Rebase to newer actionmonkey
authorBenjamin Smedberg <benjamin@smedbergs.us>
Fri, 18 Apr 2008 15:10:39 -0400
changeset 108 33529a5c309fd85dad4adb0f672eaeb6493195ad
parent 107 9905102122bc97034c8f5b2106e9b62d3f00adca
child 109 5c0f47743d922f6366e7a126b28e4b3f2d68b519
push id3
push userbsmedberg@mozilla.com
push dateFri, 18 Apr 2008 19:21:32 +0000
Rebase to newer actionmonkey
gcobject-nodelete.patch
gfx-refcounting
more-template-typedefs
mozAutoDocUpdate
no-attributes-configure-check
nsSlots
profilemigrator-immortal
remove-cyclec.patch
reorder-bases
root-contentutils
root-contentutils2
root-layout-stuff
root-timers
securebrowser-cast
series
shell-loginit
system-metrics-comarray
system-metrics-comarray2
template-hashtable-getters
template-hashtable-getters2
timerthread-array
unbraced-if-fixes.patch
xpconnect-finalizers
--- a/gcobject-nodelete.patch
+++ b/gcobject-nodelete.patch
@@ -1,15 +1,15 @@
 * * *
 * * *
 
 diff --git a/chrome/src/nsChromeRegistry.cpp b/chrome/src/nsChromeRegistry.cpp
 --- a/chrome/src/nsChromeRegistry.cpp
 +++ b/chrome/src/nsChromeRegistry.cpp
-@@ -332,18 +332,6 @@
+@@ -333,18 +333,6 @@ nsChromeRegistry::nsProviderArray::Enume
      ProviderEntry *entry = reinterpret_cast<ProviderEntry*>(mArray[i]);
      a->AppendCString(entry->provider);
    }
 -}
 -
 -void
 -nsChromeRegistry::nsProviderArray::Clear()
 -{
@@ -21,154 +21,154 @@ diff --git a/chrome/src/nsChromeRegistry
 -
 -  mArray.Clear();
  }
  
  nsChromeRegistry::PackageEntry::PackageEntry(const nsACString& aPackage) :
 diff --git a/chrome/src/nsChromeRegistry.h b/chrome/src/nsChromeRegistry.h
 --- a/chrome/src/nsChromeRegistry.h
 +++ b/chrome/src/nsChromeRegistry.h
-@@ -163,7 +163,10 @@
+@@ -165,7 +165,10 @@ public:
      const nsACString& GetSelected(const nsACString& aPreferred, MatchType aType);
      void    SetBase(const nsACString& aProvider, nsIURI* base);
      void    EnumerateToArray(nsCStringArray *a);
 -    void    Clear();
 +    void    Clear()
 +    {
 +      mArray.Clear();
 +    }
  
    private:
      ProviderEntry* GetProvider(const nsACString& aPreferred, MatchType aType);
 diff --git a/content/html/content/src/nsHTMLFormElement.cpp b/content/html/content/src/nsHTMLFormElement.cpp
 --- a/content/html/content/src/nsHTMLFormElement.cpp
 +++ b/content/html/content/src/nsHTMLFormElement.cpp
-@@ -262,7 +262,7 @@
+@@ -264,7 +264,7 @@ protected:
     * @param aFormSubmission the submission object
     * @param aEvent the DOM event that was passed to us for the submit
     */
 -  nsresult BuildSubmission(nsCOMPtr<nsIFormSubmission>& aFormSubmission, 
 +  nsresult BuildSubmission(nsIFormSubmission*& aFormSubmission, 
                             nsEvent* aEvent);
    /**
     * Perform the submission (called by DoSubmit and FlushPendingSubmission)
-@@ -471,7 +471,6 @@
+@@ -473,7 +473,6 @@ NS_NewHTMLFormElement(nsINodeInfo *aNode
    nsresult rv = it->Init();
  
    if (NS_FAILED(rv)) {
 -    delete it;
      return nsnull;
    }
  
-@@ -622,7 +621,7 @@
+@@ -624,7 +623,7 @@ nsHTMLFormElement::Submit()
  {
    // Send the submit event
    nsresult rv = NS_OK;
 -  nsCOMPtr<nsPresContext> presContext = GetPresContext();
 +  nsPresContext* presContext = GetPresContext();
    if (mPendingSubmission) {
      // aha, we have a pending submission that was not flushed
      // (this happens when form.submit() is called twice)
-@@ -686,7 +685,7 @@
+@@ -688,7 +687,7 @@ nsHTMLFormElement::BindToTree(nsIDocumen
                                                   aCompileEventHandlers);
    NS_ENSURE_SUCCESS(rv, rv);
  
 -  nsCOMPtr<nsIHTMLDocument> htmlDoc(do_QueryInterface(aDocument));
 +  nsIHTMLDocument* htmlDoc(do_QueryInterface(aDocument));
    if (htmlDoc) {
      htmlDoc->AddedForm();
    }
-@@ -750,7 +749,7 @@
+@@ -752,7 +751,7 @@ void
  void
  nsHTMLFormElement::UnbindFromTree(PRBool aDeep, PRBool aNullParent)
  {
 -  nsCOMPtr<nsIHTMLDocument> oldDocument = do_QueryInterface(GetCurrentDoc());
 +  nsIHTMLDocument* oldDocument = do_QueryInterface(GetCurrentDoc());
  
    // Mark all of our controls as maybe being orphans
    MarkOrphans(mControls->mElements);
-@@ -893,8 +892,8 @@
+@@ -895,8 +894,8 @@ nsHTMLFormElement::DoReset()
    PRUint32 numElements;
    GetElementCount(&numElements);
    for (PRUint32 elementX = 0; (elementX < numElements); elementX++) {
 -    nsCOMPtr<nsIFormControl> controlNode;
 -    GetElementAt(elementX, getter_AddRefs(controlNode));
 +    nsIFormControl* controlNode = nsnull;
 +    GetElementAt(elementX, &controlNode);
      if (controlNode) {
        controlNode->Reset();
      }
-@@ -924,7 +923,7 @@
+@@ -926,7 +925,7 @@ nsHTMLFormElement::DoSubmit(nsEvent* aEv
    mIsSubmitting = PR_TRUE;
    NS_ASSERTION(!mWebProgress && !mSubmittingRequest, "Web progress / submitting request should not exist here!");
  
 -  nsCOMPtr<nsIFormSubmission> submission;
 +  nsIFormSubmission* submission = nsnull;
     
    //
    // prepare the submission object
-@@ -960,7 +959,7 @@
+@@ -962,7 +961,7 @@ nsHTMLFormElement::DoSubmit(nsEvent* aEv
  }
  
  nsresult
 -nsHTMLFormElement::BuildSubmission(nsCOMPtr<nsIFormSubmission>& aFormSubmission, 
 +nsHTMLFormElement::BuildSubmission(nsIFormSubmission*& aFormSubmission, 
                                     nsEvent* aEvent)
  {
    NS_ASSERTION(!mPendingSubmission, "tried to build two submissions!");
-@@ -978,7 +977,7 @@
+@@ -980,7 +979,7 @@ nsHTMLFormElement::BuildSubmission(nsCOM
    //
    // Get the submission object
    //
 -  rv = GetSubmissionFromForm(this, getter_AddRefs(aFormSubmission));
 +  rv = GetSubmissionFromForm(this, &aFormSubmission);
    NS_ENSURE_SUBMIT_SUCCESS(rv);
  
    //
-@@ -997,8 +996,8 @@
+@@ -999,8 +998,8 @@ nsHTMLFormElement::SubmitSubmission(nsIF
    //
    // Get the action and target
    //
 -  nsCOMPtr<nsIURI> actionURI;
 -  rv = GetActionURL(getter_AddRefs(actionURI));
 +  nsIURI* actionURI = nsnull;
 +  rv = GetActionURL(&actionURI);
    NS_ENSURE_SUBMIT_SUCCESS(rv);
  
    if (!actionURI) {
-@@ -1008,8 +1007,8 @@
+@@ -1010,8 +1009,8 @@ nsHTMLFormElement::SubmitSubmission(nsIF
  
    // If there is no link handler, then we won't actually be able to submit.
    nsIDocument* doc = GetCurrentDoc();
 -  nsCOMPtr<nsISupports> container = doc ? doc->GetContainer() : nsnull;
 -  nsCOMPtr<nsILinkHandler> linkHandler(do_QueryInterface(container));
 +  nsISupports* container = doc ? doc->GetContainer() : nsnull;
 +  nsILinkHandler* linkHandler(do_QueryInterface(container));
    if (!linkHandler || IsEditable()) {
      mIsSubmitting = PR_FALSE;
      return NS_OK;
-@@ -1064,7 +1063,7 @@
+@@ -1066,7 +1065,7 @@ nsHTMLFormElement::SubmitSubmission(nsIF
    //
    // Submit
    //
 -  nsCOMPtr<nsIDocShell> docShell;
 +  nsIDocShell* docShell = nsnull;
  
    {
      nsAutoPopupStatePusher popupStatePusher(mSubmitPopupState);
-@@ -1072,7 +1071,7 @@
+@@ -1074,7 +1073,7 @@ nsHTMLFormElement::SubmitSubmission(nsIF
      nsAutoHandlingUserInputStatePusher userInpStatePusher(mSubmitInitiatedFromUserInput);
  
      rv = aFormSubmission->SubmitTo(actionURI, target, this, linkHandler,
 -                                   getter_AddRefs(docShell),
 +                                   &docShell,
                                     getter_AddRefs(mSubmittingRequest));
    }
  
-@@ -1118,31 +1117,31 @@
+@@ -1120,31 +1119,31 @@ nsHTMLFormElement::NotifySubmitObservers
  
    // Notify observers that the form is being submitted.
    nsresult rv = NS_OK;
 -  nsCOMPtr<nsIObserverService> service =
 +  nsIObserverService* service =
      do_GetService("@mozilla.org/observer-service;1", &rv);
    NS_ENSURE_SUCCESS(rv, rv);
  
@@ -197,104 +197,104 @@ diff --git a/content/html/content/src/ns
 -      theEnum->GetNext(getter_AddRefs(inst));
 +      theEnum->GetNext(&inst);
  
 -      nsCOMPtr<nsIFormSubmitObserver> formSubmitObserver(
 +      nsIFormSubmitObserver* formSubmitObserver(
                        do_QueryInterface(inst));
        if (formSubmitObserver) {
          rv = formSubmitObserver->Notify(this,
-@@ -1220,8 +1219,8 @@
+@@ -1222,8 +1221,8 @@ static PRInt32 CompareFormControlPositio
  {
    NS_ASSERTION(aControl1 != aControl2, "Comparing a form control to itself");
  
 -  nsCOMPtr<nsIContent> content1 = do_QueryInterface(aControl1);
 -  nsCOMPtr<nsIContent> content2 = do_QueryInterface(aControl2);
 +  nsIContent* content1 = do_QueryInterface(aControl1);
 +  nsIContent* content2 = do_QueryInterface(aControl2);
  
    NS_ASSERTION(content1 && content2,
                 "We should be able to QI to nsIContent here!");
-@@ -1262,7 +1261,7 @@
+@@ -1264,7 +1263,7 @@ nsHTMLFormElement::AddElement(nsIFormCon
  {
  #ifdef DEBUG
    {
 -    nsCOMPtr<nsIContent> content = do_QueryInterface(aChild);
 +    nsIContent* content = do_QueryInterface(aChild);
      NS_ASSERTION(content->GetParent(),
                   "Form control should have a parent");
    }
-@@ -1278,7 +1277,7 @@
+@@ -1280,7 +1279,7 @@ nsHTMLFormElement::AddElement(nsIFormCon
                 "Form control already in form");
  
    PRUint32 count = controlList.Length();
 -  nsCOMPtr<nsIFormControl> element;
 +  nsIFormControl* element = nsnull;
    
    // Optimize most common case where we insert at the end.
    PRBool lastElement = PR_FALSE;
-@@ -1324,7 +1323,7 @@
+@@ -1326,7 +1325,7 @@ nsHTMLFormElement::AddElement(nsIFormCon
    //
    PRInt32 type = aChild->GetType();
    if (type == NS_FORM_INPUT_RADIO) {
 -    nsCOMPtr<nsIRadioControlElement> radio = do_QueryInterface(aChild);
 +    nsIRadioControlElement* radio = do_QueryInterface(aChild);
      nsresult rv = radio->AddedToRadioGroup();
      NS_ENSURE_SUCCESS(rv, rv);
    }
-@@ -1385,7 +1384,7 @@
+@@ -1387,7 +1386,7 @@ nsHTMLFormElement::AddElement(nsIFormCon
        nsIDocument* document = GetCurrentDoc();
        if (document) {
          MOZ_AUTO_DOC_UPDATE(document, UPDATE_CONTENT_STATE, PR_TRUE);
 -        nsCOMPtr<nsIContent> oldElement(do_QueryInterface(oldDefaultSubmit));
 +        nsIContent* oldElement(do_QueryInterface(oldDefaultSubmit));
          document->ContentStatesChanged(oldElement, nsnull,
                                         NS_EVENT_STATE_DEFAULT);
        }
-@@ -1412,7 +1411,7 @@
+@@ -1414,7 +1413,7 @@ nsHTMLFormElement::RemoveElement(nsIForm
    //
    nsresult rv = NS_OK;
    if (aChild->GetType() == NS_FORM_INPUT_RADIO) {
 -    nsCOMPtr<nsIRadioControlElement> radio = do_QueryInterface(aChild);
 +    nsIRadioControlElement* radio = do_QueryInterface(aChild);
      rv = radio->WillRemoveFromRadioGroup();
      NS_ENSURE_SUCCESS(rv, rv);
    }
-@@ -1477,7 +1476,7 @@
+@@ -1479,7 +1478,7 @@ nsHTMLFormElement::RemoveElement(nsIForm
        nsIDocument* document = GetCurrentDoc();
        if (document) {
          MOZ_AUTO_DOC_UPDATE(document, UPDATE_CONTENT_STATE, PR_TRUE);
 -        nsCOMPtr<nsIContent> newElement(do_QueryInterface(mDefaultSubmitElement));
 +        nsIContent* newElement(do_QueryInterface(mDefaultSubmitElement));
          document->ContentStatesChanged(newElement, nsnull,
                                         NS_EVENT_STATE_DEFAULT);
        }
-@@ -1518,10 +1517,10 @@
+@@ -1520,10 +1519,10 @@ nsHTMLFormElement::OnSubmitClickBegin()
    // Prepare to run NotifySubmitObservers early before the
    // scripts on the page get to modify the form data, possibly
    // throwing off any password manager. (bug 257781)
 -  nsCOMPtr<nsIURI> actionURI;
 +  nsIURI* actionURI = nsnull;
    nsresult rv;
  
 -  rv = GetActionURL(getter_AddRefs(actionURI));
 +  rv = GetActionURL(&actionURI);
    if (NS_FAILED(rv) || !actionURI)
      return NS_OK;
  
-@@ -1548,7 +1547,7 @@
+@@ -1550,7 +1549,7 @@ NS_IMETHODIMP
  NS_IMETHODIMP
  nsHTMLFormElement::FlushPendingSubmission()
  {
 -  nsCOMPtr<nsIFormSubmission> kunkFuDeathGrip(mPendingSubmission);
 +  nsIFormSubmission* kunkFuDeathGrip(mPendingSubmission);
  
    if (!mPendingSubmission) {
      return NS_OK;
-@@ -1608,24 +1607,24 @@
+@@ -1610,24 +1609,24 @@ nsHTMLFormElement::GetActionURL(nsIURI**
    // XUL, do nothing. This prevents undesirable reloading of
    // a document inside XUL.
  
 -  nsCOMPtr<nsIURI> actionURL;
 +  nsIURI* actionURL = nsnull;
    if (action.IsEmpty()) {
 -    nsCOMPtr<nsIHTMLDocument> htmlDoc(do_QueryInterface(document));
 +    nsIHTMLDocument* htmlDoc(do_QueryInterface(document));
@@ -314,40 +314,40 @@ diff --git a/content/html/content/src/ns
      if (!baseURL) {
        return NS_OK; // No base URL -> exit early, see Bug 30721
      }
 -    rv = NS_NewURI(getter_AddRefs(actionURL), action, nsnull, baseURL);
 +    rv = NS_NewURI(&actionURL, action, nsnull, baseURL);
      NS_ENSURE_SUCCESS(rv, rv);
    }
  
-@@ -1813,10 +1812,10 @@
+@@ -1815,10 +1814,10 @@ nsHTMLFormElement::GetPositionInGroup(ns
      return NS_OK;
    }
  
 -  nsCOMPtr<nsISupports> itemWithName;
 -  nsresult rv = ResolveName(name, getter_AddRefs(itemWithName));
 +  nsISupports* itemWithName = nsnull;
 +  nsresult rv = ResolveName(name, &itemWithName);
    NS_ENSURE_SUCCESS(rv, rv);
 -  nsCOMPtr<nsIDOMNodeList> radioNodeList(do_QueryInterface(itemWithName));
 +  nsIDOMNodeList* radioNodeList(do_QueryInterface(itemWithName));
  
    // XXX If ResolveName could return an nsContentList instead then we 
    //     could get an nsContentList instead of using this hacky upcast
-@@ -1827,7 +1826,7 @@
+@@ -1829,7 +1828,7 @@ nsHTMLFormElement::GetPositionInGroup(ns
      return NS_OK;
    }
  
 -  nsCOMPtr<nsIContent> currentRadioNode(do_QueryInterface(aRadio));
 +  nsIContent* currentRadioNode(do_QueryInterface(aRadio));
    NS_ASSERTION(currentRadioNode, "No nsIContent for current radio button");
    *aPositionIndex = radioGroup->IndexOf(currentRadioNode, PR_TRUE);
    NS_ASSERTION(*aPositionIndex >= 0, "Radio button not found in its own group");
-@@ -1848,17 +1847,17 @@
+@@ -1850,17 +1849,17 @@ nsHTMLFormElement::GetNextRadioButton(co
    // If no radio is focused, get the radio relative to the selected one.
    *aRadioOut = nsnull;
  
 -  nsCOMPtr<nsIDOMHTMLInputElement> currentRadio;
 +  nsIDOMHTMLInputElement* currentRadio = nsnull;
    if (aFocusedRadio) {
      currentRadio = aFocusedRadio;
    }
@@ -360,65 +360,65 @@ diff --git a/content/html/content/src/ns
 -  ResolveName(aName, getter_AddRefs(itemWithName));
 -  nsCOMPtr<nsIDOMNodeList> radioNodeList(do_QueryInterface(itemWithName));
 +  nsISupports* itemWithName = nsnull;
 +  ResolveName(aName, &itemWithName);
 +  nsIDOMNodeList* radioNodeList(do_QueryInterface(itemWithName));
  
    // XXX If ResolveName could return an nsContentList instead then we 
    //     could get an nsContentList instead of using this hacky upcast
-@@ -1869,7 +1868,7 @@
+@@ -1871,7 +1870,7 @@ nsHTMLFormElement::GetNextRadioButton(co
      return NS_ERROR_FAILURE;
    }
  
 -  nsCOMPtr<nsIContent> currentRadioNode(do_QueryInterface(currentRadio));
 +  nsIContent* currentRadioNode(do_QueryInterface(currentRadio));
    NS_ASSERTION(currentRadioNode, "No nsIContent for current radio button");
    PRInt32 index = radioGroup->IndexOf(currentRadioNode, PR_TRUE);
    if (index < 0) {
-@@ -1879,9 +1878,9 @@
+@@ -1881,9 +1880,9 @@ nsHTMLFormElement::GetNextRadioButton(co
    PRUint32 numRadios;
    radioGroup->GetLength(&numRadios);
    PRBool disabled = PR_TRUE;
 -  nsCOMPtr<nsIDOMHTMLInputElement> radio;
 -  nsCOMPtr<nsIDOMNode> radioDOMNode;
 -  nsCOMPtr<nsIFormControl> formControl;
 +  nsIDOMHTMLInputElement* radio = nsnull;
 +  nsIDOMNode* radioDOMNode = nsnull;
 +  nsIFormControl* formControl = nsnull;
  
    do {
      if (aPrevious) {
-@@ -1892,7 +1891,7 @@
+@@ -1894,7 +1893,7 @@ nsHTMLFormElement::GetNextRadioButton(co
      else if (++index >= (PRInt32)numRadios) {
        index = 0;
      }
 -    radioGroup->Item(index, getter_AddRefs(radioDOMNode));
 +    radioGroup->Item(index, &radioDOMNode);
      radio = do_QueryInterface(radioDOMNode);
      if (!radio)
        continue;
-@@ -1922,13 +1921,13 @@
+@@ -1924,13 +1923,13 @@ nsHTMLFormElement::WalkRadioGroup(const 
      // XXX If the name is empty, it's not stored in the control list.  There
      // *must* be a more efficient way to do this.
      //
 -    nsCOMPtr<nsIFormControl> control;
 +    nsIFormControl* control = nsnull;
      PRUint32 len = 0;
      GetElementCount(&len);
      for (PRUint32 i=0; i<len; i++) {
 -      GetElementAt(i, getter_AddRefs(control));
 +      GetElementAt(i, &control);
        if (control->GetType() == NS_FORM_INPUT_RADIO) {
 -        nsCOMPtr<nsIContent> controlContent(do_QueryInterface(control));
 +        nsIContent* controlContent(do_QueryInterface(control));
          if (controlContent) {
            if (controlContent->AttrValueIs(kNameSpaceID_None, nsGkAtoms::name,
                                            EmptyString(), eCaseMatters)) {
-@@ -1944,27 +1943,27 @@
+@@ -1946,27 +1945,27 @@ nsHTMLFormElement::WalkRadioGroup(const 
      //
      // Get the control / list of controls from the form using form["name"]
      //
 -    nsCOMPtr<nsISupports> item;
 -    rv = DoResolveName(aName, aFlushContent, getter_AddRefs(item));
 +    nsISupports* item = nsnull;
 +    rv = DoResolveName(aName, aFlushContent, &item);
  
@@ -443,38 +443,38 @@ diff --git a/content/html/content/src/ns
 -            nodeList->Item(i, getter_AddRefs(node));
 -            nsCOMPtr<nsIFormControl> formControl(do_QueryInterface(node));
 +            nsIDOMNode* node = nsnull;
 +            nodeList->Item(i, &node);
 +            nsIFormControl* formControl(do_QueryInterface(node));
              if (formControl) {
                if (formControl->GetType() == NS_FORM_INPUT_RADIO) {
                  aVisitor->Visit(formControl, &stopIterating);
-@@ -2110,9 +2109,9 @@
+@@ -2112,9 +2111,9 @@ nsFormControlList::NamedItem(const nsASt
  
    nsresult rv = NS_OK;
  
 -  nsCOMPtr<nsISupports> supports;
 +  nsISupports* supports = nsnull;
    
 -  if (!mNameLookupTable.Get(aName, getter_AddRefs(supports))) // key not found
 +  if (!mNameLookupTable.Get(aName, &supports)) // key not found
       return rv;
  
    if (supports) {
-@@ -2121,7 +2120,7 @@
+@@ -2123,7 +2122,7 @@ nsFormControlList::NamedItem(const nsASt
  
      if (!*aReturn) {
        // If not, we check if it's a node list.
 -      nsCOMPtr<nsIDOMNodeList> nodeList(do_QueryInterface(supports));
 +      nsIDOMNodeList* nodeList(do_QueryInterface(supports));
        NS_ASSERTION(nodeList, "Huh, what's going one here?");
  
        if (nodeList) {
-@@ -2163,18 +2162,18 @@
+@@ -2165,18 +2164,18 @@ nsFormControlList::AddElementToTable(nsI
      return NS_OK;
    }
  
 -  nsCOMPtr<nsISupports> supports;
 -  mNameLookupTable.Get(aName, getter_AddRefs(supports));
 +  nsISupports* supports = nsnull;
 +  mNameLookupTable.Get(aName, &supports);
  
@@ -488,17 +488,17 @@ diff --git a/content/html/content/src/ns
      // Found something in the hash, check its type
 -    nsCOMPtr<nsIContent> content(do_QueryInterface(supports));
 -    nsCOMPtr<nsIContent> newChild(do_QueryInterface(aChild));
 +    nsIContent* content(do_QueryInterface(supports));
 +    nsIContent* newChild(do_QueryInterface(aChild));
  
      if (content) {
        // Check if the new content is the same as the one we found in the
-@@ -2195,19 +2194,19 @@
+@@ -2197,19 +2196,19 @@ nsFormControlList::AddElementToTable(nsI
        // Add the new child too
        list->AppendElement(newChild);
  
 -      nsCOMPtr<nsISupports> listSupports = do_QueryInterface(list);
 +      nsISupports* listSupports = do_QueryInterface(list);
  
        // Replace the element with the list.
        NS_ENSURE_TRUE(mNameLookupTable.Put(aName, listSupports),
@@ -511,17 +511,17 @@ diff --git a/content/html/content/src/ns
  
        // Upcast, uggly, but it works!
        nsBaseContentList *list = static_cast<nsBaseContentList *>
 -                                           ((nsIDOMNodeList *)nodeList.get());
 +                                           ((nsIDOMNodeList *)nodeList);
  
        PRInt32 oldIndex = list->IndexOf(newChild, PR_FALSE);
        
-@@ -2242,17 +2241,17 @@
+@@ -2244,17 +2243,17 @@ nsFormControlList::RemoveElementFromTabl
      return NS_OK;
    }
  
 -  nsCOMPtr<nsIContent> content = do_QueryInterface(aChild);  
 +  nsIContent* content = do_QueryInterface(aChild);  
    if (!content) {
      return NS_OK;
    }
@@ -533,32 +533,32 @@ diff --git a/content/html/content/src/ns
 +  if (!mNameLookupTable.Get(aName, &supports))
      return NS_OK;
  
 -  nsCOMPtr<nsIFormControl> fctrl(do_QueryInterface(supports));
 +  nsIFormControl* fctrl(do_QueryInterface(supports));
  
    if (fctrl) {
      // Single element in the hash, just remove it if it's the one
-@@ -2264,12 +2263,12 @@
+@@ -2266,12 +2265,12 @@ nsFormControlList::RemoveElementFromTabl
      return NS_OK;
    }
  
 -  nsCOMPtr<nsIDOMNodeList> nodeList(do_QueryInterface(supports));
 +  nsIDOMNodeList* nodeList(do_QueryInterface(supports));
    NS_ENSURE_TRUE(nodeList, NS_ERROR_FAILURE);
  
    // Upcast, uggly, but it works!
    nsBaseContentList *list = static_cast<nsBaseContentList *>
 -                                       ((nsIDOMNodeList *)nodeList.get());
 +                                       ((nsIDOMNodeList *)nodeList);
  
    list->RemoveElement(content);
  
-@@ -2283,11 +2282,11 @@
+@@ -2285,11 +2284,11 @@ nsFormControlList::RemoveElementFromTabl
    } else if (length == 1) {
      // Only one element left, replace the list in the hash with the
      // single element.
 -    nsCOMPtr<nsIDOMNode> node;
 -    list->Item(0, getter_AddRefs(node));
 +    nsIDOMNode* node = nsnull;
 +    list->Item(0, &node);
  
@@ -566,200 +566,200 @@ diff --git a/content/html/content/src/ns
 -      nsCOMPtr<nsISupports> tmp(do_QueryInterface(node));
 +      nsISupports* tmp(do_QueryInterface(node));
        NS_ENSURE_TRUE(mNameLookupTable.Put(aName, tmp),NS_ERROR_FAILURE);
      }
    }
 diff --git a/content/xul/document/src/nsXULContentSink.cpp b/content/xul/document/src/nsXULContentSink.cpp
 --- a/content/xul/document/src/nsXULContentSink.cpp
 +++ b/content/xul/document/src/nsXULContentSink.cpp
-@@ -940,7 +940,7 @@
+@@ -940,7 +940,7 @@ XULContentSinkImpl::OpenTag(const PRUnic
      nsVoidArray* children;
      rv = mContextStack.GetTopChildren(&children);
      if (NS_FAILED(rv)) {
 -        delete element;
 +        NS_GetGC()->Free(element);
          return rv;
      }
  
-@@ -1162,7 +1162,7 @@
+@@ -1162,7 +1162,7 @@ XULContentSinkImpl::OpenScript(const PRU
            }
  
            if (NS_FAILED(rv)) {
 -              delete script;
 +              NS_GetGC()->Free(script);
                return rv;
            }
  
-@@ -1177,7 +1177,7 @@
+@@ -1177,7 +1177,7 @@ XULContentSinkImpl::OpenScript(const PRU
        nsVoidArray* children;
        rv = mContextStack.GetTopChildren(&children);
        if (NS_FAILED(rv)) {
 -          delete script;
 +          NS_GetGC()->Free(script);
            return rv;
        }
  
 diff --git a/docshell/shistory/src/nsSHEntry.cpp b/docshell/shistory/src/nsSHEntry.cpp
 --- a/docshell/shistory/src/nsSHEntry.cpp
 +++ b/docshell/shistory/src/nsSHEntry.cpp
-@@ -82,7 +82,6 @@
+@@ -82,7 +82,6 @@ nsresult nsSHEntry::Startup()
  
  void nsSHEntry::Shutdown()
  {
 -  delete gHistoryTracker;
    gHistoryTracker = nsnull;
  }
  
-@@ -155,7 +154,7 @@
+@@ -155,7 +154,7 @@ nsSHEntry::~nsSHEntry()
    mChildren.EnumerateForwards(ClearParentPtr, nsnull);
    mChildren.Clear();
  
 -  nsCOMPtr<nsIContentViewer> viewer = mContentViewer;
 +  nsIContentViewer* viewer = mContentViewer;
    DropPresentationState();
    if (viewer) {
      viewer->Destroy();
-@@ -199,7 +198,6 @@
+@@ -199,7 +198,6 @@ NS_IMETHODIMP nsSHEntry::GetURI(nsIURI**
  NS_IMETHODIMP nsSHEntry::GetURI(nsIURI** aURI)
  {
    *aURI = mURI;
 -  NS_IF_ADDREF(*aURI);
    return NS_OK;
  }
  
-@@ -212,7 +210,6 @@
+@@ -212,7 +210,6 @@ NS_IMETHODIMP nsSHEntry::GetReferrerURI(
  NS_IMETHODIMP nsSHEntry::GetReferrerURI(nsIURI **aReferrerURI)
  {
    *aReferrerURI = mReferrerURI;
 -  NS_IF_ADDREF(*aReferrerURI);
    return NS_OK;
  }
  
-@@ -236,8 +233,8 @@
+@@ -236,8 +233,8 @@ nsSHEntry::SetContentViewer(nsIContentVi
    if (mContentViewer) {
      gHistoryTracker->AddObject(this);
  
 -    nsCOMPtr<nsIDOMDocument> domDoc;
 -    mContentViewer->GetDOMDocument(getter_AddRefs(domDoc));
 +    nsIDOMDocument* domDoc = nsnull;
 +    mContentViewer->GetDOMDocument(&domDoc);
      // Store observed document in strong pointer in case it is removed from
      // the contentviewer
      mDocument = do_QueryInterface(domDoc);
-@@ -254,7 +251,6 @@
+@@ -254,7 +251,6 @@ nsSHEntry::GetContentViewer(nsIContentVi
  nsSHEntry::GetContentViewer(nsIContentViewer **aResult)
  {
    *aResult = mContentViewer;
 -  NS_IF_ADDREF(*aResult);
    return NS_OK;
  }
  
-@@ -271,7 +267,6 @@
+@@ -271,7 +267,6 @@ nsSHEntry::GetAnyContentViewer(nsISHEntr
      printf("Found content viewer\n");
  #endif
      *aOwnerEntry = this;
 -    NS_ADDREF(*aOwnerEntry);
      return NS_OK;
    }
    // The root SHEntry doesn't have a ContentViewer, so check child nodes
-@@ -327,7 +322,6 @@
+@@ -327,7 +322,6 @@ NS_IMETHODIMP nsSHEntry::GetPostData(nsI
  NS_IMETHODIMP nsSHEntry::GetPostData(nsIInputStream** aResult)
  {
    *aResult = mPostData;
 -  NS_IF_ADDREF(*aResult);
    return NS_OK;
  }
  
-@@ -340,7 +334,6 @@
+@@ -340,7 +334,6 @@ NS_IMETHODIMP nsSHEntry::GetLayoutHistor
  NS_IMETHODIMP nsSHEntry::GetLayoutHistoryState(nsILayoutHistoryState** aResult)
  {
    *aResult = mLayoutHistoryState;
 -  NS_IF_ADDREF(*aResult);
    return NS_OK;
  }
  
-@@ -402,7 +395,6 @@
+@@ -402,7 +395,6 @@ NS_IMETHODIMP nsSHEntry::GetCacheKey(nsI
  NS_IMETHODIMP nsSHEntry::GetCacheKey(nsISupports** aResult)
  {
    *aResult = mCacheKey;
 -  NS_IF_ADDREF(*aResult);
    return NS_OK;
  }
  
-@@ -492,7 +484,6 @@
+@@ -492,7 +484,6 @@ nsSHEntry::Clone(nsISHEntry ** aResult)
    *aResult = new nsSHEntry(*this);
    if (!*aResult)
      return NS_ERROR_OUT_OF_MEMORY;
 -  NS_ADDREF(*aResult);
    return NS_OK;
  }
  
-@@ -501,7 +492,6 @@
+@@ -501,7 +492,6 @@ nsSHEntry::GetParent(nsISHEntry ** aResu
  {
    NS_ENSURE_ARG_POINTER(aResult);
    *aResult = mParent;
 -  NS_IF_ADDREF(*aResult);
    return NS_OK;
  }
  
-@@ -527,7 +517,7 @@
+@@ -527,7 +517,7 @@ NS_IMETHODIMP
  NS_IMETHODIMP
  nsSHEntry::GetWindowState(nsISupports **aState)
  {
 -  NS_IF_ADDREF(*aState = mWindowState);
 +  *aState = mWindowState;
    return NS_OK;
  }
  
-@@ -548,7 +538,7 @@
+@@ -548,7 +538,7 @@ NS_IMETHODIMP
  NS_IMETHODIMP
  nsSHEntry::GetOwner(nsISupports **aOwner)
  {
 -  NS_IF_ADDREF(*aOwner = mOwner);
 +  *aOwner = mOwner;
    return NS_OK;
  }
  
-@@ -620,7 +610,6 @@
+@@ -620,7 +610,6 @@ nsSHEntry::GetChildAt(PRInt32 aIndex, ns
      *aResult = mChildren[aIndex];
      // yes, mChildren can have holes in it.  AddChild's offset parameter makes
      // that possible.
 -    NS_IF_ADDREF(*aResult);
    } else {
      *aResult = nsnull;
    }
-@@ -638,7 +627,7 @@
+@@ -638,7 +627,7 @@ NS_IMETHODIMP
  NS_IMETHODIMP
  nsSHEntry::ChildShellAt(PRInt32 aIndex, nsIDocShellTreeItem **aShell)
  {
 -  NS_IF_ADDREF(*aShell = mChildShells.SafeObjectAt(aIndex));
 +  *aShell = mChildShells.SafeObjectAt(aIndex);
    return NS_OK;
  }
  
-@@ -652,7 +641,7 @@
+@@ -652,7 +641,7 @@ NS_IMETHODIMP
  NS_IMETHODIMP
  nsSHEntry::GetRefreshURIList(nsISupportsArray **aList)
  {
 -  NS_IF_ADDREF(*aList = mRefreshURIList);
 +  *aList = mRefreshURIList;
    return NS_OK;
  }
  
-@@ -679,7 +668,7 @@
+@@ -679,7 +668,7 @@ void
  void
  nsSHEntry::DropPresentationState()
  {
 -  nsRefPtr<nsSHEntry> kungFuDeathGrip = this;
 +  nsSHEntry* kungFuDeathGrip = this;
  
    if (mDocument) {
      mDocument->SetShellsHidden(PR_FALSE);
-@@ -705,19 +694,19 @@
+@@ -705,19 +694,19 @@ nsSHEntry::Expire()
    // get it evicted.
    if (!mContentViewer)
      return;
 -  nsCOMPtr<nsISupports> container;
 -  mContentViewer->GetContainer(getter_AddRefs(container));
 -  nsCOMPtr<nsIDocShellTreeItem> treeItem = do_QueryInterface(container);
 +  nsISupports* container = nsnull;
 +  mContentViewer->GetContainer(&container);
@@ -778,53 +778,53 @@ diff --git a/docshell/shistory/src/nsSHE
 +  treeItem->GetSameTypeRootTreeItem(&root);
 +  nsIWebNavigation* webNav = do_QueryInterface(root);
 +  nsISHistory* history = nsnull;
 +  webNav->GetSessionHistory(&history);
 +  nsISHistoryInternal* historyInt = do_QueryInterface(history);
    if (!historyInt)
      return;
    historyInt->EvictExpiredContentViewerForEntry(this);
-@@ -818,7 +807,7 @@
+@@ -818,7 +807,7 @@ nsSHEntry::DocumentMutated()
    // Release the reference to the contentviewer asynchronously so that the
    // document doesn't get nuked mid-mutation.
  
 -  nsCOMPtr<nsIRunnable> evt =
 +  nsIRunnable* evt =
        new DestroyViewerEvent(mContentViewer, mDocument);
    nsresult rv = NS_DispatchToCurrentThread(evt);
    if (NS_FAILED(rv)) {
 diff --git a/dom/src/base/nsJSEnvironment.cpp b/dom/src/base/nsJSEnvironment.cpp
 --- a/dom/src/base/nsJSEnvironment.cpp
 +++ b/dom/src/base/nsJSEnvironment.cpp
-@@ -391,11 +391,11 @@
+@@ -391,11 +391,11 @@ NS_HandleScriptError(nsIScriptGlobalObje
                       nsEventStatus *aStatus)
  {
    PRBool called = PR_FALSE;
 -  nsCOMPtr<nsPIDOMWindow> win(do_QueryInterface(aScriptGlobal));
 +  nsPIDOMWindow* win(do_QueryInterface(aScriptGlobal));
    nsIDocShell *docShell = win ? win->GetDocShell() : nsnull;
    if (docShell) {
 -    nsCOMPtr<nsPresContext> presContext;
 -    docShell->GetPresContext(getter_AddRefs(presContext));
 +    nsPresContext* presContext = nsnull;
 +    docShell->GetPresContext(&presContext);
  
      static PRInt32 errorDepth; // Recursion prevention
      ++errorDepth;
-@@ -460,7 +460,7 @@
+@@ -460,7 +460,7 @@ NS_ScriptErrorReporter(JSContext *cx,
          // Scope to make sure we're not using |win| in the rest of
          // this function when we should be using |globalObject|.  We
          // only need |win| for the event dispatch.
 -        nsCOMPtr<nsPIDOMWindow> win(do_QueryInterface(globalObject));
 +        nsPIDOMWindow* win(do_QueryInterface(globalObject));
          nsIDocShell *docShell = win ? win->GetDocShell() : nsnull;
          if (docShell &&
              (report->errorNumber != JSMSG_OUT_OF_MEMORY &&
-@@ -468,25 +468,25 @@
+@@ -468,25 +468,25 @@ NS_ScriptErrorReporter(JSContext *cx,
            static PRInt32 errorDepth; // Recursion prevention
            ++errorDepth;
  
 -          nsCOMPtr<nsPresContext> presContext;
 -          docShell->GetPresContext(getter_AddRefs(presContext));
 +          nsPresContext* presContext = nsnull;
 +          docShell->GetPresContext(&presContext);
  
@@ -847,17 +847,17 @@ diff --git a/dom/src/base/nsJSEnvironmen
  
 -              nsCOMPtr<nsIURI> codebase;
 -              p->GetURI(getter_AddRefs(codebase));
 +              nsIURI* codebase = nsnull;
 +              p->GetURI(&codebase);
  
                if (errorURI && codebase) {
                  // FIXME: Once error reports contain the origin of the
-@@ -521,19 +521,19 @@
+@@ -521,19 +521,19 @@ NS_ScriptErrorReporter(JSContext *cx,
        if (status != nsEventStatus_eConsumeNoDefault) {
          // Make an nsIScriptError and populate it with information from
          // this error.
 -        nsCOMPtr<nsIScriptError> errorObject =
 +        nsIScriptError* errorObject =
            do_CreateInstance("@mozilla.org/scripterror;1");
  
          if (errorObject != nsnull) {
@@ -871,26 +871,26 @@ diff --git a/dom/src/base/nsJSEnvironmen
                         "nsIScriptObjectPrincipal");
 -          nsCOMPtr<nsIPrincipal> systemPrincipal;
 -          sSecurityManager->GetSystemPrincipal(getter_AddRefs(systemPrincipal));
 +          nsIPrincipal* systemPrincipal = nsnull;
 +          sSecurityManager->GetSystemPrincipal(&systemPrincipal);
            const char * category =
              scriptPrincipal->GetPrincipal() == systemPrincipal
              ? "chrome javascript"
-@@ -548,7 +548,7 @@
+@@ -548,7 +548,7 @@ NS_ScriptErrorReporter(JSContext *cx,
                                   category);
  
            if (NS_SUCCEEDED(rv)) {
 -            nsCOMPtr<nsIConsoleService> consoleService =
 +            nsIConsoleService* consoleService =
                do_GetService(NS_CONSOLESERVICE_CONTRACTID, &rv);
              if (NS_SUCCEEDED(rv)) {
                consoleService->LogMessage(errorObject);
-@@ -611,18 +611,18 @@
+@@ -611,18 +611,18 @@ LocaleToUnicode(JSContext *cx, char *src
  
    if (!gDecoder) {
      // use app default locale
 -    nsCOMPtr<nsILocaleService> localeService = 
 +    nsILocaleService* localeService = 
        do_GetService(NS_LOCALESERVICE_CONTRACTID, &rv);
      if (NS_SUCCEEDED(rv)) {
 -      nsCOMPtr<nsILocale> appLocale;
@@ -903,26 +903,26 @@ diff --git a/dom/src/base/nsJSEnvironmen
            GetCategory(NS_LITERAL_STRING(NSILOCALE_TIME), localeStr);
          NS_ASSERTION(NS_SUCCEEDED(rv), "failed to get app locale info");
  
 -        nsCOMPtr<nsIPlatformCharset> platformCharset =
 +        nsIPlatformCharset* platformCharset =
            do_GetService(NS_PLATFORMCHARSET_CONTRACTID, &rv);
  
          if (NS_SUCCEEDED(rv)) {
-@@ -630,7 +630,7 @@
+@@ -630,7 +630,7 @@ LocaleToUnicode(JSContext *cx, char *src
            rv = platformCharset->GetDefaultCharsetForLocale(localeStr, charset);
            if (NS_SUCCEEDED(rv)) {
              // get/create unicode decoder for charset
 -            nsCOMPtr<nsICharsetConverterManager> ccm =
 +            nsICharsetConverterManager* ccm =
                do_GetService(NS_CHARSETCONVERTERMANAGER_CONTRACTID, &rv);
              if (NS_SUCCEEDED(rv))
                ccm->GetUnicodeDecoder(charset.get(), &gDecoder);
-@@ -715,15 +715,15 @@
+@@ -715,15 +715,15 @@ LocaleCompare(JSContext *cx, JSString *s
    nsresult rv;
  
    if (!gCollation) {
 -    nsCOMPtr<nsILocaleService> localeService =
 +    nsILocaleService* localeService =
        do_GetService(NS_LOCALESERVICE_CONTRACTID, &rv);
  
      if (NS_SUCCEEDED(rv)) {
@@ -932,51 +932,51 @@ diff --git a/dom/src/base/nsJSEnvironmen
 +      rv = localeService->GetApplicationLocale(&locale);
  
        if (NS_SUCCEEDED(rv)) {
 -        nsCOMPtr<nsICollationFactory> colFactory =
 +        nsICollationFactory* colFactory =
            do_CreateInstance(NS_COLLATIONFACTORY_CONTRACTID, &rv);
  
          if (NS_SUCCEEDED(rv)) {
-@@ -766,10 +766,10 @@
+@@ -766,10 +766,10 @@ JSObject2Win(JSContext *cx, JSObject *ob
      return nsnull;
    }
  
 -  nsCOMPtr<nsIXPConnectWrappedNative> wrapper;
 -  xpc->GetWrappedNativeOfJSObject(cx, obj, getter_AddRefs(wrapper));
 +  nsIXPConnectWrappedNative* wrapper = nsnull;
 +  xpc->GetWrappedNativeOfJSObject(cx, obj, &wrapper);
    if (wrapper) {
 -    nsCOMPtr<nsPIDOMWindow> win = do_QueryWrappedNative(wrapper);
 +    nsPIDOMWindow* win = do_QueryWrappedNative(wrapper);
      if (win) {
        return static_cast<nsGlobalWindow *>
                          (static_cast<nsPIDOMWindow *>(win));
-@@ -787,7 +787,7 @@
+@@ -787,7 +787,7 @@ PrintWinURI(nsGlobalWindow *win)
      return;
    }
  
 -  nsCOMPtr<nsIDocument> doc = do_QueryInterface(win->GetExtantDocument());
 +  nsIDocument* doc = do_QueryInterface(win->GetExtantDocument());
    if (!doc) {
      printf("No document in the window.\n");
      return;
-@@ -818,8 +818,8 @@
+@@ -818,8 +818,8 @@ PrintWinCodebase(nsGlobalWindow *win)
      return;
    }
  
 -  nsCOMPtr<nsIURI> uri;
 -  prin->GetURI(getter_AddRefs(uri));
 +  nsIURI* uri = nsnull;
 +  prin->GetURI(&uri);
    if (!uri) {
      printf("No URI, maybe the system principal.\n");
      return;
-@@ -880,18 +880,18 @@
+@@ -880,18 +880,18 @@ nsJSContext::DOMOperationCallback(JSCont
    // If we get here we're most likely executing an infinite loop in JS,
    // we'll tell the user about this and we'll give the user the option
    // of stopping the execution of the script.
 -  nsCOMPtr<nsPIDOMWindow> win(do_QueryInterface(ctx->GetGlobalObject()));
 +  nsPIDOMWindow* win(do_QueryInterface(ctx->GetGlobalObject()));
    NS_ENSURE_TRUE(win, JS_TRUE);
  
    nsIDocShell *docShell = win->GetDocShell();
@@ -989,104 +989,104 @@ diff --git a/dom/src/base/nsJSEnvironmen
    // Get the nsIPrompt interface from the docshell
 -  nsCOMPtr<nsIPrompt> prompt;
 -  ireq->GetInterface(NS_GET_IID(nsIPrompt), getter_AddRefs(prompt));
 +  nsIPrompt* prompt = nsnull;
 +  ireq->GetInterface(NS_GET_IID(nsIPrompt), (void**)&prompt);
    NS_ENSURE_TRUE(prompt, JS_TRUE);
  
    nsresult rv;
-@@ -905,12 +905,12 @@
+@@ -905,12 +905,12 @@ nsJSContext::DOMOperationCallback(JSCont
    if (debugPossible) {
      PRBool jsds_IsOn = PR_FALSE;
      const char jsdServiceCtrID[] = "@mozilla.org/js/jsd/debugger-service;1";
 -    nsCOMPtr<jsdIExecutionHook> jsdHook;  
 -    nsCOMPtr<jsdIDebuggerService> jsds = do_GetService(jsdServiceCtrID, &rv);
 +    jsdIExecutionHook* jsdHook = nsnull;  
 +    jsdIDebuggerService* jsds = do_GetService(jsdServiceCtrID, &rv);
    
      // Check if there's a user for the debugger service that's 'on' for us
      if (NS_SUCCEEDED(rv)) {
 -      jsds->GetDebuggerHook(getter_AddRefs(jsdHook));
 +      jsds->GetDebuggerHook(&jsdHook);
        jsds->GetIsOn(&jsds_IsOn);
        if (jsds_IsOn) { // If this is not true, the next call would start jsd...
          rv = jsds->OnForRuntime(cx->runtime);
-@@ -926,13 +926,13 @@
+@@ -926,13 +926,13 @@ nsJSContext::DOMOperationCallback(JSCont
  #endif
  
    // Get localizable strings
 -  nsCOMPtr<nsIStringBundleService>
 +  nsIStringBundleService*
      stringService(do_GetService(NS_STRINGBUNDLE_CONTRACTID));
    if (!stringService)
      return JS_TRUE;
  
 -  nsCOMPtr<nsIStringBundle> bundle;
 -  stringService->CreateBundle(kDOMStringBundleURL, getter_AddRefs(bundle));
 +  nsIStringBundle* bundle = nsnull;
 +  stringService->CreateBundle(kDOMStringBundleURL, &bundle);
    if (!bundle)
      return JS_TRUE;
    
-@@ -1080,7 +1080,7 @@
+@@ -1080,7 +1080,7 @@ nsJSContext::JSOptionChangedCallback(con
    // need to enable this directly from InitContext
    if ((newDefaultJSOptions & JSOPTION_STRICT) == 0) {
      nsIScriptGlobalObject *global = context->GetGlobalObject();
 -    nsCOMPtr<nsIDOMChromeWindow> chromeWindow(do_QueryInterface(global));
 +    nsIDOMChromeWindow* chromeWindow(do_QueryInterface(global));
      if (chromeWindow)
        newDefaultJSOptions |= JSOPTION_STRICT;
    }
-@@ -1260,7 +1260,7 @@
+@@ -1260,7 +1260,7 @@ nsJSContext::EvaluateStringWithValue(con
      nsIScriptGlobalObject *global = GetGlobalObject();
      if (!global)
        return NS_ERROR_FAILURE;
 -    nsCOMPtr<nsIScriptObjectPrincipal> objPrincipal =
 +    nsIScriptObjectPrincipal* objPrincipal =
        do_QueryInterface(global, &rv);
      if (NS_FAILED(rv))
        return NS_ERROR_FAILURE;
-@@ -1285,7 +1285,7 @@
+@@ -1285,7 +1285,7 @@ nsJSContext::EvaluateStringWithValue(con
    // from native code via XPConnect uses the right context.  Do this whether
    // or not the SecurityManager said "ok", in order to simplify control flow
    // below where we pop before returning.
 -  nsCOMPtr<nsIJSContextStack> stack =
 +  nsIJSContextStack* stack =
             do_GetService("@mozilla.org/js/xpc/ContextStack;1", &rv);
    if (NS_FAILED(rv) || NS_FAILED(stack->Push(mContext))) {
      JSPRINCIPALS_DROP(mContext, jsprin);
-@@ -1435,7 +1435,7 @@
+@@ -1435,7 +1435,7 @@ nsJSContext::EvaluateString(const nsAStr
      aPrincipal->GetJSPrincipals(mContext, &jsprin);
    }
    else {
 -    nsCOMPtr<nsIScriptObjectPrincipal> objPrincipal =
 +    nsIScriptObjectPrincipal* objPrincipal =
        do_QueryInterface(GetGlobalObject(), &rv);
      if (NS_FAILED(rv))
        return NS_ERROR_FAILURE;
-@@ -1459,7 +1459,7 @@
+@@ -1459,7 +1459,7 @@ nsJSContext::EvaluateString(const nsAStr
    // from native code via XPConnect uses the right context.  Do this whether
    // or not the SecurityManager said "ok", in order to simplify control flow
    // below where we pop before returning.
 -  nsCOMPtr<nsIJSContextStack> stack =
 +  nsIJSContextStack* stack =
             do_GetService("@mozilla.org/js/xpc/ContextStack;1", &rv);
    if (NS_FAILED(rv) || NS_FAILED(stack->Push(mContext))) {
      JSPRINCIPALS_DROP(mContext, jsprin);
-@@ -1623,7 +1623,7 @@
+@@ -1623,7 +1623,7 @@ nsJSContext::ExecuteScript(void *aScript
  
    // Push our JSContext on our thread's context stack, in case native code
    // called from JS calls back into JS via XPConnect.
 -  nsCOMPtr<nsIJSContextStack> stack =
 +  nsIJSContextStack* stack =
             do_GetService("@mozilla.org/js/xpc/ContextStack;1", &rv);
    if (NS_FAILED(rv) || NS_FAILED(stack->Push(mContext))) {
      return NS_ERROR_FAILURE;
-@@ -1705,16 +1705,16 @@
+@@ -1705,16 +1705,16 @@ nsJSContext::JSObjectFromInterface(nsISu
    }
    // Get the jsobject associated with this target
    nsresult rv;
 -  nsCOMPtr<nsIXPConnectJSObjectHolder> jsholder;
 +  nsIXPConnectJSObjectHolder* jsholder = nsnull;
    rv = nsContentUtils::XPConnect()->WrapNative(mContext, (JSObject *)aScope,
                                                 aTarget,
                                                 NS_GET_IID(nsISupports),
@@ -1097,67 +1097,67 @@ diff --git a/dom/src/base/nsJSEnvironmen
 -  nsCOMPtr<nsIXPConnectWrappedNative> wrapper = do_QueryInterface(jsholder);
 +  nsIXPConnectWrappedNative* wrapper = do_QueryInterface(jsholder);
    NS_ASSERTION(wrapper, "wrapper must impl nsIXPConnectWrappedNative");
 -  nsCOMPtr<nsISupports> targetSupp = do_QueryInterface(aTarget);
 +  nsISupports* targetSupp = do_QueryInterface(aTarget);
    NS_ASSERTION(wrapper->Native() == targetSupp, "Native should be the target!");
  #endif
    return jsholder->GetJSObject(aRet);
-@@ -1798,7 +1798,7 @@
+@@ -1798,7 +1798,7 @@ nsJSContext::CompileFunction(void* aTarg
    nsIScriptGlobalObject *global = GetGlobalObject();
    if (global) {
      // XXXbe why the two-step QI? speed up via a new GetGlobalObjectData func?
 -    nsCOMPtr<nsIScriptObjectPrincipal> globalData = do_QueryInterface(global);
 +    nsIScriptObjectPrincipal* globalData = do_QueryInterface(global);
      if (globalData) {
        nsIPrincipal *prin = globalData->GetPrincipal();
        if (!prin)
-@@ -1856,7 +1856,7 @@
+@@ -1856,7 +1856,7 @@ nsJSContext::CallEventHandler(nsISupport
    // xxxmarkh - this comment is no longer true - principals are not used at
    // all now, and never were in some cases.
  
 -  nsCOMPtr<nsIJSContextStack> stack =
 +  nsIJSContextStack* stack =
      do_GetService("@mozilla.org/js/xpc/ContextStack;1", &rv);
    if (NS_FAILED(rv) || NS_FAILED(stack->Push(mContext)))
      return NS_ERROR_FAILURE;
-@@ -1867,7 +1867,7 @@
+@@ -1867,7 +1867,7 @@ nsJSContext::CallEventHandler(nsISupport
      // We're not done yet!  Some event listeners are confused about their
      // script context, so check whether we might actually be the wrong script
      // context.  To be safe, do CheckFunctionAccess checks for both.
 -    nsCOMPtr<nsIContent> content = do_QueryInterface(aTarget);
 +    nsIContent* content = do_QueryInterface(aTarget);
      if (content) {
        // XXXbz XBL2/sXBL issue
        nsIDocument* ownerDoc = content->GetOwnerDoc();
-@@ -1987,7 +1987,7 @@
+@@ -1987,7 +1987,7 @@ nsJSContext::BindCompiledEventHandler(ns
  
    // Push our JSContext on our thread's context stack, in case native code
    // called from JS calls back into JS via XPConnect.
 -  nsCOMPtr<nsIJSContextStack> stack =
 +  nsIJSContextStack* stack =
             do_GetService("@mozilla.org/js/xpc/ContextStack;1", &rv);
    if (NS_FAILED(rv) || NS_FAILED(stack->Push(mContext))) {
      return NS_ERROR_FAILURE;
-@@ -2203,11 +2203,11 @@
+@@ -2203,11 +2203,11 @@ nsJSContext::GetGlobalObject()
      return nsnull;
    }
  
 -  nsCOMPtr<nsIScriptGlobalObject> sgo;
 +  nsIScriptGlobalObject* sgo = nsnull;
    nsISupports *priv =
      (nsISupports *)::JS_GetPrivate(mContext, global);
  
 -  nsCOMPtr<nsIXPConnectWrappedNative> wrapped_native =
 +  nsIXPConnectWrappedNative* wrapped_native =
      do_QueryInterface(priv);
  
    if (wrapped_native) {
-@@ -2238,17 +2238,16 @@
+@@ -2238,17 +2238,16 @@ nsJSContext::CreateNativeGlobalForInner(
  {
    nsIXPConnect *xpc = nsContentUtils::XPConnect();
    PRUint32 flags = aIsChrome? nsIXPConnect::FLAG_SYSTEM_GLOBAL_OBJECT : 0;
 -  nsCOMPtr<nsIXPConnectJSObjectHolder> jsholder;
 +  nsIXPConnectJSObjectHolder* jsholder = nsnull;
    nsresult rv = xpc->
            InitClassesWithNewWrappedGlobal(mContext,
                                            aNewInner, NS_GET_IID(nsISupports),
@@ -1168,44 +1168,44 @@ diff --git a/dom/src/base/nsJSEnvironmen
      return rv;
    jsholder->GetJSObject(reinterpret_cast<JSObject **>(aNativeGlobal));
 -  *aHolder = jsholder.get();
 -  NS_ADDREF(*aHolder);
 +  *aHolder = jsholder;
    return NS_OK;
  }
  
-@@ -2322,7 +2321,7 @@
+@@ -2322,7 +2321,7 @@ nsJSContext::InitContext(nsIScriptGlobal
  
    JSObject *global = ::JS_GetGlobalObject(mContext);
  
 -  nsCOMPtr<nsIXPConnectJSObjectHolder> holder;
 +  nsIXPConnectJSObjectHolder* holder = nsnull;
  
    // If there's already a global object in mContext we won't tell
    // XPConnect to wrap aGlobalObject since it's already wrapped.
-@@ -2330,7 +2329,7 @@
+@@ -2330,7 +2329,7 @@ nsJSContext::InitContext(nsIScriptGlobal
    nsresult rv;
  
    if (!global) {
 -    nsCOMPtr<nsIDOMChromeWindow> chromeWindow(do_QueryInterface(aGlobalObject));
 +    nsIDOMChromeWindow* chromeWindow(do_QueryInterface(aGlobalObject));
      PRUint32 flags = 0;
      
      if (chromeWindow) {
-@@ -2349,7 +2348,7 @@
+@@ -2349,7 +2348,7 @@ nsJSContext::InitContext(nsIScriptGlobal
      rv = xpc->InitClassesWithNewWrappedGlobal(mContext, aGlobalObject,
                                                NS_GET_IID(nsISupports),
                                                flags,
 -                                              getter_AddRefs(holder));
 +                                              &holder);
      NS_ENSURE_SUCCESS(rv, rv);
  
      // Now check whether we need to grab a pointer to the
-@@ -2368,15 +2367,15 @@
+@@ -2368,15 +2367,15 @@ nsJSContext::InitContext(nsIScriptGlobal
      rv = xpc->InitClasses(mContext, global);
      NS_ENSURE_SUCCESS(rv, rv);
  
 -    nsCOMPtr<nsIClassInfo> ci(do_QueryInterface(aGlobalObject));
 +    nsIClassInfo* ci(do_QueryInterface(aGlobalObject));
  
      if (ci) {
        rv = xpc->WrapNative(mContext, global, aGlobalObject,
@@ -1214,35 +1214,35 @@ diff --git a/dom/src/base/nsJSEnvironmen
 +                           &holder);
        NS_ENSURE_SUCCESS(rv, rv);
  
 -      nsCOMPtr<nsIXPConnectWrappedNative> wrapper(do_QueryInterface(holder));
 +      nsIXPConnectWrappedNative* wrapper(do_QueryInterface(holder));
        NS_ENSURE_TRUE(wrapper, NS_ERROR_FAILURE);
  
        rv = wrapper->RefreshPrototype();
-@@ -2452,7 +2451,7 @@
+@@ -2452,7 +2451,7 @@ nsJSContext::ConvertSupportsTojsvals(nsI
    nsresult rv = NS_OK;
  
    // If the array implements nsIJSArgArray, just grab the values directly.
 -  nsCOMPtr<nsIJSArgArray> fastArray = do_QueryInterface(aArgs);
 +  nsIJSArgArray* fastArray = do_QueryInterface(aArgs);
    if (fastArray != nsnull) {
      *aMarkp = nsnull;
      return fastArray->GetArgs(aArgc, aArgv);
-@@ -2473,7 +2472,7 @@
+@@ -2473,7 +2472,7 @@ nsJSContext::ConvertSupportsTojsvals(nsI
    PRUint32 argCtr, argCount;
    // This general purpose function may need to convert an arg array
    // (window.arguments, event-handler args) and a generic property.
 -  nsCOMPtr<nsIArray> argsArray(do_QueryInterface(aArgs));
 +  nsIArray* argsArray(do_QueryInterface(aArgs));
  
    if (argsArray) {
      rv = argsArray->GetLength(&argCount);
-@@ -2489,15 +2488,15 @@
+@@ -2489,15 +2488,15 @@ nsJSContext::ConvertSupportsTojsvals(nsI
  
    if (argsArray) {
      for (argCtr = 0; argCtr < argCount && NS_SUCCEEDED(rv); argCtr++) {
 -      nsCOMPtr<nsISupports> arg;
 +      nsISupports* arg = nsnull;
        jsval *thisval = argv + argCtr;
        argsArray->QueryElementAt(argCtr, NS_GET_IID(nsISupports),
 -                                getter_AddRefs(arg));
@@ -1251,17 +1251,17 @@ diff --git a/dom/src/base/nsJSEnvironmen
          *thisval = JSVAL_NULL;
          continue;
        }
 -      nsCOMPtr<nsIVariant> variant(do_QueryInterface(arg));
 +      nsIVariant* variant(do_QueryInterface(arg));
        if (variant != nsnull) {
          rv = xpc->VariantToJS(mContext, (JSObject *)aScope, variant, 
                                thisval);
-@@ -2512,14 +2511,14 @@
+@@ -2512,14 +2511,14 @@ nsJSContext::ConvertSupportsTojsvals(nsI
  #ifdef NS_DEBUG
            // but first, check its not another nsISupportsPrimitive, as
            // these are now deprecated for use with script contexts.
 -          nsCOMPtr<nsISupportsPrimitive> prim(do_QueryInterface(arg));
 +          nsISupportsPrimitive* prim(do_QueryInterface(arg));
            NS_ASSERTION(prim == nsnull,
                         "Don't pass nsISupportsPrimitives - use nsIVariant!");
  #endif
@@ -1269,134 +1269,134 @@ diff --git a/dom/src/base/nsJSEnvironmen
 +          nsIXPConnectJSObjectHolder* wrapper = nsnull;
            rv = xpc->WrapNative(mContext, (JSObject *)aScope, arg,
                                 NS_GET_IID(nsISupports),
 -                               getter_AddRefs(wrapper));
 +                               &wrapper);
            if (NS_SUCCEEDED(rv)) {
              JSObject *obj;
              rv = wrapper->GetJSObject(&obj);
-@@ -2531,7 +2530,7 @@
+@@ -2531,7 +2530,7 @@ nsJSContext::ConvertSupportsTojsvals(nsI
        }
      }
    } else {
 -    nsCOMPtr<nsIVariant> variant(do_QueryInterface(aArgs));
 +    nsIVariant* variant(do_QueryInterface(aArgs));
      if (variant)
        rv = xpc->VariantToJS(mContext, (JSObject *)aScope, variant, argv);
      else {
-@@ -2554,7 +2553,7 @@
+@@ -2554,7 +2553,7 @@ nsJSContext::AddSupportsPrimitiveTojsval
  {
    NS_PRECONDITION(aArg, "Empty arg");
  
 -  nsCOMPtr<nsISupportsPrimitive> argPrimitive(do_QueryInterface(aArg));
 +  nsISupportsPrimitive* argPrimitive(do_QueryInterface(aArg));
    if (!argPrimitive)
      return NS_ERROR_NO_INTERFACE;
  
-@@ -2564,7 +2563,7 @@
+@@ -2564,7 +2563,7 @@ nsJSContext::AddSupportsPrimitiveTojsval
  
    switch(type) {
      case nsISupportsPrimitive::TYPE_CSTRING : {
 -      nsCOMPtr<nsISupportsCString> p(do_QueryInterface(argPrimitive));
 +      nsISupportsCString* p(do_QueryInterface(argPrimitive));
        NS_ENSURE_TRUE(p, NS_ERROR_UNEXPECTED);
  
        nsCAutoString data;
-@@ -2580,7 +2579,7 @@
+@@ -2580,7 +2579,7 @@ nsJSContext::AddSupportsPrimitiveTojsval
        break;
      }
      case nsISupportsPrimitive::TYPE_STRING : {
 -      nsCOMPtr<nsISupportsString> p(do_QueryInterface(argPrimitive));
 +      nsISupportsString* p(do_QueryInterface(argPrimitive));
        NS_ENSURE_TRUE(p, NS_ERROR_UNEXPECTED);
  
        nsAutoString data;
-@@ -2599,7 +2598,7 @@
+@@ -2599,7 +2598,7 @@ nsJSContext::AddSupportsPrimitiveTojsval
        break;
      }
      case nsISupportsPrimitive::TYPE_PRBOOL : {
 -      nsCOMPtr<nsISupportsPRBool> p(do_QueryInterface(argPrimitive));
 +      nsISupportsPRBool* p(do_QueryInterface(argPrimitive));
        NS_ENSURE_TRUE(p, NS_ERROR_UNEXPECTED);
  
        PRBool data;
-@@ -2611,7 +2610,7 @@
+@@ -2611,7 +2610,7 @@ nsJSContext::AddSupportsPrimitiveTojsval
        break;
      }
      case nsISupportsPrimitive::TYPE_PRUINT8 : {
 -      nsCOMPtr<nsISupportsPRUint8> p(do_QueryInterface(argPrimitive));
 +      nsISupportsPRUint8* p(do_QueryInterface(argPrimitive));
        NS_ENSURE_TRUE(p, NS_ERROR_UNEXPECTED);
  
        PRUint8 data;
-@@ -2623,7 +2622,7 @@
+@@ -2623,7 +2622,7 @@ nsJSContext::AddSupportsPrimitiveTojsval
        break;
      }
      case nsISupportsPrimitive::TYPE_PRUINT16 : {
 -      nsCOMPtr<nsISupportsPRUint16> p(do_QueryInterface(argPrimitive));
 +      nsISupportsPRUint16* p(do_QueryInterface(argPrimitive));
        NS_ENSURE_TRUE(p, NS_ERROR_UNEXPECTED);
  
        PRUint16 data;
-@@ -2635,7 +2634,7 @@
+@@ -2635,7 +2634,7 @@ nsJSContext::AddSupportsPrimitiveTojsval
        break;
      }
      case nsISupportsPrimitive::TYPE_PRUINT32 : {
 -      nsCOMPtr<nsISupportsPRUint32> p(do_QueryInterface(argPrimitive));
 +      nsISupportsPRUint32* p(do_QueryInterface(argPrimitive));
        NS_ENSURE_TRUE(p, NS_ERROR_UNEXPECTED);
  
        PRUint32 data;
-@@ -2647,7 +2646,7 @@
+@@ -2647,7 +2646,7 @@ nsJSContext::AddSupportsPrimitiveTojsval
        break;
      }
      case nsISupportsPrimitive::TYPE_CHAR : {
 -      nsCOMPtr<nsISupportsChar> p(do_QueryInterface(argPrimitive));
 +      nsISupportsChar* p(do_QueryInterface(argPrimitive));
        NS_ENSURE_TRUE(p, NS_ERROR_UNEXPECTED);
  
        char data;
-@@ -2662,7 +2661,7 @@
+@@ -2662,7 +2661,7 @@ nsJSContext::AddSupportsPrimitiveTojsval
        break;
      }
      case nsISupportsPrimitive::TYPE_PRINT16 : {
 -      nsCOMPtr<nsISupportsPRInt16> p(do_QueryInterface(argPrimitive));
 +      nsISupportsPRInt16* p(do_QueryInterface(argPrimitive));
        NS_ENSURE_TRUE(p, NS_ERROR_UNEXPECTED);
  
        PRInt16 data;
-@@ -2674,7 +2673,7 @@
+@@ -2674,7 +2673,7 @@ nsJSContext::AddSupportsPrimitiveTojsval
        break;
      }
      case nsISupportsPrimitive::TYPE_PRINT32 : {
 -      nsCOMPtr<nsISupportsPRInt32> p(do_QueryInterface(argPrimitive));
 +      nsISupportsPRInt32* p(do_QueryInterface(argPrimitive));
        NS_ENSURE_TRUE(p, NS_ERROR_UNEXPECTED);
  
        PRInt32 data;
-@@ -2686,7 +2685,7 @@
+@@ -2686,7 +2685,7 @@ nsJSContext::AddSupportsPrimitiveTojsval
        break;
      }
      case nsISupportsPrimitive::TYPE_FLOAT : {
 -      nsCOMPtr<nsISupportsFloat> p(do_QueryInterface(argPrimitive));
 +      nsISupportsFloat* p(do_QueryInterface(argPrimitive));
        NS_ENSURE_TRUE(p, NS_ERROR_UNEXPECTED);
  
        float data;
-@@ -2700,7 +2699,7 @@
+@@ -2700,7 +2699,7 @@ nsJSContext::AddSupportsPrimitiveTojsval
        break;
      }
      case nsISupportsPrimitive::TYPE_DOUBLE : {
 -      nsCOMPtr<nsISupportsDouble> p(do_QueryInterface(argPrimitive));
 +      nsISupportsDouble* p(do_QueryInterface(argPrimitive));
        NS_ENSURE_TRUE(p, NS_ERROR_UNEXPECTED);
  
        double data;
-@@ -2714,25 +2713,25 @@
+@@ -2714,25 +2713,25 @@ nsJSContext::AddSupportsPrimitiveTojsval
        break;
      }
      case nsISupportsPrimitive::TYPE_INTERFACE_POINTER : {
 -      nsCOMPtr<nsISupportsInterfacePointer> p(do_QueryInterface(argPrimitive));
 +      nsISupportsInterfacePointer* p(do_QueryInterface(argPrimitive));
        NS_ENSURE_TRUE(p, NS_ERROR_UNEXPECTED);
  
 -      nsCOMPtr<nsISupports> data;
@@ -1418,80 +1418,80 @@ diff --git a/dom/src/base/nsJSEnvironmen
 -      nsCOMPtr<nsIXPConnectJSObjectHolder> wrapper;
 +      nsIXPConnectJSObjectHolder* wrapper = nsnull;
        rv = xpc->WrapNative(cx, ::JS_GetGlobalObject(cx), data,
 -                           *iid, getter_AddRefs(wrapper));
 +                           *iid, &wrapper);
        NS_ENSURE_SUCCESS(rv, rv);
  
        JSObject *obj;
-@@ -3475,11 +3474,10 @@
+@@ -3475,11 +3474,10 @@ nsresult
  nsresult
  nsJSRuntime::CreateContext(nsIScriptContext **aContext)
  {
 -  nsCOMPtr<nsIScriptContext> scriptContext;
 +  nsIScriptContext* scriptContext = nsnull;
  
    *aContext = new nsJSContext(sRuntime);
    NS_ENSURE_TRUE(*aContext, NS_ERROR_OUT_OF_MEMORY);
 -  NS_ADDREF(*aContext);
    return NS_OK;
  }
  
-@@ -3562,10 +3560,10 @@
+@@ -3570,10 +3568,10 @@ ObjectPrincipalFinder(JSContext *cx, JSO
    if (!sSecurityManager)
      return nsnull;
  
 -  nsCOMPtr<nsIPrincipal> principal;
 +  nsIPrincipal* principal = nsnull;
    nsresult rv =
      sSecurityManager->GetObjectPrincipal(cx, obj,
 -                                         getter_AddRefs(principal));
 +                                         &principal);
  
    if (NS_FAILED(rv) || !principal) {
      return nsnull;
-@@ -3741,7 +3739,6 @@
+@@ -3755,7 +3753,6 @@ nsresult NS_CreateJSRuntime(nsIScriptRun
    *aRuntime = new nsJSRuntime();
    if (*aRuntime == nsnull)
      return NS_ERROR_OUT_OF_MEMORY;
 -  NS_IF_ADDREF(*aRuntime);
    return NS_OK;
  }
  
-@@ -3751,7 +3748,7 @@
+@@ -3765,7 +3762,7 @@ nsresult NS_CreateJSRuntime(nsIScriptRun
  // to/from nsISupports.
  // When consumed by non-JS (eg, another script language), conversion is done
  // on-the-fly.
 -class nsJSArgArray : public nsIJSArgArray, public nsIArray {
 +class nsJSArgArray : public XPCOMGCFinalizedObject, public nsIJSArgArray, public nsIArray {
  public:
    nsJSArgArray(JSContext *aContext, PRUint32 argc, jsval *argv, nsresult *prv);
    ~nsJSArgArray();
-@@ -3880,7 +3877,6 @@
+@@ -3894,7 +3891,6 @@ nsresult NS_CreateJSArgv(JSContext *aCon
    if (ret == nsnull)
      return NS_ERROR_OUT_OF_MEMORY;
    if (NS_FAILED(rv)) {
 -    delete ret;
      return rv;
    }
    return ret->QueryInterface(NS_GET_IID(nsIArray), (void **)aArray);
 diff --git a/dom/src/base/nsJSTimeoutHandler.cpp b/dom/src/base/nsJSTimeoutHandler.cpp
 --- a/dom/src/base/nsJSTimeoutHandler.cpp
 +++ b/dom/src/base/nsJSTimeoutHandler.cpp
-@@ -55,7 +55,7 @@
+@@ -55,7 +55,7 @@ static const char kSetTimeoutStr[] = "se
  static const char kSetTimeoutStr[] = "setTimeout";
  
  // Our JS nsIScriptTimeoutHandler implementation.
 -class nsJSScriptTimeoutHandler: public nsIScriptTimeoutHandler
 +class nsJSScriptTimeoutHandler: public XPCOMGCFinalizedObject, public nsIScriptTimeoutHandler
  {
  public:
    // nsISupports
-@@ -254,16 +254,16 @@
+@@ -254,16 +254,16 @@ nsJSScriptTimeoutHandler::Init(nsGlobalW
      // Create our arg array - leave an extra slot for a secret final argument
      // that indicates to the called function how "late" the timeout is.  We
      // will fill that in when SetLateness is called.
 -    nsCOMPtr<nsIArray> array;
 +    nsIArray* array = nsnull;
      rv = NS_CreateJSArgv(cx, (argc > 1) ? argc - 1 : argc, nsnull,
 -                         getter_AddRefs(array));
 +                         &array);
@@ -1501,193 +1501,193 @@ diff --git a/dom/src/base/nsJSTimeoutHan
  
      PRUint32 dummy;
      jsval *jsargv = nsnull;
 -    nsCOMPtr<nsIJSArgArray> jsarray(do_QueryInterface(array));
 +    nsIJSArgArray* jsarray(do_QueryInterface(array));
      jsarray->GetArgs(&dummy, reinterpret_cast<void **>(&jsargv));
  
      // must have worked - we own the impl! :)
-@@ -282,7 +282,7 @@
+@@ -282,7 +282,7 @@ nsJSScriptTimeoutHandler::Init(nsGlobalW
  
  void nsJSScriptTimeoutHandler::SetLateness(PRIntervalTime aHowLate)
  {
 -  nsCOMPtr<nsIJSArgArray> jsarray(do_QueryInterface(mArgv));
 +  nsIJSArgArray* jsarray(do_QueryInterface(mArgv));
    if (jsarray) {
      PRUint32 argc;
      jsval *jsargv;
-@@ -314,11 +314,10 @@
+@@ -314,11 +314,10 @@ nsresult NS_CreateJSTimeoutHandler(nsGlo
  
    nsresult rv = handler->Init(aWindow, aIsInterval, aInterval);
    if (NS_FAILED(rv)) {
 -    delete handler;
      return rv;
    }
  
 -  NS_ADDREF(*aRet = handler);
 +  *aRet = handler;
  
    return NS_OK;
  }
 diff --git a/editor/libeditor/html/nsHTMLURIRefObject.cpp b/editor/libeditor/html/nsHTMLURIRefObject.cpp
 --- a/editor/libeditor/html/nsHTMLURIRefObject.cpp
 +++ b/editor/libeditor/html/nsHTMLURIRefObject.cpp
-@@ -141,7 +141,7 @@
+@@ -141,7 +141,7 @@ nsHTMLURIRefObject::GetNextURI(nsAString
    // Loop over attribute list:
    if (!mAttributes)
    {
 -    nsCOMPtr<nsIDOMElement> element (do_QueryInterface(mNode));
 +    nsIDOMElement* element (do_QueryInterface(mNode));
      if (!element)
        return NS_ERROR_INVALID_ARG;
  
-@@ -161,13 +161,13 @@
+@@ -161,13 +161,13 @@ nsHTMLURIRefObject::GetNextURI(nsAString
  #endif
    while (mCurAttrIndex < mAttributeCnt)
    {
 -    nsCOMPtr<nsIDOMNode> attrNode;
 -    rv = mAttributes->Item(mCurAttrIndex++, getter_AddRefs(attrNode));
 +    nsIDOMNode* attrNode = nsnull;
 +    rv = mAttributes->Item(mCurAttrIndex++, &attrNode);
        // XXX Does Item() addref, or not?
        // The comparable code in nsEditor assumes it doesn't.
      NS_ENSURE_SUCCESS(rv, rv);
      NS_ENSURE_ARG_POINTER(attrNode);
 -    nsCOMPtr<nsIDOMAttr> curAttrNode (do_QueryInterface(attrNode));
 +    nsIDOMAttr* curAttrNode (do_QueryInterface(attrNode));
      NS_ENSURE_ARG_POINTER(curAttrNode);
      nsString curAttr;
      rv = curAttrNode->GetName(curAttr);
-@@ -295,7 +295,6 @@
+@@ -295,7 +295,6 @@ nsHTMLURIRefObject::GetNode(nsIDOMNode**
    if (!aNode)
      return NS_ERROR_NULL_POINTER;
    *aNode = mNode.get();
 -  NS_ADDREF(*aNode);
    return NS_OK;
  }
  
-@@ -323,7 +322,6 @@
+@@ -323,7 +322,6 @@ nsresult NS_NewHTMLURIRefObject(nsIURIRe
    nsresult rv = refObject->SetNode(aNode);
    if (NS_FAILED(rv)) {
      *aResult = 0;
 -    delete refObject;
      return rv;
    }
    return refObject->QueryInterface(NS_GET_IID(nsIURIRefObject),
 diff --git a/gfx/thebes/src/gfxTextRunCache.cpp b/gfx/thebes/src/gfxTextRunCache.cpp
 --- a/gfx/thebes/src/gfxTextRunCache.cpp
 +++ b/gfx/thebes/src/gfxTextRunCache.cpp
-@@ -131,6 +131,5 @@
+@@ -131,6 +131,5 @@ void
  void
  gfxTextRunCache::Shutdown()
  {
 -    delete gTextRunCache;
      gTextRunCache = nsnull;
  }
 diff --git a/intl/uconv/src/nsUTF8ToUnicode.cpp b/intl/uconv/src/nsUTF8ToUnicode.cpp
 --- a/intl/uconv/src/nsUTF8ToUnicode.cpp
 +++ b/intl/uconv/src/nsUTF8ToUnicode.cpp
-@@ -59,7 +59,6 @@
+@@ -59,7 +59,6 @@ NS_IMETHODIMP NS_NewUTF8ToUnicode(nsISup
    nsresult res = inst->QueryInterface(aIID, aResult);
    if (NS_FAILED(res)) {
      *aResult = nsnull;
 -    delete inst;
    }
    return res;
  }
 diff --git a/js/src/xpconnect/loader/mozJSComponentLoader.cpp b/js/src/xpconnect/loader/mozJSComponentLoader.cpp
 --- a/js/src/xpconnect/loader/mozJSComponentLoader.cpp
 +++ b/js/src/xpconnect/loader/mozJSComponentLoader.cpp
-@@ -129,7 +129,7 @@
+@@ -129,7 +129,7 @@ mozJSLoaderErrorReporter(JSContext *cx, 
      nsresult rv;
  
      /* Use the console service to register the error. */
 -    nsCOMPtr<nsIConsoleService> consoleService =
 +    nsIConsoleService* consoleService =
          do_GetService(NS_CONSOLESERVICE_CONTRACTID);
  
      /*
-@@ -137,7 +137,7 @@
+@@ -137,7 +137,7 @@ mozJSLoaderErrorReporter(JSContext *cx, 
       * error, then log it with the console service.  The UI can then
       * poll the service to update the Error console.
       */
 -    nsCOMPtr<nsIScriptError> errorObject = 
 +    nsIScriptError* errorObject = 
          do_CreateInstance(NS_SCRIPTERROR_CONTRACTID);
      
      if (consoleService && errorObject) {
-@@ -319,8 +319,8 @@
+@@ -319,8 +319,8 @@ nsXPCFastLoadIO::GetInputStream(nsIInput
  nsXPCFastLoadIO::GetInputStream(nsIInputStream **_retval)
  {
      if (! mInputStream) {
 -        nsCOMPtr<nsIInputStream> fileInput;
 -        nsresult rv = NS_NewLocalFileInputStream(getter_AddRefs(fileInput),
 +        nsIInputStream* fileInput = nsnull;
 +        nsresult rv = NS_NewLocalFileInputStream(&fileInput,
                                                   mFile);
          NS_ENSURE_SUCCESS(rv, rv);
  
-@@ -343,8 +343,8 @@
+@@ -343,8 +343,8 @@ nsXPCFastLoadIO::GetOutputStream(nsIOutp
              ioFlags |= PR_CREATE_FILE | PR_TRUNCATE;
          }
  
 -        nsCOMPtr<nsIOutputStream> fileOutput;
 -        nsresult rv = NS_NewLocalFileOutputStream(getter_AddRefs(fileOutput),
 +        nsIOutputStream* fileOutput = nsnull;
 +        nsresult rv = NS_NewLocalFileOutputStream(&fileOutput,
                                                    mFile, ioFlags, 0644);
          NS_ENSURE_SUCCESS(rv, rv);
  
-@@ -542,7 +542,7 @@
+@@ -542,7 +542,7 @@ mozJSComponentLoader::ReallyInit()
      JS_SetThreadStackLimit(mContext, stackLimit);
  
  #ifndef XPCONNECT_STANDALONE
 -    nsCOMPtr<nsIScriptSecurityManager> secman = 
 +    nsIScriptSecurityManager* secman = 
          do_GetService(NS_SCRIPTSECURITYMANAGER_CONTRACTID);
      if (!secman)
          return NS_ERROR_FAILURE;
-@@ -560,7 +560,7 @@
+@@ -560,7 +560,7 @@ mozJSComponentLoader::ReallyInit()
          return NS_ERROR_OUT_OF_MEMORY;
  
      // Set up our fastload file
 -    nsCOMPtr<nsIFastLoadService> flSvc = do_GetFastLoadService(&rv);
 +    nsIFastLoadService* flSvc = do_GetFastLoadService(&rv);
      if (NS_SUCCEEDED(rv))
          rv = flSvc->NewFastLoadFile("XPC", getter_AddRefs(mFastLoadFile));
      if (NS_FAILED(rv)) {
-@@ -569,7 +569,7 @@
+@@ -569,7 +569,7 @@ mozJSComponentLoader::ReallyInit()
  
      // Listen for xpcom-shutdown so that we can close out our fastload file
      // at that point (after that we can no longer create an input stream).
 -    nsCOMPtr<nsIObserverService> obsSvc =
 +    nsIObserverService* obsSvc =
          do_GetService(kObserverServiceContractID, &rv);
      NS_ENSURE_SUCCESS(rv, rv);
  
-@@ -604,7 +604,7 @@
+@@ -604,7 +604,7 @@ mozJSComponentLoader::LoadModule(nsILoca
              return rv;
      }
  
 -    nsCOMPtr<nsIHashable> lfhash(do_QueryInterface(aComponentFile));
 +    nsIHashable* lfhash(do_QueryInterface(aComponentFile));
      if (!lfhash) {
          NS_ERROR("nsLocalFile not implementing nsIHashable");
          return NS_NOINTERFACE;
-@@ -617,7 +617,7 @@
+@@ -617,7 +617,7 @@ mozJSComponentLoader::LoadModule(nsILoca
          return NS_OK;
      }
  
 -    nsAutoPtr<ModuleEntry> entry(new ModuleEntry);
 +    ModuleEntry *entry(new ModuleEntry);
      if (!entry)
          return NS_ERROR_OUT_OF_MEMORY;
  
-@@ -629,23 +629,23 @@
+@@ -629,23 +629,23 @@ mozJSComponentLoader::LoadModule(nsILoca
          return rv;
      }
  
 -    nsCOMPtr<nsIXPConnect> xpc = do_GetService(kXPConnectServiceContractID,
 +    nsIXPConnect* xpc = do_GetService(kXPConnectServiceContractID,
                                                 &rv);
      if (NS_FAILED(rv))
          return rv;
@@ -1706,49 +1706,49 @@ diff --git a/js/src/xpconnect/loader/moz
 +    nsIXPConnectJSObjectHolder* cm_holder = nsnull;
      rv = xpc->WrapNative(cx, entry->global, cm, 
                           NS_GET_IID(nsIComponentManager),
 -                         getter_AddRefs(cm_holder));
 +                         &cm_holder);
  
      if (NS_FAILED(rv)) {
  #ifdef DEBUG_shaver
-@@ -664,10 +664,10 @@
+@@ -664,10 +664,10 @@ mozJSComponentLoader::LoadModule(nsILoca
      }
  
      JSObject* file_jsobj;
 -    nsCOMPtr<nsIXPConnectJSObjectHolder> file_holder;
 +    nsIXPConnectJSObjectHolder* file_holder = nsnull;
      rv = xpc->WrapNative(cx, entry->global, aComponentFile, 
                           NS_GET_IID(nsIFile),
 -                         getter_AddRefs(file_holder));
 +                         &file_holder);
  
      if (NS_FAILED(rv)) {
          return rv;
-@@ -730,9 +730,6 @@
+@@ -730,9 +730,6 @@ mozJSComponentLoader::LoadModule(nsILoca
          return NS_ERROR_OUT_OF_MEMORY;
  
      NS_ADDREF(*aResult = entry->module);
 -
 -    // The hash owns the ModuleEntry now, forget about it
 -    entry.forget();
  
      return NS_OK;
  }
-@@ -836,7 +833,7 @@
+@@ -836,7 +833,7 @@ mozJSComponentLoader::CloseFastLoad()
      if (mFastLoadOutput) {
          nsresult rv = mFastLoadOutput->Close();
          if (NS_SUCCEEDED(rv)) {
 -            nsCOMPtr<nsIFastLoadService> flSvc = do_GetFastLoadService(&rv);
 +            nsIFastLoadService* flSvc = do_GetFastLoadService(&rv);
              if (NS_SUCCEEDED(rv)) {
                  flSvc->CacheChecksum(mFastLoadFile, mFastLoadOutput);
              }
-@@ -875,15 +872,15 @@
+@@ -875,15 +872,15 @@ mozJSComponentLoader::StartFastLoad(nsIF
          if (exists) {
              LOG(("trying to use existing fastload file\n"));
  
 -            nsCOMPtr<nsIInputStream> input;
 -            rv = mFastLoadIO->GetInputStream(getter_AddRefs(input));
 +            nsIInputStream* input = nsnull;
 +            rv = mFastLoadIO->GetInputStream(&input);
              NS_ENSURE_SUCCESS(rv, rv);
@@ -1757,115 +1757,115 @@ diff --git a/js/src/xpconnect/loader/moz
              if (NS_SUCCEEDED(rv)) {
                  LOG(("opened fastload file for reading\n"));
  
 -                nsCOMPtr<nsIFastLoadReadControl>
 +                nsIFastLoadReadControl*
                      readControl(do_QueryInterface(mFastLoadInput));
                  if (readControl) {
                      // Verify checksum, using the FastLoadService's
-@@ -929,8 +926,8 @@
+@@ -929,8 +926,8 @@ mozJSComponentLoader::StartFastLoad(nsIF
          if (!exists) {
              LOG(("Creating new fastload file\n"));
  
 -            nsCOMPtr<nsIOutputStream> output;
 -            rv = mFastLoadIO->GetOutputStream(getter_AddRefs(output));
 +            nsIOutputStream* output = nsnull;
 +            rv = mFastLoadIO->GetOutputStream(&output);
              NS_ENSURE_SUCCESS(rv, rv);
  
              rv = flSvc->NewOutputStream(output,
-@@ -992,8 +989,8 @@
+@@ -992,8 +989,8 @@ mozJSComponentLoader::ReadScript(nsIFast
  
      LOG(("Found %s in fastload file\n", nativePath));
  
 -    nsCOMPtr<nsIURI> oldURI;
 -    rv = flSvc->SelectMuxedDocument(uri, getter_AddRefs(oldURI));
 +    nsIURI* oldURI = nsnull;
 +    rv = flSvc->SelectMuxedDocument(uri, (class nsISupports**)&oldURI);
      NS_ENSURE_SUCCESS(rv, rv);
  
      NS_ASSERTION(mFastLoadInput,
-@@ -1033,8 +1030,8 @@
+@@ -1033,8 +1030,8 @@ mozJSComponentLoader::WriteScript(nsIFas
                                     nsIFastLoadService::NS_FASTLOAD_WRITE);
      NS_ENSURE_SUCCESS(rv, rv);
  
 -    nsCOMPtr<nsIURI> oldURI;
 -    rv = flSvc->SelectMuxedDocument(uri, getter_AddRefs(oldURI));
 +    nsIURI* oldURI = nsnull;
 +    rv = flSvc->SelectMuxedDocument(uri, (class nsISupports**)&oldURI);
      NS_ENSURE_SUCCESS(rv, rv);
  
      rv = WriteScriptToStream(cx, script, mFastLoadOutput);
-@@ -1059,13 +1056,13 @@
+@@ -1059,13 +1056,13 @@ mozJSComponentLoader::GlobalForLocation(
      JSPrincipalsHolder princHolder(mContext, jsPrincipals);
  #endif
  
 -    nsCOMPtr<nsIXPCScriptable> backstagePass;
 -    rv = mRuntimeService->GetBackstagePass(getter_AddRefs(backstagePass));
 +    nsIXPCScriptable* backstagePass = nsnull;
 +    rv = mRuntimeService->GetBackstagePass(&backstagePass);
      NS_ENSURE_SUCCESS(rv, rv);
  
      JSCLAutoErrorReporterSetter aers(cx, mozJSLoaderErrorReporter);
  
 -    nsCOMPtr<nsIXPConnect> xpc =
 +    nsIXPConnect* xpc =
          do_GetService(kXPConnectServiceContractID, &rv);
      NS_ENSURE_SUCCESS(rv, rv);
  
-@@ -1073,12 +1070,12 @@
+@@ -1073,12 +1070,12 @@ mozJSComponentLoader::GlobalForLocation(
      // backstage pass as the global in our compilation context.
      JS_SetGlobalObject(cx, nsnull);
  
 -    nsCOMPtr<nsIXPConnectJSObjectHolder> holder;
 +    nsIXPConnectJSObjectHolder* holder = nsnull;
      rv = xpc->InitClassesWithNewWrappedGlobal(cx, backstagePass,
                                                NS_GET_IID(nsISupports),
                                                nsIXPConnect::
                                                    FLAG_SYSTEM_GLOBAL_OBJECT,
 -                                              getter_AddRefs(holder));
 +                                              &holder);
      NS_ENSURE_SUCCESS(rv, rv);
  
      JSObject *global;
-@@ -1089,10 +1086,10 @@
+@@ -1089,10 +1086,10 @@ mozJSComponentLoader::GlobalForLocation(
          return NS_ERROR_FAILURE;
      }
  
 -    nsCOMPtr<nsIXPConnectJSObjectHolder> locationHolder;
 +    nsIXPConnectJSObjectHolder* locationHolder = nsnull;
      rv = xpc->WrapNative(cx, global, aComponent,
                           NS_GET_IID(nsILocalFile),
 -                         getter_AddRefs(locationHolder));
 +                         &locationHolder);
      NS_ENSURE_SUCCESS(rv, rv);
  
      JSObject *locationObj;
-@@ -1118,7 +1115,7 @@
+@@ -1118,7 +1115,7 @@ mozJSComponentLoader::GlobalForLocation(
      // Before compiling the script, first check to see if we have it in
      // the fastload file.  Note: as a rule, fastload errors are not fatal
      // to loading the script, since we can always slow-load.
 -    nsCOMPtr<nsIFastLoadService> flSvc = do_GetFastLoadService(&rv);
 +    nsIFastLoadService* flSvc = do_GetFastLoadService(&rv);
  
      // Save the old state and restore it upon return
      FastLoadStateHolder flState(flSvc);
-@@ -1131,8 +1128,8 @@
+@@ -1131,8 +1128,8 @@ mozJSComponentLoader::GlobalForLocation(
          }
      }
  
 -    nsCOMPtr<nsIURI> uri;
 -    rv = NS_NewURI(getter_AddRefs(uri), nativePath);
 +    nsIURI* uri = nsnull;
 +    rv = NS_NewURI(&uri, nativePath);
      NS_ENSURE_SUCCESS(rv, rv);
  
      JSScript *script = nsnull;
-@@ -1151,14 +1148,14 @@
+@@ -1151,14 +1148,14 @@ mozJSComponentLoader::GlobalForLocation(
  
              // Remove the fastload file, it may be corrupted.
              LOG(("Invalid fastload file detected, removing it\n"));
 -            nsCOMPtr<nsIObjectOutputStream> objectOutput;
 -            flSvc->GetOutputStream(getter_AddRefs(objectOutput));
 +            nsIObjectOutputStream* objectOutput = nsnull;
 +            flSvc->GetOutputStream(&objectOutput);
              if (objectOutput) {
@@ -1874,57 +1874,57 @@ diff --git a/js/src/xpconnect/loader/moz
              }
 -            nsCOMPtr<nsIObjectInputStream> objectInput;
 -            flSvc->GetInputStream(getter_AddRefs(objectInput));
 +            nsIObjectInputStream* objectInput = nsnull;
 +            flSvc->GetInputStream(&objectInput);
              if (objectInput) {
                  flSvc->SetInputStream(nsnull);
                  objectInput->Close();
-@@ -1327,7 +1324,7 @@
+@@ -1327,7 +1324,7 @@ mozJSComponentLoader::Import(const nsACS
      // This function should only be called from JS.
      nsresult rv;
  
 -    nsCOMPtr<nsIXPConnect> xpc =
 +    nsIXPConnect* xpc =
          do_GetService(kXPConnectServiceContractID, &rv);
      NS_ENSURE_SUCCESS(rv, rv);
      
-@@ -1338,8 +1335,8 @@
+@@ -1338,8 +1335,8 @@ mozJSComponentLoader::Import(const nsACS
  #ifdef DEBUG
      {
      // ensure that we are being call from JS, from this method
 -    nsCOMPtr<nsIInterfaceInfo> info;
 -    rv = cc->GetCalleeInterface(getter_AddRefs(info));
 +    nsIInterfaceInfo* info = nsnull;
 +    rv = cc->GetCalleeInterface(&info);
      NS_ENSURE_SUCCESS(rv, rv);
      nsXPIDLCString name;
      info->GetName(getter_Copies(name));
-@@ -1382,8 +1379,8 @@
+@@ -1382,8 +1379,8 @@ mozJSComponentLoader::Import(const nsACS
          // Our targetObject is the caller's global object. Find it by
          // walking the calling object's parent chain.
  
 -        nsCOMPtr<nsIXPConnectWrappedNative> wn;
 -        rv = cc->GetCalleeWrapper(getter_AddRefs(wn));
 +        nsIXPConnectWrappedNative* wn = nsnull;
 +        rv = cc->GetCalleeWrapper(&wn);
          NS_ENSURE_SUCCESS(rv, rv);
          
          wn->GetJSObject(&targetObject);
-@@ -1422,7 +1419,7 @@
+@@ -1422,7 +1419,7 @@ mozJSComponentLoader::ImportInto(const n
          NS_ENSURE_SUCCESS(rv, rv);
      }
      
 -    nsCOMPtr<nsIIOService> ioService = do_GetIOService(&rv);
 +    nsIIOService* ioService = do_GetIOService(&rv);
      NS_ENSURE_SUCCESS(rv, rv);
  
      // Get the URI.
-@@ -1433,20 +1430,20 @@
+@@ -1433,20 +1430,20 @@ mozJSComponentLoader::ImportInto(const n
      NS_ENSURE_SUCCESS(rv, NS_ERROR_INVALID_ARG);
  
      // Get the file belonging to it.
 -    nsCOMPtr<nsIFile> file;
 -    rv = fileURL->GetFile(getter_AddRefs(file));
 +    nsIFile* file = nsnull;
 +    rv = fileURL->GetFile(&file);
      NS_ENSURE_SUCCESS(rv, rv);
@@ -1940,28 +1940,28 @@ diff --git a/js/src/xpconnect/loader/moz
      }
  
      ModuleEntry* mod;
 -    nsAutoPtr<ModuleEntry> newEntry;
 +    ModuleEntry* newEntry = nsnull;
      if (!mImports.Get(lfhash, &mod) && !mInProgressImports.Get(lfhash, &mod)) {
          newEntry = new ModuleEntry;
          if (!newEntry || !mInProgressImports.Put(lfhash, newEntry))
-@@ -1539,7 +1536,6 @@
+@@ -1539,7 +1536,6 @@ mozJSComponentLoader::ImportInto(const n
      if (newEntry) {
          if (!mImports.Put(lfhash, newEntry))
              return NS_ERROR_OUT_OF_MEMORY;
 -        newEntry.forget();
      }
      
      return NS_OK;
 diff --git a/js/src/xpconnect/src/xpcjsruntime.cpp b/js/src/xpconnect/src/xpcjsruntime.cpp
 --- a/js/src/xpconnect/src/xpcjsruntime.cpp
 +++ b/js/src/xpconnect/src/xpcjsruntime.cpp
-@@ -158,16 +158,6 @@
+@@ -158,16 +158,6 @@ JSClassSweeper(JSDHashTable *table, JSDH
  #endif
  
      delete shared;
 -    return JS_DHASH_REMOVE;
 -}
 -
 -JS_STATIC_DLL_CALLBACK(JSDHashOperator)
 -DyingProtoKiller(JSDHashTable *table, JSDHashEntryHdr *hdr,
@@ -1971,235 +1971,224 @@ diff --git a/js/src/xpconnect/src/xpcjsr
 -        (XPCWrappedNativeProto*)((JSDHashEntryStub*)hdr)->key;
 -    delete proto;
      return JS_DHASH_REMOVE;
  }
  
 diff --git a/js/src/xpconnect/src/xpcwrappednative.cpp b/js/src/xpconnect/src/xpcwrappednative.cpp
 --- a/js/src/xpconnect/src/xpcwrappednative.cpp
 +++ b/js/src/xpconnect/src/xpcwrappednative.cpp
-@@ -214,7 +214,7 @@
+@@ -214,7 +214,7 @@ XPCWrappedNative::GetNewOrUsed(XPCCallCo
      NS_ASSERTION(!Scope->GetRuntime()->GetThreadRunningGC(), 
                   "XPCWrappedNative::GetNewOrUsed called during GC");
  
 -    nsCOMPtr<nsISupports> identity;
 +    nsISupports* identity = nsnull;
  #ifdef XPC_IDISPATCH_SUPPORT
      // XXX This is done for the benefit of some warped COM implementations
      // where QI(IID_IUnknown, a.b) == QI(IID_IUnknown, a). If someone passes
-@@ -275,7 +275,7 @@
+@@ -275,7 +275,7 @@ XPCWrappedNative::GetNewOrUsed(XPCCallCo
      // of that class.
      JSBool isClassInfo = Interface->GetIID()->Equals(NS_GET_IID(nsIClassInfo));
  
 -    nsCOMPtr<nsIClassInfo> info;
 +    nsIClassInfo* info = nsnull;
  
      if(!isClassInfo)
          info = do_QueryInterface(identity);
-@@ -301,7 +301,7 @@
+@@ -301,7 +301,7 @@ XPCWrappedNative::GetNewOrUsed(XPCCallCo
      // described by the nsIClassInfo, not for the class info object
      // itself.
      if(!isClassInfo &&
 -       NS_FAILED(GatherScriptableCreateInfo(identity, info.get(),
 +       NS_FAILED(GatherScriptableCreateInfo(identity, info,
                                              &sciProto, &sciWrapper)))
          return NS_ERROR_FAILURE;
  
-@@ -481,7 +481,7 @@
+@@ -481,7 +481,7 @@ XPCWrappedNative::GetUsedOnly(XPCCallCon
                                XPCWrappedNative** resultWrapper)
  {
      NS_ASSERTION(Object, "XPCWrappedNative::GetUsedOnly was called with a null Object");
 -    nsCOMPtr<nsISupports> identity;
 +    nsISupports* identity = nsnull;
  #ifdef XPC_IDISPATCH_SUPPORT
      // XXX See GetNewOrUsed for more info on this
      if(Interface->GetIID()->Equals(NSID_IDISPATCH))
-@@ -584,13 +584,13 @@
+@@ -584,13 +584,13 @@ XPCWrappedNative::GatherProtoScriptableC
      NS_ASSERTION(classInfo, "bad param");
      NS_ASSERTION(sciProto && !sciProto->GetCallback(), "bad param");
  
 -    nsCOMPtr<nsISupports> possibleHelper;
 +    nsISupports* possibleHelper = nsnull;
      nsresult rv = classInfo->GetHelperForLanguage(
                                      nsIProgrammingLanguage::JAVASCRIPT,
 -                                    getter_AddRefs(possibleHelper));
 +                                    &possibleHelper);
      if(NS_SUCCEEDED(rv) && possibleHelper)
      {
 -        nsCOMPtr<nsIXPCScriptable> helper(do_QueryInterface(possibleHelper));
 +        nsIXPCScriptable* helper(do_QueryInterface(possibleHelper));
          if(helper)
          {
              JSUint32 flags;
-@@ -629,7 +629,7 @@
+@@ -629,7 +629,7 @@ XPCWrappedNative::GatherScriptableCreate
      }
  
      // Do the same for the wrapper specific scriptable
 -    nsCOMPtr<nsIXPCScriptable> helper(do_QueryInterface(obj));
 +    nsIXPCScriptable* helper(do_QueryInterface(obj));
      if(helper)
      {
          JSUint32 flags;
-@@ -905,7 +905,6 @@
+@@ -905,7 +905,6 @@ XPCWrappedNative::FlatJSObjectFinalized(
             (!HasProto() ||
              (proto && proto->GetScriptableInfo() != mScriptableInfo)))
          {
 -            delete mScriptableInfo;
              mScriptableInfo = nsnull;
          }
  
-@@ -954,13 +953,6 @@
+@@ -954,13 +953,6 @@ XPCWrappedNative::SystemIsBeingShutDown(
  
      if(HasProto())
          proto->SystemIsBeingShutDown(cx);
 -
 -    if(mScriptableInfo &&
 -       (!HasProto() ||
 -        (proto && proto->GetScriptableInfo() != mScriptableInfo)))
 -    {
 -        delete mScriptableInfo;
 -    }
  
      // cleanup the tearoffs...
  
-@@ -1438,8 +1430,8 @@
+@@ -1438,8 +1430,8 @@ XPCWrappedNative::InitTearOff(XPCCallCon
          // Guard against trying to build a tearoff for a shared nsIClassInfo.
          if(iid->Equals(NS_GET_IID(nsIClassInfo)))
          {
 -            nsCOMPtr<nsISupports> alternate_identity(do_QueryInterface(obj));
 -            if(alternate_identity.get() != identity)
 +            nsISupports* alternate_identity(do_QueryInterface(obj));
 +            if(alternate_identity != identity)
              {
                  NS_RELEASE(obj);
                  aTearOff->SetInterface(nsnull);
-@@ -1463,7 +1455,7 @@
+@@ -1463,7 +1455,7 @@ XPCWrappedNative::InitTearOff(XPCCallCon
          // The code in this block also does a check for the double wrapped
          // nsIPropertyBag case.
  
 -        nsCOMPtr<nsIXPConnectWrappedJS> wrappedJS(do_QueryInterface(obj));
 +        nsIXPConnectWrappedJS* wrappedJS(do_QueryInterface(obj));
          if(wrappedJS)
          {
              JSObject* jso = nsnull;
-@@ -2428,7 +2420,7 @@
+@@ -2428,7 +2420,7 @@ XPCWrappedNative::GetObjectPrincipal() c
  {
      nsIPrincipal* principal = GetScope()->GetPrincipal();
  #ifdef DEBUG
 -    nsCOMPtr<nsIScriptObjectPrincipal> objPrin(do_QueryInterface(mIdentity));
 +    nsIScriptObjectPrincipal* objPrin(do_QueryInterface(mIdentity));
      NS_ASSERTION(!objPrin || objPrin->GetPrincipal() == principal,
                   "Principal mismatch.  Expect bad things to happen");
  #endif
-@@ -2713,8 +2705,8 @@
+@@ -2713,8 +2705,8 @@ XPCWrappedNative::HandlePossibleNameCase
              if(e)
              {
                  nsresult rv;
 -                nsCOMPtr<nsIStackFrame> loc = nsnull;
 -                rv = e->GetLocation(getter_AddRefs(loc));
 +                nsIStackFrame* loc = nsnull;
 +                rv = e->GetLocation(&loc);
                  if(NS_SUCCEEDED(rv) && loc) {
                      loc->ToString(&locationStr); // failure here leaves it nsnull.
                  }
 diff --git a/js/src/xpconnect/src/xpcwrappednativeproto.cpp b/js/src/xpconnect/src/xpcwrappednativeproto.cpp
 --- a/js/src/xpconnect/src/xpcwrappednativeproto.cpp
 +++ b/js/src/xpconnect/src/xpcwrappednativeproto.cpp
-@@ -81,8 +81,6 @@
+@@ -81,8 +81,6 @@ XPCWrappedNativeProto::~XPCWrappedNative
      // Note that our weak ref to mScope is not to be trusted at this point.
  
      XPCNativeSet::ClearCacheEntryForClassInfo(mClassInfo);
 -
 -    delete mScriptableInfo;
  }
  
  JSBool
 diff --git a/layout/generic/nsTextFrameThebes.cpp b/layout/generic/nsTextFrameThebes.cpp
 --- a/layout/generic/nsTextFrameThebes.cpp
 +++ b/layout/generic/nsTextFrameThebes.cpp
-@@ -430,7 +430,6 @@
+@@ -433,7 +433,6 @@ nsTextFrameTextRunCache::Init() {
  
  void
  nsTextFrameTextRunCache::Shutdown() {
 -    delete gTextRuns;
      gTextRuns = nsnull;
  }
  
-@@ -1264,8 +1263,8 @@
- static gfxFontGroup*
- GetFontGroupForFrame(nsIFrame* aFrame)
- {
--  nsCOMPtr<nsIFontMetrics> metrics;
--  nsLayoutUtils::GetFontMetricsForFrame(aFrame, getter_AddRefs(metrics));
-+  nsIFontMetrics* metrics = nsnull;
-+  nsLayoutUtils::GetFontMetricsForFrame(aFrame, &metrics);
- 
-   if (!metrics)
-     return nsnull;
-@@ -1282,10 +1281,10 @@
+@@ -1293,10 +1292,10 @@ static AddRefed<gfxContext>
  static AddRefed<gfxContext>
  GetReferenceRenderingContext(nsTextFrame* aTextFrame, nsIRenderingContext* aRC)
  {
 -  nsCOMPtr<nsIRenderingContext> tmp = aRC;
 +  nsIRenderingContext* tmp = aRC;
    if (!tmp) {
      nsresult rv = aTextFrame->PresContext()->PresShell()->
 -      CreateRenderingContext(aTextFrame, getter_AddRefs(tmp));
 +      CreateRenderingContext(aTextFrame, &tmp);
      if (NS_FAILED(rv))
        return AddRefed<gfxContext>(nsnull);
    }
-@@ -2487,7 +2486,7 @@
+@@ -2510,7 +2509,7 @@ PropertyProvider::SetupJustificationSpac
  
  // Helper class for managing blinking text
  
 -class nsBlinkTimer : public nsITimerCallback
 +class nsBlinkTimer : public XPCOMGCFinalizedObject, public nsITimerCallback
  {
  public:
    nsBlinkTimer();
-@@ -2644,7 +2643,6 @@
+@@ -2667,7 +2666,6 @@ nsresult nsBlinkTimer::AddBlinkFrame(nsP
      if (!sTextBlinker) return NS_ERROR_OUT_OF_MEMORY;
    }
    
 -  NS_ADDREF(sTextBlinker);
  
    sTextBlinker->AddFrame(aPresContext, aFrame);
    return NS_OK;
-@@ -2883,7 +2881,7 @@
+@@ -2906,7 +2904,7 @@ nsTextPaintStyle::InitSelectionColors()
  
    if (selectionContent &&
        selectionStatus == nsISelectionController::SELECTION_ON) {
 -    nsRefPtr<nsStyleContext> sc = nsnull;
 +    nsStyleContext* sc = nsnull;
      sc = mPresContext->StyleSet()->
        ProbePseudoStyleFor(selectionContent, nsCSSPseudoElements::mozSelection,
                            mFrame->GetStyleContext());
-@@ -3062,7 +3060,7 @@
+@@ -3085,7 +3083,7 @@ NS_IMETHODIMP nsTextFrame::GetAccessible
      }
    }
  
 -  nsCOMPtr<nsIAccessibilityService> accService = do_GetService("@mozilla.org/accessibilityService;1");
 +  nsIAccessibilityService* accService = do_GetService("@mozilla.org/accessibilityService;1");
  
    if (accService) {
      return accService->CreateHTMLTextAccessible(static_cast<nsIFrame*>(this), aAccessible);
-@@ -4200,9 +4198,9 @@
+@@ -4224,9 +4222,9 @@ nsTextFrame::GetSelectionStatus(PRInt16*
  nsTextFrame::GetSelectionStatus(PRInt16* aSelectionFlags)
  {
    // get the selection controller
 -  nsCOMPtr<nsISelectionController> selectionController;
 +  nsISelectionController* selectionController = nsnull;
    nsresult rv = GetSelectionController(PresContext(),
 -                                       getter_AddRefs(selectionController));
 +                                       &selectionController);
    if (NS_FAILED(rv) || !selectionController)
      return nsISelectionController::SELECTION_OFF;
  
-@@ -4344,15 +4342,15 @@
+@@ -4388,15 +4386,15 @@ nsTextFrame::SetSelected(nsPresContext* 
    PRBool found = PR_FALSE;
    if (aRange) {
      //lets see if the range contains us, if so we must redraw!
 -    nsCOMPtr<nsIDOMNode> endNode;
 +    nsIDOMNode* endNode = nsnull;
      PRInt32 endOffset;
 -    nsCOMPtr<nsIDOMNode> startNode;
 +    nsIDOMNode* startNode = nsnull;
@@ -2213,33 +2202,33 @@ diff --git a/layout/generic/nsTextFrameT
 -    nsCOMPtr<nsIDOMNode> thisNode = do_QueryInterface(GetContent());
 +    nsIDOMNode* thisNode = do_QueryInterface(GetContent());
  
      if (thisNode == startNode)
      {
 diff --git a/layout/mathml/base/src/nsMathMLChar.cpp b/layout/mathml/base/src/nsMathMLChar.cpp
 --- a/layout/mathml/base/src/nsMathMLChar.cpp
 +++ b/layout/mathml/base/src/nsMathMLChar.cpp
-@@ -154,12 +154,12 @@
+@@ -154,12 +154,12 @@ static void
  static void
  AlertMissingFonts(nsString& aMissingFonts)
  {
 -  nsCOMPtr<nsIStringBundleService> sbs(do_GetService(NS_STRINGBUNDLE_CONTRACTID));
 +  nsIStringBundleService* sbs(do_GetService(NS_STRINGBUNDLE_CONTRACTID));
    if (!sbs)
      return;
  
 -  nsCOMPtr<nsIStringBundle> sb;
 -  sbs->CreateBundle("resource://gre/res/fonts/mathfont.properties", getter_AddRefs(sb));
 +  nsIStringBundle* sb = nsnull;
 +  sbs->CreateBundle("resource://gre/res/fonts/mathfont.properties", &sb);
    if (!sb)
      return;
  
-@@ -169,14 +169,14 @@
+@@ -169,14 +169,14 @@ AlertMissingFonts(nsString& aMissingFont
    sb->FormatStringFromName(NS_LITERAL_STRING("mathfont_missing_dialog_message").get(),
                             strings, 1, getter_Copies(message));
  
 -  nsCOMPtr<nsIWindowWatcher> wwatch(do_GetService(NS_WINDOWWATCHER_CONTRACTID));
 +  nsIWindowWatcher* wwatch(do_GetService(NS_WINDOWWATCHER_CONTRACTID));
    if (!wwatch)
      return;
  
@@ -2248,198 +2237,189 @@ diff --git a/layout/mathml/base/src/nsMa
 +  nsIDOMWindow* parent = nsnull;
 +  wwatch->GetActiveWindow(&parent);
    nsresult rv;
 -  nsCOMPtr<nsINonBlockingAlertService> prompter =
 +  nsINonBlockingAlertService* prompter =
      do_GetService("@mozilla.org/embedcomp/nbalert-service;1", &rv);
  
    if (prompter && parent) {
-@@ -599,7 +599,7 @@
+@@ -599,7 +599,7 @@ nsGlyphTableList::Finalize()
  {
    // Remove our observer from the observer service
    nsresult rv = NS_OK;
 -  nsCOMPtr<nsIObserverService> obs = 
 +  nsIObserverService* obs = 
             do_GetService("@mozilla.org/observer-service;1", &rv);
    if (NS_SUCCEEDED(rv)) {
      rv = obs->RemoveObserver(this, NS_XPCOM_SHUTDOWN_OBSERVER_ID);
-@@ -662,10 +662,10 @@
+@@ -662,10 +662,10 @@ GetPrefValue(nsIPrefBranch* aPrefBranch,
  {
    aPrefValue.Truncate();
    if (aPrefBranch) {
 -    nsCOMPtr<nsISupportsString> prefString;
 +    nsISupportsString* prefString = nsnull;
      aPrefBranch->GetComplexValue(aPrefKey,
                                   NS_GET_IID(nsISupportsString),
 -                                 getter_AddRefs(prefString));
 +                                 (void**)&prefString);
      if (prefString) {
        prefString->GetData(aPrefValue);
      }
-@@ -794,7 +794,7 @@
+@@ -794,7 +794,7 @@ InitGlobals(nsPresContext* aPresContext)
    nsCAutoString key;
    nsAutoString value;
    nsIPersistentProperties* mathfontProp = nsnull;
 -  nsCOMPtr<nsIPrefBranch> prefBranch(do_GetService(NS_PREFSERVICE_CONTRACTID));
 +  nsIPrefBranch* prefBranch(do_GetService(NS_PREFSERVICE_CONTRACTID));
  
    // Add the math fonts in the gGlyphTableList in order of preference ...
    // Note: we only load font-names at this stage. The actual glyph tables will
-@@ -2298,8 +2298,8 @@
+@@ -2298,8 +2298,8 @@ nsMathMLChar::PaintVertically(nsPresCont
    else if (bmdata[3].ascent + bmdata[3].descent > 0) {
      // glue is present
      nscoord overlap;
 -    nsCOMPtr<nsIFontMetrics> fm;
 -    aRenderingContext.GetFontMetrics(*getter_AddRefs(fm));
 +    nsIFontMetrics* fm = nsnull;
 +    aRenderingContext.GetFontMetrics(*&fm);
      nsMathMLFrame::GetRuleThickness(fm, overlap);
      overlap = 2 * PR_MAX(overlap, onePixel);
      // Ensure the stride for the glue is not reduced to less than onePixel
-@@ -2501,8 +2501,8 @@
+@@ -2501,8 +2501,8 @@ nsMathMLChar::PaintHorizontally(nsPresCo
    else if (bmdata[3].rightBearing - bmdata[3].leftBearing > 0) {
      // glue is present
      nscoord overlap;
 -    nsCOMPtr<nsIFontMetrics> fm;
 -    aRenderingContext.GetFontMetrics(*getter_AddRefs(fm));
 +    nsIFontMetrics* fm = nsnull;
 +    aRenderingContext.GetFontMetrics(*&fm);
      nsMathMLFrame::GetRuleThickness(fm, overlap);
      overlap = 2 * PR_MAX(overlap, onePixel);
      // Ensure the stride for the glue is not reduced to less than onePixel
 diff --git a/modules/plugin/base/src/ns4xPlugin.cpp b/modules/plugin/base/src/ns4xPlugin.cpp
 --- a/modules/plugin/base/src/ns4xPlugin.cpp
 +++ b/modules/plugin/base/src/ns4xPlugin.cpp
-@@ -592,7 +592,6 @@
+@@ -592,7 +592,6 @@ ns4xPlugin::CreatePlugin(nsIServiceManag
    if (*aResult == NULL)
      return NS_ERROR_OUT_OF_MEMORY;
  
 -  NS_ADDREF(*aResult);
  
    if (!aFileName) //do not call NP_Initialize in this case, bug 74938
      return NS_OK;
-@@ -624,7 +623,6 @@
+@@ -624,7 +623,6 @@ ns4xPlugin::CreatePlugin(nsIServiceManag
    if (*aResult == NULL)
      return NS_ERROR_OUT_OF_MEMORY;
  
 -  NS_ADDREF(*aResult);
  
    // we must init here because the plugin may call NPN functions
    // when we call into the NP_Initialize entry point - NPN functions
-@@ -660,7 +658,6 @@
+@@ -660,7 +658,6 @@ ns4xPlugin::CreatePlugin(nsIServiceManag
    if (*aResult == NULL)
      return NS_ERROR_OUT_OF_MEMORY;
  
 -  NS_ADDREF(*aResult);
  
    // we must init here because the plugin may call NPN functions
    // when we call into the NP_Initialize entry point - NPN functions
-@@ -763,7 +760,6 @@
+@@ -763,7 +760,6 @@ ns4xPlugin::CreatePlugin(nsIServiceManag
    ::UseResFile(appRefNum);
    *aResult = plugin;
  
 -  NS_ADDREF(*aResult);
    if (NS_FAILED((*aResult)->Initialize())) {
      NS_RELEASE(*aResult);
      return NS_ERROR_FAILURE;
-@@ -792,7 +788,6 @@
+@@ -792,7 +788,6 @@ ns4xPlugin::CreatePlugin(nsIServiceManag
    if (*aResult == NULL)
      return NS_ERROR_OUT_OF_MEMORY;
  
 -  NS_ADDREF(*aResult);
  
    // we must init here because the plugin may call NPN functions
    // when we call into the NP_Initialize entry point - NPN functions
-@@ -831,7 +826,7 @@
+@@ -831,7 +826,7 @@ ns4xPlugin::CreateInstance(nsISupports *
    *aResult = NULL;
  
    // XXX This is suspicuous!
 -  nsRefPtr<ns4xPluginInstance> inst =
 +  ns4xPluginInstance* inst =
      new ns4xPluginInstance(&fCallbacks, fLibrary);
  
    if (!inst)
-@@ -952,13 +947,13 @@
+@@ -952,13 +947,13 @@ MakeNew4xStreamInternal(NPP npp, const c
    if (inst == NULL)
      return NPERR_INVALID_INSTANCE_ERROR;
  
 -  nsCOMPtr<nsIPluginManager> pm = do_GetService(kPluginManagerCID);
 +  nsIPluginManager* pm = do_GetService(kPluginManagerCID);
    NS_ASSERTION(pm, "failed to get plugin manager");
    if (!pm) return NPERR_GENERIC_ERROR;
  
 -  nsCOMPtr<nsIPluginStreamListener> listener;
 +  nsIPluginStreamListener* listener = nsnull;
    if (target == nsnull)
 -    ((ns4xPluginInstance*)inst)->NewNotifyStream(getter_AddRefs(listener),
 +    ((ns4xPluginInstance*)inst)->NewNotifyStream(&listener,
                                                   notifyData,
                                                   bDoNotify, relativeURL);
  
-@@ -1075,7 +1070,7 @@
+@@ -1093,7 +1088,7 @@ _posturl(NPP npp, const char *relativeUR
  // A little helper class used to wrap up plugin manager streams (that is,
  // streams from the plugin to the browser).
  
 -class ns4xStreamWrapper : nsISupports
 +class ns4xStreamWrapper : public XPCOMGCFinalizedObject, private nsISupports
  {
  public:
    NS_DECL_ISUPPORTS
-@@ -1100,7 +1095,6 @@
+@@ -1118,7 +1113,6 @@ ns4xStreamWrapper::ns4xStreamWrapper(nsI
    NS_ASSERTION(stream != NULL, "bad stream");
  
    fStream = stream;
 -  NS_ADDREF(fStream);
  
    memset(&fNPStream, 0, sizeof(fNPStream));
    fNPStream.ndata = (void*) this;
-@@ -1116,7 +1110,6 @@
+@@ -1134,7 +1128,6 @@ ns4xStreamWrapper::GetStream(nsIOutputSt
  ns4xStreamWrapper::GetStream(nsIOutputStream* &result)
  {
    result = fStream;
 -  NS_IF_ADDREF(fStream);
  }
  
  
-@@ -1224,7 +1217,6 @@
+@@ -1254,7 +1247,6 @@ _destroystream(NPP npp, NPStream *pstrea
        return NPERR_INVALID_PARAM;
  
      // This will release the wrapped nsIOutputStream.
 -    delete wrapper;
      pstream->ndata = nsnull;
    }
  
-@@ -1284,7 +1276,7 @@
-   NPN_PLUGIN_LOG(PLUGIN_LOG_NORMAL,
-                  ("NPN_ReloadPlugins: reloadPages=%d\n", reloadPages));
- 
--  nsCOMPtr<nsIPluginManager> pm(do_GetService(kPluginManagerCID));
-+  nsIPluginManager* pm(do_GetService(kPluginManagerCID));
- 
-   pm->ReloadPlugins(reloadPages);
- }
-@@ -1386,12 +1378,12 @@
+@@ -1444,12 +1436,12 @@ GetDocumentFromNPP(NPP npp)
    nsCOMPtr<nsPIPluginInstancePeer> pp(do_QueryInterface(pip));
    NS_ENSURE_TRUE(pp, nsnull);
  
 -  nsCOMPtr<nsIPluginInstanceOwner> owner;
 -  pp->GetOwner(getter_AddRefs(owner));
 +  nsIPluginInstanceOwner* owner = nsnull;
 +  pp->GetOwner(&owner);
    NS_ENSURE_TRUE(owner, nsnull);
  
 -  nsCOMPtr<nsIDocument> doc;
 -  owner->GetDocument(getter_AddRefs(doc));
 +  nsIDocument* doc = nsnull;
 +  owner->GetDocument(&doc);
  
    return doc;
  }
-@@ -1440,19 +1432,19 @@
+@@ -1506,19 +1498,19 @@ _getpluginelement(NPP npp)
    }
  
    // Pass ownership of elementp to element
 -  nsCOMPtr<nsIDOMElement> element;
 -  element.swap(elementp);
 +  nsIDOMElement* element = nsnull;
 +  swap(element, elementp);
  
@@ -2454,73 +2434,55 @@ diff --git a/modules/plugin/base/src/ns4
 +  nsIXPConnectJSObjectHolder* holder = nsnull;
    xpc->WrapNative(cx, ::JS_GetGlobalObject(cx), element,
                    NS_GET_IID(nsIDOMElement),
 -                  getter_AddRefs(holder));
 +                  &holder);
    NS_ENSURE_TRUE(holder, nsnull);
  
    JSObject* obj = nsnull;
-@@ -1479,7 +1471,7 @@
- NPIdentifier NP_CALLBACK
- _getstringidentifier(const NPUTF8* name)
- {
--  nsCOMPtr<nsIThreadJSContextStack> stack =
-+  nsIThreadJSContextStack* stack =
-     do_GetService("@mozilla.org/js/xpc/ContextStack;1");
-   if (!stack)
-     return NULL;
-@@ -1497,7 +1489,7 @@
- _getstringidentifiers(const NPUTF8** names, int32_t nameCount,
-                       NPIdentifier *identifiers)
- {
--  nsCOMPtr<nsIThreadJSContextStack> stack =
-+  nsIThreadJSContextStack* stack =
-     do_GetService("@mozilla.org/js/xpc/ContextStack;1");
-   if (!stack)
-     return;
-@@ -1702,7 +1694,7 @@
+@@ -1818,7 +1810,7 @@ _evaluate(NPP npp, NPObject* npobj, NPSt
    NS_ConvertUTF8toUTF16 utf16script(script->utf8characters,
                                      script->utf8length);
  
 -  nsCOMPtr<nsIScriptContext> scx = GetScriptContextFromJSContext(cx);
 +  nsIScriptContext* scx = GetScriptContextFromJSContext(cx);
    NS_ENSURE_TRUE(scx, false);
  
    nsIPrincipal *principal = doc->NodePrincipal();
-@@ -2006,8 +1998,8 @@
+@@ -2167,8 +2159,8 @@ _getvalue(NPP npp, NPNVariable variable,
  
      ns4xPluginInstance *inst = (ns4xPluginInstance *) npp->ndata;
  
 -    nsCOMPtr<nsIPluginInstancePeer> peer;
 -    if (NS_SUCCEEDED(inst->GetPeer(getter_AddRefs(peer))) &&
 +    nsIPluginInstancePeer* peer = nsnull;
 +    if (NS_SUCCEEDED(inst->GetPeer(&peer)) &&
          peer &&
          NS_SUCCEEDED(peer->GetValue(nsPluginInstancePeerVariable_NetscapeWindow,
                                      result))) {
-@@ -2019,7 +2011,7 @@
+@@ -2180,7 +2172,7 @@ _getvalue(NPP npp, NPNVariable variable,
  
    case NPNVjavascriptEnabledBool: {
      *(NPBool*)result = PR_FALSE;
 -    nsCOMPtr<nsIPrefBranch> prefs(do_GetService(NS_PREFSERVICE_CONTRACTID));
 +    nsIPrefBranch* prefs(do_GetService(NS_PREFSERVICE_CONTRACTID));
      if (prefs) {
        PRBool js = PR_FALSE;;
        res = prefs->GetBoolPref("javascript.enabled", &js);
-@@ -2035,7 +2027,7 @@
+@@ -2196,7 +2188,7 @@ _getvalue(NPP npp, NPNVariable variable,
  
    case NPNVisOfflineBool: {
      PRBool offline = PR_FALSE;
 -    nsCOMPtr<nsIIOService> ioservice =
 +    nsIIOService* ioservice =
        do_GetService(NS_IOSERVICE_CONTRACTID, &res);
      if (NS_SUCCEEDED(res))
        res = ioservice->GetOffline(&offline);
-@@ -2060,14 +2052,14 @@
+@@ -2221,14 +2213,14 @@ _getvalue(NPP npp, NPNVariable variable,
      ns4xPluginInstance *inst = (ns4xPluginInstance *) npp->ndata;
      NS_ENSURE_TRUE(inst, NPERR_GENERIC_ERROR);
  
 -    nsCOMPtr<nsIPluginInstancePeer> pip;
 -    inst->GetPeer(getter_AddRefs(pip));
 -    nsCOMPtr<nsIPluginTagInfo2> pti2 (do_QueryInterface(pip));
 +    nsIPluginInstancePeer* pip = nsnull;
 +    inst->GetPeer(&pip);
@@ -2531,345 +2493,327 @@ diff --git a/modules/plugin/base/src/ns4
 +      nsIDOMElement* e = nsnull;
 +      pti2->GetDOMElement(&e);
        if (e) {
 -        NS_ADDREF(*(nsIDOMElement**)result = e.get());
 +        *(nsIDOMElement**)result = e;
          return NPERR_NO_ERROR;
        }
      }
-@@ -2078,7 +2070,7 @@
+@@ -2239,7 +2231,7 @@ _getvalue(NPP npp, NPNVariable variable,
      ns4xPluginInstance *inst = (ns4xPluginInstance *)npp->ndata;
      NS_ENSURE_TRUE(inst, NPERR_GENERIC_ERROR);
  
 -    nsIDOMWindow *domWindow = inst->GetDOMWindow().get();
 +    nsIDOMWindow *domWindow = inst->GetDOMWindow();
  
      if (domWindow) {
        // Pass over ownership of domWindow to the caller.
-@@ -2201,7 +2193,7 @@
+@@ -2366,7 +2358,7 @@ _setvalue(NPP npp, NPPVariable variable,
      case NPPVjavascriptPushCallerBool:
        {
          nsresult rv;
 -        nsCOMPtr<nsIJSContextStack> contextStack =
 +        nsIJSContextStack* contextStack =
            do_GetService("@mozilla.org/js/xpc/ContextStack;1", &rv);
          if (NS_SUCCEEDED(rv)) {
            NPBool bPushCaller = (result != nsnull);
-@@ -2209,9 +2201,9 @@
+@@ -2374,9 +2366,9 @@ _setvalue(NPP npp, NPPVariable variable,
            if (bPushCaller) {
              rv = NS_ERROR_FAILURE;
  
 -            nsCOMPtr<nsIPluginInstancePeer> peer;
 -            if (NS_SUCCEEDED(inst->GetPeer(getter_AddRefs(peer))) && peer) {
 -              nsCOMPtr<nsIPluginInstancePeer2> peer2 =
 +            nsIPluginInstancePeer* peer = nsnull;
 +            if (NS_SUCCEEDED(inst->GetPeer(&peer)) && peer) {
 +              nsIPluginInstancePeer2* peer2 =
                  do_QueryInterface(peer);
  
                if (peer2) {
-@@ -2306,7 +2298,7 @@
- 
-   char *retstr;
- 
--  nsCOMPtr<nsIPluginManager> pm(do_GetService(kPluginManagerCID));
-+  nsIPluginManager* pm(do_GetService(kPluginManagerCID));
- 
-   pm->UserAgent((const char **)&retstr);
- 
-@@ -2441,7 +2433,7 @@
- void NP_CALLBACK
- _pluginthreadasynccall(NPP instance, PluginThreadCallback func, void *userData)
- {
--  nsRefPtr<nsPluginThreadRunnable> evt =
-+  nsPluginThreadRunnable* evt =
-     new nsPluginThreadRunnable(instance, func, userData);
- 
-   if (evt && evt->IsValid()) {
 diff --git a/netwerk/build/nsNetModule.cpp b/netwerk/build/nsNetModule.cpp
 --- a/netwerk/build/nsNetModule.cpp
 +++ b/netwerk/build/nsNetModule.cpp
-@@ -344,7 +344,7 @@
+@@ -344,7 +344,7 @@ RegisterStreamConverters(nsIComponentMan
                           const char *registryLocation,
                           const char *componentType,
                           const nsModuleComponentInfo *info) {
 -    nsCOMPtr<nsICategoryManager> catmgr =
 +    nsICategoryManager* catmgr =
          do_GetService(NS_CATEGORYMANAGER_CONTRACTID);
      NS_ENSURE_STATE(catmgr);
  
-@@ -361,7 +361,7 @@
+@@ -361,7 +361,7 @@ UnregisterStreamConverters(nsIComponentM
  UnregisterStreamConverters(nsIComponentManager *aCompMgr, nsIFile *aPath,
                             const char *registryLocation,
                             const nsModuleComponentInfo *info) {
 -    nsCOMPtr<nsICategoryManager> catmgr =
 +    nsICategoryManager* catmgr =
          do_GetService(NS_CATEGORYMANAGER_CONTRACTID);
      NS_ENSURE_STATE(catmgr);
  
-@@ -519,7 +519,6 @@
+@@ -519,7 +519,6 @@ CreateNewUnknownDecoderFactory(nsISuppor
    if (!inst) {
      return NS_ERROR_OUT_OF_MEMORY;
    }
 -  NS_ADDREF(inst);
    rv = inst->QueryInterface(aIID, aResult);
    NS_RELEASE(inst);
  
-@@ -544,7 +543,6 @@
+@@ -544,7 +543,6 @@ CreateNewBinaryDetectorFactory(nsISuppor
    if (!inst) {
      return NS_ERROR_OUT_OF_MEMORY;
    }
 -  NS_ADDREF(inst);
    rv = inst->QueryInterface(aIID, aResult);
    NS_RELEASE(inst);
  
-@@ -570,10 +568,8 @@
+@@ -570,10 +568,8 @@ CreateNewNSTXTToHTMLConvFactory(nsISuppo
    inst = new nsTXTToHTMLConv();
    if (!inst) return NS_ERROR_OUT_OF_MEMORY;
  
 -  NS_ADDREF(inst);
    rv = inst->Init();
    if (NS_FAILED(rv)) {
 -    delete inst;
      return rv;
    }
    rv = inst->QueryInterface(aIID, aResult);
 diff --git a/toolkit/xre/nsEmbedFunctions.cpp b/toolkit/xre/nsEmbedFunctions.cpp
 --- a/toolkit/xre/nsEmbedFunctions.cpp
 +++ b/toolkit/xre/nsEmbedFunctions.cpp
-@@ -64,12 +64,12 @@
+@@ -64,12 +64,12 @@ XRE_LockProfileDirectory(nsILocalFile* a
  XRE_LockProfileDirectory(nsILocalFile* aDirectory,
                           nsISupports* *aLockObject)
  {
 -  nsCOMPtr<nsIProfileLock> lock;
 +  nsIProfileLock* lock = nsnull;
  
    nsresult rv = NS_LockProfilePath(aDirectory, nsnull, nsnull,
 -                                   getter_AddRefs(lock));
 +                                   &lock);
    if (NS_SUCCEEDED(rv))
 -    NS_ADDREF(*aLockObject = lock);
 +    *aLockObject = lock;
  
    return rv;
  }
-@@ -130,7 +130,7 @@
+@@ -130,7 +130,7 @@ XRE_InitEmbedding(nsILocalFile *aLibXULD
    // to autoregister every time (for instance, if it's debug), it can do
    // so after we return from this function.
  
 -  nsCOMPtr<nsIObserver> startupNotifier
 +  nsIObserver* startupNotifier
      (do_CreateInstance(NS_APPSTARTUPNOTIFIER_CONTRACTID));
    if (!startupNotifier)
      return NS_ERROR_FAILURE;
-@@ -159,5 +159,4 @@
+@@ -159,5 +159,4 @@ XRE_TermEmbedding()
    gDirServiceProvider->DoShutdown();
    NS_ShutdownXPCOM(nsnull);
    delete [] sCombined;
 -  delete gDirServiceProvider;
  }
 diff --git a/uriloader/base/nsURILoader.cpp b/uriloader/base/nsURILoader.cpp
 --- a/uriloader/base/nsURILoader.cpp
 +++ b/uriloader/base/nsURILoader.cpp
-@@ -477,7 +477,8 @@
+@@ -477,7 +477,8 @@ nsresult nsDocumentOpenInfo::DispatchCon
                 mContentType.get(), contractidString.get()));
  
            listener = do_CreateInstance(contractidString);
 -          LOG(("  Listener from category manager: 0x%p", listener));
 +          LOG(("  Listener from category manager: 0x%p",
 +               (nsIURIContentListener*) listener));
            
            if (listener && TryContentListener(listener, aChannel)) {
              LOG(("  Listener from category manager likes this type"));
-@@ -638,7 +639,8 @@
+@@ -639,7 +640,8 @@ nsDocumentOpenInfo::ConvertData(nsIReque
      new nsDocumentOpenInfo(m_originalContext, mFlags, mURILoader);
    if (!nextLink) return NS_ERROR_OUT_OF_MEMORY;
  
 -  LOG(("  Downstream DocumentOpenInfo would be: 0x%p", nextLink));
 +  LOG(("  Downstream DocumentOpenInfo would be: 0x%p",
 +       (nsDocumentOpenInfo*) nextLink));
    
    // Make sure nextLink starts with the contentListener that said it wanted the
    // results of this decode.
 diff --git a/view/src/nsView.cpp b/view/src/nsView.cpp
 --- a/view/src/nsView.cpp
 +++ b/view/src/nsView.cpp
-@@ -63,7 +63,7 @@
+@@ -63,7 +63,7 @@ static nsEventStatus PR_CALLBACK HandleE
  /**
   * nsISupports-derived helper class that allows to store and get a view
   */
 -class ViewWrapper : public nsIInterfaceRequestor
 +class ViewWrapper : public XPCOMGCFinalizedObject, public nsIInterfaceRequestor
  {
    public:
      NS_DECLARE_STATIC_IID_ACCESSOR(VIEW_WRAPPER_IID)
-@@ -359,8 +359,8 @@
+@@ -359,8 +359,8 @@ void nsView::ResetWidgetBounds(PRBool aR
  
  nsRect nsView::CalcWidgetBounds(nsWindowType aType)
  {
 -  nsCOMPtr<nsIDeviceContext> dx;
 -  mViewManager->GetDeviceContext(*getter_AddRefs(dx));
 +  nsIDeviceContext* dx = nsnull;
 +  mViewManager->GetDeviceContext(*&dx);
    NS_ASSERTION(dx, "View manager can't be created without a device context");
    PRInt32 p2a = dx->AppUnitsPerDevPixel();
  
-@@ -643,8 +643,8 @@
+@@ -643,8 +643,8 @@ nsresult nsIView::CreateWidget(const nsI
    if (NS_OK == v->LoadWidget(aWindowIID))
    {
      PRBool usewidgets;
 -    nsCOMPtr<nsIDeviceContext> dx;
 -    mViewManager->GetDeviceContext(*getter_AddRefs(dx));
 +    nsIDeviceContext* dx = nsnull;
 +    mViewManager->GetDeviceContext(*&dx);
      dx->SupportsNativeWidgets(usewidgets);
  
      if (PR_TRUE == usewidgets)
-@@ -734,15 +734,12 @@
+@@ -734,15 +734,12 @@ nsresult nsView::LoadWidget(const nsCID 
    ViewWrapper* wrapper = new ViewWrapper(this);
    if (!wrapper)
      return NS_ERROR_OUT_OF_MEMORY;
 -  NS_ADDREF(wrapper); // Will be released in ~nsView
  
    nsresult rv = CallCreateInstance(aClassIID, &mWindow);
  
    if (NS_SUCCEEDED(rv)) {
      // Set the widget's client data
      mWindow->SetClientData(wrapper);
 -  } else {
 -    delete wrapper;
    }
  
    return rv;
-@@ -817,8 +814,8 @@
+@@ -817,8 +814,8 @@ nsIntPoint nsIView::GetScreenPosition() 
    nsPoint toWidgetOffset(0,0);
    nsIWidget* widget = GetNearestWidget(&toWidgetOffset);
    if (widget) {
 -    nsCOMPtr<nsIDeviceContext> dx;
 -    mViewManager->GetDeviceContext(*getter_AddRefs(dx));
 +    nsIDeviceContext* dx = nsnull;
 +    mViewManager->GetDeviceContext(*&dx);
      PRInt32 p2a = dx->AppUnitsPerDevPixel();
      nsIntRect ourRect(NSAppUnitsToIntPixels(toWidgetOffset.x, p2a),
                        NSAppUnitsToIntPixels(toWidgetOffset.y, p2a),
 diff --git a/xpcom/base/nsAgg.h b/xpcom/base/nsAgg.h
 --- a/xpcom/base/nsAgg.h
 +++ b/xpcom/base/nsAgg.h
-@@ -171,10 +171,6 @@
+@@ -171,10 +171,6 @@ _InstanceClass##Constructor(nsISupports 
                                                                              \
      nsISupports* inner = inst->InnerObject();                               \
      nsresult rv = inner->QueryInterface(aIID, aResult);                     \
 -    if (NS_FAILED(rv)) {                                                    \
 -        delete inst;                                                        \
 -    }                                                                       \
 -                                                                            \
      return rv;                                                              \
  }                                                                           \
  
-@@ -193,7 +189,6 @@
+@@ -193,7 +189,6 @@ _InstanceClass##Constructor(nsISupports 
      }                                                                       \
                                                                              \
      nsISupports* inner = inst->InnerObject();                               \
 -    NS_ADDREF(inner);                                                       \
      nsresult rv = inst->_InitMethod();                                      \
      if (NS_SUCCEEDED(rv)) {                                                 \
          rv = inner->QueryInterface(aIID, aResult);                          \
 diff --git a/xpcom/components/nsComponentManager.cpp b/xpcom/components/nsComponentManager.cpp
 --- a/xpcom/components/nsComponentManager.cpp
 +++ b/xpcom/components/nsComponentManager.cpp
-@@ -1992,7 +1992,6 @@
+@@ -1992,7 +1992,6 @@ nsComponentManagerImpl::RegisterService(
                         (PL_DHashTableOperate(&mContractIDs, aContractID,
                                                  PL_DHASH_ADD));
          if (!contractIDTableEntry) {
 -            delete entry;
              return NS_ERROR_OUT_OF_MEMORY;
          }
  
 diff --git a/xpcom/glue/nsGenericFactory.cpp b/xpcom/glue/nsGenericFactory.cpp
 --- a/xpcom/glue/nsGenericFactory.cpp
 +++ b/xpcom/glue/nsGenericFactory.cpp
-@@ -282,7 +282,7 @@
+@@ -282,7 +282,7 @@ nsGenericModule::Initialize(nsIComponent
          return rv;
  #endif
  
 -    nsCOMPtr<nsIComponentRegistrar> registrar = do_QueryInterface(compMgr, &rv);
 +    nsIComponentRegistrar* registrar = do_QueryInterface(compMgr, &rv);
      if (NS_FAILED(rv))
          return rv;
  
-@@ -297,8 +297,8 @@
+@@ -297,8 +297,8 @@ nsGenericModule::Initialize(nsIComponent
      for (PRUint32 i = 0; i < mComponentCount; i++) {
          if (!desc->mConstructor ||
              (desc->mFlags & nsIClassInfo::EAGER_CLASSINFO)) {
 -            nsCOMPtr<nsIGenericFactory> fact;
 -            nsresult rv = NS_NewGenericFactory(getter_AddRefs(fact), desc);
 +            nsIGenericFactory* fact = nsnull;
 +            nsresult rv = NS_NewGenericFactory(&fact, desc);
              if (NS_FAILED(rv)) return rv;
  
              // if we don't have a mConstructor, then we should not populate
-@@ -324,15 +324,6 @@
+@@ -324,15 +324,6 @@ void
  void
  nsGenericModule::Shutdown()
  {
 -    // Free cached factories that were not registered.
 -    FactoryNode* node;
 -    while (mFactoriesNotToBeRegistered)
 -    {
 -        node = mFactoriesNotToBeRegistered->mNext;
 -        delete mFactoriesNotToBeRegistered;
 -        mFactoriesNotToBeRegistered = node;
 -    }
 -
      if (mInitialized) {
          mInitialized = PR_FALSE;
  
-@@ -370,8 +361,8 @@
+@@ -370,8 +361,8 @@ nsGenericModule::GetClassObject(nsICompo
      const nsModuleComponentInfo* desc = mComponents;
      for (PRUint32 i = 0; i < mComponentCount; i++) {
          if (desc->mCID.Equals(aClass)) {
 -            nsCOMPtr<nsIGenericFactory> fact;
 -            rv = NS_NewGenericFactory(getter_AddRefs(fact), desc);
 +            nsIGenericFactory* fact = nsnull;
 +            rv = NS_NewGenericFactory(&fact, desc);
              if (NS_FAILED(rv)) return rv;
              return fact->QueryInterface(aIID, r_classObj);
          }
-@@ -397,7 +388,7 @@
+@@ -397,7 +388,7 @@ nsGenericModule::RegisterSelf(nsICompone
      for (PRUint32 i = 0; i < mComponentCount; i++) {
          // Register the component only if it has a constructor
          if (cp->mConstructor) {
 -            nsCOMPtr<nsIComponentRegistrar> registrar = do_QueryInterface(aCompMgr, &rv);
 +            nsIComponentRegistrar* registrar = do_QueryInterface(aCompMgr, &rv);
              if (registrar)
                  rv = registrar->RegisterFactoryLocation(cp->mCID, 
                                                          cp->mDescription,
-@@ -450,7 +441,7 @@
+@@ -450,7 +441,7 @@ nsGenericModule::UnregisterSelf(nsICompo
  
          // Unregister the component
          nsresult rv; 
 -        nsCOMPtr<nsIComponentRegistrar> registrar = do_QueryInterface(aCompMgr, &rv);
 +        nsIComponentRegistrar* registrar = do_QueryInterface(aCompMgr, &rv);
          if (registrar)
               rv = registrar->UnregisterFactoryLocation(cp->mCID, aPath);
          if (NS_FAILED(rv)) {
-@@ -489,7 +480,7 @@
+@@ -489,7 +480,7 @@ NS_NewGenericModule2(nsModuleInfo const 
          return NS_ERROR_OUT_OF_MEMORY;
  
      // Increase refcnt and store away nsIModule interface to m in result
 -    NS_ADDREF(*result = m);
 +    *result = m;
      return rv;
  }
  
 diff --git a/xpcom/glue/nsISupportsUtils.h b/xpcom/glue/nsISupportsUtils.h
 --- a/xpcom/glue/nsISupportsUtils.h
 +++ b/xpcom/glue/nsISupportsUtils.h
-@@ -79,6 +79,22 @@
+@@ -79,6 +79,22 @@ public:
      {
          return MMgc::GCObject::operator new(size, NS_GetGC());
      }
 +
 +    static void* operator new[](size_t size)
 +    {
 +        return MMgc::GCObject::operator new(size, NS_GetGC());
 +    }
@@ -2882,183 +2826,183 @@ diff --git a/xpcom/glue/nsISupportsUtils
 +
 +    static void operator delete[](void* obj)
 +    {
 +        NS_NOTREACHED("Don't delete GCObjects!");
 +    }
  };
  
  class XPCOMGCFinalizedObject
-@@ -93,6 +109,12 @@
+@@ -93,6 +109,12 @@ public:
      static void* operator new(size_t size)
      {
          return MMgc::GCFinalizedObject::operator new(size, NS_GetGC());
 +    }
 +
 +protected:
 +    static void operator delete(void *obj)
 +    {
 +        NS_NOTREACHED("Don't delete GCObjects!");
      }
  };
  
 diff --git a/xpcom/proxy/src/nsProxyObjectManager.cpp b/xpcom/proxy/src/nsProxyObjectManager.cpp
 --- a/xpcom/proxy/src/nsProxyObjectManager.cpp
 +++ b/xpcom/proxy/src/nsProxyObjectManager.cpp
-@@ -162,12 +162,12 @@
+@@ -162,12 +162,12 @@ nsProxyObjectManager::GetProxyForObject(
      *aProxyObject = nsnull;
  
      // handle special values
 -    nsCOMPtr<nsIThread> thread;
 +    nsIThread* thread = nsnull;
      if (aTarget == NS_PROXY_TO_CURRENT_THREAD) {
        aTarget = NS_GetCurrentThread();
      } else if (aTarget == NS_PROXY_TO_MAIN_THREAD) {
        thread = do_GetMainThread();
 -      aTarget = thread.get();
 +      aTarget = thread;
      }
  
      // check to see if the target is on our thread.  If so, just return the
-@@ -182,11 +182,11 @@
+@@ -182,11 +182,11 @@ nsProxyObjectManager::GetProxyForObject(
              return aObj->QueryInterface(aIID, aProxyObject);
      }
      
 -    nsCOMPtr<nsISupports> realObj = do_QueryInterface(aObj);
 +    nsISupports* realObj = do_QueryInterface(aObj);
  
      // Make sure the object passed in is not a proxy; if it is, be nice and
      // build the proxy for the real object.
 -    nsCOMPtr<nsProxyObject> po = do_QueryInterface(aObj);
 +    nsProxyObject* po = do_QueryInterface(aObj);
      if (po) {
          realObj = po->GetRealObject();
      }
-@@ -230,8 +230,8 @@
+@@ -230,8 +230,8 @@ nsProxyObjectManager::GetClass(REFNSIID 
      if (!iim)
          return NS_ERROR_FAILURE;
  
 -    nsCOMPtr<nsIInterfaceInfo> ii;
 -    nsresult rv = iim->GetInfoForIID(&aIID, getter_AddRefs(ii));
 +    nsIInterfaceInfo* ii = nsnull;
 +    nsresult rv = iim->GetInfoForIID(&aIID, &ii);
      if (NS_FAILED(rv))
          return rv;
  
-@@ -245,12 +245,10 @@
+@@ -245,12 +245,10 @@ nsProxyObjectManager::GetClass(REFNSIID 
  
      if (mProxyClassMap.Get(aIID, aResult)) {
          NS_ASSERTION(*aResult, "Null data in mProxyClassMap");
 -        delete pec;
          return NS_OK;
      }
  
      if (!mProxyClassMap.Put(aIID, pec)) {
 -        delete pec;
          return NS_ERROR_OUT_OF_MEMORY;
      }
  
-@@ -278,7 +276,7 @@
+@@ -278,7 +276,7 @@ NS_GetProxyForObject(nsIEventTarget *tar
  
      // get the proxy object manager
      //
 -    nsCOMPtr<nsIProxyObjectManager> proxyObjMgr = 
 +    nsIProxyObjectManager* proxyObjMgr = 
          do_GetService(proxyObjMgrCID, &rv);
      if (NS_FAILED(rv))
          return rv;
 diff --git a/xpcom/reflect/xptcall/src/xptcall.cpp b/xpcom/reflect/xptcall/src/xptcall.cpp
 --- a/xpcom/reflect/xptcall/src/xptcall.cpp
 +++ b/xpcom/reflect/xptcall/src/xptcall.cpp
-@@ -45,7 +45,6 @@
+@@ -45,7 +45,6 @@ nsXPTCStubBase::QueryInterface(REFNSIID 
                                 void **aInstancePtr)
  {
      if (aIID.Equals(mEntry->mIID)) {
 -        NS_ADDREF_THIS();
          *aInstancePtr = static_cast<nsISupports*>(this);
          return NS_OK;
      }
-@@ -78,6 +77,5 @@
+@@ -78,6 +77,5 @@ EXPORT_XPCOM_API(void)
  EXPORT_XPCOM_API(void)
  NS_DestroyXPTCallStub(nsISomeInterface* aStub)
  {
 -    nsXPTCStubBase* stub = static_cast<nsXPTCStubBase*>(aStub);
 -    delete(stub);
 +    // nothing to do, GC will delete it automatically
  }
 diff --git a/xpfe/components/intl/nsCharsetMenu.cpp b/xpfe/components/intl/nsCharsetMenu.cpp
 --- a/xpfe/components/intl/nsCharsetMenu.cpp
 +++ b/xpfe/components/intl/nsCharsetMenu.cpp
-@@ -152,7 +152,7 @@
+@@ -152,7 +152,7 @@ public:
   * @created         23/Nov/1999
   * @author  Catalin Rotaru [CATA]
   */
 -class nsCharsetMenu : public nsIRDFDataSource, public nsICurrentCharsetListener
 +class nsCharsetMenu : public XPCOMGCFinalizedObject, public nsIRDFDataSource, public nsICurrentCharsetListener
  {
    NS_DECL_CYCLE_COLLECTING_ISUPPORTS
    NS_DECL_CYCLE_COLLECTION_CLASS_AMBIGUOUS(nsCharsetMenu, nsIRDFDataSource)
-@@ -343,7 +343,6 @@
+@@ -343,7 +343,6 @@ NS_IMETHODIMP NS_NewCharsetMenu(nsISuppo
    nsresult res = inst->QueryInterface(aIID, aResult);
    if (NS_FAILED(res)) {
      *aResult = nsnull;
 -    delete inst;
    }
    return res;
  }
-@@ -391,7 +390,7 @@
+@@ -391,7 +390,7 @@ nsCharsetMenu::SetArrayFromEnumerator(ns
  //----------------------------------------------------------------------------
  // Class nsCharsetMenuObserver
  
 -class nsCharsetMenuObserver : public nsIObserver {
 +class nsCharsetMenuObserver : public XPCOMGCFinalizedObject, public nsIObserver {
  
  public:
    NS_DECL_ISUPPORTS
-@@ -525,7 +524,7 @@
+@@ -525,7 +524,7 @@ nsCharsetMenu::nsCharsetMenu()
    }
  
    //get pref service
 -  nsCOMPtr<nsIPrefService> PrefService = do_GetService(NS_PREFSERVICE_CONTRACTID, &res);
 +  nsIPrefService* PrefService = do_GetService(NS_PREFSERVICE_CONTRACTID, &res);
    if (NS_SUCCEEDED(res))
      res = PrefService->GetBranch(nsnull, getter_AddRefs(mPrefs));
  
-@@ -533,7 +532,7 @@
+@@ -533,7 +532,7 @@ nsCharsetMenu::nsCharsetMenu()
    mCharsetMenuObserver = new nsCharsetMenuObserver(this);
  
    if (mCharsetMenuObserver)  {
 -    nsCOMPtr<nsIObserverService> observerService = 
 +    nsIObserverService* observerService = 
               do_GetService("@mozilla.org/observer-service;1", &res);
  
      if (NS_SUCCEEDED(res))
-@@ -564,8 +563,8 @@
+@@ -564,8 +563,8 @@ nsresult nsCharsetMenu::RefreshBrowserMe
  {
    nsresult res = NS_OK;
  
 -  nsCOMPtr<nsIRDFContainer> container;
 -  res = NewRDFContainer(mInner, kNC_BrowserCharsetMenuRoot, getter_AddRefs(container));
 +  nsIRDFContainer* container = nsnull;
 +  res = NewRDFContainer(mInner, kNC_BrowserCharsetMenuRoot, &container);
    if (NS_FAILED(res)) return res;
  
    // clean the menu
-@@ -573,8 +572,8 @@
+@@ -573,8 +572,8 @@ nsresult nsCharsetMenu::RefreshBrowserMe
    if (NS_FAILED(res)) return res;
  
    // rebuild the menu
 -  nsCOMPtr<nsIUTF8StringEnumerator> decoders;
 -  res = mCCManager->GetDecoderList(getter_AddRefs(decoders));
 +  nsIUTF8StringEnumerator* decoders = nsnull;
 +  res = mCCManager->GetDecoderList(&decoders);
    if (NS_FAILED(res)) return res;
  
    nsCStringArray decs;
-@@ -598,16 +597,16 @@
+@@ -598,16 +597,16 @@ nsresult nsCharsetMenu::RefreshMailviewM
  {
    nsresult res = NS_OK;
  
 -  nsCOMPtr<nsIRDFContainer> container;
 -  res = NewRDFContainer(mInner, kNC_MailviewCharsetMenuRoot, getter_AddRefs(container));
 +  nsIRDFContainer* container = nsnull;
 +  res = NewRDFContainer(mInner, kNC_MailviewCharsetMenuRoot, &container);
    if (NS_FAILED(res)) return res;
@@ -3069,17 +3013,17 @@ diff --git a/xpfe/components/intl/nsChar
  
 -  nsCOMPtr<nsIUTF8StringEnumerator> decoders;
 -  res = mCCManager->GetDecoderList(getter_AddRefs(decoders));
 +  nsIUTF8StringEnumerator* decoders = nsnull;
 +  res = mCCManager->GetDecoderList(&decoders);
    if (NS_FAILED(res)) return res;
  
    nsCStringArray decs;
-@@ -631,17 +630,17 @@
+@@ -631,17 +630,17 @@ nsresult nsCharsetMenu::RefreshMaileditM
  {
    nsresult res;
  
 -  nsCOMPtr<nsIRDFContainer> container;
 -  res = NewRDFContainer(mInner, kNC_MaileditCharsetMenuRoot, getter_AddRefs(container));
 +  nsIRDFContainer* container = nsnull;
 +  res = NewRDFContainer(mInner, kNC_MaileditCharsetMenuRoot, &container);
    NS_ENSURE_SUCCESS(res, res);
@@ -3093,28 +3037,28 @@ diff --git a/xpfe/components/intl/nsChar
    // clear the menu
 -  nsCOMPtr<nsIRDFNode> node;
 -  while (NS_SUCCEEDED(enumerator->GetNext(getter_AddRefs(node)))) {
 +  nsIRDFNode* node = nsnull;
 +  while (NS_SUCCEEDED(enumerator->GetNext((class nsISupports**)&node))) {
  
      res = mInner->Unassert(kNC_MaileditCharsetMenuRoot, kNC_Name, node);
      NS_ENSURE_SUCCESS(res, res);
-@@ -651,8 +650,8 @@
+@@ -651,8 +650,8 @@ nsresult nsCharsetMenu::RefreshMaileditM
    }
  
    // get a list of available encoders
 -  nsCOMPtr<nsIUTF8StringEnumerator> encoders;
 -  res = mCCManager->GetEncoderList(getter_AddRefs(encoders));
 +  nsIUTF8StringEnumerator* encoders = nsnull;
 +  res = mCCManager->GetEncoderList(&encoders);
    NS_ENSURE_SUCCESS(res, res);
  
    nsCStringArray encs;
-@@ -669,16 +668,16 @@
+@@ -669,16 +668,16 @@ nsresult nsCharsetMenu::RefreshComposerM
  {
    nsresult res = NS_OK;
  
 -  nsCOMPtr<nsIRDFContainer> container;
 -  res = NewRDFContainer(mInner, kNC_ComposerCharsetMenuRoot, getter_AddRefs(container));
 +  nsIRDFContainer* container = nsnull;
 +  res = NewRDFContainer(mInner, kNC_ComposerCharsetMenuRoot, &container);
    if (NS_FAILED(res)) return res;
@@ -3125,28 +3069,28 @@ diff --git a/xpfe/components/intl/nsChar
  
 -  nsCOMPtr<nsIUTF8StringEnumerator> decoders;
 -  res = mCCManager->GetDecoderList(getter_AddRefs(decoders));
 +  nsIUTF8StringEnumerator* decoders = nsnull;
 +  res = mCCManager->GetDecoderList(&decoders);
    if (NS_FAILED(res)) return res;
  
    nsCStringArray decs;
-@@ -705,8 +704,8 @@
+@@ -705,8 +704,8 @@ nsresult nsCharsetMenu::Init()
    if (!mInitialized)  {
  
      //enumerate decoders
 -    nsCOMPtr<nsIUTF8StringEnumerator> decoders;
 -    res = mCCManager->GetDecoderList(getter_AddRefs(decoders));
 +    nsIUTF8StringEnumerator* decoders = nsnull;
 +    res = mCCManager->GetDecoderList(&decoders);
      if (NS_FAILED(res)) return res;
  
      SetArrayFromEnumerator(decoders, mDecoderList);
-@@ -822,20 +821,20 @@
+@@ -822,20 +821,20 @@ nsresult nsCharsetMenu::SetCharsetCheckm
                                              PRBool aValue)
  {
    nsresult res = NS_OK;
 -  nsCOMPtr<nsIRDFContainer> container;
 -  nsCOMPtr<nsIRDFResource> node;
 +  nsIRDFContainer* container = nsnull;
 +  nsIRDFResource* node = nsnull;
  
@@ -3163,123 +3107,123 @@ diff --git a/xpfe/components/intl/nsChar
 -  nsCOMPtr<nsIRDFLiteral> checkedLiteral;
 +  nsIRDFLiteral* checkedLiteral = nsnull;
    nsAutoString checked; checked.AssignWithConversion((aValue == PR_TRUE) ? "true" : "false");
 -  res = mRDFService->GetLiteral(checked.get(), getter_AddRefs(checkedLiteral));
 +  res = mRDFService->GetLiteral(checked.get(), &checkedLiteral);
    if (NS_FAILED(res)) return res;
    res = Assert(node, kNC_Checked, checkedLiteral, PR_TRUE);
    if (NS_FAILED(res)) return res;
-@@ -851,7 +850,7 @@
+@@ -851,7 +850,7 @@ nsresult nsCharsetMenu::FreeResources()
    nsresult res = NS_OK;
  
    if (mCharsetMenuObserver) {
 -    nsCOMPtr<nsIPrefBranch2> pbi = do_QueryInterface(mPrefs);
 +    nsIPrefBranch2* pbi = do_QueryInterface(mPrefs);
      if (pbi) {
        pbi->RemoveObserver(kBrowserStaticPrefKey, mCharsetMenuObserver);
        pbi->RemoveObserver(kMaileditPrefKey, mCharsetMenuObserver);
-@@ -873,8 +872,8 @@
+@@ -873,8 +872,8 @@ nsresult nsCharsetMenu::InitBrowserMenu(
    nsresult res = NS_OK;
  
    if (!mBrowserMenuInitialized)  {
 -    nsCOMPtr<nsIRDFContainer> container;
 -    res = NewRDFContainer(mInner, kNC_BrowserCharsetMenuRoot, getter_AddRefs(container));
 +    nsIRDFContainer* container = nsnull;
 +    res = NewRDFContainer(mInner, kNC_BrowserCharsetMenuRoot, &container);
      if (NS_FAILED(res)) return res;
  
  
-@@ -902,7 +901,7 @@
+@@ -902,7 +901,7 @@ nsresult nsCharsetMenu::InitBrowserMenu(
      NS_ASSERTION(NS_SUCCEEDED(res), "error initializing browser cache charset menu");
  
      // register prefs callback
 -    nsCOMPtr<nsIPrefBranch2> pbi = do_QueryInterface(mPrefs);
 +    nsIPrefBranch2* pbi = do_QueryInterface(mPrefs);
      if (pbi)
        res = pbi->AddObserver(kBrowserStaticPrefKey, mCharsetMenuObserver, PR_FALSE);
    }
-@@ -922,8 +921,8 @@
+@@ -922,8 +921,8 @@ nsresult nsCharsetMenu::InitMaileditMenu
    nsresult res = NS_OK;
  
    if (!mMaileditMenuInitialized)  {
 -    nsCOMPtr<nsIRDFContainer> container;
 -    res = NewRDFContainer(mInner, kNC_MaileditCharsetMenuRoot, getter_AddRefs(container));
 +    nsIRDFContainer* container = nsnull;
 +    res = NewRDFContainer(mInner, kNC_MaileditCharsetMenuRoot, &container);
      if (NS_FAILED(res)) return res;
  
      //enumerate encoders
-@@ -931,8 +930,8 @@
+@@ -931,8 +930,8 @@ nsresult nsCharsetMenu::InitMaileditMenu
      // charset encoders, but it's safe because we rely on prefs to filter
      // them out. Moreover, 'customize' menu lists only genuine charset 
      // encoders further guarding  against  'font encoders' sneaking in. 
 -    nsCOMPtr<nsIUTF8StringEnumerator> encoders;
 -    res = mCCManager->GetEncoderList(getter_AddRefs(encoders));
 +    nsIUTF8StringEnumerator* encoders = nsnull;
 +    res = mCCManager->GetEncoderList(&encoders);
      if (NS_FAILED(res))  return res;
  
      nsCStringArray maileditEncoderList;
-@@ -942,7 +941,7 @@
+@@ -942,7 +941,7 @@ nsresult nsCharsetMenu::InitMaileditMenu
      NS_ASSERTION(NS_SUCCEEDED(res), "error initializing mailedit charset menu from prefs");
  
      // register prefs callback
 -    nsCOMPtr<nsIPrefBranch2> pbi = do_QueryInterface(mPrefs);
 +    nsIPrefBranch2* pbi = do_QueryInterface(mPrefs);
      if (pbi)
        res = pbi->AddObserver(kMaileditPrefKey, mCharsetMenuObserver, PR_FALSE);
    }
-@@ -962,8 +961,8 @@
+@@ -962,8 +961,8 @@ nsresult nsCharsetMenu::InitMailviewMenu
    nsresult res = NS_OK;
  
    if (!mMailviewMenuInitialized)  {
 -    nsCOMPtr<nsIRDFContainer> container;
 -    res = NewRDFContainer(mInner, kNC_MailviewCharsetMenuRoot, getter_AddRefs(container));
 +    nsIRDFContainer* container = nsnull;
 +    res = NewRDFContainer(mInner, kNC_MailviewCharsetMenuRoot, &container);
      if (NS_FAILED(res)) return res;
  
      nsCStringArray mailviewDecoderList;
-@@ -1004,8 +1003,8 @@
+@@ -1004,8 +1003,8 @@ nsresult nsCharsetMenu::InitComposerMenu
    nsresult res = NS_OK;
  
    if (!mComposerMenuInitialized)  {
 -    nsCOMPtr<nsIRDFContainer> container;
 -    res = NewRDFContainer(mInner, kNC_ComposerCharsetMenuRoot, getter_AddRefs(container));
 +    nsIRDFContainer* container = nsnull;
 +    res = NewRDFContainer(mInner, kNC_ComposerCharsetMenuRoot, &container);
      if (NS_FAILED(res)) return res;
  
      nsCStringArray composerDecoderList;
-@@ -1109,9 +1108,9 @@
+@@ -1109,9 +1108,9 @@ nsresult nsCharsetMenu::InitStaticMenu(n
    NS_TIMELINE_START_TIMER("nsCharsetMenu::InitStaticMenu");
  
    nsresult res = NS_OK;
 -  nsCOMPtr<nsIRDFContainer> container;
 +  nsIRDFContainer* container = nsnull;
  
 -  res = NewRDFContainer(mInner, aResource, getter_AddRefs(container));
 +  res = NewRDFContainer(mInner, aResource, &container);
    if (NS_FAILED(res)) return res;
  
    // XXX work around bug that causes the submenus to be first instead of last
-@@ -1136,9 +1135,9 @@
+@@ -1136,9 +1135,9 @@ nsresult nsCharsetMenu::InitCacheMenu(
    NS_TIMELINE_START_TIMER("nsCharsetMenu::InitCacheMenu");
  
    nsresult res = NS_OK;
 -  nsCOMPtr<nsIRDFContainer> container;
 +  nsIRDFContainer* container = nsnull;
  
 -  res = NewRDFContainer(mInner, aResource, getter_AddRefs(container));
 +  res = NewRDFContainer(mInner, aResource, &container);
    if (NS_FAILED(res)) return res;
  
    res = AddFromNolocPrefsToMenu(aArray, container, aKey, aDecs, "charset.");
-@@ -1158,14 +1157,14 @@
+@@ -1158,14 +1157,14 @@ nsresult nsCharsetMenu::InitAutodetMenu(
  
    if (!mAutoDetectInitialized) {
      nsVoidArray chardetArray;
 -    nsCOMPtr<nsIRDFContainer> container;
 +    nsIRDFContainer* container = nsnull;
      nsCStringArray detectorArray;
  
 -    res = NewRDFContainer(mInner, kNC_BrowserAutodetMenuRoot, getter_AddRefs(container));
@@ -3288,31 +3232,31 @@ diff --git a/xpfe/components/intl/nsChar
  
 -    nsCOMPtr<nsIUTF8StringEnumerator> detectors;
 -    res = mCCManager->GetCharsetDetectorList(getter_AddRefs(detectors));
 +    nsIUTF8StringEnumerator* detectors = nsnull;
 +    res = mCCManager->GetCharsetDetectorList(&detectors);
      if (NS_FAILED(res)) goto done;
  
      res = SetArrayFromEnumerator(detectors, detectorArray);
-@@ -1202,11 +1201,11 @@
+@@ -1202,11 +1201,11 @@ nsresult nsCharsetMenu::InitMoreMenu(nsC
    NS_TIMELINE_START_TIMER("nsCharsetMenu::InitMoreMenu");
  
    nsresult res = NS_OK;
 -  nsCOMPtr<nsIRDFContainer> container;
 +  nsIRDFContainer* container = nsnull;
    nsVoidArray moreMenu;
    nsAutoString prop; prop.AssignWithConversion(aFlag);
  
 -  res = NewRDFContainer(mInner, aResource, getter_AddRefs(container));
 +  res = NewRDFContainer(mInner, aResource, &container);
    if (NS_FAILED(res)) goto done;
  
    // remove charsets "not for browser"
-@@ -1240,12 +1239,12 @@
+@@ -1240,12 +1239,12 @@ nsresult nsCharsetMenu::InitMoreSubmenus
  
    nsresult res = NS_OK;
  
 -  nsCOMPtr<nsIRDFContainer> container1;
 -  nsCOMPtr<nsIRDFContainer> container2;
 -  nsCOMPtr<nsIRDFContainer> container3;
 -  nsCOMPtr<nsIRDFContainer> container4;
 -  nsCOMPtr<nsIRDFContainer> container5;
@@ -3321,17 +3265,17 @@ diff --git a/xpfe/components/intl/nsChar
 +  nsIRDFContainer* container2 = nsnull;
 +  nsIRDFContainer* container3 = nsnull;
 +  nsIRDFContainer* container4 = nsnull;
 +  nsIRDFContainer* container5 = nsnull;
 +  nsIRDFContainer* containerU = nsnull;
    const char key1[] = "intl.charsetmenu.browser.more1";
    const char key2[] = "intl.charsetmenu.browser.more2";
    const char key3[] = "intl.charsetmenu.browser.more3";
-@@ -1254,32 +1253,32 @@
+@@ -1254,32 +1253,32 @@ nsresult nsCharsetMenu::InitMoreSubmenus
    const char keyU[] = "intl.charsetmenu.browser.unicode";
  
    res = NewRDFContainer(mInner, kNC_BrowserMore1CharsetMenuRoot, 
 -    getter_AddRefs(container1));
 +    &container1);
    if (NS_FAILED(res)) return res;
    AddFromPrefsToMenu(NULL, container1, key1, aDecs, NULL);
  
@@ -3360,17 +3304,17 @@ diff --git a/xpfe/components/intl/nsChar
    AddFromPrefsToMenu(NULL, container5, key5, aDecs, NULL);
  
    res = NewRDFContainer(mInner, kNC_BrowserUnicodeCharsetMenuRoot, 
 -    getter_AddRefs(containerU));
 +    &containerU);
    if (NS_FAILED(res)) return res;
    AddFromPrefsToMenu(NULL, containerU, keyU, aDecs, NULL);
  
-@@ -1362,21 +1361,21 @@
+@@ -1362,21 +1361,21 @@ nsresult nsCharsetMenu::AddMenuItemToCon
                          PRInt32 aPlace) 
  {
    nsresult res = NS_OK;
 -  nsCOMPtr<nsIRDFResource> node;
 +  nsIRDFResource* node = nsnull;
  
    nsCAutoString id;
    if (aIDPrefix != NULL) id.Assign(aIDPrefix);
@@ -3386,57 +3330,57 @@ diff --git a/xpfe/components/intl/nsChar
    // set node's title
 -  nsCOMPtr<nsIRDFLiteral> titleLiteral;
 -  res = mRDFService->GetLiteral(title, getter_AddRefs(titleLiteral));
 +  nsIRDFLiteral* titleLiteral = nsnull;
 +  res = mRDFService->GetLiteral(title, &titleLiteral);
    if (NS_FAILED(res)) return res;
  
    if (aPlace < -1) {
-@@ -1466,8 +1465,8 @@
+@@ -1466,8 +1465,8 @@ nsresult nsCharsetMenu::AddFromPrefsToMe
  {
    nsresult res = NS_OK;
  
 -  nsCOMPtr<nsIPrefLocalizedString> pls;
 -  res = mPrefs->GetComplexValue(aKey, NS_GET_IID(nsIPrefLocalizedString), getter_AddRefs(pls));
 +  nsIPrefLocalizedString* pls = nsnull;
 +  res = mPrefs->GetComplexValue(aKey, NS_GET_IID(nsIPrefLocalizedString), (void**)&pls);
    if (NS_FAILED(res)) return res;
  
    if (pls) {
-@@ -1573,8 +1572,8 @@
+@@ -1573,8 +1572,8 @@ nsCharsetMenu::AddCharsetToCache(const n
    i = FindMenuItemInArray(aArray, aCharset, NULL);
    if (i >= 0) return res;
  
 -  nsCOMPtr<nsIRDFContainer> container;
 -  res = NewRDFContainer(mInner, aRDFResource, getter_AddRefs(container));
 +  nsIRDFContainer* container = nsnull;
 +  res = NewRDFContainer(mInner, aRDFResource, &container);
    if (NS_FAILED(res)) return res;
  
    // iff too many items, remove last one
-@@ -1765,7 +1764,7 @@
+@@ -1765,7 +1764,7 @@ nsresult nsCharsetMenu::ReorderMenuItemA
  nsresult nsCharsetMenu::ReorderMenuItemArray(nsVoidArray * aArray)
  {
    nsresult res = NS_OK;
 -  nsCOMPtr<nsICollation> collation;
 +  nsICollation* collation = nsnull;
    PRUint32 count = aArray->Count();
    PRUint32 i;
  
-@@ -1775,7 +1774,7 @@
+@@ -1775,7 +1774,7 @@ nsresult nsCharsetMenu::ReorderMenuItemA
    for (i = 0; i < count; i++)
      array[i].key = nsnull;
  
 -  res = GetCollation(getter_AddRefs(collation));
 +  res = GetCollation(&collation);
    if (NS_FAILED(res))
      goto done;
  
-@@ -1808,14 +1807,14 @@
+@@ -1808,14 +1807,14 @@ nsresult nsCharsetMenu::GetCollation(nsI
  nsresult nsCharsetMenu::GetCollation(nsICollation ** aCollation)
  {
    nsresult res = NS_OK;
 -  nsCOMPtr<nsILocale> locale = nsnull;
 +  nsILocale* locale = nsnull;
    nsICollationFactory * collationFactory = nsnull;
    
 -  nsCOMPtr<nsILocaleService> localeServ = 
--- a/gfx-refcounting
+++ b/gfx-refcounting
@@ -1,14 +1,14 @@
 Bug 421127 - Switch GFX refcounting to its own class hierarchy, so that it doesn't conflict with XPCOMGC work
 
 diff --git a/chrome/src/Makefile.in b/chrome/src/Makefile.in
 --- a/chrome/src/Makefile.in
 +++ b/chrome/src/Makefile.in
-@@ -59,6 +59,7 @@
+@@ -59,6 +59,7 @@ REQUIRES	= xpcom \
  		  xuldoc \
  		  gfx \
  		  layout \
 +		  thebes \
  		  locale \
  		  necko \
  		  dom \
 diff --git a/content/base/src/nsFrameLoader.cpp b/content/base/src/nsFrameLoader.cpp
@@ -29,17 +29,17 @@ diff --git a/content/canvas/src/nsCanvas
  #include "gfxTextRunCache.h"
  
  #include "nsFrameManager.h"
 +
 +using namespace mozilla;
  
  #ifndef M_PI
  #define M_PI		3.14159265358979323846
-@@ -343,15 +345,15 @@
+@@ -343,15 +345,15 @@ protected:
      nsCOMPtr<nsICSSParser> mCSSParser;
  
      // yay cairo
 -    nsRefPtr<gfxContext> mThebesContext;
 -    nsRefPtr<gfxASurface> mThebesSurface;
 +    RefPtr<gfxContext> mThebesContext;
 +    RefPtr<gfxASurface> mThebesSurface;
  
@@ -48,47 +48,47 @@ diff --git a/content/canvas/src/nsCanvas
      cairo_surface_t *mSurface;
  
      nsString mTextStyle;
 -    nsRefPtr<gfxFontGroup> mFontGroup;
 +    RefPtr<gfxFontGroup> mFontGroup;
      gfxFontGroup *GetCurrentFontStyle();
   
      // style handling
-@@ -745,7 +747,7 @@
+@@ -745,7 +747,7 @@ nsCanvasRenderingContext2D::Render(gfxCo
      if (!mThebesSurface)
          return NS_ERROR_FAILURE;
  
 -    nsRefPtr<gfxPattern> pat = new gfxPattern(mThebesSurface);
 +    RefPtr<gfxPattern> pat = new gfxPattern(mThebesSurface);
  
      // XXX I don't want to use PixelSnapped here, but layout doesn't guarantee
      // pixel alignment for this stuff!
-@@ -1651,7 +1653,7 @@
+@@ -1651,7 +1653,7 @@ nsCanvasRenderingContext2D::MozTextAlong
  nsCanvasRenderingContext2D::MozTextAlongPath(const nsAString& textToDraw, PRBool stroke)
  {
      // Most of this code is copied from its svg equivalent
 -    nsRefPtr<gfxFlattenedPath> path(mThebesContext->GetFlattenedPath());
 +    RefPtr<gfxFlattenedPath> path(mThebesContext->GetFlattenedPath());
  
      const PRUnichar* textdata;
      textToDraw.GetData(&textdata);
-@@ -2202,9 +2204,9 @@
+@@ -2202,9 +2204,9 @@ nsCanvasRenderingContext2D::CairoSurface
              rv = canvas->GetSize(&w, &h);
              NS_ENSURE_SUCCESS(rv, rv);
  
 -            nsRefPtr<gfxImageSurface> surf =
 +            RefPtr<gfxImageSurface> surf =
                  new gfxImageSurface (gfxIntSize(w, h), gfxASurface::ImageFormatARGB32);
 -            nsRefPtr<gfxContext> ctx = new gfxContext(surf);
 +            RefPtr<gfxContext> ctx = new gfxContext(surf);
              ctx->SetOperator(gfxContext::OPERATOR_CLEAR);
              ctx->Paint();
              ctx->SetOperator(gfxContext::OPERATOR_OVER);
-@@ -2249,13 +2251,13 @@
+@@ -2249,13 +2251,13 @@ nsCanvasRenderingContext2D::CairoSurface
      if (heightOut)
          *heightOut = imgHeight;
  
 -    nsRefPtr<gfxPattern> gfxpattern;
 +    RefPtr<gfxPattern> gfxpattern;
      img->GetPattern(getter_AddRefs(gfxpattern));
 -    nsRefPtr<gfxASurface> gfxsurf = gfxpattern->GetSurface();
 +    RefPtr<gfxASurface> gfxsurf = gfxpattern->GetSurface();
@@ -118,111 +118,111 @@ diff --git a/content/svg/content/src/nsS
  #undef LoadImage
  #endif
  
 +using namespace mozilla;
 +
  //--------------------Filter Resource-----------------------
  /**
    * nsSVGFilterResource provides functionality for managing images used by
-@@ -175,7 +177,7 @@
+@@ -175,7 +177,7 @@ private:
  
    nsAutoString mInput, mResult;
    nsRect mSourceRegion, mFilterSubregion, mSurfaceRect;
 -  nsRefPtr<gfxImageSurface> mTargetImage;
 +  RefPtr<gfxImageSurface> mTargetImage;
    nsSVGFE *mFilter;
    nsSVGFilterInstance* mInstance;
    PRUint8 *mSourceData, *mTargetData;
-@@ -233,7 +235,7 @@
+@@ -233,7 +235,7 @@ nsSVGFilterResource::AcquireSourceImage(
  {
    aIn->GetAnimVal(mInput);
  
 -  nsRefPtr<gfxImageSurface> surface;
 +  RefPtr<gfxImageSurface> surface;
    mInstance->LookupImage(mInput, getter_AddRefs(surface),
                           &mSourceRegion,
                           mFilter->GetColorModel(mInstance, aIn));
-@@ -244,8 +246,7 @@
+@@ -244,8 +246,7 @@ nsSVGFilterResource::AcquireSourceImage(
    mSourceData = surface->Data();
    *aSourceData = mSourceData;
    if (aSurface) {
 -    *aSurface = nsnull;
 -    surface.swap(*aSurface);
 +    *aSurface = surface.forget().get();
    }
    return NS_OK;
  }
-@@ -266,7 +267,7 @@
+@@ -266,7 +267,7 @@ nsSVGFilterResource::AcquireTargetImage(
    *aTargetData = mTargetData;
    if (aSurface) {
      *aSurface = mTargetImage;
 -    NS_ADDREF(*aSurface);
 +    mTargetImage->AddReference();
    }
    return NS_OK;
  }
-@@ -1681,7 +1682,7 @@
+@@ -1683,7 +1684,7 @@ nsSVGFECompositeElement::Filter(nsSVGFil
  {
    nsresult rv;
    PRUint8 *sourceData, *targetData;
 -  nsRefPtr<gfxImageSurface> sourceSurface, targetSurface;
 +  RefPtr<gfxImageSurface> sourceSurface, targetSurface;
    nsSVGFilterResource fr(this, instance);
  
    rv = fr.AcquireSourceImage(mIn2, &sourceData, getter_AddRefs(sourceSurface));
-@@ -2507,7 +2508,7 @@
+@@ -2509,7 +2510,7 @@ nsSVGFEMergeElement::Filter(nsSVGFilterI
  {
    nsresult rv;
    PRUint8 *sourceData, *targetData;
 -  nsRefPtr<gfxImageSurface> sourceSurface, targetSurface;
 +  RefPtr<gfxImageSurface> sourceSurface, targetSurface;
    nsSVGFilterResource fr(this, instance);
  
    rv = fr.AcquireTargetImage(mResult, &targetData,
-@@ -2752,7 +2753,7 @@
+@@ -2754,7 +2755,7 @@ nsSVGFEOffsetElement::Filter(nsSVGFilter
  {
    nsresult rv;
    PRUint8 *sourceData, *targetData;
 -  nsRefPtr<gfxImageSurface> sourceSurface, targetSurface;
 +  RefPtr<gfxImageSurface> sourceSurface, targetSurface;
    nsSVGFilterResource fr(this, instance);
  
    rv = fr.AcquireSourceImage(mIn1, &sourceData, getter_AddRefs(sourceSurface));
-@@ -2886,7 +2887,7 @@
+@@ -2888,7 +2889,7 @@ nsSVGFEFloodElement::Filter(nsSVGFilterI
  {
    nsresult rv;
    PRUint8 *targetData;
 -  nsRefPtr<gfxImageSurface> targetSurface;
 +  RefPtr<gfxImageSurface> targetSurface;
    nsSVGFilterResource fr(this, instance);
  
    rv = fr.AcquireTargetImage(mResult, &targetData,
-@@ -5593,7 +5594,7 @@
+@@ -5596,7 +5597,7 @@ nsSVGFEImageElement::Filter(nsSVGFilterI
  {
    nsresult rv;
    PRUint8 *targetData;
 -  nsRefPtr<gfxImageSurface> targetSurface;
 +  RefPtr<gfxImageSurface> targetSurface;
  
    nsSVGFilterResource fr(this, instance);
  
-@@ -5619,7 +5620,7 @@
+@@ -5622,7 +5623,7 @@ nsSVGFEImageElement::Filter(nsSVGFilterI
    if (imageContainer)
      imageContainer->GetCurrentFrame(getter_AddRefs(currentFrame));
  
 -  nsRefPtr<gfxPattern> thebesPattern = nsnull;
 +  RefPtr<gfxPattern> thebesPattern = nsnull;
    if (currentFrame) {
      nsCOMPtr<nsIImage> img(do_GetInterface(currentFrame));
  
 diff --git a/content/svg/content/src/nsSVGFilters.h b/content/svg/content/src/nsSVGFilters.h
 --- a/content/svg/content/src/nsSVGFilters.h
 +++ b/content/svg/content/src/nsSVGFilters.h
-@@ -60,10 +60,10 @@
+@@ -60,10 +60,10 @@ protected:
    nsresult Init();
  
    struct ScaleInfo {
 -    nsRefPtr<gfxImageSurface> mRealSource;
 -    nsRefPtr<gfxImageSurface> mRealTarget;
 -    nsRefPtr<gfxImageSurface> mSource;
 -    nsRefPtr<gfxImageSurface> mTarget;
 +    mozilla::RefPtr<gfxImageSurface> mRealSource;
@@ -239,47 +239,47 @@ diff --git a/content/svg/content/src/nsS
  #include "nsSVGUtils.h"
  #include "nsSVGPoint.h"
  #include "gfxContext.h"
 +
 +using namespace mozilla;
  
  nsSVGElement::NumberInfo nsSVGPathElement::sNumberInfo = 
                                                    { &nsGkAtoms::pathLength, 0 };
-@@ -104,7 +106,7 @@
+@@ -104,7 +106,7 @@ nsSVGPathElement::GetTotalLength(float *
  {
    *_retval = 0;
  
 -  nsRefPtr<gfxFlattenedPath> flat = GetFlattenedPath(nsnull);
 +  RefPtr<gfxFlattenedPath> flat = GetFlattenedPath(nsnull);
  
    if (!flat)
      return NS_ERROR_FAILURE;
-@@ -118,7 +120,7 @@
- NS_IMETHODIMP
- nsSVGPathElement::GetPointAtLength(float distance, nsIDOMSVGPoint **_retval)
+@@ -120,7 +122,7 @@ nsSVGPathElement::GetPointAtLength(float
  {
+   NS_ENSURE_FINITE(distance, NS_ERROR_ILLEGAL_VALUE);
+ 
 -  nsRefPtr<gfxFlattenedPath> flat = GetFlattenedPath(nsnull);
 +  RefPtr<gfxFlattenedPath> flat = GetFlattenedPath(nsnull);
    if (!flat)
      return NS_ERROR_FAILURE;
  
-@@ -473,7 +475,7 @@
+@@ -495,7 +497,7 @@ nsSVGPathElement::DidModifySVGObservable
    return nsSVGPathElementBase::DidModifySVGObservable(observable, aModType);
  }
  
 -already_AddRefed<gfxFlattenedPath>
 +AddRefed<gfxFlattenedPath>
  nsSVGPathElement::GetFlattenedPath(nsIDOMSVGMatrix *aMatrix)
  {
    gfxContext ctx(nsSVGUtils::GetThebesComputationalSurface());
 diff --git a/content/svg/content/src/nsSVGPathElement.h b/content/svg/content/src/nsSVGPathElement.h
 --- a/content/svg/content/src/nsSVGPathElement.h
 +++ b/content/svg/content/src/nsSVGPathElement.h
-@@ -104,7 +104,7 @@
+@@ -104,7 +104,7 @@ public:
    virtual void GetMarkPoints(nsTArray<nsSVGMark> *aMarks);
    virtual void ConstructPath(gfxContext *aCtx);
  
 -  virtual already_AddRefed<gfxFlattenedPath> GetFlattenedPath(nsIDOMSVGMatrix *aMatrix);
 +  virtual mozilla::AddRefed<gfxFlattenedPath> GetFlattenedPath(nsIDOMSVGMatrix *aMatrix);
  
    // nsIContent interface
    virtual nsresult Clone(nsINodeInfo *aNodeInfo, nsINode **aResult) const;
@@ -290,63 +290,63 @@ diff --git a/content/svg/content/src/nsS
  
  #include "nsSVGPathGeometryElement.h"
  
 +using namespace mozilla;
 +
  nsSVGPathGeometryElement::nsSVGPathGeometryElement(nsINodeInfo *aNodeInfo)
    : nsSVGPathGeometryElementBase(aNodeInfo)
  {
-@@ -66,8 +68,8 @@
+@@ -66,8 +68,8 @@ nsSVGPathGeometryElement::GetMarkPoints(
  {
  }
  
 -already_AddRefed<gfxFlattenedPath>
 +AddRefed<gfxFlattenedPath>
  nsSVGPathGeometryElement::GetFlattenedPath(nsIDOMSVGMatrix *aMatrix)
  {
 -  return nsnull;
 +  return AddRefed<gfxFlattenedPath>(nsnull);
  }
 diff --git a/content/svg/content/src/nsSVGPathGeometryElement.h b/content/svg/content/src/nsSVGPathGeometryElement.h
 --- a/content/svg/content/src/nsSVGPathGeometryElement.h
 +++ b/content/svg/content/src/nsSVGPathGeometryElement.h
-@@ -61,7 +61,7 @@
+@@ -61,7 +61,7 @@ public:
    virtual PRBool IsMarkable();
    virtual void GetMarkPoints(nsTArray<nsSVGMark> *aMarks);
    virtual void ConstructPath(gfxContext *aCtx) = 0;
 -  virtual already_AddRefed<gfxFlattenedPath> GetFlattenedPath(nsIDOMSVGMatrix *aMatrix);
 +  virtual mozilla::AddRefed<gfxFlattenedPath> GetFlattenedPath(nsIDOMSVGMatrix *aMatrix);
  };
  
  #endif
 diff --git a/editor/txtsvc/src/Makefile.in b/editor/txtsvc/src/Makefile.in
 --- a/editor/txtsvc/src/Makefile.in
 +++ b/editor/txtsvc/src/Makefile.in
-@@ -57,6 +57,7 @@
+@@ -57,6 +57,7 @@ REQUIRES	= xpcom \
  		  dom \
  		  widget \
  		  lwbrk \
 +		  thebes \
  		  $(NULL)
  
  CPPSRCS		= \
 diff --git a/gfx/src/thebes/nsThebesDeviceContext.cpp b/gfx/src/thebes/nsThebesDeviceContext.cpp
 --- a/gfx/src/thebes/nsThebesDeviceContext.cpp
 +++ b/gfx/src/thebes/nsThebesDeviceContext.cpp
-@@ -89,6 +89,8 @@
+@@ -89,6 +89,8 @@ static nsSystemFontsMac *gSystemFonts = 
  #else
  #error Need to declare gSystemFonts!
  #endif
 +
 +using namespace mozilla;
  
  #ifdef MOZ_ENABLE_GTK2
  extern "C" {
-@@ -304,7 +306,7 @@
+@@ -300,7 +302,7 @@ nsThebesDeviceContext::CreateRenderingCo
      nsCOMPtr<nsIRenderingContext> pContext;
      rv = CreateRenderingContextInstance(*getter_AddRefs(pContext));
      if (NS_SUCCEEDED(rv)) {
 -        nsRefPtr<gfxASurface> surface(aWidget->GetThebesSurface());
 +        RefPtr<gfxASurface> surface(aWidget->GetThebesSurface());
          if (surface)
              rv = pContext->Init(this, surface);
          else
@@ -357,33 +357,33 @@ diff --git a/gfx/src/thebes/nsThebesDevi
  
  #include "nsDeviceContext.h"
  
 -#include "nsRefPtrHashtable.h"
 +#include "nsDataHashtable.h"
  #include "nsHashKeys.h"
  
  #include "prlog.h"
-@@ -139,9 +139,10 @@
+@@ -139,9 +139,10 @@ private:
      nscoord mWidth;
      nscoord mHeight;
  
 -    nsRefPtrHashtable<nsISupportsHashKey, gfxASurface> mWidgetSurfaceCache;
 +    nsDataHashtable<nsISupportsHashKey,
 +                    mozilla::RefPtr<gfxASurface> > mWidgetSurfaceCache;
  
 -    nsRefPtr<gfxASurface> mPrintingSurface;
 +    mozilla::RefPtr<gfxASurface> mPrintingSurface;
      float mPrintingScale;
      nsCOMPtr<nsIDeviceContextSpec> mDeviceContextSpec;
  };
 diff --git a/gfx/src/thebes/nsThebesFontMetrics.h b/gfx/src/thebes/nsThebesFontMetrics.h
 --- a/gfx/src/thebes/nsThebesFontMetrics.h
 +++ b/gfx/src/thebes/nsThebesFontMetrics.h
-@@ -183,7 +183,7 @@
+@@ -183,7 +183,7 @@ protected:
      };
      friend class AutoTextRun;
  
 -    nsRefPtr<gfxFontGroup> mFontGroup;
 +    mozilla::RefPtr<gfxFontGroup> mFontGroup;
      gfxFontStyle *mFontStyle;
  
  private:
@@ -394,98 +394,101 @@ diff --git a/gfx/src/thebes/nsThebesImag
  #include "gfxPlatform.h"
  
  #include "prenv.h"
 +
 +using namespace mozilla;
  
  static PRBool gDisableOptimize = PR_FALSE;
  
-@@ -309,7 +311,7 @@
+@@ -309,7 +311,7 @@ nsThebesImage::Optimize(nsIDeviceContext
          if (ddbSize <= kMaxSingleDDBSize &&
              ddbSize + gTotalDDBSize <= kMaxDDBSize)
          {
 -            nsRefPtr<gfxWindowsSurface> wsurf = mWinSurface->OptimizeToDDB(nsnull, gfxIntSize(mWidth, mHeight), mFormat);
 +            RefPtr<gfxWindowsSurface> wsurf = mWinSurface->OptimizeToDDB(nsnull, gfxIntSize(mWidth, mHeight), mFormat);
              if (wsurf) {
                  gTotalDDBs++;
                  gTotalDDBSize += ddbSize;
-@@ -486,7 +488,7 @@
+@@ -486,7 +488,7 @@ nsThebesImage::Draw(nsIRenderingContext 
      // sample the whole pixel.
      subimageRect.RoundOut();
  
 -    nsRefPtr<gfxPattern> pat;
 +    RefPtr<gfxPattern> pat;
      PRBool ctxHasNonTranslation = ctx->CurrentMatrix().HasNonTranslation();
      if ((xscale == 1.0 && yscale == 1.0 && !ctxHasNonTranslation) ||
          subimageRect == gfxRect(0, 0, mWidth, mHeight))
-@@ -501,7 +503,7 @@
+@@ -501,7 +503,7 @@ nsThebesImage::Draw(nsIRenderingContext 
          // integer width and height.
          gfxIntSize size(PRInt32(subimageRect.Width()),
                          PRInt32(subimageRect.Height()));
 -        nsRefPtr<gfxASurface> temp =
 +        RefPtr<gfxASurface> temp =
              gfxPlatform::GetPlatform()->CreateOffscreenSurface(size, mFormat);
          if (!temp || temp->CairoStatus() != 0)
              return NS_ERROR_FAILURE;
-@@ -529,7 +531,7 @@
+@@ -529,7 +531,7 @@ nsThebesImage::Draw(nsIRenderingContext 
          if (dim.width == 0 || dim.height == 0)
              return NS_OK;
  
 -        nsRefPtr<gfxASurface> temp =
 +        RefPtr<gfxASurface> temp =
              gfxPlatform::GetPlatform()->CreateOffscreenSurface (dim,  mFormat);
          if (!temp || temp->CairoStatus() != 0)
              return NS_ERROR_FAILURE;
-@@ -569,7 +571,7 @@
+@@ -569,7 +571,7 @@ nsThebesImage::Draw(nsIRenderingContext 
  
      pat->SetMatrix(mat);
  
 -    nsRefPtr<gfxASurface> target = ctx->CurrentSurface();
 +    RefPtr<gfxASurface> target = ctx->CurrentSurface();
      switch (target->GetType()) {
      case gfxASurface::SurfaceTypeXlib:
      case gfxASurface::SurfaceTypeXcb:
-@@ -635,12 +637,12 @@
-     PRBool doSnap = !(thebesContext->CurrentMatrix().HasNonTranslation());
-     PRBool hasPadding = ((xPadding != 0) || (yPadding != 0));
- 
--    nsRefPtr<gfxASurface> tmpSurfaceGrip;
-+    RefPtr<gfxASurface> tmpSurfaceGrip;
- 
+@@ -642,7 +644,7 @@ nsThebesImage::ThebesDrawTile(gfxContext
      if (mSinglePixel && !hasPadding) {
          thebesContext->SetColor(mSinglePixelColor);
      } else {
 -        nsRefPtr<gfxASurface> surface;
 +        RefPtr<gfxASurface> surface;
          PRInt32 width, height;
  
          if (hasPadding) {
+@@ -701,7 +703,7 @@ nsThebesImage::ThebesDrawTile(gfxContext
+             // tileWidth, tileHeight), with padX padding added to the left
+             // and right sides and padY padding added to the top and bottom
+             // sides.
+-            nsRefPtr<gfxASurface> tmpSurface;
++            RefPtr<gfxASurface> tmpSurface;
+             tmpSurface = gfxPlatform::GetPlatform()->CreateOffscreenSurface(
+                     gfxIntSize(tileWidth + 2*padX, tileHeight + 2*padY), format);
+             if (!tmpSurface || tmpSurface->CairoStatus()) {
 diff --git a/gfx/src/thebes/nsThebesImage.h b/gfx/src/thebes/nsThebesImage.h
 --- a/gfx/src/thebes/nsThebesImage.h
 +++ b/gfx/src/thebes/nsThebesImage.h
-@@ -94,7 +94,7 @@
+@@ -95,7 +95,7 @@ public:
  
      NS_IMETHOD GetSurface(gfxASurface **aSurface) {
          *aSurface = ThebesSurface();
 -        NS_ADDREF(*aSurface);
 +        (*aSurface)->AddReference();
          return NS_OK;
      }
  
-@@ -103,7 +103,7 @@
+@@ -104,7 +104,7 @@ public:
              *aPattern = new gfxPattern(mSinglePixelColor);
          else
              *aPattern = new gfxPattern(ThebesSurface());
 -        NS_ADDREF(*aPattern);
 +        (*aPattern)->AddReference();
          return NS_OK;
      }
  
-@@ -168,12 +168,12 @@
+@@ -169,12 +169,12 @@ protected:
  
      gfxRGBA mSinglePixelColor;
  
 -    nsRefPtr<gfxImageSurface> mImageSurface;
 -    nsRefPtr<gfxASurface> mOptSurface;
 +    mozilla::RefPtr<gfxImageSurface> mImageSurface;
 +    mozilla::RefPtr<gfxASurface> mOptSurface;
  #if defined(XP_WIN)
@@ -503,207 +506,207 @@ diff --git a/gfx/src/thebes/nsThebesRend
 @@ -42,6 +42,7 @@
  
  #include "nsRect.h"
  #include "nsString.h"
 +#include "nsAutoPtr.h"
  #include "nsTransform2D.h"
  #include "nsIRegion.h"
  #include "nsIServiceManager.h"
-@@ -714,7 +715,7 @@
+@@ -714,7 +715,7 @@ nsThebesRenderingContext::GetNativeGraph
          return mThebes->GetCairo();
  #ifdef XP_WIN
      if (aType == NATIVE_WINDOWS_DC) {
 -        nsRefPtr<gfxASurface> surf(mThebes->CurrentSurface());
 +        RefPtr<gfxASurface> surf(mThebes->CurrentSurface());
          if (!surf || surf->CairoStatus())
              return nsnull;
          return static_cast<gfxWindowsSurface*>(static_cast<gfxASurface*>(surf.get()))->GetDC();
 diff --git a/gfx/src/thebes/nsThebesRenderingContext.h b/gfx/src/thebes/nsThebesRenderingContext.h
 --- a/gfx/src/thebes/nsThebesRenderingContext.h
 +++ b/gfx/src/thebes/nsThebesRenderingContext.h
-@@ -232,7 +232,7 @@
+@@ -232,7 +232,7 @@ protected:
      nscolor mColor;
  
      // the rendering context
 -    nsRefPtr<gfxContext> mThebes;
 +    mozilla::RefPtr<gfxContext> mThebes;
  
      // for handing out to people
      void UpdateTempTransformMatrix();
 diff --git a/gfx/thebes/public/gfxASurface.h b/gfx/thebes/public/gfxASurface.h
 --- a/gfx/thebes/public/gfxASurface.h
 +++ b/gfx/thebes/public/gfxASurface.h
-@@ -52,8 +52,9 @@
+@@ -52,8 +52,9 @@ typedef void (*thebes_destroy_func_t) (v
   */
  class THEBES_API gfxASurface {
  public:
 -    nsrefcnt AddRef(void);
 -    nsrefcnt Release(void);
 +    void AddReference();
 +    void ReleaseReference();
 +    uint32_t GetRefCount();
  
  public:
      /**
-@@ -92,7 +93,7 @@
+@@ -92,7 +93,7 @@ public:
      } gfxContentType;
  
      /* Wrap the given cairo surface and return a gfxASurface for it */
 -    static already_AddRefed<gfxASurface> Wrap(cairo_surface_t *csurf);
 +    static mozilla::AddRefed<gfxASurface> Wrap(cairo_surface_t *csurf);
  
      /*** this DOES NOT addref the surface */
      cairo_surface_t *CairoSurface() {
 diff --git a/gfx/thebes/public/gfxAlphaRecovery.h b/gfx/thebes/public/gfxAlphaRecovery.h
 --- a/gfx/thebes/public/gfxAlphaRecovery.h
 +++ b/gfx/thebes/public/gfxAlphaRecovery.h
-@@ -47,9 +47,9 @@
+@@ -47,9 +47,9 @@ public:
       * background and the other on white, return a new surface
       * that contains the contents with recovered alpha.
       */
 -    static already_AddRefed<gfxImageSurface> RecoverAlpha (gfxImageSurface *blackSurface,
 -                                                           gfxImageSurface *whiteSurface,
 -                                                           gfxIntSize dimensions);
 +    static mozilla::AddRefed<gfxImageSurface> RecoverAlpha (gfxImageSurface *blackSurface,
 +                                                            gfxImageSurface *whiteSurface,
 +                                                            gfxIntSize dimensions);
  };
  
  #endif /* _GFXALPHARECOVERY_H_ */
 diff --git a/gfx/thebes/public/gfxAtsuiFonts.h b/gfx/thebes/public/gfxAtsuiFonts.h
 --- a/gfx/thebes/public/gfxAtsuiFonts.h
 +++ b/gfx/thebes/public/gfxAtsuiFonts.h
-@@ -91,7 +91,7 @@
+@@ -91,7 +91,7 @@ protected:
  
      ATSUStyle mATSUStyle;
  
 -    nsRefPtr<MacOSFontEntry> mFontEntry;
 +    RefPtr<MacOSFontEntry> mFontEntry;
  
      PRBool mHasMirroring;
      PRBool mHasMirroringLookedUp;
-@@ -138,7 +138,7 @@
+@@ -138,7 +138,7 @@ public:
  
      PRBool HasFont(ATSUFontID fid);
  
 -    inline gfxAtsuiFont* WhichFontSupportsChar(nsTArray< nsRefPtr<gfxFont> >& aFontList, PRUint32 aCh) {
 +    inline gfxAtsuiFont* WhichFontSupportsChar(nsTArray< RefPtr<gfxFont> >& aFontList, PRUint32 aCh) {
          PRUint32 len = aFontList.Length();
          for (PRUint32 i = 0; i < len; i++) {
              gfxAtsuiFont* font = static_cast<gfxAtsuiFont*>(aFontList.ElementAt(i).get());
-@@ -149,9 +149,9 @@
+@@ -149,9 +149,9 @@ public:
      }
  
     // search through pref fonts for a character, return nsnull if no matching pref font
 -   already_AddRefed<gfxAtsuiFont> WhichPrefFontSupportsChar(PRUint32 aCh);
 +   AddRefed<gfxAtsuiFont> WhichPrefFontSupportsChar(PRUint32 aCh);
     
 -   already_AddRefed<gfxAtsuiFont> FindFontForChar(PRUint32 aCh, PRUint32 aPrevCh, PRUint32 aNextCh, gfxAtsuiFont* aPrevMatchedFont);
 +   AddRefed<gfxAtsuiFont> FindFontForChar(PRUint32 aCh, PRUint32 aPrevCh, PRUint32 aNextCh, gfxAtsuiFont* aPrevMatchedFont);
  
  protected:
      static PRBool FindATSUFont(const nsAString& aName,
-@@ -165,8 +165,8 @@
-                        PRBool aWrapped, PRUint32 aSegmentStart, PRUint32 aSegmentLength);
+@@ -183,8 +183,8 @@ protected:
+                        PRUint32 aOffsetInTextRun, PRUint32 aLengthInTextRun);
      
      // cache the most recent pref font to avoid general pref font lookup
 -    nsRefPtr<MacOSFamilyEntry>    mLastPrefFamily;
 -    nsRefPtr<gfxAtsuiFont>        mLastPrefFont;
 +    RefPtr<MacOSFamilyEntry>   mLastPrefFamily;
 +    RefPtr<gfxAtsuiFont>       mLastPrefFont;
      eFontPrefLang                 mLastPrefLang;       // lang group for last pref font
      PRBool                        mLastPrefFirstFont;  // is this the first font in the list of pref fonts for this lang group?
      eFontPrefLang                 mPageLang;
 diff --git a/gfx/thebes/public/gfxBeOSPlatform.h b/gfx/thebes/public/gfxBeOSPlatform.h
 --- a/gfx/thebes/public/gfxBeOSPlatform.h
 +++ b/gfx/thebes/public/gfxBeOSPlatform.h
-@@ -52,7 +52,7 @@
+@@ -52,7 +52,7 @@ public:
          return (gfxBeOSPlatform*) gfxPlatform::GetPlatform();
      }
  
 -    already_AddRefed<gfxASurface>
 +    AddRefed<gfxASurface>
          CreateOffscreenSurface(PRUint32 width,
                                 PRUint32 height,
                                 gfxASurface::gfxImageFormat imageFormat);
 diff --git a/gfx/thebes/public/gfxContext.h b/gfx/thebes/public/gfxContext.h
 --- a/gfx/thebes/public/gfxContext.h
 +++ b/gfx/thebes/public/gfxContext.h
-@@ -66,7 +66,7 @@
+@@ -66,7 +66,7 @@ typedef struct _cairo cairo_t;
   * as opposed to app units.
   */
  class THEBES_API gfxContext {
 -    THEBES_INLINE_DECL_REFCOUNTING(gfxContext)
 +    DECL_INLINE_REFCOUNTING(gfxContext)
  
  public:
      /**
-@@ -86,8 +86,8 @@
+@@ -86,8 +86,8 @@ public:
       * active, returns the surface the gfxContext was created with,
       * and 0,0 in dx,dy.
       */
 -    already_AddRefed<gfxASurface> CurrentSurface(gfxFloat *dx, gfxFloat *dy);
 -    already_AddRefed<gfxASurface> CurrentSurface() {
 +    mozilla::AddRefed<gfxASurface> CurrentSurface(gfxFloat *dx, gfxFloat *dy);
 +    mozilla::AddRefed<gfxASurface> CurrentSurface() {
          return CurrentSurface(NULL, NULL);
      }
  
-@@ -341,7 +341,7 @@
+@@ -341,7 +341,7 @@ public:
      /**
       * Get the source pattern (solid color, normal pattern, surface, etc)
       */
 -    already_AddRefed<gfxPattern> GetPattern();
 +    mozilla::AddRefed<gfxPattern> GetPattern();
  
      /**
       ** Painting
-@@ -526,7 +526,7 @@
+@@ -526,7 +526,7 @@ public:
       * Groups
       */
      void PushGroup(gfxASurface::gfxContentType content = gfxASurface::CONTENT_COLOR);
 -    already_AddRefed<gfxPattern> PopGroup();
 +    mozilla::AddRefed<gfxPattern> PopGroup();
      void PopGroupToSource();
  
      /**
-@@ -545,7 +545,7 @@
+@@ -545,7 +545,7 @@ public:
      /**
       ** Obtaining a "flattened" path - path converted to all line segments
       **/
 -    already_AddRefed<gfxFlattenedPath> GetFlattenedPath();
 +    mozilla::AddRefed<gfxFlattenedPath> GetFlattenedPath();
  
      /**
       ** Flags
-@@ -577,7 +577,7 @@
+@@ -577,7 +577,7 @@ public:
  
  private:
      cairo_t *mCairo;
 -    nsRefPtr<gfxASurface> mSurface;
 +    mozilla::RefPtr<gfxASurface> mSurface;
      PRInt32 mFlags;
  };
  
 diff --git a/gfx/thebes/public/gfxFont.h b/gfx/thebes/public/gfxFont.h
 --- a/gfx/thebes/public/gfxFont.h
 +++ b/gfx/thebes/public/gfxFont.h
-@@ -182,8 +182,8 @@
+@@ -182,8 +182,8 @@ public:
  
      // Look up a font in the cache. Returns an addrefed pointer, or null
      // if there's nothing matching in the cache
 -    already_AddRefed<gfxFont> Lookup(const nsAString &aName,
 -                                     const gfxFontStyle *aFontGroup);
 +    mozilla::AddRefed<gfxFont> Lookup(const nsAString &aName,
 +                                       const gfxFontStyle *aFontGroup);
      // We created a new font (presumably because Lookup returned null);
      // put it in the cache. The font's refcount should be nonzero. It is
      // allowable to add a new font even if there is one already in the
-@@ -355,32 +355,26 @@
+@@ -355,32 +355,26 @@ private:
  /* a SPECIFIC single font family */
  class THEBES_API gfxFont {
  public:
 -    nsrefcnt AddRef(void) {
 -        NS_PRECONDITION(PRInt32(mRefCnt) >= 0, "illegal refcnt");
 +    void AddReference(void) {
          if (mExpirationState.IsTracked()) {
              gfxFontCache::GetCache()->RemoveObject(this);
@@ -729,113 +732,113 @@ diff --git a/gfx/thebes/public/gfxFont.h
      PRInt32 GetRefCount() { return mRefCnt; }
  
  protected:
 -    nsAutoRefCnt mRefCnt;
 +    mozilla::RefCnt mRefCnt;
  
  public:
      gfxFont(const nsAString &aName, const gfxFontStyle *aFontGroup);
-@@ -561,7 +555,7 @@
+@@ -561,7 +555,7 @@ protected:
  };
  
  class THEBES_API gfxTextRunFactory {
 -    THEBES_INLINE_DECL_REFCOUNTING(gfxTextRunFactory)
 +    DECL_INLINE_REFCOUNTING(gfxTextRunFactory)
  
  public:
      // Flags in the mask 0xFFFF0000 are reserved for textrun clients
-@@ -1139,7 +1133,7 @@
+@@ -1139,7 +1133,7 @@ public:
  
      // The text is divided into GlyphRuns as necessary
      struct GlyphRun {
 -        nsRefPtr<gfxFont> mFont;   // never null
 +        mozilla::RefPtr<gfxFont> mFont;   // never null
          PRUint32          mCharacterOffset; // into original UTF16 string
      };
  
-@@ -1370,7 +1364,7 @@
+@@ -1370,7 +1364,7 @@ private:
          const PRUnichar *mDouble;
      } mText;
      void             *mUserData;
 -    gfxFontGroup     *mFontGroup; // addrefed
 +    mozilla::RefPtr<gfxFontGroup> mFontGroup;
      gfxSkipChars      mSkipChars;
      nsExpirationState mExpirationState;
      PRUint32          mAppUnitsPerDevUnit;
-@@ -1477,7 +1471,7 @@
+@@ -1478,7 +1472,7 @@ protected:
  protected:
      nsString mFamilies;
      gfxFontStyle mStyle;
 -    nsTArray< nsRefPtr<gfxFont> > mFonts;
 +    nsTArray< mozilla::RefPtr<gfxFont> > mFonts;
      gfxFloat mUnderlineOffset;
  
      // Init this font group's font metrics. If there no bad fonts, you don't need to call this.
 diff --git a/gfx/thebes/public/gfxOS2Platform.h b/gfx/thebes/public/gfxOS2Platform.h
 --- a/gfx/thebes/public/gfxOS2Platform.h
 +++ b/gfx/thebes/public/gfxOS2Platform.h
-@@ -55,7 +55,7 @@
+@@ -55,7 +55,7 @@ public:
          return (gfxOS2Platform*) gfxPlatform::GetPlatform();
      }
  
 -    already_AddRefed<gfxASurface>
 +    AddRefed<gfxASurface>
          CreateOffscreenSurface(const gfxIntSize& size,
                                 gfxASurface::gfxImageFormat imageFormat);
  
 diff --git a/gfx/thebes/public/gfxPangoFonts.h b/gfx/thebes/public/gfxPangoFonts.h
 --- a/gfx/thebes/public/gfxPangoFonts.h
 +++ b/gfx/thebes/public/gfxPangoFonts.h
-@@ -64,7 +64,7 @@
+@@ -64,7 +64,7 @@ public:
      gfxPangoFont (const nsAString& aName,
                    const gfxFontStyle *aFontStyle);
      virtual ~gfxPangoFont ();
 -    static already_AddRefed<gfxPangoFont> GetOrMakeFont(PangoFont *aPangoFont);
 +    static mozilla::AddRefed<gfxPangoFont> GetOrMakeFont(PangoFont *aPangoFont);
  
      static void Shutdown();
  
 diff --git a/gfx/thebes/public/gfxPath.h b/gfx/thebes/public/gfxPath.h
 --- a/gfx/thebes/public/gfxPath.h
 +++ b/gfx/thebes/public/gfxPath.h
-@@ -43,7 +43,7 @@
+@@ -43,7 +43,7 @@ typedef struct cairo_path cairo_path_t;
  typedef struct cairo_path cairo_path_t;
  
  class THEBES_API gfxFlattenedPath {
 -    THEBES_INLINE_DECL_REFCOUNTING(gfxPath)
 +    DECL_INLINE_REFCOUNTING(gfxPath)
  
  public:
      gfxFlattenedPath(cairo_path_t *aPath);
 diff --git a/gfx/thebes/public/gfxPattern.h b/gfx/thebes/public/gfxPattern.h
 --- a/gfx/thebes/public/gfxPattern.h
 +++ b/gfx/thebes/public/gfxPattern.h
-@@ -49,7 +49,7 @@
+@@ -49,7 +49,7 @@ typedef struct _cairo_pattern cairo_patt
  
  
  class THEBES_API gfxPattern {
 -    THEBES_INLINE_DECL_REFCOUNTING(gfxPattern)
 +    DECL_INLINE_REFCOUNTING(gfxPattern)
  
  public:
      gfxPattern(cairo_pattern_t *aPattern);
-@@ -95,7 +95,7 @@
+@@ -95,7 +95,7 @@ public:
      /* returns TRUE if it succeeded */
      PRBool GetSolidColor(gfxRGBA& aColor);
  
 -    already_AddRefed<gfxASurface> GetSurface();
 +    mozilla::AddRefed<gfxASurface> GetSurface();
  
  protected:
      cairo_pattern_t *mPattern;
 diff --git a/gfx/thebes/public/gfxPlatform.h b/gfx/thebes/public/gfxPlatform.h
 --- a/gfx/thebes/public/gfxPlatform.h
 +++ b/gfx/thebes/public/gfxPlatform.h
-@@ -131,12 +131,12 @@
+@@ -135,12 +135,12 @@ public:
       * Create an offscreen surface of the given dimensions
       * and image format.
       */
 -    virtual already_AddRefed<gfxASurface> CreateOffscreenSurface(const gfxIntSize& size,
 -                                                                 gfxASurface::gfxImageFormat imageFormat) = 0;
 +    virtual mozilla::AddRefed<gfxASurface> CreateOffscreenSurface(const gfxIntSize& size,
 +                                                                   gfxASurface::gfxImageFormat imageFormat) = 0;
  
@@ -845,31 +848,31 @@ diff --git a/gfx/thebes/public/gfxPlatfo
 +    virtual mozilla::AddRefed<gfxASurface> OptimizeImage(gfxImageSurface *aSurface,
 +                                                          gfxASurface::gfxImageFormat format);
  
      /*
       * Font bits
 diff --git a/gfx/thebes/public/gfxPlatformGtk.h b/gfx/thebes/public/gfxPlatformGtk.h
 --- a/gfx/thebes/public/gfxPlatformGtk.h
 +++ b/gfx/thebes/public/gfxPlatformGtk.h
-@@ -54,8 +54,8 @@
+@@ -54,8 +54,8 @@ public:
          return (gfxPlatformGtk*) gfxPlatform::GetPlatform();
      }
  
 -    already_AddRefed<gfxASurface> CreateOffscreenSurface(const gfxIntSize& size,
 -                                                         gfxASurface::gfxImageFormat imageFormat);
 +    mozilla::AddRefed<gfxASurface> CreateOffscreenSurface(const gfxIntSize& size,
 +                                                          gfxASurface::gfxImageFormat imageFormat);
  
      nsresult GetFontList(const nsACString& aLangGroup,
                           const nsACString& aGenericFamily,
 diff --git a/gfx/thebes/public/gfxPlatformMac.h b/gfx/thebes/public/gfxPlatformMac.h
 --- a/gfx/thebes/public/gfxPlatformMac.h
 +++ b/gfx/thebes/public/gfxPlatformMac.h
-@@ -50,11 +50,11 @@
+@@ -50,11 +50,11 @@ public:
          return (gfxPlatformMac*) gfxPlatform::GetPlatform();
      }
  
 -    already_AddRefed<gfxASurface> CreateOffscreenSurface(const gfxIntSize& size,
 -                                                         gfxASurface::gfxImageFormat imageFormat);
 +    AddRefed<gfxASurface> CreateOffscreenSurface(const gfxIntSize& size,
 +                                                           gfxASurface::gfxImageFormat imageFormat);
  
@@ -878,29 +881,29 @@ diff --git a/gfx/thebes/public/gfxPlatfo
 +    AddRefed<gfxASurface> gfxPlatformMac::OptimizeImage(gfxImageSurface *aSurface,
 +                                                                  gfxASurface::gfxImageFormat format);
  
      nsresult ResolveFontName(const nsAString& aFontName,
                               FontResolverCallback aCallback,
 diff --git a/gfx/thebes/public/gfxQuartzImageSurface.h b/gfx/thebes/public/gfxQuartzImageSurface.h
 --- a/gfx/thebes/public/gfxQuartzImageSurface.h
 +++ b/gfx/thebes/public/gfxQuartzImageSurface.h
-@@ -48,7 +48,7 @@
+@@ -48,7 +48,7 @@ public:
  
      virtual ~gfxQuartzImageSurface();
  
 -    already_AddRefed<gfxImageSurface> GetImageSurface();
 +    AddRefed<gfxImageSurface> GetImageSurface();
  };
  
  #endif /* GFX_QUARTZIMAGESURFACE_H */
 diff --git a/gfx/thebes/public/gfxQuartzNativeDrawing.h b/gfx/thebes/public/gfxQuartzNativeDrawing.h
 --- a/gfx/thebes/public/gfxQuartzNativeDrawing.h
 +++ b/gfx/thebes/public/gfxQuartzNativeDrawing.h
-@@ -74,11 +74,11 @@
+@@ -74,11 +74,11 @@ private:
      gfxQuartzNativeDrawing(const gfxQuartzNativeDrawing&);
      const gfxQuartzNativeDrawing& operator=(const gfxQuartzNativeDrawing&);
  
 -    nsRefPtr<gfxContext> mContext;
 +    RefPtr<gfxContext> mContext;
      gfxRect mNativeRect; // not yet used, will be needed for offscreen buffers
  
      // saved state
@@ -918,17 +921,17 @@ diff --git a/gfx/thebes/public/gfxTypes.
  #include "prtypes.h"
 +#include "nscore.h"
 +#include "nsDebug.h"
 +
 +#include "mozilla/RefPtr.h"
  
  /**
   * Currently needs to be 'double' for Cairo compatibility. Could
-@@ -54,34 +58,4 @@
+@@ -54,34 +58,4 @@ typedef double gfxFloat;
  # define THEBES_API NS_IMPORT
  #endif
  
 -/**
 - * Define refcounting for Thebes.  For now use the stuff from nsISupportsImpl
 - * even though it forces the functions to be virtual...
 - */
 -#include "nsISupportsImpl.h"
@@ -956,134 +959,125 @@ diff --git a/gfx/thebes/public/gfxTypes.
 -protected:                                                                    \
 -    nsAutoRefCnt mRefCnt;                                                     \
 -public:
 -
  #endif /* GFX_TYPES_H */
 diff --git a/gfx/thebes/public/gfxWindowsFonts.h b/gfx/thebes/public/gfxWindowsFonts.h
 --- a/gfx/thebes/public/gfxWindowsFonts.h
 +++ b/gfx/thebes/public/gfxWindowsFonts.h
-@@ -280,7 +280,7 @@
+@@ -287,7 +287,7 @@ private:
  
      LOGFONTW mLogFont;
  
 -    nsRefPtr<FontEntry> mFontEntry;
 +    RefPtr<FontEntry> mFontEntry;
      
      virtual PRBool SetupCairoFont(gfxContext *aContext);
  };
-@@ -308,7 +308,7 @@
+@@ -315,7 +315,7 @@ public:
          return mGenericFamily;
      }
  
 -    const nsTArray<nsRefPtr<FontEntry> >& GetFontList() const {
 +    const nsTArray<RefPtr<FontEntry> >& GetFontList() const {
          return mFontEntries;
      }
      PRUint32 FontListLength() const {
-@@ -335,7 +335,7 @@
+@@ -342,7 +342,7 @@ private:
  private:
  
      nsCString mGenericFamily;
 -    nsTArray<nsRefPtr<FontEntry> > mFontEntries;
 +    nsTArray<RefPtr<FontEntry> > mFontEntries;
  };
  
  #endif /* GFX_WINDOWSFONTS_H */
 diff --git a/gfx/thebes/public/gfxWindowsNativeDrawing.h b/gfx/thebes/public/gfxWindowsNativeDrawing.h
 --- a/gfx/thebes/public/gfxWindowsNativeDrawing.h
 +++ b/gfx/thebes/public/gfxWindowsNativeDrawing.h
-@@ -128,7 +128,7 @@
+@@ -128,7 +128,7 @@ public:
  
  private:
  
 -    nsRefPtr<gfxContext> mContext;
 +    RefPtr<gfxContext> mContext;
      gfxRect mNativeRect;
      PRUint32 mNativeDrawFlags;
  
-@@ -136,7 +136,7 @@
+@@ -136,7 +136,7 @@ private:
      PRUint8 mRenderState;
  
      gfxPoint mDeviceOffset;
 -    nsRefPtr<gfxPattern> mBlackPattern, mWhitePattern;
 +    RefPtr<gfxPattern> mBlackPattern, mWhitePattern;
  
      enum TransformType {
          TRANSLATION_ONLY,
-@@ -150,7 +150,7 @@
+@@ -150,7 +150,7 @@ private:
      XFORM mWorldTransform;
  
      // saved state
 -    nsRefPtr<gfxWindowsSurface> mWinSurface, mBlackSurface, mWhiteSurface;
 +    RefPtr<gfxWindowsSurface> mWinSurface, mBlackSurface, mWhiteSurface;
      HDC mDC;
      XFORM mOldWorldTransform;
      POINT mOrigViewportOrigin;
 diff --git a/gfx/thebes/public/gfxWindowsPlatform.h b/gfx/thebes/public/gfxWindowsPlatform.h
 --- a/gfx/thebes/public/gfxWindowsPlatform.h
 +++ b/gfx/thebes/public/gfxWindowsPlatform.h
-@@ -56,8 +56,8 @@
+@@ -57,8 +57,8 @@ public:
          return (gfxWindowsPlatform*) gfxPlatform::GetPlatform();
      }
  
 -    already_AddRefed<gfxASurface> CreateOffscreenSurface(const gfxIntSize& size,
 -                                                         gfxASurface::gfxImageFormat imageFormat);
 +    AddRefed<gfxASurface> CreateOffscreenSurface(const gfxIntSize& size,
 +                                                           gfxASurface::gfxImageFormat imageFormat);
  
      nsresult GetFontList(const nsACString& aLangGroup,
                           const nsACString& aGenericFamily,
-@@ -90,7 +90,7 @@
+@@ -93,7 +93,7 @@ public:
      PRBool GetPrefFontEntries(const nsCString& aLangGroup, nsTArray<nsRefPtr<FontEntry> > *array);
      void SetPrefFontEntries(const nsCString& aLangGroup, nsTArray<nsRefPtr<FontEntry> >& array);
  
 -    typedef nsDataHashtable<nsStringHashKey, nsRefPtr<FontFamily> > FontTable;
 +    typedef nsDataHashtable<nsStringHashKey, RefPtr<FontFamily> > FontTable;
  
  private:
      void Init();
-@@ -109,7 +109,7 @@
+@@ -112,7 +112,7 @@ private:
                                                           void* userArg);
  
      static PLDHashOperator PR_CALLBACK FontGetCMapDataProc(nsStringHashKey::KeyType aKey,
 -                                                           nsRefPtr<FontFamily>& aFontFamily,
 +                                                           RefPtr<FontFamily>& aFontFamily,
                                                             void* userArg);
  
      static int CALLBACK FontResolveProc(const ENUMLOGFONTEXW *lpelfe,
-@@ -117,12 +117,12 @@
+@@ -120,12 +120,12 @@ private:
                                          DWORD fontType, LPARAM data);
  
      static PLDHashOperator PR_CALLBACK HashEnumFunc(nsStringHashKey::KeyType aKey,
 -                                                    nsRefPtr<FontFamily>& aData,
 +                                                    RefPtr<FontFamily>& aData,
                                                      void* userArg);
  
      static PLDHashOperator PR_CALLBACK FindFontForCharProc(nsStringHashKey::KeyType aKey,
 -                                                             nsRefPtr<FontFamily>& aFontFamily,
 -                                                             void* userArg);
 +                                                           RefPtr<FontFamily>& aFontFamily,
 +                                                           void* userArg);
  
      virtual cmsHPROFILE GetPlatformCMSOutputProfile();
  
-@@ -136,7 +136,7 @@
-     // when system-wide font lookup fails for a character, cache it to skip future searches
-     gfxSparseBitSet mCodepointsWithNoFonts;
-     
--    nsDataHashtable<nsCStringHashKey, nsTArray<nsRefPtr<FontEntry> > > mPrefFonts;
-+    nsDataHashtable<nsCStringHashKey, nsTArray<RefPtr<FontEntry> > > mPrefFonts;
- };
- 
- #endif /* GFX_WINDOWS_PLATFORM_H */
 diff --git a/gfx/thebes/public/gfxWindowsSurface.h b/gfx/thebes/public/gfxWindowsSurface.h
 --- a/gfx/thebes/public/gfxWindowsSurface.h
 +++ b/gfx/thebes/public/gfxWindowsSurface.h
-@@ -68,11 +68,11 @@
+@@ -68,11 +68,11 @@ public:
  
      HDC GetDC() { return mDC; }
  
 -    already_AddRefed<gfxImageSurface> GetImageSurface();
 +    AddRefed<gfxImageSurface> GetImageSurface();
  
 -    already_AddRefed<gfxWindowsSurface> OptimizeToDDB(HDC dc,
 -                                                      const gfxIntSize& size,
@@ -1092,17 +1086,17 @@ diff --git a/gfx/thebes/public/gfxWindow
 +                                                        const gfxIntSize& size,
 +                                                        gfxImageFormat format);
  
      nsresult BeginPrinting(const nsAString& aTitle, const nsAString& aPrintToFileName);
      nsresult EndPrinting();
 diff --git a/gfx/thebes/public/gfxXlibNativeRenderer.h b/gfx/thebes/public/gfxXlibNativeRenderer.h
 --- a/gfx/thebes/public/gfxXlibNativeRenderer.h
 +++ b/gfx/thebes/public/gfxXlibNativeRenderer.h
-@@ -87,7 +87,7 @@
+@@ -87,7 +87,7 @@ public:
      };
  
      struct DrawOutput {
 -        nsRefPtr<gfxASurface> mSurface;
 +        mozilla::RefPtr<gfxASurface> mSurface;
          PRPackedBool mUniformAlpha;
          PRPackedBool mUniformColor;
          gfxRGBA      mColor;
@@ -1121,17 +1115,17 @@ diff --git a/gfx/thebes/src/gfxASurface.
  // refcount mismatch issues.
 -nsrefcnt
 -gfxASurface::AddRef(void)
 +void
 +gfxASurface::AddReference()
  {
      if (mSurfaceValid) {
          if (mFloatingRefs) {
-@@ -72,17 +74,15 @@
+@@ -72,17 +74,15 @@ gfxASurface::AddRef(void)
          } else {
              cairo_surface_reference(mSurface);
          }
 -
 -        return (nsrefcnt) cairo_surface_get_reference_count(mSurface);
      } else {
          // the surface isn't valid, but we still need to refcount
          // the gfxASurface
@@ -1142,17 +1136,17 @@ diff --git a/gfx/thebes/src/gfxASurface.
  
 -nsrefcnt
 -gfxASurface::Release(void)
 +void
 +gfxASurface::ReleaseReference(void)
  {
      if (mSurfaceValid) {
          NS_ASSERTION(mFloatingRefs == 0, "gfxASurface::Release with floating refs still hanging around!");
-@@ -90,20 +90,21 @@
+@@ -90,20 +90,21 @@ gfxASurface::Release(void)
          // Note that there is a destructor set on user data for mSurface,
          // which will delete this gfxASurface wrapper when the surface's refcount goes
          // out of scope.
 -        nsrefcnt refcnt = (nsrefcnt) cairo_surface_get_reference_count(mSurface);
          cairo_surface_destroy(mSurface);
 -
 -        // |this| may not be valid any more, don't use it!
 -
@@ -1171,36 +1165,36 @@ diff --git a/gfx/thebes/src/gfxASurface.
 +{
 +    if (mSurfaceValid) {
 +        return cairo_surface_get_reference_count(mSurface);
      }
 +    return mFloatingRefs;
  }
  
  void
-@@ -125,7 +126,7 @@
+@@ -125,7 +126,7 @@ gfxASurface::SetSurfaceWrapper(cairo_sur
      cairo_surface_set_user_data(csurf, &gfxasurface_pointer_key, asurf, SurfaceDestroyFunc);
  }
  
 -already_AddRefed<gfxASurface>
 +AddRefed<gfxASurface>
  gfxASurface::Wrap (cairo_surface_t *csurf)
  {
      gfxASurface *result;
-@@ -134,8 +135,7 @@
+@@ -134,8 +135,7 @@ gfxASurface::Wrap (cairo_surface_t *csur
      result = GetSurfaceWrapper(csurf);
      if (result) {
          // fprintf(stderr, "Existing wrapper for %p -> %p\n", csurf, result);
 -        NS_ADDREF(result);
 -        return result;
 +        return do_AddRef(result);
      }
  
      /* No wrapper; figure out the surface type and create it */
-@@ -169,8 +169,7 @@
+@@ -169,8 +169,7 @@ gfxASurface::Wrap (cairo_surface_t *csur
  
      // fprintf(stderr, "New wrapper for %p -> %p\n", csurf, result);
  
 -    NS_ADDREF(result);
 -    return result;
 +    return do_AddRef(result);
  }
  
@@ -1211,17 +1205,17 @@ diff --git a/gfx/thebes/src/gfxAlphaReco
 @@ -40,6 +40,7 @@
  
  #include "gfxImageSurface.h"
  
 +using namespace mozilla;
  
  struct gfxAlphaRecoveryResult {
      gfxAlphaRecoveryResult()
-@@ -57,14 +58,14 @@
+@@ -57,14 +58,14 @@ static void _compute_alpha_values (unsig
                                     gfxIntSize dimensions,
                                     gfxAlphaRecoveryResult *result);
  
 -already_AddRefed<gfxImageSurface>
 +AddRefed<gfxImageSurface>
  gfxAlphaRecovery::RecoverAlpha (gfxImageSurface *blackSurf,
                                  gfxImageSurface *whiteSurf,
                                  gfxIntSize dimensions)
@@ -1229,30 +1223,30 @@ diff --git a/gfx/thebes/src/gfxAlphaReco
  
 -    nsRefPtr<gfxImageSurface> resultSurf;
 -    resultSurf = new gfxImageSurface(dimensions, gfxASurface::ImageFormatARGB32);
 +    RefPtr<gfxImageSurface> resultSurf =
 +      new gfxImageSurface(dimensions, gfxASurface::ImageFormatARGB32);
  
      // copy blackSurf into resultSurf
      gfxContext ctx(resultSurf);
-@@ -80,8 +81,7 @@
+@@ -80,8 +81,7 @@ gfxAlphaRecovery::RecoverAlpha (gfxImage
  
      // XX use result, maybe return pattern, etc.
  
 -    NS_ADDREF(resultSurf.get());
 -    return resultSurf.get();
 +    return resultSurf.forget();
  }
  
  /** from cairo-xlib-utils.c, modified */
 diff --git a/gfx/thebes/src/gfxAtsuiFonts.cpp b/gfx/thebes/src/gfxAtsuiFonts.cpp
 --- a/gfx/thebes/src/gfxAtsuiFonts.cpp
 +++ b/gfx/thebes/src/gfxAtsuiFonts.cpp
-@@ -423,20 +423,19 @@
+@@ -423,20 +423,19 @@ gfxAtsuiFont::GetFontEntry()
   * except for OOM in which case we do nothing and return null.
   */
   
 -static already_AddRefed<gfxAtsuiFont>
 +static AddRefed<gfxAtsuiFont>
  GetOrMakeFont(MacOSFontEntry *aFontEntry, const gfxFontStyle *aStyle, PRBool aNeedsBold)
  {
      // the font entry name is the psname, not the family name
@@ -1268,149 +1262,149 @@ diff --git a/gfx/thebes/src/gfxAtsuiFont
 -    gfxFont *f = nsnull;
 -    font.swap(f);
 -    return static_cast<gfxAtsuiFont *>(f);
 +
 +    return AddRefed<gfxAtsuiFont>(static_cast<gfxAtsuiFont*>(font.forget().get()));
  }
  
  gfxAtsuiFontGroup::gfxAtsuiFontGroup(const nsAString& families,
-@@ -461,7 +460,7 @@
+@@ -462,7 +461,7 @@ gfxAtsuiFontGroup::gfxAtsuiFontGroup(con
          MacOSFontEntry *defaultFont = gfxQuartzFontCache::SharedFontCache()->GetDefaultFont(aStyle, needsBold);
          NS_ASSERTION(defaultFont, "invalid default font returned by GetDefaultFont");
  
 -        nsRefPtr<gfxAtsuiFont> font = GetOrMakeFont(defaultFont, aStyle, needsBold);
 +        RefPtr<gfxAtsuiFont> font = GetOrMakeFont(defaultFont, aStyle, needsBold);
  
          if (font) {
              mFonts.AppendElement(font);
-@@ -495,7 +494,7 @@
+@@ -498,7 +497,7 @@ gfxAtsuiFontGroup::FindATSUFont(const ns
      MacOSFontEntry *fe = fc->FindFontForFamily(aName, fontStyle, needsBold);
  
      if (fe && !fontGroup->HasFont(fe->GetFontID())) {
 -        nsRefPtr<gfxAtsuiFont> font = GetOrMakeFont(fe, fontStyle, needsBold);
 +        RefPtr<gfxAtsuiFont> font = GetOrMakeFont(fe, fontStyle, needsBold);
          if (font) {
              fontGroup->mFonts.AppendElement(font);
          }
-@@ -718,11 +717,11 @@
+@@ -748,11 +747,11 @@ gfxAtsuiFontGroup::HasFont(ATSUFontID fi
  }
  
  struct PrefFontCallbackData {
 -    PrefFontCallbackData(nsTArray<nsRefPtr<MacOSFamilyEntry> >& aFamiliesArray) 
 +    PrefFontCallbackData(nsTArray<RefPtr<MacOSFamilyEntry> >& aFamiliesArray) 
          : mPrefFamilies(aFamiliesArray)
      {}
  
 -    nsTArray<nsRefPtr<MacOSFamilyEntry> >& mPrefFamilies;
 +    nsTArray<RefPtr<MacOSFamilyEntry> >& mPrefFamilies;
  
      static PRBool AddFontFamilyEntry(eFontPrefLang aLang, const nsAString& aName, void *aClosure)
      {
-@@ -737,12 +736,12 @@
+@@ -767,12 +766,12 @@ struct PrefFontCallbackData {
  };
  
  
 -already_AddRefed<gfxAtsuiFont>
 +AddRefed<gfxAtsuiFont>
  gfxAtsuiFontGroup::WhichPrefFontSupportsChar(PRUint32 aCh)
  {
      // FindCharUnicodeRange only supports BMP character points and there are no non-BMP fonts in prefs
      if (aCh > 0xFFFF)
 -        return nsnull;
 +        return AddRefed<gfxAtsuiFont>(nsnull);
  
      // get the pref font list if it hasn't been set up already
      PRUint32 unicodeRange = FindCharUnicodeRange(aCh);
-@@ -750,7 +749,7 @@
+@@ -780,7 +779,7 @@ gfxAtsuiFontGroup::WhichPrefFontSupports
  
      // if the last pref font was the first family in the pref list, no need to recheck through a list of families
      if (mLastPrefFont && charLang == mLastPrefLang && mLastPrefFirstFont && mLastPrefFont->TestCharacterMap(aCh)) {
 -        nsRefPtr<gfxAtsuiFont> prefFont = mLastPrefFont;
 +        RefPtr<gfxAtsuiFont> prefFont = mLastPrefFont;
          return prefFont.forget();
      }
      
-@@ -762,7 +761,7 @@
+@@ -792,7 +791,7 @@ gfxAtsuiFontGroup::WhichPrefFontSupports
      macPlatform->GetLangPrefs(prefLangs, numLangs, charLang, mPageLang);
      
      for (i = 0; i < numLangs; i++) {
 -        nsAutoTArray<nsRefPtr<MacOSFamilyEntry>, 5> families;
 +        nsAutoTArray<RefPtr<MacOSFamilyEntry>, 5> families;
          eFontPrefLang currentLang = prefLangs[i];
          
          gfxQuartzFontCache *fc = gfxQuartzFontCache::SharedFontCache();
-@@ -789,7 +788,7 @@
+@@ -819,7 +818,7 @@ gfxAtsuiFontGroup::WhichPrefFontSupports
              // GetOrMakeFont repeatedly.  speeds up FindFontForChar lookup times for subsequent
              // pref font lookups
              if (family == mLastPrefFamily && mLastPrefFont->TestCharacterMap(aCh)) {
 -                nsRefPtr<gfxAtsuiFont> prefFont = mLastPrefFont;
 +                RefPtr<gfxAtsuiFont> prefFont = mLastPrefFont;
                  return prefFont.forget();
              }
              
-@@ -797,7 +796,7 @@
+@@ -827,7 +826,7 @@ gfxAtsuiFontGroup::WhichPrefFontSupports
              MacOSFontEntry *fe = family->FindFont(&mStyle, needsBold);
              // if ch in cmap, create and return a gfxFont
              if (fe && fe->TestCharacterMap(aCh)) {
 -                nsRefPtr<gfxAtsuiFont> prefFont = GetOrMakeFont(fe, &mStyle, needsBold);
 +                RefPtr<gfxAtsuiFont> prefFont = GetOrMakeFont(fe, &mStyle, needsBold);
                  mLastPrefFamily = family;
                  mLastPrefFont = prefFont;
                  mLastPrefLang = charLang;
-@@ -808,13 +807,13 @@
+@@ -838,13 +837,13 @@ gfxAtsuiFontGroup::WhichPrefFontSupports
          }
      }
      
 -    return nsnull;
 +    return AddRefed<gfxAtsuiFont>(nsnull);
  }
  
 -already_AddRefed<gfxAtsuiFont>
 +AddRefed<gfxAtsuiFont>
  gfxAtsuiFontGroup::FindFontForChar(PRUint32 aCh, PRUint32 aPrevCh, PRUint32 aNextCh, gfxAtsuiFont* aPrevMatchedFont)
  {
 -    nsRefPtr<gfxAtsuiFont>    selectedFont;
 +    RefPtr<gfxAtsuiFont>    selectedFont;
      
      // if this character or the next one is a joiner use the
      // same font as the previous range if we can
-@@ -859,7 +858,7 @@
+@@ -889,7 +888,7 @@ gfxAtsuiFontGroup::FindFontForChar(PRUin
          }
      }
  
 -    return nsnull;
 +    return AddRefed<gfxAtsuiFont>(nsnull);
  }
  
  /**
-@@ -1317,7 +1316,7 @@
+@@ -1347,7 +1346,7 @@ public:
      PRUint32 MatchNextRange() 
      { 
          PRUint32                matchStartOffset, chStartOffset, ch, nextCh;
 -        nsRefPtr<gfxAtsuiFont>  font;
 +        RefPtr<gfxAtsuiFont>  font;
          
          matchStartOffset = mPrevOffset;
  
-@@ -1376,8 +1375,8 @@
+@@ -1406,8 +1405,8 @@ private:
      PRUint32                mPrevCh;
      PRBool                  mFirstRange;
      gfxAtsuiFontGroup       *mFontGroup;
 -    nsRefPtr<gfxAtsuiFont>  mMatchedFont;
 -    nsRefPtr<gfxAtsuiFont>  mNextMatchedFont;
 +    RefPtr<gfxAtsuiFont> mMatchedFont;
 +    RefPtr<gfxAtsuiFont> mNextMatchedFont;
  };
  
  
 diff --git a/gfx/thebes/src/gfxBeOSPlatform.cpp b/gfx/thebes/src/gfxBeOSPlatform.cpp
 --- a/gfx/thebes/src/gfxBeOSPlatform.cpp
 +++ b/gfx/thebes/src/gfxBeOSPlatform.cpp
-@@ -66,7 +66,7 @@
+@@ -66,7 +66,7 @@ gfxBeOSPlatform::~gfxBeOSPlatform()
  #endif
  }
  
 -already_AddRefed<gfxASurface>
 +AddRefed<gfxASurface>
  gfxBeOSPlatform::CreateOffscreenSurface (PRUint32 width,
                                           PRUint32 height,
                                           gfxASurface::gfxImageFormat imageFormat)
@@ -1420,17 +1414,17 @@ diff --git a/gfx/thebes/src/gfxContext.c
 @@ -56,6 +56,7 @@
  #include "gfxPattern.h"
  #include "gfxPlatform.h"
  
 +using namespace mozilla;
  
  gfxContext::gfxContext(gfxASurface *surface) :
      mSurface(surface)
-@@ -74,16 +75,14 @@
+@@ -74,16 +75,14 @@ gfxContext::OriginalSurface()
      return mSurface;
  }
  
 -already_AddRefed<gfxASurface>
 +AddRefed<gfxASurface>
  gfxContext::CurrentSurface(gfxFloat *dx, gfxFloat *dy)
  {
      cairo_surface_t *s = cairo_get_group_target(mCairo);
@@ -1439,53 +1433,53 @@ diff --git a/gfx/thebes/src/gfxContext.c
              cairo_surface_get_device_offset(s, dx, dy);
 -        gfxASurface *ret = mSurface;
 -        NS_ADDREF(ret);
 -        return ret;
 +        return do_AddRef(mSurface);
      }
  
      if (dx && dy)
-@@ -667,7 +666,7 @@
+@@ -667,7 +666,7 @@ gfxContext::SetPattern(gfxPattern *patte
      cairo_set_source(mCairo, pattern->CairoPattern());
  }
  
 -already_AddRefed<gfxPattern>
 +AddRefed<gfxPattern>
  gfxContext::GetPattern()
  {
      cairo_pattern_t *pat = cairo_get_source(mCairo);
-@@ -679,8 +678,7 @@
+@@ -679,8 +678,7 @@ gfxContext::GetPattern()
      else
          wrapper = new gfxPattern(gfxRGBA(0,0,0,0));
  
 -    NS_IF_ADDREF(wrapper);
 -    return wrapper;
 +    return do_AddRef(wrapper);
  }
  
  
-@@ -712,14 +710,13 @@
+@@ -712,14 +710,13 @@ gfxContext::PushGroup(gfxASurface::gfxCo
      cairo_push_group_with_content(mCairo, (cairo_content_t) content);
  }
  
 -already_AddRefed<gfxPattern>
 +AddRefed<gfxPattern>
  gfxContext::PopGroup()
  {
      cairo_pattern_t *pat = cairo_pop_group(mCairo);
      gfxPattern *wrapper = new gfxPattern(pat);
      cairo_pattern_destroy(pat);
 -    NS_IF_ADDREF(wrapper);
 -    return wrapper;
 +    return do_AddRef(wrapper);
  }
  
  void
-@@ -764,13 +761,12 @@
+@@ -764,13 +761,12 @@ gfxContext::GetUserStrokeExtent()
      return gfxRect(xmin, ymin, xmax - xmin, ymax - ymin);
  }
  
 -already_AddRefed<gfxFlattenedPath>
 +AddRefed<gfxFlattenedPath>
  gfxContext::GetFlattenedPath()
  {
      gfxFlattenedPath *path =
@@ -1503,17 +1497,17 @@ diff --git a/gfx/thebes/src/gfxFont.cpp 
  
  #include "nsCRT.h"
  
 +using namespace mozilla;
 +
  gfxFontCache *gfxFontCache::gGlobalCache = nsnull;
  
  #ifdef DEBUG_roc
-@@ -107,18 +109,16 @@
+@@ -107,18 +109,16 @@ gfxFontCache::HashEntry::KeyEquals(const
             aKey->mStyle->Equals(*mFont->GetStyle());
  }
  
 -already_AddRefed<gfxFont>
 +AddRefed<gfxFont>
  gfxFontCache::Lookup(const nsAString &aName,
                       const gfxFontStyle *aStyle)
  {
@@ -1525,25 +1519,25 @@ diff --git a/gfx/thebes/src/gfxFont.cpp 
  
 -    gfxFont *font = entry->mFont;
 -    NS_ADDREF(font);
 -    return font;
 +    return do_AddRef(entry->mFont);
  }
  
  void
-@@ -1050,7 +1050,6 @@
+@@ -1087,7 +1087,6 @@ gfxTextRun::gfxTextRun(const gfxTextRunF
  {
      NS_ASSERTION(mAppUnitsPerDevUnit != 0, "Invalid app unit scale");
      MOZ_COUNT_CTOR(gfxTextRun);
 -    NS_ADDREF(mFontGroup);
      if (aParams->mSkipChars) {
          mSkipChars.TakeFrom(aParams->mSkipChars);
      }
-@@ -1084,7 +1083,6 @@
+@@ -1121,7 +1120,6 @@ gfxTextRun::~gfxTextRun()
  #ifdef DEBUG_TEXT_RUN_STORAGE_METRICS
      AccountStorageForTextRun(this, -1);
  #endif
 -    NS_RELEASE(mFontGroup);
      MOZ_COUNT_DTOR(gfxTextRun);
  }
  
 diff --git a/gfx/thebes/src/gfxFontconfigUtils.cpp b/gfx/thebes/src/gfxFontconfigUtils.cpp
@@ -1553,47 +1547,47 @@ diff --git a/gfx/thebes/src/gfxFontconfi
  
  #include "nsIAtom.h"
  #include "nsCRT.h"
 +
 +using namespace mozilla;
  
  /* static */ gfxFontconfigUtils* gfxFontconfigUtils::sUtils = nsnull;
  
-@@ -305,7 +307,7 @@
+@@ -309,7 +311,7 @@ gfxFontconfigUtils::UpdateFontListIntern
          return NS_OK;
  
      for (PRInt32 i = 0; i < mAliasForMultiFonts.Count(); i++) {
 -        nsRefPtr<gfxFontNameList> fonts = new gfxFontNameList;
 +        RefPtr<gfxFontNameList> fonts = new gfxFontNameList;
          nsCAutoString fontname(*mAliasForMultiFonts.CStringAt(i));
          rv = GetResolvedFonts(fontname, fonts);
          if (NS_FAILED(rv))
-@@ -493,7 +495,7 @@
+@@ -497,7 +499,7 @@ gfxFontconfigUtils::ResolveFontName(cons
      if (mAliasForMultiFonts.IndexOfIgnoreCase(fontname) >= 0) {
          nsCAutoString key;
          ToLowerCase(fontname, key);
 -        nsRefPtr<gfxFontNameList> fonts;
 +        RefPtr<gfxFontNameList> fonts;
          if (!mAliasTable.Get(key, &fonts))
              NS_ERROR("The mAliasTable was broken!");
          for (PRUint32 i = 0; i < fonts->Length(); i++) {
 diff --git a/gfx/thebes/src/gfxFontconfigUtils.h b/gfx/thebes/src/gfxFontconfigUtils.h
 --- a/gfx/thebes/src/gfxFontconfigUtils.h
 +++ b/gfx/thebes/src/gfxFontconfigUtils.h
-@@ -46,7 +46,7 @@
+@@ -46,7 +46,7 @@ class gfxFontNameList : public nsTArray<
  class gfxFontNameList : public nsTArray<nsString>
  {
  public:
 -    THEBES_INLINE_DECL_REFCOUNTING(gfxFontList)
 +    DECL_INLINE_REFCOUNTING(gfxFontList)
      PRBool Exists(nsAString& aName);
  };
  
-@@ -93,7 +93,7 @@
+@@ -93,7 +93,7 @@ protected:
      nsCStringArray mAliasForSingleFont;
      nsCStringArray mAliasForMultiFonts;
  
 -    nsDataHashtable<nsCStringHashKey, nsRefPtr<gfxFontNameList> > mAliasTable;
 +    nsDataHashtable<nsCStringHashKey, mozilla::RefPtr<gfxFontNameList> > mAliasTable;
  };
  
  #endif /* GFX_FONTCONFIG_UTILS_H */
@@ -1607,72 +1601,72 @@ diff --git a/gfx/thebes/src/gfxImageSurf
 +
 +#include <string.h>
  
  gfxImageSurface::gfxImageSurface(const gfxIntSize& size, gfxImageFormat format) :
      mSize(size), mFormat(format)
 diff --git a/gfx/thebes/src/gfxOS2Fonts.cpp b/gfx/thebes/src/gfxOS2Fonts.cpp
 --- a/gfx/thebes/src/gfxOS2Fonts.cpp
 +++ b/gfx/thebes/src/gfxOS2Fonts.cpp
-@@ -397,10 +397,10 @@
+@@ -397,10 +397,10 @@ PRBool gfxOS2Font::SetupCairoFont(gfxCon
   * In either case, add a ref and return it ---
   * except for OOM in which case we do nothing and return null.
   */
 -static already_AddRefed<gfxOS2Font> GetOrMakeFont(const nsAString& aName,
 +static AddRefed<gfxOS2Font> GetOrMakeFont(const nsAString& aName,
                                                    const gfxFontStyle *aStyle)
  {
 -    nsRefPtr<gfxFont> font = gfxFontCache::GetCache()->Lookup(aName, aStyle);
 +    RefPtr<gfxFont> font = gfxFontCache::GetCache()->Lookup(aName, aStyle);
      if (!font) {
          font = new gfxOS2Font(aName, aStyle);
          if (!font)
-@@ -450,7 +450,7 @@
+@@ -450,7 +450,7 @@ gfxOS2FontGroup::gfxOS2FontGroup(const n
      }
  
      for (int i = 0; i < familyArray.Count(); i++) {
 -        nsRefPtr<gfxOS2Font> font = GetOrMakeFont(*familyArray[i], &mStyle);
 +        RefPtr<gfxOS2Font> font = GetOrMakeFont(*familyArray[i], &mStyle);
          if (font) {
              mFonts.AppendElement(font);
          }
-@@ -479,7 +479,7 @@
+@@ -479,7 +479,7 @@ gfxOS2FontGroup::gfxOS2FontGroup(const n
          for (int i = 3; i < fontList.Count(); i++) {
              // check for duplicates that we already found through the familyArray
              if (familyArray.IndexOf(*fontList[i]) == -1) {
 -                nsRefPtr<gfxOS2Font> font = GetOrMakeFont(*fontList[i], &mStyle);
 +                RefPtr<gfxOS2Font> font = GetOrMakeFont(*fontList[i], &mStyle);
                  if (font) {
                      mFonts.AppendElement(font);
                  }
 diff --git a/gfx/thebes/src/gfxOS2Platform.cpp b/gfx/thebes/src/gfxOS2Platform.cpp
 --- a/gfx/thebes/src/gfxOS2Platform.cpp
 +++ b/gfx/thebes/src/gfxOS2Platform.cpp
-@@ -81,7 +81,7 @@
+@@ -81,7 +81,7 @@ gfxOS2Platform::~gfxOS2Platform()
  #endif
  }
  
 -already_AddRefed<gfxASurface>
 +AddRefed<gfxASurface>
  gfxOS2Platform::CreateOffscreenSurface(const gfxIntSize& aSize,
                                         gfxASurface::gfxImageFormat aImageFormat)
  {
 diff --git a/gfx/thebes/src/gfxPangoFonts.cpp b/gfx/thebes/src/gfxPangoFonts.cpp
 --- a/gfx/thebes/src/gfxPangoFonts.cpp
 +++ b/gfx/thebes/src/gfxPangoFonts.cpp
-@@ -79,6 +79,8 @@
+@@ -78,6 +78,8 @@
+ #include <gdk/gdkpango.h>
  
  #include <math.h>
- 
++
 +using namespace mozilla;
-+
+ 
  #define FLOAT_PANGO_SCALE ((gfxFloat)PANGO_SCALE)
  
- #ifndef PANGO_VERSION_CHECK
-@@ -137,19 +139,17 @@
+@@ -483,19 +485,17 @@ gfxPangoFontGroup::FontCallback (const n
   * In either case, add a ref, append it to the aFonts array, and return it ---
   * except for OOM in which case we do nothing and return null.
   */
 -static already_AddRefed<gfxPangoFont>
 +static AddRefed<gfxPangoFont>
  GetOrMakeFont(const nsAString& aName, const gfxFontStyle *aStyle)
  {
 -    nsRefPtr<gfxFont> font = gfxFontCache::GetCache()->Lookup(aName, aStyle);
@@ -1686,51 +1680,51 @@ diff --git a/gfx/thebes/src/gfxPangoFont
      }
 -    gfxFont *f = nsnull;
 -    font.swap(f);
 -    return static_cast<gfxPangoFont *>(f);
 +    return do_AddRef(static_cast<gfxPangoFont*>(font.get()));
  }
  
  gfxPangoFontGroup::gfxPangoFontGroup (const nsAString& families,
-@@ -186,7 +186,7 @@
+@@ -532,7 +532,7 @@ gfxPangoFontGroup::gfxPangoFontGroup (co
          fcFamilies.Append(NS_LITERAL_STRING("sans-serif"));
      }
  
 -    nsRefPtr<gfxPangoFont> font = GetOrMakeFont(fcFamilies, &mStyle);
 +    RefPtr<gfxPangoFont> font = GetOrMakeFont(fcFamilies, &mStyle);
      if (font) {
          mFonts.AppendElement(font);
      }
-@@ -368,7 +368,7 @@
+@@ -714,7 +714,7 @@ NewPangoFontDescription(const nsAString 
   */
  
  /* static */
 -already_AddRefed<gfxPangoFont>
 +AddRefed<gfxPangoFont>
  gfxPangoFont::GetOrMakeFont(PangoFont *aPangoFont)
  {
      gfxPangoFont *font = static_cast<gfxPangoFont*>
-@@ -401,13 +401,12 @@
+@@ -747,13 +747,12 @@ gfxPangoFont::GetOrMakeFont(PangoFont *a
  
          pango_font_description_free(desc);
          if (!font)
 -            return nsnull;
 +            return AddRefed<gfxPangoFont>(NULL);
  
          // Do not add this font to the gfxFontCache hash table as this may not
          // be the PangoFont that fontconfig chooses for this style.
      }
 -    NS_ADDREF(font);
 -    return font;
 +    return do_AddRef(font);
  }
  
  static PangoFont*
-@@ -1278,7 +1277,7 @@
+@@ -1655,7 +1654,7 @@ gfxPangoFontGroup::CreateGlyphRunsItemiz
          }
  
          /* look up the gfxPangoFont from the PangoFont */
 -        nsRefPtr<gfxPangoFont> font =
 +        RefPtr<gfxPangoFont> font =
              gfxPangoFont::GetOrMakeFont(item->analysis.font);
  
          nsresult rv = aTextRun->AddGlyphRun(font, utf16Offset, PR_TRUE);
@@ -1741,17 +1735,17 @@ diff --git a/gfx/thebes/src/gfxPattern.c
  
  #include "cairo.h"
  #include "lcms.h"
 +
 +using namespace mozilla;
  
  gfxPattern::gfxPattern(cairo_pattern_t *aPattern)
  {
-@@ -160,13 +162,13 @@
+@@ -160,13 +162,13 @@ gfxPattern::GetSolidColor(gfxRGBA& aColo
                                    &aColor.a) == CAIRO_STATUS_SUCCESS;
  }
  
 -already_AddRefed<gfxASurface>
 +AddRefed<gfxASurface>
  gfxPattern::GetSurface()
  {
      cairo_surface_t *surf = nsnull;
@@ -1769,17 +1763,17 @@ diff --git a/gfx/thebes/src/gfxPlatform.
  #include "plstr.h"
  #include "nsIPrefService.h"
  #include "nsIPrefBranch.h"
 +
 +using namespace mozilla;
  
  gfxPlatform *gPlatform = nsnull;
  int gGlitzState = -1;
-@@ -228,24 +230,22 @@
+@@ -232,24 +234,22 @@ gfxPlatform::SetUseGlitz(PRBool use)
      gGlitzState = (use ? 1 : 0);
  }
  
 -already_AddRefed<gfxASurface>
 +AddRefed<gfxASurface>
  gfxPlatform::OptimizeImage(gfxImageSurface *aSurface,
                             gfxASurface::gfxImageFormat format)
  {
@@ -1810,61 +1804,61 @@ diff --git a/gfx/thebes/src/gfxPlatformG
  
  #include "lcms.h"
  
 +using namespace mozilla;
 +
  PRInt32 gfxPlatformGtk::sDPI = -1;
  gfxFontconfigUtils *gfxPlatformGtk::sFontconfigUtils = nsnull;
  
-@@ -104,11 +106,11 @@
+@@ -104,11 +106,11 @@ gfxPlatformGtk::~gfxPlatformGtk()
  #endif
  }
  
 -already_AddRefed<gfxASurface>
 +AddRefed<gfxASurface>
  gfxPlatformGtk::CreateOffscreenSurface(const gfxIntSize& size,
                                         gfxASurface::gfxImageFormat imageFormat)
  {
 -    nsRefPtr<gfxASurface> newSurface = nsnull;
 +    RefPtr<gfxASurface> newSurface = nsnull;
  
      int glitzf;
      int xrenderFormatID;
-@@ -130,7 +132,7 @@
+@@ -130,7 +132,7 @@ gfxPlatformGtk::CreateOffscreenSurface(c
              xrenderFormatID = PictStandardA1;
              break;
          default:
 -            return nsnull;
 +            return AddRefed<gfxASurface>(nsnull);
      }
  
      // XXX we really need a different interface here, something that passes
-@@ -138,7 +140,7 @@
+@@ -138,7 +140,7 @@ gfxPlatformGtk::CreateOffscreenSurface(c
      // we should try to match
      Display* display = GDK_DISPLAY();
      if (!display)
 -        return nsnull;
 +        return AddRefed<gfxASurface>(nsnull);
  
      if (!UseGlitz()) {
          GdkPixmap* pixmap = nsnull;
 diff --git a/gfx/thebes/src/gfxPlatformMac.cpp b/gfx/thebes/src/gfxPlatformMac.cpp
 --- a/gfx/thebes/src/gfxPlatformMac.cpp
 +++ b/gfx/thebes/src/gfxPlatformMac.cpp
-@@ -66,7 +66,7 @@
+@@ -66,7 +66,7 @@ gfxPlatformMac::gfxPlatformMac()
  #endif
  }
  
 -already_AddRefed<gfxASurface>
 +AddRefed<gfxASurface>
  gfxPlatformMac::CreateOffscreenSurface(const gfxIntSize& size,
                                         gfxASurface::gfxImageFormat imageFormat)
  {
-@@ -141,28 +141,25 @@
+@@ -141,28 +141,25 @@ gfxPlatformMac::CreateOffscreenSurface(c
  #endif
      }
  
 -    NS_IF_ADDREF(newSurface);
 -    return newSurface;
 +    return do_AddRef(newSurface);
  }
  
@@ -1899,47 +1893,47 @@ diff --git a/gfx/thebes/src/gfxQuartzFon
 @@ -41,7 +41,6 @@
  #define GFXQUARTZFONTCACHE_H_
  
  #include "nsDataHashtable.h"
 -#include "nsRefPtrHashtable.h"
  
  #include "gfxFontUtils.h"
  #include "gfxAtsuiFonts.h"
-@@ -60,7 +59,7 @@
+@@ -60,7 +59,7 @@ struct FontSearch {
      const PRUint32 ch;
      gfxAtsuiFont *fontToMatch;
      PRInt32 matchRank;
 -    nsRefPtr<MacOSFontEntry> bestMatch;
 +    RefPtr<MacOSFontEntry> bestMatch;
  };
  
  class MacOSFamilyEntry;
-@@ -130,9 +129,9 @@
+@@ -130,9 +129,9 @@ public:
      virtual void LocalizedName(nsAString& aLocalizedName);
      virtual PRBool HasOtherFamilyNames();
      
 -    nsTArray<nsRefPtr<MacOSFontEntry> >& GetFontList() { return mAvailableFonts; }
 +    nsTArray<RefPtr<MacOSFontEntry> >& GetFontList() { return mAvailableFonts; }
      
 -    void AddFontEntry(nsRefPtr<MacOSFontEntry> aFontEntry) {
 +    void AddFontEntry(RefPtr<MacOSFontEntry> aFontEntry) {
          mAvailableFonts.AppendElement(aFontEntry);
      }
      
-@@ -166,7 +165,7 @@
+@@ -174,7 +173,7 @@ protected:
      MacOSFontEntry* FindFontWeight(MacOSFontEntry* aFontsForWeights[], const gfxFontStyle* aStyle, PRBool& aNeedsBold);
      
      nsString mName;  // canonical font family name returned from NSFontManager
 -    nsTArray<nsRefPtr<MacOSFontEntry> >  mAvailableFonts;
 +    nsTArray<RefPtr<MacOSFontEntry> >  mAvailableFonts;
      PRPackedBool mOtherFamilyNamesInitialized;
      PRPackedBool mHasOtherFamilyNames;
      PRPackedBool mIsBadUnderlineFontFamily;
-@@ -227,15 +226,15 @@
+@@ -236,15 +235,15 @@ public:
  
      static PRInt32 AppleWeightToCSSWeight(PRInt32 aAppleWeight);
      
 -    PRBool GetPrefFontFamilyEntries(eFontPrefLang aLangGroup, nsTArray<nsRefPtr<MacOSFamilyEntry> > *array);
 -    void SetPrefFontFamilyEntries(eFontPrefLang aLangGroup, nsTArray<nsRefPtr<MacOSFamilyEntry> >& array);
 +    PRBool GetPrefFontFamilyEntries(eFontPrefLang aLangGroup, nsTArray<RefPtr<MacOSFamilyEntry> > *array);
 +    void SetPrefFontFamilyEntries(eFontPrefLang aLangGroup, nsTArray<RefPtr<MacOSFamilyEntry> >& array);
      
@@ -1949,35 +1943,40 @@ diff --git a/gfx/thebes/src/gfxQuartzFon
      static PLDHashOperator PR_CALLBACK FindFontForCharProc(nsStringHashKey::KeyType aKey,
 -                                                             nsRefPtr<MacOSFamilyEntry>& aFamilyEntry,
 -                                                             void* userArg);
 +                                                           RefPtr<MacOSFamilyEntry>& aFamilyEntry,
 +                                                           void* userArg);
  
      static gfxQuartzFontCache *sSharedFontCache;
  
-@@ -261,8 +260,8 @@
+@@ -270,16 +269,16 @@ private:
      void EliminateDuplicateFaces(const nsAString& aFamilyName);
                                                               
      static PLDHashOperator PR_CALLBACK InitOtherFamilyNamesProc(nsStringHashKey::KeyType aKey,
 -                                                             nsRefPtr<MacOSFamilyEntry>& aFamilyEntry,
 -                                                             void* userArg);
+-
 +                                                                RefPtr<MacOSFamilyEntry>& aFamilyEntry,
 +                                                                void* userArg);
-     
++    
      void GenerateFontListKey(const nsAString& aKeyName, nsAString& aResult);
      static void ATSNotification(ATSFontNotificationInfoRef aInfo, void* aUserArg);
-@@ -270,19 +269,22 @@
+     static int PR_CALLBACK PrefChangedCallback(const char *aPrefName, void *closure);
  
      static PLDHashOperator PR_CALLBACK
          HashEnumFuncForFamilies(nsStringHashKey::KeyType aKey,
 -                                nsRefPtr<MacOSFamilyEntry>& aFamilyEntry,
 +                                RefPtr<MacOSFamilyEntry>& aFamilyEntry,
                                  void* aUserArg);
  
+     // gfxFontInfoLoader overrides, used to load in font cmaps
+@@ -288,15 +287,18 @@ private:
+     virtual void FinishLoader();
+ 
      // canonical family name ==> family entry (unique, one name per family entry)
 -    nsRefPtrHashtable<nsStringHashKey, MacOSFamilyEntry> mFontFamilies;    
 +    nsDataHashtable< nsStringHashKey,
 +                     RefPtr<MacOSFamilyEntry> > mFontFamilies;
  
      // other family name ==> family entry (not unique, can have multiple names per 
      // family entry, only names *other* than the canonical names are stored here)
 -    nsRefPtrHashtable<nsStringHashKey, MacOSFamilyEntry> mOtherFamilyNames;    
@@ -1990,145 +1989,151 @@ diff --git a/gfx/thebes/src/gfxQuartzFon
 +    nsDataHashtable<nsUint32HashKey,
 +                    nsTArray<RefPtr<MacOSFamilyEntry> > > mPrefFonts;
  
      // when system-wide font lookup fails for a character, cache it to skip future searches
      gfxSparseBitSet mCodepointsWithNoFonts;
 diff --git a/gfx/thebes/src/gfxQuartzFontCache.mm b/gfx/thebes/src/gfxQuartzFontCache.mm
 --- a/gfx/thebes/src/gfxQuartzFontCache.mm
 +++ b/gfx/thebes/src/gfxQuartzFontCache.mm
-@@ -824,7 +824,7 @@
+@@ -838,7 +838,7 @@ gfxQuartzFontCache::InitOtherFamilyNames
  }
                                                           
  PLDHashOperator PR_CALLBACK gfxQuartzFontCache::InitOtherFamilyNamesProc(nsStringHashKey::KeyType aKey,
 -                                                         nsRefPtr<MacOSFamilyEntry>& aFamilyEntry,
 +                                                         RefPtr<MacOSFamilyEntry>& aFamilyEntry,
                                                           void* userArg)
  {
      gfxQuartzFontCache *fc = (gfxQuartzFontCache*) userArg;
-@@ -865,7 +865,6 @@
+@@ -879,7 +879,6 @@ gfxQuartzFontCache::InitSingleFaceList()
              if (familyEntry) {
                  MacOSFontEntry *fontEntry = familyEntry->FindFont(singleFaceFonts[i]);
                  if (fontEntry) {
 -                    PRBool found;
                      nsAutoString displayName, key;
                      
                      // use the display name the canonical name
-@@ -874,7 +873,7 @@
+@@ -888,7 +887,7 @@ gfxQuartzFontCache::InitSingleFaceList()
                      GenerateFontListKey(displayName, key);
  
                      // add only if doesn't exist already
 -                    if (!(familyEntry = mFontFamilies.GetWeak(key, &found))) {
 +                    if (!(familyEntry = mFontFamilies.Get(key, nsnull))) {
                          familyEntry = new SingleFaceFamily(displayName);
                          familyEntry->AddFontEntry(fontEntry);
                          mFontFamilies.Put(key, familyEntry);
-@@ -897,13 +896,12 @@
+@@ -911,13 +910,12 @@ gfxQuartzFontCache::PreloadNamesList()
      
      PRUint32 numFonts = preloadFonts.Length();
      for (PRUint32 i = 0; i < numFonts; i++) {
 -        PRBool found;
          nsAutoString key;
          GenerateFontListKey(preloadFonts[i], key);
          
          // only search canonical names!
 -        MacOSFamilyEntry *familyEntry = mFontFamilies.GetWeak(key, &found);
 -        if (familyEntry) {
 +        RefPtr<MacOSFamilyEntry> familyEntry;
 +        if (mFontFamilies.Get(key, &familyEntry)) {
              AddOtherFamilyNameFunctor addOtherNames(this);
              familyEntry->ReadOtherFamilyNames(addOtherNames);
          }
-@@ -917,7 +915,7 @@
+@@ -931,8 +929,8 @@ gfxQuartzFontCache::EliminateDuplicateFa
      MacOSFamilyEntry *family = FindFamily(aFamilyName);
      if (!family) return;
  
 -    nsTArray<nsRefPtr<MacOSFontEntry> >& fontlist = family->GetFontList();
+-
 +    nsTArray<RefPtr<MacOSFontEntry> >& fontlist = family->GetFontList();
-     
++    
      PRUint32 i, bold, numFonts, italicIndex;
      MacOSFontEntry *italic, *nonitalic;
-@@ -1082,7 +1080,7 @@
+     PRUint32 boldtraits[2] = { 0, NSBoldFontMask };
+@@ -1096,8 +1094,8 @@ struct FontListData {
  
  PLDHashOperator PR_CALLBACK
  gfxQuartzFontCache::HashEnumFuncForFamilies(nsStringHashKey::KeyType aKey,
 -                                            nsRefPtr<MacOSFamilyEntry>& aFamilyEntry,
+-                                            void *aUserArg)
 +                                            RefPtr<MacOSFamilyEntry>& aFamilyEntry,
-                                             void* aUserArg)
++                                            void* aUserArg)
  {
      FontListData *data = (FontListData*)aUserArg;
-@@ -1128,7 +1126,7 @@
+ 
+@@ -1184,8 +1182,8 @@ gfxQuartzFontCache::FindFontForChar(cons
  }
  
  PLDHashOperator PR_CALLBACK 
 -gfxQuartzFontCache::FindFontForCharProc(nsStringHashKey::KeyType aKey, nsRefPtr<MacOSFamilyEntry>& aFamilyEntry,
+-     void *userArg)
 +gfxQuartzFontCache::FindFontForCharProc(nsStringHashKey::KeyType aKey, RefPtr<MacOSFamilyEntry>& aFamilyEntry,
-      void* userArg)
++     void* userArg)
  {
      FontSearch *data = (FontSearch*)userArg;
-@@ -1143,16 +1141,15 @@
+ 
+@@ -1199,16 +1197,15 @@ gfxQuartzFontCache::FindFamily(const nsA
  {
      nsAutoString key;
      MacOSFamilyEntry *familyEntry;
 -    PRBool found;
      GenerateFontListKey(aFamily, key);
-     
+ 
      // lookup in canonical (i.e. English) family name list
 -    if ((familyEntry = mFontFamilies.GetWeak(key, &found))) {
 +    if (mFontFamilies.Get(key, &familyEntry)) {
          return familyEntry;
      }
  
      // lookup in other family names list (mostly localized names)
 -    if ((familyEntry = mOtherFamilyNames.GetWeak(key, &found))) {
 +    if (mOtherFamilyNames.Get(key, &familyEntry)) {
          return familyEntry;
      }
  
-@@ -1161,7 +1158,7 @@
+@@ -1217,7 +1214,7 @@ gfxQuartzFontCache::FindFamily(const nsA
      // since reading name table entries is expensive
      if (!mOtherFamilyNamesInitialized) {
          InitOtherFamilyNames();
 -        if ((familyEntry = mOtherFamilyNames.GetWeak(key, &found))) {
 +        if (mOtherFamilyNames.Get(key, &familyEntry)) {
              return familyEntry;
          }
      }
-@@ -1193,13 +1190,13 @@
+@@ -1249,13 +1246,13 @@ gfxQuartzFontCache::AppleWeightToCSSWeig
  }
  
  PRBool
 -gfxQuartzFontCache::GetPrefFontFamilyEntries(eFontPrefLang aLangGroup, nsTArray<nsRefPtr<MacOSFamilyEntry> > *array)
 +gfxQuartzFontCache::GetPrefFontFamilyEntries(eFontPrefLang aLangGroup, nsTArray<RefPtr<MacOSFamilyEntry> > *array)
  {
      return mPrefFonts.Get(PRUint32(aLangGroup), array);
  }
  
  void
 -gfxQuartzFontCache::SetPrefFontFamilyEntries(eFontPrefLang aLangGroup, nsTArray<nsRefPtr<MacOSFamilyEntry> >& array)
 +gfxQuartzFontCache::SetPrefFontFamilyEntries(eFontPrefLang aLangGroup, nsTArray<RefPtr<MacOSFamilyEntry> >& array)
  {
      mPrefFonts.Put(PRUint32(aLangGroup), array);
  }
-@@ -1208,10 +1205,9 @@
+@@ -1264,10 +1261,9 @@ gfxQuartzFontCache::AddOtherFamilyName(M
  gfxQuartzFontCache::AddOtherFamilyName(MacOSFamilyEntry *aFamilyEntry, nsAString& aOtherFamilyName)
  {
      nsAutoString key;
 -    PRBool found;
      GenerateFontListKey(aOtherFamilyName, key);
  
 -    if (!mOtherFamilyNames.GetWeak(key, &found)) {
 +    if (!mOtherFamilyNames.Get(key, nsnull)) {
          mOtherFamilyNames.Put(key, aFamilyEntry);
          PR_LOG(gFontInfoLog, PR_LOG_DEBUG, ("(fontinit-otherfamily) canonical family: %s, other family: %s\n", 
                                              NS_ConvertUTF16toUTF8(aFamilyEntry->Name()).get(), 
 diff --git a/gfx/thebes/src/gfxQuartzImageSurface.cpp b/gfx/thebes/src/gfxQuartzImageSurface.cpp
 --- a/gfx/thebes/src/gfxQuartzImageSurface.cpp
 +++ b/gfx/thebes/src/gfxQuartzImageSurface.cpp
-@@ -58,20 +58,18 @@
+@@ -58,20 +58,18 @@ gfxQuartzImageSurface::~gfxQuartzImageSu
  {
  }
  
 -already_AddRefed<gfxImageSurface>
 +AddRefed<gfxImageSurface>
  gfxQuartzImageSurface::GetImageSurface()
  {
      if (!mSurfaceValid)
@@ -2147,47 +2152,47 @@ diff --git a/gfx/thebes/src/gfxQuartzIma
 -    NS_ADDREF(imgsurf);
 -    return imgsurf;
 +    return AddRefed<gfxImageSurface>(
 +        static_cast<gfxImageSurface*>(gfxASurface::Wrap(isurf).get()));
  }
 diff --git a/gfx/thebes/src/gfxQuartzNativeDrawing.cpp b/gfx/thebes/src/gfxQuartzNativeDrawing.cpp
 --- a/gfx/thebes/src/gfxQuartzNativeDrawing.cpp
 +++ b/gfx/thebes/src/gfxQuartzNativeDrawing.cpp
-@@ -62,7 +62,7 @@
+@@ -62,7 +62,7 @@ gfxQuartzNativeDrawing::BeginNativeDrawi
      NS_ASSERTION(!mQuartzSurface, "BeginNativeDrawing called when drawing already in progress");
  
      gfxPoint deviceOffset;
 -    nsRefPtr<gfxASurface> surf = mContext->CurrentSurface(&deviceOffset.x, &deviceOffset.y);
 +    RefPtr<gfxASurface> surf = mContext->CurrentSurface(&deviceOffset.x, &deviceOffset.y);
      if (!surf || surf->CairoStatus())
          return nsnull;
  
 diff --git a/gfx/thebes/src/gfxWindowsFonts.cpp b/gfx/thebes/src/gfxWindowsFonts.cpp
 --- a/gfx/thebes/src/gfxWindowsFonts.cpp
 +++ b/gfx/thebes/src/gfxWindowsFonts.cpp
-@@ -81,7 +81,7 @@
+@@ -81,7 +81,7 @@ struct DCFromContext {
  struct DCFromContext {
      DCFromContext(gfxContext *aContext) {
          dc = NULL;
 -        nsRefPtr<gfxASurface> aSurface = aContext->CurrentSurface();
 +        RefPtr<gfxASurface> aSurface = aContext->CurrentSurface();
          NS_ASSERTION(aSurface, "DCFromContext: null surface");
          if (aSurface &&
              (aSurface->GetType() == gfxASurface::SurfaceTypeWin32 ||
-@@ -660,7 +660,7 @@
+@@ -671,7 +671,7 @@ gfxWindowsFont::SetupCairoFont(gfxContex
   * In either case, add a ref, append it to the aFonts array, and return it ---
   * except for OOM in which case we do nothing and return null.
   */
 -static already_AddRefed<gfxWindowsFont>
 +static AddRefed<gfxWindowsFont>
  GetOrMakeFont(FontEntry *aFontEntry, const gfxFontStyle *aStyle)
  {
      // because we know the FontEntry has the weight we really want, use it for matching
-@@ -671,16 +671,14 @@
+@@ -682,16 +682,14 @@ GetOrMakeFont(FontEntry *aFontEntry, con
      if (style.sizeAdjust == 0.0)
          style.size = ROUND(style.size);
  
 -    nsRefPtr<gfxFont> font = gfxFontCache::GetCache()->Lookup(aFontEntry->GetName(), &style);
 +    RefPtr<gfxFont> font = gfxFontCache::GetCache()->Lookup(aFontEntry->GetName(), &style);
      if (!font) {
          font = new gfxWindowsFont(aFontEntry->GetName(), &style, aFontEntry);
          if (!font)
@@ -2197,88 +2202,88 @@ diff --git a/gfx/thebes/src/gfxWindowsFo
      }
 -    gfxFont *f = nsnull;
 -    font.swap(f);
 -    return static_cast<gfxWindowsFont *>(f);
 +    return do_AddRef(static_cast<gfxWindowsFont*>(font.get()));
  }
  
  static PRBool
-@@ -699,14 +697,14 @@
+@@ -710,14 +708,14 @@ AddFontNameToArray(const nsAString& aNam
  }
  
  void
 -gfxWindowsFontGroup::GroupFamilyListToArrayList(nsTArray<nsRefPtr<FontEntry> > *list)
 +gfxWindowsFontGroup::GroupFamilyListToArrayList(nsTArray<RefPtr<FontEntry> > *list)
  {
      nsAutoTArray<nsAutoString, 15> fonts;
      ForEachFont(AddFontNameToArray, &fonts);
  
      PRUint32 len = fonts.Length();
      for (PRUint32 i = 0; i < len; ++i) {
 -        nsRefPtr<FontEntry> fe = gfxWindowsPlatform::GetPlatform()->FindFontEntry(fonts[i], mStyle);
 +        RefPtr<FontEntry> fe = gfxWindowsPlatform::GetPlatform()->FindFontEntry(fonts[i], mStyle);
          list->AppendElement(fe);
      }
  }
-@@ -714,7 +712,7 @@
+@@ -725,7 +723,7 @@ void
  void
  gfxWindowsFontGroup::FamilyListToArrayList(const nsString& aFamilies,
                                             const nsCString& aLangGroup,
 -                                           nsTArray<nsRefPtr<FontEntry> > *list)
 +                                           nsTArray<RefPtr<FontEntry> > *list)
  {
      nsAutoTArray<nsAutoString, 15> fonts;
      ForEachFont(aFamilies, aLangGroup, AddFontNameToArray, &fonts);
-@@ -722,7 +720,7 @@
+@@ -733,7 +731,7 @@ gfxWindowsFontGroup::FamilyListToArrayLi
      PRUint32 len = fonts.Length();
      for (PRUint32 i = 0; i < len; ++i) {
          const nsAutoString& str = fonts[i];
 -        nsRefPtr<FontEntry> fe = gfxWindowsPlatform::GetPlatform()->FindFontEntry(str, mStyle);
 +        RefPtr<FontEntry> fe = gfxWindowsPlatform::GetPlatform()->FindFontEntry(str, mStyle);
          list->AppendElement(fe);
      }
  }
-@@ -741,7 +739,7 @@
+@@ -752,7 +750,7 @@ gfxWindowsFontGroup::gfxWindowsFontGroup
              NS_ERROR("Failed to create font group");
              return;
          }
 -        nsRefPtr<FontEntry> fe = gfxWindowsPlatform::GetPlatform()->FindFontEntry(nsDependentString(logFont.lfFaceName), *aStyle);
 +        RefPtr<FontEntry> fe = gfxWindowsPlatform::GetPlatform()->FindFontEntry(nsDependentString(logFont.lfFaceName), *aStyle);
          mFontEntries.AppendElement(fe);
      }
  
-@@ -765,7 +763,7 @@
+@@ -778,7 +776,7 @@ gfxWindowsFontGroup::GetFontAt(PRInt32 i
  gfxWindowsFontGroup::GetFontAt(PRInt32 i)
  {
      if (!mFonts[i]) {
 -        nsRefPtr<gfxWindowsFont> font = GetOrMakeFont(mFontEntries[i], &mStyle);
 +        RefPtr<gfxWindowsFont> font = GetOrMakeFont(mFontEntries[i], &mStyle);
          mFonts[i] = font;
      }
  
-@@ -947,7 +945,7 @@
+@@ -960,7 +958,7 @@ gfxWindowsFontGroup::InitTextRunGDI(gfxC
  gfxWindowsFontGroup::InitTextRunGDI(gfxContext *aContext, gfxTextRun *aRun,
                                      const char *aString, PRUint32 aLength)
  {
 -    nsRefPtr<gfxWindowsFont> font = GetFontAt(0);
 +    RefPtr<gfxWindowsFont> font = GetFontAt(0);
      DCFromContext dc(aContext);
      if (SetupDCFont(dc, font)) {
          nsAutoTArray<WCHAR,500> glyphArray;
-@@ -971,7 +969,7 @@
+@@ -984,7 +982,7 @@ gfxWindowsFontGroup::InitTextRunGDI(gfxC
  gfxWindowsFontGroup::InitTextRunGDI(gfxContext *aContext, gfxTextRun *aRun,
                                      const PRUnichar *aString, PRUint32 aLength)
  {
 -    nsRefPtr<gfxWindowsFont> font = GetFontAt(0);
 +    RefPtr<gfxWindowsFont> font = GetFontAt(0);
      DCFromContext dc(aContext);
      if (SetupDCFont(dc, font)) {
          nsAutoTArray<WCHAR,500> glyphArray;
-@@ -1485,18 +1483,18 @@
+@@ -1498,18 +1496,18 @@ public:
      struct TextRange {
          TextRange(PRUint32 aStart,  PRUint32 aEnd) : start(aStart), end(aEnd) { }
          PRUint32 Length() const { return end - start; }
 -        nsRefPtr<FontEntry> font;
 +        RefPtr<FontEntry> font;
          PRUint32 start, end;
      };
  
@@ -2290,239 +2295,239 @@ diff --git a/gfx/thebes/src/gfxWindowsFo
          else
              fe = mGroup->GetFontEntryAt(0);
  
 -        nsRefPtr<gfxWindowsFont> font = GetOrMakeFont(fe, mGroup->GetStyle());
 +        RefPtr<gfxWindowsFont> font = GetOrMakeFont(fe, mGroup->GetStyle());
          SetCurrentFont(font);
  
          mRangeString = mItemString + mRanges[i].start;
-@@ -1511,7 +1509,7 @@
+@@ -1524,7 +1522,7 @@ public:
              if (ch > 0xFFFF)
                  return PR_FALSE;
  
 -            nsRefPtr<gfxWindowsFont> font = GetOrMakeFont(aFontEntry, mGroup->GetStyle());
 +            RefPtr<gfxWindowsFont> font = GetOrMakeFont(aFontEntry, mGroup->GetStyle());
  
              HDC dc = GetDC((HWND)nsnull);
              HFONT hfont = font->GetHFONT();
-@@ -1532,9 +1530,9 @@
+@@ -1558,9 +1556,9 @@ public:
          return PR_FALSE;
      }
  
 -    inline FontEntry *WhichFontSupportsChar(const nsTArray<nsRefPtr<FontEntry> >& fonts, PRUint32 ch) {
 +    inline FontEntry *WhichFontSupportsChar(const nsTArray<RefPtr<FontEntry> >& fonts, PRUint32 ch) {
          for (PRUint32 i = 0; i < fonts.Length(); i++) {
 -            nsRefPtr<FontEntry> fe = fonts[i];
 +            RefPtr<FontEntry> fe = fonts[i];
              if (fe->mSymbolFont && !mGroup->GetStyle()->familyNameQuirks)
                  continue;
              if (HasCharacter(fe, ch))
-@@ -1551,7 +1549,7 @@
+@@ -1577,7 +1575,7 @@ public:
      }
  
      inline FontEntry *FindFontForChar(PRUint32 ch, PRUint32 prevCh, PRUint32 nextCh, FontEntry *aFont) {
 -        nsRefPtr<FontEntry> selectedFont;
 +        RefPtr<FontEntry> selectedFont;
  
          // if this character or the next one is a joiner use the
          // same font as the previous range if we can
-@@ -1585,7 +1583,7 @@
+@@ -1611,7 +1609,7 @@ public:
                  if (langGroup) {
                      PR_LOG(gFontLog, PR_LOG_DEBUG, (" - Trying to find fonts for: %s (%s)", langGroup, gScriptToText[primaryId].value));
  
 -                    nsAutoTArray<nsRefPtr<FontEntry>, 5> fonts;
 +                    nsAutoTArray<RefPtr<FontEntry>, 5> fonts;
                      this->GetPrefFonts(langGroup, fonts);
                      selectedFont = WhichFontSupportsChar(fonts, ch);
                  }
-@@ -1597,7 +1595,7 @@
+@@ -1623,7 +1621,7 @@ public:
                      if (PR_LOG_TEST(gFontLog, PR_LOG_DEBUG))
                          PR_LOG(gFontLog, PR_LOG_DEBUG, (" - Trying to find fonts for: CJK"));
  
 -                    nsAutoTArray<nsRefPtr<FontEntry>, 15> fonts;
 +                    nsAutoTArray<RefPtr<FontEntry>, 15> fonts;
                      this->GetCJKPrefFonts(fonts);
                      selectedFont = WhichFontSupportsChar(fonts, ch);
                  } else {
-@@ -1605,7 +1603,7 @@
+@@ -1631,7 +1629,7 @@ public:
                      if (langGroup) {
                          PR_LOG(gFontLog, PR_LOG_DEBUG, (" - Trying to find fonts for: %s", langGroup));
  
 -                        nsAutoTArray<nsRefPtr<FontEntry>, 5> fonts;
 +                        nsAutoTArray<RefPtr<FontEntry>, 5> fonts;
                          this->GetPrefFonts(langGroup, fonts);
                          selectedFont = WhichFontSupportsChar(fonts, ch);
                      }
-@@ -1621,7 +1619,7 @@
+@@ -1647,7 +1645,7 @@ public:
          if (!selectedFont) {
              PR_LOG(gFontLog, PR_LOG_DEBUG, (" - Looking for best match"));
  
 -            nsRefPtr<gfxWindowsFont> refFont = mGroup->GetFontAt(0);
 +            RefPtr<gfxWindowsFont> refFont = mGroup->GetFontAt(0);
              gfxWindowsPlatform *platform = gfxWindowsPlatform::GetPlatform();
              selectedFont = platform->FindFontForChar(ch, refFont);
          }
-@@ -1651,7 +1649,7 @@
+@@ -1677,7 +1675,7 @@ public:
                  if ((i+2 < mItemLength) && NS_IS_HIGH_SURROGATE(ch) && NS_IS_LOW_SURROGATE(mItemString[i+2]))
                      nextCh = SURROGATE_TO_UCS4(nextCh, mItemString[i+2]);
              }
 -            nsRefPtr<FontEntry> fe = FindFontForChar(ch,
 +            RefPtr<FontEntry> fe = FindFontForChar(ch,
                                                       prevCh,
                                                       nextCh,
                                                       (mRanges.Length() == 0) ? nsnull : mRanges[mRanges.Length() - 1].font);
-@@ -1698,10 +1696,10 @@
+@@ -1724,10 +1722,10 @@ private:
      }
  
      // this function appends to the array passed in.
 -    void GetPrefFonts(const char *aLangGroup, nsTArray<nsRefPtr<FontEntry> >& array) {
 +    void GetPrefFonts(const char *aLangGroup, nsTArray<RefPtr<FontEntry> >& array) {
          NS_ASSERTION(aLangGroup, "aLangGroup is null");
          gfxWindowsPlatform *platform = gfxWindowsPlatform::GetPlatform();
 -        nsAutoTArray<nsRefPtr<FontEntry>, 5> fonts;
 +        nsAutoTArray<RefPtr<FontEntry>, 5> fonts;
          /* this lookup has to depend on weight and style */
          nsCAutoString key(aLangGroup);
          key.Append("-");
-@@ -1723,7 +1721,7 @@
+@@ -1749,7 +1747,7 @@ private:
      }
  
      // this function assigns to the array passed in.
 -    void GetCJKPrefFonts(nsTArray<nsRefPtr<FontEntry> >& array) {
 +    void GetCJKPrefFonts(nsTArray<RefPtr<FontEntry> >& array) {
          gfxWindowsPlatform *platform = gfxWindowsPlatform::GetPlatform();
  
          nsCAutoString key("x-internal-cjk-");
-@@ -1810,7 +1808,7 @@
+@@ -1836,7 +1834,7 @@ private:
      }
  
  private:
 -    nsRefPtr<gfxContext> mContext;
 +    RefPtr<gfxContext> mContext;
      HDC mDC;
  
      SCRIPT_ITEM *mScriptItem;
-@@ -1842,7 +1840,7 @@
+@@ -1868,7 +1866,7 @@ private:
      int mMaxGlyphs;
      int mNumGlyphs;
  
 -    nsRefPtr<gfxWindowsFont> mCurrentFont;
 +    RefPtr<gfxWindowsFont> mCurrentFont;
  
      PRPackedBool mFontSelected;
  
-@@ -2002,7 +2000,7 @@
+@@ -2028,7 +2026,7 @@ public:
      }
  
  private:
 -    nsRefPtr<gfxContext> mContext;
 +    RefPtr<gfxContext> mContext;
      HDC mDC;
      const PRUnichar *mString;
      const PRUint32 mLength;
 diff --git a/gfx/thebes/src/gfxWindowsNativeDrawing.cpp b/gfx/thebes/src/gfxWindowsNativeDrawing.cpp
 --- a/gfx/thebes/src/gfxWindowsNativeDrawing.cpp
 +++ b/gfx/thebes/src/gfxWindowsNativeDrawing.cpp
-@@ -68,7 +68,7 @@
+@@ -68,7 +68,7 @@ gfxWindowsNativeDrawing::BeginNativeDraw
  gfxWindowsNativeDrawing::BeginNativeDrawing()
  {
      if (mRenderState == RENDER_STATE_INIT) {
 -        nsRefPtr<gfxASurface> surf = mContext->CurrentSurface(&mDeviceOffset.x, &mDeviceOffset.y);
 +        RefPtr<gfxASurface> surf = mContext->CurrentSurface(&mDeviceOffset.x, &mDeviceOffset.y);
          if (!surf || surf->CairoStatus())
              return nsnull;
  
-@@ -258,9 +258,9 @@
+@@ -258,9 +258,9 @@ gfxWindowsNativeDrawing::PaintToContext(
          // nothing to do, it already went to the context
          mRenderState = RENDER_STATE_DONE;
      } else if (mRenderState == RENDER_STATE_ALPHA_RECOVERY_WHITE_DONE) {
 -        nsRefPtr<gfxImageSurface> black = mBlackSurface->GetImageSurface();
 -        nsRefPtr<gfxImageSurface> white = mWhiteSurface->GetImageSurface();
 -        nsRefPtr<gfxImageSurface> alphaSurface =
 +        RefPtr<gfxImageSurface> black = mBlackSurface->GetImageSurface();
 +        RefPtr<gfxImageSurface> white = mWhiteSurface->GetImageSurface();
 +        RefPtr<gfxImageSurface> alphaSurface =
              gfxAlphaRecovery::RecoverAlpha(black, white, mTempSurfaceSize);
  
          mContext->Save();
-@@ -268,7 +268,7 @@
+@@ -268,7 +268,7 @@ gfxWindowsNativeDrawing::PaintToContext(
          mContext->NewPath();
          mContext->Rectangle(gfxRect(gfxPoint(0.0, 0.0), mNativeRect.size));
  
 -        nsRefPtr<gfxPattern> pat = new gfxPattern(alphaSurface);
 +        RefPtr<gfxPattern> pat = new gfxPattern(alphaSurface);
  
          gfxMatrix m;
          m.Scale(mScale.width, mScale.height);
 diff --git a/gfx/thebes/src/gfxWindowsPlatform.cpp b/gfx/thebes/src/gfxWindowsPlatform.cpp
 --- a/gfx/thebes/src/gfxWindowsPlatform.cpp
 +++ b/gfx/thebes/src/gfxWindowsPlatform.cpp
-@@ -96,13 +96,12 @@
+@@ -102,13 +102,12 @@ gfxWindowsPlatform::~gfxWindowsPlatform(
  {
  }
  
 -already_AddRefed<gfxASurface>
 +AddRefed<gfxASurface>
  gfxWindowsPlatform::CreateOffscreenSurface(const gfxIntSize& size,
                                             gfxASurface::gfxImageFormat imageFormat)
  {
      gfxASurface *surf = new gfxWindowsSurface(size, imageFormat);
 -    NS_IF_ADDREF(surf);
 -    return surf;
 +    return do_AddRef(surf);
  }
  
  int CALLBACK 
-@@ -122,7 +121,7 @@
+@@ -128,7 +127,7 @@ gfxWindowsPlatform::FontEnumProc(const E
      nsAutoString name(logFont.lfFaceName);
      BuildKeyNameFromFontName(name);
  
 -    nsRefPtr<FontFamily> ff;
 +    RefPtr<FontFamily> ff;
      if (!ht->Get(name, &ff)) {
          ff = new FontFamily(nsDependentString(logFont.lfFaceName));
          ht->Put(name, ff);
-@@ -144,7 +143,7 @@
+@@ -150,7 +149,7 @@ struct FontListData {
  
  PLDHashOperator PR_CALLBACK
  gfxWindowsPlatform::HashEnumFunc(nsStringHashKey::KeyType aKey,
 -                                 nsRefPtr<FontFamily>& aFontFamily,
 +                                 RefPtr<FontFamily>& aFontFamily,
                                   void* userArg)
  {
      FontListData *data = (FontListData*)userArg;
-@@ -247,7 +246,7 @@
+@@ -257,7 +256,7 @@ gfxWindowsPlatform::UpdateFontList()
          BuildKeyNameFromFontName(substituteName);
          RemoveCharsetFromFontSubstitute(actualFontName);
          BuildKeyNameFromFontName(actualFontName);
 -        nsRefPtr<FontFamily> ff;
 +        RefPtr<FontFamily> ff;
          if (!actualFontName.IsEmpty() && mFonts.Get(actualFontName, &ff))
              mFontSubstitutes.Put(substituteName, ff);
          else
-@@ -322,7 +321,7 @@
+@@ -356,7 +355,7 @@ gfxWindowsPlatform::ResolveFontName(cons
      nsAutoString keyName(aFontName);
      BuildKeyNameFromFontName(keyName);
  
 -    nsRefPtr<FontFamily> ff;
 +    RefPtr<FontFamily> ff;
      if (mFonts.Get(keyName, &ff) ||
          mFontSubstitutes.Get(keyName, &ff) ||
          mFontAliases.Get(keyName, &ff)) {
-@@ -373,7 +372,7 @@
+@@ -407,7 +406,7 @@ gfxWindowsPlatform::FontResolveProc(cons
      nsAutoString name(logFont.lfFaceName);
  
      // Save the alias name to cache
 -    nsRefPtr<FontFamily> ff;
 +    RefPtr<FontFamily> ff;
      nsAutoString keyName(name);
      BuildKeyNameFromFontName(keyName);
      if (!rData->mCaller->mFonts.Get(keyName, &ff)) {
-@@ -398,14 +397,14 @@
+@@ -432,14 +431,14 @@ struct FontSearch {
          ch(aCh), fontToMatch(aFont), matchRank(-1) {
      }
      PRUint32 ch;
 -    nsRefPtr<gfxWindowsFont> fontToMatch;
 +    RefPtr<gfxWindowsFont> fontToMatch;
      PRInt32 matchRank;
 -    nsRefPtr<FontEntry> bestMatch;
 +    RefPtr<FontEntry> bestMatch;
@@ -2530,26 +2535,26 @@ diff --git a/gfx/thebes/src/gfxWindowsPl
  
  PLDHashOperator PR_CALLBACK
  gfxWindowsPlatform::FindFontForCharProc(nsStringHashKey::KeyType aKey,
 -                                        nsRefPtr<FontFamily>& aFontFamily,
 +                                        RefPtr<FontFamily>& aFontFamily,
                                          void* userArg)
  {
      FontSearch *data = (FontSearch*)userArg;
-@@ -490,7 +489,7 @@
+@@ -524,7 +523,7 @@ gfxWindowsPlatform::FindFontFamily(const
      nsAutoString name(aName);
      BuildKeyNameFromFontName(name);
  
 -    nsRefPtr<FontFamily> ff;
 +    RefPtr<FontFamily> ff;
      if (!mFonts.Get(name, &ff) &&
          !mFontSubstitutes.Get(name, &ff) &&
          !mFontAliases.Get(name, &ff)) {
-@@ -531,13 +530,13 @@
+@@ -565,13 +564,13 @@ gfxWindowsPlatform::GetPlatformCMSOutput
  }
  
  PRBool
 -gfxWindowsPlatform::GetPrefFontEntries(const nsCString& aKey, nsTArray<nsRefPtr<FontEntry> > *array)
 +gfxWindowsPlatform::GetPrefFontEntries(const nsCString& aKey, nsTArray<RefPtr<FontEntry> > *array)
  {
      return mPrefFonts.Get(aKey, array);
  }
@@ -2558,17 +2563,17 @@ diff --git a/gfx/thebes/src/gfxWindowsPl
 -gfxWindowsPlatform::SetPrefFontEntries(const nsCString& aKey, nsTArray<nsRefPtr<FontEntry> >& array)
 +gfxWindowsPlatform::SetPrefFontEntries(const nsCString& aKey, nsTArray<RefPtr<FontEntry> >& array)
  {
      mPrefFonts.Put(aKey, array);
  }
 diff --git a/gfx/thebes/src/gfxWindowsSurface.cpp b/gfx/thebes/src/gfxWindowsSurface.cpp
 --- a/gfx/thebes/src/gfxWindowsSurface.cpp
 +++ b/gfx/thebes/src/gfxWindowsSurface.cpp
-@@ -122,50 +122,46 @@
+@@ -122,50 +122,46 @@ gfxWindowsSurface::~gfxWindowsSurface()
      }
  }
  
 -already_AddRefed<gfxImageSurface>
 +AddRefed<gfxImageSurface>
  gfxWindowsSurface::GetImageSurface()
  {
      if (!mSurfaceValid) {
@@ -2645,17 +2650,17 @@ diff --git a/gfx/thebes/test/gfxFontSele
  #ifdef MOZ_WIDGET_GTK2
  #include "gtk/gtk.h"
  #endif
 +
 +using namespace mozilla;
  
  enum {
      S_UTF8 = 0,
-@@ -223,17 +225,16 @@
+@@ -223,17 +225,16 @@ struct TestEntry {
  
  nsTArray<TestEntry> testList;
  
 -already_AddRefed<gfxContext>
 +AddRefed<gfxContext>
  MakeContext ()
  {
      const int size = 200;
@@ -2667,26 +2672,26 @@ diff --git a/gfx/thebes/test/gfxFontSele
 -    gfxContext *ctx = new gfxContext(surface);
 -    NS_IF_ADDREF(ctx);
 -    return ctx;
 +
 +    return do_AddRef(new gfxContext(surface));
  }
  
  TestEntry*
-@@ -286,7 +287,7 @@
+@@ -286,7 +287,7 @@ DumpTestExpect (TestEntry *test) {
  
  PRBool
  RunTest (TestEntry *test, gfxContext *ctx) {
 -    nsRefPtr<gfxFontGroup> fontGroup;
 +    RefPtr<gfxFontGroup> fontGroup;
  
      fontGroup = gfxPlatform::GetPlatform()->CreateFontGroup(NS_ConvertUTF8toUTF16(test->utf8FamilyString), &test->fontStyle);
  
-@@ -378,7 +379,7 @@
+@@ -378,7 +379,7 @@ main (int argc, char **argv) {
      // set up the tests
      SetupTests();
  
 -    nsRefPtr<gfxContext> context = MakeContext();
 +    RefPtr<gfxContext> context = MakeContext();
  
      for (uint test = 0;
           test < testList.Length();
@@ -2710,26 +2715,26 @@ diff --git a/gfx/thebes/test/gfxSurfaceR
 -    NS_ADDREF(s);
 -    return s->Release();
 +    s->AddReference();
 +    s->ReleaseReference();
 +    return s->GetRefCount();
  }
  
  int
-@@ -42,7 +47,7 @@
+@@ -42,7 +47,7 @@ TestNewSurface () {
      int failures = 0;
      int destroyed = 0;
  
 -    nsRefPtr<gfxASurface> s = new gfxImageSurface (gfxIntSize(10, 10), gfxASurface::ImageFormatARGB32);
 +    RefPtr<gfxASurface> s = new gfxImageSurface (gfxIntSize(10, 10), gfxASurface::ImageFormatARGB32);
      cairo_surface_t *cs = s->CairoSurface();
  
      cairo_surface_set_user_data (cs, &destruction_key, &destroyed, SurfaceDestroyNotifier);
-@@ -96,7 +101,7 @@
+@@ -96,7 +101,7 @@ TestExistingSurface () {
      failures += CheckInt (cairo_surface_get_reference_count(cs), 1);
      failures += CheckInt (destroyed, 0);
  
 -    nsRefPtr<gfxASurface> s = gfxASurface::Wrap(cs);
 +    RefPtr<gfxASurface> s = gfxASurface::Wrap(cs);
  
      failures += CheckInt (GetASurfaceRefCount(s.get()), 2);
  
@@ -2740,17 +2745,17 @@ diff --git a/gfx/thebes/test/gfxTextRunP
  #include "gtk/gtk.h"
  #endif
  
 +using namespace mozilla;
 +
  struct TestEntry {
    const char* mFamilies;
    const char* mString;
-@@ -70,20 +72,19 @@
+@@ -70,20 +72,19 @@ TestEntry testList[] = {
  { nsnull, nsnull } // terminator
  };
  
 -already_AddRefed<gfxContext>
 +AddRefed<gfxContext>
  MakeContext ()
  {
      const int size = 200;
@@ -2766,17 +2771,17 @@ diff --git a/gfx/thebes/test/gfxTextRunP
 +    return do_AddRef(new gfxContext(surface));
  }
  
 -nsRefPtr<gfxFontGroup> fontGroup;
 +RefPtr<gfxFontGroup> fontGroup;
  const char* lastFamilies = nsnull;
  
  void
-@@ -154,7 +155,7 @@
+@@ -154,7 +155,7 @@ main (int argc, char **argv) {
      fflush (stderr);
      fflush (stdout);
  
 -    nsRefPtr<gfxContext> context = MakeContext();
 +    RefPtr<gfxContext> context = MakeContext();
  
      // Start timing
      PRIntervalTime start = PR_IntervalNow();
@@ -2787,17 +2792,17 @@ diff --git a/gfx/thebes/test/gfxWordCach
  #include "gtk/gtk.h"
  #endif
  
 +using namespace mozilla;
 +
  class FrameTextRunCache;
  
  static FrameTextRunCache *gTextRuns = nsnull;
-@@ -116,17 +118,16 @@
+@@ -116,17 +118,16 @@ MakeTextRun(const PRUnichar *aText, PRUi
     return textRun.forget();
  }
  
 -already_AddRefed<gfxContext>
 +AddRefed<gfxContext>
  MakeContext ()
  {
     const int size = 200;
@@ -2809,26 +2814,26 @@ diff --git a/gfx/thebes/test/gfxWordCach
 -   gfxContext *ctx = new gfxContext(surface);
 -   NS_IF_ADDREF(ctx);
 -   return ctx;
 +
 +   return do_AddRef(new gfxContext(surface));
  }
  
  int
-@@ -153,7 +154,7 @@
+@@ -153,7 +154,7 @@ main (int argc, char **argv) {
  
     gTextRuns = new FrameTextRunCache();
  
 -   nsRefPtr<gfxContext> ctx = MakeContext();
 +   RefPtr<gfxContext> ctx = MakeContext();
     {
         gfxFontStyle style (FONT_STYLE_NORMAL,
                             139,
-@@ -162,7 +163,7 @@
+@@ -162,7 +163,7 @@ main (int argc, char **argv) {
                             0.0,
                             PR_FALSE, PR_FALSE);
  
 -       nsRefPtr<gfxFontGroup> fontGroup =
 +       RefPtr<gfxFontGroup> fontGroup =
             gfxPlatform::GetPlatform()->CreateFontGroup(NS_LITERAL_STRING("Geneva, MS Sans Serif, Helvetica,serif"), &style);
  
         gfxTextRunFactory::Parameters params = {
@@ -2839,53 +2844,53 @@ diff --git a/layout/base/nsCSSRendering.
  
  #include "gfxContext.h"
  
 +using namespace mozilla;
 +
  #define BORDER_FULL    0        //entire side
  #define BORDER_INSIDE  1        //inside half
  #define BORDER_OUTSIDE 2        //outside half
-@@ -2813,7 +2815,7 @@
+@@ -2804,7 +2806,7 @@ nsCSSRendering::PaintBorder(nsPresContex
    SF(" borderStyles: %d %d %d %d\n", borderStyles[0], borderStyles[1], borderStyles[2], borderStyles[3]);
  
    // start drawing
 -  nsRefPtr<gfxContext> ctx = aRenderingContext.ThebesContext();
 +  RefPtr<gfxContext> ctx = aRenderingContext.ThebesContext();
  
    ctx->Save();
  
-@@ -2971,7 +2973,7 @@
+@@ -2962,7 +2964,7 @@ nsCSSRendering::PaintOutline(nsPresConte
                                  width / twipsPerPixel };
  
    // start drawing
 -  nsRefPtr<gfxContext> ctx = aRenderingContext.ThebesContext();
 +  RefPtr<gfxContext> ctx = aRenderingContext.ThebesContext();
  
    ctx->Save();
  
-@@ -3715,7 +3717,7 @@
+@@ -3706,7 +3708,7 @@ nsCSSRendering::PaintBackgroundWithSC(ns
      anchor.y += bgClipArea.y - aBorderArea.y;
    }
  
 -  nsRefPtr<gfxContext> ctx = aRenderingContext.ThebesContext();
 +  RefPtr<gfxContext> ctx = aRenderingContext.ThebesContext();
    ctx->Save();
  
    nscoord appUnitsPerPixel = aPresContext->DevPixelsToAppUnits(1);
-@@ -4005,7 +4007,7 @@
+@@ -4000,7 +4002,7 @@ nsCSSRendering::PaintRoundedBackground(n
                                         nscoord aTheRadius[4],
                                         PRBool aCanPaintNonWhite)
  {
 -  nsRefPtr<gfxContext> ctx = aRenderingContext.ThebesContext();
 +  RefPtr<gfxContext> ctx = aRenderingContext.ThebesContext();
  
    // needed for our border thickness
    nscoord appUnitsPerPixel = aPresContext->AppUnitsPerDevPixel();
-@@ -4479,7 +4481,7 @@
+@@ -4473,7 +4475,7 @@ nsCSSRendering::PaintDecorationLine(gfxC
    PRBool contextIsSaved = PR_FALSE;
  
    gfxFloat oldLineWidth;
 -  nsRefPtr<gfxPattern> oldPattern;
 +  RefPtr<gfxPattern> oldPattern;
  
    switch (aStyle) {
      case NS_STYLE_BORDER_STYLE_SOLID:
@@ -2895,18 +2900,18 @@ diff --git a/layout/base/nsDisplayList.c
 @@ -50,6 +50,8 @@
  #include "nsRegion.h"
  #include "nsFrameManager.h"
  #include "gfxContext.h"
 +
 +using namespace mozilla;
  
  nsDisplayListBuilder::nsDisplayListBuilder(nsIFrame* aReferenceFrame,
-     PRBool aIsForEvents, PRBool aBuildCaret, nsIFrame* aMovingFrame)
-@@ -795,7 +797,7 @@
+     PRBool aIsForEvents, PRBool aBuildCaret)
+@@ -797,7 +799,7 @@ void nsDisplayOpacity::Paint(nsDisplayLi
    aCtx->GetDeviceContext(*getter_AddRefs(devCtx));
    float a2p = 1.0f / devCtx->AppUnitsPerDevPixel();
  
 -  nsRefPtr<gfxContext> ctx = aCtx->ThebesContext();
 +  RefPtr<gfxContext> ctx = aCtx->ThebesContext();
  
    ctx->Save();
  
@@ -2916,32 +2921,32 @@ diff --git a/layout/base/nsIPresShell.h 
 @@ -64,6 +64,7 @@
  #include "mozFlushType.h"
  #include "nsWeakReference.h"
  #include <stdio.h> // for FILE definition
 +#include "gfxASurface.h"
  
  class nsIAtom;
  class nsIContent;
-@@ -743,10 +744,10 @@
+@@ -743,10 +744,10 @@ public:
     * edge of the presshell area. The aPoint, aScreenRect and aSurface
     * arguments function in a similar manner as RenderSelection.
     */
 -  virtual already_AddRefed<gfxASurface> RenderNode(nsIDOMNode* aNode,
 -                                                   nsIRegion* aRegion,
 -                                                   nsPoint& aPoint,
 -                                                   nsRect* aScreenRect) = 0;
 +  virtual mozilla::AddRefed<gfxASurface> RenderNode(nsIDOMNode* aNode,
 +                                                    nsIRegion* aRegion,
 +                                                    nsPoint& aPoint,
 +                                                    nsRect* aScreenRect) = 0;
  
    /*
     * Renders a selection to a surface and returns it. This method is primarily
-@@ -763,9 +764,9 @@
+@@ -763,9 +764,9 @@ public:
     * the original. When scaling does not occur, the mouse point isn't used
     * as the position can be determined from the displayed frames.
     */
 -  virtual already_AddRefed<gfxASurface> RenderSelection(nsISelection* aSelection,
 -                                                        nsPoint& aPoint,
 -                                                        nsRect* aScreenRect) = 0;
 +  virtual mozilla::AddRefed<gfxASurface> RenderSelection(nsISelection* aSelection,
 +                                                         nsPoint& aPoint,
@@ -2956,38 +2961,38 @@ diff --git a/layout/base/nsLayoutUtils.c
  #include "nsSVGForeignObjectFrame.h"
  #include "nsSVGOuterSVGFrame.h"
  #endif
 +
 +using namespace mozilla;
  
  /**
   * A namespace class for static layout utilities.
-@@ -2319,7 +2321,7 @@
+@@ -2436,7 +2438,7 @@ nsLayoutUtils::DrawImage(nsIRenderingCon
    nsCOMPtr<nsIDeviceContext> dc;
    aRenderingContext->GetDeviceContext(*getter_AddRefs(dc));
  
 -  nsRefPtr<gfxContext> ctx = aRenderingContext->ThebesContext();
 +  RefPtr<gfxContext> ctx = aRenderingContext->ThebesContext();
  
    // the dest rect is affected by the current transform; that'll be
    // handled by Image::Draw(), when we actually set up the rectangle.
 diff --git a/layout/base/nsPresShell.cpp b/layout/base/nsPresShell.cpp
 --- a/layout/base/nsPresShell.cpp
 +++ b/layout/base/nsPresShell.cpp
-@@ -204,6 +204,8 @@
+@@ -204,6 +204,8 @@ static NS_DEFINE_CID(kCSSStyleSheetCID, 
  static NS_DEFINE_CID(kCSSStyleSheetCID, NS_CSS_STYLESHEET_CID);
  static NS_DEFINE_IID(kRangeCID,     NS_RANGE_CID);
  
 +using namespace mozilla;
 +
  PRBool nsIPresShell::gIsAccessibilityActive = PR_FALSE;
  
  // convert a color value to a string, in the CSS format #RRGGBB
-@@ -884,14 +886,14 @@
+@@ -884,14 +886,14 @@ public:
                              nscolor aBackgroundColor,
                              gfxContext* aThebesContext);
  
 -  virtual already_AddRefed<gfxASurface> RenderNode(nsIDOMNode* aNode,
 -                                                   nsIRegion* aRegion,
 -                                                   nsPoint& aPoint,
 -                                                   nsRect* aScreenRect);
 -
@@ -3000,106 +3005,106 @@ diff --git a/layout/base/nsPresShell.cpp
 +                                                     nsRect* aScreenRect);
 +
 +  virtual AddRefed<gfxASurface> RenderSelection(nsISelection* aSelection,
 +                                                          nsPoint& aPoint,
 +                                                          nsRect* aScreenRect);
  
    //nsIViewObserver interface
  
-@@ -1091,7 +1093,7 @@
+@@ -1091,7 +1093,7 @@ protected:
     * aScreenRect - [out] set to the area of the screen the painted area should
     *               be displayed at
     */
 -  already_AddRefed<gfxASurface>
 +  AddRefed<gfxASurface>
    PaintRangePaintInfo(nsTArray<nsAutoPtr<RangePaintInfo> >* aItems,
                        nsISelection* aSelection,
                        nsIRegion* aRegion,
-@@ -5200,7 +5202,7 @@
+@@ -5205,7 +5207,7 @@ PresShell::CreateRangePaintInfo(nsIDOMRa
    return info;
  }
  
 -already_AddRefed<gfxASurface>
 +AddRefed<gfxASurface>
  PresShell::PaintRangePaintInfo(nsTArray<nsAutoPtr<RangePaintInfo> >* aItems,
                                 nsISelection* aSelection,
                                 nsIRegion* aRegion,
-@@ -5210,7 +5212,7 @@
+@@ -5215,7 +5217,7 @@ PresShell::PaintRangePaintInfo(nsTArray<
  {
    nsPresContext* pc = GetPresContext();
    if (!pc || aArea.width == 0 || aArea.height == 0)
 -    return nsnull;
 +    return AddRefed<gfxASurface>(nsnull);
  
    nsIDeviceContext* deviceContext = pc->DeviceContext();
  
-@@ -5260,7 +5262,7 @@
+@@ -5265,7 +5267,7 @@ PresShell::PaintRangePaintInfo(nsTArray<
                          gfxImageSurface::ImageFormatARGB32);
    if (!surface || surface->CairoStatus()) {
      delete surface;
 -    return nsnull;
 +    return AddRefed<gfxASurface>(nsnull);
    }
  
    // clear the image
-@@ -5313,11 +5315,11 @@
+@@ -5318,11 +5320,11 @@ PresShell::PaintRangePaintInfo(nsTArray<
    // restore the old selection display state
    frameSelection->SetDisplaySelection(oldDisplaySelection);
  
 -  NS_ADDREF(surface);
 -  return surface;
 -}
 -
 -already_AddRefed<gfxASurface>
 +  surface->AddReference();
 +  return AddRefed<gfxASurface>(surface);
 +}
 +
 +AddRefed<gfxASurface>
  PresShell::RenderNode(nsIDOMNode* aNode,
                        nsIRegion* aRegion,
                        nsPoint& aPoint,
-@@ -5335,7 +5337,7 @@
+@@ -5340,7 +5342,7 @@ PresShell::RenderNode(nsIDOMNode* aNode,
    RangePaintInfo* info = CreateRangePaintInfo(range, area);
    if (info && !rangeItems.AppendElement(info)) {
      delete info;
 -    return nsnull;
 +    return AddRefed<gfxASurface>(nsnull);
    }
  
    if (aRegion) {
-@@ -5350,7 +5352,7 @@
+@@ -5355,7 +5357,7 @@ PresShell::RenderNode(nsIDOMNode* aNode,
      
      nsPresContext* pc = GetPresContext();
      if (!pc)
 -      return nsnull;
 +      return AddRefed<gfxASurface>(nsnull);
  
      // move the region so that it is offset from the topleft corner of the surface
      aRegion->Offset(-rrectPixels.x + (rrectPixels.x - pc->AppUnitsToDevPixels(area.x)),
-@@ -5361,7 +5363,7 @@
+@@ -5366,7 +5368,7 @@ PresShell::RenderNode(nsIDOMNode* aNode,
                               aScreenRect);
  }
  
 -already_AddRefed<gfxASurface>
 +AddRefed<gfxASurface>
  PresShell::RenderSelection(nsISelection* aSelection,
                             nsPoint& aPoint,
                             nsRect* aScreenRect)
-@@ -5386,7 +5388,7 @@
+@@ -5391,7 +5393,7 @@ PresShell::RenderSelection(nsISelection*
      RangePaintInfo* info = CreateRangePaintInfo(range, area);
      if (info && !rangeItems.AppendElement(info)) {
        delete info;
 -      return nsnull;
 +      return AddRefed<gfxASurface>(nsnull);
      }
    }
  
-@@ -7031,20 +7033,20 @@
+@@ -7036,20 +7038,20 @@ DumpToPNG(nsIPresShell* shell, nsAString
    nsRect r(0, 0, shell->GetPresContext()->DevPixelsToAppUnits(width),
                   shell->GetPresContext()->DevPixelsToAppUnits(height));
  
 -  nsRefPtr<gfxImageSurface> imgSurface =
 +  RefPtr<gfxImageSurface> imgSurface =
       new gfxImageSurface(gfxIntSize(width, height),
                           gfxImageSurface::ImageFormatARGB32);
    NS_ENSURE_TRUE(imgSurface, NS_ERROR_OUT_OF_MEMORY);
@@ -3118,29 +3123,29 @@ diff --git a/layout/base/nsPresShell.cpp
 -  nsRefPtr<gfxContext> context = new gfxContext(surface);
 +  RefPtr<gfxContext> context = new gfxContext(surface);
    NS_ENSURE_TRUE(context, NS_ERROR_OUT_OF_MEMORY);
  
    nsresult rv = shell->RenderDocument(r, PR_FALSE, PR_FALSE,
 diff --git a/layout/generic/nsBlockFrame.cpp b/layout/generic/nsBlockFrame.cpp
 --- a/layout/generic/nsBlockFrame.cpp
 +++ b/layout/generic/nsBlockFrame.cpp
-@@ -102,6 +102,8 @@
+@@ -101,6 +101,8 @@ static const int MIN_LINES_NEEDING_CURSO
  #ifdef DEBUG
  #include "nsPrintfCString.h"
  #include "nsBlockDebugFlags.h"
 +
 +using namespace mozilla;
  
  PRBool nsBlockFrame::gLamePaintMetrics;
  PRBool nsBlockFrame::gLameReflowMetrics;
-@@ -5922,7 +5924,7 @@
+@@ -5923,7 +5925,7 @@ nsBlockFrame::PaintTextDecorationLine(ns
+       
+   // Only paint if we have a positive width
    if (width > 0) {
-     const nsStyleVisibility* visibility = GetStyleVisibility();
-     PRBool isRTL = visibility->mDirection == NS_STYLE_DIRECTION_RTL;
 -    nsRefPtr<gfxContext> ctx = aRenderingContext.ThebesContext();
 +    RefPtr<gfxContext> ctx = aRenderingContext.ThebesContext();
      gfxPoint pt(PresContext()->AppUnitsToGfxUnits(start + aPt.x),
                  PresContext()->AppUnitsToGfxUnits(aLine->mBounds.y + aPt.y));
      gfxSize size(PresContext()->AppUnitsToGfxUnits(width), aSize);
 diff --git a/layout/generic/nsFrame.cpp b/layout/generic/nsFrame.cpp
 --- a/layout/generic/nsFrame.cpp
 +++ b/layout/generic/nsFrame.cpp
@@ -3148,59 +3153,59 @@ diff --git a/layout/generic/nsFrame.cpp 
  
  #include "gfxContext.h"
  
 +using namespace mozilla;
 +
  static NS_DEFINE_CID(kLookAndFeelCID,  NS_LOOKANDFEEL_CID);
  static NS_DEFINE_CID(kWidgetCID, NS_CHILD_CID);
  
-@@ -784,7 +786,7 @@
+@@ -784,7 +786,7 @@ void nsDisplaySelectionOverlay::Paint(ns
    gfxRGBA c(color);
    c.a = .5;
  
 -  nsRefPtr<gfxContext> ctx = aCtx->ThebesContext();
 +  RefPtr<gfxContext> ctx = aCtx->ThebesContext();
    ctx->SetColor(c);
  
    nsRect rect(aBuilder->ToReferenceFrame(mFrame), mFrame->GetSize());
 diff --git a/layout/generic/nsHTMLContainerFrame.cpp b/layout/generic/nsHTMLContainerFrame.cpp
 --- a/layout/generic/nsHTMLContainerFrame.cpp
 +++ b/layout/generic/nsHTMLContainerFrame.cpp
-@@ -70,6 +70,8 @@
+@@ -71,6 +71,8 @@
  #include "nsLineBox.h"
  #include "nsDisplayList.h"
  #include "nsCSSRendering.h"
 +
 +using namespace mozilla;
  
  class nsDisplayTextDecoration : public nsDisplayItem {
  public:
-@@ -224,7 +226,7 @@
-   const nsStyleVisibility* visibility = GetStyleVisibility();
-   PRBool isRTL = visibility->mDirection == NS_STYLE_DIRECTION_RTL;
+@@ -239,7 +241,7 @@ nsHTMLContainerFrame::PaintTextDecoratio
+     }
+   }
    nscoord innerWidth = mRect.width - bp.left - bp.right;
 -  nsRefPtr<gfxContext> ctx = aRenderingContext.ThebesContext();
 +  RefPtr<gfxContext> ctx = aRenderingContext.ThebesContext();
    gfxPoint pt(PresContext()->AppUnitsToGfxUnits(bp.left + aPt.x),
                PresContext()->AppUnitsToGfxUnits(bp.top + aPt.y));
    gfxSize size(PresContext()->AppUnitsToGfxUnits(innerWidth), aSize);
 diff --git a/layout/generic/nsObjectFrame.cpp b/layout/generic/nsObjectFrame.cpp
 --- a/layout/generic/nsObjectFrame.cpp
 +++ b/layout/generic/nsObjectFrame.cpp
-@@ -1410,7 +1410,7 @@
+@@ -1410,7 +1410,7 @@ nsObjectFrame::PaintPlugin(nsIRenderingC
         * to tell the plugin where it is, we dispatch a NPWindow through
         * |HandleEvent| to tell the plugin when its window moved
         */
 -      nsRefPtr<gfxContext> ctx = aRenderingContext.ThebesContext();
 +      RefPtr<gfxContext> ctx = aRenderingContext.ThebesContext();
        gfxMatrix ctxMatrix = ctx->CurrentMatrix();
        if (ctxMatrix.HasNonTranslation()) {
          // soo; in the future, we should be able to render
-@@ -1432,7 +1432,7 @@
+@@ -1432,7 +1432,7 @@ nsObjectFrame::PaintPlugin(nsIRenderingC
  
        /* Set the device offsets as appropriate, for whatever our current group offsets might be */
        gfxFloat xoff, yoff;
 -      nsRefPtr<gfxASurface> surf = ctx->CurrentSurface(&xoff, &yoff);
 +      RefPtr<gfxASurface> surf = ctx->CurrentSurface(&xoff, &yoff);
  
        if (surf->CairoStatus() != 0) {
          NS_WARNING("Plugin is being asked to render to a surface that's in error!");
@@ -3211,50 +3216,50 @@ diff --git a/layout/generic/nsTextFrameT
  #include "gfxContext.h"
  #include "gfxTextRunWordCache.h"
  
 +using namespace mozilla;
 +
  #ifdef NS_DEBUG
  #undef NOISY_BLINK
  #undef NOISY_REFLOW
-@@ -1277,7 +1279,7 @@
+@@ -1288,7 +1290,7 @@ GetFontGroupForFrame(nsIFrame* aFrame,
    return fm->GetThebesFontGroup();
  }
  
 -static already_AddRefed<gfxContext>
 +static AddRefed<gfxContext>
  GetReferenceRenderingContext(nsTextFrame* aTextFrame, nsIRenderingContext* aRC)
  {
    nsCOMPtr<nsIRenderingContext> tmp = aRC;
-@@ -1285,12 +1287,11 @@
+@@ -1296,12 +1298,11 @@ GetReferenceRenderingContext(nsTextFrame
      nsresult rv = aTextFrame->PresContext()->PresShell()->
        CreateRenderingContext(aTextFrame, getter_AddRefs(tmp));
      if (NS_FAILED(rv))
 -      return nsnull;
 +      return AddRefed<gfxContext>(nsnull);
    }
  
    gfxContext* ctx = tmp->ThebesContext();
 -  NS_ADDREF(ctx);
 -  return ctx;
 +  return do_AddRef(ctx);
  }
  
  /**
-@@ -1300,7 +1301,7 @@
+@@ -1311,7 +1312,7 @@ static gfxTextRun*
  static gfxTextRun*
  GetHyphenTextRun(gfxTextRun* aTextRun, gfxContext* aContext, nsTextFrame* aTextFrame)
  {
 -  nsRefPtr<gfxContext> ctx = aContext;
 +  RefPtr<gfxContext> ctx = aContext;
    if (!ctx) {
      ctx = GetReferenceRenderingContext(aTextFrame, nsnull);
    }
-@@ -1772,7 +1773,7 @@
+@@ -1783,7 +1784,7 @@ nsTextFrame::EnsureTextRun(gfxContext* a
        gTextRuns->MarkUsed(mTextRun);
      }
    } else {
 -    nsRefPtr<gfxContext> ctx = aReferenceContext;
 +    RefPtr<gfxContext> ctx = aReferenceContext;
      if (!ctx) {
        ctx = GetReferenceRenderingContext(this, nsnull);
      }
@@ -3265,17 +3270,17 @@ diff --git a/layout/generic/nsTextRunTra
  #include "nsStyleContext.h"
  #include "gfxContext.h"
  #include "nsContentUtils.h"
 +
 +using namespace mozilla;
  
  #define SZLIG 0x00DF
  
-@@ -288,7 +290,7 @@
+@@ -288,7 +290,7 @@ nsFontVariantTextRunFactory::RebuildText
    gfxFontGroup* fontGroup = aTextRun->GetFontGroup();
    gfxFontStyle fontStyle = *fontGroup->GetStyle();
    fontStyle.size *= 0.8;
 -  nsRefPtr<gfxFontGroup> smallFont = fontGroup->Copy(&fontStyle);
 +  RefPtr<gfxFontGroup> smallFont = fontGroup->Copy(&fontStyle);
    if (!smallFont)
      return;
  
@@ -3286,53 +3291,53 @@ diff --git a/layout/svg/base/src/nsSVGFi
  #include "gfxASurface.h"
  #include "gfxContext.h"
  #include "gfxImageSurface.h"
 +
 +using namespace mozilla;
  
  nsIFrame*
  NS_NewSVGFilterFrame(nsIPresShell* aPresShell, nsIContent* aContent, nsStyleContext* aContext)
-@@ -446,7 +448,7 @@
+@@ -446,7 +448,7 @@ nsSVGFilterFrame::FilterPaint(nsSVGRende
    if (!analysis.GetSourceColorAlphaNeeded().IsEmpty() ||
        !analysis.GetSourceAlphaNeeded().IsEmpty()) {
      // paint the target geometry
 -    nsRefPtr<gfxImageSurface> tmpSurface = instance.GetImage();
 +    RefPtr<gfxImageSurface> tmpSurface = instance.GetImage();
      if (!tmpSurface) {
        FilterFailCleanup(aContext, aTarget);
        return NS_OK;
-@@ -460,7 +462,7 @@
+@@ -460,7 +462,7 @@ nsSVGFilterFrame::FilterPaint(nsSVGRende
      aTarget->PaintSVG(&tmpState, nsnull);
  
      if (!analysis.GetSourceAlphaNeeded().IsEmpty()) {
 -      nsRefPtr<gfxImageSurface> alpha = instance.GetImage();
 +      RefPtr<gfxImageSurface> alpha = instance.GetImage();
        if (!alpha) {
          FilterFailCleanup(aContext, aTarget);
          return NS_OK;
-@@ -494,7 +496,7 @@
+@@ -494,7 +496,7 @@ nsSVGFilterFrame::FilterPaint(nsSVGRende
      // but we have to because all filter primitives currently need to
      // call AcquireSourceImage and find a source image, even if they don't
      // use it!
 -    nsRefPtr<gfxImageSurface> tmpSurface = instance.GetImage();
 +    RefPtr<gfxImageSurface> tmpSurface = instance.GetImage();
      if (!tmpSurface) {
        FilterFailCleanup(aContext, aTarget);
        return NS_OK;
-@@ -517,7 +519,7 @@
+@@ -517,7 +519,7 @@ nsSVGFilterFrame::FilterPaint(nsSVGRende
    }
  
    nsRect filterRect;
 -  nsRefPtr<gfxImageSurface> filterSurface;
 +  RefPtr<gfxImageSurface> filterSurface;
  
    instance.LookupImage(NS_LITERAL_STRING(""),
                         getter_AddRefs(filterSurface), &filterRect, colorModel);
-@@ -734,15 +736,15 @@
+@@ -734,15 +736,15 @@ nsSVGFilterInstance::GetFilterSubregion(
  #endif
  }
  
 -already_AddRefed<gfxImageSurface>
 +AddRefed<gfxImageSurface>
  nsSVGFilterInstance::GetImage()
  {
 -  nsRefPtr<gfxImageSurface> surface =
@@ -3341,142 +3346,142 @@ diff --git a/layout/svg/base/src/nsSVGFi
                          gfxASurface::ImageFormatARGB32);
  
    if (!surface || surface->CairoStatus()) {
 -    return nsnull;
 +    return AddRefed<gfxImageSurface>(nsnull);
    }
  
    surface->SetDeviceOffset(gfxPoint(-mSurfaceRect.x, -mSurfaceRect.y));
-@@ -752,9 +754,7 @@
+@@ -752,9 +754,7 @@ nsSVGFilterInstance::GetImage()
    ctx.SetOperator(gfxContext::OPERATOR_CLEAR);
    ctx.Paint();
  
 -  gfxImageSurface *retval = nsnull;
 -  surface.swap(retval);
 -  return retval;
 +  return surface.forget();
  }
  
  void
-@@ -775,7 +775,7 @@
+@@ -775,7 +775,7 @@ nsSVGFilterInstance::LookupImage(const n
    }
  
    *aImage = entry->mImage;
 -  NS_ADDREF(*aImage);
 +  entry->mImage->AddReference();
    *aRegion = entry->mRegion;
  
    if (aRequiredColorModel == entry->mColorModel)
 diff --git a/layout/svg/base/src/nsSVGFilterInstance.h b/layout/svg/base/src/nsSVGFilterInstance.h
 --- a/layout/svg/base/src/nsSVGFilterInstance.h
 +++ b/layout/svg/base/src/nsSVGFilterInstance.h
-@@ -79,7 +79,7 @@
+@@ -79,7 +79,7 @@ public:
    // device offsets so that its origin is positioned at mSurfaceRect.TopLeft()
    // when using cairo to draw into the surface). The surface is cleared
    // to transparent black.
 -  already_AddRefed<gfxImageSurface> GetImage();
 +  mozilla::AddRefed<gfxImageSurface> GetImage();
  
    void LookupImage(const nsAString &aName,
                     gfxImageSurface **aImage,
-@@ -134,7 +134,7 @@
+@@ -134,7 +134,7 @@ private:
        mImage(aImage), mRegion(aRegion), mColorModel(aColorModel) {
      }
  
 -    nsRefPtr<gfxImageSurface> mImage;
 +    mozilla::RefPtr<gfxImageSurface> mImage;
      nsRect mRegion;
      ColorModel mColorModel;
    };
 diff --git a/layout/svg/base/src/nsSVGGlyphFrame.cpp b/layout/svg/base/src/nsSVGGlyphFrame.cpp
 --- a/layout/svg/base/src/nsSVGGlyphFrame.cpp
 +++ b/layout/svg/base/src/nsSVGGlyphFrame.cpp
-@@ -55,6 +55,8 @@
+@@ -54,6 +54,8 @@
  #include "gfxMatrix.h"
  #include "gfxPlatform.h"
  #include "gfxTextRunWordCache.h"
 +
 +using namespace mozilla;
  
  struct CharacterPosition {
    gfxPoint pos;
-@@ -422,7 +424,7 @@
+@@ -426,7 +428,7 @@ NS_IMETHODIMP
  NS_IMETHODIMP
  nsSVGGlyphFrame::UpdateCoveredRegion()
  {
 -  nsRefPtr<gfxContext> tmpCtx = MakeTmpCtx();
 +  RefPtr<gfxContext> tmpCtx = MakeTmpCtx();
+   SetupGlobalTransform(tmpCtx);
    CharacterIterator iter(this, PR_TRUE);
-   iter.SetupGlobalTransform(gfxMatrix());
-   
-@@ -546,7 +548,7 @@
+   iter.SetInitialMatrix(tmpCtx);
+@@ -555,7 +557,7 @@ nsSVGGlyphFrame::GetBBox(nsIDOMSVGRect *
  {
    *_retval = nsnull;
  
 -  nsRefPtr<gfxContext> tmpCtx = MakeTmpCtx();
 +  RefPtr<gfxContext> tmpCtx = MakeTmpCtx();
+   SetupGlobalTransform(tmpCtx);
    CharacterIterator iter(this, PR_TRUE);
-   iter.SetupGlobalTransform(gfxMatrix());
-   AddCharactersToPath(&iter, tmpCtx);
-@@ -615,7 +617,7 @@
+   iter.SetInitialMatrix(tmpCtx);
+@@ -625,7 +627,7 @@ nsSVGGlyphFrame::GetCharacterPositions(n
    if (!textPath)
      return PR_TRUE;
  
 -  nsRefPtr<gfxFlattenedPath> data = textPath->GetFlattenedPath();
 +  RefPtr<gfxFlattenedPath> data = textPath->GetFlattenedPath();
  
    /* textPath frame, but invalid target */
    if (!data)
-@@ -833,7 +835,7 @@
+@@ -843,7 +845,7 @@ nsSVGGlyphFrame::GetEndPositionOfChar(PR
    if (!iter.AdvanceToCharacter(charnum))
      return NS_ERROR_DOM_INDEX_SIZE_ERR;
  
 -  nsRefPtr<gfxContext> tmpCtx = MakeTmpCtx();
 +  RefPtr<gfxContext> tmpCtx = MakeTmpCtx();
    iter.SetupForMetrics(tmpCtx);
    tmpCtx->MoveTo(gfxPoint(mTextRun->GetAdvanceWidth(charnum, 1, nsnull), 0));
    tmpCtx->IdentityMatrix();
-@@ -852,7 +854,7 @@
+@@ -862,7 +864,7 @@ nsSVGGlyphFrame::GetExtentOfChar(PRUint3
    gfxTextRun::Metrics metrics =
      mTextRun->MeasureText(charnum, 1, PR_FALSE, nsnull, nsnull);
  
 -  nsRefPtr<gfxContext> tmpCtx = MakeTmpCtx();
 +  RefPtr<gfxContext> tmpCtx = MakeTmpCtx();
    iter.SetupForMetrics(tmpCtx);
    tmpCtx->Rectangle(metrics.mBoundingBox);
    tmpCtx->IdentityMatrix();
-@@ -1070,7 +1072,7 @@
+@@ -1080,7 +1082,7 @@ nsSVGGlyphFrame::GetCharNumAtPosition(ns
    point->GetX(&xPos);
    point->GetY(&yPos);
  
 -  nsRefPtr<gfxContext> tmpCtx = MakeTmpCtx();
 +  RefPtr<gfxContext> tmpCtx = MakeTmpCtx();
    CharacterIterator iter(this, PR_FALSE);
  
    PRInt32 i;
-@@ -1164,7 +1166,7 @@
+@@ -1150,7 +1152,7 @@ PRBool
  PRBool
  nsSVGGlyphFrame::ContainsPoint(float x, float y)
  {
 -  nsRefPtr<gfxContext> tmpCtx = MakeTmpCtx();
 +  RefPtr<gfxContext> tmpCtx = MakeTmpCtx();
+   SetupGlobalTransform(tmpCtx);
    CharacterIterator iter(this, PR_TRUE);
-   iter.SetupGlobalTransform(gfxMatrix());
-   
-@@ -1266,7 +1268,7 @@
+   iter.SetInitialMatrix(tmpCtx);
+@@ -1254,7 +1256,7 @@ nsSVGGlyphFrame::EnsureTextRun(float *aD
                             font.sizeAdjust, font.systemFont,
                             font.familyNameQuirks);
  
 -    nsRefPtr<gfxFontGroup> fontGroup =
 +    RefPtr<gfxFontGroup> fontGroup =
        gfxPlatform::GetPlatform()->CreateFontGroup(font.name, &fontStyle);
  
      PRUint32 flags = gfxTextRunFactory::TEXT_NEED_BOUNDING_BOX |
-@@ -1275,7 +1277,7 @@
+@@ -1263,7 +1265,7 @@ nsSVGGlyphFrame::EnsureTextRun(float *aD
      // XXX We should use a better surface here! But then we'd have to
      // change things so we can ensure we always have the "right" sort of
      // surface available, by creating the textrun only at the right times
 -    nsRefPtr<gfxContext> tmpCtx = MakeTmpCtx();
 +    RefPtr<gfxContext> tmpCtx = MakeTmpCtx();
      tmpCtx->SetMatrix(m);
  
      // Use only the word cache here. We don't want to cache the textrun
@@ -3487,87 +3492,87 @@ diff --git a/layout/svg/base/src/nsSVGGr
  #include "gfxContext.h"
  #include "nsIDOMSVGRect.h"
  #include "gfxPattern.h"
 +
 +using namespace mozilla;
  
  //----------------------------------------------------------------------
  // Implementation
-@@ -345,7 +347,7 @@
+@@ -345,7 +347,7 @@ nsSVGGradientFrame::SetupPaintServer(gfx
  
    patternMatrix.Invert();
  
 -  nsRefPtr<gfxPattern> gradient = CreateGradient();
 +  RefPtr<gfxPattern> gradient = CreateGradient();
    if (!gradient || gradient->CairoStatus())
      return PR_FALSE;
  
-@@ -598,7 +600,7 @@
+@@ -598,7 +600,7 @@ nsSVGLinearGradientFrame::GradientLookup
      GetAnimValue(static_cast<nsSVGSVGElement*>(nsnull));
  }
  
 -already_AddRefed<gfxPattern>
 +AddRefed<gfxPattern>
  nsSVGLinearGradientFrame::CreateGradient()
  {
    float x1, y1, x2, y2;
-@@ -608,9 +610,7 @@
+@@ -608,9 +610,7 @@ nsSVGLinearGradientFrame::CreateGradient
    x2 = GradientLookupAttribute(nsGkAtoms::x2, nsSVGLinearGradientElement::X2);
    y2 = GradientLookupAttribute(nsGkAtoms::y2, nsSVGLinearGradientElement::Y2);
  
 -  gfxPattern *pattern = new gfxPattern(x1, y1, x2, y2);
 -  NS_IF_ADDREF(pattern);
 -  return pattern;
 +  return do_AddRef(new gfxPattern(x1, y1, x2, y2));
  }
  
  // -------------------------------------------------------------------------
-@@ -680,7 +680,7 @@
+@@ -680,7 +680,7 @@ nsSVGRadialGradientFrame::GradientLookup
      GetAnimValue(static_cast<nsSVGSVGElement*>(nsnull));
  }
  
 -already_AddRefed<gfxPattern>
 +AddRefed<gfxPattern>
  nsSVGRadialGradientFrame::CreateGradient()
  {
    float cx, cy, r, fx, fy;
-@@ -720,9 +720,7 @@
+@@ -720,9 +720,7 @@ nsSVGRadialGradientFrame::CreateGradient
      }
    }
  
 -  gfxPattern *pattern = new gfxPattern(fx, fy, 0, cx, cy, r);
 -  NS_IF_ADDREF(pattern);
 -  return pattern;
 +  return do_AddRef(new gfxPattern(fx, fy, 0, cx, cy, r));
  }
  
  // -------------------------------------------------------------------------
 diff --git a/layout/svg/base/src/nsSVGGradientFrame.h b/layout/svg/base/src/nsSVGGradientFrame.h
 --- a/layout/svg/base/src/nsSVGGradientFrame.h
 +++ b/layout/svg/base/src/nsSVGGradientFrame.h
-@@ -133,7 +133,7 @@
+@@ -133,7 +133,7 @@ private:
    gfxMatrix GetGradientTransform(nsSVGGeometryFrame *aSource);
  
  protected:
 -  virtual already_AddRefed<gfxPattern> CreateGradient() = 0;
 +  virtual mozilla::AddRefed<gfxPattern> CreateGradient() = 0;
  
    // Use these inline methods instead of GetGradientWithAttr(..., aGradType)
    nsIContent* GetLinearGradientWithAttr(nsIAtom *aAttrName)
-@@ -221,7 +221,7 @@
+@@ -221,7 +221,7 @@ public:
  
  protected:
    float GradientLookupAttribute(nsIAtom *aAtomName, PRUint16 aEnumName);
 -  virtual already_AddRefed<gfxPattern> CreateGradient();
 +  virtual mozilla::AddRefed<gfxPattern> CreateGradient();
  };
  
  // -------------------------------------------------------------------------
-@@ -259,7 +259,7 @@
+@@ -259,7 +259,7 @@ protected:
  protected:
    float GradientLookupAttribute(nsIAtom *aAtomName, PRUint16 aEnumName,
                                  nsIContent *aElement = nsnull);
 -  virtual already_AddRefed<gfxPattern> CreateGradient();
 +  virtual mozilla::AddRefed<gfxPattern> CreateGradient();
  };
  
  #endif // __NS_SVGGRADIENTFRAME_H__
@@ -3578,17 +3583,17 @@ diff --git a/layout/svg/base/src/nsSVGIm
  #include "gfxContext.h"
  #include "nsIInterfaceRequestorUtils.h"
  #include "nsIImage.h"
 +
 +using namespace mozilla;
  
  class nsSVGImageFrame;
  
-@@ -257,7 +259,7 @@
+@@ -257,7 +259,7 @@ nsSVGImageFrame::PaintSVG(nsSVGRenderSta
    if (mImageContainer)
      mImageContainer->GetCurrentFrame(getter_AddRefs(currentFrame));
  
 -  nsRefPtr<gfxPattern> thebesPattern = nsnull;
 +  RefPtr<gfxPattern> thebesPattern = nsnull;
    if (currentFrame) {
      nsCOMPtr<nsIImage> img(do_GetInterface(currentFrame));
  
@@ -3599,44 +3604,44 @@ diff --git a/layout/svg/base/src/nsSVGMa
  #include "nsIDOMSVGRect.h"
  #include "gfxImageSurface.h"
  
 +using namespace mozilla;
 +
  //----------------------------------------------------------------------
  // Implementation
  
-@@ -72,7 +74,7 @@
+@@ -72,7 +74,7 @@ NS_GetSVGMaskElement(nsIURI *aURI, nsICo
    return nsnull;
  }
  
 -already_AddRefed<gfxPattern>
 +AddRefed<gfxPattern>
  nsSVGMaskFrame::ComputeMaskAlpha(nsSVGRenderState *aContext,
                                   nsISVGChildFrame* aParent,
                                   nsIDOMSVGMatrix* aMatrix,
-@@ -83,7 +85,7 @@
+@@ -83,7 +85,7 @@ nsSVGMaskFrame::ComputeMaskAlpha(nsSVGRe
    // has a mask reference loop.
    if (mInUse) {
      NS_WARNING("Mask loop detected!");
 -    return nsnull;
 +    return AddRefed<gfxPattern>(nsnull);
    }
    AutoMaskReferencer maskRef(this);
  
-@@ -123,7 +125,7 @@
+@@ -123,7 +125,7 @@ nsSVGMaskFrame::ComputeMaskAlpha(nsSVGRe
                                  nsISVGChildFrame::TRANSFORM_CHANGED);
  
        if (!bbox)
 -        return nsnull;
 +        return AddRefed<gfxPattern>(nsnull);
  
  #ifdef DEBUG_tor
        bbox->GetX(&x);
-@@ -165,13 +167,13 @@
+@@ -165,13 +167,13 @@ nsSVGMaskFrame::ComputeMaskAlpha(nsSVGRe
  
    gfx->Restore();
  
 -  nsRefPtr<gfxPattern> pattern = gfx->PopGroup();
 +  RefPtr<gfxPattern> pattern = gfx->PopGroup();
    if (!pattern || pattern->CairoStatus())
 -    return nsnull;
 +    return AddRefed<gfxPattern>(nsnull);
@@ -3644,17 +3649,17 @@ diff --git a/layout/svg/base/src/nsSVGMa
 -  nsRefPtr<gfxASurface> surface = pattern->GetSurface();
 +  RefPtr<gfxASurface> surface = pattern->GetSurface();
    if (!surface || surface->CairoStatus())
 -    return nsnull;
 +    return AddRefed<gfxPattern>(nsnull);
  
    surface->SetDeviceOffset(gfxPoint(0,0));
  
-@@ -191,15 +193,15 @@
+@@ -191,15 +193,15 @@ nsSVGMaskFrame::ComputeMaskAlpha(nsSVGRe
  
    // 0 disables mask, < 0 is an error
    if (surfaceSize.width <= 0 || surfaceSize.height <= 0)
 -    return nsnull;
 +    return AddRefed<gfxPattern>(nsnull);
  
    if (resultOverflows)
 -    return nsnull;
@@ -3664,31 +3669,31 @@ diff --git a/layout/svg/base/src/nsSVGMa
 +  RefPtr<gfxImageSurface> image =
      new gfxImageSurface(surfaceSize, gfxASurface::ImageFormatARGB32);
    if (!image || image->CairoStatus())
 -    return nsnull;
 +    return AddRefed<gfxPattern>(nsnull);
  
    gfxContext transferCtx(image);
    transferCtx.SetOperator(gfxContext::OPERATOR_SOURCE);
-@@ -231,9 +233,8 @@
+@@ -231,9 +233,8 @@ nsSVGMaskFrame::ComputeMaskAlpha(nsSVGRe
    gfxPattern *retval = new gfxPattern(image);
    if (retval) {
      retval->SetMatrix(gfxMatrix().Translate(-clipExtents.pos));
 -    NS_ADDREF(retval);
    }
 -  return retval;
 +  return do_AddRef(retval);
  }
  
  nsIAtom *
 diff --git a/layout/svg/base/src/nsSVGMaskFrame.h b/layout/svg/base/src/nsSVGMaskFrame.h
 --- a/layout/svg/base/src/nsSVGMaskFrame.h
 +++ b/layout/svg/base/src/nsSVGMaskFrame.h
-@@ -56,10 +56,10 @@
+@@ -56,10 +56,10 @@ protected:
  
  public:
    // nsSVGMaskFrame method:
 -  already_AddRefed<gfxPattern> ComputeMaskAlpha(nsSVGRenderState *aContext,
 -                                                nsISVGChildFrame* aParent,
 -                                                nsIDOMSVGMatrix* aMatrix,
 -                                                float aOpacity = 1.0f);
 +  mozilla::AddRefed<gfxPattern> ComputeMaskAlpha(nsSVGRenderState *aContext,
@@ -3705,44 +3710,44 @@ diff --git a/layout/svg/base/src/nsSVGPa
  #include "gfxContext.h"
  #include "gfxPlatform.h"
  #include "gfxPattern.h"
 +
 +using namespace mozilla;
  
  #ifdef DEBUG_scooter
  static void printCTM(char *msg, gfxMatrix aCTM);
-@@ -315,7 +317,7 @@
+@@ -315,7 +317,7 @@ nsSVGPatternFrame::PaintPattern(gfxASurf
    printf("Creating %dX%d surface\n", int(surfaceSize.width), int(surfaceSize.height));
  #endif
  
 -  nsRefPtr<gfxASurface> tmpSurface =
 +  RefPtr<gfxASurface> tmpSurface =
      gfxPlatform::GetPlatform()->CreateOffscreenSurface(surfaceSize,
                                                         gfxASurface::ImageFormatARGB32);
    if (!tmpSurface || tmpSurface->CairoStatus())
-@@ -354,7 +356,7 @@
+@@ -354,7 +356,7 @@ nsSVGPatternFrame::PaintPattern(gfxASurf
    }
  
    // caller now owns the surface
 -  tmpSurface.swap(*surface);
 +  *surface = do_AddRef(tmpSurface).get();
    return NS_OK;
  }
  
-@@ -843,7 +845,7 @@
+@@ -843,7 +845,7 @@ nsSVGPatternFrame::SetupPaintServer(gfxC
    gfxMatrix matrix = aContext->CurrentMatrix();
  
    // Paint it!
 -  nsRefPtr<gfxASurface> surface;
 +  RefPtr<gfxASurface> surface;
    gfxMatrix pMatrix;
    aContext->IdentityMatrix();
    nsresult rv = PaintPattern(getter_AddRefs(surface), &pMatrix,
-@@ -860,7 +862,7 @@
+@@ -860,7 +862,7 @@ nsSVGPatternFrame::SetupPaintServer(gfxC
  
    pMatrix.Invert();
  
 -  nsRefPtr<gfxPattern> pattern = new gfxPattern(surface);
 +  RefPtr<gfxPattern> pattern = new gfxPattern(surface);
  
    if (!pattern || pattern->CairoStatus())
      return PR_FALSE;
@@ -3752,17 +3757,17 @@ diff --git a/layout/svg/base/src/nsSVGTe
 @@ -46,6 +46,7 @@
  #include "nsSVGPathElement.h"
  #include "nsSVGTextPathElement.h"
  
 +using namespace mozilla;
  
  NS_IMPL_ISUPPORTS1(nsSVGPathListener, nsIMutationObserver)
  
-@@ -169,14 +170,17 @@
+@@ -169,14 +170,17 @@ nsSVGTextPathFrame::GetPathFrame()
    return path;
  }
  
 -already_AddRefed<gfxFlattenedPath>
 +AddRefed<gfxFlattenedPath>
  nsSVGTextPathFrame::GetFlattenedPath()
  {
    nsIFrame *path = GetPathFrame();
@@ -3773,47 +3778,47 @@ diff --git a/layout/svg/base/src/nsSVGTe
 +  return AddRefed<gfxFlattenedPath>(nsnull);
  }
   
 -already_AddRefed<gfxFlattenedPath>
 +AddRefed<gfxFlattenedPath>
  nsSVGTextPathFrame::GetFlattenedPath(nsIFrame *path)
  {
    NS_PRECONDITION(path, "Unexpected null path");
-@@ -203,7 +207,7 @@
+@@ -203,7 +207,7 @@ nsSVGTextPathFrame::GetStartOffset()
      return 0.0;
  
    if (length->IsPercentage()) {
 -    nsRefPtr<gfxFlattenedPath> data = GetFlattenedPath();
 +    RefPtr<gfxFlattenedPath> data = GetFlattenedPath();
      return data ? (val * data->GetLength() / 100.0) : 0.0;
    } else {
      return val * GetPathScale();
-@@ -223,7 +227,7 @@
+@@ -223,7 +227,7 @@ nsSVGTextPathFrame::GetPathScale()
    if (pl == 0.0f)
      return 1.0;
  
 -  nsRefPtr<gfxFlattenedPath> data = GetFlattenedPath(pathFrame);
 +  RefPtr<gfxFlattenedPath> data = GetFlattenedPath(pathFrame);
    return data ? data->GetLength() / pl : 1.0; 
  }
  
 diff --git a/layout/svg/base/src/nsSVGTextPathFrame.h b/layout/svg/base/src/nsSVGTextPathFrame.h
 --- a/layout/svg/base/src/nsSVGTextPathFrame.h
 +++ b/layout/svg/base/src/nsSVGTextPathFrame.h
-@@ -96,7 +96,7 @@
+@@ -96,7 +96,7 @@ public:
  #endif
  
    // nsSVGTextPathFrame methods:
 -  already_AddRefed<gfxFlattenedPath> GetFlattenedPath();
 +  mozilla::AddRefed<gfxFlattenedPath> GetFlattenedPath();
    nsIFrame *GetPathFrame();
  
    gfxFloat GetStartOffset();
-@@ -109,7 +109,7 @@
+@@ -109,7 +109,7 @@ protected:
    NS_IMETHOD_(already_AddRefed<nsIDOMSVGLengthList>) GetDy();
  
  private:
 -  already_AddRefed<gfxFlattenedPath> GetFlattenedPath(nsIFrame *path);
 +  mozilla::AddRefed<gfxFlattenedPath> GetFlattenedPath(nsIFrame *path);
  
    nsCOMPtr<nsIDOMSVGAnimatedString> mHref;
    nsRefPtr<nsSVGPathListener> mPathListener;
@@ -3824,34 +3829,34 @@ diff --git a/layout/svg/base/src/nsSVGUt
  #include "nsSVGForeignObjectFrame.h"
  #include "nsIFontMetrics.h"
  #include "nsIDOMSVGUnitTypes.h"
 +
 +using namespace mozilla;
  
  static PRBool AddEffectProperties(nsIFrame *aFrame);
  
-@@ -1353,11 +1355,12 @@
+@@ -1390,11 +1392,12 @@ nsSVGUtils::PaintChildWithEffects(nsSVGR
  
    gfx->PopGroupToSource();
  
 -  nsRefPtr<gfxPattern> maskSurface =
 -    maskFrame ? maskFrame->ComputeMaskAlpha(aContext, svgChildFrame,
 -                                            matrix, opacity) : nsnull;
 +  RefPtr<gfxPattern> maskSurface;
 +  if (maskFrame)
 +    maskSurface = maskFrame->ComputeMaskAlpha(aContext, svgChildFrame,
 +                                              matrix, opacity);
  
 -  nsRefPtr<gfxPattern> clipMaskSurface;
 +  RefPtr<gfxPattern> clipMaskSurface;
    if (clipPathFrame && !isTrivialClip) {
      gfx->PushGroup(gfxASurface::CONTENT_COLOR_ALPHA);
  
-@@ -1543,13 +1546,13 @@
+@@ -1580,13 +1583,13 @@ nsSVGUtils::GetThebesComputationalSurfac
  nsSVGUtils::GetThebesComputationalSurface()
  {
    if (!mThebesComputationalSurface) {
 -    nsRefPtr<gfxImageSurface> surface =
 +    RefPtr<gfxImageSurface> surface =
        new gfxImageSurface(gfxIntSize(1, 1), gfxASurface::ImageFormatARGB32);
      NS_ASSERTION(surface && !surface->CairoStatus(),
                   "Could not create offscreen surface");
@@ -3869,17 +3874,17 @@ diff --git a/layout/xul/base/src/nsTextB
  #include "nsBidiUtils.h"
  #include "nsBidiPresUtils.h"
  #endif // IBMBIDI
 +
 +using namespace mozilla;
  
  #define CROP_LEFT   "left"
  #define CROP_RIGHT  "right"
-@@ -451,7 +453,7 @@
+@@ -450,7 +452,7 @@ nsTextBoxFrame::PaintTitle(nsIRenderingC
  
      nscoord baseline =
        presContext->RoundAppUnitsToNearestDevPixels(textRect.y + ascent);
 -    nsRefPtr<gfxContext> ctx = aRenderingContext.ThebesContext();
 +    RefPtr<gfxContext> ctx = aRenderingContext.ThebesContext();
      gfxPoint pt(presContext->AppUnitsToGfxUnits(textRect.x),
                  presContext->AppUnitsToGfxUnits(textRect.y));
      gfxFloat width = presContext->AppUnitsToGfxUnits(textRect.width);
@@ -3890,35 +3895,35 @@ diff --git a/modules/libpr0n/src/imgCont
  #include "prenv.h"
  
  #include "gfxContext.h"
 +
 +using namespace mozilla;
  
  /* Accounting for compressed data */
  #if defined(PR_LOGGING)
-@@ -977,7 +979,7 @@
+@@ -977,7 +979,7 @@ void imgContainer::ClearFrame(gfxIImageF
      return;
  
    nsCOMPtr<nsIImage> img(do_GetInterface(aFrame));
 -  nsRefPtr<gfxASurface> surf;
 +  RefPtr<gfxASurface> surf;
  
    img->LockImagePixels(0);
    img->GetSurface(getter_AddRefs(surf));
-@@ -997,7 +999,7 @@
+@@ -997,7 +999,7 @@ void imgContainer::ClearFrame(gfxIImageF
    }
  
    nsCOMPtr<nsIImage> img(do_GetInterface(aFrame));
 -  nsRefPtr<gfxASurface> surf;
 +  RefPtr<gfxASurface> surf;
  
    img->LockImagePixels(0);
    img->GetSurface(getter_AddRefs(surf));
-@@ -1129,11 +1131,11 @@
+@@ -1129,11 +1131,11 @@ nsresult imgContainer::DrawFrameTo(gfxII
    }
  
    nsCOMPtr<nsIImage> srcImg(do_GetInterface(aSrc));
 -  nsRefPtr<gfxPattern> srcPatt;
 +  RefPtr<gfxPattern> srcPatt;
    srcImg->GetPattern(getter_AddRefs(srcPatt));
  
    nsCOMPtr<nsIImage> dstImg(do_GetInterface(aDst));
@@ -3933,26 +3938,26 @@ diff --git a/modules/libpr0n/src/imgTool
 @@ -55,6 +55,7 @@
  #include "nsWeakReference.h"
  #include "nsIInterfaceRequestorUtils.h"
  
 +using namespace mozilla;
  
  /* ========== Utility classes ========== */
  
-@@ -298,7 +299,7 @@
+@@ -298,7 +299,7 @@ NS_IMETHODIMP imgTools::EncodeScaledImag
      return NS_ERROR_FAILURE;
  
    nsCOMPtr<nsIImage> img(do_GetInterface(frame));
 -  nsRefPtr<gfxImageSurface> dest;
 +  RefPtr<gfxImageSurface> dest;
  
    if (!doScaling) {
      // If we're not scaling the image, use the actual width/height.
-@@ -319,7 +320,7 @@
+@@ -319,7 +320,7 @@ NS_IMETHODIMP imgTools::EncodeScaledImag
      // Prepare to draw a scaled version of the image to a temporary surface...
  
      // Get the source image surface
 -    nsRefPtr<gfxPattern> gfxpat;
 +    RefPtr<gfxPattern> gfxpat;
      img->GetPattern(getter_AddRefs(gfxpat));
  
      // Create a temporary image surface
@@ -3963,17 +3968,17 @@ diff --git a/view/src/nsViewManager.cpp 
  #include "gfxContext.h"
  #define NS_STATIC_FOCUS_SUPPRESSOR
  #include "nsIFocusEventSuppressor.h"
 +
 +using namespace mozilla;
  
  static NS_DEFINE_IID(kBlenderCID, NS_BLENDER_CID);
  static NS_DEFINE_IID(kRegionCID, NS_REGION_CID);
-@@ -484,7 +486,7 @@
+@@ -484,7 +486,7 @@ void nsViewManager::Refresh(nsView *aVie
  
      PRInt32 p2a = mContext->AppUnitsPerDevPixel();
  
 -    nsRefPtr<gfxContext> ctx = localcx->ThebesContext();
 +    RefPtr<gfxContext> ctx = localcx->ThebesContext();
  
      ctx->Save();
  
@@ -3990,81 +3995,81 @@ diff --git a/widget/src/cocoa/nsChildVie
  
  #import <Carbon/Carbon.h>
  #import <Cocoa/Cocoa.h>
  
 -class gfxASurface;
  class nsChildView;
  union nsPluginPort;
  
-@@ -357,7 +357,7 @@
+@@ -394,7 +394,7 @@ protected:
    nsWeakPtr             mAccessible;
  #endif
  
 -  nsRefPtr<gfxASurface> mTempThebesSurface;
 +  RefPtr<gfxASurface> mTempThebesSurface;
  
    PRPackedBool          mVisible;
    PRPackedBool          mDrawing;
 diff --git a/widget/src/cocoa/nsChildView.mm b/widget/src/cocoa/nsChildView.mm
 --- a/widget/src/cocoa/nsChildView.mm
 +++ b/widget/src/cocoa/nsChildView.mm
-@@ -2509,7 +2509,7 @@
+@@ -2495,7 +2495,7 @@ NSEvent* gLastDragEvent = nil;
    mGeckoChild->GetBounds(geckoBounds);
  
    NSRect bounds = [self bounds];
 -  nsRefPtr<gfxQuartzSurface> targetSurface =
 +  RefPtr<gfxQuartzSurface> targetSurface =
      new gfxQuartzSurface(cgContext, gfxSize(bounds.size.width, bounds.size.height));
  
  #ifdef DEBUG_UPDATE
-@@ -2522,7 +2522,7 @@
+@@ -2508,7 +2508,7 @@ NSEvent* gLastDragEvent = nil;
    fprintf (stderr, "  xform in: [%f %f %f %f %f %f]\n", xform.a, xform.b, xform.c, xform.d, xform.tx, xform.ty);
  #endif
  
 -  nsRefPtr<gfxContext> targetContext = new gfxContext(targetSurface);
 +  RefPtr<gfxContext> targetContext = new gfxContext(targetSurface);
  
    nsCOMPtr<nsIRenderingContext> rc;
    mGeckoChild->GetDeviceContext()->CreateRenderingContextInstance(*getter_AddRefs(rc));
 diff --git a/widget/src/cocoa/nsDeviceContextSpecX.mm b/widget/src/cocoa/nsDeviceContextSpecX.mm
 --- a/widget/src/cocoa/nsDeviceContextSpecX.mm
 +++ b/widget/src/cocoa/nsDeviceContextSpecX.mm
-@@ -210,7 +210,7 @@
+@@ -210,7 +210,7 @@ NS_IMETHODIMP nsDeviceContextSpecX::GetS
      CGContextRef context;
      ::PMSessionGetCGGraphicsContext(mPrintSession, &context);
  
 -    nsRefPtr<gfxASurface> newSurface;
 +    RefPtr<gfxASurface> newSurface;
  
      if (context) {
          // Initially, origin is at bottom-left corner of the paper.
-@@ -225,8 +225,7 @@
+@@ -225,8 +225,7 @@ NS_IMETHODIMP nsDeviceContextSpecX::GetS
      if (!newSurface)
          return NS_ERROR_FAILURE;
  
 -    *surface = newSurface;
 -    NS_ADDREF(*surface);
 +    *surface = do_AddRef(newSurface).get();
  
      return NS_OK;
  
 diff --git a/widget/src/cocoa/nsDragService.mm b/widget/src/cocoa/nsDragService.mm
 --- a/widget/src/cocoa/nsDragService.mm
 +++ b/widget/src/cocoa/nsDragService.mm
-@@ -170,7 +170,7 @@
+@@ -170,7 +170,7 @@ nsDragService::ConstructDragImage(nsIDOM
    if ([[NSScreen screens] count] > 0)
      screenPoint.y = NSMaxY([[[NSScreen screens] objectAtIndex:0] frame]) - screenPoint.y;
  
 -  nsRefPtr<gfxASurface> surface;
 +  RefPtr<gfxASurface> surface;
    nsPresContext* pc;
    nsresult rv = DrawDrag(aDOMNode, aRegion,
                           NSToIntRound(screenPoint.x), NSToIntRound(screenPoint.y),
-@@ -186,12 +186,12 @@
+@@ -186,12 +186,12 @@ nsDragService::ConstructDragImage(nsIDOM
    PRUint32 width = aDragRect->width;
    PRUint32 height = aDragRect->height;
  
 -  nsRefPtr<gfxImageSurface> imgSurface = new gfxImageSurface(
 +  RefPtr<gfxImageSurface> imgSurface = new gfxImageSurface(
      gfxIntSize(width, height), gfxImageSurface::ImageFormatARGB32);
    if (!imgSurface)
      return nil;
@@ -4072,17 +4077,17 @@ diff --git a/widget/src/cocoa/nsDragServ
 -  nsRefPtr<gfxContext> context = new gfxContext(imgSurface);
 +  RefPtr<gfxContext> context = new gfxContext(imgSurface);
    if (!context)
      return nil;
  
 diff --git a/widget/src/cocoa/nsNativeThemeCocoa.mm b/widget/src/cocoa/nsNativeThemeCocoa.mm
 --- a/widget/src/cocoa/nsNativeThemeCocoa.mm
 +++ b/widget/src/cocoa/nsNativeThemeCocoa.mm
-@@ -994,7 +994,7 @@
+@@ -998,7 +998,7 @@ nsNativeThemeCocoa::DrawWidgetBackground
    nativeWidgetRect.ScaleInverse(gfxFloat(p2a));
    nativeClipRect.ScaleInverse(gfxFloat(p2a));
  
 -  nsRefPtr<gfxContext> thebesCtx = aContext->ThebesContext();
 +  RefPtr<gfxContext> thebesCtx = aContext->ThebesContext();
    if (!thebesCtx)
      return NS_ERROR_FAILURE;
  
@@ -4093,26 +4098,26 @@ diff --git a/widget/src/gtk2/nsDeviceCon
  #include <unistd.h>
  #include <sys/types.h>
  #include <sys/stat.h>
 +
 +using namespace mozilla;
  
  /* Ensure that the result is always equal to either PR_TRUE or PR_FALSE */
  #define MAKE_PR_BOOL(val) ((val)?(PR_TRUE):(PR_FALSE))
-@@ -452,7 +454,7 @@
+@@ -463,7 +465,7 @@ NS_IMETHODIMP nsDeviceContextSpecGTK::Ge
    PRInt16 format;
    mPrintSettings->GetOutputFormat(&format);
  
 -  nsRefPtr<gfxASurface> surface;
 +  RefPtr<gfxASurface> surface;
    gfxSize surfaceSize(width, height);
  
    // Determine the real format with some GTK magic
-@@ -483,7 +485,7 @@
+@@ -494,7 +496,7 @@ NS_IMETHODIMP nsDeviceContextSpecGTK::Ge
    if (!surface)
      return NS_ERROR_OUT_OF_MEMORY;
  
 -  surface.swap(*aSurface);
 +  *aSurface = surface.forget().get();
  
    return NS_OK;
  }
@@ -4123,17 +4128,17 @@ diff --git a/widget/src/gtk2/nsDragServi
  #include "nsPresContext.h"
  #include "nsIDocument.h"
  #include "nsISelection.h"
 +
 +using namespace mozilla;
  
  static PRLogModuleInfo *sDragLm = NULL;
  
-@@ -206,7 +208,7 @@
+@@ -206,7 +208,7 @@ nsDragService::InvokeDragSession(nsIDOMN
          nsRect dragRect;
          nsPresContext* pc;
          if (mHasImage || mSelection) {
 -          nsRefPtr<gfxASurface> surface;
 +          RefPtr<gfxASurface> surface;
            DrawDrag(aDOMNode, aRegion, mScreenX, mScreenY,
                     &dragRect, getter_AddRefs(surface), &pc);
            if (surface) {
@@ -4144,93 +4149,93 @@ diff --git a/widget/src/gtk2/nsImageToPi
  
  #include "nsImageToPixbuf.h"
  
 +using namespace mozilla;
 +
  NS_IMPL_ISUPPORTS1(nsImageToPixbuf, nsIImageToPixbuf)
  
  inline unsigned char
-@@ -71,7 +73,7 @@
+@@ -71,7 +73,7 @@ nsImageToPixbuf::ImageToPixbuf(nsIImage*
      PRInt32 width = aImage->GetWidth(),
              height = aImage->GetHeight();
  
 -    nsRefPtr<gfxPattern> pattern;
 +    RefPtr<gfxPattern> pattern;
      aImage->GetPattern(getter_AddRefs(pattern));
  
      return PatternToPixbuf(pattern, width, height);
-@@ -136,7 +138,7 @@
+@@ -136,7 +138,7 @@ nsImageToPixbuf::SurfaceToPixbuf(gfxASur
          return nsnull;
      }
  
 -    nsRefPtr<gfxImageSurface> imgSurface;
 +    RefPtr<gfxImageSurface> imgSurface;
      if (aSurface->GetType() == gfxASurface::SurfaceTypeImage) {
          imgSurface = static_cast<gfxImageSurface*>
                                  (static_cast<gfxASurface*>(aSurface));
-@@ -147,7 +149,7 @@
+@@ -147,7 +149,7 @@ nsImageToPixbuf::SurfaceToPixbuf(gfxASur
          if (!imgSurface)
              return nsnull;
  
 -        nsRefPtr<gfxContext> context = new gfxContext(imgSurface);
 +        RefPtr<gfxContext> context = new gfxContext(imgSurface);
          if (!context)
              return nsnull;
  
-@@ -167,9 +169,9 @@
+@@ -167,9 +169,9 @@ nsImageToPixbuf::PatternToPixbuf(gfxPatt
          return nsnull;
      }
  
 -    nsRefPtr<gfxImageSurface> imgSurface;
 +    RefPtr<gfxImageSurface> imgSurface;
      if (aPattern->GetType() == gfxPattern::PATTERN_SURFACE) {
 -        nsRefPtr<gfxASurface> surface = aPattern->GetSurface();
 +        RefPtr<gfxASurface> surface = aPattern->GetSurface();
          if (surface->GetType() == gfxASurface::SurfaceTypeImage) {
              imgSurface = static_cast<gfxImageSurface*>
                                      (static_cast<gfxASurface*>(surface.get()));
-@@ -183,7 +185,7 @@
+@@ -183,7 +185,7 @@ nsImageToPixbuf::PatternToPixbuf(gfxPatt
          if (!imgSurface)
              return nsnull;
  
 -        nsRefPtr<gfxContext> context = new gfxContext(imgSurface);
 +        RefPtr<gfxContext> context = new gfxContext(imgSurface);
          if (!context)
              return nsnull;
  
 diff --git a/widget/src/gtk2/nsWindow.cpp b/widget/src/gtk2/nsWindow.cpp
 --- a/widget/src/gtk2/nsWindow.cpp
 +++ b/widget/src/gtk2/nsWindow.cpp
-@@ -116,6 +116,8 @@
+@@ -116,6 +116,8 @@ static const char sAccessibilityKey [] =
  #include "gfxGlitzSurface.h"
  #include "glitz-glx.h"
  #endif
 +
 +using namespace mozilla;
  
  /* For PrepareNativeWidget */
  static NS_DEFINE_IID(kDeviceContextCID, NS_DEVICE_CONTEXT_CID);
-@@ -1677,13 +1679,13 @@
+@@ -1677,13 +1679,13 @@ nsWindow::OnExposeEvent(GtkWidget *aWidg
      GetHasTransparentBackground(translucent);
      nsIntRect boundsRect;
      GdkPixmap* bufferPixmap = nsnull;
 -    nsRefPtr<gfxXlibSurface> bufferPixmapSurface;
 +    RefPtr<gfxXlibSurface> bufferPixmapSurface;
  
      updateRegion->GetBoundingBox(&boundsRect.x, &boundsRect.y,
                                   &boundsRect.width, &boundsRect.height);
  
      // do double-buffering and clipping here
 -    nsRefPtr<gfxContext> ctx = rc->ThebesContext();
 +    RefPtr<gfxContext> ctx = rc->ThebesContext();
      ctx->Save();
      ctx->NewPath();
      if (translucent) {
-@@ -1767,18 +1769,18 @@
+@@ -1767,18 +1769,18 @@ nsWindow::OnExposeEvent(GtkWidget *aWidg
      if (NS_LIKELY(!mIsDestroyed)) {
          if (status != nsEventStatus_eIgnore) {
              if (translucent) {
 -                nsRefPtr<gfxPattern> pattern = ctx->PopGroup();
 +                RefPtr<gfxPattern> pattern = ctx->PopGroup();
                  ctx->SetOperator(gfxContext::OPERATOR_SOURCE);
                  ctx->SetPattern(pattern);
                  ctx->Paint();
@@ -4256,60 +4261,60 @@ diff --git a/widget/src/gtk2/nsWindow.h 
  
 -#include "nsAutoPtr.h"
 -
  #include "nsCommonWidget.h"
 +#include "gfxTypes.h"
  
  #include "mozcontainer.h"
  #include "mozdrawingarea.h"
-@@ -385,7 +384,7 @@
+@@ -385,7 +384,7 @@ private:
      PRInt32             mTransparencyBitmapWidth;
      PRInt32             mTransparencyBitmapHeight;
  
 -    nsRefPtr<gfxASurface> mThebesSurface;
 +    mozilla::RefPtr<gfxASurface> mThebesSurface;
  
  #ifdef ACCESSIBILITY
      nsCOMPtr<nsIAccessible> mRootAccessible;
 diff --git a/widget/src/windows/nsDeviceContextSpecWin.cpp b/widget/src/windows/nsDeviceContextSpecWin.cpp
 --- a/widget/src/windows/nsDeviceContextSpecWin.cpp
 +++ b/widget/src/windows/nsDeviceContextSpecWin.cpp
-@@ -516,7 +516,7 @@
+@@ -516,7 +516,7 @@ NS_IMETHODIMP nsDeviceContextSpecWin::Ge
  {
    NS_ASSERTION(mDevMode, "DevMode can't be NULL here");
  
 -  nsRefPtr<gfxASurface> newSurface;
 +  RefPtr<gfxASurface> newSurface;
  
    PRInt16 outputFormat;
    mPrintSettings->GetOutputFormat(&outputFormat);
-@@ -552,8 +552,7 @@
+@@ -552,8 +552,7 @@ NS_IMETHODIMP nsDeviceContextSpecWin::Ge
    }
  
    if (newSurface) {
 -    *surface = newSurface;
 -    NS_ADDREF(*surface);
 +    *surface = newSurface.forget().get();
      return NS_OK;
    }
  
 diff --git a/widget/src/windows/nsDragService.cpp b/widget/src/windows/nsDragService.cpp
 --- a/widget/src/windows/nsDragService.cpp
 +++ b/widget/src/windows/nsDragService.cpp
-@@ -110,7 +110,7 @@
+@@ -110,7 +110,7 @@ nsDragService::CreateDragImage(nsIDOMNod
  
    // Prepare the drag image
    nsRect dragRect;
 -  nsRefPtr<gfxASurface> surface;
 +  RefPtr<gfxASurface> surface;
    nsPresContext* pc;
    DrawDrag(aDOMNode, aRegion,
             mScreenX, mScreenY,
-@@ -125,13 +125,13 @@
+@@ -125,13 +125,13 @@ nsDragService::CreateDragImage(nsIDOMNod
  
    psdi->crColorKey = CLR_NONE;
  
 -  nsRefPtr<gfxImageSurface> imgSurface = new gfxImageSurface(
 +  RefPtr<gfxImageSurface> imgSurface = new gfxImageSurface(
      gfxIntSize(bmWidth, bmHeight), 
      gfxImageSurface::ImageFormatARGB32);
    if (!imgSurface)
@@ -4318,38 +4323,38 @@ diff --git a/widget/src/windows/nsDragSe
 -  nsRefPtr<gfxContext> context = new gfxContext(imgSurface);
 +  RefPtr<gfxContext> context = new gfxContext(imgSurface);
    if (!context)
      return PR_FALSE;
  
 diff --git a/widget/src/windows/nsNativeThemeWin.cpp b/widget/src/windows/nsNativeThemeWin.cpp
 --- a/widget/src/windows/nsNativeThemeWin.cpp
 +++ b/widget/src/windows/nsNativeThemeWin.cpp
-@@ -1239,7 +1239,7 @@
+@@ -1239,7 +1239,7 @@ nsNativeThemeWin::DrawWidgetBackground(n
      }
    }
  
 -  nsRefPtr<gfxContext> ctx = aContext->ThebesContext();
 +  RefPtr<gfxContext> ctx = aContext->ThebesContext();
  
    gfxWindowsNativeDrawing nativeDrawing(ctx, cr, GetWidgetNativeDrawingFlags(aWidgetType));
  
-@@ -2654,7 +2654,7 @@
+@@ -2652,7 +2652,7 @@ nsresult nsNativeThemeWin::ClassicDrawWi
    tr.ScaleInverse(p2a);
    cr.ScaleInverse(p2a);
  
 -  nsRefPtr<gfxContext> ctx = aContext->ThebesContext();
 +  RefPtr<gfxContext> ctx = aContext->ThebesContext();
  
    gfxWindowsNativeDrawing nativeDrawing(ctx, cr, GetWidgetNativeDrawingFlags(aWidgetType));
  
 diff --git a/widget/src/windows/nsWindow.cpp b/widget/src/windows/nsWindow.cpp
 --- a/widget/src/windows/nsWindow.cpp
 +++ b/widget/src/windows/nsWindow.cpp
-@@ -5543,17 +5543,17 @@
+@@ -5600,17 +5600,17 @@ PRBool nsWindow::OnPaint(HDC aDC)
  #endif // NS_DEBUG
  
  #ifdef MOZ_XUL
 -      nsRefPtr<gfxASurface> targetSurface;
 +      RefPtr<gfxASurface> targetSurface;
        if (mIsTransparent) {
          targetSurface = mTransparentSurface;
        } else {
@@ -4365,17 +4370,17 @@ diff --git a/widget/src/windows/nsWindow
 +
 +      RefPtr<gfxContext> thebesContext = new gfxContext(targetSurface);
  
  #ifdef MOZ_XUL
        if (mIsTransparent) {
 diff --git a/widget/src/windows/nsWindow.h b/widget/src/windows/nsWindow.h
 --- a/widget/src/windows/nsWindow.h
 +++ b/widget/src/windows/nsWindow.h
-@@ -408,7 +408,7 @@
+@@ -412,7 +412,7 @@ protected:
  
  #ifdef MOZ_XUL
    // use layered windows to support full 256 level alpha translucency
 -  nsRefPtr<gfxWindowsSurface> mTransparentSurface;
 +  RefPtr<gfxWindowsSurface> mTransparentSurface;
  
    HDC           mMemoryDC;
    HBITMAP       mMemoryBitmap;
@@ -4386,51 +4391,51 @@ diff --git a/widget/src/xpwidgets/nsBase
  
  #include "gfxContext.h"
  #include "gfxImageSurface.h"
 +
 +using namespace mozilla;
  
  #define DRAGIMAGES_PREF "nglayout.enable_drag_images"
  
-@@ -445,9 +447,9 @@
+@@ -445,9 +447,9 @@ nsBaseDragService::DrawDrag(nsIDOMNode* 
    // draw the image for selections
    if (mSelection) {
      nsPoint pnt(aScreenDragRect->x, aScreenDragRect->y);
 -    nsRefPtr<gfxASurface> surface = presShell->RenderSelection(mSelection, pnt, aScreenDragRect);
 -    *aSurface = surface;
 -    NS_IF_ADDREF(*aSurface);
 +
 +    *aSurface = presShell->
 +      RenderSelection(mSelection, pnt, aScreenDragRect).get();
      return NS_OK;
    }
  
-@@ -469,8 +471,8 @@
+@@ -469,8 +471,8 @@ nsBaseDragService::DrawDrag(nsIDOMNode* 
      aRegion->GetRegion(getter_AddRefs(clipRegion));
  
    nsPoint pnt(aScreenDragRect->x, aScreenDragRect->y);
 -  nsRefPtr<gfxASurface> surface = presShell->RenderNode(dragNode, clipRegion,
 -                                                        pnt, aScreenDragRect);
 +  RefPtr<gfxASurface> surface = presShell->RenderNode(dragNode, clipRegion,
 +                                                         pnt, aScreenDragRect);
  
    // if an image was specified, reposition the drag rectangle to
    // the supplied offset in mImageX and mImageY.
-@@ -479,8 +481,7 @@
+@@ -479,8 +481,7 @@ nsBaseDragService::DrawDrag(nsIDOMNode* 
      aScreenDragRect->y = aScreenY - mImageY;
    }
  
 -  *aSurface = surface;
 -  NS_IF_ADDREF(*aSurface);
 +  *aSurface = surface.forget().get();
  
    return NS_OK;
  }
-@@ -548,14 +549,14 @@
+@@ -548,14 +549,14 @@ nsBaseDragService::DrawDragForImage(nsPr
      aScreenDragRect->height = destRect.height;
    }
  
 -  nsRefPtr<gfxImageSurface> surface =
 +  RefPtr<gfxImageSurface> surface =
      new gfxImageSurface(gfxIntSize(destRect.width, destRect.height),
                          gfxImageSurface::ImageFormatARGB32);
    if (!surface)
--- a/more-template-typedefs
+++ b/more-template-typedefs
@@ -1,12 +1,12 @@
 diff --git a/js/src/xpconnect/src/xpcprivate.h b/js/src/xpconnect/src/xpcprivate.h
 --- a/js/src/xpconnect/src/xpcprivate.h
 +++ b/js/src/xpconnect/src/xpcprivate.h
-@@ -511,7 +511,7 @@ private:
+@@ -532,7 +532,7 @@ private:
  #endif
  
  #ifndef XPCONNECT_STANDALONE
 -    typedef nsBaseHashtable<nsVoidPtrHashKey, nsISupports*, nsISupports*> ScopeSet;
 +    typedef nsBaseHashtable<nsVoidPtrHashKey, nsISupports*, nsISupports*, CAllocator> ScopeSet;
      ScopeSet mScopes;
  #endif
- };
+     static PRUint32 gReportAllJSExceptions;
--- a/mozAutoDocUpdate
+++ b/mozAutoDocUpdate
@@ -1,21 +1,25 @@
 diff --git a/content/base/public/nsIDocument.h b/content/base/public/nsIDocument.h
 --- a/content/base/public/nsIDocument.h
 +++ b/content/base/public/nsIDocument.h
-@@ -1001,6 +1001,8 @@ public:
-     mDocument(aNotify ? aDocument : nsnull),
-     mUpdateType(aUpdateType)
-   {
-+    ASSERT_StackObject(this);
-+
-     if (mDocument) {
-       mDocument->BeginUpdate(mUpdateType);
-     }
-@@ -1014,7 +1016,7 @@ public:
+@@ -1065,7 +1065,9 @@ NS_DEFINE_STATIC_IID_ACCESSOR(nsIDocumen
+  * event is dispatched, if necessary, when the outermost mozAutoSubtreeModified
+  * object is deleted.
+  */
+-class mozAutoSubtreeModified
++class
++  NS_STACK_CLASS
++mozAutoSubtreeModified
+ {
+ public:
+   /**
+@@ -1098,8 +1100,8 @@ public:
    }
  
  private:
--  nsCOMPtr<nsIDocument> mDocument;
-+  nsIDocument* mDocument;
-   nsUpdateType mUpdateType;
+-  nsCOMPtr<nsINode>     mTarget;
+-  nsCOMPtr<nsIDocument> mSubtreeOwner;
++  nsINode*     mTarget;
++  nsIDocument* mSubtreeOwner;
  };
  
+ // XXX These belong somewhere else
deleted file mode 100644
--- a/no-attributes-configure-check
+++ /dev/null
@@ -1,21 +0,0 @@
-diff --git a/configure.in b/configure.in
---- a/configure.in
-+++ b/configure.in
-@@ -1296,6 +1296,17 @@
-         # don't use -Wcast-align on ia64 or sparc, it's noisy on those platforms
-         # icc doesn't support this flag.
-         _WARNINGS_CFLAGS="${_WARNINGS_CFLAGS} -Wcast-align"
-+    fi
-+
-+    _SAVE_CFLAGS=$CFLAGS
-+    CFLAGS="$CFLAGS -Wno-attributes"
-+    AC_TRY_COMPILE([$no_attributes_flag],
-+                   [void test();],
-+                   ac_cv_no_attributes_flag="yes",
-+                   ac_cv_no_attributes_flag="no")
-+    CFLAGS=$_SAVE_CFLAGS
-+    if test "$ac_cv_no_attributes_flag" = "yes"; then
-+        _WARNINGS_CFLAGS="${_WARNINGS_CFLAGS} -Wno-attributes"
-     fi
- 
-     dnl Turn pedantic on but disable the warnings for long long
--- a/nsSlots
+++ b/nsSlots
@@ -1,37 +1,37 @@
 * * *
 
 diff --git a/content/base/public/nsINode.h b/content/base/public/nsINode.h
 --- a/content/base/public/nsINode.h
 +++ b/content/base/public/nsINode.h
-@@ -556,7 +556,7 @@ public:
+@@ -558,7 +558,7 @@ public:
  
    // This class can be extended by subclasses that wish to store more
    // information in the slots.
 -  class nsSlots
 +  class nsSlots : public XPCOMGCObject
    {
    public:
      nsSlots(PtrBits aFlags)
-@@ -565,10 +565,6 @@ public:
+@@ -567,10 +567,6 @@ public:
          mWeakReference(nsnull)
      {
      }
 -
 -    // If needed we could remove the vtable pointer this dtor causes by
 -    // putting a DestroySlots function on nsINode
 -    virtual ~nsSlots();
  
      /**
       * Storage for flags for this node. These are the same flags as the
 diff --git a/content/base/src/nsGenericElement.cpp b/content/base/src/nsGenericElement.cpp
 --- a/content/base/src/nsGenericElement.cpp
 +++ b/content/base/src/nsGenericElement.cpp
-@@ -162,20 +162,6 @@ nsresult NS_NewContentIterator(nsIConten
+@@ -164,20 +164,6 @@ nsresult NS_NewContentIterator(nsIConten
  
  //----------------------------------------------------------------------
  
 -nsINode::nsSlots::~nsSlots()
 -{
 -  if (mChildNodes) {
 -    mChildNodes->DropReference();
 -    NS_RELEASE(mChildNodes);
@@ -42,135 +42,135 @@ diff --git a/content/base/src/nsGenericE
 -  }
 -}
 -
 -//----------------------------------------------------------------------
 -
  nsINode::~nsINode()
  {
    NS_ASSERTION(!HasSlots(), "nsNodeUtils::LastRelease was not called?");
-@@ -245,8 +231,8 @@ nsGenericElement::AddEventListenerByIID(
+@@ -247,8 +233,8 @@ nsGenericElement::AddEventListenerByIID(
  nsGenericElement::AddEventListenerByIID(nsIDOMEventListener *aListener,
                                         const nsIID& aIID)
  {
 -  nsCOMPtr<nsIEventListenerManager> elm;
 -  nsresult rv = GetListenerManager(PR_TRUE, getter_AddRefs(elm));
 +  nsIEventListenerManager* elm = nsnull;
 +  nsresult rv = GetListenerManager(PR_TRUE, &elm);
    if (elm) {
      return elm->AddEventListenerByIID(aListener, aIID, NS_EVENT_FLAG_BUBBLE);
    }
-@@ -257,8 +243,8 @@ nsGenericElement::RemoveEventListenerByI
+@@ -259,8 +245,8 @@ nsGenericElement::RemoveEventListenerByI
  nsGenericElement::RemoveEventListenerByIID(nsIDOMEventListener *aListener,
                                             const nsIID& aIID)
  {
 -  nsCOMPtr<nsIEventListenerManager> elm;
 -  GetListenerManager(PR_FALSE, getter_AddRefs(elm));
 +  nsIEventListenerManager* elm = nsnull;
 +  GetListenerManager(PR_FALSE, &elm);
    if (elm) {
      return elm->RemoveEventListenerByIID(aListener, aIID, NS_EVENT_FLAG_BUBBLE);
    }
-@@ -268,8 +254,8 @@ nsresult
+@@ -270,8 +256,8 @@ nsresult
  nsresult
  nsGenericElement::GetSystemEventGroup(nsIDOMEventGroup** aGroup)
  {
 -  nsCOMPtr<nsIEventListenerManager> elm;
 -  nsresult rv = GetListenerManager(PR_TRUE, getter_AddRefs(elm));
 +  nsIEventListenerManager* elm = nsnull;
 +  nsresult rv = GetListenerManager(PR_TRUE, &elm);
    if (elm) {
      return elm->GetSystemEventGroupLM(aGroup);
    }
-@@ -501,7 +487,7 @@ NS_IMETHODIMP
+@@ -490,7 +476,7 @@ NS_IMETHODIMP
  NS_IMETHODIMP
  nsNode3Tearoff::GetBaseURI(nsAString& aURI)
  {
 -  nsCOMPtr<nsIURI> baseURI = mContent->GetBaseURI();
 +  nsIURI* baseURI = mContent->GetBaseURI();
    nsCAutoString spec;
  
    if (baseURI) {
-@@ -516,7 +502,7 @@ NS_IMETHODIMP
+@@ -505,7 +491,7 @@ NS_IMETHODIMP
  NS_IMETHODIMP
  nsNode3Tearoff::GetTextContent(nsAString &aTextContent)
  {
 -  nsCOMPtr<nsIDOMNode> node(do_QueryInterface(mContent));
 +  nsIDOMNode* node(do_QueryInterface(mContent));
    NS_ASSERTION(node, "We have an nsIContent which doesn't support nsIDOMNode");
  
    PRUint16 nodeType;
-@@ -546,7 +532,7 @@ nsNode3Tearoff::SetTextContent(const nsA
+@@ -535,7 +521,7 @@ nsNode3Tearoff::SetTextContent(const nsA
    // Batch possible DOMSubtreeModified events.
    mozAutoSubtreeModified subtree(mContent->GetOwnerDoc(), nsnull);
  
 -  nsCOMPtr<nsIDOMNode> node(do_QueryInterface(mContent));
 +  nsIDOMNode* node(do_QueryInterface(mContent));
    NS_ASSERTION(node, "We have an nsIContent which doesn't support nsIDOMNode");
  
    PRUint16 nodeType;
-@@ -572,7 +558,7 @@ nsNode3Tearoff::CompareDocumentPosition(
+@@ -561,7 +547,7 @@ nsNode3Tearoff::CompareDocumentPosition(
  {
    NS_ENSURE_ARG_POINTER(aOther);
  
 -  nsCOMPtr<nsINode> other = do_QueryInterface(aOther);
 +  nsINode* other = do_QueryInterface(aOther);
    NS_ENSURE_TRUE(other, NS_ERROR_DOM_NOT_SUPPORTED_ERR);
  
    *aReturn = nsContentUtils::ComparePosition(other, mContent);
-@@ -583,7 +569,7 @@ nsNode3Tearoff::IsSameNode(nsIDOMNode* a
+@@ -572,7 +558,7 @@ nsNode3Tearoff::IsSameNode(nsIDOMNode* a
  nsNode3Tearoff::IsSameNode(nsIDOMNode* aOther,
                             PRBool* aReturn)
  {
 -  nsCOMPtr<nsIContent> other(do_QueryInterface(aOther));
 +  nsIContent* other(do_QueryInterface(aOther));
    *aReturn = mContent == other;
  
    return NS_OK;
-@@ -605,8 +591,8 @@ nsNode3Tearoff::AreNodesEqual(nsIContent
+@@ -594,8 +580,8 @@ nsNode3Tearoff::AreNodesEqual(nsIContent
    }
  
    if (aContent1->Tag() == nsGkAtoms::documentTypeNodeName) {
 -    nsCOMPtr<nsIDOMDocumentType> docType1 = do_QueryInterface(aContent1);
 -    nsCOMPtr<nsIDOMDocumentType> docType2 = do_QueryInterface(aContent2);
 +    nsIDOMDocumentType* docType1 = do_QueryInterface(aContent1);
 +    nsIDOMDocumentType* docType2 = do_QueryInterface(aContent2);
  
      NS_ASSERTION(docType1 && docType2, "Why don't we have a document type node?");
  
-@@ -662,8 +648,8 @@ nsNode3Tearoff::AreNodesEqual(nsIContent
+@@ -651,8 +637,8 @@ nsNode3Tearoff::AreNodesEqual(nsIContent
      }
    } else {
      // aContent1 is not an element.  Node value check.
 -    nsCOMPtr<nsIDOMNode> domNode1 = do_QueryInterface(aContent1);
 -    nsCOMPtr<nsIDOMNode> domNode2 = do_QueryInterface(aContent2);
 +    nsIDOMNode* domNode1 = do_QueryInterface(aContent1);
 +    nsIDOMNode* domNode2 = do_QueryInterface(aContent2);
      NS_ASSERTION(domNode1 && domNode2, "How'd we get nsIContent without nsIDOMNode?");
      domNode1->GetNodeValue(string1);
      domNode2->GetNodeValue(string2);
-@@ -698,7 +684,7 @@ nsNode3Tearoff::IsEqualNode(nsIDOMNode* 
+@@ -687,7 +673,7 @@ nsNode3Tearoff::IsEqualNode(nsIDOMNode* 
    *aReturn = PR_FALSE;
  
    // Since we implement nsIContent, aOther must as well.
 -  nsCOMPtr<nsIContent> aOtherContent = do_QueryInterface(aOther);
 +  nsIContent* aOtherContent = do_QueryInterface(aOther);
    // Documents and attributes don't implement nsIContent.
    if (!aOtherContent) {
      return NS_OK;
-@@ -851,7 +837,7 @@ nsNSElementTearoff::GetBoundingClientRec
+@@ -840,7 +826,7 @@ nsNSElementTearoff::GetBoundingClientRec
    if (!rect)
      return NS_ERROR_OUT_OF_MEMORY;
  
 -  NS_ADDREF(*aResult = rect);
 +  *aResult = rect;
    
    nsIFrame* frame = mContent->GetPrimaryFrame(Flush_Layout);
    if (!frame) {
-@@ -918,21 +904,16 @@ NS_IMPL_ISUPPORTS1(nsNodeWeakReference,
+@@ -907,21 +893,16 @@ NS_IMPL_ISUPPORTS1(nsNodeWeakReference,
  NS_IMPL_ISUPPORTS1(nsNodeWeakReference,
                     nsIWeakReference)
  
 -nsNodeWeakReference::~nsNodeWeakReference()
 -{
 -  if (mNode) {
 -    NS_ASSERTION(mNode->GetSlots() &&
 -                 mNode->GetSlots()->mWeakReference == this,
@@ -189,185 +189,185 @@ diff --git a/content/base/src/nsGenericE
 +    *aInstancePtr = nsnull;
 +    return NS_ERROR_NULL_POINTER;
 +  }
 +
 +  return node->QueryInterface(aIID, aInstancePtr);
  }
  
  
-@@ -956,7 +937,7 @@ nsNodeSupportsWeakRefTearoff::GetWeakRef
+@@ -945,7 +926,7 @@ nsNodeSupportsWeakRefTearoff::GetWeakRef
      NS_ENSURE_TRUE(slots->mWeakReference, NS_ERROR_OUT_OF_MEMORY);
    }
  
 -  NS_ADDREF(*aInstancePtr = slots->mWeakReference);
 +  *aInstancePtr = slots->mWeakReference;
  
    return NS_OK;
  }
-@@ -977,9 +958,9 @@ nsresult
+@@ -966,9 +947,9 @@ nsresult
  nsresult
  nsDOMEventRTTearoff::GetDOM3EventTarget(nsIDOM3EventTarget **aTarget)
  {
 -  nsCOMPtr<nsIEventListenerManager> listener_manager;
 +  nsIEventListenerManager* listener_manager = nsnull;
    nsresult rv =
 -    mContent->GetListenerManager(PR_TRUE, getter_AddRefs(listener_manager));
 +    mContent->GetListenerManager(PR_TRUE, &listener_manager);
    NS_ENSURE_SUCCESS(rv, rv);
  
    return CallQueryInterface(listener_manager, aTarget);
-@@ -1021,11 +1002,11 @@ NS_IMETHODIMP
+@@ -1010,11 +991,11 @@ NS_IMETHODIMP
  NS_IMETHODIMP
  nsDOMEventRTTearoff::DispatchEvent(nsIDOMEvent *aEvt, PRBool* _retval)
  {
 -  nsCOMPtr<nsIEventListenerManager> listener_manager;
 +  nsIEventListenerManager* listener_manager = nsnull;
    nsresult rv =
 -    mContent->GetListenerManager(PR_TRUE, getter_AddRefs(listener_manager));
 -  NS_ENSURE_SUCCESS(rv, rv);
 -  nsCOMPtr<nsIDOMEventTarget> target = do_QueryInterface(listener_manager);
 +    mContent->GetListenerManager(PR_TRUE, &listener_manager);
 +  NS_ENSURE_SUCCESS(rv, rv);
 +  nsIDOMEventTarget* target = do_QueryInterface(listener_manager);
    NS_ENSURE_STATE(target);
    return target->DispatchEvent(aEvt, _retval);
  }
-@@ -1037,8 +1018,8 @@ nsDOMEventRTTearoff::AddGroupedEventList
+@@ -1026,8 +1007,8 @@ nsDOMEventRTTearoff::AddGroupedEventList
                                               PRBool aUseCapture,
                                               nsIDOMEventGroup *aEvtGrp)
  {
 -  nsCOMPtr<nsIDOM3EventTarget> event_target;
 -  nsresult rv = GetDOM3EventTarget(getter_AddRefs(event_target));
 +  nsIDOM3EventTarget* event_target = nsnull;
 +  nsresult rv = GetDOM3EventTarget(&event_target);
    NS_ENSURE_SUCCESS(rv, rv);
  
    return event_target->AddGroupedEventListener(aType, aListener, aUseCapture,
-@@ -1051,8 +1032,8 @@ nsDOMEventRTTearoff::RemoveGroupedEventL
+@@ -1040,8 +1021,8 @@ nsDOMEventRTTearoff::RemoveGroupedEventL
                                                  PRBool aUseCapture,
                                                  nsIDOMEventGroup *aEvtGrp)
  {
 -  nsCOMPtr<nsIDOM3EventTarget> event_target;
 -  nsresult rv = GetDOM3EventTarget(getter_AddRefs(event_target));
 +  nsIDOM3EventTarget* event_target = nsnull;
 +  nsresult rv = GetDOM3EventTarget(&event_target);
    NS_ENSURE_SUCCESS(rv, rv);
  
    return event_target->RemoveGroupedEventListener(aType, aListener,
-@@ -1078,9 +1059,9 @@ nsDOMEventRTTearoff::AddEventListener(co
+@@ -1067,9 +1048,9 @@ nsDOMEventRTTearoff::AddEventListener(co
                                        PRBool aUseCapture,
                                        PRBool aWantsUntrusted)
  {
 -  nsCOMPtr<nsIEventListenerManager> listener_manager;
 +  nsIEventListenerManager* listener_manager = nsnull;
    nsresult rv =
 -    mContent->GetListenerManager(PR_TRUE, getter_AddRefs(listener_manager));
 +    mContent->GetListenerManager(PR_TRUE, &listener_manager);
    NS_ENSURE_SUCCESS(rv, rv);
  
    PRInt32 flags = aUseCapture ? NS_EVENT_FLAG_CAPTURE : NS_EVENT_FLAG_BUBBLE;
-@@ -1103,10 +1084,6 @@ nsGenericElement::nsDOMSlots::nsDOMSlots
+@@ -1092,10 +1073,6 @@ nsGenericElement::nsDOMSlots::nsDOMSlots
  {
  }
  
 -nsGenericElement::nsDOMSlots::~nsDOMSlots()
 -{
 -}
 -
  nsGenericElement::nsGenericElement(nsINodeInfo *aNodeInfo)
    : nsIContent(aNodeInfo)
  {
-@@ -1230,7 +1207,7 @@ nsGenericElement::SetPrefix(const nsAStr
+@@ -1219,7 +1196,7 @@ nsGenericElement::SetPrefix(const nsAStr
  {
    // XXX: Validate the prefix string!
  
 -  nsCOMPtr<nsIAtom> prefix;
 +  nsIAtom* prefix = nsnull;
  
    if (!aPrefix.IsEmpty()) {
      prefix = do_GetAtom(aPrefix);
-@@ -1242,9 +1219,9 @@ nsGenericElement::SetPrefix(const nsAStr
+@@ -1231,9 +1208,9 @@ nsGenericElement::SetPrefix(const nsAStr
      return NS_ERROR_DOM_NAMESPACE_ERR;
    }
  
 -  nsCOMPtr<nsINodeInfo> newNodeInfo;
 +  nsINodeInfo* newNodeInfo = nsnull;
    nsresult rv = nsContentUtils::PrefixChanged(mNodeInfo, prefix,
 -                                              getter_AddRefs(newNodeInfo));
 +                                              &newNodeInfo);
    NS_ENSURE_SUCCESS(rv, rv);
  
    mNodeInfo = newNodeInfo;
-@@ -1311,7 +1288,7 @@ nsGenericElement::InternalIsSupported(ns
+@@ -1300,7 +1277,7 @@ nsGenericElement::InternalIsSupported(ns
    }
  #endif /* MOZ_SVG */
    else {
 -    nsCOMPtr<nsIDOMNSFeatureFactory> factory =
 +    nsIDOMNSFeatureFactory* factory =
        GetDOMFeatureFactory(aFeature, aVersion);
  
      if (factory) {
-@@ -1328,7 +1305,7 @@ nsGenericElement::InternalGetFeature(nsI
+@@ -1317,7 +1294,7 @@ nsGenericElement::InternalGetFeature(nsI
                                      nsISupports** aReturn)
  {
    *aReturn = nsnull;
 -  nsCOMPtr<nsIDOMNSFeatureFactory> factory =
 +  nsIDOMNSFeatureFactory* factory =
      GetDOMFeatureFactory(aFeature, aVersion);
  
    if (factory) {
-@@ -1338,12 +1315,12 @@ nsGenericElement::InternalGetFeature(nsI
+@@ -1327,12 +1304,12 @@ nsGenericElement::InternalGetFeature(nsI
    return NS_OK;
  }
  
 -already_AddRefed<nsIDOMNSFeatureFactory>
 +nsIDOMNSFeatureFactory*
  nsGenericElement::GetDOMFeatureFactory(const nsAString& aFeature,
                                         const nsAString& aVersion)
  {
    nsIDOMNSFeatureFactory *factory = nsnull;
 -  nsCOMPtr<nsICategoryManager> categoryManager =
 +  nsICategoryManager* categoryManager =
      do_GetService(NS_CATEGORYMANAGER_CONTRACTID);
    if (categoryManager) {
      nsCAutoString featureCategory(NS_DOMNS_FEATURE_PREFIX);
-@@ -1398,7 +1375,7 @@ nsGenericElement::GetAttributes(nsIDOMNa
+@@ -1387,7 +1364,7 @@ nsGenericElement::GetAttributes(nsIDOMNa
      }
    }
  
 -  NS_ADDREF(*aAttributes = slots->mAttributeMap);
 +  *aAttributes = slots->mAttributeMap;
  
    return NS_OK;
  }
-@@ -1417,10 +1394,9 @@ nsGenericElement::GetChildNodes(nsIDOMNo
+@@ -1406,10 +1383,9 @@ nsGenericElement::GetChildNodes(nsIDOMNo
      if (!slots->mChildNodes) {
        return NS_ERROR_OUT_OF_MEMORY;
      }
 -    NS_ADDREF(slots->mChildNodes);
 -  }
 -
 -  NS_ADDREF(*aChildNodes = slots->mChildNodes);
 +  }
 +
 +  *aChildNodes = slots->mChildNodes;
  
    return NS_OK;
  }
-@@ -1501,7 +1477,7 @@ nsGenericElement::SetAttribute(const nsA
+@@ -1490,7 +1466,7 @@ nsGenericElement::SetAttribute(const nsA
      nsresult rv = nsContentUtils::CheckQName(aName, PR_FALSE);
      NS_ENSURE_SUCCESS(rv, rv);
  
 -    nsCOMPtr<nsIAtom> nameAtom = do_GetAtom(aName);
 +    nsIAtom* nameAtom = do_GetAtom(aName);
      NS_ENSURE_TRUE(nameAtom, NS_ERROR_OUT_OF_MEMORY);
  
      return SetAttr(kNameSpaceID_None, nameAtom, aValue, PR_TRUE);
-@@ -1535,12 +1511,12 @@ nsGenericElement::GetAttributeNode(const
+@@ -1524,12 +1500,12 @@ nsGenericElement::GetAttributeNode(const
    NS_ENSURE_ARG_POINTER(aReturn);
    *aReturn = nsnull;
  
 -  nsCOMPtr<nsIDOMNamedNodeMap> map;
 -  nsresult rv = GetAttributes(getter_AddRefs(map));
 -  NS_ENSURE_SUCCESS(rv, rv);
 -
 -  nsCOMPtr<nsIDOMNode> node;
@@ -376,17 +376,17 @@ diff --git a/content/base/src/nsGenericE
 +  nsresult rv = GetAttributes(&map);
 +  NS_ENSURE_SUCCESS(rv, rv);
 +
 +  nsIDOMNode* node = nsnull;
 +  rv = map->GetNamedItem(aName, &node);
  
    if (NS_SUCCEEDED(rv) && node) {
      rv = CallQueryInterface(node, aReturn);
-@@ -1558,12 +1534,12 @@ nsGenericElement::SetAttributeNode(nsIDO
+@@ -1547,12 +1523,12 @@ nsGenericElement::SetAttributeNode(nsIDO
  
    *aReturn = nsnull;
  
 -  nsCOMPtr<nsIDOMNamedNodeMap> map;
 -  nsresult rv = GetAttributes(getter_AddRefs(map));
 -  NS_ENSURE_SUCCESS(rv, rv);
 -
 -  nsCOMPtr<nsIDOMNode> returnNode;
@@ -395,17 +395,17 @@ diff --git a/content/base/src/nsGenericE
 +  nsresult rv = GetAttributes(&map);
 +  NS_ENSURE_SUCCESS(rv, rv);
 +
 +  nsIDOMNode* returnNode = nsnull;
 +  rv = map->SetNamedItem(aAttribute, &returnNode);
    NS_ENSURE_SUCCESS(rv, rv);
  
    if (returnNode) {
-@@ -1582,16 +1558,16 @@ nsGenericElement::RemoveAttributeNode(ns
+@@ -1571,16 +1547,16 @@ nsGenericElement::RemoveAttributeNode(ns
  
    *aReturn = nsnull;
  
 -  nsCOMPtr<nsIDOMNamedNodeMap> map;
 -  nsresult rv = GetAttributes(getter_AddRefs(map));
 +  nsIDOMNamedNodeMap* map = nsnull;
 +  nsresult rv = GetAttributes(&map);
    NS_ENSURE_SUCCESS(rv, rv);
@@ -416,63 +416,63 @@ diff --git a/content/base/src/nsGenericE
    if (NS_SUCCEEDED(rv)) {
 -    nsCOMPtr<nsIDOMNode> node;
 -    rv = map->RemoveNamedItem(name, getter_AddRefs(node));
 +    nsIDOMNode* node = nsnull;
 +    rv = map->RemoveNamedItem(name, &node);
  
      if (NS_SUCCEEDED(rv) && node) {
        rv = CallQueryInterface(node, aReturn);
-@@ -1605,11 +1581,11 @@ nsGenericElement::GetElementsByTagName(c
+@@ -1594,11 +1570,11 @@ nsGenericElement::GetElementsByTagName(c
  nsGenericElement::GetElementsByTagName(const nsAString& aTagname,
                                         nsIDOMNodeList** aReturn)
  {
 -  nsCOMPtr<nsIAtom> nameAtom = do_GetAtom(aTagname);
 +  nsIAtom* nameAtom = do_GetAtom(aTagname);
    NS_ENSURE_TRUE(nameAtom, NS_ERROR_OUT_OF_MEMORY);
  
    nsContentList *list = NS_GetContentList(this, nameAtom,
 -                                          kNameSpaceID_Unknown).get();
 +                                          kNameSpaceID_Unknown);
    NS_ENSURE_TRUE(list, NS_ERROR_OUT_OF_MEMORY);
  
    // transfer ref to aReturn
-@@ -1633,7 +1609,7 @@ nsGenericElement::GetAttributeNS(const n
+@@ -1622,7 +1598,7 @@ nsGenericElement::GetAttributeNS(const n
      return NS_OK;
    }
  
 -  nsCOMPtr<nsIAtom> name = do_GetAtom(aLocalName);
 +  nsIAtom* name = do_GetAtom(aLocalName);
    GetAttr(nsid, name, aReturn);
  
    return NS_OK;
-@@ -1644,11 +1620,11 @@ nsGenericElement::SetAttributeNS(const n
+@@ -1633,11 +1609,11 @@ nsGenericElement::SetAttributeNS(const n
                                   const nsAString& aQualifiedName,
                                   const nsAString& aValue)
  {
 -  nsCOMPtr<nsINodeInfo> ni;
 +  nsINodeInfo* ni = nsnull;
    nsresult rv =
      nsContentUtils::GetNodeInfoFromQName(aNamespaceURI, aQualifiedName,
                                           mNodeInfo->NodeInfoManager(),
 -                                         getter_AddRefs(ni));
 +                                         &ni);
    NS_ENSURE_SUCCESS(rv, rv);
  
    return SetAttr(ni->NamespaceID(), ni->NameAtom(), ni->GetPrefixAtom(),
-@@ -1659,7 +1635,7 @@ nsGenericElement::RemoveAttributeNS(cons
+@@ -1648,7 +1624,7 @@ nsGenericElement::RemoveAttributeNS(cons
  nsGenericElement::RemoveAttributeNS(const nsAString& aNamespaceURI,
                                      const nsAString& aLocalName)
  {
 -  nsCOMPtr<nsIAtom> name = do_GetAtom(aLocalName);
 +  nsIAtom* name = do_GetAtom(aLocalName);
    PRInt32 nsid =
      nsContentUtils::NameSpaceManager()->GetNameSpaceID(aNamespaceURI);
  
-@@ -1684,12 +1660,12 @@ nsGenericElement::GetAttributeNodeNS(con
+@@ -1673,12 +1649,12 @@ nsGenericElement::GetAttributeNodeNS(con
  
    *aReturn = nsnull;
  
 -  nsCOMPtr<nsIDOMNamedNodeMap> map;
 -  nsresult rv = GetAttributes(getter_AddRefs(map));
 -  NS_ENSURE_SUCCESS(rv, rv);
 -
 -  nsCOMPtr<nsIDOMNode> node;
@@ -481,17 +481,17 @@ diff --git a/content/base/src/nsGenericE
 +  nsresult rv = GetAttributes(&map);
 +  NS_ENSURE_SUCCESS(rv, rv);
 +
 +  nsIDOMNode* node = nsnull;
 +  rv = map->GetNamedItemNS(aNamespaceURI, aLocalName, &node);
  
    if (NS_SUCCEEDED(rv) && node) {
      rv = CallQueryInterface(node, aReturn);
-@@ -1707,12 +1683,12 @@ nsGenericElement::SetAttributeNodeNS(nsI
+@@ -1696,12 +1672,12 @@ nsGenericElement::SetAttributeNodeNS(nsI
  
    *aReturn = nsnull;
  
 -  nsCOMPtr<nsIDOMNamedNodeMap> map;
 -  nsresult rv = GetAttributes(getter_AddRefs(map));
 -  NS_ENSURE_SUCCESS(rv, rv);
 -
 -  nsCOMPtr<nsIDOMNode> returnNode;
@@ -500,81 +500,81 @@ diff --git a/content/base/src/nsGenericE
 +  nsresult rv = GetAttributes(&map);
 +  NS_ENSURE_SUCCESS(rv, rv);
 +
 +  nsIDOMNode* returnNode = nsnull;
 +  rv = map->SetNamedItemNS(aNewAttr, &returnNode);
    NS_ENSURE_SUCCESS(rv, rv);
  
    if (returnNode) {
-@@ -1736,10 +1712,10 @@ nsGenericElement::GetElementsByTagNameNS
+@@ -1725,10 +1701,10 @@ nsGenericElement::GetElementsByTagNameNS
      NS_ENSURE_SUCCESS(rv, rv);
    }
  
 -  nsCOMPtr<nsIAtom> nameAtom = do_GetAtom(aLocalName);
 +  nsIAtom* nameAtom = do_GetAtom(aLocalName);
    NS_ENSURE_TRUE(nameAtom, NS_ERROR_OUT_OF_MEMORY);
  
 -  nsContentList *list = NS_GetContentList(this, nameAtom, nameSpaceId).get();
 +  nsContentList *list = NS_GetContentList(this, nameAtom, nameSpaceId);
    NS_ENSURE_TRUE(list, NS_ERROR_OUT_OF_MEMORY);
  
    // transfer ref to aReturn
-@@ -1776,7 +1752,7 @@ nsGenericElement::HasAttributeNS(const n
+@@ -1765,7 +1741,7 @@ nsGenericElement::HasAttributeNS(const n
      return NS_OK;
    }
  
 -  nsCOMPtr<nsIAtom> name = do_GetAtom(aLocalName);
 +  nsIAtom* name = do_GetAtom(aLocalName);
    *aReturn = HasAttr(nsid, name);
  
    return NS_OK;
-@@ -1787,10 +1763,10 @@ nsGenericElement::JoinTextNodes(nsIConte
+@@ -1776,10 +1752,10 @@ nsGenericElement::JoinTextNodes(nsIConte
                                  nsIContent* aSecond)
  {
    nsresult rv = NS_OK;
 -  nsCOMPtr<nsIDOMText> firstText(do_QueryInterface(aFirst, &rv));
 -
 -  if (NS_SUCCEEDED(rv)) {
 -    nsCOMPtr<nsIDOMText> secondText(do_QueryInterface(aSecond, &rv));
 +  nsIDOMText* firstText(do_QueryInterface(aFirst, &rv));
 +
 +  if (NS_SUCCEEDED(rv)) {
 +    nsIDOMText* secondText(do_QueryInterface(aSecond, &rv));
  
      if (NS_SUCCEEDED(rv)) {
        nsAutoString str;
-@@ -1817,7 +1793,7 @@ nsGenericElement::Normalize()
+@@ -1806,7 +1782,7 @@ nsGenericElement::Normalize()
    for (index = 0; (index < count) && (NS_OK == result); index++) {
      nsIContent *child = GetChildAt(index);
  
 -    nsCOMPtr<nsIDOMNode> node = do_QueryInterface(child);
 +    nsIDOMNode* node = do_QueryInterface(child);
      if (node) {
        PRUint16 nodeType;
        node->GetNodeType(&nodeType);
-@@ -1843,7 +1819,7 @@ nsGenericElement::Normalize()
+@@ -1832,7 +1808,7 @@ nsGenericElement::Normalize()
              // nodes.
              nsIContent *sibling = GetChildAt(index + 1);
  
 -            nsCOMPtr<nsIDOMNode> siblingNode = do_QueryInterface(sibling);
 +            nsIDOMNode* siblingNode = do_QueryInterface(sibling);
  
              if (siblingNode) {
                PRUint16 siblingNodeType;
-@@ -1867,7 +1843,7 @@ nsGenericElement::Normalize()
+@@ -1856,7 +1832,7 @@ nsGenericElement::Normalize()
            break;
  
          case nsIDOMNode::ELEMENT_NODE:
 -          nsCOMPtr<nsIDOMElement> element = do_QueryInterface(child);
 +          nsIDOMElement* element = do_QueryInterface(child);
  
            if (element) {
              result = element->Normalize();
-@@ -1907,16 +1883,16 @@ BindNodesInInsertPoints(nsXBLBinding* aB
+@@ -1896,16 +1872,16 @@ BindNodesInInsertPoints(nsXBLBinding* aB
    if (inserts) {
      PRBool allowScripts = aBinding->AllowScripts();
  #ifdef MOZ_XUL
 -    nsCOMPtr<nsIXULDocument> xulDoc = do_QueryInterface(aDocument);
 +    nsIXULDocument* xulDoc = do_QueryInterface(aDocument);
  #endif
      PRUint32 i;
      for (i = 0; i < inserts->Length(); ++i) {
@@ -584,130 +584,130 @@ diff --git a/content/base/src/nsGenericE
        if (insertRoot) {
          PRUint32 j;
          for (j = 0; j < insertRoot->GetChildCount(); ++j) {
 -          nsCOMPtr<nsIContent> child = insertRoot->GetChildAt(j);
 +          nsIContent* child = insertRoot->GetChildAt(j);
            rv = child->BindToTree(aDocument, aInsertParent,
                                   aBinding->GetBoundElement(), allowScripts);
            NS_ENSURE_SUCCESS(rv, rv);
-@@ -2034,11 +2010,11 @@ nsGenericElement::BindToTree(nsIDocument
+@@ -2032,11 +2008,11 @@ nsGenericElement::BindToTree(nsIDocument
        nsXBLBinding* contBinding =
          GetFirstBindingWithContent(bmgr, this);
        if (contBinding) {
 -        nsCOMPtr<nsIContent> anonRoot = contBinding->GetAnonymousContent();
 +        nsIContent* anonRoot = contBinding->GetAnonymousContent();
          PRBool allowScripts = contBinding->AllowScripts();
          PRUint32 i;
          for (i = 0; i < anonRoot->GetChildCount(); ++i) {
 -          nsCOMPtr<nsIContent> child = anonRoot->GetChildAt(i);
 +          nsIContent* child = anonRoot->GetChildAt(i);
            rv = child->BindToTree(aDocument, this, this, allowScripts);
            NS_ENSURE_SUCCESS(rv, rv);
          }
-@@ -2070,7 +2046,7 @@ nsGenericElement::BindToTree(nsIDocument
+@@ -2068,7 +2044,7 @@ nsGenericElement::BindToTree(nsIDocument
    // Additionally, there's not really a need to generate the children here.
    for (i = 0; i < mAttrsAndChildren.ChildCount(); ++i) {
      // The child can remove itself from the parent in BindToTree.
 -    nsCOMPtr<nsIContent> child = mAttrsAndChildren.ChildAt(i);
 +    nsIContent* child = mAttrsAndChildren.ChildAt(i);
      rv = child->BindToTree(aDocument, this, aBindingParent,
                             aCompileEventHandlers);
      NS_ENSURE_SUCCESS(rv, rv);
-@@ -2174,7 +2150,7 @@ nsGenericElement::doPreHandleEvent(nsICo
+@@ -2172,7 +2148,7 @@ nsGenericElement::doPreHandleEvent(nsICo
    PRBool isAnonForEvents = aContent->IsNativeAnonymous();
    if (aVisitor.mEvent->message == NS_MOUSE_ENTER_SYNTH ||
        aVisitor.mEvent->message == NS_MOUSE_EXIT_SYNTH) {
 -     nsCOMPtr<nsIContent> relatedTarget =
 +     nsIContent* relatedTarget =
         do_QueryInterface(static_cast<nsMouseEvent*>
                                      (aVisitor.mEvent)->relatedTarget);
      if (relatedTarget &&
-@@ -2207,7 +2183,7 @@ nsGenericElement::doPreHandleEvent(nsICo
+@@ -2205,7 +2181,7 @@ nsGenericElement::doPreHandleEvent(nsICo
      }
    }
  
 -  nsCOMPtr<nsIContent> parent = aContent->GetParent();
 +  nsIContent* parent = aContent->GetParent();
    if (isAnonForEvents) {
-     // Don't propagate mutation events which are dispatched somewhere inside
-     // native anonymous content.
-@@ -2218,7 +2194,7 @@ nsGenericElement::doPreHandleEvent(nsICo
- 
+     // If a DOM event is explicitly dispatched using node.dispatchEvent(), then
+     // all the events are allowed even in the native anonymous content..
+@@ -2214,7 +2190,7 @@ nsGenericElement::doPreHandleEvent(nsICo
+                  "Mutation event dispatched in native anonymous content!?!");
      aVisitor.mEventTargetAtParent = parent;
    } else if (parent) {
 -    nsCOMPtr<nsIContent> content(do_QueryInterface(aVisitor.mEvent->target));
 +    nsIContent* content(do_QueryInterface(aVisitor.mEvent->target));
      if (content && content->GetBindingParent() == parent) {
        aVisitor.mEventTargetAtParent = parent;
      }
-@@ -2377,7 +2353,7 @@ nsGenericElement::GetExistingAttrNameFro
+@@ -2373,7 +2349,7 @@ nsGenericElement::GetExistingAttrNameFro
                                                kNameSpaceID_None, &nodeInfo);
    }
    else {
 -    NS_ADDREF(nodeInfo = name->NodeInfo());
 +    nodeInfo = name->NodeInfo();
    }
  
    return nodeInfo;
-@@ -2396,7 +2372,7 @@ nsGenericElement::GetBaseURI() const
+@@ -2392,7 +2368,7 @@ nsGenericElement::GetBaseURI() const
  
    // Our base URL depends on whether we have an xml:base attribute, as
    // well as on whether any of our ancestors do.
 -  nsCOMPtr<nsIURI> parentBase;
 +  nsIURI* parentBase = nsnull;
  
    nsIContent *parent = GetParent();
    if (parent) {
-@@ -2413,13 +2389,13 @@ nsGenericElement::GetBaseURI() const
+@@ -2409,13 +2385,13 @@ nsGenericElement::GetBaseURI() const
    if (value.IsEmpty()) {
      // No xml:base, so we just use the parent's base URL
      nsIURI *base = nsnull;
 -    parentBase.swap(base);
 +    swap(parentBase, base);
  
      return base;
    }
  
 -  nsCOMPtr<nsIURI> ourBase;
 -  nsresult rv = NS_NewURI(getter_AddRefs(ourBase), value,
 +  nsIURI* ourBase = nsnull;
 +  nsresult rv = NS_NewURI(&ourBase, value,
                            doc->GetDocumentCharacterSet().get(), parentBase);
    if (NS_SUCCEEDED(rv)) {
      // do a security check, almost the same as nsDocument::SetBaseURL()
-@@ -2435,7 +2411,6 @@ nsGenericElement::GetBaseURI() const
+@@ -2431,7 +2407,6 @@ nsGenericElement::GetBaseURI() const
      base = ourBase;
    }
  
 -  NS_IF_ADDREF(base);
  
    return base;    
  }
-@@ -2453,7 +2428,7 @@ nsGenericElement::SetFocus(nsPresContext
+@@ -2449,7 +2424,7 @@ nsGenericElement::SetFocus(nsPresContext
    // Traditionally focusable elements can take focus as long as they don't set
    // the disabled attribute
  
 -  nsCOMPtr<nsIPresShell> presShell = aPresContext->PresShell();
 +  nsIPresShell* presShell = aPresContext->PresShell();
    if (!presShell) {
      return;
    }
-@@ -2484,8 +2459,8 @@ nsGenericElement::ShouldFocus(nsIContent
+@@ -2480,8 +2455,8 @@ nsGenericElement::ShouldFocus(nsIContent
      nsIScriptGlobalObject *sgo = document->GetScriptGlobalObject();
  
      if (sgo) {
 -      nsCOMPtr<nsIWebNavigation> webNav(do_GetInterface(sgo));
 -      nsCOMPtr<nsIBaseWindow> baseWin(do_QueryInterface(webNav));
 +      nsIWebNavigation* webNav(do_GetInterface(sgo));
 +      nsIBaseWindow* baseWin(do_QueryInterface(webNav));
  
        if (baseWin) {
          baseWin->GetVisibility(&visible);
-@@ -2510,13 +2485,13 @@ nsGenericElement::ShouldBlur(nsIContent 
+@@ -2506,13 +2481,13 @@ nsGenericElement::ShouldBlur(nsIContent 
      nsPIDOMWindow *win = document->GetWindow();
  
      if (win) {
 -      nsCOMPtr<nsIFocusController> focusController =
 +      nsIFocusController* focusController =
             win->GetRootFocusController();
  
        if (focusController) {
@@ -715,160 +715,160 @@ diff --git a/content/base/src/nsGenericE
 -        focusController->GetFocusedElement(getter_AddRefs(focusedElement));    
 -        nsCOMPtr<nsIDOMElement> domElement = do_QueryInterface(aContent);
 +        nsIDOMElement* focusedElement = nsnull;
 +        focusController->GetFocusedElement(&focusedElement);    
 +        nsIDOMElement* domElement = do_QueryInterface(aContent);
          //when the element is the same as the focused element, blur it
          if (domElement == focusedElement)
            isFocused = PR_TRUE;
-@@ -2689,7 +2664,7 @@ nsresult
+@@ -2690,7 +2665,7 @@ nsresult
  nsresult
  nsGenericElement::RemoveChildAt(PRUint32 aIndex, PRBool aNotify)
  {
 -  nsCOMPtr<nsIContent> oldKid = mAttrsAndChildren.GetSafeChildAt(aIndex);
 +  nsIContent* oldKid = mAttrsAndChildren.GetSafeChildAt(aIndex);
    NS_ASSERTION(oldKid == GetChildAt(aIndex), "Unexpected child in RemoveChildAt");
  
    if (oldKid) {
-@@ -2717,7 +2692,7 @@ nsGenericElement::doRemoveChildAt(PRUint
+@@ -2718,7 +2693,7 @@ nsGenericElement::doRemoveChildAt(PRUint
    if (aNotify && aDocument) {
      nsIPresShell *presShell = aDocument->GetPrimaryShell();
      if (presShell && presShell->IsAccessibilityActive()) {
 -      nsCOMPtr<nsIAccessibilityService> accService = 
 +      nsIAccessibilityService* accService = 
          do_GetService("@mozilla.org/accessibilityService;1");
        if (accService) {
          accService->InvalidateSubtreeFor(presShell, aKid,
-@@ -2785,7 +2760,7 @@ nsGenericElement::DispatchEvent(nsPresCo
+@@ -2791,7 +2766,7 @@ nsGenericElement::DispatchEvent(nsPresCo
      return NS_OK;
    }
  
 -  nsCOMPtr<nsIPresShell> shell = aPresContext->GetPresShell();
 +  nsIPresShell* shell = aPresContext->GetPresShell();
    if (!shell) {
      return NS_OK;
    }
-@@ -2926,7 +2901,7 @@ PRBool IsAllowedAsChild(nsIContent* aNew
+@@ -2941,7 +2916,7 @@ PRBool IsAllowedAsChild(nsIContent* aNew
                    "Must have ref content for replace");
  #ifdef DEBUG
    PRUint16 debugNodeType = 0;
 -  nsCOMPtr<nsIDOMNode> debugNode(do_QueryInterface(aNewChild));
 +  nsIDOMNode* debugNode(do_QueryInterface(aNewChild));
    nsresult debugRv = debugNode->GetNodeType(&debugNodeType);
  
    NS_PRECONDITION(NS_SUCCEEDED(debugRv) && debugNodeType == aNewNodeType,
-@@ -2970,11 +2945,11 @@ PRBool IsAllowedAsChild(nsIContent* aNew
+@@ -2985,11 +2960,11 @@ PRBool IsAllowedAsChild(nsIContent* aNew
        }
  
        // Now grovel for a doctype
 -      nsCOMPtr<nsIDOMDocument> doc = do_QueryInterface(aDocument);
 +      nsIDOMDocument* doc = do_QueryInterface(aDocument);
        NS_ASSERTION(doc, "Shouldn't happen");
 -      nsCOMPtr<nsIDOMDocumentType> docType;
 -      doc->GetDoctype(getter_AddRefs(docType));
 -      nsCOMPtr<nsIContent> docTypeContent = do_QueryInterface(docType);
 +      nsIDOMDocumentType* docType = nsnull;
 +      doc->GetDoctype(&docType);
 +      nsIContent* docTypeContent = do_QueryInterface(docType);
        
        if (!docTypeContent) {
          // It's all good.
-@@ -2997,11 +2972,11 @@ PRBool IsAllowedAsChild(nsIContent* aNew
+@@ -3012,11 +2987,11 @@ PRBool IsAllowedAsChild(nsIContent* aNew
          return PR_FALSE;
        }
  
 -      nsCOMPtr<nsIDOMDocument> doc = do_QueryInterface(aDocument);
 +      nsIDOMDocument* doc = do_QueryInterface(aDocument);
        NS_ASSERTION(doc, "Shouldn't happen");
 -      nsCOMPtr<nsIDOMDocumentType> docType;
 -      doc->GetDoctype(getter_AddRefs(docType));
 -      nsCOMPtr<nsIContent> docTypeContent = do_QueryInterface(docType);
 +      nsIDOMDocumentType* docType = nsnull;
 +      doc->GetDoctype(&docType);
 +      nsIContent* docTypeContent = do_QueryInterface(docType);
        if (docTypeContent) {
          // Already have a doctype, so this is only OK if we're replacing it
          return aIsReplace && docTypeContent == aRefContent;
-@@ -3052,7 +3027,7 @@ PRBool IsAllowedAsChild(nsIContent* aNew
+@@ -3067,7 +3042,7 @@ PRBool IsAllowedAsChild(nsIContent* aNew
          }
          // If we can put this content at the the right place, we might be ok;
          // if not, we bail out.
 -        nsCOMPtr<nsIDOMNode> childNode(do_QueryInterface(childContent));
 +        nsIDOMNode* childNode(do_QueryInterface(childContent));
          PRUint16 type;
          childNode->GetNodeType(&type);
          if (!IsAllowedAsChild(childContent, type, aParent, aDocument,
-@@ -3095,9 +3070,9 @@ nsGenericElement::doReplaceOrInsertBefor
+@@ -3110,9 +3085,9 @@ nsGenericElement::doReplaceOrInsertBefor
  
    // Keep a strong reference to the node that we'll return to ensure it
    // doesn't go away.
 -  nsCOMPtr<nsIDOMNode> returnVal = aReplace ? aRefChild : aNewChild;
 -
 -  nsCOMPtr<nsIContent> refContent;
 +  nsIDOMNode* returnVal = aReplace ? aRefChild : aNewChild;
 +
 +  nsIContent* refContent = nsnull;
    nsresult res = NS_OK;
    PRInt32 insPos;
  
-@@ -3112,7 +3087,7 @@ nsGenericElement::doReplaceOrInsertBefor
+@@ -3127,7 +3102,7 @@ nsGenericElement::doReplaceOrInsertBefor
      }
  
      if (aRefChild == aNewChild) {
 -      NS_ADDREF(*aReturn = aNewChild);
 +      *aReturn = aNewChild;
  
        return NS_OK;
      }
-@@ -3120,7 +3095,7 @@ nsGenericElement::doReplaceOrInsertBefor
+@@ -3135,7 +3110,7 @@ nsGenericElement::doReplaceOrInsertBefor
      insPos = container->GetChildCount();
    }
  
 -  nsCOMPtr<nsIContent> newContent = do_QueryInterface(aNewChild);
 +  nsIContent* newContent = do_QueryInterface(aNewChild);
    if (!newContent) {
      return NS_ERROR_DOM_HIERARCHY_REQUEST_ERR;
    }
-@@ -3237,7 +3212,7 @@ nsGenericElement::doReplaceOrInsertBefor
+@@ -3252,7 +3227,7 @@ nsGenericElement::doReplaceOrInsertBefor
            return NS_ERROR_DOM_NOT_FOUND_ERR;
          }
  
 -        nsCOMPtr<nsIDOMNode> tmpNode = do_QueryInterface(childContent);
 +        nsIDOMNode* tmpNode = do_QueryInterface(childContent);
          PRUint16 tmpType = 0;
          tmpNode->GetNodeType(&tmpType);
  
-@@ -3317,7 +3292,7 @@ nsGenericElement::doReplaceOrInsertBefor
+@@ -3332,7 +3307,7 @@ nsGenericElement::doReplaceOrInsertBefor
      NS_ENSURE_SUCCESS(res, res);
    }
  
 -  returnVal.swap(*aReturn);
 +  swap(returnVal, *aReturn);
  
    return res;
  }
-@@ -3336,7 +3311,7 @@ nsGenericElement::doRemoveChild(nsIDOMNo
+@@ -3351,7 +3326,7 @@ nsGenericElement::doRemoveChild(nsIDOMNo
  
    nsINode* container = NODE_FROM(aParent, aDocument);
  
 -  nsCOMPtr<nsIContent> content = do_QueryInterface(aOldChild);
 +  nsIContent* content = do_QueryInterface(aOldChild);
    // fix children to be a passed argument
    PRInt32 index = container->IndexOf(content);
    if (index == -1) {
-@@ -3347,7 +3322,6 @@ nsGenericElement::doRemoveChild(nsIDOMNo
+@@ -3362,7 +3337,6 @@ nsGenericElement::doRemoveChild(nsIDOMNo
    nsresult rv = container->RemoveChildAt(index, PR_TRUE);
  
    *aReturn = aOldChild;
 -  NS_ADDREF(aOldChild);
  
    return rv;
  }
-@@ -3422,12 +3396,12 @@ nsGenericElement::AddScriptEventListener
+@@ -3437,12 +3411,12 @@ nsGenericElement::AddScriptEventListener
    }
  
    NS_PRECONDITION(aEventName, "Must have event name!");
 -  nsCOMPtr<nsISupports> target;
 +  nsISupports* target = nsnull;
    PRBool defer = PR_TRUE;
 -  nsCOMPtr<nsIEventListenerManager> manager;
 -
@@ -876,188 +876,166 @@ diff --git a/content/base/src/nsGenericE
 -                                               getter_AddRefs(target),
 +  nsIEventListenerManager* manager = nsnull;
 +
 +  nsresult rv = GetEventListenerManagerForAttr(&manager,
 +                                               &target,
                                                 &defer);
    NS_ENSURE_SUCCESS(rv, rv);
  
-@@ -3578,10 +3552,10 @@ nsGenericElement::SetAttrAndNotify(PRInt
+@@ -3593,10 +3567,10 @@ nsGenericElement::SetAttrAndNotify(PRInt
      }
    }
    else {
 -    nsCOMPtr<nsINodeInfo> ni;
 +    nsINodeInfo* ni = nsnull;
      rv = mNodeInfo->NodeInfoManager()->GetNodeInfo(aName, aPrefix,
                                                     aNamespaceID,
 -                                                   getter_AddRefs(ni));
 +                                                   &ni);
      NS_ENSURE_SUCCESS(rv, rv);
  
      rv = mAttrsAndChildren.SetAndTakeAttr(ni, aParsedValue);
-@@ -3614,10 +3588,10 @@ nsGenericElement::SetAttrAndNotify(PRInt
- 
-     nsAutoString attrName;
-     aName->ToString(attrName);
--    nsCOMPtr<nsIDOMAttr> attrNode;
-+    nsIDOMAttr* attrNode = nsnull;
-     nsAutoString ns;
-     nsContentUtils::NameSpaceManager()->GetNameSpaceURI(aNamespaceID, ns);
--    GetAttributeNodeNS(ns, attrName, getter_AddRefs(attrNode));
-+    GetAttributeNodeNS(ns, attrName, &attrNode);
-     mutation.mRelatedNode = attrNode;
- 
-     mutation.mAttrName = aName;
-@@ -3677,7 +3651,7 @@ nsGenericElement::GetEventListenerManage
+@@ -3697,7 +3671,7 @@ nsGenericElement::GetEventListenerManage
  {
    nsresult rv = GetListenerManager(PR_TRUE, aManager);
    if (NS_SUCCEEDED(rv)) {
 -    NS_ADDREF(*aTarget = static_cast<nsIContent*>(this));
 +    *aTarget = static_cast<nsIContent*>(this);
    }
    *aDefer = PR_TRUE;
    return rv;
-@@ -3822,13 +3796,13 @@ nsGenericElement::UnsetAttr(PRInt32 aNam
+@@ -3842,13 +3816,13 @@ nsGenericElement::UnsetAttr(PRInt32 aNam
                                           this);
  
    // Grab the attr node if needed before we remove it from the attr map
 -  nsCOMPtr<nsIDOMAttr> attrNode;
 +  nsIDOMAttr* attrNode = nsnull;
    if (hasMutationListeners) {
      nsAutoString attrName;
      aName->ToString(attrName);
      nsAutoString ns;
      nsContentUtils::NameSpaceManager()->GetNameSpaceURI(aNameSpaceID, ns);
 -    GetAttributeNodeNS(ns, attrName, getter_AddRefs(attrNode));
 +    GetAttributeNodeNS(ns, attrName, &attrNode);
    }
  
    // Clear binding to nsIDOMNamedNodeMap
-@@ -3864,7 +3838,7 @@ nsGenericElement::UnsetAttr(PRInt32 aNam
-   }
- 
-   if (hasMutationListeners) {
--    nsCOMPtr<nsIDOMEventTarget> node =
-+    nsIDOMEventTarget* node =
-       do_QueryInterface(static_cast<nsIContent *>(this));
-     nsMutationEvent mutation(PR_TRUE, NS_MUTATION_ATTRMODIFIED);
- 
-@@ -4012,9 +3986,9 @@ nsGenericElement::List(FILE* out, PRInt3
+@@ -4036,9 +4010,9 @@ nsGenericElement::List(FILE* out, PRInt3
      // Note: not listing nsIAnonymousContentCreator-created content...
  
      nsBindingManager* bindingManager = document->BindingManager();
 -    nsCOMPtr<nsIDOMNodeList> anonymousChildren;
 +    nsIDOMNodeList* anonymousChildren = nsnull;
      bindingManager->GetAnonymousNodesFor(nonConstThis,
 -                                         getter_AddRefs(anonymousChildren));
 +                                         &anonymousChildren);
  
      if (anonymousChildren) {
        anonymousChildren->GetLength(&length);
-@@ -4023,9 +3997,9 @@ nsGenericElement::List(FILE* out, PRInt3
+@@ -4047,9 +4021,9 @@ nsGenericElement::List(FILE* out, PRInt3
          fputs("anonymous-children<\n", out);
  
          for (i = 0; i < length; ++i) {
 -          nsCOMPtr<nsIDOMNode> node;
 -          anonymousChildren->Item(i, getter_AddRefs(node));
 -          nsCOMPtr<nsIContent> child = do_QueryInterface(node);
 +          nsIDOMNode* node = nsnull;
 +          anonymousChildren->Item(i, &node);
 +          nsIContent* child = do_QueryInterface(node);
            child->List(out, aIndent + 1);
          }
  
-@@ -4035,9 +4009,9 @@ nsGenericElement::List(FILE* out, PRInt3
+@@ -4059,9 +4033,9 @@ nsGenericElement::List(FILE* out, PRInt3
      }
  
      if (bindingManager->HasContentListFor(nonConstThis)) {
 -      nsCOMPtr<nsIDOMNodeList> contentList;
 +      nsIDOMNodeList* contentList = nsnull;
        bindingManager->GetContentListFor(nonConstThis,
 -                                        getter_AddRefs(contentList));
 +                                        &contentList);
  
        NS_ASSERTION(contentList != nsnull, "oops, binding manager lied");
  
-@@ -4047,9 +4021,9 @@ nsGenericElement::List(FILE* out, PRInt3
+@@ -4071,9 +4045,9 @@ nsGenericElement::List(FILE* out, PRInt3
          fputs("content-list<\n", out);
  
          for (i = 0; i < length; ++i) {
 -          nsCOMPtr<nsIDOMNode> node;
 -          contentList->Item(i, getter_AddRefs(node));
 -          nsCOMPtr<nsIContent> child = do_QueryInterface(node);
 +          nsIDOMNode* node = nsnull;
 +          contentList->Item(i, &node);
 +          nsIContent* child = do_QueryInterface(node);
            child->List(out, aIndent + 1);
          }
  
-@@ -4147,8 +4121,8 @@ nsGenericElement::PreHandleEventForLinks
+@@ -4171,8 +4145,8 @@ nsGenericElement::PreHandleEventForLinks
    }
  
    // Make sure we meet the preconditions before continuing
 -  nsCOMPtr<nsIURI> absURI;
 -  if (!CheckHandleEventForLinksPrecondition(aVisitor, getter_AddRefs(absURI))) {
 +  nsIURI* absURI = nsnull;
 +  if (!CheckHandleEventForLinksPrecondition(aVisitor, &absURI)) {
      return NS_OK;
    }
  
-@@ -4202,8 +4176,8 @@ nsGenericElement::PostHandleEventForLink
+@@ -4226,8 +4200,8 @@ nsGenericElement::PostHandleEventForLink
    }
  
    // Make sure we meet the preconditions before continuing
 -  nsCOMPtr<nsIURI> absURI;
 -  if (!CheckHandleEventForLinksPrecondition(aVisitor, getter_AddRefs(absURI))) {
 +  nsIURI* absURI = nsnull;
 +  if (!CheckHandleEventForLinksPrecondition(aVisitor, &absURI)) {
      return NS_OK;
    }
  
-@@ -4230,7 +4204,7 @@ nsGenericElement::PostHandleEventForLink
+@@ -4254,7 +4228,7 @@ nsGenericElement::PostHandleEventForLink
                PRBool isActive = PR_FALSE;
                focusController->GetActive(&isActive);
                if (!isActive) {
 -                nsCOMPtr<nsIDOMElement> domElement = do_QueryInterface(this);
 +                nsIDOMElement* domElement = do_QueryInterface(this);
                  if(domElement)
                    focusController->SetFocusedElement(domElement);
                  break;
-@@ -4254,7 +4228,7 @@ nsGenericElement::PostHandleEventForLink
+@@ -4278,7 +4252,7 @@ nsGenericElement::PostHandleEventForLink
        }
  
        // The default action is simply to dispatch DOMActivate
 -      nsCOMPtr<nsIPresShell> shell = aVisitor.mPresContext->GetPresShell();
 +      nsIPresShell* shell = aVisitor.mPresContext->GetPresShell();
        if (shell) {
          // single-click
          nsEventStatus status = nsEventStatus_eIgnore;
 diff --git a/content/base/src/nsGenericElement.h b/content/base/src/nsGenericElement.h
 --- a/content/base/src/nsGenericElement.h
 +++ b/content/base/src/nsGenericElement.h
-@@ -84,7 +84,7 @@ typedef unsigned long PtrBits;
+@@ -85,7 +85,7 @@ typedef unsigned long PtrBits;
   * and Item to its existing child list.
   * @see nsIDOMNodeList
   */
 -class nsChildContentList : public nsGenericDOMNodeList 
 +class nsChildContentList : public XPCOMGCFinalizedObject, public nsGenericDOMNodeList 
  {
  public:
    nsChildContentList(nsINode* aNode)
-@@ -110,7 +110,7 @@ private:
+@@ -111,7 +111,7 @@ private:
  /**
   * A tearoff class for nsGenericElement to implement additional interfaces
   */
 -class nsNode3Tearoff : public nsIDOM3Node
 +class nsNode3Tearoff : public XPCOMGCFinalizedObject, public nsIDOM3Node
  {
  public:
    NS_DECL_CYCLE_COLLECTING_ISUPPORTS
-@@ -145,15 +145,17 @@ private:
+@@ -146,15 +146,17 @@ private:
   * A class that implements nsIWeakReference
   */
  
 -class nsNodeWeakReference : public nsIWeakReference
 +class nsNodeWeakReference : public XPCOMGCFinalizedObject, public nsIWeakReference
  {
  public:
    nsNodeWeakReference(nsINode* aNode)
@@ -1068,17 +1046,17 @@ diff --git a/content/base/src/nsGenericE
  
 -  ~nsNodeWeakReference();
 +  ~nsNodeWeakReference()
 +  {
 +  }
  
    // nsISupports
    NS_DECL_ISUPPORTS
-@@ -161,19 +163,14 @@ public:
+@@ -162,19 +164,14 @@ public:
    // nsIWeakReference
    NS_DECL_NSIWEAKREFERENCE
  
 -  void NoticeNodeDestruction()
 -  {
 -    mNode = nsnull;
 -  }
 -
@@ -1090,46 +1068,46 @@ diff --git a/content/base/src/nsGenericE
  /**
   * Tearoff to use for nodes to implement nsISupportsWeakReference
   */
 -class nsNodeSupportsWeakRefTearoff : public nsISupportsWeakReference
 +class nsNodeSupportsWeakRefTearoff : public XPCOMGCFinalizedObject, public nsISupportsWeakReference
  {
  public:
    nsNodeSupportsWeakRefTearoff(nsINode* aNode)
-@@ -575,7 +572,7 @@ public:
+@@ -578,7 +575,7 @@ public:
                                       const nsAString& aVersion,
                                       nsISupports** aReturn);
    
 -  static already_AddRefed<nsIDOMNSFeatureFactory>
 +  static nsIDOMNSFeatureFactory*
      GetDOMFeatureFactory(const nsAString& aFeature, const nsAString& aVersion);
  
    static PRBool ShouldFocus(nsIContent *aContent);
-@@ -888,7 +885,6 @@ public:
+@@ -891,7 +888,6 @@ public:
    {
    public:
      nsDOMSlots(PtrBits aFlags);
 -    virtual ~nsDOMSlots();
  
      /**
       * The .style attribute (an interface that forwards to the actual
-@@ -914,11 +910,6 @@ public:
+@@ -917,11 +913,6 @@ public:
        */
        nsIControllers* mControllers; // [OWNER]
      };
 -    
 -    /**
 -     * Weak reference to this node
 -     */
 -    nsNodeWeakReference* mWeakReference;
    };
  
  protected:
-@@ -1039,7 +1030,7 @@ _elementName::Clone(nsINodeInfo *aNodeIn
+@@ -1042,7 +1033,7 @@ _elementName::Clone(nsINodeInfo *aNodeIn
   * Yet another tearoff class for nsGenericElement
   * to implement additional interfaces
   */
 -class nsNSElementTearoff : public nsIDOMNSElement
 +class nsNSElementTearoff : public XPCOMGCFinalizedObject, public nsIDOMNSElement
  {
  public:
    NS_DECL_CYCLE_COLLECTING_ISUPPORTS
--- a/profilemigrator-immortal
+++ b/profilemigrator-immortal
@@ -1,23 +1,35 @@
 This patch is a temporary crutch because garburator is dying on nsBrowserMigrator.ii
 
 diff --git a/browser/components/migration/src/nsProfileMigrator.cpp b/browser/components/migration/src/nsProfileMigrator.cpp
 --- a/browser/components/migration/src/nsProfileMigrator.cpp
 +++ b/browser/components/migration/src/nsProfileMigrator.cpp
-@@ -89,7 +89,7 @@
+@@ -89,7 +89,7 @@ nsProfileMigrator::Migrate(nsIProfileSta
    nsresult rv;
  
    nsCAutoString key;
 -  nsCOMPtr<nsIBrowserProfileMigrator> bpm;
 +  nsIBrowserProfileMigrator* bpm = nsnull;
  
    rv = GetDefaultBrowserMigratorKey(key, bpm);
    if (NS_FAILED(rv)) return rv;
-@@ -168,7 +168,7 @@
+@@ -168,7 +168,7 @@ NS_IMPL_ISUPPORTS1(nsProfileMigrator, ns
  
  nsresult
  nsProfileMigrator::GetDefaultBrowserMigratorKey(nsACString& aKey,
 -                                                nsCOMPtr<nsIBrowserProfileMigrator>& bpm)
 +                                                nsIBrowserProfileMigrator*& bpm)
  {
  #if XP_WIN
  
+diff --git a/browser/components/migration/src/nsProfileMigrator.h b/browser/components/migration/src/nsProfileMigrator.h
+--- a/browser/components/migration/src/nsProfileMigrator.h
++++ b/browser/components/migration/src/nsProfileMigrator.h
+@@ -57,7 +57,7 @@ protected:
+   ~nsProfileMigrator() { }
+ 
+   nsresult GetDefaultBrowserMigratorKey(nsACString& key,
+-                                        nsCOMPtr<nsIBrowserProfileMigrator>& bpm);
++                                        nsIBrowserProfileMigrator* &bpm);
+ 
+   /**
+    * Import profiles from ~/.firefox/ or ~/.phoenix/
--- a/remove-cyclec.patch
+++ b/remove-cyclec.patch
@@ -1,14 +1,14 @@
 Get rid of the cycle collector.
 
 diff --git a/content/base/public/nsContentUtils.h b/content/base/public/nsContentUtils.h
 --- a/content/base/public/nsContentUtils.h
 +++ b/content/base/public/nsContentUtils.h
-@@ -846,20 +846,6 @@
+@@ -857,20 +857,6 @@ public:
    static PRUint32 GetEventId(nsIAtom* aName);
  
    /**
 -   * Used only during traversal of the XPCOM graph by the cycle
 -   * collector: push a pointer to the listener manager onto the
 -   * children deque, if it exists. Do nothing if there is no listener
 -   * manager.
 -   *
@@ -19,17 +19,17 @@ diff --git a/content/base/public/nsConte
 -   */
 -  static void TraverseListenerManager(nsINode *aNode,
 -                                      nsCycleCollectionTraversalCallback &cb);
 -
 -  /**
     * Get the eventlistener manager for aNode. If a new eventlistener manager
     * was created, aCreated is set to PR_TRUE.
     *
-@@ -1005,74 +991,6 @@
+@@ -1016,74 +1002,6 @@ public:
     * Unbinds the content from the tree and nulls it out if it's not null.
     */
    static void DestroyAnonymousContent(nsCOMPtr<nsIContent>* aContent);
 -
 -  /**
 -   * Keep script object aNewObject, held by aScriptObjectHolder, alive.
 -   *
 -   * NOTE: This currently only supports objects that hold script objects of one
@@ -94,17 +94,17 @@ diff --git a/content/base/public/nsConte
 -   *
 -   * @param aScriptObjectHolder the object that holds JS objects that we want to
 -   *                            drop
 -   */
 -  static nsresult DropJSObjects(void* aScriptObjectHolder);
  
    /**
     * Convert nsIContent::IME_STATUS_* to nsIKBStateControll::IME_STATUS_*
-@@ -1299,13 +1217,8 @@
+@@ -1354,13 +1272,8 @@ private:
    static PRUint32 sRunnersCountAtFirstBlocker;
  };
  
 -#define NS_HOLD_JS_OBJECTS(obj, clazz)                                         \
 -  nsContentUtils::HoldJSObjects(NS_CYCLE_COLLECTION_UPCAST(obj, clazz),        \
 -                                &NS_CYCLE_COLLECTION_NAME(clazz))
 -
 -#define NS_DROP_JS_OBJECTS(obj, clazz)                                         \
@@ -113,17 +113,17 @@ diff --git a/content/base/public/nsConte
 +#define NS_HOLD_JS_OBJECTS(obj, clazz) NS_OK
 +#define NS_DROP_JS_OBJECTS(obj, clazz) NS_OK
  
  class nsCxPusher
  {
 diff --git a/content/base/public/nsIContent.h b/content/base/public/nsIContent.h
 --- a/content/base/public/nsIContent.h
 +++ b/content/base/public/nsIContent.h
-@@ -833,39 +833,11 @@
+@@ -856,39 +856,11 @@ NS_DEFINE_STATIC_IID_ACCESSOR(nsIContent
  
  // Some cycle-collecting helper macros for nsIContent subclasses
  
 -#define NS_IMPL_CYCLE_COLLECTION_TRAVERSE_LISTENERMANAGER \
 -  if (tmp->HasFlag(NODE_HAS_LISTENERMANAGER)) {           \
 -    nsContentUtils::TraverseListenerManager(tmp, cb);     \
 -  }
 -
@@ -162,17 +162,17 @@ diff --git a/content/base/public/nsICont
 +#define NS_IMPL_CYCLE_COLLECTION_UNLINK_LISTENERMANAGER
 +#define NS_IMPL_CYCLE_COLLECTION_UNLINK_PRESERVED_WRAPPER
 +#define NS_IMPL_CYCLE_COLLECTION_UNLINK_USERDATA
  
  #endif /* nsIContent_h___ */
 diff --git a/content/base/src/nsContentSink.cpp b/content/base/src/nsContentSink.cpp
 --- a/content/base/src/nsContentSink.cpp
 +++ b/content/base/src/nsContentSink.cpp
-@@ -159,23 +159,6 @@
+@@ -160,23 +160,6 @@ NS_INTERFACE_MAP_BEGIN_CYCLE_COLLECTION(
    NS_INTERFACE_MAP_ENTRY(nsITimerCallback)
    NS_INTERFACE_MAP_ENTRY_AMBIGUOUS(nsISupports, nsIScriptLoaderObserver)
  NS_INTERFACE_MAP_END
 -
 -NS_IMPL_CYCLE_COLLECTION_CLASS(nsContentSink)
 -NS_IMPL_CYCLE_COLLECTION_UNLINK_BEGIN(nsContentSink)
 -  if (tmp->mDocument) {
 -    tmp->mDocument->RemoveObserver(tmp);
@@ -189,17 +189,17 @@ diff --git a/content/base/src/nsContentS
 -NS_IMPL_CYCLE_COLLECTION_TRAVERSE_END
 -
  
  nsContentSink::nsContentSink()
  {
 diff --git a/content/base/src/nsContentUtils.cpp b/content/base/src/nsContentUtils.cpp
 --- a/content/base/src/nsContentUtils.cpp
 +++ b/content/base/src/nsContentUtils.cpp
-@@ -3243,26 +3243,6 @@
+@@ -3253,26 +3253,6 @@ nsContentUtils::HasMutationListeners(nsI
    return PR_FALSE;
  }
  
 -/* static */
 -void
 -nsContentUtils::TraverseListenerManager(nsINode *aNode,
 -                                        nsCycleCollectionTraversalCallback &cb)
 -{
@@ -216,20 +216,23 @@ diff --git a/content/base/src/nsContentU
 -    NS_CYCLE_COLLECTION_NOTE_EDGE_NAME(cb, "[via hash] mListenerManager");
 -    cb.NoteXPCOMChild(entry->mListenerManager);
 -  }
 -}
 -
  nsresult
  nsContentUtils::GetListenerManager(nsINode *aNode,
                                     PRBool aCreateIfNotFound,
-@@ -3763,33 +3743,6 @@
- }
- 
- /* static */
+@@ -3770,33 +3750,6 @@ nsContentUtils::DropScriptObject(PRUint3
+   if (--sScriptRootCount[langIndex] == 0) {
+     NS_RELEASE(sScriptRuntimes[langIndex]);
+   }
+-}
+-
+-/* static */
 -nsresult
 -nsContentUtils::HoldJSObjects(void* aScriptObjectHolder,
 -                              nsScriptObjectTracer* aTracer)
 -{
 -  nsresult rv = sXPConnect->AddJSHolder(aScriptObjectHolder, aTracer);
 -  NS_ENSURE_SUCCESS(rv, rv);
 -
 -  ++sJSGCThingRootCount;
@@ -244,26 +247,23 @@ diff --git a/content/base/src/nsContentU
 -nsContentUtils::DropJSObjects(void* aScriptObjectHolder)
 -{
 -  NS_LOG_RELEASE(sXPConnect, sJSGCThingRootCount - 1, "HoldJSObjects");
 -  nsresult rv = sXPConnect->RemoveJSHolder(aScriptObjectHolder);
 -  if (--sJSGCThingRootCount == 0 && !sInitialized) {
 -    NS_RELEASE(sXPConnect);
 -  }
 -  return rv;
--}
--
--/* static */
- PRUint32
- nsContentUtils::GetKBStateControlStatusFromIMEStatus(PRUint32 aState)
- {
+ }
+ 
+ /* static */
 diff --git a/content/base/src/nsDOMAttributeMap.cpp b/content/base/src/nsDOMAttributeMap.cpp
 --- a/content/base/src/nsDOMAttributeMap.cpp
 +++ b/content/base/src/nsDOMAttributeMap.cpp
-@@ -84,36 +84,6 @@
+@@ -84,36 +84,6 @@ nsDOMAttributeMap::~nsDOMAttributeMap()
  {
    mAttributeCache.Enumerate(RemoveMapRef, nsnull);
  }
 -
 -void
 -nsDOMAttributeMap::DropReference()
 -{
 -  mAttributeCache.Enumerate(RemoveMapRef, nsnull);
@@ -293,48 +293,48 @@ diff --git a/content/base/src/nsDOMAttri
 -NS_IMPL_CYCLE_COLLECTION_TRAVERSE_END
 -
  
  // QueryInterface implementation for nsDOMAttributeMap
  NS_INTERFACE_MAP_BEGIN_CYCLE_COLLECTION(nsDOMAttributeMap)
 diff --git a/content/base/src/nsDOMAttributeMap.h b/content/base/src/nsDOMAttributeMap.h
 --- a/content/base/src/nsDOMAttributeMap.h
 +++ b/content/base/src/nsDOMAttributeMap.h
-@@ -131,8 +131,6 @@
+@@ -131,8 +131,6 @@ public:
    // nsIDOMNamedNodeMap interface
    NS_DECL_NSIDOMNAMEDNODEMAP
  
 -  void DropReference();
 -
    nsIContent* GetContent()
    {
      return mContent;
 diff --git a/content/base/src/nsDocument.cpp b/content/base/src/nsDocument.cpp
 --- a/content/base/src/nsDocument.cpp
 +++ b/content/base/src/nsDocument.cpp
-@@ -154,7 +154,6 @@
+@@ -154,7 +154,6 @@ static NS_DEFINE_CID(kDOMEventGroupCID, 
  
  #include "nsIJSContextStack.h"
  #include "nsIXPConnect.h"
 -#include "nsCycleCollector.h"
  #include "nsCCUncollectableMarker.h"
  #include "nsIContentPolicy.h"
  
-@@ -802,10 +801,6 @@
+@@ -804,10 +803,6 @@ nsDocument::~nsDocument()
    if (gDocumentLeakPRLog)
      PR_LOG(gDocumentLeakPRLog, PR_LOG_DEBUG,
             ("DOCUMENT %p destroyed", this));
 -#endif
 -
 -#ifdef DEBUG
 -  nsCycleCollector_DEBUG_wasFreed(static_cast<nsIDocument*>(this));
  #endif
  
    mInDestructor = PR_TRUE;
-@@ -946,171 +941,6 @@
+@@ -950,173 +945,6 @@ NS_IMPL_CYCLE_COLLECTING_RELEASE_AMBIGUO
                                                          nsIDocument,
                                                          nsNodeUtils::LastRelease(this))
  
 -
 -PR_STATIC_CALLBACK(PLDHashOperator)
 -SubDocTraverser(PLDHashTable *table, PLDHashEntryHdr *hdr, PRUint32 number,
 -                void *arg)
 -{
@@ -467,16 +467,18 @@ diff --git a/content/base/src/nsDocument
 -
 -
 -NS_IMPL_CYCLE_COLLECTION_UNLINK_BEGIN(nsDocument)
 -  // Tear down linkmap. This is a performance optimization so that we
 -  // don't waste time removing links one by one as they are removed
 -  // from the doc.
 -  tmp->DestroyLinkMap();
 -
+-  nsAutoScriptBlocker scriptBlocker;
+-
 -  // Unlink the mChildren nsAttrAndChildArray.
 -  for (PRInt32 indx = PRInt32(tmp->mChildren.ChildCount()) - 1; 
 -       indx >= 0; --indx) {
 -    tmp->mChildren.ChildAt(indx)->UnbindFromTree();
 -    tmp->mChildren.RemoveChildAt(indx);
 -  }
 -
 -  NS_IMPL_CYCLE_COLLECTION_UNLINK_NSCOMPTR(mCachedRootContent)
@@ -499,17 +501,17 @@ diff --git a/content/base/src/nsDocument
 -
 -
  nsresult
  nsDocument::Init()
  {
 diff --git a/content/base/src/nsGenericDOMDataNode.cpp b/content/base/src/nsGenericDOMDataNode.cpp
 --- a/content/base/src/nsGenericDOMDataNode.cpp
 +++ b/content/base/src/nsGenericDOMDataNode.cpp
-@@ -78,31 +78,6 @@
+@@ -79,31 +79,6 @@ nsGenericDOMDataNode::~nsGenericDOMDataN
  }
  
  NS_IMPL_CYCLE_COLLECTION_CLASS(nsGenericDOMDataNode)
 -
 -NS_IMPL_CYCLE_COLLECTION_TRAVERSE_BEGIN(nsGenericDOMDataNode)
 -  nsIDocument* currentDoc = tmp->GetCurrentDoc();
 -  if (currentDoc && nsCCUncollectableMarker::InGeneration(
 -                      currentDoc->GetMarkedCCGeneration())) {
@@ -534,54 +536,58 @@ diff --git a/content/base/src/nsGenericD
 -  NS_IMPL_CYCLE_COLLECTION_UNLINK_PRESERVED_WRAPPER
 -NS_IMPL_CYCLE_COLLECTION_UNLINK_END
  
  NS_INTERFACE_MAP_BEGIN_CYCLE_COLLECTION(nsGenericDOMDataNode)
    NS_INTERFACE_MAP_ENTRY(nsIContent)
 diff --git a/content/base/src/nsGenericElement.cpp b/content/base/src/nsGenericElement.cpp
 --- a/content/base/src/nsGenericElement.cpp
 +++ b/content/base/src/nsGenericElement.cpp
-@@ -1178,13 +1178,6 @@
+@@ -1167,13 +1167,6 @@ nsGenericElement::nsDOMSlots::nsDOMSlots
  
  nsGenericElement::nsDOMSlots::~nsDOMSlots()
  {
 -  if (mStyle) {
 -    mStyle->DropReference();
 -  }
 -
 -  if (mAttributeMap) {
 -    mAttributeMap->DropReference();
 -  }
  }
  
  nsGenericElement::nsGenericElement(nsINodeInfo *aNodeInfo)
-@@ -3443,99 +3436,6 @@
+@@ -3452,103 +3445,6 @@ nsGenericElement::doRemoveChild(nsIDOMNo
  // nsISupports implementation
  
  NS_IMPL_CYCLE_COLLECTION_CLASS(nsGenericElement)
 -
 -NS_IMPL_CYCLE_COLLECTION_UNLINK_BEGIN(nsGenericElement)
 -  NS_IMPL_CYCLE_COLLECTION_UNLINK_LISTENERMANAGER
 -  NS_IMPL_CYCLE_COLLECTION_UNLINK_USERDATA
 -  NS_IMPL_CYCLE_COLLECTION_UNLINK_PRESERVED_WRAPPER
 -
 -  if (tmp->HasProperties() && tmp->IsNodeOfType(nsINode::eXUL)) {
 -    tmp->DeleteProperty(nsGkAtoms::contextmenulistener);
 -    tmp->DeleteProperty(nsGkAtoms::popuplistener);
 -  }
 -
 -  // Unlink child content (and unbind our subtree).
 -  {
--    PRUint32 i;
--    PRUint32 kids = tmp->mAttrsAndChildren.ChildCount();
--    for (i = kids; i > 0; i--) {
--      // We could probably do a non-deep unbind here when IsInDoc is false
--      // for better performance.
--      tmp->mAttrsAndChildren.ChildAt(i-1)->UnbindFromTree();
--      tmp->mAttrsAndChildren.RemoveChildAt(i-1);    
+-    PRUint32 childCount = tmp->mAttrsAndChildren.ChildCount();
+-    if (childCount) {
+-      // Don't allow script to run while we're unbinding everything.
+-      nsAutoScriptBlocker scriptBlocker;
+-      while (childCount-- > 0) {
+-        // Once we have XPCOMGC we shouldn't need to call UnbindFromTree.
+-        // We could probably do a non-deep unbind here when IsInDoc is false
+-        // for better performance.
+-        tmp->mAttrsAndChildren.ChildAt(childCount)->UnbindFromTree();
+-        tmp->mAttrsAndChildren.RemoveChildAt(childCount);
+-      }
 -    }
 -  }  
 -
 -  // Unlink any DOM slots of interest.
 -  {
 -    nsDOMSlots *slots = tmp->GetExistingDOMSlots();
 -    if (slots) {
 -      if (slots->mAttributeMap) {
@@ -651,17 +657,17 @@ diff --git a/content/base/src/nsGenericE
 -NS_IMPL_CYCLE_COLLECTION_TRAVERSE_END
 -
  
  NS_INTERFACE_MAP_BEGIN_CYCLE_COLLECTION(nsGenericElement)
    NS_INTERFACE_MAP_ENTRY(nsIContent)
 diff --git a/content/base/src/nsNodeUtils.cpp b/content/base/src/nsNodeUtils.cpp
 --- a/content/base/src/nsNodeUtils.cpp
 +++ b/content/base/src/nsNodeUtils.cpp
-@@ -385,31 +385,6 @@
+@@ -385,31 +385,6 @@ nsNodeUtils::CallUserDataHandlers(nsCOMA
    return NS_OK;
  }
  
 -static void
 -NoteUserData(void *aObject, nsIAtom *aKey, void *aXPCOMChild, void *aData)
 -{
 -  nsCycleCollectionTraversalCallback* cb =
 -    static_cast<nsCycleCollectionTraversalCallback*>(aData);
@@ -686,17 +692,17 @@ diff --git a/content/base/src/nsNodeUtil
 -}
 -
  /* static */
  nsresult
  nsNodeUtils::CloneNodeImpl(nsINode *aNode, PRBool aDeep, nsIDOMNode **aResult)
 diff --git a/content/base/src/nsNodeUtils.h b/content/base/src/nsNodeUtils.h
 --- a/content/base/src/nsNodeUtils.h
 +++ b/content/base/src/nsNodeUtils.h
-@@ -242,16 +242,6 @@
+@@ -242,16 +242,6 @@ public:
                                         PRUint16 aOperation, PRBool aCloned);
  
    /**
 -   * Helper for the cycle collector to traverse the DOM UserData and
 -   * UserDataHandlers for aNode.
 -   *
 -   * @param aNode the node to traverse UserData and UserDataHandlers for
 -   * @param aCb the cycle collection callback
@@ -706,54 +712,54 @@ diff --git a/content/base/src/nsNodeUtil
 -
 -  /**
     * A basic implementation of the DOM cloneNode method. Calls nsINode::Clone to
     * do the actual cloning of the node.
     *
 diff --git a/content/base/src/nsObjectLoadingContent.cpp b/content/base/src/nsObjectLoadingContent.cpp
 --- a/content/base/src/nsObjectLoadingContent.cpp
 +++ b/content/base/src/nsObjectLoadingContent.cpp
-@@ -1325,12 +1325,6 @@
+@@ -1326,12 +1326,6 @@ nsObjectLoadingContent::RemovedFromDocum
    }
  }
  
 -void
 -nsObjectLoadingContent::Traverse(nsCycleCollectionTraversalCallback &cb)
 -{
 -  cb.NoteXPCOMChild(mFrameLoader);
 -}
 -
  // <private>
  /* static */ PRBool
  nsObjectLoadingContent::IsSuccessfulRequest(nsIRequest* aRequest)
 diff --git a/content/base/src/nsXMLHttpRequest.cpp b/content/base/src/nsXMLHttpRequest.cpp
 --- a/content/base/src/nsXMLHttpRequest.cpp
 +++ b/content/base/src/nsXMLHttpRequest.cpp
-@@ -1670,7 +1670,7 @@
+@@ -1663,7 +1663,7 @@ nsXMLHttpRequest::RequestCompleted()
      ChangeState(XML_HTTP_REQUEST_OPENED);
    }
  
 -  nsJSContext::MaybeCC(PR_FALSE);
 +  nsJSContext::MaybeCC();
    return rv;
  }
  
-@@ -2194,7 +2194,7 @@
+@@ -2187,7 +2187,7 @@ nsXMLHttpRequest::Error(nsIDOMEvent* aEv
      NotifyEventListeners(errorEventListeners, event);
    }
  
 -  nsJSContext::MaybeCC(PR_FALSE);
 +  nsJSContext::MaybeCC();
    return NS_OK;
  }
  
 diff --git a/content/events/src/nsDOMDataContainerEvent.cpp b/content/events/src/nsDOMDataContainerEvent.cpp
 --- a/content/events/src/nsDOMDataContainerEvent.cpp
 +++ b/content/events/src/nsDOMDataContainerEvent.cpp
-@@ -49,17 +49,6 @@
+@@ -49,17 +49,6 @@ nsDOMDataContainerEvent::nsDOMDataContai
  
  NS_IMPL_CYCLE_COLLECTION_CLASS(nsDOMDataContainerEvent)
  
 -NS_IMPL_CYCLE_COLLECTION_UNLINK_BEGIN_INHERITED(nsDOMDataContainerEvent,
 -                                                nsDOMEvent)
 -  if (tmp->mData.IsInitialized())
 -    tmp->mData.Clear();
 -NS_IMPL_CYCLE_COLLECTION_UNLINK_END
@@ -761,17 +767,17 @@ diff --git a/content/events/src/nsDOMDat
 -NS_IMPL_CYCLE_COLLECTION_TRAVERSE_BEGIN_INHERITED(nsDOMDataContainerEvent,
 -                                                  nsDOMEvent)
 -  tmp->mData.EnumerateRead(TraverseEntry, &cb);
 -NS_IMPL_CYCLE_COLLECTION_TRAVERSE_END
 -
  NS_IMPL_ADDREF_INHERITED(nsDOMDataContainerEvent, nsDOMEvent)
  NS_IMPL_RELEASE_INHERITED(nsDOMDataContainerEvent, nsDOMEvent)
  
-@@ -104,15 +93,3 @@
+@@ -104,15 +93,3 @@ NS_NewDOMDataContainerEvent(nsIDOMEvent*
    return CallQueryInterface(it, aInstancePtrResult);
  }
  
 -PLDHashOperator
 -nsDOMDataContainerEvent::TraverseEntry(const nsAString& aKey,
 -                                       nsIVariant *aDataItem,
 -                                       void* aUserArg)
 -{
@@ -780,30 +786,30 @@ diff --git a/content/events/src/nsDOMDat
 -  cb->NoteXPCOMChild(aDataItem);
 -
 -  return PL_DHASH_NEXT;
 -}
 -
 diff --git a/content/events/src/nsDOMDataContainerEvent.h b/content/events/src/nsDOMDataContainerEvent.h
 --- a/content/events/src/nsDOMDataContainerEvent.h
 +++ b/content/events/src/nsDOMDataContainerEvent.h
-@@ -57,9 +57,6 @@
+@@ -57,9 +57,6 @@ public:
    NS_DECL_NSIDOMDATACONTAINEREVENT
  
  private:
 -  static PLDHashOperator PR_CALLBACK
 -    TraverseEntry(const nsAString& aKey, nsIVariant *aDataItem, void* aUserArg);
 -
    nsInterfaceHashtable<nsStringHashKey, nsIVariant> mData;
  };
  
 diff --git a/content/events/src/nsDOMEvent.cpp b/content/events/src/nsDOMEvent.cpp
 --- a/content/events/src/nsDOMEvent.cpp
 +++ b/content/events/src/nsDOMEvent.cpp
-@@ -155,59 +155,6 @@
+@@ -155,59 +155,6 @@ NS_INTERFACE_MAP_END
  
  NS_IMPL_CYCLE_COLLECTING_ADDREF(nsDOMEvent)
  NS_IMPL_CYCLE_COLLECTING_RELEASE(nsDOMEvent)
 -
 -NS_IMPL_CYCLE_COLLECTION_UNLINK_BEGIN(nsDOMEvent)
 -  if (tmp->mEventIsInternal) {
 -    tmp->mEvent->target = nsnull;
 -    tmp->mEvent->currentTarget = nsnull;
@@ -856,17 +862,17 @@ diff --git a/content/events/src/nsDOMEve
 -  NS_IMPL_CYCLE_COLLECTION_TRAVERSE_NSCOMPTR(mExplicitOriginalTarget)
 -NS_IMPL_CYCLE_COLLECTION_TRAVERSE_END
  
  // nsIDOMEventInterface
  NS_METHOD nsDOMEvent::GetType(nsAString& aType)
 diff --git a/content/events/src/nsEventListenerManager.cpp b/content/events/src/nsEventListenerManager.cpp
 --- a/content/events/src/nsEventListenerManager.cpp
 +++ b/content/events/src/nsEventListenerManager.cpp
-@@ -388,18 +388,6 @@
+@@ -388,18 +388,6 @@ NS_INTERFACE_MAP_END
  
  NS_IMPL_CYCLE_COLLECTING_ADDREF_AMBIGUOUS(nsEventListenerManager, nsIEventListenerManager)
  NS_IMPL_CYCLE_COLLECTING_RELEASE_AMBIGUOUS(nsEventListenerManager, nsIEventListenerManager)
 -
 -NS_IMPL_CYCLE_COLLECTION_TRAVERSE_BEGIN(nsEventListenerManager)
 -  PRUint32 count = tmp->mListeners.Length();
 -  for (PRUint32 i = 0; i < count; i++) {
 -    cb.NoteXPCOMChild(tmp->mListeners.ElementAt(i).mListener.get());
@@ -878,17 +884,17 @@ diff --git a/content/events/src/nsEventL
 -NS_IMPL_CYCLE_COLLECTION_UNLINK_END
 -
  
  const EventTypeData*
  nsEventListenerManager::GetTypeDataForIID(const nsIID& aIID)
 diff --git a/content/events/src/nsEventStateManager.cpp b/content/events/src/nsEventStateManager.cpp
 --- a/content/events/src/nsEventStateManager.cpp
 +++ b/content/events/src/nsEventStateManager.cpp
-@@ -677,66 +677,6 @@
+@@ -677,66 +677,6 @@ NS_IMPL_CYCLE_COLLECTING_ADDREF_AMBIGUOU
  NS_IMPL_CYCLE_COLLECTING_ADDREF_AMBIGUOUS(nsEventStateManager, nsIEventStateManager)
  NS_IMPL_CYCLE_COLLECTING_RELEASE_AMBIGUOUS(nsEventStateManager, nsIEventStateManager)
  
 -PR_STATIC_CALLBACK(PRBool)
 -TraverseAccessKeyContent(nsHashKey *aKey, void *aData, void* aClosure)
 -{
 -  nsCycleCollectionTraversalCallback *cb =
 -    static_cast<nsCycleCollectionTraversalCallback*>(aClosure);
@@ -948,17 +954,17 @@ diff --git a/content/events/src/nsEventS
 -
 -
  NS_IMETHODIMP
  nsEventStateManager::PreHandleEvent(nsPresContext* aPresContext,
                                      nsEvent *aEvent,
 diff --git a/content/html/content/src/nsHTMLFormElement.cpp b/content/html/content/src/nsHTMLFormElement.cpp
 --- a/content/html/content/src/nsHTMLFormElement.cpp
 +++ b/content/html/content/src/nsHTMLFormElement.cpp
-@@ -525,25 +525,6 @@
+@@ -527,25 +527,6 @@ nsHTMLFormElement::Init()
  
  
  // nsISupports
 -
 -PR_STATIC_CALLBACK(PLDHashOperator)
 -ElementTraverser(const nsAString& key, nsIDOMHTMLInputElement* element,
 -                 void* userArg)
 -{
@@ -974,17 +980,17 @@ diff --git a/content/html/content/src/ns
 -                                                  nsGenericHTMLElement)
 -  NS_IMPL_CYCLE_COLLECTION_TRAVERSE_NSCOMPTR_AMBIGUOUS(mControls,
 -                                                       nsIDOMHTMLCollection)
 -  tmp->mSelectedRadioButtons.EnumerateRead(ElementTraverser, &cb);
 -NS_IMPL_CYCLE_COLLECTION_TRAVERSE_END
  
  NS_IMPL_ADDREF_INHERITED(nsHTMLFormElement, nsGenericElement) 
  NS_IMPL_RELEASE_INHERITED(nsHTMLFormElement, nsGenericElement) 
-@@ -2076,23 +2057,7 @@
+@@ -2078,23 +2059,7 @@ nsFormControlList::FlushPendingNotificat
    }
  }
  
 -PR_STATIC_CALLBACK(PLDHashOperator)
 -ControlTraverser(const nsAString& key, nsISupports* control, void* userArg)
 -{
 -  nsCycleCollectionTraversalCallback *cb = 
 -    static_cast<nsCycleCollectionTraversalCallback*>(userArg);
@@ -1001,45 +1007,45 @@ diff --git a/content/html/content/src/ns
 -  tmp->mNameLookupTable.EnumerateRead(ControlTraverser, &cb);
 -NS_IMPL_CYCLE_COLLECTION_TRAVERSE_END
  
  // XPConnect interface list for nsFormControlList
  NS_INTERFACE_TABLE_HEAD(nsFormControlList)
 diff --git a/content/html/content/src/nsHTMLObjectElement.cpp b/content/html/content/src/nsHTMLObjectElement.cpp
 --- a/content/html/content/src/nsHTMLObjectElement.cpp
 +++ b/content/html/content/src/nsHTMLObjectElement.cpp
-@@ -158,10 +158,6 @@
+@@ -158,10 +158,6 @@ nsHTMLObjectElement::DoneAddingChildren(
  }
  
  NS_IMPL_CYCLE_COLLECTION_CLASS(nsHTMLObjectElement)
 -NS_IMPL_CYCLE_COLLECTION_TRAVERSE_BEGIN_INHERITED(nsHTMLObjectElement,
 -                                                  nsGenericHTMLFormElement)
 -  tmp->Traverse(cb);
 -NS_IMPL_CYCLE_COLLECTION_TRAVERSE_END
  
  NS_IMPL_ADDREF_INHERITED(nsHTMLObjectElement, nsGenericElement) 
  NS_IMPL_RELEASE_INHERITED(nsHTMLObjectElement, nsGenericElement) 
 diff --git a/content/html/content/src/nsHTMLSharedObjectElement.cpp b/content/html/content/src/nsHTMLSharedObjectElement.cpp
 --- a/content/html/content/src/nsHTMLSharedObjectElement.cpp
 +++ b/content/html/content/src/nsHTMLSharedObjectElement.cpp
-@@ -202,10 +202,6 @@
+@@ -202,10 +202,6 @@ nsHTMLSharedObjectElement::DoneAddingChi
  }
  
  NS_IMPL_CYCLE_COLLECTION_CLASS(nsHTMLSharedObjectElement)
 -NS_IMPL_CYCLE_COLLECTION_TRAVERSE_BEGIN_INHERITED(nsHTMLSharedObjectElement,
 -                                                  nsGenericHTMLElement)
 -  tmp->Traverse(cb);
 -NS_IMPL_CYCLE_COLLECTION_TRAVERSE_END
  
  NS_IMPL_ADDREF_INHERITED(nsHTMLSharedObjectElement, nsGenericElement) 
  NS_IMPL_RELEASE_INHERITED(nsHTMLSharedObjectElement, nsGenericElement) 
 diff --git a/content/html/document/src/nsHTMLDocument.cpp b/content/html/document/src/nsHTMLDocument.cpp
 --- a/content/html/document/src/nsHTMLDocument.cpp
 +++ b/content/html/document/src/nsHTMLDocument.cpp
-@@ -379,40 +379,6 @@
+@@ -380,40 +380,6 @@ nsHTMLDocument::~nsHTMLDocument()
  }
  
  NS_IMPL_CYCLE_COLLECTION_CLASS(nsHTMLDocument)
 -
 -PR_STATIC_CALLBACK(PLDHashOperator)
 -IdAndNameMapEntryTraverse(PLDHashTable *table, PLDHashEntryHdr *hdr,
 -                          PRUint32 number, void *arg)
 -{
@@ -1073,17 +1079,17 @@ diff --git a/content/html/document/src/n
 -                                                       nsIDOMNodeList)
 -NS_IMPL_CYCLE_COLLECTION_TRAVERSE_END
  
  NS_IMPL_ADDREF_INHERITED(nsHTMLDocument, nsDocument)
  NS_IMPL_RELEASE_INHERITED(nsHTMLDocument, nsDocument)
 diff --git a/content/html/document/src/nsHTMLFragmentContentSink.cpp b/content/html/document/src/nsHTMLFragmentContentSink.cpp
 --- a/content/html/document/src/nsHTMLFragmentContentSink.cpp
 +++ b/content/html/document/src/nsHTMLFragmentContentSink.cpp
-@@ -238,27 +238,6 @@
+@@ -238,27 +238,6 @@ NS_INTERFACE_MAP_BEGIN_CYCLE_COLLECTION(
    NS_INTERFACE_MAP_ENTRY(nsIContentSink)
    NS_INTERFACE_MAP_ENTRY_AMBIGUOUS(nsISupports, nsIContentSink)
  NS_INTERFACE_MAP_END
 -
 -NS_IMPL_CYCLE_COLLECTION_CLASS(nsHTMLFragmentContentSink)
 -NS_IMPL_CYCLE_COLLECTION_UNLINK_BEGIN(nsHTMLFragmentContentSink)
 -  NS_IMPL_CYCLE_COLLECTION_UNLINK_NSCOMPTR(mParser)
 -  NS_IMPL_CYCLE_COLLECTION_UNLINK_NSCOMPTR(mTargetDocument)
@@ -1104,57 +1110,58 @@ diff --git a/content/html/document/src/n
 -  }
 -NS_IMPL_CYCLE_COLLECTION_TRAVERSE_END
  
  NS_IMETHODIMP
  nsHTMLFragmentContentSink::WillBuildModel(void)
 diff --git a/content/svg/content/src/nsSVGUseElement.cpp b/content/svg/content/src/nsSVGUseElement.cpp
 --- a/content/svg/content/src/nsSVGUseElement.cpp
 +++ b/content/svg/content/src/nsSVGUseElement.cpp
-@@ -61,20 +61,6 @@
+@@ -61,21 +61,6 @@ NS_IMPL_NS_NEW_SVG_ELEMENT(Use)
  
  //----------------------------------------------------------------------
  // nsISupports methods
 -
 -NS_IMPL_CYCLE_COLLECTION_CLASS(nsSVGUseElement)
 -NS_IMPL_CYCLE_COLLECTION_UNLINK_BEGIN_INHERITED(nsSVGUseElement,
 -                                                nsSVGUseElementBase)
+-  nsAutoScriptBlocker scriptBlocker;
 -  NS_IMPL_CYCLE_COLLECTION_UNLINK_NSCOMPTR(mOriginal)
 -  tmp->DestroyAnonymousContent();
 -  tmp->RemoveListener();
 -NS_IMPL_CYCLE_COLLECTION_UNLINK_END
 -NS_IMPL_CYCLE_COLLECTION_TRAVERSE_BEGIN_INHERITED(nsSVGUseElement,
 -                                                  nsSVGUseElementBase)
 -  NS_IMPL_CYCLE_COLLECTION_TRAVERSE_NSCOMPTR(mOriginal)
 -  NS_IMPL_CYCLE_COLLECTION_TRAVERSE_NSCOMPTR(mClone)
 -  NS_IMPL_CYCLE_COLLECTION_TRAVERSE_NSCOMPTR(mSourceContent)
 -NS_IMPL_CYCLE_COLLECTION_TRAVERSE_END
  
  NS_IMPL_ADDREF_INHERITED(nsSVGUseElement,nsSVGUseElementBase)
  NS_IMPL_RELEASE_INHERITED(nsSVGUseElement,nsSVGUseElementBase)
 diff --git a/content/xbl/src/nsBindingManager.cpp b/content/xbl/src/nsBindingManager.cpp
 --- a/content/xbl/src/nsBindingManager.cpp
 +++ b/content/xbl/src/nsBindingManager.cpp
-@@ -143,15 +143,6 @@
+@@ -143,15 +143,6 @@ NS_INTERFACE_MAP_END
  NS_INTERFACE_MAP_END
  
  NS_IMPL_CYCLE_COLLECTION_UNLINK_0(nsAnonymousContentList)
 -NS_IMPL_CYCLE_COLLECTION_TRAVERSE_BEGIN(nsAnonymousContentList)
 -  {
 -    PRInt32 i, count = tmp->mElements->Length();
 -    for (i = 0; i < count; ++i) {
 -      NS_IMPL_CYCLE_COLLECTION_TRAVERSE_NATIVE_MEMBER(mElements->ElementAt(i),
 -                                                      nsXBLInsertionPoint);
 -    }
 -  }
 -NS_IMPL_CYCLE_COLLECTION_TRAVERSE_END
  
  NS_IMETHODIMP
  nsAnonymousContentList::GetLength(PRUint32* aLength)
-@@ -326,72 +317,6 @@
+@@ -326,72 +317,6 @@ SetOrRemoveObject(PLDHashTable& table, n
  // Static member variable initialization
  
  // Implement our nsISupports methods
 -
 -NS_IMPL_CYCLE_COLLECTION_UNLINK_BEGIN(nsBindingManager)
 -  tmp->mDestroyed = PR_TRUE;
 -
 -  if (tmp->mBindingTable.IsInitialized())
@@ -1217,17 +1224,17 @@ diff --git a/content/xbl/src/nsBindingMa
 -  NS_IMPL_CYCLE_COLLECTION_TRAVERSE_NSTARRAY_MEMBER(mAttachedStack,
 -                                                    nsXBLBinding)
 -  // No need to traverse mProcessAttachedQueueEvent, since it'll just
 -  // fire at some point.
 -NS_IMPL_CYCLE_COLLECTION_TRAVERSE_END
  
  NS_IMPL_CYCLE_COLLECTION_CLASS(nsBindingManager)
  
-@@ -1474,57 +1399,6 @@
+@@ -1474,57 +1399,6 @@ nsBindingManager::DropDocumentReference(
  }
  
  void
 -nsBindingManager::Traverse(nsIContent *aContent,
 -                           nsCycleCollectionTraversalCallback &cb)
 -{
 -  if (!aContent->HasFlag(NODE_MAY_BE_IN_BINDING_MNGR)) {
 -    return;
@@ -1278,30 +1285,30 @@ diff --git a/content/xbl/src/nsBindingMa
 -
 -void
  nsBindingManager::BeginOutermostUpdate()
  {
    mAttachedStackSizeOnOutermost = mAttachedStack.Length();
 diff --git a/content/xbl/src/nsBindingManager.h b/content/xbl/src/nsBindingManager.h
 --- a/content/xbl/src/nsBindingManager.h
 +++ b/content/xbl/src/nsBindingManager.h
-@@ -189,9 +189,6 @@
+@@ -189,9 +189,6 @@ public:
                       RuleProcessorData* aData,
                       PRBool* aCutOffInheritance);
  
 -  NS_HIDDEN_(void) Traverse(nsIContent *aContent,
 -                            nsCycleCollectionTraversalCallback &cb);
 -
    NS_DECL_CYCLE_COLLECTION_CLASS(nsBindingManager)
  
    // Notify the binding manager when an outermost update begins and
 diff --git a/content/xbl/src/nsXBLBinding.cpp b/content/xbl/src/nsXBLBinding.cpp
 --- a/content/xbl/src/nsXBLBinding.cpp
 +++ b/content/xbl/src/nsXBLBinding.cpp
-@@ -286,38 +286,6 @@
+@@ -286,38 +286,6 @@ nsXBLBinding::~nsXBLBinding(void)
    nsIXBLDocumentInfo* info = mPrototypeBinding->XBLDocumentInfo();
    NS_RELEASE(info);
  }
 -
 -PR_STATIC_CALLBACK(PLDHashOperator)
 -TraverseKey(nsISupports* aKey, nsInsertionPointList* aData, void* aClosure)
 -{
 -  nsCycleCollectionTraversalCallback &cb = 
@@ -1333,17 +1340,17 @@ diff --git a/content/xbl/src/nsXBLBindin
 -NS_IMPL_CYCLE_COLLECTION_ROOT_NATIVE(nsXBLBinding, AddRef)
 -NS_IMPL_CYCLE_COLLECTION_UNROOT_NATIVE(nsXBLBinding, Release)
  
  void
  nsXBLBinding::SetBaseBinding(nsXBLBinding* aBinding)
 diff --git a/content/xbl/src/nsXBLDocumentInfo.cpp b/content/xbl/src/nsXBLDocumentInfo.cpp
 --- a/content/xbl/src/nsXBLDocumentInfo.cpp
 +++ b/content/xbl/src/nsXBLDocumentInfo.cpp
-@@ -434,64 +434,6 @@
+@@ -434,64 +434,6 @@ static PRBool IsChromeURI(nsIURI* aURI)
  
  /* Implementation file */
  
 -static PRIntn PR_CALLBACK
 -TraverseProtos(nsHashKey *aKey, void *aData, void* aClosure)
 -{
 -  nsCycleCollectionTraversalCallback *cb = 
 -    static_cast<nsCycleCollectionTraversalCallback*>(aClosure);
@@ -1401,17 +1408,17 @@ diff --git a/content/xbl/src/nsXBLDocume
 -NS_IMPL_CYCLE_COLLECTION_TRACE_END
 -
  NS_INTERFACE_MAP_BEGIN_CYCLE_COLLECTION(nsXBLDocumentInfo)
    NS_INTERFACE_MAP_ENTRY(nsIXBLDocumentInfo)
    NS_INTERFACE_MAP_ENTRY(nsIScriptGlobalObjectOwner)
 diff --git a/content/xbl/src/nsXBLProtoImpl.cpp b/content/xbl/src/nsXBLProtoImpl.cpp
 --- a/content/xbl/src/nsXBLProtoImpl.cpp
 +++ b/content/xbl/src/nsXBLProtoImpl.cpp
-@@ -212,30 +212,6 @@
+@@ -212,30 +212,6 @@ nsXBLProtoImpl::CompilePrototypeMembers(
    return NS_OK;
  }
  
 -void
 -nsXBLProtoImpl::Trace(TraceCallback aCallback, void *aClosure) const
 -{
 -  // If we don't have a class object then we either didn't compile members
 -  // or we only have fields, in both cases there are no cycles through our
@@ -1435,42 +1442,42 @@ diff --git a/content/xbl/src/nsXBLProtoI
 -}
 -
  nsXBLProtoImplField*
  nsXBLProtoImpl::FindField(const nsString& aFieldName) const
  {
 diff --git a/content/xbl/src/nsXBLProtoImpl.h b/content/xbl/src/nsXBLProtoImpl.h
 --- a/content/xbl/src/nsXBLProtoImpl.h
 +++ b/content/xbl/src/nsXBLProtoImpl.h
-@@ -88,9 +88,6 @@
+@@ -88,9 +88,6 @@ public:
      mFields = aFieldList;
    }
  
 -  void Trace(TraceCallback aCallback, void *aClosure) const;
 -  void UnlinkJSObjects();
 -
    nsXBLProtoImplField* FindField(const nsString& aFieldName) const;
  
    // Resolve all the fields for this implementation on the object |obj| False
 diff --git a/content/xbl/src/nsXBLProtoImplMember.h b/content/xbl/src/nsXBLProtoImplMember.h
 --- a/content/xbl/src/nsXBLProtoImplMember.h
 +++ b/content/xbl/src/nsXBLProtoImplMember.h
-@@ -113,8 +113,6 @@
+@@ -113,8 +113,6 @@ public:
                                   const nsCString& aClassStr,
                                   void* aClassObject)=0;
  
 -  virtual void Trace(TraceCallback aCallback, void *aClosure) const = 0;
 -
  protected:
    friend class nsAutoGCRoot;
    
 diff --git a/content/xbl/src/nsXBLProtoImplMethod.cpp b/content/xbl/src/nsXBLProtoImplMethod.cpp
 --- a/content/xbl/src/nsXBLProtoImplMethod.cpp
 +++ b/content/xbl/src/nsXBLProtoImplMethod.cpp
-@@ -257,14 +257,6 @@
+@@ -257,14 +257,6 @@ nsXBLProtoImplMethod::CompileMember(nsIS
    return NS_OK;
  }
  
 -void
 -nsXBLProtoImplMethod::Trace(TraceCallback aCallback, void *aClosure) const
 -{
 -  if (IsCompiled() && mJSMethodObject) {
 -    aCallback(nsIProgrammingLanguage::JAVASCRIPT, mJSMethodObject, aClosure);
@@ -1478,29 +1485,29 @@ diff --git a/content/xbl/src/nsXBLProtoI
 -}
 -
  nsresult
  nsXBLProtoImplAnonymousMethod::Execute(nsIContent* aBoundElement)
  {
 diff --git a/content/xbl/src/nsXBLProtoImplMethod.h b/content/xbl/src/nsXBLProtoImplMethod.h
 --- a/content/xbl/src/nsXBLProtoImplMethod.h
 +++ b/content/xbl/src/nsXBLProtoImplMethod.h
-@@ -128,8 +128,6 @@
+@@ -128,8 +128,6 @@ public:
                                   const nsCString& aClassStr,
                                   void* aClassObject);
  
 -  virtual void Trace(TraceCallback aCallback, void *aClosure) const;
 -
    PRBool IsCompiled() const
    {
      return !(mUncompiledMethod & BIT_UNCOMPILED);
 diff --git a/content/xbl/src/nsXBLProtoImplProperty.cpp b/content/xbl/src/nsXBLProtoImplProperty.cpp
 --- a/content/xbl/src/nsXBLProtoImplProperty.cpp
 +++ b/content/xbl/src/nsXBLProtoImplProperty.cpp
-@@ -324,15 +324,3 @@
+@@ -324,15 +324,3 @@ nsXBLProtoImplProperty::CompileMember(ns
    
    return rv;
  }
 -
 -void
 -nsXBLProtoImplProperty::Trace(TraceCallback aCallback, void *aClosure) const
 -{
 -  if (mJSAttributes & JSPROP_GETTER) {
@@ -1509,47 +1516,48 @@ diff --git a/content/xbl/src/nsXBLProtoI
 -
 -  if (mJSAttributes & JSPROP_SETTER) {
 -    aCallback(nsIProgrammingLanguage::JAVASCRIPT, mJSSetterObject, aClosure);
 -  }
 -}
 diff --git a/content/xbl/src/nsXBLProtoImplProperty.h b/content/xbl/src/nsXBLProtoImplProperty.h
 --- a/content/xbl/src/nsXBLProtoImplProperty.h
 +++ b/content/xbl/src/nsXBLProtoImplProperty.h
-@@ -71,8 +71,6 @@
+@@ -71,8 +71,6 @@ public:
                                   const nsCString& aClassStr,
                                   void* aClassObject);
  
 -  virtual void Trace(TraceCallback aCallback, void *aClosure) const;
 -
  protected:
    union {
      // The raw text for the getter (prior to compilation).
 diff --git a/content/xbl/src/nsXBLPrototypeBinding.cpp b/content/xbl/src/nsXBLPrototypeBinding.cpp
 --- a/content/xbl/src/nsXBLPrototypeBinding.cpp
 +++ b/content/xbl/src/nsXBLPrototypeBinding.cpp
-@@ -244,17 +244,6 @@
+@@ -245,18 +245,6 @@ PRUint32 nsXBLInsertionPointEntry::gRefC
  PRUint32 nsXBLInsertionPointEntry::gRefCnt = 0;
  nsFixedSizeAllocator* nsXBLInsertionPointEntry::kPool;
  
 -NS_IMPL_CYCLE_COLLECTION_CLASS(nsXBLInsertionPointEntry)
 -NS_IMPL_CYCLE_COLLECTION_UNLINK_BEGIN_NATIVE(nsXBLInsertionPointEntry)
 -  NS_IMPL_CYCLE_COLLECTION_UNLINK_NSCOMPTR(mInsertionParent)
 -  if (tmp->mDefaultContent) {
+-    nsAutoScriptBlocker scriptBlocker;
 -    // mDefaultContent is a sort of anonymous content within the XBL
 -    // document, and we own and manage it.  Unhook it here, since we're going
 -    // away.
 -    tmp->mDefaultContent->UnbindFromTree();
 -    tmp->mDefaultContent = nsnull;
 -  }      
 -NS_IMPL_CYCLE_COLLECTION_UNLINK_END
  NS_IMPL_CYCLE_COLLECTION_TRAVERSE_NATIVE_BEGIN(nsXBLInsertionPointEntry)
    NS_IMPL_CYCLE_COLLECTION_TRAVERSE_NSCOMPTR(mInsertionParent)
    NS_IMPL_CYCLE_COLLECTION_TRAVERSE_NSCOMPTR(mDefaultContent)
-@@ -328,54 +317,6 @@
+@@ -330,54 +318,6 @@ nsXBLPrototypeBinding::Init(const nsACSt
  
    SetBindingElement(aElement);
    return NS_OK;
 -}
 -
 -PR_STATIC_CALLBACK(PRIntn)
 -TraverseInsertionPoint(nsHashKey* aKey, void* aData, void* aClosure)
 -{
@@ -1597,31 +1605,31 @@ diff --git a/content/xbl/src/nsXBLProtot
 -  if (mImplementation)
 -    mImplementation->Trace(aCallback, aClosure);
  }
  
  void
 diff --git a/content/xbl/src/nsXBLPrototypeBinding.h b/content/xbl/src/nsXBLPrototypeBinding.h
 --- a/content/xbl/src/nsXBLPrototypeBinding.h
 +++ b/content/xbl/src/nsXBLPrototypeBinding.h
-@@ -196,10 +196,6 @@
+@@ -196,10 +196,6 @@ public:
                  nsIXBLDocumentInfo* aInfo,
                  nsIContent* aElement);
  
 -  void Traverse(nsCycleCollectionTraversalCallback &cb) const;
 -  void UnlinkJSObjects();
 -  void Trace(TraceCallback aCallback, void *aClosure) const;
 -
  // Static members
    static PRUint32 gRefCnt;
   
 diff --git a/content/xml/document/src/nsXMLContentSink.cpp b/content/xml/document/src/nsXMLContentSink.cpp
 --- a/content/xml/document/src/nsXMLContentSink.cpp
 +++ b/content/xml/document/src/nsXMLContentSink.cpp
-@@ -188,18 +188,6 @@
+@@ -189,18 +189,6 @@ NS_INTERFACE_MAP_END_INHERITING(nsConten
  
  NS_IMPL_ADDREF_INHERITED(nsXMLContentSink, nsContentSink)
  NS_IMPL_RELEASE_INHERITED(nsXMLContentSink, nsContentSink)
 -
 -NS_IMPL_CYCLE_COLLECTION_CLASS(nsXMLContentSink)
 -
 -NS_IMPL_CYCLE_COLLECTION_TRAVERSE_BEGIN_INHERITED(nsXMLContentSink,
 -                                                  nsContentSink)
@@ -1633,17 +1641,17 @@ diff --git a/content/xml/document/src/ns
 -  }
 -NS_IMPL_CYCLE_COLLECTION_TRAVERSE_END
  
  // nsIContentSink
  NS_IMETHODIMP
 diff --git a/content/xslt/src/xpath/nsXPathResult.cpp b/content/xslt/src/xpath/nsXPathResult.cpp
 --- a/content/xslt/src/xpath/nsXPathResult.cpp
 +++ b/content/xslt/src/xpath/nsXPathResult.cpp
-@@ -76,18 +76,6 @@
+@@ -76,18 +76,6 @@ nsXPathResult::~nsXPathResult()
  {
      RemoveObserver();
  }
 -
 -NS_IMPL_CYCLE_COLLECTION_CLASS(nsXPathResult)
 -NS_IMPL_CYCLE_COLLECTION_UNLINK_BEGIN(nsXPathResult)
 -    {
 -        tmp->RemoveObserver();
@@ -1655,17 +1663,17 @@ diff --git a/content/xslt/src/xpath/nsXP
 -    NS_IMPL_CYCLE_COLLECTION_TRAVERSE_NSCOMARRAY(mResultNodes)
 -NS_IMPL_CYCLE_COLLECTION_TRAVERSE_END
  
  NS_IMPL_CYCLE_COLLECTING_ADDREF_AMBIGUOUS(nsXPathResult, nsIDOMXPathResult)
  NS_IMPL_CYCLE_COLLECTING_RELEASE_AMBIGUOUS(nsXPathResult, nsIDOMXPathResult)
 diff --git a/content/xslt/src/xslt/txMozillaXSLTProcessor.cpp b/content/xslt/src/xslt/txMozillaXSLTProcessor.cpp
 --- a/content/xslt/src/xslt/txMozillaXSLTProcessor.cpp
 +++ b/content/xslt/src/xslt/txMozillaXSLTProcessor.cpp
-@@ -291,23 +291,6 @@
+@@ -291,23 +291,6 @@ private:
  /**
   * txMozillaXSLTProcessor
   */
 -
 -NS_IMPL_CYCLE_COLLECTION_CLASS(txMozillaXSLTProcessor)
 -NS_IMPL_CYCLE_COLLECTION_UNLINK_BEGIN(txMozillaXSLTProcessor)
 -    NS_IMPL_CYCLE_COLLECTION_UNLINK_NSCOMPTR(mEmbeddedStylesheetRoot)
 -    NS_IMPL_CYCLE_COLLECTION_UNLINK_NSCOMPTR(mSource)
@@ -1682,58 +1690,58 @@ diff --git a/content/xslt/src/xslt/txMoz
 -    }
 -NS_IMPL_CYCLE_COLLECTION_TRAVERSE_END
  
  NS_IMPL_CYCLE_COLLECTING_ADDREF(txMozillaXSLTProcessor)
  NS_IMPL_CYCLE_COLLECTING_RELEASE(txMozillaXSLTProcessor)
 diff --git a/content/xul/content/src/nsXULElement.cpp b/content/xul/content/src/nsXULElement.cpp
 --- a/content/xul/content/src/nsXULElement.cpp
 +++ b/content/xul/content/src/nsXULElement.cpp
-@@ -386,11 +386,6 @@
+@@ -387,11 +387,6 @@ nsXULElement::QueryInterface(REFNSIID aI
  {
      NS_PRECONDITION(aInstancePtr, "null out param");
  
 -    if (aIID.Equals(NS_GET_IID(nsXPCOMCycleCollectionParticipant))) {
 -      *aInstancePtr = &NS_CYCLE_COLLECTION_NAME(nsXULElement);
 -      return NS_OK;
 -    }
 -
      nsresult rv = nsGenericElement::QueryInterface(aIID, aInstancePtr);
      if (NS_SUCCEEDED(rv))
          return rv;
-@@ -710,12 +705,6 @@
+@@ -711,12 +706,6 @@ nsXULElement::PerformAccesskey(PRBool aK
  // nsIScriptEventHandlerOwner interface
  
  NS_IMPL_CYCLE_COLLECTION_CLASS(nsScriptEventHandlerOwnerTearoff)
 -NS_IMPL_CYCLE_COLLECTION_UNLINK_BEGIN(nsScriptEventHandlerOwnerTearoff)
 -  tmp->mElement = nsnull;
 -NS_IMPL_CYCLE_COLLECTION_UNLINK_END
 -NS_IMPL_CYCLE_COLLECTION_TRAVERSE_BEGIN(nsScriptEventHandlerOwnerTearoff)
 -  cb.NoteXPCOMChild(static_cast<nsIContent*>(tmp->mElement));
 -NS_IMPL_CYCLE_COLLECTION_TRAVERSE_END
  
  NS_INTERFACE_MAP_BEGIN_CYCLE_COLLECTION(nsScriptEventHandlerOwnerTearoff)
    NS_INTERFACE_MAP_ENTRY(nsIScriptEventHandlerOwner)
-@@ -817,15 +806,6 @@
+@@ -818,15 +807,6 @@ nsScriptEventHandlerOwnerTearoff::Compil
          // take a copy of the event handler, and tell the language about it.
          if (aHandler) {
              NS_ASSERTION(!attr->mEventHandler, "Leaking handler.");
 -
 -            rv = nsContentUtils::HoldScriptObject(aContext->GetScriptTypeID(),
 -                                                  elem,
 -                                                  &NS_CYCLE_COLLECTION_NAME(nsXULPrototypeNode),
 -                                                  aHandler,
 -                                                  elem->mHoldsScriptObject);
 -            if (NS_FAILED(rv)) return rv;
 -
 -            elem->mHoldsScriptObject = PR_TRUE;
          }
          attr->mEventHandler = (void *)aHandler;
      }
-@@ -2540,62 +2520,6 @@
+@@ -2543,62 +2523,6 @@ nsXULElement::RecompileScriptEventListen
      }
  }
  
 -NS_IMPL_CYCLE_COLLECTION_CLASS(nsXULPrototypeNode)
 -NS_IMPL_CYCLE_COLLECTION_UNLINK_BEGIN_NATIVE(nsXULPrototypeNode)
 -    if (tmp->mType == nsXULPrototypeNode::eType_Element) {
 -        static_cast<nsXULPrototypeElement*>(tmp)->Unlink();
 -    }
@@ -1786,17 +1794,17 @@ diff --git a/content/xul/content/src/nsX
 -    }
 -NS_IMPL_CYCLE_COLLECTION_ROOT_END
 -//NS_IMPL_CYCLE_COLLECTION_ROOT_NATIVE(nsXULPrototypeNode, AddRef)
 -NS_IMPL_CYCLE_COLLECTION_UNROOT_NATIVE(nsXULPrototypeNode, Release)
 -
  //----------------------------------------------------------------------
  //
  // nsXULPrototypeAttribute
-@@ -2890,24 +2814,6 @@
+@@ -2893,24 +2817,6 @@ nsXULPrototypeElement::SetAttrAt(PRUint3
      return NS_OK;
  }
  
 -void
 -nsXULPrototypeElement::UnlinkJSObjects()
 -{
 -    if (mHoldsScriptObject) {
 -        nsContentUtils::DropScriptObjects(mScriptTypeID, this,
@@ -1811,79 +1819,79 @@ diff --git a/content/xul/content/src/nsX
 -    mNumAttributes = 0;
 -    delete[] mAttributes;
 -    mAttributes = nsnull;
 -}
 -
  //----------------------------------------------------------------------
  //
  // nsXULPrototypeScript
-@@ -2930,7 +2836,6 @@
+@@ -2933,7 +2839,6 @@ nsXULPrototypeScript::nsXULPrototypeScri
  
  nsXULPrototypeScript::~nsXULPrototypeScript()
  {
 -    UnlinkJSObjects();
  }
  
  nsresult
 diff --git a/content/xul/content/src/nsXULElement.h b/content/xul/content/src/nsXULElement.h
 --- a/content/xul/content/src/nsXULElement.h
 +++ b/content/xul/content/src/nsXULElement.h
-@@ -247,7 +247,6 @@
+@@ -247,7 +247,6 @@ public:
            mHasIdAttribute(PR_FALSE),
            mHasClassAttribute(PR_FALSE),
            mHasStyleAttribute(PR_FALSE),
 -          mHoldsScriptObject(PR_FALSE),
            mScriptTypeID(nsIProgrammingLanguage::UNKNOWN)
      {
          NS_LOG_ADDREF(this, 1, ClassName(), ClassSize());
-@@ -255,8 +254,6 @@
+@@ -255,8 +254,6 @@ public:
  
      virtual ~nsXULPrototypeElement()
      {
 -        UnlinkJSObjects();
 -        Unlink();
          NS_ASSERTION(!mChildren && mNumChildren == 0,
                       "ReleaseSubtree not called");
      }
-@@ -291,9 +288,6 @@
+@@ -291,9 +288,6 @@ public:
  
      nsresult SetAttrAt(PRUint32 aPos, const nsAString& aValue, nsIURI* aDocumentURI);
  
 -    void UnlinkJSObjects();
 -    void Unlink();
 -
      PRUint32                 mNumChildren;
      nsXULPrototypeNode**     mChildren;           // [OWNER]
  
-@@ -305,7 +299,6 @@
+@@ -305,7 +299,6 @@ public:
      PRPackedBool             mHasIdAttribute:1;
      PRPackedBool             mHasClassAttribute:1;
      PRPackedBool             mHasStyleAttribute:1;
 -    PRPackedBool             mHoldsScriptObject:1;
  
      // The language ID can not be set on a per-node basis, but is tracked
      // so that the language ID from the originating root can be used
-@@ -362,15 +355,6 @@
+@@ -362,15 +355,6 @@ public:
                       nsIDocument* aDocument,
                       nsIScriptGlobalObjectOwner* aGlobalOwner);
  
 -    void UnlinkJSObjects()
 -    {
 -        if (mScriptObject.mObject) {
 -            nsContentUtils::DropScriptObjects(mScriptObject.mLangID, this,
 -                                              &NS_CYCLE_COLLECTION_NAME(nsXULPrototypeNode));
 -            mScriptObject.mObject = nsnull;
 -        }
 -    }
 -
      void Set(nsScriptObjectHolder &aHolder)
      {
          NS_ASSERTION(mScriptObject.mLangID == aHolder.getScriptTypeID(),
-@@ -383,13 +367,7 @@
+@@ -383,13 +367,7 @@ public:
      {
          NS_ASSERTION(!mScriptObject.mObject, "Leaking script object.");
  
 -        nsresult rv = nsContentUtils::HoldScriptObject(mScriptObject.mLangID,
 -                                                       this,
 -                                                       &NS_CYCLE_COLLECTION_NAME(nsXULPrototypeNode),
 -                                                       aObject, PR_FALSE);
 -        if (NS_SUCCEEDED(rv)) {
@@ -1891,17 +1899,17 @@ diff --git a/content/xul/content/src/nsX
 -        }
 +        mScriptObject.mObject = aObject;
      }
  
      struct ScriptObjectHolder
 diff --git a/content/xul/document/src/nsXULCommandDispatcher.cpp b/content/xul/document/src/nsXULCommandDispatcher.cpp
 --- a/content/xul/document/src/nsXULCommandDispatcher.cpp
 +++ b/content/xul/document/src/nsXULCommandDispatcher.cpp
-@@ -104,19 +104,6 @@
+@@ -104,19 +104,6 @@ NS_INTERFACE_MAP_END
  
  NS_IMPL_CYCLE_COLLECTING_ADDREF(nsXULCommandDispatcher)
  NS_IMPL_CYCLE_COLLECTING_RELEASE(nsXULCommandDispatcher)
 -
 -NS_IMPL_CYCLE_COLLECTION_UNLINK_BEGIN(nsXULCommandDispatcher)
 -  tmp->Disconnect();
 -NS_IMPL_CYCLE_COLLECTION_UNLINK_END
 -
@@ -1914,17 +1922,17 @@ diff --git a/content/xul/document/src/ns
 -  }
 -NS_IMPL_CYCLE_COLLECTION_TRAVERSE_END
  
  void
  nsXULCommandDispatcher::Disconnect()
 diff --git a/content/xul/document/src/nsXULControllers.cpp b/content/xul/document/src/nsXULControllers.cpp
 --- a/content/xul/document/src/nsXULControllers.cpp
 +++ b/content/xul/document/src/nsXULControllers.cpp
-@@ -98,21 +98,6 @@
+@@ -98,21 +98,6 @@ NS_NewXULControllers(nsISupports* aOuter
  }
  
  NS_IMPL_CYCLE_COLLECTION_CLASS(nsXULControllers)
 -NS_IMPL_CYCLE_COLLECTION_UNLINK_BEGIN(nsXULControllers)
 -  tmp->DeleteControllers();
 -NS_IMPL_CYCLE_COLLECTION_UNLINK_END
 -NS_IMPL_CYCLE_COLLECTION_TRAVERSE_BEGIN(nsXULControllers)
 -  {
@@ -1939,17 +1947,17 @@ diff --git a/content/xul/document/src/ns
 -  }
 -NS_IMPL_CYCLE_COLLECTION_TRAVERSE_END
  
  NS_INTERFACE_MAP_BEGIN_CYCLE_COLLECTION(nsXULControllers)
    NS_INTERFACE_MAP_ENTRY(nsIControllers)
 diff --git a/content/xul/document/src/nsXULDocument.cpp b/content/xul/document/src/nsXULDocument.cpp
 --- a/content/xul/document/src/nsXULDocument.cpp
 +++ b/content/xul/document/src/nsXULDocument.cpp
-@@ -288,73 +288,6 @@
+@@ -288,73 +288,6 @@ NS_NewXULDocument(nsIXULDocument** resul
  
  NS_IMPL_CYCLE_COLLECTION_CLASS(nsXULDocument)
  
 -static PRIntn
 -TraverseElement(const PRUnichar* aID, nsIContent* aElement, void* aContext)
 -{
 -    nsCycleCollectionTraversalCallback *cb =
 -        static_cast<nsCycleCollectionTraversalCallback*>(aContext);
@@ -2016,31 +2024,31 @@ diff --git a/content/xul/document/src/ns
 -NS_IMPL_CYCLE_COLLECTION_TRAVERSE_END
 -
  NS_IMPL_ADDREF_INHERITED(nsXULDocument, nsXMLDocument)
  NS_IMPL_RELEASE_INHERITED(nsXULDocument, nsXMLDocument)
  
 diff --git a/content/xul/document/src/nsXULPrototypeDocument.cpp b/content/xul/document/src/nsXULPrototypeDocument.cpp
 --- a/content/xul/document/src/nsXULPrototypeDocument.cpp
 +++ b/content/xul/document/src/nsXULPrototypeDocument.cpp
-@@ -196,13 +196,6 @@
+@@ -196,13 +196,6 @@ nsXULPrototypeDocument::~nsXULPrototypeD
  
  NS_IMPL_CYCLE_COLLECTION_CLASS(nsXULPrototypeDocument)
  NS_IMPL_CYCLE_COLLECTION_UNLINK_0(nsXULPrototypeDocument)
 -NS_IMPL_CYCLE_COLLECTION_TRAVERSE_BEGIN(nsXULPrototypeDocument)
 -    NS_IMPL_CYCLE_COLLECTION_TRAVERSE_NATIVE_MEMBER(mRoot,
 -                                                    nsXULPrototypeElement)
 -    cb.NoteXPCOMChild(static_cast<nsIScriptGlobalObject*>(tmp->mGlobalObject));
 -    NS_IMPL_CYCLE_COLLECTION_TRAVERSE_NATIVE_MEMBER(mNodeInfoManager,
 -                                                    nsNodeInfoManager)
 -NS_IMPL_CYCLE_COLLECTION_TRAVERSE_END
  
  NS_INTERFACE_MAP_BEGIN_CYCLE_COLLECTION(nsXULPrototypeDocument)
      NS_INTERFACE_MAP_ENTRY(nsIScriptGlobalObjectOwner)
-@@ -628,14 +621,6 @@
+@@ -628,14 +621,6 @@ nsXULPDGlobalObject::~nsXULPDGlobalObjec
  
  NS_IMPL_CYCLE_COLLECTION_CLASS(nsXULPDGlobalObject)
  NS_IMPL_CYCLE_COLLECTION_UNLINK_0(nsXULPDGlobalObject)
 -NS_IMPL_CYCLE_COLLECTION_TRAVERSE_BEGIN(nsXULPDGlobalObject)
 -  {
 -    PRUint32 lang_index;
 -    NS_STID_FOR_INDEX(lang_index) {
 -      cb.NoteXPCOMChild(tmp->mScriptContexts[lang_index]);
@@ -2048,63 +2056,63 @@ diff --git a/content/xul/document/src/ns
 -  }
 -NS_IMPL_CYCLE_COLLECTION_TRAVERSE_END
  
  NS_INTERFACE_MAP_BEGIN_CYCLE_COLLECTION(nsXULPDGlobalObject)
    NS_INTERFACE_MAP_ENTRY(nsIScriptGlobalObject)
 diff --git a/content/xul/templates/src/nsTemplateRule.h b/content/xul/templates/src/nsTemplateRule.h
 --- a/content/xul/templates/src/nsTemplateRule.h
 +++ b/content/xul/templates/src/nsTemplateRule.h
-@@ -225,12 +225,6 @@
+@@ -225,12 +225,6 @@ public:
      nsresult
      AddBindingsToQueryProcessor(nsIXULTemplateQueryProcessor* aProcessor);
  
 -    void Traverse(nsCycleCollectionTraversalCallback &cb) const
 -    {
 -        cb.NoteXPCOMChild(mRuleNode);
 -        cb.NoteXPCOMChild(mAction);
 -    }
 -
  protected:
  
      struct Binding {
 diff --git a/content/xul/templates/src/nsXULContentBuilder.cpp b/content/xul/templates/src/nsXULContentBuilder.cpp
 --- a/content/xul/templates/src/nsXULContentBuilder.cpp
 +++ b/content/xul/templates/src/nsXULContentBuilder.cpp
-@@ -146,11 +146,6 @@
+@@ -147,11 +147,6 @@ protected:
      NS_NewXULContentBuilder(nsISupports* aOuter, REFNSIID aIID, void** aResult);
  
      nsXULContentBuilder();
 -
 -    void Traverse(nsCycleCollectionTraversalCallback &cb) const
 -    {
 -        mSortState.Traverse(cb);
 -    }
  
      virtual void Uninit(PRBool aIsFinal);
  
 diff --git a/content/xul/templates/src/nsXULSortService.h b/content/xul/templates/src/nsXULSortService.h
 --- a/content/xul/templates/src/nsXULSortService.h
 +++ b/content/xul/templates/src/nsXULSortService.h
-@@ -91,11 +91,6 @@
+@@ -91,11 +91,6 @@ struct nsSortState
    nsSortState()
      : initialized(PR_FALSE)
    {
 -  }
 -  void Traverse(nsCycleCollectionTraversalCallback &cb) const
 -  {
 -    cb.NoteXPCOMChild(processor);
 -    cb.NoteXPCOMChild(lastContainer);
    }
  };
  
 diff --git a/content/xul/templates/src/nsXULTemplateBuilder.cpp b/content/xul/templates/src/nsXULTemplateBuilder.cpp
 --- a/content/xul/templates/src/nsXULTemplateBuilder.cpp
 +++ b/content/xul/templates/src/nsXULTemplateBuilder.cpp
-@@ -243,53 +243,12 @@
+@@ -244,53 +244,12 @@ nsXULTemplateBuilder::Uninit(PRBool aIsF
      mQueriesCompiled = PR_FALSE;
  }
  
 -static PLDHashOperator
 -TraverseMatchList(nsISupports* aKey, nsTemplateMatch* aMatch, void* aContext)
 -{
 -    nsCycleCollectionTraversalCallback *cb =
 -        static_cast<nsCycleCollectionTraversalCallback*>(aContext);
@@ -2151,17 +2159,17 @@ diff --git a/content/xul/templates/src/n
 -    tmp->Traverse(cb);
 -NS_IMPL_CYCLE_COLLECTION_TRAVERSE_END
  
  NS_IMPL_CYCLE_COLLECTING_ADDREF_AMBIGUOUS(nsXULTemplateBuilder,
                                            nsIXULTemplateBuilder)
 diff --git a/content/xul/templates/src/nsXULTemplateQueryProcessorRDF.cpp b/content/xul/templates/src/nsXULTemplateQueryProcessorRDF.cpp
 --- a/content/xul/templates/src/nsXULTemplateQueryProcessorRDF.cpp
 +++ b/content/xul/templates/src/nsXULTemplateQueryProcessorRDF.cpp
-@@ -87,66 +87,6 @@
+@@ -87,66 +87,6 @@ nsIRDFResource*           nsXULTemplateQ
  
  NS_IMPL_CYCLE_COLLECTION_CLASS(nsXULTemplateQueryProcessorRDF)
  NS_IMPL_CYCLE_COLLECTION_UNLINK_0(nsXULTemplateQueryProcessorRDF)
 -
 -PR_STATIC_CALLBACK(PLDHashOperator)
 -BindingDependenciesTraverser(nsISupports* key,
 -                             nsCOMArray<nsXULTemplateResultRDF>* array,
 -                             void* userArg)
@@ -2229,28 +2237,28 @@ diff --git a/dom/src/base/nsGlobalWindow
 @@ -79,7 +79,6 @@
  #endif
  #include "nsContentCID.h"
  #include "nsLayoutStatics.h"
 -#include "nsCycleCollector.h"
  #include "nsCCUncollectableMarker.h"
  
  // Interfaces Needed
-@@ -747,10 +746,6 @@
+@@ -747,10 +746,6 @@ nsGlobalWindow::~nsGlobalWindow()
  
    CleanUp();
  
 -#ifdef DEBUG
 -  nsCycleCollector_DEBUG_wasFreed(static_cast<nsIScriptGlobalObject*>(this));
 -#endif
 -
    delete mPendingStorageEvents;
  
    nsLayoutStatics::Release();
-@@ -767,17 +762,6 @@
+@@ -767,17 +762,6 @@ void
  void
  nsGlobalWindow::CleanupCachedXBLHandlers(nsGlobalWindow* aWindow)
  {
 -  if (aWindow->mCachedXBLPrototypeHandlers.IsInitialized() &&
 -      aWindow->mCachedXBLPrototypeHandlers.Count() > 0) {
 -    aWindow->mCachedXBLPrototypeHandlers.Clear();
 -
 -    nsCOMPtr<nsISupports> supports;
@@ -2258,61 +2266,61 @@ diff --git a/dom/src/base/nsGlobalWindow
 -                            getter_AddRefs(supports));
 -    NS_ASSERTION(supports, "Failed to QI to nsCycleCollectionISupports?!");
 -
 -    nsContentUtils::DropJSObjects(supports);
 -  }
  }
  
  void
-@@ -800,9 +784,6 @@
+@@ -800,9 +784,6 @@ nsGlobalWindow::CleanUp()
  
    mOpener = nsnull;             // Forces Release
    if (mContext) {
 -#ifdef DEBUG
 -    nsCycleCollector_DEBUG_shouldBeFreed(mContext);
 -#endif
      mContext = nsnull;            // Forces Release
    }
    mChromeEventHandler = nsnull; // Forces Release
-@@ -826,10 +807,6 @@
+@@ -826,10 +807,6 @@ nsGlobalWindow::CleanUp()
    mArgumentsLast = nsnull;
  
    CleanupCachedXBLHandlers(this);
 -
 -#ifdef DEBUG
 -  nsCycleCollector_DEBUG_shouldBeFreed(static_cast<nsIScriptGlobalObject*>(this));
 -#endif
  }
  
  void
-@@ -872,11 +849,6 @@
+@@ -872,11 +849,6 @@ nsGlobalWindow::FreeInnerObjects(PRBool 
      // Remember the document's principal.
      mDocumentPrincipal = mDoc->NodePrincipal();
    }
 -
 -#ifdef DEBUG
 -  if (mDocument)
 -    nsCycleCollector_DEBUG_shouldBeFreed(nsCOMPtr<nsISupports>(do_QueryInterface(mDocument)));
 -#endif
  
    // Make sure that this is called before we null out the document.
    NotifyDOMWindowDestroyed(this);
-@@ -915,10 +887,6 @@
+@@ -915,10 +887,6 @@ nsGlobalWindow::FreeInnerObjects(PRBool 
  #endif
  
    CleanupCachedXBLHandlers(this);
 -
 -#ifdef DEBUG
 -  nsCycleCollector_DEBUG_shouldBeFreed(static_cast<nsIScriptGlobalObject*>(this));
 -#endif
  }
  
  //*****************************************************************************
-@@ -955,125 +923,6 @@
+@@ -955,125 +923,6 @@ NS_IMPL_CYCLE_COLLECTING_RELEASE_AMBIGUO
  NS_IMPL_CYCLE_COLLECTING_RELEASE_AMBIGUOUS(nsGlobalWindow,
                                             nsIScriptGlobalObject)
  
 -
 -NS_IMPL_CYCLE_COLLECTION_TRAVERSE_BEGIN(nsGlobalWindow)
 -  if (tmp->mDoc && nsCCUncollectableMarker::InGeneration(
 -                     tmp->mDoc->GetMarkedCCGeneration())) {
 -    return NS_OK;
@@ -2428,28 +2436,28 @@ diff --git a/dom/src/base/nsGlobalWindow
 -
 -NS_IMPL_CYCLE_COLLECTION_ROOT_BEGIN(nsGlobalWindow)
 -  nsGlobalWindow::CleanupCachedXBLHandlers(tmp);
 -NS_IMPL_CYCLE_COLLECTION_ROOT_END
 -
  //*****************************************************************************
  // nsGlobalWindow::nsIScriptGlobalObject
  //*****************************************************************************
-@@ -2087,10 +1936,6 @@
+@@ -2087,10 +1936,6 @@ nsGlobalWindow::SetDocShell(nsIDocShell*
          mScriptContexts[st_ndx] = nsnull;
        }
      }
 -#ifdef DEBUG
 -    nsCycleCollector_DEBUG_shouldBeFreed(mContext);
 -    nsCycleCollector_DEBUG_shouldBeFreed(static_cast<nsIScriptGlobalObject*>(this));
 -#endif
      mContext = nsnull; // we nuked it above also
    }
  
-@@ -5704,26 +5549,6 @@
+@@ -5720,26 +5565,6 @@ nsGlobalWindow::CacheXBLPrototypeHandler
      return;
    }
  
 -  if (!mCachedXBLPrototypeHandlers.Count()) {
 -    // Can't use macros to get the participant because nsGlobalChromeWindow also
 -    // runs through this code. Use QueryInterface to get the correct objects.
 -    nsXPCOMCycleCollectionParticipant* participant;
 -    CallQueryInterface(this, &participant);
@@ -2477,86 +2485,86 @@ diff --git a/dom/src/base/nsJSEnvironmen
 @@ -79,7 +79,6 @@
  #include "jscntxt.h"
  #include "nsEventDispatcher.h"
  #include "nsIContent.h"
 -#include "nsCycleCollector.h"
  #include "nsNetUtil.h"
  
  // For locale aware string methods
-@@ -177,10 +176,6 @@
+@@ -177,10 +176,6 @@ static PRUint32 sCCollectCount;
  static PRUint32 sCCollectCount;
  static PRBool sUserIsActive;
  static PRTime sPreviousCCTime;
 -static PRUint32 sCollectedObjectsCounts;
 -static PRUint32 sGCCount;
 -static PRUint32 sCCSuspectChanges;
 -static PRUint32 sCCSuspectedCount;
  static nsITimer *sGCTimer;
  static PRBool sReadyForGC;
  
-@@ -258,7 +253,6 @@
+@@ -258,7 +253,6 @@ nsUserActivityObserver::Observe(nsISuppo
      // we can reset the counter.
      mUserActivityCounter = 0;
    }
 -  PRBool higherProbability = PR_FALSE;
    ++mUserActivityCounter;
    if (!strcmp(aTopic, "user-interaction-inactive")) {
  #ifdef DEBUG_smaug
-@@ -271,13 +265,11 @@
+@@ -271,13 +265,11 @@ nsUserActivityObserver::Observe(nsISuppo
          return NS_OK;
        }
      }
 -    higherProbability = (mUserActivityCounter > NS_CC_SOFT_LIMIT_INACTIVE);
    } else if (!strcmp(aTopic, "user-interaction-active")) {
  #ifdef DEBUG_smaug
      printf("user-interaction-active\n");
  #endif
      sUserIsActive = PR_TRUE;
 -    higherProbability = (mUserActivityCounter > NS_CC_SOFT_LIMIT_ACTIVE);
    } else if (!strcmp(aTopic, "xpcom-shutdown")) {
      nsCOMPtr<nsIObserverService> obs =
        do_GetService("@mozilla.org/observer-service;1");
-@@ -288,7 +280,7 @@
+@@ -288,7 +280,7 @@ nsUserActivityObserver::Observe(nsISuppo
      }
      return NS_OK;
    }
 -  nsJSContext::MaybeCC(higherProbability);
 +  nsJSContext::MaybeCC();
    return NS_OK;
  }
  
-@@ -1172,9 +1164,6 @@
+@@ -1172,9 +1164,6 @@ nsJSContext::nsJSContext(JSRuntime *aRun
  
  nsJSContext::~nsJSContext()
  {
 -#ifdef DEBUG
 -  nsCycleCollector_DEBUG_wasFreed(static_cast<nsIScriptContext*>(this));
 -#endif
    NS_PRECONDITION(!mTerminations, "Shouldn't have termination funcs by now");
  
    Unlink();
-@@ -1226,16 +1215,6 @@
+@@ -1226,16 +1215,6 @@ nsJSContext::Unlink()
  }
  
  // QueryInterface implementation for nsJSContext
 -NS_IMPL_CYCLE_COLLECTION_CLASS(nsJSContext)
 -NS_IMPL_CYCLE_COLLECTION_UNLINK_BEGIN(nsJSContext)
 -  NS_IMPL_CYCLE_COLLECTION_UNLINK_NSCOMPTR(mGlobalWrapperRef)
 -  tmp->Unlink();
 -  tmp->mIsInitialized = PR_FALSE;
 -NS_IMPL_CYCLE_COLLECTION_UNLINK_END
 -NS_IMPL_CYCLE_COLLECTION_TRAVERSE_BEGIN(nsJSContext)
 -  NS_IMPL_CYCLE_COLLECTION_TRAVERSE_NSCOMPTR(mGlobalWrapperRef)
 -  nsContentUtils::XPConnect()->NoteJSContext(tmp->mContext, cb);
 -NS_IMPL_CYCLE_COLLECTION_TRAVERSE_END
  
  NS_INTERFACE_MAP_BEGIN_CYCLE_COLLECTION(nsJSContext)
    NS_INTERFACE_MAP_ENTRY(nsIScriptContext)
-@@ -3317,77 +3296,15 @@
+@@ -3317,77 +3296,15 @@ nsJSContext::CC()
  nsJSContext::CC()
  {
    ++sCCollectCount;
 -#ifdef DEBUG_smaug
 -  printf("Will run cycle collector (%i), %lldms since previous.\n",
 -         sCCollectCount, (PR_Now() - sPreviousCCTime) / PR_USEC_PER_MSEC);
 -#endif
 -  sPreviousCCTime = PR_Now();
@@ -2629,37 +2637,37 @@ diff --git a/dom/src/base/nsJSEnvironmen
 -    }
 -#endif
 -  }
 -  return PR_FALSE;
 +  // add future call to NS_GetGC()->MaybeGC(true);
  }
  
  //static
-@@ -3395,7 +3312,7 @@
+@@ -3395,7 +3312,7 @@ nsJSContext::CCIfUserInactive()
  nsJSContext::CCIfUserInactive()
  {
    if (sUserIsActive) {
 -    MaybeCC(PR_TRUE);
 +    MaybeCC();
    } else {
      CC();
    }
-@@ -3598,10 +3515,6 @@
+@@ -3598,10 +3515,6 @@ nsJSRuntime::Startup()
    sCCollectCount = 0;
    sUserIsActive = PR_FALSE;
    sPreviousCCTime = 0;
 -  sCollectedObjectsCounts = 0;
 -  sGCCount = 0;
 -  sCCSuspectChanges = 0;
 -  sCCSuspectedCount = 0;
    sGCTimer = nsnull;
    sReadyForGC = PR_FALSE;
    sLoadInProgressGCTimer = PR_FALSE;
-@@ -3902,27 +3815,6 @@
+@@ -3916,27 +3829,6 @@ nsJSArgArray::ReleaseJSObjects()
  }
  
  // QueryInterface implementation for nsJSArgArray
 -NS_IMPL_CYCLE_COLLECTION_CLASS(nsJSArgArray)
 -NS_IMPL_CYCLE_COLLECTION_ROOT_BEGIN(nsJSArgArray)
 -  tmp->ReleaseJSObjects();
 -NS_IMPL_CYCLE_COLLECTION_ROOT_END
 -NS_IMPL_CYCLE_COLLECTION_UNLINK_0(nsJSArgArray)
@@ -2680,17 +2688,17 @@ diff --git a/dom/src/base/nsJSEnvironmen
 -NS_IMPL_CYCLE_COLLECTION_TRACE_END
 -
  NS_INTERFACE_MAP_BEGIN_CYCLE_COLLECTION(nsJSArgArray)
    NS_INTERFACE_MAP_ENTRY(nsIArray)
    NS_INTERFACE_MAP_ENTRY(nsIJSArgArray)
 diff --git a/dom/src/base/nsJSEnvironment.h b/dom/src/base/nsJSEnvironment.h
 --- a/dom/src/base/nsJSEnvironment.h
 +++ b/dom/src/base/nsJSEnvironment.h
-@@ -179,20 +179,8 @@
+@@ -179,20 +179,8 @@ public:
    // that MaybeCC uses.
    static void CC();
  
 -  // MaybeCC calls cycle collector if certain conditions are fulfilled.
 -  // The conditions are:
 -  // - The timer related to page load (sGCTimer) must not be active.
 -  // - At least NS_MIN_CC_INTERVAL milliseconds must have elapsed since the
 -  //   previous cycle collector call.
@@ -2706,17 +2714,17 @@ diff --git a/dom/src/base/nsJSEnvironmen
 +  // MaybeCC calls cycle collector if internal thresholds have been reached
 +  static void MaybeCC();
  
    // Calls CC() if user is currently inactive, otherwise MaybeCC(PR_TRUE)
    static void CCIfUserInactive();
 diff --git a/dom/src/base/nsJSTimeoutHandler.cpp b/dom/src/base/nsJSTimeoutHandler.cpp
 --- a/dom/src/base/nsJSTimeoutHandler.cpp
 +++ b/dom/src/base/nsJSTimeoutHandler.cpp
-@@ -112,21 +112,6 @@
+@@ -112,21 +112,6 @@ private:
  
  // nsJSScriptTimeoutHandler
  // QueryInterface implementation for nsJSScriptTimeoutHandler
 -NS_IMPL_CYCLE_COLLECTION_CLASS(nsJSScriptTimeoutHandler)
 -NS_IMPL_CYCLE_COLLECTION_ROOT_BEGIN(nsJSScriptTimeoutHandler)
 -  tmp->ReleaseJSObjects();
 -NS_IMPL_CYCLE_COLLECTION_ROOT_END
 -NS_IMPL_CYCLE_COLLECTION_UNLINK_0(nsJSScriptTimeoutHandler)
@@ -2731,33 +2739,33 @@ diff --git a/dom/src/base/nsJSTimeoutHan
 -  NS_IMPL_CYCLE_COLLECTION_TRACE_JS_MEMBER_CALLBACK(mFunObj)
 -NS_IMPL_CYCLE_COLLECTION_TRACE_END
  
  NS_INTERFACE_MAP_BEGIN_CYCLE_COLLECTION(nsJSScriptTimeoutHandler)
    NS_INTERFACE_MAP_ENTRY(nsIScriptTimeoutHandler)
 diff --git a/dom/src/base/nsWindowRoot.cpp b/dom/src/base/nsWindowRoot.cpp
 --- a/dom/src/base/nsWindowRoot.cpp
 +++ b/dom/src/base/nsWindowRoot.cpp
-@@ -67,10 +67,10 @@
+@@ -67,10 +67,10 @@ nsWindowRoot::nsWindowRoot(nsIDOMWindow*
    nsFocusController::Create(getter_AddRefs(mFocusController));
  
    nsCOMPtr<nsIDOMFocusListener> focusListener(do_QueryInterface(mFocusController));
 -  mRefCnt.incr(static_cast<nsIDOMEventTarget*>(this));
 +  ++mRefCnt;
    AddEventListener(NS_LITERAL_STRING("focus"), focusListener, PR_TRUE);
    AddEventListener(NS_LITERAL_STRING("blur"), focusListener, PR_TRUE);
 -  mRefCnt.decr(static_cast<nsIDOMEventTarget*>(this));
 +  --mRefCnt;
  }
  
  nsWindowRoot::~nsWindowRoot()
 diff --git a/dom/src/events/nsJSEventListener.cpp b/dom/src/events/nsJSEventListener.cpp
 --- a/dom/src/events/nsJSEventListener.cpp
 +++ b/dom/src/events/nsJSEventListener.cpp
-@@ -81,47 +81,11 @@
+@@ -81,47 +81,11 @@ nsJSEventListener::nsJSEventListener(nsI
    // until we are done with it.
    NS_ASSERTION(aScopeObject && aContext,
                 "EventListener with no context or scope?");
 -  nsContentUtils::HoldScriptObject(aContext->GetScriptTypeID(), this,
 -                                   &NS_CYCLE_COLLECTION_NAME(nsJSEventListener),
 -                                   aScopeObject, PR_FALSE);
  }
  
@@ -2798,17 +2806,17 @@ diff --git a/dom/src/events/nsJSEventLis
 -                                                 mScopeObject)
 -NS_IMPL_CYCLE_COLLECTION_TRACE_END
  
  NS_INTERFACE_MAP_BEGIN_CYCLE_COLLECTION(nsJSEventListener)
    NS_INTERFACE_MAP_ENTRY(nsIDOMEventListener)
 diff --git a/dom/src/offline/nsDOMOfflineResourceList.cpp b/dom/src/offline/nsDOMOfflineResourceList.cpp
 --- a/dom/src/offline/nsDOMOfflineResourceList.cpp
 +++ b/dom/src/offline/nsDOMOfflineResourceList.cpp
-@@ -80,66 +80,6 @@
+@@ -80,66 +80,6 @@ static PRUint32 gCachedKeysCount = 0;
  //
  // nsDOMOfflineResourceList
  //
 -
 -NS_IMPL_CYCLE_COLLECTION_CLASS(nsDOMOfflineResourceList)
 -
 -NS_IMPL_CYCLE_COLLECTION_TRAVERSE_BEGIN(nsDOMOfflineResourceList)
 -  NS_IMPL_CYCLE_COLLECTION_TRAVERSE_NSCOMPTR(mWindow)
@@ -2868,17 +2876,17 @@ diff --git a/dom/src/offline/nsDOMOfflin
 -
 -NS_IMPL_CYCLE_COLLECTION_UNLINK_END
  
  NS_INTERFACE_MAP_BEGIN_CYCLE_COLLECTION(nsDOMOfflineResourceList)
    NS_INTERFACE_MAP_ENTRY_AMBIGUOUS(nsISupports, nsIDOMOfflineResourceList)
 diff --git a/dom/src/storage/nsDOMStorage.cpp b/dom/src/storage/nsDOMStorage.cpp
 --- a/dom/src/storage/nsDOMStorage.cpp
 +++ b/dom/src/storage/nsDOMStorage.cpp
-@@ -363,29 +363,6 @@
+@@ -363,29 +363,6 @@ nsDOMStorageEntry::~nsDOMStorageEntry()
  nsDOMStorageEntry::~nsDOMStorageEntry()
  {
  }
 -
 -PLDHashOperator PR_CALLBACK
 -SessionStorageTraverser(nsSessionStorageEntry* aEntry, void* userArg) {
 -  nsCycleCollectionTraversalCallback *cb = 
 -    static_cast<nsCycleCollectionTraversalCallback*>(userArg);
@@ -2898,17 +2906,17 @@ diff --git a/dom/src/storage/nsDOMStorag
 -    if (tmp->mItems.IsInitialized()) {
 -      tmp->mItems.EnumerateEntries(SessionStorageTraverser, &cb);
 -    }
 -  }
 -NS_IMPL_CYCLE_COLLECTION_TRAVERSE_END
  
  NS_IMPL_CYCLE_COLLECTING_ADDREF_AMBIGUOUS(nsDOMStorage, nsIDOMStorage)
  NS_IMPL_CYCLE_COLLECTING_RELEASE_AMBIGUOUS(nsDOMStorage, nsIDOMStorage)
-@@ -1211,18 +1188,6 @@
+@@ -1211,18 +1188,6 @@ NS_NewDOMStorageList(nsIDOMStorageList**
  // nsDOMStorageItem
  //
  
 -NS_IMPL_CYCLE_COLLECTION_CLASS(nsDOMStorageItem)
 -NS_IMPL_CYCLE_COLLECTION_UNLINK_BEGIN(nsDOMStorageItem)
 -  {
 -    tmp->mStorage = nsnull;
 -  }
@@ -2920,17 +2928,17 @@ diff --git a/dom/src/storage/nsDOMStorag
 -NS_IMPL_CYCLE_COLLECTION_TRAVERSE_END
 -
  NS_IMPL_CYCLE_COLLECTING_ADDREF_AMBIGUOUS(nsDOMStorageItem, nsIDOMStorageItem)
  NS_IMPL_CYCLE_COLLECTING_RELEASE_AMBIGUOUS(nsDOMStorageItem, nsIDOMStorageItem)
  NS_INTERFACE_MAP_BEGIN_CYCLE_COLLECTION(nsDOMStorageItem)
 diff --git a/embedding/components/commandhandler/src/nsCommandManager.cpp b/embedding/components/commandhandler/src/nsCommandManager.cpp
 --- a/embedding/components/commandhandler/src/nsCommandManager.cpp
 +++ b/embedding/components/commandhandler/src/nsCommandManager.cpp
-@@ -68,30 +68,6 @@
+@@ -68,30 +68,6 @@ nsCommandManager::~nsCommandManager()
  {
    /* destructor code */
  }
 -
 -
 -PR_STATIC_CALLBACK(PLDHashOperator)
 -TraverseCommandObservers(const char* aKey, nsCOMArray<nsIObserver>* aObservers,
 -                         void* aClosure)
@@ -2954,26 +2962,26 @@ diff --git a/embedding/components/comman
 -  tmp->mObserversTable.EnumerateRead(TraverseCommandObservers, &cb);
 -NS_IMPL_CYCLE_COLLECTION_TRAVERSE_END
  
  NS_IMPL_CYCLE_COLLECTING_ADDREF_AMBIGUOUS(nsCommandManager, nsICommandManager)
  NS_IMPL_CYCLE_COLLECTING_RELEASE_AMBIGUOUS(nsCommandManager, nsICommandManager)
 diff --git a/js/src/xpconnect/idl/nsIXPConnect.idl b/js/src/xpconnect/idl/nsIXPConnect.idl
 --- a/js/src/xpconnect/idl/nsIXPConnect.idl
 +++ b/js/src/xpconnect/idl/nsIXPConnect.idl
-@@ -405,7 +405,7 @@
+@@ -405,7 +405,7 @@ interface nsIXPCFunctionThisTranslator :
      { 0xbd, 0xd6, 0x0, 0x0, 0x64, 0x65, 0x73, 0x74 } }
  %}
  
--[uuid(20df9082-5b83-416d-ba80-0422af516d57)]
+-[uuid(c1d4a482-1beb-4c82-9c0b-d2ab93acc7ef)]
 +[uuid(ccc89d14-104a-475e-af6f-eb83acd15bcf)]
  interface nsIXPConnect : nsISupports
  {
  %{ C++
-@@ -709,28 +709,6 @@
+@@ -709,28 +709,6 @@ interface nsIXPConnect : nsISupports
                                 in PRUint32 aWay);
  
      /**
 -     * Root JS objects held by aHolder.
 -     * @param aHolder The object that hold the JS objects that should be rooted.
 -     * @param aTrace The tracer for aHolder.
 -     */
 -    [noscript] void addJSHolder(in voidPtr aHolder,
@@ -2995,17 +3003,17 @@ diff --git a/js/src/xpconnect/idl/nsIXPC
 -
 -    /**
       * Get the JSClass and JSGetObjectOps pointers to use for
       * identifying JSObjects that hold nsIXPConnectWrappedNative
       * pointers in their private date. See IS_WRAPPER_CLASS in
 diff --git a/js/src/xpconnect/src/nsXPConnect.cpp b/js/src/xpconnect/src/nsXPConnect.cpp
 --- a/js/src/xpconnect/src/nsXPConnect.cpp
 +++ b/js/src/xpconnect/src/nsXPConnect.cpp
-@@ -80,20 +80,13 @@
+@@ -81,20 +81,13 @@ nsXPConnect::nsXPConnect()
          mContextStack(nsnull),
          mDefaultSecurityManager(nsnull),
          mDefaultSecurityManagerFlags(0),
 -        mShuttingDown(JS_FALSE),
 -        mCycleCollectionContext(nsnull),
 -        mCycleCollecting(PR_FALSE)
 +        mShuttingDown(JS_FALSE)
  {
@@ -3017,28 +3025,28 @@ diff --git a/js/src/xpconnect/src/nsXPCo
 -
 -    nsCycleCollector_registerRuntime(nsIProgrammingLanguage::JAVASCRIPT, this);
 -#ifdef DEBUG_CC
 -    mJSRoots.ops = nsnull;
 -#endif
  
  #ifdef XPC_TOOLS_SUPPORT
    {
-@@ -124,10 +117,6 @@
+@@ -127,10 +120,6 @@ nsXPConnect::nsXPConnect()
  
  nsXPConnect::~nsXPConnect()
  {
 -    NS_ASSERTION(!mCycleCollectionContext,
 -                 "Didn't call FinishCycleCollection?");
 -    nsCycleCollector_forgetRuntime(nsIProgrammingLanguage::JAVASCRIPT);
 -
      JSContext *cx = nsnull;
      if (mRuntime) {
          // Create our own JSContext rather than an XPCCallContext, since
-@@ -412,643 +401,6 @@
+@@ -415,638 +404,6 @@ nsXPConnect::GetInfoForName(const char *
  {
      return FindInfo(NameTester, name, mInterfaceInfoManager, info);
  }
 -
 -static JSGCCallback gOldJSGCCallback;
 -// Whether cycle collection was run.
 -static PRBool gDidCollection;
 -// Whether starting cycle collection was successful.
@@ -3153,23 +3161,19 @@ diff --git a/js/src/xpconnect/src/nsXPCo
 -    gOldJSGCCallback = nsnull;
 -
 -    mCycleCollectionContext = nsnull;
 -    mCycleCollecting = PR_FALSE;
 -
 -    return gCollected;
 -}
 -
--// JSTRACE_SCRIPTED_FUNCTION can hold on to a lot of objects, adding it to the
--// cycle collector reduces the number of edges to those objects.
 -// JSTRACE_XML can recursively hold on to more JSTRACE_XML objects, adding it to
 -// the cycle collector avoids stack overflow.
--#define ADD_TO_CC(_kind) \
--    ((_kind) == JSTRACE_OBJECT || (_kind) == JSTRACE_SCRIPTED_FUNCTION || \
--     (_kind) == JSTRACE_XML)
+-#define ADD_TO_CC(_kind)    ((_kind) == JSTRACE_OBJECT || (_kind) == JSTRACE_XML)
 -
 -#ifdef DEBUG_CC
 -struct NoteJSRootTracer : public JSTracer
 -{
 -    NoteJSRootTracer(PLDHashTable *aObjects,
 -                     nsCycleCollectionTraversalCallback& cb)
 -      : mObjects(aObjects),
 -        mCb(cb)
@@ -3513,17 +3517,16 @@ diff --git a/js/src/xpconnect/src/nsXPCo
 -        }
 -    }
 -    else
 -    {
 -        static const char trace_types[JSTRACE_LIMIT][10] = {
 -            "Object",
 -            "Double",
 -            "String",
--            "Function",
 -            "Namespace",
 -            "Qname",
 -            "Xml"
 -        };
 -        JS_snprintf(name, sizeof(name), "JS %s", trace_types[traceKind]);
 -    }
 -
 -    if(traceKind == JSTRACE_OBJECT || traceKind == JSTRACE_NAMESPACE ||
@@ -3672,39 +3675,39 @@ diff --git a/js/src/xpconnect/src/nsXPCo
 -                           nsCycleCollectionTraversalCallback &aCb)
 -{
 -    aCb.NoteNativeChild(aJSContext, &JSContext_cycleCollectorGlobal);
 -}
 -
  
  /***************************************************************************/
  /***************************************************************************/
-@@ -2306,18 +1658,6 @@
-     return NS_ERROR_UNEXPECTED;
+@@ -2305,18 +1662,6 @@ nsXPConnect::OnDispatchedEvent(nsIThread
  }
  
--NS_IMETHODIMP
+ NS_IMETHODIMP
 -nsXPConnect::AddJSHolder(void* aHolder, nsScriptObjectTracer* aTracer)
 -{
 -    return mRuntime->AddJSHolder(aHolder, aTracer);
 -}
 -
 -NS_IMETHODIMP
 -nsXPConnect::RemoveJSHolder(void* aHolder)
 -{
 -    return mRuntime->RemoveJSHolder(aHolder);
 -}
 -
- #ifdef DEBUG
- /* These are here to be callable from a debugger */
- JS_BEGIN_EXTERN_C
+-NS_IMETHODIMP
+ nsXPConnect::SetReportAllJSExceptions(PRBool newval)
+ {
+     // Ignore if the environment variable was set.
 diff --git a/js/src/xpconnect/src/xpcjsruntime.cpp b/js/src/xpconnect/src/xpcjsruntime.cpp
 --- a/js/src/xpconnect/src/xpcjsruntime.cpp
 +++ b/js/src/xpconnect/src/xpcjsruntime.cpp
-@@ -253,42 +253,6 @@
+@@ -253,42 +253,6 @@ ContextCallback(JSContext *cx, uintN ope
             : JS_TRUE;
  }
  
 -struct ObjectHolder : public JSDHashEntryHdr
 -{
 -    void *holder;
 -    nsScriptObjectTracer* tracer;
 -};
@@ -3737,17 +3740,17 @@ diff --git a/js/src/xpconnect/src/xpcjsr
 -    JS_DHashTableOperate(&mJSHolders, aHolder, JS_DHASH_REMOVE);
 -
 -    return NS_OK;
 -}
 -
  // static
  void XPCJSRuntime::TraceJS(JSTracer* trc, void* data)
  {
-@@ -320,34 +284,7 @@
+@@ -320,34 +284,7 @@ void XPCJSRuntime::TraceJS(JSTracer* trc
      for(XPCRootSetElem *e = self->mObjectHolderRoots; e ; e = e->GetNextRoot())
          static_cast<XPCJSObjectHolder*>(e)->TraceJS(trc);
          
 -    if(self->GetXPConnect()->ShouldTraceRoots())
 -    {
 -        // Only trace these if we're not cycle-collecting, the cycle collector
 -        // will do that if we are.
 -        self->TraceXPConnectRoots(trc);
@@ -3773,17 +3776,17 @@ diff --git a/js/src/xpconnect/src/xpcjsr
 -
 -    entry->tracer->Trace(entry->holder, TraceJSObject, arg);
 -
 -    return JS_DHASH_NEXT;
 +    self->TraceXPConnectRoots(trc);
  }
  
  struct ClearedGlobalObject : public JSDHashEntryHdr
-@@ -358,24 +295,6 @@
+@@ -358,24 +295,6 @@ struct ClearedGlobalObject : public JSDH
  
  void XPCJSRuntime::TraceXPConnectRoots(JSTracer *trc)
  {
 -    if(mClearedGlobalObjects.ops)
 -    {
 -        JSContext *iter = nsnull, *acx;
 -        while((acx = JS_ContextIterator(GetJSRuntime(), &iter)))
 -        {
@@ -3798,17 +3801,17 @@ diff --git a/js/src/xpconnect/src/xpcjsr
 -                                      "global object");
 -            }
 -        }
 -    }
 -
      XPCWrappedNativeScope::TraceJS(trc, this);
  
      for(XPCRootSetElem *e = mVariantRoots; e ; e = e->GetNextRoot())
-@@ -383,137 +302,6 @@
+@@ -383,137 +302,6 @@ void XPCJSRuntime::TraceXPConnectRoots(J
  
      for(XPCRootSetElem *e = mWrappedJSRoots; e ; e = e->GetNextRoot())
          static_cast<nsXPCWrappedJS*>(e)->TraceJS(trc);
 -
 -    if(mJSHolders.ops)
 -        JS_DHashTableEnumerate(&mJSHolders, TraceJSHolder, trc);
 -}
 -
@@ -3936,17 +3939,17 @@ diff --git a/js/src/xpconnect/src/xpcjsr
 -        reinterpret_cast<ClearedGlobalObject*>(entry);
 -
 -    return JS_DHASH_ENTRY_IS_BUSY(entry) ?
 -           clearedGlobal->mGlobalObject :
 -           nsnull;
  }
  
  // static
-@@ -1021,17 +809,6 @@
+@@ -1021,17 +809,6 @@ XPCJSRuntime::~XPCJSRuntime()
  
      gOldJSGCCallback = NULL;
      gOldJSContextCallback = NULL;
 -
 -    if(mJSHolders.ops)
 -    {
 -        JS_DHashTableFinish(&mJSHolders);
 -        mJSHolders.ops = nsnull;
@@ -3954,17 +3957,17 @@ diff --git a/js/src/xpconnect/src/xpcjsr
 -    if(mClearedGlobalObjects.ops)
 -    {
 -        JS_DHashTableFinish(&mClearedGlobalObjects);
 -        mClearedGlobalObjects.ops = nsnull;
 -    }
  }
  
  XPCJSRuntime::XPCJSRuntime(nsXPConnect* aXPConnect,
-@@ -1082,13 +859,6 @@
+@@ -1082,13 +859,6 @@ XPCJSRuntime::XPCJSRuntime(nsXPConnect* 
          gOldJSGCCallback = JS_SetGCCallbackRT(mJSRuntime, GCCallback);
          JS_SetExtraGCRoots(mJSRuntime, TraceJS, this);
      }
 -
 -    if(!JS_DHashTableInit(&mJSHolders, JS_DHashGetStubOps(), nsnull,
 -                          sizeof(ObjectHolder), 512))
 -        mJSHolders.ops = nsnull;
 -    if(!JS_DHashTableInit(&mClearedGlobalObjects, JS_DHashGetStubOps(), nsnull,
@@ -3979,28 +3982,28 @@ diff --git a/js/src/xpconnect/src/xpcpri
 @@ -54,7 +54,6 @@
  #include "nsXPCOM.h"
  #include "nsAutoPtr.h"
  #include "nsCycleCollectionParticipant.h"
 -#include "nsCycleCollector.h"
  #include "nsISupports.h"
  #include "nsIServiceManager.h"
  #include "nsIClassInfoImpl.h"
-@@ -444,9 +443,7 @@
+@@ -444,9 +443,7 @@ const PRBool OBJ_IS_NOT_GLOBAL = PR_FALS
  
  class nsXPConnect : public nsIXPConnect,
                      public nsIThreadObserver,
 -                    public nsSupportsWeakReference,
 -                    public nsCycleCollectionJSRuntime,
 -                    public nsCycleCollectionParticipant
 +                    public nsSupportsWeakReference
  {
  public:
      // all the interface method declarations...
-@@ -495,43 +492,7 @@
+@@ -495,46 +492,11 @@ public:
      nsresult GetInfoForIID(const nsIID * aIID, nsIInterfaceInfo** info);
      nsresult GetInfoForName(const char * name, nsIInterfaceInfo** info);
  
 -    // nsCycleCollectionParticipant
 -    NS_IMETHOD RootAndUnlinkJSObjects(void *p);
 -    NS_IMETHOD Unlink(void *p);
 -    NS_IMETHOD Unroot(void *p);
 -    NS_IMETHOD Traverse(void *p,
@@ -4024,40 +4027,44 @@ diff --git a/js/src/xpconnect/src/xpcpri
 -    }
 -
 -    XPCCallContext* GetCycleCollectionContext()
 -    {
 -        return mCycleCollectionContext;
 -    }
 -
      PRInt32 GetRequestDepth(JSContext* cx);
--
+ 
 -    // This returns the singleton nsCycleCollectionParticipant for JSContexts.
 -    static nsCycleCollectionParticipant *JSContextParticipant();
 -
 -#ifndef XPCONNECT_STANDALONE
 -    void RecordTraversal(void *p, nsISupports *s);
 -#endif
+     static PRBool ReportAllJSExceptions()
+     {
+-      return gReportAllJSExceptions > 0;
++        return gReportAllJSExceptions > 0;
+     }
  
  #ifdef XPC_IDISPATCH_SUPPORT
- public:
-@@ -557,12 +518,6 @@
+@@ -561,12 +523,6 @@ private:
      nsIXPCSecurityManager*   mDefaultSecurityManager;
      PRUint16                 mDefaultSecurityManagerFlags;
      JSBool                   mShuttingDown;
 -    XPCCallContext*          mCycleCollectionContext;
 -#ifdef DEBUG_CC
 -    nsAutoPtr<XPCCallContext> mExplainCycleCollectionContext;
 -    PLDHashTable             mJSRoots;
 -#endif
 -    PRBool                   mCycleCollecting;
  
  #ifdef XPC_TOOLS_SUPPORT
      nsCOMPtr<nsIXPCToolsProfiler> mProfiler;
-@@ -706,21 +661,12 @@
+@@ -711,21 +667,12 @@ public:
  
      static void JS_DLL_CALLBACK TraceJS(JSTracer* trc, void* data);
      void TraceXPConnectRoots(JSTracer *trc);
 -    void AddXPConnectRoots(JSContext* cx,
 -                           nsCycleCollectionTraversalCallback& cb);
  
      static JSBool JS_DLL_CALLBACK GCCallback(JSContext *cx, JSGCStatus status);
  
@@ -4069,37 +4076,37 @@ diff --git a/js/src/xpconnect/src/xpcpri
 -    nsresult RemoveJSHolder(void* aHolder);
 -
 -    void UnsetContextGlobals();
 -    void RestoreContextGlobals();
 -    JSObject* GetUnsetContextGlobal(JSContext* cx);
  
      void DebugDump(PRInt16 depth);
  
-@@ -785,8 +731,6 @@
+@@ -790,8 +737,6 @@ private:
      XPCRootSetElem *mVariantRoots;
      XPCRootSetElem *mWrappedJSRoots;
      XPCRootSetElem *mObjectHolderRoots;
 -    JSDHashTable mJSHolders;
 -    JSDHashTable mClearedGlobalObjects;
  };
  
  /***************************************************************************/
-@@ -1262,10 +1206,6 @@
+@@ -1267,10 +1212,6 @@ public:
  
      static void
      TraceJS(JSTracer* trc, XPCJSRuntime* rt);
 -
 -    static void
 -    SuspectAllWrappers(XPCJSRuntime* rt, JSContext* cx,
 -                       nsCycleCollectionTraversalCallback &cb);
  
      static void
      FinishedMarkPhaseOfGC(JSContext* cx, XPCJSRuntime* rt);
-@@ -2071,25 +2011,6 @@
+@@ -2076,25 +2017,6 @@ public:
      NS_DECL_ISUPPORTS
      NS_DECL_NSIXPCONNECTJSOBJECTHOLDER
      NS_DECL_NSIXPCONNECTWRAPPEDNATIVE
 -    // No need to unlink the JS objects, if the XPCWrappedNative will be cycle
 -    // collected then its mFlatJSObject will be cycle collected too and
 -    // finalization of the mFlatJSObject will unlink the js objects (see
 -    // XPC_WN_NoHelper_Finalize and FlatJSObjectFinalized).
 -    // We also rely on NS_DECL_CYCLE_COLLECTION_CLASS_NO_UNLINK having empty
@@ -4115,43 +4122,43 @@ diff --git a/js/src/xpconnect/src/xpcpri
 -      NS_IMETHOD Unlink(void *p) { return NS_OK; }
 -      NS_IMETHOD Unroot(void *p) { return NS_OK; }
 -    };
 -    NS_CYCLE_COLLECTION_PARTICIPANT_INSTANCE
 -    NS_DECL_CYCLE_COLLECTION_UNMARK_PURPLE_STUB(XPCWrappedNative)
  
  #ifndef XPCONNECT_STANDALONE
      virtual nsIPrincipal* GetObjectPrincipal() const;
-@@ -2324,8 +2245,6 @@
+@@ -2329,8 +2