--- a/accessible/src/base/nsARIAGridAccessible.cpp
+++ b/accessible/src/base/nsARIAGridAccessible.cpp
@@ -453,28 +453,28 @@ nsARIAGridAccessible::GetSelectedCells(n
     do_CreateInstance(NS_ARRAY_CONTRACTID, &rv);
   NS_ENSURE_SUCCESS(rv, rv);
 
   nsAccIterator rowIter(this, nsAccIterator::GetRow);
 
   nsAccessible *row = nsnull;
   while (row = rowIter.GetNext()) {
     nsAccIterator cellIter(row, nsAccIterator::GetCell);
-    nsIAccessible *cell = nsnull;
+    nsAccessible *cell = nsnull;
 
     if (nsAccUtils::IsARIASelected(row)) {
       while (cell = cellIter.GetNext())
-        selCells->AppendElement(cell, PR_FALSE);
+        selCells->AppendElement(static_cast<nsIAccessible *>(cell), PR_FALSE);
 
       continue;
     }
 
     while (cell = cellIter.GetNext()) {
       if (nsAccUtils::IsARIASelected(cell))
-        selCells->AppendElement(cell, PR_FALSE);
+        selCells->AppendElement(static_cast<nsIAccessible *>(cell), PR_FALSE);
     }
   }
 
   NS_ADDREF(*aCells = selCells);
   return NS_OK;
 }
 
 NS_IMETHODIMP
@@ -1053,18 +1053,17 @@ NS_IMETHODIMP
 nsARIAGridCellAccessible::IsSelected(PRBool *aIsSelected)
 {
   NS_ENSURE_ARG_POINTER(aIsSelected);
   *aIsSelected = PR_FALSE;
 
   if (IsDefunct())
     return NS_ERROR_FAILURE;
 
-  nsCOMPtr<nsIAccessible> row;
-  GetParent(getter_AddRefs(row));
+  nsAccessible *row = GetParent();
   if (nsAccUtils::Role(row) != nsIAccessibleRole::ROLE_ROW)
     return NS_OK;
 
   if (!nsAccUtils::IsARIASelected(row) && !nsAccUtils::IsARIASelected(this))
     return NS_OK;
 
   *aIsSelected = PR_TRUE;
   return NS_OK;
@@ -1079,27 +1078,21 @@ nsARIAGridCellAccessible::GetARIAState(P
   nsresult rv = nsHyperTextAccessibleWrap::GetARIAState(aState, aExtraState);
   NS_ENSURE_SUCCESS(rv, rv);
 
   // Return if the gridcell has aria-selected="true".
   if (*aState & nsIAccessibleStates::STATE_SELECTED)
     return NS_OK;
 
   // Check aria-selected="true" on the row.
-  nsCOMPtr<nsIAccessible> row;
-  GetParent(getter_AddRefs(row));
+  nsAccessible *row = GetParent();
   if (nsAccUtils::Role(row) != nsIAccessibleRole::ROLE_ROW)
     return NS_OK;
 
-  nsRefPtr<nsAccessible> acc = do_QueryObject(row);
-  nsCOMPtr<nsIDOMNode> rowNode;
-  acc->GetDOMNode(getter_AddRefs(rowNode));
-  NS_ENSURE_STATE(rowNode);
-
-  nsCOMPtr<nsIContent> rowContent(do_QueryInterface(rowNode));
+  nsIContent *rowContent = row->GetContent();
   if (nsAccUtils::HasDefinedARIAToken(rowContent,
                                       nsAccessibilityAtoms::aria_selected) &&
       !rowContent->AttrValueIs(kNameSpaceID_None,
                                nsAccessibilityAtoms::aria_selected,
                                nsAccessibilityAtoms::_false, eCaseMatters)) {
 
     *aState |= nsIAccessibleStates::STATE_SELECTABLE |
       nsIAccessibleStates::STATE_SELECTED;

--- a/accessible/src/base/nsAccUtils.cpp
+++ b/accessible/src/base/nsAccUtils.cpp
@@ -96,53 +96,46 @@ nsAccUtils::SetAccGroupAttrs(nsIPersiste
 
     value.Truncate();
     value.AppendInt(aSetSize);
     SetAccAttr(aAttributes, nsAccessibilityAtoms::setsize, value);
   }
 }
 
 PRInt32
-nsAccUtils::GetDefaultLevel(nsAccessible *aAcc)
+nsAccUtils::GetDefaultLevel(nsAccessible *aAccessible)
 {
-  PRUint32 role = nsAccUtils::Role(aAcc);
+  PRUint32 role = nsAccUtils::Role(aAccessible);
 
   if (role == nsIAccessibleRole::ROLE_OUTLINEITEM)
     return 1;
 
   if (role == nsIAccessibleRole::ROLE_ROW) {
-    nsCOMPtr<nsIAccessible> parent = aAcc->GetParent();
+    nsAccessible *parent = aAccessible->GetParent();
     if (Role(parent) == nsIAccessibleRole::ROLE_TREE_TABLE) {
       // It is a row inside flatten treegrid. Group level is always 1 until it
       // is overriden by aria-level attribute.
       return 1;
     }
   }
 
   return 0;
 }
 
 PRInt32
-nsAccUtils::GetARIAOrDefaultLevel(nsIAccessible *aAcc)
+nsAccUtils::GetARIAOrDefaultLevel(nsAccessible *aAccessible)
 {
-  nsRefPtr<nsAccessible> acc = do_QueryObject(aAcc);
-  NS_ENSURE_TRUE(acc, 0);
-
-  nsCOMPtr<nsIDOMNode> node;
-  acc->GetDOMNode(getter_AddRefs(node));
-  nsCOMPtr<nsIContent> content(do_QueryInterface(node));
-  NS_ENSURE_TRUE(content, 0);
-
   PRInt32 level = 0;
-  nsCoreUtils::GetUIntAttr(content, nsAccessibilityAtoms::aria_level, &level);
+  nsCoreUtils::GetUIntAttr(aAccessible->GetContent(),
+                           nsAccessibilityAtoms::aria_level, &level);
 
   if (level != 0)
     return level;
 
-  return GetDefaultLevel(acc);
+  return GetDefaultLevel(aAccessible);
 }
 
 void
 nsAccUtils::GetPositionAndSizeForXULSelectControlItem(nsIContent *aContent,
                                                       PRInt32 *aPosInSet,
                                                       PRInt32 *aSetSize)
 {
   nsCOMPtr<nsIDOMXULSelectControlItemElement> item(do_QueryInterface(aContent));
@@ -504,32 +497,21 @@ nsAccUtils::GetMultiSelectableContainer(
                                                    State(accessible));
 
   if (State(container) & nsIAccessibleStates::STATE_MULTISELECTABLE)
     return container;
   return nsnull;
 }
 
 PRBool
-nsAccUtils::IsARIASelected(nsIAccessible *aAccessible)
+nsAccUtils::IsARIASelected(nsAccessible *aAccessible)
 {
-  nsRefPtr<nsAccessible> acc = do_QueryObject(aAccessible);
-  nsCOMPtr<nsIDOMNode> node;
-  acc->GetDOMNode(getter_AddRefs(node));
-  NS_ASSERTION(node, "No DOM node!");
-
-  if (node) {
-    nsCOMPtr<nsIContent> content(do_QueryInterface(node));
-    if (content->AttrValueIs(kNameSpaceID_None,
-                             nsAccessibilityAtoms::aria_selected,
-                             nsAccessibilityAtoms::_true, eCaseMatters))
-      return PR_TRUE;
-  }
-
-  return PR_FALSE;
+  return aAccessible->GetContent()->
+    AttrValueIs(kNameSpaceID_None, nsAccessibilityAtoms::aria_selected,
+                nsAccessibilityAtoms::_true, eCaseMatters);
 }
 
 already_AddRefed<nsHyperTextAccessible>
 nsAccUtils::GetTextAccessibleFromSelection(nsISelection *aSelection,
                                            nsINode **aNode)
 {
   // Get accessible from selection's focus DOM point (the DOM point where
   // selection is ended).

--- a/accessible/src/base/nsAccUtils.h
+++ b/accessible/src/base/nsAccUtils.h
@@ -102,17 +102,17 @@ public:
    * Get default value of the level for the given accessible.
    */
   static PRInt32 GetDefaultLevel(nsAccessible *aAcc);
 
   /**
    * Return ARIA level value or the default one if ARIA is missed for the
    * given accessible.
    */
-  static PRInt32 GetARIAOrDefaultLevel(nsIAccessible *aAcc);
+  static PRInt32 GetARIAOrDefaultLevel(nsAccessible *aAccessible);
 
   /**
    * Compute position in group (posinset) and group size (setsize) for
    * nsIDOMXULSelectControlItemElement node.
    */
   static void GetPositionAndSizeForXULSelectControlItem(nsIContent *aContent,
                                                         PRInt32 *aPosInSet,
                                                         PRInt32 *aSetSize);
@@ -224,17 +224,17 @@ public:
    * Return multi selectable container for the given item.
    */
   static nsAccessible *GetMultiSelectableContainer(nsINode *aNode);
 
   /**
    * Return true if the DOM node of given accessible has aria-selected="true"
    * attribute.
    */
-  static PRBool IsARIASelected(nsIAccessible *aAccessible);
+  static PRBool IsARIASelected(nsAccessible *aAccessible);
 
   /**
    * Return text accessible containing focus point of the given selection.
    * Used for normal and misspelling selection changes processing.
    *
    * @param aSelection  [in] the given selection
    * @param aNode       [out, optional] the DOM node of text accessible
    * @return            text accessible

--- a/accessible/src/base/nsAccessNode.cpp
+++ b/accessible/src/base/nsAccessNode.cpp
@@ -154,23 +154,26 @@ nsAccessNode::Shutdown()
 // nsIAccessNode
 NS_IMETHODIMP nsAccessNode::GetUniqueID(void **aUniqueID)
 {
   *aUniqueID = static_cast<void*>(GetNode());
   return NS_OK;
 }
 
 // nsIAccessNode
-NS_IMETHODIMP nsAccessNode::GetOwnerWindow(void **aWindow)
+NS_IMETHODIMP
+nsAccessNode::GetOwnerWindow(void **aWindow)
 {
+  NS_ENSURE_ARG_POINTER(aWindow);
   *aWindow = nsnull;
-  nsCOMPtr<nsIAccessibleDocument> docAccessible(GetDocAccessible());
-  if (!docAccessible)
-    return NS_ERROR_FAILURE; // This node or doc accessible is shut down
-  return docAccessible->GetWindowHandle(aWindow);
+
+  if (IsDefunct())
+    return NS_ERROR_FAILURE;
+
+  return GetDocAccessible()->GetWindowHandle(aWindow);
 }
 
 nsApplicationAccessible*
 nsAccessNode::GetApplicationAccessible()
 {
   NS_ASSERTION(!nsAccessibilityService::IsShutdown(),
                "Accessibility wasn't initialized!");
 
@@ -287,16 +290,23 @@ nsPresContext* nsAccessNode::GetPresCont
 {
   nsCOMPtr<nsIPresShell> presShell(GetPresShell());
   if (!presShell) {
     return nsnull;
   }
   return presShell->GetPresContext();
 }
 
+nsDocAccessible *
+nsAccessNode::GetDocAccessible() const
+{
+  return mContent ?
+    GetAccService()->GetDocAccessible(mContent->GetOwnerDoc()) : nsnull;
+}
+
 already_AddRefed<nsRootAccessible> nsAccessNode::GetRootAccessible()
 {
   nsCOMPtr<nsIDocShellTreeItem> docShellTreeItem =
     nsCoreUtils::GetDocShellTreeItemFor(mContent);
   NS_ASSERTION(docShellTreeItem, "No docshell tree item for mContent");
   if (!docShellTreeItem) {
     return nsnull;
   }
@@ -313,17 +323,16 @@ already_AddRefed<nsRootAccessible> nsAcc
 }
 
 nsIFrame*
 nsAccessNode::GetFrame()
 {
   return mContent ? mContent->GetPrimaryFrame() : nsnull;
 }
 
-
 ////////////////////////////////////////////////////////////////////////////////
 // nsIAccessNode
 
 NS_IMETHODIMP
 nsAccessNode::GetDOMNode(nsIDOMNode **aDOMNode)
 {
   NS_ENSURE_ARG_POINTER(aDOMNode);
   *aDOMNode = nsnull;
@@ -335,17 +344,17 @@ nsAccessNode::GetDOMNode(nsIDOMNode **aD
   return NS_OK;
 }
 
 NS_IMETHODIMP
 nsAccessNode::GetDocument(nsIAccessibleDocument **aDocument)
 {
   NS_ENSURE_ARG_POINTER(aDocument);
 
-  NS_IF_ADDREF(*aDocument = nsAccUtils::GetDocAccessibleFor(mWeakShell));
+  NS_IF_ADDREF(*aDocument = GetDocAccessible());
   return NS_OK;
 }
 
 NS_IMETHODIMP
 nsAccessNode::GetRootDocument(nsIAccessibleDocument **aRootDocument)
 {
   NS_ENSURE_ARG_POINTER(aRootDocument);
 
@@ -489,17 +498,8 @@ nsAccessNode::GetLanguage(nsAString& aLa
     nsIDocument *doc = mContent->GetOwnerDoc();
     if (doc) {
       doc->GetHeaderData(nsAccessibilityAtoms::headerContentLanguage, aLanguage);
     }
   }
  
   return NS_OK;
 }
-
-////////////////////////////////////////////////////////////////////////////////
-// nsAccessNode protected
-
-nsDocAccessible*
-nsAccessNode::GetDocAccessible() const
-{
-  return nsAccUtils::GetDocAccessibleFor(mWeakShell);
-}

--- a/accessible/src/base/nsAccessNode.h
+++ b/accessible/src/base/nsAccessNode.h
@@ -94,19 +94,19 @@ public:
     static void ShutdownXPAccessibility();
 
   /**
    * Return an application accessible.
    */
   static nsApplicationAccessible* GetApplicationAccessible();
 
   /**
-   * Return the document accessible for this accesnode.
+   * Return the document accessible for this access node.
    */
-  nsDocAccessible* GetDocAccessible() const;
+  inline nsDocAccessible *GetDocAccessible() const;
 
   /**
    * Return the root document accessible for this accessnode.
    */
   already_AddRefed<nsRootAccessible> GetRootAccessible();
 
   /**
    * Reference to a node of focused accessible.

--- a/accessible/src/base/nsCaretAccessible.cpp
+++ b/accessible/src/base/nsCaretAccessible.cpp
@@ -257,17 +257,17 @@ nsCaretAccessible::NormalSelectionChange
   if (textAcc == mLastTextAccessible && caretOffset == mLastCaretOffset) {
     PRInt32 selectionCount;
     textAcc->GetSelectionCount(&selectionCount);   // Don't swallow similar events when selecting text
     if (!selectionCount) {
       return NS_OK;  // Swallow duplicate caret event
     }
   }
   mLastCaretOffset = caretOffset;
-  mLastTextAccessible = textAcc;
+  mLastTextAccessible.swap(textAcc);
 
   nsRefPtr<nsAccEvent> event =
     new nsAccCaretMoveEvent(textNode);
   NS_ENSURE_TRUE(event, NS_ERROR_OUT_OF_MEMORY);
 
   return mRootAccessible->FireDelayedAccessibleEvent(event);
 }
 
@@ -300,20 +300,17 @@ nsCaretAccessible::GetCaretRect(nsIWidge
   NS_ENSURE_TRUE(aOutWidget, caretRect);
   *aOutWidget = nsnull;
   NS_ENSURE_TRUE(mRootAccessible, caretRect);
 
   if (!mLastTextAccessible) {
     return caretRect;    // Return empty rect
   }
 
-  nsRefPtr<nsAccessible> lastTextAccessible =
-    do_QueryObject(mLastTextAccessible);
-
-  nsINode *lastNodeWithCaret = lastTextAccessible->GetNode();
+  nsINode *lastNodeWithCaret = mLastTextAccessible->GetNode();
   NS_ENSURE_TRUE(lastNodeWithCaret, caretRect);
 
   nsIPresShell *presShell = nsCoreUtils::GetPresShellFor(lastNodeWithCaret);
   NS_ENSURE_TRUE(presShell, caretRect);
 
   nsRefPtr<nsCaret> caret = presShell->GetCaret();
   NS_ENSURE_TRUE(caret, caretRect);
 

--- a/accessible/src/base/nsCaretAccessible.h
+++ b/accessible/src/base/nsCaretAccessible.h
@@ -33,27 +33,21 @@
  * the provisions above, a recipient may use your version of this file under
  * the terms of any one of the MPL, the GPL or the LGPL.
  *
  * ***** END LICENSE BLOCK ***** */
 
 #ifndef __nsCaretAccessible_h__
 #define __nsCaretAccessible_h__
 
-#include "nsIWeakReference.h"
-#include "nsIAccessibleText.h"
-#include "nsIContent.h"
+#include "nsHyperTextAccessible.h"
+
 #include "nsISelectionListener.h"
-#include "nsISelectionController.h"
-#include "nsRect.h"
 
 class nsRootAccessible;
-class nsIView;
-class nsIPresShell;
-class nsIWidget;
 
 /*
  * This special accessibility class is for the caret, which is really the currently focused selection.
  * There is only 1 visible caret per top level window (nsRootAccessible),
  * However, there may be several visible selections.
  *
  * The important selections are the one owned by each document, and the one in the currently focused control.
  *
@@ -139,15 +133,15 @@ private:
 
   // Currently focused control.
   nsCOMPtr<nsIContent> mCurrentControl;
 
   // Info for the the last selection event.
   // If it was on a control, then its control's selection. Otherwise, it's for
   // a document where the selection changed.
   nsCOMPtr<nsIWeakReference> mLastUsedSelection; // Weak ref to nsISelection
-  nsCOMPtr<nsIAccessibleText> mLastTextAccessible;
+  nsRefPtr<nsHyperTextAccessible> mLastTextAccessible;
   PRInt32 mLastCaretOffset;
 
   nsRootAccessible *mRootAccessible;
 };
 
 #endif

--- a/accessible/src/html/nsHTMLTableAccessible.cpp
+++ b/accessible/src/html/nsHTMLTableAccessible.cpp
@@ -1478,22 +1478,19 @@ nsHTMLTableAccessible::IsProbablyForLayo
   if (styledWidth.EqualsLiteral("100%")) {
     RETURN_LAYOUT_ANSWER(PR_TRUE, "<=4 columns and 100% width");
   }
   if (styledWidth.Find(NS_LITERAL_STRING("px"))) { // Hardcoded in pixels
     nsIFrame *tableFrame = GetFrame();
     NS_ENSURE_TRUE(tableFrame , NS_ERROR_FAILURE);
     nsSize tableSize  = tableFrame->GetSize();
 
-    nsCOMPtr<nsIAccessibleDocument> docAccessible = GetDocAccessible();
+    nsDocAccessible *docAccessible = GetDocAccessible();
     NS_ENSURE_TRUE(docAccessible, NS_ERROR_FAILURE);
-
-    nsRefPtr<nsAccessNode> docAccessNode = do_QueryObject(docAccessible);
-
-    nsIFrame *docFrame = docAccessNode->GetFrame();
+    nsIFrame *docFrame = docAccessible->GetFrame();
     NS_ENSURE_TRUE(docFrame , NS_ERROR_FAILURE);
 
     nsSize docSize = docFrame->GetSize();
     if (docSize.width > 0) {
       PRInt32 percentageOfDocWidth = (100 * tableSize.width) / docSize.width;
       if (percentageOfDocWidth > 95) {
         // 3-4 columns, no borders, not a lot of rows, and 95% of the doc's width
         // Probably for layout

--- a/accessible/src/html/nsHyperTextAccessible.cpp
+++ b/accessible/src/html/nsHyperTextAccessible.cpp
@@ -737,17 +737,17 @@ nsHyperTextAccessible::HypertextOffsetsT
 
   return NS_OK;
 }
 
 PRInt32
 nsHyperTextAccessible::GetRelativeOffset(nsIPresShell *aPresShell,
                                          nsIFrame *aFromFrame,
                                          PRInt32 aFromOffset,
-                                         nsIAccessible *aFromAccessible,
+                                         nsAccessible *aFromAccessible,
                                          nsSelectionAmount aAmount,
                                          nsDirection aDirection,
                                          PRBool aNeedsStart)
 {
   const PRBool kIsJumpLinesOk = PR_TRUE;          // okay to jump lines
   const PRBool kIsScrollViewAStop = PR_FALSE;     // do not stop at scroll views
   const PRBool kIsKeyboardSelect = PR_TRUE;       // is keyboard selection
   const PRBool kIsVisualBidi = PR_FALSE;          // use visual order for bidi text
@@ -758,19 +758,17 @@ nsHyperTextAccessible::GetRelativeOffset
   }
 
   // Ask layout for the new node and offset, after moving the appropriate amount
   nsPeekOffsetStruct pos;
 
   nsresult rv;
   PRInt32 contentOffset = aFromOffset;
   if (nsAccUtils::IsText(aFromAccessible)) {
-    nsRefPtr<nsAccessNode> accessNode = do_QueryObject(aFromAccessible);
-
-    nsIFrame *frame = accessNode->GetFrame();
+    nsIFrame *frame = aFromAccessible->GetFrame();
     NS_ENSURE_TRUE(frame, -1);
 
     if (frame->GetType() == nsAccessibilityAtoms::textFrame) {
       rv = RenderedToContentOffset(frame, aFromOffset, &contentOffset);
       NS_ENSURE_SUCCESS(rv, -1);
     }
   }
 
@@ -949,20 +947,18 @@ nsresult nsHyperTextAccessible::GetTextH
   nsIFrame *startFrame = GetPosAndText(startOffset, endOffset, nsnull, nsnull,
                                        nsnull, getter_AddRefs(startAcc));
 
   if (!startFrame) {
     PRInt32 textLength;
     GetCharacterCount(&textLength);
     if (aBoundaryType == BOUNDARY_LINE_START && aOffset > 0 && aOffset == textLength) {
       // Asking for start of line, while on last character
-      if (startAcc) {
-        nsRefPtr<nsAccessNode> startAccessNode = do_QueryObject(startAcc);
-        startFrame = startAccessNode->GetFrame();
-      }
+      if (startAcc)
+        startFrame = startAcc->GetFrame();
     }
     if (!startFrame) {
       return aOffset > textLength ? NS_ERROR_FAILURE : NS_OK;
     }
     else {
       // We're on the last continuation since we're on the last character
       startFrame = startFrame->GetLastContinuation();
     }

--- a/accessible/src/html/nsHyperTextAccessible.h
+++ b/accessible/src/html/nsHyperTextAccessible.h
@@ -181,17 +181,17 @@ protected:
     * @param  aFromAccessible  the starting accessible we're moving from
     * @param  aAmount          how much are we moving (word/line/etc.) ?
     * @param  aDirection       forward or backward?
     * @param  aNeedsStart      for word and line cases, are we basing this on
     *                          the start or end?
     * @return                  the resulting offset into this hypertext
     */
   PRInt32 GetRelativeOffset(nsIPresShell *aPresShell, nsIFrame *aFromFrame,
-                            PRInt32 aFromOffset, nsIAccessible *aFromAccessible,
+                            PRInt32 aFromOffset, nsAccessible *aFromAccessible,
                             nsSelectionAmount aAmount, nsDirection aDirection,
                             PRBool aNeedsStart);
 
   /**
     * Provides information for substring that is defined by the given start
     * and end offsets for this hyper text.
     *
     * @param  aStartOffset  [inout] the start offset into the hyper text. This

--- a/accessible/src/msaa/nsAccessNodeWrap.cpp
+++ b/accessible/src/msaa/nsAccessNodeWrap.cpp
@@ -179,17 +179,17 @@ STDMETHODIMP nsAccessNodeWrap::get_nodeI
     /* [out] */ unsigned short __RPC_FAR *aNodeType)
 {
 __try{
   *aNodeName = nsnull;
   *aNodeValue = nsnull;
 
   if (IsDefunct())
     return E_FAIL;
- 
+
   nsCOMPtr<nsIDOMNode> DOMNode(do_QueryInterface(GetNode()));
 
   PRUint16 nodeType = 0;
   DOMNode->GetNodeType(&nodeType);
   *aNodeType=static_cast<unsigned short>(nodeType);
 
   if (*aNodeType !=  NODETYPE_TEXT) {
     nsAutoString nodeName;

--- a/accessible/src/msaa/nsAccessibleWrap.cpp
+++ b/accessible/src/msaa/nsAccessibleWrap.cpp
@@ -1722,24 +1722,23 @@ PRInt32 nsAccessibleWrap::GetChildIDFor(
   accessNode->GetUniqueID(&uniqueID);
 
   // Yes, this means we're only compatibible with 32 bit
   // MSAA is only available for 32 bit windows, so it's okay
   return - NS_PTR_TO_INT32(uniqueID);
 }
 
 HWND
-nsAccessibleWrap::GetHWNDFor(nsIAccessible *aAccessible)
+nsAccessibleWrap::GetHWNDFor(nsAccessible *aAccessible)
 {
-  nsRefPtr<nsAccessNode> accessNode = do_QueryObject(aAccessible);
-  if (!accessNode)
-    return 0;
+  HWND hWnd = 0;
+  if (!aAccessible)
+    return hWnd;
 
-  HWND hWnd = 0;
-  nsIFrame *frame = accessNode->GetFrame();
+  nsIFrame *frame = aAccessible->GetFrame();
   if (frame) {
     nsIWidget *window = frame->GetWindow();
     PRBool isVisible;
     window->IsVisible(isVisible);
     if (isVisible) {
       // Short explanation:
       // If HWND for frame is inside a hidden window, fire the event on the
       // containing document's visible window.
@@ -1755,17 +1754,17 @@ nsAccessibleWrap::GetHWNDFor(nsIAccessib
       // combo box, we need to use an ensure that we never fire an event with
       // an HWND for a hidden window.
       hWnd = (HWND)frame->GetWindow()->GetNativeData(NS_NATIVE_WINDOW);
     }
   }
 
   if (!hWnd) {
     void* handle = nsnull;
-    nsDocAccessible *accessibleDoc = accessNode->GetDocAccessible();
+    nsDocAccessible *accessibleDoc = aAccessible->GetDocAccessible();
     if (!accessibleDoc)
       return 0;
 
     accessibleDoc->GetWindowHandle(&handle);
     hWnd = (HWND)handle;
   }
 
   return hWnd;

--- a/accessible/src/msaa/nsAccessibleWrap.h
+++ b/accessible/src/msaa/nsAccessibleWrap.h
@@ -306,17 +306,17 @@ public: // construction, destruction
                                            EXCEPINFO *pExcepInfo,
                                            UINT *puArgErr);
 
   // nsAccessible
   virtual nsresult HandleAccEvent(nsAccEvent *aEvent);
 
   // Helper methods
   static PRInt32 GetChildIDFor(nsIAccessible* aAccessible);
-  static HWND GetHWNDFor(nsIAccessible *aAccessible);
+  static HWND GetHWNDFor(nsAccessible *aAccessible);
   static HRESULT ConvertToIA2Attributes(nsIPersistentProperties *aAttributes,
                                         BSTR *aIA2Attributes);
 
   /**
    * System caret support: update the Windows caret position. 
    * The system caret works more universally than the MSAA caret
    * For example, Window-Eyes, JAWS, ZoomText and Windows Tablet Edition use it
    * We will use an invisible system caret.

--- a/accessible/src/xforms/nsXFormsAccessible.cpp
+++ b/accessible/src/xforms/nsXFormsAccessible.cpp
@@ -116,33 +116,29 @@ nsXFormsAccessible::CacheSelectChildren(
   sXFormsService->GetSelectChildrenFor(container, getter_AddRefs(children));
 
   if (!children)
     return;
 
   PRUint32 length = 0;
   children->GetLength(&length);
 
-  nsCOMPtr<nsIAccessible> accessible;
-  nsRefPtr<nsAccessible> acc;
-
   for (PRUint32 index = 0; index < length; index++) {
-    nsCOMPtr<nsIDOMNode> child;
-    children->Item(index, getter_AddRefs(child));
-    if (!child)
+    nsCOMPtr<nsIDOMNode> DOMChild;
+    children->Item(index, getter_AddRefs(DOMChild));
+    if (!DOMChild)
       continue;
 
-    GetAccService()->GetAttachedAccessibleFor(child,
-                                              getter_AddRefs(accessible));
+    nsCOMPtr<nsIContent> child(do_QueryInterface(DOMChild));
+    nsAccessible *accessible = GetAccService()->GetAttachedAccessibleFor(child);
     if (!accessible)
       continue;
 
-    acc = do_QueryObject(accessible);
-    mChildren.AppendElement(acc);
-    acc->SetParent(this);
+    mChildren.AppendElement(accessible);
+    accessible->SetParent(this);
   }
 }
 
 // nsIAccessible
 
 NS_IMETHODIMP
 nsXFormsAccessible::GetValue(nsAString& aValue)
 {

--- a/accessible/src/xul/nsXULTreeAccessible.cpp
+++ b/accessible/src/xul/nsXULTreeAccessible.cpp
@@ -539,21 +539,19 @@ nsXULTreeAccessible::InvalidateCache(PRI
     if (accessible) {
       nsRefPtr<nsAccEvent> event =
         new nsAccEvent(nsIAccessibleEvent::EVENT_HIDE, accessible, PR_FALSE);
       nsEventShell::FireEvent(event);
 
       accessible->Shutdown();
 
       // Remove accessible from document cache and tree cache.
-      nsCOMPtr<nsIAccessibleDocument> docAccessible = GetDocAccessible();
-      if (docAccessible) { 
-        nsRefPtr<nsDocAccessible> docAcc = do_QueryObject(docAccessible);
-        docAcc->RemoveAccessNodeFromCache(accessible);
-      }
+      nsDocAccessible *docAccessible = GetDocAccessible();
+      if (docAccessible)
+        docAccessible->RemoveAccessNodeFromCache(accessible);
 
       mAccessibleCache.Remove(key);
     }
   }
 
   // We dealt with removed tree items already however we may keep tree items
   // having row indexes greater than row count. We should remove these dead tree
   // items silently from caches.
@@ -568,21 +566,19 @@ nsXULTreeAccessible::InvalidateCache(PRI
 
     void *key = reinterpret_cast<void*>(rowIdx);
     nsAccessible *accessible = mAccessibleCache.GetWeak(key);
 
     if (accessible) {
       accessible->Shutdown();
 
       // Remove accessible from document cache and tree cache.
-      nsCOMPtr<nsIAccessibleDocument> docAccessible = GetDocAccessible();
-      if (docAccessible) {
-        nsRefPtr<nsDocAccessible> docAcc = do_QueryObject(docAccessible);
-        docAcc->RemoveAccessNodeFromCache(accessible);
-      }
+      nsDocAccessible *docAccessible = GetDocAccessible();
+      if (docAccessible)
+        docAccessible->RemoveAccessNodeFromCache(accessible);
 
       mAccessibleCache.Remove(key);
     }
   }
 }
 
 void
 nsXULTreeAccessible::TreeViewInvalidated(PRInt32 aStartRow, PRInt32 aEndRow,