Backed out 6 changesets (bug 832920, bug 825341, bug 838582, bug 842726, bug 629801, bug 842561) for Linux32 debug mochitest-2 and Windows/OSX mochitest-browser-chrome failures on a CLOSED TREE.
authorRyan VanderMeulen <ryanvm@gmail.com>
Fri, 22 Feb 2013 15:30:06 -0500
changeset 122689 ca34c11bf55d05f0d024df500e9fcceed130ee9b
parent 122688 5a070d16268d2ff2698afc6849a523fa5a3d040f
child 122690 7440ba65e44de857f2287b2c7987569ba7fdcd00
push id24356
push usergszorc@mozilla.com
push dateSun, 24 Feb 2013 01:00:12 +0000
treeherdermozilla-central@195e706140d1 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
bugs832920, 825341, 838582, 842726, 629801, 842561
milestone22.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Backed out 6 changesets (bug 832920, bug 825341, bug 838582, bug 842726, bug 629801, bug 842561) for Linux32 debug mochitest-2 and Windows/OSX mochitest-browser-chrome failures on a CLOSED TREE.
accessible/src/generic/HyperTextAccessible.cpp
accessible/src/msaa/TextLeafAccessibleWrap.cpp
browser/devtools/framework/Toolbox.jsm
browser/devtools/framework/toolbox-window.xul
content/base/public/nsContentUtils.h
content/base/public/nsIDocument.h
content/base/src/DocumentFragment.cpp
content/base/src/Makefile.in
content/base/src/Text.cpp
content/base/src/Text.h
content/base/src/nsContentUtils.cpp
content/base/src/nsCopySupport.cpp
content/base/src/nsDocument.cpp
content/base/src/nsGkAtomList.h
content/base/src/nsRange.cpp
content/base/src/nsRange.h
content/base/src/nsTextNode.cpp
content/base/src/nsTextNode.h
content/base/test/test_bug166235.html
content/base/test/test_copypaste.html
content/events/src/nsContentEventHandler.cpp
content/html/content/src/HTMLTextAreaElement.cpp
content/html/content/src/HTMLTextAreaElement.h
content/html/content/src/HTMLTimeElement.cpp
content/html/content/src/HTMLTimeElement.h
content/html/content/src/Makefile.in
content/html/content/src/nsGenericHTMLElement.h
content/html/content/src/nsHTMLMediaElement.cpp
content/html/content/test/Makefile.in
content/html/content/test/reflect.js
content/html/content/test/test_bug388558.html
content/html/content/test/test_bug389797.html
content/html/content/test/test_bug629801.html
content/html/content/test/test_bug838582.html
content/html/document/src/nsHTMLDocument.cpp
content/test/unit/test_range.js
content/xml/content/src/CDATASection.h
dom/base/nsDOMClassInfo.cpp
dom/base/nsDOMClassInfo.h
dom/bindings/Bindings.conf
dom/bindings/Codegen.py
dom/imptests/failures/html/old-tests/submission/Opera/microdata/test_001.html.json
dom/imptests/failures/webapps/DOMCore/tests/approved/test_interfaces.html.json
dom/imptests/failures/webapps/DOMCore/tests/submissions/Ms2ger/Makefile.in
dom/imptests/failures/webapps/DOMCore/tests/submissions/Ms2ger/test_Range-comparePoint.html.json
dom/imptests/failures/webapps/DOMCore/tests/submissions/Ms2ger/test_Range-intersectsNode-binding.html.json
dom/interfaces/core/nsIDOMDocumentFragment.idl
dom/interfaces/core/nsIDOMNSEditableElement.idl
dom/interfaces/html/nsIDOMHTMLTextAreaElement.idl
dom/plugins/test/mochitest/test_copyText.html
dom/webidl/Document.webidl
dom/webidl/HTMLTextAreaElement.webidl
dom/webidl/HTMLTimeElement.webidl
dom/webidl/Range.webidl
dom/webidl/WebIDL.mk
editor/composer/test/test_bug338427.html
editor/libeditor/base/IMETextTxn.cpp
editor/libeditor/base/nsEditPropertyAtomList.h
editor/libeditor/html/nsHTMLEditRules.cpp
editor/libeditor/html/nsHTMLEditUtils.cpp
editor/libeditor/html/nsHTMLEditor.cpp
editor/libeditor/html/nsWSRunObject.cpp
editor/libeditor/html/tests/test_bug629845.html
editor/libeditor/text/tests/test_bug596333.html
editor/libeditor/text/tests/test_texteditor_keyevent_handling.html
editor/txtsvc/src/nsFilteredContentIterator.cpp
editor/txtsvc/src/nsTextServicesDocument.cpp
embedding/components/find/src/nsFind.cpp
embedding/components/find/src/nsFind.h
embedding/components/find/src/nsWebBrowserFind.cpp
extensions/spellcheck/src/mozInlineSpellChecker.cpp
extensions/spellcheck/src/mozInlineSpellWordUtil.cpp
layout/base/nsPresContext.cpp
layout/base/nsPresShell.cpp
layout/forms/nsTextControlFrame.cpp
layout/forms/test/test_bug595310.html
layout/generic/nsSelection.cpp
layout/generic/test/test_selection_expanding.html
layout/printing/nsPrintEngine.cpp
parser/htmlparser/public/nsHTMLTagList.h
parser/htmlparser/src/nsElementTable.cpp
parser/htmlparser/src/nsHTMLTags.cpp
toolkit/components/typeaheadfind/nsTypeAheadFind.cpp
--- a/accessible/src/generic/HyperTextAccessible.cpp
+++ b/accessible/src/generic/HyperTextAccessible.cpp
@@ -1819,17 +1819,17 @@ HyperTextAccessible::SetSelectionBounds(
   NS_ENSURE_STATE(domSel);
 
   uint32_t rangeCount = domSel->GetRangeCount();
   if (rangeCount < static_cast<uint32_t>(aSelectionNum))
     return NS_ERROR_INVALID_ARG;
 
   nsRefPtr<nsRange> range;
   if (aSelectionNum == rangeCount)
-    range = new nsRange(mContent);
+    range = new nsRange();
   else
     range = domSel->GetRangeAt(aSelectionNum);
 
   nsresult rv = HypertextOffsetsToDOMRange(startOffset, endOffset, range);
   NS_ENSURE_SUCCESS(rv, rv);
 
   // If new range was created then add it, otherwise notify selection listeners
   // that existing selection range was changed.
@@ -1881,17 +1881,17 @@ HyperTextAccessible::RemoveSelection(int
 //                     in unsigned long scrollType);
 NS_IMETHODIMP
 HyperTextAccessible::ScrollSubstringTo(int32_t aStartIndex, int32_t aEndIndex,
                                        uint32_t aScrollType)
 {
   if (IsDefunct())
     return NS_ERROR_FAILURE;
 
-  nsRefPtr<nsRange> range = new nsRange(mContent);
+  nsRefPtr<nsRange> range = new nsRange();
   nsresult rv = HypertextOffsetsToDOMRange(aStartIndex, aEndIndex, range);
   NS_ENSURE_SUCCESS(rv, rv);
 
   return nsCoreUtils::ScrollSubstringTo(GetFrame(), range, aScrollType);
 }
 
 // void nsIAccessibleText::
 //   scrollSubstringToPoint(in long startIndex, in long endIndex,
@@ -1905,17 +1905,17 @@ HyperTextAccessible::ScrollSubstringToPo
 {
   nsIFrame *frame = GetFrame();
   if (!frame)
     return NS_ERROR_FAILURE;
 
   nsIntPoint coords = nsAccUtils::ConvertToScreenCoords(aX, aY, aCoordinateType,
                                                         this);
 
-  nsRefPtr<nsRange> range = new nsRange(mContent);
+  nsRefPtr<nsRange> range = new nsRange();
   nsresult rv = HypertextOffsetsToDOMRange(aStartIndex, aEndIndex, range);
   NS_ENSURE_SUCCESS(rv, rv);
 
   nsPresContext* presContext = frame->PresContext();
   nsPoint coordsInAppUnits =
     coords.ToAppUnits(presContext->AppUnitsPerDevPixel());
 
   bool initialScrolled = false;
--- a/accessible/src/msaa/TextLeafAccessibleWrap.cpp
+++ b/accessible/src/msaa/TextLeafAccessibleWrap.cpp
@@ -153,17 +153,17 @@ TextLeafAccessibleWrap::scrollToSubstrin
     /* [in] */ unsigned int aStartIndex,
     /* [in] */ unsigned int aEndIndex)
 {
   A11Y_TRYBLOCK_BEGIN
 
   if (IsDefunct())
     return E_FAIL;
 
-  nsRefPtr<nsRange> range = new nsRange(mContent);
+  nsRefPtr<nsRange> range = new nsRange();
   if (NS_FAILED(range->SetStart(mContent, aStartIndex)))
       return E_FAIL;
 
   if (NS_FAILED(range->SetEnd(mContent, aEndIndex)))
   return E_FAIL;
 
   nsresult rv =
     nsCoreUtils::ScrollSubstringTo(GetFrame(), range,
--- a/browser/devtools/framework/Toolbox.jsm
+++ b/browser/devtools/framework/Toolbox.jsm
@@ -460,17 +460,16 @@ Toolbox.prototype = {
     this._currentToolId = id;
 
     let iframe = this.doc.getElementById("toolbox-panel-iframe-" + id);
     if (!iframe) {
       iframe = this.doc.createElement("iframe");
       iframe.className = "toolbox-panel-iframe";
       iframe.id = "toolbox-panel-iframe-" + id;
       iframe.setAttribute("flex", 1);
-      iframe.setAttribute("forceOwnRefreshDriver", "");
 
       let vbox = this.doc.getElementById("toolbox-panel-" + id);
       vbox.appendChild(iframe);
 
       let boundLoad = function() {
         iframe.removeEventListener("DOMContentLoaded", boundLoad, true);
 
         definition.build(iframe.contentWindow, this).then(function(panel) {
--- a/browser/devtools/framework/toolbox-window.xul
+++ b/browser/devtools/framework/toolbox-window.xul
@@ -24,10 +24,10 @@
 
   <keyset id="toolbox-keyset">
     <key id="toolbox-key-close"
          key="&closeCmd.key;"
          command="toolbox-cmd-close"
          modifiers="accel"/>
   </keyset>
 
-  <iframe id="toolbox-iframe" flex="1" forceOwnRefreshDriver=""></iframe>
+  <iframe id="toolbox-iframe" flex="1"></iframe>
 </window>
--- a/content/base/public/nsContentUtils.h
+++ b/content/base/public/nsContentUtils.h
@@ -107,17 +107,16 @@ namespace mozilla {
 
 class Selection;
 
 namespace layers {
   class LayerManager;
 } // namespace layers
 
 namespace dom {
-class DocumentFragment;
 class Element;
 } // namespace dom
 
 } // namespace mozilla
 
 extern const char kLoadAsData[];
 
 enum EventNameType {
@@ -362,17 +361,16 @@ public:
    */
   static nsresult CheckSameOrigin(const nsINode* aTrustedNode,
                                   nsIDOMNode* aUnTrustedNode);
   static nsresult CheckSameOrigin(const nsINode* aTrustedNode,
                                   const nsINode* unTrustedNode);
 
   // Check if the (JS) caller can access aNode.
   static bool CanCallerAccess(nsIDOMNode *aNode);
-  static bool CanCallerAccess(nsINode* aNode);
 
   // Check if the (JS) caller can access aWindow.
   // aWindow can be either outer or inner window.
   static bool CanCallerAccess(nsPIDOMWindow* aWindow);
 
   /**
    * Get the window through the JS context that's currently on the stack.
    * If there's no JS context currently on the stack, returns null.
@@ -1081,20 +1079,16 @@ public:
    * @param aFragment the string which is parsed to a DocumentFragment
    * @param aReturn the resulting fragment
    * @param aPreventScriptExecution whether to mark scripts as already started
    */
   static nsresult CreateContextualFragment(nsINode* aContextNode,
                                            const nsAString& aFragment,
                                            bool aPreventScriptExecution,
                                            nsIDOMDocumentFragment** aReturn);
-  static already_AddRefed<mozilla::dom::DocumentFragment>
-  CreateContextualFragment(nsINode* aContextNode, const nsAString& aFragment,
-                           bool aPreventScriptExecution,
-                           mozilla::ErrorResult& aRv);
 
   /**
    * Invoke the fragment parsing algorithm (innerHTML) using the HTML parser.
    *
    * @param aSourceBuffer the string being set as innerHTML
    * @param aTargetNode the target container
    * @param aContextLocalName local name of context node
    * @param aContextNamespace namespace of context node
--- a/content/base/public/nsIDocument.h
+++ b/content/base/public/nsIDocument.h
@@ -1934,20 +1934,16 @@ public:
   bool MozSyntheticDocument() const
   {
     return IsSyntheticDocument();
   }
   Element* GetCurrentScript();
   void ReleaseCapture() const;
   virtual void MozSetImageElement(const nsAString& aImageElementId,
                                   Element* aElement) = 0;
-  nsIURI* GetDocumentURIObject()
-  {
-    return GetDocumentURI();
-  }
   // Not const because all the full-screen goop is not const
   virtual bool MozFullScreenEnabled() = 0;
   virtual Element* GetMozFullScreenElement(mozilla::ErrorResult& rv) = 0;
   bool MozFullScreen()
   {
     return IsFullScreenDoc();
   }
   void MozCancelFullScreen();
@@ -2407,20 +2403,16 @@ NS_NewSVGDocument(nsIDocument** aInstanc
 nsresult
 NS_NewImageDocument(nsIDocument** aInstancePtrResult);
 
 #ifdef MOZ_MEDIA
 nsresult
 NS_NewVideoDocument(nsIDocument** aInstancePtrResult);
 #endif
 
-already_AddRefed<mozilla::dom::DocumentFragment>
-NS_NewDocumentFragment(nsNodeInfoManager* aNodeInfoManager,
-                       mozilla::ErrorResult& aRv);
-
 nsresult
 NS_NewDocumentFragment(nsIDOMDocumentFragment** aInstancePtrResult,
                        nsNodeInfoManager *aNodeInfoManager);
 
 // Note: it's the caller's responsibility to create or get aPrincipal as needed
 // -- this method will not attempt to get a principal based on aDocumentURI.
 // Also, both aDocumentURI and aBaseURI must not be null.
 nsresult
--- a/content/base/src/DocumentFragment.cpp
+++ b/content/base/src/DocumentFragment.cpp
@@ -17,43 +17,30 @@
 #include "nsDOMString.h"
 #include "nsContentUtils.h"
 #include "mozilla/dom/DocumentFragmentBinding.h"
 
 nsresult
 NS_NewDocumentFragment(nsIDOMDocumentFragment** aInstancePtrResult,
                        nsNodeInfoManager *aNodeInfoManager)
 {
-  mozilla::ErrorResult rv;
-  *aInstancePtrResult = NS_NewDocumentFragment(aNodeInfoManager, rv).get();
-  return rv.ErrorCode();
-}
-
-already_AddRefed<mozilla::dom::DocumentFragment>
-NS_NewDocumentFragment(nsNodeInfoManager* aNodeInfoManager,
-                       mozilla::ErrorResult& aRv)
-{
   using namespace mozilla::dom;
 
-  if (!aNodeInfoManager) {
-    aRv.Throw(NS_ERROR_INVALID_ARG);
-    return nullptr;
-  }
+  NS_ENSURE_ARG(aNodeInfoManager);
 
-  nsCOMPtr<nsINodeInfo> nodeInfo =
-    aNodeInfoManager->GetNodeInfo(nsGkAtoms::documentFragmentNodeName,
-                                  nullptr, kNameSpaceID_None,
-                                  nsIDOMNode::DOCUMENT_FRAGMENT_NODE);
-  if (!nodeInfo) {
-    aRv.Throw(NS_ERROR_OUT_OF_MEMORY);
-    return nullptr;
-  }
+  nsCOMPtr<nsINodeInfo> nodeInfo;
+  nodeInfo = aNodeInfoManager->GetNodeInfo(nsGkAtoms::documentFragmentNodeName,
+                                           nullptr, kNameSpaceID_None,
+                                           nsIDOMNode::DOCUMENT_FRAGMENT_NODE);
+  NS_ENSURE_TRUE(nodeInfo, NS_ERROR_OUT_OF_MEMORY);
 
-  nsRefPtr<DocumentFragment> it = new DocumentFragment(nodeInfo.forget());
-  return it.forget();
+  DocumentFragment *it = new DocumentFragment(nodeInfo.forget());
+  NS_ADDREF(*aInstancePtrResult = it);
+
+  return NS_OK;
 }
 
 DOMCI_NODE_DATA(DocumentFragment, mozilla::dom::DocumentFragment)
 
 namespace mozilla {
 namespace dom {
 
 DocumentFragment::DocumentFragment(already_AddRefed<nsINodeInfo> aNodeInfo)
--- a/content/base/src/Makefile.in
+++ b/content/base/src/Makefile.in
@@ -46,17 +46,16 @@ EXPORTS_NAMESPACES = mozilla/dom
 
 EXPORTS_mozilla/dom = \
   Comment.h \
   DocumentFragment.h \
   DocumentType.h \
   DOMImplementation.h \
   EventSource.h \
   Link.h \
-  Text.h \
   $(NULL)
 
 CPPSRCS		= \
 		Comment.cpp \
 		DirectionalityUtils.cpp \
 		DocumentType.cpp \
 		DOMImplementation.cpp \
 		EventSource.cpp \
@@ -116,17 +115,16 @@ CPPSRCS		= \
 		nsReferencedElement.cpp \
 		nsScriptElement.cpp \
 		nsScriptLoader.cpp \
 		nsStubDocumentObserver.cpp \
 		nsStubMutationObserver.cpp \
 		nsStyledElement.cpp \
 		nsStyleLinkElement.cpp \
 		nsSyncLoadService.cpp \
-		Text.cpp \
 		nsTextFragment.cpp \
 		nsTextNode.cpp \
 		nsTraversal.cpp \
 		nsTreeSanitizer.cpp \
 		nsTreeWalker.cpp \
                 nsViewportInfo.cpp \
 		WebSocket.cpp \
 		nsXHTMLContentSerializer.cpp \
deleted file mode 100644
--- a/content/base/src/Text.cpp
+++ /dev/null
@@ -1,23 +0,0 @@
-/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
-/* This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
-
-#include "mozilla/dom/Text.h"
-
-namespace mozilla {
-namespace dom {
-
-already_AddRefed<Text>
-Text::SplitText(uint32_t aOffset, ErrorResult& rv)
-{
-  nsCOMPtr<nsIContent> newChild;
-  rv = SplitData(aOffset, getter_AddRefs(newChild));
-  if (rv.Failed()) {
-    return nullptr;
-  }
-  return static_cast<Text*>(newChild.forget().get());
-}
-
-} // namespace dom
-} // namespace mozilla
deleted file mode 100644
--- a/content/base/src/Text.h
+++ /dev/null
@@ -1,35 +0,0 @@
-/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
-/* This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
-
-#ifndef mozilla_dom_Text_h
-#define mozilla_dom_Text_h
-
-#include "nsGenericDOMDataNode.h"
-#include "mozilla/ErrorResult.h"
-
-namespace mozilla {
-namespace dom {
-
-class Text : public nsGenericDOMDataNode
-{
-public:
-  Text(already_AddRefed<nsINodeInfo> aNodeInfo)
-    : nsGenericDOMDataNode(aNodeInfo)
-  {}
-
-  using nsGenericDOMDataNode::GetWholeText;
-
-  // WebIDL API
-  already_AddRefed<Text> SplitText(uint32_t aOffset, ErrorResult& rv);
-  void GetWholeText(nsAString& aWholeText, ErrorResult& rv)
-  {
-    rv = GetWholeText(aWholeText);
-  }
-};
-
-} // namespace dom
-} // namespace mozilla
-
-#endif // mozilla_dom_Text_h
--- a/content/base/src/nsContentUtils.cpp
+++ b/content/base/src/nsContentUtils.cpp
@@ -163,17 +163,16 @@
 #include "nsIEditor.h"
 #include "mozilla/Attributes.h"
 #include "nsIParserService.h"
 #include "nsIDOMScriptObjectFactory.h"
 #include "nsSandboxFlags.h"
 #include "nsSVGFeatures.h"
 #include "MediaDecoder.h"
 #include "DecoderTraits.h"
-#include "mozilla/dom/DocumentFragment.h"
 
 #include "nsWrapperCacheInlines.h"
 #include "nsViewportInfo.h"
 
 extern "C" int MOZ_XMLTranslateEntity(const char* ptr, const char* end,
                                       const char** next, PRUnichar* result);
 extern "C" int MOZ_XMLCheckQName(const char* ptr, const char* end,
                                  int ns_aware, const char** colon);
@@ -1578,39 +1577,33 @@ nsContentUtils::CanCallerAccess(nsIPrinc
   // is chrome.
   return IsCallerChrome();
 }
 
 // static
 bool
 nsContentUtils::CanCallerAccess(nsIDOMNode *aNode)
 {
-  nsCOMPtr<nsINode> node = do_QueryInterface(aNode);
-  NS_ENSURE_TRUE(node, false);
-  return CanCallerAccess(node);
-}
-
-// static
-bool
-nsContentUtils::CanCallerAccess(nsINode* aNode)
-{
   // XXXbz why not check the IsCapabilityEnabled thing up front, and not bother
   // with the system principal games?  But really, there should be a simpler
   // API here, dammit.
   nsCOMPtr<nsIPrincipal> subjectPrincipal;
   nsresult rv = sSecurityManager->GetSubjectPrincipal(getter_AddRefs(subjectPrincipal));
   NS_ENSURE_SUCCESS(rv, false);
 
   if (!subjectPrincipal) {
     // we're running as system, grant access to the node.
 
     return true;
   }
 
-  return CanCallerAccess(subjectPrincipal, aNode->NodePrincipal());
+  nsCOMPtr<nsINode> node = do_QueryInterface(aNode);
+  NS_ENSURE_TRUE(node, false);
+
+  return CanCallerAccess(subjectPrincipal, node->NodePrincipal());
 }
 
 // static
 bool
 nsContentUtils::CanCallerAccess(nsPIDOMWindow* aWindow)
 {
   // XXXbz why not check the IsCapabilityEnabled thing up front, and not bother
   // with the system principal games?  But really, there should be a simpler
@@ -4057,87 +4050,75 @@ nsContentUtils::IsValidNodeName(nsIAtom 
 
 /* static */
 nsresult
 nsContentUtils::CreateContextualFragment(nsINode* aContextNode,
                                          const nsAString& aFragment,
                                          bool aPreventScriptExecution,
                                          nsIDOMDocumentFragment** aReturn)
 {
-  ErrorResult rv;
-  *aReturn = CreateContextualFragment(aContextNode, aFragment,
-                                      aPreventScriptExecution, rv).get();
-  return rv.ErrorCode();
-}
-
-already_AddRefed<DocumentFragment>
-nsContentUtils::CreateContextualFragment(nsINode* aContextNode,
-                                         const nsAString& aFragment,
-                                         bool aPreventScriptExecution,
-                                         ErrorResult& aRv)
-{
-  if (!aContextNode) {
-    aRv.Throw(NS_ERROR_INVALID_ARG);
-    return nullptr;
-  }
+  *aReturn = nullptr;
+  NS_ENSURE_ARG(aContextNode);
 
   // If we don't have a document here, we can't get the right security context
   // for compiling event handlers... so just bail out.
   nsCOMPtr<nsIDocument> document = aContextNode->OwnerDoc();
   bool isHTML = document->IsHTML();
 #ifdef DEBUG
   nsCOMPtr<nsIHTMLDocument> htmlDoc = do_QueryInterface(document);
   NS_ASSERTION(!isHTML || htmlDoc, "Should have HTMLDocument here!");
 #endif
 
   if (isHTML) {
-    nsRefPtr<DocumentFragment> frag =
-      NS_NewDocumentFragment(document->NodeInfoManager(), aRv);
+    nsCOMPtr<nsIDOMDocumentFragment> frag;
+    NS_NewDocumentFragment(getter_AddRefs(frag), document->NodeInfoManager());
     
     nsCOMPtr<nsIContent> contextAsContent = do_QueryInterface(aContextNode);
     if (contextAsContent && !contextAsContent->IsElement()) {
       contextAsContent = contextAsContent->GetParent();
       if (contextAsContent && !contextAsContent->IsElement()) {
         // can this even happen?
         contextAsContent = nullptr;
       }
     }
     
+    nsresult rv;
+    nsCOMPtr<nsIContent> fragment = do_QueryInterface(frag);
     if (contextAsContent && !contextAsContent->IsHTML(nsGkAtoms::html)) {
-      aRv = ParseFragmentHTML(aFragment, frag,
-                              contextAsContent->Tag(),
-                              contextAsContent->GetNameSpaceID(),
-                              (document->GetCompatibilityMode() ==
+      rv = ParseFragmentHTML(aFragment,
+                             fragment,
+                             contextAsContent->Tag(),
+                             contextAsContent->GetNameSpaceID(),
+                             (document->GetCompatibilityMode() ==
                                eCompatibility_NavQuirks),
-                              aPreventScriptExecution);
+                             aPreventScriptExecution);
     } else {
-      aRv = ParseFragmentHTML(aFragment, frag,
-                              nsGkAtoms::body,
-                              kNameSpaceID_XHTML,
-                              (document->GetCompatibilityMode() ==
+      rv = ParseFragmentHTML(aFragment,
+                             fragment,
+                             nsGkAtoms::body,
+                             kNameSpaceID_XHTML,
+                             (document->GetCompatibilityMode() ==
                                eCompatibility_NavQuirks),
-                              aPreventScriptExecution);
+                             aPreventScriptExecution);
     }
 
-    return frag.forget();
+    frag.forget(aReturn);
+    return rv;
   }
 
   nsAutoTArray<nsString, 32> tagStack;
   nsAutoString uriStr, nameStr;
   nsCOMPtr<nsIContent> content = do_QueryInterface(aContextNode);
   // just in case we have a text node
   if (content && !content->IsElement())
     content = content->GetParent();
 
   while (content && content->IsElement()) {
     nsString& tagName = *tagStack.AppendElement();
-    if (!&tagName) {
-      aRv.Throw(NS_ERROR_OUT_OF_MEMORY);
-      return nullptr;
-    }
+    NS_ENSURE_TRUE(&tagName, NS_ERROR_OUT_OF_MEMORY);
 
     tagName = content->NodeInfo()->QualifiedName();
 
     // see if we need to add xmlns declarations
     uint32_t count = content->GetAttrCount();
     bool setDefaultNamespace = false;
     if (count > 0) {
       uint32_t index;
@@ -4173,20 +4154,21 @@ nsContentUtils::CreateContextualFragment
         tagName.Append(NS_LITERAL_STRING(" xmlns=\"") + uriStr +
                        NS_LITERAL_STRING("\""));
       }
     }
 
     content = content->GetParent();
   }
 
-  nsCOMPtr<nsIDOMDocumentFragment> frag;
-  aRv = ParseFragmentXML(aFragment, document, tagStack,
-                         aPreventScriptExecution, getter_AddRefs(frag));
-  return static_cast<DocumentFragment*>(frag.forget().get());
+  return ParseFragmentXML(aFragment,
+                          document,
+                          tagStack,
+                          aPreventScriptExecution,
+                          aReturn);
 }
 
 /* static */
 void
 nsContentUtils::DropFragmentParsers()
 {
   NS_IF_RELEASE(sHTMLFragmentParser);
   NS_IF_RELEASE(sXMLFragmentParser);
--- a/content/base/src/nsCopySupport.cpp
+++ b/content/base/src/nsCopySupport.cpp
@@ -288,17 +288,17 @@ nsCopySupport::GetTransferableForNode(ns
                                       nsITransferable** aTransferable)
 {
   nsCOMPtr<nsISelection> selection;
   // Make a temporary selection with aNode in a single range.
   nsresult rv = NS_NewDomSelection(getter_AddRefs(selection));
   NS_ENSURE_SUCCESS(rv, rv);
   nsCOMPtr<nsIDOMNode> node = do_QueryInterface(aNode);
   NS_ENSURE_TRUE(node, NS_ERROR_FAILURE);
-  nsRefPtr<nsRange> range = new nsRange(aNode);
+  nsRefPtr<nsRange> range = new nsRange();
   rv = range->SelectNode(node);
   NS_ENSURE_SUCCESS(rv, rv);
   rv = selection->AddRange(range);
   NS_ENSURE_SUCCESS(rv, rv);
   // It's not the primary selection - so don't skip invisible content.
   uint32_t flags = 0;
   return SelectionCopyHelper(selection, aDoc, false, 0, flags,
                              aTransferable);
--- a/content/base/src/nsDocument.cpp
+++ b/content/base/src/nsDocument.cpp
@@ -5336,17 +5336,17 @@ nsDocument::CreateRange(nsIDOMRange** aR
   ErrorResult rv;
   *aReturn = nsIDocument::CreateRange(rv).get();
   return rv.ErrorCode();
 }
 
 already_AddRefed<nsRange>
 nsIDocument::CreateRange(ErrorResult& rv)
 {
-  nsRefPtr<nsRange> range = new nsRange(this);
+  nsRefPtr<nsRange> range = new nsRange();
   nsresult res = range->Set(this, 0, this, 0);
   if (NS_FAILED(res)) {
     rv.Throw(res);
     return nullptr;
   }
 
   return range.forget();
 }
--- a/content/base/src/nsGkAtomList.h
+++ b/content/base/src/nsGkAtomList.h
@@ -367,17 +367,16 @@ GK_ATOM(focused, "focused")
 GK_ATOM(following, "following")
 GK_ATOM(followingSibling, "following-sibling")
 GK_ATOM(font, "font")
 GK_ATOM(fontWeight, "font-weight")
 GK_ATOM(fontpicker, "fontpicker")
 GK_ATOM(footer, "footer")
 GK_ATOM(_for, "for")
 GK_ATOM(forEach, "for-each")
-GK_ATOM(forceOwnRefreshDriver, "forceOwnRefreshDriver")
 GK_ATOM(form, "form")
 GK_ATOM(formaction, "formaction")
 GK_ATOM(format, "format")
 GK_ATOM(formatNumber, "format-number")
 GK_ATOM(formenctype, "formenctype")
 GK_ATOM(formmethod, "formmethod")
 GK_ATOM(formnovalidate, "formnovalidate")
 GK_ATOM(formtarget, "formtarget")
--- a/content/base/src/nsRange.cpp
+++ b/content/base/src/nsRange.cpp
@@ -24,33 +24,37 @@
 #include "nsIDOMNodeList.h"
 #include "nsGkAtoms.h"
 #include "nsContentUtils.h"
 #include "nsGenericDOMDataNode.h"
 #include "nsClientRect.h"
 #include "nsLayoutUtils.h"
 #include "nsTextFrame.h"
 #include "nsFontFaceList.h"
-#include "mozilla/dom/DocumentFragment.h"
-#include "mozilla/dom/RangeBinding.h"
 #include "mozilla/Telemetry.h"
 #include "mozilla/Likely.h"
 
 using namespace mozilla;
 
-JSObject*
-nsRange::WrapObject(JSContext* aCx, JSObject* aScope, bool* aTriedToWrap)
-{
-  return dom::RangeBinding::Wrap(aCx, aScope, this, aTriedToWrap);
-}
-
 /******************************************************
  * stack based utilty class for managing monitor
  ******************************************************/
 
+// NS_ERROR_DOM_NOT_OBJECT_ERR is not the correct one to throw, but spec doesn't say
+// what is
+#define VALIDATE_ACCESS(node_)                                                     \
+  PR_BEGIN_MACRO                                                                   \
+    if (!node_) {                                                                  \
+      return NS_ERROR_DOM_NOT_OBJECT_ERR;                                          \
+    }                                                                              \
+    if (!nsContentUtils::CanCallerAccess(node_)) {                                 \
+      return NS_ERROR_DOM_SECURITY_ERR;                                            \
+    }                                                                              \
+  PR_END_MACRO
+
 static void InvalidateAllFrames(nsINode* aNode)
 {
   NS_PRECONDITION(aNode, "bad arg");
 
   nsIFrame* frame = nullptr;
   switch (aNode->NodeType()) {
     case nsIDOMNode::TEXT_NODE:
     case nsIDOMNode::ELEMENT_NODE:
@@ -215,22 +219,19 @@ nsRange::~nsRange()
 nsresult
 nsRange::CreateRange(nsIDOMNode* aStartParent, int32_t aStartOffset,
                      nsIDOMNode* aEndParent, int32_t aEndOffset,
                      nsRange** aRange)
 {
   MOZ_ASSERT(aRange);
   *aRange = NULL;
 
-  nsCOMPtr<nsINode> startParent = do_QueryInterface(aStartParent);
-  NS_ENSURE_ARG_POINTER(startParent);
-
-  nsRefPtr<nsRange> range = new nsRange(startParent);
-
-  nsresult rv = range->SetStart(startParent, aStartOffset);
+  nsRefPtr<nsRange> range = new nsRange();
+
+  nsresult rv = range->SetStart(aStartParent, aStartOffset);
   NS_ENSURE_SUCCESS(rv, rv);
 
   rv = range->SetEnd(aEndParent, aEndOffset);
   NS_ENSURE_SUCCESS(rv, rv);
 
   range.forget(aRange);
   return NS_OK;
 }
@@ -254,42 +255,32 @@ nsRange::CreateRange(nsIDOMNode* aStartP
 
 NS_IMPL_CYCLE_COLLECTING_ADDREF(nsRange)
 NS_IMPL_CYCLE_COLLECTING_RELEASE(nsRange)
 
 DOMCI_DATA(Range, nsRange)
 
 // QueryInterface implementation for nsRange
 NS_INTERFACE_MAP_BEGIN_CYCLE_COLLECTION(nsRange)
-  NS_WRAPPERCACHE_INTERFACE_MAP_ENTRY
   NS_INTERFACE_MAP_ENTRY(nsIDOMRange)
   NS_INTERFACE_MAP_ENTRY(nsIMutationObserver)
   NS_INTERFACE_MAP_ENTRY_AMBIGUOUS(nsISupports, nsIDOMRange)
   NS_DOM_INTERFACE_MAP_ENTRY_CLASSINFO(Range)
 NS_INTERFACE_MAP_END
 
 NS_IMPL_CYCLE_COLLECTION_UNLINK_BEGIN(nsRange)
-  NS_IMPL_CYCLE_COLLECTION_UNLINK_PRESERVED_WRAPPER
-  NS_IMPL_CYCLE_COLLECTION_UNLINK(mOwner);
   tmp->Reset();
 NS_IMPL_CYCLE_COLLECTION_UNLINK_END
 
 NS_IMPL_CYCLE_COLLECTION_TRAVERSE_BEGIN(nsRange)
-  NS_IMPL_CYCLE_COLLECTION_TRAVERSE(mOwner)
   NS_IMPL_CYCLE_COLLECTION_TRAVERSE(mStartParent)
   NS_IMPL_CYCLE_COLLECTION_TRAVERSE(mEndParent)
   NS_IMPL_CYCLE_COLLECTION_TRAVERSE(mRoot)
-  NS_IMPL_CYCLE_COLLECTION_TRAVERSE_SCRIPT_OBJECTS
 NS_IMPL_CYCLE_COLLECTION_TRAVERSE_END
 
-NS_IMPL_CYCLE_COLLECTION_TRACE_BEGIN(nsRange)
-  NS_IMPL_CYCLE_COLLECTION_TRACE_PRESERVED_WRAPPER
-NS_IMPL_CYCLE_COLLECTION_TRACE_END
-
-
 static void
 RangeHashTableDtor(void* aObject, nsIAtom* aPropertyName, void* aPropertyValue,
                    void* aData)
 {
   nsRange::RangeHashTable* ranges =
     static_cast<nsRange::RangeHashTable*>(aPropertyValue);
   delete ranges;
 }
@@ -680,138 +671,108 @@ nsRange::ParentChainChanged(nsIContent *
 }
 
 /******************************************************
  * Utilities for comparing points: API from nsIDOMRange
  ******************************************************/
 NS_IMETHODIMP
 nsRange::IsPointInRange(nsIDOMNode* aParent, int32_t aOffset, bool* aResult)
 {
-  nsCOMPtr<nsINode> parent = do_QueryInterface(aParent);
-  if (!parent) {
-    return NS_ERROR_DOM_NOT_OBJECT_ERR;
+  int16_t compareResult = 0;
+  nsresult rv = ComparePoint(aParent, aOffset, &compareResult);
+  // If the node isn't in the range's document, it clearly isn't in the range.
+  if (rv == NS_ERROR_DOM_WRONG_DOCUMENT_ERR) {
+    *aResult = false;
+    return NS_OK;
   }
 
-  ErrorResult rv;
-  *aResult = IsPointInRange(*parent, aOffset, rv);
-  return rv.ErrorCode();
+  *aResult = compareResult == 0;
+
+  return rv;
 }
-
-bool
-nsRange::IsPointInRange(nsINode& aParent, uint32_t aOffset, ErrorResult& aRv)
-{
-  uint16_t compareResult = ComparePoint(aParent, aOffset, aRv);
-  // If the node isn't in the range's document, it clearly isn't in the range.
-  if (aRv.ErrorCode() == NS_ERROR_DOM_WRONG_DOCUMENT_ERR) {
-    aRv = NS_OK;
-    return false;
-  }
-
-  return compareResult == 0;
-}
-
+  
 // returns -1 if point is before range, 0 if point is in range,
 // 1 if point is after range.
 NS_IMETHODIMP
 nsRange::ComparePoint(nsIDOMNode* aParent, int32_t aOffset, int16_t* aResult)
 {
+  // our range is in a good state?
+  if (!mIsPositioned) 
+    return NS_ERROR_NOT_INITIALIZED;
+
   nsCOMPtr<nsINode> parent = do_QueryInterface(aParent);
   NS_ENSURE_TRUE(parent, NS_ERROR_DOM_HIERARCHY_REQUEST_ERR);
 
-  ErrorResult rv;
-  *aResult = ComparePoint(*parent, aOffset, rv);
-  return rv.ErrorCode();
-}
-
-int16_t
-nsRange::ComparePoint(nsINode& aParent, uint32_t aOffset, ErrorResult& aRv)
-{
-  // our range is in a good state?
-  if (!mIsPositioned) {
-    aRv.Throw(NS_ERROR_NOT_INITIALIZED);
-    return 0;
+  if (!nsContentUtils::ContentIsDescendantOf(parent, mRoot)) {
+    return NS_ERROR_DOM_WRONG_DOCUMENT_ERR;
   }
-
-  if (!nsContentUtils::ContentIsDescendantOf(&aParent, mRoot)) {
-    aRv.Throw(NS_ERROR_DOM_WRONG_DOCUMENT_ERR);
-    return 0;
+  
+  if (parent->NodeType() == nsIDOMNode::DOCUMENT_TYPE_NODE) {
+    return NS_ERROR_DOM_INVALID_NODE_TYPE_ERR;
+  }
+
+  if (aOffset < 0 || uint32_t(aOffset) > parent->Length()) {
+    return NS_ERROR_DOM_INDEX_SIZE_ERR;
   }
-
-  if (aParent.NodeType() == nsIDOMNode::DOCUMENT_TYPE_NODE) {
-    aRv.Throw(NS_ERROR_DOM_INVALID_NODE_TYPE_ERR);
-    return 0;
-  }
-
-  if (aOffset > aParent.Length()) {
-    aRv.Throw(NS_ERROR_DOM_INDEX_SIZE_ERR);
-    return 0;
-  }
-
+  
   int32_t cmp;
-  if ((cmp = nsContentUtils::ComparePoints(&aParent, aOffset,
+  if ((cmp = nsContentUtils::ComparePoints(parent, aOffset,
                                            mStartParent, mStartOffset)) <= 0) {
-
-    return cmp;
+    
+    *aResult = cmp;
   }
-  if (nsContentUtils::ComparePoints(mEndParent, mEndOffset,
-                                    &aParent, aOffset) == -1) {
-    return 1;
+  else if (nsContentUtils::ComparePoints(mEndParent, mEndOffset,
+                                         parent, aOffset) == -1) {
+    *aResult = 1;
   }
-
-  return 0;
+  else {
+    *aResult = 0;
+  }
+  
+  return NS_OK;
 }
 
 NS_IMETHODIMP
 nsRange::IntersectsNode(nsIDOMNode* aNode, bool* aResult)
 {
   *aResult = false;
 
   nsCOMPtr<nsINode> node = do_QueryInterface(aNode);
   // TODO: This should throw a TypeError.
   NS_ENSURE_ARG(node);
 
-  ErrorResult rv;
-  *aResult = IntersectsNode(*node, rv);
-  return rv.ErrorCode();
-}
-
-bool
-nsRange::IntersectsNode(nsINode& aNode, ErrorResult& aRv)
-{
-  if (!mIsPositioned) {
-    aRv.Throw(NS_ERROR_NOT_INITIALIZED);
-    return false;
-  }
+  NS_ENSURE_TRUE(mIsPositioned, NS_ERROR_NOT_INITIALIZED);
 
   // Step 3.
-  nsINode* parent = aNode.GetParentNode();
+  nsINode* parent = node->GetParentNode();
   if (!parent) {
     // Steps 2 and 4. 
     // |parent| is null, so |node|'s root is |node| itself.
-    return GetRoot() == &aNode;
+    *aResult = (GetRoot() == node);
+    return NS_OK;
   }
 
   // Step 5.
-  int32_t nodeIndex = parent->IndexOf(&aNode);
+  int32_t nodeIndex = parent->IndexOf(node);
 
   // Steps 6-7.
   // Note: if disconnected is true, ComparePoints returns 1.
   bool disconnected = false;
-  bool result = nsContentUtils::ComparePoints(mStartParent, mStartOffset,
-                                             parent, nodeIndex + 1,
-                                             &disconnected) < 0 &&
-               nsContentUtils::ComparePoints(parent, nodeIndex,
-                                             mEndParent, mEndOffset,
-                                             &disconnected) < 0;
+  *aResult = nsContentUtils::ComparePoints(mStartParent, mStartOffset,
+                                           parent, nodeIndex + 1,
+                                           &disconnected) < 0 &&
+             nsContentUtils::ComparePoints(parent, nodeIndex,
+                                           mEndParent, mEndOffset,
+                                           &disconnected) < 0;
 
   // Step 2.
   if (disconnected) {
-    result = false;
+    *aResult = false;
   }
-  return result;
+  return NS_OK;
 }
 
 /******************************************************
  * Private helper routines
  ******************************************************/
 
 // It's important that all setting of the range start/end points 
 // go through this function, which will do all the right voodoo
@@ -879,33 +840,29 @@ nsRange::DoSetRange(nsINode* aStartN, in
   }
 
   // This needs to be the last thing this function does.  See comment
   // in ParentChainChanged.
   mRoot = aRoot;
 }
 
 static int32_t
-IndexOf(nsINode* aChild)
-{
-  nsINode* parent = aChild->GetParentNode();
-
-  return parent ? parent->IndexOf(aChild) : -1;
-}
-
-static int32_t
 IndexOf(nsIDOMNode* aChildNode)
 {
   // convert node to nsIContent, so that we can find the child index
 
   nsCOMPtr<nsINode> child = do_QueryInterface(aChildNode);
   if (!child) {
     return -1;
   }
-  return IndexOf(child);
+
+  nsINode *parent = child->GetParentNode();
+
+  // finally we get the index
+  return parent ? parent->IndexOf(child) : -1;
 }
 
 nsINode*
 nsRange::GetCommonAncestor() const
 {
   return mIsPositioned ?
     nsContentUtils::GetCommonAncestor(mStartParent, mEndParent) :
     nullptr;
@@ -925,125 +882,71 @@ NS_IMETHODIMP
 nsRange::GetStartContainer(nsIDOMNode** aStartParent)
 {
   if (!mIsPositioned)
     return NS_ERROR_NOT_INITIALIZED;
 
   return CallQueryInterface(mStartParent, aStartParent);
 }
 
-nsINode*
-nsRange::GetStartContainer(ErrorResult& aRv) const
-{
-  if (!mIsPositioned) {
-    aRv.Throw(NS_ERROR_NOT_INITIALIZED);
-    return nullptr;
-  }
-
-  return mStartParent;
-}
-
 NS_IMETHODIMP
 nsRange::GetStartOffset(int32_t* aStartOffset)
 {
   if (!mIsPositioned)
     return NS_ERROR_NOT_INITIALIZED;
 
   *aStartOffset = mStartOffset;
 
   return NS_OK;
 }
 
-uint32_t
-nsRange::GetStartOffset(ErrorResult& aRv) const
-{
-  if (!mIsPositioned) {
-    aRv.Throw(NS_ERROR_NOT_INITIALIZED);
-    return 0;
-  }
-
-  return mStartOffset;
-}
-
 NS_IMETHODIMP
 nsRange::GetEndContainer(nsIDOMNode** aEndParent)
 {
   if (!mIsPositioned)
     return NS_ERROR_NOT_INITIALIZED;
 
   return CallQueryInterface(mEndParent, aEndParent);
 }
 
-nsINode*
-nsRange::GetEndContainer(ErrorResult& aRv) const
-{
-  if (!mIsPositioned) {
-    aRv.Throw(NS_ERROR_NOT_INITIALIZED);
-    return nullptr;
-  }
-
-  return mEndParent;
-}
-
 NS_IMETHODIMP
 nsRange::GetEndOffset(int32_t* aEndOffset)
 {
   if (!mIsPositioned)
     return NS_ERROR_NOT_INITIALIZED;
 
   *aEndOffset = mEndOffset;
 
   return NS_OK;
 }
 
-uint32_t
-nsRange::GetEndOffset(ErrorResult& aRv) const
-{
-  if (!mIsPositioned) {
-    aRv.Throw(NS_ERROR_NOT_INITIALIZED);
-    return 0;
-  }
-
-  return mEndOffset;
-}
-
 NS_IMETHODIMP
 nsRange::GetCollapsed(bool* aIsCollapsed)
 {
   if (!mIsPositioned)
     return NS_ERROR_NOT_INITIALIZED;
 
   *aIsCollapsed = Collapsed();
 
   return NS_OK;
 }
 
-nsINode*
-nsRange::GetCommonAncestorContainer(ErrorResult& aRv) const
-{
-  if (!mIsPositioned) {
-    aRv.Throw(NS_ERROR_NOT_INITIALIZED);
-    return nullptr;
-  }
-
-  return nsContentUtils::GetCommonAncestor(mStartParent, mEndParent);
-}
-
 NS_IMETHODIMP
 nsRange::GetCommonAncestorContainer(nsIDOMNode** aCommonParent)
 {
-  ErrorResult rv;
-  nsINode* commonAncestor = GetCommonAncestorContainer(rv);
-  if (commonAncestor) {
-    NS_ADDREF(*aCommonParent = commonAncestor->AsDOMNode());
-  } else {
-    *aCommonParent = nullptr;
+  *aCommonParent = nullptr;
+  if (!mIsPositioned)
+    return NS_ERROR_NOT_INITIALIZED;
+
+  nsINode* container = nsContentUtils::GetCommonAncestor(mStartParent, mEndParent);
+  if (container) {
+    return CallQueryInterface(container, aCommonParent);
   }
 
-  return rv.ErrorCode();
+  return NS_ERROR_NOT_INITIALIZED;
 }
 
 nsINode*
 nsRange::IsValidBoundary(nsINode* aNode)
 {
   if (!aNode) {
     return nullptr;
   }
@@ -1084,39 +987,24 @@ nsRange::IsValidBoundary(nsINode* aNode)
                    root->IsNodeOfType(nsINode::eATTRIBUTE),
                    "Creating a DOM Range using root which isn't in DOM!");
 #endif
 
   // We allow this because of backward compatibility.
   return root;
 }
 
-void
-nsRange::SetStart(nsINode& aNode, uint32_t aOffset, ErrorResult& aRv)
-{
- if (!nsContentUtils::CanCallerAccess(&aNode)) {
-    aRv.Throw(NS_ERROR_DOM_SECURITY_ERR);
-    return;
-  }
-
-  AutoInvalidateSelection atEndOfBlock(this);
-  aRv = SetStart(&aNode, aOffset);
-}
-
 NS_IMETHODIMP
 nsRange::SetStart(nsIDOMNode* aParent, int32_t aOffset)
 {
+  VALIDATE_ACCESS(aParent);
+
   nsCOMPtr<nsINode> parent = do_QueryInterface(aParent);
-  if (!parent) {
-    return NS_ERROR_DOM_NOT_OBJECT_ERR;
-  }
-
-  ErrorResult rv;
-  SetStart(*parent, aOffset, rv);
-  return rv.ErrorCode();
+  AutoInvalidateSelection atEndOfBlock(this);
+  return SetStart(parent, aOffset);
 }
 
 /* virtual */ nsresult
 nsRange::SetStart(nsINode* aParent, int32_t aOffset)
 {
   nsINode* newRoot = IsValidBoundary(aParent);
   NS_ENSURE_TRUE(newRoot, NS_ERROR_DOM_INVALID_NODE_TYPE_ERR);
 
@@ -1134,90 +1022,55 @@ nsRange::SetStart(nsINode* aParent, int3
     return NS_OK;
   }
 
   DoSetRange(aParent, aOffset, mEndParent, mEndOffset, mRoot);
   
   return NS_OK;
 }
 
-void
-nsRange::SetStartBefore(nsINode& aNode, ErrorResult& aRv)
-{
-  if (!nsContentUtils::CanCallerAccess(&aNode)) {
-    aRv.Throw(NS_ERROR_DOM_SECURITY_ERR);
-    return;
-  }
-
-  AutoInvalidateSelection atEndOfBlock(this);
-  aRv = SetStart(aNode.GetParentNode(), IndexOf(&aNode));
-}
-
 NS_IMETHODIMP
 nsRange::SetStartBefore(nsIDOMNode* aSibling)
 {
-  nsCOMPtr<nsINode> sibling = do_QueryInterface(aSibling);
-  if (!sibling) {
-    return NS_ERROR_DOM_NOT_OBJECT_ERR;
+  VALIDATE_ACCESS(aSibling);
+  
+  nsCOMPtr<nsIDOMNode> parent;
+  nsresult rv = aSibling->GetParentNode(getter_AddRefs(parent));
+  if (NS_FAILED(rv) || !parent) {
+    return NS_ERROR_DOM_INVALID_NODE_TYPE_ERR;
   }
 
-  ErrorResult rv;
-  SetStartBefore(*sibling, rv);
-  return rv.ErrorCode();
-}
-
-void
-nsRange::SetStartAfter(nsINode& aNode, ErrorResult& aRv)
-{
-  if (!nsContentUtils::CanCallerAccess(&aNode)) {
-    aRv.Throw(NS_ERROR_DOM_SECURITY_ERR);
-    return;
-  }
-
-  AutoInvalidateSelection atEndOfBlock(this);
-  aRv = SetStart(aNode.GetParentNode(), IndexOf(&aNode) + 1);
+  return SetStart(parent, IndexOf(aSibling));
 }
 
 NS_IMETHODIMP
 nsRange::SetStartAfter(nsIDOMNode* aSibling)
 {
-  nsCOMPtr<nsINode> sibling = do_QueryInterface(aSibling);
-  if (!sibling) {
-    return NS_ERROR_DOM_NOT_OBJECT_ERR;
+  VALIDATE_ACCESS(aSibling);
+
+  nsCOMPtr<nsIDOMNode> nParent;
+  nsresult res = aSibling->GetParentNode(getter_AddRefs(nParent));
+  if (NS_FAILED(res) || !nParent) {
+    return NS_ERROR_DOM_INVALID_NODE_TYPE_ERR;
   }
 
-  ErrorResult rv;
-  SetStartAfter(*sibling, rv);
-  return rv.ErrorCode();
-}
-
-void
-nsRange::SetEnd(nsINode& aNode, uint32_t aOffset, ErrorResult& aRv)
-{
- if (!nsContentUtils::CanCallerAccess(&aNode)) {
-    aRv.Throw(NS_ERROR_DOM_SECURITY_ERR);
-    return;
-  }
-  AutoInvalidateSelection atEndOfBlock(this);
-  aRv = SetEnd(&aNode, aOffset);
+  return SetStart(nParent, IndexOf(aSibling) + 1);
 }
 
 NS_IMETHODIMP
 nsRange::SetEnd(nsIDOMNode* aParent, int32_t aOffset)
 {
+  VALIDATE_ACCESS(aParent);
+
+  AutoInvalidateSelection atEndOfBlock(this);
   nsCOMPtr<nsINode> parent = do_QueryInterface(aParent);
-  if (!parent) {
-    return NS_ERROR_DOM_NOT_OBJECT_ERR;
-  }
-
-  ErrorResult rv;
-  SetEnd(*parent, aOffset, rv);
-  return rv.ErrorCode();
+  return SetEnd(parent, aOffset);
 }
 
+
 /* virtual */ nsresult
 nsRange::SetEnd(nsINode* aParent, int32_t aOffset)
 {
   nsINode* newRoot = IsValidBoundary(aParent);
   NS_ENSURE_TRUE(newRoot, NS_ERROR_DOM_INVALID_NODE_TYPE_ERR);
 
   if (aOffset < 0 || uint32_t(aOffset) > aParent->Length()) {
     return NS_ERROR_DOM_INDEX_SIZE_ERR;
@@ -1233,64 +1086,42 @@ nsRange::SetEnd(nsINode* aParent, int32_
     return NS_OK;
   }
 
   DoSetRange(mStartParent, mStartOffset, aParent, aOffset, mRoot);
 
   return NS_OK;
 }
 
-void
-nsRange::SetEndBefore(nsINode& aNode, ErrorResult& aRv)
-{
-  if (!nsContentUtils::CanCallerAccess(&aNode)) {
-    aRv.Throw(NS_ERROR_DOM_SECURITY_ERR);
-    return;
-  }
-
-  AutoInvalidateSelection atEndOfBlock(this);
-  aRv = SetEnd(aNode.GetParentNode(), IndexOf(&aNode));
-}
-
 NS_IMETHODIMP
 nsRange::SetEndBefore(nsIDOMNode* aSibling)
 {
-  nsCOMPtr<nsINode> sibling = do_QueryInterface(aSibling);
-  if (!sibling) {
-    return NS_ERROR_DOM_NOT_OBJECT_ERR;
+  VALIDATE_ACCESS(aSibling);
+  
+  nsCOMPtr<nsIDOMNode> nParent;
+  nsresult rv = aSibling->GetParentNode(getter_AddRefs(nParent));
+  if (NS_FAILED(rv) || !nParent) {
+    return NS_ERROR_DOM_INVALID_NODE_TYPE_ERR;
   }
 
-  ErrorResult rv;
-  SetEndBefore(*sibling, rv);
-  return rv.ErrorCode();
-}
-
-void
-nsRange::SetEndAfter(nsINode& aNode, ErrorResult& aRv)
-{
-  if (!nsContentUtils::CanCallerAccess(&aNode)) {
-    aRv.Throw(NS_ERROR_DOM_SECURITY_ERR);
-    return;
-  }
-
-  AutoInvalidateSelection atEndOfBlock(this);
-  aRv = SetEnd(aNode.GetParentNode(), IndexOf(&aNode) + 1);
+  return SetEnd(nParent, IndexOf(aSibling));
 }
 
 NS_IMETHODIMP
 nsRange::SetEndAfter(nsIDOMNode* aSibling)
 {
-  nsCOMPtr<nsINode> sibling = do_QueryInterface(aSibling);
-  if (!sibling) {
-    return NS_ERROR_DOM_NOT_OBJECT_ERR;
+  VALIDATE_ACCESS(aSibling);
+  
+  nsCOMPtr<nsIDOMNode> nParent;
+  nsresult res = aSibling->GetParentNode(getter_AddRefs(nParent));
+  if (NS_FAILED(res) || !nParent) {
+    return NS_ERROR_DOM_INVALID_NODE_TYPE_ERR;
   }
 
-  ErrorResult rv;
-  SetEndAfter(*sibling, rv);
-  return rv.ErrorCode();
+  return SetEnd(nParent, IndexOf(aSibling) + 1);
 }
 
 NS_IMETHODIMP
 nsRange::Collapse(bool aToStart)
 {
   if (!mIsPositioned)
     return NS_ERROR_NOT_INITIALIZED;
 
@@ -1301,76 +1132,49 @@ nsRange::Collapse(bool aToStart)
     DoSetRange(mEndParent, mEndOffset, mEndParent, mEndOffset, mRoot);
 
   return NS_OK;
 }
 
 NS_IMETHODIMP
 nsRange::SelectNode(nsIDOMNode* aN)
 {
+  VALIDATE_ACCESS(aN);
+  
   nsCOMPtr<nsINode> node = do_QueryInterface(aN);
   NS_ENSURE_TRUE(node, NS_ERROR_DOM_INVALID_NODE_TYPE_ERR);
 
-  ErrorResult rv;
-  SelectNode(*node, rv);
-  return rv.ErrorCode();
-}
-
-void
-nsRange::SelectNode(nsINode& aNode, ErrorResult& aRv)
-{
-  if (!nsContentUtils::CanCallerAccess(&aNode)) {
-    aRv.Throw(NS_ERROR_DOM_SECURITY_ERR);
-    return;
-  }
-
-  nsINode* parent = aNode.GetParentNode();
+  nsINode* parent = node->GetParentNode();
   nsINode* newRoot = IsValidBoundary(parent);
-  if (!newRoot) {
-    aRv.Throw(NS_ERROR_DOM_INVALID_NODE_TYPE_ERR);
-    return;
-  }
-
-  int32_t index = parent->IndexOf(&aNode);
+  NS_ENSURE_TRUE(newRoot, NS_ERROR_DOM_INVALID_NODE_TYPE_ERR);
+
+  int32_t index = parent->IndexOf(node);
   if (index < 0) {
-    aRv.Throw(NS_ERROR_DOM_INVALID_NODE_TYPE_ERR);
-    return;
+    return NS_ERROR_DOM_INVALID_NODE_TYPE_ERR;
   }
 
   AutoInvalidateSelection atEndOfBlock(this);
   DoSetRange(parent, index, parent, index + 1, newRoot);
+  
+  return NS_OK;
 }
 
 NS_IMETHODIMP
 nsRange::SelectNodeContents(nsIDOMNode* aN)
 {
+  VALIDATE_ACCESS(aN);
+
   nsCOMPtr<nsINode> node = do_QueryInterface(aN);
-  NS_ENSURE_TRUE(node, NS_ERROR_DOM_INVALID_NODE_TYPE_ERR);
-
-  ErrorResult rv;
-  SelectNodeContents(*node, rv);
-  return rv.ErrorCode();
-}
-
-void
-nsRange::SelectNodeContents(nsINode& aNode, ErrorResult& aRv)
-{
-  if (!nsContentUtils::CanCallerAccess(&aNode)) {
-    aRv.Throw(NS_ERROR_DOM_SECURITY_ERR);
-    return;
-  }
-
-  nsINode* newRoot = IsValidBoundary(&aNode);
-  if (!newRoot) {
-    aRv.Throw(NS_ERROR_DOM_INVALID_NODE_TYPE_ERR);
-    return;
-  }
-
+  nsINode* newRoot = IsValidBoundary(node);
+  NS_ENSURE_TRUE(newRoot, NS_ERROR_DOM_INVALID_NODE_TYPE_ERR);
+  
   AutoInvalidateSelection atEndOfBlock(this);
-  DoSetRange(&aNode, 0, &aNode, aNode.Length(), newRoot);
+  DoSetRange(node, 0, node, node->Length(), newRoot);
+  
+  return NS_OK;
 }
 
 // The Subtree Content Iterator only returns subtrees that are
 // completely within a given range. It doesn't return a CharacterData
 // node that contains either the start or end point of the range.,
 // nor does it return element nodes when nothing in the element is selected.
 // We need an iterator that will also include these start/end points
 // so that our methods/algorithms aren't cluttered with special
@@ -1764,37 +1568,38 @@ ValidateCurrentNode(nsRange* aRange, Ran
   nsCOMPtr<nsINode> node = do_QueryInterface(domNode);
   MOZ_ASSERT(node);
 
   nsresult res = nsRange::CompareNodeToRange(node, aRange, &before, &after);
 
   return NS_SUCCEEDED(res) && !before && !after;
 }
 
-nsresult
-nsRange::CutContents(dom::DocumentFragment** aFragment)
+nsresult nsRange::CutContents(nsIDOMDocumentFragment** aFragment)
 { 
   if (aFragment) {
     *aFragment = nullptr;
   }
 
+  nsresult rv;
+
   nsCOMPtr<nsIDocument> doc = mStartParent->OwnerDoc();
 
   nsCOMPtr<nsIDOMNode> commonAncestor;
-  nsresult rv = GetCommonAncestorContainer(getter_AddRefs(commonAncestor));
+  rv = GetCommonAncestorContainer(getter_AddRefs(commonAncestor));
   NS_ENSURE_SUCCESS(rv, rv);
 
   // If aFragment isn't null, create a temporary fragment to hold our return.
-  nsRefPtr<dom::DocumentFragment> retval;
+  nsCOMPtr<nsIDOMDocumentFragment> retval;
   if (aFragment) {
-    ErrorResult error;
-    retval = NS_NewDocumentFragment(doc->NodeInfoManager(), error);
-    NS_ENSURE_SUCCESS(error.ErrorCode(), error.ErrorCode());
+    rv = NS_NewDocumentFragment(getter_AddRefs(retval),
+                                doc->NodeInfoManager());
+    NS_ENSURE_SUCCESS(rv, rv);
   }
-  nsCOMPtr<nsIDOMNode> commonCloneAncestor = retval.get();
+  nsCOMPtr<nsIDOMNode> commonCloneAncestor(do_QueryInterface(retval));
 
   // Batch possible DOMSubtreeModified events.
   mozAutoSubtreeModified subtree(mRoot ? mRoot->OwnerDoc(): nullptr, nullptr);
 
   // Save the range end points locally to avoid interference
   // of Range gravity during our edits!
 
   nsCOMPtr<nsIDOMNode> startContainer = do_QueryInterface(mStartParent);
@@ -2054,102 +1859,73 @@ nsRange::CutContents(dom::DocumentFragme
 }
 
 NS_IMETHODIMP
 nsRange::DeleteContents()
 {
   return CutContents(nullptr);
 }
 
-void
-nsRange::DeleteContents(ErrorResult& aRv)
-{
-  aRv = CutContents(nullptr);
-}
-
 NS_IMETHODIMP
 nsRange::ExtractContents(nsIDOMDocumentFragment** aReturn)
 {
   NS_ENSURE_ARG_POINTER(aReturn);
-  nsRefPtr<dom::DocumentFragment> fragment;
-  nsresult rv = CutContents(getter_AddRefs(fragment));
-  fragment.forget(aReturn);
-  return rv;
-}
-
-already_AddRefed<dom::DocumentFragment>
-nsRange::ExtractContents(ErrorResult& rv)
-{
-  nsRefPtr<dom::DocumentFragment> fragment;
-  rv = CutContents(getter_AddRefs(fragment));
-  return fragment.forget();
+  return CutContents(aReturn);
 }
 
 NS_IMETHODIMP
 nsRange::CompareBoundaryPoints(uint16_t aHow, nsIDOMRange* aOtherRange,
                                int16_t* aCmpRet)
 {
   nsRange* otherRange = static_cast<nsRange*>(aOtherRange);
   NS_ENSURE_TRUE(otherRange, NS_ERROR_NULL_POINTER);
 
-  ErrorResult rv;
-  *aCmpRet = CompareBoundaryPoints(aHow, *otherRange, rv);
-  return rv.ErrorCode();
-}
-
-int16_t
-nsRange::CompareBoundaryPoints(uint16_t aHow, nsRange& aOtherRange,
-                               ErrorResult& rv)
-{
-  if (!mIsPositioned || !aOtherRange.IsPositioned()) {
-    rv.Throw(NS_ERROR_NOT_INITIALIZED);
-    return 0;
-  }
+  if (!mIsPositioned || !otherRange->IsPositioned())
+    return NS_ERROR_NOT_INITIALIZED;
 
   nsINode *ourNode, *otherNode;
   int32_t ourOffset, otherOffset;
 
   switch (aHow) {
     case nsIDOMRange::START_TO_START:
       ourNode = mStartParent;
       ourOffset = mStartOffset;
-      otherNode = aOtherRange.GetStartParent();
-      otherOffset = aOtherRange.StartOffset();
+      otherNode = otherRange->GetStartParent();
+      otherOffset = otherRange->StartOffset();
       break;
     case nsIDOMRange::START_TO_END:
       ourNode = mEndParent;
       ourOffset = mEndOffset;
-      otherNode = aOtherRange.GetStartParent();
-      otherOffset = aOtherRange.StartOffset();
+      otherNode = otherRange->GetStartParent();
+      otherOffset = otherRange->StartOffset();
       break;
     case nsIDOMRange::END_TO_START:
       ourNode = mStartParent;
       ourOffset = mStartOffset;
-      otherNode = aOtherRange.GetEndParent();
-      otherOffset = aOtherRange.EndOffset();
+      otherNode = otherRange->GetEndParent();
+      otherOffset = otherRange->EndOffset();
       break;
     case nsIDOMRange::END_TO_END:
       ourNode = mEndParent;
       ourOffset = mEndOffset;
-      otherNode = aOtherRange.GetEndParent();
-      otherOffset = aOtherRange.EndOffset();
+      otherNode = otherRange->GetEndParent();
+      otherOffset = otherRange->EndOffset();
       break;
     default:
       // We were passed an illegal value
-      rv.Throw(NS_ERROR_DOM_NOT_SUPPORTED_ERR);
-      return 0;
+      return NS_ERROR_DOM_NOT_SUPPORTED_ERR;
   }
 
-  if (mRoot != aOtherRange.GetRoot()) {
-    rv.Throw(NS_ERROR_DOM_WRONG_DOCUMENT_ERR);
-    return 0;
-  }
-
-  return nsContentUtils::ComparePoints(ourNode, ourOffset,
-                                       otherNode, otherOffset);
+  if (mRoot != otherRange->GetRoot())
+    return NS_ERROR_DOM_WRONG_DOCUMENT_ERR;
+
+  *aCmpRet = nsContentUtils::ComparePoints(ourNode, ourOffset,
+                                           otherNode, otherOffset);
+
+  return NS_OK;
 }
 
 /* static */ nsresult
 nsRange::CloneParentsBetween(nsIDOMNode *aAncestor,
                              nsIDOMNode *aNode,
                              nsIDOMNode **aClosestAncestor,
                              nsIDOMNode **aFarthestAncestor)
 {
@@ -2196,68 +1972,55 @@ nsRange::CloneParentsBetween(nsIDOMNode 
   NS_IF_ADDREF(*aFarthestAncestor);
 
   return NS_OK;
 }
 
 NS_IMETHODIMP
 nsRange::CloneContents(nsIDOMDocumentFragment** aReturn)
 {
-  ErrorResult rv;
-  *aReturn = CloneContents(rv).get();
-  return rv.ErrorCode();
-}
-
-already_AddRefed<dom::DocumentFragment>
-nsRange::CloneContents(ErrorResult& aRv)
-{
+  nsresult res;
   nsCOMPtr<nsIDOMNode> commonAncestor;
-  aRv = GetCommonAncestorContainer(getter_AddRefs(commonAncestor));
-  MOZ_ASSERT(!aRv.Failed(), "GetCommonAncestorContainer() shouldn't fail!");
+  res = GetCommonAncestorContainer(getter_AddRefs(commonAncestor));
+  if (NS_FAILED(res)) return res;
 
   nsCOMPtr<nsIDOMDocument> document =
     do_QueryInterface(mStartParent->OwnerDoc());
   NS_ASSERTION(document, "CloneContents needs a document to continue.");
-  if (!document) {
-    aRv.Throw(NS_ERROR_FAILURE);
-    return nullptr;
-  }
+  if (!document) return NS_ERROR_FAILURE;
 
   // Create a new document fragment in the context of this document,
   // which might be null
 
+  nsCOMPtr<nsIDOMDocumentFragment> clonedFrag;
 
   nsCOMPtr<nsIDocument> doc(do_QueryInterface(document));
 
-  nsRefPtr<dom::DocumentFragment> clonedFrag =
-    NS_NewDocumentFragment(doc->NodeInfoManager(), aRv);
-  if (aRv.Failed()) {
-    return nullptr;
-  }
-
-  nsCOMPtr<nsIDOMNode> commonCloneAncestor = clonedFrag.get();
-  if (!commonCloneAncestor) {
-    aRv.Throw(NS_ERROR_FAILURE);
-    return nullptr;
-  }
+  res = NS_NewDocumentFragment(getter_AddRefs(clonedFrag),
+                               doc->NodeInfoManager());
+  if (NS_FAILED(res)) return res;
+
+  nsCOMPtr<nsIDOMNode> commonCloneAncestor(do_QueryInterface(clonedFrag));
+  if (!commonCloneAncestor) return NS_ERROR_FAILURE;
 
   // Create and initialize a subtree iterator that will give
   // us all the subtrees within the range.
 
   RangeSubtreeIterator iter;
 
-  aRv = iter.Init(this);
-  if (aRv.Failed()) {
-    return nullptr;
-  }
+  res = iter.Init(this);
+  if (NS_FAILED(res)) return res;
 
   if (iter.IsDone())
   {
     // There's nothing to add to the doc frag, we must be done!
-    return clonedFrag.forget();
+
+    *aReturn = clonedFrag;
+    NS_IF_ADDREF(*aReturn);
+    return NS_OK;
   }
 
   iter.First();
 
   // With the exception of text nodes that contain one of the range
   // end points and elements which don't have any content selected the subtree
   // iterator should only give us back subtrees that are completely contained
   // between the range's end points.
@@ -2275,20 +2038,18 @@ nsRange::CloneContents(ErrorResult& aRv)
                        (!(iNode == mEndParent && mEndOffset == 0) &&
                         !(iNode == mStartParent &&
                           mStartOffset ==
                             int32_t(iNode->AsElement()->GetChildCount())));
 
     // Clone the current subtree!
 
     nsCOMPtr<nsIDOMNode> clone;
-    aRv = node->CloneNode(deepClone, 1, getter_AddRefs(clone));
-    if (aRv.Failed()) {
-      return nullptr;
-    }
+    res = node->CloneNode(deepClone, 1, getter_AddRefs(clone));
+    if (NS_FAILED(res)) return res;
 
     // If it's CharacterData, make sure we only clone what
     // is in the range.
     //
     // XXX_kin: We need to also handle ProcessingInstruction
     // XXX_kin: according to the spec.
 
     nsCOMPtr<nsIDOMCharacterData> charData(do_QueryInterface(clone));
@@ -2296,150 +2057,124 @@ nsRange::CloneContents(ErrorResult& aRv)
     if (charData)
     {
       if (iNode == mEndParent)
       {
         // We only need the data before mEndOffset, so get rid of any
         // data after it.
 
         uint32_t dataLength = 0;
-        aRv = charData->GetLength(&dataLength);
-        if (aRv.Failed()) {
-          return nullptr;
-        }
+        res = charData->GetLength(&dataLength);
+        if (NS_FAILED(res)) return res;
 
         if (dataLength > (uint32_t)mEndOffset)
         {
-          aRv = charData->DeleteData(mEndOffset, dataLength - mEndOffset);
-          if (aRv.Failed()) {
-            return nullptr;
-          }
+          res = charData->DeleteData(mEndOffset, dataLength - mEndOffset);
+          if (NS_FAILED(res)) return res;
         }
       }       
 
       if (iNode == mStartParent)
       {
         // We don't need any data before mStartOffset, so just
         // delete it!
 
         if (mStartOffset > 0)
         {
-          aRv = charData->DeleteData(0, mStartOffset);
-          if (aRv.Failed()) {
-            return nullptr;
-          }
+          res = charData->DeleteData(0, mStartOffset);
+          if (NS_FAILED(res)) return res;
         }
       }
     }
 
     // Clone the parent hierarchy between commonAncestor and node.
 
     nsCOMPtr<nsIDOMNode> closestAncestor, farthestAncestor;
 
-    aRv = CloneParentsBetween(commonAncestor, node,
+    res = CloneParentsBetween(commonAncestor, node,
                               getter_AddRefs(closestAncestor),
                               getter_AddRefs(farthestAncestor));
 
-    if (aRv.Failed()) {
-      return nullptr;
-    }
+    if (NS_FAILED(res)) return res;
 
     // Hook the parent hierarchy/context of the subtree into the clone tree.
 
     nsCOMPtr<nsIDOMNode> tmpNode;
 
     if (farthestAncestor)
     {
-      aRv = commonCloneAncestor->AppendChild(farthestAncestor,
+      res = commonCloneAncestor->AppendChild(farthestAncestor,
                                              getter_AddRefs(tmpNode));
 
-      if (aRv.Failed()) {
-        return nullptr;
-      }
+      if (NS_FAILED(res)) return res;
     }
 
     // Place the cloned subtree into the cloned doc frag tree!
 
     if (closestAncestor)
     {
       // Append the subtree under closestAncestor since it is the
       // immediate parent of the subtree.
 
-      aRv = closestAncestor->AppendChild(clone, getter_AddRefs(tmpNode));
+      res = closestAncestor->AppendChild(clone, getter_AddRefs(tmpNode));
     }
     else
     {
       // If we get here, there is no missing parent hierarchy between 
       // commonAncestor and node, so just append clone to commonCloneAncestor.
 
-      aRv = commonCloneAncestor->AppendChild(clone, getter_AddRefs(tmpNode));
+      res = commonCloneAncestor->AppendChild(clone, getter_AddRefs(tmpNode));
     }
-    if (aRv.Failed()) {
-      return nullptr;
-    }
+    if (NS_FAILED(res)) return res;
 
     // Get the next subtree to be processed. The idea here is to setup
     // the parameters for the next iteration of the loop.
 
     iter.Next();
 
     if (iter.IsDone())
       break; // We must be done!
 
     nsCOMPtr<nsIDOMNode> nextNode(iter.GetCurrentNode());
-    if (!nextNode) {
-      aRv.Throw(NS_ERROR_FAILURE);
-      return nullptr;
-    }
+    if (!nextNode) return NS_ERROR_FAILURE;
 
     // Get node and nextNode's common parent.
     nsContentUtils::GetCommonAncestor(node, nextNode, getter_AddRefs(commonAncestor));
 
-    if (!commonAncestor) {
-      aRv.Throw(NS_ERROR_FAILURE);
-      return nullptr;
-    }
+    if (!commonAncestor)
+      return NS_ERROR_FAILURE;
 
     // Find the equivalent of commonAncestor in the cloned tree!
 
     while (node && node != commonAncestor)
     {
       tmpNode = node;
-      aRv = tmpNode->GetParentNode(getter_AddRefs(node));
-      if (aRv.Failed()) {
-        return nullptr;
-      }
-
-      if (!node) {
-        aRv.Throw(NS_ERROR_FAILURE);
-        return nullptr;
-      }
+      res = tmpNode->GetParentNode(getter_AddRefs(node));
+      if (NS_FAILED(res)) return res;
+      if (!node) return NS_ERROR_FAILURE;
 
       tmpNode = clone;
-      aRv = tmpNode->GetParentNode(getter_AddRefs(clone));
-      if (aRv.Failed()) {
-        return nullptr;
-      }
-
-      if (!clone) {
-        aRv.Throw(NS_ERROR_FAILURE);
-        return nullptr;
-      }
+      res = tmpNode->GetParentNode(getter_AddRefs(clone));
+      if (NS_FAILED(res)) return res;
+      if (!clone) return NS_ERROR_FAILURE;
     }
 
     commonCloneAncestor = clone;
   }
 
-  return clonedFrag.forget();
+  *aReturn = clonedFrag;
+  NS_IF_ADDREF(*aReturn);
+
+  return NS_OK;
 }
 
 already_AddRefed<nsRange>
 nsRange::CloneRange() const
 {
-  nsRefPtr<nsRange> range = new nsRange(mOwner);
+  nsRefPtr<nsRange> range = new nsRange();
 
   range->SetMaySpanAnonymousSubtrees(mMaySpanAnonymousSubtrees);
 
   range->DoSetRange(mStartParent, mStartOffset, mEndParent, mEndOffset, mRoot);
 
   return range.forget();
 }
 
@@ -2448,232 +2183,169 @@ nsRange::CloneRange(nsIDOMRange** aRetur
 {
   *aReturn = CloneRange().get();
   return NS_OK;
 }
 
 NS_IMETHODIMP
 nsRange::InsertNode(nsIDOMNode* aNode)
 {
-  nsCOMPtr<nsINode> node = do_QueryInterface(aNode);
-  if (!node) {
-    return NS_ERROR_DOM_NOT_OBJECT_ERR;
-  }
-
-  ErrorResult rv;
-  InsertNode(*node, rv);
-  return rv.ErrorCode();
-}
-
-void
-nsRange::InsertNode(nsINode& aNode, ErrorResult& aRv)
-{
-  if (!nsContentUtils::CanCallerAccess(&aNode)) {
-    aRv.Throw(NS_ERROR_DOM_SECURITY_ERR);
-    return;
-  }
-
-  int32_t tStartOffset = StartOffset();
+  VALIDATE_ACCESS(aNode);
+  
+  nsresult res;
+  int32_t tStartOffset;
+  this->GetStartOffset(&tStartOffset);
 
   nsCOMPtr<nsIDOMNode> tStartContainer;
-  aRv = this->GetStartContainer(getter_AddRefs(tStartContainer));
-  if (aRv.Failed()) {
-    return;
-  }
+  res = this->GetStartContainer(getter_AddRefs(tStartContainer));
+  NS_ENSURE_SUCCESS(res, res);
 
   // This is the node we'll be inserting before, and its parent
   nsCOMPtr<nsIDOMNode> referenceNode;
   nsCOMPtr<nsIDOMNode> referenceParentNode = tStartContainer;
 
   nsCOMPtr<nsIDOMText> startTextNode(do_QueryInterface(tStartContainer));
   nsCOMPtr<nsIDOMNodeList> tChildList;
   if (startTextNode) {
-    aRv = tStartContainer->GetParentNode(getter_AddRefs(referenceParentNode));
-    if (aRv.Failed()) {
-      return;
-    }
-
-    if (!referenceParentNode) {
-      aRv.Throw(NS_ERROR_DOM_HIERARCHY_REQUEST_ERR);
-      return;
-    }
+    res = tStartContainer->GetParentNode(getter_AddRefs(referenceParentNode));
+    NS_ENSURE_SUCCESS(res, res);
+    NS_ENSURE_TRUE(referenceParentNode, NS_ERROR_DOM_HIERARCHY_REQUEST_ERR);
 
     nsCOMPtr<nsIDOMText> secondPart;
-    aRv = startTextNode->SplitText(tStartOffset, getter_AddRefs(secondPart));
-    if (aRv.Failed()) {
-      return;
-    }
+    res = startTextNode->SplitText(tStartOffset, getter_AddRefs(secondPart));
+    NS_ENSURE_SUCCESS(res, res);
 
     referenceNode = secondPart;
   } else {
-    aRv = tStartContainer->GetChildNodes(getter_AddRefs(tChildList));
-    if (aRv.Failed()) {
-      return;
-    }
+    res = tStartContainer->GetChildNodes(getter_AddRefs(tChildList));
+    NS_ENSURE_SUCCESS(res, res);
 
     // find the insertion point in the DOM and insert the Node
-    aRv = tChildList->Item(tStartOffset, getter_AddRefs(referenceNode));
-    if (aRv.Failed()) {
-      return;
-    }
+    res = tChildList->Item(tStartOffset, getter_AddRefs(referenceNode));
+    NS_ENSURE_SUCCESS(res, res);
   }
 
   // We might need to update the end to include the new node (bug 433662).
   // Ideally we'd only do this if needed, but it's tricky to know when it's
   // needed in advance (bug 765799).
   int32_t newOffset;
 
   if (referenceNode) {
     newOffset = IndexOf(referenceNode);
   } else {
     uint32_t length;
-    aRv = tChildList->GetLength(&length);
-    if (aRv.Failed()) {
-      return;
-    }
-
+    res = tChildList->GetLength(&length);
+    NS_ENSURE_SUCCESS(res, res);
     newOffset = length;
   }
 
-  if (aNode.NodeType() == nsIDOMNode::DOCUMENT_FRAGMENT_NODE) {
-    newOffset += aNode.GetChildCount();
+  nsCOMPtr<nsINode> node = do_QueryInterface(aNode);
+  NS_ENSURE_STATE(node);
+  if (node->NodeType() == nsIDOMNode::DOCUMENT_FRAGMENT_NODE) {
+    newOffset += node->GetChildCount();
   } else {
     newOffset++;
   }
 
   // Now actually insert the node
   nsCOMPtr<nsIDOMNode> tResultNode;
-  nsCOMPtr<nsIDOMNode> node = aNode.AsDOMNode();
-  if (!node) {
-    aRv.Throw(NS_ERROR_DOM_NOT_OBJECT_ERR);
-    return;
-  }
-  aRv = referenceParentNode->InsertBefore(node, referenceNode, getter_AddRefs(tResultNode));
-  if (aRv.Failed()) {
-    return;
-  }
+  res = referenceParentNode->InsertBefore(aNode, referenceNode, getter_AddRefs(tResultNode));
+  NS_ENSURE_SUCCESS(res, res);
 
   if (Collapsed()) {
-    aRv = SetEnd(referenceParentNode, newOffset);
+    return SetEnd(referenceParentNode, newOffset);
   }
+  return NS_OK;
 }
 
 NS_IMETHODIMP
 nsRange::SurroundContents(nsIDOMNode* aNewParent)
 {
-  nsCOMPtr<nsINode> node = do_QueryInterface(aNewParent);
-  if (!node) {
-    return NS_ERROR_DOM_NOT_OBJECT_ERR;
-  }
-  ErrorResult rv;
-  SurroundContents(*node, rv);
-  return rv.ErrorCode();
-}
-
-void
-nsRange::SurroundContents(nsINode& aNewParent, ErrorResult& aRv)
-{
-  if (!nsContentUtils::CanCallerAccess(&aNewParent)) {
-    aRv.Throw(NS_ERROR_DOM_SECURITY_ERR);
-    return;
-  }
-
-  if (!mRoot) {
-    aRv.Throw(NS_ERROR_DOM_INVALID_STATE_ERR);
-    return;
-  }
+  VALIDATE_ACCESS(aNewParent);
+
+  NS_ENSURE_TRUE(mRoot, NS_ERROR_DOM_INVALID_STATE_ERR);
   // INVALID_STATE_ERROR: Raised if the Range partially selects a non-text
   // node.
   if (mStartParent != mEndParent) {
     bool startIsText = mStartParent->IsNodeOfType(nsINode::eTEXT);
     bool endIsText = mEndParent->IsNodeOfType(nsINode::eTEXT);
     nsINode* startGrandParent = mStartParent->GetParentNode();
     nsINode* endGrandParent = mEndParent->GetParentNode();
-    if (!((startIsText && endIsText &&
-           startGrandParent &&
-           startGrandParent == endGrandParent) ||
-          (startIsText &&
-           startGrandParent &&
-           startGrandParent == mEndParent) ||
-          (endIsText &&
-           endGrandParent &&
-           endGrandParent == mStartParent))) {
-      aRv.Throw(NS_ERROR_DOM_INVALID_STATE_ERR);
-      return;
-    }
+    NS_ENSURE_TRUE((startIsText && endIsText &&
+                    startGrandParent &&
+                    startGrandParent == endGrandParent) ||
+                   (startIsText &&
+                    startGrandParent &&
+                    startGrandParent == mEndParent) ||
+                   (endIsText &&
+                    endGrandParent &&
+                    endGrandParent == mStartParent),
+                   NS_ERROR_DOM_INVALID_STATE_ERR);
   }
 
   // INVALID_NODE_TYPE_ERROR if aNewParent is something that can't be inserted
   // (Document, DocumentType, DocumentFragment)
-  uint16_t nodeType = aNewParent.NodeType();
+  uint16_t nodeType;
+  nsresult res = aNewParent->GetNodeType(&nodeType);
+  if (NS_FAILED(res)) return res;
   if (nodeType == nsIDOMNode::DOCUMENT_NODE ||
       nodeType == nsIDOMNode::DOCUMENT_TYPE_NODE ||
       nodeType == nsIDOMNode::DOCUMENT_FRAGMENT_NODE) {
-    aRv.Throw(NS_ERROR_DOM_INVALID_NODE_TYPE_ERR);
-    return;
+    return NS_ERROR_DOM_INVALID_NODE_TYPE_ERR;
   }
 
   // Extract the contents within the range.
 
   nsCOMPtr<nsIDOMDocumentFragment> docFrag;
 
-  aRv = ExtractContents(getter_AddRefs(docFrag));
-
-  if (aRv.Failed()) {
-    return;
-  }
-
-  if (!docFrag) {
-    aRv.Throw(NS_ERROR_FAILURE);
-    return;
-  }
+  res = ExtractContents(getter_AddRefs(docFrag));
+
+  if (NS_FAILED(res)) return res;
+  if (!docFrag) return NS_ERROR_FAILURE;
 
   // Spec says we need to remove all of aNewParent's
   // children prior to insertion.
 
-  nsCOMPtr<nsINodeList> children = aNewParent.ChildNodes();
-  if (!children) {
-    aRv.Throw(NS_ERROR_FAILURE);
-    return;
-  }
-
-  uint32_t numChildren = children->Length();
+  nsCOMPtr<nsIDOMNodeList> children;
+  res = aNewParent->GetChildNodes(getter_AddRefs(children));
+
+  if (NS_FAILED(res)) return res;
+  if (!children) return NS_ERROR_FAILURE;
+
+  uint32_t numChildren = 0;
+  res = children->GetLength(&numChildren);
+  if (NS_FAILED(res)) return res;
 
   nsCOMPtr<nsIDOMNode> tmpNode;
 
   while (numChildren)
   {
-    nsCOMPtr<nsINode> child = children->Item(--numChildren);
-    if (!child) {
-      aRv.Throw(NS_ERROR_FAILURE);
-      return;
-    }
-
-    aNewParent.RemoveChild(*child, aRv);
-    if (aRv.Failed()) {
-      return;
-    }
+    nsCOMPtr<nsIDOMNode> child;
+    res = children->Item(--numChildren, getter_AddRefs(child));
+
+    if (NS_FAILED(res)) return res;
+    if (!child) return NS_ERROR_FAILURE;
+
+    res = aNewParent->RemoveChild(child, getter_AddRefs(tmpNode));
+    if (NS_FAILED(res)) return res;
   }
 
   // Insert aNewParent at the range's start point.
 
-  InsertNode(aNewParent, aRv);
-  if (aRv.Failed()) {
-    return;
-  }
+  res = InsertNode(aNewParent);
+  if (NS_FAILED(res)) return res;
 
   // Append the content we extracted under aNewParent.
-  aRv = aNewParent.AsDOMNode()->AppendChild(docFrag, getter_AddRefs(tmpNode));
-  if (aRv.Failed()) {
-    return;
-  }
+
+  res = aNewParent->AppendChild(docFrag, getter_AddRefs(tmpNode));
+  if (NS_FAILED(res)) return res;
 
   // Select aNewParent, and its contents.
 
-  SelectNode(aNewParent, aRv);
+  return SelectNode(aNewParent);
 }
 
 NS_IMETHODIMP
 nsRange::ToString(nsAString& aReturn)
 { 
   // clear the string
   aReturn.Truncate();
   
@@ -2774,28 +2446,16 @@ nsRange::CreateContextualFragment(const 
 {
   if (mIsPositioned) {
     return nsContentUtils::CreateContextualFragment(mStartParent, aFragment,
                                                     false, aReturn);
   }
   return NS_ERROR_FAILURE;
 }
 
-already_AddRefed<dom::DocumentFragment>
-nsRange::CreateContextualFragment(const nsAString& aFragment, ErrorResult& aRv)
-{
-  if (!mIsPositioned) {
-    aRv.Throw(NS_ERROR_FAILURE);
-    return nullptr;
-  }
-
-  return nsContentUtils::CreateContextualFragment(mStartParent, aFragment,
-                                                  false, aRv);
-}
-
 static void ExtractRectFromOffset(nsIFrame* aFrame,
                                   const nsIFrame* aRelativeTo, 
                                   const int32_t aOffset, nsRect* aR, bool aKeepLeft)
 {
   nsPoint point;
   aFrame->GetPointFromOffset(aOffset, &point);
 
   point += aFrame->GetOffsetTo(aRelativeTo);
@@ -2918,64 +2578,61 @@ static void CollectClientRects(nsLayoutU
         nsLayoutUtils::GetContainingBlockForClientRect(frame), aCollector);
     }
   } while (!iter.IsDone());
 }
 
 NS_IMETHODIMP
 nsRange::GetBoundingClientRect(nsIDOMClientRect** aResult)
 {
-  *aResult = GetBoundingClientRect().get();
-  return NS_OK;
-}
-
-already_AddRefed<nsIDOMClientRect>
-nsRange::GetBoundingClientRect()
-{
-  nsRefPtr<nsClientRect> rect = new nsClientRect();
+  *aResult = nullptr;
+
+  // Weak ref, since we addref it below
+  nsClientRect* rect = new nsClientRect();
+  if (!rect)
+    return NS_ERROR_OUT_OF_MEMORY;
+
+  NS_ADDREF(*aResult = rect);
+
   if (!mStartParent)
-    return rect.forget();
+    return NS_OK;
 
   nsLayoutUtils::RectAccumulator accumulator;
+  
   CollectClientRects(&accumulator, this, mStartParent, mStartOffset, 
     mEndParent, mEndOffset);
 
   nsRect r = accumulator.mResultRect.IsEmpty() ? accumulator.mFirstRect : 
     accumulator.mResultRect;
   rect->SetLayoutRect(r);
-  return rect.forget();
+  return NS_OK;
 }
 
 NS_IMETHODIMP
 nsRange::GetClientRects(nsIDOMClientRectList** aResult)
 {
-  ErrorResult rv;
-  *aResult = GetClientRects(rv).get();
-  return rv.ErrorCode();
-}
-
-already_AddRefed<nsClientRectList>
-nsRange::GetClientRects(ErrorResult& rv)
-{
+  *aResult = nullptr;
+
   if (!mStartParent)
-    return nullptr;
+    return NS_OK;
 
   nsRefPtr<nsClientRectList> rectList =
     new nsClientRectList(static_cast<nsIDOMRange*>(this));
+  if (!rectList)
+    return NS_ERROR_OUT_OF_MEMORY;
 
   nsLayoutUtils::RectListBuilder builder(rectList);
 
   CollectClientRects(&builder, this, mStartParent, mStartOffset, 
     mEndParent, mEndOffset);
 
-  if (NS_FAILED(builder.mRV)) {
-    rv.Throw(builder.mRV);
-    return nullptr;
-  }
-  return rectList.forget();
+  if (NS_FAILED(builder.mRV))
+    return builder.mRV;
+  rectList.forget(aResult);
+  return NS_OK;
 }
 
 NS_IMETHODIMP
 nsRange::GetUsedFontFaces(nsIDOMFontFaceList** aResult)
 {
   *aResult = nullptr;
 
   NS_ENSURE_TRUE(mStartParent, NS_ERROR_UNEXPECTED);
--- a/content/base/src/nsRange.h
+++ b/content/base/src/nsRange.h
@@ -7,71 +7,52 @@
  * Implementation of the DOM nsIDOMRange object.
  */
 
 #ifndef nsRange_h___
 #define nsRange_h___
 
 #include "nsIDOMRange.h"
 #include "nsCOMPtr.h"
+#include "nsIDOMDocumentFragment.h"
 #include "nsINode.h"
-#include "nsIDocument.h"
 #include "nsIDOMNode.h"
 #include "prmon.h"
 #include "nsStubMutationObserver.h"
-#include "nsWrapperCache.h"
-#include "mozilla/Attributes.h"
 
-class nsClientRectList;
-class nsIDOMDocumentFragment;
-
-namespace mozilla {
-class ErrorResult;
-namespace dom {
-class DocumentFragment;
-}
-}
-
-class nsRange MOZ_FINAL : public nsIDOMRange,
-                          public nsStubMutationObserver,
-                          public nsWrapperCache
+class nsRange : public nsIDOMRange,
+                public nsStubMutationObserver
 {
-  typedef mozilla::ErrorResult ErrorResult;
-
 public:
-  nsRange(nsINode* aNode)
+  nsRange()
     : mRoot(nullptr)
     , mStartOffset(0)
     , mEndOffset(0)
     , mIsPositioned(false)
     , mIsDetached(false)
     , mMaySpanAnonymousSubtrees(false)
     , mInSelection(false)
     , mStartOffsetWasIncremented(false)
     , mEndOffsetWasIncremented(false)
 #ifdef DEBUG
     , mAssertNextInsertOrAppendIndex(-1)
     , mAssertNextInsertOrAppendNode(nullptr)
 #endif
-  {
-    SetIsDOMBinding();
-    MOZ_ASSERT(aNode, "range isn't in a document!");
-    mOwner = aNode->OwnerDoc();
-  }
+  {}
   virtual ~nsRange();
 
   static nsresult CreateRange(nsIDOMNode* aStartParent, int32_t aStartOffset,
                               nsIDOMNode* aEndParent, int32_t aEndOffset,
                               nsRange** aRange);
   static nsresult CreateRange(nsIDOMNode* aStartParent, int32_t aStartOffset,
                               nsIDOMNode* aEndParent, int32_t aEndOffset,
                               nsIDOMRange** aRange);
 
   NS_DECL_CYCLE_COLLECTING_ISUPPORTS
-  NS_DECL_CYCLE_COLLECTION_SCRIPT_HOLDER_CLASS_AMBIGUOUS(nsRange, nsIDOMRange)
+  NS_DECL_CYCLE_COLLECTION_CLASS_AMBIGUOUS(nsRange, nsIDOMRange)
 
   // nsIDOMRange interface
   NS_DECL_NSIDOMRANGE
   
   nsINode* GetRoot() const
   {
     return mRoot;
   }
@@ -96,16 +77,22 @@ public:
     return mEndOffset;
   }
   
   bool IsPositioned() const
   {
     return mIsPositioned;
   }
 
+  bool Collapsed() const
+  {
+    return mIsPositioned && mStartParent == mEndParent &&
+           mStartOffset == mEndOffset;
+  }
+
   void SetMaySpanAnonymousSubtrees(bool aMaySpanAnonymousSubtrees)
   {
     mMaySpanAnonymousSubtrees = aMaySpanAnonymousSubtrees;
   }
   
   /**
    * Return true iff this range is part of at least one Selection object
    * and isn't detached.
@@ -154,68 +141,28 @@ public:
 
   // nsIMutationObserver methods
   NS_DECL_NSIMUTATIONOBSERVER_CHARACTERDATACHANGED
   NS_DECL_NSIMUTATIONOBSERVER_CONTENTINSERTED
   NS_DECL_NSIMUTATIONOBSERVER_CONTENTREMOVED
   NS_DECL_NSIMUTATIONOBSERVER_PARENTCHAINCHANGED
   NS_DECL_NSIMUTATIONOBSERVER_CONTENTAPPENDED
 
-  // WebIDL
-  bool Collapsed() const
-  {
-    return mIsPositioned && mStartParent == mEndParent &&
-           mStartOffset == mEndOffset;
-  }
-  already_AddRefed<mozilla::dom::DocumentFragment>
-  CreateContextualFragment(const nsAString& aString, ErrorResult& aError);
-  already_AddRefed<mozilla::dom::DocumentFragment>
-  CloneContents(ErrorResult& aErr);
-  int16_t CompareBoundaryPoints(uint16_t aHow, nsRange& aOther,
-                                ErrorResult& aErr);
-  int16_t ComparePoint(nsINode& aParent, uint32_t aOffset, ErrorResult& aErr);
-  void DeleteContents(ErrorResult& aRv);
-  already_AddRefed<mozilla::dom::DocumentFragment>
-    ExtractContents(ErrorResult& aErr);
-  nsINode* GetCommonAncestorContainer(ErrorResult& aRv) const;
-  nsINode* GetStartContainer(ErrorResult& aRv) const;
-  uint32_t GetStartOffset(ErrorResult& aRv) const;
-  nsINode* GetEndContainer(ErrorResult& aRv) const;
-  uint32_t GetEndOffset(ErrorResult& aRv) const;
-  void InsertNode(nsINode& aNode, ErrorResult& aErr);
-  bool IntersectsNode(nsINode& aNode, ErrorResult& aRv);
-  bool IsPointInRange(nsINode& aParent, uint32_t aOffset, ErrorResult& aErr);
-  void SelectNode(nsINode& aNode, ErrorResult& aErr);
-  void SelectNodeContents(nsINode& aNode, ErrorResult& aErr);
-  void SetEnd(nsINode& aNode, uint32_t aOffset, ErrorResult& aErr);
-  void SetEndAfter(nsINode& aNode, ErrorResult& aErr);
-  void SetEndBefore(nsINode& aNode, ErrorResult& aErr);
-  void SetStart(nsINode& aNode, uint32_t aOffset, ErrorResult& aErr);
-  void SetStartAfter(nsINode& aNode, ErrorResult& aErr);
-  void SetStartBefore(nsINode& aNode, ErrorResult& aErr);
-  void SurroundContents(nsINode& aNode, ErrorResult& aErr);
-  already_AddRefed<nsIDOMClientRect> GetBoundingClientRect();
-  already_AddRefed<nsClientRectList> GetClientRects(ErrorResult& aErr);
-
-  nsINode* GetParentObject() const { return mOwner; }
-  virtual JSObject* WrapObject(JSContext* cx, JSObject* scope, bool* tried)
-    MOZ_OVERRIDE MOZ_FINAL;
-
 private:
   // no copy's or assigns
   nsRange(const nsRange&);
   nsRange& operator=(const nsRange&);
 
   /**
    * Cut or delete the range's contents.
    *
    * @param aFragment nsIDOMDocumentFragment containing the nodes.
    *                  May be null to indicate the caller doesn't want a fragment.
    */
-  nsresult CutContents(mozilla::dom::DocumentFragment** frag);
+  nsresult CutContents(nsIDOMDocumentFragment** frag);
 
   static nsresult CloneParentsBetween(nsIDOMNode *aAncestor,
                                       nsIDOMNode *aNode,
                                       nsIDOMNode **aClosestAncestor,
                                       nsIDOMNode **aFarthestAncestor);
 
 public:
 /******************************************************************************
@@ -272,18 +219,17 @@ protected:
     ~AutoInvalidateSelection();
     nsRange* mRange;
     nsRefPtr<nsINode> mCommonAncestor;
 #ifdef DEBUG
     bool mWasInSelection;
 #endif
     static bool mIsNested;
   };
-
-  nsCOMPtr<nsIDocument> mOwner;
+  
   nsCOMPtr<nsINode> mRoot;
   nsCOMPtr<nsINode> mStartParent;
   nsCOMPtr<nsINode> mEndParent;
   int32_t mStartOffset;
   int32_t mEndOffset;
 
   bool mIsPositioned;
   bool mIsDetached;
--- a/content/base/src/nsTextNode.cpp
+++ b/content/base/src/nsTextNode.cpp
@@ -180,16 +180,27 @@ nsTextNode::BindToTree(nsIDocument* aDoc
 
 void nsTextNode::UnbindFromTree(bool aDeep, bool aNullParent)
 {
   ResetDirectionSetByTextNode(this);
 
   nsGenericDOMDataNode::UnbindFromTree(aDeep, aNullParent);
 }
 
+already_AddRefed<nsTextNode>
+nsTextNode::SplitText(uint32_t aOffset, ErrorResult& rv)
+{
+  nsCOMPtr<nsIContent> newChild;
+  rv = SplitData(aOffset, getter_AddRefs(newChild));
+  if (rv.Failed()) {
+    return nullptr;
+  }
+  return static_cast<nsTextNode*>(newChild.forget().get());
+}
+
 #ifdef DEBUG
 void
 nsTextNode::List(FILE* out, int32_t aIndent) const
 {
   int32_t index;
   for (index = aIndent; --index >= 0; ) fputs("  ", out);
 
   fprintf(out, "Text@%p", static_cast<const void*>(this));
--- a/content/base/src/nsTextNode.h
+++ b/content/base/src/nsTextNode.h
@@ -5,29 +5,29 @@
 
 #ifndef nsTextNode_h
 #define nsTextNode_h
 
 /*
  * Implementation of DOM Core's nsIDOMText node.
  */
 
-#include "mozilla/dom/Text.h"
+#include "nsGenericDOMDataNode.h"
 #include "nsIDOMText.h"
 #include "nsDebug.h"
 
 /**
  * Class used to implement DOM text nodes
  */
-class nsTextNode : public mozilla::dom::Text,
+class nsTextNode : public nsGenericDOMDataNode,
                    public nsIDOMText
 {
 public:
   nsTextNode(already_AddRefed<nsINodeInfo> aNodeInfo)
-    : mozilla::dom::Text(aNodeInfo)
+    : nsGenericDOMDataNode(aNodeInfo)
   {
     NS_ABORT_IF_FALSE(mNodeInfo->NodeType() == nsIDOMNode::TEXT_NODE,
                       "Bad NodeType in aNodeInfo");
     SetIsDOMBinding();
   }
 
   virtual ~nsTextNode();
 
@@ -57,16 +57,24 @@ public:
   virtual void UnbindFromTree(bool aDeep = true,
                               bool aNullParent = true);
 
   nsresult AppendTextForNormalize(const PRUnichar* aBuffer, uint32_t aLength,
                                   bool aNotify, nsIContent* aNextSibling);
 
   virtual nsIDOMNode* AsDOMNode() { return this; }
 
+  // WebIDL API
+  already_AddRefed<nsTextNode> SplitText(uint32_t aOffset,
+                                         mozilla::ErrorResult& rv);
+  void GetWholeText(nsAString& aWholeText, mozilla::ErrorResult& rv)
+  {
+    rv = GetWholeText(aWholeText);
+  }
+
 #ifdef DEBUG
   virtual void List(FILE* out, int32_t aIndent) const;
   virtual void DumpContent(FILE* out, int32_t aIndent, bool aDumpAll) const;
 #endif
 
 protected:
   virtual JSObject* WrapNode(JSContext *aCx, JSObject *aScope,
                              bool *aTriedToWrap) MOZ_OVERRIDE;
--- a/content/base/test/test_bug166235.html
+++ b/content/base/test/test_bug166235.html
@@ -35,17 +35,17 @@ https://bugzilla.mozilla.org/show_bug.cg
   var docShell = webnav.QueryInterface(SpecialPowers.Ci.nsIDocShell);
 
   var documentViewer = docShell.contentViewer
                                .QueryInterface(SpecialPowers.Ci.nsIContentViewerEdit);
 
   var clipboard = Cc["@mozilla.org/widget/clipboard;1"]
                     .getService(SpecialPowers.Ci.nsIClipboard);
 
-  var textarea = SpecialPowers.wrap(document.getElementById('input'));
+  var textarea = SpecialPowers.wrap(document).getElementById('input');
 
   function getLoadContext() {
     return SpecialPowers.wrap(window).QueryInterface(Ci.nsIInterfaceRequestor)
                                      .getInterface(Ci.nsIWebNavigation)
                                      .QueryInterface(Ci.nsILoadContext);
   }
 
   function copyChildrenToClipboard(id) {
@@ -73,17 +73,18 @@ https://bugzilla.mozilla.org/show_bug.cg
         data.value.QueryInterface(SpecialPowers.Ci.nsISupportsString).data,
       expected,
       mime + " value in the clipboard");
     return data.value;
   }
   function testPasteText(expected, test) {
     textarea.value="";
     textarea.focus();
-    textarea.editor.paste(1);
+    textarea.QueryInterface(SpecialPowers.Ci.nsIDOMNSEditableElement)
+            .editor.paste(1);
     is(textarea.value, expected, test + ": textarea paste");
   }
   function testInnerHTML(id, expected) {
     var value = document.getElementById(id).innerHTML;
     is(value, expected, id + ".innerHTML");
   }
 
 // expected results for Selection.toString()
--- a/content/base/test/test_copypaste.html
+++ b/content/base/test/test_copypaste.html
@@ -51,17 +51,17 @@ function testCopyPaste () {
   var docShell = webnav.QueryInterface(Components.interfaces.nsIDocShell);
 
   var documentViewer = docShell.contentViewer
                                .QueryInterface(Components.interfaces.nsIContentViewerEdit);
 
   var clipboard = Components.classes["@mozilla.org/widget/clipboard;1"]
                             .getService(Components.interfaces.nsIClipboard);
 
-  var textarea = SpecialPowers.wrap(document.getElementById('input'));
+  var textarea = document.getElementById('input');
 
   function copySelectionToClipboard() {
     documentViewer.copySelection();
     ok(clipboard.hasDataMatchingFlavors(["text/unicode"], 1,1), "check text/unicode");
     ok(clipboard.hasDataMatchingFlavors(["text/html"], 1,1), "check text/html");
   }
   function copyToClipboard(node) {
     textarea.blur();
@@ -106,17 +106,18 @@ function testCopyPaste () {
         data.value.QueryInterface(Components.interfaces.nsISupportsString).data,
       expected,
       mime + " value in the clipboard");
     return data.value;
   }
   function testPasteText(expected) {
     textarea.value="";
     textarea.focus();
-    textarea.editor.paste(1);
+    textarea.QueryInterface(Components.interfaces.nsIDOMNSEditableElement)
+            .editor.paste(1);
     is(textarea.value, expected, "value of the textarea after the paste");
   }
   function testSelectionToString(expected) {
     is(window.getSelection().toString().replace(/\r\n/g,"\n"), expected, "Selection.toString");
   }
   function testInnerHTML(id, expected) {
     var value = document.getElementById(id).innerHTML;
     is(value, expected, id + ".innerHTML");
--- a/content/events/src/nsContentEventHandler.cpp
+++ b/content/events/src/nsContentEventHandler.cpp
@@ -510,17 +510,17 @@ nsContentEventHandler::OnQueryTextConten
 {
   nsresult rv = Init(aEvent);
   if (NS_FAILED(rv))
     return rv;
 
   NS_ASSERTION(aEvent->mReply.mString.IsEmpty(),
                "The reply string must be empty");
 
-  nsRefPtr<nsRange> range = new nsRange(mRootContent);
+  nsRefPtr<nsRange> range = new nsRange();
   rv = SetRangeFromFlatTextOffset(range, aEvent->mInput.mOffset,
                                   aEvent->mInput.mLength, false);
   NS_ENSURE_SUCCESS(rv, rv);
 
   rv = GenerateFlatTextContent(range, aEvent->mReply.mString);
   NS_ENSURE_SUCCESS(rv, rv);
 
   aEvent->mSucceeded = true;
@@ -567,17 +567,17 @@ static nsresult GetFrameForTextRect(nsIN
 
 nsresult
 nsContentEventHandler::OnQueryTextRect(nsQueryContentEvent* aEvent)
 {
   nsresult rv = Init(aEvent);
   if (NS_FAILED(rv))
     return rv;
 
-  nsRefPtr<nsRange> range = new nsRange(mRootContent);
+  nsRefPtr<nsRange> range = new nsRange();
   rv = SetRangeFromFlatTextOffset(range, aEvent->mInput.mOffset,
                                   aEvent->mInput.mLength, true);
   NS_ENSURE_SUCCESS(rv, rv);
 
   // used to iterate over all contents and their frames
   nsCOMPtr<nsIContentIterator> iter = NS_NewContentIterator();
   iter->Init(range);
 
@@ -711,17 +711,17 @@ nsContentEventHandler::OnQueryCaretRect(
       aEvent->mReply.mRect =
         rect.ToOutsidePixels(caretFrame->PresContext()->AppUnitsPerDevPixel());
       aEvent->mSucceeded = true;
       return NS_OK;
     }
   }
 
   // Otherwise, we should set the guessed caret rect.
-  nsRefPtr<nsRange> range = new nsRange(mRootContent);
+  nsRefPtr<nsRange> range = new nsRange();
   rv = SetRangeFromFlatTextOffset(range, aEvent->mInput.mOffset, 0, true);
   NS_ENSURE_SUCCESS(rv, rv);
 
   int32_t offsetInFrame;
   nsIFrame* frame;
   rv = GetStartFrameAndOffset(range, &frame, &offsetInFrame);
   NS_ENSURE_SUCCESS(rv, rv);
 
@@ -894,20 +894,19 @@ nsContentEventHandler::OnQueryDOMWidgetH
 }
 
 nsresult
 nsContentEventHandler::GetFlatTextOffsetOfRange(nsIContent* aRootContent,
                                                 nsINode* aNode,
                                                 int32_t aNodeOffset,
                                                 uint32_t* aNativeOffset)
 {
-  NS_ENSURE_STATE(aRootContent);
   NS_ASSERTION(aNativeOffset, "param is invalid");
 
-  nsRefPtr<nsRange> prev = new nsRange(aRootContent);
+  nsRefPtr<nsRange> prev = new nsRange();
   nsCOMPtr<nsIDOMNode> rootDOMNode(do_QueryInterface(aRootContent));
   prev->SetStart(rootDOMNode, 0);
 
   nsCOMPtr<nsIDOMNode> startDOMNode(do_QueryInterface(aNode));
   NS_ASSERTION(startDOMNode, "startNode doesn't have nsIDOMNode");
   prev->SetEnd(startDOMNode, aNodeOffset);
 
   nsCOMPtr<nsIContentIterator> iter = NS_NewContentIterator();
@@ -1029,17 +1028,17 @@ nsContentEventHandler::OnSelectionEvent(
   if (rv != NS_ERROR_NOT_AVAILABLE) {
     NS_ENSURE_SUCCESS(rv, rv);
   } else {
     rv = Init(aEvent);
     NS_ENSURE_SUCCESS(rv, rv);
   }
 
   // Get range from offset and length
-  nsRefPtr<nsRange> range = new nsRange(mRootContent);
+  nsRefPtr<nsRange> range = new nsRange();
   NS_ENSURE_TRUE(range, NS_ERROR_OUT_OF_MEMORY);
   rv = SetRangeFromFlatTextOffset(range, aEvent->mOffset, aEvent->mLength,
                                   aEvent->mExpandToClusterBoundary);
   NS_ENSURE_SUCCESS(rv, rv);
 
   nsINode* startNode = range->GetStartParent();
   nsINode* endNode = range->GetEndParent();
   int32_t startOffset = range->StartOffset();
--- a/content/html/content/src/HTMLTextAreaElement.cpp
+++ b/content/html/content/src/HTMLTextAreaElement.cpp
@@ -1,29 +1,29 @@
 /* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
 /* vim: set sw=2 ts=2 et tw=80: */
 /* This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 #include "mozilla/dom/HTMLTextAreaElement.h"
-#include "mozilla/dom/HTMLTextAreaElementBinding.h"
 #include "mozilla/Util.h"
 
 #include "nsIControllers.h"
 #include "nsFocusManager.h"
 #include "nsPIDOMWindow.h"
 #include "nsContentCID.h"
 #include "nsIComponentManager.h"
 #include "nsIDOMHTMLFormElement.h"
 #include "nsIFormControl.h"
 #include "nsIForm.h"
 #include "nsFormSubmission.h"
 #include "nsIDOMEventTarget.h"
 #include "nsAttrValueInlines.h"
+#include "nsGkAtoms.h"
 #include "nsStyleConsts.h"
 #include "nsPresContext.h"
 #include "nsMappedAttributes.h"
 #include "nsIFormControlFrame.h"
 #include "nsITextControlFrame.h"
 #include "nsLinebreakConverter.h"
 #include "nsIDocument.h"
 #include "nsIFrame.h"
@@ -68,18 +68,16 @@ HTMLTextAreaElement::HTMLTextAreaElement
   // Set up our default state.  By default we're enabled (since we're
   // a control type that can be disabled but not actually disabled
   // right now), optional, and valid.  We are NOT readwrite by default
   // until someone calls UpdateEditableState on us, apparently!  Also
   // by default we don't have to show validity UI and so forth.
   AddStatesSilently(NS_EVENT_STATE_ENABLED |
                     NS_EVENT_STATE_OPTIONAL |
                     NS_EVENT_STATE_VALID);
-
-  SetIsDOMBinding();
 }
 
 
 NS_IMPL_CYCLE_COLLECTION_UNLINK_BEGIN_INHERITED(HTMLTextAreaElement,
                                                 nsGenericHTMLFormElement)
   NS_IMPL_CYCLE_COLLECTION_UNLINK(mValidity)
   NS_IMPL_CYCLE_COLLECTION_UNLINK(mControllers)
   tmp->mState.Unlink();
@@ -233,17 +231,17 @@ void
 HTMLTextAreaElement::GetValueInternal(nsAString& aValue, bool aIgnoreWrap) const
 {
   mState.GetValue(aValue, aIgnoreWrap);
 }
 
 NS_IMETHODIMP_(nsIEditor*)
 HTMLTextAreaElement::GetTextEditor()
 {
-  return GetEditor();
+  return mState.GetEditor();
 }
 
 NS_IMETHODIMP_(nsISelectionController*)
 HTMLTextAreaElement::GetSelectionController()
 {
   return mState.GetSelectionController();
 }
 
@@ -368,31 +366,21 @@ HTMLTextAreaElement::GetDefaultValue(nsA
 {
   nsContentUtils::GetNodeTextContent(this, false, aDefaultValue);
   return NS_OK;
 }  
 
 NS_IMETHODIMP
 HTMLTextAreaElement::SetDefaultValue(const nsAString& aDefaultValue)
 {
-  ErrorResult error;
-  SetDefaultValue(aDefaultValue, error);
-  return error.ErrorCode();
-}
-
-void
-HTMLTextAreaElement::SetDefaultValue(const nsAString& aDefaultValue, ErrorResult& aError)
-{
   nsresult rv = nsContentUtils::SetNodeTextContent(this, aDefaultValue, true);
   if (NS_SUCCEEDED(rv) && !mValueChanged) {
     Reset();
   }
-  if (NS_FAILED(rv)) {
-    aError.Throw(rv);
-  }
+  return rv;
 }
 
 bool
 HTMLTextAreaElement::ParseAttribute(int32_t aNamespaceID,
                                     nsIAtom* aAttribute,
                                     const nsAString& aValue,
                                     nsAttrValue& aResult)
 {
@@ -570,201 +558,127 @@ HTMLTextAreaElement::DoneAddingChildren(
 bool
 HTMLTextAreaElement::IsDoneAddingChildren()
 {
   return mDoneAddingChildren;
 }
 
 // Controllers Methods
 
-nsIControllers*
-HTMLTextAreaElement::GetControllers(ErrorResult& aError)
-{
-  if (!mControllers)
-  {
-    nsresult rv;
-    mControllers = do_CreateInstance(kXULControllersCID, &rv);
-    if (NS_FAILED(rv)) {
-      aError.Throw(rv);
-      return nullptr;
-    }
-
-    nsCOMPtr<nsIController> controller = do_CreateInstance("@mozilla.org/editor/editorcontroller;1", &rv);
-    if (NS_FAILED(rv)) {
-      aError.Throw(rv);
-      return nullptr;
-    }
-
-    mControllers->AppendController(controller);
-
-    controller = do_CreateInstance("@mozilla.org/editor/editingcontroller;1", &rv);
-    if (NS_FAILED(rv)) {
-      aError.Throw(rv);
-      return nullptr;
-    }
-
-    mControllers->AppendController(controller);
-  }
-
-  return mControllers;
-}
-
 NS_IMETHODIMP
 HTMLTextAreaElement::GetControllers(nsIControllers** aResult)
 {
   NS_ENSURE_ARG_POINTER(aResult);
 
-  ErrorResult error;
-  *aResult = GetControllers(error);
+  if (!mControllers)
+  {
+    nsresult rv;
+    mControllers = do_CreateInstance(kXULControllersCID, &rv);
+    NS_ENSURE_SUCCESS(rv, rv);
+
+    nsCOMPtr<nsIController> controller = do_CreateInstance("@mozilla.org/editor/editorcontroller;1", &rv);
+    if (NS_FAILED(rv))
+      return rv;
+
+    mControllers->AppendController(controller);
+
+    controller = do_CreateInstance("@mozilla.org/editor/editingcontroller;1", &rv);
+    if (NS_FAILED(rv))
+      return rv;
+
+    mControllers->AppendController(controller);
+  }
+
+  *aResult = mControllers;
   NS_IF_ADDREF(*aResult);
 
-  return error.ErrorCode();
-}
-
-uint32_t
-HTMLTextAreaElement::GetTextLength()
-{
-  nsAutoString val;
-  GetValue(val);
-  return val.Length();
+  return NS_OK;
 }
 
 NS_IMETHODIMP
 HTMLTextAreaElement::GetTextLength(int32_t *aTextLength)
 {
   NS_ENSURE_ARG_POINTER(aTextLength);
-  *aTextLength = GetTextLength();
+  nsAutoString val;
+  nsresult rv = GetValue(val);
+  *aTextLength = val.Length();
 
-  return NS_OK;
+  return rv;
 }
 
 NS_IMETHODIMP
 HTMLTextAreaElement::GetSelectionStart(int32_t *aSelectionStart)
 {
   NS_ENSURE_ARG_POINTER(aSelectionStart);
 
-  ErrorResult error;
-  *aSelectionStart = GetSelectionStart(error);
-  return error.ErrorCode();
-}
-
-uint32_t
-HTMLTextAreaElement::GetSelectionStart(ErrorResult& aError)
-{
-  int32_t selStart, selEnd;
-  nsresult rv = GetSelectionRange(&selStart, &selEnd);
+  int32_t selEnd;
+  nsresult rv = GetSelectionRange(aSelectionStart, &selEnd);
 
   if (NS_FAILED(rv) && mState.IsSelectionCached()) {
-    return mState.GetSelectionProperties().mStart;
+    *aSelectionStart = mState.GetSelectionProperties().mStart;
+    return NS_OK;
   }
-  if (NS_FAILED(rv)) {
-    aError.Throw(rv);
-  }
-  return selStart;
+  return rv;
 }
 
 NS_IMETHODIMP
 HTMLTextAreaElement::SetSelectionStart(int32_t aSelectionStart)
 {
-  ErrorResult error;
-  SetSelectionStart(aSelectionStart, error);
-  return error.ErrorCode();
-}
-
-void
-HTMLTextAreaElement::SetSelectionStart(uint32_t aSelectionStart, ErrorResult& aError)
-{
   if (mState.IsSelectionCached()) {
     mState.GetSelectionProperties().mStart = aSelectionStart;
-    return;
+    return NS_OK;
   }
 
   nsAutoString direction;
   nsresult rv = GetSelectionDirection(direction);
-  if (NS_FAILED(rv)) {
-    aError.Throw(rv);
-    return;
-  }
+  NS_ENSURE_SUCCESS(rv, rv);
   int32_t start, end;
   rv = GetSelectionRange(&start, &end);
-  if (NS_FAILED(rv)) {
-    aError.Throw(rv);
-    return;
-  }
+  NS_ENSURE_SUCCESS(rv, rv);
   start = aSelectionStart;
   if (end < start) {
     end = start;
   }
-  rv = SetSelectionRange(start, end, direction);
-  if (NS_FAILED(rv)) {
-    aError.Throw(rv);
-  }
+  return SetSelectionRange(start, end, direction);
 }
 
 NS_IMETHODIMP
 HTMLTextAreaElement::GetSelectionEnd(int32_t *aSelectionEnd)
 {
   NS_ENSURE_ARG_POINTER(aSelectionEnd);
 
-  ErrorResult error;
-  *aSelectionEnd = GetSelectionEnd(error);
-  return error.ErrorCode();
-}
-
-uint32_t
-HTMLTextAreaElement::GetSelectionEnd(ErrorResult& aError)
-{
-  int32_t selStart, selEnd;
-  nsresult rv = GetSelectionRange(&selStart, &selEnd);
+  int32_t selStart;
+  nsresult rv = GetSelectionRange(&selStart, aSelectionEnd);
 
   if (NS_FAILED(rv) && mState.IsSelectionCached()) {
-    return mState.GetSelectionProperties().mEnd;
+    *aSelectionEnd = mState.GetSelectionProperties().mEnd;
+    return NS_OK;
   }
-  if (NS_FAILED(rv)) {
-    aError.Throw(rv);
-  }
-  return selEnd;
+  return rv;
 }
 
 NS_IMETHODIMP
 HTMLTextAreaElement::SetSelectionEnd(int32_t aSelectionEnd)
 {
-  ErrorResult error;
-  SetSelectionEnd(aSelectionEnd, error);
-  return error.ErrorCode();
-}
-
-void
-HTMLTextAreaElement::SetSelectionEnd(uint32_t aSelectionEnd, ErrorResult& aError)
-{
   if (mState.IsSelectionCached()) {
     mState.GetSelectionProperties().mEnd = aSelectionEnd;
-    return;
+    return NS_OK;
   }
 
   nsAutoString direction;
   nsresult rv = GetSelectionDirection(direction);
-  if (NS_FAILED(rv)) {
-    aError.Throw(rv);
-    return;
-  }
+  NS_ENSURE_SUCCESS(rv, rv);
   int32_t start, end;
   rv = GetSelectionRange(&start, &end);
-  if (NS_FAILED(rv)) {
-    aError.Throw(rv);
-    return;
-  }
+  NS_ENSURE_SUCCESS(rv, rv);
   end = aSelectionEnd;
   if (start > end) {
     start = end;
   }
-  rv = SetSelectionRange(start, end, direction);
-  if (NS_FAILED(rv)) {
-    aError.Throw(rv);
-  }
+  return SetSelectionRange(start, end, direction);
 }
 
 nsresult
 HTMLTextAreaElement::GetSelectionRange(int32_t* aSelectionStart,
                                        int32_t* aSelectionEnd)
 {
   nsresult rv = NS_ERROR_FAILURE;
   nsIFormControlFrame* formControlFrame = GetFormControlFrame(true);
@@ -790,24 +704,16 @@ DirectionToName(nsITextControlFrame::Sel
   } else {
     NS_NOTREACHED("Invalid SelectionDirection value");
   }
 }
 
 nsresult
 HTMLTextAreaElement::GetSelectionDirection(nsAString& aDirection)
 {
-  ErrorResult error;
-  GetSelectionDirection(aDirection, error);
-  return error.ErrorCode();
-}
-
-void
-HTMLTextAreaElement::GetSelectionDirection(nsAString& aDirection, ErrorResult& aError)
-{
   nsresult rv = NS_ERROR_FAILURE;
   nsIFormControlFrame* formControlFrame = GetFormControlFrame(true);
 
   if (formControlFrame) {
     nsITextControlFrame* textControlFrame = do_QueryFrame(formControlFrame);
     if (textControlFrame) {
       nsITextControlFrame::SelectionDirection dir;
       rv = textControlFrame->GetSelectionRange(nullptr, nullptr, &dir);
@@ -815,97 +721,73 @@ HTMLTextAreaElement::GetSelectionDirecti
         DirectionToName(dir, aDirection);
       }
     }
   }
 
   if (NS_FAILED(rv)) {
     if (mState.IsSelectionCached()) {
       DirectionToName(mState.GetSelectionProperties().mDirection, aDirection);
-      return;
+      return NS_OK;
     }
-    aError.Throw(rv);
   }
+
+  return rv;
 }
 
 NS_IMETHODIMP
-HTMLTextAreaElement::SetSelectionDirection(const nsAString& aDirection)
-{
-  ErrorResult error;
-  SetSelectionDirection(aDirection, error);
-  return error.ErrorCode();
-}
-
-void
-HTMLTextAreaElement::SetSelectionDirection(const nsAString& aDirection, ErrorResult& aError)
-{
+HTMLTextAreaElement::SetSelectionDirection(const nsAString& aDirection) {
   if (mState.IsSelectionCached()) {
     nsITextControlFrame::SelectionDirection dir = nsITextControlFrame::eNone;
     if (aDirection.EqualsLiteral("forward")) {
       dir = nsITextControlFrame::eForward;
     } else if (aDirection.EqualsLiteral("backward")) {
       dir = nsITextControlFrame::eBackward;
     }
     mState.GetSelectionProperties().mDirection = dir;
-    return;
+    return NS_OK;
   }
 
   int32_t start, end;
   nsresult rv = GetSelectionRange(&start, &end);
   if (NS_SUCCEEDED(rv)) {
     rv = SetSelectionRange(start, end, aDirection);
   }
-  if (NS_FAILED(rv)) {
-    aError.Throw(rv);
-  }
+
+  return rv;
 }
 
 NS_IMETHODIMP
 HTMLTextAreaElement::SetSelectionRange(int32_t aSelectionStart,
                                        int32_t aSelectionEnd,
                                        const nsAString& aDirection)
-{
-  ErrorResult error;
-  Optional<nsAString> dir;
-  dir = &aDirection;
-  SetSelectionRange(aSelectionStart, aSelectionEnd, dir, error);
-  return error.ErrorCode();
-}
-
-void
-HTMLTextAreaElement::SetSelectionRange(uint32_t aSelectionStart,
-                                       uint32_t aSelectionEnd,
-                                       const Optional<nsAString>& aDirection,
-                                       ErrorResult& aError)
-{
+{ 
   nsresult rv = NS_ERROR_FAILURE;
   nsIFormControlFrame* formControlFrame = GetFormControlFrame(true);
 
   if (formControlFrame) {
     nsITextControlFrame* textControlFrame = do_QueryFrame(formControlFrame);
     if (textControlFrame) {
       // Default to forward, even if not specified.
       // Note that we don't currently support directionless selections, so
       // "none" is treated like "forward".
       nsITextControlFrame::SelectionDirection dir = nsITextControlFrame::eForward;
-      if (aDirection.WasPassed() && aDirection.Value().EqualsLiteral("backward")) {
+      if (aDirection.EqualsLiteral("backward")) {
         dir = nsITextControlFrame::eBackward;
       }
 
       rv = textControlFrame->SetSelectionRange(aSelectionStart, aSelectionEnd, dir);
       if (NS_SUCCEEDED(rv)) {
         rv = textControlFrame->ScrollSelectionIntoView();
       }
     }
   }
 
-  if (NS_FAILED(rv)) {
-    aError.Throw(rv);
-  }
-}
+  return rv;
+} 
 
 nsresult
 HTMLTextAreaElement::Reset()
 {
   nsresult rv;
 
   // To get the initial spellchecking, reset value to
   // empty string before setting the default value.
@@ -1423,17 +1305,10 @@ void
 HTMLTextAreaElement::FieldSetDisabledChanged(bool aNotify)
 {
   UpdateValueMissingValidityState();
   UpdateBarredFromConstraintValidation();
 
   nsGenericHTMLFormElement::FieldSetDisabledChanged(aNotify);
 }
 
-JSObject*
-HTMLTextAreaElement::WrapNode(JSContext* aCx, JSObject* aScope,
-                              bool* aTriedToWrap)
-{
-  return HTMLTextAreaElementBinding::Wrap(aCx, aScope, this, aTriedToWrap);
-}
-
 } // namespace dom
 } // namespace mozilla
--- a/content/html/content/src/HTMLTextAreaElement.h
+++ b/content/html/content/src/HTMLTextAreaElement.h
@@ -11,17 +11,16 @@
 #include "nsITextControlElement.h"
 #include "nsIDOMNSEditableElement.h"
 #include "nsCOMPtr.h"
 #include "nsGenericHTMLElement.h"
 #include "nsEventStates.h"
 #include "nsStubMutationObserver.h"
 #include "nsIConstraintValidation.h"
 #include "nsHTMLFormElement.h"
-#include "nsGkAtoms.h"
 
 #include "nsTextEditorState.h"
 
 class nsFormSubmission;
 class nsIControllers;
 class nsIDocument;
 class nsPresContext;
 class nsPresState;
@@ -155,133 +154,19 @@ public:
   bool     IsTooLong();
   bool     IsValueMissing() const;
   void     UpdateTooLongValidityState();
   void     UpdateValueMissingValidityState();
   void     UpdateBarredFromConstraintValidation();
   nsresult GetValidationMessage(nsAString& aValidationMessage,
                                 ValidityStateType aType);
 
-  // Web IDL binding methods
-  bool Autofocus()
-  {
-    return GetBoolAttr(nsGkAtoms::autofocus);
-  }
-  void SetAutofocus(bool aAutoFocus, ErrorResult& aError)
-  {
-    SetHTMLBoolAttr(nsGkAtoms::autofocus, aAutoFocus, aError);
-  }
-  uint32_t Cols()
-  {
-    return GetIntAttr(nsGkAtoms::cols, DEFAULT_COLS);
-  }
-  void SetCols(uint32_t aCols, ErrorResult& aError)
-  {
-    if (aCols == 0) {
-      aError.Throw(NS_ERROR_DOM_INDEX_SIZE_ERR);
-    } else {
-      SetHTMLUnsignedIntAttr(nsGkAtoms::cols, aCols, aError);
-    }
-  }
-  bool Disabled()
-  {
-    return GetBoolAttr(nsGkAtoms::disabled);
-  }
-  void SetDisabled(bool aDisabled, ErrorResult& aError)
-  {
-    SetHTMLBoolAttr(nsGkAtoms::disabled, aDisabled, aError);
-  }
-  // nsGenericHTMLFormElement::GetForm is fine
-  using nsGenericHTMLFormElement::GetForm;
-  int32_t MaxLength()
-  {
-    return GetIntAttr(nsGkAtoms::maxlength, -1);
-  }
-  void SetMaxLength(int32_t aMaxLength, ErrorResult& aError)
-  {
-    if (aMaxLength < 0) {
-      aError.Throw(NS_ERROR_DOM_INDEX_SIZE_ERR);
-    } else {
-      SetHTMLIntAttr(nsGkAtoms::maxlength, aMaxLength, aError);
-    }
-  }
-  // XPCOM GetName is fine
-  void SetName(const nsAString& aName, ErrorResult& aError)
-  {
-    SetHTMLAttr(nsGkAtoms::name, aName, aError);
-  }
-  // XPCOM GetPlaceholder is fine
-  void SetPlaceholder(const nsAString& aPlaceholder, ErrorResult& aError)
-  {
-    SetHTMLAttr(nsGkAtoms::placeholder, aPlaceholder, aError);
-  }
-  bool ReadOnly()
-  {
-    return GetBoolAttr(nsGkAtoms::readonly);
-  }
-  void SetReadOnly(bool aReadOnly, ErrorResult& aError)
-  {
-    SetHTMLBoolAttr(nsGkAtoms::readonly, aReadOnly, aError);
-  }
-  bool Required()
-  {
-    return GetBoolAttr(nsGkAtoms::required);
-  }
-  void SetRequired(bool aRequired, ErrorResult& aError)
-  {
-    SetHTMLBoolAttr(nsGkAtoms::required, aRequired, aError);
-  }
-  uint32_t Rows()
-  {
-    return GetIntAttr(nsGkAtoms::rows, DEFAULT_ROWS_TEXTAREA);
-  }
-  void SetRows(uint32_t aRows, ErrorResult& aError)
-  {
-    if (aRows == 0) {
-      aError.Throw(NS_ERROR_DOM_INDEX_SIZE_ERR);
-    } else {
-      SetHTMLUnsignedIntAttr(nsGkAtoms::rows, aRows, aError);
-    }
-  }
-  // XPCOM GetWrap is fine
-  void SetWrap(const nsAString& aWrap, ErrorResult& aError)
-  {
-    SetHTMLAttr(nsGkAtoms::wrap, aWrap, aError);
-  }
-  // XPCOM GetType is fine
-  // XPCOM GetDefaultValue is fine
-  void SetDefaultValue(const nsAString& aDefaultValue, ErrorResult& aError);
-  // XPCOM GetValue/SetValue are fine
-  uint32_t GetTextLength();
-  // nsIConstraintValidation::WillValidate is fine.
-  // nsIConstraintValidation::Validity() is fine.
-  // nsIConstraintValidation::GetValidationMessage() is fine.
-  // nsIConstraintValidation::CheckValidity() is fine.
-  using nsIConstraintValidation::CheckValidity;
-  // nsIConstraintValidation::SetCustomValidity() is fine.
-  // XPCOM Select is fine
-  uint32_t GetSelectionStart(ErrorResult& aError);
-  void SetSelectionStart(uint32_t aSelectionStart, ErrorResult& aError);
-  uint32_t GetSelectionEnd(ErrorResult& aError);
-  void SetSelectionEnd(uint32_t aSelectionEnd, ErrorResult& aError);
-  void GetSelectionDirection(nsAString& aDirection, ErrorResult& aError);
-  void SetSelectionDirection(const nsAString& aDirection, ErrorResult& aError);
-  void SetSelectionRange(uint32_t aSelectionStart, uint32_t aSelectionEnd, const Optional<nsAString>& aDirecton, ErrorResult& aError);
-  nsIControllers* GetControllers(ErrorResult& aError);
-  nsIEditor* GetEditor()
-  {
-    return mState.GetEditor();
-  }
-
 protected:
   using nsGenericHTMLFormElement::IsSingleLineTextControl; // get rid of the compiler warning
 
-  virtual JSObject* WrapNode(JSContext *aCx, JSObject *aScope,
-                             bool *aTriedToWrap) MOZ_OVERRIDE;
-
   nsCOMPtr<nsIControllers> mControllers;
   /** Whether or not the value has changed since its default value was given. */
   bool                     mValueChanged;
   /** Whether or not we are already handling select event. */
   bool                     mHandlingSelect;
   /** Whether or not we are done adding children (always true if not
       created by a parser */
   bool                     mDoneAddingChildren;
deleted file mode 100644
--- a/content/html/content/src/HTMLTimeElement.cpp
+++ /dev/null
@@ -1,63 +0,0 @@
-/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
-/* This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
-
-#include "HTMLTimeElement.h"
-#include "mozilla/dom/HTMLTimeElementBinding.h"
-#include "nsContentUtils.h"
-#include "nsGenericHTMLElement.h"
-#include "nsVariant.h"
-#include "nsGkAtoms.h"
-
-NS_IMPL_NS_NEW_HTML_ELEMENT(Time)
-
-namespace mozilla {
-namespace dom {
-
-HTMLTimeElement::HTMLTimeElement(already_AddRefed<nsINodeInfo> aNodeInfo)
-  : nsGenericHTMLElement(aNodeInfo)
-{
-  SetIsDOMBinding();
-}
-
-HTMLTimeElement::~HTMLTimeElement()
-{
-}
-
-NS_IMPL_ADDREF_INHERITED(HTMLTimeElement, Element)
-NS_IMPL_RELEASE_INHERITED(HTMLTimeElement, Element)
-
-NS_INTERFACE_TABLE_HEAD(HTMLTimeElement)
-  NS_HTML_CONTENT_INTERFACE_TABLE0(HTMLTimeElement)
-  NS_HTML_CONTENT_INTERFACE_TABLE_TO_MAP_SEGUE(HTMLTimeElement,
-                                               nsGenericHTMLElement)
-NS_HTML_CONTENT_INTERFACE_MAP_END
-
-NS_IMPL_ELEMENT_CLONE(HTMLTimeElement)
-
-JSObject*
-HTMLTimeElement::WrapNode(JSContext* cx, JSObject* scope, bool* triedToWrap)
-{
-  return HTMLTimeElementBinding::Wrap(cx, scope, this, triedToWrap);
-}
-
-void
-HTMLTimeElement::GetItemValueText(nsAString& text)
-{
-  if (HasAttr(kNameSpaceID_None, nsGkAtoms::datetime)) {
-    GetDateTime(text);
-  } else {
-    GetTextContentInternal(text);
-  }
-}
-
-void
-HTMLTimeElement::SetItemValueText(const nsAString& text)
-{
-  ErrorResult rv;
-  SetDateTime(text, rv);
-}
-
-} // namespace dom
-} // namespace mozilla
deleted file mode 100644
--- a/content/html/content/src/HTMLTimeElement.h
+++ /dev/null
@@ -1,59 +0,0 @@
-/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
-/* This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
-
-#ifndef mozilla_dom_HTMLTimeElement_h
-#define mozilla_dom_HTMLTimeElement_h
-
-#include "nsIDOMHTMLElement.h"
-#include "nsGenericHTMLElement.h"
-#include "nsGkAtoms.h"
-
-namespace mozilla {
-namespace dom {
-
-class HTMLTimeElement MOZ_FINAL : public nsGenericHTMLElement,
-                                  public nsIDOMHTMLElement
-{
-public:
-  HTMLTimeElement(already_AddRefed<nsINodeInfo> aNodeInfo);
-  virtual ~HTMLTimeElement();
-
-  // nsISupports
-  NS_DECL_ISUPPORTS_INHERITED
-
-  // nsIDOMNode
-  NS_FORWARD_NSIDOMNODE_TO_NSINODE
-
-  // nsIDOMElement
-  NS_FORWARD_NSIDOMELEMENT_TO_GENERIC
-
-  // nsIDOMHTMLElement
-  NS_FORWARD_NSIDOMHTMLELEMENT_TO_GENERIC
-
-  // HTMLTimeElement WebIDL
-  void GetDateTime(nsAString& aDateTime)
-  {
-    GetHTMLAttr(nsGkAtoms::datetime, aDateTime);
-  }
-
-  void SetDateTime(const nsAString& aDateTime, ErrorResult& aError)
-  {
-    SetHTMLAttr(nsGkAtoms::datetime, aDateTime, aError);
-  }
-
-  virtual void GetItemValueText(nsAString& text);
-  virtual void SetItemValueText(const nsAString& text);
-  virtual nsresult Clone(nsINodeInfo* aNodeInfo, nsINode** aResult) const;
-  virtual nsIDOMNode* AsDOMNode() { return this; }
-
-protected:
-  virtual JSObject* WrapNode(JSContext* aCx, JSObject* aScope,
-                             bool* aTriedToWrap) MOZ_OVERRIDE;
-};
-
-} // namespace dom
-} // namespace mozilla
-
-#endif // mozilla_dom_HTMLTimeElement_h
--- a/content/html/content/src/Makefile.in
+++ b/content/html/content/src/Makefile.in
@@ -67,17 +67,16 @@ EXPORTS_mozilla/dom = \
 		HTMLStyleElement.h \
 		HTMLTableCaptionElement.h \
 		HTMLTableCellElement.h \
 		HTMLTableColElement.h \
 		HTMLTableElement.h \
 		HTMLTableRowElement.h \
 		HTMLTableSectionElement.h \
 		HTMLTextAreaElement.h \
-		HTMLTimeElement.h \
 		HTMLTitleElement.h \
 		HTMLUnknownElement.h \
 		UndoManager.h \
 		ValidityState.h \
 		$(NULL)
 
 CPPSRCS		= \
 		HTMLPropertiesCollection.cpp \
@@ -132,17 +131,16 @@ CPPSRCS		= \
 		HTMLStyleElement.cpp \
 		HTMLTableElement.cpp \
 		HTMLTableCaptionElement.cpp \
 		HTMLTableCellElement.cpp \
 		HTMLTableColElement.cpp \
 		HTMLTableRowElement.cpp \
 		HTMLTableSectionElement.cpp \
 		HTMLTextAreaElement.cpp \
-		HTMLTimeElement.cpp \
 		HTMLTitleElement.cpp \
 		HTMLUnknownElement.cpp \
 		ValidityState.cpp \
 		nsIConstraintValidation.cpp \
 		nsRadioVisitor.cpp \
 		nsDOMStringMap.cpp \
 		UndoManager.cpp \
 		$(NULL)
--- a/content/html/content/src/nsGenericHTMLElement.h
+++ b/content/html/content/src/nsGenericHTMLElement.h
@@ -1957,17 +1957,16 @@ NS_DECLARE_NS_NEW_HTML_ELEMENT(TableCell
 NS_DECLARE_NS_NEW_HTML_ELEMENT(TableCol)
 NS_DECLARE_NS_NEW_HTML_ELEMENT(Table)
 NS_DECLARE_NS_NEW_HTML_ELEMENT(TableRow)
 NS_DECLARE_NS_NEW_HTML_ELEMENT(TableSection)
 NS_DECLARE_NS_NEW_HTML_ELEMENT(Tbody)
 NS_DECLARE_NS_NEW_HTML_ELEMENT(TextArea)
 NS_DECLARE_NS_NEW_HTML_ELEMENT(Tfoot)
 NS_DECLARE_NS_NEW_HTML_ELEMENT(Thead)
-NS_DECLARE_NS_NEW_HTML_ELEMENT(Time)
 NS_DECLARE_NS_NEW_HTML_ELEMENT(Title)
 NS_DECLARE_NS_NEW_HTML_ELEMENT(Unknown)
 #if defined(MOZ_MEDIA)
 NS_DECLARE_NS_NEW_HTML_ELEMENT(Video)
 #endif
 
 inline nsISupports*
 ToSupports(nsGenericHTMLElement* aHTMLElement)
--- a/content/html/content/src/nsHTMLMediaElement.cpp
+++ b/content/html/content/src/nsHTMLMediaElement.cpp
@@ -3286,17 +3286,17 @@ nsIContent* nsHTMLMediaElement::GetNextS
 {
   nsCOMPtr<nsIDOMNode> thisDomNode = do_QueryObject(this);
 
   mSourceLoadCandidate = nullptr;
 
   nsresult rv = NS_OK;
   if (!mSourcePointer) {
     // First time this has been run, create a selection to cover children.
-    mSourcePointer = new nsRange(this);
+    mSourcePointer = new nsRange();
 
     rv = mSourcePointer->SelectNodeContents(thisDomNode);
     if (NS_FAILED(rv)) return nullptr;
 
     rv = mSourcePointer->Collapse(true);
     if (NS_FAILED(rv)) return nullptr;
   }
 
--- a/content/html/content/test/Makefile.in
+++ b/content/html/content/test/Makefile.in
@@ -274,17 +274,16 @@ MOCHITEST_FILES = \
 		test_input_file_picker.html \
 		test_bug763626.html \
 		test_bug780993.html \
 		test_bug797113.html \
 		test_bug787134.html \
 		test_bug803677.html \
 		test_bug827126.html \
 		test_bug827426.html \
-		test_bug838582.html \
 		test_bug841466.html \
 		test_iframe_sandbox_inheritance.html \
 		file_iframe_sandbox_a_if1.html \
 		file_iframe_sandbox_a_if2.html \
 		file_iframe_sandbox_a_if3.html \
 		file_iframe_sandbox_a_if4.html \
 		file_iframe_sandbox_a_if5.html \
 		file_iframe_sandbox_a_if6.html \
@@ -345,17 +344,16 @@ MOCHITEST_FILES = \
 		test_htmlcollection.html \
 		test_formelements.html \
 		test_rowscollection.html \
 		test_map_attributes_reflection.html \
 		test_meta_attributes_reflection.html \
 		test_mod_attributes_reflection.html \
 		test_mozaudiochannel.html \
 		test_style_attributes_reflection.html \
-		test_bug629801.html \
 		$(NULL)
 
 
 MOCHITEST_BROWSER_FILES = \
 		browser_bug649778.js \
 		file_bug649778.html \
 		file_bug649778.html^headers^ \
 		$(NULL)
--- a/content/html/content/test/reflect.js
+++ b/content/html/content/test/reflect.js
@@ -53,17 +53,18 @@ function reflectString(aParameters)
   is(element[idlAttr], "null",
      "null should have been stringified to 'null'");
   element.removeAttribute(contentAttr);
 
   element[idlAttr] = null;
   // TODO: remove this ugly hack when null stringification will work as expected.
   var todoAttrs = {
     form: [ "acceptCharset", "name", "target" ],
-    input: [ "accept", "alt", "formTarget", "max", "min", "name", "pattern", "placeholder", "step", "defaultValue" ]
+    input: [ "accept", "alt", "formTarget", "max", "min", "name", "pattern", "placeholder", "step", "defaultValue" ],
+    textarea: [ "name", "placeholder" ]
   };
   if (!(element.localName in todoAttrs) || todoAttrs[element.localName].indexOf(idlAttr) == -1) {
     is(element.getAttribute(contentAttr), "null",
        "null should have been stringified to 'null'");
     is(element[idlAttr], "null", "null should have been stringified to 'null'");
     element.removeAttribute(contentAttr);
   } else {
     todo_is(element.getAttribute(contentAttr), "null",
--- a/content/html/content/test/test_bug388558.html
+++ b/content/html/content/test/test_bug388558.html
@@ -20,17 +20,17 @@ https://bugzilla.mozilla.org/show_bug.cg
 
 /** Test for Bug 388558 **/
 var inputChange = 0;
 var textareaChange = 0;
 
 function testUserInput() {
   netscape.security.PrivilegeManager.enablePrivilege('UniversalXPConnect');
   var input = document.getElementById("input");
-  var textarea = SpecialPowers.wrap(document.getElementById("textarea"));
+  var textarea = document.getElementById("textarea");
 
   input.focus();
   input.QueryInterface(Components.interfaces.nsIDOMNSEditableElement).setUserInput("foo");
   input.blur();
   is(inputChange, 1, "Input element should have got one change event.");
 
   input.focus();
   input.value = "bar";
@@ -42,31 +42,31 @@ function testUserInput() {
   is(inputChange, 1, 
      "Change event dispatched when setting the value of the input element (2).");
 
   input.QueryInterface(Components.interfaces.nsIDOMNSEditableElement).setUserInput("foo");
   is(inputChange, 1,
      "Change event dispatched when input element doesn't have focus.");
 
   textarea.focus();
-  textarea.setUserInput("foo");
+  textarea.QueryInterface(Components.interfaces.nsIDOMNSEditableElement).setUserInput("foo");
   textarea.blur();
   is(textareaChange, 1, "Textarea element should have got one change event.");
 
   textarea.focus();
   textarea.value = "bar";
   textarea.blur();
   is(textareaChange, 1,
      "Change event dispatched when setting the value of the textarea element.");
 
   textarea.value = "";
   is(textareaChange, 1,
      "Change event dispatched when setting the value of the textarea element (2).");
 
-  textarea.setUserInput("foo");
+  textarea.QueryInterface(Components.interfaces.nsIDOMNSEditableElement).setUserInput("foo");
   is(textareaChange, 1,
      "Change event dispatched when textarea element doesn't have focus.");
 }
 
 SimpleTest.waitForExplicitFinish();
 addLoadEvent(testUserInput);
 addLoadEvent(SimpleTest.finish);
 
--- a/content/html/content/test/test_bug389797.html
+++ b/content/html/content/test/test_bug389797.html
@@ -208,17 +208,16 @@ HTML_TAG("sub", "");
 HTML_TAG("sup", "");
 HTML_TAG("table", "Table");
 HTML_TAG("tbody", "TableSection");
 HTML_TAG("td", "TableCell");
 HTML_TAG("textarea", "TextArea", [], [ "nsIDOMNSEditableElement" ]);
 HTML_TAG("tfoot", "TableSection");
 HTML_TAG("th", "TableCell");
 HTML_TAG("thead", "TableSection");
-HTML_TAG("time", "Time");
 HTML_TAG("title", "Title");
 HTML_TAG("tr", "TableRow");
 HTML_TAG("tt", "");
 HTML_TAG("u", "");
 HTML_TAG("ul", "UList");
 HTML_TAG("var", "");
 HTML_TAG("wbr", "");
 HTML_TAG("xmp", "");
@@ -250,14 +249,36 @@ for (var tag of allTags) {
 
   // Check that each node QIs to all the things we expect it to QI to
   for (var iface of interfaces[tag].concat(interfacesNonClassinfo[tag])) {
     is(iface in SpecialPowers.Ci, true,
        iface + " not in Components.interfaces");
     is(node instanceof SpecialPowers.Ci[iface], true,
        tagName(tag) + " does not QI to " + iface);
   }
+
+  // Now see what classinfo reports
+  netscape.security.PrivilegeManager.enablePrivilege("UniversalXPConnect");
+  var nodeClassInfo = SpecialPowers.wrap(node).QueryInterface(SpecialPowers.Ci.nsIClassInfo);
+  var count = {};
+  var classInfoInterfaces =
+    nodeClassInfo.getInterfaces(count).
+    map(function(id) { return SpecialPowers.Components.interfacesByID[id].toString(); });
+
+  // Make sure that we know about all the things classinfo claims
+  for (var classInfoInterface of classInfoInterfaces) {
+    isnot(interfaces[tag].indexOf(classInfoInterface), -1,
+          "Should know about " + tagName(tag) + " implementing " +
+          classInfoInterface);
+  }
+
+  // And make sure classinfo claims all the things we know about
+  for (iface of interfaces[tag]) {
+    isnot(classInfoInterfaces.indexOf(iface), -1,
+          "Classinfo for " + tagName(tag) + " should claim to implement " +
+          iface);
+  }
 }
 </script>
 </pre>
 </body>
 </html>
 
deleted file mode 100644
--- a/content/html/content/test/test_bug629801.html
+++ /dev/null
@@ -1,60 +0,0 @@
-<!DOCTYPE HTML>
-<html>
-<!--
-https://bugzilla.mozilla.org/show_bug.cgi?id=629801
--->
-<head>
-  <title>Test for Bug 629801</title>
-  <script type="application/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
-  <script type="application/javascript" src="reflect.js"></script>
-  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
-</head>
-<body>
-<a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=629801">Mozilla Bug 629801</a>
-<p id="display"></p>
-<div id="content" style="display: none">
-
-<div itemscope>
- This tests itemValue on time elements, first with no datetime attribute, then with no text content,
- then with both.
- <time id="t1" itemprop="a">May 10th 2009</time>
- <time id="t2" itemprop="b" datetime="2009-05-10"></time>
- <time id="t3" itemprop="c" datetime="2009-05-10">May 10th 2009</time>
-</div>
-
-</div>
-<pre id="test">
-<script type="application/javascript">
-
-/** Test for Bug 629801 **/
-
-var t1 = document.getElementById("t1"),
-    t2 = document.getElementById("t2"),
-    t3 = document.getElementById("t3"),
-    t4 = document.createElement("time");
-
-// .dateTime IDL
-is(t1.dateTime, "", "dateTime is properly set to empty string if datetime attributeis absent");
-is(t2.dateTime, "2009-05-10", "dateTime is properly set to datetime attribute with datetime and no text content");
-is(t3.dateTime, "2009-05-10", "dateTime is properly set to datetime attribute with datetime and text content");
-
-// .itemValue getter for <time>'s microdata
-var times = document.getItems()[0];
-is(times.properties["a"][0].itemValue, "May 10th 2009", "itemValue getter with no datetime uses text content");
-is(times.properties["b"][0].itemValue, "2009-05-10", "itemValue getter with no text content uses datetime");
-is(times.properties["c"][0].itemValue, "2009-05-10", "itemValue getter with datetime and text content uses datetime");
-
-// .itemValue setter uses datetime vs. text content
-times.properties["a"][0].itemValue = "2009-05-10";
-is(times.properties["a"][0].dateTime, "2009-05-10", "setting itemValue updates datetime");
-
-// dateTime reflects datetime attribute
-reflectString({
-  element: t4,
-  attribute: "dateTime"
-});
-
-</script>
-</pre>
-</body>
-</html>
deleted file mode 100644
--- a/content/html/content/test/test_bug838582.html
+++ /dev/null
@@ -1,35 +0,0 @@
-<!DOCTYPE HTML>
-<html>
-<!--
-https://bugzilla.mozilla.org/show_bug.cgi?id=838582
--->
-<head>
-  <title>Test for Bug 838582</title>
-  <script type="application/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
-  <script type="application/javascript" src="reflect.js"></script>
-  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
-</head>
-<body>
-<a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=838582">Mozilla Bug 838582</a>
-<p id="display"></p>
-<div id="content" style="display: none">
-  
-</div>
-<pre id="test">
-<textarea id="t">abc</textarea>
-<script type="application/javascript">
-
-/** Test for Bug 838582 **/
-
-var textarea = document.getElementById("t");
-
-is(t.textLength, 3, "Correct textLength for defaultValue");
-t.value = "abcdef";
-is(t.textLength, 6, "Correct textLength for value");
-ok(!("controllers" in t), "Don't have web-visible controllers property");
-ok("controllers" in SpecialPowers.wrap(t), "Have chrome-visible controllers property");
-
-</script>
-</pre>
-</body>
-</html>
--- a/content/html/document/src/nsHTMLDocument.cpp
+++ b/content/html/document/src/nsHTMLDocument.cpp
@@ -2607,17 +2607,17 @@ nsHTMLDocument::DeferredContentEditableC
 
       nsIDocShell *docshell = window->GetDocShell();
       if (!docshell)
         return;
 
       nsCOMPtr<nsIEditor> editor;
       docshell->GetEditor(getter_AddRefs(editor));
       if (editor) {
-        nsRefPtr<nsRange> range = new nsRange(aElement);
+        nsRefPtr<nsRange> range = new nsRange();
         rv = range->SelectNode(node);
         if (NS_FAILED(rv)) {
           // The node might be detached from the document at this point,
           // which would cause this call to fail.  In this case, we can
           // safely ignore the contenteditable count change.
           return;
         }
 
--- a/content/test/unit/test_range.js
+++ b/content/test/unit/test_range.js
@@ -358,25 +358,25 @@ function run_miscellaneous_tests() {
   if ((endOffset > startOffset) &&
       (startContainer == endContainer) &&
       (startContainer instanceof C_i.nsIDOMText)) {
     // Invalid start node
     try {
       baseRange.setStart(null, 0);
       do_throw("Should have thrown NOT_OBJECT_ERR!");
     } catch (e) {
-      do_check_eq(e instanceof TypeError, true);
+      do_check_eq(e.name, "NS_ERROR_DOM_NOT_OBJECT_ERR");
     }
 
     // Invalid start node
     try {
       baseRange.setStart({}, 0);
       do_throw("Should have thrown SecurityError!");
     } catch (e) {
-      do_check_true(e instanceof TypeError);
+      do_check_eq(e.name, "SecurityError");
     }
 
     // Invalid index
     try {
       baseRange.setStart(startContainer, -1);
       do_throw("Should have thrown IndexSizeError!");
     } catch (e) {
       do_check_eq(e.name, "IndexSizeError");
--- a/content/xml/content/src/CDATASection.h
+++ b/content/xml/content/src/CDATASection.h
@@ -2,27 +2,27 @@
 /* This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 #ifndef mozilla_dom_CDATASection_h
 #define mozilla_dom_CDATASection_h
 
 #include "nsIDOMCDATASection.h"
-#include "mozilla/dom/Text.h"
+#include "nsGenericDOMDataNode.h"
 
 namespace mozilla {
 namespace dom {
 
-class CDATASection : public Text,
+class CDATASection : public nsGenericDOMDataNode,
                      public nsIDOMCDATASection
 {
 public:
   CDATASection(already_AddRefed<nsINodeInfo> aNodeInfo)
-    : Text(aNodeInfo)
+    : nsGenericDOMDataNode(aNodeInfo)
   {
     NS_ABORT_IF_FALSE(mNodeInfo->NodeType() == nsIDOMNode::CDATA_SECTION_NODE,
                       "Bad NodeType in aNodeInfo");
     SetIsDOMBinding();
   }
   virtual ~CDATASection();
 
   // nsISupports
--- a/dom/base/nsDOMClassInfo.cpp
+++ b/dom/base/nsDOMClassInfo.cpp
@@ -6662,16 +6662,29 @@ nsNavigatorSH::PreCreate(nsISupports *na
 
     return NS_ERROR_UNEXPECTED;
   }
   return SetParentToWindow(win, parentObj);
 }
 
 // DOM Node helper
 
+template<nsresult (*func)(JSContext *cx, JSObject *obj, jsval *vp)>
+static JSBool
+GetterShim(JSContext *cx, JSHandleObject obj, JSHandleId /* unused */, JSMutableHandleValue vp)
+{
+  nsresult rv = (*func)(cx, obj, vp.address());
+  if (NS_FAILED(rv)) {
+    xpc::Throw(cx, rv);
+    return JS_FALSE;
+  }
+
+  return JS_TRUE;
+}
+
 NS_IMETHODIMP
 nsNodeSH::PreCreate(nsISupports *nativeObj, JSContext *cx, JSObject *globalObj,
                     JSObject **parentObj)
 {
   nsINode *node = static_cast<nsINode*>(nativeObj);
 
 #ifdef DEBUG
   {
@@ -7374,16 +7387,52 @@ nsNamedNodeMapSH::GetNamedItem(nsISuppor
 {
   nsDOMAttributeMap* map = nsDOMAttributeMap::FromSupports(aNative);
 
   nsINode *attr;
   *aCache = attr = map->GetNamedItem(aName);
   return attr;
 }
 
+// Can't be static so GetterShim will compile
+nsresult
+DocumentURIObjectGetter(JSContext *cx, JSObject *obj, jsval *vp)
+{
+  // This function duplicates some of the logic in XPC_WN_HelperGetProperty
+  XPCWrappedNative *wrapper =
+    XPCWrappedNative::GetWrappedNativeOfJSObject(cx, obj);
+
+  // The error checks duplicate code in THROW_AND_RETURN_IF_BAD_WRAPPER
+  NS_ENSURE_TRUE(!wrapper || wrapper->IsValid(), NS_ERROR_XPC_HAS_BEEN_SHUTDOWN);
+
+  nsCOMPtr<nsIDocument> doc = do_QueryWrappedNative(wrapper, obj);
+  NS_ENSURE_TRUE(doc, NS_ERROR_UNEXPECTED);
+
+  return WrapNative(cx, JS_GetGlobalForScopeChain(cx), doc->GetDocumentURI(),
+                    &NS_GET_IID(nsIURI), true, vp);
+}
+
+NS_IMETHODIMP
+nsDocumentSH::PostCreatePrototype(JSContext * cx, JSObject * proto)
+{
+  // XXXbz when this goes away, kill GetterShim as well.
+  // set up our proto first
+  nsresult rv = nsNodeSH::PostCreatePrototype(cx, proto);
+
+  if (xpc::AccessCheck::isChrome(js::GetObjectCompartment(proto))) {
+    // Stick a documentURIObject property on there
+    JS_DefinePropertyById(cx, proto, sDocumentURIObject_id,
+                          JSVAL_VOID, GetterShim<DocumentURIObjectGetter>,
+                          nullptr,
+                          JSPROP_READONLY | JSPROP_SHARED);
+  }
+
+  return rv;
+}
+
 NS_IMETHODIMP
 nsDocumentSH::NewResolve(nsIXPConnectWrappedNative *wrapper, JSContext *cx,
                          JSObject *obj, jsid id, uint32_t flags,
                          JSObject **objp, bool *_retval)
 {
   nsresult rv;
 
   if (id == sLocation_id) {
--- a/dom/base/nsDOMClassInfo.h
+++ b/dom/base/nsDOMClassInfo.h
@@ -629,16 +629,17 @@ public:
   {
   }
 
   virtual ~nsDocumentSH()
   {
   }
 
 public:
+  NS_IMETHOD PostCreatePrototype(JSContext * cx, JSObject * proto);
   NS_IMETHOD NewResolve(nsIXPConnectWrappedNative *wrapper, JSContext *cx,
                         JSObject *obj, jsid id, uint32_t flags,
                         JSObject **objp, bool *_retval);
   NS_IMETHOD GetFlags(uint32_t* aFlags);
   NS_IMETHOD PostCreate(nsIXPConnectWrappedNative *wrapper, JSContext *cx,
                         JSObject *obj);
   NS_IMETHOD  PostTransplant(nsIXPConnectWrappedNative *wrapper, JSContext *cx,
                              JSObject *obj);
--- a/dom/bindings/Bindings.conf
+++ b/dom/bindings/Bindings.conf
@@ -425,25 +425,16 @@ DOMInterfaces = {
 },
 
 'HTMLTableSectionElement': {
     'resultNotAddRefed': [
         'rows'
     ]
 },
 
-'HTMLTextAreaElement': {
-    'resultNotAddRefed': [
-        'form', 'controllers', 'editor'
-    ],
-    'binaryNames': {
-        'textLength': 'getTextLength'
-    }
-},
-
 'HTMLStyleElement': {
     'resultNotAddRefed': [
         'sheet'
     ]
 },
 
 'HTMLUListElement': {
     'nativeType' : 'mozilla::dom::HTMLSharedListElement'
@@ -577,24 +568,16 @@ DOMInterfaces = {
     'nativeOwnership': 'refcounted'
 },
 
 'PropertyNodeList': {
     'headerFile': 'HTMLPropertiesCollection.h',
     'resultNotAddRefed': [ 'item' ]
 },
 
-'Range': {
-    'nativeType': 'nsRange',
-    'resultNotAddRefed': [ 'startContainer', 'endContainer', 'commonAncestorContainer' ],
-    'binaryNames': {
-        '__stringifier': 'ToString'
-    }
-},
-
 'Rect': {
     "nativeType": "nsDOMCSSRect",
     'resultNotAddRefed': [ "top", "right", "bottom", "left" ]
 },
 
 'RGBColor': {
     "nativeOwnership": "refcounted",
     "nativeType": "nsDOMCSSRGBColor",
@@ -828,19 +811,17 @@ DOMInterfaces = {
     'resultNotAddRefed': [ 'getItem' ]
 },
 
 'SVGSVGElement': {
     'resultNotAddRefed': [ 'getElementById' ]
 },
 
 'Text': {
-    # Total hack to allow binding code to realize that nsTextNode can
-    # in fact be cast to Text.
-    'headerFile': 'nsTextNode.h',
+    'nativeType': 'nsTextNode',
 },
 
 'TextDecoder': [
 {
     'nativeOwnership': 'refcounted',
 },
 {
     'workers': True,
@@ -1218,21 +1199,21 @@ addExternalIface('MozFrameLoader', nativ
 addExternalIface('MozRDFCompositeDataSource', nativeType='nsIRDFCompositeDataSource',
                  notflattened=True)
 addExternalIface('MozRDFResource', nativeType='nsIRDFResource', notflattened=True)
 addExternalIface('MozXULTemplateBuilder', nativeType='nsIXULTemplateBuilder')
 addExternalIface('NamedNodeMap')
 addExternalIface('NodeIterator')
 addExternalIface('nsIStreamListener', nativeType='nsIStreamListener', notflattened=True)
 addExternalIface('nsISupports', nativeType='nsISupports')
-addExternalIface('nsIEditor', nativeType='nsIEditor', notflattened=True)
 addExternalIface('OutputStream', nativeType='nsIOutputStream',
                  notflattened=True)
 addExternalIface('Principal', nativeType='nsIPrincipal',
                  headerFile='nsIPrincipal.h', notflattened=True)
+addExternalIface('Range', nativeType='nsRange')
 addExternalIface('Selection', nativeType='nsISelection')
 addExternalIface('StyleSheet', nativeType='nsIStyleSheet')
 addExternalIface('StyleSheetList')
 addExternalIface('SVGAnimatedEnumeration', headerFile='nsIDOMSVGAnimatedEnum.h')
 addExternalIface('SVGAnimatedNumber')
 addExternalIface('SVGAnimatedString')
 addExternalIface('SVGLength')
 addExternalIface('SVGNumber')
--- a/dom/bindings/Codegen.py
+++ b/dom/bindings/Codegen.py
@@ -1814,28 +1814,16 @@ def InitUnforgeableProperties(descriptor
             CGList(unforgeables, "\n"),
             pre=("\n"
             "// Important: do unforgeable property setup after we have handed\n"
             "// over ownership of the C++ object to obj as needed, so that if\n"
             "// we fail and it ends up GCed it won't have problems in the\n"
             "// finalizer trying to drop its ownership of the C++ object.\n"),
             post="\n")).define() if len(unforgeables) > 0 else ""
 
-def AssertInheritanceChain(descriptor):
-    asserts = ""
-    iface = descriptor.interface
-    while iface:
-        desc = descriptor.getDescriptor(iface.identifier.name)
-        asserts += (
-            "  MOZ_ASSERT(static_cast<%s*>(aObject) == \n"
-            "             reinterpret_cast<%s*>(aObject));\n" %
-            (desc.nativeType, desc.nativeType))
-        iface = iface.parent
-    return asserts
-
 class CGWrapWithCacheMethod(CGAbstractMethod):
     """
     Create a wrapper JSObject for a given native that implements nsWrapperCache.
 
     properties should be a PropertyArrays instance.
     """
     def __init__(self, descriptor, properties):
         assert descriptor.interface.hasInterfacePrototypeObject()
@@ -1846,18 +1834,17 @@ class CGWrapWithCacheMethod(CGAbstractMe
         CGAbstractMethod.__init__(self, descriptor, 'Wrap', 'JSObject*', args)
         self.properties = properties
 
     def definition_body(self):
         if self.descriptor.workers:
             return """  *aTriedToWrap = true;
   return aObject->GetJSObject();"""
 
-        return """%s
-  *aTriedToWrap = true;
+        return """  *aTriedToWrap = true;
 
   JSObject* parent = WrapNativeParent(aCx, aScope, aObject->GetParentObject());
   if (!parent) {
     return NULL;
   }
 
   // That might have ended up wrapping us already, due to the wonders
   // of XBL.  Check for that, and bail out as needed.  Scope so we don't
@@ -1876,18 +1863,17 @@ class CGWrapWithCacheMethod(CGAbstractMe
   if (!proto) {
     return NULL;
   }
 
 %s
 %s
   aCache->SetWrapper(obj);
 
-  return obj;""" % (AssertInheritanceChain(self.descriptor),
-                    CheckPref(self.descriptor, "global", "*aTriedToWrap", "NULL", "aCache"),
+  return obj;""" % (CheckPref(self.descriptor, "global", "*aTriedToWrap", "NULL", "aCache"),
                     CreateBindingJSObject(self.descriptor, "parent"),
                     InitUnforgeableProperties(self.descriptor, self.properties))
 
 class CGWrapMethod(CGAbstractMethod):
     def __init__(self, descriptor):
         # XXX can we wrap if we don't have an interface prototype object?
         assert descriptor.interface.hasInterfacePrototypeObject()
         args = [Argument('JSContext*', 'aCx'), Argument('JSObject*', 'aScope'),
@@ -1908,27 +1894,26 @@ class CGWrapNonWrapperCacheMethod(CGAbst
         # XXX can we wrap if we don't have an interface prototype object?
         assert descriptor.interface.hasInterfacePrototypeObject()
         args = [Argument('JSContext*', 'aCx'), Argument('JSObject*', 'aScope'),
                 Argument(descriptor.nativeType + '*', 'aObject')]
         CGAbstractMethod.__init__(self, descriptor, 'Wrap', 'JSObject*', args)
         self.properties = properties
 
     def definition_body(self):
-        return """%s
+        return """
   JSObject* global = JS_GetGlobalForObject(aCx, aScope);
   JSObject* proto = GetProtoObject(aCx, global);
   if (!proto) {
     return NULL;
   }
 
 %s
 %s
-  return obj;""" % (AssertInheritanceChain(self.descriptor),
-                    CreateBindingJSObject(self.descriptor, "global"),
+  return obj;""" % (CreateBindingJSObject(self.descriptor, "global"),
                     InitUnforgeableProperties(self.descriptor, self.properties))
 
 builtinNames = {
     IDLType.Tags.bool: 'bool',
     IDLType.Tags.int8: 'int8_t',
     IDLType.Tags.int16: 'int16_t',
     IDLType.Tags.int32: 'int32_t',
     IDLType.Tags.int64: 'int64_t',
--- a/dom/imptests/failures/html/old-tests/submission/Opera/microdata/test_001.html.json
+++ b/dom/imptests/failures/html/old-tests/submission/Opera/microdata/test_001.html.json
@@ -1,3 +1,5 @@
 {
-  "itemValue must reflect the src attribute on track elements": true
+  "itemValue must reflect the src attribute on track elements": true,
+  "itemValue must reflect the dateTime attribute of time elements with no datetime attribute": true,
+  "itemValue must reflect the datetime attribute of time elements with a datetime attribute": true
 }
--- a/dom/imptests/failures/webapps/DOMCore/tests/approved/test_interfaces.html.json
+++ b/dom/imptests/failures/webapps/DOMCore/tests/approved/test_interfaces.html.json
@@ -87,16 +87,55 @@
   "Attr interface: existence and properties of interface prototype object's \"constructor\" property": true,
   "Attr interface: attribute name": true,
   "Attr interface: attribute value": true,
   "Stringification of document.querySelector(\"[id]\").attributes[0]": "debug",
   "CharacterData interface: operation remove()": true,
   "CharacterData interface: document.createTextNode(\"abc\") must inherit property \"remove\" with the proper type (7)": true,
   "CharacterData interface: xmlDoc.createProcessingInstruction(\"abc\", \"def\") must inherit property \"remove\" with the proper type (7)": true,
   "CharacterData interface: document.createComment(\"abc\") must inherit property \"remove\" with the proper type (7)": true,
+  "Range interface: existence and properties of interface object": true,
+  "Range interface: existence and properties of interface prototype object": true,
+  "Range interface: existence and properties of interface prototype object's \"constructor\" property": true,
+  "Range interface: attribute startContainer": true,
+  "Range interface: attribute startOffset": true,
+  "Range interface: attribute endContainer": true,
+  "Range interface: attribute endOffset": true,
+  "Range interface: attribute collapsed": true,
+  "Range interface: attribute commonAncestorContainer": true,
+  "Range interface: calling setStart(Node,unsigned long) on document.createRange() with too few arguments must throw TypeError": true,
+  "Range interface: calling setEnd(Node,unsigned long) on document.createRange() with too few arguments must throw TypeError": true,
+  "Range interface: calling setStartBefore(Node) on document.createRange() with too few arguments must throw TypeError": true,
+  "Range interface: calling setStartAfter(Node) on document.createRange() with too few arguments must throw TypeError": true,
+  "Range interface: calling setEndBefore(Node) on document.createRange() with too few arguments must throw TypeError": true,
+  "Range interface: calling setEndAfter(Node) on document.createRange() with too few arguments must throw TypeError": true,
+  "Range interface: calling collapse(boolean) on document.createRange() with too few arguments must throw TypeError": true,
+  "Range interface: calling selectNode(Node) on document.createRange() with too few arguments must throw TypeError": true,
+  "Range interface: calling selectNodeContents(Node) on document.createRange() with too few arguments must throw TypeError": true,
+  "Range interface: calling compareBoundaryPoints(unsigned short,Range) on document.createRange() with too few arguments must throw TypeError": true,
+  "Range interface: calling insertNode(Node) on document.createRange() with too few arguments must throw TypeError": true,
+  "Range interface: calling surroundContents(Node) on document.createRange() with too few arguments must throw TypeError": true,
+  "Range interface: calling isPointInRange(Node,unsigned long) on document.createRange() with too few arguments must throw TypeError": true,
+  "Range interface: calling comparePoint(Node,unsigned long) on document.createRange() with too few arguments must throw TypeError": true,
+  "Range interface: calling intersectsNode(Node) on document.createRange() with too few arguments must throw TypeError": true,
+  "Range interface: calling setStart(Node,unsigned long) on detachedRange with too few arguments must throw TypeError": true,
+  "Range interface: calling setEnd(Node,unsigned long) on detachedRange with too few arguments must throw TypeError": true,
+  "Range interface: calling setStartBefore(Node) on detachedRange with too few arguments must throw TypeError": true,
+  "Range interface: calling setStartAfter(Node) on detachedRange with too few arguments must throw TypeError": true,
+  "Range interface: calling setEndBefore(Node) on detachedRange with too few arguments must throw TypeError": true,
+  "Range interface: calling setEndAfter(Node) on detachedRange with too few arguments must throw TypeError": true,
+  "Range interface: calling collapse(boolean) on detachedRange with too few arguments must throw TypeError": true,
+  "Range interface: calling selectNode(Node) on detachedRange with too few arguments must throw TypeError": true,
+  "Range interface: calling selectNodeContents(Node) on detachedRange with too few arguments must throw TypeError": true,
+  "Range interface: calling compareBoundaryPoints(unsigned short,Range) on detachedRange with too few arguments must throw TypeError": true,
+  "Range interface: calling insertNode(Node) on detachedRange with too few arguments must throw TypeError": true,
+  "Range interface: calling surroundContents(Node) on detachedRange with too few arguments must throw TypeError": true,
+  "Range interface: calling isPointInRange(Node,unsigned long) on detachedRange with too few arguments must throw TypeError": true,
+  "Range interface: calling comparePoint(Node,unsigned long) on detachedRange with too few arguments must throw TypeError": true,
+  "Range interface: calling intersectsNode(Node) on detachedRange with too few arguments must throw TypeError": true,
   "NodeIterator interface: existence and properties of interface object": true,
   "NodeIterator interface: existence and properties of interface prototype object": true,
   "NodeIterator interface: existence and properties of interface prototype object's \"constructor\" property": true,
   "NodeIterator interface: attribute root": true,
   "NodeIterator interface: attribute referenceNode": true,
   "NodeIterator interface: attribute pointerBeforeReferenceNode": true,
   "NodeIterator interface: attribute whatToShow": true,
   "NodeIterator interface: attribute filter": true,
--- a/dom/imptests/failures/webapps/DOMCore/tests/submissions/Ms2ger/Makefile.in
+++ b/dom/imptests/failures/webapps/DOMCore/tests/submissions/Ms2ger/Makefile.in
@@ -24,14 +24,15 @@ MOCHITEST_FILES := \
   test_Event-defaultPrevented.html.json \
   test_EventTarget-dispatchEvent.html.json \
   test_Node-isEqualNode.xhtml.json \
   test_NodeFilter-constants.html.json \
   test_Range-attributes.html.json \
   test_Range-commonAncestorContainer.html.json \
   test_Range-comparePoint.html.json \
   test_Range-detach.html.json \
+  test_Range-intersectsNode-binding.html.json \
   test_attributes.html.json \
   test_case.html.json \
   test_historical.html.json \
   $(NULL)
 
 include $(topsrcdir)/config/rules.mk
--- a/dom/imptests/failures/webapps/DOMCore/tests/submissions/Ms2ger/test_Range-comparePoint.html.json
+++ b/dom/imptests/failures/webapps/DOMCore/tests/submissions/Ms2ger/test_Range-comparePoint.html.json
@@ -1,3 +1,4 @@
 {
-  "Range.comparePoint": true
+  "Range.comparePoint": true,
+  "Range.comparePoint 1": true
 }
new file mode 100644
--- /dev/null
+++ b/dom/imptests/failures/webapps/DOMCore/tests/submissions/Ms2ger/test_Range-intersectsNode-binding.html.json
@@ -0,0 +1,3 @@
+{
+  "Calling intersectsNode without an argument or with an invalid argument should throw a TypeError.": true
+}
--- a/dom/interfaces/core/nsIDOMDocumentFragment.idl
+++ b/dom/interfaces/core/nsIDOMDocumentFragment.idl
@@ -9,12 +9,12 @@
  * DocumentFragment is a "lightweight" or "minimal" Document object.
  * nsIDOMDocumentFragment is used in situations where the Document
  * interface can potentially be a heavyweight interface.
  *
  * For more information on this interface please see 
  * http://www.w3.org/TR/DOM-Level-2-Core/
  */
 
-[scriptable, builtinclass, uuid(4a15eb0c-d5bc-4902-9d50-21b12cab47e7)]
+[scriptable, uuid(4a15eb0c-d5bc-4902-9d50-21b12cab47e7)]
 interface nsIDOMDocumentFragment : nsIDOMNode
 {
 };
--- a/dom/interfaces/core/nsIDOMNSEditableElement.idl
+++ b/dom/interfaces/core/nsIDOMNSEditableElement.idl
@@ -4,21 +4,18 @@
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 #include "nsISupports.idl"
 
 interface nsIEditor;
 
 /**
  * This interface is implemented by elements which have inner editable content,
- * such as HTML input and textarea.
- *
- * Please make sure to update the HTMLTextAreaElement Web IDL interface to
- * mirror this interface when changing it.
- */
+ * such as HTML input and textarea. 
+*/
 
 [scriptable, uuid(b33eb56c-3120-418c-892b-774b00c7dde8)]
 interface nsIDOMNSEditableElement : nsISupports
 {
   readonly attribute nsIEditor editor;
   // This is similar to set .value on nsIDOMInput/TextAreaElements, but
   // handling of the value change is closer to the normal user input, so 
   // 'change' event for example will be dispatched when focusing out the
--- a/dom/interfaces/html/nsIDOMHTMLTextAreaElement.idl
+++ b/dom/interfaces/html/nsIDOMHTMLTextAreaElement.idl
@@ -55,12 +55,10 @@ interface nsIDOMHTMLTextAreaElement : ns
   void select();
            attribute long                  selectionStart;
            attribute long                  selectionEnd;
   void setSelectionRange(in long selectionStart, in long selectionEnd, [optional] in DOMString direction);
            attribute DOMString             selectionDirection;
 
 
   // Mozilla extensions
-  // Please make sure to update the HTMLTextAreaElement Web IDL interface to
-  // mirror the list of Mozilla extensions here when changing it.
   readonly attribute nsIControllers   controllers;
 };
--- a/dom/plugins/test/mochitest/test_copyText.html
+++ b/dom/plugins/test/mochitest/test_copyText.html
@@ -10,17 +10,18 @@ function runTests() {
 
   var text = " some text \n to copy 'n paste "
   var textElt = document.getElementById("input");
   var plugin = document.getElementById("plugin1");
 
   textElt.focus();
   textElt.value = text;
   textElt.select();
-  SpecialPowers.wrap(textElt).editor.copy();
+  textElt.QueryInterface(Components.interfaces.nsIDOMNSEditableElement)
+      .editor.copy();
 
   is(plugin.getClipboardText(), text);
 
   SimpleTest.finish();
 }
 
 SimpleTest.waitForExplicitFinish();
 
--- a/dom/webidl/Document.webidl
+++ b/dom/webidl/Document.webidl
@@ -13,16 +13,17 @@
  * http://dev.w3.org/csswg/cssom-view/#extensions-to-the-document-interface
  *
  * http://mxr.mozilla.org/mozilla-central/source/dom/interfaces/core/nsIDOMDocument.idl
  */
 
 interface Attr;
 interface Comment;
 interface NodeIterator;
+interface Range;
 interface StyleSheetList;
 interface Touch;
 interface TouchList;
 interface TreeWalker;
 interface WindowProxy;
 interface nsISupports;
 
 enum VisibilityState { "hidden", "visible" };
@@ -198,19 +199,16 @@ partial interface Document {
    * |-moz-element(#aImageElementId)|. If this is null, the function will
    * unregister the image element ID |aImageElementId|.
    *
    * @see <https://developer.mozilla.org/en/DOM/document.mozSetImageElement>
    */
   void mozSetImageElement(DOMString aImageElementId,
                           Element? aImageElement);
 
-  [ChromeOnly]
-  readonly attribute URI? documentURIObject;
-
 };
 
 // http://dvcs.w3.org/hg/fullscreen/raw-file/tip/Overview.html#api
 partial interface Document {
   // Note: Per spec the 'S' in these two is lowercase, but the "Moz"
   // versions hve it uppercase.
   readonly attribute boolean mozFullScreenEnabled;
   [Throws]
deleted file mode 100644
--- a/dom/webidl/HTMLTextAreaElement.webidl
+++ /dev/null
@@ -1,93 +0,0 @@
-/* -*- Mode: IDL; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
-/* This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this file,
- * You can obtain one at http://mozilla.org/MPL/2.0/.
- *
- * The origin of this IDL file is
- * http://www.whatwg.org/specs/web-apps/current-work/#the-textarea-element
- * http://www.whatwg.org/specs/web-apps/current-work/#other-elements,-attributes-and-apis
- * © Copyright 2004-2011 Apple Computer, Inc., Mozilla Foundation, and
- * Opera Software ASA. You are granted a license to use, reproduce
- * and create derivative works of this document.
- */
-
-interface nsIEditor;
-interface MozControllers;
-
-interface HTMLTextAreaElement : HTMLElement {
-           // attribute DOMString autocomplete;
-  [SetterThrows, Pure]
-           attribute boolean autofocus;
-  [SetterThrows, Pure]
-           attribute unsigned long cols;
-           // attribute DOMString dirName;
-  [SetterThrows, Pure]
-           attribute boolean disabled;
-  [Pure]
-  readonly attribute HTMLFormElement? form;
-           // attribute DOMString inputMode;
-  [SetterThrows, Pure]
-           attribute long maxLength;
-  [SetterThrows, Pure]
-           attribute DOMString name;
-  [SetterThrows, Pure]
-           attribute DOMString placeholder;
-  [SetterThrows, Pure]
-           attribute boolean readOnly;
-  [SetterThrows, Pure]
-           attribute boolean required;
-  [SetterThrows, Pure]
-           attribute unsigned long rows;
-  [SetterThrows, Pure]
-           attribute DOMString wrap;
-
-  [Constant]
-  readonly attribute DOMString type;
-  [SetterThrows, Pure]
-           attribute DOMString defaultValue;
-  [TreatNullAs=EmptyString] attribute DOMString value;
-  readonly attribute unsigned long textLength;
-
-  readonly attribute boolean willValidate;
-  readonly attribute ValidityState validity;
-  readonly attribute DOMString validationMessage;
-  boolean checkValidity();
-  void setCustomValidity(DOMString error);
-
-  // readonly attribute NodeList labels;
-
-  void select();
-  [Throws]
-           attribute unsigned long selectionStart;
-  [Throws]
-           attribute unsigned long selectionEnd;
-  [Throws]
-           attribute DOMString selectionDirection;
-  // void setRangeText(DOMString replacement);
-  // void setRangeText(DOMString replacement, unsigned long start, unsigned long end, optional SelectionMode selectionMode);
-  [Throws]
-  void setSelectionRange(unsigned long start, unsigned long end, optional DOMString direction);
-};
-
-partial interface HTMLTextAreaElement {
-  // Mirrored chrome-only Mozilla extensions to nsIDOMHTMLTextAreaElement.
-  // Please make sure to update this list of nsIDOMHTMLTextAreaElement changes.
-
-  [Throws, ChromeOnly]
-  readonly attribute MozControllers controllers;
-};
-
-partial interface HTMLTextAreaElement {
-  // Mirrored chrome-only nsIDOMNSEditableElement methods.  Please make sure
-  // to update this list if nsIDOMNSEditableElement changes.
-
-  [ChromeOnly]
-  readonly attribute nsIEditor? editor;
-
-  // This is similar to set .value on nsIDOMInput/TextAreaElements, but
-  // handling of the value change is closer to the normal user input, so
-  // 'change' event for example will be dispatched when focusing out the
-  // element.
-  [ChromeOnly]
-  void setUserInput(DOMString input);
-};
deleted file mode 100644
--- a/dom/webidl/HTMLTimeElement.webidl
+++ /dev/null
@@ -1,13 +0,0 @@
-/* -*- Mode: IDL; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
-/* This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this file,
- * You can obtain one at http://mozilla.org/MPL/2.0/.
- *
- * The origin of this IDL file is
- * http://www.whatwg.org/specs/web-apps/current-work/multipage/text-level-semantics.html#the-time-element
- */
-
-interface HTMLTimeElement : HTMLElement {
-           [SetterThrows]
-           attribute DOMString dateTime;
-};
--- a/dom/webidl/Range.webidl
+++ b/dom/webidl/Range.webidl
@@ -1,90 +1,52 @@
 /* -*- Mode: IDL; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
 /* This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this file,
  * You can obtain one at http://mozilla.org/MPL/2.0/.
  *
  * The origin of this IDL file is
- * http://dom.spec.whatwg.org/#range
- * http://domparsing.spec.whatwg.org/#dom-range-createcontextualfragment
- * http://dvcs.w3.org/hg/csswg/raw-file/tip/cssom-view/Overview.html#extensions-to-the-range-interface
+ * http://www.w3.org/TR/2012/WD-dom-20120105/
  *
  * Copyright © 2012 W3C® (MIT, ERCIM, Keio), All Rights Reserved. W3C
  * liability, trademark and document use rules apply.
  */
 
-interface ClientRect;
-
 interface Range {
-  [Throws]
   readonly attribute Node startContainer;
-  [Throws]
   readonly attribute unsigned long startOffset;
-  [Throws]
   readonly attribute Node endContainer;
-  [Throws]
   readonly attribute unsigned long endOffset;
   readonly attribute boolean collapsed;
-  [Throws]
   readonly attribute Node commonAncestorContainer;
 
-  [Throws]
   void setStart(Node refNode, unsigned long offset);
-  [Throws]
   void setEnd(Node refNode, unsigned long offset);
-  [Throws]
   void setStartBefore(Node refNode);
-  [Throws]
   void setStartAfter(Node refNode);
-  [Throws]
   void setEndBefore(Node refNode);
-  [Throws]
   void setEndAfter(Node refNode);
   void collapse(boolean toStart);
-  [Throws]
   void selectNode(Node refNode);
-  [Throws]
   void selectNodeContents(Node refNode);
 
   const unsigned short START_TO_START = 0;
   const unsigned short START_TO_END = 1;
   const unsigned short END_TO_END = 2;
   const unsigned short END_TO_START = 3;
-  [Throws]
   short compareBoundaryPoints(unsigned short how, Range sourceRange);
-  [Throws]
+
   void deleteContents();
-  [Throws]
   DocumentFragment extractContents();
-  [Throws]
   DocumentFragment cloneContents();
-  [Throws]
   void insertNode(Node node);
-  [Throws]
   void surroundContents(Node newParent);
 
   Range cloneRange();
   void detach();
 
-  [Throws]
   boolean isPointInRange(Node node, unsigned long offset);
-  [Throws]
   short comparePoint(Node node, unsigned long offset);
 
-  [Throws]
   boolean intersectsNode(Node node);
 
   stringifier;
 };
-
-// http://domparsing.spec.whatwg.org/#dom-range-createcontextualfragment
-partial interface Range {
-  [Throws]
-  DocumentFragment createContextualFragment(DOMString fragment);
-};
-
-// http://dvcs.w3.org/hg/csswg/raw-file/tip/cssom-view/Overview.html#extensions-to-the-range-interface
-partial interface Range {
-  [Throws]
-  ClientRectList getClientRects();
-  ClientRect getBoundingClientRect();
-};
--- a/dom/webidl/WebIDL.mk
+++ b/dom/webidl/WebIDL.mk
@@ -103,18 +103,16 @@ webidl_files = \
   HTMLSpanElement.webidl \
   HTMLStyleElement.webidl \
   HTMLTableCaptionElement.webidl \
   HTMLTableCellElement.webidl \
   HTMLTableColElement.webidl \
   HTMLTableElement.webidl \
   HTMLTableRowElement.webidl \
   HTMLTableSectionElement.webidl \
-  HTMLTextAreaElement.webidl \
-  HTMLTimeElement.webidl \
   HTMLTitleElement.webidl \
   HTMLUListElement.webidl \
   ImageData.webidl \
   LinkStyle.webidl \
   LocalMediaStream.webidl \
   Location.webidl \
   MediaStream.webidl \
   MutationObserver.webidl \
@@ -123,17 +121,16 @@ webidl_files = \
   NodeList.webidl \
   PaintRequest.webidl \
   PaintRequestList.webidl \
   PannerNode.webidl \
   Performance.webidl \
   PerformanceNavigation.webidl \
   PerformanceTiming.webidl \
   ProcessingInstruction.webidl \
-  Range.webidl \
   Rect.webidl \
   RGBColor.webidl \
   RTCConfiguration.webidl \
   Screen.webidl \
   SVGAElement.webidl \
   SVGAltGlyphElement.webidl \
   SVGAngle.webidl \
   SVGAnimatedAngle.webidl \
--- a/editor/composer/test/test_bug338427.html
+++ b/editor/composer/test/test_bug338427.html
@@ -16,17 +16,17 @@ https://bugzilla.mozilla.org/show_bug.cg
 
 </div>
 <pre id="test">
 <script class="testbody" type="text/javascript">
 
 /** Test for Bug 338427 **/
 function init() {
     var textarea = document.getElementById("editor");
-    var editor = textarea.editor;
+    var editor = textarea.QueryInterface(Components.interfaces.nsIDOMNSEditableElement).editor;
     var spellchecker = editor.getInlineSpellChecker(true);
     spellchecker.enableRealTimeSpell = true;
 
     var list = {}, count = {};
     spellchecker.spellChecker.GetDictionaryList(list, count);
     if (count.value === 0) {
         return; // no dictionary, no test possible
     }
--- a/editor/libeditor/base/IMETextTxn.cpp
+++ b/editor/libeditor/base/IMETextTxn.cpp
@@ -309,23 +309,18 @@ NS_IMETHODIMP IMETextTxn::CollapseTextSe
                 continue;
 
              result= selCon->GetSelection(TextRangeToSelection(textRangeType),
                      getter_AddRefs(imeSel));
              NS_ASSERTION(NS_SUCCEEDED(result), "Cannot get selction");
              if(NS_FAILED(result))
                 break;
 
-             nsCOMPtr<nsIContent> content = do_QueryInterface(mElement);
-             if (!content) {
-               break;
-          }
-
-             nsRefPtr<nsRange> newRange = new nsRange(content);
-             result = newRange->SetStart(content, mOffset+selectionStart);
+             nsRefPtr<nsRange> newRange = new nsRange();
+             result = newRange->SetStart(mElement,mOffset+selectionStart);
              NS_ASSERTION(NS_SUCCEEDED(result), "Cannot SetStart");
              if(NS_FAILED(result))
                 break;
 
              result = newRange->SetEnd(mElement,mOffset+selectionEnd);
              NS_ASSERTION(NS_SUCCEEDED(result), "Cannot SetEnd");
              if(NS_FAILED(result))
                 break;
--- a/editor/libeditor/base/nsEditPropertyAtomList.h
+++ b/editor/libeditor/base/nsEditPropertyAtomList.h
@@ -145,14 +145,13 @@ EDITOR_ATOM(sub, "sub")
 EDITOR_ATOM(sup, "sup")
 EDITOR_ATOM(table, "table")
 EDITOR_ATOM(tbody, "tbody")
 EDITOR_ATOM(td, "td")
 EDITOR_ATOM(textarea, "textarea")
 EDITOR_ATOM(tfoot, "tfoot")
 EDITOR_ATOM(thead, "thead")
 EDITOR_ATOM(th, "th")
-EDITOR_ATOM(time, "time")
 EDITOR_ATOM(tr, "tr")
 EDITOR_ATOM(tt, "tt")
 EDITOR_ATOM(ul, "ul")
 EDITOR_ATOM(u, "u")
 EDITOR_ATOM(var, "var")
--- a/editor/libeditor/html/nsHTMLEditRules.cpp
+++ b/editor/libeditor/html/nsHTMLEditRules.cpp
@@ -243,36 +243,30 @@ nsHTMLEditRules::Init(nsPlaintextEditor 
   nsAdoptingCString returnInEmptyLIKillsList =
     Preferences::GetCString(kPrefName);
 
   // only when "false", becomes FALSE.  Otherwise (including empty), TRUE.
   // XXX Why was this pref designed as a string and not bool?
   mReturnInEmptyLIKillsList = !returnInEmptyLIKillsList.EqualsLiteral("false");
 
   // make a utility range for use by the listenter
-  nsCOMPtr<nsINode> node = mHTMLEditor->GetRoot();
-  if (!node) {
-    node = mHTMLEditor->GetDocument();
-  }
-
-  NS_ENSURE_STATE(node);
-
-  mUtilRange = new nsRange(node);
+  mUtilRange = new nsRange();
    
   // set up mDocChangeRange to be whole doc
-  // temporarily turn off rules sniffing
-  nsAutoLockRulesSniffing lockIt((nsTextEditRules*)this);
-  if (!mDocChangeRange) {
-    mDocChangeRange = new nsRange(node);
-  }
-
-  if (node->IsElement()) {
-    ErrorResult rv;
-    mDocChangeRange->SelectNode(*node, rv);
-    res = AdjustSpecialBreaks(node);
+  nsCOMPtr<nsIDOMElement> rootElem = do_QueryInterface(mHTMLEditor->GetRoot());
+  if (rootElem)
+  {
+    // temporarily turn off rules sniffing
+    nsAutoLockRulesSniffing lockIt((nsTextEditRules*)this);
+    if (!mDocChangeRange)
+    {
+      mDocChangeRange = new nsRange();
+    }
+    mDocChangeRange->SelectNode(rootElem);
+    res = AdjustSpecialBreaks();
     NS_ENSURE_SUCCESS(res, res);
   }
 
   // add ourselves as a listener to edit actions
   res = mHTMLEditor->AddEditActionListener(this);
 
   return res;
 }
@@ -1442,19 +1436,17 @@ nsHTMLEditRules::WillInsertText(EditActi
     nsCOMPtr<nsISelection> selection(aSelection);
     nsCOMPtr<nsISelectionPrivate> selPriv(do_QueryInterface(selection));
     selPriv->SetInterlinePosition(false);
     if (curNode) aSelection->Collapse(curNode, curOffset);
     // manually update the doc changed range so that AfterEdit will clean up
     // the correct portion of the document.
     if (!mDocChangeRange)
     {
-      nsCOMPtr<nsINode> node = do_QueryInterface(selNode);
-      NS_ENSURE_STATE(node);
-      mDocChangeRange = new nsRange(node);
+      mDocChangeRange = new nsRange();
     }
     res = mDocChangeRange->SetStart(selNode, selOffset);
     NS_ENSURE_SUCCESS(res, res);
     if (curNode)
       res = mDocChangeRange->SetEnd(curNode, curOffset);
     else
       res = mDocChangeRange->SetEnd(selNode, selOffset);
     NS_ENSURE_SUCCESS(res, res);
@@ -5073,19 +5065,17 @@ nsHTMLEditRules::ExpandSelectionForDelet
   {
     // find block node containing br
     nsCOMPtr<nsIDOMNode> brBlock = firstBRParent;
     if (!IsBlockNode(brBlock))
       brBlock = nsHTMLEditor::GetBlockNodeParent(brBlock);
     bool nodeBefore=false, nodeAfter=false;
     
     // create a range that represents expanded selection
-    nsCOMPtr<nsINode> node = do_QueryInterface(selStartNode);
-    NS_ENSURE_STATE(node);
-    nsRefPtr<nsRange> range = new nsRange(node);
+    nsRefPtr<nsRange> range = new nsRange();
     res = range->SetStart(selStartNode, selStartOffset);
     NS_ENSURE_SUCCESS(res, res);
     res = range->SetEnd(selEndNode, selEndOffset);
     NS_ENSURE_SUCCESS(res, res);
     
     // check if block is entirely inside range
     nsCOMPtr<nsIContent> brContentBlock = do_QueryInterface(brBlock);
     res = nsRange::CompareNodeToRange(brContentBlock, range, &nodeBefore, &nodeAfter);
@@ -6122,19 +6112,17 @@ nsHTMLEditRules::GetNodesFromPoint(DOMPo
   nsresult res;
 
   // get our point
   nsCOMPtr<nsIDOMNode> node;
   int32_t offset;
   point.GetPoint(node, offset);
   
   // use it to make a range
-  nsCOMPtr<nsINode> nativeNode = do_QueryInterface(node);
-  NS_ENSURE_STATE(nativeNode);
-  nsRefPtr<nsRange> range = new nsRange(nativeNode);
+  nsRefPtr<nsRange> range = new nsRange();
   res = range->SetStart(node, offset);
   NS_ENSURE_SUCCESS(res, res);
   /* SetStart() will also set the end for this new range
   res = range->SetEnd(node, offset);
   NS_ENSURE_SUCCESS(res, res); */
   
   // expand the range to include adjacent inlines
   res = PromoteRange(range, operation);
@@ -7304,19 +7292,17 @@ nsHTMLEditRules::PinSelectionToNewBlock(
   // get the (collapsed) selection location
   nsCOMPtr<nsIDOMNode> selNode, temp;
   int32_t selOffset;
   nsresult res = mHTMLEditor->GetStartNodeAndOffset(aSelection, getter_AddRefs(selNode), &selOffset);
   NS_ENSURE_SUCCESS(res, res);
   temp = selNode;
   
   // use ranges and sRangeHelper to compare sel point to new block
-  nsCOMPtr<nsINode> node = do_QueryInterface(selNode);
-  NS_ENSURE_STATE(node);
-  nsRefPtr<nsRange> range = new nsRange(node);
+  nsRefPtr<nsRange> range = new nsRange();
   res = range->SetStart(selNode, selOffset);
   NS_ENSURE_SUCCESS(res, res);
   res = range->SetEnd(selNode, selOffset);
   NS_ENSURE_SUCCESS(res, res);
   nsCOMPtr<nsIContent> block (do_QueryInterface(mNewBlock));
   NS_ENSURE_TRUE(block, NS_ERROR_NO_INTERFACE);
   bool nodeBefore, nodeAfter;
   res = nsRange::CompareNodeToRange(block, range, &nodeBefore, &nodeAfter);
--- a/editor/libeditor/html/nsHTMLEditUtils.cpp
+++ b/editor/libeditor/html/nsHTMLEditUtils.cpp
@@ -745,17 +745,16 @@ static const nsElementInfo kElements[eHT
   ELEM(sup, true, true, GROUP_SPECIAL, GROUP_INLINE_ELEMENT),
   ELEM(table, true, false, GROUP_BLOCK, GROUP_TABLE_CONTENT),
   ELEM(tbody, true, false, GROUP_TABLE_CONTENT, GROUP_TBODY_CONTENT),
   ELEM(td, true, false, GROUP_TR_CONTENT, GROUP_FLOW_ELEMENT),
   ELEM(textarea, true, false, GROUP_FORMCONTROL, GROUP_LEAF),
   ELEM(tfoot, true, false, GROUP_NONE, GROUP_TBODY_CONTENT),
   ELEM(th, true, false, GROUP_TR_CONTENT, GROUP_FLOW_ELEMENT),
   ELEM(thead, true, false, GROUP_NONE, GROUP_TBODY_CONTENT),
-  ELEM(time, true, false, GROUP_PHRASE, GROUP_INLINE_ELEMENT),
   ELEM(title, true, false, GROUP_HEAD_CONTENT, GROUP_LEAF),
   ELEM(tr, true, false, GROUP_TBODY_CONTENT, GROUP_TR_CONTENT),
   ELEM(tt, true, true, GROUP_FONTSTYLE, GROUP_INLINE_ELEMENT),
   ELEM(u, true, true, GROUP_FONTSTYLE, GROUP_INLINE_ELEMENT),
   // XXX Can contain self and ol because editor does sublists illegally.
   ELEM(ul, true, true, GROUP_BLOCK | GROUP_OL_UL,
        GROUP_LI | GROUP_OL_UL),
   ELEM(var, true, true, GROUP_PHRASE, GROUP_INLINE_ELEMENT),
--- a/editor/libeditor/html/nsHTMLEditor.cpp
+++ b/editor/libeditor/html/nsHTMLEditor.cpp
@@ -3249,17 +3249,17 @@ nsHTMLEditor::ContentInserted(nsIDocumen
     if (IsMozEditorBogusNode(aChild)) {
       // Ignore insertion of the bogus node
       return;
     }
     mRules->DocumentModified();
 
     // Update spellcheck for only the newly-inserted node (bug 743819)
     if (mInlineSpellChecker) {
-      nsRefPtr<nsRange> range = new nsRange(aChild);
+      nsRefPtr<nsRange> range = new nsRange();
       nsresult res = range->Set(aContainer, aIndexInContainer,
                                 aContainer, aIndexInContainer + 1);
       if (NS_SUCCEEDED(res)) {
         mInlineSpellChecker->SpellCheckRange(range);
       }
     }
   }
 }
--- a/editor/libeditor/html/nsWSRunObject.cpp
+++ b/editor/libeditor/html/nsWSRunObject.cpp
@@ -1479,20 +1479,18 @@ nsWSRunObject::DeleteChars(nsIDOMNode *a
         NS_ENSURE_SUCCESS(res, res);
       }
       break;
     }
     else
     {
       if (!range)
       {
-        nsCOMPtr<nsINode> startNode = do_QueryInterface(aStartNode);
-        NS_ENSURE_STATE(startNode);
-        range = new nsRange(startNode);
-        res = range->SetStart(startNode, aStartOffset);
+        range = new nsRange();
+        res = range->SetStart(aStartNode, aStartOffset);
         NS_ENSURE_SUCCESS(res, res);
         res = range->SetEnd(aEndNode, aEndOffset);
         NS_ENSURE_SUCCESS(res, res);
       }
       bool nodeBefore, nodeAfter;
       nsCOMPtr<nsIContent> content (do_QueryInterface(node));
       res = nsRange::CompareNodeToRange(content, range, &nodeBefore, &nodeAfter);
       NS_ENSURE_SUCCESS(res, res);
--- a/editor/libeditor/html/tests/test_bug629845.html
+++ b/editor/libeditor/html/tests/test_bug629845.html
@@ -21,22 +21,20 @@ function initFrame(frame)
 
   document.getElementsByTagName('button')[0].click();
 }
 
 function command(aName)
 {
   var frame = document.getElementsByTagName('iframe')[0];
 
-  is(frame.contentDocument.designMode, "on", "design mode should be on!");
   var caught = false;
   try {
     frame.contentDocument.execCommand(aName, false, null);
   } catch (e) {
-    ok(false, "exception " + e + " was thrown");
     caught = true;
   }
 
   ok(!caught, "No exception should have been thrown.");
 
   // Stop the document load before finishing, just to be clean.
   document.getElementsByTagName('iframe')[0].contentWindow.document.close();
   SimpleTest.finish();
--- a/editor/libeditor/text/tests/test_bug596333.html
+++ b/editor/libeditor/text/tests/test_bug596333.html
@@ -22,17 +22,19 @@ https://bugzilla.mozilla.org/show_bug.cg
 const Ci = SpecialPowers.Ci;
 
 SimpleTest.waitForExplicitFinish();
 addLoadEvent(function() SimpleTest.executeSoon(runTest));
 
 var gMisspeltWords;
 
 function getEditor() {
-  return SpecialPowers.wrap(document.getElementById("edit")).editor;
+  return document.getElementById("edit")
+                 .QueryInterface(Ci.nsIDOMNSEditableElement)
+                 .editor;
 }
 
 function getSpellCheckSelection() {
   var editor = getEditor();
   var selcon = editor.selectionController;
   return selcon.getSelection(selcon.SELECTION_SPELLCHECK);
 }
 
--- a/editor/libeditor/text/tests/test_texteditor_keyevent_handling.html
+++ b/editor/libeditor/text/tests/test_texteditor_keyevent_handling.html
@@ -422,17 +422,17 @@ function runTests()
 
   textarea.setAttribute("readonly", "readonly");
   doTest(textarea, "<textarea readonly>", false, true, true);
 
   // make non-tabbable plaintext editor
   textarea.removeAttribute("readonly");
   const nsIPlaintextEditor = Components.interfaces.nsIPlaintextEditor;
   const nsIDOMNSEditableElement = Components.interfaces.nsIDOMNSEditableElement;
-  var editor = SpecialPowers.wrap(textarea).editor;
+  var editor = textarea.QueryInterface(nsIDOMNSEditableElement).editor;
   var flags = editor.flags;
   editor.flags = flags & ~(nsIPlaintextEditor.eEditorWidgetMask |
                            nsIPlaintextEditor.eEditorAllowInteraction);
   doTest(textarea, "non-tabbable <textarea>", false, false, false);
 
   textarea.setAttribute("readonly", "readonly");
   doTest(textarea, "non-tabbable <textarea readonly>", false, true, false);
 
--- a/editor/txtsvc/src/nsFilteredContentIterator.cpp
+++ b/editor/txtsvc/src/nsFilteredContentIterator.cpp
@@ -52,24 +52,23 @@ NS_IMPL_CYCLE_COLLECTION_5(nsFilteredCon
                            mPreIterator,
                            mFilter,
                            mRange)
 
 //------------------------------------------------------------
 nsresult
 nsFilteredContentIterator::Init(nsINode* aRoot)
 {
-  NS_ENSURE_ARG_POINTER(aRoot);
   NS_ENSURE_TRUE(mPreIterator, NS_ERROR_FAILURE);
   NS_ENSURE_TRUE(mIterator, NS_ERROR_FAILURE);
   mIsOutOfRange    = false;
   mDirection       = eForward;
   mCurrentIterator = mPreIterator;
 
-  mRange = new nsRange(aRoot);
+  mRange = new nsRange();
   nsCOMPtr<nsIDOMNode> domNode(do_QueryInterface(aRoot));
   if (domNode) {
     mRange->SelectNode(domNode);
   }
 
   nsresult rv = mPreIterator->Init(mRange);
   NS_ENSURE_SUCCESS(rv, rv);
   return mIterator->Init(mRange);
--- a/editor/txtsvc/src/nsTextServicesDocument.cpp
+++ b/editor/txtsvc/src/nsTextServicesDocument.cpp
@@ -2065,20 +2065,17 @@ nsTextServicesDocument::CreateDocumentCo
 {
   *aRange = NULL;
 
   nsCOMPtr<nsIDOMNode> node;
   nsresult rv = GetDocumentContentRootNode(getter_AddRefs(node));
   NS_ENSURE_SUCCESS(rv, rv);
   NS_ENSURE_TRUE(node, NS_ERROR_NULL_POINTER);
 
-  nsCOMPtr<nsINode> nativeNode = do_QueryInterface(node);
-  NS_ENSURE_STATE(nativeNode);
-
-  nsRefPtr<nsRange> range = new nsRange(nativeNode);
+  nsRefPtr<nsRange> range = new nsRange();
 
   rv = range->SelectNodeContents(node);
   NS_ENSURE_SUCCESS(rv, rv);
 
   range.forget(aRange);
   return NS_OK;
 }
 
--- a/embedding/components/find/src/nsFind.cpp
+++ b/embedding/components/find/src/nsFind.cpp
@@ -142,18 +142,16 @@ NS_IMPL_CYCLE_COLLECTING_RELEASE(nsFindC
 NS_IMPL_CYCLE_COLLECTION_6(nsFindContentIterator, mOuterIterator, mInnerIterator,
                            mStartOuterContent, mEndOuterContent, mEndNode, mStartNode)
 
 
 nsresult
 nsFindContentIterator::Init(nsIDOMNode* aStartNode, int32_t aStartOffset,
                             nsIDOMNode* aEndNode, int32_t aEndOffset)
 {
-  NS_ENSURE_ARG_POINTER(aStartNode);
-  NS_ENSURE_ARG_POINTER(aEndNode);
   if (!mOuterIterator) {
     if (mFindBackward) {
       // Use post-order in the reverse case, so we get parents
       // before children in case we want to prevent descending
       // into a node.
       mOuterIterator = do_CreateInstance(kCContentIteratorCID);
     }
     else {
@@ -271,20 +269,17 @@ nsFindContentIterator::Reset()
   nsCOMPtr<nsIContent> endContent(do_QueryInterface(mEndNode));
   if (endContent) {
     mEndOuterContent = endContent->FindFirstNonChromeOnlyAccessContent();
   }
 
   // Note: OK to just set up the outer iterator here; if our range has a native
   // anonymous endpoint we'll end up setting up an inner iterator, and
   // reset the outer one in the process.
-  nsCOMPtr<nsINode> node = do_QueryInterface(mStartNode);
-  NS_ENSURE_TRUE_VOID(node);
-
-  nsCOMPtr<nsIDOMRange> range = nsFind::CreateRange(node);
+  nsCOMPtr<nsIDOMRange> range = nsFind::CreateRange();
   range->SetStart(mStartNode, mStartOffset);
   range->SetEnd(mEndNode, mEndOffset);
   mOuterIterator->Init(range);
 
   if (!mFindBackward) {
     if (mStartOuterContent != startContent) {
       // the start node was an anonymous text node
       SetupInnerIterator(mStartOuterContent);
@@ -366,19 +361,20 @@ nsFindContentIterator::SetupInnerIterato
   // don't mess with disabled input fields
   uint32_t editorFlags = 0;
   editor->GetFlags(&editorFlags);
   if (editorFlags & nsIPlaintextEditor::eEditorDisabledMask)
     return;
 
   nsCOMPtr<nsIDOMElement> rootElement;
   editor->GetRootElement(getter_AddRefs(rootElement));
+  nsCOMPtr<nsIContent> rootContent(do_QueryInterface(rootElement));
 
-  nsCOMPtr<nsIDOMRange> innerRange = nsFind::CreateRange(aContent);
-  nsCOMPtr<nsIDOMRange> outerRange = nsFind::CreateRange(aContent);
+  nsCOMPtr<nsIDOMRange> innerRange = nsFind::CreateRange();
+  nsCOMPtr<nsIDOMRange> outerRange = nsFind::CreateRange();
   if (!innerRange || !outerRange) {
     return;
   }
 
   // now create the inner-iterator
   mInnerIterator = do_CreateInstance(kCPreContentIteratorCID);
 
   if (mInnerIterator) {
@@ -1140,17 +1136,17 @@ nsFind::Find(const PRUnichar *aPatText, 
       {
 #ifdef DEBUG_FIND
         printf("Found a match!\n");
 #endif
 
         // Make the range:
         nsCOMPtr<nsIDOMNode> startParent;
         nsCOMPtr<nsIDOMNode> endParent;
-        nsCOMPtr<nsIDOMRange> range = CreateRange(tc);
+        nsCOMPtr<nsIDOMRange> range = CreateRange();
         if (range)
         {
           int32_t matchStartOffset, matchEndOffset;
           // convert char index to range point:
           int32_t mao = matchAnchorOffset + (mFindBackward ? 1 : 0);
           if (mFindBackward)
           {
             startParent = do_QueryInterface(tc);
@@ -1254,14 +1250,14 @@ nsFind::Find(const PRUnichar *aPatText, 
 
   // Out of nodes, and didn't match.
   ResetAll();
   return NS_OK;
 }
 
 /* static */
 already_AddRefed<nsIDOMRange>
-nsFind::CreateRange(nsINode* aNode)
+nsFind::CreateRange()
 {
-  nsRefPtr<nsRange> range = new nsRange(aNode);
+  nsRefPtr<nsRange> range = new nsRange();
   range->SetMaySpanAnonymousSubtrees(true);
   return range.forget();
 }
--- a/embedding/components/find/src/nsFind.h
+++ b/embedding/components/find/src/nsFind.h
@@ -30,17 +30,17 @@ class nsFind : public nsIFind
 public:
   NS_DECL_CYCLE_COLLECTING_ISUPPORTS
   NS_DECL_NSIFIND
   NS_DECL_CYCLE_COLLECTION_CLASS(nsFind)
 
   nsFind();
   virtual ~nsFind();
 
-  static already_AddRefed<nsIDOMRange> CreateRange(nsINode* aNode);
+  static already_AddRefed<nsIDOMRange> CreateRange();
 
 protected:
   // Parameters set from the interface:
   //nsCOMPtr<nsIDOMRange> mRange;   // search only in this range
   bool mFindBackward;
   bool mCaseSensitive;
 
   nsCOMPtr<nsIWordBreaker> mWordBreaker;
--- a/embedding/components/find/src/nsWebBrowserFind.cpp
+++ b/embedding/components/find/src/nsWebBrowserFind.cpp
@@ -722,21 +722,21 @@ nsresult nsWebBrowserFind::SearchInFrame
     // Now make sure the content (for actual finding) and frame (for
     // selection) models are up to date.
     theDoc->FlushPendingNotifications(Flush_Frames);
 
     nsCOMPtr<nsISelection> sel;
     GetFrameSelection(aWindow, getter_AddRefs(sel));
     NS_ENSURE_ARG_POINTER(sel);
 
-    nsCOMPtr<nsIDOMRange> searchRange = nsFind::CreateRange(theDoc);
+    nsCOMPtr<nsIDOMRange> searchRange = nsFind::CreateRange();
     NS_ENSURE_ARG_POINTER(searchRange);
-    nsCOMPtr<nsIDOMRange> startPt  = nsFind::CreateRange(theDoc);
+    nsCOMPtr<nsIDOMRange> startPt  = nsFind::CreateRange();
     NS_ENSURE_ARG_POINTER(startPt);
-    nsCOMPtr<nsIDOMRange> endPt  = nsFind::CreateRange(theDoc);
+    nsCOMPtr<nsIDOMRange> endPt  = nsFind::CreateRange();
     NS_ENSURE_ARG_POINTER(endPt);
 
     nsCOMPtr<nsIDOMRange> foundRange;
 
     // If !aWrapping, search from selection to end
     if (!aWrapping)
         rv = GetSearchLimits(searchRange, startPt, endPt, domDoc, sel,
                              false);
--- a/extensions/spellcheck/src/mozInlineSpellChecker.cpp
+++ b/extensions/spellcheck/src/mozInlineSpellChecker.cpp
@@ -127,20 +127,17 @@ mozInlineSpellStatus::InitForEditorChang
     mOp = eOpChangeDelete;
     mRange = nullptr;
     return NS_OK;
   }
 
   mOp = eOpChange;
 
   // range to check
-  nsCOMPtr<nsINode> prevNode = do_QueryInterface(aPreviousNode);
-  NS_ENSURE_STATE(prevNode);
-
-  mRange = new nsRange(prevNode);
+  mRange = new nsRange();
 
   // ...we need to put the start and end in the correct order
   int16_t cmpResult;
   rv = mAnchorRange->ComparePoint(aPreviousNode, aPreviousOffset, &cmpResult);
   NS_ENSURE_SUCCESS(rv, rv);
   if (cmpResult < 0) {
     // previous anchor node is before the current anchor
     rv = mRange->SetStart(aPreviousNode, aPreviousOffset);
--- a/extensions/spellcheck/src/mozInlineSpellWordUtil.cpp
+++ b/extensions/spellcheck/src/mozInlineSpellWordUtil.cpp
@@ -312,21 +312,20 @@ mozInlineSpellWordUtil::GetNextWord(nsAS
 // mozInlineSpellWordUtil::MakeRange
 //
 //    Convenience function for creating a range over the current document.
 
 nsresult
 mozInlineSpellWordUtil::MakeRange(NodeOffset aBegin, NodeOffset aEnd,
                                   nsRange** aRange)
 {
-  NS_ENSURE_ARG_POINTER(aBegin.mNode);
   if (!mDOMDocument)
     return NS_ERROR_NOT_INITIALIZED;
 
-  nsRefPtr<nsRange> range = new nsRange(aBegin.mNode);
+  nsRefPtr<nsRange> range = new nsRange();
   nsresult rv = range->Set(aBegin.mNode, aBegin.mOffset,
                            aEnd.mNode, aEnd.mOffset);
   NS_ENSURE_SUCCESS(rv, rv);
   range.forget(aRange);
 
   return NS_OK;
 }
 
--- a/layout/base/nsPresContext.cpp
+++ b/layout/base/nsPresContext.cpp
@@ -943,24 +943,17 @@ nsPresContext::Init(nsDeviceContext* aDe
       // We don't have our container set yet at this point
       nsCOMPtr<nsISupports> ourContainer = mDocument->GetContainer();
 
       nsCOMPtr<nsIDocShellTreeItem> ourItem = do_QueryInterface(ourContainer);
       if (ourItem) {
         nsCOMPtr<nsIDocShellTreeItem> parentItem;
         ourItem->GetSameTypeParent(getter_AddRefs(parentItem));
         if (parentItem) {
-          Element* containingElement =
-            parent->FindContentForSubDocument(mDocument);
-          if (!containingElement->IsXUL() ||
-              !containingElement->
-                HasAttr(kNameSpaceID_None,
-                        nsGkAtoms::forceOwnRefreshDriver)) {
-            mRefreshDriver = parent->GetShell()->GetPresContext()->RefreshDriver();
-          }
+          mRefreshDriver = parent->GetShell()->GetPresContext()->RefreshDriver();
         }
       }
     }
 
     if (!mRefreshDriver) {
       mRefreshDriver = new nsRefreshDriver(this);
     }
   }
--- a/layout/base/nsPresShell.cpp
+++ b/layout/base/nsPresShell.cpp
@@ -2898,17 +2898,17 @@ PresShell::GoToAnchor(const nsAString& a
 
     // Should we select the target? This action is controlled by a
     // preference: the default is to not select.
     bool selectAnchor = Preferences::GetBool("layout.selectanchor");
 
     // Even if select anchor pref is false, we must still move the
     // caret there. That way tabbing will start from the new
     // location
-    nsRefPtr<nsIDOMRange> jumpToRange = new nsRange(mDocument);
+    nsRefPtr<nsIDOMRange> jumpToRange = new nsRange();
     while (content && content->GetFirstChild()) {
       content = content->GetFirstChild();
     }
     nsCOMPtr<nsIDOMNode> node(do_QueryInterface(content));
     NS_ASSERTION(node, "No nsIDOMNode for descendant of anchor");
     jumpToRange->SelectNodeContents(node);
     // Select the anchor
     nsISelection* sel = mSelection->
@@ -4799,17 +4799,17 @@ PresShell::RenderNode(nsIDOMNode* aNode,
   nsRect area;
   nsTArray<nsAutoPtr<RangePaintInfo> > rangeItems;
 
   // nothing to draw if the node isn't in a document
   nsCOMPtr<nsINode> node = do_QueryInterface(aNode);
   if (!node->IsInDoc())
     return nullptr;
   
-  nsRefPtr<nsRange> range = new nsRange(node);
+  nsRefPtr<nsRange> range = new nsRange();
   if (NS_FAILED(range->SelectNode(aNode)))
     return nullptr;
 
   RangePaintInfo* info = CreateRangePaintInfo(range, area, false);
   if (info && !rangeItems.AppendElement(info)) {
     delete info;
     return nullptr;
   }
--- a/layout/forms/nsTextControlFrame.cpp
+++ b/layout/forms/nsTextControlFrame.cpp
@@ -773,17 +773,17 @@ nsTextControlFrame::SetSelectionInternal
                                          nsIDOMNode *aEndNode,
                                          int32_t aEndOffset,
                                          nsITextControlFrame::SelectionDirection aDirection)
 {
   // Create a new range to represent the new selection.
   // Note that we use a new range to avoid having to do
   // isIncreasing checks to avoid possible errors.
 
-  nsRefPtr<nsRange> range = new nsRange(mContent);
+  nsRefPtr<nsRange> range = new nsRange();
   nsresult rv = range->SetStart(aStartNode, aStartOffset);
   NS_ENSURE_SUCCESS(rv, rv);
 
   rv = range->SetEnd(aEndNode, aEndOffset);
   NS_ENSURE_SUCCESS(rv, rv);
 
   // Get the selection, clear it and add the new range to it!
   nsCOMPtr<nsITextControlElement> txtCtrl = do_QueryInterface(GetContent());
--- a/layout/forms/test/test_bug595310.html
+++ b/layout/forms/test/test_bug595310.html
@@ -25,17 +25,17 @@ SimpleTest.waitForExplicitFinish();
 
 addLoadEvent(function() {
   // We want to compare to value="bar" and no placeholder shown.
   // That is what is currently showed.
   var s1 = snapshotWindow(window, false);
 
   var content = document.getElementById('content');
   var i = document.getElementById('i');
-  var t = SpecialPowers.wrap(document.getElementById('t'));
+  var t = document.getElementById('t');
   i.value = ""; i.placeholder = "foo";
   t.value = ""; t.placeholder = "foo";
 
   // Flushing.
   // Note: one call would have been enough actually but I didn't want to favour
   // one element... ;)
   i.getBoundingClientRect();
   t.getBoundingClientRect();
--- a/layout/generic/nsSelection.cpp
+++ b/layout/generic/nsSelection.cpp
@@ -1464,17 +1464,17 @@ nsFrameSelection::TakeFocus(nsIContent *
     bool changes = mChangesDuringBatching;
     mBatching = 1;
 
     if (aMultipleSelection) {
       // Remove existing collapsed ranges as there's no point in having 
       // non-anchor/focus collapsed ranges.
       mDomSelections[index]->RemoveCollapsedRanges();
 
-      nsRefPtr<nsRange> newRange = new nsRange(aNewFocus);
+      nsRefPtr<nsRange> newRange = new nsRange();
 
       newRange->SetStart(aNewFocus, aContentOffset);
       newRange->SetEnd(aNewFocus, aContentOffset);
       mDomSelections[index]->AddRange(newRange);
       mBatching = batching;
       mChangesDuringBatching = changes;
     }
     else
@@ -2864,17 +2864,17 @@ Selection::GetTableSelectionType(nsIDOMR
   return NS_OK;
 }
 
 nsresult
 nsFrameSelection::CreateAndAddRange(nsINode *aParentNode, int32_t aOffset)
 {
   if (!aParentNode) return NS_ERROR_NULL_POINTER;
 
-  nsRefPtr<nsRange> range = new nsRange(aParentNode);
+  nsRefPtr<nsRange> range = new nsRange();
 
   // Set range around child at given offset
   nsresult result = range->SetStart(aParentNode, aOffset);
   if (NS_FAILED(result)) return result;
   result = range->SetEnd(aParentNode, aOffset+1);
   if (NS_FAILED(result)) return result;
   
   int8_t index = GetIndexFromSelectionType(nsISelectionController::SELECTION_NORMAL);
@@ -3274,17 +3274,17 @@ Selection::SubtractRange(RangeData* aRan
   // If the existing range left overlaps the new range (aSubtract) then
   // cmp < 0, and cmp2 < 0
   // If it right overlaps the new range then cmp > 0 and cmp2 > 0
   // If it fully contains the new range, then cmp < 0 and cmp2 > 0
 
   if (cmp2 > 0) {
     // We need to add a new RangeData to the output, running from
     // the end of aSubtract to the end of range
-    nsRefPtr<nsRange> postOverlap = new nsRange(aSubtract->GetEndParent());
+    nsRefPtr<nsRange> postOverlap = new nsRange();
 
     rv =
       postOverlap->SetStart(aSubtract->GetEndParent(), aSubtract->EndOffset());
     NS_ENSURE_SUCCESS(rv, rv);
     rv =
      postOverlap->SetEnd(range->GetEndParent(), range->EndOffset());
     NS_ENSURE_SUCCESS(rv, rv);
     if (!postOverlap->Collapsed()) {
@@ -3292,17 +3292,17 @@ Selection::SubtractRange(RangeData* aRan
         return NS_ERROR_OUT_OF_MEMORY;
       (*aOutput)[0].mTextRangeStyle = aRange->mTextRangeStyle;
     }
   }
 
   if (cmp < 0) {
     // We need to add a new RangeData to the output, running from
     // the start of the range to the start of aSubtract
-    nsRefPtr<nsRange> preOverlap = new nsRange(range->GetStartParent());
+    nsRefPtr<nsRange> preOverlap = new nsRange();
 
     nsresult rv =
      preOverlap->SetStart(range->GetStartParent(), range->StartOffset());
     NS_ENSURE_SUCCESS(rv, rv);
     rv =
      preOverlap->SetEnd(aSubtract->GetStartParent(), aSubtract->StartOffset());
     NS_ENSURE_SUCCESS(rv, rv);
     
@@ -4404,17 +4404,17 @@ Selection::Collapse(nsINode* aParentNode
   nsresult result;
   // Delete all of the current ranges
   nsRefPtr<nsPresContext>  presContext = GetPresContext();
   Clear(presContext);
 
   // Turn off signal for table selection
   mFrameSelection->ClearTableCellSelection();
 
-  nsRefPtr<nsRange> range = new nsRange(aParentNode);
+  nsRefPtr<nsRange> range = new nsRange();
   result = range->SetEnd(aParentNode, aOffset);
   if (NS_FAILED(result))
     return result;
   result = range->SetStart(aParentNode, aOffset);
   if (NS_FAILED(result))
     return result;
 
 #ifdef DEBUG_SELECTION
@@ -4660,17 +4660,17 @@ Selection::Extend(nsINode* aParentNode, 
                                                   aParentNode, aOffset,
                                                   &disconnected);
   //compare anchor to new cursor
   int32_t result3 = nsContentUtils::ComparePoints(anchorNode, anchorOffset,
                                                   aParentNode, aOffset,
                                                   &disconnected);
 
   nsRefPtr<nsPresContext>  presContext = GetPresContext();
-  nsRefPtr<nsRange> difRange = new nsRange(aParentNode);
+  nsRefPtr<nsRange> difRange = new nsRange();
   if ((result1 == 0 && result3 < 0) || (result1 <= 0 && result2 < 0)){//a1,2  a,1,2
     //select from 1 to 2 unless they are collapsed
     res = range->SetEnd(aParentNode, aOffset);
     if (NS_FAILED(res))
       return res;
     dir = eDirNext;
     res = difRange->SetEnd(range->GetEndParent(), range->EndOffset());
     nsresult tmp = difRange->SetStart(focusNode, focusOffset);
--- a/layout/generic/test/test_selection_expanding.html
+++ b/layout/generic/test/test_selection_expanding.html
@@ -70,17 +70,17 @@ var div1 = document.getElementById("div1
 var div2 = document.getElementById("div2");
 var div3 = document.getElementById("div3");
 var xbl = document.getElementById("xbl");
 var xbl_child = document.getElementById("xbl_child");
 var fixedDiv1 = document.getElementById("fixedDiv1");
 var fixedDiv2 = document.getElementById("fixedDiv2");
 var iframe = document.getElementById("iframe");
 var input = document.getElementById("input");
-var textarea = SpecialPowers.wrap(document.getElementById("textarea"));
+var textarea = document.getElementById("textarea");
 
 function test()
 {
   netscape.security.PrivilegeManager.enablePrivilege('UniversalXPConnect');
 
   function getSelectionForEditor(aEditorElement)
   {
     const nsIDOMNSEditableElement =
@@ -404,9 +404,9 @@ function test()
 
   SimpleTest.finish();
 }
 window.onload = function() { setTimeout(test, 0); };
 SimpleTest.waitForExplicitFinish();
 </script>
 </pre>
 </body>
-</html>
+</html>
\ No newline at end of file
--- a/layout/printing/nsPrintEngine.cpp
+++ b/layout/printing/nsPrintEngine.cpp
@@ -2436,21 +2436,18 @@ CloneRangeToSelection(nsRange* aRange, n
   aRange->GetEndContainer(getter_AddRefs(endContainer));
   int32_t endOffset = aRange->EndOffset();
   NS_ENSURE_TRUE_VOID(startContainer && endContainer);
 
   nsCOMPtr<nsIDOMNode> newStart = GetEqualNodeInCloneTree(startContainer, aDoc);
   nsCOMPtr<nsIDOMNode> newEnd = GetEqualNodeInCloneTree(endContainer, aDoc);
   NS_ENSURE_TRUE_VOID(newStart && newEnd);
 
-  nsCOMPtr<nsINode> newStartNode = do_QueryInterface(newStart);
-  NS_ENSURE_TRUE_VOID(newStartNode);
-
-  nsRefPtr<nsRange> range = new nsRange(newStartNode);
-  nsresult rv = range->SetStart(newStartNode, startOffset);
+  nsRefPtr<nsRange> range = new nsRange();
+  nsresult rv = range->SetStart(newStart, startOffset);
   NS_ENSURE_SUCCESS_VOID(rv);
   rv = range->SetEnd(newEnd, endOffset);
   NS_ENSURE_SUCCESS_VOID(rv);
 
   aSelection->AddRange(range);
 }
 
 static nsresult CloneSelection(nsIDocument* aOrigDoc, nsIDocument* aDoc)
--- a/parser/htmlparser/public/nsHTMLTagList.h
+++ b/parser/htmlparser/public/nsHTMLTagList.h
@@ -148,17 +148,16 @@ HTML_HTMLELEMENT_TAG(sub)
 HTML_HTMLELEMENT_TAG(sup)
 HTML_TAG(table, Table)
 HTML_TAG(tbody, TableSection)
 HTML_TAG(td, TableCell)
 HTML_TAG(textarea, TextArea)
 HTML_TAG(tfoot, TableSection)
 HTML_TAG(th, TableCell)
 HTML_TAG(thead, TableSection)
-HTML_TAG(time, Time)
 HTML_TAG(title, Title)
 HTML_TAG(tr, TableRow)
 HTML_HTMLELEMENT_TAG(tt)
 HTML_HTMLELEMENT_TAG(u)
 HTML_TAG(ul, SharedList)
 HTML_HTMLELEMENT_TAG(var)
 #if defined(MOZ_MEDIA)
 HTML_TAG(video, Video)
--- a/parser/htmlparser/src/nsElementTable.cpp
+++ b/parser/htmlparser/src/nsElementTable.cpp
@@ -1197,25 +1197,16 @@ const nsHTMLElement gHTMLElements[] = {
     /*req-parent excl-parent*/          eHTMLTag_table,eHTMLTag_unknown,  //fix bug 54840...
     /*rootnodes,endrootnodes*/          &gInTable,&gInTable,  
     /*autoclose starttags and endtags*/ &gTBodyAutoClose,0,0,0,
     /*parent,incl,exclgroups*/          kNone, kNone, kSelf,
     /*special props, prop-range*/       (kNoPropagate|kBadContentWatch|kNoStyleLeaksIn|kNoStyleLeaksOut), kNoPropRange,
     /*special parents,kids*/            &gInTable,&gTableElemKids,
   },
   {
-    /*tag*/                             eHTMLTag_time,
-    /*req-parent excl-parent*/          eHTMLTag_unknown,eHTMLTag_unknown,
-    /*rootnodes,endrootnodes*/          &gRootTags,&gRootTags,
-    /*autoclose starttags and endtags*/ 0,0,0,0,
-    /*parent,incl,exclgroups*/          kPhrase, (kSelf|kInlineEntity), kNone,
-    /*special props, prop-range*/       0, kDefaultPropRange,
-    /*special parents,kids*/            0,0,
-  },
-  {
     /*tag*/                             eHTMLTag_title,
     /*req-parent excl-parent*/          eHTMLTag_unknown,eHTMLTag_unknown,
     /*rootnodes,endrootnodes*/          &gInHead,&gInHead,
     /*autoclose starttags and endtags*/ 0,0,0,0,
     /*parent,incl,exclgroups*/          kHeadContent,kPCDATA, kNone,
     /*special props, prop-range*/       kNoStyleLeaksIn, kNoPropRange,
     /*special parents,kids*/            &gInHead,&gContainsText,
   },
--- a/parser/htmlparser/src/nsHTMLTags.cpp
+++ b/parser/htmlparser/src/nsHTMLTags.cpp
@@ -250,18 +250,16 @@ static const PRUnichar sHTMLTagUnicodeNa
 static const PRUnichar sHTMLTagUnicodeName_textarea[] =
   {'t', 'e', 'x', 't', 'a', 'r', 'e', 'a', '\0'};
 static const PRUnichar sHTMLTagUnicodeName_tfoot[] =
   {'t', 'f', 'o', 'o', 't', '\0'};
 static const PRUnichar sHTMLTagUnicodeName_th[] =
   {'t', 'h', '\0'};
 static const PRUnichar sHTMLTagUnicodeName_thead[] =
   {'t', 'h', 'e', 'a', 'd', '\0'};
-static const PRUnichar sHTMLTagUnicodeName_time[] =
-  {'t', 'i', 'm', 'e', '\0'};
 static const PRUnichar sHTMLTagUnicodeName_title[] =
   {'t', 'i', 't', 'l', 'e', '\0'};
 static const PRUnichar sHTMLTagUnicodeName_tr[] =
   {'t', 'r', '\0'};
 static const PRUnichar sHTMLTagUnicodeName_tt[] =
   {'t', 't', '\0'};
 static const PRUnichar sHTMLTagUnicodeName_u[] =
   {'u', '\0'};
--- a/toolkit/components/typeaheadfind/nsTypeAheadFind.cpp
+++ b/toolkit/components/typeaheadfind/nsTypeAheadFind.cpp
@@ -89,22 +89,19 @@ nsTypeAheadFind::~nsTypeAheadFind()
     prefInternal->RemoveObserver("accessibility.browsewithcaret", this);
   }
 }
 
 nsresult
 nsTypeAheadFind::Init(nsIDocShell* aDocShell)
 {
   nsCOMPtr<nsIPrefBranch> prefInternal(do_GetService(NS_PREFSERVICE_CONTRACTID));
-  nsIPresShell* presShell = aDocShell->GetPresShell();
-  NS_ENSURE_STATE(presShell);
-
-  mSearchRange = nullptr;
-  mStartPointRange = nullptr;
-  mEndPointRange = nullptr;
+  mSearchRange = new nsRange();
+  mStartPointRange = new nsRange();
+  mEndPointRange = new nsRange();
   if (!prefInternal || !EnsureFind())
     return NS_ERROR_FAILURE;
 
   SetDocShell(aDocShell);
 
   // ----------- Listen to prefs ------------------
   nsresult rv = prefInternal->AddObserver("accessibility.browsewithcaret", this, true);
   NS_ENSURE_SUCCESS(rv, rv);
@@ -164,22 +161,22 @@ nsTypeAheadFind::SetDocShell(nsIDocShell
 {
   mDocShell = do_GetWeakReference(aDocShell);
 
   mWebBrowserFind = do_GetInterface(aDocShell);
   NS_ENSURE_TRUE(mWebBrowserFind, NS_ERROR_FAILURE);
 
   nsCOMPtr<nsIPresShell> presShell;
   presShell = aDocShell->GetPresShell();
-  mPresShell = do_GetWeakReference(presShell);
+  mPresShell = do_GetWeakReference(presShell);      
 
   mStartFindRange = nullptr;
-  mStartPointRange = nullptr;
-  mSearchRange = nullptr;
-  mEndPointRange = nullptr;
+  mStartPointRange = new nsRange();
+  mSearchRange = new nsRange();
+  mEndPointRange = new nsRange();
 
   mFoundLink = nullptr;
   mFoundEditable = nullptr;
   mCurrentWindow = nullptr;
 
   mSelectionController = nullptr;
 
   mFind = nullptr;
@@ -359,20 +356,16 @@ nsTypeAheadFind::FindItNow(nsIPresShell 
                                     selectionController.get() : nullptr,
                                     aIsFirstVisiblePreferred,  aFindPrev,
                                     getter_AddRefs(presShell),
                                     getter_AddRefs(presContext)))) {
     return NS_ERROR_FAILURE;
   }
 
   int16_t rangeCompareResult = 0;
-  if (!mStartPointRange) {
-    mStartPointRange = new nsRange(presShell->GetDocument());
-  }
-
   mStartPointRange->CompareBoundaryPoints(nsIDOMRange::START_TO_START, mSearchRange, &rangeCompareResult);
   // No need to wrap find in doc if starting at beginning
   bool hasWrapped = (rangeCompareResult < 0);
 
   if (mTypeAheadBuffer.IsEmpty() || !EnsureFind())
     return NS_ERROR_FAILURE;
 
   mFind->SetFindBackwards(aFindPrev);
@@ -623,20 +616,16 @@ nsTypeAheadFind::FindItNow(nsIPresShell 
         continue;
       }
 
       if (aFindPrev) {
         // Reverse mode: swap start and end points, so that we start
         // at end of document and go to beginning
         nsCOMPtr<nsIDOMRange> tempRange;
         mStartPointRange->CloneRange(getter_AddRefs(tempRange));
-        if (!mEndPointRange) {
-          mEndPointRange = new nsRange(presShell->GetDocument());
-        }
-
         mStartPointRange = mEndPointRange;
         mEndPointRange = tempRange;
       }
 
       continue;
     }
 
     // ------------- Failed --------------
@@ -725,24 +714,16 @@ nsTypeAheadFind::GetSearchContainers(nsI
  
   nsCOMPtr<nsIDOMNode> rootNode(do_QueryInterface(rootContent));
 
   if (!rootNode)
     return NS_ERROR_FAILURE;
 
   uint32_t childCount = rootContent->GetChildCount();
 
-  if (!mSearchRange) {
-    mSearchRange = new nsRange(rootContent);
-  }
-
-  if (!mEndPointRange) {
-    mEndPointRange = new nsRange(rootContent);
-  }
-
   mSearchRange->SelectNodeContents(rootNode);
 
   mEndPointRange->SetEnd(rootNode, childCount);
   mEndPointRange->Collapse(false); // collapse to end
 
   // Consider current selection as null if
   // it's not in the currently focused document
   nsCOMPtr<nsIDOMRange> currentSelectionRange;
@@ -750,20 +731,16 @@ nsTypeAheadFind::GetSearchContainers(nsI
   if (aSelectionController && selectionPresShell && selectionPresShell == presShell) {
     nsCOMPtr<nsISelection> selection;
     aSelectionController->GetSelection(
       nsISelectionController::SELECTION_NORMAL, getter_AddRefs(selection));
     if (selection)
       selection->GetRangeAt(0, getter_AddRefs(currentSelectionRange));
   }
 
-  if (!mStartPointRange) {
-    mStartPointRange = new nsRange(doc);
-  }
-
   if (!currentSelectionRange) {
     // Ensure visible range, move forward if necessary
     // This uses ignores the return value, but usese the side effect of
     // IsRangeVisible. It returns the first visible range after searchRange
     IsRangeVisible(presShell, presContext, mSearchRange, 
                    aIsFirstVisiblePreferred, true, 
                    getter_AddRefs(mStartPointRange), nullptr);
   }