Merged to actionmonkey tip... boy was that painful!
authorbenjamin@smedbergs.us
Fri, 30 Nov 2007 12:35:55 -0500
changeset 60 0aa235cc1bf230352fd1b32efd23146ab61d97e0
parent 59 d364a33213b70a696a116acd20d51257e481895c
child 61 e90b21f493041b0b2202c588c76386d386443b94
push id1
push userbsmedberg@mozilla.com
push dateTue, 15 Apr 2008 21:51:22 +0000
Merged to actionmonkey tip... boy was that painful!
64bit
activex-oji.patch
comarray.patch
comptr-rewrite.patch
dont-delete-gcobjects
fix-garburator.patch
gc-hashtables.patch
gcobject-fixup.patch
gcobject-nodelete.patch
gcobject-rdf.patch
gcobject-tiergecko.patch
gcobject-tiertoolkit.patch
layout-bases.patch
necko-cookie.patch
prerewrite_fixes.patch
remove-cyclec.patch
root-threads
series
unbraced-if-fixes.patch
windows-warning.patch
xpcomgcbase.patch
xpconnect-allocations
--- a/64bit
+++ b/64bit
@@ -1,24 +1,12 @@
 diff --git a/configure.in b/configure.in
 --- a/configure.in
 +++ b/configure.in
-@@ -7923,7 +7923,7 @@ unset CONFIG_FILES
+@@ -7909,7 +7909,7 @@ unset CONFIG_FILES
  
  export PYTHON
  
 -ac_configure_args="$_SUBDIR_CONFIG_ARGS --with-mmgc-shared"
 +ac_configure_args="$_SUBDIR_CONFIG_ARGS --with-mmgc-shared --without-tamarin "
  AC_OUTPUT_SUBDIRS(js/tamarin)
  ac_configure_args="$_SUBDIR_CONFIG_ARGS"
  
-diff --git a/js/src/jsatom.h b/js/src/jsatom.h
---- a/js/src/jsatom.h
-+++ b/js/src/jsatom.h
-@@ -74,7 +74,7 @@ JS_STATIC_ASSERT(sizeof(JSAtom *) == JS_
- #if JS_BYTES_PER_WORD == 4
- # define ATOM_HASH(atom)          ((JSHashNumber)(atom) >> 2)
- #elif JS_BYTES_PER_WORD == 8
--# define ATOM_HASH(atom)          (((JSHashNumber)(atom) >> 3) ^              \
-+# define ATOM_HASH(atom)          (((JSHashNumber)(jsuword)(atom) >> 3) ^ \
-                                    (JSHashNumber)((jsuword)(atom) >> 32))
- #else
- # error "Unsupported configuration"
--- a/activex-oji.patch
+++ b/activex-oji.patch
@@ -1,64 +0,0 @@
-diff -r c492b3713f43 embedding/browser/activex/src/plugin/npwin.cpp
---- a/embedding/browser/activex/src/plugin/npwin.cpp	Fri Sep 28 14:04:09 2007 -0400
-+++ b/embedding/browser/activex/src/plugin/npwin.cpp	Fri Sep 28 15:10:41 2007 -0400
-@@ -22,25 +22,6 @@
- 
- //\\// GLOBAL DATA
- NPNetscapeFuncs* g_pNavigatorFuncs = 0;
--JRIGlobalRef Private_GetJavaClass(void);
--
--//\\//\\//\\//\\//\\//\\//\\//\\//\\//\\//\\//\\//\\//\\//\\//\\//\\//\\//\\.
--////\\//\\//\\//\\//\\//\\//\\//\\//\\//\\//\\//\\//\\//\\//\\//\\//\\//\\//.
--// Private_GetJavaClass (global function)
--//
--//	Given a Java class reference (thru NPP_GetJavaClass) inform JRT
--//	of this class existence
--//
--JRIGlobalRef
--Private_GetJavaClass(void)
--{
--    jref clazz = NPP_GetJavaClass();
--    if (clazz) {
--		JRIEnv* env = NPN_GetJavaEnv();
--		return JRI_NewGlobalRef(env, clazz);
--    }
--    return NULL;
--}
- 
- //\\//\\//\\//\\//\\//\\//\\//\\//\\//\\//\\//\\//\\//\\//\\//\\//\\//\\//\\.
- ////\\//\\//\\//\\//\\//\\//\\//\\//\\//\\//\\//\\//\\//\\//\\//\\//\\//\\//.
-@@ -121,14 +102,6 @@ NP_Initialize(NPNetscapeFuncs* pFuncs)
- 		g_pluginFuncs->urlnotify = NPP_URLNotify;
- 	}
- 	
--#ifdef WIN32 // An ugly hack, because Win16 lags behind in Java
--	if( navMinorVers >= NPVERS_HAS_LIVECONNECT ) {
--#else
--	if( navMinorVers >= NPVERS_WIN16_HAS_LIVECONNECT )
--#endif // WIN32
--		g_pluginFuncs->javaClass = Private_GetJavaClass();
--	}
--
- 	// NPP_Initialize is a standard (cross-platform) initialize function.
-     return NPP_Initialize();
- }
-@@ -313,17 +286,7 @@ void NPN_ReloadPlugins(NPBool reloadPage
-     g_pNavigatorFuncs->reloadplugins(reloadPages);
- }
- 
--JRIEnv* NPN_GetJavaEnv(void)
--{
--	return g_pNavigatorFuncs->getJavaEnv();
--}
--
--jref NPN_GetJavaPeer(NPP instance)
--{
--	return g_pNavigatorFuncs->getJavaPeer(instance);
--}
--
- NPError NPN_GetValue(NPP instance, NPNVariable variable, void *result)
- {
-     return g_pNavigatorFuncs->getvalue(instance, variable, result);
--}
-\ No newline at end of file
-+}
--- a/comarray.patch
+++ b/comarray.patch
@@ -30,17 +30,17 @@ diff --git a/content/base/public/nsConte
 +++ b/content/base/public/nsContentUtils.h
 @@ -89,7 +89,6 @@ class nsIScriptContext;
  class nsIScriptContext;
  template<class E> class nsCOMArray;
  class nsIPref;
 -class nsVoidArray;
  struct JSRuntime;
  class nsICaseConversion;
- #ifdef MOZ_XTF
+ class nsIWidget;
 diff --git a/content/base/public/nsIContent.h b/content/base/public/nsIContent.h
 --- a/content/base/public/nsIContent.h
 +++ b/content/base/public/nsIContent.h
 @@ -48,7 +48,6 @@ class nsIAtom;
  class nsIAtom;
  class nsIDocument;
  class nsPresContext;
 -class nsVoidArray;
@@ -190,17 +190,17 @@ diff --git a/rdf/datasource/public/nsIRD
 -
 -
  #define NS_IRDFFILESYSTEMDATAOURCE_IID \
  { 0x1222e6f0, 0xa5e3, 0x11d2, { 0x8b, 0x7c, 0x00, 0x80, 0x5f, 0x8a, 0x7d, 0xb5 } }
  
 diff --git a/widget/src/windows/nsDataObj.h b/widget/src/windows/nsDataObj.h
 --- a/widget/src/windows/nsDataObj.h
 +++ b/widget/src/windows/nsDataObj.h
-@@ -127,7 +127,6 @@ typedef struct _FILEGROUPDESCRIPTORW {
+@@ -128,7 +128,6 @@ typedef struct _FILEGROUPDESCRIPTORW {
  # endif /*__W32API_MAJOR_VERSION*/
  #endif /*__MINGW32__*/
  
 -class nsVoidArray;
  class CEnumFormatEtc;
  class nsITransferable;
  
 diff --git a/widget/src/xpwidgets/nsTransferable.h b/widget/src/xpwidgets/nsTransferable.h
@@ -226,39 +226,171 @@ diff --git a/xpcom/base/Makefile.in b/xp
 @@ -53,7 +53,6 @@ REQUIRES	= string \
  		  $(NULL)
  
  CPPSRCS		= \
 -		nsAllocator.cpp \
  		nsVersionComparatorImpl.cpp \
  		nsConsoleMessage.cpp \
  		nsConsoleService.cpp \
+diff --git a/xpcom/base/nsAllocator.cpp b/xpcom/base/nsAllocator.cpp
+deleted file mode 100644
+--- a/xpcom/base/nsAllocator.cpp
++++ /dev/null
+@@ -1,41 +0,0 @@
+-/* -*- Mode: C++; tab-width: 4; indent-tabs-mode: nil; c-basic-offset: 4 -*- */
+-/* ***** BEGIN LICENSE BLOCK *****
+- * Version: MPL 1.1/GPL 2.0/LGPL 2.1
+- *
+- * The contents of this file are subject to the Mozilla Public License Version
+- * 1.1 (the "License"); you may not use this file except in compliance with
+- * the License. You may obtain a copy of the License at
+- * http://www.mozilla.org/MPL/
+- *
+- * Software distributed under the License is distributed on an "AS IS" basis,
+- * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
+- * for the specific language governing rights and limitations under the
+- * License.
+- *
+- * The Original Code is mozilla.org code.
+- *
+- * The Initial Developer of the Original Code is
+- * Netscape Communications Corporation.
+- * Portions created by the Initial Developer are Copyright (C) 1998
+- * the Initial Developer. All Rights Reserved.
+- *
+- * Contributor(s):
+- *   Pierre Phaneuf <pp@ludusdesign.com>
+- *
+- * Alternatively, the contents of this file may be used under the terms of
+- * either of the GNU General Public License Version 2 or later (the "GPL"),
+- * or the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
+- * in which case the provisions of the GPL or the LGPL are applicable instead
+- * of those above. If you wish to allow use of your version of this file only
+- * under the terms of either the GPL or the LGPL, and not to allow others to
+- * use your version of this file under the terms of the MPL, indicate your
+- * decision by deleting the provisions above and replace them with the notice
+- * and other provisions required by the GPL or the LGPL. If you do not delete
+- * the provisions above, a recipient may use your version of this file under
+- * the terms of any one of the MPL, the GPL or the LGPL.
+- *
+- * ***** END LICENSE BLOCK ***** */
+-
+-////////////////////////////////////////////////////////////////////////////////
+-// obsolete
+-////////////////////////////////////////////////////////////////////////////////
+diff --git a/xpcom/base/nsAllocator.h b/xpcom/base/nsAllocator.h
+deleted file mode 100644
+--- a/xpcom/base/nsAllocator.h
++++ /dev/null
+@@ -1,50 +0,0 @@
+-/* -*- Mode: C++; tab-width: 4; indent-tabs-mode: nil; c-basic-offset: 4 -*- */
+-/* ***** BEGIN LICENSE BLOCK *****
+- * Version: MPL 1.1/GPL 2.0/LGPL 2.1
+- *
+- * The contents of this file are subject to the Mozilla Public License Version
+- * 1.1 (the "License"); you may not use this file except in compliance with
+- * the License. You may obtain a copy of the License at
+- * http://www.mozilla.org/MPL/
+- *
+- * Software distributed under the License is distributed on an "AS IS" basis,
+- * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
+- * for the specific language governing rights and limitations under the
+- * License.
+- *
+- * The Original Code is mozilla.org code.
+- *
+- * The Initial Developer of the Original Code is
+- * Netscape Communications Corporation.
+- * Portions created by the Initial Developer are Copyright (C) 1998
+- * the Initial Developer. All Rights Reserved.
+- *
+- * Contributor(s):
+- *
+- * Alternatively, the contents of this file may be used under the terms of
+- * either of the GNU General Public License Version 2 or later (the "GPL"),
+- * or the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
+- * in which case the provisions of the GPL or the LGPL are applicable instead
+- * of those above. If you wish to allow use of your version of this file only
+- * under the terms of either the GPL or the LGPL, and not to allow others to
+- * use your version of this file under the terms of the MPL, indicate your
+- * decision by deleting the provisions above and replace them with the notice
+- * and other provisions required by the GPL or the LGPL. If you do not delete
+- * the provisions above, a recipient may use your version of this file under
+- * the terms of any one of the MPL, the GPL or the LGPL.
+- *
+- * ***** END LICENSE BLOCK ***** */
+-
+-////////////////////////////////////////////////////////////////////////////////
+-// obsolete
+-////////////////////////////////////////////////////////////////////////////////
+-
+-#ifndef nsAllocator_h__
+-#define nsAllocator_h__
+-
+-#include "nsIAllocator.h"
+-#include "prmem.h"
+-#include "nsAgg.h"
+-#include "nsIFactory.h"
+-
+-#endif // nsAllocator_h__
 diff --git a/xpcom/glue/Makefile.in b/xpcom/glue/Makefile.in
 --- a/xpcom/glue/Makefile.in
 +++ b/xpcom/glue/Makefile.in
 @@ -70,6 +70,7 @@ CPPSRCS		= \
  
  SDK_HEADERS = \
  		pldhash.h \
 +		nsAllocator.h \
  		nsArrayEnumerator.h \
  		nsArrayUtils.h \
  		nsAutoLock.h \
-diff --git a/xpcom/base/nsAllocator.cpp b/xpcom/glue/nsAllocator.cpp
-rename from xpcom/base/nsAllocator.cpp
-rename to xpcom/glue/nsAllocator.cpp
---- a/xpcom/glue/nsAllocator.cpp
+diff --git a/xpcom/glue/nsAllocator.cpp b/xpcom/glue/nsAllocator.cpp
+new file mode 100644
+--- /dev/null
 +++ b/xpcom/glue/nsAllocator.cpp
-@@ -36,6 +36,22 @@
-  *
-  * ***** END LICENSE BLOCK ***** */
- 
--////////////////////////////////////////////////////////////////////////////////
--// obsolete
--////////////////////////////////////////////////////////////////////////////////
+@@ -0,0 +1,57 @@
++/* -*- Mode: C++; tab-width: 4; indent-tabs-mode: nil; c-basic-offset: 4 -*- */
++/* ***** BEGIN LICENSE BLOCK *****
++ * Version: MPL 1.1/GPL 2.0/LGPL 2.1
++ *
++ * The contents of this file are subject to the Mozilla Public License Version
++ * 1.1 (the "License"); you may not use this file except in compliance with
++ * the License. You may obtain a copy of the License at
++ * http://www.mozilla.org/MPL/
++ *
++ * Software distributed under the License is distributed on an "AS IS" basis,
++ * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
++ * for the specific language governing rights and limitations under the
++ * License.
++ *
++ * The Original Code is mozilla.org code.
++ *
++ * The Initial Developer of the Original Code is
++ * Netscape Communications Corporation.
++ * Portions created by the Initial Developer are Copyright (C) 1998
++ * the Initial Developer. All Rights Reserved.
++ *
++ * Contributor(s):
++ *   Pierre Phaneuf <pp@ludusdesign.com>
++ *
++ * Alternatively, the contents of this file may be used under the terms of
++ * either of the GNU General Public License Version 2 or later (the "GPL"),
++ * or the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
++ * in which case the provisions of the GPL or the LGPL are applicable instead
++ * of those above. If you wish to allow use of your version of this file only
++ * under the terms of either the GPL or the LGPL, and not to allow others to
++ * use your version of this file under the terms of the MPL, indicate your
++ * decision by deleting the provisions above and replace them with the notice
++ * and other provisions required by the GPL or the LGPL. If you do not delete
++ * the provisions above, a recipient may use your version of this file under
++ * the terms of any one of the MPL, the GPL or the LGPL.
++ *
++ * ***** END LICENSE BLOCK ***** */
++
 +#include "nsAllocator.h"
 +#include "nsDebug.h"
 +
 +void*
 +GCAllocator::Realloc(void *object, size_t oldsize, size_t newsize)
 +{
 +    NS_ASSERTION(object, "Calling Realloc without an original object.");
 +
@@ -268,29 +400,65 @@ rename to xpcom/glue/nsAllocator.cpp
 +    void *newobject = Alloc(newsize);
 +    if (!newobject)
 +        return NULL;
 +
 +    memset(reinterpret_cast<char*>(newobject) + oldsize, 0, newsize - oldsize);
 +    memcpy(newobject, object, oldsize);
 +    return newobject;
 +}
-diff --git a/xpcom/base/nsAllocator.h b/xpcom/glue/nsAllocator.h
-rename from xpcom/base/nsAllocator.h
-rename to xpcom/glue/nsAllocator.h
---- a/xpcom/glue/nsAllocator.h
+diff --git a/xpcom/glue/nsAllocator.h b/xpcom/glue/nsAllocator.h
+new file mode 100644
+--- /dev/null
 +++ b/xpcom/glue/nsAllocator.h
-@@ -42,9 +42,60 @@
- #ifndef nsAllocator_h__
- #define nsAllocator_h__
- 
--#include "nsIAllocator.h"
--#include "prmem.h"
--#include "nsAgg.h"
--#include "nsIFactory.h"
+@@ -0,0 +1,101 @@
++/* -*- Mode: C++; tab-width: 4; indent-tabs-mode: nil; c-basic-offset: 4 -*- */
++/* ***** BEGIN LICENSE BLOCK *****
++ * Version: MPL 1.1/GPL 2.0/LGPL 2.1
++ *
++ * The contents of this file are subject to the Mozilla Public License Version
++ * 1.1 (the "License"); you may not use this file except in compliance with
++ * the License. You may obtain a copy of the License at
++ * http://www.mozilla.org/MPL/
++ *
++ * Software distributed under the License is distributed on an "AS IS" basis,
++ * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
++ * for the specific language governing rights and limitations under the
++ * License.
++ *
++ * The Original Code is mozilla.org code.
++ *
++ * The Initial Developer of the Original Code is
++ * Netscape Communications Corporation.
++ * Portions created by the Initial Developer are Copyright (C) 1998
++ * the Initial Developer. All Rights Reserved.
++ *
++ * Contributor(s):
++ *
++ * Alternatively, the contents of this file may be used under the terms of
++ * either of the GNU General Public License Version 2 or later (the "GPL"),
++ * or the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
++ * in which case the provisions of the GPL or the LGPL are applicable instead
++ * of those above. If you wish to allow use of your version of this file only
++ * under the terms of either the GPL or the LGPL, and not to allow others to
++ * use your version of this file under the terms of the MPL, indicate your
++ * decision by deleting the provisions above and replace them with the notice
++ * and other provisions required by the GPL or the LGPL. If you do not delete
++ * the provisions above, a recipient may use your version of this file under
++ * the terms of any one of the MPL, the GPL or the LGPL.
++ *
++ * ***** END LICENSE BLOCK ***** */
++
++////////////////////////////////////////////////////////////////////////////////
++// obsolete
++////////////////////////////////////////////////////////////////////////////////
++
++#ifndef nsAllocator_h__
++#define nsAllocator_h__
++
 +#include <stdlib.h>
 +
 +#include "nsXPCOM.h"
 +#include "MMgc.h"
 +
 +/**
 + * The following classes are all static and follow the same pattern:
 + *
@@ -336,18 +504,18 @@ rename to xpcom/glue/nsAllocator.h
 +
 +    static void Free(void *object)
 +    {
 +        // Not allowed to call GC::Free during finalization...
 +        // We'd really like to eagerly-free nsCOMArray buffers allocated from
 +        // the stack... need to think about this
 +    }
 +};
- 
- #endif // nsAllocator_h__
++
++#endif // nsAllocator_h__
 diff --git a/xpcom/glue/nsCOMArray.h b/xpcom/glue/nsCOMArray.h
 --- a/xpcom/glue/nsCOMArray.h
 +++ b/xpcom/glue/nsCOMArray.h
 @@ -39,7 +39,7 @@
  #ifndef nsCOMArray_h__
  #define nsCOMArray_h__
  
 -#include "nsVoidArray.h"
--- a/comptr-rewrite.patch
+++ b/comptr-rewrite.patch
@@ -320,17 +320,17 @@ diff --git a/xpcom/base/nsAutoPtr.h b/xp
  inline
 -NSCAP_BOOL
 -operator!=( const nsAutoArrayPtr<T>& lhs, NSCAP_Zero* rhs )
 +bool
 +operator!=( const nsAutoArrayPtr<T>& lhs, void* rhs )
      // specifically to allow |smartPtr != 0|
    {
      return static_cast<const void*>(lhs.get()) != reinterpret_cast<const void*>(rhs);
-@@ -877,517 +852,15 @@ operator!=( const nsAutoArrayPtr<T>& lhs
+@@ -877,528 +852,15 @@ operator!=( const nsAutoArrayPtr<T>& lhs
  
  template <class T>
  inline
 -NSCAP_BOOL
 -operator!=( NSCAP_Zero* lhs, const nsAutoArrayPtr<T>& rhs )
 +bool
 +operator!=( void* lhs, const nsAutoArrayPtr<T>& rhs )
      // specifically to allow |0 != smartPtr|
@@ -491,16 +491,27 @@ diff --git a/xpcom/base/nsAutoPtr.h b/xp
 -          // return the value of mRawPtr and null out mRawPtr. Useful for
 -          // already_AddRefed return values.
 -        {
 -          T* temp = 0;
 -          swap(temp);
 -          return temp;
 -        }
 -
+-      void
+-      forget( T** rhs )
+-          // Set the target of rhs to the value of mRawPtr and null out mRawPtr.
+-          // Useful to avoid unnecessary AddRef/Release pairs with "out"
+-          // parameters.
+-        {
+-          NS_ASSERTION(rhs, "Null pointer passed to forget!");
+-          *rhs = 0;
+-          swap(*rhs);
+-        }
+-
 -      T*
 -      get() const
 -          /*
 -            Prefer the implicit conversion provided automatically by |operator nsDerivedSafe<T>*() const|.
 -             Use |get()| to resolve ambiguity or to get a castable pointer.
 -
 -            Returns a |nsDerivedSafe<T>*| to deny clients the use of |AddRef| and |Release|.
 -          */
@@ -1336,17 +1347,17 @@ diff --git a/xpcom/glue/nsCOMPtr.h b/xpc
 +
 +  New code should use MMgc::WriteBarrier<type> instead.
  */
  
 +#include "MMgc.h"
  
    // Wrapping includes can speed up compiles (see "Large Scale C++ Software Design")
  #ifndef nsDebug_h___
-@@ -65,1609 +60,455 @@
+@@ -65,1630 +60,455 @@
    // for |nsresult|, |NS_ADDREF|, |NS_GET_TEMPLATE_IID| et al
  #endif
  
 -#ifndef nscore_h___
 -#include "nscore.h"
 -  // for |NS_COM_GLUE|
 -#endif
 -
@@ -1668,27 +1679,27 @@ diff --git a/xpcom/glue/nsCOMPtr.h b/xpc
 -    return nsQueryInterfaceWithError(aRawPtr, error);
 -  }
 -
 -template <class T>
 -inline
 -void
 -do_QueryInterface( already_AddRefed<T>& )
 -  {
--    // This signature exists soley to _stop_ you from doing the bad thing.
+-    // This signature exists solely to _stop_ you from doing the bad thing.
 -    //  Saying |do_QueryInterface()| on a pointer that is not otherwise owned by
 -    //  someone else is an automatic leak.  See <http://bugzilla.mozilla.org/show_bug.cgi?id=8221>.
 -  }
 -
 -template <class T>
 -inline
 -void
 -do_QueryInterface( already_AddRefed<T>&, nsresult* )
 -  {
--    // This signature exists soley to _stop_ you from doing the bad thing.
+-    // This signature exists solely to _stop_ you from doing the bad thing.
 -    //  Saying |do_QueryInterface()| on a pointer that is not otherwise owned by
 -    //  someone else is an automatic leak.  See <http://bugzilla.mozilla.org/show_bug.cgi?id=8221>.
 -  }
 -
 -
 -////////////////////////////////////////////////////////////////////////////
 -// Using servicemanager with COMPtrs
 -class NS_COM_GLUE nsGetServiceByCID
@@ -2139,16 +2150,27 @@ diff --git a/xpcom/glue/nsCOMPtr.h b/xpc
 -          // return the value of mRawPtr and null out mRawPtr. Useful for
 -          // already_AddRefed return values.
 -        {
 -          T* temp = 0;
 -          swap(temp);
 -          return temp;
 -        }
 -
+-      void
+-      forget( T** rhs )
+-          // Set the target of rhs to the value of mRawPtr and null out mRawPtr.
+-          // Useful to avoid unnecessary AddRef/Release pairs with "out"
+-          // parameters.
+-        {
+-          NS_ASSERTION(rhs, "Null pointer passed to forget!");
+-          *rhs = 0;
+-          swap(*rhs);
+-        }
+-
 -      T*
 -      get() const
 -          /*
 -            Prefer the implicit conversion provided automatically by |operator nsDerivedSafe<T>*() const|.
 -             Use |get()| to resolve ambiguity or to get a castable pointer.
 -          */
 -        {
 -          return reinterpret_cast<T*>(mRawPtr);
@@ -2449,16 +2471,26 @@ diff --git a/xpcom/glue/nsCOMPtr.h b/xpc
 -        {
 -          nsISupports* temp = rhs;
 -          NSCAP_LOG_ASSIGNMENT(this, temp);
 -          NSCAP_LOG_RELEASE(this, mRawPtr);
 -          rhs = mRawPtr;
 -          mRawPtr = temp;
 -        }
 -
+-      void
+-      forget( nsISupports** rhs )
+-          // Set the target of rhs to the value of mRawPtr and null out mRawPtr.
+-          // Useful to avoid unnecessary AddRef/Release pairs with "out"
+-          // parameters.
+-        {
+-          NS_ASSERTION(rhs, "Null pointer passed to forget!");
+-          *rhs = 0;
+-          swap(*rhs);
+-        }
 -
 -        // Other pointer operators
 -
 -      nsISupports*
 -      get() const
 -          /*
 -            Prefer the implicit conversion provided automatically by |operator nsDerivedSafe<nsISupports>*() const|.
 -             Use |get()| to resolve ambiguity or to get a castable pointer.
@@ -3798,27 +3830,27 @@ diff --git a/xpcom/glue/nsIWeakReference
      //  is very likely to be a programmer error.
    }
  
 -template <class T>
 -inline
 -void
 -do_GetWeakReference( already_AddRefed<T>& )
 -  {
--    // This signature exists soley to _stop_ you from doing the bad thing.
+-    // This signature exists solely to _stop_ you from doing the bad thing.
 -    //  Saying |do_GetWeakReference()| on a pointer that is not otherwise owned by
 -    //  someone else is an automatic leak.  See <http://bugzilla.mozilla.org/show_bug.cgi?id=8221>.
 -  }
 -
 -template <class T>
 -inline
 -void
 -do_GetWeakReference( already_AddRefed<T>&, nsresult* )
 -  {
--    // This signature exists soley to _stop_ you from doing the bad thing.
+-    // This signature exists solely to _stop_ you from doing the bad thing.
 -    //  Saying |do_GetWeakReference()| on a pointer that is not otherwise owned by
 -    //  someone else is an automatic leak.  See <http://bugzilla.mozilla.org/show_bug.cgi?id=8221>.
 -  }
 -
  #endif
 diff --git a/xpcom/glue/nsServiceManagerUtils.h b/xpcom/glue/nsServiceManagerUtils.h
 --- a/xpcom/glue/nsServiceManagerUtils.h
 +++ b/xpcom/glue/nsServiceManagerUtils.h
new file mode 100644
--- /dev/null
+++ b/dont-delete-gcobjects
@@ -0,0 +1,64 @@
+diff --git a/chrome/src/nsChromeRegistry.cpp b/chrome/src/nsChromeRegistry.cpp
+--- a/chrome/src/nsChromeRegistry.cpp
++++ b/chrome/src/nsChromeRegistry.cpp
+@@ -329,18 +329,6 @@ nsChromeRegistry::nsProviderArray::Enume
+   }
+ }
+ 
+-void
+-nsChromeRegistry::nsProviderArray::Clear()
+-{
+-  PRInt32 i = mArray.Count();
+-  while (i--) {
+-    ProviderEntry* entry = reinterpret_cast<ProviderEntry*>(mArray[i]);
+-    delete entry;
+-  }
+-
+-  mArray.Clear();
+-}
+-
+ nsChromeRegistry::PackageEntry::PackageEntry(const nsACString& aPackage) :
+   package(aPackage), flags(0)
+ {
+diff --git a/chrome/src/nsChromeRegistry.h b/chrome/src/nsChromeRegistry.h
+--- a/chrome/src/nsChromeRegistry.h
++++ b/chrome/src/nsChromeRegistry.h
+@@ -163,7 +163,10 @@ public:
+     const nsACString& GetSelected(const nsACString& aPreferred, MatchType aType);
+     void    SetBase(const nsACString& aProvider, nsIURI* base);
+     void    EnumerateToArray(nsCStringArray *a);
+-    void    Clear();
++    void    Clear()
++    {
++      mArray.Clear();
++    }
+ 
+   private:
+     ProviderEntry* GetProvider(const nsACString& aPreferred, MatchType aType);
+diff --git a/content/xul/document/src/nsXULContentSink.cpp b/content/xul/document/src/nsXULContentSink.cpp
+--- a/content/xul/document/src/nsXULContentSink.cpp
++++ b/content/xul/document/src/nsXULContentSink.cpp
+@@ -940,7 +940,6 @@ XULContentSinkImpl::OpenTag(const PRUnic
+     nsVoidArray* children;
+     rv = mContextStack.GetTopChildren(&children);
+     if (NS_FAILED(rv)) {
+-        delete element;
+         return rv;
+     }
+ 
+@@ -1147,7 +1146,6 @@ XULContentSinkImpl::OpenScript(const PRU
+           }
+ 
+           if (NS_FAILED(rv)) {
+-              delete script;
+               return rv;
+           }
+ 
+@@ -1162,7 +1160,6 @@ XULContentSinkImpl::OpenScript(const PRU
+       nsVoidArray* children;
+       rv = mContextStack.GetTopChildren(&children);
+       if (NS_FAILED(rv)) {
+-          delete script;
+           return rv;
+       }
+ 
--- a/fix-garburator.patch
+++ b/fix-garburator.patch
@@ -88,29 +88,29 @@ diff --git a/uriloader/base/nsURILoader.
 -  LOG(("  Downstream DocumentOpenInfo would be: 0x%p", nextLink.get()));
 +  LOG(("  Downstream DocumentOpenInfo would be: 0x%p", nextLink));
    
    // Make sure nextLink starts with the contentListener that said it wanted the
    // results of this decode.
 diff --git a/uriloader/exthandler/nsExternalHelperAppService.cpp b/uriloader/exthandler/nsExternalHelperAppService.cpp
 --- a/uriloader/exthandler/nsExternalHelperAppService.cpp
 +++ b/uriloader/exthandler/nsExternalHelperAppService.cpp
-@@ -615,7 +615,7 @@ NS_IMETHODIMP nsExternalHelperAppService
-     GetFromTypeAndExtension(aMimeContentType, fileExtension,
-                             getter_AddRefs(mimeInfo));
+@@ -621,7 +621,7 @@ NS_IMETHODIMP nsExternalHelperAppService
+     mimeSvc->GetFromTypeAndExtension(aMimeContentType, fileExtension,
+                                      getter_AddRefs(mimeInfo));
    } 
 -  LOG(("Type/Ext lookup found 0x%p\n", mimeInfo.get()));
 +  LOG(("Type/Ext lookup found 0x%p\n", mimeInfo));
  
    // No mimeinfo -> we can't continue. probably OOM.
    if (!mimeInfo)
 diff --git a/uriloader/prefetch/nsOfflineCacheUpdate.cpp b/uriloader/prefetch/nsOfflineCacheUpdate.cpp
 --- a/uriloader/prefetch/nsOfflineCacheUpdate.cpp
 +++ b/uriloader/prefetch/nsOfflineCacheUpdate.cpp
-@@ -1099,7 +1099,7 @@ nsOfflineCacheUpdateService::OnStateChan
+@@ -1112,7 +1112,7 @@ nsOfflineCacheUpdateService::OnStateChan
          if (!doc) return NS_OK;
  
          LOG(("nsOfflineCacheUpdateService::OnStateChange [%p, doc=%p]",
 -             this, doc.get()));
 +             this, doc));
  
          nsRefPtr<nsOfflineCacheUpdate> update;
          if (mDocUpdates.Get(doc, getter_AddRefs(update))) {
--- a/gc-hashtables.patch
+++ b/gc-hashtables.patch
@@ -1,23 +1,11 @@
 * * *
 * * *
 
-diff --git a/js/src/xpconnect/src/nsXPConnect.cpp b/js/src/xpconnect/src/nsXPConnect.cpp
---- a/js/src/xpconnect/src/nsXPConnect.cpp
-+++ b/js/src/xpconnect/src/nsXPConnect.cpp
-@@ -113,7 +113,7 @@ nsXPConnect::nsXPConnect()
- }
- 
- #ifndef XPCONNECT_STANDALONE
--typedef nsBaseHashtable<nsVoidPtrHashKey, nsISupports*, nsISupports*> ScopeSet;
-+typedef nsBaseHashtable<nsVoidPtrHashKey, nsISupports*, nsISupports*, CAllocator> ScopeSet;
- #endif
- 
- static const PLDHashTableOps RefCountOps =
 diff --git a/xpcom/components/nsCategoryManager.h b/xpcom/components/nsCategoryManager.h
 --- a/xpcom/components/nsCategoryManager.h
 +++ b/xpcom/components/nsCategoryManager.h
 @@ -63,8 +63,8 @@ class CategoryLeaf : public nsDepCharHas
  class CategoryLeaf : public nsDepCharHashKey
  {
  public:
 -  CategoryLeaf(const char* aKey)
deleted file mode 100644
--- a/gcobject-fixup.patch
+++ /dev/null
@@ -1,172 +0,0 @@
-* * *
-
-diff --git a/content/base/public/nsIDocument.h b/content/base/public/nsIDocument.h
---- a/content/base/public/nsIDocument.h
-+++ b/content/base/public/nsIDocument.h
-@@ -110,7 +110,6 @@ class nsIDocument : public nsINode
- {
- public:
-   NS_DECLARE_STATIC_IID_ACCESSOR(NS_IDOCUMENT_IID)
--  NS_DECL_AND_IMPL_ZEROING_OPERATOR_NEW
- 
- #ifdef MOZILLA_INTERNAL_API
-   nsIDocument()
-diff --git a/toolkit/xre/nsAppRunner.cpp b/toolkit/xre/nsAppRunner.cpp
---- a/toolkit/xre/nsAppRunner.cpp
-+++ b/toolkit/xre/nsAppRunner.cpp
-@@ -790,7 +790,7 @@ static NS_METHOD AppInfoConstructor(nsIS
- {
-   NS_ENSURE_NO_AGGREGATION(aOuter);
- 
--  return new nsXULAppInfo()->QueryInterface(aIID, aResult);
-+  return (new nsXULAppInfo())->QueryInterface(aIID, aResult);
- }
- 
- PRBool gLogConsoleErrors
-@@ -1043,8 +1043,8 @@ static void DumpArbitraryHelp()
-   ScopedLogging log;
- 
-   {
--    nsXREDirProvider dirProvider;
--    dirProvider.Initialize(nsnull, gAppData->xreDirectory);
-+    nsXREDirProvider *dirProvider = new nsXREDirProvider();
-+    dirProvider->Initialize(nsnull, gAppData->xreDirectory);
- 
-     ScopedXPCOMStartup xpcom;
-     xpcom.Initialize();
-@@ -2571,12 +2571,12 @@ XRE_main(int argc, char* argv[], const n
-     CrashReporter::SetRestartArgs(argc, argv);
- 
-     // annotate other data (user id etc)
--    nsXREDirProvider dirProvider;
-+    nsXREDirProvider *dirProvider = new nsXREDirProvider();
-     nsCOMPtr<nsILocalFile> userAppDataDir;
--    rv = dirProvider.Initialize(gAppData->directory, gAppData->xreDirectory);
-+    rv = dirProvider->Initialize(gAppData->directory, gAppData->xreDirectory);
-     if (NS_SUCCEEDED(rv) &&
--        NS_SUCCEEDED(dirProvider.GetUserAppDataDirectory(
--                                 getter_AddRefs(userAppDataDir)))) {
-+        NS_SUCCEEDED(dirProvider->GetUserAppDataDirectory(
-+                                  getter_AddRefs(userAppDataDir)))) {
-       CrashReporter::SetupExtraData(userAppDataDir,
-                                     nsDependentCString(appData.buildID));
-     }
-@@ -2671,8 +2671,8 @@ XRE_main(int argc, char* argv[], const n
- #endif
- 
-   {
--    nsXREDirProvider dirProvider;
--    rv = dirProvider.Initialize(gAppData->directory, gAppData->xreDirectory);
-+    nsXREDirProvider *dirProvider = new nsXREDirProvider();
-+    rv = dirProvider->Initialize(gAppData->directory, gAppData->xreDirectory);
-     if (NS_FAILED(rv))
-       return 1;
- 
-@@ -2790,14 +2790,14 @@ XRE_main(int argc, char* argv[], const n
-     //----------------------------------------------------------------
-     {
-       nsCOMPtr<nsIFile> registryFile;
--      rv = dirProvider.GetAppDir()->Clone(getter_AddRefs(registryFile));
-+      rv = dirProvider->GetAppDir()->Clone(getter_AddRefs(registryFile));
-       if (NS_SUCCEEDED(rv)) {
-         registryFile->AppendNative(CLEANUP_REGISTRY);
- 
-         PRBool exists;
-         rv = registryFile->Exists(&exists);
-         if (NS_SUCCEEDED(rv) && exists) {
--          return VerifyInstallation(dirProvider.GetAppDir());
-+          return VerifyInstallation(dirProvider->GetAppDir());
-         }
-       }
-     }
-@@ -2832,14 +2832,14 @@ XRE_main(int argc, char* argv[], const n
-   // Check for and process any available updates
-   nsCOMPtr<nsIFile> updRoot;
-   PRBool persistent;
--  rv = dirProvider.GetFile(XRE_UPDATE_ROOT_DIR, &persistent,
--                           getter_AddRefs(updRoot));
-+  rv = dirProvider->GetFile(XRE_UPDATE_ROOT_DIR, &persistent,
-+                            getter_AddRefs(updRoot));
-   // XRE_UPDATE_ROOT_DIR may fail. Fallback to appDir if failed
-   if (NS_FAILED(rv))
--    updRoot = dirProvider.GetAppDir();
--
--  ProcessUpdates(dirProvider.GetGREDir(),
--                 dirProvider.GetAppDir(),
-+    updRoot = dirProvider->GetAppDir();
-+
-+  ProcessUpdates(dirProvider->GetGREDir(),
-+                 dirProvider->GetAppDir(),
-                  updRoot,
-                  gRestartArgc,
-                  gRestartArgv);
-@@ -2863,7 +2863,7 @@ XRE_main(int argc, char* argv[], const n
-     rv = profileLock->GetLocalDirectory(getter_AddRefs(profLD));
-     NS_ENSURE_SUCCESS(rv, 1);
- 
--    rv = dirProvider.SetProfile(profD, profLD);
-+    rv = dirProvider->SetProfile(profD, profLD);
-     NS_ENSURE_SUCCESS(rv, 1);
- 
-     //////////////////////// NOW WE HAVE A PROFILE ////////////////////////
-@@ -2889,7 +2889,7 @@ XRE_main(int argc, char* argv[], const n
-     // profile was started with.  The format of the version stamp is defined
-     // by the BuildVersion function.
-     PRBool versionOK = CheckCompatibility(profD, version, osABI,
--                                          dirProvider.GetGREDir(),
-+                                          dirProvider->GetGREDir(),
-                                           gAppData->directory);
- 
-     // Every time a profile is loaded by a build with a different version,
-@@ -2902,7 +2902,7 @@ XRE_main(int argc, char* argv[], const n
-     if (gSafeMode) {
-       RemoveComponentRegistries(profD, profLD, PR_FALSE);
-       WriteVersion(profD, NS_LITERAL_CSTRING("Safe Mode"), osABI,
--                   dirProvider.GetGREDir(), gAppData->directory);
-+                   dirProvider->GetGREDir(), gAppData->directory);
-     }
-     else if (versionOK) {
-       if (ComponentsListChanged(profD)) {
-@@ -2926,7 +2926,7 @@ XRE_main(int argc, char* argv[], const n
- 
-       // Write out version
-       WriteVersion(profD, version, osABI,
--                   dirProvider.GetGREDir(), gAppData->directory);
-+                   dirProvider->GetGREDir(), gAppData->directory);
-     }
- 
-     PRBool needsRestart = PR_FALSE;
-@@ -2969,7 +2969,7 @@ XRE_main(int argc, char* argv[], const n
- 
-         if (gDoMigration) {
-           nsCOMPtr<nsIFile> file;
--          dirProvider.GetAppDir()->Clone(getter_AddRefs(file));
-+          dirProvider->GetAppDir()->Clone(getter_AddRefs(file));
-           file->AppendNative(NS_LITERAL_CSTRING("override.ini"));
-           nsINIParser parser;
-           nsCOMPtr<nsILocalFile> localFile(do_QueryInterface(file));
-@@ -2991,9 +2991,9 @@ XRE_main(int argc, char* argv[], const n
-           nsCOMPtr<nsIProfileMigrator> pm
-             (do_CreateInstance(NS_PROFILEMIGRATOR_CONTRACTID));
-           if (pm)
--            pm->Migrate(&dirProvider);
-+            pm->Migrate(dirProvider);
-         }
--        dirProvider.DoStartup();
-+        dirProvider->DoStartup();
- 
-         nsCOMPtr<nsICommandLineRunner> cmdLine
-           (do_CreateInstance("@mozilla.org/toolkit/command-line;1"));
-diff --git a/toolkit/xre/nsNativeAppSupportCocoa.mm b/toolkit/xre/nsNativeAppSupportCocoa.mm
---- a/toolkit/xre/nsNativeAppSupportCocoa.mm
-+++ b/toolkit/xre/nsNativeAppSupportCocoa.mm
-@@ -79,7 +79,8 @@ enum {
-         eCarbonLibVersTooOldExplanationIndex
-      };
- 
--class nsNativeAppSupportCocoa : public nsNativeAppSupportBase
-+class nsNativeAppSupportCocoa : public XPCOMGCFinalizedObject
-+                              , public nsNativeAppSupportBase
- {
- public:
-   nsNativeAppSupportCocoa() :
--- a/gcobject-nodelete.patch
+++ b/gcobject-nodelete.patch
@@ -31,104 +31,104 @@ diff --git a/content/html/content/src/ns
                                                   aCompileEventHandlers);
    NS_ENSURE_SUCCESS(rv, rv);
  
 -  nsCOMPtr<nsIHTMLDocument> htmlDoc(do_QueryInterface(aDocument));
 +  nsIHTMLDocument* htmlDoc(do_QueryInterface(aDocument));
    if (htmlDoc) {
      htmlDoc->AddedForm();
    }
-@@ -694,7 +693,7 @@ void
+@@ -747,7 +746,7 @@ void
  void
  nsHTMLFormElement::UnbindFromTree(PRBool aDeep, PRBool aNullParent)
  {
 -  nsCOMPtr<nsIHTMLDocument> oldDocument = do_QueryInterface(GetCurrentDoc());
 +  nsIHTMLDocument* oldDocument = do_QueryInterface(GetCurrentDoc());
  
-   nsGenericHTMLElement::UnbindFromTree(aDeep, aNullParent);
- 
-@@ -812,8 +811,8 @@ nsHTMLFormElement::DoReset()
+   // Mark all of our controls as maybe being orphans
+   MarkOrphans(mControls->mElements);
+@@ -890,8 +889,8 @@ nsHTMLFormElement::DoReset()
    PRUint32 numElements;
    GetElementCount(&numElements);
    for (PRUint32 elementX = 0; (elementX < numElements); elementX++) {
 -    nsCOMPtr<nsIFormControl> controlNode;
 -    GetElementAt(elementX, getter_AddRefs(controlNode));
 +    nsIFormControl* controlNode = nsnull;
 +    GetElementAt(elementX, &controlNode);
      if (controlNode) {
        controlNode->Reset();
      }
-@@ -843,7 +842,7 @@ nsHTMLFormElement::DoSubmit(nsEvent* aEv
+@@ -921,7 +920,7 @@ nsHTMLFormElement::DoSubmit(nsEvent* aEv
    mIsSubmitting = PR_TRUE;
    NS_ASSERTION(!mWebProgress && !mSubmittingRequest, "Web progress / submitting request should not exist here!");
  
 -  nsCOMPtr<nsIFormSubmission> submission;
 +  nsIFormSubmission* submission = nsnull;
     
    //
    // prepare the submission object
-@@ -879,7 +878,7 @@ nsHTMLFormElement::DoSubmit(nsEvent* aEv
+@@ -957,7 +956,7 @@ nsHTMLFormElement::DoSubmit(nsEvent* aEv
  }
  
  nsresult
 -nsHTMLFormElement::BuildSubmission(nsCOMPtr<nsIFormSubmission>& aFormSubmission, 
 +nsHTMLFormElement::BuildSubmission(nsIFormSubmission*& aFormSubmission, 
                                     nsEvent* aEvent)
  {
    NS_ASSERTION(!mPendingSubmission, "tried to build two submissions!");
-@@ -897,7 +896,7 @@ nsHTMLFormElement::BuildSubmission(nsCOM
+@@ -975,7 +974,7 @@ nsHTMLFormElement::BuildSubmission(nsCOM
    //
    // Get the submission object
    //
 -  rv = GetSubmissionFromForm(this, getter_AddRefs(aFormSubmission));
 +  rv = GetSubmissionFromForm(this, &aFormSubmission);
    NS_ENSURE_SUBMIT_SUCCESS(rv);
  
    //
-@@ -916,8 +915,8 @@ nsHTMLFormElement::SubmitSubmission(nsIF
+@@ -994,8 +993,8 @@ nsHTMLFormElement::SubmitSubmission(nsIF
    //
    // Get the action and target
    //
 -  nsCOMPtr<nsIURI> actionURI;
 -  rv = GetActionURL(getter_AddRefs(actionURI));
 +  nsIURI* actionURI = nsnull;
 +  rv = GetActionURL(&actionURI);
    NS_ENSURE_SUBMIT_SUCCESS(rv);
  
    if (!actionURI) {
-@@ -927,8 +926,8 @@ nsHTMLFormElement::SubmitSubmission(nsIF
+@@ -1005,8 +1004,8 @@ nsHTMLFormElement::SubmitSubmission(nsIF
  
    // If there is no link handler, then we won't actually be able to submit.
    nsIDocument* doc = GetCurrentDoc();
 -  nsCOMPtr<nsISupports> container = doc ? doc->GetContainer() : nsnull;
 -  nsCOMPtr<nsILinkHandler> linkHandler(do_QueryInterface(container));
 +  nsISupports* container = doc ? doc->GetContainer() : nsnull;
 +  nsILinkHandler* linkHandler(do_QueryInterface(container));
    if (!linkHandler || IsEditable()) {
      mIsSubmitting = PR_FALSE;
      return NS_OK;
-@@ -983,7 +982,7 @@ nsHTMLFormElement::SubmitSubmission(nsIF
+@@ -1061,7 +1060,7 @@ nsHTMLFormElement::SubmitSubmission(nsIF
    //
    // Submit
    //
 -  nsCOMPtr<nsIDocShell> docShell;
 +  nsIDocShell* docShell = nsnull;
  
    {
      nsAutoPopupStatePusher popupStatePusher(mSubmitPopupState);
-@@ -991,7 +990,7 @@ nsHTMLFormElement::SubmitSubmission(nsIF
+@@ -1069,7 +1068,7 @@ nsHTMLFormElement::SubmitSubmission(nsIF
      nsAutoHandlingUserInputStatePusher userInpStatePusher(mSubmitInitiatedFromUserInput);
  
      rv = aFormSubmission->SubmitTo(actionURI, target, this, linkHandler,
 -                                   getter_AddRefs(docShell),
 +                                   &docShell,
                                     getter_AddRefs(mSubmittingRequest));
    }
  
-@@ -1035,31 +1034,31 @@ nsHTMLFormElement::NotifySubmitObservers
+@@ -1113,31 +1112,31 @@ nsHTMLFormElement::NotifySubmitObservers
  
    // Notify observers that the form is being submitted.
    nsresult rv = NS_OK;
 -  nsCOMPtr<nsIObserverService> service =
 +  nsIObserverService* service =
      do_GetService("@mozilla.org/observer-service;1", &rv);
    NS_ENSURE_SUCCESS(rv, rv);
  
@@ -158,104 +158,104 @@ diff --git a/content/html/content/src/ns
 -
 -      nsCOMPtr<nsIFormSubmitObserver> formSubmitObserver(
 +      theEnum->GetNext(&inst);
 +
 +      nsIFormSubmitObserver* formSubmitObserver(
                        do_QueryInterface(inst));
        if (formSubmitObserver) {
          rv = formSubmitObserver->Notify(this,
-@@ -1137,8 +1136,8 @@ static PRInt32 CompareFormControlPositio
+@@ -1215,8 +1214,8 @@ static PRInt32 CompareFormControlPositio
  {
    NS_ASSERTION(aControl1 != aControl2, "Comparing a form control to itself");
  
 -  nsCOMPtr<nsIContent> content1 = do_QueryInterface(aControl1);
 -  nsCOMPtr<nsIContent> content2 = do_QueryInterface(aControl2);
 +  nsIContent* content1 = do_QueryInterface(aControl1);
 +  nsIContent* content2 = do_QueryInterface(aControl2);
  
    NS_ASSERTION(content1 && content2,
                 "We should be able to QI to nsIContent here!");
-@@ -1179,7 +1178,7 @@ nsHTMLFormElement::AddElement(nsIFormCon
+@@ -1257,7 +1256,7 @@ nsHTMLFormElement::AddElement(nsIFormCon
  {
  #ifdef DEBUG
    {
 -    nsCOMPtr<nsIContent> content = do_QueryInterface(aChild);
 +    nsIContent* content = do_QueryInterface(aChild);
      NS_ASSERTION(content->GetParent(),
                   "Form control should have a parent");
    }
-@@ -1195,7 +1194,7 @@ nsHTMLFormElement::AddElement(nsIFormCon
+@@ -1273,7 +1272,7 @@ nsHTMLFormElement::AddElement(nsIFormCon
                 "Form control already in form");
  
    PRUint32 count = controlList.Length();
 -  nsCOMPtr<nsIFormControl> element;
 +  nsIFormControl* element = nsnull;
    
    // Optimize most common case where we insert at the end.
    PRBool lastElement = PR_FALSE;
-@@ -1241,7 +1240,7 @@ nsHTMLFormElement::AddElement(nsIFormCon
+@@ -1319,7 +1318,7 @@ nsHTMLFormElement::AddElement(nsIFormCon
    //
    PRInt32 type = aChild->GetType();
    if (type == NS_FORM_INPUT_RADIO) {
 -    nsCOMPtr<nsIRadioControlElement> radio = do_QueryInterface(aChild);
 +    nsIRadioControlElement* radio = do_QueryInterface(aChild);
      nsresult rv = radio->AddedToRadioGroup();
      NS_ENSURE_SUCCESS(rv, rv);
    }
-@@ -1302,7 +1301,7 @@ nsHTMLFormElement::AddElement(nsIFormCon
+@@ -1380,7 +1379,7 @@ nsHTMLFormElement::AddElement(nsIFormCon
        nsIDocument* document = GetCurrentDoc();
        if (document) {
          MOZ_AUTO_DOC_UPDATE(document, UPDATE_CONTENT_STATE, PR_TRUE);
 -        nsCOMPtr<nsIContent> oldElement(do_QueryInterface(oldDefaultSubmit));
 +        nsIContent* oldElement(do_QueryInterface(oldDefaultSubmit));
          document->ContentStatesChanged(oldElement, nsnull,
                                         NS_EVENT_STATE_DEFAULT);
        }
-@@ -1329,7 +1328,7 @@ nsHTMLFormElement::RemoveElement(nsIForm
+@@ -1407,7 +1406,7 @@ nsHTMLFormElement::RemoveElement(nsIForm
    //
    nsresult rv = NS_OK;
    if (aChild->GetType() == NS_FORM_INPUT_RADIO) {
 -    nsCOMPtr<nsIRadioControlElement> radio = do_QueryInterface(aChild);
 +    nsIRadioControlElement* radio = do_QueryInterface(aChild);
      rv = radio->WillRemoveFromRadioGroup();
      NS_ENSURE_SUCCESS(rv, rv);
    }
-@@ -1394,7 +1393,7 @@ nsHTMLFormElement::RemoveElement(nsIForm
+@@ -1472,7 +1471,7 @@ nsHTMLFormElement::RemoveElement(nsIForm
        nsIDocument* document = GetCurrentDoc();
        if (document) {
          MOZ_AUTO_DOC_UPDATE(document, UPDATE_CONTENT_STATE, PR_TRUE);
 -        nsCOMPtr<nsIContent> newElement(do_QueryInterface(mDefaultSubmitElement));
 +        nsIContent* newElement(do_QueryInterface(mDefaultSubmitElement));
          document->ContentStatesChanged(newElement, nsnull,
                                         NS_EVENT_STATE_DEFAULT);
        }
-@@ -1435,10 +1434,10 @@ nsHTMLFormElement::OnSubmitClickBegin()
+@@ -1513,10 +1512,10 @@ nsHTMLFormElement::OnSubmitClickBegin()
    // Prepare to run NotifySubmitObservers early before the
    // scripts on the page get to modify the form data, possibly
    // throwing off any password manager. (bug 257781)
 -  nsCOMPtr<nsIURI> actionURI;
 +  nsIURI* actionURI = nsnull;
    nsresult rv;
  
 -  rv = GetActionURL(getter_AddRefs(actionURI));
 +  rv = GetActionURL(&actionURI);
    if (NS_FAILED(rv) || !actionURI)
      return NS_OK;
  
-@@ -1465,7 +1464,7 @@ NS_IMETHODIMP
+@@ -1543,7 +1542,7 @@ NS_IMETHODIMP
  NS_IMETHODIMP
  nsHTMLFormElement::FlushPendingSubmission()
  {
 -  nsCOMPtr<nsIFormSubmission> kunkFuDeathGrip(mPendingSubmission);
 +  nsIFormSubmission* kunkFuDeathGrip(mPendingSubmission);
  
    if (!mPendingSubmission) {
      return NS_OK;
-@@ -1525,24 +1524,24 @@ nsHTMLFormElement::GetActionURL(nsIURI**
+@@ -1603,24 +1602,24 @@ nsHTMLFormElement::GetActionURL(nsIURI**
    // XUL, do nothing. This prevents undesirable reloading of
    // a document inside XUL.
  
 -  nsCOMPtr<nsIURI> actionURL;
 +  nsIURI* actionURL = nsnull;
    if (action.IsEmpty()) {
 -    nsCOMPtr<nsIHTMLDocument> htmlDoc(do_QueryInterface(document));
 +    nsIHTMLDocument* htmlDoc(do_QueryInterface(document));
@@ -275,40 +275,40 @@ diff --git a/content/html/content/src/ns
      if (!baseURL) {
        return NS_OK; // No base URL -> exit early, see Bug 30721
      }
 -    rv = NS_NewURI(getter_AddRefs(actionURL), action, nsnull, baseURL);
 +    rv = NS_NewURI(&actionURL, action, nsnull, baseURL);
      NS_ENSURE_SUCCESS(rv, rv);
    }
  
-@@ -1729,10 +1728,10 @@ nsHTMLFormElement::GetPositionInGroup(ns
+@@ -1807,10 +1806,10 @@ nsHTMLFormElement::GetPositionInGroup(ns
      return NS_OK;
    }
  
 -  nsCOMPtr<nsISupports> itemWithName;
 -  nsresult rv = ResolveName(name, getter_AddRefs(itemWithName));
 +  nsISupports* itemWithName = nsnull;
 +  nsresult rv = ResolveName(name, &itemWithName);
    NS_ENSURE_SUCCESS(rv, rv);
 -  nsCOMPtr<nsIDOMNodeList> radioNodeList(do_QueryInterface(itemWithName));
 +  nsIDOMNodeList* radioNodeList(do_QueryInterface(itemWithName));
  
    // XXX If ResolveName could return an nsContentList instead then we 
    //     could get an nsContentList instead of using this hacky upcast
-@@ -1743,7 +1742,7 @@ nsHTMLFormElement::GetPositionInGroup(ns
+@@ -1821,7 +1820,7 @@ nsHTMLFormElement::GetPositionInGroup(ns
      return NS_OK;
    }
  
 -  nsCOMPtr<nsIContent> currentRadioNode(do_QueryInterface(aRadio));
 +  nsIContent* currentRadioNode(do_QueryInterface(aRadio));
    NS_ASSERTION(currentRadioNode, "No nsIContent for current radio button");
    *aPositionIndex = radioGroup->IndexOf(currentRadioNode, PR_TRUE);
    NS_ASSERTION(*aPositionIndex >= 0, "Radio button not found in its own group");
-@@ -1764,17 +1763,17 @@ nsHTMLFormElement::GetNextRadioButton(co
+@@ -1842,17 +1841,17 @@ nsHTMLFormElement::GetNextRadioButton(co
    // If no radio is focused, get the radio relative to the selected one.
    *aRadioOut = nsnull;
  
 -  nsCOMPtr<nsIDOMHTMLInputElement> currentRadio;
 +  nsIDOMHTMLInputElement* currentRadio = nsnull;
    if (aFocusedRadio) {
      currentRadio = aFocusedRadio;
    }
@@ -323,65 +323,65 @@ diff --git a/content/html/content/src/ns
 +  }
 +
 +  nsISupports* itemWithName = nsnull;
 +  ResolveName(aName, &itemWithName);
 +  nsIDOMNodeList* radioNodeList(do_QueryInterface(itemWithName));
  
    // XXX If ResolveName could return an nsContentList instead then we 
    //     could get an nsContentList instead of using this hacky upcast
-@@ -1785,7 +1784,7 @@ nsHTMLFormElement::GetNextRadioButton(co
+@@ -1863,7 +1862,7 @@ nsHTMLFormElement::GetNextRadioButton(co
      return NS_ERROR_FAILURE;
    }
  
 -  nsCOMPtr<nsIContent> currentRadioNode(do_QueryInterface(currentRadio));
 +  nsIContent* currentRadioNode(do_QueryInterface(currentRadio));
    NS_ASSERTION(currentRadioNode, "No nsIContent for current radio button");
    PRInt32 index = radioGroup->IndexOf(currentRadioNode, PR_TRUE);
    if (index < 0) {
-@@ -1795,9 +1794,9 @@ nsHTMLFormElement::GetNextRadioButton(co
+@@ -1873,9 +1872,9 @@ nsHTMLFormElement::GetNextRadioButton(co
    PRUint32 numRadios;
    radioGroup->GetLength(&numRadios);
    PRBool disabled = PR_TRUE;
 -  nsCOMPtr<nsIDOMHTMLInputElement> radio;
 -  nsCOMPtr<nsIDOMNode> radioDOMNode;
 -  nsCOMPtr<nsIFormControl> formControl;
 +  nsIDOMHTMLInputElement* radio = nsnull;
 +  nsIDOMNode* radioDOMNode = nsnull;
 +  nsIFormControl* formControl = nsnull;
  
    do {
      if (aPrevious) {
-@@ -1808,7 +1807,7 @@ nsHTMLFormElement::GetNextRadioButton(co
+@@ -1886,7 +1885,7 @@ nsHTMLFormElement::GetNextRadioButton(co
      else if (++index >= (PRInt32)numRadios) {
        index = 0;
      }
 -    radioGroup->Item(index, getter_AddRefs(radioDOMNode));
 +    radioGroup->Item(index, &radioDOMNode);
      radio = do_QueryInterface(radioDOMNode);
      if (!radio)
        continue;
-@@ -1838,13 +1837,13 @@ nsHTMLFormElement::WalkRadioGroup(const 
+@@ -1916,13 +1915,13 @@ nsHTMLFormElement::WalkRadioGroup(const 
      // XXX If the name is empty, it's not stored in the control list.  There
      // *must* be a more efficient way to do this.
      //
 -    nsCOMPtr<nsIFormControl> control;
 +    nsIFormControl* control = nsnull;
      PRUint32 len = 0;
      GetElementCount(&len);
      for (PRUint32 i=0; i<len; i++) {
 -      GetElementAt(i, getter_AddRefs(control));
 +      GetElementAt(i, &control);
        if (control->GetType() == NS_FORM_INPUT_RADIO) {
 -        nsCOMPtr<nsIContent> controlContent(do_QueryInterface(control));
 +        nsIContent* controlContent(do_QueryInterface(control));
          if (controlContent) {
            if (controlContent->AttrValueIs(kNameSpaceID_None, nsGkAtoms::name,
                                            EmptyString(), eCaseMatters)) {
-@@ -1860,27 +1859,27 @@ nsHTMLFormElement::WalkRadioGroup(const 
+@@ -1938,27 +1937,27 @@ nsHTMLFormElement::WalkRadioGroup(const 
      //
      // Get the control / list of controls from the form using form["name"]
      //
 -    nsCOMPtr<nsISupports> item;
 -    rv = DoResolveName(aName, aFlushContent, getter_AddRefs(item));
 +    nsISupports* item = nsnull;
 +    rv = DoResolveName(aName, aFlushContent, &item);
  
@@ -406,38 +406,38 @@ diff --git a/content/html/content/src/ns
 -            nodeList->Item(i, getter_AddRefs(node));
 -            nsCOMPtr<nsIFormControl> formControl(do_QueryInterface(node));
 +            nsIDOMNode* node = nsnull;
 +            nodeList->Item(i, &node);
 +            nsIFormControl* formControl(do_QueryInterface(node));
              if (formControl) {
                if (formControl->GetType() == NS_FORM_INPUT_RADIO) {
                  aVisitor->Visit(formControl, &stopIterating);
-@@ -2026,9 +2025,9 @@ nsFormControlList::NamedItem(const nsASt
+@@ -2104,9 +2103,9 @@ nsFormControlList::NamedItem(const nsASt
  
    nsresult rv = NS_OK;
  
 -  nsCOMPtr<nsISupports> supports;
 +  nsISupports* supports = nsnull;
    
 -  if (!mNameLookupTable.Get(aName, getter_AddRefs(supports))) // key not found
 +  if (!mNameLookupTable.Get(aName, &supports)) // key not found
       return rv;
  
    if (supports) {
-@@ -2037,7 +2036,7 @@ nsFormControlList::NamedItem(const nsASt
+@@ -2115,7 +2114,7 @@ nsFormControlList::NamedItem(const nsASt
  
      if (!*aReturn) {
        // If not, we check if it's a node list.
 -      nsCOMPtr<nsIDOMNodeList> nodeList(do_QueryInterface(supports));
 +      nsIDOMNodeList* nodeList(do_QueryInterface(supports));
        NS_ASSERTION(nodeList, "Huh, what's going one here?");
  
        if (nodeList) {
-@@ -2079,18 +2078,18 @@ nsFormControlList::AddElementToTable(nsI
+@@ -2157,18 +2156,18 @@ nsFormControlList::AddElementToTable(nsI
      return NS_OK;
    }
  
 -  nsCOMPtr<nsISupports> supports;
 -  mNameLookupTable.Get(aName, getter_AddRefs(supports));
 +  nsISupports* supports = nsnull;
 +  mNameLookupTable.Get(aName, &supports);
  
@@ -451,17 +451,17 @@ diff --git a/content/html/content/src/ns
      // Found something in the hash, check its type
 -    nsCOMPtr<nsIContent> content(do_QueryInterface(supports));
 -    nsCOMPtr<nsIContent> newChild(do_QueryInterface(aChild));
 +    nsIContent* content(do_QueryInterface(supports));
 +    nsIContent* newChild(do_QueryInterface(aChild));
  
      if (content) {
        // Check if the new content is the same as the one we found in the
-@@ -2111,19 +2110,19 @@ nsFormControlList::AddElementToTable(nsI
+@@ -2189,19 +2188,19 @@ nsFormControlList::AddElementToTable(nsI
        // Add the new child too
        list->AppendElement(newChild);
  
 -      nsCOMPtr<nsISupports> listSupports = do_QueryInterface(list);
 +      nsISupports* listSupports = do_QueryInterface(list);
  
        // Replace the element with the list.
        NS_ENSURE_TRUE(mNameLookupTable.Put(aName, listSupports),
@@ -474,17 +474,17 @@ diff --git a/content/html/content/src/ns
  
        // Upcast, uggly, but it works!
        nsBaseContentList *list = static_cast<nsBaseContentList *>
 -                                           ((nsIDOMNodeList *)nodeList.get());
 +                                           ((nsIDOMNodeList *)nodeList);
  
        PRInt32 oldIndex = list->IndexOf(newChild, PR_FALSE);
        
-@@ -2158,17 +2157,17 @@ nsFormControlList::RemoveElementFromTabl
+@@ -2236,17 +2235,17 @@ nsFormControlList::RemoveElementFromTabl
      return NS_OK;
    }
  
 -  nsCOMPtr<nsIContent> content = do_QueryInterface(aChild);  
 +  nsIContent* content = do_QueryInterface(aChild);  
    if (!content) {
      return NS_OK;
    }
@@ -497,32 +497,32 @@ diff --git a/content/html/content/src/ns
 +  if (!mNameLookupTable.Get(aName, &supports))
      return NS_OK;
  
 -  nsCOMPtr<nsIFormControl> fctrl(do_QueryInterface(supports));
 +  nsIFormControl* fctrl(do_QueryInterface(supports));
  
    if (fctrl) {
      // Single element in the hash, just remove it if it's the one
-@@ -2180,12 +2179,12 @@ nsFormControlList::RemoveElementFromTabl
+@@ -2258,12 +2257,12 @@ nsFormControlList::RemoveElementFromTabl
      return NS_OK;
    }
  
 -  nsCOMPtr<nsIDOMNodeList> nodeList(do_QueryInterface(supports));
 +  nsIDOMNodeList* nodeList(do_QueryInterface(supports));
    NS_ENSURE_TRUE(nodeList, NS_ERROR_FAILURE);
  
    // Upcast, uggly, but it works!
    nsBaseContentList *list = static_cast<nsBaseContentList *>
 -                                       ((nsIDOMNodeList *)nodeList.get());
 +                                       ((nsIDOMNodeList *)nodeList);
  
    list->RemoveElement(content);
  
-@@ -2199,11 +2198,11 @@ nsFormControlList::RemoveElementFromTabl
+@@ -2277,11 +2276,11 @@ nsFormControlList::RemoveElementFromTabl
    } else if (length == 1) {
      // Only one element left, replace the list in the hash with the
      // single element.
 -    nsCOMPtr<nsIDOMNode> node;
 -    list->Item(0, getter_AddRefs(node));
 +    nsIDOMNode* node = nsnull;
 +    list->Item(0, &node);
  
@@ -547,153 +547,153 @@ diff --git a/docshell/shistory/src/nsSHE
    mChildren.EnumerateForwards(ClearParentPtr, nsnull);
    mChildren.Clear();
  
 -  nsCOMPtr<nsIContentViewer> viewer = mContentViewer;
 +  nsIContentViewer* viewer = mContentViewer;
    DropPresentationState();
    if (viewer) {
      viewer->Destroy();
-@@ -198,7 +197,6 @@ NS_IMETHODIMP nsSHEntry::GetURI(nsIURI**
+@@ -199,7 +198,6 @@ NS_IMETHODIMP nsSHEntry::GetURI(nsIURI**
  NS_IMETHODIMP nsSHEntry::GetURI(nsIURI** aURI)
  {
    *aURI = mURI;
 -  NS_IF_ADDREF(*aURI);
    return NS_OK;
  }
  
-@@ -211,7 +209,6 @@ NS_IMETHODIMP nsSHEntry::GetReferrerURI(
+@@ -212,7 +210,6 @@ NS_IMETHODIMP nsSHEntry::GetReferrerURI(
  NS_IMETHODIMP nsSHEntry::GetReferrerURI(nsIURI **aReferrerURI)
  {
    *aReferrerURI = mReferrerURI;
 -  NS_IF_ADDREF(*aReferrerURI);
    return NS_OK;
  }
  
-@@ -233,8 +230,8 @@ nsSHEntry::SetContentViewer(nsIContentVi
-   mContentViewer = aViewer;
- 
+@@ -236,8 +233,8 @@ nsSHEntry::SetContentViewer(nsIContentVi
    if (mContentViewer) {
+     gHistoryTracker->AddObject(this);
+ 
 -    nsCOMPtr<nsIDOMDocument> domDoc;
 -    mContentViewer->GetDOMDocument(getter_AddRefs(domDoc));
 +    nsIDOMDocument* domDoc = nsnull;
 +    mContentViewer->GetDOMDocument(&domDoc);
      // Store observed document in strong pointer in case it is removed from
      // the contentviewer
      mDocument = do_QueryInterface(domDoc);
-@@ -253,7 +250,6 @@ nsSHEntry::GetContentViewer(nsIContentVi
+@@ -254,7 +251,6 @@ nsSHEntry::GetContentViewer(nsIContentVi
  nsSHEntry::GetContentViewer(nsIContentViewer **aResult)
  {
    *aResult = mContentViewer;
 -  NS_IF_ADDREF(*aResult);
    return NS_OK;
  }
  
-@@ -270,7 +266,6 @@ nsSHEntry::GetAnyContentViewer(nsISHEntr
+@@ -271,7 +267,6 @@ nsSHEntry::GetAnyContentViewer(nsISHEntr
      printf("Found content viewer\n");
  #endif
      *aOwnerEntry = this;
 -    NS_ADDREF(*aOwnerEntry);
      return NS_OK;
    }
    // The root SHEntry doesn't have a ContentViewer, so check child nodes
-@@ -326,7 +321,6 @@ NS_IMETHODIMP nsSHEntry::GetPostData(nsI
+@@ -327,7 +322,6 @@ NS_IMETHODIMP nsSHEntry::GetPostData(nsI
  NS_IMETHODIMP nsSHEntry::GetPostData(nsIInputStream** aResult)
  {
    *aResult = mPostData;
 -  NS_IF_ADDREF(*aResult);
    return NS_OK;
  }
  
-@@ -339,7 +333,6 @@ NS_IMETHODIMP nsSHEntry::GetLayoutHistor
+@@ -340,7 +334,6 @@ NS_IMETHODIMP nsSHEntry::GetLayoutHistor
  NS_IMETHODIMP nsSHEntry::GetLayoutHistoryState(nsILayoutHistoryState** aResult)
  {
    *aResult = mLayoutHistoryState;
 -  NS_IF_ADDREF(*aResult);
    return NS_OK;
  }
  
-@@ -401,7 +394,6 @@ NS_IMETHODIMP nsSHEntry::GetCacheKey(nsI
+@@ -402,7 +395,6 @@ NS_IMETHODIMP nsSHEntry::GetCacheKey(nsI
  NS_IMETHODIMP nsSHEntry::GetCacheKey(nsISupports** aResult)
  {
    *aResult = mCacheKey;
 -  NS_IF_ADDREF(*aResult);
    return NS_OK;
  }
  
-@@ -491,7 +483,6 @@ nsSHEntry::Clone(nsISHEntry ** aResult)
+@@ -492,7 +484,6 @@ nsSHEntry::Clone(nsISHEntry ** aResult)
    *aResult = new nsSHEntry(*this);
    if (!*aResult)
      return NS_ERROR_OUT_OF_MEMORY;
 -  NS_ADDREF(*aResult);
    return NS_OK;
  }
  
-@@ -500,7 +491,6 @@ nsSHEntry::GetParent(nsISHEntry ** aResu
+@@ -501,7 +492,6 @@ nsSHEntry::GetParent(nsISHEntry ** aResu
  {
    NS_ENSURE_ARG_POINTER(aResult);
    *aResult = mParent;
 -  NS_IF_ADDREF(*aResult);
    return NS_OK;
  }
  
-@@ -526,7 +516,7 @@ NS_IMETHODIMP
+@@ -527,7 +517,7 @@ NS_IMETHODIMP
  NS_IMETHODIMP
  nsSHEntry::GetWindowState(nsISupports **aState)
  {
 -  NS_IF_ADDREF(*aState = mWindowState);
 +  *aState = mWindowState;
    return NS_OK;
  }
  
-@@ -547,7 +537,7 @@ NS_IMETHODIMP
+@@ -548,7 +538,7 @@ NS_IMETHODIMP
  NS_IMETHODIMP
  nsSHEntry::GetOwner(nsISupports **aOwner)
  {
 -  NS_IF_ADDREF(*aOwner = mOwner);
 +  *aOwner = mOwner;
    return NS_OK;
  }
  
-@@ -619,7 +609,6 @@ nsSHEntry::GetChildAt(PRInt32 aIndex, ns
+@@ -620,7 +610,6 @@ nsSHEntry::GetChildAt(PRInt32 aIndex, ns
      *aResult = mChildren[aIndex];
      // yes, mChildren can have holes in it.  AddChild's offset parameter makes
      // that possible.
 -    NS_IF_ADDREF(*aResult);
    } else {
      *aResult = nsnull;
    }
-@@ -637,7 +626,7 @@ NS_IMETHODIMP
+@@ -638,7 +627,7 @@ NS_IMETHODIMP
  NS_IMETHODIMP
  nsSHEntry::ChildShellAt(PRInt32 aIndex, nsIDocShellTreeItem **aShell)
  {
 -  NS_IF_ADDREF(*aShell = mChildShells.SafeObjectAt(aIndex));
 +  *aShell = mChildShells.SafeObjectAt(aIndex);
    return NS_OK;
  }
  
-@@ -651,7 +640,7 @@ NS_IMETHODIMP
+@@ -652,7 +641,7 @@ NS_IMETHODIMP
  NS_IMETHODIMP
  nsSHEntry::GetRefreshURIList(nsISupportsArray **aList)
  {
 -  NS_IF_ADDREF(*aList = mRefreshURIList);
 +  *aList = mRefreshURIList;
    return NS_OK;
  }
  
-@@ -678,7 +667,7 @@ void
+@@ -679,7 +668,7 @@ void
  void
  nsSHEntry::DropPresentationState()
  {
 -  nsRefPtr<nsSHEntry> kungFuDeathGrip = this;
 +  nsSHEntry* kungFuDeathGrip = this;
  
    if (mDocument) {
      mDocument->SetShellsHidden(PR_FALSE);
-@@ -704,19 +693,19 @@ nsSHEntry::Expire()
+@@ -705,19 +694,19 @@ nsSHEntry::Expire()
    // get it evicted.
    if (!mContentViewer)
      return;
 -  nsCOMPtr<nsISupports> container;
 -  mContentViewer->GetContainer(getter_AddRefs(container));
 -  nsCOMPtr<nsIDocShellTreeItem> treeItem = do_QueryInterface(container);
 +  nsISupports* container = nsnull;
 +  mContentViewer->GetContainer(&container);
@@ -712,53 +712,53 @@ diff --git a/docshell/shistory/src/nsSHE
 +  treeItem->GetSameTypeRootTreeItem(&root);
 +  nsIWebNavigation* webNav = do_QueryInterface(root);
 +  nsISHistory* history = nsnull;
 +  webNav->GetSessionHistory(&history);
 +  nsISHistoryInternal* historyInt = do_QueryInterface(history);
    if (!historyInt)
      return;
    historyInt->EvictExpiredContentViewerForEntry(this);
-@@ -817,7 +806,7 @@ nsSHEntry::DocumentMutated()
+@@ -818,7 +807,7 @@ nsSHEntry::DocumentMutated()
    // Release the reference to the contentviewer asynchronously so that the
    // document doesn't get nuked mid-mutation.
  
 -  nsCOMPtr<nsIRunnable> evt =
 +  nsIRunnable* evt =
        new DestroyViewerEvent(mContentViewer, mDocument);
    nsresult rv = NS_DispatchToCurrentThread(evt);
    if (NS_FAILED(rv)) {
 diff --git a/dom/src/base/nsJSEnvironment.cpp b/dom/src/base/nsJSEnvironment.cpp
 --- a/dom/src/base/nsJSEnvironment.cpp
 +++ b/dom/src/base/nsJSEnvironment.cpp
-@@ -235,11 +235,11 @@ NS_HandleScriptError(nsIScriptGlobalObje
+@@ -341,11 +341,11 @@ NS_HandleScriptError(nsIScriptGlobalObje
                       nsEventStatus *aStatus)
  {
    PRBool called = PR_FALSE;
 -  nsCOMPtr<nsPIDOMWindow> win(do_QueryInterface(aScriptGlobal));
 +  nsPIDOMWindow* win(do_QueryInterface(aScriptGlobal));
    nsIDocShell *docShell = win ? win->GetDocShell() : nsnull;
    if (docShell) {
 -    nsCOMPtr<nsPresContext> presContext;
 -    docShell->GetPresContext(getter_AddRefs(presContext));
 +    nsPresContext* presContext = nsnull;
 +    docShell->GetPresContext(&presContext);
  
      static PRInt32 errorDepth; // Recursion prevention
      ++errorDepth;
-@@ -304,7 +304,7 @@ NS_ScriptErrorReporter(JSContext *cx,
+@@ -410,7 +410,7 @@ NS_ScriptErrorReporter(JSContext *cx,
          // Scope to make sure we're not using |win| in the rest of
          // this function when we should be using |globalObject|.  We
          // only need |win| for the event dispatch.
 -        nsCOMPtr<nsPIDOMWindow> win(do_QueryInterface(globalObject));
 +        nsPIDOMWindow* win(do_QueryInterface(globalObject));
          nsIDocShell *docShell = win ? win->GetDocShell() : nsnull;
          if (docShell &&
              (report->errorNumber != JSMSG_OUT_OF_MEMORY &&
-@@ -312,25 +312,25 @@ NS_ScriptErrorReporter(JSContext *cx,
+@@ -418,25 +418,25 @@ NS_ScriptErrorReporter(JSContext *cx,
            static PRInt32 errorDepth; // Recursion prevention
            ++errorDepth;
  
 -          nsCOMPtr<nsPresContext> presContext;
 -          docShell->GetPresContext(getter_AddRefs(presContext));
 +          nsPresContext* presContext = nsnull;
 +          docShell->GetPresContext(&presContext);
  
@@ -782,17 +782,17 @@ diff --git a/dom/src/base/nsJSEnvironmen
 +              nsIURI* errorURI = nsnull;
 +              NS_NewURI(&errorURI, report->filename);
 +
 +              nsIURI* codebase = nsnull;
 +              p->GetURI(&codebase);
  
                if (errorURI && codebase) {
                  // FIXME: Once error reports contain the origin of the
-@@ -364,19 +364,19 @@ NS_ScriptErrorReporter(JSContext *cx,
+@@ -470,19 +470,19 @@ NS_ScriptErrorReporter(JSContext *cx,
        if (status != nsEventStatus_eConsumeNoDefault) {
          // Make an nsIScriptError and populate it with information from
          // this error.
 -        nsCOMPtr<nsIScriptError> errorObject =
 +        nsIScriptError* errorObject =
            do_CreateInstance("@mozilla.org/scripterror;1");
  
          if (errorObject != nsnull) {
@@ -806,26 +806,26 @@ diff --git a/dom/src/base/nsJSEnvironmen
                         "nsIScriptObjectPrincipal");
 -          nsCOMPtr<nsIPrincipal> systemPrincipal;
 -          sSecurityManager->GetSystemPrincipal(getter_AddRefs(systemPrincipal));
 +          nsIPrincipal* systemPrincipal = nsnull;
 +          sSecurityManager->GetSystemPrincipal(&systemPrincipal);
            const char * category =
              scriptPrincipal->GetPrincipal() == systemPrincipal
              ? "chrome javascript"
-@@ -391,7 +391,7 @@ NS_ScriptErrorReporter(JSContext *cx,
+@@ -497,7 +497,7 @@ NS_ScriptErrorReporter(JSContext *cx,
                                   category);
  
            if (NS_SUCCEEDED(rv)) {
 -            nsCOMPtr<nsIConsoleService> consoleService =
 +            nsIConsoleService* consoleService =
                do_GetService(NS_CONSOLESERVICE_CONTRACTID, &rv);
              if (NS_SUCCEEDED(rv)) {
                consoleService->LogMessage(errorObject);
-@@ -454,18 +454,18 @@ LocaleToUnicode(JSContext *cx, char *src
+@@ -560,18 +560,18 @@ LocaleToUnicode(JSContext *cx, char *src
  
    if (!gDecoder) {
      // use app default locale
 -    nsCOMPtr<nsILocaleService> localeService = 
 +    nsILocaleService* localeService = 
        do_GetService(NS_LOCALESERVICE_CONTRACTID, &rv);
      if (NS_SUCCEEDED(rv)) {
 -      nsCOMPtr<nsILocale> appLocale;
@@ -838,26 +838,26 @@ diff --git a/dom/src/base/nsJSEnvironmen
            GetCategory(NS_LITERAL_STRING(NSILOCALE_TIME), localeStr);
          NS_ASSERTION(NS_SUCCEEDED(rv), "failed to get app locale info");
  
 -        nsCOMPtr<nsIPlatformCharset> platformCharset =
 +        nsIPlatformCharset* platformCharset =
            do_GetService(NS_PLATFORMCHARSET_CONTRACTID, &rv);
  
          if (NS_SUCCEEDED(rv)) {
-@@ -473,7 +473,7 @@ LocaleToUnicode(JSContext *cx, char *src
+@@ -579,7 +579,7 @@ LocaleToUnicode(JSContext *cx, char *src
            rv = platformCharset->GetDefaultCharsetForLocale(localeStr, charset);
            if (NS_SUCCEEDED(rv)) {
              // get/create unicode decoder for charset
 -            nsCOMPtr<nsICharsetConverterManager> ccm =
 +            nsICharsetConverterManager* ccm =
                do_GetService(NS_CHARSETCONVERTERMANAGER_CONTRACTID, &rv);
              if (NS_SUCCEEDED(rv))
                ccm->GetUnicodeDecoder(charset.get(), &gDecoder);
-@@ -558,15 +558,15 @@ LocaleCompare(JSContext *cx, JSString *s
+@@ -664,15 +664,15 @@ LocaleCompare(JSContext *cx, JSString *s
    nsresult rv;
  
    if (!gCollation) {
 -    nsCOMPtr<nsILocaleService> localeService =
 +    nsILocaleService* localeService =
        do_GetService(NS_LOCALESERVICE_CONTRACTID, &rv);
  
      if (NS_SUCCEEDED(rv)) {
@@ -867,51 +867,51 @@ diff --git a/dom/src/base/nsJSEnvironmen
 +      rv = localeService->GetApplicationLocale(&locale);
  
        if (NS_SUCCEEDED(rv)) {
 -        nsCOMPtr<nsICollationFactory> colFactory =
 +        nsICollationFactory* colFactory =
            do_CreateInstance(NS_COLLATIONFACTORY_CONTRACTID, &rv);
  
          if (NS_SUCCEEDED(rv)) {
-@@ -609,10 +609,10 @@ JSObject2Win(JSContext *cx, JSObject *ob
+@@ -715,10 +715,10 @@ JSObject2Win(JSContext *cx, JSObject *ob
      return nsnull;
    }
  
 -  nsCOMPtr<nsIXPConnectWrappedNative> wrapper;
 -  xpc->GetWrappedNativeOfJSObject(cx, obj, getter_AddRefs(wrapper));
 +  nsIXPConnectWrappedNative* wrapper = nsnull;
 +  xpc->GetWrappedNativeOfJSObject(cx, obj, &wrapper);
    if (wrapper) {
 -    nsCOMPtr<nsPIDOMWindow> win = do_QueryWrappedNative(wrapper);
 +    nsPIDOMWindow* win = do_QueryWrappedNative(wrapper);
      if (win) {
        return static_cast<nsGlobalWindow *>
                          (static_cast<nsPIDOMWindow *>(win));
-@@ -630,7 +630,7 @@ PrintWinURI(nsGlobalWindow *win)
+@@ -736,7 +736,7 @@ PrintWinURI(nsGlobalWindow *win)
      return;
    }
  
 -  nsCOMPtr<nsIDocument> doc = do_QueryInterface(win->GetExtantDocument());
 +  nsIDocument* doc = do_QueryInterface(win->GetExtantDocument());
    if (!doc) {
      printf("No document in the window.\n");
      return;
-@@ -661,8 +661,8 @@ PrintWinCodebase(nsGlobalWindow *win)
+@@ -767,8 +767,8 @@ PrintWinCodebase(nsGlobalWindow *win)
      return;
    }
  
 -  nsCOMPtr<nsIURI> uri;
 -  prin->GetURI(getter_AddRefs(uri));
 +  nsIURI* uri = nsnull;
 +  prin->GetURI(&uri);
    if (!uri) {
      printf("No URI, maybe the system principal.\n");
      return;
-@@ -746,18 +746,18 @@ nsJSContext::DOMBranchCallback(JSContext
+@@ -852,18 +852,18 @@ nsJSContext::DOMBranchCallback(JSContext
    // If we get here we're most likely executing an infinite loop in JS,
    // we'll tell the user about this and we'll give the user the option
    // of stopping the execution of the script.
 -  nsCOMPtr<nsPIDOMWindow> win(do_QueryInterface(ctx->GetGlobalObject()));
 +  nsPIDOMWindow* win(do_QueryInterface(ctx->GetGlobalObject()));
    NS_ENSURE_TRUE(win, JS_TRUE);
  
    nsIDocShell *docShell = win->GetDocShell();
@@ -924,104 +924,104 @@ diff --git a/dom/src/base/nsJSEnvironmen
    // Get the nsIPrompt interface from the docshell
 -  nsCOMPtr<nsIPrompt> prompt;
 -  ireq->GetInterface(NS_GET_IID(nsIPrompt), getter_AddRefs(prompt));
 +  nsIPrompt* prompt = nsnull;
 +  ireq->GetInterface(NS_GET_IID(nsIPrompt), (void**)&prompt);
    NS_ENSURE_TRUE(prompt, JS_TRUE);
  
    nsresult rv;
-@@ -769,12 +769,12 @@ nsJSContext::DOMBranchCallback(JSContext
+@@ -875,12 +875,12 @@ nsJSContext::DOMBranchCallback(JSContext
    if (debugPossible) {
      PRBool jsds_IsOn = PR_FALSE;
      const char jsdServiceCtrID[] = "@mozilla.org/js/jsd/debugger-service;1";
 -    nsCOMPtr<jsdIExecutionHook> jsdHook;  
 -    nsCOMPtr<jsdIDebuggerService> jsds = do_GetService(jsdServiceCtrID, &rv);
 +    jsdIExecutionHook* jsdHook = nsnull;  
 +    jsdIDebuggerService* jsds = do_GetService(jsdServiceCtrID, &rv);
    
      // Check if there's a user for the debugger service that's 'on' for us
      if (NS_SUCCEEDED(rv)) {
 -      jsds->GetDebuggerHook(getter_AddRefs(jsdHook));
 +      jsds->GetDebuggerHook(&jsdHook);
        jsds->GetIsOn(&jsds_IsOn);
        if (jsds_IsOn) { // If this is not true, the next call would start jsd...
          rv = jsds->OnForRuntime(cx->runtime);
-@@ -790,13 +790,13 @@ nsJSContext::DOMBranchCallback(JSContext
+@@ -896,13 +896,13 @@ nsJSContext::DOMBranchCallback(JSContext
  #endif
  
    // Get localizable strings
 -  nsCOMPtr<nsIStringBundleService>
 +  nsIStringBundleService*
      stringService(do_GetService(NS_STRINGBUNDLE_CONTRACTID));
    if (!stringService)
      return JS_TRUE;
  
 -  nsCOMPtr<nsIStringBundle> bundle;
 -  stringService->CreateBundle(kDOMStringBundleURL, getter_AddRefs(bundle));
 +  nsIStringBundle* bundle = nsnull;
 +  stringService->CreateBundle(kDOMStringBundleURL, &bundle);
    if (!bundle)
      return JS_TRUE;
    
-@@ -910,7 +910,7 @@ nsJSContext::JSOptionChangedCallback(con
+@@ -1019,7 +1019,7 @@ nsJSContext::JSOptionChangedCallback(con
    // need to enable this directly from InitContext
    if ((newDefaultJSOptions & JSOPTION_STRICT) == 0) {
      nsIScriptGlobalObject *global = context->GetGlobalObject();
 -    nsCOMPtr<nsIDOMChromeWindow> chromeWindow(do_QueryInterface(global));
 +    nsIDOMChromeWindow* chromeWindow(do_QueryInterface(global));
      if (chromeWindow)
        newDefaultJSOptions |= JSOPTION_STRICT;
    }
-@@ -1080,7 +1080,7 @@ nsJSContext::EvaluateStringWithValue(con
+@@ -1202,7 +1202,7 @@ nsJSContext::EvaluateStringWithValue(con
      nsIScriptGlobalObject *global = GetGlobalObject();
      if (!global)
        return NS_ERROR_FAILURE;
 -    nsCOMPtr<nsIScriptObjectPrincipal> objPrincipal =
 +    nsIScriptObjectPrincipal* objPrincipal =
        do_QueryInterface(global, &rv);
      if (NS_FAILED(rv))
        return NS_ERROR_FAILURE;
-@@ -1105,7 +1105,7 @@ nsJSContext::EvaluateStringWithValue(con
+@@ -1227,7 +1227,7 @@ nsJSContext::EvaluateStringWithValue(con
    // from native code via XPConnect uses the right context.  Do this whether
    // or not the SecurityManager said "ok", in order to simplify control flow
    // below where we pop before returning.
 -  nsCOMPtr<nsIJSContextStack> stack =
 +  nsIJSContextStack* stack =
             do_GetService("@mozilla.org/js/xpc/ContextStack;1", &rv);
    if (NS_FAILED(rv) || NS_FAILED(stack->Push(mContext))) {
      JSPRINCIPALS_DROP(mContext, jsprin);
-@@ -1278,7 +1278,7 @@ nsJSContext::EvaluateString(const nsAStr
+@@ -1400,7 +1400,7 @@ nsJSContext::EvaluateString(const nsAStr
      aPrincipal->GetJSPrincipals(mContext, &jsprin);
    }
    else {
 -    nsCOMPtr<nsIScriptObjectPrincipal> objPrincipal =
 +    nsIScriptObjectPrincipal* objPrincipal =
        do_QueryInterface(GetGlobalObject(), &rv);
      if (NS_FAILED(rv))
        return NS_ERROR_FAILURE;
-@@ -1302,7 +1302,7 @@ nsJSContext::EvaluateString(const nsAStr
+@@ -1424,7 +1424,7 @@ nsJSContext::EvaluateString(const nsAStr
    // from native code via XPConnect uses the right context.  Do this whether
    // or not the SecurityManager said "ok", in order to simplify control flow
    // below where we pop before returning.
 -  nsCOMPtr<nsIJSContextStack> stack =
 +  nsIJSContextStack* stack =
             do_GetService("@mozilla.org/js/xpc/ContextStack;1", &rv);
    if (NS_FAILED(rv) || NS_FAILED(stack->Push(mContext))) {
      JSPRINCIPALS_DROP(mContext, jsprin);
-@@ -1511,7 +1511,7 @@ nsJSContext::ExecuteScript(void *aScript
+@@ -1633,7 +1633,7 @@ nsJSContext::ExecuteScript(void *aScript
  
    // Push our JSContext on our thread's context stack, in case native code
    // called from JS calls back into JS via XPConnect.
 -  nsCOMPtr<nsIJSContextStack> stack =
 +  nsIJSContextStack* stack =
             do_GetService("@mozilla.org/js/xpc/ContextStack;1", &rv);
    if (NS_FAILED(rv) || NS_FAILED(stack->Push(mContext))) {
      return NS_ERROR_FAILURE;
-@@ -1594,16 +1594,16 @@ nsJSContext::JSObjectFromInterface(nsISu
+@@ -1716,16 +1716,16 @@ nsJSContext::JSObjectFromInterface(nsISu
    }
    // Get the jsobject associated with this target
    nsresult rv;
 -  nsCOMPtr<nsIXPConnectJSObjectHolder> jsholder;
 +  nsIXPConnectJSObjectHolder* jsholder = nsnull;
    rv = nsContentUtils::XPConnect()->WrapNative(mContext, (JSObject *)aScope,
                                                 aTarget,
                                                 NS_GET_IID(nsISupports),
@@ -1032,76 +1032,67 @@ diff --git a/dom/src/base/nsJSEnvironmen
 -  nsCOMPtr<nsIXPConnectWrappedNative> wrapper = do_QueryInterface(jsholder);
 +  nsIXPConnectWrappedNative* wrapper = do_QueryInterface(jsholder);
    NS_ASSERTION(wrapper, "wrapper must impl nsIXPConnectWrappedNative");
 -  nsCOMPtr<nsISupports> targetSupp = do_QueryInterface(aTarget);
 +  nsISupports* targetSupp = do_QueryInterface(aTarget);
    NS_ASSERTION(wrapper->Native() == targetSupp, "Native should be the target!");
  #endif
    return jsholder->GetJSObject(aRet);
-@@ -1671,7 +1671,7 @@ nsJSContext::CompileFunction(void* aTarg
+@@ -1793,7 +1793,7 @@ nsJSContext::CompileFunction(void* aTarg
    nsIScriptGlobalObject *global = GetGlobalObject();
    if (global) {
      // XXXbe why the two-step QI? speed up via a new GetGlobalObjectData func?
 -    nsCOMPtr<nsIScriptObjectPrincipal> globalData = do_QueryInterface(global);
 +    nsIScriptObjectPrincipal* globalData = do_QueryInterface(global);
      if (globalData) {
        nsIPrincipal *prin = globalData->GetPrincipal();
        if (!prin)
-@@ -1717,7 +1717,7 @@ nsJSContext::CallEventHandler(nsISupport
-   // This may not be strictly needed, but lets do it as an extra level
-   // of safety. Ideally the check in nsGenericElement::AddScriptEventListener
-   // is enough.
--  nsCOMPtr<nsINode> nodeTarget = do_QueryInterface(aTarget);
-+  nsINode* nodeTarget = do_QueryInterface(aTarget);
-   if (nodeTarget) {
-     nsIDocument* doc = nodeTarget->GetOwnerDoc();
-     if (!doc || doc->IsLoadedAsData()) {
-@@ -1739,7 +1739,7 @@ nsJSContext::CallEventHandler(nsISupport
+@@ -1850,7 +1850,7 @@ nsJSContext::CallEventHandler(nsISupport
    // xxxmarkh - this comment is no longer true - principals are not used at
    // all now, and never were in some cases.
  
 -  nsCOMPtr<nsIJSContextStack> stack =
 +  nsIJSContextStack* stack =
      do_GetService("@mozilla.org/js/xpc/ContextStack;1", &rv);
    if (NS_FAILED(rv) || NS_FAILED(stack->Push(mContext)))
      return NS_ERROR_FAILURE;
-@@ -1750,7 +1750,7 @@ nsJSContext::CallEventHandler(nsISupport
+@@ -1861,7 +1861,7 @@ nsJSContext::CallEventHandler(nsISupport
      // We're not done yet!  Some event listeners are confused about their
      // script context, so check whether we might actually be the wrong script
      // context.  To be safe, do CheckFunctionAccess checks for both.
 -    nsCOMPtr<nsIContent> content = do_QueryInterface(aTarget);
 +    nsIContent* content = do_QueryInterface(aTarget);
      if (content) {
        // XXXbz XBL2/sXBL issue
        nsIDocument* ownerDoc = content->GetOwnerDoc();
-@@ -1865,7 +1865,7 @@ nsJSContext::BindCompiledEventHandler(ns
+@@ -1976,7 +1976,7 @@ nsJSContext::BindCompiledEventHandler(ns
  
    // Push our JSContext on our thread's context stack, in case native code
    // called from JS calls back into JS via XPConnect.
 -  nsCOMPtr<nsIJSContextStack> stack =
 +  nsIJSContextStack* stack =
             do_GetService("@mozilla.org/js/xpc/ContextStack;1", &rv);
    if (NS_FAILED(rv) || NS_FAILED(stack->Push(mContext))) {
      return NS_ERROR_FAILURE;
-@@ -2081,11 +2081,11 @@ nsJSContext::GetGlobalObject()
+@@ -2192,11 +2192,11 @@ nsJSContext::GetGlobalObject()
      return nsnull;
    }
  
 -  nsCOMPtr<nsIScriptGlobalObject> sgo;
 +  nsIScriptGlobalObject* sgo = nsnull;
    nsISupports *priv =
      (nsISupports *)::JS_GetPrivate(mContext, global);
  
 -  nsCOMPtr<nsIXPConnectWrappedNative> wrapped_native =
 +  nsIXPConnectWrappedNative* wrapped_native =
      do_QueryInterface(priv);
  
    if (wrapped_native) {
-@@ -2116,17 +2116,16 @@ nsJSContext::CreateNativeGlobalForInner(
+@@ -2227,17 +2227,16 @@ nsJSContext::CreateNativeGlobalForInner(
  {
    nsIXPConnect *xpc = nsContentUtils::XPConnect();
    PRUint32 flags = aIsChrome? nsIXPConnect::FLAG_SYSTEM_GLOBAL_OBJECT : 0;
 -  nsCOMPtr<nsIXPConnectJSObjectHolder> jsholder;
 +  nsIXPConnectJSObjectHolder* jsholder = nsnull;
    nsresult rv = xpc->
            InitClassesWithNewWrappedGlobal(mContext,
                                            aNewInner, NS_GET_IID(nsISupports),
@@ -1112,42 +1103,44 @@ diff --git a/dom/src/base/nsJSEnvironmen
      return rv;
    jsholder->GetJSObject(reinterpret_cast<JSObject **>(aNativeGlobal));
 -  *aHolder = jsholder.get();
 -  NS_ADDREF(*aHolder);
 +  *aHolder = jsholder;
    return NS_OK;
  }
  
-@@ -2210,13 +2209,13 @@ nsJSContext::InitContext(nsIScriptGlobal
+@@ -2311,7 +2310,7 @@ nsJSContext::InitContext(nsIScriptGlobal
  
    JSObject *global = ::JS_GetGlobalObject(mContext);
  
 -  nsCOMPtr<nsIXPConnectJSObjectHolder> holder;
 +  nsIXPConnectJSObjectHolder* holder = nsnull;
  
    // If there's already a global object in mContext we won't tell
    // XPConnect to wrap aGlobalObject since it's already wrapped.
+@@ -2319,7 +2318,7 @@ nsJSContext::InitContext(nsIScriptGlobal
+   nsresult rv;
  
    if (!global) {
 -    nsCOMPtr<nsIDOMChromeWindow> chromeWindow(do_QueryInterface(aGlobalObject));
 +    nsIDOMChromeWindow* chromeWindow(do_QueryInterface(aGlobalObject));
      PRUint32 flags = 0;
      
      if (chromeWindow) {
-@@ -2235,7 +2234,7 @@ nsJSContext::InitContext(nsIScriptGlobal
+@@ -2338,7 +2337,7 @@ nsJSContext::InitContext(nsIScriptGlobal
      rv = xpc->InitClassesWithNewWrappedGlobal(mContext, aGlobalObject,
                                                NS_GET_IID(nsISupports),
                                                flags,
 -                                              getter_AddRefs(holder));
 +                                              &holder);
      NS_ENSURE_SUCCESS(rv, rv);
  
      // Now check whether we need to grab a pointer to the
-@@ -2254,15 +2253,15 @@ nsJSContext::InitContext(nsIScriptGlobal
+@@ -2357,15 +2356,15 @@ nsJSContext::InitContext(nsIScriptGlobal
      rv = xpc->InitClasses(mContext, global);
      NS_ENSURE_SUCCESS(rv, rv);
  
 -    nsCOMPtr<nsIClassInfo> ci(do_QueryInterface(aGlobalObject));
 +    nsIClassInfo* ci(do_QueryInterface(aGlobalObject));
  
      if (ci) {
        rv = xpc->WrapNative(mContext, global, aGlobalObject,
@@ -1156,35 +1149,35 @@ diff --git a/dom/src/base/nsJSEnvironmen
 +                           &holder);
        NS_ENSURE_SUCCESS(rv, rv);
  
 -      nsCOMPtr<nsIXPConnectWrappedNative> wrapper(do_QueryInterface(holder));
 +      nsIXPConnectWrappedNative* wrapper(do_QueryInterface(holder));
        NS_ENSURE_TRUE(wrapper, NS_ERROR_FAILURE);
  
        rv = wrapper->RefreshPrototype();
-@@ -2337,7 +2336,7 @@ nsJSContext::ConvertSupportsTojsvals(nsI
+@@ -2441,7 +2440,7 @@ nsJSContext::ConvertSupportsTojsvals(nsI
    nsresult rv = NS_OK;
  
    // If the array implements nsIJSArgArray, just grab the values directly.
 -  nsCOMPtr<nsIJSArgArray> fastArray = do_QueryInterface(aArgs);
 +  nsIJSArgArray* fastArray = do_QueryInterface(aArgs);
    if (fastArray != nsnull) {
      *aMarkp = nsnull;
      return fastArray->GetArgs(aArgc, aArgv);
-@@ -2358,7 +2357,7 @@ nsJSContext::ConvertSupportsTojsvals(nsI
+@@ -2462,7 +2461,7 @@ nsJSContext::ConvertSupportsTojsvals(nsI
    PRUint32 argCtr, argCount;
    // This general purpose function may need to convert an arg array
    // (window.arguments, event-handler args) and a generic property.
 -  nsCOMPtr<nsIArray> argsArray(do_QueryInterface(aArgs));
 +  nsIArray* argsArray(do_QueryInterface(aArgs));
  
    if (argsArray) {
      rv = argsArray->GetLength(&argCount);
-@@ -2374,15 +2373,15 @@ nsJSContext::ConvertSupportsTojsvals(nsI
+@@ -2478,15 +2477,15 @@ nsJSContext::ConvertSupportsTojsvals(nsI
  
    if (argsArray) {
      for (argCtr = 0; argCtr < argCount && NS_SUCCEEDED(rv); argCtr++) {
 -      nsCOMPtr<nsISupports> arg;
 +      nsISupports* arg = nsnull;
        jsval *thisval = argv + argCtr;
        argsArray->QueryElementAt(argCtr, NS_GET_IID(nsISupports),
 -                                getter_AddRefs(arg));
@@ -1193,17 +1186,17 @@ diff --git a/dom/src/base/nsJSEnvironmen
          *thisval = JSVAL_NULL;
          continue;
        }
 -      nsCOMPtr<nsIVariant> variant(do_QueryInterface(arg));
 +      nsIVariant* variant(do_QueryInterface(arg));
        if (variant != nsnull) {
          rv = xpc->VariantToJS(mContext, (JSObject *)aScope, variant, 
                                thisval);
-@@ -2397,14 +2396,14 @@ nsJSContext::ConvertSupportsTojsvals(nsI
+@@ -2501,14 +2500,14 @@ nsJSContext::ConvertSupportsTojsvals(nsI
  #ifdef NS_DEBUG
            // but first, check its not another nsISupportsPrimitive, as
            // these are now deprecated for use with script contexts.
 -          nsCOMPtr<nsISupportsPrimitive> prim(do_QueryInterface(arg));
 +          nsISupportsPrimitive* prim(do_QueryInterface(arg));
            NS_ASSERTION(prim == nsnull,
                         "Don't pass nsISupportsPrimitives - use nsIVariant!");
  #endif
@@ -1211,134 +1204,134 @@ diff --git a/dom/src/base/nsJSEnvironmen
 +          nsIXPConnectJSObjectHolder* wrapper = nsnull;
            rv = xpc->WrapNative(mContext, (JSObject *)aScope, arg,
                                 NS_GET_IID(nsISupports),
 -                               getter_AddRefs(wrapper));
 +                               &wrapper);
            if (NS_SUCCEEDED(rv)) {
              JSObject *obj;
              rv = wrapper->GetJSObject(&obj);
-@@ -2416,7 +2415,7 @@ nsJSContext::ConvertSupportsTojsvals(nsI
+@@ -2520,7 +2519,7 @@ nsJSContext::ConvertSupportsTojsvals(nsI
        }
      }
    } else {
 -    nsCOMPtr<nsIVariant> variant(do_QueryInterface(aArgs));
 +    nsIVariant* variant(do_QueryInterface(aArgs));
      if (variant)
        rv = xpc->VariantToJS(mContext, (JSObject *)aScope, variant, argv);
      else {
-@@ -2439,7 +2438,7 @@ nsJSContext::AddSupportsPrimitiveTojsval
+@@ -2543,7 +2542,7 @@ nsJSContext::AddSupportsPrimitiveTojsval
  {
    NS_PRECONDITION(aArg, "Empty arg");
  
 -  nsCOMPtr<nsISupportsPrimitive> argPrimitive(do_QueryInterface(aArg));
 +  nsISupportsPrimitive* argPrimitive(do_QueryInterface(aArg));
    if (!argPrimitive)
      return NS_ERROR_NO_INTERFACE;
  
-@@ -2449,7 +2448,7 @@ nsJSContext::AddSupportsPrimitiveTojsval
+@@ -2553,7 +2552,7 @@ nsJSContext::AddSupportsPrimitiveTojsval
  
    switch(type) {
      case nsISupportsPrimitive::TYPE_CSTRING : {
 -      nsCOMPtr<nsISupportsCString> p(do_QueryInterface(argPrimitive));
 +      nsISupportsCString* p(do_QueryInterface(argPrimitive));
        NS_ENSURE_TRUE(p, NS_ERROR_UNEXPECTED);
  
        nsCAutoString data;
-@@ -2465,7 +2464,7 @@ nsJSContext::AddSupportsPrimitiveTojsval
+@@ -2569,7 +2568,7 @@ nsJSContext::AddSupportsPrimitiveTojsval
        break;
      }
      case nsISupportsPrimitive::TYPE_STRING : {
 -      nsCOMPtr<nsISupportsString> p(do_QueryInterface(argPrimitive));
 +      nsISupportsString* p(do_QueryInterface(argPrimitive));
        NS_ENSURE_TRUE(p, NS_ERROR_UNEXPECTED);
  
        nsAutoString data;
-@@ -2484,7 +2483,7 @@ nsJSContext::AddSupportsPrimitiveTojsval
+@@ -2588,7 +2587,7 @@ nsJSContext::AddSupportsPrimitiveTojsval
        break;
      }
      case nsISupportsPrimitive::TYPE_PRBOOL : {
 -      nsCOMPtr<nsISupportsPRBool> p(do_QueryInterface(argPrimitive));
 +      nsISupportsPRBool* p(do_QueryInterface(argPrimitive));
        NS_ENSURE_TRUE(p, NS_ERROR_UNEXPECTED);
  
        PRBool data;
-@@ -2496,7 +2495,7 @@ nsJSContext::AddSupportsPrimitiveTojsval
+@@ -2600,7 +2599,7 @@ nsJSContext::AddSupportsPrimitiveTojsval
        break;
      }
      case nsISupportsPrimitive::TYPE_PRUINT8 : {
 -      nsCOMPtr<nsISupportsPRUint8> p(do_QueryInterface(argPrimitive));
 +      nsISupportsPRUint8* p(do_QueryInterface(argPrimitive));
        NS_ENSURE_TRUE(p, NS_ERROR_UNEXPECTED);
  
        PRUint8 data;
-@@ -2508,7 +2507,7 @@ nsJSContext::AddSupportsPrimitiveTojsval
+@@ -2612,7 +2611,7 @@ nsJSContext::AddSupportsPrimitiveTojsval
        break;
      }
      case nsISupportsPrimitive::TYPE_PRUINT16 : {
 -      nsCOMPtr<nsISupportsPRUint16> p(do_QueryInterface(argPrimitive));
 +      nsISupportsPRUint16* p(do_QueryInterface(argPrimitive));
        NS_ENSURE_TRUE(p, NS_ERROR_UNEXPECTED);
  
        PRUint16 data;
-@@ -2520,7 +2519,7 @@ nsJSContext::AddSupportsPrimitiveTojsval
+@@ -2624,7 +2623,7 @@ nsJSContext::AddSupportsPrimitiveTojsval
        break;
      }
      case nsISupportsPrimitive::TYPE_PRUINT32 : {
 -      nsCOMPtr<nsISupportsPRUint32> p(do_QueryInterface(argPrimitive));
 +      nsISupportsPRUint32* p(do_QueryInterface(argPrimitive));
        NS_ENSURE_TRUE(p, NS_ERROR_UNEXPECTED);
  
        PRUint32 data;
-@@ -2532,7 +2531,7 @@ nsJSContext::AddSupportsPrimitiveTojsval
+@@ -2636,7 +2635,7 @@ nsJSContext::AddSupportsPrimitiveTojsval
        break;
      }
      case nsISupportsPrimitive::TYPE_CHAR : {
 -      nsCOMPtr<nsISupportsChar> p(do_QueryInterface(argPrimitive));
 +      nsISupportsChar* p(do_QueryInterface(argPrimitive));
        NS_ENSURE_TRUE(p, NS_ERROR_UNEXPECTED);
  
        char data;
-@@ -2547,7 +2546,7 @@ nsJSContext::AddSupportsPrimitiveTojsval
+@@ -2651,7 +2650,7 @@ nsJSContext::AddSupportsPrimitiveTojsval
        break;
      }
      case nsISupportsPrimitive::TYPE_PRINT16 : {
 -      nsCOMPtr<nsISupportsPRInt16> p(do_QueryInterface(argPrimitive));
 +      nsISupportsPRInt16* p(do_QueryInterface(argPrimitive));
        NS_ENSURE_TRUE(p, NS_ERROR_UNEXPECTED);
  
        PRInt16 data;
-@@ -2559,7 +2558,7 @@ nsJSContext::AddSupportsPrimitiveTojsval
+@@ -2663,7 +2662,7 @@ nsJSContext::AddSupportsPrimitiveTojsval
        break;
      }
      case nsISupportsPrimitive::TYPE_PRINT32 : {
 -      nsCOMPtr<nsISupportsPRInt32> p(do_QueryInterface(argPrimitive));
 +      nsISupportsPRInt32* p(do_QueryInterface(argPrimitive));
        NS_ENSURE_TRUE(p, NS_ERROR_UNEXPECTED);
  
        PRInt32 data;
-@@ -2571,7 +2570,7 @@ nsJSContext::AddSupportsPrimitiveTojsval
+@@ -2675,7 +2674,7 @@ nsJSContext::AddSupportsPrimitiveTojsval
        break;
      }
      case nsISupportsPrimitive::TYPE_FLOAT : {
 -      nsCOMPtr<nsISupportsFloat> p(do_QueryInterface(argPrimitive));
 +      nsISupportsFloat* p(do_QueryInterface(argPrimitive));
        NS_ENSURE_TRUE(p, NS_ERROR_UNEXPECTED);
  
        float data;
-@@ -2585,7 +2584,7 @@ nsJSContext::AddSupportsPrimitiveTojsval
+@@ -2689,7 +2688,7 @@ nsJSContext::AddSupportsPrimitiveTojsval
        break;
      }
      case nsISupportsPrimitive::TYPE_DOUBLE : {
 -      nsCOMPtr<nsISupportsDouble> p(do_QueryInterface(argPrimitive));
 +      nsISupportsDouble* p(do_QueryInterface(argPrimitive));
        NS_ENSURE_TRUE(p, NS_ERROR_UNEXPECTED);
  
        double data;
-@@ -2599,25 +2598,25 @@ nsJSContext::AddSupportsPrimitiveTojsval
+@@ -2703,25 +2702,25 @@ nsJSContext::AddSupportsPrimitiveTojsval
        break;
      }
      case nsISupportsPrimitive::TYPE_INTERFACE_POINTER : {
 -      nsCOMPtr<nsISupportsInterfacePointer> p(do_QueryInterface(argPrimitive));
 +      nsISupportsInterfacePointer* p(do_QueryInterface(argPrimitive));
        NS_ENSURE_TRUE(p, NS_ERROR_UNEXPECTED);
  
 -      nsCOMPtr<nsISupports> data;
@@ -1360,60 +1353,60 @@ diff --git a/dom/src/base/nsJSEnvironmen
 -      nsCOMPtr<nsIXPConnectJSObjectHolder> wrapper;
 +      nsIXPConnectJSObjectHolder* wrapper = nsnull;
        rv = xpc->WrapNative(cx, ::JS_GetGlobalObject(cx), data,
 -                           *iid, getter_AddRefs(wrapper));
 +                           *iid, &wrapper);
        NS_ENSURE_SUCCESS(rv, rv);
  
        JSObject *obj;
-@@ -3303,11 +3302,10 @@ nsresult
+@@ -3460,11 +3459,10 @@ nsresult
  nsresult
  nsJSRuntime::CreateContext(nsIScriptContext **aContext)
  {
 -  nsCOMPtr<nsIScriptContext> scriptContext;
 +  nsIScriptContext* scriptContext = nsnull;
  
    *aContext = new nsJSContext(sRuntime);
    NS_ENSURE_TRUE(*aContext, NS_ERROR_OUT_OF_MEMORY);
 -  NS_ADDREF(*aContext);
    return NS_OK;
  }
  
-@@ -3386,10 +3384,10 @@ ObjectPrincipalFinder(JSContext *cx, JSO
+@@ -3547,10 +3545,10 @@ ObjectPrincipalFinder(JSContext *cx, JSO
    if (!sSecurityManager)
      return nsnull;
  
 -  nsCOMPtr<nsIPrincipal> principal;
 +  nsIPrincipal* principal = nsnull;
    nsresult rv =
      sSecurityManager->GetObjectPrincipal(cx, obj,
 -                                         getter_AddRefs(principal));
 +                                         &principal);
  
    if (NS_FAILED(rv) || !principal) {
      return nsnull;
-@@ -3538,7 +3536,6 @@ nsresult NS_CreateJSRuntime(nsIScriptRun
+@@ -3730,7 +3728,6 @@ nsresult NS_CreateJSRuntime(nsIScriptRun
    *aRuntime = new nsJSRuntime();
    if (*aRuntime == nsnull)
      return NS_ERROR_OUT_OF_MEMORY;
 -  NS_IF_ADDREF(*aRuntime);
    return NS_OK;
  }
  
-@@ -3548,7 +3545,7 @@ nsresult NS_CreateJSRuntime(nsIScriptRun
+@@ -3740,7 +3737,7 @@ nsresult NS_CreateJSRuntime(nsIScriptRun
  // to/from nsISupports.
  // When consumed by non-JS (eg, another script language), conversion is done
  // on-the-fly.
 -class nsJSArgArray : public nsIJSArgArray, public nsIArray {
 +class nsJSArgArray : public XPCOMGCFinalizedObject, public nsIJSArgArray, public nsIArray {
  public:
    nsJSArgArray(JSContext *aContext, PRUint32 argc, jsval *argv, nsresult *prv);
    ~nsJSArgArray();
-@@ -3684,7 +3681,6 @@ nsresult NS_CreateJSArgv(JSContext *aCon
+@@ -3871,7 +3868,6 @@ nsresult NS_CreateJSArgv(JSContext *aCon
    if (ret == nsnull)
      return NS_ERROR_OUT_OF_MEMORY;
    if (NS_FAILED(rv)) {
 -    delete ret;
      return rv;
    }
    return ret->QueryInterface(NS_GET_IID(nsIArray), (void **)aArray);
 diff --git a/dom/src/base/nsJSTimeoutHandler.cpp b/dom/src/base/nsJSTimeoutHandler.cpp
@@ -1423,47 +1416,29 @@ diff --git a/dom/src/base/nsJSTimeoutHan
  static const char kSetTimeoutStr[] = "setTimeout";
  
  // Our JS nsIScriptTimeoutHandler implementation.
 -class nsJSScriptTimeoutHandler: public nsIScriptTimeoutHandler
 +class nsJSScriptTimeoutHandler: public XPCOMGCFinalizedObject, public nsIScriptTimeoutHandler
  {
  public:
    // nsISupports
-@@ -138,7 +138,7 @@ nsJSScriptTimeoutHandler::ReleaseJSObjec
- nsJSScriptTimeoutHandler::ReleaseJSObjects()
- {
-   if (mExpr || mFunObj) {
--    nsCOMPtr<nsIScriptContext> scx = mContext;
-+    nsIScriptContext* scx = mContext;
-     JSRuntime *rt = nsnull;
- 
-     if (scx) {
-@@ -160,7 +160,7 @@ nsJSScriptTimeoutHandler::ReleaseJSObjec
-       // window having a context. It would be good to remedy this
-       // workable but clumsy situation someday.
- 
--      nsCOMPtr<nsIJSRuntimeService> rtsvc =
-+      nsIJSRuntimeService* rtsvc =
-         do_GetService("@mozilla.org/js/xpc/RuntimeService;1");
- 
-       if (rtsvc) {
-@@ -201,9 +201,9 @@ nsJSScriptTimeoutHandler::Init(nsIScript
+@@ -168,9 +168,9 @@ nsJSScriptTimeoutHandler::Init(nsIScript
  
    mContext = aContext;
  
 -  nsCOMPtr<nsIXPCNativeCallContext> ncc;
 +  nsIXPCNativeCallContext* ncc = nsnull;
    nsresult rv = nsContentUtils::XPConnect()->
 -    GetCurrentNativeCallContext(getter_AddRefs(ncc));
 +    GetCurrentNativeCallContext(&ncc);
    NS_ENSURE_SUCCESS(rv, rv);
  
    if (!ncc)
-@@ -293,16 +293,16 @@ nsJSScriptTimeoutHandler::Init(nsIScript
+@@ -258,16 +258,16 @@ nsJSScriptTimeoutHandler::Init(nsIScript
      // Create our arg array - leave an extra slot for a secret final argument
      // that indicates to the called function how "late" the timeout is.  We
      // will fill that in when SetLateness is called.
 -    nsCOMPtr<nsIArray> array;
 +    nsIArray* array = nsnull;
      rv = NS_CreateJSArgv(cx, (argc > 1) ? argc - 1 : argc, nsnull,
 -                         getter_AddRefs(array));
 +                         &array);
@@ -1473,26 +1448,26 @@ diff --git a/dom/src/base/nsJSTimeoutHan
  
      PRUint32 dummy;
      jsval *jsargv = nsnull;
 -    nsCOMPtr<nsIJSArgArray> jsarray(do_QueryInterface(array));
 +    nsIJSArgArray* jsarray(do_QueryInterface(array));
      jsarray->GetArgs(&dummy, reinterpret_cast<void **>(&jsargv));
  
      // must have worked - we own the impl! :)
-@@ -321,7 +321,7 @@ nsJSScriptTimeoutHandler::Init(nsIScript
+@@ -286,7 +286,7 @@ nsJSScriptTimeoutHandler::Init(nsIScript
  
  void nsJSScriptTimeoutHandler::SetLateness(PRIntervalTime aHowLate)
  {
 -  nsCOMPtr<nsIJSArgArray> jsarray(do_QueryInterface(mArgv));
 +  nsIJSArgArray* jsarray(do_QueryInterface(mArgv));
    if (jsarray) {
      PRUint32 argc;
      jsval *jsargv;
-@@ -353,11 +353,10 @@ nsresult NS_CreateJSTimeoutHandler(nsISc
+@@ -318,11 +318,10 @@ nsresult NS_CreateJSTimeoutHandler(nsISc
  
    nsresult rv = handler->Init(aContext, aIsInterval, aInterval);
    if (NS_FAILED(rv)) {
 -    delete handler;
      return rv;
    }
  
 -  NS_ADDREF(*aRet = handler);
@@ -2022,60 +1997,60 @@ diff --git a/js/src/xpconnect/src/xpcwra
      }
  
      // Do the same for the wrapper specific scriptable
 -    nsCOMPtr<nsIXPCScriptable> helper(do_QueryInterface(obj));
 +    nsIXPCScriptable* helper(do_QueryInterface(obj));
      if(helper)
      {
          JSUint32 flags;
-@@ -938,13 +938,6 @@ XPCWrappedNative::SystemIsBeingShutDown(
+@@ -934,13 +934,6 @@ XPCWrappedNative::SystemIsBeingShutDown(
      if(HasProto())
          proto->SystemIsBeingShutDown(cx);
  
 -    if(mScriptableInfo &&
 -       (!HasProto() ||
 -        (proto && proto->GetScriptableInfo() != mScriptableInfo)))
 -    {
 -        delete mScriptableInfo;
 -    }
 -
      // cleanup the tearoffs...
  
      XPCWrappedNativeTearOffChunk* chunk;
-@@ -1416,8 +1409,8 @@ XPCWrappedNative::InitTearOff(XPCCallCon
+@@ -1412,8 +1405,8 @@ XPCWrappedNative::InitTearOff(XPCCallCon
          // Guard against trying to build a tearoff for a shared nsIClassInfo.
          if(iid->Equals(NS_GET_IID(nsIClassInfo)))
          {
 -            nsCOMPtr<nsISupports> alternate_identity(do_QueryInterface(obj));
 -            if(alternate_identity.get() != identity)
 +            nsISupports* alternate_identity(do_QueryInterface(obj));
 +            if(alternate_identity != identity)
              {
                  NS_RELEASE(obj);
                  aTearOff->SetInterface(nsnull);
-@@ -1441,7 +1434,7 @@ XPCWrappedNative::InitTearOff(XPCCallCon
+@@ -1437,7 +1430,7 @@ XPCWrappedNative::InitTearOff(XPCCallCon
          // The code in this block also does a check for the double wrapped
          // nsIPropertyBag case.
  
 -        nsCOMPtr<nsIXPConnectWrappedJS> wrappedJS(do_QueryInterface(obj));
 +        nsIXPConnectWrappedJS* wrappedJS(do_QueryInterface(obj));
          if(wrappedJS)
          {
              JSObject* jso = nsnull;
-@@ -2402,7 +2395,7 @@ XPCWrappedNative::GetObjectPrincipal() c
+@@ -2395,7 +2388,7 @@ XPCWrappedNative::GetObjectPrincipal() c
  {
      nsIPrincipal* principal = GetScope()->GetPrincipal();
  #ifdef DEBUG
 -    nsCOMPtr<nsIScriptObjectPrincipal> objPrin(do_QueryInterface(mIdentity));
 +    nsIScriptObjectPrincipal* objPrin(do_QueryInterface(mIdentity));
      NS_ASSERTION(!objPrin || objPrin->GetPrincipal() == principal,
                   "Principal mismatch.  Expect bad things to happen");
  #endif
-@@ -2684,8 +2677,8 @@ XPCWrappedNative::HandlePossibleNameCase
+@@ -2677,8 +2670,8 @@ XPCWrappedNative::HandlePossibleNameCase
              if(e)
              {
                  nsresult rv;
 -                nsCOMPtr<nsIStackFrame> loc = nsnull;
 -                rv = e->GetLocation(getter_AddRefs(loc));
 +                nsIStackFrame* loc = nsnull;
 +                rv = e->GetLocation(&loc);
                  if(NS_SUCCEEDED(rv) && loc) {
@@ -2099,28 +2074,28 @@ diff --git a/layout/generic/nsTextFrameT
 @@ -428,7 +428,6 @@ nsTextFrameTextRunCache::Init() {
  
  void
  nsTextFrameTextRunCache::Shutdown() {
 -    delete gTextRuns;
      gTextRuns = nsnull;
  }
  
-@@ -1196,8 +1195,8 @@ static gfxFontGroup*
+@@ -1247,8 +1246,8 @@ static gfxFontGroup*
  static gfxFontGroup*
  GetFontGroupForFrame(nsIFrame* aFrame)
  {
 -  nsCOMPtr<nsIFontMetrics> metrics;
 -  nsLayoutUtils::GetFontMetricsForFrame(aFrame, getter_AddRefs(metrics));
 +  nsIFontMetrics* metrics = nsnull;
 +  nsLayoutUtils::GetFontMetricsForFrame(aFrame, &metrics);
  
    if (!metrics)
      return nsnull;
-@@ -1211,20 +1210,19 @@ GetFontGroupForFrame(nsIFrame* aFrame)
+@@ -1262,20 +1261,19 @@ GetFontGroupForFrame(nsIFrame* aFrame)
    return fm->GetThebesFontGroup();
  }
  
 -static already_AddRefed<gfxContext>
 +static gfxContext*
  GetReferenceRenderingContext(nsTextFrame* aTextFrame, nsIRenderingContext* aRC)
  {
 -  nsCOMPtr<nsIRenderingContext> tmp = aRC;
@@ -2134,82 +2109,82 @@ diff --git a/layout/generic/nsTextFrameT
    }
  
    gfxContext* ctx = static_cast<gfxContext*>
            (tmp->GetNativeGraphicData(nsIRenderingContext::NATIVE_THEBES_CONTEXT));
 -  NS_ADDREF(ctx);
    return ctx;
  }
  
-@@ -1235,7 +1233,7 @@ static gfxTextRun*
+@@ -1286,7 +1284,7 @@ static gfxTextRun*
  static gfxTextRun*
  GetHyphenTextRun(gfxTextRun* aTextRun, gfxContext* aContext, nsTextFrame* aTextFrame)
  {
 -  nsRefPtr<gfxContext> ctx = aContext;
 +  gfxContext* ctx = aContext;
    if (!ctx) {
      ctx = GetReferenceRenderingContext(aTextFrame, nsnull);
    }
-@@ -1712,7 +1710,7 @@ nsTextFrame::EnsureTextRun(gfxContext* a
+@@ -1757,7 +1755,7 @@ nsTextFrame::EnsureTextRun(gfxContext* a
        gTextRuns->MarkUsed(mTextRun);
      }
    } else {
 -    nsRefPtr<gfxContext> ctx = aReferenceContext;
 +    gfxContext* ctx = aReferenceContext;
      if (!ctx) {
        ctx = GetReferenceRenderingContext(this, nsnull);
      }
-@@ -2402,7 +2400,7 @@ PropertyProvider::SetupJustificationSpac
+@@ -2444,7 +2442,7 @@ PropertyProvider::SetupJustificationSpac
  
  // Helper class for managing blinking text
  
 -class nsBlinkTimer : public nsITimerCallback
 +class nsBlinkTimer : public XPCOMGCFinalizedObject, public nsITimerCallback
  {
  public:
    nsBlinkTimer();
-@@ -2559,7 +2557,6 @@ nsresult nsBlinkTimer::AddBlinkFrame(nsP
+@@ -2601,7 +2599,6 @@ nsresult nsBlinkTimer::AddBlinkFrame(nsP
      if (!sTextBlinker) return NS_ERROR_OUT_OF_MEMORY;
    }
    
 -  NS_ADDREF(sTextBlinker);
  
    sTextBlinker->AddFrame(aPresContext, aFrame);
    return NS_OK;
-@@ -2798,7 +2795,7 @@ nsTextPaintStyle::InitSelectionColors()
+@@ -2840,7 +2837,7 @@ nsTextPaintStyle::InitSelectionColors()
  
    if (selectionContent &&
        selectionStatus == nsISelectionController::SELECTION_ON) {
 -    nsRefPtr<nsStyleContext> sc = nsnull;
 +    nsStyleContext* sc = nsnull;
      sc = mPresContext->StyleSet()->
        ProbePseudoStyleFor(selectionContent, nsCSSPseudoElements::mozSelection,
                            mFrame->GetStyleContext());
-@@ -2971,7 +2968,7 @@ NS_IMETHODIMP nsTextFrame::GetAccessible
+@@ -3013,7 +3010,7 @@ NS_IMETHODIMP nsTextFrame::GetAccessible
  {
    if (!IsEmpty() || GetNextInFlow()) {
  
 -    nsCOMPtr<nsIAccessibilityService> accService = do_GetService("@mozilla.org/accessibilityService;1");
 +    nsIAccessibilityService* accService = do_GetService("@mozilla.org/accessibilityService;1");
  
      if (accService) {
        return accService->CreateHTMLTextAccessible(static_cast<nsIFrame*>(this), aAccessible);
-@@ -4061,9 +4058,9 @@ nsTextFrame::GetSelectionStatus(PRInt16*
+@@ -4104,9 +4101,9 @@ nsTextFrame::GetSelectionStatus(PRInt16*
  nsTextFrame::GetSelectionStatus(PRInt16* aSelectionFlags)
  {
    // get the selection controller
 -  nsCOMPtr<nsISelectionController> selectionController;
 +  nsISelectionController* selectionController = nsnull;
    nsresult rv = GetSelectionController(PresContext(),
 -                                       getter_AddRefs(selectionController));
 +                                       &selectionController);
    if (NS_FAILED(rv) || !selectionController)
      return nsISelectionController::SELECTION_OFF;
  
-@@ -4205,15 +4202,15 @@ nsTextFrame::SetSelected(nsPresContext* 
+@@ -4248,15 +4245,15 @@ nsTextFrame::SetSelected(nsPresContext* 
    PRBool found = PR_FALSE;
    if (aRange) {
      //lets see if the range contains us, if so we must redraw!
 -    nsCOMPtr<nsIDOMNode> endNode;
 +    nsIDOMNode* endNode = nsnull;
      PRInt32 endOffset;
 -    nsCOMPtr<nsIDOMNode> startNode;
 +    nsIDOMNode* startNode = nsnull;
@@ -2258,93 +2233,93 @@ diff --git a/layout/mathml/base/src/nsMa
 +  nsIDOMWindow* parent = nsnull;
 +  wwatch->GetActiveWindow(&parent);
    nsresult rv;
 -  nsCOMPtr<nsINonBlockingAlertService> prompter =
 +  nsINonBlockingAlertService* prompter =
      do_GetService("@mozilla.org/embedcomp/nbalert-service;1", &rv);
  
    if (prompter && parent) {
-@@ -779,7 +779,7 @@ nsGlyphTableList::Initialize()
+@@ -783,7 +783,7 @@ nsGlyphTableList::Initialize()
  nsGlyphTableList::Initialize()
  {
    nsresult rv = NS_OK;
 -  nsCOMPtr<nsIObserverService> obs = 
 +  nsIObserverService* obs = 
             do_GetService("@mozilla.org/observer-service;1", &rv);
    if (NS_SUCCEEDED(rv)) {
      rv = obs->AddObserver(this, NS_XPCOM_SHUTDOWN_OBSERVER_ID, PR_FALSE);
-@@ -793,7 +793,7 @@ nsGlyphTableList::Finalize()
+@@ -797,7 +797,7 @@ nsGlyphTableList::Finalize()
  {
    // Remove our observer from the observer service
    nsresult rv = NS_OK;
 -  nsCOMPtr<nsIObserverService> obs = 
 +  nsIObserverService* obs = 
             do_GetService("@mozilla.org/observer-service;1", &rv);
    if (NS_SUCCEEDED(rv)) {
      rv = obs->RemoveObserver(this, NS_XPCOM_SHUTDOWN_OBSERVER_ID);
-@@ -1032,10 +1032,10 @@ GetPrefValue(nsIPrefBranch* aPrefBranch,
+@@ -1036,10 +1036,10 @@ GetPrefValue(nsIPrefBranch* aPrefBranch,
  {
    aPrefValue.Truncate();
    if (aPrefBranch) {
 -    nsCOMPtr<nsISupportsString> prefString;
 +    nsISupportsString* prefString = nsnull;
      aPrefBranch->GetComplexValue(aPrefKey,
                                   NS_GET_IID(nsISupportsString),
 -                                 getter_AddRefs(prefString));
 +                                 (void**)&prefString);
      if (prefString) {
        prefString->GetData(aPrefValue);
      }
-@@ -1196,7 +1196,6 @@ InitGlobals(nsPresContext* aPresContext)
+@@ -1200,7 +1200,6 @@ InitGlobals(nsPresContext* aPresContext)
      }
    }
    if (NS_FAILED(rv)) {
 -    delete gGlyphTableList;
      delete nsGlyphTableList::gBaseFonts;
      delete [] nsGlyphTableList::gParts;
      delete [] nsGlyphTableList::gVariants;
-@@ -1222,7 +1221,7 @@ InitGlobals(nsPresContext* aPresContext)
+@@ -1226,7 +1225,7 @@ InitGlobals(nsPresContext* aPresContext)
    nsCAutoString key;
    nsAutoString value;
    nsIPersistentProperties* mathfontProp = nsnull;
 -  nsCOMPtr<nsIPrefBranch> prefBranch(do_GetService(NS_PREFSERVICE_CONTRACTID));
 +  nsIPrefBranch* prefBranch(do_GetService(NS_PREFSERVICE_CONTRACTID));
  
    // Add the math fonts in the gGlyphTableList in order of preference ...
    // Note: we only load font-names at this stage. The actual glyph tables will
-@@ -1279,12 +1278,12 @@ InitGlobals(nsPresContext* aPresContext)
+@@ -1283,12 +1282,12 @@ InitGlobals(nsPresContext* aPresContext)
    NS_FREE_XPCOM_ALLOCATED_POINTER_ARRAY(count, allKey);
  
    // Next, look our internal settings
 -  nsCOMPtr<nsISimpleEnumerator> iterator;
 -  if (NS_SUCCEEDED(mathfontProp->Enumerate(getter_AddRefs(iterator)))) {
 +  nsISimpleEnumerator* iterator = nsnull;
 +  if (NS_SUCCEEDED(mathfontProp->Enumerate(&iterator))) {
      PRBool more;
      while ((NS_SUCCEEDED(iterator->HasMoreElements(&more))) && more) {
 -      nsCOMPtr<nsIPropertyElement> element;
 -      if (NS_SUCCEEDED(iterator->GetNext(getter_AddRefs(element)))) {
 +      nsIPropertyElement* element = nsnull;
 +      if (NS_SUCCEEDED(iterator->GetNext((class nsISupports**)&element))) {
          if (NS_SUCCEEDED(element->GetKey(key))) {
            if ((30 < key.Length()) && 
                (0 == key.Find("font.mathfont-family.\\u")) &&
-@@ -2372,8 +2371,8 @@ nsMathMLChar::PaintVertically(nsPresCont
+@@ -2376,8 +2375,8 @@ nsMathMLChar::PaintVertically(nsPresCont
    }
    else { // glue is present
      nscoord overlap;
 -    nsCOMPtr<nsIFontMetrics> fm;
 -    aRenderingContext.GetFontMetrics(*getter_AddRefs(fm));
 +    nsIFontMetrics* fm = nsnull;
 +    aRenderingContext.GetFontMetrics(*&fm);
      nsMathMLFrame::GetRuleThickness(fm, overlap);
      overlap = 2 * PR_MAX(overlap, onePixel);
      while (overlap > 0 && bmdata[3].ascent + bmdata[3].descent <= 2*overlap + onePixel)
-@@ -2566,8 +2565,8 @@ nsMathMLChar::PaintHorizontally(nsPresCo
+@@ -2570,8 +2569,8 @@ nsMathMLChar::PaintHorizontally(nsPresCo
    }
    else { // glue is present
      nscoord overlap;
 -    nsCOMPtr<nsIFontMetrics> fm;
 -    aRenderingContext.GetFontMetrics(*getter_AddRefs(fm));
 +    nsIFontMetrics* fm = nsnull;
 +    aRenderingContext.GetFontMetrics(*&fm);
      nsMathMLFrame::GetRuleThickness(fm, overlap);
@@ -2802,55 +2777,55 @@ diff --git a/view/src/nsView.cpp b/view/
  /**
   * nsISupports-derived helper class that allows to store and get a view
   */
 -class ViewWrapper : public nsIInterfaceRequestor
 +class ViewWrapper : public XPCOMGCFinalizedObject, public nsIInterfaceRequestor
  {
    public:
      NS_DECLARE_STATIC_IID_ACCESSOR(VIEW_WRAPPER_IID)
-@@ -338,8 +338,8 @@ void nsView::ResetWidgetBounds(PRBool aR
+@@ -342,8 +342,8 @@ void nsView::ResetWidgetBounds(PRBool aR
  
  nsRect nsView::CalcWidgetBounds(nsWindowType aType)
  {
 -  nsCOMPtr<nsIDeviceContext> dx;
 -  mViewManager->GetDeviceContext(*getter_AddRefs(dx));
 +  nsIDeviceContext* dx = nsnull;
 +  mViewManager->GetDeviceContext(*&dx);
    NS_ASSERTION(dx, "View manager can't be created without a device context");
    PRInt32 p2a = dx->AppUnitsPerDevPixel();
  
-@@ -621,8 +621,8 @@ nsresult nsIView::CreateWidget(const nsI
+@@ -625,8 +625,8 @@ nsresult nsIView::CreateWidget(const nsI
    if (NS_OK == v->LoadWidget(aWindowIID))
    {
      PRBool usewidgets;
 -    nsCOMPtr<nsIDeviceContext> dx;
 -    mViewManager->GetDeviceContext(*getter_AddRefs(dx));
 +    nsIDeviceContext* dx = nsnull;
 +    mViewManager->GetDeviceContext(*&dx);
      dx->SupportsNativeWidgets(usewidgets);
  
      if (PR_TRUE == usewidgets)
-@@ -704,15 +704,12 @@ nsresult nsView::LoadWidget(const nsCID 
+@@ -708,15 +708,12 @@ nsresult nsView::LoadWidget(const nsCID 
    ViewWrapper* wrapper = new ViewWrapper(this);
    if (!wrapper)
      return NS_ERROR_OUT_OF_MEMORY;
 -  NS_ADDREF(wrapper); // Will be released in ~nsView
  
    nsresult rv = CallCreateInstance(aClassIID, &mWindow);
  
    if (NS_SUCCEEDED(rv)) {
      // Set the widget's client data
      mWindow->SetClientData(wrapper);
 -  } else {
 -    delete wrapper;
    }
  
    return rv;
-@@ -787,8 +784,8 @@ nsIntPoint nsIView::GetScreenPosition() 
+@@ -791,8 +788,8 @@ nsIntPoint nsIView::GetScreenPosition() 
    nsPoint toWidgetOffset(0,0);
    nsIWidget* widget = GetNearestWidget(&toWidgetOffset);
    if (widget) {
 -    nsCOMPtr<nsIDeviceContext> dx;
 -    mViewManager->GetDeviceContext(*getter_AddRefs(dx));
 +    nsIDeviceContext* dx = nsnull;
 +    mViewManager->GetDeviceContext(*&dx);
      PRInt32 p2a = dx->AppUnitsPerDevPixel();
deleted file mode 100644
--- a/gcobject-rdf.patch
+++ /dev/null
@@ -1,674 +0,0 @@
-diff --git a/rdf/base/src/nsCompositeDataSource.cpp b/rdf/base/src/nsCompositeDataSource.cpp
---- a/rdf/base/src/nsCompositeDataSource.cpp
-+++ b/rdf/base/src/nsCompositeDataSource.cpp
-@@ -146,7 +146,7 @@ protected:
- // CompositeEnumeratorImpl
- //
- 
--class CompositeEnumeratorImpl : public nsISimpleEnumerator
-+class CompositeEnumeratorImpl : public XPCOMGCObject, public nsISimpleEnumerator
- {
-     // nsISupports
-     NS_DECL_ISUPPORTS
-@@ -160,8 +160,6 @@ class CompositeEnumeratorImpl : public n
- 
-     virtual nsresult
-     HasNegation(nsIRDFDataSource* aDataSource, nsIRDFNode* aNode, PRBool* aResult) = 0;
--
--    virtual void Destroy() = 0;
- 
- protected:
-     CompositeEnumeratorImpl(CompositeDataSourceImpl* aCompositeDataSource,
-@@ -197,22 +195,9 @@ CompositeEnumeratorImpl::CompositeEnumer
- 
- CompositeEnumeratorImpl::~CompositeEnumeratorImpl(void)
- {
--	if (mCoalesceDuplicateArcs == PR_TRUE)
--	{
--		for (PRInt32 i = mAlreadyReturned.Count() - 1; i >= 0; --i)
--		{
--			nsIRDFNode *node = (nsIRDFNode *) mAlreadyReturned[i];
--			NS_RELEASE(node);
--		}
--	}
--
--	NS_IF_RELEASE(mCurrent);
--	NS_IF_RELEASE(mResult);
--	NS_RELEASE(mCompositeDataSource);
- }
- 
- NS_IMPL_ADDREF(CompositeEnumeratorImpl)
--NS_IMPL_RELEASE_WITH_DESTROY(CompositeEnumeratorImpl, Destroy())
- NS_IMPL_QUERY_INTERFACE1(CompositeEnumeratorImpl, nsISimpleEnumerator)
- 
- NS_IMETHODIMP
-@@ -375,48 +360,27 @@ public:
- public:
-     enum Type { eArcsIn, eArcsOut };
- 
--    static CompositeArcsInOutEnumeratorImpl*
--    Create(nsFixedSizeAllocator& aAllocator,
--           CompositeDataSourceImpl* aCompositeDataSource,
--           nsIRDFNode* aNode,
--           Type aType,
--           PRBool aAllowNegativeAssertions,
--           PRBool aCoalesceDuplicateArcs) {
--        void* place = aAllocator.Alloc(sizeof(CompositeArcsInOutEnumeratorImpl));
--        return place
--            ? ::new (place) CompositeArcsInOutEnumeratorImpl(aCompositeDataSource,
--                                                             aNode, aType,
--                                                             aAllowNegativeAssertions,
--                                                             aCoalesceDuplicateArcs)
--            : nsnull; }
--
--    virtual ~CompositeArcsInOutEnumeratorImpl();
--
--    virtual nsresult
--    GetEnumerator(nsIRDFDataSource* aDataSource, nsISimpleEnumerator** aResult);
--
--    virtual nsresult
--    HasNegation(nsIRDFDataSource* aDataSource, nsIRDFNode* aNode, PRBool* aResult);
--
--    virtual void Destroy();
--
--protected:
-     CompositeArcsInOutEnumeratorImpl(CompositeDataSourceImpl* aCompositeDataSource,
-                                      nsIRDFNode* aNode,
-                                      Type aType,
-                                      PRBool aAllowNegativeAssertions,
-                                      PRBool aCoalesceDuplicateArcs);
- 
-+    virtual ~CompositeArcsInOutEnumeratorImpl();
-+
-+    virtual nsresult
-+    GetEnumerator(nsIRDFDataSource* aDataSource, nsISimpleEnumerator** aResult);
-+
-+    virtual nsresult
-+    HasNegation(nsIRDFDataSource* aDataSource, nsIRDFNode* aNode, PRBool* aResult);
-+
-+protected:
-+
- private:
-     nsIRDFNode* mNode;
-     Type        mType;
-     PRBool	    mAllowNegativeAssertions;
-     PRBool      mCoalesceDuplicateArcs;
--
--    // Hide so that only Create() and Destroy() can be used to
--    // allocate and deallocate from the heap
--    static void* operator new(size_t) CPP_THROW_NEW { return 0; }
--    static void operator delete(void*, size_t) {}
- };
- 
- 
-@@ -465,19 +429,6 @@ CompositeArcsInOutEnumeratorImpl::HasNeg
-     return NS_OK;
- }
- 
--void
--CompositeArcsInOutEnumeratorImpl::Destroy()
--{
--    // Keep the datasource alive for the duration of the stack
--    // frame so its allocator stays valid.
--    nsCOMPtr<nsIRDFCompositeDataSource> kungFuDeathGrip = mCompositeDataSource;
--
--    nsFixedSizeAllocator& pool = mCompositeDataSource->mAllocator;
--    this->~CompositeArcsInOutEnumeratorImpl();
--    pool.Free(this, sizeof(*this));
--}
--
--
- //----------------------------------------------------------------------
- //
- // CompositeAssertionEnumeratorImpl
-@@ -486,33 +437,6 @@ class CompositeAssertionEnumeratorImpl :
- class CompositeAssertionEnumeratorImpl : public CompositeEnumeratorImpl
- {
- public:
--    static CompositeAssertionEnumeratorImpl*
--    Create(nsFixedSizeAllocator& aAllocator,
--           CompositeDataSourceImpl* aCompositeDataSource,
--           nsIRDFResource* aSource,
--           nsIRDFResource* aProperty,
--           nsIRDFNode* aTarget,
--           PRBool aTruthValue,
--           PRBool aAllowNegativeAssertions,
--           PRBool aCoalesceDuplicateArcs) {
--        void* place = aAllocator.Alloc(sizeof(CompositeAssertionEnumeratorImpl));
--        return place
--            ? ::new (place) CompositeAssertionEnumeratorImpl(aCompositeDataSource,
--                                                             aSource, aProperty, aTarget,
--                                                             aTruthValue,
--                                                             aAllowNegativeAssertions,
--                                                             aCoalesceDuplicateArcs)
--            : nsnull; }
--
--    virtual nsresult
--    GetEnumerator(nsIRDFDataSource* aDataSource, nsISimpleEnumerator** aResult);
--
--    virtual nsresult
--    HasNegation(nsIRDFDataSource* aDataSource, nsIRDFNode* aNode, PRBool* aResult);
--
--    virtual void Destroy();
--
--protected:
-     CompositeAssertionEnumeratorImpl(CompositeDataSourceImpl* aCompositeDataSource,
-                                      nsIRDFResource* aSource,
-                                      nsIRDFResource* aProperty,
-@@ -521,6 +445,14 @@ protected:
-                                      PRBool aAllowNegativeAssertions,
-                                      PRBool aCoalesceDuplicateArcs);
- 
-+    virtual nsresult
-+    GetEnumerator(nsIRDFDataSource* aDataSource, nsISimpleEnumerator** aResult);
-+
-+    virtual nsresult
-+    HasNegation(nsIRDFDataSource* aDataSource, nsIRDFNode* aNode, PRBool* aResult);
-+
-+protected:
-+
-     virtual ~CompositeAssertionEnumeratorImpl();
- 
- private:
-@@ -530,11 +462,6 @@ private:
-     PRBool          mTruthValue;
-     PRBool          mAllowNegativeAssertions;
-     PRBool          mCoalesceDuplicateArcs;
--
--    // Hide so that only Create() and Destroy() can be used to
--    // allocate and deallocate from the heap
--    static void* operator new(size_t) CPP_THROW_NEW { return 0; }
--    static void operator delete(void*, size_t) {}
- };
- 
- 
-@@ -595,18 +522,6 @@ CompositeAssertionEnumeratorImpl::HasNeg
-     }
- }
- 
--void
--CompositeAssertionEnumeratorImpl::Destroy()
--{
--    // Keep the datasource alive for the duration of the stack
--    // frame so its allocator stays valid.
--    nsCOMPtr<nsIRDFCompositeDataSource> kungFuDeathGrip = mCompositeDataSource;
--
--    nsFixedSizeAllocator& pool = mCompositeDataSource->mAllocator;
--    this->~CompositeAssertionEnumeratorImpl();
--    pool.Free(this, sizeof(*this));
--}
--
- ////////////////////////////////////////////////////////////////////////
- 
- nsresult
-@@ -727,11 +642,10 @@ CompositeDataSourceImpl::GetSources(nsIR
-     if ((mAllowNegativeAssertions == PR_FALSE) && (aTruthValue == PR_FALSE))
-         return(NS_RDF_NO_VALUE);
- 
--    *aResult = CompositeAssertionEnumeratorImpl::Create(mAllocator,
--                                                        this, nsnull, aProperty,
--                                                        aTarget, aTruthValue,
--                                                        mAllowNegativeAssertions,
--                                                        mCoalesceDuplicateArcs);
-+    *aResult = new CompositeAssertionEnumeratorImpl(this, nsnull, aProperty,
-+                                                    aTarget, aTruthValue,
-+                                                    mAllowNegativeAssertions,
-+                                                    mCoalesceDuplicateArcs);
- 
-     if (! *aResult)
-         return NS_ERROR_OUT_OF_MEMORY;
-@@ -834,11 +748,11 @@ CompositeDataSourceImpl::GetTargets(nsIR
-         return(NS_RDF_NO_VALUE);
- 
-     *aResult =
--        CompositeAssertionEnumeratorImpl::Create(mAllocator, this,
--                                                 aSource, aProperty, nsnull,
--                                                 aTruthValue,
--                                                 mAllowNegativeAssertions,
--                                                 mCoalesceDuplicateArcs);
-+        new CompositeAssertionEnumeratorImpl(this,
-+                                             aSource, aProperty, nsnull,
-+                                             aTruthValue,
-+                                             mAllowNegativeAssertions,
-+                                             mCoalesceDuplicateArcs);
- 
-     if (! *aResult)
-         return NS_ERROR_OUT_OF_MEMORY;
-@@ -1166,10 +1080,10 @@ CompositeDataSourceImpl::ArcLabelsIn(nsI
-         return NS_ERROR_NULL_POINTER;
- 
-     nsISimpleEnumerator* result = 
--        CompositeArcsInOutEnumeratorImpl::Create(mAllocator, this, aTarget,
--                                                 CompositeArcsInOutEnumeratorImpl::eArcsIn,
--                                                 mAllowNegativeAssertions,
--                                                 mCoalesceDuplicateArcs);
-+        new CompositeArcsInOutEnumeratorImpl(this, aTarget,
-+                                             CompositeArcsInOutEnumeratorImpl::eArcsIn,
-+                                             mAllowNegativeAssertions,
-+                                             mCoalesceDuplicateArcs);
- 
-     if (! result)
-         return NS_ERROR_OUT_OF_MEMORY;
-@@ -1192,10 +1106,10 @@ CompositeDataSourceImpl::ArcLabelsOut(ns
-         return NS_ERROR_NULL_POINTER;
- 
-     nsISimpleEnumerator* result =
--        CompositeArcsInOutEnumeratorImpl::Create(mAllocator, this, aSource,
--                                                 CompositeArcsInOutEnumeratorImpl::eArcsOut,
--                                                 mAllowNegativeAssertions,
--                                                 mCoalesceDuplicateArcs);
-+        new CompositeArcsInOutEnumeratorImpl(this, aSource,
-+                                             CompositeArcsInOutEnumeratorImpl::eArcsOut,
-+                                             mAllowNegativeAssertions,
-+                                             mCoalesceDuplicateArcs);
- 
-     if (! result)
-         return NS_ERROR_OUT_OF_MEMORY;
-diff --git a/rdf/base/src/nsInMemoryDataSource.cpp b/rdf/base/src/nsInMemoryDataSource.cpp
---- a/rdf/base/src/nsInMemoryDataSource.cpp
-+++ b/rdf/base/src/nsInMemoryDataSource.cpp
-@@ -427,7 +427,8 @@ public:
- /**
-  * InMemoryAssertionEnumeratorImpl
-  */
--class InMemoryAssertionEnumeratorImpl : public nsISimpleEnumerator
-+class InMemoryAssertionEnumeratorImpl : public XPCOMGCFinalizedObject
-+                                      , public nsISimpleEnumerator
- {
- private:
-     InMemoryDataSource* mDataSource;
-@@ -440,44 +441,14 @@ private:
-     Assertion*      mNextAssertion;
-     nsCOMPtr<nsISupportsArray> mHashArcs;
- 
--    // Hide so that only Create() and Destroy() can be used to
--    // allocate and deallocate from the heap
--    static void* operator new(size_t) CPP_THROW_NEW { return 0; }
--    static void operator delete(void*, size_t) {}
--
-+    virtual ~InMemoryAssertionEnumeratorImpl();
-+
-+public:
-     InMemoryAssertionEnumeratorImpl(InMemoryDataSource* aDataSource,
-                                     nsIRDFResource* aSource,
-                                     nsIRDFResource* aProperty,
-                                     nsIRDFNode* aTarget,
-                                     PRBool aTruthValue);
--
--    virtual ~InMemoryAssertionEnumeratorImpl();
--
--public:
--    static InMemoryAssertionEnumeratorImpl*
--    Create(InMemoryDataSource* aDataSource,
--           nsIRDFResource* aSource,
--           nsIRDFResource* aProperty,
--           nsIRDFNode* aTarget,
--           PRBool aTruthValue) {
--        void* place = aDataSource->mAllocator.Alloc(sizeof(InMemoryAssertionEnumeratorImpl));
--        return place
--            ? ::new (place) InMemoryAssertionEnumeratorImpl(aDataSource,
--                                                            aSource, aProperty, aTarget,
--                                                            aTruthValue)
--            : nsnull; }
--
--    static void
--    Destroy(InMemoryAssertionEnumeratorImpl* aEnumerator) {
--        // Keep the datasource alive for the duration of the stack
--        // frame so its allocator stays valid.
--        nsCOMPtr<nsIRDFDataSource> kungFuDeathGrip = aEnumerator->mDataSource;
--
--        // Grab the pool from the datasource; since we keep the
--        // datasource alive, this has to be safe.
--        nsFixedSizeAllocator& pool = aEnumerator->mDataSource->mAllocator;
--        aEnumerator->~InMemoryAssertionEnumeratorImpl();
--        pool.Free(aEnumerator, sizeof(*aEnumerator)); }
- 
-     // nsISupports interface
-     NS_DECL_ISUPPORTS
-@@ -548,7 +519,6 @@ InMemoryAssertionEnumeratorImpl::~InMemo
- }
- 
- NS_IMPL_ADDREF(InMemoryAssertionEnumeratorImpl)
--NS_IMPL_RELEASE_WITH_DESTROY(InMemoryAssertionEnumeratorImpl, Destroy(this))
- NS_IMPL_QUERY_INTERFACE1(InMemoryAssertionEnumeratorImpl, nsISimpleEnumerator)
- 
- NS_IMETHODIMP
-@@ -631,11 +601,6 @@ class InMemoryArcsEnumeratorImpl : publi
- class InMemoryArcsEnumeratorImpl : public nsISimpleEnumerator
- {
- private:
--    // Hide so that only Create() and Destroy() can be used to
--    // allocate and deallocate from the heap
--    static void* operator new(size_t) CPP_THROW_NEW { return 0; }
--    static void operator delete(void*, size_t) {}
--
-     InMemoryDataSource* mDataSource;
-     nsIRDFResource*     mSource;
-     nsIRDFNode*         mTarget;
-@@ -644,43 +609,22 @@ private:
-     Assertion*          mAssertion;
-     nsCOMPtr<nsISupportsArray> mHashArcs;
- 
-+    virtual ~InMemoryArcsEnumeratorImpl();
-+
-+    static PLDHashOperator PR_CALLBACK
-+    ArcEnumerator(PLDHashTable* aTable, PLDHashEntryHdr* aHdr,
-+                       PRUint32 aNumber, void* aArg);
-+
-+public:
-+    // nsISupports interface
-+    NS_DECL_ISUPPORTS
-+
-+    // nsISimpleEnumerator interface
-+    NS_DECL_NSISIMPLEENUMERATOR
-+
-     InMemoryArcsEnumeratorImpl(InMemoryDataSource* aDataSource,
-                                nsIRDFResource* aSource,
-                                nsIRDFNode* aTarget);
--
--    virtual ~InMemoryArcsEnumeratorImpl();
--
--    static PLDHashOperator PR_CALLBACK
--    ArcEnumerator(PLDHashTable* aTable, PLDHashEntryHdr* aHdr,
--                       PRUint32 aNumber, void* aArg);
--
--public:
--    // nsISupports interface
--    NS_DECL_ISUPPORTS
--
--    // nsISimpleEnumerator interface
--    NS_DECL_NSISIMPLEENUMERATOR
--
--    static InMemoryArcsEnumeratorImpl*
--    Create(InMemoryDataSource* aDataSource,
--           nsIRDFResource* aSource,
--           nsIRDFNode* aTarget) {
--        void* place = aDataSource->mAllocator.Alloc(sizeof(InMemoryArcsEnumeratorImpl));
--        return place
--            ? ::new (place) InMemoryArcsEnumeratorImpl(aDataSource, aSource, aTarget)
--            : nsnull; }
--
--    static void
--    Destroy(InMemoryArcsEnumeratorImpl* aEnumerator) {
--        // Keep the datasource alive for the duration of the stack
--        // frame so its allocator stays valid.
--        nsCOMPtr<nsIRDFDataSource> kungFuDeathGrip = aEnumerator->mDataSource;
--
--        // Grab the pool from the datasource; since we keep the
--        // datasource alive, this has to be safe.
--        nsFixedSizeAllocator& pool = aEnumerator->mDataSource->mAllocator;
--        aEnumerator->~InMemoryArcsEnumeratorImpl();
--        pool.Free(aEnumerator, sizeof(*aEnumerator)); }
- };
- 
- 
-@@ -747,7 +691,6 @@ InMemoryArcsEnumeratorImpl::~InMemoryArc
- }
- 
- NS_IMPL_ADDREF(InMemoryArcsEnumeratorImpl)
--NS_IMPL_RELEASE_WITH_DESTROY(InMemoryArcsEnumeratorImpl, Destroy(this))
- NS_IMPL_QUERY_INTERFACE1(InMemoryArcsEnumeratorImpl, nsISimpleEnumerator)
- 
- NS_IMETHODIMP
-@@ -1207,8 +1150,8 @@ InMemoryDataSource::GetSources(nsIRDFRes
-         return NS_ERROR_NULL_POINTER;
- 
-     InMemoryAssertionEnumeratorImpl* result =
--        InMemoryAssertionEnumeratorImpl::Create(this, nsnull, aProperty,
--                                                  aTarget, aTruthValue);
-+        new InMemoryAssertionEnumeratorImpl(this, nsnull, aProperty,
-+                                            aTarget, aTruthValue);
- 
-     if (! result)
-         return NS_ERROR_OUT_OF_MEMORY;
-@@ -1238,8 +1181,8 @@ InMemoryDataSource::GetTargets(nsIRDFRes
-         return NS_ERROR_NULL_POINTER;
- 
-     InMemoryAssertionEnumeratorImpl* result =
--        InMemoryAssertionEnumeratorImpl::Create(this, aSource, aProperty,
--                                                nsnull, aTruthValue);
-+        new InMemoryAssertionEnumeratorImpl(this, aSource, aProperty,
-+                                            nsnull, aTruthValue);
- 
-     if (! result)
-         return NS_ERROR_OUT_OF_MEMORY;
-@@ -1744,7 +1687,7 @@ InMemoryDataSource::ArcLabelsIn(nsIRDFNo
-         return NS_ERROR_NULL_POINTER;
- 
-     InMemoryArcsEnumeratorImpl* result =
--        InMemoryArcsEnumeratorImpl::Create(this, nsnull, aTarget);
-+        new InMemoryArcsEnumeratorImpl(this, nsnull, aTarget);
- 
-     if (! result)
-         return NS_ERROR_OUT_OF_MEMORY;
-@@ -1763,7 +1706,7 @@ InMemoryDataSource::ArcLabelsOut(nsIRDFR
-         return NS_ERROR_NULL_POINTER;
- 
-     InMemoryArcsEnumeratorImpl* result =
--        InMemoryArcsEnumeratorImpl::Create(this, aSource, nsnull);
-+        new InMemoryArcsEnumeratorImpl(this, aSource, nsnull);
- 
-     if (! result)
-         return NS_ERROR_OUT_OF_MEMORY;
-diff --git a/rdf/base/src/nsRDFContentSink.cpp b/rdf/base/src/nsRDFContentSink.cpp
---- a/rdf/base/src/nsRDFContentSink.cpp
-+++ b/rdf/base/src/nsRDFContentSink.cpp
-@@ -437,12 +437,10 @@ RDFContentSinkImpl::QueryInterface(REFNS
-         iid.Equals(kIContentSinkIID) ||
-         iid.Equals(kISupportsIID)) {
-         *result = static_cast<nsIXMLContentSink*>(this);
--        AddRef();
-         return NS_OK;
-     }
-     else if (iid.Equals(kIExpatSinkIID)) {
-       *result = static_cast<nsIExpatSink*>(this);
--       AddRef();
-        return NS_OK;
-     }
-     return NS_NOINTERFACE;
-diff --git a/rdf/base/src/nsRDFService.cpp b/rdf/base/src/nsRDFService.cpp
---- a/rdf/base/src/nsRDFService.cpp
-+++ b/rdf/base/src/nsRDFService.cpp
-@@ -317,39 +317,38 @@ static PLDHashTableOps gDateTableOps = {
-     nsnull
- };
- 
--class BlobImpl : public nsIRDFBlob
-+class BlobImpl : public MMgc::GCFinalizedObject, public nsIRDFBlob
- {
- public:
-     struct Data {
--        PRInt32  mLength;
-+        PRInt32 mLength;
-         PRUint8 *mBytes;
-     };
-+
-+    static void* operator new(size_t size, size_t extra)
-+    {
-+        return MMgc::GCObject::operator new(size, NS_GetGC(), extra);
-+    }
- 
-     BlobImpl(const PRUint8 *aBytes, PRInt32 aLength)
-     {
-         mData.mLength = aLength;
--        mData.mBytes = new PRUint8[aLength];
--        memcpy(mData.mBytes, aBytes, aLength);
--        NS_ADDREF(RDFServiceImpl::gRDFService);
-+        mData.mBytes = mBytes;
-+        memcpy(mBytes, aBytes, aLength);
-         RDFServiceImpl::gRDFService->RegisterBlob(this);
-     }
- 
--    virtual ~BlobImpl()
-+    ~BlobImpl()
-     {
-         RDFServiceImpl::gRDFService->UnregisterBlob(this);
--        // Use NS_RELEASE2() here, because we want to decrease the
--        // refcount, but not null out the gRDFService pointer (which is
--        // what a vanilla NS_RELEASE() would do).
--        nsrefcnt refcnt;
--        NS_RELEASE2(RDFServiceImpl::gRDFService, refcnt);
--        delete[] mData.mBytes;
-     }
- 
-     NS_DECL_ISUPPORTS
-     NS_DECL_NSIRDFNODE
-     NS_DECL_NSIRDFBLOB
- 
--    Data mData;
-+    Data    mData;
-+    PRUint8 mBytes[1];
- };
- 
- NS_IMPL_ISUPPORTS2(BlobImpl, nsIRDFNode, nsIRDFBlob)
-@@ -366,7 +365,7 @@ BlobImpl::EqualsNode(nsIRDFNode *aNode, 
-             const PRUint8 *bytes;
-             blob->GetValue(&bytes);
- 
--            if (0 == memcmp(bytes, mData.mBytes, length)) {
-+            if (0 == memcmp(bytes, mBytes, length)) {
-                 *aEquals = PR_TRUE;
-                 return NS_OK;
-             }
-@@ -380,7 +379,7 @@ NS_IMETHODIMP
- NS_IMETHODIMP
- BlobImpl::GetValue(const PRUint8 **aResult)
- {
--    *aResult = mData.mBytes;
-+    *aResult = mBytes;
-     return NS_OK;
- }
- 
-@@ -447,7 +446,7 @@ static PLDHashTableOps gBlobTableOps = {
- //   i.e., there is are no resource factories to allow you to generate
- //   customer resources. I doubt that makes sense, anyway.
- //
--class LiteralImpl : public nsIRDFLiteral {
-+class LiteralImpl : public XPCOMGCFinalizedObject, public nsIRDFLiteral {
- public:
-     static nsresult
-     Create(const PRUnichar* aValue, nsIRDFLiteral** aResult);
-@@ -462,51 +461,41 @@ public:
-     NS_DECL_NSIRDFLITERAL
- 
- protected:
--    LiteralImpl(const PRUnichar* s);
-+    static void* operator new(size_t size, size_t extra)
-+    {
-+        return MMgc::GCObject::operator new(size, NS_GetGC(), extra);
-+    }
-+
-+    LiteralImpl(const PRUnichar* s, size_t length);
-     virtual ~LiteralImpl();
- 
--    const PRUnichar* GetValue() const {
--        size_t objectSize = ((sizeof(LiteralImpl) + sizeof(PRUnichar) - 1) / sizeof(PRUnichar)) * sizeof(PRUnichar);
--        return reinterpret_cast<const PRUnichar*>(reinterpret_cast<const unsigned char*>(this) + objectSize);
--    }
-+    const PRUnichar* GetValue() const
-+    {
-+        return mBuffer;
-+    }
-+
-+    PRUnichar mBuffer[1];
- };
- 
- 
- nsresult
- LiteralImpl::Create(const PRUnichar* aValue, nsIRDFLiteral** aResult)
- {
--    // Goofy math to get alignment right. Copied from nsSharedString.h.
--    size_t objectSize = ((sizeof(LiteralImpl) + sizeof(PRUnichar) - 1) / sizeof(PRUnichar)) * sizeof(PRUnichar);
--    size_t stringLen = nsCharTraits<PRUnichar>::length(aValue);
--    size_t stringSize = (stringLen + 1) * sizeof(PRUnichar);
--
--    void* objectPtr = operator new(objectSize + stringSize);
--    if (! objectPtr)
--        return NS_ERROR_NULL_POINTER;
--
--    PRUnichar* buf = reinterpret_cast<PRUnichar*>(static_cast<unsigned char*>(objectPtr) + objectSize);
--    nsCharTraits<PRUnichar>::copy(buf, aValue, stringLen + 1);
--
--    NS_ADDREF(*aResult = new (objectPtr) LiteralImpl(buf));
--    return NS_OK;
--}
--
--
--LiteralImpl::LiteralImpl(const PRUnichar* s)
--{
-+    size_t stringLen = NS_strlen(aValue);
-+    *aResult = new(stringLen * sizeof(PRUnichar)) LiteralImpl(aValue, stringLen);
-+    return *aResult ? NS_OK : NS_ERROR_OUT_OF_MEMORY;
-+}
-+
-+
-+LiteralImpl::LiteralImpl(const PRUnichar* s, size_t length)
-+{
-+    nsCharTraits<PRUnichar>::copy(mBuffer, s, length + 1);
-     RDFServiceImpl::gRDFService->RegisterLiteral(this);
--    NS_ADDREF(RDFServiceImpl::gRDFService);
- }
- 
- LiteralImpl::~LiteralImpl()
- {
-     RDFServiceImpl::gRDFService->UnregisterLiteral(this);
--
--    // Use NS_RELEASE2() here, because we want to decrease the
--    // refcount, but not null out the gRDFService pointer (which is
--    // what a vanilla NS_RELEASE() would do).
--    nsrefcnt refcnt;
--    NS_RELEASE2(RDFServiceImpl::gRDFService, refcnt);
- }
- 
- NS_IMPL_THREADSAFE_ADDREF(LiteralImpl)
-@@ -523,7 +512,6 @@ LiteralImpl::QueryInterface(REFNSIID iid
-         iid.Equals(kIRDFNodeIID) ||
-         iid.Equals(kISupportsIID)) {
-         *result = static_cast<nsIRDFLiteral*>(this);
--        AddRef();
-         return NS_OK;
-     }
-     return NS_NOINTERFACE;
-@@ -603,12 +591,6 @@ DateImpl::~DateImpl()
- DateImpl::~DateImpl()
- {
-     RDFServiceImpl::gRDFService->UnregisterDate(this);
--
--    // Use NS_RELEASE2() here, because we want to decrease the
--    // refcount, but not null out the gRDFService pointer (which is
--    // what a vanilla NS_RELEASE() would do).
--    nsrefcnt refcnt;
--    NS_RELEASE2(RDFServiceImpl::gRDFService, refcnt);
- }
- 
- NS_IMPL_ADDREF(DateImpl)
-@@ -625,7 +607,6 @@ DateImpl::QueryInterface(REFNSIID iid, v
-         iid.Equals(kIRDFNodeIID) ||
-         iid.Equals(kISupportsIID)) {
-         *result = static_cast<nsIRDFDate*>(this);
--        AddRef();
-         return NS_OK;
-     }
-     return NS_NOINTERFACE;
-@@ -709,12 +690,6 @@ IntImpl::~IntImpl()
- IntImpl::~IntImpl()
- {
-     RDFServiceImpl::gRDFService->UnregisterInt(this);
--
--    // Use NS_RELEASE2() here, because we want to decrease the
--    // refcount, but not null out the gRDFService pointer (which is
--    // what a vanilla NS_RELEASE() would do).
--    nsrefcnt refcnt;
--    NS_RELEASE2(RDFServiceImpl::gRDFService, refcnt);
- }
- 
- NS_IMPL_ADDREF(IntImpl)
-@@ -1187,7 +1162,7 @@ RDFServiceImpl::GetBlobLiteral(const PRU
-         return NS_OK;
-     }
- 
--    BlobImpl *result = new BlobImpl(aBytes, aLength);
-+    BlobImpl *result = new (aLength) BlobImpl(aBytes, aLength);
-     if (! result)
-         return NS_ERROR_OUT_OF_MEMORY;
- 
deleted file mode 100644
--- a/gcobject-tiergecko.patch
+++ /dev/null
@@ -1,3399 +0,0 @@
-* * *
-* * *
-* * *
-
-diff --git a/accessible/src/base/nsAccessNode.cpp b/accessible/src/base/nsAccessNode.cpp
---- a/accessible/src/base/nsAccessNode.cpp
-+++ b/accessible/src/base/nsAccessNode.cpp
-@@ -114,7 +114,6 @@ nsIAccessibilityService *nsAccessNode::G
- //-----------------------------------------------------
- NS_IMPL_QUERY_INTERFACE2(nsAccessNode, nsIAccessNode, nsPIAccessNode)
- NS_IMPL_ADDREF(nsAccessNode)
--NS_IMPL_RELEASE_WITH_DESTROY(nsAccessNode, LastRelease())
- 
- nsAccessNode::nsAccessNode(nsIDOMNode *aNode, nsIWeakReference* aShell): 
-   mDOMNode(aNode), mWeakShell(aShell)
-@@ -129,18 +128,10 @@ nsAccessNode::nsAccessNode(nsIDOMNode *a
- //-----------------------------------------------------
- nsAccessNode::~nsAccessNode()
- {
--  NS_ASSERTION(!mWeakShell, "LastRelease was never called!?!");
--}
--
--void nsAccessNode::LastRelease()
--{
--  // First cleanup if needed...
-   if (mWeakShell) {
-     Shutdown();
-     NS_ASSERTION(!mWeakShell, "A Shutdown() impl forgot to call its parent's Shutdown?");
-   }
--  // ... then die.
--  NS_DELETEXPCOM(this);
- }
- 
- NS_IMETHODIMP nsAccessNode::Init()
-diff --git a/caps/include/nsPrincipal.h b/caps/include/nsPrincipal.h
---- a/caps/include/nsPrincipal.h
-+++ b/caps/include/nsPrincipal.h
-@@ -51,7 +51,7 @@ class nsIObjectInputStream;
- class nsIObjectInputStream;
- class nsIObjectOutputStream;
- 
--class nsPrincipal : public nsIPrincipal
-+class nsPrincipal : public XPCOMGCFinalizedObject, public nsIPrincipal
- {
- public:
-   nsPrincipal();
-diff --git a/caps/src/nsNullPrincipal.cpp b/caps/src/nsNullPrincipal.cpp
---- a/caps/src/nsNullPrincipal.cpp
-+++ b/caps/src/nsNullPrincipal.cpp
-@@ -60,28 +60,6 @@ NS_IMPL_CI_INTERFACE_GETTER2(nsNullPrinc
-                              nsIPrincipal,
-                              nsISerializable)
- 
--NS_IMETHODIMP_(nsrefcnt) 
--nsNullPrincipal::AddRef()
--{
--  NS_PRECONDITION(PRInt32(mJSPrincipals.refcount) >= 0, "illegal refcnt");
--  nsrefcnt count = PR_AtomicIncrement((PRInt32 *)&mJSPrincipals.refcount);
--  NS_LOG_ADDREF(this, count, "nsNullPrincipal", sizeof(*this));
--  return count;
--}
--
--NS_IMETHODIMP_(nsrefcnt)
--nsNullPrincipal::Release()
--{
--  NS_PRECONDITION(0 != mJSPrincipals.refcount, "dup release");
--  nsrefcnt count = PR_AtomicDecrement((PRInt32 *)&mJSPrincipals.refcount);
--  NS_LOG_RELEASE(this, count, "nsNullPrincipal");
--  if (count == 0) {
--    NS_DELETEXPCOM(this);
--  }
--
--  return count;
--}
--
- nsNullPrincipal::nsNullPrincipal()
- {
- }
-diff --git a/caps/src/nsPrincipal.cpp b/caps/src/nsPrincipal.cpp
---- a/caps/src/nsPrincipal.cpp
-+++ b/caps/src/nsPrincipal.cpp
-@@ -79,29 +79,6 @@ NS_IMPL_CI_INTERFACE_GETTER2(nsPrincipal
-                              nsIPrincipal,
-                              nsISerializable)
- 
--NS_IMETHODIMP_(nsrefcnt)
--nsPrincipal::AddRef()
--{
--  NS_PRECONDITION(PRInt32(mJSPrincipals.refcount) >= 0, "illegal refcnt");
--  // XXXcaa does this need to be threadsafe?  See bug 143559.
--  nsrefcnt count = PR_AtomicIncrement((PRInt32 *)&mJSPrincipals.refcount);
--  NS_LOG_ADDREF(this, count, "nsPrincipal", sizeof(*this));
--  return count;
--}
--
--NS_IMETHODIMP_(nsrefcnt)
--nsPrincipal::Release()
--{
--  NS_PRECONDITION(0 != mJSPrincipals.refcount, "dup release");
--  nsrefcnt count = PR_AtomicDecrement((PRInt32 *)&mJSPrincipals.refcount);
--  NS_LOG_RELEASE(this, count, "nsPrincipal");
--  if (count == 0) {
--    NS_DELETEXPCOM(this);
--  }
--
--  return count;
--}
--
- nsPrincipal::nsPrincipal()
-   : mCapabilities(nsnull),
-     mSecurityPolicy(nsnull),
-diff --git a/caps/src/nsSystemPrincipal.cpp b/caps/src/nsSystemPrincipal.cpp
---- a/caps/src/nsSystemPrincipal.cpp
-+++ b/caps/src/nsSystemPrincipal.cpp
-@@ -57,29 +57,6 @@ NS_IMPL_CI_INTERFACE_GETTER2(nsSystemPri
-                              nsIPrincipal,
-                              nsISerializable)
- 
--NS_IMETHODIMP_(nsrefcnt) 
--nsSystemPrincipal::AddRef()
--{
--  NS_PRECONDITION(PRInt32(mJSPrincipals.refcount) >= 0, "illegal refcnt");
--  nsrefcnt count = PR_AtomicIncrement((PRInt32 *)&mJSPrincipals.refcount);
--  NS_LOG_ADDREF(this, count, "nsSystemPrincipal", sizeof(*this));
--  return count;
--}
--
--NS_IMETHODIMP_(nsrefcnt)
--nsSystemPrincipal::Release()
--{
--  NS_PRECONDITION(0 != mJSPrincipals.refcount, "dup release");
--  nsrefcnt count = PR_AtomicDecrement((PRInt32 *)&mJSPrincipals.refcount);
--  NS_LOG_RELEASE(this, count, "nsSystemPrincipal");
--  if (count == 0) {
--    NS_DELETEXPCOM(this);
--  }
--
--  return count;
--}
--
--
- ///////////////////////////////////////
- // Methods implementing nsIPrincipal //
- ///////////////////////////////////////
-diff --git a/content/base/src/nsCommentNode.cpp b/content/base/src/nsCommentNode.cpp
---- a/content/base/src/nsCommentNode.cpp
-+++ b/content/base/src/nsCommentNode.cpp
-@@ -178,7 +178,7 @@ nsCommentNode::List(FILE* out, PRInt32 a
-   PRInt32 indx;
-   for (indx = aIndent; --indx >= 0; ) fputs("  ", out);
- 
--  fprintf(out, "Comment@%p refcount=%d<!--", this, mRefCnt.get());
-+  fprintf(out, "Comment@%p<!--", this);
- 
-   nsAutoString tmp;
-   ToCString(tmp, 0, mText.GetLength());
-diff --git a/content/base/src/nsGenericElement.cpp b/content/base/src/nsGenericElement.cpp
---- a/content/base/src/nsGenericElement.cpp
-+++ b/content/base/src/nsGenericElement.cpp
-@@ -868,21 +868,6 @@ nsNodeSupportsWeakRefTearoff::GetWeakRef
- 
- //----------------------------------------------------------------------
- 
--nsDOMEventRTTearoff *
--nsDOMEventRTTearoff::mCachedEventTearoff[NS_EVENT_TEAROFF_CACHE_SIZE];
--
--PRUint32 nsDOMEventRTTearoff::mCachedEventTearoffCount = 0;
--
--
--nsDOMEventRTTearoff::nsDOMEventRTTearoff(nsIContent *aContent)
--  : mContent(aContent)
--{
--}
--
--nsDOMEventRTTearoff::~nsDOMEventRTTearoff()
--{
--}
--
- NS_IMPL_CYCLE_COLLECTION_1(nsDOMEventRTTearoff, mContent)
- 
- NS_INTERFACE_MAP_BEGIN_CYCLE_COLLECTION(nsDOMEventRTTearoff)
-@@ -893,64 +878,6 @@ NS_INTERFACE_MAP_END_AGGREGATED(mContent
- 
- NS_IMPL_CYCLE_COLLECTING_ADDREF_AMBIGUOUS(nsDOMEventRTTearoff,
-                                           nsIDOMEventTarget)
--NS_IMPL_CYCLE_COLLECTING_RELEASE_AMBIGUOUS_WITH_DESTROY(nsDOMEventRTTearoff,
--                                                        nsIDOMEventTarget,
--                                                        LastRelease())
--
--nsDOMEventRTTearoff *
--nsDOMEventRTTearoff::Create(nsIContent *aContent)
--{
--  if (mCachedEventTearoffCount) {
--    // We have cached unused instances of this class, return a cached
--    // instance in stead of always creating a new one.
--    nsDOMEventRTTearoff *tearoff =
--      mCachedEventTearoff[--mCachedEventTearoffCount];
--
--    // Set the back pointer to the content object
--    tearoff->mContent = aContent;
--
--    return tearoff;
--  }
--
--  // The cache is empty, this means we haveto create a new instance.
--  return new nsDOMEventRTTearoff(aContent);
--}
--
--// static
--void
--nsDOMEventRTTearoff::Shutdown()
--{
--  // Clear our cache.
--  while (mCachedEventTearoffCount) {
--    delete mCachedEventTearoff[--mCachedEventTearoffCount];
--  }
--}
--
--void
--nsDOMEventRTTearoff::LastRelease()
--{
--  if (mCachedEventTearoffCount < NS_EVENT_TEAROFF_CACHE_SIZE) {
--    // There's still space in the cache for one more instance, put
--    // this instance in the cache in stead of deleting it.
--    mCachedEventTearoff[mCachedEventTearoffCount++] = this;
--
--    // Don't set mContent to null directly since setting mContent to null
--    // could result in code that grabs a tearoff from the cache and we don't
--    // want to get reused while still being torn down.
--    // See bug 330526.
--    nsCOMPtr<nsIContent> kungFuDeathGrip;
--    kungFuDeathGrip.swap(mContent);
--
--    // The refcount balancing and destructor re-entrancy protection
--    // code in Release() sets mRefCnt to 1 so we have to set it to 0
--    // here to prevent leaks
--    mRefCnt = 0;
--
--    return;
--  }
--
--  delete this;
--}
- 
- nsresult
- nsDOMEventRTTearoff::GetDOM3EventTarget(nsIDOM3EventTarget **aTarget)
-@@ -3932,8 +3859,7 @@ nsGenericElement::List(FILE* out, PRInt3
- 
-   ListAttributes(out);
- 
--  fprintf(out, " intrinsicstate=[%08x]", IntrinsicState());
--  fprintf(out, " refcount=%d<", mRefCnt.get());
-+  fprintf(out, " intrinsicstate=[%08x]<", IntrinsicState());
- 
-   PRUint32 i, length = GetChildCount();
-   if (length > 0) {
-diff --git a/content/base/src/nsGenericElement.h b/content/base/src/nsGenericElement.h
---- a/content/base/src/nsGenericElement.h
-+++ b/content/base/src/nsGenericElement.h
-@@ -205,7 +205,8 @@ private:
-  * @see nsDOMEventRTTearoff::Create
-  */
- 
--class nsDOMEventRTTearoff : public nsIDOMEventTarget,
-+class nsDOMEventRTTearoff : public XPCOMGCObject,
-+                            public nsIDOMEventTarget,
-                             public nsIDOM3EventTarget,
-                             public nsIDOMNSEventTarget
- {
-@@ -216,33 +217,23 @@ private:
-   // nsDOMEventRTTearoff::Create(). That's why the constructor and
-   // destrucor of this class is private.
- 
--  nsDOMEventRTTearoff(nsIContent *aContent);
--
--  static nsDOMEventRTTearoff *mCachedEventTearoff[NS_EVENT_TEAROFF_CACHE_SIZE];
--  static PRUint32 mCachedEventTearoffCount;
--
--  /**
--   * This method gets called by Release() when it's time to delete the
--   * this object, in stead of always deleting the object we'll put the
--   * object in the cache if unless the cache is already full.
--   */
--  void LastRelease();
-+  nsDOMEventRTTearoff(nsIContent *aContent) : mContent(aContent) { }
- 
-   nsresult GetDOM3EventTarget(nsIDOM3EventTarget **aTarget);
- 
-+  ~nsDOMEventRTTearoff() {
-+    NS_ERROR("Not a finalized object");
-+  }
-+
- public:
--  virtual ~nsDOMEventRTTearoff();
--
-   /**
-    * Use this static method to create instances of nsDOMEventRTTearoff.
-    * @param aContent the content to create a tearoff for
-    */
--  static nsDOMEventRTTearoff *Create(nsIContent *aContent);
--
--  /**
--   * Call before shutdown to clear the cache and free memory for this class.
--   */
--  static void Shutdown();
-+  static nsDOMEventRTTearoff *Create(nsIContent *aContent)
-+  {
-+    return new nsDOMEventRTTearoff(aContent);
-+  }
- 
-   // nsISupports
-   NS_DECL_CYCLE_COLLECTING_ISUPPORTS
-diff --git a/content/base/src/nsNodeInfo.cpp b/content/base/src/nsNodeInfo.cpp
---- a/content/base/src/nsNodeInfo.cpp
-+++ b/content/base/src/nsNodeInfo.cpp
-@@ -55,39 +55,6 @@
- #include NEW_H
- #include "nsFixedSizeAllocator.h"
- 
--static const size_t kNodeInfoPoolSizes[] = {
--  sizeof(nsNodeInfo)
--};
--
--static const PRInt32 kNodeInfoPoolInitialSize = 
--  (NS_SIZE_IN_HEAP(sizeof(nsNodeInfo))) * 64;
--
--// static
--nsFixedSizeAllocator* nsNodeInfo::sNodeInfoPool = nsnull;
--
--// static
--nsNodeInfo*
--nsNodeInfo::Create()
--{
--  if (!sNodeInfoPool) {
--    sNodeInfoPool = new nsFixedSizeAllocator();
--    if (!sNodeInfoPool)
--      return nsnull;
--
--    nsresult rv = sNodeInfoPool->Init("NodeInfo Pool", kNodeInfoPoolSizes,
--                                      1, kNodeInfoPoolInitialSize);
--    if (NS_FAILED(rv)) {
--      delete sNodeInfoPool;
--      sNodeInfoPool = nsnull;
--      return nsnull;
--    }
--  }
--
--  // Create a new one
--  void* place = sNodeInfoPool->Alloc(sizeof(nsNodeInfo));
--  return place ? new (place) nsNodeInfo() : nsnull;
--}
--
- nsNodeInfo::nsNodeInfo()
- {
- }
-@@ -131,7 +98,6 @@ nsNodeInfo::Init(nsIAtom *aName, nsIAtom
- // nsISupports
- 
- NS_IMPL_ADDREF(nsNodeInfo)
--NS_IMPL_RELEASE_WITH_DESTROY(nsNodeInfo, LastRelease())
- NS_IMPL_QUERY_INTERFACE1(nsNodeInfo, nsINodeInfo)
- 
- // nsINodeInfo
-@@ -277,27 +243,3 @@ nsNodeInfo::QualifiedNameEqualsInternal(
-   // end of aQualifiedName
-   return mInner.mName->EqualsUTF8(Substring(colon, end));
- }
--
--// static
--void
--nsNodeInfo::ClearCache()
--{
--  // Clear our cache.
--  delete sNodeInfoPool;
--  sNodeInfoPool = nsnull;
--}
--
--void
--nsNodeInfo::LastRelease()
--{
--  nsRefPtr<nsNodeInfoManager> kungFuDeathGrip = mOwnerManager;
--  this->~nsNodeInfo();
--
--  // The refcount balancing and destructor re-entrancy protection
--  // code in Release() sets mRefCnt to 1 so we have to set it to 0
--  // here to prevent leaks
--  mRefCnt = 0;
--
--  NS_ASSERTION(sNodeInfoPool, "No NodeInfoPool when deleting NodeInfo!!!");
--  sNodeInfoPool->Free(this, sizeof(nsNodeInfo));
--}
-diff --git a/content/base/src/nsNodeInfo.h b/content/base/src/nsNodeInfo.h
---- a/content/base/src/nsNodeInfo.h
-+++ b/content/base/src/nsNodeInfo.h
-@@ -52,7 +52,7 @@
- 
- class nsFixedSizeAllocator;
- 
--class nsNodeInfo : public nsINodeInfo
-+class nsNodeInfo : public XPCOMGCFinalizedObject, public nsINodeInfo
- {
- public:
-   NS_DECL_ISUPPORTS
-@@ -74,7 +74,9 @@ public:
-   // nsNodeInfo
-   // Create objects with Create
- public:
--  static nsNodeInfo *Create();
-+  static nsNodeInfo *Create() {
-+    return new nsNodeInfo();
-+  }
- private:
-   nsNodeInfo();
- protected:
-@@ -90,21 +92,6 @@ public:
-    */
-   nsresult Init(nsIAtom *aName, nsIAtom *aPrefix, PRInt32 aNamespaceID,
-                 nsNodeInfoManager *aOwnerManager);
--
--  /**
--   * Call before shutdown to clear the cache and free memory for this class.
--   */
--  static void ClearCache();
--
--private:
--  static nsFixedSizeAllocator* sNodeInfoPool;
--
--  /**
--   * This method gets called by Release() when it's time to delete 
--   * this object, instead of always deleting the object we'll put the
--   * object in the cache unless the cache is already full.
--   */
--   void LastRelease();
- };
- 
- #endif /* nsNodeInfo_h___ */
-diff --git a/content/base/src/nsNodeInfoManager.cpp b/content/base/src/nsNodeInfoManager.cpp
---- a/content/base/src/nsNodeInfoManager.cpp
-+++ b/content/base/src/nsNodeInfoManager.cpp
-@@ -109,44 +109,12 @@ nsNodeInfoManager::~nsNodeInfoManager()
-   if (mNodeInfoHash)
-     PL_HashTableDestroy(mNodeInfoHash);
- 
--
--  if (gNodeManagerCount == 0) {
--    nsNodeInfo::ClearCache();
--  }
--
-   // Note: mPrincipal may be null here if we never got inited correctly
-   NS_IF_RELEASE(mPrincipal);
- 
- #ifdef DEBUG_jst
-   printf ("Removing NodeInfoManager, gcount = %d\n", gNodeManagerCount);
- #endif
--}
--
--
--nsrefcnt
--nsNodeInfoManager::AddRef()
--{
--  NS_PRECONDITION(PRInt32(mRefCnt) >= 0, "illegal refcnt");
--
--  nsrefcnt count = PR_AtomicIncrement((PRInt32*)&mRefCnt);
--  NS_LOG_ADDREF(this, count, "nsNodeInfoManager", sizeof(*this));
--
--  return count;
--}
--
--nsrefcnt
--nsNodeInfoManager::Release()
--{
--  NS_PRECONDITION(0 != mRefCnt, "dup release");
--
--  nsrefcnt count = PR_AtomicDecrement((PRInt32 *)&mRefCnt);
--  NS_LOG_RELEASE(this, count, "nsNodeInfoManager");
--  if (count == 0) {
--    mRefCnt = 1; /* stabilize */
--    delete this;
--  }
--
--  return count;
- }
- 
- nsresult
-diff --git a/content/base/src/nsNodeInfoManager.h b/content/base/src/nsNodeInfoManager.h
---- a/content/base/src/nsNodeInfoManager.h
-+++ b/content/base/src/nsNodeInfoManager.h
-@@ -64,9 +64,6 @@ public:
-   nsNodeInfoManager();
-   ~nsNodeInfoManager();
- 
--  nsrefcnt AddRef(void);
--  nsrefcnt Release(void);
--
-   /**
-    * Initialize the nodeinfo manager with a document.
-    */
-@@ -146,7 +143,6 @@ private:
-                                                     const void *key2);
-   static PLHashNumber PR_CALLBACK GetNodeInfoInnerHashValue(const void *key);
- 
--  nsAutoRefCnt mRefCnt;
-   NS_DECL_OWNINGTHREAD
- 
-   PLHashTable *mNodeInfoHash;
-diff --git a/content/base/src/nsTextNode.cpp b/content/base/src/nsTextNode.cpp
---- a/content/base/src/nsTextNode.cpp
-+++ b/content/base/src/nsTextNode.cpp
-@@ -236,8 +236,7 @@ nsTextNode::List(FILE* out, PRInt32 aInd
-   for (index = aIndent; --index >= 0; ) fputs("  ", out);
- 
-   fprintf(out, "Text@%p", this);
--  fprintf(out, " intrinsicstate=[%08x]", IntrinsicState());
--  fprintf(out, " refcount=%d<", mRefCnt.get());
-+  fprintf(out, " intrinsicstate=[%08x]<", IntrinsicState());
- 
-   nsAutoString tmp;
-   ToCString(tmp, 0, mText.GetLength());
-diff --git a/content/events/src/nsEventDispatcher.cpp b/content/events/src/nsEventDispatcher.cpp
---- a/content/events/src/nsEventDispatcher.cpp
-+++ b/content/events/src/nsEventDispatcher.cpp
-@@ -494,8 +494,6 @@ nsEventDispatcher::Dispatch(nsISupports*
-   if (!externalDOMEvent && preVisitor.mDOMEvent) {
-     // An nsDOMEvent was created while dispatching the event.
-     // Duplicate private data if someone holds a pointer to it.
--    nsrefcnt rc = 0;
--    NS_RELEASE2(preVisitor.mDOMEvent, rc);
-     nsCOMPtr<nsIPrivateDOMEvent> privateEvent =
-       do_QueryInterface(preVisitor.mDOMEvent);
-     if (privateEvent) {
-diff --git a/content/html/document/src/nsHTMLDocument.h b/content/html/document/src/nsHTMLDocument.h
---- a/content/html/document/src/nsHTMLDocument.h
-+++ b/content/html/document/src/nsHTMLDocument.h
-@@ -78,9 +78,6 @@ public:
-   virtual nsresult Init();
- 
-   NS_IMETHOD QueryInterface(REFNSIID aIID, void** aInstancePtr);
--
--  NS_IMETHOD_(nsrefcnt) AddRef(void);
--  NS_IMETHOD_(nsrefcnt) Release(void);
- 
-   virtual void Reset(nsIChannel* aChannel, nsILoadGroup* aLoadGroup);
-   virtual void ResetToURI(nsIURI* aURI, nsILoadGroup* aLoadGroup,
-diff --git a/content/xbl/src/nsXBLBinding.h b/content/xbl/src/nsXBLBinding.h
---- a/content/xbl/src/nsXBLBinding.h
-+++ b/content/xbl/src/nsXBLBinding.h
-@@ -77,25 +77,6 @@ public:
-    *    which are queued to fire their constructors.
-    */
- 
--  nsrefcnt AddRef()
--  {
--    ++mRefCnt;
--    NS_LOG_ADDREF(this, mRefCnt, "nsXBLBinding", sizeof(nsXBLBinding));
--    return mRefCnt;
--  }
--
--  nsrefcnt Release()
--  {
--    --mRefCnt;
--    NS_LOG_RELEASE(this, mRefCnt, "nsXBLBinding");
--    if (mRefCnt == 0) {
--      mRefCnt = 1;
--      delete this;
--      return 0;
--    }
--    return mRefCnt;
--  }
--
-   NS_DECL_CYCLE_COLLECTION_NATIVE_CLASS(nsXBLBinding)
- 
-   nsXBLPrototypeBinding* PrototypeBinding() { return mPrototypeBinding; }
-@@ -169,7 +150,6 @@ public:
- 
- // MEMBER VARIABLES
- protected:
--  nsAutoRefCnt mRefCnt;
-   nsXBLPrototypeBinding* mPrototypeBinding; // Weak, but we're holding a ref to the docinfo
-   nsCOMPtr<nsIContent> mContent; // Strong. Our anonymous content stays around with us.
-   nsRefPtr<nsXBLBinding> mNextBinding; // Strong. The derived binding owns the base class bindings.
-diff --git a/content/xbl/src/nsXBLContentSink.cpp b/content/xbl/src/nsXBLContentSink.cpp
---- a/content/xbl/src/nsXBLContentSink.cpp
-+++ b/content/xbl/src/nsXBLContentSink.cpp
-@@ -893,13 +893,6 @@ nsXBLContentSink::CreateElement(const PR
-   AddAttributesToXULPrototype(aAtts, aAttsCount, prototype);
- 
-   nsresult rv = nsXULElement::Create(prototype, mDocument, PR_FALSE, aResult);
--
--  // XUL prototype elements start with a refcnt of 1 to represent
--  // ownership by the XUL prototype document.  In our case we have no
--  // prototype document, so release that reference.  The Create call
--  // above took a reference.
--  prototype->Release();
--
-   return rv;
- #endif
- }
-diff --git a/content/xbl/src/nsXBLInsertionPoint.cpp b/content/xbl/src/nsXBLInsertionPoint.cpp
---- a/content/xbl/src/nsXBLInsertionPoint.cpp
-+++ b/content/xbl/src/nsXBLInsertionPoint.cpp
-@@ -51,19 +51,6 @@ nsXBLInsertionPoint::~nsXBLInsertionPoin
- {
- }
- 
--nsrefcnt
--nsXBLInsertionPoint::Release()
--{
--  --mRefCnt;
--  NS_LOG_RELEASE(this, mRefCnt, "nsXBLInsertionPoint");
--  if (mRefCnt == 0) {
--    mRefCnt = 1;
--    delete this;
--    return 0;
--  }
--  return mRefCnt;
--}
--
- NS_IMPL_CYCLE_COLLECTION_NATIVE_CLASS(nsXBLInsertionPoint)
- NS_IMPL_CYCLE_COLLECTION_UNLINK_BEGIN_NATIVE(nsXBLInsertionPoint)
-   NS_IMPL_CYCLE_COLLECTION_UNLINK_NSCOMARRAY(mElements)
-diff --git a/content/xbl/src/nsXBLInsertionPoint.h b/content/xbl/src/nsXBLInsertionPoint.h
---- a/content/xbl/src/nsXBLInsertionPoint.h
-+++ b/content/xbl/src/nsXBLInsertionPoint.h
-@@ -44,21 +44,11 @@
- #include "nsCOMPtr.h"
- #include "nsCycleCollectionParticipant.h"
- 
--class nsXBLInsertionPoint
-+class nsXBLInsertionPoint : public XPCOMGCFinalizedObject
- {
- public:
-   nsXBLInsertionPoint(nsIContent* aParentElement, PRUint32 aIndex, nsIContent* aDefContent);
-   ~nsXBLInsertionPoint();
--
--  nsrefcnt AddRef()
--  {
--    ++mRefCnt;
--    NS_LOG_ADDREF(this, mRefCnt, "nsXBLInsertionPoint",
--                  sizeof(nsXBLInsertionPoint));
--    return mRefCnt;
--  }
--
--  nsrefcnt Release();
- 
-   NS_DECL_CYCLE_COLLECTION_NATIVE_CLASS(nsXBLInsertionPoint)
- 
-@@ -84,7 +74,6 @@ public:
-   PRBool Matches(nsIContent* aContent, PRUint32 aIndex);
- 
- protected:
--  nsAutoRefCnt mRefCnt;
-   nsIContent* mParentElement;            // This ref is weak.  The parent of the <children> element.
-   PRInt32 mIndex;                        // The index of this insertion point. -1 is a pseudo-point.
-   nsCOMArray<nsIContent> mElements;      // An array of elements present at the insertion point.
-diff --git a/content/xbl/src/nsXBLPrototypeBinding.cpp b/content/xbl/src/nsXBLPrototypeBinding.cpp
---- a/content/xbl/src/nsXBLPrototypeBinding.cpp
-+++ b/content/xbl/src/nsXBLPrototypeBinding.cpp
-@@ -137,7 +137,7 @@ private:
- // The same insertion point may be in the insertion point table for multiple
- // keys, so we refcount the entries.
- 
--class nsXBLInsertionPointEntry {
-+class nsXBLInsertionPointEntry : public XPCOMGCFinalizedObject {
- public:
-   ~nsXBLInsertionPointEntry() {
-     if (mDefaultContent) {
-@@ -157,92 +157,20 @@ public:
-   nsIContent* GetDefaultContent() { return mDefaultContent; }
-   void SetDefaultContent(nsIContent* aChildren) { mDefaultContent = aChildren; }
- 
--
--  // We keep kPool alive as long as there is at least either a
--  // nsXBLPrototypeBinding or a nsXBLInsertionPointEntry alive.
--  // nsXBLPrototypeBinding has its own global refcount so it only adds 1 to
--  // nsXBLInsertionPointEntry::gRefCnt as long as there's at least one
--  // nsXBLPrototypeBinding alive.
--
--  static void InitPool(PRInt32 aInitialSize)
--  {
--    if (++gRefCnt == 1) {
--      kPool = new nsFixedSizeAllocator();
--      if (kPool) {
--        static const size_t kBucketSizes[] = {
--          sizeof(nsXBLInsertionPointEntry)
--        };
--        kPool->Init("XBL Insertion Point Entries", kBucketSizes,
--                    NS_ARRAY_LENGTH(kBucketSizes), aInitialSize);
--      }
--    }
--  }
--  static PRBool PoolInited()
--  {
--    return kPool != nsnull;
--  }
--  static void ReleasePool()
--  {
--    if (--gRefCnt == 0) {
--      delete kPool;
--    }
--  }
--
-   static nsXBLInsertionPointEntry*
-   Create(nsIContent* aParent) {
--    void* place = kPool->Alloc(sizeof(nsXBLInsertionPointEntry));
--    if (!place) {
--      return nsnull;
--    }
--    ++gRefCnt;
--    return ::new (place) nsXBLInsertionPointEntry(aParent);
--  }
--
--  static void
--  Destroy(nsXBLInsertionPointEntry* aSelf) {
--    aSelf->~nsXBLInsertionPointEntry();
--    kPool->Free(aSelf, sizeof(*aSelf));
--    nsXBLInsertionPointEntry::ReleasePool();
--  }
--
--  nsrefcnt AddRef() {
--    ++mRefCnt;
--    NS_LOG_ADDREF(this, mRefCnt, "nsXBLInsertionPointEntry", sizeof(nsXBLInsertionPointEntry));
--    return mRefCnt;
--  }
--
--  nsrefcnt Release() {
--    --mRefCnt;
--    NS_LOG_RELEASE(this, mRefCnt, "nsXBLInsertionPointEntry");
--    if (mRefCnt == 0) {
--      Destroy(this);
--      return 0;
--    }
--    return mRefCnt;
-+    return new nsXBLInsertionPointEntry(aParent);
-   }
- 
- protected:
-   nsCOMPtr<nsIContent> mInsertionParent;
-   nsCOMPtr<nsIContent> mDefaultContent;
-   PRUint32 mInsertionIndex;
--  nsAutoRefCnt mRefCnt;
- 
-   nsXBLInsertionPointEntry(nsIContent* aParent)
-     : mInsertionParent(aParent),
-       mInsertionIndex(0) { }
--
--private:
--  // Hide so that only Create() and Destroy() can be used to
--  // allocate and deallocate from the heap
--  static void* operator new(size_t) CPP_THROW_NEW { return 0; }
--  static void operator delete(void*, size_t) {}
--
--  static nsFixedSizeAllocator* kPool;
--  static PRUint32 gRefCnt;
- };
--
--PRUint32 nsXBLInsertionPointEntry::gRefCnt = 0;
--nsFixedSizeAllocator* nsXBLInsertionPointEntry::kPool;
- 
- NS_IMPL_CYCLE_COLLECTION_NATIVE_CLASS(nsXBLInsertionPointEntry)
- NS_IMPL_CYCLE_COLLECTION_TRAVERSE_NATIVE_BEGIN(nsXBLInsertionPointEntry)
-@@ -292,7 +220,6 @@ nsXBLPrototypeBinding::nsXBLPrototypeBin
-     if (kAttrPool) {
-       kAttrPool->Init("XBL Attribute Entries", kAttrBucketSizes, kAttrNumBuckets, kAttrInitialSize);
-     }
--    nsXBLInsertionPointEntry::InitPool(kInsInitialSize);
-   }
- }
- 
-@@ -301,7 +228,7 @@ nsXBLPrototypeBinding::Init(const nsACSt
-                             nsIXBLDocumentInfo* aInfo,
-                             nsIContent* aElement)
- {
--  if (!kAttrPool || !nsXBLInsertionPointEntry::PoolInited()) {
-+  if (!kAttrPool) {
-     return NS_ERROR_OUT_OF_MEMORY;
-   }
- 
-@@ -343,7 +270,6 @@ nsXBLPrototypeBinding::~nsXBLPrototypeBi
-   gRefCnt--;
-   if (gRefCnt == 0) {
-     delete kAttrPool;
--    nsXBLInsertionPointEntry::ReleasePool();
-   }
-   MOZ_COUNT_DTOR(nsXBLPrototypeBinding);
- }
-@@ -1141,13 +1067,6 @@ nsXBLPrototypeBinding::ConstructAttribut
-   }
- }
- 
--static PRBool PR_CALLBACK
--DeleteInsertionPointEntry(nsHashKey* aKey, void* aData, void* aClosure)
--{
--  static_cast<nsXBLInsertionPointEntry*>(aData)->Release();
--  return PR_TRUE;
--}
--
- void 
- nsXBLPrototypeBinding::ConstructInsertionTable(nsIContent* aContent)
- {
-@@ -1160,7 +1079,7 @@ nsXBLPrototypeBinding::ConstructInsertio
-     return;
- 
-   mInsertionPointTable = new nsObjectHashtable(nsnull, nsnull,
--                                               DeleteInsertionPointEntry,
-+                                               nsnull,
-                                                nsnull, 4);
-   if (!mInsertionPointTable)
-     return;
-@@ -1177,7 +1096,6 @@ nsXBLPrototypeBinding::ConstructInsertio
-     child->GetAttr(kNameSpaceID_None, nsGkAtoms::includes, includes);
-     if (includes.IsEmpty()) {
-       nsISupportsKey key(nsGkAtoms::children);
--      xblIns->AddRef();
-       mInsertionPointTable->Put(&key, xblIns);
-     }
-     else {
-@@ -1196,7 +1114,6 @@ nsXBLPrototypeBinding::ConstructInsertio
-         nsCOMPtr<nsIAtom> atom = do_GetAtom(tok);
-            
-         nsISupportsKey key(atom);
--        xblIns->AddRef();
-         mInsertionPointTable->Put(&key, xblIns);
-           
-         token = nsCRT::strtok( newStr, "| ", &newStr );
-diff --git a/content/xml/content/src/nsXMLCDATASection.cpp b/content/xml/content/src/nsXMLCDATASection.cpp
---- a/content/xml/content/src/nsXMLCDATASection.cpp
-+++ b/content/xml/content/src/nsXMLCDATASection.cpp
-@@ -169,7 +169,7 @@ nsXMLCDATASection::List(FILE* out, PRInt
-   PRInt32 index;
-   for (index = aIndent; --index >= 0; ) fputs("  ", out);
- 
--  fprintf(out, "CDATASection refcount=%d<", mRefCnt.get());
-+  fprintf(out, "CDATASection<");
- 
-   nsAutoString tmp;
-   ToCString(tmp, 0, mText.GetLength());
-diff --git a/content/xml/content/src/nsXMLProcessingInstruction.cpp b/content/xml/content/src/nsXMLProcessingInstruction.cpp
---- a/content/xml/content/src/nsXMLProcessingInstruction.cpp
-+++ b/content/xml/content/src/nsXMLProcessingInstruction.cpp
-@@ -186,7 +186,7 @@ nsXMLProcessingInstruction::List(FILE* o
-   PRInt32 index;
-   for (index = aIndent; --index >= 0; ) fputs("  ", out);
- 
--  fprintf(out, "Processing instruction refcount=%d<", mRefCnt.get());
-+  fprintf(out, "Processing instruction <");
- 
-   nsAutoString tmp;
-   ToCString(tmp, 0, mText.GetLength());
-diff --git a/content/xslt/src/base/txNamespaceMap.cpp b/content/xslt/src/base/txNamespaceMap.cpp
---- a/content/xslt/src/base/txNamespaceMap.cpp
-+++ b/content/xslt/src/base/txNamespaceMap.cpp
-@@ -46,8 +46,8 @@ txNamespaceMap::txNamespaceMap()
- 
- txNamespaceMap::txNamespaceMap(const txNamespaceMap& aOther)
-     : mPrefixes(aOther.mPrefixes)
-+    , mNamespaces(aOther.mNamespaces)
- {
--    mNamespaces = aOther.mNamespaces; //bah! I want a copy-constructor!
- }
- 
- nsresult
-@@ -79,7 +79,7 @@ txNamespaceMap::mapNamespace(nsIAtom* aP
-     // Check if the mapping already exists
-     PRInt32 index = mPrefixes.IndexOf(prefix);
-     if (index >= 0) {
--        mNamespaces.ReplaceElementAt(NS_INT32_TO_PTR(nsId), index);
-+        mNamespaces[index] = nsId;
- 
-         return NS_OK;
-     }
-@@ -89,7 +89,7 @@ txNamespaceMap::mapNamespace(nsIAtom* aP
-         return NS_ERROR_OUT_OF_MEMORY;
-     }
-     
--    if (!mNamespaces.AppendElement(NS_INT32_TO_PTR(nsId))) {
-+    if (!mNamespaces.AppendElement(nsId)) {
-         mPrefixes.RemoveObjectAt(mPrefixes.Count() - 1);
- 
-         return NS_ERROR_OUT_OF_MEMORY;
-@@ -109,7 +109,7 @@ txNamespaceMap::lookupNamespace(nsIAtom*
- 
-     PRInt32 index = mPrefixes.IndexOf(prefix);
-     if (index >= 0) {
--        return NS_PTR_TO_INT32(mNamespaces.SafeElementAt(index));
-+        return mNamespaces[index];
-     }
- 
-     if (!prefix) {
-diff --git a/content/xslt/src/base/txNamespaceMap.h b/content/xslt/src/base/txNamespaceMap.h
---- a/content/xslt/src/base/txNamespaceMap.h
-+++ b/content/xslt/src/base/txNamespaceMap.h
-@@ -41,26 +41,13 @@
- 
- #include "nsIAtom.h"
- #include "nsCOMArray.h"
-+#include "nsTArray.h"
- 
--class txNamespaceMap
-+class txNamespaceMap : public XPCOMGCObject
- {
- public:
-     txNamespaceMap();
-     txNamespaceMap(const txNamespaceMap& aOther);
--
--    nsrefcnt AddRef()
--    {
--        return ++mRefCnt;
--    }
--    nsrefcnt Release()
--    {
--        if (--mRefCnt == 0) {
--            mRefCnt = 1; //stabilize
--            delete this;
--            return 0;
--        }
--        return mRefCnt;
--    }
- 
-     nsresult mapNamespace(nsIAtom* aPrefix, const nsAString& aNamespaceURI);
-     PRInt32 lookupNamespace(nsIAtom* aPrefix);
-@@ -68,9 +55,8 @@ public:
-     PRInt32 lookupNamespaceWithDefault(const nsAString& aPrefix);
- 
- private:
--    nsAutoRefCnt mRefCnt;
-     nsCOMArray<nsIAtom> mPrefixes;
--    nsVoidArray mNamespaces;
-+    nsTArray<PRInt32> mNamespaces;
- };
- 
- #endif //TRANSFRMX_TXNAMESPACEMAP_H
-diff --git a/content/xslt/src/xpath/txBooleanExpr.cpp b/content/xslt/src/xpath/txBooleanExpr.cpp
---- a/content/xslt/src/xpath/txBooleanExpr.cpp
-+++ b/content/xslt/src/xpath/txBooleanExpr.cpp
-@@ -44,6 +44,7 @@
- 
- #include "txExpr.h"
- #include "txIXPathContext.h"
-+#include "txResultRecycler.h"
- 
- /**
-  * Evaluates this Expr based on the given context node and processor state
-diff --git a/content/xslt/src/xpath/txBooleanResult.cpp b/content/xslt/src/xpath/txBooleanResult.cpp
---- a/content/xslt/src/xpath/txBooleanResult.cpp
-+++ b/content/xslt/src/xpath/txBooleanResult.cpp
-@@ -47,7 +47,6 @@
-  * @param boolean the MBool to use for initialization of this BooleanResult's value
- **/
- BooleanResult::BooleanResult(PRBool boolean)
--    : txAExprResult(nsnull)
- {
-     this->value = boolean;
- } //-- BooleanResult
-diff --git a/content/xslt/src/xpath/txCoreFunctionCall.cpp b/content/xslt/src/xpath/txCoreFunctionCall.cpp
---- a/content/xslt/src/xpath/txCoreFunctionCall.cpp
-+++ b/content/xslt/src/xpath/txCoreFunctionCall.cpp
-@@ -46,6 +46,7 @@
- #include <math.h>
- #include "txStringUtils.h"
- #include "txXMLUtils.h"
-+#include "txResultRecycler.h"
- 
- struct txCoreFunctionDescriptor
- {
-diff --git a/content/xslt/src/xpath/txExpr.h b/content/xslt/src/xpath/txExpr.h
---- a/content/xslt/src/xpath/txExpr.h
-+++ b/content/xslt/src/xpath/txExpr.h
-@@ -699,11 +699,11 @@ class txLiteralExpr : public Expr {
- class txLiteralExpr : public Expr {
- public:
-     txLiteralExpr(double aDbl)
--        : mValue(new NumberResult(aDbl, nsnull))
-+        : mValue(new NumberResult(aDbl))
-     {
-     }
-     txLiteralExpr(const nsAString& aStr)
--        : mValue(new StringResult(aStr, nsnull))
-+        : mValue(new StringResult(aStr))
-     {
-     }
-     txLiteralExpr(txAExprResult* aValue)
-diff --git a/content/xslt/src/xpath/txExprResult.h b/content/xslt/src/xpath/txExprResult.h
---- a/content/xslt/src/xpath/txExprResult.h
-+++ b/content/xslt/src/xpath/txExprResult.h
-@@ -54,11 +54,9 @@
-  * Note: for NodeSet, see NodeSet.h
- */
- 
--class txAExprResult
-+class txAExprResult : public XPCOMGCFinalizedObject
- {
- public:
--    friend class txResultRecycler;
--
-     // Update txLiteralExpr::getReturnType and sTypes in txEXSLTFunctions.cpp if
-     // this enum is changed.
-     enum ResultType {
-@@ -69,20 +67,12 @@ public:
-         RESULT_TREE_FRAGMENT
-     };
- 
--    txAExprResult(txResultRecycler* aRecycler) : mRecycler(aRecycler)
-+    txAExprResult()
-     {
-     }
-     virtual ~txAExprResult()
-     {
-     }
--
--    void AddRef()
--    {
--        ++mRefCnt;
--        NS_LOG_ADDREF(this, mRefCnt, "txAExprResult", sizeof(*this));
--    }
--    
--    void Release(); // Implemented in txResultRecycler.cpp
- 
-     /**
-      * Returns the type of ExprResult represented
-@@ -114,10 +104,6 @@ public:
-      * @return the Number value
-     **/
-     virtual double numberValue()          = 0;
--
--private:
--    nsAutoRefCnt mRefCnt;
--    nsRefPtr<txResultRecycler> mRecycler;
- };
- 
- #define TX_DECL_EXPRRESULT                                        \
-@@ -142,7 +128,7 @@ class NumberResult : public txAExprResul
- class NumberResult : public txAExprResult {
- 
- public:
--    NumberResult(double aValue, txResultRecycler* aRecycler);
-+    NumberResult(double aValue);
- 
-     TX_DECL_EXPRRESULT
- 
-@@ -153,8 +139,8 @@ public:
- 
- class StringResult : public txAExprResult {
- public:
--    StringResult(txResultRecycler* aRecycler);
--    StringResult(const nsAString& aValue, txResultRecycler* aRecycler);
-+    StringResult();
-+    StringResult(const nsAString& aValue);
- 
-     TX_DECL_EXPRRESULT
- 
-diff --git a/content/xslt/src/xpath/txNodeSet.cpp b/content/xslt/src/xpath/txNodeSet.cpp
---- a/content/xslt/src/xpath/txNodeSet.cpp
-+++ b/content/xslt/src/xpath/txNodeSet.cpp
-@@ -69,9 +69,8 @@ static const PRInt32 kTxNodeSetGrowFacto
- #define kForward   1
- #define kReversed -1
- 
--txNodeSet::txNodeSet(txResultRecycler* aRecycler)
--    : txAExprResult(aRecycler),
--      mStart(nsnull),
-+txNodeSet::txNodeSet()
-+    : mStart(nsnull),
-       mEnd(nsnull),
-       mStartBuffer(nsnull),
-       mEndBuffer(nsnull),
-@@ -80,9 +79,8 @@ txNodeSet::txNodeSet(txResultRecycler* a
- {
- }
- 
--txNodeSet::txNodeSet(const txXPathNode& aNode, txResultRecycler* aRecycler)
--    : txAExprResult(aRecycler),
--      mStart(nsnull),
-+txNodeSet::txNodeSet(const txXPathNode& aNode)
-+    : mStart(nsnull),
-       mEnd(nsnull),
-       mStartBuffer(nsnull),
-       mEndBuffer(nsnull),
-@@ -97,9 +95,8 @@ txNodeSet::txNodeSet(const txXPathNode& 
-     ++mEnd;
- }
- 
--txNodeSet::txNodeSet(const txNodeSet& aSource, txResultRecycler* aRecycler)
--    : txAExprResult(aRecycler),
--      mStart(nsnull),
-+txNodeSet::txNodeSet(const txNodeSet& aSource)
-+    : mStart(nsnull),
-       mEnd(nsnull),
-       mStartBuffer(nsnull),
-       mEndBuffer(nsnull),
-diff --git a/content/xslt/src/xpath/txNodeSet.h b/content/xslt/src/xpath/txNodeSet.h
---- a/content/xslt/src/xpath/txNodeSet.h
-+++ b/content/xslt/src/xpath/txNodeSet.h
-@@ -54,18 +54,18 @@ public:
-     /**
-      * Creates a new empty NodeSet
-      */
--    txNodeSet(txResultRecycler* aRecycler);
-+    txNodeSet();
- 
-     /**
-      * Creates a new NodeSet with one node.
-      */
--    txNodeSet(const txXPathNode& aNode, txResultRecycler* aRecycler);
-+    txNodeSet(const txXPathNode& aNode);
- 
-     /**
-      * Creates a new txNodeSet, copying the node references from the source
-      * NodeSet.
-      */
--    txNodeSet(const txNodeSet& aSource, txResultRecycler* aRecycler);
-+    txNodeSet(const txNodeSet& aSource);
- 
-     /**
-      * Destructor for txNodeSet, deletes the nodes.
-diff --git a/content/xslt/src/xpath/txNodeSetAdaptor.cpp b/content/xslt/src/xpath/txNodeSetAdaptor.cpp
---- a/content/xslt/src/xpath/txNodeSetAdaptor.cpp
-+++ b/content/xslt/src/xpath/txNodeSetAdaptor.cpp
-@@ -59,7 +59,7 @@ txNodeSetAdaptor::Init()
- txNodeSetAdaptor::Init()
- {
-     if (!mNodeSet) {
--        mNodeSet = new txNodeSet(nsnull);
-+        mNodeSet = new txNodeSet();
-     }
- 
-     return mNodeSet ? NS_OK : NS_ERROR_OUT_OF_MEMORY;
-diff --git a/content/xslt/src/xpath/txNumberResult.cpp b/content/xslt/src/xpath/txNumberResult.cpp
---- a/content/xslt/src/xpath/txNumberResult.cpp
-+++ b/content/xslt/src/xpath/txNumberResult.cpp
-@@ -51,8 +51,8 @@
-  * Creates a new NumberResult with the value of the given double parameter
-  * @param dbl the double to use for initialization of this NumberResult's value
- **/
--NumberResult::NumberResult(double aValue, txResultRecycler* aRecycler)
--    : txAExprResult(aRecycler), value(aValue)
-+NumberResult::NumberResult(double aValue)
-+    : value(aValue)
- {
- } //-- NumberResult
- 
-diff --git a/content/xslt/src/xpath/txRelationalExpr.cpp b/content/xslt/src/xpath/txRelationalExpr.cpp
---- a/content/xslt/src/xpath/txRelationalExpr.cpp
-+++ b/content/xslt/src/xpath/txRelationalExpr.cpp
-@@ -41,6 +41,7 @@
- #include "txNodeSet.h"
- #include "txIXPathContext.h"
- #include "txXPathTreeWalker.h"
-+#include "txResultRecycler.h"
- 
- /**
-  *  Compares the two ExprResults based on XPath 1.0 Recommendation (section 3.4)
-diff --git a/content/xslt/src/xpath/txResultRecycler.cpp b/content/xslt/src/xpath/txResultRecycler.cpp
---- a/content/xslt/src/xpath/txResultRecycler.cpp
-+++ b/content/xslt/src/xpath/txResultRecycler.cpp
-@@ -47,257 +47,87 @@ txResultRecycler::txResultRecycler()
- {
- }
- 
--txResultRecycler::~txResultRecycler()
--{
--    txStackIterator stringIter(&mStringResults);
--    while (stringIter.hasNext()) {
--        delete static_cast<StringResult*>(stringIter.next());
--    }
--    txStackIterator nodesetIter(&mNodeSetResults);
--    while (nodesetIter.hasNext()) {
--        delete static_cast<txNodeSet*>(nodesetIter.next());
--    }
--    txStackIterator numberIter(&mNumberResults);
--    while (numberIter.hasNext()) {
--        delete static_cast<NumberResult*>(numberIter.next());
--    }
--
--    NS_IF_RELEASE(mEmptyStringResult);
--    NS_IF_RELEASE(mTrueResult);
--    NS_IF_RELEASE(mFalseResult);
--}
--
--
- nsresult
- txResultRecycler::init()
- {
-     NS_ASSERTION(!mEmptyStringResult && !mTrueResult && !mFalseResult,
-                  "Already inited");
--    mEmptyStringResult = new StringResult(nsnull);
-+    mEmptyStringResult = new StringResult();
-     NS_ENSURE_TRUE(mEmptyStringResult, NS_ERROR_OUT_OF_MEMORY);
--
--    NS_ADDREF(mEmptyStringResult);
- 
-     mTrueResult = new BooleanResult(PR_TRUE);
-     NS_ENSURE_TRUE(mTrueResult, NS_ERROR_OUT_OF_MEMORY);
- 
--    NS_ADDREF(mTrueResult);
--
-     mFalseResult = new BooleanResult(PR_FALSE);
-     NS_ENSURE_TRUE(mFalseResult, NS_ERROR_OUT_OF_MEMORY);
- 
--    NS_ADDREF(mFalseResult);
--
-     return NS_OK;
--}
--
--
--void
--txResultRecycler::recycle(txAExprResult* aResult)
--{
--    NS_ASSERTION(aResult->mRefCnt == 0, "In-use txAExprResult recycled");
--    nsRefPtr<txResultRecycler> kungFuDeathGrip;
--    aResult->mRecycler.swap(kungFuDeathGrip);
--
--    nsresult rv = NS_OK;
--    switch (aResult->getResultType()) {
--        case txAExprResult::STRING:
--        {
--            rv = mStringResults.push(static_cast<StringResult*>(aResult));
--            if (NS_FAILED(rv)) {
--                delete aResult;
--            }
--            return;
--        }
--        case txAExprResult::NODESET:
--        {
--            rv = mNodeSetResults.push(static_cast<txNodeSet*>(aResult));
--            if (NS_FAILED(rv)) {
--                delete aResult;
--            }
--            return;
--        }
--        case txAExprResult::NUMBER:
--        {
--            rv = mNumberResults.push(static_cast<NumberResult*>(aResult));
--            if (NS_FAILED(rv)) {
--                delete aResult;
--            }
--            return;
--        }
--        default:
--        {
--            delete aResult;
--        }
--    }
- }
- 
- nsresult
- txResultRecycler::getStringResult(StringResult** aResult)
- {
--    if (mStringResults.isEmpty()) {
--        *aResult = new StringResult(this);
--        NS_ENSURE_TRUE(*aResult, NS_ERROR_OUT_OF_MEMORY);
--    }
--    else {
--        *aResult = static_cast<StringResult*>(mStringResults.pop());
--        (*aResult)->mValue.Truncate();
--        (*aResult)->mRecycler = this;
--    }
--    NS_ADDREF(*aResult);
--
--    return NS_OK;
-+    *aResult = new StringResult();
-+    return *aResult ? NS_OK : NS_ERROR_OUT_OF_MEMORY;
- }
- 
- nsresult
- txResultRecycler::getStringResult(const nsAString& aValue,
-                                   txAExprResult** aResult)
- {
--    if (mStringResults.isEmpty()) {
--        *aResult = new StringResult(aValue, this);
--        NS_ENSURE_TRUE(*aResult, NS_ERROR_OUT_OF_MEMORY);
--    }
--    else {
--        StringResult* strRes =
--            static_cast<StringResult*>(mStringResults.pop());
--        strRes->mValue = aValue;
--        strRes->mRecycler = this;
--        *aResult = strRes;
--    }
--    NS_ADDREF(*aResult);
--
--    return NS_OK;
-+    *aResult = new StringResult(aValue);
-+    return *aResult ? NS_OK : NS_ERROR_OUT_OF_MEMORY;
- }
- 
- void
- txResultRecycler::getEmptyStringResult(txAExprResult** aResult)
- {
-     *aResult = mEmptyStringResult;
--    NS_ADDREF(*aResult);
- }
- 
- nsresult
- txResultRecycler::getNodeSet(txNodeSet** aResult)
- {
--    if (mNodeSetResults.isEmpty()) {
--        *aResult = new txNodeSet(this);
--        NS_ENSURE_TRUE(*aResult, NS_ERROR_OUT_OF_MEMORY);
--    }
--    else {
--        *aResult = static_cast<txNodeSet*>(mNodeSetResults.pop());
--        (*aResult)->clear();
--        (*aResult)->mRecycler = this;
--    }
--    NS_ADDREF(*aResult);
--
--    return NS_OK;
-+    *aResult = new txNodeSet();
-+    return *aResult ? NS_OK : NS_ERROR_OUT_OF_MEMORY;
- }
- 
- nsresult
- txResultRecycler::getNodeSet(txNodeSet* aNodeSet, txNodeSet** aResult)
- {
--    if (mNodeSetResults.isEmpty()) {
--        *aResult = new txNodeSet(*aNodeSet, this);
--        NS_ENSURE_TRUE(*aResult, NS_ERROR_OUT_OF_MEMORY);
--    }
--    else {
--        *aResult = static_cast<txNodeSet*>(mNodeSetResults.pop());
--        (*aResult)->clear();
--        (*aResult)->append(*aNodeSet);
--        (*aResult)->mRecycler = this;
--    }
--    NS_ADDREF(*aResult);
--
--    return NS_OK;
-+    *aResult = new txNodeSet(*aNodeSet);
-+    return *aResult ? NS_OK : NS_ERROR_OUT_OF_MEMORY;
- }
- 
- nsresult
- txResultRecycler::getNodeSet(const txXPathNode& aNode, txAExprResult** aResult)
- {
--    if (mNodeSetResults.isEmpty()) {
--        *aResult = new txNodeSet(aNode, this);
--        NS_ENSURE_TRUE(*aResult, NS_ERROR_OUT_OF_MEMORY);
--    }
--    else {
--        txNodeSet* nodes = static_cast<txNodeSet*>(mNodeSetResults.pop());
--        nodes->clear();
--        nodes->append(aNode);
--        nodes->mRecycler = this;
--        *aResult = nodes;
--    }
--    NS_ADDREF(*aResult);
--
--    return NS_OK;
-+    *aResult = new txNodeSet(aNode);
-+    return *aResult ? NS_OK : NS_ERROR_OUT_OF_MEMORY;
- }
- 
- nsresult
- txResultRecycler::getNodeSet(const txXPathNode& aNode, txNodeSet** aResult)
- {
--    if (mNodeSetResults.isEmpty()) {
--        *aResult = new txNodeSet(aNode, this);
--        NS_ENSURE_TRUE(*aResult, NS_ERROR_OUT_OF_MEMORY);
--    }
--    else {
--        *aResult = static_cast<txNodeSet*>(mNodeSetResults.pop());
--        (*aResult)->clear();
--        (*aResult)->append(aNode);
--        (*aResult)->mRecycler = this;
--    }
--    NS_ADDREF(*aResult);
--
--    return NS_OK;
-+    *aResult = new txNodeSet(aNode);
-+    return *aResult ? NS_OK : NS_ERROR_OUT_OF_MEMORY;
- }
- 
- nsresult
- txResultRecycler::getNumberResult(double aValue, txAExprResult** aResult)
- {
--    if (mNumberResults.isEmpty()) {
--        *aResult = new NumberResult(aValue, this);
--        NS_ENSURE_TRUE(*aResult, NS_ERROR_OUT_OF_MEMORY);
--    }
--    else {
--        NumberResult* numRes =
--            static_cast<NumberResult*>(mNumberResults.pop());
--        numRes->value = aValue;
--        numRes->mRecycler = this;
--        *aResult = numRes;
--    }
--    NS_ADDREF(*aResult);
--
--    return NS_OK;
-+    *aResult = new NumberResult(aValue);
-+    return *aResult ? NS_OK : NS_ERROR_OUT_OF_MEMORY;
- }
- 
- void
- txResultRecycler::getBoolResult(PRBool aValue, txAExprResult** aResult)
- {
-     *aResult = aValue ? mTrueResult : mFalseResult;
--    NS_ADDREF(*aResult);
- }
- 
- nsresult
- txResultRecycler::getNonSharedNodeSet(txNodeSet* aNodeSet, txNodeSet** aResult)
- {
--    if (aNodeSet->mRefCnt > 1) {
--        return getNodeSet(aNodeSet, aResult);
--    }
--
--    *aResult = aNodeSet;
--    NS_ADDREF(*aResult);
--
--    return NS_OK;
-+    return getNodeSet(aNodeSet, aResult);
- }
--
--void
--txAExprResult::Release()
--{
--    --mRefCnt;
--    NS_LOG_RELEASE(this, mRefCnt, "txAExprResult");
--    if (mRefCnt == 0) {
--        if (mRecycler) {
--            mRecycler->recycle(this);
--        }
--        else {
--            delete this;
--        }
--    }
--}
-diff --git a/content/xslt/src/xpath/txResultRecycler.h b/content/xslt/src/xpath/txResultRecycler.h
---- a/content/xslt/src/xpath/txResultRecycler.h
-+++ b/content/xslt/src/xpath/txResultRecycler.h
-@@ -49,33 +49,12 @@ class NumberResult;
- class NumberResult;
- class BooleanResult;
- 
--class txResultRecycler
-+class txResultRecycler : public XPCOMGCObject
- {
- public:
-     txResultRecycler();
--    ~txResultRecycler();
-+    ~txResultRecycler() { }
-     nsresult init();
--
--    void AddRef()
--    {
--        ++mRefCnt;
--        NS_LOG_ADDREF(this, mRefCnt, "txResultRecycler", sizeof(*this));
--    }
--    void Release()
--    {
--        --mRefCnt;
--        NS_LOG_RELEASE(this, mRefCnt, "txResultRecycler");
--        if (mRefCnt == 0) {
--            mRefCnt = 1; //stabilize
--            delete this;
--        }
--    }
--
--    /**
--     * Returns an txAExprResult to this recycler for reuse.
--     * @param aResult  result to recycle
--     */
--    void recycle(txAExprResult* aResult);
- 
-     /**
-      * Functions to return results that will be fully used by the caller.
-@@ -102,10 +81,6 @@ public:
-     nsresult getNonSharedNodeSet(txNodeSet* aNodeSet, txNodeSet** aResult);
- 
- private:
--    nsAutoRefCnt mRefCnt;
--    txStack mStringResults;
--    txStack mNodeSetResults;
--    txStack mNumberResults;
-     StringResult* mEmptyStringResult;
-     BooleanResult* mTrueResult;
-     BooleanResult* mFalseResult;
-diff --git a/content/xslt/src/xpath/txStringResult.cpp b/content/xslt/src/xpath/txStringResult.cpp
---- a/content/xslt/src/xpath/txStringResult.cpp
-+++ b/content/xslt/src/xpath/txStringResult.cpp
-@@ -45,8 +45,7 @@
- /**
-  * Default Constructor
- **/
--StringResult::StringResult(txResultRecycler* aRecycler)
--    : txAExprResult(aRecycler)
-+StringResult::StringResult()
- {
- }
- 
-@@ -54,8 +53,8 @@ StringResult::StringResult(txResultRecyc
-  * Creates a new StringResult with the value of the given String parameter
-  * @param str the String to use for initialization of this StringResult's value
- **/
--StringResult::StringResult(const nsAString& aValue, txResultRecycler* aRecycler)
--    : txAExprResult(aRecycler), mValue(aValue)
-+StringResult::StringResult(const nsAString& aValue)
-+    : mValue(aValue)
- {
- }
- 
-diff --git a/content/xslt/src/xslt/txExecutionState.cpp b/content/xslt/src/xslt/txExecutionState.cpp
---- a/content/xslt/src/xslt/txExecutionState.cpp
-+++ b/content/xslt/src/xslt/txExecutionState.cpp
-@@ -183,7 +183,7 @@ txExecutionState::init(const txXPathNode
-     
-     // The actual value here doesn't really matter since noone should use this
-     // value. But lets put something errorlike in just in case
--    mGlobalVarPlaceholderValue = new StringResult(NS_LITERAL_STRING("Error"), nsnull);
-+    mGlobalVarPlaceholderValue = new StringResult(NS_LITERAL_STRING("Error"));
-     NS_ENSURE_TRUE(mGlobalVarPlaceholderValue, NS_ERROR_OUT_OF_MEMORY);
- 
-     // Initiate first instruction. This has to be done last since findTemplate
-diff --git a/content/xslt/src/xslt/txKey.h b/content/xslt/src/xslt/txKey.h
---- a/content/xslt/src/xslt/txKey.h
-+++ b/content/xslt/src/xslt/txKey.h
-@@ -70,7 +70,7 @@ struct txKeyValueHashEntry : public PLDH
- {
-     txKeyValueHashEntry(const void* aKey)
-         : mKey(*static_cast<const txKeyValueHashKey*>(aKey)),
--          mNodeSet(new txNodeSet(nsnull))
-+          mNodeSet(new txNodeSet())
-     {
-     }
- 
-diff --git a/content/xslt/src/xslt/txKeyFunctionCall.cpp b/content/xslt/src/xslt/txKeyFunctionCall.cpp
---- a/content/xslt/src/xslt/txKeyFunctionCall.cpp
-+++ b/content/xslt/src/xslt/txKeyFunctionCall.cpp
-@@ -288,7 +288,7 @@ txKeyHash::init()
-     rv = mIndexedKeys.Init(1);
-     NS_ENSURE_SUCCESS(rv, rv);
-     
--    mEmptyNodeSet = new txNodeSet(nsnull);
-+    mEmptyNodeSet = new txNodeSet();
-     NS_ENSURE_TRUE(mEmptyNodeSet, NS_ERROR_OUT_OF_MEMORY);
-     
-     return NS_OK;
-diff --git a/content/xslt/src/xslt/txMozillaStylesheetCompiler.cpp b/content/xslt/src/xslt/txMozillaStylesheetCompiler.cpp
---- a/content/xslt/src/xslt/txMozillaStylesheetCompiler.cpp
-+++ b/content/xslt/src/xslt/txMozillaStylesheetCompiler.cpp
-@@ -433,9 +433,6 @@ public:
-     nsresult startLoad(nsIURI* aUri, txStylesheetCompiler* aCompiler,
-                        nsIPrincipal* aSourcePrincipal);
- 
--protected:
--    nsAutoRefCnt mRefCnt;
--
- private:
-     nsRefPtr<txMozillaXSLTProcessor> mProcessor;
-     nsCOMPtr<nsILoadGroup> mLoadGroup;
-@@ -451,23 +448,6 @@ txCompileObserver::txCompileObserver(txM
-     : mProcessor(aProcessor),
-       mLoadGroup(aLoadGroup)
- {
--}
--
--nsrefcnt
--txCompileObserver::AddRef()
--{
--    return ++mRefCnt;
--}
--
--nsrefcnt
--txCompileObserver::Release()
--{
--    if (--mRefCnt == 0) {
--        mRefCnt = 1; //stabilize
--        delete this;
--        return 0;
--    }
--    return mRefCnt;
- }
- 
- nsresult
-@@ -667,29 +647,12 @@ public:
- 
- protected:
-     nsRefPtr<txMozillaXSLTProcessor> mProcessor;
--    nsAutoRefCnt mRefCnt;
-+    nsCOMPtr<nsIPrincipal> mCallerPrincipal;
- };
- 
- txSyncCompileObserver::txSyncCompileObserver(txMozillaXSLTProcessor* aProcessor)
-   : mProcessor(aProcessor)
- {
--}
--
--nsrefcnt
--txSyncCompileObserver::AddRef()
--{
--    return ++mRefCnt;
--}
--
--nsrefcnt
--txSyncCompileObserver::Release()
--{
--    if (--mRefCnt == 0) {
--        mRefCnt = 1; //stabilize
--        delete this;
--        return 0;
--    }
--    return mRefCnt;
- }
- 
- nsresult
-diff --git a/content/xslt/src/xslt/txMozillaXSLTProcessor.cpp b/content/xslt/src/xslt/txMozillaXSLTProcessor.cpp
---- a/content/xslt/src/xslt/txMozillaXSLTProcessor.cpp
-+++ b/content/xslt/src/xslt/txMozillaXSLTProcessor.cpp
-@@ -499,7 +499,7 @@ txMozillaXSLTProcessor::AddXSLTParam(con
-         NS_ENSURE_SUCCESS(rv, rv);
-     }
-     else {
--        value = new StringResult(aValue, nsnull);
-+        value = new StringResult(aValue);
-         NS_ENSURE_TRUE(value, NS_ERROR_OUT_OF_MEMORY);
-     }
- 
-@@ -1315,7 +1315,7 @@ txVariable::Convert(nsIVariant *aValue, 
-             nsresult rv = aValue->GetAsDouble(&value);
-             NS_ENSURE_SUCCESS(rv, rv);
- 
--            *aResult = new NumberResult(value, nsnull);
-+            *aResult = new NumberResult(value);
-             NS_ENSURE_TRUE(*aResult, NS_ERROR_OUT_OF_MEMORY);
- 
-             NS_ADDREF(*aResult);
-@@ -1354,7 +1354,7 @@ txVariable::Convert(nsIVariant *aValue, 
-             nsresult rv = aValue->GetAsAString(value);
-             NS_ENSURE_SUCCESS(rv, rv);
- 
--            *aResult = new StringResult(value, nsnull);
-+            *aResult = new StringResult(value);
-             NS_ENSURE_TRUE(*aResult, NS_ERROR_OUT_OF_MEMORY);
- 
-             NS_ADDREF(*aResult);
-@@ -1377,7 +1377,7 @@ txVariable::Convert(nsIVariant *aValue, 
-                     return NS_ERROR_FAILURE;
-                 }
- 
--                *aResult = new txNodeSet(*xpathNode, nsnull);
-+                *aResult = new txNodeSet(*xpathNode);
-                 if (!*aResult) {
-                     return NS_ERROR_OUT_OF_MEMORY;
-                 }
-@@ -1394,7 +1394,7 @@ txVariable::Convert(nsIVariant *aValue, 
- 
-             nsCOMPtr<nsIDOMNodeList> nodeList = do_QueryInterface(supports);
-             if (nodeList) {
--                nsRefPtr<txNodeSet> nodeSet = new txNodeSet(nsnull);
-+                nsRefPtr<txNodeSet> nodeSet = new txNodeSet();
-                 if (!nodeSet) {
-                     return NS_ERROR_OUT_OF_MEMORY;
-                 }
-@@ -1449,7 +1449,7 @@ txVariable::Convert(nsIVariant *aValue, 
-                                     (::JS_GetStringChars(str));
-                 nsDependentString value(strChars, ::JS_GetStringLength(str));
- 
--                *aResult = new StringResult(value, nsnull);
-+                *aResult = new StringResult(value);
-                 if (!*aResult) {
-                     return NS_ERROR_OUT_OF_MEMORY;
-                 }
-@@ -1477,7 +1477,7 @@ txVariable::Convert(nsIVariant *aValue, 
- 
-             nsISupports** values = static_cast<nsISupports**>(array);
- 
--            nsRefPtr<txNodeSet> nodeSet = new txNodeSet(nsnull);
-+            nsRefPtr<txNodeSet> nodeSet = new txNodeSet();
-             if (!nodeSet) {
-                 NS_FREE_XPCOM_ISUPPORTS_POINTER_ARRAY(count, values);
- 
-diff --git a/content/xslt/src/xslt/txRtfHandler.cpp b/content/xslt/src/xslt/txRtfHandler.cpp
---- a/content/xslt/src/xslt/txRtfHandler.cpp
-+++ b/content/xslt/src/xslt/txRtfHandler.cpp
-@@ -40,8 +40,7 @@
- #include "txRtfHandler.h"
- 
- txResultTreeFragment::txResultTreeFragment(nsAutoPtr<txResultBuffer>& aBuffer)
--    : txAExprResult(nsnull),
--      mBuffer(aBuffer)
-+    : mBuffer(aBuffer)
- {
- }
- 
-diff --git a/content/xslt/src/xslt/txStylesheet.h b/content/xslt/src/xslt/txStylesheet.h
---- a/content/xslt/src/xslt/txStylesheet.h
-+++ b/content/xslt/src/xslt/txStylesheet.h
-@@ -55,7 +55,7 @@ class txStripSpaceTest;
- class txStripSpaceTest;
- class txXSLKey;
- 
--class txStylesheet
-+class txStylesheet : public XPCOMGCFinalizedObject
- {
- public:
-     class ImportFrame;
-@@ -67,20 +67,6 @@ public:
-     txStylesheet();
-     ~txStylesheet();
-     nsresult init();
--
--    nsrefcnt AddRef()
--    {
--        return ++mRefCnt;
--    }
--    nsrefcnt Release()
--    {
--        if (--mRefCnt == 0) {
--            mRefCnt = 1; //stabilize
--            delete this;
--            return 0;
--        }
--        return mRefCnt;
--    }
- 
-     txInstruction* findTemplate(const txXPathNode& aNode,
-                                 const txExpandedName& aMode,
-@@ -159,9 +145,6 @@ private:
-                            nsTPtrArray<txStripSpaceTest>& aFrameStripSpaceTests);
-     nsresult addAttributeSet(txAttributeSetItem* aAttributeSetItem);
- 
--    // Refcount
--    nsAutoRefCnt mRefCnt;
--
-     // List of ImportFrames
-     txList mImportFrames;
-     
-diff --git a/content/xslt/src/xslt/txStylesheetCompiler.cpp b/content/xslt/src/xslt/txStylesheetCompiler.cpp
---- a/content/xslt/src/xslt/txStylesheetCompiler.cpp
-+++ b/content/xslt/src/xslt/txStylesheetCompiler.cpp
-@@ -69,27 +69,6 @@ txStylesheetCompiler::txStylesheetCompil
-     mStatus = init(aStylesheetURI, aStylesheet, aInsertPosition);
- }
- 
--nsrefcnt
--txStylesheetCompiler::AddRef()
--{
--    ++mRefCnt;
--    NS_LOG_ADDREF(this, mRefCnt, "txStylesheetCompiler", sizeof(*this));
--    return mRefCnt;
--}
--
--nsrefcnt
--txStylesheetCompiler::Release()
--{
--    --mRefCnt;
--    NS_LOG_RELEASE(this, mRefCnt, "txStylesheetCompiler");
--    if (mRefCnt == 0) {
--        mRefCnt = 1; //stabilize
--        delete this;
--        return 0;
--    }
--    return mRefCnt;
--}
--
- void
- txStylesheetCompiler::setBaseURI(const nsString& aBaseURI)
- {
-diff --git a/content/xslt/src/xslt/txStylesheetCompiler.h b/content/xslt/src/xslt/txStylesheetCompiler.h
---- a/content/xslt/src/xslt/txStylesheetCompiler.h
-+++ b/content/xslt/src/xslt/txStylesheetCompiler.h
-@@ -75,9 +75,6 @@ class txACompileObserver
- class txACompileObserver
- {
- public:
--    virtual nsrefcnt AddRef() = 0;
--    virtual nsrefcnt Release() = 0;
--
-     virtual nsresult loadURI(const nsAString& aUri,
-                              const nsAString& aReferrerUri,
-                              txStylesheetCompiler* aCompiler) = 0;
-@@ -88,8 +85,6 @@ public:
- };
- 
- #define TX_DECL_ACOMPILEOBSERVER \
--  nsrefcnt AddRef(); \
--  nsrefcnt Release(); \
-   nsresult loadURI(const nsAString& aUri, const nsAString& aReferrerUri, \
-                    txStylesheetCompiler* aCompiler); \
-   void onDoneCompiling(txStylesheetCompiler* aCompiler, nsresult aResult, \
-@@ -213,8 +208,6 @@ public:
-                          txStylesheet* aStylesheet,
-                          txListIterator* aInsertPosition,
-                          txACompileObserver* aObserver);
--    virtual nsrefcnt AddRef();
--    virtual nsrefcnt Release();
- 
-     void setBaseURI(const nsString& aBaseURI);
- 
-@@ -251,7 +244,6 @@ private:
-     nsresult ensureNewElementContext();
-     nsresult maybeDoneCompiling();
- 
--    nsAutoRefCnt mRefCnt;
-     nsString mCharacters;
-     nsresult mStatus;
- };
-diff --git a/content/xul/content/src/nsXULElement.h b/content/xul/content/src/nsXULElement.h
---- a/content/xul/content/src/nsXULElement.h
-+++ b/content/xul/content/src/nsXULElement.h
-@@ -186,14 +186,12 @@ public:
- 
-  */
- 
--class nsXULPrototypeNode
-+class nsXULPrototypeNode : public XPCOMGCFinalizedObject
- {
- public:
-     enum Type { eType_Element, eType_Script, eType_Text, eType_PI };
- 
-     Type                     mType;
--
--    nsAutoRefCnt             mRefCnt;
- 
-     virtual ~nsXULPrototypeNode() {}
-     virtual nsresult Serialize(nsIObjectOutputStream* aStream,
-@@ -209,17 +207,6 @@ public:
-     virtual PRUint32 ClassSize() = 0;
- #endif
- 
--    void AddRef() {
--        ++mRefCnt;
--        NS_LOG_ADDREF(this, mRefCnt, ClassName(), ClassSize());
--    }
--    void Release()
--    {
--        --mRefCnt;
--        NS_LOG_RELEASE(this, mRefCnt, ClassName());
--        if (mRefCnt == 0)
--            delete this;
--    }
-     /**
-      * The prototype document must call ReleaseSubtree when it is going
-      * away.  This makes the parents through the tree stop owning their
-@@ -228,13 +215,13 @@ public:
-      * those prototypes no longer remember their children to allow them
-      * to be constructed.
-      */
--    virtual void ReleaseSubtree() { Release(); }
-+    virtual void ReleaseSubtree() { }
- 
-     NS_DECL_CYCLE_COLLECTION_NATIVE_CLASS(nsXULPrototypeNode)
- 
- protected:
-     nsXULPrototypeNode(Type aType)
--        : mType(aType), mRefCnt(1) {}
-+        : mType(aType) {}
- };
- 
- class nsXULPrototypeElement : public nsXULPrototypeNode
-@@ -280,8 +267,6 @@ public:
-         delete[] mChildren;
-         mChildren = nsnull;
-       }
--
--      nsXULPrototypeNode::ReleaseSubtree();
-     }
- 
-     virtual nsresult Serialize(nsIObjectOutputStream* aStream,
-diff --git a/content/xul/document/src/nsXULContentSink.cpp b/content/xul/document/src/nsXULContentSink.cpp
---- a/content/xul/document/src/nsXULContentSink.cpp
-+++ b/content/xul/document/src/nsXULContentSink.cpp
-@@ -228,24 +228,6 @@ XULContentSinkImpl::~XULContentSinkImpl(
-     // any remaining content elements. The context stack _should_ be
-     // empty, unless something has gone wrong.
-     while (mContextStack.Depth()) {
--        nsresult rv;
--
--        nsVoidArray* children;
--        rv = mContextStack.GetTopChildren(&children);
--        if (NS_SUCCEEDED(rv)) {
--            for (PRInt32 i = children->Count() - 1; i >= 0; --i) {
--                nsXULPrototypeNode* child =
--                    reinterpret_cast<nsXULPrototypeNode*>(children->ElementAt(i));
--
--                child->Release();
--            }
--        }
--
--        nsXULPrototypeNode* node;
--        rv = mContextStack.GetTopNode(&node);
--        if (NS_SUCCEEDED(rv))
--            node->Release();
--
-         State state;
-         mContextStack.Pop(&state);
-     }
-@@ -714,12 +696,10 @@ XULContentSinkImpl::HandleProcessingInst
-     nsVoidArray* children;
-     rv = mContextStack.GetTopChildren(&children);
-     if (NS_FAILED(rv)) {
--        pi->Release();
-         return rv;
-     }
- 
-     if (!children->AppendElement(pi)) {
--        pi->Release();
-         return NS_ERROR_OUT_OF_MEMORY;
-     }
- 
-@@ -752,17 +732,6 @@ XULContentSinkImpl::ReportError(const PR
-   // make sure to empty the context stack so that
-   // <parsererror> could become the root element.
-   while (mContextStack.Depth()) {
--    nsVoidArray* children;
--    rv = mContextStack.GetTopChildren(&children);
--    if (NS_SUCCEEDED(rv)) {
--      for (PRInt32 i = children->Count() - 1; i >= 0; --i) {
--        nsXULPrototypeNode* child =
--            reinterpret_cast<nsXULPrototypeNode*>(children->ElementAt(i));
--
--        child->Release();
--      }
--    }
--
-     State state;
-     mContextStack.Pop(&state);
-   }
-@@ -909,7 +878,6 @@ XULContentSinkImpl::OpenRoot(const PRUni
-     // containers will hook up to us as their parent.
-     rv = mContextStack.Push(element, mState);
-     if (NS_FAILED(rv)) {
--        element->Release();
-         return rv;
-     }
- 
-diff --git a/content/xul/document/src/nsXULPrototypeDocument.cpp b/content/xul/document/src/nsXULPrototypeDocument.cpp
---- a/content/xul/document/src/nsXULPrototypeDocument.cpp
-+++ b/content/xul/document/src/nsXULPrototypeDocument.cpp
-@@ -179,12 +179,6 @@ nsXULPrototypeDocument::~nsXULPrototypeD
-         mGlobalObject->ClearGlobalObjectOwner();
-     }
- 
--    PRUint32 count = mProcessingInstructions.Length();
--    for (PRUint32 i = 0; i < count; i++)
--    {
--        mProcessingInstructions[i]->Release();
--    }
--
-     if (mRoot)
-         mRoot->ReleaseSubtree();
- 
-diff --git a/content/xul/templates/src/nsXMLBinding.h b/content/xul/templates/src/nsXMLBinding.h
---- a/content/xul/templates/src/nsXMLBinding.h
-+++ b/content/xul/templates/src/nsXMLBinding.h
-@@ -72,22 +72,14 @@ struct nsXMLBinding {
-  * a collection of <binding> descriptors. This object is refcounted by
-  * nsXMLBindingValues objects and the query processor.
-  */
--class nsXMLBindingSet
-+class nsXMLBindingSet : public XPCOMGCFinalizedObject
- {
- public:
--
--  // results hold a reference to a binding set in their
--  // nsXMLBindingValues fields
--  nsAutoRefCnt mRefCnt;
- 
-   // pointer to the first binding in a linked list
-   nsAutoPtr<nsXMLBinding> mFirst;
- 
- public:
--
--  NS_IMETHOD_(nsrefcnt) AddRef();
--  NS_IMETHOD_(nsrefcnt) Release();
--  NS_DECL_OWNINGTHREAD
- 
-   /**
-    * Add a binding to the set
-diff --git a/docshell/base/nsWebShell.cpp b/docshell/base/nsWebShell.cpp
---- a/docshell/base/nsWebShell.cpp
-+++ b/docshell/base/nsWebShell.cpp
-@@ -561,9 +561,6 @@ nsWebShell::~nsWebShell()
- {
-    Destroy();
- 
--  ++mRefCnt; // following releases can cause this destructor to be called
--             // recursively if the refcount is allowed to remain 0
--
-   mContentViewer=nsnull;
-   mDeviceContext=nsnull;
- 
-diff --git a/dom/src/base/nsWindowRoot.cpp b/dom/src/base/nsWindowRoot.cpp
---- a/dom/src/base/nsWindowRoot.cpp
-+++ b/dom/src/base/nsWindowRoot.cpp
-@@ -67,10 +67,8 @@ nsWindowRoot::nsWindowRoot(nsIDOMWindow*
-   nsFocusController::Create(getter_AddRefs(mFocusController));
- 
-   nsCOMPtr<nsIDOMFocusListener> focusListener(do_QueryInterface(mFocusController));
--  ++mRefCnt;
-   AddEventListener(NS_LITERAL_STRING("focus"), focusListener, PR_TRUE);
-   AddEventListener(NS_LITERAL_STRING("blur"), focusListener, PR_TRUE);
--  --mRefCnt;
- }
- 
- nsWindowRoot::~nsWindowRoot()
-diff --git a/editor/txtsvc/src/nsTSDNotifier.cpp b/editor/txtsvc/src/nsTSDNotifier.cpp
---- a/editor/txtsvc/src/nsTSDNotifier.cpp
-+++ b/editor/txtsvc/src/nsTSDNotifier.cpp
-@@ -48,32 +48,6 @@ nsTSDNotifier::~nsTSDNotifier()
- {
-   mDoc = 0;
- }
--
--#define DEBUG_TSD_NOTIFIER_REFCNT 1
--
--#ifdef DEBUG_TSD_NOTIFIER_REFCNT
--
--nsrefcnt nsTSDNotifier::AddRef(void)
--{
--  return ++mRefCnt;
--}
--
--nsrefcnt nsTSDNotifier::Release(void)
--{
--  NS_PRECONDITION(0 != mRefCnt, "dup release");
--  if (--mRefCnt == 0) {
--    NS_DELETEXPCOM(this);
--    return 0;
--  }
--  return mRefCnt;
--}
--
--#else
--
--NS_IMPL_ADDREF(nsTSDNotifier)
--NS_IMPL_RELEASE(nsTSDNotifier)
--
--#endif
- 
- NS_IMPL_QUERY_INTERFACE1(nsTSDNotifier, nsIEditActionListener)
- 
-diff --git a/editor/txtsvc/src/nsTextServicesDocument.cpp b/editor/txtsvc/src/nsTextServicesDocument.cpp
---- a/editor/txtsvc/src/nsTextServicesDocument.cpp
-+++ b/editor/txtsvc/src/nsTextServicesDocument.cpp
-@@ -104,8 +104,6 @@ nsIRangeUtils* nsTextServicesDocument::s
- 
- nsTextServicesDocument::nsTextServicesDocument()
- {
--  mRefCnt         = 0;
--
-   mSelStartIndex  = -1;
-   mSelStartOffset = -1;
-   mSelEndIndex    = -1;
-@@ -142,32 +140,6 @@ nsTextServicesDocument::Shutdown()
- {
-   NS_IF_RELEASE(sRangeHelper);
- }
--
--#define DEBUG_TEXT_SERVICES__DOCUMENT_REFCNT 1
--
--#ifdef DEBUG_TEXT_SERVICES__DOCUMENT_REFCNT
--
--nsrefcnt nsTextServicesDocument::AddRef(void)
--{
--  return ++mRefCnt;
--}
--
--nsrefcnt nsTextServicesDocument::Release(void)
--{
--  NS_PRECONDITION(0 != mRefCnt, "dup release");
--  if (--mRefCnt == 0) {
--    NS_DELETEXPCOM(this);
--    return 0;
--  }
--  return mRefCnt;
--}
--
--#else
--
--NS_IMPL_ADDREF(nsTextServicesDocument)
--NS_IMPL_RELEASE(nsTextServicesDocument)
--
--#endif
- 
- NS_IMPL_QUERY_INTERFACE1(nsTextServicesDocument, nsITextServicesDocument)
- 
-diff --git a/embedding/browser/gtk/src/EmbedPrivate.cpp b/embedding/browser/gtk/src/EmbedPrivate.cpp
---- a/embedding/browser/gtk/src/EmbedPrivate.cpp
-+++ b/embedding/browser/gtk/src/EmbedPrivate.cpp
-@@ -211,18 +211,6 @@ NS_IMPL_QUERY_INTERFACE2(GTKEmbedDirecto
- NS_IMPL_QUERY_INTERFACE2(GTKEmbedDirectoryProvider,
-                          nsIDirectoryServiceProvider,
-                          nsIDirectoryServiceProvider2)
--
--NS_IMETHODIMP_(nsrefcnt)
--GTKEmbedDirectoryProvider::AddRef()
--{
--  return 1;
--}
--
--NS_IMETHODIMP_(nsrefcnt)
--GTKEmbedDirectoryProvider::Release()
--{
--  return 1;
--}
- 
- NS_IMETHODIMP
- GTKEmbedDirectoryProvider::GetFile(const char *aKey, PRBool *aPersist,
-diff --git a/embedding/browser/webBrowser/nsWebBrowser.cpp b/embedding/browser/webBrowser/nsWebBrowser.cpp
---- a/embedding/browser/webBrowser/nsWebBrowser.cpp
-+++ b/embedding/browser/webBrowser/nsWebBrowser.cpp
-@@ -124,7 +124,7 @@ nsWebBrowser::~nsWebBrowser()
- 
- PRBool PR_CALLBACK deleteListener(void *aElement, void *aData) {
-     nsWebBrowserListenerState *state = (nsWebBrowserListenerState*)aElement;
--    NS_DELETEXPCOM(state);
-+    delete state;
-     return PR_TRUE;
- }
- 
-@@ -306,7 +306,7 @@ NS_IMETHODIMP nsWebBrowser::RemoveWebBro
-         // if we've emptied the array, get rid of it.
-         if (0 >= mListenerArray->Count()) {
-             (void)mListenerArray->EnumerateForwards(deleteListener, nsnull);
--            NS_DELETEXPCOM(mListenerArray);
-+            delete mListenerArray;
-             mListenerArray = nsnull;
-         }
- 
-@@ -1155,7 +1155,7 @@ NS_IMETHODIMP nsWebBrowser::Create()
-           i++;
-       }
-       (void)mListenerArray->EnumerateForwards(deleteListener, nsnull);
--      NS_DELETEXPCOM(mListenerArray);
-+      delete mListenerArray;
-       mListenerArray = nsnull;
-    }
- 
-diff --git a/embedding/components/windowwatcher/src/nsWindowWatcher.cpp b/embedding/components/windowwatcher/src/nsWindowWatcher.cpp
---- a/embedding/components/windowwatcher/src/nsWindowWatcher.cpp
-+++ b/embedding/components/windowwatcher/src/nsWindowWatcher.cpp
-@@ -197,13 +197,11 @@ nsWatcherWindowEnumerator::nsWatcherWind
-     mCurrentPosition(inWatcher->mOldestWindow)
- {
-   mWindowWatcher->AddEnumerator(this);
--  mWindowWatcher->AddRef();
- }
- 
- nsWatcherWindowEnumerator::~nsWatcherWindowEnumerator()
- {
-   mWindowWatcher->RemoveEnumerator(this);
--  mWindowWatcher->Release();
- }
- 
- NS_IMETHODIMP
-diff --git a/gfx/src/thebes/nsThebesRegion.cpp b/gfx/src/thebes/nsThebesRegion.cpp
---- a/gfx/src/thebes/nsThebesRegion.cpp
-+++ b/gfx/src/thebes/nsThebesRegion.cpp
-@@ -43,7 +43,6 @@ NS_IMPL_ISUPPORTS1(nsThebesRegion, nsIRe
- 
- nsThebesRegion::nsThebesRegion() 
- {  
--  NS_INIT_ISUPPORTS();
- }
- 
- nsresult nsThebesRegion::Init (void)
-diff --git a/gfx/thebes/public/gfxFont.h b/gfx/thebes/public/gfxFont.h
---- a/gfx/thebes/public/gfxFont.h
-+++ b/gfx/thebes/public/gfxFont.h
-@@ -368,7 +368,7 @@ public:
-     PRInt32 GetRefCount() { return mRefCnt; }
- 
- protected:
--    nsAutoRefCnt mRefCnt;
-+    gfxAutoRefCnt mRefCnt;
- 
- public:
-     gfxFont(const nsAString &aName, const gfxFontStyle *aFontGroup);
-diff --git a/gfx/thebes/public/gfxTypes.h b/gfx/thebes/public/gfxTypes.h
---- a/gfx/thebes/public/gfxTypes.h
-+++ b/gfx/thebes/public/gfxTypes.h
-@@ -55,11 +55,23 @@ typedef double gfxFloat;
- #endif
- 
- /**
-- * Define refcounting for Thebes.  For now use the stuff from nsISupportsImpl
-- * even though it forces the functions to be virtual...
-+ * Define refcounting for Thebes.
-  */
--#include "nsISupportsImpl.h"
- #include "nsAutoPtr.h"
-+
-+struct gfxAutoRefCnt
-+{
-+    gfxAutoRefCnt() : mValue(0) {}
-+
-+    nsrefcnt operator++() { return ++mValue; }
-+    nsrefcnt operator--() { return --mValue; }
-+    void operator=(int v) { mValue = v; }
-+
-+    operator int() const { return mValue; }
-+    int get() const { return mValue; }
-+private:
-+    int mValue;
-+};
- 
- #define THEBES_INLINE_DECL_REFCOUNTING(_class)                                \
- public:                                                                       \
-@@ -75,13 +87,13 @@ public:                                 
-         NS_LOG_RELEASE(this, mRefCnt, #_class);                               \
-         if (mRefCnt == 0) {                                                   \
-             mRefCnt = 1; /* stabilize */                                      \
--            NS_DELETEXPCOM(this);                                             \
-+            delete this;                                                      \
-             return 0;                                                         \
-         }                                                                     \
-         return mRefCnt;                                                       \
-     }                                                                         \
- protected:                                                                    \
--    nsAutoRefCnt mRefCnt;                                                     \
-+    gfxAutoRefCnt mRefCnt;                                                    \
- public:
- 
- #endif /* GFX_TYPES_H */
-diff --git a/layout/build/nsLayoutStatics.cpp b/layout/build/nsLayoutStatics.cpp
---- a/layout/build/nsLayoutStatics.cpp
-+++ b/layout/build/nsLayoutStatics.cpp
-@@ -240,7 +240,6 @@ nsLayoutStatics::Shutdown()
-   nsDOMStorageManager::Shutdown();
-   txMozillaXSLTProcessor::Shutdown();
-   nsDOMAttribute::Shutdown();
--  nsDOMEventRTTearoff::Shutdown();
-   nsEventListenerManager::Shutdown();
-   nsContentList::Shutdown();
-   nsComputedDOMStyle::Shutdown();
-diff --git a/layout/generic/nsGfxScrollFrame.cpp b/layout/generic/nsGfxScrollFrame.cpp
---- a/layout/generic/nsGfxScrollFrame.cpp
-+++ b/layout/generic/nsGfxScrollFrame.cpp
-@@ -796,18 +796,6 @@ nsHTMLScrollFrame::Reflow(nsPresContext*
-   return rv;
- }
- 
--NS_IMETHODIMP_(nsrefcnt) 
--nsHTMLScrollFrame::AddRef(void)
--{
--  return NS_OK;
--}
--
--NS_IMETHODIMP_(nsrefcnt)
--nsHTMLScrollFrame::Release(void)
--{
--    return NS_OK;
--}
--
- #ifdef NS_DEBUG
- NS_IMETHODIMP
- nsHTMLScrollFrame::GetFrameName(nsAString& aResult) const
-@@ -1141,18 +1129,6 @@ nsXULScrollFrame::GetMinWidth(nsIRenderi
-   return 0;
- }
- #endif
--
--NS_IMETHODIMP_(nsrefcnt) 
--nsXULScrollFrame::AddRef(void)
--{
--  return NS_OK;
--}
--
--NS_IMETHODIMP_(nsrefcnt)
--nsXULScrollFrame::Release(void)
--{
--    return NS_OK;
--}
- 
- #ifdef NS_DEBUG
- NS_IMETHODIMP
-@@ -1227,16 +1203,6 @@ nsGfxScrollFrameInner::~nsGfxScrollFrame
- {
- }
- 
--NS_IMETHODIMP_(nsrefcnt) nsGfxScrollFrameInner::AddRef(void)
--{
--  return 2;
--}
--
--NS_IMETHODIMP_(nsrefcnt) nsGfxScrollFrameInner::Release(void)
--{
--  return 1;
--}
--
- NS_IMPL_QUERY_INTERFACE1(nsGfxScrollFrameInner, nsIScrollPositionListener)
- 
- nsresult
-diff --git a/layout/generic/nsGfxScrollFrame.h b/layout/generic/nsGfxScrollFrame.h
---- a/layout/generic/nsGfxScrollFrame.h
-+++ b/layout/generic/nsGfxScrollFrame.h
-@@ -65,8 +65,6 @@ class nsGfxScrollFrameInner : public nsI
-                               public nsIReflowCallback {
- public:
-   NS_IMETHOD QueryInterface(REFNSIID aIID, void** aInstancePtr);
--  NS_IMETHOD_(nsrefcnt) AddRef(void);
--  NS_IMETHOD_(nsrefcnt) Release(void);
- 
-   nsGfxScrollFrameInner(nsContainerFrame* aOuter, PRBool aIsRoot,
-                         PRBool aIsXUL);
-diff --git a/layout/style/nsCSSDeclaration.h b/layout/style/nsCSSDeclaration.h
---- a/layout/style/nsCSSDeclaration.h
-+++ b/layout/style/nsCSSDeclaration.h
-@@ -55,7 +55,7 @@
- #include "nsCSSDataBlock.h"
- #include "nsCSSStruct.h"
- 
--class nsCSSDeclaration {
-+class nsCSSDeclaration : public XPCOMGCFinalizedObject {
- public:
-   /**
-    * Construct an |nsCSSDeclaration| that is in an invalid state (null
-@@ -219,11 +219,6 @@ private:
-                                           nsAString& aResult) const;
- 
- private:
--    //
--    // Specialized ref counting.
--    // We do not want everyone to ref count us, only the rules which hold
--    //  onto us (our well defined lifetime is when the last rule releases
--    //  us).
-     // It's worth a comment here that the main nsCSSDeclaration is refcounted,
-     //  but it's |mImportant| is not refcounted, but just owned by the
-     //  non-important declaration.
-@@ -240,7 +235,6 @@ private:
-     }
- public:
-     void RuleAbort(void) {
--      NS_ASSERTION(0 == mRefCnt, "bad RuleAbort");
-       delete this;
-     }
- private:
-@@ -253,7 +247,7 @@ private:
- 
- private:
-     nsValueArray mOrder;
--    nsAutoRefCnt mRefCnt;
-+    int mRefCnt;
-     nsCSSCompressedDataBlock *mData; // never null, except while expanded
-     nsCSSCompressedDataBlock *mImportantData; // may be null
- };
-diff --git a/layout/style/nsCSSRule.cpp b/layout/style/nsCSSRule.cpp
---- a/layout/style/nsCSSRule.cpp
-+++ b/layout/style/nsCSSRule.cpp
-@@ -42,15 +42,13 @@
- #include "nsICSSStyleSheet.h"
- 
- nsCSSRule::nsCSSRule(void)
--  : mRefCnt(0),
--    mSheet(nsnull),
-+  : mSheet(nsnull),
-     mParentRule(nsnull)
- {
- }
- 
- nsCSSRule::nsCSSRule(const nsCSSRule& aCopy)
--  : mRefCnt(0),
--    mSheet(aCopy.mSheet),
-+  : mSheet(aCopy.mSheet),
-     mParentRule(aCopy.mParentRule)
- {
- }
-diff --git a/layout/style/nsCSSRule.h b/layout/style/nsCSSRule.h
---- a/layout/style/nsCSSRule.h
-+++ b/layout/style/nsCSSRule.h
-@@ -48,17 +48,13 @@ struct nsRuleData;
- struct nsRuleData;
- class nsICSSGroupRule;
- 
--class nsCSSRule {
-+class nsCSSRule : public XPCOMGCFinalizedObject {
- public:
-   nsCSSRule(void);
-   nsCSSRule(const nsCSSRule& aCopy);
-   virtual ~nsCSSRule(void);
- 
--  // for implementing nsISupports
--  NS_IMETHOD_(nsrefcnt) AddRef();
--  NS_IMETHOD_(nsrefcnt) Release();
- protected:
--  nsAutoRefCnt mRefCnt;
-   NS_DECL_OWNINGTHREAD
- public:
- 
-diff --git a/layout/style/nsCSSStyleRule.cpp b/layout/style/nsCSSStyleRule.cpp
---- a/layout/style/nsCSSStyleRule.cpp
-+++ b/layout/style/nsCSSStyleRule.cpp
-@@ -817,11 +817,6 @@ public:
-                                             nsICSSParser** aCSSParser);
-   virtual nsresult DeclarationChanged();
- 
--  // Override |AddRef| and |Release| for being a member of
--  // |DOMCSSStyleRuleImpl|.
--  NS_IMETHOD_(nsrefcnt) AddRef(void);
--  NS_IMETHOD_(nsrefcnt) Release(void);
--
-   friend class DOMCSSStyleRuleImpl;
- 
- protected:
-diff --git a/layout/style/nsCSSStyleSheet.cpp b/layout/style/nsCSSStyleSheet.cpp
---- a/layout/style/nsCSSStyleSheet.cpp
-+++ b/layout/style/nsCSSStyleSheet.cpp
-@@ -622,7 +622,6 @@ nsCSSStyleSheetInner::RebuildNameSpaces(
- 
- nsCSSStyleSheet::nsCSSStyleSheet()
-   : nsICSSStyleSheet(),
--    mRefCnt(0),
-     mTitle(), 
-     mMedia(nsnull),
-     mFirstChild(nsnull), 
-@@ -647,7 +646,6 @@ nsCSSStyleSheet::nsCSSStyleSheet(const n
-                                  nsIDocument* aDocumentToUse,
-                                  nsIDOMNode* aOwningNodeToUse)
-   : nsICSSStyleSheet(),
--    mRefCnt(0),
-     mTitle(aCopy.mTitle), 
-     mMedia(nsnull),
-     mFirstChild(nsnull), 
-diff --git a/layout/style/nsComputedDOMStyle.cpp b/layout/style/nsComputedDOMStyle.cpp
---- a/layout/style/nsComputedDOMStyle.cpp
-+++ b/layout/style/nsComputedDOMStyle.cpp
-@@ -80,29 +80,15 @@
-  * returned by the getComputedStyle() function.
-  */
- 
--static nsComputedDOMStyle *sCachedComputedDOMStyle;
--
- nsresult
- NS_NewComputedDOMStyle(nsIComputedDOMStyle** aComputedStyle)
- {
-   NS_ENSURE_ARG_POINTER(aComputedStyle);
- 
--  if (sCachedComputedDOMStyle) {
--    // There's an unused nsComputedDOMStyle cached, use it.
--    // But before we use it, re-initialize the object.
--
--    // Oh yeah baby, placement new!
--    *aComputedStyle = new (sCachedComputedDOMStyle) nsComputedDOMStyle();
--
--    sCachedComputedDOMStyle = nsnull;
--  } else {
--    // No nsComputedDOMStyle cached, create a new one.
--
--    *aComputedStyle = new nsComputedDOMStyle();
--    NS_ENSURE_TRUE(*aComputedStyle, NS_ERROR_OUT_OF_MEMORY);
--  }
--
--  NS_ADDREF(*aComputedStyle);
-+  // No nsComputedDOMStyle cached, create a new one.
-+
-+  *aComputedStyle = new nsComputedDOMStyle();
-+  NS_ENSURE_TRUE(*aComputedStyle, NS_ERROR_OUT_OF_MEMORY);
- 
-   return NS_OK;
- }
-@@ -129,12 +115,6 @@ void
- void
- nsComputedDOMStyle::Shutdown()
- {
--  // We want to de-allocate without calling the dtor since we
--  // already did that manually in doDestroyComputedDOMStyle(),
--  // so cast our cached object to something that doesn't know
--  // about our dtor.
--  delete reinterpret_cast<char*>(sCachedComputedDOMStyle);
--  sCachedComputedDOMStyle = nsnull;
- }
- 
- 
-@@ -148,26 +128,6 @@ NS_INTERFACE_MAP_BEGIN(nsComputedDOMStyl
-   NS_INTERFACE_MAP_ENTRY_AMBIGUOUS(nsISupports, nsIComputedDOMStyle)
-   NS_INTERFACE_MAP_ENTRY_CONTENT_CLASSINFO(ComputedCSSStyleDeclaration)
- NS_INTERFACE_MAP_END
--
--
--static void doDestroyComputedDOMStyle(nsComputedDOMStyle *aComputedStyle)
--{
--  if (!sCachedComputedDOMStyle) {
--    // The cache is empty, store aComputedStyle in the cache.
--
--    sCachedComputedDOMStyle = aComputedStyle;
--    sCachedComputedDOMStyle->~nsComputedDOMStyle();
--  } else {
--    // The cache is full, delete aComputedStyle
--
--    delete aComputedStyle;
--  }
--}
--
--NS_IMPL_ADDREF(nsComputedDOMStyle)
--NS_IMPL_RELEASE_WITH_DESTROY(nsComputedDOMStyle,
--                             doDestroyComputedDOMStyle(this))
--
- 
- NS_IMETHODIMP
- nsComputedDOMStyle::Init(nsIDOMElement *aElement,
-diff --git a/layout/style/nsComputedDOMStyle.h b/layout/style/nsComputedDOMStyle.h
---- a/layout/style/nsComputedDOMStyle.h
-+++ b/layout/style/nsComputedDOMStyle.h
-@@ -56,7 +56,7 @@
- #include "nsWeakReference.h"
- #include "nsAutoPtr.h"
- 
--class nsComputedDOMStyle : public nsIComputedDOMStyle
-+class nsComputedDOMStyle : public XPCOMGCFinalizedObject, public nsIComputedDOMStyle
- {
- public:
-   NS_DECL_ISUPPORTS
-diff --git a/layout/style/nsDOMCSSAttrDeclaration.h b/layout/style/nsDOMCSSAttrDeclaration.h
---- a/layout/style/nsDOMCSSAttrDeclaration.h
-+++ b/layout/style/nsDOMCSSAttrDeclaration.h
-@@ -55,10 +55,6 @@ public:
-   nsDOMCSSAttributeDeclaration(nsIContent *aContent);
-   ~nsDOMCSSAttributeDeclaration();
- 
--  // impl AddRef/Release; QI is implemented by our parent class
--  NS_IMETHOD_(nsrefcnt) AddRef(void);
--  NS_IMETHOD_(nsrefcnt) Release(void);
--
-   virtual void DropReference();
-   // If GetCSSDeclaration returns non-null, then the decl it returns
-   // is owned by our current style rule.
-@@ -74,9 +70,6 @@ protected:
- protected:
-   virtual nsresult DeclarationChanged();
-   
--  nsAutoRefCnt mRefCnt;
--  NS_DECL_OWNINGTHREAD
--
-   nsIContent *mContent;
- };
- 
-diff --git a/layout/style/nsDOMCSSDeclaration.cpp b/layout/style/nsDOMCSSDeclaration.cpp
---- a/layout/style/nsDOMCSSDeclaration.cpp
-+++ b/layout/style/nsDOMCSSDeclaration.cpp
-@@ -356,18 +356,6 @@ CSS2PropertiesTearoff::CSS2PropertiesTea
- 
- CSS2PropertiesTearoff::~CSS2PropertiesTearoff()
- {
--}
--
--NS_IMETHODIMP_(nsrefcnt)
--CSS2PropertiesTearoff::AddRef(void)
--{
--  return mOuter->AddRef();
--}
--
--NS_IMETHODIMP_(nsrefcnt)
--CSS2PropertiesTearoff::Release(void)
--{
--  return mOuter->Release();
- }
- 
- NS_IMETHODIMP
-diff --git a/layout/style/nsDOMCSSDeclaration.h b/layout/style/nsDOMCSSDeclaration.h
---- a/layout/style/nsDOMCSSDeclaration.h
-+++ b/layout/style/nsDOMCSSDeclaration.h
-@@ -64,7 +64,7 @@ private:
-   nsICSSDeclaration* mOuter;
- };
- 
--class nsDOMCSSDeclaration : public nsICSSDeclaration
-+class nsDOMCSSDeclaration : public XPCOMGCFinalizedObject, public nsICSSDeclaration
- {
- public:
-   nsDOMCSSDeclaration();
-diff --git a/layout/style/nsHTMLCSSStyleSheet.cpp b/layout/style/nsHTMLCSSStyleSheet.cpp
---- a/layout/style/nsHTMLCSSStyleSheet.cpp
-+++ b/layout/style/nsHTMLCSSStyleSheet.cpp
-@@ -391,7 +391,6 @@ protected:
- 
- HTMLCSSStyleSheetImpl::HTMLCSSStyleSheetImpl()
-   : nsIHTMLCSSStyleSheet(),
--    mRefCnt(0),
-     mURL(nsnull),
-     mDocument(nsnull),
-     mFirstLineRule(nsnull),
-diff --git a/layout/tables/nsTableRowGroupFrame.cpp b/layout/tables/nsTableRowGroupFrame.cpp
---- a/layout/tables/nsTableRowGroupFrame.cpp
-+++ b/layout/tables/nsTableRowGroupFrame.cpp
-@@ -65,15 +65,6 @@ nsTableRowGroupFrame::~nsTableRowGroupFr
- }
- 
- /* ----------- nsTableRowGroupFrame ---------- */
--nsrefcnt nsTableRowGroupFrame::AddRef(void)
--{
--  return 1;//implementation of nsLineIterator
--}
--
--nsrefcnt nsTableRowGroupFrame::Release(void)
--{
--  return 1;//implementation of nsLineIterator
--}
- 
- NS_IMETHODIMP
- nsTableRowGroupFrame::QueryInterface(const nsIID& aIID, void** aInstancePtr)
-diff --git a/layout/xul/base/src/nsDocElementBoxFrame.cpp b/layout/xul/base/src/nsDocElementBoxFrame.cpp
---- a/layout/xul/base/src/nsDocElementBoxFrame.cpp
-+++ b/layout/xul/base/src/nsDocElementBoxFrame.cpp
-@@ -149,18 +149,6 @@ nsDocElementBoxFrame::CreateAnonymousCon
-   return NS_OK;
- }
- 
--NS_IMETHODIMP_(nsrefcnt) 
--nsDocElementBoxFrame::AddRef(void)
--{
--  return NS_OK;
--}
--
--NS_IMETHODIMP_(nsrefcnt)
--nsDocElementBoxFrame::Release(void)
--{
--  return NS_OK;
--}
--
- NS_INTERFACE_MAP_BEGIN(nsDocElementBoxFrame)
-   NS_INTERFACE_MAP_ENTRY(nsIAnonymousContentCreator)
- NS_INTERFACE_MAP_END_INHERITING(nsBoxFrame)
-diff --git a/layout/xul/base/src/nsListBoxBodyFrame.cpp b/layout/xul/base/src/nsListBoxBodyFrame.cpp
---- a/layout/xul/base/src/nsListBoxBodyFrame.cpp
-+++ b/layout/xul/base/src/nsListBoxBodyFrame.cpp
-@@ -206,20 +206,6 @@ nsListBoxBodyFrame::~nsListBoxBodyFrame(
- 
- }
- 
--////////// nsISupports /////////////////
--
--NS_IMETHODIMP_(nsrefcnt) 
--nsListBoxBodyFrame::AddRef(void)
--{
--  return 2;
--}
--
--NS_IMETHODIMP_(nsrefcnt)
--nsListBoxBodyFrame::Release(void)
--{
--  return 1;
--}
--
- //
- // QueryInterface
- //
-diff --git a/layout/xul/base/src/nsListItemFrame.cpp b/layout/xul/base/src/nsListItemFrame.cpp
---- a/layout/xul/base/src/nsListItemFrame.cpp
-+++ b/layout/xul/base/src/nsListItemFrame.cpp
-@@ -43,18 +43,6 @@
- #include "nsINameSpaceManager.h" 
- #include "nsGkAtoms.h"
- #include "nsDisplayList.h"
--
--NS_IMETHODIMP_(nsrefcnt) 
--nsListItemFrame::AddRef(void)
--{
--  return NS_OK;
--}
--
--NS_IMETHODIMP_(nsrefcnt)
--nsListItemFrame::Release(void)
--{
--  return NS_OK;
--}
- 
- NS_INTERFACE_MAP_BEGIN(nsListItemFrame)
- NS_INTERFACE_MAP_END_INHERITING(nsGridRowLeafFrame)
-diff --git a/layout/xul/base/src/nsMenuFrame.cpp b/layout/xul/base/src/nsMenuFrame.cpp
---- a/layout/xul/base/src/nsMenuFrame.cpp
-+++ b/layout/xul/base/src/nsMenuFrame.cpp
-@@ -167,18 +167,6 @@ NS_NewMenuFrame(nsIPresShell* aPresShell
-   return it;
- }
- 
--NS_IMETHODIMP_(nsrefcnt) 
--nsMenuFrame::AddRef(void)
--{
--  return NS_OK;
--}
--
--NS_IMETHODIMP_(nsrefcnt)
--nsMenuFrame::Release(void)
--{
--    return NS_OK;
--}
--
- //
- // QueryInterface
- //
-diff --git a/layout/xul/base/src/nsRootBoxFrame.cpp b/layout/xul/base/src/nsRootBoxFrame.cpp
---- a/layout/xul/base/src/nsRootBoxFrame.cpp
-+++ b/layout/xul/base/src/nsRootBoxFrame.cpp
-@@ -333,18 +333,6 @@ nsRootBoxFrame::RemoveTooltipSupport(nsI
-   return NS_ERROR_NOT_IMPLEMENTED;
- }
- 
--NS_IMETHODIMP_(nsrefcnt) 
--nsRootBoxFrame::AddRef(void)
--{
--  return NS_OK;
--}
--
--NS_IMETHODIMP_(nsrefcnt)
--nsRootBoxFrame::Release(void)
--{
--  return NS_OK;
--}
--
- NS_INTERFACE_MAP_BEGIN(nsRootBoxFrame)
-   NS_INTERFACE_MAP_ENTRY(nsIRootBox)
- NS_INTERFACE_MAP_END_INHERITING(nsBoxFrame)
-diff --git a/layout/xul/base/src/nsSplitterFrame.cpp b/layout/xul/base/src/nsSplitterFrame.cpp
---- a/layout/xul/base/src/nsSplitterFrame.cpp
-+++ b/layout/xul/base/src/nsSplitterFrame.cpp
-@@ -262,7 +262,6 @@ nsSplitterFrame::Destroy()
-   if (mInner) {
-     mInner->RemoveListener();
-     mInner->Disconnect();
--    mInner->Release();
-     mInner = nsnull;
-   }
-   nsBoxFrame::Destroy();
-@@ -327,7 +326,6 @@ nsSplitterFrame::Init(nsIContent*      a
-   if (!mInner)
-     return NS_ERROR_OUT_OF_MEMORY;
- 
--  mInner->AddRef();
-   mInner->mChildInfosAfter = nsnull;
-   mInner->mChildInfosBefore = nsnull;
-   mInner->mState = nsSplitterFrameInner::Open;
-diff --git a/layout/xul/base/src/tree/src/nsTreeBodyFrame.cpp b/layout/xul/base/src/tree/src/nsTreeBodyFrame.cpp
---- a/layout/xul/base/src/tree/src/nsTreeBodyFrame.cpp
-+++ b/layout/xul/base/src/tree/src/nsTreeBodyFrame.cpp
-@@ -174,18 +174,6 @@ nsTreeBodyFrame::~nsTreeBodyFrame()
-   delete mSlots;
- }
- 
--NS_IMETHODIMP_(nsrefcnt) 
--nsTreeBodyFrame::AddRef(void)
--{
--  return NS_OK;
--}
--
--NS_IMETHODIMP_(nsrefcnt)
--nsTreeBodyFrame::Release(void)
--{
--  return NS_OK;
--}
--
- static void
- GetBorderPadding(nsStyleContext* aContext, nsMargin& aMargin)
- {
-diff --git a/layout/xul/base/src/tree/src/nsTreeColFrame.cpp b/layout/xul/base/src/tree/src/nsTreeColFrame.cpp
---- a/layout/xul/base/src/tree/src/nsTreeColFrame.cpp
-+++ b/layout/xul/base/src/tree/src/nsTreeColFrame.cpp
-@@ -63,18 +63,6 @@ NS_NewTreeColFrame(nsIPresShell* aPresSh
-   return new (aPresShell) nsTreeColFrame(aPresShell, aContext, aIsRoot, aLayoutManager);
- } // NS_NewTreeColFrame
- 
--NS_IMETHODIMP_(nsrefcnt) 
--nsTreeColFrame::AddRef(void)
--{
--  return NS_OK;
--}
--
--NS_IMETHODIMP_(nsrefcnt)
--nsTreeColFrame::Release(void)
--{
--  return NS_OK;
--}
--
- //
- // QueryInterface
- //
-diff --git a/modules/libjar/nsJAR.cpp b/modules/libjar/nsJAR.cpp
---- a/modules/libjar/nsJAR.cpp
-+++ b/modules/libjar/nsJAR.cpp
-@@ -133,32 +133,12 @@ nsJAR::nsJAR(): mManifestData(nsnull, ns
- 
- nsJAR::~nsJAR()
- {
-+  mCache->ReleaseZip(this);
-   Close();
- }
- 
- NS_IMPL_THREADSAFE_QUERY_INTERFACE2(nsJAR, nsIZipReader, nsIJAR)
- NS_IMPL_THREADSAFE_ADDREF(nsJAR)
--
--// Custom Release method works with nsZipReaderCache...
--nsrefcnt nsJAR::Release(void) 
--{
--  nsrefcnt count; 
--  NS_PRECONDITION(0 != mRefCnt, "dup release"); 
--  count = PR_AtomicDecrement((PRInt32 *)&mRefCnt); 
--  NS_LOG_RELEASE(this, count, "nsJAR"); 
--  if (0 == count) {
--    mRefCnt = 1; /* stabilize */ 
--    /* enable this to find non-threadsafe destructors: */ 
--    /* NS_ASSERT_OWNINGTHREAD(nsJAR); */ 
--    NS_DELETEXPCOM(this); 
--    return 0; 
--  }
--  else if (1 == count && mCache) {
--    nsresult rv = mCache->ReleaseZip(this);
--    NS_ASSERTION(NS_SUCCEEDED(rv), "failed to release zip file");
--  }
--  return count; 
--} 
- 
- //----------------------------------------------
- // nsIZipReader implementation
-diff --git a/modules/plugin/base/src/nsPluginHostImpl.cpp b/modules/plugin/base/src/nsPluginHostImpl.cpp
---- a/modules/plugin/base/src/nsPluginHostImpl.cpp
-+++ b/modules/plugin/base/src/nsPluginHostImpl.cpp
-@@ -1300,7 +1300,7 @@ private:
- 
-   // local cached file, we save the content into local cache if browser cache is not available,
-   // or plugin asks stream as file and it expects file extension until bug 90558 got fixed
--  nsIFile                 *mLocalCachedFile;
-+  nsCOMPtr<nsIFile>         mLocalCachedFile;
-   nsCOMPtr<nsIOutputStream> mFileCacheOutputStream;
-   nsHashtable             *mDataForwardToRequest;
- 
-@@ -1681,7 +1681,6 @@ nsPluginStreamListenerPeer::nsPluginStre
-   mPendingRequests = 0;
-   mHaveFiredOnStartRequest = PR_FALSE;
-   mDataForwardToRequest = nsnull;
--  mLocalCachedFile = nsnull;
- }
- 
- 
-@@ -1707,25 +1706,9 @@ nsPluginStreamListenerPeer::~nsPluginStr
-   if (mFileCacheOutputStream)
-     mFileCacheOutputStream = nsnull;
- 
--  // if we have mLocalCachedFile lets release it
--  // and it'll be fiscally remove if refcnt == 1
--  if (mLocalCachedFile) {
--    nsrefcnt refcnt;
--    NS_RELEASE2(mLocalCachedFile, refcnt);
--
--#ifdef PLUGIN_LOGGING
--    nsCAutoString filePath;
--    mLocalCachedFile->GetNativePath(filePath);
--
--    PR_LOG(nsPluginLogging::gPluginLog, PLUGIN_LOG_NORMAL,
--      ("LocalyCachedFile=%s has %d refcnt and will %s be deleted now\n",filePath.get(),refcnt,refcnt==1?"":"NOT"));
--#endif
--
--    if (refcnt == 1) {
--      mLocalCachedFile->Remove(PR_FALSE);
--      NS_RELEASE(mLocalCachedFile);
--    }
--  }
-+  // XXXbsmedberg: previously we would do dark magic to see if anyone else
-+  // was holding a reference to mLocalCachedFile and if not, we'd remove it.
-+  // Now we just punt
- 
-   delete mDataForwardToRequest;
- }
-@@ -1895,7 +1878,7 @@ nsPluginStreamListenerPeer::SetupPluginC
-             (useExistingCacheFile =
-              lp->mPluginStreamInfo->UseExistingPluginCacheFile(mPluginStreamInfo)))
-         {
--            NS_ADDREF(mLocalCachedFile = lp->mLocalCachedFile);
-+            mLocalCachedFile = lp->mLocalCachedFile;
-         }
-         NS_RELEASE(lp);
-       }
-@@ -1941,10 +1924,7 @@ nsPluginStreamListenerPeer::SetupPluginC
-       return rv;
- 
-     // save the file.
--    CallQueryInterface(pluginTmp, &mLocalCachedFile); // no need to check return value, just addref
--    // add one extra refcnt, we can use NS_RELEASE2(mLocalCachedFile...) in dtor
--    // to remove this file when refcnt == 1
--    NS_ADDREF(mLocalCachedFile);
-+    mLocalCachedFile = do_QueryInterface(pluginTmp);
-   }
- 
-   // add this listenerPeer to list of stream peers for this instance
-@@ -2372,7 +2352,7 @@ NS_IMETHODIMP nsPluginStreamListenerPeer
- 
-   // call OnFileAvailable if plugin requests stream type StreamType_AsFile or StreamType_AsFileOnly
-   if (mStreamType >= nsPluginStreamType_AsFile) {
--    nsCOMPtr<nsIFile> localFile = do_QueryInterface(mLocalCachedFile);
-+    nsCOMPtr<nsIFile> localFile = mLocalCachedFile;
-     if (!localFile) {
-       nsCOMPtr<nsICachingChannel> cacheChannel = do_QueryInterface(request);
-       if (cacheChannel) {
-@@ -6443,7 +6423,6 @@ NS_IMETHODIMP nsPluginHostImpl::Observe(
-     OnShutdown();
-     Destroy();
-     UnloadUnusedLibraries();
--    sInst->Release();
-   }
-   if (!nsCRT::strcmp(NS_PREFBRANCH_PREFCHANGE_TOPIC_ID, aTopic)) {
-     NS_ASSERTION(someData &&
-diff --git a/modules/plugin/tools/sdk/samples/simple/Makefile.in b/modules/plugin/tools/sdk/samples/simple/Makefile.in
---- a/modules/plugin/tools/sdk/samples/simple/Makefile.in
-+++ b/modules/plugin/tools/sdk/samples/simple/Makefile.in
-@@ -52,11 +52,9 @@ NO_DIST_INSTALL = 1
- NO_DIST_INSTALL = 1
- NO_INSTALL = 1
- 
--CPPSRCS = nsScriptablePeer.cpp \
-+CPPSRCS = \
-           plugin.cpp \
-           $(NULL)
--
--XPIDLSRCS = nsISimplePlugin.idl
- 
- SHARED_LIBRARY_LIBS = ../common/$(LIB_PREFIX)plugingate_s.$(LIB_SUFFIX)
- 
-diff --git a/modules/plugin/tools/sdk/samples/simple/nsISimplePlugin.idl b/modules/plugin/tools/sdk/samples/simple/nsISimplePlugin.idl
-deleted file mode 100644
---- a/modules/plugin/tools/sdk/samples/simple/nsISimplePlugin.idl
-+++ /dev/null
-@@ -1,44 +0,0 @@
--/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*-
-- *
-- * ***** BEGIN LICENSE BLOCK *****
-- * Version: MPL 1.1/GPL 2.0/LGPL 2.1
-- *
-- * The contents of this file are subject to the Mozilla Public License Version
-- * 1.1 (the "License"); you may not use this file except in compliance with
-- * the License. You may obtain a copy of the License at
-- * http://www.mozilla.org/MPL/
-- *
-- * Software distributed under the License is distributed on an "AS IS" basis,
-- * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
-- * for the specific language governing rights and limitations under the
-- * License.
-- *
-- * The Original Code is mozilla.org code.
-- *
-- * The Initial Developer of the Original Code is
-- * Netscape Communications Corporation.
-- * Portions created by the Initial Developer are Copyright (C) 2001
-- * the Initial Developer. All Rights Reserved.
-- *
-- * Contributor(s):
-- *
-- * Alternatively, the contents of this file may be used under the terms of
-- * either the GNU General Public License Version 2 or later (the "GPL"), or
-- * the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
-- * in which case the provisions of the GPL or the LGPL are applicable instead
-- * of those above. If you wish to allow use of your version of this file only
-- * under the terms of either the GPL or the LGPL, and not to allow others to
-- * use your version of this file under the terms of the MPL, indicate your
-- * decision by deleting the provisions above and replace them with the notice
-- * and other provisions required by the GPL or the LGPL. If you do not delete
-- * the provisions above, a recipient may use your version of this file under
-- * the terms of any one of the MPL, the GPL or the LGPL.
-- *
-- * ***** END LICENSE BLOCK ***** */
--
--#include "nsISupports.idl"
--
--[scriptable, uuid(482e1890-1fe5-11d5-9cf8-0060b0fbd8ac)]
--interface nsISimplePlugin : nsISupports {
--  readonly attribute string version;
--};
-diff --git a/modules/plugin/tools/sdk/samples/simple/nsScriptablePeer.cpp b/modules/plugin/tools/sdk/samples/simple/nsScriptablePeer.cpp
-deleted file mode 100644
---- a/modules/plugin/tools/sdk/samples/simple/nsScriptablePeer.cpp
-+++ /dev/null
-@@ -1,123 +0,0 @@
--/* -*- Mode: C++; tab-width: 4; indent-tabs-mode: nil; c-basic-offset: 4 -*- */
--/* ***** BEGIN LICENSE BLOCK *****
-- * Version: MPL 1.1/GPL 2.0/LGPL 2.1
-- *
-- * The contents of this file are subject to the Mozilla Public License Version
-- * 1.1 (the "License"); you may not use this file except in compliance with
-- * the License. You may obtain a copy of the License at
-- * http://www.mozilla.org/MPL/
-- *
-- * Software distributed under the License is distributed on an "AS IS" basis,
-- * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
-- * for the specific language governing rights and limitations under the
-- * License.
-- *
-- * The Original Code is mozilla.org code.
-- *
-- * The Initial Developer of the Original Code is
-- * Netscape Communications Corporation.
-- * Portions created by the Initial Developer are Copyright (C) 1998
-- * the Initial Developer. All Rights Reserved.
-- *
-- * Contributor(s):
-- *
-- * Alternatively, the contents of this file may be used under the terms of
-- * either the GNU General Public License Version 2 or later (the "GPL"), or
-- * the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
-- * in which case the provisions of the GPL or the LGPL are applicable instead
-- * of those above. If you wish to allow use of your version of this file only
-- * under the terms of either the GPL or the LGPL, and not to allow others to
-- * use your version of this file under the terms of the MPL, indicate your
-- * decision by deleting the provisions above and replace them with the notice
-- * and other provisions required by the GPL or the LGPL. If you do not delete
-- * the provisions above, a recipient may use your version of this file under
-- * the terms of any one of the MPL, the GPL or the LGPL.
-- *
-- * ***** END LICENSE BLOCK ***** */
--
--// ==============================
--// ! Scriptability related code !
--// ==============================
--
--/////////////////////////////////////////////////////
--//
--// This file implements the nsScriptablePeer object
--// The native methods of this class are supposed to
--// be callable from JavaScript
--//
--#include "plugin.h"
--
--static NS_DEFINE_IID(kISimplePluginIID, NS_ISIMPLEPLUGIN_IID);
--static NS_DEFINE_IID(kIClassInfoIID, NS_ICLASSINFO_IID);
--static NS_DEFINE_IID(kISupportsIID, NS_ISUPPORTS_IID);
--
--nsScriptablePeer::nsScriptablePeer(nsPluginInstance* aPlugin)
--{
--  mPlugin = aPlugin;
--  mRefCnt = 0;
--}
--
--nsScriptablePeer::~nsScriptablePeer()
--{
--}
--
--// AddRef, Release and QueryInterface are common methods and must 
--// be implemented for any interface
--NS_IMETHODIMP_(nsrefcnt) nsScriptablePeer::AddRef() 
--{ 
--  ++mRefCnt; 
--  return mRefCnt; 
--} 
--
--NS_IMETHODIMP_(nsrefcnt) nsScriptablePeer::Release() 
--{ 
--  --mRefCnt; 
--  if (mRefCnt == 0) { 
--    delete this;
--    return 0; 
--  } 
--  return mRefCnt; 
--} 
--
--// here nsScriptablePeer should return three interfaces it can be asked for by their iid's
--// static casts are necessary to ensure that correct pointer is returned
--NS_IMETHODIMP nsScriptablePeer::QueryInterface(const nsIID& aIID, void** aInstancePtr) 
--{ 
--  if(!aInstancePtr) 
--    return NS_ERROR_NULL_POINTER; 
--
--  if(aIID.Equals(kISimplePluginIID)) {
--    *aInstancePtr = static_cast<nsISimplePlugin*>(this); 
--    AddRef();
--    return NS_OK;
--  }
--
--  if(aIID.Equals(kIClassInfoIID)) {
--    *aInstancePtr = static_cast<nsIClassInfo*>(this); 
--    AddRef();
--    return NS_OK;
--  }
--
--  if(aIID.Equals(kISupportsIID)) {
--    *aInstancePtr = static_cast<nsISupports*>((static_cast<nsISimplePlugin*>(this))); 
--    AddRef();
--    return NS_OK;
--  }
--
--  return NS_NOINTERFACE; 
--}
--
--void nsScriptablePeer::SetInstance(nsPluginInstance* plugin)
--{
--  mPlugin = plugin;
--}
--
--//
--// the following method will be callable from JavaScript
--//
--NS_IMETHODIMP nsScriptablePeer::GetVersion(char * *aVersion)
--{
--  if (mPlugin)
--    mPlugin->getVersion(aVersion);
--  return NS_OK;
--}
-diff --git a/modules/plugin/tools/sdk/samples/simple/nsScriptablePeer.h b/modules/plugin/tools/sdk/samples/simple/nsScriptablePeer.h
-deleted file mode 100644
---- a/modules/plugin/tools/sdk/samples/simple/nsScriptablePeer.h
-+++ /dev/null
-@@ -1,108 +0,0 @@
--/* -*- Mode: C++; tab-width: 4; indent-tabs-mode: nil; c-basic-offset: 4 -*- */
--/* ***** BEGIN LICENSE BLOCK *****
-- * Version: MPL 1.1/GPL 2.0/LGPL 2.1
-- *
-- * The contents of this file are subject to the Mozilla Public License Version
-- * 1.1 (the "License"); you may not use this file except in compliance with
-- * the License. You may obtain a copy of the License at
-- * http://www.mozilla.org/MPL/
-- *
-- * Software distributed under the License is distributed on an "AS IS" basis,
-- * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
-- * for the specific language governing rights and limitations under the
-- * License.
-- *
-- * The Original Code is mozilla.org code.
-- *
-- * The Initial Developer of the Original Code is
-- * Netscape Communications Corporation.
-- * Portions created by the Initial Developer are Copyright (C) 1998
-- * the Initial Developer. All Rights Reserved.
-- *
-- * Contributor(s):
-- *
-- * Alternatively, the contents of this file may be used under the terms of
-- * either the GNU General Public License Version 2 or later (the "GPL"), or
-- * the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
-- * in which case the provisions of the GPL or the LGPL are applicable instead
-- * of those above. If you wish to allow use of your version of this file only
-- * under the terms of either the GPL or the LGPL, and not to allow others to
-- * use your version of this file under the terms of the MPL, indicate your
-- * decision by deleting the provisions above and replace them with the notice
-- * and other provisions required by the GPL or the LGPL. If you do not delete
-- * the provisions above, a recipient may use your version of this file under
-- * the terms of any one of the MPL, the GPL or the LGPL.
-- *
-- * ***** END LICENSE BLOCK ***** */
--
--// ==============================
--// ! Scriptability related code !
--// ==============================
--//
--// nsScriptablePeer - xpconnect scriptable peer
--//
--
--#ifndef __nsScriptablePeer_h__
--#define __nsScriptablePeer_h__
--
--#include "nsISimplePlugin.h"
--#include "nsIClassInfo.h"
--#include "nsIProgrammingLanguage.h"
--
--class nsPluginInstance;
--
--// We must implement nsIClassInfo because it signals the
--// Mozilla Security Manager to allow calls from JavaScript.
--
--class nsClassInfoMixin : public nsIClassInfo
--{
--  // These flags are used by the DOM and security systems to signal that 
--  // JavaScript callers are allowed to call this object's scritable methods.
--  NS_IMETHOD GetFlags(PRUint32 *aFlags)
--    {*aFlags = nsIClassInfo::PLUGIN_OBJECT | nsIClassInfo::DOM_OBJECT;
--     return NS_OK;}
--  NS_IMETHOD GetImplementationLanguage(PRUint32 *aImplementationLanguage)
--    {*aImplementationLanguage = nsIProgrammingLanguage::CPLUSPLUS;
--     return NS_OK;}
--  // The rest of the methods can safely return error codes...
--  NS_IMETHOD GetInterfaces(PRUint32 *count, nsIID * **array)
--    {return NS_ERROR_NOT_IMPLEMENTED;}
--  NS_IMETHOD GetHelperForLanguage(PRUint32 language, nsISupports **_retval)
--    {return NS_ERROR_NOT_IMPLEMENTED;}
--  NS_IMETHOD GetContractID(char * *aContractID)
--    {return NS_ERROR_NOT_IMPLEMENTED;}
--  NS_IMETHOD GetClassDescription(char * *aClassDescription)
--    {return NS_ERROR_NOT_IMPLEMENTED;}
--  NS_IMETHOD GetClassID(nsCID * *aClassID)
--    {return NS_ERROR_NOT_IMPLEMENTED;}
--  NS_IMETHOD GetClassIDNoAlloc(nsCID *aClassIDNoAlloc)
--    {return NS_ERROR_NOT_IMPLEMENTED;}
--};
--
--class nsScriptablePeer : public nsISimplePlugin,
--                         public nsClassInfoMixin
--{
--public:
--  nsScriptablePeer(nsPluginInstance* plugin);
--  ~nsScriptablePeer();
--
--public:
--  // methods from nsISupports
--  NS_IMETHOD QueryInterface(const nsIID& aIID, void** aInstancePtr); 
--  NS_IMETHOD_(nsrefcnt) AddRef(); 
--  NS_IMETHOD_(nsrefcnt) Release(); 
--
--protected: 
--  nsrefcnt mRefCnt;  
--
--public:
--  // native methods callable from JavaScript
--  NS_DECL_NSISIMPLEPLUGIN
--
--  void SetInstance(nsPluginInstance* plugin);
--
--protected:
--  nsPluginInstance* mPlugin;
--};
--
--#endif
-diff --git a/modules/plugin/tools/sdk/samples/simple/plugin.cpp b/modules/plugin/tools/sdk/samples/simple/plugin.cpp
---- a/modules/plugin/tools/sdk/samples/simple/plugin.cpp
-+++ b/modules/plugin/tools/sdk/samples/simple/plugin.cpp
-@@ -36,13 +36,7 @@
-  * ***** END LICENSE BLOCK ***** */
- 
- #include "plugin.h"
--#include "nsIServiceManager.h"
--#include "nsIMemory.h"
--#include "nsISupportsUtils.h" // this is where some useful macros defined
--
--// service manager which will give the access to all public browser services
--// we will use memory service as an illustration
--nsIServiceManager * gServiceManager = NULL;
-+#include <string.h>
- 
- // Unix needs this
- #ifdef XP_UNIX
-@@ -81,28 +75,11 @@ NPError NS_PluginGetValue(NPPVariable aV
- //
- NPError NS_PluginInitialize()
- {
--  // this is probably a good place to get the service manager
--  // note that Mozilla will add reference, so do not forget to release
--  nsISupports * sm = NULL;
--  
--  NPN_GetValue(NULL, NPNVserviceManager, &sm);
--
--  // Mozilla returns nsIServiceManager so we can use it directly; doing QI on
--  // nsISupports here can still be more appropriate in case something is changed 
--  // in the future so we don't need to do casting of any sort.
--  if(sm) {
--    sm->QueryInterface(NS_GET_IID(nsIServiceManager), (void**)&gServiceManager);
--    NS_RELEASE(sm);
--  }
--  
-   return NPERR_NO_ERROR;
- }
- 
- void NS_PluginShutdown()
- {
--  // we should release the service manager
--  NS_IF_RELEASE(gServiceManager);
--  gServiceManager = NULL;
- }
- 
- /////////////////////////////////////////////////////////////
-@@ -130,20 +107,13 @@ void NS_DestroyPluginInstance(nsPluginIn
- //
- nsPluginInstance::nsPluginInstance(NPP aInstance) : nsPluginInstanceBase(),
-   mInstance(aInstance),
--  mInitialized(FALSE),
--  mScriptablePeer(NULL)
-+  mInitialized(FALSE)
- {
-   mString[0] = '\0';
- }
- 
- nsPluginInstance::~nsPluginInstance()
- {
--  // mScriptablePeer may be also held by the browser 
--  // so releasing it here does not guarantee that it is over
--  // we should take precaution in case it will be called later
--  // and zero its mPlugin member
--  mScriptablePeer->SetInstance(NULL);
--  NS_IF_RELEASE(mScriptablePeer);
- }
- 
- NPBool nsPluginInstance::init(NPWindow* aWindow)
-@@ -168,86 +138,12 @@ void nsPluginInstance::getVersion(char* 
- void nsPluginInstance::getVersion(char* *aVersion)
- {
-   const char *ua = NPN_UserAgent(mInstance);
--  char*& version = *aVersion;
--
--  // although we can use NPAPI NPN_MemAlloc call to allocate memory:
--  //    version = (char*)NPN_MemAlloc(strlen(ua) + 1);
--  // for illustration purposed we use the service manager to access 
--  // the memory service provided by Mozilla
--  nsIMemory * nsMemoryService = NULL;
--  
--  if (gServiceManager) {
--    // get service using its contract id and use it to allocate the memory
--    gServiceManager->GetServiceByContractID("@mozilla.org/xpcom/memory-service;1", NS_GET_IID(nsIMemory), (void **)&nsMemoryService);
--    if(nsMemoryService)
--      version = (char *)nsMemoryService->Alloc(strlen(ua) + 1);
--  }
--
--  if (version)
--    strcpy(version, ua);
--
--  // release service
--  NS_IF_RELEASE(nsMemoryService);
-+  *aVersion = (char*)NPN_MemAlloc(strlen(ua) + 1);
-+  if (*aVersion)
-+    strcpy(*aVersion, ua);
- }
- 
--// ==============================
--// ! Scriptability related code !
--// ==============================
--//
--// here the plugin is asked by Mozilla to tell if it is scriptable
--// we should return a valid interface id and a pointer to 
--// nsScriptablePeer interface which we should have implemented
--// and which should be defined in the corressponding *.xpt file
--// in the bin/components folder
- NPError	nsPluginInstance::GetValue(NPPVariable aVariable, void *aValue)
- {
--  NPError rv = NPERR_NO_ERROR;
--
--  switch (aVariable) {
--    case NPPVpluginScriptableInstance: {
--      // addref happens in getter, so we don't addref here
--      nsISimplePlugin * scriptablePeer = getScriptablePeer();
--      if (scriptablePeer) {
--        *(nsISupports **)aValue = scriptablePeer;
--      } else
--        rv = NPERR_OUT_OF_MEMORY_ERROR;
--    }
--    break;
--
--    case NPPVpluginScriptableIID: {
--      static nsIID scriptableIID = NS_ISIMPLEPLUGIN_IID;
--      nsIID* ptr = (nsIID *)NPN_MemAlloc(sizeof(nsIID));
--      if (ptr) {
--          *ptr = scriptableIID;
--          *(nsIID **)aValue = ptr;
--      } else
--        rv = NPERR_OUT_OF_MEMORY_ERROR;
--    }
--    break;
--
--    default:
--      break;
--  }
--
--  return rv;
-+  return NPERR_NO_ERROR;
- }
--
--// ==============================
--// ! Scriptability related code !
--// ==============================
--//
--// this method will return the scriptable object (and create it if necessary)
--nsScriptablePeer* nsPluginInstance::getScriptablePeer()
--{
--  if (!mScriptablePeer) {
--    mScriptablePeer = new nsScriptablePeer(this);
--    if(!mScriptablePeer)
--      return NULL;
--
--    NS_ADDREF(mScriptablePeer);
--  }
--
--  // add reference for the caller requesting the object
--  NS_ADDREF(mScriptablePeer);
--  return mScriptablePeer;
--}
-diff --git a/modules/plugin/tools/sdk/samples/simple/plugin.h b/modules/plugin/tools/sdk/samples/simple/plugin.h
---- a/modules/plugin/tools/sdk/samples/simple/plugin.h
-+++ b/modules/plugin/tools/sdk/samples/simple/plugin.h
-@@ -39,7 +39,6 @@
- #define __PLUGIN_H__
- 
- #include "pluginbase.h"
--#include "nsScriptablePeer.h"
- 
- class nsPluginInstance : public nsPluginInstanceBase
- {
-@@ -59,12 +58,9 @@ public:
-   // locals
-   void getVersion(char* *aVersion);
- 
--  nsScriptablePeer* getScriptablePeer();
--
- private:
-   NPP mInstance;
-   NPBool mInitialized;
--  nsScriptablePeer * mScriptablePeer;
- 
- public:
-   char mString[128];
-diff --git a/uriloader/exthandler/nsExternalHelperAppService.cpp b/uriloader/exthandler/nsExternalHelperAppService.cpp
---- a/uriloader/exthandler/nsExternalHelperAppService.cpp
-+++ b/uriloader/exthandler/nsExternalHelperAppService.cpp
-@@ -986,14 +986,10 @@ nsExternalAppHandler::nsExternalAppHandl
-   
-   // Make sure extension is correct.
-   EnsureSuggestedFileName();
--
--  gExtProtSvc->AddRef();
- }
- 
- nsExternalAppHandler::~nsExternalAppHandler()
- {
--  // Not using NS_RELEASE, since we don't want to set gExtProtSvc to NULL
--  gExtProtSvc->Release();
- }
- 
- NS_IMETHODIMP nsExternalAppHandler::SetWebProgressListener(nsIWebProgressListener2 * aWebProgressListener)
deleted file mode 100644
--- a/gcobject-tiertoolkit.patch
+++ /dev/null
@@ -1,84 +0,0 @@
-* * *
-
-diff --git a/toolkit/components/places/src/nsNavHistoryQuery.cpp b/toolkit/components/places/src/nsNavHistoryQuery.cpp
---- a/toolkit/components/places/src/nsNavHistoryQuery.cpp
-+++ b/toolkit/components/places/src/nsNavHistoryQuery.cpp
-@@ -1100,7 +1100,6 @@ NS_IMETHODIMP nsNavHistoryQuery::Clone(n
-   nsNavHistoryQuery *clone = new nsNavHistoryQuery(*this);
-   NS_ENSURE_TRUE(clone, NS_ERROR_OUT_OF_MEMORY);
- 
--  clone->mRefCnt = 0; // the clone doesn't inherit our refcount
-   NS_ADDREF(*_retval = clone);
-   return NS_OK;
- }
-diff --git a/toolkit/xre/nsAppRunner.cpp b/toolkit/xre/nsAppRunner.cpp
---- a/toolkit/xre/nsAppRunner.cpp
-+++ b/toolkit/xre/nsAppRunner.cpp
-@@ -529,7 +529,8 @@ PRBool gSafeMode = PR_FALSE;
-  * The nsXULAppInfo object implements nsIFactory so that it can be its own
-  * singleton.
-  */
--class nsXULAppInfo : public nsIXULAppInfo,
-+class nsXULAppInfo : public XPCOMGCObject,
-+                     public nsIXULAppInfo,
- #ifdef XP_WIN
-                      public nsIWinAppHelper,
- #endif
-@@ -564,18 +565,6 @@ NS_INTERFACE_MAP_BEGIN(nsXULAppInfo)
- #endif
-   NS_INTERFACE_MAP_ENTRY_CONDITIONAL(nsIXULAppInfo, gAppData)
- NS_INTERFACE_MAP_END
--
--NS_IMETHODIMP_(nsrefcnt)
--nsXULAppInfo::AddRef()
--{
--  return 1;
--}
--
--NS_IMETHODIMP_(nsrefcnt)
--nsXULAppInfo::Release()
--{
--  return 1;
--}
- 
- NS_IMETHODIMP
- nsXULAppInfo::GetVendor(nsACString& aResult)
-@@ -796,14 +785,12 @@ nsXULAppInfo::AnnotateCrashReport(const 
- }
- #endif
- 
--static const nsXULAppInfo kAppInfo;
- static NS_METHOD AppInfoConstructor(nsISupports* aOuter,
-                                     REFNSIID aIID, void **aResult)
- {
-   NS_ENSURE_NO_AGGREGATION(aOuter);
- 
--  return const_cast<nsXULAppInfo*>(&kAppInfo)->
--    QueryInterface(aIID, aResult);
-+  return new nsXULAppInfo()->QueryInterface(aIID, aResult);
- }
- 
- PRBool gLogConsoleErrors
-diff --git a/xpinstall/src/nsInstallVersion.cpp b/xpinstall/src/nsInstallVersion.cpp
---- a/xpinstall/src/nsInstallVersion.cpp
-+++ b/xpinstall/src/nsInstallVersion.cpp
-@@ -78,19 +78,16 @@ nsInstallVersion::QueryInterface(REFNSII
-     if ( aIID.Equals(kIScriptObjectOwnerIID))
-     {
-         *aInstancePtr = (void*) ((nsIScriptObjectOwner*)this);
--        AddRef();
-         return NS_OK;
-     }
-     else if ( aIID.Equals(kIInstallVersion_IID) )
-     {
-         *aInstancePtr = (void*) ((nsIDOMInstallVersion*)this);
--        AddRef();
-         return NS_OK;
-     }
-     else if ( aIID.Equals(kISupportsIID) )
-     {
-         *aInstancePtr = (void*)(nsISupports*)(nsIScriptObjectOwner*)this;
--        AddRef();
-         return NS_OK;
-     }
- 
deleted file mode 100644
--- a/layout-bases.patch
+++ /dev/null
@@ -1,60 +0,0 @@
-diff --git a/content/base/src/nsContentIterator.cpp b/content/base/src/nsContentIterator.cpp
---- a/content/base/src/nsContentIterator.cpp
-+++ b/content/base/src/nsContentIterator.cpp
-@@ -183,7 +183,8 @@ ContentIsInTraversalRange(nsIContent *aC
- /*
-  *  A simple iterator class for traversing the content in "close tag" order
-  */
--class nsContentIterator : public nsIContentIterator //, public nsIEnumerator
-+class nsContentIterator : public nsIContentIterator
-+                      //, public nsIEnumerator
- {
- public:
-   NS_DECL_ISUPPORTS
-diff --git a/content/svg/content/src/nsSVGTSpanElement.cpp b/content/svg/content/src/nsSVGTSpanElement.cpp
---- a/content/svg/content/src/nsSVGTSpanElement.cpp
-+++ b/content/svg/content/src/nsSVGTSpanElement.cpp
-@@ -49,9 +49,10 @@
- 
- typedef nsSVGStylableElement nsSVGTSpanElementBase;
- 
--class nsSVGTSpanElement : public nsSVGTSpanElementBase,
--                          public nsIDOMSVGTSpanElement // : nsIDOMSVGTextPositioningElement
--                                                       // : nsIDOMSVGTextContentElement
-+class nsSVGTSpanElement : public nsSVGTSpanElementBase
-+                        , public nsIDOMSVGTSpanElement
-+                     // , nsIDOMSVGTextPositioningElement
-+                     // , nsIDOMSVGTextContentElement
- {
- protected:
-   friend nsresult NS_NewSVGTSpanElement(nsIContent **aResult,
-diff --git a/content/svg/content/src/nsSVGTextElement.cpp b/content/svg/content/src/nsSVGTextElement.cpp
---- a/content/svg/content/src/nsSVGTextElement.cpp
-+++ b/content/svg/content/src/nsSVGTextElement.cpp
-@@ -49,9 +49,10 @@
- 
- typedef nsSVGGraphicElement nsSVGTextElementBase;
- 
--class nsSVGTextElement : public nsSVGTextElementBase,
--                         public nsIDOMSVGTextElement // : nsIDOMSVGTextPositioningElement
--                                                     // : nsIDOMSVGTextContentElement
-+class nsSVGTextElement : public nsSVGTextElementBase
-+                       , public nsIDOMSVGTextElement
-+                    // , nsIDOMSVGTextPositioningElement
-+                    // , nsIDOMSVGTextContentElement
- {
- protected:
-   friend nsresult NS_NewSVGTextElement(nsIContent **aResult,
-diff --git a/layout/svg/base/src/nsSVGGlyphFrame.h b/layout/svg/base/src/nsSVGGlyphFrame.h
---- a/layout/svg/base/src/nsSVGGlyphFrame.h
-+++ b/layout/svg/base/src/nsSVGGlyphFrame.h
-@@ -53,7 +53,8 @@ typedef nsSVGGeometryFrame nsSVGGlyphFra
- typedef nsSVGGeometryFrame nsSVGGlyphFrameBase;
- 
- class nsSVGGlyphFrame : public nsSVGGlyphFrameBase,
--                        public nsISVGGlyphFragmentLeaf, // : nsISVGGlyphFragmentNode
-+                        public nsISVGGlyphFragmentLeaf,
-+                   // : nsISVGGlyphFragmentNode
-                         public nsISVGChildFrame
- {
-   friend nsIFrame*
deleted file mode 100644
--- a/necko-cookie.patch
+++ /dev/null
@@ -1,261 +0,0 @@
-* * *
-
-diff --git a/netwerk/base/src/nsStandardURL.h b/netwerk/base/src/nsStandardURL.h
---- a/netwerk/base/src/nsStandardURL.h
-+++ b/netwerk/base/src/nsStandardURL.h
-@@ -102,7 +102,7 @@ public: /* internal -- HPUX compiler can
-     //
-     // Pref observer
-     //
--    class nsPrefObserver : public nsIObserver
-+    class nsPrefObserver : public XPCOMGCObject, public nsIObserver
-     {
-     public:
-         NS_DECL_ISUPPORTS
-diff --git a/netwerk/cookie/src/nsCookie.cpp b/netwerk/cookie/src/nsCookie.cpp
---- a/netwerk/cookie/src/nsCookie.cpp
-+++ b/netwerk/cookie/src/nsCookie.cpp
-@@ -44,30 +44,45 @@
-  * string helper impl
-  ******************************************************************************/
- 
--// copy aSource strings into contiguous storage provided in aDest1,
--// providing terminating nulls for each destination string.
--static inline void
--StrBlockCopy(const nsACString &aSource1,
--             const nsACString &aSource2,
--             const nsACString &aSource3,
--             const nsACString &aSource4,
--             char             *&aDest1,
--             char             *&aDest2,
--             char             *&aDest3,
--             char             *&aDest4,
--             char             *&aDestEnd)
-+// copy a string into a pre-allocated buffer, updating the buffer pointer.
-+static void
-+WriteString(const nsACString &s,
-+            char *&dbuf)
- {
--  char *toBegin = aDest1;
--  nsACString::const_iterator fromBegin, fromEnd;
-+    const char *sbuf;
-+    PRUint32 size = s.GetData(&sbuf);
-+    memcpy(dbuf, sbuf, size);
-+    dbuf[size] = '\0';
-+    dbuf += size + 1;
-+}
- 
--  *copy_string(aSource1.BeginReading(fromBegin), aSource1.EndReading(fromEnd), toBegin) = char(0);
--  aDest2 = ++toBegin;
--  *copy_string(aSource2.BeginReading(fromBegin), aSource2.EndReading(fromEnd), toBegin) = char(0);
--  aDest3 = ++toBegin;
--  *copy_string(aSource3.BeginReading(fromBegin), aSource3.EndReading(fromEnd), toBegin) = char(0);
--  aDest4 = ++toBegin;
--  *copy_string(aSource4.BeginReading(fromBegin), aSource4.EndReading(fromEnd), toBegin) = char(0);
--  aDestEnd = toBegin;
-+nsCookie::nsCookie(const nsACString &aName,
-+                   const nsACString &aValue,
-+                   const nsACString &aHost,
-+                   const nsACString &aPath,
-+                   PRInt64         aExpiry,
-+                   PRInt64         aCreationID,
-+                   PRBool          aIsSession,
-+                   PRBool          aIsSecure,
-+                   PRBool          aIsHttpOnly)
-+    : mNext(nsnull)
-+    , mExpiry(aExpiry)
-+    , mCreationID(aCreationID)
-+    , mIsSession(aIsSession != PR_FALSE)
-+    , mIsSecure(aIsSecure != PR_FALSE)
-+    , mIsHttpOnly(aIsHttpOnly != PR_FALSE)
-+{
-+    char *dest = mStringBuffer;
-+
-+    mName = dest;
-+    WriteString(aName, dest);
-+    mValue = dest;
-+    WriteString(aValue, dest);
-+    mHost = dest;
-+    WriteString(aHost, dest);
-+    mPath = dest;
-+    WriteString(aPath, dest);
-+    mEnd = dest - 1;
- }
- 
- /******************************************************************************
-@@ -94,21 +109,9 @@ nsCookie::Create(const nsACString &aName
-                  PRBool            aIsSecure,
-                  PRBool            aIsHttpOnly)
- {
--  // find the required string buffer size, adding 4 for the terminating nulls
-+  // find the required string buffer size
-   const PRUint32 stringLength = aName.Length() + aValue.Length() +
--                                aHost.Length() + aPath.Length() + 4;
--
--  // allocate contiguous space for the nsCookie and its strings -
--  // we store the strings in-line with the nsCookie to save allocations
--  void *place = ::operator new(sizeof(nsCookie) + stringLength);
--  if (!place)
--    return nsnull;
--
--  // assign string members
--  char *name, *value, *host, *path, *end;
--  name = static_cast<char *>(place) + sizeof(nsCookie);
--  StrBlockCopy(aName, aValue, aHost, aPath,
--               name, value, host, path, end);
-+                                aHost.Length() + aPath.Length();
- 
-   // check if the creation id given to us is greater than the running maximum
-   // (it should always be monotonically increasing). if it's not, make up our own.
-@@ -118,9 +121,10 @@ nsCookie::Create(const nsACString &aName
-     aCreationID = ++gLastCreationID;
- 
-   // construct the cookie. placement new, oh yeah!
--  return new (place) nsCookie(name, value, host, path, end,
--                              aExpiry, aCreationID,
--                              aIsSession, aIsSecure, aIsHttpOnly);
-+  return new (NS_GetGC(), stringLength)
-+      nsCookie(aName, aValue, aHost, aPath,
-+               aExpiry, aCreationID,
-+               aIsSession, aIsSecure, aIsHttpOnly);
- }
- 
- /******************************************************************************
-diff --git a/netwerk/cookie/src/nsCookie.h b/netwerk/cookie/src/nsCookie.h
---- a/netwerk/cookie/src/nsCookie.h
-+++ b/netwerk/cookie/src/nsCookie.h
-@@ -54,7 +54,7 @@
-  * implementation
-  ******************************************************************************/
- 
--class nsCookie : public nsICookie2
-+class nsCookie : public MMgc::GCObject, public nsICookie2
- {
-   public:
-     // nsISupports
-@@ -64,33 +64,23 @@ class nsCookie : public nsICookie2
- 
-   private:
-     // for internal use only. see nsCookie::Create().
--    nsCookie(const char     *aName,
--             const char     *aValue,
--             const char     *aHost,
--             const char     *aPath,
--             const char     *aEnd,
-+    nsCookie(const nsACString &aName,
-+             const nsACString &aValue,
-+             const nsACString &aHost,
-+             const nsACString &aPath,
-              PRInt64         aExpiry,
-              PRInt64         aCreationID,
-              PRBool          aIsSession,
-              PRBool          aIsSecure,
--             PRBool          aIsHttpOnly)
--     : mNext(nsnull)
--     , mName(aName)
--     , mValue(aValue)
--     , mHost(aHost)
--     , mPath(aPath)
--     , mEnd(aEnd)
--     , mExpiry(aExpiry)
--     , mCreationID(aCreationID)
--     , mIsSession(aIsSession != PR_FALSE)
--     , mIsSecure(aIsSecure != PR_FALSE)
--     , mIsHttpOnly(aIsHttpOnly != PR_FALSE)
--    {
-+             PRBool          aIsHttpOnly);
-+
-+    // NOT IMPLEMENTED OR CALLED
-+    ~nsCookie() {
-+        NS_ERROR("Not called");
-     }
- 
-   public:
--    // public helper to create an nsCookie object. use |operator delete|
--    // to destroy an object created by this method.
-+    // public helper to create an nsCookie object
-     static nsCookie * Create(const nsACString &aName,
-                              const nsACString &aValue,
-                              const nsACString &aHost,
-@@ -100,8 +90,6 @@ class nsCookie : public nsICookie2
-                              PRBool            aIsSession,
-                              PRBool            aIsSecure,
-                              PRBool            aIsHttpOnly);
--
--    virtual ~nsCookie() {}
- 
-     // fast (inline, non-xpcom) getters
-     inline const nsDependentCString Name()  const { return nsDependentCString(mName, mValue - 1); }
-@@ -148,6 +136,10 @@ class nsCookie : public nsICookie2
-     PRPackedBool mIsSession;
-     PRPackedBool mIsSecure;
-     PRPackedBool mIsHttpOnly;
-+
-+    // The name/value/host/path data is allocated directly at the end of this
-+    // object, with four bytes for terminating nulls
-+    char mStringBuffer[4];
- };
- 
- #endif // nsCookie_h__
-diff --git a/netwerk/cookie/src/nsCookieService.cpp b/netwerk/cookie/src/nsCookieService.cpp
---- a/netwerk/cookie/src/nsCookieService.cpp
-+++ b/netwerk/cookie/src/nsCookieService.cpp
-@@ -879,15 +879,7 @@ nsCookieService::Read()
-     if (!newCookie)
-       return NS_ERROR_OUT_OF_MEMORY;
- 
--    if (!AddCookieToList(newCookie, PR_FALSE))
--      // It is purpose that created us; purpose that connects us;
--      // purpose that pulls us; that guides us; that drives us.
--      // It is purpose that defines us; purpose that binds us.
--      // When a cookie no longer has purpose, it has a choice:
--      // it can return to the source to be deleted, or it can go
--      // into exile, and stay hidden inside the Matrix.
--      // Let's choose deletion.
--      delete newCookie;
-+    (void) AddCookieToList(newCookie, PR_FALSE);
-   }
- 
-   return NS_OK;
-@@ -1014,16 +1006,7 @@ nsCookieService::ImportCookies()
-     // known unique one here.
-     newCookie->SetCreationID(--creationIDCounter);
- 
--    if (!AddCookieToList(newCookie)) {
--      // It is purpose that created us; purpose that connects us;
--      // purpose that pulls us; that guides us; that drives us.
--      // It is purpose that defines us; purpose that binds us.
--      // When a cookie no longer has purpose, it has a choice:
--      // it can return to the source to be deleted, or it can go
--      // into exile, and stay hidden inside the Matrix.
--      // Let's choose deletion.
--      delete newCookie;
--    }
-+    (void) AddCookieToList(newCookie);
-   }
- 
-   // we're done importing - delete the old cookie file
-diff --git a/netwerk/dns/src/nsHostResolver.cpp b/netwerk/dns/src/nsHostResolver.cpp
---- a/netwerk/dns/src/nsHostResolver.cpp
-+++ b/netwerk/dns/src/nsHostResolver.cpp
-@@ -162,7 +162,7 @@ nsHostRecord::Create(const nsHostKey *ke
-     size_t hostLen = strlen(key->host) + 1;
-     size_t size = hostLen + sizeof(nsHostRecord);
- 
--    nsHostRecord *rec = (nsHostRecord*) ::operator new(size);
-+    nsHostRecord *rec = (nsHostRecord*) MMgc::GCFinalizedObject::operator new(size, NS_GetGC());
-     if (!rec)
-         return NS_ERROR_OUT_OF_MEMORY;
- 
-diff --git a/netwerk/dns/src/nsHostResolver.h b/netwerk/dns/src/nsHostResolver.h
---- a/netwerk/dns/src/nsHostResolver.h
-+++ b/netwerk/dns/src/nsHostResolver.h
-@@ -130,7 +130,7 @@ public:
- /**
-  * nsHostResolver - an asynchronous host name resolver.
-  */
--class nsHostResolver
-+class nsHostResolver : public XPCOMGCFinalizedObject
- {
- public:
-     /**
--- a/prerewrite_fixes.patch
+++ b/prerewrite_fixes.patch
@@ -46,17 +46,17 @@ diff --git a/content/base/src/nsImageLoa
 +                                                ? mPendingRequest
 +                                                : mCurrentRequest));
    if (NS_FAILED(rv)) {
      FireEvent(NS_LITERAL_STRING("error"));
      return NS_OK;
 diff --git a/content/base/src/nsXMLHttpRequest.cpp b/content/base/src/nsXMLHttpRequest.cpp
 --- a/content/base/src/nsXMLHttpRequest.cpp
 +++ b/content/base/src/nsXMLHttpRequest.cpp
-@@ -1043,7 +1043,7 @@ nsXMLHttpRequest::CreateEvent(const nsAS
+@@ -1044,7 +1044,7 @@ nsXMLHttpRequest::CreateEvent(const nsAS
  }
  
  void
 -nsXMLHttpRequest::CopyEventListeners(nsCOMPtr<nsIDOMEventListener>& aListener,
 +nsXMLHttpRequest::CopyEventListeners(nsIDOMEventListener* aListener,
                                       const nsCOMArray<nsIDOMEventListener>& aListenerArray,
                                       nsCOMArray<nsIDOMEventListener>& aCopy)
  {
@@ -98,27 +98,27 @@ diff --git a/content/svg/content/src/nsS
 +      ? static_cast<nsSVGSVGElement*>(ancestor.get()) 
 +      : nsnull;
      if (viewportElement) {
        rv = viewportElement->GetViewboxToViewportTransform(getter_AddRefs(ancestorCTM));
        if (NS_FAILED(rv)) return rv;
 diff --git a/content/svg/content/src/nsSVGSVGElement.h b/content/svg/content/src/nsSVGSVGElement.h
 --- a/content/svg/content/src/nsSVGSVGElement.h
 +++ b/content/svg/content/src/nsSVGSVGElement.h
-@@ -48,10 +48,6 @@
- #include "nsIDOMSVGMatrix.h"
+@@ -49,10 +49,6 @@
  #include "nsSVGLength2.h"
  #include "nsSVGEnum.h"
--
+ 
 -#define QI_AND_CAST_TO_NSSVGSVGELEMENT(base)                                  \
 -  (nsCOMPtr<nsIDOMSVGSVGElement>(do_QueryInterface(base)) ?                   \
 -   static_cast<nsSVGSVGElement*>(base.get()) : nsnull)
- 
+-
  typedef nsSVGStylableElement nsSVGSVGElementBase;
  
+ class svgFloatSize {
 diff --git a/content/xslt/src/xslt/txStylesheet.cpp b/content/xslt/src/xslt/txStylesheet.cpp
 --- a/content/xslt/src/xslt/txStylesheet.cpp
 +++ b/content/xslt/src/xslt/txStylesheet.cpp
 @@ -558,7 +558,8 @@ txStylesheet::addAttributeSet(txAttribut
  
      aAttributeSetItem->mFirstInstruction.forget();
  
 -    delete lastNonReturn->mNext;      // Delete the txReturn...
@@ -177,45 +177,45 @@ diff --git a/content/xul/templates/src/n
 -    nsCOMPtr<nsIRDFNode>* ValuesArray() { return mValues; }
 +    nsIRDFNodeManualCOMPtrArray ValuesArray() { return mValues; }
  
      /*
       * Retrieve the assignment for a particular variable
 diff --git a/docshell/base/nsDocShell.cpp b/docshell/base/nsDocShell.cpp
 --- a/docshell/base/nsDocShell.cpp
 +++ b/docshell/base/nsDocShell.cpp
-@@ -935,10 +935,10 @@ nsDocShell::LoadStream(nsIInputStream *a
+@@ -938,10 +938,10 @@ nsDocShell::LoadStream(nsIInputStream *a
  
      // build up a channel for this stream.
      nsCOMPtr<nsIChannel> channel;
 -    NS_ENSURE_SUCCESS(NS_NewInputStreamChannel
 -                      (getter_AddRefs(channel), uri, aStream,
 -                       aContentType, aContentCharset),
 -                      NS_ERROR_FAILURE);
 +    nsresult res = NS_NewInputStreamChannel(getter_AddRefs(channel), uri, 
 +                                            aStream, aContentType,
 +                                            aContentCharset);
 +    NS_ENSURE_SUCCESS(res, NS_ERROR_FAILURE);
  
      nsCOMPtr<nsIURILoader>
          uriLoader(do_GetService(NS_URI_LOADER_CONTRACTID));
-@@ -1825,9 +1825,9 @@ nsDocShell::GetSameTypeRootTreeItem(nsID
+@@ -1834,9 +1834,9 @@ nsDocShell::GetSameTypeRootTreeItem(nsID
                        NS_ERROR_FAILURE);
      while (parent) {
          *aRootTreeItem = parent;
 -        NS_ENSURE_SUCCESS((*aRootTreeItem)->
 -                          GetSameTypeParent(getter_AddRefs(parent)),
 -                          NS_ERROR_FAILURE);
 +        nsresult res = (*aRootTreeItem)->
 +            GetSameTypeParent(getter_AddRefs(parent));
 +        NS_ENSURE_SUCCESS(res, NS_ERROR_FAILURE);
      }
      NS_ADDREF(*aRootTreeItem);
      return NS_OK;
-@@ -5874,9 +5874,9 @@ nsDocShell::CreateContentViewer(const ch
+@@ -5910,9 +5910,9 @@ nsDocShell::CreateContentViewer(const ch
  
      // let's try resetting the load group if we need to...
      nsCOMPtr<nsILoadGroup> currentLoadGroup;
 -    NS_ENSURE_SUCCESS(aOpenedChannel->
 -                      GetLoadGroup(getter_AddRefs(currentLoadGroup)),
 -                      NS_ERROR_FAILURE);
 +    nsresult res = aOpenedChannel->
 +        GetLoadGroup(getter_AddRefs(currentLoadGroup));
@@ -299,17 +299,17 @@ diff --git a/editor/libeditor/base/nsSel
 -    nsAutoTrackDOMPoint(nsRangeUpdater &aRangeUpdater, nsCOMPtr<nsIDOMNode> *aNode, PRInt32 *aOffset) :
 +    nsAutoTrackDOMPoint(nsRangeUpdater &aRangeUpdater, nsIDOMNode **aNode, PRInt32 *aOffset) :
      mRU(aRangeUpdater)
      ,mNode(aNode)
      ,mOffset(aOffset)
 diff --git a/editor/libeditor/html/nsHTMLDataTransfer.cpp b/editor/libeditor/html/nsHTMLDataTransfer.cpp
 --- a/editor/libeditor/html/nsHTMLDataTransfer.cpp
 +++ b/editor/libeditor/html/nsHTMLDataTransfer.cpp
-@@ -342,7 +342,7 @@ nsHTMLEditor::InsertHTMLWithContext(cons
+@@ -341,7 +341,7 @@ nsHTMLEditor::InsertHTMLWithContext(cons
      {
        // Use an auto tracker so that our drop point is correctly
        // positioned after the delete.
 -      nsAutoTrackDOMPoint tracker(mRangeUpdater, &targetNode, &targetOffset);
 +      nsAutoTrackDOMPoint tracker(mRangeUpdater, getter_AddRefs(targetNode), &targetOffset);
        res = DeleteSelection(eNone);
        NS_ENSURE_SUCCESS(res, res);
      }
@@ -338,17 +338,17 @@ diff --git a/editor/libeditor/html/nsHTM
    
    {
      // track end location of where we are deleting
 -    nsAutoTrackDOMPoint tracker(mHTMLEditor->mRangeUpdater, address_of(endNode), &endOffset);
 +    nsAutoTrackDOMPoint tracker(mHTMLEditor->mRangeUpdater, getter_AddRefs(endNode), &endOffset);
      // we are handling all ranged deletions directly now.
      *aHandled = PR_TRUE;
      
-@@ -4382,7 +4382,7 @@ nsHTMLEditRules::CreateStyleForInsertTex
+@@ -4418,7 +4418,7 @@ nsHTMLEditRules::CreateStyleForInsertTex
          // This is so we can know where to put the selection after we call
          // RemoveStyleInside().  RemoveStyleInside() could remove any and all of those nodes,
          // so I have to use the range tracking system to find the right spot to put selection.
 -        nsAutoTrackDOMPoint tracker(mHTMLEditor->mRangeUpdater, address_of(newSelParent), &newSelOffset);
 +        nsAutoTrackDOMPoint tracker(mHTMLEditor->mRangeUpdater, getter_AddRefs(newSelParent), &newSelOffset);
          res = mHTMLEditor->RemoveStyleInside(leftNode, item->tag, &(item->attr));
          if (NS_FAILED(res)) return res;
        }
@@ -412,17 +412,17 @@ diff --git a/editor/libeditor/html/nsWSR
 -    nsAutoTrackDOMPoint tracker(mHTMLEditor->mRangeUpdater, aInOutParent, aInOutOffset);
 +    nsAutoTrackDOMPoint tracker(mHTMLEditor->mRangeUpdater, getter_AddRefs(*aInOutParent), aInOutOffset);
  
      // handle any changes needed to ws run after inserted text
      if (!afterRun)
 diff --git a/editor/libeditor/text/nsPlaintextDataTransfer.cpp b/editor/libeditor/text/nsPlaintextDataTransfer.cpp
 --- a/editor/libeditor/text/nsPlaintextDataTransfer.cpp
 +++ b/editor/libeditor/text/nsPlaintextDataTransfer.cpp
-@@ -99,7 +99,7 @@ nsresult nsPlaintextEditor::InsertTextAt
+@@ -98,7 +98,7 @@ nsresult nsPlaintextEditor::InsertTextAt
      {
        // Use an auto tracker so that our drop point is correctly
        // positioned after the delete.
 -      nsAutoTrackDOMPoint tracker(mRangeUpdater, &targetNode, &targetOffset);
 +      nsAutoTrackDOMPoint tracker(mRangeUpdater, getter_AddRefs(targetNode), &targetOffset);
        res = DeleteSelection(eNone);
        NS_ENSURE_SUCCESS(res, res);
      }
@@ -468,64 +468,64 @@ diff --git a/js/src/xpconnect/src/xpclog
 +
 +#endif
  JS_BEGIN_EXTERN_C
  
  void   XPC_Log_print(const char *fmt, ...);
 diff --git a/layout/style/nsCSSLoader.cpp b/layout/style/nsCSSLoader.cpp
 --- a/layout/style/nsCSSLoader.cpp
 +++ b/layout/style/nsCSSLoader.cpp
-@@ -1009,7 +1009,7 @@ CSSLoaderImpl::CreateSheet(nsIURI* aURI,
+@@ -1008,7 +1008,7 @@ CSSLoaderImpl::CreateSheet(nsIURI* aURI,
        if (cache) {
          if (cache->IsEnabled()) {
            sheet = cache->GetStyleSheet(aURI);
 -          LOG(("  From XUL cache: %p", sheet.get()));
 +          //LOG(("  From XUL cache: %p", sheet.get()));
          }
        }
      }
-@@ -1020,7 +1020,7 @@ CSSLoaderImpl::CreateSheet(nsIURI* aURI,
+@@ -1019,7 +1019,7 @@ CSSLoaderImpl::CreateSheet(nsIURI* aURI,
        nsURIAndPrincipalHashKey key(aURI, aLoaderPrincipal);
        
        mCompleteSheets.Get(&key, getter_AddRefs(sheet));
 -      LOG(("  From completed: %p", sheet.get()));
 +      //LOG(("  From completed: %p", sheet.get()));
      
        // Then loading sheets
        if (!sheet && !aSyncLoad) {
-@@ -1029,7 +1029,7 @@ CSSLoaderImpl::CreateSheet(nsIURI* aURI,
+@@ -1028,7 +1028,7 @@ CSSLoaderImpl::CreateSheet(nsIURI* aURI,
          mLoadingDatas.Get(&key, &loadData);
          if (loadData) {
            sheet = loadData->mSheet;
 -          LOG(("  From loading: %p", sheet.get()));
 +          //LOG(("  From loading: %p", sheet.get()));
  
  #ifdef DEBUG
            PRBool debugEqual;
-@@ -1049,7 +1049,7 @@ CSSLoaderImpl::CreateSheet(nsIURI* aURI,
+@@ -1048,7 +1048,7 @@ CSSLoaderImpl::CreateSheet(nsIURI* aURI,
            mPendingDatas.Get(&key, &loadData);
            if (loadData) {
              sheet = loadData->mSheet;
 -            LOG(("  From pending: %p", sheet.get()));
 +            //LOG(("  From pending: %p", sheet.get()));
  
  #ifdef DEBUG
              PRBool debugEqual;
-@@ -1573,8 +1573,8 @@ CSSLoaderImpl::SheetComplete(SheetLoadDa
+@@ -1578,8 +1578,8 @@ CSSLoaderImpl::SheetComplete(SheetLoadDa
      nsTObserverArray<nsICSSLoaderObserver>::ForwardIterator iter(mObservers);
      nsCOMPtr<nsICSSLoaderObserver> obs;
      while ((obs = iter.GetNext())) {
 -      LOG(("  Notifying global observer 0x%x for data 0x%s.  wasAlternate: %d",
 -           obs.get(), data, data->mWasAlternate));
 +      /*LOG(("  Notifying global observer 0x%x for data 0x%s.  wasAlternate: %d",
 +        obs.get(), data, data->mWasAlternate));*/
        obs->StyleSheetLoaded(data->mSheet, data->mWasAlternate, aStatus);
      }
    }
-@@ -1797,8 +1797,8 @@ CSSLoaderImpl::LoadStyleLink(nsIContent*
+@@ -1802,8 +1802,8 @@ CSSLoaderImpl::LoadStyleLink(nsIContent*
    NS_ENSURE_SUCCESS(rv, rv);
  
    if (state == eSheetComplete) {
 -    LOG(("  Sheet already complete: 0x%p",
 -         static_cast<void*>(sheet.get())));
 +    /*LOG(("  Sheet already complete: 0x%p",
 +      static_cast<void*>(sheet.get())));*/
      if (aObserver) {
@@ -552,30 +552,30 @@ diff --git a/layout/style/nsCSSStyleShee
 +#define END_MEDIA_CHANGE(sheet, doc)                           
 +#endif
  
  NS_IMETHODIMP
  nsMediaList::SetMediaText(const nsAString& aMediaText)
 diff --git a/netwerk/cookie/src/nsCookieService.cpp b/netwerk/cookie/src/nsCookieService.cpp
 --- a/netwerk/cookie/src/nsCookieService.cpp
 +++ b/netwerk/cookie/src/nsCookieService.cpp
-@@ -486,7 +486,8 @@ nsCookieService::InitDB()
+@@ -529,7 +529,8 @@ nsCookieService::InitDB()
          nsCOMPtr<mozIStorageStatement> stmt;
          rv = mDBConn->CreateStatement(NS_LITERAL_CSTRING(
            "SELECT id, name, value, host, path, expiry, isSecure, isHttpOnly "
 -          "FROM moz_cookies"), getter_AddRefs(stmt));
 +          "FROM moz_cookies"),
 +				      getter_AddRefs(stmt));
-         if (NS_SUCCEEDED(rv)) {
-           PRBool hasResult;
-           rv = stmt->ExecuteStep(&hasResult);
-@@ -851,7 +852,8 @@ nsCookieService::Read()
+         if (NS_SUCCEEDED(rv))
+           break;
+ 
+@@ -906,7 +907,8 @@ nsCookieService::Read()
    nsCOMPtr<mozIStorageStatement> stmt;
    rv = mDBConn->CreateStatement(NS_LITERAL_CSTRING(
-     "SELECT id, name, value, host, path, expiry, isSecure, isHttpOnly "
+     "SELECT id, name, value, host, path, expiry, lastAccessed, isSecure, isHttpOnly "
 -    "FROM moz_cookies"), getter_AddRefs(stmt));
 +    "FROM moz_cookies"),
 +				getter_AddRefs(stmt));
    NS_ENSURE_SUCCESS(rv, rv);
  
    nsCAutoString name, value, host, path;
 diff --git a/storage/src/mozStorageConnection.cpp b/storage/src/mozStorageConnection.cpp
 --- a/storage/src/mozStorageConnection.cpp
@@ -588,107 +588,97 @@ diff --git a/storage/src/mozStorageConne
 +        "PRAGMA user_version"), 
 +                                  getter_AddRefs(stmt));
      if (NS_FAILED(rv)) return rv;
  
      *version = 0;
 diff --git a/toolkit/components/downloads/src/nsDownloadManager.cpp b/toolkit/components/downloads/src/nsDownloadManager.cpp
 --- a/toolkit/components/downloads/src/nsDownloadManager.cpp
 +++ b/toolkit/components/downloads/src/nsDownloadManager.cpp
-@@ -354,7 +354,8 @@ nsDownloadManager::InitDB(PRBool *aDoImp
-       rv = mDBConn->CreateStatement(NS_LITERAL_CSTRING(
+@@ -469,7 +469,8 @@ nsDownloadManager::InitDB(PRBool *aDoImp
          "SELECT id, name, source, target, tempPath, startTime, endTime, state, "
-                "referrer, entityID, currBytes, maxBytes "
+                "referrer, entityID, currBytes, maxBytes, mimeType, "
+                "preferredApplication, preferredAction, autoResume "
 -        "FROM moz_downloads"), getter_AddRefs(stmt));
 +        "FROM moz_downloads"),
 +                                    getter_AddRefs(stmt));
        if (NS_SUCCEEDED(rv))
          break;
  
-@@ -552,7 +553,8 @@ nsDownloadManager::RestoreDatabaseState(
-     "FROM moz_downloads "
-     "WHERE state = ?1 "
-       "OR state = ?2 "
--      "OR state = ?3"), getter_AddRefs(stmt));
-+      "OR state = ?3"),
-+                                         getter_AddRefs(stmt));
-   NS_ENSURE_SUCCESS(rv, rv);
- 
-   PRInt32 i = 0;
-@@ -579,7 +581,8 @@ nsDownloadManager::RestoreDatabaseState(
-     "SET state = ?1 "
+@@ -671,7 +672,8 @@ nsDownloadManager::RestoreDatabaseState(
+     "SET autoResume = ?1 "
      "WHERE state = ?2 "
        "OR state = ?3 "
 -      "OR state = ?4"), getter_AddRefs(stmt));
 +      "OR state = ?4"),
 +                                getter_AddRefs(stmt));
    NS_ENSURE_SUCCESS(rv, rv);
  
-   i = 0;
-@@ -610,7 +613,8 @@ nsDownloadManager::RestoreActiveDownload
+   PRInt32 i = 0;
+@@ -698,7 +700,8 @@ nsDownloadManager::RestoreActiveDownload
      "SELECT id "
      "FROM moz_downloads "
-     "WHERE state = ?1 "
--      "AND LENGTH(entityID) > 0"), getter_AddRefs(stmt));
-+      "AND LENGTH(entityID) > 0"),
+     "WHERE (state = ?1 AND LENGTH(entityID) > 0) "
+-      "OR autoResume != ?2"), getter_AddRefs(stmt));
++    "OR autoResume != ?2"),
 +                                         getter_AddRefs(stmt));
    NS_ENSURE_SUCCESS(rv, rv);
  
    rv = stmt->BindInt32Parameter(0, nsIDownloadManager::DOWNLOAD_PAUSED);
-@@ -642,7 +646,8 @@ nsDownloadManager::AddDownloadToDB(const
-   nsresult rv = mDBConn->CreateStatement(NS_LITERAL_CSTRING(
+@@ -742,7 +745,8 @@ nsDownloadManager::AddDownloadToDB(const
      "INSERT INTO moz_downloads "
-     "(name, source, target, tempPath, startTime, endTime, state) "
--    "VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7)"), getter_AddRefs(stmt));
-+    "VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7)"), 
+     "(name, source, target, tempPath, startTime, endTime, state, "
+      "mimeType, preferredApplication, preferredAction) "
+-    "VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8, ?9, ?10)"), getter_AddRefs(stmt));
++    "VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8, ?9, ?10)"),
 +                                         getter_AddRefs(stmt));
    NS_ENSURE_SUCCESS(rv, 0);
  
    PRInt32 i = 0;
-@@ -723,7 +728,8 @@ nsDownloadManager::Init()
-     "UPDATE moz_downloads "
+@@ -836,7 +840,8 @@ nsDownloadManager::Init()
      "SET tempPath = ?1, startTime = ?2, endTime = ?3, state = ?4, "
-         "referrer = ?5, entityID = ?6, currBytes = ?7, maxBytes = ?8 "
--    "WHERE id = ?9"), getter_AddRefs(mUpdateDownloadStatement));
-+    "WHERE id = ?9"), 
+         "referrer = ?5, entityID = ?6, currBytes = ?7, maxBytes = ?8, "
+         "autoResume = ?9 "
+-    "WHERE id = ?10"), getter_AddRefs(mUpdateDownloadStatement));
++    "WHERE id = ?10"),
 +                                getter_AddRefs(mUpdateDownloadStatement));
    NS_ENSURE_SUCCESS(rv, rv);
  
    // Do things *after* initializing various download manager properties such as
-@@ -777,7 +783,8 @@ nsDownloadManager::GetDownloadFromDB(PRU
-     "SELECT id, state, startTime, source, target, tempPath, name, referrer, "
-            "entityID, currBytes, maxBytes "
+@@ -891,7 +896,8 @@ nsDownloadManager::GetDownloadFromDB(PRU
+            "entityID, currBytes, maxBytes, mimeType, preferredAction, "
+            "preferredApplication, autoResume "
      "FROM moz_downloads "
 -    "WHERE id = ?1"), getter_AddRefs(stmt));
 +    "WHERE id = ?1"), 
 +                                         getter_AddRefs(stmt));
    NS_ENSURE_SUCCESS(rv, rv);
  
    rv = stmt->BindInt64Parameter(0, aID);
-@@ -1230,7 +1237,8 @@ nsDownloadManager::RemoveDownload(PRUint
+@@ -1418,7 +1424,8 @@ nsDownloadManager::RemoveDownload(PRUint
    nsCOMPtr<mozIStorageStatement> stmt;
    nsresult rv = mDBConn->CreateStatement(NS_LITERAL_CSTRING(
      "DELETE FROM moz_downloads "
 -    "WHERE id = ?1"), getter_AddRefs(stmt));
 +    "WHERE id = ?1"), 
 +                                         getter_AddRefs(stmt));
    NS_ENSURE_SUCCESS(rv, rv);
  
    rv = stmt->BindInt64Parameter(0, aID); // unsigned; 64-bit to prevent overflow
-@@ -1265,7 +1273,8 @@ nsDownloadManager::CleanUp()
+@@ -1453,7 +1460,8 @@ nsDownloadManager::CleanUp()
      "WHERE state = ?1 "
        "OR state = ?2 "
        "OR state = ?3 "
 -      "OR state = ?4"), getter_AddRefs(stmt));
 +      "OR state = ?4"), 
 +                                         getter_AddRefs(stmt));
    NS_ENSURE_SUCCESS(rv, rv);
    for (PRUint32 i = 0; i < 4; ++i) {
      rv = stmt->BindInt32Parameter(i, states[i]);
-@@ -1298,7 +1307,8 @@ nsDownloadManager::GetCanCleanUp(PRBool 
+@@ -1486,7 +1494,8 @@ nsDownloadManager::GetCanCleanUp(PRBool 
      "WHERE state = ?1 "
        "OR state = ?2 "
        "OR state = ?3 "
 -      "OR state = ?4"), getter_AddRefs(stmt));
 +      "OR state = ?4"), 
 +                                         getter_AddRefs(stmt));
    NS_ENSURE_SUCCESS(rv, rv);
    for (PRUint32 i = 0; i < 4; ++i) {
@@ -720,51 +710,51 @@ diff --git a/toolkit/components/places/s
 -    if (e)                                                                 \
 -      e->method;                                                           \
    }
  
  #endif
 diff --git a/toolkit/components/places/src/nsNavHistory.cpp b/toolkit/components/places/src/nsNavHistory.cpp
 --- a/toolkit/components/places/src/nsNavHistory.cpp
 +++ b/toolkit/components/places/src/nsNavHistory.cpp
-@@ -970,7 +970,8 @@ nsNavHistory::MigrateV6Up(mozIStorageCon
+@@ -981,7 +981,8 @@ nsNavHistory::MigrateV6Up(mozIStorageCon
    nsCOMPtr<mozIStorageStatement> statement;
    nsresult rv = mDBConn->CreateStatement(NS_LITERAL_CSTRING(
      "SELECT a.dateAdded, a.lastModified, b.dateAdded, b.lastModified "
 -    "FROM moz_annos a, moz_items_annos b"), getter_AddRefs(statement));
 +    "FROM moz_annos a, moz_items_annos b"), 
 +                                         getter_AddRefs(statement));
    if (NS_FAILED(rv)) {
      // add dateAdded and lastModified columns to moz_annos
      rv = aDBConn->ExecuteSimpleSQL(NS_LITERAL_CSTRING(
-@@ -1010,7 +1011,8 @@ nsNavHistory::CleanUpOnQuit()
+@@ -1021,7 +1022,8 @@ nsNavHistory::CleanUpOnQuit()
    // test for moz_places.user_title
    nsCOMPtr<mozIStorageStatement> statement2;
    nsresult rv = mDBConn->CreateStatement(NS_LITERAL_CSTRING(
 -    "SELECT user_title FROM moz_places"), getter_AddRefs(statement2));
 +    "SELECT user_title FROM moz_places"), 
 +                                         getter_AddRefs(statement2));
    if (NS_SUCCEEDED(rv)) {
      mozStorageTransaction transaction(mDBConn, PR_FALSE);
      // 1. Indexes are moved along with the renamed table. Since we're dropping
-@@ -2873,11 +2875,12 @@ nsNavHistory::RemovePagesFromHost(const 
+@@ -2867,11 +2869,12 @@ nsNavHistory::RemovePagesFromHost(const 
  
    // notify observers
    UpdateBatchScoper batch(*this); // sends Begin/EndUpdateBatch to obsrvrs.
 +  GARBURATOR_HATES_THIS (
    if (deletedURIs.Count()) {
      nsCOMPtr<nsIURI> thisURI;
      for (PRUint32 observerIndex = 0; observerIndex < mObservers.Length();
           observerIndex ++) {
 -      const nsCOMPtr<nsINavHistoryObserver> &obs = mObservers.ElementAt(observerIndex);
 +      const nsCOMPtr<nsINavHistoryObserver> obs = mObservers.ElementAt(observerIndex);
        if (! obs)
          continue;
  
-@@ -2890,6 +2893,7 @@ nsNavHistory::RemovePagesFromHost(const 
+@@ -2884,6 +2887,7 @@ nsNavHistory::RemovePagesFromHost(const 
        }
      }
    }
 +                         )
    return NS_OK;
  }
  
 diff --git a/toolkit/crashreporter/test/TestCrashReporterAPI.cpp b/toolkit/crashreporter/test/TestCrashReporterAPI.cpp
--- a/remove-cyclec.patch
+++ b/remove-cyclec.patch
@@ -1,17 +1,17 @@
 * * *
 * * *
 * * *
 * * *
 
 diff --git a/content/base/public/nsContentUtils.h b/content/base/public/nsContentUtils.h
 --- a/content/base/public/nsContentUtils.h
 +++ b/content/base/public/nsContentUtils.h
-@@ -843,20 +843,6 @@ public:
+@@ -822,20 +822,6 @@ public:
    static PRUint32 GetEventId(nsIAtom* aName);
  
    /**
 -   * Used only during traversal of the XPCOM graph by the cycle
 -   * collector: push a pointer to the listener manager onto the
 -   * children deque, if it exists. Do nothing if there is no listener
 -   * manager.
 -   *
@@ -22,27 +22,99 @@ diff --git a/content/base/public/nsConte
 -   */
 -  static void TraverseListenerManager(nsINode *aNode,
 -                                      nsCycleCollectionTraversalCallback &cb);
 -
 -  /**
     * Get the eventlistener manager for aNode. If a new eventlistener manager
     * was created, aCreated is set to PR_TRUE.
     *
-@@ -1027,10 +1013,6 @@ public:
-       }
-       return rv;
-     }
--    void traverse(nsCycleCollectionTraversalCallback &cb)
--    {
--      cb.NoteScriptChild(mLangID, mObject);
--    }
-     PRUint32 mLangID;
-     void *mObject;
-   };
+@@ -978,66 +964,6 @@ public:
+    * Unbinds the content from the tree and nulls it out if it's not null.
+    */
+   static void DestroyAnonymousContent(nsCOMPtr<nsIContent>* aContent);
+-
+-  /**
+-   * Keep script object aNewObject, held by aScriptObjectHolder, alive.
+-   *
+-   * NOTE: This currently only supports objects that hold script objects of one
+-   *       scripting language.
+-   *
+-   * @param aLangID script language ID of aNewObject
+-   * @param aScriptObjectHolder the object that holds aNewObject
+-   * @param aTracer the tracer for aScriptObject
+-   * @param aNewObject the script object to hold
+-   * @param aWasHoldingObjects whether aScriptObjectHolder was already holding
+-   *                           script objects (ie. HoldScriptObject was called
+-   *                           on it before, without a corresponding call to
+-   *                           DropScriptObjects)
+-   */
+-  static nsresult HoldScriptObject(PRUint32 aLangID, void* aScriptObjectHolder,
+-                                   nsScriptObjectTracer* aTracer,
+-                                   void* aNewObject, PRBool aWasHoldingObjects)
+-  {
+-    if (aLangID == nsIProgrammingLanguage::JAVASCRIPT) {
+-      return aWasHoldingObjects ? NS_OK :
+-                                  HoldJSObjects(aScriptObjectHolder, aTracer);
+-    }
+-
+-    return HoldScriptObject(aLangID, aNewObject);
+-  }
+-
+-  /**
+-   * Drop any script objects that aScriptObjectHolder is holding.
+-   *
+-   * NOTE: This currently only supports objects that hold script objects of one
+-   *       scripting language.
+-   *
+-   * @param aLangID script language ID of the objects that 
+-   * @param aScriptObjectHolder the object that holds script object that we want
+-   *                            to drop
+-   * @param aTracer the tracer for aScriptObject
+-   */
+-  static nsresult DropScriptObjects(PRUint32 aLangID, void* aScriptObjectHolder,
+-                                    nsScriptObjectTracer* aTracer)
+-  {
+-    if (aLangID == nsIProgrammingLanguage::JAVASCRIPT) {
+-      return DropJSObjects(aScriptObjectHolder);
+-    }
+-
+-    aTracer->Trace(aScriptObjectHolder, DropScriptObject, nsnull);
+-
+-    return NS_OK;
+-  }
+-
+-  /**
+-   * Keep the JS objects held by aScriptObjectHolder alive.
+-   *
+-   * @param aScriptObjectHolder the object that holds JS objects that we want to
+-   *                            keep alive
+-   * @param aTracer the tracer for aScriptObject
+-   */
+-  static nsresult HoldJSObjects(void* aScriptObjectHolder,
+-                                nsScriptObjectTracer* aTracer);
+ 
+   /**
+    * Drop the JS objects held by aScriptObjectHolder.
+@@ -1198,13 +1124,8 @@ private:
+ };
+ 
+ 
+-#define NS_HOLD_JS_OBJECTS(obj, clazz)                                         \
+-  nsContentUtils::HoldJSObjects(NS_CYCLE_COLLECTION_UPCAST(obj, clazz),        \
+-                                &NS_CYCLE_COLLECTION_NAME(clazz))
+-
+-#define NS_DROP_JS_OBJECTS(obj, clazz)                                         \
+-  nsContentUtils::DropJSObjects(NS_CYCLE_COLLECTION_UPCAST(obj, clazz))
+-
++#define NS_HOLD_JS_OBJECTS(obj, clazz) NS_OK
++#define NS_DROP_JS_OBJECTS(obj, clazz) NS_OK
+ 
+ class nsCxPusher
+ {
 diff --git a/content/base/public/nsIContent.h b/content/base/public/nsIContent.h
 --- a/content/base/public/nsIContent.h
 +++ b/content/base/public/nsIContent.h
 @@ -827,38 +827,11 @@ NS_DEFINE_STATIC_IID_ACCESSOR(nsIContent
  
  // Some cycle-collecting helper macros for nsIContent subclasses
  
 -#define NS_IMPL_CYCLE_COLLECTION_TRAVERSE_LISTENERMANAGER \
@@ -84,17 +156,17 @@ diff --git a/content/base/public/nsICont
 +#define NS_IMPL_CYCLE_COLLECTION_UNLINK_LISTENERMANAGER
 +#define NS_IMPL_CYCLE_COLLECTION_UNLINK_PRESERVED_WRAPPER
 +#define NS_IMPL_CYCLE_COLLECTION_UNLINK_USERDATA
  
  #endif /* nsIContent_h___ */
 diff --git a/content/base/src/nsContentUtils.cpp b/content/base/src/nsContentUtils.cpp
 --- a/content/base/src/nsContentUtils.cpp
 +++ b/content/base/src/nsContentUtils.cpp
-@@ -3047,25 +3047,6 @@ nsContentUtils::HasMutationListeners(nsI
+@@ -3059,25 +3059,6 @@ nsContentUtils::HasMutationListeners(nsI
    return PR_FALSE;
  }
  
 -/* static */
 -void
 -nsContentUtils::TraverseListenerManager(nsINode *aNode,
 -                                        nsCycleCollectionTraversalCallback &cb)
 -{
@@ -110,16 +182,51 @@ diff --git a/content/base/src/nsContentU
 -  if (PL_DHASH_ENTRY_IS_BUSY(entry)) {
 -    cb.NoteXPCOMChild(entry->mListenerManager);
 -  }
 -}
 -
  nsresult
  nsContentUtils::GetListenerManager(nsINode *aNode,
                                     PRBool aCreateIfNotFound,
+@@ -3540,34 +3521,6 @@ nsContentUtils::DropScriptObject(PRUint3
+ }
+ 
+ /* static */
+-nsresult
+-nsContentUtils::HoldJSObjects(void* aScriptObjectHolder,
+-                              nsScriptObjectTracer* aTracer)
+-{
+-  PRBool newHolder;
+-  nsresult rv = sXPConnect->AddJSHolder(aScriptObjectHolder, aTracer);
+-  NS_ENSURE_SUCCESS(rv, rv);
+-
+-  ++sJSGCThingRootCount;
+-  NS_LOG_ADDREF(sXPConnect, sJSGCThingRootCount, "HoldJSObjects",
+-                sizeof(void*));
+-
+-  return NS_OK;
+-}
+-
+-/* static */
+-nsresult
+-nsContentUtils::DropJSObjects(void* aScriptObjectHolder)
+-{
+-  NS_LOG_RELEASE(sXPConnect, sJSGCThingRootCount - 1, "HoldJSObjects");
+-  nsresult rv = sXPConnect->RemoveJSHolder(aScriptObjectHolder);
+-  if (--sJSGCThingRootCount == 0 && !sInitialized) {
+-    NS_RELEASE(sXPConnect);
+-  }
+-  return rv;
+-}
+-
+-/* static */
+ PRUint32
+ nsContentUtils::GetKBStateControlStatusFromIMEStatus(PRUint32 aState)
+ {
 diff --git a/content/base/src/nsDOMAttributeMap.cpp b/content/base/src/nsDOMAttributeMap.cpp
 --- a/content/base/src/nsDOMAttributeMap.cpp
 +++ b/content/base/src/nsDOMAttributeMap.cpp
 @@ -82,36 +82,6 @@ nsDOMAttributeMap::~nsDOMAttributeMap()
  {
    mAttributeCache.Enumerate(RemoveMapRef, nsnull);
  }
 -
@@ -165,36 +272,36 @@ diff --git a/content/base/src/nsDOMAttri
 -  void DropReference();
 -
    nsIContent* GetContent()
    {
      return mContent;
 diff --git a/content/base/src/nsDocument.cpp b/content/base/src/nsDocument.cpp
 --- a/content/base/src/nsDocument.cpp
 +++ b/content/base/src/nsDocument.cpp
-@@ -154,7 +154,6 @@ static NS_DEFINE_CID(kDOMEventGroupCID, 
+@@ -155,7 +155,6 @@ static NS_DEFINE_CID(kDOMEventGroupCID, 
  #include "nsLayoutStatics.h"
  #include "nsIJSContextStack.h"
  #include "nsIXPConnect.h"
 -#include "nsCycleCollector.h"
  #include "nsCCUncollectableMarker.h"
  #include "nsIContentPolicy.h"
  
-@@ -792,10 +791,6 @@ nsDocument::~nsDocument()
+@@ -793,10 +792,6 @@ nsDocument::~nsDocument()
    if (gDocumentLeakPRLog)
      PR_LOG(gDocumentLeakPRLog, PR_LOG_DEBUG,
             ("DOCUMENT %p destroyed", this));
 -#endif
 -
 -#ifdef DEBUG
 -  nsCycleCollector_DEBUG_wasFreed(static_cast<nsIDocument*>(this));
  #endif
  
    mInDestructor = PR_TRUE;
-@@ -937,151 +932,6 @@ NS_IMPL_CYCLE_COLLECTING_RELEASE_AMBIGUO
+@@ -938,151 +933,6 @@ NS_IMPL_CYCLE_COLLECTING_RELEASE_AMBIGUO
                                                          nsIDocument,
                                                          nsNodeUtils::LastRelease(this))
  
 -
 -PR_STATIC_CALLBACK(PLDHashOperator)
 -SubDocTraverser(PLDHashTable *table, PLDHashEntryHdr *hdr, PRUint32 number,
 -                void *arg)
 -{
@@ -514,17 +621,17 @@ diff --git a/content/base/src/nsNodeUtil
 -  static void TraverseUserData(nsINode* aNode,
 -                               nsCycleCollectionTraversalCallback &aCb);
  
    /**
     * A basic implementation of the DOM cloneNode method. Calls nsINode::Clone to
 diff --git a/content/base/src/nsObjectLoadingContent.cpp b/content/base/src/nsObjectLoadingContent.cpp
 --- a/content/base/src/nsObjectLoadingContent.cpp
 +++ b/content/base/src/nsObjectLoadingContent.cpp
-@@ -1180,12 +1180,6 @@ nsObjectLoadingContent::RemovedFromDocum
+@@ -1188,12 +1188,6 @@ nsObjectLoadingContent::RemovedFromDocum
    }
  }
  
 -void
 -nsObjectLoadingContent::Traverse(nsCycleCollectionTraversalCallback &cb)
 -{
 -  cb.NoteXPCOMChild(mFrameLoader);
 -}
@@ -619,17 +726,17 @@ diff --git a/content/events/src/nsEventL
 -
 -
  const EventTypeData*
  nsEventListenerManager::GetTypeDataForIID(const nsIID& aIID)
  {
 diff --git a/content/events/src/nsEventStateManager.cpp b/content/events/src/nsEventStateManager.cpp
 --- a/content/events/src/nsEventStateManager.cpp
 +++ b/content/events/src/nsEventStateManager.cpp
-@@ -638,69 +638,6 @@ NS_IMPL_CYCLE_COLLECTING_ADDREF_AMBIGUOU
+@@ -699,69 +699,6 @@ NS_IMPL_CYCLE_COLLECTING_ADDREF_AMBIGUOU
  NS_IMPL_CYCLE_COLLECTING_ADDREF_AMBIGUOUS(nsEventStateManager, nsIEventStateManager)
  NS_IMPL_CYCLE_COLLECTING_RELEASE_AMBIGUOUS(nsEventStateManager, nsIEventStateManager)
  
 -PR_STATIC_CALLBACK(PRBool)
 -TraverseAccessKeyContent(nsHashKey *aKey, void *aData, void* aClosure)
 -{
 -  nsCycleCollectionTraversalCallback *cb =
 -    static_cast<nsCycleCollectionTraversalCallback*>(aClosure);
@@ -718,17 +825,17 @@ diff --git a/content/html/content/src/ns
 -  NS_IMPL_CYCLE_COLLECTION_TRAVERSE_NSCOMPTR_AMBIGUOUS(mControls,
 -                                                       nsIDOMHTMLCollection)
 -  tmp->mSelectedRadioButtons.EnumerateRead(ElementTraverser, &cb);
 -NS_IMPL_CYCLE_COLLECTION_TRAVERSE_END
 -
  NS_IMPL_ADDREF_INHERITED(nsHTMLFormElement, nsGenericElement) 
  NS_IMPL_RELEASE_INHERITED(nsHTMLFormElement, nsGenericElement) 
  
-@@ -1995,23 +1976,7 @@ nsFormControlList::FlushPendingNotificat
+@@ -2073,23 +2054,7 @@ nsFormControlList::FlushPendingNotificat
    }
  }
  
 -PR_STATIC_CALLBACK(PLDHashOperator)
 -ControlTraverser(const nsAString& key, nsISupports* control, void* userArg)
 -{
 -  nsCycleCollectionTraversalCallback *cb = 
 -    static_cast<nsCycleCollectionTraversalCallback*>(userArg);
@@ -773,17 +880,17 @@ diff --git a/content/html/content/src/ns
 -  tmp->Traverse(cb);
 -NS_IMPL_CYCLE_COLLECTION_TRAVERSE_END
  
  NS_IMPL_ADDREF_INHERITED(nsHTMLSharedObjectElement, nsGenericElement) 
  NS_IMPL_RELEASE_INHERITED(nsHTMLSharedObjectElement, nsGenericElement) 
 diff --git a/content/html/document/src/nsHTMLDocument.cpp b/content/html/document/src/nsHTMLDocument.cpp
 --- a/content/html/document/src/nsHTMLDocument.cpp
 +++ b/content/html/document/src/nsHTMLDocument.cpp
-@@ -343,40 +343,6 @@ nsHTMLDocument::~nsHTMLDocument()
+@@ -364,40 +364,6 @@ nsHTMLDocument::~nsHTMLDocument()
  }
  
  NS_IMPL_CYCLE_COLLECTION_CLASS(nsHTMLDocument)
 -
 -PR_STATIC_CALLBACK(PLDHashOperator)
 -IdAndNameMapEntryTraverse(PLDHashTable *table, PLDHashEntryHdr *hdr,
 -                          PRUint32 number, void *arg)
 -{
@@ -904,20 +1011,23 @@ diff --git a/content/xbl/src/nsBindingMa
 -  NS_IMPL_CYCLE_COLLECTION_TRAVERSE_NSTARRAY_MEMBER(mAttachedStack,
 -                                                    nsXBLBinding)
 -  // No need to traverse mProcessAttachedQueueEvent, since it'll just
 -  // fire at some point.
 -NS_IMPL_CYCLE_COLLECTION_TRAVERSE_END
  
  NS_IMPL_CYCLE_COLLECTION_CLASS(nsBindingManager)
  
-@@ -1488,42 +1415,6 @@ nsBindingManager::ParentChainChanged(nsI
- }
- 
- void
+@@ -1493,42 +1420,6 @@ nsBindingManager::ParentChainChanged(nsI
+ nsBindingManager::ParentChainChanged(nsIContent *aContent)
+ {
+   NS_BINDINGMANAGER_NOTIFY_OBSERVERS(ParentChainChanged, (aContent));
+-}
+-
+-void
 -nsBindingManager::Traverse(nsIContent *aContent,
 -                           nsCycleCollectionTraversalCallback &cb)
 -{
 -  if (!aContent->HasFlag(NODE_MAY_BE_IN_BINDING_MNGR)) {
 -    return;
 -  }
 -
 -  nsXBLBinding *binding = GetBinding(aContent);
@@ -941,76 +1051,73 @@ diff --git a/content/xbl/src/nsBindingMa
 -    cb.NoteXPCOMChild(aContent);
 -    cb.NoteXPCOMChild(value);
 -  }
 -  if (mWrapperTable.ops &&
 -      (value = LookupObject(mWrapperTable, aContent))) {
 -    cb.NoteXPCOMChild(aContent);
 -    cb.NoteXPCOMChild(value);
 -  }
--}
--
--void
- nsBindingManager::BeginOutermostUpdate()
- {
-   mProcessOnEndUpdate = (mAttachedStack.Length() == 0);
+ }
+ 
+ void
 diff --git a/content/xbl/src/nsBindingManager.h b/content/xbl/src/nsBindingManager.h
 --- a/content/xbl/src/nsBindingManager.h
 +++ b/content/xbl/src/nsBindingManager.h
 @@ -202,9 +202,6 @@ public:
                       RuleProcessorData* aData,
                       PRBool* aCutOffInheritance);
  
 -  NS_HIDDEN_(void) Traverse(nsIContent *aContent,
 -                            nsCycleCollectionTraversalCallback &cb);
 -
    NS_DECL_CYCLE_COLLECTION_CLASS(nsBindingManager)
  
    // Notify the binding manager when an outermost update begins and
 diff --git a/content/xbl/src/nsXBLBinding.cpp b/content/xbl/src/nsXBLBinding.cpp
 --- a/content/xbl/src/nsXBLBinding.cpp
 +++ b/content/xbl/src/nsXBLBinding.cpp
-@@ -287,19 +287,6 @@ nsXBLBinding::~nsXBLBinding(void)
+@@ -288,33 +288,12 @@ nsXBLBinding::~nsXBLBinding(void)
    NS_RELEASE(info);
  }
  
 -PR_STATIC_CALLBACK(PLDHashOperator)
 -TraverseKey(nsISupports* aKey, nsInsertionPointList* aData, void* aClosure)
 -{
 -  nsCycleCollectionTraversalCallback &cb = 
 -    *static_cast<nsCycleCollectionTraversalCallback*>(aClosure);
 -
 -  cb.NoteXPCOMChild(aKey);
 -  if (aData) {
 -    NS_IMPL_CYCLE_COLLECTION_TRAVERSE_NSTARRAY(*aData, nsXBLInsertionPoint)
 -  }
 -  return PL_DHASH_NEXT;
 -}
 -
- NS_IMPL_CYCLE_COLLECTION_NATIVE_CLASS(nsXBLBinding)
+-NS_IMPL_CYCLE_COLLECTION_CLASS(nsXBLBinding)
  NS_IMPL_CYCLE_COLLECTION_UNLINK_BEGIN_NATIVE(nsXBLBinding)
    // XXX Probably can't unlink mPrototypeBinding->XBLDocumentInfo(), because
-@@ -307,13 +294,6 @@ NS_IMPL_CYCLE_COLLECTION_UNLINK_BEGIN_NA
+   //     mPrototypeBinding is weak.
    NS_IMPL_CYCLE_COLLECTION_UNLINK_NSCOMPTR(mContent)
    // XXX What about mNextBinding and mInsertionPointTable?
  NS_IMPL_CYCLE_COLLECTION_UNLINK_END
 -NS_IMPL_CYCLE_COLLECTION_TRAVERSE_NATIVE_BEGIN(nsXBLBinding)
 -  cb.NoteXPCOMChild(tmp->mPrototypeBinding->XBLDocumentInfo());
 -  NS_IMPL_CYCLE_COLLECTION_TRAVERSE_NSCOMPTR(mContent)
 -  NS_IMPL_CYCLE_COLLECTION_TRAVERSE_NATIVE_MEMBER(mNextBinding, nsXBLBinding)
 -  if (tmp->mInsertionPointTable)
 -    tmp->mInsertionPointTable->EnumerateRead(TraverseKey, &cb);
 -NS_IMPL_CYCLE_COLLECTION_TRAVERSE_END
  NS_IMPL_CYCLE_COLLECTION_ROOT_NATIVE(nsXBLBinding, AddRef)
  NS_IMPL_CYCLE_COLLECTION_UNROOT_NATIVE(nsXBLBinding, Release)
  
 diff --git a/content/xbl/src/nsXBLDocumentInfo.cpp b/content/xbl/src/nsXBLDocumentInfo.cpp
 --- a/content/xbl/src/nsXBLDocumentInfo.cpp
 +++ b/content/xbl/src/nsXBLDocumentInfo.cpp
-@@ -434,40 +434,6 @@ static PRBool IsChromeURI(nsIURI* aURI)
+@@ -434,62 +434,6 @@ static PRBool IsChromeURI(nsIURI* aURI)
  
  /* Implementation file */
  
 -static PRIntn PR_CALLBACK
 -TraverseProtos(nsHashKey *aKey, void *aData, void* aClosure)
 -{
 -  nsCycleCollectionTraversalCallback *cb = 
 -    static_cast<nsCycleCollectionTraversalCallback*>(aClosure);
@@ -1022,55 +1129,77 @@ diff --git a/content/xbl/src/nsXBLDocume
 -static PRIntn PR_CALLBACK
 -UnlinkProtos(nsHashKey *aKey, void *aData, void* aClosure)
 -{
 -  nsXBLPrototypeBinding *proto = static_cast<nsXBLPrototypeBinding*>(aData);
 -  proto->Unlink();
 -  return kHashEnumerateNext;
 -}
 -
+-struct ProtoTracer
+-{
+-  TraceCallback mCallback;
+-  void *mClosure;
+-};
+-
+-static PRIntn PR_CALLBACK
+-TraceProtos(nsHashKey *aKey, void *aData, void* aClosure)
+-{
+-  ProtoTracer* closure = static_cast<ProtoTracer*>(aClosure);
+-  nsXBLPrototypeBinding *proto = static_cast<nsXBLPrototypeBinding*>(aData);
+-  proto->Trace(closure->mCallback, closure->mClosure);
+-  return kHashEnumerateNext;
+-}
+-
 -NS_IMPL_CYCLE_COLLECTION_CLASS(nsXBLDocumentInfo)
 -NS_IMPL_CYCLE_COLLECTION_UNLINK_BEGIN(nsXBLDocumentInfo)
 -  if (tmp->mBindingTable) {
 -    tmp->mBindingTable->Enumerate(UnlinkProtos, nsnull);
 -  }
 -  NS_IMPL_CYCLE_COLLECTION_UNLINK_NSCOMPTR(mDocument)
 -  NS_IMPL_CYCLE_COLLECTION_UNLINK_NSCOMPTR(mGlobalObject)
 -NS_IMPL_CYCLE_COLLECTION_UNLINK_END
 -NS_IMPL_CYCLE_COLLECTION_TRAVERSE_BEGIN(nsXBLDocumentInfo)
 -  NS_IMPL_CYCLE_COLLECTION_TRAVERSE_NSCOMPTR(mDocument)
 -  if (tmp->mBindingTable) {
 -    tmp->mBindingTable->Enumerate(TraverseProtos, &cb);
 -  }
 -  cb.NoteXPCOMChild(static_cast<nsIScriptGlobalObject*>(tmp->mGlobalObject));
+-  NS_IMPL_CYCLE_COLLECTION_TRAVERSE_SCRIPT_OBJECTS
 -NS_IMPL_CYCLE_COLLECTION_TRAVERSE_END
+-NS_IMPL_CYCLE_COLLECTION_TRACE_BEGIN(nsXBLDocumentInfo)
+-  if (tmp->mBindingTable) {
+-    ProtoTracer closure = { aCallback, aClosure };
+-    tmp->mBindingTable->Enumerate(TraceProtos, &closure);
+-  }
+-NS_IMPL_CYCLE_COLLECTION_TRACE_END
 -
  NS_INTERFACE_MAP_BEGIN_CYCLE_COLLECTION(nsXBLDocumentInfo)
    NS_INTERFACE_MAP_ENTRY(nsIXBLDocumentInfo)
    NS_INTERFACE_MAP_ENTRY(nsIScriptGlobalObjectOwner)
 diff --git a/content/xbl/src/nsXBLProtoImpl.cpp b/content/xbl/src/nsXBLProtoImpl.cpp
 --- a/content/xbl/src/nsXBLProtoImpl.cpp
 +++ b/content/xbl/src/nsXBLProtoImpl.cpp
 @@ -199,30 +199,6 @@ nsXBLProtoImpl::CompilePrototypeMembers(
    return NS_OK;
  }
  
 -void
--nsXBLProtoImpl::Traverse(nsCycleCollectionTraversalCallback &cb) const
+-nsXBLProtoImpl::Trace(TraceCallback aCallback, void *aClosure) const
 -{
 -  // If we don't have a class object then we either didn't compile members
 -  // or we only have fields, in both cases there are no cycles through our
 -  // members.
 -  if (!mClassObject) {
 -    return;
 -  }
 -
 -  nsXBLProtoImplMember *member;
 -  for (member = mMembers; member; member = member->GetNext()) {
--    member->Traverse(cb);
+-    member->Trace(aCallback, aClosure);
 -  }
 -}
 -
 -void
 -nsXBLProtoImpl::Unlink()
 -{
 -  if (mClassObject) {
 -    DestroyMembers(nsnull);
@@ -1082,118 +1211,121 @@ diff --git a/content/xbl/src/nsXBLProtoI
  {
 diff --git a/content/xbl/src/nsXBLProtoImpl.h b/content/xbl/src/nsXBLProtoImpl.h
 --- a/content/xbl/src/nsXBLProtoImpl.h
 +++ b/content/xbl/src/nsXBLProtoImpl.h
 @@ -90,9 +90,6 @@ public:
      mFields = aFieldList;
    }
  
--  void Traverse(nsCycleCollectionTraversalCallback &cb) const;
+-  void Trace(TraceCallback aCallback, void *aClosure) const;
 -  void Unlink();
 -
    nsXBLProtoImplField* FindField(const nsString& aFieldName) const;
  
    // Resolve all the fields for this implementation on the object |obj| False
 diff --git a/content/xbl/src/nsXBLProtoImplMember.h b/content/xbl/src/nsXBLProtoImplMember.h
 --- a/content/xbl/src/nsXBLProtoImplMember.h
 +++ b/content/xbl/src/nsXBLProtoImplMember.h
 @@ -114,8 +114,6 @@ public:
                                   const nsCString& aClassStr,
                                   void* aClassObject)=0;
  
--  virtual void Traverse(nsCycleCollectionTraversalCallback &cb) const = 0;
+-  virtual void Trace(TraceCallback aCallback, void *aClosure) const = 0;
 -
  protected:
    friend class nsAutoGCRoot;
    
 diff --git a/content/xbl/src/nsXBLProtoImplMethod.cpp b/content/xbl/src/nsXBLProtoImplMethod.cpp
 --- a/content/xbl/src/nsXBLProtoImplMethod.cpp
 +++ b/content/xbl/src/nsXBLProtoImplMethod.cpp
-@@ -276,14 +276,6 @@ nsXBLProtoImplMethod::CompileMember(nsIS
+@@ -272,16 +272,6 @@ nsXBLProtoImplMethod::CompileMember(nsIS
    return rv;
  }
  
 -void
--nsXBLProtoImplMethod::Traverse(nsCycleCollectionTraversalCallback &cb) const
+-nsXBLProtoImplMethod::Trace(TraceCallback aCallback, void *aClosure) const
 -{
 -  NS_ASSERTION(mIsCompiled, "Shouldn't traverse uncompiled method");
 -
--  cb.NoteScriptChild(nsIProgrammingLanguage::JAVASCRIPT, mJSMethodObject);
+-  if (mJSMethodObject) {
+-    aCallback(nsIProgrammingLanguage::JAVASCRIPT, mJSMethodObject, aClosure);
+-  }
 -}
 -
  nsresult
  nsXBLProtoImplAnonymousMethod::Execute(nsIContent* aBoundElement)
  {
 diff --git a/content/xbl/src/nsXBLProtoImplMethod.h b/content/xbl/src/nsXBLProtoImplMethod.h
 --- a/content/xbl/src/nsXBLProtoImplMethod.h
 +++ b/content/xbl/src/nsXBLProtoImplMethod.h
 @@ -129,8 +129,6 @@ public:
                                   const nsCString& aClassStr,
                                   void* aClassObject);
  
--  virtual void Traverse(nsCycleCollectionTraversalCallback &cb) const;
+-  virtual void Trace(TraceCallback aCallback, void *aClosure) const;
 -
  protected:
    union {
      nsXBLUncompiledMethod* mUncompiledMethod; // An object that represents the method before being compiled.
 diff --git a/content/xbl/src/nsXBLProtoImplProperty.cpp b/content/xbl/src/nsXBLProtoImplProperty.cpp
 --- a/content/xbl/src/nsXBLProtoImplProperty.cpp
 +++ b/content/xbl/src/nsXBLProtoImplProperty.cpp
-@@ -343,17 +343,3 @@ nsXBLProtoImplProperty::CompileMember(ns
+@@ -337,17 +337,3 @@ nsXBLProtoImplProperty::CompileMember(ns
    
    return rv;
  }
 -
 -void
--nsXBLProtoImplProperty::Traverse(nsCycleCollectionTraversalCallback &cb) const
+-nsXBLProtoImplProperty::Trace(TraceCallback aCallback, void *aClosure) const
 -{
 -  NS_ASSERTION(mIsCompiled, "Shouldn't traverse uncompiled method");
 -
--  if (mJSAttributes & JSPROP_GETTER) {
--    cb.NoteScriptChild(nsIProgrammingLanguage::JAVASCRIPT, mJSGetterObject);
+-  if ((mJSAttributes & JSPROP_GETTER) && mJSGetterObject) {
+-    aCallback(nsIProgrammingLanguage::JAVASCRIPT, mJSGetterObject, aClosure);
 -  }
 -
--  if (mJSAttributes & JSPROP_SETTER) {
--    cb.NoteScriptChild(nsIProgrammingLanguage::JAVASCRIPT, mJSSetterObject);
+-  if ((mJSAttributes & JSPROP_SETTER) && mJSSetterObject) {
+-    aCallback(nsIProgrammingLanguage::JAVASCRIPT, mJSSetterObject, aClosure);
 -  }
 -}
 diff --git a/content/xbl/src/nsXBLProtoImplProperty.h b/content/xbl/src/nsXBLProtoImplProperty.h
 --- a/content/xbl/src/nsXBLProtoImplProperty.h
 +++ b/content/xbl/src/nsXBLProtoImplProperty.h
 @@ -72,8 +72,6 @@ public:
                                   const nsCString& aClassStr,
                                   void* aClassObject);
  
--  virtual void Traverse(nsCycleCollectionTraversalCallback &cb) const;
+-  virtual void Trace(TraceCallback aCallback, void *aClosure) const;
 -
  protected:
    union {
      // The raw text for the getter (prior to compilation).
 diff --git a/content/xbl/src/nsXBLPrototypeBinding.cpp b/content/xbl/src/nsXBLPrototypeBinding.cpp
 --- a/content/xbl/src/nsXBLPrototypeBinding.cpp
 +++ b/content/xbl/src/nsXBLPrototypeBinding.cpp
-@@ -245,16 +245,6 @@ nsFixedSizeAllocator* nsXBLInsertionPoin
+@@ -244,17 +244,6 @@ PRUint32 nsXBLInsertionPointEntry::gRefC
+ PRUint32 nsXBLInsertionPointEntry::gRefCnt = 0;
  nsFixedSizeAllocator* nsXBLInsertionPointEntry::kPool;
  
- NS_IMPL_CYCLE_COLLECTION_NATIVE_CLASS(nsXBLInsertionPointEntry)
+-NS_IMPL_CYCLE_COLLECTION_CLASS(nsXBLInsertionPointEntry)
 -NS_IMPL_CYCLE_COLLECTION_UNLINK_BEGIN_NATIVE(nsXBLInsertionPointEntry)
 -  NS_IMPL_CYCLE_COLLECTION_UNLINK_NSCOMPTR(mInsertionParent)
 -  if (tmp->mDefaultContent) {
 -    // mDefaultContent is a sort of anonymous content within the XBL
 -    // document, and we own and manage it.  Unhook it here, since we're going
 -    // away.
 -    tmp->mDefaultContent->UnbindFromTree();
 -    tmp->mDefaultContent = nsnull;
 -  }      
 -NS_IMPL_CYCLE_COLLECTION_UNLINK_END
  NS_IMPL_CYCLE_COLLECTION_TRAVERSE_NATIVE_BEGIN(nsXBLInsertionPointEntry)
    NS_IMPL_CYCLE_COLLECTION_TRAVERSE_NSCOMPTR(mInsertionParent)
    NS_IMPL_CYCLE_COLLECTION_TRAVERSE_NSCOMPTR(mDefaultContent)
-@@ -328,48 +318,6 @@ nsXBLPrototypeBinding::Init(const nsACSt
+@@ -328,53 +317,6 @@ nsXBLPrototypeBinding::Init(const nsACSt
  
    SetBindingElement(aElement);
    return NS_OK;
 -}
 -
 -PR_STATIC_CALLBACK(PRIntn)
 -TraverseInsertionPoint(nsHashKey* aKey, void* aData, void* aClosure)
 -{
@@ -1214,76 +1346,71 @@ diff --git a/content/xbl/src/nsXBLProtot
 -  cb->NoteXPCOMChild(static_cast<nsISupports*>(aData));
 -  return kHashEnumerateNext;
 -}
 -
 -void
 -nsXBLPrototypeBinding::Traverse(nsCycleCollectionTraversalCallback &cb) const
 -{
 -  cb.NoteXPCOMChild(mBinding);
--  if (mImplementation)
--    mImplementation->Traverse(cb);
 -  if (mResources)
 -    cb.NoteXPCOMChild(mResources->mLoader);
 -  if (mInsertionPointTable)
 -    mInsertionPointTable->Enumerate(TraverseInsertionPoint, &cb);
 -  if (mInterfaceTable)
 -    mInterfaceTable->Enumerate(TraverseBinding, &cb);
 -}
 -
 -void
 -nsXBLPrototypeBinding::Unlink()
 -{
 -  if (mImplementation)
 -    mImplementation->Unlink();
+-}
+-
+-void
+-nsXBLPrototypeBinding::Trace(TraceCallback aCallback, void *aClosure) const
+-{
+-  if (mImplementation)
+-    mImplementation->Trace(aCallback, aClosure);
  }
  
  void
 diff --git a/content/xbl/src/nsXBLPrototypeBinding.h b/content/xbl/src/nsXBLPrototypeBinding.h
 --- a/content/xbl/src/nsXBLPrototypeBinding.h
 +++ b/content/xbl/src/nsXBLPrototypeBinding.h
-@@ -188,7 +188,6 @@ public:
+@@ -196,10 +196,6 @@ public:
+                 nsIXBLDocumentInfo* aInfo,
                  nsIContent* aElement);
  
-   void Traverse(nsCycleCollectionTraversalCallback &cb) const;
+-  void Traverse(nsCycleCollectionTraversalCallback &cb) const;
 -  void Unlink();
- 
+-  void Trace(TraceCallback aCallback, void *aClosure) const;
+-
  // Static members
    static PRUint32 gRefCnt;
+  
 diff --git a/content/xslt/src/xpath/nsXPathResult.cpp b/content/xslt/src/xpath/nsXPathResult.cpp
 --- a/content/xslt/src/xpath/nsXPathResult.cpp
 +++ b/content/xslt/src/xpath/nsXPathResult.cpp
-@@ -60,31 +60,6 @@ nsXPathResult::~nsXPathResult()
+@@ -76,18 +76,6 @@ nsXPathResult::~nsXPathResult()
  {
      RemoveObserver();
  }
 -
 -NS_IMPL_CYCLE_COLLECTION_CLASS(nsXPathResult)
 -NS_IMPL_CYCLE_COLLECTION_UNLINK_BEGIN(nsXPathResult)
 -    {
 -        tmp->RemoveObserver();
 -    }
 -    NS_IMPL_CYCLE_COLLECTION_UNLINK_NSCOMPTR(mDocument)
 -NS_IMPL_CYCLE_COLLECTION_UNLINK_END
 -NS_IMPL_CYCLE_COLLECTION_TRAVERSE_BEGIN(nsXPathResult)
 -    NS_IMPL_CYCLE_COLLECTION_TRAVERSE_NSCOMPTR(mDocument)
--    {
--        txAExprResult *result = tmp->mResult.get();
--        if (result && result->getResultType() == txAExprResult::NODESET) {
--            txNodeSet *nodeSet = static_cast<txNodeSet*>(result);
--            nsCOMPtr<nsIDOMNode> node;
--            PRInt32 count = nodeSet->size();
--            PRInt32 i;
--            for (i = 0; i < count; ++i) {
--                txXPathNativeNode::getNode(nodeSet->get(i),
--                                           getter_AddRefs(node));
--                cb.NoteXPCOMChild(node);
--            }
--        }
--    }
+-    NS_IMPL_CYCLE_COLLECTION_TRAVERSE_NSCOMARRAY(mResultNodes)
 -NS_IMPL_CYCLE_COLLECTION_TRAVERSE_END
  
  NS_IMPL_CYCLE_COLLECTING_ADDREF_AMBIGUOUS(nsXPathResult, nsIDOMXPathResult)
  NS_IMPL_CYCLE_COLLECTING_RELEASE_AMBIGUOUS(nsXPathResult, nsIDOMXPathResult)
 diff --git a/content/xul/content/src/nsXULElement.cpp b/content/xul/content/src/nsXULElement.cpp
 --- a/content/xul/content/src/nsXULElement.cpp
 +++ b/content/xul/content/src/nsXULElement.cpp
 @@ -377,11 +377,6 @@ nsXULElement::QueryInterface(REFNSIID aI
@@ -1293,54 +1420,163 @@ diff --git a/content/xul/content/src/nsX
 -    if (aIID.Equals(NS_GET_IID(nsXPCOMCycleCollectionParticipant))) {
 -      *aInstancePtr = &NS_CYCLE_COLLECTION_NAME(nsXULElement);
 -      return NS_OK;
 -    }
 -
      nsresult rv = nsGenericElement::QueryInterface(aIID, aInstancePtr);
      if (NS_SUCCEEDED(rv))
          return rv;
-@@ -652,12 +647,6 @@ nsXULElement::PerformAccesskey(PRBool aK
+@@ -656,12 +651,6 @@ nsXULElement::PerformAccesskey(PRBool aK
  // nsIScriptEventHandlerOwner interface
  
  NS_IMPL_CYCLE_COLLECTION_CLASS(nsScriptEventHandlerOwnerTearoff)
 -NS_IMPL_CYCLE_COLLECTION_UNLINK_BEGIN(nsScriptEventHandlerOwnerTearoff)
 -  tmp->mElement = nsnull;
 -NS_IMPL_CYCLE_COLLECTION_UNLINK_END
 -NS_IMPL_CYCLE_COLLECTION_TRAVERSE_BEGIN(nsScriptEventHandlerOwnerTearoff)
 -  cb.NoteXPCOMChild(static_cast<nsIContent*>(tmp->mElement));
 -NS_IMPL_CYCLE_COLLECTION_TRAVERSE_END
  
  NS_INTERFACE_MAP_BEGIN_CYCLE_COLLECTION(nsScriptEventHandlerOwnerTearoff)
    NS_INTERFACE_MAP_ENTRY(nsIScriptEventHandlerOwner)
-@@ -2353,24 +2342,6 @@ nsXULElement::RecompileScriptEventListen
- 
- NS_IMPL_CYCLE_COLLECTION_NATIVE_CLASS(nsXULPrototypeNode)
- NS_IMPL_CYCLE_COLLECTION_UNLINK_NATIVE_0(nsXULPrototypeNode)
+@@ -761,15 +750,6 @@ nsScriptEventHandlerOwnerTearoff::Compil
+         // take a copy of the event handler, and tell the language about it.
+         if (aHandler) {
+             NS_ASSERTION(!attr->mEventHandler, "Leaking handler.");
+-
+-            rv = nsContentUtils::HoldScriptObject(aContext->GetScriptTypeID(),
+-                                                  elem,
+-                                                  &NS_CYCLE_COLLECTION_NAME(nsXULPrototypeNode),
+-                                                  aHandler,
+-                                                  elem->mHoldsScriptObject);
+-            if (NS_FAILED(rv)) return rv;
+-
+-            elem->mHoldsScriptObject = PR_TRUE;
+         }
+         attr->mEventHandler = (void *)aHandler;
+     }
+@@ -2403,47 +2383,6 @@ nsXULElement::RecompileScriptEventListen
+     }
+ }
+ 
+-NS_IMPL_CYCLE_COLLECTION_CLASS(nsXULPrototypeNode)
+-NS_IMPL_CYCLE_COLLECTION_UNLINK_BEGIN_NATIVE(nsXULPrototypeNode)
+-    if (tmp->mType == nsXULPrototypeNode::eType_Element) {
+-        static_cast<nsXULPrototypeElement*>(tmp)->Unlink();
+-    }
+-    else if (tmp->mType == nsXULPrototypeNode::eType_Script) {
+-        static_cast<nsXULPrototypeScript*>(tmp)->Unlink();
+-    }
+-NS_IMPL_CYCLE_COLLECTION_UNLINK_END
 -NS_IMPL_CYCLE_COLLECTION_TRAVERSE_NATIVE_BEGIN(nsXULPrototypeNode)
 -    if (tmp->mType == nsXULPrototypeNode::eType_Element) {
 -        nsXULPrototypeElement *elem =
 -            static_cast<nsXULPrototypeElement*>(tmp);
 -        PRUint32 i;
--        for (i = 0; i < elem->mNumAttributes; ++i) {
--            cb.NoteScriptChild(elem->mScriptTypeID,
--                               elem->mAttributes[i].mEventHandler);
--        }
 -        for (i = 0; i < elem->mNumChildren; ++i) {
 -            NS_IMPL_CYCLE_COLLECTION_TRAVERSE_NATIVE_PTR(elem->mChildren[i],
 -                                                         nsXULPrototypeNode)
 -        }
 -    }
+-    NS_IMPL_CYCLE_COLLECTION_TRAVERSE_SCRIPT_OBJECTS
+-NS_IMPL_CYCLE_COLLECTION_TRAVERSE_END
+-NS_IMPL_CYCLE_COLLECTION_TRACE_NATIVE_BEGIN(nsXULPrototypeNode)
+-    if (tmp->mType == nsXULPrototypeNode::eType_Element) {
+-        nsXULPrototypeElement *elem =
+-            static_cast<nsXULPrototypeElement*>(tmp);
+-        if (elem->mHoldsScriptObject) {
+-            PRUint32 i;
+-            for (i = 0; i < elem->mNumAttributes; ++i) {
+-                void *handler = elem->mAttributes[i].mEventHandler;
+-                NS_IMPL_CYCLE_COLLECTION_TRACE_CALLBACK(elem->mScriptTypeID,
+-                                                        handler)
+-            }
+-        }
+-    }
 -    else if (tmp->mType == nsXULPrototypeNode::eType_Script) {
--        static_cast<nsXULPrototypeScript*>(tmp)->mScriptObject.traverse(cb);
--    }
--NS_IMPL_CYCLE_COLLECTION_TRAVERSE_END
+-        nsXULPrototypeScript *script =
+-            static_cast<nsXULPrototypeScript*>(tmp);
+-        NS_IMPL_CYCLE_COLLECTION_TRACE_CALLBACK(script->mScriptObject.mLangID,
+-                                                script->mScriptObject.mObject)
+-    }
+-NS_IMPL_CYCLE_COLLECTION_TRACE_END
  NS_IMPL_CYCLE_COLLECTION_ROOT_NATIVE(nsXULPrototypeNode, AddRef)
  NS_IMPL_CYCLE_COLLECTION_UNROOT_NATIVE(nsXULPrototypeNode, Release)
  
+@@ -2744,11 +2683,6 @@ void
+ void
+ nsXULPrototypeElement::Unlink()
+ {
+-    if (mHoldsScriptObject) {
+-        nsContentUtils::DropScriptObjects(mScriptTypeID, this,
+-                                          &NS_CYCLE_COLLECTION_NAME(nsXULPrototypeNode));
+-        mHoldsScriptObject = PR_FALSE;
+-    }
+     mNumAttributes = 0;
+     delete[] mAttributes;
+     mAttributes = nsnull;
+@@ -2776,7 +2710,6 @@ nsXULPrototypeScript::nsXULPrototypeScri
+ 
+ nsXULPrototypeScript::~nsXULPrototypeScript()
+ {
+-    Unlink();
+ }
+ 
+ nsresult
+diff --git a/content/xul/content/src/nsXULElement.h b/content/xul/content/src/nsXULElement.h
+--- a/content/xul/content/src/nsXULElement.h
++++ b/content/xul/content/src/nsXULElement.h
+@@ -246,7 +246,6 @@ public:
+           mHasIdAttribute(PR_FALSE),
+           mHasClassAttribute(PR_FALSE),
+           mHasStyleAttribute(PR_FALSE),
+-          mHoldsScriptObject(PR_FALSE),
+           mScriptTypeID(nsIProgrammingLanguage::UNKNOWN)
+     {
+         NS_LOG_ADDREF(this, 1, ClassName(), ClassSize());
+@@ -302,7 +301,6 @@ public:
+     PRPackedBool             mHasIdAttribute:1;
+     PRPackedBool             mHasClassAttribute:1;
+     PRPackedBool             mHasStyleAttribute:1;
+-    PRPackedBool             mHoldsScriptObject:1;
+ 
+     // The language ID can not be set on a per-node basis, but is tracked
+     // so that the language ID from the originating root can be used
+@@ -359,15 +357,6 @@ public:
+                      nsIDocument* aDocument,
+                      nsIScriptGlobalObjectOwner* aGlobalOwner);
+ 
+-    void Unlink()
+-    {
+-        if (mScriptObject.mObject) {
+-            nsContentUtils::DropScriptObjects(mScriptObject.mLangID, this,
+-                                              &NS_CYCLE_COLLECTION_NAME(nsXULPrototypeNode));
+-            mScriptObject.mObject = nsnull;
+-        }
+-    }
+-
+     void Set(nsScriptObjectHolder &aHolder)
+     {
+         NS_ASSERTION(mScriptObject.mLangID == aHolder.getScriptTypeID(),
+@@ -380,13 +369,7 @@ public:
+     {
+         NS_ASSERTION(!mScriptObject.mObject, "Leaking script object.");
+ 
+-        nsresult rv = nsContentUtils::HoldScriptObject(mScriptObject.mLangID,
+-                                                       this,
+-                                                       &NS_CYCLE_COLLECTION_NAME(nsXULPrototypeNode),
+-                                                       aObject, PR_FALSE);
+-        if (NS_SUCCEEDED(rv)) {
+-            mScriptObject.mObject = aObject;
+-        }
++        mScriptObject.mObject = aObject;
+     }
+ 
+     struct ScriptObjectHolder
 diff --git a/content/xul/document/src/nsXULCommandDispatcher.cpp b/content/xul/document/src/nsXULCommandDispatcher.cpp
 --- a/content/xul/document/src/nsXULCommandDispatcher.cpp
 +++ b/content/xul/document/src/nsXULCommandDispatcher.cpp
 @@ -105,19 +105,6 @@ NS_IMPL_CYCLE_COLLECTING_ADDREF(nsXULCom
  NS_IMPL_CYCLE_COLLECTING_ADDREF(nsXULCommandDispatcher)
  NS_IMPL_CYCLE_COLLECTING_RELEASE(nsXULCommandDispatcher)
  
 -NS_IMPL_CYCLE_COLLECTION_UNLINK_BEGIN(nsXULCommandDispatcher)
@@ -1838,145 +2074,148 @@ diff --git a/dom/src/base/nsGlobalWindow
 -    nsCycleCollector_DEBUG_shouldBeFreed(static_cast<nsIScriptGlobalObject*>(this));
 -#endif
      mContext = nsnull; // we nuked it above also
    }
  
 diff --git a/dom/src/base/nsJSEnvironment.cpp b/dom/src/base/nsJSEnvironment.cpp
 --- a/dom/src/base/nsJSEnvironment.cpp
 +++ b/dom/src/base/nsJSEnvironment.cpp
-@@ -80,7 +80,6 @@
+@@ -79,7 +79,6 @@
  #include "jscntxt.h"
  #include "nsEventDispatcher.h"
  #include "nsIContent.h"
 -#include "nsCycleCollector.h"
  #include "nsNetUtil.h"
  
  // For locale aware string methods
-@@ -991,9 +990,6 @@ nsJSContext::nsJSContext(JSRuntime *aRun
+@@ -168,7 +167,6 @@ static PRUint32 sCCollectCount;
+ static PRUint32 sCCollectCount;
+ static PRBool sUserIsActive;
+ static PRTime sPreviousCCTime;
+-static PRBool sPreviousCCDidCollect;
+ static nsITimer *sGCTimer;
+ static PRBool sReadyForGC;
+ 
+@@ -1108,9 +1106,6 @@ nsJSContext::nsJSContext(JSRuntime *aRun
  
  nsJSContext::~nsJSContext()
  {
 -#ifdef DEBUG
 -  nsCycleCollector_DEBUG_wasFreed(static_cast<nsIScriptContext*>(this));
 -#endif
    NS_PRECONDITION(!mTerminations, "Shouldn't have termination funcs by now");
-                   
-   // Cope with JS_NewContext failure in ctor (XXXbe move NewContext to Init?)
-@@ -1038,35 +1034,7 @@ nsJSContext::~nsJSContext()
-   }
+ 
+   Unlink();
+@@ -1162,16 +1157,6 @@ nsJSContext::Unlink()
  }
  
--struct ContextCallbackItem : public JSTracer
--{
--  nsCycleCollectionTraversalCallback *cb;
--};
--
--void
--NoteContextChild(JSTracer *trc, void *thing, uint32 kind)
--{
--  if (kind == JSTRACE_OBJECT || kind == JSTRACE_NAMESPACE ||
--      kind == JSTRACE_QNAME || kind == JSTRACE_XML) {
--    ContextCallbackItem *item = static_cast<ContextCallbackItem*>(trc);
--    item->cb->NoteScriptChild(JAVASCRIPT, thing);
--  }
--}
--
  // QueryInterface implementation for nsJSContext
 -NS_IMPL_CYCLE_COLLECTION_CLASS(nsJSContext)
--// XXX Should we call ClearScope here?
--NS_IMPL_CYCLE_COLLECTION_UNLINK_0(nsJSContext)
+-NS_IMPL_CYCLE_COLLECTION_UNLINK_BEGIN(nsJSContext)
+-  NS_IMPL_CYCLE_COLLECTION_UNLINK_NSCOMPTR(mGlobalWrapperRef)
+-  tmp->Unlink();
+-  tmp->mIsInitialized = PR_FALSE;
+-NS_IMPL_CYCLE_COLLECTION_UNLINK_END
 -NS_IMPL_CYCLE_COLLECTION_TRAVERSE_BEGIN(nsJSContext)
 -  NS_IMPL_CYCLE_COLLECTION_TRAVERSE_NSCOMPTR(mGlobalWrapperRef)
--  {
--    ContextCallbackItem trc;
--    trc.cb = &cb;
--
--    JS_TRACER_INIT(&trc, tmp->mContext, NoteContextChild);
--    js_TraceContext(&trc, tmp->mContext);
--  }
+-  nsContentUtils::XPConnect()->NoteJSContext(tmp->mContext, cb);
 -NS_IMPL_CYCLE_COLLECTION_TRAVERSE_END
  
  NS_INTERFACE_MAP_BEGIN_CYCLE_COLLECTION(nsJSContext)
    NS_INTERFACE_MAP_ENTRY(nsIScriptContext)
-@@ -3200,9 +3168,7 @@ nsJSContext::Notify(nsITimer *timer)
-     // loading and move on as if they weren't.
-     sPendingLoadCount = 0;
- 
--    // nsCycleCollector_collect() will run a ::JS_GC() indirectly,
--    // so we do not explicitly call ::JS_GC() here. 
--    nsCycleCollector_collect();
-+    ::JS_GC(mContext);
-   } else {
-     FireGCTimer(PR_TRUE);
+@@ -3276,17 +3261,17 @@ nsJSContext::CC()
+   sPreviousCCTime = PR_Now();
+   sDelayedCCollectCount = 0;
+   ++sCCollectCount;
+-#ifdef DEBUG_smaug
+-  printf("Will run cycle collector (%i)\n", sCCollectCount);
+-#endif
+-  // nsCycleCollector_collect() will run a ::JS_GC() indirectly, so
+-  // we do not explicitly call ::JS_GC() here.
+-  sPreviousCCDidCollect = nsCycleCollector_collect();
+-#ifdef DEBUG_smaug
+-  printf("(1) %s\n", sPreviousCCDidCollect ?
+-                     "Cycle collector did collect nodes" :
+-                     "Cycle collector did not collect nodes");
+-#endif
++
++  nsIXPConnect* xpconnect = do_GetService("@mozilla.org/js/xpc/XPConnect;1");
++  if (xpconnect) {
++    nsIXPCNativeCallContext* context = nsnull;
++    xpconnect->GetCurrentNativeCallContext(&context);
++    if (context) {
++      JSContext *cx = nsnull;
++      context->GetJSContext(&cx);
++      ::JS_GC(cx);
++    }
++  }
+ }
+ 
+ //static
+@@ -3296,7 +3281,7 @@ nsJSContext::MaybeCC(PRBool aHigherProba
+   ++sDelayedCCollectCount;
+   // Increase the probability also if the previous call to cycle collector
+   // collected something.
+-  if (aHigherProbability || sPreviousCCDidCollect) {
++  if (aHigherProbability) {
+     sDelayedCCollectCount *= NS_PROBABILITY_MULTIPLIER;
    }
-@@ -3235,9 +3201,9 @@ nsJSContext::LoadEnd()
-     NS_RELEASE(sGCTimer);
-     sLoadInProgressGCTimer = PR_FALSE;
- 
--    // nsCycleCollector_collect() will run a ::JS_GC() indirectly, so
--    // we do not explicitly call ::JS_GC() here.
--    nsCycleCollector_collect();
-+    // XXXbsmedberg: I'm just going to punt on this because I can't figure
-+    // out how to get mContext from here and this should be going away anyway
-+    // ::JS_GC(mContext);
-   }
- }
- 
-@@ -3264,9 +3230,7 @@ nsJSContext::FireGCTimer(PRBool aLoadInP
-     // timer.
-     sLoadInProgressGCTimer = PR_FALSE;
- 
--    // nsCycleCollector_collect() will run a ::JS_GC() indirectly, so
--    // we do not explicitly call ::JS_GC() here.
--    nsCycleCollector_collect();
-+    ::JS_GC(mContext);
- 
-     return;
-   }
-@@ -3654,21 +3618,6 @@ nsJSArgArray::ReleaseJSObjects()
+ 
+@@ -3515,7 +3500,6 @@ nsJSRuntime::Startup()
+   sCCollectCount = 0;
+   sUserIsActive = PR_FALSE;
+   sPreviousCCTime = 0;
+-  sPreviousCCDidCollect = PR_FALSE;
+   sGCTimer = nsnull;
+   sReadyForGC = PR_FALSE;
+   sLoadInProgressGCTimer = PR_FALSE;
+@@ -3821,24 +3805,6 @@ nsJSArgArray::ReleaseJSObjects()
  
  // QueryInterface implementation for nsJSArgArray
  NS_IMPL_CYCLE_COLLECTION_CLASS(nsJSArgArray)
 -NS_IMPL_CYCLE_COLLECTION_UNLINK_BEGIN(nsJSArgArray)
 -  tmp->ReleaseJSObjects();
 -NS_IMPL_CYCLE_COLLECTION_UNLINK_END
 -NS_IMPL_CYCLE_COLLECTION_TRAVERSE_BEGIN(nsJSArgArray)
--  {
--    jsval *argv = tmp->mArgv;
--    if (argv) {
--      jsval *end;
--      for (end = argv + tmp->mArgc; argv < end; ++argv) {
--        if (JSVAL_IS_OBJECT(*argv))
--          cb.NoteScriptChild(JAVASCRIPT, JSVAL_TO_OBJECT(*argv));
--      }
+-  NS_IMPL_CYCLE_COLLECTION_TRAVERSE_SCRIPT_OBJECTS
+-NS_IMPL_CYCLE_COLLECTION_TRAVERSE_END
+-
+-NS_IMPL_CYCLE_COLLECTION_TRACE_BEGIN(nsJSArgArray)
+-  jsval *argv = tmp->mArgv;
+-  if (argv) {
+-    jsval *end;
+-    for (end = argv + tmp->mArgc; argv < end; ++argv) {
+-      if (JSVAL_IS_GCTHING(*argv))
+-        NS_IMPL_CYCLE_COLLECTION_TRACE_CALLBACK(JAVASCRIPT,
+-                                                JSVAL_TO_GCTHING(*argv))
 -    }
 -  }
--NS_IMPL_CYCLE_COLLECTION_TRAVERSE_END
+-NS_IMPL_CYCLE_COLLECTION_TRACE_END
  
  NS_INTERFACE_MAP_BEGIN_CYCLE_COLLECTION(nsJSArgArray)
    NS_INTERFACE_MAP_ENTRY(nsIArray)
 diff --git a/dom/src/base/nsJSTimeoutHandler.cpp b/dom/src/base/nsJSTimeoutHandler.cpp
 --- a/dom/src/base/nsJSTimeoutHandler.cpp
 +++ b/dom/src/base/nsJSTimeoutHandler.cpp
 @@ -112,14 +112,6 @@ private:
  // nsJSScriptTimeoutHandler
  // QueryInterface implementation for nsJSScriptTimeoutHandler
  NS_IMPL_CYCLE_COLLECTION_CLASS(nsJSScriptTimeoutHandler)
 -NS_IMPL_CYCLE_COLLECTION_UNLINK_BEGIN(nsJSScriptTimeoutHandler)
 -  tmp->ReleaseJSObjects();
 -NS_IMPL_CYCLE_COLLECTION_UNLINK_END
 -NS_IMPL_CYCLE_COLLECTION_TRAVERSE_BEGIN(nsJSScriptTimeoutHandler)
 -  NS_IMPL_CYCLE_COLLECTION_TRAVERSE_NSCOMPTR(mContext)
 -  NS_IMPL_CYCLE_COLLECTION_TRAVERSE_NSCOMPTR(mArgv)
--  cb.NoteScriptChild(nsIProgrammingLanguage::JAVASCRIPT, tmp->mFunObj);
+-  NS_IMPL_CYCLE_COLLECTION_TRAVERSE_SCRIPT_OBJECTS
 -NS_IMPL_CYCLE_COLLECTION_TRAVERSE_END
  
- NS_INTERFACE_MAP_BEGIN_CYCLE_COLLECTION(nsJSScriptTimeoutHandler)
-   NS_INTERFACE_MAP_ENTRY(nsIScriptTimeoutHandler)
+ NS_IMPL_CYCLE_COLLECTION_TRACE_BEGIN(nsJSScriptTimeoutHandler)
+   NS_IMPL_CYCLE_COLLECTION_TRACE_JS_MEMBER_CALLBACK(mExpr)
 diff --git a/dom/src/base/nsWindowRoot.cpp b/dom/src/base/nsWindowRoot.cpp
 --- a/dom/src/base/nsWindowRoot.cpp
 +++ b/dom/src/base/nsWindowRoot.cpp
 @@ -67,10 +67,10 @@ nsWindowRoot::nsWindowRoot(nsIDOMWindow*
    nsFocusController::Create(getter_AddRefs(mFocusController));
  
    nsCOMPtr<nsIDOMFocusListener> focusListener(do_QueryInterface(mFocusController));
 -  mRefCnt.incr(static_cast<nsIDOMEventTarget*>(this));
@@ -1986,30 +2225,40 @@ diff --git a/dom/src/base/nsWindowRoot.c
 -  mRefCnt.decr(static_cast<nsIDOMEventTarget*>(this));
 +  --mRefCnt;
  }
  
  nsWindowRoot::~nsWindowRoot()
 diff --git a/dom/src/events/nsJSEventListener.cpp b/dom/src/events/nsJSEventListener.cpp
 --- a/dom/src/events/nsJSEventListener.cpp
 +++ b/dom/src/events/nsJSEventListener.cpp
-@@ -89,16 +89,6 @@ nsJSEventListener::~nsJSEventListener()
-   mContext->DropScriptObject(mScopeObject);
+@@ -90,26 +90,6 @@ nsJSEventListener::~nsJSEventListener()
+     NS_DROP_JS_OBJECTS(this, nsJSEventListener);
  }
  
 -NS_IMPL_CYCLE_COLLECTION_CLASS(nsJSEventListener)
 -NS_IMPL_CYCLE_COLLECTION_UNLINK_BEGIN(nsJSEventListener)
 -  NS_IMPL_CYCLE_COLLECTION_UNLINK_NSCOMPTR(mTarget)
+-  if (tmp->mContext) {
+-    tmp->mScopeObject = nsnull;
+-    NS_DROP_JS_OBJECTS(tmp, nsJSEventListener);
+-    NS_IMPL_CYCLE_COLLECTION_UNLINK_NSCOMPTR(mContext)
+-  }
 -NS_IMPL_CYCLE_COLLECTION_UNLINK_END
 -NS_IMPL_CYCLE_COLLECTION_TRAVERSE_BEGIN(nsJSEventListener)
 -  NS_IMPL_CYCLE_COLLECTION_TRAVERSE_NSCOMPTR(mTarget)
 -  NS_IMPL_CYCLE_COLLECTION_TRAVERSE_NSCOMPTR(mContext)
--  cb.NoteScriptChild(nsIProgrammingLanguage::JAVASCRIPT, tmp->mScopeObject);
+-  NS_IMPL_CYCLE_COLLECTION_TRAVERSE_SCRIPT_OBJECTS
 -NS_IMPL_CYCLE_COLLECTION_TRAVERSE_END
 -
+-NS_IMPL_CYCLE_COLLECTION_TRACE_BEGIN(nsJSEventListener)
+-  NS_IMPL_CYCLE_COLLECTION_TRACE_MEMBER_CALLBACK(tmp->mContext->GetScriptTypeID(),
+-                                                 mScopeObject)
+-NS_IMPL_CYCLE_COLLECTION_TRACE_END
+-
  NS_INTERFACE_MAP_BEGIN_CYCLE_COLLECTION(nsJSEventListener)
    NS_INTERFACE_MAP_ENTRY(nsIDOMEventListener)
    NS_INTERFACE_MAP_ENTRY(nsIJSEventListener)
 diff --git a/dom/src/storage/nsDOMStorage.cpp b/dom/src/storage/nsDOMStorage.cpp
 --- a/dom/src/storage/nsDOMStorage.cpp
 +++ b/dom/src/storage/nsDOMStorage.cpp
 @@ -256,29 +256,6 @@ nsDOMStorageEntry::~nsDOMStorageEntry()
  {
@@ -2089,267 +2338,420 @@ diff --git a/embedding/components/comman
 -NS_IMPL_CYCLE_COLLECTION_UNLINK_END
 -NS_IMPL_CYCLE_COLLECTION_TRAVERSE_BEGIN(nsCommandManager)
 -  tmp->mObserversTable.EnumerateRead(TraverseCommandObservers, &cb);
 -NS_IMPL_CYCLE_COLLECTION_TRAVERSE_END
 -
  NS_IMPL_CYCLE_COLLECTING_ADDREF_AMBIGUOUS(nsCommandManager, nsICommandManager)
  NS_IMPL_CYCLE_COLLECTING_RELEASE_AMBIGUOUS(nsCommandManager, nsICommandManager)
  
+diff --git a/js/src/xpconnect/idl/nsIXPConnect.idl b/js/src/xpconnect/idl/nsIXPConnect.idl
+--- a/js/src/xpconnect/idl/nsIXPConnect.idl
++++ b/js/src/xpconnect/idl/nsIXPConnect.idl
+@@ -729,26 +729,4 @@ interface nsIXPConnect : nsISupports
+     [noscript] JSVal getCrossOriginWrapperForObject(in JSContextPtr aJSContext,
+                                                     in JSObjectPtr aParent,
+                                                     in JSObjectPtr aWrappedObj);
+-
+-    /**
+-     * Root JS objects held by aHolder.
+-     * @param aHolder The object that hold the JS objects that should be rooted.
+-     * @param aTrace The tracer for aHolder.
+-     */
+-    [noscript] void addJSHolder(in voidPtr aHolder,
+-                                in nsScriptObjectTracerPtr aTracer);
+-
+-    /**
+-     * Stop rooting the JS objects held by aHolder.
+-     * @param aHolder The object that hold the rooted JS objects.
+-     */
+-    [noscript] void removeJSHolder(in voidPtr aHolder);
+-
+-    /**
+-     * Note aJSContext as a child to the cycle collector.
+-     * @param aJSContext The JSContext to note.
+-     * @param aCb The cycle collection traversal callback.
+-     */
+-    [noscript,notxpcom] void noteJSContext(in JSContextPtr aJSContext,
+-                                           in nsCCTraversalCallbackRef aCb);
+ };
 diff --git a/js/src/xpconnect/src/nsXPConnect.cpp b/js/src/xpconnect/src/nsXPConnect.cpp
 --- a/js/src/xpconnect/src/nsXPConnect.cpp
 +++ b/js/src/xpconnect/src/nsXPConnect.cpp
-@@ -77,16 +77,13 @@ nsXPConnect::nsXPConnect()
+@@ -76,20 +76,13 @@ nsXPConnect::nsXPConnect()
+         mContextStack(nsnull),
          mDefaultSecurityManager(nsnull),
          mDefaultSecurityManagerFlags(0),
-         mShuttingDown(JS_FALSE),
--        mObjRefcounts(nsnull),
--        mCycleCollectionContext(nsnull)
-+        mObjRefcounts(nsnull)
+-        mShuttingDown(JS_FALSE),
+-        mCycleCollectionContext(nsnull),
+-        mCycleCollecting(PR_FALSE)
++        mShuttingDown(JS_FALSE)
  {
      // Ignore the result. If the runtime service is not ready to rumble
      // then we'll set this up later as needed.
      CreateRuntime();
  
      CallGetService(XPC_CONTEXT_STACK_CONTRACTID, &mContextStack);
 -
 -    nsCycleCollector_registerRuntime(nsIProgrammingLanguage::JAVASCRIPT, this);
+-#ifdef DEBUG_CC
+-    mJSRoots.ops = nsnull;
+-#endif
  
  #ifdef XPC_TOOLS_SUPPORT
    {
-@@ -221,15 +218,6 @@ struct JSObjectRefcounts
+@@ -120,10 +113,6 @@ nsXPConnect::nsXPConnect()
  
  nsXPConnect::~nsXPConnect()
  {
 -    NS_ASSERTION(!mCycleCollectionContext,
 -                 "Didn't call FinishCycleCollection?");
 -    nsCycleCollector_forgetRuntime(nsIProgrammingLanguage::JAVASCRIPT);
--    if (mObjRefcounts)
--    {
--        delete mObjRefcounts;
--        mObjRefcounts = NULL;
--    }
 -
      JSContext *cx = nsnull;
      if (mRuntime) {
          // Create our own JSContext rather than an XPCCallContext, since
-@@ -513,364 +501,6 @@ nsXPConnect::GetInfoForName(const char *
+@@ -407,576 +396,6 @@ nsXPConnect::GetInfoForName(const char *
      return FindInfo(NameTester, name, mInterfaceInfoManager, info);
  }
  
 -static JSGCCallback gOldJSGCCallback;
+-// Number of collections that have collected nodes.
+-static PRUint32 gCollections;
+-// Whether to run cycle collection during GC.
+-static PRBool gCollect;
 -
 -JS_STATIC_DLL_CALLBACK(JSBool)
--XPCCycleGCCallback(JSContext *cx, JSGCStatus status)
--{
--    // Chain to old GCCallback first, we want to get all the mark notifications
--    // before recording the end of the mark phase.
--    JSBool ok = gOldJSGCCallback ? gOldJSGCCallback(cx, status) : JS_TRUE;
--
--    // Record the end of a mark phase. If we get more mark notifications then
--    // the GC has restarted and we'll need to clear the refcounts first.
+-XPCCycleCollectGCCallback(JSContext *cx, JSGCStatus status)
+-{
+-    // Launch the cycle collector.
 -    if(status == JSGC_MARK_END)
--        nsXPConnect::GetXPConnect()->GetJSObjectRefcounts()->MarkEnd();
+-    {
+-        // This is the hook between marking and sweeping in the JS GC. Do cycle
+-        // collection.
+-        if(gCollect && nsCycleCollector_doCollect())
+-            ++gCollections;
+-        else
+-            // If cycle collection didn't collect anything we should stop
+-            // collecting until the next call to nsXPConnect::Collect, even if
+-            // there are more (nested) JS_GC calls.
+-            gCollect = PR_FALSE;
+-
+-        // Mark JS objects that are held by XPCOM objects that are in cycles
+-        // that will not be collected.
+-        nsXPConnect::GetRuntime()->
+-            TraceXPConnectRoots(cx->runtime->gcMarkingTracer);
+-    }
+-    else if(status == JSGC_END)
+-        nsXPConnect::GetRuntime()->RestoreContextGlobals();
+-
+-    PRBool ok = gOldJSGCCallback ? gOldJSGCCallback(cx, status) : JS_TRUE;
+-
+-    if(status == JSGC_BEGIN)
+-        nsXPConnect::GetRuntime()->UnsetContextGlobals();
 -
 -    return ok;
 -}
 -
--void XPCMarkNotification(void *thing, uint8 flags, void *closure)
--{
--    // XXX This can't deal with JS atoms yet, but probably should.
--    uint8 ty = flags & GCF_TYPEMASK;
--    if(ty != GCX_OBJECT &&
--       ty != GCX_NAMESPACE && 
--       ty != GCX_QNAME &&
--       ty != GCX_XML)
--        return;
--
--    JSObjectRefcounts* jsr = static_cast<JSObjectRefcounts*>(closure);
--    // We're marking after a mark phase ended, so the GC restarted itself and
--    // we want to clear the refcounts first.
--    if(jsr->mMarkEnded)
--        jsr->MarkStart();
--    jsr->Ref(thing);
--}
+-PRUint32
+-nsXPConnect::Collect()
+-{
+-    // We're dividing JS objects into 2 categories:
+-    //
+-    // 1. "real" roots, held by the JS engine itself or rooted through the root
+-    //    and lock JS APIs. Roots from this category are considered black in the
+-    //    cycle collector, any cycle they participate in is uncollectable.
+-    //
+-    // 2. roots held by C++ objects that participate in cycle collection,
+-    //    held by XPConnect (see XPCJSRuntime::TraceXPConnectRoots). Roots from
+-    //    this category are considered grey in the cycle collector, their final
+-    //    color depends on the objects that hold them. It is thus very important
+-    //    to always traverse the objects that hold these objects during cycle
+-    //    collection (see XPCJSRuntime::AddXPConnectRoots).
+-    //
+-    // Note that if a root is in both categories it is the fact that it is in
+-    // category 1 that takes precedence, so it will be considered black.
+-    //
+-    //
+-    // We split up garbage collection into 3 phases (1, 3 and 4) and do cycle
+-    // collection between the first 2 phases of garbage collection:
+-    //
+-    // 1. marking of the roots in category 1 by having the JS GC do its marking
+-    // 2. cycle collection
+-    // 3. marking of the roots in category 2 by
+-    //    XPCJSRuntime::TraceXPConnectRoots 
+-    // 4. sweeping of unmarked JS objects
+-    //
+-    // During cycle collection, marked JS objects (and the objects they hold)
+-    // will be colored black. White objects holding roots from category 2 will
+-    // be forgotten by XPConnect (in the unlink callback of the white objects).
+-    // During phase 3 we'll only mark black objects holding JS objects (white
+-    // objects were forgotten) and white JS objects will be swept during
+-    // phase 4.
+-    // Because splitting up the JS GC itself is hard, we're going to use a GC
+-    // callback to do phase 2 and 3 after phase 1 has ended (see
+-    // XPCCycleCollectGCCallback).
+-    //
+-    // If DEBUG_CC is not defined the cycle collector will not traverse  roots
+-    // from category 1 or any JS objects held by them. Any JS objects they hold
+-    // will already be marked by the JS GC and will thus be colored black
+-    // themselves. Any C++ objects they hold will have a missing (untraversed)
+-    // edge from the JS object to the C++ object and so it will be marked black
+-    // too. This decreases the number of objects that the cycle collector has to
+-    // deal with.
+-    // To improve debugging, if DEBUG_CC is defined all JS objects are
+-    // traversed.
+-
+-    XPCCallContext cycleCollectionContext(NATIVE_CALLER);
+-    if(!cycleCollectionContext.IsValid())
+-    {
+-        return PR_FALSE;
+-    }
+-
+-    mCycleCollecting = PR_TRUE;
+-    mCycleCollectionContext = &cycleCollectionContext;
+-    gCollections = 0;
+-    gCollect = PR_TRUE;
+-
+-    JSContext *cx = mCycleCollectionContext->GetJSContext();
+-    gOldJSGCCallback = JS_SetGCCallback(cx, XPCCycleCollectGCCallback);
+-    JS_GC(cx);
+-    JS_SetGCCallback(cx, gOldJSGCCallback);
+-    gOldJSGCCallback = nsnull;
+-
+-    mCycleCollectionContext = nsnull;
+-    mCycleCollecting = PR_FALSE;
+-
+-    return gCollections;
+-}
+-
+-// JSTRACE_FUNCTION can hold on to a lot of objects, adding it to the cycle
+-// collector reduces the number of edges to those objects.
+-// JSTRACE_XML can recursively hold on to more JSTRACE_XML objects, adding it to
+-// the cycle collector avoids stack overflow.
+-#define ADD_TO_CC(_kind) \
+-    ((_kind) == JSTRACE_OBJECT || (_kind) == JSTRACE_FUNCTION || \
+-     (_kind) == JSTRACE_XML)
+-
+-#ifdef DEBUG_CC
+-struct NoteJSRootTracer : public JSTracer
+-{
+-    NoteJSRootTracer(PLDHashTable *aObjects,
+-                     nsCycleCollectionTraversalCallback& cb)
+-      : mObjects(aObjects),
+-        mCb(cb)
+-    {
+-    }
+-    PLDHashTable* mObjects;
+-    nsCycleCollectionTraversalCallback& mCb;
+-};
+-
+-JS_STATIC_DLL_CALLBACK(void)
+-NoteJSRoot(JSTracer *trc, void *thing, uint32 kind)
+-{
+-    if(ADD_TO_CC(kind))
+-    {
+-        NoteJSRootTracer *tracer = static_cast<NoteJSRootTracer*>(trc);
+-        PLDHashEntryHdr *entry = PL_DHashTableOperate(tracer->mObjects, thing,
+-                                                      PL_DHASH_ADD);
+-        if(entry && !reinterpret_cast<PLDHashEntryStub*>(entry)->key)
+-        {
+-            reinterpret_cast<PLDHashEntryStub*>(entry)->key = thing;
+-            tracer->mCb.NoteRoot(nsIProgrammingLanguage::JAVASCRIPT, thing,
+-                                 nsXPConnect::GetXPConnect());
+-        }
+-    }
+-    else if(kind != JSTRACE_DOUBLE && kind != JSTRACE_STRING)
+-    {
+-        JS_TraceChildren(trc, thing, kind);
+-    }
+-}
+-#endif
 -
 -nsresult 
--nsXPConnect::BeginCycleCollection()
--{
--    if (!mObjRefcounts)
--        mObjRefcounts = new JSObjectRefcounts;
--
--    mObjRefcounts->MarkStart();
--
--    NS_ASSERTION(!mCycleCollectionContext,
--                 "Didn't call FinishCycleCollection?");
--    mCycleCollectionContext = new XPCCallContext(NATIVE_CALLER);
--    if(!mCycleCollectionContext || !mCycleCollectionContext->IsValid())
+-nsXPConnect::BeginCycleCollection(nsCycleCollectionTraversalCallback &cb)
+-{
+-#ifdef DEBUG_CC
+-    NS_ASSERTION(!mJSRoots.ops, "Didn't call FinishCollection?");
+-
+-    if(!mCycleCollectionContext)
 -    {
--        delete mCycleCollectionContext;
--        mCycleCollectionContext = nsnull;
--        return NS_ERROR_FAILURE;
--    }
--
--    JSContext *cx = mCycleCollectionContext->GetJSContext();
--    gOldJSGCCallback = JS_SetGCCallback(cx, XPCCycleGCCallback);
--    JS_SetGCThingCallback(cx, XPCMarkNotification, mObjRefcounts);
--    JS_GC(cx);
--    JS_SetGCThingCallback(cx, nsnull, nsnull);
--    JS_SetGCCallback(cx, gOldJSGCCallback);
--    gOldJSGCCallback = nsnull;
--
--    XPCWrappedNativeScope::SuspectAllWrappers(mRuntime);
+-        // Being called from nsCycleCollector::ExplainLiveExpectedGarbage.
+-        mExplainCycleCollectionContext = new XPCCallContext(NATIVE_CALLER);
+-        if(!mExplainCycleCollectionContext ||
+-           !mExplainCycleCollectionContext->IsValid())
+-        {
+-            mExplainCycleCollectionContext = nsnull;
+-            return PR_FALSE;
+-        }
+-
+-        mCycleCollectionContext = mExplainCycleCollectionContext;
+-
+-        // Record all objects held by the JS runtime. This avoids doing a
+-        // complete GC if we're just tracing to explain (from
+-        // ExplainLiveExpectedGarbage), which makes the results of cycle
+-        // collection identical for DEBUG_CC and non-DEBUG_CC builds.
+-        if(!PL_DHashTableInit(&mJSRoots, PL_DHashGetStubOps(), nsnull,
+-                              sizeof(PLDHashEntryStub), PL_DHASH_MIN_SIZE)) {
+-            mJSRoots.ops = nsnull;
+-
+-            return NS_ERROR_OUT_OF_MEMORY;
+-        }
+-
+-        PRBool alreadyCollecting = mCycleCollecting;
+-        mCycleCollecting = PR_TRUE;
+-        NoteJSRootTracer trc(&mJSRoots, cb);
+-        JS_TRACER_INIT(&trc, mCycleCollectionContext->GetJSContext(),
+-                       NoteJSRoot);
+-        JS_TraceRuntime(&trc);
+-        mCycleCollecting = alreadyCollecting;
+-    }
+-#else
+-    NS_ASSERTION(mCycleCollectionContext,
+-                 "Didn't call nsXPConnect::Collect()?");
+-#endif
+-
+-    GetRuntime()->AddXPConnectRoots(mCycleCollectionContext->GetJSContext(),
+-                                    cb);
 -
 -#ifndef XPCONNECT_STANDALONE
--    NS_ASSERTION(mObjRefcounts->mScopes.Count() == 0, "Didn't clear mScopes?");
+-    if(!mScopes.IsInitialized())
+-    {
+-        mScopes.Init();
+-    }
+-    NS_ASSERTION(mScopes.Count() == 0, "Didn't clear mScopes?");
 -    XPCWrappedNativeScope::TraverseScopes(*mCycleCollectionContext);
 -#endif
 -
 -    return NS_OK;
 -}
 -
 -#ifndef XPCONNECT_STANDALONE
 -void
 -nsXPConnect::RecordTraversal(void *p, nsISupports *s)
 -{
--    mObjRefcounts->mScopes.Put(p, s);
+-    mScopes.Put(p, s);
 -}
 -#endif
 -
 -nsresult 
 -nsXPConnect::FinishCycleCollection()
 -{
--    delete mCycleCollectionContext;
--    mCycleCollectionContext = nsnull;
--    if (mObjRefcounts)
--        mObjRefcounts->Finish();
+-#ifdef DEBUG_CC
+-    if(mExplainCycleCollectionContext)
+-    {
+-        mCycleCollectionContext = nsnull;
+-        mExplainCycleCollectionContext = nsnull;
+-    }
+-#endif
+-
+-#ifndef XPCONNECT_STANDALONE
+-    mScopes.Clear();
+-#endif
+-
+-#ifdef DEBUG_CC
+-    if(mJSRoots.ops)
+-    {
+-        PL_DHashTableFinish(&mJSRoots);
+-        mJSRoots.ops = nsnull;
+-    }
+-#endif
+-
 -    return NS_OK;
 -}
 -
 -nsCycleCollectionParticipant *
 -nsXPConnect::ToParticipant(void *p)
 -{
--    // Put this assertion here so it fires when we still have a stack
--    // showing where the bad pointer came from.
--    NS_ASSERTION(mObjRefcounts->Get(p) > 0,
--                 "JS object but unknown to the JS GC?");
--
 -    return this;
 -}
 -
 -NS_IMETHODIMP
 -nsXPConnect::Root(void *p)
 -{
--    if(!mCycleCollectionContext || !JS_LockGCThing(*mCycleCollectionContext, p))
--        return NS_ERROR_FAILURE;
 -    return NS_OK;
 -}
 -
 -#ifdef DEBUG_CC
 -void
 -nsXPConnect::PrintAllReferencesTo(void *p)
 -{
 -#ifdef DEBUG
 -    if(!mCycleCollectionContext) {
 -        NS_NOTREACHED("no context");
 -        return;
 -    }
 -    JS_DumpHeap(*mCycleCollectionContext, stdout, nsnull, 0, p,
 -                0x7fffffff, nsnull);
 -#endif
 -}
--
--JS_STATIC_DLL_CALLBACK(JSDHashOperator)
--SuspectWrappedJS(JSDHashTable *table, JSDHashEntryHdr *hdr,
--                 uint32 number, void *arg)
--{
--    for (nsXPCWrappedJS* wrapper = ((JSObject2WrappedJSMap::Entry*)hdr)->value;
--         wrapper; wrapper = wrapper->GetNextWrapper())
--        if (wrapper->IsValid() && !wrapper->IsSubjectToFinalization())
--            nsCycleCollector_suspectCurrent(
--                NS_CYCLE_COLLECTION_CLASSNAME(nsXPCWrappedJS)::Upcast(wrapper));
--    return JS_DHASH_NEXT;
--}
--
--void
--nsXPConnect::SuspectExtraPointers()
--{
--    // FIXME: We should really just call suspectCurrent on all the roots
--    // in the runtime, or even all the objects in the runtime, except we
--    // can't call suspectCurrent on JS objects.
--    GetRuntime(this)->GetWrappedJSMap()->Enumerate(SuspectWrappedJS, nsnull);
--}
 -#endif
 -
 -NS_IMETHODIMP
 -nsXPConnect::Unlink(void *p)
 -{
--    if(!mCycleCollectionContext)
--        return NS_ERROR_FAILURE;
--    uint8 ty = *js_GetGCThingFlags(p) & GCF_TYPEMASK;
--    if(ty == GCX_OBJECT)
--        JS_ClearScope(*mCycleCollectionContext, static_cast<JSObject*>(p));
 -    return NS_OK;
 -}
 -
 -NS_IMETHODIMP
 -nsXPConnect::Unroot(void *p)
 -{
--    if(!mCycleCollectionContext ||
--       !JS_UnlockGCThing(*mCycleCollectionContext, p))
--        return NS_ERROR_FAILURE;
 -    return NS_OK;
 -}
 -
--struct ContextCallbackItem : public JSTracer
--{
--    nsCycleCollectionTraversalCallback *cb;
--};
--
--void
--NoteJSChild(JSTracer *trc, void *thing, uint32 kind)
--{
--    if(kind == JSTRACE_OBJECT || kind == JSTRACE_NAMESPACE ||
--       kind == JSTRACE_QNAME || kind == JSTRACE_XML)
+-struct TraversalTracer : public JSTracer
+-{
+-    TraversalTracer(nsCycleCollectionTraversalCallback &aCb) : cb(aCb)
 -    {
--        ContextCallbackItem *item = static_cast<ContextCallbackItem*>(trc);
--        item->cb->NoteScriptChild(nsIProgrammingLanguage::JAVASCRIPT, thing);
--    }
--}
--
--static uint8 GCTypeToTraceKindMap[GCX_NTYPES] = {
--    JSTRACE_OBJECT,     /* GCX_OBJECT */
--    JSTRACE_STRING,     /* GCX_STRING (unused) */
--    JSTRACE_DOUBLE,     /* GCX_DOUBLE (unused) */
--    JSTRACE_STRING,     /* GCX_MUTABLE_STRING (unused) */
--    JSTRACE_FUNCTION,   /* GCX_FUNCTION (unused) */
--    JSTRACE_NAMESPACE,  /* GCX_NAMESPACE */
--    JSTRACE_QNAME,      /* GCX_QNAME */
--    JSTRACE_XML         /* GCX_XML */
--    // We don't care about JSTRACE_STRING, so stop here
+-    }
+-    nsCycleCollectionTraversalCallback &cb;
 -};
 -
+-JS_STATIC_DLL_CALLBACK(void)
+-NoteJSChild(JSTracer *trc, void *thing, uint32 kind)
+-{
+-    if(ADD_TO_CC(kind))
+-    {
+-        TraversalTracer *tracer = static_cast<TraversalTracer*>(trc);
+-        tracer->cb.NoteScriptChild(nsIProgrammingLanguage::JAVASCRIPT, thing);
+-    }
+-    else if(kind != JSTRACE_DOUBLE && kind != JSTRACE_STRING)
+-    {
+-        JS_TraceChildren(trc, thing, kind);
+-    }
+-}
+-
 -NS_IMETHODIMP
 -nsXPConnect::Traverse(void *p, nsCycleCollectionTraversalCallback &cb)
 -{
 -    if(!mCycleCollectionContext)
 -        return NS_ERROR_FAILURE;
 -
 -    JSContext *cx = mCycleCollectionContext->GetJSContext();
 -
--    PRUint32 refcount = mObjRefcounts->Get(p);
--    NS_ASSERTION(refcount > 0, "JS object but unknown to the JS GC?");
--
--    uint8 ty = *js_GetGCThingFlags(p) & GCF_TYPEMASK;
--    if(ty != GCX_OBJECT && ty != GCX_NAMESPACE && ty != GCX_QNAME &&
--       ty != GCX_XML)
--        return NS_OK;
+-    uint32 traceKind = js_GetGCThingTraceKind(p);
+-    NS_ASSERTION(traceKind != JSTRACE_NAMESPACE &&
+-                 traceKind != JSTRACE_QNAME,
+-                 "Somebody holds one of these objects directly?");
+-
+-    CCNodeType type;
 -
 -#ifdef DEBUG_CC
--    if(ty == GCX_OBJECT)
+-    if(mJSRoots.ops)
+-    {
+-        PLDHashEntryHdr* entry =
+-            PL_DHashTableOperate(&mJSRoots, p, PL_DHASH_LOOKUP);
+-        type = PL_DHASH_ENTRY_IS_BUSY(entry) ? GCMarked : GCUnmarked;
+-    }
+-    else
+-    {
+-        type = JS_IsAboutToBeFinalized(cx, p) ? GCUnmarked : GCMarked;
+-    }
+-
+-    if(traceKind == JSTRACE_OBJECT)
 -    {
 -        JSObject *obj = static_cast<JSObject*>(p);
 -        JSClass *clazz = OBJ_GET_CLASS(cx, obj);
 -        char name[72];
 -        if(XPCNativeWrapper::IsNativeWrapperClass(clazz))
 -        {
 -            XPCWrappedNative* wn = XPCNativeWrapper::GetWrappedNative(cx, obj);
 -            if(wn)
@@ -2417,49 +2819,63 @@ diff --git a/js/src/xpconnect/src/nsXPCo
 -                else
 -                {
 -                    JS_snprintf(name, sizeof(name), "JS Object (Script)");
 -                }
 -            }
 -            else if(clazz == &js_FunctionClass)
 -            {
 -                JSFunction* fun = (JSFunction*) JS_GetPrivate(cx, obj);
--                if(fun->atom)
+-                if(fun->atom && ATOM_IS_STRING(fun->atom))
 -                {
+-                    NS_ConvertUTF16toUTF8
+-                        fname(JS_GetStringChars(ATOM_TO_STRING(fun->atom)));
 -                    JS_snprintf(name, sizeof(name), "JS Object (Function - %s)",
--                                js_AtomToPrintableString(cx, fun->atom));
+-                                fname.get());
 -                }
 -                else
 -                {
 -                    JS_snprintf(name, sizeof(name), "JS Object (Function)");
 -                }
 -            }
 -            else
 -            {
 -                JS_snprintf(name, sizeof(name), "JS Object (%s)", clazz->name);
 -            }
 -        }
 -
--        cb.DescribeNode(refcount, sizeof(JSObject), name);
+-        cb.DescribeNode(type, 0, sizeof(JSObject), name);
 -    }
 -    else
 -    {
--        cb.DescribeNode(refcount, sizeof(JSObject), "JS Object");
+-        cb.DescribeNode(type, 0, sizeof(JSObject), "JS Object");
 -    }
 -#else
--    cb.DescribeNode(refcount);
+-    type = JS_IsAboutToBeFinalized(cx, p) ? GCUnmarked : GCMarked;
+-    cb.DescribeNode(type, 0);
 -#endif
 -
--    ContextCallbackItem trc;
--    trc.cb = &cb;
+-    if(!ADD_TO_CC(traceKind))
+-        return NS_OK;
+-
+-#ifndef DEBUG_CC
+-    // There's no need to trace objects that have already been marked by the JS
+-    // GC. Any JS objects hanging from them will already be marked. Only do this
+-    // if DEBUG_CC is not defined, else we do want to know about all JS objects
+-    // to get better graphs and explanations.
+-    if(type == GCMarked)
+-        return NS_OK;
+-#endif
+-
+-    TraversalTracer trc(cb);
 -
 -    JS_TRACER_INIT(&trc, cx, NoteJSChild);
--    JS_TraceChildren(&trc, p, GCTypeToTraceKindMap[ty]);
--
--    if(ty != GCX_OBJECT)
+-    JS_TraceChildren(&trc, p, traceKind);
+-
+-    if(traceKind != JSTRACE_OBJECT)
 -        return NS_OK;
 -    
 -    JSObject *obj = static_cast<JSObject*>(p);
 -    JSClass* clazz = OBJ_GET_CLASS(cx, obj);
 -
 -    if(clazz == &XPC_WN_Tearoff_JSClass)
 -    {
 -        // A tearoff holds a strong reference to its native object
@@ -2479,122 +2895,571 @@ diff --git a/js/src/xpconnect/src/nsXPCo
 -    {
 -        cb.NoteXPCOMChild(static_cast<nsISupports*>(JS_GetPrivate(cx, obj)));
 -    }
 -
 -#ifndef XPCONNECT_STANDALONE
 -    if(clazz->flags & JSCLASS_IS_GLOBAL)
 -    {
 -        nsISupports *principal = nsnull;
--        mObjRefcounts->mScopes.Get(obj, &principal);
+-        mScopes.Get(obj, &principal);
 -        cb.NoteXPCOMChild(principal);
 -    }
 -#endif
 -
 -    return NS_OK;
 -}
 -
+-PRInt32
+-nsXPConnect::GetRequestDepth(JSContext* cx)
+-{
+-    PRInt32 requestDepth = cx->outstandingRequests;
+-    XPCCallContext* context = GetCycleCollectionContext();
+-    if(context && cx == context->GetJSContext())
+-        // Ignore the request from the XPCCallContext we created for cycle
+-        // collection.
+-        --requestDepth;
+-    return requestDepth;
+-}
+-
+-class JSContextParticipant : public nsCycleCollectionParticipant
+-{
+-public:
+-    NS_IMETHOD Root(void *n)
+-    {
+-        return NS_OK;
+-    }
+-    NS_IMETHOD Unlink(void *n)
+-    {
+-        // We must not unlink a JSContext because Root/Unroot don't ensure that
+-        // the pointer is still valid.
+-        return NS_OK;
+-    }
+-    NS_IMETHOD Unroot(void *n)
+-    {
+-        return NS_OK;
+-    }
+-    NS_IMETHODIMP Traverse(void *n, nsCycleCollectionTraversalCallback &cb)
+-    {
+-        JSContext *cx = static_cast<JSContext*>(n);
+-
+-        // Add cx->requestDepth to the refcount, if there are outstanding
+-        // requests the context needs to be kept alive and adding unknown
+-        // edges will ensure that any cycles this context is in won't be
+-        // collected.
+-        PRInt32 refCount = nsXPConnect::GetXPConnect()->GetRequestDepth(cx) + 1;
+-
+-#ifdef DEBUG_CC
+-        cb.DescribeNode(RefCounted, refCount, sizeof(JSContext),
+-                        "JSContext");
+-#else
+-        cb.DescribeNode(RefCounted, refCount);
+-#endif
+-
+-        void* globalObject;
+-        if(cx->globalObject)
+-            globalObject = cx->globalObject;
+-        else
+-            globalObject = nsXPConnect::GetRuntime()->GetUnsetContextGlobal(cx);
+-
+-        cb.NoteScriptChild(nsIProgrammingLanguage::JAVASCRIPT, globalObject);
+-
+-        return NS_OK;
+-    }
+-};
+-
+-static JSContextParticipant JSContext_cycleCollectorGlobal;
+-
+-// static
+-nsCycleCollectionParticipant*
+-nsXPConnect::JSContextParticipant()
+-{
+-    return &JSContext_cycleCollectorGlobal;
+-}
+-
+-NS_IMETHODIMP_(void)
+-nsXPConnect::NoteJSContext(JSContext *aJSContext,
+-                           nsCycleCollectionTraversalCallback &aCb)
+-{
+-    aCb.NoteNativeChild(aJSContext, &JSContext_cycleCollectorGlobal);
+-}
+-
 -
  /***************************************************************************/
  /***************************************************************************/
  // nsIXPConnect interface methods...
+@@ -2201,18 +1620,6 @@ nsXPConnect::OnDispatchedEvent(nsIThread
+     return NS_ERROR_UNEXPECTED;
+ }
+ 
+-NS_IMETHODIMP
+-nsXPConnect::AddJSHolder(void* aHolder, nsScriptObjectTracer* aTracer)
+-{
+-    return mRuntime->AddJSHolder(aHolder, aTracer);
+-}
+-
+-NS_IMETHODIMP
+-nsXPConnect::RemoveJSHolder(void* aHolder)
+-{
+-    return mRuntime->RemoveJSHolder(aHolder);
+-}
+-
+ #ifdef DEBUG
+ /* These are here to be callable from a debugger */
+ JS_BEGIN_EXTERN_C
+diff --git a/js/src/xpconnect/src/xpcjsruntime.cpp b/js/src/xpconnect/src/xpcjsruntime.cpp
+--- a/js/src/xpconnect/src/xpcjsruntime.cpp
++++ b/js/src/xpconnect/src/xpcjsruntime.cpp
+@@ -251,42 +251,6 @@ ContextCallback(JSContext *cx, uintN ope
+            : JS_TRUE;
+ }
+ 
+-struct ObjectHolder : public JSDHashEntryHdr
+-{
+-    void *holder;
+-    nsScriptObjectTracer* tracer;
+-};
+-
+-nsresult
+-XPCJSRuntime::AddJSHolder(void* aHolder, nsScriptObjectTracer* aTracer)
+-{
+-    if(!mJSHolders.ops)
+-        return NS_ERROR_OUT_OF_MEMORY;
+-
+-    ObjectHolder *entry =
+-        reinterpret_cast<ObjectHolder*>(JS_DHashTableOperate(&mJSHolders,
+-                                                             aHolder,
+-                                                             JS_DHASH_ADD));
+-    if(!entry)
+-        return NS_ERROR_OUT_OF_MEMORY;
+-
+-    entry->holder = aHolder;
+-    entry->tracer = aTracer;
+-
+-    return NS_OK;
+-}
+-
+-nsresult
+-XPCJSRuntime::RemoveJSHolder(void* aHolder)
+-{
+-    if(!mJSHolders.ops)
+-        return NS_ERROR_OUT_OF_MEMORY;
+-
+-    JS_DHashTableOperate(&mJSHolders, aHolder, JS_DHASH_REMOVE);
+-
+-    return NS_OK;
+-}
+-
+ // static
+ void XPCJSRuntime::TraceJS(JSTracer* trc, void* data)
+ {
+@@ -318,34 +282,7 @@ void XPCJSRuntime::TraceJS(JSTracer* trc
+     for(XPCRootSetElem *e = self->mObjectHolderRoots; e ; e = e->GetNextRoot())
+         static_cast<XPCJSObjectHolder*>(e)->TraceJS(trc);
+         
+-    if(self->GetXPConnect()->ShouldTraceRoots())
+-    {
+-        // Only trace these if we're not cycle-collecting, the cycle collector
+-        // will do that if we are.
+-        self->TraceXPConnectRoots(trc);
+-    }
+-}
+-
+-PR_STATIC_CALLBACK(void)
+-TraceJSObject(PRUint32 aLangID, void *aScriptThing, void *aClosure)
+-{
+-    if(aLangID == nsIProgrammingLanguage::JAVASCRIPT)
+-    {
+-        JS_CALL_TRACER(static_cast<JSTracer*>(aClosure), aScriptThing,
+-                       js_GetGCThingTraceKind(aScriptThing),
+-                       "JSObjectHolder");
+-    }
+-}
+-
+-JS_STATIC_DLL_CALLBACK(JSDHashOperator)
+-TraceJSHolder(JSDHashTable *table, JSDHashEntryHdr *hdr, uint32 number,
+-              void *arg)
+-{
+-    ObjectHolder* entry = reinterpret_cast<ObjectHolder*>(hdr);
+-
+-    entry->tracer->Trace(entry->holder, TraceJSObject, arg);
+-
+-    return JS_DHASH_NEXT;
++    self->TraceXPConnectRoots(trc);
+ }
+ 
+ struct ClearedGlobalObject : public JSDHashEntryHdr
+@@ -356,24 +293,6 @@ struct ClearedGlobalObject : public JSDH
+ 
+ void XPCJSRuntime::TraceXPConnectRoots(JSTracer *trc)
+ {
+-    if(mClearedGlobalObjects.ops)
+-    {
+-        JSContext *iter = nsnull, *acx;
+-        while((acx = JS_ContextIterator(GetJSRuntime(), &iter)))
+-        {
+-            JSDHashEntryHdr* entry =
+-                JS_DHashTableOperate(&mClearedGlobalObjects, acx,
+-                                     JS_DHASH_LOOKUP);
+-            if(JS_DHASH_ENTRY_IS_BUSY(entry))
+-            {
+-                ClearedGlobalObject* clearedGlobal =
+-                    reinterpret_cast<ClearedGlobalObject*>(entry);
+-                JS_CALL_OBJECT_TRACER(trc, clearedGlobal->mGlobalObject,
+-                                      "global object");
+-            }
+-        }
+-    }
+-
+     XPCWrappedNativeScope::TraceJS(trc, this);
+ 
+     for(XPCRootSetElem *e = mVariantRoots; e ; e = e->GetNextRoot())
+@@ -381,137 +300,6 @@ void XPCJSRuntime::TraceXPConnectRoots(J
+ 
+     for(XPCRootSetElem *e = mWrappedJSRoots; e ; e = e->GetNextRoot())
+         static_cast<nsXPCWrappedJS*>(e)->TraceJS(trc);
+-
+-    if(mJSHolders.ops)
+-        JS_DHashTableEnumerate(&mJSHolders, TraceJSHolder, trc);
+-}
+-
+-JS_STATIC_DLL_CALLBACK(JSDHashOperator)
+-NoteJSHolder(JSDHashTable *table, JSDHashEntryHdr *hdr, uint32 number,
+-             void *arg)
+-{
+-    ObjectHolder* entry = reinterpret_cast<ObjectHolder*>(hdr);
+-
+-    nsCycleCollectionTraversalCallback* cb =
+-        static_cast<nsCycleCollectionTraversalCallback*>(arg);
+-    cb->NoteRoot(nsIProgrammingLanguage::CPLUSPLUS, entry->holder,
+-                 entry->tracer);
+-
+-    return JS_DHASH_NEXT;
+-}
+-
+-
+-void XPCJSRuntime::AddXPConnectRoots(JSContext* cx,
+-                                     nsCycleCollectionTraversalCallback &cb)
+-{
+-    // For all JS objects that are held by native objects but aren't held
+-    // through rooting or locking, we need to add all the native objects that
+-    // hold them so that the JS objects are colored correctly in the cycle
+-    // collector. This includes JSContexts that don't have outstanding requests,
+-    // because their global object wasn't marked by the JS GC. All other JS
+-    // roots were marked by the JS GC and will be colored correctly in the cycle
+-    // collector.
+-
+-    JSContext *iter = nsnull, *acx;
+-    while((acx = JS_ContextIterator(GetJSRuntime(), &iter)))
+-    {
+-#ifndef DEBUG_CC
+-        // Only skip JSContexts with outstanding requests if DEBUG_CC is not
+-        // defined, else we do want to know about all JSContexts to get better
+-        // graphs and explanations.
+-        if(nsXPConnect::GetXPConnect()->GetRequestDepth(acx) != 0)
+-            continue;
+-#endif
+-        cb.NoteRoot(nsIProgrammingLanguage::CPLUSPLUS, acx,
+-                    nsXPConnect::JSContextParticipant());
+-    }
+-
+-    XPCWrappedNativeScope::SuspectAllWrappers(this, cx, cb);
+-
+-    for(XPCRootSetElem *e = mVariantRoots; e ; e = e->GetNextRoot())
+-        cb.NoteXPCOMRoot(static_cast<XPCTraceableVariant*>(e));
+-
+-    for(XPCRootSetElem *e = mWrappedJSRoots; e ; e = e->GetNextRoot())
+-    {
+-        nsIXPConnectWrappedJS *wrappedJS = static_cast<nsXPCWrappedJS*>(e);
+-        cb.NoteXPCOMRoot(wrappedJS);
+-    }
+-
+-    if(mJSHolders.ops)
+-        JS_DHashTableEnumerate(&mJSHolders, NoteJSHolder, &cb);
+-}
+-
+-void XPCJSRuntime::UnsetContextGlobals()
+-{
+-    if(!mClearedGlobalObjects.ops)
+-        return;
+-
+-    RestoreContextGlobals();
+-
+-    JSContext *iter = nsnull, *acx;
+-    while((acx = JS_ContextIterator(GetJSRuntime(), &iter)))
+-    {
+-        if(nsXPConnect::GetXPConnect()->GetRequestDepth(acx) == 0)
+-        {
+-            JS_ClearNewbornRoots(acx);
+-            if(acx->globalObject)
+-            {
+-                JSDHashEntryHdr* entry =
+-                    JS_DHashTableOperate(&mClearedGlobalObjects, acx,
+-                                         JS_DHASH_ADD);
+-                ClearedGlobalObject* clearedGlobal =
+-                    reinterpret_cast<ClearedGlobalObject*>(entry);
+-                if(clearedGlobal)
+-                {
+-                    clearedGlobal->mContext = acx;
+-                    clearedGlobal->mGlobalObject = acx->globalObject;
+-                    acx->globalObject = nsnull;
+-                }
+-            }
+-        }
+-    }
+-}
+-
+-JSDHashOperator
+-RemoveContextGlobal(JSDHashTable *table, JSDHashEntryHdr *hdr, uint32 number,
+-                    void *arg)
+-{
+-  return JS_DHASH_REMOVE;
+-}
+-
+-void XPCJSRuntime::RestoreContextGlobals()
+-{
+-    if(!mClearedGlobalObjects.ops || mClearedGlobalObjects.entryCount == 0)
+-        return;
+-
+-    JSContext *iter = nsnull, *acx;
+-    while((acx = JS_ContextIterator(GetJSRuntime(), &iter)))
+-    {
+-        JSDHashEntryHdr* entry =
+-            JS_DHashTableOperate(&mClearedGlobalObjects, acx, JS_DHASH_LOOKUP);
+-        if(JS_DHASH_ENTRY_IS_BUSY(entry))
+-        {
+-            ClearedGlobalObject* clearedGlobal =
+-                reinterpret_cast<ClearedGlobalObject*>(entry);
+-            acx->globalObject = clearedGlobal->mGlobalObject;
+-        }
+-    }
+-    JS_DHashTableEnumerate(&mClearedGlobalObjects, RemoveContextGlobal, nsnull);
+-}
+-
+-JSObject* XPCJSRuntime::GetUnsetContextGlobal(JSContext* cx)
+-{
+-    if(!mClearedGlobalObjects.ops)
+-        return nsnull;
+-
+-    JSDHashEntryHdr* entry =
+-        JS_DHashTableOperate(&mClearedGlobalObjects, cx, JS_DHASH_LOOKUP);
+-    ClearedGlobalObject* clearedGlobal =
+-        reinterpret_cast<ClearedGlobalObject*>(entry);
+-
+-    return JS_DHASH_ENTRY_IS_BUSY(entry) ?
+-           clearedGlobal->mGlobalObject :
+-           nsnull;
+ }
+ 
+ // static
+@@ -1034,17 +822,6 @@ XPCJSRuntime::~XPCJSRuntime()
+ 
+     gOldJSGCCallback = NULL;
+     gOldJSContextCallback = NULL;
+-
+-    if(mJSHolders.ops)
+-    {
+-        JS_DHashTableFinish(&mJSHolders);
+-        mJSHolders.ops = nsnull;
+-    }
+-    if(mClearedGlobalObjects.ops)
+-    {
+-        JS_DHashTableFinish(&mClearedGlobalObjects);
+-        mClearedGlobalObjects.ops = nsnull;
+-    }
+ }
+ 
+ XPCJSRuntime::XPCJSRuntime(nsXPConnect* aXPConnect,
+@@ -1098,13 +875,6 @@ XPCJSRuntime::XPCJSRuntime(nsXPConnect* 
+         JS_SetExtraGCRoots(mJSRuntime, TraceJS, this);
+     }
+ 
+-    if(!JS_DHashTableInit(&mJSHolders, JS_DHashGetStubOps(), nsnull,
+-                          sizeof(ObjectHolder), 512))
+-        mJSHolders.ops = nsnull;
+-    if(!JS_DHashTableInit(&mClearedGlobalObjects, JS_DHashGetStubOps(), nsnull,
+-                          sizeof(ClearedGlobalObject), JS_DHASH_MIN_SIZE))
+-        mClearedGlobalObjects.ops = nsnull;
+-
+     // Install a JavaScript 'debugger' keyword handler in debug builds only
+ #ifdef DEBUG
+     if(mJSRuntime && !JS_GetGlobalDebugHooks(mJSRuntime)->debuggerHandler)
 diff --git a/js/src/xpconnect/src/xpcprivate.h b/js/src/xpconnect/src/xpcprivate.h
 --- a/js/src/xpconnect/src/xpcprivate.h
 +++ b/js/src/xpconnect/src/xpcprivate.h
 @@ -54,7 +54,6 @@
  #include "nsXPCOM.h"
  #include "nsAutoPtr.h"
  #include "nsCycleCollectionParticipant.h"
 -#include "nsCycleCollector.h"
  #include "nsISupports.h"
  #include "nsIServiceManager.h"
  #include "nsIClassInfoImpl.h"
-@@ -430,7 +429,6 @@ class nsXPConnect : public nsIXPConnect,
+@@ -430,9 +429,7 @@ const PRBool OBJ_IS_NOT_GLOBAL = PR_FALS
+ 
  class nsXPConnect : public nsIXPConnect,
                      public nsIThreadObserver,
-                     public nsSupportsWeakReference,
--                    public nsCycleCollectionLanguageRuntime,
-                     public nsCycleCollectionParticipant
+-                    public nsSupportsWeakReference,
+-                    public nsCycleCollectionJSRuntime,
+-                    public nsCycleCollectionParticipant
++                    public nsSupportsWeakReference
  {
  public:
-@@ -479,27 +477,6 @@ public:
+     // all the interface method declarations...
+@@ -480,44 +477,6 @@ public:
  
      nsresult GetInfoForIID(const nsIID * aIID, nsIInterfaceInfo** info);
      nsresult GetInfoForName(const char * name, nsIInterfaceInfo** info);
 -
 -    // nsCycleCollectionParticipant
 -    NS_IMETHOD Root(void *p);
 -    NS_IMETHOD Unlink(void *p);
 -    NS_IMETHOD Unroot(void *p);
 -    NS_IMETHOD Traverse(void *p,
 -                        nsCycleCollectionTraversalCallback &cb);
 -    
 -    // nsCycleCollectionLanguageRuntime
--    virtual nsresult BeginCycleCollection();
+-    virtual nsresult BeginCycleCollection(nsCycleCollectionTraversalCallback &cb);
 -    virtual nsresult FinishCycleCollection();
 -    virtual nsCycleCollectionParticipant *ToParticipant(void *p);
+-    virtual PRUint32 Collect();
 -#ifdef DEBUG_CC
 -    virtual void PrintAllReferencesTo(void *p);
--    virtual void SuspectExtraPointers();
 -#endif
 -
--    JSObjectRefcounts* GetJSObjectRefcounts() {return mObjRefcounts;}
+-    // We should not trace XPConnect JS roots when tracing the graph for the
+-    // cycle collector. Those should be traced from the XPCOM objects that hold
+-    // them when we know that they won't be collected by the cycle collector.
+-    PRBool ShouldTraceRoots()
+-    {
+-        return !mCycleCollecting;
+-    }
+-
+-    XPCCallContext* GetCycleCollectionContext()
+-    {
+-        return mCycleCollectionContext;
+-    }
+-
+-    PRInt32 GetRequestDepth(JSContext* cx);
+-
+-    // This returns the singleton nsCycleCollectionParticipant for JSContexts.
+-    static nsCycleCollectionParticipant *JSContextParticipant();
+-
 -#ifndef XPCONNECT_STANDALONE
 -    void RecordTraversal(void *p, nsISupports *s);
 -#endif
  
  #ifdef XPC_IDISPATCH_SUPPORT
  public:
-@@ -526,7 +503,6 @@ private:
+@@ -543,12 +502,6 @@ private:
+     nsIXPCSecurityManager*   mDefaultSecurityManager;
      PRUint16                 mDefaultSecurityManagerFlags;
      JSBool                   mShuttingDown;
-     JSObjectRefcounts*       mObjRefcounts;
 -    XPCCallContext*          mCycleCollectionContext;
+-#ifdef DEBUG_CC
+-    nsAutoPtr<XPCCallContext> mExplainCycleCollectionContext;
+-    PLDHashTable             mJSRoots;
+-#endif
+-    PRBool                   mCycleCollecting;
  
  #ifdef XPC_TOOLS_SUPPORT
      nsCOMPtr<nsIXPCToolsProfiler> mProfiler;
-@@ -1189,8 +1165,6 @@ public:
-     void SetGlobal(XPCCallContext& ccx, JSObject* aGlobal);
- 
-     static void InitStatics() { gScopes = nsnull; gDyingScopes = nsnull; }
--
--    void Traverse(nsCycleCollectionTraversalCallback &cb);
- 
- #ifndef XPCONNECT_STANDALONE
-     /**
-@@ -1933,7 +1907,6 @@ public:
-     NS_DECL_CYCLE_COLLECTING_ISUPPORTS
+@@ -702,21 +655,12 @@ public:
+ 
+     static void JS_DLL_CALLBACK TraceJS(JSTracer* trc, void* data);
+     void TraceXPConnectRoots(JSTracer *trc);
+-    void AddXPConnectRoots(JSContext* cx,
+-                           nsCycleCollectionTraversalCallback& cb);
+ 
+     static JSBool JS_DLL_CALLBACK GCCallback(JSContext *cx, JSGCStatus status);
+ 
+     inline void AddVariantRoot(XPCTraceableVariant* variant);
+     inline void AddWrappedJSRoot(nsXPCWrappedJS* wrappedJS);
+     inline void AddObjectHolderRoot(XPCJSObjectHolder* holder);
+-
+-    nsresult AddJSHolder(void* aHolder, nsScriptObjectTracer* aTracer);
+-    nsresult RemoveJSHolder(void* aHolder);
+-
+-    void UnsetContextGlobals();
+-    void RestoreContextGlobals();
+-    JSObject* GetUnsetContextGlobal(JSContext* cx);
+ 
+     void DebugDump(PRInt16 depth);
+ 
+@@ -781,8 +725,6 @@ private:
+     XPCRootSetElem *mVariantRoots;
+     XPCRootSetElem *mWrappedJSRoots;
+     XPCRootSetElem *mObjectHolderRoots;
+-    JSDHashTable mJSHolders;
+-    JSDHashTable mClearedGlobalObjects;
+ };
+ 
+ /***************************************************************************/
+@@ -1187,10 +1129,6 @@ public:
+ 
+     static void
+     TraceJS(JSTracer* trc, XPCJSRuntime* rt);
+-
+-    static void
+-    SuspectAllWrappers(XPCJSRuntime* rt, JSContext* cx,
+-                       nsCycleCollectionTraversalCallback &cb);
+ 
+     static void
+     FinishedMarkPhaseOfGC(JSContext* cx, XPCJSRuntime* rt);
+@@ -1970,8 +1908,6 @@ public:
+     NS_DECL_ISUPPORTS
      NS_DECL_NSIXPCONNECTJSOBJECTHOLDER
      NS_DECL_NSIXPCONNECTWRAPPEDNATIVE
 -    NS_DECL_CYCLE_COLLECTION_CLASS(XPCWrappedNative)
+-    NS_DECL_CYCLE_COLLECTION_UNMARK_PURPLE_STUB(XPCWrappedNative)
  
  #ifndef XPCONNECT_STANDALONE
      virtual nsIPrincipal* GetObjectPrincipal() const;
+@@ -2183,8 +2119,6 @@ public:
+ 
+     JSObject* GetWrapper()              { return mWrapper; }
+     void      SetWrapper(JSObject *obj) { mWrapper = obj; }
+-
+-    void NoteTearoffs(nsCycleCollectionTraversalCallback& cb);
+ 
+     // Make ctor and dtor protected (rather than private) to placate nsCOMPtr.
+ protected:
 diff --git a/js/src/xpconnect/src/xpcvariant.cpp b/js/src/xpconnect/src/xpcvariant.cpp
 --- a/js/src/xpconnect/src/xpcvariant.cpp
 +++ b/js/src/xpconnect/src/xpcvariant.cpp
-@@ -89,14 +89,6 @@ XPCTraceableVariant::PrintTraceName(JSTr