Merge from tracemonkey
authorLuke Wagner <lw@mozilla.com>
Tue, 11 May 2010 00:41:08 -0700
changeset 52523 57e7fc4ae81243865fee66ca364f3244686bbb04
parent 52522 a88154256ee0b5182ba4435c1b9b0511fcc7bbe0 (current diff)
parent 52519 44895016f99e9d67bdc30677fe66d3401062983c (diff)
child 52524 4d63fb08f0ad630bd9a3807de0fc0222ce0e681f
push idunknown
push userunknown
push dateunknown
milestone1.9.3a5pre
Merge from tracemonkey
accessible/public/nsIAccessibilityService.idl
accessible/src/html/nsHTMLAreaAccessible.cpp
accessible/src/html/nsHTMLAreaAccessible.h
browser/base/content/aboutSupport.xhtml
browser/components/places/content/utils.js
browser/components/places/tests/chrome/test_bug510634.xul
browser/components/places/tests/chrome/test_multiple_left_pane.xul
browser/locales/en-US/chrome/browser/aboutSupport.dtd
browser/themes/winstripe/browser/tabbrowser/tab-active-bkgnd.png
browser/themes/winstripe/browser/tabbrowser/tab-bkgnd.png
browser/themes/winstripe/browser/tabbrowser/tab-hover-bkgnd.png
content/base/public/nsIDragDropHandler.idl
content/events/public/nsIPrivateCompositionEvent.h
content/html/content/src/nsHTMLHeadElement.cpp
content/html/content/src/nsHTMLHtmlElement.cpp
content/html/document/crashtests/353713-1.html
content/media/ogg/nsChannelReader.cpp
content/media/ogg/nsChannelReader.h
content/media/ogg/nsOggHacks.h
content/xbl/test/test_bug398135.xhtml
docshell/test/browser/browser_bug550565.js
docshell/test/browser/file_bug550565_favicon.ico
docshell/test/browser/file_bug550565_popup.html
dom/interfaces/html/nsIDOMHTMLBaseFontElement.idl
dom/plugins/PluginPRLibrary.h
dom/tests/mochitest/ajax/lib/MochiKit_packed.js
dom/tests/mochitest/ajax/lib/SimpleTest.js
dom/tests/mochitest/dom-level2-html/files/basefont.html
dom/tests/mochitest/dom-level2-html/files/basefont.xhtml
dom/tests/mochitest/dom-level2-html/files/basefont.xml
dom/tests/mochitest/dom-level2-html/files/head.html
dom/tests/mochitest/dom-level2-html/files/head.xhtml
dom/tests/mochitest/dom-level2-html/files/head.xml
dom/tests/mochitest/dom-level2-html/test_HTMLBaseFontElement01.html
dom/tests/mochitest/dom-level2-html/test_HTMLBaseFontElement02.html
dom/tests/mochitest/dom-level2-html/test_HTMLBaseFontElement03.html
dom/tests/mochitest/dom-level2-html/test_HTMLHeadElement01.html
dom/tests/mochitest/dom-level2-html/test_basefont01.html
gfx/cairo/cairo/src/cairo-meta-surface.c
gfx/cairo/cairo/src/cairo-qpainter-surface.cpp
gfx/cairo/cairo/src/cairo-qpainter.h
gfx/cairo/cairo/src/cairo-skiplist-private.h
gfx/cairo/cairo/src/cairo-skiplist.c
gfx/cairo/pixman-neon.patch
gfx/layers/opengl/glWrapper.cpp
gfx/layers/opengl/glWrapper.h
gfx/thebes/public/gfxBlur.h
gfx/thebes/src/gfxBlur.cpp
ipc/app/mozilla-runtime.exe.manifest
js/jsd/jsd_scpt.c
js/jsd/jsd_xpc.cpp
js/src/jsapi.cpp
js/src/jsapi.h
js/src/jsarray.cpp
js/src/jsarray.h
js/src/jsatom.cpp
js/src/jsatom.h
js/src/jsbool.cpp
js/src/jsbool.h
js/src/jsbuiltins.cpp
js/src/jsbuiltins.h
js/src/jscntxt.cpp
js/src/jscntxt.h
js/src/jscntxtinlines.h
js/src/jsdate.cpp
js/src/jsdate.h
js/src/jsdbgapi.cpp
js/src/jsdbgapi.h
js/src/jsdtracef.cpp
js/src/jsdtracef.h
js/src/jsemit.cpp
js/src/jsemit.h
js/src/jsexn.cpp
js/src/jsfun.cpp
js/src/jsfun.h
js/src/jsgc.cpp
js/src/jsgc.h
js/src/jshashtable.h
js/src/jsinterp.cpp
js/src/jsinterp.h
js/src/jsiter.cpp
js/src/jsiter.h
js/src/jsnum.cpp
js/src/jsnum.h
js/src/jsobj.cpp
js/src/jsobj.h
js/src/jsobjinlines.h
js/src/jsopcode.cpp
js/src/jsopcode.h
js/src/jsops.cpp
js/src/jsparse.cpp
js/src/jsparse.h
js/src/jsprvtd.h
js/src/jsrecursion.cpp
js/src/jsregexp.cpp
js/src/jsregexp.h
js/src/jsscope.h
js/src/jsscopeinlines.h
js/src/jsscript.cpp
js/src/jsscript.h
js/src/jsstr.cpp
js/src/jsstr.h
js/src/jstl.h
js/src/jstracer.cpp
js/src/jstypedarray.h
js/src/jsutil.cpp
js/src/jsxml.cpp
js/src/jsxml.h
js/src/shell/js.cpp
js/src/tests/js1_5/decompilation/regress-355992.js
js/src/tests/js1_5/decompilation/regress-356248.js
js/src/tests/js1_5/extensions/regress-220584.js
js/src/tests/js1_5/extensions/regress-312278.js
js/src/tests/js1_5/extensions/regress-313630.js
js/src/tests/js1_5/extensions/regress-349616.js
js/src/tests/js1_5/extensions/regress-352060.js
js/src/tests/js1_5/extensions/regress-352094.js
js/src/tests/js1_5/extensions/regress-352455.js
js/src/tests/js1_5/extensions/regress-356085.js
js/src/tests/js1_5/extensions/regress-356106.js
js/src/tests/js1_5/extensions/regress-356378.js
js/src/tests/js1_5/extensions/regress-380831.js
js/src/tests/js1_5/extensions/regress-381205.js
js/src/tests/js1_5/extensions/regress-383965.js
js/src/tests/js1_5/extensions/regress-424257.js
js/src/tests/js1_5/extensions/regress-452372.js
js/src/tests/js1_7/decompilation/regress-381101.js
js/src/tests/js1_7/decompilation/regress-381108.js
js/src/tests/js1_7/extensions/regress-355578.js
js/src/tests/js1_7/extensions/regress-379482.js
js/src/trace-test/tests/basic/bug533705.js
js/src/trace-test/tests/basic/testBug532363.js
js/src/trace-test/tests/basic/testBug550210.js
js/src/xpconnect/src/XPCDispTearOff.cpp
js/src/xpconnect/src/xpcwrappedjsclass.cpp
js/src/xpconnect/tests/js/old/threads.js
layout/base/tests/chrome/bug396024_helper.xul
layout/base/tests/chrome/bug482976_helper.xul
layout/base/tests/chrome/test_bug396024.xul
layout/base/tests/chrome/test_bug482976.xul
layout/mathml/doc/Notes.txt
layout/mathml/doc/operator.txt
layout/mathml/mathml-css.pl
media/libfishsound/AUTHORS
media/libfishsound/COPYING
media/libfishsound/ChangeLog
media/libfishsound/Makefile.in
media/libfishsound/README
media/libfishsound/README_MOZILLA
media/libfishsound/bug487519.patch
media/libfishsound/bug520500.patch
media/libfishsound/endian.patch
media/libfishsound/fishsound_reset.patch
media/libfishsound/include/Makefile.in
media/libfishsound/include/fishsound/Makefile.in
media/libfishsound/include/fishsound/comments.h
media/libfishsound/include/fishsound/config.h
media/libfishsound/include/fishsound/constants.h
media/libfishsound/include/fishsound/decode.h
media/libfishsound/include/fishsound/deprecated.h
media/libfishsound/include/fishsound/encode.h
media/libfishsound/include/fishsound/fishsound.h
media/libfishsound/src/Makefile.in
media/libfishsound/src/libfishsound/Makefile.in
media/libfishsound/src/libfishsound/config.h
media/libfishsound/src/libfishsound/convert.h
media/libfishsound/src/libfishsound/convert_c.h
media/libfishsound/src/libfishsound/convert_oil.h
media/libfishsound/src/libfishsound/debug.h
media/libfishsound/src/libfishsound/fishsound.c
media/libfishsound/src/libfishsound/fishsound_comments.c
media/libfishsound/src/libfishsound/fishsound_decode.c
media/libfishsound/src/libfishsound/fishsound_encode.c
media/libfishsound/src/libfishsound/fishsound_flac.c
media/libfishsound/src/libfishsound/fishsound_speex.c
media/libfishsound/src/libfishsound/fishsound_vorbis.c
media/libfishsound/src/libfishsound/fs_compat.h
media/libfishsound/src/libfishsound/fs_vector.c
media/libfishsound/src/libfishsound/fs_vector.h
media/libfishsound/src/libfishsound/private.h
media/libfishsound/trac497.patch
media/libfishsound/update.sh
media/liboggplay/COPYING
media/liboggplay/Makefile.in
media/liboggplay/README
media/liboggplay/README_MOZILLA
media/liboggplay/aspect_ratio.patch
media/liboggplay/bug481921.patch
media/liboggplay/bug487519.patch
media/liboggplay/bug493678.patch
media/liboggplay/bug496529.patch
media/liboggplay/bug500311.patch
media/liboggplay/bug504843.patch
media/liboggplay/bug515217.patch
media/liboggplay/bug520493.patch
media/liboggplay/bug523816.patch
media/liboggplay/endian.patch
media/liboggplay/faster_seek.patch
media/liboggplay/fishsound_reset.patch
media/liboggplay/fix-17ef4ca82df28.patch
media/liboggplay/handle-read-errors.patch
media/liboggplay/include/Makefile.in
media/liboggplay/include/oggplay/Makefile.in
media/liboggplay/include/oggplay/config_win32.h
media/liboggplay/include/oggplay/oggplay.h
media/liboggplay/include/oggplay/oggplay_callback_info.h
media/liboggplay/include/oggplay/oggplay_enums.h
media/liboggplay/include/oggplay/oggplay_query.h
media/liboggplay/include/oggplay/oggplay_reader.h
media/liboggplay/include/oggplay/oggplay_seek.h
media/liboggplay/include/oggplay/oggplay_tools.h
media/liboggplay/liboggplay-199a8cea6c4fd6d.patch
media/liboggplay/oggplay_os2.patch
media/liboggplay/seek_to_key_frame.patch
media/liboggplay/src/Makefile.in
media/liboggplay/src/liboggplay/Makefile.in
media/liboggplay/src/liboggplay/config.h
media/liboggplay/src/liboggplay/cpu.c
media/liboggplay/src/liboggplay/cpu.h
media/liboggplay/src/liboggplay/oggplay.c
media/liboggplay/src/liboggplay/oggplay_buffer.c
media/liboggplay/src/liboggplay/oggplay_buffer.h
media/liboggplay/src/liboggplay/oggplay_callback.c
media/liboggplay/src/liboggplay/oggplay_callback.h
media/liboggplay/src/liboggplay/oggplay_callback_info.c
media/liboggplay/src/liboggplay/oggplay_data.c
media/liboggplay/src/liboggplay/oggplay_data.h
media/liboggplay/src/liboggplay/oggplay_file_reader.c
media/liboggplay/src/liboggplay/oggplay_file_reader.h
media/liboggplay/src/liboggplay/oggplay_private.h
media/liboggplay/src/liboggplay/oggplay_query.c
media/liboggplay/src/liboggplay/oggplay_seek.c
media/liboggplay/src/liboggplay/oggplay_tcp_reader.c
media/liboggplay/src/liboggplay/oggplay_tcp_reader.h
media/liboggplay/src/liboggplay/oggplay_tools.c
media/liboggplay/src/liboggplay/oggplay_yuv2rgb.c
media/liboggplay/src/liboggplay/oggplay_yuv2rgb_template.h
media/liboggplay/src/liboggplay/os2_semaphore.c
media/liboggplay/src/liboggplay/os2_semaphore.h
media/liboggplay/src/liboggplay/std_semaphore.h
media/liboggplay/src/liboggplay/x86/oggplay_yuv2rgb_x86.c
media/liboggplay/src/liboggplay/x86/yuv2rgb_x86.h
media/liboggplay/src/liboggplay/x86/yuv2rgb_x86_vs.h
media/liboggplay/update.sh
media/liboggz/AUTHORS
media/liboggz/COPYING
media/liboggz/ChangeLog
media/liboggz/Makefile.in
media/liboggz/README
media/liboggz/README_MOZILLA
media/liboggz/bug487519.patch
media/liboggz/bug496063.patch
media/liboggz/bug498380.patch
media/liboggz/bug504843.patch
media/liboggz/bug516847.patch
media/liboggz/bug518169.patch
media/liboggz/bug519155.patch
media/liboggz/bug520493.patch
media/liboggz/bug523335.patch
media/liboggz/bug526097.patch
media/liboggz/bug533822.patch
media/liboggz/faster_seek.patch
media/liboggz/include/Makefile.in
media/liboggz/include/oggz/Makefile.in
media/liboggz/include/oggz/config.h
media/liboggz/include/oggz/config_gcc.h
media/liboggz/include/oggz/config_win32.h
media/liboggz/include/oggz/oggz.h
media/liboggz/include/oggz/oggz_comments.h
media/liboggz/include/oggz/oggz_constants.h
media/liboggz/include/oggz/oggz_deprecated.h
media/liboggz/include/oggz/oggz_io.h
media/liboggz/include/oggz/oggz_off_t.h
media/liboggz/include/oggz/oggz_off_t_generated.h
media/liboggz/include/oggz/oggz_read.h
media/liboggz/include/oggz/oggz_seek.h
media/liboggz/include/oggz/oggz_stream.h
media/liboggz/include/oggz/oggz_table.h
media/liboggz/include/oggz/oggz_write.h
media/liboggz/key_frame_seek.patch
media/liboggz/offset_next.patch
media/liboggz/oggz_os2.patch
media/liboggz/seek.patch
media/liboggz/src/Makefile.in
media/liboggz/src/liboggz/Makefile.in
media/liboggz/src/liboggz/dirac.c
media/liboggz/src/liboggz/dirac.h
media/liboggz/src/liboggz/metric_internal.c
media/liboggz/src/liboggz/oggz.c
media/liboggz/src/liboggz/oggz_auto.c
media/liboggz/src/liboggz/oggz_auto.h
media/liboggz/src/liboggz/oggz_byteorder.h
media/liboggz/src/liboggz/oggz_comments.c
media/liboggz/src/liboggz/oggz_compat.h
media/liboggz/src/liboggz/oggz_dlist.c
media/liboggz/src/liboggz/oggz_dlist.h
media/liboggz/src/liboggz/oggz_io.c
media/liboggz/src/liboggz/oggz_macros.h
media/liboggz/src/liboggz/oggz_private.h
media/liboggz/src/liboggz/oggz_read.c
media/liboggz/src/liboggz/oggz_seek.c
media/liboggz/src/liboggz/oggz_stream.c
media/liboggz/src/liboggz/oggz_stream.h
media/liboggz/src/liboggz/oggz_stream_private.h
media/liboggz/src/liboggz/oggz_table.c
media/liboggz/src/liboggz/oggz_vector.c
media/liboggz/src/liboggz/oggz_vector.h
media/liboggz/src/liboggz/oggz_write.c
media/liboggz/update.sh
media/liboggz/wince.patch
parser/html/nsAHtml5EncodingDeclarationHandler.h
testing/mochitest/tests/FakeJSAN.js
testing/mochitest/tests/cli.js
testing/mochitest/tests/standalone.js
testing/mochitest/tests/test_Base.js
testing/mochitest/tests/test_Color.js
testing/mochitest/tests/test_DateTime.js
testing/mochitest/tests/test_DragAndDrop.js
testing/mochitest/tests/test_Format.js
testing/mochitest/tests/test_Iter.js
testing/mochitest/tests/test_Logging.js
testing/mochitest/tests/test_MochiKit-Async.html
testing/mochitest/tests/test_MochiKit-Async.json
testing/mochitest/tests/test_MochiKit-Base.html
testing/mochitest/tests/test_MochiKit-Color.html
testing/mochitest/tests/test_MochiKit-DOM.html
testing/mochitest/tests/test_MochiKit-DateTime.html
testing/mochitest/tests/test_MochiKit-DragAndDrop.html
testing/mochitest/tests/test_MochiKit-Format.html
testing/mochitest/tests/test_MochiKit-Iter.html
testing/mochitest/tests/test_MochiKit-JSAN.html
testing/mochitest/tests/test_MochiKit-Logging.html
testing/mochitest/tests/test_MochiKit-MochiKit.html
testing/mochitest/tests/test_MochiKit-Signal.html
testing/mochitest/tests/test_MochiKit-Style.html
testing/mochitest/tests/test_MochiKit-Visual.html
testing/mochitest/tests/test_Signal.js
toolkit/content/tests/chrome/bug437844.css
toolkit/content/tests/chrome/bug437844.dtd
toolkit/content/tests/chrome/bug437844.manifest
toolkit/content/tests/widgets/test_focus.xul
toolkit/crashreporter/client/crashreporter_unix.cpp
toolkit/mozapps/downloads/tests/chrome/test_unkownContentType_dialog_layout.xul
toolkit/themes/pinstripe/global/splitter/grip-hrz-after.gif
toolkit/themes/pinstripe/global/splitter/grip-hrz-before.gif
toolkit/themes/pinstripe/global/splitter/grip-vrt-after.gif
toolkit/themes/pinstripe/global/splitter/grip-vrt-before.gif
toolkit/themes/winstripe/global/splitter/grip-hrz-after.gif
toolkit/themes/winstripe/global/splitter/grip-hrz-before.gif
toolkit/themes/winstripe/global/splitter/grip-vrt-after.gif
toolkit/themes/winstripe/global/splitter/grip-vrt-before.gif
xpcom/glue/functexcept.h
xpfe/components/find/Makefile.in
xpfe/components/find/public/Makefile.in
xpfe/components/find/public/nsIFindService.idl
xpfe/components/find/src/Makefile.in
xpfe/components/find/src/nsFindModule.cpp
xpfe/components/find/src/nsFindService.cpp
xpfe/components/find/src/nsFindService.h
xpfe/components/intl/Makefile.in
xpfe/components/intl/nsCharsetMenu.cpp
xpfe/components/intl/nsCharsetMenu.h
--- a/.hgignore
+++ b/.hgignore
@@ -1,14 +1,14 @@
 # .hgignore - List of filenames hg should ignore
 
 # Filenames that should be ignored wherever they appear
 ~$
 \.py(c|o)$
-(^|/)TAGS$
+(?i)(^|/)TAGS$
 (^|/)ID$
 (^|/)\.DS_Store$
 
 # User files that may appear at the root
 ^\.mozconfig
 ^mozconfig
 ^configure$
 ^config\.cache$
--- a/LICENSE
+++ b/LICENSE
@@ -1,567 +1,9 @@
-                          MOZILLA PUBLIC LICENSE
-                                Version 1.1
-
-                              ---------------
-
-1. Definitions.
-
-     1.0.1. "Commercial Use" means distribution or otherwise making the
-     Covered Code available to a third party.
-
-     1.1. "Contributor" means each entity that creates or contributes to
-     the creation of Modifications.
-
-     1.2. "Contributor Version" means the combination of the Original
-     Code, prior Modifications used by a Contributor, and the Modifications
-     made by that particular Contributor.
-
-     1.3. "Covered Code" means the Original Code or Modifications or the
-     combination of the Original Code and Modifications, in each case
-     including portions thereof.
-
-     1.4. "Electronic Distribution Mechanism" means a mechanism generally
-     accepted in the software development community for the electronic
-     transfer of data.
-
-     1.5. "Executable" means Covered Code in any form other than Source
-     Code.
-
-     1.6. "Initial Developer" means the individual or entity identified
-     as the Initial Developer in the Source Code notice required by Exhibit
-     A.
-
-     1.7. "Larger Work" means a work which combines Covered Code or
-     portions thereof with code not governed by the terms of this License.
-
-     1.8. "License" means this document.
-
-     1.8.1. "Licensable" means having the right to grant, to the maximum
-     extent possible, whether at the time of the initial grant or
-     subsequently acquired, any and all of the rights conveyed herein.
-
-     1.9. "Modifications" means any addition to or deletion from the
-     substance or structure of either the Original Code or any previous
-     Modifications. When Covered Code is released as a series of files, a
-     Modification is:
-          A. Any addition to or deletion from the contents of a file
-          containing Original Code or previous Modifications.
-
-          B. Any new file that contains any part of the Original Code or
-          previous Modifications.
-
-     1.10. "Original Code" means Source Code of computer software code
-     which is described in the Source Code notice required by Exhibit A as
-     Original Code, and which, at the time of its release under this
-     License is not already Covered Code governed by this License.
-
-     1.10.1. "Patent Claims" means any patent claim(s), now owned or
-     hereafter acquired, including without limitation, method, process,
-     and apparatus claims, in any patent Licensable by grantor.
-
-     1.11. "Source Code" means the preferred form of the Covered Code for
-     making modifications to it, including all modules it contains, plus
-     any associated interface definition files, scripts used to control
-     compilation and installation of an Executable, or source code
-     differential comparisons against either the Original Code or another
-     well known, available Covered Code of the Contributor's choice. The
-     Source Code can be in a compressed or archival form, provided the
-     appropriate decompression or de-archiving software is widely available
-     for no charge.
-
-     1.12. "You" (or "Your") means an individual or a legal entity
-     exercising rights under, and complying with all of the terms of, this
-     License or a future version of this License issued under Section 6.1.
-     For legal entities, "You" includes any entity which controls, is
-     controlled by, or is under common control with You. For purposes of
-     this definition, "control" means (a) the power, direct or indirect,
-     to cause the direction or management of such entity, whether by
-     contract or otherwise, or (b) ownership of more than fifty percent
-     (50%) of the outstanding shares or beneficial ownership of such
-     entity.
-
-2. Source Code License.
-
-     2.1. The Initial Developer Grant.
-     The Initial Developer hereby grants You a world-wide, royalty-free,
-     non-exclusive license, subject to third party intellectual property
-     claims:
-          (a) under intellectual property rights (other than patent or
-          trademark) Licensable by Initial Developer to use, reproduce,
-          modify, display, perform, sublicense and distribute the Original
-          Code (or portions thereof) with or without Modifications, and/or
-          as part of a Larger Work; and
-
-          (b) under Patents Claims infringed by the making, using or
-          selling of Original Code, to make, have made, use, practice,
-          sell, and offer for sale, and/or otherwise dispose of the
-          Original Code (or portions thereof).
-
-          (c) the licenses granted in this Section 2.1(a) and (b) are
-          effective on the date Initial Developer first distributes
-          Original Code under the terms of this License.
-
-          (d) Notwithstanding Section 2.1(b) above, no patent license is
-          granted: 1) for code that You delete from the Original Code; 2)
-          separate from the Original Code; or 3) for infringements caused
-          by: i) the modification of the Original Code or ii) the
-          combination of the Original Code with other software or devices.
-
-     2.2. Contributor Grant.
-     Subject to third party intellectual property claims, each Contributor
-     hereby grants You a world-wide, royalty-free, non-exclusive license
-
-          (a) under intellectual property rights (other than patent or
-          trademark) Licensable by Contributor, to use, reproduce, modify,
-          display, perform, sublicense and distribute the Modifications
-          created by such Contributor (or portions thereof) either on an
-          unmodified basis, with other Modifications, as Covered Code
-          and/or as part of a Larger Work; and
-
-          (b) under Patent Claims infringed by the making, using, or
-          selling of Modifications made by that Contributor either alone
-          and/or in combination with its Contributor Version (or portions
-          of such combination), to make, use, sell, offer for sale, have
-          made, and/or otherwise dispose of: 1) Modifications made by that
-          Contributor (or portions thereof); and 2) the combination of
-          Modifications made by that Contributor with its Contributor
-          Version (or portions of such combination).
-
-          (c) the licenses granted in Sections 2.2(a) and 2.2(b) are
-          effective on the date Contributor first makes Commercial Use of
-          the Covered Code.
-
-          (d) Notwithstanding Section 2.2(b) above, no patent license is
-          granted: 1) for any code that Contributor has deleted from the
-          Contributor Version; 2) separate from the Contributor Version;
-          3) for infringements caused by: i) third party modifications of
-          Contributor Version or ii) the combination of Modifications made
-          by that Contributor with other software (except as part of the
-          Contributor Version) or other devices; or 4) under Patent Claims
-          infringed by Covered Code in the absence of Modifications made by
-          that Contributor.
-
-3. Distribution Obligations.
-
-     3.1. Application of License.
-     The Modifications which You create or to which You contribute are
-     governed by the terms of this License, including without limitation
-     Section 2.2. The Source Code version of Covered Code may be
-     distributed only under the terms of this License or a future version
-     of this License released under Section 6.1, and You must include a
-     copy of this License with every copy of the Source Code You
-     distribute. You may not offer or impose any terms on any Source Code
-     version that alters or restricts the applicable version of this
-     License or the recipients' rights hereunder. However, You may include
-     an additional document offering the additional rights described in
-     Section 3.5.
-
-     3.2. Availability of Source Code.
-     Any Modification which You create or to which You contribute must be
-     made available in Source Code form under the terms of this License
-     either on the same media as an Executable version or via an accepted
-     Electronic Distribution Mechanism to anyone to whom you made an
-     Executable version available; and if made available via Electronic
-     Distribution Mechanism, must remain available for at least twelve (12)
-     months after the date it initially became available, or at least six
-     (6) months after a subsequent version of that particular Modification
-     has been made available to such recipients. You are responsible for
-     ensuring that the Source Code version remains available even if the
-     Electronic Distribution Mechanism is maintained by a third party.
-
-     3.3. Description of Modifications.
-     You must cause all Covered Code to which You contribute to contain a
-     file documenting the changes You made to create that Covered Code and
-     the date of any change. You must include a prominent statement that
-     the Modification is derived, directly or indirectly, from Original
-     Code provided by the Initial Developer and including the name of the
-     Initial Developer in (a) the Source Code, and (b) in any notice in an
-     Executable version or related documentation in which You describe the
-     origin or ownership of the Covered Code.
-
-     3.4. Intellectual Property Matters
-          (a) Third Party Claims.
-          If Contributor has knowledge that a license under a third party's
-          intellectual property rights is required to exercise the rights
-          granted by such Contributor under Sections 2.1 or 2.2,
-          Contributor must include a text file with the Source Code
-          distribution titled "LEGAL" which describes the claim and the
-          party making the claim in sufficient detail that a recipient will
-          know whom to contact. If Contributor obtains such knowledge after
-          the Modification is made available as described in Section 3.2,
-          Contributor shall promptly modify the LEGAL file in all copies
-          Contributor makes available thereafter and shall take other steps
-          (such as notifying appropriate mailing lists or newsgroups)
-          reasonably calculated to inform those who received the Covered
-          Code that new knowledge has been obtained.
-
-          (b) Contributor APIs.
-          If Contributor's Modifications include an application programming
-          interface and Contributor has knowledge of patent licenses which
-          are reasonably necessary to implement that API, Contributor must
-          also include this information in the LEGAL file.
-
-          (c) Representations.
-          Contributor represents that, except as disclosed pursuant to
-          Section 3.4(a) above, Contributor believes that Contributor's
-          Modifications are Contributor's original creation(s) and/or
-          Contributor has sufficient rights to grant the rights conveyed by
-          this License.
-
-     3.5. Required Notices.
-     You must duplicate the notice in Exhibit A in each file of the Source
-     Code. If it is not possible to put such notice in a particular Source
-     Code file due to its structure, then You must include such notice in a
-     location (such as a relevant directory) where a user would be likely
-     to look for such a notice. If You created one or more Modification(s)
-     You may add your name as a Contributor to the notice described in
-     Exhibit A. You must also duplicate this License in any documentation
-     for the Source Code where You describe recipients' rights or ownership
-     rights relating to Covered Code. You may choose to offer, and to
-     charge a fee for, warranty, support, indemnity or liability
-     obligations to one or more recipients of Covered Code. However, You
-     may do so only on Your own behalf, and not on behalf of the Initial
-     Developer or any Contributor. You must make it absolutely clear than
-     any such warranty, support, indemnity or liability obligation is
-     offered by You alone, and You hereby agree to indemnify the Initial
-     Developer and every Contributor for any liability incurred by the
-     Initial Developer or such Contributor as a result of warranty,
-     support, indemnity or liability terms You offer.
-
-     3.6. Distribution of Executable Versions.
-     You may distribute Covered Code in Executable form only if the
-     requirements of Section 3.1-3.5 have been met for that Covered Code,
-     and if You include a notice stating that the Source Code version of
-     the Covered Code is available under the terms of this License,
-     including a description of how and where You have fulfilled the
-     obligations of Section 3.2. The notice must be conspicuously included
-     in any notice in an Executable version, related documentation or
-     collateral in which You describe recipients' rights relating to the
-     Covered Code. You may distribute the Executable version of Covered
-     Code or ownership rights under a license of Your choice, which may
-     contain terms different from this License, provided that You are in
-     compliance with the terms of this License and that the license for the
-     Executable version does not attempt to limit or alter the recipient's
-     rights in the Source Code version from the rights set forth in this
-     License. If You distribute the Executable version under a different
-     license You must make it absolutely clear that any terms which differ
-     from this License are offered by You alone, not by the Initial
-     Developer or any Contributor. You hereby agree to indemnify the
-     Initial Developer and every Contributor for any liability incurred by
-     the Initial Developer or such Contributor as a result of any such
-     terms You offer.
-
-     3.7. Larger Works.
-     You may create a Larger Work by combining Covered Code with other code
-     not governed by the terms of this License and distribute the Larger
-     Work as a single product. In such a case, You must make sure the
-     requirements of this License are fulfilled for the Covered Code.
-
-4. Inability to Comply Due to Statute or Regulation.
-
-     If it is impossible for You to comply with any of the terms of this
-     License with respect to some or all of the Covered Code due to
-     statute, judicial order, or regulation then You must: (a) comply with
-     the terms of this License to the maximum extent possible; and (b)
-     describe the limitations and the code they affect. Such description
-     must be included in the LEGAL file described in Section 3.4 and must
-     be included with all distributions of the Source Code. Except to the
-     extent prohibited by statute or regulation, such description must be
-     sufficiently detailed for a recipient of ordinary skill to be able to
-     understand it.
-
-5. Application of this License.
-
-     This License applies to code to which the Initial Developer has
-     attached the notice in Exhibit A and to related Covered Code.
-
-6. Versions of the License.
-
-     6.1. New Versions.
-     Netscape Communications Corporation ("Netscape") may publish revised
-     and/or new versions of the License from time to time. Each version
-     will be given a distinguishing version number.
+Please see the file toolkit/content/license.html for the copyright licensing
+conditions attached to this codebase, including copies of the licenses
+concerned.
 
-     6.2. Effect of New Versions.
-     Once Covered Code has been published under a particular version of the
-     License, You may always continue to use it under the terms of that
-     version. You may also choose to use such Covered Code under the terms
-     of any subsequent version of the License published by Netscape. No one
-     other than Netscape has the right to modify the terms applicable to
-     Covered Code created under this License.
-
-     6.3. Derivative Works.
-     If You create or use a modified version of this License (which you may
-     only do in order to apply it to code which is not already Covered Code
-     governed by this License), You must (a) rename Your license so that
-     the phrases "Mozilla", "MOZILLAPL", "MOZPL", "Netscape",
-     "MPL", "NPL" or any confusingly similar phrase do not appear in your
-     license (except to note that your license differs from this License)
-     and (b) otherwise make it clear that Your version of the license
-     contains terms which differ from the Mozilla Public License and
-     Netscape Public License. (Filling in the name of the Initial
-     Developer, Original Code or Contributor in the notice described in
-     Exhibit A shall not of themselves be deemed to be modifications of
-     this License.)
-
-7. DISCLAIMER OF WARRANTY.
-
-     COVERED CODE IS PROVIDED UNDER THIS LICENSE ON AN "AS IS" BASIS,
-     WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING,
-     WITHOUT LIMITATION, WARRANTIES THAT THE COVERED CODE IS FREE OF
-     DEFECTS, MERCHANTABLE, FIT FOR A PARTICULAR PURPOSE OR NON-INFRINGING.
-     THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE COVERED CODE
-     IS WITH YOU. SHOULD ANY COVERED CODE PROVE DEFECTIVE IN ANY RESPECT,
-     YOU (NOT THE INITIAL DEVELOPER OR ANY OTHER CONTRIBUTOR) ASSUME THE
-     COST OF ANY NECESSARY SERVICING, REPAIR OR CORRECTION. THIS DISCLAIMER
-     OF WARRANTY CONSTITUTES AN ESSENTIAL PART OF THIS LICENSE. NO USE OF
-     ANY COVERED CODE IS AUTHORIZED HEREUNDER EXCEPT UNDER THIS DISCLAIMER.
-
-8. TERMINATION.
-
-     8.1. This License and the rights granted hereunder will terminate
-     automatically if You fail to comply with terms herein and fail to cure
-     such breach within 30 days of becoming aware of the breach. All
-     sublicenses to the Covered Code which are properly granted shall
-     survive any termination of this License. Provisions which, by their
-     nature, must remain in effect beyond the termination of this License
-     shall survive.
-
-     8.2. If You initiate litigation by asserting a patent infringement
-     claim (excluding declatory judgment actions) against Initial Developer
-     or a Contributor (the Initial Developer or Contributor against whom
-     You file such action is referred to as "Participant") alleging that:
-
-     (a) such Participant's Contributor Version directly or indirectly
-     infringes any patent, then any and all rights granted by such
-     Participant to You under Sections 2.1 and/or 2.2 of this License
-     shall, upon 60 days notice from Participant terminate prospectively,
-     unless if within 60 days after receipt of notice You either: (i)
-     agree in writing to pay Participant a mutually agreeable reasonable
-     royalty for Your past and future use of Modifications made by such
-     Participant, or (ii) withdraw Your litigation claim with respect to
-     the Contributor Version against such Participant. If within 60 days
-     of notice, a reasonable royalty and payment arrangement are not
-     mutually agreed upon in writing by the parties or the litigation claim
-     is not withdrawn, the rights granted by Participant to You under
-     Sections 2.1 and/or 2.2 automatically terminate at the expiration of
-     the 60 day notice period specified above.
-
-     (b) any software, hardware, or device, other than such Participant's
-     Contributor Version, directly or indirectly infringes any patent, then
-     any rights granted to You by such Participant under Sections 2.1(b)
-     and 2.2(b) are revoked effective as of the date You first made, used,
-     sold, distributed, or had made, Modifications made by that
-     Participant.
-
-     8.3. If You assert a patent infringement claim against Participant
-     alleging that such Participant's Contributor Version directly or
-     indirectly infringes any patent where such claim is resolved (such as
-     by license or settlement) prior to the initiation of patent
-     infringement litigation, then the reasonable value of the licenses
-     granted by such Participant under Sections 2.1 or 2.2 shall be taken
-     into account in determining the amount or value of any payment or
-     license.
-
-     8.4. In the event of termination under Sections 8.1 or 8.2 above,
-     all end user license agreements (excluding distributors and resellers)
-     which have been validly granted by You or any distributor hereunder
-     prior to termination shall survive termination.
-
-9. LIMITATION OF LIABILITY.
-
-     UNDER NO CIRCUMSTANCES AND UNDER NO LEGAL THEORY, WHETHER TORT
-     (INCLUDING NEGLIGENCE), CONTRACT, OR OTHERWISE, SHALL YOU, THE INITIAL
-     DEVELOPER, ANY OTHER CONTRIBUTOR, OR ANY DISTRIBUTOR OF COVERED CODE,
-     OR ANY SUPPLIER OF ANY OF SUCH PARTIES, BE LIABLE TO ANY PERSON FOR
-     ANY INDIRECT, SPECIAL, INCIDENTAL, OR CONSEQUENTIAL DAMAGES OF ANY
-     CHARACTER INCLUDING, WITHOUT LIMITATION, DAMAGES FOR LOSS OF GOODWILL,
-     WORK STOPPAGE, COMPUTER FAILURE OR MALFUNCTION, OR ANY AND ALL OTHER
-     COMMERCIAL DAMAGES OR LOSSES, EVEN IF SUCH PARTY SHALL HAVE BEEN
-     INFORMED OF THE POSSIBILITY OF SUCH DAMAGES. THIS LIMITATION OF
-     LIABILITY SHALL NOT APPLY TO LIABILITY FOR DEATH OR PERSONAL INJURY
-     RESULTING FROM SUCH PARTY'S NEGLIGENCE TO THE EXTENT APPLICABLE LAW
-     PROHIBITS SUCH LIMITATION. SOME JURISDICTIONS DO NOT ALLOW THE
-     EXCLUSION OR LIMITATION OF INCIDENTAL OR CONSEQUENTIAL DAMAGES, SO
-     THIS EXCLUSION AND LIMITATION MAY NOT APPLY TO YOU.
-
-10. U.S. GOVERNMENT END USERS.
-
-     The Covered Code is a "commercial item," as that term is defined in
-     48 C.F.R. 2.101 (Oct. 1995), consisting of "commercial computer
-     software" and "commercial computer software documentation," as such
-     terms are used in 48 C.F.R. 12.212 (Sept. 1995). Consistent with 48
-     C.F.R. 12.212 and 48 C.F.R. 227.7202-1 through 227.7202-4 (June 1995),
-     all U.S. Government End Users acquire Covered Code with only those
-     rights set forth herein.
-
-11. MISCELLANEOUS.
-
-     This License represents the complete agreement concerning subject
-     matter hereof. If any provision of this License is held to be
-     unenforceable, such provision shall be reformed only to the extent
-     necessary to make it enforceable. This License shall be governed by
-     California law provisions (except to the extent applicable law, if
-     any, provides otherwise), excluding its conflict-of-law provisions.
-     With respect to disputes in which at least one party is a citizen of,
-     or an entity chartered or registered to do business in the United
-     States of America, any litigation relating to this License shall be
-     subject to the jurisdiction of the Federal Courts of the Northern
-     District of California, with venue lying in Santa Clara County,
-     California, with the losing party responsible for costs, including
-     without limitation, court costs and reasonable attorneys' fees and
-     expenses. The application of the United Nations Convention on
-     Contracts for the International Sale of Goods is expressly excluded.
-     Any law or regulation which provides that the language of a contract
-     shall be construed against the drafter shall not apply to this
-     License.
-
-12. RESPONSIBILITY FOR CLAIMS.
+You are not granted rights or licenses to the trademarks of the
+Mozilla Foundation or any party, including without limitation the
+Firefox name or logo.
 
-     As between Initial Developer and the Contributors, each party is
-     responsible for claims and damages arising, directly or indirectly,
-     out of its utilization of rights under this License and You agree to
-     work with Initial Developer and Contributors to distribute such
-     responsibility on an equitable basis. Nothing herein is intended or
-     shall be deemed to constitute any admission of liability.
-
-13. MULTIPLE-LICENSED CODE.
-
-     Initial Developer may designate portions of the Covered Code as
-     "Multiple-Licensed". "Multiple-Licensed" means that the Initial
-     Developer permits you to utilize portions of the Covered Code under
-     Your choice of the NPL or the alternative licenses, if any, specified
-     by the Initial Developer in the file described in Exhibit A.
-
-EXHIBIT A -Mozilla Public License.
-
-     ``The contents of this file are subject to the Mozilla Public License
-     Version 1.1 (the "License"); you may not use this file except in
-     compliance with the License. You may obtain a copy of the License at
-     http://www.mozilla.org/MPL/
-
-     Software distributed under the License is distributed on an "AS IS"
-     basis, WITHOUT WARRANTY OF ANY KIND, either express or implied. See the
-     License for the specific language governing rights and limitations
-     under the License.
-
-     The Original Code is ______________________________________.
-
-     The Initial Developer of the Original Code is ________________________.
-     Portions created by ______________________ are Copyright (C) ______
-     _______________________. All Rights Reserved.
-
-     Contributor(s): ______________________________________.
-
-     Alternatively, the contents of this file may be used under the terms
-     of the _____ license (the "[___] License"), in which case the
-     provisions of [______] License are applicable instead of those
-     above. If you wish to allow use of your version of this file only
-     under the terms of the [____] License and not to allow others to use
-     your version of this file under the MPL, indicate your decision by
-     deleting the provisions above and replace them with the notice and
-     other provisions required by the [___] License. If you do not delete
-     the provisions above, a recipient may use your version of this file
-     under either the MPL or the [___] License."
-
-     [NOTE: The text of this Exhibit A may differ slightly from the text of
-     the notices in the Source Code files of the Original Code. You should
-     use the text of this Exhibit A rather than the text found in the
-     Original Code Source Code for Your Modifications.]
-
-     ----------------------------------------------------------------------
-
-     AMENDMENTS
-
-     The Netscape Public License Version 1.1 ("NPL") consists of the
-     Mozilla Public License Version 1.1 with the following Amendments,
-     including Exhibit A-Netscape Public License. Files identified with
-     "Exhibit A-Netscape Public License" are governed by the Netscape
-     Public License Version 1.1.
-
-     Additional Terms applicable to the Netscape Public License.
-          I. Effect.
-          These additional terms described in this Netscape Public
-          License -- Amendments shall apply to the Mozilla Communicator
-          client code and to all Covered Code under this License.
-
-          II. "Netscape's Branded Code" means Covered Code that Netscape
-          distributes and/or permits others to distribute under one or more
-          trademark(s) which are controlled by Netscape but which are not
-          licensed for use under this License.
-
-          III. Netscape and logo.
-          This License does not grant any rights to use the trademarks
-          "Netscape", the "Netscape N and horizon" logo or the "Netscape
-          lighthouse" logo, "Netcenter", "Gecko", "Java" or "JavaScript",
-          "Smart Browsing" even if such marks are included in the Original
-          Code or Modifications.
-
-          IV. Inability to Comply Due to Contractual Obligation.
-          Prior to licensing the Original Code under this License, Netscape
-          has licensed third party code for use in Netscape's Branded Code.
-          To the extent that Netscape is limited contractually from making
-          such third party code available under this License, Netscape may
-          choose to reintegrate such code into Covered Code without being
-          required to distribute such code in Source Code form, even if
-          such code would otherwise be considered "Modifications" under
-          this License.
-
-          V. Use of Modifications and Covered Code by Initial Developer.
-               V.1. In General.
-               The obligations of Section 3 apply to Netscape, except to
-               the extent specified in this Amendment, Section V.2 and V.3.
-
-               V.2. Other Products.
-               Netscape may include Covered Code in products other than the
-               Netscape's Branded Code which are released by Netscape
-               during the two (2) years following the release date of the
-               Original Code, without such additional products becoming
-               subject to the terms of this License, and may license such
-               additional products on different terms from those contained
-               in this License.
-
-               V.3. Alternative Licensing.
-               Netscape may license the Source Code of Netscape's Branded
-               Code, including Modifications incorporated therein, without
-               such Netscape Branded Code becoming subject to the terms of
-               this License, and may license such Netscape Branded Code on
-               different terms from those contained in this License.
-
-          VI. Litigation.
-          Notwithstanding the limitations of Section 11 above, the
-          provisions regarding litigation in Section 11(a), (b) and (c) of
-          the License shall apply to all disputes relating to this License.
-
-     EXHIBIT A-Netscape Public License.
-
-          "The contents of this file are subject to the Netscape Public
-          License Version 1.1 (the "License"); you may not use this file
-          except in compliance with the License. You may obtain a copy of
-          the License at http://www.mozilla.org/NPL/
-
-          Software distributed under the License is distributed on an "AS
-          IS" basis, WITHOUT WARRANTY OF ANY KIND, either express or
-          implied. See the License for the specific language governing
-          rights and limitations under the License.
-
-          The Original Code is Mozilla Communicator client code, released
-          March 31, 1998.
-
-          The Initial Developer of the Original Code is Netscape
-          Communications Corporation. Portions created by Netscape are
-          Copyright (C) 1998-1999 Netscape Communications Corporation. All
-          Rights Reserved.
-
-          Contributor(s): ______________________________________.
-
-          Alternatively, the contents of this file may be used under the
-          terms of the _____ license (the "[___] License"), in which case
-          the provisions of [______] License are applicable  instead of
-          those above. If you wish to allow use of your version of this
-          file only under the terms of the [____] License and not to allow
-          others to use your version of this file under the NPL, indicate
-          your decision by deleting the provisions above and replace  them
-          with the notice and other provisions required by the [___]
-          License. If you do not delete the provisions above, a recipient
-          may use your version of this file under either the NPL or the
-          [___] License."
+For more information, see: http://www.mozilla.org/foundation/licensing.html
--- a/Makefile.in
+++ b/Makefile.in
@@ -190,17 +190,19 @@ ifdef MOZ_CRASHREPORTER
 	  $(foreach dir,$(SYM_STORE_SOURCE_DIRS),-s $(dir))               \
 	  $(DUMP_SYMS_BIN)                                                \
 	  $(DIST)/crashreporter-symbols                                   \
 	  $(MAKE_SYM_STORE_PATH) >                                        \
 	  $(DIST)/crashreporter-symbols/$(SYMBOL_INDEX_NAME)
 	echo packing symbols
 	$(NSINSTALL) -D $(DIST)/$(PKG_PATH)
 	cd $(DIST)/crashreporter-symbols && \
-          zip -r9D "../$(PKG_PATH)$(SYMBOL_ARCHIVE_BASENAME).zip" .
+          zip -r9D "../$(PKG_PATH)$(SYMBOL_FULL_ARCHIVE_BASENAME).zip" .
+	cd $(DIST)/crashreporter-symbols && \
+          zip -r9D "../$(PKG_PATH)$(SYMBOL_ARCHIVE_BASENAME).zip" . -i "*.sym"
 else
 ifdef WINCE
 ifdef SYMBOLSTORE_PATH
 	echo building symbol store with symstore.exe
 	$(RM) -rf $(DIST)/symbols
 	$(RM) -f "$(DIST)/$(SYMBOL_ARCHIVE_BASENAME).zip"
 	$(NSINSTALL) -D $(DIST)/symbols
 	$(SYMBOLSTORE_PATH) add -r -f "$(subst /,\,$(shell pwd -W))\*.PDB" \
@@ -210,17 +212,17 @@ ifdef SYMBOLSTORE_PATH
 	cd $(DIST)/symbols && \
 	  zip -r9D "../$(PKG_PATH)$(SYMBOL_ARCHIVE_BASENAME).zip" .
 endif # SYMBOLSTORE_PATH
 endif # WINCE
 endif # MOZ_CRASHREPORTER
 
 uploadsymbols:
 ifdef MOZ_CRASHREPORTER
-	$(SHELL) $(topsrcdir)/toolkit/crashreporter/tools/upload_symbols.sh "$(DIST)/$(PKG_PATH)$(SYMBOL_ARCHIVE_BASENAME).zip"
+	$(SHELL) $(topsrcdir)/toolkit/crashreporter/tools/upload_symbols.sh "$(DIST)/$(PKG_PATH)$(SYMBOL_FULL_ARCHIVE_BASENAME).zip"
 endif
 
 # defined in package-name.mk
 export MOZ_SOURCE_STAMP
 
 #XXX: this is a hack, since we don't want to clobber for MSVC
 # PGO support, but we can't do this test in client.mk
 ifneq ($(OS_ARCH)_$(GNU_CC), WINNT_)
--- a/accessible/public/Makefile.in
+++ b/accessible/public/Makefile.in
@@ -47,17 +47,16 @@ DIRS = msaa ia2
 endif
 
 MODULE    = accessibility
 XPIDL_MODULE= accessibility
 GRE_MODULE	= 1
 
 XPIDLSRCS = \
       nsIAccessibleTypes.idl \
-      nsIAccessibilityService.idl \
       nsIAccessibleRetrieval.idl \
       nsIAccessible.idl \
       nsIAccessibleApplication.idl \
       nsIAccessibleRelation.idl \
       nsIAccessibleRole.idl \
       nsIAccessibleStates.idl \
       nsIAccessibleDocument.idl \
       nsIAccessibleProvider.idl \
@@ -69,10 +68,14 @@ XPIDLSRCS = \
       nsIAccessibleHyperText.idl \
       nsIAccessibleTable.idl \
       nsIAccessibleText.idl \
       nsIAccessibleValue.idl \
       nsIAccessibleImage.idl \
       nsIXBLAccessible.idl \
       $(NULL)
 
+EXPORTS		= \
+      nsIAccessibilityService.h \
+      $(NULL)
+
 include $(topsrcdir)/config/rules.mk
 
rename from accessible/public/nsIAccessibilityService.idl
rename to accessible/public/nsIAccessibilityService.h
--- a/accessible/public/nsIAccessibilityService.idl
+++ b/accessible/public/nsIAccessibilityService.h
@@ -16,110 +16,162 @@
  * The Original Code is the Mozilla browser.
  *
  * The Initial Developer of the Original Code is
  * Netscape Communications Corporation.
  * Portions created by the Initial Developer are Copyright (C) 1999
  * the Initial Developer. All Rights Reserved.
  *
  * Contributor(s):
+ *   Eric Vaughan <evaughan@netscape.com> (original author)
+ *   Alexander Surkov <surkov.alexander@gmail.com>
  *
  * Alternatively, the contents of this file may be used under the terms of
  * either of the GNU General Public License Version 2 or later (the "GPL"),
  * or the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
  * in which case the provisions of the GPL or the LGPL are applicable instead
  * of those above. If you wish to allow use of your version of this file only
  * under the terms of either the GPL or the LGPL, and not to allow others to
  * use your version of this file under the terms of the MPL, indicate your
  * decision by deleting the provisions above and replace them with the notice
  * and other provisions required by the GPL or the LGPL. If you do not delete
  * the provisions above, a recipient may use your version of this file under
  * the terms of any one of the MPL, the GPL or the LGPL.
  *
  * ***** END LICENSE BLOCK ***** */
 
-#include "nsISupports.idl"
-#include "nsIAccessibleRetrieval.idl"
+#ifndef _nsIAccessibilityService_h_
+#define _nsIAccessibilityService_h_
+
+#include "nsISupports.h"
+#include "nsIAccessibleRetrieval.h"
+
+class nsIDocument;
+class nsIFrame;
+class nsObjectFrame;
+class nsIContent;
 
-interface nsIDocument;
-interface nsIFrame;
-interface nsObjectFrame;
-interface nsIContent;
+#define NS_IACCESSIBILITYSERVICE_IID \
+{0x33fa2a8d, 0x72e5, 0x4b8b,         \
+  {0xbb, 0x17, 0x6b, 0x22, 0x79, 0x05, 0x5c, 0x6c} }
 
-[uuid(4df7499d-d96e-48f8-a936-8a22ec0d4915)]
-interface nsIAccessibilityService : nsIAccessibleRetrieval
+class nsIAccessibilityService : public nsIAccessibleRetrieval
 {
-  nsIAccessible createOuterDocAccessible(in nsIDOMNode aNode);
+public:
+  NS_DECLARE_STATIC_IID_ACCESSOR(NS_IACCESSIBILITYSERVICE_IID)
+
+  /**
+   * Creates accessible for the given DOM node or frame.
+   */
+  virtual nsresult CreateOuterDocAccessible(nsIDOMNode *aNode,
+                                            nsIAccessible **aAccessible) = 0;
 
-  nsIAccessible createHTML4ButtonAccessible(in nsIFrame aFrame);
-  nsIAccessible createHyperTextAccessible(in nsIFrame aFrame);
-  nsIAccessible createHTMLBRAccessible(in nsIFrame aFrame);
-  nsIAccessible createHTMLButtonAccessible(in nsIFrame aFrame);
-  nsIAccessible createHTMLLIAccessible(in nsIFrame aFrame, in nsIFrame aBulletFrame, in AString aBulletText);
-  nsIAccessible createHTMLCheckboxAccessible(in nsIFrame aFrame);
-  nsIAccessible createHTMLComboboxAccessible(in nsIDOMNode aNode, in nsIWeakReference aPresShell);
-  nsIAccessible createHTMLGenericAccessible(in nsIFrame aFrame);
-  nsIAccessible createHTMLGroupboxAccessible(in nsIFrame aFrame);
-  nsIAccessible createHTMLHRAccessible(in nsIFrame aFrame);
-  nsIAccessible createHTMLImageAccessible(in nsIFrame aFrame);
-  nsIAccessible createHTMLLabelAccessible(in nsIFrame aFrame);
-  nsIAccessible createHTMLListboxAccessible(in nsIDOMNode aNode, in nsIWeakReference aPresShell);
-  nsIAccessible createHTMLMediaAccessible(in nsIFrame aFrame);
-  nsIAccessible createHTMLObjectFrameAccessible(in nsObjectFrame aFrame);
-  nsIAccessible createHTMLRadioButtonAccessible(in nsIFrame aFrame);
-  nsIAccessible createHTMLSelectOptionAccessible(in nsIDOMNode aNode, in nsIAccessible aAccParent, in nsIWeakReference aPresShell);
-  nsIAccessible createHTMLTableAccessible(in nsIFrame aFrame);
-  nsIAccessible createHTMLTableCellAccessible(in nsIFrame aFrame);
-  nsIAccessible createHTMLTextAccessible(in nsIFrame aFrame);
-  nsIAccessible createHTMLTextFieldAccessible(in nsIFrame aFrame);
-  nsIAccessible createHTMLCaptionAccessible(in nsIFrame aFrame);
+  virtual nsresult CreateHTML4ButtonAccessible(nsIFrame *aFrame,
+                                               nsIAccessible **aAccessible) = 0;
+  virtual nsresult CreateHyperTextAccessible(nsIFrame *aFrame,
+                                             nsIAccessible **aAccessible) = 0;
+  virtual nsresult CreateHTMLBRAccessible(nsIFrame *aFrame,
+                                          nsIAccessible **aAccessible) = 0;
+  virtual nsresult CreateHTMLButtonAccessible(nsIFrame *aFrame,
+                                              nsIAccessible **aAccessible) = 0;
+  virtual nsresult CreateHTMLLIAccessible(nsIFrame *aFrame,
+                                          nsIFrame *aBulletFrame,
+                                          const nsAString& aBulletText,
+                                          nsIAccessible **aAccessible) = 0;
+  virtual nsresult CreateHTMLCheckboxAccessible(nsIFrame *aFrame,
+                                                nsIAccessible **aAccessible) = 0;
+  virtual nsresult CreateHTMLComboboxAccessible(nsIDOMNode *aNode,
+                                                nsIWeakReference *aPresShell,
+                                                nsIAccessible **aAccessible) = 0;
+  virtual nsresult CreateHTMLGenericAccessible(nsIFrame *aFrame,
+                                               nsIAccessible **aAccessible) = 0;
+  virtual nsresult CreateHTMLGroupboxAccessible(nsIFrame *aFrame,
+                                                nsIAccessible **aAccessible) = 0;
+  virtual nsresult CreateHTMLHRAccessible(nsIFrame *aFrame,
+                                          nsIAccessible **aAccessible) = 0;
+  virtual nsresult CreateHTMLImageAccessible(nsIFrame *aFrame,
+                                             nsIAccessible **aAccessible) = 0;
+  virtual nsresult CreateHTMLLabelAccessible(nsIFrame *aFrame,
+                                             nsIAccessible **aAccessible) = 0;
+  virtual nsresult CreateHTMLListboxAccessible(nsIDOMNode *aNode,
+                                               nsIWeakReference *aPresShell,
+                                               nsIAccessible **aAccessible) = 0;
+  virtual nsresult CreateHTMLMediaAccessible(nsIFrame *aFrame,
+                                             nsIAccessible **aAccessible) = 0;
+  virtual nsresult CreateHTMLObjectFrameAccessible(nsObjectFrame *aFrame,
+                                                   nsIAccessible **aAccessible) = 0;
+  virtual nsresult CreateHTMLRadioButtonAccessible(nsIFrame *aFrame,
+                                                   nsIAccessible **aAccessible) = 0;
+  virtual nsresult CreateHTMLSelectOptionAccessible(nsIDOMNode *aNode,
+                                                    nsIAccessible *aAccParent,
+                                                    nsIWeakReference *aPresShell,
+                                                    nsIAccessible **aAccessible) = 0;
+  virtual nsresult CreateHTMLTableAccessible(nsIFrame *aFrame,
+                                             nsIAccessible **aAccessible) = 0;
+  virtual nsresult CreateHTMLTableCellAccessible(nsIFrame *aFrame,
+                                                 nsIAccessible **aAccessible) = 0;
+  virtual nsresult CreateHTMLTextAccessible(nsIFrame *aFrame,
+                                            nsIAccessible **aAccessible) = 0;
+  virtual nsresult CreateHTMLTextFieldAccessible(nsIFrame *aFrame,
+                                                 nsIAccessible **aAccessible) = 0;
+  virtual nsresult CreateHTMLCaptionAccessible(nsIFrame *aFrame,
+                                               nsIAccessible **aAccessible) = 0;
 
-  // For gtk+ native window accessible
-  nsIAccessible addNativeRootAccessible(in voidPtr aAtkAccessible);
-  void removeNativeRootAccessible(in nsIAccessible aRootAccessible);
+  /**
+   * Adds/remove ATK root accessible for gtk+ native window to/from children
+   * of the application accessible.
+   */
+  virtual nsresult AddNativeRootAccessible(void *aAtkAccessible,
+                                           nsIAccessible **aAccessible) = 0;
+  virtual nsresult
+    RemoveNativeRootAccessible(nsIAccessible *aRootAccessible) = 0;
 
   /**
    * Used to describe sort of changes leading to accessible tree invalidation.
    */
-  const unsigned long NODE_APPEND = 0x01;
-  const unsigned long NODE_REMOVE = 0x02;
-  const unsigned long NODE_SIGNIFICANT_CHANGE = 0x03;
-  const unsigned long FRAME_SHOW = 0x04;
-  const unsigned long FRAME_HIDE = 0x05;
-  const unsigned long FRAME_SIGNIFICANT_CHANGE = 0x06;
+  enum {
+    NODE_APPEND = 0x01,
+    NODE_REMOVE = 0x02,
+    NODE_SIGNIFICANT_CHANGE = 0x03,
+    FRAME_SHOW = 0x04,
+    FRAME_HIDE = 0x05,
+    FRAME_SIGNIFICANT_CHANGE = 0x06
+  };
 
   /**
    * Invalidate the accessible tree when DOM tree or frame tree is changed.
    *
    * @param aPresShell   [in] the presShell where changes occured
    * @param aContent     [in] the affected DOM content
    * @param aChangeType  [in] the change type (see constants declared above)
    */
-  void invalidateSubtreeFor(in nsIPresShell aPresShell, in nsIContent aContent,
-                            in PRUint32 aChangeType);
+  virtual nsresult InvalidateSubtreeFor(nsIPresShell *aPresShell,
+                                        nsIContent *aContent,
+                                        PRUint32 aChangeType) = 0;
 
   /**
    * Notify accessibility that anchor jump has been accomplished to the given
    * target. Used by layout.
    */
-  void notifyOfAnchorJumpTo(in nsIContent aTarget);
+  virtual void NotifyOfAnchorJumpTo(nsIContent *aTarget) = 0;
 
   /**
    * Fire accessible event of the given type for the given target.
    *
    * @param aEvent   [in] accessible event type
    * @param aTarget  [in] target of accessible event
    */
-  void fireAccessibleEvent(in unsigned long aEvent, in nsIAccessible aTarget);
+  virtual nsresult FireAccessibleEvent(PRUint32 aEvent,
+                                       nsIAccessible *aTarget) = 0;
 };
 
-
-%{ C++
+NS_DEFINE_STATIC_IID_ACCESSOR(nsIAccessibilityService,
+                              NS_IACCESSIBILITYSERVICE_IID)
 
 // for component registration
 // {DE401C37-9A7F-4278-A6F8-3DE2833989EF}
 #define NS_ACCESSIBILITY_SERVICE_CID \
 { 0xde401c37, 0x9a7f, 0x4278, { 0xa6, 0xf8, 0x3d, 0xe2, 0x83, 0x39, 0x89, 0xef } }
 
 extern nsresult
 NS_GetAccessibilityService(nsIAccessibilityService** aResult);
 
-%}
+#endif
--- a/accessible/public/nsIAccessibleDocument.idl
+++ b/accessible/public/nsIAccessibleDocument.idl
@@ -53,17 +53,17 @@ interface nsIDOMWindow;
  * You can QueryInterface to nsIAccessibleDocument from
  * the nsIAccessible or nsIAccessNode for the root node
  * of a document. You can also get one from 
  * nsIAccessNode::GetAccessibleDocument() or 
  * nsIAccessibleEvent::GetAccessibleDocument()
  *
  * @status UNDER_REVIEW
  */
-[scriptable, uuid(427597a3-1737-4743-bf43-2311a1ed5fbd)]
+[scriptable, uuid(471909e7-0ea4-4ce0-bf31-a1372b2b285c)]
 interface nsIAccessibleDocument : nsISupports
 {
   /**
    * The URL of the document
    */
   readonly attribute AString URL;
 
   /**
@@ -79,17 +79,17 @@ interface nsIAccessibleDocument : nsISup
   /**
    * The doc type of the document, as specified in the document.
    */
   readonly attribute AString docType;
 
   /**
    * The nsIDOMDocument interface associated with this document.
    */
-  readonly attribute nsIDOMDocument document;
+  readonly attribute nsIDOMDocument DOMDocument;
 
   /**
    * The nsIDOMWindow that the document resides in.
    */
   readonly attribute nsIDOMWindow window;
 
   /**
    * The namespace for each ID that is handed back.
--- a/accessible/public/nsIAccessibleProvider.idl
+++ b/accessible/public/nsIAccessibleProvider.idl
@@ -93,17 +93,17 @@ interface nsIAccessibleProvider : nsISup
   const long XULRadioGroup = 0x00001016;
 
   /** The single tab in a dialog or tabbrowser/editor interface */
   const long XULTab = 0x00001017;
 
   /** A combination of a tabs object and a tabpanels object */
   const long XULTabBox = 0x00001018;
 
-  /** The collection of tab objects, useable in the TabBox and independant of
+  /** The collection of tab objects, usable in the TabBox and independent of it
    as well */
   const long XULTabs = 0x00001019;
 
   const long XULText             = 0x0000101A;
   const long XULTextBox          = 0x0000101B;
   const long XULThumb            = 0x0000101C;
   const long XULTree             = 0x0000101D;
   const long XULTreeColumns      = 0x0000101E;
--- a/accessible/src/atk/nsAccessibleWrap.cpp
+++ b/accessible/src/atk/nsAccessibleWrap.cpp
@@ -35,24 +35,27 @@
  * decision by deleting the provisions above and replace them with the notice
  * and other provisions required by the GPL or the LGPL. If you do not delete
  * the provisions above, a recipient may use your version of this file under
  * the terms of any one of the MPL, the GPL or the LGPL.
  *
  * ***** END LICENSE BLOCK ***** */
 
 #include "nsAccessibleWrap.h"
+
+#include "nsAccUtils.h"
 #include "nsApplicationAccessibleWrap.h"
 #include "nsRootAccessible.h"
 #include "nsDocAccessibleWrap.h"
 #include "nsIAccessibleValue.h"
 #include "nsString.h"
 #include "nsAutoPtr.h"
 #include "prprf.h"
 #include "nsRoleMap.h"
+#include "nsRelUtils.h"
 #include "nsStateMap.h"
 
 #include "nsMaiInterfaceComponent.h"
 #include "nsMaiInterfaceAction.h"
 #include "nsMaiInterfaceText.h"
 #include "nsMaiInterfaceEditableText.h"
 #include "nsMaiInterfaceSelection.h"
 #include "nsMaiInterfaceValue.h"
@@ -1150,17 +1153,17 @@ nsAccessibleWrap::FirePlatformEvent(nsAc
 
     case nsIAccessibleEvent::EVENT_FOCUS:
       {
         MAI_LOG_DEBUG(("\n\nReceived: EVENT_FOCUS\n"));
         nsRefPtr<nsRootAccessible> rootAccWrap = accWrap->GetRootAccessible();
         if (rootAccWrap && rootAccWrap->mActivated) {
             atk_focus_tracker_notify(atkObj);
             // Fire state change event for focus
-            nsCOMPtr<nsIAccessibleEvent> stateChangeEvent =
+            nsRefPtr<nsAccEvent> stateChangeEvent =
               new nsAccStateChangeEvent(accessible,
                                         nsIAccessibleStates::STATE_FOCUSED,
                                         PR_FALSE, PR_TRUE);
             return FireAtkStateChangeEvent(stateChangeEvent, atkObj);
         }
       } break;
 
     case nsIAccessibleEvent::EVENT_VALUE_CHANGE:
@@ -1378,17 +1381,17 @@ nsAccessibleWrap::FirePlatformEvent(nsAc
         atk_object_notify_state_change(atkObj, ATK_STATE_SHOWING, PR_FALSE);
         break;
     }
 
     return NS_OK;
 }
 
 nsresult
-nsAccessibleWrap::FireAtkStateChangeEvent(nsIAccessibleEvent *aEvent,
+nsAccessibleWrap::FireAtkStateChangeEvent(nsAccEvent *aEvent,
                                           AtkObject *aObject)
 {
     MAI_LOG_DEBUG(("\n\nReceived: EVENT_STATE_CHANGE\n"));
 
     nsCOMPtr<nsIAccessibleStateChangeEvent> event =
         do_QueryInterface(aEvent);
     NS_ENSURE_TRUE(event, NS_ERROR_FAILURE);
 
@@ -1420,17 +1423,17 @@ nsAccessibleWrap::FireAtkStateChangeEven
                                            isEnabled);
         }
     }
 
     return NS_OK;
 }
 
 nsresult
-nsAccessibleWrap::FireAtkTextChangedEvent(nsIAccessibleEvent *aEvent,
+nsAccessibleWrap::FireAtkTextChangedEvent(nsAccEvent *aEvent,
                                           AtkObject *aObject)
 {
     MAI_LOG_DEBUG(("\n\nReceived: EVENT_TEXT_REMOVED/INSERTED\n"));
 
     nsCOMPtr<nsIAccessibleTextChangeEvent> event =
         do_QueryInterface(aEvent);
     NS_ENSURE_TRUE(event, NS_ERROR_FAILURE);
 
@@ -1438,42 +1441,40 @@ nsAccessibleWrap::FireAtkTextChangedEven
     event->GetStart(&start);
 
     PRUint32 length = 0;
     event->GetLength(&length);
 
     PRBool isInserted;
     event->IsInserted(&isInserted);
 
-    PRBool isFromUserInput;
-    aEvent->GetIsFromUserInput(&isFromUserInput);
+    PRBool isFromUserInput = aEvent->IsFromUserInput();
 
     char *signal_name = g_strconcat(isInserted ? "text_changed::insert" : "text_changed::delete",
                                     isFromUserInput ? "" : kNonUserInputEvent, NULL);
     g_signal_emit_by_name(aObject, signal_name, start, length);
     g_free (signal_name);
 
     return NS_OK;
 }
 
 nsresult
-nsAccessibleWrap::FireAtkShowHideEvent(nsIAccessibleEvent *aEvent,
+nsAccessibleWrap::FireAtkShowHideEvent(nsAccEvent *aEvent,
                                        AtkObject *aObject, PRBool aIsAdded)
 {
     if (aIsAdded)
         MAI_LOG_DEBUG(("\n\nReceived: Show event\n"));
     else
         MAI_LOG_DEBUG(("\n\nReceived: Hide event\n"));
 
     PRInt32 indexInParent = getIndexInParentCB(aObject);
     AtkObject *parentObject = getParentCB(aObject);
     NS_ENSURE_STATE(parentObject);
 
-    PRBool isFromUserInput;
-    aEvent->GetIsFromUserInput(&isFromUserInput);
+    PRBool isFromUserInput = aEvent->IsFromUserInput();
     char *signal_name = g_strconcat(aIsAdded ? "children_changed::add" :  "children_changed::remove",
                                     isFromUserInput ? "" : kNonUserInputEvent, NULL);
     g_signal_emit_by_name(parentObject, signal_name, indexInParent, aObject, NULL);
     g_free(signal_name);
 
     return NS_OK;
 }
 
--- a/accessible/src/atk/nsAccessibleWrap.h
+++ b/accessible/src/atk/nsAccessibleWrap.h
@@ -115,24 +115,20 @@ public:
       static nsCString returnedString;
       returnedString = NS_ConvertUTF16toUTF8(aString);
       return returnedString.get();
     }
 
 protected:
     virtual nsresult FirePlatformEvent(nsAccEvent *aEvent);
 
-    nsresult FireAtkStateChangeEvent(nsIAccessibleEvent *aEvent,
-                                     AtkObject *aObject);
-    nsresult FireAtkTextChangedEvent(nsIAccessibleEvent *aEvent,
-                                     AtkObject *aObject);
-    nsresult FireAtkPropChangedEvent(nsIAccessibleEvent *aEvent,
-                                     AtkObject *aObject);
-    nsresult FireAtkShowHideEvent(nsIAccessibleEvent *aEvent,
-                                  AtkObject *aObject, PRBool aIsAdded);
+    nsresult FireAtkStateChangeEvent(nsAccEvent *aEvent, AtkObject *aObject);
+    nsresult FireAtkTextChangedEvent(nsAccEvent *aEvent, AtkObject *aObject);
+    nsresult FireAtkShowHideEvent(nsAccEvent *aEvent, AtkObject *aObject,
+                                  PRBool aIsAdded);
 
     AtkObject *mAtkObject;
 
 private:
     PRUint16 CreateMaiInterfaces(void);
 };
 
 #endif /* __NS_ACCESSIBLE_WRAP_H__ */
--- a/accessible/src/atk/nsMaiInterfaceAction.cpp
+++ b/accessible/src/atk/nsMaiInterfaceAction.cpp
@@ -35,19 +35,22 @@
  * and other provisions required by the GPL or the LGPL. If you do not delete
  * the provisions above, a recipient may use your version of this file under
  * the terms of any one of the MPL, the GPL or the LGPL.
  *
  * ***** END LICENSE BLOCK ***** */
 
 #include "nsMaiInterfaceAction.h"
 
+#include "nsAccUtils.h"
 #include "nsRoleMap.h"
 #include "nsString.h"
 
+#include "nsIDOMDOMStringList.h"
+
 void
 actionInterfaceInitCB(AtkActionIface *aIface)
 {
     NS_ASSERTION(aIface, "Invalid aIface");
     if (!aIface)
         return;
 
     aIface->do_action = doActionCB;
--- a/accessible/src/atk/nsMaiInterfaceComponent.cpp
+++ b/accessible/src/atk/nsMaiInterfaceComponent.cpp
@@ -34,17 +34,21 @@
  * decision by deleting the provisions above and replace them with the notice
  * and other provisions required by the GPL or the LGPL. If you do not delete
  * the provisions above, a recipient may use your version of this file under
  * the terms of any one of the MPL, the GPL or the LGPL.
  *
  * ***** END LICENSE BLOCK ***** */
 
 #include "nsMaiInterfaceComponent.h"
+
 #include "nsAccessibleWrap.h"
+#include "nsAccUtils.h"
+#include "nsCoreUtils.h"
+
 #include "nsIDOMDocument.h"
 #include "nsIDOMDocumentView.h"
 #include "nsIDOMAbstractView.h"
 #include "nsIDOMWindowInternal.h"
 #include "nsIDocShellTreeItem.h"
 #include "nsIInterfaceRequestorUtils.h"
 
 void
--- a/accessible/src/atk/nsMaiInterfaceTable.cpp
+++ b/accessible/src/atk/nsMaiInterfaceTable.cpp
@@ -35,16 +35,18 @@
  * and other provisions required by the GPL or the LGPL. If you do not delete
  * the provisions above, a recipient may use your version of this file under
  * the terms of any one of the MPL, the GPL or the LGPL.
  *
  * ***** END LICENSE BLOCK ***** */
 
 #include "nsMaiInterfaceTable.h"
 
+#include "nsAccUtils.h"
+
 #include "nsArrayUtils.h"
 
 void
 tableInterfaceInitCB(AtkTableIface *aIface)
 
 {
     g_return_if_fail(aIface != NULL);
 
--- a/accessible/src/base/Makefile.in
+++ b/accessible/src/base/Makefile.in
@@ -69,17 +69,18 @@ CPPSRCS = \
   nsApplicationAccessible.cpp \
   nsCaretAccessible.cpp \
   nsTextAccessible.cpp \
   nsTextEquivUtils.cpp \
   nsTextAttrs.cpp \
   $(NULL)
 
 EXPORTS = \
-  nsRootAccessible.h \
+  a11yGeneric.h \
+  nsAccessible.h \
   nsAccessNode.h \
   $(NULL)
 
 # we don't want the shared lib, but we want to force the creation of a static lib.
 FORCE_STATIC_LIB = 1
 
 include $(topsrcdir)/config/rules.mk
 
copy from accessible/src/base/nsCoreUtils.h
copy to accessible/src/base/a11yGeneric.h
--- a/accessible/src/base/nsCoreUtils.h
+++ b/accessible/src/base/a11yGeneric.h
@@ -10,18 +10,18 @@
  * Software distributed under the License is distributed on an "AS IS" basis,
  * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
  * for the specific language governing rights and limitations under the
  * License.
  *
  * The Original Code is mozilla.org code.
  *
  * The Initial Developer of the Original Code is
- * Mozilla Foundation.
- * Portions created by the Initial Developer are Copyright (C) 2007
+ * Mozilla Corporation.
+ * Portions created by the Initial Developer are Copyright (C) 2010
  * the Initial Developer. All Rights Reserved.
  *
  * Contributor(s):
  *   Alexander Surkov <surkov.alexander@gmail.com> (original author)
  *
  * Alternatively, the contents of this file may be used under the terms of
  * either of the GNU General Public License Version 2 or later (the "GPL"),
  * or the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
@@ -31,447 +31,47 @@
  * use your version of this file under the terms of the MPL, indicate your
  * decision by deleting the provisions above and replace them with the notice
  * and other provisions required by the GPL or the LGPL. If you do not delete
  * the provisions above, a recipient may use your version of this file under
  * the terms of any one of the MPL, the GPL or the LGPL.
  *
  * ***** END LICENSE BLOCK ***** */
 
-#ifndef nsCoreUtils_h_
-#define nsCoreUtils_h_
-
-#include "nsAccessibilityAtoms.h"
-
-#include "nsIDOMNode.h"
-#include "nsIContent.h"
-#include "nsIBoxObject.h"
-#include "nsITreeBoxObject.h"
-#include "nsITreeColumns.h"
-
-#include "nsIFrame.h"
-#include "nsIDocShellTreeItem.h"
-#include "nsIArray.h"
-#include "nsIMutableArray.h"
-#include "nsPoint.h"
-
-class nsCoreUtils
-{
-public:
-  /**
-   * Return true if the given node has registered click, mousedown or mouseup
-   * event listeners.
-   */
-  static PRBool HasClickListener(nsIContent *aContent);
-
-  /**
-   * Dispatch click event to XUL tree cell.
-   *
-   * @param  aTreeBoxObj  [in] tree box object
-   * @param  aRowIndex    [in] row index
-   * @param  aColumn      [in] column object
-   * @param  aPseudoElm   [in] pseudo elemenet inside the cell, see
-   *                       nsITreeBoxObject for available values
-   */
-  static void DispatchClickEvent(nsITreeBoxObject *aTreeBoxObj,
-                                 PRInt32 aRowIndex, nsITreeColumn *aColumn,
-                                 const nsCString& aPseudoElt = EmptyCString());
-
-  /**
-   * Send mouse event to the given element.
-   *
-   * @param  aEventType  [in] an event type (see nsGUIEvent.h for constants)
-   * @param  aPresShell  [in] the presshell for the given element
-   * @param  aContent    [in] the element
-   */
-  static PRBool DispatchMouseEvent(PRUint32 aEventType,
-                                   nsIPresShell *aPresShell,
-                                   nsIContent *aContent);
-
-  /**
-   * Send mouse event to the given element.
-   *
-   * @param aEventType   [in] an event type (see nsGUIEvent.h for constants)
-   * @param aX           [in] x coordinate in dev pixels
-   * @param aY           [in] y coordinate in dev pixels
-   * @param aContent     [in] the element
-   * @param aFrame       [in] frame of the element
-   * @param aPresShell   [in] the presshell for the element
-   * @param aRootWidget  [in] the root widget of the element
-   */
-  static void DispatchMouseEvent(PRUint32 aEventType, PRInt32 aX, PRInt32 aY,
-                                 nsIContent *aContent, nsIFrame *aFrame,
-                                 nsIPresShell *aPresShell,
-                                 nsIWidget *aRootWidget);
-
-  /**
-   * Return an accesskey registered on the given element by
-   * nsIEventStateManager or 0 if there is no registered accesskey.
-   *
-   * @param aContent - the given element.
-   */
-  static PRUint32 GetAccessKeyFor(nsIContent *aContent);
-
-  /**
-   * Return DOM element related with the given node, i.e.
-   * a) itself if it is DOM element
-   * b) parent element if it is text node
-   * c) body element if it is HTML document node
-   * d) document element if it is document node.
-   *
-   * @param aNode  [in] the given DOM node
-   */
-  static already_AddRefed<nsIDOMElement> GetDOMElementFor(nsIDOMNode *aNode);
-
-  /**
-   * Return DOM node for the given DOM point.
-   */
-  static already_AddRefed<nsIDOMNode> GetDOMNodeFromDOMPoint(nsIDOMNode *aNode,
-                                                             PRUint32 aOffset);
-  /**
-   * Return the nsIContent* to check for ARIA attributes on -- this may not
-   * always be the DOM node for the accessible. Specifically, for doc
-   * accessibles, it is not the document node, but either the root element or
-   * <body> in HTML. Similar with GetDOMElementFor() method.
-   *
-   * @param aDOMNode  DOM node for the accessible that may be affected by ARIA
-   * @return          the nsIContent which may have ARIA markup
-   */
-  static nsIContent *GetRoleContent(nsIDOMNode *aDOMNode);
+#ifndef _a11yGeneric_H_
+#define _a11yGeneric_H_
 
-  /**
-   * Is the first passed in node an ancestor of the second?
-   * Note: A node is not considered to be the ancestor of itself.
-   *
-   * @param  aPossibleAncestorNode   [in] node to test for ancestor-ness of
-   *                                   aPossibleDescendantNode
-   * @param  aPossibleDescendantNode [in] node to test for descendant-ness of
-   *                                   aPossibleAncestorNode
-   * @return PR_TRUE                  if aPossibleAncestorNode is an ancestor of
-   *                                   aPossibleDescendantNode
-   */
-   static PRBool IsAncestorOf(nsINode *aPossibleAncestorNode,
-                              nsINode *aPossibleDescendantNode);
-
-  /**
-   * Are the first node and the second siblings?
-   *
-   * @return PR_TRUE if aDOMNode1 and aDOMNode2 have same parent
-   */
-   static PRBool AreSiblings(nsINode *aNode1, nsINode *aNode2);
-
-  /**
-   * Helper method to scroll range into view, used for implementation of
-   * nsIAccessibleText::scrollSubstringTo().
-   *
-   * @param aFrame        the frame for accessible the range belongs to.
-   * @param aStartNode    start node of a range
-   * @param aStartOffset  an offset inside the start node
-   * @param aEndNode      end node of a range
-   * @param aEndOffset    an offset inside the end node
-   * @param aScrollType   the place a range should be scrolled to
-   */
-  static nsresult ScrollSubstringTo(nsIFrame *aFrame,
-                                    nsIDOMNode *aStartNode, PRInt32 aStartIndex,
-                                    nsIDOMNode *aEndNode, PRInt32 aEndIndex,
-                                    PRUint32 aScrollType);
-
-  /** Helper method to scroll range into view, used for implementation of
-   * nsIAccessibleText::scrollSubstringTo[Point]().
-   *
-   * @param aFrame        the frame for accessible the range belongs to.
-   * @param aStartNode    start node of a range
-   * @param aStartOffset  an offset inside the start node
-   * @param aEndNode      end node of a range
-   * @param aEndOffset    an offset inside the end node
-   * @param aVPercent     how to align vertically, specified in percents
-   * @param aHPercent     how to align horizontally, specified in percents
-   */
-  static nsresult ScrollSubstringTo(nsIFrame *aFrame,
-                                    nsIDOMNode *aStartNode, PRInt32 aStartIndex,
-                                    nsIDOMNode *aEndNode, PRInt32 aEndIndex,
-                                    PRInt16 aVPercent, PRInt16 aHPercent);
-
-  /**
-   * Scrolls the given frame to the point, used for implememntation of
-   * nsIAccessNode::scrollToPoint and nsIAccessibleText::scrollSubstringToPoint.
-   *
-   * @param aScrollableFrame  the scrollable frame
-   * @param aFrame            the frame to scroll
-   * @param aPoint            the point scroll to
-   */
-  static void ScrollFrameToPoint(nsIFrame *aScrollableFrame,
-                                 nsIFrame *aFrame, const nsIntPoint& aPoint);
-
-  /**
-   * Converts scroll type constant defined in nsIAccessibleScrollType to
-   * vertical and horizontal percents.
-   */
-  static void ConvertScrollTypeToPercents(PRUint32 aScrollType,
-                                          PRInt16 *aVPercent,
-                                          PRInt16 *aHPercent);
-
-  /**
-   * Returns coordinates relative screen for the top level window.
-   *
-   * @param aNode  the DOM node hosted in the window.
-   */
-  static nsIntPoint GetScreenCoordsForWindow(nsIDOMNode *aNode);
-
-  /**
-   * Return document shell tree item for the given DOM node.
-   */
-  static already_AddRefed<nsIDocShellTreeItem>
-    GetDocShellTreeItemFor(nsIDOMNode *aNode);
-
-  /**
-   * Retrun frame for the given DOM element.
-   */
-  static nsIFrame* GetFrameFor(nsIDOMElement *aElm);
-
-  /**
-   * Retrun true if the type of given frame equals to the given frame type.
-   *
-   * @param aFrame  the frame
-   * @param aAtom   the frame type
-   */
-  static PRBool IsCorrectFrameType(nsIFrame* aFrame, nsIAtom* aAtom);
-
-  /**
-   * Return presShell for the document containing the given DOM node.
-   */
-  static already_AddRefed<nsIPresShell> GetPresShellFor(nsIDOMNode *aNode);
-
-  /**
-   * Return document node for the given document shell tree item.
-   */
-  static already_AddRefed<nsIDOMNode>
-    GetDOMNodeForContainer(nsIDocShellTreeItem *aContainer);
+#include "nsThreadUtils.h"
 
-  /**
-   * Get the ID for an element, in some types of XML this may not be the ID attribute
-   * @param aContent  Node to get the ID for
-   * @param aID       Where to put ID string
-   * @return          PR_TRUE if there is an ID set for this node
-   */
-  static PRBool GetID(nsIContent *aContent, nsAString& aID);
-
-  /**
-   * Convert attribute value of the given node to positive integer. If no
-   * attribute or wrong value then false is returned.
-   */
-  static PRBool GetUIntAttr(nsIContent *aContent, nsIAtom *aAttr,
-                            PRInt32 *aUInt);
-
-  /**
-   * Check if the given element is XLink.
-   *
-   * @param aContent  the given element
-   * @return          PR_TRUE if the given element is XLink
-   */
-  static PRBool IsXLink(nsIContent *aContent);
-
-  /**
-   * Returns language for the given node.
-   *
-   * @param aContent     [in] the given node
-   * @param aRootContent [in] container of the given node
-   * @param aLanguage    [out] language
-   */
-  static void GetLanguageFor(nsIContent *aContent, nsIContent *aRootContent,
-                             nsAString& aLanguage);
-
-  /**
-   * Return the array of elements the given node is referred to by its
-   * IDRefs attribute.
-   *
-   * @param aContent     [in] the given node
-   * @param aAttr        [in] IDRefs attribute on the given node
-   * @param aRefElements [out] result array of elements
-   */
-  static void GetElementsByIDRefsAttr(nsIContent *aContent, nsIAtom *aAttr,
-                                      nsIArray **aRefElements);
-
-  /**
-   * Return the array of elements having IDRefs that points to the given node.
-   *
-   * @param  aRootContent  [in] root element to search inside
-   * @param  aContent      [in] an element having ID attribute
-   * @param  aIDRefsAttr   [in] IDRefs attribute
-   * @param  aElements     [out] result array of elements
-   */
-  static void GetElementsHavingIDRefsAttr(nsIContent *aRootContent,
-                                          nsIContent *aContent,
-                                          nsIAtom *aIDRefsAttr,
-                                          nsIArray **aElements);
-
-  /**
-   * Helper method for GetElementsHavingIDRefsAttr.
-   */
-  static void GetElementsHavingIDRefsAttrImpl(nsIContent *aRootContent,
-                                              nsCString& aIdWithSpaces,
-                                              nsIAtom *aIDRefsAttr,
-                                              nsIMutableArray *aElements);
-
-  /**
-   * Return computed styles declaration for the given node.
-   */
-  static void GetComputedStyleDeclaration(const nsAString& aPseudoElt,
-                                          nsIDOMNode *aNode,
-                                          nsIDOMCSSStyleDeclaration **aCssDecl);
-
-  /**
-   * Search element in neighborhood of the given element by tag name and
-   * attribute value that equals to ID attribute of the given element.
-   * ID attribute can be either 'id' attribute or 'anonid' if the element is
-   * anonymous.
-   * The first matched content will be returned.
-   *
-   * @param aForNode - the given element the search is performed for
-   * @param aRelationAttrs - an array of attributes, element is attribute name of searched element, ignored if aAriaProperty passed in
-   * @param aAttrNum - how many attributes in aRelationAttrs
-   * @param aTagName - tag name of searched element, or nsnull for any -- ignored if aAriaProperty passed in
-   * @param aAncestorLevelsToSearch - points how is the neighborhood of the
-   *                                  given element big.
-   */
-  static nsIContent *FindNeighbourPointingToNode(nsIContent *aForNode,
-                                                 nsIAtom **aRelationAttrs, 
-                                                 PRUint32 aAttrNum,
-                                                 nsIAtom *aTagName = nsnull,
-                                                 PRUint32 aAncestorLevelsToSearch = 5);
-
-  /**
-   * Overloaded version of FindNeighbourPointingToNode to accept only one
-   * relation attribute.
-   */
-  static nsIContent *FindNeighbourPointingToNode(nsIContent *aForNode,
-                                                 nsIAtom *aRelationAttr, 
-                                                 nsIAtom *aTagName = nsnull,
-                                                 PRUint32 aAncestorLevelsToSearch = 5);
+// What we want is: NS_INTERFACE_MAP_ENTRY(self) for static IID accessors,
+// but some of our classes have an ambiguous base class of nsISupports which
+// prevents this from working (the default macro converts it to nsISupports,
+// then addrefs it, then returns it). Therefore, we expand the macro here and
+// change it so that it works. Yuck.
+#define NS_INTERFACE_MAP_STATIC_AMBIGUOUS(_class)                              \
+  if (aIID.Equals(NS_GET_IID(_class))) {                                       \
+    NS_ADDREF(this);                                                           \
+    *aInstancePtr = this;                                                      \
+    return NS_OK;                                                              \
+  } else
 
-  /**
-   * Search for element that satisfies the requirements in subtree of the given
-   * element. The requirements are tag name, attribute name and value of
-   * attribute.
-   * The first matched content will be returned.
-   *
-   * @param aId - value of searched attribute
-   * @param aLookContent - element that search is performed inside
-   * @param aRelationAttrs - an array of searched attributes
-   * @param aAttrNum - how many attributes in aRelationAttrs
-   * @param                 if both aAriaProperty and aRelationAttrs are null, then any element with aTagType will do
-   * @param aExcludeContent - element that is skiped for search
-   * @param aTagType - tag name of searched element, by default it is 'label' --
-   *                   ignored if aAriaProperty passed in
-   */
-  static nsIContent *FindDescendantPointingToID(const nsString *aId,
-                                                nsIContent *aLookContent,
-                                                nsIAtom **aRelationAttrs,
-                                                PRUint32 aAttrNum = 1,
-                                                nsIContent *aExcludeContent = nsnull,
-                                                nsIAtom *aTagType = nsAccessibilityAtoms::label);
-
-  /**
-   * Overloaded version of FindDescendantPointingToID to accept only one
-   * relation attribute.
-   */
-  static nsIContent *FindDescendantPointingToID(const nsString *aId,
-                                                nsIContent *aLookContent,
-                                                nsIAtom *aRelationAttr,
-                                                nsIContent *aExcludeContent = nsnull,
-                                                nsIAtom *aTagType = nsAccessibilityAtoms::label);
-
-  // Helper for FindDescendantPointingToID(), same args
-  static nsIContent *FindDescendantPointingToIDImpl(nsCString& aIdWithSpaces,
-                                                    nsIContent *aLookContent,
-                                                    nsIAtom **aRelationAttrs,
-                                                    PRUint32 aAttrNum = 1,
-                                                    nsIContent *aExcludeContent = nsnull,
-                                                    nsIAtom *aTagType = nsAccessibilityAtoms::label);
-
-  /**
-   * Return the label element for the given DOM element.
-   */
-  static nsIContent *GetLabelContent(nsIContent *aForNode);
-
-  /**
-   * Return the HTML label element for the given HTML element.
-   */
-  static nsIContent *GetHTMLLabelContent(nsIContent *aForNode);
-
-  /**
-   * Return box object for XUL treechildren element by tree box object.
-   */
-  static already_AddRefed<nsIBoxObject>
-    GetTreeBodyBoxObject(nsITreeBoxObject *aTreeBoxObj);
+#define NS_OK_DEFUNCT_OBJECT                                                   \
+  NS_ERROR_GENERATE_SUCCESS(NS_ERROR_MODULE_GENERAL, 0x22)
 
-  /**
-   * Return tree box object from any levels DOMNode under the XUL tree.
-   */
-  static void
-    GetTreeBoxObject(nsIDOMNode* aDOMNode, nsITreeBoxObject** aBoxObject);
-
-  /**
-   * Return first sensible column for the given tree box object.
-   */
-  static already_AddRefed<nsITreeColumn>
-    GetFirstSensibleColumn(nsITreeBoxObject *aTree);
-
-  /**
-   * Return last sensible column for the given tree box object.
-   */
-  static already_AddRefed<nsITreeColumn>
-    GetLastSensibleColumn(nsITreeBoxObject *aTree);
-
-  /**
-   * Return sensible columns count for the given tree box object.
-   */
-  static PRUint32 GetSensibleColumnCount(nsITreeBoxObject *aTree);
-
-  /**
-   * Return sensible column at the given index for the given tree box object.
-   */
-  static already_AddRefed<nsITreeColumn>
-    GetSensibleColumnAt(nsITreeBoxObject *aTree, PRUint32 aIndex);
+#define NS_ENSURE_A11Y_SUCCESS(res, ret)                                       \
+  PR_BEGIN_MACRO                                                               \
+    nsresult __rv = res; /* Don't evaluate |res| more than once */             \
+    if (NS_FAILED(__rv)) {                                                     \
+      NS_ENSURE_SUCCESS_BODY(res, ret)                                         \
+      return ret;                                                              \
+    }                                                                          \
+    if (__rv == NS_OK_DEFUNCT_OBJECT)                                          \
+      return ret;                                                              \
+  PR_END_MACRO
 
-  /**
-   * Return next sensible column for the given column.
-   */
-  static already_AddRefed<nsITreeColumn>
-    GetNextSensibleColumn(nsITreeColumn *aColumn);
-
-  /**
-   * Return previous sensible column for the given column.
-   */
-  static already_AddRefed<nsITreeColumn>
-    GetPreviousSensibleColumn(nsITreeColumn *aColumn);
-
-  /**
-   * Return true if the given column is hidden (i.e. not sensible).
-   */
-  static PRBool IsColumnHidden(nsITreeColumn *aColumn);
-
-  /**
-   * Return true if the given node is table header element.
-   */
-  static PRBool IsHTMLTableHeader(nsIContent *aContent)
-  {
-    return aContent->NodeInfo()->Equals(nsAccessibilityAtoms::th) ||
-      aContent->HasAttr(kNameSpaceID_None, nsAccessibilityAtoms::scope);
-  }
-
-  /**
-   * Generates frames for popup subtree.
-   *
-   * @param aNode    [in] DOM node containing the menupopup element as a child
-   * @param aIsAnon  [in] specifies whether popup should be searched inside of
-   *                  anonymous or explicit content
-   */
-  static void GeneratePopupTree(nsIDOMNode *aNode, PRBool aIsAnon = PR_FALSE);
-};
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsRunnable helpers
 ////////////////////////////////////////////////////////////////////////////////
 
 /**
  * Use NS_DECL_RUNNABLEMETHOD_ macros to declare a runnable class for the given
  * method of the given class. There are three macros:
@@ -591,9 +191,8 @@ public:                                 
 {                                                                              \
   nsCOMPtr<nsIRunnable> runnable =                                             \
     new nsRunnableMethod_##Method(Obj, Arg1, Arg2);                            \
   if (runnable)                                                                \
     NS_DispatchToMainThread(runnable);                                         \
 }
 
 #endif
-
--- a/accessible/src/base/nsARIAGridAccessible.cpp
+++ b/accessible/src/base/nsARIAGridAccessible.cpp
@@ -33,16 +33,19 @@
  * and other provisions required by the GPL or the LGPL. If you do not delete
  * the provisions above, a recipient may use your version of this file under
  * the terms of any one of the MPL, the GPL or the LGPL.
  *
  * ***** END LICENSE BLOCK ***** */
 
 #include "nsARIAGridAccessible.h"
 
+#include "nsAccUtils.h"
+
+#include "nsIMutableArray.h"
 #include "nsComponentManagerUtils.h"
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsARIAGridAccessible
 ////////////////////////////////////////////////////////////////////////////////
 
 
 ////////////////////////////////////////////////////////////////////////////////
@@ -760,17 +763,17 @@ nsARIAGridAccessible::GetNextCellInRow(n
 
   return nsnull;
 }
 
 nsresult
 nsARIAGridAccessible::SetARIASelected(nsIAccessible *aAccessible,
                                       PRBool aIsSelected, PRBool aNotify)
 {
-  nsRefPtr<nsAccessible> acc = nsAccUtils::QueryAccessible(aAccessible);
+  nsRefPtr<nsAccessible> acc = do_QueryObject(aAccessible);
   nsCOMPtr<nsIDOMNode> node;
   acc->GetDOMNode(getter_AddRefs(node));
   NS_ENSURE_STATE(node);
 
   nsCOMPtr<nsIContent> content(do_QueryInterface(node));
 
   nsresult rv = NS_OK;
   if (aIsSelected)
@@ -1092,17 +1095,17 @@ nsARIAGridCellAccessible::GetARIAState(P
     return NS_OK;
 
   // Check aria-selected="true" on the row.
   nsCOMPtr<nsIAccessible> row;
   GetParent(getter_AddRefs(row));
   if (nsAccUtils::Role(row) != nsIAccessibleRole::ROLE_ROW)
     return NS_OK;
 
-  nsRefPtr<nsAccessible> acc = nsAccUtils::QueryAccessible(row);
+  nsRefPtr<nsAccessible> acc = do_QueryObject(row);
   nsCOMPtr<nsIDOMNode> rowNode;
   acc->GetDOMNode(getter_AddRefs(rowNode));
   NS_ENSURE_STATE(rowNode);
 
   nsCOMPtr<nsIContent> rowContent(do_QueryInterface(rowNode));
   if (nsAccUtils::HasDefinedARIAToken(rowContent,
                                       nsAccessibilityAtoms::aria_selected) &&
       !rowContent->AttrValueIs(kNameSpaceID_None,
--- a/accessible/src/base/nsAccCache.h
+++ b/accessible/src/base/nsAccCache.h
@@ -37,25 +37,21 @@
  * ***** END LICENSE BLOCK ***** */
 
 #ifndef _nsAccCache_H_
 #define _nsAccCache_H_
 
 #include "nsRefPtrHashtable.h"
 #include "nsCycleCollectionParticipant.h"
 
-class nsAccessNode;
-class nsAccessible;
 class nsIAccessNode;
 
-typedef nsRefPtrHashtable<nsVoidPtrHashKey, nsAccessNode>
-  nsAccessNodeHashtable;
-
-typedef nsRefPtrHashtable<nsVoidPtrHashKey, nsAccessible>
-  nsAccessibleHashtable;
+////////////////////////////////////////////////////////////////////////////////
+// Accessible cache utils
+////////////////////////////////////////////////////////////////////////////////
 
 /**
  * Shutdown and removes the accessible from cache.
  */
 template <class T>
 static PLDHashOperator
 ClearCacheEntry(const void* aKey, nsRefPtr<T>& aAccessNode, void* aUserArg)
 {
--- a/accessible/src/base/nsAccEvent.cpp
+++ b/accessible/src/base/nsAccEvent.cpp
@@ -33,28 +33,32 @@
  * and other provisions required by the GPL or the LGPL. If you do not delete
  * the provisions above, a recipient may use your version of this file under
  * the terms of any one of the MPL, the GPL or the LGPL.
  *
  * ***** END LICENSE BLOCK ***** */
 
 #include "nsAccEvent.h"
 
+#include "nsAccessibilityService.h"
+#include "nsAccUtils.h"
 #include "nsApplicationAccessibleWrap.h"
 #include "nsDocAccessible.h"
+#include "nsIAccessibleText.h"
+#ifdef MOZ_XUL
+#include "nsXULTreeAccessible.h"
+#endif
 
 #include "nsIDOMDocument.h"
 #include "nsIEventStateManager.h"
 #include "nsIPersistentProperties2.h"
 #include "nsIServiceManager.h"
 #ifdef MOZ_XUL
 #include "nsIDOMXULMultSelectCntrlEl.h"
-#include "nsXULTreeAccessible.h"
 #endif
-#include "nsIAccessibleText.h"
 #include "nsIContent.h"
 #include "nsIPresShell.h"
 #include "nsPresContext.h"
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsAccEvent
 ////////////////////////////////////////////////////////////////////////////////
 
@@ -188,25 +192,20 @@ nsAccEvent::GetDocAccessible()
 // nsAccEvent: protected methods
 
 already_AddRefed<nsIAccessible>
 nsAccEvent::GetAccessibleByNode()
 {
   if (!mNode)
     return nsnull;
 
-  nsCOMPtr<nsIAccessibilityService> accService = 
-    do_GetService("@mozilla.org/accessibilityService;1");
-  if (!accService)
-    return nsnull;
-
   nsCOMPtr<nsIDOMNode> DOMNode(do_QueryInterface(mNode));
 
   nsCOMPtr<nsIAccessible> accessible;
-  accService->GetAccessibleFor(DOMNode, getter_AddRefs(accessible));
+  GetAccService()->GetAccessibleFor(DOMNode, getter_AddRefs(accessible));
 
 #ifdef MOZ_XUL
   // hack for xul tree table. We need a better way for firing delayed event
   // against xul tree table. see bug 386821.
   // There will be problem if some day we want to fire delayed event against
   // the xul tree itself or an unselected treeitem.
   nsCOMPtr<nsIContent> content(do_QueryInterface(mNode));
   if (content && content->NodeInfo()->Equals(nsAccessibilityAtoms::tree,
@@ -214,18 +213,17 @@ nsAccEvent::GetAccessibleByNode()
 
     nsCOMPtr<nsIDOMXULMultiSelectControlElement> multiSelect =
       do_QueryInterface(mNode);
 
     if (multiSelect) {
       PRInt32 treeIndex = -1;
       multiSelect->GetCurrentIndex(&treeIndex);
       if (treeIndex >= 0) {
-        nsRefPtr<nsXULTreeAccessible> treeAcc =
-          nsAccUtils::QueryAccessibleTree(accessible);
+        nsRefPtr<nsXULTreeAccessible> treeAcc = do_QueryObject(accessible);
         if (treeAcc)
           accessible = treeAcc->GetTreeItemAccessible(treeIndex);
       }
     }
   }
 #endif
 
   return accessible.forget();
--- a/accessible/src/base/nsAccUtils.cpp
+++ b/accessible/src/base/nsAccUtils.cpp
@@ -37,23 +37,24 @@
  * ***** END LICENSE BLOCK ***** */
 
 #include "nsCoreUtils.h"
 #include "nsAccUtils.h"
 
 #include "nsIAccessibleStates.h"
 #include "nsIAccessibleTypes.h"
 
+#include "nsAccessibilityService.h"
+#include "nsAccessibilityAtoms.h"
+#include "nsAccessible.h"
+#include "nsAccTreeWalker.h"
+#include "nsARIAMap.h"
+#include "nsDocAccessible.h"
 #include "nsHyperTextAccessible.h"
 #include "nsHTMLTableAccessible.h"
-#include "nsDocAccessible.h"
-#include "nsAccessibilityAtoms.h"
-#include "nsAccTreeWalker.h"
-#include "nsAccessible.h"
-#include "nsARIAMap.h"
 #include "nsXULTreeGridAccessible.h"
 
 #include "nsIDOMXULContainerElement.h"
 #include "nsIDOMXULSelectCntrlEl.h"
 #include "nsIDOMXULSelectCntrlItemEl.h"
 #include "nsWhitespaceTokenizer.h"
 #include "nsComponentManagerUtils.h"
 
@@ -523,17 +524,17 @@ nsAccUtils::GetMultiSelectableContainer(
     return container.forget();
 
   return nsnull;
 }
 
 PRBool
 nsAccUtils::IsARIASelected(nsIAccessible *aAccessible)
 {
-  nsRefPtr<nsAccessible> acc = nsAccUtils::QueryAccessible(aAccessible);
+  nsRefPtr<nsAccessible> acc = do_QueryObject(aAccessible);
   nsCOMPtr<nsIDOMNode> node;
   acc->GetDOMNode(getter_AddRefs(node));
   NS_ASSERTION(node, "No DOM node!");
 
   if (node) {
     nsCOMPtr<nsIContent> content(do_QueryInterface(node));
     if (content->AttrValueIs(kNameSpaceID_None,
                              nsAccessibilityAtoms::aria_selected,
@@ -681,21 +682,21 @@ nsAccUtils::GetScreenCoordsForWindow(nsI
 nsIntPoint
 nsAccUtils::GetScreenCoordsForParent(nsIAccessNode *aAccessNode)
 {
   nsRefPtr<nsAccessNode> parent;
   nsCOMPtr<nsIAccessible> accessible(do_QueryInterface(aAccessNode));
   if (accessible) {
     nsCOMPtr<nsIAccessible> parentAccessible;
     accessible->GetParent(getter_AddRefs(parentAccessible));
-    parent = nsAccUtils::QueryAccessNode(parentAccessible);
+    parent = do_QueryObject(parentAccessible);
   } else {
     nsCOMPtr<nsIAccessNode> parentAccessNode;
     aAccessNode->GetParentNode(getter_AddRefs(parentAccessNode));
-    parent = nsAccUtils::QueryAccessNode(parentAccessNode);
+    parent = do_QueryObject(parentAccessNode);
   }
 
   if (!parent)
     return nsIntPoint(0, 0);
 
   nsIFrame *parentFrame = parent->GetFrame();
   if (!parentFrame)
     return nsIntPoint(0, 0);
@@ -780,78 +781,16 @@ nsAccUtils::GetLiveAttrValue(PRUint32 aR
     case ePoliteLiveAttr:
       aValue = NS_LITERAL_STRING("polite");
       return PR_TRUE;
   }
 
   return PR_FALSE;
 }
 
-already_AddRefed<nsAccessible>
-nsAccUtils::QueryAccessible(nsIAccessible *aAccessible)
-{
-  nsAccessible* acc = nsnull;
-  if (aAccessible)
-    CallQueryInterface(aAccessible, &acc);
-
-  return acc;
-}
-
-already_AddRefed<nsAccessible>
-nsAccUtils::QueryAccessible(nsIAccessNode *aAccessNode)
-{
-  nsAccessible* acc = nsnull;
-  if (aAccessNode)
-    CallQueryInterface(aAccessNode, &acc);
-
-  return acc;
-}
-
-already_AddRefed<nsHTMLTableAccessible>
-nsAccUtils::QueryAccessibleTable(nsIAccessibleTable *aAccessibleTable)
-{
-  nsHTMLTableAccessible* accessible = nsnull;
-  if (aAccessibleTable)
-    CallQueryInterface(aAccessibleTable, &accessible);
-  
-  return accessible;
-}
-
-already_AddRefed<nsDocAccessible>
-nsAccUtils::QueryAccessibleDocument(nsIAccessible *aAccessible)
-{
-  nsDocAccessible* accessible = nsnull;
-  if (aAccessible)
-    CallQueryInterface(aAccessible, &accessible);
-
-  return accessible;
-}
-
-already_AddRefed<nsDocAccessible>
-nsAccUtils::QueryAccessibleDocument(nsIAccessibleDocument *aAccessibleDocument)
-{
-  nsDocAccessible* accessible = nsnull;
-  if (aAccessibleDocument)
-    CallQueryInterface(aAccessibleDocument, &accessible);
-
-  return accessible;
-}
-
-#ifdef MOZ_XUL
-already_AddRefed<nsXULTreeAccessible>
-nsAccUtils::QueryAccessibleTree(nsIAccessible *aAccessible)
-{
-  nsXULTreeAccessible* accessible = nsnull;
-  if (aAccessible)
-    CallQueryInterface(aAccessible, &accessible);
-
-  return accessible;
-}
-#endif
-
 #ifdef DEBUG_A11Y
 
 PRBool
 nsAccUtils::IsTextInterfaceSupportCorrect(nsIAccessible *aAccessible)
 {
   PRBool foundText = PR_FALSE;
   
   nsCOMPtr<nsIAccessibleDocument> accDoc = do_QueryInterface(aAccessible);
@@ -884,17 +823,17 @@ nsAccUtils::IsTextInterfaceSupportCorrec
 #endif
 
 PRInt32
 nsAccUtils::TextLength(nsIAccessible *aAccessible)
 {
   if (!IsText(aAccessible))
     return 1;
   
-  nsRefPtr<nsAccessNode> accNode = nsAccUtils::QueryAccessNode(aAccessible);
+  nsRefPtr<nsAccessNode> accNode = do_QueryObject(aAccessible);
   
   nsIFrame *frame = accNode->GetFrame();
   if (frame && frame->GetType() == nsAccessibilityAtoms::textFrame) {
     // Ensure that correct text length is calculated (with non-rendered
     // whitespace chars not counted).
     nsIContent *content = frame->GetContent();
     if (content) {
       PRUint32 length;
@@ -903,17 +842,17 @@ nsAccUtils::TextLength(nsIAccessible *aA
       return NS_SUCCEEDED(rv) ? static_cast<PRInt32>(length) : -1;
     }
   }
   
   // For list bullets (or anything other accessible which would compute its own
   // text. They don't have their own frame.
   // XXX In the future, list bullets may have frame and anon content, so 
   // we should be able to remove this at that point
-  nsRefPtr<nsAccessible> acc(nsAccUtils::QueryAccessible(aAccessible));
+  nsRefPtr<nsAccessible> acc(do_QueryObject(aAccessible));
 
   nsAutoString text;
   acc->AppendTextTo(text, 0, PR_UINT32_MAX); // Get all the text
   return text.Length();
 }
 
 PRBool
 nsAccUtils::MustPrune(nsIAccessible *aAccessible)
--- a/accessible/src/base/nsAccUtils.h
+++ b/accessible/src/base/nsAccUtils.h
@@ -345,93 +345,16 @@ public:
   {
     DestinationType* object = nsnull;
     if (aObject)
       CallQueryInterface(aObject.get(), &object);
     
     return object;
   }
 
-  /**
-   * Query nsAccessNode from the given nsIAccessible.
-   */
-  static already_AddRefed<nsAccessNode>
-    QueryAccessNode(nsIAccessible *aAccessible)
-  {
-    nsAccessNode* accessNode = nsnull;
-    if (aAccessible)
-      CallQueryInterface(aAccessible, &accessNode);
-
-    return accessNode;
-  }
-
-  /**
-   * Query nsAccessNode from the given nsIAccessNode.
-   */
-  static already_AddRefed<nsAccessNode>
-    QueryAccessNode(nsIAccessNode *aAccessNode)
-  {
-    nsAccessNode* accessNode = nsnull;
-    if (aAccessNode)
-      CallQueryInterface(aAccessNode, &accessNode);
-    
-    return accessNode;
-  }
-
-  /**
-   * Query nsAccessNode from the given nsIAccessNode.
-   */
-  static already_AddRefed<nsAccessNode>
-    QueryAccessNode(nsIAccessibleDocument *aAccessibleDocument)
-  {
-    nsAccessNode* accessNode = nsnull;
-    if (aAccessibleDocument)
-      CallQueryInterface(aAccessibleDocument, &accessNode);
-    
-    return accessNode;
-  }
-
-  /**
-   * Query nsAccessible from the given nsIAccessible.
-   */
-  static already_AddRefed<nsAccessible>
-    QueryAccessible(nsIAccessible *aAccessible);
-
-  /**
-   * Query nsAccessible from the given nsIAccessNode.
-   */
-  static already_AddRefed<nsAccessible>
-    QueryAccessible(nsIAccessNode *aAccessNode);
-
-  /**
-   * Query nsHTMLTableAccessible from the given nsIAccessibleTable.
-   */
-  static already_AddRefed<nsHTMLTableAccessible>
-    QueryAccessibleTable(nsIAccessibleTable *aAccessibleTable);
-
-  /**
-   * Query nsDocAccessible from the given nsIAccessible.
-   */
-  static already_AddRefed<nsDocAccessible>
-    QueryAccessibleDocument(nsIAccessible *aAccessible);
-
-  /**
-   * Query nsDocAccessible from the given nsIAccessibleDocument.
-   */
-  static already_AddRefed<nsDocAccessible>
-    QueryAccessibleDocument(nsIAccessibleDocument *aAccessibleDocument);
-
-#ifdef MOZ_XUL
-  /**
-   * Query nsXULTreeAccessible from the given nsIAccessible.
-   */
-  static already_AddRefed<nsXULTreeAccessible>
-    QueryAccessibleTree(nsIAccessible *aAccessible);
-#endif
-
 #ifdef DEBUG_A11Y
   /**
    * Detect whether the given accessible object implements nsIAccessibleText,
    * when it is text or has text child node.
    */
   static PRBool IsTextInterfaceSupportCorrect(nsIAccessible *aAccessible);
 #endif
 
--- a/accessible/src/base/nsAccessNode.cpp
+++ b/accessible/src/base/nsAccessNode.cpp
@@ -32,26 +32,31 @@
  * decision by deleting the provisions above and replace them with the notice
  * and other provisions required by the GPL or the LGPL. If you do not delete
  * the provisions above, a recipient may use your version of this file under
  * the terms of any one of the MPL, the GPL or the LGPL.
  *
  * ***** END LICENSE BLOCK ***** */
 
 #include "nsDocAccessible.h"
+
 #include "nsIAccessible.h"
+
+#include "nsAccCache.h"
 #include "nsAccessibilityAtoms.h"
+#include "nsAccUtils.h"
+#include "nsCoreUtils.h"
+
 #include "nsHashtable.h"
 #include "nsAccessibilityService.h"
 #include "nsApplicationAccessibleWrap.h"
 #include "nsIAccessibleDocument.h"
 #include "nsIDocShell.h"
 #include "nsIDocShellTreeItem.h"
 #include "nsIDocument.h"
-#include "nsIDOMCSSStyleDeclaration.h"
 #include "nsIDOMCSSPrimitiveValue.h"
 #include "nsIDOMDocument.h"
 #include "nsIDOMElement.h"
 #include "nsIDOMHTMLDocument.h"
 #include "nsIDOMHTMLElement.h"
 #include "nsIDOMNSDocument.h"
 #include "nsIDOMNSHTMLElement.h"
 #include "nsIDOMWindow.h"
@@ -62,16 +67,17 @@
 #include "nsIPrefBranch.h"
 #include "nsPresContext.h"
 #include "nsIPresShell.h"
 #include "nsIServiceManager.h"
 #include "nsIStringBundle.h"
 #include "nsRootAccessible.h"
 #include "nsFocusManager.h"
 #include "nsIObserverService.h"
+#include "mozilla/Services.h"
 
 /* For documentation of the accessibility architecture, 
  * see http://lxr.mozilla.org/seamonkey/source/accessible/accessible-docs.html
  */
 
 nsIStringBundle *nsAccessNode::gStringBundle = 0;
 nsIStringBundle *nsAccessNode::gKeyStringBundle = 0;
 nsIDOMNode *nsAccessNode::gLastFocusedNode = 0;
@@ -161,18 +167,17 @@ nsAccessNode::Init()
     NS_ASSERTION(docAccessible, "Cannot cache new nsAccessNode");
     if (!docAccessible) {
       return NS_ERROR_FAILURE;
     }
   }
 
   void* uniqueID;
   GetUniqueID(&uniqueID);
-  nsRefPtr<nsDocAccessible> docAcc =
-    nsAccUtils::QueryAccessibleDocument(docAccessible);
+  nsRefPtr<nsDocAccessible> docAcc = do_QueryObject(docAccessible);
   NS_ASSERTION(docAcc, "No nsDocAccessible for document accessible!");
 
   if (!docAcc->CacheAccessNode(uniqueID, this))
     return NS_ERROR_OUT_OF_MEMORY;
 
   // Make sure an ancestor in real content is cached
   // so that nsDocAccessible::RefreshNodes() can find the anonymous subtree to release when
   // the root node goes away
@@ -272,24 +277,25 @@ void nsAccessNode::InitXPAccessibility()
 
   NotifyA11yInitOrShutdown(PR_TRUE);
 }
 
 // nsAccessNode protected static
 void nsAccessNode::NotifyA11yInitOrShutdown(PRBool aIsInit)
 {
   nsCOMPtr<nsIObserverService> obsService =
-    do_GetService("@mozilla.org/observer-service;1");
+    mozilla::services::GetObserverService();
   NS_ASSERTION(obsService, "No observer service to notify of a11y init/shutdown");
-  if (obsService) {
-    static const PRUnichar kInitIndicator[] = { '1', 0 };
-    static const PRUnichar kShutdownIndicator[] = { '0', 0 }; 
-    obsService->NotifyObservers(nsnull, "a11y-init-or-shutdown",
-                                aIsInit ? kInitIndicator  : kShutdownIndicator);
-  }
+  if (!obsService)
+    return;
+
+  static const PRUnichar kInitIndicator[] = { '1', 0 };
+  static const PRUnichar kShutdownIndicator[] = { '0', 0 }; 
+  obsService->NotifyObservers(nsnull, "a11y-init-or-shutdown",
+                              aIsInit ? kInitIndicator  : kShutdownIndicator);
 }
 
 void nsAccessNode::ShutdownXPAccessibility()
 {
   // Called by nsAccessibilityService::Shutdown()
   // which happens when xpcom is shutting down
   // at exit of program
 
@@ -501,21 +507,20 @@ nsresult
 nsAccessNode::MakeAccessNode(nsIDOMNode *aNode, nsIAccessNode **aAccessNode)
 {
   *aAccessNode = nsnull;
   
   nsCOMPtr<nsIAccessNode> accessNode =
     GetAccService()->GetCachedAccessNode(aNode, mWeakShell);
 
   if (!accessNode) {
-    nsCOMPtr<nsIAccessible> accessible;
-    GetAccService()->GetAccessibleInWeakShell(aNode, mWeakShell,
-                                              getter_AddRefs(accessible));
+    nsRefPtr<nsAccessible> accessible =
+      GetAccService()->GetAccessibleInWeakShell(aNode, mWeakShell);
 
-    accessNode = do_QueryInterface(accessible);
+    accessNode = accessible;
   }
 
   if (accessNode) {
     NS_ADDREF(*aAccessNode = accessNode);
     return NS_OK;
   }
 
   nsAccessNode *newAccessNode = new nsAccessNode(aNode, mWeakShell);
--- a/accessible/src/base/nsAccessNode.h
+++ b/accessible/src/base/nsAccessNode.h
@@ -38,68 +38,45 @@
 
 /* For documentation of the accessibility architecture, 
  * see http://lxr.mozilla.org/seamonkey/source/accessible/accessible-docs.html
  */
 
 #ifndef _nsAccessNode_H_
 #define _nsAccessNode_H_
 
-#include "nsAccCache.h"
-#include "nsAccessibilityAtoms.h"
-#include "nsCoreUtils.h"
-#include "nsAccUtils.h"
+#include "nsIAccessNode.h"
+#include "nsIAccessibleTypes.h"
 
-#include "nsIAccessibleTypes.h"
-#include "nsIAccessNode.h"
+#include "a11yGeneric.h"
+
 #include "nsIContent.h"
 #include "nsIDOMNode.h"
 #include "nsINameSpaceManager.h"
 #include "nsIStringBundle.h"
+#include "nsRefPtrHashtable.h"
 #include "nsWeakReference.h"
-#include "nsAccessibilityService.h"
+
+class nsAccessNode;
+class nsApplicationAccessible;
+class nsDocAccessible;
+class nsIAccessibleDocument;
+class nsRootAccessible;
 
 class nsIPresShell;
 class nsPresContext;
-class nsIAccessibleDocument;
 class nsIFrame;
-class nsIDOMNodeList;
-class nsRootAccessible;
-class nsApplicationAccessible;
 class nsIDocShellTreeItem;
 
+typedef nsRefPtrHashtable<nsVoidPtrHashKey, nsAccessNode>
+  nsAccessNodeHashtable;
+
 #define ACCESSIBLE_BUNDLE_URL "chrome://global-platform/locale/accessible.properties"
 #define PLATFORM_KEYS_BUNDLE_URL "chrome://global-platform/locale/platformKeys.properties"
 
-// What we want is: NS_INTERFACE_MAP_ENTRY(self) for static IID accessors,
-// but some of our classes have an ambiguous base class of nsISupports which
-// prevents this from working (the default macro converts it to nsISupports,
-// then addrefs it, then returns it). Therefore, we expand the macro here and
-// change it so that it works. Yuck.
-#define NS_INTERFACE_MAP_STATIC_AMBIGUOUS(_class) \
-  if (aIID.Equals(NS_GET_IID(_class))) { \
-  NS_ADDREF(this); \
-  *aInstancePtr = this; \
-  return NS_OK; \
-  } else
-
-#define NS_OK_DEFUNCT_OBJECT \
-NS_ERROR_GENERATE_SUCCESS(NS_ERROR_MODULE_GENERAL, 0x22)
-
-#define NS_ENSURE_A11Y_SUCCESS(res, ret)                                  \
-  PR_BEGIN_MACRO                                                          \
-    nsresult __rv = res; /* Don't evaluate |res| more than once */        \
-    if (NS_FAILED(__rv)) {                                                \
-      NS_ENSURE_SUCCESS_BODY(res, ret)                                    \
-      return ret;                                                         \
-    }                                                                     \
-    if (__rv == NS_OK_DEFUNCT_OBJECT)                                     \
-      return ret;                                                         \
-  PR_END_MACRO
-
 #define NS_ACCESSNODE_IMPL_CID                          \
 {  /* 2b07e3d7-00b3-4379-aa0b-ea22e2c8ffda */           \
   0x2b07e3d7,                                           \
   0x00b3,                                               \
   0x4379,                                               \
   { 0xaa, 0x0b, 0xea, 0x22, 0xe2, 0xc8, 0xff, 0xda }    \
 }
 
--- a/accessible/src/base/nsAccessibilityAtomList.h
+++ b/accessible/src/base/nsAccessibilityAtomList.h
@@ -192,16 +192,17 @@ ACCESSIBILITY_ATOM(scope, "scope") // HT
 ACCESSIBILITY_ATOM(simple, "simple") // XLink
 ACCESSIBILITY_ATOM(src, "src")
 ACCESSIBILITY_ATOM(selected, "selected")
 ACCESSIBILITY_ATOM(summary, "summary")
 ACCESSIBILITY_ATOM(tabindex, "tabindex")
 ACCESSIBILITY_ATOM(title, "title")
 ACCESSIBILITY_ATOM(tooltiptext, "tooltiptext")
 ACCESSIBILITY_ATOM(type, "type")
+ACCESSIBILITY_ATOM(usemap, "usemap")
 ACCESSIBILITY_ATOM(value, "value")
 
   // Alphabetical list of object attributes
 ACCESSIBILITY_ATOM(checkable, "checkable")
 ACCESSIBILITY_ATOM(display, "display")
 ACCESSIBILITY_ATOM(eventFromInput, "event-from-input")
 ACCESSIBILITY_ATOM(textAlign, "text-align")
 ACCESSIBILITY_ATOM(textIndent, "text-indent")
--- a/accessible/src/base/nsAccessibilityService.cpp
+++ b/accessible/src/base/nsAccessibilityService.cpp
@@ -42,53 +42,55 @@
 #include "nsCoreUtils.h"
 #include "nsAccUtils.h"
 #include "nsApplicationAccessibleWrap.h"
 #include "nsARIAGridAccessibleWrap.h"
 #include "nsARIAMap.h"
 #include "nsIContentViewer.h"
 #include "nsCURILoader.h"
 #include "nsDocAccessible.h"
-#include "nsHTMLImageAccessibleWrap.h"
+#include "nsHTMLImageMapAccessible.h"
 #include "nsHTMLLinkAccessible.h"
 #include "nsHTMLSelectAccessible.h"
 #include "nsHTMLTableAccessibleWrap.h"
 #include "nsHTMLTextAccessible.h"
 #include "nsHyperTextAccessibleWrap.h"
 #include "nsIAccessibilityService.h"
 #include "nsIAccessibleProvider.h"
+
 #include "nsIDOMDocument.h"
 #include "nsIDOMHTMLAreaElement.h"
 #include "nsIDOMHTMLLegendElement.h"
 #include "nsIDOMHTMLObjectElement.h"
 #include "nsIDOMHTMLOptGroupElement.h"
 #include "nsIDOMHTMLOptionElement.h"
 #include "nsIDOMWindow.h"
 #include "nsIDOMXULElement.h"
+#include "nsIHTMLDocument.h"
 #include "nsIDocShell.h"
 #include "nsIFrame.h"
 #include "nsIInterfaceRequestorUtils.h"
 #include "nsIImageFrame.h"
 #include "nsILink.h"
 #include "nsINameSpaceManager.h"
 #include "nsIObserverService.h"
 #include "nsIPluginInstance.h"
 #include "nsIPresShell.h"
 #include "nsISupportsUtils.h"
 #include "nsIWebNavigation.h"
 #include "nsObjectFrame.h"
 #include "nsOuterDocAccessible.h"
 #include "nsRootAccessibleWrap.h"
 #include "nsTextFragment.h"
-#include "nsPresContext.h"
 #include "nsServiceManagerUtils.h"
 #include "nsUnicharUtils.h"
 #include "nsIWebProgress.h"
 #include "nsNetError.h"
 #include "nsDocShellLoadTypes.h"
+#include "mozilla/Services.h"
 
 #ifdef MOZ_XUL
 #include "nsXULAlertAccessible.h"
 #include "nsXULColorPickerAccessible.h"
 #include "nsXULComboboxAccessible.h"
 #include "nsXULFormControlAccessible.h"
 #include "nsXULListboxAccessibleWrap.h"
 #include "nsXULMenuAccessibleWrap.h"
@@ -113,18 +115,18 @@
 ////////////////////////////////////////////////////////////////////////////////
 
 nsAccessibilityService *nsAccessibilityService::gAccessibilityService = nsnull;
 PRBool nsAccessibilityService::gIsShutdown = PR_TRUE;
 
 nsAccessibilityService::nsAccessibilityService()
 {
   // Add observers.
-  nsCOMPtr<nsIObserverService> observerService = 
-    do_GetService("@mozilla.org/observer-service;1");
+  nsCOMPtr<nsIObserverService> observerService =
+    mozilla::services::GetObserverService();
   if (!observerService)
     return;
 
   observerService->AddObserver(this, NS_XPCOM_SHUTDOWN_OBSERVER_ID, PR_FALSE);
   nsCOMPtr<nsIWebProgress> progress(do_GetService(NS_DOCUMENTLOADER_SERVICE_CONTRACTID));
   if (progress) {
     progress->AddProgressListener(static_cast<nsIWebProgressListener*>(this),
                                   nsIWebProgress::NOTIFY_STATE_DOCUMENT);
@@ -149,21 +151,21 @@ NS_IMPL_THREADSAFE_ISUPPORTS5(nsAccessib
 
 NS_IMETHODIMP
 nsAccessibilityService::Observe(nsISupports *aSubject, const char *aTopic,
                          const PRUnichar *aData)
 {
   if (!nsCRT::strcmp(aTopic, NS_XPCOM_SHUTDOWN_OBSERVER_ID)) {
 
     // Remove observers.
-    nsCOMPtr<nsIObserverService> observerService = 
-      do_GetService("@mozilla.org/observer-service;1");
-    if (observerService) {
+    nsCOMPtr<nsIObserverService> observerService =
+      mozilla::services::GetObserverService();
+    if (observerService)
       observerService->RemoveObserver(this, NS_XPCOM_SHUTDOWN_OBSERVER_ID);
-    }
+
     nsCOMPtr<nsIWebProgress> progress(do_GetService(NS_DOCUMENTLOADER_SERVICE_CONTRACTID));
     if (progress)
       progress->RemoveProgressListener(static_cast<nsIWebProgressListener*>(this));
 
     // Application is going to be closed, shutdown accessibility and mark
     // accessibility service as shutdown to prevent calls of its methods.
     // Don't null accessibility service static member at this point to be safe
     // if someone will try to operate with it.
@@ -240,55 +242,66 @@ nsAccessibilityService::ProcessDocLoadEv
       
   nsCOMPtr<nsIDOMDocument> domDoc;
   domWindow->GetDocument(getter_AddRefs(domDoc));
   nsCOMPtr<nsIDOMNode> docNode = do_QueryInterface(domDoc);
   NS_ENSURE_TRUE(docNode,);
 
   nsCOMPtr<nsIAccessible> accessible;
   GetAccessibleFor(docNode, getter_AddRefs(accessible));
-  nsRefPtr<nsDocAccessible> docAcc =
-    nsAccUtils::QueryAccessibleDocument(accessible);
+  nsRefPtr<nsDocAccessible> docAcc = do_QueryObject(accessible);
   NS_ENSURE_TRUE(docAcc,);
 
   docAcc->FireDocLoadEvents(aEventType);
 }
 
 // nsIAccessibilityService
-NS_IMETHODIMP
+void
 nsAccessibilityService::NotifyOfAnchorJumpTo(nsIContent *aTarget)
 {
+  nsIDocument *document = aTarget->GetCurrentDoc();
+  nsCOMPtr<nsIDOMNode> documentNode(do_QueryInterface(document));
+  if (!documentNode)
+    return;
+
   nsCOMPtr<nsIDOMNode> targetNode(do_QueryInterface(aTarget));
 
   nsCOMPtr<nsIAccessible> targetAcc;
   GetAccessibleFor(targetNode, getter_AddRefs(targetAcc));
 
+  // Getting the targetAcc above will have ensured accessible doc creation.
+  // XXX Bug 561683
+  nsRefPtr<nsDocAccessible> accessibleDoc =
+    nsAccessNode::GetDocAccessibleFor(documentNode);
+  if (!accessibleDoc)
+    return;
+
   // If the jump target is not accessible then fire an event for nearest
   // accessible in parent chain.
   if (!targetAcc) {
-    nsIDocument *document = aTarget->GetCurrentDoc();
-    nsCOMPtr<nsIDOMNode> documentNode(do_QueryInterface(document));
-    if (documentNode) {
-      nsCOMPtr<nsIAccessibleDocument> accessibleDoc =
-        nsAccessNode::GetDocAccessibleFor(documentNode);
-      if (accessibleDoc)
         accessibleDoc->GetAccessibleInParentChain(targetNode, PR_TRUE,
                                                   getter_AddRefs(targetAcc));
-    }
+        nsCOMPtr<nsIAccessNode> accNode = do_QueryInterface(targetAcc);
+        accNode->GetDOMNode(getter_AddRefs(targetNode));
   }
 
-  if (targetAcc)
-    nsEventShell::FireEvent(nsIAccessibleEvent::EVENT_SCROLLING_START,
-                            targetAcc);
+  NS_ASSERTION(targetNode,
+      "No accessible in parent chain!? Expect at least a document accessible.");
+  if (!targetNode)
+    return;
 
-  return NS_OK;
+  // XXX note in rare cases the node could go away before we flush the queue,
+  // for example if the node becomes inaccessible, or is removed from the DOM.
+  accessibleDoc->FireDelayedAccessibleEvent(
+                     nsIAccessibleEvent::EVENT_SCROLLING_START,
+                     targetNode);
 }
 
 // nsIAccessibilityService
-NS_IMETHODIMP
+nsresult
 nsAccessibilityService::FireAccessibleEvent(PRUint32 aEvent,
                                             nsIAccessible *aTarget)
 {
   nsEventShell::FireEvent(aEvent, aTarget);
   return NS_OK;
 }
 
 /* void onProgressChange (in nsIWebProgress aWebProgress, in nsIRequest aRequest, in long aCurSelfProgress, in long aMaxSelfProgress, in long aCurTotalProgress, in long aMaxTotalProgress); */
@@ -376,17 +389,17 @@ nsAccessibilityService::GetShellFromNode
   NS_IF_ADDREF(*aWeakShell);
 
   return NS_OK;
 }
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsIAccessibilityService
 
-NS_IMETHODIMP 
+nsresult
 nsAccessibilityService::CreateOuterDocAccessible(nsIDOMNode* aDOMNode, 
                                                  nsIAccessible **aOuterDocAccessible)
 {
   NS_ENSURE_ARG_POINTER(aDOMNode);
   
   *aOuterDocAccessible = nsnull;
 
   nsCOMPtr<nsIWeakReference> outerWeakShell;
@@ -458,34 +471,34 @@ nsAccessibilityService::CreateDocOrRootA
   }
 
   return accessible.forget();
 }
 
  /**
    * HTML widget creation
    */
-NS_IMETHODIMP
+nsresult
 nsAccessibilityService::CreateHTML4ButtonAccessible(nsIFrame *aFrame, nsIAccessible **_retval)
 {
   nsCOMPtr<nsIDOMNode> node;
   nsCOMPtr<nsIWeakReference> weakShell;
   nsresult rv = GetInfo(aFrame, getter_AddRefs(weakShell), getter_AddRefs(node));
   if (NS_FAILED(rv))
     return rv;
 
   *_retval = new nsHTML4ButtonAccessible(node, weakShell);
   if (! *_retval) 
     return NS_ERROR_OUT_OF_MEMORY;
 
   NS_ADDREF(*_retval);
   return NS_OK;
 }
 
-NS_IMETHODIMP
+nsresult
 nsAccessibilityService::CreateHTMLButtonAccessible(nsIFrame *aFrame, nsIAccessible **_retval)
 {
   nsCOMPtr<nsIDOMNode> node;
   nsCOMPtr<nsIWeakReference> weakShell;
   nsresult rv = GetInfo(aFrame, getter_AddRefs(weakShell), getter_AddRefs(node));
   if (NS_FAILED(rv))
     return rv;
 
@@ -563,17 +576,17 @@ nsAccessibilityService::CreateHTMLAccess
   }
   else if (nsCoreUtils::IsHTMLTableHeader(content)) {
     accessible = new nsHTMLTableHeaderCellAccessibleWrap(aNode, aWeakShell);
   }
 
   return accessible.forget();
 }
 
-NS_IMETHODIMP
+nsresult
 nsAccessibilityService::CreateHTMLLIAccessible(nsIFrame *aFrame, 
                                                nsIFrame *aBulletFrame,
                                                const nsAString& aBulletText,
                                                nsIAccessible **_retval)
 {
   nsCOMPtr<nsIDOMNode> node;
   nsCOMPtr<nsIWeakReference> weakShell;
   nsresult rv = GetInfo(aFrame, getter_AddRefs(weakShell), getter_AddRefs(node));
@@ -583,17 +596,17 @@ nsAccessibilityService::CreateHTMLLIAcce
   *_retval = new nsHTMLLIAccessible(node, weakShell, aBulletText);
   if (! *_retval) 
     return NS_ERROR_OUT_OF_MEMORY;
 
   NS_ADDREF(*_retval);
   return NS_OK;
 }
 
-NS_IMETHODIMP
+nsresult
 nsAccessibilityService::CreateHyperTextAccessible(nsIFrame *aFrame, nsIAccessible **aAccessible)
 {
   nsCOMPtr<nsIDOMNode> node;
   nsCOMPtr<nsIWeakReference> weakShell;
   nsresult rv = GetInfo(aFrame, getter_AddRefs(weakShell), getter_AddRefs(node));
   if (NS_FAILED(rv))
     return rv;
 
@@ -602,101 +615,123 @@ nsAccessibilityService::CreateHyperTextA
   
   *aAccessible = new nsHyperTextAccessibleWrap(node, weakShell);
   NS_ENSURE_TRUE(*aAccessible, NS_ERROR_OUT_OF_MEMORY);
 
   NS_ADDREF(*aAccessible);
   return NS_OK;
 }
 
-NS_IMETHODIMP
+nsresult
 nsAccessibilityService::CreateHTMLCheckboxAccessible(nsIFrame *aFrame, nsIAccessible **_retval)
 {
   nsCOMPtr<nsIDOMNode> node;
   nsCOMPtr<nsIWeakReference> weakShell;
   nsresult rv = GetInfo(aFrame, getter_AddRefs(weakShell), getter_AddRefs(node));
   if (NS_FAILED(rv))
     return rv;
 
   *_retval = new nsHTMLCheckboxAccessible(node, weakShell);
   if (! *_retval) 
     return NS_ERROR_OUT_OF_MEMORY;
 
   NS_ADDREF(*_retval);
   return NS_OK;
 }
 
-NS_IMETHODIMP 
+nsresult
 nsAccessibilityService::CreateHTMLComboboxAccessible(nsIDOMNode* aDOMNode, nsIWeakReference* aPresShell, nsIAccessible **_retval)
 {
   *_retval = new nsHTMLComboboxAccessible(aDOMNode, aPresShell);
   if (! *_retval)
     return NS_ERROR_OUT_OF_MEMORY;
 
   NS_ADDREF(*_retval);
   return NS_OK;
 }
 
-NS_IMETHODIMP
-nsAccessibilityService::CreateHTMLImageAccessible(nsIFrame *aFrame, nsIAccessible **_retval)
+nsresult
+nsAccessibilityService::CreateHTMLImageAccessible(nsIFrame *aFrame,
+                                                  nsIAccessible **aAccessible)
 {
+  NS_ENSURE_ARG_POINTER(aAccessible);
+  *aAccessible = nsnull;
+
   nsCOMPtr<nsIDOMNode> node;
   nsCOMPtr<nsIWeakReference> weakShell;
   nsresult rv = GetInfo(aFrame, getter_AddRefs(weakShell), getter_AddRefs(node));
   if (NS_FAILED(rv))
     return rv;
 
-  *_retval = nsnull;
-  nsCOMPtr<nsIDOMElement> domElement(do_QueryInterface(node));
-  if (domElement) {
-      *_retval = new nsHTMLImageAccessibleWrap(node, weakShell);
+  nsCOMPtr<nsIContent> content = do_QueryInterface(node);
+  NS_ENSURE_STATE(content);
+
+  nsCOMPtr<nsIHTMLDocument> htmlDoc =
+    do_QueryInterface(content->GetCurrentDoc());
+
+  nsCOMPtr<nsIDOMHTMLMapElement> mapElm;
+  if (htmlDoc) {
+    nsAutoString mapElmName;
+    content->GetAttr(kNameSpaceID_None, nsAccessibilityAtoms::usemap,
+                     mapElmName);
+
+    if (!mapElmName.IsEmpty()) {
+      if (mapElmName.CharAt(0) == '#')
+        mapElmName.Cut(0,1);
+      mapElm = htmlDoc->GetImageMap(mapElmName);
+    }
   }
 
-  if (! *_retval) 
+  if (mapElm)
+    *aAccessible = new nsHTMLImageMapAccessible(node, weakShell, mapElm);
+  else
+    *aAccessible = new nsHTMLImageAccessibleWrap(node, weakShell);
+
+  if (!*aAccessible)
     return NS_ERROR_OUT_OF_MEMORY;
 
-  NS_ADDREF(*_retval);
+  NS_ADDREF(*aAccessible);
   return NS_OK;
 }
 
-NS_IMETHODIMP
+nsresult
 nsAccessibilityService::CreateHTMLGenericAccessible(nsIFrame *aFrame, nsIAccessible **aAccessible)
 {
   return CreateHyperTextAccessible(aFrame, aAccessible);
 }
 
-NS_IMETHODIMP
+nsresult
 nsAccessibilityService::CreateHTMLGroupboxAccessible(nsIFrame *aFrame, nsIAccessible **_retval)
 {
   nsCOMPtr<nsIDOMNode> node;
   nsCOMPtr<nsIWeakReference> weakShell;
   nsresult rv = GetInfo(aFrame, getter_AddRefs(weakShell), getter_AddRefs(node));
   if (NS_FAILED(rv))
     return rv;
 
   *_retval = new nsHTMLGroupboxAccessible(node, weakShell);
   if (! *_retval) 
     return NS_ERROR_OUT_OF_MEMORY;
 
   NS_ADDREF(*_retval);
   return NS_OK;
 }
 
-NS_IMETHODIMP 
+nsresult
 nsAccessibilityService::CreateHTMLListboxAccessible(nsIDOMNode* aDOMNode, nsIWeakReference* aPresShell, nsIAccessible **_retval)
 {
   *_retval = new nsHTMLSelectListAccessible(aDOMNode, aPresShell);
   if (! *_retval) 
     return NS_ERROR_OUT_OF_MEMORY;
 
   NS_ADDREF(*_retval);
   return NS_OK;
 }
 
-NS_IMETHODIMP
+nsresult
 nsAccessibilityService::CreateHTMLMediaAccessible(nsIFrame *aFrame,
                                                   nsIAccessible **aAccessible)
 {
   NS_ENSURE_ARG_POINTER(aAccessible);
   *aAccessible = nsnull;
 
   nsCOMPtr<nsIDOMNode> node;
   nsCOMPtr<nsIWeakReference> weakShell;
@@ -716,17 +751,17 @@ nsAccessibilityService::CreateHTMLMediaA
   * We can have several cases here. 
   *  1) a text or html embedded document where the contentDocument
   *     variable in the object element holds the content
   *  2) web content that uses a plugin, which means we will
   *     have to go to the plugin to get the accessible content
   *  3) An image or imagemap, where the image frame points back to 
   *     the object element DOMNode
   */
-NS_IMETHODIMP
+nsresult
 nsAccessibilityService::CreateHTMLObjectFrameAccessible(nsObjectFrame *aFrame,
                                                         nsIAccessible **aAccessible)
 {
   nsCOMPtr<nsIDOMNode> node;
   nsCOMPtr<nsIWeakReference> weakShell;
   GetInfo(aFrame, getter_AddRefs(weakShell), getter_AddRefs(node));
 
   *aAccessible = nsnull;
@@ -765,65 +800,65 @@ nsAccessibilityService::CreateHTMLObject
   // we have the object frame, get the image frame
   nsIFrame *frame = aFrame->GetFirstChild(nsnull);
   if (frame)
     return frame->GetAccessible(aAccessible);
 
   return NS_OK;
 }
 
-NS_IMETHODIMP
+nsresult
 nsAccessibilityService::CreateHTMLRadioButtonAccessible(nsIFrame *aFrame, nsIAccessible **_retval)
 {
   nsCOMPtr<nsIDOMNode> node;
   nsCOMPtr<nsIWeakReference> weakShell;
   nsresult rv = GetInfo(aFrame, getter_AddRefs(weakShell), getter_AddRefs(node));
   if (NS_FAILED(rv))
     return rv;
 
   *_retval = new nsHTMLRadioButtonAccessible(node, weakShell);
   if (! *_retval) 
     return NS_ERROR_OUT_OF_MEMORY;
 
   NS_ADDREF(*_retval);
   return NS_OK;
 }
 
-NS_IMETHODIMP 
+nsresult
 nsAccessibilityService::CreateHTMLSelectOptionAccessible(nsIDOMNode* aDOMNode, 
                                                          nsIAccessible *aParent, 
                                                          nsIWeakReference* aPresShell, 
                                                          nsIAccessible **_retval)
 {
   *_retval = new nsHTMLSelectOptionAccessible(aDOMNode, aPresShell);
   if (! *_retval) 
     return NS_ERROR_OUT_OF_MEMORY;
 
   NS_ADDREF(*_retval);
   return NS_OK;
 }
 
-NS_IMETHODIMP
+nsresult
 nsAccessibilityService::CreateHTMLTableAccessible(nsIFrame *aFrame, nsIAccessible **_retval)
 {
   nsCOMPtr<nsIDOMNode> node;
   nsCOMPtr<nsIWeakReference> weakShell;
   nsresult rv = GetInfo(aFrame, getter_AddRefs(weakShell), getter_AddRefs(node));
   if (NS_FAILED(rv))
     return rv;
 
   *_retval = new nsHTMLTableAccessibleWrap(node, weakShell);
   if (! *_retval) 
     return NS_ERROR_OUT_OF_MEMORY;
 
   NS_ADDREF(*_retval);
   return NS_OK;
 }
 
-NS_IMETHODIMP
+nsresult
 nsAccessibilityService::CreateHTMLTableCellAccessible(nsIFrame *aFrame,
                                                       nsIAccessible **aAccessible)
 {
   nsCOMPtr<nsIDOMNode> node;
   nsCOMPtr<nsIWeakReference> weakShell;
   nsresult rv = GetInfo(aFrame, getter_AddRefs(weakShell), getter_AddRefs(node));
   if (NS_FAILED(rv))
     return rv;
@@ -831,17 +866,17 @@ nsAccessibilityService::CreateHTMLTableC
   *aAccessible = new nsHTMLTableCellAccessibleWrap(node, weakShell);
   if (!*aAccessible) 
     return NS_ERROR_OUT_OF_MEMORY;
 
   NS_ADDREF(*aAccessible);
   return NS_OK;
 }
 
-NS_IMETHODIMP
+nsresult
 nsAccessibilityService::CreateHTMLTextAccessible(nsIFrame *aFrame, nsIAccessible **_retval)
 {
   *_retval = nsnull;
 
   nsCOMPtr<nsIDOMNode> node;
   nsCOMPtr<nsIWeakReference> weakShell;
   nsresult rv = GetInfo(aFrame, getter_AddRefs(weakShell), getter_AddRefs(node));
   if (NS_FAILED(rv))
@@ -851,85 +886,85 @@ nsAccessibilityService::CreateHTMLTextAc
   *_retval = new nsHTMLTextAccessible(node, weakShell);
   if (! *_retval) 
     return NS_ERROR_OUT_OF_MEMORY;
 
   NS_ADDREF(*_retval);
   return NS_OK;
 }
 
-NS_IMETHODIMP
+nsresult
 nsAccessibilityService::CreateHTMLTextFieldAccessible(nsIFrame *aFrame, nsIAccessible **_retval)
 {
   nsCOMPtr<nsIDOMNode> node;
   nsCOMPtr<nsIWeakReference> weakShell;
   nsresult rv = GetInfo(aFrame, getter_AddRefs(weakShell), getter_AddRefs(node));
   if (NS_FAILED(rv))
     return rv;
 
   *_retval = new nsHTMLTextFieldAccessible(node, weakShell);
   if (! *_retval) 
     return NS_ERROR_OUT_OF_MEMORY;
 
   NS_ADDREF(*_retval);
   return NS_OK;
 }
 
-NS_IMETHODIMP
+nsresult
 nsAccessibilityService::CreateHTMLLabelAccessible(nsIFrame *aFrame, nsIAccessible **_retval)
 {
   nsCOMPtr<nsIDOMNode> node;
   nsCOMPtr<nsIWeakReference> weakShell;
   nsresult rv = GetInfo(aFrame, getter_AddRefs(weakShell), getter_AddRefs(node));
   if (NS_FAILED(rv))
     return rv;
 
   *_retval = new nsHTMLLabelAccessible(node, weakShell);
   if (! *_retval) 
     return NS_ERROR_OUT_OF_MEMORY;
 
   NS_ADDREF(*_retval);
   return NS_OK;
 }
 
-NS_IMETHODIMP
+nsresult
 nsAccessibilityService::CreateHTMLHRAccessible(nsIFrame *aFrame, nsIAccessible **_retval)
 {
   nsCOMPtr<nsIDOMNode> node;
   nsCOMPtr<nsIWeakReference> weakShell;
   nsresult rv = GetInfo(aFrame, getter_AddRefs(weakShell), getter_AddRefs(node));
   if (NS_FAILED(rv))
     return rv;
 
   *_retval = new nsHTMLHRAccessible(node, weakShell);
   if (! *_retval) 
     return NS_ERROR_OUT_OF_MEMORY;
 
   NS_ADDREF(*_retval);
   return NS_OK;
 }
 
-NS_IMETHODIMP
+nsresult
 nsAccessibilityService::CreateHTMLBRAccessible(nsIFrame *aFrame, nsIAccessible **_retval)
 {
   nsCOMPtr<nsIDOMNode> node;
   nsCOMPtr<nsIWeakReference> weakShell;
   nsresult rv = GetInfo(aFrame, getter_AddRefs(weakShell), getter_AddRefs(node));
   if (NS_FAILED(rv))
     return rv;
 
   *_retval = new nsHTMLBRAccessible(node, weakShell);
   if (! *_retval) 
     return NS_ERROR_OUT_OF_MEMORY;
 
   NS_ADDREF(*_retval);
   return NS_OK;
 }
 
-NS_IMETHODIMP
+nsresult
 nsAccessibilityService::CreateHTMLCaptionAccessible(nsIFrame *aFrame, nsIAccessible **_retval)
 {
   nsCOMPtr<nsIDOMNode> node;
   nsCOMPtr<nsIWeakReference> weakShell;
   nsresult rv = GetInfo(aFrame, getter_AddRefs(weakShell), getter_AddRefs(node));
   if (NS_FAILED(rv))
     return rv;
 
@@ -1205,35 +1240,25 @@ nsAccessibilityService::GetAccessibleInS
     CallQueryInterface(accessible.get(), aAccessible);
   
   return NS_OK;
 }
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsAccessibilityService public
 
-nsresult
+already_AddRefed<nsAccessible>
 nsAccessibilityService::GetAccessibleInWeakShell(nsIDOMNode *aNode, 
-                                                 nsIWeakReference *aWeakShell,
-                                                 nsIAccessible **aAccessible) 
+                                                 nsIWeakReference *aWeakShell) 
 {
-  NS_ENSURE_ARG_POINTER(aAccessible);
-  *aAccessible = nsnull;
-
-  NS_ENSURE_ARG(aNode);
-  NS_ENSURE_ARG(aWeakShell);
+  if (!aNode || !aWeakShell)
+    return nsnull;
 
   nsCOMPtr<nsIPresShell> presShell(do_QueryReferent(aWeakShell));
-  nsRefPtr<nsAccessible> accessible =
-    GetAccessible(aNode, presShell, aWeakShell);
-
-  if (accessible)
-    CallQueryInterface(accessible.get(), aAccessible);
-
-  return NS_OK;
+  return GetAccessible(aNode, presShell, aWeakShell);
 }
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsAccessibilityService private
 
 PRBool
 nsAccessibilityService::InitAccessible(nsAccessible *aAccessible,
                                        nsRoleMapEntry *aRoleMapEntry)
@@ -1375,43 +1400,21 @@ nsAccessibilityService::GetAccessible(ns
       !weakFrame.GetFrame()->GetStyleVisibility()->IsVisible()) {
     if (aIsHidden)
       *aIsHidden = PR_TRUE;
 
     return nsnull;
   }
 
   if (weakFrame.GetFrame()->GetContent() != content) {
-    // Not the main content for this frame!
-    // For example, this happens because <area> elements return the
-    // image frame as their primary frame. The main content for the 
-    // image frame is the image content.
-
-    // Check if frame is an image frame, and content is <area>.
-    nsIImageFrame *imageFrame = do_QueryFrame(weakFrame.GetFrame());
-    nsCOMPtr<nsIDOMHTMLAreaElement> areaElmt = do_QueryInterface(content);
-    if (imageFrame && areaElmt) {
-      // XXX: it's a hack we should try the cache before or if failed cache
-      // the image accessible.
-      nsCOMPtr<nsIAccessible> imageAcc;
-      CreateHTMLImageAccessible(weakFrame.GetFrame(), getter_AddRefs(imageAcc));
-      if (imageAcc) {
-        // Cache children.
-        PRInt32 childCount;
-        imageAcc->GetChildCount(&childCount);
-        // <area> accessible should be in cache now.
-        nsAccessNode* cachedAreaAcc = GetCachedAccessNode(aNode, aWeakShell);
-        if (cachedAreaAcc) {
-          newAcc = nsAccUtils::QueryObject<nsAccessible>(cachedAreaAcc);
-          return newAcc.forget();
-        }
-      }
-    }
-
-    return nsnull;
+    // Not the main content for this frame. This happens because <area>
+    // elements return the image frame as their primary frame. The main content
+    // for the image frame is the image content. If the frame is not an image
+    // frame or the node is not an area element then null is returned.
+    return GetAreaAccessible(weakFrame.GetFrame(), aNode, aWeakShell);
   }
 
   // Attempt to create an accessible based on what we know.
   if (content->IsNodeOfType(nsINode::eTEXT)) {
     // --- Create HTML for visible text frames ---
     nsIFrame* f = weakFrame.GetFrame();
     if (f && f->IsEmpty()) {
       nsAutoString renderedWhitespace;
@@ -1490,19 +1493,18 @@ nsAccessibilityService::GetAccessible(ns
       nsIContent *tableContent = content;
       while ((tableContent = tableContent->GetParent()) != nsnull) {
         nsIFrame *tableFrame = tableContent->GetPrimaryFrame();
         if (!tableFrame)
           continue;
 
         if (tableFrame->GetType() == nsAccessibilityAtoms::tableOuterFrame) {
           nsCOMPtr<nsIDOMNode> tableNode(do_QueryInterface(tableContent));
-          nsCOMPtr<nsIAccessible> tableAccessible;
-          GetAccessibleInWeakShell(tableNode, aWeakShell,
-                                   getter_AddRefs(tableAccessible));
+          nsRefPtr<nsAccessible> tableAccessible =
+            GetAccessibleInWeakShell(tableNode, aWeakShell);
 
           if (tableAccessible) {
             if (!roleMapEntry) {
               PRUint32 role = nsAccUtils::Role(tableAccessible);
               if (role != nsIAccessibleRole::ROLE_TABLE &&
                   role != nsIAccessibleRole::ROLE_TREE_TABLE) {
                 // No ARIA role and not in table: override role. For example,
                 // <table role="label"><td>content</td></table>
@@ -1741,16 +1743,62 @@ nsAccessibilityService::GetRelevantConte
     }
   }
 
   NS_ADDREF(*aRelevantNode = aNode);
   return NS_OK;
 }
 
 already_AddRefed<nsAccessible>
+nsAccessibilityService::GetAreaAccessible(nsIFrame *aImageFrame,
+                                          nsIDOMNode *aAreaNode,
+                                          nsIWeakReference *aWeakShell)
+{
+  // Check if frame is an image frame, and content is <area>.
+  nsIImageFrame *imageFrame = do_QueryFrame(aImageFrame);
+  if (!imageFrame)
+    return nsnull;
+
+  nsCOMPtr<nsIDOMHTMLAreaElement> areaElmt = do_QueryInterface(aAreaNode);
+  if (!areaElmt)
+    return nsnull;
+
+  // Try to get image map accessible from the global cache or create it
+  // if failed.
+  nsRefPtr<nsAccessible> imageAcc;
+
+  nsCOMPtr<nsIDOMNode> imageNode(do_QueryInterface(aImageFrame->GetContent()));
+  nsAccessNode *cachedImgAcc = GetCachedAccessNode(imageNode, aWeakShell);
+  if (cachedImgAcc)
+    imageAcc = nsAccUtils::QueryObject<nsAccessible>(cachedImgAcc);
+
+  if (!imageAcc) {
+    nsCOMPtr<nsIAccessible> imageAccessible;
+    CreateHTMLImageAccessible(aImageFrame,
+                              getter_AddRefs(imageAccessible));
+
+    imageAcc = nsAccUtils::QueryObject<nsAccessible>(imageAccessible);
+    if (!InitAccessible(imageAcc, nsnull))
+      return nsnull;
+  }
+
+  // Make sure <area> accessible children of the image map are cached so
+  // that they should be available in global cache.
+  imageAcc->EnsureChildren();
+
+  nsAccessNode *cachedAreaAcc = GetCachedAccessNode(aAreaNode, aWeakShell);
+  if (!cachedAreaAcc)
+    return nsnull;
+
+  nsRefPtr<nsAccessible> areaAcc =
+    nsAccUtils::QueryObject<nsAccessible>(cachedAreaAcc);
+  return areaAcc.forget();
+}
+
+already_AddRefed<nsAccessible>
 nsAccessibilityService::CreateAccessibleByType(nsIDOMNode *aNode,
                                                nsIWeakReference *aWeakShell)
 {
   nsCOMPtr<nsIAccessibleProvider> accessibleProvider(do_QueryInterface(aNode));
   if (!accessibleProvider)
     return nsnull;
 
   PRInt32 type;
@@ -1985,17 +2033,19 @@ nsAccessibilityService::CreateAccessible
   }
 
   return accessible.forget();
 }
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsIAccessibilityService (DON'T put methods here)
 
-NS_IMETHODIMP nsAccessibilityService::AddNativeRootAccessible(void * aAtkAccessible,  nsIAccessible **aRootAccessible)
+nsresult
+nsAccessibilityService::AddNativeRootAccessible(void *aAtkAccessible,
+                                                nsIAccessible **aRootAccessible)
 {
 #ifdef MOZ_ACCESSIBILITY_ATK
   nsNativeRootAccessibleWrap* rootAccWrap =
     new nsNativeRootAccessibleWrap((AtkObject*)aAtkAccessible);
 
   *aRootAccessible = static_cast<nsIAccessible*>(rootAccWrap);
   NS_ADDREF(*aRootAccessible);
 
@@ -2006,17 +2056,18 @@ NS_IMETHODIMP nsAccessibilityService::Ad
   applicationAcc->AddRootAccessible(*aRootAccessible);
 
   return NS_OK;
 #else
   return NS_ERROR_NOT_IMPLEMENTED;
 #endif
 }
 
-NS_IMETHODIMP nsAccessibilityService::RemoveNativeRootAccessible(nsIAccessible * aRootAccessible)
+nsresult
+nsAccessibilityService::RemoveNativeRootAccessible(nsIAccessible *aRootAccessible)
 {
 #ifdef MOZ_ACCESSIBILITY_ATK
   void* atkAccessible;
   aRootAccessible->GetNativeInterface(&atkAccessible);
 
   nsApplicationAccessible *applicationAcc =
     nsAccessNode::GetApplicationAccessible();
   NS_ENSURE_STATE(applicationAcc);
@@ -2025,35 +2076,34 @@ NS_IMETHODIMP nsAccessibilityService::Re
 
   return NS_OK;
 #else
   return NS_ERROR_NOT_IMPLEMENTED;
 #endif
 }
 
 // Called from layout when the frame tree owned by a node changes significantly
-NS_IMETHODIMP
+nsresult
 nsAccessibilityService::InvalidateSubtreeFor(nsIPresShell *aShell,
                                              nsIContent *aChangeContent,
                                              PRUint32 aChangeType)
 {
   NS_ASSERTION(aChangeType == nsIAccessibilityService::FRAME_SIGNIFICANT_CHANGE ||
                aChangeType == nsIAccessibilityService::FRAME_SHOW ||
                aChangeType == nsIAccessibilityService::FRAME_HIDE ||
                aChangeType == nsIAccessibilityService::NODE_SIGNIFICANT_CHANGE ||
                aChangeType == nsIAccessibilityService::NODE_APPEND ||
                aChangeType == nsIAccessibilityService::NODE_REMOVE,
                "Incorrect aEvent passed in");
 
   NS_ENSURE_ARG_POINTER(aShell);
 
   nsCOMPtr<nsIAccessibleDocument> accessibleDoc =
     nsAccessNode::GetDocAccessibleFor(aShell->GetDocument());
-  nsRefPtr<nsDocAccessible> docAcc =
-    nsAccUtils::QueryAccessibleDocument(accessibleDoc);
+  nsRefPtr<nsDocAccessible> docAcc = do_QueryObject(accessibleDoc);
   if (docAcc)
     docAcc->InvalidateCacheSubtree(aChangeContent, aChangeType);
 
   return NS_OK;
 }
 
 ////////////////////////////////////////////////////////////////////////////////
 // NS_GetAccessibilityService
--- a/accessible/src/base/nsAccessibilityService.h
+++ b/accessible/src/base/nsAccessibilityService.h
@@ -36,16 +36,17 @@
  *
  * ***** END LICENSE BLOCK ***** */
 
 #ifndef __nsAccessibilityService_h__
 #define __nsAccessibilityService_h__
 
 #include "nsIAccessibilityService.h"
 
+#include "a11yGeneric.h"
 #include "nsCoreUtils.h"
 
 #include "nsCOMArray.h"
 #include "nsIObserver.h"
 #include "nsIWebProgress.h"
 #include "nsIWebProgressListener.h"
 #include "nsWeakReference.h"
 
@@ -66,20 +67,87 @@ class nsAccessibilityService : public ns
                                public nsSupportsWeakReference
 {
 public:
   nsAccessibilityService();
   virtual ~nsAccessibilityService();
 
   NS_DECL_ISUPPORTS
   NS_DECL_NSIACCESSIBLERETRIEVAL
-  NS_DECL_NSIACCESSIBILITYSERVICE
   NS_DECL_NSIOBSERVER
   NS_DECL_NSIWEBPROGRESSLISTENER
 
+  // nsIAccessibilityService
+  virtual nsresult CreateOuterDocAccessible(nsIDOMNode *aNode,
+                                            nsIAccessible **aAccessible);
+  virtual nsresult CreateHTML4ButtonAccessible(nsIFrame *aFrame,
+                                               nsIAccessible **aAccessible);
+  virtual nsresult CreateHyperTextAccessible(nsIFrame *aFrame,
+                                             nsIAccessible **aAccessible);
+  virtual nsresult CreateHTMLBRAccessible(nsIFrame *aFrame,
+                                          nsIAccessible **aAccessible);
+  virtual nsresult CreateHTMLButtonAccessible(nsIFrame *aFrame,
+                                              nsIAccessible **aAccessible);
+  virtual nsresult CreateHTMLLIAccessible(nsIFrame *aFrame,
+                                          nsIFrame *aBulletFrame,
+                                          const nsAString& aBulletText,
+                                          nsIAccessible **aAccessible);
+  virtual nsresult CreateHTMLCheckboxAccessible(nsIFrame *aFrame,
+                                                nsIAccessible **aAccessible);
+  virtual nsresult CreateHTMLComboboxAccessible(nsIDOMNode *aNode,
+                                                nsIWeakReference *aPresShell,
+                                                nsIAccessible **aAccessible);
+  virtual nsresult CreateHTMLGenericAccessible(nsIFrame *aFrame,
+                                               nsIAccessible **aAccessible);
+  virtual nsresult CreateHTMLGroupboxAccessible(nsIFrame *aFrame,
+                                                nsIAccessible **aAccessible);
+  virtual nsresult CreateHTMLHRAccessible(nsIFrame *aFrame,
+                                          nsIAccessible **aAccessible);
+  virtual nsresult CreateHTMLImageAccessible(nsIFrame *aFrame,
+                                             nsIAccessible **aAccessible);
+  virtual nsresult CreateHTMLLabelAccessible(nsIFrame *aFrame,
+                                             nsIAccessible **aAccessible);
+  virtual nsresult CreateHTMLListboxAccessible(nsIDOMNode *aNode,
+                                               nsIWeakReference *aPresShell,
+                                               nsIAccessible **aAccessible);
+  virtual nsresult CreateHTMLMediaAccessible(nsIFrame *aFrame,
+                                             nsIAccessible **aAccessible);
+  virtual nsresult CreateHTMLObjectFrameAccessible(nsObjectFrame *aFrame,
+                                                   nsIAccessible **aAccessible);
+  virtual nsresult CreateHTMLRadioButtonAccessible(nsIFrame *aFrame,
+                                                   nsIAccessible **aAccessible);
+  virtual nsresult CreateHTMLSelectOptionAccessible(nsIDOMNode *aNode,
+                                                    nsIAccessible *aAccParent,
+                                                    nsIWeakReference *aPresShell,
+                                                    nsIAccessible **aAccessible);
+  virtual nsresult CreateHTMLTableAccessible(nsIFrame *aFrame,
+                                             nsIAccessible **aAccessible);
+  virtual nsresult CreateHTMLTableCellAccessible(nsIFrame *aFrame,
+                                                 nsIAccessible **aAccessible);
+  virtual nsresult CreateHTMLTextAccessible(nsIFrame *aFrame,
+                                            nsIAccessible **aAccessible);
+  virtual nsresult CreateHTMLTextFieldAccessible(nsIFrame *aFrame,
+                                                 nsIAccessible **aAccessible);
+  virtual nsresult CreateHTMLCaptionAccessible(nsIFrame *aFrame,
+                                               nsIAccessible **aAccessible);
+
+  virtual nsresult AddNativeRootAccessible(void *aAtkAccessible,
+                                           nsIAccessible **aAccessible);
+  virtual nsresult RemoveNativeRootAccessible(nsIAccessible *aRootAccessible);
+
+  virtual nsresult InvalidateSubtreeFor(nsIPresShell *aPresShell,
+                                        nsIContent *aContent,
+                                        PRUint32 aChangeType);
+
+  virtual void NotifyOfAnchorJumpTo(nsIContent *aTarget);
+
+  virtual nsresult FireAccessibleEvent(PRUint32 aEvent, nsIAccessible *aTarget);
+
+  // nsAccessibiltiyService
+
   /**
    * Return presentation shell for the given node.
    *
    * @param aNode - the given DOM node.
    */
   static nsresult GetShellFromNode(nsIDOMNode *aNode,
                                    nsIWeakReference **weakShell);
 
@@ -101,21 +169,19 @@ public:
     GetAccessible(nsIDOMNode *aNode, nsIPresShell *aPresShell,
                   nsIWeakReference *aWeakShell, PRBool *aIsHidden = nsnull);
 
   /**
    * Return an accessible for a DOM node in the given pres shell.
    * 
    * @param aNode       [in] the given node.
    * @param aPresShell  [in] the presentation shell of the given node.
-   * @param aAccessible [out] the nsIAccessible for the given node.
    */
-  nsresult GetAccessibleInWeakShell(nsIDOMNode *aNode,
-                                    nsIWeakReference *aPresShell,
-                                    nsIAccessible **aAccessible);
+  already_AddRefed<nsAccessible>
+    GetAccessibleInWeakShell(nsIDOMNode *aNode, nsIWeakReference *aPresShell);
 
   /**
    * Return an access node for the DOM node in the given presentation shell if
    * the access node already exists, otherwise null.
    *
    * @param  aNode       [in] the DOM node to get an access node for
    * @param  aPresShell  [in] the presentation shell which contains layout info
    *                       for the DOM node
@@ -145,16 +211,23 @@ private:
    *                          if none
    *
    * @return true if the accessible was initialized, otherwise false
    */
   PRBool InitAccessible(nsAccessible *aAccessible,
                         nsRoleMapEntry *aRoleMapEntry);
 
   /**
+   * Return accessible for HTML area element associated with an image map.
+   */
+  already_AddRefed<nsAccessible>
+    GetAreaAccessible(nsIFrame *aImageFrame, nsIDOMNode *aAreaNode,
+                      nsIWeakReference *aWeakShell);
+
+  /**
    * Create accessible for the element implementing nsIAccessibleProvider
    * interface.
    */
   already_AddRefed<nsAccessible>
     CreateAccessibleByType(nsIDOMNode *aNode, nsIWeakReference *aWeakShell);
 
   /**
    * Create document or root accessible.
--- a/accessible/src/base/nsAccessible.cpp
+++ b/accessible/src/base/nsAccessible.cpp
@@ -36,19 +36,25 @@
  * the terms of any one of the MPL, the GPL or the LGPL.
  *
  * ***** END LICENSE BLOCK ***** */
 
 #include "nsAccessible.h"
 
 #include "nsIXBLAccessible.h"
 
+#include "nsAccUtils.h"
+#include "nsARIAMap.h"
+#include "nsDocAccessible.h"
+#include "nsEventShell.h"
+
+#include "nsAccessibilityService.h"
 #include "nsAccTreeWalker.h"
-#include "nsAccessibleRelation.h"
-#include "nsDocAccessible.h"
+#include "nsRelUtils.h"
+#include "nsTextEquivUtils.h"
 
 #include "nsIDOMElement.h"
 #include "nsIDOMDocument.h"
 #include "nsIDOMDocumentXBL.h"
 #include "nsIDOMDocumentTraversal.h"
 #include "nsIDOMHTMLDocument.h"
 #include "nsIDOMHTMLFormElement.h"
 #include "nsIDOMNodeFilter.h"
@@ -90,60 +96,16 @@
 #include "nsWhitespaceTokenizer.h"
 #include "nsAttrName.h"
 #include "nsNetUtil.h"
 
 #ifdef NS_DEBUG
 #include "nsIDOMCharacterData.h"
 #endif
 
-/**
- * nsAccessibleDOMStringList implementation
- */
-nsAccessibleDOMStringList::nsAccessibleDOMStringList()
-{
-}
-
-nsAccessibleDOMStringList::~nsAccessibleDOMStringList()
-{
-}
-
-NS_IMPL_ISUPPORTS1(nsAccessibleDOMStringList, nsIDOMDOMStringList)
-
-NS_IMETHODIMP
-nsAccessibleDOMStringList::Item(PRUint32 aIndex, nsAString& aResult)
-{
-  if (aIndex >= mNames.Length()) {
-    SetDOMStringToNull(aResult);
-  } else {
-    aResult = mNames.ElementAt(aIndex);
-  }
-
-  return NS_OK;
-}
-
-NS_IMETHODIMP
-nsAccessibleDOMStringList::GetLength(PRUint32 *aLength)
-{
-  *aLength = mNames.Length();
-
-  return NS_OK;
-}
-
-NS_IMETHODIMP
-nsAccessibleDOMStringList::Contains(const nsAString& aString, PRBool *aResult)
-{
-  *aResult = mNames.Contains(aString);
-
-  return NS_OK;
-}
-
-/*
- * Class nsAccessible
- */
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsAccessible. nsISupports
 
 NS_IMPL_CYCLE_COLLECTION_CLASS(nsAccessible)
 
 NS_IMPL_CYCLE_COLLECTION_TRAVERSE_BEGIN_INHERITED(nsAccessible, nsAccessNode)
   NS_CYCLE_COLLECTION_NOTE_EDGE_NAME(cb, "mParent");
@@ -438,17 +400,17 @@ nsAccessible::GetKeyboardShortcut(nsAStr
 {
   aAccessKey.Truncate();
 
   nsCOMPtr<nsIContent> content(do_QueryInterface(mDOMNode));
   if (!content)
     return NS_ERROR_FAILURE;
 
   PRUint32 key = nsCoreUtils::GetAccessKeyFor(content);
-  if (!key && content->IsNodeOfType(nsIContent::eELEMENT)) {
+  if (!key && content->IsElement()) {
     // Copy access key from label node unless it is labeled
     // via an ancestor <label>, in which case that would be redundant
     nsCOMPtr<nsIContent> labelContent(nsCoreUtils::GetLabelContent(content));
     nsCOMPtr<nsINode> thisNode = do_QueryInterface(mDOMNode);
     if (labelContent && !nsCoreUtils::IsAncestorOf(labelContent, thisNode))
       key = nsCoreUtils::GetAccessKeyFor(labelContent);
   }
 
@@ -600,28 +562,16 @@ nsAccessible::GetChildren(nsIArray **aOu
     nsIAccessible* child = GetChildAt(childIdx);
     children->AppendElement(child, PR_FALSE);
   }
 
   NS_ADDREF(*aOutChildren = children);
   return NS_OK;
 }
 
-nsIAccessible *nsAccessible::NextChild(nsCOMPtr<nsIAccessible>& aAccessible)
-{
-  nsCOMPtr<nsIAccessible> nextChild;
-  if (!aAccessible) {
-    GetFirstChild(getter_AddRefs(nextChild));
-  }
-  else {
-    aAccessible->GetNextSibling(getter_AddRefs(nextChild));
-  }
-  return (aAccessible = nextChild);
-}
-
 PRBool
 nsAccessible::GetAllowsAnonChildAccessibles()
 {
   return PR_TRUE;
 }
 
 /* readonly attribute long childCount; */
 NS_IMETHODIMP
@@ -786,17 +736,17 @@ nsAccessible::GetStateInternal(PRUint32 
     isDisabled = content->AttrValueIs(kNameSpaceID_None,
                                       nsAccessibilityAtoms::disabled,
                                       nsAccessibilityAtoms::_true,
                                       eCaseMatters);
   }
   if (isDisabled) {
     *aState |= nsIAccessibleStates::STATE_UNAVAILABLE;
   }
-  else if (content->IsNodeOfType(nsINode::eELEMENT)) {
+  else if (content->IsElement()) {
     nsIFrame *frame = GetFrame();
     if (frame && frame->IsFocusable()) {
       *aState |= nsIAccessibleStates::STATE_FOCUSABLE;
     }
 
     if (gLastFocusedNode == mDOMNode) {
       *aState |= nsIAccessibleStates::STATE_FOCUSED;
     }
@@ -831,22 +781,18 @@ nsAccessible::GetStateInternal(PRUint32 
   /* readonly attribute boolean focusedChild; */
 NS_IMETHODIMP nsAccessible::GetFocusedChild(nsIAccessible **aFocusedChild) 
 { 
   nsCOMPtr<nsIAccessible> focusedChild;
   if (gLastFocusedNode == mDOMNode) {
     focusedChild = this;
   }
   else if (gLastFocusedNode) {
-    nsCOMPtr<nsIAccessibilityService> accService =
-      do_GetService("@mozilla.org/accessibilityService;1");
-    NS_ENSURE_TRUE(accService, NS_ERROR_FAILURE);
-
-    accService->GetAccessibleFor(gLastFocusedNode,
-                                 getter_AddRefs(focusedChild));
+    GetAccService()->GetAccessibleFor(gLastFocusedNode,
+                                      getter_AddRefs(focusedChild));
     if (focusedChild) {
       nsCOMPtr<nsIAccessible> focusedParentAccessible;
       focusedChild->GetParent(getter_AddRefs(focusedParentAccessible));
       if (focusedParentAccessible != this) {
         focusedChild = nsnull;
       }
     }
   }
@@ -898,27 +844,27 @@ nsAccessible::GetChildAtPoint(PRInt32 aX
 
   nsIContent* content = nsnull;
   if (!foundFrame || !(content = foundFrame->GetContent())) {
     NS_IF_ADDREF(*aChild = fallbackAnswer);
     return NS_OK;
   }
 
   nsCOMPtr<nsIDOMNode> node(do_QueryInterface(content));
-  nsCOMPtr<nsIAccessibilityService> accService = GetAccService();
 
   nsCOMPtr<nsIDOMNode> relevantNode;
-  accService->GetRelevantContentNodeFor(node, getter_AddRefs(relevantNode));
+  GetAccService()->GetRelevantContentNodeFor(node,
+                                             getter_AddRefs(relevantNode));
   if (!relevantNode) {
     NS_IF_ADDREF(*aChild = fallbackAnswer);
     return NS_OK;
   }
 
   nsCOMPtr<nsIAccessible> accessible;
-  accService->GetAccessibleFor(relevantNode, getter_AddRefs(accessible));
+  GetAccService()->GetAccessibleFor(relevantNode, getter_AddRefs(accessible));
   if (!accessible) {
     // No accessible for the node with the point, so find the first
     // accessible in the DOM parent chain
     accDocument->GetAccessibleInParentChain(relevantNode, PR_TRUE,
                                             getter_AddRefs(accessible));
     if (!accessible) {
       NS_IF_ADDREF(*aChild = fallbackAnswer);
       return NS_OK;
@@ -926,18 +872,20 @@ nsAccessible::GetChildAtPoint(PRInt32 aX
   }
 
   if (accessible == this) {
     // Manually walk through accessible children and see if the are within this
     // point. Skip offscreen or invisible accessibles. This takes care of cases
     // where layout won't walk into things for us, such as image map areas and
     // sub documents (XXX: subdocuments should be handled by methods of
     // nsOuterDocAccessibles).
-    nsCOMPtr<nsIAccessible> child;
-    while (NextChild(child)) {
+    PRInt32 childCount = GetChildCount();
+    for (PRInt32 childIdx = 0; childIdx < childCount; childIdx++) {
+      nsAccessible *child = GetChildAt(childIdx);
+
       PRInt32 childX, childY, childWidth, childHeight;
       child->GetBounds(&childX, &childY, &childWidth, &childHeight);
       if (aX >= childX && aX < childX + childWidth &&
           aY >= childY && aY < childY + childHeight &&
           (nsAccUtils::State(child) & nsIAccessibleStates::STATE_INVISIBLE) == 0) {
 
         if (aDeepestChild)
           return child->GetDeepestChildAtPoint(aX, aY, aChild);
@@ -1352,17 +1300,17 @@ nsresult
 nsAccessible::HandleAccEvent(nsAccEvent *aEvent)
 {
   NS_ENSURE_ARG_POINTER(aEvent);
   nsCOMPtr<nsIDOMNode> eventNode;
   aEvent->GetDOMNode(getter_AddRefs(eventNode));
   NS_ENSURE_TRUE(nsAccUtils::IsNodeRelevant(eventNode), NS_ERROR_FAILURE);
 
   nsCOMPtr<nsIObserverService> obsService =
-    do_GetService("@mozilla.org/observer-service;1");
+    mozilla::services::GetObserverService();
   NS_ENSURE_TRUE(obsService, NS_ERROR_FAILURE);
 
   return obsService->NotifyObservers(aEvent, NS_ACCESSIBLE_EVENT_TOPIC, nsnull);
 }
 
 NS_IMETHODIMP
 nsAccessible::GetRole(PRUint32 *aRole)
 {
@@ -2899,17 +2847,17 @@ nsAccessible::GetParent()
 
   if (!docAccessible)
     return nsnull;
 
   nsCOMPtr<nsIAccessible> parent;
   docAccessible->GetAccessibleInParentChain(mDOMNode, PR_TRUE,
                                             getter_AddRefs(parent));
 
-  nsRefPtr<nsAccessible> parentAcc = nsAccUtils::QueryAccessible(parent);
+  nsRefPtr<nsAccessible> parentAcc = do_QueryObject(parent);
 
 #ifdef DEBUG
   NS_ASSERTION(!parentAcc->IsDefunct(), "Defunct parent!");
 
   parentAcc->EnsureChildren();
   if (parent != mParent)
     NS_WARNING("Bad accessible tree!");
 #endif
@@ -2989,17 +2937,17 @@ nsAccessible::CacheChildren()
     child->SetParent(this);
   }
 }
 
 void
 nsAccessible::TestChildCache(nsAccessible *aCachedChild)
 {
 #ifdef DEBUG
-  PRUint32 childCount = mChildren.Length();
+  PRInt32 childCount = mChildren.Length();
   if (childCount == 0) {
     NS_ASSERTION(!mAreChildrenInitialized, "No children but initialized!");
     return;
   }
 
   nsAccessible *child = nsnull;
   for (PRInt32 childIdx = 0; childIdx < childCount; childIdx++) {
     child = mChildren[childIdx];
@@ -3007,16 +2955,17 @@ nsAccessible::TestChildCache(nsAccessibl
       break;
   }
 
   NS_ASSERTION(child == aCachedChild,
                "[TestChildCache] cached accessible wasn't found. Wrong accessible tree!");  
 #endif
 }
 
+// nsAccessible public
 PRBool
 nsAccessible::EnsureChildren()
 {
   if (IsDefunct()) {
     mAreChildrenInitialized = PR_FALSE;
     return PR_TRUE;
   }
 
@@ -3065,26 +3014,25 @@ nsAccessible::GetSiblingAtOffset(PRInt32
 
   nsAccessible *child = parent->GetChildAt(indexInParent + aOffset);
   if (aError && !child)
     *aError = NS_ERROR_UNEXPECTED;
 
   return child;
 }
 
-already_AddRefed<nsIAccessible>
+already_AddRefed<nsAccessible>
 nsAccessible::GetFirstAvailableAccessible(nsIDOMNode *aStartNode)
 {
-  nsCOMPtr<nsIAccessible> accessible;
   nsCOMPtr<nsIDOMTreeWalker> walker; 
   nsCOMPtr<nsIDOMNode> currentNode(aStartNode);
 
   while (currentNode) {
-    GetAccService()->GetAccessibleInWeakShell(currentNode, mWeakShell,
-                                              getter_AddRefs(accessible));
+    nsRefPtr<nsAccessible> accessible =
+      GetAccService()->GetAccessibleInWeakShell(currentNode, mWeakShell);
     if (accessible)
       return accessible.forget();
 
     if (!walker) {
       // Instantiate walker lazily since we won't need it in 90% of the cases
       // where the first DOM node we're given provides an accessible
       nsCOMPtr<nsIDOMDocument> document;
       currentNode->GetOwnerDocument(getter_AddRefs(document));
--- a/accessible/src/base/nsAccessible.h
+++ b/accessible/src/base/nsAccessible.h
@@ -36,79 +36,53 @@
  *
  * ***** END LICENSE BLOCK ***** */
 
 #ifndef _nsAccessible_H_
 #define _nsAccessible_H_
 
 #include "nsAccessNodeWrap.h"
 
-#include "nsARIAMap.h"
-#include "nsEventShell.h"
-#include "nsRelUtils.h"
-#include "nsTextEquivUtils.h"
-
 #include "nsIAccessible.h"
 #include "nsIAccessibleHyperLink.h"
 #include "nsIAccessibleSelectable.h"
 #include "nsIAccessibleValue.h"
 #include "nsIAccessibleRole.h"
 #include "nsIAccessibleStates.h"
-#include "nsIAccessibleEvent.h"
+
+#include "nsStringGlue.h"
+#include "nsTArray.h"
 
-#include "nsIDOMNodeList.h"
-#include "nsINameSpaceManager.h"
-#include "nsWeakReference.h"
-#include "nsString.h"
-#include "nsTArray.h"
-#include "nsIDOMDOMStringList.h"
+class nsAccessible;
+class nsAccEvent;
+struct nsRoleMapEntry;
 
 struct nsRect;
 class nsIContent;
 class nsIFrame;
-class nsIPresShell;
-class nsIDOMNode;
 class nsIAtom;
 class nsIView;
 
+typedef nsRefPtrHashtable<nsVoidPtrHashKey, nsAccessible>
+  nsAccessibleHashtable;
+
 // see nsAccessible::GetAttrValue
 #define NS_OK_NO_ARIA_VALUE \
 NS_ERROR_GENERATE_SUCCESS(NS_ERROR_MODULE_GENERAL, 0x21)
 
 // see nsAccessible::GetNameInternal
 #define NS_OK_EMPTY_NAME \
 NS_ERROR_GENERATE_SUCCESS(NS_ERROR_MODULE_GENERAL, 0x23)
 
 // see nsAccessible::GetNameInternal
 #define NS_OK_NAME_FROM_TOOLTIP \
 NS_ERROR_GENERATE_SUCCESS(NS_ERROR_MODULE_GENERAL, 0x25)
 
-// Saves a data member -- if child count equals this value we haven't
-// cached children or child count yet
-enum { eChildCountUninitialized = -1 };
 
-class nsAccessibleDOMStringList : public nsIDOMDOMStringList
-{
-public:
-  nsAccessibleDOMStringList();
-  virtual ~nsAccessibleDOMStringList();
-
-  NS_DECL_ISUPPORTS
-  NS_DECL_NSIDOMDOMSTRINGLIST
-
-  PRBool Add(const nsAString& aName) {
-    return mNames.AppendElement(aName) != nsnull;
-  }
-
-private:
-  nsTArray<nsString> mNames;
-};
-
-
-#define NS_ACCESSIBLE_IMPL_CID                          \
+#define NS_ACCESSIBLE_IMPL_IID                          \
 {  /* 133c8bf4-4913-4355-bd50-426bd1d6e1ad */           \
   0x133c8bf4,                                           \
   0x4913,                                               \
   0x4355,                                               \
   { 0xbd, 0x50, 0x42, 0x6b, 0xd1, 0xd6, 0xe1, 0xad }    \
 }
 
 class nsAccessible : public nsAccessNodeWrap, 
@@ -123,17 +97,17 @@ public:
 
   NS_DECL_ISUPPORTS_INHERITED
   NS_DECL_CYCLE_COLLECTION_CLASS_INHERITED(nsAccessible, nsAccessNode)
 
   NS_DECL_NSIACCESSIBLE
   NS_DECL_NSIACCESSIBLEHYPERLINK
   NS_DECL_NSIACCESSIBLESELECTABLE
   NS_DECL_NSIACCESSIBLEVALUE
-  NS_DECLARE_STATIC_IID_ACCESSOR(NS_ACCESSIBLE_IMPL_CID)
+  NS_DECLARE_STATIC_IID_ACCESSOR(NS_ACCESSIBLE_IMPL_IID)
 
   //////////////////////////////////////////////////////////////////////////////
   // nsAccessNode
 
   virtual nsresult Shutdown();
 
   //////////////////////////////////////////////////////////////////////////////
   // Public methods
@@ -227,16 +201,21 @@ public:
   virtual void SetRoleMapEntry(nsRoleMapEntry *aRoleMapEntry);
 
   /**
    * Set accessible parent.
    */
   void SetParent(nsAccessible *aParent);
 
   /**
+   * Cache children if necessary. Return true if the accessible is defunct.
+   */
+  PRBool EnsureChildren();
+
+  /**
    * Set the child count to -1 (unknown) and null out cached child pointers.
    * Should be called when accessible tree is changed because document has
    * transformed.
    */
   virtual void InvalidateChildren();
 
   //////////////////////////////////////////////////////////////////////////////
   // Accessible tree traverse methods
@@ -313,21 +292,16 @@ protected:
   // Initializing, cache and tree traverse methods
 
   /**
    * Cache accessible children.
    */
   virtual void CacheChildren();
 
   /**
-   * Cache children if necessary. Return true if the accessible is defunct.
-   */
-  PRBool EnsureChildren();
-
-  /**
    * Return sibling accessible at the given offset.
    */
   virtual nsAccessible* GetSiblingAtOffset(PRInt32 aOffset,
                                            nsresult *aError = nsnull);
 
   //////////////////////////////////////////////////////////////////////////////
   // Miscellaneous helpers
 
@@ -346,32 +320,28 @@ protected:
   /**
    * Compute the name for XUL node.
    */
   nsresult GetXULName(nsAString& aName);
 
   // helper method to verify frames
   static nsresult GetFullKeyName(const nsAString& aModifierName, const nsAString& aKeyName, nsAString& aStringOut);
   static nsresult GetTranslatedString(const nsAString& aKey, nsAString& aStringOut);
-
-  // nsCOMPtr<>& is useful here, because getter_AddRefs() nulls the comptr's value, and NextChild
-  // depends on the passed-in comptr being null or already set to a child (finding the next sibling).
-  nsIAccessible *NextChild(nsCOMPtr<nsIAccessible>& aAccessible);
     
   already_AddRefed<nsIAccessible> GetNextWithState(nsIAccessible *aStart, PRUint32 matchState);
 
   /**
    * Return an accessible for the given DOM node, or if that node isn't
    * accessible, return the accessible for the next DOM node which has one
    * (based on forward depth first search).
    *
    * @param  aStartNode  [in] the DOM node to start from
    * @return              the resulting accessible
    */   
-  already_AddRefed<nsIAccessible>
+  already_AddRefed<nsAccessible>
     GetFirstAvailableAccessible(nsIDOMNode *aStartNode);
 
   // Hyperlink helpers
   virtual nsresult GetLinkOffset(PRInt32* aStartOffset, PRInt32* aEndOffset);
 
   //////////////////////////////////////////////////////////////////////////////
   // Action helpers
 
@@ -441,12 +411,12 @@ protected:
   nsRefPtr<nsAccessible> mParent;
   nsTArray<nsRefPtr<nsAccessible> > mChildren;
   PRBool mAreChildrenInitialized;
 
   nsRoleMapEntry *mRoleMapEntry; // Non-null indicates author-supplied role; possibly state & value as well
 };
 
 NS_DEFINE_STATIC_IID_ACCESSOR(nsAccessible,
-                              NS_ACCESSIBLE_IMPL_CID)
+                              NS_ACCESSIBLE_IMPL_IID)
 
 #endif  
 
--- a/accessible/src/base/nsApplicationAccessible.cpp
+++ b/accessible/src/base/nsApplicationAccessible.cpp
@@ -38,32 +38,48 @@
  * the provisions above, a recipient may use your version of this file under
  * the terms of any one of the MPL, the GPL or the LGPL.
  *
  * ***** END LICENSE BLOCK ***** */
  
 #include "nsApplicationAccessible.h"
 
 #include "nsAccessibilityService.h"
+#include "nsAccUtils.h"
 
 #include "nsIComponentManager.h"
+#include "nsIDOMDocument.h"
+#include "nsIDOMWindow.h"
+#include "nsIWindowMediator.h"
 #include "nsServiceManagerUtils.h"
 
 nsApplicationAccessible::nsApplicationAccessible() :
   nsAccessibleWrap(nsnull, nsnull)
 {
 }
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsISupports
 
 NS_IMPL_ISUPPORTS_INHERITED1(nsApplicationAccessible, nsAccessible,
                              nsIAccessibleApplication)
 
 ////////////////////////////////////////////////////////////////////////////////
+// nsIAccessNode
+
+NS_IMETHODIMP
+nsApplicationAccessible::GetRootDocument(nsIAccessibleDocument **aRootDocument)
+{
+  NS_ENSURE_ARG_POINTER(aRootDocument);
+  *aRootDocument = nsnull;
+
+  return NS_OK;
+}
+
+////////////////////////////////////////////////////////////////////////////////
 // nsIAccessible
 
 NS_IMETHODIMP
 nsApplicationAccessible::GetName(nsAString& aName)
 {
   aName.Truncate();
 
   nsCOMPtr<nsIStringBundleService> bundleService =
@@ -241,18 +257,52 @@ nsApplicationAccessible::InvalidateChild
 }
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsAccessible protected methods
 
 void
 nsApplicationAccessible::CacheChildren()
 {
-  // Nothing to do. Children are keeped up to dated by Add/RemoveRootAccessible
-  // method calls.
+  // CacheChildren is called only once for application accessible when its
+  // children are requested because empty InvalidateChldren() prevents its
+  // repeated calls.
+
+  // Basically children are kept updated by Add/RemoveRootAccessible method
+  // calls. However if there are open windows before accessibility was started
+  // then we need to make sure root accessibles for open windows are created so
+  // that all root accessibles are stored in application accessible children
+  // array.
+
+  nsCOMPtr<nsIWindowMediator> windowMediator =
+    do_GetService(NS_WINDOWMEDIATOR_CONTRACTID);
+
+  nsCOMPtr<nsISimpleEnumerator> windowEnumerator;
+  nsresult rv = windowMediator->GetEnumerator(nsnull,
+                                              getter_AddRefs(windowEnumerator));
+  if (NS_FAILED(rv))
+    return;
+
+  PRBool hasMore = PR_FALSE;
+  windowEnumerator->HasMoreElements(&hasMore);
+  while (hasMore) {
+    nsCOMPtr<nsISupports> window;
+    windowEnumerator->GetNext(getter_AddRefs(window));
+    nsCOMPtr<nsIDOMWindow> DOMWindow = do_QueryInterface(window);
+    if (DOMWindow) {
+      nsCOMPtr<nsIDOMDocument> DOMDocument;
+      DOMWindow->GetDocument(getter_AddRefs(DOMDocument));
+      if (DOMDocument) {
+        nsCOMPtr<nsIAccessible> accessible;
+        GetAccService()->GetAccessibleFor(DOMDocument,
+                                          getter_AddRefs(accessible));
+      }
+    }
+    windowEnumerator->HasMoreElements(&hasMore);
+  }
 }
 
 nsAccessible*
 nsApplicationAccessible::GetSiblingAtOffset(PRInt32 aOffset, nsresult* aError)
 {
   if (IsDefunct()) {
     if (aError)
       *aError = NS_ERROR_FAILURE;
--- a/accessible/src/base/nsApplicationAccessible.h
+++ b/accessible/src/base/nsApplicationAccessible.h
@@ -63,16 +63,19 @@ class nsApplicationAccessible: public ns
                                public nsIAccessibleApplication
 {
 public:
   nsApplicationAccessible();
 
   // nsISupports
   NS_DECL_ISUPPORTS_INHERITED
 
+  // nsIAccessNode
+  NS_IMETHOD GetRootDocument(nsIAccessibleDocument **aRootDocument);
+
   // nsIAccessible
   NS_IMETHOD GetName(nsAString& aName);
   NS_IMETHOD GetDescription(nsAString& aValue);
   NS_IMETHOD GetRole(PRUint32 *aRole);
   NS_IMETHOD GetState(PRUint32 *aState, PRUint32 *aExtraState);
 
   NS_IMETHOD GetParent(nsIAccessible **aAccessible);
 
--- a/accessible/src/base/nsBaseWidgetAccessible.cpp
+++ b/accessible/src/base/nsBaseWidgetAccessible.cpp
@@ -33,30 +33,28 @@
  * decision by deleting the provisions above and replace them with the notice
  * and other provisions required by the GPL or the LGPL. If you do not delete
  * the provisions above, a recipient may use your version of this file under
  * the terms of any one of the MPL, the GPL or the LGPL.
  *
  * ***** END LICENSE BLOCK ***** */
 
 #include "nsBaseWidgetAccessible.h"
+
 #include "nsAccessibilityAtoms.h"
-#include "nsIAccessibilityService.h"
-#include "nsIAccessibleDocument.h"
-#include "nsAccessibleWrap.h"
+#include "nsAccessibilityService.h"
+#include "nsAccUtils.h"
 #include "nsCoreUtils.h"
+#include "nsHyperTextAccessibleWrap.h"
+
 #include "nsIDOMNSHTMLElement.h"
 #include "nsGUIEvent.h"
-#include "nsHyperTextAccessibleWrap.h"
 #include "nsILink.h"
 #include "nsIFrame.h"
 #include "nsINameSpaceManager.h"
-#include "nsPresContext.h"
-#include "nsIPresShell.h"
-#include "nsIServiceManager.h"
 #include "nsIURI.h"
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsLeafAccessible
 ////////////////////////////////////////////////////////////////////////////////
 
 nsLeafAccessible::nsLeafAccessible(nsIDOMNode* aNode, nsIWeakReference* aShell):
 nsAccessibleWrap(aNode, aShell)
@@ -104,32 +102,32 @@ nsLinkableAccessible::
 NS_IMPL_ISUPPORTS_INHERITED0(nsLinkableAccessible, nsAccessibleWrap)
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsLinkableAccessible. nsIAccessible
 
 NS_IMETHODIMP
 nsLinkableAccessible::TakeFocus()
 {
-  nsCOMPtr<nsIAccessible> actionAcc = GetActionAccessible();
+  nsRefPtr<nsAccessible> actionAcc = GetActionAccessible();
   if (actionAcc)
     return actionAcc->TakeFocus();
 
   return nsAccessibleWrap::TakeFocus();
 }
 
 nsresult
 nsLinkableAccessible::GetStateInternal(PRUint32 *aState, PRUint32 *aExtraState)
 {
   nsresult rv = nsAccessibleWrap::GetStateInternal(aState, aExtraState);
   NS_ENSURE_A11Y_SUCCESS(rv, rv);
 
   if (mIsLink) {
     *aState |= nsIAccessibleStates::STATE_LINKED;
-    nsCOMPtr<nsIAccessible> actionAcc = GetActionAccessible();
+    nsRefPtr<nsAccessible> actionAcc = GetActionAccessible();
     if (nsAccUtils::State(actionAcc) & nsIAccessibleStates::STATE_TRAVERSED)
       *aState |= nsIAccessibleStates::STATE_TRAVERSED;
   }
 
   return NS_OK;
 }
 
 NS_IMETHODIMP
@@ -137,17 +135,17 @@ nsLinkableAccessible::GetValue(nsAString
 {
   aValue.Truncate();
 
   nsAccessible::GetValue(aValue);
   if (!aValue.IsEmpty())
     return NS_OK;
 
   if (mIsLink) {
-    nsCOMPtr<nsIAccessible> actionAcc = GetActionAccessible();
+    nsRefPtr<nsAccessible> actionAcc = GetActionAccessible();
     if (actionAcc)
       return actionAcc->GetValue(aValue);
   }
 
   return NS_ERROR_NOT_IMPLEMENTED;
 }
 
 
@@ -181,46 +179,46 @@ nsLinkableAccessible::GetActionName(PRUi
 }
 
 NS_IMETHODIMP
 nsLinkableAccessible::DoAction(PRUint8 aIndex)
 {
   if (aIndex != eAction_Jump)
     return NS_ERROR_INVALID_ARG;
   
-  nsCOMPtr<nsIAccessible> actionAcc = GetActionAccessible();
+  nsRefPtr<nsAccessible> actionAcc = GetActionAccessible();
   if (actionAcc)
     return actionAcc->DoAction(aIndex);
   
   return nsAccessibleWrap::DoAction(aIndex);
 }
 
 NS_IMETHODIMP
 nsLinkableAccessible::GetKeyboardShortcut(nsAString& aKeyboardShortcut)
 {
   aKeyboardShortcut.Truncate();
 
-  nsCOMPtr<nsIAccessible> actionAcc = GetActionAccessible();
+  nsRefPtr<nsAccessible> actionAcc = GetActionAccessible();
   if (actionAcc)
     return actionAcc->GetKeyboardShortcut(aKeyboardShortcut);
 
   return nsAccessible::GetKeyboardShortcut(aKeyboardShortcut);
 }
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsLinkableAccessible. nsIAccessibleHyperLink
 
 NS_IMETHODIMP
 nsLinkableAccessible::GetURI(PRInt32 aIndex, nsIURI **aURI)
 {
   if (mIsLink) {
-    nsCOMPtr<nsIAccessible> actionAcc = GetActionAccessible();
+    nsRefPtr<nsAccessible> actionAcc = GetActionAccessible();
     if (actionAcc) {
       nsCOMPtr<nsIAccessibleHyperLink> hyperLinkAcc =
-        do_QueryInterface(actionAcc);
+        nsAccUtils::QueryObject<nsIAccessibleHyperLink>(actionAcc);
       NS_ASSERTION(hyperLinkAcc,
                    "nsIAccessibleHyperLink isn't implemented.");
 
       if (hyperLinkAcc)
         return hyperLinkAcc->GetURI(aIndex, aURI);
     }
   }
   
@@ -259,50 +257,46 @@ nsLinkableAccessible::CacheActionContent
     return;
   }
 
   while ((walkUpContent = walkUpContent->GetParent())) {
     isOnclick = nsCoreUtils::HasClickListener(walkUpContent);
   
     nsCOMPtr<nsIDOMNode> walkUpNode(do_QueryInterface(walkUpContent));
 
-    nsCOMPtr<nsIAccessible> walkUpAcc;
-    GetAccService()->GetAccessibleInWeakShell(walkUpNode, mWeakShell,
-                                              getter_AddRefs(walkUpAcc));
+    nsRefPtr<nsAccessible> walkUpAcc =
+      GetAccService()->GetAccessibleInWeakShell(walkUpNode, mWeakShell);
 
     if (nsAccUtils::Role(walkUpAcc) == nsIAccessibleRole::ROLE_LINK &&
         nsAccUtils::State(walkUpAcc) & nsIAccessibleStates::STATE_LINKED) {
       mIsLink = PR_TRUE;
       mActionContent = walkUpContent;
       return;
     }
 
     if (isOnclick) {
       mActionContent = walkUpContent;
       mIsOnclick = PR_TRUE;
       return;
     }
   }
 }
 
-already_AddRefed<nsIAccessible>
+already_AddRefed<nsAccessible>
 nsLinkableAccessible::GetActionAccessible()
 {
   // Return accessible for the action content if it's different from node of
   // this accessible. If the action accessible is not null then it is used to
   // redirect methods calls otherwise we use method implementation from the
   // base class.
   nsCOMPtr<nsIDOMNode> actionNode(do_QueryInterface(mActionContent));
   if (!actionNode || mDOMNode == actionNode)
     return nsnull;
 
-  nsIAccessible *accessible = nsnull;
-  GetAccService()->GetAccessibleInWeakShell(actionNode, mWeakShell,
-                                            &accessible);
-  return accessible;
+  return GetAccService()->GetAccessibleInWeakShell(actionNode, mWeakShell);
 }
 
 //---------------------
 // nsEnumRoleAccessible
 //---------------------
 
 nsEnumRoleAccessible::nsEnumRoleAccessible(nsIDOMNode* aNode, nsIWeakReference* aShell, PRUint32 aRole) :
   nsAccessibleWrap(aNode, aShell),
--- a/accessible/src/base/nsBaseWidgetAccessible.h
+++ b/accessible/src/base/nsBaseWidgetAccessible.h
@@ -105,17 +105,17 @@ public:
 
   // nsAccessible
   virtual nsresult GetStateInternal(PRUint32 *aState, PRUint32 *aExtraState);
 
 protected:
   /**
    * Return an accessible for cached action node.
    */
-  already_AddRefed<nsIAccessible> GetActionAccessible();
+  already_AddRefed<nsAccessible> GetActionAccessible();
 
   /**
    * Cache action node.
    */
   virtual void CacheActionContent();
 
   nsCOMPtr<nsIContent> mActionContent;
   PRPackedBool mIsLink;
--- a/accessible/src/base/nsCaretAccessible.cpp
+++ b/accessible/src/base/nsCaretAccessible.cpp
@@ -30,20 +30,23 @@
  * use your version of this file under the terms of the MPL, indicate your
  * decision by deleting the provisions above and replace them with the notice
  * and other provisions required by the GPL or the LGPL. If you do not delete
  * the provisions above, a recipient may use your version of this file under
  * the terms of any one of the MPL, the GPL or the LGPL.
  *
  * ***** END LICENSE BLOCK ***** */
 
-// NOTE: alphabetically ordered
+#include "nsCaretAccessible.h"
+
 #include "nsAccessibilityService.h"
-#include "nsCaretAccessible.h"
+#include "nsAccUtils.h"
+#include "nsCoreUtils.h"
 #include "nsIAccessibleEvent.h"
+
 #include "nsCaret.h"
 #include "nsIDOMDocument.h"
 #include "nsIDOMHTMLAnchorElement.h"
 #include "nsIDOMHTMLInputElement.h"
 #include "nsIDOMHTMLTextAreaElement.h"
 #include "nsIFrame.h"
 #include "nsIPresShell.h"
 #include "nsRootAccessible.h"
--- a/accessible/src/base/nsCoreUtils.cpp
+++ b/accessible/src/base/nsCoreUtils.cpp
@@ -69,16 +69,20 @@
 #include "nsIView.h"
 
 #include "nsContentCID.h"
 #include "nsComponentManagerUtils.h"
 #include "nsIInterfaceRequestorUtils.h"
 
 static NS_DEFINE_IID(kRangeCID, NS_RANGE_CID);
 
+////////////////////////////////////////////////////////////////////////////////
+// nsCoreUtils
+////////////////////////////////////////////////////////////////////////////////
+
 PRBool
 nsCoreUtils::HasClickListener(nsIContent *aContent)
 {
   NS_ENSURE_TRUE(aContent, PR_FALSE);
   nsIEventListenerManager* listenerManager =
     aContent->GetListenerManager(PR_FALSE);
 
   return listenerManager &&
@@ -233,17 +237,17 @@ nsCoreUtils::GetAccessKeyFor(nsIContent 
 }
 
 already_AddRefed<nsIDOMElement>
 nsCoreUtils::GetDOMElementFor(nsIDOMNode *aNode)
 {
   nsCOMPtr<nsINode> node(do_QueryInterface(aNode));
   nsIDOMElement *element = nsnull;
 
-  if (node->IsNodeOfType(nsINode::eELEMENT))
+  if (node->IsElement())
     CallQueryInterface(node, &element);
 
   else if (node->IsNodeOfType(nsINode::eTEXT)) {
     nsCOMPtr<nsINode> nodeParent = node->GetNodeParent();
     NS_ASSERTION(nodeParent, "Text node has no parent!");
     if (nodeParent)
       CallQueryInterface(nodeParent, &element);
   }
@@ -267,17 +271,17 @@ nsCoreUtils::GetDOMElementFor(nsIDOMNode
 }
 
 already_AddRefed<nsIDOMNode>
 nsCoreUtils::GetDOMNodeFromDOMPoint(nsIDOMNode *aNode, PRUint32 aOffset)
 {
   nsIDOMNode *resultNode = nsnull;
 
   nsCOMPtr<nsIContent> content(do_QueryInterface(aNode));
-  if (content && content->IsNodeOfType(nsINode::eELEMENT)) {
+  if (content && content->IsElement()) {
 
     PRUint32 childCount = content->GetChildCount();
     NS_ASSERTION(aOffset >= 0 && aOffset <= childCount,
                  "Wrong offset of the DOM point!");
 
     // The offset can be after last child of container node that means DOM point
     // is placed immediately after the last child. In this case use the DOM node
     // from the given DOM point is used as result node.
@@ -1145,8 +1149,42 @@ nsCoreUtils::GeneratePopupTree(nsIDOMNod
                                        eCaseMatters)) {
 
       child->SetAttr(kNameSpaceID_None, nsAccessibilityAtoms::menugenerated,
                      NS_LITERAL_STRING("true"), PR_TRUE);
       return;
     }
   }
 }
+
+
+////////////////////////////////////////////////////////////////////////////////
+// nsAccessibleDOMStringList
+////////////////////////////////////////////////////////////////////////////////
+
+NS_IMPL_ISUPPORTS1(nsAccessibleDOMStringList, nsIDOMDOMStringList)
+
+NS_IMETHODIMP
+nsAccessibleDOMStringList::Item(PRUint32 aIndex, nsAString& aResult)
+{
+  if (aIndex >= mNames.Length())
+    SetDOMStringToNull(aResult);
+  else
+    aResult = mNames.ElementAt(aIndex);
+
+  return NS_OK;
+}
+
+NS_IMETHODIMP
+nsAccessibleDOMStringList::GetLength(PRUint32 *aLength)
+{
+  *aLength = mNames.Length();
+
+  return NS_OK;
+}
+
+NS_IMETHODIMP
+nsAccessibleDOMStringList::Contains(const nsAString& aString, PRBool *aResult)
+{
+  *aResult = mNames.Contains(aString);
+
+  return NS_OK;
+}
--- a/accessible/src/base/nsCoreUtils.h
+++ b/accessible/src/base/nsCoreUtils.h
@@ -44,20 +44,25 @@
 #include "nsIDOMNode.h"
 #include "nsIContent.h"
 #include "nsIBoxObject.h"
 #include "nsITreeBoxObject.h"
 #include "nsITreeColumns.h"
 
 #include "nsIFrame.h"
 #include "nsIDocShellTreeItem.h"
-#include "nsIArray.h"
+#include "nsIDOMCSSStyleDeclaration.h"
+#include "nsIDOMDOMStringList.h"
 #include "nsIMutableArray.h"
 #include "nsPoint.h"
+#include "nsTArray.h"
 
+/**
+ * Core utils.
+ */
 class nsCoreUtils
 {
 public:
   /**
    * Return true if the given node has registered click, mousedown or mouseup
    * event listeners.
    */
   static PRBool HasClickListener(nsIContent *aContent);
@@ -463,137 +468,31 @@ public:
    *
    * @param aNode    [in] DOM node containing the menupopup element as a child
    * @param aIsAnon  [in] specifies whether popup should be searched inside of
    *                  anonymous or explicit content
    */
   static void GeneratePopupTree(nsIDOMNode *aNode, PRBool aIsAnon = PR_FALSE);
 };
 
-////////////////////////////////////////////////////////////////////////////////
-// nsRunnable helpers
-////////////////////////////////////////////////////////////////////////////////
 
 /**
- * Use NS_DECL_RUNNABLEMETHOD_ macros to declare a runnable class for the given
- * method of the given class. There are three macros:
- *  NS_DECL_RUNNABLEMETHOD(Class, Method)
- *  NS_DECL_RUNNABLEMETHOD_ARG1(Class, Method, Arg1Type)
- *  NS_DECL_RUNNABLEMETHOD_ARG2(Class, Method, Arg1Type, Arg2Type)
- * Note Arg1Type and Arg2Type must be types which keeps the objects alive.
- *
- * Use NS_DISPATCH_RUNNABLEMETHOD_ macros to create an instance of declared
- * runnable class and dispatch it to main thread. Availabe macros are:
- *  NS_DISPATCH_RUNNABLEMETHOD(Method, Object)
- *  NS_DISPATCH_RUNNABLEMETHOD_ARG1(Method, Object, Arg1)
- *  NS_DISPATCH_RUNNABLEMETHOD_ARG2(Method, Object, Arg1, Arg2)
+ * nsIDOMDOMStringList implementation.
  */
-
-#define NS_DECL_RUNNABLEMETHOD_HELPER(ClassType, Method)                       \
-  void Revoke()                                                                \
-  {                                                                            \
-    NS_IF_RELEASE(mObj);                                                       \
-  }                                                                            \
-                                                                               \
-protected:                                                                     \
-  virtual ~nsRunnableMethod_##Method()                                         \
-  {                                                                            \
-    NS_IF_RELEASE(mObj);                                                       \
-  }                                                                            \
-                                                                               \
-private:                                                                       \
-  ClassType *mObj;                                                             \
-
-
-#define NS_DECL_RUNNABLEMETHOD(ClassType, Method)                              \
-class nsRunnableMethod_##Method : public nsRunnable                            \
-{                                                                              \
-public:                                                                        \
-  nsRunnableMethod_##Method(ClassType *aObj) : mObj(aObj)                      \
-  {                                                                            \
-    NS_IF_ADDREF(mObj);                                                        \
-  }                                                                            \
-                                                                               \
-  NS_IMETHODIMP Run()                                                          \
-  {                                                                            \
-    if (!mObj)                                                                 \
-      return NS_OK;                                                            \
-    (mObj-> Method)();                                                         \
-    return NS_OK;                                                              \
-  }                                                                            \
-                                                                               \
-  NS_DECL_RUNNABLEMETHOD_HELPER(ClassType, Method)                             \
-                                                                               \
-};
+class nsAccessibleDOMStringList : public nsIDOMDOMStringList
+{
+public:
+  nsAccessibleDOMStringList() {};
+  virtual ~nsAccessibleDOMStringList() {};
 
-#define NS_DECL_RUNNABLEMETHOD_ARG1(ClassType, Method, Arg1Type)               \
-class nsRunnableMethod_##Method : public nsRunnable                            \
-{                                                                              \
-public:                                                                        \
-  nsRunnableMethod_##Method(ClassType *aObj, Arg1Type aArg1) :                 \
-    mObj(aObj), mArg1(aArg1)                                                   \
-  {                                                                            \
-    NS_IF_ADDREF(mObj);                                                        \
-  }                                                                            \
-                                                                               \
-  NS_IMETHODIMP Run()                                                          \
-  {                                                                            \
-    if (!mObj)                                                                 \
-      return NS_OK;                                                            \
-    (mObj-> Method)(mArg1);                                                    \
-    return NS_OK;                                                              \
-  }                                                                            \
-                                                                               \
-  NS_DECL_RUNNABLEMETHOD_HELPER(ClassType, Method)                             \
-  Arg1Type mArg1;                                                              \
-};
+  NS_DECL_ISUPPORTS
+  NS_DECL_NSIDOMDOMSTRINGLIST
 
-#define NS_DECL_RUNNABLEMETHOD_ARG2(ClassType, Method, Arg1Type, Arg2Type)     \
-class nsRunnableMethod_##Method : public nsRunnable                            \
-{                                                                              \
-public:                                                                        \
-                                                                               \
-  nsRunnableMethod_##Method(ClassType *aObj,                                   \
-                            Arg1Type aArg1, Arg2Type aArg2) :                  \
-    mObj(aObj), mArg1(aArg1), mArg2(aArg2)                                     \
-  {                                                                            \
-    NS_IF_ADDREF(mObj);                                                        \
-  }                                                                            \
-                                                                               \
-  NS_IMETHODIMP Run()                                                          \
-  {                                                                            \
-    if (!mObj)                                                                 \
-      return NS_OK;                                                            \
-    (mObj-> Method)(mArg1, mArg2);                                             \
-    return NS_OK;                                                              \
-  }                                                                            \
-                                                                               \
-  NS_DECL_RUNNABLEMETHOD_HELPER(ClassType, Method)                             \
-  Arg1Type mArg1;                                                              \
-  Arg2Type mArg2;                                                              \
+  PRBool Add(const nsAString& aName) {
+    return mNames.AppendElement(aName) != nsnull;
+  }
+
+private:
+  nsTArray<nsString> mNames;
 };
 
-#define NS_DISPATCH_RUNNABLEMETHOD(Method, Obj)                                \
-{                                                                              \
-  nsCOMPtr<nsIRunnable> runnable =                                             \
-    new nsRunnableMethod_##Method(Obj);                                        \
-  if (runnable)                                                                \
-    NS_DispatchToMainThread(runnable);                                         \
-}
-
-#define NS_DISPATCH_RUNNABLEMETHOD_ARG1(Method, Obj, Arg1)                     \
-{                                                                              \
-  nsCOMPtr<nsIRunnable> runnable =                                             \
-    new nsRunnableMethod_##Method(Obj, Arg1);                                  \
-  if (runnable)                                                                \
-    NS_DispatchToMainThread(runnable);                                         \
-}
-
-#define NS_DISPATCH_RUNNABLEMETHOD_ARG2(Method, Obj, Arg1, Arg2)               \
-{                                                                              \
-  nsCOMPtr<nsIRunnable> runnable =                                             \
-    new nsRunnableMethod_##Method(Obj, Arg1, Arg2);                            \
-  if (runnable)                                                                \
-    NS_DispatchToMainThread(runnable);                                         \
-}
-
 #endif
 
--- a/accessible/src/base/nsDocAccessible.cpp
+++ b/accessible/src/base/nsDocAccessible.cpp
@@ -31,19 +31,24 @@
  * use your version of this file under the terms of the MPL, indicate your
  * decision by deleting the provisions above and replace them with the notice
  * and other provisions required by the GPL or the LGPL. If you do not delete
  * the provisions above, a recipient may use your version of this file under
  * the terms of any one of the MPL, the GPL or the LGPL.
  *
  * ***** END LICENSE BLOCK ***** */
 
-#include "nsRootAccessible.h"
+#include "nsAccCache.h"
 #include "nsAccessibilityAtoms.h"
 #include "nsAccessibilityService.h"
+#include "nsAccUtils.h"
+#include "nsCoreUtils.h"
+#include "nsRootAccessible.h"
+#include "nsTextEquivUtils.h"
+
 #include "nsIMutableArray.h"
 #include "nsICommandManager.h"
 #include "nsIDocShell.h"
 #include "nsIDocShellTreeItem.h"
 #include "nsIDocument.h"
 #include "nsIDOMAttr.h"
 #include "nsIDOMCharacterData.h"
 #include "nsIDOMDocument.h"
@@ -469,27 +474,26 @@ NS_IMETHODIMP nsDocAccessible::GetWindow
   if (!*aDOMWin)
     return NS_ERROR_FAILURE;  // No DOM Window
 
   NS_ADDREF(*aDOMWin);
 
   return NS_OK;
 }
 
-NS_IMETHODIMP nsDocAccessible::GetDocument(nsIDOMDocument **aDOMDoc)
+NS_IMETHODIMP
+nsDocAccessible::GetDOMDocument(nsIDOMDocument **aDOMDocument)
 {
-  nsCOMPtr<nsIDOMDocument> domDoc(do_QueryInterface(mDocument));
-  *aDOMDoc = domDoc;
+  NS_ENSURE_ARG_POINTER(aDOMDocument);
+  *aDOMDocument = nsnull;
 
-  if (domDoc) {
-    NS_ADDREF(*aDOMDoc);
-    return NS_OK;
-  }
+  if (mDocument)
+    CallQueryInterface(mDocument, aDOMDocument);
 
-  return NS_ERROR_FAILURE;
+  return NS_OK;
 }
 
 // nsIAccessibleHyperText method
 NS_IMETHODIMP nsDocAccessible::GetAssociatedEditor(nsIEditor **aEditor)
 {
   NS_ENSURE_ARG_POINTER(aEditor);
   *aEditor = nsnull;
 
@@ -662,18 +666,17 @@ void nsDocAccessible::ShutdownChildDocum
       treeNode->GetChildAt(count, getter_AddRefs(treeItemChild));
       NS_ASSERTION(treeItemChild, "No tree item when there should be");
       if (!treeItemChild) {
         continue;
       }
       nsCOMPtr<nsIAccessibleDocument> docAccessible =
         GetDocAccessibleFor(treeItemChild);
       if (docAccessible) {
-        nsRefPtr<nsAccessNode> docAccNode =
-          nsAccUtils::QueryAccessNode(docAccessible);
+        nsRefPtr<nsAccessNode> docAccNode = do_QueryObject(docAccessible);
         docAccNode->Shutdown();
       }
     }
   }
 }
 
 nsIFrame*
 nsDocAccessible::GetFrame()
@@ -1662,18 +1665,17 @@ nsDocAccessible::ProcessPendingEvent(nsA
       GetAccessibleInParentChain(domNode, PR_TRUE,
                                  getter_AddRefs(containerAccessible));
       if (!containerAccessible)
         containerAccessible = this;
     }
 
     if (isAsync) {
       // For asynch show, delayed invalidatation of parent's children
-      nsRefPtr<nsAccessible> containerAcc =
-        nsAccUtils::QueryAccessible(containerAccessible);
+      nsRefPtr<nsAccessible> containerAcc = do_QueryObject(containerAccessible);
       if (containerAcc)
         containerAcc->InvalidateChildren();
 
       // Some show events in the subtree may have been removed to 
       // avoid firing redundant events. But, we still need to make sure any
       // accessibles parenting those shown nodes lose their child references.
       InvalidateChildrenInSubtree(domNode);
     }
@@ -1698,18 +1700,17 @@ nsDocAccessible::ProcessPendingEvent(nsA
     // Fire show/create events for this node or first accessible descendants of it
     FireShowHideEvents(domNode, PR_FALSE, eventType, eNormalEvent, isAsync,
                        isFromUserInput); 
     return;
   }
 
   if (accessible) {
     if (eventType == nsIAccessibleEvent::EVENT_INTERNAL_LOAD) {
-      nsRefPtr<nsDocAccessible> docAcc =
-        nsAccUtils::QueryAccessibleDocument(accessible);
+      nsRefPtr<nsDocAccessible> docAcc = do_QueryObject(accessible);
       NS_ASSERTION(docAcc, "No doc accessible for doc load event");
 
       if (docAcc)
         docAcc->FireDocLoadEvents(nsIAccessibleEvent::EVENT_DOCUMENT_LOAD_COMPLETE);
     }
     else if (eventType == nsIAccessibleEvent::EVENT_TEXT_CARET_MOVED) {
       nsCOMPtr<nsIAccessibleText> accessibleText = do_QueryInterface(accessible);
       PRInt32 caretOffset;
@@ -1930,18 +1931,17 @@ nsDocAccessible::InvalidateCacheSubtree(
       // Just invalidate accessible hierarchy and return,
       // otherwise the page load time slows down way too much
       nsCOMPtr<nsIAccessible> containerAccessible;
       GetAccessibleInParentChain(childNode, PR_FALSE, getter_AddRefs(containerAccessible));
       if (!containerAccessible) {
         containerAccessible = this;
       }
 
-      nsRefPtr<nsAccessible> containerAcc =
-        nsAccUtils::QueryAccessible(containerAccessible);
+      nsRefPtr<nsAccessible> containerAcc = do_QueryObject(containerAccessible);
       containerAcc->InvalidateChildren();
       return;
     }     
     // else: user input, so we must fall through and for full handling,
     // e.g. fire the mutation events. Note: user input could cause DOM_CREATE
     // during page load if user typed into an input field or contentEditable area
   }
 
@@ -2023,18 +2023,17 @@ nsDocAccessible::InvalidateCacheSubtree(
   // We will use this accessible to fire the accessible mutation event.
   // We're guaranteed success, because we will eventually end up at the doc accessible,
   // and there is always one of those.
 
   if (aChild && !isHiding) {
     if (!isAsynch) {
       // DOM already updated with new objects -- invalidate parent's children now
       // For asynch we must wait until layout updates before we invalidate the children
-      nsRefPtr<nsAccessible> containerAcc =
-        nsAccUtils::QueryAccessible(containerAccessible);
+      nsRefPtr<nsAccessible> containerAcc = do_QueryObject(containerAccessible);
       if (containerAcc)
         containerAcc->InvalidateChildren();
 
     }
 
     // Fire EVENT_SHOW, EVENT_MENUPOPUP_START for newly visible content.
 
     // Fire after a short timer, because we want to make sure the view has been
@@ -2119,18 +2118,20 @@ nsDocAccessible::GetAccessibleInParentCh
       break;
     }
 
     nsCOMPtr<nsIDOMNode> relevantNode;
     if (NS_SUCCEEDED(GetAccService()->GetRelevantContentNodeFor(currentNode, getter_AddRefs(relevantNode))) && relevantNode) {
       currentNode = relevantNode;
     }
     if (aCanCreate) {
-      GetAccService()->GetAccessibleInWeakShell(currentNode, mWeakShell, 
-                                                aAccessible);
+      nsRefPtr<nsAccessible> acc =
+        GetAccService()->GetAccessibleInWeakShell(currentNode, mWeakShell);
+      if (acc)
+        CallQueryInterface(acc, aAccessible);
     }
     else { // Only return cached accessibles, don't create anything
       nsAccessNode* accessNode = GetCachedAccessNode(currentNode);
       if (accessNode)
         CallQueryInterface(accessNode, aAccessible);
     }
   } while (!*aAccessible);
 
--- a/accessible/src/base/nsDocAccessible.h
+++ b/accessible/src/base/nsDocAccessible.h
@@ -35,17 +35,19 @@
  * the terms of any one of the MPL, the GPL or the LGPL.
  *
  * ***** END LICENSE BLOCK ***** */
 
 #ifndef _nsDocAccessible_H_
 #define _nsDocAccessible_H_
 
 #include "nsHyperTextAccessibleWrap.h"
+#include "nsEventShell.h"
 #include "nsIAccessibleDocument.h"
+
 #include "nsIDocument.h"
 #include "nsIDocumentObserver.h"
 #include "nsIEditor.h"
 #include "nsIObserver.h"
 #include "nsIScrollPositionListener.h"
 #include "nsITimer.h"
 #include "nsIWeakReference.h"
 #include "nsCOMArray.h"
@@ -199,17 +201,17 @@ protected:
     virtual void GetBoundsRect(nsRect& aRect, nsIFrame** aRelativeFrame);
     virtual nsresult AddEventListeners();
     virtual nsresult RemoveEventListeners();
     void AddScrollListener();
     void RemoveScrollListener();
 
     /**
      * For any accessibles in this subtree, invalidate their knowledge of
-     * their children. Only weak refrences are destroyed, not accessibles.
+     * their children. Only weak references are destroyed, not accessibles.
      * @param aStartNode  The root of the subrtee to invalidate accessible child refs in
      */
     void InvalidateChildrenInSubtree(nsIDOMNode *aStartNode);
     void RefreshNodes(nsIDOMNode *aStartNode);
     static void ScrollTimerCallback(nsITimer *aTimer, void *aClosure);
 
     /**
      * Fires accessible events when attribute is changed.
--- a/accessible/src/base/nsEventShell.cpp
+++ b/accessible/src/base/nsEventShell.cpp
@@ -33,16 +33,18 @@
  * and other provisions required by the GPL or the LGPL. If you do not delete
  * the provisions above, a recipient may use your version of this file under
  * the terms of any one of the MPL, the GPL or the LGPL.
  *
  * ***** END LICENSE BLOCK ***** */
 
 #include "nsEventShell.h"
 
+#include "nsAccUtils.h"
+#include "nsCoreUtils.h"
 #include "nsDocAccessible.h"
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsEventShell
 ////////////////////////////////////////////////////////////////////////////////
 
 void
 nsEventShell::FireEvent(nsAccEvent *aEvent)
--- a/accessible/src/base/nsEventShell.h
+++ b/accessible/src/base/nsEventShell.h
@@ -36,18 +36,19 @@
  *
  * ***** END LICENSE BLOCK ***** */
 
 #ifndef _nsEventShell_H_
 #define _nsEventShell_H_
 
 #include "nsAccEvent.h"
 
+#include "a11yGeneric.h"
+
 #include "nsAutoPtr.h"
-#include "nsCoreUtils.h"
 
 class nsIPersistentProperties;
 
 /**
  * Used for everything about events.
  */
 class nsEventShell
 {
--- a/accessible/src/base/nsOuterDocAccessible.cpp
+++ b/accessible/src/base/nsOuterDocAccessible.cpp
@@ -32,20 +32,21 @@
  * decision by deleting the provisions above and replace them with the notice
  * and other provisions required by the GPL or the LGPL. If you do not delete
  * the provisions above, a recipient may use your version of this file under
  * the terms of any one of the MPL, the GPL or the LGPL.
  *
  * ***** END LICENSE BLOCK ***** */
 
 #include "nsOuterDocAccessible.h"
-#include "nsIAccessibilityService.h"
-#include "nsIAccessibleDocument.h"
+
+#include "nsAccessibilityService.h"
+#include "nsAccUtils.h"
+
 #include "nsIDocument.h"
-#include "nsIPresShell.h"
 #include "nsIServiceManager.h"
 #include "nsIContent.h"
 
 NS_IMPL_ISUPPORTS_INHERITED0(nsOuterDocAccessible, nsAccessible)
 
 nsOuterDocAccessible::nsOuterDocAccessible(nsIDOMNode* aNode, 
                                            nsIWeakReference* aShell):
   nsAccessibleWrap(aNode, aShell)
@@ -117,17 +118,17 @@ nsOuterDocAccessible::CacheChildren()
   nsCOMPtr<nsIDOMNode> innerNode(do_QueryInterface(innerDoc));
   if (!innerNode) {
     return;
   }
 
   nsCOMPtr<nsIAccessible> innerAccessible;
   nsCOMPtr<nsIAccessibilityService> accService = GetAccService();
   accService->GetAccessibleFor(innerNode, getter_AddRefs(innerAccessible));
-  nsRefPtr<nsAccessible> innerAcc(nsAccUtils::QueryAccessible(innerAccessible));
+  nsRefPtr<nsAccessible> innerAcc(do_QueryObject(innerAccessible));
   if (!innerAcc)
     return;
 
   // Success getting inner document as first child -- now we cache it.
   mChildren.AppendElement(innerAcc);
   innerAcc->SetParent(this);
 }
 
--- a/accessible/src/base/nsRelUtils.cpp
+++ b/accessible/src/base/nsRelUtils.cpp
@@ -33,16 +33,17 @@
  * and other provisions required by the GPL or the LGPL. If you do not delete
  * the provisions above, a recipient may use your version of this file under
  * the terms of any one of the MPL, the GPL or the LGPL.
  *
  * ***** END LICENSE BLOCK ***** */
 
 #include "nsRelUtils.h"
 
+#include "nsAccessibilityService.h"
 #include "nsAccessNode.h"
 
 #include "nsIDOMDocument.h"
 #include "nsIDOMElement.h"
 #include "nsIDOMDocumentXBL.h"
 
 #include "nsAutoPtr.h"
 #include "nsArrayUtils.h"
--- a/accessible/src/base/nsRootAccessible.cpp
+++ b/accessible/src/base/nsRootAccessible.cpp
@@ -30,19 +30,21 @@
  * use your version of this file under the terms of the MPL, indicate your
  * decision by deleting the provisions above and replace them with the notice
  * and other provisions required by the GPL or the LGPL. If you do not delete
  * the provisions above, a recipient may use your version of this file under
  * the terms of any one of the MPL, the GPL or the LGPL.
  *
  * ***** END LICENSE BLOCK ***** */
 
-// NOTE: alphabetically ordered
 #include "nsAccessibilityService.h"
 #include "nsApplicationAccessibleWrap.h"
+#include "nsAccUtils.h"
+#include "nsCoreUtils.h"
+#include "nsRelUtils.h"
 
 #include "nsHTMLSelectAccessible.h"
 #include "nsIDocShell.h"
 #include "nsIDocShellTreeItem.h"
 #include "nsIDocShellTreeNode.h"
 #include "nsIDocShellTreeOwner.h"
 #include "nsIDOMDocument.h"
 #include "nsIDOMElement.h"
@@ -69,23 +71,27 @@
 #include "nsIServiceManager.h"
 #include "nsPIDOMWindow.h"
 #include "nsIWebBrowserChrome.h"
 #include "nsReadableUtils.h"
 #include "nsRootAccessible.h"
 #include "nsIDOMNSEventTarget.h"
 #include "nsIDOMDocumentEvent.h"
 #include "nsFocusManager.h"
+#include "Element.h"
+
 
 #ifdef MOZ_XUL
 #include "nsXULTreeAccessible.h"
 #include "nsIXULDocument.h"
 #include "nsIXULWindow.h"
 #endif
 
+using namespace mozilla::dom;
+
 ////////////////////////////////////////////////////////////////////////////////
 // nsISupports
 
 // Expanded version of NS_IMPL_ISUPPORTS_INHERITED2 
 // so we can QI directly to concrete nsRootAccessible
 NS_IMPL_QUERY_HEAD(nsRootAccessible)
 NS_IMPL_QUERY_BODY(nsIDOMEventListener)
 if (aIID.Equals(NS_GET_IID(nsRootAccessible)))
@@ -136,19 +142,19 @@ nsRootAccessible::GetName(nsAString& aNa
 nsresult
 nsRootAccessible::GetRoleInternal(PRUint32 *aRole) 
 { 
   if (!mDocument) {
     return NS_ERROR_FAILURE;
   }
 
   // If it's a <dialog> or <wizard>, use nsIAccessibleRole::ROLE_DIALOG instead
-  nsIContent *rootContent = mDocument->GetRootContent();
-  if (rootContent) {
-    nsCOMPtr<nsIDOMElement> rootElement(do_QueryInterface(rootContent));
+  Element *root = mDocument->GetRootElement();
+  if (root) {
+    nsCOMPtr<nsIDOMElement> rootElement(do_QueryInterface(root));
     if (rootElement) {
       nsAutoString name;
       rootElement->GetLocalName(name);
       if (name.EqualsLiteral("dialog") || name.EqualsLiteral("wizard")) {
         *aRole = nsIAccessibleRole::ROLE_DIALOG; // Always at the root
         return NS_OK;
       }
     }
@@ -617,17 +623,17 @@ nsresult nsRootAccessible::HandleEventWi
     // document going away, closing a window/dialog, and wizard page changing.
     // We only destroy the accessible object when it's a document accessible,
     // so that we don't destroy something still in use, like wizard page. 
     // And we only get cached document accessible to destroy, so that we don't
     // create it just to destroy it.
     nsCOMPtr<nsIDocument> doc(do_QueryInterface(aTargetNode));
     nsCOMPtr<nsIAccessibleDocument> accDoc = GetDocAccessibleFor(doc);
     if (accDoc) {
-      nsRefPtr<nsAccessNode> docAccNode = nsAccUtils::QueryAccessNode(accDoc);
+      nsRefPtr<nsAccessNode> docAccNode = do_QueryObject(accDoc);
       docAccNode->Shutdown();
     }
 
     return NS_OK;
   }
 
   nsCOMPtr<nsIPresShell> eventShell = nsCoreUtils::GetPresShellFor(aTargetNode);
   if (!eventShell) {
@@ -644,24 +650,23 @@ nsresult nsRootAccessible::HandleEventWi
 
   nsCOMPtr<nsIAccessible> accessible;
   accService->GetAccessibleInShell(aTargetNode, eventShell,
                                    getter_AddRefs(accessible));
 
   if (eventType.EqualsLiteral("popuphiding"))
     return HandlePopupHidingEvent(aTargetNode, accessible);
 
-  nsRefPtr<nsAccessible> acc(nsAccUtils::QueryAccessible(accessible));
+  nsRefPtr<nsAccessible> acc(do_QueryObject(accessible));
   if (!acc)
     return NS_OK;
 
 #ifdef MOZ_XUL
   if (isTree) {
-    nsRefPtr<nsXULTreeAccessible> treeAcc =
-      nsAccUtils::QueryAccessibleTree(accessible);
+    nsRefPtr<nsXULTreeAccessible> treeAcc = do_QueryObject(accessible);
     NS_ASSERTION(treeAcc,
                  "Accessible for xul:tree isn't nsXULTreeAccessible.");
 
     if (treeAcc) {
       if (eventType.EqualsLiteral("TreeViewChanged")) {
         treeAcc->TreeViewChanged();
         return NS_OK;
       }
@@ -715,18 +720,17 @@ nsresult nsRootAccessible::HandleEventWi
   // If it's a tree element, need the currently selected item
   if (isTree) {
     nsCOMPtr<nsIDOMXULMultiSelectControlElement> multiSelect =
       do_QueryInterface(aTargetNode);
     if (multiSelect) {
       PRInt32 treeIndex = -1;
       multiSelect->GetCurrentIndex(&treeIndex);
       if (treeIndex >= 0) {
-        nsRefPtr<nsXULTreeAccessible> treeAcc =
-          nsAccUtils::QueryAccessibleTree(accessible);
+        nsRefPtr<nsXULTreeAccessible> treeAcc = do_QueryObject(accessible);
         if (treeAcc) {
           treeItemAccessible = treeAcc->GetTreeItemAccessible(treeIndex);
           if (treeItemAccessible)
             accessible = treeItemAccessible;
         }
       }
     }
   }
@@ -827,18 +831,17 @@ nsresult nsRootAccessible::HandleEventWi
   else if (eventType.EqualsLiteral("DOMMenuItemActive")) {
     PRBool fireFocus = PR_FALSE;
     if (!treeItemAccessible) {
 #ifdef MOZ_XUL
       if (isTree) {
         return NS_OK; // Tree with nothing selected
       }
 #endif
-      nsRefPtr<nsAccessNode> menuAccessNode =
-        nsAccUtils::QueryAccessNode(accessible);
+      nsRefPtr<nsAccessNode> menuAccessNode = do_QueryObject(accessible);
   
       nsIFrame* menuFrame = menuAccessNode->GetFrame();
       NS_ENSURE_TRUE(menuFrame, NS_ERROR_FAILURE);
 
       nsIMenuFrame* imenuFrame = do_QueryFrame(menuFrame);
       if (imenuFrame)
         fireFocus = PR_TRUE;
       // QI failed for nsIMenuFrame means it's not on menu bar
@@ -1120,17 +1123,17 @@ nsRootAccessible::HandlePopupShownEvent(
     if (comboboxRole == nsIAccessibleRole::ROLE_COMBOBOX ||
         comboboxRole == nsIAccessibleRole::ROLE_AUTOCOMPLETE) {
       nsRefPtr<nsAccEvent> event =
         new nsAccStateChangeEvent(comboboxAcc,
                                   nsIAccessibleStates::STATE_EXPANDED,
                                   PR_FALSE, PR_TRUE);
       NS_ENSURE_TRUE(event, NS_ERROR_OUT_OF_MEMORY);
 
-      nsRefPtr<nsAccessible> acc(nsAccUtils::QueryAccessible(comboboxAcc));
+      nsRefPtr<nsAccessible> acc(do_QueryObject(comboboxAcc));
       nsEventShell::FireEvent(event);
       return NS_OK;
     }
   }
 
   return NS_OK;
 }
 
--- a/accessible/src/base/nsTextAttrs.cpp
+++ b/accessible/src/base/nsTextAttrs.cpp
@@ -33,17 +33,18 @@
  * and other provisions required by the GPL or the LGPL. If you do not delete
  * the provisions above, a recipient may use your version of this file under
  * the terms of any one of the MPL, the GPL or the LGPL.
  *
  * ***** END LICENSE BLOCK ***** */
 
 #include "nsTextAttrs.h"
 
-#include "nsAccessNode.h"
+#include "nsAccUtils.h"
+#include "nsCoreUtils.h"
 #include "nsHyperTextAccessibleWrap.h"
 
 #include "gfxFont.h"
 #include "gfxUserFontSet.h"
 #include "nsIThebesFontMetrics.h"
 
 ////////////////////////////////////////////////////////////////////////////////
 // Constants and structures
--- a/accessible/src/base/nsTextAttrs.h
+++ b/accessible/src/base/nsTextAttrs.h
@@ -40,17 +40,16 @@
 #define nsTextAttrs_h_
 
 class nsHyperTextAccessible;
 
 #include "nsAccessibilityAtoms.h"
 
 #include "nsIDOMNode.h"
 #include "nsIDOMElement.h"
-#include "nsIDOMCSSStyleDeclaration.h"
 
 #include "nsIContent.h"
 #include "nsIFrame.h"
 #include "nsIPersistentProperties2.h"
 
 #include "nsCOMPtr.h"
 #include "nsString.h"
 #include "nsTPtrArray.h"
--- a/accessible/src/base/nsTextEquivUtils.cpp
+++ b/accessible/src/base/nsTextEquivUtils.cpp
@@ -34,17 +34,19 @@
  * and other provisions required by the GPL or the LGPL. If you do not delete
  * the provisions above, a recipient may use your version of this file under
  * the terms of any one of the MPL, the GPL or the LGPL.
  *
  * ***** END LICENSE BLOCK ***** */
 
 #include "nsTextEquivUtils.h"
 
+#include "nsAccessibilityService.h"
 #include "nsAccessible.h"
+#include "nsAccUtils.h"
 
 #include "nsIDOMXULLabeledControlEl.h"
 
 #include "nsArrayUtils.h"
 
 #define NS_OK_NO_NAME_CLAUSE_HANDLED \
 NS_ERROR_GENERATE_SUCCESS(NS_ERROR_MODULE_GENERAL, 0x24)
 
@@ -329,17 +331,17 @@ nsTextEquivUtils::AppendFromValue(nsIAcc
   if (aAccessible != gInitiatorAcc) {
     nsresult rv = aAccessible->GetValue(text);
     NS_ENSURE_SUCCESS(rv, rv);
 
     return AppendString(aString, text) ?
       NS_OK : NS_OK_NO_NAME_CLAUSE_HANDLED;
   }
 
-  nsRefPtr<nsAccessible> acc = nsAccUtils::QueryAccessible(aAccessible);
+  nsRefPtr<nsAccessible> acc = do_QueryObject(aAccessible);
   nsCOMPtr<nsIDOMNode> node;
   acc->GetDOMNode(getter_AddRefs(node));
   NS_ENSURE_STATE(node);
 
   nsCOMPtr<nsIContent> content(do_QueryInterface(node));
   NS_ENSURE_STATE(content);
 
   nsCOMPtr<nsIContent> parent = content->GetParent();
--- a/accessible/src/html/Makefile.in
+++ b/accessible/src/html/Makefile.in
@@ -45,19 +45,19 @@ include $(DEPTH)/config/autoconf.mk
 
 MODULE = accessibility
 LIBRARY_NAME = accessibility_html_s
 LIBXUL_LIBRARY = 1
 
 
 
 CPPSRCS = \
-  nsHTMLAreaAccessible.cpp \
   nsHTMLFormControlAccessible.cpp \
   nsHTMLImageAccessible.cpp \
+  nsHTMLImageMapAccessible.cpp \
   nsHTMLLinkAccessible.cpp \
   nsHTMLSelectAccessible.cpp \
   nsHTMLTableAccessible.cpp \
   nsHTMLTextAccessible.cpp \
   nsHyperTextAccessible.cpp \
   $(NULL)
 
 EXPORTS = \
--- a/accessible/src/html/nsHTMLFormControlAccessible.cpp
+++ b/accessible/src/html/nsHTMLFormControlAccessible.cpp
@@ -31,19 +31,23 @@
  * use your version of this file under the terms of the MPL, indicate your
  * decision by deleting the provisions above and replace them with the notice
  * and other provisions required by the GPL or the LGPL. If you do not delete
  * the provisions above, a recipient may use your version of this file under
  * the terms of any one of the MPL, the GPL or the LGPL.
  *
  * ***** END LICENSE BLOCK ***** */
 
-// NOTE: alphabetically ordered
+#include "nsHTMLFormControlAccessible.h"
+
 #include "nsAccessibilityAtoms.h"
-#include "nsHTMLFormControlAccessible.h"
+#include "nsAccUtils.h"
+#include "nsRelUtils.h"
+#include "nsTextEquivUtils.h"
+
 #include "nsIDOMDocument.h"
 #include "nsIDOMNSHTMLInputElement.h"
 #include "nsIDOMHTMLInputElement.h"
 #include "nsIDOMNSHTMLElement.h"
 #include "nsIDOMNSEditableElement.h"
 #include "nsIDOMNSHTMLButtonElement.h"
 #include "nsIDOMHTMLFormElement.h"
 #include "nsIDOMHTMLLegendElement.h"
--- a/accessible/src/html/nsHTMLImageAccessible.cpp
+++ b/accessible/src/html/nsHTMLImageAccessible.cpp
@@ -31,73 +31,47 @@
  * use your version of this file under the terms of the MPL, indicate your
  * decision by deleting the provisions above and replace them with the notice
  * and other provisions required by the GPL or the LGPL. If you do not delete
  * the provisions above, a recipient may use your version of this file under
  * the terms of any one of the MPL, the GPL or the LGPL.
  *
  * ***** END LICENSE BLOCK ***** */
 
+#include "nsHTMLImageAccessible.h"
+
+#include "nsAccessibilityAtoms.h"
+#include "nsAccUtils.h"
+
 #include "imgIContainer.h"
 #include "imgIRequest.h"
-
-#include "nsHTMLImageAccessible.h"
-#include "nsAccessibilityAtoms.h"
-#include "nsHTMLAreaAccessible.h"
-
-#include "nsIDOMHTMLCollection.h"
 #include "nsIDocument.h"
-#include "nsIHTMLDocument.h"
 #include "nsIImageLoadingContent.h"
 #include "nsILink.h"
 #include "nsIPresShell.h"
 #include "nsIServiceManager.h"
 #include "nsIDOMHTMLImageElement.h"
 #include "nsIDOMDocument.h"
 #include "nsPIDOMWindow.h"
 
-// --- image -----
-
-const PRUint32 kDefaultImageCacheSize = 256;
-
 ////////////////////////////////////////////////////////////////////////////////
 // nsHTMLImageAccessible
-
-nsHTMLImageAccessible::nsHTMLImageAccessible(nsIDOMNode* aDOMNode, nsIWeakReference* aShell):
-nsLinkableAccessible(aDOMNode, aShell), mAccessNodeCache(nsnull)
-{ 
-  nsCOMPtr<nsIDOMElement> element(do_QueryInterface(aDOMNode));
-  nsCOMPtr<nsIPresShell> shell(do_QueryReferent(mWeakShell));
-  if (!shell)
-    return;
-
-  nsIDocument *doc = shell->GetDocument();
-  nsAutoString mapElementName;
+////////////////////////////////////////////////////////////////////////////////
 
-  if (doc && element) {
-    nsCOMPtr<nsIHTMLDocument> htmlDoc(do_QueryInterface(doc));
-    element->GetAttribute(NS_LITERAL_STRING("usemap"),mapElementName);
-    if (htmlDoc && !mapElementName.IsEmpty()) {
-      if (mapElementName.CharAt(0) == '#')
-        mapElementName.Cut(0,1);
-      mMapElement = htmlDoc->GetImageMap(mapElementName);
-    }
-  }
-
-  if (mMapElement) {
-    mAccessNodeCache = new nsAccessNodeHashtable();
-    mAccessNodeCache->Init(kDefaultImageCacheSize);
-  }
+nsHTMLImageAccessible::
+  nsHTMLImageAccessible(nsIDOMNode* aDOMNode, nsIWeakReference* aShell) :
+  nsLinkableAccessible(aDOMNode, aShell)
+{
 }
 
 NS_IMPL_ISUPPORTS_INHERITED1(nsHTMLImageAccessible, nsAccessible,
                              nsIAccessibleImage)
 
 ////////////////////////////////////////////////////////////////////////////////
-// nsIAccessible
+// nsAccessible public
 
 nsresult
 nsHTMLImageAccessible::GetStateInternal(PRUint32 *aState, PRUint32 *aExtraState)
 {
   // The state is a bitfield, get our inherited state, then logically OR it with
   // STATE_ANIMATED if this is an animated image.
 
   nsresult rv = nsLinkableAccessible::GetStateInternal(aState, aExtraState);
@@ -145,44 +119,22 @@ nsHTMLImageAccessible::GetNameInternal(n
   }
 
   return NS_OK;
 }
 
 nsresult
 nsHTMLImageAccessible::GetRoleInternal(PRUint32 *aRole)
 {
-  *aRole = mMapElement ? nsIAccessibleRole::ROLE_IMAGE_MAP :
-                         nsIAccessibleRole::ROLE_GRAPHIC;
+  *aRole = nsIAccessibleRole::ROLE_GRAPHIC;
   return NS_OK;
 }
 
-void 
-nsHTMLImageAccessible::CacheChildren()
-{
-  nsCOMPtr<nsIDOMHTMLCollection> mapAreas = GetAreaCollection();
-  if (!mapAreas)
-    return;
-
-  PRUint32 areaCount = 0;
-  mapAreas->GetLength(&areaCount);
-
-  nsCOMPtr<nsIAccessible> areaAccessible;
-  nsRefPtr<nsAccessible> areaAcc;
-
-  for (PRUint32 areaIdx = 0; areaIdx < areaCount; areaIdx++) {
-    areaAccessible = GetAreaAccessible(mapAreas, areaIdx);
-    if (!areaAccessible)
-      return;
-
-    areaAcc = nsAccUtils::QueryObject<nsAccessible>(areaAccessible);
-    mChildren.AppendElement(areaAcc);
-    areaAcc->SetParent(this);
-  }
-}
+////////////////////////////////////////////////////////////////////////////////
+// nsIAccessible
 
 NS_IMETHODIMP
 nsHTMLImageAccessible::GetNumActions(PRUint8 *aNumActions)
 {
   NS_ENSURE_ARG_POINTER(aNumActions);
   *aNumActions = 0;
 
   if (IsDefunct())
@@ -235,76 +187,16 @@ nsHTMLImageAccessible::DoAction(PRUint8 
     nsCOMPtr<nsIDOMWindow> tmp;
     return win->Open(longDesc, NS_LITERAL_STRING(""), NS_LITERAL_STRING(""),
                      getter_AddRefs(tmp));
   }
   return nsLinkableAccessible::DoAction(aIndex);
 }
 
 ////////////////////////////////////////////////////////////////////////////////
-// nsIAccessibleHyperLink
-NS_IMETHODIMP
-nsHTMLImageAccessible::GetAnchorCount(PRInt32 *aAnchorCount)
-{
-  NS_ENSURE_ARG_POINTER(aAnchorCount);
-
-  if (!mMapElement)
-    return nsLinkableAccessible::GetAnchorCount(aAnchorCount);
-
-  return GetChildCount(aAnchorCount);
-}
-
-NS_IMETHODIMP
-nsHTMLImageAccessible::GetURI(PRInt32 aIndex, nsIURI **aURI)
-{
-  NS_ENSURE_ARG_POINTER(aURI);
-  *aURI = nsnull;
-
-  if (!mMapElement)
-    return nsLinkableAccessible::GetURI(aIndex, aURI);
-
-  nsCOMPtr<nsIDOMHTMLCollection> mapAreas = GetAreaCollection();
-  if (!mapAreas)
-    return NS_OK;
-  
-  nsCOMPtr<nsIDOMNode> domNode;
-  mapAreas->Item(aIndex, getter_AddRefs(domNode));
-  if (!domNode)
-    return NS_ERROR_INVALID_ARG;
-
-  nsCOMPtr<nsIContent> link(do_QueryInterface(domNode));
-  if (link)
-    *aURI = link->GetHrefURI().get();
-
-  return NS_OK;
-}
-
-NS_IMETHODIMP
-nsHTMLImageAccessible::GetAnchor(PRInt32 aIndex, nsIAccessible **aAccessible)
-{
-  NS_ENSURE_ARG_POINTER(aAccessible);
-  *aAccessible = nsnull;
-
-  if (!mMapElement)
-    return nsLinkableAccessible::GetAnchor(aIndex, aAccessible);
-
-  nsCOMPtr<nsIDOMHTMLCollection> mapAreas = GetAreaCollection();
-  if (mapAreas) {
-    nsCOMPtr<nsIAccessible> accessible;
-    accessible = GetAreaAccessible(mapAreas, aIndex);
-    if (!accessible)
-      return NS_ERROR_INVALID_ARG;
-
-    NS_ADDREF(*aAccessible = accessible);
-  }
-
-  return NS_OK;
-}
-
-////////////////////////////////////////////////////////////////////////////////
 // nsIAccessibleImage
 
 NS_IMETHODIMP
 nsHTMLImageAccessible::GetImagePosition(PRUint32 aCoordType,
                                         PRInt32 *aX, PRInt32 *aY)
 {
   PRInt32 width, height;
   nsresult rv = GetBounds(aX, aY, &width, &height);
@@ -316,36 +208,17 @@ nsHTMLImageAccessible::GetImagePosition(
 
 NS_IMETHODIMP
 nsHTMLImageAccessible::GetImageSize(PRInt32 *aWidth, PRInt32 *aHeight)
 {
   PRInt32 x, y;
   return GetBounds(&x, &y, aWidth, aHeight);
 }
 
-////////////////////////////////////////////////////////////////////////////////
-// nsHTMLImageAccessible. nsAccessNode
-
-nsresult
-nsHTMLImageAccessible::Shutdown()
-{
-  nsLinkableAccessible::Shutdown();
-
-  if (mAccessNodeCache) {
-    ClearCache(*mAccessNodeCache);
-    delete mAccessNodeCache;
-    mAccessNodeCache = nsnull;
-  }
-
-  return NS_OK;
-}
-
-////////////////////////////////////////////////////////////////////////////////
-// nsHTMLImageAccessible
-
+// nsAccessible
 nsresult
 nsHTMLImageAccessible::GetAttributesInternal(nsIPersistentProperties *aAttributes)
 {
   if (IsDefunct())
     return NS_ERROR_FAILURE;
   
   nsresult rv = nsLinkableAccessible::GetAttributesInternal(aAttributes);
   NS_ENSURE_SUCCESS(rv, rv);
@@ -355,61 +228,16 @@ nsHTMLImageAccessible::GetAttributesInte
   nsAutoString src;
   content->GetAttr(kNameSpaceID_None, nsAccessibilityAtoms::src, src);
   if (!src.IsEmpty())
     nsAccUtils::SetAccAttr(aAttributes, nsAccessibilityAtoms::src, src);
 
   return NS_OK;
 }
 
-already_AddRefed<nsIDOMHTMLCollection>
-nsHTMLImageAccessible::GetAreaCollection()
-{
-  if (!mMapElement)
-    return nsnull;
-
-  nsIDOMHTMLCollection *mapAreas = nsnull;
-  nsresult rv = mMapElement->GetAreas(&mapAreas);
-  if (NS_FAILED(rv))
-    return nsnull;
-
-  return mapAreas;
-}
-
-already_AddRefed<nsIAccessible>
-nsHTMLImageAccessible::GetAreaAccessible(nsIDOMHTMLCollection *aAreaCollection,
-                                         PRInt32 aAreaNum)
-{
-  if (!aAreaCollection)
-    return nsnull;
-
-  nsCOMPtr<nsIDOMNode> domNode;
-  aAreaCollection->Item(aAreaNum,getter_AddRefs(domNode));
-  if (!domNode)
-    return nsnull;
-
-  void* key = reinterpret_cast<void*>(aAreaNum);
-  nsRefPtr<nsAccessNode> accessNode = mAccessNodeCache->GetWeak(key);
-
-  if (!accessNode) {
-    accessNode = new nsHTMLAreaAccessible(domNode, this, mWeakShell);
-    if (!accessNode)
-      return nsnull;
-
-    nsresult rv = accessNode->Init();
-    if (NS_FAILED(rv))
-      return nsnull;
-
-    mAccessNodeCache->Put(key, accessNode);
-  }
-
-  nsCOMPtr<nsIAccessible> accessible = do_QueryInterface(accessNode);
-  return accessible.forget();
-}
-
 ////////////////////////////////////////////////////////////////////////////////
 // Private methods
 
 PRBool
 nsHTMLImageAccessible::HasLongDesc()
 {
   if (IsDefunct())
     return PR_FALSE;
--- a/accessible/src/html/nsHTMLImageAccessible.h
+++ b/accessible/src/html/nsHTMLImageAccessible.h
@@ -35,72 +35,46 @@
  * the terms of any one of the MPL, the GPL or the LGPL.
  *
  * ***** END LICENSE BLOCK ***** */
 
 #ifndef _nsHTMLImageAccessible_H_
 #define _nsHTMLImageAccessible_H_
 
 #include "nsBaseWidgetAccessible.h"
-#include "nsIDOMHTMLMapElement.h"
 #include "nsIAccessibleImage.h"
 
 /* Accessible for supporting images
  * supports:
  * - gets name, role
  * - support basic state
  */
 class nsHTMLImageAccessible : public nsLinkableAccessible,
                               public nsIAccessibleImage
 {
-
-  NS_DECL_ISUPPORTS_INHERITED
-
 public:
   nsHTMLImageAccessible(nsIDOMNode* aDomNode, nsIWeakReference* aShell);
 
+  // nsISupports
+  NS_DECL_ISUPPORTS_INHERITED
+
   // nsIAccessible
   NS_IMETHOD GetNumActions(PRUint8 *aNumActions);
   NS_IMETHOD GetActionName(PRUint8 aIndex, nsAString& aName);
   NS_IMETHOD DoAction(PRUint8 index);
 
-  // nsIAccessibleHyperLink
-  NS_IMETHOD GetAnchorCount(PRInt32 *aAnchorCount);
-  NS_IMETHOD GetURI(PRInt32 aIndex, nsIURI **aURI);
-  NS_IMETHOD GetAnchor(PRInt32 aIndex, nsIAccessible **aAccessible);
-
   // nsIAccessibleImage
   NS_DECL_NSIACCESSIBLEIMAGE
 
-  // nsAccessNode
-  virtual nsresult Shutdown();
-
   // nsAccessible
   virtual nsresult GetNameInternal(nsAString& aName);
   virtual nsresult GetRoleInternal(PRUint32 *aRole);
   virtual nsresult GetStateInternal(PRUint32 *aState, PRUint32 *aExtraState);
   virtual nsresult GetAttributesInternal(nsIPersistentProperties *aAttributes);
 
-protected:
-  // nsAccessible
-  virtual void CacheChildren();
-
-  // nsHTMLImageAccessible
-  already_AddRefed<nsIDOMHTMLCollection> GetAreaCollection();
-  already_AddRefed<nsIAccessible>
-    GetAreaAccessible(nsIDOMHTMLCollection* aAreaNodes, PRInt32 aAreaNum);
-
-  // Reference on linked map element if any.
-  nsCOMPtr<nsIDOMHTMLMapElement> mMapElement;
-
-  // Cache of area accessibles. We do not use common cache because images can
-  // share area elements but we need to have separate area accessibles for
-  // each image accessible.
-  nsAccessNodeHashtable *mAccessNodeCache;
-
 private:
   /**
    * Determine if this image accessible has a longdesc attribute.
    *
    * @returns  true if the longdesc attribute is present.
    */
   PRBool HasLongDesc();
   
rename from accessible/src/html/nsHTMLAreaAccessible.cpp
rename to accessible/src/html/nsHTMLImageMapAccessible.cpp
--- a/accessible/src/html/nsHTMLAreaAccessible.cpp
+++ b/accessible/src/html/nsHTMLImageMapAccessible.cpp
@@ -15,54 +15,171 @@
  * The Original Code is mozilla.org code.
  *
  * The Initial Developer of the Original Code is
  * Netscape Communications Corporation.
  * Portions created by the Initial Developer are Copyright (C) 1998
  * the Initial Developer. All Rights Reserved.
  *
  * Contributor(s):
- *   Author: Aaron Leventhal (aaronl@netscape.com)
+ *   Aaron Leventhal <aaronl@netscape.com> (original author)
+ *   Alexander Surkov <surkov.alexander@gmail.com>
  *
  * Alternatively, the contents of this file may be used under the terms of
  * either of the GNU General Public License Version 2 or later (the "GPL"),
  * or the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
  * in which case the provisions of the GPL or the LGPL are applicable instead
  * of those above. If you wish to allow use of your version of this file only
  * under the terms of either the GPL or the LGPL, and not to allow others to
  * use your version of this file under the terms of the MPL, indicate your
  * decision by deleting the provisions above and replace them with the notice
  * and other provisions required by the GPL or the LGPL. If you do not delete
  * the provisions above, a recipient may use your version of this file under
  * the terms of any one of the MPL, the GPL or the LGPL.
  *
  * ***** END LICENSE BLOCK ***** */
 
-#include "nsHTMLAreaAccessible.h"
+#include "nsHTMLImageMapAccessible.h"
+
+#include "nsAccUtils.h"
+
+#include "nsIDOMHTMLCollection.h"
 #include "nsIServiceManager.h"
 #include "nsIDOMElement.h"
 #include "nsIDOMHTMLAreaElement.h"
 #include "nsIFrame.h"
 #include "nsIImageFrame.h"
 #include "nsIImageMap.h"
 
+////////////////////////////////////////////////////////////////////////////////
+// nsHTMLImageMapAccessible
+////////////////////////////////////////////////////////////////////////////////
+
+nsHTMLImageMapAccessible::
+  nsHTMLImageMapAccessible(nsIDOMNode *aDOMNode, nsIWeakReference *aShell,
+                           nsIDOMHTMLMapElement *aMapElm) :
+  nsHTMLImageAccessibleWrap(aDOMNode, aShell), mMapElement(aMapElm)
+{
+}
+
+////////////////////////////////////////////////////////////////////////////////
+// nsHTMLImageMapAccessible: nsISupports
+
+NS_IMPL_ISUPPORTS_INHERITED0(nsHTMLImageMapAccessible, nsHTMLImageAccessible)
+
+////////////////////////////////////////////////////////////////////////////////
+// nsHTMLImageMapAccessible: nsIAccessibleHyperLink
+
+NS_IMETHODIMP
+nsHTMLImageMapAccessible::GetAnchorCount(PRInt32 *aAnchorCount)
+{
+  NS_ENSURE_ARG_POINTER(aAnchorCount);
+
+  return GetChildCount(aAnchorCount);
+}
+
+NS_IMETHODIMP
+nsHTMLImageMapAccessible::GetURI(PRInt32 aIndex, nsIURI **aURI)
+{
+  NS_ENSURE_ARG_POINTER(aURI);
+  *aURI = nsnull;
+
+  nsAccessible *areaAcc = GetChildAt(aIndex);
+  if (!areaAcc)
+    return NS_ERROR_INVALID_ARG;
+
+  nsCOMPtr<nsIDOMNode> areaNode;
+  areaAcc->GetDOMNode(getter_AddRefs(areaNode));
+
+  nsCOMPtr<nsIContent> link(do_QueryInterface(areaNode));
+  if (link)
+    *aURI = link->GetHrefURI().get();
+
+  return NS_OK;
+}
+
+NS_IMETHODIMP
+nsHTMLImageMapAccessible::GetAnchor(PRInt32 aIndex, nsIAccessible **aAccessible)
+{
+  NS_ENSURE_ARG_POINTER(aAccessible);
+  *aAccessible = nsnull;
+
+  nsAccessible *areaAcc = GetChildAt(aIndex);
+  if (!areaAcc)
+    return NS_ERROR_INVALID_ARG;
+
+  NS_ADDREF(*aAccessible = areaAcc);
+  return NS_OK;
+}
+
+////////////////////////////////////////////////////////////////////////////////
+// nsHTMLImageMapAccessible: nsAccessible public
+
+nsresult
+nsHTMLImageMapAccessible::GetRoleInternal(PRUint32 *aRole)
+{
+  *aRole = nsIAccessibleRole::ROLE_IMAGE_MAP;
+  return NS_OK;
+}
+
+////////////////////////////////////////////////////////////////////////////////
+// nsHTMLImageMapAccessible: nsAccessible protected
+
+void 
+nsHTMLImageMapAccessible::CacheChildren()
+{
+  if (!mMapElement)
+    return;
+
+  nsCOMPtr<nsIDOMHTMLCollection> mapAreas;
+  mMapElement->GetAreas(getter_AddRefs(mapAreas));
+  if (!mapAreas)
+    return;
+
+  PRUint32 areaCount = 0;
+  mapAreas->GetLength(&areaCount);
+
+  for (PRUint32 areaIdx = 0; areaIdx < areaCount; areaIdx++) {
+    nsCOMPtr<nsIDOMNode> areaNode;
+    mapAreas->Item(areaIdx, getter_AddRefs(areaNode));
+    if (!areaNode)
+      return;
+
+    nsRefPtr<nsAccessible> areaAcc =
+      new nsHTMLAreaAccessible(areaNode, mWeakShell);
+    if (!areaAcc)
+      return;
+
+    nsresult rv = areaAcc->Init();
+    if (NS_FAILED(rv)) {
+      areaAcc->Shutdown();
+      return;
+    }
+
+    // We must respect ARIA on area elements (for the canvas map technique)
+    areaAcc->SetRoleMapEntry(nsAccUtils::GetRoleMapEntry(areaNode));
+
+    mChildren.AppendElement(areaAcc);
+    areaAcc->SetParent(this);
+  }
+}
+
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsHTMLAreaAccessible
 ////////////////////////////////////////////////////////////////////////////////
 
 nsHTMLAreaAccessible::
-  nsHTMLAreaAccessible(nsIDOMNode *aDomNode, nsIAccessible *aParent,
-                       nsIWeakReference* aShell):
-  nsHTMLLinkAccessible(aDomNode, aShell)
+  nsHTMLAreaAccessible(nsIDOMNode *aNode, nsIWeakReference *aShell) :
+  nsHTMLLinkAccessible(aNode, aShell)
 {
 }
 
 ////////////////////////////////////////////////////////////////////////////////
-// nsIAccessible
+// nsHTMLAreaAccessible: nsIAccessible
 
 nsresult
 nsHTMLAreaAccessible::GetNameInternal(nsAString & aName)
 {
   nsresult rv = nsAccessible::GetNameInternal(aName);
   NS_ENSURE_SUCCESS(rv, rv);
 
   if (!aName.IsEmpty())
@@ -131,28 +248,41 @@ nsHTMLAreaAccessible::GetBounds(PRInt32 
   orgRectPixels = frame->GetScreenRectExternal();
   *x += orgRectPixels.x;
   *y += orgRectPixels.y;
 
   return NS_OK;
 }
 
 ////////////////////////////////////////////////////////////////////////////////
-// nsAccessible public implementation
+// nsHTMLAreaAccessible: nsAccessible public
+
+nsresult
+nsHTMLAreaAccessible::GetStateInternal(PRUint32 *aState, PRUint32 *aExtraState)
+{
+  // Bypass the link states specialization for non links.
+  if (mRoleMapEntry &&
+      mRoleMapEntry->role != nsIAccessibleRole::ROLE_NOTHING &&
+      mRoleMapEntry->role != nsIAccessibleRole::ROLE_LINK) {
+    return nsAccessible::GetStateInternal(aState,aExtraState);
+  }
+
+  return nsHTMLLinkAccessible::GetStateInternal(aState, aExtraState);
+}
 
 nsresult
 nsHTMLAreaAccessible::GetChildAtPoint(PRInt32 aX, PRInt32 aY,
                                       PRBool aDeepestChild,
                                       nsIAccessible **aChild)
 {
   // Don't walk into area accessibles.
   NS_ADDREF(*aChild = this);
   return NS_OK;
 }
 
 ////////////////////////////////////////////////////////////////////////////////
-// nsAccessible protected implementation
+// nsHTMLAreaAccessible: nsAccessible protected
 
 void
 nsHTMLAreaAccessible::CacheChildren()
 {
   // No children for aria accessible.
 }
rename from accessible/src/html/nsHTMLAreaAccessible.h
rename to accessible/src/html/nsHTMLImageMapAccessible.h
--- a/accessible/src/html/nsHTMLAreaAccessible.h
+++ b/accessible/src/html/nsHTMLImageMapAccessible.h
@@ -15,17 +15,18 @@
  * The Original Code is mozilla.org code.
  *
  * The Initial Developer of the Original Code is
  * Netscape Communications Corporation.
  * Portions created by the Initial Developer are Copyright (C) 1998
  * the Initial Developer. All Rights Reserved.
  *
  * Contributor(s):
- *   Author: Aaron Leventhal (aaronl@netscape.com)
+ *   Aaron Leventhal <aaronl@netscape.com> (original author)
+ *   Alexander Surkov <surkov.alexander@gmail.com>
  *
  * Alternatively, the contents of this file may be used under the terms of
  * either of the GNU General Public License Version 2 or later (the "GPL"),
  * or the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
  * in which case the provisions of the GPL or the LGPL are applicable instead
  * of those above. If you wish to allow use of your version of this file only
  * under the terms of either the GPL or the LGPL, and not to allow others to
  * use your version of this file under the terms of the MPL, indicate your
@@ -35,34 +36,68 @@
  * the terms of any one of the MPL, the GPL or the LGPL.
  *
  * ***** END LICENSE BLOCK ***** */
 
 #ifndef _nsHTMLAreaAccessible_H_
 #define _nsHTMLAreaAccessible_H_
 
 #include "nsHTMLLinkAccessible.h"
+#include "nsHTMLImageAccessibleWrap.h"
+
+#include "nsIDOMHTMLMapElement.h"
+
+/**
+ * Used for HTML image maps.
+ */
+class nsHTMLImageMapAccessible : public nsHTMLImageAccessibleWrap
+{
+public:
+  nsHTMLImageMapAccessible(nsIDOMNode *aNode, nsIWeakReference *aShell,
+                           nsIDOMHTMLMapElement *aMapElm);
+
+  // nsISupports and cycle collector
+  NS_DECL_ISUPPORTS_INHERITED
+
+  // nsIAccessibleHyperLink
+  NS_IMETHOD GetAnchorCount(PRInt32 *aAnchorCount);
+  NS_IMETHOD GetURI(PRInt32 aIndex, nsIURI **aURI);
+  NS_IMETHOD GetAnchor(PRInt32 aIndex, nsIAccessible **aAccessible);
+
+  // nsAccessible
+  virtual nsresult GetRoleInternal(PRUint32 *aRole);
+
+protected:
+
+  // nsAccessible
+  virtual void CacheChildren();
+
+private:
+  // Reference on linked map element if any.
+  nsCOMPtr<nsIDOMHTMLMapElement> mMapElement;
+};
+
 
 /**
  * Accessible for image map areas - must be child of image.
  */
 class nsHTMLAreaAccessible : public nsHTMLLinkAccessible
 {
 
 public:
-  nsHTMLAreaAccessible(nsIDOMNode *domNode, nsIAccessible *accParent,
-                       nsIWeakReference* aShell);
+  nsHTMLAreaAccessible(nsIDOMNode *aNode, nsIWeakReference *aShell);
 
   // nsIAccessible
   NS_IMETHOD GetDescription(nsAString& aDescription);
 
   NS_IMETHOD GetBounds(PRInt32 *x, PRInt32 *y, PRInt32 *width, PRInt32 *height);
 
   // nsAccessible
   virtual nsresult GetNameInternal(nsAString& aName);
+  virtual nsresult GetStateInternal(PRUint32 *aState, PRUint32 *aExtraState);
   virtual nsresult GetChildAtPoint(PRInt32 aX, PRInt32 aY,
                                    PRBool aDeepestChild,
                                    nsIAccessible **aChild);
 
 protected:
 
   // nsAccessible
   virtual void CacheChildren();
--- a/accessible/src/html/nsHTMLLinkAccessible.cpp
+++ b/accessible/src/html/nsHTMLLinkAccessible.cpp
@@ -34,16 +34,18 @@
  * and other provisions required by the GPL or the LGPL. If you do not delete
  * the provisions above, a recipient may use your version of this file under
  * the terms of any one of the MPL, the GPL or the LGPL.
  *
  * ***** END LICENSE BLOCK ***** */
 
 #include "nsHTMLLinkAccessible.h"
 
+#include "nsCoreUtils.h"
+
 #include "nsILink.h"
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsHTMLLinkAccessible
 
 nsHTMLLinkAccessible::nsHTMLLinkAccessible(nsIDOMNode* aDomNode,
                                            nsIWeakReference* aShell):
   nsHyperTextAccessibleWrap(aDomNode, aShell)
--- a/accessible/src/html/nsHTMLSelectAccessible.cpp
+++ b/accessible/src/html/nsHTMLSelectAccessible.cpp
@@ -31,20 +31,25 @@
  * use your version of this file under the terms of the MPL, indicate your
  * decision by deleting the provisions above and replace them with the notice
  * and other provisions required by the GPL or the LGPL. If you do not delete
  * the provisions above, a recipient may use your version of this file under
  * the terms of any one of the MPL, the GPL or the LGPL.
  *
  * ***** END LICENSE BLOCK ***** */
 
+#include "nsHTMLSelectAccessible.h"
+
+#include "nsAccessibilityService.h"
+#include "nsAccUtils.h"
+#include "nsEventShell.h"
+#include "nsIAccessibleEvent.h"
+#include "nsTextEquivUtils.h"
+
 #include "nsCOMPtr.h"
-#include "nsHTMLSelectAccessible.h"
-#include "nsIAccessibilityService.h"
-#include "nsIAccessibleEvent.h"
 #include "nsIFrame.h"
 #include "nsIComboboxControlFrame.h"
 #include "nsIDocument.h"
 #include "nsIDOMHTMLInputElement.h"
 #include "nsIDOMHTMLOptGroupElement.h"
 #include "nsIDOMHTMLSelectElement.h"
 #include "nsIListControlFrame.h"
 #include "nsIServiceManager.h"
@@ -110,46 +115,51 @@ void nsHTMLSelectableAccessible::iterato
     (*aSelectionCount)++;
 }
 
 void
 nsHTMLSelectableAccessible::iterator::AddAccessibleIfSelected(nsIMutableArray *aSelectedAccessibles, 
                                                               nsPresContext *aContext)
 {
   PRBool isSelected = PR_FALSE;
-  nsCOMPtr<nsIAccessible> tempAccess;
+  nsRefPtr<nsAccessible> tempAcc;
 
   if (mOption) {
     mOption->GetSelected(&isSelected);
     if (isSelected) {
       nsCOMPtr<nsIDOMNode> optionNode(do_QueryInterface(mOption));
-      GetAccService()->GetAccessibleInWeakShell(optionNode, mWeakShell,
-                                                getter_AddRefs(tempAccess));
+      tempAcc = GetAccService()->GetAccessibleInWeakShell(optionNode,
+                                                          mWeakShell);
     }
   }
 
-  if (tempAccess)
-    aSelectedAccessibles->AppendElement(static_cast<nsISupports*>(tempAccess), PR_FALSE);
+  if (tempAcc)
+    aSelectedAccessibles->AppendElement(static_cast<nsIAccessible*>(tempAcc),
+                                        PR_FALSE);
 }
 
 PRBool
 nsHTMLSelectableAccessible::iterator::GetAccessibleIfSelected(PRInt32 aIndex,
                                                               nsPresContext *aContext, 
                                                               nsIAccessible **aAccessible)
 {
   PRBool isSelected = PR_FALSE;
 
   *aAccessible = nsnull;
 
   if (mOption) {
     mOption->GetSelected(&isSelected);
     if (isSelected) {
       if (mSelCount == aIndex) {
         nsCOMPtr<nsIDOMNode> optionNode(do_QueryInterface(mOption));
-        GetAccService()->GetAccessibleInWeakShell(optionNode, mWeakShell, aAccessible);
+        nsRefPtr<nsAccessible> acc =
+          GetAccService()->GetAccessibleInWeakShell(optionNode, mWeakShell);
+        if (acc)
+          CallQueryInterface(acc, aAccessible);
+
         return PR_TRUE;
       }
       mSelCount++;
     }
   }
 
   return PR_FALSE;
 }
@@ -387,65 +397,60 @@ nsHTMLSelectListAccessible::CacheOptSibl
 
     nsCOMPtr<nsIAtom> tag = childContent->Tag();
     if (tag == nsAccessibilityAtoms::option ||
         tag == nsAccessibilityAtoms::optgroup) {
 
       // Get an accessible for option or optgroup and cache it.
       nsCOMPtr<nsIDOMNode> childNode(do_QueryInterface(childContent));
 
-      nsCOMPtr<nsIAccessible> accessible;
-      GetAccService()->GetAccessibleInWeakShell(childNode, mWeakShell,
-                                                getter_AddRefs(accessible));
-      if (accessible) {
-        nsRefPtr<nsAccessible> acc =
-          nsAccUtils::QueryObject<nsAccessible>(accessible);
-
+      nsRefPtr<nsAccessible> acc =
+        GetAccService()->GetAccessibleInWeakShell(childNode, mWeakShell);
+      if (acc) {
         mChildren.AppendElement(acc);
         acc->SetParent(this);
       }
 
       // Deep down into optgroup element.
       if (tag == nsAccessibilityAtoms::optgroup)
         CacheOptSiblings(childContent);
     }
   }
 }
 
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsHTMLSelectOptionAccessible
 ////////////////////////////////////////////////////////////////////////////////
 
-/** Default Constructor */
-nsHTMLSelectOptionAccessible::nsHTMLSelectOptionAccessible(nsIDOMNode* aDOMNode, nsIWeakReference* aShell):
-nsHyperTextAccessibleWrap(aDOMNode, aShell)
+nsHTMLSelectOptionAccessible::
+  nsHTMLSelectOptionAccessible(nsIDOMNode *aDOMNode, nsIWeakReference *aShell) :
+  nsHyperTextAccessibleWrap(aDOMNode, aShell)
 {
   nsCOMPtr<nsIDOMNode> parentNode;
   aDOMNode->GetParentNode(getter_AddRefs(parentNode));
-  nsCOMPtr<nsIAccessible> parentAccessible;
-  if (parentNode) {
-    // If the parent node is a Combobox, then the option's accessible parent
-    // is nsHTMLComboboxListAccessible, not the nsHTMLComboboxAccessible that
-    // GetParent would normally return. This is because the 
-    // nsHTMLComboboxListAccessible is inserted into the accessible hierarchy
-    // where there is no DOM node for it.
-    GetAccService()->GetAccessibleInWeakShell(parentNode, mWeakShell, 
-                                              getter_AddRefs(parentAccessible));
-    if (parentAccessible) {
-      if (nsAccUtils::RoleInternal(parentAccessible) ==
-          nsIAccessibleRole::ROLE_COMBOBOX) {
-        nsCOMPtr<nsIAccessible> comboAccessible(parentAccessible);
-        comboAccessible->GetLastChild(getter_AddRefs(parentAccessible));
-      }
-    }
+
+  if (!parentNode)
+    return;
+
+  // If the parent node is a Combobox, then the option's accessible parent
+  // is nsHTMLComboboxListAccessible, not the nsHTMLComboboxAccessible that
+  // GetParent would normally return. This is because the 
+  // nsHTMLComboboxListAccessible is inserted into the accessible hierarchy
+  // where there is no DOM node for it.
+  nsRefPtr<nsAccessible> parentAcc =
+    GetAccService()->GetAccessibleInWeakShell(parentNode, mWeakShell);
+  if (!parentAcc)
+    return;
+
+  if (nsAccUtils::RoleInternal(parentAcc) == nsIAccessibleRole::ROLE_COMBOBOX) {
+    PRInt32 childCount = parentAcc->GetChildCount();
+    parentAcc = parentAcc->GetChildAt(childCount - 1);
   }
 
-  nsRefPtr<nsAccessible> parentAcc =
-    nsAccUtils::QueryObject<nsAccessible>(parentAccessible);
   SetParent(parentAcc);
 }
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsHTMLSelectOptionAccessible: nsAccessible public
 
 nsresult
 nsHTMLSelectOptionAccessible::GetRoleInternal(PRUint32 *aRole)
@@ -999,49 +1004,47 @@ NS_IMETHODIMP nsHTMLComboboxAccessible::
   aDescription.Truncate();
   // First check to see if combo box itself has a description, perhaps through
   // tooltip (title attribute) or via aria-describedby
   nsAccessible::GetDescription(aDescription);
   if (!aDescription.IsEmpty()) {
     return NS_OK;
   }
   // Use description of currently focused option
-  nsCOMPtr<nsIAccessible> optionAccessible = GetFocusedOptionAccessible();
-  return optionAccessible ? optionAccessible->GetDescription(aDescription) : NS_OK;
+  nsRefPtr<nsAccessible> optionAcc = GetFocusedOptionAccessible();
+  return optionAcc ? optionAcc->GetDescription(aDescription) : NS_OK;
 }
 
-already_AddRefed<nsIAccessible>
+already_AddRefed<nsAccessible>
 nsHTMLComboboxAccessible::GetFocusedOptionAccessible()
 {
-  if (!mWeakShell) {
-    return nsnull;  // Shut down
-  }
+  if (IsDefunct())
+    return nsnull;
+
   nsCOMPtr<nsIDOMNode> focusedOptionNode;
-  nsHTMLSelectOptionAccessible::GetFocusedOptionNode(mDOMNode, getter_AddRefs(focusedOptionNode));
+  nsHTMLSelectOptionAccessible::
+    GetFocusedOptionNode(mDOMNode, getter_AddRefs(focusedOptionNode));
   if (!focusedOptionNode) {
     return nsnull;
   }
 
-  nsIAccessible *optionAccessible;
-  GetAccService()->GetAccessibleInWeakShell(focusedOptionNode, mWeakShell, 
-                                            &optionAccessible);
-  return optionAccessible;
+  return GetAccService()->GetAccessibleInWeakShell(focusedOptionNode,
+                                                   mWeakShell);
 }
 
 /**
   * MSAA/ATK accessible value != HTML value, especially not in combo boxes.
   * Our accessible value is the text label for of our ( first ) selected child.
   * The easiest way to get this is from the first child which is the readonly textfield.
   */
 NS_IMETHODIMP nsHTMLComboboxAccessible::GetValue(nsAString& aValue)
 {
-  // Use label of currently focused option
-  nsCOMPtr<nsIAccessible> optionAccessible = GetFocusedOptionAccessible();
-  NS_ENSURE_TRUE(optionAccessible, NS_ERROR_FAILURE);
-  return optionAccessible->GetName(aValue);
+  // Use accessible name of currently focused option.
+  nsRefPtr<nsAccessible> optionAcc = GetFocusedOptionAccessible();
+  return optionAcc ? optionAcc->GetName(aValue) : NS_OK;
 }
 
 /** Just one action ( click ). */
 NS_IMETHODIMP nsHTMLComboboxAccessible::GetNumActions(PRUint8 *aNumActions)
 {
   *aNumActions = 1;
   return NS_OK;
 }
--- a/accessible/src/html/nsHTMLSelectAccessible.h
+++ b/accessible/src/html/nsHTMLSelectAccessible.h
@@ -235,17 +235,21 @@ public:
   virtual nsresult GetRoleInternal(PRUint32 *aRole);
   virtual nsresult GetStateInternal(PRUint32 *aState, PRUint32 *aExtraState);
 
 protected:
   // nsAccessible
   virtual void CacheChildren();
 
   // nsHTMLComboboxAccessible
-  already_AddRefed<nsIAccessible> GetFocusedOptionAccessible();
+
+  /**
+   * Return focused option accessible.
+   */
+  already_AddRefed<nsAccessible> GetFocusedOptionAccessible();
 
 private:
   nsRefPtr<nsHTMLComboboxListAccessible> mListAccessible;
 };
 
 /*
  * A class that represents the window that lives to the right
  * of the drop down button inside the Select. This is the window
--- a/accessible/src/html/nsHTMLTableAccessible.cpp
+++ b/accessible/src/html/nsHTMLTableAccessible.cpp
@@ -34,35 +34,36 @@
  * and other provisions required by the GPL or the LGPL. If you do not delete
  * the provisions above, a recipient may use your version of this file under
  * the terms of any one of the MPL, the GPL or the LGPL.
  *
  * ***** END LICENSE BLOCK ***** */
 
 #include "nsHTMLTableAccessible.h"
 
+#include "nsAccessibilityService.h"
+#include "nsAccUtils.h"
 #include "nsDocAccessible.h"
+#include "nsRelUtils.h"
+#include "nsTextEquivUtils.h"
 
 #include "nsIDOMElement.h"
 #include "nsIDOMDocument.h"
 #include "nsIDOMDocumentRange.h"
 #include "nsIDOMRange.h"
 #include "nsISelection2.h"
 #include "nsISelectionPrivate.h"
 #include "nsINameSpaceManager.h"
-#include "nsIAccessibilityService.h"
-#include "nsIDOMCSSStyleDeclaration.h"
 #include "nsIDOMHTMLCollection.h"
 #include "nsIDOMHTMLTableCellElement.h"
 #include "nsIDOMHTMLTableElement.h"
 #include "nsIDOMHTMLTableRowElement.h"
 #include "nsIDOMHTMLTableSectionElem.h"
 #include "nsIDocument.h"
 #include "nsIPresShell.h"
-#include "nsIServiceManager.h"
 #include "nsITableLayout.h"
 #include "nsITableCellLayout.h"
 #include "nsFrameSelection.h"
 #include "nsLayoutErrors.h"
 #include "nsArrayUtils.h"
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsHTMLTableCellAccessible
@@ -329,26 +330,26 @@ nsHTMLTableCellAccessible::GetHeaderCell
     NS_ENSURE_SUCCESS(rv, rv);
 
     PRUint32 count = 0;
     rv = headerCellElms->GetLength(&count);
     if (NS_SUCCEEDED(rv) && count > 0) {
       nsCOMPtr<nsIDOMNode> headerCellNode;
       for (PRUint32 idx = 0; idx < count; idx++) {
         headerCellNode = do_QueryElementAt(headerCellElms, idx, &rv);
-        nsCOMPtr<nsIAccessible> headerCell;
-        GetAccService()->GetAccessibleInWeakShell(headerCellNode, mWeakShell,
-                                                  getter_AddRefs(headerCell));
+        nsRefPtr<nsAccessible> headerCell =
+          GetAccService()->GetAccessibleInWeakShell(headerCellNode, mWeakShell);
 
         if (headerCell &&
             (aRowOrColumnHeaderCell == nsAccUtils::eRowHeaderCells &&
              nsAccUtils::Role(headerCell) == nsIAccessibleRole::ROLE_ROWHEADER ||
              aRowOrColumnHeaderCell == nsAccUtils::eColumnHeaderCells &&
              nsAccUtils::Role(headerCell) == nsIAccessibleRole::ROLE_COLUMNHEADER))
-          headerCells->AppendElement(headerCell, PR_FALSE);
+          headerCells->AppendElement(static_cast<nsIAccessible*>(headerCell.get()),
+                                     PR_FALSE);
       }
     }
 
     NS_ADDREF(*aHeaderCells = headerCells);
     return NS_OK;
   }
 
   // Otherwise calculate header cells from hierarchy (see 11.4.3 "Algorithm to
@@ -401,30 +402,30 @@ nsHTMLTableHeaderCellAccessible::GetRole
   // rowheader.
   nsIContent* parent = content->GetParent();
   NS_ENSURE_STATE(parent);
 
   PRInt32 indexInParent = parent->IndexOf(content);
 
   for (PRInt32 idx = indexInParent - 1; idx >= 0; idx--) {
     nsIContent* sibling = parent->GetChildAt(idx);
-    if (sibling && sibling->IsNodeOfType(nsINode::eELEMENT)) {
+    if (sibling && sibling->IsElement()) {
       if (nsCoreUtils::IsHTMLTableHeader(sibling))
         *aRole = nsIAccessibleRole::ROLE_COLUMNHEADER;
       else
         *aRole = nsIAccessibleRole::ROLE_ROWHEADER;
 
       return NS_OK;
     }
   }
 
   PRInt32 childCount = parent->GetChildCount();
   for (PRInt32 idx = indexInParent + 1; idx < childCount; idx++) {
     nsIContent* sibling = parent->GetChildAt(idx);
-    if (sibling && sibling->IsNodeOfType(nsINode::eELEMENT)) {
+    if (sibling && sibling->IsElement()) {
       if (nsCoreUtils::IsHTMLTableHeader(sibling))
         *aRole = nsIAccessibleRole::ROLE_COLUMNHEADER;
       else
         *aRole = nsIAccessibleRole::ROLE_ROWHEADER;
       
       return NS_OK;
     }
   }
@@ -732,20 +733,19 @@ nsHTMLTableAccessible::GetSelectedCells(
                                       *getter_AddRefs(cellElement),
                                       startRowIndex, startColIndex,
                                       rowSpan, colSpan,
                                       actualRowSpan, actualColSpan,
                                       isSelected);
 
       if (NS_SUCCEEDED(rv) && startRowIndex == rowIndex &&
           startColIndex == columnIndex && isSelected) {
-        nsCOMPtr<nsIAccessible> cell;
-        GetAccService()->GetAccessibleInWeakShell(cellElement, mWeakShell,
-                                                  getter_AddRefs(cell));
-        selCells->AppendElement(cell, PR_FALSE);
+        nsRefPtr<nsAccessible> cell =
+          GetAccService()->GetAccessibleInWeakShell(cellElement, mWeakShell);
+        selCells->AppendElement(static_cast<nsIAccessible*>(cell.get()), PR_FALSE);
       }
     }
   }
 
   NS_ADDREF(*aCells = selCells);
   return NS_OK;
 }
 
@@ -906,18 +906,22 @@ nsHTMLTableAccessible::GetSelectedRowInd
 NS_IMETHODIMP
 nsHTMLTableAccessible::GetCellAt(PRInt32 aRow, PRInt32 aColumn,
                                  nsIAccessible **aTableCellAccessible)
 {
   nsCOMPtr<nsIDOMElement> cellElement;
   nsresult rv = GetCellAt(aRow, aColumn, *getter_AddRefs(cellElement));
   NS_ENSURE_SUCCESS(rv, rv);
 
-  return GetAccService()->GetAccessibleInWeakShell(cellElement, mWeakShell,
-                                                   aTableCellAccessible);
+  nsRefPtr<nsAccessible> cellAcc =
+    GetAccService()->GetAccessibleInWeakShell(cellElement, mWeakShell);
+  if (cellAcc)
+    CallQueryInterface(cellAcc, aTableCellAccessible);
+
+  return NS_OK;
 }
 
 NS_IMETHODIMP
 nsHTMLTableAccessible::GetCellIndexAt(PRInt32 aRow, PRInt32 aColumn,
                                       PRInt32 *aIndex)
 {
   NS_ENSURE_ARG_POINTER(aIndex);
 
@@ -1494,17 +1498,17 @@ nsHTMLTableAccessible::IsProbablyForLayo
   if (styledWidth.Find(NS_LITERAL_STRING("px"))) { // Hardcoded in pixels
     nsIFrame *tableFrame = GetFrame();
     NS_ENSURE_TRUE(tableFrame , NS_ERROR_FAILURE);
     nsSize tableSize  = tableFrame->GetSize();
 
     nsCOMPtr<nsIAccessibleDocument> docAccessible = GetDocAccessible();
     NS_ENSURE_TRUE(docAccessible, NS_ERROR_FAILURE);
 
-    nsRefPtr<nsAccessNode> docAccessNode = nsAccUtils::QueryAccessNode(docAccessible);
+    nsRefPtr<nsAccessNode> docAccessNode = do_QueryObject(docAccessible);
 
     nsIFrame *docFrame = docAccessNode->GetFrame();
     NS_ENSURE_TRUE(docFrame , NS_ERROR_FAILURE);
 
     nsSize docSize = docFrame->GetSize();
     if (docSize.width > 0) {
       PRInt32 percentageOfDocWidth = (100 * tableSize.width) / docSize.width;
       if (percentageOfDocWidth > 95) {
--- a/accessible/src/html/nsHTMLTextAccessible.cpp
+++ b/accessible/src/html/nsHTMLTextAccessible.cpp
@@ -35,20 +35,20 @@
  * the provisions above, a recipient may use your version of this file under
  * the terms of any one of the MPL, the GPL or the LGPL.
  *
  * ***** END LICENSE BLOCK ***** */
 
 #include "nsHTMLTextAccessible.h"
 
 #include "nsDocAccessible.h"
+#include "nsTextEquivUtils.h"
 
 #include "nsIFrame.h"
 #include "nsPresContext.h"
-#include "nsIPresShell.h"
 #include "nsISelection.h"
 #include "nsISelectionController.h"
 #include "nsComponentManagerUtils.h"
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsHTMLTextAccessible
 ////////////////////////////////////////////////////////////////////////////////
 
--- a/accessible/src/html/nsHyperTextAccessible.cpp
+++ b/accessible/src/html/nsHyperTextAccessible.cpp
@@ -33,18 +33,20 @@
  * decision by deleting the provisions above and replace them with the notice
  * and other provisions required by the GPL or the LGPL. If you do not delete
  * the provisions above, a recipient may use your version of this file under
  * the terms of any one of the MPL, the GPL or the LGPL.
  *
  * ***** END LICENSE BLOCK ***** */
 
 #include "nsHyperTextAccessible.h"
+
 #include "nsAccessibilityAtoms.h"
 #include "nsAccessibilityService.h"
+#include "nsAccUtils.h"
 #include "nsTextAttrs.h"
 
 #include "nsIClipboard.h"
 #include "nsContentCID.h"
 #include "nsIDOMAbstractView.h"
 #include "nsIDOMCharacterData.h"
 #include "nsIDOMDocument.h"
 #include "nsPIDOMWindow.h"        
@@ -317,33 +319,34 @@ nsHyperTextAccessible::GetPosAndText(PRI
     aBoundsRect->Empty();
   }
   if (aStartAcc)
     *aStartAcc = nsnull;
   if (aEndAcc)
     *aEndAcc = nsnull;
 
   nsIntRect unionRect;
-  nsCOMPtr<nsIAccessible> accessible, lastAccessible;
+  nsAccessible *lastAccessible = nsnull;
 
   gfxSkipChars skipChars;
   gfxSkipCharsIterator iter;
 
   // Loop through children and collect valid offsets, text and bounds
-  // depending on what we need for out parameters
-  while (NextChild(accessible)) {
-    lastAccessible = accessible;
-    nsRefPtr<nsAccessNode> accessNode = nsAccUtils::QueryAccessNode(accessible);
+  // depending on what we need for out parameters.
+  PRInt32 childCount = GetChildCount();
+  for (PRInt32 childIdx = 0; childIdx < childCount; childIdx++) {
+    nsAccessible *childAcc = mChildren[childIdx];
+    lastAccessible = childAcc;
 
-    nsIFrame *frame = accessNode->GetFrame();
+    nsIFrame *frame = childAcc->GetFrame();
     if (!frame) {
       continue;
     }
     nsIFrame *primaryFrame = frame;
-    if (nsAccUtils::IsText(accessible)) {
+    if (nsAccUtils::IsText(childAcc)) {
       // We only need info up to rendered offset -- that is what we're
       // converting to content offset
       PRInt32 substringEndOffset = -1;
       PRUint32 ourRenderedStart = 0;
       PRInt32 ourContentStart = 0;
       if (frame->GetType() == nsAccessibilityAtoms::textFrame) {
         nsresult rv = frame->GetRenderedText(nsnull, &skipChars, &iter);
         if (NS_SUCCEEDED(rv)) {
@@ -352,17 +355,17 @@ nsHyperTextAccessible::GetPosAndText(PRI
           substringEndOffset =
             iter.ConvertOriginalToSkipped(skipChars.GetOriginalCharCount() +
                                           ourContentStart) - ourRenderedStart;
         }
       }
       if (substringEndOffset < 0) {
         // XXX for non-textframe text like list bullets,
         // should go away after list bullet rewrite
-        substringEndOffset = nsAccUtils::TextLength(accessible);
+        substringEndOffset = nsAccUtils::TextLength(childAcc);
       }
       if (startOffset < substringEndOffset) {
         // Our start is within this substring
         if (startOffset > 0 || endOffset < substringEndOffset) {
           // We don't want the whole string for this accessible
           // Get out the continuing text frame with this offset
           PRInt32 outStartLineUnused;
           PRInt32 contentOffset;
@@ -373,45 +376,44 @@ nsHyperTextAccessible::GetPosAndText(PRI
           else {
             contentOffset = startOffset;
           }
           frame->GetChildFrameContainingOffset(contentOffset, PR_TRUE,
                                                &outStartLineUnused, &frame);
           if (aEndFrame) {
             *aEndFrame = frame; // We ended in the current frame
             if (aEndAcc)
-              NS_ADDREF(*aEndAcc = accessible);
+              NS_ADDREF(*aEndAcc = childAcc);
           }
           if (substringEndOffset > endOffset) {
             // Need to stop before the end of the available text
             substringEndOffset = endOffset;
           }
           aEndOffset = endOffset;
         }
         if (aText) {
           if (isPassword) {
             for (PRInt32 count = startOffset; count < substringEndOffset; count ++)
               *aText += '*'; // Show *'s only for password text
           }
           else {
-            nsRefPtr<nsAccessible> acc(nsAccUtils::QueryAccessible(accessible));
-            acc->AppendTextTo(*aText, startOffset,
-                              substringEndOffset - startOffset);
+            childAcc->AppendTextTo(*aText, startOffset,
+                                   substringEndOffset - startOffset);
           }
         }
         if (aBoundsRect) {    // Caller wants the bounds of the text
           aBoundsRect->UnionRect(*aBoundsRect,
                                  GetBoundsForString(primaryFrame, startOffset,
                                                     substringEndOffset));
         }
         if (!startFrame) {
           startFrame = frame;
           aStartOffset = startOffset;
           if (aStartAcc)
-            NS_ADDREF(*aStartAcc = accessible);
+            NS_ADDREF(*aStartAcc = childAcc);
         }
         // We already started copying in this accessible's string,
         // for the next accessible we'll start at offset 0
         startOffset = 0;
       }
       else {
         // We have not found the start position yet, get the new startOffset
         // that is relative to next accessible
@@ -443,17 +445,17 @@ nsHyperTextAccessible::GetPosAndText(PRI
             aBoundsRect->UnionRect(*aBoundsRect,
                                    frame->GetScreenRectExternal());
           }
         }
         if (!startFrame) {
           startFrame = frame;
           aStartOffset = 0;
           if (aStartAcc)
-            NS_ADDREF(*aStartAcc = accessible);
+            NS_ADDREF(*aStartAcc = childAcc);
         }
       }
       -- endOffset;
     }
     if (endOffset <= 0 && startFrame) {
       break; // If we don't have startFrame yet, get that in next loop iteration
     }
   }
@@ -478,25 +480,27 @@ NS_IMETHODIMP nsHyperTextAccessible::Get
   return GetPosAndText(aStartOffset, aEndOffset, &aText) ? NS_OK : NS_ERROR_FAILURE;
 }
 
 /*
  * Gets the character count.
  */
 NS_IMETHODIMP nsHyperTextAccessible::GetCharacterCount(PRInt32 *aCharacterCount)
 {
+  NS_ENSURE_ARG_POINTER(aCharacterCount);
   *aCharacterCount = 0;
-  if (!mDOMNode) {
+
+  if (IsDefunct())
     return NS_ERROR_FAILURE;
-  }
 
-  nsCOMPtr<nsIAccessible> accessible;
+  PRInt32 childCount = GetChildCount();
+  for (PRInt32 childIdx = 0; childIdx < childCount; childIdx++) {
+    nsAccessible *childAcc = mChildren[childIdx];
 
-  while (NextChild(accessible)) {
-    PRInt32 textLength = nsAccUtils::TextLength(accessible);
+    PRInt32 textLength = nsAccUtils::TextLength(childAcc);
     NS_ENSURE_TRUE(textLength >= 0, nsnull);
     *aCharacterCount += textLength;
   }
   return NS_OK;
 }
 
 /*
  * Gets the specified character.
@@ -576,40 +580,41 @@ nsresult nsHyperTextAccessible::DOMPoint
         return NS_OK;
       }
       findNode = do_QueryInterface(parentContent); // Case #2: there are no children
     }
   }
 
   // Get accessible for this findNode, or if that node isn't accessible, use the
   // accessible for the next DOM node which has one (based on forward depth first search)
-  nsCOMPtr<nsIAccessible> descendantAccessible;
+  nsRefPtr<nsAccessible> descendantAcc;
   if (findNode) {
     nsCOMPtr<nsIContent> findContent = do_QueryInterface(findNode);
     if (findContent->IsHTML() && 
         findContent->NodeInfo()->Equals(nsAccessibilityAtoms::br) &&
         findContent->AttrValueIs(kNameSpaceID_None,
                                  nsAccessibilityAtoms::mozeditorbogusnode,
                                  nsAccessibilityAtoms::_true,
                                  eIgnoreCase)) {
       // This <br> is the hacky "bogus node" used when there is no text in a control
       *aHyperTextOffset = 0;
       return NS_OK;
     }
-    descendantAccessible = GetFirstAvailableAccessible(findNode);
+    descendantAcc = GetFirstAvailableAccessible(findNode);
   }
+
   // From the descendant, go up and get the immediate child of this hypertext
-  nsCOMPtr<nsIAccessible> childAccessible;
-  while (descendantAccessible) {
-    nsCOMPtr<nsIAccessible> parentAccessible;
-    descendantAccessible->GetParent(getter_AddRefs(parentAccessible));
-    if (this == parentAccessible) {
-      childAccessible = descendantAccessible;
+  nsRefPtr<nsAccessible> childAccAtOffset;
+  while (descendantAcc) {
+    nsRefPtr<nsAccessible> parentAcc = descendantAcc->GetParent();
+    if (parentAcc == this) {
+      childAccAtOffset = descendantAcc;
       break;
     }
+
     // This offset no longer applies because the passed-in text object is not a child
     // of the hypertext. This happens when there are nested hypertexts, e.g.
     // <div>abc<h1>def</h1>ghi</div>
     // If the passed-in DOM point was not on a direct child of the hypertext, we will
     // return the offset for that entire hypertext
     if (aIsEndOffset) {
       // Not inclusive, the indicated char comes at index before this offset
       // If the end offset is after the first character of the passed in object, use 1 for
@@ -617,39 +622,50 @@ nsresult nsHyperTextAccessible::DOMPoint
     // before the embedded object char if we end at the very beginning of the child.
     addTextOffset = addTextOffset > 0;
     }
     else {
       // Start offset, inclusive
       // Make sure the offset lands on the embedded object character in order to indicate
       // the true inner offset is inside the subtree for that link
       addTextOffset =
-        (nsAccUtils::TextLength(descendantAccessible) == static_cast<PRInt32>(addTextOffset)) ? 1 : 0;
+        (nsAccUtils::TextLength(descendantAcc) == static_cast<PRInt32>(addTextOffset)) ? 1 : 0;
     }
-    descendantAccessible = parentAccessible;
-  }  
+
+    descendantAcc.swap(parentAcc);
+  }
 
   // Loop through, adding offsets until we reach childAccessible
   // If childAccessible is null we will end up adding up the entire length of
   // the hypertext, which is good -- it just means our offset node
   // came after the last accessible child's node
-  nsCOMPtr<nsIAccessible> accessible;
-  while (NextChild(accessible) && accessible != childAccessible) {
-    PRInt32 textLength = nsAccUtils::TextLength(accessible);
+  PRInt32 childCount = GetChildCount();
+
+  PRInt32 childIdx = 0;
+  nsAccessible *childAcc = nsnull;
+  for (; childIdx < childCount; childIdx++) {
+    childAcc = mChildren[childIdx];
+    if (childAcc == childAccAtOffset)
+      break;
+
+    PRInt32 textLength = nsAccUtils::TextLength(childAcc);
     NS_ENSURE_TRUE(textLength >= 0, nsnull);
     *aHyperTextOffset += textLength;
   }
-  if (accessible) {
+
+  if (childIdx < childCount) {
     *aHyperTextOffset += addTextOffset;
-    NS_ASSERTION(accessible == childAccessible, "These should be equal whenever we exit loop and accessible != nsnull");
+    NS_ASSERTION(childAcc == childAccAtOffset,
+                 "These should be equal whenever we exit loop and childAcc != nsnull");
+
     if (aFinalAccessible &&
-        (NextChild(accessible) ||
-         static_cast<PRInt32>(addTextOffset) < nsAccUtils::TextLength(childAccessible))) {  
+        (childIdx < childCount - 1 ||
+         static_cast<PRInt32>(addTextOffset) < nsAccUtils::TextLength(childAccAtOffset))) {  
       // If not at end of last text node, we will return the accessible we were in
-      NS_ADDREF(*aFinalAccessible = childAccessible);
+      NS_ADDREF(*aFinalAccessible = childAccAtOffset);
     }
   }
 
   return NS_OK;
 }
 
 nsresult
 nsHyperTextAccessible::HypertextOffsetToDOMPoint(PRInt32 aHTOffset,
@@ -760,18 +776,17 @@ nsHyperTextAccessible::GetRelativeOffset
   }
 
   // Ask layout for the new node and offset, after moving the appropriate amount
   nsPeekOffsetStruct pos;
 
   nsresult rv;
   PRInt32 contentOffset = aFromOffset;
   if (nsAccUtils::IsText(aFromAccessible)) {
-    nsRefPtr<nsAccessNode> accessNode =
-      nsAccUtils::QueryAccessNode(aFromAccessible);
+    nsRefPtr<nsAccessNode> accessNode = do_QueryObject(aFromAccessible);
 
     nsIFrame *frame = accessNode->GetFrame();
     NS_ENSURE_TRUE(frame, -1);
 
     if (frame->GetType() == nsAccessibilityAtoms::textFrame) {
       rv = RenderedToContentOffset(frame, aFromOffset, &contentOffset);
       NS_ENSURE_SUCCESS(rv, -1);
     }
@@ -955,18 +970,17 @@ nsresult nsHyperTextAccessible::GetTextH
                                        nsnull, getter_AddRefs(startAcc));
 
   if (!startFrame) {
     PRInt32 textLength;
     GetCharacterCount(&textLength);
     if (aBoundaryType == BOUNDARY_LINE_START && aOffset > 0 && aOffset == textLength) {
       // Asking for start of line, while on last character
       if (startAcc) {
-        nsRefPtr<nsAccessNode> startAccessNode =
-          nsAccUtils::QueryAccessNode(startAcc);
+        nsRefPtr<nsAccessNode> startAccessNode = do_QueryObject(startAcc);
         startFrame = startAccessNode->GetFrame();
       }
     }
     if (!startFrame) {
       return aOffset > textLength ? NS_ERROR_FAILURE : NS_OK;
     }
     else {
       // We're on the last continuation since we're on the last character
@@ -1114,17 +1128,17 @@ nsHyperTextAccessible::GetTextAttributes
   NS_ENSURE_SUCCESS(rv, rv);
 
   // Set 'misspelled' text attribute.
   rv = GetSpellTextAttribute(node, nodeOffset, aStartOffset, aEndOffset,
                              aAttributes ? *aAttributes : nsnull);
   NS_ENSURE_SUCCESS(rv, rv);
 
   nsCOMPtr<nsIContent> content(do_QueryInterface(node));
-  if (content && content->IsNodeOfType(nsINode::eELEMENT))
+  if (content && content->IsElement())
     node = do_QueryInterface(content->GetChildAt(nodeOffset));
 
   if (!node)
     return NS_OK;
 
   nsTextAttrsMgr textAttrsMgr(this, mDOMNode, aIncludeDefAttrs, node);
   return textAttrsMgr.GetAttributes(*aAttributes, aStartOffset, aEndOffset);
 }
@@ -1272,23 +1286,22 @@ nsHyperTextAccessible::GetOffsetAtPoint(
   nsPoint pointInHyperText(context->DevPixelsToAppUnits(pxInHyperText.x),
                            context->DevPixelsToAppUnits(pxInHyperText.y));
 
   // Go through the frames to check if each one has the point.
   // When one does, add up the character offsets until we have a match
 
   // We have an point in an accessible child of this, now we need to add up the
   // offsets before it to what we already have
-  nsCOMPtr<nsIAccessible> accessible;
   PRInt32 offset = 0;
+  PRInt32 childCount = GetChildCount();
+  for (PRInt32 childIdx = 0; childIdx < childCount; childIdx++) {
+    nsAccessible *childAcc = mChildren[childIdx];
 
-  while (NextChild(accessible)) {
-    nsRefPtr<nsAccessNode> accessNode = nsAccUtils::QueryAccessNode(accessible);
-
-    nsIFrame *primaryFrame = accessNode->GetFrame();
+    nsIFrame *primaryFrame = childAcc->GetFrame();
     NS_ENSURE_TRUE(primaryFrame, NS_ERROR_FAILURE);
 
     nsIFrame *frame = primaryFrame;
     while (frame) {
       nsIContent *content = frame->GetContent();
       NS_ENSURE_TRUE(content, NS_ERROR_FAILURE);
       nsPoint pointInFrame = pointInHyperText - frame->GetOffsetToExternal(hyperFrame);
       nsSize frameSize = frame->GetSize();
@@ -1306,82 +1319,85 @@ nsHyperTextAccessible::GetOffsetAtPoint(
           NS_ENSURE_SUCCESS(rv, rv);
           offset += addToOffset;
         }
         *aOffset = offset;
         return NS_OK;
       }
       frame = frame->GetNextContinuation();
     }
-    PRInt32 textLength = nsAccUtils::TextLength(accessible);
+    PRInt32 textLength = nsAccUtils::TextLength(childAcc);
     NS_ENSURE_TRUE(textLength >= 0, NS_ERROR_FAILURE);
     offset += textLength;
   }
 
   return NS_OK; // Not found, will return -1
 }
 
 // ------- nsIAccessibleHyperText ---------------
 NS_IMETHODIMP
 nsHyperTextAccessible::GetLinkCount(PRInt32 *aLinkCount)
 {
   NS_ENSURE_ARG_POINTER(aLinkCount);
   *aLinkCount = 0;
-  if (!mDOMNode) {
+  if (IsDefunct())
     return NS_ERROR_FAILURE;
-  }
 
-  nsCOMPtr<nsIAccessible> accessible;
-
-  while (NextChild(accessible)) {
-    if (nsAccUtils::IsEmbeddedObject(accessible))
+  PRInt32 childCount = GetChildCount();
+  for (PRInt32 childIdx = 0; childIdx < childCount; childIdx++) {
+    nsAccessible *childAcc = mChildren[childIdx];
+    if (nsAccUtils::IsEmbeddedObject(childAcc))
       ++*aLinkCount;
   }
   return NS_OK;
 }
 
 
 NS_IMETHODIMP
 nsHyperTextAccessible::GetLink(PRInt32 aLinkIndex, nsIAccessibleHyperLink **aLink)
 {
   NS_ENSURE_ARG_POINTER(aLink);
   *aLink = nsnull;
 
   if (IsDefunct())
     return NS_ERROR_FAILURE;
 
   PRInt32 linkIndex = aLinkIndex;
-  nsCOMPtr<nsIAccessible> accessible;
-  while (NextChild(accessible)) {
-    if (nsAccUtils::IsEmbeddedObject(accessible) && linkIndex-- == 0)
-      return CallQueryInterface(accessible, aLink);
+
+  PRInt32 childCount = GetChildCount();
+  for (PRInt32 childIdx = 0; childIdx < childCount; childIdx++) {
+    nsAccessible *childAcc = mChildren[childIdx];
+    if (nsAccUtils::IsEmbeddedObject(childAcc) && linkIndex-- == 0)
+      return CallQueryInterface(childAcc, aLink);
   }
 
   return NS_ERROR_INVALID_ARG;
 }
 
 NS_IMETHODIMP
 nsHyperTextAccessible::GetLinkIndex(PRInt32 aCharIndex, PRInt32 *aLinkIndex)
 {
   NS_ENSURE_ARG_POINTER(aLinkIndex);
   *aLinkIndex = -1; // API says this magic value means 'not found'
 
+  if (IsDefunct())
+    return NS_ERROR_FAILURE;
+
   PRInt32 characterCount = 0;
   PRInt32 linkIndex = 0;
-  if (!mDOMNode) {
-    return NS_ERROR_FAILURE;
-  }
 
-  nsCOMPtr<nsIAccessible> accessible;
+  PRInt32 childCount = GetChildCount();
+  for (PRInt32 childIdx = 0;
+       childIdx < childCount && characterCount <= aCharIndex; childIdx++) {
+    nsAccessible *childAcc = mChildren[childIdx];
 
-  while (NextChild(accessible) && characterCount <= aCharIndex) {
-    PRUint32 role = nsAccUtils::Role(accessible);
+    PRUint32 role = nsAccUtils::Role(childAcc);
     if (role == nsIAccessibleRole::ROLE_TEXT_LEAF ||
         role == nsIAccessibleRole::ROLE_STATICTEXT) {
-      PRInt32 textLength = nsAccUtils::TextLength(accessible);
+      PRInt32 textLength = nsAccUtils::TextLength(childAcc);
       NS_ENSURE_TRUE(textLength >= 0, NS_ERROR_FAILURE);
       characterCount += textLength;
     }
     else {
       if (characterCount ++ == aCharIndex) {
         *aLinkIndex = linkIndex;
         break;
       }
--- a/accessible/src/mac/Makefile.in
+++ b/accessible/src/mac/Makefile.in
@@ -43,16 +43,17 @@ include $(DEPTH)/config/autoconf.mk
 
 MODULE = accessibility
 LIBRARY_NAME = accessibility_toolkit_s
 LIBXUL_LIBRARY = 1
 
   
   
 CMMSRCS = nsAccessNodeWrap.mm \
+          nsDocAccessibleWrap.mm \
           nsRootAccessibleWrap.mm \
           nsAccessibleWrap.mm \
           mozAccessible.mm \
           mozDocAccessible.mm \
           mozActionElements.mm \
           mozTextAccessible.mm \
           $(NULL)
           
--- a/accessible/src/mac/nsAccessibleWrap.h
+++ b/accessible/src/mac/nsAccessibleWrap.h
@@ -38,24 +38,25 @@
 
 /* For documentation of the accessibility architecture, 
  * see http://lxr.mozilla.org/seamonkey/source/accessible/accessible-docs.html
  */
 
 #ifndef _nsAccessibleWrap_H_
 #define _nsAccessibleWrap_H_
 
+#include "nsAccessible.h"
+#include "nsAccUtils.h"
+
 #include "nsCOMPtr.h"
 #include "nsRect.h"
 
 #include "nsTArray.h"
 #include "nsAutoPtr.h"
 
-#include "nsAccessible.h"
-
 struct AccessibleWrapper;
 struct objc_class;
 
 class nsAccessibleWrap : public nsAccessible
 {
   public: // construction, destruction
     nsAccessibleWrap(nsIDOMNode*, nsIWeakReference *aShell);
     virtual ~nsAccessibleWrap();
@@ -94,33 +95,20 @@ class nsAccessibleWrap : public nsAccess
     // return this accessible's all children, adhering to "flat" accessibles by not returning their children.
     void GetUnignoredChildren(nsTArray<nsRefPtr<nsAccessibleWrap> > &aChildrenArray);
     virtual already_AddRefed<nsIAccessible> GetUnignoredParent();
     
   protected:
 
     virtual nsresult FirePlatformEvent(nsAccEvent *aEvent);
 
-    PRBool AncestorIsFlat() {
-      // we don't create a native object if we're child of a "flat" accessible; for example, on OS X buttons 
-      // shouldn't have any children, because that makes the OS confused. 
-      //
-      // to maintain a scripting environment where the XPCOM accessible hierarchy look the same 
-      // on all platforms, we still let the C++ objects be created though.
-
-      nsAccessible* parent(GetParent());
-      while (parent) {
-        if (nsAccUtils::MustPrune(parent))
-          return PR_TRUE;
-
-        parent = parent->GetParent();
-      }
-      // no parent was flat
-      return PR_FALSE;
-    }
+  /**
+   * Return true if the parent doesn't have children to expose to AT.
+   */
+  PRBool AncestorIsFlat();
 
     // Wrapper around our native object.
     AccessibleWrapper *mNativeWrapper;
 };
 
 // Define unsupported wrap classes here
 typedef class nsHTMLTableCellAccessible    nsHTMLTableCellAccessibleWrap;
 typedef class nsHTMLTableAccessible        nsHTMLTableAccessibleWrap;
--- a/accessible/src/mac/nsAccessibleWrap.mm
+++ b/accessible/src/mac/nsAccessibleWrap.mm
@@ -180,17 +180,17 @@ nsAccessibleWrap::FirePlatformEvent(nsAc
   PRUint32 eventType = aEvent->GetEventType();
 
   // ignore everything but focus-changed and value-changed events for now.
   if (eventType != nsIAccessibleEvent::EVENT_FOCUS &&
       eventType != nsIAccessibleEvent::EVENT_VALUE_CHANGE)
     return NS_OK;
 
   nsCOMPtr<nsIAccessible> accessible;
-  nsresult rv = aEvent->GetAccessible(getter_AddRefs(accessible));
+  aEvent->GetAccessible(getter_AddRefs(accessible));
   NS_ENSURE_STATE(accessible);
 
   mozAccessible *nativeAcc = nil;
   accessible->GetNativeInterface((void**)&nativeAcc);
   if (!nativeAcc)
     return NS_ERROR_FAILURE;
 
   switch (eventType) {
@@ -222,79 +222,79 @@ nsAccessibleWrap::InvalidateChildren()
 }
 
 PRInt32
 nsAccessibleWrap::GetUnignoredChildCount(PRBool aDeepCount)
 {
   // if we're flat, we have no children.
   if (nsAccUtils::MustPrune(this))
     return 0;
-  
-  PRInt32 childCount = 0;
-  GetChildCount(&childCount);
-  
-  nsCOMPtr<nsIAccessible> curAcc;
-  
-  while (NextChild(curAcc)) {
-    nsAccessibleWrap *childWrap = static_cast<nsAccessibleWrap*>(curAcc.get());
-    
+
+  PRInt32 resultChildCount = 0;
+
+  PRInt32 childCount = GetChildCount();
+  for (PRInt32 childIdx = 0; childIdx < childCount; childIdx++) {
+    nsAccessibleWrap *childAcc =
+      static_cast<nsAccessibleWrap*>(GetChildAt(childIdx));
+
     // if the current child is not ignored, count it.
-    if (!childWrap->IsIgnored())
-      ++childCount;
-      
+    if (!childAcc->IsIgnored())
+      ++resultChildCount;
+
     // if it's flat, we don't care to inspect its children.
-    if (nsAccUtils::MustPrune(childWrap))
+    if (nsAccUtils::MustPrune(childAcc))
       continue;
-    
+
     if (aDeepCount) {
       // recursively count the unignored children of our children since it's a deep count.
-      childCount += childWrap->GetUnignoredChildCount(PR_TRUE);
+      resultChildCount += childAcc->GetUnignoredChildCount(PR_TRUE);
     } else {
       // no deep counting, but if the child is ignored, we want to substitute it for its
       // children.
-      if (childWrap->IsIgnored()) 
-        childCount += childWrap->GetUnignoredChildCount(PR_FALSE);
+      if (childAcc->IsIgnored()) 
+        resultChildCount += childAcc->GetUnignoredChildCount(PR_FALSE);
     }
   } 
   
-  return childCount;
+  return resultChildCount;
 }
 
 // if we for some reason have no native accessible, we should be skipped over (and traversed)
 // when fetching all unignored children, etc.  when counting unignored children, we will not be counted.
 PRBool 
 nsAccessibleWrap::IsIgnored() 
 {
   return (mNativeWrapper == nsnull) || mNativeWrapper->isIgnored();
 }
 
 void
 nsAccessibleWrap::GetUnignoredChildren(nsTArray<nsRefPtr<nsAccessibleWrap> > &aChildrenArray)
 {
-  nsCOMPtr<nsIAccessible> curAcc;
-  
   // we're flat; there are no children.
   if (nsAccUtils::MustPrune(this))
     return;
-  
-  while (NextChild(curAcc)) {
-    nsAccessibleWrap *childWrap = static_cast<nsAccessibleWrap*>(curAcc.get());
-    if (childWrap->IsIgnored()) {
+
+  PRInt32 childCount = GetChildCount();
+  for (PRInt32 childIdx = 0; childIdx < childCount; childIdx++) {
+    nsAccessibleWrap *childAcc =
+      static_cast<nsAccessibleWrap*>(GetChildAt(childIdx));
+
+    if (childAcc->IsIgnored()) {
       // element is ignored, so try adding its children as substitutes, if it has any.
-      if (!nsAccUtils::MustPrune(childWrap)) {
+      if (!nsAccUtils::MustPrune(childAcc)) {
         nsTArray<nsRefPtr<nsAccessibleWrap> > children;
-        childWrap->GetUnignoredChildren(children);
+        childAcc->GetUnignoredChildren(children);
         if (!children.IsEmpty()) {
           // add the found unignored descendants to the array.
           aChildrenArray.AppendElements(children);
         }
       }
     } else
       // simply add the element, since it's not ignored.
-      aChildrenArray.AppendElement(childWrap);
+      aChildrenArray.AppendElement(childAcc);
   }
 }
 
 already_AddRefed<nsIAccessible>
 nsAccessibleWrap::GetUnignoredParent()
 {
   nsAccessibleWrap *parentWrap = static_cast<nsAccessibleWrap*>(GetParent());
   if (!parentWrap)
@@ -304,8 +304,33 @@ nsAccessibleWrap::GetUnignoredParent()
   if (parentWrap->IsIgnored())
     return parentWrap->GetUnignoredParent();
   
   nsIAccessible *outValue = nsnull;
   NS_IF_ADDREF(outValue = parentWrap);
   
   return outValue;
 }
+
+////////////////////////////////////////////////////////////////////////////////
+// nsAccessibleWrap protected
+
+PRBool
+nsAccessibleWrap::AncestorIsFlat()
+{
+  // We don't create a native object if we're child of a "flat" accessible;
+  // for example, on OS X buttons shouldn't have any children, because that
+  // makes the OS confused. 
+  //
+  // To maintain a scripting environment where the XPCOM accessible hierarchy
+  // look the same on all platforms, we still let the C++ objects be created
+  // though.
+
+  nsAccessible* parent(GetParent());
+  while (parent) {
+    if (nsAccUtils::MustPrune(parent))
+      return PR_TRUE;
+
+    parent = parent->GetParent();
+  }
+  // no parent was flat
+  return PR_FALSE;
+}
--- a/accessible/src/mac/nsDocAccessibleWrap.h
+++ b/accessible/src/mac/nsDocAccessibleWrap.h
@@ -36,12 +36,23 @@
  *
  * ***** END LICENSE BLOCK ***** */
 
 #ifndef _nsDocAccessibleWrap_H_
 #define _nsDocAccessibleWrap_H_
 
 #include "nsDocAccessible.h"
 
-typedef nsDocAccessible nsDocAccessibleWrap;
+class nsDocAccessibleWrap: public nsDocAccessible
+{
+public:
+    nsDocAccessibleWrap(nsIDOMNode *aNode, nsIWeakReference *aShell);
+    virtual ~nsDocAccessibleWrap();
+
+    // nsIAccessNode
+
+    /**
+     * Creates the native accessible connected to this one.
+     */
+    virtual nsresult Init ();
+};
 
 #endif
-
new file mode 100644
--- /dev/null
+++ b/accessible/src/mac/nsDocAccessibleWrap.mm
@@ -0,0 +1,66 @@
+/* -*- Mode: C; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*-
+ * ***** BEGIN LICENSE BLOCK *****
+ * Version: MPL 1.1/GPL 2.0/LGPL 2.1
+ *
+ * The contents of this file are subject to the Mozilla Public License Version
+ * 1.1 (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ * http://www.mozilla.org/MPL/
+ *
+ * Software distributed under the License is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
+ * for the specific language governing rights and limitations under the
+ * License.
+ *
+ * The Original Code is mozilla.org code.
+ *
+ * The Initial Developer of the Original Code is Mozilla Foundation.
+ * Portions created by the Initial Developer are Copyright (C) 2010
+ * the Initial Developer. All Rights Reserved.
+ *
+ * Contributor(s):
+ *   Original Author: Steven Michaud <smichaud@pobox.com>
+ *
+ * Alternatively, the contents of this file may be used under the terms of
+ * either the GNU General Public License Version 2 or later (the "GPL"), or
+ * the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
+ * in which case the provisions of the GPL or the LGPL are applicable instead
+ * of those above. If you wish to allow use of your version of this file only
+ * under the terms of either the GPL or the LGPL, and not to allow others to
+ * use your version of this file under the terms of the MPL, indicate your
+ * decision by deleting the provisions above and replace them with the notice
+ * and other provisions required by the GPL or the LGPL. If you do not delete
+ * the provisions above, a recipient may use your version of this file under
+ * the terms of any one of the MPL, the GPL or the LGPL.
+ *
+ * ***** END LICENSE BLOCK ***** */
+
+#include "nsDocAccessibleWrap.h"
+
+#import "mozAccessibleWrapper.h"
+
+nsDocAccessibleWrap::
+  nsDocAccessibleWrap(nsIDOMNode *aDOMNode, nsIWeakReference *aShell) :
+  nsDocAccessible(aDOMNode, aShell)
+{
+}
+
+nsDocAccessibleWrap::~nsDocAccessibleWrap()
+{
+}
+
+nsresult
+nsDocAccessibleWrap::Init () 
+{
+  nsresult rv = nsDocAccessible::Init();
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  NS_ASSERTION(!mNativeWrapper, "nsDocAccessibleWrap::Init() called more than once!");
+
+  if (!mNativeWrapper) {
+    // Create our native object using the class type specified in GetNativeType().
+    mNativeWrapper = new AccessibleWrapper (this, GetNativeType());
+  }
+
+  return NS_OK;
+}
--- a/accessible/src/msaa/CAccessibleText.cpp
+++ b/accessible/src/msaa/CAccessibleText.cpp
@@ -46,16 +46,17 @@
 #include "nsIAccessible.h"
 #include "nsIAccessibleText.h"
 #include "nsIAccessibleTypes.h"
 #include "nsIWinAccessNode.h"
 #include "nsAccessNodeWrap.h"
 #include "nsAccessibleWrap.h"
 
 #include "nsCOMPtr.h"
+#include "nsIPersistentProperties2.h"
 #include "nsString.h"
 
 #define GET_NSIACCESSIBLETEXT \
 nsCOMPtr<nsIAccessibleText> textAcc(do_QueryInterface(this));\
 NS_ASSERTION(textAcc,\
              "Subclass of CAccessibleText doesn't implement nsIAccessibleText");\
 if (!textAcc)\
   return E_FAIL;\
--- a/accessible/src/msaa/nsAccessNodeWrap.cpp
+++ b/accessible/src/msaa/nsAccessNodeWrap.cpp
@@ -32,35 +32,37 @@
  * decision by deleting the provisions above and replace them with the notice
  * and other provisions required by the GPL or the LGPL. If you do not delete
  * the provisions above, a recipient may use your version of this file under
  * the terms of any one of the MPL, the GPL or the LGPL.
  *
  * ***** END LICENSE BLOCK ***** */
 
 #include "nsAccessNodeWrap.h"
+
+#include "AccessibleApplication.h"
 #include "ISimpleDOMNode_i.c"
+
 #include "nsAccessibilityAtoms.h"
-#include "nsIAccessible.h"
+#include "nsAccessibilityService.h"
+#include "nsApplicationAccessibleWrap.h"
+#include "nsCoreUtils.h"
+#include "nsRootAccessible.h"
+
 #include "nsAttrName.h"
 #include "nsIDocument.h"
-#include "nsIDOMCSSStyleDeclaration.h"
 #include "nsIDOMNodeList.h"
 #include "nsIDOMNSHTMLElement.h"
 #include "nsIDOMViewCSS.h"
 #include "nsIFrame.h"
 #include "nsINameSpaceManager.h"
 #include "nsIPrefService.h"
 #include "nsIPrefBranch.h"
-#include "nsIPresShell.h"
 #include "nsPIDOMWindow.h"
-#include "nsRootAccessible.h"
 #include "nsIServiceManager.h"
-#include "AccessibleApplication.h"
-#include "nsApplicationAccessibleWrap.h"
 
 /// the accessible library and cached methods
 HINSTANCE nsAccessNodeWrap::gmAccLib = nsnull;
 HINSTANCE nsAccessNodeWrap::gmUserLib = nsnull;
 LPFNACCESSIBLEOBJECTFROMWINDOW nsAccessNodeWrap::gmAccessibleObjectFromWindow = nsnull;
 LPFNNOTIFYWINEVENT nsAccessNodeWrap::gmNotifyWinEvent = nsnull;
 LPFNGETGUITHREADINFO nsAccessNodeWrap::gmGetGUIThreadInfo = nsnull;
 
@@ -406,24 +408,21 @@ ISimpleDOMNode* nsAccessNodeWrap::MakeAc
     doc = do_QueryInterface(node);
     content = do_QueryInterface(node);
   }
 
   if (!doc)
     return NULL;
 
   ISimpleDOMNode *iNode = NULL;
-  nsCOMPtr<nsIAccessible> nsAcc;
-  GetAccService()->GetAccessibleInWeakShell(node, mWeakShell, 
-                                            getter_AddRefs(nsAcc));
-  if (nsAcc) {
-    nsCOMPtr<nsIAccessNode> accessNode(do_QueryInterface(nsAcc));
-    NS_ASSERTION(accessNode, "nsIAccessible impl does not inherit from nsIAccessNode");
-    IAccessible *msaaAccessible;
-    nsAcc->GetNativeInterface((void**)&msaaAccessible); // addrefs
+  nsRefPtr<nsAccessible> acc =
+    GetAccService()->GetAccessibleInWeakShell(node, mWeakShell);
+  if (acc) {
+    IAccessible *msaaAccessible = nsnull;
+    acc->GetNativeInterface((void**)&msaaAccessible); // addrefs
     msaaAccessible->QueryInterface(IID_ISimpleDOMNode, (void**)&iNode); // addrefs
     msaaAccessible->Release(); // Release IAccessible
   }
   else {
     newNode = new nsAccessNodeWrap(node, mWeakShell);
     if (!newNode)
       return NULL;
 
--- a/accessible/src/msaa/nsAccessibleWrap.cpp
+++ b/accessible/src/msaa/nsAccessibleWrap.cpp
@@ -32,17 +32,21 @@
  * decision by deleting the provisions above and replace them with the notice
  * and other provisions required by the GPL or the LGPL. If you do not delete
  * the provisions above, a recipient may use your version of this file under
  * the terms of any one of the MPL, the GPL or the LGPL.
  *
  * ***** END LICENSE BLOCK ***** */
 
 #include "nsAccessibleWrap.h"
+
 #include "nsAccessibilityAtoms.h"
+#include "nsAccUtils.h"
+#include "nsCoreUtils.h"
+#include "nsRelUtils.h"
 
 #include "nsIAccessibleDocument.h"
 #include "nsIAccessibleSelectable.h"
 #include "nsIAccessibleEvent.h"
 #include "nsIAccessibleWin32Object.h"
 
 #include "Accessible2_i.c"
 #include "AccessibleStates.h"
@@ -492,17 +496,17 @@ STDMETHODIMP nsAccessibleWrap::get_accRo
   if (!accessNode)
     return E_FAIL;
 
   accessNode->GetDOMNode(getter_AddRefs(domNode));
   nsIContent *content = nsCoreUtils::GetRoleContent(domNode);
   if (!content)
     return E_FAIL;
 
-  if (content->IsNodeOfType(nsINode::eELEMENT)) {
+  if (content->IsElement()) {
     nsAutoString roleString;
     if (msaaRole != ROLE_SYSTEM_CLIENT &&
         !content->GetAttr(kNameSpaceID_None, nsAccessibilityAtoms::role, roleString)) {
       nsIDocument * document = content->GetCurrentDoc();
       if (!document)
         return E_FAIL;
 
       nsINodeInfo *nodeInfo = content->NodeInfo();
@@ -1746,17 +1750,17 @@ PRInt32 nsAccessibleWrap::GetChildIDFor(
   // Yes, this means we're only compatibible with 32 bit
   // MSAA is only available for 32 bit windows, so it's okay
   return - NS_PTR_TO_INT32(uniqueID);
 }
 
 HWND
 nsAccessibleWrap::GetHWNDFor(nsIAccessible *aAccessible)
 {
-  nsRefPtr<nsAccessNode> accessNode = nsAccUtils::QueryAccessNode(aAccessible);
+  nsRefPtr<nsAccessNode> accessNode = do_QueryObject(aAccessible);
   if (!accessNode)
     return 0;
 
   HWND hWnd = 0;
   nsIFrame *frame = accessNode->GetFrame();
   if (frame) {
     nsIWidget *window = frame->GetWindow();
     PRBool isVisible;
--- a/accessible/src/msaa/nsDocAccessibleWrap.cpp
+++ b/accessible/src/msaa/nsDocAccessibleWrap.cpp
@@ -38,17 +38,16 @@
 
 #include "nsDocAccessibleWrap.h"
 #include "ISimpleDOMDocument_i.c"
 #include "nsIAccessibilityService.h"
 #include "nsIDocShell.h"
 #include "nsIDocShellTreeNode.h"
 #include "nsIFrame.h"
 #include "nsIInterfaceRequestorUtils.h"
-#include "nsIPresShell.h"
 #include "nsISelectionController.h"
 #include "nsIServiceManager.h"
 #include "nsIURI.h"
 #include "nsIViewManager.h"
 #include "nsIWebNavigation.h"
 
 /* For documentation of the accessibility architecture, 
  * see http://lxr.mozilla.org/seamonkey/source/accessible/accessible-docs.html
--- a/accessible/src/msaa/nsDocAccessibleWrap.h
+++ b/accessible/src/msaa/nsDocAccessibleWrap.h
@@ -39,16 +39,18 @@
 /* For documentation of the accessibility architecture, 
  * see http://lxr.mozilla.org/seamonkey/source/accessible/accessible-docs.html
  */
 
 #ifndef _nsDocAccessibleWrap_H_
 #define _nsDocAccessibleWrap_H_
 
 #include "ISimpleDOMDocument.h"
+
+#include "nsAccUtils.h"
 #include "nsDocAccessible.h"
 #include "nsIDocShellTreeItem.h"
 
 class nsDocAccessibleWrap: public nsDocAccessible,
                            public ISimpleDOMDocument
 {
 public:
     nsDocAccessibleWrap(nsIDOMNode *aNode, nsIWeakReference *aShell);
--- a/accessible/src/msaa/nsHyperTextAccessibleWrap.cpp
+++ b/accessible/src/msaa/nsHyperTextAccessibleWrap.cpp
@@ -35,16 +35,18 @@
  * and other provisions required by the GPL or the LGPL. If you do not delete
  * the provisions above, a recipient may use your version of this file under
  * the terms of any one of the MPL, the GPL or the LGPL.
  *
  * ***** END LICENSE BLOCK ***** */
 
 #include "nsHyperTextAccessibleWrap.h"
 
+#include "nsEventShell.h"
+
 NS_IMPL_ISUPPORTS_INHERITED0(nsHyperTextAccessibleWrap,
                              nsHyperTextAccessible)
 
 IMPL_IUNKNOWN_INHERITED2(nsHyperTextAccessibleWrap,
                          nsAccessibleWrap,
                          CAccessibleHypertext,
                          CAccessibleEditableText);
 
--- a/accessible/src/msaa/nsTextAccessibleWrap.cpp
+++ b/accessible/src/msaa/nsTextAccessibleWrap.cpp
@@ -35,16 +35,17 @@
  * the terms of any one of the MPL, the GPL or the LGPL.
  *
  * ***** END LICENSE BLOCK ***** */
 
 // NOTE: alphabetically ordered
 #include "nsTextAccessibleWrap.h"
 #include "ISimpleDOMText_i.c"
 
+#include "nsCoreUtils.h"
 #include "nsDocAccessible.h"
 
 #include "nsIFontMetrics.h"
 #include "nsIFrame.h"
 #include "nsPresContext.h"
 #include "nsIPresShell.h"
 #include "nsIRenderingContext.h"
 #include "nsIComponentManager.h"
--- a/accessible/src/msaa/nsTextAccessibleWrap.h
+++ b/accessible/src/msaa/nsTextAccessibleWrap.h
@@ -39,17 +39,16 @@
 #ifndef _nsTextAccessibleWrap_H_
 #define _nsTextAccessibleWrap_H_
 
 #include "nsTextAccessible.h"
 #include "ISimpleDOMText.h"
 #include "nsRect.h"
 
 class nsIFrame;
-class nsPresContext;
 class nsIRenderingContext;
 
 class nsTextAccessibleWrap : public nsTextAccessible, 
                              public ISimpleDOMText
 {
   public:
     nsTextAccessibleWrap(nsIDOMNode *, nsIWeakReference* aShell);
     virtual ~nsTextAccessibleWrap() {}
--- a/accessible/src/xforms/nsXFormsAccessible.cpp
+++ b/accessible/src/xforms/nsXFormsAccessible.cpp
@@ -33,16 +33,20 @@
  * and other provisions required by the GPL or the LGPL. If you do not delete
  * the provisions above, a recipient may use your version of this file under
  * the terms of any one of the MPL, the GPL or the LGPL.
  *
  * ***** END LICENSE BLOCK ***** */
 
 #include "nsXFormsAccessible.h"
 
+#include "nsAccessibilityService.h"
+#include "nsAccUtils.h"
+#include "nsTextEquivUtils.h"
+
 #include "nscore.h"
 #include "nsServiceManagerUtils.h"
 #include "nsIDOMElement.h"
 #include "nsIDOMNodeList.h"
 #include "nsIEditor.h"
 #include "nsIMutableArray.h"
 #include "nsIXFormsUtilityService.h"
 #include "nsIPlaintextEditor.h"
@@ -100,20 +104,16 @@ nsXFormsAccessible::GetBoundChildElement
 
   aValue.Truncate();
   return NS_OK;
 }
 
 void
 nsXFormsAccessible::CacheSelectChildren(nsIDOMNode *aContainerNode)
 {
-  nsIAccessibilityService *accService = GetAccService();
-  if (!accService)
-    return;
-
   nsCOMPtr<nsIDOMNode> container(aContainerNode);
   if (!container)
     container = mDOMNode;
 
   nsCOMPtr<nsIDOMNodeList> children;
   sXFormsService->GetSelectChildrenFor(container, getter_AddRefs(children));
 
   if (!children)
@@ -126,17 +126,18 @@ nsXFormsAccessible::CacheSelectChildren(
   nsRefPtr<nsAccessible> acc;
 
   for (PRUint32 index = 0; index < length; index++) {
     nsCOMPtr<nsIDOMNode> child;
     children->Item(index, getter_AddRefs(child));
     if (!child)
       continue;
 
-    accService->GetAttachedAccessibleFor(child, getter_AddRefs(accessible));
+    GetAccService()->GetAttachedAccessibleFor(child,
+                                              getter_AddRefs(accessible));
     if (!accessible)
       continue;
 
     acc = nsAccUtils::QueryObject<nsAccessible>(accessible);
     mChildren.AppendElement(acc);
     acc->SetParent(this);
   }
 }
@@ -332,32 +333,29 @@ nsXFormsSelectableAccessible::GetSelecte
   NS_ENSURE_ARG_POINTER(aAccessibles);
 
   *aAccessibles = nsnull;
 
   nsCOMPtr<nsIMutableArray> accessibles =
     do_CreateInstance(NS_ARRAY_CONTRACTID);
   NS_ENSURE_TRUE(accessibles, NS_ERROR_OUT_OF_MEMORY);
 
-  nsIAccessibilityService* accService = GetAccService();
-  NS_ENSURE_TRUE(accService, NS_ERROR_FAILURE);
-
   nsresult rv;
 
   if (mIsSelect1Element) {
     nsCOMPtr<nsIDOMNode> item;
     rv = sXFormsService->GetSelectedItemForSelect1(mDOMNode,
                                                    getter_AddRefs(item));
     NS_ENSURE_SUCCESS(rv, rv);
 
     if (!item)
       return NS_OK;
 
     nsCOMPtr<nsIAccessible> accessible;
-    accService->GetAccessibleFor(item, getter_AddRefs(accessible));
+    GetAccService()->GetAccessibleFor(item, getter_AddRefs(accessible));
     NS_ENSURE_TRUE(accessible, NS_ERROR_FAILURE);
 
     accessibles->AppendElement(accessible, PR_FALSE);
     NS_ADDREF(*aAccessibles = accessibles);
     return NS_OK;
   }
 
   nsCOMPtr<nsIDOMNodeList> items;
@@ -374,17 +372,17 @@ nsXFormsSelectableAccessible::GetSelecte
     return NS_OK;
 
   for (PRUint32 index = 0; index < length; index++) {
     nsCOMPtr<nsIDOMNode> item;
     items->Item(index, getter_AddRefs(item));
     NS_ENSURE_TRUE(item, NS_ERROR_FAILURE);
 
     nsCOMPtr<nsIAccessible> accessible;
-    accService->GetAccessibleFor(item, getter_AddRefs(accessible));
+    GetAccService()->GetAccessibleFor(item, getter_AddRefs(accessible));
     NS_ENSURE_TRUE(accessible, NS_ERROR_FAILURE);
 
     accessibles->AppendElement(accessible, PR_FALSE);
   }
 
   NS_ADDREF(*aAccessibles = accessibles);
   return NS_OK;
 }
@@ -462,31 +460,28 @@ nsXFormsSelectableAccessible::RemoveChil
 
 NS_IMETHODIMP
 nsXFormsSelectableAccessible::RefSelection(PRInt32 aIndex,
                                            nsIAccessible **aAccessible)
 {
   NS_ENSURE_ARG_POINTER(aAccessible);
   *aAccessible = nsnull;
 
-  nsIAccessibilityService* accService = GetAccService();
-  NS_ENSURE_TRUE(accService, NS_ERROR_FAILURE);
-
   nsresult rv;
   if (mIsSelect1Element) {
     if (aIndex != 0)
       return NS_OK;
 
     nsCOMPtr<nsIDOMNode> item;
     rv = sXFormsService->GetSelectedItemForSelect1(mDOMNode,
                                                    getter_AddRefs(item));
     NS_ENSURE_SUCCESS(rv, rv);
 
     if (item)
-      return accService->GetAccessibleFor(item, aAccessible);
+      return GetAccService()->GetAccessibleFor(item, aAccessible);
     return NS_OK;
   }
 
   nsCOMPtr<nsIDOMNodeList> items;
   rv = sXFormsService->GetSelectedItemsForSelect(mDOMNode,
                                                  getter_AddRefs(items));
   NS_ENSURE_SUCCESS(rv, rv);
 
@@ -497,17 +492,17 @@ nsXFormsSelectableAccessible::RefSelecti
   items->GetLength(&length);
   if (aIndex < 0 || PRUint32(aIndex) >= length)
     return NS_OK;
 
   nsCOMPtr<nsIDOMNode> item;
   items->Item(aIndex, getter_AddRefs(item));
 
   nsCOMPtr<nsIAccessible> accessible;
-  return accService->GetAccessibleFor(item, getter_AddRefs(accessible));
+  return GetAccService()->GetAccessibleFor(item, getter_AddRefs(accessible));
 }
 
 NS_IMETHODIMP
 nsXFormsSelectableAccessible::IsChildSelected(PRInt32 aIndex,
                                               PRBool *aIsSelected)
 {
   NS_ENSURE_ARG_POINTER(aIsSelected);
   *aIsSelected = PR_FALSE;
--- a/accessible/src/xforms/nsXFormsFormControlsAccessible.cpp
+++ b/accessible/src/xforms/nsXFormsFormControlsAccessible.cpp
@@ -33,16 +33,18 @@
  * and other provisions required by the GPL or the LGPL. If you do not delete
  * the provisions above, a recipient may use your version of this file under
  * the terms of any one of the MPL, the GPL or the LGPL.
  *
  * ***** END LICENSE BLOCK ***** */
 
 #include "nsXFormsFormControlsAccessible.h"
 
+#include "nsTextEquivUtils.h"
+
 // nsXFormsLabelAccessible
 
 nsXFormsLabelAccessible::
   nsXFormsLabelAccessible(nsIDOMNode *aNode, nsIWeakReference *aShell):
   nsXFormsAccessible(aNode, aShell)
 {
 }
 
--- a/accessible/src/xul/nsXULColorPickerAccessible.cpp
+++ b/accessible/src/xul/nsXULColorPickerAccessible.cpp
@@ -33,17 +33,19 @@
  * and other provisions required by the GPL or the LGPL. If you do not delete
  * the provisions above, a recipient may use your version of this file under
  * the terms of any one of the MPL, the GPL or the LGPL.
  *
  * ***** END LICENSE BLOCK ***** */
 
 #include "nsXULColorPickerAccessible.h"
 
+#include "nsAccUtils.h"
 #include "nsAccTreeWalker.h"
+#include "nsCoreUtils.h"
 
 #include "nsIDOMElement.h"
 
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsXULColorPickerTileAccessible
 ////////////////////////////////////////////////////////////////////////////////
 
--- a/accessible/src/xul/nsXULComboboxAccessible.cpp
+++ b/accessible/src/xul/nsXULComboboxAccessible.cpp
@@ -35,19 +35,20 @@
  * and other provisions required by the GPL or the LGPL. If you do not delete
  * the provisions above, a recipient may use your version of this file under
  * the terms of any one of the MPL, the GPL or the LGPL.
  *
  * ***** END LICENSE BLOCK ***** */
 
 #include "nsXULComboboxAccessible.h"
 
+#include "nsAccessibilityService.h"
+
 #include "nsIDOMXULMenuListElement.h"
 #include "nsIDOMXULSelectCntrlItemEl.h"
-#include "nsServiceManagerUtils.h"
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsXULComboboxAccessible
 ////////////////////////////////////////////////////////////////////////////////
 
 nsXULComboboxAccessible::
   nsXULComboboxAccessible(nsIDOMNode* aDOMNode, nsIWeakReference* aShell) :
   nsAccessibleWrap(aDOMNode, aShell)
@@ -139,19 +140,18 @@ nsXULComboboxAccessible::GetDescription(
   nsCOMPtr<nsIDOMXULMenuListElement> menuListElm(do_QueryInterface(mDOMNode));
   if (!menuListElm)
     return NS_ERROR_FAILURE;
 
   nsCOMPtr<nsIDOMXULSelectControlItemElement> focusedOptionItem;
   menuListElm->GetSelectedItem(getter_AddRefs(focusedOptionItem));
   nsCOMPtr<nsIDOMNode> focusedOptionNode(do_QueryInterface(focusedOptionItem));
   if (focusedOptionNode) {
-    nsCOMPtr<nsIAccessible> focusedOption;
-    GetAccService()->GetAccessibleInWeakShell(focusedOptionNode, mWeakShell, 
-                                              getter_AddRefs(focusedOption));
+    nsRefPtr<nsAccessible> focusedOption =
+      GetAccService()->GetAccessibleInWeakShell(focusedOptionNode, mWeakShell);
     NS_ENSURE_TRUE(focusedOption, NS_ERROR_FAILURE);
 
     return focusedOption->GetDescription(aDescription);
   }
 
   return NS_OK;
 }
 
--- a/accessible/src/xul/nsXULFormControlAccessible.cpp
+++ b/accessible/src/xul/nsXULFormControlAccessible.cpp
@@ -32,34 +32,38 @@
  * use your version of this file under the terms of the MPL, indicate your
  * decision by deleting the provisions above and replace them with the notice
  * and other provisions required by the GPL or the LGPL. If you do not delete
  * the provisions above, a recipient may use your version of this file under
  * the terms of any one of the MPL, the GPL or the LGPL.
  *
  * ***** END LICENSE BLOCK ***** */
 
+#include "nsXULFormControlAccessible.h"
+
+#include "nsAccessibilityAtoms.h"
+#include "nsAccUtils.h"
+#include "nsAccTreeWalker.h"
+#include "nsCoreUtils.h"
+#include "nsRelUtils.h"
+
 // NOTE: alphabetically ordered
-#include "nsXULFormControlAccessible.h"
 #include "nsHTMLFormControlAccessible.h"
-#include "nsAccessibilityAtoms.h"
-#include "nsAccTreeWalker.h"
 #include "nsXULMenuAccessible.h"
 #include "nsIDOMHTMLInputElement.h"
 #include "nsIDOMNSEditableElement.h"
 #include "nsIDOMXULButtonElement.h"
 #include "nsIDOMXULCheckboxElement.h"
 #include "nsIDOMXULMenuListElement.h"
 #include "nsIDOMXULSelectCntrlItemEl.h"
 #include "nsIDOMXULTextboxElement.h"
 #include "nsIEditor.h"
 #include "nsIFrame.h"
 #include "nsINameSpaceManager.h"
 #include "nsITextControlFrame.h"
-#include "nsIPresShell.h"
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsXULButtonAccessible
 ////////////////////////////////////////////////////////////////////////////////
 
 nsXULButtonAccessible::
   nsXULButtonAccessible(nsIDOMNode* aNode, nsIWeakReference* aShell) :
   nsAccessibleWrap(aNode, aShell)
@@ -488,30 +492,31 @@ nsXULGroupboxAccessible::GetRelationByTy
 {
   nsresult rv = nsAccessibleWrap::GetRelationByType(aRelationType, aRelation);
   NS_ENSURE_SUCCESS(rv, rv);
 
   if (aRelationType == nsIAccessibleRelation::RELATION_LABELLED_BY) {
     // The label for xul:groupbox is generated from xul:label that is
     // inside the anonymous content of the xul:caption.
     // The xul:label has an accessible object but the xul:caption does not
-    nsCOMPtr<nsIAccessible> testLabelAccessible;
-    while (NextChild(testLabelAccessible)) {
-      if (nsAccUtils::Role(testLabelAccessible) == nsIAccessibleRole::ROLE_LABEL) {
+    PRInt32 childCount = GetChildCount();
+    for (PRInt32 childIdx = 0; childIdx < childCount; childIdx++) {
+      nsAccessible *childAcc = GetChildAt(childIdx);
+      if (nsAccUtils::Role(childAcc) == nsIAccessibleRole::ROLE_LABEL) {
         // Ensure that it's our label
         // XXX: we'll fail if group accessible expose more than one relation
         // targets.
         nsCOMPtr<nsIAccessible> testGroupboxAccessible =
-          nsRelUtils::GetRelatedAccessible(testLabelAccessible,
+          nsRelUtils::GetRelatedAccessible(childAcc,
                                            nsIAccessibleRelation::RELATION_LABEL_FOR);
 
         if (testGroupboxAccessible == this) {
           // The <label> points back to this groupbox
           return nsRelUtils::
-            AddTarget(aRelationType, aRelation, testLabelAccessible);
+            AddTarget(aRelationType, aRelation, childAcc);
         }
       }
     }
   }
 
   return NS_OK;
 }
 
--- a/accessible/src/xul/nsXULListboxAccessible.cpp
+++ b/accessible/src/xul/nsXULListboxAccessible.cpp
@@ -35,20 +35,22 @@
  * and other provisions required by the GPL or the LGPL. If you do not delete
  * the provisions above, a recipient may use your version of this file under
  * the terms of any one of the MPL, the GPL or the LGPL.
  *
  * ***** END LICENSE BLOCK ***** */
 
 #include "nsXULListboxAccessible.h"
 
+#include "nsAccessibilityService.h"
+#include "nsAccUtils.h"
+
 #include "nsIDOMXULPopupElement.h"
 #include "nsIDOMXULMultSelectCntrlEl.h"
 #include "nsIDOMXULSelectCntrlItemEl.h"
-#include "nsServiceManagerUtils.h"
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsXULColumnsAccessible
 ////////////////////////////////////////////////////////////////////////////////
 
 nsXULColumnsAccessible::
   nsXULColumnsAccessible(nsIDOMNode *aDOMNode, nsIWeakReference *aShell) :
   nsAccessibleWrap(aDOMNode, aShell)
@@ -357,19 +359,18 @@ nsXULListboxAccessible::GetCellAt(PRInt3
     do_QueryInterface(mDOMNode);
 
   nsCOMPtr<nsIDOMXULSelectControlItemElement> item;
   control->GetItemAtIndex(aRow, getter_AddRefs(item));
   NS_ENSURE_TRUE(item, NS_ERROR_INVALID_ARG);
 
   nsCOMPtr<nsIDOMNode> itemNode(do_QueryInterface(item));
 
-  nsCOMPtr<nsIAccessible> accessibleRow;
-  GetAccService()->GetAccessibleInWeakShell(itemNode, mWeakShell,
-                                            getter_AddRefs(accessibleRow));
+  nsRefPtr<nsAccessible> accessibleRow =
+    GetAccService()->GetAccessibleInWeakShell(itemNode, mWeakShell);
   NS_ENSURE_STATE(accessibleRow);
 
   nsresult rv = accessibleRow->GetChildAt(aColumn, aAccessibleCell);
   NS_ENSURE_SUCCESS(rv, NS_ERROR_INVALID_ARG);
 
   return NS_OK;
 }
 
@@ -624,29 +625,25 @@ nsXULListboxAccessible::GetSelectedCells
   PRUint32 selectedItemsCount = 0;
   rv = selectedItems->GetLength(&selectedItemsCount);
   NS_ENSURE_SUCCESS(rv, rv);
 
   PRUint32 index = 0;
   for (; index < selectedItemsCount; index++) {
     nsCOMPtr<nsIDOMNode> itemNode;
     selectedItems->Item(index, getter_AddRefs(itemNode));
-    nsCOMPtr<nsIAccessible> item;
-    GetAccService()->GetAccessibleInWeakShell(itemNode, mWeakShell,
-                                              getter_AddRefs(item));
+    nsRefPtr<nsAccessible> item =
+      GetAccService()->GetAccessibleInWeakShell(itemNode, mWeakShell);
 
     if (item) {
-      nsCOMPtr<nsIAccessible> cell, nextCell;
-      item->GetFirstChild(getter_AddRefs(cell));
-      while (cell) {
+      PRInt32 cellCount = item->GetChildCount();
+      for (PRInt32 cellIdx = 0; cellIdx < cellCount; cellIdx++) {
+        nsAccessible *cell = mChildren[cellIdx];
         if (nsAccUtils::Role(cell) == nsIAccessibleRole::ROLE_CELL)
-          selCells->AppendElement(cell, PR_FALSE);
-
-        cell->GetNextSibling(getter_AddRefs(nextCell));
-        nextCell.swap(cell);
+          selCells->AppendElement(static_cast<nsIAccessible*>(cell), PR_FALSE);
       }
     }
   }
 
   NS_ADDREF(*aCells = selCells);
   return NS_OK;
 }
 
@@ -872,17 +869,17 @@ nsXULListitemAccessible::
     if (NS_SUCCEEDED(res) && typeString.Equals(NS_LITERAL_STRING("checkbox")))
       mIsCheckbox = PR_TRUE;
   }
 }
 
 /** Inherit the ISupports impl from nsAccessible, we handle nsIAccessibleSelectable */
 NS_IMPL_ISUPPORTS_INHERITED0(nsXULListitemAccessible, nsAccessible)
 
-already_AddRefed<nsIAccessible>
+already_AddRefed<nsAccessible>
 nsXULListitemAccessible::GetListAccessible()
 {
   if (IsDefunct())
     return nsnull;
   
   nsCOMPtr<nsIDOMXULSelectControlItemElement> listItem =
     do_QueryInterface(mDOMNode);
   if (!listItem)
@@ -890,19 +887,17 @@ nsXULListitemAccessible::GetListAccessib
 
   nsCOMPtr<nsIDOMXULSelectControlElement> list;
   listItem->GetControl(getter_AddRefs(list));
 
   nsCOMPtr<nsIDOMNode> listNode(do_QueryInterface(list));
   if (!listNode)
     return nsnull;
 
-  nsIAccessible *listAcc = nsnull;
-  GetAccService()->GetAccessibleInWeakShell(listNode, mWeakShell, &listAcc);
-  return listAcc;
+  return GetAccService()->GetAccessibleInWeakShell(listNode, mWeakShell);
 }
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsXULListitemAccessible. nsIAccessible
 
 /**
   * If there is a Listcell as a child ( not anonymous ) use it, otherwise
   *   default to getting the name from GetXULName
@@ -923,17 +918,17 @@ nsXULListitemAccessible::GetNameInternal
     }
   }
   return GetXULName(aName);
 }
 
 nsresult
 nsXULListitemAccessible::GetRoleInternal(PRUint32 *aRole)
 {
-  nsCOMPtr<nsIAccessible> listAcc = GetListAccessible();
+  nsRefPtr<nsAccessible> listAcc = GetListAccessible();
   NS_ENSURE_STATE(listAcc);
 
   if (nsAccUtils::Role(listAcc) == nsIAccessibleRole::ROLE_TABLE) {
     *aRole = nsIAccessibleRole::ROLE_ROW;
     return NS_OK;
   }
 
   if (mIsCheckbox)
--- a/accessible/src/xul/nsXULListboxAccessible.h
+++ b/accessible/src/xul/nsXULListboxAccessible.h
@@ -129,17 +129,20 @@ public:
   virtual nsresult GetNameInternal(nsAString& aName);
   virtual nsresult GetRoleInternal(PRUint32 *aRole);
   virtual nsresult GetStateInternal(PRUint32 *aState, PRUint32 *aExtraState);
   virtual void GetPositionAndSizeInternal(PRInt32 *aPosInSet,
                                           PRInt32 *aSetSize);
   virtual PRBool GetAllowsAnonChildAccessibles();
 
 protected:
-  already_AddRefed<nsIAccessible> GetListAccessible();
+  /**
+   * Return listbox accessible for the listitem.