Merge with TraceMonkey
authorLuke Wagner <lw@mozilla.com>
Wed, 09 Jun 2010 21:59:18 -0700
changeset 52795 a17abc6472007a9f0595101428c7fe6270e867b9
parent 52764 2081625fcdd4b8ead668484e8df3d0e25c96cfb2 (current diff)
parent 47409 130b4376a8420d3fbe00e82ac242b8faf056d3ff (diff)
child 52796 df628a955f27c810cfcdc807a22a52204bfdc0f8
push idunknown
push userunknown
push dateunknown
milestone1.9.3a5pre
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Merge with TraceMonkey
accessible/tests/mochitest/test_relations.html
accessible/tests/mochitest/test_relations.xul
accessible/tests/mochitest/test_relations_tree.xul
accessible/tests/mochitest/test_table_1.html
accessible/tests/mochitest/test_table_4.html
accessible/tests/mochitest/test_table_headers.html
accessible/tests/mochitest/test_table_headers_ariagrid.html
accessible/tests/mochitest/test_table_headers_listbox.xul
accessible/tests/mochitest/test_table_headers_tree.xul
accessible/tests/mochitest/test_table_indexes.html
accessible/tests/mochitest/test_table_indexes_ariagrid.html
accessible/tests/mochitest/test_table_indexes_listbox.xul
accessible/tests/mochitest/test_table_indexes_tree.xul
accessible/tests/mochitest/test_table_layoutguess.html
accessible/tests/mochitest/test_table_sels.html
accessible/tests/mochitest/test_table_sels_ariagrid.html
accessible/tests/mochitest/test_table_sels_listbox.xul
accessible/tests/mochitest/test_table_sels_tree.xul
accessible/tests/mochitest/test_table_struct.html
accessible/tests/mochitest/test_table_struct_ariagrid.html
accessible/tests/mochitest/test_table_struct_ariatreegrid.html
accessible/tests/mochitest/test_table_struct_listbox.xul
accessible/tests/mochitest/test_table_struct_tree.xul
browser/components/places/content/toolbar.xml
browser/fuel/test/browser_Extensions.js
caps/src/nsScriptSecurityManager.cpp
content/base/public/nsContentUtils.h
content/base/src/nsContentUtils.cpp
content/canvas/public/WebGLArray.h
content/canvas/public/nsICanvasElement.h
content/canvas/src/CustomQS_WebGL.h
content/canvas/src/NativeJSContext.cpp
content/canvas/src/NativeJSContext.h
content/canvas/src/glwrap.cpp
content/canvas/src/glwrap.h
content/canvas/src/localgl.h
content/canvas/src/nsGLPbuffer.cpp
content/canvas/src/nsGLPbuffer.h
content/canvas/src/nsGLPbufferCGL.cpp
content/canvas/src/nsGLPbufferEGL.cpp
content/canvas/src/nsGLPbufferGLX.cpp
content/canvas/src/nsGLPbufferOSMesa.cpp
content/canvas/src/nsGLPbufferWGL.cpp
content/html/content/public/nsIFormSubmission.h
content/media/ogg/nsOggPlayStateMachine.cpp
content/media/ogg/nsOggPlayStateMachine.h
content/media/test/320x240.allow-origin.ogv
content/media/test/320x240.allow-origin.ogv^headers^
content/media/test/test_bug468190.html
content/media/test/test_bug468190_wav.html
content/media/test/test_bug476973.html
content/media/test/test_bug486646.html
content/media/test/test_bug495145_wav.html
content/media/test/test_bug495319.html
content/media/test/test_duration1.html
content/media/test/test_ended1.html
content/media/test/test_ended2.html
content/media/test/test_onloadedmetadata.html
content/media/test/test_play.html
content/media/test/test_progress1.html
content/media/test/test_progress2.html
content/media/test/test_progress3.html
content/media/test/test_progress4.html
content/media/test/test_timeupdate1.html
content/media/test/test_timeupdate2.html
content/media/test/test_wav_onloadedmetadata.html
content/media/test/test_wav_standalone.html
content/media/test/test_wav_timeupdate1.html
content/media/test/test_wav_timeupdate2.html
content/media/test/test_wav_trunc_seek.html
docshell/base/nsIChannelClassifier.idl
docshell/base/nsIURIClassifier.idl
dom/base/nsDOMClassInfo.cpp
dom/base/nsJSEnvironment.cpp
dom/plugins/PluginThreadChild.cpp
dom/plugins/PluginThreadChild.h
embedding/components/windowwatcher/public/nsINonBlockingAlertService.idl
extensions/cookie/test/unit/test_cookies.js
extensions/layout-debug/Makefile.in
extensions/layout-debug/application.ini
extensions/layout-debug/chrome.manifest
extensions/layout-debug/layoutdebug-prefs.js
extensions/layout-debug/makefiles.sh
extensions/layout-debug/src/Makefile.in
extensions/layout-debug/src/nsDebugFactory.cpp
extensions/layout-debug/src/nsILayoutDebuggingTools.idl
extensions/layout-debug/src/nsILayoutRegressionTester.idl
extensions/layout-debug/src/nsLayoutDebugCIID.h
extensions/layout-debug/src/nsLayoutDebugCLH.cpp
extensions/layout-debug/src/nsLayoutDebugCLH.h
extensions/layout-debug/src/nsLayoutDebuggingTools.cpp
extensions/layout-debug/src/nsLayoutDebuggingTools.h
extensions/layout-debug/src/nsRegressionTester.cpp
extensions/layout-debug/src/nsRegressionTester.h
extensions/layout-debug/ui/Makefile.in
extensions/layout-debug/ui/content/layoutdebug-overlay.xul
extensions/layout-debug/ui/content/layoutdebug.js
extensions/layout-debug/ui/content/layoutdebug.xul
extensions/layout-debug/ui/jar.mn
extensions/layout-debug/ui/locale/en-US/layoutdebug-overlay.dtd
extensions/layout-debug/ui/locale/en-US/layoutdebug.dtd
gfx/cairo/libpixman/src/pixman-arm-neon.h
gfx/cairo/libpixman/src/pixman-arm-simd-asm.c
gfx/cairo/libpixman/src/pixman-arm-simd-asm.h
gfx/cairo/libpixman/src/pixman-arm-simd.h
gfx/cairo/libpixman/src/pixman-compose-accessors.c
gfx/cairo/libpixman/src/pixman-compose.c
gfx/cairo/libpixman/src/pixman-compute-region.c
gfx/cairo/libpixman/src/pixman-mmx.h
gfx/cairo/libpixman/src/pixman-pict.c
gfx/cairo/libpixman/src/pixman-source.c
gfx/cairo/libpixman/src/pixman-sse2.h
gfx/cairo/libpixman/src/pixman-transformed-accessors.c
gfx/cairo/libpixman/src/pixman-transformed.c
gfx/cairo/libpixman/src/pixman-vmx.h
gfx/cairo/libpixman/src/pixman-wce-arm-simd.asm
gfx/layers/opengl/LayerManagerOGLShaders.h
intl/uconv/src/nsGREResProperties.cpp
intl/uconv/src/nsGREResProperties.h
intl/uconv/src/unixcharset.sample.properties
ipc/app/fake/Makefile.in
ipc/app/fake/mozilla-runtime.cpp
ipc/glue/MozillaChildThread.cpp
ipc/glue/MozillaChildThread.h
ipc/ipdl/test/cxx/IPDLUnitTestThreadChild.cpp
ipc/ipdl/test/cxx/IPDLUnitTestThreadChild.h
ipc/ipdl/test/cxx/PTestArrays.ipdl
ipc/ipdl/test/cxx/PTestArraysSub.ipdl
ipc/ipdl/test/cxx/TestArrays.cpp
ipc/ipdl/test/cxx/TestArrays.h
js/jsd/jsd.h
js/jsd/jsd_val.c
js/src/config/rules.mk
js/src/ctypes/CTypes.cpp
js/src/imacro_asm.js.in
js/src/imacros.c.out
js/src/jsapi-tests/testIsAboutToBeFinalized.cpp
js/src/jsapi-tests/tests.h
js/src/jsapi.cpp
js/src/jsapi.h
js/src/jsarray.cpp
js/src/jsarray.h
js/src/jsatom.cpp
js/src/jsatom.h
js/src/jsbuiltins.cpp
js/src/jsbuiltins.h
js/src/jscntxt.cpp
js/src/jscntxt.h
js/src/jscntxtinlines.h
js/src/jsdate.cpp
js/src/jsdbgapi.cpp
js/src/jsdbgapi.h
js/src/jsemit.cpp
js/src/jsemit.h
js/src/jsexn.cpp
js/src/jsfun.cpp
js/src/jsfun.h
js/src/jsgc.cpp
js/src/jsgc.h
js/src/jsgcchunk.cpp
js/src/jsgcchunk.h
js/src/jshashtable.h
js/src/jsinterp.cpp
js/src/jsinterp.h
js/src/jsiter.cpp
js/src/jsiter.h
js/src/jslock.cpp
js/src/jslock.h
js/src/jsobj.cpp
js/src/jsobj.h
js/src/jsobjinlines.h
js/src/json.cpp
js/src/jsopcode.cpp
js/src/jsopcode.h
js/src/jsops.cpp
js/src/jsparse.cpp
js/src/jsparse.h
js/src/jspropertytree.cpp
js/src/jsproxy.cpp
js/src/jsproxy.h
js/src/jsprvtd.h
js/src/jspubtd.h
js/src/jsrecursion.cpp
js/src/jsregexp.cpp
js/src/jsregexp.h
js/src/jsscan.cpp
js/src/jsscope.cpp
js/src/jsscope.h
js/src/jsscopeinlines.h
js/src/jsscript.cpp
js/src/jsscript.h
js/src/jsstr.cpp
js/src/jsstr.h
js/src/jstl.h
js/src/jstracer.cpp
js/src/jstypedarray.cpp
js/src/jstypedarray.h
js/src/jstypes.h
js/src/jsutil.cpp
js/src/jswrapper.cpp
js/src/jswrapper.h
js/src/jsxdrapi.cpp
js/src/jsxdrapi.h
js/src/jsxml.cpp
js/src/jsxml.h
js/src/shell/js.cpp
js/src/shell/jsworkers.cpp
js/src/tests/jstests.py
js/src/xpconnect/loader/mozJSComponentLoader.cpp
js/src/xpconnect/src/XPCChromeObjectWrapper.cpp
js/src/xpconnect/src/XPCCrossOriginWrapper.cpp
js/src/xpconnect/src/XPCDispObject.cpp
js/src/xpconnect/src/XPCDispTearOff.cpp
js/src/xpconnect/src/XPCNativeWrapper.cpp
js/src/xpconnect/src/XPCNativeWrapper.h
js/src/xpconnect/src/XPCSafeJSObjectWrapper.cpp
js/src/xpconnect/src/XPCSystemOnlyWrapper.cpp
js/src/xpconnect/src/XPCWrapper.cpp
js/src/xpconnect/src/XPCWrapper.h
js/src/xpconnect/src/nsXPConnect.cpp
js/src/xpconnect/src/qsgen.py
js/src/xpconnect/src/xpccomponents.cpp
js/src/xpconnect/src/xpcinlines.h
js/src/xpconnect/src/xpcprivate.h
js/src/xpconnect/src/xpcquickstubs.cpp
js/src/xpconnect/src/xpcquickstubs.h
js/src/xpconnect/src/xpcwrappedjsclass.cpp
js/src/xpconnect/src/xpcwrappednative.cpp
js/src/xpconnect/src/xpcwrappednativejsops.cpp
js/src/xpconnect/tools/Makefile.in
js/src/xpconnect/tools/idl/Makefile.in
js/src/xpconnect/tools/idl/nsIXPCToolsCompiler.idl
js/src/xpconnect/tools/idl/nsIXPCToolsProfiler.idl
js/src/xpconnect/tools/js/CompileJSFiles.js
js/src/xpconnect/tools/js/ListJSFiles.js
js/src/xpconnect/tools/src/Makefile.in
js/src/xpconnect/tools/src/nsXPCToolsCompiler.cpp
js/src/xpconnect/tools/src/nsXPCToolsModule.cpp
js/src/xpconnect/tools/src/nsXPCToolsProfiler.cpp
js/src/xpconnect/tools/src/xpctools_private.h
layout/reftests/box-shadow/boxshadow-inner-basic-ref.html
layout/style/nsICSSStyleSheet.h
memory/jemalloc/crtvc8sp1.diff
memory/jemalloc/crtvc9sp1.diff
modules/plugin/base/public/nsDefaultPlugin.h
modules/plugin/base/src/nsJSNPRuntime.cpp
modules/plugin/default/mac/DefaultPlugin.mm
modules/plugin/default/mac/DefaultPlugin.xcodeproj/TemplateIcon.tiff
modules/plugin/default/mac/DefaultPlugin.xcodeproj/project.pbxproj
modules/plugin/default/mac/English.lproj/InfoPlist.strings
modules/plugin/default/mac/Info.plist
modules/plugin/default/mac/Makefile.in
modules/plugin/default/mac/plugin.png
modules/plugin/default/os2/Makefile.in
modules/plugin/default/os2/dbg.cpp
modules/plugin/default/os2/dbg.h
modules/plugin/default/os2/dialogs.cpp
modules/plugin/default/os2/dialogs.h
modules/plugin/default/os2/maindll.cpp
modules/plugin/default/os2/npnulos2.h
modules/plugin/default/os2/npnulos2.ico
modules/plugin/default/os2/npnulos2.rc
modules/plugin/default/os2/npos2.cpp
modules/plugin/default/os2/npshell.cpp
modules/plugin/default/os2/plugin.cpp
modules/plugin/default/os2/plugin.h
modules/plugin/default/os2/utils.cpp
modules/plugin/default/os2/utils.h
modules/plugin/default/unix/Makefile.in
modules/plugin/default/unix/npshell.c
modules/plugin/default/unix/npunix.c
modules/plugin/default/unix/nullplugin.c
modules/plugin/default/unix/nullplugin.h
modules/plugin/default/windows/Makefile.in
modules/plugin/default/windows/Npnul32.dsp
modules/plugin/default/windows/dbg.cpp
modules/plugin/default/windows/dbg.h
modules/plugin/default/windows/dialogs.cpp
modules/plugin/default/windows/dialogs.h
modules/plugin/default/windows/maindll.cpp
modules/plugin/default/windows/npnul32.def
modules/plugin/default/windows/npnul32.dsw
modules/plugin/default/windows/npnul32.rc
modules/plugin/default/windows/npshell.cpp
modules/plugin/default/windows/npwin.cpp
modules/plugin/default/windows/plugicon.ico
modules/plugin/default/windows/plugin.cpp
modules/plugin/default/windows/plugin.h
modules/plugin/default/windows/resource.h
modules/plugin/default/windows/utils.cpp
modules/plugin/default/windows/utils.h
netwerk/cache/public/Makefile.in
netwerk/cache/public/nsICache.idl
netwerk/cache/public/nsICacheEntryDescriptor.idl
netwerk/cache/public/nsICacheListener.idl
netwerk/cache/public/nsICacheService.idl
netwerk/cache/public/nsICacheSession.idl
netwerk/cache/public/nsICacheVisitor.idl
netwerk/cache/src/Makefile.in
netwerk/cache/src/nsCache.cpp
netwerk/cache/src/nsCache.h
netwerk/cache/src/nsCacheDevice.h
netwerk/cache/src/nsCacheEntry.cpp
netwerk/cache/src/nsCacheEntry.h
netwerk/cache/src/nsCacheEntryDescriptor.cpp
netwerk/cache/src/nsCacheEntryDescriptor.h
netwerk/cache/src/nsCacheMetaData.cpp
netwerk/cache/src/nsCacheMetaData.h
netwerk/cache/src/nsCacheRequest.h
netwerk/cache/src/nsCacheService.cpp
netwerk/cache/src/nsCacheService.h
netwerk/cache/src/nsCacheSession.cpp
netwerk/cache/src/nsCacheSession.h
netwerk/cache/src/nsDeleteDir.cpp
netwerk/cache/src/nsDeleteDir.h
netwerk/cache/src/nsDiskCache.h
netwerk/cache/src/nsDiskCacheBinding.cpp
netwerk/cache/src/nsDiskCacheBinding.h
netwerk/cache/src/nsDiskCacheBlockFile.cpp
netwerk/cache/src/nsDiskCacheBlockFile.h
netwerk/cache/src/nsDiskCacheDevice.cpp
netwerk/cache/src/nsDiskCacheDevice.h
netwerk/cache/src/nsDiskCacheDeviceSQL.cpp
netwerk/cache/src/nsDiskCacheDeviceSQL.h
netwerk/cache/src/nsDiskCacheEntry.cpp
netwerk/cache/src/nsDiskCacheEntry.h
netwerk/cache/src/nsDiskCacheMap.cpp
netwerk/cache/src/nsDiskCacheMap.h
netwerk/cache/src/nsDiskCacheStreams.cpp
netwerk/cache/src/nsDiskCacheStreams.h
netwerk/cache/src/nsMemoryCacheDevice.cpp
netwerk/cache/src/nsMemoryCacheDevice.h
netwerk/cookie/public/Makefile.in
netwerk/cookie/public/nsICookie.idl
netwerk/cookie/public/nsICookie2.idl
netwerk/cookie/public/nsICookieManager.idl
netwerk/cookie/public/nsICookieManager2.idl
netwerk/cookie/public/nsICookiePermission.idl
netwerk/cookie/public/nsICookieService.idl
netwerk/cookie/src/Makefile.in
netwerk/cookie/src/nsCookie.cpp
netwerk/cookie/src/nsCookie.h
netwerk/cookie/src/nsCookieService.cpp
netwerk/cookie/src/nsCookieService.h
netwerk/dns/public/Makefile.in
netwerk/dns/public/nsIDNSListener.idl
netwerk/dns/public/nsIDNSRecord.idl
netwerk/dns/public/nsIDNSRequest.idl
netwerk/dns/public/nsIDNSService.idl
netwerk/dns/public/nsIEffectiveTLDService.idl
netwerk/dns/public/nsIIDNService.idl
netwerk/dns/public/nsPIDNSService.idl
netwerk/dns/src/Makefile.in
netwerk/dns/src/effective_tld_names.dat
netwerk/dns/src/nameprep.c
netwerk/dns/src/nameprep_template.c
netwerk/dns/src/nameprepdata.c
netwerk/dns/src/nsDNSService2.cpp
netwerk/dns/src/nsDNSService2.h
netwerk/dns/src/nsEffectiveTLDService.cpp
netwerk/dns/src/nsEffectiveTLDService.h
netwerk/dns/src/nsHostResolver.cpp
netwerk/dns/src/nsHostResolver.h
netwerk/dns/src/nsIDNKitInterface.h
netwerk/dns/src/nsIDNService.cpp
netwerk/dns/src/nsIDNService.h
netwerk/dns/src/prepare_tlds.py
netwerk/dns/src/punycode.c
netwerk/dns/src/punycode.h
netwerk/dns/src/race.c
netwerk/mime/public/Makefile.in
netwerk/mime/public/nsIMIMEHeaderParam.idl
netwerk/mime/public/nsIMIMEInfo.idl
netwerk/mime/public/nsIMIMEService.idl
netwerk/mime/public/nsMimeTypes.h
netwerk/mime/src/Makefile.in
netwerk/mime/src/nsMIMEHeaderParamImpl.cpp
netwerk/mime/src/nsMIMEHeaderParamImpl.h
netwerk/protocol/about/public/Makefile.in
netwerk/protocol/about/public/nsAboutProtocolUtils.h
netwerk/protocol/about/public/nsIAboutModule.idl
netwerk/protocol/about/src/Makefile.in
netwerk/protocol/about/src/nsAboutBlank.cpp
netwerk/protocol/about/src/nsAboutBlank.h
netwerk/protocol/about/src/nsAboutBloat.cpp
netwerk/protocol/about/src/nsAboutBloat.h
netwerk/protocol/about/src/nsAboutCache.cpp
netwerk/protocol/about/src/nsAboutCache.h
netwerk/protocol/about/src/nsAboutCacheEntry.cpp
netwerk/protocol/about/src/nsAboutCacheEntry.h
netwerk/protocol/about/src/nsAboutProtocolHandler.cpp
netwerk/protocol/about/src/nsAboutProtocolHandler.h
netwerk/protocol/data/src/Makefile.in
netwerk/protocol/data/src/nsDataChannel.cpp
netwerk/protocol/data/src/nsDataChannel.h
netwerk/protocol/data/src/nsDataHandler.cpp
netwerk/protocol/data/src/nsDataHandler.h
netwerk/protocol/data/src/nsDataModule.cpp
netwerk/protocol/file/public/Makefile.in
netwerk/protocol/file/public/nsIFileChannel.idl
netwerk/protocol/file/public/nsIFileProtocolHandler.idl
netwerk/protocol/file/src/Makefile.in
netwerk/protocol/file/src/nsFileChannel.cpp
netwerk/protocol/file/src/nsFileChannel.h
netwerk/protocol/file/src/nsFileProtocolHandler.cpp
netwerk/protocol/file/src/nsFileProtocolHandler.h
netwerk/protocol/ftp/public/Makefile.in
netwerk/protocol/ftp/public/ftpCore.h
netwerk/protocol/ftp/public/nsIFTPChannel.idl
netwerk/protocol/ftp/src/Makefile.in
netwerk/protocol/ftp/src/nsFTPChannel.cpp
netwerk/protocol/ftp/src/nsFTPChannel.h
netwerk/protocol/ftp/src/nsFtpConnectionThread.cpp
netwerk/protocol/ftp/src/nsFtpConnectionThread.h
netwerk/protocol/ftp/src/nsFtpControlConnection.cpp
netwerk/protocol/ftp/src/nsFtpControlConnection.h
netwerk/protocol/ftp/src/nsFtpProtocolHandler.cpp
netwerk/protocol/ftp/src/nsFtpProtocolHandler.h
netwerk/protocol/gopher/src/Makefile.in
netwerk/protocol/gopher/src/nsGopherChannel.cpp
netwerk/protocol/gopher/src/nsGopherChannel.h
netwerk/protocol/gopher/src/nsGopherHandler.cpp
netwerk/protocol/gopher/src/nsGopherHandler.h
netwerk/protocol/http/public/Makefile.in
netwerk/protocol/http/public/nsIHttpActivityObserver.idl
netwerk/protocol/http/public/nsIHttpAuthManager.idl
netwerk/protocol/http/public/nsIHttpAuthenticator.idl
netwerk/protocol/http/public/nsIHttpChannel.idl
netwerk/protocol/http/public/nsIHttpChannelInternal.idl
netwerk/protocol/http/public/nsIHttpEventSink.idl
netwerk/protocol/http/public/nsIHttpHeaderVisitor.idl
netwerk/protocol/http/public/nsIHttpProtocolHandler.idl
netwerk/protocol/http/src/Makefile.in
netwerk/protocol/http/src/README
netwerk/protocol/http/src/nsAHttpConnection.h
netwerk/protocol/http/src/nsAHttpTransaction.h
netwerk/protocol/http/src/nsHttp.cpp
netwerk/protocol/http/src/nsHttp.h
netwerk/protocol/http/src/nsHttpActivityDistributor.cpp
netwerk/protocol/http/src/nsHttpActivityDistributor.h
netwerk/protocol/http/src/nsHttpAtomList.h
netwerk/protocol/http/src/nsHttpAuthCache.cpp
netwerk/protocol/http/src/nsHttpAuthCache.h
netwerk/protocol/http/src/nsHttpAuthManager.cpp
netwerk/protocol/http/src/nsHttpAuthManager.h
netwerk/protocol/http/src/nsHttpBasicAuth.cpp
netwerk/protocol/http/src/nsHttpBasicAuth.h
netwerk/protocol/http/src/nsHttpChannel.cpp
netwerk/protocol/http/src/nsHttpChannel.h
netwerk/protocol/http/src/nsHttpChunkedDecoder.cpp
netwerk/protocol/http/src/nsHttpChunkedDecoder.h
netwerk/protocol/http/src/nsHttpConnection.cpp
netwerk/protocol/http/src/nsHttpConnection.h
netwerk/protocol/http/src/nsHttpConnectionInfo.cpp
netwerk/protocol/http/src/nsHttpConnectionInfo.h
netwerk/protocol/http/src/nsHttpConnectionMgr.cpp
netwerk/protocol/http/src/nsHttpConnectionMgr.h
netwerk/protocol/http/src/nsHttpDigestAuth.cpp
netwerk/protocol/http/src/nsHttpDigestAuth.h
netwerk/protocol/http/src/nsHttpHandler.cpp
netwerk/protocol/http/src/nsHttpHandler.h
netwerk/protocol/http/src/nsHttpHeaderArray.cpp
netwerk/protocol/http/src/nsHttpHeaderArray.h
netwerk/protocol/http/src/nsHttpNTLMAuth.cpp
netwerk/protocol/http/src/nsHttpNTLMAuth.h
netwerk/protocol/http/src/nsHttpPipeline.cpp
netwerk/protocol/http/src/nsHttpPipeline.h
netwerk/protocol/http/src/nsHttpRequestHead.cpp
netwerk/protocol/http/src/nsHttpRequestHead.h
netwerk/protocol/http/src/nsHttpResponseHead.cpp
netwerk/protocol/http/src/nsHttpResponseHead.h
netwerk/protocol/http/src/nsHttpTransaction.cpp
netwerk/protocol/http/src/nsHttpTransaction.h
netwerk/protocol/res/public/Makefile.in
netwerk/protocol/res/public/nsIResProtocolHandler.idl
netwerk/protocol/res/src/Makefile.in
netwerk/protocol/res/src/nsResProtocolHandler.cpp
netwerk/protocol/res/src/nsResProtocolHandler.h
netwerk/protocol/viewsource/public/Makefile.in
netwerk/protocol/viewsource/public/nsIViewSourceChannel.idl
netwerk/protocol/viewsource/src/Makefile.in
netwerk/protocol/viewsource/src/nsViewSourceChannel.cpp
netwerk/protocol/viewsource/src/nsViewSourceChannel.h
netwerk/protocol/viewsource/src/nsViewSourceHandler.cpp
netwerk/protocol/viewsource/src/nsViewSourceHandler.h
netwerk/socket/base/Makefile.in
netwerk/socket/base/nsISOCKSSocketInfo.idl
netwerk/socket/base/nsISSLSocketControl.idl
netwerk/socket/base/nsISocketProvider.idl
netwerk/socket/base/nsISocketProviderService.idl
netwerk/socket/base/nsITransportSecurityInfo.idl
netwerk/socket/base/nsSOCKS4SocketProvider.h
netwerk/socket/base/nsSOCKSIOLayer.cpp
netwerk/socket/base/nsSOCKSIOLayer.h
netwerk/socket/base/nsSOCKSSocketProvider.cpp
netwerk/socket/base/nsSOCKSSocketProvider.h
netwerk/socket/base/nsSocketProviderService.cpp
netwerk/socket/base/nsSocketProviderService.h
netwerk/socket/base/nsUDPSocketProvider.cpp
netwerk/socket/base/nsUDPSocketProvider.h
netwerk/wifi/public/Makefile.in
netwerk/wifi/public/nsIWifiAccessPoint.idl
netwerk/wifi/public/nsIWifiListener.idl
netwerk/wifi/public/nsIWifiMonitor.idl
netwerk/wifi/src/Makefile.in
netwerk/wifi/src/nsWifiAccessPoint.cpp
netwerk/wifi/src/nsWifiAccessPoint.h
netwerk/wifi/src/nsWifiMonitor.cpp
netwerk/wifi/src/nsWifiMonitor.h
netwerk/wifi/src/nsWifiScannerMac.cpp
netwerk/wifi/src/nsWifiScannerSolaris.cpp
netwerk/wifi/src/nsWifiScannerUnix.cpp
netwerk/wifi/src/nsWifiScannerWin.cpp
netwerk/wifi/src/osx_corewlan.mm
netwerk/wifi/src/osx_wifi.h
netwerk/wifi/src/wlanapi.h
security/manager/ssl/src/nsCrypto.cpp
storage/test/unit/test_js_helpers_enumerate.js
storage/test/unit/test_js_helpers_prototype_chain_safe.js
toolkit/components/remote/nsPhRemoteService.cpp
toolkit/components/remote/nsPhRemoteService.h
toolkit/components/satchel/src/nsStorageFormHistory.cpp
toolkit/components/satchel/src/nsStorageFormHistory.h
toolkit/mozapps/extensions/nsExtensionManager.js
toolkit/mozapps/extensions/nsIExtensionManager.idl
toolkit/mozapps/extensions/test/addons/test_bug257155/install.rdf
toolkit/mozapps/extensions/test/addons/test_bug378216_1/install.rdf
toolkit/mozapps/extensions/test/addons/test_bug378216_10/install.rdf
toolkit/mozapps/extensions/test/addons/test_bug378216_11/install.rdf
toolkit/mozapps/extensions/test/addons/test_bug378216_12/install.rdf
toolkit/mozapps/extensions/test/addons/test_bug378216_13/install.rdf
toolkit/mozapps/extensions/test/addons/test_bug378216_2/install.rdf
toolkit/mozapps/extensions/test/addons/test_bug378216_3/install.rdf
toolkit/mozapps/extensions/test/addons/test_bug378216_4/install.rdf
toolkit/mozapps/extensions/test/addons/test_bug378216_5/install.rdf
toolkit/mozapps/extensions/test/addons/test_bug378216_6/install.rdf
toolkit/mozapps/extensions/test/addons/test_bug378216_7/install.rdf
toolkit/mozapps/extensions/test/addons/test_bug378216_8/install.rdf
toolkit/mozapps/extensions/test/addons/test_bug378216_9/install.rdf
toolkit/mozapps/extensions/test/addons/test_bug392180/install.rdf
toolkit/mozapps/extensions/test/addons/test_bug396129_a_1/install.rdf
toolkit/mozapps/extensions/test/addons/test_bug396129_a_2/install.rdf
toolkit/mozapps/extensions/test/addons/test_bug396129_b_1/install.rdf
toolkit/mozapps/extensions/test/addons/test_bug396129_b_2/install.rdf
toolkit/mozapps/extensions/test/addons/test_bug396129_c_1/install.rdf
toolkit/mozapps/extensions/test/addons/test_bug396129_c_2/install.rdf
toolkit/mozapps/extensions/test/addons/test_bug396129_d_1/install.rdf
toolkit/mozapps/extensions/test/addons/test_bug396129_d_2/install.rdf
toolkit/mozapps/extensions/test/addons/test_bug428341_1/README
toolkit/mozapps/extensions/test/addons/test_bug428341_2/install.rdf
toolkit/mozapps/extensions/test/addons/test_bug428341_3/install.rdf
toolkit/mozapps/extensions/test/addons/test_bug428341_4/install.rdf
toolkit/mozapps/extensions/test/addons/test_bug428341_5/install.rdf
toolkit/mozapps/extensions/test/addons/test_bug428341_6/install.rdf
toolkit/mozapps/extensions/test/addons/test_bug428341_7/install.rdf
toolkit/mozapps/extensions/test/addons/test_bug428341_8/install.rdf
toolkit/mozapps/extensions/test/addons/test_bug428341_9/install.rdf
toolkit/mozapps/extensions/test/addons/test_bug436207/install.js
toolkit/mozapps/extensions/test/browser/browser_bug510909.js
toolkit/mozapps/extensions/test/bug435743.rdf
toolkit/mozapps/extensions/test/bug435743.sjs
toolkit/mozapps/extensions/test/bug435743.xpi
toolkit/mozapps/extensions/test/test_bug435743_1.xul
toolkit/mozapps/extensions/test/test_bug435743_2.xul
toolkit/mozapps/extensions/test/unit/data/bug455906_block.xml
toolkit/mozapps/extensions/test/unit/data/bug455906_empty.xml
toolkit/mozapps/extensions/test/unit/data/bug455906_start.xml
toolkit/mozapps/extensions/test/unit/data/bug455906_warn.xml
toolkit/mozapps/extensions/test/unit/data/cert8.db
toolkit/mozapps/extensions/test/unit/data/key3.db
toolkit/mozapps/extensions/test/unit/data/secmod.db
toolkit/mozapps/extensions/test/unit/data/signed-no-cn.xpi
toolkit/mozapps/extensions/test/unit/data/signed-no-o.xpi
toolkit/mozapps/extensions/test/unit/data/signed-tampered.xpi
toolkit/mozapps/extensions/test/unit/data/signed-untrusted.xpi
toolkit/mozapps/extensions/test/unit/data/signed.xpi
toolkit/mozapps/extensions/test/unit/data/test_bug299716.rdf
toolkit/mozapps/extensions/test/unit/data/test_bug299716_2.rdf
toolkit/mozapps/extensions/test/unit/data/test_bug324121.rdf
toolkit/mozapps/extensions/test/unit/data/test_bug378216.rdf
toolkit/mozapps/extensions/test/unit/data/test_bug393285.xml
toolkit/mozapps/extensions/test/unit/data/test_bug394300.rdf
toolkit/mozapps/extensions/test/unit/data/test_bug396129.rdf
toolkit/mozapps/extensions/test/unit/data/test_bug404024.xml
toolkit/mozapps/extensions/test/unit/data/test_bug417606.xml
toolkit/mozapps/extensions/test/unit/data/test_bug424107_1.rdf
toolkit/mozapps/extensions/test/unit/data/test_bug424107_2.rdf
toolkit/mozapps/extensions/test/unit/data/test_bug424262.xml
toolkit/mozapps/extensions/test/unit/data/test_bug449027_app.xml
toolkit/mozapps/extensions/test/unit/data/test_bug449027_toolkit.xml
toolkit/mozapps/extensions/test/unit/data/test_bug468528.xml
toolkit/mozapps/extensions/test/unit/data/test_bug470377/install_1.rdf
toolkit/mozapps/extensions/test/unit/data/test_bug470377/install_2.rdf
toolkit/mozapps/extensions/test/unit/data/test_bug470377/install_3.rdf
toolkit/mozapps/extensions/test/unit/data/test_bug470377/install_4.rdf
toolkit/mozapps/extensions/test/unit/data/test_bug470377/install_5.rdf
toolkit/mozapps/extensions/test/unit/data/test_bug470377/update_1.rdf
toolkit/mozapps/extensions/test/unit/data/test_bug470377/update_2.rdf
toolkit/mozapps/extensions/test/unit/data/test_bug470377/update_3.rdf
toolkit/mozapps/extensions/test/unit/data/test_bug470377/update_4.rdf
toolkit/mozapps/extensions/test/unit/data/test_bug470377/update_5.rdf
toolkit/mozapps/extensions/test/unit/data/test_bug486195/install.rdf
toolkit/mozapps/extensions/test/unit/data/test_bug514327_1.xml
toolkit/mozapps/extensions/test/unit/data/test_bug514327_2.xml
toolkit/mozapps/extensions/test/unit/data/test_bug514327_3_empty.xml
toolkit/mozapps/extensions/test/unit/data/test_bug514327_3_outdated_1.xml
toolkit/mozapps/extensions/test/unit/data/test_bug514327_3_outdated_2.xml
toolkit/mozapps/extensions/test/unit/data/test_bug526598_1.xpi
toolkit/mozapps/extensions/test/unit/data/test_bug526598_2.xpi
toolkit/mozapps/extensions/test/unit/data/test_bug541420.xpi
toolkit/mozapps/extensions/test/unit/data/unsigned.xpi
toolkit/mozapps/extensions/test/unit/test_LightweightThemeManager.js
toolkit/mozapps/extensions/test/unit/test_bug257155.js
toolkit/mozapps/extensions/test/unit/test_bug299716.js
toolkit/mozapps/extensions/test/unit/test_bug299716_2.js
toolkit/mozapps/extensions/test/unit/test_bug324121.js
toolkit/mozapps/extensions/test/unit/test_bug335238.js
toolkit/mozapps/extensions/test/unit/test_bug371495.js
toolkit/mozapps/extensions/test/unit/test_bug378216.js
toolkit/mozapps/extensions/test/unit/test_bug384052.js
toolkit/mozapps/extensions/test/unit/test_bug386153.js
toolkit/mozapps/extensions/test/unit/test_bug391899.js
toolkit/mozapps/extensions/test/unit/test_bug392180.js
toolkit/mozapps/extensions/test/unit/test_bug393285.js
toolkit/mozapps/extensions/test/unit/test_bug394300.js
toolkit/mozapps/extensions/test/unit/test_bug394717.js
toolkit/mozapps/extensions/test/unit/test_bug396129.js
toolkit/mozapps/extensions/test/unit/test_bug397778.js
toolkit/mozapps/extensions/test/unit/test_bug404024.js
toolkit/mozapps/extensions/test/unit/test_bug406118.js
toolkit/mozapps/extensions/test/unit/test_bug417606.js
toolkit/mozapps/extensions/test/unit/test_bug424107.js
toolkit/mozapps/extensions/test/unit/test_bug424262.js
toolkit/mozapps/extensions/test/unit/test_bug425657.js
toolkit/mozapps/extensions/test/unit/test_bug428341.js
toolkit/mozapps/extensions/test/unit/test_bug430120.js
toolkit/mozapps/extensions/test/unit/test_bug436207.js
toolkit/mozapps/extensions/test/unit/test_bug449027.js
toolkit/mozapps/extensions/test/unit/test_bug455906.js
toolkit/mozapps/extensions/test/unit/test_bug465190.js
toolkit/mozapps/extensions/test/unit/test_bug468528.js
toolkit/mozapps/extensions/test/unit/test_bug470377_1.js
toolkit/mozapps/extensions/test/unit/test_bug470377_2.js
toolkit/mozapps/extensions/test/unit/test_bug470377_3.js
toolkit/mozapps/extensions/test/unit/test_bug470377_4.js
toolkit/mozapps/extensions/test/unit/test_bug474988.js
toolkit/mozapps/extensions/test/unit/test_bug486195.js
toolkit/mozapps/extensions/test/unit/test_bug509194.js
toolkit/mozapps/extensions/test/unit/test_bug514327_1.js
toolkit/mozapps/extensions/test/unit/test_bug514327_2.js
toolkit/mozapps/extensions/test/unit/test_bug514327_3.js
toolkit/mozapps/extensions/test/unit/test_bug521905.js
toolkit/mozapps/extensions/test/unit/test_bug526598.js
toolkit/mozapps/extensions/test/unit/test_bug541420.js
toolkit/mozapps/update/test/chrome/test_0011_check_billboard_noLicense_noAddons.xul
toolkit/mozapps/update/test/chrome/test_0012_check_billboard_noAddons.xul
toolkit/mozapps/update/test/chrome/test_0021_check_noBillboard_noLicense_noAddons.xul
toolkit/mozapps/update/test/chrome/test_0022_check_noBillboard_noAddons.xul
toolkit/mozapps/update/test/chrome/test_0031_available_billboard_noLicense_noAddons.xul
toolkit/mozapps/update/test/chrome/test_0032_available_billboard_noAddons.xul
toolkit/mozapps/update/test/chrome/test_0041_available_noBillboard_noLicense_noAddons.xul
toolkit/mozapps/update/test/chrome/test_0042_available_noBillboard_noAddons.xul
toolkit/mozapps/update/test/chrome/test_0111_neverButton_billboard.xul
toolkit/mozapps/update/test/chrome/test_0112_neverButton_noBillboard.xul
toolkit/themes/gnomestripe/mozapps/extensions/extensionIcons.png
toolkit/themes/gnomestripe/mozapps/extensions/notifyBadges.png
toolkit/themes/gnomestripe/mozapps/extensions/ratings.png
toolkit/themes/gnomestripe/mozapps/extensions/viewButtons.png
toolkit/themes/pinstripe/mozapps/extensions/extensionIcons.png
toolkit/themes/pinstripe/mozapps/extensions/extensionItem.png
toolkit/themes/pinstripe/mozapps/extensions/itemDisabledFader.png
toolkit/themes/pinstripe/mozapps/extensions/itemEnabledFader.png
toolkit/themes/pinstripe/mozapps/extensions/notifyBadges.png
toolkit/themes/pinstripe/mozapps/extensions/question.png
toolkit/themes/pinstripe/mozapps/extensions/ratings.png
toolkit/themes/pinstripe/mozapps/extensions/viewButtons.png
toolkit/themes/pinstripe/mozapps/plugins/pluginCrashed.png
toolkit/themes/pinstripe/mozapps/plugins/pluginOutdated-16.png
toolkit/themes/winstripe/mozapps/extensions/extensionIcons-aero.png
toolkit/themes/winstripe/mozapps/extensions/extensionIcons.png
toolkit/themes/winstripe/mozapps/extensions/itemDisabledFader.png
toolkit/themes/winstripe/mozapps/extensions/itemEnabledFader.png
toolkit/themes/winstripe/mozapps/extensions/notifyBadges-aero.png
toolkit/themes/winstripe/mozapps/extensions/notifyBadges.png
toolkit/themes/winstripe/mozapps/extensions/question-aero.png
toolkit/themes/winstripe/mozapps/extensions/question.png
toolkit/themes/winstripe/mozapps/extensions/ratings-aero.png
toolkit/themes/winstripe/mozapps/extensions/ratings.png
toolkit/themes/winstripe/mozapps/extensions/viewButtons-aero.png
toolkit/themes/winstripe/mozapps/extensions/viewButtons.png
toolkit/themes/winstripe/mozapps/plugins/pluginCrashed-aero.png
toolkit/themes/winstripe/mozapps/plugins/pluginCrashed.png
widget/src/photon/Makefile.in
widget/src/photon/PtRawDrawContainer.cpp
widget/src/photon/PtRawDrawContainer.h
widget/src/photon/nsAppShell.cpp
widget/src/photon/nsAppShell.h
widget/src/photon/nsBidiKeyboard.cpp
widget/src/photon/nsBidiKeyboard.h
widget/src/photon/nsClipboard.cpp
widget/src/photon/nsClipboard.h
widget/src/photon/nsDragService.cpp
widget/src/photon/nsDragService.h
widget/src/photon/nsFilePicker.cpp
widget/src/photon/nsFilePicker.h
widget/src/photon/nsLookAndFeel.cpp
widget/src/photon/nsLookAndFeel.h
widget/src/photon/nsScreenManagerPh.cpp
widget/src/photon/nsScreenManagerPh.h
widget/src/photon/nsScreenPh.cpp
widget/src/photon/nsScreenPh.h
widget/src/photon/nsSound.cpp
widget/src/photon/nsSound.h
widget/src/photon/nsToolkit.cpp
widget/src/photon/nsToolkit.h
widget/src/photon/nsWidget.cpp
widget/src/photon/nsWidget.h
widget/src/photon/nsWidgetFactory.cpp
widget/src/photon/nsWindow.cpp
widget/src/photon/nsWindow.h
widget/src/qt/keysym2ucs.c
widget/src/qt/keysym2ucs.h
widget/src/xremoteclient/PhRemoteClient.cpp
widget/src/xremoteclient/PhRemoteClient.h
xpcom/ds/nsCommaSeparatedTokenizer.h
--- a/Makefile.in
+++ b/Makefile.in
@@ -69,22 +69,16 @@ tier_base_dirs += \
 	memory \
 	$(NULL)
 endif
 
 ifdef COMPILE_ENVIRONMENT
 include $(topsrcdir)/$(MOZ_BUILD_APP)/build.mk
 endif
 
-TIERS += testharness
-
-# test harnesses
-ifdef ENABLE_TESTS
-tier_testharness_dirs += testing/xpcshell
-endif
 
 include $(topsrcdir)/config/config.mk
 
 GARBAGE_DIRS += dist _javagen _profile _tests staticlib
 DIST_GARBAGE = config.cache config.log config.status config-defs.h \
    dependencies.beos config/autoconf.mk \
    unallmakefiles mozilla-config.h \
    netwerk/necko-config.h xpcom/xpcom-config.h xpcom/xpcom-private.h \
--- a/accessible/public/nsIAccessibilityService.h
+++ b/accessible/public/nsIAccessibilityService.h
@@ -36,34 +36,47 @@
  * the provisions above, a recipient may use your version of this file under
  * the terms of any one of the MPL, the GPL or the LGPL.
  *
  * ***** END LICENSE BLOCK ***** */
 
 #ifndef _nsIAccessibilityService_h_
 #define _nsIAccessibilityService_h_
 
-#include "nsISupports.h"
 #include "nsIAccessibleRetrieval.h"
+#include "nsIAccessibleEvent.h"
 
+class nsAccessible;
+class nsIContent;
 class nsIDocument;
 class nsIFrame;
+class nsIPresShell;
 class nsObjectFrame;
-class nsIContent;
 
+// 9f43b315-53c6-4d46-9818-9c8593e91984
 #define NS_IACCESSIBILITYSERVICE_IID \
-{0x33fa2a8d, 0x72e5, 0x4b8b,         \
-  {0xbb, 0x17, 0x6b, 0x22, 0x79, 0x05, 0x5c, 0x6c} }
+{0x9f43b315, 0x53c6, 0x4d46,         \
+  {0x98, 0x18, 0x9c, 0x85, 0x93, 0xe9, 0x19, 0x84} }
 
 class nsIAccessibilityService : public nsIAccessibleRetrieval
 {
 public:
   NS_DECLARE_STATIC_IID_ACCESSOR(NS_IACCESSIBILITYSERVICE_IID)
 
   /**
+   * Return an accessible object for a DOM node in the given pres shell.
+   *
+   * @param  aNode      [in] the DOM node to get an accessible for
+   * @param  aPresShell [in] the presentation shell which contains layout info
+   *                         for the DOM node
+   */
+  virtual nsAccessible* GetAccessibleInShell(nsIDOMNode *aNode,
+                                             nsIPresShell *aPresShell) = 0;
+
+  /**
    * Creates accessible for the given DOM node or frame.
    */
   virtual nsresult CreateOuterDocAccessible(nsIDOMNode *aNode,
                                             nsIAccessible **aAccessible) = 0;
 
   virtual nsresult CreateHTML4ButtonAccessible(nsIFrame *aFrame,
                                                nsIAccessible **aAccessible) = 0;
   virtual nsresult CreateHyperTextAccessible(nsIFrame *aFrame,
@@ -134,17 +147,17 @@ public:
     FRAME_SHOW = 0x04,
     FRAME_HIDE = 0x05,
     FRAME_SIGNIFICANT_CHANGE = 0x06
   };
 
   /**
    * Invalidate the accessible tree when DOM tree or frame tree is changed.
    *
-   * @param aPresShell   [in] the presShell where changes occured
+   * @param aPresShell   [in] the presShell where changes occurred
    * @param aContent     [in] the affected DOM content
    * @param aChangeType  [in] the change type (see constants declared above)
    */
   virtual nsresult InvalidateSubtreeFor(nsIPresShell *aPresShell,
                                         nsIContent *aContent,
                                         PRUint32 aChangeType) = 0;
 
   /**
--- a/accessible/public/nsIAccessibleDocument.idl
+++ b/accessible/public/nsIAccessibleDocument.idl
@@ -53,17 +53,17 @@ interface nsIDOMWindow;
  * You can QueryInterface to nsIAccessibleDocument from
  * the nsIAccessible or nsIAccessNode for the root node
  * of a document. You can also get one from 
  * nsIAccessNode::GetAccessibleDocument() or 
  * nsIAccessibleEvent::GetAccessibleDocument()
  *
  * @status UNDER_REVIEW
  */
-[scriptable, uuid(471909e7-0ea4-4ce0-bf31-a1372b2b285c)]
+[scriptable, uuid(03c6ce8a-aa40-4484-9282-e6579c56e054)]
 interface nsIAccessibleDocument : nsISupports
 {
   /**
    * The URL of the document
    */
   readonly attribute AString URL;
 
   /**
@@ -96,21 +96,9 @@ interface nsIAccessibleDocument : nsISup
    */
   AString getNameSpaceURIForID(in short nameSpaceID);
 
   /**
    * The window handle for the OS window the document is being displayed in.
    * For example, in Windows you can static cast it to an HWND.
    */
   [noscript] readonly attribute voidPtr windowHandle;
-
-  /**
-   * Returns the first accessible parent of a DOM node.
-   * Guaranteed not to return nsnull if the DOM node is in a document.
-   * @param aDOMNode The DOM node we need an accessible for.
-   * @param aCanCreate Can accessibles be created or must it be the first 
-   *                   cached accessible in the parent chain?
-   * @return An first nsIAccessible found by crawling up the DOM node
-   *         to the document root.
-   */
-  nsIAccessible getAccessibleInParentChain(in nsIDOMNode aDOMNode,
-                                           in boolean aCanCreate);
 };
--- a/accessible/public/nsIAccessibleProvider.idl
+++ b/accessible/public/nsIAccessibleProvider.idl
@@ -40,17 +40,17 @@
 
 #include "nsISupports.idl"
 
 /**
  * nsIAccessibleProvider interface is used to link element and accessible
    object. For that XBL binding of element should implement the interface.
  */
 
-[scriptable, uuid(3f7f9194-c625-4a85-8148-6d92d34897fa)]
+[scriptable, uuid(ac0639d5-f95b-4e2b-970c-9eab281fb6a5)]
 interface nsIAccessibleProvider : nsISupports
 {
   /**
    * Constants set of common use.
    */
 
   /** Do not create an accessible for this object
    * This is useful if an ancestor binding already implements nsIAccessibleProvider,
@@ -87,25 +87,22 @@ interface nsIAccessibleProvider : nsISup
   const long XULMenuSeparator = 0x00001010;
   const long XULPane    = 0x00001011;
   const long XULProgressMeter = 0x00001012;
   const long XULScale = 0x00001013;
   const long XULStatusBar = 0x00001014;
   const long XULRadioButton = 0x00001015;
   const long XULRadioGroup = 0x00001016;
 
-  /** The single tab in a dialog or tabbrowser/editor interface */
+  /** Used for XUL tab element */
   const long XULTab = 0x00001017;
-
-  /** A combination of a tabs object and a tabpanels object */
-  const long XULTabBox = 0x00001018;
-
-  /** The collection of tab objects, usable in the TabBox and independent of it
-   as well */
-  const long XULTabs = 0x00001019;
+  /** Used for XUL tabs element, a container for tab elements */
+  const long XULTabs = 0x00001018;
+  /** Used for XUL tabpanels container element */
+  const long XULTabpanels = 0x00001019;
 
   const long XULText             = 0x0000101A;
   const long XULTextBox          = 0x0000101B;
   const long XULThumb            = 0x0000101C;
   const long XULTree             = 0x0000101D;
   const long XULTreeColumns      = 0x0000101E;
   const long XULTreeColumnItem   = 0x0000101F;
   const long XULToolbar          = 0x00001020;
@@ -121,17 +118,17 @@ interface nsIAccessibleProvider : nsISup
   /** Used for xforms elements that provide accessible object for itself as
    * well for anonymous content. This property are used for upload,
    * input[type="xsd:gDay"] and input[type="xsd:gMonth"] */
   const long XFormsContainer = 0x00002000;
 
   /** Used for label element */
   const long XFormsLabel = 0x00002001;
   /** Used for output element */
-  const long XFormsOuput = 0x00002002;
+  const long XFormsOutput = 0x00002002;
   /** Used for trigger and submit elements */
   const long XFormsTrigger = 0x00002003;
   /** Used for input and textarea elements */
   const long XFormsInput = 0x00002004;
   /** Used for input[xsd:boolean] element */
   const long XFormsInputBoolean = 0x00002005;
   /** Used for input[xsd:date] element */
   const long XFormsInputDate = 0x00002006;
--- a/accessible/public/nsIAccessibleRetrieval.idl
+++ b/accessible/public/nsIAccessibleRetrieval.idl
@@ -51,17 +51,17 @@ interface nsIDOMDOMStringList;
  * An interface for in-process accessibility clients
  * wishing to get an nsIAccessible or nsIAccessNode for
  * a given DOM node.
  * More documentation at:
  *   http://www.mozilla.org/projects/ui/accessibility
  *
  * @status UNDER_REVIEW
  */
-[scriptable, uuid(3df14f00-7253-4b9c-97c2-b4632090da23)]
+[scriptable, uuid(3e5cbd5c-dbab-4ea3-b82b-4cd6201d6fe0)]
 interface nsIAccessibleRetrieval : nsISupports
 {
   /**
    * Return application accessible.
    */
   nsIAccessible getApplicationAccessible();
 
   /**
@@ -92,26 +92,16 @@ interface nsIAccessibleRetrieval : nsISu
    * accessible object for returned node.
    *
    * @param aNode - the DOM node to get relevant content node.
    *
    * @return - the DOM node for parent attached accessible
    */
   nsIDOMNode getRelevantContentNodeFor(in nsIDOMNode aNode);
 
-  /**
-   * Return an nsIAccessible for a DOM node in the given pres shell.
-   * Create a new accessible of the appropriate type if necessary,
-   * or use one from the accessibility cache if it already exists.
-   * @param aNode      The DOM node to get an accessible for.
-   * @param aPresShell The presentation shell which contains layout info for the DOM node.
-   * @return The nsIAccessible for the given DOM node.
-   */
-  nsIAccessible getAccessibleInShell(in nsIDOMNode aNode, in nsIPresShell aPresShell);
-
    /**
     * Returns accessible role as a string.
     *
     * @param aRole - the accessible role constants.
     */
   AString getStringRole(in unsigned long aRole);
 
    /**
--- a/accessible/src/atk/nsAccessibleWrap.cpp
+++ b/accessible/src/atk/nsAccessibleWrap.cpp
@@ -889,30 +889,28 @@ getChildCountCB(AtkObject *aAtkObj)
 AtkObject *
 refChildCB(AtkObject *aAtkObj, gint aChildIndex)
 {
     // aChildIndex should not be less than zero
     if (aChildIndex < 0) {
       return nsnull;
     }
 
-    // XXX Fix this so it is not O(n^2) to walk through the children!
-    // Either we can cache the last accessed child so that we can just GetNextSibling()
-    // or we should cache an array of children in each nsAccessible
-    // (instead of mNextSibling on the children)
     nsAccessibleWrap *accWrap = GetAccessibleWrap(aAtkObj);
     if (!accWrap || nsAccUtils::MustPrune(accWrap)) {
         return nsnull;
     }
 
     nsCOMPtr<nsIAccessible> accChild;
     nsCOMPtr<nsIAccessibleHyperText> hyperText;
     accWrap->QueryInterface(NS_GET_IID(nsIAccessibleHyperText), getter_AddRefs(hyperText));
     if (hyperText) {
-        // If HyperText, then number of links matches number of children
+        // If HyperText, then number of links matches number of children.
+        // XXX Fix this so it is not O(n^2) to walk through the children
+        // (bug 566328).
         nsCOMPtr<nsIAccessibleHyperLink> hyperLink;
         hyperText->GetLink(aChildIndex, getter_AddRefs(hyperLink));
         accChild = do_QueryInterface(hyperLink);
     }
     else {
         nsCOMPtr<nsIAccessibleText> accText;
         accWrap->QueryInterface(NS_GET_IID(nsIAccessibleText), getter_AddRefs(accText));
         if (!accText) {  // Accessible Text that is not HyperText has no children
@@ -940,46 +938,36 @@ getIndexInParentCB(AtkObject *aAtkObj)
 {
     // We don't use nsIAccessible::GetIndexInParent() because
     // for ATK we don't want to include text leaf nodes as children
     nsAccessibleWrap *accWrap = GetAccessibleWrap(aAtkObj);
     if (!accWrap) {
         return -1;
     }
 
-    nsCOMPtr<nsIAccessible> parent;
-    accWrap->GetParent(getter_AddRefs(parent));
+    nsAccessible *parent = accWrap->GetParent();
     if (!parent) {
         return -1; // No parent
     }
 
-    nsCOMPtr<nsIAccessible> sibling;
-    parent->GetFirstChild(getter_AddRefs(sibling));
-    if (!sibling) {
-        return -1;  // Error, parent has no children
-    }
-
     PRInt32 currentIndex = 0;
 
-    while (sibling != static_cast<nsIAccessible*>(accWrap)) {
-      NS_ASSERTION(sibling, "Never ran into the same child that we started from");
-
-      if (!sibling) {
-          return -1;
-      }
-      if (nsAccUtils::IsEmbeddedObject(sibling)) {
-        ++ currentIndex;
+    PRInt32 childCount = parent->GetChildCount();
+    for (PRInt32 idx = 0; idx < childCount; idx++) {
+      nsAccessible *sibling = parent->GetChildAt(idx);
+      if (sibling == accWrap) {
+          return currentIndex;
       }
 
-      nsCOMPtr<nsIAccessible> tempAccessible;
-      sibling->GetNextSibling(getter_AddRefs(tempAccessible));
-      sibling.swap(tempAccessible);
+      if (nsAccUtils::IsEmbeddedObject(sibling)) {
+          ++ currentIndex;
+      }
     }
 
-    return currentIndex;
+    return -1;
 }
 
 static void TranslateStates(PRUint32 aState, const AtkStateMap *aStateMap,
                             AtkStateSet *aStateSet)
 {
   NS_ASSERTION(aStateSet, "Can't pass in null state set");
 
   // Convert every state to an entry in AtkStateMap
--- a/accessible/src/base/Makefile.in
+++ b/accessible/src/base/Makefile.in
@@ -45,16 +45,17 @@ include $(DEPTH)/config/autoconf.mk
 MODULE = accessibility
 LIBRARY_NAME = accessibility_base_s
 LIBXUL_LIBRARY = 1
 
 
 CPPSRCS = \
   nsAccessNode.cpp \
   nsAccEvent.cpp \
+  nsAccIterator.cpp \
   nsARIAGridAccessible.cpp \
   nsARIAMap.cpp \
   nsDocAccessible.cpp \
   nsOuterDocAccessible.cpp \
   nsAccessibilityAtoms.cpp \
   nsCoreUtils.cpp \
   nsAccUtils.cpp \
   nsRelUtils.cpp \
--- a/accessible/src/base/nsARIAGridAccessible.cpp
+++ b/accessible/src/base/nsARIAGridAccessible.cpp
@@ -33,17 +33,17 @@
  * and other provisions required by the GPL or the LGPL. If you do not delete
  * the provisions above, a recipient may use your version of this file under
  * the terms of any one of the MPL, the GPL or the LGPL.
  *
  * ***** END LICENSE BLOCK ***** */
 
 #include "nsARIAGridAccessible.h"
 
-#include "nsAccUtils.h"
+#include "nsAccIterator.h"
 
 #include "nsIMutableArray.h"
 #include "nsComponentManagerUtils.h"
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsARIAGridAccessible
 ////////////////////////////////////////////////////////////////////////////////
 
@@ -96,54 +96,58 @@ NS_IMETHODIMP
 nsARIAGridAccessible::GetColumnCount(PRInt32 *acolumnCount)
 {
   NS_ENSURE_ARG_POINTER(acolumnCount);
   *acolumnCount = 0;
 
   if (IsDefunct())
     return NS_ERROR_FAILURE;
 
-  nsCOMPtr<nsIAccessible> row = GetNextRow();
-  nsCOMPtr<nsIAccessible> cell;
-  while ((cell = GetNextCellInRow(row, cell)))
+  nsAccIterator rowIter(this, nsAccIterator::GetRow);
+  nsAccessible *row = rowIter.GetNext();
+
+  nsAccIterator cellIter(row, nsAccIterator::GetCell);
+  nsAccessible *cell = nsnull;
+
+  while ((cell = cellIter.GetNext()))
     (*acolumnCount)++;
 
   return NS_OK;
 }
 
 NS_IMETHODIMP
 nsARIAGridAccessible::GetRowCount(PRInt32 *arowCount)
 {
   NS_ENSURE_ARG_POINTER(arowCount);
   *arowCount = 0;
 
   if (IsDefunct())
     return NS_ERROR_FAILURE;
 
-  nsCOMPtr<nsIAccessible> row;
-  while ((row = GetNextRow(row)))
+  nsAccIterator rowIter(this, nsAccIterator::GetRow);
+  while (rowIter.GetNext())
     (*arowCount)++;
 
   return NS_OK;
 }
 
 NS_IMETHODIMP
 nsARIAGridAccessible::GetCellAt(PRInt32 aRowIndex, PRInt32 aColumnIndex,
                                 nsIAccessible **aAccessible)
 {
   NS_ENSURE_ARG_POINTER(aAccessible);
   *aAccessible = nsnull;
 
   if (IsDefunct())
     return NS_ERROR_FAILURE;
 
-  nsCOMPtr<nsIAccessible> row = GetRowAt(aRowIndex);
+  nsAccessible *row = GetRowAt(aRowIndex);
   NS_ENSURE_ARG(row);
 
-  nsCOMPtr<nsIAccessible> cell = GetCellInRowAt(row, aColumnIndex);
+  nsAccessible *cell = GetCellInRowAt(row, aColumnIndex);
   NS_ENSURE_ARG(cell);
 
   NS_ADDREF(*aAccessible = cell);
   return NS_OK;
 }
 
 NS_IMETHODIMP
 nsARIAGridAccessible::GetCellIndexAt(PRInt32 aRowIndex, PRInt32 aColumnIndex,
@@ -283,50 +287,52 @@ nsARIAGridAccessible::IsColumnSelected(P
   NS_ENSURE_ARG_POINTER(aIsSelected);
   *aIsSelected = PR_FALSE;
 
   if (IsDefunct())
     return NS_ERROR_FAILURE;
 
   NS_ENSURE_ARG(IsValidColumn(aColumn));
 
-  nsCOMPtr<nsIAccessible> row = GetNextRow();
+  nsAccIterator rowIter(this, nsAccIterator::GetRow);
+  nsAccessible *row = rowIter.GetNext();
   if (!row)
     return NS_OK;
 
   do {
     if (!nsAccUtils::IsARIASelected(row)) {
-      nsCOMPtr<nsIAccessible> cell = GetCellInRowAt(row, aColumn);
+      nsAccessible *cell = GetCellInRowAt(row, aColumn);
       if (!cell) // Do not fail due to wrong markup
         return NS_OK;
       
       if (!nsAccUtils::IsARIASelected(cell))
         return NS_OK;
     }
-  } while ((row = GetNextRow(row)));
+  } while ((row = rowIter.GetNext()));
 
   *aIsSelected = PR_TRUE;
   return NS_OK;
 }
 
 NS_IMETHODIMP
 nsARIAGridAccessible::IsRowSelected(PRInt32 aRow, PRBool *aIsSelected)
 {
   NS_ENSURE_ARG_POINTER(aIsSelected);
   *aIsSelected = PR_FALSE;
 
   if (IsDefunct())
     return NS_ERROR_FAILURE;
 
-  nsCOMPtr<nsIAccessible> row = GetRowAt(aRow);
+  nsAccessible *row = GetRowAt(aRow);
   NS_ENSURE_ARG(row);
 
   if (!nsAccUtils::IsARIASelected(row)) {
-    nsCOMPtr<nsIAccessible> cell;
-    while ((cell = GetNextCellInRow(row, cell))) {
+    nsAccIterator cellIter(row, nsAccIterator::GetCell);
+    nsAccessible *cell = nsnull;
+    while ((cell = cellIter.GetNext())) {
       if (!nsAccUtils::IsARIASelected(cell))
         return NS_OK;
     }
   }
 
   *aIsSelected = PR_TRUE;
   return NS_OK;
 }
@@ -336,21 +342,21 @@ nsARIAGridAccessible::IsCellSelected(PRI
                                      PRBool *aIsSelected)
 {
   NS_ENSURE_ARG_POINTER(aIsSelected);
   *aIsSelected = PR_FALSE;
 
   if (IsDefunct())
     return NS_ERROR_FAILURE;
 
-  nsCOMPtr<nsIAccessible> row(GetRowAt(aRow));
+  nsAccessible *row = GetRowAt(aRow);
   NS_ENSURE_ARG(row);
 
   if (!nsAccUtils::IsARIASelected(row)) {
-    nsCOMPtr<nsIAccessible> cell(GetCellInRowAt(row, aColumn));
+    nsAccessible *cell = GetCellInRowAt(row, aColumn);
     NS_ENSURE_ARG(cell);
 
     if (!nsAccUtils::IsARIASelected(cell))
       return NS_OK;
   }
 
   *aIsSelected = PR_TRUE;
   return NS_OK;
@@ -362,26 +368,30 @@ nsARIAGridAccessible::GetSelectedCellCou
   NS_ENSURE_ARG_POINTER(aCount);
   *aCount = 0;
 
   if (IsDefunct())
     return NS_ERROR_FAILURE;
 
   PRInt32 colCount = 0;
   GetColumnCount(&colCount);
-  
-  nsCOMPtr<nsIAccessible> row;
-  while ((row = GetNextRow(row))) {
+
+  nsAccIterator rowIter(this, nsAccIterator::GetRow);
+
+  nsAccessible *row = nsnull;
+  while ((row = rowIter.GetNext())) {
     if (nsAccUtils::IsARIASelected(row)) {
       (*aCount) += colCount;
       continue;
     }
 
-    nsCOMPtr<nsIAccessible> cell;
-    while ((cell = GetNextCellInRow(row, cell))) {
+    nsAccIterator cellIter(row, nsAccIterator::GetCell);
+    nsAccessible *cell = nsnull;
+
+    while ((cell = cellIter.GetNext())) {
       if (nsAccUtils::IsARIASelected(cell))
         (*aCount)++;
     }
   }
 
   return NS_OK;
 }
 
@@ -395,34 +405,37 @@ NS_IMETHODIMP
 nsARIAGridAccessible::GetSelectedRowCount(PRUint32* aCount)
 {
   NS_ENSURE_ARG_POINTER(aCount);
   *aCount = 0;
 
   if (IsDefunct())
     return NS_ERROR_FAILURE;
 
-  nsCOMPtr<nsIAccessible> row;
-  while ((row = GetNextRow(row))) {
+  nsAccIterator rowIter(this, nsAccIterator::GetRow);
+
+  nsAccessible *row = nsnull;
+  while ((row = rowIter.GetNext())) {
     if (nsAccUtils::IsARIASelected(row)) {
       (*aCount)++;
       continue;
     }
 
-    nsCOMPtr<nsIAccessible> cell = GetNextCellInRow(row);
+    nsAccIterator cellIter(row, nsAccIterator::GetCell);
+    nsAccessible *cell = cellIter.GetNext();
     if (!cell)
       continue;
 
     PRBool isRowSelected = PR_TRUE;
     do {
       if (!nsAccUtils::IsARIASelected(cell)) {
         isRowSelected = PR_FALSE;
         break;
       }
-    } while ((cell = GetNextCellInRow(row, cell)));
+    } while ((cell = cellIter.GetNext()));
 
     if (isRowSelected)
       (*aCount)++;
   }
 
   return NS_OK;
 }
 
@@ -435,28 +448,31 @@ nsARIAGridAccessible::GetSelectedCells(n
   if (IsDefunct())
     return NS_ERROR_FAILURE;
 
   nsresult rv = NS_OK;
   nsCOMPtr<nsIMutableArray> selCells =
     do_CreateInstance(NS_ARRAY_CONTRACTID, &rv);
   NS_ENSURE_SUCCESS(rv, rv);
 
-  nsCOMPtr<nsIAccessible> row;
-  while (row = GetNextRow(row)) {
+  nsAccIterator rowIter(this, nsAccIterator::GetRow);
+
+  nsAccessible *row = nsnull;
+  while (row = rowIter.GetNext()) {
+    nsAccIterator cellIter(row, nsAccIterator::GetCell);
+    nsIAccessible *cell = nsnull;
+
     if (nsAccUtils::IsARIASelected(row)) {
-      nsCOMPtr<nsIAccessible> cell;
-      while (cell = GetNextCellInRow(row, cell))
+      while (cell = cellIter.GetNext())
         selCells->AppendElement(cell, PR_FALSE);
 
       continue;
     }
 
-    nsCOMPtr<nsIAccessible> cell;
-    while (cell = GetNextCellInRow(row, cell)) {
+    while (cell = cellIter.GetNext()) {
       if (nsAccUtils::IsARIASelected(cell))
         selCells->AppendElement(cell, PR_FALSE);
     }
   }
 
   NS_ADDREF(*aCells = selCells);
   return NS_OK;
 }
@@ -476,27 +492,31 @@ nsARIAGridAccessible::GetSelectedCellInd
   PRInt32 rowCount = 0;
   GetRowCount(&rowCount);
 
   PRInt32 colCount = 0;
   GetColumnCount(&colCount);
 
   nsTArray<PRInt32> selCells(rowCount * colCount);
 
-  nsCOMPtr<nsIAccessible> row;
-  for (PRInt32 rowIdx = 0; row = GetNextRow(row); rowIdx++) {
+  nsAccIterator rowIter(this, nsAccIterator::GetRow);
+
+  nsAccessible *row = nsnull;
+  for (PRInt32 rowIdx = 0; row = rowIter.GetNext(); rowIdx++) {
     if (nsAccUtils::IsARIASelected(row)) {
       for (PRInt32 colIdx = 0; colIdx < colCount; colIdx++)
         selCells.AppendElement(rowIdx * colCount + colIdx);
 
       continue;
     }
 
-    nsCOMPtr<nsIAccessible> cell;
-    for (PRInt32 colIdx = 0; cell = GetNextCellInRow(row, cell); colIdx++) {
+    nsAccIterator cellIter(row, nsAccIterator::GetCell);
+    nsAccessible *cell = nsnull;
+
+    for (PRInt32 colIdx = 0; cell = cellIter.GetNext(); colIdx++) {
       if (nsAccUtils::IsARIASelected(cell))
         selCells.AppendElement(rowIdx * colCount + colIdx);
     }
   }
 
   PRUint32 selCellsCount = selCells.Length();
   if (!selCellsCount)
     return NS_OK;
@@ -532,34 +552,37 @@ nsARIAGridAccessible::GetSelectedRowIndi
 
   PRInt32 rowCount = 0;
   GetRowCount(&rowCount);
   if (!rowCount)
     return NS_OK;
 
   nsTArray<PRInt32> selRows(rowCount);
 
-  nsCOMPtr<nsIAccessible> row;
-  for (PRInt32 rowIdx = 0; row = GetNextRow(row); rowIdx++) {
+  nsAccIterator rowIter(this, nsAccIterator::GetRow);
+
+  nsAccessible *row = nsnull;
+  for (PRInt32 rowIdx = 0; row = rowIter.GetNext(); rowIdx++) {
     if (nsAccUtils::IsARIASelected(row)) {
       selRows.AppendElement(rowIdx);
       continue;
     }
 
-    nsCOMPtr<nsIAccessible> cell = GetNextCellInRow(row);
+    nsAccIterator cellIter(row, nsAccIterator::GetCell);
+    nsAccessible *cell = cellIter.GetNext();
     if (!cell)
       continue;
 
     PRBool isRowSelected = PR_TRUE;
     do {
       if (!nsAccUtils::IsARIASelected(cell)) {
         isRowSelected = PR_FALSE;
         break;
       }
-    } while ((cell = GetNextCellInRow(row, cell)));
+    } while ((cell = cellIter.GetNext()));
 
     if (isRowSelected)
       selRows.AppendElement(rowIdx);
   }
 
   PRUint32 selrowCount = selRows.Length();
   if (!selrowCount)
     return NS_OK;
@@ -575,73 +598,79 @@ nsARIAGridAccessible::GetSelectedRowIndi
 NS_IMETHODIMP
 nsARIAGridAccessible::SelectRow(PRInt32 aRow)
 {
   NS_ENSURE_ARG(IsValidRow(aRow));
 
   if (IsDefunct())
     return NS_ERROR_FAILURE;
 
-  nsCOMPtr<nsIAccessible> row;
-  for (PRInt32 rowIdx = 0; row = GetNextRow(row); rowIdx++) {
+  nsAccIterator rowIter(this, nsAccIterator::GetRow);
+
+  nsAccessible *row = nsnull;
+  for (PRInt32 rowIdx = 0; row = rowIter.GetNext(); rowIdx++) {
     nsresult rv = SetARIASelected(row, rowIdx == aRow);
     NS_ENSURE_SUCCESS(rv, rv);
   }
 
   return NS_OK;
 }
 
 NS_IMETHODIMP
 nsARIAGridAccessible::SelectColumn(PRInt32 aColumn)
 {
   NS_ENSURE_ARG(IsValidColumn(aColumn));
 
   if (IsDefunct())
     return NS_ERROR_FAILURE;
 
-  nsCOMPtr<nsIAccessible> row;
-  while ((row = GetNextRow(row))) {
+  nsAccIterator rowIter(this, nsAccIterator::GetRow);
+
+  nsAccessible *row = nsnull;
+  while ((row = rowIter.GetNext())) {
     // Unselect all cells in the row.
     nsresult rv = SetARIASelected(row, PR_FALSE);
     NS_ENSURE_SUCCESS(rv, rv);
 
     // Select cell at the column index.
-    nsCOMPtr<nsIAccessible> cell = GetCellInRowAt(row, aColumn);
+    nsAccessible *cell = GetCellInRowAt(row, aColumn);
     if (cell) {
       rv = SetARIASelected(cell, PR_TRUE);
       NS_ENSURE_SUCCESS(rv, rv);
     }
   }
 
   return NS_OK;
 }
 
 NS_IMETHODIMP
 nsARIAGridAccessible::UnselectRow(PRInt32 aRow)
 {
   if (IsDefunct())
     return NS_ERROR_FAILURE;
 
-  nsCOMPtr<nsIAccessible> row = GetRowAt(aRow);
+  nsAccessible *row = GetRowAt(aRow);
   NS_ENSURE_ARG(row);
 
   return SetARIASelected(row, PR_FALSE);
 }
 
 NS_IMETHODIMP
 nsARIAGridAccessible::UnselectColumn(PRInt32 aColumn)
 {
   NS_ENSURE_ARG(IsValidColumn(aColumn));
 
   if (IsDefunct())
     return NS_ERROR_FAILURE;
 
-  nsCOMPtr<nsIAccessible> row;
-  while ((row = GetNextRow(row))) {
-    nsCOMPtr<nsIAccessible> cell = GetCellInRowAt(row, aColumn);
+  nsAccIterator rowIter(this, nsAccIterator::GetRow);
+
+  nsAccessible *row = nsnull;
+  while ((row = rowIter.GetNext())) {
+    nsAccessible *cell = GetCellInRowAt(row, aColumn);
     if (cell) {
       nsresult rv = SetARIASelected(cell, PR_FALSE);
       NS_ENSURE_SUCCESS(rv, rv);
     }
   }
 
   return NS_OK;
 }
@@ -691,94 +720,49 @@ nsARIAGridAccessible::IsValidRowNColumn(
   if (aRow >= rowCount)
     return PR_FALSE;
 
   PRInt32 colCount = 0;
   GetColumnCount(&colCount);
   return aColumn < colCount;
 }
 
-already_AddRefed<nsIAccessible>
+nsAccessible*
 nsARIAGridAccessible::GetRowAt(PRInt32 aRow)
 {
   PRInt32 rowIdx = aRow;
-  nsCOMPtr<nsIAccessible> row(GetNextRow());
-  while (rowIdx != 0 && (row = GetNextRow(row)))
+
+  nsAccIterator rowIter(this, nsAccIterator::GetRow);
+
+  nsAccessible *row = rowIter.GetNext();
+  while (rowIdx != 0 && (row = rowIter.GetNext()))
     rowIdx--;
 
-  return row.forget();
-}
-
-already_AddRefed<nsIAccessible>
-nsARIAGridAccessible::GetCellInRowAt(nsIAccessible *aRow, PRInt32 aColumn)
-{
-  PRInt32 colIdx = aColumn;
-  nsCOMPtr<nsIAccessible> cell(GetNextCellInRow(aRow));
-  while (colIdx != 0 && (cell = GetNextCellInRow(aRow, cell)))
-    colIdx--;
-
-  return cell.forget();
+  return row;
 }
 
-already_AddRefed<nsIAccessible>
-nsARIAGridAccessible::GetNextRow(nsIAccessible *aRow)
+nsAccessible*
+nsARIAGridAccessible::GetCellInRowAt(nsAccessible *aRow, PRInt32 aColumn)
 {
-  nsCOMPtr<nsIAccessible> nextRow, tmpAcc;
-  if (!aRow)
-    GetFirstChild(getter_AddRefs(nextRow));
-  else
-    aRow->GetNextSibling(getter_AddRefs(nextRow));
-
-  while (nextRow) {
-    if (nsAccUtils::Role(nextRow) == nsIAccessibleRole::ROLE_ROW)
-      return nextRow.forget();
-
-    nextRow->GetNextSibling(getter_AddRefs(tmpAcc));
-    tmpAcc.swap(nextRow);
-  }
-
-  return nsnull;
-}
+  PRInt32 colIdx = aColumn;
 
-already_AddRefed<nsIAccessible>
-nsARIAGridAccessible::GetNextCellInRow(nsIAccessible *aRow, nsIAccessible *aCell)
-{
-  if (!aRow)
-    return nsnull;
-
-  nsCOMPtr<nsIAccessible> nextCell, tmpAcc;
-  if (!aCell)
-    aRow->GetFirstChild(getter_AddRefs(nextCell));
-  else
-    aCell->GetNextSibling(getter_AddRefs(nextCell));
+  nsAccIterator cellIter(aRow, nsAccIterator::GetCell);
+  nsAccessible *cell = cellIter.GetNext();
+  while (colIdx != 0 && (cell = cellIter.GetNext()))
+    colIdx--;
 
-  while (nextCell) {
-    PRUint32 role = nsAccUtils::Role(nextCell);
-    if (role == nsIAccessibleRole::ROLE_GRID_CELL ||
-        role == nsIAccessibleRole::ROLE_ROWHEADER ||
-        role == nsIAccessibleRole::ROLE_COLUMNHEADER)
-      return nextCell.forget();
-
-    nextCell->GetNextSibling(getter_AddRefs(tmpAcc));
-    tmpAcc.swap(nextCell);
-  }
-
-  return nsnull;
+  return cell;
 }
 
 nsresult
-nsARIAGridAccessible::SetARIASelected(nsIAccessible *aAccessible,
+nsARIAGridAccessible::SetARIASelected(nsAccessible *aAccessible,
                                       PRBool aIsSelected, PRBool aNotify)
 {
-  nsRefPtr<nsAccessible> acc = do_QueryObject(aAccessible);
-  nsCOMPtr<nsIDOMNode> node;
-  acc->GetDOMNode(getter_AddRefs(node));
-  NS_ENSURE_STATE(node);
-
-  nsCOMPtr<nsIContent> content(do_QueryInterface(node));
+  nsCOMPtr<nsIContent> content(do_QueryInterface(aAccessible->GetDOMNode()));
+  NS_ENSURE_STATE(content);
 
   nsresult rv = NS_OK;
   if (aIsSelected)
     rv = content->SetAttr(kNameSpaceID_None, nsAccessibilityAtoms::aria_selected,
                           NS_LITERAL_STRING("true"), aNotify);
   else
     rv = content->UnsetAttr(kNameSpaceID_None,
                             nsAccessibilityAtoms::aria_selected, aNotify);
@@ -795,40 +779,42 @@ nsARIAGridAccessible::SetARIASelected(ns
   if (aIsSelected)
     return NS_OK;
 
   PRUint32 role = nsAccUtils::Role(aAccessible);
 
   // If the given accessible is row that was unselected then remove
   // aria-selected from cell accessible.
   if (role == nsIAccessibleRole::ROLE_ROW) {
-    nsCOMPtr<nsIAccessible> cell;
-    while ((cell = GetNextCellInRow(aAccessible, cell))) {
+    nsAccIterator cellIter(aAccessible, nsAccIterator::GetCell);
+    nsAccessible *cell = nsnull;
+
+    while ((cell = cellIter.GetNext())) {
       rv = SetARIASelected(cell, PR_FALSE, PR_FALSE);
       NS_ENSURE_SUCCESS(rv, rv);
     }
     return NS_OK;
   }
 
   // If the given accessible is cell that was unselected and its row is selected
   // then remove aria-selected from row and put aria-selected on
   // siblings cells.
   if (role == nsIAccessibleRole::ROLE_GRID_CELL ||
       role == nsIAccessibleRole::ROLE_ROWHEADER ||
       role == nsIAccessibleRole::ROLE_COLUMNHEADER) {
-    nsCOMPtr<nsIAccessible> row;
-    aAccessible->GetParent(getter_AddRefs(row));
+    nsAccessible *row = aAccessible->GetParent();
 
     if (nsAccUtils::Role(row) == nsIAccessibleRole::ROLE_ROW &&
         nsAccUtils::IsARIASelected(row)) {
       rv = SetARIASelected(row, PR_FALSE, PR_FALSE);
       NS_ENSURE_SUCCESS(rv, rv);
 
-      nsCOMPtr<nsIAccessible> cell;
-      while ((cell = GetNextCellInRow(row, cell))) {
+      nsAccIterator cellIter(row, nsAccIterator::GetCell);
+      nsAccessible *cell = nsnull;
+      while ((cell = cellIter.GetNext())) {
         if (cell != aAccessible) {
           rv = SetARIASelected(cell, PR_TRUE, PR_FALSE);
           NS_ENSURE_SUCCESS(rv, rv);
         }
       }
     }
   }
 
@@ -842,17 +828,18 @@ nsARIAGridAccessible::GetSelectedColumns
   NS_ENSURE_ARG_POINTER(acolumnCount);
   *acolumnCount = 0;
   if (aColumns)
     *aColumns = nsnull;
 
   if (IsDefunct())
     return NS_ERROR_FAILURE;
 
-  nsCOMPtr<nsIAccessible> row = GetNextRow();
+  nsAccIterator rowIter(this, nsAccIterator::GetRow);
+  nsAccessible *row = rowIter.GetNext();
   if (!row)
     return NS_OK;
 
   PRInt32 colCount = 0;
   GetColumnCount(&colCount);
   if (!colCount)
     return NS_OK;
 
@@ -863,25 +850,27 @@ nsARIAGridAccessible::GetSelectedColumns
   for (PRInt32 i = 0; i < selColCount; i++)
     isColSelArray[i] = PR_TRUE;
 
   do {
     if (nsAccUtils::IsARIASelected(row))
       continue;
 
     PRInt32 colIdx = 0;
-    nsCOMPtr<nsIAccessible> cell;
-    for (colIdx = 0; cell = GetNextCellInRow(row, cell); colIdx++) {
+
+    nsAccIterator cellIter(row, nsAccIterator::GetCell);
+    nsAccessible *cell = nsnull;
+    for (colIdx = 0; cell = cellIter.GetNext(); colIdx++) {
       if (isColSelArray.SafeElementAt(colIdx, PR_FALSE) &&
           !nsAccUtils::IsARIASelected(cell)) {
         isColSelArray[colIdx] = PR_FALSE;
         selColCount--;
       }
     }
-  } while ((row = GetNextRow(row)));
+  } while ((row = rowIter.GetNext()));
 
   if (!selColCount)
     return NS_OK;
 
   if (!aColumns) {
     *acolumnCount = selColCount;
     return NS_OK;
   }
@@ -1125,52 +1114,48 @@ nsARIAGridCellAccessible::GetAttributesI
   if (IsDefunct())
     return NS_ERROR_FAILURE;
   
   nsresult rv = nsHyperTextAccessibleWrap::GetAttributesInternal(aAttributes);
   NS_ENSURE_SUCCESS(rv, rv);
 
   // Expose "table-cell-index" attribute.
 
-  nsCOMPtr<nsIAccessible> thisRow;
-  GetParent(getter_AddRefs(thisRow));
+  nsAccessible *thisRow = GetParent();
   if (nsAccUtils::Role(thisRow) != nsIAccessibleRole::ROLE_ROW)
     return NS_OK;
 
   PRInt32 colIdx = 0, colCount = 0;
-  nsCOMPtr<nsIAccessible> child, nextChild;
-  thisRow->GetFirstChild(getter_AddRefs(child));
-  while (child) {
+  PRInt32 childCount = thisRow->GetChildCount();
+  for (PRInt32 childIdx = 0; childIdx < childCount; childIdx++) {
+    nsAccessible *child = thisRow->GetChildAt(childIdx);
     if (child == this)
       colIdx = colCount;
 
     PRUint32 role = nsAccUtils::Role(child);
     if (role == nsIAccessibleRole::ROLE_GRID_CELL ||
         role == nsIAccessibleRole::ROLE_ROWHEADER ||
         role == nsIAccessibleRole::ROLE_COLUMNHEADER)
       colCount++;
-
-    child->GetNextSibling(getter_AddRefs(nextChild));
-    child.swap(nextChild);
   }
 
-  nsCOMPtr<nsIAccessible> table;
-  thisRow->GetParent(getter_AddRefs(table));
+  nsAccessible *table = thisRow->GetParent();
   if (nsAccUtils::Role(table) != nsIAccessibleRole::ROLE_TABLE &&
       nsAccUtils::Role(table) != nsIAccessibleRole::ROLE_TREE_TABLE)
     return NS_OK;
 
   PRInt32 rowIdx = 0;
-  table->GetFirstChild(getter_AddRefs(child));
-  while (child && child != thisRow) {
+  childCount = table->GetChildCount();
+  for (PRInt32 childIdx = 0; childIdx < childCount; childIdx++) {
+    nsAccessible *child = table->GetChildAt(childIdx);
+    if (child == thisRow)
+      break;
+
     if (nsAccUtils::Role(child) == nsIAccessibleRole::ROLE_ROW)
       rowIdx++;
-
-    child->GetNextSibling(getter_AddRefs(nextChild));
-    child.swap(nextChild);
   }
 
   PRInt32 idx = rowIdx * colCount + colIdx;
 
   nsAutoString stringIdx;
   stringIdx.AppendInt(idx);
   nsAccUtils::SetAccAttr(aAttributes, nsAccessibilityAtoms::tableCellIndex,
                          stringIdx);
--- a/accessible/src/base/nsARIAGridAccessible.h
+++ b/accessible/src/base/nsARIAGridAccessible.h
@@ -72,51 +72,32 @@ protected:
   /**
    * Retrun true if given row and column indexes are valid.
    */
   PRBool IsValidRowNColumn(PRInt32 aRow, PRInt32 aColumn);
 
   /**
    * Return row accessible at the given row index.
    */
-  already_AddRefed<nsIAccessible> GetRowAt(PRInt32 aRow);
+  nsAccessible *GetRowAt(PRInt32 aRow);
 
   /**
    * Return cell accessible at the given column index in the row.
    */
-  already_AddRefed<nsIAccessible> GetCellInRowAt(nsIAccessible *aRow,
-                                                 PRInt32 aColumn);
-
-  /**
-   * Return next row accessible relative given row accessible or first row
-   * accessible if it is null.
-   *
-   * @param  aRow  [in, optional] row accessible
-   */
-  already_AddRefed<nsIAccessible> GetNextRow(nsIAccessible *aRow = nsnull);
-
-  /**
-   * Return next cell accessible relative given cell accessible or first cell
-   * in the given row accessible if given cell accessible is null.
-   *
-   * @param  aRow   [in] row accessible
-   * @param  aCell  [in, optional] cell accessible
-   */
-  already_AddRefed<nsIAccessible> GetNextCellInRow(nsIAccessible *aRow,
-                                                   nsIAccessible *aCell = nsnull);
+  nsAccessible *GetCellInRowAt(nsAccessible *aRow, PRInt32 aColumn);
 
   /**
    * Set aria-selected attribute value on DOM node of the given accessible.
    *
    * @param  aAccessible  [in] accessible
    * @param  aIsSelected  [in] new value of aria-selected attribute
    * @param  aNotify      [in, optional] specifies if DOM should be notified
    *                       about attribute change (used internally).
    */
-  nsresult SetARIASelected(nsIAccessible *aAccessible, PRBool aIsSelected,
+  nsresult SetARIASelected(nsAccessible *aAccessible, PRBool aIsSelected,
                            PRBool aNotify = PR_TRUE);
 
   /**
    * Helper method for GetSelectedColumnCount and GetSelectedColumns.
    */
   nsresult GetSelectedColumnsArray(PRUint32 *acolumnCount,
                                    PRInt32 **aColumns = nsnull);
 };
--- a/accessible/src/base/nsAccEvent.cpp
+++ b/accessible/src/base/nsAccEvent.cpp
@@ -251,17 +251,17 @@ nsAccEvent::CaptureIsFromUserInput(EIsFr
   if (aIsFromUserInput != eAutoDetect) {
     mIsFromUserInput = aIsFromUserInput == eFromUserInput ? PR_TRUE : PR_FALSE;
     return;
   }
 
   if (!targetNode)
     return;
 
-  nsCOMPtr<nsIPresShell> presShell = nsCoreUtils::GetPresShellFor(targetNode);
+  nsIPresShell *presShell = nsCoreUtils::GetPresShellFor(targetNode);
   if (!presShell) {
     NS_NOTREACHED("Threre should always be an pres shell for an event");
     return;
   }
 
   nsIEventStateManager *esm = presShell->GetPresContext()->EventStateManager();
   if (!esm) {
     NS_NOTREACHED("There should always be an ESM for an event");
@@ -309,21 +309,26 @@ nsAccReorderEvent::HasAccessibleInReason
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsAccStateChangeEvent
 ////////////////////////////////////////////////////////////////////////////////
 
 NS_IMPL_ISUPPORTS_INHERITED1(nsAccStateChangeEvent, nsAccEvent,
                              nsIAccessibleStateChangeEvent)
 
+// Note: we pass in eAllowDupes to the base class because we don't currently
+// support correct state change coalescence (XXX Bug 569356). Also we need to
+// decide how to coalesce events created via accessible (instead of node).
 nsAccStateChangeEvent::
   nsAccStateChangeEvent(nsIAccessible *aAccessible,
                         PRUint32 aState, PRBool aIsExtraState,
-                        PRBool aIsEnabled):
-  nsAccEvent(::nsIAccessibleEvent::EVENT_STATE_CHANGE, aAccessible),
+                        PRBool aIsEnabled, PRBool aIsAsynch,
+                        EIsFromUserInput aIsFromUserInput):
+  nsAccEvent(nsIAccessibleEvent::EVENT_STATE_CHANGE, aAccessible, aIsAsynch,
+             aIsFromUserInput, eAllowDupes),
   mState(aState), mIsExtraState(aIsExtraState), mIsEnabled(aIsEnabled)
 {
 }
 
 nsAccStateChangeEvent::
   nsAccStateChangeEvent(nsIDOMNode *aNode,
                         PRUint32 aState, PRBool aIsExtraState,
                         PRBool aIsEnabled):
@@ -374,22 +379,30 @@ nsAccStateChangeEvent::IsEnabled(PRBool 
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsAccTextChangeEvent
 ////////////////////////////////////////////////////////////////////////////////
 
 NS_IMPL_ISUPPORTS_INHERITED1(nsAccTextChangeEvent, nsAccEvent,
                              nsIAccessibleTextChangeEvent)
 
+// Note: we pass in eAllowDupes to the base class because we don't support text
+// events coalescence. We fire delayed text change events in nsDocAccessible but
+// we continue to base the event off the accessible object rather than just the
+// node. This means we won't try to create an accessible based on the node when
+// we are ready to fire the event and so we will no longer assert at that point
+// if the node was removed from the document. Either way, the AT won't work with
+// a defunct accessible so the behaviour should be equivalent.
+// XXX revisit this when coalescence is faster (eCoalesceFromSameSubtree)
 nsAccTextChangeEvent::
   nsAccTextChangeEvent(nsIAccessible *aAccessible,
                        PRInt32 aStart, PRUint32 aLength, PRBool aIsInserted,
                        PRBool aIsAsynch, EIsFromUserInput aIsFromUserInput) :
   nsAccEvent(aIsInserted ? nsIAccessibleEvent::EVENT_TEXT_INSERTED : nsIAccessibleEvent::EVENT_TEXT_REMOVED,
-             aAccessible, aIsAsynch, aIsFromUserInput),
+             aAccessible, aIsAsynch, aIsFromUserInput, eAllowDupes),
   mStart(aStart), mLength(aLength), mIsInserted(aIsInserted)
 {
 #ifdef XP_WIN
   nsCOMPtr<nsIAccessibleText> textAccessible = do_QueryInterface(aAccessible);
   NS_ASSERTION(textAccessible, "Should not be firing test change event for non-text accessible!!!");
   if (textAccessible) {
     textAccessible->GetText(aStart, aStart + aLength, mModifiedText);
   }
--- a/accessible/src/base/nsAccEvent.h
+++ b/accessible/src/base/nsAccEvent.h
@@ -193,17 +193,18 @@ NS_DEFINE_STATIC_IID_ACCESSOR(nsAccReord
 
 
 class nsAccStateChangeEvent: public nsAccEvent,
                              public nsIAccessibleStateChangeEvent
 {
 public:
   nsAccStateChangeEvent(nsIAccessible *aAccessible,
                         PRUint32 aState, PRBool aIsExtraState,
-                        PRBool aIsEnabled);
+                        PRBool aIsEnabled, PRBool aIsAsynch = PR_FALSE,
+                        EIsFromUserInput aIsFromUserInput = eAutoDetect);
 
   nsAccStateChangeEvent(nsIDOMNode *aNode,
                         PRUint32 aState, PRBool aIsExtraState,
                         PRBool aIsEnabled);
 
   nsAccStateChangeEvent(nsIDOMNode *aNode,
                         PRUint32 aState, PRBool aIsExtraState);
 
new file mode 100644
--- /dev/null
+++ b/accessible/src/base/nsAccIterator.cpp
@@ -0,0 +1,93 @@
+/* ***** BEGIN LICENSE BLOCK *****
+ * Version: MPL 1.1/GPL 2.0/LGPL 2.1
+ *
+ * The contents of this file are subject to the Mozilla Public License Version
+ * 1.1 (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ * http://www.mozilla.org/MPL/
+ *
+ * Software distributed under the License is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
+ * for the specific language governing rights and limitations under the
+ * License.
+ *
+ * The Original Code is mozilla.org code.
+ *
+ * The Initial Developer of the Original Code is
+ * Mozilla Foundation.
+ * Portions created by the Initial Developer are Copyright (C) 2010
+ * the Initial Developer. All Rights Reserved.
+ *
+ * Contributor(s):
+ *  Alexander Surkov <surkov.alexander@gmail.com> (original author)
+ *
+ * Alternatively, the contents of this file may be used under the terms of
+ * either the GNU General Public License Version 2 or later (the "GPL"), or
+ * the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
+ * in which case the provisions of the GPL or the LGPL are applicable instead
+ * of those above. If you wish to allow use of your version of this file only
+ * under the terms of either the GPL or the LGPL, and not to allow others to
+ * use your version of this file under the terms of the MPL, indicate your
+ * decision by deleting the provisions above and replace them with the notice
+ * and other provisions required by the GPL or the LGPL. If you do not delete
+ * the provisions above, a recipient may use your version of this file under
+ * the terms of any one of the MPL, the GPL or the LGPL.
+ *
+ * ***** END LICENSE BLOCK ***** */
+
+#include "nsAccIterator.h"
+
+////////////////////////////////////////////////////////////////////////////////
+// nsAccIterator
+
+nsAccIterator::nsAccIterator(nsAccessible *aAccessible,
+                             AccIteratorFilterFuncPtr aFilterFunc,
+                             IterationType aIterationType) :
+  mFilterFunc(aFilterFunc), mIsDeep(aIterationType != eFlatNav)
+{
+  mState = new IteratorState(aAccessible);
+}
+
+nsAccIterator::~nsAccIterator()
+{
+  while (mState) {
+    IteratorState *tmp = mState;
+    mState = tmp->mParentState;
+    delete tmp;
+  }
+}
+
+nsAccessible*
+nsAccIterator::GetNext()
+{
+  while (mState) {
+    nsAccessible *child = mState->mParent->GetChildAt(mState->mIndex++);
+    if (!child) {
+      IteratorState *tmp = mState;
+      mState = mState->mParentState;
+      delete tmp;
+
+      continue;
+    }
+
+    PRBool isComplying = mFilterFunc(child);
+    if (isComplying)
+      return child;
+
+    if (mIsDeep) {
+      IteratorState *childState = new IteratorState(child, mState);
+      mState = childState;
+    }
+  }
+
+  return nsnull;
+}
+
+////////////////////////////////////////////////////////////////////////////////
+// nsAccIterator::IteratorState
+
+nsAccIterator::IteratorState::IteratorState(nsAccessible *aParent,
+                                            IteratorState *mParentState) :
+  mParent(aParent), mIndex(0), mParentState(mParentState)
+{
+}
new file mode 100644
--- /dev/null
+++ b/accessible/src/base/nsAccIterator.h
@@ -0,0 +1,124 @@
+/* ***** BEGIN LICENSE BLOCK *****
+ * Version: MPL 1.1/GPL 2.0/LGPL 2.1
+ *
+ * The contents of this file are subject to the Mozilla Public License Version
+ * 1.1 (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ * http://www.mozilla.org/MPL/
+ *
+ * Software distributed under the License is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
+ * for the specific language governing rights and limitations under the
+ * License.
+ *
+ * The Original Code is mozilla.org code.
+ *
+ * The Initial Developer of the Original Code is
+ * Mozilla Foundation.
+ * Portions created by the Initial Developer are Copyright (C) 2010
+ * the Initial Developer. All Rights Reserved.
+ *
+ * Contributor(s):
+ *  Alexander Surkov <surkov.alexander@gmail.com> (original author)
+ *
+ * Alternatively, the contents of this file may be used under the terms of
+ * either the GNU General Public License Version 2 or later (the "GPL"), or
+ * the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
+ * in which case the provisions of the GPL or the LGPL are applicable instead
+ * of those above. If you wish to allow use of your version of this file only
+ * under the terms of either the GPL or the LGPL, and not to allow others to
+ * use your version of this file under the terms of the MPL, indicate your
+ * decision by deleting the provisions above and replace them with the notice
+ * and other provisions required by the GPL or the LGPL. If you do not delete
+ * the provisions above, a recipient may use your version of this file under
+ * the terms of any one of the MPL, the GPL or the LGPL.
+ *
+ * ***** END LICENSE BLOCK ***** */
+
+#ifndef nsAccIterator_h_
+#define nsAccIterator_h_
+
+#include "nsAccessible.h"
+#include "nsAccUtils.h"
+
+/**
+ * Return true if the traversed accessible complies with filter.
+ */
+typedef PRBool (*AccIteratorFilterFuncPtr) (nsAccessible *);
+
+/**
+ * Allows to iterate through accessible children or subtree complying with
+ * filter function.
+ */
+class nsAccIterator
+{
+public:
+  /**
+   * Used to define iteration type.
+   */
+  enum IterationType {
+    /**
+     * Navigation happens through direct children.
+     */
+    eFlatNav,
+
+    /**
+     * Navigation through subtree excluding iterator root; if the accessible
+     * complies with filter, iterator ignores its children.
+     */
+    eTreeNav
+  };
+
+  nsAccIterator(nsAccessible *aRoot, AccIteratorFilterFuncPtr aFilterFunc,
+                IterationType aIterationType = eFlatNav);
+  ~nsAccIterator();
+
+  /**
+   * Return next accessible complying with filter function. Return the first
+   * accessible for the first time.
+   */
+  nsAccessible *GetNext();
+
+  /**
+   * Predefined filters.
+   */
+  static PRBool GetSelected(nsAccessible *aAccessible)
+  {
+    return nsAccUtils::State(aAccessible) & nsIAccessibleStates::STATE_SELECTED;
+  }
+  static PRBool GetSelectable(nsAccessible *aAccessible)
+  {
+    return nsAccUtils::State(aAccessible) & nsIAccessibleStates::STATE_SELECTABLE;
+  }
+  static PRBool GetRow(nsAccessible *aAccessible)
+  {
+    return nsAccUtils::Role(aAccessible) == nsIAccessibleRole::ROLE_ROW;
+  }
+  static PRBool GetCell(nsAccessible *aAccessible)
+  {
+    PRUint32 role = nsAccUtils::Role(aAccessible);
+    return role == nsIAccessibleRole::ROLE_GRID_CELL ||
+           role == nsIAccessibleRole::ROLE_ROWHEADER ||
+           role == nsIAccessibleRole::ROLE_COLUMNHEADER;
+  }
+
+private:
+  nsAccIterator();
+  nsAccIterator(const nsAccIterator&);
+  nsAccIterator& operator =(const nsAccIterator&);
+
+  struct IteratorState
+  {
+    IteratorState(nsAccessible *aParent, IteratorState *mParentState = nsnull);
+
+    nsAccessible *mParent;
+    PRInt32 mIndex;
+    IteratorState *mParentState;
+  };
+
+  AccIteratorFilterFuncPtr mFilterFunc;
+  PRBool mIsDeep;
+  IteratorState *mState;
+};
+
+#endif
--- a/accessible/src/base/nsAccUtils.cpp
+++ b/accessible/src/base/nsAccUtils.cpp
@@ -118,17 +118,17 @@ nsAccUtils::GetDefaultLevel(nsAccessible
   }
 
   return 0;
 }
 
 PRInt32
 nsAccUtils::GetARIAOrDefaultLevel(nsIAccessible *aAcc)
 {
-  nsRefPtr<nsAccessible> acc = nsAccUtils::QueryObject<nsAccessible>(aAcc);
+  nsRefPtr<nsAccessible> acc = do_QueryObject(aAcc);
   NS_ENSURE_TRUE(acc, 0);
 
   nsCOMPtr<nsIDOMNode> node;
   acc->GetDOMNode(getter_AddRefs(node));
   nsCOMPtr<nsIContent> content(do_QueryInterface(node));
   NS_ENSURE_TRUE(content, 0);
 
   PRInt32 level = 0;
@@ -347,17 +347,17 @@ nsAccUtils::HasAccessibleChildren(nsIDOM
 {
   if (!aNode)
     return PR_FALSE;
 
   nsCOMPtr<nsIContent> content(do_QueryInterface(aNode));
   if (!content)
     return PR_FALSE;
 
-  nsCOMPtr<nsIPresShell> presShell = nsCoreUtils::GetPresShellFor(aNode);
+  nsIPresShell *presShell = nsCoreUtils::GetPresShellFor(aNode);
   if (!presShell)
     return PR_FALSE;
 
   nsIFrame *frame = content->GetPrimaryFrame();
   if (!frame)
     return PR_FALSE;
 
   nsCOMPtr<nsIWeakReference> weakShell(do_GetWeakReference(presShell));
@@ -547,56 +547,56 @@ nsAccUtils::IsARIASelected(nsIAccessible
 
 already_AddRefed<nsIAccessibleText>
 nsAccUtils::GetTextAccessibleFromSelection(nsISelection *aSelection,
                                            nsIDOMNode **aNode)
 {
   // Get accessible from selection's focus DOM point (the DOM point where
   // selection is ended).
 
-  nsCOMPtr<nsIDOMNode> focusNode;
-  aSelection->GetFocusNode(getter_AddRefs(focusNode));
-  if (!focusNode)
+  nsCOMPtr<nsIDOMNode> focusDOMNode;
+  aSelection->GetFocusNode(getter_AddRefs(focusDOMNode));
+  if (!focusDOMNode)
     return nsnull;
 
   PRInt32 focusOffset = 0;
   aSelection->GetFocusOffset(&focusOffset);
 
-  nsCOMPtr<nsIDOMNode> resultNode =
+  nsCOMPtr<nsINode> focusNode(do_QueryInterface(focusDOMNode));
+  nsCOMPtr<nsINode> resultNode =
     nsCoreUtils::GetDOMNodeFromDOMPoint(focusNode, focusOffset);
 
   // Get text accessible containing the result node.
   while (resultNode) {
     // Make sure to get the correct starting node for selection events inside
     // XBL content trees.
-    nsCOMPtr<nsIDOMNode> relevantNode;
-    GetAccService()->GetRelevantContentNodeFor(resultNode, 
-                                               getter_AddRefs(relevantNode));
-    if (relevantNode)
-      resultNode.swap(relevantNode);
+    nsCOMPtr<nsIDOMNode> resultDOMNode(do_QueryInterface(resultNode));
+    nsCOMPtr<nsIDOMNode> relevantDOMNode;
+    GetAccService()->GetRelevantContentNodeFor(resultDOMNode,
+                                               getter_AddRefs(relevantDOMNode));
+    if (relevantDOMNode) {
+      resultNode = do_QueryInterface(relevantDOMNode);
+      resultDOMNode.swap(relevantDOMNode);
+    }
 
-    nsCOMPtr<nsIContent> content = do_QueryInterface(resultNode);
-    if (!content || !content->IsNodeOfType(nsINode::eTEXT)) {
-      nsCOMPtr<nsIAccessible> accessible;
-      GetAccService()->GetAccessibleFor(resultNode, getter_AddRefs(accessible));
+    if (!resultNode || !resultNode->IsNodeOfType(nsINode::eTEXT)) {
+      nsAccessible *accessible = GetAccService()->GetAccessible(resultDOMNode);
       if (accessible) {
         nsIAccessibleText *textAcc = nsnull;
         CallQueryInterface(accessible, &textAcc);
         if (textAcc) {
           if (aNode)
-            NS_ADDREF(*aNode = resultNode);
+            resultDOMNode.forget(aNode);
 
           return textAcc;
         }
       }
     }
 
-    nsCOMPtr<nsIDOMNode> parentNode;
-    resultNode->GetParentNode(getter_AddRefs(parentNode));
-    resultNode.swap(parentNode);
+    resultNode = resultNode->GetParent();
   }
 
   NS_NOTREACHED("No nsIAccessibleText for selection change event!");
 
   return nsnull;
 }
 
 nsresult
@@ -784,78 +784,77 @@ nsAccUtils::GetLiveAttrValue(PRUint32 aR
   }
 
   return PR_FALSE;
 }
 
 #ifdef DEBUG_A11Y
 
 PRBool
-nsAccUtils::IsTextInterfaceSupportCorrect(nsIAccessible *aAccessible)
+nsAccUtils::IsTextInterfaceSupportCorrect(nsAccessible *aAccessible)
 {
   PRBool foundText = PR_FALSE;
   
-  nsCOMPtr<nsIAccessibleDocument> accDoc = do_QueryInterface(aAccessible);
+  nsCOMPtr<nsIAccessibleDocument> accDoc = do_QueryObject(aAccessible);
   if (accDoc) {
     // Don't test for accessible docs, it makes us create accessibles too
     // early and fire mutation events before we need to
     return PR_TRUE;
   }
 
-  nsCOMPtr<nsIAccessible> child, nextSibling;
-  aAccessible->GetFirstChild(getter_AddRefs(child));
-  while (child) {
+  PRInt32 childCount = aAccessible->GetChildCount();
+  for (PRint32 childIdx = 0; childIdx < childCount; childIdx++) {
+    nsAccessible *child = GetChildAt(childIdx);
     if (IsText(child)) {
       foundText = PR_TRUE;
       break;
     }
-    child->GetNextSibling(getter_AddRefs(nextSibling));
-    child.swap(nextSibling);
   }
 
   if (foundText) {
     // found text child node
-    nsCOMPtr<nsIAccessibleText> text = do_QueryInterface(aAccessible);
+    nsCOMPtr<nsIAccessibleText> text = do_QueryObject(aAccessible);
     if (!text)
       return PR_FALSE;
   }
 
   return PR_TRUE; 
 }
 #endif
 
-PRInt32
-nsAccUtils::TextLength(nsIAccessible *aAccessible)
+PRUint32
+nsAccUtils::TextLength(nsAccessible *aAccessible)
 {
   if (!IsText(aAccessible))
     return 1;
-  
-  nsRefPtr<nsAccessNode> accNode = do_QueryObject(aAccessible);
-  
-  nsIFrame *frame = accNode->GetFrame();
+
+  nsIFrame *frame = aAccessible->GetFrame();
   if (frame && frame->GetType() == nsAccessibilityAtoms::textFrame) {
     // Ensure that correct text length is calculated (with non-rendered
     // whitespace chars not counted).
     nsIContent *content = frame->GetContent();
     if (content) {
       PRUint32 length;
       nsresult rv = nsHyperTextAccessible::
         ContentToRenderedOffset(frame, content->TextLength(), &length);
-      return NS_SUCCEEDED(rv) ? static_cast<PRInt32>(length) : -1;
+      if (NS_FAILED(rv)) {
+        NS_NOTREACHED("Failed to get rendered offset!");
+        return 0;
+      }
+
+      return length;
     }
   }
-  
+
   // For list bullets (or anything other accessible which would compute its own
   // text. They don't have their own frame.
   // XXX In the future, list bullets may have frame and anon content, so 
   // we should be able to remove this at that point
-  nsRefPtr<nsAccessible> acc(do_QueryObject(aAccessible));
-
   nsAutoString text;
-  acc->AppendTextTo(text, 0, PR_UINT32_MAX); // Get all the text
+  aAccessible->AppendTextTo(text, 0, PR_UINT32_MAX); // Get all the text
   return text.Length();
 }
 
 PRBool
 nsAccUtils::MustPrune(nsIAccessible *aAccessible)
 { 
   PRUint32 role = nsAccUtils::Role(aAccessible);
 
--- a/accessible/src/base/nsAccUtils.h
+++ b/accessible/src/base/nsAccUtils.h
@@ -314,69 +314,38 @@ public:
    *
    * @param  aRule   [in] rule constant (see ELiveAttrRule in nsAccMap.h)
    * @param  aValue  [out] object attribute value
    *
    * @return         true if object attribute should be exposed
    */
   static PRBool GetLiveAttrValue(PRUint32 aRule, nsAString& aValue);
 
-  /**
-   * Query DestinationType from the given SourceType.
-   */
-  template<class DestinationType, class SourceType> static inline
-    already_AddRefed<DestinationType> QueryObject(SourceType *aObject)
-  {
-    DestinationType* object = nsnull;
-    if (aObject)
-      CallQueryInterface(aObject, &object);
-
-    return object;
-  }
-  template<class DestinationType, class SourceType> static inline
-    already_AddRefed<DestinationType> QueryObject(nsCOMPtr<SourceType>& aObject)
-  {
-    DestinationType* object = nsnull;
-    if (aObject)
-      CallQueryInterface(aObject, &object);
-
-    return object;
-  }
-  template<class DestinationType, class SourceType> static inline
-  already_AddRefed<DestinationType> QueryObject(nsRefPtr<SourceType>& aObject)
-  {
-    DestinationType* object = nsnull;
-    if (aObject)
-      CallQueryInterface(aObject.get(), &object);
-    
-    return object;
-  }
-
 #ifdef DEBUG_A11Y
   /**
    * Detect whether the given accessible object implements nsIAccessibleText,
    * when it is text or has text child node.
    */
-  static PRBool IsTextInterfaceSupportCorrect(nsIAccessible *aAccessible);
+  static PRBool IsTextInterfaceSupportCorrect(nsAccessible *aAccessible);
 #endif
 
   /**
    * Return true if the given accessible has text role.
    */
   static PRBool IsText(nsIAccessible *aAcc)
   {
     PRUint32 role = Role(aAcc);
     return role == nsIAccessibleRole::ROLE_TEXT_LEAF ||
            role == nsIAccessibleRole::ROLE_STATICTEXT;
   }
 
   /**
-   * Return text length of the given accessible, return -1 on failure.
+   * Return text length of the given accessible, return 0 on failure.
    */
-  static PRInt32 TextLength(nsIAccessible *aAccessible);
+  static PRUint32 TextLength(nsAccessible *aAccessible);
 
   /**
    * Return true if the given accessible is embedded object.
    */
   static PRBool IsEmbeddedObject(nsIAccessible *aAcc)
   {
     PRUint32 role = Role(aAcc);
     return role != nsIAccessibleRole::ROLE_TEXT_LEAF &&
--- a/accessible/src/base/nsAccessNode.cpp
+++ b/accessible/src/base/nsAccessNode.cpp
@@ -143,58 +143,53 @@ nsAccessNode::Init()
 {
   // We have to put this here, instead of constructor, otherwise
   // we don't have the virtual GetUniqueID() method for the hash key.
   // We need that for accessibles that don't have DOM nodes
 
 #ifdef DEBUG_A11Y
   NS_ASSERTION(!mIsInitialized, "Initialized twice!");
 #endif
-  nsCOMPtr<nsIAccessibleDocument> docAccessible(GetDocAccessible());
-  if (!docAccessible) {
+  nsRefPtr<nsDocAccessible> docAcc = GetDocAccessible();
+  if (!docAcc) {
     // No doc accessible yet for this node's document. 
     // There was probably an accessible event fired before the 
     // current document was ever asked for by the assistive technology.
     // Create a doc accessible so we can cache this node
     nsCOMPtr<nsIPresShell> presShell(do_QueryReferent(mWeakShell));
     if (presShell) {
       nsCOMPtr<nsIDOMNode> docNode(do_QueryInterface(presShell->GetDocument()));
       if (docNode) {
-        nsCOMPtr<nsIAccessible> accessible;
-        GetAccService()->GetAccessibleInShell(docNode, presShell,
-                                              getter_AddRefs(accessible));
-        docAccessible = do_QueryInterface(accessible);
+        nsAccessible *accessible =
+          GetAccService()->GetAccessibleInWeakShell(docNode, mWeakShell);
+        docAcc = do_QueryObject(accessible);
       }
     }
-    NS_ASSERTION(docAccessible, "Cannot cache new nsAccessNode");
-    if (!docAccessible) {
+    NS_ASSERTION(docAcc, "Cannot cache new nsAccessNode");
+    if (!docAcc) {
       return NS_ERROR_FAILURE;
     }
   }
 
   void* uniqueID;
   GetUniqueID(&uniqueID);
-  nsRefPtr<nsDocAccessible> docAcc = do_QueryObject(docAccessible);
-  NS_ASSERTION(docAcc, "No nsDocAccessible for document accessible!");
 
   if (!docAcc->CacheAccessNode(uniqueID, this))
     return NS_ERROR_OUT_OF_MEMORY;
 
   // Make sure an ancestor in real content is cached
   // so that nsDocAccessible::RefreshNodes() can find the anonymous subtree to release when
   // the root node goes away
   nsCOMPtr<nsIContent> content = do_QueryInterface(mDOMNode);
   if (content && content->IsInAnonymousSubtree()) {
     // Specific examples of where this is used: <input type="file"> and <xul:findbar>
-    nsCOMPtr<nsIAccessible> parentAccessible;
-    docAccessible->GetAccessibleInParentChain(mDOMNode, PR_TRUE, getter_AddRefs(parentAccessible));
-    if (parentAccessible) {
-      PRInt32 childCountUnused;
-      parentAccessible->GetChildCount(&childCountUnused);
-    }
+    nsAccessible *parent = GetAccService()->GetContainerAccessible(mDOMNode,
+                                                                   PR_TRUE);
+    if (parent)
+      parent->EnsureChildren();
   }
 
 #ifdef DEBUG_A11Y
   mIsInitialized = PR_TRUE;
 #endif
 
   return NS_OK;
 }
@@ -251,17 +246,17 @@ nsAccessNode::GetApplicationAccessible()
   }
 
   return gApplicationAccessible;
 }
 
 void nsAccessNode::InitXPAccessibility()
 {
   nsCOMPtr<nsIStringBundleService> stringBundleService =
-    do_GetService(NS_STRINGBUNDLE_CONTRACTID);
+    mozilla::services::GetStringBundleService();
   if (stringBundleService) {
     // Static variables are released in ShutdownAllXPAccessibility();
     stringBundleService->CreateBundle(ACCESSIBLE_BUNDLE_URL, 
                                       &gStringBundle);
     stringBundleService->CreateBundle(PLATFORM_KEYS_BUNDLE_URL, 
                                       &gKeyStringBundle);
   }
 
@@ -396,18 +391,17 @@ nsAccessNode::IsInCache()
     nsAccessNode::GetDocAccessibleFor(mWeakShell);
 
   if (!accessibleDoc)
     return nsnull;
 
   void* uniqueID = nsnull;
   GetUniqueID(&uniqueID);
 
-  nsRefPtr<nsDocAccessible> docAccessible =
-    nsAccUtils::QueryObject<nsDocAccessible>(accessibleDoc);
+  nsRefPtr<nsDocAccessible> docAccessible = do_QueryObject(accessibleDoc);
   return docAccessible->GetCachedAccessNode(uniqueID) ? PR_TRUE : PR_FALSE;
 }
 #endif
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsIAccessNode
 
 NS_IMETHODIMP
@@ -506,22 +500,18 @@ nsAccessNode::ScrollToPoint(PRUint32 aCo
 nsresult
 nsAccessNode::MakeAccessNode(nsIDOMNode *aNode, nsIAccessNode **aAccessNode)
 {
   *aAccessNode = nsnull;
   
   nsCOMPtr<nsIAccessNode> accessNode =
     GetAccService()->GetCachedAccessNode(aNode, mWeakShell);
 
-  if (!accessNode) {
-    nsRefPtr<nsAccessible> accessible =
-      GetAccService()->GetAccessibleInWeakShell(aNode, mWeakShell);
-
-    accessNode = accessible;
-  }
+  if (!accessNode)
+    accessNode = GetAccService()->GetAccessibleInWeakShell(aNode, mWeakShell);
 
   if (accessNode) {
     NS_ADDREF(*aAccessNode = accessNode);
     return NS_OK;
   }
 
   nsAccessNode *newAccessNode = new nsAccessNode(aNode, mWeakShell);
   if (!newAccessNode) {
@@ -703,32 +693,31 @@ nsAccessNode::GetDocAccessibleFor(nsIDoc
     CallQueryInterface(accessible, &docAccessible);
   }
   return docAccessible;
 }
  
 nsDocAccessible*
 nsAccessNode::GetDocAccessibleFor(nsIDOMNode *aNode)
 {
-  nsCOMPtr<nsIPresShell> eventShell = nsCoreUtils::GetPresShellFor(aNode);
-  if (eventShell) {
-    return GetDocAccessibleFor(eventShell->GetDocument());
-  }
+  nsIPresShell *presShell = nsCoreUtils::GetPresShellFor(aNode);
+  if (presShell)
+    return GetDocAccessibleFor(presShell->GetDocument());
 
   nsCOMPtr<nsIDocument> doc(do_QueryInterface(aNode));
   if (doc) {
     return GetDocAccessibleFor(doc);
   }
 
   return nsnull;
 }
 
 already_AddRefed<nsIDOMNode> nsAccessNode::GetCurrentFocus()
 {
-  nsCOMPtr<nsIPresShell> shell = nsCoreUtils::GetPresShellFor(mDOMNode);
+  nsIPresShell *shell = nsCoreUtils::GetPresShellFor(mDOMNode);
   NS_ENSURE_TRUE(shell, nsnull);
   nsCOMPtr<nsIDocument> doc = shell->GetDocument();
   NS_ENSURE_TRUE(doc, nsnull);
 
   nsIDOMWindow* win = doc->GetWindow();
 
   nsCOMPtr<nsIDOMWindow> focusedWindow;
   nsCOMPtr<nsIDOMElement> focusedElement;
--- a/accessible/src/base/nsAccessNode.h
+++ b/accessible/src/base/nsAccessNode.h
@@ -130,16 +130,21 @@ class nsAccessNode: public nsIAccessNode
     virtual nsresult Shutdown();
 
     /**
      * Return frame for the given access node object.
      */
     virtual nsIFrame* GetFrame();
 
   /**
+   * Return DOM node associated with this accessible.
+   */
+  nsIDOMNode *GetDOMNode() const { return mDOMNode; }
+
+  /**
    * Return the corresponding press shell for this accessible.
    */
   already_AddRefed<nsIPresShell> GetPresShell();
 
   /**
    * Return true if the accessible still has presentation shell. Light-weight
    * version of IsDefunct() method.
    */
--- a/accessible/src/base/nsAccessibilityAtomList.h
+++ b/accessible/src/base/nsAccessibilityAtomList.h
@@ -190,16 +190,17 @@ ACCESSIBILITY_ATOM(popup, "popup")
 ACCESSIBILITY_ATOM(readonly, "readonly")
 ACCESSIBILITY_ATOM(scope, "scope") // HTML table
 ACCESSIBILITY_ATOM(simple, "simple") // XLink
 ACCESSIBILITY_ATOM(src, "src")
 ACCESSIBILITY_ATOM(selected, "selected")
 ACCESSIBILITY_ATOM(summary, "summary")
 ACCESSIBILITY_ATOM(tabindex, "tabindex")
 ACCESSIBILITY_ATOM(title, "title")
+ACCESSIBILITY_ATOM(toolbarname, "toolbarname")
 ACCESSIBILITY_ATOM(tooltiptext, "tooltiptext")
 ACCESSIBILITY_ATOM(type, "type")
 ACCESSIBILITY_ATOM(usemap, "usemap")
 ACCESSIBILITY_ATOM(value, "value")
 
   // Alphabetical list of object attributes
 ACCESSIBILITY_ATOM(checkable, "checkable")
 ACCESSIBILITY_ATOM(display, "display")
--- a/accessible/src/base/nsAccessibilityService.cpp
+++ b/accessible/src/base/nsAccessibilityService.cpp
@@ -105,25 +105,29 @@
 #include "nsHTMLWin32ObjectAccessible.h"
 #endif
 
 #ifndef DISABLE_XFORMS_HOOKS
 #include "nsXFormsFormControlsAccessible.h"
 #include "nsXFormsWidgetsAccessible.h"
 #endif
 
+#include "mozilla/FunctionTimer.h"
+
 ////////////////////////////////////////////////////////////////////////////////
 // nsAccessibilityService
 ////////////////////////////////////////////////////////////////////////////////
 
 nsAccessibilityService *nsAccessibilityService::gAccessibilityService = nsnull;
 PRBool nsAccessibilityService::gIsShutdown = PR_TRUE;
 
 nsAccessibilityService::nsAccessibilityService()
 {
+  NS_TIME_FUNCTION;
+
   // Add observers.
   nsCOMPtr<nsIObserverService> observerService =
     mozilla::services::GetObserverService();
   if (!observerService)
     return;
 
   observerService->AddObserver(this, NS_XPCOM_SHUTDOWN_OBSERVER_ID, PR_FALSE);
   nsCOMPtr<nsIWebProgress> progress(do_GetService(NS_DOCUMENTLOADER_SERVICE_CONTRACTID));
@@ -259,33 +263,30 @@ nsAccessibilityService::NotifyOfAnchorJu
 {
   nsIDocument *document = aTarget->GetCurrentDoc();
   nsCOMPtr<nsIDOMNode> documentNode(do_QueryInterface(document));
   if (!documentNode)
     return;
 
   nsCOMPtr<nsIDOMNode> targetNode(do_QueryInterface(aTarget));
 
-  nsCOMPtr<nsIAccessible> targetAcc;
-  GetAccessibleFor(targetNode, getter_AddRefs(targetAcc));
+  nsAccessible *targetAcc = GetAccessible(targetNode);
 
   // Getting the targetAcc above will have ensured accessible doc creation.
   // XXX Bug 561683
   nsRefPtr<nsDocAccessible> accessibleDoc =
     nsAccessNode::GetDocAccessibleFor(documentNode);
   if (!accessibleDoc)
     return;
 
   // If the jump target is not accessible then fire an event for nearest
   // accessible in parent chain.
   if (!targetAcc) {
-        accessibleDoc->GetAccessibleInParentChain(targetNode, PR_TRUE,
-                                                  getter_AddRefs(targetAcc));
-        nsCOMPtr<nsIAccessNode> accNode = do_QueryInterface(targetAcc);
-        accNode->GetDOMNode(getter_AddRefs(targetNode));
+    targetAcc = GetContainerAccessible(targetNode, PR_TRUE);
+    targetNode = targetAcc->GetDOMNode();
   }
 
   NS_ASSERTION(targetNode,
       "No accessible in parent chain!? Expect at least a document accessible.");
   if (!targetNode)
     return;
 
   // XXX note in rare cases the node could go away before we flush the queue,
@@ -982,18 +983,17 @@ nsAccessibilityService::GetCachedAccessN
                                             nsIWeakReference *aWeakShell)
 {
   nsCOMPtr<nsIAccessibleDocument> accessibleDoc =
     nsAccessNode::GetDocAccessibleFor(aWeakShell);
 
   if (!accessibleDoc)
     return nsnull;
 
-  nsRefPtr<nsDocAccessible> docAccessible =
-    nsAccUtils::QueryObject<nsDocAccessible>(accessibleDoc);
+  nsRefPtr<nsDocAccessible> docAccessible = do_QueryObject(accessibleDoc);
   return docAccessible->GetCachedAccessNode(static_cast<void*>(aNode));
 }
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsIAccessibleRetrieval
 
 NS_IMETHODIMP
 nsAccessibilityService::GetApplicationAccessible(nsIAccessible **aAccessibleApplication)
@@ -1168,42 +1168,18 @@ nsAccessibilityService::GetStringRelatio
   * GetAccessibleFor - get an nsIAccessible from a DOM node
   */
 
 NS_IMETHODIMP
 nsAccessibilityService::GetAccessibleFor(nsIDOMNode *aNode,
                                          nsIAccessible **aAccessible)
 {
   NS_ENSURE_ARG_POINTER(aAccessible);
-  *aAccessible = nsnull;
 
-  NS_ENSURE_ARG(aNode);
-
-  nsCOMPtr<nsIContent> content(do_QueryInterface(aNode));
-  nsCOMPtr<nsIDocument> doc;
-  if (content) {
-    doc = content->GetDocument();
-  }
-  else {// Could be document node
-    doc = do_QueryInterface(aNode);
-  }
-  if (!doc)
-    return NS_ERROR_FAILURE;
-
-  // We use presentation shell #0 because we assume that is presentation of
-  // given node window.
-  nsIPresShell *presShell = doc->GetPrimaryShell();
-
-  nsCOMPtr<nsIWeakReference> weakShell(do_GetWeakReference(presShell));
-  nsRefPtr<nsAccessible> accessible =
-    GetAccessible(aNode, presShell, weakShell);
-
-  if (accessible)
-    CallQueryInterface(accessible.get(), aAccessible);
-  
+  NS_IF_ADDREF(*aAccessible = GetAccessible(aNode));
   return NS_OK;
 }
 
 NS_IMETHODIMP
 nsAccessibilityService::GetAttachedAccessibleFor(nsIDOMNode *aNode,
                                                  nsIAccessible **aAccessible)
 {
   NS_ENSURE_ARG(aNode);
@@ -1216,49 +1192,105 @@ nsAccessibilityService::GetAttachedAcces
   NS_ENSURE_SUCCESS(rv, rv);
 
   if (relevantNode != aNode)
     return NS_OK;
 
   return GetAccessibleFor(aNode, aAccessible);
 }
 
-NS_IMETHODIMP
+nsAccessible*
 nsAccessibilityService::GetAccessibleInShell(nsIDOMNode *aNode, 
-                                             nsIPresShell *aPresShell,
-                                             nsIAccessible **aAccessible) 
+                                             nsIPresShell *aPresShell) 
 {
-  NS_ENSURE_ARG_POINTER(aAccessible);
-  *aAccessible = nsnull;
-
-  NS_ENSURE_ARG(aNode);
-  NS_ENSURE_ARG(aPresShell);
+  if (!aNode || !aPresShell)
+    return nsnull;
 
   nsCOMPtr<nsIWeakReference> weakShell(do_GetWeakReference(aPresShell));
   nsRefPtr<nsAccessible> accessible =
     GetAccessible(aNode, aPresShell, weakShell);
-
-  if (accessible)
-    CallQueryInterface(accessible.get(), aAccessible);
-  
-  return NS_OK;
+  return accessible;
 }
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsAccessibilityService public
 
-already_AddRefed<nsAccessible>
+nsAccessible *
+nsAccessibilityService::GetAccessible(nsIDOMNode *aNode)
+{
+  if (!aNode)
+    return nsnull;
+
+  nsIPresShell *presShell = nsCoreUtils::GetPresShellFor(aNode);
+  if (!presShell)
+    return nsnull;
+
+  nsCOMPtr<nsIWeakReference> weakShell(do_GetWeakReference(presShell));
+  nsRefPtr<nsAccessible> accessible = GetAccessible(aNode, presShell,
+                                                    weakShell);
+  return accessible;
+}
+
+nsAccessible *
 nsAccessibilityService::GetAccessibleInWeakShell(nsIDOMNode *aNode, 
                                                  nsIWeakReference *aWeakShell) 
 {
   if (!aNode || !aWeakShell)
     return nsnull;
 
   nsCOMPtr<nsIPresShell> presShell(do_QueryReferent(aWeakShell));
-  return GetAccessible(aNode, presShell, aWeakShell);
+  nsRefPtr<nsAccessible> accessible = GetAccessible(aNode, presShell,
+                                                    aWeakShell);
+  return accessible;
+}
+
+nsAccessible *
+nsAccessibilityService::GetContainerAccessible(nsIDOMNode *aNode,
+                                               PRBool aCanCreate)
+{
+  if (!aNode)
+    return nsnull;
+
+  nsCOMPtr<nsINode> currNode(do_QueryInterface(aNode));
+  nsIDocument *document = currNode->GetCurrentDoc();
+  if (!document)
+    return nsnull;
+
+  nsIPresShell *presShell = document->GetPrimaryShell();
+  if (!presShell)
+    return nsnull;
+
+  nsCOMPtr<nsIWeakReference> weakShell(do_GetWeakReference(presShell));
+
+  nsAccessible *accessible = nsnull;
+  while (!accessible && (currNode = currNode->GetNodeParent())) {
+    nsCOMPtr<nsIDOMNode> currDOMNode(do_QueryInterface(currNode));
+
+    nsCOMPtr<nsIDOMNode> relevantDOMNode;
+    GetAccService()->GetRelevantContentNodeFor(currDOMNode,
+                                               getter_AddRefs(relevantDOMNode));
+    if (relevantDOMNode) {
+      currNode = do_QueryInterface(relevantDOMNode);
+      currDOMNode.swap(relevantDOMNode);
+    }
+
+    if (aCanCreate) {
+      accessible =
+        GetAccService()->GetAccessibleInWeakShell(currDOMNode, weakShell);
+
+    } else {
+      // Only return cached accessible, don't create anything.
+      nsRefPtr<nsAccessible> cachedAcc =
+        do_QueryObject(GetCachedAccessNode(currDOMNode, weakShell));
+
+      accessible = cachedAcc;
+    }
+  }
+
+  return accessible;
 }
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsAccessibilityService private
 
 PRBool
 nsAccessibilityService::InitAccessible(nsAccessible *aAccessible,
                                        nsRoleMapEntry *aRoleMapEntry)
@@ -1341,18 +1373,17 @@ nsAccessibilityService::GetAccessible(ns
 #endif
 
   // Check to see if we already have an accessible for this node in the cache.
   nsAccessNode* cachedAccessNode = GetCachedAccessNode(aNode, aWeakShell);
   if (cachedAccessNode) {
     // XXX: the cache might contain the access node for the DOM node that is not
     // accessible because of wrong cache update. In this case try to create new
     // accessible.
-    nsRefPtr<nsAccessible> cachedAccessible =
-      nsAccUtils::QueryObject<nsAccessible>(cachedAccessNode);
+    nsRefPtr<nsAccessible> cachedAccessible = do_QueryObject(cachedAccessNode);
 
     if (cachedAccessible)
       return cachedAccessible.forget();
   }
 
   // No cache entry, so we must create the accessible.
   nsRefPtr<nsAccessible> newAcc;
 
@@ -1426,17 +1457,17 @@ nsAccessibilityService::GetAccessible(ns
 
         return nsnull;
       }
     }
     if (weakFrame.IsAlive()) {
       nsCOMPtr<nsIAccessible> newAccessible;
       weakFrame.GetFrame()->GetAccessible(getter_AddRefs(newAccessible));
       if (newAccessible) {
-        newAcc = nsAccUtils::QueryObject<nsAccessible>(newAccessible);
+        newAcc = do_QueryObject(newAccessible);
         if (InitAccessible(newAcc, nsnull))
           return newAcc.forget();
         return nsnull;
       }
     }
 
     return nsnull;
   }
@@ -1493,17 +1524,17 @@ nsAccessibilityService::GetAccessible(ns
       nsIContent *tableContent = content;
       while ((tableContent = tableContent->GetParent()) != nsnull) {
         nsIFrame *tableFrame = tableContent->GetPrimaryFrame();
         if (!tableFrame)
           continue;
 
         if (tableFrame->GetType() == nsAccessibilityAtoms::tableOuterFrame) {
           nsCOMPtr<nsIDOMNode> tableNode(do_QueryInterface(tableContent));
-          nsRefPtr<nsAccessible> tableAccessible =
+          nsAccessible *tableAccessible =
             GetAccessibleInWeakShell(tableNode, aWeakShell);
 
           if (tableAccessible) {
             if (!roleMapEntry) {
               PRUint32 role = nsAccUtils::Role(tableAccessible);
               if (role != nsIAccessibleRole::ROLE_TABLE &&
                   role != nsIAccessibleRole::ROLE_TREE_TABLE) {
                 // No ARIA role and not in table: override role. For example,
@@ -1594,17 +1625,17 @@ nsAccessibilityService::GetAccessible(ns
             *aIsHidden = PR_TRUE;
 
           return nsnull;
         }
 
         // Try using frame to do it.
         nsCOMPtr<nsIAccessible> newAccessible;
         f->GetAccessible(getter_AddRefs(newAccessible));
-        newAcc = nsAccUtils::QueryObject<nsAccessible>(newAccessible);
+        newAcc = do_QueryObject(newAccessible);
       }
     }
   }
 
   if (!newAcc) {
     // Elements may implement nsIAccessibleProvider via XBL. This allows them to
     // say what kind of accessible to create.
     newAcc = CreateAccessibleByType(aNode, aWeakShell);
@@ -1763,38 +1794,37 @@ nsAccessibilityService::GetAreaAccessibl
 
   // Try to get image map accessible from the global cache or create it
   // if failed.
   nsRefPtr<nsAccessible> imageAcc;
 
   nsCOMPtr<nsIDOMNode> imageNode(do_QueryInterface(aImageFrame->GetContent()));
   nsAccessNode *cachedImgAcc = GetCachedAccessNode(imageNode, aWeakShell);
   if (cachedImgAcc)
-    imageAcc = nsAccUtils::QueryObject<nsAccessible>(cachedImgAcc);
+    imageAcc = do_QueryObject(cachedImgAcc);
 
   if (!imageAcc) {
     nsCOMPtr<nsIAccessible> imageAccessible;
     CreateHTMLImageAccessible(aImageFrame,
                               getter_AddRefs(imageAccessible));
 
-    imageAcc = nsAccUtils::QueryObject<nsAccessible>(imageAccessible);
+    imageAcc = do_QueryObject(imageAccessible);
     if (!InitAccessible(imageAcc, nsnull))
       return nsnull;
   }
 
   // Make sure <area> accessible children of the image map are cached so
   // that they should be available in global cache.
   imageAcc->EnsureChildren();
 
   nsAccessNode *cachedAreaAcc = GetCachedAccessNode(aAreaNode, aWeakShell);
   if (!cachedAreaAcc)
     return nsnull;
 
-  nsRefPtr<nsAccessible> areaAcc =
-    nsAccUtils::QueryObject<nsAccessible>(cachedAreaAcc);
+  nsRefPtr<nsAccessible> areaAcc = do_QueryObject(cachedAreaAcc);
   return areaAcc.forget();
 }
 
 already_AddRefed<nsAccessible>
 nsAccessibilityService::CreateAccessibleByType(nsIDOMNode *aNode,
                                                nsIWeakReference *aWeakShell)
 {
   nsCOMPtr<nsIAccessibleProvider> accessibleProvider(do_QueryInterface(aNode));
@@ -1922,22 +1952,22 @@ nsAccessibilityService::CreateAccessible
       accessible = new nsXULRadioButtonAccessible(aNode, aWeakShell);
       break;
     case nsIAccessibleProvider::XULRadioGroup:
       accessible = new nsXULRadioGroupAccessible(aNode, aWeakShell);
       break;
     case nsIAccessibleProvider::XULTab:
       accessible = new nsXULTabAccessible(aNode, aWeakShell);
       break;
-    case nsIAccessibleProvider::XULTabBox:
-      accessible = new nsXULTabBoxAccessible(aNode, aWeakShell);
-      break;
     case nsIAccessibleProvider::XULTabs:
       accessible = new nsXULTabsAccessible(aNode, aWeakShell);
       break;
+    case nsIAccessibleProvider::XULTabpanels:
+      accessible = new nsXULTabpanelsAccessible(aNode, aWeakShell);
+      break;
     case nsIAccessibleProvider::XULText:
       accessible = new nsXULTextAccessible(aNode, aWeakShell);
       break;
     case nsIAccessibleProvider::XULTextBox:
       accessible = new nsXULTextFieldAccessible(aNode, aWeakShell);
       break;
     case nsIAccessibleProvider::XULThumb:
       accessible = new nsXULThumbAccessible(aNode, aWeakShell);
@@ -1969,17 +1999,17 @@ nsAccessibilityService::CreateAccessible
     // XForms elements
     case nsIAccessibleProvider::XFormsContainer:
       accessible = new nsXFormsContainerAccessible(aNode, aWeakShell);
       break;
 
     case nsIAccessibleProvider::XFormsLabel:
       accessible = new nsXFormsLabelAccessible(aNode, aWeakShell);
       break;
-    case nsIAccessibleProvider::XFormsOuput:
+    case nsIAccessibleProvider::XFormsOutput:
       accessible = new nsXFormsOutputAccessible(aNode, aWeakShell);
       break;
     case nsIAccessibleProvider::XFormsTrigger:
       accessible = new nsXFormsTriggerAccessible(aNode, aWeakShell);
       break;
     case nsIAccessibleProvider::XFormsInput:
       accessible = new nsXFormsInputAccessible(aNode, aWeakShell);
       break;
--- a/accessible/src/base/nsAccessibilityService.h
+++ b/accessible/src/base/nsAccessibilityService.h
@@ -71,16 +71,19 @@ public:
   virtual ~nsAccessibilityService();
 
   NS_DECL_ISUPPORTS
   NS_DECL_NSIACCESSIBLERETRIEVAL
   NS_DECL_NSIOBSERVER
   NS_DECL_NSIWEBPROGRESSLISTENER
 
   // nsIAccessibilityService
+  virtual nsAccessible* GetAccessibleInShell(nsIDOMNode *aNode,
+                                             nsIPresShell *aPresShell);
+
   virtual nsresult CreateOuterDocAccessible(nsIDOMNode *aNode,
                                             nsIAccessible **aAccessible);
   virtual nsresult CreateHTML4ButtonAccessible(nsIFrame *aFrame,
                                                nsIAccessible **aAccessible);
   virtual nsresult CreateHyperTextAccessible(nsIFrame *aFrame,
                                              nsIAccessible **aAccessible);
   virtual nsresult CreateHTMLBRAccessible(nsIFrame *aFrame,
                                           nsIAccessible **aAccessible);
@@ -165,23 +168,37 @@ public:
    * @param  aIsHidden   [out, optional] indicates whether the node's frame is
    *                       hidden
    */
   already_AddRefed<nsAccessible>
     GetAccessible(nsIDOMNode *aNode, nsIPresShell *aPresShell,
                   nsIWeakReference *aWeakShell, PRBool *aIsHidden = nsnull);
 
   /**
+   * Return an accessible for the given DOM node.
+   */
+  nsAccessible *GetAccessible(nsIDOMNode *aNode);
+
+  /**
    * Return an accessible for a DOM node in the given pres shell.
    * 
    * @param aNode       [in] the given node.
    * @param aPresShell  [in] the presentation shell of the given node.
    */
-  already_AddRefed<nsAccessible>
-    GetAccessibleInWeakShell(nsIDOMNode *aNode, nsIWeakReference *aPresShell);
+  nsAccessible *GetAccessibleInWeakShell(nsIDOMNode *aNode,
+                                         nsIWeakReference *aPresShell);
+
+  /**
+   * Return the first accessible parent of a DOM node.
+   *
+   * @param aDOMNode    [in] the DOM node to get an accessible for
+   * @param aCanCreate  [in] specifies if accessible can be created if it didn't
+   *                     exist
+   */
+  nsAccessible *GetContainerAccessible(nsIDOMNode *aNode, PRBool aCanCreate);
 
   /**
    * Return an access node for the DOM node in the given presentation shell if
    * the access node already exists, otherwise null.
    *
    * @param  aNode       [in] the DOM node to get an access node for
    * @param  aPresShell  [in] the presentation shell which contains layout info
    *                       for the DOM node
--- a/accessible/src/base/nsAccessible.cpp
+++ b/accessible/src/base/nsAccessible.cpp
@@ -36,16 +36,17 @@
  * the terms of any one of the MPL, the GPL or the LGPL.
  *
  * ***** END LICENSE BLOCK ***** */
 
 #include "nsAccessible.h"
 
 #include "nsIXBLAccessible.h"
 
+#include "nsAccIterator.h"
 #include "nsAccUtils.h"
 #include "nsARIAMap.h"
 #include "nsDocAccessible.h"
 #include "nsEventShell.h"
 
 #include "nsAccessibilityService.h"
 #include "nsAccTreeWalker.h"
 #include "nsRelUtils.h"
@@ -170,20 +171,20 @@ nsresult nsAccessible::QueryInterface(RE
     if (mRoleMapEntry && mRoleMapEntry->valueRule != eNoValue) {
       *aInstancePtr = static_cast<nsIAccessibleValue*>(this);
       NS_ADDREF_THIS();
       return NS_OK;
     }
   }                       
 
   if (aIID.Equals(NS_GET_IID(nsIAccessibleHyperLink))) {
-    nsCOMPtr<nsIAccessibleHyperText> hyperTextParent =
-      nsAccUtils::QueryObject<nsIAccessibleHyperText>(GetParent());
-
-    if (hyperTextParent) {
+    // Every embedded accessible within hypertext accessible implements
+    // hyperlink interface.
+    nsCOMPtr<nsIAccessibleHyperText> hyperTextParent = do_QueryObject(GetParent());
+    if (hyperTextParent && nsAccUtils::IsEmbeddedObject(this)) {
       *aInstancePtr = static_cast<nsIAccessibleHyperLink*>(this);
       NS_ADDREF_THIS();
       return NS_OK;
     }
     return NS_ERROR_NO_INTERFACE;
   }
 
   return nsAccessNodeWrap::QueryInterface(aIID, aInstancePtr);
@@ -853,23 +854,21 @@ nsAccessible::GetChildAtPoint(PRInt32 aX
   nsCOMPtr<nsIDOMNode> relevantNode;
   GetAccService()->GetRelevantContentNodeFor(node,
                                              getter_AddRefs(relevantNode));
   if (!relevantNode) {
     NS_IF_ADDREF(*aChild = fallbackAnswer);
     return NS_OK;
   }
 
-  nsCOMPtr<nsIAccessible> accessible;
-  GetAccService()->GetAccessibleFor(relevantNode, getter_AddRefs(accessible));
+  nsAccessible *accessible = GetAccService()->GetAccessible(relevantNode);
   if (!accessible) {
     // No accessible for the node with the point, so find the first
     // accessible in the DOM parent chain
-    accDocument->GetAccessibleInParentChain(relevantNode, PR_TRUE,
-                                            getter_AddRefs(accessible));
+    accessible = GetAccService()->GetContainerAccessible(relevantNode, PR_TRUE);
     if (!accessible) {
       NS_IF_ADDREF(*aChild = fallbackAnswer);
       return NS_OK;
     }
   }
 
   if (accessible == this) {
     // Manually walk through accessible children and see if the are within this
@@ -2461,99 +2460,74 @@ nsAccessible::DispatchClickEvent(nsICont
   PRBool res = nsCoreUtils::DispatchMouseEvent(NS_MOUSE_BUTTON_DOWN, presShell,
                                                aContent);
   if (!res)
     return;
 
   nsCoreUtils::DispatchMouseEvent(NS_MOUSE_BUTTON_UP, presShell, aContent);
 }
 
-already_AddRefed<nsIAccessible>
-nsAccessible::GetNextWithState(nsIAccessible *aStart, PRUint32 matchState)
-{
-  // Return the next descendant that matches one of the states in matchState
-  // Uses depth first search
-  NS_ASSERTION(matchState, "GetNextWithState() not called with a state to match");
-  NS_ASSERTION(aStart, "GetNextWithState() not called with an accessible to start with");
-  nsCOMPtr<nsIAccessible> look, current = aStart;
-  PRUint32 state = 0;
-  while (0 == (state & matchState)) {
-    current->GetFirstChild(getter_AddRefs(look));
-    while (!look) {
-      if (current == this) {
-        return nsnull; // At top of subtree
-      }
-      current->GetNextSibling(getter_AddRefs(look));
-      if (!look) {
-        current->GetParent(getter_AddRefs(look));
-        current = look;
-        look = nsnull;
-        continue;
-      }
-    }
-    current.swap(look);
-    state = nsAccUtils::State(current);
-  }
-
-  nsIAccessible *returnAccessible = nsnull;
-  current.swap(returnAccessible);
-
-  return returnAccessible;
-}
-
 // nsIAccessibleSelectable
 NS_IMETHODIMP nsAccessible::GetSelectedChildren(nsIArray **aSelectedAccessibles)
 {
   *aSelectedAccessibles = nsnull;
 
   nsCOMPtr<nsIMutableArray> selectedAccessibles =
     do_CreateInstance(NS_ARRAY_CONTRACTID);
   NS_ENSURE_STATE(selectedAccessibles);
 
-  nsCOMPtr<nsIAccessible> selected = this;
-  while ((selected = GetNextWithState(selected, nsIAccessibleStates::STATE_SELECTED)) != nsnull) {
+  nsAccIterator iter(this, nsAccIterator::GetSelected, nsAccIterator::eTreeNav);
+  nsIAccessible *selected = nsnull;
+  while ((selected = iter.GetNext()))
     selectedAccessibles->AppendElement(selected, PR_FALSE);
-  }
 
   PRUint32 length = 0;
   selectedAccessibles->GetLength(&length); 
   if (length) { // length of nsIArray containing selected options
     *aSelectedAccessibles = selectedAccessibles;
     NS_ADDREF(*aSelectedAccessibles);
   }
 
   return NS_OK;
 }
 
 // return the nth selected descendant nsIAccessible object
 NS_IMETHODIMP nsAccessible::RefSelection(PRInt32 aIndex, nsIAccessible **aSelected)
 {
+  NS_ENSURE_ARG_POINTER(aSelected);
   *aSelected = nsnull;
+
   if (aIndex < 0) {
-    return NS_ERROR_FAILURE;
+    return NS_ERROR_INVALID_ARG;
   }
-  nsCOMPtr<nsIAccessible> selected = this;
+
+  nsAccIterator iter(this, nsAccIterator::GetSelected, nsAccIterator::eTreeNav);
+  nsAccessible *selected = nsnull;
+
   PRInt32 count = 0;
   while (count ++ <= aIndex) {
-    selected = GetNextWithState(selected, nsIAccessibleStates::STATE_SELECTED);
+    selected = iter.GetNext();
     if (!selected) {
-      return NS_ERROR_FAILURE; // aIndex out of range
+      // The index is out of range.
+      return NS_ERROR_INVALID_ARG;
     }
   }
   NS_IF_ADDREF(*aSelected = selected);
   return NS_OK;
 }
 
 NS_IMETHODIMP nsAccessible::GetSelectionCount(PRInt32 *aSelectionCount)
 {
+  NS_ENSURE_ARG_POINTER(aSelectionCount);
   *aSelectionCount = 0;
-  nsCOMPtr<nsIAccessible> selected = this;
-  while ((selected = GetNextWithState(selected, nsIAccessibleStates::STATE_SELECTED)) != nsnull) {
-    ++ *aSelectionCount;
-  }
+
+  nsAccIterator iter(this, nsAccIterator::GetSelected, nsAccIterator::eTreeNav);
+  nsAccessible *selected = nsnull;
+  while ((selected = iter.GetNext()))
+    ++(*aSelectionCount);
 
   return NS_OK;
 }
 
 NS_IMETHODIMP nsAccessible::AddChildToSelection(PRInt32 aIndex)
 {
   // Tree views and other container widgets which may have grandchildren should
   // implement a selection methods for their specific interfaces, because being
@@ -2599,31 +2573,34 @@ NS_IMETHODIMP nsAccessible::IsChildSelec
   nsAccessible* child = GetChildAt(aIndex);
   PRUint32 state = nsAccUtils::State(child);
   if (state & nsIAccessibleStates::STATE_SELECTED) {
     *aIsSelected = PR_TRUE;
   }
   return NS_OK;
 }
 
-NS_IMETHODIMP nsAccessible::ClearSelection()
+NS_IMETHODIMP
+nsAccessible::ClearSelection()
 {
-  nsCOMPtr<nsIAccessible> selected = this;
-  while ((selected = GetNextWithState(selected, nsIAccessibleStates::STATE_SELECTED)) != nsnull) {
+  nsAccIterator iter(this, nsAccIterator::GetSelected, nsAccIterator::eTreeNav);
+  nsAccessible *selected = nsnull;
+  while ((selected = iter.GetNext()))
     selected->SetSelected(PR_FALSE);
-  }
+
   return NS_OK;
 }
 
 NS_IMETHODIMP nsAccessible::SelectAllSelection(PRBool *_retval)
 {
-  nsCOMPtr<nsIAccessible> selectable = this;
-  while ((selectable = GetNextWithState(selectable, nsIAccessibleStates::STATE_SELECTED)) != nsnull) {
+  nsAccIterator iter(this, nsAccIterator::GetSelectable, nsAccIterator::eTreeNav);
+  nsAccessible *selectable = nsnull;
+  while((selectable = iter.GetNext()))
     selectable->SetSelected(PR_TRUE);
-  }
+
   return NS_OK;
 }
 
 // nsIAccessibleHyperLink
 // Because of new-atk design, any embedded object in text can implement
 // nsIAccessibleHyperLink, which helps determine where it is located
 // within containing text
 
@@ -2637,26 +2614,34 @@ nsAccessible::GetAnchorCount(PRInt32 *aA
 }
 
 // readonly attribute long nsIAccessibleHyperLink::startIndex
 NS_IMETHODIMP
 nsAccessible::GetStartIndex(PRInt32 *aStartIndex)
 {
   NS_ENSURE_ARG_POINTER(aStartIndex);
   *aStartIndex = 0;
+
+  if (IsDefunct())
+    return NS_ERROR_FAILURE;
+
   PRInt32 endIndex;
   return GetLinkOffset(aStartIndex, &endIndex);
 }
 
 // readonly attribute long nsIAccessibleHyperLink::endIndex
 NS_IMETHODIMP
 nsAccessible::GetEndIndex(PRInt32 *aEndIndex)
 {
   NS_ENSURE_ARG_POINTER(aEndIndex);
   *aEndIndex = 0;
+
+  if (IsDefunct())
+    return NS_ERROR_FAILURE;
+
   PRInt32 startIndex;
   return GetLinkOffset(&startIndex, aEndIndex);
 }
 
 NS_IMETHODIMP
 nsAccessible::GetURI(PRInt32 aIndex, nsIURI **aURI)
 {
   NS_ENSURE_ARG_POINTER(aURI);
@@ -2715,42 +2700,35 @@ nsAccessible::GetValid(PRBool *aValid)
 NS_IMETHODIMP
 nsAccessible::GetSelected(PRBool *aSelected)
 {
   NS_ENSURE_ARG_POINTER(aSelected);
   *aSelected = (gLastFocusedNode == mDOMNode);
   return NS_OK;
 }
 
-nsresult nsAccessible::GetLinkOffset(PRInt32* aStartOffset, PRInt32* aEndOffset)
+nsresult
+nsAccessible::GetLinkOffset(PRInt32 *aStartOffset, PRInt32 *aEndOffset)
 {
-  *aStartOffset = *aEndOffset = 0;
-  nsAccessible* parent = GetParent();
-  if (!parent) {
-    return NS_ERROR_FAILURE;
-  }
-
-  nsCOMPtr<nsIAccessible> accessible, nextSibling;
-  PRInt32 characterCount = 0;
-  parent->GetFirstChild(getter_AddRefs(accessible));
-
-  while (accessible) {
-    if (nsAccUtils::IsText(accessible))
-      characterCount += nsAccUtils::TextLength(accessible);
-
-    else if (accessible == this) {
+  nsAccessible *parent = GetParent();
+  NS_ENSURE_STATE(parent);
+
+  PRUint32 characterCount = 0;
+
+  PRInt32 childCount = parent->GetChildCount();
+  for (PRInt32 childIdx = 0; childIdx < childCount; childIdx++) {
+    nsAccessible *sibling = parent->GetChildAt(childIdx);
+
+    if (sibling == this) {
       *aStartOffset = characterCount;
       *aEndOffset = characterCount + 1;
       return NS_OK;
     }
-    else {
-      ++ characterCount;
-    }
-    accessible->GetNextSibling(getter_AddRefs(nextSibling));
-    accessible.swap(nextSibling);
+
+    characterCount += nsAccUtils::TextLength(sibling);
   }
 
   return NS_ERROR_FAILURE;
 }
 
 nsresult
 nsAccessible::AppendTextTo(nsAString& aText, PRUint32 aStartOffset, PRUint32 aLength)
 {
@@ -2837,37 +2815,36 @@ nsAccessible*
 nsAccessible::GetParent()
 {
   if (IsDefunct())
     return nsnull;
 
   if (mParent)
     return mParent;
 
+#ifdef DEBUG
   nsDocAccessible *docAccessible = GetDocAccessible();
   NS_ASSERTION(docAccessible, "No document accessible for valid accessible!");
-
-  if (!docAccessible)
+#endif
+
+  nsAccessible *parent = GetAccService()->GetContainerAccessible(mDOMNode,
+                                                                 PR_TRUE);
+  NS_ASSERTION(parent, "No accessible parent for valid accessible!");
+  if (!parent)
     return nsnull;
 
-  nsCOMPtr<nsIAccessible> parent;
-  docAccessible->GetAccessibleInParentChain(mDOMNode, PR_TRUE,
-                                            getter_AddRefs(parent));
-
-  nsRefPtr<nsAccessible> parentAcc = do_QueryObject(parent);
-
 #ifdef DEBUG
-  NS_ASSERTION(!parentAcc->IsDefunct(), "Defunct parent!");
-
-  parentAcc->EnsureChildren();
+  NS_ASSERTION(!parent->IsDefunct(), "Defunct parent!");
+
+  parent->EnsureChildren();
   if (parent != mParent)
     NS_WARNING("Bad accessible tree!");
 #endif
 
-  return parentAcc;
+  return parent;
 }
 
 nsAccessible*
 nsAccessible::GetChildAt(PRUint32 aIndex)
 {
   if (EnsureChildren())
     return nsnull;
 
@@ -3014,27 +2991,27 @@ nsAccessible::GetSiblingAtOffset(PRInt32
 
   nsAccessible *child = parent->GetChildAt(indexInParent + aOffset);
   if (aError && !child)
     *aError = NS_ERROR_UNEXPECTED;
 
   return child;
 }
 
-already_AddRefed<nsAccessible>
-nsAccessible::GetFirstAvailableAccessible(nsIDOMNode *aStartNode)
+nsAccessible *
+nsAccessible::GetFirstAvailableAccessible(nsIDOMNode *aStartNode) const
 {
   nsCOMPtr<nsIDOMTreeWalker> walker; 
   nsCOMPtr<nsIDOMNode> currentNode(aStartNode);
 
   while (currentNode) {
-    nsRefPtr<nsAccessible> accessible =
+    nsAccessible *accessible =
       GetAccService()->GetAccessibleInWeakShell(currentNode, mWeakShell);
     if (accessible)
-      return accessible.forget();
+      return accessible;
 
     if (!walker) {
       // Instantiate walker lazily since we won't need it in 90% of the cases
       // where the first DOM node we're given provides an accessible
       nsCOMPtr<nsIDOMDocument> document;
       currentNode->GetOwnerDocument(getter_AddRefs(document));
       nsCOMPtr<nsIDOMDocumentTraversal> trav = do_QueryInterface(document);
       NS_ASSERTION(trav, "No DOM document traversal for document");
--- a/accessible/src/base/nsAccessible.h
+++ b/accessible/src/base/nsAccessible.h
@@ -241,16 +241,21 @@ public:
   virtual PRInt32 GetIndexOf(nsIAccessible *aChild);
 
   /**
    * Return index in parent accessible.
    */
   PRInt32 GetIndexInParent();
 
   /**
+   * Return true if accessible has children;
+   */
+  PRBool HasChildren() { return !!GetChildAt(0); }
+
+  /**
    * Return parent accessible only if cached.
    */
   nsAccessible* GetCachedParent();
 
   /**
    * Return first child accessible only if cached.
    */
   nsAccessible* GetCachedFirstChild();
@@ -320,29 +325,26 @@ protected:
   /**
    * Compute the name for XUL node.
    */
   nsresult GetXULName(nsAString& aName);
 
   // helper method to verify frames
   static nsresult GetFullKeyName(const nsAString& aModifierName, const nsAString& aKeyName, nsAString& aStringOut);
   static nsresult GetTranslatedString(const nsAString& aKey, nsAString& aStringOut);
-    
-  already_AddRefed<nsIAccessible> GetNextWithState(nsIAccessible *aStart, PRUint32 matchState);
 
   /**
    * Return an accessible for the given DOM node, or if that node isn't
    * accessible, return the accessible for the next DOM node which has one
    * (based on forward depth first search).
    *
    * @param  aStartNode  [in] the DOM node to start from
    * @return              the resulting accessible
-   */   
-  already_AddRefed<nsAccessible>
-    GetFirstAvailableAccessible(nsIDOMNode *aStartNode);
+   */
+  nsAccessible *GetFirstAvailableAccessible(nsIDOMNode *aStartNode) const;
 
   // Hyperlink helpers
   virtual nsresult GetLinkOffset(PRInt32* aStartOffset, PRInt32* aEndOffset);
 
   //////////////////////////////////////////////////////////////////////////////
   // Action helpers
 
   /**
--- a/accessible/src/base/nsApplicationAccessible.cpp
+++ b/accessible/src/base/nsApplicationAccessible.cpp
@@ -45,16 +45,17 @@
 #include "nsAccessibilityService.h"
 #include "nsAccUtils.h"
 
 #include "nsIComponentManager.h"
 #include "nsIDOMDocument.h"
 #include "nsIDOMWindow.h"
 #include "nsIWindowMediator.h"
 #include "nsServiceManagerUtils.h"
+#include "mozilla/Services.h"
 
 nsApplicationAccessible::nsApplicationAccessible() :
   nsAccessibleWrap(nsnull, nsnull)
 {
 }
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsISupports
@@ -78,17 +79,17 @@ nsApplicationAccessible::GetRootDocument
 // nsIAccessible
 
 NS_IMETHODIMP
 nsApplicationAccessible::GetName(nsAString& aName)
 {
   aName.Truncate();
 
   nsCOMPtr<nsIStringBundleService> bundleService =
-    do_GetService(NS_STRINGBUNDLE_CONTRACTID);
+    mozilla::services::GetStringBundleService();
 
   NS_ASSERTION(bundleService, "String bundle service must be present!");
   NS_ENSURE_STATE(bundleService);
 
   nsCOMPtr<nsIStringBundle> bundle;
   nsresult rv = bundleService->CreateBundle("chrome://branding/locale/brand.properties",
                                             getter_AddRefs(bundle));
   NS_ENSURE_SUCCESS(rv, rv);
@@ -319,18 +320,17 @@ nsApplicationAccessible::GetSiblingAtOff
 ////////////////////////////////////////////////////////////////////////////////
 // Public methods
 
 nsresult
 nsApplicationAccessible::AddRootAccessible(nsIAccessible *aRootAccessible)
 {
   NS_ENSURE_ARG_POINTER(aRootAccessible);
 
-  nsRefPtr<nsAccessible> rootAcc =
-    nsAccUtils::QueryObject<nsAccessible>(aRootAccessible);
+  nsRefPtr<nsAccessible> rootAcc = do_QueryObject(aRootAccessible);
 
   if (!mChildren.AppendElement(rootAcc))
     return NS_ERROR_FAILURE;
 
   rootAcc->SetParent(this);
 
   return NS_OK;
 }
--- a/accessible/src/base/nsBaseWidgetAccessible.cpp
+++ b/accessible/src/base/nsBaseWidgetAccessible.cpp
@@ -102,32 +102,32 @@ nsLinkableAccessible::
 NS_IMPL_ISUPPORTS_INHERITED0(nsLinkableAccessible, nsAccessibleWrap)
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsLinkableAccessible. nsIAccessible
 
 NS_IMETHODIMP
 nsLinkableAccessible::TakeFocus()
 {
-  nsRefPtr<nsAccessible> actionAcc = GetActionAccessible();
+  nsAccessible *actionAcc = GetActionAccessible();
   if (actionAcc)
     return actionAcc->TakeFocus();
 
   return nsAccessibleWrap::TakeFocus();
 }
 
 nsresult
 nsLinkableAccessible::GetStateInternal(PRUint32 *aState, PRUint32 *aExtraState)
 {
   nsresult rv = nsAccessibleWrap::GetStateInternal(aState, aExtraState);
   NS_ENSURE_A11Y_SUCCESS(rv, rv);
 
   if (mIsLink) {
     *aState |= nsIAccessibleStates::STATE_LINKED;
-    nsRefPtr<nsAccessible> actionAcc = GetActionAccessible();
+    nsAccessible *actionAcc = GetActionAccessible();
     if (nsAccUtils::State(actionAcc) & nsIAccessibleStates::STATE_TRAVERSED)
       *aState |= nsIAccessibleStates::STATE_TRAVERSED;
   }
 
   return NS_OK;
 }
 
 NS_IMETHODIMP
@@ -135,17 +135,17 @@ nsLinkableAccessible::GetValue(nsAString
 {
   aValue.Truncate();
 
   nsAccessible::GetValue(aValue);
   if (!aValue.IsEmpty())
     return NS_OK;
 
   if (mIsLink) {
-    nsRefPtr<nsAccessible> actionAcc = GetActionAccessible();
+    nsAccessible *actionAcc = GetActionAccessible();
     if (actionAcc)
       return actionAcc->GetValue(aValue);
   }
 
   return NS_ERROR_NOT_IMPLEMENTED;
 }
 
 
@@ -178,47 +178,46 @@ nsLinkableAccessible::GetActionName(PRUi
   return NS_ERROR_INVALID_ARG;
 }
 
 NS_IMETHODIMP
 nsLinkableAccessible::DoAction(PRUint8 aIndex)
 {
   if (aIndex != eAction_Jump)
     return NS_ERROR_INVALID_ARG;
-  
-  nsRefPtr<nsAccessible> actionAcc = GetActionAccessible();
+
+  nsAccessible *actionAcc = GetActionAccessible();
   if (actionAcc)
     return actionAcc->DoAction(aIndex);
   
   return nsAccessibleWrap::DoAction(aIndex);
 }
 
 NS_IMETHODIMP
 nsLinkableAccessible::GetKeyboardShortcut(nsAString& aKeyboardShortcut)
 {
   aKeyboardShortcut.Truncate();
 
-  nsRefPtr<nsAccessible> actionAcc = GetActionAccessible();
+  nsAccessible *actionAcc = GetActionAccessible();
   if (actionAcc)
     return actionAcc->GetKeyboardShortcut(aKeyboardShortcut);
 
   return nsAccessible::GetKeyboardShortcut(aKeyboardShortcut);
 }
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsLinkableAccessible. nsIAccessibleHyperLink
 
 NS_IMETHODIMP
 nsLinkableAccessible::GetURI(PRInt32 aIndex, nsIURI **aURI)
 {
   if (mIsLink) {
-    nsRefPtr<nsAccessible> actionAcc = GetActionAccessible();
+    nsAccessible *actionAcc = GetActionAccessible();
     if (actionAcc) {
-      nsCOMPtr<nsIAccessibleHyperLink> hyperLinkAcc =
-        nsAccUtils::QueryObject<nsIAccessibleHyperLink>(actionAcc);
+      nsCOMPtr<nsIAccessibleHyperLink> hyperLinkAcc = do_QueryObject(actionAcc);
       NS_ASSERTION(hyperLinkAcc,
                    "nsIAccessibleHyperLink isn't implemented.");
 
       if (hyperLinkAcc)
         return hyperLinkAcc->GetURI(aIndex, aURI);
     }
   }
   
@@ -257,17 +256,17 @@ nsLinkableAccessible::CacheActionContent
     return;
   }
 
   while ((walkUpContent = walkUpContent->GetParent())) {
     isOnclick = nsCoreUtils::HasClickListener(walkUpContent);
   
     nsCOMPtr<nsIDOMNode> walkUpNode(do_QueryInterface(walkUpContent));
 
-    nsRefPtr<nsAccessible> walkUpAcc =
+    nsAccessible *walkUpAcc =
       GetAccService()->GetAccessibleInWeakShell(walkUpNode, mWeakShell);
 
     if (nsAccUtils::Role(walkUpAcc) == nsIAccessibleRole::ROLE_LINK &&
         nsAccUtils::State(walkUpAcc) & nsIAccessibleStates::STATE_LINKED) {
       mIsLink = PR_TRUE;
       mActionContent = walkUpContent;
       return;
     }
@@ -275,18 +274,18 @@ nsLinkableAccessible::CacheActionContent
     if (isOnclick) {
       mActionContent = walkUpContent;
       mIsOnclick = PR_TRUE;
       return;
     }
   }
 }
 
-already_AddRefed<nsAccessible>
-nsLinkableAccessible::GetActionAccessible()
+nsAccessible *
+nsLinkableAccessible::GetActionAccessible() const
 {
   // Return accessible for the action content if it's different from node of
   // this accessible. If the action accessible is not null then it is used to
   // redirect methods calls otherwise we use method implementation from the
   // base class.
   nsCOMPtr<nsIDOMNode> actionNode(do_QueryInterface(mActionContent));
   if (!actionNode || mDOMNode == actionNode)
     return nsnull;
--- a/accessible/src/base/nsBaseWidgetAccessible.h
+++ b/accessible/src/base/nsBaseWidgetAccessible.h
@@ -105,17 +105,17 @@ public:
 
   // nsAccessible
   virtual nsresult GetStateInternal(PRUint32 *aState, PRUint32 *aExtraState);
 
 protected:
   /**
    * Return an accessible for cached action node.
    */
-  already_AddRefed<nsAccessible> GetActionAccessible();
+  nsAccessible *GetActionAccessible() const;
 
   /**
    * Cache action node.
    */
   virtual void CacheActionContent();
 
   nsCOMPtr<nsIContent> mActionContent;
   PRPackedBool mIsLink;
--- a/accessible/src/base/nsCaretAccessible.cpp
+++ b/accessible/src/base/nsCaretAccessible.cpp
@@ -316,17 +316,17 @@ nsCaretAccessible::GetCaretRect(nsIWidge
 
   nsCOMPtr<nsIAccessNode> lastAccessNode(do_QueryInterface(mLastTextAccessible));
   NS_ENSURE_TRUE(lastAccessNode, caretRect);
 
   nsCOMPtr<nsIDOMNode> lastNodeWithCaret;
   lastAccessNode->GetDOMNode(getter_AddRefs(lastNodeWithCaret));
   NS_ENSURE_TRUE(lastNodeWithCaret, caretRect);
 
-  nsCOMPtr<nsIPresShell> presShell =
+  nsIPresShell *presShell =
     nsCoreUtils::GetPresShellFor(lastNodeWithCaret);
   NS_ENSURE_TRUE(presShell, caretRect);
 
   nsRefPtr<nsCaret> caret = presShell->GetCaret();
   NS_ENSURE_TRUE(caret, caretRect);
 
   nsCOMPtr<nsISelection> caretSelection(do_QueryReferent(mLastUsedSelection));
   NS_ENSURE_TRUE(caretSelection, caretRect);
@@ -366,17 +366,17 @@ nsCaretAccessible::GetCaretRect(nsIWidge
 }
 
 already_AddRefed<nsISelectionController>
 nsCaretAccessible::GetSelectionControllerForNode(nsIDOMNode *aNode)
 {
   if (!aNode)
     return nsnull;
 
-  nsCOMPtr<nsIPresShell> presShell = nsCoreUtils::GetPresShellFor(aNode);
+  nsIPresShell *presShell = nsCoreUtils::GetPresShellFor(aNode);
   if (!presShell)
     return nsnull;
 
   nsCOMPtr<nsIDocument> doc = presShell->GetDocument();
   if (!doc)
     return nsnull;
 
   // Get selection controller only for form controls, not for the document.
--- a/accessible/src/base/nsCoreUtils.cpp
+++ b/accessible/src/base/nsCoreUtils.cpp
@@ -265,39 +265,32 @@ nsCoreUtils::GetDOMElementFor(nsIDOMNode
 
     nsCOMPtr<nsIDOMDocument> domDoc(do_QueryInterface(node));
     domDoc->GetDocumentElement(&element);
   }
 
   return element;
 }
 
-already_AddRefed<nsIDOMNode>
-nsCoreUtils::GetDOMNodeFromDOMPoint(nsIDOMNode *aNode, PRUint32 aOffset)
+nsINode *
+nsCoreUtils::GetDOMNodeFromDOMPoint(nsINode *aNode, PRUint32 aOffset)
 {
-  nsIDOMNode *resultNode = nsnull;
-
-  nsCOMPtr<nsIContent> content(do_QueryInterface(aNode));
-  if (content && content->IsElement()) {
-
-    PRUint32 childCount = content->GetChildCount();
+  if (aNode && aNode->IsElement()) {
+    PRUint32 childCount = aNode->GetChildCount();
     NS_ASSERTION(aOffset >= 0 && aOffset <= childCount,
                  "Wrong offset of the DOM point!");
 
     // The offset can be after last child of container node that means DOM point
     // is placed immediately after the last child. In this case use the DOM node
     // from the given DOM point is used as result node.
-    if (aOffset != childCount) {
-      CallQueryInterface(content->GetChildAt(aOffset), &resultNode);
-      return resultNode;
-    }
+    if (aOffset != childCount)
+      return aNode->GetChildAt(aOffset);
   }
 
-  NS_IF_ADDREF(resultNode = aNode);
-  return resultNode;
+  return aNode;
 }
 
 nsIContent*
 nsCoreUtils::GetRoleContent(nsIDOMNode *aDOMNode)
 {
   nsCOMPtr<nsIContent> content(do_QueryInterface(aDOMNode));
   if (!content) {
     nsCOMPtr<nsIDOMDocument> domDoc(do_QueryInterface(aDOMNode));
@@ -521,35 +514,16 @@ nsCoreUtils::IsCorrectFrameType(nsIFrame
   NS_ASSERTION(aFrame != nsnull,
                "aFrame is null in call to IsCorrectFrameType!");
   NS_ASSERTION(aAtom != nsnull,
                "aAtom is null in call to IsCorrectFrameType!");
   
   return aFrame->GetType() == aAtom;
 }
 
-already_AddRefed<nsIPresShell>
-nsCoreUtils::GetPresShellFor(nsIDOMNode *aNode)
-{
-  nsCOMPtr<nsIDOMDocument> domDocument;
-  aNode->GetOwnerDocument(getter_AddRefs(domDocument));
-
-  nsCOMPtr<nsIDocument> doc(do_QueryInterface(domDocument));
-  if (!doc) // This is necessary when the node is the document node
-    doc = do_QueryInterface(aNode);
-
-  nsIPresShell *presShell = nsnull;
-  if (doc) {
-    presShell = doc->GetPrimaryShell();
-    NS_IF_ADDREF(presShell);
-  }
-
-  return presShell;
-}
-
 already_AddRefed<nsIDOMNode>
 nsCoreUtils::GetDOMNodeForContainer(nsIDocShellTreeItem *aContainer)
 {
   nsCOMPtr<nsIDocShell> shell = do_QueryInterface(aContainer);
 
   nsCOMPtr<nsIContentViewer> cv;
   shell->GetContentViewer(getter_AddRefs(cv));
 
--- a/accessible/src/base/nsCoreUtils.h
+++ b/accessible/src/base/nsCoreUtils.h
@@ -124,18 +124,18 @@ public:
    *
    * @param aNode  [in] the given DOM node
    */
   static already_AddRefed<nsIDOMElement> GetDOMElementFor(nsIDOMNode *aNode);
 
   /**
    * Return DOM node for the given DOM point.
    */
-  static already_AddRefed<nsIDOMNode> GetDOMNodeFromDOMPoint(nsIDOMNode *aNode,
-                                                             PRUint32 aOffset);
+  static nsINode *GetDOMNodeFromDOMPoint(nsINode *aNode, PRUint32 aOffset);
+
   /**
    * Return the nsIContent* to check for ARIA attributes on -- this may not
    * always be the DOM node for the accessible. Specifically, for doc
    * accessibles, it is not the document node, but either the root element or
    * <body> in HTML. Similar with GetDOMElementFor() method.
    *
    * @param aDOMNode  DOM node for the accessible that may be affected by ARIA
    * @return          the nsIContent which may have ARIA markup
@@ -238,17 +238,22 @@ public:
    * @param aFrame  the frame
    * @param aAtom   the frame type
    */
   static PRBool IsCorrectFrameType(nsIFrame* aFrame, nsIAtom* aAtom);
 
   /**
    * Return presShell for the document containing the given DOM node.
    */
-  static already_AddRefed<nsIPresShell> GetPresShellFor(nsIDOMNode *aNode);
+  static nsIPresShell *GetPresShellFor(nsIDOMNode *aNode)
+  {
+    nsCOMPtr<nsINode> node(do_QueryInterface(aNode));
+    nsIDocument *document = node->GetOwnerDoc();
+    return document ? document->GetPrimaryShell() : nsnull;
+  }
 
   /**
    * Return document node for the given document shell tree item.
    */
   static already_AddRefed<nsIDOMNode>
     GetDOMNodeForContainer(nsIDocShellTreeItem *aContainer);
 
   /**
--- a/accessible/src/base/nsDocAccessible.cpp
+++ b/accessible/src/base/nsDocAccessible.cpp
@@ -544,18 +544,17 @@ nsDocAccessible::GetCachedAccessNode(voi
       accessNode = this;
   }
 
 #ifdef DEBUG
   // All cached accessible nodes should be in the parent
   // It will assert if not all the children were created
   // when they were first cached, and no invalidation
   // ever corrected parent accessible's child cache.
-  nsRefPtr<nsAccessible> acc =
-    nsAccUtils::QueryObject<nsAccessible>(accessNode);
+  nsRefPtr<nsAccessible> acc = do_QueryObject(accessNode);
 
   if (acc) {
     nsAccessible* parent(acc->GetCachedParent());
     if (parent)
       parent->TestChildCache(acc);
   }
 #endif
 
@@ -979,20 +978,23 @@ void nsDocAccessible::ScrollPositionDidC
 ////////////////////////////////////////////////////////////////////////////////
 // nsIObserver
 
 NS_IMETHODIMP nsDocAccessible::Observe(nsISupports *aSubject, const char *aTopic,
                                        const PRUnichar *aData)
 {
   if (!nsCRT::strcmp(aTopic,"obs_documentCreated")) {    
     // State editable will now be set, readonly is now clear
+    // Normally we only fire delayed events created from the node, not an
+    // accessible object. See the nsAccStateChangeEvent constructor for details
+    // about this exceptional case.
     nsRefPtr<nsAccEvent> event =
       new nsAccStateChangeEvent(this, nsIAccessibleStates::EXT_STATE_EDITABLE,
                                 PR_TRUE, PR_TRUE);
-    nsEventShell::FireEvent(event);
+    FireDelayedAccessibleEvent(event);
   }
 
   return NS_OK;
 }
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsIDocumentObserver
 
@@ -1304,32 +1306,32 @@ nsDocAccessible::ARIAAttributeChanged(ns
     InvalidateCacheSubtree(aContent,
                            nsIAccessibilityService::NODE_SIGNIFICANT_CHANGE);
     return;
   }
 }
 
 void nsDocAccessible::ContentAppended(nsIDocument *aDocument,
                                       nsIContent* aContainer,
-                                      PRInt32 aNewIndexInContainer)
+                                      nsIContent* aFirstNewContent,
+                                      PRInt32 /* unused */)
 {
   if ((!mIsContentLoaded || !mDocument) && mAccessNodeCache.Count() <= 1) {
     // See comments in nsDocAccessible::InvalidateCacheSubtree
     InvalidateChildren();
     return;
   }
 
-  PRUint32 childCount = aContainer->GetChildCount();
-  for (PRUint32 index = aNewIndexInContainer; index < childCount; index ++) {
-    nsCOMPtr<nsIContent> child(aContainer->GetChildAt(index));
+  // Does this need to be a strong ref?  If so, why?
+  for (nsIContent* cur = aFirstNewContent; cur; cur = cur->GetNextSibling()) {
     // InvalidateCacheSubtree will not fire the EVENT_SHOW for the new node
     // unless an accessible can be created for the passed in node, which it
     // can't do unless the node is visible. The right thing happens there so
     // no need for an extra visibility check here.
-    InvalidateCacheSubtree(child, nsIAccessibilityService::NODE_APPEND);
+    InvalidateCacheSubtree(cur, nsIAccessibilityService::NODE_APPEND);
   }
 }
 
 
 void nsDocAccessible::ContentStatesChanged(nsIDocument* aDocument,
                                            nsIContent* aContent1,
                                            nsIContent* aContent2,
                                            PRInt32 aStateMask)
@@ -1358,28 +1360,28 @@ void nsDocAccessible::CharacterDataChang
                                            nsIContent* aContent,
                                            CharacterDataChangeInfo* aInfo)
 {
   FireTextChangeEventForText(aContent, aInfo, PR_TRUE);
 }
 
 void
 nsDocAccessible::ContentInserted(nsIDocument *aDocument, nsIContent* aContainer,
-                                 nsIContent* aChild, PRInt32 aIndexInContainer)
+                                 nsIContent* aChild, PRInt32 /* unused */)
 {
   // InvalidateCacheSubtree will not fire the EVENT_SHOW for the new node
   // unless an accessible can be created for the passed in node, which it
   // can't do unless the node is visible. The right thing happens there so
   // no need for an extra visibility check here.
   InvalidateCacheSubtree(aChild, nsIAccessibilityService::NODE_APPEND);
 }
 
 void
 nsDocAccessible::ContentRemoved(nsIDocument *aDocument, nsIContent* aContainer,
-                                nsIContent* aChild, PRInt32 aIndexInContainer)
+                                nsIContent* aChild, PRInt32 /* unused */)
 {
   // It's no needed to invalidate the subtree of the removed element,
   // because we get notifications directly from content (see
   // nsGenericElement::doRemoveChildAt) *before* the frame for the content is
   // destroyed, or any other side effects occur . That allows us to correctly
   // calculate the TEXT_REMOVED event if there is one and coalesce events from
   // the same subtree.
 }
@@ -1413,17 +1415,17 @@ nsDocAccessible::GetParent()
     if (accService) {
       // XXX aaronl: ideally we would traverse the presshell chain. Since
       // there's no easy way to do that, we cheat and use the document
       // hierarchy. GetAccessibleFor() is bad because it doesn't support our
       // concept of multiple presshells per doc.
       // It should be changed to use GetAccessibleInWeakShell()
       nsCOMPtr<nsIAccessible> parent;
       accService->GetAccessibleFor(ownerNode, getter_AddRefs(parent));
-      mParent = nsAccUtils::QueryObject<nsAccessible>(parent);
+      mParent = do_QueryObject(parent);
     }
   }
 
   NS_ASSERTION(mParent, "No parent for not root document accessible!");
   return mParent;
 }
 
 
@@ -1451,119 +1453,111 @@ nsDocAccessible::FireTextChangeEventForT
   if (!mIsContentLoaded || !mDocument) {
     return;
   }
 
   nsCOMPtr<nsIDOMNode> node(do_QueryInterface(aContent));
   if (!node)
     return;
 
-  nsCOMPtr<nsIAccessible> accessible;
-  nsresult rv = GetAccessibleInParentChain(node, PR_TRUE, getter_AddRefs(accessible));
-  if (NS_FAILED(rv) || !accessible)
+  nsAccessible *accessible = GetAccService()->GetContainerAccessible(node,
+                                                                     PR_TRUE);
+  if (!accessible)
     return;
 
-  nsRefPtr<nsHyperTextAccessible> textAccessible;
-  rv = accessible->QueryInterface(NS_GET_IID(nsHyperTextAccessible),
-                                  getter_AddRefs(textAccessible));
-  if (NS_FAILED(rv) || !textAccessible)
+  nsRefPtr<nsHyperTextAccessible> textAccessible(do_QueryObject(accessible));
+  if (!textAccessible)
     return;
 
   PRInt32 start = aInfo->mChangeStart;
 
   PRInt32 offset = 0;
-  rv = textAccessible->DOMPointToHypertextOffset(node, start, &offset);
-  if (NS_FAILED(rv))
-    return;
+  textAccessible->DOMPointToHypertextOffset(node, start, &offset);
 
   PRInt32 length = aIsInserted ?
     aInfo->mReplaceLength: // text has been added
     aInfo->mChangeEnd - start; // text has been removed
 
   if (length > 0) {
     PRUint32 renderedStartOffset, renderedEndOffset;
     nsIFrame* frame = aContent->GetPrimaryFrame();
     if (!frame)
       return;
 
-    rv = textAccessible->ContentToRenderedOffset(frame, start,
-                                                 &renderedStartOffset);
+    nsresult rv = textAccessible->ContentToRenderedOffset(frame, start,
+                                                          &renderedStartOffset);
     if (NS_FAILED(rv))
       return;
 
     rv = textAccessible->ContentToRenderedOffset(frame, start + length,
                                                  &renderedEndOffset);
     if (NS_FAILED(rv))
       return;
 
+    // Normally we only fire delayed events created from the node, not an
+    // accessible object. See the nsAccTextChangeEvent constructor for details
+    // about this exceptional case.
     nsRefPtr<nsAccEvent> event =
       new nsAccTextChangeEvent(accessible, offset,
                                renderedEndOffset - renderedStartOffset,
                                aIsInserted, PR_FALSE);
-    nsEventShell::FireEvent(event);
+    FireDelayedAccessibleEvent(event);
 
     FireValueChangeForTextFields(accessible);
   }
 }
 
 already_AddRefed<nsAccEvent>
-nsDocAccessible::CreateTextChangeEventForNode(nsIAccessible *aContainerAccessible,
+nsDocAccessible::CreateTextChangeEventForNode(nsAccessible *aContainerAccessible,
                                               nsIDOMNode *aChangeNode,
-                                              nsIAccessible *aAccessibleForChangeNode,
+                                              nsAccessible *aAccessibleForChangeNode,
                                               PRBool aIsInserting,
                                               PRBool aIsAsynch,
                                               EIsFromUserInput aIsFromUserInput)
 {
-  nsRefPtr<nsHyperTextAccessible> textAccessible;
-  aContainerAccessible->QueryInterface(NS_GET_IID(nsHyperTextAccessible),
-                                       getter_AddRefs(textAccessible));
+  nsRefPtr<nsHyperTextAccessible> textAccessible =
+    do_QueryObject(aContainerAccessible);
   if (!textAccessible) {
     return nsnull;
   }
 
   PRInt32 offset;
   PRInt32 length = 0;
-  nsCOMPtr<nsIAccessible> changeAccessible;
-  nsresult rv = textAccessible->DOMPointToHypertextOffset(aChangeNode, -1, &offset,
-                                                          getter_AddRefs(changeAccessible));
-  NS_ENSURE_SUCCESS(rv, nsnull);
+  nsAccessible *changeAcc =
+    textAccessible->DOMPointToHypertextOffset(aChangeNode, -1, &offset);
 
   if (!aAccessibleForChangeNode) {
     // A span-level object or something else without an accessible is being removed, where
     // it has no accessible but it has descendant content which is aggregated as text
     // into the parent hypertext.
     // In this case, accessibleToBeRemoved may just be the first
     // accessible that is removed, which affects the text in the hypertext container
-    if (!changeAccessible) {
+    if (!changeAcc)
       return nsnull; // No descendant content that represents any text in the hypertext parent
-    }
 
     nsCOMPtr<nsINode> changeNode(do_QueryInterface(aChangeNode));
-    nsCOMPtr<nsIAccessible> child = changeAccessible;
-    while (PR_TRUE) {
-      nsCOMPtr<nsIAccessNode> childAccessNode =
-        do_QueryInterface(changeAccessible);
 
-      nsCOMPtr<nsIDOMNode> childDOMNode;
-      childAccessNode->GetDOMNode(getter_AddRefs(childDOMNode));
+    nsAccessible *parent = changeAcc->GetParent();
+    PRInt32 childCount = parent->GetChildCount();
+    PRInt32 changeAccIdx = parent->GetIndexOf(changeAcc);
 
-      nsCOMPtr<nsINode> childNode(do_QueryInterface(childDOMNode));
+    for (PRInt32 idx = changeAccIdx; idx < childCount; idx++) {
+      nsAccessible *child = parent->GetChildAt(idx);
+      nsCOMPtr<nsINode> childNode(do_QueryInterface(child->GetDOMNode()));
+
       if (!nsCoreUtils::IsAncestorOf(changeNode, childNode)) {
-        break;  // We only want accessibles with DOM nodes as children of this node
-      }
-      length += nsAccUtils::TextLength(child);
-      child->GetNextSibling(getter_AddRefs(changeAccessible));
-      if (!changeAccessible) {
+        // We only want accessibles with DOM nodes as children of this node
         break;
       }
-      child.swap(changeAccessible);
+
+      length += nsAccUtils::TextLength(child);
     }
   }
   else {
-    NS_ASSERTION(!changeAccessible || changeAccessible == aAccessibleForChangeNode,
+    NS_ASSERTION(!changeAcc || changeAcc == aAccessibleForChangeNode,
                  "Hypertext is reporting a different accessible for this node");
 
     length = nsAccUtils::TextLength(aAccessibleForChangeNode);
     if (nsAccUtils::Role(aAccessibleForChangeNode) == nsIAccessibleRole::ROLE_WHITESPACE) {  // newline
       // Don't fire event for the first html:br in an editor.
       nsCOMPtr<nsIEditor> editor;
       textAccessible->GetAssociatedEditor(getter_AddRefs(editor));
       if (editor) {
@@ -1613,18 +1607,19 @@ nsDocAccessible::FireDelayedAccessibleEv
     mEventQueue->Push(aEvent);
 
   return NS_OK;
 }
 
 void
 nsDocAccessible::ProcessPendingEvent(nsAccEvent *aEvent)
 {  
-  nsCOMPtr<nsIAccessible> accessible;
-  aEvent->GetAccessible(getter_AddRefs(accessible));
+  nsCOMPtr<nsIAccessible> acc;
+  aEvent->GetAccessible(getter_AddRefs(acc));
+  nsRefPtr<nsAccessible> accessible(do_QueryObject(acc));
 
   nsCOMPtr<nsIDOMNode> domNode;
   aEvent->GetDOMNode(getter_AddRefs(domNode));
 
   PRUint32 eventType = aEvent->GetEventType();
   EIsFromUserInput isFromUserInput =
     aEvent->IsFromUserInput() ? eFromUserInput : eNoUserInput;
 
@@ -1652,32 +1647,30 @@ nsDocAccessible::ProcessPendingEvent(nsA
         return;
       }
       gLastFocusedFrameType = newFrameType;
     }
   }
 
   if (eventType == nsIAccessibleEvent::EVENT_SHOW) {
 
-    nsCOMPtr<nsIAccessible> containerAccessible;
+    nsAccessible *containerAccessible = nsnull;
     if (accessible)
-      accessible->GetParent(getter_AddRefs(containerAccessible));
+      containerAccessible = accessible->GetParent();
 
     if (!containerAccessible) {
-      GetAccessibleInParentChain(domNode, PR_TRUE,
-                                 getter_AddRefs(containerAccessible));
+      containerAccessible = GetAccService()->GetContainerAccessible(domNode,
+                                                                    PR_TRUE);
       if (!containerAccessible)
         containerAccessible = this;
     }
 
     if (isAsync) {
       // For asynch show, delayed invalidatation of parent's children
-      nsRefPtr<nsAccessible> containerAcc = do_QueryObject(containerAccessible);
-      if (containerAcc)
-        containerAcc->InvalidateChildren();
+      containerAccessible->InvalidateChildren();
 
       // Some show events in the subtree may have been removed to 
       // avoid firing redundant events. But, we still need to make sure any
       // accessibles parenting those shown nodes lose their child references.
       InvalidateChildrenInSubtree(domNode);
     }
 
     // Also fire text changes if the node being created could affect the text in an nsIAccessibleText parent.
@@ -1707,17 +1700,17 @@ nsDocAccessible::ProcessPendingEvent(nsA
     if (eventType == nsIAccessibleEvent::EVENT_INTERNAL_LOAD) {
       nsRefPtr<nsDocAccessible> docAcc = do_QueryObject(accessible);
       NS_ASSERTION(docAcc, "No doc accessible for doc load event");
 
       if (docAcc)
         docAcc->FireDocLoadEvents(nsIAccessibleEvent::EVENT_DOCUMENT_LOAD_COMPLETE);
     }
     else if (eventType == nsIAccessibleEvent::EVENT_TEXT_CARET_MOVED) {
-      nsCOMPtr<nsIAccessibleText> accessibleText = do_QueryInterface(accessible);
+      nsCOMPtr<nsIAccessibleText> accessibleText = do_QueryObject(accessible);
       PRInt32 caretOffset;
       if (accessibleText && NS_SUCCEEDED(accessibleText->GetCaretOffset(&caretOffset))) {
 #ifdef DEBUG_A11Y
         PRUnichar chAtOffset;
         accessibleText->GetCharacterAtOffset(caretOffset, &chAtOffset);
         printf("\nCaret moved to %d with char %c", caretOffset, chAtOffset);
 #endif
 #ifdef DEBUG_CARET
@@ -1766,18 +1759,17 @@ nsDocAccessible::ProcessPendingEvent(nsA
         }
       }
     }
   }
 }
 
 void nsDocAccessible::InvalidateChildrenInSubtree(nsIDOMNode *aStartNode)
 {
-  nsRefPtr<nsAccessible> acc =
-    nsAccUtils::QueryObject<nsAccessible>(GetCachedAccessNode(aStartNode));
+  nsRefPtr<nsAccessible> acc = do_QueryObject(GetCachedAccessNode(aStartNode));
   if (acc)
     acc->InvalidateChildren();
 
   // Invalidate accessible children in the DOM subtree 
   nsCOMPtr<nsINode> node = do_QueryInterface(aStartNode);
   PRInt32 index, numChildren = node->GetChildCount();
   for (index = 0; index < numChildren; index ++) {
     nsCOMPtr<nsIDOMNode> childNode = do_QueryInterface(node->GetChildAt(index));
@@ -1791,18 +1783,17 @@ void nsDocAccessible::RefreshNodes(nsIDO
   if (mAccessNodeCache.Count() <= 1) {
     return; // All we have is a doc accessible. There is nothing to invalidate, quit early
   }
 
   nsRefPtr<nsAccessNode> accessNode = GetCachedAccessNode(aStartNode);
 
   // Shut down accessible subtree, which may have been created for
   // anonymous content subtree
-  nsRefPtr<nsAccessible> accessible =
-    nsAccUtils::QueryObject<nsAccessible>(accessNode);
+  nsRefPtr<nsAccessible> accessible = do_QueryObject(accessNode);
   if (accessible) {
     // Fire menupopup end if a menu goes away
     PRUint32 role = nsAccUtils::Role(accessible);
     if (role == nsIAccessibleRole::ROLE_MENUPOPUP) {
       nsCOMPtr<nsIDOMNode> domNode;
       accessNode->GetDOMNode(getter_AddRefs(domNode));
       nsCOMPtr<nsIDOMXULPopupElement> popup(do_QueryInterface(domNode));
       if (!popup) {
@@ -1812,19 +1803,18 @@ void nsDocAccessible::RefreshNodes(nsIDO
                                 accessible);
       }
     }
 
     // We only need to shutdown the accessibles here if one of them has been
     // created.
     if (accessible->GetCachedFirstChild()) {
       nsCOMPtr<nsIArray> children;
-      // use GetChildren() to fetch children at one time, instead of using
-      // GetNextSibling(), because after we shutdown the first child,
-      // mNextSibling will be set null.
+      // use GetChildren() to fetch all children at once, because after shutdown
+      // the child references are cleared.
       accessible->GetChildren(getter_AddRefs(children));
       PRUint32 childCount =0;
       if (children)
         children->GetLength(&childCount);
       nsCOMPtr<nsIDOMNode> possibleAnonNode;
       for (PRUint32 index = 0; index < childCount; index++) {
         nsCOMPtr<nsIAccessNode> childAccessNode;
         children->QueryElementAt(index, NS_GET_IID(nsIAccessNode),
@@ -1925,34 +1915,33 @@ nsDocAccessible::InvalidateCacheSubtree(
 
     nsIEventStateManager *esm = presShell->GetPresContext()->EventStateManager();
     NS_ENSURE_TRUE(esm,);
 
     if (!esm->IsHandlingUserInputExternal()) {
       // Changes during page load, but not caused by user input
       // Just invalidate accessible hierarchy and return,
       // otherwise the page load time slows down way too much
-      nsCOMPtr<nsIAccessible> containerAccessible;
-      GetAccessibleInParentChain(childNode, PR_FALSE, getter_AddRefs(containerAccessible));
+      nsAccessible *containerAccessible =
+        GetAccService()->GetContainerAccessible(childNode, PR_FALSE);
       if (!containerAccessible) {
         containerAccessible = this;
       }
 
-      nsRefPtr<nsAccessible> containerAcc = do_QueryObject(containerAccessible);
-      containerAcc->InvalidateChildren();
+      containerAccessible->InvalidateChildren();
       return;
     }     
     // else: user input, so we must fall through and for full handling,
     // e.g. fire the mutation events. Note: user input could cause DOM_CREATE
     // during page load if user typed into an input field or contentEditable area
   }
 
   // Update last change state information
-  nsCOMPtr<nsIAccessNode> childAccessNode = GetCachedAccessNode(childNode);
-  nsCOMPtr<nsIAccessible> childAccessible = do_QueryInterface(childAccessNode);
+  nsRefPtr<nsAccessible> childAccessible =
+    do_QueryObject(GetCachedAccessNode(childNode));
 
 #ifdef DEBUG_A11Y
   nsAutoString localName;
   childNode->GetLocalName(localName);
   const char *hasAccessible = childAccessible ? " (acc)" : "";
   if (aChangeType == nsIAccessibilityService::FRAME_HIDE)
     printf("[Hide %s %s]\n", NS_ConvertUTF16toUTF8(localName).get(), hasAccessible);
   else if (aChangeType == nsIAccessibilityService::FRAME_SHOW)
@@ -1962,18 +1951,18 @@ nsDocAccessible::InvalidateCacheSubtree(
   else if (aChangeType == nsIAccessibilityService::NODE_APPEND)
     printf("[Create %s %s]\n", NS_ConvertUTF16toUTF8(localName).get(), hasAccessible);
   else if (aChangeType == nsIAccessibilityService::NODE_REMOVE)
     printf("[Destroy  %s %s]\n", NS_ConvertUTF16toUTF8(localName).get(), hasAccessible);
   else if (aChangeType == nsIAccessibilityService::NODE_SIGNIFICANT_CHANGE)
     printf("[Type change %s %s]\n", NS_ConvertUTF16toUTF8(localName).get(), hasAccessible);
 #endif
 
-  nsCOMPtr<nsIAccessible> containerAccessible;
-  GetAccessibleInParentChain(childNode, PR_TRUE, getter_AddRefs(containerAccessible));
+  nsAccessible *containerAccessible =
+    GetAccService()->GetContainerAccessible(childNode, PR_TRUE);
   if (!containerAccessible) {
     containerAccessible = this;
   }
 
   if (!isShowing) {
     // Fire EVENT_HIDE.
     if (isHiding) {
       nsCOMPtr<nsIContent> content(do_QueryInterface(childNode));
@@ -2003,63 +1992,63 @@ nsDocAccessible::InvalidateCacheSubtree(
       return;
 
     if (childNode != mDOMNode) { // Fire text change unless the node being removed is for this doc
       // When a node is hidden or removed, the text in an ancestor hyper text will lose characters
       // At this point we still have the frame and accessible for this node if there was one
       // XXX Collate events when a range is deleted
       // XXX We need a way to ignore SplitNode and JoinNode() when they
       // do not affect the text within the hypertext
+      // Normally we only fire delayed events created from the node, not an
+      // accessible object. See the nsAccTextChangeEvent constructor for details
+      // about this exceptional case.
       nsRefPtr<nsAccEvent> textChangeEvent =
         CreateTextChangeEventForNode(containerAccessible, childNode, childAccessible,
                                      PR_FALSE, isAsynch);
       if (textChangeEvent) {
-        nsEventShell::FireEvent(textChangeEvent);
+        FireDelayedAccessibleEvent(textChangeEvent);
       }
     }
   }
 
   // We need to get an accessible for the mutation event's container node
   // If there is no accessible for that node, we need to keep moving up the parent
   // chain so there is some accessible.
   // We will use this accessible to fire the accessible mutation event.
   // We're guaranteed success, because we will eventually end up at the doc accessible,
   // and there is always one of those.
 
   if (aChild && !isHiding) {
     if (!isAsynch) {
       // DOM already updated with new objects -- invalidate parent's children now
       // For asynch we must wait until layout updates before we invalidate the children
-      nsRefPtr<nsAccessible> containerAcc = do_QueryObject(containerAccessible);
-      if (containerAcc)
-        containerAcc->InvalidateChildren();
-
+      containerAccessible->InvalidateChildren();
     }
 
     // Fire EVENT_SHOW, EVENT_MENUPOPUP_START for newly visible content.
 
     // Fire after a short timer, because we want to make sure the view has been
     // updated to make this accessible content visible. If we don't wait,
     // the assistive technology may receive the event and then retrieve
     // nsIAccessibleStates::STATE_INVISIBLE for the event's accessible object.
 
     FireDelayedAccessibleEvent(nsIAccessibleEvent::EVENT_SHOW, childNode,
                                nsAccEvent::eCoalesceFromSameSubtree,
                                isAsynch);
 
-    // Check to see change occured in an ARIA menu, and fire
+    // Check to see change occurred in an ARIA menu, and fire
     // an EVENT_MENUPOPUP_START if it did.
     nsRoleMapEntry *roleMapEntry = nsAccUtils::GetRoleMapEntry(childNode);
     if (roleMapEntry && roleMapEntry->role == nsIAccessibleRole::ROLE_MENUPOPUP) {
       FireDelayedAccessibleEvent(nsIAccessibleEvent::EVENT_MENUPOPUP_START,
                                  childNode, nsAccEvent::eRemoveDupes,
                                  isAsynch);
     }
 
-    // Check to see if change occured inside an alert, and fire an EVENT_ALERT if it did
+    // Check to see if change occurred inside an alert, and fire an EVENT_ALERT if it did
     nsIContent *ancestor = aChild;
     while (PR_TRUE) {
       if (roleMapEntry && roleMapEntry->role == nsIAccessibleRole::ROLE_ALERT) {
         nsCOMPtr<nsIDOMNode> alertNode(do_QueryInterface(ancestor));
         FireDelayedAccessibleEvent(nsIAccessibleEvent::EVENT_ALERT, alertNode,
                                    nsAccEvent::eRemoveDupes, isAsynch);
         break;
       }
@@ -2093,56 +2082,16 @@ nsDocAccessible::InvalidateCacheSubtree(
     new nsAccReorderEvent(containerAccessible, isAsynch,
                           isUnconditionalEvent,
                           aChild ? childNode.get() : nsnull);
   NS_ENSURE_TRUE(reorderEvent,);
 
   FireDelayedAccessibleEvent(reorderEvent);
 }
 
-// nsIAccessibleDocument method
-NS_IMETHODIMP
-nsDocAccessible::GetAccessibleInParentChain(nsIDOMNode *aNode,
-                                            PRBool aCanCreate,
-                                            nsIAccessible **aAccessible)
-{
-  // Find accessible in parent chain of DOM nodes, or return null
-  *aAccessible = nsnull;
-  nsCOMPtr<nsIDOMNode> currentNode(aNode), parentNode;
-  nsCOMPtr<nsIAccessNode> accessNode;
-
-  do {
-    currentNode->GetParentNode(getter_AddRefs(parentNode));
-    currentNode = parentNode;
-    if (!currentNode) {
-      NS_ADDREF_THIS();
-      *aAccessible = this;
-      break;
-    }
-
-    nsCOMPtr<nsIDOMNode> relevantNode;
-    if (NS_SUCCEEDED(GetAccService()->GetRelevantContentNodeFor(currentNode, getter_AddRefs(relevantNode))) && relevantNode) {
-      currentNode = relevantNode;
-    }
-    if (aCanCreate) {
-      nsRefPtr<nsAccessible> acc =
-        GetAccService()->GetAccessibleInWeakShell(currentNode, mWeakShell);
-      if (acc)
-        CallQueryInterface(acc, aAccessible);
-    }
-    else { // Only return cached accessibles, don't create anything
-      nsAccessNode* accessNode = GetCachedAccessNode(currentNode);
-      if (accessNode)
-        CallQueryInterface(accessNode, aAccessible);
-    }
-  } while (!*aAccessible);
-
-  return NS_OK;
-}
-
 nsresult
 nsDocAccessible::FireShowHideEvents(nsIDOMNode *aDOMNode,
                                     PRBool aAvoidOnThisNode,
                                     PRUint32 aEventType,
                                     EEventFiringType aDelayedOrNormal,
                                     PRBool aIsAsyncChange,
                                     EIsFromUserInput aIsFromUserInput)
 {
--- a/accessible/src/base/nsDocAccessible.h
+++ b/accessible/src/base/nsDocAccessible.h
@@ -252,19 +252,19 @@ protected:
    * @param  aAccessible           [in] the accessible for that node, or nsnull
    *                                 if none exists
    * @param  aIsInserting          [in] is aChangeNode being created or shown
    *                                 (vs. removed or hidden)
    * @param  aIsAsync              [in] whether casual change is async
    * @param  aIsFromUserInput      [in] the event is known to be from user input
    */
   already_AddRefed<nsAccEvent>
-    CreateTextChangeEventForNode(nsIAccessible *aContainerAccessible,
+    CreateTextChangeEventForNode(nsAccessible *aContainerAccessible,
                                  nsIDOMNode *aNode,
-                                 nsIAccessible *aAccessible,
+                                 nsAccessible *aAccessible,
                                  PRBool aIsInserting,
                                  PRBool aIsAsynch,
                                  EIsFromUserInput aIsFromUserInput = eAutoDetect);
 
   /**
    * Used to define should the event be fired on a delay.
    */
   enum EEventFiringType {
--- a/accessible/src/base/nsEventShell.cpp
+++ b/accessible/src/base/nsEventShell.cpp
@@ -47,18 +47,17 @@
 ////////////////////////////////////////////////////////////////////////////////
 
 void
 nsEventShell::FireEvent(nsAccEvent *aEvent)
 {
   if (!aEvent)
     return;
 
-  nsRefPtr<nsAccessible> acc =
-    nsAccUtils::QueryObject<nsAccessible>(aEvent->GetAccessible());
+  nsRefPtr<nsAccessible> acc = do_QueryObject(aEvent->GetAccessible());
   NS_ENSURE_TRUE(acc,);
 
   nsCOMPtr<nsIDOMNode> node;
   aEvent->GetDOMNode(getter_AddRefs(node));
   if (node) {
     sEventTargetNode = node;
     sEventFromUserInput = aEvent->IsFromUserInput();
   }
--- a/accessible/src/base/nsRootAccessible.cpp
+++ b/accessible/src/base/nsRootAccessible.cpp
@@ -71,26 +71,26 @@
 #include "nsIServiceManager.h"
 #include "nsPIDOMWindow.h"
 #include "nsIWebBrowserChrome.h"
 #include "nsReadableUtils.h"
 #include "nsRootAccessible.h"
 #include "nsIDOMNSEventTarget.h"
 #include "nsIDOMDocumentEvent.h"
 #include "nsFocusManager.h"
-#include "Element.h"
+#include "mozilla/dom/Element.h"
 
 
 #ifdef MOZ_XUL
 #include "nsXULTreeAccessible.h"
 #include "nsIXULDocument.h"
 #include "nsIXULWindow.h"
 #endif
 
-using namespace mozilla::dom;
+using namespace mozilla;
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsISupports
 
 // Expanded version of NS_IMPL_ISUPPORTS_INHERITED2 
 // so we can QI directly to concrete nsRootAccessible
 NS_IMPL_QUERY_HEAD(nsRootAccessible)
 NS_IMPL_QUERY_BODY(nsIDOMEventListener)
@@ -142,17 +142,17 @@ nsRootAccessible::GetName(nsAString& aNa
 nsresult
 nsRootAccessible::GetRoleInternal(PRUint32 *aRole) 
 { 
   if (!mDocument) {
     return NS_ERROR_FAILURE;
   }
 
   // If it's a <dialog> or <wizard>, use nsIAccessibleRole::ROLE_DIALOG instead
-  Element *root = mDocument->GetRootElement();
+  dom::Element *root = mDocument->GetRootElement();
   if (root) {
     nsCOMPtr<nsIDOMElement> rootElement(do_QueryInterface(root));
     if (rootElement) {
       nsAutoString name;
       rootElement->GetLocalName(name);
       if (name.EqualsLiteral("dialog") || name.EqualsLiteral("wizard")) {
         *aRole = nsIAccessibleRole::ROLE_DIALOG; // Always at the root
         return NS_OK;
@@ -203,32 +203,27 @@ nsRootAccessible::GetStateInternal(PRUin
     //     how to detect that
     *aState |= nsIAccessibleStates::STATE_MOVEABLE;
   }
 #endif
 
   if (!aExtraState)
     return NS_OK;
 
-  nsCOMPtr<nsIDOMWindow> domWin;
-  GetWindow(getter_AddRefs(domWin));
-  nsCOMPtr<nsIDocShellTreeItem> dsti = do_GetInterface(domWin);
-  if (dsti) {
-    nsCOMPtr<nsIDocShellTreeItem> root;
-    dsti->GetRootTreeItem(getter_AddRefs(root));
-    nsCOMPtr<nsIDOMWindow> rootWindow = do_GetInterface(root);
+  nsCOMPtr<nsIFocusManager> fm = do_GetService(FOCUSMANAGER_CONTRACTID);
+  if (fm) {
+    nsCOMPtr<nsIDOMWindow> rootWindow;
+    GetWindow(getter_AddRefs(rootWindow));
 
-    nsCOMPtr<nsIFocusManager> fm = do_GetService(FOCUSMANAGER_CONTRACTID);
-    if (fm && rootWindow) {
-      nsCOMPtr<nsIDOMWindow> activeWindow;
-      fm->GetActiveWindow(getter_AddRefs(activeWindow));
-      if (activeWindow == rootWindow)
-        *aExtraState |= nsIAccessibleStates::EXT_STATE_ACTIVE;
-    }
+    nsCOMPtr<nsIDOMWindow> activeWindow;
+    fm->GetActiveWindow(getter_AddRefs(activeWindow));
+    if (activeWindow == rootWindow)
+      *aExtraState |= nsIAccessibleStates::EXT_STATE_ACTIVE;
   }
+
 #ifdef MOZ_XUL
   if (GetChromeFlags() & nsIWebBrowserChrome::CHROME_MODAL) {
     *aExtraState |= nsIAccessibleStates::EXT_STATE_MODAL;
   }
 #endif
 
   return NS_OK;
 }
@@ -502,18 +497,17 @@ nsRootAccessible::FireAccessibleFocusEve
       FireDelayedAccessibleEvent(menuEndEvent);
     }
     mCurrentARIAMenubar = nsnull;
   }
 
   nsCOMPtr<nsIContent> focusContent = do_QueryInterface(finalFocusNode);
   nsIFrame *focusFrame = nsnull;
   if (focusContent) {
-    nsCOMPtr<nsIPresShell> shell =
-      nsCoreUtils::GetPresShellFor(finalFocusNode);
+    nsIPresShell *shell = nsCoreUtils::GetPresShellFor(finalFocusNode);
 
     NS_ASSERTION(shell, "No pres shell for final focus node!");
     if (!shell)
       return PR_FALSE;
 
     focusFrame = focusContent->GetPrimaryFrame();
   }
 
@@ -630,38 +624,36 @@ nsresult nsRootAccessible::HandleEventWi
     if (accDoc) {
       nsRefPtr<nsAccessNode> docAccNode = do_QueryObject(accDoc);
       docAccNode->Shutdown();
     }
 
     return NS_OK;
   }
 
-  nsCOMPtr<nsIPresShell> eventShell = nsCoreUtils::GetPresShellFor(aTargetNode);
+  nsIPresShell *eventShell = nsCoreUtils::GetPresShellFor(aTargetNode);
   if (!eventShell) {
     return NS_OK;
   }
 
   if (eventType.EqualsLiteral("DOMContentLoaded")) {
     // Don't create the doc accessible until load scripts have a chance to set
     // role attribute for <body> or <html> element, because the value of 
     // role attribute will be cached when the doc accessible is Init()'d
     TryFireEarlyLoadEvent(aTargetNode);
     return NS_OK;
   }
 
-  nsCOMPtr<nsIAccessible> accessible;
-  accService->GetAccessibleInShell(aTargetNode, eventShell,
-                                   getter_AddRefs(accessible));
+  nsAccessible *accessible =
+    accService->GetAccessibleInShell(aTargetNode, eventShell);
 
   if (eventType.EqualsLiteral("popuphiding"))
     return HandlePopupHidingEvent(aTargetNode, accessible);
 
-  nsRefPtr<nsAccessible> acc(do_QueryObject(accessible));
-  if (!acc)
+  if (!accessible)
     return NS_OK;
 
 #ifdef MOZ_XUL
   if (isTree) {
     nsRefPtr<nsXULTreeAccessible> treeAcc = do_QueryObject(accessible);
     NS_ASSERTION(treeAcc,
                  "Accessible for xul:tree isn't nsXULTreeAccessible.");
 
@@ -710,17 +702,17 @@ nsresult nsRootAccessible::HandleEventWi
       new nsAccStateChangeEvent(accessible,
                                 nsIAccessibleStates::STATE_CHECKED,
                                 PR_FALSE, isEnabled);
 
     nsEventShell::FireEvent(accEvent);
     return NS_OK;
   }
 
-  nsCOMPtr<nsIAccessible> treeItemAccessible;
+  nsAccessible *treeItemAccessible = nsnull;
 #ifdef MOZ_XUL
   // If it's a tree element, need the currently selected item
   if (isTree) {
     nsCOMPtr<nsIDOMXULMultiSelectControlElement> multiSelect =
       do_QueryInterface(aTargetNode);
     if (multiSelect) {
       PRInt32 treeIndex = -1;
       multiSelect->GetCurrentIndex(&treeIndex);
@@ -797,18 +789,17 @@ nsresult nsRootAccessible::HandleEventWi
           nsCOMPtr<nsIDOMXULSelectControlItemElement> selectedItem;
           selectControl->GetSelectedItem(getter_AddRefs(selectedItem));
           if (selectedItem)
             focusedItem = do_QueryInterface(selectedItem);
 
           if (!focusedItem)
             return NS_OK;
 
-          accService->GetAccessibleInShell(focusedItem, eventShell,
-                                           getter_AddRefs(accessible));
+          accessible = accService->GetAccessibleInShell(focusedItem, eventShell);
           if (!accessible)
             return NS_OK;
         }
       }
     }
     FireAccessibleFocusEvent(accessible, focusedItem, aEvent);
   }
   else if (eventType.EqualsLiteral("blur")) {
@@ -831,40 +822,36 @@ nsresult nsRootAccessible::HandleEventWi
   else if (eventType.EqualsLiteral("DOMMenuItemActive")) {
     PRBool fireFocus = PR_FALSE;
     if (!treeItemAccessible) {
 #ifdef MOZ_XUL
       if (isTree) {
         return NS_OK; // Tree with nothing selected
       }
 #endif
-      nsRefPtr<nsAccessNode> menuAccessNode = do_QueryObject(accessible);
-  
-      nsIFrame* menuFrame = menuAccessNode->GetFrame();
+      nsIFrame* menuFrame = accessible->GetFrame();
       NS_ENSURE_TRUE(menuFrame, NS_ERROR_FAILURE);
 
       nsIMenuFrame* imenuFrame = do_QueryFrame(menuFrame);
       if (imenuFrame)
         fireFocus = PR_TRUE;
       // QI failed for nsIMenuFrame means it's not on menu bar
       if (imenuFrame && imenuFrame->IsOnMenuBar() &&
                        !imenuFrame->IsOnActiveMenuBar()) {
         // It is a top level menuitem. Only fire a focus event when the menu bar
         // is active.
         return NS_OK;
       } else {
-        nsCOMPtr<nsIAccessible> containerAccessible;
-        accessible->GetParent(getter_AddRefs(containerAccessible));
+        nsAccessible *containerAccessible = accessible->GetParent();
         NS_ENSURE_TRUE(containerAccessible, NS_ERROR_FAILURE);
         // It is not top level menuitem
         // Only fire focus event if it is not inside collapsed popup
         // and not a listitem of a combo box
         if (nsAccUtils::State(containerAccessible) & nsIAccessibleStates::STATE_COLLAPSED) {
-          nsCOMPtr<nsIAccessible> containerParent;
-          containerAccessible->GetParent(getter_AddRefs(containerParent));
+          nsAccessible *containerParent = containerAccessible->GetParent();
           NS_ENSURE_TRUE(containerParent, NS_ERROR_FAILURE);
           if (nsAccUtils::Role(containerParent) != nsIAccessibleRole::ROLE_COMBOBOX) {
             return NS_OK;
           }
         }
       }
     }
     if (!fireFocus) {
--- a/accessible/src/base/nsTextAccessible.cpp
+++ b/accessible/src/base/nsTextAccessible.cpp
@@ -56,17 +56,17 @@ nsTextAccessible::GetRoleInternal(PRUint
   *aRole = nsIAccessibleRole::ROLE_TEXT_LEAF;
   return NS_OK;
 }
 
 nsresult
 nsTextAccessible::AppendTextTo(nsAString& aText, PRUint32 aStartOffset, PRUint32 aLength)
 {
   nsIFrame *frame = GetFrame();
-  NS_ENSURE_TRUE(frame, NS_ERROR_FAILURE);
+  if (!frame) return NS_ERROR_FAILURE;//NS_ENSURE_TRUE(frame, NS_ERROR_FAILURE);
 
   return frame->GetRenderedText(&aText, nsnull, nsnull, aStartOffset, aLength);
 }
 
 void
 nsTextAccessible::CacheChildren()
 {
   // No children for text accessible.
--- a/accessible/src/base/nsTextAttrs.cpp
+++ b/accessible/src/base/nsTextAttrs.cpp
@@ -76,56 +76,84 @@ static nsCSSTextAttrMapItem gCSSTextAttr
   { "text-decoration",   "underline",     &nsAccessibilityAtoms::textUnderlineStyle,    "solid" },
   { "vertical-align",    kAnyValue,       &nsAccessibilityAtoms::textPosition,          kCopyValue }
 };
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsTextAttrs
 
 nsTextAttrsMgr::nsTextAttrsMgr(nsHyperTextAccessible *aHyperTextAcc,
-                               nsIDOMNode *aHyperTextNode,
                                PRBool aIncludeDefAttrs,
-                               nsIDOMNode *aOffsetNode) :
-  mHyperTextAcc(aHyperTextAcc), mHyperTextNode(aHyperTextNode),
-  mIncludeDefAttrs(aIncludeDefAttrs), mOffsetNode(aOffsetNode)
+                               nsAccessible *aOffsetAcc,
+                               PRInt32 aOffsetAccIdx) :
+  mHyperTextAcc(aHyperTextAcc), mIncludeDefAttrs(aIncludeDefAttrs),
+  mOffsetAcc(aOffsetAcc), mOffsetAccIdx(aOffsetAccIdx)
 {
 }
 
 nsresult
 nsTextAttrsMgr::GetAttributes(nsIPersistentProperties *aAttributes,
                               PRInt32 *aStartHTOffset,
                               PRInt32 *aEndHTOffset)
 {
-  // 1. Hyper text accessible and its DOM node must be specified always.
-  // 2. Offset DOM node and result hyper text offsets must be specifed in
+  // 1. Hyper text accessible must be specified always.
+  // 2. Offset accessible and result hyper text offsets must be specified in
   // the case of text attributes.
-  // 3. Offset DOM node and result hyper text offsets must not be specifed but
-  // include default text attributes flag and attributes list must be specified
-  // in the case of default text attributes.
-  NS_PRECONDITION(mHyperTextAcc && mHyperTextNode &&
-                  ((mOffsetNode && aStartHTOffset && aEndHTOffset) ||
-                  (!mOffsetNode && !aStartHTOffset && !aEndHTOffset &&
+  // 3. Offset accessible and result hyper text offsets must not be specified
+  // but include default text attributes flag and attributes list must be
+  // specified in the case of default text attributes.
+  NS_PRECONDITION(mHyperTextAcc &&
+                  ((mOffsetAcc && mOffsetAccIdx != -1 &&
+                    aStartHTOffset && aEndHTOffset) ||
+                  (!mOffsetAcc && mOffsetAccIdx == -1 &&
+                    !aStartHTOffset && !aEndHTOffset &&
                    mIncludeDefAttrs && aAttributes)),
                   "Wrong usage of nsTextAttrsMgr!");
 
+  // Embedded objects are combined into own range with empty attributes set.
+  if (mOffsetAcc && nsAccUtils::IsEmbeddedObject(mOffsetAcc)) {
+    for (PRInt32 childIdx = mOffsetAccIdx - 1; childIdx >= 0; childIdx--) {
+      nsAccessible *currAcc = mHyperTextAcc->GetChildAt(childIdx);
+      if (!nsAccUtils::IsEmbeddedObject(currAcc))
+        break;
+
+      (*aStartHTOffset)--;
+    }
+
+    PRInt32 childCount = mHyperTextAcc->GetChildCount();
+    for (PRInt32 childIdx = mOffsetAccIdx + 1; childIdx < childCount;
+         childIdx++) {
+      nsAccessible *currAcc = mHyperTextAcc->GetChildAt(childIdx);
+      if (!nsAccUtils::IsEmbeddedObject(currAcc))
+        break;
+
+      (*aEndHTOffset)++;
+    }
+
+    return NS_OK;
+  }
+
+  nsIDOMNode *hyperTextNode = mHyperTextAcc->GetDOMNode();
   nsCOMPtr<nsIDOMElement> hyperTextElm =
-    nsCoreUtils::GetDOMElementFor(mHyperTextNode);
+    nsCoreUtils::GetDOMElementFor(mHyperTextAcc->GetDOMNode());
+  nsIFrame *rootFrame = nsCoreUtils::GetFrameFor(hyperTextElm);
+
+  nsIDOMNode *offsetNode = nsnull;
   nsCOMPtr<nsIDOMElement> offsetElm;
-  if (mOffsetNode)
-    offsetElm = nsCoreUtils::GetDOMElementFor(mOffsetNode);
-
-  nsIFrame *rootFrame = nsCoreUtils::GetFrameFor(hyperTextElm);
   nsIFrame *frame = nsnull;
-  if (offsetElm)
+  if (mOffsetAcc) {
+    offsetNode = mOffsetAcc->GetDOMNode();
+    offsetElm = nsCoreUtils::GetDOMElementFor(offsetNode);
     frame = nsCoreUtils::GetFrameFor(offsetElm);
+  }
 
   nsTPtrArray<nsITextAttr> textAttrArray(10);
 
   // "language" text attribute
-  nsLangTextAttr langTextAttr(mHyperTextAcc, mHyperTextNode, mOffsetNode);
+  nsLangTextAttr langTextAttr(mHyperTextAcc, hyperTextNode, offsetNode);
   textAttrArray.AppendElement(static_cast<nsITextAttr*>(&langTextAttr));
 
   // "color" text attribute
   nsCSSTextAttr colorTextAttr(0, hyperTextElm, offsetElm);
   textAttrArray.AppendElement(static_cast<nsITextAttr*>(&colorTextAttr));
 
   // "font-family" text attribute
   nsCSSTextAttr fontFamilyTextAttr(1, hyperTextElm, offsetElm);
@@ -169,243 +197,89 @@ nsTextAttrsMgr::GetAttributes(nsIPersist
       if (textAttr->GetValue(value, mIncludeDefAttrs))
         nsAccUtils::SetAccAttr(aAttributes, textAttr->GetName(), value);
     }
   }
 
   nsresult rv = NS_OK;
 
   // Expose text attributes range where they are applied if applicable.
-  if (mOffsetNode)
+  if (mOffsetAcc)
     rv = GetRange(textAttrArray, aStartHTOffset, aEndHTOffset);
 
   textAttrArray.Clear();
   return rv;
 }
 
 nsresult
 nsTextAttrsMgr::GetRange(const nsTPtrArray<nsITextAttr>& aTextAttrArray,
                          PRInt32 *aStartHTOffset, PRInt32 *aEndHTOffset)
 {
-  nsCOMPtr<nsIDOMElement> rootElm =
-    nsCoreUtils::GetDOMElementFor(mHyperTextNode);
-  NS_ENSURE_STATE(rootElm);
+  PRUint32 attrLen = aTextAttrArray.Length();
 
-  nsCOMPtr<nsIDOMNode> tmpNode(mOffsetNode);
-  nsCOMPtr<nsIDOMNode> currNode(mOffsetNode);
-
-  PRUint32 len = aTextAttrArray.Length();
+  // Navigate backward from anchor accessible to find start offset.
+  for (PRInt32 childIdx = mOffsetAccIdx - 1; childIdx >= 0; childIdx--) {
+    nsAccessible *currAcc = mHyperTextAcc->GetChildAt(childIdx);
 
-  // Navigate backwards and forwards from current node to the root node to
-  // calculate range bounds for the text attribute. Navigation sequence is the
-  // following:
-  // 1. Navigate through the siblings.
-  // 2. If the traversed sibling has children then navigate from its leaf child
-  //    to it through whole tree of the traversed sibling.
-  // 3. Get the parent and cycle algorithm until the root node.
+    // Stop on embedded accessible since embedded accessibles are combined into
+    // own range.
+    if (nsAccUtils::IsEmbeddedObject(currAcc))
+      break;
 
-  // Navigate backwards (find the start offset).
-  while (currNode && currNode != rootElm) {
-    nsCOMPtr<nsIDOMElement> currElm(nsCoreUtils::GetDOMElementFor(currNode));
+    nsCOMPtr<nsIDOMElement> currElm =
+      nsCoreUtils::GetDOMElementFor(currAcc->GetDOMNode());
     NS_ENSURE_STATE(currElm);
 
-    if (currNode != mOffsetNode) {
-      PRBool stop = PR_FALSE;
-      for (PRUint32 idx = 0; idx < len; idx++) {
-        nsITextAttr *textAttr = aTextAttrArray[idx];
-        if (!textAttr->Equal(currElm)) {
-
-          PRInt32 startHTOffset = 0;
-          nsCOMPtr<nsIAccessible> startAcc;
-          nsresult rv = mHyperTextAcc->
-            DOMPointToHypertextOffset(tmpNode, -1, &startHTOffset,
-                                      getter_AddRefs(startAcc));
-          NS_ENSURE_SUCCESS(rv, rv);
-
-          if (!startAcc)
-            startHTOffset = 0;
-
-          if (startHTOffset > *aStartHTOffset)
-            *aStartHTOffset = startHTOffset;
-
-          stop = PR_TRUE;
-          break;
-        }
-      }
-      if (stop)
-        break;
-    }
-
-    currNode->GetPreviousSibling(getter_AddRefs(tmpNode));
-    if (tmpNode) {
-      // Navigate through the subtree of traversed children to calculate
-      // left bound of the range.
-      FindStartOffsetInSubtree(aTextAttrArray, tmpNode, currNode,
-                               aStartHTOffset);
-    }
-
-    currNode->GetParentNode(getter_AddRefs(tmpNode));
-    currNode.swap(tmpNode);
-  }
-
-  // Navigate forwards (find the end offset).
-  PRBool moveIntoSubtree = PR_TRUE;
-  currNode = mOffsetNode;
-
-  while (currNode && currNode != rootElm) {
-    nsCOMPtr<nsIDOMElement> currElm(nsCoreUtils::GetDOMElementFor(currNode));
-    NS_ENSURE_STATE(currElm);
-
-    // Stop new end offset searching if the given text attribute changes its
-    // value.
-    PRBool stop = PR_FALSE;
-    for (PRUint32 idx = 0; idx < len; idx++) {
-      nsITextAttr *textAttr = aTextAttrArray[idx];
+    PRBool offsetFound = PR_FALSE;
+    for (PRUint32 attrIdx = 0; attrIdx < attrLen; attrIdx++) {
+      nsITextAttr *textAttr = aTextAttrArray[attrIdx];
       if (!textAttr->Equal(currElm)) {
-
-        PRInt32 endHTOffset = 0;
-        nsresult rv = mHyperTextAcc->
-          DOMPointToHypertextOffset(currNode, -1, &endHTOffset);
-        NS_ENSURE_SUCCESS(rv, rv);
-
-        if (endHTOffset < *aEndHTOffset)
-          *aEndHTOffset = endHTOffset;
-
-        stop = PR_TRUE;
+        offsetFound = PR_TRUE;
         break;
       }
     }
 
-    if (stop)
+    if (offsetFound)
+      break;
+
+    *(aStartHTOffset) -= nsAccUtils::TextLength(currAcc);
+  }
+
+  // Navigate forward from anchor accessible to find end offset.
+  PRInt32 childLen = mHyperTextAcc->GetChildCount();
+  for (PRInt32 childIdx = mOffsetAccIdx + 1; childIdx < childLen; childIdx++) {
+    nsAccessible *currAcc = mHyperTextAcc->GetChildAt(childIdx);
+    if (nsAccUtils::IsEmbeddedObject(currAcc))
       break;
 
-    if (moveIntoSubtree) {
-      // Navigate through subtree of traversed node. We use 'moveIntoSubtree'
-      // flag to avoid traversing the same subtree twice.
-      currNode->GetFirstChild(getter_AddRefs(tmpNode));
-      if (tmpNode)
-        FindEndOffsetInSubtree(aTextAttrArray, tmpNode, aEndHTOffset);
+    nsCOMPtr<nsIDOMElement> currElm =
+      nsCoreUtils::GetDOMElementFor(currAcc->GetDOMNode());
+    NS_ENSURE_STATE(currElm);
+
+    PRBool offsetFound = PR_FALSE;
+    for (PRUint32 attrIdx = 0; attrIdx < attrLen; attrIdx++) {
+      nsITextAttr *textAttr = aTextAttrArray[attrIdx];
+
+      // Alter the end offset when text attribute changes its value and stop
+      // the search.
+      if (!textAttr->Equal(currElm)) {
+        offsetFound = PR_TRUE;
+        break;
+      }
     }
 
-    currNode->GetNextSibling(getter_AddRefs(tmpNode));
-    moveIntoSubtree = PR_TRUE;
-    if (!tmpNode) {
-      currNode->GetParentNode(getter_AddRefs(tmpNode));
-      moveIntoSubtree = PR_FALSE;
-    }
+    if (offsetFound)
+      break;
 
-    currNode.swap(tmpNode);
+    (*aEndHTOffset) += nsAccUtils::TextLength(currAcc);
   }
 
   return NS_OK;
 }
 
-PRBool
-nsTextAttrsMgr::FindEndOffsetInSubtree(const nsTPtrArray<nsITextAttr>& aTextAttrArray,
-                                       nsIDOMNode *aCurrNode,
-                                       PRInt32 *aHTOffset)
-{
-  if (!aCurrNode)
-    return PR_FALSE;
-
-  nsCOMPtr<nsIDOMElement> currElm(nsCoreUtils::GetDOMElementFor(aCurrNode));
-  if (!currElm)
-    return PR_FALSE;
-
-  // If the given text attribute (pointed by nsTextAttr object) changes its
-  // value on the traversed element then fit the end of range.
-  PRUint32 len = aTextAttrArray.Length();
-  for (PRUint32 idx = 0; idx < len; idx++) {
-    nsITextAttr *textAttr = aTextAttrArray[idx];
-    if (!textAttr->Equal(currElm)) {
-      PRInt32 endHTOffset = 0;
-      nsresult rv = mHyperTextAcc->
-        DOMPointToHypertextOffset(aCurrNode, -1, &endHTOffset);
-      NS_ENSURE_SUCCESS(rv, PR_FALSE);
-
-      if (endHTOffset < *aHTOffset)
-        *aHTOffset = endHTOffset;
-
-      return PR_TRUE;
-    }
-  }
-
-  // Deeply traverse into the tree to fit the end of range.
-  nsCOMPtr<nsIDOMNode> nextNode;
-  aCurrNode->GetFirstChild(getter_AddRefs(nextNode));
-  if (nextNode) {
-    PRBool res = FindEndOffsetInSubtree(aTextAttrArray, nextNode, aHTOffset);
-    if (res)
-      return res;
-  }
-
-  aCurrNode->GetNextSibling(getter_AddRefs(nextNode));
-  if (nextNode) {
-    if (FindEndOffsetInSubtree(aTextAttrArray, nextNode, aHTOffset))
-      return PR_TRUE;
-  }
-
-  return PR_FALSE;
-}
-
-PRBool
-nsTextAttrsMgr::FindStartOffsetInSubtree(const nsTPtrArray<nsITextAttr>& aTextAttrArray,
-                                         nsIDOMNode *aCurrNode,
-                                         nsIDOMNode *aPrevNode,
-                                         PRInt32 *aHTOffset)
-{
-  if (!aCurrNode)
-    return PR_FALSE;
-
-  // Find the closest element back to the traversed element.
-  nsCOMPtr<nsIDOMNode> nextNode;
-  aCurrNode->GetLastChild(getter_AddRefs(nextNode));
-  if (nextNode) {
-    if (FindStartOffsetInSubtree(aTextAttrArray, nextNode, aPrevNode, aHTOffset))
-      return PR_TRUE;
-  }
-
-  nsCOMPtr<nsIDOMElement> currElm(nsCoreUtils::GetDOMElementFor(aCurrNode));
-  if (!currElm)
-    return PR_FALSE;
-
-  // If the given text attribute (pointed by nsTextAttr object) changes its
-  // value on the traversed element then fit the start of range.
-  PRUint32 len = aTextAttrArray.Length();
-  for (PRUint32 idx = 0; idx < len; idx++) {
-    nsITextAttr *textAttr = aTextAttrArray[idx];
-    if (!textAttr->Equal(currElm)) {
-
-      PRInt32 startHTOffset = 0;
-      nsCOMPtr<nsIAccessible> startAcc;
-      nsresult rv = mHyperTextAcc->
-        DOMPointToHypertextOffset(aPrevNode, -1, &startHTOffset,
-                                  getter_AddRefs(startAcc));
-      NS_ENSURE_SUCCESS(rv, PR_FALSE);
-
-      if (!startAcc)
-        startHTOffset = 0;
-
-      if (startHTOffset > *aHTOffset)
-        *aHTOffset = startHTOffset;
-
-      return PR_TRUE;
-    }
-  }
-
-  // Moving backwards to find the start of range.
-  aCurrNode->GetPreviousSibling(getter_AddRefs(nextNode));
-  if (nextNode) {
-    if (FindStartOffsetInSubtree(aTextAttrArray, nextNode, aCurrNode, aHTOffset))
-      return PR_TRUE;
-  }
-
-  return PR_FALSE;
-}
-
 ////////////////////////////////////////////////////////////////////////////////
 // nsLangTextAttr
 
 nsLangTextAttr::nsLangTextAttr(nsHyperTextAccessible *aRootAcc, 
                                nsIDOMNode *aRootNode, nsIDOMNode *aNode) :
   nsTextAttr<nsAutoString>(aNode == nsnull)
 {
   mRootContent = do_QueryInterface(aRootNode);
--- a/accessible/src/base/nsTextAttrs.h
+++ b/accessible/src/base/nsTextAttrs.h
@@ -64,32 +64,32 @@ class nsITextAttr;
  * @note "invalid: spelling" text attrbiute is implemented entirerly in
  *       nsHyperTextAccessible class.
  */
 class nsTextAttrsMgr
 {
 public:
   /**
    * Constructor. If instance of the class is intended to expose default text
-   * attributes then 'aIncludeDefAttrs' and 'oOffsetNode' argument must be
+   * attributes then 'aIncludeDefAttrs' and 'aOffsetNode' argument must be
    * skiped.
    *
    * @param aHyperTextAcc    hyper text accessible text attributes are
    *                         calculated for
    * @param aHyperTextNode   DOM node of the given hyper text accessbile
    * @param aIncludeDefAttrs [optional] indicates whether default text
    *                         attributes should be included into list of exposed
    *                         text attributes.
    * @param oOffsetNode      [optional] DOM node represents hyper text offset
    *                         inside hyper text accessible
    */
   nsTextAttrsMgr(nsHyperTextAccessible *aHyperTextAcc,
-                 nsIDOMNode *aHyperTextNode,
                  PRBool aIncludeDefAttrs = PR_TRUE,
-                 nsIDOMNode *oOffsetNode = nsnull);
+                 nsAccessible *aOffsetAcc = nsnull,
+                 PRInt32 aOffsetAccIdx = -1);
 
   /*
    * Return text attributes and hyper text offsets where these attributes are
    * applied. Offsets are calculated in the case of non default attributes.
    *
    * @note In the case of default attributes pointers on hyper text offsets
    *       must be skiped.
    *
@@ -110,51 +110,23 @@ protected:
    *
    * @param aTextAttrArray  [in] text attributes array
    * @param aStartHTOffset  [in, out] the start offset
    * @param aEndHTOffset    [in, out] the end offset
    */
    nsresult GetRange(const nsTPtrArray<nsITextAttr>& aTextAttrArray,
                      PRInt32 *aStartHTOffset, PRInt32 *aEndHTOffset);
 
-  /*
-   * Find new end offset for text attributes navigating through the tree. New
-   * end offset may be smaller if one of text attributes changes its value
-   * before the given end offset.
-   *
-   * @param  aTextAttrArray  [in] text attributes array
-   * @param  aCurrNode       [in] the first node of the tree
-   * @param  aHTOffset       [in, out] the end offset
-   * @return                 true if the end offset has been changed
-   */
-   PRBool FindEndOffsetInSubtree(const nsTPtrArray<nsITextAttr>& aTextAttrArray,
-                                 nsIDOMNode *aCurrNode, PRInt32 *aHTOffset);
-
-  /*
-   * Find the start offset for text attributes navigating through the tree. New
-   * start offset may be bigger if one of text attributes changes its value
-   * after the given start offset.
-   *
-   * @param  aTextAttrArray  [in] text attributes array
-   * @param  aCurrNode       [in] the node navigating through thee thee is
-   *                         started from
-   * @param  aPrevNode       [in] the previous node placed before the start node
-   * @param  aHTOffset       [in, out] the start offset
-   * @return                 true if the start offset has been changed
-   */
-   PRBool FindStartOffsetInSubtree(const nsTPtrArray<nsITextAttr>& aTextAttrArray,
-                                   nsIDOMNode *aCurrNode, nsIDOMNode *aPrevNode,
-                                   PRInt32 *aHTOffset);
-
 private:
   nsRefPtr<nsHyperTextAccessible> mHyperTextAcc;
-  nsCOMPtr<nsIDOMNode> mHyperTextNode;
 
   PRBool mIncludeDefAttrs;
-  nsCOMPtr<nsIDOMNode> mOffsetNode;
+
+  nsRefPtr<nsAccessible> mOffsetAcc;
+  PRInt32 mOffsetAccIdx;
 };
 
 
 ////////////////////////////////////////////////////////////////////////////////
 // Private implementation details
 
 /**
  * Interface class of text attribute class implementations.
--- a/accessible/src/base/nsTextEquivUtils.cpp
+++ b/accessible/src/base/nsTextEquivUtils.cpp
@@ -136,36 +136,35 @@ nsTextEquivUtils::AppendTextEquivFromCon
 {
   // Prevent recursion which can cause infinite loops.
   if (gInitiatorAcc)
     return NS_OK;
 
   gInitiatorAcc = aInitiatorAcc;
 
   nsCOMPtr<nsIDOMNode> DOMNode(do_QueryInterface(aContent));
-  nsCOMPtr<nsIPresShell> shell = nsCoreUtils::GetPresShellFor(DOMNode);
+  nsIPresShell *shell = nsCoreUtils::GetPresShellFor(DOMNode);
   if (!shell) {
     NS_ASSERTION(PR_TRUE, "There is no presshell!");
     gInitiatorAcc = nsnull;
     return NS_ERROR_UNEXPECTED;
   }
 
   // If the given content is not visible or isn't accessible then go down
   // through the DOM subtree otherwise go down through accessible subtree and
   // calculate the flat string.
   nsIFrame *frame = aContent->GetPrimaryFrame();
   PRBool isVisible = frame && frame->GetStyleVisibility()->IsVisible();
 
   nsresult rv = NS_ERROR_FAILURE;
   PRBool goThroughDOMSubtree = PR_TRUE;
 
   if (isVisible) {
-    nsCOMPtr<nsIAccessible> accessible;
-    GetAccService()->GetAccessibleInShell(DOMNode, shell,
-                                               getter_AddRefs(accessible));
+    nsAccessible *accessible =
+      GetAccService()->GetAccessibleInShell(DOMNode, shell);
     if (accessible) {
       rv = AppendFromAccessible(accessible, aString);
       goThroughDOMSubtree = PR_FALSE;
     }
   }
 
   if (goThroughDOMSubtree)
     rv = AppendFromDOMNode(aContent, aString);
@@ -232,26 +231,24 @@ nsTextEquivUtils::AppendTextEquivFromTex
 // nsTextEquivUtils. Private.
 
 nsCOMPtr<nsIAccessible> nsTextEquivUtils::gInitiatorAcc;
 
 nsresult
 nsTextEquivUtils::AppendFromAccessibleChildren(nsIAccessible *aAccessible,
                                                nsAString *aString)
 {
-  nsCOMPtr<nsIAccessible> accChild, accNextChild;
-  aAccessible->GetFirstChild(getter_AddRefs(accChild));
+  nsresult rv = NS_OK_NO_NAME_CLAUSE_HANDLED;
 
-  nsresult rv = NS_OK_NO_NAME_CLAUSE_HANDLED;
-  while (accChild) {
-    rv = AppendFromAccessible(accChild, aString);
+  nsRefPtr<nsAccessible> accessible(do_QueryObject(aAccessible));
+  PRInt32 childCount = accessible->GetChildCount();
+  for (PRInt32 childIdx = 0; childIdx < childCount; childIdx++) {
+    nsAccessible *child = accessible->GetChildAt(childIdx);
+    rv = AppendFromAccessible(child, aString);
     NS_ENSURE_SUCCESS(rv, rv);
-
-    accChild->GetNextSibling(getter_AddRefs(accNextChild));
-    accChild.swap(accNextChild);
   }
 
   return rv;
 }
 
 nsresult
 nsTextEquivUtils::AppendFromAccessible(nsIAccessible *aAccessible,
                                        nsAString *aString)
--- a/accessible/src/html/nsHTMLImageAccessible.cpp
+++ b/accessible/src/html/nsHTMLImageAccessible.cpp
@@ -180,17 +180,17 @@ nsHTMLImageAccessible::DoAction(PRUint8 
     nsCOMPtr<nsIDOMDocument> domDocument;
     rv = mDOMNode->GetOwnerDocument(getter_AddRefs(domDocument));
     NS_ENSURE_SUCCESS(rv, rv);
     nsCOMPtr<nsIDocument> document(do_QueryInterface(domDocument));
     nsCOMPtr<nsPIDOMWindow> piWindow = document->GetWindow();
     nsCOMPtr<nsIDOMWindowInternal> win(do_QueryInterface(piWindow));
     NS_ENSURE_TRUE(win, NS_ERROR_FAILURE);
     nsCOMPtr<nsIDOMWindow> tmp;
-    return win->Open(longDesc, NS_LITERAL_STRING(""), NS_LITERAL_STRING(""),
+    return win->Open(longDesc, EmptyString(), EmptyString(),
                      getter_AddRefs(tmp));
   }
   return nsLinkableAccessible::DoAction(aIndex);
 }
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsIAccessibleImage
 
--- a/accessible/src/html/nsHTMLSelectAccessible.cpp
+++ b/accessible/src/html/nsHTMLSelectAccessible.cpp
@@ -115,29 +115,29 @@ void nsHTMLSelectableAccessible::iterato
     (*aSelectionCount)++;
 }
 
 void
 nsHTMLSelectableAccessible::iterator::AddAccessibleIfSelected(nsIMutableArray *aSelectedAccessibles, 
                                                               nsPresContext *aContext)
 {
   PRBool isSelected = PR_FALSE;
-  nsRefPtr<nsAccessible> tempAcc;
+  nsAccessible *optionAcc = nsnull;
 
   if (mOption) {
     mOption->GetSelected(&isSelected);
     if (isSelected) {
       nsCOMPtr<nsIDOMNode> optionNode(do_QueryInterface(mOption));
-      tempAcc = GetAccService()->GetAccessibleInWeakShell(optionNode,
-                                                          mWeakShell);
+      optionAcc = GetAccService()->GetAccessibleInWeakShell(optionNode,
+                                                            mWeakShell);
     }
   }
 
-  if (tempAcc)
-    aSelectedAccessibles->AppendElement(static_cast<nsIAccessible*>(tempAcc),
+  if (optionAcc)
+    aSelectedAccessibles->AppendElement(static_cast<nsIAccessible*>(optionAcc),
                                         PR_FALSE);
 }
 
 PRBool
 nsHTMLSelectableAccessible::iterator::GetAccessibleIfSelected(PRInt32 aIndex,
                                                               nsPresContext *aContext, 
                                                               nsIAccessible **aAccessible)
 {
@@ -145,20 +145,19 @@ nsHTMLSelectableAccessible::iterator::Ge
 
   *aAccessible = nsnull;
 
   if (mOption) {
     mOption->GetSelected(&isSelected);
     if (isSelected) {
       if (mSelCount == aIndex) {
         nsCOMPtr<nsIDOMNode> optionNode(do_QueryInterface(mOption));
-        nsRefPtr<nsAccessible> acc =
+        nsAccessible *accessible =
           GetAccService()->GetAccessibleInWeakShell(optionNode, mWeakShell);
-        if (acc)
-          CallQueryInterface(acc, aAccessible);
+        NS_IF_ADDREF(*aAccessible = accessible);
 
         return PR_TRUE;
       }
       mSelCount++;
     }
   }
 
   return PR_FALSE;
@@ -397,21 +396,21 @@ nsHTMLSelectListAccessible::CacheOptSibl
 
     nsCOMPtr<nsIAtom> tag = childContent->Tag();
     if (tag == nsAccessibilityAtoms::option ||
         tag == nsAccessibilityAtoms::optgroup) {
 
       // Get an accessible for option or optgroup and cache it.
       nsCOMPtr<nsIDOMNode> childNode(do_QueryInterface(childContent));
 
-      nsRefPtr<nsAccessible> acc =
+      nsAccessible *accessible =
         GetAccService()->GetAccessibleInWeakShell(childNode, mWeakShell);
-      if (acc) {
-        mChildren.AppendElement(acc);
-        acc->SetParent(this);
+      if (accessible) {
+        mChildren.AppendElement(accessible);
+        accessible->SetParent(this);
       }
 
       // Deep down into optgroup element.
       if (tag == nsAccessibilityAtoms::optgroup)
         CacheOptSiblings(childContent);
     }
   }
 }
@@ -431,17 +430,17 @@ nsHTMLSelectOptionAccessible::
   if (!parentNode)
     return;
 
   // If the parent node is a Combobox, then the option's accessible parent
   // is nsHTMLComboboxListAccessible, not the nsHTMLComboboxAccessible that
   // GetParent would normally return. This is because the 
   // nsHTMLComboboxListAccessible is inserted into the accessible hierarchy
   // where there is no DOM node for it.
-  nsRefPtr<nsAccessible> parentAcc =
+  nsAccessible *parentAcc =
     GetAccService()->GetAccessibleInWeakShell(parentNode, mWeakShell);
   if (!parentAcc)
     return;
 
   if (nsAccUtils::RoleInternal(parentAcc) == nsIAccessibleRole::ROLE_COMBOBOX) {
     PRInt32 childCount = parentAcc->GetChildCount();
     parentAcc = parentAcc->GetChildAt(childCount - 1);
   }
@@ -1004,21 +1003,21 @@ NS_IMETHODIMP nsHTMLComboboxAccessible::
   aDescription.Truncate();
   // First check to see if combo box itself has a description, perhaps through
   // tooltip (title attribute) or via aria-describedby
   nsAccessible::GetDescription(aDescription);
   if (!aDescription.IsEmpty()) {
     return NS_OK;
   }
   // Use description of currently focused option
-  nsRefPtr<nsAccessible> optionAcc = GetFocusedOptionAccessible();
-  return optionAcc ? optionAcc->GetDescription(aDescription) : NS_OK;
+  nsAccessible *option = GetFocusedOptionAccessible();
+  return option ? option->GetDescription(aDescription) : NS_OK;
 }
 
-already_AddRefed<nsAccessible>
+nsAccessible *
 nsHTMLComboboxAccessible::GetFocusedOptionAccessible()
 {
   if (IsDefunct())
     return nsnull;
 
   nsCOMPtr<nsIDOMNode> focusedOptionNode;
   nsHTMLSelectOptionAccessible::
     GetFocusedOptionNode(mDOMNode, getter_AddRefs(focusedOptionNode));
@@ -1033,18 +1032,18 @@ nsHTMLComboboxAccessible::GetFocusedOpti
 /**
   * MSAA/ATK accessible value != HTML value, especially not in combo boxes.
   * Our accessible value is the text label for of our ( first ) selected child.
   * The easiest way to get this is from the first child which is the readonly textfield.
   */
 NS_IMETHODIMP nsHTMLComboboxAccessible::GetValue(nsAString& aValue)
 {
   // Use accessible name of currently focused option.
-  nsRefPtr<nsAccessible> optionAcc = GetFocusedOptionAccessible();
-  return optionAcc ? optionAcc->GetName(aValue) : NS_OK;
+  nsAccessible *option = GetFocusedOptionAccessible();
+  return option ? option->GetName(aValue) : NS_OK;
 }
 
 /** Just one action ( click ). */
 NS_IMETHODIMP nsHTMLComboboxAccessible::GetNumActions(PRUint8 *aNumActions)
 {
   *aNumActions = 1;
   return NS_OK;
 }
--- a/accessible/src/html/nsHTMLSelectAccessible.h
+++ b/accessible/src/html/nsHTMLSelectAccessible.h
@@ -239,17 +239,17 @@ protected:
   // nsAccessible
   virtual void CacheChildren();
 
   // nsHTMLComboboxAccessible
 
   /**
    * Return focused option accessible.
    */
-  already_AddRefed<nsAccessible> GetFocusedOptionAccessible();
+  nsAccessible *GetFocusedOptionAccessible();
 
 private:
   nsRefPtr<nsHTMLComboboxListAccessible> mListAccessible;
 };
 
 /*
  * A class that represents the window that lives to the right
  * of the drop down button inside the Select. This is the window
--- a/accessible/src/html/nsHTMLTableAccessible.cpp
+++ b/accessible/src/html/nsHTMLTableAccessible.cpp
@@ -330,25 +330,25 @@ nsHTMLTableCellAccessible::GetHeaderCell
     NS_ENSURE_SUCCESS(rv, rv);
 
     PRUint32 count = 0;
     rv = headerCellElms->GetLength(&count);
     if (NS_SUCCEEDED(rv) && count > 0) {
       nsCOMPtr<nsIDOMNode> headerCellNode;
       for (PRUint32 idx = 0; idx < count; idx++) {
         headerCellNode = do_QueryElementAt(headerCellElms, idx, &rv);
-        nsRefPtr<nsAccessible> headerCell =
+        nsAccessible *headerCell =
           GetAccService()->GetAccessibleInWeakShell(headerCellNode, mWeakShell);
 
         if (headerCell &&
             (aRowOrColumnHeaderCell == nsAccUtils::eRowHeaderCells &&
              nsAccUtils::Role(headerCell) == nsIAccessibleRole::ROLE_ROWHEADER ||
              aRowOrColumnHeaderCell == nsAccUtils::eColumnHeaderCells &&
              nsAccUtils::Role(headerCell) == nsIAccessibleRole::ROLE_COLUMNHEADER))
-          headerCells->AppendElement(static_cast<nsIAccessible*>(headerCell.get()),
+          headerCells->AppendElement(static_cast<nsIAccessible*>(headerCell),
                                      PR_FALSE);
       }
     }
 
     NS_ADDREF(*aHeaderCells = headerCells);
     return NS_OK;
   }
 
@@ -733,19 +733,19 @@ nsHTMLTableAccessible::GetSelectedCells(
                                       *getter_AddRefs(cellElement),
                                       startRowIndex, startColIndex,
                                       rowSpan, colSpan,
                                       actualRowSpan, actualColSpan,
                                       isSelected);
 
       if (NS_SUCCEEDED(rv) && startRowIndex == rowIndex &&
           startColIndex == columnIndex && isSelected) {
-        nsRefPtr<nsAccessible> cell =
+        nsAccessible *cell =
           GetAccService()->GetAccessibleInWeakShell(cellElement, mWeakShell);
-        selCells->AppendElement(static_cast<nsIAccessible*>(cell.get()), PR_FALSE);
+        selCells->AppendElement(static_cast<nsIAccessible*>(cell), PR_FALSE);
       }
     }
   }
 
   NS_ADDREF(*aCells = selCells);
   return NS_OK;
 }
 
@@ -906,20 +906,20 @@ nsHTMLTableAccessible::GetSelectedRowInd
 NS_IMETHODIMP
 nsHTMLTableAccessible::GetCellAt(PRInt32 aRow, PRInt32 aColumn,
                                  nsIAccessible **aTableCellAccessible)
 {
   nsCOMPtr<nsIDOMElement> cellElement;
   nsresult rv = GetCellAt(aRow, aColumn, *getter_AddRefs(cellElement));
   NS_ENSURE_SUCCESS(rv, rv);
 
-  nsRefPtr<nsAccessible> cellAcc =
+  nsAccessible *cell =
     GetAccService()->GetAccessibleInWeakShell(cellElement, mWeakShell);
-  if (cellAcc)
-    CallQueryInterface(cellAcc, aTableCellAccessible);
+  if (cell)
+    CallQueryInterface(cell, aTableCellAccessible);
 
   return NS_OK;
 }
 
 NS_IMETHODIMP
 nsHTMLTableAccessible::GetCellIndexAt(PRInt32 aRow, PRInt32 aColumn,
                                       PRInt32 *aIndex)
 {
--- a/accessible/src/html/nsHyperTextAccessible.cpp
+++ b/accessible/src/html/nsHyperTextAccessible.cpp
@@ -272,18 +272,18 @@ nsIntRect nsHyperTextAccessible::GetBoun
 
 /*
  * Gets the specified text.
  */
 nsIFrame*
 nsHyperTextAccessible::GetPosAndText(PRInt32& aStartOffset, PRInt32& aEndOffset,
                                      nsAString *aText, nsIFrame **aEndFrame,
                                      nsIntRect *aBoundsRect,
-                                     nsIAccessible **aStartAcc,
-                                     nsIAccessible **aEndAcc)
+                                     nsAccessible **aStartAcc,
+                                     nsAccessible **aEndAcc)
 {
   if (aStartOffset == nsIAccessibleText::TEXT_OFFSET_END_OF_TEXT) {
     GetCharacterCount(&aStartOffset);
   }
   if (aStartOffset == nsIAccessibleText::TEXT_OFFSET_CARET) {
     GetCaretOffset(&aStartOffset);
   }
   if (aEndOffset == nsIAccessibleText::TEXT_OFFSET_END_OF_TEXT) {
@@ -518,98 +518,94 @@ NS_IMETHODIMP nsHyperTextAccessible::Get
 
   if (text.IsEmpty()) {
     return NS_ERROR_FAILURE;
   }
   *aCharacter = text.First();
   return NS_OK;
 }
 
-nsresult nsHyperTextAccessible::DOMPointToHypertextOffset(nsIDOMNode* aNode, PRInt32 aNodeOffset,
-                                                          PRInt32* aHyperTextOffset,
-                                                          nsIAccessible **aFinalAccessible,
-                                                          PRBool aIsEndOffset)
+nsAccessible*
+nsHyperTextAccessible::DOMPointToHypertextOffset(nsIDOMNode *aNode,
+                                                 PRInt32 aNodeOffset,
+                                                 PRInt32 *aHyperTextOffset,
+                                                 PRBool aIsEndOffset)
 {
-  // Turn a DOM Node and offset into an offset into this hypertext.
-  // On failure, return null. On success, return the DOM node which contains the offset.
-  NS_ENSURE_ARG_POINTER(aHyperTextOffset);
+  if (!aHyperTextOffset)
+    return nsnull;
   *aHyperTextOffset = 0;
 
-  if (!aNode) {
-    return NS_ERROR_FAILURE;
-  }
-  if (aFinalAccessible) {
-    *aFinalAccessible = nsnull;
-  }
+  if (!aNode)
+    return nsnull;
 
   PRUint32 addTextOffset = 0;
   nsCOMPtr<nsIDOMNode> findNode;
 
   unsigned short nodeType;
   aNode->GetNodeType(&nodeType);
   if (aNodeOffset == -1) {
     findNode = aNode;
   }
   else if (nodeType == nsIDOMNode::TEXT_NODE) {
     // For text nodes, aNodeOffset comes in as a character offset
     // Text offset will be added at the end, if we find the offset in this hypertext
     // We want the "skipped" offset into the text (rendered text without the extra whitespace)
     nsCOMPtr<nsIContent> content = do_QueryInterface(aNode);
     NS_ASSERTION(content, "No nsIContent for dom node");
     nsIFrame *frame = content->GetPrimaryFrame();
-    NS_ENSURE_TRUE(frame, NS_ERROR_FAILURE);
+    NS_ENSURE_TRUE(frame, nsnull);
     nsresult rv = ContentToRenderedOffset(frame, aNodeOffset, &addTextOffset);
-    NS_ENSURE_SUCCESS(rv, rv);
+    NS_ENSURE_SUCCESS(rv, nsnull);
     // Get the child node and 
     findNode = aNode;
   }
   else {
     // For non-text nodes, aNodeOffset comes in as a child node index
     nsCOMPtr<nsIContent> parentContent(do_QueryInterface(aNode));
     // Should not happen, but better to protect against crash if doc node is somehow passed in
-    NS_ENSURE_TRUE(parentContent, NS_ERROR_FAILURE);
+    NS_ENSURE_TRUE(parentContent, nsnull);
     // findNode could be null if aNodeOffset == # of child nodes, which means one of two things:
     // 1) we're at the end of the children, keep findNode = null, so that we get the last possible offset
     // 2) there are no children and the passed-in node is mDOMNode, which means we're an aempty nsIAccessibleText
     // 3) there are no children, and the passed-in node is not mDOMNode -- use parentContent for the node to find
      
     findNode = do_QueryInterface(parentContent->GetChildAt(aNodeOffset));
     if (!findNode && !aNodeOffset) {
       if (SameCOMIdentity(parentContent, mDOMNode)) {
         // There are no children, which means this is an empty nsIAccessibleText, in which
         // case we can only be at hypertext offset 0
         *aHyperTextOffset = 0;
-        return NS_OK;
+        return nsnull;
       }
       findNode = do_QueryInterface(parentContent); // Case #2: there are no children
     }
   }
 
   // Get accessible for this findNode, or if that node isn't accessible, use the
   // accessible for the next DOM node which has one (based on forward depth first search)
-  nsRefPtr<nsAccessible> descendantAcc;
+  nsAccessible *descendantAcc = nsnull;
   if (findNode) {
     nsCOMPtr<nsIContent> findContent = do_QueryInterface(findNode);
     if (findContent->IsHTML() && 
         findContent->NodeInfo()->Equals(nsAccessibilityAtoms::br) &&
         findContent->AttrValueIs(kNameSpaceID_None,
                                  nsAccessibilityAtoms::mozeditorbogusnode,
                                  nsAccessibilityAtoms::_true,
                                  eIgnoreCase)) {
       // This <br> is the hacky "bogus node" used when there is no text in a control
       *aHyperTextOffset = 0;
-      return NS_OK;
+      return nsnull;
     }
     descendantAcc = GetFirstAvailableAccessible(findNode);
   }
 
   // From the descendant, go up and get the immediate child of this hypertext
-  nsRefPtr<nsAccessible> childAccAtOffset;
+  nsAccessible *childAccAtOffset = nsnull;
   while (descendantAcc) {
-    nsRefPtr<nsAccessible> parentAcc = descendantAcc->GetParent();
+    nsAccessible *parentAcc = descendantAcc->GetParent();
     if (parentAcc == this) {
       childAccAtOffset = descendantAcc;
       break;
     }
 
     // This offset no longer applies because the passed-in text object is not a child
     // of the hypertext. This happens when there are nested hypertexts, e.g.
     // <div>abc<h1>def</h1>ghi</div>
@@ -622,54 +618,51 @@ nsresult nsHyperTextAccessible::DOMPoint
     // before the embedded object char if we end at the very beginning of the child.
     addTextOffset = addTextOffset > 0;
     }
     else {
       // Start offset, inclusive
       // Make sure the offset lands on the embedded object character in order to indicate
       // the true inner offset is inside the subtree for that link
       addTextOffset =
-        (nsAccUtils::TextLength(descendantAcc) == static_cast<PRInt32>(addTextOffset)) ? 1 : 0;
+        (nsAccUtils::TextLength(descendantAcc) == addTextOffset) ? 1 : 0;
     }
 
-    descendantAcc.swap(parentAcc);
+    descendantAcc = parentAcc;
   }
 
   // Loop through, adding offsets until we reach childAccessible
   // If childAccessible is null we will end up adding up the entire length of
   // the hypertext, which is good -- it just means our offset node
   // came after the last accessible child's node
   PRInt32 childCount = GetChildCount();
 
   PRInt32 childIdx = 0;
   nsAccessible *childAcc = nsnull;
   for (; childIdx < childCount; childIdx++) {
     childAcc = mChildren[childIdx];
     if (childAcc == childAccAtOffset)
       break;
 
-    PRInt32 textLength = nsAccUtils::TextLength(childAcc);
-    NS_ENSURE_TRUE(textLength >= 0, nsnull);
-    *aHyperTextOffset += textLength;
+    *aHyperTextOffset += nsAccUtils::TextLength(childAcc);
   }
 
   if (childIdx < childCount) {
     *aHyperTextOffset += addTextOffset;
     NS_ASSERTION(childAcc == childAccAtOffset,
                  "These should be equal whenever we exit loop and childAcc != nsnull");
 
-    if (aFinalAccessible &&
-        (childIdx < childCount - 1 ||
-         static_cast<PRInt32>(addTextOffset) < nsAccUtils::TextLength(childAccAtOffset))) {  
+    if (childIdx < childCount - 1 ||
+        addTextOffset < nsAccUtils::TextLength(childAccAtOffset)) {
       // If not at end of last text node, we will return the accessible we were in
-      NS_ADDREF(*aFinalAccessible = childAccAtOffset);
+      return childAccAtOffset;
     }
   }
 
-  return NS_OK;
+  return nsnull;
 }
 
 nsresult
 nsHyperTextAccessible::HypertextOffsetToDOMPoint(PRInt32 aHTOffset,
                                                  nsIDOMNode **aNode,
                                                  PRInt32 *aOffset)
 {
   nsCOMPtr<nsIDOMNode> endNode;
@@ -718,17 +711,17 @@ nsHyperTextAccessible::HypertextOffsetsT
           NS_ADDREF(*aEndNode = editorRoot);
 
           return NS_OK;
         }
       }
     }
   }
 
-  nsCOMPtr<nsIAccessible> startAcc, endAcc;
+  nsRefPtr<nsAccessible> startAcc, endAcc;
   PRInt32 startOffset = aStartHTOffset, endOffset = aEndHTOffset;
   nsIFrame *startFrame = nsnull, *endFrame = nsnull;
 
   startFrame = GetPosAndText(startOffset, endOffset, nsnull, &endFrame, nsnull,
                              getter_AddRefs(startAcc), getter_AddRefs(endAcc));
   if (!startAcc || !endAcc)
     return NS_ERROR_FAILURE;
 
@@ -811,23 +804,21 @@ nsHyperTextAccessible::GetRelativeOffset
     }
   }
 
   // Turn the resulting node and offset into a hyperTextOffset
   PRInt32 hyperTextOffset;
   nsCOMPtr<nsIDOMNode> resultNode = do_QueryInterface(pos.mResultContent);
   NS_ENSURE_TRUE(resultNode, -1);
 
-  nsCOMPtr<nsIAccessible> finalAccessible;
-  rv = DOMPointToHypertextOffset(resultNode, pos.mContentOffset, &hyperTextOffset,
-                                 getter_AddRefs(finalAccessible),
-                                 aDirection == eDirNext);
-  // If finalAccessible == nsnull, then DOMPointToHypertextOffset() searched through the hypertext
-  // children without finding the node/offset position
-  NS_ENSURE_SUCCESS(rv, -1);
+  // If finalAccessible is nsnull, then DOMPointToHypertextOffset() searched
+  // through the hypertext children without finding the node/offset position.
+  nsAccessible *finalAccessible =
+    DOMPointToHypertextOffset(resultNode, pos.mContentOffset, &hyperTextOffset,
+                              aDirection == eDirNext);
 
   if (!finalAccessible && aDirection == eDirPrevious) {
     // If we reached the end during search, this means we didn't find the DOM point
     // and we're actually at the start of the paragraph
     hyperTextOffset = 0;
   }  
   else if (aAmount == eSelectBeginLine) {
     nsAccessible *firstChild = mChildren.SafeElementAt(0, nsnull);
@@ -960,17 +951,17 @@ nsresult nsHyperTextAccessible::GetTextH
     default:  // Note, sentence support is deprecated and falls through to here
       return NS_ERROR_INVALID_ARG;
   }
 
   PRInt32 startOffset = aOffset + (aBoundaryType == BOUNDARY_LINE_END);  // Avoid getting the previous line
   PRInt32 endOffset = startOffset;
 
   // Convert offsets to frame-relative
-  nsCOMPtr<nsIAccessible> startAcc;
+  nsRefPtr<nsAccessible> startAcc;
   nsIFrame *startFrame = GetPosAndText(startOffset, endOffset, nsnull, nsnull,
                                        nsnull, getter_AddRefs(startAcc));
 
   if (!startFrame) {
     PRInt32 textLength;
     GetCharacterCount(&textLength);
     if (aBoundaryType == BOUNDARY_LINE_START && aOffset > 0 && aOffset == textLength) {
       // Asking for start of line, while on last character
@@ -1002,21 +993,21 @@ nsresult nsHyperTextAccessible::GetTextH
     NS_ENSURE_TRUE(finalStartOffset >= 0, NS_ERROR_FAILURE);
   }
 
   if (aType == eGetBefore) {
     endOffset = aOffset;
   }
   else {
     // Start moving forward from the start so that we don't get 
-    // 2 words/lines if the offset occured on whitespace boundary
+    // 2 words/lines if the offset occurred on whitespace boundary
     // Careful, startOffset and endOffset are passed by reference to GetPosAndText() and changed
     // For BOUNDARY_LINE_END, make sure we start of this line
     startOffset = endOffset = finalStartOffset + (aBoundaryType == BOUNDARY_LINE_END);
-    nsCOMPtr<nsIAccessible> endAcc;
+    nsRefPtr<nsAccessible> endAcc;
     nsIFrame *endFrame = GetPosAndText(startOffset, endOffset, nsnull, nsnull,
                                        nsnull, getter_AddRefs(endAcc));
     if (nsAccUtils::Role(endAcc) == nsIAccessibleRole::ROLE_STATICTEXT) {
       // Static text like list bullets will ruin our forward calculation,
       // since the caret cannot be in the static text. Start just after the static text.
       startOffset = endOffset = finalStartOffset +
                                 (aBoundaryType == BOUNDARY_LINE_END) +
                                 nsAccUtils::TextLength(endAcc);
@@ -1086,86 +1077,103 @@ NS_IMETHODIMP nsHyperTextAccessible::Get
 //                                      out long rangeEndOffset);
 NS_IMETHODIMP
 nsHyperTextAccessible::GetTextAttributes(PRBool aIncludeDefAttrs,
                                          PRInt32 aOffset,
                                          PRInt32 *aStartOffset,
                                          PRInt32 *aEndOffset,
                                          nsIPersistentProperties **aAttributes)
 {
-  // 1. First we get spell check, then language, then the set of CSS-based
-  //    attributes.
+  // 1. Get each attribute and its ranges one after another.
   // 2. As we get each new attribute, we pass the current start and end offsets
   //    as in/out parameters. In other words, as attributes are collected,
   //    the attribute range itself can only stay the same or get smaller.
-  //
-  // Example:
-  //  Current: range 5-10
-  //  Adding:  range 7-12
-  //  Result:  range 7-10
 
   NS_ENSURE_ARG_POINTER(aStartOffset);
   *aStartOffset = 0;
 
   NS_ENSURE_ARG_POINTER(aEndOffset);
-  nsresult rv = GetCharacterCount(aEndOffset);
-  NS_ENSURE_SUCCESS(rv, rv);
+  *aEndOffset = 0;
+
+  if (IsDefunct())
+    return NS_ERROR_FAILURE;
 
   if (aAttributes) {
     *aAttributes = nsnull;
 
     nsCOMPtr<nsIPersistentProperties> attributes =
       do_CreateInstance(NS_PERSISTENTPROPERTIES_CONTRACTID);
     NS_ENSURE_TRUE(attributes, NS_ERROR_OUT_OF_MEMORY);
 
     NS_ADDREF(*aAttributes = attributes);
   }
 
-  if (!mDOMNode)
-    return NS_ERROR_FAILURE;
+  PRInt32 offsetAccIdx = -1;
+  PRInt32 startOffset = 0, endOffset = 0;
+  nsAccessible *offsetAcc = GetAccessibleAtOffset(aOffset, &offsetAccIdx,
+                                                  &startOffset, &endOffset);
+  if (!offsetAcc) {
+    // Offset 0 is correct offset when accessible has empty text. Include
+    // default attributes if they were requested, otherwise return empty set.
+    if (aOffset == 0) {
+      if (aIncludeDefAttrs) {
+        nsTextAttrsMgr textAttrsMgr(this, PR_TRUE, nsnull, -1);
+        return textAttrsMgr.GetAttributes(*aAttributes);
+      }
+      return NS_OK;
+    }
+    return NS_ERROR_INVALID_ARG;
+  }
 
-  nsCOMPtr<nsIDOMNode> node;
-  PRInt32 nodeOffset = 0;
-  rv = HypertextOffsetToDOMPoint(aOffset, getter_AddRefs(node), &nodeOffset);
+  PRInt32 offsetInAcc = aOffset - startOffset;
+
+  nsTextAttrsMgr textAttrsMgr(this, aIncludeDefAttrs, offsetAcc, offsetAccIdx);
+  nsresult rv = textAttrsMgr.GetAttributes(*aAttributes, &startOffset,
+                                           &endOffset);
   NS_ENSURE_SUCCESS(rv, rv);
 
-  // Set 'misspelled' text attribute.
-  rv = GetSpellTextAttribute(node, nodeOffset, aStartOffset, aEndOffset,
-                             aAttributes ? *aAttributes : nsnull);
-  NS_ENSURE_SUCCESS(rv, rv);
+  // Compute spelling attributes on text accessible only.
+  nsIFrame *offsetFrame = offsetAcc->GetFrame();
+  if (offsetFrame && offsetFrame->GetType() == nsAccessibilityAtoms::textFrame) {
+    nsCOMPtr<nsIDOMNode> node = offsetAcc->GetDOMNode();
+
+    PRInt32 nodeOffset = 0;
+    nsresult rv = RenderedToContentOffset(offsetFrame, offsetInAcc,
+                                          &nodeOffset);
+    NS_ENSURE_SUCCESS(rv, rv);
 
-  nsCOMPtr<nsIContent> content(do_QueryInterface(node));
-  if (content && content->IsElement())
-    node = do_QueryInterface(content->GetChildAt(nodeOffset));
+    // Set 'misspelled' text attribute.
+    rv = GetSpellTextAttribute(node, nodeOffset, &startOffset, &endOffset,
+                               aAttributes ? *aAttributes : nsnull);
+    NS_ENSURE_SUCCESS(rv, rv);
+  }
 
-  if (!node)
-    return NS_OK;
-
-  nsTextAttrsMgr textAttrsMgr(this, mDOMNode, aIncludeDefAttrs, node);
-  return textAttrsMgr.GetAttributes(*aAttributes, aStartOffset, aEndOffset);
+  *aStartOffset = startOffset;
+  *aEndOffset = endOffset;
+  return NS_OK;
 }
 
 // nsIPersistentProperties
 // nsIAccessibleText::defaultTextAttributes
 NS_IMETHODIMP
 nsHyperTextAccessible::GetDefaultTextAttributes(nsIPersistentProperties **aAttributes)
 {
   NS_ENSURE_ARG_POINTER(aAttributes);
   *aAttributes = nsnull;
 
+  if (IsDefunct())
+    return NS_ERROR_FAILURE;
+
   nsCOMPtr<nsIPersistentProperties> attributes =