--- a/accessible/public/nsIAccessibilityService.h
+++ b/accessible/public/nsIAccessibilityService.h
@@ -39,17 +39,20 @@
  * ***** END LICENSE BLOCK ***** */
 
 #ifndef _nsIAccessibilityService_h_
 #define _nsIAccessibilityService_h_
 
 #include "nsIAccessibleRetrieval.h"
 #include "nsIAccessibleEvent.h"
 
+#include "nsAutoPtr.h"
+
 class nsAccessible;
+class nsINode;
 class nsIContent;
 class nsIDocument;
 class nsIFrame;
 class nsIPresShell;
 class nsObjectFrame;
 
 // 10ff6dca-b219-4b64-9a4c-67a62b86edce
 #define NS_IACCESSIBILITYSERVICE_IID \
@@ -63,75 +66,66 @@ public:
 
   /**
    * Return an accessible object for a DOM node in the given pres shell.
    *
    * @param  aNode      [in] the DOM node to get an accessible for
    * @param  aPresShell [in] the presentation shell which contains layout info
    *                         for the DOM node
    */
-  virtual nsAccessible* GetAccessibleInShell(nsIDOMNode *aNode,
-                                             nsIPresShell *aPresShell) = 0;
+  virtual nsAccessible* GetAccessibleInShell(nsINode* aNode,
+                                             nsIPresShell* aPresShell) = 0;
 
   /**
    * Creates accessible for the given DOM node or frame.
    */
-  virtual nsresult CreateOuterDocAccessible(nsIDOMNode *aNode,
-                                            nsIAccessible **aAccessible) = 0;
-
-  virtual nsresult CreateHTML4ButtonAccessible(nsIFrame *aFrame,
-                                               nsIAccessible **aAccessible) = 0;
-  virtual nsresult CreateHyperTextAccessible(nsIFrame *aFrame,
-                                             nsIAccessible **aAccessible) = 0;
-  virtual nsresult CreateHTMLBRAccessible(nsIFrame *aFrame,
-                                          nsIAccessible **aAccessible) = 0;
-  virtual nsresult CreateHTMLButtonAccessible(nsIFrame *aFrame,
-                                              nsIAccessible **aAccessible) = 0;
-  virtual nsresult CreateHTMLLIAccessible(nsIFrame *aFrame,
-                                          nsIFrame *aBulletFrame,
-                                          const nsAString& aBulletText,
-                                          nsIAccessible **aAccessible) = 0;
-  virtual nsresult CreateHTMLCheckboxAccessible(nsIFrame *aFrame,
-                                                nsIAccessible **aAccessible) = 0;
-  virtual nsresult CreateHTMLComboboxAccessible(nsIDOMNode *aNode,
-                                                nsIWeakReference *aPresShell,
-                                                nsIAccessible **aAccessible) = 0;
-  virtual nsresult CreateHTMLGenericAccessible(nsIFrame *aFrame,
-                                               nsIAccessible **aAccessible) = 0;
-  virtual nsresult CreateHTMLGroupboxAccessible(nsIFrame *aFrame,
-                                                nsIAccessible **aAccessible) = 0;
-  virtual nsresult CreateHTMLHRAccessible(nsIFrame *aFrame,
-                                          nsIAccessible **aAccessible) = 0;
-  virtual nsresult CreateHTMLImageAccessible(nsIFrame *aFrame,
-                                             nsIAccessible **aAccessible) = 0;
-  virtual nsresult CreateHTMLLabelAccessible(nsIFrame *aFrame,
-                                             nsIAccessible **aAccessible) = 0;
-  virtual nsresult CreateHTMLListboxAccessible(nsIDOMNode *aNode,
-                                               nsIWeakReference *aPresShell,
-                                               nsIAccessible **aAccessible) = 0;
-  virtual nsresult CreateHTMLMediaAccessible(nsIFrame *aFrame,
-                                             nsIAccessible **aAccessible) = 0;
-  virtual nsresult CreateHTMLObjectFrameAccessible(nsObjectFrame *aFrame,
-                                                   nsIAccessible **aAccessible) = 0;
-  virtual nsresult CreateHTMLRadioButtonAccessible(nsIFrame *aFrame,
-                                                   nsIAccessible **aAccessible) = 0;
-  virtual nsresult CreateHTMLSelectOptionAccessible(nsIDOMNode *aNode,
-                                                    nsIAccessible *aAccParent,
-                                                    nsIWeakReference *aPresShell,
-                                                    nsIAccessible **aAccessible) = 0;
-  virtual nsresult CreateHTMLTableAccessible(nsIFrame *aFrame,
-                                             nsIAccessible **aAccessible) = 0;
-  virtual nsresult CreateHTMLTableCellAccessible(nsIFrame *aFrame,
-                                                 nsIAccessible **aAccessible) = 0;
-  virtual nsresult CreateHTMLTextAccessible(nsIFrame *aFrame,
-                                            nsIAccessible **aAccessible) = 0;
-  virtual nsresult CreateHTMLTextFieldAccessible(nsIFrame *aFrame,
-                                                 nsIAccessible **aAccessible) = 0;
-  virtual nsresult CreateHTMLCaptionAccessible(nsIFrame *aFrame,
-                                               nsIAccessible **aAccessible) = 0;
+  virtual already_AddRefed<nsAccessible>
+    CreateHTMLBRAccessible(nsIContent* aContent, nsIPresShell* aPresShell) = 0;
+  virtual already_AddRefed<nsAccessible>
+    CreateHTML4ButtonAccessible(nsIContent* aContent, nsIPresShell* aPresShell) = 0;
+  virtual already_AddRefed<nsAccessible>
+    CreateHTMLButtonAccessible(nsIContent* aContent, nsIPresShell* aPresShell) = 0;
+  virtual already_AddRefed<nsAccessible>
+    CreateHTMLCaptionAccessible(nsIContent* aContent, nsIPresShell* aPresShell) = 0;
+  virtual already_AddRefed<nsAccessible>
+    CreateHTMLCheckboxAccessible(nsIContent* aContent, nsIPresShell* aPresShell) = 0;
+  virtual already_AddRefed<nsAccessible>
+    CreateHTMLComboboxAccessible(nsIContent* aContent, nsIPresShell* aPresShell) = 0;
+  virtual already_AddRefed<nsAccessible>
+    CreateHTMLGroupboxAccessible(nsIContent* aContent, nsIPresShell* aPresShell) = 0;
+  virtual already_AddRefed<nsAccessible>
+    CreateHTMLHRAccessible(nsIContent* aContent, nsIPresShell* aPresShell) = 0;
+  virtual already_AddRefed<nsAccessible>
+    CreateHTMLImageAccessible(nsIContent* aContent, nsIPresShell* aPresShell) = 0;
+  virtual already_AddRefed<nsAccessible>
+    CreateHTMLLabelAccessible(nsIContent* aContent, nsIPresShell* aPresShell) = 0;
+  virtual already_AddRefed<nsAccessible>
+    CreateHTMLLIAccessible(nsIContent* aContent, nsIPresShell* aPresShell,
+                           const nsAString& aBulletText) = 0;
+  virtual already_AddRefed<nsAccessible>
+    CreateHTMLListboxAccessible(nsIContent* aContent, nsIPresShell* aPresShell) = 0;
+  virtual already_AddRefed<nsAccessible>
+    CreateHTMLMediaAccessible(nsIContent* aContent, nsIPresShell* aPresShell) = 0;
+  virtual already_AddRefed<nsAccessible>
+    CreateHTMLObjectFrameAccessible(nsObjectFrame* aFrame, nsIContent* aContent,
+                                    nsIPresShell* aPresShell) = 0;
+  virtual already_AddRefed<nsAccessible>
+    CreateHTMLRadioButtonAccessible(nsIContent* aContent, nsIPresShell* aPresShell) = 0;
+  virtual already_AddRefed<nsAccessible>
+    CreateHTMLTableAccessible(nsIContent* aContent, nsIPresShell* aPresShell) = 0;
+  virtual already_AddRefed<nsAccessible>
+    CreateHTMLTableCellAccessible(nsIContent* aContent, nsIPresShell* aPresShell) = 0;
+  virtual already_AddRefed<nsAccessible>
+    CreateHTMLTextAccessible(nsIContent* aContent, nsIPresShell* aPresShell) = 0;
+  virtual already_AddRefed<nsAccessible>
+    CreateHTMLTextFieldAccessible(nsIContent* aContent, nsIPresShell* aPresShell) = 0;
+  virtual already_AddRefed<nsAccessible>
+    CreateHyperTextAccessible(nsIContent* aContent, nsIPresShell* aPresShell) = 0;
+  virtual already_AddRefed<nsAccessible>
+    CreateOuterDocAccessible(nsIContent* aContent, nsIPresShell* aPresShell) = 0;
 
   /**
    * Adds/remove ATK root accessible for gtk+ native window to/from children
    * of the application accessible.
    */
   virtual nsAccessible* AddNativeRootAccessible(void* aAtkAccessible) = 0;
   virtual void RemoveNativeRootAccessible(nsAccessible* aRootAccessible) = 0;
 

--- a/accessible/src/base/nsAccessibilityService.cpp
+++ b/accessible/src/base/nsAccessibilityService.cpp
@@ -181,609 +181,289 @@ nsresult
 nsAccessibilityService::FireAccessibleEvent(PRUint32 aEvent,
                                             nsIAccessible *aTarget)
 {
   nsRefPtr<nsAccessible> accessible(do_QueryObject(aTarget));
   nsEventShell::FireEvent(aEvent, accessible);
   return NS_OK;
 }
 
-// nsAccessibilityService private
-nsresult
-nsAccessibilityService::GetInfo(nsIFrame *aFrame, nsIWeakReference **aShell,
-                                nsIContent **aContent)
-{
-  NS_ASSERTION(aFrame,"Error -- 1st argument (aFrame) is null!!");
-  if (!aFrame) {
-    return NS_ERROR_FAILURE;
-  }
-  nsIContent* content = aFrame->GetContent();
-  if (!content)
-    return NS_ERROR_FAILURE;
-
-  nsIDocument* document = content->GetOwnerDoc();
-  if (!document)
-    return NS_ERROR_FAILURE;
-
-  NS_ASSERTION(document->GetShell(),
-               "Error: aFrame's document doesn't have a PresShell!");
-
-  // do_GetWR only works into a |nsCOMPtr| :-(
-  nsCOMPtr<nsIWeakReference> weakShell =
-    do_GetWeakReference(document->GetShell());
-
-  weakShell.forget(aShell);
-  NS_IF_ADDREF(*aContent = content);
-
-  return NS_OK;
-}
-
 ////////////////////////////////////////////////////////////////////////////////
 // nsIAccessibilityService
 
-nsresult
-nsAccessibilityService::CreateOuterDocAccessible(nsIDOMNode* aDOMNode, 
-                                                 nsIAccessible **aOuterDocAccessible)
+already_AddRefed<nsAccessible>
+nsAccessibilityService::CreateOuterDocAccessible(nsIContent* aContent,
+                                                 nsIPresShell* aPresShell)
 {
-  NS_ENSURE_ARG_POINTER(aDOMNode);
-  
-  *aOuterDocAccessible = nsnull;
-
-  nsCOMPtr<nsIContent> content(do_QueryInterface(aDOMNode));
-  nsCOMPtr<nsIWeakReference> outerWeakShell =
-    nsCoreUtils::GetWeakShellFor(content);
-  NS_ENSURE_TRUE(outerWeakShell, NS_ERROR_FAILURE);
-
-  nsOuterDocAccessible *outerDocAccessible =
-    new nsOuterDocAccessible(content, outerWeakShell);
-  NS_ENSURE_TRUE(outerDocAccessible, NS_ERROR_FAILURE);
-
-  NS_ADDREF(*aOuterDocAccessible = outerDocAccessible);
-
-  return NS_OK;
+  nsCOMPtr<nsIWeakReference> weakShell(do_GetWeakReference(aPresShell));
+  nsAccessible* accessible = new nsOuterDocAccessible(aContent, weakShell);
+  NS_IF_ADDREF(accessible);
+  return accessible;
 }
 
- /**
-   * HTML widget creation
-   */
-nsresult
-nsAccessibilityService::CreateHTML4ButtonAccessible(nsIFrame *aFrame,
-                                                    nsIAccessible **aAccessible)
+already_AddRefed<nsAccessible>
+nsAccessibilityService::CreateHTML4ButtonAccessible(nsIContent* aContent,
+                                                    nsIPresShell* aPresShell)
 {
-  nsCOMPtr<nsIContent> content;
-  nsCOMPtr<nsIWeakReference> weakShell;
-  nsresult rv = GetInfo(aFrame, getter_AddRefs(weakShell),
-                        getter_AddRefs(content));
-  if (NS_FAILED(rv))
-    return rv;
-
-  *aAccessible = new nsHTML4ButtonAccessible(content, weakShell);
-  if (!*aAccessible)
-    return NS_ERROR_OUT_OF_MEMORY;
-
-  NS_ADDREF(*aAccessible);
-  return NS_OK;
+  nsCOMPtr<nsIWeakReference> weakShell(do_GetWeakReference(aPresShell));
+  nsAccessible* accessible = new nsHTML4ButtonAccessible(aContent, weakShell);
+  NS_IF_ADDREF(accessible);
+  return accessible;
 }
 
-nsresult
-nsAccessibilityService::CreateHTMLButtonAccessible(nsIFrame *aFrame,
-                                                   nsIAccessible **aAccessible)
+already_AddRefed<nsAccessible>
+nsAccessibilityService::CreateHTMLButtonAccessible(nsIContent* aContent,
+                                                   nsIPresShell* aPresShell)
 {
-  nsCOMPtr<nsIContent> content;
-  nsCOMPtr<nsIWeakReference> weakShell;
-  nsresult rv = GetInfo(aFrame, getter_AddRefs(weakShell),
-                        getter_AddRefs(content));
-  if (NS_FAILED(rv))
-    return rv;
-
-  *aAccessible = new nsHTMLButtonAccessible(content, weakShell);
-  if (!*aAccessible)
-    return NS_ERROR_OUT_OF_MEMORY;
-
-  NS_ADDREF(*aAccessible);
-  return NS_OK;
+  nsCOMPtr<nsIWeakReference> weakShell(do_GetWeakReference(aPresShell));
+  nsAccessible* accessible = new nsHTMLButtonAccessible(aContent, weakShell);
+  NS_IF_ADDREF(accessible);
+  return accessible;
 }
 
-// nsAccessibilityService private
 already_AddRefed<nsAccessible>
-nsAccessibilityService::CreateHTMLAccessibleByMarkup(nsIFrame *aFrame,
-                                                     nsIWeakReference *aWeakShell,
-                                                     nsINode *aNode)
+nsAccessibilityService::CreateHTMLLIAccessible(nsIContent* aContent,
+                                               nsIPresShell* aPresShell,
+                                               const nsAString& aBulletText)
 {
-  // This method assumes we're in an HTML namespace.
-  nsRefPtr<nsAccessible> accessible;
-
-  nsCOMPtr<nsIContent> content(do_QueryInterface(aNode));
-  nsIAtom *tag = content->Tag();
-  if (tag == nsAccessibilityAtoms::legend) {
-    accessible = new nsHTMLLegendAccessible(content, aWeakShell);
-  }
-  else if (tag == nsAccessibilityAtoms::option) {
-    accessible = new nsHTMLSelectOptionAccessible(content, aWeakShell);
-  }
-  else if (tag == nsAccessibilityAtoms::optgroup) {
-    accessible = new nsHTMLSelectOptGroupAccessible(content, aWeakShell);
-  }
-  else if (tag == nsAccessibilityAtoms::ul || tag == nsAccessibilityAtoms::ol ||
-           tag == nsAccessibilityAtoms::dl) {
-    accessible = new nsHTMLListAccessible(content, aWeakShell);
-  }
-  else if (tag == nsAccessibilityAtoms::a) {
-
-    // Only some roles truly enjoy life as nsHTMLLinkAccessibles, for details
-    // see closed bug 494807.
-    nsRoleMapEntry *roleMapEntry = nsAccUtils::GetRoleMapEntry(aNode);
-    if (roleMapEntry && roleMapEntry->role != nsIAccessibleRole::ROLE_NOTHING
-        && roleMapEntry->role != nsIAccessibleRole::ROLE_LINK) {
+  nsCOMPtr<nsIWeakReference> weakShell(do_GetWeakReference(aPresShell));
+  nsAccessible* accessible = new nsHTMLLIAccessible(aContent, weakShell,
+                                                    aBulletText);
+  NS_IF_ADDREF(accessible);
+  return accessible;
+}
 
-      accessible = new nsHyperTextAccessibleWrap(content, aWeakShell);
-    } else {
-      accessible = new nsHTMLLinkAccessible(content, aWeakShell);
-    }
-  }
-  else if (tag == nsAccessibilityAtoms::dt ||
-           (tag == nsAccessibilityAtoms::li && 
-            aFrame->GetType() != nsAccessibilityAtoms::blockFrame)) {
-    // Normally for li, it is created by the list item frame (in nsBlockFrame)
-    // which knows about the bullet frame; however, in this case the list item
-    // must have been styled using display: foo
-    accessible = new nsHTMLLIAccessible(content, aWeakShell, EmptyString());
-  }
-  else if (tag == nsAccessibilityAtoms::abbr ||
-           tag == nsAccessibilityAtoms::acronym ||
-           tag == nsAccessibilityAtoms::blockquote ||
-           tag == nsAccessibilityAtoms::dd ||
-           tag == nsAccessibilityAtoms::form ||
-           tag == nsAccessibilityAtoms::h1 ||
-           tag == nsAccessibilityAtoms::h2 ||
-           tag == nsAccessibilityAtoms::h3 ||
-           tag == nsAccessibilityAtoms::h4 ||
-           tag == nsAccessibilityAtoms::h5 ||
-           tag == nsAccessibilityAtoms::h6 ||
-           tag == nsAccessibilityAtoms::q) {
-
-    accessible = new nsHyperTextAccessibleWrap(content, aWeakShell);
-  }
-  else if (tag == nsAccessibilityAtoms::tr) {
-    accessible = new nsEnumRoleAccessible(content, aWeakShell,
-                                          nsIAccessibleRole::ROLE_ROW);
-  }
-  else if (nsCoreUtils::IsHTMLTableHeader(content)) {
-    accessible = new nsHTMLTableHeaderCellAccessibleWrap(content, aWeakShell);
-  }
-
-  return accessible.forget();
+already_AddRefed<nsAccessible>
+nsAccessibilityService::CreateHyperTextAccessible(nsIContent* aContent,
+                                                  nsIPresShell* aPresShell)
+{
+  nsCOMPtr<nsIWeakReference> weakShell(do_GetWeakReference(aPresShell));
+  nsAccessible* accessible = new nsHyperTextAccessibleWrap(aContent, weakShell);
+  NS_IF_ADDREF(accessible);
+  return accessible;
 }
 
-nsresult
-nsAccessibilityService::CreateHTMLLIAccessible(nsIFrame *aFrame, 
-                                               nsIFrame *aBulletFrame,
-                                               const nsAString& aBulletText,
-                                               nsIAccessible **aAccessible)
+already_AddRefed<nsAccessible>
+nsAccessibilityService::CreateHTMLCheckboxAccessible(nsIContent* aContent,
+                                                     nsIPresShell* aPresShell)
 {
-  nsCOMPtr<nsIContent> content;
-  nsCOMPtr<nsIWeakReference> weakShell;
-  nsresult rv = GetInfo(aFrame, getter_AddRefs(weakShell),
-                        getter_AddRefs(content));
-  if (NS_FAILED(rv))
-    return rv;
-
-  *aAccessible = new nsHTMLLIAccessible(content, weakShell, aBulletText);
-  if (!*aAccessible)
-    return NS_ERROR_OUT_OF_MEMORY;
-
-  NS_ADDREF(*aAccessible);
-  return NS_OK;
-}
-
-nsresult
-nsAccessibilityService::CreateHyperTextAccessible(nsIFrame *aFrame,
-                                                  nsIAccessible **aAccessible)
-{
-  nsCOMPtr<nsIContent> content;
-  nsCOMPtr<nsIWeakReference> weakShell;
-  nsresult rv = GetInfo(aFrame, getter_AddRefs(weakShell),
-                        getter_AddRefs(content));
-  if (NS_FAILED(rv))
-    return rv;
-
-  *aAccessible = new nsHyperTextAccessibleWrap(content, weakShell);
-  if (!*aAccessible)
-    return NS_ERROR_OUT_OF_MEMORY;
-
-  NS_ADDREF(*aAccessible);
-  return NS_OK;
+  nsCOMPtr<nsIWeakReference> weakShell(do_GetWeakReference(aPresShell));
+  nsAccessible* accessible = new nsHTMLCheckboxAccessible(aContent, weakShell);
+  NS_IF_ADDREF(accessible);
+  return accessible;
 }
 
-nsresult
-nsAccessibilityService::CreateHTMLCheckboxAccessible(nsIFrame *aFrame,
-                                                     nsIAccessible **aAccessible)
+already_AddRefed<nsAccessible>
+nsAccessibilityService::CreateHTMLComboboxAccessible(nsIContent* aContent,
+                                                     nsIPresShell* aPresShell)
 {
-  nsCOMPtr<nsIContent> content;
-  nsCOMPtr<nsIWeakReference> weakShell;
-  nsresult rv = GetInfo(aFrame, getter_AddRefs(weakShell),
-                        getter_AddRefs(content));
-  if (NS_FAILED(rv))
-    return rv;
-
-  *aAccessible = new nsHTMLCheckboxAccessible(content, weakShell);
-  if (!*aAccessible)
-    return NS_ERROR_OUT_OF_MEMORY;
-
-  NS_ADDREF(*aAccessible);
-  return NS_OK;
+  nsCOMPtr<nsIWeakReference> weakShell(do_GetWeakReference(aPresShell));
+  nsAccessible* accessible = new nsHTMLComboboxAccessible(aContent, weakShell);
+  NS_IF_ADDREF(accessible);
+  return accessible;
 }
 
-nsresult
-nsAccessibilityService::CreateHTMLComboboxAccessible(nsIDOMNode *aDOMNode,
-                                                     nsIWeakReference *aPresShell,
-                                                     nsIAccessible **aAccessible)
+already_AddRefed<nsAccessible>
+nsAccessibilityService::CreateHTMLImageAccessible(nsIContent* aContent,
+                                                  nsIPresShell* aPresShell)
 {
-  nsCOMPtr<nsIContent> content(do_QueryInterface(aDOMNode));
-  *aAccessible = new nsHTMLComboboxAccessible(content, aPresShell);
-  if (!*aAccessible)
-    return NS_ERROR_OUT_OF_MEMORY;
-
-  NS_ADDREF(*aAccessible);
-  return NS_OK;
-}
-
-nsresult
-nsAccessibilityService::CreateHTMLImageAccessible(nsIFrame *aFrame,
-                                                  nsIAccessible **aAccessible)
-{
-  NS_ENSURE_ARG_POINTER(aAccessible);
-  *aAccessible = nsnull;
-
-  nsCOMPtr<nsIContent> content;
-  nsCOMPtr<nsIWeakReference> weakShell;
-  nsresult rv = GetInfo(aFrame, getter_AddRefs(weakShell),
-                        getter_AddRefs(content));
-  if (NS_FAILED(rv))
-    return rv;
-
   nsCOMPtr<nsIHTMLDocument> htmlDoc =
-    do_QueryInterface(content->GetCurrentDoc());
+    do_QueryInterface(aContent->GetCurrentDoc());
 
   nsCOMPtr<nsIDOMHTMLMapElement> mapElm;
   if (htmlDoc) {
     nsAutoString mapElmName;
-    content->GetAttr(kNameSpaceID_None, nsAccessibilityAtoms::usemap,
-                     mapElmName);
+    aContent->GetAttr(kNameSpaceID_None, nsAccessibilityAtoms::usemap,
+                      mapElmName);
 
     if (!mapElmName.IsEmpty()) {
       if (mapElmName.CharAt(0) == '#')
         mapElmName.Cut(0,1);
       mapElm = htmlDoc->GetImageMap(mapElmName);
     }
   }
 
-  if (mapElm)
-    *aAccessible = new nsHTMLImageMapAccessible(content, weakShell, mapElm);
-  else
-    *aAccessible = new nsHTMLImageAccessibleWrap(content, weakShell);
-
-  if (!*aAccessible)
-    return NS_ERROR_OUT_OF_MEMORY;
-
-  NS_ADDREF(*aAccessible);
-  return NS_OK;
-}
-
-nsresult
-nsAccessibilityService::CreateHTMLGenericAccessible(nsIFrame *aFrame, nsIAccessible **aAccessible)
-{
-  return CreateHyperTextAccessible(aFrame, aAccessible);
+  nsCOMPtr<nsIWeakReference> weakShell(do_GetWeakReference(aPresShell));
+  nsAccessible* accessible = mapElm ?
+    new nsHTMLImageMapAccessible(aContent, weakShell, mapElm) :
+    new nsHTMLImageAccessibleWrap(aContent, weakShell);
+  NS_IF_ADDREF(accessible);
+  return accessible;
 }
 
-nsresult
-nsAccessibilityService::CreateHTMLGroupboxAccessible(nsIFrame *aFrame,
-                                                     nsIAccessible **aAccessible)
+already_AddRefed<nsAccessible>
+nsAccessibilityService::CreateHTMLGroupboxAccessible(nsIContent* aContent,
+                                                     nsIPresShell* aPresShell)
 {
-  nsCOMPtr<nsIContent> content;
-  nsCOMPtr<nsIWeakReference> weakShell;
-  nsresult rv = GetInfo(aFrame, getter_AddRefs(weakShell),
-                        getter_AddRefs(content));
-  if (NS_FAILED(rv))
-    return rv;
+  nsCOMPtr<nsIWeakReference> weakShell(do_GetWeakReference(aPresShell));
+  nsAccessible* accessible = new nsHTMLGroupboxAccessible(aContent, weakShell);
+  NS_IF_ADDREF(accessible);
+  return accessible;
+}
 
-  *aAccessible = new nsHTMLGroupboxAccessible(content, weakShell);
-  if (!*aAccessible)
-    return NS_ERROR_OUT_OF_MEMORY;
-
-  NS_ADDREF(*aAccessible);
-  return NS_OK;
+already_AddRefed<nsAccessible>
+nsAccessibilityService::CreateHTMLListboxAccessible(nsIContent* aContent,
+                                                    nsIPresShell* aPresShell)
+{
+  nsCOMPtr<nsIWeakReference> weakShell(do_GetWeakReference(aPresShell));
+  nsAccessible* accessible = new nsHTMLSelectListAccessible(aContent, weakShell);
+  NS_IF_ADDREF(accessible);
+  return accessible;
 }
 
-nsresult
-nsAccessibilityService::CreateHTMLListboxAccessible(nsIDOMNode* aDOMNode,
-                                                    nsIWeakReference *aPresShell,
-                                                    nsIAccessible **aAccessible)
+already_AddRefed<nsAccessible>
+nsAccessibilityService::CreateHTMLMediaAccessible(nsIContent* aContent,
+                                                  nsIPresShell* aPresShell)
 {
-  nsCOMPtr<nsIContent> content(do_QueryInterface(aDOMNode));
-  *aAccessible = new nsHTMLSelectListAccessible(content, aPresShell);
-  if (!*aAccessible)
-    return NS_ERROR_OUT_OF_MEMORY;
-
-  NS_ADDREF(*aAccessible);
-  return NS_OK;
+  nsCOMPtr<nsIWeakReference> weakShell(do_GetWeakReference(aPresShell));
+  nsAccessible* accessible = new nsEnumRoleAccessible(aContent, weakShell,
+                                                      nsIAccessibleRole::ROLE_GROUPING);
+  NS_IF_ADDREF(accessible);
+  return accessible;
 }
 
-nsresult
-nsAccessibilityService::CreateHTMLMediaAccessible(nsIFrame *aFrame,
-                                                  nsIAccessible **aAccessible)
+already_AddRefed<nsAccessible>
+nsAccessibilityService::CreateHTMLObjectFrameAccessible(nsObjectFrame* aFrame,
+                                                        nsIContent* aContent,
+                                                        nsIPresShell* aPresShell)
 {
-  NS_ENSURE_ARG_POINTER(aAccessible);
-  *aAccessible = nsnull;
-
-  nsCOMPtr<nsIContent> content;
-  nsCOMPtr<nsIWeakReference> weakShell;
-  nsresult rv = GetInfo(aFrame, getter_AddRefs(weakShell),
-                        getter_AddRefs(content));
-  NS_ENSURE_SUCCESS(rv, rv);
-
-  *aAccessible = new nsEnumRoleAccessible(content, weakShell,
-                                          nsIAccessibleRole::ROLE_GROUPING);
-  NS_ENSURE_TRUE(*aAccessible, NS_ERROR_OUT_OF_MEMORY);
-
-  NS_ADDREF(*aAccessible);
-  return NS_OK;
-}
+  // We can have several cases here:
+  // 1) a text or html embedded document where the contentDocument variable in
+  //    the object element holds the content;
+  // 2) web content that uses a plugin, which means we will have to go to
+  //    the plugin to get the accessible content;
+  // 3) an image or imagemap, where the image frame points back to the object
+  //    element DOMNode.
 
-/**
-  * We can have several cases here. 
-  *  1) a text or html embedded document where the contentDocument
-  *     variable in the object element holds the content
-  *  2) web content that uses a plugin, which means we will
-  *     have to go to the plugin to get the accessible content
-  *  3) An image or imagemap, where the image frame points back to 
-  *     the object element DOMNode
-  */
-nsresult
-nsAccessibilityService::CreateHTMLObjectFrameAccessible(nsObjectFrame *aFrame,
-                                                        nsIAccessible **aAccessible)
-{
-  NS_ENSURE_ARG_POINTER(aAccessible);
-  *aAccessible = nsnull;
+  if (aFrame->GetRect().IsEmpty())
+    return nsnull;
 
-  nsCOMPtr<nsIContent> content;
-  nsCOMPtr<nsIWeakReference> weakShell;
-  GetInfo(aFrame, getter_AddRefs(weakShell), getter_AddRefs(content));
+  nsCOMPtr<nsIWeakReference> weakShell(do_GetWeakReference(aPresShell));
 
-  if (aFrame->GetRect().IsEmpty()) {
-    return NS_ERROR_FAILURE;
-  }
   // 1) for object elements containing either HTML or TXT documents
-  nsCOMPtr<nsIDOMHTMLObjectElement> obj(do_QueryInterface(content));
+  nsCOMPtr<nsIDOMHTMLObjectElement> obj(do_QueryInterface(aContent));
   if (obj) {
     nsCOMPtr<nsIDOMDocument> domDoc;
     obj->GetContentDocument(getter_AddRefs(domDoc));
-    if (domDoc) {
-      nsCOMPtr<nsIDOMNode> DOMNode(do_QueryInterface(content));
-      return CreateOuterDocAccessible(DOMNode, aAccessible);
-    }
+    if (domDoc)
+      return CreateOuterDocAccessible(aContent, aPresShell);
   }
 
 #ifdef XP_WIN
   // 2) for plugins
   nsCOMPtr<nsIPluginInstance> pluginInstance ;
   aFrame->GetPluginInstance(*getter_AddRefs(pluginInstance));
   if (pluginInstance) {
     // Note: pluginPort will be null if windowless.
     HWND pluginPort = nsnull;
     aFrame->GetPluginPort(&pluginPort);
 
-    *aAccessible =
-      new nsHTMLWin32ObjectOwnerAccessible(content, weakShell, pluginPort);
-    NS_ENSURE_TRUE(*aAccessible, NS_ERROR_OUT_OF_MEMORY);
-
-    NS_ADDREF(*aAccessible);
-    return NS_OK;
+    nsAccessible* accessible = new nsHTMLWin32ObjectOwnerAccessible(aContent,
+                                                                    weakShell,
+                                                                    pluginPort);
+    NS_IF_ADDREF(accessible);
+    return accessible;
   }
 #endif
 
   // 3) for images and imagemaps, or anything else with a child frame
   // we have the object frame, get the image frame
-  nsIFrame *frame = aFrame->GetFirstChild(nsnull);
-  if (frame)
-    return frame->GetAccessible(aAccessible);
-
-  return NS_OK;
+  nsIFrame* frame = aFrame->GetFirstChild(nsnull);
+  return frame ? frame->CreateAccessible() : nsnull;
 }
 
-nsresult
-nsAccessibilityService::CreateHTMLRadioButtonAccessible(nsIFrame *aFrame,
-                                                        nsIAccessible **aAccessible)
+already_AddRefed<nsAccessible>
+nsAccessibilityService::CreateHTMLRadioButtonAccessible(nsIContent* aContent,
+                                                        nsIPresShell* aPresShell)
 {
-  nsCOMPtr<nsIContent> content;
-  nsCOMPtr<nsIWeakReference> weakShell;
-  nsresult rv = GetInfo(aFrame, getter_AddRefs(weakShell),
-                        getter_AddRefs(content));
-  if (NS_FAILED(rv))
-    return rv;
-
-  *aAccessible = new nsHTMLRadioButtonAccessible(content, weakShell);
-  if (!*aAccessible)
-    return NS_ERROR_OUT_OF_MEMORY;
-
-  NS_ADDREF(*aAccessible);
-  return NS_OK;
+  nsCOMPtr<nsIWeakReference> weakShell(do_GetWeakReference(aPresShell));
+  nsAccessible* accessible = new nsHTMLRadioButtonAccessible(aContent, weakShell);
+  NS_IF_ADDREF(accessible);
+  return accessible;
 }
 
-nsresult
-nsAccessibilityService::CreateHTMLSelectOptionAccessible(nsIDOMNode *aDOMNode,
-                                                         nsIAccessible *aParent, 
-                                                         nsIWeakReference *aPresShell,
-                                                         nsIAccessible **aAccessible)
+already_AddRefed<nsAccessible>
+nsAccessibilityService::CreateHTMLTableAccessible(nsIContent* aContent,
+                                                  nsIPresShell* aPresShell)
 {
-  nsCOMPtr<nsIContent> content(do_QueryInterface(aDOMNode));
-  *aAccessible = new nsHTMLSelectOptionAccessible(content, aPresShell);
-  if (!*aAccessible)
-    return NS_ERROR_OUT_OF_MEMORY;
-
-  NS_ADDREF(*aAccessible);
-  return NS_OK;
+  nsCOMPtr<nsIWeakReference> weakShell(do_GetWeakReference(aPresShell));
+  nsAccessible* accessible = new nsHTMLTableAccessibleWrap(aContent, weakShell);
+  NS_IF_ADDREF(accessible);
+  return accessible;
 }
 
-nsresult
-nsAccessibilityService::CreateHTMLTableAccessible(nsIFrame *aFrame,
-                                                  nsIAccessible **aAccessible)
+already_AddRefed<nsAccessible>
+nsAccessibilityService::CreateHTMLTableCellAccessible(nsIContent* aContent,
+                                                      nsIPresShell* aPresShell)
 {
-  nsCOMPtr<nsIContent> content;
-  nsCOMPtr<nsIWeakReference> weakShell;
-  nsresult rv = GetInfo(aFrame, getter_AddRefs(weakShell),
-                        getter_AddRefs(content));
-  if (NS_FAILED(rv))
-    return rv;
-
-  *aAccessible = new nsHTMLTableAccessibleWrap(content, weakShell);
-  if (!*aAccessible)
-    return NS_ERROR_OUT_OF_MEMORY;
-
-  NS_ADDREF(*aAccessible);
-  return NS_OK;
+  nsCOMPtr<nsIWeakReference> weakShell(do_GetWeakReference(aPresShell));
+  nsAccessible* accessible = new nsHTMLTableCellAccessibleWrap(aContent,
+                                                               weakShell);
+  NS_IF_ADDREF(accessible);
+  return accessible;
 }
 
-nsresult
-nsAccessibilityService::CreateHTMLTableCellAccessible(nsIFrame *aFrame,
-                                                      nsIAccessible **aAccessible)
+already_AddRefed<nsAccessible>
+nsAccessibilityService::CreateHTMLTextAccessible(nsIContent* aContent,
+                                                 nsIPresShell* aPresShell)
 {
-  NS_ENSURE_ARG_POINTER(aAccessible);
-  *aAccessible = nsnull;
-
-  nsCOMPtr<nsIContent> content;
-  nsCOMPtr<nsIWeakReference> weakShell;
-  nsresult rv = GetInfo(aFrame, getter_AddRefs(weakShell),
-                        getter_AddRefs(content));
-  if (NS_FAILED(rv))
-    return rv;
-
-  *aAccessible = new nsHTMLTableCellAccessibleWrap(content, weakShell);
-  if (!*aAccessible)
-    return NS_ERROR_OUT_OF_MEMORY;
-
-  NS_ADDREF(*aAccessible);
-  return NS_OK;
+  nsCOMPtr<nsIWeakReference> weakShell(do_GetWeakReference(aPresShell));
+  nsAccessible* accessible = new nsHTMLTextAccessible(aContent, weakShell);
+  NS_IF_ADDREF(accessible);
+  return accessible;
 }
 
-nsresult
-nsAccessibilityService::CreateHTMLTextAccessible(nsIFrame *aFrame,
-                                                 nsIAccessible **aAccessible)
+already_AddRefed<nsAccessible>
+nsAccessibilityService::CreateHTMLTextFieldAccessible(nsIContent* aContent,
+                                                      nsIPresShell* aPresShell)
 {
-  *aAccessible = nsnull;
-
-  nsCOMPtr<nsIContent> content;
-  nsCOMPtr<nsIWeakReference> weakShell;
-  nsresult rv = GetInfo(aFrame, getter_AddRefs(weakShell),
-                        getter_AddRefs(content));
-  if (NS_FAILED(rv))
-    return rv;
-
-  // XXX Don't create ATK objects for these
-  *aAccessible = new nsHTMLTextAccessible(content, weakShell);
-  if (!*aAccessible)
-    return NS_ERROR_OUT_OF_MEMORY;
-
-  NS_ADDREF(*aAccessible);
-  return NS_OK;
+  nsCOMPtr<nsIWeakReference> weakShell(do_GetWeakReference(aPresShell));
+  nsAccessible* accessible = new nsHTMLTextFieldAccessible(aContent, weakShell);
+  NS_IF_ADDREF(accessible);
+  return accessible;
 }
 
-nsresult
-nsAccessibilityService::CreateHTMLTextFieldAccessible(nsIFrame *aFrame,
-                                                      nsIAccessible **aAccessible)
+already_AddRefed<nsAccessible>
+nsAccessibilityService::CreateHTMLLabelAccessible(nsIContent* aContent,
+                                                  nsIPresShell* aPresShell)
 {
-  nsCOMPtr<nsIContent> content;
-  nsCOMPtr<nsIWeakReference> weakShell;
-  nsresult rv = GetInfo(aFrame, getter_AddRefs(weakShell),
-                        getter_AddRefs(content));
-  if (NS_FAILED(rv))
-    return rv;
-
-  *aAccessible = new nsHTMLTextFieldAccessible(content, weakShell);
-  if (!*aAccessible)
-    return NS_ERROR_OUT_OF_MEMORY;
-
-  NS_ADDREF(*aAccessible);
-  return NS_OK;
+  nsCOMPtr<nsIWeakReference> weakShell(do_GetWeakReference(aPresShell));
+  nsAccessible* accessible = new nsHTMLLabelAccessible(aContent, weakShell);
+  NS_IF_ADDREF(accessible);
+  return accessible;
 }
 
-nsresult
-nsAccessibilityService::CreateHTMLLabelAccessible(nsIFrame *aFrame,
-                                                  nsIAccessible **aAccessible)
+already_AddRefed<nsAccessible>
+nsAccessibilityService::CreateHTMLHRAccessible(nsIContent* aContent,
+                                               nsIPresShell* aPresShell)
 {
-  nsCOMPtr<nsIContent> content;
-  nsCOMPtr<nsIWeakReference> weakShell;
-  nsresult rv = GetInfo(aFrame, getter_AddRefs(weakShell),
-                        getter_AddRefs(content));
-  if (NS_FAILED(rv))
-    return rv;
-
-  *aAccessible = new nsHTMLLabelAccessible(content, weakShell);
-  if (!*aAccessible)
-    return NS_ERROR_OUT_OF_MEMORY;
-
-  NS_ADDREF(*aAccessible);
-  return NS_OK;
+  nsCOMPtr<nsIWeakReference> weakShell(do_GetWeakReference(aPresShell));
+  nsAccessible* accessible = new nsHTMLHRAccessible(aContent, weakShell);
+  NS_IF_ADDREF(accessible);
+  return accessible;
 }
 
-nsresult
-nsAccessibilityService::CreateHTMLHRAccessible(nsIFrame *aFrame,
-                                               nsIAccessible **aAccessible)
+already_AddRefed<nsAccessible>
+nsAccessibilityService::CreateHTMLBRAccessible(nsIContent* aContent,
+                                               nsIPresShell* aPresShell)
 {
-  nsCOMPtr<nsIContent> content;
-  nsCOMPtr<nsIWeakReference> weakShell;
-  nsresult rv = GetInfo(aFrame, getter_AddRefs(weakShell),
-                        getter_AddRefs(content));
-  if (NS_FAILED(rv))
-    return rv;
-
-  *aAccessible = new nsHTMLHRAccessible(content, weakShell);
-  if (!*aAccessible)
-    return NS_ERROR_OUT_OF_MEMORY;
-
-  NS_ADDREF(*aAccessible);
-  return NS_OK;
+  nsCOMPtr<nsIWeakReference> weakShell(do_GetWeakReference(aPresShell));
+  nsAccessible* accessible = new nsHTMLBRAccessible(aContent, weakShell);
+  NS_IF_ADDREF(accessible);
+  return accessible;
 }
 
-nsresult
-nsAccessibilityService::CreateHTMLBRAccessible(nsIFrame *aFrame,
-                                               nsIAccessible **aAccessible)
+already_AddRefed<nsAccessible>
+nsAccessibilityService::CreateHTMLCaptionAccessible(nsIContent* aContent,
+                                                    nsIPresShell* aPresShell)
 {
-  nsCOMPtr<nsIContent> content;
-  nsCOMPtr<nsIWeakReference> weakShell;
-  nsresult rv = GetInfo(aFrame, getter_AddRefs(weakShell),
-                        getter_AddRefs(content));
-  if (NS_FAILED(rv))
-    return rv;
-
-  *aAccessible = new nsHTMLBRAccessible(content, weakShell);
-  if (!*aAccessible)
-    return NS_ERROR_OUT_OF_MEMORY;
-
-  NS_ADDREF(*aAccessible);
-  return NS_OK;
-}
-
-nsresult
-nsAccessibilityService::CreateHTMLCaptionAccessible(nsIFrame *aFrame,
-                                                    nsIAccessible **aAccessible)
-{
-  nsCOMPtr<nsIContent> content;
-  nsCOMPtr<nsIWeakReference> weakShell;
-  nsresult rv = GetInfo(aFrame, getter_AddRefs(weakShell),
-                        getter_AddRefs(content));
-  if (NS_FAILED(rv))
-    return rv;
-
-  *aAccessible = new nsHTMLCaptionAccessible(content, weakShell);
-  if (!*aAccessible)
-    return NS_ERROR_OUT_OF_MEMORY;
-
-  NS_ADDREF(*aAccessible);
-  return NS_OK;
+  nsCOMPtr<nsIWeakReference> weakShell(do_GetWeakReference(aPresShell));
+  nsAccessible* accessible = new nsHTMLCaptionAccessible(aContent, weakShell);
+  NS_IF_ADDREF(accessible);
+  return accessible;
 }
 
 void
 nsAccessibilityService::PresShellDestroyed(nsIPresShell *aPresShell)
 {
   // Presshell destruction will automatically destroy shells for descendant
   // documents, so no need to worry about those. Just shut down the accessible
   // for this one document. That keeps us from having bad behavior in case of
@@ -1038,26 +718,25 @@ nsAccessibilityService::GetAccessibleFro
   }
 
   NS_IF_ADDREF(*aAccessible = accessible);
   return NS_OK;
 }
 
 // nsIAccesibilityService
 nsAccessible*
-nsAccessibilityService::GetAccessibleInShell(nsIDOMNode *aNode, 
-                                             nsIPresShell *aPresShell) 
+nsAccessibilityService::GetAccessibleInShell(nsINode* aNode,
+                                             nsIPresShell* aPresShell)
 {
   if (!aNode || !aPresShell)
     return nsnull;
 
-  nsCOMPtr<nsINode> node(do_QueryInterface(aNode));
   nsCOMPtr<nsIWeakReference> weakShell(do_GetWeakReference(aPresShell));
   nsRefPtr<nsAccessible> accessible =
-    GetAccessible(node, aPresShell, weakShell);
+    GetAccessible(aNode, aPresShell, weakShell);
   return accessible;
 }
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsAccessibilityService public
 
 nsAccessible *
 nsAccessibilityService::GetAccessible(nsINode *aNode)
@@ -1244,17 +923,20 @@ nsAccessibilityService::GetAccessible(ns
   }
 
   if (weakFrame.GetFrame()->GetContent() != content) {
     // Not the main content for this frame. This happens because <area>
     // elements return the image frame as their primary frame. The main content
     // for the image frame is the image content. If the frame is not an image
     // frame or the node is not an area element then null is returned.
     // This setup will change when bug 135040 is fixed.
-    return GetAreaAccessible(weakFrame.GetFrame(), aNode, aWeakShell);
+    nsAccessible* areaAcc = GetAreaAccessible(weakFrame.GetFrame(),
+                                              aNode, aWeakShell);
+    NS_IF_ADDREF(areaAcc);
+    return areaAcc;
   }
 
   // Attempt to create an accessible based on what we know.
   nsRefPtr<nsAccessible> newAcc;
   if (content->IsNodeOfType(nsINode::eTEXT)) {
     // --- Create HTML for visible text frames ---
     nsIFrame* f = weakFrame.GetFrame();
     if (f && f->IsEmpty()) {
@@ -1264,24 +946,20 @@ nsAccessibilityService::GetAccessible(ns
         // Really empty -- nothing is rendered
         if (aIsHidden)
           *aIsHidden = PR_TRUE;
 
         return nsnull;
       }
     }
     if (weakFrame.IsAlive()) {
-      nsCOMPtr<nsIAccessible> newAccessible;
-      weakFrame.GetFrame()->GetAccessible(getter_AddRefs(newAccessible));
-      if (newAccessible) {
-        newAcc = do_QueryObject(newAccessible);
-        if (InitAccessible(newAcc, nsnull))
-          return newAcc.forget();
-        return nsnull;
-      }
+      newAcc = weakFrame.GetFrame()->CreateAccessible();
+      if (InitAccessible(newAcc, nsnull))
+        return newAcc.forget();
+      return nsnull;
     }
 
     return nsnull;
   }
 
   PRBool isHTML = content->IsHTML();
   if (isHTML && content->Tag() == nsAccessibilityAtoms::map) {
     // Create hyper text accessible for HTML map if it is used to group links
@@ -1407,18 +1085,18 @@ nsAccessibilityService::GetAccessible(ns
     }
 
     if (!newAcc && tryTagNameOrFrame) {
       // Prefer to use markup (mostly tag name, perhaps attributes) to
       // decide if and what kind of accessible to create.
       // The method creates accessibles for table related content too therefore
       // we do not call it if accessibles for table related content are
       // prevented above.
-      newAcc = CreateHTMLAccessibleByMarkup(weakFrame.GetFrame(), aWeakShell,
-                                            aNode);
+      newAcc = CreateHTMLAccessibleByMarkup(weakFrame.GetFrame(), content,
+                                            aWeakShell);
 
       if (!newAcc) {
         // Do not create accessible object subtrees for non-rendered table
         // captions. This could not be done in
         // nsTableCaptionFrame::GetAccessible() because the descendants of
         // the table caption would still be created. By setting
         // *aIsHidden = PR_TRUE we ensure that no descendant accessibles are
         // created.
@@ -1432,19 +1110,17 @@ nsAccessibilityService::GetAccessible(ns
           // is no better place:
           if (aIsHidden)
             *aIsHidden = PR_TRUE;
 
           return nsnull;
         }
 
         // Try using frame to do it.
-        nsCOMPtr<nsIAccessible> newAccessible;
-        f->GetAccessible(getter_AddRefs(newAccessible));
-        newAcc = do_QueryObject(newAccessible);
+        newAcc = f->CreateAccessible();
       }
     }
   }
 
   if (!newAcc) {
     // Elements may implement nsIAccessibleProvider via XBL. This allows them to
     // say what kind of accessible to create.
     newAcc = CreateAccessibleByType(content, aWeakShell);
@@ -1624,17 +1300,17 @@ nsAccessibilityService::GetRelevantConte
           return bindingParent;
       }
     }
   }
 
   return aNode;
 }
 
-already_AddRefed<nsAccessible>
+nsAccessible*
 nsAccessibilityService::GetAreaAccessible(nsIFrame *aImageFrame,
                                           nsINode *aAreaNode,
                                           nsIWeakReference *aWeakShell)
 {
   // Check if frame is an image frame, and content is <area>.
   nsIImageFrame *imageFrame = do_QueryFrame(aImageFrame);
   if (!imageFrame)
     return nsnull;
@@ -1643,267 +1319,416 @@ nsAccessibilityService::GetAreaAccessibl
   if (!areaElmt)
     return nsnull;
 
   // Try to get image map accessible from the global cache or create it
   // if failed.
   nsRefPtr<nsAccessible> imageAcc =
     GetCachedAccessible(aImageFrame->GetContent(), aWeakShell);
   if (!imageAcc) {
-    nsCOMPtr<nsIAccessible> imageAccessible;
-    CreateHTMLImageAccessible(aImageFrame,
-                              getter_AddRefs(imageAccessible));
+    imageAcc = CreateHTMLImageAccessible(aImageFrame->GetContent(),
+                                         aImageFrame->PresContext()->PresShell());
 
-    imageAcc = do_QueryObject(imageAccessible);
     if (!InitAccessible(imageAcc, nsnull))
       return nsnull;
   }
 
   // Make sure <area> accessible children of the image map are cached so
   // that they should be available in global cache.
   imageAcc->EnsureChildren();
 
-  nsAccessible *cachedAreaAcc = GetCachedAccessible(aAreaNode, aWeakShell);
-  NS_IF_ADDREF(cachedAreaAcc);
-  return cachedAreaAcc;
+  return GetCachedAccessible(aAreaNode, aWeakShell);
 }
 
 already_AddRefed<nsAccessible>
-nsAccessibilityService::CreateAccessibleByType(nsIContent *aContent,
-                                               nsIWeakReference *aWeakShell)
+nsAccessibilityService::CreateAccessibleByType(nsIContent* aContent,
+                                               nsIWeakReference* aWeakShell)
 {
   nsCOMPtr<nsIAccessibleProvider> accessibleProvider(do_QueryInterface(aContent));
   if (!accessibleProvider)
     return nsnull;
 
   PRInt32 type;
   nsresult rv = accessibleProvider->GetAccessibleType(&type);
   if (NS_FAILED(rv))
     return nsnull;
 
-  nsRefPtr<nsAccessible> accessible;
   if (type == nsIAccessibleProvider::OuterDoc) {
-    accessible = new nsOuterDocAccessible(aContent, aWeakShell);
-    return accessible.forget();
+    nsAccessible* accessible = new nsOuterDocAccessible(aContent, aWeakShell);
+    NS_IF_ADDREF(accessible);
+    return accessible;
   }
 
+  nsAccessible* accessible = nsnull;
   switch (type)
   {
 #ifdef MOZ_XUL
     case nsIAccessibleProvider::NoAccessible:
       return nsnull;
 
     // XUL controls
     case nsIAccessibleProvider::XULAlert:
       accessible = new nsXULAlertAccessible(aContent, aWeakShell);
       break;
+
     case nsIAccessibleProvider::XULButton:
       accessible = new nsXULButtonAccessible(aContent, aWeakShell);
       break;
+
     case nsIAccessibleProvider::XULCheckbox:
       accessible = new nsXULCheckboxAccessible(aContent, aWeakShell);
       break;
+
     case nsIAccessibleProvider::XULColorPicker:
       accessible = new nsXULColorPickerAccessible(aContent, aWeakShell);
       break;
+
     case nsIAccessibleProvider::XULColorPickerTile:
       accessible = new nsXULColorPickerTileAccessible(aContent, aWeakShell);
       break;
+
     case nsIAccessibleProvider::XULCombobox:
       accessible = new nsXULComboboxAccessible(aContent, aWeakShell);
       break;
+
     case nsIAccessibleProvider::XULDropmarker:
       accessible = new nsXULDropmarkerAccessible(aContent, aWeakShell);
       break;
+
     case nsIAccessibleProvider::XULGroupbox:
       accessible = new nsXULGroupboxAccessible(aContent, aWeakShell);
       break;
+
     case nsIAccessibleProvider::XULImage:
     {
       // Don't include nameless images in accessible tree.
       if (!aContent->HasAttr(kNameSpaceID_None,
                              nsAccessibilityAtoms::tooltiptext))
         return nsnull;
 
       accessible = new nsHTMLImageAccessibleWrap(aContent, aWeakShell);
       break;
+
     }
     case nsIAccessibleProvider::XULLink:
       accessible = new nsXULLinkAccessible(aContent, aWeakShell);
       break;
+
     case nsIAccessibleProvider::XULListbox:
       accessible = new nsXULListboxAccessibleWrap(aContent, aWeakShell);
       break;
+
     case nsIAccessibleProvider::XULListCell:
       accessible = new nsXULListCellAccessibleWrap(aContent, aWeakShell);
       break;
+
     case nsIAccessibleProvider::XULListHead:
       accessible = new nsXULColumnsAccessible(aContent, aWeakShell);
       break;
+
     case nsIAccessibleProvider::XULListHeader:
       accessible = new nsXULColumnItemAccessible(aContent, aWeakShell);
       break;
+
     case nsIAccessibleProvider::XULListitem:
       accessible = new nsXULListitemAccessible(aContent, aWeakShell);
       break;
+
     case nsIAccessibleProvider::XULMenubar:
       accessible = new nsXULMenubarAccessible(aContent, aWeakShell);
       break;
+
     case nsIAccessibleProvider::XULMenuitem:
       accessible = new nsXULMenuitemAccessibleWrap(aContent, aWeakShell);
       break;
+
     case nsIAccessibleProvider::XULMenupopup:
     {
 #ifdef MOZ_ACCESSIBILITY_ATK
       // ATK considers this node to be redundant when within menubars, and it makes menu
       // navigation with assistive technologies more difficult
       // XXX In the future we will should this for consistency across the nsIAccessible
       // implementations on each platform for a consistent scripting environment, but
       // then strip out redundant accessibles in the nsAccessibleWrap class for each platform.
       nsIContent *parent = aContent->GetParent();
       if (parent && parent->NodeInfo()->Equals(nsAccessibilityAtoms::menu,
                                                kNameSpaceID_XUL))
         return nsnull;
 #endif
       accessible = new nsXULMenupopupAccessible(aContent, aWeakShell);
       break;
+
     }
     case nsIAccessibleProvider::XULMenuSeparator:
       accessible = new nsXULMenuSeparatorAccessible(aContent, aWeakShell);
       break;
+
     case nsIAccessibleProvider::XULPane:
       accessible = new nsEnumRoleAccessible(aContent, aWeakShell,
                                             nsIAccessibleRole::ROLE_PANE);
       break;
+
     case nsIAccessibleProvider::XULProgressMeter:
       accessible = new nsXULProgressMeterAccessible(aContent, aWeakShell);
       break;
+
     case nsIAccessibleProvider::XULStatusBar:
       accessible = new nsXULStatusBarAccessible(aContent, aWeakShell);
       break;
+
     case nsIAccessibleProvider::XULScale:
       accessible = new nsXULSliderAccessible(aContent, aWeakShell);
       break;
+
     case nsIAccessibleProvider::XULRadioButton:
       accessible = new nsXULRadioButtonAccessible(aContent, aWeakShell);
       break;
+
     case nsIAccessibleProvider::XULRadioGroup:
       accessible = new nsXULRadioGroupAccessible(aContent, aWeakShell);
       break;
+
     case nsIAccessibleProvider::XULTab:
       accessible = new nsXULTabAccessible(aContent, aWeakShell);
       break;
+
     case nsIAccessibleProvider::XULTabs:
       accessible = new nsXULTabsAccessible(aContent, aWeakShell);
       break;
+
     case nsIAccessibleProvider::XULTabpanels:
       accessible = new nsXULTabpanelsAccessible(aContent, aWeakShell);
       break;
+
     case nsIAccessibleProvider::XULText:
       accessible = new nsXULTextAccessible(aContent, aWeakShell);
       break;
+
     case nsIAccessibleProvider::XULTextBox:
       accessible = new nsXULTextFieldAccessible(aContent, aWeakShell);
       break;
+
     case nsIAccessibleProvider::XULThumb:
       accessible = new nsXULThumbAccessible(aContent, aWeakShell);
       break;
+
     case nsIAccessibleProvider::XULTree:
       return CreateAccessibleForXULTree(aContent, aWeakShell);
 
     case nsIAccessibleProvider::XULTreeColumns:
       accessible = new nsXULTreeColumnsAccessible(aContent, aWeakShell);
       break;
+
     case nsIAccessibleProvider::XULTreeColumnItem:
       accessible = new nsXULColumnItemAccessible(aContent, aWeakShell);
       break;
+
     case nsIAccessibleProvider::XULToolbar:
       accessible = new nsXULToolbarAccessible(aContent, aWeakShell);
       break;
+
     case nsIAccessibleProvider::XULToolbarSeparator:
       accessible = new nsXULToolbarSeparatorAccessible(aContent, aWeakShell);
       break;
+
     case nsIAccessibleProvider::XULTooltip:
       accessible = new nsXULTooltipAccessible(aContent, aWeakShell);
       break;
+
     case nsIAccessibleProvider::XULToolbarButton:
       accessible = new nsXULToolbarButtonAccessible(aContent, aWeakShell);
       break;
+
 #endif // MOZ_XUL
 
 #ifndef DISABLE_XFORMS_HOOKS
     // XForms elements
     case nsIAccessibleProvider::XFormsContainer:
       accessible = new nsXFormsContainerAccessible(aContent, aWeakShell);
       break;
 
     case nsIAccessibleProvider::XFormsLabel:
       accessible = new nsXFormsLabelAccessible(aContent, aWeakShell);
       break;
+
     case nsIAccessibleProvider::XFormsOutput:
       accessible = new nsXFormsOutputAccessible(aContent, aWeakShell);
       break;
+
     case nsIAccessibleProvider::XFormsTrigger:
       accessible = new nsXFormsTriggerAccessible(aContent, aWeakShell);
       break;
+
     case nsIAccessibleProvider::XFormsInput:
       accessible = new nsXFormsInputAccessible(aContent, aWeakShell);
       break;
+
     case nsIAccessibleProvider::XFormsInputBoolean:
       accessible = new nsXFormsInputBooleanAccessible(aContent, aWeakShell);
       break;
+
     case nsIAccessibleProvider::XFormsInputDate:
       accessible = new nsXFormsInputDateAccessible(aContent, aWeakShell);
       break;
+
     case nsIAccessibleProvider::XFormsSecret:
       accessible = new nsXFormsSecretAccessible(aContent, aWeakShell);
       break;
+
     case nsIAccessibleProvider::XFormsSliderRange:
       accessible = new nsXFormsRangeAccessible(aContent, aWeakShell);
       break;
+
     case nsIAccessibleProvider::XFormsSelect:
       accessible = new nsXFormsSelectAccessible(aContent, aWeakShell);
       break;
+
     case nsIAccessibleProvider::XFormsChoices:
       accessible = new nsXFormsChoicesAccessible(aContent, aWeakShell);
       break;
+
     case nsIAccessibleProvider::XFormsSelectFull:
       accessible = new nsXFormsSelectFullAccessible(aContent, aWeakShell);
       break;
+
     case nsIAccessibleProvider::XFormsItemCheckgroup:
       accessible = new nsXFormsItemCheckgroupAccessible(aContent, aWeakShell);
       break;
+
     case nsIAccessibleProvider::XFormsItemRadiogroup:
       accessible = new nsXFormsItemRadiogroupAccessible(aContent, aWeakShell);
       break;
+
     case nsIAccessibleProvider::XFormsSelectCombobox:
       accessible = new nsXFormsSelectComboboxAccessible(aContent, aWeakShell);
       break;
+
     case nsIAccessibleProvider::XFormsItemCombobox:
       accessible = new nsXFormsItemComboboxAccessible(aContent, aWeakShell);
       break;
 
     case nsIAccessibleProvider::XFormsDropmarkerWidget:
       accessible = new nsXFormsDropmarkerWidgetAccessible(aContent, aWeakShell);
       break;
+
     case nsIAccessibleProvider::XFormsCalendarWidget:
       accessible = new nsXFormsCalendarWidgetAccessible(aContent, aWeakShell);
       break;
+
     case nsIAccessibleProvider::XFormsComboboxPopupWidget:
       accessible = new nsXFormsComboboxPopupWidgetAccessible(aContent, aWeakShell);
       break;
+
 #endif
 
     default:
       return nsnull;
   }
 
-  return accessible.forget();
+  NS_IF_ADDREF(accessible);
+  return accessible;
 }
 
+already_AddRefed<nsAccessible>
+nsAccessibilityService::CreateHTMLAccessibleByMarkup(nsIFrame* aFrame,
+                                                     nsIContent* aContent,
+                                                     nsIWeakReference* aWeakShell)
+{
+  // This method assumes we're in an HTML namespace.
+  nsIAtom *tag = aContent->Tag();
+  if (tag == nsAccessibilityAtoms::legend) {
+    nsAccessible* accessible = new nsHTMLLegendAccessible(aContent, aWeakShell);
+    NS_IF_ADDREF(accessible);
+    return accessible;
+  }
+
+  if (tag == nsAccessibilityAtoms::option) {
+    nsAccessible* accessible = new nsHTMLSelectOptionAccessible(aContent,
+                                                                aWeakShell);
+    NS_IF_ADDREF(accessible);
+    return accessible;
+  }
+
+  if (tag == nsAccessibilityAtoms::optgroup) {
+    nsAccessible* accessible = new nsHTMLSelectOptGroupAccessible(aContent,
+                                                                  aWeakShell);
+    NS_IF_ADDREF(accessible);
+    return accessible;
+  }
+
+  if (tag == nsAccessibilityAtoms::ul || tag == nsAccessibilityAtoms::ol ||
+      tag == nsAccessibilityAtoms::dl) {
+    nsAccessible* accessible = new nsHTMLListAccessible(aContent, aWeakShell);
+    NS_IF_ADDREF(accessible);
+    return accessible;
+  }
+
+  if (tag == nsAccessibilityAtoms::a) {
+    // Only some roles truly enjoy life as nsHTMLLinkAccessibles, for details
+    // see closed bug 494807.
+    nsRoleMapEntry *roleMapEntry = nsAccUtils::GetRoleMapEntry(aContent);
+    if (roleMapEntry && roleMapEntry->role != nsIAccessibleRole::ROLE_NOTHING &&
+        roleMapEntry->role != nsIAccessibleRole::ROLE_LINK) {
+      nsAccessible* accessible = new nsHyperTextAccessibleWrap(aContent,
+                                                               aWeakShell);
+      NS_IF_ADDREF(accessible);
+      return accessible;
+    }
+
+    nsAccessible* accessible = new nsHTMLLinkAccessible(aContent, aWeakShell);
+    NS_IF_ADDREF(accessible);
+    return accessible;
+  }
+
+  if (tag == nsAccessibilityAtoms::dt ||
+      (tag == nsAccessibilityAtoms::li &&
+       aFrame->GetType() != nsAccessibilityAtoms::blockFrame)) {
+    // Normally for li, it is created by the list item frame (in nsBlockFrame)
+    // which knows about the bullet frame; however, in this case the list item
+    // must have been styled using display: foo
+    nsAccessible* accessible = new nsHTMLLIAccessible(aContent, aWeakShell,
+                                                      EmptyString());
+    NS_IF_ADDREF(accessible);
+    return accessible;
+  }
+
+  if (tag == nsAccessibilityAtoms::abbr ||
+      tag == nsAccessibilityAtoms::acronym ||
+      tag == nsAccessibilityAtoms::blockquote ||
+      tag == nsAccessibilityAtoms::dd ||
+      tag == nsAccessibilityAtoms::form ||
+      tag == nsAccessibilityAtoms::h1 ||
+      tag == nsAccessibilityAtoms::h2 ||
+      tag == nsAccessibilityAtoms::h3 ||
+      tag == nsAccessibilityAtoms::h4 ||
+      tag == nsAccessibilityAtoms::h5 ||
+      tag == nsAccessibilityAtoms::h6 ||
+      tag == nsAccessibilityAtoms::q) {
+    nsAccessible* accessible = new nsHyperTextAccessibleWrap(aContent, aWeakShell);
+    NS_IF_ADDREF(accessible);
+    return accessible;
+  }
+
+  if (tag == nsAccessibilityAtoms::tr) {
+    nsAccessible* accessible = new nsEnumRoleAccessible(aContent, aWeakShell,
+                                                        nsIAccessibleRole::ROLE_ROW);
+    NS_IF_ADDREF(accessible);
+    return accessible;
+  }
+
+  if (nsCoreUtils::IsHTMLTableHeader(aContent)) {
+    nsAccessible* accessible = new nsHTMLTableHeaderCellAccessibleWrap(aContent,
+                                                                       aWeakShell);
+    NS_IF_ADDREF(accessible);
+    return accessible;
+  }
+
+  return nsnull;
+ }
+
 ////////////////////////////////////////////////////////////////////////////////
 // nsIAccessibilityService (DON'T put methods here)
 
 nsAccessible*
 nsAccessibilityService::AddNativeRootAccessible(void* aAtkAccessible)
  {
 #ifdef MOZ_ACCESSIBILITY_ATK
   nsApplicationAccessible* applicationAcc =
@@ -1990,62 +1815,68 @@ NS_GetAccessibilityService(nsIAccessibil
   return NS_OK;
 }
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsAccessibilityService private (DON'T put methods here)
 
 already_AddRefed<nsAccessible>
 nsAccessibilityService::CreateAccessibleForDeckChild(nsIFrame* aFrame,
-                                                     nsIContent *aContent,
-                                                     nsIWeakReference *aWeakShell)
+                                                     nsIContent* aContent,
+                                                     nsIWeakReference* aWeakShell)
 {
-  nsRefPtr<nsAccessible> accessible;
-
   if (aFrame->GetType() == nsAccessibilityAtoms::boxFrame ||
       aFrame->GetType() == nsAccessibilityAtoms::scrollFrame) {
 
     nsIFrame* parentFrame = aFrame->GetParent();
     if (parentFrame && parentFrame->GetType() == nsAccessibilityAtoms::deckFrame) {
       // If deck frame is for xul:tabpanels element then the given node has
       // tabpanel accessible.
       nsCOMPtr<nsIContent> parentContent = parentFrame->GetContent();
 #ifdef MOZ_XUL
       if (parentContent->NodeInfo()->Equals(nsAccessibilityAtoms::tabpanels,
                                             kNameSpaceID_XUL)) {
-        accessible = new nsXULTabpanelAccessible(aContent, aWeakShell);
-      } else
+        nsAccessible* accessible = new nsXULTabpanelAccessible(aContent,
+                                                               aWeakShell);
+        NS_IF_ADDREF(accessible);
+        return accessible;
+      }
 #endif
-        accessible =
-          new nsEnumRoleAccessible(aContent, aWeakShell,
-                                   nsIAccessibleRole::ROLE_PROPERTYPAGE);
+      nsAccessible* accessible = new nsEnumRoleAccessible(aContent, aWeakShell,
+                                                          nsIAccessibleRole::ROLE_PROPERTYPAGE);
+      NS_IF_ADDREF(accessible);
+      return accessible;
     }
   }
 
-  return accessible.forget();
+  return nsnull;
 }
 
 #ifdef MOZ_XUL
 already_AddRefed<nsAccessible>
-nsAccessibilityService::CreateAccessibleForXULTree(nsIContent *aContent,
-                                                   nsIWeakReference *aWeakShell)
+nsAccessibilityService::CreateAccessibleForXULTree(nsIContent* aContent,
+                                                   nsIWeakReference* aWeakShell)
 {
   nsCOMPtr<nsITreeBoxObject> treeBoxObj = nsCoreUtils::GetTreeBoxObject(aContent);
   if (!treeBoxObj)
     return nsnull;
 
   nsCOMPtr<nsITreeColumns> treeColumns;
   treeBoxObj->GetColumns(getter_AddRefs(treeColumns));
   if (!treeColumns)
     return nsnull;
 
-  nsRefPtr<nsAccessible> accessible;
-
   PRInt32 count = 0;
   treeColumns->GetCount(&count);
-  if (count == 1) // outline of list accessible
-    accessible = new nsXULTreeAccessible(aContent, aWeakShell);
-  else // table or tree table accessible
-    accessible = new nsXULTreeGridAccessibleWrap(aContent, aWeakShell);
 
-  return accessible.forget();
+  // Outline of list accessible.
+  if (count == 1) {
+    nsAccessible* accessible = new nsXULTreeAccessible(aContent, aWeakShell);
+    NS_IF_ADDREF(accessible);
+    return accessible;
+  }
+
+  // Table or tree table accessible.
+  nsAccessible* accessible = new nsXULTreeGridAccessibleWrap(aContent, aWeakShell);
+  NS_IF_ADDREF(accessible);
+  return accessible;
 }
 #endif

--- a/accessible/src/base/nsAccessibilityService.h
+++ b/accessible/src/base/nsAccessibilityService.h
@@ -53,71 +53,63 @@ class nsAccessibilityService : public ns
 public:
   virtual ~nsAccessibilityService();
 
   NS_DECL_ISUPPORTS_INHERITED
   NS_DECL_NSIACCESSIBLERETRIEVAL
   NS_DECL_NSIOBSERVER
 
   // nsIAccessibilityService
-  virtual nsAccessible* GetAccessibleInShell(nsIDOMNode *aNode,
-                                             nsIPresShell *aPresShell);
+  virtual nsAccessible* GetAccessibleInShell(nsINode* aNode,
+                                             nsIPresShell* aPresShell);
 
-  virtual nsresult CreateOuterDocAccessible(nsIDOMNode *aNode,
-                                            nsIAccessible **aAccessible);
-  virtual nsresult CreateHTML4ButtonAccessible(nsIFrame *aFrame,
-                                               nsIAccessible **aAccessible);
-  virtual nsresult CreateHyperTextAccessible(nsIFrame *aFrame,
-                                             nsIAccessible **aAccessible);
-  virtual nsresult CreateHTMLBRAccessible(nsIFrame *aFrame,
-                                          nsIAccessible **aAccessible);
-  virtual nsresult CreateHTMLButtonAccessible(nsIFrame *aFrame,
-                                              nsIAccessible **aAccessible);
-  virtual nsresult CreateHTMLLIAccessible(nsIFrame *aFrame,
-                                          nsIFrame *aBulletFrame,
-                                          const nsAString& aBulletText,
-                                          nsIAccessible **aAccessible);
-  virtual nsresult CreateHTMLCheckboxAccessible(nsIFrame *aFrame,
-                                                nsIAccessible **aAccessible);
-  virtual nsresult CreateHTMLComboboxAccessible(nsIDOMNode *aNode,
-                                                nsIWeakReference *aPresShell,
-                                                nsIAccessible **aAccessible);
-  virtual nsresult CreateHTMLGenericAccessible(nsIFrame *aFrame,
-                                               nsIAccessible **aAccessible);
-  virtual nsresult CreateHTMLGroupboxAccessible(nsIFrame *aFrame,
-                                                nsIAccessible **aAccessible);
-  virtual nsresult CreateHTMLHRAccessible(nsIFrame *aFrame,
-                                          nsIAccessible **aAccessible);
-  virtual nsresult CreateHTMLImageAccessible(nsIFrame *aFrame,
-                                             nsIAccessible **aAccessible);
-  virtual nsresult CreateHTMLLabelAccessible(nsIFrame *aFrame,
-                                             nsIAccessible **aAccessible);
-  virtual nsresult CreateHTMLListboxAccessible(nsIDOMNode *aNode,
-                                               nsIWeakReference *aPresShell,
-                                               nsIAccessible **aAccessible);
-  virtual nsresult CreateHTMLMediaAccessible(nsIFrame *aFrame,
-                                             nsIAccessible **aAccessible);
-  virtual nsresult CreateHTMLObjectFrameAccessible(nsObjectFrame *aFrame,
-                                                   nsIAccessible **aAccessible);
-  virtual nsresult CreateHTMLRadioButtonAccessible(nsIFrame *aFrame,
-                                                   nsIAccessible **aAccessible);
-  virtual nsresult CreateHTMLSelectOptionAccessible(nsIDOMNode *aNode,
-                                                    nsIAccessible *aAccParent,
-                                                    nsIWeakReference *aPresShell,
-                                                    nsIAccessible **aAccessible);
-  virtual nsresult CreateHTMLTableAccessible(nsIFrame *aFrame,
-                                             nsIAccessible **aAccessible);
-  virtual nsresult CreateHTMLTableCellAccessible(nsIFrame *aFrame,
-                                                 nsIAccessible **aAccessible);
-  virtual nsresult CreateHTMLTextAccessible(nsIFrame *aFrame,
-                                            nsIAccessible **aAccessible);
-  virtual nsresult CreateHTMLTextFieldAccessible(nsIFrame *aFrame,
-                                                 nsIAccessible **aAccessible);
-  virtual nsresult CreateHTMLCaptionAccessible(nsIFrame *aFrame,
-                                               nsIAccessible **aAccessible);
+  virtual already_AddRefed<nsAccessible>
+    CreateHTMLBRAccessible(nsIContent* aContent, nsIPresShell* aPresShell);
+  virtual already_AddRefed<nsAccessible>
+    CreateHTML4ButtonAccessible(nsIContent* aContent, nsIPresShell* aPresShell);
+  virtual already_AddRefed<nsAccessible>
+    CreateHTMLButtonAccessible(nsIContent* aContent, nsIPresShell* aPresShell);
+  virtual already_AddRefed<nsAccessible>
+    CreateHTMLCaptionAccessible(nsIContent* aContent, nsIPresShell* aPresShell);
+  virtual already_AddRefed<nsAccessible>
+    CreateHTMLCheckboxAccessible(nsIContent* aContent, nsIPresShell* aPresShell);
+  virtual already_AddRefed<nsAccessible>
+    CreateHTMLComboboxAccessible(nsIContent* aContent, nsIPresShell* aPresShell);
+  virtual already_AddRefed<nsAccessible>
+    CreateHTMLGroupboxAccessible(nsIContent* aContent, nsIPresShell* aPresShell);
+  virtual already_AddRefed<nsAccessible>
+    CreateHTMLHRAccessible(nsIContent* aContent, nsIPresShell* aPresShell);
+  virtual already_AddRefed<nsAccessible>
+    CreateHTMLImageAccessible(nsIContent* aContent, nsIPresShell* aPresShell);
+  virtual already_AddRefed<nsAccessible>
+    CreateHTMLLabelAccessible(nsIContent* aContent, nsIPresShell* aPresShell);
+  virtual already_AddRefed<nsAccessible>
+    CreateHTMLLIAccessible(nsIContent* aContent, nsIPresShell* aPresShell,
+                           const nsAString& aBulletText);
+  virtual already_AddRefed<nsAccessible>
+    CreateHTMLListboxAccessible(nsIContent* aContent, nsIPresShell* aPresShell);
+  virtual already_AddRefed<nsAccessible>
+    CreateHTMLMediaAccessible(nsIContent* aContent, nsIPresShell* aPresShell);
+  virtual already_AddRefed<nsAccessible>
+    CreateHTMLObjectFrameAccessible(nsObjectFrame* aFrame, nsIContent* aContent,
+                                    nsIPresShell* aPresShell);
+  virtual already_AddRefed<nsAccessible>
+    CreateHTMLRadioButtonAccessible(nsIContent* aContent, nsIPresShell* aPresShell);
+  virtual already_AddRefed<nsAccessible>
+    CreateHTMLTableAccessible(nsIContent* aContent, nsIPresShell* aPresShell);
+  virtual already_AddRefed<nsAccessible>
+    CreateHTMLTableCellAccessible(nsIContent* aContent, nsIPresShell* aPresShell);
+  virtual already_AddRefed<nsAccessible>
+    CreateHTMLTextAccessible(nsIContent* aContent, nsIPresShell* aPresShell);
+  virtual already_AddRefed<nsAccessible>
+    CreateHTMLTextFieldAccessible(nsIContent* aContent, nsIPresShell* aPresShell);
+  virtual already_AddRefed<nsAccessible>
+    CreateHyperTextAccessible(nsIContent* aContent, nsIPresShell* aPresShell);
+  virtual already_AddRefed<nsAccessible>
+    CreateOuterDocAccessible(nsIContent* aContent, nsIPresShell* aPresShell);
 
   virtual nsAccessible* AddNativeRootAccessible(void* aAtkAccessible);
   virtual void RemoveNativeRootAccessible(nsAccessible* aRootAccessible);
 
   virtual nsresult InvalidateSubtreeFor(nsIPresShell *aPresShell,
                                         nsIContent *aContent,
                                         PRUint32 aChangeType);
 
@@ -235,61 +227,48 @@ private:
   PRBool Init();
 
   /**
    * Shutdowns accessibility service.
    */
   void Shutdown();
 
   /**
-   * Return presentation shell, DOM node for the given frame.
-   *
-   * @param aFrame    [in] the given frame
-   * @param aShell    [out] presentation shell for DOM node associated with the
-   *                    given frame
-   * @param aContent  [out] DOM node associated with the given frame
-   */
-  nsresult GetInfo(nsIFrame *aFrame, nsIWeakReference **aShell,
-                   nsIContent **aContent);
-
-  /**
    * Return accessible for HTML area element associated with an image map.
    */
-  already_AddRefed<nsAccessible>
-    GetAreaAccessible(nsIFrame *aImageFrame, nsINode *aAreaNode,
-                      nsIWeakReference *aWeakShell);
+  nsAccessible* GetAreaAccessible(nsIFrame* aImageFrame, nsINode* aAreaNode,
+                                  nsIWeakReference* aWeakShell);
 
   /**
    * Create accessible for the element implementing nsIAccessibleProvider
    * interface.
    */
   already_AddRefed<nsAccessible>
-    CreateAccessibleByType(nsIContent *aContent, nsIWeakReference *aWeakShell);
+    CreateAccessibleByType(nsIContent* aContent, nsIWeakReference* aWeakShell);
 
   /**
    * Create accessible for HTML node by tag name.
    */
   already_AddRefed<nsAccessible>
-    CreateHTMLAccessibleByMarkup(nsIFrame *aFrame, nsIWeakReference *aWeakShell,
-                                 nsINode *aNode);
+    CreateHTMLAccessibleByMarkup(nsIFrame* aFrame, nsIContent* aContent,
+                                 nsIWeakReference* aWeakShell);
 
   /**
    * Create accessible if parent is a deck frame.
    */
   already_AddRefed<nsAccessible>
-    CreateAccessibleForDeckChild(nsIFrame *aFrame, nsIContent *aContent,
-                                 nsIWeakReference *aWeakShell);
+    CreateAccessibleForDeckChild(nsIFrame* aFrame, nsIContent* aContent,
+                                 nsIWeakReference* aWeakShell);
 
 #ifdef MOZ_XUL
   /**
    * Create accessible for XUL tree element.
    */
   already_AddRefed<nsAccessible>
-    CreateAccessibleForXULTree(nsIContent *aContent,
-                               nsIWeakReference *aWeakShell);
+    CreateAccessibleForXULTree(nsIContent* aContent, nsIWeakReference* aWeakShell);
 #endif
 
   /**
    * Reference for accessibility service.
    */
   static nsAccessibilityService *gAccessibilityService;
 
   /**
@@ -323,17 +302,17 @@ GetAccService()
 /**
  * Map nsIAccessibleRole constants to strings. Used by
  * nsIAccessibleRetrieval::getStringRole() method.
  */
 static const char kRoleNames[][20] = {
   "nothing",             //ROLE_NOTHING
   "titlebar",            //ROLE_TITLEBAR
   "menubar",             //ROLE_MENUBAR
-  "scrollbar",           //ROLE_SCROLLBAR 
+  "scrollbar",           //ROLE_SCROLLBAR
   "grip",                //ROLE_GRIP
   "sound",               //ROLE_SOUND
   "cursor",              //ROLE_CURSOR
   "caret",               //ROLE_CARET
   "alert",               //ROLE_ALERT
   "window",              //ROLE_WINDOW
   "internal frame",      //ROLE_INTERNAL_FRAME
   "menupopup",           //ROLE_MENUPOPUP
@@ -440,17 +419,17 @@ static const char kRoleNames[][20] = {
   "parent menuitem",     //ROLE_PARENT_MENUITEM
   "calendar",            //ROLE_CALENDAR
   "combobox list",       //ROLE_COMBOBOX_LIST
   "combobox option",     //ROLE_COMBOBOX_OPTION
   "image map",           //ROLE_IMAGE_MAP
   "listbox option",      //ROLE_OPTION
   "listbox rich option", //ROLE_RICH_OPTION
   "listbox",             //ROLE_LISTBOX
-  "flat equation",       //ROLE_FLAT_EQUATION  
+  "flat equation",       //ROLE_FLAT_EQUATION
   "gridcell",            //ROLE_GRID_CELL
   "embedded object"      //ROLE_EMBEDDED_OBJECT
 };
 
 /**
  * Map nsIAccessibleEvents constants to strings. Used by
  * nsIAccessibleRetrieval::getStringEventType() method.
  */

--- a/layout/base/nsPresShell.cpp
+++ b/layout/base/nsPresShell.cpp
@@ -6561,20 +6561,17 @@ PresShell::HandleEventInternal(nsEvent* 
     if (accService) {
       nsCOMPtr<nsISupports> container = mPresContext->GetContainer();
       if (!container) {
         // This presshell is not active. This often happens when a
         // preshell is being held onto for fastback.
         return NS_OK;
       }
 
-      nsCOMPtr<nsIDOMNode> domNode(do_QueryInterface(mDocument));
-      NS_ASSERTION(domNode, "No dom node for doc");
-
-      accEvent->mAccessible = accService->GetAccessibleInShell(domNode, this);
+      accEvent->mAccessible = accService->GetAccessibleInShell(mDocument, this);
 
       // Ensure this is set in case a11y was activated before any
       // nsPresShells existed to observe "a11y-init-or-shutdown" topic
       gIsAccessibilityActive = PR_TRUE;
       return NS_OK;
     }
   }
 #endif

--- a/layout/forms/nsComboboxControlFrame.cpp
+++ b/layout/forms/nsComboboxControlFrame.cpp
@@ -295,27 +295,27 @@ NS_QUERYFRAME_HEAD(nsComboboxControlFram
   NS_QUERYFRAME_ENTRY(nsIComboboxControlFrame)
   NS_QUERYFRAME_ENTRY(nsIFormControlFrame)
   NS_QUERYFRAME_ENTRY(nsIAnonymousContentCreator)
   NS_QUERYFRAME_ENTRY(nsISelectControlFrame)
   NS_QUERYFRAME_ENTRY(nsIStatefulFrame)
 NS_QUERYFRAME_TAIL_INHERITING(nsBlockFrame)
 
 #ifdef ACCESSIBILITY
-NS_IMETHODIMP nsComboboxControlFrame::GetAccessible(nsIAccessible** aAccessible)
+already_AddRefed<nsAccessible>
+nsComboboxControlFrame::CreateAccessible()
 {
   nsCOMPtr<nsIAccessibilityService> accService = do_GetService("@mozilla.org/accessibilityService;1");
 
   if (accService) {
-    nsCOMPtr<nsIDOMNode> node = do_QueryInterface(mContent);
-    nsCOMPtr<nsIWeakReference> weakShell(do_GetWeakReference(PresContext()->PresShell()));
-    return accService->CreateHTMLComboboxAccessible(node, weakShell, aAccessible);
+    return accService->CreateHTMLComboboxAccessible(mContent,
+                                                    PresContext()->PresShell());
   }
 
-  return NS_ERROR_FAILURE;
+  return nsnull;
 }
 #endif
 
 void 
 nsComboboxControlFrame::SetFocus(PRBool aOn, PRBool aRepaint)
 {
   nsWeakFrame weakFrame(this);
   if (aOn) {

--- a/layout/forms/nsComboboxControlFrame.h
+++ b/layout/forms/nsComboboxControlFrame.h
@@ -98,17 +98,17 @@ public:
   NS_DECL_FRAMEARENA_HELPERS
 
   // nsIAnonymousContentCreator
   virtual nsresult CreateAnonymousContent(nsTArray<nsIContent*>& aElements);
   virtual void AppendAnonymousContentTo(nsBaseContentList& aElements);
   virtual nsIFrame* CreateFrameFor(nsIContent* aContent);
 
 #ifdef ACCESSIBILITY
-  NS_IMETHOD GetAccessible(nsIAccessible** aAccessible);
+  virtual already_AddRefed<nsAccessible> CreateAccessible();
 #endif
 
   virtual nscoord GetMinWidth(nsIRenderingContext *aRenderingContext);
 
   virtual nscoord GetPrefWidth(nsIRenderingContext *aRenderingContext);
 
   NS_IMETHOD Reflow(nsPresContext*          aCX,
                     nsHTMLReflowMetrics&     aDesiredSize,

--- a/layout/forms/nsFieldSetFrame.cpp
+++ b/layout/forms/nsFieldSetFrame.cpp
@@ -103,17 +103,17 @@ public:
                           nsFrameList&   aFrameList);
   NS_IMETHOD RemoveFrame(nsIAtom*       aListName,
                          nsIFrame*      aOldFrame);
 
   virtual nsIAtom* GetType() const;
   virtual PRBool IsContainingBlock() const;
 
 #ifdef ACCESSIBILITY  
-  NS_IMETHOD  GetAccessible(nsIAccessible** aAccessible);
+  virtual already_AddRefed<nsAccessible> CreateAccessible();
 #endif
 
 #ifdef DEBUG
   NS_IMETHOD GetFrameName(nsAString& aResult) const {
     return MakeFrameName(NS_LITERAL_STRING("FieldSet"), aResult);
   }
 #endif
 
@@ -644,25 +644,27 @@ nsFieldSetFrame::RemoveFrame(nsIAtom*   
                              nsIFrame*      aOldFrame)
 {
   // For reference, see bug 70648, bug 276104 and bug 236071.
   NS_ASSERTION(aOldFrame != mLegendFrame, "Cannot remove mLegendFrame here");
   return mContentFrame->RemoveFrame(aListName, aOldFrame);
 }
 
 #ifdef ACCESSIBILITY
-NS_IMETHODIMP nsFieldSetFrame::GetAccessible(nsIAccessible** aAccessible)
+already_AddRefed<nsAccessible>
+nsFieldSetFrame::CreateAccessible()
 {
   nsCOMPtr<nsIAccessibilityService> accService = do_GetService("@mozilla.org/accessibilityService;1");
 
   if (accService) {
-    return accService->CreateHTMLGroupboxAccessible(static_cast<nsIFrame*>(this), aAccessible);
+    return accService->CreateHTMLGroupboxAccessible(mContent,
+                                                    PresContext()->PresShell());
   }
 
-  return NS_ERROR_FAILURE;
+  return nsnull;
 }
 #endif
 
 void
 nsFieldSetFrame::ReparentFrameList(const nsFrameList& aFrameList)
 {
   nsFrameManager* frameManager = PresContext()->FrameManager();
   for (nsFrameList::Enumerator e(aFrameList); !e.AtEnd(); e.Next()) {

--- a/layout/forms/nsFileControlFrame.cpp
+++ b/layout/forms/nsFileControlFrame.cpp
@@ -837,24 +837,26 @@ nsFileControlFrame::BuildDisplayList(nsD
       return NS_ERROR_OUT_OF_MEMORY;
     aLists.Content()->AppendToTop(item);
   }
 
   return DisplaySelectionOverlay(aBuilder, aLists);
 }
 
 #ifdef ACCESSIBILITY
-NS_IMETHODIMP nsFileControlFrame::GetAccessible(nsIAccessible** aAccessible)
+already_AddRefed<nsAccessible>
+nsFileControlFrame::CreateAccessible()
 {
   // Accessible object exists just to hold onto its children, for later shutdown
   nsCOMPtr<nsIAccessibilityService> accService = do_GetService("@mozilla.org/accessibilityService;1");
   if (!accService)
-    return NS_ERROR_FAILURE;
+    return nsnull;
 
-  return accService->CreateHTMLGenericAccessible(static_cast<nsIFrame*>(this), aAccessible);
+  return accService->CreateHyperTextAccessible(mContent,
+                                               PresContext()->PresShell());
 }
 #endif
 
 PRInt32
 nsFileControlFrame::GetFileFilterFromAccept() const
 {
   nsAutoString accept;
   mContent->GetAttr(kNameSpaceID_None, nsGkAtoms::accept, accept);

--- a/layout/forms/nsFileControlFrame.h
+++ b/layout/forms/nsFileControlFrame.h
@@ -90,17 +90,17 @@ public:
 
 
 
   // nsIAnonymousContentCreator
   virtual nsresult CreateAnonymousContent(nsTArray<nsIContent*>& aElements);
   virtual void AppendAnonymousContentTo(nsBaseContentList& aElements);
 
 #ifdef ACCESSIBILITY
-  NS_IMETHOD GetAccessible(nsIAccessible** aAccessible);
+  virtual already_AddRefed<nsAccessible> CreateAccessible();
 #endif
 
   // create and destroy the static UploadLastDir object for remembering
   // which directory was last used on a site-by-site basis
   static void InitUploadLastDir();
   static void DestroyUploadLastDir();
 
   /**

--- a/layout/forms/nsGfxButtonControlFrame.cpp
+++ b/layout/forms/nsGfxButtonControlFrame.cpp
@@ -176,29 +176,16 @@ nsGfxButtonControlFrame::GetFormProperty
     rv = const_cast<nsGfxButtonControlFrame*>(this)->GetDefaultLabel(temp);
     aValue = temp;
   } else {
     aValue.Truncate();
   }
   return rv;
 }
 
-#ifdef ACCESSIBILITY
-NS_IMETHODIMP nsGfxButtonControlFrame::GetAccessible(nsIAccessible** aAccessible)
-{
-  nsCOMPtr<nsIAccessibilityService> accService = do_GetService("@mozilla.org/accessibilityService;1");
-
-  if (accService) {
-    return accService->CreateHTMLButtonAccessible(static_cast<nsIFrame*>(this), aAccessible);
-  }
-
-  return NS_ERROR_FAILURE;
-}
-#endif
-
 NS_QUERYFRAME_HEAD(nsGfxButtonControlFrame)
   NS_QUERYFRAME_ENTRY(nsIAnonymousContentCreator)
 NS_QUERYFRAME_TAIL_INHERITING(nsHTMLButtonControlFrame)
 
 // Initially we hardcoded the default strings here.
 // Next, we used html.css to store the default label for various types
 // of buttons. (nsGfxButtonControlFrame::DoNavQuirksReflow rev 1.20)
 // However, since html.css is not internationalized, we now grab the default

--- a/layout/forms/nsGfxButtonControlFrame.h
+++ b/layout/forms/nsGfxButtonControlFrame.h
@@ -61,21 +61,16 @@ public:
   nsGfxButtonControlFrame(nsStyleContext* aContext);
 
   virtual void DestroyFrom(nsIFrame* aDestructRoot);
 
   NS_IMETHOD HandleEvent(nsPresContext* aPresContext, 
                          nsGUIEvent* aEvent,
                          nsEventStatus* aEventStatus);
 
- 
-#ifdef ACCESSIBILITY
-  NS_IMETHOD GetAccessible(nsIAccessible** aAccessible);
-#endif
-
   virtual nsIAtom* GetType() const;
 
 #ifdef DEBUG
   NS_IMETHOD GetFrameName(nsAString& aResult) const;
 #endif
 
   NS_DECL_QUERYFRAME
 

--- a/layout/forms/nsGfxCheckboxControlFrame.cpp
+++ b/layout/forms/nsGfxCheckboxControlFrame.cpp
@@ -115,28 +115,28 @@ nsGfxCheckboxControlFrame::nsGfxCheckbox
 {
 }
 
 nsGfxCheckboxControlFrame::~nsGfxCheckboxControlFrame()
 {
 }
 
 #ifdef ACCESSIBILITY
-NS_IMETHODIMP
-nsGfxCheckboxControlFrame::GetAccessible(nsIAccessible** aAccessible)
+already_AddRefed<nsAccessible>
+nsGfxCheckboxControlFrame::CreateAccessible()
 {
   nsCOMPtr<nsIAccessibilityService> accService
     = do_GetService("@mozilla.org/accessibilityService;1");
 
   if (accService) {
-    return accService->CreateHTMLCheckboxAccessible(
-      static_cast<nsIFrame*>(this), aAccessible);
+    return accService->CreateHTMLCheckboxAccessible(mContent,
+                                                    PresContext()->PresShell());
   }
 
-  return NS_ERROR_FAILURE;
+  return nsnull;
 }
 #endif
 
 //------------------------------------------------------------
 NS_IMETHODIMP
 nsGfxCheckboxControlFrame::BuildDisplayList(nsDisplayListBuilder*   aBuilder,
                                             const nsRect&           aDirtyRect,
                                             const nsDisplayListSet& aLists)

--- a/layout/forms/nsGfxCheckboxControlFrame.h
+++ b/layout/forms/nsGfxCheckboxControlFrame.h
@@ -57,17 +57,17 @@ public:
   }
 #endif
 
   NS_IMETHOD BuildDisplayList(nsDisplayListBuilder*   aBuilder,
                               const nsRect&           aDirtyRect,
                               const nsDisplayListSet& aLists);
 
 #ifdef ACCESSIBILITY
-  NS_IMETHOD GetAccessible(nsIAccessible** aAccessible);
+  virtual already_AddRefed<nsAccessible> CreateAccessible();
 #endif
 
 protected:
 
   PRBool IsChecked();
   PRBool IsIndeterminate();
 };
 

--- a/layout/forms/nsGfxRadioControlFrame.cpp
+++ b/layout/forms/nsGfxRadioControlFrame.cpp
@@ -60,28 +60,28 @@ nsGfxRadioControlFrame::nsGfxRadioContro
 {
 }
 
 nsGfxRadioControlFrame::~nsGfxRadioControlFrame()
 {
 }
 
 #ifdef ACCESSIBILITY
-NS_IMETHODIMP
-nsGfxRadioControlFrame::GetAccessible(nsIAccessible** aAccessible)
+already_AddRefed<nsAccessible>
+nsGfxRadioControlFrame::CreateAccessible()
 {
   nsCOMPtr<nsIAccessibilityService> accService
     = do_GetService("@mozilla.org/accessibilityService;1");
 
   if (accService) {
-    return accService->CreateHTMLRadioButtonAccessible(
-      static_cast<nsIFrame*>(this), aAccessible);
+    return accService->CreateHTMLRadioButtonAccessible(mContent,
+                                                       PresContext()->PresShell());
   }
 
-  return NS_ERROR_FAILURE;
+  return nsnull;
 }
 #endif
 
 //--------------------------------------------------------------
 // Draw the dot for a non-native radio button in the checked state.
 static void
 PaintCheckedRadioButton(nsIFrame* aFrame,
                         nsIRenderingContext* aCtx,

--- a/layout/forms/nsGfxRadioControlFrame.h
+++ b/layout/forms/nsGfxRadioControlFrame.h
@@ -50,17 +50,17 @@ class nsGfxRadioControlFrame : public ns
 {
 public:
   nsGfxRadioControlFrame(nsStyleContext* aContext);
   ~nsGfxRadioControlFrame();
 
   NS_DECL_FRAMEARENA_HELPERS
 
 #ifdef ACCESSIBILITY
-  NS_IMETHOD GetAccessible(nsIAccessible** aAccessible);
+  virtual already_AddRefed<nsAccessible> CreateAccessible();
 #endif
 
   NS_IMETHOD BuildDisplayList(nsDisplayListBuilder*   aBuilder,
                               const nsRect&           aDirtyRect,
                               const nsDisplayListSet& aLists);
 };
 
 #endif

--- a/layout/forms/nsHTMLButtonControlFrame.cpp
+++ b/layout/forms/nsHTMLButtonControlFrame.cpp
@@ -105,31 +105,28 @@ nsHTMLButtonControlFrame::Init(
   return rv;
 }
 
 NS_QUERYFRAME_HEAD(nsHTMLButtonControlFrame)
   NS_QUERYFRAME_ENTRY(nsIFormControlFrame)
 NS_QUERYFRAME_TAIL_INHERITING(nsHTMLContainerFrame)
 
 #ifdef ACCESSIBILITY
-NS_IMETHODIMP nsHTMLButtonControlFrame::GetAccessible(nsIAccessible** aAccessible)
+already_AddRefed<nsAccessible>
+nsHTMLButtonControlFrame::CreateAccessible()
 {
   nsCOMPtr<nsIAccessibilityService> accService = do_GetService("@mozilla.org/accessibilityService;1");
 
   if (accService) {
-    nsIContent* content = GetContent();
-    nsCOMPtr<nsIDOMHTMLButtonElement> buttonElement(do_QueryInterface(content));
-    if (buttonElement) //If turned XBL-base form control off, the frame contains HTML 4 button
-      return accService->CreateHTML4ButtonAccessible(static_cast<nsIFrame*>(this), aAccessible);
-    nsCOMPtr<nsIDOMHTMLInputElement> inputElement(do_QueryInterface(content));
-    if (inputElement) //If turned XBL-base form control on, the frame contains normal HTML button
-      return accService->CreateHTMLButtonAccessible(static_cast<nsIFrame*>(this), aAccessible);
+    return IsInput() ?
+      accService->CreateHTMLButtonAccessible(mContent, PresContext()->PresShell()) :
+      accService->CreateHTML4ButtonAccessible(mContent, PresContext()->PresShell());
   }
 
-  return NS_ERROR_FAILURE;
+  return nsnull;
 }
 #endif
 
 nsIAtom*
 nsHTMLButtonControlFrame::GetType() const
 {
   return nsGkAtoms::HTMLButtonControlFrame;
 }

--- a/layout/forms/nsHTMLButtonControlFrame.h
+++ b/layout/forms/nsHTMLButtonControlFrame.h
@@ -99,17 +99,17 @@ public:
   NS_IMETHOD InsertFrames(nsIAtom*        aListName,
                           nsIFrame*       aPrevFrame,
                           nsFrameList&    aFrameList);
 
   NS_IMETHOD RemoveFrame(nsIAtom*        aListName,
                          nsIFrame*       aOldFrame);
 
 #ifdef ACCESSIBILITY
-  NS_IMETHOD GetAccessible(nsIAccessible** aAccessible);
+  virtual already_AddRefed<nsAccessible> CreateAccessible();
 #endif
 
   virtual nsIAtom* GetType() const;
   
 #ifdef DEBUG
   NS_IMETHOD GetFrameName(nsAString& aResult) const {
     return MakeFrameName(NS_LITERAL_STRING("HTMLButtonControl"), aResult);
   }

--- a/layout/forms/nsImageControlFrame.cpp
+++ b/layout/forms/nsImageControlFrame.cpp
@@ -91,17 +91,17 @@ public:
 
   NS_IMETHOD HandleEvent(nsPresContext* aPresContext, 
                          nsGUIEvent* aEvent,
                          nsEventStatus* aEventStatus);
 
   virtual nsIAtom* GetType() const;
 
 #ifdef ACCESSIBILITY
-  NS_IMETHOD GetAccessible(nsIAccessible** aAccessible);
+  virtual already_AddRefed<nsAccessible> CreateAccessible();
 #endif
 
 #ifdef DEBUG
   NS_IMETHOD GetFrameName(nsAString& aResult) const {
     return MakeFrameName(NS_LITERAL_STRING("ImageControl"), aResult);
   }
 #endif
 
@@ -159,30 +159,31 @@ nsImageControlFrame::Init(nsIContent*   
                                  IntPointDtorFunc);
 }
 
 NS_QUERYFRAME_HEAD(nsImageControlFrame)
   NS_QUERYFRAME_ENTRY(nsIFormControlFrame)
 NS_QUERYFRAME_TAIL_INHERITING(nsImageControlFrameSuper)
 
 #ifdef ACCESSIBILITY
-NS_IMETHODIMP nsImageControlFrame::GetAccessible(nsIAccessible** aAccessible)
+already_AddRefed<nsAccessible>
+nsImageControlFrame::CreateAccessible()
 {
   nsCOMPtr<nsIAccessibilityService> accService = do_GetService("@mozilla.org/accessibilityService;1");
 
   if (accService) {
     if (mContent->Tag() == nsGkAtoms::button) {
-      return accService->CreateHTML4ButtonAccessible(static_cast<nsIFrame*>(this), aAccessible);
+      return accService->CreateHTML4ButtonAccessible(mContent, PresContext()->PresShell());
     }
     else if (mContent->Tag() == nsGkAtoms::input) {
-      return accService->CreateHTMLButtonAccessible(static_cast<nsIFrame*>(this), aAccessible);
+      return accService->CreateHTMLButtonAccessible(mContent, PresContext()->PresShell());
     }
   }
 
-  return NS_ERROR_FAILURE;
+  return nsnull;
 }
 #endif
 
 nsIAtom*
 nsImageControlFrame::GetType() const
 {
   return nsGkAtoms::imageControlFrame; 
 }

--- a/layout/forms/nsListControlFrame.cpp
+++ b/layout/forms/nsListControlFrame.cpp
@@ -398,27 +398,27 @@ nsListControlFrame::InvalidateFocus()
 
 NS_QUERYFRAME_HEAD(nsListControlFrame)
   NS_QUERYFRAME_ENTRY(nsIFormControlFrame)
   NS_QUERYFRAME_ENTRY(nsIListControlFrame)
   NS_QUERYFRAME_ENTRY(nsISelectControlFrame)
 NS_QUERYFRAME_TAIL_INHERITING(nsHTMLScrollFrame)
 
 #ifdef ACCESSIBILITY
-NS_IMETHODIMP nsListControlFrame::GetAccessible(nsIAccessible** aAccessible)
+already_AddRefed<nsAccessible>
+nsListControlFrame::CreateAccessible()
 {
   nsCOMPtr<nsIAccessibilityService> accService = do_GetService("@mozilla.org/accessibilityService;1");
 
   if (accService) {
-    nsCOMPtr<nsIDOMNode> node = do_QueryInterface(mContent);
-    nsCOMPtr<nsIWeakReference> weakShell(do_GetWeakReference(PresContext()->PresShell()));
-    return accService->CreateHTMLListboxAccessible(node, weakShell, aAccessible);
+    return accService->CreateHTMLListboxAccessible(mContent,
+                                                   PresContext()->PresShell());
   }
 
-  return NS_ERROR_FAILURE;
+  return nsnull;
 }
 #endif
 
 static nscoord
 GetMaxOptionHeight(nsIFrame* aContainer)
 {
   nscoord result = 0;
   for (nsIFrame* option = aContainer->GetFirstChild(nsnull);

--- a/layout/forms/nsListControlFrame.h
+++ b/layout/forms/nsListControlFrame.h
@@ -139,17 +139,17 @@ public:
   virtual nsresult GetFormProperty(nsIAtom* aName, nsAString& aValue) const; 
   virtual void SetFocus(PRBool aOn = PR_TRUE, PRBool aRepaint = PR_FALSE);
 
   virtual nsGfxScrollFrameInner::ScrollbarStyles GetScrollbarStyles() const;
   virtual PRBool ShouldPropagateComputedHeightToScrolledContent() const;
 
     // for accessibility purposes
 #ifdef ACCESSIBILITY
-  NS_IMETHOD GetAccessible(nsIAccessible** aAccessible);
+  virtual already_AddRefed<nsAccessible> CreateAccessible();
 #endif
 
     // nsHTMLContainerFrame
   virtual PRIntn GetSkipSides() const;
 
     // nsIListControlFrame
   virtual void SetComboboxFrame(nsIFrame* aComboboxFrame);
   virtual PRInt32 GetSelectedIndex(); 

--- a/layout/forms/nsTextControlFrame.cpp
+++ b/layout/forms/nsTextControlFrame.cpp
@@ -137,25 +137,27 @@ NS_IMPL_FRAMEARENA_HELPERS(nsTextControl
 
 NS_QUERYFRAME_HEAD(nsTextControlFrame)
   NS_QUERYFRAME_ENTRY(nsIFormControlFrame)
   NS_QUERYFRAME_ENTRY(nsIAnonymousContentCreator)
   NS_QUERYFRAME_ENTRY(nsITextControlFrame)
 NS_QUERYFRAME_TAIL_INHERITING(nsBoxFrame)
 
 #ifdef ACCESSIBILITY
-NS_IMETHODIMP nsTextControlFrame::GetAccessible(nsIAccessible** aAccessible)
+already_AddRefed<nsAccessible>
+nsTextControlFrame::CreateAccessible()
 {
   nsCOMPtr<nsIAccessibilityService> accService = do_GetService("@mozilla.org/accessibilityService;1");
 
   if (accService) {
-    return accService->CreateHTMLTextFieldAccessible(static_cast<nsIFrame*>(this), aAccessible);
+    return accService->CreateHTMLTextFieldAccessible(mContent,
+                                                     PresContext()->PresShell());
   }
 
-  return NS_ERROR_FAILURE;
+  return nsnull;
 }
 #endif
 
 #ifdef DEBUG
 class EditorInitializerEntryTracker {
 public:
   explicit EditorInitializerEntryTracker(nsTextControlFrame &frame)
     : mFrame(frame)

--- a/layout/forms/nsTextControlFrame.h
+++ b/layout/forms/nsTextControlFrame.h
@@ -92,17 +92,17 @@ public:
   virtual nscoord GetBoxAscent(nsBoxLayoutState& aBoxLayoutState);
   virtual PRBool IsCollapsed(nsBoxLayoutState& aBoxLayoutState);
 
   DECL_DO_GLOBAL_REFLOW_COUNT_DSP(nsTextControlFrame, nsStackFrame)
 
   virtual PRBool IsLeaf() const;
   
 #ifdef ACCESSIBILITY
-  NS_IMETHOD GetAccessible(nsIAccessible** aAccessible);
+  virtual already_AddRefed<nsAccessible> CreateAccessible();
 #endif
 
 #ifdef NS_DEBUG
   NS_IMETHOD GetFrameName(nsAString& aResult) const
   {
     aResult.AssignLiteral("nsTextControlFrame");
     return NS_OK;
   }

--- a/layout/generic/nsBRFrame.cpp
+++ b/layout/generic/nsBRFrame.cpp
@@ -45,17 +45,16 @@
 #include "nsStyleConsts.h"
 #include "nsGkAtoms.h"
 #include "nsIFontMetrics.h"
 #include "nsIRenderingContext.h"
 #include "nsLayoutUtils.h"
 
 #ifdef ACCESSIBILITY
 #include "nsIServiceManager.h"
-#include "nsIAccessible.h"
 #include "nsIAccessibilityService.h"
 #endif
 
 //FOR SELECTION
 #include "nsIContent.h"
 #include "nsFrameSelection.h"
 //END INCLUDES FOR SELECTION
 
@@ -85,18 +84,18 @@ public:
   virtual nsIAtom* GetType() const;
 
   virtual PRBool IsFrameOfType(PRUint32 aFlags) const
   {
     return nsFrame::IsFrameOfType(aFlags & ~(nsIFrame::eReplaced |
                                              nsIFrame::eLineParticipant));
   }
 
-#ifdef ACCESSIBILITY  
-  NS_IMETHOD GetAccessible(nsIAccessible** aAccessible);
+#ifdef ACCESSIBILITY
+  virtual already_AddRefed<nsAccessible> CreateAccessible();
 #endif
 
 protected:
   BRFrame(nsStyleContext* aContext) : nsFrame(aContext) {}
   virtual ~BRFrame();
 };
 
 nsIFrame*
@@ -264,25 +263,28 @@ BRFrame::PeekOffsetWord(PRBool aForward,
                         PRInt32* aOffset, PeekWordState* aState)
 {
   NS_ASSERTION (aOffset && *aOffset <= 1, "aOffset out of range");
   // Keep going. The actual line jumping will stop us.
   return PR_FALSE;
 }
 
 #ifdef ACCESSIBILITY
-NS_IMETHODIMP BRFrame::GetAccessible(nsIAccessible** aAccessible)
+already_AddRefed<nsAccessible>
+BRFrame::CreateAccessible()
 {
-  NS_ENSURE_TRUE(mContent, NS_ERROR_FAILURE);
   nsCOMPtr<nsIAccessibilityService> accService = do_GetService("@mozilla.org/accessibilityService;1");
-  NS_ENSURE_TRUE(accService, NS_ERROR_FAILURE);
+  if (!accService) {
+    return nsnull;
+  }
   nsIContent *parent = mContent->GetParent();
   if (parent &&
       parent->IsRootOfNativeAnonymousSubtree() &&
       parent->GetChildCount() == 1) {
     // This <br> is the only node in a text control, therefore it is the hacky
     // "bogus node" used when there is no text in the control
-    return NS_ERROR_FAILURE;
+    return nsnull;
   }
-  return accService->CreateHTMLBRAccessible(this, aAccessible);
+  return accService->CreateHTMLBRAccessible(mContent,
+                                            PresContext()->PresShell());
 }
 #endif
 

--- a/layout/generic/nsBlockFrame.cpp
+++ b/layout/generic/nsBlockFrame.cpp
@@ -6120,69 +6120,72 @@ nsBlockFrame::BuildDisplayList(nsDisplay
     printf("%s\n", buf);
   }
 #endif
 
   return rv;
 }
 
 #ifdef ACCESSIBILITY
-NS_IMETHODIMP nsBlockFrame::GetAccessible(nsIAccessible** aAccessible)
+already_AddRefed<nsAccessible>
+nsBlockFrame::CreateAccessible()
 {
-  *aAccessible = nsnull;
   nsCOMPtr<nsIAccessibilityService> accService = 
     do_GetService("@mozilla.org/accessibilityService;1");
-  NS_ENSURE_TRUE(accService, NS_ERROR_FAILURE);
+  if (!accService) {
+    return nsnull;
+  }
+
+  nsPresContext* presContext = PresContext();
 
   // block frame may be for <hr>
   if (mContent->Tag() == nsGkAtoms::hr) {
-    return accService->CreateHTMLHRAccessible(static_cast<nsIFrame*>(this), aAccessible);
-  }
-
-  nsPresContext *aPresContext = PresContext();
-  if (!mBullet || !aPresContext) {
+    return accService->CreateHTMLHRAccessible(mContent,
+                                              presContext->PresShell());
+  }
+
+  if (!mBullet || !presContext) {
     if (!mContent->GetParent()) {
       // Don't create accessible objects for the root content node, they are redundant with
       // the nsDocAccessible object created with the document node
-      return NS_ERROR_FAILURE;
+      return nsnull;
     }
     
     nsCOMPtr<nsIDOMHTMLDocument> htmlDoc =
       do_QueryInterface(mContent->GetDocument());
     if (htmlDoc) {
       nsCOMPtr<nsIDOMHTMLElement> body;
       htmlDoc->GetBody(getter_AddRefs(body));
       if (SameCOMIdentity(body, mContent)) {
         // Don't create accessible objects for the body, they are redundant with
         // the nsDocAccessible object created with the document node
-        return NS_ERROR_FAILURE;
+        return nsnull;
       }
     }
 
     // Not a bullet, treat as normal HTML container
-    return accService->CreateHyperTextAccessible(static_cast<nsIFrame*>(this), aAccessible);
+    return accService->CreateHyperTextAccessible(mContent,
+                                                 presContext->PresShell());
   }
 
   // Create special list bullet accessible
   const nsStyleList* myList = GetStyleList();
   nsAutoString bulletText;
   if (myList->GetListStyleImage() ||
       myList->mListStyleType == NS_STYLE_LIST_STYLE_DISC ||
       myList->mListStyleType == NS_STYLE_LIST_STYLE_CIRCLE ||
       myList->mListStyleType == NS_STYLE_LIST_STYLE_SQUARE) {
     bulletText.Assign(PRUnichar(0x2022));; // Unicode bullet character
   }
   else if (myList->mListStyleType != NS_STYLE_LIST_STYLE_NONE) {
     mBullet->GetListItemText(*myList, bulletText);
   }
 
-  return accService->CreateHTMLLIAccessible(static_cast<nsIFrame*>(this), 
-                                            static_cast<nsIFrame*>(mBullet), 
-                                            bulletText,
-                                            aAccessible);
+  return accService->CreateHTMLLIAccessible(mContent, presContext->PresShell(),
+                                            bulletText);
 }
 #endif
 
 void nsBlockFrame::ClearLineCursor()
 {
   if (!(GetStateBits() & NS_BLOCK_HAS_LINE_CURSOR)) {
     return;
   }

--- a/layout/generic/nsBlockFrame.h
+++ b/layout/generic/nsBlockFrame.h
@@ -197,17 +197,17 @@ public:
 
 #ifdef DEBUG
   NS_IMETHOD List(FILE* out, PRInt32 aIndent) const;
   NS_IMETHOD_(nsFrameState) GetDebugStateBits() const;
   NS_IMETHOD GetFrameName(nsAString& aResult) const;
 #endif
 
 #ifdef ACCESSIBILITY
-  NS_IMETHOD GetAccessible(nsIAccessible** aAccessible);
+  virtual already_AddRefed<nsAccessible> CreateAccessible();
 #endif
 
   // line cursor methods to speed up searching for the line(s)
   // containing a point. The basic idea is that we set the cursor
   // property if the lines' combinedArea.ys and combinedArea.yMosts
   // are non-decreasing (considering only non-empty combinedAreas;
   // empty combinedAreas never participate in event handling or
   // painting), and the block has sufficient number of lines. The

--- a/layout/generic/nsFrame.cpp
+++ b/layout/generic/nsFrame.cpp
@@ -5509,20 +5509,20 @@ nsIView* nsIFrame::GetClosestView(nsPoin
 nsFrame::ChildIsDirty(nsIFrame* aChild)
 {
   NS_NOTREACHED("should never be called on a frame that doesn't inherit from "
                 "nsContainerFrame");
 }
 
 
 #ifdef ACCESSIBILITY
-NS_IMETHODIMP
-nsFrame::GetAccessible(nsIAccessible** aAccessible)
-{
-  return NS_ERROR_NOT_IMPLEMENTED;
+already_AddRefed<nsAccessible>
+nsFrame::CreateAccessible()
+{
+  return nsnull;
 }
 #endif
 
 NS_DECLARE_FRAME_PROPERTY(OverflowAreaProperty, nsIFrame::DestroyRect)
 
 void
 nsIFrame::ClearOverflowRect()
 {

--- a/layout/generic/nsFrame.h
+++ b/layout/generic/nsFrame.h
@@ -255,17 +255,17 @@ public:
                                      PRBool aIsKeyboardSelect);
 
   NS_IMETHOD  CheckVisibility(nsPresContext* aContext, PRInt32 aStartIndex, PRInt32 aEndIndex, PRBool aRecurse, PRBool *aFinished, PRBool *_retval);
 
   NS_IMETHOD  GetOffsets(PRInt32 &aStart, PRInt32 &aEnd) const;
   virtual void ChildIsDirty(nsIFrame* aChild);
 
 #ifdef ACCESSIBILITY
-  NS_IMETHOD  GetAccessible(nsIAccessible** aAccessible);
+  virtual already_AddRefed<nsAccessible> CreateAccessible();
 #endif
 
   NS_IMETHOD GetParentStyleContextFrame(nsPresContext* aPresContext,
                                         nsIFrame**      aProviderFrame,
                                         PRBool*         aIsChild);
 
   virtual PRBool IsEmpty();
   virtual PRBool IsSelfEmpty();

--- a/layout/generic/nsFrameFrame.cpp
+++ b/layout/generic/nsFrameFrame.cpp
@@ -170,17 +170,17 @@ public:
 
   // if the content is "visibility:hidden", then just hide the view
   // and all our contents. We don't extend "visibility:hidden" to
   // the child content ourselves, since it belongs to a different
   // document and CSS doesn't inherit in there.
   virtual PRBool SupportsVisibilityHidden() { return PR_FALSE; }
 
 #ifdef ACCESSIBILITY
-  NS_IMETHOD GetAccessible(nsIAccessible** aAccessible);
+  virtual already_AddRefed<nsAccessible> CreateAccessible();
 #endif
 
   // nsIFrameFrame
   NS_IMETHOD GetDocShell(nsIDocShell **aDocShell);
   NS_IMETHOD BeginSwapDocShells(nsIFrame* aOther);
   virtual void EndSwapDocShells(nsIFrame* aOther);
 
   // nsIReflowCallback
@@ -230,26 +230,23 @@ nsSubDocumentFrame::nsSubDocumentFrame(n
   , mIsInline(PR_FALSE)
   , mPostedReflowCallback(PR_FALSE)
   , mDidCreateDoc(PR_FALSE)
   , mCallingShow(PR_FALSE)
 {
 }
 
 #ifdef ACCESSIBILITY
-NS_IMETHODIMP nsSubDocumentFrame::GetAccessible(nsIAccessible** aAccessible)
+already_AddRefed<nsAccessible>
+nsSubDocumentFrame::CreateAccessible()
 {
   nsCOMPtr<nsIAccessibilityService> accService = do_GetService("@mozilla.org/accessibilityService;1");
-
-  if (accService) {
-    nsCOMPtr<nsIDOMNode> node = do_QueryInterface(mContent);
-    return accService->CreateOuterDocAccessible(node, aAccessible);
-  }
-
-  return NS_ERROR_FAILURE;
+  return accService ?
+    accService->CreateOuterDocAccessible(mContent, PresContext()->PresShell()) :
+    nsnull;
 }
 #endif
 
 NS_QUERYFRAME_HEAD(nsSubDocumentFrame)
   NS_QUERYFRAME_ENTRY(nsIFrameFrame)
 NS_QUERYFRAME_TAIL_INHERITING(nsLeafFrame)
 
 class AsyncFrameInit : public nsRunnable

--- a/layout/generic/nsGfxScrollFrame.cpp
+++ b/layout/generic/nsGfxScrollFrame.cpp
@@ -879,30 +879,31 @@ nsHTMLScrollFrame::Reflow(nsPresContext*
 NS_IMETHODIMP
 nsHTMLScrollFrame::GetFrameName(nsAString& aResult) const
 {
   return MakeFrameName(NS_LITERAL_STRING("HTMLScroll"), aResult);
 }
 #endif
 
 #ifdef ACCESSIBILITY
-NS_IMETHODIMP nsHTMLScrollFrame::GetAccessible(nsIAccessible** aAccessible)
+already_AddRefed<nsAccessible>
+nsHTMLScrollFrame::CreateAccessible()
 {
-  *aAccessible = nsnull;
   if (!IsFocusable()) {
-    return NS_OK;
+    return nsnull;
   }
   // Focusable via CSS, so needs to be in accessibility hierarchy
   nsCOMPtr<nsIAccessibilityService> accService = do_GetService("@mozilla.org/accessibilityService;1");
 
   if (accService) {
-    return accService->CreateHTMLGenericAccessible(static_cast<nsIFrame*>(this), aAccessible);
+    return accService->CreateHyperTextAccessible(mContent,
+                                                 PresContext()->PresShell());
   }
 
-  return NS_ERROR_FAILURE;
+  return nsnull;
 }
 #endif
 
 NS_QUERYFRAME_HEAD(nsHTMLScrollFrame)
   NS_QUERYFRAME_ENTRY(nsIAnonymousContentCreator)
   NS_QUERYFRAME_ENTRY(nsIScrollableFrame)
   NS_QUERYFRAME_ENTRY(nsIStatefulFrame)
 NS_QUERYFRAME_TAIL_INHERITING(nsHTMLContainerFrame)

--- a/layout/generic/nsGfxScrollFrame.h
+++ b/layout/generic/nsGfxScrollFrame.h
@@ -462,17 +462,17 @@ public:
   
 #ifdef NS_DEBUG
   NS_IMETHOD GetFrameName(nsAString& aResult) const;
 #endif
 
   PRBool DidHistoryRestore() { return mInner.mDidHistoryRestore; }
 
 #ifdef ACCESSIBILITY
-  NS_IMETHOD GetAccessible(nsIAccessible** aAccessible);
+  virtual already_AddRefed<nsAccessible> CreateAccessible();
 #endif
 
 protected:
   nsHTMLScrollFrame(nsIPresShell* aShell, nsStyleContext* aContext, PRBool aIsRoot);
   virtual PRIntn GetSkipSides() const;
   
   void SetSuppressScrollbarUpdate(PRBool aSuppress) {
     mInner.mSupppressScrollbarUpdate = aSuppress;

--- a/layout/generic/nsHTMLCanvasFrame.cpp
+++ b/layout/generic/nsHTMLCanvasFrame.cpp
@@ -307,20 +307,20 @@ nsHTMLCanvasFrame::GetContinuationOffset
     }
     offset -= mBorderPadding.top;
     offset = NS_MAX(0, offset);
   }
   return offset;
 }
 
 #ifdef ACCESSIBILITY
-NS_IMETHODIMP
-nsHTMLCanvasFrame::GetAccessible(nsIAccessible** aAccessible)
+already_AddRefed<nsAccessible>
+nsHTMLCanvasFrame::CreateAccessible()
 {
-  return NS_ERROR_FAILURE;
+  return nsnull;
 }
 #endif
 
 #ifdef DEBUG
 NS_IMETHODIMP
 nsHTMLCanvasFrame::GetFrameName(nsAString& aResult) const
 {
   return MakeFrameName(NS_LITERAL_STRING("HTMLCanvas"), aResult);

--- a/layout/generic/nsHTMLCanvasFrame.h
+++ b/layout/generic/nsHTMLCanvasFrame.h
@@ -83,17 +83,17 @@ public:
   NS_IMETHOD Reflow(nsPresContext*          aPresContext,
                     nsHTMLReflowMetrics&     aDesiredSize,
                     const nsHTMLReflowState& aReflowState,
                     nsReflowStatus&          aStatus);
   
   nsRect GetInnerArea() const;
 
 #ifdef ACCESSIBILITY
-  NS_IMETHOD GetAccessible(nsIAccessible** aAccessible);
+  virtual already_AddRefed<nsAccessible> CreateAccessible();
 #endif
 
   virtual nsIAtom* GetType() const;
 
   virtual PRBool IsFrameOfType(PRUint32 aFlags) const
   {
     return nsSplittableFrame::IsFrameOfType(aFlags & ~(nsIFrame::eReplaced));
   }

--- a/layout/generic/nsIFrame.h
+++ b/layout/generic/nsIFrame.h
@@ -85,17 +85,17 @@ class nsIRenderingContext;
 class nsIView;
 class nsIWidget;
 class nsIDOMRange;
 class nsISelectionController;
 class nsBoxLayoutState;
 class nsIBoxLayout;
 class nsILineIterator;
 #ifdef ACCESSIBILITY
-class nsIAccessible;
+class nsAccessible;
 #endif
 class nsDisplayListBuilder;
 class nsDisplayListSet;
 class nsDisplayList;
 class gfxSkipChars;
 class gfxSkipCharsIterator;
 class gfxContext;
 class nsLineList_iterator;
@@ -2056,17 +2056,17 @@ public:
   /**
    * Called to retrieve this frame's accessible.
    * If this frame implements Accessibility return a valid accessible
    * If not return NS_ERROR_NOT_IMPLEMENTED.
    * Note: nsAccessible must be refcountable. Do not implement directly on your frame
    * Use a mediatior of some kind.
    */
 #ifdef ACCESSIBILITY
-  NS_IMETHOD GetAccessible(nsIAccessible** aAccessible) = 0;
+  virtual already_AddRefed<nsAccessible> CreateAccessible() = 0;
 #endif
 
   /**
    * Get the frame whose style context should be the parent of this
    * frame's style context (i.e., provide the parent style context).
    * This frame must either be an ancestor of this frame or a child.  If
    * this frame returns a child frame, then the child frame must be sure
    * to return a grandparent or higher!

--- a/layout/generic/nsImageFrame.cpp
+++ b/layout/generic/nsImageFrame.cpp
@@ -178,25 +178,27 @@ nsImageFrame::~nsImageFrame()
 {
 }
 
 NS_QUERYFRAME_HEAD(nsImageFrame)
   NS_QUERYFRAME_ENTRY(nsIImageFrame)
 NS_QUERYFRAME_TAIL_INHERITING(ImageFrameSuper)
 
 #ifdef ACCESSIBILITY
-NS_IMETHODIMP nsImageFrame::GetAccessible(nsIAccessible** aAccessible)
+already_AddRefed<nsAccessible>
+nsImageFrame::CreateAccessible()
 {
   nsCOMPtr<nsIAccessibilityService> accService = do_GetService("@mozilla.org/accessibilityService;1");
 
   if (accService) {
-    return accService->CreateHTMLImageAccessible(static_cast<nsIFrame*>(this), aAccessible);
+    return accService->CreateHTMLImageAccessible(mContent,
+                                                 PresContext()->PresShell());
   }
 
-  return NS_ERROR_FAILURE;
+  return nsnull;
 }
 #endif
 
 void
 nsImageFrame::DestroyFrom(nsIFrame* aDestructRoot)
 {
   // Tell our image map, if there is one, to clean up
   // This causes the nsImageMap to unregister itself as

--- a/layout/generic/nsImageFrame.h
+++ b/layout/generic/nsImageFrame.h
@@ -123,17 +123,17 @@ public:
                         nsEventStatus* aEventStatus);
   NS_IMETHOD GetCursor(const nsPoint& aPoint,
                        nsIFrame::Cursor& aCursor);
   NS_IMETHOD AttributeChanged(PRInt32 aNameSpaceID,
                               nsIAtom* aAttribute,
                               PRInt32 aModType);
 
 #ifdef ACCESSIBILITY
-  NS_IMETHOD GetAccessible(nsIAccessible** aAccessible);
+  virtual already_AddRefed<nsAccessible> CreateAccessible();
 #endif
 
   virtual nsIAtom* GetType() const;
 
   virtual PRBool IsFrameOfType(PRUint32 aFlags) const
   {
     return ImageFrameSuper::IsFrameOfType(aFlags & ~(nsIFrame::eReplaced));
   }

--- a/layout/generic/nsInlineFrame.cpp
+++ b/layout/generic/nsInlineFrame.cpp
@@ -941,37 +941,40 @@ nsInlineFrame::GetSkipSides() const
       }
     }
   }
 
   return skip;
 }
 
 #ifdef ACCESSIBILITY
-NS_IMETHODIMP nsInlineFrame::GetAccessible(nsIAccessible** aAccessible)
+already_AddRefed<nsAccessible>
+nsInlineFrame::CreateAccessible()
 {
   // Broken image accessibles are created here, because layout
   // replaces the image or image control frame with an inline frame
-  *aAccessible = nsnull;
   nsIAtom *tagAtom = mContent->Tag();
   if ((tagAtom == nsGkAtoms::img || tagAtom == nsGkAtoms::input || 
        tagAtom == nsGkAtoms::label) && mContent->IsHTML()) {
     // Only get accessibility service if we're going to use it
     nsCOMPtr<nsIAccessibilityService> accService(do_GetService("@mozilla.org/accessibilityService;1"));
     if (!accService)
-      return NS_ERROR_FAILURE;
+      return nsnull;
     if (tagAtom == nsGkAtoms::input)  // Broken <input type=image ... />
-      return accService->CreateHTMLButtonAccessible(static_cast<nsIFrame*>(this), aAccessible);
+      return accService->CreateHTMLButtonAccessible(mContent,
+                                                    PresContext()->PresShell());
     else if (tagAtom == nsGkAtoms::img)  // Create accessible for broken <img>
-      return accService->CreateHTMLImageAccessible(static_cast<nsIFrame*>(this), aAccessible);
+      return accService->CreateHTMLImageAccessible(mContent,
+                                                   PresContext()->PresShell());
     else if (tagAtom == nsGkAtoms::label)  // Creat accessible for <label>
-      return accService->CreateHTMLLabelAccessible(static_cast<nsIFrame*>(this), aAccessible);
+      return accService->CreateHTMLLabelAccessible(mContent,
+                                                   PresContext()->PresShell());
   }
 
-  return NS_ERROR_FAILURE;
+  return nsnull;
 }
 #endif
 
 //////////////////////////////////////////////////////////////////////
 
 // nsLineFrame implementation
 
 nsIFrame*

--- a/layout/generic/nsInlineFrame.h
+++ b/layout/generic/nsInlineFrame.h
@@ -75,17 +75,17 @@ public:
   friend nsIFrame* NS_NewInlineFrame(nsIPresShell* aPresShell, nsStyleContext* aContext);
 
   // nsIFrame overrides
   NS_IMETHOD BuildDisplayList(nsDisplayListBuilder*   aBuilder,
                               const nsRect&           aDirtyRect,
                               const nsDisplayListSet& aLists);
 
 #ifdef ACCESSIBILITY
-  NS_IMETHODIMP GetAccessible(nsIAccessible** aAccessible);
+  virtual already_AddRefed<nsAccessible> CreateAccessible();
 #endif
 
 #ifdef DEBUG
   NS_IMETHOD GetFrameName(nsAString& aResult) const;
 #endif
   virtual nsIAtom* GetType() const;
 
   virtual PRBool IsFrameOfType(PRUint32 aFlags) const

--- a/layout/generic/nsObjectFrame.cpp
+++ b/layout/generic/nsObjectFrame.cpp
@@ -576,25 +576,24 @@ nsObjectFrame::~nsObjectFrame()
          ("nsObjectFrame %p deleted\n", this));
 }
 
 NS_QUERYFRAME_HEAD(nsObjectFrame)
   NS_QUERYFRAME_ENTRY(nsIObjectFrame)
 NS_QUERYFRAME_TAIL_INHERITING(nsObjectFrameSuper)
 
 #ifdef ACCESSIBILITY
-NS_IMETHODIMP nsObjectFrame::GetAccessible(nsIAccessible** aAccessible)
+already_AddRefed<nsAccessible>
+nsObjectFrame::CreateAccessible()
 {
   nsCOMPtr<nsIAccessibilityService> accService = do_GetService("@mozilla.org/accessibilityService;1");
-
-  if (accService) {
-    return accService->CreateHTMLObjectFrameAccessible(this, aAccessible);
-  }
-
-  return NS_ERROR_FAILURE;
+  return accService ?
+    accService->CreateHTMLObjectFrameAccessible(this, mContent,
+                                                PresContext()->PresShell()) :
+    nsnull;
 }
 
 #ifdef XP_WIN
 NS_IMETHODIMP nsObjectFrame::GetPluginPort(HWND *aPort)
 {
   *aPort = (HWND) mInstanceOwner->GetPluginPortFromWidget();
   return NS_OK;
 }

--- a/layout/generic/nsObjectFrame.h
+++ b/layout/generic/nsObjectFrame.h
@@ -144,17 +144,17 @@ public:
   void GetEmptyClipConfiguration(nsTArray<nsIWidget::Configuration>* aConfigurations) {
     ComputeWidgetGeometry(nsRegion(), nsPoint(0,0), aConfigurations);
   }
 
   void DidSetWidgetGeometry();
 
   // accessibility support
 #ifdef ACCESSIBILITY
-  NS_IMETHOD GetAccessible(nsIAccessible** aAccessible);
+  virtual already_AddRefed<nsAccessible> CreateAccessible();
 #ifdef XP_WIN
   NS_IMETHOD GetPluginPort(HWND *aPort);
 #endif
 #endif
 
   //local methods
   nsresult CreateWidget(nscoord aWidth, nscoord aHeight, PRBool aViewOnly);
 

--- a/layout/generic/nsPlaceholderFrame.h
+++ b/layout/generic/nsPlaceholderFrame.h
@@ -161,21 +161,21 @@ public:
 #endif
 
   virtual PRBool IsEmpty() { return PR_TRUE; }
   virtual PRBool IsSelfEmpty() { return PR_TRUE; }
 
   virtual PRBool CanContinueTextRun() const;
 
 #ifdef ACCESSIBILITY
-  NS_IMETHOD  GetAccessible(nsIAccessible** aAccessible)
+  virtual already_AddRefed<nsAccessible> CreateAccessible()
   {
-    nsIFrame *realFrame = GetRealFrameForPlaceholder(this);
-    return realFrame ? realFrame->GetAccessible(aAccessible) :
-                       nsFrame::GetAccessible(aAccessible);
+    nsIFrame* realFrame = GetRealFrameForPlaceholder(this);
+    return realFrame ? realFrame->CreateAccessible() :
+                       nsFrame::CreateAccessible();
   }
 #endif
 
   NS_IMETHOD GetParentStyleContextFrame(nsPresContext* aPresContext,
                                         nsIFrame**      aProviderFrame,
                                         PRBool*         aIsChild);
   /**
    * @return the out-of-flow for aFrame if aFrame is a placeholder; otherwise

--- a/layout/generic/nsTextFrame.h
+++ b/layout/generic/nsTextFrame.h
@@ -211,17 +211,17 @@ public:
    * Call this only after reflow the frame. Returns true if non-collapsed
    * characters are present.
    */
   PRBool HasNoncollapsedCharacters() const {
     return (GetStateBits() & TEXT_HAS_NONCOLLAPSED_CHARACTERS) != 0;
   }
   
 #ifdef ACCESSIBILITY
-  NS_IMETHOD GetAccessible(nsIAccessible** aAccessible);
+  virtual already_AddRefed<nsAccessible> CreateAccessible();
 #endif
   
   virtual void MarkIntrinsicWidthsDirty();
   virtual nscoord GetMinWidth(nsIRenderingContext *aRenderingContext);
   virtual nscoord GetPrefWidth(nsIRenderingContext *aRenderingContext);
   virtual void AddInlineMinWidth(nsIRenderingContext *aRenderingContext,
                                  InlineMinWidthData *aData);
   virtual void AddInlinePrefWidth(nsIRenderingContext *aRenderingContext,

--- a/layout/generic/nsTextFrameThebes.cpp
+++ b/layout/generic/nsTextFrameThebes.cpp
@@ -99,17 +99,16 @@
 #include "nsLineBreaker.h"
 #include "nsIWordBreaker.h"
 #include "nsGenericDOMDataNode.h"
 
 #include "nsILineIterator.h"
 
 #include "nsIServiceManager.h"
 #ifdef ACCESSIBILITY
-#include "nsIAccessible.h"
 #include "nsIAccessibilityService.h"
 #endif
 #include "nsAutoPtr.h"
 
 #include "nsBidiFrames.h"
 #include "nsBidiPresUtils.h"
 #include "nsBidiUtils.h"
 
@@ -3383,32 +3382,34 @@ nsTextPaintStyle::GetResolvedForeColor(n
     actualBGColor = mFrameBackgroundColor;
   }
   return Get40PercentColor(aDefaultForeColor, actualBGColor);
 }
 
 //-----------------------------------------------------------------------------
 
 #ifdef ACCESSIBILITY
-NS_IMETHODIMP nsTextFrame::GetAccessible(nsIAccessible** aAccessible)
+already_AddRefed<nsAccessible>
+nsTextFrame::CreateAccessible()
 {
   if (IsEmpty()) {
     nsAutoString renderedWhitespace;
     GetRenderedText(&renderedWhitespace, nsnull, nsnull, 0, 1);
     if (renderedWhitespace.IsEmpty()) {
-      return NS_ERROR_FAILURE;
+      return nsnull;
     }
   }
 
   nsCOMPtr<nsIAccessibilityService> accService = do_GetService("@mozilla.org/accessibilityService;1");
 
   if (accService) {
-    return accService->CreateHTMLTextAccessible(static_cast<nsIFrame*>(this), aAccessible);
-  }
-  return NS_ERROR_FAILURE;
+    return accService->CreateHTMLTextAccessible(mContent,
+                                                PresContext()->PresShell());
+  }
+  return nsnull;
 }
 #endif
 
 
 //-----------------------------------------------------------------------------
 NS_IMETHODIMP
 nsTextFrame::Init(nsIContent*      aContent,
                   nsIFrame*        aParent,

--- a/layout/generic/nsVideoFrame.cpp
+++ b/layout/generic/nsVideoFrame.cpp
@@ -55,17 +55,16 @@
 #include "nsContentCreatorFunctions.h"
 #include "nsBoxLayoutState.h"
 #include "nsBoxFrame.h"
 #include "nsImageFrame.h"
 #include "nsIImageLoadingContent.h"
 
 #ifdef ACCESSIBILITY
 #include "nsIServiceManager.h"
-#include "nsIAccessible.h"
 #include "nsIAccessibilityService.h"
 #endif
 
 using namespace mozilla::layers;
 
 nsIFrame*
 NS_NewHTMLVideoFrame(nsIPresShell* aPresShell, nsStyleContext* aContext)
 {
@@ -414,25 +413,24 @@ nsVideoFrame::BuildDisplayList(nsDisplay
 
 nsIAtom*
 nsVideoFrame::GetType() const
 {
   return nsGkAtoms::HTMLVideoFrame;
 }
 
 #ifdef ACCESSIBILITY
-NS_IMETHODIMP
-nsVideoFrame::GetAccessible(nsIAccessible** aAccessible)
+already_AddRefed<nsAccessible>
+nsVideoFrame::CreateAccessible()
 {
   nsCOMPtr<nsIAccessibilityService> accService =
     do_GetService("@mozilla.org/accessibilityService;1");
-  NS_ENSURE_STATE(accService);
-
-  return accService->CreateHTMLMediaAccessible(static_cast<nsIFrame*>(this),
-                                               aAccessible);
+  return accService ?
+    accService->CreateHTMLMediaAccessible(mContent, PresContext()->PresShell()) :
+    nsnull;
 }
 #endif
 
 #ifdef DEBUG
 NS_IMETHODIMP
 nsVideoFrame::GetFrameName(nsAString& aResult) const
 {
   return MakeFrameName(NS_LITERAL_STRING("HTMLVideo"), aResult);

--- a/layout/generic/nsVideoFrame.h
+++ b/layout/generic/nsVideoFrame.h
@@ -87,17 +87,17 @@ public:
   virtual PRBool IsLeaf() const;
 
   NS_IMETHOD Reflow(nsPresContext*          aPresContext,
                     nsHTMLReflowMetrics&     aDesiredSize,
                     const nsHTMLReflowState& aReflowState,
                     nsReflowStatus&          aStatus);
 
 #ifdef ACCESSIBILITY
-  NS_IMETHOD GetAccessible(nsIAccessible** aAccessible);
+  virtual already_AddRefed<nsAccessible> CreateAccessible();
 #endif
 
   virtual nsIAtom* GetType() const;
 
   virtual PRBool IsFrameOfType(PRUint32 aFlags) const
   {
     return nsSplittableFrame::IsFrameOfType(aFlags & ~(nsIFrame::eReplaced));
   }

--- a/layout/tables/nsTableCellFrame.cpp
+++ b/layout/tables/nsTableCellFrame.cpp
@@ -995,25 +995,27 @@ NS_METHOD nsTableCellFrame::Reflow(nsPre
 
 NS_QUERYFRAME_HEAD(nsTableCellFrame)
   NS_QUERYFRAME_ENTRY(nsTableCellFrame)
   NS_QUERYFRAME_ENTRY(nsITableCellLayout)
   NS_QUERYFRAME_ENTRY(nsIPercentHeightObserver)
 NS_QUERYFRAME_TAIL_INHERITING(nsHTMLContainerFrame)
 
 #ifdef ACCESSIBILITY
-NS_IMETHODIMP nsTableCellFrame::GetAccessible(nsIAccessible** aAccessible)
+already_AddRefed<nsAccessible>
+nsTableCellFrame::CreateAccessible()
 {
   nsCOMPtr<nsIAccessibilityService> accService = do_GetService("@mozilla.org/accessibilityService;1");
 
   if (accService) {
-    return accService->CreateHTMLTableCellAccessible(static_cast<nsIFrame*>(this), aAccessible);
+    return accService->CreateHTMLTableCellAccessible(mContent,
+                                                     PresContext()->PresShell());
   }
 
-  return NS_ERROR_FAILURE;
+  return nsnull;
 }
 #endif
 
 /* This is primarily for editor access via nsITableLayout */
 NS_IMETHODIMP
 nsTableCellFrame::GetCellIndexes(PRInt32 &aRowIndex, PRInt32 &aColIndex)
 {
   nsresult res = GetRowIndex(aRowIndex);

--- a/layout/tables/nsTableCellFrame.h
+++ b/layout/tables/nsTableCellFrame.h
@@ -81,17 +81,17 @@ public:
   nsTableCellFrame(nsStyleContext* aContext);
   ~nsTableCellFrame();
 
   NS_IMETHOD Init(nsIContent*      aContent,
                   nsIFrame*        aParent,
                   nsIFrame*        aPrevInFlow);
 
 #ifdef ACCESSIBILITY
-  NS_IMETHOD GetAccessible(nsIAccessible** aAccessible);
+  virtual already_AddRefed<nsAccessible> CreateAccessible();
 #endif
 
   NS_IMETHOD  AttributeChanged(PRInt32         aNameSpaceID,
                                nsIAtom*        aAttribute,
                                PRInt32         aModType);
 
   /** @see nsIFrame::DidSetStyleContext */
   virtual void DidSetStyleContext(nsStyleContext* aOldStyleContext);

--- a/layout/tables/nsTableOuterFrame.cpp
+++ b/layout/tables/nsTableOuterFrame.cpp
@@ -141,27 +141,28 @@ nsTableCaptionFrame::GetParentStyleConte
   }
 
   NS_NOTREACHED("Where is our inner table frame?");
   return nsBlockFrame::GetParentStyleContextFrame(aPresContext, aProviderFrame,
                                                   aIsChild);
 }
 
 #ifdef ACCESSIBILITY
-NS_IMETHODIMP nsTableCaptionFrame::GetAccessible(nsIAccessible** aAccessible)
+already_AddRefed<nsAccessible>
+nsTableCaptionFrame::CreateAccessible()
 {
-  *aAccessible = nsnull;
   if (!GetRect().IsEmpty()) {
     nsCOMPtr<nsIAccessibilityService> accService = do_GetService("@mozilla.org/accessibilityService;1");
     if (accService) {
-      return accService->CreateHTMLCaptionAccessible(static_cast<nsIFrame*>(this), aAccessible);
+      return accService->CreateHTMLCaptionAccessible(mContent,
+                                                     PresContext()->PresShell());
     }
   }
 
-  return NS_ERROR_FAILURE;
+  return nsnull;
 }
 #endif
 
 #ifdef NS_DEBUG
 NS_IMETHODIMP
 nsTableCaptionFrame::GetFrameName(nsAString& aResult) const
 {
   return MakeFrameName(NS_LITERAL_STRING("Caption"), aResult);
@@ -187,25 +188,27 @@ nsTableOuterFrame::~nsTableOuterFrame()
 {
 }
 
 NS_QUERYFRAME_HEAD(nsTableOuterFrame)
   NS_QUERYFRAME_ENTRY(nsITableLayout)
 NS_QUERYFRAME_TAIL_INHERITING(nsHTMLContainerFrame)
 
 #ifdef ACCESSIBILITY
-NS_IMETHODIMP nsTableOuterFrame::GetAccessible(nsIAccessible** aAccessible)
+already_AddRefed<nsAccessible>
+nsTableOuterFrame::CreateAccessible()
 {
   nsCOMPtr<nsIAccessibilityService> accService = do_GetService("@mozilla.org/accessibilityService;1");
 
   if (accService) {
-    return accService->CreateHTMLTableAccessible(static_cast<nsIFrame*>(this), aAccessible);
+    return accService->CreateHTMLTableAccessible(mContent,
+                                                 PresContext()->PresShell());
   }
 
-  return NS_ERROR_FAILURE;
+  return nsnull;
 }
 #endif
 
 /* virtual */ PRBool
 nsTableOuterFrame::IsContainingBlock() const
 {
   return PR_FALSE;
 }

--- a/layout/tables/nsTableOuterFrame.h
+++ b/layout/tables/nsTableOuterFrame.h
@@ -58,17 +58,17 @@ public:
                                  nsSize aCBSize, nscoord aAvailableWidth,
                                  nsSize aMargin, nsSize aBorder,
                                  nsSize aPadding, PRBool aShrinkWrap);
 
   NS_IMETHOD GetParentStyleContextFrame(nsPresContext* aPresContext,
                                         nsIFrame**      aProviderFrame,
                                         PRBool*         aIsChild);
 #ifdef ACCESSIBILITY
-  NS_IMETHOD GetAccessible(nsIAccessible** aAccessible);
+  virtual already_AddRefed<nsAccessible> CreateAccessible();
 #endif
 
 #ifdef NS_DEBUG
   NS_IMETHOD GetFrameName(nsAString& aResult) const;
 #endif
 
 protected:
   nsTableCaptionFrame(nsStyleContext*  aContext);
@@ -121,17 +121,17 @@ public:
   NS_IMETHOD RemoveFrame(nsIAtom*        aListName,
                          nsIFrame*       aOldFrame);
 
   virtual nsIFrame* GetContentInsertionFrame() {
     return GetFirstChild(nsnull)->GetContentInsertionFrame();
   }
 
 #ifdef ACCESSIBILITY
-  NS_IMETHOD GetAccessible(nsIAccessible** aAccessible);
+  virtual already_AddRefed<nsAccessible> CreateAccessible();
 #endif
 
   NS_IMETHOD BuildDisplayList(nsDisplayListBuilder*   aBuilder,
                               const nsRect&           aDirtyRect,
                               const nsDisplayListSet& aLists);
 
   nsresult BuildDisplayListForInnerTable(nsDisplayListBuilder*   aBuilder,
                                          const nsRect&           aDirtyRect,