--- a/editor/libeditor/HTMLAbsPositionEditor.cpp
+++ b/editor/libeditor/HTMLAbsPositionEditor.cpp
@@ -265,17 +265,17 @@ HTMLEditor::RefreshGrabber()
       mPositionedObjectBorderLeft,
       mPositionedObjectBorderTop,
       mPositionedObjectMarginLeft,
       mPositionedObjectMarginTop);
   NS_ENSURE_SUCCESS(rv, rv);
 
   SetAnonymousElementPosition(mPositionedObjectX+12,
                               mPositionedObjectY-14,
-                              static_cast<nsIDOMElement*>(GetAsDOMNode(mGrabber)));
+                              mGrabber);
   return NS_OK;
 }
 
 NS_IMETHODIMP
 HTMLEditor::HideGrabber()
 {
   nsresult rv = mAbsolutelyPositionedObject->UnsetAttr(kNameSpaceID_None,
                                                        nsGkAtoms::_moz_abspos,
@@ -289,19 +289,19 @@ HTMLEditor::HideGrabber()
   nsCOMPtr<nsIPresShell> ps = GetPresShell();
   // We allow the pres shell to be null; when it is, we presume there
   // are no document observers to notify, but we still want to
   // UnbindFromTree.
 
   nsCOMPtr<nsIContent> parentContent = mGrabber->GetParent();
   NS_ENSURE_TRUE(parentContent, NS_ERROR_NULL_POINTER);
 
-  DeleteRefToAnonymousNode(static_cast<nsIDOMElement*>(GetAsDOMNode(mGrabber)), parentContent, ps);
+  DeleteRefToAnonymousNode(mGrabber, parentContent, ps);
   mGrabber = nullptr;
-  DeleteRefToAnonymousNode(static_cast<nsIDOMElement*>(GetAsDOMNode(mPositioningShadow)), parentContent, ps);
+  DeleteRefToAnonymousNode(mPositioningShadow, parentContent, ps);
   mPositioningShadow = nullptr;
 
   return NS_OK;
 }
 
 NS_IMETHODIMP
 HTMLEditor::ShowGrabberOnElement(nsIDOMElement* aElement)
 {
@@ -394,18 +394,17 @@ HTMLEditor::EndMoving()
 {
   if (mPositioningShadow) {
     nsCOMPtr<nsIPresShell> ps = GetPresShell();
     NS_ENSURE_TRUE(ps, NS_ERROR_NOT_INITIALIZED);
 
     nsCOMPtr<nsIContent> parentContent = mGrabber->GetParent();
     NS_ENSURE_TRUE(parentContent, NS_ERROR_FAILURE);
 
-    DeleteRefToAnonymousNode(static_cast<nsIDOMElement*>(GetAsDOMNode(mPositioningShadow)),
-                             parentContent, ps);
+    DeleteRefToAnonymousNode(mPositioningShadow, parentContent, ps);
 
     mPositioningShadow = nullptr;
   }
   nsCOMPtr<nsIDOMEventTarget> piTarget = GetDOMEventTarget();
 
   if (piTarget && mMouseMotionListenerP) {
     DebugOnly<nsresult> rv =
       piTarget->RemoveEventListener(NS_LITERAL_STRING("mousemove"),

--- a/editor/libeditor/HTMLAnonymousNodeEditor.cpp
+++ b/editor/libeditor/HTMLAnonymousNodeEditor.cpp
@@ -281,61 +281,60 @@ HTMLEditor::RemoveListenerAndDeleteRef(c
                                        Element* aElement,
                                        nsIContent* aParentContent,
                                        nsIPresShell* aShell)
 {
   nsCOMPtr<nsIDOMEventTarget> evtTarget(do_QueryInterface(aElement));
   if (evtTarget) {
     evtTarget->RemoveEventListener(aEvent, aListener, aUseCapture);
   }
-  DeleteRefToAnonymousNode(static_cast<nsIDOMElement*>(GetAsDOMNode(aElement)), aParentContent, aShell);
+  DeleteRefToAnonymousNode(aElement, aParentContent, aShell);
 }
 
 // Deletes all references to an anonymous element
 void
-HTMLEditor::DeleteRefToAnonymousNode(nsIDOMElement* aElement,
+HTMLEditor::DeleteRefToAnonymousNode(nsIContent* aContent,
                                      nsIContent* aParentContent,
                                      nsIPresShell* aShell)
 {
   // call ContentRemoved() for the anonymous content
   // node so its references get removed from the frame manager's
   // undisplay map, and its layout frames get destroyed!
 
-  if (aElement) {
-    nsCOMPtr<nsIContent> content = do_QueryInterface(aElement);
-    if (content) {
-      nsAutoScriptBlocker scriptBlocker;
-      // Need to check whether aShell has been destroyed (but not yet deleted).
-      // In that case presContext->GetPresShell() returns nullptr.
-      // See bug 338129.
-      if (content->IsInComposedDoc() && aShell && aShell->GetPresContext() &&
-          aShell->GetPresContext()->GetPresShell() == aShell) {
-        nsCOMPtr<nsIDocumentObserver> docObserver = do_QueryInterface(aShell);
-        if (docObserver) {
-          // Call BeginUpdate() so that the nsCSSFrameConstructor/PresShell
-          // knows we're messing with the frame tree.
-          nsCOMPtr<nsIDocument> document = GetDocument();
-          if (document) {
-            docObserver->BeginUpdate(document, UPDATE_CONTENT_MODEL);
-          }
+  if (NS_WARN_IF(!aContent)) {
+    return;
+  }
 
-          // XXX This is wrong (bug 439258).  Once it's fixed, the NS_WARNING
-          // in RestyleManager::RestyleForRemove should be changed back
-          // to an assertion.
-          docObserver->ContentRemoved(content->GetComposedDoc(),
-                                      aParentContent, content, -1,
-                                      content->GetPreviousSibling());
-          if (document) {
-            docObserver->EndUpdate(document, UPDATE_CONTENT_MODEL);
-          }
-        }
+  nsAutoScriptBlocker scriptBlocker;
+  // Need to check whether aShell has been destroyed (but not yet deleted).
+  // In that case presContext->GetPresShell() returns nullptr.
+  // See bug 338129.
+  if (aContent->IsInComposedDoc() && aShell && aShell->GetPresContext() &&
+      aShell->GetPresContext()->GetPresShell() == aShell) {
+    nsCOMPtr<nsIDocumentObserver> docObserver = do_QueryInterface(aShell);
+    if (docObserver) {
+      // Call BeginUpdate() so that the nsCSSFrameConstructor/PresShell
+      // knows we're messing with the frame tree.
+      nsCOMPtr<nsIDocument> document = GetDocument();
+      if (document) {
+        docObserver->BeginUpdate(document, UPDATE_CONTENT_MODEL);
       }
-      content->UnbindFromTree();
+
+      // XXX This is wrong (bug 439258).  Once it's fixed, the NS_WARNING
+      // in RestyleManager::RestyleForRemove should be changed back
+      // to an assertion.
+      docObserver->ContentRemoved(aContent->GetComposedDoc(),
+                                  aParentContent, aContent, -1,
+                                  aContent->GetPreviousSibling());
+      if (document) {
+        docObserver->EndUpdate(document, UPDATE_CONTENT_MODEL);
+      }
     }
   }
+  aContent->UnbindFromTree();
 }
 
 // The following method is mostly called by a selection listener. When a
 // selection change is notified, the method is called to check if resizing
 // handles, a grabber and/or inline table editing UI need to be displayed
 // or refreshed
 NS_IMETHODIMP
 HTMLEditor::CheckSelectionStateForAnonymousButtons(nsISelection* aSelection)
@@ -564,15 +563,15 @@ HTMLEditor::GetPositionAndDimensions(nsI
   }
   return NS_OK;
 }
 
 // self-explanatory
 void
 HTMLEditor::SetAnonymousElementPosition(int32_t aX,
                                         int32_t aY,
-                                        nsIDOMElement* aElement)
+                                        Element* aElement)
 {
-  mCSSEditUtils->SetCSSPropertyPixels(aElement, NS_LITERAL_STRING("left"), aX);
-  mCSSEditUtils->SetCSSPropertyPixels(aElement, NS_LITERAL_STRING("top"), aY);
+  mCSSEditUtils->SetCSSPropertyPixels(*aElement, *nsGkAtoms::left, aX);
+  mCSSEditUtils->SetCSSPropertyPixels(*aElement, *nsGkAtoms::top, aY);
 }
 
 } // namespace mozilla

--- a/editor/libeditor/HTMLEditor.h
+++ b/editor/libeditor/HTMLEditor.h
@@ -916,17 +916,17 @@ protected:
 protected:
   // ANONYMOUS UTILS
   void RemoveListenerAndDeleteRef(const nsAString& aEvent,
                                   nsIDOMEventListener* aListener,
                                   bool aUseCapture,
                                   Element* aElement,
                                   nsIContent* aParentContent,
                                   nsIPresShell* aShell);
-  void DeleteRefToAnonymousNode(nsIDOMElement* aElement,
+  void DeleteRefToAnonymousNode(nsIContent* aContent,
                                 nsIContent* aParentContent,
                                 nsIPresShell* aShell);
 
   nsresult ShowResizersInner(nsIDOMElement *aResizedElement);
 
   /**
    * Returns the offset of an element's frame to its absolute containing block.
    */
@@ -1002,17 +1002,17 @@ protected:
   int8_t  mInfoXIncrement;
   int8_t  mInfoYIncrement;
 
   nsresult SetAllResizersPosition();
 
   already_AddRefed<Element> CreateResizer(int16_t aLocation,
                                           nsIDOMNode* aParentNode);
   void SetAnonymousElementPosition(int32_t aX, int32_t aY,
-                                   nsIDOMElement* aResizer);
+                                   Element* aResizer);
 
   already_AddRefed<Element> CreateShadow(nsIDOMNode* aParentNode,
                                          nsIDOMElement* aOriginalObject);
   nsresult SetShadowPosition(Element* aShadow, Element* aOriginalObject,
                              int32_t aOriginalObjectX,
                              int32_t aOriginalObjectY);
 
   already_AddRefed<Element> CreateResizingInfo(nsIDOMNode* aParentNode);
@@ -1057,26 +1057,26 @@ protected:
   nsresult GrabberClicked();
   nsresult EndMoving();
   nsresult CheckPositionedElementBGandFG(nsIDOMElement* aElement,
                                          nsAString& aReturn);
 
   // inline table editing
   nsCOMPtr<nsIDOMElement> mInlineEditedCell;
 
-  nsCOMPtr<nsIDOMElement> mAddColumnBeforeButton;
-  nsCOMPtr<nsIDOMElement> mRemoveColumnButton;
-  nsCOMPtr<nsIDOMElement> mAddColumnAfterButton;
+  RefPtr<Element> mAddColumnBeforeButton;
+  RefPtr<Element> mRemoveColumnButton;
+  RefPtr<Element> mAddColumnAfterButton;
 
-  nsCOMPtr<nsIDOMElement> mAddRowBeforeButton;
-  nsCOMPtr<nsIDOMElement> mRemoveRowButton;
-  nsCOMPtr<nsIDOMElement> mAddRowAfterButton;
+  RefPtr<Element> mAddRowBeforeButton;
+  RefPtr<Element> mRemoveRowButton;
+  RefPtr<Element> mAddRowAfterButton;
 
-  void AddMouseClickListener(nsIDOMElement* aElement);
-  void RemoveMouseClickListener(nsIDOMElement* aElement);
+  void AddMouseClickListener(Element* aElement);
+  void RemoveMouseClickListener(Element* aElement);
 
   nsCOMPtr<nsILinkHandler> mLinkHandler;
 
 public:
   friend class HTMLEditorEventListener;
   friend class HTMLEditRules;
   friend class TextEditRules;
   friend class WSRunObject;

--- a/editor/libeditor/HTMLEditorObjectResizer.cpp
+++ b/editor/libeditor/HTMLEditorObjectResizer.cpp
@@ -236,26 +236,26 @@ HTMLEditor::SetAllResizersPosition()
   mCSSEditUtils->ParseLength(value, &resizerWidth, getter_AddRefs(dummyUnit));
   mCSSEditUtils->GetComputedProperty(*mTopLeftHandle, *nsGkAtoms::height,
                                      value);
   mCSSEditUtils->ParseLength(value, &resizerHeight, getter_AddRefs(dummyUnit));
 
   int32_t rw  = (int32_t)((resizerWidth + 1) / 2);
   int32_t rh =  (int32_t)((resizerHeight+ 1) / 2);
 
-  SetAnonymousElementPosition(x-rw,     y-rh, static_cast<nsIDOMElement*>(GetAsDOMNode(mTopLeftHandle)));
-  SetAnonymousElementPosition(x+w/2-rw, y-rh, static_cast<nsIDOMElement*>(GetAsDOMNode(mTopHandle)));
-  SetAnonymousElementPosition(x+w-rw-1, y-rh, static_cast<nsIDOMElement*>(GetAsDOMNode(mTopRightHandle)));
+  SetAnonymousElementPosition(x-rw,     y-rh, mTopLeftHandle);
+  SetAnonymousElementPosition(x+w/2-rw, y-rh, mTopHandle);
+  SetAnonymousElementPosition(x+w-rw-1, y-rh, mTopRightHandle);
 
-  SetAnonymousElementPosition(x-rw,     y+h/2-rh, static_cast<nsIDOMElement*>(GetAsDOMNode(mLeftHandle)));
-  SetAnonymousElementPosition(x+w-rw-1, y+h/2-rh, static_cast<nsIDOMElement*>(GetAsDOMNode(mRightHandle)));
+  SetAnonymousElementPosition(x-rw,     y+h/2-rh, mLeftHandle);
+  SetAnonymousElementPosition(x+w-rw-1, y+h/2-rh, mRightHandle);
 
-  SetAnonymousElementPosition(x-rw,     y+h-rh-1, static_cast<nsIDOMElement*>(GetAsDOMNode(mBottomLeftHandle)));
-  SetAnonymousElementPosition(x+w/2-rw, y+h-rh-1, static_cast<nsIDOMElement*>(GetAsDOMNode(mBottomHandle)));
-  SetAnonymousElementPosition(x+w-rw-1, y+h-rh-1, static_cast<nsIDOMElement*>(GetAsDOMNode(mBottomRightHandle)));
+  SetAnonymousElementPosition(x-rw,     y+h-rh-1, mBottomLeftHandle);
+  SetAnonymousElementPosition(x+w/2-rw, y+h-rh-1, mBottomHandle);
+  SetAnonymousElementPosition(x+w-rw-1, y+h-rh-1, mBottomRightHandle);
 
   return NS_OK;
 }
 
 NS_IMETHODIMP
 HTMLEditor::RefreshResizers()
 {
   // nothing to do if resizers are not displayed...
@@ -713,17 +713,17 @@ HTMLEditor::SetResizingInfoPosition(int3
 }
 
 nsresult
 HTMLEditor::SetShadowPosition(Element* aShadow,
                               Element* aOriginalObject,
                               int32_t aOriginalObjectX,
                               int32_t aOriginalObjectY)
 {
-  SetAnonymousElementPosition(aOriginalObjectX, aOriginalObjectY, static_cast<nsIDOMElement*>(GetAsDOMNode(aShadow)));
+  SetAnonymousElementPosition(aOriginalObjectX, aOriginalObjectY, aShadow);
 
   if (HTMLEditUtils::IsImage(aOriginalObject)) {
     nsAutoString imageSource;
     aOriginalObject->GetAttr(kNameSpaceID_None, nsGkAtoms::src, imageSource);
     nsresult rv = aShadow->SetAttr(kNameSpaceID_None, nsGkAtoms::src,
                                    imageSource, true);
     NS_ENSURE_SUCCESS(rv, rv);
   }

--- a/editor/libeditor/HTMLInlineTableEditor.cpp
+++ b/editor/libeditor/HTMLInlineTableEditor.cpp
@@ -56,35 +56,35 @@ HTMLEditor::ShowInlineTableEditingUI(nsI
     NS_ERROR("call HideInlineTableEditingUI first");
     return NS_ERROR_UNEXPECTED;
   }
 
   // the resizers and the shadow will be anonymous children of the body
   nsCOMPtr<nsIDOMElement> bodyElement = do_QueryInterface(GetRoot());
   NS_ENSURE_TRUE(bodyElement, NS_ERROR_NULL_POINTER);
 
-  CreateAnonymousElement(NS_LITERAL_STRING("a"), bodyElement,
-                         NS_LITERAL_STRING("mozTableAddColumnBefore"),
-                         false, getter_AddRefs(mAddColumnBeforeButton));
-  CreateAnonymousElement(NS_LITERAL_STRING("a"), bodyElement,
-                         NS_LITERAL_STRING("mozTableRemoveColumn"),
-                         false, getter_AddRefs(mRemoveColumnButton));
-  CreateAnonymousElement(NS_LITERAL_STRING("a"), bodyElement,
-                         NS_LITERAL_STRING("mozTableAddColumnAfter"),
-                         false, getter_AddRefs(mAddColumnAfterButton));
+  mAddColumnBeforeButton =
+    CreateAnonymousElement(nsGkAtoms::a, bodyElement,
+                           NS_LITERAL_STRING("mozTableAddColumnBefore"), false);
+  mRemoveColumnButton =
+    CreateAnonymousElement(nsGkAtoms::a, bodyElement,
+                           NS_LITERAL_STRING("mozTableRemoveColumn"), false);
+  mAddColumnAfterButton =
+    CreateAnonymousElement(nsGkAtoms::a, bodyElement,
+                           NS_LITERAL_STRING("mozTableAddColumnAfter"), false);
 
-  CreateAnonymousElement(NS_LITERAL_STRING("a"), bodyElement,
-                         NS_LITERAL_STRING("mozTableAddRowBefore"),
-                         false, getter_AddRefs(mAddRowBeforeButton));
-  CreateAnonymousElement(NS_LITERAL_STRING("a"), bodyElement,
-                         NS_LITERAL_STRING("mozTableRemoveRow"),
-                         false, getter_AddRefs(mRemoveRowButton));
-  CreateAnonymousElement(NS_LITERAL_STRING("a"), bodyElement,
-                         NS_LITERAL_STRING("mozTableAddRowAfter"),
-                         false, getter_AddRefs(mAddRowAfterButton));
+  mAddRowBeforeButton =
+    CreateAnonymousElement(nsGkAtoms::a, bodyElement,
+                           NS_LITERAL_STRING("mozTableAddRowBefore"), false);
+  mRemoveRowButton =
+    CreateAnonymousElement(nsGkAtoms::a, bodyElement,
+                           NS_LITERAL_STRING("mozTableRemoveRow"), false);
+  mAddRowAfterButton =
+    CreateAnonymousElement(nsGkAtoms::a, bodyElement,
+                           NS_LITERAL_STRING("mozTableAddRowAfter"), false);
 
   AddMouseClickListener(mAddColumnBeforeButton);
   AddMouseClickListener(mRemoveColumnButton);
   AddMouseClickListener(mAddColumnAfterButton);
   AddMouseClickListener(mAddRowBeforeButton);
   AddMouseClickListener(mRemoveRowButton);
   AddMouseClickListener(mAddRowAfterButton);
 
@@ -183,27 +183,27 @@ HTMLEditor::DoInlineTableEditingAction(n
         HideResizers();
     }
   }
 
   return NS_OK;
 }
 
 void
-HTMLEditor::AddMouseClickListener(nsIDOMElement* aElement)
+HTMLEditor::AddMouseClickListener(Element* aElement)
 {
   nsCOMPtr<nsIDOMEventTarget> evtTarget(do_QueryInterface(aElement));
   if (evtTarget) {
     evtTarget->AddEventListener(NS_LITERAL_STRING("click"),
                                 mEventListener, true);
   }
 }
 
 void
-HTMLEditor::RemoveMouseClickListener(nsIDOMElement* aElement)
+HTMLEditor::RemoveMouseClickListener(Element* aElement)
 {
   nsCOMPtr<nsIDOMEventTarget> evtTarget(do_QueryInterface(aElement));
   if (evtTarget) {
     evtTarget->RemoveEventListener(NS_LITERAL_STRING("click"),
                                    mEventListener, true);
   }
 }
 
@@ -229,46 +229,38 @@ HTMLEditor::RefreshInlineTableEditingUI(
   nsCOMPtr<nsIDOMNode> tableNode = GetEnclosingTable(mInlineEditedCell);
   nsCOMPtr<nsIDOMElement> tableElement = do_QueryInterface(tableNode);
   int32_t rowCount, colCount;
   rv = GetTableSize(tableElement, &rowCount, &colCount);
   NS_ENSURE_SUCCESS(rv, rv);
 
   SetAnonymousElementPosition(xHoriz-10, yCell-7,  mAddColumnBeforeButton);
 #ifdef DISABLE_TABLE_DELETION
-  NS_NAMED_LITERAL_STRING(classStr, "class");
-
   if (colCount== 1) {
-    mRemoveColumnButton->SetAttribute(classStr,
-                                      NS_LITERAL_STRING("hidden"));
-  }
-  else {
-    bool hasClass = false;
-    rv = mRemoveColumnButton->HasAttribute(classStr, &hasClass);
-    if (NS_SUCCEEDED(rv) && hasClass) {
-      mRemoveColumnButton->RemoveAttribute(classStr);
+    mRemoveColumnButton->SetAttr(kNameSpaceID_None, nsGkAtoms::_class,
+                                 NS_LITERAL_STRING("hidden"), true);
+  } else {
+    if (mRemoveColumnButton->HasAttr(kNameSpaceID_None, nsGkAtoms::_class)) {
+      mRemoveColumnButton->UnsetAttr(kNameSpaceID_None, nsGkAtoms::_class);
     }
 #endif
     SetAnonymousElementPosition(xHoriz-4, yCell-7,  mRemoveColumnButton);
 #ifdef DISABLE_TABLE_DELETION
   }
 #endif
   SetAnonymousElementPosition(xHoriz+6, yCell-7,  mAddColumnAfterButton);
 
   SetAnonymousElementPosition(xCell-7, yVert-10,  mAddRowBeforeButton);
 #ifdef DISABLE_TABLE_DELETION
   if (rowCount== 1) {
-    mRemoveRowButton->SetAttribute(classStr,
-                                   NS_LITERAL_STRING("hidden"));
-  }
-  else {
-    bool hasClass = false;
-    rv = mRemoveRowButton->HasAttribute(classStr, &hasClass);
-    if (NS_SUCCEEDED(rv) && hasClass) {
-      mRemoveRowButton->RemoveAttribute(classStr);
+    mRemoveRowButton->SetAttr(kNameSpaceID_None, nsGkAtoms::_class,
+                              NS_LITERAL_STRING("hidden"), true);
+  } else {
+    if (mRemoveRowButton->HasAttr(kNameSpaceID_None, nsGkAtoms::_class)) {
+      mRemoveRowButton->UnsetAttr(kNameSpaceID_None, nsGkAtoms::_class, true);
     }
 #endif
     SetAnonymousElementPosition(xCell-7, yVert-4,  mRemoveRowButton);
 #ifdef DISABLE_TABLE_DELETION
   }
 #endif
   SetAnonymousElementPosition(xCell-7, yVert+6,  mAddRowAfterButton);