Bug 497495 - frame poisoning. r=roc sr=dbaron a1.9.2=dbaron
authorZack Weinberg <zweinberg@mozilla.com>
Wed, 23 Sep 2009 11:36:31 -0700
changeset 31881 0f16cce1d7c6ea7b56f1f78680cf7da065121321
parent 31880 b606033313524de64f12e30a831f42a6cd6feb92
child 31882 dcc67c2cb0f1c15ed9a26ee94dfe8c18218c3e62
push id228
push userzweinberg@mozilla.com
push dateWed, 23 Sep 2009 19:09:20 +0000
reviewersroc, dbaron
bugs497495
milestone1.9.2b1pre
Bug 497495 - frame poisoning. r=roc sr=dbaron a1.9.2=dbaron
layout/base/Makefile.in
layout/base/nsIPercentHeightObserver.h
layout/base/nsIPresShell.h
layout/base/nsPresArena.cpp
layout/base/nsPresArena.h
layout/base/nsPresContext.h
layout/base/nsPresShell.cpp
layout/forms/nsComboboxControlFrame.cpp
layout/forms/nsComboboxControlFrame.h
layout/forms/nsFieldSetFrame.cpp
layout/forms/nsFileControlFrame.cpp
layout/forms/nsFileControlFrame.h
layout/forms/nsFormControlFrame.cpp
layout/forms/nsFormControlFrame.h
layout/forms/nsGfxButtonControlFrame.cpp
layout/forms/nsGfxButtonControlFrame.h
layout/forms/nsGfxCheckboxControlFrame.cpp
layout/forms/nsGfxCheckboxControlFrame.h
layout/forms/nsGfxRadioControlFrame.cpp
layout/forms/nsGfxRadioControlFrame.h
layout/forms/nsHTMLButtonControlFrame.cpp
layout/forms/nsHTMLButtonControlFrame.h
layout/forms/nsICheckboxControlFrame.h
layout/forms/nsIComboboxControlFrame.h
layout/forms/nsIFormControlFrame.h
layout/forms/nsIListControlFrame.h
layout/forms/nsIRadioControlFrame.h
layout/forms/nsISelectControlFrame.h
layout/forms/nsITextControlFrame.h
layout/forms/nsImageControlFrame.cpp
layout/forms/nsIsIndexFrame.cpp
layout/forms/nsIsIndexFrame.h
layout/forms/nsLegendFrame.cpp
layout/forms/nsLegendFrame.h
layout/forms/nsListControlFrame.cpp
layout/forms/nsListControlFrame.h
layout/forms/nsSelectsAreaFrame.cpp
layout/forms/nsSelectsAreaFrame.h
layout/forms/nsTextControlFrame.cpp
layout/forms/nsTextControlFrame.h
layout/generic/nsBRFrame.cpp
layout/generic/nsBidiFrames.cpp
layout/generic/nsBidiFrames.h
layout/generic/nsBlockFrame.cpp
layout/generic/nsBlockFrame.h
layout/generic/nsBulletFrame.cpp
layout/generic/nsBulletFrame.h
layout/generic/nsColumnSetFrame.cpp
layout/generic/nsContainerFrame.cpp
layout/generic/nsContainerFrame.h
layout/generic/nsFirstLetterFrame.cpp
layout/generic/nsFirstLetterFrame.h
layout/generic/nsFloatManager.cpp
layout/generic/nsFrame.cpp
layout/generic/nsFrame.h
layout/generic/nsFrameFrame.cpp
layout/generic/nsFrameSetFrame.cpp
layout/generic/nsFrameSetFrame.h
layout/generic/nsGfxScrollFrame.cpp
layout/generic/nsGfxScrollFrame.h
layout/generic/nsHTMLCanvasFrame.cpp
layout/generic/nsHTMLCanvasFrame.h
layout/generic/nsHTMLContainerFrame.cpp
layout/generic/nsHTMLContainerFrame.h
layout/generic/nsHTMLFrame.cpp
layout/generic/nsIAnonymousContentCreator.h
layout/generic/nsICanvasFrame.h
layout/generic/nsIFrame.h
layout/generic/nsIFrameDebug.h
layout/generic/nsIFrameFrame.h
layout/generic/nsIImageFrame.h
layout/generic/nsIObjectFrame.h
layout/generic/nsIPageSequenceFrame.h
layout/generic/nsIScrollableFrame.h
layout/generic/nsIScrollableViewProvider.h
layout/generic/nsIStatefulFrame.h
layout/generic/nsImageFrame.cpp
layout/generic/nsImageFrame.h
layout/generic/nsInlineFrame.cpp
layout/generic/nsInlineFrame.h
layout/generic/nsLeafFrame.cpp
layout/generic/nsLeafFrame.h
layout/generic/nsLineBox.cpp
layout/generic/nsObjectFrame.cpp
layout/generic/nsObjectFrame.h
layout/generic/nsPageContentFrame.cpp
layout/generic/nsPageContentFrame.h
layout/generic/nsPageFrame.cpp
layout/generic/nsPageFrame.h
layout/generic/nsPlaceholderFrame.cpp
layout/generic/nsPlaceholderFrame.h
layout/generic/nsQueryFrame.h
layout/generic/nsSimplePageSequence.cpp
layout/generic/nsSimplePageSequence.h
layout/generic/nsSpacerFrame.cpp
layout/generic/nsSplittableFrame.cpp
layout/generic/nsSplittableFrame.h
layout/generic/nsTextFrame.h
layout/generic/nsTextFrameThebes.cpp
layout/generic/nsVideoFrame.cpp
layout/generic/nsVideoFrame.h
layout/generic/nsViewportFrame.cpp
layout/generic/nsViewportFrame.h
layout/mathml/nsIMathMLFrame.h
layout/mathml/nsMathMLContainerFrame.cpp
layout/mathml/nsMathMLContainerFrame.h
layout/mathml/nsMathMLForeignFrameWrapper.cpp
layout/mathml/nsMathMLForeignFrameWrapper.h
layout/mathml/nsMathMLTokenFrame.cpp
layout/mathml/nsMathMLTokenFrame.h
layout/mathml/nsMathMLmactionFrame.cpp
layout/mathml/nsMathMLmactionFrame.h
layout/mathml/nsMathMLmencloseFrame.cpp
layout/mathml/nsMathMLmencloseFrame.h
layout/mathml/nsMathMLmfencedFrame.cpp
layout/mathml/nsMathMLmfencedFrame.h
layout/mathml/nsMathMLmfracFrame.cpp
layout/mathml/nsMathMLmfracFrame.h
layout/mathml/nsMathMLmmultiscriptsFrame.cpp
layout/mathml/nsMathMLmmultiscriptsFrame.h
layout/mathml/nsMathMLmoFrame.cpp
layout/mathml/nsMathMLmoFrame.h
layout/mathml/nsMathMLmoverFrame.cpp
layout/mathml/nsMathMLmoverFrame.h
layout/mathml/nsMathMLmpaddedFrame.cpp
layout/mathml/nsMathMLmpaddedFrame.h
layout/mathml/nsMathMLmphantomFrame.cpp
layout/mathml/nsMathMLmphantomFrame.h
layout/mathml/nsMathMLmrootFrame.cpp
layout/mathml/nsMathMLmrootFrame.h
layout/mathml/nsMathMLmrowFrame.cpp
layout/mathml/nsMathMLmrowFrame.h
layout/mathml/nsMathMLmspaceFrame.cpp
layout/mathml/nsMathMLmspaceFrame.h
layout/mathml/nsMathMLmsqrtFrame.cpp
layout/mathml/nsMathMLmsqrtFrame.h
layout/mathml/nsMathMLmstyleFrame.cpp
layout/mathml/nsMathMLmstyleFrame.h
layout/mathml/nsMathMLmsubFrame.cpp
layout/mathml/nsMathMLmsubFrame.h
layout/mathml/nsMathMLmsubsupFrame.cpp
layout/mathml/nsMathMLmsubsupFrame.h
layout/mathml/nsMathMLmsupFrame.cpp
layout/mathml/nsMathMLmsupFrame.h
layout/mathml/nsMathMLmtableFrame.cpp
layout/mathml/nsMathMLmtableFrame.h
layout/mathml/nsMathMLmunderFrame.cpp
layout/mathml/nsMathMLmunderFrame.h
layout/mathml/nsMathMLmunderoverFrame.cpp
layout/mathml/nsMathMLmunderoverFrame.h
layout/style/nsICSSPseudoComparator.h
layout/svg/base/src/nsISVGChildFrame.h
layout/svg/base/src/nsISVGGlyphFragmentLeaf.h
layout/svg/base/src/nsISVGGlyphFragmentNode.h
layout/svg/base/src/nsISVGSVGFrame.h
layout/svg/base/src/nsSVGAFrame.cpp
layout/svg/base/src/nsSVGClipPathFrame.cpp
layout/svg/base/src/nsSVGClipPathFrame.h
layout/svg/base/src/nsSVGContainerFrame.cpp
layout/svg/base/src/nsSVGContainerFrame.h
layout/svg/base/src/nsSVGFilterFrame.cpp
layout/svg/base/src/nsSVGFilterFrame.h
layout/svg/base/src/nsSVGForeignObjectFrame.cpp
layout/svg/base/src/nsSVGForeignObjectFrame.h
layout/svg/base/src/nsSVGGFrame.cpp
layout/svg/base/src/nsSVGGFrame.h
layout/svg/base/src/nsSVGGenericContainerFrame.cpp
layout/svg/base/src/nsSVGGenericContainerFrame.h
layout/svg/base/src/nsSVGGeometryFrame.cpp
layout/svg/base/src/nsSVGGeometryFrame.h
layout/svg/base/src/nsSVGGlyphFrame.cpp
layout/svg/base/src/nsSVGGlyphFrame.h
layout/svg/base/src/nsSVGGradientFrame.cpp
layout/svg/base/src/nsSVGGradientFrame.h
layout/svg/base/src/nsSVGImageFrame.cpp
layout/svg/base/src/nsSVGInnerSVGFrame.cpp
layout/svg/base/src/nsSVGInnerSVGFrame.h
layout/svg/base/src/nsSVGLeafFrame.cpp
layout/svg/base/src/nsSVGMarkerFrame.cpp
layout/svg/base/src/nsSVGMarkerFrame.h
layout/svg/base/src/nsSVGMaskFrame.cpp
layout/svg/base/src/nsSVGMaskFrame.h
layout/svg/base/src/nsSVGOuterSVGFrame.cpp
layout/svg/base/src/nsSVGOuterSVGFrame.h
layout/svg/base/src/nsSVGPaintServerFrame.cpp
layout/svg/base/src/nsSVGPaintServerFrame.h
layout/svg/base/src/nsSVGPathGeometryFrame.cpp
layout/svg/base/src/nsSVGPathGeometryFrame.h
layout/svg/base/src/nsSVGPatternFrame.cpp
layout/svg/base/src/nsSVGPatternFrame.h
layout/svg/base/src/nsSVGStopFrame.cpp
layout/svg/base/src/nsSVGSwitchFrame.cpp
layout/svg/base/src/nsSVGTSpanFrame.cpp
layout/svg/base/src/nsSVGTSpanFrame.h
layout/svg/base/src/nsSVGTextContainerFrame.cpp
layout/svg/base/src/nsSVGTextContainerFrame.h
layout/svg/base/src/nsSVGTextFrame.cpp
layout/svg/base/src/nsSVGTextFrame.h
layout/svg/base/src/nsSVGTextPathFrame.cpp
layout/svg/base/src/nsSVGTextPathFrame.h
layout/svg/base/src/nsSVGUseFrame.cpp
layout/tables/nsITableCellLayout.h
layout/tables/nsITableLayout.h
layout/tables/nsTableCellFrame.cpp
layout/tables/nsTableCellFrame.h
layout/tables/nsTableColFrame.cpp
layout/tables/nsTableColFrame.h
layout/tables/nsTableColGroupFrame.cpp
layout/tables/nsTableColGroupFrame.h
layout/tables/nsTableFrame.cpp
layout/tables/nsTableFrame.h
layout/tables/nsTableOuterFrame.cpp
layout/tables/nsTableOuterFrame.h
layout/tables/nsTableRowFrame.cpp
layout/tables/nsTableRowFrame.h
layout/tables/nsTableRowGroupFrame.cpp
layout/tables/nsTableRowGroupFrame.h
layout/xul/base/public/nsIMenuFrame.h
layout/xul/base/public/nsIScrollbarMediator.h
layout/xul/base/src/grid/nsGridRowGroupFrame.cpp
layout/xul/base/src/grid/nsGridRowGroupFrame.h
layout/xul/base/src/grid/nsGridRowLeafFrame.cpp
layout/xul/base/src/grid/nsGridRowLeafFrame.h
layout/xul/base/src/nsBoxFrame.cpp
layout/xul/base/src/nsBoxFrame.h
layout/xul/base/src/nsButtonBoxFrame.cpp
layout/xul/base/src/nsButtonBoxFrame.h
layout/xul/base/src/nsDeckFrame.cpp
layout/xul/base/src/nsDeckFrame.h
layout/xul/base/src/nsDocElementBoxFrame.cpp
layout/xul/base/src/nsGroupBoxFrame.cpp
layout/xul/base/src/nsIRootBox.h
layout/xul/base/src/nsIScrollbarFrame.h
layout/xul/base/src/nsImageBoxFrame.cpp
layout/xul/base/src/nsImageBoxFrame.h
layout/xul/base/src/nsLeafBoxFrame.cpp
layout/xul/base/src/nsLeafBoxFrame.h
layout/xul/base/src/nsListBoxBodyFrame.cpp
layout/xul/base/src/nsListBoxBodyFrame.h
layout/xul/base/src/nsListItemFrame.cpp
layout/xul/base/src/nsListItemFrame.h
layout/xul/base/src/nsMenuBarFrame.cpp
layout/xul/base/src/nsMenuBarFrame.h
layout/xul/base/src/nsMenuFrame.cpp
layout/xul/base/src/nsMenuFrame.h
layout/xul/base/src/nsMenuPopupFrame.cpp
layout/xul/base/src/nsMenuPopupFrame.h
layout/xul/base/src/nsPopupSetFrame.cpp
layout/xul/base/src/nsPopupSetFrame.h
layout/xul/base/src/nsProgressMeterFrame.cpp
layout/xul/base/src/nsProgressMeterFrame.h
layout/xul/base/src/nsResizerFrame.cpp
layout/xul/base/src/nsResizerFrame.h
layout/xul/base/src/nsRootBoxFrame.cpp
layout/xul/base/src/nsScrollBoxFrame.cpp
layout/xul/base/src/nsScrollbarButtonFrame.cpp
layout/xul/base/src/nsScrollbarButtonFrame.h
layout/xul/base/src/nsScrollbarFrame.cpp
layout/xul/base/src/nsScrollbarFrame.h
layout/xul/base/src/nsSliderFrame.cpp
layout/xul/base/src/nsSliderFrame.h
layout/xul/base/src/nsSplitterFrame.cpp
layout/xul/base/src/nsSplitterFrame.h
layout/xul/base/src/nsStackFrame.cpp
layout/xul/base/src/nsStackFrame.h
layout/xul/base/src/nsTextBoxFrame.cpp
layout/xul/base/src/nsTextBoxFrame.h
layout/xul/base/src/nsTitleBarFrame.cpp
layout/xul/base/src/nsTitleBarFrame.h
layout/xul/base/src/nsXULLabelFrame.cpp
layout/xul/base/src/nsXULLabelFrame.h
layout/xul/base/src/tree/src/nsTreeBodyFrame.cpp
layout/xul/base/src/tree/src/nsTreeBodyFrame.h
layout/xul/base/src/tree/src/nsTreeColFrame.cpp
layout/xul/base/src/tree/src/nsTreeColFrame.h
xpcom/base/nscore.h
--- a/layout/base/Makefile.in
+++ b/layout/base/Makefile.in
@@ -128,16 +128,17 @@ CPPSRCS		= \
 		nsDocumentViewer.cpp \
 		nsFrameManager.cpp \
 		nsFrameTraversal.cpp \
 		nsGenConList.cpp \
 		nsImageLoader.cpp \
 		nsLayoutDebugger.cpp \
 		nsLayoutHistoryState.cpp \
 		nsLayoutUtils.cpp \
+		nsPresArena.cpp \
 		nsPresContext.cpp \
 		nsPresShell.cpp \
 		nsPresState.cpp \
 		nsQuoteList.cpp \
 		nsStyleChangeList.cpp \
 		nsStyleSheetService.cpp \
 		$(NULL)
 
--- a/layout/base/nsIPercentHeightObserver.h
+++ b/layout/base/nsIPercentHeightObserver.h
@@ -46,17 +46,17 @@ class  nsPresContext;
 /**
  * This interface is supported by frames that need to provide computed height
  * values to children during reflow which would otherwise not happen. Currently only
  * table cells support this.
  */
 class nsIPercentHeightObserver
 {
 public:
-  NS_DECLARE_FRAME_ACCESSOR(nsIPercentHeightObserver)
+  NS_DECL_QUERYFRAME_TARGET(nsIPercentHeightObserver)
 
   // Notify the observer that aReflowState has no computed height, but it has a percent height
   virtual void NotifyPercentHeight(const nsHTMLReflowState& aReflowState) = 0;
 
   // Ask the observer if it should observe aReflowState.frame
   virtual PRBool NeedsToObserve(const nsHTMLReflowState& aReflowState) = 0;
 };
 
--- a/layout/base/nsIPresShell.h
+++ b/layout/base/nsIPresShell.h
@@ -50,16 +50,17 @@
  */
 
 /* a presentation of a document, part 2 */
 
 #ifndef nsIPresShell_h___
 #define nsIPresShell_h___
 
 #include "nsISupports.h"
+#include "nsQueryFrame.h"
 #include "nsCoord.h"
 #include "nsRect.h"
 #include "nsColor.h"
 #include "nsEvent.h"
 #include "nsCompatibility.h"
 #include "nsFrameManagerBase.h"
 #include "mozFlushType.h"
 #include "nsWeakReference.h"
@@ -99,19 +100,20 @@ class gfxContext;
 class nsPIDOMEventTarget;
 class nsIDOMEvent;
 class nsDisplayList;
 class nsDisplayListBuilder;
 
 typedef short SelectionType;
 typedef PRUint32 nsFrameState;
 
-#define NS_IPRESSHELL_IID \
-{ 0xfea81c36, 0xed5b, 0x41f5, \
-  { 0x89, 0x5d, 0x4c, 0x50, 0x79, 0x49, 0xad, 0x3b } }
+// eed2ef56-133f-4696-9eee-5fc45d816be8
+#define NS_IPRESSHELL_IID     \
+{ 0xeed2ef56, 0x133f, 0x4696, \
+  { 0x9e, 0xee, 0x5f, 0xc4, 0x5d, 0x81, 0x6b, 0xe8 } }
 
 // Constants for ScrollContentIntoView() function
 #define NS_PRESSHELL_SCROLL_TOP      0
 #define NS_PRESSHELL_SCROLL_BOTTOM   100
 #define NS_PRESSHELL_SCROLL_LEFT     0
 #define NS_PRESSHELL_SCROLL_RIGHT    100
 #define NS_PRESSHELL_SCROLL_CENTER   50
 #define NS_PRESSHELL_SCROLL_ANYWHERE -1
@@ -164,21 +166,30 @@ public:
    * controls incorrectly store their data in the frames rather than the
    * content model and printing calls |EndObservingDocument| multiple
    * times to make form controls behave nicely when printed.
    */
   NS_IMETHOD Destroy() = 0;
   
   PRBool IsDestroying() { return mIsDestroying; }
 
-  // All frames owned by the shell are allocated from an arena.  They are also recycled
-  // using free lists (separate free lists being maintained for each size_t).
-  // Methods for recycling frames.
-  virtual void* AllocateFrame(size_t aSize) = 0;
-  virtual void  FreeFrame(size_t aSize, void* aFreeChunk) = 0;
+  // All frames owned by the shell are allocated from an arena.  They
+  // are also recycled using free lists.  Separate free lists are
+  // maintained for each frame type (aCode), which must always
+  // correspond to the same aSize value. AllocateFrame clears the
+  // memory that it returns.
+  virtual void* AllocateFrame(nsQueryFrame::FrameIID aCode, size_t aSize) = 0;
+  virtual void  FreeFrame(nsQueryFrame::FrameIID aCode, void* aChunk) = 0;
+
+  // Objects closely related to the frame tree, but that are not
+  // actual frames (subclasses of nsFrame) are also allocated from the
+  // arena, and recycled via a separate set of per-size free lists.
+  // AllocateMisc does *not* clear the memory that it returns.
+  virtual void* AllocateMisc(size_t aSize) = 0;
+  virtual void  FreeMisc(size_t aSize, void* aChunk) = 0;
 
   /**
    * Stack memory allocation:
    *
    * Callers who wish to allocate memory whose lifetime corresponds to
    * the lifetime of a stack-allocated object can use this API.  The
    * caller must use a pair of calls to PushStackMemory and
    * PopStackMemory, such that all stack object lifetimes are either
new file mode 100644
--- /dev/null
+++ b/layout/base/nsPresArena.cpp
@@ -0,0 +1,254 @@
+/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*-
+ * vim: set ts=2 sw=2 et tw=78:
+ * ***** BEGIN LICENSE BLOCK *****
+ * Version: MPL 1.1/GPL 2.0/LGPL 2.1
+ *
+ * The contents of this file are subject to the Mozilla Public License Version
+ * 1.1 (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ * http://www.mozilla.org/MPL/
+ *
+ * Software distributed under the License is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
+ * for the specific language governing rights and limitations under the
+ * License.
+ *
+ * The Original Code is mozilla.org code.
+ *
+ * The Initial Developer of the Original Code is
+ * Netscape Communications Corporation.
+ * Portions created by the Initial Developer are Copyright (C) 1998
+ * the Initial Developer. All Rights Reserved.
+ *
+ * Contributor(s):
+ *   Steve Clark <buster@netscape.com>
+ *   Håkan Waara <hwaara@chello.se>
+ *   Dan Rosen <dr@netscape.com>
+ *   Daniel Glazman <glazman@netscape.com>
+ *   Mats Palmgren <mats.palmgren@bredband.net>
+ *
+ * Alternatively, the contents of this file may be used under the terms of
+ * either of the GNU General Public License Version 2 or later (the "GPL"),
+ * or the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
+ * in which case the provisions of the GPL or the LGPL are applicable instead
+ * of those above. If you wish to allow use of your version of this file only
+ * under the terms of either the GPL or the LGPL, and not to allow others to
+ * use your version of this file under the terms of the MPL, indicate your
+ * decision by deleting the provisions above and replace them with the notice
+ * and other provisions required by the GPL or the LGPL. If you do not delete
+ * the provisions above, a recipient may use your version of this file under
+ * the terms of any one of the MPL, the GPL or the LGPL.
+ *
+ * ***** END LICENSE BLOCK *****
+ */
+
+/* arena allocation for the frame tree and closely-related objects */
+
+#include "nsPresArena.h"
+#include "nsCRT.h"
+#include "nsDebug.h"
+#include "nsTArray.h"
+#include "nsTHashtable.h"
+#include "prmem.h"
+
+#ifndef DEBUG_TRACEMALLOC_PRESARENA
+
+// Even on 32-bit systems, we allocate objects from the frame arena
+// that require 8-byte alignment.  The cast to PRUword is needed
+// because plarena isn't as careful about mask construction as it
+// ought to be.
+#define ALIGN_SHIFT 3
+#define PL_ARENA_CONST_ALIGN_MASK ((PRUword(1) << ALIGN_SHIFT) - 1)
+#include "plarena.h"
+
+// Size to use for PLArena block allocations.
+static const size_t ARENA_PAGE_SIZE = 4096;
+
+// Freed memory is filled with a poison value, which is believed to
+// form a pointer to an always-unmapped region of the address space on
+// all platforms of interest. The low 12 bits of this number are
+// chosen to fall in the middle of the typical 4096-byte page, and
+// make the address odd.
+//
+// With the possible exception of PPC64, current 64-bit CPUs permit
+// only a subset (2^48 to 2^56, depending) of the full virtual address
+// space to be used.  x86-64 has the inaccessible region in the
+// *middle* of the address space, whereas all others are believed to
+// have it at the highest addresses.  Use an address in this region if
+// we possibly can; if the hardware doesn't let anyone use it, we
+// needn't worry about the OS.
+//
+// TODO: Confirm that this value is a pointer to an always-unmapped
+// address space region on (at least) Win32, Win64, WinCE, ARM Linux,
+// MacOSX, and add #ifdefs below as necessary. (Bug 507294.)
+
+#if defined(__x86_64__) || defined(_M_AMD64)
+const PRUword ARENA_POISON = 0x7FFFFFFFF0DEA7FF;
+#else
+// This evaluates to 0xF0DE_A7FF when PRUword is 32 bits long, but to
+// 0xFFFF_FFFF_F0DE_A7FF when it's 64 bits.
+const PRUword ARENA_POISON = (~PRUword(0x0FFFFF00) | PRUword(0x0DEA700));
+#endif
+
+// All keys to this hash table fit in 32 bits (see below) so we do not
+// bother actually hashing them.
+class FreeList : public PLDHashEntryHdr
+{
+public:
+  typedef PRUint32 KeyType;
+  nsTArray<void *> mEntries;
+  size_t mEntrySize;
+
+protected:
+  typedef const void* KeyTypePointer;
+  KeyTypePointer mKey;
+
+  FreeList(KeyTypePointer aKey) : mEntrySize(0), mKey(aKey) {}
+  // Default copy constructor and destructor are ok.
+
+  PRBool KeyEquals(KeyTypePointer const aKey) const
+  { return mKey == aKey; }
+
+  static KeyTypePointer KeyToPointer(KeyType aKey)
+  { return NS_INT32_TO_PTR(aKey); }
+
+  static PLDHashNumber HashKey(KeyTypePointer aKey)
+  { return NS_PTR_TO_INT32(aKey); }
+
+  enum { ALLOW_MEMMOVE = PR_FALSE };
+  friend class nsTHashtable<FreeList>;
+};
+
+struct nsPresArena::State {
+  nsTHashtable<FreeList> mFreeLists;
+  PLArenaPool mPool;
+
+  State()
+  {
+    mFreeLists.Init();
+    PL_INIT_ARENA_POOL(&mPool, "PresArena", ARENA_PAGE_SIZE);
+  }
+
+  ~State()
+  {
+    PL_FinishArenaPool(&mPool);
+  }
+
+  void* Allocate(PRUint32 aCode, size_t aSize)
+  {
+    NS_ABORT_IF_FALSE(aSize > 0, "PresArena cannot allocate zero bytes");
+
+    // We only hand out aligned sizes
+    aSize = PL_ARENA_ALIGN(&mPool, aSize);
+
+    // If there is no free-list entry for this type already, we have
+    // to create one now, to record its size.
+    FreeList* list = mFreeLists.PutEntry(aCode);
+    if (!list) {
+      return nsnull;
+    }
+
+    nsTArray<void*>::index_type len = list->mEntries.Length();
+    if (list->mEntrySize == 0) {
+      NS_ABORT_IF_FALSE(len == 0, "list with entries but no recorded size");
+      list->mEntrySize = aSize;
+    } else {
+      NS_ABORT_IF_FALSE(list->mEntrySize == aSize,
+                        "different sizes for same object type code");
+    }
+
+    void* result;
+    if (len > 0) {
+      // LIFO behavior for best cache utilization
+      result = list->mEntries.ElementAt(len - 1);
+      list->mEntries.RemoveElementAt(len - 1);
+#ifdef DEBUG
+      {
+        char* p = reinterpret_cast<char*>(result);
+        char* limit = p + list->mEntrySize;
+        for (; p < limit; p += sizeof(PRUword)) {
+          NS_ABORT_IF_FALSE(*reinterpret_cast<PRUword*>(p) == ARENA_POISON,
+                            "PresArena: poison overwritten");
+        }
+      }
+#endif
+      return result;
+    }
+
+    // Allocate a new chunk from the arena
+    PL_ARENA_ALLOCATE(result, &mPool, aSize);
+    return result;
+  }
+
+  void Free(PRUint32 aCode, void* aPtr)
+  {
+    // Try to recycle this entry.
+    FreeList* list = mFreeLists.GetEntry(aCode);
+    NS_ABORT_IF_FALSE(list, "no free list for pres arena object");
+    NS_ABORT_IF_FALSE(list->mEntrySize > 0, "PresArena cannot free zero bytes");
+
+    char* p = reinterpret_cast<char*>(aPtr);
+    char* limit = p + list->mEntrySize;
+    for (; p < limit; p += sizeof(PRUword)) {
+      *reinterpret_cast<PRUword*>(p) = ARENA_POISON;
+    }
+
+    list->mEntries.AppendElement(aPtr);
+  }
+};
+
+#else
+// Stub implementation that forwards everything to malloc and does not
+// poison.
+
+struct nsPresArena::State
+{
+  void* Allocate(PRUnit32 /* unused */, size_t aSize)
+  {
+    return PR_Malloc(aSize);
+  }
+
+  void Free(PRUint32 /* unused */, void* aPtr)
+  {
+    PR_Free(aPtr);
+  }
+};
+
+#endif // DEBUG_TRACEMALLOC_PRESARENA
+
+// Public interface
+nsPresArena::nsPresArena()
+  : mState(new nsPresArena::State())
+{}
+
+nsPresArena::~nsPresArena()
+{
+  delete mState;
+}
+
+void*
+nsPresArena::AllocateBySize(size_t aSize)
+{
+  return mState->Allocate(PRUint32(aSize) |
+                          PRUint32(nsQueryFrame::NON_FRAME_MARKER),
+                          aSize);
+}
+
+void
+nsPresArena::FreeBySize(size_t aSize, void* aPtr)
+{
+  mState->Free(PRUint32(aSize) |
+               PRUint32(nsQueryFrame::NON_FRAME_MARKER), aPtr);
+}
+
+void*
+nsPresArena::AllocateByCode(nsQueryFrame::FrameIID aCode, size_t aSize)
+{
+  return mState->Allocate(aCode, aSize);
+}
+
+void
+nsPresArena::FreeByCode(nsQueryFrame::FrameIID aCode, void* aPtr)
+{
+  mState->Free(aCode, aPtr);
+}
new file mode 100644
--- /dev/null
+++ b/layout/base/nsPresArena.h
@@ -0,0 +1,82 @@
+/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*-
+ * vim: set ts=2 sw=2 et tw=78:
+ * ***** BEGIN LICENSE BLOCK *****
+ * Version: MPL 1.1/GPL 2.0/LGPL 2.1
+ *
+ * The contents of this file are subject to the Mozilla Public License Version
+ * 1.1 (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ * http://www.mozilla.org/MPL/
+ *
+ * Software distributed under the License is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
+ * for the specific language governing rights and limitations under the
+ * License.
+ *
+ * The Original Code is mozilla.org code.
+ *
+ * The Initial Developer of the Original Code is
+ * Netscape Communications Corporation.
+ * Portions created by the Initial Developer are Copyright (C) 1998
+ * the Initial Developer. All Rights Reserved.
+ *
+ * Contributor(s):
+ *   Steve Clark <buster@netscape.com>
+ *   Håkan Waara <hwaara@chello.se>
+ *   Dan Rosen <dr@netscape.com>
+ *   Daniel Glazman <glazman@netscape.com>
+ *   Mats Palmgren <mats.palmgren@bredband.net>
+ *
+ * Alternatively, the contents of this file may be used under the terms of
+ * either of the GNU General Public License Version 2 or later (the "GPL"),
+ * or the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
+ * in which case the provisions of the GPL or the LGPL are applicable instead
+ * of those above. If you wish to allow use of your version of this file only
+ * under the terms of either the GPL or the LGPL, and not to allow others to
+ * use your version of this file under the terms of the MPL, indicate your
+ * decision by deleting the provisions above and replace them with the notice
+ * and other provisions required by the GPL or the LGPL. If you do not delete
+ * the provisions above, a recipient may use your version of this file under
+ * the terms of any one of the MPL, the GPL or the LGPL.
+ *
+ * ***** END LICENSE BLOCK *****
+ */
+
+#ifndef nsPresArena_h___
+#define nsPresArena_h___
+
+#include "nscore.h"
+#include "nsQueryFrame.h"
+
+// Uncomment this to disable arenas, instead forwarding to
+// malloc for every allocation.
+//#define DEBUG_TRACEMALLOC_PRESARENA 1
+
+// The debugging version of nsPresArena does not free all the memory it
+// allocated when the arena itself is destroyed.
+#ifdef DEBUG_TRACEMALLOC_PRESARENA
+#define PRESARENA_MUST_FREE_DURING_DESTROY PR_TRUE
+#else
+#define PRESARENA_MUST_FREE_DURING_DESTROY PR_FALSE
+#endif
+
+class nsPresArena {
+public:
+  nsPresArena();
+  ~nsPresArena();
+
+  // Pool allocation with recycler lists indexed by object size.
+  NS_HIDDEN_(void*) AllocateBySize(size_t aSize);
+  NS_HIDDEN_(void)  FreeBySize(size_t aSize, void* aPtr);
+
+  // Pool allocation with recycler lists indexed by object-type code.
+  // Every type code must always be used with the same object size.
+  NS_HIDDEN_(void*) AllocateByCode(nsQueryFrame::FrameIID aCode, size_t aSize);
+  NS_HIDDEN_(void)  FreeByCode(nsQueryFrame::FrameIID aCode, void* aPtr);
+
+private:
+  struct State;
+  State* mState;
+};
+
+#endif
--- a/layout/base/nsPresContext.h
+++ b/layout/base/nsPresContext.h
@@ -275,25 +275,25 @@ public:
   /** 
    * Get medium of presentation
    */
   nsIAtom* Medium() { return mMedium; }
 
   void* AllocateFromShell(size_t aSize)
   {
     if (mShell)
-      return mShell->AllocateFrame(aSize);
+      return mShell->AllocateMisc(aSize);
     return nsnull;
   }
 
   void FreeToShell(size_t aSize, void* aFreeChunk)
   {
     NS_ASSERTION(mShell, "freeing after shutdown");
     if (mShell)
-      mShell->FreeFrame(aSize, aFreeChunk);
+      mShell->FreeMisc(aSize, aFreeChunk);
   }
 
   /**
    * Get the font metrics for a given font.
    *
    * If aUseUserFontSet is false, don't build or use the user font set.
    * This is intended only for nsRuleNode::CalcLengthWithInitialFont
    * (which is used from media query matching, which is in turn called
--- a/layout/base/nsPresShell.cpp
+++ b/layout/base/nsPresShell.cpp
@@ -46,22 +46,20 @@
  * Copyright (c) International Business Machines
  * Corporation, 2000
  *
  * Modifications to Mozilla code or documentation
  * identified per MPL Section 3.3
  *
  * Date         Modified by     Description of modification
  * 05/03/2000   IBM Corp.       Observer events for reflow states
- */ 
+ */
 
 /* a presentation of a document, part 2 */
 
-#define PL_ARENA_CONST_ALIGN_MASK 3
-
 #include "nsIPresShell.h"
 #include "nsPresContext.h"
 #include "nsIContent.h"
 #include "nsIDocument.h"
 #include "nsIDOMXULDocument.h"
 #include "nsStubDocumentObserver.h"
 #include "nsStyleSet.h"
 #include "nsICSSStyleSheet.h" // XXX for UA sheet loading hack, can this go away please?
@@ -112,24 +110,24 @@
 #include "nsIDOMXMLDocument.h"
 #include "nsIScrollableView.h"
 #include "nsIParser.h"
 #include "nsParserCIID.h"
 #include "nsFrameSelection.h"
 #include "nsIDOMNSHTMLInputElement.h" //optimization for ::DoXXX commands
 #include "nsIDOMNSHTMLTextAreaElement.h"
 #include "nsViewsCID.h"
+#include "nsPresArena.h"
 #include "nsFrameManager.h"
 #include "nsXPCOM.h"
 #include "nsISupportsPrimitives.h"
 #include "nsILayoutHistoryState.h"
 #include "nsILineIterator.h" // for ScrollContentIntoView
 #include "nsTimer.h"
 #include "nsWeakPtr.h"
-#include "plarena.h"
 #include "pldhash.h"
 #include "nsIObserverService.h"
 #include "nsIObserver.h"
 #include "nsIDocShell.h"        // for reflow observation
 #include "nsIBaseWindow.h"
 #include "nsLayoutErrors.h"
 #include "nsLayoutUtils.h"
 #include "nsCSSRendering.h"
@@ -429,19 +427,16 @@ protected:
 // microseconds.  When this bound is exceeded and reflow commands are
 // still queued up, a reflow event is posted.  The idea is for reflow
 // to not hog the processor beyond the time specifed in
 // gMaxRCProcessingTime.  This data member is initialized from the
 // layout.reflow.timeslice pref.
 #define NS_MAX_REFLOW_TIME    1000000
 static PRInt32 gMaxRCProcessingTime = -1;
 
-// Largest chunk size we recycle
-static const size_t gMaxRecycledSize = 400;
-
 #define MARK_INCREMENT 50
 #define BLOCK_INCREMENT 4044 /* a bit under 4096, for malloc overhead */
 
 /**A block of memory that the stack will 
  * chop up and hand out
  */
 struct StackBlock {
    
@@ -628,145 +623,16 @@ StackArena::Pop()
     memset(block->mBlock + pos, 0xdd, mPos - pos);
   }
 #endif
 
   mCurBlock = mMarks[mStackTop].mBlock;
   mPos      = mMarks[mStackTop].mPos;
 }
 
-// Uncomment this to disable the frame arena.
-//#define DEBUG_TRACEMALLOC_FRAMEARENA 1
-
-// Memory is allocated 4-byte aligned. We have recyclers for chunks up to
-// 200 bytes
-class FrameArena {
-public:
-  FrameArena(PRUint32 aArenaSize = 4096);
-  ~FrameArena();
-
-  // Memory management functions
-  NS_HIDDEN_(void*) AllocateFrame(size_t aSize);
-  NS_HIDDEN_(void)  FreeFrame(size_t aSize, void* aPtr);
-
-private:
-#ifdef DEBUG
-  // Number of frames in the pool
-  PRUint32 mFrameCount;
-#endif
-
-#if !defined(DEBUG_TRACEMALLOC_FRAMEARENA)
-  // Underlying arena pool
-  PLArenaPool mPool;
-
-  // The recycler array is sparse with the indices being multiples of 4,
-  // i.e., 0, 4, 8, 12, 16, 20, ...
-  void*       mRecyclers[gMaxRecycledSize >> 2];
-#endif
-};
-
-FrameArena::FrameArena(PRUint32 aArenaSize)
-#ifdef DEBUG
-  : mFrameCount(0)
-#endif
-{
-#if !defined(DEBUG_TRACEMALLOC_FRAMEARENA)
-  // Initialize the arena pool
-  PL_INIT_ARENA_POOL(&mPool, "FrameArena", aArenaSize);
-
-  // Zero out the recyclers array
-  memset(mRecyclers, 0, sizeof(mRecyclers));
-#endif
-}
-
-FrameArena::~FrameArena()
-{
-  NS_ASSERTION(mFrameCount == 0,
-               "Some objects allocated with AllocateFrame were not freed");
- 
-#if !defined(DEBUG_TRACEMALLOC_FRAMEARENA)
-  // Free the arena in the pool and finish using it
-  PL_FinishArenaPool(&mPool);
-#endif
-} 
-
-void*
-FrameArena::AllocateFrame(size_t aSize)
-{
-  void* result = nsnull;
-
-#if defined(DEBUG_TRACEMALLOC_FRAMEARENA)
-
-  result = PR_Malloc(aSize);
-
-#else
-
-  // Ensure we have correct alignment for pointers.  Important for Tru64
-  aSize = PR_ROUNDUP(aSize, sizeof(void*));
-
-  // Check recyclers first
-  if (aSize < gMaxRecycledSize) {
-    const int   index = aSize >> 2;
-
-    result = mRecyclers[index];
-    if (result) {
-      // Need to move to the next object
-      void* next = *((void**)result);
-      mRecyclers[index] = next;
-    }
-  }
-
-  if (!result) {
-    // Allocate a new chunk from the arena
-    PL_ARENA_ALLOCATE(result, &mPool, aSize);
-  }
-
-#endif
-
-#ifdef DEBUG
-  if (result != nsnull)
-    ++mFrameCount;
-#endif
-
-  return result;
-}
-
-void
-FrameArena::FreeFrame(size_t aSize, void* aPtr)
-{
-#ifdef DEBUG
-  --mFrameCount;
-
-  // Mark the memory with 0xdd in DEBUG builds so that there will be
-  // problems if someone tries to access memory that they've freed.
-  memset(aPtr, 0xdd, aSize);
-#endif
-#if defined(DEBUG_TRACEMALLOC_FRAMEARENA)
-  PR_Free(aPtr);
-#else
-  // Ensure we have correct alignment for pointers.  Important for Tru64
-  aSize = PR_ROUNDUP(aSize, sizeof(void*));
-
-  // See if it's a size that we recycle
-  if (aSize < gMaxRecycledSize) {
-    const int   index = aSize >> 2;
-    void*       currentTop = mRecyclers[index];
-    mRecyclers[index] = aPtr;
-    *((void**)aPtr) = currentTop;
-  }
-#ifdef DEBUG_dbaron
-  else {
-    fprintf(stderr,
-            "WARNING: FrameArena::FreeFrame leaking chunk of %d bytes.\n",
-            aSize);
-  }
-#endif
-#endif
-}
-
 struct nsCallbackEventRequest
 {
   nsIReflowCallback* callback;
   nsCallbackEventRequest* next;
 };
 
 // ----------------------------------------------------------------------------
 class nsPresShellEventCB;
@@ -788,18 +654,23 @@ public:
   // nsIPresShell
   NS_IMETHOD Init(nsIDocument* aDocument,
                   nsPresContext* aPresContext,
                   nsIViewManager* aViewManager,
                   nsStyleSet* aStyleSet,
                   nsCompatibility aCompatMode);
   NS_IMETHOD Destroy();
 
-  virtual NS_HIDDEN_(void*) AllocateFrame(size_t aSize);
-  virtual NS_HIDDEN_(void)  FreeFrame(size_t aSize, void* aFreeChunk);
+  virtual NS_HIDDEN_(void*) AllocateFrame(nsQueryFrame::FrameIID aCode,
+                                          size_t aSize);
+  virtual NS_HIDDEN_(void)  FreeFrame(nsQueryFrame::FrameIID aCode,
+                                      void* aChunk);
+
+  virtual NS_HIDDEN_(void*) AllocateMisc(size_t aSize);
+  virtual NS_HIDDEN_(void)  FreeMisc(size_t aSize, void* aChunk);
 
   // Dynamic stack memory allocation
   virtual NS_HIDDEN_(void) PushStackMemory();
   virtual NS_HIDDEN_(void) PopStackMemory();
   virtual NS_HIDDEN_(void*) AllocateStackMemory(size_t aSize);
 
   NS_IMETHOD SetPreferenceStyleRules(PRBool aForceReflow);
   
@@ -1179,17 +1050,17 @@ protected:
   nsTArray<nsIFrame*> mCurrentEventFrameStack;
   nsCOMArray<nsIContent> mCurrentEventContentStack;
 
   nsCOMPtr<nsIContent>          mLastAnchorScrolledTo;
   nscoord                       mLastAnchorScrollPositionY;
   nsRefPtr<nsCaret>             mCaret;
   nsRefPtr<nsCaret>             mOriginalCaret;
   PRInt16                       mSelectionFlags;
-  FrameArena                    mFrameArena;
+  nsPresArena                   mFrameArena;
   StackArena                    mStackArena;
   nsCOMPtr<nsIDragService>      mDragService;
   
   nsRevocableEventPtr<ReflowEvent> mReflowEvent;
 
 #ifdef DEBUG
   // The reflow root under which we're currently reflowing.  Null when
   // not in reflow.
@@ -1407,16 +1278,21 @@ private:
 
 private:
   /*
    * Computes the backstop color for the view: transparent if in a transparent
    * widget, otherwise the PresContext default background color. This color is
    * only visible if the contents of the view as a whole are translucent.
    */
   nscolor ComputeBackstopColor(nsIView* aView);
+
+#ifdef DEBUG
+  // Ensure that every allocation from the PresArena is eventually freed.
+  PRUint32 mPresArenaAllocCount;
+#endif
 };
 
 class nsAutoCauseReflowNotifier
 {
 public:
   nsAutoCauseReflowNotifier(PresShell* aShell)
     : mShell(aShell)
   {
@@ -1740,16 +1616,19 @@ PresShell::PresShell()
   mReflowCountMgr->SetPresShell(this);
 #endif
 #ifdef PR_LOGGING
   if (! gLog)
     gLog = PR_NewLogModule("PresShell");
 #endif
   mSelectionFlags = nsISelectionDisplay::DISPLAY_TEXT | nsISelectionDisplay::DISPLAY_IMAGES;
   mIsThemeSupportDisabled = PR_FALSE;
+#ifdef DEBUG
+  mPresArenaAllocCount = 0;
+#endif
 
   new (this) nsFrameManager();
 }
 
 NS_IMPL_ISUPPORTS8(PresShell, nsIPresShell, nsIDocumentObserver,
                    nsIViewObserver, nsISelectionController,
                    nsISelectionDisplay, nsIObserver, nsISupportsWeakReference,
                    nsIMutationObserver)
@@ -1761,17 +1640,22 @@ PresShell::~PresShell()
     Destroy();
   }
 
   NS_ASSERTION(mCurrentEventContentStack.Count() == 0,
                "Huh, event content left on the stack in pres shell dtor!");
   NS_ASSERTION(mFirstCallbackEventRequest == nsnull &&
                mLastCallbackEventRequest == nsnull,
                "post-reflow queues not empty.  This means we're leaking");
- 
+
+#ifdef DEBUG
+  NS_ASSERTION(mPresArenaAllocCount == 0,
+               "Some pres arena objects were not freed");
+#endif
+
   delete mStyleSet;
   delete mFrameConstructor;
 
   mCurrentEventContent = nsnull;
 
   NS_IF_RELEASE(mPresContext);
   NS_IF_RELEASE(mDocument);
   NS_IF_RELEASE(mSelection);
@@ -2096,25 +1980,56 @@ PresShell::PopStackMemory()
 
 /* virtual */ void*
 PresShell::AllocateStackMemory(size_t aSize)
 {
   return mStackArena.Allocate(aSize);
 }
 
 void
-PresShell::FreeFrame(size_t aSize, void* aPtr)
-{
-  mFrameArena.FreeFrame(aSize, aPtr);
+PresShell::FreeFrame(nsQueryFrame::FrameIID aCode, void* aPtr)
+{
+#ifdef DEBUG
+  mPresArenaAllocCount--;
+#endif
+  if (PRESARENA_MUST_FREE_DURING_DESTROY || !mIsDestroying)
+    mFrameArena.FreeByCode(aCode, aPtr);
 }
 
 void*
-PresShell::AllocateFrame(size_t aSize)
-{
-  return mFrameArena.AllocateFrame(aSize);
+PresShell::AllocateFrame(nsQueryFrame::FrameIID aCode, size_t aSize)
+{
+#ifdef DEBUG
+  mPresArenaAllocCount++;
+#endif
+  void* result = mFrameArena.AllocateByCode(aCode, aSize);
+
+  if (result) {
+    memset(result, 0, aSize);
+  }
+  return result;
+}
+
+void
+PresShell::FreeMisc(size_t aSize, void* aPtr)
+{
+#ifdef DEBUG
+  mPresArenaAllocCount--;
+#endif
+  if (PRESARENA_MUST_FREE_DURING_DESTROY || !mIsDestroying)
+    mFrameArena.FreeBySize(aSize, aPtr);
+}
+
+void*
+PresShell::AllocateMisc(size_t aSize)
+{
+#ifdef DEBUG
+  mPresArenaAllocCount++;
+#endif
+  return mFrameArena.AllocateBySize(aSize);
 }
 
 void
 nsIPresShell::SetAuthorStyleDisabled(PRBool aStyleDisabled)
 {
   if (aStyleDisabled != mStyleSet->GetAuthorStyleDisabled()) {
     mStyleSet->SetAuthorStyleDisabled(aStyleDisabled);
     ReconstructStyleData();
@@ -4710,17 +4625,17 @@ PresShell::IsThemeSupportEnabled()
 {
   return !mIsThemeSupportDisabled;
 }
 
 // Post a request to handle an arbitrary callback after reflow has finished.
 NS_IMETHODIMP
 PresShell::PostReflowCallback(nsIReflowCallback* aCallback)
 {
-  void* result = AllocateFrame(sizeof(nsCallbackEventRequest));
+  void* result = AllocateMisc(sizeof(nsCallbackEventRequest));
   if (NS_UNLIKELY(!result)) {
     return NS_ERROR_OUT_OF_MEMORY;
   }
   nsCallbackEventRequest* request = (nsCallbackEventRequest*)result;
 
   request->callback = aCallback;
   request->next = nsnull;
 
@@ -4754,17 +4669,17 @@ PresShell::CancelReflowCallback(nsIReflo
           node = node->next;
           before->next = node;
         }
 
         if (toFree == mLastCallbackEventRequest) {
           mLastCallbackEventRequest = before;
         }
 
-        FreeFrame(sizeof(nsCallbackEventRequest), toFree);
+        FreeMisc(sizeof(nsCallbackEventRequest), toFree);
       } else {
         before = node;
         node = node->next;
       }
    }
 
    return NS_OK;
 }
@@ -4774,17 +4689,17 @@ PresShell::CancelPostedReflowCallbacks()
 {
   while (mFirstCallbackEventRequest) {
     nsCallbackEventRequest* node = mFirstCallbackEventRequest;
     mFirstCallbackEventRequest = node->next;
     if (!mFirstCallbackEventRequest) {
       mLastCallbackEventRequest = nsnull;
     }
     nsIReflowCallback* callback = node->callback;
-    FreeFrame(sizeof(nsCallbackEventRequest), node);
+    FreeMisc(sizeof(nsCallbackEventRequest), node);
     if (callback) {
       callback->ReflowCallbackCanceled();
     }
   }
 }
 
 void
 PresShell::HandlePostedReflowCallbacks(PRBool aInterruptible)
@@ -4793,17 +4708,17 @@ PresShell::HandlePostedReflowCallbacks(P
 
    while (mFirstCallbackEventRequest) {
      nsCallbackEventRequest* node = mFirstCallbackEventRequest;
      mFirstCallbackEventRequest = node->next;
      if (!mFirstCallbackEventRequest) {
        mLastCallbackEventRequest = nsnull;
      }
      nsIReflowCallback* callback = node->callback;
-     FreeFrame(sizeof(nsCallbackEventRequest), node);
+     FreeMisc(sizeof(nsCallbackEventRequest), node);
      if (callback) {
        if (callback->ReflowFinished()) {
          shouldFlush = PR_TRUE;
        }
      }
    }
 
    mozFlushType flushType =
--- a/layout/forms/nsComboboxControlFrame.cpp
+++ b/layout/forms/nsComboboxControlFrame.cpp
@@ -167,16 +167,18 @@ NS_NewComboboxControlFrame(nsIPresShell*
   if (it) {
     // set the state flags (if any are provided)
     it->AddStateBits(aStateFlags);
   }
 
   return it;
 }
 
+NS_IMPL_FRAMEARENA_HELPERS(nsComboboxControlFrame)
+
 //-----------------------------------------------------------
 // Reflow Debugging Macros
 // These let us "see" how many reflow counts are happening
 //-----------------------------------------------------------
 #ifdef DO_REFLOW_COUNTER
 
 #define MAX_REFLOW_CNT 1024
 static PRInt32 gTotalReqs    = 0;;
@@ -1052,16 +1054,18 @@ nsComboboxControlFrame::CreateAnonymousC
 
   return NS_OK;
 }
 
 // XXXbz this is a for-now hack.  Now that display:inline-block works,
 // need to revisit this.
 class nsComboboxDisplayFrame : public nsBlockFrame {
 public:
+  NS_DECL_FRAMEARENA_HELPERS
+
   nsComboboxDisplayFrame (nsStyleContext* aContext,
                           nsComboboxControlFrame* aComboBox)
     : nsBlockFrame(aContext),
       mComboBox(aComboBox)
   {}
 
   // Need this so that line layout knows that this block's width
   // depends on the available width.
@@ -1081,16 +1085,18 @@ public:
   NS_IMETHOD BuildDisplayList(nsDisplayListBuilder*   aBuilder,
                               const nsRect&           aDirtyRect,
                               const nsDisplayListSet& aLists);
 
 protected:
   nsComboboxControlFrame* mComboBox;
 };
 
+NS_IMPL_FRAMEARENA_HELPERS(nsComboboxDisplayFrame)
+
 nsIAtom*
 nsComboboxDisplayFrame::GetType() const
 {
   return nsGkAtoms::comboboxDisplayFrame;
 }
 
 NS_IMETHODIMP
 nsComboboxDisplayFrame::Reflow(nsPresContext*           aPresContext,
--- a/layout/forms/nsComboboxControlFrame.h
+++ b/layout/forms/nsComboboxControlFrame.h
@@ -92,16 +92,17 @@ class nsComboboxControlFrame : public ns
 public:
   friend nsIFrame* NS_NewComboboxControlFrame(nsIPresShell* aPresShell, nsStyleContext* aContext, PRUint32 aFlags);
   friend class nsComboboxDisplayFrame;
 
   nsComboboxControlFrame(nsStyleContext* aContext);
   ~nsComboboxControlFrame();
 
   NS_DECL_QUERYFRAME
+  NS_DECL_FRAMEARENA_HELPERS
   NS_DECL_ISUPPORTS_INHERITED
 
   // nsIAnonymousContentCreator
   virtual nsresult CreateAnonymousContent(nsTArray<nsIContent*>& aElements);
   virtual nsIFrame* CreateFrameFor(nsIContent* aContent);
 
 #ifdef ACCESSIBILITY
   NS_IMETHOD GetAccessible(nsIAccessible** aAccessible);
--- a/layout/forms/nsFieldSetFrame.cpp
+++ b/layout/forms/nsFieldSetFrame.cpp
@@ -61,16 +61,17 @@
 #endif
 #include "nsIServiceManager.h"
 #include "nsDisplayList.h"
 
 class nsLegendFrame;
 
 class nsFieldSetFrame : public nsHTMLContainerFrame {
 public:
+  NS_DECL_FRAMEARENA_HELPERS
 
   nsFieldSetFrame(nsStyleContext* aContext);
 
   NS_IMETHOD SetInitialChildList(nsIAtom*       aListName,
                                  nsFrameList&   aChildList);
 
   NS_HIDDEN_(nscoord)
     GetIntrinsicWidth(nsIRenderingContext* aRenderingContext,
@@ -128,16 +129,18 @@ protected:
 };
 
 nsIFrame*
 NS_NewFieldSetFrame(nsIPresShell* aPresShell, nsStyleContext* aContext)
 {
   return new (aPresShell) nsFieldSetFrame(aContext);
 }
 
+NS_IMPL_FRAMEARENA_HELPERS(nsFieldSetFrame)
+
 nsFieldSetFrame::nsFieldSetFrame(nsStyleContext* aContext)
   : nsHTMLContainerFrame(aContext)
 {
   mContentFrame = nsnull;
   mLegendFrame  = nsnull;
   mLegendSpace  = 0;
 }
 
--- a/layout/forms/nsFileControlFrame.cpp
+++ b/layout/forms/nsFileControlFrame.cpp
@@ -82,16 +82,18 @@
 #define SYNC_BOTH 0x3
 
 nsIFrame*
 NS_NewFileControlFrame(nsIPresShell* aPresShell, nsStyleContext* aContext)
 {
   return new (aPresShell) nsFileControlFrame(aContext);
 }
 
+NS_IMPL_FRAMEARENA_HELPERS(nsFileControlFrame)
+
 nsFileControlFrame::nsFileControlFrame(nsStyleContext* aContext):
   nsBlockFrame(aContext),
   mTextFrame(nsnull), 
   mCachedState(nsnull)
 {
   AddStateBits(NS_BLOCK_FLOAT_MGR);
 }
 
--- a/layout/forms/nsFileControlFrame.h
+++ b/layout/forms/nsFileControlFrame.h
@@ -59,17 +59,18 @@ public:
                   nsIFrame*   aParent,
                   nsIFrame*   aPrevInFlow);
 
   NS_IMETHOD BuildDisplayList(nsDisplayListBuilder*   aBuilder,
                               const nsRect&           aDirtyRect,
                               const nsDisplayListSet& aLists);
 
   NS_DECL_QUERYFRAME
-  
+  NS_DECL_FRAMEARENA_HELPERS
+
   // nsIFormControlFrame
   virtual nsresult SetFormProperty(nsIAtom* aName, const nsAString& aValue);
   virtual nsresult GetFormProperty(nsIAtom* aName, nsAString& aValue) const;
   virtual void SetFocus(PRBool aOn, PRBool aRepaint);
 
   virtual nscoord GetMinWidth(nsIRenderingContext *aRenderingContext);
   
   NS_IMETHOD Reflow(nsPresContext*          aCX,
--- a/layout/forms/nsFormControlFrame.cpp
+++ b/layout/forms/nsFormControlFrame.cpp
@@ -61,16 +61,18 @@ nsFormControlFrame::Destroy()
   nsFormControlFrame::RegUnRegAccessKey(static_cast<nsIFrame*>(this), PR_FALSE);
   nsLeafFrame::Destroy();
 }
 
 NS_QUERYFRAME_HEAD(nsFormControlFrame)
   NS_QUERYFRAME_ENTRY(nsIFormControlFrame)
 NS_QUERYFRAME_TAIL_INHERITING(nsLeafFrame)
 
+NS_IMPL_FRAMEARENA_HELPERS(nsFormControlFrame)
+
 nscoord
 nsFormControlFrame::GetIntrinsicWidth()
 {
   // Provide a reasonable default for sites that use an "auto" height.
   // Note that if you change this, you should change the values in forms.css
   // as well.  This is the 13px default width minus the 2px default border.
   return nsPresContext::CSSPixelsToAppUnits(13 - 2 * 2);
 }
--- a/layout/forms/nsFormControlFrame.h
+++ b/layout/forms/nsFormControlFrame.h
@@ -44,32 +44,32 @@
 /** 
  * nsFormControlFrame is the base class for radio buttons and
  * checkboxes.  It also has two static methods (RegUnRegAccessKey and
  * GetScreenHeight) that are used by other form controls.
  */
 class nsFormControlFrame : public nsLeafFrame,
                            public nsIFormControlFrame
 {
-
 public:
   /**
     * Main constructor
     * @param aContent the content representing this frame
     * @param aParentFrame the parent frame
     */
   nsFormControlFrame(nsStyleContext*);
 
   virtual PRBool IsFrameOfType(PRUint32 aFlags) const
   {
     return nsLeafFrame::IsFrameOfType(aFlags &
       ~(nsIFrame::eReplaced | nsIFrame::eReplacedContainsBlock));
   }
 
   NS_DECL_QUERYFRAME
+  NS_DECL_FRAMEARENA_HELPERS
 
   /** 
     * Respond to a gui event
     * @see nsIFrame::HandleEvent
     */
   NS_IMETHOD HandleEvent(nsPresContext* aPresContext, 
                          nsGUIEvent* aEvent,
                          nsEventStatus* aEventStatus);
--- a/layout/forms/nsGfxButtonControlFrame.cpp
+++ b/layout/forms/nsGfxButtonControlFrame.cpp
@@ -65,16 +65,18 @@ nsGfxButtonControlFrame::nsGfxButtonCont
 }
 
 nsIFrame*
 NS_NewGfxButtonControlFrame(nsIPresShell* aPresShell, nsStyleContext* aContext)
 {
   return new (aPresShell) nsGfxButtonControlFrame(aContext);
 }
 
+NS_IMPL_FRAMEARENA_HELPERS(nsGfxButtonControlFrame)
+
 void nsGfxButtonControlFrame::Destroy()
 {
   nsContentUtils::DestroyAnonymousContent(&mTextContent);
   nsHTMLButtonControlFrame::Destroy();
 }
 
 nsIAtom*
 nsGfxButtonControlFrame::GetType() const
--- a/layout/forms/nsGfxButtonControlFrame.h
+++ b/layout/forms/nsGfxButtonControlFrame.h
@@ -51,16 +51,18 @@ class nsIAccessible;
 // browse button for input[type=file].
 // The label for button is specified through generated content
 // in the ua.css file.
 
 class nsGfxButtonControlFrame : public nsHTMLButtonControlFrame,
                                 public nsIAnonymousContentCreator
 {
 public:
+  NS_DECL_FRAMEARENA_HELPERS
+
   nsGfxButtonControlFrame(nsStyleContext* aContext);
 
   virtual void Destroy();
 
   NS_IMETHOD HandleEvent(nsPresContext* aPresContext, 
                          nsGUIEvent* aEvent,
                          nsEventStatus* aEventStatus);
 
--- a/layout/forms/nsGfxCheckboxControlFrame.cpp
+++ b/layout/forms/nsGfxCheckboxControlFrame.cpp
@@ -100,16 +100,18 @@ PaintIndeterminateMark(nsIFrame* aFrame,
 //------------------------------------------------------------
 nsIFrame*
 NS_NewGfxCheckboxControlFrame(nsIPresShell* aPresShell,
                               nsStyleContext* aContext)
 {
   return new (aPresShell) nsGfxCheckboxControlFrame(aContext);
 }
 
+NS_IMPL_FRAMEARENA_HELPERS(nsGfxCheckboxControlFrame)
+
 
 //------------------------------------------------------------
 // Initialize GFX-rendered state
 nsGfxCheckboxControlFrame::nsGfxCheckboxControlFrame(nsStyleContext* aContext)
 : nsFormControlFrame(aContext)
 {
 }
 
--- a/layout/forms/nsGfxCheckboxControlFrame.h
+++ b/layout/forms/nsGfxCheckboxControlFrame.h
@@ -43,19 +43,21 @@
 #ifdef ACCESSIBILITY
 class nsIAccessible;
 #endif
 
 class nsGfxCheckboxControlFrame : public nsFormControlFrame,
                                   public nsICheckboxControlFrame
 {
 public:
+  NS_DECL_FRAMEARENA_HELPERS
+
   nsGfxCheckboxControlFrame(nsStyleContext* aContext);
   virtual ~nsGfxCheckboxControlFrame();
-  
+
 #ifdef DEBUG
   NS_IMETHOD GetFrameName(nsAString& aResult) const {
     return MakeFrameName(NS_LITERAL_STRING("CheckboxControl"), aResult);
   }
 #endif
 
   NS_IMETHOD BuildDisplayList(nsDisplayListBuilder*   aBuilder,
                               const nsRect&           aDirtyRect,
--- a/layout/forms/nsGfxRadioControlFrame.cpp
+++ b/layout/forms/nsGfxRadioControlFrame.cpp
@@ -48,16 +48,18 @@
 #include "nsCSSAnonBoxes.h"
 
 nsIFrame*
 NS_NewGfxRadioControlFrame(nsIPresShell* aPresShell, nsStyleContext* aContext)
 {
   return new (aPresShell) nsGfxRadioControlFrame(aContext);
 }
 
+NS_IMPL_FRAMEARENA_HELPERS(nsGfxRadioControlFrame)
+
 nsGfxRadioControlFrame::nsGfxRadioControlFrame(nsStyleContext* aContext):
   nsFormControlFrame(aContext)
 {
 }
 
 nsGfxRadioControlFrame::~nsGfxRadioControlFrame()
 {
 }
--- a/layout/forms/nsGfxRadioControlFrame.h
+++ b/layout/forms/nsGfxRadioControlFrame.h
@@ -51,17 +51,18 @@ class nsGfxRadioControlFrame : public ns
                                public nsIRadioControlFrame
 
 {
 public:
   nsGfxRadioControlFrame(nsStyleContext* aContext);
   ~nsGfxRadioControlFrame();
 
   NS_DECL_QUERYFRAME
-  
+  NS_DECL_FRAMEARENA_HELPERS
+
 #ifdef ACCESSIBILITY
   NS_IMETHOD GetAccessible(nsIAccessible** aAccessible);
 #endif
   NS_IMETHOD OnChecked(nsPresContext* aPresContext, PRBool aChecked);
 
   NS_IMETHOD BuildDisplayList(nsDisplayListBuilder*   aBuilder,
                               const nsRect&           aDirtyRect,
                               const nsDisplayListSet& aLists);
--- a/layout/forms/nsHTMLButtonControlFrame.cpp
+++ b/layout/forms/nsHTMLButtonControlFrame.cpp
@@ -69,16 +69,18 @@
 #include "nsDisplayList.h"
 
 nsIFrame*
 NS_NewHTMLButtonControlFrame(nsIPresShell* aPresShell, nsStyleContext* aContext)
 {
   return new (aPresShell) nsHTMLButtonControlFrame(aContext);
 }
 
+NS_IMPL_FRAMEARENA_HELPERS(nsHTMLButtonControlFrame)
+
 nsHTMLButtonControlFrame::nsHTMLButtonControlFrame(nsStyleContext* aContext)
   : nsHTMLContainerFrame(aContext)
 {
 }
 
 nsHTMLButtonControlFrame::~nsHTMLButtonControlFrame()
 {
 }
--- a/layout/forms/nsHTMLButtonControlFrame.h
+++ b/layout/forms/nsHTMLButtonControlFrame.h
@@ -57,20 +57,20 @@ class nsIRenderingContext;
 
 class nsHTMLButtonControlFrame : public nsHTMLContainerFrame,
                                  public nsIFormControlFrame 
 {
 public:
   nsHTMLButtonControlFrame(nsStyleContext* aContext);
   ~nsHTMLButtonControlFrame();
 
-
   virtual void Destroy();
 
   NS_DECL_QUERYFRAME
+  NS_DECL_FRAMEARENA_HELPERS
 
   NS_IMETHOD BuildDisplayList(nsDisplayListBuilder*   aBuilder,
                               const nsRect&           aDirtyRect,
                               const nsDisplayListSet& aLists);
 
   virtual nscoord GetMinWidth(nsIRenderingContext *aRenderingContext);
 
   virtual nscoord GetPrefWidth(nsIRenderingContext *aRenderingContext);
--- a/layout/forms/nsICheckboxControlFrame.h
+++ b/layout/forms/nsICheckboxControlFrame.h
@@ -44,17 +44,17 @@ class nsPresContext;
 
 /** 
   * nsICheckControlFrame is the common interface radio buttons.
   * @see nsFromControlFrame and its base classes for more info
   */
 class nsICheckboxControlFrame
 {
 public:
-  NS_DECLARE_FRAME_ACCESSOR(nsICheckboxControlFrame)
+  NS_DECL_QUERYFRAME_TARGET(nsICheckboxControlFrame)
   
   /**
    * Called by content when checkbox "checked" changes
    */
   NS_IMETHOD OnChecked(nsPresContext* aPresContext, PRBool aChecked) = 0;
 };
 
 #endif
--- a/layout/forms/nsIComboboxControlFrame.h
+++ b/layout/forms/nsIComboboxControlFrame.h
@@ -49,17 +49,17 @@ class nsCSSFrameConstructor;
 /** 
   * nsIComboboxControlFrame is the common interface for frames of form controls. It
   * provides a uniform way of creating widgets, resizing, and painting.
   * @see nsLeafFrame and its base classes for more info
   */
 class nsIComboboxControlFrame : public nsQueryFrame
 {
 public:
-  NS_DECLARE_FRAME_ACCESSOR(nsIComboboxControlFrame)
+  NS_DECL_QUERYFRAME_TARGET(nsIComboboxControlFrame)
 
   /**
    * Indicates whether the list is dropped down
    */
   virtual PRBool IsDroppedDown() = 0;
 
   /**
    * Shows or hides the drop down
--- a/layout/forms/nsIFormControlFrame.h
+++ b/layout/forms/nsIFormControlFrame.h
@@ -47,17 +47,17 @@ struct nsSize;
 /** 
   * nsIFormControlFrame is the common interface for frames of form controls. It
   * provides a uniform way of creating widgets, resizing, and painting.
   * @see nsLeafFrame and its base classes for more info
   */
 class nsIFormControlFrame : public nsQueryFrame
 {
 public:
-  NS_DECLARE_FRAME_ACCESSOR(nsIFormControlFrame)
+  NS_DECL_QUERYFRAME_TARGET(nsIFormControlFrame)
 
   /**
    * 
    * @param aOn
    * @param aRepaint
    */
   virtual void SetFocus(PRBool aOn = PR_TRUE, PRBool aRepaint = PR_FALSE) = 0;
 
--- a/layout/forms/nsIListControlFrame.h
+++ b/layout/forms/nsIListControlFrame.h
@@ -45,17 +45,17 @@ class nsAString;
 class nsIContent;
 
 /** 
   * nsIListControlFrame is the interface for frame-based listboxes.
   */
 class nsIListControlFrame : public nsQueryFrame
 {
 public:
-  NS_DECLARE_FRAME_ACCESSOR(nsIListControlFrame)
+  NS_DECL_QUERYFRAME_TARGET(nsIListControlFrame)
 
   /**
    * Sets the ComboBoxFrame
    *
    */
   virtual void SetComboboxFrame(nsIFrame* aComboboxFrame) = 0;
 
   /**
--- a/layout/forms/nsIRadioControlFrame.h
+++ b/layout/forms/nsIRadioControlFrame.h
@@ -43,17 +43,17 @@ class nsStyleContext;
 
 /** 
   * nsIRadioControlFrame is the common interface radio buttons.
   * @see nsFormControlFrame and its base classes for more info
   */
 class nsIRadioControlFrame
 {
 public:
-  NS_DECLARE_FRAME_ACCESSOR(nsIRadioControlFrame)
+  NS_DECL_QUERYFRAME_TARGET(nsIRadioControlFrame)
 
    /**
     * Called by content when the radio button's state changes
     */
    NS_IMETHOD OnChecked(nsPresContext* aPresContext, PRBool aChecked) = 0;
 };
 
 #endif
--- a/layout/forms/nsISelectControlFrame.h
+++ b/layout/forms/nsISelectControlFrame.h
@@ -44,17 +44,17 @@
 class nsIDOMHTMLOptionElement;
 
 /** 
   * nsISelectControlFrame is the interface for combo boxes and listboxes
   */
 class nsISelectControlFrame : public nsQueryFrame
 {
 public:
-  NS_DECLARE_FRAME_ACCESSOR(nsISelectControlFrame)
+  NS_DECL_QUERYFRAME_TARGET(nsISelectControlFrame)
 
   /**
    * Adds an option to the list at index
    */
 
   NS_IMETHOD AddOption(PRInt32 index) = 0;
 
   /**
--- a/layout/forms/nsITextControlFrame.h
+++ b/layout/forms/nsITextControlFrame.h
@@ -43,17 +43,17 @@
 class nsIEditor;
 class nsIDocShell;
 class nsISelectionController;
 class nsFrameSelection;
 
 class nsITextControlFrame : public nsIFormControlFrame
 {
 public:
-  NS_DECLARE_FRAME_ACCESSOR(nsITextControlFrame)
+  NS_DECL_QUERYFRAME_TARGET(nsITextControlFrame)
 
   NS_IMETHOD    GetEditor(nsIEditor **aEditor) = 0;
 
   /**
    * Tell whether the frame currently owns the value or the content does (for
    * edge cases where the frame has just been created or is just going away).
    *
    * @param aOwnsValue whether the frame owns the value [out]
--- a/layout/forms/nsImageControlFrame.cpp
+++ b/layout/forms/nsImageControlFrame.cpp
@@ -77,16 +77,17 @@ public:
   ~nsImageControlFrame();
 
   virtual void Destroy();
   NS_IMETHOD Init(nsIContent*      aContent,
                   nsIFrame*        aParent,
                   nsIFrame*        aPrevInFlow);
 
   NS_DECL_QUERYFRAME
+  NS_DECL_FRAMEARENA_HELPERS
 
   NS_IMETHOD Reflow(nsPresContext*          aPresContext,
                     nsHTMLReflowMetrics&     aDesiredSize,
                     const nsHTMLReflowState& aReflowState,
                     nsReflowStatus&          aStatus);
 
   NS_IMETHOD HandleEvent(nsPresContext* aPresContext, 
                          nsGUIEvent* aEvent,
@@ -132,16 +133,18 @@ nsImageControlFrame::Destroy()
 }
 
 nsIFrame*
 NS_NewImageControlFrame(nsIPresShell* aPresShell, nsStyleContext* aContext)
 {
   return new (aPresShell) nsImageControlFrame(aContext);
 }
 
+NS_IMPL_FRAMEARENA_HELPERS(nsImageControlFrame)
+
 NS_IMETHODIMP
 nsImageControlFrame::Init(nsIContent*      aContent,
                           nsIFrame*        aParent,
                           nsIFrame*        aPrevInFlow)
 {
   nsresult rv = nsImageControlFrameSuper::Init(aContent, aParent, aPrevInFlow);
   NS_ENSURE_SUCCESS(rv, rv);
 
--- a/layout/forms/nsIsIndexFrame.cpp
+++ b/layout/forms/nsIsIndexFrame.cpp
@@ -79,16 +79,18 @@
 #include "nsLayoutErrors.h"
 
 nsIFrame*
 NS_NewIsIndexFrame(nsIPresShell* aPresShell, nsStyleContext* aContext)
 {
   return new (aPresShell) nsIsIndexFrame(aContext);
 }
 
+NS_IMPL_FRAMEARENA_HELPERS(nsIsIndexFrame)
+
 nsIsIndexFrame::nsIsIndexFrame(nsStyleContext* aContext) :
   nsBlockFrame(aContext)
 {
   SetFlags(NS_BLOCK_FLOAT_MGR);
 }
 
 nsIsIndexFrame::~nsIsIndexFrame()
 {
--- a/layout/forms/nsIsIndexFrame.h
+++ b/layout/forms/nsIsIndexFrame.h
@@ -77,16 +77,17 @@ public:
    * Processes a key typed event
    * @param aKeyEvent @see nsIDOMEvent.h 
    * @returns whether the event was consumed or ignored. @see nsresult
    *
    */
   NS_IMETHOD KeyPress(nsIDOMEvent* aKeyEvent); // we only care when a key is pressed
 
   NS_DECL_QUERYFRAME
+  NS_DECL_FRAMEARENA_HELPERS
 
   // nsISupports
   NS_IMETHOD QueryInterface(const nsIID& aIID, void** aInstancePtr);
 
   // nsIFormControlFrame
   virtual nscoord GetMinWidth(nsIRenderingContext *aRenderingContext);
   
   virtual PRBool IsLeaf() const;
--- a/layout/forms/nsLegendFrame.cpp
+++ b/layout/forms/nsLegendFrame.cpp
@@ -55,16 +55,18 @@ NS_NewLegendFrame(nsIPresShell* aPresShe
 
   nsIFrame* f = new (aPresShell) nsLegendFrame(aContext);
   if (f) {
     f->AddStateBits(NS_BLOCK_FLOAT_MGR | NS_BLOCK_MARGIN_ROOT);
   }
   return f;
 }
 
+NS_IMPL_FRAMEARENA_HELPERS(nsLegendFrame)
+
 nsIAtom*
 nsLegendFrame::GetType() const
 {
   return nsGkAtoms::legendFrame; 
 }
 
 void
 nsLegendFrame::Destroy()
--- a/layout/forms/nsLegendFrame.h
+++ b/layout/forms/nsLegendFrame.h
@@ -37,22 +37,22 @@
 
 #ifndef nsLegendFrame_h___
 #define nsLegendFrame_h___
 
 #include "nsBlockFrame.h"
 
 class nsLegendFrame : public nsBlockFrame {
 public:
-  NS_DECLARE_FRAME_ACCESSOR(nsLegendFrame)
+  NS_DECL_QUERYFRAME_TARGET(nsLegendFrame)
+  NS_DECL_QUERYFRAME
+  NS_DECL_FRAMEARENA_HELPERS
 
   nsLegendFrame(nsStyleContext* aContext) : nsBlockFrame(aContext) {}
 
-  NS_DECL_QUERYFRAME
-
   NS_IMETHOD Reflow(nsPresContext*           aPresContext,
                     nsHTMLReflowMetrics&     aDesiredSize,
                     const nsHTMLReflowState& aReflowState,
                     nsReflowStatus&          aStatus);
 
   virtual void Destroy();
 
   virtual nsIAtom* GetType() const;
--- a/layout/forms/nsListControlFrame.cpp
+++ b/layout/forms/nsListControlFrame.cpp
@@ -159,16 +159,18 @@ NS_NewListControlFrame(nsIPresShell* aPr
 
   if (it) {
     it->AddStateBits(NS_FRAME_INDEPENDENT_SELECTION);
   }
 
   return it;
 }
 
+NS_IMPL_FRAMEARENA_HELPERS(nsListControlFrame)
+
 //---------------------------------------------------------
 nsListControlFrame::nsListControlFrame(
   nsIPresShell* aShell, nsIDocument* aDocument, nsStyleContext* aContext)
   : nsHTMLScrollFrame(aShell, aContext, PR_FALSE),
     mMightNeedSecondPass(PR_FALSE),
     mHasPendingInterruptAtStartOfReflow(PR_FALSE),
     mLastDropdownComputedHeight(NS_UNCONSTRAINEDSIZE)
 {
--- a/layout/forms/nsListControlFrame.h
+++ b/layout/forms/nsListControlFrame.h
@@ -73,16 +73,17 @@ class nsListControlFrame : public nsHTML
                            public nsIFormControlFrame, 
                            public nsIListControlFrame,
                            public nsISelectControlFrame
 {
 public:
   friend nsIFrame* NS_NewListControlFrame(nsIPresShell* aPresShell, nsStyleContext* aContext);
 
   NS_DECL_QUERYFRAME
+  NS_DECL_FRAMEARENA_HELPERS
 
     // nsIFrame
   NS_IMETHOD HandleEvent(nsPresContext* aPresContext,
                          nsGUIEvent* aEvent,
                          nsEventStatus* aEventStatus);
   
   NS_IMETHOD SetInitialChildList(nsIAtom*        aListName,
                                  nsFrameList&    aChildList);
--- a/layout/forms/nsSelectsAreaFrame.cpp
+++ b/layout/forms/nsSelectsAreaFrame.cpp
@@ -51,16 +51,18 @@ NS_NewSelectsAreaFrame(nsIPresShell* aSh
     // We need NS_BLOCK_FLOAT_MGR to ensure that the options inside the select
     // aren't expanded by right floats outside the select.
     it->SetFlags(aFlags | NS_BLOCK_FLOAT_MGR);
   }
 
   return it;
 }
 
+NS_IMPL_FRAMEARENA_HELPERS(nsSelectsAreaFrame)
+
 //---------------------------------------------------------
 PRBool 
 nsSelectsAreaFrame::IsOptionElement(nsIContent* aContent)
 {
   PRBool result = PR_FALSE;
  
   nsCOMPtr<nsIDOMHTMLOptionElement> optElem;
   if (NS_SUCCEEDED(aContent->QueryInterface(NS_GET_IID(nsIDOMHTMLOptionElement),(void**) getter_AddRefs(optElem)))) {      
--- a/layout/forms/nsSelectsAreaFrame.h
+++ b/layout/forms/nsSelectsAreaFrame.h
@@ -38,16 +38,18 @@
 #define nsSelectsAreaFrame_h___
 
 #include "nsBlockFrame.h"
 class nsIContent;
 
 class nsSelectsAreaFrame : public nsBlockFrame
 {
 public:
+  NS_DECL_FRAMEARENA_HELPERS
+
   friend nsIFrame* NS_NewSelectsAreaFrame(nsIPresShell* aShell, nsStyleContext* aContext, PRUint32 aFlags);
 
   NS_IMETHOD BuildDisplayList(nsDisplayListBuilder*   aBuilder,
                               const nsRect&           aDirtyRect,
                               const nsDisplayListSet& aLists);
 
   nsresult BuildDisplayListInternal(nsDisplayListBuilder*   aBuilder,
                                     const nsRect&           aDirtyRect,
--- a/layout/forms/nsTextControlFrame.cpp
+++ b/layout/forms/nsTextControlFrame.cpp
@@ -946,22 +946,23 @@ nsTextInputSelectionImpl::CheckVisibilit
 }
 
 nsIFrame*
 NS_NewTextControlFrame(nsIPresShell* aPresShell, nsStyleContext* aContext)
 {
   return new (aPresShell) nsTextControlFrame(aPresShell, aContext);
 }
 
+NS_IMPL_FRAMEARENA_HELPERS(nsTextControlFrame)
+
 NS_QUERYFRAME_HEAD(nsTextControlFrame)
   NS_QUERYFRAME_ENTRY(nsIFormControlFrame)
   NS_QUERYFRAME_ENTRY(nsIAnonymousContentCreator)
   NS_QUERYFRAME_ENTRY(nsITextControlFrame)
-  if (nsIScrollableViewProvider::kFrameIID == id && IsScrollable())
-    return static_cast<nsIScrollableViewProvider*>(this);
+  NS_QUERYFRAME_ENTRY_CONDITIONAL(nsIScrollableViewProvider, IsScrollable())
 NS_QUERYFRAME_TAIL_INHERITING(nsBoxFrame)
 
 #ifdef ACCESSIBILITY
 NS_IMETHODIMP nsTextControlFrame::GetAccessible(nsIAccessible** aAccessible)
 {
   nsCOMPtr<nsIAccessibilityService> accService = do_GetService("@mozilla.org/accessibilityService;1");
 
   if (accService) {
--- a/layout/forms/nsTextControlFrame.h
+++ b/layout/forms/nsTextControlFrame.h
@@ -64,16 +64,18 @@ class nsIAccessible;
 
 class nsTextControlFrame : public nsStackFrame,
                            public nsIAnonymousContentCreator,
                            public nsITextControlFrame,
                            public nsIScrollableViewProvider
 
 {
 public:
+  NS_DECL_FRAMEARENA_HELPERS
+
   nsTextControlFrame(nsIPresShell* aShell, nsStyleContext* aContext);
   virtual ~nsTextControlFrame();
 
   virtual void RemovedAsPrimaryFrame(); 
 
   virtual void Destroy();
 
   virtual nscoord GetMinWidth(nsIRenderingContext* aRenderingContext);
--- a/layout/generic/nsBRFrame.cpp
+++ b/layout/generic/nsBRFrame.cpp
@@ -56,16 +56,18 @@
 
 //FOR SELECTION
 #include "nsIContent.h"
 #include "nsFrameSelection.h"
 //END INCLUDES FOR SELECTION
 
 class BRFrame : public nsFrame {
 public:
+  NS_DECL_FRAMEARENA_HELPERS
+
   friend nsIFrame* NS_NewBRFrame(nsIPresShell* aPresShell, nsStyleContext* aContext);
 
   virtual ContentOffsets CalcContentOffsetsFromFramePoint(nsPoint aPoint);
 
   virtual PRBool PeekOffsetNoAmount(PRBool aForward, PRInt32* aOffset);
   virtual PRBool PeekOffsetCharacter(PRBool aForward, PRInt32* aOffset);
   virtual PRBool PeekOffsetWord(PRBool aForward, PRBool aWordSelectEatSpace, PRBool aIsKeyboardSelect,
                                 PRInt32* aOffset, PeekWordState* aState);
@@ -98,16 +100,18 @@ protected:
 };
 
 nsIFrame*
 NS_NewBRFrame(nsIPresShell* aPresShell, nsStyleContext* aContext)
 {
   return new (aPresShell) BRFrame(aContext);
 }
 
+NS_IMPL_FRAMEARENA_HELPERS(BRFrame)
+
 BRFrame::~BRFrame()
 {
 }
 
 NS_IMETHODIMP
 BRFrame::Reflow(nsPresContext* aPresContext,
                 nsHTMLReflowMetrics& aMetrics,
                 const nsHTMLReflowState& aReflowState,
--- a/layout/generic/nsBidiFrames.cpp
+++ b/layout/generic/nsBidiFrames.cpp
@@ -66,9 +66,11 @@ nsDirectionalFrame::GetFrameName(nsAStri
 #endif
 
 nsIFrame*
 NS_NewDirectionalFrame(nsIPresShell* aPresShell, nsStyleContext* aContext, PRUnichar aChar)
 {
   return new (aPresShell) nsDirectionalFrame(aContext, aChar);
 }
 
+NS_IMPL_FRAMEARENA_HELPERS(nsDirectionalFrame)
+
 #endif /* IBMBIDI */
--- a/layout/generic/nsBidiFrames.h
+++ b/layout/generic/nsBidiFrames.h
@@ -45,16 +45,18 @@
 
 
 class nsDirectionalFrame : public nsFrame
 {
 protected:
   virtual ~nsDirectionalFrame();
 
 public:
+  NS_DECL_FRAMEARENA_HELPERS
+
   nsDirectionalFrame(nsStyleContext* aContext, PRUnichar aChar);
 
   /**
    * Get the "type" of the frame
    *
    * @see nsGkAtoms::directionalFrame
    */
   virtual nsIAtom* GetType() const;
--- a/layout/generic/nsBlockFrame.cpp
+++ b/layout/generic/nsBlockFrame.cpp
@@ -271,16 +271,18 @@ NS_NewBlockFrame(nsIPresShell* aPresShel
 {
   nsBlockFrame* it = new (aPresShell) nsBlockFrame(aContext);
   if (it) {
     it->SetFlags(aFlags);
   }
   return it;
 }
 
+NS_IMPL_FRAMEARENA_HELPERS(nsBlockFrame)
+
 nsBlockFrame::~nsBlockFrame()
 {
 }
 
 void
 nsBlockFrame::Destroy()
 {
   mAbsoluteContainer.DestroyFrames(this);
--- a/layout/generic/nsBlockFrame.h
+++ b/layout/generic/nsBlockFrame.h
@@ -137,17 +137,18 @@ class nsIntervalSet;
  * The block frame has an additional named child list:
  * - "Absolute-list" which contains the absolutely positioned frames
  *
  * @see nsGkAtoms::absoluteList
  */ 
 class nsBlockFrame : public nsBlockFrameSuper
 {
 public:
-  NS_DECLARE_FRAME_ACCESSOR(nsBlockFrame)
+  NS_DECL_QUERYFRAME_TARGET(nsBlockFrame)
+  NS_DECL_FRAMEARENA_HELPERS
 
   typedef nsLineList::iterator                  line_iterator;
   typedef nsLineList::const_iterator            const_line_iterator;
   typedef nsLineList::reverse_iterator          reverse_line_iterator;
   typedef nsLineList::const_reverse_iterator    const_reverse_line_iterator;
 
   line_iterator begin_lines() { return mLines.begin(); }
   line_iterator end_lines() { return mLines.end(); }
--- a/layout/generic/nsBulletFrame.cpp
+++ b/layout/generic/nsBulletFrame.cpp
@@ -79,16 +79,17 @@ public:
   NS_IMETHOD FrameChanged(imgIContainer *aContainer, nsIntRect *dirtyRect);
 
   void SetFrame(nsBulletFrame *frame) { mFrame = frame; }
 
 private:
   nsBulletFrame *mFrame;
 };
 
+NS_IMPL_FRAMEARENA_HELPERS(nsBulletFrame)
 
 nsBulletFrame::~nsBulletFrame()
 {
 }
 
 void
 nsBulletFrame::Destroy()
 {
--- a/layout/generic/nsBulletFrame.h
+++ b/layout/generic/nsBulletFrame.h
@@ -47,16 +47,18 @@
 #include "imgIDecoderObserver.h"
 
 /**
  * A simple class that manages the layout and rendering of html bullets.
  * This class also supports the CSS list-style properties.
  */
 class nsBulletFrame : public nsFrame {
 public:
+  NS_DECL_FRAMEARENA_HELPERS
+
   nsBulletFrame(nsStyleContext* aContext) : nsFrame(aContext) {}
   virtual ~nsBulletFrame();
 
   // nsIFrame
   virtual void Destroy();
   NS_IMETHOD BuildDisplayList(nsDisplayListBuilder*   aBuilder,
                               const nsRect&           aDirtyRect,
                               const nsDisplayListSet& aLists);
--- a/layout/generic/nsColumnSetFrame.cpp
+++ b/layout/generic/nsColumnSetFrame.cpp
@@ -49,16 +49,18 @@
 #include "nsStyleConsts.h"
 #include "nsCOMPtr.h"
 #include "nsLayoutUtils.h"
 #include "nsDisplayList.h"
 #include "nsCSSRendering.h"
 
 class nsColumnSetFrame : public nsHTMLContainerFrame {
 public:
+  NS_DECL_FRAMEARENA_HELPERS
+
   nsColumnSetFrame(nsStyleContext* aContext);
 
   NS_IMETHOD SetInitialChildList(nsIAtom*        aListName,
                                  nsFrameList&    aChildList);
 
   NS_IMETHOD Reflow(nsPresContext* aPresContext,
                     nsHTMLReflowMetrics& aDesiredSize,
                     const nsHTMLReflowState& aReflowState,
@@ -187,16 +189,18 @@ NS_NewColumnSetFrame(nsIPresShell* aPres
   if (it) {
     // set the state flags (if any are provided)
     it->AddStateBits(aStateFlags);
   }
 
   return it;
 }
 
+NS_IMPL_FRAMEARENA_HELPERS(nsColumnSetFrame)
+
 nsColumnSetFrame::nsColumnSetFrame(nsStyleContext* aContext)
   : nsHTMLContainerFrame(aContext), mLastBalanceHeight(NS_INTRINSICSIZE),
     mLastFrameStatus(NS_FRAME_COMPLETE)
 {
 }
 
 nsIAtom*
 nsColumnSetFrame::GetType() const
--- a/layout/generic/nsContainerFrame.cpp
+++ b/layout/generic/nsContainerFrame.cpp
@@ -75,16 +75,18 @@
 #include "nsThemeConstants.h"
 
 #ifdef NS_DEBUG
 #undef NOISY
 #else
 #undef NOISY
 #endif
 
+NS_IMPL_FRAMEARENA_HELPERS(nsContainerFrame)
+
 nsContainerFrame::~nsContainerFrame()
 {
 }
 
 NS_IMETHODIMP
 nsContainerFrame::Init(nsIContent* aContent,
                        nsIFrame*   aParent,
                        nsIFrame*   aPrevInFlow)
--- a/layout/generic/nsContainerFrame.h
+++ b/layout/generic/nsContainerFrame.h
@@ -68,16 +68,18 @@
 class nsOverflowContinuationTracker;
 
 /**
  * Implementation of a container frame.
  */
 class nsContainerFrame : public nsSplittableFrame
 {
 public:
+  NS_DECL_FRAMEARENA_HELPERS
+
   // nsIFrame overrides
   NS_IMETHOD Init(nsIContent* aContent,
                   nsIFrame*   aParent,
                   nsIFrame*   aPrevInFlow);
   NS_IMETHOD SetInitialChildList(nsIAtom*     aListName,
                                  nsFrameList& aChildList);
   NS_IMETHOD AppendFrames(nsIAtom*  aListName,
                           nsFrameList& aFrameList);
--- a/layout/generic/nsFirstLetterFrame.cpp
+++ b/layout/generic/nsFirstLetterFrame.cpp
@@ -49,16 +49,18 @@
 #include "nsFrameManager.h"
 
 nsIFrame*
 NS_NewFirstLetterFrame(nsIPresShell* aPresShell, nsStyleContext* aContext)
 {
   return new (aPresShell) nsFirstLetterFrame(aContext);
 }
 
+NS_IMPL_FRAMEARENA_HELPERS(nsFirstLetterFrame)
+
 #ifdef NS_DEBUG
 NS_IMETHODIMP
 nsFirstLetterFrame::GetFrameName(nsAString& aResult) const
 {
   return MakeFrameName(NS_LITERAL_STRING("Letter"), aResult);
 }
 #endif
 
--- a/layout/generic/nsFirstLetterFrame.h
+++ b/layout/generic/nsFirstLetterFrame.h
@@ -41,16 +41,18 @@
 /* rendering object for CSS :first-letter pseudo-element */
 
 #include "nsHTMLContainerFrame.h"
 
 #define nsFirstLetterFrameSuper nsHTMLContainerFrame
 
 class nsFirstLetterFrame : public nsFirstLetterFrameSuper {
 public:
+  NS_DECL_FRAMEARENA_HELPERS
+
   nsFirstLetterFrame(nsStyleContext* aContext) : nsHTMLContainerFrame(aContext) {}
 
   NS_IMETHOD Init(nsIContent*      aContent,
                   nsIFrame*        aParent,
                   nsIFrame*        aPrevInFlow);
   NS_IMETHOD SetInitialChildList(nsIAtom*        aListName,
                                  nsFrameList&    aChildList);
 #ifdef NS_DEBUG
--- a/layout/generic/nsFloatManager.cpp
+++ b/layout/generic/nsFloatManager.cpp
@@ -50,24 +50,24 @@ PRInt32 nsFloatManager::sCachedFloatMana
 void* nsFloatManager::sCachedFloatManagers[NS_FLOAT_MANAGER_CACHE_SIZE];
 
 /////////////////////////////////////////////////////////////////////////////
 
 // PresShell Arena allocate callback (for nsIntervalSet use below)
 static void*
 PSArenaAllocCB(size_t aSize, void* aClosure)
 {
-  return static_cast<nsIPresShell*>(aClosure)->AllocateFrame(aSize);
+  return static_cast<nsIPresShell*>(aClosure)->AllocateMisc(aSize);
 }
 
 // PresShell Arena free callback (for nsIntervalSet use below)
 static void
 PSArenaFreeCB(size_t aSize, void* aPtr, void* aClosure)
 {
-  static_cast<nsIPresShell*>(aClosure)->FreeFrame(aSize, aPtr);
+  static_cast<nsIPresShell*>(aClosure)->FreeMisc(aSize, aPtr);
 }
 
 /////////////////////////////////////////////////////////////////////////////
 // nsFloatManager
 
 nsFloatManager::nsFloatManager(nsIPresShell* aPresShell)
   : mX(0), mY(0),
     mFloatDamage(PSArenaAllocCB, PSArenaFreeCB, aPresShell)
--- a/layout/generic/nsFrame.cpp
+++ b/layout/generic/nsFrame.cpp
@@ -285,47 +285,16 @@ nsWeakFrame::Init(nsIFrame* aFrame)
 }
 
 nsIFrame*
 NS_NewEmptyFrame(nsIPresShell* aPresShell, nsStyleContext* aContext)
 {
   return new (aPresShell) nsFrame(aContext);
 }
 
-// Overloaded new operator. Initializes the memory to 0 and relies on an arena
-// (which comes from the presShell) to perform the allocation.
-void* 
-nsFrame::operator new(size_t sz, nsIPresShell* aPresShell) CPP_THROW_NEW
-{
-  // Check the recycle list first.
-  void* result = aPresShell->AllocateFrame(sz);
-  
-  if (result) {
-    memset(result, 0, sz);
-  }
-
-  return result;
-}
-
-// Overridden to prevent the global delete from being called, since the memory
-// came out of an nsIArena instead of the global delete operator's heap.
-void 
-nsFrame::operator delete(void* aPtr, size_t sz)
-{
-  // Don't let the memory be freed, since it will be recycled
-  // instead. Don't call the global operator delete.
-
-  // Stash the size of the object in the first four bytes of the
-  // freed up memory.  The Destroy method can then use this information
-  // to recycle the object.
-  size_t* szPtr = (size_t*)aPtr;
-  *szPtr = sz;
-}
-
-
 nsFrame::nsFrame(nsStyleContext* aContext)
 {
   MOZ_COUNT_CTOR(nsFrame);
 
   mState = NS_FRAME_FIRST_REFLOW | NS_FRAME_IS_DIRTY;
   mStyleContext = aContext;
   mStyleContext->AddRef();
 }
@@ -334,22 +303,32 @@ nsFrame::~nsFrame()
 {
   MOZ_COUNT_DTOR(nsFrame);
 
   NS_IF_RELEASE(mContent);
   if (mStyleContext)
     mStyleContext->Release();
 }
 
+NS_IMPL_FRAMEARENA_HELPERS(nsFrame)
+
+// Dummy operator delete.  Will never be called, but must be defined
+// to satisfy some C++ ABIs.
+void
+nsFrame::operator delete(void *, size_t)
+{
+  NS_RUNTIMEABORT("nsFrame::operator delete should never be called");
+}
+
 NS_QUERYFRAME_HEAD(nsFrame)
   NS_QUERYFRAME_ENTRY(nsIFrame)
 #ifdef DEBUG
   NS_QUERYFRAME_ENTRY(nsIFrameDebug)
 #endif
-NS_QUERYFRAME_TAIL
+NS_QUERYFRAME_TAIL_INHERITANCE_ROOT
 
 /////////////////////////////////////////////////////////////////////////////
 // nsIFrame
 
 NS_IMETHODIMP
 nsFrame::Init(nsIContent*      aContent,
               nsIFrame*        aParent,
               nsIFrame*        aPrevInFlow)
@@ -472,29 +451,35 @@ nsFrame::Destroy()
 
   //XXX Why is this done in nsFrame instead of some frame class
   // that actually loads images?
   presContext->StopImagesFor(this);
 
   if (view) {
     // Break association between view and frame
     view->SetClientData(nsnull);
-    
+
     // Destroy the view
     view->Destroy();
   }
 
-  // Deleting the frame doesn't really free the memory, since we're using an
-  // arena for allocation, but we will get our destructors called.
-  delete this;
-
-  // Now that we're totally cleaned out, we need to add ourselves to the presshell's
-  // recycler.
-  size_t* sz = (size_t*)this;
-  shell->FreeFrame(*sz, (void*)this);
+  // Must retrieve the object ID before calling destructors, so the
+  // vtable is still valid.
+  //
+  // Note to future tweakers: having the method that returns the
+  // object size call the destructor will not avoid an indirect call;
+  // the compiler cannot devirtualize the call to the destructor even
+  // if it's from a method defined in the same class.
+
+  nsQueryFrame::FrameIID id = GetFrameId();
+  this->~nsFrame();
+
+  // Now that we're totally cleaned out, we need to add ourselves to
+  // the presshell's recycler.
+  shell->FreeFrame(id, this);
 }
 
 NS_IMETHODIMP
 nsFrame::GetOffsets(PRInt32 &aStart, PRInt32 &aEnd) const
 {
   aStart = 0;
   aEnd = 0;
   return NS_OK;
--- a/layout/generic/nsFrame.h
+++ b/layout/generic/nsFrame.h
@@ -108,16 +108,32 @@
 #define NS_FRAME_TRACE(_bits,_args)
 #define NS_FRAME_TRACE_IN(_method)
 #define NS_FRAME_TRACE_OUT(_method)
 #define NS_FRAME_TRACE_MSG(_bits,_args)
 #define NS_FRAME_TRACE_REFLOW_IN(_method)
 #define NS_FRAME_TRACE_REFLOW_OUT(_method, _status)
 #endif
 
+// Frame allocation boilerplate macros.  Every subclass of nsFrame
+// must define its own operator new and GetAllocatedSize.  If they do
+// not, the per-frame recycler lists in nsPresArena will not work
+// correctly, with potentially catastrophic consequences (not enough
+// memory is allocated for a frame object).
+
+#define NS_DECL_FRAMEARENA_HELPERS                                \
+  NS_MUST_OVERRIDE void* operator new(size_t, nsIPresShell*);     \
+  virtual NS_MUST_OVERRIDE nsQueryFrame::FrameIID GetFrameId();
+
+#define NS_IMPL_FRAMEARENA_HELPERS(class)                         \
+  void* class::operator new(size_t sz, nsIPresShell* aShell)      \
+  { return aShell->AllocateFrame(nsQueryFrame::class##_id, sz); } \
+  nsQueryFrame::FrameIID class::GetFrameId()                      \
+  { return nsQueryFrame::class##_id; }
+
 //----------------------------------------------------------------------
 
 struct nsBoxLayoutMetrics;
 
 /**
  * Implementation of a simple frame that's not splittable and has no
  * child frames.
  *
@@ -129,40 +145,41 @@ class nsFrame : public nsBox
   , public nsIFrameDebug
 #endif
 {
 public:
   /**
    * Create a new "empty" frame that maps a given piece of content into a
    * 0,0 area.
    */
-  friend nsIFrame* NS_NewEmptyFrame(nsIPresShell* aShell, nsStyleContext* aContext);
-
-  // Overloaded new operator. Initializes the memory to 0 and relies on an arena
-  // (which comes from the presShell) to perform the allocation.
-  void* operator new(size_t sz, nsIPresShell* aPresShell) CPP_THROW_NEW;
-
-  // Overridden to prevent the global delete from being called, since the memory
-  // came out of an arena instead of the global delete operator's heap.  
-  // XXX Would like to make this private some day, but our UNIX compilers can't 
-  // deal with it.
-  void operator delete(void* aPtr, size_t sz);
-
-  // We compute and store the HTML content's overflow area. So don't
-  // try to compute it in the box code.
-  virtual PRBool ComputesOwnOverflowArea() { return PR_TRUE; }
+  friend nsIFrame* NS_NewEmptyFrame(nsIPresShell* aShell,
+                                    nsStyleContext* aContext);
 
 private:
-  // The normal operator new is disallowed on nsFrames.
-  void* operator new(size_t sz) CPP_THROW_NEW { return nsnull; }
+  // Left undefined; nsFrame objects are never allocated from the heap.
+  void* operator new(size_t sz) CPP_THROW_NEW;
+
+protected:
+  // Overridden to prevent the global delete from being called, since
+  // the memory came out of an arena instead of the heap.
+  //
+  // Ideally this would be private and undefined, like the normal
+  // operator new.  Unfortunately, the C++ standard requires an
+  // overridden operator delete to be accessible to any subclass that
+  // defines a virtual destructor, so we can only make it protected;
+  // worse, some C++ compilers will synthesize calls to this function
+  // from the "deleting destructors" that they emit in case of
+  // delete-expressions, so it can't even be undefined.
+  void operator delete(void* aPtr, size_t sz);
 
 public:
 
   // nsQueryFrame
   NS_DECL_QUERYFRAME
+  NS_DECL_FRAMEARENA_HELPERS
 
   // nsIFrame
   NS_IMETHOD  Init(nsIContent*      aContent,
                    nsIFrame*        aParent,
                    nsIFrame*        asPrevInFlow);
   NS_IMETHOD  SetInitialChildList(nsIAtom*           aListName,
                                   nsFrameList&       aChildList);
   NS_IMETHOD  AppendFrames(nsIAtom*        aListName,
@@ -366,16 +383,20 @@ public:
 
   // Box layout methods
   virtual nsSize GetPrefSize(nsBoxLayoutState& aBoxLayoutState);
   virtual nsSize GetMinSize(nsBoxLayoutState& aBoxLayoutState);
   virtual nsSize GetMaxSize(nsBoxLayoutState& aBoxLayoutState);
   virtual nscoord GetFlex(nsBoxLayoutState& aBoxLayoutState);
   virtual nscoord GetBoxAscent(nsBoxLayoutState& aBoxLayoutState);
 
+  // We compute and store the HTML content's overflow area. So don't
+  // try to compute it in the box code.
+  virtual PRBool ComputesOwnOverflowArea() { return PR_TRUE; }
+
   //--------------------------------------------------
   // Additional methods
 
   /**
    * Helper method to invalidate portions of a standard container frame if the
    * desired size indicates that the size has changed (specifically border,
    * background and outline).
    * We assume that the difference between the old frame area and the new
--- a/layout/generic/nsFrameFrame.cpp
+++ b/layout/generic/nsFrameFrame.cpp
@@ -108,16 +108,18 @@ static NS_DEFINE_CID(kCChildCID, NS_CHIL
 /******************************************************************************
  * nsSubDocumentFrame
  *****************************************************************************/
 class nsSubDocumentFrame : public nsLeafFrame,
                            public nsIFrameFrame,
                            public nsIReflowCallback
 {
 public:
+  NS_DECL_FRAMEARENA_HELPERS
+
   nsSubDocumentFrame(nsStyleContext* aContext);
 
 #ifdef DEBUG
   NS_IMETHOD GetFrameName(nsAString& aResult) const;
 #endif
 
   NS_DECL_QUERYFRAME
 
@@ -752,16 +754,18 @@ nsSubDocumentFrame::AttributeChanged(PRI
 }
 
 nsIFrame*
 NS_NewSubDocumentFrame(nsIPresShell* aPresShell, nsStyleContext* aContext)
 {
   return new (aPresShell) nsSubDocumentFrame(aContext);
 }
 
+NS_IMPL_FRAMEARENA_HELPERS(nsSubDocumentFrame)
+
 void
 nsSubDocumentFrame::Destroy()
 {
   if (mPostedReflowCallback) {
     PresContext()->PresShell()->CancelReflowCallback(this);
     mPostedReflowCallback = PR_FALSE;
   }
   
--- a/layout/generic/nsFrameSetFrame.cpp
+++ b/layout/generic/nsFrameSetFrame.cpp
@@ -124,19 +124,21 @@ void nsFramesetDrag::UnSet()
   mChange   = 0;
   mSource   = nsnull;
   mActive   = PR_FALSE;
 }
 
 /*******************************************************************************
  * nsHTMLFramesetBorderFrame
  ******************************************************************************/
-class nsHTMLFramesetBorderFrame : public nsLeafFrame {
+class nsHTMLFramesetBorderFrame : public nsLeafFrame
+{
+public:
+  NS_DECL_FRAMEARENA_HELPERS
 
-public:
 #ifdef DEBUG
   NS_IMETHOD GetFrameName(nsAString& aResult) const;
 #endif
 
   NS_IMETHOD HandleEvent(nsPresContext* aPresContext, 
                          nsGUIEvent* aEvent,
                          nsEventStatus* aEventStatus);
 
@@ -174,19 +176,21 @@ protected:
   PRPackedBool mVisibility;
   PRPackedBool mVisibilityOverride;
   PRPackedBool mCanResize;
   friend class nsHTMLFramesetFrame;
 };
 /*******************************************************************************
  * nsHTMLFramesetBlankFrame
  ******************************************************************************/
-class nsHTMLFramesetBlankFrame : public nsLeafFrame {
+class nsHTMLFramesetBlankFrame : public nsLeafFrame
+{
+public:
+  NS_DECL_FRAMEARENA_HELPERS
 
-public:
 #ifdef DEBUG
   NS_IMETHOD List(FILE* out = stdout, PRInt32 aIndent = 0) const;
 #endif
 
   NS_IMETHOD BuildDisplayList(nsDisplayListBuilder*   aBuilder,
                               const nsRect&           aDirtyRect,
                               const nsDisplayListSet& aLists);
 
@@ -1598,16 +1602,18 @@ NS_NewHTMLFramesetFrame(nsIPresShell* aP
   const nsStyleDisplay* disp = aContext->GetStyleDisplay();
   NS_ASSERTION(!disp->IsAbsolutelyPositioned() && !disp->IsFloating(),
                "Framesets should not be positioned and should not float");
 #endif
 
   return new (aPresShell) nsHTMLFramesetFrame(aContext);
 }
 
+NS_IMPL_FRAMEARENA_HELPERS(nsHTMLFramesetFrame)
+
 /*******************************************************************************
  * nsHTMLFramesetBorderFrame
  ******************************************************************************/
 nsHTMLFramesetBorderFrame::nsHTMLFramesetBorderFrame(nsStyleContext* aContext,
                                                      PRInt32 aWidth,
                                                      PRBool  aVertical,
                                                      PRBool  aVisibility)
   : nsLeafFrame(aContext), mWidth(aWidth), mVertical(aVertical), mVisibility(aVisibility)
@@ -1619,16 +1625,18 @@ nsHTMLFramesetBorderFrame::nsHTMLFramese
    mNextNeighbor = 0;
 }
 
 nsHTMLFramesetBorderFrame::~nsHTMLFramesetBorderFrame()
 {
   //printf("nsHTMLFramesetBorderFrame destructor %p \n", this);
 }
 
+NS_IMPL_FRAMEARENA_HELPERS(nsHTMLFramesetBorderFrame)
+
 nscoord nsHTMLFramesetBorderFrame::GetIntrinsicWidth()
 {
   // No intrinsic width
   return 0;
 }
 
 nscoord nsHTMLFramesetBorderFrame::GetIntrinsicHeight()
 {
@@ -1831,16 +1839,18 @@ NS_IMETHODIMP nsHTMLFramesetBorderFrame:
   return MakeFrameName(NS_LITERAL_STRING("FramesetBorder"), aResult);
 }
 #endif
 
 /*******************************************************************************
  * nsHTMLFramesetBlankFrame
  ******************************************************************************/
 
+NS_IMPL_FRAMEARENA_HELPERS(nsHTMLFramesetBlankFrame)
+
 nsHTMLFramesetBlankFrame::~nsHTMLFramesetBlankFrame()
 {
   //printf("nsHTMLFramesetBlankFrame destructor %p \n", this);
 }
 
 nscoord nsHTMLFramesetBlankFrame::GetIntrinsicWidth()
 {
   // No intrinsic width
--- a/layout/generic/nsFrameSetFrame.h
+++ b/layout/generic/nsFrameSetFrame.h
@@ -99,24 +99,24 @@ struct nsFramesetDrag {
 };
 
 /*******************************************************************************
  * nsHTMLFramesetFrame
  ******************************************************************************/
 class nsHTMLFramesetFrame : public nsHTMLContainerFrame
 {
 public:
-  NS_DECLARE_FRAME_ACCESSOR(nsHTMLFramesetFrame)
+  NS_DECL_QUERYFRAME_TARGET(nsHTMLFramesetFrame)
+  NS_DECL_QUERYFRAME
+  NS_DECL_FRAMEARENA_HELPERS
 
   nsHTMLFramesetFrame(nsStyleContext* aContext);
 
   virtual ~nsHTMLFramesetFrame();
 
-  NS_DECL_QUERYFRAME
-
   NS_IMETHOD Init(nsIContent*      aContent,
                   nsIFrame*        aParent,
                   nsIFrame*        aPrevInFlow);
 
   NS_IMETHOD SetInitialChildList(nsIAtom*     aListName,
                                  nsFrameList& aChildList);
 
   static PRBool  gDragInProgress;
--- a/layout/generic/nsGfxScrollFrame.cpp
+++ b/layout/generic/nsGfxScrollFrame.cpp
@@ -85,16 +85,18 @@
 //----------nsHTMLScrollFrame-------------------------------------------
 
 nsIFrame*
 NS_NewHTMLScrollFrame(nsIPresShell* aPresShell, nsStyleContext* aContext, PRBool aIsRoot)
 {
   return new (aPresShell) nsHTMLScrollFrame(aPresShell, aContext, aIsRoot);
 }
 
+NS_IMPL_FRAMEARENA_HELPERS(nsHTMLScrollFrame)
+
 nsHTMLScrollFrame::nsHTMLScrollFrame(nsIPresShell* aShell, nsStyleContext* aContext, PRBool aIsRoot)
   : nsHTMLContainerFrame(aContext),
     mInner(this, aIsRoot, PR_FALSE)
 {
 }
 
 /**
 * Get the view that we are scrolling within the scrolling view. 
@@ -943,16 +945,18 @@ NS_QUERYFRAME_TAIL_INHERITING(nsHTMLCont
 //----------nsXULScrollFrame-------------------------------------------
 
 nsIFrame*
 NS_NewXULScrollFrame(nsIPresShell* aPresShell, nsStyleContext* aContext, PRBool aIsRoot)
 {
   return new (aPresShell) nsXULScrollFrame(aPresShell, aContext, aIsRoot);
 }
 
+NS_IMPL_FRAMEARENA_HELPERS(nsXULScrollFrame)
+
 nsXULScrollFrame::nsXULScrollFrame(nsIPresShell* aShell, nsStyleContext* aContext, PRBool aIsRoot)
   : nsBoxFrame(aShell, aContext, aIsRoot),
     mInner(this, aIsRoot, PR_TRUE)
 {
     SetLayoutManager(nsnull);
 }
 
 /**
--- a/layout/generic/nsGfxScrollFrame.h
+++ b/layout/generic/nsGfxScrollFrame.h
@@ -246,16 +246,17 @@ public:
 class nsHTMLScrollFrame : public nsHTMLContainerFrame,
                           public nsIScrollableFrame,
                           public nsIAnonymousContentCreator,
                           public nsIStatefulFrame {
 public:
   friend nsIFrame* NS_NewHTMLScrollFrame(nsIPresShell* aPresShell, nsStyleContext* aContext, PRBool aIsRoot);
 
   NS_DECL_QUERYFRAME
+  NS_DECL_FRAMEARENA_HELPERS
 
   // Called to set the child frames. We typically have three: the scroll area,
   // the vertical scrollbar, and the horizontal scrollbar.
   NS_IMETHOD SetInitialChildList(nsIAtom*        aListName,
                                  nsFrameList&    aChildList);
 
   NS_IMETHOD BuildDisplayList(nsDisplayListBuilder*   aBuilder,
                               const nsRect&           aDirtyRect,
@@ -431,16 +432,17 @@ private:
  * or remove the scrolled frame
  */
 class nsXULScrollFrame : public nsBoxFrame,
                          public nsIScrollableFrame,
                          public nsIAnonymousContentCreator,
                          public nsIStatefulFrame {
 public:
   NS_DECL_QUERYFRAME
+  NS_DECL_FRAMEARENA_HELPERS
 
   friend nsIFrame* NS_NewXULScrollFrame(nsIPresShell* aPresShell, nsStyleContext* aContext, PRBool aIsRoot);
 
   // Called to set the child frames. We typically have three: the scroll area,
   // the vertical scrollbar, and the horizontal scrollbar.
   NS_IMETHOD SetInitialChildList(nsIAtom*        aListName,
                                  nsFrameList&    aChildList);
 
--- a/layout/generic/nsHTMLCanvasFrame.cpp
+++ b/layout/generic/nsHTMLCanvasFrame.cpp
@@ -87,16 +87,18 @@ public:
 
 
 nsIFrame*
 NS_NewHTMLCanvasFrame(nsIPresShell* aPresShell, nsStyleContext* aContext)
 {
   return new (aPresShell) nsHTMLCanvasFrame(aContext);
 }
 
+NS_IMPL_FRAMEARENA_HELPERS(nsHTMLCanvasFrame)
+
 nsHTMLCanvasFrame::~nsHTMLCanvasFrame()
 {
 }
 
 nsIntSize
 nsHTMLCanvasFrame::GetCanvasSize()
 {
   PRUint32 w, h;
--- a/layout/generic/nsHTMLCanvasFrame.h
+++ b/layout/generic/nsHTMLCanvasFrame.h
@@ -46,16 +46,18 @@
 #include "nsPresContext.h"
 #include "nsIIOService.h"
 
 nsIFrame* NS_NewHTMLCanvasFrame (nsIPresShell* aPresShell, nsStyleContext* aContext);
 
 class nsHTMLCanvasFrame : public nsSplittableFrame
 {
 public:
+  NS_DECL_FRAMEARENA_HELPERS
+
   nsHTMLCanvasFrame(nsStyleContext* aContext) : nsSplittableFrame(aContext) {}
 
   NS_IMETHOD BuildDisplayList(nsDisplayListBuilder*   aBuilder,
                               const nsRect&           aDirtyRect,
                               const nsDisplayListSet& aLists);
 
   void PaintCanvas(nsIRenderingContext& aRenderingContext,
                    const nsRect& aDirtyRect, nsPoint aPt);
--- a/layout/generic/nsHTMLContainerFrame.cpp
+++ b/layout/generic/nsHTMLContainerFrame.cpp
@@ -732,8 +732,10 @@ nsHTMLContainerFrame::CreateViewForFrame
   // Remember our view
   aFrame->SetView(view);
 
   NS_FRAME_LOG(NS_FRAME_TRACE_CALLS,
                ("nsHTMLContainerFrame::CreateViewForFrame: frame=%p view=%p",
                 aFrame));
   return NS_OK;
 }
+
+NS_IMPL_FRAMEARENA_HELPERS(nsHTMLContainerFrame)
--- a/layout/generic/nsHTMLContainerFrame.h
+++ b/layout/generic/nsHTMLContainerFrame.h
@@ -64,16 +64,17 @@ class nsLineBox;
 #endif
 
 class nsDisplayTextDecoration;
 
 // Base class for html container frames that provides common
 // functionality.
 class nsHTMLContainerFrame : public nsContainerFrame {
 public:
+  NS_DECL_FRAMEARENA_HELPERS
 
   /**
    * Helper method to create next-in-flows if necessary. If aFrame
    * already has a next-in-flow then this method does
    * nothing. Otherwise, a new continuation frame is created and
    * linked into the flow. In addition, the new frame becomes the
    * next-sibling of aFrame. If aPlaceholderResult is not null and
    * aFrame is a float or positioned, then *aPlaceholderResult holds
--- a/layout/generic/nsHTMLFrame.cpp
+++ b/layout/generic/nsHTMLFrame.cpp
@@ -82,16 +82,17 @@ class CanvasFrame : public nsHTMLContain
                     public nsIScrollPositionListener, 
                     public nsICanvasFrame {
 public:
   CanvasFrame(nsStyleContext* aContext)
   : nsHTMLContainerFrame(aContext), mDoPaintFocus(PR_FALSE),
     mAbsoluteContainer(nsGkAtoms::absoluteList) {}
 
   NS_DECL_QUERYFRAME
+  NS_DECL_FRAMEARENA_HELPERS
 
   // nsISupports (nsIScrollPositionListener)
   NS_IMETHOD QueryInterface(const nsIID& aIID, void** aInstancePtr);
 
   NS_IMETHOD Init(nsIContent*      aContent,
                   nsIFrame*        aParent,
                   nsIFrame*        aPrevInFlow);
   virtual void Destroy();
@@ -182,19 +183,21 @@ private:
 };
 
 
 //----------------------------------------------------------------------
 
 nsIFrame*
 NS_NewCanvasFrame(nsIPresShell* aPresShell, nsStyleContext* aContext)
 {
-  return new (aPresShell)CanvasFrame(aContext);
+  return new (aPresShell) CanvasFrame(aContext);
 }
 
+NS_IMPL_FRAMEARENA_HELPERS(CanvasFrame)
+
 NS_IMPL_QUERY_INTERFACE1(CanvasFrame, nsIScrollPositionListener)
 
 NS_QUERYFRAME_HEAD(CanvasFrame)
   NS_QUERYFRAME_ENTRY(nsICanvasFrame)
 NS_QUERYFRAME_TAIL_INHERITING(nsHTMLContainerFrame)
 
 NS_IMETHODIMP
 CanvasFrame::Init(nsIContent*      aContent,
--- a/layout/generic/nsIAnonymousContentCreator.h
+++ b/layout/generic/nsIAnonymousContentCreator.h
@@ -53,17 +53,17 @@ template <class T> class nsTArray;
  * Any source for anonymous content can implement this interface to provide it.
  * HTML frames like nsFileControlFrame currently use this.
  *
  * @see nsCSSFrameConstructor
  */
 class nsIAnonymousContentCreator
 {
 public:
-  NS_DECLARE_FRAME_ACCESSOR(nsIAnonymousContentCreator)
+  NS_DECL_QUERYFRAME_TARGET(nsIAnonymousContentCreator)
 
   /**
    * Creates "native" anonymous content and adds the created content to
    * the aElements array. None of the returned elements can be nsnull.
    *
    * @note The returned elements are owned by this object. This object is
    *       responsible for calling UnbindFromTree on the elements it returned
    *       from CreateAnonymousContent when appropriate (i.e. before releasing
--- a/layout/generic/nsICanvasFrame.h
+++ b/layout/generic/nsICanvasFrame.h
@@ -40,17 +40,17 @@
 #ifndef nsICanvasFrame_h__
 #define nsICanvasFrame_h__
 
 #include "nsQueryFrame.h"
 
 class nsICanvasFrame
 {
 public:
-  NS_DECLARE_FRAME_ACCESSOR(nsICanvasFrame)
+  NS_DECL_QUERYFRAME_TARGET(nsICanvasFrame)
 
   /** SetHasFocus tells the CanvasFrame to draw with focus ring
    *  @param aHasFocus PR_TRUE to show focus ring, PR_FALSE to hide it
    */
   NS_IMETHOD SetHasFocus(PRBool aHasFocus) = 0;
 
 };
 
--- a/layout/generic/nsIFrame.h
+++ b/layout/generic/nsIFrame.h
@@ -485,17 +485,17 @@ typedef PRBool nsDidReflowStatus;
  * link to many of the functions defined here. Too bad.
  *
  * If you're not in layout but you must call functions in here, at least
  * restrict yourself to calling virtual methods, which won't hurt you as badly.
  */
 class nsIFrame : public nsQueryFrame
 {
 public:
-  NS_DECLARE_FRAME_ACCESSOR(nsIFrame)
+  NS_DECL_QUERYFRAME_TARGET(nsIFrame)
 
   nsPresContext* PresContext() const {
     return GetStyleContext()->GetRuleNode()->GetPresContext();
   }
 
   /**
    * Called to initialize the frame. This is called immediately after creating
    * the frame.
--- a/layout/generic/nsIFrameDebug.h
+++ b/layout/generic/nsIFrameDebug.h
@@ -45,18 +45,18 @@
 class nsPresContext;
 struct PRLogModuleInfo;
 
 /**
  * Debug related functions
  */
 class nsIFrameDebug {
 public:
-  NS_DECLARE_FRAME_ACCESSOR(nsIFrameDebug)
-  
+  NS_DECL_QUERYFRAME_TARGET(nsIFrameDebug)
+
   NS_IMETHOD  List(FILE* out, PRInt32 aIndent) const = 0;
   /**
    * lists the frames beginning from the root frame
    * - calls root frame's List(...)
    */
   static void RootFrameList(nsPresContext* aPresContext, FILE* out, PRInt32 aIndent);
 
   static void DumpFrameTree(nsIFrame* aFrame);
--- a/layout/generic/nsIFrameFrame.h
+++ b/layout/generic/nsIFrameFrame.h
@@ -43,17 +43,17 @@
 #ifndef nsIFrameFrame_h___
 #define nsIFrameFrame_h___
 
 class nsIDocShell;
 
 class nsIFrameFrame
 {
 public:
-  NS_DECLARE_FRAME_ACCESSOR(nsIFrameFrame)
+  NS_DECL_QUERYFRAME_TARGET(nsIFrameFrame)
 
   NS_IMETHOD GetDocShell(nsIDocShell **aDocShell) = 0;
 
   /**
    * Only allowed to fail if the other frame is not the same type as
    * this one or if one of the frames has no docshell.  Don't call
    * EndSwapDocShells() unless BeginSwapDocShells() succeeds.
    */
--- a/layout/generic/nsIImageFrame.h
+++ b/layout/generic/nsIImageFrame.h
@@ -46,16 +46,16 @@
 struct nsSize;
 class imgIRequest;
 class nsPresContext;
 class nsIImageMap;
 
 class nsIImageFrame
 {
 public:
-  NS_DECLARE_FRAME_ACCESSOR(nsIImageFrame)
+  NS_DECL_QUERYFRAME_TARGET(nsIImageFrame)
 
   NS_IMETHOD GetIntrinsicImageSize(nsSize& aSize) = 0;
 
   NS_IMETHOD GetImageMap(nsPresContext *aPresContext, nsIImageMap **aImageMap) = 0;
 };
 
 #endif /* nsIImageFrame_h___ */
--- a/layout/generic/nsIObjectFrame.h
+++ b/layout/generic/nsIObjectFrame.h
@@ -45,17 +45,17 @@
 
 #include "nsIFrame.h"
 
 class nsIPluginInstance;
 
 class nsIObjectFrame : public nsQueryFrame
 {
 public:
-  NS_DECLARE_FRAME_ACCESSOR(nsIObjectFrame)
+  NS_DECL_QUERYFRAME_TARGET(nsIObjectFrame)
 
   NS_IMETHOD GetPluginInstance(nsIPluginInstance*& aPluginInstance) = 0;
 
   /**
    * Instantiate a plugin for a channel, returning a stream listener for the
    * data.
    *
    * @note Calling this method can delete the frame, so don't assume
--- a/layout/generic/nsIPageSequenceFrame.h
+++ b/layout/generic/nsIPageSequenceFrame.h
@@ -46,17 +46,17 @@ class nsIPrintSettings;
 /**
  * Interface for accessing special capabilities of the page sequence frame.
  *
  * Today all that exists are member functions for printing.
  */
 class nsIPageSequenceFrame : public nsQueryFrame
 {
 public:
-  NS_DECLARE_FRAME_ACCESSOR(nsIPageSequenceFrame)
+  NS_DECL_QUERYFRAME_TARGET(nsIPageSequenceFrame)
 
   /**
    * Print the set of pages.
    *
    * @param   aPrintOptions options for printing
    * @param   aStatusCallback interface that the client provides to receive
    *            progress notifications. Can be NULL
    * @return  NS_OK if successful
--- a/layout/generic/nsIScrollableFrame.h
+++ b/layout/generic/nsIScrollableFrame.h
@@ -50,17 +50,17 @@
 #include "nsPresContext.h"
 #include "nsIFrame.h" // to get nsIBox, which is a typedef
 
 class nsBoxLayoutState;
 
 class nsIScrollableFrame : public nsIScrollableViewProvider {
 public:
 
-  NS_DECLARE_FRAME_ACCESSOR(nsIScrollableFrame)
+  NS_DECL_QUERYFRAME_TARGET(nsIScrollableFrame)
 
   /**
    * Get the frame that we are scrolling within the scrollable frame.
    * @result child frame
    */
   virtual nsIFrame* GetScrolledFrame() const = 0;
 
   typedef nsPresContext::ScrollbarStyles ScrollbarStyles;
--- a/layout/generic/nsIScrollableViewProvider.h
+++ b/layout/generic/nsIScrollableViewProvider.h
@@ -41,14 +41,14 @@
 
 #include "nsQueryFrame.h"
 
 class nsIScrollableView;
 
 class nsIScrollableViewProvider : public nsQueryFrame
 {
  public: 
-  NS_DECLARE_FRAME_ACCESSOR(nsIScrollableViewProvider)
+  NS_DECL_QUERYFRAME_TARGET(nsIScrollableViewProvider)
 
   virtual nsIScrollableView* GetScrollableView() = 0;
 };
 
 #endif /* _nsIScrollableViewProvider_h */
--- a/layout/generic/nsIStatefulFrame.h
+++ b/layout/generic/nsIStatefulFrame.h
@@ -9,17 +9,17 @@
 #include "nsQueryFrame.h"
 
 class nsPresContext;
 class nsPresState;
 
 class nsIStatefulFrame
 {
  public: 
-  NS_DECLARE_FRAME_ACCESSOR(nsIStatefulFrame)
+  NS_DECL_QUERYFRAME_TARGET(nsIStatefulFrame)
 
   // If you create a special type stateful frame (e.g. scroll) that needs
   // to be captured outside of the standard pass through the frames, you'll need
   // a special ID by which to refer to that type.
   enum SpecialStateID {eNoID=0, eDocumentScrollState};
 
   // Save the state for this frame.  Some implementations may choose to return
   // different states depending on the value of aStateID.  If this method
--- a/layout/generic/nsImageFrame.cpp
+++ b/layout/generic/nsImageFrame.cpp
@@ -156,16 +156,18 @@ inline PRBool HaveFixedSize(const nsHTML
 }
 
 nsIFrame*
 NS_NewImageFrame(nsIPresShell* aPresShell, nsStyleContext* aContext)
 {
   return new (aPresShell) nsImageFrame(aContext);
 }
 
+NS_IMPL_FRAMEARENA_HELPERS(nsImageFrame)
+
 
 nsImageFrame::nsImageFrame(nsStyleContext* aContext) :
   ImageFrameSuper(aContext),
   mComputedSize(0, 0),
   mIntrinsicSize(0, 0),
   mDisplayingIcon(PR_FALSE)
 {
   // We assume our size is not constrained and we haven't gotten an
--- a/layout/generic/nsImageFrame.h
+++ b/layout/generic/nsImageFrame.h
@@ -89,16 +89,18 @@ private:
 
 #define IMAGE_SIZECONSTRAINED       0x00100000
 #define IMAGE_GOTINITIALREFLOW      0x00200000
 
 #define ImageFrameSuper nsSplittableFrame
 
 class nsImageFrame : public ImageFrameSuper, public nsIImageFrame {
 public:
+  NS_DECL_FRAMEARENA_HELPERS
+
   nsImageFrame(nsStyleContext* aContext);
 
   NS_DECL_QUERYFRAME
 
   virtual void Destroy();
   NS_IMETHOD Init(nsIContent*      aContent,
                   nsIFrame*        aParent,
                   nsIFrame*        aPrevInFlow);
--- a/layout/generic/nsInlineFrame.cpp
+++ b/layout/generic/nsInlineFrame.cpp
@@ -67,16 +67,18 @@
 // Basic nsInlineFrame methods
 
 nsIFrame*
 NS_NewInlineFrame(nsIPresShell* aPresShell, nsStyleContext* aContext)
 {
   return new (aPresShell) nsInlineFrame(aContext);
 }
 
+NS_IMPL_FRAMEARENA_HELPERS(nsInlineFrame)
+
 NS_QUERYFRAME_HEAD(nsInlineFrame)
   NS_QUERYFRAME_ENTRY(nsInlineFrame)
 NS_QUERYFRAME_TAIL_INHERITING(nsInlineFrameSuper)
 
 #ifdef DEBUG
 NS_IMETHODIMP
 nsInlineFrame::GetFrameName(nsAString& aResult) const
 {
@@ -894,16 +896,18 @@ ReParentChildListStyle(nsPresContext* aP
 }
 
 nsIFrame*
 NS_NewFirstLineFrame(nsIPresShell* aPresShell, nsStyleContext* aContext)
 {
   return new (aPresShell) nsFirstLineFrame(aContext);
 }
 
+NS_IMPL_FRAMEARENA_HELPERS(nsFirstLineFrame)
+
 #ifdef DEBUG
 NS_IMETHODIMP
 nsFirstLineFrame::GetFrameName(nsAString& aResult) const
 {
   return MakeFrameName(NS_LITERAL_STRING("Line"), aResult);
 }
 #endif
 
@@ -1072,16 +1076,18 @@ nsFirstLineFrame::PullOverflowsFromPrevI
 //////////////////////////////////////////////////////////////////////
 
 nsIFrame*
 NS_NewPositionedInlineFrame(nsIPresShell* aPresShell, nsStyleContext* aContext)
 {
   return new (aPresShell) nsPositionedInlineFrame(aContext);
 }
 
+NS_IMPL_FRAMEARENA_HELPERS(nsPositionedInlineFrame)
+
 void
 nsPositionedInlineFrame::Destroy()
 {
   mAbsoluteContainer.DestroyFrames(this);
   nsInlineFrame::Destroy();
 }
 
 NS_IMETHODIMP
--- a/layout/generic/nsInlineFrame.h
+++ b/layout/generic/nsInlineFrame.h
@@ -71,18 +71,19 @@ class nsAnonymousBlockFrame;
  * Inline frame class.
  *
  * This class manages a list of child frames that are inline frames. Working with
  * nsLineLayout, the class will reflow and place inline frames on a line.
  */
 class nsInlineFrame : public nsInlineFrameSuper
 {
 public:
-  NS_DECLARE_FRAME_ACCESSOR(nsInlineFrame)
+  NS_DECL_QUERYFRAME_TARGET(nsInlineFrame)
   NS_DECL_QUERYFRAME
+  NS_DECL_FRAMEARENA_HELPERS
 
   friend nsIFrame* NS_NewInlineFrame(nsIPresShell* aPresShell, nsStyleContext* aContext);
 
   // nsIFrame overrides
   NS_IMETHOD BuildDisplayList(nsDisplayListBuilder*   aBuilder,
                               const nsRect&           aDirtyRect,
                               const nsDisplayListSet& aLists);
 
@@ -208,16 +209,18 @@ protected:
 //----------------------------------------------------------------------
 
 /**
  * Variation on inline-frame used to manage lines for line layout in
  * special situations (:first-line style in particular).
  */
 class nsFirstLineFrame : public nsInlineFrame {
 public:
+  NS_DECL_FRAMEARENA_HELPERS
+
   friend nsIFrame* NS_NewFirstLineFrame(nsIPresShell* aPresShell, nsStyleContext* aContext);
 
 #ifdef DEBUG
   NS_IMETHOD GetFrameName(nsAString& aResult) const;
 #endif
   virtual nsIAtom* GetType() const;
   NS_IMETHOD Reflow(nsPresContext* aPresContext,
                     nsHTMLReflowMetrics& aDesiredSize,
@@ -242,16 +245,18 @@ protected:
 
 // Derived class created for relatively positioned inline-level elements
 // that acts as a containing block for child absolutely positioned
 // elements
 
 class nsPositionedInlineFrame : public nsInlineFrame
 {
 public:
+  NS_DECL_FRAMEARENA_HELPERS
+
   nsPositionedInlineFrame(nsStyleContext* aContext)
     : nsInlineFrame(aContext)
     , mAbsoluteContainer(nsGkAtoms::absoluteList)
   {}
 
   virtual ~nsPositionedInlineFrame() { } // useful for debugging
 
   virtual void Destroy();
--- a/layout/generic/nsLeafFrame.cpp
+++ b/layout/generic/nsLeafFrame.cpp
@@ -43,16 +43,18 @@
 #include "nsHTMLParts.h"
 #include "nsIPresShell.h"
 #include "nsPresContext.h"
 
 nsLeafFrame::~nsLeafFrame()
 {
 }
 
+NS_IMPL_FRAMEARENA_HELPERS(nsLeafFrame)
+
 /* virtual */ nscoord
 nsLeafFrame::GetMinWidth(nsIRenderingContext *aRenderingContext)
 {
   nscoord result;
   DISPLAY_MIN_WIDTH(this, result);
 
   result = GetIntrinsicWidth();
   return result;
--- a/layout/generic/nsLeafFrame.h
+++ b/layout/generic/nsLeafFrame.h
@@ -46,16 +46,17 @@
 /**
  * Abstract class that provides simple fixed-size layout for leaf objects
  * (e.g. images, form elements, etc.). Deriviations provide the implementation
  * of the GetDesiredSize method. The rendering method knows how to render
  * borders and backgrounds.
  */
 class nsLeafFrame : public nsFrame {
 public:
+  NS_DECL_FRAMEARENA_HELPERS
 
   // nsIFrame replacements
   NS_IMETHOD BuildDisplayList(nsDisplayListBuilder*   aBuilder,
                               const nsRect&           aDirtyRect,
                               const nsDisplayListSet& aLists) {
     DO_GLOBAL_REFLOW_COUNT_DSP("nsLeafFrame");
     return DisplayBorderBackgroundOutline(aBuilder, aLists);
   }
--- a/layout/generic/nsLineBox.cpp
+++ b/layout/generic/nsLineBox.cpp
@@ -91,37 +91,37 @@ nsLineBox*
 NS_NewLineBox(nsIPresShell* aPresShell, nsIFrame* aFrame,
               PRInt32 aCount, PRBool aIsBlock)
 {
   return new (aPresShell)nsLineBox(aFrame, aCount, aIsBlock);
 }
 
 // Overloaded new operator. Uses an arena (which comes from the presShell)
 // to perform the allocation.
-void* 
+void*
 nsLineBox::operator new(size_t sz, nsIPresShell* aPresShell) CPP_THROW_NEW
 {
-  return aPresShell->AllocateFrame(sz);
+  return aPresShell->AllocateMisc(sz);
 }
 
 // Overloaded delete operator. Doesn't actually free the memory, because we
 // use an arena
-void 
+void
 nsLineBox::operator delete(void* aPtr, size_t sz)
 {
 }
 
 void
 nsLineBox::Destroy(nsIPresShell* aPresShell)
 {
   // Destroy the object. This won't actually free the memory, though
   delete this;
 
   // Have the pres shell recycle the memory
-  aPresShell->FreeFrame(sizeof(*this), (void*)this);
+  aPresShell->FreeMisc(sizeof(*this), (void*)this);
 }
 
 void
 nsLineBox::Cleanup()
 {
   if (mData) {
     if (IsBlock()) {
       delete mBlockData;
--- a/layout/generic/nsObjectFrame.cpp
+++ b/layout/generic/nsObjectFrame.cpp
@@ -2340,16 +2340,18 @@ nsObjectFrame::GetNextObjectFrame(nsPres
 }
 
 nsIFrame*
 NS_NewObjectFrame(nsIPresShell* aPresShell, nsStyleContext* aContext)
 {
   return new (aPresShell) nsObjectFrame(aContext);
 }
 
+NS_IMPL_FRAMEARENA_HELPERS(nsObjectFrame)
+
 
 // nsPluginDOMContextMenuListener class implementation
 
 nsPluginDOMContextMenuListener::nsPluginDOMContextMenuListener()
 {
 }
 
 nsPluginDOMContextMenuListener::~nsPluginDOMContextMenuListener()
--- a/layout/generic/nsObjectFrame.h
+++ b/layout/generic/nsObjectFrame.h
@@ -58,16 +58,18 @@ class nsIPluginHost;
 class nsIPluginInstance;
 class nsPresContext;
 class nsDisplayPlugin;
 
 #define nsObjectFrameSuper nsFrame
 
 class nsObjectFrame : public nsObjectFrameSuper, public nsIObjectFrame {
 public:
+  NS_DECL_FRAMEARENA_HELPERS
+
   friend nsIFrame* NS_NewObjectFrame(nsIPresShell* aPresShell, nsStyleContext* aContext);
 
   NS_DECL_QUERYFRAME
 
   NS_IMETHOD Init(nsIContent* aContent,
                   nsIFrame* aParent,
                   nsIFrame* aPrevInFlow);
   virtual nscoord GetMinWidth(nsIRenderingContext *aRenderingContext);
--- a/layout/generic/nsPageContentFrame.cpp
+++ b/layout/generic/nsPageContentFrame.cpp
@@ -51,16 +51,18 @@
 #include "nsDisplayList.h"
 
 nsIFrame*
 NS_NewPageContentFrame(nsIPresShell* aPresShell, nsStyleContext* aContext)
 {
   return new (aPresShell) nsPageContentFrame(aContext);
 }
 
+NS_IMPL_FRAMEARENA_HELPERS(nsPageContentFrame)
+
 /* virtual */ nsSize
 nsPageContentFrame::ComputeSize(nsIRenderingContext *aRenderingContext,
                                 nsSize aCBSize, nscoord aAvailableWidth,
                                 nsSize aMargin, nsSize aBorder, nsSize aPadding,
                                 PRBool aShrinkWrap)
 {
   NS_ASSERTION(mPD, "Pages are supposed to have page data");
   nscoord height = (!mPD || mPD->mReflowSize.height == NS_UNCONSTRAINEDSIZE)
--- a/layout/generic/nsPageContentFrame.h
+++ b/layout/generic/nsPageContentFrame.h
@@ -40,16 +40,18 @@
 #include "nsViewportFrame.h"
 class nsPageFrame;
 class nsSharedPageData;
 
 // Page frame class used by the simple page sequence frame
 class nsPageContentFrame : public ViewportFrame {
 
 public:
+  NS_DECL_FRAMEARENA_HELPERS
+
   friend nsIFrame* NS_NewPageContentFrame(nsIPresShell* aPresShell, nsStyleContext* aContext);
   friend class nsPageFrame;
 
   // nsIFrame
   NS_IMETHOD  Reflow(nsPresContext*      aPresContext,
                      nsHTMLReflowMetrics& aDesiredSize,
                      const nsHTMLReflowState& aMaxSize,
                      nsReflowStatus&      aStatus);
--- a/layout/generic/nsPageFrame.cpp
+++ b/layout/generic/nsPageFrame.cpp
@@ -66,16 +66,18 @@ extern PRLogModuleInfo * kLayoutPrinting
 #endif
 
 nsIFrame*
 NS_NewPageFrame(nsIPresShell* aPresShell, nsStyleContext* aContext)
 {
   return new (aPresShell) nsPageFrame(aContext);
 }
 
+NS_IMPL_FRAMEARENA_HELPERS(nsPageFrame)
+
 nsPageFrame::nsPageFrame(nsStyleContext* aContext)
 : nsContainerFrame(aContext)
 {
 }
 
 nsPageFrame::~nsPageFrame()
 {
 }
@@ -601,16 +603,18 @@ NS_NewPageBreakFrame(nsIPresShell* aPres
 {
   NS_PRECONDITION(aPresShell, "null PresShell");
   //check that we are only creating page break frames when printing
   NS_ASSERTION(aPresShell->GetPresContext()->IsPaginated(), "created a page break frame while not printing");
 
   return new (aPresShell) nsPageBreakFrame(aContext);
 }
 
+NS_IMPL_FRAMEARENA_HELPERS(nsPageBreakFrame)
+
 nsPageBreakFrame::nsPageBreakFrame(nsStyleContext* aContext) :
   nsLeafFrame(aContext), mHaveReflowed(PR_FALSE)
 {
 }
 
 nsPageBreakFrame::~nsPageBreakFrame()
 {
 }
--- a/layout/generic/nsPageFrame.h
+++ b/layout/generic/nsPageFrame.h
@@ -41,16 +41,18 @@
 #include "nsLeafFrame.h"
 
 class nsSharedPageData;
 
 // Page frame class used by the simple page sequence frame
 class nsPageFrame : public nsContainerFrame {
 
 public:
+  NS_DECL_FRAMEARENA_HELPERS
+
   friend nsIFrame* NS_NewPageFrame(nsIPresShell* aPresShell, nsStyleContext* aContext);
 
   NS_IMETHOD  Reflow(nsPresContext*      aPresContext,
                      nsHTMLReflowMetrics& aDesiredSize,
                      const nsHTMLReflowState& aMaxSize,
                      nsReflowStatus&      aStatus);
 
   NS_IMETHOD BuildDisplayList(nsDisplayListBuilder*   aBuilder,
@@ -123,17 +125,19 @@ protected:
 
   PRInt32     mPageNum;
   PRInt32     mTotNumPages;
 
   nsSharedPageData* mPD;
 };
 
 
-class nsPageBreakFrame : public nsLeafFrame {
+class nsPageBreakFrame : public nsLeafFrame
+{
+  NS_DECL_FRAMEARENA_HELPERS
 
   nsPageBreakFrame(nsStyleContext* aContext);
   ~nsPageBreakFrame();
 
   NS_IMETHOD Reflow(nsPresContext*          aPresContext,
                     nsHTMLReflowMetrics&     aDesiredSize,
                     const nsHTMLReflowState& aReflowState,
                     nsReflowStatus&          aStatus);
--- a/layout/generic/nsPlaceholderFrame.cpp
+++ b/layout/generic/nsPlaceholderFrame.cpp
@@ -51,16 +51,18 @@
 #include "nsDisplayList.h"
 
 nsIFrame*
 NS_NewPlaceholderFrame(nsIPresShell* aPresShell, nsStyleContext* aContext)
 {
   return new (aPresShell) nsPlaceholderFrame(aContext);
 }
 
+NS_IMPL_FRAMEARENA_HELPERS(nsPlaceholderFrame)
+
 nsPlaceholderFrame::~nsPlaceholderFrame()
 {
 }
 
 /* virtual */ nscoord
 nsPlaceholderFrame::GetMinWidth(nsIRenderingContext *aRenderingContext)
 {
   nscoord result = 0;
--- a/layout/generic/nsPlaceholderFrame.h
+++ b/layout/generic/nsPlaceholderFrame.h
@@ -80,16 +80,18 @@
 nsIFrame* NS_NewPlaceholderFrame(nsIPresShell* aPresShell, nsStyleContext* aContext);
 
 /**
  * Implementation of a frame that's used as a placeholder for a frame that
  * has been moved out of the flow
  */
 class nsPlaceholderFrame : public nsSplittableFrame {
 public:
+  NS_DECL_FRAMEARENA_HELPERS
+
   /**
    * Create a new placeholder frame
    */
   friend nsIFrame* NS_NewPlaceholderFrame(nsIPresShell* aPresShell, nsStyleContext* aContext);
   nsPlaceholderFrame(nsStyleContext* aContext) : nsSplittableFrame(aContext) {}
   virtual ~nsPlaceholderFrame();
 
   // Get/Set the associated out of flow frame
--- a/layout/generic/nsQueryFrame.h
+++ b/layout/generic/nsQueryFrame.h
@@ -35,41 +35,51 @@
  *
  * ***** END LICENSE BLOCK ***** */
 
 #ifndef nsQueryFrame_h
 #define nsQueryFrame_h
 
 #include "nscore.h"
 
-#define NS_DECLARE_FRAME_ACCESSOR(classname) \
+#define NS_DECL_QUERYFRAME_TARGET(classname)                    \
   static const nsQueryFrame::FrameIID kFrameIID = nsQueryFrame::classname##_id;
 
-#define NS_DECL_QUERYFRAME \
+#define NS_DECL_QUERYFRAME                                      \
   virtual void* QueryFrame(FrameIID id);
 
-#define NS_QUERYFRAME_HEAD(class) \
-  void* class::QueryFrame(FrameIID id) {
+#define NS_QUERYFRAME_HEAD(class)                               \
+  void* class::QueryFrame(FrameIID id) { switch (id) {
+
+#define NS_QUERYFRAME_ENTRY(class)                              \
+  case class::kFrameIID: return static_cast<class*>(this);
+
+#define NS_QUERYFRAME_ENTRY_CONDITIONAL(class, condition)       \
+  case class::kFrameIID:                                        \
+  if (condition) return static_cast<class*>(this);              \
+  break;
 
-#define NS_QUERYFRAME_ENTRY(class) \
-  if (class::kFrameIID == id) \
-    return static_cast<class*>(this);
+#define NS_QUERYFRAME_TAIL_INHERITING(class)                    \
+  default: break;                                               \
+  }                                                             \
+  return class::QueryFrame(id);                                 \
+}
 
-#define NS_QUERYFRAME_TAIL_INHERITING(class) \
-  return class::QueryFrame(id); }
-
-#define NS_QUERYFRAME_TAIL return nsnull; }
+#define NS_QUERYFRAME_TAIL_INHERITANCE_ROOT                     \
+  default: break;                                               \
+  }                                                             \
+  return nsnull;                                                \
+}
 
 class nsQueryFrame
 {
 public:
   enum FrameIID {
     BRFrame_id,
     CanvasFrame_id,
-    nsAreaFrame_id,
     nsAutoRepeatBoxFrame_id,
     nsBCTableCellFrame_id,
     nsBlockFrame_id,
     nsBox_id,
     nsBoxFrame_id,
     nsBulletFrame_id,
     nsButtonBoxFrame_id,
     nsColumnSetFrame_id,
@@ -144,16 +154,17 @@ public:
     nsListControlFrame_id,
     nsListItemFrame_id,
     nsMathMLContainerFrame_id,
     nsMathMLForeignFrameWrapper_id,
     nsMathMLFrame_id,
     nsMathMLmactionFrame_id,
     nsMathMLmathBlockFrame_id,
     nsMathMLmathInlineFrame_id,
+    nsMathMLmencloseFrame_id,
     nsMathMLmfencedFrame_id,
     nsMathMLmfracFrame_id,
     nsMathMLmmultiscriptsFrame_id,
     nsMathMLmoFrame_id,
     nsMathMLmoverFrame_id,
     nsMathMLmpaddedFrame_id,
     nsMathMLmphantomFrame_id,
     nsMathMLmrootFrame_id,
@@ -233,19 +244,27 @@ public:
     nsTableRowGroupFrame_id,
     nsTextBoxFrame_id,
     nsTextControlFrame_id,
     nsTextFrame_id,
     nsTitleBarFrame_id,
     nsTreeBodyFrame_id,
     nsTreeColFrame_id,
     nsVideoFrame_id,
+    nsXULLabelFrame_id,
     nsXULScrollFrame_id,
     SpacerFrame_id,
-    ViewportFrame_id
+    ViewportFrame_id,
+
+    // The PresArena implementation uses this bit to distinguish
+    // objects allocated by size (that is, non-frames) from objects
+    // allocated by code (that is, frames).  It should not collide
+    // with any frame ID.  It is not 0x80000000 to avoid the question
+    // of whether enumeration constants are signed.
+    NON_FRAME_MARKER = 0x40000000
   };
 
   virtual void* QueryFrame(FrameIID id) = 0;
 };
 
 class do_QueryFrame
 {
 public:
--- a/layout/generic/nsSimplePageSequence.cpp
+++ b/layout/generic/nsSimplePageSequence.cpp
@@ -105,16 +105,18 @@ nsSharedPageData::~nsSharedPageData()
 }
 
 nsIFrame*
 NS_NewSimplePageSequenceFrame(nsIPresShell* aPresShell, nsStyleContext* aContext)
 {
   return new (aPresShell) nsSimplePageSequenceFrame(aContext);
 }
 
+NS_IMPL_FRAMEARENA_HELPERS(nsSimplePageSequenceFrame)
+
 nsSimplePageSequenceFrame::nsSimplePageSequenceFrame(nsStyleContext* aContext) :
   nsContainerFrame(aContext),
   mTotalPages(-1),
   mSelectionHeight(-1),
   mYSelOffset(0)
 {
   nscoord halfInch = PresContext()->TwipsToAppUnits(NS_INCHES_TO_TWIPS(0.5));
   mMargin.SizeTo(halfInch, halfInch, halfInch, halfInch);
--- a/layout/generic/nsSimplePageSequence.h
+++ b/layout/generic/nsSimplePageSequence.h
@@ -80,16 +80,17 @@ public:
 
 // Simple page sequence frame class. Used when we're in paginated mode
 class nsSimplePageSequenceFrame : public nsContainerFrame,
                                   public nsIPageSequenceFrame {
 public:
   friend nsIFrame* NS_NewSimplePageSequenceFrame(nsIPresShell* aPresShell, nsStyleContext* aContext);
 
   NS_DECL_QUERYFRAME
+  NS_DECL_FRAMEARENA_HELPERS
 
   // nsIFrame
   NS_IMETHOD  Reflow(nsPresContext*      aPresContext,
                      nsHTMLReflowMetrics& aDesiredSize,
                      const nsHTMLReflowState& aMaxSize,
                      nsReflowStatus&      aStatus);
 
   NS_IMETHOD  BuildDisplayList(nsDisplayListBuilder*   aBuilder,
--- a/layout/generic/nsSpacerFrame.cpp
+++ b/layout/generic/nsSpacerFrame.cpp
@@ -45,18 +45,21 @@
 #include "nsStyleConsts.h"
 #include "nsINameSpaceManager.h"
 
 // Spacer type's
 #define TYPE_WORD  0            // horizontal space
 #define TYPE_LINE  1            // line-break + vertical space
 #define TYPE_IMAGE 2            // acts like a sized image with nothing to see
 
-class SpacerFrame : public nsFrame {
+class SpacerFrame : public nsFrame
+{
 public:
+  NS_DECL_FRAMEARENA_HELPERS
+
   friend nsIFrame* NS_NewSpacerFrame(nsIPresShell* aPresShell, nsStyleContext* aContext);
 
   // nsIHTMLReflow
   virtual nscoord GetMinWidth(nsIRenderingContext *aRenderingContext);
   virtual nscoord GetPrefWidth(nsIRenderingContext *aRenderingContext);
   NS_IMETHOD Reflow(nsPresContext*          aPresContext,
                     nsHTMLReflowMetrics&     aDesiredSize,
                     const nsHTMLReflowState& aReflowState,
@@ -77,16 +80,18 @@ NS_NewSpacerFrame(nsIPresShell* aPresShe
   const nsStyleDisplay* disp = aContext->GetStyleDisplay();
   NS_ASSERTION(!disp->IsAbsolutelyPositioned() && !disp->IsFloating(),
                "Spacers should not be positioned and should not float");
 #endif
 
   return new (aPresShell) SpacerFrame(aContext);
 }
 
+NS_IMPL_FRAMEARENA_HELPERS(SpacerFrame)
+
 SpacerFrame::~SpacerFrame()
 {
 }
 
 /* virtual */ nscoord
 SpacerFrame::GetMinWidth(nsIRenderingContext *aRenderingContext)
 {
   nsHTMLReflowMetrics metrics;
--- a/layout/generic/nsSplittableFrame.cpp
+++ b/layout/generic/nsSplittableFrame.cpp
@@ -40,16 +40,18 @@
  * columns, or pages
  */
 
 #include "nsSplittableFrame.h"
 #include "nsIContent.h"
 #include "nsPresContext.h"
 #include "nsStyleContext.h"
 
+NS_IMPL_FRAMEARENA_HELPERS(nsSplittableFrame)
+
 NS_IMETHODIMP
 nsSplittableFrame::Init(nsIContent*      aContent,
                         nsIFrame*        aParent,
                         nsIFrame*        aPrevInFlow)
 {
   nsresult rv = nsFrame::Init(aContent, aParent, aPrevInFlow);
 
   if (aPrevInFlow) {
--- a/layout/generic/nsSplittableFrame.h
+++ b/layout/generic/nsSplittableFrame.h
@@ -44,16 +44,18 @@
 #define nsSplittableFrame_h___
 
 #include "nsFrame.h"
 
 // Derived class that allows splitting
 class nsSplittableFrame : public nsFrame
 {
 public:
+  NS_DECL_FRAMEARENA_HELPERS
+
   NS_IMETHOD Init(nsIContent*      aContent,
                   nsIFrame*        aParent,
                   nsIFrame*        aPrevInFlow);
   
   virtual nsSplittableType GetSplittableType() const;
 
   virtual void Destroy();
 
--- a/layout/generic/nsTextFrame.h
+++ b/layout/generic/nsTextFrame.h
@@ -64,16 +64,18 @@ class PropertyProvider;
 #define TEXT_BLINK_ON_OR_PRINTING  0x20000000
 
 // This state bit is set on frames that have some non-collapsed characters after
 // reflow
 #define TEXT_HAS_NONCOLLAPSED_CHARACTERS 0x80000000
 
 class nsTextFrame : public nsFrame {
 public:
+  NS_DECL_FRAMEARENA_HELPERS
+
   friend class nsContinuingTextFrame;
 
   nsTextFrame(nsStyleContext* aContext) : nsFrame(aContext)
   {
     NS_ASSERTION(mContentOffset == 0, "Bogus content offset");
   }
   
   // nsIFrame
--- a/layout/generic/nsTextFrameThebes.cpp
+++ b/layout/generic/nsTextFrameThebes.cpp
@@ -3406,16 +3406,18 @@ nsTextFrame::Destroy()
     mNextContinuation->SetPrevInFlow(nsnull);
   }
   // Let the base class destroy the frame
   nsFrame::Destroy();
 }
 
 class nsContinuingTextFrame : public nsTextFrame {
 public:
+  NS_DECL_FRAMEARENA_HELPERS
+
   friend nsIFrame* NS_NewContinuingTextFrame(nsIPresShell* aPresShell, nsStyleContext* aContext);
 
   NS_IMETHOD Init(nsIContent*      aContent,
                   nsIFrame*        aParent,
                   nsIFrame*        aPrevInFlow);
 
   virtual void Destroy();
 
@@ -3659,22 +3661,26 @@ VerifyNotDirty(state)
 #endif
 
 nsIFrame*
 NS_NewTextFrame(nsIPresShell* aPresShell, nsStyleContext* aContext)
 {
   return new (aPresShell) nsTextFrame(aContext);
 }
 
+NS_IMPL_FRAMEARENA_HELPERS(nsTextFrame)
+
 nsIFrame*
 NS_NewContinuingTextFrame(nsIPresShell* aPresShell, nsStyleContext* aContext)
 {
   return new (aPresShell) nsContinuingTextFrame(aContext);
 }
 
+NS_IMPL_FRAMEARENA_HELPERS(nsContinuingTextFrame)
+
 nsTextFrame::~nsTextFrame()
 {
   if (0 != (mState & TEXT_BLINK_ON_OR_PRINTING) && PresContext()->IsDynamic())
   {
     nsBlinkTimer::RemoveBlinkFrame(this);
   }
 }
 
--- a/layout/generic/nsVideoFrame.cpp
+++ b/layout/generic/nsVideoFrame.cpp
@@ -65,16 +65,18 @@
 #endif
 
 nsIFrame*
 NS_NewHTMLVideoFrame(nsIPresShell* aPresShell, nsStyleContext* aContext)
 {
   return new (aPresShell) nsVideoFrame(aContext);
 }
 
+NS_IMPL_FRAMEARENA_HELPERS(nsVideoFrame)
+
 nsVideoFrame::nsVideoFrame(nsStyleContext* aContext) :
   nsContainerFrame(aContext)
 {
 }
 
 nsVideoFrame::~nsVideoFrame()
 {
 }
--- a/layout/generic/nsVideoFrame.h
+++ b/layout/generic/nsVideoFrame.h
@@ -53,17 +53,18 @@
 nsIFrame* NS_NewVideoFrame (nsIPresShell* aPresShell, nsStyleContext* aContext);
 
 class nsVideoFrame : public nsContainerFrame, public nsIAnonymousContentCreator
 {
 public:
   nsVideoFrame(nsStyleContext* aContext);
 
   NS_DECL_QUERYFRAME
-  
+  NS_DECL_FRAMEARENA_HELPERS
+
   NS_IMETHOD BuildDisplayList(nsDisplayListBuilder*   aBuilder,
                               const nsRect&           aDirtyRect,
                               const nsDisplayListSet& aLists);
 
   NS_IMETHOD AttributeChanged(PRInt32 aNameSpaceID,
                               nsIAtom* aAttribute,
                               PRInt32 aModType);
 
--- a/layout/generic/nsViewportFrame.cpp
+++ b/layout/generic/nsViewportFrame.cpp
@@ -48,16 +48,18 @@
 #include "nsDisplayList.h"
 
 nsIFrame*
 NS_NewViewportFrame(nsIPresShell* aPresShell, nsStyleContext* aContext)
 {
   return new (aPresShell) ViewportFrame(aContext);
 }
 
+NS_IMPL_FRAMEARENA_HELPERS(ViewportFrame)
+
 NS_IMETHODIMP
 ViewportFrame::Init(nsIContent*      aContent,
                     nsIFrame*        aParent,
                     nsIFrame*        aPrevInFlow)
 {
   return Super::Init(aContent, aParent, aPrevInFlow);
 }
 
--- a/layout/generic/nsViewportFrame.h
+++ b/layout/generic/nsViewportFrame.h
@@ -52,16 +52,18 @@
 /**
   * ViewportFrame is the parent of a single child - the doc root frame or a scroll frame 
   * containing the doc root frame. ViewportFrame stores this child in its primary child 
   * list. It stores fixed positioned items in a secondary child list and its mFixedContainer 
   * delegate handles them. 
   */
 class ViewportFrame : public nsContainerFrame {
 public:
+  NS_DECL_FRAMEARENA_HELPERS
+
   typedef nsContainerFrame Super;
 
   ViewportFrame(nsStyleContext* aContext)
     : nsContainerFrame(aContext)
     , mFixedContainer(nsGkAtoms::fixedList)
   {}
   virtual ~ViewportFrame() { } // useful for debugging
 
--- a/layout/mathml/nsIMathMLFrame.h
+++ b/layout/mathml/nsIMathMLFrame.h
@@ -59,17 +59,17 @@ enum eMathMLFrameType {
   eMathMLFrameType_UprightIdentifier,
   eMathMLFrameType_COUNT
 };
 
 // Abstract base class that provides additional methods for MathML frames
 class nsIMathMLFrame
 {
 public:
-  NS_DECLARE_FRAME_ACCESSOR(nsIMathMLFrame)
+  NS_DECL_QUERYFRAME_TARGET(nsIMathMLFrame)
 
  /* SUPPORT FOR PRECISE POSITIONING */
  /*====================================================================*/
  
  /* Metrics that _exactly_ enclose the text of the frame.
   * The frame *must* have *already* being reflowed, before you can call
   * the GetBoundingMetrics() method.
   * Note that for a frame with nested children, the bounding metrics
--- a/layout/mathml/nsMathMLContainerFrame.cpp
+++ b/layout/mathml/nsMathMLContainerFrame.cpp
@@ -64,16 +64,18 @@
 #include "nsDisplayList.h"
 #include "nsCSSFrameConstructor.h"
 #include "nsIReflowCallback.h"
 
 //
 // nsMathMLContainerFrame implementation
 //
 
+NS_IMPL_FRAMEARENA_HELPERS(nsMathMLContainerFrame)
+
 NS_QUERYFRAME_HEAD(nsMathMLContainerFrame)
   NS_QUERYFRAME_ENTRY(nsMathMLFrame)
 NS_QUERYFRAME_TAIL_INHERITING(nsHTMLContainerFrame)
 
 // =============================================================================
 
 // error handlers
 // provide a feedback to the user when a frame with bad markup can not be rendered
@@ -1459,13 +1461,17 @@ NS_NewMathMLmathBlockFrame(nsIPresShell*
 {
   nsMathMLmathBlockFrame* it = new (aPresShell) nsMathMLmathBlockFrame(aContext);
   if (it) {
     it->SetFlags(aFlags);
   }
   return it;
 }
 
+NS_IMPL_FRAMEARENA_HELPERS(nsMathMLmathBlockFrame)
+
 nsIFrame*
 NS_NewMathMLmathInlineFrame(nsIPresShell* aPresShell, nsStyleContext* aContext)
 {
   return new (aPresShell) nsMathMLmathInlineFrame(aContext);
 }
+
+NS_IMPL_FRAMEARENA_HELPERS(nsMathMLmathInlineFrame)
--- a/layout/mathml/nsMathMLContainerFrame.h
+++ b/layout/mathml/nsMathMLContainerFrame.h
@@ -67,16 +67,17 @@
 
 class nsMathMLContainerFrame : public nsHTMLContainerFrame,
                                public nsMathMLFrame {
   friend class nsMathMLmfencedFrame;
 public:
   nsMathMLContainerFrame(nsStyleContext* aContext) : nsHTMLContainerFrame(aContext) {}
 
   NS_DECL_QUERYFRAME
+  NS_DECL_FRAMEARENA_HELPERS
 
   // --------------------------------------------------------------------------
   // Overloaded nsMathMLFrame methods -- see documentation in nsIMathMLFrame.h
 
   NS_IMETHOD
   Stretch(nsIRenderingContext& aRenderingContext,
           nsStretchDirection   aStretchDirection,
           nsBoundingMetrics&   aContainerSize,
@@ -386,16 +387,18 @@ private:
 // simply mapping to nsBlockFrame or nsInlineFrame.
 // A separate implemention needs to provide:
 // 1) line-breaking
 // 2) proper inter-frame spacing
 // 3) firing of Stretch() (in which case FinalizeReflow() would have to be cleaned)
 // Issues: If/when mathml becomes a pluggable component, the separation will be needed.
 class nsMathMLmathBlockFrame : public nsBlockFrame {
 public:
+  NS_DECL_FRAMEARENA_HELPERS
+
   friend nsIFrame* NS_NewMathMLmathBlockFrame(nsIPresShell* aPresShell,
           nsStyleContext* aContext, PRUint32 aFlags);
 
   // beware, mFrames is not set by nsBlockFrame
   // cannot use mFrames{.FirstChild()|.etc} since the block code doesn't set mFrames
   NS_IMETHOD
   SetInitialChildList(nsIAtom*        aListName,
                       nsFrameList&    aChildList)
@@ -457,16 +460,18 @@ protected:
   }
   virtual ~nsMathMLmathBlockFrame() {}
 };
 
 // --------------
 
 class nsMathMLmathInlineFrame : public nsInlineFrame {
 public:
+  NS_DECL_FRAMEARENA_HELPERS
+
   friend nsIFrame* NS_NewMathMLmathInlineFrame(nsIPresShell* aPresShell, nsStyleContext* aContext);
 
   NS_IMETHOD
   SetInitialChildList(nsIAtom*        aListName,
                       nsFrameList&    aChildList)
   {
     NS_ASSERTION(!aListName, "unexpected frame list");
     nsresult rv = nsInlineFrame::SetInitialChildList(aListName, aChildList);
--- a/layout/mathml/nsMathMLForeignFrameWrapper.cpp
+++ b/layout/mathml/nsMathMLForeignFrameWrapper.cpp
@@ -59,16 +59,18 @@ NS_QUERYFRAME_HEAD(nsMathMLForeignFrameW
 NS_QUERYFRAME_TAIL_INHERITING(nsBlockFrame)
 
 nsIFrame*
 NS_NewMathMLForeignFrameWrapper(nsIPresShell* aPresShell, nsStyleContext* aContext)
 {
   return new (aPresShell) nsMathMLForeignFrameWrapper(aContext);
 }
 
+NS_IMPL_FRAMEARENA_HELPERS(nsMathMLForeignFrameWrapper)
+
 NS_IMETHODIMP
 nsMathMLForeignFrameWrapper::Reflow(nsPresContext*          aPresContext,
                                     nsHTMLReflowMetrics&     aDesiredSize,
                                     const nsHTMLReflowState& aReflowState,
                                     nsReflowStatus&          aStatus)
 {
   // Let the base class do the reflow
   nsresult rv = nsBlockFrame::Reflow(aPresContext, aDesiredSize, aReflowState, aStatus);
--- a/layout/mathml/nsMathMLForeignFrameWrapper.h
+++ b/layout/mathml/nsMathMLForeignFrameWrapper.h
@@ -48,16 +48,17 @@
 #include "nsMathMLContainerFrame.h"
 
 class nsMathMLForeignFrameWrapper : public nsBlockFrame,
                                     public nsMathMLFrame {
 public:
   friend nsIFrame* NS_NewMathMLForeignFrameWrapper(nsIPresShell* aPresShell, nsStyleContext* aContext);
 
   NS_DECL_QUERYFRAME
+  NS_DECL_FRAMEARENA_HELPERS
 
   // Overloaded nsIMathMLFrame methods
 
   NS_IMETHOD
   UpdatePresentationDataFromChildAt(PRInt32         aFirstIndex,
                                     PRInt32         aLastIndex,
                                     PRUint32        aFlagsValues,
                                     PRUint32        aFlagsToUpdate)
--- a/layout/mathml/nsMathMLTokenFrame.cpp
+++ b/layout/mathml/nsMathMLTokenFrame.cpp
@@ -48,16 +48,19 @@
 #include "nsCSSFrameConstructor.h"
 #include "nsMathMLTokenFrame.h"
 
 nsIFrame*
 NS_NewMathMLTokenFrame(nsIPresShell* aPresShell, nsStyleContext* aContext)
 {
   return new (aPresShell) nsMathMLTokenFrame(aContext);
 }
+
+NS_IMPL_FRAMEARENA_HELPERS(nsMathMLTokenFrame)
+
 nsMathMLTokenFrame::~nsMathMLTokenFrame()
 {
 }
 
 eMathMLFrameType
 nsMathMLTokenFrame::GetMathMLFrameType()
 {
   // treat everything other than <mi> as ordinary...
--- a/layout/mathml/nsMathMLTokenFrame.h
+++ b/layout/mathml/nsMathMLTokenFrame.h
@@ -43,16 +43,18 @@
 #include "nsMathMLContainerFrame.h"
 
 //
 // Base class to handle token elements
 //
 
 class nsMathMLTokenFrame : public nsMathMLContainerFrame {
 public:
+  NS_DECL_FRAMEARENA_HELPERS
+
   friend nsIFrame* NS_NewMathMLTokenFrame(nsIPresShell* aPresShell, nsStyleContext* aContext);
 
   virtual eMathMLFrameType GetMathMLFrameType();
 
   NS_IMETHOD
   Init(nsIContent*      aContent,
        nsIFrame*        aParent,
        nsIFrame*        aPrevInFlow);
--- a/layout/mathml/nsMathMLmactionFrame.cpp
+++ b/layout/mathml/nsMathMLmactionFrame.cpp
@@ -91,16 +91,18 @@ NS_IMPL_QUERY_INTERFACE2(nsMathMLmaction
                          nsIDOMEventListener)
 
 nsIFrame*
 NS_NewMathMLmactionFrame(nsIPresShell* aPresShell, nsStyleContext* aContext)
 {
   return new (aPresShell) nsMathMLmactionFrame(aContext);
 }
 
+NS_IMPL_FRAMEARENA_HELPERS(nsMathMLmactionFrame)
+
 nsMathMLmactionFrame::~nsMathMLmactionFrame()
 {
   // unregister us as a mouse event listener ...
   //  printf("maction:%p unregistering as mouse event listener ...\n", this);
   mContent->RemoveEventListenerByIID(this, NS_GET_IID(nsIDOMMouseListener));
 }
 
 NS_IMETHODIMP
--- a/layout/mathml/nsMathMLmactionFrame.h
+++ b/layout/mathml/nsMathMLmactionFrame.h
@@ -52,16 +52,18 @@
 #define MOUSE(_msg) printf("maction:%p MOUSE: "#_msg" ...\n", this);
 #else
 #define MOUSE(_msg)
 #endif
 
 class nsMathMLmactionFrame : public nsMathMLContainerFrame,
                              public nsIDOMMouseListener {
 public:
+  NS_DECL_FRAMEARENA_HELPERS
+
   friend nsIFrame* NS_NewMathMLmactionFrame(nsIPresShell* aPresShell, nsStyleContext* aContext);
 
   NS_DECL_ISUPPORTS_INHERITED
 
   NS_IMETHOD
   Init(nsIContent*      aContent,
        nsIFrame*        aParent,
        nsIFrame*        aPrevInFlow);
--- a/layout/mathml/nsMathMLmencloseFrame.cpp
+++ b/layout/mathml/nsMathMLmencloseFrame.cpp
@@ -68,16 +68,18 @@ static const PRUnichar kLongDivChar = ')
 static const PRUnichar kRadicalChar = 0x221A;
 
 nsIFrame*
 NS_NewMathMLmencloseFrame(nsIPresShell* aPresShell, nsStyleContext* aContext)
 {
   return new (aPresShell) nsMathMLmencloseFrame(aContext);
 }
 
+NS_IMPL_FRAMEARENA_HELPERS(nsMathMLmencloseFrame)
+
 nsMathMLmencloseFrame::nsMathMLmencloseFrame(nsStyleContext* aContext) :
   nsMathMLContainerFrame(aContext), mNotationsToDraw(0),
   mLongDivCharIndex(-1), mRadicalCharIndex(-1), mContentWidth(0)
 {
 }
 
 nsMathMLmencloseFrame::~nsMathMLmencloseFrame()
 {
--- a/layout/mathml/nsMathMLmencloseFrame.h
+++ b/layout/mathml/nsMathMLmencloseFrame.h
@@ -75,16 +75,18 @@ enum nsMencloseNotation
     NOTATION_DOWNDIAGONALSTRIKE = 0x200,
     NOTATION_VERTICALSTRIKE = 0x400,
     NOTATION_HORIZONTALSTRIKE = 0x800
     // NOTATION_MADRUWB = 0x1000
   };
 
 class nsMathMLmencloseFrame : public nsMathMLContainerFrame {
 public:
+  NS_DECL_FRAMEARENA_HELPERS
+
   friend nsIFrame* NS_NewMathMLmencloseFrame(nsIPresShell*   aPresShell,
                                              nsStyleContext* aContext);
   
   virtual nsresult
   Place(nsIRenderingContext& aRenderingContext,
         PRBool               aPlaceOrigin,
         nsHTMLReflowMetrics& aDesiredSize);
   
--- a/layout/mathml/nsMathMLmfencedFrame.cpp
+++ b/layout/mathml/nsMathMLmfencedFrame.cpp
@@ -54,16 +54,18 @@
 //
 
 nsIFrame*
 NS_NewMathMLmfencedFrame(nsIPresShell* aPresShell, nsStyleContext* aContext)
 {
   return new (aPresShell) nsMathMLmfencedFrame(aContext);
 }
 
+NS_IMPL_FRAMEARENA_HELPERS(nsMathMLmfencedFrame)
+
 nsMathMLmfencedFrame::~nsMathMLmfencedFrame()
 {
   RemoveFencesAndSeparators();
 }
 
 NS_IMETHODIMP
 nsMathMLmfencedFrame::InheritAutomaticData(nsIFrame* aParent)
 {
--- a/layout/mathml/nsMathMLmfencedFrame.h
+++ b/layout/mathml/nsMathMLmfencedFrame.h
@@ -44,16 +44,18 @@
 #include "nsMathMLContainerFrame.h"
 
 //
 // <mfenced> -- surround content with a pair of fences
 //
 
 class nsMathMLmfencedFrame : public nsMathMLContainerFrame {
 public:
+  NS_DECL_FRAMEARENA_HELPERS
+
   friend nsIFrame* NS_NewMathMLmfencedFrame(nsIPresShell* aPresShell, nsStyleContext* aContext);
 
   virtual void
   SetAdditionalStyleContext(PRInt32          aIndex, 
                             nsStyleContext*  aStyleContext);
   virtual nsStyleContext*
   GetAdditionalStyleContext(PRInt32 aIndex) const;
 
--- a/layout/mathml/nsMathMLmfracFrame.cpp
+++ b/layout/mathml/nsMathMLmfracFrame.cpp
@@ -71,16 +71,18 @@
 static const PRUnichar kSlashChar = PRUnichar('/');
 
 nsIFrame*
 NS_NewMathMLmfracFrame(nsIPresShell* aPresShell, nsStyleContext* aContext)
 {
   return new (aPresShell) nsMathMLmfracFrame(aContext);
 }
 
+NS_IMPL_FRAMEARENA_HELPERS(nsMathMLmfracFrame)
+
 nsMathMLmfracFrame::~nsMathMLmfracFrame()
 {
   if (mSlashChar) {
     delete mSlashChar;
     mSlashChar = nsnull;
   }
 }
 
--- a/layout/mathml/nsMathMLmfracFrame.h
+++ b/layout/mathml/nsMathMLmfracFrame.h
@@ -81,16 +81,18 @@ The <mfrac> element sets displaystyle to
 false increments scriptlevel by 1, within numerator and denominator.
 These attributes are inherited by every element from its rendering 
 environment, but can be set explicitly only on the <mstyle> 
 element. 
 */
 
 class nsMathMLmfracFrame : public nsMathMLContainerFrame {
 public:
+  NS_DECL_FRAMEARENA_HELPERS
+
   friend nsIFrame* NS_NewMathMLmfracFrame(nsIPresShell* aPresShell, nsStyleContext* aContext);
 
   virtual void
   SetAdditionalStyleContext(PRInt32          aIndex, 
                             nsStyleContext*  aStyleContext);
   virtual nsStyleContext*
   GetAdditionalStyleContext(PRInt32 aIndex) const;
 
--- a/layout/mathml/nsMathMLmmultiscriptsFrame.cpp
+++ b/layout/mathml/nsMathMLmmultiscriptsFrame.cpp
@@ -54,16 +54,18 @@
 //
 
 nsIFrame*
 NS_NewMathMLmmultiscriptsFrame(nsIPresShell* aPresShell, nsStyleContext* aContext)
 {
   return new (aPresShell) nsMathMLmmultiscriptsFrame(aContext);
 }
 
+NS_IMPL_FRAMEARENA_HELPERS(nsMathMLmmultiscriptsFrame)
+
 nsMathMLmmultiscriptsFrame::~nsMathMLmmultiscriptsFrame()
 {
 }
 
 NS_IMETHODIMP
 nsMathMLmmultiscriptsFrame::TransmitAutomaticData()
 {
   // if our base is an embellished operator, let its state bubble to us
--- a/layout/mathml/nsMathMLmmultiscriptsFrame.h
+++ b/layout/mathml/nsMathMLmmultiscriptsFrame.h
@@ -45,16 +45,18 @@
 #include "nsMathMLContainerFrame.h"
 
 //
 // <mmultiscripts> -- attach prescripts and tensor indices to a base 
 //
 
 class nsMathMLmmultiscriptsFrame : public nsMathMLContainerFrame {
 public:
+  NS_DECL_FRAMEARENA_HELPERS
+
   friend nsIFrame* NS_NewMathMLmmultiscriptsFrame(nsIPresShell* aPresShell, nsStyleContext* aContext);
 
   NS_IMETHOD
   TransmitAutomaticData();
 
   virtual nsresult
   Place(nsIRenderingContext& aRenderingContext,
         PRBool               aPlaceOrigin,
--- a/layout/mathml/nsMathMLmoFrame.cpp
+++ b/layout/mathml/nsMathMLmoFrame.cpp
@@ -60,16 +60,18 @@
 #define NS_MATHML_CHAR_STYLE_CONTEXT_INDEX   0
 
 nsIFrame*
 NS_NewMathMLmoFrame(nsIPresShell* aPresShell, nsStyleContext *aContext)
 {
   return new (aPresShell) nsMathMLmoFrame(aContext);
 }
 
+NS_IMPL_FRAMEARENA_HELPERS(nsMathMLmoFrame)
+
 nsMathMLmoFrame::~nsMathMLmoFrame()
 {
 }
 
 static const PRUnichar kInvisibleComma = PRUnichar(0x200B); // a.k.a. ZERO WIDTH SPACE
 static const PRUnichar kApplyFunction  = PRUnichar(0x2061);
 static const PRUnichar kInvisibleTimes = PRUnichar(0x2062);
 static const PRUnichar kNullCh         = PRUnichar('\0');
--- a/layout/mathml/nsMathMLmoFrame.h
+++ b/layout/mathml/nsMathMLmoFrame.h
@@ -45,16 +45,18 @@
 #include "nsMathMLTokenFrame.h"
 
 //
 // <mo> -- operator, fence, or separator
 //
 
 class nsMathMLmoFrame : public nsMathMLTokenFrame {
 public:
+  NS_DECL_FRAMEARENA_HELPERS
+
   friend nsIFrame* NS_NewMathMLmoFrame(nsIPresShell* aPresShell, nsStyleContext* aContext);
 
   virtual eMathMLFrameType GetMathMLFrameType();
 
   virtual void
   SetAdditionalStyleContext(PRInt32          aIndex, 
                             nsStyleContext*  aStyleContext);
   virtual nsStyleContext*
--- a/layout/mathml/nsMathMLmoverFrame.cpp
+++ b/layout/mathml/nsMathMLmoverFrame.cpp
@@ -57,16 +57,18 @@
 //
 
 nsIFrame*
 NS_NewMathMLmoverFrame(nsIPresShell* aPresShell, nsStyleContext* aContext)
 {
   return new (aPresShell) nsMathMLmoverFrame(aContext);
 }
 
+NS_IMPL_FRAMEARENA_HELPERS(nsMathMLmoverFrame)
+
 nsMathMLmoverFrame::~nsMathMLmoverFrame()
 {
 }
 
 NS_IMETHODIMP
 nsMathMLmoverFrame::AttributeChanged(PRInt32         aNameSpaceID,
                                      nsIAtom*        aAttribute,
                                      PRInt32         aModType)
--- a/layout/mathml/nsMathMLmoverFrame.h
+++ b/layout/mathml/nsMathMLmoverFrame.h
@@ -45,16 +45,18 @@
 #include "nsMathMLContainerFrame.h"
 
 //
 // <mover> -- attach an overscript to a base
 //
 
 class nsMathMLmoverFrame : public nsMathMLContainerFrame {
 public:
+  NS_DECL_FRAMEARENA_HELPERS
+
   friend nsIFrame* NS_NewMathMLmoverFrame(nsIPresShell* aPresShell, nsStyleContext* aContext);
 
   virtual nsresult
   Place(nsIRenderingContext& aRenderingContext,
         PRBool               aPlaceOrigin,
         nsHTMLReflowMetrics& aDesiredSize);
 
   NS_IMETHOD
--- a/layout/mathml/nsMathMLmpaddedFrame.cpp
+++ b/layout/mathml/nsMathMLmpaddedFrame.cpp
@@ -68,16 +68,18 @@
 #define NS_MATHML_PSEUDO_UNIT_NAMEDSPACE  6
 
 nsIFrame*
 NS_NewMathMLmpaddedFrame(nsIPresShell* aPresShell, nsStyleContext* aContext)
 {
   return new (aPresShell) nsMathMLmpaddedFrame(aContext);
 }
 
+NS_IMPL_FRAMEARENA_HELPERS(nsMathMLmpaddedFrame)
+
 nsMathMLmpaddedFrame::~nsMathMLmpaddedFrame()
 {
 }
 
 NS_IMETHODIMP
 nsMathMLmpaddedFrame::InheritAutomaticData(nsIFrame* aParent) 
 {
   // let the base class get the default from our parent
--- a/layout/mathml/nsMathMLmpaddedFrame.h
+++ b/layout/mathml/nsMathMLmpaddedFrame.h
@@ -45,16 +45,18 @@
 #include "nsMathMLContainerFrame.h"
 
 //
 // <mpadded> -- adjust space around content  
 //
 
 class nsMathMLmpaddedFrame : public nsMathMLContainerFrame {
 public:
+  NS_DECL_FRAMEARENA_HELPERS
+
   friend nsIFrame* NS_NewMathMLmpaddedFrame(nsIPresShell* aPresShell, nsStyleContext* aContext);
 
   NS_IMETHOD
   InheritAutomaticData(nsIFrame* aParent);
 
   NS_IMETHOD
   Reflow(nsPresContext*          aPresContext,
          nsHTMLReflowMetrics&     aDesiredSize,
--- a/layout/mathml/nsMathMLmphantomFrame.cpp
+++ b/layout/mathml/nsMathMLmphantomFrame.cpp
@@ -52,16 +52,18 @@
 //
 
 nsIFrame*
 NS_NewMathMLmphantomFrame(nsIPresShell* aPresShell, nsStyleContext* aContext)
 {
   return new (aPresShell) nsMathMLmphantomFrame(aContext);
 }
 
+NS_IMPL_FRAMEARENA_HELPERS(nsMathMLmphantomFrame)
+
 nsMathMLmphantomFrame::~nsMathMLmphantomFrame()
 {
 }
 
 NS_IMETHODIMP
 nsMathMLmphantomFrame::InheritAutomaticData(nsIFrame* aParent)
 {
   // let the base class get the default from our parent
--- a/layout/mathml/nsMathMLmphantomFrame.h
+++ b/layout/mathml/nsMathMLmphantomFrame.h
@@ -44,16 +44,18 @@
 #include "nsMathMLContainerFrame.h"
 
 //
 // <mphantom> -- make content invisible but preserve its size
 //
 
 class nsMathMLmphantomFrame : public nsMathMLContainerFrame {
 public:
+  NS_DECL_FRAMEARENA_HELPERS
+
   friend nsIFrame* NS_NewMathMLmphantomFrame(nsIPresShell* aPresShell, nsStyleContext* aContext);
 
   NS_IMETHOD
   InheritAutomaticData(nsIFrame* aParent);
 
   NS_IMETHOD BuildDisplayList(nsDisplayListBuilder*   aBuilder,
                               const nsRect&           aDirtyRect,
                               const nsDisplayListSet& aLists) { return NS_OK; }
--- a/layout/mathml/nsMathMLmrootFrame.cpp
+++ b/layout/mathml/nsMathMLmrootFrame.cpp
@@ -69,16 +69,18 @@
 static const PRUnichar kSqrChar = PRUnichar(0x221A);
 
 nsIFrame*
 NS_NewMathMLmrootFrame(nsIPresShell* aPresShell, nsStyleContext* aContext)
 {
   return new (aPresShell) nsMathMLmrootFrame(aContext);
 }
 
+NS_IMPL_FRAMEARENA_HELPERS(nsMathMLmrootFrame)
+
 nsMathMLmrootFrame::nsMathMLmrootFrame(nsStyleContext* aContext) :
   nsMathMLContainerFrame(aContext),
   mSqrChar(),
   mBarRect()
 {
 }
 
 nsMathMLmrootFrame::~nsMathMLmrootFrame()
--- a/layout/mathml/nsMathMLmrootFrame.h
+++ b/layout/mathml/nsMathMLmrootFrame.h
@@ -45,16 +45,18 @@
 #include "nsMathMLContainerFrame.h"
 
 //
 // <msqrt> and <mroot> -- form a radical
 //
 
 class nsMathMLmrootFrame : public nsMathMLContainerFrame {
 public:
+  NS_DECL_FRAMEARENA_HELPERS
+
   friend nsIFrame* NS_NewMathMLmrootFrame(nsIPresShell* aPresShell, nsStyleContext* aContext);
 
   virtual void
   SetAdditionalStyleContext(PRInt32          aIndex, 
                             nsStyleContext*  aStyleContext);
   virtual nsStyleContext*
   GetAdditionalStyleContext(PRInt32 aIndex) const;
 
--- a/layout/mathml/nsMathMLmrowFrame.cpp
+++ b/layout/mathml/nsMathMLmrowFrame.cpp
@@ -53,16 +53,18 @@
 //
 
 nsIFrame*
 NS_NewMathMLmrowFrame(nsIPresShell* aPresShell, nsStyleContext* aContext)
 {
   return new (aPresShell) nsMathMLmrowFrame(aContext);
 }
 
+NS_IMPL_FRAMEARENA_HELPERS(nsMathMLmrowFrame)
+
 nsMathMLmrowFrame::~nsMathMLmrowFrame()
 {
 }
 
 NS_IMETHODIMP
 nsMathMLmrowFrame::InheritAutomaticData(nsIFrame* aParent)
 {
   // let the base class get the default from our parent
--- a/layout/mathml/nsMathMLmrowFrame.h
+++ b/layout/mathml/nsMathMLmrowFrame.h
@@ -44,16 +44,18 @@
 #include "nsMathMLContainerFrame.h"
 
 //
 // <mrow> -- horizontally group any number of subexpressions 
 //
 
 class nsMathMLmrowFrame : public nsMathMLContainerFrame {
 public:
+  NS_DECL_FRAMEARENA_HELPERS
+
   friend nsIFrame* NS_NewMathMLmrowFrame(nsIPresShell* aPresShell, nsStyleContext* aContext);
 
   NS_IMETHOD
   AttributeChanged(PRInt32  aNameSpaceID,
                    nsIAtom* aAttribute,
                    PRInt32  aModType);
 
   NS_IMETHOD
--- a/layout/mathml/nsMathMLmspaceFrame.cpp
+++ b/layout/mathml/nsMathMLmspaceFrame.cpp
@@ -53,16 +53,18 @@
 //
 
 nsIFrame*
 NS_NewMathMLmspaceFrame(nsIPresShell* aPresShell, nsStyleContext* aContext)
 {
   return new (aPresShell) nsMathMLmspaceFrame(aContext);
 }
 
+NS_IMPL_FRAMEARENA_HELPERS(nsMathMLmspaceFrame)
+
 nsMathMLmspaceFrame::~nsMathMLmspaceFrame()
 {
 }
 
 PRBool
 nsMathMLmspaceFrame::IsLeaf() const
 {
   return PR_TRUE;
--- a/layout/mathml/nsMathMLmspaceFrame.h
+++ b/layout/mathml/nsMathMLmspaceFrame.h
@@ -43,16 +43,18 @@
 #include "nsMathMLContainerFrame.h"
 
 //
 // <mspace> -- space
 //
 
 class nsMathMLmspaceFrame : public nsMathMLContainerFrame {
 public:
+  NS_DECL_FRAMEARENA_HELPERS
+
   friend nsIFrame* NS_NewMathMLmspaceFrame(nsIPresShell* aPresShell, nsStyleContext* aContext);
 
   virtual PRBool IsLeaf() const;
 
   NS_IMETHOD
   Reflow(nsPresContext*          aPresContext,
          nsHTMLReflowMetrics&     aDesiredSize,
          const nsHTMLReflowState& aReflowState,
--- a/layout/mathml/nsMathMLmsqrtFrame.cpp
+++ b/layout/mathml/nsMathMLmsqrtFrame.cpp
@@ -56,16 +56,18 @@
 //  deal. We are not responsible for cases of misconfigurations out there.
 
 nsIFrame*
 NS_NewMathMLmsqrtFrame(nsIPresShell* aPresShell, nsStyleContext* aContext)
 {
   return new (aPresShell) nsMathMLmsqrtFrame(aContext);
 }
 
+NS_IMPL_FRAMEARENA_HELPERS(nsMathMLmsqrtFrame)
+
 nsMathMLmsqrtFrame::nsMathMLmsqrtFrame(nsStyleContext* aContext) :
   nsMathMLmencloseFrame(aContext)
 {
 }
 
 nsMathMLmsqrtFrame::~nsMathMLmsqrtFrame()
 {
 }
--- a/layout/mathml/nsMathMLmsqrtFrame.h
+++ b/layout/mathml/nsMathMLmsqrtFrame.h
@@ -64,16 +64,18 @@ The <mroot> element increments scriptlev
 "false", within index, but leaves both attributes unchanged within base. The
 <msqrt> element leaves both attributes unchanged within all its arguments.
 These attributes are inherited by every element from its rendering environment,
 but can be set explicitly only on <mstyle>. (See Section 3.3.4.) 
 */
 
 class nsMathMLmsqrtFrame : public nsMathMLmencloseFrame {
 public:
+  NS_DECL_FRAMEARENA_HELPERS
+
   friend nsIFrame* NS_NewMathMLmsqrtFrame(nsIPresShell*   aPresShell,
                                           nsStyleContext* aContext);
 
   NS_IMETHOD
   Init(nsIContent* aContent,
        nsIFrame*   aParent,
        nsIFrame*   aPrevInFlow);
 
--- a/layout/mathml/nsMathMLmstyleFrame.cpp
+++ b/layout/mathml/nsMathMLmstyleFrame.cpp
@@ -54,16 +54,18 @@
 //
 
 nsIFrame*
 NS_NewMathMLmstyleFrame(nsIPresShell* aPresShell, nsStyleContext* aContext)
 {
   return new (aPresShell) nsMathMLmstyleFrame(aContext);
 }
 
+NS_IMPL_FRAMEARENA_HELPERS(nsMathMLmstyleFrame)
+
 nsMathMLmstyleFrame::~nsMathMLmstyleFrame()
 {
 }
 
 // mstyle needs special care for its scriptlevel and displaystyle attributes
 NS_IMETHODIMP
 nsMathMLmstyleFrame::InheritAutomaticData(nsIFrame* aParent) 
 {
--- a/layout/mathml/nsMathMLmstyleFrame.h
+++ b/layout/mathml/nsMathMLmstyleFrame.h
@@ -44,16 +44,18 @@
 #include "nsMathMLContainerFrame.h"
 
 //
 // <mstyle> -- style change
 //
 
 class nsMathMLmstyleFrame : public nsMathMLContainerFrame {
 public:
+  NS_DECL_FRAMEARENA_HELPERS
+
   friend nsIFrame* NS_NewMathMLmstyleFrame(nsIPresShell* aPresShell, nsStyleContext* aContext);
 
   NS_IMETHOD
   AttributeChanged(PRInt32         aNameSpaceID,
                    nsIAtom*        aAttribute,
                    PRInt32         aModType);
 
   NS_IMETHOD
--- a/layout/mathml/nsMathMLmsubFrame.cpp
+++ b/layout/mathml/nsMathMLmsubFrame.cpp
@@ -54,16 +54,18 @@
 //
 
 nsIFrame*
 NS_NewMathMLmsubFrame(nsIPresShell* aPresShell, nsStyleContext* aContext)
 {
   return new (aPresShell) nsMathMLmsubFrame(aContext);
 }
 
+NS_IMPL_FRAMEARENA_HELPERS(nsMathMLmsubFrame)
+
 nsMathMLmsubFrame::~nsMathMLmsubFrame()
 {
 }
 
 NS_IMETHODIMP
 nsMathMLmsubFrame::TransmitAutomaticData()
 {
   // if our base is an embellished operator, let its state bubble to us
--- a/layout/mathml/nsMathMLmsubFrame.h
+++ b/layout/mathml/nsMathMLmsubFrame.h
@@ -45,16 +45,18 @@
 #include "nsMathMLContainerFrame.h"
 
 //
 // <msub> -- attach a subscript to a base
 //
 
 class nsMathMLmsubFrame : public nsMathMLContainerFrame {
 public:
+  NS_DECL_FRAMEARENA_HELPERS
+
   friend nsIFrame* NS_NewMathMLmsubFrame(nsIPresShell* aPresShell, nsStyleContext* aContext);
 
   NS_IMETHOD
   TransmitAutomaticData();
 
   virtual nsresult
   Place(nsIRenderingContext& aRenderingContext,
         PRBool               aPlaceOrigin,
--- a/layout/mathml/nsMathMLmsubsupFrame.cpp
+++ b/layout/mathml/nsMathMLmsubsupFrame.cpp
@@ -54,16 +54,18 @@
 //
 
 nsIFrame*
 NS_NewMathMLmsubsupFrame(nsIPresShell* aPresShell, nsStyleContext* aContext)
 {
   return new (aPresShell) nsMathMLmsubsupFrame(aContext);
 }
 
+NS_IMPL_FRAMEARENA_HELPERS(nsMathMLmsubsupFrame)
+
 nsMathMLmsubsupFrame::~nsMathMLmsubsupFrame()
 {
 }
 
 NS_IMETHODIMP
 nsMathMLmsubsupFrame::TransmitAutomaticData()
 {
   // if our base is an embellished operator, let its state bubble to us
--- a/layout/mathml/nsMathMLmsubsupFrame.h
+++ b/layout/mathml/nsMathMLmsubsupFrame.h
@@ -45,16 +45,18 @@
 #include "nsMathMLContainerFrame.h"
 
 //
 // <msubsup> -- attach a subscript-superscript pair to a base
 //
 
 class nsMathMLmsubsupFrame : public nsMathMLContainerFrame {
 public:
+  NS_DECL_FRAMEARENA_HELPERS
+
   friend nsIFrame* NS_NewMathMLmsubsupFrame(nsIPresShell* aPresShell, nsStyleContext* aContext);
 
   NS_IMETHOD
   TransmitAutomaticData();
 
   virtual nsresult
   Place(nsIRenderingContext& aRenderingContext,
         PRBool               aPlaceOrigin,
--- a/layout/mathml/nsMathMLmsupFrame.cpp
+++ b/layout/mathml/nsMathMLmsupFrame.cpp
@@ -53,16 +53,18 @@
 //
 
 nsIFrame*
 NS_NewMathMLmsupFrame(nsIPresShell* aPresShell, nsStyleContext* aContext)
 {
   return new (aPresShell) nsMathMLmsupFrame(aContext);
 }
 
+NS_IMPL_FRAMEARENA_HELPERS(nsMathMLmsupFrame)
+
 nsMathMLmsupFrame::~nsMathMLmsupFrame()
 {
 }
 
 NS_IMETHODIMP
 nsMathMLmsupFrame::TransmitAutomaticData()
 {
   // if our base is an embellished operator, its flags bubble to us
--- a/layout/mathml/nsMathMLmsupFrame.h
+++ b/layout/mathml/nsMathMLmsupFrame.h
@@ -45,16 +45,18 @@
 #include "nsMathMLContainerFrame.h"
 
 //
 // <msup> -- attach a superscript to a base
 //
 
 class nsMathMLmsupFrame : public nsMathMLContainerFrame {
 public:
+  NS_DECL_FRAMEARENA_HELPERS
+
   friend nsIFrame* NS_NewMathMLmsupFrame(nsIPresShell* aPresShell, nsStyleContext* aContext);
 
   NS_IMETHOD
   TransmitAutomaticData();
 
   virtual nsresult
   Place(nsIRenderingContext& aRenderingContext,
         PRBool               aPlaceOrigin,
--- a/layout/mathml/nsMathMLmtableFrame.cpp
+++ b/layout/mathml/nsMathMLmtableFrame.cpp
@@ -354,16 +354,18 @@ NS_QUERYFRAME_HEAD(nsMathMLmtableOuterFr
 NS_QUERYFRAME_TAIL_INHERITING(nsTableOuterFrame)
 
 nsIFrame*
 NS_NewMathMLmtableOuterFrame (nsIPresShell* aPresShell, nsStyleContext* aContext)
 {
   return new (aPresShell) nsMathMLmtableOuterFrame(aContext);
 }
 
+NS_IMPL_FRAMEARENA_HELPERS(nsMathMLmtableOuterFrame)
+
 nsMathMLmtableOuterFrame::~nsMathMLmtableOuterFrame()
 {
 }
 
 NS_IMETHODIMP
 nsMathMLmtableOuterFrame::InheritAutomaticData(nsIFrame* aParent)
 {
   // XXX the REC says that by default, displaystyle=false in <mtable>
@@ -648,16 +650,18 @@ nsMathMLmtableOuterFrame::Reflow(nsPresC
 }
 
 nsIFrame*
 NS_NewMathMLmtableFrame(nsIPresShell* aPresShell, nsStyleContext* aContext)
 {
   return new (aPresShell) nsMathMLmtableFrame(aContext);
 }
 
+NS_IMPL_FRAMEARENA_HELPERS(nsMathMLmtableFrame)
+
 nsMathMLmtableFrame::~nsMathMLmtableFrame()
 {
 }
 
 NS_IMETHODIMP
 nsMathMLmtableFrame::SetInitialChildList(nsIAtom*  aListName,
                                          nsFrameList& aChildList)
 {
@@ -682,16 +686,18 @@ nsMathMLmtableFrame::RestyleTable()
 // implementation of nsMathMLmtrFrame
 
 nsIFrame*
 NS_NewMathMLmtrFrame(nsIPresShell* aPresShell, nsStyleContext* aContext)
 {
   return new (aPresShell) nsMathMLmtrFrame(aContext);
 }
 
+NS_IMPL_FRAMEARENA_HELPERS(nsMathMLmtrFrame)
+
 nsMathMLmtrFrame::~nsMathMLmtrFrame()
 {
 }
 
 NS_IMETHODIMP
 nsMathMLmtrFrame::AttributeChanged(PRInt32  aNameSpaceID,
                                    nsIAtom* aAttribute,
                                    PRInt32  aModType)
@@ -739,16 +745,18 @@ nsMathMLmtrFrame::AttributeChanged(PRInt
 // implementation of nsMathMLmtdFrame
 
 nsIFrame*
 NS_NewMathMLmtdFrame(nsIPresShell* aPresShell, nsStyleContext* aContext)
 {
   return new (aPresShell) nsMathMLmtdFrame(aContext);
 }
 
+NS_IMPL_FRAMEARENA_HELPERS(nsMathMLmtdFrame)
+
 nsMathMLmtdFrame::~nsMathMLmtdFrame()
 {
 }
 
 PRInt32
 nsMathMLmtdFrame::GetRowSpan()
 {
   PRInt32 rowspan = 1;
@@ -825,16 +833,18 @@ NS_QUERYFRAME_HEAD(nsMathMLmtdInnerFrame
 NS_QUERYFRAME_TAIL_INHERITING(nsBlockFrame)
 
 nsIFrame*
 NS_NewMathMLmtdInnerFrame(nsIPresShell* aPresShell, nsStyleContext* aContext)
 {
   return new (aPresShell) nsMathMLmtdInnerFrame(aContext);
 }
 
+NS_IMPL_FRAMEARENA_HELPERS(nsMathMLmtdInnerFrame)
+
 nsMathMLmtdInnerFrame::~nsMathMLmtdInnerFrame()
 {
 }
 
 NS_IMETHODIMP
 nsMathMLmtdInnerFrame::Reflow(nsPresContext*          aPresContext,
                               nsHTMLReflowMetrics&     aDesiredSize,
                               const nsHTMLReflowState& aReflowState,
--- a/layout/mathml/nsMathMLmtableFrame.h
+++ b/layout/mathml/nsMathMLmtableFrame.h
@@ -48,16 +48,17 @@
 
 class nsMathMLmtableOuterFrame : public nsTableOuterFrame,
                                  public nsMathMLFrame
 {
 public:
   friend nsIFrame* NS_NewMathMLmtableOuterFrame(nsIPresShell* aPresShell, nsStyleContext* aContext);
 
   NS_DECL_QUERYFRAME
+  NS_DECL_FRAMEARENA_HELPERS
 
   // Overloaded nsIMathMLFrame methods
 
   NS_IMETHOD
   InheritAutomaticData(nsIFrame* aParent);
 
   NS_IMETHOD
   UpdatePresentationData(PRUint32 aFlagsValues,
@@ -99,16 +100,18 @@ protected:
                 PRInt32         aRowIndex);
 }; // class nsMathMLmtableOuterFrame
 
 // --------------
 
 class nsMathMLmtableFrame : public nsTableFrame
 {
 public:
+  NS_DECL_FRAMEARENA_HELPERS
+
   friend nsIFrame* NS_NewMathMLmtableFrame(nsIPresShell* aPresShell, nsStyleContext* aContext);
 
   // Overloaded nsTableFrame methods
 
   NS_IMETHOD
   SetInitialChildList(nsIAtom*  aListName,
                       nsFrameList& aChildList);
 
@@ -155,16 +158,18 @@ protected:
   virtual ~nsMathMLmtableFrame();
 }; // class nsMathMLmtableFrame
 
 // --------------
 
 class nsMathMLmtrFrame : public nsTableRowFrame
 {
 public:
+  NS_DECL_FRAMEARENA_HELPERS
+
   friend nsIFrame* NS_NewMathMLmtrFrame(nsIPresShell* aPresShell, nsStyleContext* aContext);
 
   // overloaded nsTableRowFrame methods
 
   NS_IMETHOD
   AttributeChanged(PRInt32  aNameSpaceID,
                    nsIAtom* aAttribute,
                    PRInt32  aModType);
@@ -217,16 +222,18 @@ protected:
   virtual ~nsMathMLmtrFrame();
 }; // class nsMathMLmtrFrame
 
 // --------------
 
 class nsMathMLmtdFrame : public nsTableCellFrame
 {
 public:
+  NS_DECL_FRAMEARENA_HELPERS
+
   friend nsIFrame* NS_NewMathMLmtdFrame(nsIPresShell* aPresShell, nsStyleContext* aContext);
 
   // overloaded nsTableCellFrame methods
 
   NS_IMETHOD
   AttributeChanged(PRInt32  aNameSpaceID,
                    nsIAtom* aAttribute,
                    PRInt32  aModType);
@@ -246,16 +253,17 @@ protected:
 // --------------
 
 class nsMathMLmtdInnerFrame : public nsBlockFrame,
                               public nsMathMLFrame {
 public:
   friend nsIFrame* NS_NewMathMLmtdInnerFrame(nsIPresShell* aPresShell, nsStyleContext* aContext);
 
   NS_DECL_QUERYFRAME
+  NS_DECL_FRAMEARENA_HELPERS
 
   // Overloaded nsIMathMLFrame methods
 
   NS_IMETHOD
   UpdatePresentationDataFromChildAt(PRInt32         aFirstIndex,
                                     PRInt32         aLastIndex,
                                     PRUint32        aFlagsValues,
                                     PRUint32        aFlagsToUpdate)
--- a/layout/mathml/nsMathMLmunderFrame.cpp
+++ b/layout/mathml/nsMathMLmunderFrame.cpp
@@ -57,16 +57,18 @@
 //
 
 nsIFrame*
 NS_NewMathMLmunderFrame(nsIPresShell* aPresShell, nsStyleContext* aContext)
 {
   return new (aPresShell) nsMathMLmunderFrame(aContext);
 }
 
+NS_IMPL_FRAMEARENA_HELPERS(nsMathMLmunderFrame)
+
 nsMathMLmunderFrame::~nsMathMLmunderFrame()
 {
 }
 
 NS_IMETHODIMP
 nsMathMLmunderFrame::AttributeChanged(PRInt32         aNameSpaceID,
                                       nsIAtom*        aAttribute,
                                       PRInt32         aModType)
--- a/layout/mathml/nsMathMLmunderFrame.h
+++ b/layout/mathml/nsMathMLmunderFrame.h
@@ -45,16 +45,18 @@
 #include "nsMathMLContainerFrame.h"
 
 //
 // <munder> -- attach an underscript to a base 
 //
 
 class nsMathMLmunderFrame : public nsMathMLContainerFrame {
 public:
+  NS_DECL_FRAMEARENA_HELPERS
+
   friend nsIFrame* NS_NewMathMLmunderFrame(nsIPresShell* aPresShell, nsStyleContext* aContext);
 
   virtual nsresult
   Place(nsIRenderingContext& aRenderingContext,
         PRBool               aPlaceOrigin,
         nsHTMLReflowMetrics& aDesiredSize);
 
   NS_IMETHOD
--- a/layout/mathml/nsMathMLmunderoverFrame.cpp
+++ b/layout/mathml/nsMathMLmunderoverFrame.cpp
@@ -57,16 +57,18 @@
 //
 
 nsIFrame*
 NS_NewMathMLmunderoverFrame(nsIPresShell* aPresShell, nsStyleContext* aContext)
 {
   return new (aPresShell) nsMathMLmunderoverFrame(aContext);
 }
 
+NS_IMPL_FRAMEARENA_HELPERS(nsMathMLmunderoverFrame)
+
 nsMathMLmunderoverFrame::~nsMathMLmunderoverFrame()
 {
 }
 
 NS_IMETHODIMP
 nsMathMLmunderoverFrame::AttributeChanged(PRInt32         aNameSpaceID,
                                           nsIAtom*        aAttribute,
                                           PRInt32         aModType)
--- a/layout/mathml/nsMathMLmunderoverFrame.h
+++ b/layout/mathml/nsMathMLmunderoverFrame.h
@@ -45,16 +45,18 @@
 #include "nsMathMLContainerFrame.h"
 
 //
 // <munderover> -- attach an underscript-overscript pair to a base
 //
 
 class nsMathMLmunderoverFrame : public nsMathMLContainerFrame {
 public:
+  NS_DECL_FRAMEARENA_HELPERS
+
   friend nsIFrame* NS_NewMathMLmunderoverFrame(nsIPresShell* aPresShell, nsStyleContext* aContext);
 
   virtual nsresult
   Place(nsIRenderingContext& aRenderingContext,
         PRBool               aPlaceOrigin,
         nsHTMLReflowMetrics& aDesiredSize);
 
   NS_IMETHOD
--- a/layout/style/nsICSSPseudoComparator.h
+++ b/layout/style/nsICSSPseudoComparator.h
@@ -43,14 +43,14 @@
 #include "nsQueryFrame.h"
 
 class nsIAtom;
 struct nsCSSSelector;
 
 class nsICSSPseudoComparator
 {
 public:
-  NS_DECLARE_FRAME_ACCESSOR(nsICSSPseudoComparator)
+  NS_DECL_QUERYFRAME_TARGET(nsICSSPseudoComparator)
 
   NS_IMETHOD  PseudoMatches(nsIAtom* aTag, nsCSSSelector* aSelector, PRBool* aResult)=0;
 };
 
 #endif /* nsICSSPseudoComparator_h___ */
--- a/layout/svg/base/src/nsISVGChildFrame.h
+++ b/layout/svg/base/src/nsISVGChildFrame.h
@@ -48,17 +48,17 @@
 
 class gfxContext;
 class nsPresContext;
 class nsSVGRenderState;
 
 class nsISVGChildFrame : public nsQueryFrame
 {
 public:
-  NS_DECLARE_FRAME_ACCESSOR(nsISVGChildFrame)
+  NS_DECL_QUERYFRAME_TARGET(nsISVGChildFrame)
 
   // Paint this frame - aDirtyRect is the area being redrawn, in frame
   // offset pixel coordinates
   NS_IMETHOD PaintSVG(nsSVGRenderState* aContext,
                       const nsIntRect *aDirtyRect)=0;
 
   // Check if this frame or children contain the given point,
   // specified in app units relative to the origin of the outer
--- a/layout/svg/base/src/nsISVGGlyphFragmentLeaf.h
+++ b/layout/svg/base/src/nsISVGGlyphFragmentLeaf.h
@@ -44,17 +44,17 @@
 
 class nsIDOMSVGPoint;
 class nsIDOMSVGRect;
 class nsSVGTextPathFrame;
 
 class nsISVGGlyphFragmentLeaf : public nsISVGGlyphFragmentNode
 {
 public:
-  NS_DECLARE_FRAME_ACCESSOR(nsISVGGlyphFragmentLeaf)
+  NS_DECL_QUERYFRAME_TARGET(nsISVGGlyphFragmentLeaf)
 
   NS_IMETHOD GetStartPositionOfChar(PRUint32 charnum, nsIDOMSVGPoint **_retval)=0;
   NS_IMETHOD GetEndPositionOfChar(PRUint32 charnum, nsIDOMSVGPoint **_retval)=0;
   NS_IMETHOD GetExtentOfChar(PRUint32 charnum, nsIDOMSVGRect **_retval)=0;
   NS_IMETHOD GetRotationOfChar(PRUint32 charnum, float *_retval)=0;
 
   NS_IMETHOD_(float) GetAdvance(PRBool aForceGlobalTransform)=0;
 
--- a/layout/svg/base/src/nsISVGGlyphFragmentNode.h
+++ b/layout/svg/base/src/nsISVGGlyphFragmentNode.h
@@ -48,17 +48,17 @@ class nsIDOMSVGPoint;
 #define PRESERVE_WHITESPACE       0x00
 #define COMPRESS_WHITESPACE       0x01
 #define TRIM_LEADING_WHITESPACE   0x02
 #define TRIM_TRAILING_WHITESPACE  0x04
 
 class nsISVGGlyphFragmentNode : public nsQueryFrame
 {
 public:
-  NS_DECLARE_FRAME_ACCESSOR(nsISVGGlyphFragmentNode)
+  NS_DECL_QUERYFRAME_TARGET(nsISVGGlyphFragmentNode)
 
   virtual PRUint32 GetNumberOfChars()=0;
   virtual float GetComputedTextLength()=0;
   virtual float GetSubStringLength(PRUint32 charnum, PRUint32 fragmentChars)=0;
   virtual PRInt32 GetCharNumAtPosition(nsIDOMSVGPoint *point)=0;
   NS_IMETHOD_(nsISVGGlyphFragmentLeaf *) GetFirstGlyphFragment()=0;
   NS_IMETHOD_(nsISVGGlyphFragmentLeaf *) GetNextGlyphFragment()=0;
   NS_IMETHOD_(void) SetWhitespaceHandling(PRUint8 aWhitespaceHandling)=0;
--- a/layout/svg/base/src/nsISVGSVGFrame.h
+++ b/layout/svg/base/src/nsISVGSVGFrame.h
@@ -39,16 +39,16 @@
 #ifndef __NS_ISVGSVGFRAME_H__
 #define __NS_ISVGSVGFRAME_H__
 
 #include "nsQueryFrame.h"
 
 class nsISVGSVGFrame
 {
 public:
-  NS_DECLARE_FRAME_ACCESSOR(nsISVGSVGFrame)
+  NS_DECL_QUERYFRAME_TARGET(nsISVGSVGFrame)
 
   NS_IMETHOD SuspendRedraw()=0;        
   NS_IMETHOD UnsuspendRedraw()=0;      
   NS_IMETHOD NotifyViewportChange()=0; 
 };
 
 #endif // __NS_ISVGSVGFRAME_H__
--- a/layout/svg/base/src/nsSVGAFrame.cpp
+++ b/layout/svg/base/src/nsSVGAFrame.cpp
@@ -55,16 +55,18 @@ class nsSVGAFrame : public nsSVGAFrameBa
 {
   friend nsIFrame*
   NS_NewSVGAFrame(nsIPresShell* aPresShell, nsStyleContext* aContext);
 protected:
   nsSVGAFrame(nsStyleContext* aContext) :
     nsSVGAFrameBase(aContext) {}
 
 public:
+  NS_DECL_FRAMEARENA_HELPERS
+
 #ifdef DEBUG
   NS_IMETHOD Init(nsIContent*      aContent,
                   nsIFrame*        aParent,
                   nsIFrame*        aPrevInFlow);
 #endif
 
   // nsIFrame:
   NS_IMETHOD  AttributeChanged(PRInt32         aNameSpaceID,
@@ -98,16 +100,18 @@ private:
 // Implementation
 
 nsIFrame*
 NS_NewSVGAFrame(nsIPresShell* aPresShell, nsStyleContext* aContext)
 {
   return new (aPresShell) nsSVGAFrame(aContext);
 }
 
+NS_IMPL_FRAMEARENA_HELPERS(nsSVGAFrame)
+
 //----------------------------------------------------------------------
 // nsIFrame methods
 #ifdef DEBUG
 NS_IMETHODIMP
 nsSVGAFrame::Init(nsIContent* aContent,
                   nsIFrame* aParent,
                   nsIFrame* aPrevInFlow)
 {
--- a/layout/svg/base/src/nsSVGClipPathFrame.cpp
+++ b/layout/svg/base/src/nsSVGClipPathFrame.cpp
@@ -48,16 +48,18 @@
 // Implementation
 
 nsIFrame*
 NS_NewSVGClipPathFrame(nsIPresShell* aPresShell, nsStyleContext* aContext)
 {
   return new (aPresShell) nsSVGClipPathFrame(aContext);
 }
 
+NS_IMPL_FRAMEARENA_HELPERS(nsSVGClipPathFrame)
+
 nsresult
 nsSVGClipPathFrame::ClipPaint(nsSVGRenderState* aContext,
                               nsIFrame* aParent,
                               const gfxMatrix &aMatrix)
 {
   // If the flag is set when we get here, it means this clipPath frame
   // has already been used painting the current clip, and the document
   // has a clip reference loop.
--- a/layout/svg/base/src/nsSVGClipPathFrame.h
+++ b/layout/svg/base/src/nsSVGClipPathFrame.h
@@ -48,16 +48,18 @@ class nsSVGClipPathFrame : public nsSVGC
   NS_NewSVGClipPathFrame(nsIPresShell* aPresShell, nsStyleContext* aContext);
 protected:
   nsSVGClipPathFrame(nsStyleContext* aContext) :
     nsSVGClipPathFrameBase(aContext),
     mClipParentMatrix(nsnull),
     mInUse(PR_FALSE) {}
 
 public:
+  NS_DECL_FRAMEARENA_HELPERS
+
   // nsSVGClipPathFrame methods:
   nsresult ClipPaint(nsSVGRenderState* aContext,
                      nsIFrame* aParent,
                      const gfxMatrix &aMatrix);
 
   PRBool ClipHitTest(nsIFrame* aParent,
                      const gfxMatrix &aMatrix,
                      const nsPoint &aPoint);
--- a/layout/svg/base/src/nsSVGContainerFrame.cpp
+++ b/layout/svg/base/src/nsSVGContainerFrame.cpp
@@ -49,16 +49,19 @@ NS_QUERYFRAME_TAIL_INHERITING(nsSVGConta
 
 nsIFrame*
 NS_NewSVGContainerFrame(nsIPresShell* aPresShell,
                         nsStyleContext* aContext)
 {
   return new (aPresShell) nsSVGContainerFrame(aContext);
 }
 
+NS_IMPL_FRAMEARENA_HELPERS(nsSVGContainerFrame)
+NS_IMPL_FRAMEARENA_HELPERS(nsSVGDisplayContainerFrame)
+
 NS_IMETHODIMP
 nsSVGContainerFrame::AppendFrames(nsIAtom* aListName,
                                   nsFrameList& aFrameList)
 {
   return InsertFrames(aListName, mFrames.LastChild(), aFrameList);  
 }
 
 NS_IMETHODIMP
--- a/layout/svg/base/src/nsSVGContainerFrame.h
+++ b/layout/svg/base/src/nsSVGContainerFrame.h
@@ -49,19 +49,19 @@ class nsSVGContainerFrame : public nsSVG
 {
   friend nsIFrame* NS_NewSVGContainerFrame(nsIPresShell* aPresShell,
                                            nsStyleContext* aContext);
 protected:
   nsSVGContainerFrame(nsStyleContext* aContext) :
     nsSVGContainerFrameBase(aContext) {}
 
 public:
-  NS_DECLARE_FRAME_ACCESSOR(nsSVGContainerFrame)
-  
+  NS_DECL_QUERYFRAME_TARGET(nsSVGContainerFrame)
   NS_DECL_QUERYFRAME
+  NS_DECL_FRAMEARENA_HELPERS
 
   // Returns the transform to our gfxContext (to device pixels, not CSS px)
   virtual gfxMatrix GetCanvasTM() { return gfxMatrix(); }
 
   // nsIFrame:
   NS_IMETHOD AppendFrames(nsIAtom*        aListName,
                           nsFrameList&    aFrameList);
   NS_IMETHOD InsertFrames(nsIAtom*        aListName,
@@ -83,19 +83,19 @@ public:
 class nsSVGDisplayContainerFrame : public nsSVGContainerFrame,
                                    public nsISVGChildFrame
 {
 protected:
   nsSVGDisplayContainerFrame(nsStyleContext* aContext) :
     nsSVGContainerFrame(aContext) {}
 
 public:
-  NS_DECLARE_FRAME_ACCESSOR(nsSVGDisplayContainerFrame)
-
+  NS_DECL_QUERYFRAME_TARGET(nsSVGDisplayContainerFrame)
   NS_DECL_QUERYFRAME
+  NS_DECL_FRAMEARENA_HELPERS
 
   // nsIFrame:
   NS_IMETHOD InsertFrames(nsIAtom*        aListName,
                           nsIFrame*       aPrevFrame,
                           nsFrameList&    aFrameList);
   NS_IMETHOD RemoveFrame(nsIAtom*        aListName,
                          nsIFrame*       aOldFrame);
   NS_IMETHOD Init(nsIContent*      aContent,
--- a/layout/svg/base/src/nsSVGFilterFrame.cpp
+++ b/layout/svg/base/src/nsSVGFilterFrame.cpp
@@ -49,16 +49,18 @@
 #include "nsSVGFilterInstance.h"
 
 nsIFrame*
 NS_NewSVGFilterFrame(nsIPresShell* aPresShell, nsStyleContext* aContext)
 {
   return new (aPresShell) nsSVGFilterFrame(aContext);
 }
 
+NS_IMPL_FRAMEARENA_HELPERS(nsSVGFilterFrame)
+
 static nsIntRect
 MapDeviceRectToFilterSpace(const gfxMatrix& aMatrix,
                            const gfxIntSize& aFilterSize,
                            const nsIntRect* aDeviceRect)
 {
   nsIntRect rect(0, 0, aFilterSize.width, aFilterSize.height);
   if (aDeviceRect) {
     gfxRect r = aMatrix.TransformBounds(gfxRect(aDeviceRect->x, aDeviceRect->y,
--- a/layout/svg/base/src/nsSVGFilterFrame.h
+++ b/layout/svg/base/src/nsSVGFilterFrame.h
@@ -47,16 +47,18 @@ typedef nsSVGContainerFrame nsSVGFilterF
 class nsSVGFilterFrame : public nsSVGFilterFrameBase
 {
   friend nsIFrame*
   NS_NewSVGFilterFrame(nsIPresShell* aPresShell, nsStyleContext* aContext);
 protected:
   nsSVGFilterFrame(nsStyleContext* aContext) : nsSVGFilterFrameBase(aContext) {}
 
 public:
+  NS_DECL_FRAMEARENA_HELPERS
+
   nsresult FilterPaint(nsSVGRenderState *aContext,
                        nsIFrame *aTarget, nsSVGFilterPaintCallback *aPaintCallback,
                        const nsIntRect* aDirtyRect);
 
   /**
    * Returns the area that could change when the given rect of the source changes.
    * The rectangles are relative to the origin of the outer svg, if aTarget is SVG,
    * relative to aTarget itself otherwise, in device pixels.
--- a/layout/svg/base/src/nsSVGForeignObjectFrame.cpp
+++ b/layout/svg/base/src/nsSVGForeignObjectFrame.cpp
@@ -59,16 +59,18 @@
 
 nsIFrame*
 NS_NewSVGForeignObjectFrame(nsIPresShell   *aPresShell,
                             nsStyleContext *aContext)
 {
   return new (aPresShell) nsSVGForeignObjectFrame(aContext);
 }
 
+NS_IMPL_FRAMEARENA_HELPERS(nsSVGForeignObjectFrame)
+
 nsSVGForeignObjectFrame::nsSVGForeignObjectFrame(nsStyleContext* aContext)
   : nsSVGForeignObjectFrameBase(aContext),
     mInReflow(PR_FALSE)
 {
   AddStateBits(NS_FRAME_REFLOW_ROOT |
                NS_FRAME_MAY_BE_TRANSFORMED_OR_HAVE_RENDERING_OBSERVERS);
 }
 
--- a/layout/svg/base/src/nsSVGForeignObjectFrame.h
+++ b/layout/svg/base/src/nsSVGForeignObjectFrame.h
@@ -53,21 +53,22 @@ typedef nsContainerFrame nsSVGForeignObj
 
 class nsSVGForeignObjectFrame : public nsSVGForeignObjectFrameBase,
                                 public nsISVGChildFrame
 {
   friend nsIFrame*
   NS_NewSVGForeignObjectFrame(nsIPresShell* aPresShell, nsStyleContext* aContext);
 protected:
   nsSVGForeignObjectFrame(nsStyleContext* aContext);
-  
+
 public:
   NS_DECL_QUERYFRAME
+  NS_DECL_FRAMEARENA_HELPERS
 
-  // nsIFrame:  
+  // nsIFrame:
   NS_IMETHOD  Init(nsIContent* aContent,
                    nsIFrame*   aParent,
                    nsIFrame*   aPrevInFlow);
   virtual void Destroy();
   NS_IMETHOD  AttributeChanged(PRInt32         aNameSpaceID,
                                nsIAtom*        aAttribute,
                                PRInt32         aModType);
 
--- a/layout/svg/base/src/nsSVGGFrame.cpp
+++ b/layout/svg/base/src/nsSVGGFrame.cpp
@@ -48,16 +48,18 @@
 // Implementation
 
 nsIFrame*
 NS_NewSVGGFrame(nsIPresShell* aPresShell, nsStyleContext* aContext)
 {  
   return new (aPresShell) nsSVGGFrame(aContext);
 }
 
+NS_IMPL_FRAMEARENA_HELPERS(nsSVGGFrame)
+
 #ifdef DEBUG
 NS_IMETHODIMP
 nsSVGGFrame::Init(nsIContent* aContent,
                   nsIFrame* aParent,
                   nsIFrame* aPrevInFlow)
 {
   nsCOMPtr<nsIDOMSVGTransformable> transformable = do_QueryInterface(aContent);
   NS_ASSERTION(transformable,
--- a/layout/svg/base/src/nsSVGGFrame.h
+++ b/layout/svg/base/src/nsSVGGFrame.h
@@ -48,16 +48,18 @@ class nsSVGGFrame : public nsSVGGFrameBa
 {
   friend nsIFrame*
   NS_NewSVGGFrame(nsIPresShell* aPresShell, nsStyleContext* aContext);
 protected:
   nsSVGGFrame(nsStyleContext* aContext) :
     nsSVGGFrameBase(aContext) {}
 
 public:
+  NS_DECL_FRAMEARENA_HELPERS
+
 #ifdef DEBUG
   NS_IMETHOD Init(nsIContent*      aContent,
                   nsIFrame*        aParent,
                   nsIFrame*        aPrevInFlow);
 #endif
 
   /**
    * Get the "type" of the frame
--- a/layout/svg/base/src/nsSVGGenericContainerFrame.cpp
+++ b/layout/svg/base/src/nsSVGGenericContainerFrame.cpp
@@ -43,16 +43,18 @@
 // nsSVGGenericContainerFrame Implementation
 
 nsIFrame*
 NS_NewSVGGenericContainerFrame(nsIPresShell* aPresShell, nsStyleContext* aContext)
 {
   return new (aPresShell) nsSVGGenericContainerFrame(aContext);
 }
 
+NS_IMPL_FRAMEARENA_HELPERS(nsSVGGenericContainerFrame)
+
 //----------------------------------------------------------------------
 // nsIFrame methods
 
 NS_IMETHODIMP
 nsSVGGenericContainerFrame::AttributeChanged(PRInt32         aNameSpaceID,
                                              nsIAtom*        aAttribute,
                                              PRInt32         aModType)
 {
--- a/layout/svg/base/src/nsSVGGenericContainerFrame.h
+++ b/layout/svg/base/src/nsSVGGenericContainerFrame.h
@@ -50,16 +50,18 @@ typedef nsSVGDisplayContainerFrame nsSVG
 class nsSVGGenericContainerFrame : public nsSVGGenericContainerFrameBase
 {
   friend nsIFrame*
   NS_NewSVGGenericContainerFrame(nsIPresShell* aPresShell, nsStyleContext* aContext);
 protected:
   nsSVGGenericContainerFrame(nsStyleContext* aContext) : nsSVGGenericContainerFrameBase(aContext) {}
   
 public:
+  NS_DECL_FRAMEARENA_HELPERS
+
   // nsIFrame:
   NS_IMETHOD  AttributeChanged(PRInt32         aNameSpaceID,
                                nsIAtom*        aAttribute,
                                PRInt32         aModType);
   /**
    * Get the "type" of the frame
    *
    * @see nsGkAtoms::svgGenericContainerFrame
--- a/layout/svg/base/src/nsSVGGeometryFrame.cpp
+++ b/layout/svg/base/src/nsSVGGeometryFrame.cpp
@@ -37,16 +37,18 @@
 #include "nsPresContext.h"
 #include "nsSVGUtils.h"
 #include "nsSVGGeometryFrame.h"
 #include "nsSVGPaintServerFrame.h"
 #include "nsContentUtils.h"
 #include "gfxContext.h"
 #include "nsSVGEffects.h"
 
+NS_IMPL_FRAMEARENA_HELPERS(nsSVGGeometryFrame)
+
 //----------------------------------------------------------------------
 // nsIFrame methods
 
 NS_IMETHODIMP
 nsSVGGeometryFrame::Init(nsIContent* aContent,
                          nsIFrame* aParent,
                          nsIFrame* aPrevInFlow)
 {
--- a/layout/svg/base/src/nsSVGGeometryFrame.h
+++ b/layout/svg/base/src/nsSVGGeometryFrame.h
@@ -49,16 +49,18 @@ typedef nsFrame nsSVGGeometryFrameBase;
  * have geometry (circle, ellipse, line, polyline, polygon, path, and
  * glyph frames).  It knows how to convert the style information into
  * cairo context information and stores the fill/stroke paint
  * servers. */
 
 class nsSVGGeometryFrame : public nsSVGGeometryFrameBase
 {
 protected:
+  NS_DECL_FRAMEARENA_HELPERS
+
   nsSVGGeometryFrame(nsStyleContext *aContext) : nsSVGGeometryFrameBase(aContext) {}
 
 public:
   // nsIFrame interface:
   NS_IMETHOD Init(nsIContent* aContent,
                   nsIFrame* aParent,
                   nsIFrame* aPrevInFlow);
 
--- a/layout/svg/base/src/nsSVGGlyphFrame.cpp
+++ b/layout/svg/base/src/nsSVGGlyphFrame.cpp
@@ -185,16 +185,18 @@ private:
 // Implementation
 
 nsIFrame*
 NS_NewSVGGlyphFrame(nsIPresShell* aPresShell, nsStyleContext* aContext)
 {
   return new (aPresShell) nsSVGGlyphFrame(aContext);
 }
 
+NS_IMPL_FRAMEARENA_HELPERS(nsSVGGlyphFrame)
+
 //----------------------------------------------------------------------
 // nsQueryFrame methods
 
 NS_QUERYFRAME_HEAD(nsSVGGlyphFrame)
   NS_QUERYFRAME_ENTRY(nsISVGGlyphFragmentLeaf)
   NS_QUERYFRAME_ENTRY(nsISVGGlyphFragmentNode)
   NS_QUERYFRAME_ENTRY(nsISVGChildFrame)
 NS_QUERYFRAME_TAIL_INHERITING(nsSVGGlyphFrameBase)
--- a/layout/svg/base/src/nsSVGGlyphFrame.h
+++ b/layout/svg/base/src/nsSVGGlyphFrame.h
@@ -69,16 +69,17 @@ protected:
       {}
   ~nsSVGGlyphFrame()
   {
     ClearTextRun();
   }
 
 public:
   NS_DECL_QUERYFRAME
+  NS_DECL_FRAMEARENA_HELPERS
 
   // nsIFrame interface:
   NS_IMETHOD  CharacterDataChanged(CharacterDataChangeInfo* aInfo);
 
   virtual void DidSetStyleContext(nsStyleContext* aOldStyleContext);
 
   virtual void SetSelected(PRBool        aSelected,
                            SelectionType aType);
--- a/layout/svg/base/src/nsSVGGradientFrame.cpp
+++ b/layout/svg/base/src/nsSVGGradientFrame.cpp
@@ -54,16 +54,18 @@
 
 nsSVGGradientFrame::nsSVGGradientFrame(nsStyleContext* aContext) :
   nsSVGGradientFrameBase(aContext),
   mLoopFlag(PR_FALSE),
   mNoHRefURI(PR_FALSE)
 {
 }
 
+NS_IMPL_FRAMEARENA_HELPERS(nsSVGGradientFrame)
+
 //----------------------------------------------------------------------
 // nsIFrame methods:
 
 /* virtual */ void
 nsSVGGradientFrame::DidSetStyleContext(nsStyleContext* aOldStyleContext)
 {
   nsSVGEffects::InvalidateRenderingObservers(this);
   nsSVGGradientFrameBase::DidSetStyleContext(aOldStyleContext);
@@ -611,14 +613,18 @@ nsSVGRadialGradientFrame::CreateGradient
 
 nsIFrame*
 NS_NewSVGLinearGradientFrame(nsIPresShell*   aPresShell,
                              nsStyleContext* aContext)
 {
   return new (aPresShell) nsSVGLinearGradientFrame(aContext);
 }
 
+NS_IMPL_FRAMEARENA_HELPERS(nsSVGLinearGradientFrame)
+
 nsIFrame*
 NS_NewSVGRadialGradientFrame(nsIPresShell*   aPresShell,
                              nsStyleContext* aContext)
 {
   return new (aPresShell) nsSVGRadialGradientFrame(aContext);
 }
+
+NS_IMPL_FRAMEARENA_HELPERS(nsSVGRadialGradientFrame)
--- a/layout/svg/base/src/nsSVGGradientFrame.h
+++ b/layout/svg/base/src/nsSVGGradientFrame.h
@@ -53,16 +53,18 @@ typedef nsSVGPaintServerFrame nsSVGGradi
  * with property type nsGkAtoms::href to track the referenced gradient.
  */
 class nsSVGGradientFrame : public nsSVGGradientFrameBase
 {
 protected:
   nsSVGGradientFrame(nsStyleContext* aContext);
 
 public:
+  NS_DECL_FRAMEARENA_HELPERS
+
   // nsSVGPaintServerFrame methods:
   virtual PRBool SetupPaintServer(gfxContext *aContext,
                                   nsSVGGeometryFrame *aSource,
                                   float aGraphicOpacity);
 
   // nsIFrame interface:
   virtual void DidSetStyleContext(nsStyleContext* aOldStyleContext);
 
@@ -149,16 +151,18 @@ class nsSVGLinearGradientFrame : public 
 {
   friend nsIFrame* NS_NewSVGLinearGradientFrame(nsIPresShell* aPresShell,
                                                 nsStyleContext* aContext);
 protected:
   nsSVGLinearGradientFrame(nsStyleContext* aContext) :
     nsSVGLinearGradientFrameBase(aContext) {}
 
 public:
+  NS_DECL_FRAMEARENA_HELPERS
+
   // nsIFrame interface:
 #ifdef DEBUG
   NS_IMETHOD Init(nsIContent*      aContent,
                   nsIFrame*        aParent,
                   nsIFrame*        aPrevInFlow);
 #endif
 
   virtual nsIAtom* GetType() const;  // frame type: nsGkAtoms::svgLinearGradientFrame
@@ -190,16 +194,18 @@ class nsSVGRadialGradientFrame : public 
 {
   friend nsIFrame* NS_NewSVGRadialGradientFrame(nsIPresShell* aPresShell,
                                                 nsStyleContext* aContext);
 protected:
   nsSVGRadialGradientFrame(nsStyleContext* aContext) :
     nsSVGRadialGradientFrameBase(aContext) {}
 
 public:
+  NS_DECL_FRAMEARENA_HELPERS
+
   // nsIFrame interface:
 #ifdef DEBUG
   NS_IMETHOD Init(nsIContent*      aContent,
                   nsIFrame*        aParent,
                   nsIFrame*        aPrevInFlow);
 #endif
 
   virtual nsIAtom* GetType() const;  // frame type: nsGkAtoms::svgRadialGradientFrame
--- a/layout/svg/base/src/nsSVGImageFrame.cpp
+++ b/layout/svg/base/src/nsSVGImageFrame.cpp
@@ -75,16 +75,18 @@ class nsSVGImageFrame : public nsSVGPath
   friend nsIFrame*
   NS_NewSVGImageFrame(nsIPresShell* aPresShell, nsStyleContext* aContext);
 
 protected:
   nsSVGImageFrame(nsStyleContext* aContext) : nsSVGPathGeometryFrame(aContext) {}
   virtual ~nsSVGImageFrame();
 
 public:
+  NS_DECL_FRAMEARENA_HELPERS
+
   // nsISVGChildFrame interface:
   NS_IMETHOD PaintSVG(nsSVGRenderState *aContext, const nsIntRect *aDirtyRect);
   NS_IMETHOD_(nsIFrame*) GetFrameForPoint(const nsPoint &aPoint);
 
   // nsSVGPathGeometryFrame methods:
   NS_IMETHOD UpdateCoveredRegion();
   virtual PRUint16 GetHittestMask();
 
@@ -124,16 +126,18 @@ private:
 // Implementation
 
 nsIFrame*
 NS_NewSVGImageFrame(nsIPresShell* aPresShell, nsStyleContext* aContext)
 {
   return new (aPresShell) nsSVGImageFrame(aContext);
 }
 
+NS_IMPL_FRAMEARENA_HELPERS(nsSVGImageFrame)
+
 nsSVGImageFrame::~nsSVGImageFrame()
 {
   // set the frame to null so we don't send messages to a dead object.
   if (mListener) {
     nsCOMPtr<nsIImageLoadingContent> imageLoader = do_QueryInterface(mContent);
     if (imageLoader) {
       imageLoader->RemoveObserver(mListener);
     }
--- a/layout/svg/base/src/nsSVGInnerSVGFrame.cpp
+++ b/layout/svg/base/src/nsSVGInnerSVGFrame.cpp
@@ -47,16 +47,18 @@
 #include "gfxContext.h"
 
 nsIFrame*
 NS_NewSVGInnerSVGFrame(nsIPresShell* aPresShell, nsStyleContext* aContext)
 {
   return new (aPresShell) nsSVGInnerSVGFrame(aContext);
 }
 
+NS_IMPL_FRAMEARENA_HELPERS(nsSVGInnerSVGFrame)
+
 //----------------------------------------------------------------------
 // nsIFrame methods
 
 NS_QUERYFRAME_HEAD(nsSVGInnerSVGFrame)
   NS_QUERYFRAME_ENTRY(nsSVGInnerSVGFrame)
   NS_QUERYFRAME_ENTRY(nsISVGSVGFrame)
 NS_QUERYFRAME_TAIL_INHERITING(nsSVGInnerSVGFrameBase)
 
--- a/layout/svg/base/src/nsSVGInnerSVGFrame.h
+++ b/layout/svg/base/src/nsSVGInnerSVGFrame.h
@@ -47,19 +47,19 @@ class nsSVGInnerSVGFrame : public nsSVGI
 {
   friend nsIFrame*
   NS_NewSVGInnerSVGFrame(nsIPresShell* aPresShell, nsStyleContext* aContext);
 protected:
   nsSVGInnerSVGFrame(nsStyleContext* aContext) :
     nsSVGInnerSVGFrameBase(aContext) {}
   
 public:
-  NS_DECLARE_FRAME_ACCESSOR(nsSVGInnerSVGFrame)
-
+  NS_DECL_QUERYFRAME_TARGET(nsSVGInnerSVGFrame)
   NS_DECL_QUERYFRAME
+  NS_DECL_FRAMEARENA_HELPERS
 
   // We don't define an AttributeChanged method since changes to the
   // 'x', 'y', 'width' and 'height' attributes of our content object
   // are handled in nsSVGSVGElement::DidModifySVGObservable
 
 #ifdef DEBUG
   NS_IMETHOD Init(nsIContent*      aContent,
                   nsIFrame*        aParent,
--- a/layout/svg/base/src/nsSVGLeafFrame.cpp
+++ b/layout/svg/base/src/nsSVGLeafFrame.cpp
@@ -40,16 +40,18 @@
 class nsSVGLeafFrame : public nsFrame
 {
   friend nsIFrame*
   NS_NewSVGLeafFrame(nsIPresShell* aPresShell, nsStyleContext* aContext);
 protected:
   nsSVGLeafFrame(nsStyleContext* aContext) : nsFrame(aContext) {}
 
 public:
+  NS_DECL_FRAMEARENA_HELPERS
+
   virtual PRBool IsFrameOfType(PRUint32 aFlags) const
   {
     return nsFrame::IsFrameOfType(aFlags & ~(nsIFrame::eSVG));
   }
 
 #ifdef DEBUG
   NS_IMETHOD GetFrameName(nsAString& aResult) const
   {
@@ -61,14 +63,16 @@ public:
 };
 
 nsIFrame*
 NS_NewSVGLeafFrame(nsIPresShell* aPresShell, nsStyleContext* aContext)
 {
   return new (aPresShell) nsSVGLeafFrame(aContext);
 }
 
+NS_IMPL_FRAMEARENA_HELPERS(nsSVGLeafFrame)
+
 /* virtual */ void
 nsSVGLeafFrame::DidSetStyleContext(nsStyleContext* aOldStyleContext)
 {
   nsFrame::DidSetStyleContext(aOldStyleContext);
   nsSVGEffects::InvalidateRenderingObservers(this);
 }
--- a/layout/svg/base/src/nsSVGMarkerFrame.cpp
+++ b/layout/svg/base/src/nsSVGMarkerFrame.cpp
@@ -45,16 +45,18 @@
 #include "gfxContext.h"
 
 nsIFrame*
 NS_NewSVGMarkerFrame(nsIPresShell* aPresShell, nsStyleContext* aContext)
 {
   return new (aPresShell) nsSVGMarkerFrame(aContext);
 }
 
+NS_IMPL_FRAMEARENA_HELPERS(nsSVGMarkerFrame)
+
 //----------------------------------------------------------------------
 // nsIFrame methods:
 
 NS_IMETHODIMP
 nsSVGMarkerFrame::AttributeChanged(PRInt32  aNameSpaceID,
                                    nsIAtom* aAttribute,
                                    PRInt32  aModType)
 {
--- a/layout/svg/base/src/nsSVGMarkerFrame.h
+++ b/layout/svg/base/src/nsSVGMarkerFrame.h
@@ -55,16 +55,18 @@ class nsSVGMarkerFrame : public nsSVGMar
 protected:
   nsSVGMarkerFrame(nsStyleContext* aContext) :
     nsSVGMarkerFrameBase(aContext),
     mMarkedFrame(nsnull),
     mInUse(PR_FALSE),
     mInUse2(PR_FALSE) {}
 
 public:
+  NS_DECL_FRAMEARENA_HELPERS
+
   // nsIFrame interface:
 #ifdef DEBUG
   NS_IMETHOD Init(nsIContent*      aContent,
                   nsIFrame*        aParent,
                   nsIFrame*        aPrevInFlow);
 #endif
 
   NS_IMETHOD AttributeChanged(PRInt32         aNameSpaceID,
--- a/layout/svg/base/src/nsSVGMaskFrame.cpp
+++ b/layout/svg/base/src/nsSVGMaskFrame.cpp
@@ -47,16 +47,18 @@
 // Implementation
 
 nsIFrame*
 NS_NewSVGMaskFrame(nsIPresShell* aPresShell, nsStyleContext* aContext)
 {
   return new (aPresShell) nsSVGMaskFrame(aContext);
 }
 
+NS_IMPL_FRAMEARENA_HELPERS(nsSVGMaskFrame)
+
 already_AddRefed<gfxPattern>
 nsSVGMaskFrame::ComputeMaskAlpha(nsSVGRenderState *aContext,
                                  nsIFrame* aParent,
                                  const gfxMatrix &aMatrix,
                                  float aOpacity)
 {
   // If the flag is set when we get here, it means this mask frame
   // has already been used painting the current mask, and the document
--- a/layout/svg/base/src/nsSVGMaskFrame.h
+++ b/layout/svg/base/src/nsSVGMaskFrame.h
@@ -51,16 +51,18 @@ class nsSVGMaskFrame : public nsSVGMaskF
   NS_NewSVGMaskFrame(nsIPresShell* aPresShell, nsStyleContext* aContext);
 protected:
   nsSVGMaskFrame(nsStyleContext* aContext) :
     nsSVGMaskFrameBase(aContext),
     mMaskParentMatrix(nsnull),
     mInUse(PR_FALSE) {}
 
 public:
+  NS_DECL_FRAMEARENA_HELPERS
+
   // nsSVGMaskFrame method:
   already_AddRefed<gfxPattern> ComputeMaskAlpha(nsSVGRenderState *aContext,
                                                 nsIFrame* aParent,
                                                 const gfxMatrix &aMatrix,
                                                 float aOpacity = 1.0f);
 
 #ifdef DEBUG
   NS_IMETHOD Init(nsIContent*      aContent,
--- a/layout/svg/base/src/nsSVGOuterSVGFrame.cpp
+++ b/layout/svg/base/src/nsSVGOuterSVGFrame.cpp
@@ -134,16 +134,18 @@ nsSVGMutationObserver::UpdateTextFragmen
 // Implementation
 
 nsIFrame*
 NS_NewSVGOuterSVGFrame(nsIPresShell* aPresShell, nsStyleContext* aContext)
 {  
   return new (aPresShell) nsSVGOuterSVGFrame(aContext);
 }
 
+NS_IMPL_FRAMEARENA_HELPERS(nsSVGOuterSVGFrame)
+
 nsSVGOuterSVGFrame::nsSVGOuterSVGFrame(nsStyleContext* aContext)
     : nsSVGOuterSVGFrameBase(aContext)
     ,  mRedrawSuspendCount(0)
     , mFullZoom(0)
     , mViewportInitialized(PR_FALSE)
 #ifdef XP_MACOSX
     , mEnableBitmapFallback(PR_FALSE)
 #endif
--- a/layout/svg/base/src/nsSVGOuterSVGFrame.h
+++ b/layout/svg/base/src/nsSVGOuterSVGFrame.h
@@ -57,16 +57,17 @@ class nsSVGOuterSVGFrame : public nsSVGO
 {
   friend nsIFrame*
   NS_NewSVGOuterSVGFrame(nsIPresShell* aPresShell, nsStyleContext* aContext);
 protected:
   nsSVGOuterSVGFrame(nsStyleContext* aContext);
 
 public:
   NS_DECL_QUERYFRAME
+  NS_DECL_FRAMEARENA_HELPERS
 
 #ifdef DEBUG
   ~nsSVGOuterSVGFrame() {
     NS_ASSERTION(mForeignObjectHash.Count() == 0,
                  "foreignObject(s) still registered!");
   }
 #endif
 
--- a/layout/svg/base/src/nsSVGPaintServerFrame.cpp
+++ b/layout/svg/base/src/nsSVGPaintServerFrame.cpp
@@ -30,8 +30,10 @@
  * decision by deleting the provisions above and replace them with the notice
  * and other provisions required by the GPL or the LGPL. If you do not delete
  * the provisions above, a recipient may use your version of this file under
  * the terms of any one of the MPL, the GPL or the LGPL.
  *
  * ***** END LICENSE BLOCK ***** */
 
 #include "nsSVGPaintServerFrame.h"
+
+NS_IMPL_FRAMEARENA_HELPERS(nsSVGPaintServerFrame)
--- a/layout/svg/base/src/nsSVGPaintServerFrame.h
+++ b/layout/svg/base/src/nsSVGPaintServerFrame.h
@@ -46,16 +46,18 @@ typedef nsSVGContainerFrame nsSVGPaintSe
 
 class nsSVGPaintServerFrame : public nsSVGPaintServerFrameBase
 {
 protected:
   nsSVGPaintServerFrame(nsStyleContext* aContext) :
     nsSVGPaintServerFrameBase(aContext) {}
 
 public:
+  NS_DECL_FRAMEARENA_HELPERS
+
   /*
    * Configure paint server prior to rendering
    * @return PR_FALSE to skip rendering
    */
   virtual PRBool SetupPaintServer(gfxContext *aContext,
                                   nsSVGGeometryFrame *aSource,
                                   float aOpacity) = 0;
 };
--- a/layout/svg/base/src/nsSVGPathGeometryFrame.cpp
+++ b/layout/svg/base/src/nsSVGPathGeometryFrame.cpp
@@ -52,16 +52,18 @@
 
 nsIFrame*
 NS_NewSVGPathGeometryFrame(nsIPresShell* aPresShell,
                            nsStyleContext* aContext)
 {
   return new (aPresShell) nsSVGPathGeometryFrame(aContext);
 }
 
+NS_IMPL_FRAMEARENA_HELPERS(nsSVGPathGeometryFrame)
+
 //----------------------------------------------------------------------
 // nsQueryFrame methods
 
 NS_QUERYFRAME_HEAD(nsSVGPathGeometryFrame)
   NS_QUERYFRAME_ENTRY(nsISVGChildFrame)
 NS_QUERYFRAME_TAIL_INHERITING(nsSVGPathGeometryFrameBase)
 
 //----------------------------------------------------------------------
--- a/layout/svg/base/src/nsSVGPathGeometryFrame.h
+++ b/layout/svg/base/src/nsSVGPathGeometryFrame.h
@@ -63,16 +63,17 @@ class nsSVGPathGeometryFrame : public ns
   friend nsIFrame*
   NS_NewSVGPathGeometryFrame(nsIPresShell* aPresShell, nsStyleContext* aContext);
 protected:
   nsSVGPathGeometryFrame(nsStyleContext* aContext) :
     nsSVGPathGeometryFrameBase(aContext) {}
 
 public:
   NS_DECL_QUERYFRAME
+  NS_DECL_FRAMEARENA_HELPERS
 
   // nsIFrame interface:
   NS_IMETHOD  AttributeChanged(PRInt32         aNameSpaceID,
                                nsIAtom*        aAttribute,
                                PRInt32         aModType);
 
   virtual void DidSetStyleContext(nsStyleContext* aOldStyleContext);
 
--- a/layout/svg/base/src/nsSVGPatternFrame.cpp
+++ b/layout/svg/base/src/nsSVGPatternFrame.cpp
@@ -62,16 +62,18 @@
 
 nsSVGPatternFrame::nsSVGPatternFrame(nsStyleContext* aContext) :
   nsSVGPatternFrameBase(aContext),
   mLoopFlag(PR_FALSE), mPaintLoopFlag(PR_FALSE),
   mNoHRefURI(PR_FALSE)
 {
 }
 
+NS_IMPL_FRAMEARENA_HELPERS(nsSVGPatternFrame)
+
 //----------------------------------------------------------------------
 // nsIFrame methods:
 
 /* virtual */ void
 nsSVGPatternFrame::DidSetStyleContext(nsStyleContext* aOldStyleContext)
 {
   nsSVGEffects::InvalidateRenderingObservers(this);
   nsSVGPatternFrameBase::DidSetStyleContext(aOldStyleContext);
--- a/layout/svg/base/src/nsSVGPatternFrame.h
+++ b/layout/svg/base/src/nsSVGPatternFrame.h
@@ -54,16 +54,18 @@ typedef nsSVGPaintServerFrame  nsSVGPatt
 
 /**
  * Patterns can refer to other patterns. We create an nsSVGPaintingProperty
  * with property type nsGkAtoms::href to track the referenced pattern.
  */
 class nsSVGPatternFrame : public nsSVGPatternFrameBase
 {
 public:
+  NS_DECL_FRAMEARENA_HELPERS
+
   friend nsIFrame* NS_NewSVGPatternFrame(nsIPresShell* aPresShell,
                                          nsStyleContext* aContext);
 
   nsSVGPatternFrame(nsStyleContext* aContext);
 
   nsresult PaintPattern(gfxASurface **surface,
                         gfxMatrix *patternMatrix,
                         nsSVGGeometryFrame *aSource,
--- a/layout/svg/base/src/nsSVGStopFrame.cpp
+++ b/layout/svg/base/src/nsSVGStopFrame.cpp
@@ -51,16 +51,18 @@ typedef nsFrame  nsSVGStopFrameBase;
 class nsSVGStopFrame : public nsSVGStopFrameBase
 {
   friend nsIFrame*
   NS_NewSVGStopFrame(nsIPresShell* aPresShell, nsStyleContext* aContext);
 protected:
   nsSVGStopFrame(nsStyleContext* aContext) : nsSVGStopFrameBase(aContext) {}
 
 public:
+  NS_DECL_FRAMEARENA_HELPERS
+
   // nsIFrame interface:
 #ifdef DEBUG
   NS_IMETHOD Init(nsIContent*      aContent,
                   nsIFrame*        aParent,
                   nsIFrame*        aPrevInFlow);
 #endif
 
   virtual void DidSetStyleContext(nsStyleContext* aOldStyleContext);
@@ -88,16 +90,18 @@ public:
     return MakeFrameName(NS_LITERAL_STRING("SVGStop"), aResult);
   }
 #endif
 };
 
 //----------------------------------------------------------------------
 // Implementation
 
+NS_IMPL_FRAMEARENA_HELPERS(nsSVGStopFrame)
+
 //----------------------------------------------------------------------
 // nsIFrame methods:
 
 #ifdef DEBUG
 NS_IMETHODIMP
 nsSVGStopFrame::Init(nsIContent* aContent,
                      nsIFrame* aParent,
                      nsIFrame* aPrevInFlow)
--- a/layout/svg/base/src/nsSVGSwitchFrame.cpp
+++ b/layout/svg/base/src/nsSVGSwitchFrame.cpp
@@ -47,16 +47,18 @@ class nsSVGSwitchFrame : public nsSVGSwi
 {
   friend nsIFrame*
   NS_NewSVGSwitchFrame(nsIPresShell* aPresShell, nsStyleContext* aContext);
 protected:
   nsSVGSwitchFrame(nsStyleContext* aContext) :
     nsSVGSwitchFrameBase(aContext) {}
 
 public:
+  NS_DECL_FRAMEARENA_HELPERS
+
 #ifdef DEBUG
   NS_IMETHOD Init(nsIContent*      aContent,
                   nsIFrame*        aParent,
                   nsIFrame*        aPrevInFlow);
 #endif
 
   /**
    * Get the "type" of the frame
@@ -89,16 +91,18 @@ private:
 // Implementation
 
 nsIFrame*
 NS_NewSVGSwitchFrame(nsIPresShell* aPresShell, nsStyleContext* aContext)
 {  
   return new (aPresShell) nsSVGSwitchFrame(aContext);
 }
 
+NS_IMPL_FRAMEARENA_HELPERS(nsSVGSwitchFrame)
+
 #ifdef DEBUG
 NS_IMETHODIMP
 nsSVGSwitchFrame::Init(nsIContent* aContent,
                        nsIFrame* aParent,
                        nsIFrame* aPrevInFlow)
 {
   nsCOMPtr<nsIDOMSVGSwitchElement> svgSwitch = do_QueryInterface(aContent);
   NS_ASSERTION(svgSwitch, "Content is not an SVG switch\n");
--- a/layout/svg/base/src/nsSVGTSpanFrame.cpp
+++ b/layout/svg/base/src/nsSVGTSpanFrame.cpp
@@ -46,16 +46,18 @@
 // Implementation
 
 nsIFrame*
 NS_NewSVGTSpanFrame(nsIPresShell* aPresShell, nsStyleContext* aContext)
 {
   return new (aPresShell) nsSVGTSpanFrame(aContext);
 }
 
+NS_IMPL_FRAMEARENA_HELPERS(nsSVGTSpanFrame)
+
 nsIAtom *
 nsSVGTSpanFrame::GetType() const
 {
   return nsGkAtoms::svgTSpanFrame;
 }
 
 //----------------------------------------------------------------------
 // nsQueryFrame methods
--- a/layout/svg/base/src/nsSVGTSpanFrame.h
+++ b/layout/svg/base/src/nsSVGTSpanFrame.h
@@ -51,16 +51,17 @@ class nsSVGTSpanFrame : public nsSVGTSpa
   friend nsIFrame*
   NS_NewSVGTSpanFrame(nsIPresShell* aPresShell, nsStyleContext* aContext);
 protected:
   nsSVGTSpanFrame(nsStyleContext* aContext) :
     nsSVGTextContainerFrame(aContext) {}
 
 public:
   NS_DECL_QUERYFRAME
+  NS_DECL_FRAMEARENA_HELPERS
 
   // nsIFrame:
 #ifdef DEBUG
   NS_IMETHOD Init(nsIContent*      aContent,
                   nsIFrame*        aParent,
                   nsIFrame*        aPrevInFlow);
 #endif
 
--- a/layout/svg/base/src/nsSVGTextContainerFrame.cpp
+++ b/layout/svg/base/src/nsSVGTextContainerFrame.cpp
@@ -45,16 +45,18 @@
 
 //----------------------------------------------------------------------
 // nsQueryFrame methods
 
 NS_QUERYFRAME_HEAD(nsSVGTextContainerFrame)
   NS_QUERYFRAME_ENTRY(nsSVGTextContainerFrame)
 NS_QUERYFRAME_TAIL_INHERITING(nsSVGDisplayContainerFrame)
 
+NS_IMPL_FRAMEARENA_HELPERS(nsSVGTextContainerFrame)
+
 void
 nsSVGTextContainerFrame::NotifyGlyphMetricsChange()
 {
   nsSVGTextFrame *textFrame = GetTextFrame();
   if (textFrame)
     textFrame->NotifyGlyphMetricsChange();
 }
 
--- a/layout/svg/base/src/nsSVGTextContainerFrame.h
+++ b/layout/svg/base/src/nsSVGTextContainerFrame.h
@@ -53,18 +53,19 @@ public:
 
   void NotifyGlyphMetricsChange();
   NS_IMETHOD_(already_AddRefed<nsIDOMSVGLengthList>) GetX();
   NS_IMETHOD_(already_AddRefed<nsIDOMSVGLengthList>) GetY();
   NS_IMETHOD_(already_AddRefed<nsIDOMSVGLengthList>) GetDx();
   NS_IMETHOD_(already_AddRefed<nsIDOMSVGLengthList>) GetDy();
   
 public:
+  NS_DECL_QUERYFRAME_TARGET(nsSVGTextContainerFrame)
   NS_DECL_QUERYFRAME
-  NS_DECLARE_FRAME_ACCESSOR(nsSVGTextContainerFrame)
+  NS_DECL_FRAMEARENA_HELPERS
 
   // nsIFrame
   NS_IMETHOD InsertFrames(nsIAtom*        aListName,
                           nsIFrame*       aPrevFrame,
                           nsFrameList&    aFrameList);
   NS_IMETHOD RemoveFrame(nsIAtom *aListName, nsIFrame *aOldFrame);
 
   NS_IMETHOD GetStartPositionOfChar(PRUint32 charnum, nsIDOMSVGPoint **_retval);
--- a/layout/svg/base/src/nsSVGTextFrame.cpp
+++ b/layout/svg/base/src/nsSVGTextFrame.cpp
@@ -58,16 +58,18 @@
 // Implementation
 
 nsIFrame*
 NS_NewSVGTextFrame(nsIPresShell* aPresShell, nsStyleContext* aContext)
 {
   return new (aPresShell) nsSVGTextFrame(aContext);
 }
 
+NS_IMPL_FRAMEARENA_HELPERS(nsSVGTextFrame)
+
 //----------------------------------------------------------------------
 // nsIFrame methods
 #ifdef DEBUG
 NS_IMETHODIMP
 nsSVGTextFrame::Init(nsIContent* aContent,
                      nsIFrame* aParent,
                      nsIFrame* aPrevInFlow)
 {
--- a/layout/svg/base/src/nsSVGTextFrame.h
+++ b/layout/svg/base/src/nsSVGTextFrame.h
@@ -51,16 +51,18 @@ class nsSVGTextFrame : public nsSVGTextF
   NS_NewSVGTextFrame(nsIPresShell* aPresShell, nsStyleContext* aContext);
 protected:
   nsSVGTextFrame(nsStyleContext* aContext)
     : nsSVGTextFrameBase(aContext),
       mMetricsState(unsuspended),
       mPositioningDirty(PR_TRUE) {}
 
 public:
+  NS_DECL_FRAMEARENA_HELPERS
+
   // nsIFrame:
 #ifdef DEBUG
   NS_IMETHOD Init(nsIContent*      aContent,
                   nsIFrame*        aParent,
                   nsIFrame*        aPrevInFlow);
 #endif
 
   NS_IMETHOD  AttributeChanged(PRInt32         aNameSpaceID,
--- a/layout/svg/base/src/nsSVGTextPathFrame.cpp
+++ b/layout/svg/base/src/nsSVGTextPathFrame.cpp
@@ -47,16 +47,18 @@
 // Implementation
 
 nsIFrame*
 NS_NewSVGTextPathFrame(nsIPresShell* aPresShell, nsStyleContext* aContext)
 {
   return new (aPresShell) nsSVGTextPathFrame(aContext);
 }
 
+NS_IMPL_FRAMEARENA_HELPERS(nsSVGTextPathFrame)
+
 #ifdef DEBUG
 NS_IMETHODIMP
 nsSVGTextPathFrame::Init(nsIContent* aContent,
                          nsIFrame* aParent,
                          nsIFrame* aPrevInFlow)
 {
   NS_ASSERTION(aParent, "null parent");
 
--- a/layout/svg/base/src/nsSVGTextPathFrame.h
+++ b/layout/svg/base/src/nsSVGTextPathFrame.h
@@ -45,16 +45,18 @@ typedef nsSVGTSpanFrame nsSVGTextPathFra
 class nsSVGTextPathFrame : public nsSVGTextPathFrameBase
 {
   friend nsIFrame*
   NS_NewSVGTextPathFrame(nsIPresShell* aPresShell, nsStyleContext* aContext);
 protected:
   nsSVGTextPathFrame(nsStyleContext* aContext) : nsSVGTextPathFrameBase(aContext) {}
 
 public:
+  NS_DECL_FRAMEARENA_HELPERS
+
   // nsIFrame:
 #ifdef DEBUG
   NS_IMETHOD Init(nsIContent*      aContent,
                   nsIFrame*        aParent,
                   nsIFrame*        aPrevInFlow);
 #endif
 
   NS_IMETHOD  AttributeChanged(PRInt32         aNameSpaceID,
--- a/layout/svg/base/src/nsSVGUseFrame.cpp
+++ b/layout/svg/base/src/nsSVGUseFrame.cpp
@@ -50,17 +50,19 @@ class nsSVGUseFrame : public nsSVGUseFra
   friend nsIFrame*
   NS_NewSVGUseFrame(nsIPresShell* aPresShell, nsStyleContext* aContext);
 
 protected:
   nsSVGUseFrame(nsStyleContext* aContext) : nsSVGUseFrameBase(aContext) {}
 
 public:
   NS_DECL_QUERYFRAME
+  NS_DECL_FRAMEARENA_HELPERS
 
+  
   // nsIFrame interface:
 #ifdef DEBUG
   NS_IMETHOD Init(nsIContent*      aContent,
                   nsIFrame*        aParent,
                   nsIFrame*        aPrevInFlow);
 #endif
 
   NS_IMETHOD  AttributeChanged(PRInt32         aNameSpaceID,
@@ -93,16 +95,18 @@ public:
 // Implementation
 
 nsIFrame*
 NS_NewSVGUseFrame(nsIPresShell* aPresShell, nsStyleContext* aContext)
 {
   return new (aPresShell) nsSVGUseFrame(aContext);
 }
 
+NS_IMPL_FRAMEARENA_HELPERS(nsSVGUseFrame)
+
 nsIAtom *
 nsSVGUseFrame::GetType() const
 {
   return nsGkAtoms::svgUseFrame;
 }
 
 //----------------------------------------------------------------------
 // nsQueryFrame methods
--- a/layout/tables/nsITableCellLayout.h
+++ b/layout/tables/nsITableCellLayout.h
@@ -44,17 +44,17 @@
  * interface for layout objects that act like table cells.
  *
  * @author  sclark
  */
 class nsITableCellLayout
 {
 public:
 
-  NS_DECLARE_FRAME_ACCESSOR(nsITableCellLayout)
+  NS_DECL_QUERYFRAME_TARGET(nsITableCellLayout)
 
   /** return the mapped cell's row and column indexes (starting at 0 for each) */
   NS_IMETHOD GetCellIndexes(PRInt32 &aRowIndex, PRInt32 &aColIndex)=0;
 
   /** return the mapped cell's row index (starting at 0 for the first row) */
   virtual nsresult GetRowIndex(PRInt32 &aRowIndex) const = 0;
   
   /** return the mapped cell's column index (starting at 0 for the first column) */
--- a/layout/tables/nsITableLayout.h
+++ b/layout/tables/nsITableLayout.h
@@ -46,17 +46,17 @@ class nsIDOMElement;
  * initially, we use this to get cell info 
  *
  * @author  sclark
  */
 class nsITableLayout
 {
 public:
 
-  NS_DECLARE_FRAME_ACCESSOR(nsITableLayout)
+  NS_DECL_QUERYFRAME_TARGET(nsITableLayout)
 
   /** return all the relevant layout information about a cell.
    *  @param aRowIndex       a row which the cell intersects
    *  @param aColIndex       a col which the cell intersects
    *  @param aCell           [OUT] the content representing the cell at (aRowIndex, aColIndex)
    *  @param aStartRowIndex  [IN/OUT] the row in which aCell starts
    *  @param aStartColIndex  [IN/OUT] the col in which aCell starts
    *                         Initialize these with the "candidate" start indexes to use
--- a/layout/tables/nsTableCellFrame.cpp
+++ b/layout/tables/nsTableCellFrame.cpp
@@ -77,17 +77,19 @@ nsTableCellFrame::nsTableCellFrame(nsSty
   SetContentEmpty(PR_FALSE);
   SetHasPctOverHeight(PR_FALSE);
 }
 
 nsTableCellFrame::~nsTableCellFrame()
 {
 }
 
-nsTableCellFrame*  
+NS_IMPL_FRAMEARENA_HELPERS(nsTableCellFrame)
+
+nsTableCellFrame*
 nsTableCellFrame::GetNextCell() const
 {
   nsIFrame* childFrame = GetNextSibling();
   while (childFrame) {
     nsTableCellFrame *cellFrame = do_QueryFrame(childFrame);
     if (cellFrame) {
       return cellFrame;
     }
@@ -1019,16 +1021,18 @@ NS_NewTableCellFrame(nsIPresShell*   aPr
                      PRBool          aIsBorderCollapse)
 {
   if (aIsBorderCollapse)
     return new (aPresShell) nsBCTableCellFrame(aContext);
   else
     return new (aPresShell) nsTableCellFrame(aContext);
 }
 
+NS_IMPL_FRAMEARENA_HELPERS(nsBCTableCellFrame)
+
 nsMargin* 
 nsTableCellFrame::GetBorderWidth(nsMargin&  aBorder) const
 {
   aBorder = GetStyleBorder()->GetActualBorder();
   return &aBorder;
 }
 
 nsIAtom*
--- a/layout/tables/nsTableCellFrame.h
+++ b/layout/tables/nsTableCellFrame.h
@@ -67,19 +67,19 @@ class nsTableFrame;
  *
  * @author  sclark
  */
 class nsTableCellFrame : public nsHTMLContainerFrame, 
                          public nsITableCellLayout, 
                          public nsIPercentHeightObserver
 {
 public:
-
-  NS_DECLARE_FRAME_ACCESSOR(nsTableCellFrame)
+  NS_DECL_QUERYFRAME_TARGET(nsTableCellFrame)
   NS_DECL_QUERYFRAME
+  NS_DECL_FRAMEARENA_HELPERS
 
   // default constructor supplied by the compiler
 
   nsTableCellFrame(nsStyleContext* aContext);
   ~nsTableCellFrame();
 
   NS_IMETHOD Init(nsIContent*      aContent,
                   nsIFrame*        aParent,
@@ -297,16 +297,17 @@ inline void nsTableCellFrame::SetHasPctO
     mState &= ~NS_TABLE_CELL_HAS_PCT_OVER_HEIGHT;
   }
 }
 
 // nsBCTableCellFrame
 class nsBCTableCellFrame : public nsTableCellFrame
 {
 public:
+  NS_DECL_FRAMEARENA_HELPERS
 
   nsBCTableCellFrame(nsStyleContext* aContext);
 
   ~nsBCTableCellFrame();
 
   virtual nsIAtom* GetType() const;
 
   virtual nsMargin GetUsedBorder() const;
--- a/layout/tables/nsTableColFrame.cpp
+++ b/layout/tables/nsTableColFrame.cpp
@@ -183,16 +183,18 @@ void nsTableColFrame::Dump(PRInt32 aInde
 /* ----- global methods ----- */
 
 nsTableColFrame* 
 NS_NewTableColFrame(nsIPresShell* aPresShell, nsStyleContext* aContext)
 {
   return new (aPresShell) nsTableColFrame(aContext);
 }
 
+NS_IMPL_FRAMEARENA_HELPERS(nsTableColFrame)
+
 nsTableColFrame*  
 nsTableColFrame::GetNextCol() const
 {
   nsIFrame* childFrame = GetNextSibling();
   while (childFrame) {
     if (nsGkAtoms::tableColFrame == childFrame->GetType()) {
       return (nsTableColFrame*)childFrame;
     }
--- a/layout/tables/nsTableColFrame.h
+++ b/layout/tables/nsTableColFrame.h
@@ -48,16 +48,17 @@ enum nsTableColType {
   eColContent            = 0, // there is real col content associated   
   eColAnonymousCol       = 1, // the result of a span on a col
   eColAnonymousColGroup  = 2, // the result of a span on a col group
   eColAnonymousCell      = 3  // the result of a cell alone
 };
 
 class nsTableColFrame : public nsSplittableFrame {
 public:
+  NS_DECL_FRAMEARENA_HELPERS
 
   enum {eWIDTH_SOURCE_NONE          =0,   // no cell has contributed to the width style
         eWIDTH_SOURCE_CELL          =1,   // a cell specified a width
         eWIDTH_SOURCE_CELL_WITH_SPAN=2    // a cell implicitly specified a width via colspan
   };
 
   nsTableColType GetColType() const;
   void SetColType(nsTableColType aType);
--- a/layout/tables/nsTableColGroupFrame.cpp
+++ b/layout/tables/nsTableColGroupFrame.cpp
@@ -482,16 +482,18 @@ void nsTableColGroupFrame::GetContinuous
 /* ----- global methods ----- */
 
 nsIFrame*
 NS_NewTableColGroupFrame(nsIPresShell* aPresShell, nsStyleContext* aContext)
 {
   return new (aPresShell) nsTableColGroupFrame(aContext);
 }
 
+NS_IMPL_FRAMEARENA_HELPERS(nsTableColGroupFrame)
+
 nsIAtom*
 nsTableColGroupFrame::GetType() const
 {
   return nsGkAtoms::tableColGroupFrame;
 }
 
 #ifdef DEBUG
 NS_IMETHODIMP
--- a/layout/tables/nsTableColGroupFrame.h
+++ b/layout/tables/nsTableColGroupFrame.h
@@ -54,16 +54,17 @@ enum nsTableColGroupType {
  * nsTableColGroupFrame
  * data structure to maintain information about a single table cell's frame
  *
  * @author  sclark
  */
 class nsTableColGroupFrame : public nsHTMLContainerFrame
 {
 public:
+  NS_DECL_FRAMEARENA_HELPERS
 
   // default constructor supplied by the compiler
 
   /** instantiate a new instance of nsTableRowFrame.
     * @param aPresShell the pres shell for this frame
     *
     * @return           the frame that was created
     */
--- a/layout/tables/nsTableFrame.cpp
+++ b/layout/tables/nsTableFrame.cpp
@@ -3465,16 +3465,18 @@ nsTableFrame::GetBaseline() const
 /* ----- global methods ----- */
 
 nsIFrame*
 NS_NewTableFrame(nsIPresShell* aPresShell, nsStyleContext* aContext)
 {
   return new (aPresShell) nsTableFrame(aContext);
 }
 
+NS_IMPL_FRAMEARENA_HELPERS(nsTableFrame)
+
 nsTableFrame*
 nsTableFrame::GetTableFrame(nsIFrame* aSourceFrame)
 {
   if (aSourceFrame) {
     // "result" is the result of intermediate calls, not the result we return from this method
     for (nsIFrame* parentFrame = aSourceFrame->GetParent(); parentFrame;
          parentFrame = parentFrame->GetParent()) {
       if (nsGkAtoms::tableFrame == parentFrame->GetType()) {
--- a/layout/tables/nsTableFrame.h
+++ b/layout/tables/nsTableFrame.h
@@ -134,18 +134,18 @@ private:
   * named child list:
   * - "ColGroup-list" which contains the col group frames
   *
   * @see nsGkAtoms::colGroupList
   */
 class nsTableFrame : public nsHTMLContainerFrame, public nsITableLayout
 {
 public:
-
   NS_DECL_QUERYFRAME
+  NS_DECL_FRAMEARENA_HELPERS
 
   /** nsTableOuterFrame has intimate knowledge of the inner table frame */
   friend class nsTableOuterFrame;
 
   /** instantiate a new instance of nsTableRowFrame.
     * @param aPresShell the pres shell for this frame
     *
     * @return           the frame that was created
--- a/layout/tables/nsTableOuterFrame.cpp
+++ b/layout/tables/nsTableOuterFrame.cpp
@@ -169,16 +169,18 @@ nsTableCaptionFrame::GetFrameName(nsAStr
 #endif
 
 nsIFrame* 
 NS_NewTableCaptionFrame(nsIPresShell* aPresShell, nsStyleContext* aContext)
 {
   return new (aPresShell) nsTableCaptionFrame(aContext);
 }
 
+NS_IMPL_FRAMEARENA_HELPERS(nsTableCaptionFrame)
+
 /* ----------- nsTableOuterFrame ---------- */
 
 nsTableOuterFrame::nsTableOuterFrame(nsStyleContext* aContext):
   nsHTMLContainerFrame(aContext)
 {
 }
 
 nsTableOuterFrame::~nsTableOuterFrame()
@@ -1253,16 +1255,18 @@ nsTableOuterFrame::GetRowAndColumnByInde
 
 
 nsIFrame*
 NS_NewTableOuterFrame(nsIPresShell* aPresShell, nsStyleContext* aContext)
 {
   return new (aPresShell) nsTableOuterFrame(aContext);
 }
 
+NS_IMPL_FRAMEARENA_HELPERS(nsTableOuterFrame)
+
 #ifdef DEBUG
 NS_IMETHODIMP
 nsTableOuterFrame::GetFrameName(nsAString& aResult) const
 {
   return MakeFrameName(NS_LITERAL_STRING("TableOuter"), aResult);
 }
 #endif
 
--- a/layout/tables/nsTableOuterFrame.h
+++ b/layout/tables/nsTableOuterFrame.h
@@ -43,16 +43,18 @@
 #include "nsITableLayout.h"
 
 struct nsStyleTable;
 class nsTableFrame;
 
 class nsTableCaptionFrame : public nsBlockFrame
 {
 public:
+  NS_DECL_FRAMEARENA_HELPERS
+
   // nsISupports
   virtual nsIAtom* GetType() const;
   friend nsIFrame* NS_NewTableCaptionFrame(nsIPresShell* aPresShell, nsStyleContext*  aContext);
 
   virtual nsSize ComputeAutoSize(nsIRenderingContext *aRenderingContext,
                                  nsSize aCBSize, nscoord aAvailableWidth,
                                  nsSize aMargin, nsSize aBorder,
                                  nsSize aPadding, PRBool aShrinkWrap);
@@ -81,18 +83,18 @@ 1. decide if we'll allow subclassing.  I
 /**
  * main frame for an nsTable content object, 
  * the nsTableOuterFrame contains 0 or one caption frame, and a nsTableFrame
  * pseudo-frame (referred to as the "inner frame').
  */
 class nsTableOuterFrame : public nsHTMLContainerFrame, public nsITableLayout
 {
 public:
-
   NS_DECL_QUERYFRAME
+  NS_DECL_FRAMEARENA_HELPERS
 
   /** instantiate a new instance of nsTableRowFrame.
     * @param aPresShell the pres shell for this frame
     *
     * @return           the frame that was created
     */
   friend nsIFrame* NS_NewTableOuterFrame(nsIPresShell* aPresShell, nsStyleContext* aContext);
   
--- a/layout/tables/nsTableRowFrame.cpp
+++ b/layout/tables/nsTableRowFrame.cpp
@@ -1440,15 +1440,17 @@ void nsTableRowFrame::InitHasCellWithSty
 /* ----- global methods ----- */
 
 nsIFrame* 
 NS_NewTableRowFrame(nsIPresShell* aPresShell, nsStyleContext* aContext)
 {
   return new (aPresShell) nsTableRowFrame(aContext);
 }
 
+NS_IMPL_FRAMEARENA_HELPERS(nsTableRowFrame)
+
 #ifdef DEBUG
 NS_IMETHODIMP
 nsTableRowFrame::GetFrameName(nsAString& aResult) const
 {
   return MakeFrameName(NS_LITERAL_STRING("TableRow"), aResult);
 }
 #endif
--- a/layout/tables/nsTableRowFrame.h
+++ b/layout/tables/nsTableRowFrame.h
@@ -62,19 +62,19 @@ struct nsTableCellReflowState;
  * 
  * @see nsTableFrame
  * @see nsTableRowGroupFrame
  * @see nsTableCellFrame
  */
 class nsTableRowFrame : public nsHTMLContainerFrame
 {
 public:
-
-  NS_DECLARE_FRAME_ACCESSOR(nsTableRowFrame)
+  NS_DECL_QUERYFRAME_TARGET(nsTableRowFrame)
   NS_DECL_QUERYFRAME
+  NS_DECL_FRAMEARENA_HELPERS
 
   virtual ~nsTableRowFrame();
 
   NS_IMETHOD Init(nsIContent*      aContent,
                   nsIFrame*        aParent,
                   nsIFrame*        aPrevInFlow);
   /** @see nsIFrame::DidSetStyleContext */
   virtual void DidSetStyleContext(nsStyleContext* aOldStyleContext);
--- a/layout/tables/nsTableRowGroupFrame.cpp
+++ b/layout/tables/nsTableRowGroupFrame.cpp
@@ -1582,16 +1582,18 @@ nsTableRowGroupFrame::GetType() const
 /* ----- global methods ----- */
 
 nsIFrame*
 NS_NewTableRowGroupFrame(nsIPresShell* aPresShell, nsStyleContext* aContext)
 {
   return new (aPresShell) nsTableRowGroupFrame(aContext);
 }
 
+NS_IMPL_FRAMEARENA_HELPERS(nsTableRowGroupFrame)
+
 #ifdef DEBUG
 NS_IMETHODIMP
 nsTableRowGroupFrame::GetFrameName(nsAString& aResult) const
 {
   return MakeFrameName(NS_LITERAL_STRING("TableRowGroup"), aResult);
 }
 #endif
 
--- a/layout/tables/nsTableRowGroupFrame.h
+++ b/layout/tables/nsTableRowGroupFrame.h
@@ -92,18 +92,19 @@ struct nsRowGroupReflowState {
  * @see nsTableFrame
  * @see nsTableRowFrame
  */
 class nsTableRowGroupFrame
   : public nsHTMLContainerFrame
   , public nsILineIterator
 {
 public:
-  NS_DECLARE_FRAME_ACCESSOR(nsTableRowGroupFrame)
+  NS_DECL_QUERYFRAME_TARGET(nsTableRowGroupFrame)
   NS_DECL_QUERYFRAME
+  NS_DECL_FRAMEARENA_HELPERS
 
   /** instantiate a new instance of nsTableRowFrame.
     * @param aPresShell the pres shell for this frame
     *
     * @return           the frame that was created
     */
   friend nsIFrame* NS_NewTableRowGroupFrame(nsIPresShell* aPresShell, nsStyleContext* aContext);
   virtual ~nsTableRowGroupFrame();
--- a/layout/xul/base/public/nsIMenuFrame.h
+++ b/layout/xul/base/public/nsIMenuFrame.h
@@ -41,17 +41,17 @@
 #include "nsQueryFrame.h"
 
 // this interface exists solely because native themes need to call into it.
 // Only menu frames should implement it
 
 class nsIMenuFrame
 {
 public:
-  NS_DECLARE_FRAME_ACCESSOR(nsIMenuFrame)
+  NS_DECL_QUERYFRAME_TARGET(nsIMenuFrame)
 
   virtual PRBool IsOpen() = 0;
   virtual PRBool IsMenu() = 0;
   virtual PRBool IsOnMenuBar() = 0;
   virtual PRBool IsOnActiveMenuBar() = 0;
 };
 
 #endif
--- a/layout/xul/base/public/nsIScrollbarMediator.h
+++ b/layout/xul/base/public/nsIScrollbarMediator.h
@@ -42,17 +42,17 @@
 
 #include "nsQueryFrame.h"
 
 class nsIScrollbarFrame;
 
 class nsIScrollbarMediator
 {
 public:
-  NS_DECLARE_FRAME_ACCESSOR(nsIScrollbarMediator)
+  NS_DECL_QUERYFRAME_TARGET(nsIScrollbarMediator)
 
   // The nsIFrame aScrollbar argument below denotes the
   // scrollbar that's firing the notification. It should be
   // where the same object as where nsIScrollbarFrame is implemented
 
   NS_IMETHOD PositionChanged(nsIScrollbarFrame* aScrollbar, PRInt32 aOldIndex, PRInt32& aNewIndex) = 0;
   NS_IMETHOD ScrollbarButtonPressed(nsIScrollbarFrame* aScrollbar, PRInt32 aOldIndex, PRInt32 aNewIndex) = 0;
 
--- a/layout/xul/base/src/grid/nsGridRowGroupFrame.cpp
+++ b/layout/xul/base/src/grid/nsGridRowGroupFrame.cpp
@@ -55,17 +55,19 @@ NS_NewGridRowGroupFrame(nsIPresShell* aP
                         nsStyleContext* aContext)
 {
   nsCOMPtr<nsIBoxLayout> layout = NS_NewGridRowGroupLayout();
   if (!layout) {
     return nsnull;
   }
 
   return new (aPresShell) nsGridRowGroupFrame(aPresShell, aContext, layout);
-} 
+}
+
+NS_IMPL_FRAMEARENA_HELPERS(nsGridRowGroupFrame)
 
 
 /**
  * This is redefined because row groups have a funny property. If they are flexible
  * then their flex must be equal to the sum of their children's flexes.
  */
 nscoord
 nsGridRowGroupFrame::GetFlex(nsBoxLayoutState& aState)
--- a/layout/xul/base/src/grid/nsGridRowGroupFrame.h
+++ b/layout/xul/base/src/grid/nsGridRowGroupFrame.h
@@ -52,16 +52,17 @@
  * A frame representing a grid row (or column) group, which is usually
  * an element that is a child of a grid and contains all the rows (or
  * all the columns).  However, multiple levels of groups are allowed, so
  * the parent or child could instead be another group.
  */
 class nsGridRowGroupFrame : public nsBoxFrame
 {
 public:
+  NS_DECL_FRAMEARENA_HELPERS
 
 #ifdef NS_DEBUG
   NS_IMETHOD GetFrameName(nsAString& aResult) const
   {
       return MakeFrameName(NS_LITERAL_STRING("nsGridRowGroup"), aResult);
   }
 #endif
 
--- a/layout/xul/base/src/grid/nsGridRowLeafFrame.cpp
+++ b/layout/xul/base/src/grid/nsGridRowLeafFrame.cpp
@@ -56,17 +56,19 @@ NS_NewGridRowLeafFrame(nsIPresShell* aPr
 {
   nsCOMPtr<nsIBoxLayout> layout = NS_NewGridRowLeafLayout();
   if (!layout) {
     return nsnull;
   }
   
   return new (aPresShell) nsGridRowLeafFrame(aPresShell, aContext, PR_FALSE,
                                              layout);
-} 
+}
+
+NS_IMPL_FRAMEARENA_HELPERS(nsGridRowLeafFrame)
 
 /*
  * Our border and padding could be affected by our columns or rows.
  * Let's go check it out.
  */
 NS_IMETHODIMP
 nsGridRowLeafFrame::GetBorderAndPadding(nsMargin& aBorderAndPadding)
 {
--- a/layout/xul/base/src/grid/nsGridRowLeafFrame.h
+++ b/layout/xul/base/src/grid/nsGridRowLeafFrame.h
@@ -53,16 +53,17 @@
  * elements are the children of row group (or column group) elements,
  * and their children are placed one to a cell.
  */
 // XXXldb This needs a better name that indicates that it's for any grid
 // row.
 class nsGridRowLeafFrame : public nsBoxFrame
 {
 public:
+  NS_DECL_FRAMEARENA_HELPERS
 
   friend nsIFrame* NS_NewGridRowLeafFrame(nsIPresShell* aPresShell,
                                           nsStyleContext* aContext);
 
 #ifdef NS_DEBUG
   NS_IMETHOD GetFrameName(nsAString& aResult) const
   {
       return MakeFrameName(NS_LITERAL_STRING("nsGridRowLeaf"), aResult);
--- a/layout/xul/base/src/nsBoxFrame.cpp
+++ b/layout/xul/base/src/nsBoxFrame.cpp
@@ -121,24 +121,26 @@ static NS_DEFINE_IID(kWidgetCID, NS_CHIL
 PRBool nsBoxFrame::gDebug = PR_FALSE;
 nsIBox* nsBoxFrame::mDebugChild = nsnull;
 #endif
 
 nsIFrame*
 NS_NewBoxFrame(nsIPresShell* aPresShell, nsStyleContext* aContext, PRBool aIsRoot, nsIBoxLayout* aLayoutManager)
 {
   return new (aPresShell) nsBoxFrame(aPresShell, aContext, aIsRoot, aLayoutManager);
-} // NS_NewBoxFrame
+}
 
 nsIFrame*
 NS_NewBoxFrame(nsIPresShell* aPresShell, nsStyleContext* aContext)
 {
   return new (aPresShell) nsBoxFrame(aPresShell, aContext);
 }
 
+NS_IMPL_FRAMEARENA_HELPERS(nsBoxFrame)
+
 nsBoxFrame::nsBoxFrame(nsIPresShell* aPresShell,
                        nsStyleContext* aContext,
                        PRBool aIsRoot,
                        nsIBoxLayout* aLayoutManager) :
   nsContainerFrame(aContext),
   mMouseThrough(unset)
 {
   mState |= NS_STATE_IS_HORIZONTAL;
--- a/layout/xul/base/src/nsBoxFrame.h
+++ b/layout/xul/base/src/nsBoxFrame.h
@@ -69,16 +69,17 @@ nsIFrame* NS_NewBoxFrame(nsIPresShell* a
                          PRBool aIsRoot,
                          nsIBoxLayout* aLayoutManager);
 nsIFrame* NS_NewBoxFrame(nsIPresShell* aPresShell,
                          nsStyleContext* aContext);
 
 class nsBoxFrame : public nsContainerFrame
 {
 public:
+  NS_DECL_FRAMEARENA_HELPERS
 
   friend nsIFrame* NS_NewBoxFrame(nsIPresShell* aPresShell, 
                                   nsStyleContext* aContext,
                                   PRBool aIsRoot,
                                   nsIBoxLayout* aLayoutManager);
   friend nsIFrame* NS_NewBoxFrame(nsIPresShell* aPresShell,
                                   nsStyleContext* aContext);
 
--- a/layout/xul/base/src/nsButtonBoxFrame.cpp
+++ b/layout/xul/base/src/nsButtonBoxFrame.cpp
@@ -57,17 +57,19 @@
 // NS_NewXULButtonFrame
 //
 // Creates a new Button frame and returns it
 //
 nsIFrame*
 NS_NewButtonBoxFrame (nsIPresShell* aPresShell, nsStyleContext* aContext)
 {
   return new (aPresShell) nsButtonBoxFrame(aPresShell, aContext);
-} // NS_NewXULButtonFrame
+}
+
+NS_IMPL_FRAMEARENA_HELPERS(nsButtonBoxFrame)
 
 NS_IMETHODIMP
 nsButtonBoxFrame::BuildDisplayListForChildren(nsDisplayListBuilder*   aBuilder,
                                               const nsRect&           aDirtyRect,
                                               const nsDisplayListSet& aLists)
 {
   // override, since we don't want children to get events
   if (aBuilder->IsForEventDelivery())
--- a/layout/xul/base/src/nsButtonBoxFrame.h
+++ b/layout/xul/base/src/nsButtonBoxFrame.h
@@ -38,16 +38,18 @@
 #ifndef nsButtonBoxFrame_h___
 #define nsButtonBoxFrame_h___
 
 #include "nsBoxFrame.h"
 
 class nsButtonBoxFrame : public nsBoxFrame
 {
 public:
+  NS_DECL_FRAMEARENA_HELPERS
+
   friend nsIFrame* NS_NewButtonBoxFrame(nsIPresShell* aPresShell);
 
   nsButtonBoxFrame(nsIPresShell* aPresShell, nsStyleContext* aContext)
     :nsBoxFrame(aPresShell, aContext, PR_FALSE) {}
 
   NS_IMETHOD BuildDisplayListForChildren(nsDisplayListBuilder*   aBuilder,
                                          const nsRect&           aDirtyRect,
                                          const nsDisplayListSet& aLists);
--- a/layout/xul/base/src/nsDeckFrame.cpp
+++ b/layout/xul/base/src/nsDeckFrame.cpp
@@ -57,17 +57,19 @@
 #include "nsStackLayout.h"
 #include "nsDisplayList.h"
 #include "nsHTMLContainerFrame.h"
 
 nsIFrame*
 NS_NewDeckFrame(nsIPresShell* aPresShell, nsStyleContext* aContext)
 {
   return new (aPresShell) nsDeckFrame(aPresShell, aContext);
-} // NS_NewDeckFrame
+}
+
+NS_IMPL_FRAMEARENA_HELPERS(nsDeckFrame)
 
 
 nsDeckFrame::nsDeckFrame(nsIPresShell* aPresShell, nsStyleContext* aContext)
   : nsBoxFrame(aPresShell, aContext), mIndex(0)
 {
   nsCOMPtr<nsIBoxLayout> layout;
   NS_NewStackLayout(aPresShell, layout);
   SetLayoutManager(layout);
--- a/layout/xul/base/src/nsDeckFrame.h
+++ b/layout/xul/base/src/nsDeckFrame.h
@@ -46,16 +46,17 @@
 #ifndef nsDeckFrame_h___
 #define nsDeckFrame_h___
 
 #include "nsBoxFrame.h"
 
 class nsDeckFrame : public nsBoxFrame
 {
 public:
+  NS_DECL_FRAMEARENA_HELPERS
 
   friend nsIFrame* NS_NewDeckFrame(nsIPresShell* aPresShell,
                                    nsStyleContext* aContext);
 
   NS_IMETHOD AttributeChanged(PRInt32         aNameSpaceID,
                               nsIAtom*        aAttribute,
                               PRInt32         aModType);
 
--- a/layout/xul/base/src/nsDocElementBoxFrame.cpp
+++ b/layout/xul/base/src/nsDocElementBoxFrame.cpp
@@ -67,16 +67,17 @@ public:
 
   friend nsIFrame* NS_NewBoxFrame(nsIPresShell* aPresShell,
                                   nsStyleContext* aContext);
 
   nsDocElementBoxFrame(nsIPresShell* aShell, nsStyleContext* aContext)
     :nsBoxFrame(aShell, aContext, PR_TRUE) {}
 
   NS_DECL_QUERYFRAME
+  NS_DECL_FRAMEARENA_HELPERS
 
   // nsIAnonymousContentCreator
   virtual nsresult CreateAnonymousContent(nsTArray<nsIContent*>& aElements);
 
   virtual PRBool IsFrameOfType(PRUint32 aFlags) const
   {
     // Override nsBoxFrame.
     if (aFlags & (nsIFrame::eReplacedContainsBlock | nsIFrame::eReplaced))
@@ -95,16 +96,18 @@ private:
 //----------------------------------------------------------------------
 
 nsIFrame*
 NS_NewDocElementBoxFrame(nsIPresShell* aPresShell, nsStyleContext* aContext)
 {
   return new (aPresShell) nsDocElementBoxFrame (aPresShell, aContext);
 }
 
+NS_IMPL_FRAMEARENA_HELPERS(nsDocElementBoxFrame)
+
 void
 nsDocElementBoxFrame::Destroy()
 {
   nsContentUtils::DestroyAnonymousContent(&mPopupgroupContent);
   nsContentUtils::DestroyAnonymousContent(&mTooltipContent);
   nsBoxFrame::Destroy();
 }
 
--- a/layout/xul/base/src/nsGroupBoxFrame.cpp
+++ b/layout/xul/base/src/nsGroupBoxFrame.cpp
@@ -39,16 +39,17 @@
 
 #include "nsBoxFrame.h"
 #include "nsCSSRendering.h"
 #include "nsStyleContext.h"
 #include "nsDisplayList.h"
 
 class nsGroupBoxFrame : public nsBoxFrame {
 public:
+  NS_DECL_FRAMEARENA_HELPERS
 
   nsGroupBoxFrame(nsIPresShell* aShell, nsStyleContext* aContext):
     nsBoxFrame(aShell, aContext) {}
 
   NS_IMETHOD GetBorderAndPadding(nsMargin& aBorderAndPadding);
 
   NS_IMETHOD BuildDisplayList(nsDisplayListBuilder*   aBuilder,
                               const nsRect&           aDirtyRect,
@@ -97,16 +98,18 @@ public:
 */
 
 nsIFrame*
 NS_NewGroupBoxFrame(nsIPresShell* aPresShell, nsStyleContext* aContext)
 {
   return new (aPresShell) nsGroupBoxFrame(aPresShell, aContext);
 }
 
+NS_IMPL_FRAMEARENA_HELPERS(nsGroupBoxFrame)
+
 class nsDisplayXULGroupBackground : public nsDisplayItem {
 public:
   nsDisplayXULGroupBackground(nsGroupBoxFrame* aFrame) : nsDisplayItem(aFrame) {
     MOZ_COUNT_CTOR(nsDisplayXULGroupBackground);
   }
 #ifdef NS_BUILD_REFCNT_LOGGING
   virtual ~nsDisplayXULGroupBackground() {
     MOZ_COUNT_DTOR(nsDisplayXULGroupBackground);
--- a/layout/xul/base/src/nsIRootBox.h
+++ b/layout/xul/base/src/nsIRootBox.h
@@ -43,17 +43,17 @@
 #include "nsQueryFrame.h"
 class nsPopupSetFrame;
 class nsIContent;
 class nsIPresShell;
 
 class nsIRootBox
 {
 public:
-  NS_DECLARE_FRAME_ACCESSOR(nsIRootBox)
+  NS_DECL_QUERYFRAME_TARGET(nsIRootBox)
 
   virtual nsPopupSetFrame* GetPopupSetFrame() = 0;
   virtual void SetPopupSetFrame(nsPopupSetFrame* aPopupSet) = 0;
 
   virtual nsIContent* GetDefaultTooltip() = 0;
   virtual void SetDefaultTooltip(nsIContent* aTooltip) = 0;
 
   virtual nsresult AddTooltipSupport(nsIContent* aNode) = 0;
--- a/layout/xul/base/src/nsIScrollbarFrame.h
+++ b/layout/xul/base/src/nsIScrollbarFrame.h
@@ -41,17 +41,17 @@
 
 #include "nsQueryFrame.h"
 
 class nsIScrollbarMediator;
 
 class nsIScrollbarFrame : public nsQueryFrame
 {
 public:
-  NS_DECLARE_FRAME_ACCESSOR(nsIScrollbarFrame)
+  NS_DECL_QUERYFRAME_TARGET(nsIScrollbarFrame)
   
   // Sets the scrollbar mediator content. We will try to get its primary frame
   // and then QI that to nsIScrollbarMediator as necessary.
   virtual void SetScrollbarMediatorContent(nsIContent* aMediator) = 0;
 
   // Do NOT hold on to this.
   virtual nsIScrollbarMediator* GetScrollbarMediator() = 0;
 };
--- a/layout/xul/base/src/nsImageBoxFrame.cpp
+++ b/layout/xul/base/src/nsImageBoxFrame.cpp
@@ -153,17 +153,19 @@ FireImageDOMEvent(nsIContent* aContent, 
 // NS_NewImageBoxFrame
 //
 // Creates a new image frame and returns it
 //
 nsIFrame*
 NS_NewImageBoxFrame (nsIPresShell* aPresShell, nsStyleContext* aContext)
 {
   return new (aPresShell) nsImageBoxFrame (aPresShell, aContext);
-} // NS_NewTitledButtonFrame
+}
+
+NS_IMPL_FRAMEARENA_HELPERS(nsImageBoxFrame)
 
 NS_IMETHODIMP
 nsImageBoxFrame::AttributeChanged(PRInt32 aNameSpaceID,
                                   nsIAtom* aAttribute,
                                   PRInt32 aModType)
 {
   nsresult rv = nsLeafBoxFrame::AttributeChanged(aNameSpaceID, aAttribute,
                                                  aModType);
--- a/layout/xul/base/src/nsImageBoxFrame.h
+++ b/layout/xul/base/src/nsImageBoxFrame.h
@@ -65,16 +65,17 @@ public:
 
 private:
   nsImageBoxFrame *mFrame;
 };
 
 class nsImageBoxFrame : public nsLeafBoxFrame
 {
 public:
+  NS_DECL_FRAMEARENA_HELPERS
 
   // nsIBox
   virtual nsSize GetPrefSize(nsBoxLayoutState& aBoxLayoutState);
   virtual nsSize GetMinSize(nsBoxLayoutState& aBoxLayoutState);
   virtual nscoord GetBoxAscent(nsBoxLayoutState& aBoxLayoutState);
   virtual void MarkIntrinsicWidthsDirty();
 
   friend nsIFrame* NS_NewImageBoxFrame(nsIPresShell* aPresShell, nsStyleContext* aContext);
--- a/layout/xul/base/src/nsLeafBoxFrame.cpp
+++ b/layout/xul/base/src/nsLeafBoxFrame.cpp
@@ -65,17 +65,19 @@ static NS_DEFINE_IID(kWidgetCID, NS_CHIL
 // NS_NewLeafBoxFrame
 //
 // Creates a new Toolbar frame and returns it
 //
 nsIFrame*
 NS_NewLeafBoxFrame (nsIPresShell* aPresShell, nsStyleContext* aContext)
 {
   return new (aPresShell) nsLeafBoxFrame(aPresShell, aContext);
-} // NS_NewLeafBoxFrame
+}
+
+NS_IMPL_FRAMEARENA_HELPERS(nsLeafBoxFrame)
 
 nsLeafBoxFrame::nsLeafBoxFrame(nsIPresShell* aShell, nsStyleContext* aContext)
     : nsLeafFrame(aContext), mMouseThrough(unset)
 {
 }
 
 #ifdef DEBUG_LAYOUT
 void
--- a/layout/xul/base/src/nsLeafBoxFrame.h
+++ b/layout/xul/base/src/nsLeafBoxFrame.h
@@ -40,16 +40,17 @@
 #include "nsLeafFrame.h"
 #include "nsBox.h"
 
 class nsAccessKeyInfo;
 
 class nsLeafBoxFrame : public nsLeafFrame
 {
 public:
+  NS_DECL_FRAMEARENA_HELPERS
 
   friend nsIFrame* NS_NewLeafBoxFrame(nsIPresShell* aPresShell, nsStyleContext* aContext);
 
   virtual nsSize GetPrefSize(nsBoxLayoutState& aState);
   virtual nsSize GetMinSize(nsBoxLayoutState& aState);
   virtual nsSize GetMaxSize(nsBoxLayoutState& aState);
   virtual nscoord GetFlex(nsBoxLayoutState& aState);
   virtual nscoord GetBoxAscent(nsBoxLayoutState& aState);
--- a/layout/xul/base/src/nsListBoxBodyFrame.cpp
+++ b/layout/xul/base/src/nsListBoxBodyFrame.cpp
@@ -1538,8 +1538,10 @@ NS_NewListBoxBodyFrame(nsIPresShell* aPr
 {
   nsCOMPtr<nsIBoxLayout> layout = NS_NewListBoxLayout();
   if (!layout) {
     return nsnull;
   }
 
   return new (aPresShell) nsListBoxBodyFrame(aPresShell, aContext, layout);
 }
+
+NS_IMPL_FRAMEARENA_HELPERS(nsListBoxBodyFrame)
--- a/layout/xul/base/src/nsListBoxBodyFrame.h
+++ b/layout/xul/base/src/nsListBoxBodyFrame.h
@@ -59,19 +59,19 @@ class nsListBoxBodyFrame : public nsBoxF
                            public nsIScrollbarMediator,
                            public nsIReflowCallback
 {
   nsListBoxBodyFrame(nsIPresShell* aPresShell, nsStyleContext* aContext,
                      nsIBoxLayout* aLayoutManager);
   virtual ~nsListBoxBodyFrame();
 
 public:
-  NS_DECLARE_FRAME_ACCESSOR(nsListBoxBodyFrame)
-
+  NS_DECL_QUERYFRAME_TARGET(nsListBoxBodyFrame)
   NS_DECL_QUERYFRAME
+  NS_DECL_FRAMEARENA_HELPERS
 
   // non-virtual nsIListBoxObject
   nsresult GetRowCount(PRInt32 *aResult);
   nsresult GetNumberOfVisibleRows(PRInt32 *aResult);
   nsresult GetIndexOfFirstVisibleRow(PRInt32 *aResult);
   nsresult EnsureIndexIsVisible(PRInt32 aRowIndex);
   nsresult ScrollToIndex(PRInt32 aRowIndex);
   nsresult ScrollByLines(PRInt32 aNumLines);
--- a/layout/xul/base/src/nsListItemFrame.cpp
+++ b/layout/xul/base/src/nsListItemFrame.cpp
@@ -91,10 +91,11 @@ nsIFrame*
 NS_NewListItemFrame(nsIPresShell* aPresShell, nsStyleContext* aContext)
 {
   nsCOMPtr<nsIBoxLayout> layout = NS_NewGridRowLeafLayout();
   if (!layout) {
     return nsnull;
   }
   
   return new (aPresShell) nsListItemFrame(aPresShell, aContext, PR_FALSE, layout);
-} // NS_NewListItemFrame
+}
 
+NS_IMPL_FRAMEARENA_HELPERS(nsListItemFrame)
--- a/layout/xul/base/src/nsListItemFrame.h
+++ b/layout/xul/base/src/nsListItemFrame.h
@@ -41,16 +41,18 @@
 #include "nsGridRowLeafFrame.h"
 
 nsIFrame* NS_NewListItemFrame(nsIPresShell* aPresShell,
                               nsStyleContext *aContext);
 
 class nsListItemFrame : public nsGridRowLeafFrame
 {
 public:
+  NS_DECL_FRAMEARENA_HELPERS
+
   friend nsIFrame* NS_NewListItemFrame(nsIPresShell* aPresShell,
                                        nsStyleContext *aContext);
 
   // overridden so that children of listitems don't handle mouse events,
   // unless allowevents="true" is specified on the listitem
   NS_IMETHOD BuildDisplayListForChildren(nsDisplayListBuilder*   aBuilder,
                                          const nsRect&           aDirtyRect,
                                          const nsDisplayListSet& aLists);
--- a/layout/xul/base/src/nsMenuBarFrame.cpp
+++ b/layout/xul/base/src/nsMenuBarFrame.cpp
@@ -73,16 +73,18 @@
 // Wrapper for creating a new menu Bar container
 //
 nsIFrame*
 NS_NewMenuBarFrame(nsIPresShell* aPresShell, nsStyleContext* aContext)
 {
   return new (aPresShell) nsMenuBarFrame (aPresShell, aContext);
 }
 
+NS_IMPL_FRAMEARENA_HELPERS(nsMenuBarFrame)
+
 //
 // nsMenuBarFrame cntr
 //
 nsMenuBarFrame::nsMenuBarFrame(nsIPresShell* aShell, nsStyleContext* aContext):
   nsBoxFrame(aShell, aContext),
     mMenuBarListener(nsnull),
     mStayActive(PR_FALSE),
     mIsActive(PR_FALSE),
--- a/layout/xul/base/src/nsMenuBarFrame.h
+++ b/layout/xul/base/src/nsMenuBarFrame.h
@@ -55,16 +55,18 @@
 
 class nsIContent;
 
 nsIFrame* NS_NewMenuBarFrame(nsIPresShell* aPresShell, nsStyleContext* aContext);
 
 class nsMenuBarFrame : public nsBoxFrame, public nsMenuParent
 {
 public:
+  NS_DECL_FRAMEARENA_HELPERS
+
   nsMenuBarFrame(nsIPresShell* aShell, nsStyleContext* aContext);
 
   // nsMenuParent interface
   virtual nsMenuFrame* GetCurrentMenuItem();
   NS_IMETHOD SetCurrentMenuItem(nsMenuFrame* aMenuItem);
   virtual void CurrentMenuIsBeingDestroyed();
   NS_IMETHOD ChangeMenuItem(nsMenuFrame* aMenuItem, PRBool aSelectFirstItem);
 
--- a/layout/xul/base/src/nsMenuFrame.cpp
+++ b/layout/xul/base/src/nsMenuFrame.cpp
@@ -172,16 +172,18 @@ NS_NewMenuItemFrame(nsIPresShell* aPresS
   nsMenuFrame* it = new (aPresShell) nsMenuFrame (aPresShell, aContext);
 
   if (it)
     it->SetIsMenu(PR_FALSE);
 
   return it;
 }
 
+NS_IMPL_FRAMEARENA_HELPERS(nsMenuFrame)
+
 NS_QUERYFRAME_HEAD(nsMenuFrame)
   NS_QUERYFRAME_ENTRY(nsIMenuFrame)
   NS_QUERYFRAME_ENTRY(nsIScrollableViewProvider)
 NS_QUERYFRAME_TAIL_INHERITING(nsBoxFrame)
 
 //
 // nsMenuFrame cntr
 //
--- a/layout/xul/base/src/nsMenuFrame.h
+++ b/layout/xul/base/src/nsMenuFrame.h
@@ -106,16 +106,17 @@ private:
 class nsMenuFrame : public nsBoxFrame, 
                     public nsIMenuFrame,
                     public nsIScrollableViewProvider
 {
 public:
   nsMenuFrame(nsIPresShell* aShell, nsStyleContext* aContext);
 
   NS_DECL_QUERYFRAME
+  NS_DECL_FRAMEARENA_HELPERS
 
   // nsIBox
   NS_IMETHOD DoLayout(nsBoxLayoutState& aBoxLayoutState);
   virtual nsSize GetMinSize(nsBoxLayoutState& aBoxLayoutState);
   virtual nsSize GetPrefSize(nsBoxLayoutState& aBoxLayoutState);
 
   NS_IMETHOD Init(nsIContent*      aContent,
                   nsIFrame*        aParent,
--- a/layout/xul/base/src/nsMenuPopupFrame.cpp
+++ b/layout/xul/base/src/nsMenuPopupFrame.cpp
@@ -95,16 +95,18 @@ PRInt8 nsMenuPopupFrame::sDefaultLevelPa
 // Wrapper for creating a new menu popup container
 //
 nsIFrame*
 NS_NewMenuPopupFrame(nsIPresShell* aPresShell, nsStyleContext* aContext)
 {
   return new (aPresShell) nsMenuPopupFrame (aPresShell, aContext);
 }
 
+NS_IMPL_FRAMEARENA_HELPERS(nsMenuPopupFrame)
+
 //
 // nsMenuPopupFrame ctor
 //
 nsMenuPopupFrame::nsMenuPopupFrame(nsIPresShell* aShell, nsStyleContext* aContext)
   :nsBoxFrame(aShell, aContext),
   mCurrentMenu(nsnull),
   mPrefSize(-1, -1),
   mPopupType(ePopupTypePanel),
--- a/layout/xul/base/src/nsMenuPopupFrame.h
+++ b/layout/xul/base/src/nsMenuPopupFrame.h
@@ -112,16 +112,18 @@ nsIFrame* NS_NewMenuPopupFrame(nsIPresSh
 
 class nsIViewManager;
 class nsIView;
 class nsMenuPopupFrame;
 
 class nsMenuPopupFrame : public nsBoxFrame, public nsMenuParent
 {
 public:
+  NS_DECL_FRAMEARENA_HELPERS
+
   nsMenuPopupFrame(nsIPresShell* aShell, nsStyleContext* aContext);
 
   // nsMenuParent interface
   virtual nsMenuFrame* GetCurrentMenuItem();
   NS_IMETHOD SetCurrentMenuItem(nsMenuFrame* aMenuItem);
   virtual void CurrentMenuIsBeingDestroyed();
   NS_IMETHOD ChangeMenuItem(nsMenuFrame* aMenuItem, PRBool aSelectFirstItem);
 
--- a/layout/xul/base/src/nsPopupSetFrame.cpp
+++ b/layout/xul/base/src/nsPopupSetFrame.cpp
@@ -62,16 +62,18 @@ nsPopupFrameList::nsPopupFrameList(nsICo
 // Wrapper for creating a new menu popup container
 //
 nsIFrame*
 NS_NewPopupSetFrame(nsIPresShell* aPresShell, nsStyleContext* aContext)
 {
   return new (aPresShell) nsPopupSetFrame (aPresShell, aContext);
 }
 
+NS_IMPL_FRAMEARENA_HELPERS(nsPopupSetFrame)
+
 NS_IMETHODIMP
 nsPopupSetFrame::Init(nsIContent*      aContent,
                       nsIFrame*        aParent,
                       nsIFrame*        aPrevInFlow)
 {
   nsresult  rv = nsBoxFrame::Init(aContent, aParent, aPrevInFlow);
 
   // Normally the root box is our grandparent, but in case of wrapping
--- a/layout/xul/base/src/nsPopupSetFrame.h
+++ b/layout/xul/base/src/nsPopupSetFrame.h
@@ -59,16 +59,18 @@ struct nsPopupFrameList {
 
 public:
   nsPopupFrameList(nsIContent* aPopupContent, nsPopupFrameList* aNext);
 };
 
 class nsPopupSetFrame : public nsBoxFrame
 {
 public:
+  NS_DECL_FRAMEARENA_HELPERS
+
   nsPopupSetFrame(nsIPresShell* aShell, nsStyleContext* aContext):
     nsBoxFrame(aShell, aContext) {}
 
   ~nsPopupSetFrame() {}
   
   NS_IMETHOD Init(nsIContent*      aContent,
                   nsIFrame*        aParent,
                   nsIFrame*        aPrevInFlow);
--- a/layout/xul/base/src/nsProgressMeterFrame.cpp
+++ b/layout/xul/base/src/nsProgressMeterFrame.cpp
@@ -56,17 +56,19 @@
 // NS_NewToolbarFrame
 //
 // Creates a new Toolbar frame and returns it
 //
 nsIFrame*
 NS_NewProgressMeterFrame (nsIPresShell* aPresShell, nsStyleContext* aContext)
 {
   return new (aPresShell) nsProgressMeterFrame(aPresShell, aContext);
-} // NS_NewProgressMeterFrame
+}
+
+NS_IMPL_FRAMEARENA_HELPERS(nsProgressMeterFrame)
 
 //
 // nsProgressMeterFrame dstr
 //
 // Cleanup, if necessary
 //
 nsProgressMeterFrame :: ~nsProgressMeterFrame ( )
 {
--- a/layout/xul/base/src/nsProgressMeterFrame.h
+++ b/layout/xul/base/src/nsProgressMeterFrame.h
@@ -51,16 +51,18 @@
 
 #include "nsBoxFrame.h"
 
 class nsPresContext;
 
 class nsProgressMeterFrame : public nsBoxFrame
 {
 public:
+  NS_DECL_FRAMEARENA_HELPERS
+
   friend nsIFrame* NS_NewProgressMeterFrame(nsIPresShell* aPresShell, nsStyleContext* aContext);
 
   NS_IMETHOD DoLayout(nsBoxLayoutState& aBoxLayoutState);
 
   NS_IMETHOD AttributeChanged(PRInt32 aNameSpaceID,
                               nsIAtom* aAttribute,
                               PRInt32 aModType);
 
--- a/layout/xul/base/src/nsResizerFrame.cpp
+++ b/layout/xul/base/src/nsResizerFrame.cpp
@@ -59,17 +59,19 @@
 // NS_NewResizerFrame
 //
 // Creates a new Resizer frame and returns it
 //
 nsIFrame*
 NS_NewResizerFrame(nsIPresShell* aPresShell, nsStyleContext* aContext)
 {
   return new (aPresShell) nsResizerFrame(aPresShell, aContext);
-} // NS_NewResizerFrame
+}
+
+NS_IMPL_FRAMEARENA_HELPERS(nsResizerFrame)
 
 nsResizerFrame::nsResizerFrame(nsIPresShell* aPresShell, nsStyleContext* aContext)
 :nsTitleBarFrame(aPresShell, aContext)
 {
 }
 
 NS_IMETHODIMP
 nsResizerFrame::HandleEvent(nsPresContext* aPresContext,
--- a/layout/xul/base/src/nsResizerFrame.h
+++ b/layout/xul/base/src/nsResizerFrame.h
@@ -44,16 +44,18 @@ class nsResizerFrame : public nsTitleBar
 {
 protected:
   struct Direction {
     PRInt8 mHorizontal;
     PRInt8 mVertical;
   };
 
 public:
+  NS_DECL_FRAMEARENA_HELPERS
+
   friend nsIFrame* NS_NewResizerFrame(nsIPresShell* aPresShell, nsStyleContext* aContext);  
 
   nsResizerFrame(nsIPresShell* aPresShell, nsStyleContext* aContext);
 
   NS_IMETHOD HandleEvent(nsPresContext* aPresContext, 
                                       nsGUIEvent* aEvent,
                                       nsEventStatus* aEventStatus);
 
--- a/layout/xul/base/src/nsRootBoxFrame.cpp
+++ b/layout/xul/base/src/nsRootBoxFrame.cpp
@@ -76,16 +76,17 @@ nsIRootBox::GetRootBox(nsIPresShell* aSh
 class nsRootBoxFrame : public nsBoxFrame, public nsIRootBox {
 public:
 
   friend nsIFrame* NS_NewBoxFrame(nsIPresShell* aPresShell, nsStyleContext* aContext);
 
   nsRootBoxFrame(nsIPresShell* aShell, nsStyleContext *aContext);
 
   NS_DECL_QUERYFRAME
+  NS_DECL_FRAMEARENA_HELPERS
 
   virtual nsPopupSetFrame* GetPopupSetFrame();
   virtual void SetPopupSetFrame(nsPopupSetFrame* aPopupSet);
   virtual nsIContent* GetDefaultTooltip();
   virtual void SetDefaultTooltip(nsIContent* aTooltip);
   virtual nsresult AddTooltipSupport(nsIContent* aNode);
   virtual nsresult RemoveTooltipSupport(nsIContent* aNode);
 
@@ -137,16 +138,18 @@ protected:
 //----------------------------------------------------------------------
 
 nsIFrame*
 NS_NewRootBoxFrame(nsIPresShell* aPresShell, nsStyleContext* aContext)
 {
   return new (aPresShell) nsRootBoxFrame (aPresShell, aContext);
 }
 
+NS_IMPL_FRAMEARENA_HELPERS(nsRootBoxFrame)
+
 nsRootBoxFrame::nsRootBoxFrame(nsIPresShell* aShell, nsStyleContext* aContext):
   nsBoxFrame(aShell, aContext, PR_TRUE)
 {
   mPopupSetFrame = nsnull;
 
   nsCOMPtr<nsIBoxLayout> layout;
   NS_NewStackLayout(aShell, layout);
   SetLayoutManager(layout);
--- a/layout/xul/base/src/nsScrollBoxFrame.cpp
+++ b/layout/xul/base/src/nsScrollBoxFrame.cpp
@@ -44,16 +44,18 @@
 #include "nsGUIEvent.h"
 #include "nsButtonBoxFrame.h"
 #include "nsITimer.h"
 #include "nsRepeatService.h"
 
 class nsAutoRepeatBoxFrame : public nsButtonBoxFrame
 {
 public:
+  NS_DECL_FRAMEARENA_HELPERS
+
   friend nsIFrame* NS_NewAutoRepeatBoxFrame(nsIPresShell* aPresShell,
                                             nsStyleContext* aContext);
 
   virtual void Destroy();
 
   NS_IMETHOD AttributeChanged(PRInt32 aNameSpaceID,
                               nsIAtom* aAttribute,
                               PRInt32 aModType);
@@ -89,17 +91,19 @@ protected:
   
   PRBool IsActivatedOnHover();
 };
 
 nsIFrame*
 NS_NewAutoRepeatBoxFrame (nsIPresShell* aPresShell, nsStyleContext* aContext)
 {
   return new (aPresShell) nsAutoRepeatBoxFrame (aPresShell, aContext);
-} // NS_NewScrollBarButtonFrame
+}
+
+NS_IMPL_FRAMEARENA_HELPERS(nsAutoRepeatBoxFrame)
 
 NS_IMETHODIMP
 nsAutoRepeatBoxFrame::HandleEvent(nsPresContext* aPresContext, 
                                       nsGUIEvent* aEvent,
                                       nsEventStatus* aEventStatus)
 {  
   NS_ENSURE_ARG_POINTER(aEventStatus);
   if (nsEventStatus_eConsumeNoDefault == *aEventStatus) {
--- a/layout/xul/base/src/nsScrollbarButtonFrame.cpp
+++ b/layout/xul/base/src/nsScrollbarButtonFrame.cpp
@@ -59,17 +59,19 @@
 // NS_NewToolbarFrame
 //
 // Creates a new Toolbar frame and returns it
 //
 nsIFrame*
 NS_NewScrollbarButtonFrame (nsIPresShell* aPresShell, nsStyleContext* aContext)
 {
   return new (aPresShell) nsScrollbarButtonFrame(aPresShell, aContext);
-} // NS_NewScrollBarButtonFrame
+}
+
+NS_IMPL_FRAMEARENA_HELPERS(nsScrollbarButtonFrame)
 
 NS_IMETHODIMP
 nsScrollbarButtonFrame::HandleEvent(nsPresContext* aPresContext, 
                                     nsGUIEvent* aEvent,
                                     nsEventStatus* aEventStatus)
 {  
   NS_ENSURE_ARG_POINTER(aEventStatus);
   if (nsEventStatus_eConsumeNoDefault == *aEventStatus) {
--- a/layout/xul/base/src/nsScrollbarButtonFrame.h
+++ b/layout/xul/base/src/nsScrollbarButtonFrame.h
@@ -49,16 +49,18 @@
 #include "nsITimer.h"
 #include "nsRepeatService.h"
 
 class nsSliderFrame;
 
 class nsScrollbarButtonFrame : public nsButtonBoxFrame
 {
 public:
+  NS_DECL_FRAMEARENA_HELPERS
+
   nsScrollbarButtonFrame(nsIPresShell* aPresShell, nsStyleContext* aContext):
     nsButtonBoxFrame(aPresShell, aContext) {}
 
   // Overrides
   virtual void Destroy();
 
   friend nsIFrame* NS_NewScrollbarButtonFrame(nsIPresShell* aPresShell, nsStyleContext* aContext);
 
--- a/layout/xul/base/src/nsScrollbarFrame.cpp
+++ b/layout/xul/base/src/nsScrollbarFrame.cpp
@@ -52,17 +52,19 @@
 // NS_NewToolbarFrame
 //
 // Creates a new Toolbar frame and returns it
 //
 nsIFrame*
 NS_NewScrollbarFrame (nsIPresShell* aPresShell, nsStyleContext* aContext)
 {
   return new (aPresShell) nsScrollbarFrame (aPresShell, aContext);
-} // NS_NewScrollbarFrame
+}
+
+NS_IMPL_FRAMEARENA_HELPERS(nsScrollbarFrame)
 
 NS_QUERYFRAME_HEAD(nsScrollbarFrame)
   NS_QUERYFRAME_ENTRY(nsIScrollbarFrame)
 NS_QUERYFRAME_TAIL_INHERITING(nsBoxFrame)
 
 NS_IMETHODIMP
 nsScrollbarFrame::Init(nsIContent* aContent,
                        nsIFrame*   aParent,
--- a/layout/xul/base/src/nsScrollbarFrame.h
+++ b/layout/xul/base/src/nsScrollbarFrame.h
@@ -62,16 +62,17 @@ public:
 #endif
 
   // nsIFrame overrides
   NS_IMETHOD AttributeChanged(PRInt32 aNameSpaceID,
                               nsIAtom* aAttribute,
                               PRInt32 aModType);
 
   NS_DECL_QUERYFRAME
+  NS_DECL_FRAMEARENA_HELPERS
 
   NS_IMETHOD HandlePress(nsPresContext* aPresContext,
                          nsGUIEvent *    aEvent,
                          nsEventStatus*  aEventStatus);
 
   NS_IMETHOD HandleMultiplePress(nsPresContext* aPresContext,
                                  nsGUIEvent *    aEvent,
                                  nsEventStatus*  aEventStatus,
--- a/layout/xul/base/src/nsSliderFrame.cpp
+++ b/layout/xul/base/src/nsSliderFrame.cpp
@@ -85,17 +85,19 @@ GetContentOfBox(nsIBox *aBox)
   NS_IF_ADDREF(content);
   return content;
 }
 
 nsIFrame*
 NS_NewSliderFrame (nsIPresShell* aPresShell, nsStyleContext* aContext)
 {
   return new (aPresShell) nsSliderFrame(aPresShell, aContext);
-} // NS_NewSliderFrame
+}
+
+NS_IMPL_FRAMEARENA_HELPERS(nsSliderFrame)
 
 nsSliderFrame::nsSliderFrame(nsIPresShell* aPresShell, nsStyleContext* aContext):
   nsBoxFrame(aPresShell, aContext),
   mCurPos(0),
   mChange(0),
   mUserChanged(PR_FALSE)
 {
 }
--- a/layout/xul/base/src/nsSliderFrame.h
+++ b/layout/xul/base/src/nsSliderFrame.h
@@ -110,16 +110,18 @@ public:
   NS_IMETHOD MouseOut(nsIDOMEvent* aMouseEvent) { return NS_OK; }
 
   NS_IMETHOD HandleEvent(nsIDOMEvent* aEvent) { return NS_OK; }
 };
 
 class nsSliderFrame : public nsBoxFrame
 {
 public:
+  NS_DECL_FRAMEARENA_HELPERS
+
   friend class nsSliderMediator;
 
   nsSliderFrame(nsIPresShell* aShell, nsStyleContext* aContext);
   virtual ~nsSliderFrame();
 
 #ifdef DEBUG
   NS_IMETHOD GetFrameName(nsAString& aResult) const {
     return MakeFrameName(NS_LITERAL_STRING("SliderFrame"), aResult);
--- a/layout/xul/base/src/nsSplitterFrame.cpp
+++ b/layout/xul/base/src/nsSplitterFrame.cpp
@@ -247,17 +247,19 @@ nsSplitterFrameInner::GetState()
 // NS_NewSplitterFrame
 //
 // Creates a new Toolbar frame and returns it
 //
 nsIFrame*
 NS_NewSplitterFrame (nsIPresShell* aPresShell, nsStyleContext* aContext)
 {
   return new (aPresShell) nsSplitterFrame(aPresShell, aContext);
-} // NS_NewSplitterFrame
+}
+
+NS_IMPL_FRAMEARENA_HELPERS(nsSplitterFrame)
 
 nsSplitterFrame::nsSplitterFrame(nsIPresShell* aPresShell, nsStyleContext* aContext)
 : nsBoxFrame(aPresShell, aContext),
   mInner(0)
 {
 }
 
 void
--- a/layout/xul/base/src/nsSplitterFrame.h
+++ b/layout/xul/base/src/nsSplitterFrame.h
@@ -47,16 +47,18 @@
 
 class nsSplitterFrameInner;
 
 nsIFrame* NS_NewSplitterFrame(nsIPresShell* aPresShell, nsStyleContext* aContext);
 
 class nsSplitterFrame : public nsBoxFrame
 {
 public:
+  NS_DECL_FRAMEARENA_HELPERS
+
   nsSplitterFrame(nsIPresShell* aPresShell, nsStyleContext* aContext);
   virtual void Destroy();
 
 #ifdef DEBUG
   NS_IMETHOD GetFrameName(nsAString& aResult) const {
     return MakeFrameName(NS_LITERAL_STRING("SplitterFrame"), aResult);
   }
 #endif
--- a/layout/xul/base/src/nsStackFrame.cpp
+++ b/layout/xul/base/src/nsStackFrame.cpp
@@ -53,17 +53,19 @@
 #include "nsBoxLayoutState.h"
 #include "nsStackLayout.h"
 #include "nsDisplayList.h"
 
 nsIFrame*
 NS_NewStackFrame(nsIPresShell* aPresShell, nsStyleContext* aContext)
 {
   return new (aPresShell) nsStackFrame(aPresShell, aContext);
-} // NS_NewStackFrame
+}
+
+NS_IMPL_FRAMEARENA_HELPERS(nsStackFrame)
 
 nsStackFrame::nsStackFrame(nsIPresShell* aPresShell, nsStyleContext* aContext):
   nsBoxFrame(aPresShell, aContext)
 {
   nsCOMPtr<nsIBoxLayout> layout;
   NS_NewStackLayout(aPresShell, layout);
   SetLayoutManager(layout);
 }
--- a/layout/xul/base/src/nsStackFrame.h
+++ b/layout/xul/base/src/nsStackFrame.h
@@ -46,16 +46,17 @@
 #ifndef nsStackFrame_h___
 #define nsStackFrame_h___
 
 #include "nsBoxFrame.h"
 
 class nsStackFrame : public nsBoxFrame
 {
 public:
+  NS_DECL_FRAMEARENA_HELPERS
 
   friend nsIFrame* NS_NewStackFrame(nsIPresShell* aPresShell,
                                     nsStyleContext* aContext);
 
 #ifdef NS_DEBUG
   NS_IMETHOD GetFrameName(nsAString& aResult) const
   {
     return MakeFrameName(NS_LITERAL_STRING("Stack"), aResult);
--- a/layout/xul/base/src/nsTextBoxFrame.cpp
+++ b/layout/xul/base/src/nsTextBoxFrame.cpp
@@ -102,17 +102,19 @@ PRBool nsTextBoxFrame::gInsertSeparatorP
 // NS_NewToolbarFrame
 //
 // Creates a new Toolbar frame and returns it
 //
 nsIFrame*
 NS_NewTextBoxFrame (nsIPresShell* aPresShell, nsStyleContext* aContext)
 {
     return new (aPresShell) nsTextBoxFrame (aPresShell, aContext);
-} // NS_NewTextFrame
+}
+
+NS_IMPL_FRAMEARENA_HELPERS(nsTextBoxFrame)
 
 
 NS_IMETHODIMP
 nsTextBoxFrame::AttributeChanged(PRInt32         aNameSpaceID,
                                  nsIAtom*        aAttribute,
                                  PRInt32         aModType)
 {
     mState |= NS_STATE_NEED_LAYOUT;
--- a/layout/xul/base/src/nsTextBoxFrame.h
+++ b/layout/xul/base/src/nsTextBoxFrame.h
@@ -42,16 +42,17 @@
 
 class nsAccessKeyInfo;
 class nsAsyncAccesskeyUpdate;
 
 typedef nsLeafBoxFrame nsTextBoxFrameSuper;
 class nsTextBoxFrame : public nsTextBoxFrameSuper
 {
 public:
+  NS_DECL_FRAMEARENA_HELPERS
 
   // nsIBox
   virtual nsSize GetPrefSize(nsBoxLayoutState& aBoxLayoutState);
   virtual nsSize GetMinSize(nsBoxLayoutState& aBoxLayoutState);
   virtual nscoord GetBoxAscent(nsBoxLayoutState& aBoxLayoutState);
   NS_IMETHOD DoLayout(nsBoxLayoutState& aBoxLayoutState);
   virtual void MarkIntrinsicWidthsDirty();
 
--- a/layout/xul/base/src/nsTitleBarFrame.cpp
+++ b/layout/xul/base/src/nsTitleBarFrame.cpp
@@ -58,17 +58,19 @@
 // NS_NewTitleBarFrame
 //
 // Creates a new TitleBar frame and returns it
 //
 nsIFrame*
 NS_NewTitleBarFrame(nsIPresShell* aPresShell, nsStyleContext* aContext)
 {
   return new (aPresShell) nsTitleBarFrame(aPresShell, aContext);
-} // NS_NewTitleBarFrame
+}
+
+NS_IMPL_FRAMEARENA_HELPERS(nsTitleBarFrame)
 
 nsTitleBarFrame::nsTitleBarFrame(nsIPresShell* aPresShell, nsStyleContext* aContext)
 :nsBoxFrame(aPresShell, aContext, PR_FALSE)
 {
   mTrackingMouseMove = PR_FALSE;
 }
 
 
--- a/layout/xul/base/src/nsTitleBarFrame.h
+++ b/layout/xul/base/src/nsTitleBarFrame.h
@@ -37,18 +37,19 @@
  * ***** END LICENSE BLOCK ***** */
 #ifndef nsTitleBarFrame_h___
 #define nsTitleBarFrame_h___
 
 #include "nsBoxFrame.h"
 
 class nsTitleBarFrame : public nsBoxFrame  
 {
+public:
+  NS_DECL_FRAMEARENA_HELPERS
 
-public:
   friend nsIFrame* NS_NewTitleBarFrame(nsIPresShell* aPresShell, nsStyleContext* aContext);  
 
   nsTitleBarFrame(nsIPresShell* aPresShell, nsStyleContext* aContext);
 
   NS_IMETHOD  Init(nsIContent*      aContent,
                    nsIFrame*        aParent,
                    nsIFrame*        asPrevInFlow);
 
--- a/layout/xul/base/src/nsXULLabelFrame.cpp
+++ b/layout/xul/base/src/nsXULLabelFrame.cpp
@@ -48,16 +48,18 @@ NS_NewXULLabelFrame(nsIPresShell* aPresS
   nsXULLabelFrame* it = new (aPresShell) nsXULLabelFrame(aContext);
   
   if (it)
     it->SetFlags(NS_BLOCK_FLOAT_MGR | NS_BLOCK_MARGIN_ROOT);
 
   return it;
 }
 
+NS_IMPL_FRAMEARENA_HELPERS(nsXULLabelFrame)
+
 // If you make changes to this function, check its counterparts 
 // in nsBoxFrame and nsTextBoxFrame
 nsresult
 nsXULLabelFrame::RegUnregAccessKey(PRBool aDoReg)
 {
   // if we have no content, we can't do anything
   if (!mContent)
     return NS_ERROR_FAILURE;
--- a/layout/xul/base/src/nsXULLabelFrame.h
+++ b/layout/xul/base/src/nsXULLabelFrame.h
@@ -44,16 +44,18 @@
 
 #ifndef MOZ_XUL
 #error "This file should not be included"
 #endif
 
 class nsXULLabelFrame : public nsBlockFrame
 {
 public:
+  NS_DECL_FRAMEARENA_HELPERS
+
   friend nsIFrame* NS_NewXULLabelFrame(nsIPresShell* aPresShell,
                                        nsStyleContext *aContext);
   
   // nsIFrame
   NS_IMETHOD Init(nsIContent*      aContent,
                   nsIFrame*        aParent,
                   nsIFrame*        aPrevInFlow);
 
--- a/layout/xul/base/src/tree/src/nsTreeBodyFrame.cpp
+++ b/layout/xul/base/src/tree/src/nsTreeBodyFrame.cpp
@@ -127,18 +127,19 @@ CancelImageRequest(const nsAString& aKey
 // NS_NewTreeFrame
 //
 // Creates a new tree frame
 //
 nsIFrame*
 NS_NewTreeBodyFrame(nsIPresShell* aPresShell, nsStyleContext* aContext)
 {
   return new (aPresShell) nsTreeBodyFrame(aPresShell, aContext);
-} // NS_NewTreeFrame
-
+}
+
+NS_IMPL_FRAMEARENA_HELPERS(nsTreeBodyFrame)
 
 NS_QUERYFRAME_HEAD(nsTreeBodyFrame)
   NS_QUERYFRAME_ENTRY(nsICSSPseudoComparator)
   NS_QUERYFRAME_ENTRY(nsIScrollbarMediator)
   NS_QUERYFRAME_ENTRY(nsTreeBodyFrame)
 NS_QUERYFRAME_TAIL_INHERITING(nsLeafBoxFrame)
 
 // Constructor
--- a/layout/xul/base/src/tree/src/nsTreeBodyFrame.h
+++ b/layout/xul/base/src/tree/src/nsTreeBodyFrame.h
@@ -82,19 +82,19 @@ class NS_FINAL_CLASS nsTreeBodyFrame
   , public nsICSSPseudoComparator
   , public nsIScrollbarMediator
   , public nsIReflowCallback
 {
 public:
   nsTreeBodyFrame(nsIPresShell* aPresShell, nsStyleContext* aContext);
   ~nsTreeBodyFrame();
 
-  NS_DECLARE_FRAME_ACCESSOR(nsTreeBodyFrame)
-
+  NS_DECL_QUERYFRAME_TARGET(nsTreeBodyFrame)
   NS_DECL_QUERYFRAME
+  NS_DECL_FRAMEARENA_HELPERS
 
   // non-virtual signatures like nsITreeBodyFrame
   nsresult GetColumns(nsITreeColumns **aColumns);
   nsresult GetView(nsITreeView **aView);
   nsresult SetView(nsITreeView *aView);
   nsresult GetFocused(PRBool *aFocused);
   nsresult SetFocused(PRBool aFocused);
   nsresult GetTreeBody(nsIDOMElement **aElement);
--- a/layout/xul/base/src/tree/src/nsTreeColFrame.cpp
+++ b/layout/xul/base/src/tree/src/nsTreeColFrame.cpp
@@ -57,17 +57,19 @@
 // NS_NewTreeColFrame
 //
 // Creates a new col frame
 //
 nsIFrame*
 NS_NewTreeColFrame(nsIPresShell* aPresShell, nsStyleContext* aContext)
 {
   return new (aPresShell) nsTreeColFrame(aPresShell, aContext);
-} // NS_NewTreeColFrame
+}
+
+NS_IMPL_FRAMEARENA_HELPERS(nsTreeColFrame)
 
 // Destructor
 nsTreeColFrame::~nsTreeColFrame()
 {
 }
 
 NS_IMETHODIMP
 nsTreeColFrame::Init(nsIContent*      aContent,
--- a/layout/xul/base/src/tree/src/nsTreeColFrame.h
+++ b/layout/xul/base/src/tree/src/nsTreeColFrame.h
@@ -41,16 +41,18 @@
 class nsITreeBoxObject;
 
 nsIFrame* NS_NewTreeColFrame(nsIPresShell* aPresShell, 
                              nsStyleContext* aContext);
 
 class nsTreeColFrame : public nsBoxFrame
 {
 public:
+  NS_DECL_FRAMEARENA_HELPERS
+
   nsTreeColFrame(nsIPresShell* aPresShell,
                  nsStyleContext* aContext):
     nsBoxFrame(aPresShell, aContext) {}
 
   NS_IMETHOD Init(nsIContent*      aContent,
                   nsIFrame*        aParent,
                   nsIFrame*        aPrevInFlow);
 
--- a/xpcom/base/nscore.h
+++ b/xpcom/base/nscore.h
@@ -33,31 +33,31 @@
  * the provisions above, a recipient may use your version of this file under
  * the terms of any one of the MPL, the GPL or the LGPL.
  *
  * ***** END LICENSE BLOCK ***** */
 #ifndef nscore_h___
 #define nscore_h___
 
 /**
- * Make sure that we have the proper platform specific 
+ * Make sure that we have the proper platform specific
  * c++ definitions needed by nscore.h
  */
 #ifndef _XPCOM_CONFIG_H_
 #include "xpcom-config.h"
 #endif
 
 /**
  * Incorporate the core NSPR data types which XPCOM uses.
  */
 #include "prtypes.h"
 
 /* Core XPCOM declarations. */
 
-/** 
+/**
  * Macros defining the target platform...
  */
 #ifdef _WIN32
 #define NS_WIN32 1
 
 #elif defined(__unix)
 #define NS_UNIX 1
 
@@ -140,32 +140,34 @@
  *  - __fastcall on windows should not be applied to class
  *    constructors/destructors - use the NS_CONSTRUCTOR_FASTCALL macro for
  *    constructors/destructors.
  *
  * Examples: int NS_FASTCALL func1(char *foo);
  *           NS_HIDDEN_(int) NS_FASTCALL func2(char *foo);
  */
 
-#if defined(__i386__) && defined(__GNUC__) && (__GNUC__ >= 3) && !defined(XP_OS2)
+#if defined(__i386__) && defined(__GNUC__) && \
+    (__GNUC__ >= 3) && !defined(XP_OS2)
 #define NS_FASTCALL __attribute__ ((regparm (3), stdcall))
 #define NS_CONSTRUCTOR_FASTCALL __attribute__ ((regparm (3), stdcall))
 #elif defined(XP_WIN)
 #define NS_FASTCALL __fastcall
 #define NS_CONSTRUCTOR_FASTCALL
 #else
 #define NS_FASTCALL
 #define NS_CONSTRUCTOR_FASTCALL
 #endif
 
 /*
  * NS_DEFCALL undoes the effect of a global regparm/stdcall setting
  * so that xptcall works correctly.
  */
-#if defined(__i386__) && defined(__GNUC__) && (__GNUC__ >= 3) && !defined(XP_OS2)
+#if defined(__i386__) && defined(__GNUC__) && \
+    (__GNUC__ >= 3) && !defined(XP_OS2)
 #define NS_DEFCALL __attribute__ ((regparm (0), cdecl))
 #else
 #define NS_DEFCALL
 #endif
 
 #ifdef NS_WIN32
 
 #define NS_IMPORT __declspec(dllimport)
@@ -393,34 +395,35 @@ typedef PRUint32 nsrefcnt;
   #if defined(HAVE_CPP_2BYTE_WCHAR_T) && defined(NS_WIN32)
     typedef wchar_t PRUnichar;
   #else
     typedef PRUint16 PRUnichar;
   #endif
 #endif
 
   /*
-    If the compiler doesn't support |explicit|, we'll just make it go away, trusting
-    that the builds under compilers that do have it will keep us on the straight and narrow.
+    If the compiler doesn't support |explicit|, we'll just make it go
+    away, trusting that the builds under compilers that do have it
+    will keep us on the straight and narrow.
   */
 #ifndef HAVE_CPP_EXPLICIT
   #define explicit
 #endif
 
 #ifndef HAVE_CPP_TYPENAME
   #define typename
 #endif
 
 #ifdef HAVE_CPP_MODERN_SPECIALIZE_TEMPLATE_SYNTAX
   #define NS_SPECIALIZE_TEMPLATE  template <>
 #else
   #define NS_SPECIALIZE_TEMPLATE
 #endif
 
-/* 
+/*
  * Use these macros to do 64bit safe pointer conversions.
  */
 
 #define NS_PTR_TO_INT32(x)  ((PRInt32)  (PRWord) (x))
 #define NS_PTR_TO_UINT32(x) ((PRUint32) (PRWord) (x))
 #define NS_INT32_TO_PTR(x)  ((void *)   (PRWord) (x))
 
 /*
@@ -450,44 +453,57 @@ typedef PRUint32 nsrefcnt;
 #define NS_LIKELY(x)    (__builtin_expect(!!(x), 1))
 #define NS_UNLIKELY(x)  (__builtin_expect(!!(x), 0))
 #else
 #define NS_LIKELY(x)    (!!(x))
 #define NS_UNLIKELY(x)  (!!(x))
 #endif
 
  /*
-  * If we're being linked as standalone glue, we don't want a dynamic dependency
-  * on NSPR libs, so we skip the debug thread-safety checks, and we cannot use
-  * the THREADSAFE_ISUPPORTS macros.
+  * If we're being linked as standalone glue, we don't want a dynamic
+  * dependency on NSPR libs, so we skip the debug thread-safety
+  * checks, and we cannot use the THREADSAFE_ISUPPORTS macros.
   */
 #if defined(XPCOM_GLUE) && !defined(XPCOM_GLUE_USE_NSPR)
 #define XPCOM_GLUE_AVOID_NSPR
 #endif
 
 /**
  * Static type annotations, enforced when static-checking is enabled:
  *
  * NS_STACK_CLASS: a class which must only be instantiated on the stack
  * NS_FINAL_CLASS: a class which may not be subclassed
+ *
+ * NS_MUST_OVERRIDE:
+ *   a method which every immediate subclass of this class must
+ *   override.  A subclass override can itself be NS_MUST_OVERRIDE, in
+ *   which case its own subclasses must override the method as well.
+ *
+ *   This is similar to, but not the same as, marking a method pure
+ *   virtual.  It has no effect on the class in which the annotation
+ *   appears, you can still provide a definition for the method, and
+ *   it objects to the mere existence of a subclass that doesn't
+ *   override the method.  See examples in analysis/must-override.js.
  */
 #ifdef NS_STATIC_CHECKING
 #define NS_STACK_CLASS __attribute__((user("NS_stack")))
 #define NS_OKONHEAP    __attribute__((user("NS_okonheap")))
 #define NS_SUPPRESS_STACK_CHECK __attribute__((user("NS_suppress_stackcheck")))
 #define NS_FINAL_CLASS __attribute__((user("NS_final")))
+#define NS_MUST_OVERRIDE __attribute__((user("NS_must_override")))
 #else
 #define NS_STACK_CLASS
 #define NS_OKONHEAP
 #define NS_SUPPRESS_STACK_CHECK
 #define NS_FINAL_CLASS
+#define NS_MUST_OVERRIDE
 #endif
 
 /**
- * Attributes defined to help Dehydra GCC analysis.	
+ * Attributes defined to help Dehydra GCC analysis.
  */
 #ifdef NS_STATIC_CHECKING
 # define NS_SCRIPTABLE __attribute__((user("NS_script")))
 # define NS_INPARAM __attribute__((user("NS_inparam")))
 # define NS_OUTPARAM  __attribute__((user("NS_outparam")))
 # define NS_INOUTPARAM __attribute__((user("NS_inoutparam")))
 #else
 # define NS_SCRIPTABLE