XULStatusBar:
-      accessible = new nsXULStatusBarAccessible(aContent, aDoc);
+      accessible = new nsXULStatusBarAccessible(aContent, aWeakShell);
       break;
 
     case nsIAccessibleProvider::XULScale:
-      accessible = new nsXULSliderAccessible(aContent, aDoc);
+      accessible = new nsXULSliderAccessible(aContent, aWeakShell);
       break;
 
     case nsIAccessibleProvider::XULRadioButton:
-      accessible = new nsXULRadioButtonAccessible(aContent, aDoc);
+      accessible = new nsXULRadioButtonAccessible(aContent, aWeakShell);
       break;
 
     case nsIAccessibleProvider::XULRadioGroup:
-      accessible = new nsXULRadioGroupAccessible(aContent, aDoc);
+      accessible = new nsXULRadioGroupAccessible(aContent, aWeakShell);
       break;
 
     case nsIAccessibleProvider::XULTab:
-      accessible = new nsXULTabAccessible(aContent, aDoc);
+      accessible = new nsXULTabAccessible(aContent, aWeakShell);
       break;
 
     case nsIAccessibleProvider::XULTabs:
-      accessible = new nsXULTabsAccessible(aContent, aDoc);
+      accessible = new nsXULTabsAccessible(aContent, aWeakShell);
       break;
 
     case nsIAccessibleProvider::XULTabpanels:
-      accessible = new nsXULTabpanelsAccessible(aContent, aDoc);
+      accessible = new nsXULTabpanelsAccessible(aContent, aWeakShell);
       break;
 
     case nsIAccessibleProvider::XULText:
-      accessible = new nsXULTextAccessible(aContent, aDoc);
+      accessible = new nsXULTextAccessible(aContent, aWeakShell);
       break;
 
     case nsIAccessibleProvider::XULTextBox:
-      accessible = new nsXULTextFieldAccessible(aContent, aDoc);
+      accessible = new nsXULTextFieldAccessible(aContent, aWeakShell);
       break;
 
     case nsIAccessibleProvider::XULThumb:
-      accessible = new nsXULThumbAccessible(aContent, aDoc);
+      accessible = new nsXULThumbAccessible(aContent, aWeakShell);
       break;
 
     case nsIAccessibleProvider::XULTree:
-      return CreateAccessibleForXULTree(aContent, aDoc);
+      return CreateAccessibleForXULTree(aContent, aWeakShell);
 
     case nsIAccessibleProvider::XULTreeColumns:
-      accessible = new nsXULTreeColumnsAccessible(aContent, aDoc);
+      accessible = new nsXULTreeColumnsAccessible(aContent, aWeakShell);
       break;
 
     case nsIAccessibleProvider::XULTreeColumnItem:
-      accessible = new nsXULColumnItemAccessible(aContent, aDoc);
+      accessible = new nsXULColumnItemAccessible(aContent, aWeakShell);
       break;
 
     case nsIAccessibleProvider::XULToolbar:
-      accessible = new nsXULToolbarAccessible(aContent, aDoc);
+      accessible = new nsXULToolbarAccessible(aContent, aWeakShell);
       break;
 
     case nsIAccessibleProvider::XULToolbarSeparator:
-      accessible = new nsXULToolbarSeparatorAccessible(aContent, aDoc);
+      accessible = new nsXULToolbarSeparatorAccessible(aContent, aWeakShell);
       break;
 
     case nsIAccessibleProvider::XULTooltip:
-      accessible = new nsXULTooltipAccessible(aContent, aDoc);
+      accessible = new nsXULTooltipAccessible(aContent, aWeakShell);
       break;
 
     case nsIAccessibleProvider::XULToolbarButton:
-      accessible = new nsXULToolbarButtonAccessible(aContent, aDoc);
+      accessible = new nsXULToolbarButtonAccessible(aContent, aWeakShell);
       break;
 
 #endif // MOZ_XUL
 
     // XForms elements
     case nsIAccessibleProvider::XFormsContainer:
-      accessible = new nsXFormsContainerAccessible(aContent, aDoc);
+      accessible = new nsXFormsContainerAccessible(aContent, aWeakShell);
       break;
 
     case nsIAccessibleProvider::XFormsLabel:
-      accessible = new nsXFormsLabelAccessible(aContent, aDoc);
+      accessible = new nsXFormsLabelAccessible(aContent, aWeakShell);
       break;
 
     case nsIAccessibleProvider::XFormsOutput:
-      accessible = new nsXFormsOutputAccessible(aContent, aDoc);
+      accessible = new nsXFormsOutputAccessible(aContent, aWeakShell);
       break;
 
     case nsIAccessibleProvider::XFormsTrigger:
-      accessible = new nsXFormsTriggerAccessible(aContent, aDoc);
+      accessible = new nsXFormsTriggerAccessible(aContent, aWeakShell);
       break;
 
     case nsIAccessibleProvider::XFormsInput:
-      accessible = new nsXFormsInputAccessible(aContent, aDoc);
+      accessible = new nsXFormsInputAccessible(aContent, aWeakShell);
       break;
 
     case nsIAccessibleProvider::XFormsInputBoolean:
-      accessible = new nsXFormsInputBooleanAccessible(aContent, aDoc);
+      accessible = new nsXFormsInputBooleanAccessible(aContent, aWeakShell);
       break;
 
     case nsIAccessibleProvider::XFormsInputDate:
-      accessible = new nsXFormsInputDateAccessible(aContent, aDoc);
+      accessible = new nsXFormsInputDateAccessible(aContent, aWeakShell);
       break;
 
     case nsIAccessibleProvider::XFormsSecret:
-      accessible = new nsXFormsSecretAccessible(aContent, aDoc);
+      accessible = new nsXFormsSecretAccessible(aContent, aWeakShell);
       break;
 
     case nsIAccessibleProvider::XFormsSliderRange:
-      accessible = new nsXFormsRangeAccessible(aContent, aDoc);
+      accessible = new nsXFormsRangeAccessible(aContent, aWeakShell);
       break;
 
     case nsIAccessibleProvider::XFormsSelect:
-      accessible = new nsXFormsSelectAccessible(aContent, aDoc);
+      accessible = new nsXFormsSelectAccessible(aContent, aWeakShell);
       break;
 
     case nsIAccessibleProvider::XFormsChoices:
-      accessible = new nsXFormsChoicesAccessible(aContent, aDoc);
+      accessible = new nsXFormsChoicesAccessible(aContent, aWeakShell);
       break;
 
     case nsIAccessibleProvider::XFormsSelectFull:
-      accessible = new nsXFormsSelectFullAccessible(aContent, aDoc);
+      accessible = new nsXFormsSelectFullAccessible(aContent, aWeakShell);
       break;
 
     case nsIAccessibleProvider::XFormsItemCheckgroup:
-      accessible = new nsXFormsItemCheckgroupAccessible(aContent, aDoc);
+      accessible = new nsXFormsItemCheckgroupAccessible(aContent, aWeakShell);
       break;
 
     case nsIAccessibleProvider::XFormsItemRadiogroup:
-      accessible = new nsXFormsItemRadiogroupAccessible(aContent, aDoc);
+      accessible = new nsXFormsItemRadiogroupAccessible(aContent, aWeakShell);
       break;
 
     case nsIAccessibleProvider::XFormsSelectCombobox:
-      accessible = new nsXFormsSelectComboboxAccessible(aContent, aDoc);
+      accessible = new nsXFormsSelectComboboxAccessible(aContent, aWeakShell);
       break;
 
     case nsIAccessibleProvider::XFormsItemCombobox:
-      accessible = new nsXFormsItemComboboxAccessible(aContent, aDoc);
+      accessible = new nsXFormsItemComboboxAccessible(aContent, aWeakShell);
       break;
 
     case nsIAccessibleProvider::XFormsDropmarkerWidget:
-      accessible = new nsXFormsDropmarkerWidgetAccessible(aContent, aDoc);
+      accessible = new nsXFormsDropmarkerWidgetAccessible(aContent, aWeakShell);
       break;
 
     case nsIAccessibleProvider::XFormsCalendarWidget:
-      accessible = new nsXFormsCalendarWidgetAccessible(aContent, aDoc);
+      accessible = new nsXFormsCalendarWidgetAccessible(aContent, aWeakShell);
       break;
 
     case nsIAccessibleProvider::XFormsComboboxPopupWidget:
-      accessible = new nsXFormsComboboxPopupWidgetAccessible(aContent, aDoc);
+      accessible = new nsXFormsComboboxPopupWidgetAccessible(aContent, aWeakShell);
       break;
 
     default:
       return nsnull;
   }
 
   NS_IF_ADDREF(accessible);
   return accessible;
 }
 
 already_AddRefed<nsAccessible>
 nsAccessibilityService::CreateHTMLAccessibleByMarkup(nsIFrame* aFrame,
                                                      nsIContent* aContent,
-                                                     nsDocAccessible* aDoc)
+                                                     nsIWeakReference* aWeakShell)
 {
   // This method assumes we're in an HTML namespace.
   nsIAtom* tag = aContent->Tag();
   if (tag == nsGkAtoms::figcaption) {
     nsAccessible* accessible =
-      new nsHTMLFigcaptionAccessible(aContent, aDoc);
+      new nsHTMLFigcaptionAccessible(aContent, aWeakShell);
     NS_IF_ADDREF(accessible);
     return accessible;
   }
 
   if (tag == nsGkAtoms::figure) {
-    nsAccessible* accessible = new nsHTMLFigureAccessible(aContent, aDoc);
+    nsAccessible* accessible = new nsHTMLFigureAccessible(aContent, aWeakShell);
     NS_IF_ADDREF(accessible);
     return accessible;
   }
 
   if (tag == nsGkAtoms::legend) {
-    nsAccessible* accessible = new nsHTMLLegendAccessible(aContent, aDoc);
+    nsAccessible* accessible = new nsHTMLLegendAccessible(aContent, aWeakShell);
     NS_IF_ADDREF(accessible);
     return accessible;
   }
 
   if (tag == nsGkAtoms::option) {
-    nsAccessible* accessible = new nsHTMLSelectOptionAccessible(aContent, aDoc);
+    nsAccessible* accessible = new nsHTMLSelectOptionAccessible(aContent,
+                                                                aWeakShell);
     NS_IF_ADDREF(accessible);
     return accessible;
   }
 
   if (tag == nsGkAtoms::optgroup) {
     nsAccessible* accessible = new nsHTMLSelectOptGroupAccessible(aContent,
-                                                                  aDoc);
+                                                                  aWeakShell);
     NS_IF_ADDREF(accessible);
     return accessible;
   }
 
   if (tag == nsGkAtoms::ul || tag == nsGkAtoms::ol ||
       tag == nsGkAtoms::dl) {
-    nsAccessible* accessible = new nsHTMLListAccessible(aContent, aDoc);
+    nsAccessible* accessible = new nsHTMLListAccessible(aContent, aWeakShell);
     NS_IF_ADDREF(accessible);
     return accessible;
   }
 
   if (tag == nsGkAtoms::a) {
     // Only some roles truly enjoy life as nsHTMLLinkAccessibles, for details
     // see closed bug 494807.
     nsRoleMapEntry *roleMapEntry = nsAccUtils::GetRoleMapEntry(aContent);
     if (roleMapEntry && roleMapEntry->role != roles::NOTHING &&
         roleMapEntry->role != roles::LINK) {
-      nsAccessible* accessible = new nsHyperTextAccessibleWrap(aContent, aDoc);
+      nsAccessible* accessible = new nsHyperTextAccessibleWrap(aContent,
+                                                               aWeakShell);
       NS_IF_ADDREF(accessible);
       return accessible;
     }
 
-    nsAccessible* accessible = new nsHTMLLinkAccessible(aContent, aDoc);
+    nsAccessible* accessible = new nsHTMLLinkAccessible(aContent, aWeakShell);
     NS_IF_ADDREF(accessible);
     return accessible;
   }
 
   if (tag == nsGkAtoms::dt ||
       (tag == nsGkAtoms::li &&
        aFrame->GetType() != nsGkAtoms::blockFrame)) {
     // Normally for li, it is created by the list item frame (in nsBlockFrame)
     // which knows about the bullet frame; however, in this case the list item
     // must have been styled using display: foo
-    nsAccessible* accessible = new nsHTMLLIAccessible(aContent, aDoc);
+    nsAccessible* accessible = new nsHTMLLIAccessible(aContent, aWeakShell);
     NS_IF_ADDREF(accessible);
     return accessible;
   }
 
   if (tag == nsGkAtoms::abbr ||
       tag == nsGkAtoms::acronym ||
       tag == nsGkAtoms::blockquote ||
       tag == nsGkAtoms::dd ||
       tag == nsGkAtoms::form ||
       tag == nsGkAtoms::h1 ||
       tag == nsGkAtoms::h2 ||
       tag == nsGkAtoms::h3 ||
       tag == nsGkAtoms::h4 ||
       tag == nsGkAtoms::h5 ||
       tag == nsGkAtoms::h6 ||
       tag == nsGkAtoms::q) {
-    nsAccessible* accessible = new nsHyperTextAccessibleWrap(aContent, aDoc);
+    nsAccessible* accessible = new nsHyperTextAccessibleWrap(aContent, aWeakShell);
     NS_IF_ADDREF(accessible);
     return accessible;
   }
 
   if (tag == nsGkAtoms::tr) {
-    nsAccessible* accessible = new nsEnumRoleAccessible(aContent, aDoc,
+    nsAccessible* accessible = new nsEnumRoleAccessible(aContent, aWeakShell,
                                                         roles::ROW);
     NS_IF_ADDREF(accessible);
     return accessible;
   }
 
   if (nsCoreUtils::IsHTMLTableHeader(aContent)) {
     nsAccessible* accessible = new nsHTMLTableHeaderCellAccessibleWrap(aContent,
-                                                                       aDoc);
+                                                                       aWeakShell);
     NS_IF_ADDREF(accessible);
     return accessible;
   }
 
   if (tag == nsGkAtoms::output) {
-    nsAccessible* accessible = new nsHTMLOutputAccessible(aContent, aDoc);
+    nsAccessible* accessible = new nsHTMLOutputAccessible(aContent, aWeakShell);
     NS_IF_ADDREF(accessible);
     return accessible;
   }
 
   if (tag == nsGkAtoms::progress) {
     nsAccessible* accessible =
-      new HTMLProgressMeterAccessible(aContent, aDoc);
+      new HTMLProgressMeterAccessible(aContent, aWeakShell);
     NS_IF_ADDREF(accessible);
     return accessible;
   }
 
   return nsnull;
  }
 
 ////////////////////////////////////////////////////////////////////////////////
@@ -1817,70 +1796,71 @@ NS_GetAccessibilityService(nsIAccessibil
 }
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsAccessibilityService private (DON'T put methods here)
 
 already_AddRefed<nsAccessible>
 nsAccessibilityService::CreateAccessibleForDeckChild(nsIFrame* aFrame,
                                                      nsIContent* aContent,
-                                                     nsDocAccessible* aDoc)
+                                                     nsIWeakReference* aWeakShell)
 {
   if (aFrame->GetType() == nsGkAtoms::boxFrame ||
       aFrame->GetType() == nsGkAtoms::scrollFrame) {
 
     nsIFrame* parentFrame = aFrame->GetParent();
     if (parentFrame && parentFrame->GetType() == nsGkAtoms::deckFrame) {
       // If deck frame is for xul:tabpanels element then the given node has
       // tabpanel accessible.
       nsCOMPtr<nsIContent> parentContent = parentFrame->GetContent();
 #ifdef MOZ_XUL
       if (parentContent->NodeInfo()->Equals(nsGkAtoms::tabpanels,
                                             kNameSpaceID_XUL)) {
-        nsAccessible* accessible = new nsXULTabpanelAccessible(aContent, aDoc);
+        nsAccessible* accessible = new nsXULTabpanelAccessible(aContent,
+                                                               aWeakShell);
         NS_IF_ADDREF(accessible);
         return accessible;
       }
 #endif
-      nsAccessible* accessible = new nsEnumRoleAccessible(aContent, aDoc,
+      nsAccessible* accessible = new nsEnumRoleAccessible(aContent, aWeakShell,
                                                           roles::PROPERTYPAGE);
       NS_IF_ADDREF(accessible);
       return accessible;
     }
   }
 
   return nsnull;
 }
 
 #ifdef MOZ_XUL
 already_AddRefed<nsAccessible>
 nsAccessibilityService::CreateAccessibleForXULTree(nsIContent* aContent,
-                                                   nsDocAccessible* aDoc)
+                                                   nsIWeakReference* aWeakShell)
 {
   nsCOMPtr<nsITreeBoxObject> treeBoxObj = nsCoreUtils::GetTreeBoxObject(aContent);
   if (!treeBoxObj)
     return nsnull;
 
   nsCOMPtr<nsITreeColumns> treeColumns;
   treeBoxObj->GetColumns(getter_AddRefs(treeColumns));
   if (!treeColumns)
     return nsnull;
 
   PRInt32 count = 0;
   treeColumns->GetCount(&count);
 
   // Outline of list accessible.
   if (count == 1) {
-    nsAccessible* accessible = new nsXULTreeAccessible(aContent, aDoc);
+    nsAccessible* accessible = new nsXULTreeAccessible(aContent, aWeakShell);
     NS_IF_ADDREF(accessible);
     return accessible;
   }
 
   // Table or tree table accessible.
-  nsAccessible* accessible = new nsXULTreeGridAccessibleWrap(aContent, aDoc);
+  nsAccessible* accessible = new nsXULTreeGridAccessibleWrap(aContent, aWeakShell);
   NS_IF_ADDREF(accessible);
   return accessible;
 }
 #endif
 
 ////////////////////////////////////////////////////////////////////////////////
 // Services
 ////////////////////////////////////////////////////////////////////////////////
--- a/accessible/src/base/nsAccessibilityService.h
+++ b/accessible/src/base/nsAccessibilityService.h
@@ -211,29 +211,28 @@ public:
   {
     // XXX: weak shell is ignored until multiple shell documents are supported.
     return GetAccessible(aNode);
   }
 
   /**
    * Return an accessible for the given DOM node or container accessible if
    * the node is not accessible.
-   *
-   * @param aNode [in] the given node
-   * @param aDoc  [in] the document accessible. Can't be null.
    */
-  nsAccessible* GetAccessibleOrContainer(nsINode* aNode, nsDocAccessible* aDoc);
+  nsAccessible* GetAccessibleOrContainer(nsINode* aNode,
+                                         nsIWeakReference* aWeakShell);
 
   /**
    * Return a container accessible for the given DOM node.
    */
-  nsAccessible* GetContainerAccessible(nsINode* aNode, nsDocAccessible* aDoc)
+  inline nsAccessible* GetContainerAccessible(nsINode* aNode,
+                                              nsIWeakReference* aWeakShell)
   {
     return aNode ?
-      GetAccessibleOrContainer(aNode->GetNodeParent(), aDoc) : nsnull;
+      GetAccessibleOrContainer(aNode->GetNodeParent(), aWeakShell) : nsnull;
   }
 
 private:
   // nsAccessibilityService creation is controlled by friend
   // NS_GetAccessibilityService, keep constructors private.
   nsAccessibilityService();
   nsAccessibilityService(const nsAccessibilityService&);
   nsAccessibilityService& operator =(const nsAccessibilityService&);
@@ -249,38 +248,38 @@ private:
    */
   void Shutdown();
 
   /**
    * Create accessible for the element implementing nsIAccessibleProvider
    * interface.
    */
   already_AddRefed<nsAccessible>
-    CreateAccessibleByType(nsIContent* aContent, nsDocAccessible* aDoc);
+    CreateAccessibleByType(nsIContent* aContent, nsIWeakReference* aWeakShell);
 
   /**
    * Create accessible for HTML node by tag name.
    */
   already_AddRefed<nsAccessible>
     CreateHTMLAccessibleByMarkup(nsIFrame* aFrame, nsIContent* aContent,
-                                 nsDocAccessible* aDoc);
+                                 nsIWeakReference* aWeakShell);
 
   /**
    * Create accessible if parent is a deck frame.
    */
   already_AddRefed<nsAccessible>
     CreateAccessibleForDeckChild(nsIFrame* aFrame, nsIContent* aContent,
-                                 nsDocAccessible* aDoc);
+                                 nsIWeakReference* aWeakShell);
 
 #ifdef MOZ_XUL
   /**
    * Create accessible for XUL tree element.
    */
   already_AddRefed<nsAccessible>
-    CreateAccessibleForXULTree(nsIContent* aContent, nsDocAccessible* aDoc);
+    CreateAccessibleForXULTree(nsIContent* aContent, nsIWeakReference* aWeakShell);
 #endif
 
   /**
    * Reference for accessibility service instance.
    */
   static nsAccessibilityService* gAccessibilityService;
 
   /**
--- a/accessible/src/base/nsAccessible.cpp
+++ b/accessible/src/base/nsAccessible.cpp
@@ -188,18 +188,18 @@ nsresult nsAccessible::QueryInterface(RE
       return NS_OK;
     }
     return NS_ERROR_NO_INTERFACE;
   }
 
   return nsAccessNodeWrap::QueryInterface(aIID, aInstancePtr);
 }
 
-nsAccessible::nsAccessible(nsIContent* aContent, nsDocAccessible* aDoc) :
-  nsAccessNodeWrap(aContent, aDoc),
+nsAccessible::nsAccessible(nsIContent *aContent, nsIWeakReference *aShell) :
+  nsAccessNodeWrap(aContent, aShell),
   mParent(nsnull), mIndexInParent(-1), mFlags(eChildrenUninitialized),
   mIndexOfEmbeddedChild(-1), mRoleMapEntry(nsnull)
 {
 #ifdef NS_DEBUG_X
    {
      nsCOMPtr<nsIPresShell> shell(do_QueryReferent(aShell));
      printf(">>> %p Created Acc - DOM: %p  PS: %p", 
             (void*)static_cast<nsIAccessible*>(this), (void*)aNode,
@@ -268,17 +268,17 @@ nsAccessible::GetComputedStyleCSSValue(c
   return CallQueryInterface(cssValue, aCSSValue);
 }
 
 NS_IMETHODIMP
 nsAccessible::GetDocument(nsIAccessibleDocument **aDocument)
 {
   NS_ENSURE_ARG_POINTER(aDocument);
 
-  NS_IF_ADDREF(*aDocument = Document());
+  NS_IF_ADDREF(*aDocument = GetDocAccessible());
   return NS_OK;
 }
 
 NS_IMETHODIMP
 nsAccessible::GetDOMNode(nsIDOMNode **aDOMNode)
 {
   NS_ENSURE_ARG_POINTER(aDOMNode);
   *aDOMNode = nsnull;
@@ -395,17 +395,17 @@ nsAccessible::Description(nsString& aDes
   nsTextEquivUtils::
     GetTextEquivFromIDRefs(this, nsGkAtoms::aria_describedby,
                            aDescription);
 
   if (aDescription.IsEmpty()) {
     bool isXUL = mContent->IsXUL();
     if (isXUL) {
       // Try XUL <description control="[id]">description text</description>
-      XULDescriptionIterator iter(Document(), mContent);
+      XULDescriptionIterator iter(GetDocAccessible(), mContent);
       nsAccessible* descr = nsnull;
       while ((descr = iter.Next()))
         nsTextEquivUtils::AppendTextEquivFromContent(this, descr->GetContent(),
                                                      &aDescription);
       }
 
       if (aDescription.IsEmpty()) {
         nsIAtom *descAtom = isXUL ? nsGkAtoms::tooltiptext :
@@ -441,22 +441,22 @@ nsAccessible::AccessKey() const
   PRUint32 key = nsCoreUtils::GetAccessKeyFor(mContent);
   if (!key && mContent->IsElement()) {
     nsAccessible* label = nsnull;
 
     // Copy access key from label node.
     if (mContent->IsHTML()) {
       // Unless it is labeled via an ancestor <label>, in which case that would
       // be redundant.
-      HTMLLabelIterator iter(Document(), this,
+      HTMLLabelIterator iter(GetDocAccessible(), this,
                              HTMLLabelIterator::eSkipAncestorLabel);
       label = iter.Next();
 
     } else if (mContent->IsXUL()) {
-      XULLabelIterator iter(Document(), mContent);
+      XULLabelIterator iter(GetDocAccessible(), mContent);
       label = iter.Next();
     }
 
     if (label)
       key = nsCoreUtils::GetAccessKeyFor(label->GetContent());
   }
 
   if (!key)
@@ -681,17 +681,17 @@ PRUint64
 nsAccessible::VisibilityState()
 {
   PRUint64 vstates = states::INVISIBLE | states::OFFSCREEN;
 
   nsIFrame* frame = GetFrame();
   if (!frame)
     return vstates;
 
-  nsIPresShell* shell(mDoc->PresShell());
+  const nsCOMPtr<nsIPresShell> shell(GetPresShell());
   if (!shell)
     return vstates;
 
   // We need to know if at least a kMinPixels around the object is visible,
   // otherwise it will be marked states::OFFSCREEN.
   const PRUint16 kMinPixels  = 12;
   const nsSize frameSize = frame->GetSize();
   const nsRectVisibility rectVisibility =
@@ -724,17 +724,17 @@ nsAccessible::VisibilityState()
   return vstates &= ~states::INVISIBLE;
 }
 
 PRUint64
 nsAccessible::NativeState()
 {
   PRUint64 state = 0;
 
-  nsDocAccessible* document = Document();
+  nsDocAccessible* document = GetDocAccessible();
   if (!document || !document->IsInDocument(this))
     state |= states::STALE;
 
   bool disabled = false;
   if (mContent->IsElement()) {
     nsEventStates elementState = mContent->AsElement()->State();
 
     if (elementState.HasState(NS_EVENT_STATE_INVALID))
@@ -826,17 +826,17 @@ nsAccessible::ChildAtPoint(PRInt32 aX, P
     return fallbackAnswer;
 
   // Search an accessible at the given point starting from accessible document
   // because containing block (see CSS2) for out of flow element (for example,
   // absolutely positioned element) may be different from its DOM parent and
   // therefore accessible for containing block may be different from accessible
   // for DOM parent but GetFrameForPoint() should be called for containing block
   // to get an out of flow element.
-  nsDocAccessible* accDocument = Document();
+  nsDocAccessible *accDocument = GetDocAccessible();
   NS_ENSURE_TRUE(accDocument, nsnull);
 
   nsIFrame *frame = accDocument->GetFrame();
   NS_ENSURE_TRUE(frame, nsnull);
 
   nsPresContext *presContext = frame->PresContext();
 
   nsIntRect screenRect = frame->GetScreenRectExternal();
@@ -848,17 +848,17 @@ nsAccessible::ChildAtPoint(PRInt32 aX, P
 
   nsIContent* content = nsnull;
   if (!foundFrame || !(content = foundFrame->GetContent()))
     return fallbackAnswer;
 
   // Get accessible for the node with the point or the first accessible in
   // the DOM parent chain.
   nsAccessible* accessible =
-    GetAccService()->GetAccessibleOrContainer(content, accDocument);
+   GetAccService()->GetAccessibleOrContainer(content, mWeakShell);
   if (!accessible)
     return fallbackAnswer;
 
   if (accessible == this) {
     // Manually walk through accessible children and see if the are within this
     // point. Skip offscreen or invisible accessibles. This takes care of cases
     // where layout won't walk into things for us, such as image map areas and
     // sub documents (XXX: subdocuments should be handled by methods of
@@ -1035,17 +1035,17 @@ nsAccessible::GetBounds(PRInt32* aX, PRI
   NS_ENSURE_ARG_POINTER(aWidth);
   *aWidth = 0;
   NS_ENSURE_ARG_POINTER(aHeight);
   *aHeight = 0;
 
   if (IsDefunct())
     return NS_ERROR_FAILURE;
 
-  nsIPresShell* presShell = mDoc->PresShell();
+  nsCOMPtr<nsIPresShell> presShell = GetPresShell();
 
   // This routine will get the entire rectangle for all the frames in this node.
   // -------------------------------------------------------------------------
   //      Primary Frame for node
   //  Another frame, same node                <- Example
   //  Another frame, same node
 
   nsRect unionRectTwips;
@@ -1155,17 +1155,17 @@ nsAccessible::TakeFocus()
 }
 
 nsresult
 nsAccessible::GetHTMLName(nsAString& aLabel)
 {
   nsAutoString label;
 
   nsAccessible* labelAcc = nsnull;
-  HTMLLabelIterator iter(Document(), this);
+  HTMLLabelIterator iter(GetDocAccessible(), this);
   while ((labelAcc = iter.Next())) {
     nsresult rv = nsTextEquivUtils::
       AppendTextEquivFromContent(this, labelAcc->GetContent(), &label);
     NS_ENSURE_SUCCESS(rv, rv);
 
     label.CompressWhitespace();
   }
 
@@ -1217,17 +1217,17 @@ nsAccessible::GetXULName(nsAString& aLab
     }
   }
 
   // CASES #2 and #3 ------ label as a child or <label control="id" ... > </label>
   if (NS_FAILED(rv) || label.IsEmpty()) {
     label.Truncate();
 
     nsAccessible* labelAcc = nsnull;
-    XULLabelIterator iter(Document(), mContent);
+    XULLabelIterator iter(GetDocAccessible(), mContent);
     while ((labelAcc = iter.Next())) {
       nsCOMPtr<nsIDOMXULLabelElement> xulLabel =
         do_QueryInterface(labelAcc->GetContent());
       // Check if label's value attribute is used
       if (xulLabel && NS_SUCCEEDED(xulLabel->GetValue(label)) && label.IsEmpty()) {
         // If no value attribute, a non-empty label must contain
         // children that define its text -- possibly using HTML
         nsTextEquivUtils::
@@ -1738,17 +1738,17 @@ nsAccessible::GetValue(nsAString& aValue
     }
   }
 
   if (!aValue.IsEmpty())
     return NS_OK;
 
   // Check if it's a simple xlink.
   if (nsCoreUtils::IsXLink(mContent)) {
-    nsIPresShell* presShell = mDoc->PresShell();
+    nsCOMPtr<nsIPresShell> presShell(do_QueryReferent(mWeakShell));
     if (presShell) {
       nsCOMPtr<nsIDOMNode> DOMNode(do_QueryInterface(mContent));
       return presShell->GetLinkLocation(DOMNode, aValue);
     }
   }
 
   return NS_OK;
 }
@@ -2053,66 +2053,66 @@ nsAccessible::GetRelationByType(PRUint32
 
 Relation
 nsAccessible::RelationByType(PRUint32 aType)
 {
   // Relationships are defined on the same content node that the role would be
   // defined on.
   switch (aType) {
     case nsIAccessibleRelation::RELATION_LABEL_FOR: {
-      Relation rel(new RelatedAccIterator(Document(), mContent,
+      Relation rel(new RelatedAccIterator(GetDocAccessible(), mContent,
                                           nsGkAtoms::aria_labelledby));
       if (mContent->Tag() == nsGkAtoms::label)
         rel.AppendIter(new IDRefsIterator(mContent, mContent->IsHTML() ?
                                           nsGkAtoms::_for :
                                           nsGkAtoms::control));
 
       return rel;
     }
     case nsIAccessibleRelation::RELATION_LABELLED_BY: {
       Relation rel(new IDRefsIterator(mContent,
                                       nsGkAtoms::aria_labelledby));
       if (mContent->IsHTML()) {
-        rel.AppendIter(new HTMLLabelIterator(Document(), this));
+        rel.AppendIter(new HTMLLabelIterator(GetDocAccessible(), this));
       } else if (mContent->IsXUL()) {
-        rel.AppendIter(new XULLabelIterator(Document(), mContent));
+        rel.AppendIter(new XULLabelIterator(GetDocAccessible(), mContent));
       }
 
       return rel;
     }
     case nsIAccessibleRelation::RELATION_DESCRIBED_BY: {
       Relation rel(new IDRefsIterator(mContent,
                                         nsGkAtoms::aria_describedby));
       if (mContent->IsXUL())
-        rel.AppendIter(new XULDescriptionIterator(Document(), mContent));
+        rel.AppendIter(new XULDescriptionIterator(GetDocAccessible(), mContent));
 
       return rel;
     }
     case nsIAccessibleRelation::RELATION_DESCRIPTION_FOR: {
-      Relation rel(new RelatedAccIterator(Document(), mContent,
-                                          nsGkAtoms::aria_describedby));
+      Relation rel(new RelatedAccIterator(GetDocAccessible(), mContent,
+                                            nsGkAtoms::aria_describedby));
 
       // This affectively adds an optional control attribute to xul:description,
       // which only affects accessibility, by allowing the description to be
       // tied to a control.
       if (mContent->Tag() == nsGkAtoms::description &&
           mContent->IsXUL())
         rel.AppendIter(new IDRefsIterator(mContent,
                                           nsGkAtoms::control));
 
       return rel;
     }
     case nsIAccessibleRelation::RELATION_NODE_CHILD_OF: {
-      Relation rel(new RelatedAccIterator(Document(), mContent,
-                                          nsGkAtoms::aria_owns));
+      Relation rel(new RelatedAccIterator(GetDocAccessible(), mContent,
+                                            nsGkAtoms::aria_owns));
       
       // This is an ARIA tree or treegrid that doesn't use owns, so we need to
       // get the parent the hard way.
       if (mRoleMapEntry && (mRoleMapEntry->role == roles::OUTLINEITEM || 
-                            mRoleMapEntry->role == roles::ROW)) {
+	  mRoleMapEntry->role == roles::ROW)) {
         AccGroupInfo* groupInfo = GetGroupInfo();
         if (!groupInfo)
           return rel;
 
         rel.AppendTarget(groupInfo->ConceptualParent());
       }
 
       // If accessible is in its own Window, or is the root of a document,
@@ -2129,29 +2129,29 @@ nsAccessible::RelationByType(PRUint32 aT
           if (scrollFrame || view->GetWidget() || !frame->GetParent())
             rel.AppendTarget(Parent());
         }
       }
 
       return rel;
     }
     case nsIAccessibleRelation::RELATION_CONTROLLED_BY:
-      return Relation(new RelatedAccIterator(Document(), mContent,
+      return Relation(new RelatedAccIterator(GetDocAccessible(), mContent,
                                              nsGkAtoms::aria_controls));
     case nsIAccessibleRelation::RELATION_CONTROLLER_FOR: {
       Relation rel(new IDRefsIterator(mContent,
                                       nsGkAtoms::aria_controls));
-      rel.AppendIter(new HTMLOutputIterator(Document(), mContent));
+      rel.AppendIter(new HTMLOutputIterator(GetDocAccessible(), mContent));
       return rel;
     }
     case nsIAccessibleRelation::RELATION_FLOWS_TO:
       return Relation(new IDRefsIterator(mContent,
                                          nsGkAtoms::aria_flowto));
     case nsIAccessibleRelation::RELATION_FLOWS_FROM:
-      return Relation(new RelatedAccIterator(Document(), mContent,
+      return Relation(new RelatedAccIterator(GetDocAccessible(), mContent,
                                              nsGkAtoms::aria_flowto));
     case nsIAccessibleRelation::RELATION_DEFAULT_BUTTON: {
       if (mContent->IsHTML()) {
         // HTML form controls implements nsIFormControl interface.
         nsCOMPtr<nsIFormControl> control(do_QueryInterface(mContent));
         if (control) {
           nsCOMPtr<nsIForm> form(do_QueryInterface(control->GetFormElement()));
           if (form) {
@@ -2268,17 +2268,17 @@ nsAccessible::DoCommand(nsIContent *aCon
 }
 
 void
 nsAccessible::DispatchClickEvent(nsIContent *aContent, PRUint32 aActionIndex)
 {
   if (IsDefunct())
     return;
 
-  nsIPresShell* presShell = mDoc->PresShell();
+  nsCOMPtr<nsIPresShell> presShell = GetPresShell();
 
   // Scroll into view.
   presShell->ScrollContentIntoView(aContent, NS_PRESSHELL_SCROLL_ANYWHERE,
                                    NS_PRESSHELL_SCROLL_ANYWHERE,
                                    nsIPresShell::SCROLL_OVERFLOW_HIDDEN);
 
   // Fire mouse down and mouse up events.
   bool res = nsCoreUtils::DispatchMouseEvent(NS_MOUSE_BUTTON_DOWN, presShell,
@@ -3028,17 +3028,17 @@ nsAccessible::CurrentItem()
   // checks whether pointed node is actually a DOM descendant of the element
   // with the aria-activedescendant attribute.
   nsAutoString id;
   if (mContent->GetAttr(kNameSpaceID_None,
                         nsGkAtoms::aria_activedescendant, id)) {
     nsIDocument* DOMDoc = mContent->OwnerDoc();
     dom::Element* activeDescendantElm = DOMDoc->GetElementById(id);
     if (activeDescendantElm) {
-      nsDocAccessible* document = Document();
+      nsDocAccessible* document = GetDocAccessible();
       if (document)
         return document->GetAccessible(activeDescendantElm);
     }
   }
   return nsnull;
 }
 
 void
@@ -3074,20 +3074,17 @@ nsAccessible::ContainerWidget() const
 }
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsAccessible protected methods
 
 void
 nsAccessible::CacheChildren()
 {
-  nsDocAccessible* doc = Document();
-  NS_ENSURE_TRUE(doc,);
-
-  nsAccTreeWalker walker(doc->GetWeakShell(), mContent, GetAllowsAnonChildAccessibles());
+  nsAccTreeWalker walker(mWeakShell, mContent, GetAllowsAnonChildAccessibles());
 
   nsAccessible* child = nsnull;
   while ((child = walker.NextChild()) && AppendChild(child));
 }
 
 void
 nsAccessible::TestChildCache(nsAccessible* aCachedChild) const
 {
@@ -3150,17 +3147,18 @@ nsAccessible::GetSiblingAtOffset(PRInt32
     *aError = NS_ERROR_UNEXPECTED;
 
   return child;
 }
 
 nsAccessible *
 nsAccessible::GetFirstAvailableAccessible(nsINode *aStartNode) const
 {
-  nsAccessible* accessible = mDoc->GetAccessible(aStartNode);
+  nsAccessible* accessible =
+    GetAccService()->GetAccessibleInWeakShell(aStartNode, mWeakShell);
   if (accessible)
     return accessible;
 
   nsCOMPtr<nsIDOMDocument> domDoc = do_QueryInterface(aStartNode->OwnerDoc());
   NS_ENSURE_TRUE(domDoc, nsnull);
 
   nsCOMPtr<nsIDOMNode> currentNode = do_QueryInterface(aStartNode);
   nsCOMPtr<nsIDOMNode> rootNode = do_QueryInterface(GetNode());
@@ -3172,17 +3170,18 @@ nsAccessible::GetFirstAvailableAccessibl
 
   walker->SetCurrentNode(currentNode);
   while (true) {
     walker->NextNode(getter_AddRefs(currentNode));
     if (!currentNode)
       return nsnull;
 
     nsCOMPtr<nsINode> node(do_QueryInterface(currentNode));
-    nsAccessible* accessible = mDoc->GetAccessible(node);
+    nsAccessible* accessible =
+      GetAccService()->GetAccessibleInWeakShell(node, mWeakShell);
     if (accessible)
       return accessible;
   }
 
   return nsnull;
 }
 
 nsresult
--- a/accessible/src/base/nsAccessible.h
+++ b/accessible/src/base/nsAccessible.h
@@ -99,17 +99,17 @@ NS_ERROR_GENERATE_SUCCESS(NS_ERROR_MODUL
 
 class nsAccessible : public nsAccessNodeWrap, 
                      public nsIAccessible, 
                      public nsIAccessibleHyperLink,
                      public nsIAccessibleSelectable,
                      public nsIAccessibleValue
 {
 public:
-  nsAccessible(nsIContent* aContent, nsDocAccessible* aDoc);
+  nsAccessible(nsIContent *aContent, nsIWeakReference *aShell);
   virtual ~nsAccessible();
 
   NS_DECL_ISUPPORTS_INHERITED
   NS_DECL_CYCLE_COLLECTION_CLASS_INHERITED(nsAccessible, nsAccessNode)
 
   NS_DECL_NSIACCESSIBLE
   NS_DECL_NSIACCESSIBLEHYPERLINK
   NS_DECL_NSIACCESSIBLESELECTABLE
--- a/accessible/src/base/nsBaseWidgetAccessible.cpp
+++ b/accessible/src/base/nsBaseWidgetAccessible.cpp
@@ -54,18 +54,18 @@
 
 using namespace mozilla::a11y;
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsLeafAccessible
 ////////////////////////////////////////////////////////////////////////////////
 
 nsLeafAccessible::
-  nsLeafAccessible(nsIContent* aContent, nsDocAccessible* aDoc) :
-  nsAccessibleWrap(aContent, aDoc)
+  nsLeafAccessible(nsIContent *aContent, nsIWeakReference *aShell) :
+  nsAccessibleWrap(aContent, aShell)
 {
 }
 
 NS_IMPL_ISUPPORTS_INHERITED0(nsLeafAccessible, nsAccessible)
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsLeafAccessible: nsAccessible public
 
@@ -87,18 +87,18 @@ nsLeafAccessible::CacheChildren()
 }
 
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsLinkableAccessible
 ////////////////////////////////////////////////////////////////////////////////
 
 nsLinkableAccessible::
-  nsLinkableAccessible(nsIContent* aContent, nsDocAccessible* aDoc) :
-  nsAccessibleWrap(aContent, aDoc),
+  nsLinkableAccessible(nsIContent *aContent, nsIWeakReference *aShell) :
+  nsAccessibleWrap(aContent, aShell),
   mActionAcc(nsnull),
   mIsLink(false),
   mIsOnclick(false)
 {
 }
 
 NS_IMPL_ISUPPORTS_INHERITED0(nsLinkableAccessible, nsAccessibleWrap)
 
@@ -248,19 +248,19 @@ nsLinkableAccessible::BindToParent(nsAcc
   }
 }
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsEnumRoleAccessible
 ////////////////////////////////////////////////////////////////////////////////
 
 nsEnumRoleAccessible::
-  nsEnumRoleAccessible(nsIContent* aNode, nsDocAccessible* aDoc,
+  nsEnumRoleAccessible(nsIContent *aNode, nsIWeakReference *aShell,
                        roles::Role aRole) :
-  nsAccessibleWrap(aNode, aDoc), mRole(aRole)
+  nsAccessibleWrap(aNode, aShell), mRole(aRole)
 {
 }
 
 NS_IMPL_ISUPPORTS_INHERITED0(nsEnumRoleAccessible, nsAccessible)
 
 role
 nsEnumRoleAccessible::NativeRole()
 {
--- a/accessible/src/base/nsBaseWidgetAccessible.h
+++ b/accessible/src/base/nsBaseWidgetAccessible.h
@@ -51,17 +51,17 @@
 
 /** 
   * Leaf version of DOM Accessible -- has no children
   */
 class nsLeafAccessible : public nsAccessibleWrap
 {
 public:
 
-  nsLeafAccessible(nsIContent* aContent, nsDocAccessible* aDoc);
+  nsLeafAccessible(nsIContent *aContent, nsIWeakReference *aShell);
 
   // nsISupports
   NS_DECL_ISUPPORTS_INHERITED
 
   // nsAccessible
   virtual nsAccessible* ChildAtPoint(PRInt32 aX, PRInt32 aY,
                                      EWhichChildAtPoint aWhichChild);
 
@@ -77,17 +77,17 @@ protected:
  * report the state of the host link (traveled or not) and can activate (click)
  * the host accessible programmatically.
  */
 class nsLinkableAccessible : public nsAccessibleWrap
 {
 public:
   enum { eAction_Jump = 0 };
 
-  nsLinkableAccessible(nsIContent* aContent, nsDocAccessible* aDoc);
+  nsLinkableAccessible(nsIContent *aContent, nsIWeakReference *aShell);
 
   NS_DECL_ISUPPORTS_INHERITED
 
   // nsIAccessible
   NS_IMETHOD GetActionName(PRUint8 aIndex, nsAString& aName);
   NS_IMETHOD DoAction(PRUint8 index);
   NS_IMETHOD GetValue(nsAString& _retval);
   NS_IMETHOD TakeFocus();
@@ -118,17 +118,17 @@ protected:
 };
 
 /**
  * A simple accessible that gets its enumerated role passed into constructor.
  */ 
 class nsEnumRoleAccessible : public nsAccessibleWrap
 {
 public:
-  nsEnumRoleAccessible(nsIContent* aContent, nsDocAccessible* aDoc,
+  nsEnumRoleAccessible(nsIContent *aContent, nsIWeakReference *aShell,
                        mozilla::a11y::role aRole);
   virtual ~nsEnumRoleAccessible() { }
 
   NS_DECL_ISUPPORTS_INHERITED
 
   // nsAccessible
   virtual mozilla::a11y::role NativeRole();
 
--- a/accessible/src/base/nsCaretAccessible.cpp
+++ b/accessible/src/base/nsCaretAccessible.cpp
@@ -291,17 +291,17 @@ nsCaretAccessible::NormalSelectionChange
   }
 
   mLastCaretOffset = caretOffset;
   mLastTextAccessible = textAcc;
 
   nsRefPtr<AccEvent> event =
     new AccCaretMoveEvent(mLastTextAccessible->GetNode());
   if (event)
-    mLastTextAccessible->Document()->FireDelayedAccessibleEvent(event);
+    mLastTextAccessible->GetDocAccessible()->FireDelayedAccessibleEvent(event);
 }
 
 void
 nsCaretAccessible::SpellcheckSelectionChanged(nsISelection* aSelection)
 {
   // XXX: fire an event for accessible of focus node of the selection. If
   // spellchecking is enabled then we will fire the number of events for
   // the same accessible for newly appended range of the selection (for every
@@ -311,17 +311,17 @@ nsCaretAccessible::SpellcheckSelectionCh
   nsHyperTextAccessible* textAcc =
     nsAccUtils::GetTextAccessibleFromSelection(aSelection);
   if (!textAcc)
     return;
 
   nsRefPtr<AccEvent> event =
     new AccEvent(nsIAccessibleEvent::EVENT_TEXT_ATTRIBUTE_CHANGED, textAcc);
   if (event)
-    textAcc->Document()->FireDelayedAccessibleEvent(event);
+    textAcc->GetDocAccessible()->FireDelayedAccessibleEvent(event);
 }
 
 nsIntRect
 nsCaretAccessible::GetCaretRect(nsIWidget **aOutWidget)
 {
   nsIntRect caretRect;
   NS_ENSURE_TRUE(aOutWidget, caretRect);
   *aOutWidget = nsnull;
--- a/accessible/src/base/nsDocAccessible.cpp
+++ b/accessible/src/base/nsDocAccessible.cpp
@@ -97,23 +97,22 @@ static nsIAtom** kRelationAttrs[] =
 };
 
 static const PRUint32 kRelationAttrsLen = NS_ARRAY_LENGTH(kRelationAttrs);
 
 ////////////////////////////////////////////////////////////////////////////////
 // Constructor/desctructor
 
 nsDocAccessible::
-  nsDocAccessible(nsIDocument* aDocument, nsIContent* aRootContent,
-                  nsIWeakReference* aShell) :
-  nsHyperTextAccessibleWrap(aRootContent, this),
+  nsDocAccessible(nsIDocument *aDocument, nsIContent *aRootContent,
+                  nsIWeakReference *aShell) :
+  nsHyperTextAccessibleWrap(aRootContent, aShell),
   mDocument(aDocument), mScrollPositionChangedTicks(0),
   mLoadState(eTreeConstructionPending), mLoadEventType(0),
-  mVirtualCursor(nsnull),
-  mPresShell(nsCOMPtr<nsIPresShell>(do_QueryReferent(aShell)).get())
+  mVirtualCursor(nsnull)
 {
   mFlags |= eDocAccessible;
 
   mDependentIDsHash.Init();
   // XXX aaronl should we use an algorithm for the initial cache size?
   mAccessibleCache.Init(kDefaultCacheSize);
   mNodeToAccessibleMap.Init(kDefaultCacheSize);
 
@@ -131,17 +130,16 @@ nsDocAccessible::
 
   // We provide a virtual cursor if this is a root doc or if it's a tab doc.
   mIsCursorable = (!(mDocument->GetParentDocument()) ||
                    nsCoreUtils::IsTabDocument(mDocument));
 }
 
 nsDocAccessible::~nsDocAccessible()
 {
-  NS_ASSERTION(!mPresShell, "LastRelease was never called!?!");
 }
 
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsISupports
 
 NS_IMPL_CYCLE_COLLECTION_CLASS(nsDocAccessible)
 
@@ -205,16 +203,17 @@ NS_INTERFACE_MAP_BEGIN_CYCLE_COLLECTION_
 
   *aInstancePtr = foundInterface;
   return status;
 }
 
 NS_IMPL_ADDREF_INHERITED(nsDocAccessible, nsHyperTextAccessible)
 NS_IMPL_RELEASE_INHERITED(nsDocAccessible, nsHyperTextAccessible)
 
+
 ////////////////////////////////////////////////////////////////////////////////
 // nsIAccessible
 
 NS_IMETHODIMP
 nsDocAccessible::GetName(nsAString& aName)
 {
   nsresult rv = NS_OK;
   aName.Truncate();
@@ -618,34 +617,35 @@ nsDocAccessible::GetAccessible(nsINode* 
 // nsAccessNode
 
 bool
 nsDocAccessible::Init()
 {
   NS_LOG_ACCDOCCREATE_FOR("document initialize", mDocument, this)
 
   // Initialize notification controller.
-  mNotificationController = new NotificationController(this, mPresShell);
+  nsCOMPtr<nsIPresShell> shell(GetPresShell());
+  mNotificationController = new NotificationController(this, shell);
   if (!mNotificationController)
     return false;
 
   // Mark the document accessible as loaded if its DOM document was loaded at
   // this point (this can happen because a11y is started late or DOM document
   // having no container was loaded.
   if (mDocument->GetReadyStateEnum() == nsIDocument::READYSTATE_COMPLETE)
     mLoadState |= eDOMLoaded;
 
   AddEventListeners();
   return true;
 }
 
 void
 nsDocAccessible::Shutdown()
 {
-  if (!mPresShell) // already shutdown
+  if (!mWeakShell) // already shutdown
     return;
 
   NS_LOG_ACCDOCDESTROY_FOR("document shutdown", mDocument, this)
 
   if (mNotificationController) {
     mNotificationController->Shutdown();
     mNotificationController = nsnull;
   }
@@ -653,17 +653,17 @@ nsDocAccessible::Shutdown()
   RemoveEventListeners();
 
   // Mark the document as shutdown before AT is notified about the document
   // removal from its container (valid for root documents on ATK).
   nsCOMPtr<nsIDocument> kungFuDeathGripDoc = mDocument;
   mDocument = nsnull;
 
   if (mParent) {
-    nsDocAccessible* parentDocument = mParent->Document();
+    nsDocAccessible* parentDocument = mParent->GetDocAccessible();
     if (parentDocument)
       parentDocument->RemoveChildDocument(this);
 
     mParent->RemoveChild(this);
   }
 
   // Walk the array backwards because child documents remove themselves from the
   // array as they are shutdown.
@@ -673,33 +673,35 @@ nsDocAccessible::Shutdown()
 
   mChildDocuments.Clear();
 
   if (mVirtualCursor) {
     mVirtualCursor->RemoveObserver(this);
     mVirtualCursor = nsnull;
   }
 
-  mPresShell = nsnull;  // Avoid reentrancy
+  mWeakShell = nsnull;  // Avoid reentrancy
 
   mDependentIDsHash.Clear();
   mNodeToAccessibleMap.Clear();
   ClearCache(mAccessibleCache);
 
   nsHyperTextAccessibleWrap::Shutdown();
 
   GetAccService()->NotifyOfDocumentShutdown(kungFuDeathGripDoc);
 }
 
 nsIFrame*
 nsDocAccessible::GetFrame() const
 {
+  nsCOMPtr<nsIPresShell> shell(do_QueryReferent(mWeakShell));
+
   nsIFrame* root = nsnull;
-  if (mPresShell)
-    root = mPresShell->GetRootFrame();
+  if (shell)
+    root = shell->GetRootFrame();
 
   return root;
 }
 
 bool
 nsDocAccessible::IsDefunct() const
 {
   return nsHyperTextAccessibleWrap::IsDefunct() || !mDocument;
@@ -747,17 +749,18 @@ void nsDocAccessible::GetBoundsRect(nsRe
 }
 
 // nsDocAccessible protected member
 nsresult nsDocAccessible::AddEventListeners()
 {
   // 1) Set up scroll position listener
   // 2) Check for editor and listen for changes to editor
 
-  NS_ENSURE_TRUE(mPresShell, NS_ERROR_FAILURE);
+  nsCOMPtr<nsIPresShell> presShell(GetPresShell());
+  NS_ENSURE_TRUE(presShell, NS_ERROR_FAILURE);
 
   nsCOMPtr<nsISupports> container = mDocument->GetContainer();
   nsCOMPtr<nsIDocShellTreeItem> docShellTreeItem(do_QueryInterface(container));
   NS_ENSURE_TRUE(docShellTreeItem, NS_ERROR_FAILURE);
 
   // Make sure we're a content docshell
   // We don't want to listen to chrome progress
   PRInt32 itemType;
@@ -775,17 +778,17 @@ nsresult nsDocAccessible::AddEventListen
 
   nsCOMPtr<nsIDocShellTreeItem> rootTreeItem;
   docShellTreeItem->GetRootTreeItem(getter_AddRefs(rootTreeItem));
   if (rootTreeItem) {
     nsRootAccessible* rootAccessible = RootAccessible();
     NS_ENSURE_TRUE(rootAccessible, NS_ERROR_FAILURE);
     nsRefPtr<nsCaretAccessible> caretAccessible = rootAccessible->GetCaretAccessible();
     if (caretAccessible) {
-      caretAccessible->AddDocSelectionListener(mPresShell);
+      caretAccessible->AddDocSelectionListener(presShell);
     }
   }
 
   // add document observer
   mDocument->AddObserver(this);
   return NS_OK;
 }
 
@@ -821,18 +824,21 @@ nsresult nsDocAccessible::RemoveEventLis
     mScrollWatchTimer->Cancel();
     mScrollWatchTimer = nsnull;
     NS_RELEASE_THIS(); // Kung fu death grip
   }
 
   nsRootAccessible* rootAccessible = RootAccessible();
   if (rootAccessible) {
     nsRefPtr<nsCaretAccessible> caretAccessible = rootAccessible->GetCaretAccessible();
-    if (caretAccessible)
-      caretAccessible->RemoveDocSelectionListener(mPresShell);
+    if (caretAccessible) {
+      // Don't use GetPresShell() which can call Shutdown() if it sees dead pres shell
+      nsCOMPtr<nsIPresShell> presShell(do_QueryReferent(mWeakShell));
+      caretAccessible->RemoveDocSelectionListener(presShell);
+    }
   }
 
   return NS_OK;
 }
 
 void nsDocAccessible::ScrollTimerCallback(nsITimer *aTimer, void *aClosure)
 {
   nsDocAccessible *docAcc = reinterpret_cast<nsDocAccessible*>(aClosure);
@@ -852,33 +858,35 @@ void nsDocAccessible::ScrollTimerCallbac
       NS_RELEASE(docAcc); // Release kung fu death grip
     }
   }
 }
 
 // nsDocAccessible protected member
 void nsDocAccessible::AddScrollListener()
 {
-  if (!mPresShell)
+  nsCOMPtr<nsIPresShell> presShell(do_QueryReferent(mWeakShell));
+  if (!presShell)
     return;
 
-  nsIScrollableFrame* sf = mPresShell->GetRootScrollFrameAsScrollableExternal();
+  nsIScrollableFrame* sf = presShell->GetRootScrollFrameAsScrollableExternal();
   if (sf) {
     sf->AddScrollPositionListener(this);
     NS_LOG_ACCDOCCREATE_TEXT("add scroll listener")
   }
 }
 
 // nsDocAccessible protected member
 void nsDocAccessible::RemoveScrollListener()
 {
-  if (!mPresShell)
+  nsCOMPtr<nsIPresShell> presShell(do_QueryReferent(mWeakShell));
+  if (!presShell)
     return;
  
-  nsIScrollableFrame* sf = mPresShell->GetRootScrollFrameAsScrollableExternal();
+  nsIScrollableFrame* sf = presShell->GetRootScrollFrameAsScrollableExternal();
   if (sf) {
     sf->RemoveScrollPositionListener(this);
   }
 }
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsIScrollPositionListener
 
@@ -1320,20 +1328,21 @@ nsDocAccessible::HandleAccEvent(AccEvent
 #endif
 
 ////////////////////////////////////////////////////////////////////////////////
 // Public members
 
 void*
 nsDocAccessible::GetNativeWindow() const
 {
-  if (!mPresShell)
+  nsCOMPtr<nsIPresShell> shell(do_QueryReferent(mWeakShell));
+  if (!shell)
     return nsnull;
 
-  nsIViewManager* vm = mPresShell->GetViewManager();
+  nsIViewManager* vm = shell->GetViewManager();
   if (!vm)
     return nsnull;
 
   nsCOMPtr<nsIWidget> widget;
   vm->GetRootWidget(getter_AddRefs(widget));
   if (widget)
     return widget->GetNativeData(NS_NATIVE_WINDOW);
 
@@ -1510,17 +1519,17 @@ nsDocAccessible::ProcessInvalidationList
 ////////////////////////////////////////////////////////////////////////////////
 // nsAccessible protected
 
 void
 nsDocAccessible::CacheChildren()
 {
   // Search for accessible children starting from the document element since
   // some web pages tend to insert elements under it rather than document body.
-  nsAccTreeWalker walker(do_GetWeakReference(mPresShell).get(), mDocument->GetRootElement(),
+  nsAccTreeWalker walker(mWeakShell, mDocument->GetRootElement(),
                          GetAllowsAnonChildAccessibles());
 
   nsAccessible* child = nsnull;
   while ((child = walker.NextChild()) && AppendChild(child));
 }
 
 ////////////////////////////////////////////////////////////////////////////////
 // Protected members
@@ -1866,17 +1875,17 @@ nsDocAccessible::UpdateTree(nsAccessible
   PRUint32 updateFlags = eNoAccessible;
 
   // If child node is not accessible then look for its accessible children.
   nsAccessible* child = GetAccessible(aChildNode);
   if (child) {
     updateFlags |= UpdateTreeInternal(child, aIsInsert);
 
   } else {
-    nsAccTreeWalker walker(do_GetWeakReference(mPresShell).get(), aChildNode,
+    nsAccTreeWalker walker(mWeakShell, aChildNode,
                            aContainer->GetAllowsAnonChildAccessibles(), true);
 
     while ((child = walker.NextChild()))
       updateFlags |= UpdateTreeInternal(child, aIsInsert);
   }
 
   // Content insertion/removal is not cause of accessible tree change.
   if (updateFlags == eNoAccessible)
--- a/accessible/src/base/nsDocAccessible.h
+++ b/accessible/src/base/nsDocAccessible.h
@@ -134,27 +134,16 @@ public:
 #endif
 
   // nsIAccessibleText
   NS_IMETHOD GetAssociatedEditor(nsIEditor **aEditor);
 
   // nsDocAccessible
 
   /**
-   * Return presentation shell for this document accessible.
-   */
-  nsIPresShell* PresShell() const { return mPresShell; }
-
-  /**
-   * Return weak reference to presentation shell for this document accessible.
-   */
-  nsIWeakReference* GetWeakShell() const
-    { return do_GetWeakReference(mPresShell).get(); }
-
-  /**
    * Return true if associated DOM document was loaded and isn't unloading.
    */
   bool IsContentLoaded() const
   {
     // eDOMLoaded flag check is used for error pages as workaround to make this
     // method return correct result since error pages do not receive 'pageshow'
     // event and as consequence nsIDocument::IsShowing() returns false.
     return mDocument && mDocument->IsVisible() &&
@@ -176,29 +165,28 @@ public:
     // document and all its subdocuments are ready
     eCompletelyLoaded = eReady | 1 << 2
   };
 
   /**
    * Return true if the document has given document state.
    */
   bool HasLoadState(LoadState aState) const
-    { return (mLoadState & static_cast<PRUint32>(aState)) == 
-        static_cast<PRUint32>(aState); }
+    { return (mLoadState & aState) == aState; }
 
   /**
    * Return a native window handler or pointer depending on platform.
    */
   virtual void* GetNativeWindow() const;
 
   /**
    * Return the parent document.
    */
   nsDocAccessible* ParentDocument() const
-    { return mParent ? mParent->Document() : nsnull; }
+    { return mParent ? mParent->GetDocAccessible() : nsnull; }
 
   /**
    * Return the child document count.
    */
   PRUint32 ChildDocumentCount() const
     { return mChildDocuments.Length(); }
 
   /**
@@ -384,18 +372,16 @@ public:
 
   /**
    * Recreate an accessible, results in hide/show events pair.
    */
   void RecreateAccessible(nsIContent* aContent);
 
 protected:
 
-  void LastRelease();
-
   // nsAccessible
   virtual void CacheChildren();
 
   // nsDocAccessible
     virtual void GetBoundsRect(nsRect& aRect, nsIFrame** aRelativeFrame);
     virtual nsresult AddEventListeners();
     virtual nsresult RemoveEventListeners();
 
@@ -662,20 +648,16 @@ protected:
    */
   nsTArray<nsIContent*> mInvalidationList;
 
   /**
    * Used to process notification from core and accessible events.
    */
   nsRefPtr<NotificationController> mNotificationController;
   friend class NotificationController;
-
-private:
-
-  nsIPresShell* mPresShell;
 };
 
 NS_DEFINE_STATIC_IID_ACCESSOR(nsDocAccessible,
                               NS_DOCACCESSIBLE_IMPL_CID)
 
 inline nsDocAccessible*
 nsAccessible::AsDoc()
 {
--- a/accessible/src/base/nsFormControlAccessible.cpp
+++ b/accessible/src/base/nsFormControlAccessible.cpp
@@ -196,18 +196,18 @@ ProgressMeterAccessible<Max>::SetCurrent
   return NS_ERROR_FAILURE; // Progress meters are readonly.
 }
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsRadioButtonAccessible
 ////////////////////////////////////////////////////////////////////////////////
 
 nsRadioButtonAccessible::
-  nsRadioButtonAccessible(nsIContent* aContent, nsDocAccessible* aDoc) :
-  nsFormControlAccessible(aContent, aDoc)
+  nsRadioButtonAccessible(nsIContent *aContent, nsIWeakReference *aShell) :
+  nsFormControlAccessible(aContent, aShell)
 {
 }
 
 PRUint8
 nsRadioButtonAccessible::ActionCount()
 {
   return 1;
 }
--- a/accessible/src/base/nsFormControlAccessible.h
+++ b/accessible/src/base/nsFormControlAccessible.h
@@ -45,18 +45,18 @@ typedef nsLeafAccessible nsFormControlAc
 
 /**
   * Generic class used for progress meters.
   */
 template<int Max>
 class ProgressMeterAccessible: public nsFormControlAccessible
 {
 public:
-  ProgressMeterAccessible(nsIContent* aContent, nsDocAccessible* aDoc) :
-    nsFormControlAccessible(aContent, aDoc)
+  ProgressMeterAccessible(nsIContent* aContent, nsIWeakReference* aShell) :
+    nsFormControlAccessible(aContent, aShell)
   {
   }
 
   NS_DECL_ISUPPORTS_INHERITED
   NS_DECL_NSIACCESSIBLEVALUE
 
   // nsIAccessible
   NS_IMETHOD GetValue(nsAString &aValue);
@@ -70,17 +70,17 @@ public:
 
 /**
   * Generic class used for radio buttons.
   */
 class nsRadioButtonAccessible : public nsFormControlAccessible
 {
 
 public:
-  nsRadioButtonAccessible(nsIContent* aContent, nsDocAccessible* aDoc);
+  nsRadioButtonAccessible(nsIContent *aContent, nsIWeakReference *aShell);
 
   // nsIAccessible
   NS_IMETHOD GetActionName(PRUint8 aIndex, nsAString& aName);
   NS_IMETHOD DoAction(PRUint8 aIndex);
 
   // nsAccessible
   virtual mozilla::a11y::role NativeRole();
 
--- a/accessible/src/base/nsOuterDocAccessible.cpp
+++ b/accessible/src/base/nsOuterDocAccessible.cpp
@@ -45,18 +45,18 @@
 
 using namespace mozilla::a11y;
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsOuterDocAccessible
 ////////////////////////////////////////////////////////////////////////////////
 
 nsOuterDocAccessible::
-  nsOuterDocAccessible(nsIContent* aContent, nsDocAccessible* aDoc) :
-  nsAccessibleWrap(aContent, aDoc)
+  nsOuterDocAccessible(nsIContent *aContent, nsIWeakReference *aShell) :
+  nsAccessibleWrap(aContent, aShell)
 {
 }
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsISupports
 
 NS_IMPL_ISUPPORTS_INHERITED0(nsOuterDocAccessible,
                              nsAccessible)
--- a/accessible/src/base/nsOuterDocAccessible.h
+++ b/accessible/src/base/nsOuterDocAccessible.h
@@ -48,17 +48,17 @@
  * opposed to the nsDocAccessibleWrap which is "inner". The outer node is
  * a something like tags listed above, whereas the inner node corresponds to
  * the inner document root.
  */
 
 class nsOuterDocAccessible : public nsAccessibleWrap
 {
 public:
-  nsOuterDocAccessible(nsIContent* aContent, nsDocAccessible* aDoc);
+  nsOuterDocAccessible(nsIContent *aContent, nsIWeakReference *aShell);
 
   NS_DECL_ISUPPORTS_INHERITED
 
   // nsIAccessible
   NS_IMETHOD GetActionName(PRUint8 aIndex, nsAString& aName);
   NS_IMETHOD GetActionDescription(PRUint8 aIndex, nsAString& aDescription);
   NS_IMETHOD DoAction(PRUint8 aIndex);
 
--- a/accessible/src/base/nsRootAccessible.cpp
+++ b/accessible/src/base/nsRootAccessible.cpp
@@ -366,30 +366,34 @@ nsRootAccessible::ProcessDOMEvent(nsIDOM
   nsCOMPtr<nsIDOMNSEvent> DOMNSEvent(do_QueryInterface(aDOMEvent));
   nsCOMPtr<nsIDOMEventTarget> DOMEventTarget;
   DOMNSEvent->GetOriginalTarget(getter_AddRefs(DOMEventTarget));
   nsCOMPtr<nsINode> origTargetNode(do_QueryInterface(DOMEventTarget));
 
   nsAutoString eventType;
   aDOMEvent->GetType(eventType);
 
+  nsCOMPtr<nsIWeakReference> weakShell =
+    nsCoreUtils::GetWeakShellFor(origTargetNode);
+  if (!weakShell)
+    return;
+
   if (eventType.EqualsLiteral("popuphiding")) {
     HandlePopupHidingEvent(origTargetNode);
     return;
   }
 
-  nsDocAccessible* targetDocument = GetAccService()->
-    GetDocAccessible(origTargetNode->OwnerDoc());
-  NS_ASSERTION(targetDocument, "No document while accessible is in document?!");
-
-  nsAccessible* accessible = 
-    targetDocument->GetAccessibleOrContainer(origTargetNode);
+  nsAccessible* accessible =
+    GetAccService()->GetAccessibleOrContainer(origTargetNode, weakShell);
   if (!accessible)
     return;
 
+  nsDocAccessible* targetDocument = accessible->GetDocAccessible();
+  NS_ASSERTION(targetDocument, "No document while accessible is in document?!");
+
   nsINode* targetNode = accessible->GetNode();
 
 #ifdef MOZ_XUL
   nsRefPtr<nsXULTreeAccessible> treeAcc;
   if (targetNode->IsElement() &&
       targetNode->AsElement()->NodeInfo()->Equals(nsGkAtoms::tree,
                                                   kNameSpaceID_XUL)) {
     treeAcc = do_QueryObject(accessible);
@@ -559,17 +563,17 @@ nsRootAccessible::ProcessDOMEvent(nsIDOM
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsAccessNode
 
 void
 nsRootAccessible::Shutdown()
 {
   // Called manually or by nsAccessNode::LastRelease()
-  if (!PresShell())
+  if (!mWeakShell)
     return;  // Already shutdown
 
   nsDocAccessibleWrap::Shutdown();
 }
 
 // nsIAccessible method
 Relation
 nsRootAccessible::RelationByType(PRUint32 aType)
--- a/accessible/src/base/nsTextAccessible.cpp
+++ b/accessible/src/base/nsTextAccessible.cpp
@@ -44,18 +44,18 @@
 
 using namespace mozilla::a11y;
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsTextAccessible
 ////////////////////////////////////////////////////////////////////////////////
 
 nsTextAccessible::
-  nsTextAccessible(nsIContent* aContent, nsDocAccessible* aDoc) :
-  nsLinkableAccessible(aContent, aDoc)
+  nsTextAccessible(nsIContent *aContent, nsIWeakReference *aShell) :
+  nsLinkableAccessible(aContent, aShell)
 {
   mFlags |= eTextLeafAccessible;
 }
 
 role
 nsTextAccessible::NativeRole()
 {
   return roles::TEXT_LEAF;
--- a/accessible/src/base/nsTextAccessible.h
+++ b/accessible/src/base/nsTextAccessible.h
@@ -42,17 +42,17 @@
 #include "nsBaseWidgetAccessible.h"
 
 /**
  * Generic class used for text nodes.
  */
 class nsTextAccessible : public nsLinkableAccessible
 {
 public:
-  nsTextAccessible(nsIContent* aContent, nsDocAccessible* aDoc);
+  nsTextAccessible(nsIContent *aContent, nsIWeakReference *aShell);
 
   // nsAccessible
   virtual mozilla::a11y::role NativeRole();
   virtual void AppendTextTo(nsAString& aText, PRUint32 aStartOffset = 0,
                             PRUint32 aLength = PR_UINT32_MAX);
 
   // nsTextAccessible
   void SetText(const nsAString& aText) { mText = aText; }
--- a/accessible/src/html/nsHTMLCanvasAccessible.cpp
+++ b/accessible/src/html/nsHTMLCanvasAccessible.cpp
@@ -37,18 +37,18 @@
 
 #include "nsHTMLCanvasAccessible.h"
 
 #include "Role.h"
 
 using namespace mozilla::a11y;
 
 nsHTMLCanvasAccessible::
-  nsHTMLCanvasAccessible(nsIContent* aContent, nsDocAccessible* aDoc) :
-  nsHyperTextAccessible(aContent, aDoc)
+  nsHTMLCanvasAccessible(nsIContent* aContent, nsIWeakReference* aShell) :
+  nsHyperTextAccessible(aContent, aShell)
 {
 }
 
 role
 nsHTMLCanvasAccessible::NativeRole()
 {
   return roles::CANVAS;
 }
--- a/accessible/src/html/nsHTMLCanvasAccessible.h
+++ b/accessible/src/html/nsHTMLCanvasAccessible.h
@@ -41,16 +41,16 @@
 #define _nsHTMLCanvasAccessible_H_
 
 /**
  * HTML canvas accessible (html:canvas).
  */
 class nsHTMLCanvasAccessible : public nsHyperTextAccessible
 {
 public:
-  nsHTMLCanvasAccessible(nsIContent* aContent, nsDocAccessible* aDoc);
+  nsHTMLCanvasAccessible(nsIContent* aContent, nsIWeakReference* aShell);
   virtual ~nsHTMLCanvasAccessible() { }
 
   // nsAccessible
   virtual mozilla::a11y::role NativeRole();
 };
 
 #endif
--- a/accessible/src/html/nsHTMLFormControlAccessible.cpp
+++ b/accessible/src/html/nsHTMLFormControlAccessible.cpp
@@ -63,18 +63,18 @@
 
 using namespace mozilla::a11y;
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsHTMLCheckboxAccessible
 ////////////////////////////////////////////////////////////////////////////////
 
 nsHTMLCheckboxAccessible::
-  nsHTMLCheckboxAccessible(nsIContent* aContent, nsDocAccessible* aDoc) :
-  nsFormControlAccessible(aContent, aDoc)
+  nsHTMLCheckboxAccessible(nsIContent *aContent, nsIWeakReference *aShell) :
+  nsFormControlAccessible(aContent, aShell)
 {
 }
 
 role
 nsHTMLCheckboxAccessible::NativeRole()
 {
   return roles::CHECKBUTTON;
 }
@@ -149,18 +149,18 @@ nsHTMLCheckboxAccessible::IsWidget() con
 }
 
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsHTMLRadioButtonAccessible
 ////////////////////////////////////////////////////////////////////////////////
 
 nsHTMLRadioButtonAccessible::
-  nsHTMLRadioButtonAccessible(nsIContent* aContent, nsDocAccessible* aDoc) :
-  nsRadioButtonAccessible(aContent, aDoc)
+  nsHTMLRadioButtonAccessible(nsIContent *aContent, nsIWeakReference *aShell) :
+  nsRadioButtonAccessible(aContent, aShell)
 {
 }
 
 PRUint64
 nsHTMLRadioButtonAccessible::NativeState()
 {
   PRUint64 state = nsAccessibleWrap::NativeState();
 
@@ -238,18 +238,18 @@ nsHTMLRadioButtonAccessible::GetPosition
   *aSetSize = count;
 }
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsHTMLButtonAccessible
 ////////////////////////////////////////////////////////////////////////////////
 
 nsHTMLButtonAccessible::
-  nsHTMLButtonAccessible(nsIContent* aContent, nsDocAccessible* aDoc) :
-  nsHyperTextAccessibleWrap(aContent, aDoc)
+  nsHTMLButtonAccessible(nsIContent *aContent, nsIWeakReference *aShell) :
+  nsHyperTextAccessibleWrap(aContent, aShell)
 {
 }
 
 PRUint8
 nsHTMLButtonAccessible::ActionCount()
 {
   return 1;
 }
@@ -353,18 +353,18 @@ nsHTMLButtonAccessible::IsWidget() const
 }
 
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsHTML4ButtonAccessible
 ////////////////////////////////////////////////////////////////////////////////
 
 nsHTML4ButtonAccessible::
-  nsHTML4ButtonAccessible(nsIContent* aContent, nsDocAccessible* aDoc) :
-  nsHyperTextAccessibleWrap(aContent, aDoc)
+  nsHTML4ButtonAccessible(nsIContent *aContent, nsIWeakReference *aShell) :
+  nsHyperTextAccessibleWrap(aContent, aShell)
 {
 }
 
 PRUint8
 nsHTML4ButtonAccessible::ActionCount()
 {
   return 1;
 }
@@ -418,18 +418,18 @@ nsHTML4ButtonAccessible::IsWidget() cons
 }
 
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsHTMLTextFieldAccessible
 ////////////////////////////////////////////////////////////////////////////////
 
 nsHTMLTextFieldAccessible::
-  nsHTMLTextFieldAccessible(nsIContent* aContent, nsDocAccessible* aDoc) :
-  nsHyperTextAccessibleWrap(aContent, aDoc)
+  nsHTMLTextFieldAccessible(nsIContent *aContent, nsIWeakReference *aShell) :
+  nsHyperTextAccessibleWrap(aContent, aShell)
 {
 }
 
 NS_IMPL_ISUPPORTS_INHERITED3(nsHTMLTextFieldAccessible, nsAccessible, nsHyperTextAccessible, nsIAccessibleText, nsIAccessibleEditableText)
 
 role
 nsHTMLTextFieldAccessible::NativeRole()
 {
@@ -650,18 +650,18 @@ nsHTMLTextFieldAccessible::ContainerWidg
 }
 
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsHTMLGroupboxAccessible
 ////////////////////////////////////////////////////////////////////////////////
 
 nsHTMLFileInputAccessible::
-nsHTMLFileInputAccessible(nsIContent* aContent, nsDocAccessible* aDoc) :
-  nsHyperTextAccessibleWrap(aContent, aDoc)
+nsHTMLFileInputAccessible(nsIContent* aContent, nsIWeakReference* aShell) :
+  nsHyperTextAccessibleWrap(aContent, aShell)
 {
   mFlags |= eHTMLFileInputAccessible;
 }
 
 role
 nsHTMLFileInputAccessible::NativeRole()
 {
   // JAWS wants a text container, others don't mind. No specific role in
@@ -705,18 +705,18 @@ nsHTMLFileInputAccessible::HandleAccEven
   return NS_OK;
 }
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsHTMLGroupboxAccessible
 ////////////////////////////////////////////////////////////////////////////////
 
 nsHTMLGroupboxAccessible::
-  nsHTMLGroupboxAccessible(nsIContent* aContent, nsDocAccessible* aDoc) :
-  nsHyperTextAccessibleWrap(aContent, aDoc)
+  nsHTMLGroupboxAccessible(nsIContent *aContent, nsIWeakReference *aShell) :
+  nsHyperTextAccessibleWrap(aContent, aShell)
 {
 }
 
 role
 nsHTMLGroupboxAccessible::NativeRole()
 {
   return roles::GROUPING;
 }
@@ -765,18 +765,18 @@ nsHTMLGroupboxAccessible::RelationByType
   return rel;
 }
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsHTMLLegendAccessible
 ////////////////////////////////////////////////////////////////////////////////
 
 nsHTMLLegendAccessible::
-  nsHTMLLegendAccessible(nsIContent* aContent, nsDocAccessible* aDoc) :
-  nsHyperTextAccessibleWrap(aContent, aDoc)
+  nsHTMLLegendAccessible(nsIContent *aContent, nsIWeakReference *aShell) :
+  nsHyperTextAccessibleWrap(aContent, aShell)
 {
 }
 
 Relation
 nsHTMLLegendAccessible::RelationByType(PRUint32 aType)
 {
   Relation rel = nsHyperTextAccessibleWrap::RelationByType(aType);
   if (aType != nsIAccessibleRelation::RELATION_LABEL_FOR)
@@ -795,18 +795,18 @@ nsHTMLLegendAccessible::NativeRole()
   return roles::LABEL;
 }
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsHTMLFigureAccessible
 ////////////////////////////////////////////////////////////////////////////////
 
 nsHTMLFigureAccessible::
-  nsHTMLFigureAccessible(nsIContent* aContent, nsDocAccessible* aDoc) :
-  nsHyperTextAccessibleWrap(aContent, aDoc)
+  nsHTMLFigureAccessible(nsIContent* aContent, nsIWeakReference* aShell) :
+  nsHyperTextAccessibleWrap(aContent, aShell)
 {
 }
 
 nsresult
 nsHTMLFigureAccessible::GetAttributesInternal(nsIPersistentProperties* aAttributes)
 {
   nsresult rv = nsHyperTextAccessibleWrap::GetAttributesInternal(aAttributes);
   NS_ENSURE_SUCCESS(rv, rv);
@@ -865,18 +865,18 @@ nsHTMLFigureAccessible::Caption() const
   return nsnull;
 }
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsHTMLFigcaptionAccessible
 ////////////////////////////////////////////////////////////////////////////////
 
 nsHTMLFigcaptionAccessible::
-  nsHTMLFigcaptionAccessible(nsIContent* aContent, nsDocAccessible* aDoc) :
-  nsHyperTextAccessibleWrap(aContent, aDoc)
+  nsHTMLFigcaptionAccessible(nsIContent* aContent, nsIWeakReference* aShell) :
+  nsHyperTextAccessibleWrap(aContent, aShell)
 {
 }
 
 role
 nsHTMLFigcaptionAccessible::NativeRole()
 {
   return roles::CAPTION;
 }
--- a/accessible/src/html/nsHTMLFormControlAccessible.h
+++ b/accessible/src/html/nsHTMLFormControlAccessible.h
@@ -51,17 +51,17 @@ typedef ProgressMeterAccessible<1> HTMLP
  * Accessible for HTML input@type="checkbox".
  */
 class nsHTMLCheckboxAccessible : public nsFormControlAccessible
 {
 
 public:
   enum { eAction_Click = 0 };
 
-  nsHTMLCheckboxAccessible(nsIContent* aContent, nsDocAccessible* aDoc);
+  nsHTMLCheckboxAccessible(nsIContent *aContent, nsIWeakReference *aShell);
 
   // nsIAccessible
   NS_IMETHOD GetActionName(PRUint8 aIndex, nsAString& aName);
   NS_IMETHOD DoAction(PRUint8 index);
 
   // nsAccessible
   virtual mozilla::a11y::role NativeRole();
   virtual PRUint64 NativeState();
@@ -76,17 +76,17 @@ public:
 
 /**
  * Accessible for HTML input@type="radio" element.
  */
 class nsHTMLRadioButtonAccessible : public nsRadioButtonAccessible
 {
 
 public:
-  nsHTMLRadioButtonAccessible(nsIContent* aContent, nsDocAccessible* aDoc);
+  nsHTMLRadioButtonAccessible(nsIContent *aContent, nsIWeakReference *aShell);
 
   // nsAccessible
   virtual PRUint64 NativeState();
   virtual void GetPositionAndSizeInternal(PRInt32 *aPosInSet,
                                           PRInt32 *aSetSize);
 };
 
 
@@ -95,17 +95,17 @@ public:
  * elements.
  */
 class nsHTMLButtonAccessible : public nsHyperTextAccessibleWrap
 {
 
 public:
   enum { eAction_Click = 0 };
 
-  nsHTMLButtonAccessible(nsIContent* aContent, nsDocAccessible* aDoc);
+  nsHTMLButtonAccessible(nsIContent *aContent, nsIWeakReference *aShell);
 
   // nsIAccessible
   NS_IMETHOD GetActionName(PRUint8 aIndex, nsAString& aName);
   NS_IMETHOD DoAction(PRUint8 index);
 
   // nsAccessible
   virtual nsresult GetNameInternal(nsAString& aName);
   virtual mozilla::a11y::role NativeRole();
@@ -124,17 +124,17 @@ public:
  * Accessible for HTML button element.
  */
 class nsHTML4ButtonAccessible : public nsHyperTextAccessibleWrap
 {
 
 public:
   enum { eAction_Click = 0 };
 
-  nsHTML4ButtonAccessible(nsIContent* aContent, nsDocAccessible* aDoc);
+  nsHTML4ButtonAccessible(nsIContent *aContent, nsIWeakReference *aShell);
 
   // nsIAccessible
   NS_IMETHOD GetActionName(PRUint8 aIndex, nsAString& aName);
   NS_IMETHOD DoAction(PRUint8 index);
 
   // nsAccessible
   virtual mozilla::a11y::role NativeRole();
   virtual PRUint64 NativeState();
@@ -151,17 +151,17 @@ public:
  * Accessible for HTML input@type="text" element.
  */
 class nsHTMLTextFieldAccessible : public nsHyperTextAccessibleWrap
 {
 
 public:
   enum { eAction_Click = 0 };
 
-  nsHTMLTextFieldAccessible(nsIContent* aContent, nsDocAccessible* aDoc);
+  nsHTMLTextFieldAccessible(nsIContent *aContent, nsIWeakReference *aShell);
 
   NS_DECL_ISUPPORTS_INHERITED
 
   // nsIAccessible
   NS_IMETHOD GetValue(nsAString& _retval); 
   NS_IMETHOD GetActionName(PRUint8 aIndex, nsAString& aName);
   NS_IMETHOD DoAction(PRUint8 index);
 
@@ -185,30 +185,30 @@ public:
 
 
 /**
  * Accessible for input@type="file" element.
  */
 class nsHTMLFileInputAccessible : public nsHyperTextAccessibleWrap
 {
 public:
-  nsHTMLFileInputAccessible(nsIContent* aContent, nsDocAccessible* aDoc);
+  nsHTMLFileInputAccessible(nsIContent* aContent, nsIWeakReference* aShell);
 
   // nsAccessible
   virtual mozilla::a11y::role NativeRole();
   virtual nsresult HandleAccEvent(AccEvent* aAccEvent);
 };
 
 /**
  * Accessible for HTML fieldset element.
  */
 class nsHTMLGroupboxAccessible : public nsHyperTextAccessibleWrap
 {
 public:
-  nsHTMLGroupboxAccessible(nsIContent* aContent, nsDocAccessible* aDoc);
+  nsHTMLGroupboxAccessible(nsIContent *aContent, nsIWeakReference *aShell);
 
   // nsAccessible
   virtual nsresult GetNameInternal(nsAString& aName);
   virtual mozilla::a11y::role NativeRole();
   virtual Relation RelationByType(PRUint32 aType);
 
 protected:
   nsIContent* GetLegend();
@@ -216,30 +216,30 @@ protected:
 
 
 /**
  * Accessible for HTML legend element.
  */
 class nsHTMLLegendAccessible : public nsHyperTextAccessibleWrap
 {
 public:
-  nsHTMLLegendAccessible(nsIContent* aContent, nsDocAccessible* aDoc);
+  nsHTMLLegendAccessible(nsIContent *aContent, nsIWeakReference *aShell);
 
   // nsAccessible
   virtual mozilla::a11y::role NativeRole();
   virtual Relation RelationByType(PRUint32 aType);
 };
 
 /**
  * Accessible for HTML5 figure element.
  */
 class nsHTMLFigureAccessible : public nsHyperTextAccessibleWrap
 {
 public:
-  nsHTMLFigureAccessible(nsIContent* aContent, nsDocAccessible* aDoc);
+  nsHTMLFigureAccessible(nsIContent* aContent, nsIWeakReference* aShell);
 
   // nsAccessible
   virtual nsresult GetAttributesInternal(nsIPersistentProperties* aAttributes);
   virtual nsresult GetNameInternal(nsAString& aName);
   virtual mozilla::a11y::role NativeRole();
   virtual Relation RelationByType(PRUint32 aType);
 
 protected:
@@ -248,16 +248,16 @@ protected:
 
 
 /**
  * Accessible for HTML5 figcaption element.
  */
 class nsHTMLFigcaptionAccessible : public nsHyperTextAccessibleWrap
 {
 public:
-  nsHTMLFigcaptionAccessible(nsIContent* aContent, nsDocAccessible* aDoc);
+  nsHTMLFigcaptionAccessible(nsIContent* aContent, nsIWeakReference* aShell);
 
   // nsAccessible
   virtual mozilla::a11y::role NativeRole();
   virtual Relation RelationByType(PRUint32 aType);
 };
 
 #endif
--- a/accessible/src/html/nsHTMLImageAccessible.cpp
+++ b/accessible/src/html/nsHTMLImageAccessible.cpp
@@ -55,18 +55,18 @@
 
 using namespace mozilla::a11y;
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsHTMLImageAccessible
 ////////////////////////////////////////////////////////////////////////////////
 
 nsHTMLImageAccessible::
-  nsHTMLImageAccessible(nsIContent* aContent, nsDocAccessible* aDoc) :
-  nsLinkableAccessible(aContent, aDoc)
+  nsHTMLImageAccessible(nsIContent *aContent, nsIWeakReference *aShell) :
+  nsLinkableAccessible(aContent, aShell)
 {
 }
 
 NS_IMPL_ISUPPORTS_INHERITED1(nsHTMLImageAccessible, nsAccessible,
                              nsIAccessibleImage)
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsAccessible public
--- a/accessible/src/html/nsHTMLImageAccessible.h
+++ b/accessible/src/html/nsHTMLImageAccessible.h
@@ -46,17 +46,17 @@
  * supports:
  * - gets name, role
  * - support basic state
  */
 class nsHTMLImageAccessible : public nsLinkableAccessible,
                               public nsIAccessibleImage
 {
 public:
-  nsHTMLImageAccessible(nsIContent* aContent, nsDocAccessible* aDoc);
+  nsHTMLImageAccessible(nsIContent *aContent, nsIWeakReference *aShell);
 
   // nsISupports
   NS_DECL_ISUPPORTS_INHERITED
 
   // nsIAccessible
   NS_IMETHOD GetActionName(PRUint8 aIndex, nsAString& aName);
   NS_IMETHOD DoAction(PRUint8 index);
 
--- a/accessible/src/html/nsHTMLImageMapAccessible.cpp
+++ b/accessible/src/html/nsHTMLImageMapAccessible.cpp
@@ -52,19 +52,19 @@
 #include "nsImageMap.h"
 
 using namespace mozilla::a11y;
 ////////////////////////////////////////////////////////////////////////////////
 // nsHTMLImageMapAccessible
 ////////////////////////////////////////////////////////////////////////////////
 
 nsHTMLImageMapAccessible::
-  nsHTMLImageMapAccessible(nsIContent* aContent, nsDocAccessible* aDoc,
-                           nsIDOMHTMLMapElement* aMapElm) :
-  nsHTMLImageAccessibleWrap(aContent, aDoc), mMapElement(aMapElm)
+  nsHTMLImageMapAccessible(nsIContent *aContent, nsIWeakReference *aShell,
+                           nsIDOMHTMLMapElement *aMapElm) :
+  nsHTMLImageAccessibleWrap(aContent, aShell), mMapElement(aMapElm)
 {
 }
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsHTMLImageMapAccessible: nsISupports
 
 NS_IMPL_ISUPPORTS_INHERITED0(nsHTMLImageMapAccessible, nsHTMLImageAccessible)
 
@@ -112,46 +112,46 @@ nsHTMLImageMapAccessible::CacheChildren(
   if (!mMapElement)
     return;
 
   nsCOMPtr<nsIDOMHTMLCollection> mapAreas;
   mMapElement->GetAreas(getter_AddRefs(mapAreas));
   if (!mapAreas)
     return;
 
-  nsDocAccessible* document = Document();
+  nsDocAccessible* document = GetDocAccessible();
 
   PRUint32 areaCount = 0;
   mapAreas->GetLength(&areaCount);
 
   for (PRUint32 areaIdx = 0; areaIdx < areaCount; areaIdx++) {
     nsCOMPtr<nsIDOMNode> areaNode;
     mapAreas->Item(areaIdx, getter_AddRefs(areaNode));
     if (!areaNode)
       return;
 
     nsCOMPtr<nsIContent> areaContent(do_QueryInterface(areaNode));
     nsRefPtr<nsAccessible> area =
-      new nsHTMLAreaAccessible(areaContent, mDoc);
+      new nsHTMLAreaAccessible(areaContent, mWeakShell);
 
     if (!document->BindToDocument(area, nsAccUtils::GetRoleMapEntry(areaContent)) ||
         !AppendChild(area)) {
       return;
     }
   }
 }
 
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsHTMLAreaAccessible
 ////////////////////////////////////////////////////////////////////////////////
 
 nsHTMLAreaAccessible::
-  nsHTMLAreaAccessible(nsIContent* aContent, nsDocAccessible* aDoc) :
-  nsHTMLLinkAccessible(aContent, aDoc)
+  nsHTMLAreaAccessible(nsIContent *aContent, nsIWeakReference *aShell) :
+  nsHTMLLinkAccessible(aContent, aShell)
 {
 }
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsHTMLAreaAccessible: nsIAccessible
 
 nsresult
 nsHTMLAreaAccessible::GetNameInternal(nsAString & aName)
--- a/accessible/src/html/nsHTMLImageMapAccessible.h
+++ b/accessible/src/html/nsHTMLImageMapAccessible.h
@@ -46,18 +46,18 @@
 #include "nsIDOMHTMLMapElement.h"
 
 /**
  * Used for HTML image maps.
  */
 class nsHTMLImageMapAccessible : public nsHTMLImageAccessibleWrap
 {
 public:
-  nsHTMLImageMapAccessible(nsIContent* aContent, nsDocAccessible* aDoc,
-                           nsIDOMHTMLMapElement* aMapElm);
+  nsHTMLImageMapAccessible(nsIContent *aContent, nsIWeakReference *aShell,
+                           nsIDOMHTMLMapElement *aMapElm);
 
   // nsISupports and cycle collector
   NS_DECL_ISUPPORTS_INHERITED
 
   // nsAccessible
   virtual mozilla::a11y::role NativeRole();
 
   // HyperLinkAccessible
@@ -78,17 +78,17 @@ private:
 
 /**
  * Accessible for image map areas - must be child of image.
  */
 class nsHTMLAreaAccessible : public nsHTMLLinkAccessible
 {
 public:
 
-  nsHTMLAreaAccessible(nsIContent* aContent, nsDocAccessible* aDoc);
+  nsHTMLAreaAccessible(nsIContent *aContent, nsIWeakReference *aShell);
 
   // nsIAccessible
 
   NS_IMETHOD GetBounds(PRInt32 *x, PRInt32 *y, PRInt32 *width, PRInt32 *height);
 
   // nsAccessible
   virtual void Description(nsString& aDescription);
   virtual nsresult GetNameInternal(nsAString& aName);
--- a/accessible/src/html/nsHTMLLinkAccessible.cpp
+++ b/accessible/src/html/nsHTMLLinkAccessible.cpp
@@ -38,29 +38,28 @@
  * ***** END LICENSE BLOCK ***** */
 
 #include "nsHTMLLinkAccessible.h"
 
 #include "nsCoreUtils.h"
 #include "Role.h"
 #include "States.h"
 
-#include "nsDocAccessible.h"
 #include "nsEventStates.h"
 #include "mozilla/dom/Element.h"
 
 using namespace mozilla::a11y;
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsHTMLLinkAccessible
 ////////////////////////////////////////////////////////////////////////////////
 
 nsHTMLLinkAccessible::
-  nsHTMLLinkAccessible(nsIContent* aContent, nsDocAccessible* aDoc) :
-  nsHyperTextAccessibleWrap(aContent, aDoc)
+  nsHTMLLinkAccessible(nsIContent *aContent, nsIWeakReference *aShell) :
+  nsHyperTextAccessibleWrap(aContent, aShell)
 {
 }
 
 // Expose nsIAccessibleHyperLink unconditionally
 NS_IMPL_ISUPPORTS_INHERITED1(nsHTMLLinkAccessible, nsHyperTextAccessibleWrap,
                              nsIAccessibleHyperLink)
 
 ////////////////////////////////////////////////////////////////////////////////
@@ -112,17 +111,17 @@ nsHTMLLinkAccessible::GetValue(nsAString
   aValue.Truncate();
 
   nsresult rv = nsHyperTextAccessible::GetValue(aValue);
   NS_ENSURE_SUCCESS(rv, rv);
 
   if (!aValue.IsEmpty())
     return NS_OK;
   
-  nsIPresShell* presShell(mDoc->PresShell());
+  nsCOMPtr<nsIPresShell> presShell(do_QueryReferent(mWeakShell));
   nsCOMPtr<nsIDOMNode> DOMNode(do_QueryInterface(mContent));
   return presShell->GetLinkLocation(DOMNode, aValue);
 }
 
 PRUint8
 nsHTMLLinkAccessible::ActionCount()
 {
   return IsLinked() ? 1 : nsHyperTextAccessible::ActionCount();
--- a/accessible/src/html/nsHTMLLinkAccessible.h
+++ b/accessible/src/html/nsHTMLLinkAccessible.h
@@ -40,17 +40,17 @@
 #ifndef _nsHTMLLinkAccessible_H_
 #define _nsHTMLLinkAccessible_H_
 
 #include "nsHyperTextAccessibleWrap.h"
 
 class nsHTMLLinkAccessible : public nsHyperTextAccessibleWrap
 {
 public:
-  nsHTMLLinkAccessible(nsIContent* aContent, nsDocAccessible* aDoc);
+  nsHTMLLinkAccessible(nsIContent *aContent, nsIWeakReference *aShell);
  
   NS_DECL_ISUPPORTS_INHERITED
 
   // nsIAccessible
   NS_IMETHOD GetValue(nsAString& aValue);
 
   NS_IMETHOD GetActionName(PRUint8 aIndex, nsAString& aName);
   NS_IMETHOD DoAction(PRUint8 aIndex);
--- a/accessible/src/html/nsHTMLSelectAccessible.cpp
+++ b/accessible/src/html/nsHTMLSelectAccessible.cpp
@@ -60,18 +60,18 @@
 
 using namespace mozilla::a11y;
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsHTMLSelectListAccessible
 ////////////////////////////////////////////////////////////////////////////////
 
 nsHTMLSelectListAccessible::
-  nsHTMLSelectListAccessible(nsIContent* aContent, nsDocAccessible* aDoc) :
-  nsAccessibleWrap(aContent, aDoc)
+  nsHTMLSelectListAccessible(nsIContent *aContent, nsIWeakReference *aShell) :
+  nsAccessibleWrap(aContent, aShell)
 {
   mFlags |= eListControlAccessible;
 }
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsHTMLSelectListAccessible: nsAccessible public
 
 PRUint64
@@ -139,17 +139,17 @@ nsHTMLSelectListAccessible::AreItemsOper
 
 nsAccessible*
 nsHTMLSelectListAccessible::CurrentItem()
 {
   nsIListControlFrame* listControlFrame = do_QueryFrame(GetFrame());
   if (listControlFrame) {
     nsCOMPtr<nsIContent> activeOptionNode = listControlFrame->GetCurrentOption();
     if (activeOptionNode) {
-      nsDocAccessible* document = Document();
+      nsDocAccessible* document = GetDocAccessible();
       if (document)
         return document->GetAccessible(activeOptionNode);
     }
   }
   return nsnull;
 }
 
 void
@@ -174,49 +174,49 @@ nsHTMLSelectListAccessible::CacheChildre
 }
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsHTMLSelectListAccessible protected
 
 void
 nsHTMLSelectListAccessible::CacheOptSiblings(nsIContent *aParentContent)
 {
-  nsIPresShell* presShell(mDoc->PresShell());
+  nsCOMPtr<nsIPresShell> presShell(do_QueryReferent(mWeakShell));
   for (nsIContent* childContent = aParentContent->GetFirstChild(); childContent;
        childContent = childContent->GetNextSibling()) {
     if (!childContent->IsHTML()) {
       continue;
     }
 
     nsCOMPtr<nsIAtom> tag = childContent->Tag();
     if (tag == nsGkAtoms::option ||
         tag == nsGkAtoms::optgroup) {
 
       // Get an accessible for option or optgroup and cache it.
       nsRefPtr<nsAccessible> accessible =
         GetAccService()->GetOrCreateAccessible(childContent, presShell,
-                                               mDoc->GetWeakShell());
+                                               mWeakShell);
       if (accessible)
         AppendChild(accessible);
 
       // Deep down into optgroup element.
       if (tag == nsGkAtoms::optgroup)
         CacheOptSiblings(childContent);
     }
   }
 }
 
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsHTMLSelectOptionAccessible
 ////////////////////////////////////////////////////////////////////////////////
 
 nsHTMLSelectOptionAccessible::
-  nsHTMLSelectOptionAccessible(nsIContent* aContent, nsDocAccessible* aDoc) :
-  nsHyperTextAccessibleWrap(aContent, aDoc)
+  nsHTMLSelectOptionAccessible(nsIContent *aContent, nsIWeakReference *aShell) :
+  nsHyperTextAccessibleWrap(aContent, aShell)
 {
 }
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsHTMLSelectOptionAccessible: nsAccessible public
 
 role
 nsHTMLSelectOptionAccessible::NativeRole()
@@ -449,19 +449,19 @@ nsHTMLSelectOptionAccessible::GetSelectS
 }
 
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsHTMLSelectOptGroupAccessible
 ////////////////////////////////////////////////////////////////////////////////
 
 nsHTMLSelectOptGroupAccessible::
-  nsHTMLSelectOptGroupAccessible(nsIContent* aContent,
-                                 nsDocAccessible* aDoc) :
-  nsHTMLSelectOptionAccessible(aContent, aDoc)
+  nsHTMLSelectOptGroupAccessible(nsIContent *aContent,
+                                 nsIWeakReference *aShell) :
+  nsHTMLSelectOptionAccessible(aContent, aShell)
 {
 }
 
 role
 nsHTMLSelectOptGroupAccessible::NativeRole()
 {
   return roles::HEADING;
 }
@@ -506,18 +506,18 @@ nsHTMLSelectOptGroupAccessible::CacheChi
 }
 
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsHTMLComboboxAccessible
 ////////////////////////////////////////////////////////////////////////////////
 
 nsHTMLComboboxAccessible::
-  nsHTMLComboboxAccessible(nsIContent* aContent, nsDocAccessible* aDoc) :
-  nsAccessibleWrap(aContent, aDoc)
+  nsHTMLComboboxAccessible(nsIContent *aContent, nsIWeakReference *aShell) :
+  nsAccessibleWrap(aContent, aShell)
 {
   mFlags |= eComboboxAccessible;
 }
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsHTMLComboboxAccessible: nsAccessible
 
 role
@@ -547,20 +547,20 @@ nsHTMLComboboxAccessible::CacheChildren(
     return;
 
   nsIFrame *listFrame = comboFrame->GetDropDown();
   if (!listFrame)
     return;
 
   if (!mListAccessible) {
     mListAccessible = 
-      new nsHTMLComboboxListAccessible(mParent, mContent, mDoc);
+      new nsHTMLComboboxListAccessible(mParent, mContent, mWeakShell);
 
     // Initialize and put into cache.
-    if (!Document()->BindToDocument(mListAccessible, nsnull))
+    if (!GetDocAccessible()->BindToDocument(mListAccessible, nsnull))
       return;
   }
 
   if (AppendChild(mListAccessible)) {
     // Cache combobox option accessibles so that we build complete accessible
     // tree for combobox.
     mListAccessible->EnsureChildren();
   }
@@ -713,34 +713,34 @@ nsHTMLComboboxAccessible::SelectedOption
   if (!comboboxFrame)
     return nsnull;
 
   nsIListControlFrame* listControlFrame =
     do_QueryFrame(comboboxFrame->GetDropDown());
   if (listControlFrame) {
     nsCOMPtr<nsIContent> activeOptionNode = listControlFrame->GetCurrentOption();
     if (activeOptionNode) {
-      nsDocAccessible* document = Document();
+      nsDocAccessible* document = GetDocAccessible();
       if (document)
         return document->GetAccessible(activeOptionNode);
     }
   }
 
   return nsnull;
 }
 
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsHTMLComboboxListAccessible
 ////////////////////////////////////////////////////////////////////////////////
 
 nsHTMLComboboxListAccessible::
-  nsHTMLComboboxListAccessible(nsIAccessible* aParent, nsIContent* aContent,
-                               nsDocAccessible* aDoc) :
-  nsHTMLSelectListAccessible(aContent, aDoc)
+  nsHTMLComboboxListAccessible(nsIAccessible *aParent, nsIContent *aContent,
+                               nsIWeakReference *aShell) :
+  nsHTMLSelectListAccessible(aContent, aShell)
 {
 }
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsHTMLComboboxAccessible: nsAccessNode
 
 nsIFrame*
 nsHTMLComboboxListAccessible::GetFrame() const
--- a/accessible/src/html/nsHTMLSelectAccessible.h
+++ b/accessible/src/html/nsHTMLSelectAccessible.h
@@ -63,17 +63,17 @@ class nsIMutableArray;
 
 /*
  * The list that contains all the options in the select.
  */
 class nsHTMLSelectListAccessible : public nsAccessibleWrap
 {
 public:
   
-  nsHTMLSelectListAccessible(nsIContent* aContent, nsDocAccessible* aDoc);
+  nsHTMLSelectListAccessible(nsIContent *aContent, nsIWeakReference *aShell);
   virtual ~nsHTMLSelectListAccessible() {}
 
   // nsAccessible
   virtual mozilla::a11y::role NativeRole();
   virtual PRUint64 NativeState();
 
   // SelectAccessible
   virtual bool IsSelect();
@@ -103,17 +103,17 @@ protected:
 /*
  * Options inside the select, contained within the list
  */
 class nsHTMLSelectOptionAccessible : public nsHyperTextAccessibleWrap
 {
 public:
   enum { eAction_Select = 0 };  
   
-  nsHTMLSelectOptionAccessible(nsIContent* aContent, nsDocAccessible* aDoc);
+  nsHTMLSelectOptionAccessible(nsIContent *aContent, nsIWeakReference *aShell);
   virtual ~nsHTMLSelectOptionAccessible() {}
 
   // nsIAccessible
   NS_IMETHOD DoAction(PRUint8 index);
   NS_IMETHOD GetActionName(PRUint8 aIndex, nsAString& aName);
   NS_IMETHOD SetSelected(bool aSelect);
 
   // nsAccessible
@@ -147,17 +147,17 @@ private:
 
 /*
  * Opt Groups inside the select, contained within the list
  */
 class nsHTMLSelectOptGroupAccessible : public nsHTMLSelectOptionAccessible
 {
 public:
 
-  nsHTMLSelectOptGroupAccessible(nsIContent* aContent, nsDocAccessible* aDoc);
+  nsHTMLSelectOptGroupAccessible(nsIContent *aContent, nsIWeakReference *aShell);
   virtual ~nsHTMLSelectOptGroupAccessible() {}
 
   // nsIAccessible
   NS_IMETHOD DoAction(PRUint8 index);  
   NS_IMETHOD GetActionName(PRUint8 aIndex, nsAString& aName);
 
   // nsAccessible
   virtual mozilla::a11y::role NativeRole();
@@ -180,17 +180,17 @@ class nsHTMLComboboxListAccessible;
 /*
  * A class the represents the HTML Combobox widget.
  */
 class nsHTMLComboboxAccessible : public nsAccessibleWrap
 {
 public:
   enum { eAction_Click = 0 };
 
-  nsHTMLComboboxAccessible(nsIContent* aContent, nsDocAccessible* aDoc);
+  nsHTMLComboboxAccessible(nsIContent *aContent, nsIWeakReference *aShell);
   virtual ~nsHTMLComboboxAccessible() {}
 
   // nsIAccessible
   NS_IMETHOD GetValue(nsAString& _retval);
   NS_IMETHOD DoAction(PRUint8 index);
   NS_IMETHOD GetActionName(PRUint8 aIndex, nsAString& aName);
 
   // nsAccessNode
@@ -229,19 +229,19 @@ private:
  * A class that represents the window that lives to the right
  * of the drop down button inside the Select. This is the window
  * that is made visible when the button is pressed.
  */
 class nsHTMLComboboxListAccessible : public nsHTMLSelectListAccessible
 {
 public:
 
-  nsHTMLComboboxListAccessible(nsIAccessible* aParent, 
-                               nsIContent* aContent, 
-                               nsDocAccessible* aDoc);
+  nsHTMLComboboxListAccessible(nsIAccessible *aParent, 
+                               nsIContent *aContent, 
+                               nsIWeakReference* aShell);
   virtual ~nsHTMLComboboxListAccessible() {}
 
   // nsAccessNode
   virtual nsIFrame* GetFrame() const;
   virtual bool IsPrimaryForNode() const;
 
   // nsAccessible
   virtual PRUint64 NativeState();
--- a/accessible/src/html/nsHTMLTableAccessible.cpp
+++ b/accessible/src/html/nsHTMLTableAccessible.cpp
@@ -71,18 +71,18 @@
 
 using namespace mozilla::a11y;
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsHTMLTableCellAccessible
 ////////////////////////////////////////////////////////////////////////////////
 
 nsHTMLTableCellAccessible::
-  nsHTMLTableCellAccessible(nsIContent* aContent, nsDocAccessible* aDoc) :
-  nsHyperTextAccessibleWrap(aContent, aDoc)
+  nsHTMLTableCellAccessible(nsIContent *aContent, nsIWeakReference *aShell) :
+  nsHyperTextAccessibleWrap(aContent, aShell)
 {
 }
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsHTMLTableCellAccessible: nsISupports implementation
 
 NS_IMPL_ISUPPORTS_INHERITED1(nsHTMLTableCellAccessible,
                              nsHyperTextAccessible,
@@ -343,17 +343,18 @@ nsHTMLTableCellAccessible::GetHeaderCell
     NS_ENSURE_SUCCESS(rv, rv);
     roles::Role desiredRole = static_cast<roles::Role>(-1) ;
     if (aRowOrColumnHeaderCell == nsAccUtils::eRowHeaderCells)
       desiredRole = roles::ROWHEADER;
     else if (aRowOrColumnHeaderCell == nsAccUtils::eColumnHeaderCells)
       desiredRole = roles::COLUMNHEADER;
 
     do {
-      nsAccessible* headerCell = mDoc->GetAccessible(headerCellElm);
+      nsAccessible* headerCell =
+        GetAccService()->GetAccessibleInWeakShell(headerCellElm, mWeakShell);
 
       if (headerCell && headerCell->Role() == desiredRole)
         headerCells->AppendElement(static_cast<nsIAccessible*>(headerCell),
                                    false);
     } while ((headerCellElm = iter.NextElem()));
 
     NS_ADDREF(*aHeaderCells = headerCells);
     return NS_OK;
@@ -370,19 +371,19 @@ nsHTMLTableCellAccessible::GetHeaderCell
   return NS_OK;
 }
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsHTMLTableHeaderAccessible
 ////////////////////////////////////////////////////////////////////////////////
 
 nsHTMLTableHeaderCellAccessible::
-  nsHTMLTableHeaderCellAccessible(nsIContent* aContent,
-                                  nsDocAccessible* aDoc) :
-  nsHTMLTableCellAccessible(aContent, aDoc)
+  nsHTMLTableHeaderCellAccessible(nsIContent *aContent,
+                                  nsIWeakReference *aShell) :
+  nsHTMLTableCellAccessible(aContent, aShell)
 {
 }
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsHTMLTableHeaderAccessible: nsAccessible implementation
 
 role
 nsHTMLTableHeaderCellAccessible::NativeRole()
@@ -430,18 +431,18 @@ nsHTMLTableHeaderCellAccessible::NativeR
   return roles::COLUMNHEADER;
 }
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsHTMLTableAccessible
 ////////////////////////////////////////////////////////////////////////////////
 
 nsHTMLTableAccessible::
-  nsHTMLTableAccessible(nsIContent* aContent, nsDocAccessible* aDoc) :
-  nsAccessibleWrap(aContent, aDoc)
+  nsHTMLTableAccessible(nsIContent *aContent, nsIWeakReference *aShell) :
+  nsAccessibleWrap(aContent, aShell)
 {
 }
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsHTMLTableAccessible: nsISupports implementation
 
 NS_IMPL_ISUPPORTS_INHERITED2(nsHTMLTableAccessible, nsAccessible,
                              nsHTMLTableAccessible, nsIAccessibleTable)
@@ -452,17 +453,17 @@ NS_IMPL_ISUPPORTS_INHERITED2(nsHTMLTable
 
 void
 nsHTMLTableAccessible::CacheChildren()
 {
   // Move caption accessible so that it's the first child. Check for the first
   // caption only, because nsAccessibilityService ensures we don't create
   // accessibles for the other captions, since only the first is actually
   // visible.
-  nsAccTreeWalker walker(mDoc->GetWeakShell(), mContent, GetAllowsAnonChildAccessibles());
+  nsAccTreeWalker walker(mWeakShell, mContent, GetAllowsAnonChildAccessibles());
 
   nsAccessible* child = nsnull;
   while ((child = walker.NextChild())) {
     if (child->Role() == roles::CAPTION) {
       InsertChildAt(0, child);
       while ((child = walker.NextChild()) && AppendChild(child));
       break;
     }
@@ -712,17 +713,18 @@ nsHTMLTableAccessible::GetSelectedCells(
                                       startRowIndex, startColIndex,
                                       rowSpan, colSpan,
                                       actualRowSpan, actualColSpan,
                                       isSelected);
 
       if (NS_SUCCEEDED(rv) && startRowIndex == rowIndex &&
           startColIndex == columnIndex && isSelected) {
         nsCOMPtr<nsIContent> cellContent(do_QueryInterface(cellElement));
-        nsAccessible *cell = mDoc->GetAccessible(cellContent);
+        nsAccessible *cell =
+          GetAccService()->GetAccessibleInWeakShell(cellContent, mWeakShell);
         selCells->AppendElement(static_cast<nsIAccessible*>(cell), false);
       }
     }
   }
 
   NS_ADDREF(*aCells = selCells);
   return NS_OK;
 }
@@ -885,17 +887,18 @@ NS_IMETHODIMP
 nsHTMLTableAccessible::GetCellAt(PRInt32 aRow, PRInt32 aColumn,
                                  nsIAccessible **aTableCellAccessible)
 {
   nsCOMPtr<nsIDOMElement> cellElement;
   nsresult rv = GetCellAt(aRow, aColumn, *getter_AddRefs(cellElement));
   NS_ENSURE_SUCCESS(rv, rv);
 
   nsCOMPtr<nsIContent> cellContent(do_QueryInterface(cellElement));
-  nsAccessible* cell = mDoc->GetAccessible(cellContent);
+  nsAccessible *cell =
+    GetAccService()->GetAccessibleInWeakShell(cellContent, mWeakShell);
 
   if (!cell) {
     return NS_ERROR_INVALID_ARG;
   }
 
   if (cell != this) {
     // XXX bug 576838: crazy tables (like table6 in tables/test_table2.html) may
     // return itself as a cell what makes Orca hang.
@@ -1186,17 +1189,17 @@ nsHTMLTableAccessible::AddRowOrColumnToS
   PRInt32 count = 0;
   if (doSelectRow)
     rv = GetColumnCount(&count);
   else
     rv = GetRowCount(&count);
 
   NS_ENSURE_SUCCESS(rv, rv);
 
-  nsIPresShell* presShell(mDoc->PresShell());
+  nsCOMPtr<nsIPresShell> presShell(GetPresShell());
   nsRefPtr<nsFrameSelection> tableSelection =
     const_cast<nsFrameSelection*>(presShell->ConstFrameSelection());
 
   for (PRInt32 idx = 0; idx < count; idx++) {
     PRInt32 rowIdx = doSelectRow ? aIndex : idx;
     PRInt32 colIdx = doSelectRow ? idx : aIndex;
     rv = tableLayout->GetCellDataAt(rowIdx, colIdx,
                                     *getter_AddRefs(cellElm),
@@ -1218,17 +1221,17 @@ nsHTMLTableAccessible::AddRowOrColumnToS
 nsresult
 nsHTMLTableAccessible::RemoveRowsOrColumnsFromSelection(PRInt32 aIndex,
                                                         PRUint32 aTarget,
                                                         bool aIsOuter)
 {
   nsITableLayout *tableLayout = GetTableLayout();
   NS_ENSURE_STATE(tableLayout);
 
-  nsIPresShell* presShell(mDoc->PresShell());
+  nsCOMPtr<nsIPresShell> presShell(GetPresShell());
   nsRefPtr<nsFrameSelection> tableSelection =
     const_cast<nsFrameSelection*>(presShell->ConstFrameSelection());
 
   bool doUnselectRow = (aTarget == nsISelectionPrivate::TABLESELECTION_ROW);
   PRInt32 count = 0;
   nsresult rv = doUnselectRow ? GetColumnCount(&count) : GetRowCount(&count);
   NS_ENSURE_SUCCESS(rv, rv);
 
@@ -1377,17 +1380,17 @@ nsHTMLTableAccessible::IsProbablyForLayo
 #define RETURN_LAYOUT_ANSWER(isLayout, heuristic) { *aIsProbablyForLayout = isLayout; return NS_OK; }
 #endif
 
   *aIsProbablyForLayout = false;
 
   if (IsDefunct())
     return NS_ERROR_FAILURE;
 
-  nsDocAccessible* docAccessible = Document();
+  nsDocAccessible *docAccessible = GetDocAccessible();
   if (docAccessible) {
     PRUint64 docState = docAccessible->State();
     if (docState & states::EDITABLE) {  // Need to see all elements while document is being edited
       RETURN_LAYOUT_ANSWER(false, "In editable document");
     }
   }
 
   // Check to see if an ARIA role overrides the role from native markup,
@@ -1531,17 +1534,17 @@ nsHTMLTableAccessible::IsProbablyForLayo
   if (styledWidth.EqualsLiteral("100%")) {
     RETURN_LAYOUT_ANSWER(true, "<=4 columns and 100% width");
   }
   if (styledWidth.Find(NS_LITERAL_STRING("px"))) { // Hardcoded in pixels
     nsIFrame *tableFrame = GetFrame();
     NS_ENSURE_TRUE(tableFrame , NS_ERROR_FAILURE);
     nsSize tableSize  = tableFrame->GetSize();
 
-    nsDocAccessible* docAccessible = Document();
+    nsDocAccessible *docAccessible = GetDocAccessible();
     NS_ENSURE_TRUE(docAccessible, NS_ERROR_FAILURE);
     nsIFrame *docFrame = docAccessible->GetFrame();
     NS_ENSURE_TRUE(docFrame , NS_ERROR_FAILURE);
 
     nsSize docSize = docFrame->GetSize();
     if (docSize.width > 0) {
       PRInt32 percentageOfDocWidth = (100 * tableSize.width) / docSize.width;
       if (percentageOfDocWidth > 95) {
--- a/accessible/src/html/nsHTMLTableAccessible.h
+++ b/accessible/src/html/nsHTMLTableAccessible.h
@@ -47,17 +47,17 @@ class nsITableCellLayout;
 
 /**
  * HTML table cell accessible (html:td).
  */
 class nsHTMLTableCellAccessible : public nsHyperTextAccessibleWrap,
                                   public nsIAccessibleTableCell
 {
 public:
-  nsHTMLTableCellAccessible(nsIContent* aContent, nsDocAccessible* aDoc);
+  nsHTMLTableCellAccessible(nsIContent *aContent, nsIWeakReference *aShell);
 
   // nsISupports
   NS_DECL_ISUPPORTS_INHERITED
 
   // nsIAccessibleTableCell
   NS_DECL_NSIACCESSIBLETABLECELL
 
   // nsAccessible
@@ -90,18 +90,18 @@ protected:
 
 
 /**
  * HTML table row/column header accessible (html:th or html:td@scope).
  */
 class nsHTMLTableHeaderCellAccessible : public nsHTMLTableCellAccessible
 {
 public:
-  nsHTMLTableHeaderCellAccessible(nsIContent* aContent,
-                                  nsDocAccessible* aDoc);
+  nsHTMLTableHeaderCellAccessible(nsIContent *aContent,
+                                  nsIWeakReference *aShell);
 
   // nsAccessible
   virtual mozilla::a11y::role NativeRole();
 };
 
 
 /**
  * HTML table accessible (html:table).
@@ -119,17 +119,17 @@ public:
   0x47ac,                                               \
   { 0x88, 0xdc, 0x4a, 0x23, 0x51, 0x6a, 0xa2, 0x3d }    \
 }
 
 class nsHTMLTableAccessible : public nsAccessibleWrap,
                               public nsIAccessibleTable
 {
 public:
-  nsHTMLTableAccessible(nsIContent* aContent, nsDocAccessible* aDoc);
+  nsHTMLTableAccessible(nsIContent *aContent, nsIWeakReference *aShell);
 
   NS_DECL_ISUPPORTS_INHERITED
   NS_DECL_NSIACCESSIBLETABLE
   NS_DECLARE_STATIC_IID_ACCESSOR(NS_TABLEACCESSIBLE_IMPL_CID)
 
   // nsAccessible
   virtual void Description(nsString& aDescription);
   virtual nsresult GetNameInternal(nsAString& aName);
@@ -206,19 +206,18 @@ NS_DEFINE_STATIC_IID_ACCESSOR(nsHTMLTabl
 
 
 /**
  * HTML caption accessible (html:caption).
  */
 class nsHTMLCaptionAccessible : public nsHyperTextAccessibleWrap
 {
 public:
-  nsHTMLCaptionAccessible(nsIContent* aContent, nsDocAccessible* aDoc) :
-    nsHyperTextAccessibleWrap(aContent, aDoc) { }
-  virtual ~nsHTMLCaptionAccessible() { }
+  nsHTMLCaptionAccessible(nsIContent *aContent, nsIWeakReference *aShell) :
+    nsHyperTextAccessibleWrap(aContent, aShell) { }
 
   // nsIAccessible
 
   // nsAccessible
   virtual mozilla::a11y::role NativeRole();
   virtual Relation RelationByType(PRUint32 aRelationType);
 };
 
--- a/accessible/src/html/nsHTMLTextAccessible.cpp
+++ b/accessible/src/html/nsHTMLTextAccessible.cpp
@@ -56,18 +56,18 @@
 
 using namespace mozilla::a11y;
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsHTMLTextAccessible
 ////////////////////////////////////////////////////////////////////////////////
 
 nsHTMLTextAccessible::
-  nsHTMLTextAccessible(nsIContent* aContent, nsDocAccessible* aDoc) :
-  nsTextAccessibleWrap(aContent, aDoc)
+  nsHTMLTextAccessible(nsIContent *aContent, nsIWeakReference *aShell) :
+  nsTextAccessibleWrap(aContent, aShell)
 {
 }
 
 NS_IMPL_ISUPPORTS_INHERITED0(nsHTMLTextAccessible, nsTextAccessible)
 
 NS_IMETHODIMP
 nsHTMLTextAccessible::GetName(nsAString& aName)
 {
@@ -88,17 +88,17 @@ nsHTMLTextAccessible::NativeRole()
   return nsTextAccessible::NativeRole();
 }
 
 PRUint64
 nsHTMLTextAccessible::NativeState()
 {
   PRUint64 state = nsTextAccessible::NativeState();
 
-  nsDocAccessible* docAccessible = Document();
+  nsDocAccessible *docAccessible = GetDocAccessible();
   if (docAccessible) {
      PRUint64 docState = docAccessible->State();
      if (0 == (docState & states::EDITABLE)) {
        state |= states::READONLY; // Links not focusable in editor
      }
   }
 
   return state;
@@ -117,35 +117,35 @@ nsHTMLTextAccessible::GetAttributesInter
 }
 
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsHTMLHRAccessible
 ////////////////////////////////////////////////////////////////////////////////
 
 nsHTMLHRAccessible::
-  nsHTMLHRAccessible(nsIContent* aContent, nsDocAccessible* aDoc) :
-  nsLeafAccessible(aContent, aDoc)
+  nsHTMLHRAccessible(nsIContent *aContent, nsIWeakReference *aShell) :
+  nsLeafAccessible(aContent, aShell)
 {
 }
 
 role
 nsHTMLHRAccessible::NativeRole()
 {
   return roles::SEPARATOR;
 }
 
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsHTMLBRAccessible
 ////////////////////////////////////////////////////////////////////////////////
 
 nsHTMLBRAccessible::
-  nsHTMLBRAccessible(nsIContent* aContent, nsDocAccessible* aDoc) :
-  nsLeafAccessible(aContent, aDoc)
+  nsHTMLBRAccessible(nsIContent *aContent, nsIWeakReference *aShell) :
+  nsLeafAccessible(aContent, aShell)
 {
 }
 
 role
 nsHTMLBRAccessible::NativeRole()
 {
   return roles::WHITESPACE;
 }
@@ -163,18 +163,18 @@ nsHTMLBRAccessible::GetNameInternal(nsAS
   return NS_OK;
 }
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsHTMLLabelAccessible
 ////////////////////////////////////////////////////////////////////////////////
 
 nsHTMLLabelAccessible::
-  nsHTMLLabelAccessible(nsIContent* aContent, nsDocAccessible* aDoc) :
-  nsHyperTextAccessibleWrap(aContent, aDoc)
+  nsHTMLLabelAccessible(nsIContent *aContent, nsIWeakReference *aShell) :
+  nsHyperTextAccessibleWrap(aContent, aShell)
 {
 }
 
 NS_IMPL_ISUPPORTS_INHERITED0(nsHTMLLabelAccessible, nsHyperTextAccessible)
 
 nsresult
 nsHTMLLabelAccessible::GetNameInternal(nsAString& aName)
 {
@@ -187,18 +187,18 @@ nsHTMLLabelAccessible::NativeRole()
   return roles::LABEL;
 }
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsHTMLOuputAccessible
 ////////////////////////////////////////////////////////////////////////////////
 
 nsHTMLOutputAccessible::
-  nsHTMLOutputAccessible(nsIContent* aContent, nsDocAccessible* aDoc) :
-  nsHyperTextAccessibleWrap(aContent, aDoc)
+  nsHTMLOutputAccessible(nsIContent* aContent, nsIWeakReference* aShell) :
+  nsHyperTextAccessibleWrap(aContent, aShell)
 {
 }
 
 NS_IMPL_ISUPPORTS_INHERITED0(nsHTMLOutputAccessible, nsHyperTextAccessible)
 
 Relation
 nsHTMLOutputAccessible::RelationByType(PRUint32 aType)
 {
@@ -228,25 +228,25 @@ nsHTMLOutputAccessible::GetAttributesInt
 }
 
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsHTMLLIAccessible
 ////////////////////////////////////////////////////////////////////////////////
 
 nsHTMLLIAccessible::
-  nsHTMLLIAccessible(nsIContent* aContent, nsDocAccessible* aDoc) :
-  nsHyperTextAccessibleWrap(aContent, aDoc), mBullet(nsnull)
+  nsHTMLLIAccessible(nsIContent* aContent, nsIWeakReference* aShell) :
+  nsHyperTextAccessibleWrap(aContent, aShell), mBullet(nsnull)
 {
   mFlags |= eHTMLListItemAccessible;
 
   nsBlockFrame* blockFrame = do_QueryFrame(GetFrame());
   if (blockFrame && blockFrame->HasBullet()) {
-    mBullet = new nsHTMLListBulletAccessible(mContent, mDoc);
-    if (!Document()->BindToDocument(mBullet, nsnull))
+    mBullet = new nsHTMLListBulletAccessible(mContent, mWeakShell);
+    if (!GetDocAccessible()->BindToDocument(mBullet, nsnull))
       mBullet = nsnull;
   }
 }
 
 NS_IMPL_ISUPPORTS_INHERITED0(nsHTMLLIAccessible, nsHyperTextAccessible)
 
 void
 nsHTMLLIAccessible::Shutdown()
@@ -289,19 +289,19 @@ NS_IMETHODIMP nsHTMLLIAccessible::GetBou
 void
 nsHTMLLIAccessible::UpdateBullet(bool aHasBullet)
 {
   if (aHasBullet == !!mBullet) {
     NS_NOTREACHED("Bullet and accessible are in sync already!");
     return;
   }
 
-  nsDocAccessible* document = Document();
+  nsDocAccessible* document = GetDocAccessible();
   if (aHasBullet) {
-    mBullet = new nsHTMLListBulletAccessible(mContent, mDoc);
+    mBullet = new nsHTMLListBulletAccessible(mContent, mWeakShell);
     if (document->BindToDocument(mBullet, nsnull)) {
       InsertChildAt(0, mBullet);
     }
   } else {
     RemoveChild(mBullet);
     document->UnbindFromDocument(mBullet);
     mBullet = nsnull;
   }
@@ -323,18 +323,18 @@ nsHTMLLIAccessible::CacheChildren()
   nsAccessibleWrap::CacheChildren();
 }
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsHTMLListBulletAccessible
 ////////////////////////////////////////////////////////////////////////////////
 
 nsHTMLListBulletAccessible::
-  nsHTMLListBulletAccessible(nsIContent* aContent, nsDocAccessible* aDoc) :
-    nsLeafAccessible(aContent, aDoc)
+  nsHTMLListBulletAccessible(nsIContent* aContent, nsIWeakReference* aShell) :
+    nsLeafAccessible(aContent, aShell)
 {
 }
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsHTMLListBulletAccessible: nsAccessNode
 
 bool
 nsHTMLListBulletAccessible::IsPrimaryForNode() const
@@ -395,18 +395,18 @@ nsHTMLListBulletAccessible::AppendTextTo
   aText.Append(Substring(bulletText, aStartOffset, aLength));
 }
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsHTMLListAccessible
 ////////////////////////////////////////////////////////////////////////////////
 
 nsHTMLListAccessible::
-  nsHTMLListAccessible(nsIContent* aContent, nsDocAccessible* aDoc) :
-  nsHyperTextAccessibleWrap(aContent, aDoc)
+  nsHTMLListAccessible(nsIContent *aContent, nsIWeakReference *aShell) :
+  nsHyperTextAccessibleWrap(aContent, aShell)
 {
 }
 
 NS_IMPL_ISUPPORTS_INHERITED0(nsHTMLListAccessible, nsHyperTextAccessible)
 
 role
 nsHTMLListAccessible::NativeRole()
 {
--- a/accessible/src/html/nsHTMLTextAccessible.h
+++ b/accessible/src/html/nsHTMLTextAccessible.h
@@ -45,17 +45,17 @@
 #include "nsBaseWidgetAccessible.h"
 
 /**
  * Used for text nodes within HTML document.
  */
 class nsHTMLTextAccessible : public nsTextAccessibleWrap
 {
 public:
-  nsHTMLTextAccessible(nsIContent* aContent, nsDocAccessible* aDoc);
+  nsHTMLTextAccessible(nsIContent *aContent, nsIWeakReference *aShell);
 
   // nsISupports
   NS_DECL_ISUPPORTS_INHERITED
 
   // nsIAccessible
   NS_IMETHOD GetName(nsAString& aName);
 
   // nsAccessible
@@ -65,74 +65,74 @@ public:
 };
 
 /**
  * Used for HTML hr element.
  */
 class nsHTMLHRAccessible : public nsLeafAccessible
 {
 public:
-  nsHTMLHRAccessible(nsIContent* aContent, nsDocAccessible* aDoc);
+  nsHTMLHRAccessible(nsIContent *aContent, nsIWeakReference *aShell);
 
   // nsAccessible
   virtual mozilla::a11y::role NativeRole();
 };
 
 /**
  * Used for HTML br element.
  */
 class nsHTMLBRAccessible : public nsLeafAccessible
 {
 public:
-  nsHTMLBRAccessible(nsIContent* aContent, nsDocAccessible* aDoc);
+  nsHTMLBRAccessible(nsIContent *aContent, nsIWeakReference *aShell);
 
   // nsAccessible
   virtual nsresult GetNameInternal(nsAString& aName);
   virtual mozilla::a11y::role NativeRole();
   virtual PRUint64 NativeState();
 };
 
 /**
  * Used for HTML label element.
  */
 class nsHTMLLabelAccessible : public nsHyperTextAccessibleWrap
 {
 public:
-  nsHTMLLabelAccessible(nsIContent* aContent, nsDocAccessible* aDoc);
+  nsHTMLLabelAccessible(nsIContent *aContent, nsIWeakReference *aShell);
 
   NS_DECL_ISUPPORTS_INHERITED
 
   // nsAccessible
   virtual nsresult GetNameInternal(nsAString& aName);
   virtual mozilla::a11y::role NativeRole();
 };
 
 /**
  * Used for HTML output element.
  */
 class nsHTMLOutputAccessible : public nsHyperTextAccessibleWrap
 {
 public:
-  nsHTMLOutputAccessible(nsIContent* aContent, nsDocAccessible* aDoc);
+  nsHTMLOutputAccessible(nsIContent* aContent, nsIWeakReference* aShell);
 
   NS_DECL_ISUPPORTS_INHERITED
 
   // nsAccessible
   virtual mozilla::a11y::role NativeRole();
   virtual nsresult GetAttributesInternal(nsIPersistentProperties* aAttributes);
   virtual Relation RelationByType(PRUint32 aType);
 };
 
 /**
  * Used for bullet of HTML list item element (for example, HTML li).
  */
 class nsHTMLListBulletAccessible : public nsLeafAccessible
 {
 public:
-  nsHTMLListBulletAccessible(nsIContent* aContent, nsDocAccessible* aDoc);
+  nsHTMLListBulletAccessible(nsIContent* aContent, nsIWeakReference* aShell);
 
   // nsIAccessible
   NS_IMETHOD GetName(nsAString& aName);
 
   // nsAccessNode
   virtual bool IsPrimaryForNode() const;
 
   // nsAccessible
@@ -143,33 +143,33 @@ public:
 };
 
 /**
  * Used for HTML list (like HTML ul).
  */
 class nsHTMLListAccessible : public nsHyperTextAccessibleWrap
 {
 public:
-  nsHTMLListAccessible(nsIContent* aContent, nsDocAccessible* aDoc);
+  nsHTMLListAccessible(nsIContent *aContent, nsIWeakReference *aShell);
 
   // nsISupports
   NS_DECL_ISUPPORTS_INHERITED
 
   // nsAccessible
   virtual mozilla::a11y::role NativeRole();
   virtual PRUint64 NativeState();
 };
 
 /**
  * Used for HTML list item (e.g. HTML li).
  */
 class nsHTMLLIAccessible : public nsHyperTextAccessibleWrap
 {
 public:
-  nsHTMLLIAccessible(nsIContent* aContent, nsDocAccessible* aDoc);
+  nsHTMLLIAccessible(nsIContent* aContent, nsIWeakReference* aShell);
 
   // nsISupports
   NS_DECL_ISUPPORTS_INHERITED
 
   // nsAccessNode
   virtual void Shutdown();
 
   // nsIAccessible
--- a/accessible/src/html/nsHyperTextAccessible.cpp
+++ b/accessible/src/html/nsHyperTextAccessible.cpp
@@ -36,17 +36,16 @@
  * the terms of any one of the MPL, the GPL or the LGPL.
  *
  * ***** END LICENSE BLOCK ***** */
 
 #include "nsHyperTextAccessible.h"
 
 #include "nsAccessibilityService.h"
 #include "nsAccUtils.h"
-#include "nsDocAccessible.h"
 #include "nsTextAttrs.h"
 #include "Role.h"
 #include "States.h"
 
 #include "nsIClipboard.h"
 #include "nsFocusManager.h"
 #include "nsIDOMCharacterData.h"
 #include "nsIDOMDocument.h"
@@ -67,18 +66,18 @@
 
 using namespace mozilla::a11y;
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsHyperTextAccessible
 ////////////////////////////////////////////////////////////////////////////////
 
 nsHyperTextAccessible::
-  nsHyperTextAccessible(nsIContent* aNode, nsDocAccessible* aDoc) :
-  nsAccessibleWrap(aNode, aDoc)
+  nsHyperTextAccessible(nsIContent *aNode, nsIWeakReference *aShell) :
+  nsAccessibleWrap(aNode, aShell)
 {
   mFlags |= eHyperTextAccessible;
 }
 
 NS_IMPL_ADDREF_INHERITED(nsHyperTextAccessible, nsAccessibleWrap)
 NS_IMPL_RELEASE_INHERITED(nsHyperTextAccessible, nsAccessibleWrap)
 
 nsresult nsHyperTextAccessible::QueryInterface(REFNSIID aIID, void** aInstancePtr)
@@ -205,18 +204,17 @@ nsIntRect nsHyperTextAccessible::GetBoun
   nsIFrame *frame;
   PRInt32 startContentOffsetInFrame;
   // Get the right frame continuation -- not really a child, but a sibling of
   // the primary frame passed in
   rv = aFrame->GetChildFrameContainingOffset(startContentOffset, false,
                                              &startContentOffsetInFrame, &frame);
   NS_ENSURE_SUCCESS(rv, screenRect);
 
-  NS_ENSURE_TRUE(mDoc, screenRect);
-  nsIPresShell* shell = mDoc->PresShell();
+  nsCOMPtr<nsIPresShell> shell = GetPresShell();
   NS_ENSURE_TRUE(shell, screenRect);
 
   nsPresContext *context = shell->GetPresContext();
 
   while (frame && startContentOffset < endContentOffset) {
     // Start with this frame's screen rect, which we will 
     // shrink based on the substring we care about within it.
     // We will then add that frame to the total screenRect we
@@ -879,20 +877,17 @@ nsresult nsHyperTextAccessible::GetTextH
                                               nsAString &aText)
 {
   aText.Truncate();
 
   NS_ENSURE_ARG_POINTER(aStartOffset);
   NS_ENSURE_ARG_POINTER(aEndOffset);
   *aStartOffset = *aEndOffset = 0;
 
-  if (!mDoc)
-    return NS_ERROR_FAILURE;
-
-  nsIPresShell* presShell = mDoc->PresShell();
+  nsCOMPtr<nsIPresShell> presShell = GetPresShell();
   if (!presShell) {
     return NS_ERROR_FAILURE;
   }
 
   if (aOffset == nsIAccessibleText::TEXT_OFFSET_END_OF_TEXT) {
     aOffset = CharacterCount();
   }
   if (aOffset == nsIAccessibleText::TEXT_OFFSET_CARET) {
@@ -1293,20 +1288,17 @@ NS_IMETHODIMP nsHyperTextAccessible::Get
  * Gets the offset of the character located at coordinates x and y. x and y are interpreted as being relative to
  * the screen or this widget's window depending on coords.
  */
 NS_IMETHODIMP
 nsHyperTextAccessible::GetOffsetAtPoint(PRInt32 aX, PRInt32 aY,
                                         PRUint32 aCoordType, PRInt32 *aOffset)
 {
   *aOffset = -1;
-  if (!mDoc)
-    return NS_ERROR_FAILURE;
-
-  nsIPresShell* shell = mDoc->PresShell();
+  nsCOMPtr<nsIPresShell> shell = GetPresShell();
   if (!shell) {
     return NS_ERROR_FAILURE;
   }
   nsIFrame *hyperFrame = GetFrame();
   if (!hyperFrame) {
     return NS_ERROR_FAILURE;
   }
   nsIntRect frameScreenRect = hyperFrame->GetScreenRectExternal();
@@ -1546,22 +1538,24 @@ nsHyperTextAccessible::GetAssociatedEdit
   }
 
   nsCOMPtr<nsIDocShellTreeItem> docShellTreeItem =
     nsCoreUtils::GetDocShellTreeItemFor(mContent);
   nsCOMPtr<nsIEditingSession> editingSession(do_GetInterface(docShellTreeItem));
   if (!editingSession)
     return NS_OK; // No editing session interface
 
-  NS_ENSURE_TRUE(mDoc, NS_ERROR_FAILURE);
-  nsIDocument* docNode = mDoc->GetDocumentNode();
-  NS_ENSURE_TRUE(docNode, NS_ERROR_FAILURE);
+  nsCOMPtr<nsIPresShell> shell = GetPresShell();
+  NS_ENSURE_TRUE(shell, NS_ERROR_FAILURE);
+
+  nsCOMPtr<nsIDocument> doc = shell->GetDocument();
+  NS_ENSURE_TRUE(doc, NS_ERROR_FAILURE);
 
   nsCOMPtr<nsIEditor> editor;
-  return editingSession->GetEditorForWindow(docNode->GetWindow(), aEditor);
+  return editingSession->GetEditorForWindow(doc->GetWindow(), aEditor);
 }
 
 /**
   * =================== Caret & Selection ======================
   */
 
 nsresult
 nsHyperTextAccessible::SetSelectionRange(PRInt32 aStartPos, PRInt32 aEndPos)
@@ -1589,20 +1583,21 @@ nsHyperTextAccessible::SetSelectionRange
     nsCOMPtr<nsIDOMRange> range;
     domSel->GetRangeAt(1, getter_AddRefs(range));
     domSel->RemoveRange(range);
   }
 
   // Now that selection is done, move the focus to the selection.
   nsFocusManager* DOMFocusManager = nsFocusManager::GetFocusManager();
   if (DOMFocusManager) {
-    NS_ENSURE_TRUE(mDoc, NS_ERROR_FAILURE);
-    nsIDocument* docNode = mDoc->GetDocumentNode();
-    NS_ENSURE_TRUE(docNode, NS_ERROR_FAILURE);
-    nsCOMPtr<nsPIDOMWindow> window = docNode->GetWindow();
+    nsCOMPtr<nsIPresShell> shell = GetPresShell();
+    NS_ENSURE_TRUE(shell, NS_ERROR_FAILURE);
+    nsCOMPtr<nsIDocument> doc = shell->GetDocument();
+    NS_ENSURE_TRUE(doc, NS_ERROR_FAILURE);
+    nsCOMPtr<nsPIDOMWindow> window = doc->GetWindow();
     nsCOMPtr<nsIDOMElement> result;
     DOMFocusManager->MoveFocus(window, nsnull, nsIFocusManager::MOVEFOCUS_CARET,
                                nsIFocusManager::FLAG_BYMOVEFOCUS, getter_AddRefs(result));
   }
 
   return NS_OK;
 }
 
--- a/accessible/src/html/nsHyperTextAccessible.h
+++ b/accessible/src/html/nsHyperTextAccessible.h
@@ -71,19 +71,17 @@ const PRUnichar kForcedNewLineChar = '\n
   * Special Accessible that knows how contain both text and embedded objects
   */
 class nsHyperTextAccessible : public nsAccessibleWrap,
                               public nsIAccessibleText,
                               public nsIAccessibleHyperText,
                               public nsIAccessibleEditableText
 {
 public:
-  nsHyperTextAccessible(nsIContent* aContent, nsDocAccessible* aDoc);
-  virtual ~nsHyperTextAccessible() { }
-
+  nsHyperTextAccessible(nsIContent *aContent, nsIWeakReference *aShell);
   NS_DECL_ISUPPORTS_INHERITED
   NS_DECL_NSIACCESSIBLETEXT
   NS_DECL_NSIACCESSIBLEHYPERTEXT
   NS_DECL_NSIACCESSIBLEEDITABLETEXT
   NS_DECLARE_STATIC_IID_ACCESSOR(NS_HYPERTEXTACCESSIBLE_IMPL_CID)
 
   // nsAccessible
   virtual PRInt32 GetLevelInternal();
--- a/accessible/src/mac/mozAccessible.mm
+++ b/accessible/src/mac/mozAccessible.mm
@@ -608,17 +608,17 @@ GetNativeFromGeckoAccessible(nsIAccessib
 - (NSWindow*)window
 {
   NS_OBJC_BEGIN_TRY_ABORT_BLOCK_NIL;
 
   nsAccessibleWrap *accWrap = static_cast<nsAccessibleWrap*>(mGeckoAccessible);
 
   // Get a pointer to the native window (NSWindow) we reside in.
   NSWindow *nativeWindow = nil;
-  nsDocAccessible* docAcc = accWrap->Document();
+  nsDocAccessible* docAcc = accWrap->GetDocAccessible();
   if (docAcc)
     nativeWindow = static_cast<NSWindow*>(docAcc->GetNativeWindow());
 
   NSAssert1(nativeWindow, @"Could not get native window for %@", self);
   return nativeWindow;
 
   NS_OBJC_END_TRY_ABORT_BLOCK_NIL;
 }
--- a/accessible/src/mac/nsAccessNodeWrap.h
+++ b/accessible/src/mac/nsAccessNodeWrap.h
@@ -42,18 +42,18 @@
 
 #ifndef _nsAccessNodeWrap_H_
 #define _nsAccessNodeWrap_H_
 
 #include "nsAccessNode.h"
 
 class nsAccessNodeWrap :  public nsAccessNode
 {
-public:
-  nsAccessNodeWrap(nsIContent* aContent, nsDocAccessible* aDoc);
-  virtual ~nsAccessNodeWrap();
+  public: // construction, destruction
+    nsAccessNodeWrap(nsIContent *aContent, nsIWeakReference *aShell);
+    virtual ~nsAccessNodeWrap();
 
-  static void InitAccessibility();
-  static void ShutdownAccessibility();
+    static void InitAccessibility();
+    static void ShutdownAccessibility();
 };
 
 #endif
 
--- a/accessible/src/mac/nsAccessNodeWrap.mm
+++ b/accessible/src/mac/nsAccessNodeWrap.mm
@@ -47,18 +47,18 @@
  * Class nsAccessNodeWrap
  */
 
 //-----------------------------------------------------
 // construction 
 //-----------------------------------------------------
 
 nsAccessNodeWrap::
-  nsAccessNodeWrap(nsIContent* aContent, nsDocAccessible* aDoc) :
-  nsAccessNode(aContent, aDoc)
+  nsAccessNodeWrap(nsIContent *aContent, nsIWeakReference *aShell) :
+  nsAccessNode(aContent, aShell)
 {
 }
 
 //-----------------------------------------------------
 // destruction
 //-----------------------------------------------------
 nsAccessNodeWrap::~nsAccessNodeWrap()
 {
--- a/accessible/src/mac/nsAccessibleWrap.h
+++ b/accessible/src/mac/nsAccessibleWrap.h
@@ -57,17 +57,17 @@
 
 #if defined(__OBJC__)
 @class mozAccessible;
 #endif
 
 class nsAccessibleWrap : public nsAccessible
 {
 public: // construction, destruction
-  nsAccessibleWrap(nsIContent* aContent, nsDocAccessible* aDoc);
+  nsAccessibleWrap(nsIContent* aContent, nsIWeakReference* aShell);
   virtual ~nsAccessibleWrap();
     
   /**
    * Get the native Obj-C object (mozAccessible).
    */
   NS_IMETHOD GetNativeInterface (void** aOutAccessible);
   
   /**
--- a/accessible/src/mac/nsAccessibleWrap.mm
+++ b/accessible/src/mac/nsAccessibleWrap.mm
@@ -46,18 +46,18 @@
 #import "mozAccessible.h"
 #import "mozActionElements.h"
 #import "mozHTMLAccessible.h"
 #import "mozTextAccessible.h"
 
 using namespace mozilla::a11y;
 
 nsAccessibleWrap::
-  nsAccessibleWrap(nsIContent* aContent, nsDocAccessible* aDoc) :
-  nsAccessible(aContent, aDoc), mNativeObject(nil),  
+  nsAccessibleWrap(nsIContent *aContent, nsIWeakReference *aShell) :
+  nsAccessible(aContent, aShell), mNativeObject(nil),
   mNativeInited(false)
 {
 }
 
 nsAccessibleWrap::~nsAccessibleWrap()
 {
 }
 
--- a/accessible/src/msaa/nsARIAGridAccessibleWrap.h
+++ b/accessible/src/msaa/nsARIAGridAccessibleWrap.h
@@ -48,36 +48,36 @@
 /**
  * IA2 wrapper class for nsARIAGridAccessible implementing IAccessibleTable and
  * IAccessibleTable2 interfaces.
  */
 class nsARIAGridAccessibleWrap : public nsARIAGridAccessible,
                                  public CAccessibleTable
 {
 public:
-  nsARIAGridAccessibleWrap(nsIContent* aContent, nsDocAccessible* aDoc) :
-    nsARIAGridAccessible(aContent, aDoc) {}
+  nsARIAGridAccessibleWrap(nsIContent *aContent, nsIWeakReference *aShell) :
+    nsARIAGridAccessible(aContent, aShell) {}
 
   // IUnknown
   DECL_IUNKNOWN_INHERITED
 
   // nsISupports
   NS_DECL_ISUPPORTS_INHERITED
 };
 
 /**
  * IA2 wrapper class for nsARIAGridCellAccessible implementing
  * IAccessibleTableCell interface.
  */
 class nsARIAGridCellAccessibleWrap : public nsARIAGridCellAccessible,
                                      public CAccessibleTableCell
 {
 public:
-  nsARIAGridCellAccessibleWrap(nsIContent* aContent, nsDocAccessible* aDoc) :
-    nsARIAGridCellAccessible(aContent, aDoc) {}
+  nsARIAGridCellAccessibleWrap(nsIContent *aContent, nsIWeakReference *aShell) :
+    nsARIAGridCellAccessible(aContent, aShell) {}
 
   // IUnknown
   DECL_IUNKNOWN_INHERITED
 
   // nsISupports
   NS_DECL_ISUPPORTS_INHERITED
 };
 
--- a/accessible/src/msaa/nsAccessNodeWrap.cpp
+++ b/accessible/src/msaa/nsAccessNodeWrap.cpp
@@ -65,18 +65,18 @@ using namespace mozilla::a11y;
 
 AccTextChangeEvent* nsAccessNodeWrap::gTextEvent = nsnull;
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsAccessNodeWrap
 ////////////////////////////////////////////////////////////////////////////////
 
 nsAccessNodeWrap::
-  nsAccessNodeWrap(nsIContent* aContent, nsDocAccessible* aDoc) :
-  nsAccessNode(aContent, aDoc)
+  nsAccessNodeWrap(nsIContent *aContent, nsIWeakReference *aShell) :
+  nsAccessNode(aContent, aShell)
 {
 }
 
 nsAccessNodeWrap::~nsAccessNodeWrap()
 {
 }
 
 //-----------------------------------------------------
@@ -407,31 +407,32 @@ ISimpleDOMNode*
 nsAccessNodeWrap::MakeAccessNode(nsINode *aNode)
 {
   if (!aNode)
     return NULL;
 
   nsAccessNodeWrap *newNode = NULL;
 
   ISimpleDOMNode *iNode = NULL;
-  nsAccessible* acc = mDoc->GetAccessible(aNode);
+  nsAccessible *acc =
+    GetAccService()->GetAccessibleInWeakShell(aNode, mWeakShell);
   if (acc) {
     IAccessible *msaaAccessible = nsnull;
     acc->GetNativeInterface((void**)&msaaAccessible); // addrefs
     msaaAccessible->QueryInterface(IID_ISimpleDOMNode, (void**)&iNode); // addrefs
     msaaAccessible->Release(); // Release IAccessible
   }
   else {
     nsCOMPtr<nsIContent> content(do_QueryInterface(aNode));
     if (!content) {
       NS_NOTREACHED("The node is a document which is not accessible!");
       return NULL;
     }
 
-    newNode = new nsAccessNodeWrap(content, mDoc);
+    newNode = new nsAccessNodeWrap(content, mWeakShell);
     if (!newNode)
       return NULL;
 
     newNode->Init();
     iNode = static_cast<ISimpleDOMNode*>(newNode);
     iNode->AddRef();
   }
 
--- a/accessible/src/msaa/nsAccessNodeWrap.h
+++ b/accessible/src/msaa/nsAccessNodeWrap.h
@@ -78,17 +78,17 @@ class nsAccessNodeWrap :  public nsAcces
   public:
     NS_DECL_ISUPPORTS_INHERITED
     NS_DECL_NSIWINACCESSNODE
 
   public: // IServiceProvider
     STDMETHODIMP QueryService(REFGUID guidService, REFIID riid, void** ppv);
 
 public: // construction, destruction
-  nsAccessNodeWrap(nsIContent* aContent, nsDocAccessible* aDoc);
+  nsAccessNodeWrap(nsIContent *aContent, nsIWeakReference *aShell);
   virtual ~nsAccessNodeWrap();
 
     // IUnknown
     STDMETHODIMP QueryInterface(REFIID, void**);
 
   public:
 
     virtual /* [id][propget] */ HRESULT STDMETHODCALLTYPE get_nodeInfo( 
--- a/accessible/src/msaa/nsAccessibleWrap.cpp
+++ b/accessible/src/msaa/nsAccessibleWrap.cpp
@@ -92,18 +92,18 @@ static const PRInt32 kIEnumVariantDiscon
 ////////////////////////////////////////////////////////////////////////////////
 
 ITypeInfo* nsAccessibleWrap::gTypeInfo = NULL;
 
 //-----------------------------------------------------
 // construction
 //-----------------------------------------------------
 nsAccessibleWrap::
-  nsAccessibleWrap(nsIContent* aContent, nsDocAccessible* aDoc) :
-  nsAccessible(aContent, aDoc), mEnumVARIANTPosition(0)
+  nsAccessibleWrap(nsIContent *aContent, nsIWeakReference *aShell) :
+  nsAccessible(aContent, aShell), mEnumVARIANTPosition(0)
 {
 }
 
 //-----------------------------------------------------
 // destruction
 //-----------------------------------------------------
 nsAccessibleWrap::~nsAccessibleWrap()
 {
@@ -1511,17 +1511,17 @@ nsAccessibleWrap::FirePlatformEvent(AccE
   NS_ASSERTION(winLastEntry == kEVENT_LAST_ENTRY,
                "MSAA event map skewed");
 
   PRUint32 winEvent = gWinEventMap[eventType];
   if (!winEvent)
     return NS_OK;
 
   // Means we're not active.
-  NS_ENSURE_TRUE(!IsDefunct(), NS_ERROR_FAILURE);
+  NS_ENSURE_TRUE(mWeakShell, NS_ERROR_FAILURE);
 
   nsAccessible *accessible = aEvent->GetAccessible();
   if (!accessible)
     return NS_OK;
 
   if (eventType == nsIAccessibleEvent::EVENT_TEXT_CARET_MOVED ||
       eventType == nsIAccessibleEvent::EVENT_FOCUS) {
     UpdateSystemCaret();
@@ -1582,46 +1582,44 @@ PRInt32 nsAccessibleWrap::GetChildIDFor(
   // XXX: bug 606080
   return aAccessible ? - NS_PTR_TO_INT32(aAccessible->UniqueID()) : 0;
 }
 
 HWND
 nsAccessibleWrap::GetHWNDFor(nsAccessible *aAccessible)
 {
   if (aAccessible) {
-    nsDocAccessible* document = aAccessible->Document();
-    if(!document)
-      return nsnull;
-
     // Popup lives in own windows, use its HWND until the popup window is
     // hidden to make old JAWS versions work with collapsed comboboxes (see
     // discussion in bug 379678).
     nsIFrame* frame = aAccessible->GetFrame();
     if (frame) {
       nsIWidget* widget = frame->GetNearestWidget();
       if (widget) {
         bool isVisible = false;
         widget->IsVisible(isVisible);
         if (isVisible) {
-          nsCOMPtr<nsIPresShell> shell(document->PresShell());
+          nsCOMPtr<nsIPresShell> shell(aAccessible->GetPresShell());
           nsIViewManager* vm = shell->GetViewManager();
           if (vm) {
             nsCOMPtr<nsIWidget> rootWidget;
             vm->GetRootWidget(getter_AddRefs(rootWidget));
             // Make sure the accessible belongs to popup. If not then use
             // document HWND (which might be different from root widget in the
             // case of window emulation).
             if (rootWidget != widget)
               return static_cast<HWND>(widget->GetNativeData(NS_NATIVE_WINDOW));
           }
         }
       }
     }
 
-    return static_cast<HWND>(document->GetNativeWindow());
+    nsDocAccessible* document = aAccessible->GetDocAccessible();
+    if (document)
+      return static_cast<HWND>(document->GetNativeWindow());
   }
   return nsnull;
 }
 
 HRESULT
 nsAccessibleWrap::ConvertToIA2Attributes(nsIPersistentProperties *aAttributes,
                                          BSTR *aIA2Attributes)
 {
@@ -1739,17 +1737,17 @@ nsAccessibleWrap::GetXPAccessibleFor(con
     void* uniqueID = reinterpret_cast<void*>(-aVarChild.lVal);
 
     // Document.
     if (IsDoc())
       return AsDoc()->GetAccessibleByUniqueIDInSubtree(uniqueID);
 
     // ARIA document.
     if (ARIARole() == roles::DOCUMENT) {
-      nsDocAccessible* document = Document();
+      nsDocAccessible* document = GetDocAccessible();
       nsAccessible* child =
         document->GetAccessibleByUniqueIDInSubtree(uniqueID);
 
       // Check whether the accessible for the given ID is a child of ARIA
       // document.
       nsAccessible* parent = child ? child->Parent() : nsnull;
       while (parent && parent != document) {
         if (parent == this)
--- a/accessible/src/msaa/nsAccessibleWrap.h
+++ b/accessible/src/msaa/nsAccessibleWrap.h
@@ -99,17 +99,17 @@ Class::QueryInterface(REFIID iid, void**
 class nsAccessibleWrap : public nsAccessible,
                          public CAccessibleComponent,
                          public CAccessibleHyperlink,
                          public CAccessibleValue,
                          public IAccessible2,
                          public IEnumVARIANT
 {
 public: // construction, destruction
-  nsAccessibleWrap(nsIContent* aContent, nsDocAccessible* aDoc);
+  nsAccessibleWrap(nsIContent *aContent, nsIWeakReference *aShell);
   virtual ~nsAccessibleWrap();
 
     // nsISupports
     NS_DECL_ISUPPORTS_INHERITED
 
   public: // IUnknown methods - see iunknown.h for documentation
     STDMETHODIMP QueryInterface(REFIID, void**);
 
--- a/accessible/src/msaa/nsHTMLImageAccessibleWrap.h
+++ b/accessible/src/msaa/nsHTMLImageAccessibleWrap.h
@@ -43,18 +43,18 @@
 
 #include "nsHTMLImageAccessible.h"
 #include "CAccessibleImage.h"
 
 class nsHTMLImageAccessibleWrap : public nsHTMLImageAccessible,
                                   public CAccessibleImage
 {
 public:
-  nsHTMLImageAccessibleWrap(nsIContent* aContent, nsDocAccessible* aDoc) :
-    nsHTMLImageAccessible(aContent, aDoc) {}
+  nsHTMLImageAccessibleWrap(nsIContent *aContent, nsIWeakReference *aShell) :
+    nsHTMLImageAccessible(aContent, aShell) {}
 
   // IUnknown
   DECL_IUNKNOWN_INHERITED
 
   // nsISupports
   NS_DECL_ISUPPORTS_INHERITED
 };
 
--- a/accessible/src/msaa/nsHTMLTableAccessibleWrap.h
+++ b/accessible/src/msaa/nsHTMLTableAccessibleWrap.h
@@ -49,18 +49,18 @@
 /**
  * IA2 wrapper class for nsHTMLTableAccessible implementing IAccessibleTable
  * and IAccessibleTable2 interfaces.
  */
 class nsHTMLTableAccessibleWrap : public nsHTMLTableAccessible,
                                   public CAccessibleTable
 {
 public:
-  nsHTMLTableAccessibleWrap(nsIContent* aContent, nsDocAccessible* aDoc) :
-    nsHTMLTableAccessible(aContent, aDoc) {}
+  nsHTMLTableAccessibleWrap(nsIContent *aContent, nsIWeakReference *aShell) :
+    nsHTMLTableAccessible(aContent, aShell) {}
 
   // IUnknown
   DECL_IUNKNOWN_INHERITED
 
   // nsISupports
   NS_DECL_ISUPPORTS_INHERITED
 };
 
@@ -68,18 +68,18 @@ public:
 /**
  * IA2 wrapper class for nsHTMLTableCellAccessible implementing
  * IAccessibleTableCell interface.
  */
 class nsHTMLTableCellAccessibleWrap : public nsHTMLTableCellAccessible,
                                       public CAccessibleTableCell
 {
 public:
-  nsHTMLTableCellAccessibleWrap(nsIContent* aContent, nsDocAccessible* aDoc) :
-    nsHTMLTableCellAccessible(aContent, aDoc) {}
+  nsHTMLTableCellAccessibleWrap(nsIContent *aContent, nsIWeakReference *aShell) :
+    nsHTMLTableCellAccessible(aContent, aShell) {}
 
   // IUnknown
   DECL_IUNKNOWN_INHERITED
 
   // nsISupports
   NS_DECL_ISUPPORTS_INHERITED
 };
 
@@ -87,19 +87,19 @@ public:
 /**
  * IA2 wrapper class for nsHTMLTableHeaderCellAccessible implementing
  * IAccessibleTableCell interface.
  */
 class nsHTMLTableHeaderCellAccessibleWrap : public nsHTMLTableHeaderCellAccessible,
                                             public CAccessibleTableCell
 {
 public:
-  nsHTMLTableHeaderCellAccessibleWrap(nsIContent* aContent,
-                                      nsDocAccessible* aDoc) :
-    nsHTMLTableHeaderCellAccessible(aContent, aDoc) {}
+  nsHTMLTableHeaderCellAccessibleWrap(nsIContent *aContent,
+                                      nsIWeakReference *aShell) :
+    nsHTMLTableHeaderCellAccessible(aContent, aShell) {}
 
   // IUnknown
   DECL_IUNKNOWN_INHERITED
 
   // nsISupports
   NS_DECL_ISUPPORTS_INHERITED
 };
 
--- a/accessible/src/msaa/nsHTMLWin32ObjectAccessible.cpp
+++ b/accessible/src/msaa/nsHTMLWin32ObjectAccessible.cpp
@@ -43,19 +43,19 @@
 
 using namespace mozilla::a11y;
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsHTMLWin32ObjectOwnerAccessible
 ////////////////////////////////////////////////////////////////////////////////
 
 nsHTMLWin32ObjectOwnerAccessible::
-  nsHTMLWin32ObjectOwnerAccessible(nsIContent* aContent,
-                                   nsDocAccessible* aDoc, void* aHwnd) :
-  nsAccessibleWrap(aContent, aDoc), mHwnd(aHwnd)
+  nsHTMLWin32ObjectOwnerAccessible(nsIContent *aContent,
+                                   nsIWeakReference *aShell, void *aHwnd) :
+  nsAccessibleWrap(aContent, aShell), mHwnd(aHwnd)
 {
   // Our only child is a nsHTMLWin32ObjectAccessible object.
   mNativeAccessible = new nsHTMLWin32ObjectAccessible(mHwnd);
 }
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsHTMLWin32ObjectOwnerAccessible: nsAccessNode implementation
 
--- a/accessible/src/msaa/nsHTMLWin32ObjectAccessible.h
+++ b/accessible/src/msaa/nsHTMLWin32ObjectAccessible.h
@@ -48,18 +48,18 @@ class nsHTMLWin32ObjectOwnerAccessible :
 {
 public:
   // This will own the nsHTMLWin32ObjectAccessible. We create this where the
   // <object> or <embed> exists in the tree, so that get_accNextSibling() etc.
   // will still point to Gecko accessible sibling content. This is necessary
   // because the native plugin accessible doesn't know where it exists in the
   // Mozilla tree, and returns null for previous and next sibling. This would
   // have the effect of cutting off all content after the plugin.
-  nsHTMLWin32ObjectOwnerAccessible(nsIContent* aContent,
-                                   nsDocAccessible* aDoc, void* aHwnd);
+  nsHTMLWin32ObjectOwnerAccessible(nsIContent *aContent,
+                                   nsIWeakReference *aShell, void *aHwnd);
   virtual ~nsHTMLWin32ObjectOwnerAccessible() {}
 
   // nsAccessNode
   virtual void Shutdown();
 
   // nsAccessible
   virtual mozilla::a11y::role NativeRole();
   virtual PRUint64 NativeState();
--- a/accessible/src/msaa/nsHyperTextAccessibleWrap.h
+++ b/accessible/src/msaa/nsHyperTextAccessibleWrap.h
@@ -46,18 +46,18 @@
 #include "CAccessibleEditableText.h"
 #include "CAccessibleHyperText.h"
 
 class nsHyperTextAccessibleWrap : public nsHyperTextAccessible,
                                   public CAccessibleHypertext,
                                   public CAccessibleEditableText
 {
 public:
-  nsHyperTextAccessibleWrap(nsIContent* aContent, nsDocAccessible* aDoc) :
-    nsHyperTextAccessible(aContent, aDoc) {}
+  nsHyperTextAccessibleWrap(nsIContent *aContent, nsIWeakReference *aShell) :
+    nsHyperTextAccessible(aContent, aShell) {}
 
   // IUnknown
   DECL_IUNKNOWN_INHERITED
 
   // nsISupports
   NS_DECL_ISUPPORTS_INHERITED
 
   // nsAccessible
--- a/accessible/src/msaa/nsTextAccessibleWrap.cpp
+++ b/accessible/src/msaa/nsTextAccessibleWrap.cpp
@@ -51,18 +51,18 @@
 
 using namespace mozilla::a11y;
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsTextAccessibleWrap Accessible
 ////////////////////////////////////////////////////////////////////////////////
 
 nsTextAccessibleWrap::
-  nsTextAccessibleWrap(nsIContent* aContent, nsDocAccessible* aDoc) :
-  nsTextAccessible(aContent, aDoc)
+  nsTextAccessibleWrap(nsIContent *aContent, nsIWeakReference *aShell) :
+  nsTextAccessible(aContent, aShell)
 {
 }
 
 STDMETHODIMP_(ULONG) nsTextAccessibleWrap::AddRef()
 {
   return nsAccessNode::AddRef();
 }
 
@@ -124,17 +124,17 @@ STDMETHODIMP nsTextAccessibleWrap::get_c
 __try {
   *aX = *aY = *aWidth = *aHeight = 0;
   nscoord x, y, width, height, docX, docY, docWidth, docHeight;
   HRESULT rv = get_unclippedSubstringBounds(aStartIndex, aEndIndex, &x, &y, &width, &height);
   if (FAILED(rv)) {
     return rv;
   }
 
-  nsDocAccessible* docAccessible = Document();
+  nsDocAccessible *docAccessible = GetDocAccessible();
   NS_ASSERTION(docAccessible,
                "There must always be a doc accessible, but there isn't. Crash!");
 
   docAccessible->GetBounds(&docX, &docY, &docWidth, &docHeight);
 
   nsIntRect unclippedRect(x, y, width, height);
   nsIntRect docRect(docX, docY, docWidth, docHeight);
   nsIntRect clippedRect;
--- a/accessible/src/msaa/nsTextAccessibleWrap.h
+++ b/accessible/src/msaa/nsTextAccessibleWrap.h
@@ -45,17 +45,17 @@
 
 class nsIFrame;
 class nsRenderingContext;
 
 class nsTextAccessibleWrap : public nsTextAccessible, 
                              public ISimpleDOMText
 {
 public:
-  nsTextAccessibleWrap(nsIContent* aContent, nsDocAccessible* aDoc);
+  nsTextAccessibleWrap(nsIContent *aContent, nsIWeakReference *aShell);
   virtual ~nsTextAccessibleWrap() {}
 
     // IUnknown methods - see iunknown.h for documentation
     STDMETHODIMP_(ULONG) AddRef();
     STDMETHODIMP_(ULONG) Release();
     STDMETHODIMP QueryInterface(REFIID, void**);
 
     virtual /* [propget] */ HRESULT STDMETHODCALLTYPE get_domText( 
--- a/accessible/src/msaa/nsXULListboxAccessibleWrap.cpp
+++ b/accessible/src/msaa/nsXULListboxAccessibleWrap.cpp
@@ -38,18 +38,18 @@
 
 #include "nsXULListboxAccessibleWrap.h"
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsXULListboxAccessibleWrap
 ////////////////////////////////////////////////////////////////////////////////
 
 nsXULListboxAccessibleWrap::
-  nsXULListboxAccessibleWrap(nsIContent* aContent, nsDocAccessible* aDoc) :
-  nsXULListboxAccessible(aContent, aDoc)
+  nsXULListboxAccessibleWrap(nsIContent *aContent, nsIWeakReference *aShell) :
+  nsXULListboxAccessible(aContent, aShell)
 {
 }
 
 NS_IMPL_ISUPPORTS_INHERITED0(nsXULListboxAccessibleWrap,
                              nsXULListboxAccessible)
 
 IMPL_IUNKNOWN_QUERY_HEAD(nsXULListboxAccessibleWrap)
 IMPL_IUNKNOWN_QUERY_ENTRY_COND(CAccessibleTable, IsMulticolumn());
@@ -57,18 +57,18 @@ IMPL_IUNKNOWN_QUERY_ENTRY(nsAccessibleWr
 IMPL_IUNKNOWN_QUERY_TAIL
 
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsXULListCellAccessibleWrap
 ////////////////////////////////////////////////////////////////////////////////
 
 nsXULListCellAccessibleWrap::
-  nsXULListCellAccessibleWrap(nsIContent* aContent, nsDocAccessible* aDoc) :
-  nsXULListCellAccessible(aContent, aDoc)
+  nsXULListCellAccessibleWrap(nsIContent *aContent, nsIWeakReference *aShell) :
+  nsXULListCellAccessible(aContent, aShell)
 {
 }
 
 NS_IMPL_ISUPPORTS_INHERITED0(nsXULListCellAccessibleWrap,
                              nsXULListCellAccessible)
 
 IMPL_IUNKNOWN_INHERITED1(nsXULListCellAccessibleWrap,
                          nsHyperTextAccessibleWrap,
--- a/accessible/src/msaa/nsXULListboxAccessibleWrap.h
+++ b/accessible/src/msaa/nsXULListboxAccessibleWrap.h
@@ -47,34 +47,34 @@
 /**
  * IA2 wrapper class for nsXULListboxAccessible class implementing
  * IAccessibleTable and IAccessibleTable2 interfaces.
  */
 class nsXULListboxAccessibleWrap : public nsXULListboxAccessible,
                                    public CAccessibleTable
 {
 public:
-  nsXULListboxAccessibleWrap(nsIContent* aContent, nsDocAccessible* aDoc);
+  nsXULListboxAccessibleWrap(nsIContent *aContent, nsIWeakReference *aShell);
 
   // IUnknown
   DECL_IUNKNOWN_INHERITED
 
   // nsISupports
   NS_DECL_ISUPPORTS_INHERITED
 };
 
 /**
  * IA2 wrapper class for nsXULListCellAccessible class, implements
  * IAccessibleTableCell interface.
  */
 class nsXULListCellAccessibleWrap : public nsXULListCellAccessible,
                                     public CAccessibleTableCell
 {
 public:
-  nsXULListCellAccessibleWrap(nsIContent* aContent, nsDocAccessible* aDoc);
+  nsXULListCellAccessibleWrap(nsIContent *aContent, nsIWeakReference *aShell);
 
   // IUnknown
   DECL_IUNKNOWN_INHERITED
 
   // nsISupports
   NS_DECL_ISUPPORTS_INHERITED
 };
 
--- a/accessible/src/msaa/nsXULMenuAccessibleWrap.cpp
+++ b/accessible/src/msaa/nsXULMenuAccessibleWrap.cpp
@@ -38,18 +38,18 @@
 #include "nsXULMenuAccessibleWrap.h"
 #include "nsINameSpaceManager.h"
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsXULMenuAccessibleWrap
 ////////////////////////////////////////////////////////////////////////////////
 
 nsXULMenuitemAccessibleWrap::
-  nsXULMenuitemAccessibleWrap(nsIContent* aContent, nsDocAccessible* aDoc) :
-  nsXULMenuitemAccessible(aContent, aDoc)
+  nsXULMenuitemAccessibleWrap(nsIContent *aContent, nsIWeakReference *aShell) :
+  nsXULMenuitemAccessible(aContent, aShell)
 {
 }
 
 NS_IMETHODIMP
 nsXULMenuitemAccessibleWrap::GetName(nsAString& aName)
 {
   // XXX This should be done in get_accName() so that nsIAccessible::GetName()]
   // provides the same results on all platforms
--- a/accessible/src/msaa/nsXULMenuAccessibleWrap.h
+++ b/accessible/src/msaa/nsXULMenuAccessibleWrap.h
@@ -38,16 +38,16 @@
 #ifndef __nsXULMenuAccessibleWrap_h__
 #define __nsXULMenuAccessibleWrap_h__
 
 #include "nsXULMenuAccessible.h"
 
 class nsXULMenuitemAccessibleWrap : public nsXULMenuitemAccessible
 {
 public:
-  nsXULMenuitemAccessibleWrap(nsIContent* aContent, nsDocAccessible* aDoc);
+  nsXULMenuitemAccessibleWrap(nsIContent *aContent, nsIWeakReference *aShell);
   virtual ~nsXULMenuitemAccessibleWrap() {}
 
   // nsIAccessible
   NS_IMETHOD GetName(nsAString& aName);
 };
 
 #endif
--- a/accessible/src/msaa/nsXULTreeGridAccessibleWrap.cpp
+++ b/accessible/src/msaa/nsXULTreeGridAccessibleWrap.cpp
@@ -39,41 +39,41 @@
 
 #include "nsXULTreeGridAccessibleWrap.h"
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsXULTreeGridAccessibleWrap
 ////////////////////////////////////////////////////////////////////////////////
 
 nsXULTreeGridAccessibleWrap::
-  nsXULTreeGridAccessibleWrap(nsIContent* aContent, nsDocAccessible* aDoc) :
-  nsXULTreeGridAccessible(aContent, aDoc)
+  nsXULTreeGridAccessibleWrap(nsIContent *aContent, nsIWeakReference *aShell) :
+  nsXULTreeGridAccessible(aContent, aShell)
 {
 }
 
 NS_IMPL_ISUPPORTS_INHERITED0(nsXULTreeGridAccessibleWrap,
                              nsXULTreeGridAccessible)
 
 IMPL_IUNKNOWN_INHERITED1(nsXULTreeGridAccessibleWrap,
                          nsAccessibleWrap,
                          CAccessibleTable)
 
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsXULTreeGridCellAccessibleWrap
 ////////////////////////////////////////////////////////////////////////////////
 
 nsXULTreeGridCellAccessibleWrap::
-  nsXULTreeGridCellAccessibleWrap(nsIContent* aContent,
-                                  nsDocAccessible* aDoc,
-                                  nsXULTreeGridRowAccessible* aRowAcc,
-                                  nsITreeBoxObject* aTree,
-                                  nsITreeView* aTreeView,
+  nsXULTreeGridCellAccessibleWrap(nsIContent *aContent,
+                                  nsIWeakReference *aShell,
+                                  nsXULTreeGridRowAccessible *aRowAcc,
+                                  nsITreeBoxObject *aTree,
+                                  nsITreeView *aTreeView,
                                   PRInt32 aRow, nsITreeColumn* aColumn) :
-  nsXULTreeGridCellAccessible(aContent, aDoc, aRowAcc, aTree, aTreeView,
+  nsXULTreeGridCellAccessible(aContent, aShell, aRowAcc, aTree, aTreeView,
                               aRow, aColumn)
 {
 }
 
 NS_IMPL_ISUPPORTS_INHERITED0(nsXULTreeGridCellAccessibleWrap,
                              nsXULTreeGridCellAccessible)
 
 IMPL_IUNKNOWN_INHERITED1(nsXULTreeGridCellAccessibleWrap,
--- a/accessible/src/msaa/nsXULTreeGridAccessibleWrap.h
+++ b/accessible/src/msaa/nsXULTreeGridAccessibleWrap.h
@@ -48,38 +48,38 @@
 /**
  * IA2 wrapper class for nsXULTreeGridAccessible class implementing
  * IAccessibleTable and IAccessibleTable2 interfaces.
  */
 class nsXULTreeGridAccessibleWrap : public nsXULTreeGridAccessible,
                                     public CAccessibleTable
 {
 public:
-  nsXULTreeGridAccessibleWrap(nsIContent* aContent, nsDocAccessible* aDoc);
+  nsXULTreeGridAccessibleWrap(nsIContent *aContent, nsIWeakReference *aShell);
 
   // IUnknown
   DECL_IUNKNOWN_INHERITED
 
   // nsISupports
   NS_DECL_ISUPPORTS_INHERITED
 };
 
 /**
  * IA2 wrapper class for nsXULTreeGridCellAccessible class, implements
  * IAccessibleTableCell interface.
  */
 class nsXULTreeGridCellAccessibleWrap : public nsXULTreeGridCellAccessible,
                                         public CAccessibleTableCell
 {
 public:
-  nsXULTreeGridCellAccessibleWrap(nsIContent* aContent,
-                                  nsDocAccessible* aDoc,
-                                  nsXULTreeGridRowAccessible* aRowAcc,
-                                  nsITreeBoxObject* aTree,
-                                  nsITreeView* aTreeView,
+  nsXULTreeGridCellAccessibleWrap(nsIContent *aContent,
+                                  nsIWeakReference *aShell,
+                                  nsXULTreeGridRowAccessible *aRowAcc,
+                                  nsITreeBoxObject *aTree,
+                                  nsITreeView *aTreeView,
                                   PRInt32 aRow, nsITreeColumn* aColumn);
 
   // IUnknown
   DECL_IUNKNOWN_INHERITED
 
   // nsISupports
   NS_DECL_ISUPPORTS_INHERITED
 };
--- a/accessible/src/other/nsAccessNodeWrap.cpp
+++ b/accessible/src/other/nsAccessNodeWrap.cpp
@@ -47,18 +47,18 @@
 // Class nsAccessNodeWrap
 ////////////////////////////////////////////////////////////////////////////////
 
 //-----------------------------------------------------
 // construction 
 //-----------------------------------------------------
 
 nsAccessNodeWrap::
-  nsAccessNodeWrap(nsIContent* aContent, nsDocAccessible* aDoc) :
-  nsAccessNode(aContent, aDoc)
+  nsAccessNodeWrap(nsIContent *aContent, nsIWeakReference* aShell) :
+  nsAccessNode(aContent, aShell)
 {
 }
 
 //-----------------------------------------------------
 // destruction
 //-----------------------------------------------------
 nsAccessNodeWrap::~nsAccessNodeWrap()
 {
--- a/accessible/src/other/nsAccessNodeWrap.h
+++ b/accessible/src/other/nsAccessNodeWrap.h
@@ -43,17 +43,17 @@
 #ifndef _nsAccessNodeWrap_H_
 #define _nsAccessNodeWrap_H_
 
 #include "nsAccessNode.h"
 
 class nsAccessNodeWrap :  public nsAccessNode
 {
 public: // construction, destruction
-  nsAccessNodeWrap(nsIContent* aContent, nsDocAccessible* aDoc);
+  nsAccessNodeWrap(nsIContent *aContent, nsIWeakReference* aShell);
   virtual ~nsAccessNodeWrap();
 
     static void InitAccessibility();
     static void ShutdownAccessibility();
 };
 
 #endif
 
--- a/accessible/src/other/nsAccessibleWrap.cpp
+++ b/accessible/src/other/nsAccessibleWrap.cpp
@@ -37,18 +37,18 @@
  * ***** END LICENSE BLOCK ***** */
 
 #include "nsAccessibleWrap.h"
 
 //-----------------------------------------------------
 // construction 
 //-----------------------------------------------------
 nsAccessibleWrap::
-  nsAccessibleWrap(nsIContent* aContent, nsDocAccessible* aDoc) :
-  nsAccessible(aContent, aDoc)
+  nsAccessibleWrap(nsIContent *aContent, nsIWeakReference *aShell) :
+  nsAccessible(aContent, aShell)
 {
 }
 
 //-----------------------------------------------------
 // destruction
 //-----------------------------------------------------
 nsAccessibleWrap::~nsAccessibleWrap()
 {
--- a/accessible/src/other/nsAccessibleWrap.h
+++ b/accessible/src/other/nsAccessibleWrap.h
@@ -44,17 +44,17 @@
 #define _nsAccessibleWrap_H_
 
 #include "nsCOMPtr.h"
 #include "nsAccessible.h"
 
 class nsAccessibleWrap : public nsAccessible
 {
 public: // construction, destruction
-  nsAccessibleWrap(nsIContent* aContent, nsDocAccessible* aDoc);
+  nsAccessibleWrap(nsIContent *aContent, nsIWeakReference *aShell);
   virtual ~nsAccessibleWrap();
 
   protected:
     virtual nsresult FirePlatformEvent(AccEvent* aEvent)
     {
       return NS_OK;
     }
 };
--- a/accessible/src/xforms/nsXFormsAccessible.cpp
+++ b/accessible/src/xforms/nsXFormsAccessible.cpp
@@ -35,17 +35,16 @@
  * the terms of any one of the MPL, the GPL or the LGPL.
  *
  * ***** END LICENSE BLOCK ***** */
 
 #include "nsXFormsAccessible.h"
 
 #include "nsAccessibilityService.h"
 #include "nsAccUtils.h"
-#include "nsDocAccessible.h"
 #include "nsTextEquivUtils.h"
 #include "Role.h"
 #include "States.h"
 
 #include "nscore.h"
 #include "nsServiceManagerUtils.h"
 #include "nsIDOMElement.h"
 #include "nsIDOMNodeList.h"
@@ -73,18 +72,18 @@ nsXFormsAccessibleBase::nsXFormsAccessib
   }
 }
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsXFormsAccessible
 ////////////////////////////////////////////////////////////////////////////////
 
 nsXFormsAccessible::
-  nsXFormsAccessible(nsIContent* aContent, nsDocAccessible* aDoc) :
-  nsHyperTextAccessibleWrap(aContent, aDoc)
+nsXFormsAccessible(nsIContent *aContent, nsIWeakReference *aShell) :
+  nsHyperTextAccessibleWrap(aContent, aShell)
 {
 }
 
 nsresult
 nsXFormsAccessible::GetBoundChildElementValue(const nsAString& aTagName,
                                               nsAString& aValue)
 {
   NS_ENSURE_TRUE(sXFormsService, NS_ERROR_FAILURE);
@@ -119,30 +118,30 @@ nsXFormsAccessible::CacheSelectChildren(
     container = do_QueryInterface(mContent);
 
   nsCOMPtr<nsIDOMNodeList> children;
   sXFormsService->GetSelectChildrenFor(container, getter_AddRefs(children));
 
   if (!children)
     return;
 
-  nsIPresShell* presShell(mDoc->PresShell());
+  nsCOMPtr<nsIPresShell> presShell(do_QueryReferent(mWeakShell));
 
   PRUint32 length = 0;
   children->GetLength(&length);
 
   for (PRUint32 index = 0; index < length; index++) {
     nsCOMPtr<nsIDOMNode> DOMChild;
     children->Item(index, getter_AddRefs(DOMChild));
     if (!DOMChild)
       continue;
 
     nsCOMPtr<nsIContent> child(do_QueryInterface(DOMChild));
     nsAccessible* accessible =
-      GetAccService()->GetOrCreateAccessible(child, presShell, mDoc->GetWeakShell());
+      GetAccService()->GetOrCreateAccessible(child, presShell, mWeakShell);
     if (!accessible)
       continue;
 
     AppendChild(accessible);
   }
 }
 
 // nsIAccessible
@@ -220,18 +219,18 @@ nsXFormsAccessible::GetAllowsAnonChildAc
 }
 
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsXFormsContainerAccessible
 ////////////////////////////////////////////////////////////////////////////////
 
 nsXFormsContainerAccessible::
-  nsXFormsContainerAccessible(nsIContent* aContent, nsDocAccessible* aDoc) :
-  nsXFormsAccessible(aContent, aDoc)
+  nsXFormsContainerAccessible(nsIContent *aContent, nsIWeakReference *aShell) :
+  nsXFormsAccessible(aContent, aShell)
 {
 }
 
 role
 nsXFormsContainerAccessible::NativeRole()
 {
   return roles::GROUPING;
 }
@@ -243,18 +242,18 @@ nsXFormsContainerAccessible::GetAllowsAn
 }
 
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsXFormsEditableAccessible
 ////////////////////////////////////////////////////////////////////////////////
 
 nsXFormsEditableAccessible::
-  nsXFormsEditableAccessible(nsIContent* aContent, nsDocAccessible* aDoc) :
-  nsXFormsAccessible(aContent, aDoc)
+  nsXFormsEditableAccessible(nsIContent *aContent, nsIWeakReference *aShell) :
+  nsXFormsAccessible(aContent, aShell)
 {
 }
 
 PRUint64
 nsXFormsEditableAccessible::NativeState()
 {
   PRUint64 state = nsXFormsAccessible::NativeState();
 
@@ -293,18 +292,18 @@ nsXFormsEditableAccessible::GetAssociate
   return sXFormsService->GetEditor(DOMNode, aEditor);
 }
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsXFormsSelectableAccessible
 ////////////////////////////////////////////////////////////////////////////////
 
 nsXFormsSelectableAccessible::
-  nsXFormsSelectableAccessible(nsIContent* aContent, nsDocAccessible* aDoc) :
-  nsXFormsEditableAccessible(aContent, aDoc), mIsSelect1Element(nsnull)
+  nsXFormsSelectableAccessible(nsIContent *aContent, nsIWeakReference *aShell) :
+  nsXFormsEditableAccessible(aContent, aShell), mIsSelect1Element(nsnull)
 {
   mIsSelect1Element =
     mContent->NodeInfo()->Equals(nsGkAtoms::select1);
 }
 
 bool
 nsXFormsSelectableAccessible::IsSelect()
 {
@@ -321,46 +320,47 @@ nsXFormsSelectableAccessible::SelectedIt
 
   nsresult rv;
   nsCOMPtr<nsIDOMNode> DOMNode(do_QueryInterface(mContent));
 
   if (mIsSelect1Element) {
     nsCOMPtr<nsIDOMNode> itemDOMNode;
     rv = sXFormsService->GetSelectedItemForSelect1(DOMNode,
                                                    getter_AddRefs(itemDOMNode));
-    if (NS_FAILED(rv) || !itemDOMNode || !mDoc)
+    if (NS_FAILED(rv) || !itemDOMNode)
       return nsnull;
 
     nsCOMPtr<nsINode> itemNode(do_QueryInterface(itemDOMNode));
-    nsIAccessible* item = mDoc->GetAccessible(itemNode);
+    nsIAccessible* item = GetAccService()->GetAccessibleInWeakShell(itemNode,
+                                                                    mWeakShell);
     if (item)
       selectedItems->AppendElement(item, false);
 
     nsIMutableArray* items = nsnull;
     selectedItems.forget(&items);
     return items;
   }
 
   nsCOMPtr<nsIDOMNodeList> itemNodeList;
   rv = sXFormsService->GetSelectedItemsForSelect(DOMNode,
                                                  getter_AddRefs(itemNodeList));
-  if (NS_FAILED(rv) || !itemNodeList || !mDoc)
+  if (NS_FAILED(rv) || !itemNodeList)
     return nsnull;
 
   PRUint32 length = 0;
   itemNodeList->GetLength(&length);
-
   for (PRUint32 index = 0; index < length; index++) {
     nsCOMPtr<nsIDOMNode> itemDOMNode;
     itemNodeList->Item(index, getter_AddRefs(itemDOMNode));
     if (!itemDOMNode)
       return nsnull;
 
     nsCOMPtr<nsINode> itemNode(do_QueryInterface(itemDOMNode));
-    nsIAccessible* item = mDoc->GetAccessible(itemNode);
+    nsIAccessible* item = GetAccService()->GetAccessibleInWeakShell(itemNode,
+                                                                    mWeakShell);
     if (item)
       selectedItems->AppendElement(item, false);
   }
 
   nsIMutableArray* items = nsnull;
   selectedItems.forget(&items);
   return items;
 }
@@ -425,46 +425,43 @@ nsXFormsSelectableAccessible::RemoveItem
 
   sXFormsService->RemoveItemFromSelectionForSelect(DOMNode, itemDOMNode);
   return true;
 }
 
 nsAccessible*
 nsXFormsSelectableAccessible::GetSelectedItem(PRUint32 aIndex)
 {
-  if (!mDoc)
-    return nsnull;
-
   nsresult rv;
   nsCOMPtr<nsIDOMNode> DOMNode(do_QueryInterface(mContent));
   if (mIsSelect1Element) {
     if (aIndex != 0)
       return nsnull;
 
     nsCOMPtr<nsIDOMNode> itemDOMNode;
     rv = sXFormsService->GetSelectedItemForSelect1(DOMNode,
                                                    getter_AddRefs(itemDOMNode));
     if (NS_SUCCEEDED(rv) && itemDOMNode) {
       nsCOMPtr<nsINode> itemNode(do_QueryInterface(itemDOMNode));
-      return mDoc->GetAccessible(itemNode);
+      return GetAccService()->GetAccessibleInWeakShell(itemNode, mWeakShell);
     }
     return nsnull;
   }
 
   nsCOMPtr<nsIDOMNodeList> itemNodeList;
   rv = sXFormsService->GetSelectedItemsForSelect(DOMNode,
                                                  getter_AddRefs(itemNodeList));
   if (NS_FAILED(rv) || !itemNodeList)
     return nsnull;
 
   nsCOMPtr<nsIDOMNode> itemDOMNode;
   itemNodeList->Item(aIndex, getter_AddRefs(itemDOMNode));
 
   nsCOMPtr<nsINode> itemNode(do_QueryInterface(itemDOMNode));
-  return mDoc->GetAccessible(itemNode);
+  return GetAccService()->GetAccessibleInWeakShell(itemNode, mWeakShell);
 }
 
 bool
 nsXFormsSelectableAccessible::IsItemSelected(PRUint32 aIndex)
 {
   nsCOMPtr<nsIDOMNode> itemDOMNode(do_QueryInterface(GetItemByIndex(&aIndex)));
   if (!itemDOMNode)
     return false;
@@ -532,19 +529,19 @@ nsXFormsSelectableAccessible::GetItemByI
 }
 
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsXFormsSelectableItemAccessible
 ////////////////////////////////////////////////////////////////////////////////
 
 nsXFormsSelectableItemAccessible::
-  nsXFormsSelectableItemAccessible(nsIContent* aContent,
-                                   nsDocAccessible* aDoc) :
-  nsXFormsAccessible(aContent, aDoc)
+  nsXFormsSelectableItemAccessible(nsIContent *aContent,
+                                   nsIWeakReference *aShell) :
+  nsXFormsAccessible(aContent, aShell)
 {
 }
 
 NS_IMETHODIMP
 nsXFormsSelectableItemAccessible::GetValue(nsAString& aValue)
 {
   nsCOMPtr<nsIDOMNode> DOMNode(do_QueryInterface(mContent));
   return sXFormsService->GetValue(DOMNode, aValue);
--- a/accessible/src/xforms/nsXFormsAccessible.h
+++ b/accessible/src/xforms/nsXFormsAccessible.h
@@ -65,17 +65,17 @@ protected:
  * Every XForms element that is bindable to XForms model or is able to contain
  * XForms hint and XForms label elements should have accessible object. This
  * class is base class for accessible objects for these XForms elements.
  */
 class nsXFormsAccessible : public nsHyperTextAccessibleWrap,
                            public nsXFormsAccessibleBase
 {
 public:
-  nsXFormsAccessible(nsIContent* aContent, nsDocAccessible* aDoc);
+  nsXFormsAccessible(nsIContent *aContent, nsIWeakReference *aShell);
 
   // nsIAccessible
 
   // Returns value of instance node that xforms element is bound to.
   NS_IMETHOD GetValue(nsAString& aValue);
 
   // nsAccessible
   // Returns value of child xforms 'hint' element.
@@ -119,17 +119,17 @@ protected:
  * to choose month. It has an entryfield, a drop-down button and a drop-down
  * list, all of which need to be accessible. Another example would be
  * an XForms upload element since it is constructed from textfield and
  * 'pick up file' and 'clear file' buttons.
  */
 class nsXFormsContainerAccessible : public nsXFormsAccessible
 {
 public:
-  nsXFormsContainerAccessible(nsIContent* aContent, nsDocAccessible* aDoc);
+  nsXFormsContainerAccessible(nsIContent *aContent, nsIWeakReference *aShell);
 
   // nsAccessible
   virtual mozilla::a11y::role NativeRole();
 
   // Allows accessible nodes in anonymous content of xforms element by
   // always returning true value.
   virtual bool GetAllowsAnonChildAccessibles();
 };
@@ -137,34 +137,34 @@ public:
 
 /**
  * The class is base for accessible objects for XForms elements that have
  * editable area.
  */
 class nsXFormsEditableAccessible : public nsXFormsAccessible
 {
 public:
-  nsXFormsEditableAccessible(nsIContent* aContent, nsDocAccessible* aDoc);
+  nsXFormsEditableAccessible(nsIContent *aContent, nsIWeakReference *aShell);
 
   // nsIAccessibleEditableText
   NS_IMETHOD GetAssociatedEditor(nsIEditor **aEditor);
 
   // nsAccessible
   virtual PRUint64 NativeState();
 };
 
 
 /**
  * The class is base for accessible objects for XForms select and XForms
  * select1 elements.
  */
 class nsXFormsSelectableAccessible : public nsXFormsEditableAccessible
 {
 public:
-  nsXFormsSelectableAccessible(nsIContent* aContent, nsDocAccessible* aDoc);
+  nsXFormsSelectableAccessible(nsIContent *aContent, nsIWeakReference *aShell);
 
   // SelectAccessible
   virtual bool IsSelect();
   virtual already_AddRefed<nsIArray> SelectedItems();
   virtual PRUint32 SelectedItemCount();
   virtual nsAccessible* GetSelectedItem(PRUint32 aIndex);
   virtual bool IsItemSelected(PRUint32 aIndex);
   virtual bool AddItemToSelection(PRUint32 aIndex);
@@ -181,18 +181,18 @@ protected:
 
 
 /**
  * The class is base for accessible objects for XForms item elements.
  */
 class nsXFormsSelectableItemAccessible : public nsXFormsAccessible
 {
 public:
-  nsXFormsSelectableItemAccessible(nsIContent* aContent,
-                                   nsDocAccessible* aDoc);
+  nsXFormsSelectableItemAccessible(nsIContent *aContent,
+                                   nsIWeakReference *aShell);
 
   NS_IMETHOD GetValue(nsAString& aValue);
   NS_IMETHOD DoAction(PRUint8 aIndex);
 
   // ActionAccessible
   virtual PRUint8 ActionCount();
 
 protected:
--- a/accessible/src/xforms/nsXFormsFormControlsAccessible.cpp
+++ b/accessible/src/xforms/nsXFormsFormControlsAccessible.cpp
@@ -44,18 +44,18 @@
 
 using namespace mozilla::a11y;
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsXFormsLabelAccessible
 ////////////////////////////////////////////////////////////////////////////////
 
 nsXFormsLabelAccessible::
-  nsXFormsLabelAccessible(nsIContent* aContent, nsDocAccessible* aDoc) :
-  nsXFormsAccessible(aContent, aDoc)
+  nsXFormsLabelAccessible(nsIContent *aContent, nsIWeakReference *aShell) :
+  nsXFormsAccessible(aContent, aShell)
 {
 }
 
 role
 nsXFormsLabelAccessible::NativeRole()
 {
   return roles::LABEL;
 }
@@ -76,35 +76,35 @@ nsXFormsLabelAccessible::Description(nsS
 }
 
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsXFormsOutputAccessible
 ////////////////////////////////////////////////////////////////////////////////
 
 nsXFormsOutputAccessible::
-  nsXFormsOutputAccessible(nsIContent* aContent, nsDocAccessible* aDoc) :
-  nsXFormsAccessible(aContent, aDoc)
+  nsXFormsOutputAccessible(nsIContent *aContent, nsIWeakReference *aShell) :
+  nsXFormsAccessible(aContent, aShell)
 {
 }
 
 role
 nsXFormsOutputAccessible::NativeRole()
 {
   return roles::STATICTEXT;
 }
 
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsXFormsTriggerAccessible
 ////////////////////////////////////////////////////////////////////////////////
 
 nsXFormsTriggerAccessible::
-  nsXFormsTriggerAccessible(nsIContent* aContent, nsDocAccessible* aDoc) :
-  nsXFormsAccessible(aContent, aDoc)
+  nsXFormsTriggerAccessible(nsIContent *aContent, nsIWeakReference *aShell) :
+  nsXFormsAccessible(aContent, aShell)
 {
 }
 
 role
 nsXFormsTriggerAccessible::NativeRole()
 {
   return roles::PUSHBUTTON;
 }
@@ -143,18 +143,18 @@ nsXFormsTriggerAccessible::DoAction(PRUi
 }
 
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsXFormsInputAccessible
 ////////////////////////////////////////////////////////////////////////////////
 
 nsXFormsInputAccessible::
-  nsXFormsInputAccessible(nsIContent* aContent, nsDocAccessible* aDoc) :
-  nsXFormsEditableAccessible(aContent, aDoc)
+  nsXFormsInputAccessible(nsIContent *aContent, nsIWeakReference *aShell) :
+  nsXFormsEditableAccessible(aContent, aShell)
 {
 }
 
 NS_IMPL_ISUPPORTS_INHERITED3(nsXFormsInputAccessible, nsAccessible, nsHyperTextAccessible, nsIAccessibleText, nsIAccessibleEditableText)
 
 role
 nsXFormsInputAccessible::NativeRole()
 {
@@ -188,18 +188,18 @@ nsXFormsInputAccessible::DoAction(PRUint
 }
 
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsXFormsInputBooleanAccessible
 ////////////////////////////////////////////////////////////////////////////////
 
 nsXFormsInputBooleanAccessible::
-  nsXFormsInputBooleanAccessible(nsIContent* aContent, nsDocAccessible* aDoc) :
-  nsXFormsAccessible(aContent, aDoc)
+  nsXFormsInputBooleanAccessible(nsIContent *aContent, nsIWeakReference *aShell) :
+  nsXFormsAccessible(aContent, aShell)
 {
 }
 
 role
 nsXFormsInputBooleanAccessible::NativeRole()
 {
   return roles::CHECKBUTTON;
 }
@@ -256,35 +256,35 @@ nsXFormsInputBooleanAccessible::DoAction
 }
 
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsXFormsInputDateAccessible
 ////////////////////////////////////////////////////////////////////////////////
 
 nsXFormsInputDateAccessible::
-  nsXFormsInputDateAccessible(nsIContent* aContent, nsDocAccessible* aDoc) :
-  nsXFormsContainerAccessible(aContent, aDoc)
+  nsXFormsInputDateAccessible(nsIContent *aContent, nsIWeakReference *aShell) :
+  nsXFormsContainerAccessible(aContent, aShell)
 {
 }
 
 role
 nsXFormsInputDateAccessible::NativeRole()
 {
   return roles::DROPLIST;
 }
 
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsXFormsSecretAccessible
 ////////////////////////////////////////////////////////////////////////////////
 
 nsXFormsSecretAccessible::
-  nsXFormsSecretAccessible(nsIContent* aContent, nsDocAccessible* aDoc) :
-  nsXFormsInputAccessible(aContent, aDoc)
+  nsXFormsSecretAccessible(nsIContent *aContent, nsIWeakReference *aShell) :
+  nsXFormsInputAccessible(aContent, aShell)
 {
 }
 
 role
 nsXFormsSecretAccessible::NativeRole()
 {
   return roles::PASSWORD_TEXT;
 }
@@ -302,18 +302,18 @@ nsXFormsSecretAccessible::GetValue(nsASt
 }
 
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsXFormsRangeAccessible
 ////////////////////////////////////////////////////////////////////////////////
 
 nsXFormsRangeAccessible::
-  nsXFormsRangeAccessible(nsIContent* aContent, nsDocAccessible* aDoc) :
-  nsXFormsAccessible(aContent, aDoc)
+  nsXFormsRangeAccessible(nsIContent *aContent, nsIWeakReference *aShell) :
+  nsXFormsAccessible(aContent, aShell)
 {
 }
 
 role
 nsXFormsRangeAccessible::NativeRole()
 {
   return roles::SLIDER;
 }
@@ -395,18 +395,18 @@ nsXFormsRangeAccessible::GetCurrentValue
 }
 
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsXFormsSelectAccessible
 ////////////////////////////////////////////////////////////////////////////////
 
 nsXFormsSelectAccessible::
-  nsXFormsSelectAccessible(nsIContent* aContent, nsDocAccessible* aDoc) :
-  nsXFormsContainerAccessible(aContent, aDoc)
+  nsXFormsSelectAccessible(nsIContent *aContent, nsIWeakReference *aShell) :
+  nsXFormsContainerAccessible(aContent, aShell)
 {
 }
 
 PRUint64
 nsXFormsSelectAccessible::NativeState()
 {
   PRUint64 state = nsXFormsContainerAccessible::NativeState();
 
@@ -422,18 +422,18 @@ nsXFormsSelectAccessible::NativeState()
 }
 
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsXFormsChoicesAccessible
 ////////////////////////////////////////////////////////////////////////////////
 
 nsXFormsChoicesAccessible::
-  nsXFormsChoicesAccessible(nsIContent* aContent, nsDocAccessible* aDoc) :
-  nsXFormsAccessible(aContent, aDoc)
+  nsXFormsChoicesAccessible(nsIContent *aContent, nsIWeakReference *aShell) :
+  nsXFormsAccessible(aContent, aShell)
 {
 }
 
 role
 nsXFormsChoicesAccessible::NativeRole()
 {
   return roles::GROUPING;
 }
@@ -452,18 +452,18 @@ nsXFormsChoicesAccessible::CacheChildren
 }
 
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsXFormsSelectFullAccessible
 ////////////////////////////////////////////////////////////////////////////////
 
 nsXFormsSelectFullAccessible::
-  nsXFormsSelectFullAccessible(nsIContent* aContent, nsDocAccessible* aDoc) :
-  nsXFormsSelectableAccessible(aContent, aDoc)
+  nsXFormsSelectFullAccessible(nsIContent *aContent, nsIWeakReference *aShell) :
+  nsXFormsSelectableAccessible(aContent, aShell)
 {
 }
 
 role
 nsXFormsSelectFullAccessible::NativeRole()
 {
   return roles::GROUPING;
 }
@@ -475,18 +475,18 @@ nsXFormsSelectFullAccessible::CacheChild
 }
 
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsXFormsItemCheckgroupAccessible
 ////////////////////////////////////////////////////////////////////////////////
 
 nsXFormsItemCheckgroupAccessible::
-  nsXFormsItemCheckgroupAccessible(nsIContent* aContent, nsDocAccessible* aDoc) :
-  nsXFormsSelectableItemAccessible(aContent, aDoc)
+  nsXFormsItemCheckgroupAccessible(nsIContent *aContent, nsIWeakReference *aShell) :
+  nsXFormsSelectableItemAccessible(aContent, aShell)
 {
 }
 
 role
 nsXFormsItemCheckgroupAccessible::NativeRole()
 {
   return roles::CHECKBUTTON;
 }
@@ -517,18 +517,18 @@ nsXFormsItemCheckgroupAccessible::GetAct
 }
 
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsXFormsItemRadiogroupAccessible
 ////////////////////////////////////////////////////////////////////////////////
 
 nsXFormsItemRadiogroupAccessible::
-  nsXFormsItemRadiogroupAccessible(nsIContent* aContent, nsDocAccessible* aDoc) :
-  nsXFormsSelectableItemAccessible(aContent, aDoc)
+  nsXFormsItemRadiogroupAccessible(nsIContent *aContent, nsIWeakReference *aShell) :
+  nsXFormsSelectableItemAccessible(aContent, aShell)
 {
 }
 
 role
 nsXFormsItemRadiogroupAccessible::NativeRole()
 {
   return roles::RADIOBUTTON;
 }
@@ -555,18 +555,18 @@ nsXFormsItemRadiogroupAccessible::GetAct
 }
 
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsXFormsSelectComboboxAccessible
 ////////////////////////////////////////////////////////////////////////////////
 
 nsXFormsSelectComboboxAccessible::
-  nsXFormsSelectComboboxAccessible(nsIContent* aContent, nsDocAccessible* aDoc) :
-  nsXFormsSelectableAccessible(aContent, aDoc)
+  nsXFormsSelectComboboxAccessible(nsIContent *aContent, nsIWeakReference *aShell) :
+  nsXFormsSelectableAccessible(aContent, aShell)
 {
 }
 
 role
 nsXFormsSelectComboboxAccessible::NativeRole()
 {
   return roles::COMBOBOX;
 }
@@ -596,18 +596,18 @@ nsXFormsSelectComboboxAccessible::GetAll
 }
 
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsXFormsItemComboboxAccessible
 ////////////////////////////////////////////////////////////////////////////////
 
 nsXFormsItemComboboxAccessible::
-  nsXFormsItemComboboxAccessible(nsIContent* aContent, nsDocAccessible* aDoc) :
-  nsXFormsSelectableItemAccessible(aContent, aDoc)
+  nsXFormsItemComboboxAccessible(nsIContent *aContent, nsIWeakReference *aShell) :
+  nsXFormsSelectableItemAccessible(aContent, aShell)
 {
 }
 
 role
 nsXFormsItemComboboxAccessible::NativeRole()
 {
   return roles::LISTITEM;
 }
--- a/accessible/src/xforms/nsXFormsFormControlsAccessible.h
+++ b/accessible/src/xforms/nsXFormsFormControlsAccessible.h
@@ -43,45 +43,45 @@
 
 /**
  * Accessible object for xforms:label.
  */
 
 class nsXFormsLabelAccessible : public nsXFormsAccessible
 {
 public:
-  nsXFormsLabelAccessible(nsIContent* aContent, nsDocAccessible* aDoc);
+  nsXFormsLabelAccessible(nsIContent *aContent, nsIWeakReference *aShell);
 
   // nsAccessible
   virtual void Description(nsString& aDescription);
   virtual nsresult GetNameInternal(nsAString& aName);
   virtual mozilla::a11y::role NativeRole();
 };
 
 /**
  * Accessible object for xforms:output.
  */
 
 class nsXFormsOutputAccessible : public nsXFormsAccessible
 {
 public:
-  nsXFormsOutputAccessible(nsIContent* aContent, nsDocAccessible* aDoc);
+  nsXFormsOutputAccessible(nsIContent *aContent, nsIWeakReference *aShell);
 
   // nsAccessible
   virtual mozilla::a11y::role NativeRole();
 };
 
 /**
  * Accessible object for xforms:trigger and xforms:submit.
  */
 
 class nsXFormsTriggerAccessible : public nsXFormsAccessible
 {
 public:
-  nsXFormsTriggerAccessible(nsIContent* aContent, nsDocAccessible* aDoc);
+  nsXFormsTriggerAccessible(nsIContent *aContent, nsIWeakReference *aShell);
 
   // nsIAccessible
   NS_IMETHOD GetValue(nsAString& aValue);
 
   NS_IMETHOD GetActionName(PRUint8 aIndex, nsAString& aName);
   NS_IMETHOD DoAction(PRUint8 aIndex);
 
   // nsAccessible
@@ -93,17 +93,17 @@ public:
 
 /**
  * Accessible object for xforms:input and xforms:textarea.
  */
 
 class nsXFormsInputAccessible : public nsXFormsEditableAccessible
 {
 public:
-  nsXFormsInputAccessible(nsIContent* aContent, nsDocAccessible* aDoc);
+  nsXFormsInputAccessible(nsIContent *aContent, nsIWeakReference *aShell);
 
   NS_DECL_ISUPPORTS_INHERITED
 
   // nsIAccessible
   NS_IMETHOD GetActionName(PRUint8 aIndex, nsAString& aName);
   NS_IMETHOD DoAction(PRUint8 aIndex);
 
   // nsAccessible
@@ -115,17 +115,17 @@ public:
 
 /**
  * Accessible object for xforms:input[type="xsd:boolean"].
  */
 
 class nsXFormsInputBooleanAccessible : public nsXFormsAccessible
 {
 public:
-  nsXFormsInputBooleanAccessible(nsIContent* aContent, nsDocAccessible* aDoc);
+  nsXFormsInputBooleanAccessible(nsIContent *aContent, nsIWeakReference *aShell);
 
   // nsIAccessible
   NS_IMETHOD GetActionName(PRUint8 aIndex, nsAString& aName);
   NS_IMETHOD DoAction(PRUint8 aIndex);
 
   // nsAccessible
   virtual mozilla::a11y::role NativeRole();
   virtual PRUint64 NativeState();
@@ -136,30 +136,30 @@ public:
 
 /**
  * Accessible object for xforms:input[type="xsd:date"].
  */
 
 class nsXFormsInputDateAccessible : public nsXFormsContainerAccessible
 {
 public:
-  nsXFormsInputDateAccessible(nsIContent* aContent, nsDocAccessible* aDoc);
+  nsXFormsInputDateAccessible(nsIContent *aContent, nsIWeakReference *aShell);
 
   // nsAccessible
   virtual mozilla::a11y::role NativeRole();
 };
 
 /**
  * Accessible object for xforms:secret.
  */
 
 class nsXFormsSecretAccessible : public nsXFormsInputAccessible
 {
 public:
-  nsXFormsSecretAccessible(nsIContent* aContent, nsDocAccessible* aDoc);
+  nsXFormsSecretAccessible(nsIContent *aContent, nsIWeakReference *aShell);
 
   // nsIAccessible
   NS_IMETHOD GetValue(nsAString& aValue);
 
   // nsAccessible
   virtual mozilla::a11y::role NativeRole();
   virtual PRUint64 NativeState();
 };
@@ -167,17 +167,17 @@ public:
 
 /**
  * Accessible object for xforms:range.
  */
 
 class nsXFormsRangeAccessible : public nsXFormsAccessible
 {
 public:
-  nsXFormsRangeAccessible(nsIContent* aContent, nsDocAccessible* aDoc);
+  nsXFormsRangeAccessible(nsIContent *aContent, nsIWeakReference *aShell);
 
   // nsIAccessibleValue
   NS_IMETHOD GetMaximumValue(double *aMaximumValue);
   NS_IMETHOD GetMinimumValue(double *aMinimumValue);
   NS_IMETHOD GetMinimumIncrement(double *aMinimumIncrement);
   NS_IMETHOD GetCurrentValue(double *aCurrentValue);
 
   // nsAccessible
@@ -189,31 +189,31 @@ public:
 /**
  * Accessible object for xforms:select and xforms:select1 that are implemented
  * using host document's native widget.
  */
 
 class nsXFormsSelectAccessible : public nsXFormsContainerAccessible
 {
 public:
-  nsXFormsSelectAccessible(nsIContent* aContent, nsDocAccessible* aDoc);
+  nsXFormsSelectAccessible(nsIContent *aContent, nsIWeakReference *aShell);
 
   // nsAccessible
   virtual PRUint64 NativeState();
 };
 
 
 /**
  * Accessible object for xforms:choices.
  */
 
 class nsXFormsChoicesAccessible : public nsXFormsAccessible
 {
 public:
-  nsXFormsChoicesAccessible(nsIContent* aContent, nsDocAccessible* aDoc);
+  nsXFormsChoicesAccessible(nsIContent* aContent, nsIWeakReference *aShell);
 
   // nsIAccessible
   NS_IMETHOD GetValue(nsAString& aValue);
 
   // nsAccessible
   virtual mozilla::a11y::role NativeRole();
 
 protected:
@@ -225,17 +225,17 @@ protected:
 /**
  * Accessible object for xforms:select/xforms:select1 of full appearance that
  * may be represented by group of checkboxes or radiogroup.
  */
 
 class nsXFormsSelectFullAccessible : public nsXFormsSelectableAccessible
 {
 public:
-  nsXFormsSelectFullAccessible(nsIContent* aContent, nsDocAccessible* aDoc);
+  nsXFormsSelectFullAccessible(nsIContent *aContent, nsIWeakReference *aShell);
 
   // nsAccessible
   virtual mozilla::a11y::role NativeRole();
 
 protected:
   // nsAccessible
   virtual void CacheChildren();
 };
@@ -245,18 +245,18 @@ protected:
  * Accessible object for a xforms:item when it is represented by a checkbox.
  * This occurs when the item is contained in a xforms:select with full
  * appearance. Such a xforms:select is represented by a checkgroup.
  */
 
 class nsXFormsItemCheckgroupAccessible : public nsXFormsSelectableItemAccessible
 {
 public:
-  nsXFormsItemCheckgroupAccessible(nsIContent* aContent,
-                                   nsDocAccessible* aDoc);
+  nsXFormsItemCheckgroupAccessible(nsIContent *aContent,
+                                   nsIWeakReference *aShell);
 
   // nsIAccessible
   NS_IMETHOD GetActionName(PRUint8 aIndex, nsAString& aName);
 
   // nsAccessible
   virtual mozilla::a11y::role NativeRole();
   virtual PRUint64 NativeState();
 };
@@ -266,18 +266,18 @@ public:
  * Accessible object for a xforms:item when it is represented by a radiobutton.
  * This occurs when the item is contained in a xforms:select1 with full
  * appearance. Such a xforms:select1 is represented as a radiogroup.
  */
 
 class nsXFormsItemRadiogroupAccessible : public nsXFormsSelectableItemAccessible
 {
 public:
-  nsXFormsItemRadiogroupAccessible(nsIContent* aContent,
-                                   nsDocAccessible* aDoc);
+  nsXFormsItemRadiogroupAccessible(nsIContent *aContent,
+                                   nsIWeakReference *aShell);
 
   // nsIAccessible
   NS_IMETHOD GetActionName(PRUint8 aIndex, nsAString& aName);
 
   // nsAccessible
   virtual mozilla::a11y::role NativeRole();
   virtual PRUint64 NativeState();
 };
@@ -286,18 +286,18 @@ public:
 /**
  * Accessible object for xforms:select1 of minimal appearance that is
  * represented by combobox.
  */
 
 class nsXFormsSelectComboboxAccessible : public nsXFormsSelectableAccessible
 {
 public:
-  nsXFormsSelectComboboxAccessible(nsIContent* aContent,
-                                   nsDocAccessible* aDoc);
+  nsXFormsSelectComboboxAccessible(nsIContent *aContent,
+                                   nsIWeakReference *aShell);
 
   // nsAccessible
   virtual mozilla::a11y::role NativeRole();
   virtual PRUint64 NativeState();
   virtual bool GetAllowsAnonChildAccessibles();
 };
 
 
@@ -305,18 +305,18 @@ public:
  * Accessible object for xforms:item element when it is represented by a
  * listitem. This occurs when the item is contained in a xforms:select with
  * minimal appearance. Such a xforms:select is represented by a combobox.
  */
 
 class nsXFormsItemComboboxAccessible : public nsXFormsSelectableItemAccessible
 {
 public:
-  nsXFormsItemComboboxAccessible(nsIContent* aContent,
-                                 nsDocAccessible* aDoc);
+  nsXFormsItemComboboxAccessible(nsIContent *aContent,
+                                 nsIWeakReference *aShell);
 
   // nsIAccessible
   NS_IMETHOD GetActionName(PRUint8 aIndex, nsAString& aName);
 
   // nsAccessible
   virtual mozilla::a11y::role NativeRole();
   virtual PRUint64 NativeState();
 };
--- a/accessible/src/xforms/nsXFormsWidgetsAccessible.cpp
+++ b/accessible/src/xforms/nsXFormsWidgetsAccessible.cpp
@@ -43,19 +43,19 @@
 
 using namespace mozilla::a11y;
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsXFormsDropmarkerWidgetAccessible
 ////////////////////////////////////////////////////////////////////////////////
 
 nsXFormsDropmarkerWidgetAccessible::
-  nsXFormsDropmarkerWidgetAccessible(nsIContent* aContent,
-                                     nsDocAccessible* aDoc) :
-  nsLeafAccessible(aContent, aDoc)
+  nsXFormsDropmarkerWidgetAccessible(nsIContent *aContent,
+                                     nsIWeakReference *aShell) :
+  nsLeafAccessible(aContent, aShell)
 {
 }
 
 role
 nsXFormsDropmarkerWidgetAccessible::NativeRole()
 {
   return roles::PUSHBUTTON;
 }
@@ -108,36 +108,36 @@ nsXFormsDropmarkerWidgetAccessible::DoAc
 }
 
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsXFormsCalendarWidgetAccessible
 ////////////////////////////////////////////////////////////////////////////////
 
 nsXFormsCalendarWidgetAccessible::
-  nsXFormsCalendarWidgetAccessible(nsIContent* aContent, nsDocAccessible* aDoc) :
-  nsAccessibleWrap(aContent, aDoc)
+nsXFormsCalendarWidgetAccessible(nsIContent *aContent, nsIWeakReference *aShell) :
+  nsAccessibleWrap(aContent, aShell)
 {
 }
 
 role
 nsXFormsCalendarWidgetAccessible::NativeRole()
 {
   return roles::CALENDAR;
 }
 
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsXFormsComboboxPopupWidgetAccessible
 ////////////////////////////////////////////////////////////////////////////////
 
 nsXFormsComboboxPopupWidgetAccessible::
-  nsXFormsComboboxPopupWidgetAccessible(nsIContent* aContent,
-                                        nsDocAccessible* aDoc) :
-  nsXFormsAccessible(aContent, aDoc)
+  nsXFormsComboboxPopupWidgetAccessible(nsIContent *aContent,
+                                        nsIWeakReference *aShell) :
+  nsXFormsAccessible(aContent, aShell)
 {
 }
 
 role
 nsXFormsComboboxPopupWidgetAccessible::NativeRole()
 {
   return roles::LIST;
 }
--- a/accessible/src/xforms/nsXFormsWidgetsAccessible.h
+++ b/accessible/src/xforms/nsXFormsWidgetsAccessible.h
@@ -46,18 +46,18 @@
  * Accessible object for dropmarker widget that is used inside xforms elements
  * of combobox representation. For example, these are xforms:select1,
  * xforms:input[type="xsd:date"].
  */
 class nsXFormsDropmarkerWidgetAccessible : public nsLeafAccessible,
                                            public nsXFormsAccessibleBase
 {
 public:
-  nsXFormsDropmarkerWidgetAccessible(nsIContent* aContent,
-                                     nsDocAccessible* aDoc);
+  nsXFormsDropmarkerWidgetAccessible(nsIContent *aContent,
+                                     nsIWeakReference *aShell);
 
   // nsIAccessible
   NS_IMETHOD GetActionName(PRUint8 aIndex, nsAString& aName);
   NS_IMETHOD DoAction(PRUint8 aIndex);
 
   // nsAccessible
   virtual mozilla::a11y::role NativeRole();
   virtual PRUint64 NativeState();
@@ -68,33 +68,33 @@ public:
 
 
 /**
  * Accessible object for calendar widget. It is used by xforms:input[xsd:date].
  */
 class nsXFormsCalendarWidgetAccessible : public nsAccessibleWrap
 {
 public:
-  nsXFormsCalendarWidgetAccessible(nsIContent* aContent,
-                                   nsDocAccessible* aDoc);
+  nsXFormsCalendarWidgetAccessible(nsIContent *aContent,
+                                   nsIWeakReference *aShell);
 
   // nsAccessible
   virtual mozilla::a11y::role NativeRole();
 };
 
 
 /**
  * Accessible object for popup menu of minimal xforms select1 element that is
  * represented by combobox.
  */
 class nsXFormsComboboxPopupWidgetAccessible : public nsXFormsAccessible
 {
 public:
-  nsXFormsComboboxPopupWidgetAccessible(nsIContent* aContent,
-                                        nsDocAccessible* aDoc);
+  nsXFormsComboboxPopupWidgetAccessible(nsIContent *aContent,
+                                        nsIWeakReference *aShell);
 
   // nsIAccessible
   NS_IMETHOD GetValue(nsAString& aValue);
 
   // nsAccessible
   virtual void Description(nsString& aDescription);
   virtual nsresult GetNameInternal(nsAString& aName);
   virtual mozilla::a11y::role NativeRole();
--- a/accessible/src/xul/XULSelectControlAccessible.cpp
+++ b/accessible/src/xul/XULSelectControlAccessible.cpp
@@ -56,18 +56,18 @@
 using namespace mozilla;
 using namespace mozilla::a11y;
 
 ////////////////////////////////////////////////////////////////////////////////
 // XULSelectControlAccessible
 ////////////////////////////////////////////////////////////////////////////////
 
 XULSelectControlAccessible::
-  XULSelectControlAccessible(nsIContent* aContent, nsDocAccessible* aDoc) :
-  nsAccessibleWrap(aContent, aDoc)
+  XULSelectControlAccessible(nsIContent *aContent, nsIWeakReference *aShell) :
+  nsAccessibleWrap(aContent, aShell)
 {
   mSelectControl = do_QueryInterface(aContent);
 }
 
 ////////////////////////////////////////////////////////////////////////////////
 // XULSelectControlAccessible: nsAccessNode
 
 void
@@ -87,45 +87,47 @@ XULSelectControlAccessible::IsSelect()
 }
 
 // Interface methods
 already_AddRefed<nsIArray>
 XULSelectControlAccessible::SelectedItems()
 {
   nsCOMPtr<nsIMutableArray> selectedItems =
     do_CreateInstance(NS_ARRAY_CONTRACTID);
-  if (!selectedItems || !mDoc)
+  if (!selectedItems)
     return nsnull;
 
   // For XUL multi-select control
   nsCOMPtr<nsIDOMXULMultiSelectControlElement> xulMultiSelect =
     do_QueryInterface(mSelectControl);
   if (xulMultiSelect) {
     PRInt32 length = 0;
     xulMultiSelect->GetSelectedCount(&length);
     for (PRInt32 index = 0; index < length; index++) {
       nsCOMPtr<nsIDOMXULSelectControlItemElement> itemElm;
       xulMultiSelect->GetSelectedItem(index, getter_AddRefs(itemElm));
       nsCOMPtr<nsINode> itemNode(do_QueryInterface(itemElm));
-      nsAccessible* item = mDoc->GetAccessible(itemNode);
+      nsAccessible* item =
+        GetAccService()->GetAccessibleInWeakShell(itemNode, mWeakShell);
       if (item)
         selectedItems->AppendElement(static_cast<nsIAccessible*>(item),
                                      false);
     }
   } else {  // Single select?
       nsCOMPtr<nsIDOMXULSelectControlItemElement> itemElm;
       mSelectControl->GetSelectedItem(getter_AddRefs(itemElm));
       nsCOMPtr<nsINode> itemNode(do_QueryInterface(itemElm));
       if(itemNode) {
-        nsAccessible* item = mDoc->GetAccessible(itemNode);
+        nsAccessible* item =
+          GetAccService()->GetAccessibleInWeakShell(itemNode, mWeakShell);
         if (item)
           selectedItems->AppendElement(static_cast<nsIAccessible*>(item),
                                      false);
       }
-  }
+    }
 
   nsIMutableArray* items = nsnull;
   selectedItems.forget(&items);
   return items;
 }
 
 nsAccessible*
 XULSelectControlAccessible::GetSelectedItem(PRUint32 aIndex)
@@ -135,17 +137,18 @@ XULSelectControlAccessible::GetSelectedI
 
   nsCOMPtr<nsIDOMXULSelectControlItemElement> itemElm;
   if (multiSelectControl)
     multiSelectControl->GetSelectedItem(aIndex, getter_AddRefs(itemElm));
   else if (aIndex == 0)
     mSelectControl->GetSelectedItem(getter_AddRefs(itemElm));
 
   nsCOMPtr<nsINode> itemNode(do_QueryInterface(itemElm));
-  return itemNode && mDoc ? mDoc->GetAccessible(itemNode) : nsnull;
+  return itemNode ?
+    GetAccService()->GetAccessibleInWeakShell(itemNode, mWeakShell) : nsnull;
 }
 
 PRUint32
 XULSelectControlAccessible::SelectedItemCount()
 {
   // For XUL multi-select control
   nsCOMPtr<nsIDOMXULMultiSelectControlElement> multiSelectControl =
     do_QueryInterface(mSelectControl);
@@ -276,17 +279,17 @@ XULSelectControlAccessible::CurrentItem(
   else
     mSelectControl->GetSelectedItem(getter_AddRefs(currentItemElm));
 
   nsCOMPtr<nsINode> DOMNode;
   if (currentItemElm)
     DOMNode = do_QueryInterface(currentItemElm);
 
   if (DOMNode) {
-    nsDocAccessible* document = Document();
+    nsDocAccessible* document = GetDocAccessible();
     if (document)
       return document->GetAccessible(DOMNode);
   }
 
   return nsnull;
 }
 
 void
--- a/accessible/src/xul/XULSelectControlAccessible.h
+++ b/accessible/src/xul/XULSelectControlAccessible.h
@@ -44,17 +44,17 @@
 #include "nsIDOMXULSelectCntrlEl.h"
 
 /**
  * The basic implementation of accessible selection for XUL select controls.
  */
 class XULSelectControlAccessible : public nsAccessibleWrap
 {
 public:
-  XULSelectControlAccessible(nsIContent* aContent, nsDocAccessible* aDoc);
+  XULSelectControlAccessible(nsIContent *aContent, nsIWeakReference *aShell);
   virtual ~XULSelectControlAccessible() {}
 
   // nsAccessNode
   virtual void Shutdown();
 
   // SelectAccessible
   virtual bool IsSelect();
   virtual already_AddRefed<nsIArray> SelectedItems();
--- a/accessible/src/xul/nsXULAlertAccessible.cpp
+++ b/accessible/src/xul/nsXULAlertAccessible.cpp
@@ -42,18 +42,18 @@
 
 using namespace mozilla::a11y;
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsXULAlertAccessible
 ////////////////////////////////////////////////////////////////////////////////
 
 nsXULAlertAccessible::
-  nsXULAlertAccessible(nsIContent* aContent, nsDocAccessible* aDoc) :
-  nsAccessibleWrap(aContent, aDoc)
+  nsXULAlertAccessible(nsIContent *aContent, nsIWeakReference *aShell) :
+  nsAccessibleWrap(aContent, aShell)
 {
 }
 
 NS_IMPL_ISUPPORTS_INHERITED0(nsXULAlertAccessible, nsAccessible)
 
 role
 nsXULAlertAccessible::NativeRole()
 {
--- a/accessible/src/xul/nsXULAlertAccessible.h
+++ b/accessible/src/xul/nsXULAlertAccessible.h
@@ -42,17 +42,17 @@
 
 /**
  * Accessible for supporting XUL alerts.
  */
 
 class nsXULAlertAccessible : public nsAccessibleWrap
 {
 public:
-  nsXULAlertAccessible(nsIContent* aContent, nsDocAccessible* aDoc);
+  nsXULAlertAccessible(nsIContent *aContent, nsIWeakReference *aShell);
 
   NS_DECL_ISUPPORTS_INHERITED
 
   // nsIAccessible
   NS_IMETHOD GetName(nsAString& aName);
 
   // nsAccessible
   virtual mozilla::a11y::role NativeRole();
--- a/accessible/src/xul/nsXULColorPickerAccessible.cpp
+++ b/accessible/src/xul/nsXULColorPickerAccessible.cpp
@@ -50,18 +50,18 @@
 
 using namespace mozilla::a11y;
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsXULColorPickerTileAccessible
 ////////////////////////////////////////////////////////////////////////////////
 
 nsXULColorPickerTileAccessible::
-  nsXULColorPickerTileAccessible(nsIContent* aContent, nsDocAccessible* aDoc) :
-  nsAccessibleWrap(aContent, aDoc)
+  nsXULColorPickerTileAccessible(nsIContent *aContent, nsIWeakReference *aShell) :
+  nsAccessibleWrap(aContent, aShell)
 {
 }
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsXULColorPickerTileAccessible: nsIAccessible
 
 NS_IMETHODIMP
 nsXULColorPickerTileAccessible::GetValue(nsAString& aValue)
@@ -112,18 +112,18 @@ nsXULColorPickerTileAccessible::Containe
   return nsnull;
 }
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsXULColorPickerAccessible
 ////////////////////////////////////////////////////////////////////////////////
 
 nsXULColorPickerAccessible::
-  nsXULColorPickerAccessible(nsIContent* aContent, nsDocAccessible* aDoc) :
-  nsXULColorPickerTileAccessible(aContent, aDoc)
+  nsXULColorPickerAccessible(nsIContent *aContent, nsIWeakReference *aShell) :
+  nsXULColorPickerTileAccessible(aContent, aShell)
 {
   mFlags |= eMenuButtonAccessible;
 }
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsXULColorPickerAccessible: nsAccessible
 
 PRUint64
@@ -172,26 +172,24 @@ nsXULColorPickerAccessible::AreItemsOper
 }
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsXULColorPickerAccessible: protected nsAccessible
 
 void
 nsXULColorPickerAccessible::CacheChildren()
 {
-  NS_ENSURE_TRUE(mDoc,);
-
-  nsAccTreeWalker walker(mDoc->GetWeakShell(), mContent, true);
+  nsAccTreeWalker walker(mWeakShell, mContent, true);
 
   nsAccessible* child = nsnull;
   while ((child = walker.NextChild())) {
     PRUint32 role = child->Role();
 
     // Get an accessible for menupopup or panel elements.
     if (role == roles::ALERT) {
       AppendChild(child);
       return;
     }
 
     // Unbind rejected accessibles from the document.
-    Document()->UnbindFromDocument(child);
+    GetDocAccessible()->UnbindFromDocument(child);
   }
 }
--- a/accessible/src/xul/nsXULColorPickerAccessible.h
+++ b/accessible/src/xul/nsXULColorPickerAccessible.h
@@ -42,18 +42,18 @@
 #include "nsAccessibleWrap.h"
 
 /**
  * Used for color button in colorpicker palette.
  */
 class nsXULColorPickerTileAccessible : public nsAccessibleWrap
 {
 public:
-  nsXULColorPickerTileAccessible(nsIContent* aContent,
-                                 nsDocAccessible* aDoc);
+  nsXULColorPickerTileAccessible(nsIContent *aContent,
+                                 nsIWeakReference *aShell);
 
   // nsIAccessible
   NS_IMETHOD GetValue(nsAString& _retval);
 
   // nsAccessible
   virtual mozilla::a11y::role NativeRole();
   virtual PRUint64 NativeState();
 
@@ -63,17 +63,17 @@ public:
 
 
 /**
  * Used for colorpicker button (xul:colorpicker@type="button").
  */
 class nsXULColorPickerAccessible : public nsXULColorPickerTileAccessible
 {
 public:
-  nsXULColorPickerAccessible(nsIContent* aContent, nsDocAccessible* aDoc);
+  nsXULColorPickerAccessible(nsIContent *aContent, nsIWeakReference *aShell);
 
   // nsAccessible
   virtual mozilla::a11y::role NativeRole();
   virtual PRUint64 NativeState();
 
   // Widgets
   virtual bool IsWidget() const;
   virtual bool IsActiveWidget() const;
--- a/accessible/src/xul/nsXULComboboxAccessible.cpp
+++ b/accessible/src/xul/nsXULComboboxAccessible.cpp
@@ -36,34 +36,33 @@
  * the provisions above, a recipient may use your version of this file under
  * the terms of any one of the MPL, the GPL or the LGPL.
  *
  * ***** END LICENSE BLOCK ***** */
 
 #include "nsXULComboboxAccessible.h"
 
 #include "nsAccessibilityService.h"
-#include "nsDocAccessible.h"
 #include "nsCoreUtils.h"
 #include "Role.h"
 #include "States.h"
 
 #include "nsIAutoCompleteInput.h"
 #include "nsIDOMXULMenuListElement.h"
 #include "nsIDOMXULSelectCntrlItemEl.h"
 
 using namespace mozilla::a11y;
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsXULComboboxAccessible
 ////////////////////////////////////////////////////////////////////////////////
 
 nsXULComboboxAccessible::
-  nsXULComboboxAccessible(nsIContent* aContent, nsDocAccessible* aDoc) :
-  nsAccessibleWrap(aContent, aDoc)
+  nsXULComboboxAccessible(nsIContent *aContent, nsIWeakReference *aShell) :
+  nsAccessibleWrap(aContent, aShell)
 {
   if (mContent->AttrValueIs(kNameSpaceID_None, nsGkAtoms::type,
                             nsGkAtoms::autocomplete, eIgnoreCase))
     mFlags |= eAutoCompleteAccessible;
   else
     mFlags |= eComboboxAccessible;
 }
 
@@ -127,18 +126,19 @@ nsXULComboboxAccessible::Description(nsS
   nsCOMPtr<nsIDOMXULMenuListElement> menuListElm(do_QueryInterface(mContent));
   if (!menuListElm)
     return;
 
   nsCOMPtr<nsIDOMXULSelectControlItemElement> focusedOptionItem;
   menuListElm->GetSelectedItem(getter_AddRefs(focusedOptionItem));
   nsCOMPtr<nsIContent> focusedOptionContent =
     do_QueryInterface(focusedOptionItem);
-  if (focusedOptionContent && mDoc) {
-    nsAccessible* focusedOptionAcc = mDoc->GetAccessible(focusedOptionContent);
+  if (focusedOptionContent) {
+    nsAccessible* focusedOptionAcc = GetAccService()->
+      GetAccessibleInWeakShell(focusedOptionContent, mWeakShell);
     if (focusedOptionAcc)
       focusedOptionAcc->Description(aDescription);
   }
 }
 
 bool
 nsXULComboboxAccessible::GetAllowsAnonChildAccessibles()
 {
--- a/accessible/src/xul/nsXULComboboxAccessible.h
+++ b/accessible/src/xul/nsXULComboboxAccessible.h
@@ -45,17 +45,17 @@
 /**
  * Used for XUL comboboxes like xul:menulist and autocomplete textbox.
  */
 class nsXULComboboxAccessible : public nsAccessibleWrap
 {
 public:
   enum { eAction_Click = 0 };
 
-  nsXULComboboxAccessible(nsIContent* aContent, nsDocAccessible* aDoc);
+  nsXULComboboxAccessible(nsIContent *aContent, nsIWeakReference *aShell);
 
   // nsIAccessible
   NS_IMETHOD GetValue(nsAString& aValue);
   NS_IMETHOD DoAction(PRUint8 aIndex);
   NS_IMETHOD GetActionName(PRUint8 aIndex, nsAString& aName);
 
   // nsAccessible
   virtual void Description(nsString& aDescription);
--- a/accessible/src/xul/nsXULFormControlAccessible.cpp
+++ b/accessible/src/xul/nsXULFormControlAccessible.cpp
@@ -66,18 +66,18 @@
 
 using namespace mozilla::a11y;
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsXULButtonAccessible
 ////////////////////////////////////////////////////////////////////////////////
 
 nsXULButtonAccessible::
-  nsXULButtonAccessible(nsIContent* aContent, nsDocAccessible* aDoc) :
-  nsAccessibleWrap(aContent, aDoc)
+  nsXULButtonAccessible(nsIContent *aContent, nsIWeakReference *aShell) :
+  nsAccessibleWrap(aContent, aShell)
 {
   if (ContainsMenu())
     mFlags |= eMenuButtonAccessible;
 }
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsXULButtonAccessible: nsISupports
 
@@ -221,24 +221,23 @@ nsXULButtonAccessible::CacheChildren()
                                        nsGkAtoms::menu,
                                        eCaseMatters);
 
   bool isMenuButton = isMenu ?
     false :
     mContent->AttrValueIs(kNameSpaceID_None, nsGkAtoms::type,
                           nsGkAtoms::menuButton, eCaseMatters);
 
-  NS_ENSURE_TRUE(mDoc,);
   if (!isMenu && !isMenuButton)
     return;
 
   nsAccessible* menupopup = nsnull;
   nsAccessible* button = nsnull;
 
-  nsAccTreeWalker walker(mDoc->GetWeakShell(), mContent, true);
+  nsAccTreeWalker walker(mWeakShell, mContent, true);
 
   nsAccessible* child = nsnull;
   while ((child = walker.NextChild())) {
     roles::Role role = child->Role();
 
     if (role == roles::MENUPOPUP) {
       // Get an accessible for menupopup or panel elements.
       menupopup = child;
@@ -246,17 +245,17 @@ nsXULButtonAccessible::CacheChildren()
     } else if (isMenuButton && role == roles::PUSHBUTTON) {
       // Button type="menu-button" contains a real button. Get an accessible
       // for it. Ignore dropmarker button which is placed as a last child.
       button = child;
       break;
 
     } else {
       // Unbind rejected accessible from document.
-      Document()->UnbindFromDocument(child);
+      GetDocAccessible()->UnbindFromDocument(child);
     }
   }
 
   if (!menupopup)
     return;
 
   AppendChild(menupopup);
   if (button)
@@ -277,18 +276,18 @@ nsXULButtonAccessible::ContainsMenu()
                                    strings, eCaseMatters) >= 0;
 }
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsXULDropmarkerAccessible
 ////////////////////////////////////////////////////////////////////////////////
 
 nsXULDropmarkerAccessible::
-  nsXULDropmarkerAccessible(nsIContent* aContent, nsDocAccessible* aDoc) :
-  nsFormControlAccessible(aContent, aDoc)
+  nsXULDropmarkerAccessible(nsIContent *aContent, nsIWeakReference *aShell) :
+  nsFormControlAccessible(aContent, aShell)
 {
 }
 
 PRUint8
 nsXULDropmarkerAccessible::ActionCount()
 {
   return 1;
 }
@@ -358,18 +357,18 @@ nsXULDropmarkerAccessible::NativeState()
   return DropmarkerOpen(false) ? states::PRESSED : 0;
 }
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsXULCheckboxAccessible
 ////////////////////////////////////////////////////////////////////////////////
 
 nsXULCheckboxAccessible::
-  nsXULCheckboxAccessible(nsIContent* aContent, nsDocAccessible* aDoc) :
-  nsFormControlAccessible(aContent, aDoc)
+  nsXULCheckboxAccessible(nsIContent *aContent, nsIWeakReference *aShell) :
+  nsFormControlAccessible(aContent, aShell)
 {
 }
 
 role
 nsXULCheckboxAccessible::NativeRole()
 {
   return roles::CHECKBUTTON;
 }
@@ -438,18 +437,18 @@ nsXULCheckboxAccessible::NativeState()
   return state;
 }
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsXULGroupboxAccessible
 ////////////////////////////////////////////////////////////////////////////////
 
 nsXULGroupboxAccessible::
-  nsXULGroupboxAccessible(nsIContent* aContent, nsDocAccessible* aDoc) :
-  nsAccessibleWrap(aContent, aDoc)
+  nsXULGroupboxAccessible(nsIContent *aContent, nsIWeakReference *aShell) :
+  nsAccessibleWrap(aContent, aShell)
 {
 }
 
 role
 nsXULGroupboxAccessible::NativeRole()
 {
   return roles::GROUPING;
 }
@@ -495,18 +494,18 @@ nsXULGroupboxAccessible::RelationByType(
   return rel;
 }
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsXULRadioButtonAccessible
 ////////////////////////////////////////////////////////////////////////////////
 
 nsXULRadioButtonAccessible::
-  nsXULRadioButtonAccessible(nsIContent* aContent, nsDocAccessible* aDoc) :
-  nsRadioButtonAccessible(aContent, aDoc)
+  nsXULRadioButtonAccessible(nsIContent *aContent, nsIWeakReference *aShell) :
+  nsRadioButtonAccessible(aContent, aShell)
 {
 }
 
 PRUint64
 nsXULRadioButtonAccessible::NativeState()
 {
   PRUint64 state = nsFormControlAccessible::NativeState();
   state |= states::CHECKABLE;
@@ -554,18 +553,18 @@ nsXULRadioButtonAccessible::ContainerWid
   *   The Radio Group proxies for the Radio Buttons themselves. The Group gets
   *   focus whereas the Buttons do not. So we only have an accessible object for
   *   this for the purpose of getting the proper RadioButton. Need this here to 
   *   avoid circular reference problems when navigating the accessible tree and
   *   for getting to the radiobuttons.
   */
 
 nsXULRadioGroupAccessible::
-  nsXULRadioGroupAccessible(nsIContent* aContent, nsDocAccessible* aDoc) :
-  XULSelectControlAccessible(aContent, aDoc)
+  nsXULRadioGroupAccessible(nsIContent *aContent, nsIWeakReference *aShell) :
+  XULSelectControlAccessible(aContent, aShell)
 { 
 }
 
 role
 nsXULRadioGroupAccessible::NativeRole()
 {
   return roles::GROUPING;
 }
@@ -601,35 +600,35 @@ nsXULRadioGroupAccessible::AreItemsOpera
 }
 
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsXULStatusBarAccessible
 ////////////////////////////////////////////////////////////////////////////////
 
 nsXULStatusBarAccessible::
-  nsXULStatusBarAccessible(nsIContent* aContent, nsDocAccessible* aDoc) :
-  nsAccessibleWrap(aContent, aDoc)
+  nsXULStatusBarAccessible(nsIContent *aContent, nsIWeakReference *aShell) :
+  nsAccessibleWrap(aContent, aShell)
 {
 }
 
 role
 nsXULStatusBarAccessible::NativeRole()
 {
   return roles::STATUSBAR;
 }
 
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsXULToolbarButtonAccessible
 ////////////////////////////////////////////////////////////////////////////////
 
 nsXULToolbarButtonAccessible::
-  nsXULToolbarButtonAccessible(nsIContent* aContent, nsDocAccessible* aDoc) :
-  nsXULButtonAccessible(aContent, aDoc)
+  nsXULToolbarButtonAccessible(nsIContent *aContent, nsIWeakReference *aShell) :
+  nsXULButtonAccessible(aContent, aShell)
 {
 }
 
 void
 nsXULToolbarButtonAccessible::GetPositionAndSizeInternal(PRInt32 *aPosInSet,
                                                          PRInt32 *aSetSize)
 {
   PRInt32 setSize = 0;
@@ -669,18 +668,18 @@ nsXULToolbarButtonAccessible::IsSeparato
                      (content->Tag() == nsGkAtoms::toolbarspring)); }
 
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsXULToolbarAccessible
 ////////////////////////////////////////////////////////////////////////////////
 
 nsXULToolbarAccessible::
-  nsXULToolbarAccessible(nsIContent* aContent, nsDocAccessible* aDoc) :
-  nsAccessibleWrap(aContent, aDoc)
+  nsXULToolbarAccessible(nsIContent *aContent, nsIWeakReference *aShell) :
+  nsAccessibleWrap(aContent, aShell)
 {
 }
 
 role
 nsXULToolbarAccessible::NativeRole()
 {
   return roles::TOOLBAR;
 }
@@ -698,19 +697,19 @@ nsXULToolbarAccessible::GetNameInternal(
 }
 
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsXULToolbarAccessible
 ////////////////////////////////////////////////////////////////////////////////
 
 nsXULToolbarSeparatorAccessible::
-  nsXULToolbarSeparatorAccessible(nsIContent* aContent,
-                                  nsDocAccessible* aDoc) :
-  nsLeafAccessible(aContent, aDoc)
+  nsXULToolbarSeparatorAccessible(nsIContent *aContent,
+                                  nsIWeakReference *aShell) :
+  nsLeafAccessible(aContent, aShell)
 {
 }
 
 role
 nsXULToolbarSeparatorAccessible::NativeRole()
 {
   return roles::SEPARATOR;
 }
@@ -721,18 +720,18 @@ nsXULToolbarSeparatorAccessible::NativeS
   return 0;
 }
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsXULTextFieldAccessible
 ////////////////////////////////////////////////////////////////////////////////
 
 nsXULTextFieldAccessible::
- nsXULTextFieldAccessible(nsIContent* aContent, nsDocAccessible* aDoc) :
- nsHyperTextAccessibleWrap(aContent, aDoc)
+ nsXULTextFieldAccessible(nsIContent *aContent, nsIWeakReference *aShell) :
+ nsHyperTextAccessibleWrap(aContent, aShell)
 {
 }
 
 NS_IMPL_ISUPPORTS_INHERITED3(nsXULTextFieldAccessible, nsAccessible, nsHyperTextAccessible, nsIAccessibleText, nsIAccessibleEditableText)
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsXULTextFieldAccessible: nsIAccessible
 
@@ -772,17 +771,17 @@ nsXULTextFieldAccessible::NativeState()
   PRUint64 state = nsHyperTextAccessibleWrap::NativeState();
 
   nsCOMPtr<nsIContent> inputField(GetInputField());
   NS_ENSURE_TRUE(inputField, state);
 
   // Create a temporary accessible from the HTML text field to get
   // the accessible state from. Doesn't add to cache into document cache.
   nsRefPtr<nsHTMLTextFieldAccessible> tempAccessible =
-    new nsHTMLTextFieldAccessible(inputField, mDoc);
+    new nsHTMLTextFieldAccessible(inputField, mWeakShell);
   if (!tempAccessible)
     return state;
 
   state |= tempAccessible->NativeState();
 
   nsCOMPtr<nsIDOMXULMenuListElement> menuList(do_QueryInterface(mContent));
   if (menuList) {
     // <xul:menulist droppable="false">
@@ -861,24 +860,23 @@ NS_IMETHODIMP nsXULTextFieldAccessible::
 }
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsXULTextFieldAccessible: nsAccessible protected
 
 void
 nsXULTextFieldAccessible::CacheChildren()
 {
-  NS_ENSURE_TRUE(mDoc,);
   // Create child accessibles for native anonymous content of underlying HTML
   // input element.
   nsCOMPtr<nsIContent> inputContent(GetInputField());
   if (!inputContent)
     return;
 
-  nsAccTreeWalker walker(mDoc->GetWeakShell(), inputContent, false);
+  nsAccTreeWalker walker(mWeakShell, inputContent, false);
 
   nsAccessible* child = nsnull;
   while ((child = walker.NextChild()) && AppendChild(child));
 }
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsXULTextFieldAccessible: nsHyperTextAccessible protected
 
--- a/accessible/src/xul/nsXULFormControlAccessible.h
+++ b/accessible/src/xul/nsXULFormControlAccessible.h
@@ -56,17 +56,17 @@ typedef ProgressMeterAccessible<100> XUL
  *
  * @note  Don't inherit from nsFormControlAccessible - it doesn't allow children
  *         and a button can have a dropmarker child.
  */
 class nsXULButtonAccessible : public nsAccessibleWrap
 {
 public:
   enum { eAction_Click = 0 };
-  nsXULButtonAccessible(nsIContent* aContent, nsDocAccessible* aDoc);
+  nsXULButtonAccessible(nsIContent *aContent, nsIWeakReference *aShell);
 
   // nsISupports
   NS_DECL_ISUPPORTS_INHERITED
 
   // nsIAccessible
   NS_IMETHOD GetActionName(PRUint8 aIndex, nsAString& aName);
   NS_IMETHOD DoAction(PRUint8 index);
 
@@ -95,17 +95,17 @@ protected:
 
 /**
  * Used for XUL checkbox element.
  */
 class nsXULCheckboxAccessible : public nsFormControlAccessible
 {
 public:
   enum { eAction_Click = 0 };
-  nsXULCheckboxAccessible(nsIContent* aContent, nsDocAccessible* aDoc);
+  nsXULCheckboxAccessible(nsIContent *aContent, nsIWeakReference *aShell);
 
   // nsIAccessible
   NS_IMETHOD GetActionName(PRUint8 aIndex, nsAString& aName);
   NS_IMETHOD DoAction(PRUint8 index);
 
   // nsAccessible
   virtual mozilla::a11y::role NativeRole();
   virtual PRUint64 NativeState();
@@ -116,17 +116,17 @@ public:
 
 /**
  * Used for XUL dropmarker element.
  */
 class nsXULDropmarkerAccessible : public nsFormControlAccessible
 {
 public:
   enum { eAction_Click = 0 };
-  nsXULDropmarkerAccessible(nsIContent* aContent, nsDocAccessible* aDoc);
+  nsXULDropmarkerAccessible(nsIContent *aContent, nsIWeakReference *aShell);
 
   // nsIAccessible
   NS_IMETHOD GetActionName(PRUint8 aIndex, nsAString& aName);
   NS_IMETHOD DoAction(PRUint8 index);
 
   // nsAccessible
   virtual mozilla::a11y::role NativeRole();
   virtual PRUint64 NativeState();
@@ -139,49 +139,49 @@ private:
 };
 
 /**
  * Used for XUL groupbox element.
  */
 class nsXULGroupboxAccessible : public nsAccessibleWrap
 {
 public:
-  nsXULGroupboxAccessible(nsIContent* aContent, nsDocAccessible* aDoc);
+  nsXULGroupboxAccessible(nsIContent *aContent, nsIWeakReference *aShell);
 
   // nsAccessible
   virtual mozilla::a11y::role NativeRole();
   virtual nsresult GetNameInternal(nsAString& aName);
   virtual Relation RelationByType(PRUint32 aRelationType);
 };
 
 /**
  * Used for XUL radio element (radio button).
  */
 class nsXULRadioButtonAccessible : public nsRadioButtonAccessible
 {
 
 public:
-  nsXULRadioButtonAccessible(nsIContent* aContent, nsDocAccessible* aDoc);
+  nsXULRadioButtonAccessible(nsIContent *aContent, nsIWeakReference *aShell);
 
   // nsAccessible
   virtual void GetPositionAndSizeInternal(PRInt32 *aPosInSet,
                                           PRInt32 *aSetSize);
   virtual PRUint64 NativeState();
 
   // Widgets
   virtual nsAccessible* ContainerWidget() const;
 };
 
 /**
  * Used for XUL radiogroup element.
  */
 class nsXULRadioGroupAccessible : public XULSelectControlAccessible
 {
 public:
-  nsXULRadioGroupAccessible(nsIContent* aContent, nsDocAccessible* aDoc);
+  nsXULRadioGroupAccessible(nsIContent *aContent, nsIWeakReference *aShell);
 
   // nsAccessible
   virtual mozilla::a11y::role NativeRole();
   virtual PRUint64 NativeState();
 
   // Widgets
   virtual bool IsWidget() const;
   virtual bool IsActiveWidget() const;
@@ -189,74 +189,74 @@ public:
 };
 
 /**
  * Used for XUL statusbar element.
  */
 class nsXULStatusBarAccessible : public nsAccessibleWrap
 {
 public:
-  nsXULStatusBarAccessible(nsIContent* aContent, nsDocAccessible* aDoc);
+  nsXULStatusBarAccessible(nsIContent *aContent, nsIWeakReference *aShell);
 
   // nsAccessible
   virtual mozilla::a11y::role NativeRole();
 };
 
 /**
  * Used for XUL toolbarbutton element.
  */
 class nsXULToolbarButtonAccessible : public nsXULButtonAccessible
 {
 public:
-  nsXULToolbarButtonAccessible(nsIContent* aContent, nsDocAccessible* aDoc);
+  nsXULToolbarButtonAccessible(nsIContent *aContent, nsIWeakReference *aShell);
 
   // nsAccessible
   virtual void GetPositionAndSizeInternal(PRInt32 *aPosInSet,
                                           PRInt32 *aSetSize);
 
   // nsXULToolbarButtonAccessible
   static bool IsSeparator(nsAccessible *aAccessible);
 };
 
 /**
  * Used for XUL toolbar element.
  */
 class nsXULToolbarAccessible : public nsAccessibleWrap
 {
 public:
-  nsXULToolbarAccessible(nsIContent* aContent, nsDocAccessible* aDoc);
+  nsXULToolbarAccessible(nsIContent *aContent, nsIWeakReference *aShell);
 
   // nsAccessible
   virtual mozilla::a11y::role NativeRole();
   virtual nsresult GetNameInternal(nsAString& aName);
 };
 
 /**
  * Used for XUL toolbarseparator element.
  */
 class nsXULToolbarSeparatorAccessible : public nsLeafAccessible
 {
 public:
   nsXULToolbarSeparatorAccessible(nsIContent* aContent,
-                                  nsDocAccessible* aDoc);
+                                  nsIWeakReference *aShell);
 
   // nsAccessible
   virtual mozilla::a11y::role NativeRole();
   virtual PRUint64 NativeState();
 };
 
 /**
  * Used for XUL textbox element.
  */
 class nsXULTextFieldAccessible : public nsHyperTextAccessibleWrap
 {
 public:
   enum { eAction_Click = 0 };
 
-  nsXULTextFieldAccessible(nsIContent* aContent, nsDocAccessible* aDoc);
+  nsXULTextFieldAccessible(nsIContent* aContent, nsIWeakReference *aShell);
 
   NS_DECL_ISUPPORTS_INHERITED
 
   // nsIAccessible
   NS_IMETHOD GetValue(nsAString& aValue);
   NS_IMETHOD GetActionName(PRUint8 aIndex, nsAString& aName);
   NS_IMETHOD DoAction(PRUint8 index);
 
--- a/accessible/src/xul/nsXULListboxAccessible.cpp
+++ b/accessible/src/xul/nsXULListboxAccessible.cpp
@@ -37,17 +37,16 @@
  * the terms of any one of the MPL, the GPL or the LGPL.
  *
  * ***** END LICENSE BLOCK ***** */
 
 #include "nsXULListboxAccessible.h"
 
 #include "nsAccessibilityService.h"
 #include "nsAccUtils.h"
-#include "nsDocAccessible.h"
 #include "Role.h"
 #include "States.h"
 
 #include "nsComponentManagerUtils.h"
 #include "nsIAutoCompleteInput.h"
 #include "nsIAutoCompletePopup.h"
 #include "nsIDOMXULMenuListElement.h"
 #include "nsIDOMXULMultSelectCntrlEl.h"
@@ -57,18 +56,18 @@
 
 using namespace mozilla::a11y;
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsXULColumnsAccessible
 ////////////////////////////////////////////////////////////////////////////////
 
 nsXULColumnsAccessible::
-  nsXULColumnsAccessible(nsIContent* aContent, nsDocAccessible* aDoc) :
-  nsAccessibleWrap(aContent, aDoc)
+  nsXULColumnsAccessible(nsIContent *aContent, nsIWeakReference *aShell) :
+  nsAccessibleWrap(aContent, aShell)
 {
 }
 
 role
 nsXULColumnsAccessible::NativeRole()
 {
   return roles::LIST;
 }
@@ -80,18 +79,18 @@ nsXULColumnsAccessible::NativeState()
 }
 
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsXULColumnItemAccessible
 ////////////////////////////////////////////////////////////////////////////////
 
 nsXULColumnItemAccessible::
-  nsXULColumnItemAccessible(nsIContent* aContent, nsDocAccessible* aDoc) :
-  nsLeafAccessible(aContent, aDoc)
+  nsXULColumnItemAccessible(nsIContent *aContent, nsIWeakReference *aShell) :
+  nsLeafAccessible(aContent, aShell)
 {
 }
 
 role
 nsXULColumnItemAccessible::NativeRole()
 {
   return roles::COLUMNHEADER;
 }
@@ -128,18 +127,18 @@ nsXULColumnItemAccessible::DoAction(PRUi
   return NS_OK;
 }
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsXULListboxAccessible
 ////////////////////////////////////////////////////////////////////////////////
 
 nsXULListboxAccessible::
-  nsXULListboxAccessible(nsIContent* aContent, nsDocAccessible* aDoc) :
-  XULSelectControlAccessible(aContent, aDoc)
+  nsXULListboxAccessible(nsIContent *aContent, nsIWeakReference *aShell) :
+  XULSelectControlAccessible(aContent, aShell)
 {
   nsIContent* parentContent = mContent->GetParent();
   if (parentContent) {
     nsCOMPtr<nsIAutoCompletePopup> autoCompletePopupElm =
       do_QueryInterface(parentContent);
     if (autoCompletePopupElm)
       mFlags |= eAutoCompletePopupAccessible;
   }
@@ -312,18 +311,19 @@ nsXULListboxAccessible::GetCellAt(PRInt3
   nsCOMPtr<nsIDOMXULSelectControlElement> control =
     do_QueryInterface(mContent);
 
   nsCOMPtr<nsIDOMXULSelectControlItemElement> item;
   control->GetItemAtIndex(aRow, getter_AddRefs(item));
   NS_ENSURE_TRUE(item, NS_ERROR_INVALID_ARG);
 
   nsCOMPtr<nsIContent> itemContent(do_QueryInterface(item));
-  NS_ENSURE_TRUE(mDoc, NS_ERROR_FAILURE);
-  nsAccessible *row = mDoc->GetAccessible(itemContent);
+
+  nsAccessible *row =
+    GetAccService()->GetAccessibleInWeakShell(itemContent, mWeakShell);
   NS_ENSURE_STATE(row);
 
   nsresult rv = row->GetChildAt(aColumn, aAccessibleCell);
   NS_ENSURE_SUCCESS(rv, NS_ERROR_INVALID_ARG);
 
   return NS_OK;
 }
 
@@ -596,23 +596,23 @@ nsXULListboxAccessible::GetSelectedCells
   control->GetSelectedItems(getter_AddRefs(selectedItems));
   if (!selectedItems)
     return NS_OK;
 
   PRUint32 selectedItemsCount = 0;
   rv = selectedItems->GetLength(&selectedItemsCount);
   NS_ENSURE_SUCCESS(rv, rv);
 
-  NS_ENSURE_TRUE(mDoc, NS_ERROR_FAILURE);
   PRUint32 index = 0;
   for (; index < selectedItemsCount; index++) {
     nsCOMPtr<nsIDOMNode> itemNode;
     selectedItems->Item(index, getter_AddRefs(itemNode));
     nsCOMPtr<nsIContent> itemContent(do_QueryInterface(itemNode));
-    nsAccessible *item = mDoc->GetAccessible(itemContent);
+    nsAccessible *item =
+      GetAccService()->GetAccessibleInWeakShell(itemContent, mWeakShell);
 
     if (item) {
       PRInt32 cellCount = item->GetChildCount();
       for (PRInt32 cellIdx = 0; cellIdx < cellCount; cellIdx++) {
         nsAccessible *cell = mChildren[cellIdx];
         if (cell->Role() == roles::CELL)
           selCells->AppendElement(static_cast<nsIAccessible*>(cell), false);
       }
@@ -895,18 +895,18 @@ nsXULListboxAccessible::ContainerWidget(
   return nsnull;
 }
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsXULListitemAccessible
 ////////////////////////////////////////////////////////////////////////////////
 
 nsXULListitemAccessible::
-  nsXULListitemAccessible(nsIContent* aContent, nsDocAccessible* aDoc) :
-  nsXULMenuitemAccessible(aContent, aDoc)
+  nsXULListitemAccessible(nsIContent *aContent, nsIWeakReference *aShell) :
+  nsXULMenuitemAccessible(aContent, aShell)
 {
   mIsCheckbox = mContent->AttrValueIs(kNameSpaceID_None,
                                       nsGkAtoms::type,
                                       nsGkAtoms::checkbox,
                                       eCaseMatters);
 }
 
 NS_IMPL_ISUPPORTS_INHERITED0(nsXULListitemAccessible, nsAccessible)
@@ -924,17 +924,17 @@ nsXULListitemAccessible::GetListAccessib
 
   nsCOMPtr<nsIDOMXULSelectControlElement> list;
   listItem->GetControl(getter_AddRefs(list));
 
   nsCOMPtr<nsIContent> listContent(do_QueryInterface(list));
   if (!listContent)
     return nsnull;
 
-  return mDoc->GetAccessible(listContent);
+  return GetAccService()->GetAccessibleInWeakShell(listContent, mWeakShell);
 }
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsXULListitemAccessible nsAccessible
 
 void
 nsXULListitemAccessible::Description(nsString& aDesc)
 {
@@ -1048,18 +1048,18 @@ nsXULListitemAccessible::ContainerWidget
 }
 
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsXULListCellAccessible
 ////////////////////////////////////////////////////////////////////////////////
 
 nsXULListCellAccessible::
-  nsXULListCellAccessible(nsIContent* aContent, nsDocAccessible* aDoc) :
-  nsHyperTextAccessibleWrap(aContent, aDoc)
+  nsXULListCellAccessible(nsIContent *aContent, nsIWeakReference *aShell) :
+  nsHyperTextAccessibleWrap(aContent, aShell)
 {
 }
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsISupports
 
 NS_IMPL_ISUPPORTS_INHERITED1(nsXULListCellAccessible,
                              nsHyperTextAccessible,
--- a/accessible/src/xul/nsXULListboxAccessible.h
+++ b/accessible/src/xul/nsXULListboxAccessible.h
@@ -51,31 +51,31 @@ class nsIWeakReference;
 
 /**
  * nsXULColumnsAccessible are accessible for list and tree columns elements
  * (xul:treecols and xul:listcols).
  */
 class nsXULColumnsAccessible : public nsAccessibleWrap
 {
 public:
-  nsXULColumnsAccessible(nsIContent* aContent, nsDocAccessible* aDoc);
+  nsXULColumnsAccessible(nsIContent *aContent, nsIWeakReference *aShell);
 
   // nsAccessible
   virtual mozilla::a11y::role NativeRole();
   virtual PRUint64 NativeState();
 };
 
 /**
  * nsXULColumnAccessible are accessibles for list and tree column elements
  * (xul:listcol and xul:treecol).
  */
 class nsXULColumnItemAccessible : public nsLeafAccessible
 {
 public:
-  nsXULColumnItemAccessible(nsIContent* aContent, nsDocAccessible* aDoc);
+  nsXULColumnItemAccessible(nsIContent *aContent, nsIWeakReference *aShell);
 
   // nsIAccessible
   NS_IMETHOD GetActionName(PRUint8 aIndex, nsAString& aName);
   NS_IMETHOD DoAction(PRUint8 aIndex);
 
   // nsAccessible
   virtual mozilla::a11y::role NativeRole();
   virtual PRUint64 NativeState();
@@ -88,17 +88,17 @@ public:
 
 /*
  * A class the represents the XUL Listbox widget.
  */
 class nsXULListboxAccessible : public XULSelectControlAccessible,
                                public nsIAccessibleTable
 {
 public:
-  nsXULListboxAccessible(nsIContent* aContent, nsDocAccessible* aDoc);
+  nsXULListboxAccessible(nsIContent *aContent, nsIWeakReference *aShell);
   virtual ~nsXULListboxAccessible() {}
 
   NS_DECL_ISUPPORTS_INHERITED
   NS_DECL_NSIACCESSIBLETABLE
 
   // nsIAccessible
   NS_IMETHOD GetValue(nsAString& aValue);
 
@@ -122,17 +122,17 @@ protected:
   */
 class nsXULListitemAccessible : public nsXULMenuitemAccessible
 {
 public:
   enum { eAction_Click = 0 };
 
   NS_DECL_ISUPPORTS_INHERITED
   
-  nsXULListitemAccessible(nsIContent* aContent, nsDocAccessible* aDoc);
+  nsXULListitemAccessible(nsIContent *aContent, nsIWeakReference *aShell);
   virtual ~nsXULListitemAccessible() {}
 
   // nsIAccessible
   NS_IMETHOD GetActionName(PRUint8 index, nsAString& aName);
   // Don't use XUL menuitems's description attribute
 
   // nsAccessible
   virtual void Description(nsString& aDesc);
@@ -158,17 +158,17 @@ private:
 
 /**
  * Class represents xul:listcell.
  */
 class nsXULListCellAccessible : public nsHyperTextAccessibleWrap,
                                 public nsIAccessibleTableCell
 {
 public:
-  nsXULListCellAccessible(nsIContent* aContent, nsDocAccessible* aDoc);
+  nsXULListCellAccessible(nsIContent *aContent, nsIWeakReference *aShell);
 
   // nsISupports
   NS_DECL_ISUPPORTS_INHERITED
 
   // nsIAccessibleTableCell
   NS_DECL_NSIACCESSIBLETABLECELL
 
   // nsAccessible
--- a/accessible/src/xul/nsXULMenuAccessible.cpp
+++ b/accessible/src/xul/nsXULMenuAccessible.cpp
@@ -66,18 +66,18 @@
 using namespace mozilla;
 using namespace mozilla::a11y;
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsXULMenuitemAccessible
 ////////////////////////////////////////////////////////////////////////////////
 
 nsXULMenuitemAccessible::
-  nsXULMenuitemAccessible(nsIContent* aContent, nsDocAccessible* aDoc) :
-  nsAccessibleWrap(aContent, aDoc)
+  nsXULMenuitemAccessible(nsIContent *aContent, nsIWeakReference *aShell) :
+  nsAccessibleWrap(aContent, aShell)
 {
 }
 
 PRUint64
 nsXULMenuitemAccessible::NativeState()
 {
   PRUint64 state = nsAccessible::NativeState();
 
@@ -403,18 +403,18 @@ nsXULMenuitemAccessible::ContainerWidget
 }
 
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsXULMenuSeparatorAccessible
 ////////////////////////////////////////////////////////////////////////////////
 
 nsXULMenuSeparatorAccessible::
-  nsXULMenuSeparatorAccessible(nsIContent* aContent, nsDocAccessible* aDoc) :
-  nsXULMenuitemAccessible(aContent, aDoc)
+  nsXULMenuSeparatorAccessible(nsIContent *aContent, nsIWeakReference *aShell) :
+  nsXULMenuitemAccessible(aContent, aShell)
 {
 }
 
 PRUint64
 nsXULMenuSeparatorAccessible::NativeState()
 {
   // Isn't focusable, but can be offscreen/invisible -- only copy those states
   return nsXULMenuitemAccessible::NativeState() &
@@ -449,18 +449,18 @@ nsXULMenuSeparatorAccessible::ActionCoun
   return 0;
 }
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsXULMenupopupAccessible
 ////////////////////////////////////////////////////////////////////////////////
 
 nsXULMenupopupAccessible::
-  nsXULMenupopupAccessible(nsIContent* aContent, nsDocAccessible* aDoc) :
-  XULSelectControlAccessible(aContent, aDoc)
+  nsXULMenupopupAccessible(nsIContent *aContent, nsIWeakReference *aShell) :
+  XULSelectControlAccessible(aContent, aShell)
 {
   nsMenuPopupFrame* menuPopupFrame = do_QueryFrame(GetFrame());
   if (menuPopupFrame && menuPopupFrame->IsMenu())
     mFlags |= eMenuPopupAccessible;
 
   // May be the anonymous <menupopup> inside <menulist> (a combobox)
   mSelectControl = do_QueryInterface(mContent->GetParent());
 }
@@ -551,17 +551,17 @@ nsXULMenupopupAccessible::AreItemsOperab
 {
   nsMenuPopupFrame* menuPopupFrame = do_QueryFrame(GetFrame());
   return menuPopupFrame && menuPopupFrame->IsOpen();
 }
 
 nsAccessible*
 nsXULMenupopupAccessible::ContainerWidget() const
 {
-  nsDocAccessible* document = Document();
+  nsDocAccessible* document = GetDocAccessible();
 
   nsMenuPopupFrame* menuPopupFrame = do_QueryFrame(GetFrame());
   while (menuPopupFrame) {
     nsAccessible* menuPopup =
       document->GetAccessible(menuPopupFrame->GetContent());
     if (!menuPopup) // shouldn't be a real case
       return nsnull;
 
@@ -589,18 +589,18 @@ nsXULMenupopupAccessible::ContainerWidge
   return nsnull;
 }
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsXULMenubarAccessible
 ////////////////////////////////////////////////////////////////////////////////
 
 nsXULMenubarAccessible::
-  nsXULMenubarAccessible(nsIContent* aContent, nsDocAccessible* aDoc) :
-  nsAccessibleWrap(aContent, aDoc)
+  nsXULMenubarAccessible(nsIContent *aContent, nsIWeakReference *aShell) :
+  nsAccessibleWrap(aContent, aShell)
 {
 }
 
 PRUint64
 nsXULMenubarAccessible::NativeState()
 {
   PRUint64 state = nsAccessible::NativeState();
 
--- a/accessible/src/xul/nsXULMenuAccessible.h
+++ b/accessible/src/xul/nsXULMenuAccessible.h
@@ -46,17 +46,17 @@
 /**
  * Used for XUL menu, menuitem elements.
  */
 class nsXULMenuitemAccessible : public nsAccessibleWrap
 {
 public:
   enum { eAction_Click = 0 };
 
-  nsXULMenuitemAccessible(nsIContent* aContent, nsDocAccessible* aDoc);
+  nsXULMenuitemAccessible(nsIContent *aContent, nsIWeakReference *aShell);
 
   // nsIAccessible
   NS_IMETHOD DoAction(PRUint8 index);
   NS_IMETHOD GetActionName(PRUint8 aIndex, nsAString& aName);
 
   // nsAccessible
   virtual void Description(nsString& aDescription);
   virtual nsresult GetNameInternal(nsAString& aName);
@@ -80,17 +80,17 @@ public:
 };
 
 /**
  * Used for XUL menuseparator element.
  */
 class nsXULMenuSeparatorAccessible : public nsXULMenuitemAccessible
 {
 public:
-  nsXULMenuSeparatorAccessible(nsIContent* aContent, nsDocAccessible* aDoc);
+  nsXULMenuSeparatorAccessible(nsIContent *aContent, nsIWeakReference *aShell);
 
   // nsIAccessible
   NS_IMETHOD DoAction(PRUint8 index);
   NS_IMETHOD GetActionName(PRUint8 aIndex, nsAString& aName);
 
   // nsAccessible
   virtual nsresult GetNameInternal(nsAString& aName);
   virtual mozilla::a11y::role NativeRole();
@@ -102,17 +102,17 @@ public:
 
 
 /**
  * Used for XUL menupopup and panel.
  */
 class nsXULMenupopupAccessible : public XULSelectControlAccessible
 {
 public:
-  nsXULMenupopupAccessible(nsIContent* aContent, nsDocAccessible* aDoc);
+  nsXULMenupopupAccessible(nsIContent *aContent, nsIWeakReference *aShell);
 
   // nsAccessible
   virtual nsresult GetNameInternal(nsAString& aName);
   virtual mozilla::a11y::role NativeRole();
   virtual PRUint64 NativeState();
 
   // Widgets
   virtual bool IsWidget() const;
@@ -123,17 +123,17 @@ public:
 };
 
 /**
  * Used for XUL menubar element.
  */
 class nsXULMenubarAccessible : public nsAccessibleWrap
 {
 public:
-  nsXULMenubarAccessible(nsIContent* aContent, nsDocAccessible* aDoc);
+  nsXULMenubarAccessible(nsIContent *aContent, nsIWeakReference *aShell);
 
   // nsAccessible
   virtual nsresult GetNameInternal(nsAString& aName);
   virtual mozilla::a11y::role NativeRole();
   virtual PRUint64 NativeState();
 
   // Widget
   virtual bool IsActiveWidget() const;
--- a/accessible/src/xul/nsXULSliderAccessible.cpp
+++ b/accessible/src/xul/nsXULSliderAccessible.cpp
@@ -48,18 +48,18 @@
 
 using namespace mozilla::a11y;
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsXULSliderAccessible
 ////////////////////////////////////////////////////////////////////////////////
 
 nsXULSliderAccessible::
-  nsXULSliderAccessible(nsIContent* aContent, nsDocAccessible* aDoc) :
-  nsAccessibleWrap(aContent, aDoc)
+  nsXULSliderAccessible(nsIContent *aContent, nsIWeakReference *aShell) :
+  nsAccessibleWrap(aContent, aShell)
 {
 }
 
 // nsISupports
 
 NS_IMPL_ISUPPORTS_INHERITED1(nsXULSliderAccessible,
                              nsAccessibleWrap,
                              nsIAccessibleValue)
@@ -284,18 +284,18 @@ nsXULSliderAccessible::SetSliderAttr(nsI
 }
 
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsXULThumbAccessible
 ////////////////////////////////////////////////////////////////////////////////
 
 nsXULThumbAccessible::
-  nsXULThumbAccessible(nsIContent* aContent, nsDocAccessible* aDoc) :
-  nsAccessibleWrap(aContent, aDoc)
+  nsXULThumbAccessible(nsIContent *aContent, nsIWeakReference *aShell) :
+  nsAccessibleWrap(aContent, aShell)
 {
 }
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsXULThumbAccessible: nsAccessible
 
 role
 nsXULThumbAccessible::NativeRole()
--- a/accessible/src/xul/nsXULSliderAccessible.h
+++ b/accessible/src/xul/nsXULSliderAccessible.h
@@ -44,17 +44,17 @@
 #include "nsIDOMElement.h"
 
 /**
  * Used for XUL slider and scale elements.
  */
 class nsXULSliderAccessible : public nsAccessibleWrap
 {
 public:
-  nsXULSliderAccessible(nsIContent* aContent, nsDocAccessible* aDoc);
+  nsXULSliderAccessible(nsIContent *aContent, nsIWeakReference *aShell);
 
   // nsISupports
   NS_DECL_ISUPPORTS_INHERITED
 
   // nsIAccessible
   NS_IMETHOD GetValue(nsAString& aValue);
   NS_IMETHOD GetActionName(PRUint8 aIndex, nsAString& aName);
   NS_IMETHOD DoAction(PRUint8 aIndex);
@@ -85,16 +85,16 @@ private:
 
 
 /**
  * Used for slider's thumb element.
  */
 class nsXULThumbAccessible : public nsAccessibleWrap
 {
 public:
-  nsXULThumbAccessible(nsIContent* aContent, nsDocAccessible* aDoc);
+  nsXULThumbAccessible(nsIContent *aContent, nsIWeakReference *aShell);
 
   // nsAccessible
   virtual mozilla::a11y::role NativeRole();
 };
 
 #endif
 
--- a/accessible/src/xul/nsXULTabAccessible.cpp
+++ b/accessible/src/xul/nsXULTabAccessible.cpp
@@ -54,18 +54,18 @@
 
 using namespace mozilla::a11y;
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsXULTabAccessible
 ////////////////////////////////////////////////////////////////////////////////
 
 nsXULTabAccessible::
-  nsXULTabAccessible(nsIContent* aContent, nsDocAccessible* aDoc) :
-  nsAccessibleWrap(aContent, aDoc)
+  nsXULTabAccessible(nsIContent *aContent, nsIWeakReference *aShell) :
+  nsAccessibleWrap(aContent, aShell)
 {
 }
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsXULTabAccessible: nsIAccessible
 
 PRUint8
 nsXULTabAccessible::ActionCount()
@@ -173,18 +173,18 @@ nsXULTabAccessible::GetPositionAndSizeIn
 }
 
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsXULTabsAccessible
 ////////////////////////////////////////////////////////////////////////////////
 
 nsXULTabsAccessible::
-  nsXULTabsAccessible(nsIContent* aContent, nsDocAccessible* aDoc) :
-  XULSelectControlAccessible(aContent, aDoc)
+  nsXULTabsAccessible(nsIContent *aContent, nsIWeakReference *aShell) :
+  XULSelectControlAccessible(aContent, aShell)
 {
 }
 
 role
 nsXULTabsAccessible::NativeRole()
 {
   return roles::PAGETABLIST;
 }
@@ -209,35 +209,35 @@ nsXULTabsAccessible::GetNameInternal(nsA
 }
 
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsXULTabpanelsAccessible
 ////////////////////////////////////////////////////////////////////////////////
 
 nsXULTabpanelsAccessible::
-  nsXULTabpanelsAccessible(nsIContent* aContent, nsDocAccessible* aDoc) :
-  nsAccessibleWrap(aContent, aDoc)
+  nsXULTabpanelsAccessible(nsIContent *aContent, nsIWeakReference *aShell) :
+  nsAccessibleWrap(aContent, aShell)
 {
 }
 
 role
 nsXULTabpanelsAccessible::NativeRole()
 {
   return roles::PANE;
 }
 
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsXULTabpanelAccessible
 ////////////////////////////////////////////////////////////////////////////////
 
 nsXULTabpanelAccessible::
-  nsXULTabpanelAccessible(nsIContent* aContent, nsDocAccessible* aDoc) :
-  nsAccessibleWrap(aContent, aDoc)
+  nsXULTabpanelAccessible(nsIContent *aContent, nsIWeakReference *aShell) :
+  nsAccessibleWrap(aContent, aShell)
 {
 }
 
 role
 nsXULTabpanelAccessible::NativeRole()
 {
   return roles::PROPERTYPAGE;
 }
--- a/accessible/src/xul/nsXULTabAccessible.h
+++ b/accessible/src/xul/nsXULTabAccessible.h
@@ -47,17 +47,17 @@
 /**
  * An individual tab, xul:tab element.
  */
 class nsXULTabAccessible : public nsAccessibleWrap
 {
 public:
   enum { eAction_Switch = 0 };
 
-  nsXULTabAccessible(nsIContent* aContent, nsDocAccessible* aDoc);
+  nsXULTabAccessible(nsIContent *aContent, nsIWeakReference *aShell);
 
   // nsIAccessible
   NS_IMETHOD GetActionName(PRUint8 aIndex, nsAString& aName);
   NS_IMETHOD DoAction(PRUint8 index);
 
   // nsAccessible
   virtual void GetPositionAndSizeInternal(PRInt32 *aPosInSet,
                                           PRInt32 *aSetSize);
@@ -71,17 +71,17 @@ public:
 
 
 /**
  * A container of tab objects, xul:tabs element.
  */
 class nsXULTabsAccessible : public XULSelectControlAccessible
 {
 public:
-  nsXULTabsAccessible(nsIContent* aContent, nsDocAccessible* aDoc);
+  nsXULTabsAccessible(nsIContent *aContent, nsIWeakReference *aShell);
 
   // nsIAccessible
   NS_IMETHOD GetValue(nsAString& _retval);
 
   // nsAccessible
   virtual nsresult GetNameInternal(nsAString& aName);
   virtual mozilla::a11y::role NativeRole();
 
@@ -91,17 +91,17 @@ public:
 
 
 /** 
  * A container of tab panels, xul:tabpanels element.
  */
 class nsXULTabpanelsAccessible : public nsAccessibleWrap
 {
 public:
-  nsXULTabpanelsAccessible(nsIContent* aContent, nsDocAccessible* aDoc);
+  nsXULTabpanelsAccessible(nsIContent *aContent, nsIWeakReference *aShell);
 
   // nsAccessible
   virtual mozilla::a11y::role NativeRole();
 };
 
 
 /**
  * A tabpanel object, child elements of xul:tabpanels element. Note,the object
@@ -111,17 +111,17 @@ public:
  *
  * XXX: we need to move the class logic into generic class since
  * for example we do not create instance of this class for XUL textbox used as
  * a tabpanel.
  */
 class nsXULTabpanelAccessible : public nsAccessibleWrap
 {
 public:
-  nsXULTabpanelAccessible(nsIContent* aContent, nsDocAccessible* aDoc);
+  nsXULTabpanelAccessible(nsIContent *aContent, nsIWeakReference *aShell);
 
   // nsAccessible
   virtual mozilla::a11y::role NativeRole();
   virtual Relation RelationByType(PRUint32 aType);
 };
 
 #endif
 
--- a/accessible/src/xul/nsXULTextAccessible.cpp
+++ b/accessible/src/xul/nsXULTextAccessible.cpp
@@ -56,18 +56,18 @@
 
 using namespace mozilla::a11y;
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsXULTextAccessible
 ////////////////////////////////////////////////////////////////////////////////
 
 nsXULTextAccessible::
-  nsXULTextAccessible(nsIContent* aContent, nsDocAccessible* aDoc) :
-  nsHyperTextAccessibleWrap(aContent, aDoc)
+  nsXULTextAccessible(nsIContent *aContent, nsIWeakReference *aShell) :
+  nsHyperTextAccessibleWrap(aContent, aShell)
 {
 }
 
 nsresult
 nsXULTextAccessible::GetNameInternal(nsAString& aName)
 {
   // if the value attr doesn't exist, the screen reader must get the accessible text
   // from the accessible text interface or from the children
@@ -107,18 +107,18 @@ nsXULTextAccessible::RelationByType(PRUi
 }
 
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsXULTooltipAccessible
 ////////////////////////////////////////////////////////////////////////////////
 
 nsXULTooltipAccessible::
-  nsXULTooltipAccessible(nsIContent* aContent, nsDocAccessible* aDoc) :
-  nsLeafAccessible(aContent, aDoc)
+  nsXULTooltipAccessible(nsIContent *aContent, nsIWeakReference *aShell) :
+  nsLeafAccessible(aContent, aShell)
 {
 }
 
 PRUint64
 nsXULTooltipAccessible::NativeState()
 {
   PRUint64 states = nsLeafAccessible::NativeState();
 
@@ -134,18 +134,18 @@ nsXULTooltipAccessible::NativeRole()
 }
 
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsXULLinkAccessible
 ////////////////////////////////////////////////////////////////////////////////
 
 nsXULLinkAccessible::
-  nsXULLinkAccessible(nsIContent* aContent, nsDocAccessible* aDoc) :
-  nsHyperTextAccessibleWrap(aContent, aDoc)
+  nsXULLinkAccessible(nsIContent *aContent, nsIWeakReference *aShell) :
+  nsHyperTextAccessibleWrap(aContent, aShell)
 {
 }
 
 // Expose nsIAccessibleHyperLink unconditionally
 NS_IMPL_ISUPPORTS_INHERITED1(nsXULLinkAccessible, nsHyperTextAccessibleWrap,
                              nsIAccessibleHyperLink)
 
 ////////////////////////////////////////////////////////////////////////////////
--- a/accessible/src/xul/nsXULTextAccessible.h
+++ b/accessible/src/xul/nsXULTextAccessible.h
@@ -44,44 +44,44 @@
 #include "nsHyperTextAccessibleWrap.h"
 
 /**
  * Used for XUL description and label elements.
  */
 class nsXULTextAccessible : public nsHyperTextAccessibleWrap
 {
 public:
-  nsXULTextAccessible(nsIContent* aContent, nsDocAccessible* aDoc);
+  nsXULTextAccessible(nsIContent *aContent, nsIWeakReference *aShell);
 
   // nsAccessible
   virtual nsresult GetNameInternal(nsAString& aName);
   virtual mozilla::a11y::role NativeRole();
   virtual PRUint64 NativeState();
   virtual Relation RelationByType(PRUint32 aRelationType);
 };
 
 /**
  * Used for XUL tooltip element.
  */
 class nsXULTooltipAccessible : public nsLeafAccessible
 {
 
 public:
-  nsXULTooltipAccessible(nsIContent* aContent, nsDocAccessible* aDoc);
+  nsXULTooltipAccessible(nsIContent *aContent, nsIWeakReference *aShell);
 
   // nsAccessible
   virtual mozilla::a11y::role NativeRole();
   virtual PRUint64 NativeState();
 };
 
 class nsXULLinkAccessible : public nsHyperTextAccessibleWrap
 {
 
 public:
-  nsXULLinkAccessible(nsIContent* aContent, nsDocAccessible* aDoc);
+  nsXULLinkAccessible(nsIContent *aContent, nsIWeakReference *aShell);
 
   NS_DECL_ISUPPORTS_INHERITED
 
   // nsIAccessible
   NS_IMETHOD GetValue(nsAString& aValue);
 
   NS_IMETHOD GetActionName(PRUint8 aIndex, nsAString& aName);
   NS_IMETHOD DoAction(PRUint8 aIndex);
--- a/accessible/src/xul/nsXULTreeAccessible.cpp
+++ b/accessible/src/xul/nsXULTreeAccessible.cpp
@@ -60,18 +60,18 @@
 
 using namespace mozilla::a11y;
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsXULTreeAccessible
 ////////////////////////////////////////////////////////////////////////////////
 
 nsXULTreeAccessible::
-  nsXULTreeAccessible(nsIContent* aContent, nsDocAccessible* aDoc) :
-  nsAccessibleWrap(aContent, aDoc)
+  nsXULTreeAccessible(nsIContent *aContent, nsIWeakReference *aShell) :
+  nsAccessibleWrap(aContent, aShell)
 {
   mTree = nsCoreUtils::GetTreeBoxObject(aContent);
   if (mTree)
     mTree->GetView(getter_AddRefs(mTreeView));
 
   NS_ASSERTION(mTree && mTreeView, "Can't get mTree or mTreeView!\n");
 
   nsIContent* parentContent = mContent->GetParent();
@@ -542,17 +542,17 @@ nsXULTreeAccessible::GetTreeItemAccessib
   void *key = reinterpret_cast<void*>(aRow);
   nsAccessible* cachedTreeItem = mAccessibleCache.GetWeak(key);
   if (cachedTreeItem)
     return cachedTreeItem;
 
   nsRefPtr<nsAccessible> treeItem = CreateTreeItemAccessible(aRow);
   if (treeItem) {
     if (mAccessibleCache.Put(key, treeItem)) {
-      if (Document()->BindToDocument(treeItem, nsnull))
+      if (GetDocAccessible()->BindToDocument(treeItem, nsnull))
         return treeItem;
 
       mAccessibleCache.Remove(key);
     }
   }
 
   return nsnull;
 }
@@ -562,17 +562,17 @@ nsXULTreeAccessible::InvalidateCache(PRI
 {
   if (IsDefunct())
     return;
 
   // Do not invalidate the cache if rows have been inserted.
   if (aCount > 0)
     return;
 
-  nsDocAccessible* document = Document();
+  nsDocAccessible* document = GetDocAccessible();
 
   // Fire destroy event for removed tree items and delete them from caches.
   for (PRInt32 rowIdx = aRow; rowIdx < aRow - aCount; rowIdx++) {
 
     void* key = reinterpret_cast<void*>(rowIdx);
     nsAccessible* treeItem = mAccessibleCache.GetWeak(key);
 
     if (treeItem) {
@@ -666,45 +666,45 @@ nsXULTreeAccessible::TreeViewChanged()
 
   // Fire reorder event on tree accessible on accessible tree (do not fire
   // show/hide events on tree items because it can be expensive to fire them for
   // each tree item.
   nsRefPtr<AccEvent> reorderEvent =
     new AccEvent(nsIAccessibleEvent::EVENT_REORDER, this, eAutoDetect,
                  AccEvent::eCoalesceFromSameSubtree);
   if (reorderEvent)
-    Document()->FireDelayedAccessibleEvent(reorderEvent);
+    GetDocAccessible()->FireDelayedAccessibleEvent(reorderEvent);
 
   // Clear cache.
   ClearCache(mAccessibleCache);
   mTree->GetView(getter_AddRefs(mTreeView));
 }
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsXULTreeAccessible: protected implementation
 
 already_AddRefed<nsAccessible>
 nsXULTreeAccessible::CreateTreeItemAccessible(PRInt32 aRow)
 {
   nsRefPtr<nsAccessible> accessible =
-    new nsXULTreeItemAccessible(mContent, mDoc, this, mTree, mTreeView,
+    new nsXULTreeItemAccessible(mContent, mWeakShell, this, mTree, mTreeView,
                                 aRow);
 
   return accessible.forget();
 }
                              
 ////////////////////////////////////////////////////////////////////////////////
 // nsXULTreeItemAccessibleBase
 ////////////////////////////////////////////////////////////////////////////////
 
 nsXULTreeItemAccessibleBase::
-  nsXULTreeItemAccessibleBase(nsIContent* aContent, nsDocAccessible* aDoc,
-                              nsAccessible* aParent, nsITreeBoxObject* aTree,
-                              nsITreeView* aTreeView, PRInt32 aRow) :
-  nsAccessibleWrap(aContent, aDoc),
+  nsXULTreeItemAccessibleBase(nsIContent *aContent, nsIWeakReference *aShell,
+                              nsAccessible *aParent, nsITreeBoxObject *aTree,
+                              nsITreeView *aTreeView, PRInt32 aRow) :
+  nsAccessibleWrap(aContent, aShell),
   mTree(aTree), mTreeView(aTreeView), mRow(aRow)
 {
   mParent = aParent;
 }
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsXULTreeItemAccessibleBase: nsISupports implementation
 
@@ -1108,20 +1108,20 @@ nsXULTreeItemAccessibleBase::GetCellName
 }
 
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsXULTreeItemAccessible
 ////////////////////////////////////////////////////////////////////////////////
 
 nsXULTreeItemAccessible::
-  nsXULTreeItemAccessible(nsIContent* aContent, nsDocAccessible* aDoc,
-                          nsAccessible* aParent, nsITreeBoxObject* aTree,
-                          nsITreeView* aTreeView, PRInt32 aRow) :
-  nsXULTreeItemAccessibleBase(aContent, aDoc, aParent, aTree, aTreeView, aRow)
+  nsXULTreeItemAccessible(nsIContent *aContent, nsIWeakReference *aShell,
+                          nsAccessible *aParent, nsITreeBoxObject *aTree,
+                          nsITreeView *aTreeView, PRInt32 aRow) :
+  nsXULTreeItemAccessibleBase(aContent, aShell, aParent, aTree, aTreeView, aRow)
 {
   mColumn = nsCoreUtils::GetFirstSensibleColumn(mTree);
 }
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsXULTreeItemAccessible: nsISupports implementation
 
 NS_IMPL_CYCLE_COLLECTION_CLASS(nsXULTreeItemAccessible)
@@ -1226,18 +1226,18 @@ nsXULTreeItemAccessible::CacheChildren()
 }
 
 
 ////////////////////////////////////////////////////////////////////////////////
 //  nsXULTreeColumnsAccessible
 ////////////////////////////////////////////////////////////////////////////////
 
 nsXULTreeColumnsAccessible::
-  nsXULTreeColumnsAccessible(nsIContent* aContent, nsDocAccessible* aDoc) :
-  nsXULColumnsAccessible(aContent, aDoc)
+  nsXULTreeColumnsAccessible(nsIContent *aContent, nsIWeakReference *aShell) :
+  nsXULColumnsAccessible(aContent, aShell)
 {
 }
 
 nsAccessible*
 nsXULTreeColumnsAccessible::GetSiblingAtOffset(PRInt32 aOffset,
                                                nsresult* aError) const
 {
   if (aOffset < 0)
--- a/accessible/src/xul/nsXULTreeAccessible.h
+++ b/accessible/src/xul/nsXULTreeAccessible.h
@@ -62,17 +62,17 @@ const PRUint32 kDefaultTreeCacheSize = 2
 }
 
 class nsXULTreeAccessible : public nsAccessibleWrap
 {
 public:
   using nsAccessible::GetChildCount;
   using nsAccessible::GetChildAt;
 
-  nsXULTreeAccessible(nsIContent* aContent, nsDocAccessible* aDoc);
+  nsXULTreeAccessible(nsIContent *aContent, nsIWeakReference *aShell);
 
   // nsISupports and cycle collection
   NS_DECL_ISUPPORTS_INHERITED
   NS_DECL_CYCLE_COLLECTION_CLASS_INHERITED(nsXULTreeAccessible,
                                            nsAccessible)
 
   // nsIAccessible
   NS_IMETHOD GetValue(nsAString& aValue);
@@ -175,19 +175,19 @@ NS_DEFINE_STATIC_IID_ACCESSOR(nsXULTreeA
   { 0x94, 0x0b, 0xb1, 0xe6, 0xb0, 0x83, 0x1d, 0xfc }  \
 }
 
 class nsXULTreeItemAccessibleBase : public nsAccessibleWrap
 {
 public:
   using nsAccessible::GetParent;
 
-  nsXULTreeItemAccessibleBase(nsIContent* aContent, nsDocAccessible* aDoc,
-                              nsAccessible* aParent, nsITreeBoxObject* aTree,
-                              nsITreeView* aTreeView, PRInt32 aRow);
+  nsXULTreeItemAccessibleBase(nsIContent *aContent, nsIWeakReference *aShell,
+                              nsAccessible *aParent, nsITreeBoxObject *aTree,
+                              nsITreeView *aTreeView, PRInt32 aRow);
 
   // nsISupports and cycle collection
   NS_DECL_ISUPPORTS_INHERITED
   NS_DECL_CYCLE_COLLECTION_CLASS_INHERITED(nsXULTreeItemAccessibleBase,
                                            nsAccessibleWrap)
 
   // nsIAccessible
   NS_IMETHOD GetBounds(PRInt32 *aX, PRInt32 *aY,
@@ -270,19 +270,19 @@ NS_DEFINE_STATIC_IID_ACCESSOR(nsXULTreeI
 
 
 /**
  * Accessible class for items for XUL tree.
  */
 class nsXULTreeItemAccessible : public nsXULTreeItemAccessibleBase
 {
 public:
-  nsXULTreeItemAccessible(nsIContent* aContent, nsDocAccessible* aDoc,
-                          nsAccessible* aParent, nsITreeBoxObject* aTree,
-                          nsITreeView* aTreeView, PRInt32 aRow);
+  nsXULTreeItemAccessible(nsIContent *aContent, nsIWeakReference *aShell,
+                          nsAccessible *aParent, nsITreeBoxObject *aTree,
+                          nsITreeView *aTreeView, PRInt32 aRow);
 
   // nsISupports and cycle collection
   NS_DECL_ISUPPORTS_INHERITED
   NS_DECL_CYCLE_COLLECTION_CLASS_INHERITED(nsXULTreeItemAccessible,
                                            nsXULTreeItemAccessibleBase)
 
   NS_IMETHOD GetName(nsAString& aName);
 
@@ -309,17 +309,17 @@ protected:
 
 
 /**
  * Accessible class for columns element of XUL tree.
  */
 class nsXULTreeColumnsAccessible : public nsXULColumnsAccessible
 {
 public:
-  nsXULTreeColumnsAccessible(nsIContent* aContent, nsDocAccessible* aDoc);
+  nsXULTreeColumnsAccessible(nsIContent *aContent, nsIWeakReference *aShell);
 
 protected:
 
   // nsAccessible
   virtual nsAccessible* GetSiblingAtOffset(PRInt32 aOffset,
                                            nsresult *aError = nsnull) const;
 };
 
--- a/accessible/src/xul/nsXULTreeGridAccessible.cpp
+++ b/accessible/src/xul/nsXULTreeGridAccessible.cpp
@@ -52,18 +52,18 @@
 
 using namespace mozilla::a11y;
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsXULTreeGridAccessible
 ////////////////////////////////////////////////////////////////////////////////
 
 nsXULTreeGridAccessible::
-  nsXULTreeGridAccessible(nsIContent* aContent, nsDocAccessible* aDoc) :
-  nsXULTreeAccessible(aContent, aDoc)
+  nsXULTreeGridAccessible(nsIContent *aContent, nsIWeakReference *aShell) :
+  nsXULTreeAccessible(aContent, aShell)
 {
 }
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsXULTreeGridAccessible: nsISupports implementation
 
 NS_IMPL_ISUPPORTS_INHERITED1(nsXULTreeGridAccessible,
                              nsXULTreeAccessible,
@@ -600,32 +600,32 @@ nsXULTreeGridAccessible::NativeRole()
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsXULTreeGridAccessible: nsXULTreeAccessible implementation
 
 already_AddRefed<nsAccessible>
 nsXULTreeGridAccessible::CreateTreeItemAccessible(PRInt32 aRow)
 {
   nsRefPtr<nsAccessible> accessible =
-    new nsXULTreeGridRowAccessible(mContent, mDoc, this, mTree,
+    new nsXULTreeGridRowAccessible(mContent, mWeakShell, this, mTree,
                                    mTreeView, aRow);
 
   return accessible.forget();
 }
 
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsXULTreeGridRowAccessible
 ////////////////////////////////////////////////////////////////////////////////
 
 nsXULTreeGridRowAccessible::
-  nsXULTreeGridRowAccessible(nsIContent* aContent, nsDocAccessible* aDoc,
-                             nsAccessible* aTreeAcc, nsITreeBoxObject* aTree,
-                             nsITreeView* aTreeView, PRInt32 aRow) :
-  nsXULTreeItemAccessibleBase(aContent, aDoc, aTreeAcc, aTree, aTreeView, aRow)
+  nsXULTreeGridRowAccessible(nsIContent *aContent, nsIWeakReference *aShell,
+                             nsAccessible *aTreeAcc, nsITreeBoxObject* aTree,
+                             nsITreeView *aTreeView, PRInt32 aRow) :
+  nsXULTreeItemAccessibleBase(aContent, aShell, aTreeAcc, aTree, aTreeView, aRow)
 {
   mAccessibleCache.Init(kDefaultTreeCacheSize);
 }
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsXULTreeGridRowAccessible: nsISupports and cycle collection implementation
 
 NS_IMPL_CYCLE_COLLECTION_CLASS(nsXULTreeGridRowAccessible)
@@ -756,21 +756,21 @@ nsXULTreeGridRowAccessible::GetCellAcces
   NS_PRECONDITION(aColumn, "No tree column!");
 
   void* key = static_cast<void*>(aColumn);
   nsAccessible* cachedCell = mAccessibleCache.GetWeak(key);
   if (cachedCell)
     return cachedCell;
 
   nsRefPtr<nsAccessible> cell =
-    new nsXULTreeGridCellAccessibleWrap(mContent, mDoc, this, mTree,
+    new nsXULTreeGridCellAccessibleWrap(mContent, mWeakShell, this, mTree,
                                         mTreeView, mRow, aColumn);
   if (cell) {
     if (mAccessibleCache.Put(key, cell)) {
-      if (Document()->BindToDocument(cell, nsnull))
+      if (GetDocAccessible()->BindToDocument(cell, nsnull))
         return cell;
 
       mAccessibleCache.Remove(key);
     }
   }
 
   return nsnull;
 }
@@ -806,21 +806,21 @@ nsXULTreeGridRowAccessible::CacheChildre
 {
 }
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsXULTreeGridCellAccessible
 ////////////////////////////////////////////////////////////////////////////////
 
 nsXULTreeGridCellAccessible::
-  nsXULTreeGridCellAccessible(nsIContent* aContent, nsDocAccessible* aDoc,
-                              nsXULTreeGridRowAccessible* aRowAcc,
-                              nsITreeBoxObject* aTree, nsITreeView* aTreeView,
-                              PRInt32 aRow, nsITreeColumn* aColumn) :
-  nsLeafAccessible(aContent, aDoc), mTree(aTree),
+nsXULTreeGridCellAccessible(nsIContent *aContent, nsIWeakReference *aShell,
+                            nsXULTreeGridRowAccessible *aRowAcc,
+                            nsITreeBoxObject *aTree, nsITreeView *aTreeView,
+                            PRInt32 aRow, nsITreeColumn* aColumn) :
+  nsLeafAccessible(aContent, aShell), mTree(aTree),
   mTreeView(aTreeView), mRow(aRow), mColumn(aColumn)
 {
   mParent = aRowAcc;
 }
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsXULTreeGridCellAccessible: nsISupports implementation
 
@@ -1060,29 +1060,30 @@ nsXULTreeGridCellAccessible::GetRowExten
 }
 
 NS_IMETHODIMP
 nsXULTreeGridCellAccessible::GetColumnHeaderCells(nsIArray **aHeaderCells)
 {
   NS_ENSURE_ARG_POINTER(aHeaderCells);
   *aHeaderCells = nsnull;
 
-  if (IsDefunct() || !mDoc)
+  if (IsDefunct())
     return NS_ERROR_FAILURE;
 
   nsresult rv = NS_OK;
   nsCOMPtr<nsIMutableArray> headerCells =
     do_CreateInstance(NS_ARRAY_CONTRACTID, &rv);
   NS_ENSURE_SUCCESS(rv, rv);
 
   nsCOMPtr<nsIDOMElement> columnElm;
   mColumn->GetElement(getter_AddRefs(columnElm));
 
   nsCOMPtr<nsIContent> columnContent(do_QueryInterface(columnElm));
-  nsAccessible *headerCell = mDoc->GetAccessible(columnContent);
+  nsAccessible *headerCell =
+    GetAccService()->GetAccessibleInWeakShell(columnContent, mWeakShell);
 
   if (headerCell)
     headerCells->AppendElement(static_cast<nsIAccessible*>(headerCell),
                                false);
 
   NS_ADDREF(*aHeaderCells = headerCells);
   return NS_OK;
 }
--- a/accessible/src/xul/nsXULTreeGridAccessible.h
+++ b/accessible/src/xul/nsXULTreeGridAccessible.h
@@ -45,17 +45,17 @@
 
 /**
  * Represents accessible for XUL tree in the case when it has multiple columns.
  */
 class nsXULTreeGridAccessible : public nsXULTreeAccessible,
                                 public nsIAccessibleTable
 {
 public:
-  nsXULTreeGridAccessible(nsIContent* aContent, nsDocAccessible* aDoc);
+  nsXULTreeGridAccessible(nsIContent *aContent, nsIWeakReference *aShell);
 
   // nsISupports
   NS_DECL_ISUPPORTS_INHERITED
 
   // nsIAccessibleTable
   NS_DECL_NSIACCESSIBLETABLE
 
   // nsAccessible
@@ -73,19 +73,19 @@ protected:
  * multiple columns.
  */
 class nsXULTreeGridRowAccessible : public nsXULTreeItemAccessibleBase
 {
 public:
   using nsAccessible::GetChildCount;
   using nsAccessible::GetChildAt;
 
-  nsXULTreeGridRowAccessible(nsIContent* aContent, nsDocAccessible* aDoc,
-                             nsAccessible* aParent, nsITreeBoxObject* aTree,
-                             nsITreeView* aTreeView, PRInt32 aRow);
+  nsXULTreeGridRowAccessible(nsIContent *aContent, nsIWeakReference *aShell,
+                             nsAccessible *aParent, nsITreeBoxObject *aTree,
+                             nsITreeView *aTreeView, PRInt32 aRow);
 
   // nsISupports and cycle collection
   NS_DECL_ISUPPORTS_INHERITED
   NS_DECL_CYCLE_COLLECTION_CLASS_INHERITED(nsXULTreeGridRowAccessible,
                                            nsXULTreeItemAccessibleBase)
 
   // nsAccessNode
   virtual void Shutdown();
@@ -127,19 +127,19 @@ protected:
 }
 
 class nsXULTreeGridCellAccessible : public nsLeafAccessible,
                                     public nsIAccessibleTableCell
 {
 public:
   using nsAccessible::GetParent;
 
-  nsXULTreeGridCellAccessible(nsIContent* aContent, nsDocAccessible* aDoc,
-                              nsXULTreeGridRowAccessible* aRowAcc,
-                              nsITreeBoxObject* aTree, nsITreeView* aTreeView,
+  nsXULTreeGridCellAccessible(nsIContent *aContent, nsIWeakReference *aShell,
+                              nsXULTreeGridRowAccessible *aRowAcc,
+                              nsITreeBoxObject *aTree, nsITreeView *aTreeView,
                               PRInt32 aRow, nsITreeColumn* aColumn);
 
   // nsISupports
   NS_DECL_ISUPPORTS_INHERITED
   NS_DECL_CYCLE_COLLECTION_CLASS_INHERITED(nsXULTreeGridCellAccessible,
                                            nsLeafAccessible)
 
   // nsIAccessible