Merge with TraceMonkey
authorLuke Wagner <lw@mozilla.com>
Wed, 09 Jun 2010 21:59:18 -0700
changeset 52795 a17abc6472007a9f0595101428c7fe6270e867b9
parent 52764 2081625fcdd4b8ead668484e8df3d0e25c96cfb2 (current diff)
parent 47409 130b4376a8420d3fbe00e82ac242b8faf056d3ff (diff)
child 52796 df628a955f27c810cfcdc807a22a52204bfdc0f8
push idunknown
push userunknown
push dateunknown
milestone1.9.3a5pre
Merge with TraceMonkey
accessible/tests/mochitest/test_relations.html
accessible/tests/mochitest/test_relations.xul
accessible/tests/mochitest/test_relations_tree.xul
accessible/tests/mochitest/test_table_1.html
accessible/tests/mochitest/test_table_4.html
accessible/tests/mochitest/test_table_headers.html
accessible/tests/mochitest/test_table_headers_ariagrid.html
accessible/tests/mochitest/test_table_headers_listbox.xul
accessible/tests/mochitest/test_table_headers_tree.xul
accessible/tests/mochitest/test_table_indexes.html
accessible/tests/mochitest/test_table_indexes_ariagrid.html
accessible/tests/mochitest/test_table_indexes_listbox.xul
accessible/tests/mochitest/test_table_indexes_tree.xul
accessible/tests/mochitest/test_table_layoutguess.html
accessible/tests/mochitest/test_table_sels.html
accessible/tests/mochitest/test_table_sels_ariagrid.html
accessible/tests/mochitest/test_table_sels_listbox.xul
accessible/tests/mochitest/test_table_sels_tree.xul
accessible/tests/mochitest/test_table_struct.html
accessible/tests/mochitest/test_table_struct_ariagrid.html
accessible/tests/mochitest/test_table_struct_ariatreegrid.html
accessible/tests/mochitest/test_table_struct_listbox.xul
accessible/tests/mochitest/test_table_struct_tree.xul
browser/components/places/content/toolbar.xml
browser/fuel/test/browser_Extensions.js
caps/src/nsScriptSecurityManager.cpp
content/base/public/nsContentUtils.h
content/base/src/nsContentUtils.cpp
content/canvas/public/WebGLArray.h
content/canvas/public/nsICanvasElement.h
content/canvas/src/CustomQS_WebGL.h
content/canvas/src/NativeJSContext.cpp
content/canvas/src/NativeJSContext.h
content/canvas/src/glwrap.cpp
content/canvas/src/glwrap.h
content/canvas/src/localgl.h
content/canvas/src/nsGLPbuffer.cpp
content/canvas/src/nsGLPbuffer.h
content/canvas/src/nsGLPbufferCGL.cpp
content/canvas/src/nsGLPbufferEGL.cpp
content/canvas/src/nsGLPbufferGLX.cpp
content/canvas/src/nsGLPbufferOSMesa.cpp
content/canvas/src/nsGLPbufferWGL.cpp
content/html/content/public/nsIFormSubmission.h
content/media/ogg/nsOggPlayStateMachine.cpp
content/media/ogg/nsOggPlayStateMachine.h
content/media/test/320x240.allow-origin.ogv
content/media/test/320x240.allow-origin.ogv^headers^
content/media/test/test_bug468190.html
content/media/test/test_bug468190_wav.html
content/media/test/test_bug476973.html
content/media/test/test_bug486646.html
content/media/test/test_bug495145_wav.html
content/media/test/test_bug495319.html
content/media/test/test_duration1.html
content/media/test/test_ended1.html
content/media/test/test_ended2.html
content/media/test/test_onloadedmetadata.html
content/media/test/test_play.html
content/media/test/test_progress1.html
content/media/test/test_progress2.html
content/media/test/test_progress3.html
content/media/test/test_progress4.html
content/media/test/test_timeupdate1.html
content/media/test/test_timeupdate2.html
content/media/test/test_wav_onloadedmetadata.html
content/media/test/test_wav_standalone.html
content/media/test/test_wav_timeupdate1.html
content/media/test/test_wav_timeupdate2.html
content/media/test/test_wav_trunc_seek.html
docshell/base/nsIChannelClassifier.idl
docshell/base/nsIURIClassifier.idl
dom/base/nsDOMClassInfo.cpp
dom/base/nsJSEnvironment.cpp
dom/plugins/PluginThreadChild.cpp
dom/plugins/PluginThreadChild.h
embedding/components/windowwatcher/public/nsINonBlockingAlertService.idl
extensions/cookie/test/unit/test_cookies.js
extensions/layout-debug/Makefile.in
extensions/layout-debug/application.ini
extensions/layout-debug/chrome.manifest
extensions/layout-debug/layoutdebug-prefs.js
extensions/layout-debug/makefiles.sh
extensions/layout-debug/src/Makefile.in
extensions/layout-debug/src/nsDebugFactory.cpp
extensions/layout-debug/src/nsILayoutDebuggingTools.idl
extensions/layout-debug/src/nsILayoutRegressionTester.idl
extensions/layout-debug/src/nsLayoutDebugCIID.h
extensions/layout-debug/src/nsLayoutDebugCLH.cpp
extensions/layout-debug/src/nsLayoutDebugCLH.h
extensions/layout-debug/src/nsLayoutDebuggingTools.cpp
extensions/layout-debug/src/nsLayoutDebuggingTools.h
extensions/layout-debug/src/nsRegressionTester.cpp
extensions/layout-debug/src/nsRegressionTester.h
extensions/layout-debug/ui/Makefile.in
extensions/layout-debug/ui/content/layoutdebug-overlay.xul
extensions/layout-debug/ui/content/layoutdebug.js
extensions/layout-debug/ui/content/layoutdebug.xul
extensions/layout-debug/ui/jar.mn
extensions/layout-debug/ui/locale/en-US/layoutdebug-overlay.dtd
extensions/layout-debug/ui/locale/en-US/layoutdebug.dtd
gfx/cairo/libpixman/src/pixman-arm-neon.h
gfx/cairo/libpixman/src/pixman-arm-simd-asm.c
gfx/cairo/libpixman/src/pixman-arm-simd-asm.h
gfx/cairo/libpixman/src/pixman-arm-simd.h
gfx/cairo/libpixman/src/pixman-compose-accessors.c
gfx/cairo/libpixman/src/pixman-compose.c
gfx/cairo/libpixman/src/pixman-compute-region.c
gfx/cairo/libpixman/src/pixman-mmx.h
gfx/cairo/libpixman/src/pixman-pict.c
gfx/cairo/libpixman/src/pixman-source.c
gfx/cairo/libpixman/src/pixman-sse2.h
gfx/cairo/libpixman/src/pixman-transformed-accessors.c
gfx/cairo/libpixman/src/pixman-transformed.c
gfx/cairo/libpixman/src/pixman-vmx.h
gfx/cairo/libpixman/src/pixman-wce-arm-simd.asm
gfx/layers/opengl/LayerManagerOGLShaders.h
intl/uconv/src/nsGREResProperties.cpp
intl/uconv/src/nsGREResProperties.h
intl/uconv/src/unixcharset.sample.properties
ipc/app/fake/Makefile.in
ipc/app/fake/mozilla-runtime.cpp
ipc/glue/MozillaChildThread.cpp
ipc/glue/MozillaChildThread.h
ipc/ipdl/test/cxx/IPDLUnitTestThreadChild.cpp
ipc/ipdl/test/cxx/IPDLUnitTestThreadChild.h
ipc/ipdl/test/cxx/PTestArrays.ipdl
ipc/ipdl/test/cxx/PTestArraysSub.ipdl
ipc/ipdl/test/cxx/TestArrays.cpp
ipc/ipdl/test/cxx/TestArrays.h
js/jsd/jsd.h
js/jsd/jsd_val.c
js/src/config/rules.mk
js/src/ctypes/CTypes.cpp
js/src/imacro_asm.js.in
js/src/imacros.c.out
js/src/jsapi-tests/testIsAboutToBeFinalized.cpp
js/src/jsapi-tests/tests.h
js/src/jsapi.cpp
js/src/jsapi.h
js/src/jsarray.cpp
js/src/jsarray.h
js/src/jsatom.cpp
js/src/jsatom.h
js/src/jsbuiltins.cpp
js/src/jsbuiltins.h
js/src/jscntxt.cpp
js/src/jscntxt.h
js/src/jscntxtinlines.h
js/src/jsdate.cpp
js/src/jsdbgapi.cpp
js/src/jsdbgapi.h
js/src/jsemit.cpp
js/src/jsemit.h
js/src/jsexn.cpp
js/src/jsfun.cpp
js/src/jsfun.h
js/src/jsgc.cpp
js/src/jsgc.h
js/src/jsgcchunk.cpp
js/src/jsgcchunk.h
js/src/jshashtable.h
js/src/jsinterp.cpp
js/src/jsinterp.h
js/src/jsiter.cpp
js/src/jsiter.h
js/src/jslock.cpp
js/src/jslock.h
js/src/jsobj.cpp
js/src/jsobj.h
js/src/jsobjinlines.h
js/src/json.cpp
js/src/jsopcode.cpp
js/src/jsopcode.h
js/src/jsops.cpp
js/src/jsparse.cpp
js/src/jsparse.h
js/src/jspropertytree.cpp
js/src/jsproxy.cpp
js/src/jsproxy.h
js/src/jsprvtd.h
js/src/jspubtd.h
js/src/jsrecursion.cpp
js/src/jsregexp.cpp
js/src/jsregexp.h
js/src/jsscan.cpp
js/src/jsscope.cpp
js/src/jsscope.h
js/src/jsscopeinlines.h
js/src/jsscript.cpp
js/src/jsscript.h
js/src/jsstr.cpp
js/src/jsstr.h
js/src/jstl.h
js/src/jstracer.cpp
js/src/jstypedarray.cpp
js/src/jstypedarray.h
js/src/jstypes.h
js/src/jsutil.cpp
js/src/jswrapper.cpp
js/src/jswrapper.h
js/src/jsxdrapi.cpp
js/src/jsxdrapi.h
js/src/jsxml.cpp
js/src/jsxml.h
js/src/shell/js.cpp
js/src/shell/jsworkers.cpp
js/src/tests/jstests.py
js/src/xpconnect/loader/mozJSComponentLoader.cpp
js/src/xpconnect/src/XPCChromeObjectWrapper.cpp
js/src/xpconnect/src/XPCCrossOriginWrapper.cpp
js/src/xpconnect/src/XPCDispObject.cpp
js/src/xpconnect/src/XPCDispTearOff.cpp
js/src/xpconnect/src/XPCNativeWrapper.cpp
js/src/xpconnect/src/XPCNativeWrapper.h
js/src/xpconnect/src/XPCSafeJSObjectWrapper.cpp
js/src/xpconnect/src/XPCSystemOnlyWrapper.cpp
js/src/xpconnect/src/XPCWrapper.cpp
js/src/xpconnect/src/XPCWrapper.h
js/src/xpconnect/src/nsXPConnect.cpp
js/src/xpconnect/src/qsgen.py
js/src/xpconnect/src/xpccomponents.cpp
js/src/xpconnect/src/xpcinlines.h
js/src/xpconnect/src/xpcprivate.h
js/src/xpconnect/src/xpcquickstubs.cpp
js/src/xpconnect/src/xpcquickstubs.h
js/src/xpconnect/src/xpcwrappedjsclass.cpp
js/src/xpconnect/src/xpcwrappednative.cpp
js/src/xpconnect/src/xpcwrappednativejsops.cpp
js/src/xpconnect/tools/Makefile.in
js/src/xpconnect/tools/idl/Makefile.in
js/src/xpconnect/tools/idl/nsIXPCToolsCompiler.idl
js/src/xpconnect/tools/idl/nsIXPCToolsProfiler.idl
js/src/xpconnect/tools/js/CompileJSFiles.js
js/src/xpconnect/tools/js/ListJSFiles.js
js/src/xpconnect/tools/src/Makefile.in
js/src/xpconnect/tools/src/nsXPCToolsCompiler.cpp
js/src/xpconnect/tools/src/nsXPCToolsModule.cpp
js/src/xpconnect/tools/src/nsXPCToolsProfiler.cpp
js/src/xpconnect/tools/src/xpctools_private.h
layout/reftests/box-shadow/boxshadow-inner-basic-ref.html
layout/style/nsICSSStyleSheet.h
memory/jemalloc/crtvc8sp1.diff
memory/jemalloc/crtvc9sp1.diff
modules/plugin/base/public/nsDefaultPlugin.h
modules/plugin/base/src/nsJSNPRuntime.cpp
modules/plugin/default/mac/DefaultPlugin.mm
modules/plugin/default/mac/DefaultPlugin.xcodeproj/TemplateIcon.tiff
modules/plugin/default/mac/DefaultPlugin.xcodeproj/project.pbxproj
modules/plugin/default/mac/English.lproj/InfoPlist.strings
modules/plugin/default/mac/Info.plist
modules/plugin/default/mac/Makefile.in
modules/plugin/default/mac/plugin.png
modules/plugin/default/os2/Makefile.in
modules/plugin/default/os2/dbg.cpp
modules/plugin/default/os2/dbg.h
modules/plugin/default/os2/dialogs.cpp
modules/plugin/default/os2/dialogs.h
modules/plugin/default/os2/maindll.cpp
modules/plugin/default/os2/npnulos2.h
modules/plugin/default/os2/npnulos2.ico
modules/plugin/default/os2/npnulos2.rc
modules/plugin/default/os2/npos2.cpp
modules/plugin/default/os2/npshell.cpp
modules/plugin/default/os2/plugin.cpp
modules/plugin/default/os2/plugin.h
modules/plugin/default/os2/utils.cpp
modules/plugin/default/os2/utils.h
modules/plugin/default/unix/Makefile.in
modules/plugin/default/unix/npshell.c
modules/plugin/default/unix/npunix.c
modules/plugin/default/unix/nullplugin.c
modules/plugin/default/unix/nullplugin.h
modules/plugin/default/windows/Makefile.in
modules/plugin/default/windows/Npnul32.dsp
modules/plugin/default/windows/dbg.cpp
modules/plugin/default/windows/dbg.h
modules/plugin/default/windows/dialogs.cpp
modules/plugin/default/windows/dialogs.h
modules/plugin/default/windows/maindll.cpp
modules/plugin/default/windows/npnul32.def
modules/plugin/default/windows/npnul32.dsw
modules/plugin/default/windows/npnul32.rc
modules/plugin/default/windows/npshell.cpp
modules/plugin/default/windows/npwin.cpp
modules/plugin/default/windows/plugicon.ico
modules/plugin/default/windows/plugin.cpp
modules/plugin/default/windows/plugin.h
modules/plugin/default/windows/resource.h
modules/plugin/default/windows/utils.cpp
modules/plugin/default/windows/utils.h
netwerk/cache/public/Makefile.in
netwerk/cache/public/nsICache.idl
netwerk/cache/public/nsICacheEntryDescriptor.idl
netwerk/cache/public/nsICacheListener.idl
netwerk/cache/public/nsICacheService.idl
netwerk/cache/public/nsICacheSession.idl
netwerk/cache/public/nsICacheVisitor.idl
netwerk/cache/src/Makefile.in
netwerk/cache/src/nsCache.cpp
netwerk/cache/src/nsCache.h
netwerk/cache/src/nsCacheDevice.h
netwerk/cache/src/nsCacheEntry.cpp
netwerk/cache/src/nsCacheEntry.h
netwerk/cache/src/nsCacheEntryDescriptor.cpp
netwerk/cache/src/nsCacheEntryDescriptor.h
netwerk/cache/src/nsCacheMetaData.cpp
netwerk/cache/src/nsCacheMetaData.h
netwerk/cache/src/nsCacheRequest.h
netwerk/cache/src/nsCacheService.cpp
netwerk/cache/src/nsCacheService.h
netwerk/cache/src/nsCacheSession.cpp
netwerk/cache/src/nsCacheSession.h
netwerk/cache/src/nsDeleteDir.cpp
netwerk/cache/src/nsDeleteDir.h
netwerk/cache/src/nsDiskCache.h
netwerk/cache/src/nsDiskCacheBinding.cpp
netwerk/cache/src/nsDiskCacheBinding.h
netwerk/cache/src/nsDiskCacheBlockFile.cpp
netwerk/cache/src/nsDiskCacheBlockFile.h
netwerk/cache/src/nsDiskCacheDevice.cpp
netwerk/cache/src/nsDiskCacheDevice.h
netwerk/cache/src/nsDiskCacheDeviceSQL.cpp
netwerk/cache/src/nsDiskCacheDeviceSQL.h
netwerk/cache/src/nsDiskCacheEntry.cpp
netwerk/cache/src/nsDiskCacheEntry.h
netwerk/cache/src/nsDiskCacheMap.cpp
netwerk/cache/src/nsDiskCacheMap.h
netwerk/cache/src/nsDiskCacheStreams.cpp
netwerk/cache/src/nsDiskCacheStreams.h
netwerk/cache/src/nsMemoryCacheDevice.cpp
netwerk/cache/src/nsMemoryCacheDevice.h
netwerk/cookie/public/Makefile.in
netwerk/cookie/public/nsICookie.idl
netwerk/cookie/public/nsICookie2.idl
netwerk/cookie/public/nsICookieManager.idl
netwerk/cookie/public/nsICookieManager2.idl
netwerk/cookie/public/nsICookiePermission.idl
netwerk/cookie/public/nsICookieService.idl
netwerk/cookie/src/Makefile.in
netwerk/cookie/src/nsCookie.cpp
netwerk/cookie/src/nsCookie.h
netwerk/cookie/src/nsCookieService.cpp
netwerk/cookie/src/nsCookieService.h
netwerk/dns/public/Makefile.in
netwerk/dns/public/nsIDNSListener.idl
netwerk/dns/public/nsIDNSRecord.idl
netwerk/dns/public/nsIDNSRequest.idl
netwerk/dns/public/nsIDNSService.idl
netwerk/dns/public/nsIEffectiveTLDService.idl
netwerk/dns/public/nsIIDNService.idl
netwerk/dns/public/nsPIDNSService.idl
netwerk/dns/src/Makefile.in
netwerk/dns/src/effective_tld_names.dat
netwerk/dns/src/nameprep.c
netwerk/dns/src/nameprep_template.c
netwerk/dns/src/nameprepdata.c
netwerk/dns/src/nsDNSService2.cpp
netwerk/dns/src/nsDNSService2.h
netwerk/dns/src/nsEffectiveTLDService.cpp
netwerk/dns/src/nsEffectiveTLDService.h
netwerk/dns/src/nsHostResolver.cpp
netwerk/dns/src/nsHostResolver.h
netwerk/dns/src/nsIDNKitInterface.h
netwerk/dns/src/nsIDNService.cpp
netwerk/dns/src/nsIDNService.h
netwerk/dns/src/prepare_tlds.py
netwerk/dns/src/punycode.c
netwerk/dns/src/punycode.h
netwerk/dns/src/race.c
netwerk/mime/public/Makefile.in
netwerk/mime/public/nsIMIMEHeaderParam.idl
netwerk/mime/public/nsIMIMEInfo.idl
netwerk/mime/public/nsIMIMEService.idl
netwerk/mime/public/nsMimeTypes.h
netwerk/mime/src/Makefile.in
netwerk/mime/src/nsMIMEHeaderParamImpl.cpp
netwerk/mime/src/nsMIMEHeaderParamImpl.h
netwerk/protocol/about/public/Makefile.in
netwerk/protocol/about/public/nsAboutProtocolUtils.h
netwerk/protocol/about/public/nsIAboutModule.idl
netwerk/protocol/about/src/Makefile.in
netwerk/protocol/about/src/nsAboutBlank.cpp
netwerk/protocol/about/src/nsAboutBlank.h
netwerk/protocol/about/src/nsAboutBloat.cpp
netwerk/protocol/about/src/nsAboutBloat.h
netwerk/protocol/about/src/nsAboutCache.cpp
netwerk/protocol/about/src/nsAboutCache.h
netwerk/protocol/about/src/nsAboutCacheEntry.cpp
netwerk/protocol/about/src/nsAboutCacheEntry.h
netwerk/protocol/about/src/nsAboutProtocolHandler.cpp
netwerk/protocol/about/src/nsAboutProtocolHandler.h
netwerk/protocol/data/src/Makefile.in
netwerk/protocol/data/src/nsDataChannel.cpp
netwerk/protocol/data/src/nsDataChannel.h
netwerk/protocol/data/src/nsDataHandler.cpp
netwerk/protocol/data/src/nsDataHandler.h
netwerk/protocol/data/src/nsDataModule.cpp
netwerk/protocol/file/public/Makefile.in
netwerk/protocol/file/public/nsIFileChannel.idl
netwerk/protocol/file/public/nsIFileProtocolHandler.idl
netwerk/protocol/file/src/Makefile.in
netwerk/protocol/file/src/nsFileChannel.cpp
netwerk/protocol/file/src/nsFileChannel.h
netwerk/protocol/file/src/nsFileProtocolHandler.cpp
netwerk/protocol/file/src/nsFileProtocolHandler.h
netwerk/protocol/ftp/public/Makefile.in
netwerk/protocol/ftp/public/ftpCore.h
netwerk/protocol/ftp/public/nsIFTPChannel.idl
netwerk/protocol/ftp/src/Makefile.in
netwerk/protocol/ftp/src/nsFTPChannel.cpp
netwerk/protocol/ftp/src/nsFTPChannel.h
netwerk/protocol/ftp/src/nsFtpConnectionThread.cpp
netwerk/protocol/ftp/src/nsFtpConnectionThread.h
netwerk/protocol/ftp/src/nsFtpControlConnection.cpp
netwerk/protocol/ftp/src/nsFtpControlConnection.h
netwerk/protocol/ftp/src/nsFtpProtocolHandler.cpp
netwerk/protocol/ftp/src/nsFtpProtocolHandler.h
netwerk/protocol/gopher/src/Makefile.in
netwerk/protocol/gopher/src/nsGopherChannel.cpp
netwerk/protocol/gopher/src/nsGopherChannel.h
netwerk/protocol/gopher/src/nsGopherHandler.cpp
netwerk/protocol/gopher/src/nsGopherHandler.h
netwerk/protocol/http/public/Makefile.in
netwerk/protocol/http/public/nsIHttpActivityObserver.idl
netwerk/protocol/http/public/nsIHttpAuthManager.idl
netwerk/protocol/http/public/nsIHttpAuthenticator.idl
netwerk/protocol/http/public/nsIHttpChannel.idl
netwerk/protocol/http/public/nsIHttpChannelInternal.idl
netwerk/protocol/http/public/nsIHttpEventSink.idl
netwerk/protocol/http/public/nsIHttpHeaderVisitor.idl
netwerk/protocol/http/public/nsIHttpProtocolHandler.idl
netwerk/protocol/http/src/Makefile.in
netwerk/protocol/http/src/README
netwerk/protocol/http/src/nsAHttpConnection.h
netwerk/protocol/http/src/nsAHttpTransaction.h
netwerk/protocol/http/src/nsHttp.cpp
netwerk/protocol/http/src/nsHttp.h
netwerk/protocol/http/src/nsHttpActivityDistributor.cpp
netwerk/protocol/http/src/nsHttpActivityDistributor.h
netwerk/protocol/http/src/nsHttpAtomList.h
netwerk/protocol/http/src/nsHttpAuthCache.cpp
netwerk/protocol/http/src/nsHttpAuthCache.h
netwerk/protocol/http/src/nsHttpAuthManager.cpp
netwerk/protocol/http/src/nsHttpAuthManager.h
netwerk/protocol/http/src/nsHttpBasicAuth.cpp
netwerk/protocol/http/src/nsHttpBasicAuth.h
netwerk/protocol/http/src/nsHttpChannel.cpp
netwerk/protocol/http/src/nsHttpChannel.h
netwerk/protocol/http/src/nsHttpChunkedDecoder.cpp
netwerk/protocol/http/src/nsHttpChunkedDecoder.h
netwerk/protocol/http/src/nsHttpConnection.cpp
netwerk/protocol/http/src/nsHttpConnection.h
netwerk/protocol/http/src/nsHttpConnectionInfo.cpp
netwerk/protocol/http/src/nsHttpConnectionInfo.h
netwerk/protocol/http/src/nsHttpConnectionMgr.cpp
netwerk/protocol/http/src/nsHttpConnectionMgr.h
netwerk/protocol/http/src/nsHttpDigestAuth.cpp
netwerk/protocol/http/src/nsHttpDigestAuth.h
netwerk/protocol/http/src/nsHttpHandler.cpp
netwerk/protocol/http/src/nsHttpHandler.h
netwerk/protocol/http/src/nsHttpHeaderArray.cpp
netwerk/protocol/http/src/nsHttpHeaderArray.h
netwerk/protocol/http/src/nsHttpNTLMAuth.cpp
netwerk/protocol/http/src/nsHttpNTLMAuth.h
netwerk/protocol/http/src/nsHttpPipeline.cpp
netwerk/protocol/http/src/nsHttpPipeline.h
netwerk/protocol/http/src/nsHttpRequestHead.cpp
netwerk/protocol/http/src/nsHttpRequestHead.h
netwerk/protocol/http/src/nsHttpResponseHead.cpp
netwerk/protocol/http/src/nsHttpResponseHead.h
netwerk/protocol/http/src/nsHttpTransaction.cpp
netwerk/protocol/http/src/nsHttpTransaction.h
netwerk/protocol/res/public/Makefile.in
netwerk/protocol/res/public/nsIResProtocolHandler.idl
netwerk/protocol/res/src/Makefile.in
netwerk/protocol/res/src/nsResProtocolHandler.cpp
netwerk/protocol/res/src/nsResProtocolHandler.h
netwerk/protocol/viewsource/public/Makefile.in
netwerk/protocol/viewsource/public/nsIViewSourceChannel.idl
netwerk/protocol/viewsource/src/Makefile.in
netwerk/protocol/viewsource/src/nsViewSourceChannel.cpp
netwerk/protocol/viewsource/src/nsViewSourceChannel.h
netwerk/protocol/viewsource/src/nsViewSourceHandler.cpp
netwerk/protocol/viewsource/src/nsViewSourceHandler.h
netwerk/socket/base/Makefile.in
netwerk/socket/base/nsISOCKSSocketInfo.idl
netwerk/socket/base/nsISSLSocketControl.idl
netwerk/socket/base/nsISocketProvider.idl
netwerk/socket/base/nsISocketProviderService.idl
netwerk/socket/base/nsITransportSecurityInfo.idl
netwerk/socket/base/nsSOCKS4SocketProvider.h
netwerk/socket/base/nsSOCKSIOLayer.cpp
netwerk/socket/base/nsSOCKSIOLayer.h
netwerk/socket/base/nsSOCKSSocketProvider.cpp
netwerk/socket/base/nsSOCKSSocketProvider.h
netwerk/socket/base/nsSocketProviderService.cpp
netwerk/socket/base/nsSocketProviderService.h
netwerk/socket/base/nsUDPSocketProvider.cpp
netwerk/socket/base/nsUDPSocketProvider.h
netwerk/wifi/public/Makefile.in
netwerk/wifi/public/nsIWifiAccessPoint.idl
netwerk/wifi/public/nsIWifiListener.idl
netwerk/wifi/public/nsIWifiMonitor.idl
netwerk/wifi/src/Makefile.in
netwerk/wifi/src/nsWifiAccessPoint.cpp
netwerk/wifi/src/nsWifiAccessPoint.h
netwerk/wifi/src/nsWifiMonitor.cpp
netwerk/wifi/src/nsWifiMonitor.h
netwerk/wifi/src/nsWifiScannerMac.cpp
netwerk/wifi/src/nsWifiScannerSolaris.cpp
netwerk/wifi/src/nsWifiScannerUnix.cpp
netwerk/wifi/src/nsWifiScannerWin.cpp
netwerk/wifi/src/osx_corewlan.mm
netwerk/wifi/src/osx_wifi.h
netwerk/wifi/src/wlanapi.h
security/manager/ssl/src/nsCrypto.cpp
storage/test/unit/test_js_helpers_enumerate.js
storage/test/unit/test_js_helpers_prototype_chain_safe.js
toolkit/components/remote/nsPhRemoteService.cpp
toolkit/components/remote/nsPhRemoteService.h
toolkit/components/satchel/src/nsStorageFormHistory.cpp
toolkit/components/satchel/src/nsStorageFormHistory.h
toolkit/mozapps/extensions/nsExtensionManager.js
toolkit/mozapps/extensions/nsIExtensionManager.idl
toolkit/mozapps/extensions/test/addons/test_bug257155/install.rdf
toolkit/mozapps/extensions/test/addons/test_bug378216_1/install.rdf
toolkit/mozapps/extensions/test/addons/test_bug378216_10/install.rdf
toolkit/mozapps/extensions/test/addons/test_bug378216_11/install.rdf
toolkit/mozapps/extensions/test/addons/test_bug378216_12/install.rdf
toolkit/mozapps/extensions/test/addons/test_bug378216_13/install.rdf
toolkit/mozapps/extensions/test/addons/test_bug378216_2/install.rdf
toolkit/mozapps/extensions/test/addons/test_bug378216_3/install.rdf
toolkit/mozapps/extensions/test/addons/test_bug378216_4/install.rdf
toolkit/mozapps/extensions/test/addons/test_bug378216_5/install.rdf
toolkit/mozapps/extensions/test/addons/test_bug378216_6/install.rdf
toolkit/mozapps/extensions/test/addons/test_bug378216_7/install.rdf
toolkit/mozapps/extensions/test/addons/test_bug378216_8/install.rdf
toolkit/mozapps/extensions/test/addons/test_bug378216_9/install.rdf
toolkit/mozapps/extensions/test/addons/test_bug392180/install.rdf
toolkit/mozapps/extensions/test/addons/test_bug396129_a_1/install.rdf
toolkit/mozapps/extensions/test/addons/test_bug396129_a_2/install.rdf
toolkit/mozapps/extensions/test/addons/test_bug396129_b_1/install.rdf
toolkit/mozapps/extensions/test/addons/test_bug396129_b_2/install.rdf
toolkit/mozapps/extensions/test/addons/test_bug396129_c_1/install.rdf
toolkit/mozapps/extensions/test/addons/test_bug396129_c_2/install.rdf
toolkit/mozapps/extensions/test/addons/test_bug396129_d_1/install.rdf
toolkit/mozapps/extensions/test/addons/test_bug396129_d_2/install.rdf
toolkit/mozapps/extensions/test/addons/test_bug428341_1/README
toolkit/mozapps/extensions/test/addons/test_bug428341_2/install.rdf
toolkit/mozapps/extensions/test/addons/test_bug428341_3/install.rdf
toolkit/mozapps/extensions/test/addons/test_bug428341_4/install.rdf
toolkit/mozapps/extensions/test/addons/test_bug428341_5/install.rdf
toolkit/mozapps/extensions/test/addons/test_bug428341_6/install.rdf
toolkit/mozapps/extensions/test/addons/test_bug428341_7/install.rdf
toolkit/mozapps/extensions/test/addons/test_bug428341_8/install.rdf
toolkit/mozapps/extensions/test/addons/test_bug428341_9/install.rdf
toolkit/mozapps/extensions/test/addons/test_bug436207/install.js
toolkit/mozapps/extensions/test/browser/browser_bug510909.js
toolkit/mozapps/extensions/test/bug435743.rdf
toolkit/mozapps/extensions/test/bug435743.sjs
toolkit/mozapps/extensions/test/bug435743.xpi
toolkit/mozapps/extensions/test/test_bug435743_1.xul
toolkit/mozapps/extensions/test/test_bug435743_2.xul
toolkit/mozapps/extensions/test/unit/data/bug455906_block.xml
toolkit/mozapps/extensions/test/unit/data/bug455906_empty.xml
toolkit/mozapps/extensions/test/unit/data/bug455906_start.xml
toolkit/mozapps/extensions/test/unit/data/bug455906_warn.xml
toolkit/mozapps/extensions/test/unit/data/cert8.db
toolkit/mozapps/extensions/test/unit/data/key3.db
toolkit/mozapps/extensions/test/unit/data/secmod.db
toolkit/mozapps/extensions/test/unit/data/signed-no-cn.xpi
toolkit/mozapps/extensions/test/unit/data/signed-no-o.xpi
toolkit/mozapps/extensions/test/unit/data/signed-tampered.xpi
toolkit/mozapps/extensions/test/unit/data/signed-untrusted.xpi
toolkit/mozapps/extensions/test/unit/data/signed.xpi
toolkit/mozapps/extensions/test/unit/data/test_bug299716.rdf
toolkit/mozapps/extensions/test/unit/data/test_bug299716_2.rdf
toolkit/mozapps/extensions/test/unit/data/test_bug324121.rdf
toolkit/mozapps/extensions/test/unit/data/test_bug378216.rdf
toolkit/mozapps/extensions/test/unit/data/test_bug393285.xml
toolkit/mozapps/extensions/test/unit/data/test_bug394300.rdf
toolkit/mozapps/extensions/test/unit/data/test_bug396129.rdf
toolkit/mozapps/extensions/test/unit/data/test_bug404024.xml
toolkit/mozapps/extensions/test/unit/data/test_bug417606.xml
toolkit/mozapps/extensions/test/unit/data/test_bug424107_1.rdf
toolkit/mozapps/extensions/test/unit/data/test_bug424107_2.rdf
toolkit/mozapps/extensions/test/unit/data/test_bug424262.xml
toolkit/mozapps/extensions/test/unit/data/test_bug449027_app.xml
toolkit/mozapps/extensions/test/unit/data/test_bug449027_toolkit.xml
toolkit/mozapps/extensions/test/unit/data/test_bug468528.xml
toolkit/mozapps/extensions/test/unit/data/test_bug470377/install_1.rdf
toolkit/mozapps/extensions/test/unit/data/test_bug470377/install_2.rdf
toolkit/mozapps/extensions/test/unit/data/test_bug470377/install_3.rdf
toolkit/mozapps/extensions/test/unit/data/test_bug470377/install_4.rdf
toolkit/mozapps/extensions/test/unit/data/test_bug470377/install_5.rdf
toolkit/mozapps/extensions/test/unit/data/test_bug470377/update_1.rdf
toolkit/mozapps/extensions/test/unit/data/test_bug470377/update_2.rdf
toolkit/mozapps/extensions/test/unit/data/test_bug470377/update_3.rdf
toolkit/mozapps/extensions/test/unit/data/test_bug470377/update_4.rdf
toolkit/mozapps/extensions/test/unit/data/test_bug470377/update_5.rdf
toolkit/mozapps/extensions/test/unit/data/test_bug486195/install.rdf
toolkit/mozapps/extensions/test/unit/data/test_bug514327_1.xml
toolkit/mozapps/extensions/test/unit/data/test_bug514327_2.xml
toolkit/mozapps/extensions/test/unit/data/test_bug514327_3_empty.xml
toolkit/mozapps/extensions/test/unit/data/test_bug514327_3_outdated_1.xml
toolkit/mozapps/extensions/test/unit/data/test_bug514327_3_outdated_2.xml
toolkit/mozapps/extensions/test/unit/data/test_bug526598_1.xpi
toolkit/mozapps/extensions/test/unit/data/test_bug526598_2.xpi
toolkit/mozapps/extensions/test/unit/data/test_bug541420.xpi
toolkit/mozapps/extensions/test/unit/data/unsigned.xpi
toolkit/mozapps/extensions/test/unit/test_LightweightThemeManager.js
toolkit/mozapps/extensions/test/unit/test_bug257155.js
toolkit/mozapps/extensions/test/unit/test_bug299716.js
toolkit/mozapps/extensions/test/unit/test_bug299716_2.js
toolkit/mozapps/extensions/test/unit/test_bug324121.js
toolkit/mozapps/extensions/test/unit/test_bug335238.js
toolkit/mozapps/extensions/test/unit/test_bug371495.js
toolkit/mozapps/extensions/test/unit/test_bug378216.js
toolkit/mozapps/extensions/test/unit/test_bug384052.js
toolkit/mozapps/extensions/test/unit/test_bug386153.js
toolkit/mozapps/extensions/test/unit/test_bug391899.js
toolkit/mozapps/extensions/test/unit/test_bug392180.js
toolkit/mozapps/extensions/test/unit/test_bug393285.js
toolkit/mozapps/extensions/test/unit/test_bug394300.js
toolkit/mozapps/extensions/test/unit/test_bug394717.js
toolkit/mozapps/extensions/test/unit/test_bug396129.js
toolkit/mozapps/extensions/test/unit/test_bug397778.js
toolkit/mozapps/extensions/test/unit/test_bug404024.js
toolkit/mozapps/extensions/test/unit/test_bug406118.js
toolkit/mozapps/extensions/test/unit/test_bug417606.js
toolkit/mozapps/extensions/test/unit/test_bug424107.js
toolkit/mozapps/extensions/test/unit/test_bug424262.js
toolkit/mozapps/extensions/test/unit/test_bug425657.js
toolkit/mozapps/extensions/test/unit/test_bug428341.js
toolkit/mozapps/extensions/test/unit/test_bug430120.js
toolkit/mozapps/extensions/test/unit/test_bug436207.js
toolkit/mozapps/extensions/test/unit/test_bug449027.js
toolkit/mozapps/extensions/test/unit/test_bug455906.js
toolkit/mozapps/extensions/test/unit/test_bug465190.js
toolkit/mozapps/extensions/test/unit/test_bug468528.js
toolkit/mozapps/extensions/test/unit/test_bug470377_1.js
toolkit/mozapps/extensions/test/unit/test_bug470377_2.js
toolkit/mozapps/extensions/test/unit/test_bug470377_3.js
toolkit/mozapps/extensions/test/unit/test_bug470377_4.js
toolkit/mozapps/extensions/test/unit/test_bug474988.js
toolkit/mozapps/extensions/test/unit/test_bug486195.js
toolkit/mozapps/extensions/test/unit/test_bug509194.js
toolkit/mozapps/extensions/test/unit/test_bug514327_1.js
toolkit/mozapps/extensions/test/unit/test_bug514327_2.js
toolkit/mozapps/extensions/test/unit/test_bug514327_3.js
toolkit/mozapps/extensions/test/unit/test_bug521905.js
toolkit/mozapps/extensions/test/unit/test_bug526598.js
toolkit/mozapps/extensions/test/unit/test_bug541420.js
toolkit/mozapps/update/test/chrome/test_0011_check_billboard_noLicense_noAddons.xul
toolkit/mozapps/update/test/chrome/test_0012_check_billboard_noAddons.xul
toolkit/mozapps/update/test/chrome/test_0021_check_noBillboard_noLicense_noAddons.xul
toolkit/mozapps/update/test/chrome/test_0022_check_noBillboard_noAddons.xul
toolkit/mozapps/update/test/chrome/test_0031_available_billboard_noLicense_noAddons.xul
toolkit/mozapps/update/test/chrome/test_0032_available_billboard_noAddons.xul
toolkit/mozapps/update/test/chrome/test_0041_available_noBillboard_noLicense_noAddons.xul
toolkit/mozapps/update/test/chrome/test_0042_available_noBillboard_noAddons.xul
toolkit/mozapps/update/test/chrome/test_0111_neverButton_billboard.xul
toolkit/mozapps/update/test/chrome/test_0112_neverButton_noBillboard.xul
toolkit/themes/gnomestripe/mozapps/extensions/extensionIcons.png
toolkit/themes/gnomestripe/mozapps/extensions/notifyBadges.png
toolkit/themes/gnomestripe/mozapps/extensions/ratings.png
toolkit/themes/gnomestripe/mozapps/extensions/viewButtons.png
toolkit/themes/pinstripe/mozapps/extensions/extensionIcons.png
toolkit/themes/pinstripe/mozapps/extensions/extensionItem.png
toolkit/themes/pinstripe/mozapps/extensions/itemDisabledFader.png
toolkit/themes/pinstripe/mozapps/extensions/itemEnabledFader.png
toolkit/themes/pinstripe/mozapps/extensions/notifyBadges.png
toolkit/themes/pinstripe/mozapps/extensions/question.png
toolkit/themes/pinstripe/mozapps/extensions/ratings.png
toolkit/themes/pinstripe/mozapps/extensions/viewButtons.png
toolkit/themes/pinstripe/mozapps/plugins/pluginCrashed.png
toolkit/themes/pinstripe/mozapps/plugins/pluginOutdated-16.png
toolkit/themes/winstripe/mozapps/extensions/extensionIcons-aero.png
toolkit/themes/winstripe/mozapps/extensions/extensionIcons.png
toolkit/themes/winstripe/mozapps/extensions/itemDisabledFader.png
toolkit/themes/winstripe/mozapps/extensions/itemEnabledFader.png
toolkit/themes/winstripe/mozapps/extensions/notifyBadges-aero.png
toolkit/themes/winstripe/mozapps/extensions/notifyBadges.png
toolkit/themes/winstripe/mozapps/extensions/question-aero.png
toolkit/themes/winstripe/mozapps/extensions/question.png
toolkit/themes/winstripe/mozapps/extensions/ratings-aero.png
toolkit/themes/winstripe/mozapps/extensions/ratings.png
toolkit/themes/winstripe/mozapps/extensions/viewButtons-aero.png
toolkit/themes/winstripe/mozapps/extensions/viewButtons.png
toolkit/themes/winstripe/mozapps/plugins/pluginCrashed-aero.png
toolkit/themes/winstripe/mozapps/plugins/pluginCrashed.png
widget/src/photon/Makefile.in
widget/src/photon/PtRawDrawContainer.cpp
widget/src/photon/PtRawDrawContainer.h
widget/src/photon/nsAppShell.cpp
widget/src/photon/nsAppShell.h
widget/src/photon/nsBidiKeyboard.cpp
widget/src/photon/nsBidiKeyboard.h
widget/src/photon/nsClipboard.cpp
widget/src/photon/nsClipboard.h
widget/src/photon/nsDragService.cpp
widget/src/photon/nsDragService.h
widget/src/photon/nsFilePicker.cpp
widget/src/photon/nsFilePicker.h
widget/src/photon/nsLookAndFeel.cpp
widget/src/photon/nsLookAndFeel.h
widget/src/photon/nsScreenManagerPh.cpp
widget/src/photon/nsScreenManagerPh.h
widget/src/photon/nsScreenPh.cpp
widget/src/photon/nsScreenPh.h
widget/src/photon/nsSound.cpp
widget/src/photon/nsSound.h
widget/src/photon/nsToolkit.cpp
widget/src/photon/nsToolkit.h
widget/src/photon/nsWidget.cpp
widget/src/photon/nsWidget.h
widget/src/photon/nsWidgetFactory.cpp
widget/src/photon/nsWindow.cpp
widget/src/photon/nsWindow.h
widget/src/qt/keysym2ucs.c
widget/src/qt/keysym2ucs.h
widget/src/xremoteclient/PhRemoteClient.cpp
widget/src/xremoteclient/PhRemoteClient.h
xpcom/ds/nsCommaSeparatedTokenizer.h
--- a/Makefile.in
+++ b/Makefile.in
@@ -69,22 +69,16 @@ tier_base_dirs += \
 	memory \
 	$(NULL)
 endif
 
 ifdef COMPILE_ENVIRONMENT
 include $(topsrcdir)/$(MOZ_BUILD_APP)/build.mk
 endif
 
-TIERS += testharness
-
-# test harnesses
-ifdef ENABLE_TESTS
-tier_testharness_dirs += testing/xpcshell
-endif
 
 include $(topsrcdir)/config/config.mk
 
 GARBAGE_DIRS += dist _javagen _profile _tests staticlib
 DIST_GARBAGE = config.cache config.log config.status config-defs.h \
    dependencies.beos config/autoconf.mk \
    unallmakefiles mozilla-config.h \
    netwerk/necko-config.h xpcom/xpcom-config.h xpcom/xpcom-private.h \
--- a/accessible/public/nsIAccessibilityService.h
+++ b/accessible/public/nsIAccessibilityService.h
@@ -36,34 +36,47 @@
  * the provisions above, a recipient may use your version of this file under
  * the terms of any one of the MPL, the GPL or the LGPL.
  *
  * ***** END LICENSE BLOCK ***** */
 
 #ifndef _nsIAccessibilityService_h_
 #define _nsIAccessibilityService_h_
 
-#include "nsISupports.h"
 #include "nsIAccessibleRetrieval.h"
+#include "nsIAccessibleEvent.h"
 
+class nsAccessible;
+class nsIContent;
 class nsIDocument;
 class nsIFrame;
+class nsIPresShell;
 class nsObjectFrame;
-class nsIContent;
 
+// 9f43b315-53c6-4d46-9818-9c8593e91984
 #define NS_IACCESSIBILITYSERVICE_IID \
-{0x33fa2a8d, 0x72e5, 0x4b8b,         \
-  {0xbb, 0x17, 0x6b, 0x22, 0x79, 0x05, 0x5c, 0x6c} }
+{0x9f43b315, 0x53c6, 0x4d46,         \
+  {0x98, 0x18, 0x9c, 0x85, 0x93, 0xe9, 0x19, 0x84} }
 
 class nsIAccessibilityService : public nsIAccessibleRetrieval
 {
 public:
   NS_DECLARE_STATIC_IID_ACCESSOR(NS_IACCESSIBILITYSERVICE_IID)
 
   /**
+   * Return an accessible object for a DOM node in the given pres shell.
+   *
+   * @param  aNode      [in] the DOM node to get an accessible for
+   * @param  aPresShell [in] the presentation shell which contains layout info
+   *                         for the DOM node
+   */
+  virtual nsAccessible* GetAccessibleInShell(nsIDOMNode *aNode,
+                                             nsIPresShell *aPresShell) = 0;
+
+  /**
    * Creates accessible for the given DOM node or frame.
    */
   virtual nsresult CreateOuterDocAccessible(nsIDOMNode *aNode,
                                             nsIAccessible **aAccessible) = 0;
 
   virtual nsresult CreateHTML4ButtonAccessible(nsIFrame *aFrame,
                                                nsIAccessible **aAccessible) = 0;
   virtual nsresult CreateHyperTextAccessible(nsIFrame *aFrame,
@@ -134,17 +147,17 @@ public:
     FRAME_SHOW = 0x04,
     FRAME_HIDE = 0x05,
     FRAME_SIGNIFICANT_CHANGE = 0x06
   };
 
   /**
    * Invalidate the accessible tree when DOM tree or frame tree is changed.
    *
-   * @param aPresShell   [in] the presShell where changes occured
+   * @param aPresShell   [in] the presShell where changes occurred
    * @param aContent     [in] the affected DOM content
    * @param aChangeType  [in] the change type (see constants declared above)
    */
   virtual nsresult InvalidateSubtreeFor(nsIPresShell *aPresShell,
                                         nsIContent *aContent,
                                         PRUint32 aChangeType) = 0;
 
   /**
--- a/accessible/public/nsIAccessibleDocument.idl
+++ b/accessible/public/nsIAccessibleDocument.idl
@@ -53,17 +53,17 @@ interface nsIDOMWindow;
  * You can QueryInterface to nsIAccessibleDocument from
  * the nsIAccessible or nsIAccessNode for the root node
  * of a document. You can also get one from 
  * nsIAccessNode::GetAccessibleDocument() or 
  * nsIAccessibleEvent::GetAccessibleDocument()
  *
  * @status UNDER_REVIEW
  */
-[scriptable, uuid(471909e7-0ea4-4ce0-bf31-a1372b2b285c)]
+[scriptable, uuid(03c6ce8a-aa40-4484-9282-e6579c56e054)]
 interface nsIAccessibleDocument : nsISupports
 {
   /**
    * The URL of the document
    */
   readonly attribute AString URL;
 
   /**
@@ -96,21 +96,9 @@ interface nsIAccessibleDocument : nsISup
    */
   AString getNameSpaceURIForID(in short nameSpaceID);
 
   /**
    * The window handle for the OS window the document is being displayed in.
    * For example, in Windows you can static cast it to an HWND.
    */
   [noscript] readonly attribute voidPtr windowHandle;
-
-  /**
-   * Returns the first accessible parent of a DOM node.
-   * Guaranteed not to return nsnull if the DOM node is in a document.
-   * @param aDOMNode The DOM node we need an accessible for.
-   * @param aCanCreate Can accessibles be created or must it be the first 
-   *                   cached accessible in the parent chain?
-   * @return An first nsIAccessible found by crawling up the DOM node
-   *         to the document root.
-   */
-  nsIAccessible getAccessibleInParentChain(in nsIDOMNode aDOMNode,
-                                           in boolean aCanCreate);
 };
--- a/accessible/public/nsIAccessibleProvider.idl
+++ b/accessible/public/nsIAccessibleProvider.idl
@@ -40,17 +40,17 @@
 
 #include "nsISupports.idl"
 
 /**
  * nsIAccessibleProvider interface is used to link element and accessible
    object. For that XBL binding of element should implement the interface.
  */
 
-[scriptable, uuid(3f7f9194-c625-4a85-8148-6d92d34897fa)]
+[scriptable, uuid(ac0639d5-f95b-4e2b-970c-9eab281fb6a5)]
 interface nsIAccessibleProvider : nsISupports
 {
   /**
    * Constants set of common use.
    */
 
   /** Do not create an accessible for this object
    * This is useful if an ancestor binding already implements nsIAccessibleProvider,
@@ -87,25 +87,22 @@ interface nsIAccessibleProvider : nsISup
   const long XULMenuSeparator = 0x00001010;
   const long XULPane    = 0x00001011;
   const long XULProgressMeter = 0x00001012;
   const long XULScale = 0x00001013;
   const long XULStatusBar = 0x00001014;
   const long XULRadioButton = 0x00001015;
   const long XULRadioGroup = 0x00001016;
 
-  /** The single tab in a dialog or tabbrowser/editor interface */
+  /** Used for XUL tab element */
   const long XULTab = 0x00001017;
-
-  /** A combination of a tabs object and a tabpanels object */
-  const long XULTabBox = 0x00001018;
-
-  /** The collection of tab objects, usable in the TabBox and independent of it
-   as well */
-  const long XULTabs = 0x00001019;
+  /** Used for XUL tabs element, a container for tab elements */
+  const long XULTabs = 0x00001018;
+  /** Used for XUL tabpanels container element */
+  const long XULTabpanels = 0x00001019;
 
   const long XULText             = 0x0000101A;
   const long XULTextBox          = 0x0000101B;
   const long XULThumb            = 0x0000101C;
   const long XULTree             = 0x0000101D;
   const long XULTreeColumns      = 0x0000101E;
   const long XULTreeColumnItem   = 0x0000101F;
   const long XULToolbar          = 0x00001020;
@@ -121,17 +118,17 @@ interface nsIAccessibleProvider : nsISup
   /** Used for xforms elements that provide accessible object for itself as
    * well for anonymous content. This property are used for upload,
    * input[type="xsd:gDay"] and input[type="xsd:gMonth"] */
   const long XFormsContainer = 0x00002000;
 
   /** Used for label element */
   const long XFormsLabel = 0x00002001;
   /** Used for output element */
-  const long XFormsOuput = 0x00002002;
+  const long XFormsOutput = 0x00002002;
   /** Used for trigger and submit elements */
   const long XFormsTrigger = 0x00002003;
   /** Used for input and textarea elements */
   const long XFormsInput = 0x00002004;
   /** Used for input[xsd:boolean] element */
   const long XFormsInputBoolean = 0x00002005;
   /** Used for input[xsd:date] element */
   const long XFormsInputDate = 0x00002006;
--- a/accessible/public/nsIAccessibleRetrieval.idl
+++ b/accessible/public/nsIAccessibleRetrieval.idl
@@ -51,17 +51,17 @@ interface nsIDOMDOMStringList;
  * An interface for in-process accessibility clients
  * wishing to get an nsIAccessible or nsIAccessNode for
  * a given DOM node.
  * More documentation at:
  *   http://www.mozilla.org/projects/ui/accessibility
  *
  * @status UNDER_REVIEW
  */
-[scriptable, uuid(3df14f00-7253-4b9c-97c2-b4632090da23)]
+[scriptable, uuid(3e5cbd5c-dbab-4ea3-b82b-4cd6201d6fe0)]
 interface nsIAccessibleRetrieval : nsISupports
 {
   /**
    * Return application accessible.
    */
   nsIAccessible getApplicationAccessible();
 
   /**
@@ -92,26 +92,16 @@ interface nsIAccessibleRetrieval : nsISu
    * accessible object for returned node.
    *
    * @param aNode - the DOM node to get relevant content node.
    *
    * @return - the DOM node for parent attached accessible
    */
   nsIDOMNode getRelevantContentNodeFor(in nsIDOMNode aNode);
 
-  /**
-   * Return an nsIAccessible for a DOM node in the given pres shell.
-   * Create a new accessible of the appropriate type if necessary,
-   * or use one from the accessibility cache if it already exists.
-   * @param aNode      The DOM node to get an accessible for.
-   * @param aPresShell The presentation shell which contains layout info for the DOM node.
-   * @return The nsIAccessible for the given DOM node.
-   */
-  nsIAccessible getAccessibleInShell(in nsIDOMNode aNode, in nsIPresShell aPresShell);
-
    /**
     * Returns accessible role as a string.
     *
     * @param aRole - the accessible role constants.
     */
   AString getStringRole(in unsigned long aRole);
 
    /**
--- a/accessible/src/atk/nsAccessibleWrap.cpp
+++ b/accessible/src/atk/nsAccessibleWrap.cpp
@@ -889,30 +889,28 @@ getChildCountCB(AtkObject *aAtkObj)
 AtkObject *
 refChildCB(AtkObject *aAtkObj, gint aChildIndex)
 {
     // aChildIndex should not be less than zero
     if (aChildIndex < 0) {
       return nsnull;
     }
 
-    // XXX Fix this so it is not O(n^2) to walk through the children!
-    // Either we can cache the last accessed child so that we can just GetNextSibling()
-    // or we should cache an array of children in each nsAccessible
-    // (instead of mNextSibling on the children)
     nsAccessibleWrap *accWrap = GetAccessibleWrap(aAtkObj);
     if (!accWrap || nsAccUtils::MustPrune(accWrap)) {
         return nsnull;
     }
 
     nsCOMPtr<nsIAccessible> accChild;
     nsCOMPtr<nsIAccessibleHyperText> hyperText;
     accWrap->QueryInterface(NS_GET_IID(nsIAccessibleHyperText), getter_AddRefs(hyperText));
     if (hyperText) {
-        // If HyperText, then number of links matches number of children
+        // If HyperText, then number of links matches number of children.
+        // XXX Fix this so it is not O(n^2) to walk through the children
+        // (bug 566328).
         nsCOMPtr<nsIAccessibleHyperLink> hyperLink;
         hyperText->GetLink(aChildIndex, getter_AddRefs(hyperLink));
         accChild = do_QueryInterface(hyperLink);
     }
     else {
         nsCOMPtr<nsIAccessibleText> accText;
         accWrap->QueryInterface(NS_GET_IID(nsIAccessibleText), getter_AddRefs(accText));
         if (!accText) {  // Accessible Text that is not HyperText has no children
@@ -940,46 +938,36 @@ getIndexInParentCB(AtkObject *aAtkObj)
 {
     // We don't use nsIAccessible::GetIndexInParent() because
     // for ATK we don't want to include text leaf nodes as children
     nsAccessibleWrap *accWrap = GetAccessibleWrap(aAtkObj);
     if (!accWrap) {
         return -1;
     }
 
-    nsCOMPtr<nsIAccessible> parent;
-    accWrap->GetParent(getter_AddRefs(parent));
+    nsAccessible *parent = accWrap->GetParent();
     if (!parent) {
         return -1; // No parent
     }
 
-    nsCOMPtr<nsIAccessible> sibling;
-    parent->GetFirstChild(getter_AddRefs(sibling));
-    if (!sibling) {
-        return -1;  // Error, parent has no children
-    }
-
     PRInt32 currentIndex = 0;
 
-    while (sibling != static_cast<nsIAccessible*>(accWrap)) {
-      NS_ASSERTION(sibling, "Never ran into the same child that we started from");
-
-      if (!sibling) {
-          return -1;
-      }
-      if (nsAccUtils::IsEmbeddedObject(sibling)) {
-        ++ currentIndex;
+    PRInt32 childCount = parent->GetChildCount();
+    for (PRInt32 idx = 0; idx < childCount; idx++) {
+      nsAccessible *sibling = parent->GetChildAt(idx);
+      if (sibling == accWrap) {
+          return currentIndex;
       }
 
-      nsCOMPtr<nsIAccessible> tempAccessible;
-      sibling->GetNextSibling(getter_AddRefs(tempAccessible));
-      sibling.swap(tempAccessible);
+      if (nsAccUtils::IsEmbeddedObject(sibling)) {
+          ++ currentIndex;
+      }
     }
 
-    return currentIndex;
+    return -1;
 }
 
 static void TranslateStates(PRUint32 aState, const AtkStateMap *aStateMap,
                             AtkStateSet *aStateSet)
 {
   NS_ASSERTION(aStateSet, "Can't pass in null state set");
 
   // Convert every state to an entry in AtkStateMap
--- a/accessible/src/base/Makefile.in
+++ b/accessible/src/base/Makefile.in
@@ -45,16 +45,17 @@ include $(DEPTH)/config/autoconf.mk
 MODULE = accessibility
 LIBRARY_NAME = accessibility_base_s
 LIBXUL_LIBRARY = 1
 
 
 CPPSRCS = \
   nsAccessNode.cpp \
   nsAccEvent.cpp \
+  nsAccIterator.cpp \
   nsARIAGridAccessible.cpp \
   nsARIAMap.cpp \
   nsDocAccessible.cpp \
   nsOuterDocAccessible.cpp \
   nsAccessibilityAtoms.cpp \
   nsCoreUtils.cpp \
   nsAccUtils.cpp \
   nsRelUtils.cpp \
--- a/accessible/src/base/nsARIAGridAccessible.cpp
+++ b/accessible/src/base/nsARIAGridAccessible.cpp
@@ -33,17 +33,17 @@
  * and other provisions required by the GPL or the LGPL. If you do not delete
  * the provisions above, a recipient may use your version of this file under
  * the terms of any one of the MPL, the GPL or the LGPL.
  *
  * ***** END LICENSE BLOCK ***** */
 
 #include "nsARIAGridAccessible.h"
 
-#include "nsAccUtils.h"
+#include "nsAccIterator.h"
 
 #include "nsIMutableArray.h"
 #include "nsComponentManagerUtils.h"
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsARIAGridAccessible
 ////////////////////////////////////////////////////////////////////////////////
 
@@ -96,54 +96,58 @@ NS_IMETHODIMP
 nsARIAGridAccessible::GetColumnCount(PRInt32 *acolumnCount)
 {
   NS_ENSURE_ARG_POINTER(acolumnCount);
   *acolumnCount = 0;
 
   if (IsDefunct())
     return NS_ERROR_FAILURE;
 
-  nsCOMPtr<nsIAccessible> row = GetNextRow();
-  nsCOMPtr<nsIAccessible> cell;
-  while ((cell = GetNextCellInRow(row, cell)))
+  nsAccIterator rowIter(this, nsAccIterator::GetRow);
+  nsAccessible *row = rowIter.GetNext();
+
+  nsAccIterator cellIter(row, nsAccIterator::GetCell);
+  nsAccessible *cell = nsnull;
+
+  while ((cell = cellIter.GetNext()))
     (*acolumnCount)++;
 
   return NS_OK;
 }
 
 NS_IMETHODIMP
 nsARIAGridAccessible::GetRowCount(PRInt32 *arowCount)
 {
   NS_ENSURE_ARG_POINTER(arowCount);
   *arowCount = 0;
 
   if (IsDefunct())
     return NS_ERROR_FAILURE;
 
-  nsCOMPtr<nsIAccessible> row;
-  while ((row = GetNextRow(row)))
+  nsAccIterator rowIter(this, nsAccIterator::GetRow);
+  while (rowIter.GetNext())
     (*arowCount)++;
 
   return NS_OK;
 }
 
 NS_IMETHODIMP
 nsARIAGridAccessible::GetCellAt(PRInt32 aRowIndex, PRInt32 aColumnIndex,
                                 nsIAccessible **aAccessible)
 {
   NS_ENSURE_ARG_POINTER(aAccessible);
   *aAccessible = nsnull;
 
   if (IsDefunct())
     return NS_ERROR_FAILURE;
 
-  nsCOMPtr<nsIAccessible> row = GetRowAt(aRowIndex);
+  nsAccessible *row = GetRowAt(aRowIndex);
   NS_ENSURE_ARG(row);
 
-  nsCOMPtr<nsIAccessible> cell = GetCellInRowAt(row, aColumnIndex);
+  nsAccessible *cell = GetCellInRowAt(row, aColumnIndex);
   NS_ENSURE_ARG(cell);
 
   NS_ADDREF(*aAccessible = cell);
   return NS_OK;
 }
 
 NS_IMETHODIMP
 nsARIAGridAccessible::GetCellIndexAt(PRInt32 aRowIndex, PRInt32 aColumnIndex,
@@ -283,50 +287,52 @@ nsARIAGridAccessible::IsColumnSelected(P
   NS_ENSURE_ARG_POINTER(aIsSelected);
   *aIsSelected = PR_FALSE;
 
   if (IsDefunct())
     return NS_ERROR_FAILURE;
 
   NS_ENSURE_ARG(IsValidColumn(aColumn));
 
-  nsCOMPtr<nsIAccessible> row = GetNextRow();
+  nsAccIterator rowIter(this, nsAccIterator::GetRow);
+  nsAccessible *row = rowIter.GetNext();
   if (!row)
     return NS_OK;
 
   do {
     if (!nsAccUtils::IsARIASelected(row)) {
-      nsCOMPtr<nsIAccessible> cell = GetCellInRowAt(row, aColumn);
+      nsAccessible *cell = GetCellInRowAt(row, aColumn);
       if (!cell) // Do not fail due to wrong markup
         return NS_OK;
       
       if (!nsAccUtils::IsARIASelected(cell))
         return NS_OK;
     }
-  } while ((row = GetNextRow(row)));
+  } while ((row = rowIter.GetNext()));
 
   *aIsSelected = PR_TRUE;
   return NS_OK;
 }
 
 NS_IMETHODIMP
 nsARIAGridAccessible::IsRowSelected(PRInt32 aRow, PRBool *aIsSelected)
 {
   NS_ENSURE_ARG_POINTER(aIsSelected);
   *aIsSelected = PR_FALSE;
 
   if (IsDefunct())
     return NS_ERROR_FAILURE;
 
-  nsCOMPtr<nsIAccessible> row = GetRowAt(aRow);
+  nsAccessible *row = GetRowAt(aRow);
   NS_ENSURE_ARG(row);
 
   if (!nsAccUtils::IsARIASelected(row)) {
-    nsCOMPtr<nsIAccessible> cell;
-    while ((cell = GetNextCellInRow(row, cell))) {
+    nsAccIterator cellIter(row, nsAccIterator::GetCell);
+    nsAccessible *cell = nsnull;
+    while ((cell = cellIter.GetNext())) {
       if (!nsAccUtils::IsARIASelected(cell))
         return NS_OK;
     }
   }
 
   *aIsSelected = PR_TRUE;
   return NS_OK;
 }
@@ -336,21 +342,21 @@ nsARIAGridAccessible::IsCellSelected(PRI
                                      PRBool *aIsSelected)
 {
   NS_ENSURE_ARG_POINTER(aIsSelected);
   *aIsSelected = PR_FALSE;
 
   if (IsDefunct())
     return NS_ERROR_FAILURE;
 
-  nsCOMPtr<nsIAccessible> row(GetRowAt(aRow));
+  nsAccessible *row = GetRowAt(aRow);
   NS_ENSURE_ARG(row);
 
   if (!nsAccUtils::IsARIASelected(row)) {
-    nsCOMPtr<nsIAccessible> cell(GetCellInRowAt(row, aColumn));
+    nsAccessible *cell = GetCellInRowAt(row, aColumn);
     NS_ENSURE_ARG(cell);
 
     if (!nsAccUtils::IsARIASelected(cell))
       return NS_OK;
   }
 
   *aIsSelected = PR_TRUE;
   return NS_OK;
@@ -362,26 +368,30 @@ nsARIAGridAccessible::GetSelectedCellCou
   NS_ENSURE_ARG_POINTER(aCount);
   *aCount = 0;
 
   if (IsDefunct())
     return NS_ERROR_FAILURE;
 
   PRInt32 colCount = 0;
   GetColumnCount(&colCount);
-  
-  nsCOMPtr<nsIAccessible> row;
-  while ((row = GetNextRow(row))) {
+
+  nsAccIterator rowIter(this, nsAccIterator::GetRow);
+
+  nsAccessible *row = nsnull;
+  while ((row = rowIter.GetNext())) {
     if (nsAccUtils::IsARIASelected(row)) {
       (*aCount) += colCount;
       continue;
     }
 
-    nsCOMPtr<nsIAccessible> cell;
-    while ((cell = GetNextCellInRow(row, cell))) {
+    nsAccIterator cellIter(row, nsAccIterator::GetCell);
+    nsAccessible *cell = nsnull;
+
+    while ((cell = cellIter.GetNext())) {
       if (nsAccUtils::IsARIASelected(cell))
         (*aCount)++;
     }
   }
 
   return NS_OK;
 }
 
@@ -395,34 +405,37 @@ NS_IMETHODIMP
 nsARIAGridAccessible::GetSelectedRowCount(PRUint32* aCount)
 {
   NS_ENSURE_ARG_POINTER(aCount);
   *aCount = 0;
 
   if (IsDefunct())
     return NS_ERROR_FAILURE;
 
-  nsCOMPtr<nsIAccessible> row;
-  while ((row = GetNextRow(row))) {
+  nsAccIterator rowIter(this, nsAccIterator::GetRow);
+
+  nsAccessible *row = nsnull;
+  while ((row = rowIter.GetNext())) {
     if (nsAccUtils::IsARIASelected(row)) {
       (*aCount)++;
       continue;
     }
 
-    nsCOMPtr<nsIAccessible> cell = GetNextCellInRow(row);
+    nsAccIterator cellIter(row, nsAccIterator::GetCell);
+    nsAccessible *cell = cellIter.GetNext();
     if (!cell)
       continue;
 
     PRBool isRowSelected = PR_TRUE;
     do {
       if (!nsAccUtils::IsARIASelected(cell)) {
         isRowSelected = PR_FALSE;
         break;
       }
-    } while ((cell = GetNextCellInRow(row, cell)));
+    } while ((cell = cellIter.GetNext()));
 
     if (isRowSelected)
       (*aCount)++;
   }
 
   return NS_OK;
 }
 
@@ -435,28 +448,31 @@ nsARIAGridAccessible::GetSelectedCells(n
   if (IsDefunct())
     return NS_ERROR_FAILURE;
 
   nsresult rv = NS_OK;
   nsCOMPtr<nsIMutableArray> selCells =
     do_CreateInstance(NS_ARRAY_CONTRACTID, &rv);
   NS_ENSURE_SUCCESS(rv, rv);
 
-  nsCOMPtr<nsIAccessible> row;
-  while (row = GetNextRow(row)) {
+  nsAccIterator rowIter(this, nsAccIterator::GetRow);
+
+  nsAccessible *row = nsnull;
+  while (row = rowIter.GetNext()) {
+    nsAccIterator cellIter(row, nsAccIterator::GetCell);
+    nsIAccessible *cell = nsnull;
+
     if (nsAccUtils::IsARIASelected(row)) {
-      nsCOMPtr<nsIAccessible> cell;
-      while (cell = GetNextCellInRow(row, cell))
+      while (cell = cellIter.GetNext())
         selCells->AppendElement(cell, PR_FALSE);
 
       continue;
     }
 
-    nsCOMPtr<nsIAccessible> cell;
-    while (cell = GetNextCellInRow(row, cell)) {
+    while (cell = cellIter.GetNext()) {
       if (nsAccUtils::IsARIASelected(cell))
         selCells->AppendElement(cell, PR_FALSE);
     }
   }
 
   NS_ADDREF(*aCells = selCells);
   return NS_OK;
 }
@@ -476,27 +492,31 @@ nsARIAGridAccessible::GetSelectedCellInd
   PRInt32 rowCount = 0;
   GetRowCount(&rowCount);
 
   PRInt32 colCount = 0;
   GetColumnCount(&colCount);
 
   nsTArray<PRInt32> selCells(rowCount * colCount);
 
-  nsCOMPtr<nsIAccessible> row;
-  for (PRInt32 rowIdx = 0; row = GetNextRow(row); rowIdx++) {
+  nsAccIterator rowIter(this, nsAccIterator::GetRow);
+
+  nsAccessible *row = nsnull;
+  for (PRInt32 rowIdx = 0; row = rowIter.GetNext(); rowIdx++) {
     if (nsAccUtils::IsARIASelected(row)) {
       for (PRInt32 colIdx = 0; colIdx < colCount; colIdx++)
         selCells.AppendElement(rowIdx * colCount + colIdx);
 
       continue;
     }
 
-    nsCOMPtr<nsIAccessible> cell;
-    for (PRInt32 colIdx = 0; cell = GetNextCellInRow(row, cell); colIdx++) {
+    nsAccIterator cellIter(row, nsAccIterator::GetCell);
+    nsAccessible *cell = nsnull;
+
+    for (PRInt32 colIdx = 0; cell = cellIter.GetNext(); colIdx++) {
       if (nsAccUtils::IsARIASelected(cell))
         selCells.AppendElement(rowIdx * colCount + colIdx);
     }
   }
 
   PRUint32 selCellsCount = selCells.Length();
   if (!selCellsCount)
     return NS_OK;
@@ -532,34 +552,37 @@ nsARIAGridAccessible::GetSelectedRowIndi
 
   PRInt32 rowCount = 0;
   GetRowCount(&rowCount);
   if (!rowCount)
     return NS_OK;
 
   nsTArray<PRInt32> selRows(rowCount);
 
-  nsCOMPtr<nsIAccessible> row;
-  for (PRInt32 rowIdx = 0; row = GetNextRow(row); rowIdx++) {
+  nsAccIterator rowIter(this, nsAccIterator::GetRow);
+
+  nsAccessible *row = nsnull;
+  for (PRInt32 rowIdx = 0; row = rowIter.GetNext(); rowIdx++) {
     if (nsAccUtils::IsARIASelected(row)) {
       selRows.AppendElement(rowIdx);
       continue;
     }
 
-    nsCOMPtr<nsIAccessible> cell = GetNextCellInRow(row);
+    nsAccIterator cellIter(row, nsAccIterator::GetCell);
+    nsAccessible *cell = cellIter.GetNext();
     if (!cell)
       continue;
 
     PRBool isRowSelected = PR_TRUE;
     do {
       if (!nsAccUtils::IsARIASelected(cell)) {
         isRowSelected = PR_FALSE;
         break;
       }
-    } while ((cell = GetNextCellInRow(row, cell)));
+    } while ((cell = cellIter.GetNext()));
 
     if (isRowSelected)
       selRows.AppendElement(rowIdx);
   }
 
   PRUint32 selrowCount = selRows.Length();
   if (!selrowCount)
     return NS_OK;
@@ -575,73 +598,79 @@ nsARIAGridAccessible::GetSelectedRowIndi
 NS_IMETHODIMP
 nsARIAGridAccessible::SelectRow(PRInt32 aRow)
 {
   NS_ENSURE_ARG(IsValidRow(aRow));
 
   if (IsDefunct())
     return NS_ERROR_FAILURE;
 
-  nsCOMPtr<nsIAccessible> row;
-  for (PRInt32 rowIdx = 0; row = GetNextRow(row); rowIdx++) {
+  nsAccIterator rowIter(this, nsAccIterator::GetRow);
+
+  nsAccessible *row = nsnull;
+  for (PRInt32 rowIdx = 0; row = rowIter.GetNext(); rowIdx++) {
     nsresult rv = SetARIASelected(row, rowIdx == aRow);
     NS_ENSURE_SUCCESS(rv, rv);
   }
 
   return NS_OK;
 }
 
 NS_IMETHODIMP
 nsARIAGridAccessible::SelectColumn(PRInt32 aColumn)
 {
   NS_ENSURE_ARG(IsValidColumn(aColumn));
 
   if (IsDefunct())
     return NS_ERROR_FAILURE;
 
-  nsCOMPtr<nsIAccessible> row;
-  while ((row = GetNextRow(row))) {
+  nsAccIterator rowIter(this, nsAccIterator::GetRow);
+
+  nsAccessible *row = nsnull;
+  while ((row = rowIter.GetNext())) {
     // Unselect all cells in the row.
     nsresult rv = SetARIASelected(row, PR_FALSE);
     NS_ENSURE_SUCCESS(rv, rv);
 
     // Select cell at the column index.
-    nsCOMPtr<nsIAccessible> cell = GetCellInRowAt(row, aColumn);
+    nsAccessible *cell = GetCellInRowAt(row, aColumn);
     if (cell) {
       rv = SetARIASelected(cell, PR_TRUE);
       NS_ENSURE_SUCCESS(rv, rv);
     }
   }
 
   return NS_OK;
 }
 
 NS_IMETHODIMP
 nsARIAGridAccessible::UnselectRow(PRInt32 aRow)
 {
   if (IsDefunct())
     return NS_ERROR_FAILURE;
 
-  nsCOMPtr<nsIAccessible> row = GetRowAt(aRow);
+  nsAccessible *row = GetRowAt(aRow);
   NS_ENSURE_ARG(row);
 
   return SetARIASelected(row, PR_FALSE);
 }
 
 NS_IMETHODIMP
 nsARIAGridAccessible::UnselectColumn(PRInt32 aColumn)
 {
   NS_ENSURE_ARG(IsValidColumn(aColumn));
 
   if (IsDefunct())
     return NS_ERROR_FAILURE;
 
-  nsCOMPtr<nsIAccessible> row;
-  while ((row = GetNextRow(row))) {
-    nsCOMPtr<nsIAccessible> cell = GetCellInRowAt(row, aColumn);
+  nsAccIterator rowIter(this, nsAccIterator::GetRow);
+
+  nsAccessible *row = nsnull;
+  while ((row = rowIter.GetNext())) {
+    nsAccessible *cell = GetCellInRowAt(row, aColumn);
     if (cell) {
       nsresult rv = SetARIASelected(cell, PR_FALSE);
       NS_ENSURE_SUCCESS(rv, rv);
     }
   }
 
   return NS_OK;
 }
@@ -691,94 +720,49 @@ nsARIAGridAccessible::IsValidRowNColumn(
   if (aRow >= rowCount)
     return PR_FALSE;
 
   PRInt32 colCount = 0;
   GetColumnCount(&colCount);
   return aColumn < colCount;
 }
 
-already_AddRefed<nsIAccessible>
+nsAccessible*
 nsARIAGridAccessible::GetRowAt(PRInt32 aRow)
 {
   PRInt32 rowIdx = aRow;
-  nsCOMPtr<nsIAccessible> row(GetNextRow());
-  while (rowIdx != 0 && (row = GetNextRow(row)))
+
+  nsAccIterator rowIter(this, nsAccIterator::GetRow);
+
+  nsAccessible *row = rowIter.GetNext();
+  while (rowIdx != 0 && (row = rowIter.GetNext()))
     rowIdx--;
 
-  return row.forget();
-}
-
-already_AddRefed<nsIAccessible>
-nsARIAGridAccessible::GetCellInRowAt(nsIAccessible *aRow, PRInt32 aColumn)
-{
-  PRInt32 colIdx = aColumn;
-  nsCOMPtr<nsIAccessible> cell(GetNextCellInRow(aRow));
-  while (colIdx != 0 && (cell = GetNextCellInRow(aRow, cell)))
-    colIdx--;
-
-  return cell.forget();
+  return row;
 }
 
-already_AddRefed<nsIAccessible>
-nsARIAGridAccessible::GetNextRow(nsIAccessible *aRow)
+nsAccessible*
+nsARIAGridAccessible::GetCellInRowAt(nsAccessible *aRow, PRInt32 aColumn)
 {
-  nsCOMPtr<nsIAccessible> nextRow, tmpAcc;
-  if (!aRow)
-    GetFirstChild(getter_AddRefs(nextRow));
-  else
-    aRow->GetNextSibling(getter_AddRefs(nextRow));
-
-  while (nextRow) {
-    if (nsAccUtils::Role(nextRow) == nsIAccessibleRole::ROLE_ROW)
-      return nextRow.forget();
-
-    nextRow->GetNextSibling(getter_AddRefs(tmpAcc));
-    tmpAcc.swap(nextRow);
-  }
-
-  return nsnull;
-}
+  PRInt32 colIdx = aColumn;
 
-already_AddRefed<nsIAccessible>
-nsARIAGridAccessible::GetNextCellInRow(nsIAccessible *aRow, nsIAccessible *aCell)
-{
-  if (!aRow)
-    return nsnull;
-
-  nsCOMPtr<nsIAccessible> nextCell, tmpAcc;
-  if (!aCell)
-    aRow->GetFirstChild(getter_AddRefs(nextCell));
-  else
-    aCell->GetNextSibling(getter_AddRefs(nextCell));
+  nsAccIterator cellIter(aRow, nsAccIterator::GetCell);
+  nsAccessible *cell = cellIter.GetNext();
+  while (colIdx != 0 && (cell = cellIter.GetNext()))
+    colIdx--;
 
-  while (nextCell) {
-    PRUint32 role = nsAccUtils::Role(nextCell);
-    if (role == nsIAccessibleRole::ROLE_GRID_CELL ||
-        role == nsIAccessibleRole::ROLE_ROWHEADER ||
-        role == nsIAccessibleRole::ROLE_COLUMNHEADER)
-      return nextCell.forget();
-
-    nextCell->GetNextSibling(getter_AddRefs(tmpAcc));
-    tmpAcc.swap(nextCell);
-  }
-
-  return nsnull;
+  return cell;
 }
 
 nsresult
-nsARIAGridAccessible::SetARIASelected(nsIAccessible *aAccessible,
+nsARIAGridAccessible::SetARIASelected(nsAccessible *aAccessible,
                                       PRBool aIsSelected, PRBool aNotify)
 {
-  nsRefPtr<nsAccessible> acc = do_QueryObject(aAccessible);
-  nsCOMPtr<nsIDOMNode> node;
-  acc->GetDOMNode(getter_AddRefs(node));
-  NS_ENSURE_STATE(node);
-
-  nsCOMPtr<nsIContent> content(do_QueryInterface(node));
+  nsCOMPtr<nsIContent> content(do_QueryInterface(aAccessible->GetDOMNode()));
+  NS_ENSURE_STATE(content);
 
   nsresult rv = NS_OK;
   if (aIsSelected)
     rv = content->SetAttr(kNameSpaceID_None, nsAccessibilityAtoms::aria_selected,
                           NS_LITERAL_STRING("true"), aNotify);
   else
     rv = content->UnsetAttr(kNameSpaceID_None,
                             nsAccessibilityAtoms::aria_selected, aNotify);
@@ -795,40 +779,42 @@ nsARIAGridAccessible::SetARIASelected(ns
   if (aIsSelected)
     return NS_OK;
 
   PRUint32 role = nsAccUtils::Role(aAccessible);
 
   // If the given accessible is row that was unselected then remove
   // aria-selected from cell accessible.
   if (role == nsIAccessibleRole::ROLE_ROW) {
-    nsCOMPtr<nsIAccessible> cell;
-    while ((cell = GetNextCellInRow(aAccessible, cell))) {
+    nsAccIterator cellIter(aAccessible, nsAccIterator::GetCell);
+    nsAccessible *cell = nsnull;
+
+    while ((cell = cellIter.GetNext())) {
       rv = SetARIASelected(cell, PR_FALSE, PR_FALSE);
       NS_ENSURE_SUCCESS(rv, rv);
     }
     return NS_OK;
   }
 
   // If the given accessible is cell that was unselected and its row is selected
   // then remove aria-selected from row and put aria-selected on
   // siblings cells.
   if (role == nsIAccessibleRole::ROLE_GRID_CELL ||
       role == nsIAccessibleRole::ROLE_ROWHEADER ||
       role == nsIAccessibleRole::ROLE_COLUMNHEADER) {
-    nsCOMPtr<nsIAccessible> row;
-    aAccessible->GetParent(getter_AddRefs(row));
+    nsAccessible *row = aAccessible->GetParent();
 
     if (nsAccUtils::Role(row) == nsIAccessibleRole::ROLE_ROW &&
         nsAccUtils::IsARIASelected(row)) {
       rv = SetARIASelected(row, PR_FALSE, PR_FALSE);
       NS_ENSURE_SUCCESS(rv, rv);
 
-      nsCOMPtr<nsIAccessible> cell;
-      while ((cell = GetNextCellInRow(row, cell))) {
+      nsAccIterator cellIter(row, nsAccIterator::GetCell);
+      nsAccessible *cell = nsnull;
+      while ((cell = cellIter.GetNext())) {
         if (cell != aAccessible) {
           rv = SetARIASelected(cell, PR_TRUE, PR_FALSE);
           NS_ENSURE_SUCCESS(rv, rv);
         }
       }
     }
   }
 
@@ -842,17 +828,18 @@ nsARIAGridAccessible::GetSelectedColumns
   NS_ENSURE_ARG_POINTER(acolumnCount);
   *acolumnCount = 0;
   if (aColumns)
     *aColumns = nsnull;
 
   if (IsDefunct())
     return NS_ERROR_FAILURE;
 
-  nsCOMPtr<nsIAccessible> row = GetNextRow();
+  nsAccIterator rowIter(this, nsAccIterator::GetRow);
+  nsAccessible *row = rowIter.GetNext();
   if (!row)
     return NS_OK;
 
   PRInt32 colCount = 0;
   GetColumnCount(&colCount);
   if (!colCount)
     return NS_OK;
 
@@ -863,25 +850,27 @@ nsARIAGridAccessible::GetSelectedColumns
   for (PRInt32 i = 0; i < selColCount; i++)
     isColSelArray[i] = PR_TRUE;
 
   do {
     if (nsAccUtils::IsARIASelected(row))
       continue;
 
     PRInt32 colIdx = 0;
-    nsCOMPtr<nsIAccessible> cell;
-    for (colIdx = 0; cell = GetNextCellInRow(row, cell); colIdx++) {
+
+    nsAccIterator cellIter(row, nsAccIterator::GetCell);
+    nsAccessible *cell = nsnull;
+    for (colIdx = 0; cell = cellIter.GetNext(); colIdx++) {
       if (isColSelArray.SafeElementAt(colIdx, PR_FALSE) &&
           !nsAccUtils::IsARIASelected(cell)) {
         isColSelArray[colIdx] = PR_FALSE;
         selColCount--;
       }
     }
-  } while ((row = GetNextRow(row)));
+  } while ((row = rowIter.GetNext()));
 
   if (!selColCount)
     return NS_OK;
 
   if (!aColumns) {
     *acolumnCount = selColCount;
     return NS_OK;
   }
@@ -1125,52 +1114,48 @@ nsARIAGridCellAccessible::GetAttributesI
   if (IsDefunct())
     return NS_ERROR_FAILURE;
   
   nsresult rv = nsHyperTextAccessibleWrap::GetAttributesInternal(aAttributes);
   NS_ENSURE_SUCCESS(rv, rv);
 
   // Expose "table-cell-index" attribute.
 
-  nsCOMPtr<nsIAccessible> thisRow;
-  GetParent(getter_AddRefs(thisRow));
+  nsAccessible *thisRow = GetParent();
   if (nsAccUtils::Role(thisRow) != nsIAccessibleRole::ROLE_ROW)
     return NS_OK;
 
   PRInt32 colIdx = 0, colCount = 0;
-  nsCOMPtr<nsIAccessible> child, nextChild;
-  thisRow->GetFirstChild(getter_AddRefs(child));
-  while (child) {
+  PRInt32 childCount = thisRow->GetChildCount();
+  for (PRInt32 childIdx = 0; childIdx < childCount; childIdx++) {
+    nsAccessible *child = thisRow->GetChildAt(childIdx);
     if (child == this)
       colIdx = colCount;
 
     PRUint32 role = nsAccUtils::Role(child);
     if (role == nsIAccessibleRole::ROLE_GRID_CELL ||
         role == nsIAccessibleRole::ROLE_ROWHEADER ||
         role == nsIAccessibleRole::ROLE_COLUMNHEADER)
       colCount++;
-
-    child->GetNextSibling(getter_AddRefs(nextChild));
-    child.swap(nextChild);
   }
 
-  nsCOMPtr<nsIAccessible> table;
-  thisRow->GetParent(getter_AddRefs(table));
+  nsAccessible *table = thisRow->GetParent();
   if (nsAccUtils::Role(table) != nsIAccessibleRole::ROLE_TABLE &&
       nsAccUtils::Role(table) != nsIAccessibleRole::ROLE_TREE_TABLE)
     return NS_OK;
 
   PRInt32 rowIdx = 0;
-  table->GetFirstChild(getter_AddRefs(child));
-  while (child && child != thisRow) {
+  childCount = table->GetChildCount();
+  for (PRInt32 childIdx = 0; childIdx < childCount; childIdx++) {
+    nsAccessible *child = table->GetChildAt(childIdx);
+    if (child == thisRow)
+      break;
+
     if (nsAccUtils::Role(child) == nsIAccessibleRole::ROLE_ROW)
       rowIdx++;
-
-    child->GetNextSibling(getter_AddRefs(nextChild));
-    child.swap(nextChild);
   }
 
   PRInt32 idx = rowIdx * colCount + colIdx;
 
   nsAutoString stringIdx;
   stringIdx.AppendInt(idx);
   nsAccUtils::SetAccAttr(aAttributes, nsAccessibilityAtoms::tableCellIndex,
                          stringIdx);
--- a/accessible/src/base/nsARIAGridAccessible.h
+++ b/accessible/src/base/nsARIAGridAccessible.h
@@ -72,51 +72,32 @@ protected:
   /**
    * Retrun true if given row and column indexes are valid.
    */
   PRBool IsValidRowNColumn(PRInt32 aRow, PRInt32 aColumn);
 
   /**
    * Return row accessible at the given row index.
    */
-  already_AddRefed<nsIAccessible> GetRowAt(PRInt32 aRow);
+  nsAccessible *GetRowAt(PRInt32 aRow);
 
   /**
    * Return cell accessible at the given column index in the row.
    */
-  already_AddRefed<nsIAccessible> GetCellInRowAt(nsIAccessible *aRow,
-                                                 PRInt32 aColumn);
-
-  /**
-   * Return next row accessible relative given row accessible or first row
-   * accessible if it is null.
-   *
-   * @param  aRow  [in, optional] row accessible
-   */
-  already_AddRefed<nsIAccessible> GetNextRow(nsIAccessible *aRow = nsnull);
-
-  /**
-   * Return next cell accessible relative given cell accessible or first cell
-   * in the given row accessible if given cell accessible is null.
-   *
-   * @param  aRow   [in] row accessible
-   * @param  aCell  [in, optional] cell accessible
-   */
-  already_AddRefed<nsIAccessible> GetNextCellInRow(nsIAccessible *aRow,
-                                                   nsIAccessible *aCell = nsnull);
+  nsAccessible *GetCellInRowAt(nsAccessible *aRow, PRInt32 aColumn);
 
   /**
    * Set aria-selected attribute value on DOM node of the given accessible.
    *
    * @param  aAccessible  [in] accessible
    * @param  aIsSelected  [in] new value of aria-selected attribute
    * @param  aNotify      [in, optional] specifies if DOM should be notified
    *                       about attribute change (used internally).
    */
-  nsresult SetARIASelected(nsIAccessible *aAccessible, PRBool aIsSelected,
+  nsresult SetARIASelected(nsAccessible *aAccessible, PRBool aIsSelected,
                            PRBool aNotify = PR_TRUE);
 
   /**
    * Helper method for GetSelectedColumnCount and GetSelectedColumns.
    */
   nsresult GetSelectedColumnsArray(PRUint32 *acolumnCount,
                                    PRInt32 **aColumns = nsnull);
 };
--- a/accessible/src/base/nsAccEvent.cpp
+++ b/accessible/src/base/nsAccEvent.cpp
@@ -251,17 +251,17 @@ nsAccEvent::CaptureIsFromUserInput(EIsFr
   if (aIsFromUserInput != eAutoDetect) {
     mIsFromUserInput = aIsFromUserInput == eFromUserInput ? PR_TRUE : PR_FALSE;
     return;
   }
 
   if (!targetNode)
     return;
 
-  nsCOMPtr<nsIPresShell> presShell = nsCoreUtils::GetPresShellFor(targetNode);
+  nsIPresShell *presShell = nsCoreUtils::GetPresShellFor(targetNode);
   if (!presShell) {
     NS_NOTREACHED("Threre should always be an pres shell for an event");
     return;
   }
 
   nsIEventStateManager *esm = presShell->GetPresContext()->EventStateManager();
   if (!esm) {
     NS_NOTREACHED("There should always be an ESM for an event");
@@ -309,21 +309,26 @@ nsAccReorderEvent::HasAccessibleInReason
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsAccStateChangeEvent
 ////////////////////////////////////////////////////////////////////////////////
 
 NS_IMPL_ISUPPORTS_INHERITED1(nsAccStateChangeEvent, nsAccEvent,
                              nsIAccessibleStateChangeEvent)
 
+// Note: we pass in eAllowDupes to the base class because we don't currently
+// support correct state change coalescence (XXX Bug 569356). Also we need to
+// decide how to coalesce events created via accessible (instead of node).
 nsAccStateChangeEvent::
   nsAccStateChangeEvent(nsIAccessible *aAccessible,
                         PRUint32 aState, PRBool aIsExtraState,
-                        PRBool aIsEnabled):
-  nsAccEvent(::nsIAccessibleEvent::EVENT_STATE_CHANGE, aAccessible),
+                        PRBool aIsEnabled, PRBool aIsAsynch,
+                        EIsFromUserInput aIsFromUserInput):
+  nsAccEvent(nsIAccessibleEvent::EVENT_STATE_CHANGE, aAccessible, aIsAsynch,
+             aIsFromUserInput, eAllowDupes),
   mState(aState), mIsExtraState(aIsExtraState), mIsEnabled(aIsEnabled)
 {
 }
 
 nsAccStateChangeEvent::
   nsAccStateChangeEvent(nsIDOMNode *aNode,
                         PRUint32 aState, PRBool aIsExtraState,
                         PRBool aIsEnabled):
@@ -374,22 +379,30 @@ nsAccStateChangeEvent::IsEnabled(PRBool 
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsAccTextChangeEvent
 ////////////////////////////////////////////////////////////////////////////////
 
 NS_IMPL_ISUPPORTS_INHERITED1(nsAccTextChangeEvent, nsAccEvent,
                              nsIAccessibleTextChangeEvent)
 
+// Note: we pass in eAllowDupes to the base class because we don't support text
+// events coalescence. We fire delayed text change events in nsDocAccessible but
+// we continue to base the event off the accessible object rather than just the
+// node. This means we won't try to create an accessible based on the node when
+// we are ready to fire the event and so we will no longer assert at that point
+// if the node was removed from the document. Either way, the AT won't work with
+// a defunct accessible so the behaviour should be equivalent.
+// XXX revisit this when coalescence is faster (eCoalesceFromSameSubtree)
 nsAccTextChangeEvent::
   nsAccTextChangeEvent(nsIAccessible *aAccessible,
                        PRInt32 aStart, PRUint32 aLength, PRBool aIsInserted,
                        PRBool aIsAsynch, EIsFromUserInput aIsFromUserInput) :
   nsAccEvent(aIsInserted ? nsIAccessibleEvent::EVENT_TEXT_INSERTED : nsIAccessibleEvent::EVENT_TEXT_REMOVED,
-             aAccessible, aIsAsynch, aIsFromUserInput),
+             aAccessible, aIsAsynch, aIsFromUserInput, eAllowDupes),
   mStart(aStart), mLength(aLength), mIsInserted(aIsInserted)
 {
 #ifdef XP_WIN
   nsCOMPtr<nsIAccessibleText> textAccessible = do_QueryInterface(aAccessible);
   NS_ASSERTION(textAccessible, "Should not be firing test change event for non-text accessible!!!");
   if (textAccessible) {
     textAccessible->GetText(aStart, aStart + aLength, mModifiedText);
   }
--- a/accessible/src/base/nsAccEvent.h
+++ b/accessible/src/base/nsAccEvent.h
@@ -193,17 +193,18 @@ NS_DEFINE_STATIC_IID_ACCESSOR(nsAccReord
 
 
 class nsAccStateChangeEvent: public nsAccEvent,
                              public nsIAccessibleStateChangeEvent
 {
 public:
   nsAccStateChangeEvent(nsIAccessible *aAccessible,
                         PRUint32 aState, PRBool aIsExtraState,
-                        PRBool aIsEnabled);
+                        PRBool aIsEnabled, PRBool aIsAsynch = PR_FALSE,
+                        EIsFromUserInput aIsFromUserInput = eAutoDetect);
 
   nsAccStateChangeEvent(nsIDOMNode *aNode,
                         PRUint32 aState, PRBool aIsExtraState,
                         PRBool aIsEnabled);
 
   nsAccStateChangeEvent(nsIDOMNode *aNode,
                         PRUint32 aState, PRBool aIsExtraState);
 
new file mode 100644
--- /dev/null
+++ b/accessible/src/base/nsAccIterator.cpp
@@ -0,0 +1,93 @@
+/* ***** BEGIN LICENSE BLOCK *****
+ * Version: MPL 1.1/GPL 2.0/LGPL 2.1
+ *
+ * The contents of this file are subject to the Mozilla Public License Version
+ * 1.1 (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ * http://www.mozilla.org/MPL/
+ *
+ * Software distributed under the License is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
+ * for the specific language governing rights and limitations under the
+ * License.
+ *
+ * The Original Code is mozilla.org code.
+ *
+ * The Initial Developer of the Original Code is
+ * Mozilla Foundation.
+ * Portions created by the Initial Developer are Copyright (C) 2010
+ * the Initial Developer. All Rights Reserved.
+ *
+ * Contributor(s):
+ *  Alexander Surkov <surkov.alexander@gmail.com> (original author)
+ *
+ * Alternatively, the contents of this file may be used under the terms of
+ * either the GNU General Public License Version 2 or later (the "GPL"), or
+ * the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
+ * in which case the provisions of the GPL or the LGPL are applicable instead
+ * of those above. If you wish to allow use of your version of this file only
+ * under the terms of either the GPL or the LGPL, and not to allow others to
+ * use your version of this file under the terms of the MPL, indicate your
+ * decision by deleting the provisions above and replace them with the notice
+ * and other provisions required by the GPL or the LGPL. If you do not delete
+ * the provisions above, a recipient may use your version of this file under
+ * the terms of any one of the MPL, the GPL or the LGPL.
+ *
+ * ***** END LICENSE BLOCK ***** */
+
+#include "nsAccIterator.h"
+
+////////////////////////////////////////////////////////////////////////////////
+// nsAccIterator
+
+nsAccIterator::nsAccIterator(nsAccessible *aAccessible,
+                             AccIteratorFilterFuncPtr aFilterFunc,
+                             IterationType aIterationType) :
+  mFilterFunc(aFilterFunc), mIsDeep(aIterationType != eFlatNav)
+{
+  mState = new IteratorState(aAccessible);
+}
+
+nsAccIterator::~nsAccIterator()
+{
+  while (mState) {
+    IteratorState *tmp = mState;
+    mState = tmp->mParentState;
+    delete tmp;
+  }
+}
+
+nsAccessible*
+nsAccIterator::GetNext()
+{
+  while (mState) {
+    nsAccessible *child = mState->mParent->GetChildAt(mState->mIndex++);
+    if (!child) {
+      IteratorState *tmp = mState;
+      mState = mState->mParentState;
+      delete tmp;
+
+      continue;
+    }
+
+    PRBool isComplying = mFilterFunc(child);
+    if (isComplying)
+      return child;
+
+    if (mIsDeep) {
+      IteratorState *childState = new IteratorState(child, mState);
+      mState = childState;
+    }
+  }
+
+  return nsnull;
+}
+
+////////////////////////////////////////////////////////////////////////////////
+// nsAccIterator::IteratorState
+
+nsAccIterator::IteratorState::IteratorState(nsAccessible *aParent,
+                                            IteratorState *mParentState) :
+  mParent(aParent), mIndex(0), mParentState(mParentState)
+{
+}
new file mode 100644
--- /dev/null
+++ b/accessible/src/base/nsAccIterator.h
@@ -0,0 +1,124 @@
+/* ***** BEGIN LICENSE BLOCK *****
+ * Version: MPL 1.1/GPL 2.0/LGPL 2.1
+ *
+ * The contents of this file are subject to the Mozilla Public License Version
+ * 1.1 (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ * http://www.mozilla.org/MPL/
+ *
+ * Software distributed under the License is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
+ * for the specific language governing rights and limitations under the
+ * License.
+ *
+ * The Original Code is mozilla.org code.
+ *
+ * The Initial Developer of the Original Code is
+ * Mozilla Foundation.
+ * Portions created by the Initial Developer are Copyright (C) 2010
+ * the Initial Developer. All Rights Reserved.
+ *
+ * Contributor(s):
+ *  Alexander Surkov <surkov.alexander@gmail.com> (original author)
+ *
+ * Alternatively, the contents of this file may be used under the terms of
+ * either the GNU General Public License Version 2 or later (the "GPL"), or
+ * the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
+ * in which case the provisions of the GPL or the LGPL are applicable instead
+ * of those above. If you wish to allow use of your version of this file only
+ * under the terms of either the GPL or the LGPL, and not to allow others to
+ * use your version of this file under the terms of the MPL, indicate your
+ * decision by deleting the provisions above and replace them with the notice
+ * and other provisions required by the GPL or the LGPL. If you do not delete
+ * the provisions above, a recipient may use your version of this file under
+ * the terms of any one of the MPL, the GPL or the LGPL.
+ *
+ * ***** END LICENSE BLOCK ***** */
+
+#ifndef nsAccIterator_h_
+#define nsAccIterator_h_
+
+#include "nsAccessible.h"
+#include "nsAccUtils.h"
+
+/**
+ * Return true if the traversed accessible complies with filter.
+ */
+typedef PRBool (*AccIteratorFilterFuncPtr) (nsAccessible *);
+
+/**
+ * Allows to iterate through accessible children or subtree complying with
+ * filter function.
+ */
+class nsAccIterator
+{
+public:
+  /**
+   * Used to define iteration type.
+   */
+  enum IterationType {
+    /**
+     * Navigation happens through direct children.
+     */
+    eFlatNav,
+
+    /**
+     * Navigation through subtree excluding iterator root; if the accessible
+     * complies with filter, iterator ignores its children.
+     */
+    eTreeNav
+  };
+
+  nsAccIterator(nsAccessible *aRoot, AccIteratorFilterFuncPtr aFilterFunc,
+                IterationType aIterationType = eFlatNav);
+  ~nsAccIterator();
+
+  /**
+   * Return next accessible complying with filter function. Return the first
+   * accessible for the first time.
+   */
+  nsAccessible *GetNext();
+
+  /**
+   * Predefined filters.
+   */
+  static PRBool GetSelected(nsAccessible *aAccessible)
+  {
+    return nsAccUtils::State(aAccessible) & nsIAccessibleStates::STATE_SELECTED;
+  }
+  static PRBool GetSelectable(nsAccessible *aAccessible)
+  {
+    return nsAccUtils::State(aAccessible) & nsIAccessibleStates::STATE_SELECTABLE;
+  }
+  static PRBool GetRow(nsAccessible *aAccessible)
+  {
+    return nsAccUtils::Role(aAccessible) == nsIAccessibleRole::ROLE_ROW;
+  }
+  static PRBool GetCell(nsAccessible *aAccessible)
+  {
+    PRUint32 role = nsAccUtils::Role(aAccessible);
+    return role == nsIAccessibleRole::ROLE_GRID_CELL ||
+           role == nsIAccessibleRole::ROLE_ROWHEADER ||
+           role == nsIAccessibleRole::ROLE_COLUMNHEADER;
+  }
+
+private:
+  nsAccIterator();
+  nsAccIterator(const nsAccIterator&);
+  nsAccIterator& operator =(const nsAccIterator&);
+
+  struct IteratorState
+  {
+    IteratorState(nsAccessible *aParent, IteratorState *mParentState = nsnull);
+
+    nsAccessible *mParent;
+    PRInt32 mIndex;
+    IteratorState *mParentState;
+  };
+
+  AccIteratorFilterFuncPtr mFilterFunc;
+  PRBool mIsDeep;
+  IteratorState *mState;
+};
+
+#endif
--- a/accessible/src/base/nsAccUtils.cpp
+++ b/accessible/src/base/nsAccUtils.cpp
@@ -118,17 +118,17 @@ nsAccUtils::GetDefaultLevel(nsAccessible
   }
 
   return 0;
 }
 
 PRInt32
 nsAccUtils::GetARIAOrDefaultLevel(nsIAccessible *aAcc)
 {
-  nsRefPtr<nsAccessible> acc = nsAccUtils::QueryObject<nsAccessible>(aAcc);
+  nsRefPtr<nsAccessible> acc = do_QueryObject(aAcc);
   NS_ENSURE_TRUE(acc, 0);
 
   nsCOMPtr<nsIDOMNode> node;
   acc->GetDOMNode(getter_AddRefs(node));
   nsCOMPtr<nsIContent> content(do_QueryInterface(node));
   NS_ENSURE_TRUE(content, 0);
 
   PRInt32 level = 0;
@@ -347,17 +347,17 @@ nsAccUtils::HasAccessibleChildren(nsIDOM
 {
   if (!aNode)
     return PR_FALSE;
 
   nsCOMPtr<nsIContent> content(do_QueryInterface(aNode));
   if (!content)
     return PR_FALSE;
 
-  nsCOMPtr<nsIPresShell> presShell = nsCoreUtils::GetPresShellFor(aNode);
+  nsIPresShell *presShell = nsCoreUtils::GetPresShellFor(aNode);
   if (!presShell)
     return PR_FALSE;
 
   nsIFrame *frame = content->GetPrimaryFrame();
   if (!frame)
     return PR_FALSE;
 
   nsCOMPtr<nsIWeakReference> weakShell(do_GetWeakReference(presShell));
@@ -547,56 +547,56 @@ nsAccUtils::IsARIASelected(nsIAccessible
 
 already_AddRefed<nsIAccessibleText>
 nsAccUtils::GetTextAccessibleFromSelection(nsISelection *aSelection,
                                            nsIDOMNode **aNode)
 {
   // Get accessible from selection's focus DOM point (the DOM point where
   // selection is ended).
 
-  nsCOMPtr<nsIDOMNode> focusNode;
-  aSelection->GetFocusNode(getter_AddRefs(focusNode));
-  if (!focusNode)
+  nsCOMPtr<nsIDOMNode> focusDOMNode;
+  aSelection->GetFocusNode(getter_AddRefs(focusDOMNode));
+  if (!focusDOMNode)
     return nsnull;
 
   PRInt32 focusOffset = 0;
   aSelection->GetFocusOffset(&focusOffset);
 
-  nsCOMPtr<nsIDOMNode> resultNode =
+  nsCOMPtr<nsINode> focusNode(do_QueryInterface(focusDOMNode));
+  nsCOMPtr<nsINode> resultNode =
     nsCoreUtils::GetDOMNodeFromDOMPoint(focusNode, focusOffset);
 
   // Get text accessible containing the result node.
   while (resultNode) {
     // Make sure to get the correct starting node for selection events inside
     // XBL content trees.
-    nsCOMPtr<nsIDOMNode> relevantNode;
-    GetAccService()->GetRelevantContentNodeFor(resultNode, 
-                                               getter_AddRefs(relevantNode));
-    if (relevantNode)
-      resultNode.swap(relevantNode);
+    nsCOMPtr<nsIDOMNode> resultDOMNode(do_QueryInterface(resultNode));
+    nsCOMPtr<nsIDOMNode> relevantDOMNode;
+    GetAccService()->GetRelevantContentNodeFor(resultDOMNode,
+                                               getter_AddRefs(relevantDOMNode));
+    if (relevantDOMNode) {
+      resultNode = do_QueryInterface(relevantDOMNode);
+      resultDOMNode.swap(relevantDOMNode);
+    }
 
-    nsCOMPtr<nsIContent> content = do_QueryInterface(resultNode);
-    if (!content || !content->IsNodeOfType(nsINode::eTEXT)) {
-      nsCOMPtr<nsIAccessible> accessible;
-      GetAccService()->GetAccessibleFor(resultNode, getter_AddRefs(accessible));
+    if (!resultNode || !resultNode->IsNodeOfType(nsINode::eTEXT)) {
+      nsAccessible *accessible = GetAccService()->GetAccessible(resultDOMNode);
       if (accessible) {
         nsIAccessibleText *textAcc = nsnull;
         CallQueryInterface(accessible, &textAcc);
         if (textAcc) {
           if (aNode)
-            NS_ADDREF(*aNode = resultNode);
+            resultDOMNode.forget(aNode);
 
           return textAcc;
         }
       }
     }
 
-    nsCOMPtr<nsIDOMNode> parentNode;
-    resultNode->GetParentNode(getter_AddRefs(parentNode));
-    resultNode.swap(parentNode);
+    resultNode = resultNode->GetParent();
   }
 
   NS_NOTREACHED("No nsIAccessibleText for selection change event!");
 
   return nsnull;
 }
 
 nsresult
@@ -784,78 +784,77 @@ nsAccUtils::GetLiveAttrValue(PRUint32 aR
   }
 
   return PR_FALSE;
 }
 
 #ifdef DEBUG_A11Y
 
 PRBool
-nsAccUtils::IsTextInterfaceSupportCorrect(nsIAccessible *aAccessible)
+nsAccUtils::IsTextInterfaceSupportCorrect(nsAccessible *aAccessible)
 {
   PRBool foundText = PR_FALSE;
   
-  nsCOMPtr<nsIAccessibleDocument> accDoc = do_QueryInterface(aAccessible);
+  nsCOMPtr<nsIAccessibleDocument> accDoc = do_QueryObject(aAccessible);
   if (accDoc) {
     // Don't test for accessible docs, it makes us create accessibles too
     // early and fire mutation events before we need to
     return PR_TRUE;
   }
 
-  nsCOMPtr<nsIAccessible> child, nextSibling;
-  aAccessible->GetFirstChild(getter_AddRefs(child));
-  while (child) {
+  PRInt32 childCount = aAccessible->GetChildCount();
+  for (PRint32 childIdx = 0; childIdx < childCount; childIdx++) {
+    nsAccessible *child = GetChildAt(childIdx);
     if (IsText(child)) {
       foundText = PR_TRUE;
       break;
     }
-    child->GetNextSibling(getter_AddRefs(nextSibling));
-    child.swap(nextSibling);
   }
 
   if (foundText) {
     // found text child node
-    nsCOMPtr<nsIAccessibleText> text = do_QueryInterface(aAccessible);
+    nsCOMPtr<nsIAccessibleText> text = do_QueryObject(aAccessible);
     if (!text)
       return PR_FALSE;
   }
 
   return PR_TRUE; 
 }
 #endif
 
-PRInt32
-nsAccUtils::TextLength(nsIAccessible *aAccessible)
+PRUint32
+nsAccUtils::TextLength(nsAccessible *aAccessible)
 {
   if (!IsText(aAccessible))
     return 1;
-  
-  nsRefPtr<nsAccessNode> accNode = do_QueryObject(aAccessible);
-  
-  nsIFrame *frame = accNode->GetFrame();
+
+  nsIFrame *frame = aAccessible->GetFrame();
   if (frame && frame->GetType() == nsAccessibilityAtoms::textFrame) {
     // Ensure that correct text length is calculated (with non-rendered
     // whitespace chars not counted).
     nsIContent *content = frame->GetContent();
     if (content) {
       PRUint32 length;
       nsresult rv = nsHyperTextAccessible::
         ContentToRenderedOffset(frame, content->TextLength(), &length);
-      return NS_SUCCEEDED(rv) ? static_cast<PRInt32>(length) : -1;
+      if (NS_FAILED(rv)) {
+        NS_NOTREACHED("Failed to get rendered offset!");
+        return 0;
+      }
+
+      return length;
     }
   }
-  
+
   // For list bullets (or anything other accessible which would compute its own
   // text. They don't have their own frame.
   // XXX In the future, list bullets may have frame and anon content, so 
   // we should be able to remove this at that point
-  nsRefPtr<nsAccessible> acc(do_QueryObject(aAccessible));
-
   nsAutoString text;
-  acc->AppendTextTo(text, 0, PR_UINT32_MAX); // Get all the text
+  aAccessible->AppendTextTo(text, 0, PR_UINT32_MAX); // Get all the text
   return text.Length();
 }
 
 PRBool
 nsAccUtils::MustPrune(nsIAccessible *aAccessible)
 { 
   PRUint32 role = nsAccUtils::Role(aAccessible);
 
--- a/accessible/src/base/nsAccUtils.h
+++ b/accessible/src/base/nsAccUtils.h
@@ -314,69 +314,38 @@ public:
    *
    * @param  aRule   [in] rule constant (see ELiveAttrRule in nsAccMap.h)
    * @param  aValue  [out] object attribute value
    *
    * @return         true if object attribute should be exposed
    */
   static PRBool GetLiveAttrValue(PRUint32 aRule, nsAString& aValue);
 
-  /**
-   * Query DestinationType from the given SourceType.
-   */
-  template<class DestinationType, class SourceType> static inline
-    already_AddRefed<DestinationType> QueryObject(SourceType *aObject)
-  {
-    DestinationType* object = nsnull;
-    if (aObject)
-      CallQueryInterface(aObject, &object);
-
-    return object;
-  }
-  template<class DestinationType, class SourceType> static inline
-    already_AddRefed<DestinationType> QueryObject(nsCOMPtr<SourceType>& aObject)
-  {
-    DestinationType* object = nsnull;
-    if (aObject)
-      CallQueryInterface(aObject, &object);
-
-    return object;
-  }
-  template<class DestinationType, class SourceType> static inline
-  already_AddRefed<DestinationType> QueryObject(nsRefPtr<SourceType>& aObject)
-  {
-    DestinationType* object = nsnull;
-    if (aObject)
-      CallQueryInterface(aObject.get(), &object);
-    
-    return object;
-  }
-
 #ifdef DEBUG_A11Y
   /**
    * Detect whether the given accessible object implements nsIAccessibleText,
    * when it is text or has text child node.
    */
-  static PRBool IsTextInterfaceSupportCorrect(nsIAccessible *aAccessible);
+  static PRBool IsTextInterfaceSupportCorrect(nsAccessible *aAccessible);
 #endif
 
   /**
    * Return true if the given accessible has text role.
    */
   static PRBool IsText(nsIAccessible *aAcc)
   {
     PRUint32 role = Role(aAcc);
     return role == nsIAccessibleRole::ROLE_TEXT_LEAF ||
            role == nsIAccessibleRole::ROLE_STATICTEXT;
   }
 
   /**
-   * Return text length of the given accessible, return -1 on failure.
+   * Return text length of the given accessible, return 0 on failure.
    */
-  static PRInt32 TextLength(nsIAccessible *aAccessible);
+  static PRUint32 TextLength(nsAccessible *aAccessible);
 
   /**
    * Return true if the given accessible is embedded object.
    */
   static PRBool IsEmbeddedObject(nsIAccessible *aAcc)
   {
     PRUint32 role = Role(aAcc);
     return role != nsIAccessibleRole::ROLE_TEXT_LEAF &&
--- a/accessible/src/base/nsAccessNode.cpp
+++ b/accessible/src/base/nsAccessNode.cpp
@@ -143,58 +143,53 @@ nsAccessNode::Init()
 {
   // We have to put this here, instead of constructor, otherwise
   // we don't have the virtual GetUniqueID() method for the hash key.
   // We need that for accessibles that don't have DOM nodes
 
 #ifdef DEBUG_A11Y
   NS_ASSERTION(!mIsInitialized, "Initialized twice!");
 #endif
-  nsCOMPtr<nsIAccessibleDocument> docAccessible(GetDocAccessible());
-  if (!docAccessible) {
+  nsRefPtr<nsDocAccessible> docAcc = GetDocAccessible();
+  if (!docAcc) {
     // No doc accessible yet for this node's document. 
     // There was probably an accessible event fired before the 
     // current document was ever asked for by the assistive technology.
     // Create a doc accessible so we can cache this node
     nsCOMPtr<nsIPresShell> presShell(do_QueryReferent(mWeakShell));
     if (presShell) {
       nsCOMPtr<nsIDOMNode> docNode(do_QueryInterface(presShell->GetDocument()));
       if (docNode) {
-        nsCOMPtr<nsIAccessible> accessible;
-        GetAccService()->GetAccessibleInShell(docNode, presShell,
-                                              getter_AddRefs(accessible));
-        docAccessible = do_QueryInterface(accessible);
+        nsAccessible *accessible =
+          GetAccService()->GetAccessibleInWeakShell(docNode, mWeakShell);
+        docAcc = do_QueryObject(accessible);
       }
     }
-    NS_ASSERTION(docAccessible, "Cannot cache new nsAccessNode");
-    if (!docAccessible) {
+    NS_ASSERTION(docAcc, "Cannot cache new nsAccessNode");
+    if (!docAcc) {
       return NS_ERROR_FAILURE;
     }
   }
 
   void* uniqueID;
   GetUniqueID(&uniqueID);
-  nsRefPtr<nsDocAccessible> docAcc = do_QueryObject(docAccessible);
-  NS_ASSERTION(docAcc, "No nsDocAccessible for document accessible!");
 
   if (!docAcc->CacheAccessNode(uniqueID, this))
     return NS_ERROR_OUT_OF_MEMORY;
 
   // Make sure an ancestor in real content is cached
   // so that nsDocAccessible::RefreshNodes() can find the anonymous subtree to release when
   // the root node goes away
   nsCOMPtr<nsIContent> content = do_QueryInterface(mDOMNode);
   if (content && content->IsInAnonymousSubtree()) {
     // Specific examples of where this is used: <input type="file"> and <xul:findbar>
-    nsCOMPtr<nsIAccessible> parentAccessible;
-    docAccessible->GetAccessibleInParentChain(mDOMNode, PR_TRUE, getter_AddRefs(parentAccessible));
-    if (parentAccessible) {
-      PRInt32 childCountUnused;
-      parentAccessible->GetChildCount(&childCountUnused);
-    }
+    nsAccessible *parent = GetAccService()->GetContainerAccessible(mDOMNode,
+                                                                   PR_TRUE);
+    if (parent)
+      parent->EnsureChildren();
   }
 
 #ifdef DEBUG_A11Y
   mIsInitialized = PR_TRUE;
 #endif
 
   return NS_OK;
 }
@@ -251,17 +246,17 @@ nsAccessNode::GetApplicationAccessible()
   }
 
   return gApplicationAccessible;
 }
 
 void nsAccessNode::InitXPAccessibility()
 {
   nsCOMPtr<nsIStringBundleService> stringBundleService =
-    do_GetService(NS_STRINGBUNDLE_CONTRACTID);
+    mozilla::services::GetStringBundleService();
   if (stringBundleService) {
     // Static variables are released in ShutdownAllXPAccessibility();
     stringBundleService->CreateBundle(ACCESSIBLE_BUNDLE_URL, 
                                       &gStringBundle);
     stringBundleService->CreateBundle(PLATFORM_KEYS_BUNDLE_URL, 
                                       &gKeyStringBundle);
   }
 
@@ -396,18 +391,17 @@ nsAccessNode::IsInCache()
     nsAccessNode::GetDocAccessibleFor(mWeakShell);
 
   if (!accessibleDoc)
     return nsnull;
 
   void* uniqueID = nsnull;
   GetUniqueID(&uniqueID);
 
-  nsRefPtr<nsDocAccessible> docAccessible =
-    nsAccUtils::QueryObject<nsDocAccessible>(accessibleDoc);
+  nsRefPtr<nsDocAccessible> docAccessible = do_QueryObject(accessibleDoc);
   return docAccessible->GetCachedAccessNode(uniqueID) ? PR_TRUE : PR_FALSE;
 }
 #endif
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsIAccessNode
 
 NS_IMETHODIMP
@@ -506,22 +500,18 @@ nsAccessNode::ScrollToPoint(PRUint32 aCo
 nsresult
 nsAccessNode::MakeAccessNode(nsIDOMNode *aNode, nsIAccessNode **aAccessNode)
 {
   *aAccessNode = nsnull;
   
   nsCOMPtr<nsIAccessNode> accessNode =
     GetAccService()->GetCachedAccessNode(aNode, mWeakShell);
 
-  if (!accessNode) {
-    nsRefPtr<nsAccessible> accessible =
-      GetAccService()->GetAccessibleInWeakShell(aNode, mWeakShell);
-
-    accessNode = accessible;
-  }
+  if (!accessNode)
+    accessNode = GetAccService()->GetAccessibleInWeakShell(aNode, mWeakShell);
 
   if (accessNode) {
     NS_ADDREF(*aAccessNode = accessNode);
     return NS_OK;
   }
 
   nsAccessNode *newAccessNode = new nsAccessNode(aNode, mWeakShell);
   if (!newAccessNode) {
@@ -703,32 +693,31 @@ nsAccessNode::GetDocAccessibleFor(nsIDoc
     CallQueryInterface(accessible, &docAccessible);
   }
   return docAccessible;
 }
  
 nsDocAccessible*
 nsAccessNode::GetDocAccessibleFor(nsIDOMNode *aNode)
 {
-  nsCOMPtr<nsIPresShell> eventShell = nsCoreUtils::GetPresShellFor(aNode);
-  if (eventShell) {
-    return GetDocAccessibleFor(eventShell->GetDocument());
-  }
+  nsIPresShell *presShell = nsCoreUtils::GetPresShellFor(aNode);
+  if (presShell)
+    return GetDocAccessibleFor(presShell->GetDocument());
 
   nsCOMPtr<nsIDocument> doc(do_QueryInterface(aNode));
   if (doc) {
     return GetDocAccessibleFor(doc);
   }
 
   return nsnull;
 }
 
 already_AddRefed<nsIDOMNode> nsAccessNode::GetCurrentFocus()
 {
-  nsCOMPtr<nsIPresShell> shell = nsCoreUtils::GetPresShellFor(mDOMNode);
+  nsIPresShell *shell = nsCoreUtils::GetPresShellFor(mDOMNode);
   NS_ENSURE_TRUE(shell, nsnull);
   nsCOMPtr<nsIDocument> doc = shell->GetDocument();
   NS_ENSURE_TRUE(doc, nsnull);
 
   nsIDOMWindow* win = doc->GetWindow();
 
   nsCOMPtr<nsIDOMWindow> focusedWindow;
   nsCOMPtr<nsIDOMElement> focusedElement;
--- a/accessible/src/base/nsAccessNode.h
+++ b/accessible/src/base/nsAccessNode.h
@@ -130,16 +130,21 @@ class nsAccessNode: public nsIAccessNode
     virtual nsresult Shutdown();
 
     /**
      * Return frame for the given access node object.
      */
     virtual nsIFrame* GetFrame();
 
   /**
+   * Return DOM node associated with this accessible.
+   */
+  nsIDOMNode *GetDOMNode() const { return mDOMNode; }
+
+  /**
    * Return the corresponding press shell for this accessible.
    */
   already_AddRefed<nsIPresShell> GetPresShell();
 
   /**
    * Return true if the accessible still has presentation shell. Light-weight
    * version of IsDefunct() method.
    */
--- a/accessible/src/base/nsAccessibilityAtomList.h
+++ b/accessible/src/base/nsAccessibilityAtomList.h
@@ -190,16 +190,17 @@ ACCESSIBILITY_ATOM(popup, "popup")
 ACCESSIBILITY_ATOM(readonly, "readonly")
 ACCESSIBILITY_ATOM(scope, "scope") // HTML table
 ACCESSIBILITY_ATOM(simple, "simple") // XLink
 ACCESSIBILITY_ATOM(src, "src")
 ACCESSIBILITY_ATOM(selected, "selected")
 ACCESSIBILITY_ATOM(summary, "summary")
 ACCESSIBILITY_ATOM(tabindex, "tabindex")
 ACCESSIBILITY_ATOM(title, "title")
+ACCESSIBILITY_ATOM(toolbarname, "toolbarname")
 ACCESSIBILITY_ATOM(tooltiptext, "tooltiptext")
 ACCESSIBILITY_ATOM(type, "type")
 ACCESSIBILITY_ATOM(usemap, "usemap")
 ACCESSIBILITY_ATOM(value, "value")
 
   // Alphabetical list of object attributes
 ACCESSIBILITY_ATOM(checkable, "checkable")
 ACCESSIBILITY_ATOM(display, "display")
--- a/accessible/src/base/nsAccessibilityService.cpp
+++ b/accessible/src/base/nsAccessibilityService.cpp
@@ -105,25 +105,29 @@
 #include "nsHTMLWin32ObjectAccessible.h"
 #endif
 
 #ifndef DISABLE_XFORMS_HOOKS
 #include "nsXFormsFormControlsAccessible.h"
 #include "nsXFormsWidgetsAccessible.h"
 #endif
 
+#include "mozilla/FunctionTimer.h"
+
 ////////////////////////////////////////////////////////////////////////////////
 // nsAccessibilityService
 ////////////////////////////////////////////////////////////////////////////////
 
 nsAccessibilityService *nsAccessibilityService::gAccessibilityService = nsnull;
 PRBool nsAccessibilityService::gIsShutdown = PR_TRUE;
 
 nsAccessibilityService::nsAccessibilityService()
 {
+  NS_TIME_FUNCTION;
+
   // Add observers.
   nsCOMPtr<nsIObserverService> observerService =
     mozilla::services::GetObserverService();
   if (!observerService)
     return;
 
   observerService->AddObserver(this, NS_XPCOM_SHUTDOWN_OBSERVER_ID, PR_FALSE);
   nsCOMPtr<nsIWebProgress> progress(do_GetService(NS_DOCUMENTLOADER_SERVICE_CONTRACTID));
@@ -259,33 +263,30 @@ nsAccessibilityService::NotifyOfAnchorJu
 {
   nsIDocument *document = aTarget->GetCurrentDoc();
   nsCOMPtr<nsIDOMNode> documentNode(do_QueryInterface(document));
   if (!documentNode)
     return;
 
   nsCOMPtr<nsIDOMNode> targetNode(do_QueryInterface(aTarget));
 
-  nsCOMPtr<nsIAccessible> targetAcc;
-  GetAccessibleFor(targetNode, getter_AddRefs(targetAcc));
+  nsAccessible *targetAcc = GetAccessible(targetNode);
 
   // Getting the targetAcc above will have ensured accessible doc creation.
   // XXX Bug 561683
   nsRefPtr<nsDocAccessible> accessibleDoc =
     nsAccessNode::GetDocAccessibleFor(documentNode);
   if (!accessibleDoc)
     return;
 
   // If the jump target is not accessible then fire an event for nearest
   // accessible in parent chain.
   if (!targetAcc) {
-        accessibleDoc->GetAccessibleInParentChain(targetNode, PR_TRUE,
-                                                  getter_AddRefs(targetAcc));
-        nsCOMPtr<nsIAccessNode> accNode = do_QueryInterface(targetAcc);
-        accNode->GetDOMNode(getter_AddRefs(targetNode));
+    targetAcc = GetContainerAccessible(targetNode, PR_TRUE);
+    targetNode = targetAcc->GetDOMNode();
   }
 
   NS_ASSERTION(targetNode,
       "No accessible in parent chain!? Expect at least a document accessible.");
   if (!targetNode)
     return;
 
   // XXX note in rare cases the node could go away before we flush the queue,
@@ -982,18 +983,17 @@ nsAccessibilityService::GetCachedAccessN
                                             nsIWeakReference *aWeakShell)
 {
   nsCOMPtr<nsIAccessibleDocument> accessibleDoc =
     nsAccessNode::GetDocAccessibleFor(aWeakShell);
 
   if (!accessibleDoc)
     return nsnull;
 
-  nsRefPtr<nsDocAccessible> docAccessible =
-    nsAccUtils::QueryObject<nsDocAccessible>(accessibleDoc);
+  nsRefPtr<nsDocAccessible> docAccessible = do_QueryObject(accessibleDoc);
   return docAccessible->GetCachedAccessNode(static_cast<void*>(aNode));
 }
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsIAccessibleRetrieval
 
 NS_IMETHODIMP
 nsAccessibilityService::GetApplicationAccessible(nsIAccessible **aAccessibleApplication)
@@ -1168,42 +1168,18 @@ nsAccessibilityService::GetStringRelatio
   * GetAccessibleFor - get an nsIAccessible from a DOM node
   */
 
 NS_IMETHODIMP
 nsAccessibilityService::GetAccessibleFor(nsIDOMNode *aNode,
                                          nsIAccessible **aAccessible)
 {
   NS_ENSURE_ARG_POINTER(aAccessible);
-  *aAccessible = nsnull;
 
-  NS_ENSURE_ARG(aNode);
-
-  nsCOMPtr<nsIContent> content(do_QueryInterface(aNode));
-  nsCOMPtr<nsIDocument> doc;
-  if (content) {
-    doc = content->GetDocument();
-  }
-  else {// Could be document node
-    doc = do_QueryInterface(aNode);
-  }
-  if (!doc)
-    return NS_ERROR_FAILURE;
-
-  // We use presentation shell #0 because we assume that is presentation of
-  // given node window.
-  nsIPresShell *presShell = doc->GetPrimaryShell();
-
-  nsCOMPtr<nsIWeakReference> weakShell(do_GetWeakReference(presShell));
-  nsRefPtr<nsAccessible> accessible =
-    GetAccessible(aNode, presShell, weakShell);
-
-  if (accessible)
-    CallQueryInterface(accessible.get(), aAccessible);
-  
+  NS_IF_ADDREF(*aAccessible = GetAccessible(aNode));
   return NS_OK;
 }
 
 NS_IMETHODIMP
 nsAccessibilityService::GetAttachedAccessibleFor(nsIDOMNode *aNode,
                                                  nsIAccessible **aAccessible)
 {
   NS_ENSURE_ARG(aNode);
@@ -1216,49 +1192,105 @@ nsAccessibilityService::GetAttachedAcces
   NS_ENSURE_SUCCESS(rv, rv);
 
   if (relevantNode != aNode)
     return NS_OK;
 
   return GetAccessibleFor(aNode, aAccessible);
 }
 
-NS_IMETHODIMP
+nsAccessible*
 nsAccessibilityService::GetAccessibleInShell(nsIDOMNode *aNode, 
-                                             nsIPresShell *aPresShell,
-                                             nsIAccessible **aAccessible) 
+                                             nsIPresShell *aPresShell) 
 {
-  NS_ENSURE_ARG_POINTER(aAccessible);
-  *aAccessible = nsnull;
-
-  NS_ENSURE_ARG(aNode);
-  NS_ENSURE_ARG(aPresShell);
+  if (!aNode || !aPresShell)
+    return nsnull;
 
   nsCOMPtr<nsIWeakReference> weakShell(do_GetWeakReference(aPresShell));
   nsRefPtr<nsAccessible> accessible =
     GetAccessible(aNode, aPresShell, weakShell);
-
-  if (accessible)
-    CallQueryInterface(accessible.get(), aAccessible);
-  
-  return NS_OK;
+  return accessible;
 }
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsAccessibilityService public
 
-already_AddRefed<nsAccessible>
+nsAccessible *
+nsAccessibilityService::GetAccessible(nsIDOMNode *aNode)
+{
+  if (!aNode)
+    return nsnull;
+
+  nsIPresShell *presShell = nsCoreUtils::GetPresShellFor(aNode);
+  if (!presShell)
+    return nsnull;
+
+  nsCOMPtr<nsIWeakReference> weakShell(do_GetWeakReference(presShell));
+  nsRefPtr<nsAccessible> accessible = GetAccessible(aNode, presShell,
+                                                    weakShell);
+  return accessible;
+}
+
+nsAccessible *
 nsAccessibilityService::GetAccessibleInWeakShell(nsIDOMNode *aNode, 
                                                  nsIWeakReference *aWeakShell) 
 {
   if (!aNode || !aWeakShell)
     return nsnull;
 
   nsCOMPtr<nsIPresShell> presShell(do_QueryReferent(aWeakShell));
-  return GetAccessible(aNode, presShell, aWeakShell);
+  nsRefPtr<nsAccessible> accessible = GetAccessible(aNode, presShell,
+                                                    aWeakShell);
+  return accessible;
+}
+
+nsAccessible *
+nsAccessibilityService::GetContainerAccessible(nsIDOMNode *aNode,
+                                               PRBool aCanCreate)
+{
+  if (!aNode)
+    return nsnull;
+
+  nsCOMPtr<nsINode> currNode(do_QueryInterface(aNode));
+  nsIDocument *document = currNode->GetCurrentDoc();
+  if (!document)
+    return nsnull;
+
+  nsIPresShell *presShell = document->GetPrimaryShell();
+  if (!presShell)
+    return nsnull;
+
+  nsCOMPtr<nsIWeakReference> weakShell(do_GetWeakReference(presShell));
+
+  nsAccessible *accessible = nsnull;
+  while (!accessible && (currNode = currNode->GetNodeParent())) {
+    nsCOMPtr<nsIDOMNode> currDOMNode(do_QueryInterface(currNode));
+
+    nsCOMPtr<nsIDOMNode> relevantDOMNode;
+    GetAccService()->GetRelevantContentNodeFor(currDOMNode,
+                                               getter_AddRefs(relevantDOMNode));
+    if (relevantDOMNode) {
+      currNode = do_QueryInterface(relevantDOMNode);
+      currDOMNode.swap(relevantDOMNode);
+    }
+
+    if (aCanCreate) {
+      accessible =
+        GetAccService()->GetAccessibleInWeakShell(currDOMNode, weakShell);
+
+    } else {
+      // Only return cached accessible, don't create anything.
+      nsRefPtr<nsAccessible> cachedAcc =
+        do_QueryObject(GetCachedAccessNode(currDOMNode, weakShell));
+
+      accessible = cachedAcc;
+    }
+  }
+
+  return accessible;
 }
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsAccessibilityService private
 
 PRBool
 nsAccessibilityService::InitAccessible(nsAccessible *aAccessible,
                                        nsRoleMapEntry *aRoleMapEntry)
@@ -1341,18 +1373,17 @@ nsAccessibilityService::GetAccessible(ns
 #endif
 
   // Check to see if we already have an accessible for this node in the cache.
   nsAccessNode* cachedAccessNode = GetCachedAccessNode(aNode, aWeakShell);
   if (cachedAccessNode) {
     // XXX: the cache might contain the access node for the DOM node that is not
     // accessible because of wrong cache update. In this case try to create new
     // accessible.
-    nsRefPtr<nsAccessible> cachedAccessible =
-      nsAccUtils::QueryObject<nsAccessible>(cachedAccessNode);
+    nsRefPtr<nsAccessible> cachedAccessible = do_QueryObject(cachedAccessNode);
 
     if (cachedAccessible)
       return cachedAccessible.forget();
   }
 
   // No cache entry, so we must create the accessible.
   nsRefPtr<nsAccessible> newAcc;
 
@@ -1426,17 +1457,17 @@ nsAccessibilityService::GetAccessible(ns
 
         return nsnull;
       }
     }
     if (weakFrame.IsAlive()) {
       nsCOMPtr<nsIAccessible> newAccessible;
       weakFrame.GetFrame()->GetAccessible(getter_AddRefs(newAccessible));
       if (newAccessible) {
-        newAcc = nsAccUtils::QueryObject<nsAccessible>(newAccessible);
+        newAcc = do_QueryObject(newAccessible);
         if (InitAccessible(newAcc, nsnull))
           return newAcc.forget();
         return nsnull;
       }
     }
 
     return nsnull;
   }
@@ -1493,17 +1524,17 @@ nsAccessibilityService::GetAccessible(ns
       nsIContent *tableContent = content;
       while ((tableContent = tableContent->GetParent()) != nsnull) {
         nsIFrame *tableFrame = tableContent->GetPrimaryFrame();
         if (!tableFrame)
           continue;
 
         if (tableFrame->GetType() == nsAccessibilityAtoms::tableOuterFrame) {
           nsCOMPtr<nsIDOMNode> tableNode(do_QueryInterface(tableContent));
-          nsRefPtr<nsAccessible> tableAccessible =
+          nsAccessible *tableAccessible =
             GetAccessibleInWeakShell(tableNode, aWeakShell);
 
           if (tableAccessible) {
             if (!roleMapEntry) {
               PRUint32 role = nsAccUtils::Role(tableAccessible);
               if (role != nsIAccessibleRole::ROLE_TABLE &&
                   role != nsIAccessibleRole::ROLE_TREE_TABLE) {
                 // No ARIA role and not in table: override role. For example,
@@ -1594,17 +1625,17 @@ nsAccessibilityService::GetAccessible(ns
             *aIsHidden = PR_TRUE;
 
           return nsnull;
         }
 
         // Try using frame to do it.
         nsCOMPtr<nsIAccessible> newAccessible;
         f->GetAccessible(getter_AddRefs(newAccessible));
-        newAcc = nsAccUtils::QueryObject<nsAccessible>(newAccessible);
+        newAcc = do_QueryObject(newAccessible);
       }
     }
   }
 
   if (!newAcc) {
     // Elements may implement nsIAccessibleProvider via XBL. This allows them to
     // say what kind of accessible to create.
     newAcc = CreateAccessibleByType(aNode, aWeakShell);
@@ -1763,38 +1794,37 @@ nsAccessibilityService::GetAreaAccessibl
 
   // Try to get image map accessible from the global cache or create it
   // if failed.
   nsRefPtr<nsAccessible> imageAcc;
 
   nsCOMPtr<nsIDOMNode> imageNode(do_QueryInterface(aImageFrame->GetContent()));
   nsAccessNode *cachedImgAcc = GetCachedAccessNode(imageNode, aWeakShell);
   if (cachedImgAcc)
-    imageAcc = nsAccUtils::QueryObject<nsAccessible>(cachedImgAcc);
+    imageAcc = do_QueryObject(cachedImgAcc);
 
   if (!imageAcc) {
     nsCOMPtr<nsIAccessible> imageAccessible;
     CreateHTMLImageAccessible(aImageFrame,
                               getter_AddRefs(imageAccessible));
 
-    imageAcc = nsAccUtils::QueryObject<nsAccessible>(imageAccessible);
+    imageAcc = do_QueryObject(imageAccessible);
     if (!InitAccessible(imageAcc, nsnull))
       return nsnull;
   }
 
   // Make sure <area> accessible children of the image map are cached so
   // that they should be available in global cache.
   imageAcc->EnsureChildren();
 
   nsAccessNode *cachedAreaAcc = GetCachedAccessNode(aAreaNode, aWeakShell);
   if (!cachedAreaAcc)
     return nsnull;
 
-  nsRefPtr<nsAccessible> areaAcc =
-    nsAccUtils::QueryObject<nsAccessible>(cachedAreaAcc);
+  nsRefPtr<nsAccessible> areaAcc = do_QueryObject(cachedAreaAcc);
   return areaAcc.forget();
 }
 
 already_AddRefed<nsAccessible>
 nsAccessibilityService::CreateAccessibleByType(nsIDOMNode *aNode,
                                                nsIWeakReference *aWeakShell)
 {
   nsCOMPtr<nsIAccessibleProvider> accessibleProvider(do_QueryInterface(aNode));
@@ -1922,22 +1952,22 @@ nsAccessibilityService::CreateAccessible
       accessible = new nsXULRadioButtonAccessible(aNode, aWeakShell);
       break;
     case nsIAccessibleProvider::XULRadioGroup:
       accessible = new nsXULRadioGroupAccessible(aNode, aWeakShell);
       break;
     case nsIAccessibleProvider::XULTab:
       accessible = new nsXULTabAccessible(aNode, aWeakShell);
       break;
-    case nsIAccessibleProvider::XULTabBox:
-      accessible = new nsXULTabBoxAccessible(aNode, aWeakShell);
-      break;
     case nsIAccessibleProvider::XULTabs:
       accessible = new nsXULTabsAccessible(aNode, aWeakShell);
       break;
+    case nsIAccessibleProvider::XULTabpanels:
+      accessible = new nsXULTabpanelsAccessible(aNode, aWeakShell);
+      break;
     case nsIAccessibleProvider::XULText:
       accessible = new nsXULTextAccessible(aNode, aWeakShell);
       break;
     case nsIAccessibleProvider::XULTextBox:
       accessible = new nsXULTextFieldAccessible(aNode, aWeakShell);
       break;
     case nsIAccessibleProvider::XULThumb:
       accessible = new nsXULThumbAccessible(aNode, aWeakShell);
@@ -1969,17 +1999,17 @@ nsAccessibilityService::CreateAccessible
     // XForms elements
     case nsIAccessibleProvider::XFormsContainer:
       accessible = new nsXFormsContainerAccessible(aNode, aWeakShell);
       break;
 
     case nsIAccessibleProvider::XFormsLabel:
       accessible = new nsXFormsLabelAccessible(aNode, aWeakShell);
       break;
-    case nsIAccessibleProvider::XFormsOuput:
+    case nsIAccessibleProvider::XFormsOutput:
       accessible = new nsXFormsOutputAccessible(aNode, aWeakShell);
       break;
     case nsIAccessibleProvider::XFormsTrigger:
       accessible = new nsXFormsTriggerAccessible(aNode, aWeakShell);
       break;
     case nsIAccessibleProvider::XFormsInput:
       accessible = new nsXFormsInputAccessible(aNode, aWeakShell);
       break;
--- a/accessible/src/base/nsAccessibilityService.h
+++ b/accessible/src/base/nsAccessibilityService.h
@@ -71,16 +71,19 @@ public:
   virtual ~nsAccessibilityService();
 
   NS_DECL_ISUPPORTS
   NS_DECL_NSIACCESSIBLERETRIEVAL
   NS_DECL_NSIOBSERVER
   NS_DECL_NSIWEBPROGRESSLISTENER
 
   // nsIAccessibilityService
+  virtual nsAccessible* GetAccessibleInShell(nsIDOMNode *aNode,
+                                             nsIPresShell *aPresShell);
+
   virtual nsresult CreateOuterDocAccessible(nsIDOMNode *aNode,
                                             nsIAccessible **aAccessible);
   virtual nsresult CreateHTML4ButtonAccessible(nsIFrame *aFrame,
                                                nsIAccessible **aAccessible);
   virtual nsresult CreateHyperTextAccessible(nsIFrame *aFrame,
                                              nsIAccessible **aAccessible);
   virtual nsresult CreateHTMLBRAccessible(nsIFrame *aFrame,
                                           nsIAccessible **aAccessible);
@@ -165,23 +168,37 @@ public:
    * @param  aIsHidden   [out, optional] indicates whether the node's frame is
    *                       hidden
    */
   already_AddRefed<nsAccessible>
     GetAccessible(nsIDOMNode *aNode, nsIPresShell *aPresShell,
                   nsIWeakReference *aWeakShell, PRBool *aIsHidden = nsnull);
 
   /**
+   * Return an accessible for the given DOM node.
+   */
+  nsAccessible *GetAccessible(nsIDOMNode *aNode);
+
+  /**
    * Return an accessible for a DOM node in the given pres shell.
    * 
    * @param aNode       [in] the given node.
    * @param aPresShell  [in] the presentation shell of the given node.
    */
-  already_AddRefed<nsAccessible>
-    GetAccessibleInWeakShell(nsIDOMNode *aNode, nsIWeakReference *aPresShell);
+  nsAccessible *GetAccessibleInWeakShell(nsIDOMNode *aNode,
+                                         nsIWeakReference *aPresShell);
+
+  /**
+   * Return the first accessible parent of a DOM node.
+   *
+   * @param aDOMNode    [in] the DOM node to get an accessible for
+   * @param aCanCreate  [in] specifies if accessible can be created if it didn't
+   *                     exist
+   */
+  nsAccessible *GetContainerAccessible(nsIDOMNode *aNode, PRBool aCanCreate);
 
   /**
    * Return an access node for the DOM node in the given presentation shell if
    * the access node already exists, otherwise null.
    *
    * @param  aNode       [in] the DOM node to get an access node for
    * @param  aPresShell  [in] the presentation shell which contains layout info
    *                       for the DOM node
--- a/accessible/src/base/nsAccessible.cpp
+++ b/accessible/src/base/nsAccessible.cpp
@@ -36,16 +36,17 @@
  * the terms of any one of the MPL, the GPL or the LGPL.
  *
  * ***** END LICENSE BLOCK ***** */
 
 #include "nsAccessible.h"
 
 #include "nsIXBLAccessible.h"
 
+#include "nsAccIterator.h"
 #include "nsAccUtils.h"
 #include "nsARIAMap.h"
 #include "nsDocAccessible.h"
 #include "nsEventShell.h"
 
 #include "nsAccessibilityService.h"
 #include "nsAccTreeWalker.h"
 #include "nsRelUtils.h"
@@ -170,20 +171,20 @@ nsresult nsAccessible::QueryInterface(RE
     if (mRoleMapEntry && mRoleMapEntry->valueRule != eNoValue) {
       *aInstancePtr = static_cast<nsIAccessibleValue*>(this);
       NS_ADDREF_THIS();
       return NS_OK;
     }
   }                       
 
   if (aIID.Equals(NS_GET_IID(nsIAccessibleHyperLink))) {
-    nsCOMPtr<nsIAccessibleHyperText> hyperTextParent =
-      nsAccUtils::QueryObject<nsIAccessibleHyperText>(GetParent());
-
-    if (hyperTextParent) {
+    // Every embedded accessible within hypertext accessible implements
+    // hyperlink interface.
+    nsCOMPtr<nsIAccessibleHyperText> hyperTextParent = do_QueryObject(GetParent());
+    if (hyperTextParent && nsAccUtils::IsEmbeddedObject(this)) {
       *aInstancePtr = static_cast<nsIAccessibleHyperLink*>(this);
       NS_ADDREF_THIS();
       return NS_OK;
     }
     return NS_ERROR_NO_INTERFACE;
   }
 
   return nsAccessNodeWrap::QueryInterface(aIID, aInstancePtr);
@@ -853,23 +854,21 @@ nsAccessible::GetChildAtPoint(PRInt32 aX
   nsCOMPtr<nsIDOMNode> relevantNode;
   GetAccService()->GetRelevantContentNodeFor(node,
                                              getter_AddRefs(relevantNode));
   if (!relevantNode) {
     NS_IF_ADDREF(*aChild = fallbackAnswer);
     return NS_OK;
   }
 
-  nsCOMPtr<nsIAccessible> accessible;
-  GetAccService()->GetAccessibleFor(relevantNode, getter_AddRefs(accessible));
+  nsAccessible *accessible = GetAccService()->GetAccessible(relevantNode);
   if (!accessible) {
     // No accessible for the node with the point, so find the first
     // accessible in the DOM parent chain
-    accDocument->GetAccessibleInParentChain(relevantNode, PR_TRUE,
-                                            getter_AddRefs(accessible));
+    accessible = GetAccService()->GetContainerAccessible(relevantNode, PR_TRUE);
     if (!accessible) {
       NS_IF_ADDREF(*aChild = fallbackAnswer);
       return NS_OK;
     }
   }
 
   if (accessible == this) {
     // Manually walk through accessible children and see if the are within this
@@ -2461,99 +2460,74 @@ nsAccessible::DispatchClickEvent(nsICont
   PRBool res = nsCoreUtils::DispatchMouseEvent(NS_MOUSE_BUTTON_DOWN, presShell,
                                                aContent);
   if (!res)
     return;
 
   nsCoreUtils::DispatchMouseEvent(NS_MOUSE_BUTTON_UP, presShell, aContent);
 }
 
-already_AddRefed<nsIAccessible>
-nsAccessible::GetNextWithState(nsIAccessible *aStart, PRUint32 matchState)
-{
-  // Return the next descendant that matches one of the states in matchState
-  // Uses depth first search
-  NS_ASSERTION(matchState, "GetNextWithState() not called with a state to match");
-  NS_ASSERTION(aStart, "GetNextWithState() not called with an accessible to start with");
-  nsCOMPtr<nsIAccessible> look, current = aStart;
-  PRUint32 state = 0;
-  while (0 == (state & matchState)) {
-    current->GetFirstChild(getter_AddRefs(look));
-    while (!look) {
-      if (current == this) {
-        return nsnull; // At top of subtree
-      }
-      current->GetNextSibling(getter_AddRefs(look));
-      if (!look) {
-        current->GetParent(getter_AddRefs(look));
-        current = look;
-        look = nsnull;
-        continue;
-      }
-    }
-    current.swap(look);
-    state = nsAccUtils::State(current);
-  }
-
-  nsIAccessible *returnAccessible = nsnull;
-  current.swap(returnAccessible);
-
-  return returnAccessible;
-}
-
 // nsIAccessibleSelectable
 NS_IMETHODIMP nsAccessible::GetSelectedChildren(nsIArray **aSelectedAccessibles)
 {
   *aSelectedAccessibles = nsnull;
 
   nsCOMPtr<nsIMutableArray> selectedAccessibles =
     do_CreateInstance(NS_ARRAY_CONTRACTID);
   NS_ENSURE_STATE(selectedAccessibles);
 
-  nsCOMPtr<nsIAccessible> selected = this;
-  while ((selected = GetNextWithState(selected, nsIAccessibleStates::STATE_SELECTED)) != nsnull) {
+  nsAccIterator iter(this, nsAccIterator::GetSelected, nsAccIterator::eTreeNav);
+  nsIAccessible *selected = nsnull;
+  while ((selected = iter.GetNext()))
     selectedAccessibles->AppendElement(selected, PR_FALSE);
-  }
 
   PRUint32 length = 0;
   selectedAccessibles->GetLength(&length); 
   if (length) { // length of nsIArray containing selected options
     *aSelectedAccessibles = selectedAccessibles;
     NS_ADDREF(*aSelectedAccessibles);
   }
 
   return NS_OK;
 }
 
 // return the nth selected descendant nsIAccessible object
 NS_IMETHODIMP nsAccessible::RefSelection(PRInt32 aIndex, nsIAccessible **aSelected)
 {
+  NS_ENSURE_ARG_POINTER(aSelected);
   *aSelected = nsnull;
+
   if (aIndex < 0) {
-    return NS_ERROR_FAILURE;
+    return NS_ERROR_INVALID_ARG;
   }
-  nsCOMPtr<nsIAccessible> selected = this;
+
+  nsAccIterator iter(this, nsAccIterator::GetSelected, nsAccIterator::eTreeNav);
+  nsAccessible *selected = nsnull;
+
   PRInt32 count = 0;
   while (count ++ <= aIndex) {
-    selected = GetNextWithState(selected, nsIAccessibleStates::STATE_SELECTED);
+    selected = iter.GetNext();
     if (!selected) {
-      return NS_ERROR_FAILURE; // aIndex out of range
+      // The index is out of range.
+      return NS_ERROR_INVALID_ARG;
     }
   }
   NS_IF_ADDREF(*aSelected = selected);
   return NS_OK;
 }
 
 NS_IMETHODIMP nsAccessible::GetSelectionCount(PRInt32 *aSelectionCount)
 {
+  NS_ENSURE_ARG_POINTER(aSelectionCount);
   *aSelectionCount = 0;
-  nsCOMPtr<nsIAccessible> selected = this;
-  while ((selected = GetNextWithState(selected, nsIAccessibleStates::STATE_SELECTED)) != nsnull) {
-    ++ *aSelectionCount;
-  }
+
+  nsAccIterator iter(this, nsAccIterator::GetSelected, nsAccIterator::eTreeNav);
+  nsAccessible *selected = nsnull;
+  while ((selected = iter.GetNext()))
+    ++(*aSelectionCount);
 
   return NS_OK;
 }
 
 NS_IMETHODIMP nsAccessible::AddChildToSelection(PRInt32 aIndex)
 {
   // Tree views and other container widgets which may have grandchildren should
   // implement a selection methods for their specific interfaces, because being
@@ -2599,31 +2573,34 @@ NS_IMETHODIMP nsAccessible::IsChildSelec
   nsAccessible* child = GetChildAt(aIndex);
   PRUint32 state = nsAccUtils::State(child);
   if (state & nsIAccessibleStates::STATE_SELECTED) {
     *aIsSelected = PR_TRUE;
   }
   return NS_OK;
 }
 
-NS_IMETHODIMP nsAccessible::ClearSelection()
+NS_IMETHODIMP
+nsAccessible::ClearSelection()
 {
-  nsCOMPtr<nsIAccessible> selected = this;
-  while ((selected = GetNextWithState(selected, nsIAccessibleStates::STATE_SELECTED)) != nsnull) {
+  nsAccIterator iter(this, nsAccIterator::GetSelected, nsAccIterator::eTreeNav);
+  nsAccessible *selected = nsnull;
+  while ((selected = iter.GetNext()))
     selected->SetSelected(PR_FALSE);
-  }
+
   return NS_OK;
 }
 
 NS_IMETHODIMP nsAccessible::SelectAllSelection(PRBool *_retval)
 {
-  nsCOMPtr<nsIAccessible> selectable = this;
-  while ((selectable = GetNextWithState(selectable, nsIAccessibleStates::STATE_SELECTED)) != nsnull) {
+  nsAccIterator iter(this, nsAccIterator::GetSelectable, nsAccIterator::eTreeNav);
+  nsAccessible *selectable = nsnull;
+  while((selectable = iter.GetNext()))
     selectable->SetSelected(PR_TRUE);
-  }
+
   return NS_OK;
 }
 
 // nsIAccessibleHyperLink
 // Because of new-atk design, any embedded object in text can implement
 // nsIAccessibleHyperLink, which helps determine where it is located
 // within containing text
 
@@ -2637,26 +2614,34 @@ nsAccessible::GetAnchorCount(PRInt32 *aA
 }
 
 // readonly attribute long nsIAccessibleHyperLink::startIndex
 NS_IMETHODIMP
 nsAccessible::GetStartIndex(PRInt32 *aStartIndex)
 {
   NS_ENSURE_ARG_POINTER(aStartIndex);
   *aStartIndex = 0;
+
+  if (IsDefunct())
+    return NS_ERROR_FAILURE;
+
   PRInt32 endIndex;
   return GetLinkOffset(aStartIndex, &endIndex);
 }
 
 // readonly attribute long nsIAccessibleHyperLink::endIndex
 NS_IMETHODIMP
 nsAccessible::GetEndIndex(PRInt32 *aEndIndex)
 {
   NS_ENSURE_ARG_POINTER(aEndIndex);
   *aEndIndex = 0;
+
+  if (IsDefunct())
+    return NS_ERROR_FAILURE;
+
   PRInt32 startIndex;
   return GetLinkOffset(&startIndex, aEndIndex);
 }
 
 NS_IMETHODIMP
 nsAccessible::GetURI(PRInt32 aIndex, nsIURI **aURI)
 {
   NS_ENSURE_ARG_POINTER(aURI);
@@ -2715,42 +2700,35 @@ nsAccessible::GetValid(PRBool *aValid)
 NS_IMETHODIMP
 nsAccessible::GetSelected(PRBool *aSelected)
 {
   NS_ENSURE_ARG_POINTER(aSelected);
   *aSelected = (gLastFocusedNode == mDOMNode);
   return NS_OK;
 }
 
-nsresult nsAccessible::GetLinkOffset(PRInt32* aStartOffset, PRInt32* aEndOffset)
+nsresult
+nsAccessible::GetLinkOffset(PRInt32 *aStartOffset, PRInt32 *aEndOffset)
 {
-  *aStartOffset = *aEndOffset = 0;
-  nsAccessible* parent = GetParent();
-  if (!parent) {
-    return NS_ERROR_FAILURE;
-  }
-
-  nsCOMPtr<nsIAccessible> accessible, nextSibling;
-  PRInt32 characterCount = 0;
-  parent->GetFirstChild(getter_AddRefs(accessible));
-
-  while (accessible) {
-    if (nsAccUtils::IsText(accessible))
-      characterCount += nsAccUtils::TextLength(accessible);
-
-    else if (accessible == this) {
+  nsAccessible *parent = GetParent();
+  NS_ENSURE_STATE(parent);
+
+  PRUint32 characterCount = 0;
+
+  PRInt32 childCount = parent->GetChildCount();
+  for (PRInt32 childIdx = 0; childIdx < childCount; childIdx++) {
+    nsAccessible *sibling = parent->GetChildAt(childIdx);
+
+    if (sibling == this) {
       *aStartOffset = characterCount;
       *aEndOffset = characterCount + 1;
       return NS_OK;
     }
-    else {
-      ++ characterCount;
-    }
-    accessible->GetNextSibling(getter_AddRefs(nextSibling));
-    accessible.swap(nextSibling);
+
+    characterCount += nsAccUtils::TextLength(sibling);
   }
 
   return NS_ERROR_FAILURE;
 }
 
 nsresult
 nsAccessible::AppendTextTo(nsAString& aText, PRUint32 aStartOffset, PRUint32 aLength)
 {
@@ -2837,37 +2815,36 @@ nsAccessible*
 nsAccessible::GetParent()
 {
   if (IsDefunct())
     return nsnull;
 
   if (mParent)
     return mParent;
 
+#ifdef DEBUG
   nsDocAccessible *docAccessible = GetDocAccessible();
   NS_ASSERTION(docAccessible, "No document accessible for valid accessible!");
-
-  if (!docAccessible)
+#endif
+
+  nsAccessible *parent = GetAccService()->GetContainerAccessible(mDOMNode,
+                                                                 PR_TRUE);
+  NS_ASSERTION(parent, "No accessible parent for valid accessible!");
+  if (!parent)
     return nsnull;
 
-  nsCOMPtr<nsIAccessible> parent;
-  docAccessible->GetAccessibleInParentChain(mDOMNode, PR_TRUE,
-                                            getter_AddRefs(parent));
-
-  nsRefPtr<nsAccessible> parentAcc = do_QueryObject(parent);
-
 #ifdef DEBUG
-  NS_ASSERTION(!parentAcc->IsDefunct(), "Defunct parent!");
-
-  parentAcc->EnsureChildren();
+  NS_ASSERTION(!parent->IsDefunct(), "Defunct parent!");
+
+  parent->EnsureChildren();
   if (parent != mParent)
     NS_WARNING("Bad accessible tree!");
 #endif
 
-  return parentAcc;
+  return parent;
 }
 
 nsAccessible*
 nsAccessible::GetChildAt(PRUint32 aIndex)
 {
   if (EnsureChildren())
     return nsnull;
 
@@ -3014,27 +2991,27 @@ nsAccessible::GetSiblingAtOffset(PRInt32
 
   nsAccessible *child = parent->GetChildAt(indexInParent + aOffset);
   if (aError && !child)
     *aError = NS_ERROR_UNEXPECTED;
 
   return child;
 }
 
-already_AddRefed<nsAccessible>
-nsAccessible::GetFirstAvailableAccessible(nsIDOMNode *aStartNode)
+nsAccessible *
+nsAccessible::GetFirstAvailableAccessible(nsIDOMNode *aStartNode) const
 {
   nsCOMPtr<nsIDOMTreeWalker> walker; 
   nsCOMPtr<nsIDOMNode> currentNode(aStartNode);
 
   while (currentNode) {
-    nsRefPtr<nsAccessible> accessible =
+    nsAccessible *accessible =
       GetAccService()->GetAccessibleInWeakShell(currentNode, mWeakShell);
     if (accessible)
-      return accessible.forget();
+      return accessible;
 
     if (!walker) {
       // Instantiate walker lazily since we won't need it in 90% of the cases
       // where the first DOM node we're given provides an accessible
       nsCOMPtr<nsIDOMDocument> document;
       currentNode->GetOwnerDocument(getter_AddRefs(document));
       nsCOMPtr<nsIDOMDocumentTraversal> trav = do_QueryInterface(document);
       NS_ASSERTION(trav, "No DOM document traversal for document");
--- a/accessible/src/base/nsAccessible.h
+++ b/accessible/src/base/nsAccessible.h
@@ -241,16 +241,21 @@ public:
   virtual PRInt32 GetIndexOf(nsIAccessible *aChild);
 
   /**
    * Return index in parent accessible.
    */
   PRInt32 GetIndexInParent();
 
   /**
+   * Return true if accessible has children;
+   */
+  PRBool HasChildren() { return !!GetChildAt(0); }
+
+  /**
    * Return parent accessible only if cached.
    */
   nsAccessible* GetCachedParent();
 
   /**
    * Return first child accessible only if cached.
    */
   nsAccessible* GetCachedFirstChild();
@@ -320,29 +325,26 @@ protected:
   /**
    * Compute the name for XUL node.
    */
   nsresult GetXULName(nsAString& aName);
 
   // helper method to verify frames
   static nsresult GetFullKeyName(const nsAString& aModifierName, const nsAString& aKeyName, nsAString& aStringOut);
   static nsresult GetTranslatedString(const nsAString& aKey, nsAString& aStringOut);
-    
-  already_AddRefed<nsIAccessible> GetNextWithState(nsIAccessible *aStart, PRUint32 matchState);
 
   /**
    * Return an accessible for the given DOM node, or if that node isn't
    * accessible, return the accessible for the next DOM node which has one
    * (based on forward depth first search).
    *
    * @param  aStartNode  [in] the DOM node to start from
    * @return              the resulting accessible
-   */   
-  already_AddRefed<nsAccessible>
-    GetFirstAvailableAccessible(nsIDOMNode *aStartNode);
+   */
+  nsAccessible *GetFirstAvailableAccessible(nsIDOMNode *aStartNode) const;
 
   // Hyperlink helpers
   virtual nsresult GetLinkOffset(PRInt32* aStartOffset, PRInt32* aEndOffset);
 
   //////////////////////////////////////////////////////////////////////////////
   // Action helpers
 
   /**
--- a/accessible/src/base/nsApplicationAccessible.cpp
+++ b/accessible/src/base/nsApplicationAccessible.cpp
@@ -45,16 +45,17 @@
 #include "nsAccessibilityService.h"
 #include "nsAccUtils.h"
 
 #include "nsIComponentManager.h"
 #include "nsIDOMDocument.h"
 #include "nsIDOMWindow.h"
 #include "nsIWindowMediator.h"
 #include "nsServiceManagerUtils.h"
+#include "mozilla/Services.h"
 
 nsApplicationAccessible::nsApplicationAccessible() :
   nsAccessibleWrap(nsnull, nsnull)
 {
 }
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsISupports
@@ -78,17 +79,17 @@ nsApplicationAccessible::GetRootDocument
 // nsIAccessible
 
 NS_IMETHODIMP
 nsApplicationAccessible::GetName(nsAString& aName)
 {
   aName.Truncate();
 
   nsCOMPtr<nsIStringBundleService> bundleService =
-    do_GetService(NS_STRINGBUNDLE_CONTRACTID);
+    mozilla::services::GetStringBundleService();
 
   NS_ASSERTION(bundleService, "String bundle service must be present!");
   NS_ENSURE_STATE(bundleService);
 
   nsCOMPtr<nsIStringBundle> bundle;
   nsresult rv = bundleService->CreateBundle("chrome://branding/locale/brand.properties",
                                             getter_AddRefs(bundle));
   NS_ENSURE_SUCCESS(rv, rv);
@@ -319,18 +320,17 @@ nsApplicationAccessible::GetSiblingAtOff
 ////////////////////////////////////////////////////////////////////////////////
 // Public methods
 
 nsresult
 nsApplicationAccessible::AddRootAccessible(nsIAccessible *aRootAccessible)
 {
   NS_ENSURE_ARG_POINTER(aRootAccessible);
 
-  nsRefPtr<nsAccessible> rootAcc =
-    nsAccUtils::QueryObject<nsAccessible>(aRootAccessible);
+  nsRefPtr<nsAccessible> rootAcc = do_QueryObject(aRootAccessible);
 
   if (!mChildren.AppendElement(rootAcc))
     return NS_ERROR_FAILURE;
 
   rootAcc->SetParent(this);
 
   return NS_OK;
 }
--- a/accessible/src/base/nsBaseWidgetAccessible.cpp
+++ b/accessible/src/base/nsBaseWidgetAccessible.cpp
@@ -102,32 +102,32 @@ nsLinkableAccessible::
 NS_IMPL_ISUPPORTS_INHERITED0(nsLinkableAccessible, nsAccessibleWrap)
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsLinkableAccessible. nsIAccessible
 
 NS_IMETHODIMP
 nsLinkableAccessible::TakeFocus()
 {
-  nsRefPtr<nsAccessible> actionAcc = GetActionAccessible();
+  nsAccessible *actionAcc = GetActionAccessible();
   if (actionAcc)
     return actionAcc->TakeFocus();
 
   return nsAccessibleWrap::TakeFocus();
 }
 
 nsresult
 nsLinkableAccessible::GetStateInternal(PRUint32 *aState, PRUint32 *aExtraState)
 {
   nsresult rv = nsAccessibleWrap::GetStateInternal(aState, aExtraState);
   NS_ENSURE_A11Y_SUCCESS(rv, rv);
 
   if (mIsLink) {
     *aState |= nsIAccessibleStates::STATE_LINKED;
-    nsRefPtr<nsAccessible> actionAcc = GetActionAccessible();
+    nsAccessible *actionAcc = GetActionAccessible();
     if (nsAccUtils::State(actionAcc) & nsIAccessibleStates::STATE_TRAVERSED)
       *aState |= nsIAccessibleStates::STATE_TRAVERSED;
   }
 
   return NS_OK;
 }
 
 NS_IMETHODIMP
@@ -135,17 +135,17 @@ nsLinkableAccessible::GetValue(nsAString
 {
   aValue.Truncate();
 
   nsAccessible::GetValue(aValue);
   if (!aValue.IsEmpty())
     return NS_OK;
 
   if (mIsLink) {
-    nsRefPtr<nsAccessible> actionAcc = GetActionAccessible();
+    nsAccessible *actionAcc = GetActionAccessible();
     if (actionAcc)
       return actionAcc->GetValue(aValue);
   }
 
   return NS_ERROR_NOT_IMPLEMENTED;
 }
 
 
@@ -178,47 +178,46 @@ nsLinkableAccessible::GetActionName(PRUi
   return NS_ERROR_INVALID_ARG;
 }
 
 NS_IMETHODIMP
 nsLinkableAccessible::DoAction(PRUint8 aIndex)
 {
   if (aIndex != eAction_Jump)
     return NS_ERROR_INVALID_ARG;
-  
-  nsRefPtr<nsAccessible> actionAcc = GetActionAccessible();
+
+  nsAccessible *actionAcc = GetActionAccessible();
   if (actionAcc)
     return actionAcc->DoAction(aIndex);
   
   return nsAccessibleWrap::DoAction(aIndex);
 }
 
 NS_IMETHODIMP
 nsLinkableAccessible::GetKeyboardShortcut(nsAString& aKeyboardShortcut)
 {
   aKeyboardShortcut.Truncate();
 
-  nsRefPtr<nsAccessible> actionAcc = GetActionAccessible();
+  nsAccessible *actionAcc = GetActionAccessible();
   if (actionAcc)
     return actionAcc->GetKeyboardShortcut(aKeyboardShortcut);
 
   return nsAccessible::GetKeyboardShortcut(aKeyboardShortcut);
 }
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsLinkableAccessible. nsIAccessibleHyperLink
 
 NS_IMETHODIMP
 nsLinkableAccessible::GetURI(PRInt32 aIndex, nsIURI **aURI)
 {
   if (mIsLink) {
-    nsRefPtr<nsAccessible> actionAcc = GetActionAccessible();
+    nsAccessible *actionAcc = GetActionAccessible();
     if (actionAcc) {
-      nsCOMPtr<nsIAccessibleHyperLink> hyperLinkAcc =
-        nsAccUtils::QueryObject<nsIAccessibleHyperLink>(actionAcc);
+      nsCOMPtr<nsIAccessibleHyperLink> hyperLinkAcc = do_QueryObject(actionAcc);
       NS_ASSERTION(hyperLinkAcc,
                    "nsIAccessibleHyperLink isn't implemented.");
 
       if (hyperLinkAcc)
         return hyperLinkAcc->GetURI(aIndex, aURI);
     }
   }
   
@@ -257,17 +256,17 @@ nsLinkableAccessible::CacheActionContent
     return;
   }
 
   while ((walkUpContent = walkUpContent->GetParent())) {
     isOnclick = nsCoreUtils::HasClickListener(walkUpContent);
   
     nsCOMPtr<nsIDOMNode> walkUpNode(do_QueryInterface(walkUpContent));
 
-    nsRefPtr<nsAccessible> walkUpAcc =
+    nsAccessible *walkUpAcc =
       GetAccService()->GetAccessibleInWeakShell(walkUpNode, mWeakShell);
 
     if (nsAccUtils::Role(walkUpAcc) == nsIAccessibleRole::ROLE_LINK &&
         nsAccUtils::State(walkUpAcc) & nsIAccessibleStates::STATE_LINKED) {
       mIsLink = PR_TRUE;
       mActionContent = walkUpContent;
       return;
     }
@@ -275,18 +274,18 @@ nsLinkableAccessible::CacheActionContent
     if (isOnclick) {
       mActionContent = walkUpContent;
       mIsOnclick = PR_TRUE;
       return;
     }
   }
 }
 
-already_AddRefed<nsAccessible>
-nsLinkableAccessible::GetActionAccessible()
+nsAccessible *
+nsLinkableAccessible::GetActionAccessible() const
 {
   // Return accessible for the action content if it's different from node of
   // this accessible. If the action accessible is not null then it is used to
   // redirect methods calls otherwise we use method implementation from the
   // base class.
   nsCOMPtr<nsIDOMNode> actionNode(do_QueryInterface(mActionContent));
   if (!actionNode || mDOMNode == actionNode)
     return nsnull;
--- a/accessible/src/base/nsBaseWidgetAccessible.h
+++ b/accessible/src/base/nsBaseWidgetAccessible.h
@@ -105,17 +105,17 @@ public:
 
   // nsAccessible
   virtual nsresult GetStateInternal(PRUint32 *aState, PRUint32 *aExtraState);
 
 protected:
   /**
    * Return an accessible for cached action node.
    */
-  already_AddRefed<nsAccessible> GetActionAccessible();
+  nsAccessible *GetActionAccessible() const;
 
   /**
    * Cache action node.
    */
   virtual void CacheActionContent();
 
   nsCOMPtr<nsIContent> mActionContent;
   PRPackedBool mIsLink;
--- a/accessible/src/base/nsCaretAccessible.cpp
+++ b/accessible/src/base/nsCaretAccessible.cpp
@@ -316,17 +316,17 @@ nsCaretAccessible::GetCaretRect(nsIWidge
 
   nsCOMPtr<nsIAccessNode> lastAccessNode(do_QueryInterface(mLastTextAccessible));
   NS_ENSURE_TRUE(lastAccessNode, caretRect);
 
   nsCOMPtr<nsIDOMNode> lastNodeWithCaret;
   lastAccessNode->GetDOMNode(getter_AddRefs(lastNodeWithCaret));
   NS_ENSURE_TRUE(lastNodeWithCaret, caretRect);
 
-  nsCOMPtr<nsIPresShell> presShell =
+  nsIPresShell *presShell =
     nsCoreUtils::GetPresShellFor(lastNodeWithCaret);
   NS_ENSURE_TRUE(presShell, caretRect);
 
   nsRefPtr<nsCaret> caret = presShell->GetCaret();
   NS_ENSURE_TRUE(caret, caretRect);
 
   nsCOMPtr<nsISelection> caretSelection(do_QueryReferent(mLastUsedSelection));
   NS_ENSURE_TRUE(caretSelection, caretRect);
@@ -366,17 +366,17 @@ nsCaretAccessible::GetCaretRect(nsIWidge
 }
 
 already_AddRefed<nsISelectionController>
 nsCaretAccessible::GetSelectionControllerForNode(nsIDOMNode *aNode)
 {
   if (!aNode)
     return nsnull;
 
-  nsCOMPtr<nsIPresShell> presShell = nsCoreUtils::GetPresShellFor(aNode);
+  nsIPresShell *presShell = nsCoreUtils::GetPresShellFor(aNode);
   if (!presShell)
     return nsnull;
 
   nsCOMPtr<nsIDocument> doc = presShell->GetDocument();
   if (!doc)
     return nsnull;
 
   // Get selection controller only for form controls, not for the document.
--- a/accessible/src/base/nsCoreUtils.cpp
+++ b/accessible/src/base/nsCoreUtils.cpp
@@ -265,39 +265,32 @@ nsCoreUtils::GetDOMElementFor(nsIDOMNode
 
     nsCOMPtr<nsIDOMDocument> domDoc(do_QueryInterface(node));
     domDoc->GetDocumentElement(&element);
   }
 
   return element;
 }
 
-already_AddRefed<nsIDOMNode>
-nsCoreUtils::GetDOMNodeFromDOMPoint(nsIDOMNode *aNode, PRUint32 aOffset)
+nsINode *
+nsCoreUtils::GetDOMNodeFromDOMPoint(nsINode *aNode, PRUint32 aOffset)
 {
-  nsIDOMNode *resultNode = nsnull;
-
-  nsCOMPtr<nsIContent> content(do_QueryInterface(aNode));
-  if (content && content->IsElement()) {
-
-    PRUint32 childCount = content->GetChildCount();
+  if (aNode && aNode->IsElement()) {
+    PRUint32 childCount = aNode->GetChildCount();
     NS_ASSERTION(aOffset >= 0 && aOffset <= childCount,
                  "Wrong offset of the DOM point!");
 
     // The offset can be after last child of container node that means DOM point
     // is placed immediately after the last child. In this case use the DOM node
     // from the given DOM point is used as result node.
-    if (aOffset != childCount) {
-      CallQueryInterface(content->GetChildAt(aOffset), &resultNode);
-      return resultNode;
-    }
+    if (aOffset != childCount)
+      return aNode->GetChildAt(aOffset);
   }
 
-  NS_IF_ADDREF(resultNode = aNode);
-  return resultNode;
+  return aNode;
 }
 
 nsIContent*
 nsCoreUtils::GetRoleContent(nsIDOMNode *aDOMNode)
 {
   nsCOMPtr<nsIContent> content(do_QueryInterface(aDOMNode));
   if (!content) {
     nsCOMPtr<nsIDOMDocument> domDoc(do_QueryInterface(aDOMNode));
@@ -521,35 +514,16 @@ nsCoreUtils::IsCorrectFrameType(nsIFrame
   NS_ASSERTION(aFrame != nsnull,
                "aFrame is null in call to IsCorrectFrameType!");
   NS_ASSERTION(aAtom != nsnull,
                "aAtom is null in call to IsCorrectFrameType!");
   
   return aFrame->GetType() == aAtom;
 }
 
-already_AddRefed<nsIPresShell>
-nsCoreUtils::GetPresShellFor(nsIDOMNode *aNode)
-{
-  nsCOMPtr<nsIDOMDocument> domDocument;
-  aNode->GetOwnerDocument(getter_AddRefs(domDocument));
-
-  nsCOMPtr<nsIDocument> doc(do_QueryInterface(domDocument));
-  if (!doc) // This is necessary when the node is the document node
-    doc = do_QueryInterface(aNode);
-
-  nsIPresShell *presShell = nsnull;
-  if (doc) {
-    presShell = doc->GetPrimaryShell();
-    NS_IF_ADDREF(presShell);
-  }
-
-  return presShell;
-}
-
 already_AddRefed<nsIDOMNode>
 nsCoreUtils::GetDOMNodeForContainer(nsIDocShellTreeItem *aContainer)
 {
   nsCOMPtr<nsIDocShell> shell = do_QueryInterface(aContainer);
 
   nsCOMPtr<nsIContentViewer> cv;
   shell->GetContentViewer(getter_AddRefs(cv));
 
--- a/accessible/src/base/nsCoreUtils.h
+++ b/accessible/src/base/nsCoreUtils.h
@@ -124,18 +124,18 @@ public:
    *
    * @param aNode  [in] the given DOM node
    */
   static already_AddRefed<nsIDOMElement> GetDOMElementFor(nsIDOMNode *aNode);
 
   /**
    * Return DOM node for the given DOM point.
    */
-  static already_AddRefed<nsIDOMNode> GetDOMNodeFromDOMPoint(nsIDOMNode *aNode,
-                                                             PRUint32 aOffset);
+  static nsINode *GetDOMNodeFromDOMPoint(nsINode *aNode, PRUint32 aOffset);
+
   /**
    * Return the nsIContent* to check for ARIA attributes on -- this may not
    * always be the DOM node for the accessible. Specifically, for doc
    * accessibles, it is not the document node, but either the root element or
    * <body> in HTML. Similar with GetDOMElementFor() method.
    *
    * @param aDOMNode  DOM node for the accessible that may be affected by ARIA
    * @return          the nsIContent which may have ARIA markup
@@ -238,17 +238,22 @@ public:
    * @param aFrame  the frame
    * @param aAtom   the frame type
    */
   static PRBool IsCorrectFrameType(nsIFrame* aFrame, nsIAtom* aAtom);
 
   /**
    * Return presShell for the document containing the given DOM node.
    */
-  static already_AddRefed<nsIPresShell> GetPresShellFor(nsIDOMNode *aNode);
+  static nsIPresShell *GetPresShellFor(nsIDOMNode *aNode)
+  {
+    nsCOMPtr<nsINode> node(do_QueryInterface(aNode));
+    nsIDocument *document = node->GetOwnerDoc();
+    return document ? document->GetPrimaryShell() : nsnull;
+  }
 
   /**
    * Return document node for the given document shell tree item.
    */
   static already_AddRefed<nsIDOMNode>
     GetDOMNodeForContainer(nsIDocShellTreeItem *aContainer);
 
   /**
--- a/accessible/src/base/nsDocAccessible.cpp
+++ b/accessible/src/base/nsDocAccessible.cpp
@@ -544,18 +544,17 @@ nsDocAccessible::GetCachedAccessNode(voi
       accessNode = this;
   }
 
 #ifdef DEBUG
   // All cached accessible nodes should be in the parent
   // It will assert if not all the children were created
   // when they were first cached, and no invalidation
   // ever corrected parent accessible's child cache.
-  nsRefPtr<nsAccessible> acc =
-    nsAccUtils::QueryObject<nsAccessible>(accessNode);
+  nsRefPtr<nsAccessible> acc = do_QueryObject(accessNode);
 
   if (acc) {
     nsAccessible* parent(acc->GetCachedParent());
     if (parent)
       parent->TestChildCache(acc);
   }
 #endif
 
@@ -979,20 +978,23 @@ void nsDocAccessible::ScrollPositionDidC
 ////////////////////////////////////////////////////////////////////////////////
 // nsIObserver
 
 NS_IMETHODIMP nsDocAccessible::Observe(nsISupports *aSubject, const char *aTopic,
                                        const PRUnichar *aData)
 {
   if (!nsCRT::strcmp(aTopic,"obs_documentCreated")) {    
     // State editable will now be set, readonly is now clear
+    // Normally we only fire delayed events created from the node, not an
+    // accessible object. See the nsAccStateChangeEvent constructor for details
+    // about this exceptional case.
     nsRefPtr<nsAccEvent> event =
       new nsAccStateChangeEvent(this, nsIAccessibleStates::EXT_STATE_EDITABLE,
                                 PR_TRUE, PR_TRUE);
-    nsEventShell::FireEvent(event);
+    FireDelayedAccessibleEvent(event);
   }
 
   return NS_OK;
 }
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsIDocumentObserver
 
@@ -1304,32 +1306,32 @@ nsDocAccessible::ARIAAttributeChanged(ns
     InvalidateCacheSubtree(aContent,
                            nsIAccessibilityService::NODE_SIGNIFICANT_CHANGE);
     return;
   }
 }
 
 void nsDocAccessible::ContentAppended(nsIDocument *aDocument,
                                       nsIContent* aContainer,
-                                      PRInt32 aNewIndexInContainer)
+                                      nsIContent* aFirstNewContent,
+                                      PRInt32 /* unused */)
 {
   if ((!mIsContentLoaded || !mDocument) && mAccessNodeCache.Count() <= 1) {
     // See comments in nsDocAccessible::InvalidateCacheSubtree
     InvalidateChildren();
     return;
   }
 
-  PRUint32 childCount = aContainer->GetChildCount();
-  for (PRUint32 index = aNewIndexInContainer; index < childCount; index ++) {
-    nsCOMPtr<nsIContent> child(aContainer->GetChildAt(index));
+  // Does this need to be a strong ref?  If so, why?
+  for (nsIContent* cur = aFirstNewContent; cur; cur = cur->GetNextSibling()) {
     // InvalidateCacheSubtree will not fire the EVENT_SHOW for the new node
     // unless an accessible can be created for the passed in node, which it
     // can't do unless the node is visible. The right thing happens there so
     // no need for an extra visibility check here.
-    InvalidateCacheSubtree(child, nsIAccessibilityService::NODE_APPEND);
+    InvalidateCacheSubtree(cur, nsIAccessibilityService::NODE_APPEND);
   }
 }
 
 
 void nsDocAccessible::ContentStatesChanged(nsIDocument* aDocument,
                                            nsIContent* aContent1,
                                            nsIContent* aContent2,
                                            PRInt32 aStateMask)
@@ -1358,28 +1360,28 @@ void nsDocAccessible::CharacterDataChang
                                            nsIContent* aContent,
                                            CharacterDataChangeInfo* aInfo)
 {
   FireTextChangeEventForText(aContent, aInfo, PR_TRUE);
 }
 
 void
 nsDocAccessible::ContentInserted(nsIDocument *aDocument, nsIContent* aContainer,
-                                 nsIContent* aChild, PRInt32 aIndexInContainer)
+                                 nsIContent* aChild, PRInt32 /* unused */)
 {
   // InvalidateCacheSubtree will not fire the EVENT_SHOW for the new node
   // unless an accessible can be created for the passed in node, which it
   // can't do unless the node is visible. The right thing happens there so
   // no need for an extra visibility check here.
   InvalidateCacheSubtree(aChild, nsIAccessibilityService::NODE_APPEND);
 }
 
 void
 nsDocAccessible::ContentRemoved(nsIDocument *aDocument, nsIContent* aContainer,
-                                nsIContent* aChild, PRInt32 aIndexInContainer)
+                                nsIContent* aChild, PRInt32 /* unused */)
 {
   // It's no needed to invalidate the subtree of the removed element,
   // because we get notifications directly from content (see
   // nsGenericElement::doRemoveChildAt) *before* the frame for the content is
   // destroyed, or any other side effects occur . That allows us to correctly
   // calculate the TEXT_REMOVED event if there is one and coalesce events from
   // the same subtree.
 }
@@ -1413,17 +1415,17 @@ nsDocAccessible::GetParent()
     if (accService) {
       // XXX aaronl: ideally we would traverse the presshell chain. Since
       // there's no easy way to do that, we cheat and use the document
       // hierarchy. GetAccessibleFor() is bad because it doesn't support our
       // concept of multiple presshells per doc.
       // It should be changed to use GetAccessibleInWeakShell()
       nsCOMPtr<nsIAccessible> parent;
       accService->GetAccessibleFor(ownerNode, getter_AddRefs(parent));
-      mParent = nsAccUtils::QueryObject<nsAccessible>(parent);
+      mParent = do_QueryObject(parent);
     }
   }
 
   NS_ASSERTION(mParent, "No parent for not root document accessible!");
   return mParent;
 }
 
 
@@ -1451,119 +1453,111 @@ nsDocAccessible::FireTextChangeEventForT
   if (!mIsContentLoaded || !mDocument) {
     return;
   }
 
   nsCOMPtr<nsIDOMNode> node(do_QueryInterface(aContent));
   if (!node)
     return;
 
-  nsCOMPtr<nsIAccessible> accessible;
-  nsresult rv = GetAccessibleInParentChain(node, PR_TRUE, getter_AddRefs(accessible));
-  if (NS_FAILED(rv) || !accessible)
+  nsAccessible *accessible = GetAccService()->GetContainerAccessible(node,
+                                                                     PR_TRUE);
+  if (!accessible)
     return;
 
-  nsRefPtr<nsHyperTextAccessible> textAccessible;
-  rv = accessible->QueryInterface(NS_GET_IID(nsHyperTextAccessible),
-                                  getter_AddRefs(textAccessible));
-  if (NS_FAILED(rv) || !textAccessible)
+  nsRefPtr<nsHyperTextAccessible> textAccessible(do_QueryObject(accessible));
+  if (!textAccessible)
     return;
 
   PRInt32 start = aInfo->mChangeStart;
 
   PRInt32 offset = 0;
-  rv = textAccessible->DOMPointToHypertextOffset(node, start, &offset);
-  if (NS_FAILED(rv))
-    return;
+  textAccessible->DOMPointToHypertextOffset(node, start, &offset);
 
   PRInt32 length = aIsInserted ?
     aInfo->mReplaceLength: // text has been added
     aInfo->mChangeEnd - start; // text has been removed
 
   if (length > 0) {
     PRUint32 renderedStartOffset, renderedEndOffset;
     nsIFrame* frame = aContent->GetPrimaryFrame();
     if (!frame)
       return;
 
-    rv = textAccessible->ContentToRenderedOffset(frame, start,
-                                                 &renderedStartOffset);
+    nsresult rv = textAccessible->ContentToRenderedOffset(frame, start,
+                                                          &renderedStartOffset);
     if (NS_FAILED(rv))
       return;
 
     rv = textAccessible->ContentToRenderedOffset(frame, start + length,
                                                  &renderedEndOffset);
     if (NS_FAILED(rv))
       return;
 
+    // Normally we only fire delayed events created from the node, not an
+    // accessible object. See the nsAccTextChangeEvent constructor for details
+    // about this exceptional case.
     nsRefPtr<nsAccEvent> event =
       new nsAccTextChangeEvent(accessible, offset,
                                renderedEndOffset - renderedStartOffset,
                                aIsInserted, PR_FALSE);
-    nsEventShell::FireEvent(event);
+    FireDelayedAccessibleEvent(event);
 
     FireValueChangeForTextFields(accessible);
   }
 }
 
 already_AddRefed<nsAccEvent>
-nsDocAccessible::CreateTextChangeEventForNode(nsIAccessible *aContainerAccessible,
+nsDocAccessible::CreateTextChangeEventForNode(nsAccessible *aContainerAccessible,
                                               nsIDOMNode *aChangeNode,
-                                              nsIAccessible *aAccessibleForChangeNode,
+                                              nsAccessible *aAccessibleForChangeNode,
                                               PRBool aIsInserting,
                                               PRBool aIsAsynch,
                                               EIsFromUserInput aIsFromUserInput)
 {
-  nsRefPtr<nsHyperTextAccessible> textAccessible;
-  aContainerAccessible->QueryInterface(NS_GET_IID(nsHyperTextAccessible),
-                                       getter_AddRefs(textAccessible));
+  nsRefPtr<nsHyperTextAccessible> textAccessible =
+    do_QueryObject(aContainerAccessible);
   if (!textAccessible) {
     return nsnull;
   }
 
   PRInt32 offset;
   PRInt32 length = 0;
-  nsCOMPtr<nsIAccessible> changeAccessible;
-  nsresult rv = textAccessible->DOMPointToHypertextOffset(aChangeNode, -1, &offset,
-                                                          getter_AddRefs(changeAccessible));
-  NS_ENSURE_SUCCESS(rv, nsnull);
+  nsAccessible *changeAcc =
+    textAccessible->DOMPointToHypertextOffset(aChangeNode, -1, &offset);
 
   if (!aAccessibleForChangeNode) {
     // A span-level object or something else without an accessible is being removed, where
     // it has no accessible but it has descendant content which is aggregated as text
     // into the parent hypertext.
     // In this case, accessibleToBeRemoved may just be the first
     // accessible that is removed, which affects the text in the hypertext container
-    if (!changeAccessible) {
+    if (!changeAcc)
       return nsnull; // No descendant content that represents any text in the hypertext parent
-    }
 
     nsCOMPtr<nsINode> changeNode(do_QueryInterface(aChangeNode));
-    nsCOMPtr<nsIAccessible> child = changeAccessible;
-    while (PR_TRUE) {
-      nsCOMPtr<nsIAccessNode> childAccessNode =
-        do_QueryInterface(changeAccessible);
 
-      nsCOMPtr<nsIDOMNode> childDOMNode;
-      childAccessNode->GetDOMNode(getter_AddRefs(childDOMNode));
+    nsAccessible *parent = changeAcc->GetParent();
+    PRInt32 childCount = parent->GetChildCount();
+    PRInt32 changeAccIdx = parent->GetIndexOf(changeAcc);
 
-      nsCOMPtr<nsINode> childNode(do_QueryInterface(childDOMNode));
+    for (PRInt32 idx = changeAccIdx; idx < childCount; idx++) {
+      nsAccessible *child = parent->GetChildAt(idx);
+      nsCOMPtr<nsINode> childNode(do_QueryInterface(child->GetDOMNode()));
+
       if (!nsCoreUtils::IsAncestorOf(changeNode, childNode)) {
-        break;  // We only want accessibles with DOM nodes as children of this node
-      }
-      length += nsAccUtils::TextLength(child);
-      child->GetNextSibling(getter_AddRefs(changeAccessible));
-      if (!changeAccessible) {
+        // We only want accessibles with DOM nodes as children of this node
         break;
       }
-      child.swap(changeAccessible);
+
+      length += nsAccUtils::TextLength(child);
     }
   }
   else {
-    NS_ASSERTION(!changeAccessible || changeAccessible == aAccessibleForChangeNode,
+    NS_ASSERTION(!changeAcc || changeAcc == aAccessibleForChangeNode,
                  "Hypertext is reporting a different accessible for this node");
 
     length = nsAccUtils::TextLength(aAccessibleForChangeNode);
     if (nsAccUtils::Role(aAccessibleForChangeNode) == nsIAccessibleRole::ROLE_WHITESPACE) {  // newline
       // Don't fire event for the first html:br in an editor.
       nsCOMPtr<nsIEditor> editor;
       textAccessible->GetAssociatedEditor(getter_AddRefs(editor));
       if (editor) {
@@ -1613,18 +1607,19 @@ nsDocAccessible::FireDelayedAccessibleEv
     mEventQueue->Push(aEvent);
 
   return NS_OK;
 }
 
 void
 nsDocAccessible::ProcessPendingEvent(nsAccEvent *aEvent)
 {  
-  nsCOMPtr<nsIAccessible> accessible;
-  aEvent->GetAccessible(getter_AddRefs(accessible));
+  nsCOMPtr<nsIAccessible> acc;
+  aEvent->GetAccessible(getter_AddRefs(acc));
+  nsRefPtr<nsAccessible> accessible(do_QueryObject(acc));
 
   nsCOMPtr<nsIDOMNode> domNode;
   aEvent->GetDOMNode(getter_AddRefs(domNode));
 
   PRUint32 eventType = aEvent->GetEventType();
   EIsFromUserInput isFromUserInput =
     aEvent->IsFromUserInput() ? eFromUserInput : eNoUserInput;
 
@@ -1652,32 +1647,30 @@ nsDocAccessible::ProcessPendingEvent(nsA
         return;
       }
       gLastFocusedFrameType = newFrameType;
     }
   }
 
   if (eventType == nsIAccessibleEvent::EVENT_SHOW) {
 
-    nsCOMPtr<nsIAccessible> containerAccessible;
+    nsAccessible *containerAccessible = nsnull;
     if (accessible)
-      accessible->GetParent(getter_AddRefs(containerAccessible));
+      containerAccessible = accessible->GetParent();
 
     if (!containerAccessible) {
-      GetAccessibleInParentChain(domNode, PR_TRUE,
-                                 getter_AddRefs(containerAccessible));
+      containerAccessible = GetAccService()->GetContainerAccessible(domNode,
+                                                                    PR_TRUE);
       if (!containerAccessible)
         containerAccessible = this;
     }
 
     if (isAsync) {
       // For asynch show, delayed invalidatation of parent's children
-      nsRefPtr<nsAccessible> containerAcc = do_QueryObject(containerAccessible);
-      if (containerAcc)
-        containerAcc->InvalidateChildren();
+      containerAccessible->InvalidateChildren();
 
       // Some show events in the subtree may have been removed to 
       // avoid firing redundant events. But, we still need to make sure any
       // accessibles parenting those shown nodes lose their child references.
       InvalidateChildrenInSubtree(domNode);
     }
 
     // Also fire text changes if the node being created could affect the text in an nsIAccessibleText parent.
@@ -1707,17 +1700,17 @@ nsDocAccessible::ProcessPendingEvent(nsA
     if (eventType == nsIAccessibleEvent::EVENT_INTERNAL_LOAD) {
       nsRefPtr<nsDocAccessible> docAcc = do_QueryObject(accessible);
       NS_ASSERTION(docAcc, "No doc accessible for doc load event");
 
       if (docAcc)
         docAcc->FireDocLoadEvents(nsIAccessibleEvent::EVENT_DOCUMENT_LOAD_COMPLETE);
     }
     else if (eventType == nsIAccessibleEvent::EVENT_TEXT_CARET_MOVED) {
-      nsCOMPtr<nsIAccessibleText> accessibleText = do_QueryInterface(accessible);
+      nsCOMPtr<nsIAccessibleText> accessibleText = do_QueryObject(accessible);
       PRInt32 caretOffset;
       if (accessibleText && NS_SUCCEEDED(accessibleText->GetCaretOffset(&caretOffset))) {
 #ifdef DEBUG_A11Y
         PRUnichar chAtOffset;
         accessibleText->GetCharacterAtOffset(caretOffset, &chAtOffset);
         printf("\nCaret moved to %d with char %c", caretOffset, chAtOffset);
 #endif
 #ifdef DEBUG_CARET
@@ -1766,18 +1759,17 @@ nsDocAccessible::ProcessPendingEvent(nsA
         }
       }
     }
   }
 }
 
 void nsDocAccessible::InvalidateChildrenInSubtree(nsIDOMNode *aStartNode)
 {
-  nsRefPtr<nsAccessible> acc =
-    nsAccUtils::QueryObject<nsAccessible>(GetCachedAccessNode(aStartNode));
+  nsRefPtr<nsAccessible> acc = do_QueryObject(GetCachedAccessNode(aStartNode));
   if (acc)
     acc->InvalidateChildren();
 
   // Invalidate accessible children in the DOM subtree 
   nsCOMPtr<nsINode> node = do_QueryInterface(aStartNode);
   PRInt32 index, numChildren = node->GetChildCount();
   for (index = 0; index < numChildren; index ++) {
     nsCOMPtr<nsIDOMNode> childNode = do_QueryInterface(node->GetChildAt(index));
@@ -1791,18 +1783,17 @@ void nsDocAccessible::RefreshNodes(nsIDO
   if (mAccessNodeCache.Count() <= 1) {
     return; // All we have is a doc accessible. There is nothing to invalidate, quit early
   }
 
   nsRefPtr<nsAccessNode> accessNode = GetCachedAccessNode(aStartNode);
 
   // Shut down accessible subtree, which may have been created for
   // anonymous content subtree
-  nsRefPtr<nsAccessible> accessible =
-    nsAccUtils::QueryObject<nsAccessible>(accessNode);
+  nsRefPtr<nsAccessible> accessible = do_QueryObject(accessNode);
   if (accessible) {
     // Fire menupopup end if a menu goes away
     PRUint32 role = nsAccUtils::Role(accessible);
     if (role == nsIAccessibleRole::ROLE_MENUPOPUP) {
       nsCOMPtr<nsIDOMNode> domNode;
       accessNode->GetDOMNode(getter_AddRefs(domNode));
       nsCOMPtr<nsIDOMXULPopupElement> popup(do_QueryInterface(domNode));
       if (!popup) {
@@ -1812,19 +1803,18 @@ void nsDocAccessible::RefreshNodes(nsIDO
                                 accessible);
       }
     }
 
     // We only need to shutdown the accessibles here if one of them has been
     // created.
     if (accessible->GetCachedFirstChild()) {
       nsCOMPtr<nsIArray> children;
-      // use GetChildren() to fetch children at one time, instead of using
-      // GetNextSibling(), because after we shutdown the first child,
-      // mNextSibling will be set null.
+      // use GetChildren() to fetch all children at once, because after shutdown
+      // the child references are cleared.
       accessible->GetChildren(getter_AddRefs(children));
       PRUint32 childCount =0;
       if (children)
         children->GetLength(&childCount);
       nsCOMPtr<nsIDOMNode> possibleAnonNode;
       for (PRUint32 index = 0; index < childCount; index++) {
         nsCOMPtr<nsIAccessNode> childAccessNode;
         children->QueryElementAt(index, NS_GET_IID(nsIAccessNode),
@@ -1925,34 +1915,33 @@ nsDocAccessible::InvalidateCacheSubtree(
 
     nsIEventStateManager *esm = presShell->GetPresContext()->EventStateManager();
     NS_ENSURE_TRUE(esm,);
 
     if (!esm->IsHandlingUserInputExternal()) {
       // Changes during page load, but not caused by user input
       // Just invalidate accessible hierarchy and return,
       // otherwise the page load time slows down way too much
-      nsCOMPtr<nsIAccessible> containerAccessible;
-      GetAccessibleInParentChain(childNode, PR_FALSE, getter_AddRefs(containerAccessible));
+      nsAccessible *containerAccessible =
+        GetAccService()->GetContainerAccessible(childNode, PR_FALSE);
       if (!containerAccessible) {
         containerAccessible = this;
       }
 
-      nsRefPtr<nsAccessible> containerAcc = do_QueryObject(containerAccessible);
-      containerAcc->InvalidateChildren();
+      containerAccessible->InvalidateChildren();
       return;
     }     
     // else: user input, so we must fall through and for full handling,
     // e.g. fire the mutation events. Note: user input could cause DOM_CREATE
     // during page load if user typed into an input field or contentEditable area
   }
 
   // Update last change state information
-  nsCOMPtr<nsIAccessNode> childAccessNode = GetCachedAccessNode(childNode);
-  nsCOMPtr<nsIAccessible> childAccessible = do_QueryInterface(childAccessNode);
+  nsRefPtr<nsAccessible> childAccessible =
+    do_QueryObject(GetCachedAccessNode(childNode));
 
 #ifdef DEBUG_A11Y
   nsAutoString localName;
   childNode->GetLocalName(localName);
   const char *hasAccessible = childAccessible ? " (acc)" : "";
   if (aChangeType == nsIAccessibilityService::FRAME_HIDE)
     printf("[Hide %s %s]\n", NS_ConvertUTF16toUTF8(localName).get(), hasAccessible);
   else if (aChangeType == nsIAccessibilityService::FRAME_SHOW)
@@ -1962,18 +1951,18 @@ nsDocAccessible::InvalidateCacheSubtree(
   else if (aChangeType == nsIAccessibilityService::NODE_APPEND)
     printf("[Create %s %s]\n", NS_ConvertUTF16toUTF8(localName).get(), hasAccessible);
   else if (aChangeType == nsIAccessibilityService::NODE_REMOVE)
     printf("[Destroy  %s %s]\n", NS_ConvertUTF16toUTF8(localName).get(), hasAccessible);
   else if (aChangeType == nsIAccessibilityService::NODE_SIGNIFICANT_CHANGE)
     printf("[Type change %s %s]\n", NS_ConvertUTF16toUTF8(localName).get(), hasAccessible);
 #endif
 
-  nsCOMPtr<nsIAccessible> containerAccessible;
-  GetAccessibleInParentChain(childNode, PR_TRUE, getter_AddRefs(containerAccessible));
+  nsAccessible *containerAccessible =
+    GetAccService()->GetContainerAccessible(childNode, PR_TRUE);
   if (!containerAccessible) {
     containerAccessible = this;
   }
 
   if (!isShowing) {
     // Fire EVENT_HIDE.
     if (isHiding) {
       nsCOMPtr<nsIContent> content(do_QueryInterface(childNode));
@@ -2003,63 +1992,63 @@ nsDocAccessible::InvalidateCacheSubtree(
       return;
 
     if (childNode != mDOMNode) { // Fire text change unless the node being removed is for this doc
       // When a node is hidden or removed, the text in an ancestor hyper text will lose characters
       // At this point we still have the frame and accessible for this node if there was one
       // XXX Collate events when a range is deleted
       // XXX We need a way to ignore SplitNode and JoinNode() when they
       // do not affect the text within the hypertext
+      // Normally we only fire delayed events created from the node, not an
+      // accessible object. See the nsAccTextChangeEvent constructor for details
+      // about this exceptional case.
       nsRefPtr<nsAccEvent> textChangeEvent =
         CreateTextChangeEventForNode(containerAccessible, childNode, childAccessible,
                                      PR_FALSE, isAsynch);
       if (textChangeEvent) {
-        nsEventShell::FireEvent(textChangeEvent);
+        FireDelayedAccessibleEvent(textChangeEvent);
       }
     }
   }
 
   // We need to get an accessible for the mutation event's container node
   // If there is no accessible for that node, we need to keep moving up the parent
   // chain so there is some accessible.
   // We will use this accessible to fire the accessible mutation event.
   // We're guaranteed success, because we will eventually end up at the doc accessible,
   // and there is always one of those.
 
   if (aChild && !isHiding) {
     if (!isAsynch) {
       // DOM already updated with new objects -- invalidate parent's children now
       // For asynch we must wait until layout updates before we invalidate the children
-      nsRefPtr<nsAccessible> containerAcc = do_QueryObject(containerAccessible);
-      if (containerAcc)
-        containerAcc->InvalidateChildren();
-
+      containerAccessible->InvalidateChildren();
     }
 
     // Fire EVENT_SHOW, EVENT_MENUPOPUP_START for newly visible content.
 
     // Fire after a short timer, because we want to make sure the view has been
     // updated to make this accessible content visible. If we don't wait,
     // the assistive technology may receive the event and then retrieve
     // nsIAccessibleStates::STATE_INVISIBLE for the event's accessible object.
 
     FireDelayedAccessibleEvent(nsIAccessibleEvent::EVENT_SHOW, childNode,
                                nsAccEvent::eCoalesceFromSameSubtree,
                                isAsynch);
 
-    // Check to see change occured in an ARIA menu, and fire
+    // Check to see change occurred in an ARIA menu, and fire
     // an EVENT_MENUPOPUP_START if it did.
     nsRoleMapEntry *roleMapEntry = nsAccUtils::GetRoleMapEntry(childNode);
     if (roleMapEntry && roleMapEntry->role == nsIAccessibleRole::ROLE_MENUPOPUP) {
       FireDelayedAccessibleEvent(nsIAccessibleEvent::EVENT_MENUPOPUP_START,
                                  childNode, nsAccEvent::eRemoveDupes,
                                  isAsynch);
     }
 
-    // Check to see if change occured inside an alert, and fire an EVENT_ALERT if it did
+    // Check to see if change occurred inside an alert, and fire an EVENT_ALERT if it did
     nsIContent *ancestor = aChild;
     while (PR_TRUE) {
       if (roleMapEntry && roleMapEntry->role == nsIAccessibleRole::ROLE_ALERT) {
         nsCOMPtr<nsIDOMNode> alertNode(do_QueryInterface(ancestor));
         FireDelayedAccessibleEvent(nsIAccessibleEvent::EVENT_ALERT, alertNode,
                                    nsAccEvent::eRemoveDupes, isAsynch);
         break;
       }
@@ -2093,56 +2082,16 @@ nsDocAccessible::InvalidateCacheSubtree(
     new nsAccReorderEvent(containerAccessible, isAsynch,
                           isUnconditionalEvent,
                           aChild ? childNode.get() : nsnull);
   NS_ENSURE_TRUE(reorderEvent,);
 
   FireDelayedAccessibleEvent(reorderEvent);
 }
 
-// nsIAccessibleDocument method
-NS_IMETHODIMP
-nsDocAccessible::GetAccessibleInParentChain(nsIDOMNode *aNode,
-                                            PRBool aCanCreate,
-                                            nsIAccessible **aAccessible)
-{
-  // Find accessible in parent chain of DOM nodes, or return null
-  *aAccessible = nsnull;
-  nsCOMPtr<nsIDOMNode> currentNode(aNode), parentNode;
-  nsCOMPtr<nsIAccessNode> accessNode;
-
-  do {
-    currentNode->GetParentNode(getter_AddRefs(parentNode));
-    currentNode = parentNode;
-    if (!currentNode) {
-      NS_ADDREF_THIS();
-      *aAccessible = this;
-      break;
-    }
-
-    nsCOMPtr<nsIDOMNode> relevantNode;
-    if (NS_SUCCEEDED(GetAccService()->GetRelevantContentNodeFor(currentNode, getter_AddRefs(relevantNode))) && relevantNode) {
-      currentNode = relevantNode;
-    }
-    if (aCanCreate) {
-      nsRefPtr<nsAccessible> acc =
-        GetAccService()->GetAccessibleInWeakShell(currentNode, mWeakShell);
-      if (acc)
-        CallQueryInterface(acc, aAccessible);
-    }
-    else { // Only return cached accessibles, don't create anything
-      nsAccessNode* accessNode = GetCachedAccessNode(currentNode);
-      if (accessNode)
-        CallQueryInterface(accessNode, aAccessible);
-    }
-  } while (!*aAccessible);
-
-  return NS_OK;
-}
-
 nsresult
 nsDocAccessible::FireShowHideEvents(nsIDOMNode *aDOMNode,
                                     PRBool aAvoidOnThisNode,
                                     PRUint32 aEventType,
                                     EEventFiringType aDelayedOrNormal,
                                     PRBool aIsAsyncChange,
                                     EIsFromUserInput aIsFromUserInput)
 {
--- a/accessible/src/base/nsDocAccessible.h
+++ b/accessible/src/base/nsDocAccessible.h
@@ -252,19 +252,19 @@ protected:
    * @param  aAccessible           [in] the accessible for that node, or nsnull
    *                                 if none exists
    * @param  aIsInserting          [in] is aChangeNode being created or shown
    *                                 (vs. removed or hidden)
    * @param  aIsAsync              [in] whether casual change is async
    * @param  aIsFromUserInput      [in] the event is known to be from user input
    */
   already_AddRefed<nsAccEvent>
-    CreateTextChangeEventForNode(nsIAccessible *aContainerAccessible,
+    CreateTextChangeEventForNode(nsAccessible *aContainerAccessible,
                                  nsIDOMNode *aNode,
-                                 nsIAccessible *aAccessible,
+                                 nsAccessible *aAccessible,
                                  PRBool aIsInserting,
                                  PRBool aIsAsynch,
                                  EIsFromUserInput aIsFromUserInput = eAutoDetect);
 
   /**
    * Used to define should the event be fired on a delay.
    */
   enum EEventFiringType {
--- a/accessible/src/base/nsEventShell.cpp
+++ b/accessible/src/base/nsEventShell.cpp
@@ -47,18 +47,17 @@
 ////////////////////////////////////////////////////////////////////////////////
 
 void
 nsEventShell::FireEvent(nsAccEvent *aEvent)
 {
   if (!aEvent)
     return;
 
-  nsRefPtr<nsAccessible> acc =
-    nsAccUtils::QueryObject<nsAccessible>(aEvent->GetAccessible());
+  nsRefPtr<nsAccessible> acc = do_QueryObject(aEvent->GetAccessible());
   NS_ENSURE_TRUE(acc,);
 
   nsCOMPtr<nsIDOMNode> node;
   aEvent->GetDOMNode(getter_AddRefs(node));
   if (node) {
     sEventTargetNode = node;
     sEventFromUserInput = aEvent->IsFromUserInput();
   }
--- a/accessible/src/base/nsRootAccessible.cpp
+++ b/accessible/src/base/nsRootAccessible.cpp
@@ -71,26 +71,26 @@
 #include "nsIServiceManager.h"
 #include "nsPIDOMWindow.h"
 #include "nsIWebBrowserChrome.h"
 #include "nsReadableUtils.h"
 #include "nsRootAccessible.h"
 #include "nsIDOMNSEventTarget.h"
 #include "nsIDOMDocumentEvent.h"
 #include "nsFocusManager.h"
-#include "Element.h"
+#include "mozilla/dom/Element.h"
 
 
 #ifdef MOZ_XUL
 #include "nsXULTreeAccessible.h"
 #include "nsIXULDocument.h"
 #include "nsIXULWindow.h"
 #endif
 
-using namespace mozilla::dom;
+using namespace mozilla;
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsISupports
 
 // Expanded version of NS_IMPL_ISUPPORTS_INHERITED2 
 // so we can QI directly to concrete nsRootAccessible
 NS_IMPL_QUERY_HEAD(nsRootAccessible)
 NS_IMPL_QUERY_BODY(nsIDOMEventListener)
@@ -142,17 +142,17 @@ nsRootAccessible::GetName(nsAString& aNa
 nsresult
 nsRootAccessible::GetRoleInternal(PRUint32 *aRole) 
 { 
   if (!mDocument) {
     return NS_ERROR_FAILURE;
   }
 
   // If it's a <dialog> or <wizard>, use nsIAccessibleRole::ROLE_DIALOG instead
-  Element *root = mDocument->GetRootElement();
+  dom::Element *root = mDocument->GetRootElement();
   if (root) {
     nsCOMPtr<nsIDOMElement> rootElement(do_QueryInterface(root));
     if (rootElement) {
       nsAutoString name;
       rootElement->GetLocalName(name);
       if (name.EqualsLiteral("dialog") || name.EqualsLiteral("wizard")) {
         *aRole = nsIAccessibleRole::ROLE_DIALOG; // Always at the root
         return NS_OK;
@@ -203,32 +203,27 @@ nsRootAccessible::GetStateInternal(PRUin
     //     how to detect that
     *aState |= nsIAccessibleStates::STATE_MOVEABLE;
   }
 #endif
 
   if (!aExtraState)
     return NS_OK;
 
-  nsCOMPtr<nsIDOMWindow> domWin;
-  GetWindow(getter_AddRefs(domWin));
-  nsCOMPtr<nsIDocShellTreeItem> dsti = do_GetInterface(domWin);
-  if (dsti) {
-    nsCOMPtr<nsIDocShellTreeItem> root;
-    dsti->GetRootTreeItem(getter_AddRefs(root));
-    nsCOMPtr<nsIDOMWindow> rootWindow = do_GetInterface(root);
+  nsCOMPtr<nsIFocusManager> fm = do_GetService(FOCUSMANAGER_CONTRACTID);
+  if (fm) {
+    nsCOMPtr<nsIDOMWindow> rootWindow;
+    GetWindow(getter_AddRefs(rootWindow));
 
-    nsCOMPtr<nsIFocusManager> fm = do_GetService(FOCUSMANAGER_CONTRACTID);
-    if (fm && rootWindow) {
-      nsCOMPtr<nsIDOMWindow> activeWindow;
-      fm->GetActiveWindow(getter_AddRefs(activeWindow));
-      if (activeWindow == rootWindow)
-        *aExtraState |= nsIAccessibleStates::EXT_STATE_ACTIVE;
-    }
+    nsCOMPtr<nsIDOMWindow> activeWindow;
+    fm->GetActiveWindow(getter_AddRefs(activeWindow));
+    if (activeWindow == rootWindow)
+      *aExtraState |= nsIAccessibleStates::EXT_STATE_ACTIVE;
   }
+
 #ifdef MOZ_XUL
   if (GetChromeFlags() & nsIWebBrowserChrome::CHROME_MODAL) {
     *aExtraState |= nsIAccessibleStates::EXT_STATE_MODAL;
   }
 #endif
 
   return NS_OK;
 }
@@ -502,18 +497,17 @@ nsRootAccessible::FireAccessibleFocusEve
       FireDelayedAccessibleEvent(menuEndEvent);
     }
     mCurrentARIAMenubar = nsnull;
   }
 
   nsCOMPtr<nsIContent> focusContent = do_QueryInterface(finalFocusNode);
   nsIFrame *focusFrame = nsnull;
   if (focusContent) {
-    nsCOMPtr<nsIPresShell> shell =
-      nsCoreUtils::GetPresShellFor(finalFocusNode);
+    nsIPresShell *shell = nsCoreUtils::GetPresShellFor(finalFocusNode);
 
     NS_ASSERTION(shell, "No pres shell for final focus node!");
     if (!shell)
       return PR_FALSE;
 
     focusFrame = focusContent->GetPrimaryFrame();
   }
 
@@ -630,38 +624,36 @@ nsresult nsRootAccessible::HandleEventWi
     if (accDoc) {
       nsRefPtr<nsAccessNode> docAccNode = do_QueryObject(accDoc);
       docAccNode->Shutdown();
     }
 
     return NS_OK;
   }
 
-  nsCOMPtr<nsIPresShell> eventShell = nsCoreUtils::GetPresShellFor(aTargetNode);
+  nsIPresShell *eventShell = nsCoreUtils::GetPresShellFor(aTargetNode);
   if (!eventShell) {
     return NS_OK;
   }
 
   if (eventType.EqualsLiteral("DOMContentLoaded")) {
     // Don't create the doc accessible until load scripts have a chance to set
     // role attribute for <body> or <html> element, because the value of 
     // role attribute will be cached when the doc accessible is Init()'d
     TryFireEarlyLoadEvent(aTargetNode);
     return NS_OK;
   }
 
-  nsCOMPtr<nsIAccessible> accessible;
-  accService->GetAccessibleInShell(aTargetNode, eventShell,
-                                   getter_AddRefs(accessible));
+  nsAccessible *accessible =
+    accService->GetAccessibleInShell(aTargetNode, eventShell);
 
   if (eventType.EqualsLiteral("popuphiding"))
     return HandlePopupHidingEvent(aTargetNode, accessible);
 
-  nsRefPtr<nsAccessible> acc(do_QueryObject(accessible));
-  if (!acc)
+  if (!accessible)
     return NS_OK;
 
 #ifdef MOZ_XUL
   if (isTree) {
     nsRefPtr<nsXULTreeAccessible> treeAcc = do_QueryObject(accessible);
     NS_ASSERTION(treeAcc,
                  "Accessible for xul:tree isn't nsXULTreeAccessible.");
 
@@ -710,17 +702,17 @@ nsresult nsRootAccessible::HandleEventWi
       new nsAccStateChangeEvent(accessible,
                                 nsIAccessibleStates::STATE_CHECKED,
                                 PR_FALSE, isEnabled);
 
     nsEventShell::FireEvent(accEvent);
     return NS_OK;
   }
 
-  nsCOMPtr<nsIAccessible> treeItemAccessible;
+  nsAccessible *treeItemAccessible = nsnull;
 #ifdef MOZ_XUL
   // If it's a tree element, need the currently selected item
   if (isTree) {
     nsCOMPtr<nsIDOMXULMultiSelectControlElement> multiSelect =
       do_QueryInterface(aTargetNode);
     if (multiSelect) {
       PRInt32 treeIndex = -1;
       multiSelect->GetCurrentIndex(&treeIndex);
@@ -797,18 +789,17 @@ nsresult nsRootAccessible::HandleEventWi
           nsCOMPtr<nsIDOMXULSelectControlItemElement> selectedItem;
           selectControl->GetSelectedItem(getter_AddRefs(selectedItem));
           if (selectedItem)
             focusedItem = do_QueryInterface(selectedItem);
 
           if (!focusedItem)
             return NS_OK;
 
-          accService->GetAccessibleInShell(focusedItem, eventShell,
-                                           getter_AddRefs(accessible));
+          accessible = accService->GetAccessibleInShell(focusedItem, eventShell);
           if (!accessible)
             return NS_OK;
         }
       }
     }
     FireAccessibleFocusEvent(accessible, focusedItem, aEvent);
   }
   else if (eventType.EqualsLiteral("blur")) {
@@ -831,40 +822,36 @@ nsresult nsRootAccessible::HandleEventWi
   else if (eventType.EqualsLiteral("DOMMenuItemActive")) {
     PRBool fireFocus = PR_FALSE;
     if (!treeItemAccessible) {
 #ifdef MOZ_XUL
       if (isTree) {
         return NS_OK; // Tree with nothing selected
       }
 #endif
-      nsRefPtr<nsAccessNode> menuAccessNode = do_QueryObject(accessible);
-  
-      nsIFrame* menuFrame = menuAccessNode->GetFrame();
+      nsIFrame* menuFrame = accessible->GetFrame();
       NS_ENSURE_TRUE(menuFrame, NS_ERROR_FAILURE);
 
       nsIMenuFrame* imenuFrame = do_QueryFrame(menuFrame);
       if (imenuFrame)
         fireFocus = PR_TRUE;
       // QI failed for nsIMenuFrame means it's not on menu bar
       if (imenuFrame && imenuFrame->IsOnMenuBar() &&
                        !imenuFrame->IsOnActiveMenuBar()) {
         // It is a top level menuitem. Only fire a focus event when the menu bar
         // is active.
         return NS_OK;
       } else {
-        nsCOMPtr<nsIAccessible> containerAccessible;
-        accessible->GetParent(getter_AddRefs(containerAccessible));
+        nsAccessible *containerAccessible = accessible->GetParent();
         NS_ENSURE_TRUE(containerAccessible, NS_ERROR_FAILURE);
         // It is not top level menuitem
         // Only fire focus event if it is not inside collapsed popup
         // and not a listitem of a combo box
         if (nsAccUtils::State(containerAccessible) & nsIAccessibleStates::STATE_COLLAPSED) {
-          nsCOMPtr<nsIAccessible> containerParent;
-          containerAccessible->GetParent(getter_AddRefs(containerParent));
+          nsAccessible *containerParent = containerAccessible->GetParent();
           NS_ENSURE_TRUE(containerParent, NS_ERROR_FAILURE);
           if (nsAccUtils::Role(containerParent) != nsIAccessibleRole::ROLE_COMBOBOX) {
             return NS_OK;
           }
         }
       }
     }
     if (!fireFocus) {
--- a/accessible/src/base/nsTextAccessible.cpp
+++ b/accessible/src/base/nsTextAccessible.cpp
@@ -56,17 +56,17 @@ nsTextAccessible::GetRoleInternal(PRUint
   *aRole = nsIAccessibleRole::ROLE_TEXT_LEAF;
   return NS_OK;
 }
 
 nsresult
 nsTextAccessible::AppendTextTo(nsAString& aText, PRUint32 aStartOffset, PRUint32 aLength)
 {
   nsIFrame *frame = GetFrame();
-  NS_ENSURE_TRUE(frame, NS_ERROR_FAILURE);
+  if (!frame) return NS_ERROR_FAILURE;//NS_ENSURE_TRUE(frame, NS_ERROR_FAILURE);
 
   return frame->GetRenderedText(&aText, nsnull, nsnull, aStartOffset, aLength);
 }
 
 void
 nsTextAccessible::CacheChildren()
 {
   // No children for text accessible.
--- a/accessible/src/base/nsTextAttrs.cpp
+++ b/accessible/src/base/nsTextAttrs.cpp
@@ -76,56 +76,84 @@ static nsCSSTextAttrMapItem gCSSTextAttr
   { "text-decoration",   "underline",     &nsAccessibilityAtoms::textUnderlineStyle,    "solid" },
   { "vertical-align",    kAnyValue,       &nsAccessibilityAtoms::textPosition,          kCopyValue }
 };
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsTextAttrs
 
 nsTextAttrsMgr::nsTextAttrsMgr(nsHyperTextAccessible *aHyperTextAcc,
-                               nsIDOMNode *aHyperTextNode,
                                PRBool aIncludeDefAttrs,
-                               nsIDOMNode *aOffsetNode) :
-  mHyperTextAcc(aHyperTextAcc), mHyperTextNode(aHyperTextNode),
-  mIncludeDefAttrs(aIncludeDefAttrs), mOffsetNode(aOffsetNode)
+                               nsAccessible *aOffsetAcc,
+                               PRInt32 aOffsetAccIdx) :
+  mHyperTextAcc(aHyperTextAcc), mIncludeDefAttrs(aIncludeDefAttrs),
+  mOffsetAcc(aOffsetAcc), mOffsetAccIdx(aOffsetAccIdx)
 {
 }
 
 nsresult
 nsTextAttrsMgr::GetAttributes(nsIPersistentProperties *aAttributes,
                               PRInt32 *aStartHTOffset,
                               PRInt32 *aEndHTOffset)
 {
-  // 1. Hyper text accessible and its DOM node must be specified always.
-  // 2. Offset DOM node and result hyper text offsets must be specifed in
+  // 1. Hyper text accessible must be specified always.
+  // 2. Offset accessible and result hyper text offsets must be specified in
   // the case of text attributes.
-  // 3. Offset DOM node and result hyper text offsets must not be specifed but
-  // include default text attributes flag and attributes list must be specified
-  // in the case of default text attributes.
-  NS_PRECONDITION(mHyperTextAcc && mHyperTextNode &&
-                  ((mOffsetNode && aStartHTOffset && aEndHTOffset) ||
-                  (!mOffsetNode && !aStartHTOffset && !aEndHTOffset &&
+  // 3. Offset accessible and result hyper text offsets must not be specified
+  // but include default text attributes flag and attributes list must be
+  // specified in the case of default text attributes.
+  NS_PRECONDITION(mHyperTextAcc &&
+                  ((mOffsetAcc && mOffsetAccIdx != -1 &&
+                    aStartHTOffset && aEndHTOffset) ||
+                  (!mOffsetAcc && mOffsetAccIdx == -1 &&
+                    !aStartHTOffset && !aEndHTOffset &&
                    mIncludeDefAttrs && aAttributes)),
                   "Wrong usage of nsTextAttrsMgr!");
 
+  // Embedded objects are combined into own range with empty attributes set.
+  if (mOffsetAcc && nsAccUtils::IsEmbeddedObject(mOffsetAcc)) {
+    for (PRInt32 childIdx = mOffsetAccIdx - 1; childIdx >= 0; childIdx--) {
+      nsAccessible *currAcc = mHyperTextAcc->GetChildAt(childIdx);
+      if (!nsAccUtils::IsEmbeddedObject(currAcc))
+        break;
+
+      (*aStartHTOffset)--;
+    }
+
+    PRInt32 childCount = mHyperTextAcc->GetChildCount();
+    for (PRInt32 childIdx = mOffsetAccIdx + 1; childIdx < childCount;
+         childIdx++) {
+      nsAccessible *currAcc = mHyperTextAcc->GetChildAt(childIdx);
+      if (!nsAccUtils::IsEmbeddedObject(currAcc))
+        break;
+
+      (*aEndHTOffset)++;
+    }
+
+    return NS_OK;
+  }
+
+  nsIDOMNode *hyperTextNode = mHyperTextAcc->GetDOMNode();
   nsCOMPtr<nsIDOMElement> hyperTextElm =
-    nsCoreUtils::GetDOMElementFor(mHyperTextNode);
+    nsCoreUtils::GetDOMElementFor(mHyperTextAcc->GetDOMNode());
+  nsIFrame *rootFrame = nsCoreUtils::GetFrameFor(hyperTextElm);
+
+  nsIDOMNode *offsetNode = nsnull;
   nsCOMPtr<nsIDOMElement> offsetElm;
-  if (mOffsetNode)
-    offsetElm = nsCoreUtils::GetDOMElementFor(mOffsetNode);
-
-  nsIFrame *rootFrame = nsCoreUtils::GetFrameFor(hyperTextElm);
   nsIFrame *frame = nsnull;
-  if (offsetElm)
+  if (mOffsetAcc) {
+    offsetNode = mOffsetAcc->GetDOMNode();
+    offsetElm = nsCoreUtils::GetDOMElementFor(offsetNode);
     frame = nsCoreUtils::GetFrameFor(offsetElm);
+  }
 
   nsTPtrArray<nsITextAttr> textAttrArray(10);
 
   // "language" text attribute
-  nsLangTextAttr langTextAttr(mHyperTextAcc, mHyperTextNode, mOffsetNode);
+  nsLangTextAttr langTextAttr(mHyperTextAcc, hyperTextNode, offsetNode);
   textAttrArray.AppendElement(static_cast<nsITextAttr*>(&langTextAttr));
 
   // "color" text attribute
   nsCSSTextAttr colorTextAttr(0, hyperTextElm, offsetElm);
   textAttrArray.AppendElement(static_cast<nsITextAttr*>(&colorTextAttr));
 
   // "font-family" text attribute
   nsCSSTextAttr fontFamilyTextAttr(1, hyperTextElm, offsetElm);
@@ -169,243 +197,89 @@ nsTextAttrsMgr::GetAttributes(nsIPersist
       if (textAttr->GetValue(value, mIncludeDefAttrs))
         nsAccUtils::SetAccAttr(aAttributes, textAttr->GetName(), value);
     }
   }
 
   nsresult rv = NS_OK;
 
   // Expose text attributes range where they are applied if applicable.
-  if (mOffsetNode)
+  if (mOffsetAcc)
     rv = GetRange(textAttrArray, aStartHTOffset, aEndHTOffset);
 
   textAttrArray.Clear();
   return rv;
 }
 
 nsresult
 nsTextAttrsMgr::GetRange(const nsTPtrArray<nsITextAttr>& aTextAttrArray,
                          PRInt32 *aStartHTOffset, PRInt32 *aEndHTOffset)
 {
-  nsCOMPtr<nsIDOMElement> rootElm =
-    nsCoreUtils::GetDOMElementFor(mHyperTextNode);
-  NS_ENSURE_STATE(rootElm);
+  PRUint32 attrLen = aTextAttrArray.Length();
 
-  nsCOMPtr<nsIDOMNode> tmpNode(mOffsetNode);
-  nsCOMPtr<nsIDOMNode> currNode(mOffsetNode);
-
-  PRUint32 len = aTextAttrArray.Length();
+  // Navigate backward from anchor accessible to find start offset.
+  for (PRInt32 childIdx = mOffsetAccIdx - 1; childIdx >= 0; childIdx--) {
+    nsAccessible *currAcc = mHyperTextAcc->GetChildAt(childIdx);
 
-  // Navigate backwards and forwards from current node to the root node to
-  // calculate range bounds for the text attribute. Navigation sequence is the
-  // following:
-  // 1. Navigate through the siblings.
-  // 2. If the traversed sibling has children then navigate from its leaf child
-  //    to it through whole tree of the traversed sibling.
-  // 3. Get the parent and cycle algorithm until the root node.
+    // Stop on embedded accessible since embedded accessibles are combined into
+    // own range.
+    if (nsAccUtils::IsEmbeddedObject(currAcc))
+      break;
 
-  // Navigate backwards (find the start offset).
-  while (currNode && currNode != rootElm) {
-    nsCOMPtr<nsIDOMElement> currElm(nsCoreUtils::GetDOMElementFor(currNode));
+    nsCOMPtr<nsIDOMElement> currElm =
+      nsCoreUtils::GetDOMElementFor(currAcc->GetDOMNode());
     NS_ENSURE_STATE(currElm);
 
-    if (currNode != mOffsetNode) {
-      PRBool stop = PR_FALSE;
-      for (PRUint32 idx = 0; idx < len; idx++) {
-        nsITextAttr *textAttr = aTextAttrArray[idx];
-        if (!textAttr->Equal(currElm)) {
-
-          PRInt32 startHTOffset = 0;
-          nsCOMPtr<nsIAccessible> startAcc;
-          nsresult rv = mHyperTextAcc->
-            DOMPointToHypertextOffset(tmpNode, -1, &startHTOffset,
-                                      getter_AddRefs(startAcc));
-          NS_ENSURE_SUCCESS(rv, rv);
-
-          if (!startAcc)
-            startHTOffset = 0;
-
-          if (startHTOffset > *aStartHTOffset)
-            *aStartHTOffset = startHTOffset;
-
-          stop = PR_TRUE;
-          break;
-        }
-      }
-      if (stop)
-        break;
-    }
-
-    currNode->GetPreviousSibling(getter_AddRefs(tmpNode));
-    if (tmpNode) {
-      // Navigate through the subtree of traversed children to calculate
-      // left bound of the range.
-      FindStartOffsetInSubtree(aTextAttrArray, tmpNode, currNode,
-                               aStartHTOffset);
-    }
-
-    currNode->GetParentNode(getter_AddRefs(tmpNode));
-    currNode.swap(tmpNode);
-  }
-
-  // Navigate forwards (find the end offset).
-  PRBool moveIntoSubtree = PR_TRUE;
-  currNode = mOffsetNode;
-
-  while (currNode && currNode != rootElm) {
-    nsCOMPtr<nsIDOMElement> currElm(nsCoreUtils::GetDOMElementFor(currNode));
-    NS_ENSURE_STATE(currElm);
-
-    // Stop new end offset searching if the given text attribute changes its
-    // value.
-    PRBool stop = PR_FALSE;
-    for (PRUint32 idx = 0; idx < len; idx++) {
-      nsITextAttr *textAttr = aTextAttrArray[idx];
+    PRBool offsetFound = PR_FALSE;
+    for (PRUint32 attrIdx = 0; attrIdx < attrLen; attrIdx++) {
+      nsITextAttr *textAttr = aTextAttrArray[attrIdx];
       if (!textAttr->Equal(currElm)) {
-
-        PRInt32 endHTOffset = 0;
-        nsresult rv = mHyperTextAcc->
-          DOMPointToHypertextOffset(currNode, -1, &endHTOffset);
-        NS_ENSURE_SUCCESS(rv, rv);
-
-        if (endHTOffset < *aEndHTOffset)
-          *aEndHTOffset = endHTOffset;
-
-        stop = PR_TRUE;
+        offsetFound = PR_TRUE;
         break;
       }
     }
 
-    if (stop)
+    if (offsetFound)
+      break;
+
+    *(aStartHTOffset) -= nsAccUtils::TextLength(currAcc);
+  }
+
+  // Navigate forward from anchor accessible to find end offset.
+  PRInt32 childLen = mHyperTextAcc->GetChildCount();
+  for (PRInt32 childIdx = mOffsetAccIdx + 1; childIdx < childLen; childIdx++) {
+    nsAccessible *currAcc = mHyperTextAcc->GetChildAt(childIdx);
+    if (nsAccUtils::IsEmbeddedObject(currAcc))
       break;
 
-    if (moveIntoSubtree) {
-      // Navigate through subtree of traversed node. We use 'moveIntoSubtree'
-      // flag to avoid traversing the same subtree twice.
-      currNode->GetFirstChild(getter_AddRefs(tmpNode));
-      if (tmpNode)
-        FindEndOffsetInSubtree(aTextAttrArray, tmpNode, aEndHTOffset);
+    nsCOMPtr<nsIDOMElement> currElm =
+      nsCoreUtils::GetDOMElementFor(currAcc->GetDOMNode());
+    NS_ENSURE_STATE(currElm);
+
+    PRBool offsetFound = PR_FALSE;
+    for (PRUint32 attrIdx = 0; attrIdx < attrLen; attrIdx++) {
+      nsITextAttr *textAttr = aTextAttrArray[attrIdx];
+
+      // Alter the end offset when text attribute changes its value and stop
+      // the search.
+      if (!textAttr->Equal(currElm)) {
+        offsetFound = PR_TRUE;
+        break;
+      }
     }
 
-    currNode->GetNextSibling(getter_AddRefs(tmpNode));
-    moveIntoSubtree = PR_TRUE;
-    if (!tmpNode) {
-      currNode->GetParentNode(getter_AddRefs(tmpNode));
-      moveIntoSubtree = PR_FALSE;
-    }
+    if (offsetFound)
+      break;
 
-    currNode.swap(tmpNode);
+    (*aEndHTOffset) += nsAccUtils::TextLength(currAcc);
   }
 
   return NS_OK;
 }
 
-PRBool
-nsTextAttrsMgr::FindEndOffsetInSubtree(const nsTPtrArray<nsITextAttr>& aTextAttrArray,
-                                       nsIDOMNode *aCurrNode,
-                                       PRInt32 *aHTOffset)
-{
-  if (!aCurrNode)
-    return PR_FALSE;
-
-  nsCOMPtr<nsIDOMElement> currElm(nsCoreUtils::GetDOMElementFor(aCurrNode));
-  if (!currElm)
-    return PR_FALSE;
-
-  // If the given text attribute (pointed by nsTextAttr object) changes its
-  // value on the traversed element then fit the end of range.
-  PRUint32 len = aTextAttrArray.Length();
-  for (PRUint32 idx = 0; idx < len; idx++) {
-    nsITextAttr *textAttr = aTextAttrArray[idx];
-    if (!textAttr->Equal(currElm)) {
-      PRInt32 endHTOffset = 0;
-      nsresult rv = mHyperTextAcc->
-        DOMPointToHypertextOffset(aCurrNode, -1, &endHTOffset);
-      NS_ENSURE_SUCCESS(rv, PR_FALSE);
-
-      if (endHTOffset < *aHTOffset)
-        *aHTOffset = endHTOffset;
-
-      return PR_TRUE;
-    }
-  }
-
-  // Deeply traverse into the tree to fit the end of range.
-  nsCOMPtr<nsIDOMNode> nextNode;
-  aCurrNode->GetFirstChild(getter_AddRefs(nextNode));
-  if (nextNode) {
-    PRBool res = FindEndOffsetInSubtree(aTextAttrArray, nextNode, aHTOffset);
-    if (res)
-      return res;
-  }
-
-  aCurrNode->GetNextSibling(getter_AddRefs(nextNode));
-  if (nextNode) {
-    if (FindEndOffsetInSubtree(aTextAttrArray, nextNode, aHTOffset))
-      return PR_TRUE;
-  }
-
-  return PR_FALSE;
-}
-
-PRBool
-nsTextAttrsMgr::FindStartOffsetInSubtree(const nsTPtrArray<nsITextAttr>& aTextAttrArray,
-                                         nsIDOMNode *aCurrNode,
-                                         nsIDOMNode *aPrevNode,
-                                         PRInt32 *aHTOffset)
-{
-  if (!aCurrNode)
-    return PR_FALSE;
-
-  // Find the closest element back to the traversed element.
-  nsCOMPtr<nsIDOMNode> nextNode;
-  aCurrNode->GetLastChild(getter_AddRefs(nextNode));
-  if (nextNode) {
-    if (FindStartOffsetInSubtree(aTextAttrArray, nextNode, aPrevNode, aHTOffset))
-      return PR_TRUE;
-  }
-
-  nsCOMPtr<nsIDOMElement> currElm(nsCoreUtils::GetDOMElementFor(aCurrNode));
-  if (!currElm)
-    return PR_FALSE;
-
-  // If the given text attribute (pointed by nsTextAttr object) changes its
-  // value on the traversed element then fit the start of range.
-  PRUint32 len = aTextAttrArray.Length();
-  for (PRUint32 idx = 0; idx < len; idx++) {
-    nsITextAttr *textAttr = aTextAttrArray[idx];
-    if (!textAttr->Equal(currElm)) {
-
-      PRInt32 startHTOffset = 0;
-      nsCOMPtr<nsIAccessible> startAcc;
-      nsresult rv = mHyperTextAcc->
-        DOMPointToHypertextOffset(aPrevNode, -1, &startHTOffset,
-                                  getter_AddRefs(startAcc));
-      NS_ENSURE_SUCCESS(rv, PR_FALSE);
-
-      if (!startAcc)
-        startHTOffset = 0;
-
-      if (startHTOffset > *aHTOffset)
-        *aHTOffset = startHTOffset;
-
-      return PR_TRUE;
-    }
-  }
-
-  // Moving backwards to find the start of range.
-  aCurrNode->GetPreviousSibling(getter_AddRefs(nextNode));
-  if (nextNode) {
-    if (FindStartOffsetInSubtree(aTextAttrArray, nextNode, aCurrNode, aHTOffset))
-      return PR_TRUE;
-  }
-
-  return PR_FALSE;
-}
-
 ////////////////////////////////////////////////////////////////////////////////
 // nsLangTextAttr
 
 nsLangTextAttr::nsLangTextAttr(nsHyperTextAccessible *aRootAcc, 
                                nsIDOMNode *aRootNode, nsIDOMNode *aNode) :
   nsTextAttr<nsAutoString>(aNode == nsnull)
 {
   mRootContent = do_QueryInterface(aRootNode);
--- a/accessible/src/base/nsTextAttrs.h
+++ b/accessible/src/base/nsTextAttrs.h
@@ -64,32 +64,32 @@ class nsITextAttr;
  * @note "invalid: spelling" text attrbiute is implemented entirerly in
  *       nsHyperTextAccessible class.
  */
 class nsTextAttrsMgr
 {
 public:
   /**
    * Constructor. If instance of the class is intended to expose default text
-   * attributes then 'aIncludeDefAttrs' and 'oOffsetNode' argument must be
+   * attributes then 'aIncludeDefAttrs' and 'aOffsetNode' argument must be
    * skiped.
    *
    * @param aHyperTextAcc    hyper text accessible text attributes are
    *                         calculated for
    * @param aHyperTextNode   DOM node of the given hyper text accessbile
    * @param aIncludeDefAttrs [optional] indicates whether default text
    *                         attributes should be included into list of exposed
    *                         text attributes.
    * @param oOffsetNode      [optional] DOM node represents hyper text offset
    *                         inside hyper text accessible
    */
   nsTextAttrsMgr(nsHyperTextAccessible *aHyperTextAcc,
-                 nsIDOMNode *aHyperTextNode,
                  PRBool aIncludeDefAttrs = PR_TRUE,
-                 nsIDOMNode *oOffsetNode = nsnull);
+                 nsAccessible *aOffsetAcc = nsnull,
+                 PRInt32 aOffsetAccIdx = -1);
 
   /*
    * Return text attributes and hyper text offsets where these attributes are
    * applied. Offsets are calculated in the case of non default attributes.
    *
    * @note In the case of default attributes pointers on hyper text offsets
    *       must be skiped.
    *
@@ -110,51 +110,23 @@ protected:
    *
    * @param aTextAttrArray  [in] text attributes array
    * @param aStartHTOffset  [in, out] the start offset
    * @param aEndHTOffset    [in, out] the end offset
    */
    nsresult GetRange(const nsTPtrArray<nsITextAttr>& aTextAttrArray,
                      PRInt32 *aStartHTOffset, PRInt32 *aEndHTOffset);
 
-  /*
-   * Find new end offset for text attributes navigating through the tree. New
-   * end offset may be smaller if one of text attributes changes its value
-   * before the given end offset.
-   *
-   * @param  aTextAttrArray  [in] text attributes array
-   * @param  aCurrNode       [in] the first node of the tree
-   * @param  aHTOffset       [in, out] the end offset
-   * @return                 true if the end offset has been changed
-   */
-   PRBool FindEndOffsetInSubtree(const nsTPtrArray<nsITextAttr>& aTextAttrArray,
-                                 nsIDOMNode *aCurrNode, PRInt32 *aHTOffset);
-
-  /*
-   * Find the start offset for text attributes navigating through the tree. New
-   * start offset may be bigger if one of text attributes changes its value
-   * after the given start offset.
-   *
-   * @param  aTextAttrArray  [in] text attributes array
-   * @param  aCurrNode       [in] the node navigating through thee thee is
-   *                         started from
-   * @param  aPrevNode       [in] the previous node placed before the start node
-   * @param  aHTOffset       [in, out] the start offset
-   * @return                 true if the start offset has been changed
-   */
-   PRBool FindStartOffsetInSubtree(const nsTPtrArray<nsITextAttr>& aTextAttrArray,
-                                   nsIDOMNode *aCurrNode, nsIDOMNode *aPrevNode,
-                                   PRInt32 *aHTOffset);
-
 private:
   nsRefPtr<nsHyperTextAccessible> mHyperTextAcc;
-  nsCOMPtr<nsIDOMNode> mHyperTextNode;
 
   PRBool mIncludeDefAttrs;
-  nsCOMPtr<nsIDOMNode> mOffsetNode;
+
+  nsRefPtr<nsAccessible> mOffsetAcc;
+  PRInt32 mOffsetAccIdx;
 };
 
 
 ////////////////////////////////////////////////////////////////////////////////
 // Private implementation details
 
 /**
  * Interface class of text attribute class implementations.
--- a/accessible/src/base/nsTextEquivUtils.cpp
+++ b/accessible/src/base/nsTextEquivUtils.cpp
@@ -136,36 +136,35 @@ nsTextEquivUtils::AppendTextEquivFromCon
 {
   // Prevent recursion which can cause infinite loops.
   if (gInitiatorAcc)
     return NS_OK;
 
   gInitiatorAcc = aInitiatorAcc;
 
   nsCOMPtr<nsIDOMNode> DOMNode(do_QueryInterface(aContent));
-  nsCOMPtr<nsIPresShell> shell = nsCoreUtils::GetPresShellFor(DOMNode);
+  nsIPresShell *shell = nsCoreUtils::GetPresShellFor(DOMNode);
   if (!shell) {
     NS_ASSERTION(PR_TRUE, "There is no presshell!");
     gInitiatorAcc = nsnull;
     return NS_ERROR_UNEXPECTED;
   }
 
   // If the given content is not visible or isn't accessible then go down
   // through the DOM subtree otherwise go down through accessible subtree and
   // calculate the flat string.
   nsIFrame *frame = aContent->GetPrimaryFrame();
   PRBool isVisible = frame && frame->GetStyleVisibility()->IsVisible();
 
   nsresult rv = NS_ERROR_FAILURE;
   PRBool goThroughDOMSubtree = PR_TRUE;
 
   if (isVisible) {
-    nsCOMPtr<nsIAccessible> accessible;
-    GetAccService()->GetAccessibleInShell(DOMNode, shell,
-                                               getter_AddRefs(accessible));
+    nsAccessible *accessible =
+      GetAccService()->GetAccessibleInShell(DOMNode, shell);
     if (accessible) {
       rv = AppendFromAccessible(accessible, aString);
       goThroughDOMSubtree = PR_FALSE;
     }
   }
 
   if (goThroughDOMSubtree)
     rv = AppendFromDOMNode(aContent, aString);
@@ -232,26 +231,24 @@ nsTextEquivUtils::AppendTextEquivFromTex
 // nsTextEquivUtils. Private.
 
 nsCOMPtr<nsIAccessible> nsTextEquivUtils::gInitiatorAcc;
 
 nsresult
 nsTextEquivUtils::AppendFromAccessibleChildren(nsIAccessible *aAccessible,
                                                nsAString *aString)
 {
-  nsCOMPtr<nsIAccessible> accChild, accNextChild;
-  aAccessible->GetFirstChild(getter_AddRefs(accChild));
+  nsresult rv = NS_OK_NO_NAME_CLAUSE_HANDLED;
 
-  nsresult rv = NS_OK_NO_NAME_CLAUSE_HANDLED;
-  while (accChild) {
-    rv = AppendFromAccessible(accChild, aString);
+  nsRefPtr<nsAccessible> accessible(do_QueryObject(aAccessible));
+  PRInt32 childCount = accessible->GetChildCount();
+  for (PRInt32 childIdx = 0; childIdx < childCount; childIdx++) {
+    nsAccessible *child = accessible->GetChildAt(childIdx);
+    rv = AppendFromAccessible(child, aString);
     NS_ENSURE_SUCCESS(rv, rv);
-
-    accChild->GetNextSibling(getter_AddRefs(accNextChild));
-    accChild.swap(accNextChild);
   }
 
   return rv;
 }
 
 nsresult
 nsTextEquivUtils::AppendFromAccessible(nsIAccessible *aAccessible,
                                        nsAString *aString)
--- a/accessible/src/html/nsHTMLImageAccessible.cpp
+++ b/accessible/src/html/nsHTMLImageAccessible.cpp
@@ -180,17 +180,17 @@ nsHTMLImageAccessible::DoAction(PRUint8 
     nsCOMPtr<nsIDOMDocument> domDocument;
     rv = mDOMNode->GetOwnerDocument(getter_AddRefs(domDocument));
     NS_ENSURE_SUCCESS(rv, rv);
     nsCOMPtr<nsIDocument> document(do_QueryInterface(domDocument));
     nsCOMPtr<nsPIDOMWindow> piWindow = document->GetWindow();
     nsCOMPtr<nsIDOMWindowInternal> win(do_QueryInterface(piWindow));
     NS_ENSURE_TRUE(win, NS_ERROR_FAILURE);
     nsCOMPtr<nsIDOMWindow> tmp;
-    return win->Open(longDesc, NS_LITERAL_STRING(""), NS_LITERAL_STRING(""),
+    return win->Open(longDesc, EmptyString(), EmptyString(),
                      getter_AddRefs(tmp));
   }
   return nsLinkableAccessible::DoAction(aIndex);
 }
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsIAccessibleImage
 
--- a/accessible/src/html/nsHTMLSelectAccessible.cpp
+++ b/accessible/src/html/nsHTMLSelectAccessible.cpp
@@ -115,29 +115,29 @@ void nsHTMLSelectableAccessible::iterato
     (*aSelectionCount)++;
 }
 
 void
 nsHTMLSelectableAccessible::iterator::AddAccessibleIfSelected(nsIMutableArray *aSelectedAccessibles, 
                                                               nsPresContext *aContext)
 {
   PRBool isSelected = PR_FALSE;
-  nsRefPtr<nsAccessible> tempAcc;
+  nsAccessible *optionAcc = nsnull;
 
   if (mOption) {
     mOption->GetSelected(&isSelected);
     if (isSelected) {
       nsCOMPtr<nsIDOMNode> optionNode(do_QueryInterface(mOption));
-      tempAcc = GetAccService()->GetAccessibleInWeakShell(optionNode,
-                                                          mWeakShell);
+      optionAcc = GetAccService()->GetAccessibleInWeakShell(optionNode,
+                                                            mWeakShell);
     }
   }
 
-  if (tempAcc)
-    aSelectedAccessibles->AppendElement(static_cast<nsIAccessible*>(tempAcc),
+  if (optionAcc)
+    aSelectedAccessibles->AppendElement(static_cast<nsIAccessible*>(optionAcc),
                                         PR_FALSE);
 }
 
 PRBool
 nsHTMLSelectableAccessible::iterator::GetAccessibleIfSelected(PRInt32 aIndex,
                                                               nsPresContext *aContext, 
                                                               nsIAccessible **aAccessible)
 {
@@ -145,20 +145,19 @@ nsHTMLSelectableAccessible::iterator::Ge
 
   *aAccessible = nsnull;
 
   if (mOption) {
     mOption->GetSelected(&isSelected);
     if (isSelected) {
       if (mSelCount == aIndex) {
         nsCOMPtr<nsIDOMNode> optionNode(do_QueryInterface(mOption));
-        nsRefPtr<nsAccessible> acc =
+        nsAccessible *accessible =
           GetAccService()->GetAccessibleInWeakShell(optionNode, mWeakShell);
-        if (acc)
-          CallQueryInterface(acc, aAccessible);
+        NS_IF_ADDREF(*aAccessible = accessible);
 
         return PR_TRUE;
       }
       mSelCount++;
     }
   }
 
   return PR_FALSE;
@@ -397,21 +396,21 @@ nsHTMLSelectListAccessible::CacheOptSibl
 
     nsCOMPtr<nsIAtom> tag = childContent->Tag();
     if (tag == nsAccessibilityAtoms::option ||
         tag == nsAccessibilityAtoms::optgroup) {
 
       // Get an accessible for option or optgroup and cache it.
       nsCOMPtr<nsIDOMNode> childNode(do_QueryInterface(childContent));
 
-      nsRefPtr<nsAccessible> acc =
+      nsAccessible *accessible =
         GetAccService()->GetAccessibleInWeakShell(childNode, mWeakShell);
-      if (acc) {
-        mChildren.AppendElement(acc);
-        acc->SetParent(this);
+      if (accessible) {
+        mChildren.AppendElement(accessible);
+        accessible->SetParent(this);
       }
 
       // Deep down into optgroup element.
       if (tag == nsAccessibilityAtoms::optgroup)
         CacheOptSiblings(childContent);
     }
   }
 }
@@ -431,17 +430,17 @@ nsHTMLSelectOptionAccessible::
   if (!parentNode)
     return;
 
   // If the parent node is a Combobox, then the option's accessible parent
   // is nsHTMLComboboxListAccessible, not the nsHTMLComboboxAccessible that
   // GetParent would normally return. This is because the 
   // nsHTMLComboboxListAccessible is inserted into the accessible hierarchy
   // where there is no DOM node for it.
-  nsRefPtr<nsAccessible> parentAcc =
+  nsAccessible *parentAcc =
     GetAccService()->GetAccessibleInWeakShell(parentNode, mWeakShell);
   if (!parentAcc)
     return;
 
   if (nsAccUtils::RoleInternal(parentAcc) == nsIAccessibleRole::ROLE_COMBOBOX) {
     PRInt32 childCount = parentAcc->GetChildCount();
     parentAcc = parentAcc->GetChildAt(childCount - 1);
   }
@@ -1004,21 +1003,21 @@ NS_IMETHODIMP nsHTMLComboboxAccessible::
   aDescription.Truncate();
   // First check to see if combo box itself has a description, perhaps through
   // tooltip (title attribute) or via aria-describedby
   nsAccessible::GetDescription(aDescription);
   if (!aDescription.IsEmpty()) {
     return NS_OK;
   }
   // Use description of currently focused option
-  nsRefPtr<nsAccessible> optionAcc = GetFocusedOptionAccessible();
-  return optionAcc ? optionAcc->GetDescription(aDescription) : NS_OK;
+  nsAccessible *option = GetFocusedOptionAccessible();
+  return option ? option->GetDescription(aDescription) : NS_OK;
 }
 
-already_AddRefed<nsAccessible>
+nsAccessible *
 nsHTMLComboboxAccessible::GetFocusedOptionAccessible()
 {
   if (IsDefunct())
     return nsnull;
 
   nsCOMPtr<nsIDOMNode> focusedOptionNode;
   nsHTMLSelectOptionAccessible::
     GetFocusedOptionNode(mDOMNode, getter_AddRefs(focusedOptionNode));
@@ -1033,18 +1032,18 @@ nsHTMLComboboxAccessible::GetFocusedOpti
 /**
   * MSAA/ATK accessible value != HTML value, especially not in combo boxes.
   * Our accessible value is the text label for of our ( first ) selected child.
   * The easiest way to get this is from the first child which is the readonly textfield.
   */
 NS_IMETHODIMP nsHTMLComboboxAccessible::GetValue(nsAString& aValue)
 {
   // Use accessible name of currently focused option.
-  nsRefPtr<nsAccessible> optionAcc = GetFocusedOptionAccessible();
-  return optionAcc ? optionAcc->GetName(aValue) : NS_OK;
+  nsAccessible *option = GetFocusedOptionAccessible();
+  return option ? option->GetName(aValue) : NS_OK;
 }
 
 /** Just one action ( click ). */
 NS_IMETHODIMP nsHTMLComboboxAccessible::GetNumActions(PRUint8 *aNumActions)
 {
   *aNumActions = 1;
   return NS_OK;
 }
--- a/accessible/src/html/nsHTMLSelectAccessible.h
+++ b/accessible/src/html/nsHTMLSelectAccessible.h
@@ -239,17 +239,17 @@ protected:
   // nsAccessible
   virtual void CacheChildren();
 
   // nsHTMLComboboxAccessible
 
   /**
    * Return focused option accessible.
    */
-  already_AddRefed<nsAccessible> GetFocusedOptionAccessible();
+  nsAccessible *GetFocusedOptionAccessible();
 
 private:
   nsRefPtr<nsHTMLComboboxListAccessible> mListAccessible;
 };
 
 /*
  * A class that represents the window that lives to the right
  * of the drop down button inside the Select. This is the window
--- a/accessible/src/html/nsHTMLTableAccessible.cpp
+++ b/accessible/src/html/nsHTMLTableAccessible.cpp
@@ -330,25 +330,25 @@ nsHTMLTableCellAccessible::GetHeaderCell
     NS_ENSURE_SUCCESS(rv, rv);
 
     PRUint32 count = 0;
     rv = headerCellElms->GetLength(&count);
     if (NS_SUCCEEDED(rv) && count > 0) {
       nsCOMPtr<nsIDOMNode> headerCellNode;
       for (PRUint32 idx = 0; idx < count; idx++) {
         headerCellNode = do_QueryElementAt(headerCellElms, idx, &rv);
-        nsRefPtr<nsAccessible> headerCell =
+        nsAccessible *headerCell =
           GetAccService()->GetAccessibleInWeakShell(headerCellNode, mWeakShell);
 
         if (headerCell &&
             (aRowOrColumnHeaderCell == nsAccUtils::eRowHeaderCells &&
              nsAccUtils::Role(headerCell) == nsIAccessibleRole::ROLE_ROWHEADER ||
              aRowOrColumnHeaderCell == nsAccUtils::eColumnHeaderCells &&
              nsAccUtils::Role(headerCell) == nsIAccessibleRole::ROLE_COLUMNHEADER))
-          headerCells->AppendElement(static_cast<nsIAccessible*>(headerCell.get()),
+          headerCells->AppendElement(static_cast<nsIAccessible*>(headerCell),
                                      PR_FALSE);
       }
     }
 
     NS_ADDREF(*aHeaderCells = headerCells);
     return NS_OK;
   }
 
@@ -733,19 +733,19 @@ nsHTMLTableAccessible::GetSelectedCells(
                                       *getter_AddRefs(cellElement),
                                       startRowIndex, startColIndex,
                                       rowSpan, colSpan,
                                       actualRowSpan, actualColSpan,
                                       isSelected);
 
       if (NS_SUCCEEDED(rv) && startRowIndex == rowIndex &&
           startColIndex == columnIndex && isSelected) {
-        nsRefPtr<nsAccessible> cell =
+        nsAccessible *cell =
           GetAccService()->GetAccessibleInWeakShell(cellElement, mWeakShell);
-        selCells->AppendElement(static_cast<nsIAccessible*>(cell.get()), PR_FALSE);
+        selCells->AppendElement(static_cast<nsIAccessible*>(cell), PR_FALSE);
       }
     }
   }
 
   NS_ADDREF(*aCells = selCells);
   return NS_OK;
 }
 
@@ -906,20 +906,20 @@ nsHTMLTableAccessible::GetSelectedRowInd
 NS_IMETHODIMP
 nsHTMLTableAccessible::GetCellAt(PRInt32 aRow, PRInt32 aColumn,
                                  nsIAccessible **aTableCellAccessible)
 {
   nsCOMPtr<nsIDOMElement> cellElement;
   nsresult rv = GetCellAt(aRow, aColumn, *getter_AddRefs(cellElement));
   NS_ENSURE_SUCCESS(rv, rv);
 
-  nsRefPtr<nsAccessible> cellAcc =
+  nsAccessible *cell =
     GetAccService()->GetAccessibleInWeakShell(cellElement, mWeakShell);
-  if (cellAcc)
-    CallQueryInterface(cellAcc, aTableCellAccessible);
+  if (cell)
+    CallQueryInterface(cell, aTableCellAccessible);
 
   return NS_OK;
 }
 
 NS_IMETHODIMP
 nsHTMLTableAccessible::GetCellIndexAt(PRInt32 aRow, PRInt32 aColumn,
                                       PRInt32 *aIndex)
 {
--- a/accessible/src/html/nsHyperTextAccessible.cpp
+++ b/accessible/src/html/nsHyperTextAccessible.cpp
@@ -272,18 +272,18 @@ nsIntRect nsHyperTextAccessible::GetBoun
 
 /*
  * Gets the specified text.
  */
 nsIFrame*
 nsHyperTextAccessible::GetPosAndText(PRInt32& aStartOffset, PRInt32& aEndOffset,
                                      nsAString *aText, nsIFrame **aEndFrame,
                                      nsIntRect *aBoundsRect,
-                                     nsIAccessible **aStartAcc,
-                                     nsIAccessible **aEndAcc)
+                                     nsAccessible **aStartAcc,
+                                     nsAccessible **aEndAcc)
 {
   if (aStartOffset == nsIAccessibleText::TEXT_OFFSET_END_OF_TEXT) {
     GetCharacterCount(&aStartOffset);
   }
   if (aStartOffset == nsIAccessibleText::TEXT_OFFSET_CARET) {
     GetCaretOffset(&aStartOffset);
   }
   if (aEndOffset == nsIAccessibleText::TEXT_OFFSET_END_OF_TEXT) {
@@ -518,98 +518,94 @@ NS_IMETHODIMP nsHyperTextAccessible::Get
 
   if (text.IsEmpty()) {
     return NS_ERROR_FAILURE;
   }
   *aCharacter = text.First();
   return NS_OK;
 }
 
-nsresult nsHyperTextAccessible::DOMPointToHypertextOffset(nsIDOMNode* aNode, PRInt32 aNodeOffset,
-                                                          PRInt32* aHyperTextOffset,
-                                                          nsIAccessible **aFinalAccessible,
-                                                          PRBool aIsEndOffset)
+nsAccessible*
+nsHyperTextAccessible::DOMPointToHypertextOffset(nsIDOMNode *aNode,
+                                                 PRInt32 aNodeOffset,
+                                                 PRInt32 *aHyperTextOffset,
+                                                 PRBool aIsEndOffset)
 {
-  // Turn a DOM Node and offset into an offset into this hypertext.
-  // On failure, return null. On success, return the DOM node which contains the offset.
-  NS_ENSURE_ARG_POINTER(aHyperTextOffset);
+  if (!aHyperTextOffset)
+    return nsnull;
   *aHyperTextOffset = 0;
 
-  if (!aNode) {
-    return NS_ERROR_FAILURE;
-  }
-  if (aFinalAccessible) {
-    *aFinalAccessible = nsnull;
-  }
+  if (!aNode)
+    return nsnull;
 
   PRUint32 addTextOffset = 0;
   nsCOMPtr<nsIDOMNode> findNode;
 
   unsigned short nodeType;
   aNode->GetNodeType(&nodeType);
   if (aNodeOffset == -1) {
     findNode = aNode;
   }
   else if (nodeType == nsIDOMNode::TEXT_NODE) {
     // For text nodes, aNodeOffset comes in as a character offset
     // Text offset will be added at the end, if we find the offset in this hypertext
     // We want the "skipped" offset into the text (rendered text without the extra whitespace)
     nsCOMPtr<nsIContent> content = do_QueryInterface(aNode);
     NS_ASSERTION(content, "No nsIContent for dom node");
     nsIFrame *frame = content->GetPrimaryFrame();
-    NS_ENSURE_TRUE(frame, NS_ERROR_FAILURE);
+    NS_ENSURE_TRUE(frame, nsnull);
     nsresult rv = ContentToRenderedOffset(frame, aNodeOffset, &addTextOffset);
-    NS_ENSURE_SUCCESS(rv, rv);
+    NS_ENSURE_SUCCESS(rv, nsnull);
     // Get the child node and 
     findNode = aNode;
   }
   else {
     // For non-text nodes, aNodeOffset comes in as a child node index
     nsCOMPtr<nsIContent> parentContent(do_QueryInterface(aNode));
     // Should not happen, but better to protect against crash if doc node is somehow passed in
-    NS_ENSURE_TRUE(parentContent, NS_ERROR_FAILURE);
+    NS_ENSURE_TRUE(parentContent, nsnull);
     // findNode could be null if aNodeOffset == # of child nodes, which means one of two things:
     // 1) we're at the end of the children, keep findNode = null, so that we get the last possible offset
     // 2) there are no children and the passed-in node is mDOMNode, which means we're an aempty nsIAccessibleText
     // 3) there are no children, and the passed-in node is not mDOMNode -- use parentContent for the node to find
      
     findNode = do_QueryInterface(parentContent->GetChildAt(aNodeOffset));
     if (!findNode && !aNodeOffset) {
       if (SameCOMIdentity(parentContent, mDOMNode)) {
         // There are no children, which means this is an empty nsIAccessibleText, in which
         // case we can only be at hypertext offset 0
         *aHyperTextOffset = 0;
-        return NS_OK;
+        return nsnull;
       }
       findNode = do_QueryInterface(parentContent); // Case #2: there are no children
     }
   }
 
   // Get accessible for this findNode, or if that node isn't accessible, use the
   // accessible for the next DOM node which has one (based on forward depth first search)
-  nsRefPtr<nsAccessible> descendantAcc;
+  nsAccessible *descendantAcc = nsnull;
   if (findNode) {
     nsCOMPtr<nsIContent> findContent = do_QueryInterface(findNode);
     if (findContent->IsHTML() && 
         findContent->NodeInfo()->Equals(nsAccessibilityAtoms::br) &&
         findContent->AttrValueIs(kNameSpaceID_None,
                                  nsAccessibilityAtoms::mozeditorbogusnode,
                                  nsAccessibilityAtoms::_true,
                                  eIgnoreCase)) {
       // This <br> is the hacky "bogus node" used when there is no text in a control
       *aHyperTextOffset = 0;
-      return NS_OK;
+      return nsnull;
     }
     descendantAcc = GetFirstAvailableAccessible(findNode);
   }
 
   // From the descendant, go up and get the immediate child of this hypertext
-  nsRefPtr<nsAccessible> childAccAtOffset;
+  nsAccessible *childAccAtOffset = nsnull;
   while (descendantAcc) {
-    nsRefPtr<nsAccessible> parentAcc = descendantAcc->GetParent();
+    nsAccessible *parentAcc = descendantAcc->GetParent();
     if (parentAcc == this) {
       childAccAtOffset = descendantAcc;
       break;
     }
 
     // This offset no longer applies because the passed-in text object is not a child
     // of the hypertext. This happens when there are nested hypertexts, e.g.
     // <div>abc<h1>def</h1>ghi</div>
@@ -622,54 +618,51 @@ nsresult nsHyperTextAccessible::DOMPoint
     // before the embedded object char if we end at the very beginning of the child.
     addTextOffset = addTextOffset > 0;
     }
     else {
       // Start offset, inclusive
       // Make sure the offset lands on the embedded object character in order to indicate
       // the true inner offset is inside the subtree for that link
       addTextOffset =
-        (nsAccUtils::TextLength(descendantAcc) == static_cast<PRInt32>(addTextOffset)) ? 1 : 0;
+        (nsAccUtils::TextLength(descendantAcc) == addTextOffset) ? 1 : 0;
     }
 
-    descendantAcc.swap(parentAcc);
+    descendantAcc = parentAcc;
   }
 
   // Loop through, adding offsets until we reach childAccessible
   // If childAccessible is null we will end up adding up the entire length of
   // the hypertext, which is good -- it just means our offset node
   // came after the last accessible child's node
   PRInt32 childCount = GetChildCount();
 
   PRInt32 childIdx = 0;
   nsAccessible *childAcc = nsnull;
   for (; childIdx < childCount; childIdx++) {
     childAcc = mChildren[childIdx];
     if (childAcc == childAccAtOffset)
       break;
 
-    PRInt32 textLength = nsAccUtils::TextLength(childAcc);
-    NS_ENSURE_TRUE(textLength >= 0, nsnull);
-    *aHyperTextOffset += textLength;
+    *aHyperTextOffset += nsAccUtils::TextLength(childAcc);
   }
 
   if (childIdx < childCount) {
     *aHyperTextOffset += addTextOffset;
     NS_ASSERTION(childAcc == childAccAtOffset,
                  "These should be equal whenever we exit loop and childAcc != nsnull");
 
-    if (aFinalAccessible &&
-        (childIdx < childCount - 1 ||
-         static_cast<PRInt32>(addTextOffset) < nsAccUtils::TextLength(childAccAtOffset))) {  
+    if (childIdx < childCount - 1 ||
+        addTextOffset < nsAccUtils::TextLength(childAccAtOffset)) {
       // If not at end of last text node, we will return the accessible we were in
-      NS_ADDREF(*aFinalAccessible = childAccAtOffset);
+      return childAccAtOffset;
     }
   }
 
-  return NS_OK;
+  return nsnull;
 }
 
 nsresult
 nsHyperTextAccessible::HypertextOffsetToDOMPoint(PRInt32 aHTOffset,
                                                  nsIDOMNode **aNode,
                                                  PRInt32 *aOffset)
 {
   nsCOMPtr<nsIDOMNode> endNode;
@@ -718,17 +711,17 @@ nsHyperTextAccessible::HypertextOffsetsT
           NS_ADDREF(*aEndNode = editorRoot);
 
           return NS_OK;
         }
       }
     }
   }
 
-  nsCOMPtr<nsIAccessible> startAcc, endAcc;
+  nsRefPtr<nsAccessible> startAcc, endAcc;
   PRInt32 startOffset = aStartHTOffset, endOffset = aEndHTOffset;
   nsIFrame *startFrame = nsnull, *endFrame = nsnull;
 
   startFrame = GetPosAndText(startOffset, endOffset, nsnull, &endFrame, nsnull,
                              getter_AddRefs(startAcc), getter_AddRefs(endAcc));
   if (!startAcc || !endAcc)
     return NS_ERROR_FAILURE;
 
@@ -811,23 +804,21 @@ nsHyperTextAccessible::GetRelativeOffset
     }
   }
 
   // Turn the resulting node and offset into a hyperTextOffset
   PRInt32 hyperTextOffset;
   nsCOMPtr<nsIDOMNode> resultNode = do_QueryInterface(pos.mResultContent);
   NS_ENSURE_TRUE(resultNode, -1);
 
-  nsCOMPtr<nsIAccessible> finalAccessible;
-  rv = DOMPointToHypertextOffset(resultNode, pos.mContentOffset, &hyperTextOffset,
-                                 getter_AddRefs(finalAccessible),
-                                 aDirection == eDirNext);
-  // If finalAccessible == nsnull, then DOMPointToHypertextOffset() searched through the hypertext
-  // children without finding the node/offset position
-  NS_ENSURE_SUCCESS(rv, -1);
+  // If finalAccessible is nsnull, then DOMPointToHypertextOffset() searched
+  // through the hypertext children without finding the node/offset position.
+  nsAccessible *finalAccessible =
+    DOMPointToHypertextOffset(resultNode, pos.mContentOffset, &hyperTextOffset,
+                              aDirection == eDirNext);
 
   if (!finalAccessible && aDirection == eDirPrevious) {
     // If we reached the end during search, this means we didn't find the DOM point
     // and we're actually at the start of the paragraph
     hyperTextOffset = 0;
   }  
   else if (aAmount == eSelectBeginLine) {
     nsAccessible *firstChild = mChildren.SafeElementAt(0, nsnull);
@@ -960,17 +951,17 @@ nsresult nsHyperTextAccessible::GetTextH
     default:  // Note, sentence support is deprecated and falls through to here
       return NS_ERROR_INVALID_ARG;
   }
 
   PRInt32 startOffset = aOffset + (aBoundaryType == BOUNDARY_LINE_END);  // Avoid getting the previous line
   PRInt32 endOffset = startOffset;
 
   // Convert offsets to frame-relative
-  nsCOMPtr<nsIAccessible> startAcc;
+  nsRefPtr<nsAccessible> startAcc;
   nsIFrame *startFrame = GetPosAndText(startOffset, endOffset, nsnull, nsnull,
                                        nsnull, getter_AddRefs(startAcc));
 
   if (!startFrame) {
     PRInt32 textLength;
     GetCharacterCount(&textLength);
     if (aBoundaryType == BOUNDARY_LINE_START && aOffset > 0 && aOffset == textLength) {
       // Asking for start of line, while on last character
@@ -1002,21 +993,21 @@ nsresult nsHyperTextAccessible::GetTextH
     NS_ENSURE_TRUE(finalStartOffset >= 0, NS_ERROR_FAILURE);
   }
 
   if (aType == eGetBefore) {
     endOffset = aOffset;
   }
   else {
     // Start moving forward from the start so that we don't get 
-    // 2 words/lines if the offset occured on whitespace boundary
+    // 2 words/lines if the offset occurred on whitespace boundary
     // Careful, startOffset and endOffset are passed by reference to GetPosAndText() and changed
     // For BOUNDARY_LINE_END, make sure we start of this line
     startOffset = endOffset = finalStartOffset + (aBoundaryType == BOUNDARY_LINE_END);
-    nsCOMPtr<nsIAccessible> endAcc;
+    nsRefPtr<nsAccessible> endAcc;
     nsIFrame *endFrame = GetPosAndText(startOffset, endOffset, nsnull, nsnull,
                                        nsnull, getter_AddRefs(endAcc));
     if (nsAccUtils::Role(endAcc) == nsIAccessibleRole::ROLE_STATICTEXT) {
       // Static text like list bullets will ruin our forward calculation,
       // since the caret cannot be in the static text. Start just after the static text.
       startOffset = endOffset = finalStartOffset +
                                 (aBoundaryType == BOUNDARY_LINE_END) +
                                 nsAccUtils::TextLength(endAcc);
@@ -1086,86 +1077,103 @@ NS_IMETHODIMP nsHyperTextAccessible::Get
 //                                      out long rangeEndOffset);
 NS_IMETHODIMP
 nsHyperTextAccessible::GetTextAttributes(PRBool aIncludeDefAttrs,
                                          PRInt32 aOffset,
                                          PRInt32 *aStartOffset,
                                          PRInt32 *aEndOffset,
                                          nsIPersistentProperties **aAttributes)
 {
-  // 1. First we get spell check, then language, then the set of CSS-based
-  //    attributes.
+  // 1. Get each attribute and its ranges one after another.
   // 2. As we get each new attribute, we pass the current start and end offsets
   //    as in/out parameters. In other words, as attributes are collected,
   //    the attribute range itself can only stay the same or get smaller.
-  //
-  // Example:
-  //  Current: range 5-10
-  //  Adding:  range 7-12
-  //  Result:  range 7-10
 
   NS_ENSURE_ARG_POINTER(aStartOffset);
   *aStartOffset = 0;
 
   NS_ENSURE_ARG_POINTER(aEndOffset);
-  nsresult rv = GetCharacterCount(aEndOffset);
-  NS_ENSURE_SUCCESS(rv, rv);
+  *aEndOffset = 0;
+
+  if (IsDefunct())
+    return NS_ERROR_FAILURE;
 
   if (aAttributes) {
     *aAttributes = nsnull;
 
     nsCOMPtr<nsIPersistentProperties> attributes =
       do_CreateInstance(NS_PERSISTENTPROPERTIES_CONTRACTID);
     NS_ENSURE_TRUE(attributes, NS_ERROR_OUT_OF_MEMORY);
 
     NS_ADDREF(*aAttributes = attributes);
   }
 
-  if (!mDOMNode)
-    return NS_ERROR_FAILURE;
+  PRInt32 offsetAccIdx = -1;
+  PRInt32 startOffset = 0, endOffset = 0;
+  nsAccessible *offsetAcc = GetAccessibleAtOffset(aOffset, &offsetAccIdx,
+                                                  &startOffset, &endOffset);
+  if (!offsetAcc) {
+    // Offset 0 is correct offset when accessible has empty text. Include
+    // default attributes if they were requested, otherwise return empty set.
+    if (aOffset == 0) {
+      if (aIncludeDefAttrs) {
+        nsTextAttrsMgr textAttrsMgr(this, PR_TRUE, nsnull, -1);
+        return textAttrsMgr.GetAttributes(*aAttributes);
+      }
+      return NS_OK;
+    }
+    return NS_ERROR_INVALID_ARG;
+  }
 
-  nsCOMPtr<nsIDOMNode> node;
-  PRInt32 nodeOffset = 0;
-  rv = HypertextOffsetToDOMPoint(aOffset, getter_AddRefs(node), &nodeOffset);
+  PRInt32 offsetInAcc = aOffset - startOffset;
+
+  nsTextAttrsMgr textAttrsMgr(this, aIncludeDefAttrs, offsetAcc, offsetAccIdx);
+  nsresult rv = textAttrsMgr.GetAttributes(*aAttributes, &startOffset,
+                                           &endOffset);
   NS_ENSURE_SUCCESS(rv, rv);
 
-  // Set 'misspelled' text attribute.
-  rv = GetSpellTextAttribute(node, nodeOffset, aStartOffset, aEndOffset,
-                             aAttributes ? *aAttributes : nsnull);
-  NS_ENSURE_SUCCESS(rv, rv);
+  // Compute spelling attributes on text accessible only.
+  nsIFrame *offsetFrame = offsetAcc->GetFrame();
+  if (offsetFrame && offsetFrame->GetType() == nsAccessibilityAtoms::textFrame) {
+    nsCOMPtr<nsIDOMNode> node = offsetAcc->GetDOMNode();
+
+    PRInt32 nodeOffset = 0;
+    nsresult rv = RenderedToContentOffset(offsetFrame, offsetInAcc,
+                                          &nodeOffset);
+    NS_ENSURE_SUCCESS(rv, rv);
 
-  nsCOMPtr<nsIContent> content(do_QueryInterface(node));
-  if (content && content->IsElement())
-    node = do_QueryInterface(content->GetChildAt(nodeOffset));
+    // Set 'misspelled' text attribute.
+    rv = GetSpellTextAttribute(node, nodeOffset, &startOffset, &endOffset,
+                               aAttributes ? *aAttributes : nsnull);
+    NS_ENSURE_SUCCESS(rv, rv);
+  }
 
-  if (!node)
-    return NS_OK;
-
-  nsTextAttrsMgr textAttrsMgr(this, mDOMNode, aIncludeDefAttrs, node);
-  return textAttrsMgr.GetAttributes(*aAttributes, aStartOffset, aEndOffset);
+  *aStartOffset = startOffset;
+  *aEndOffset = endOffset;
+  return NS_OK;
 }
 
 // nsIPersistentProperties
 // nsIAccessibleText::defaultTextAttributes
 NS_IMETHODIMP
 nsHyperTextAccessible::GetDefaultTextAttributes(nsIPersistentProperties **aAttributes)
 {
   NS_ENSURE_ARG_POINTER(aAttributes);
   *aAttributes = nsnull;
 
+  if (IsDefunct())
+    return NS_ERROR_FAILURE;
+
   nsCOMPtr<nsIPersistentProperties> attributes =
     do_CreateInstance(NS_PERSISTENTPROPERTIES_CONTRACTID);
   NS_ENSURE_TRUE(attributes, NS_ERROR_OUT_OF_MEMORY);
 
   NS_ADDREF(*aAttributes = attributes);
 
-  if (!mDOMNode)
-    return NS_ERROR_FAILURE;
-
-  nsTextAttrsMgr textAttrsMgr(this, mDOMNode, PR_TRUE, nsnull);
+  nsTextAttrsMgr textAttrsMgr(this, PR_TRUE);
   return textAttrsMgr.GetAttributes(*aAttributes);
 }
 
 PRInt32
 nsHyperTextAccessible::GetLevelInternal()
 {
   nsCOMPtr<nsIContent> content = nsCoreUtils::GetRoleContent(mDOMNode);
   NS_ENSURE_TRUE(content, 0);
@@ -1319,19 +1327,18 @@ nsHyperTextAccessible::GetOffsetAtPoint(
           NS_ENSURE_SUCCESS(rv, rv);
           offset += addToOffset;
         }
         *aOffset = offset;
         return NS_OK;
       }
       frame = frame->GetNextContinuation();
     }
-    PRInt32 textLength = nsAccUtils::TextLength(childAcc);
-    NS_ENSURE_TRUE(textLength >= 0, NS_ERROR_FAILURE);
-    offset += textLength;
+
+    offset += nsAccUtils::TextLength(childAcc);
   }
 
   return NS_OK; // Not found, will return -1
 }
 
 // ------- nsIAccessibleHyperText ---------------
 NS_IMETHODIMP
 nsHyperTextAccessible::GetLinkCount(PRInt32 *aLinkCount)
@@ -1387,19 +1394,17 @@ nsHyperTextAccessible::GetLinkIndex(PRIn
   PRInt32 childCount = GetChildCount();
   for (PRInt32 childIdx = 0;
        childIdx < childCount && characterCount <= aCharIndex; childIdx++) {
     nsAccessible *childAcc = mChildren[childIdx];
 
     PRUint32 role = nsAccUtils::Role(childAcc);
     if (role == nsIAccessibleRole::ROLE_TEXT_LEAF ||
         role == nsIAccessibleRole::ROLE_STATICTEXT) {
-      PRInt32 textLength = nsAccUtils::TextLength(childAcc);
-      NS_ENSURE_TRUE(textLength >= 0, NS_ERROR_FAILURE);
-      characterCount += textLength;
+      characterCount += nsAccUtils::TextLength(childAcc);
     }
     else {
       if (characterCount ++ == aCharIndex) {
         *aLinkIndex = linkIndex;
         break;
       }
       if (role != nsIAccessibleRole::ROLE_WHITESPACE) {
         ++ linkIndex;
@@ -1605,37 +1610,38 @@ nsHyperTextAccessible::GetCaretOffset(PR
 
   // Turn the focus node and offset of the selection into caret hypretext
   // offset.
   nsCOMPtr<nsISelection> domSel;
   nsresult rv = GetSelections(nsISelectionController::SELECTION_NORMAL,
                               nsnull, getter_AddRefs(domSel));
   NS_ENSURE_SUCCESS(rv, rv);
 
-  nsCOMPtr<nsIDOMNode> focusNode;
-  rv = domSel->GetFocusNode(getter_AddRefs(focusNode));
+  nsCOMPtr<nsIDOMNode> focusDOMNode;
+  rv = domSel->GetFocusNode(getter_AddRefs(focusDOMNode));
   NS_ENSURE_SUCCESS(rv, rv);
 
   PRInt32 focusOffset;
   rv = domSel->GetFocusOffset(&focusOffset);
   NS_ENSURE_SUCCESS(rv, rv);
 
   // No caret if this DOM node is inside of focused node but the selection's
   // focus point is not inside of this DOM node.
   if (isInsideOfFocusedNode) {
-    nsCOMPtr<nsIDOMNode> resultDOMNode =
+    nsCOMPtr<nsINode> focusNode(do_QueryInterface(focusDOMNode));
+    nsINode *resultNode =
       nsCoreUtils::GetDOMNodeFromDOMPoint(focusNode, focusOffset);
 
-    nsCOMPtr<nsINode> resultNode(do_QueryInterface(resultDOMNod