checkpoint
authorBenjamin Smedberg <benjamin@smedbergs.us>
Fri, 25 Jul 2008 21:56:11 -0400
changeset 162 3ae1ca70680d
parent 161 f18bbe915634
child 163 1124940b8119
push id37
push userbsmedberg@mozilla.com
push dateSat, 26 Jul 2008 04:16:20 +0000
checkpoint
automatic-garburator
automatic-gcobject
automatic-remove-addrefs
comarray.patch
comarray.patch2
comptr-rewrite.patch
comptr-rewrite.patch3
comptr-rewrite.patch4
comptr-rewrite.patch5
content-xslt-gcobjects
gcobject-nodelete.patch
nativescriptableshared-gcobject
nsGUIEvents-allowonstack
nsGUIEvents-allowonstack2
nsTimeout-GCObject
nsTimeout-GCObject2
reorder-bases
series
xbl-gcobjects
xpconnect-finalizers
xul-gcobjects
xultemplates-gcobjects
deleted file mode 100644
--- a/automatic-garburator
+++ /dev/null
@@ -1,157580 +0,0 @@
-Automatically generated patch: convert stack nsCOMPtrs to raw pointers
-
-diff --git a/accessible/src/atk/nsAccessibleWrap.cpp b/accessible/src/atk/nsAccessibleWrap.cpp
---- a/accessible/src/atk/nsAccessibleWrap.cpp
-+++ b/accessible/src/atk/nsAccessibleWrap.cpp
-@@ -430,74 +430,74 @@ nsAccessibleWrap::CreateMaiInterfaces(vo
-     }
- 
-     //nsIAccessibleText
--    nsCOMPtr<nsIAccessibleText> accessInterfaceText;
-+    nsIAccessibleText* accessInterfaceText = nsnull;
-     QueryInterface(NS_GET_IID(nsIAccessibleText),
--                   getter_AddRefs(accessInterfaceText));
-+                   (void**)&accessInterfaceText);
-     if (accessInterfaceText) {
-         interfacesBits |= 1 << MAI_INTERFACE_TEXT;
-     }
- 
-     //nsIAccessibleEditableText
--    nsCOMPtr<nsIAccessibleEditableText> accessInterfaceEditableText;
-+    nsIAccessibleEditableText* accessInterfaceEditableText = nsnull;
-     QueryInterface(NS_GET_IID(nsIAccessibleEditableText),
--                   getter_AddRefs(accessInterfaceEditableText));
-+                   (void**)&accessInterfaceEditableText);
-     if (accessInterfaceEditableText) {
-         interfacesBits |= 1 << MAI_INTERFACE_EDITABLE_TEXT;
-     }
- 
-     //nsIAccessibleValue
--    nsCOMPtr<nsIAccessibleValue> accessInterfaceValue;
-+    nsIAccessibleValue* accessInterfaceValue = nsnull;
-     QueryInterface(NS_GET_IID(nsIAccessibleValue),
--                   getter_AddRefs(accessInterfaceValue));
-+                   (void**)&accessInterfaceValue);
-     if (accessInterfaceValue) {
-        interfacesBits |= 1 << MAI_INTERFACE_VALUE; 
-     }
- 
-     //nsIAccessibleDocument
--    nsCOMPtr<nsIAccessibleDocument> accessInterfaceDocument;
-+    nsIAccessibleDocument* accessInterfaceDocument = nsnull;
-     QueryInterface(NS_GET_IID(nsIAccessibleDocument),
--                              getter_AddRefs(accessInterfaceDocument));
-+                              (void**)&accessInterfaceDocument);
-     if (accessInterfaceDocument) {
-         interfacesBits |= 1 << MAI_INTERFACE_DOCUMENT;
-     }
- 
-     //nsIAccessibleImage
--    nsCOMPtr<nsIAccessibleImage> accessInterfaceImage;
-+    nsIAccessibleImage* accessInterfaceImage = nsnull;
-     QueryInterface(NS_GET_IID(nsIAccessibleImage),
--                              getter_AddRefs(accessInterfaceImage));
-+                              (void**)&accessInterfaceImage);
-     if (accessInterfaceImage) {
-         interfacesBits |= 1 << MAI_INTERFACE_IMAGE;
-     }
- 
-     //nsIAccessibleHyperLink
--    nsCOMPtr<nsIAccessibleHyperLink> accessInterfaceHyperlink;
-+    nsIAccessibleHyperLink* accessInterfaceHyperlink = nsnull;
-     QueryInterface(NS_GET_IID(nsIAccessibleHyperLink),
--                   getter_AddRefs(accessInterfaceHyperlink));
-+                   (void**)&accessInterfaceHyperlink);
-     if (accessInterfaceHyperlink) {
-        interfacesBits |= 1 << MAI_INTERFACE_HYPERLINK_IMPL;
-     }
- 
-     if (!MustPrune(this)) {  // These interfaces require children
-       //nsIAccessibleHypertext
--      nsCOMPtr<nsIAccessibleHyperText> accessInterfaceHypertext;
-+      nsIAccessibleHyperText* accessInterfaceHypertext = nsnull;
-       QueryInterface(NS_GET_IID(nsIAccessibleHyperText),
--                     getter_AddRefs(accessInterfaceHypertext));
-+                     (void**)&accessInterfaceHypertext);
-       if (accessInterfaceHypertext) {
-           interfacesBits |= 1 << MAI_INTERFACE_HYPERTEXT;
-       }
- 
-       //nsIAccessibleTable
--      nsCOMPtr<nsIAccessibleTable> accessInterfaceTable;
-+      nsIAccessibleTable* accessInterfaceTable = nsnull;
-       QueryInterface(NS_GET_IID(nsIAccessibleTable),
--                     getter_AddRefs(accessInterfaceTable));
-+                     (void**)&accessInterfaceTable);
-       if (accessInterfaceTable) {
-           interfacesBits |= 1 << MAI_INTERFACE_TABLE;
-       }
-       
-       //nsIAccessibleSelection
--      nsCOMPtr<nsIAccessibleSelectable> accessInterfaceSelection;
-+      nsIAccessibleSelectable* accessInterfaceSelection = nsnull;
-       QueryInterface(NS_GET_IID(nsIAccessibleSelectable),
--                     getter_AddRefs(accessInterfaceSelection));
-+                     (void**)&accessInterfaceSelection);
-       if (accessInterfaceSelection) {
-           interfacesBits |= 1 << MAI_INTERFACE_SELECTION;
-       }
-@@ -790,8 +790,8 @@ GetAttributeSet(nsIAccessible* aAccessib
- GetAttributeSet(nsIAccessible* aAccessible)
- {
-     AtkAttributeSet *objAttributeSet = nsnull;
--    nsCOMPtr<nsIPersistentProperties> attributes;
--    aAccessible->GetAttributes(getter_AddRefs(attributes));
-+    nsIPersistentProperties* attributes = nsnull;
-+    aAccessible->GetAttributes(&attributes);
-     
-     if (attributes) {
-         // Deal with attributes that we only need to expose in ATK
-@@ -804,15 +804,15 @@ GetAttributeSet(nsIAccessible* aAccessib
-                                         oldValueUnused);
-         }
- 
--        nsCOMPtr<nsISimpleEnumerator> propEnum;
--        nsresult rv = attributes->Enumerate(getter_AddRefs(propEnum));
-+        nsISimpleEnumerator* propEnum = nsnull;
-+        nsresult rv = attributes->Enumerate(&propEnum);
-         NS_ENSURE_SUCCESS(rv, nsnull);
- 
-         PRBool hasMore;
-         while (NS_SUCCEEDED(propEnum->HasMoreElements(&hasMore)) && hasMore) {
--            nsCOMPtr<nsISupports> sup;
--            rv = propEnum->GetNext(getter_AddRefs(sup));
--            nsCOMPtr<nsIPropertyElement> propElem(do_QueryInterface(sup));
-+            nsISupports* sup = nsnull;
-+            rv = propEnum->GetNext(&sup);
-+            nsIPropertyElement* propElem(do_QueryInterface(sup));
-             NS_ENSURE_TRUE(propElem, nsnull);
- 
-             nsCAutoString name;
-@@ -850,8 +850,8 @@ getParentCB(AtkObject *aAtkObj)
-             return nsnull;
-         }
- 
--        nsCOMPtr<nsIAccessible> accParent;
--        nsresult rv = accWrap->GetParent(getter_AddRefs(accParent));
-+        nsIAccessible* accParent = nsnull;
-+        nsresult rv = accWrap->GetParent(&accParent);
-         if (NS_FAILED(rv) || !accParent)
-             return nsnull;
- 
-@@ -870,15 +870,15 @@ getChildCountCB(AtkObject *aAtkObj)
-     }
- 
-     PRInt32 count = 0;
--    nsCOMPtr<nsIAccessibleHyperText> hyperText;
--    accWrap->QueryInterface(NS_GET_IID(nsIAccessibleHyperText), getter_AddRefs(hyperText));
-+    nsIAccessibleHyperText* hyperText = nsnull;
-+    accWrap->QueryInterface(NS_GET_IID(nsIAccessibleHyperText), (void**)&hyperText);
-     if (hyperText) {
-         // If HyperText, then number of links matches number of children
-         hyperText->GetLinkCount(&count);
-     }
-     else {
--        nsCOMPtr<nsIAccessibleText> accText;
--        accWrap->QueryInterface(NS_GET_IID(nsIAccessibleText), getter_AddRefs(accText));
-+        nsIAccessibleText* accText = nsnull;
-+        accWrap->QueryInterface(NS_GET_IID(nsIAccessibleText), (void**)&accText);
-         if (!accText) {    // Accessible text that is not a HyperText has no children
-             accWrap->GetChildCount(&count);
-         }
-@@ -903,20 +903,20 @@ refChildCB(AtkObject *aAtkObj, gint aChi
-         return nsnull;
-     }
- 
--    nsCOMPtr<nsIAccessible> accChild;
--    nsCOMPtr<nsIAccessibleHyperText> hyperText;
--    accWrap->QueryInterface(NS_GET_IID(nsIAccessibleHyperText), getter_AddRefs(hyperText));
-+    nsIAccessible* accChild = nsnull;
-+    nsIAccessibleHyperText* hyperText = nsnull;
-+    accWrap->QueryInterface(NS_GET_IID(nsIAccessibleHyperText), (void**)&hyperText);
-     if (hyperText) {
-         // If HyperText, then number of links matches number of children
--        nsCOMPtr<nsIAccessibleHyperLink> hyperLink;
--        hyperText->GetLink(aChildIndex, getter_AddRefs(hyperLink));
-+        nsIAccessibleHyperLink* hyperLink = nsnull;
-+        hyperText->GetLink(aChildIndex, &hyperLink);
-         accChild = do_QueryInterface(hyperLink);
-     }
-     else {
--        nsCOMPtr<nsIAccessibleText> accText;
--        accWrap->QueryInterface(NS_GET_IID(nsIAccessibleText), getter_AddRefs(accText));
-+        nsIAccessibleText* accText = nsnull;
-+        accWrap->QueryInterface(NS_GET_IID(nsIAccessibleText), (void**)&accText);
-         if (!accText) {  // Accessible Text that is not HyperText has no children
--            accWrap->GetChildAt(aChildIndex, getter_AddRefs(accChild));
-+            accWrap->GetChildAt(aChildIndex, &accChild);
-         }
-     }
- 
-@@ -945,14 +945,14 @@ getIndexInParentCB(AtkObject *aAtkObj)
-         return -1;
-     }
- 
--    nsCOMPtr<nsIAccessible> parent;
--    accWrap->GetParent(getter_AddRefs(parent));
-+    nsIAccessible* parent = nsnull;
-+    accWrap->GetParent(&parent);
-     if (!parent) {
-         return -1; // No parent
-     }
- 
--    nsCOMPtr<nsIAccessible> sibling;
--    parent->GetFirstChild(getter_AddRefs(sibling));
-+    nsIAccessible* sibling = nsnull;
-+    parent->GetFirstChild(&sibling);
-     if (!sibling) {
-         return -1;  // Error, parent has no children
-     }
-@@ -969,9 +969,9 @@ getIndexInParentCB(AtkObject *aAtkObj)
-         ++ currentIndex;
-       }
- 
--      nsCOMPtr<nsIAccessible> tempAccessible;
--      sibling->GetNextSibling(getter_AddRefs(tempAccessible));
--      sibling.swap(tempAccessible);
-+      nsIAccessible* tempAccessible = nsnull;
-+      sibling->GetNextSibling(&tempAccessible);
-+      swap(sibling, tempAccessible);
-     }
- 
-     return currentIndex;
-@@ -1085,10 +1085,10 @@ nsAccessibleWrap *GetAccessibleWrap(AtkO
- 
-     NS_ENSURE_TRUE(tmpAccWrap->GetAtkObject() == aAtkObj, nsnull);
- 
--    nsRefPtr<nsApplicationAccessibleWrap> appAccWrap =
-+    nsApplicationAccessibleWrap* appAccWrap =
-         nsAccessNode::GetApplicationAccessible();
-     nsAccessibleWrap* tmpAppAccWrap =
--        static_cast<nsAccessibleWrap*>(appAccWrap.get());
-+        static_cast<nsAccessibleWrap*>(appAccWrap);
- 
-     if (tmpAppAccWrap != tmpAccWrap && !tmpAccWrap->IsValidObject())
-         return nsnull;
-@@ -1108,8 +1108,8 @@ nsresult
- nsresult
- nsAccessibleWrap::FirePlatformEvent(nsIAccessibleEvent *aEvent)
- {
--    nsCOMPtr<nsIAccessible> accessible;
--    aEvent->GetAccessible(getter_AddRefs(accessible));
-+    nsIAccessible* accessible = nsnull;
-+    aEvent->GetAccessible(&accessible);
-     NS_ENSURE_TRUE(accessible, NS_ERROR_FAILURE);
- 
-     PRUint32 type = 0;
-@@ -1145,11 +1145,11 @@ nsAccessibleWrap::FirePlatformEvent(nsIA
-     case nsIAccessibleEvent::EVENT_FOCUS:
-       {
-         MAI_LOG_DEBUG(("\n\nReceived: EVENT_FOCUS\n"));
--        nsRefPtr<nsRootAccessible> rootAccWrap = accWrap->GetRootAccessible();
-+        nsRootAccessible* rootAccWrap = accWrap->GetRootAccessible();
-         if (rootAccWrap && rootAccWrap->mActivated) {
-             atk_focus_tracker_notify(atkObj);
-             // Fire state change event for focus
--            nsCOMPtr<nsIAccessibleStateChangeEvent> stateChangeEvent =
-+            nsIAccessibleStateChangeEvent* stateChangeEvent =
-               new nsAccStateChangeEvent(accessible,
-                                         nsIAccessibleStates::STATE_FOCUSED,
-                                         PR_FALSE, PR_TRUE);
-@@ -1160,7 +1160,7 @@ nsAccessibleWrap::FirePlatformEvent(nsIA
-     case nsIAccessibleEvent::EVENT_VALUE_CHANGE:
-       {
-         MAI_LOG_DEBUG(("\n\nReceived: EVENT_VALUE_CHANGE\n"));
--        nsCOMPtr<nsIAccessibleValue> value(do_QueryInterface(accessible));
-+        nsIAccessibleValue* value(do_QueryInterface(accessible));
-         if (value) {    // Make sure this is a numeric value
-             // Don't fire for MSAA string value changes (e.g. text editing)
-             // ATK values are always numeric
-@@ -1182,7 +1182,7 @@ nsAccessibleWrap::FirePlatformEvent(nsIA
-       {
-         MAI_LOG_DEBUG(("\n\nReceived: EVENT_TEXT_CARET_MOVED\n"));
- 
--        nsCOMPtr<nsIAccessibleCaretMoveEvent> caretMoveEvent(do_QueryInterface(aEvent));
-+        nsIAccessibleCaretMoveEvent* caretMoveEvent(do_QueryInterface(aEvent));
-         NS_ASSERTION(caretMoveEvent, "Event needs event data");
-         if (!caretMoveEvent)
-             break;
-@@ -1205,7 +1205,7 @@ nsAccessibleWrap::FirePlatformEvent(nsIA
-     case nsIAccessibleEvent::EVENT_TABLE_ROW_INSERT:
-       {
-         MAI_LOG_DEBUG(("\n\nReceived: EVENT_TABLE_ROW_INSERT\n"));
--        nsCOMPtr<nsIAccessibleTableChangeEvent> tableEvent = do_QueryInterface(aEvent);
-+        nsIAccessibleTableChangeEvent* tableEvent = do_QueryInterface(aEvent);
-         NS_ENSURE_TRUE(tableEvent, NS_ERROR_FAILURE);
- 
-         PRInt32 rowIndex, numRows;
-@@ -1223,7 +1223,7 @@ nsAccessibleWrap::FirePlatformEvent(nsIA
-    case nsIAccessibleEvent::EVENT_TABLE_ROW_DELETE:
-      {
-         MAI_LOG_DEBUG(("\n\nReceived: EVENT_TABLE_ROW_DELETE\n"));
--        nsCOMPtr<nsIAccessibleTableChangeEvent> tableEvent = do_QueryInterface(aEvent);
-+        nsIAccessibleTableChangeEvent* tableEvent = do_QueryInterface(aEvent);
-         NS_ENSURE_TRUE(tableEvent, NS_ERROR_FAILURE);
- 
-         PRInt32 rowIndex, numRows;
-@@ -1248,7 +1248,7 @@ nsAccessibleWrap::FirePlatformEvent(nsIA
-     case nsIAccessibleEvent::EVENT_TABLE_COLUMN_INSERT:
-       {
-         MAI_LOG_DEBUG(("\n\nReceived: EVENT_TABLE_COLUMN_INSERT\n"));
--        nsCOMPtr<nsIAccessibleTableChangeEvent> tableEvent = do_QueryInterface(aEvent);
-+        nsIAccessibleTableChangeEvent* tableEvent = do_QueryInterface(aEvent);
-         NS_ENSURE_TRUE(tableEvent, NS_ERROR_FAILURE);
- 
-         PRInt32 colIndex, numCols;
-@@ -1266,7 +1266,7 @@ nsAccessibleWrap::FirePlatformEvent(nsIA
-     case nsIAccessibleEvent::EVENT_TABLE_COLUMN_DELETE:
-       {
-         MAI_LOG_DEBUG(("\n\nReceived: EVENT_TABLE_COLUMN_DELETE\n"));
--        nsCOMPtr<nsIAccessibleTableChangeEvent> tableEvent = do_QueryInterface(aEvent);
-+        nsIAccessibleTableChangeEvent* tableEvent = do_QueryInterface(aEvent);
-         NS_ENSURE_TRUE(tableEvent, NS_ERROR_FAILURE);
- 
-         PRInt32 colIndex, numCols;
-@@ -1317,7 +1317,7 @@ nsAccessibleWrap::FirePlatformEvent(nsIA
-       {
-         MAI_LOG_DEBUG(("\n\nReceived: EVENT_WINDOW_ACTIVATED\n"));
-         nsRootAccessible *rootAcc =
--          static_cast<nsRootAccessible *>(accessible.get());
-+          static_cast<nsRootAccessible *>(accessible);
-         rootAcc->mActivated = PR_TRUE;
-         guint id = g_signal_lookup ("activate", MAI_TYPE_ATK_OBJECT);
-         g_signal_emit(atkObj, id, 0);
-@@ -1330,7 +1330,7 @@ nsAccessibleWrap::FirePlatformEvent(nsIA
-       {
-         MAI_LOG_DEBUG(("\n\nReceived: EVENT_WINDOW_DEACTIVATED\n"));
-         nsRootAccessible *rootAcc =
--          static_cast<nsRootAccessible *>(accessible.get());
-+          static_cast<nsRootAccessible *>(accessible);
-         rootAcc->mActivated = PR_FALSE;
-         guint id = g_signal_lookup ("deactivate", MAI_TYPE_ATK_OBJECT);
-         g_signal_emit(atkObj, id, 0);
-@@ -1377,7 +1377,7 @@ nsAccessibleWrap::FireAtkStateChangeEven
- {
-     MAI_LOG_DEBUG(("\n\nReceived: EVENT_STATE_CHANGE\n"));
- 
--    nsCOMPtr<nsIAccessibleStateChangeEvent> event =
-+    nsIAccessibleStateChangeEvent* event =
-         do_QueryInterface(aEvent);
-     NS_ENSURE_TRUE(event, NS_ERROR_FAILURE);
- 
-@@ -1419,7 +1419,7 @@ nsAccessibleWrap::FireAtkTextChangedEven
- {
-     MAI_LOG_DEBUG(("\n\nReceived: EVENT_TEXT_REMOVED/INSERTED\n"));
- 
--    nsCOMPtr<nsIAccessibleTextChangeEvent> event =
-+    nsIAccessibleTextChangeEvent* event =
-         do_QueryInterface(aEvent);
-     NS_ENSURE_TRUE(event, NS_ERROR_FAILURE);
- 
-diff --git a/accessible/src/atk/nsAppRootAccessible.cpp b/accessible/src/atk/nsAppRootAccessible.cpp
---- a/accessible/src/atk/nsAppRootAccessible.cpp
-+++ b/accessible/src/atk/nsAppRootAccessible.cpp
-@@ -435,7 +435,7 @@ AtkObject *
- AtkObject *
- mai_util_get_root(void)
- {
--    nsRefPtr<nsApplicationAccessibleWrap> root =
-+    nsApplicationAccessibleWrap* root =
-         nsAccessNode::GetApplicationAccessible();
- 
-     if (root)
-@@ -541,7 +541,7 @@ nsApplicationAccessibleWrap::Init()
-     } else {
-         //check gconf-2 setting
-         nsresult rv;
--        nsCOMPtr<nsIPrefBranch> sysPrefService =
-+        nsIPrefBranch* sysPrefService =
-             do_GetService(sSysPrefService, &rv);
-         if (NS_SUCCEEDED(rv) && sysPrefService) {
-             sysPrefService->GetBoolPref(sAccessibilityKey, &isGnomeATEnabled);
-@@ -665,7 +665,7 @@ nsApplicationAccessibleWrap::RemoveRootA
-     nsresult rv = NS_ERROR_FAILURE;
- 
-     // we must use weak ref to get the index
--    nsCOMPtr<nsIWeakReference> weakPtr = do_GetWeakReference(aRootAccWrap);
-+    nsIWeakReference* weakPtr = do_GetWeakReference(aRootAccWrap);
-     rv = mChildren->IndexOf(0, weakPtr, &index);
- 
-     AtkObject *atkAccessible = nsAccessibleWrap::GetAtkObject(aRootAccWrap);
-diff --git a/accessible/src/atk/nsMaiHyperlink.cpp b/accessible/src/atk/nsMaiHyperlink.cpp
---- a/accessible/src/atk/nsMaiHyperlink.cpp
-+++ b/accessible/src/atk/nsMaiHyperlink.cpp
-@@ -144,7 +144,7 @@ MaiHyperlink::GetAtkHyperlink(void)
-     if (mMaiAtkHyperlink)
-         return mMaiAtkHyperlink;
- 
--    nsCOMPtr<nsIAccessibleHyperLink> accessIf(do_QueryInterface(mHyperlink));
-+    nsIAccessibleHyperLink* accessIf(do_QueryInterface(mHyperlink));
-     if (!accessIf)
-         return nsnull;
- 
-@@ -219,8 +219,8 @@ getUriCB(AtkHyperlink *aLink, gint aLink
- 
-     MaiAtkHyperlink *maiAtkHyperlink = MAI_ATK_HYPERLINK(aLink);
- 
--    nsCOMPtr<nsIURI> uri;
--    nsresult rv = accHyperlink->GetURI(aLinkIndex,getter_AddRefs(uri));
-+    nsIURI* uri = nsnull;
-+    nsresult rv = accHyperlink->GetURI(aLinkIndex,&uri);
-     if (NS_FAILED(rv) || !uri)
-         return nsnull;
-     nsCAutoString cautoStr;
-@@ -235,8 +235,8 @@ getObjectCB(AtkHyperlink *aLink, gint aL
-     nsIAccessibleHyperLink *accHyperlink = get_accessible_hyperlink(aLink);
-     NS_ENSURE_TRUE(accHyperlink, nsnull);
- 
--    nsCOMPtr<nsIAccessible> accObj;
--    accHyperlink->GetAnchor(aLinkIndex, getter_AddRefs(accObj));
-+    nsIAccessible* accObj = nsnull;
-+    accHyperlink->GetAnchor(aLinkIndex, &accObj);
-     NS_ENSURE_TRUE(accObj, nsnull);
- 
-     AtkObject *atkObj = nsAccessibleWrap::GetAtkObject(accObj);
-diff --git a/accessible/src/atk/nsMaiInterfaceAction.cpp b/accessible/src/atk/nsMaiInterfaceAction.cpp
---- a/accessible/src/atk/nsMaiInterfaceAction.cpp
-+++ b/accessible/src/atk/nsMaiInterfaceAction.cpp
-@@ -119,8 +119,8 @@ getKeyBindingCB(AtkAction *aAction, gint
-     nsresult rv = accWrap->GetKeyboardShortcut(accessKey);
- 
-     if (NS_SUCCEEDED(rv) && !accessKey.IsEmpty()) {
--        nsCOMPtr<nsIAccessible> parentAccessible;
--        accWrap->GetParent(getter_AddRefs(parentAccessible));
-+        nsIAccessible* parentAccessible = nsnull;
-+        accWrap->GetParent(&parentAccessible);
-         if (parentAccessible) {
-             PRUint32 role;
-             parentAccessible->GetRole(&role);
-@@ -135,7 +135,7 @@ getKeyBindingCB(AtkAction *aAction, gint
-             else if ((role == ATK_ROLE_MENU) || (role == ATK_ROLE_MENU_ITEM)) {
-                 //it is submenu, change from "s" to "s;<Alt>f:s"
-                 nsAutoString allKey = accessKey;
--                nsCOMPtr<nsIAccessible> grandParentAcc = parentAccessible;
-+                nsIAccessible* grandParentAcc = parentAccessible;
- 
-                 while ((grandParentAcc) && (role != ATK_ROLE_MENU_BAR)) {
-                     nsAutoString grandParentKey;
-@@ -147,8 +147,8 @@ getKeyBindingCB(AtkAction *aAction, gint
-                         allKey = rightChar + NS_LITERAL_STRING(":") + allKey;
-                     }
- 
--                    nsCOMPtr<nsIAccessible> tempAcc = grandParentAcc;
--                    tempAcc->GetParent(getter_AddRefs(grandParentAcc));
-+                    nsIAccessible* tempAcc = grandParentAcc;
-+                    tempAcc->GetParent(&grandParentAcc);
-                     if (grandParentAcc)
-                         grandParentAcc->GetRole(&role);
-                 }
-@@ -168,8 +168,8 @@ getKeyBindingCB(AtkAction *aAction, gint
- 
-     //get shortcut
-     nsAutoString subShortcut;
--    nsCOMPtr<nsIDOMDOMStringList> keyBindings;
--    rv = accWrap->GetKeyBindings(aActionIndex, getter_AddRefs(keyBindings));
-+    nsIDOMDOMStringList* keyBindings = nsnull;
-+    rv = accWrap->GetKeyBindings(aActionIndex, &keyBindings);
- 
-     if (NS_SUCCEEDED(rv) && keyBindings) {
-         PRUint32 length = 0;
-diff --git a/accessible/src/atk/nsMaiInterfaceComponent.cpp b/accessible/src/atk/nsMaiInterfaceComponent.cpp
---- a/accessible/src/atk/nsMaiInterfaceComponent.cpp
-+++ b/accessible/src/atk/nsMaiInterfaceComponent.cpp
-@@ -74,15 +74,15 @@ refAccessibleAtPointCB(AtkComponent *aCo
- 
-     // nsIAccessible getChildAtPoint (x,y) is in screen pixels.
-     if (aCoordType == ATK_XY_WINDOW) {
--        nsCOMPtr<nsIDOMNode> domNode;
--        accWrap->GetDOMNode(getter_AddRefs(domNode));
-+        nsIDOMNode* domNode = nsnull;
-+        accWrap->GetDOMNode(&domNode);
-         nsIntPoint winCoords = nsAccUtils::GetScreenCoordsForWindow(domNode);
-         aAccX += winCoords.x;
-         aAccY += winCoords.y;
-     }
- 
--    nsCOMPtr<nsIAccessible> pointAcc;
--    accWrap->GetChildAtPoint(aAccX, aAccY, getter_AddRefs(pointAcc));
-+    nsIAccessible* pointAcc = nsnull;
-+    accWrap->GetChildAtPoint(aAccX, aAccY, &pointAcc);
-     if (!pointAcc) {
-         return nsnull;
-     }
-@@ -115,8 +115,8 @@ getExtentsCB(AtkComponent *aComponent,
-     if (NS_FAILED(rv))
-         return;
-     if (aCoordType == ATK_XY_WINDOW) {
--        nsCOMPtr<nsIDOMNode> domNode;
--        accWrap->GetDOMNode(getter_AddRefs(domNode));
-+        nsIDOMNode* domNode = nsnull;
-+        accWrap->GetDOMNode(&domNode);
-         nsIntPoint winCoords = nsAccUtils::GetScreenCoordsForWindow(domNode);
-         nsAccX -= winCoords.x;
-         nsAccY -= winCoords.y;
-diff --git a/accessible/src/atk/nsMaiInterfaceDocument.cpp b/accessible/src/atk/nsMaiInterfaceDocument.cpp
---- a/accessible/src/atk/nsMaiInterfaceDocument.cpp
-+++ b/accessible/src/atk/nsMaiInterfaceDocument.cpp
-@@ -70,9 +70,9 @@ getDocumentLocaleCB(AtkDocument *aDocume
-     if (!accWrap)
-         return nsnull;
- 
--    nsCOMPtr<nsIAccessNode> docAccessNode;
-+    nsIAccessNode* docAccessNode = nsnull;
-     accWrap->QueryInterface(NS_GET_IID(nsIAccessNode),
--                            getter_AddRefs(docAccessNode));
-+                            (void**)&docAccessNode);
-     NS_ENSURE_TRUE(docAccessNode, nsnull);
- 
-     nsAutoString locale;
-@@ -90,9 +90,9 @@ getDocumentTypeCB(AtkDocument *aDocument
-     if (!accWrap)
-         return nsnull;
- 
--    nsCOMPtr<nsIAccessibleDocument> accDocument;
-+    nsIAccessibleDocument* accDocument = nsnull;
-     accWrap->QueryInterface(NS_GET_IID(nsIAccessibleDocument),
--                            getter_AddRefs(accDocument));
-+                            (void**)&accDocument);
-     NS_ENSURE_TRUE(accDocument, nsnull);
- 
-     nsAutoString mimeType;
-@@ -118,9 +118,9 @@ getDocumentAttributesCB(AtkDocument *aDo
-     if (!accWrap)
-         return nsnull;
- 
--    nsCOMPtr<nsIAccessibleDocument> accDocument;
-+    nsIAccessibleDocument* accDocument = nsnull;
-     accWrap->QueryInterface(NS_GET_IID(nsIAccessibleDocument),
--                            getter_AddRefs(accDocument));
-+                            (void**)&accDocument);
-     NS_ENSURE_TRUE(accDocument, nsnull);
- 
-     // according to atkobject.h, AtkAttributeSet is a GSList
-@@ -153,9 +153,9 @@ getDocumentAttributeValueCB(AtkDocument 
-     if (!accWrap)
-         return nsnull;
- 
--    nsCOMPtr<nsIAccessibleDocument> accDocument;
-+    nsIAccessibleDocument* accDocument = nsnull;
-     accWrap->QueryInterface(NS_GET_IID(nsIAccessibleDocument),
--                            getter_AddRefs(accDocument));
-+                            (void**)&accDocument);
-     NS_ENSURE_TRUE(accDocument, nsnull);
- 
-     nsresult rv;
-diff --git a/accessible/src/atk/nsMaiInterfaceEditableText.cpp b/accessible/src/atk/nsMaiInterfaceEditableText.cpp
---- a/accessible/src/atk/nsMaiInterfaceEditableText.cpp
-+++ b/accessible/src/atk/nsMaiInterfaceEditableText.cpp
-@@ -68,12 +68,12 @@ setRunAttributesCB(AtkEditableText *aTex
-     if (!accWrap)
-         return FALSE;
- 
--    nsCOMPtr<nsIAccessibleEditableText> accText;
-+    nsIAccessibleEditableText* accText = nsnull;
-     accWrap->QueryInterface(NS_GET_IID(nsIAccessibleEditableText),
--                            getter_AddRefs(accText));
-+                            (void**)&accText);
-     NS_ENSURE_TRUE(accText, FALSE);
- 
--    nsCOMPtr<nsISupports> attrSet;
-+    nsISupports* attrSet = nsnull;
-     /* how to insert attributes into nsISupports ??? */
- 
-     nsresult rv = accText->SetAttributes(aStartOffset, aEndOffset,
-@@ -88,9 +88,9 @@ setTextContentsCB(AtkEditableText *aText
-     if (!accWrap)
-         return;
- 
--    nsCOMPtr<nsIAccessibleEditableText> accText;
-+    nsIAccessibleEditableText* accText = nsnull;
-     accWrap->QueryInterface(NS_GET_IID(nsIAccessibleEditableText),
--                            getter_AddRefs(accText));
-+                            (void**)&accText);
-     if (!accText)
-         return;
- 
-@@ -108,9 +108,9 @@ insertTextCB(AtkEditableText *aText,
-     if (!accWrap)
-         return;
- 
--    nsCOMPtr<nsIAccessibleEditableText> accText;
-+    nsIAccessibleEditableText* accText = nsnull;
-     accWrap->QueryInterface(NS_GET_IID(nsIAccessibleEditableText),
--                            getter_AddRefs(accText));
-+                            (void**)&accText);
-     if (!accText)
-         return;
- 
-@@ -135,9 +135,9 @@ copyTextCB(AtkEditableText *aText, gint 
-     if (!accWrap)
-         return;
- 
--    nsCOMPtr<nsIAccessibleEditableText> accText;
-+    nsIAccessibleEditableText* accText = nsnull;
-     accWrap->QueryInterface(NS_GET_IID(nsIAccessibleEditableText),
--                            getter_AddRefs(accText));
-+                            (void**)&accText);
-     if (!accText)
-         return;
- 
-@@ -153,9 +153,9 @@ cutTextCB(AtkEditableText *aText, gint a
-     if (!accWrap)
-         return;
- 
--    nsCOMPtr<nsIAccessibleEditableText> accText;
-+    nsIAccessibleEditableText* accText = nsnull;
-     accWrap->QueryInterface(NS_GET_IID(nsIAccessibleEditableText),
--                            getter_AddRefs(accText));
-+                            (void**)&accText);
-     if (!accText)
-         return;
-     MAI_LOG_DEBUG(("EditableText: cutTextCB, aStartPos=%d, aEndPos=%d",
-@@ -170,9 +170,9 @@ deleteTextCB(AtkEditableText *aText, gin
-     if (!accWrap)
-         return;
- 
--    nsCOMPtr<nsIAccessibleEditableText> accText;
-+    nsIAccessibleEditableText* accText = nsnull;
-     accWrap->QueryInterface(NS_GET_IID(nsIAccessibleEditableText),
--                            getter_AddRefs(accText));
-+                            (void**)&accText);
-     if (!accText)
-         return;
- 
-@@ -188,9 +188,9 @@ pasteTextCB(AtkEditableText *aText, gint
-     if (!accWrap)
-         return;
- 
--    nsCOMPtr<nsIAccessibleEditableText> accText;
-+    nsIAccessibleEditableText* accText = nsnull;
-     accWrap->QueryInterface(NS_GET_IID(nsIAccessibleEditableText),
--                            getter_AddRefs(accText));
-+                            (void**)&accText);
-     if (!accText)
-         return;
- 
-diff --git a/accessible/src/atk/nsMaiInterfaceHyperlinkImpl.cpp b/accessible/src/atk/nsMaiInterfaceHyperlinkImpl.cpp
---- a/accessible/src/atk/nsMaiInterfaceHyperlinkImpl.cpp
-+++ b/accessible/src/atk/nsMaiInterfaceHyperlinkImpl.cpp
-@@ -56,9 +56,9 @@ getHyperlinkCB(AtkHyperlinkImpl *aImpl)
-     if (!accWrap)
-         return nsnull;
- 
--    nsCOMPtr<nsIAccessibleHyperLink> accHyperlink;
-+    nsIAccessibleHyperLink* accHyperlink = nsnull;
-     accWrap->QueryInterface(NS_GET_IID(nsIAccessibleHyperLink),
--                            getter_AddRefs(accHyperlink));
-+                            (void**)&accHyperlink);
-     NS_ENSURE_TRUE(accHyperlink, nsnull);
-     
-     MaiHyperlink *maiHyperlink = accWrap->GetMaiHyperlink();
-diff --git a/accessible/src/atk/nsMaiInterfaceHypertext.cpp b/accessible/src/atk/nsMaiInterfaceHypertext.cpp
---- a/accessible/src/atk/nsMaiInterfaceHypertext.cpp
-+++ b/accessible/src/atk/nsMaiInterfaceHypertext.cpp
-@@ -59,17 +59,17 @@ getLinkCB(AtkHypertext *aText, gint aLin
-     if (!accWrap)
-         return nsnull;
- 
--    nsCOMPtr<nsIAccessibleHyperText> hyperText;
-+    nsIAccessibleHyperText* hyperText = nsnull;
-     accWrap->QueryInterface(NS_GET_IID(nsIAccessibleHyperText),
--                            getter_AddRefs(hyperText));
-+                            (void**)&hyperText);
-     NS_ENSURE_TRUE(hyperText, nsnull);
- 
--    nsCOMPtr<nsIAccessibleHyperLink> hyperLink;
--    nsresult rv = hyperText->GetLink(aLinkIndex, getter_AddRefs(hyperLink));
-+    nsIAccessibleHyperLink* hyperLink = nsnull;
-+    nsresult rv = hyperText->GetLink(aLinkIndex, &hyperLink);
-     if (NS_FAILED(rv) || !hyperLink)
-         return nsnull;
- 
--    nsCOMPtr<nsIAccessible> hyperLinkAcc(do_QueryInterface(hyperLink));
-+    nsIAccessible* hyperLinkAcc(do_QueryInterface(hyperLink));
-     AtkObject *hyperLinkAtkObj = nsAccessibleWrap::GetAtkObject(hyperLinkAcc);
-     nsAccessibleWrap *accChild = GetAccessibleWrap(hyperLinkAtkObj);
-     NS_ENSURE_TRUE(accChild, nsnull);
-@@ -86,9 +86,9 @@ getLinkCountCB(AtkHypertext *aText)
-     if (!accWrap)
-         return -1;
- 
--    nsCOMPtr<nsIAccessibleHyperText> hyperText;
-+    nsIAccessibleHyperText* hyperText = nsnull;
-     accWrap->QueryInterface(NS_GET_IID(nsIAccessibleHyperText),
--                            getter_AddRefs(hyperText));
-+                            (void**)&hyperText);
-     NS_ENSURE_TRUE(hyperText, -1);
- 
-     PRInt32 count = -1;
-@@ -105,9 +105,9 @@ getLinkIndexCB(AtkHypertext *aText, gint
-     if (!accWrap)
-         return -1;
- 
--    nsCOMPtr<nsIAccessibleHyperText> hyperText;
-+    nsIAccessibleHyperText* hyperText = nsnull;
-     accWrap->QueryInterface(NS_GET_IID(nsIAccessibleHyperText),
--                            getter_AddRefs(hyperText));
-+                            (void**)&hyperText);
-     NS_ENSURE_TRUE(hyperText, -1);
- 
-     PRInt32 index = -1;
-diff --git a/accessible/src/atk/nsMaiInterfaceImage.cpp b/accessible/src/atk/nsMaiInterfaceImage.cpp
---- a/accessible/src/atk/nsMaiInterfaceImage.cpp
-+++ b/accessible/src/atk/nsMaiInterfaceImage.cpp
-@@ -62,9 +62,9 @@ getImagePositionCB(AtkImage *aImage, gin
-     if (!accWrap) 
-       return;
- 
--    nsCOMPtr<nsIAccessibleImage> image;
-+    nsIAccessibleImage* image = nsnull;
-     accWrap->QueryInterface(NS_GET_IID(nsIAccessibleImage),
--                            getter_AddRefs(image));
-+                            (void**)&image);
-     if (!image)
-       return;
- 
-@@ -89,9 +89,9 @@ getImageSizeCB(AtkImage *aImage, gint *a
-     if (!accWrap) 
-       return;
- 
--    nsCOMPtr<nsIAccessibleImage> image;
-+    nsIAccessibleImage* image = nsnull;
-     accWrap->QueryInterface(NS_GET_IID(nsIAccessibleImage),
--                            getter_AddRefs(image));
-+                            (void**)&image);
-     if (!image)
-       return;
- 
-diff --git a/accessible/src/atk/nsMaiInterfaceSelection.cpp b/accessible/src/atk/nsMaiInterfaceSelection.cpp
---- a/accessible/src/atk/nsMaiInterfaceSelection.cpp
-+++ b/accessible/src/atk/nsMaiInterfaceSelection.cpp
-@@ -63,9 +63,9 @@ addSelectionCB(AtkSelection *aSelection,
-     if (!accWrap)
-         return FALSE;
- 
--    nsCOMPtr<nsIAccessibleSelectable> accSelection;
-+    nsIAccessibleSelectable* accSelection = nsnull;
-     accWrap->QueryInterface(NS_GET_IID(nsIAccessibleSelectable),
--                            getter_AddRefs(accSelection));
-+                            (void**)&accSelection);
-     NS_ENSURE_TRUE(accSelection, FALSE);
- 
-     return NS_SUCCEEDED(accSelection->AddChildToSelection(i));
-@@ -78,9 +78,9 @@ clearSelectionCB(AtkSelection *aSelectio
-     if (!accWrap)
-         return FALSE;
- 
--    nsCOMPtr<nsIAccessibleSelectable> accSelection;
-+    nsIAccessibleSelectable* accSelection = nsnull;
-     accWrap->QueryInterface(NS_GET_IID(nsIAccessibleSelectable),
--                            getter_AddRefs(accSelection));
-+                            (void**)&accSelection);
-     NS_ENSURE_TRUE(accSelection, FALSE);
- 
-     return NS_SUCCEEDED(accSelection->ClearSelection());
-@@ -93,13 +93,13 @@ refSelectionCB(AtkSelection *aSelection,
-     if (!accWrap)
-         return nsnull;
- 
--    nsCOMPtr<nsIAccessibleSelectable> accSelection;
-+    nsIAccessibleSelectable* accSelection = nsnull;
-     accWrap->QueryInterface(NS_GET_IID(nsIAccessibleSelectable),
--                            getter_AddRefs(accSelection));
-+                            (void**)&accSelection);
-     NS_ENSURE_TRUE(accSelection, nsnull);
- 
--    nsCOMPtr<nsIAccessible> accSelect;
--    accSelection->RefSelection(i, getter_AddRefs(accSelect));
-+    nsIAccessible* accSelect = nsnull;
-+    accSelection->RefSelection(i, &accSelect);
-     if (!accSelect) {
-         return nsnull;
-     }
-@@ -118,9 +118,9 @@ getSelectionCountCB(AtkSelection *aSelec
-     if (!accWrap)
-         return -1;
- 
--    nsCOMPtr<nsIAccessibleSelectable> accSelection;
-+    nsIAccessibleSelectable* accSelection = nsnull;
-     accWrap->QueryInterface(NS_GET_IID(nsIAccessibleSelectable),
--                            getter_AddRefs(accSelection));
-+                            (void**)&accSelection);
-     NS_ENSURE_TRUE(accSelection, -1);
- 
-     PRInt32 num = 0;
-@@ -135,9 +135,9 @@ isChildSelectedCB(AtkSelection *aSelecti
-     if (!accWrap)
-         return FALSE;
- 
--    nsCOMPtr<nsIAccessibleSelectable> accSelection;
-+    nsIAccessibleSelectable* accSelection = nsnull;
-     accWrap->QueryInterface(NS_GET_IID(nsIAccessibleSelectable),
--                            getter_AddRefs(accSelection));
-+                            (void**)&accSelection);
-     NS_ENSURE_TRUE(accSelection, FALSE);
- 
-     PRBool result = FALSE;
-@@ -152,9 +152,9 @@ removeSelectionCB(AtkSelection *aSelecti
-     if (!accWrap)
-         return FALSE;
- 
--    nsCOMPtr<nsIAccessibleSelectable> accSelection;
-+    nsIAccessibleSelectable* accSelection = nsnull;
-     accWrap->QueryInterface(NS_GET_IID(nsIAccessibleSelectable),
--                            getter_AddRefs(accSelection));
-+                            (void**)&accSelection);
-     NS_ENSURE_TRUE(accSelection, FALSE);
- 
-     nsresult rv = accSelection->RemoveChildFromSelection(i);
-@@ -168,9 +168,9 @@ selectAllSelectionCB(AtkSelection *aSele
-     if (!accWrap)
-         return FALSE;
- 
--    nsCOMPtr<nsIAccessibleSelectable> accSelection;
-+    nsIAccessibleSelectable* accSelection = nsnull;
-     accWrap->QueryInterface(NS_GET_IID(nsIAccessibleSelectable),
--                            getter_AddRefs(accSelection));
-+                            (void**)&accSelection);
-     NS_ENSURE_TRUE(accSelection, FALSE);
- 
-     PRBool result = FALSE;
-diff --git a/accessible/src/atk/nsMaiInterfaceTable.cpp b/accessible/src/atk/nsMaiInterfaceTable.cpp
---- a/accessible/src/atk/nsMaiInterfaceTable.cpp
-+++ b/accessible/src/atk/nsMaiInterfaceTable.cpp
-@@ -75,13 +75,13 @@ refAtCB(AtkTable *aTable, gint aRow, gin
-     if (!accWrap)
-         return nsnull;
- 
--    nsCOMPtr<nsIAccessibleTable> accTable;
-+    nsIAccessibleTable* accTable = nsnull;
-     accWrap->QueryInterface(NS_GET_IID(nsIAccessibleTable),
--                            getter_AddRefs(accTable));
-+                            (void**)&accTable);
-     NS_ENSURE_TRUE(accTable, nsnull);
- 
--    nsCOMPtr<nsIAccessible> cell;
--    nsresult rv = accTable->CellRefAt(aRow, aColumn,getter_AddRefs(cell));
-+    nsIAccessible* cell = nsnull;
-+    nsresult rv = accTable->CellRefAt(aRow, aColumn,&cell);
-     if (NS_FAILED(rv) || !cell)
-         return nsnull;
- 
-@@ -99,9 +99,9 @@ getIndexAtCB(AtkTable *aTable, gint aRow
-     if (!accWrap)
-         return -1;
- 
--    nsCOMPtr<nsIAccessibleTable> accTable;
-+    nsIAccessibleTable* accTable = nsnull;
-     accWrap->QueryInterface(NS_GET_IID(nsIAccessibleTable),
--                            getter_AddRefs(accTable));
-+                            (void**)&accTable);
-     NS_ENSURE_TRUE(accTable, -1);
- 
-     PRInt32 index;
-@@ -118,9 +118,9 @@ getColumnAtIndexCB(AtkTable *aTable, gin
-     if (!accWrap)
-         return -1;
- 
--    nsCOMPtr<nsIAccessibleTable> accTable;
-+    nsIAccessibleTable* accTable = nsnull;
-     accWrap->QueryInterface(NS_GET_IID(nsIAccessibleTable),
--                            getter_AddRefs(accTable));
-+                            (void**)&accTable);
-     NS_ENSURE_TRUE(accTable, -1);
- 
-     PRInt32 col;
-@@ -137,9 +137,9 @@ getRowAtIndexCB(AtkTable *aTable, gint a
-     if (!accWrap)
-         return -1;
- 
--    nsCOMPtr<nsIAccessibleTable> accTable;
-+    nsIAccessibleTable* accTable = nsnull;
-     accWrap->QueryInterface(NS_GET_IID(nsIAccessibleTable),
--                            getter_AddRefs(accTable));
-+                            (void**)&accTable);
-     NS_ENSURE_TRUE(accTable, -1);
- 
-     PRInt32 row;
-@@ -156,9 +156,9 @@ getColumnCountCB(AtkTable *aTable)
-     if (!accWrap)
-         return -1;
- 
--    nsCOMPtr<nsIAccessibleTable> accTable;
-+    nsIAccessibleTable* accTable = nsnull;
-     accWrap->QueryInterface(NS_GET_IID(nsIAccessibleTable),
--                            getter_AddRefs(accTable));
-+                            (void**)&accTable);
-     NS_ENSURE_TRUE(accTable, -1);
- 
-     PRInt32 count;
-@@ -175,9 +175,9 @@ getRowCountCB(AtkTable *aTable)
-     if (!accWrap)
-         return -1;
- 
--    nsCOMPtr<nsIAccessibleTable> accTable;
-+    nsIAccessibleTable* accTable = nsnull;
-     accWrap->QueryInterface(NS_GET_IID(nsIAccessibleTable),
--                            getter_AddRefs(accTable));
-+                            (void**)&accTable);
-     NS_ENSURE_TRUE(accTable, -1);
- 
-     PRInt32 count;
-@@ -195,9 +195,9 @@ getColumnExtentAtCB(AtkTable *aTable,
-     if (!accWrap)
-         return -1;
- 
--    nsCOMPtr<nsIAccessibleTable> accTable;
-+    nsIAccessibleTable* accTable = nsnull;
-     accWrap->QueryInterface(NS_GET_IID(nsIAccessibleTable),
--                            getter_AddRefs(accTable));
-+                            (void**)&accTable);
-     NS_ENSURE_TRUE(accTable, -1);
- 
-     PRInt32 extent;
-@@ -215,9 +215,9 @@ getRowExtentAtCB(AtkTable *aTable,
-     if (!accWrap)
-         return -1;
- 
--    nsCOMPtr<nsIAccessibleTable> accTable;
-+    nsIAccessibleTable* accTable = nsnull;
-     accWrap->QueryInterface(NS_GET_IID(nsIAccessibleTable),
--                            getter_AddRefs(accTable));
-+                            (void**)&accTable);
-     NS_ENSURE_TRUE(accTable, -1);
- 
-     PRInt32 extent;
-@@ -234,13 +234,13 @@ getCaptionCB(AtkTable *aTable)
-     if (!accWrap)
-         return nsnull;
- 
--    nsCOMPtr<nsIAccessibleTable> accTable;
-+    nsIAccessibleTable* accTable = nsnull;
-     accWrap->QueryInterface(NS_GET_IID(nsIAccessibleTable),
--                            getter_AddRefs(accTable));
-+                            (void**)&accTable);
-     NS_ENSURE_TRUE(accTable, nsnull);
- 
--    nsCOMPtr<nsIAccessible> caption;
--    nsresult rv = accTable->GetCaption(getter_AddRefs(caption));
-+    nsIAccessible* caption = nsnull;
-+    nsresult rv = accTable->GetCaption(&caption);
-     if (NS_FAILED(rv) || !caption)
-         return nsnull;
- 
-@@ -254,9 +254,9 @@ getColumnDescriptionCB(AtkTable *aTable,
-     if (!accWrap)
-         return nsnull;
- 
--    nsCOMPtr<nsIAccessibleTable> accTable;
-+    nsIAccessibleTable* accTable = nsnull;
-     accWrap->QueryInterface(NS_GET_IID(nsIAccessibleTable),
--                            getter_AddRefs(accTable));
-+                            (void**)&accTable);
-     NS_ENSURE_TRUE(accTable, nsnull);
- 
-     nsAutoString autoStr;
-@@ -273,13 +273,13 @@ getColumnHeaderCB(AtkTable *aTable, gint
-     if (!accWrap)
-         return nsnull;
- 
--    nsCOMPtr<nsIAccessibleTable> accTable;
-+    nsIAccessibleTable* accTable = nsnull;
-     accWrap->QueryInterface(NS_GET_IID(nsIAccessibleTable),
--                            getter_AddRefs(accTable));
-+                            (void**)&accTable);
-     NS_ENSURE_TRUE(accTable, nsnull);
- 
--    nsCOMPtr<nsIAccessibleTable> header;
--    nsresult rv = accTable->GetColumnHeader(getter_AddRefs(header));
-+    nsIAccessibleTable* header = nsnull;
-+    nsresult rv = accTable->GetColumnHeader(&header);
-     NS_ENSURE_SUCCESS(rv, nsnull);
-     NS_ENSURE_TRUE(header, nsnull);
- 
-@@ -292,8 +292,8 @@ getColumnHeaderCB(AtkTable *aTable, gint
-     // 2. "GetColumnHeader" defined in nsIAccessibleTable returns
-     // nsXULTreeColumnsAccessibleWrap, which exports nsIAccessibleTable and is
-     // "ROLE_LIST".
--    nsCOMPtr<nsIAccessible> accHeader;
--    header->CellRefAt(0, aColumn, getter_AddRefs(accHeader));
-+    nsIAccessible* accHeader = nsnull;
-+    header->CellRefAt(0, aColumn, &accHeader);
-     NS_ENSURE_TRUE(accHeader, nsnull);
- 
-     return nsAccessibleWrap::GetAtkObject(accHeader);
-@@ -306,9 +306,9 @@ getRowDescriptionCB(AtkTable *aTable, gi
-     if (!accWrap)
-         return nsnull;
- 
--    nsCOMPtr<nsIAccessibleTable> accTable;
-+    nsIAccessibleTable* accTable = nsnull;
-     accWrap->QueryInterface(NS_GET_IID(nsIAccessibleTable),
--                            getter_AddRefs(accTable));
-+                            (void**)&accTable);
-     NS_ENSURE_TRUE(accTable, nsnull);
- 
-     nsAutoString autoStr;
-@@ -325,16 +325,16 @@ getRowHeaderCB(AtkTable *aTable, gint aR
-     if (!accWrap)
-         return nsnull;
- 
--    nsCOMPtr<nsIAccessibleTable> accTable;
-+    nsIAccessibleTable* accTable = nsnull;
-     accWrap->QueryInterface(NS_GET_IID(nsIAccessibleTable),
--                            getter_AddRefs(accTable));
-+                            (void**)&accTable);
-     NS_ENSURE_TRUE(accTable, nsnull);
- 
--    nsCOMPtr<nsIAccessibleTable> header;
--    nsresult rv = accTable->GetRowHeader(getter_AddRefs(header));
-+    nsIAccessibleTable* header = nsnull;
-+    nsresult rv = accTable->GetRowHeader(&header);
-     NS_ENSURE_SUCCESS(rv, nsnull);
- 
--    nsCOMPtr<nsIAccessible> accHeader(do_QueryInterface(header));
-+    nsIAccessible* accHeader(do_QueryInterface(header));
-     NS_ENSURE_TRUE(accHeader, nsnull);
- 
-     return nsAccessibleWrap::GetAtkObject(accHeader);
-@@ -357,9 +357,9 @@ getSelectedColumnsCB(AtkTable *aTable, g
-     if (!accWrap)
-         return 0;
- 
--    nsCOMPtr<nsIAccessibleTable> accTable;
-+    nsIAccessibleTable* accTable = nsnull;
-     accWrap->QueryInterface(NS_GET_IID(nsIAccessibleTable),
--                            getter_AddRefs(accTable));
-+                            (void**)&accTable);
-     NS_ENSURE_TRUE(accTable, 0);
- 
-     PRUint32 size = 0;
-@@ -392,9 +392,9 @@ getSelectedRowsCB(AtkTable *aTable, gint
-     if (!accWrap)
-         return 0;
- 
--    nsCOMPtr<nsIAccessibleTable> accTable;
-+    nsIAccessibleTable* accTable = nsnull;
-     accWrap->QueryInterface(NS_GET_IID(nsIAccessibleTable),
--                            getter_AddRefs(accTable));
-+                            (void**)&accTable);
-     NS_ENSURE_TRUE(accTable, 0);
- 
-     PRUint32 size = 0;
-@@ -427,9 +427,9 @@ isColumnSelectedCB(AtkTable *aTable, gin
-     if (!accWrap)
-         return FALSE;
- 
--    nsCOMPtr<nsIAccessibleTable> accTable;
-+    nsIAccessibleTable* accTable = nsnull;
-     accWrap->QueryInterface(NS_GET_IID(nsIAccessibleTable),
--                            getter_AddRefs(accTable));
-+                            (void**)&accTable);
-     NS_ENSURE_TRUE(accTable, FALSE);
- 
-     PRBool outValue;
-@@ -444,9 +444,9 @@ isRowSelectedCB(AtkTable *aTable, gint a
-     if (!accWrap)
-         return FALSE;
- 
--    nsCOMPtr<nsIAccessibleTable> accTable;
-+    nsIAccessibleTable* accTable = nsnull;
-     accWrap->QueryInterface(NS_GET_IID(nsIAccessibleTable),
--                            getter_AddRefs(accTable));
-+                            (void**)&accTable);
-     NS_ENSURE_TRUE(accTable, FALSE);
- 
-     PRBool outValue;
-@@ -461,9 +461,9 @@ isCellSelectedCB(AtkTable *aTable, gint 
-     if (!accWrap)
-         return FALSE;
- 
--    nsCOMPtr<nsIAccessibleTable> accTable;
-+    nsIAccessibleTable* accTable = nsnull;
-     accWrap->QueryInterface(NS_GET_IID(nsIAccessibleTable),
--                            getter_AddRefs(accTable));
-+                            (void**)&accTable);
-     NS_ENSURE_TRUE(accTable, FALSE);
- 
-     PRBool outValue;
-diff --git a/accessible/src/atk/nsMaiInterfaceText.cpp b/accessible/src/atk/nsMaiInterfaceText.cpp
---- a/accessible/src/atk/nsMaiInterfaceText.cpp
-+++ b/accessible/src/atk/nsMaiInterfaceText.cpp
-@@ -92,9 +92,9 @@ getTextCB(AtkText *aText, gint aStartOff
-     if (!accWrap)
-         return nsnull;
- 
--    nsCOMPtr<nsIAccessibleText> accText;
-+    nsIAccessibleText* accText = nsnull;
-     accWrap->QueryInterface(NS_GET_IID(nsIAccessibleText),
--                            getter_AddRefs(accText));
-+                            (void**)&accText);
-     NS_ENSURE_TRUE(accText, nsnull);
- 
-     nsAutoString autoStr;
-@@ -117,9 +117,9 @@ getTextAfterOffsetCB(AtkText *aText, gin
-     if (!accWrap)
-         return nsnull;
- 
--    nsCOMPtr<nsIAccessibleText> accText;
-+    nsIAccessibleText* accText = nsnull;
-     accWrap->QueryInterface(NS_GET_IID(nsIAccessibleText),
--                            getter_AddRefs(accText));
-+                            (void**)&accText);
-     NS_ENSURE_TRUE(accText, nsnull);
- 
-     nsAutoString autoStr;
-@@ -146,9 +146,9 @@ getTextAtOffsetCB(AtkText *aText, gint a
-     if (!accWrap)
-         return nsnull;
- 
--    nsCOMPtr<nsIAccessibleText> accText;
-+    nsIAccessibleText* accText = nsnull;
-     accWrap->QueryInterface(NS_GET_IID(nsIAccessibleText),
--                            getter_AddRefs(accText));
-+                            (void**)&accText);
-     NS_ENSURE_TRUE(accText, nsnull);
- 
-     nsAutoString autoStr;
-@@ -173,9 +173,9 @@ getCharacterAtOffsetCB(AtkText *aText, g
-     if (!accWrap)
-         return 0;
- 
--    nsCOMPtr<nsIAccessibleText> accText;
-+    nsIAccessibleText* accText = nsnull;
-     accWrap->QueryInterface(NS_GET_IID(nsIAccessibleText),
--                            getter_AddRefs(accText));
-+                            (void**)&accText);
-     NS_ENSURE_TRUE(accText, 0);
- 
-     /* PRUnichar is unsigned short in Mozilla */
-@@ -203,9 +203,9 @@ getTextBeforeOffsetCB(AtkText *aText, gi
-     if (!accWrap)
-         return nsnull;
- 
--    nsCOMPtr<nsIAccessibleText> accText;
-+    nsIAccessibleText* accText = nsnull;
-     accWrap->QueryInterface(NS_GET_IID(nsIAccessibleText),
--                            getter_AddRefs(accText));
-+                            (void**)&accText);
-     NS_ENSURE_TRUE(accText, nsnull);
- 
-     nsAutoString autoStr;
-@@ -230,9 +230,9 @@ getCaretOffsetCB(AtkText *aText)
-     if (!accWrap)
-         return 0;
- 
--    nsCOMPtr<nsIAccessibleText> accText;
-+    nsIAccessibleText* accText = nsnull;
-     accWrap->QueryInterface(NS_GET_IID(nsIAccessibleText),
--                            getter_AddRefs(accText));
-+                            (void**)&accText);
-     NS_ENSURE_TRUE(accText, 0);
- 
-     PRInt32 offset;
-@@ -249,16 +249,16 @@ getRunAttributesCB(AtkText *aText, gint 
-     if (!accWrap)
-         return nsnull;
- 
--    nsCOMPtr<nsIAccessibleText> accText;
-+    nsIAccessibleText* accText = nsnull;
-     accWrap->QueryInterface(NS_GET_IID(nsIAccessibleText),
--                            getter_AddRefs(accText));
-+                            (void**)&accText);
-     NS_ENSURE_TRUE(accText, nsnull);
- 
--    nsCOMPtr<nsIAccessible> accessibleWithAttrs;
-+    nsIAccessible* accessibleWithAttrs = nsnull;
-     PRInt32 startOffset = 0, endOffset = 0;
-     nsresult rv =
-         accText->GetAttributeRange(aOffset, &startOffset, &endOffset,
--                                   getter_AddRefs(accessibleWithAttrs));
-+                                   &accessibleWithAttrs);
-     *aStartOffset = startOffset;
-     *aEndOffset = endOffset;
-     if (NS_FAILED(rv))
-@@ -284,9 +284,9 @@ getCharacterExtentsCB(AtkText *aText, gi
-     if(!accWrap || !aX || !aY || !aWidth || !aHeight)
-         return;
- 
--    nsCOMPtr<nsIAccessibleText> accText;
-+    nsIAccessibleText* accText = nsnull;
-     accWrap->QueryInterface(NS_GET_IID(nsIAccessibleText),
--                            getter_AddRefs(accText));
-+                            (void**)&accText);
-     if (!accText)
-         return;
- 
-@@ -318,9 +318,9 @@ getRangeExtentsCB(AtkText *aText, gint a
-     if(!accWrap || !aRect)
-         return;
- 
--    nsCOMPtr<nsIAccessibleText> accText;
-+    nsIAccessibleText* accText = nsnull;
-     accWrap->QueryInterface(NS_GET_IID(nsIAccessibleText),
--                            getter_AddRefs(accText));
-+                            (void**)&accText);
-     if (!accText)
-         return;
- 
-@@ -352,9 +352,9 @@ getCharacterCountCB(AtkText *aText)
-     if (!accWrap)
-         return 0;
- 
--    nsCOMPtr<nsIAccessibleText> accText;
-+    nsIAccessibleText* accText = nsnull;
-     accWrap->QueryInterface(NS_GET_IID(nsIAccessibleText),
--                            getter_AddRefs(accText));
-+                            (void**)&accText);
-     NS_ENSURE_TRUE(accText, 0);
- 
-     PRInt32 count = 0;
-@@ -371,9 +371,9 @@ getOffsetAtPointCB(AtkText *aText,
-     if (!accWrap)
-         return -1;
- 
--    nsCOMPtr<nsIAccessibleText> accText;
-+    nsIAccessibleText* accText = nsnull;
-     accWrap->QueryInterface(NS_GET_IID(nsIAccessibleText),
--                            getter_AddRefs(accText));
-+                            (void**)&accText);
-     NS_ENSURE_TRUE(accText, -1);
- 
-     PRInt32 offset = 0;
-@@ -394,9 +394,9 @@ getTextSelectionCountCB(AtkText *aText)
-     if (!accWrap)
-         return nsnull;
- 
--    nsCOMPtr<nsIAccessibleText> accText;
-+    nsIAccessibleText* accText = nsnull;
-     accWrap->QueryInterface(NS_GET_IID(nsIAccessibleText),
--                            getter_AddRefs(accText));
-+                            (void**)&accText);
-     NS_ENSURE_TRUE(accText, nsnull);
- 
-     PRInt32 selectionCount;
-@@ -413,9 +413,9 @@ getTextSelectionCB(AtkText *aText, gint 
-     if (!accWrap)
-         return nsnull;
- 
--    nsCOMPtr<nsIAccessibleText> accText;
-+    nsIAccessibleText* accText = nsnull;
-     accWrap->QueryInterface(NS_GET_IID(nsIAccessibleText),
--                            getter_AddRefs(accText));
-+                            (void**)&accText);
-     NS_ENSURE_TRUE(accText, nsnull);
- 
-     PRInt32 startOffset = 0, endOffset = 0;
-@@ -440,9 +440,9 @@ addTextSelectionCB(AtkText *aText,
-     if (!accWrap)
-         return FALSE;
- 
--    nsCOMPtr<nsIAccessibleText> accText;
-+    nsIAccessibleText* accText = nsnull;
-     accWrap->QueryInterface(NS_GET_IID(nsIAccessibleText),
--                            getter_AddRefs(accText));
-+                            (void**)&accText);
-     NS_ENSURE_TRUE(accText, FALSE);
- 
-     nsresult rv = accText->AddSelection(aStartOffset, aEndOffset);
-@@ -458,9 +458,9 @@ removeTextSelectionCB(AtkText *aText,
-     if (!accWrap)
-         return FALSE;
- 
--    nsCOMPtr<nsIAccessibleText> accText;
-+    nsIAccessibleText* accText = nsnull;
-     accWrap->QueryInterface(NS_GET_IID(nsIAccessibleText),
--                            getter_AddRefs(accText));
-+                            (void**)&accText);
-     NS_ENSURE_TRUE(accText, FALSE);
- 
-     nsresult rv = accText->RemoveSelection(aSelectionNum);
-@@ -476,9 +476,9 @@ setTextSelectionCB(AtkText *aText, gint 
-     if (!accWrap)
-         return FALSE;
- 
--    nsCOMPtr<nsIAccessibleText> accText;
-+    nsIAccessibleText* accText = nsnull;
-     accWrap->QueryInterface(NS_GET_IID(nsIAccessibleText),
--                            getter_AddRefs(accText));
-+                            (void**)&accText);
-     NS_ENSURE_TRUE(accText, FALSE);
- 
-     nsresult rv = accText->SetSelectionBounds(aSelectionNum,
-@@ -493,9 +493,9 @@ setCaretOffsetCB(AtkText *aText, gint aO
-     if (!accWrap)
-         return FALSE;
- 
--    nsCOMPtr<nsIAccessibleText> accText;
-+    nsIAccessibleText* accText = nsnull;
-     accWrap->QueryInterface(NS_GET_IID(nsIAccessibleText),
--                            getter_AddRefs(accText));
-+                            (void**)&accText);
-     NS_ENSURE_TRUE(accText, FALSE);
- 
-     nsresult rv = accText->SetCaretOffset(aOffset);
-diff --git a/accessible/src/atk/nsMaiInterfaceValue.cpp b/accessible/src/atk/nsMaiInterfaceValue.cpp
---- a/accessible/src/atk/nsMaiInterfaceValue.cpp
-+++ b/accessible/src/atk/nsMaiInterfaceValue.cpp
-@@ -61,9 +61,9 @@ getCurrentValueCB(AtkValue *obj, GValue 
-     if (!accWrap)
-         return;
- 
--    nsCOMPtr<nsIAccessibleValue> accValue;
-+    nsIAccessibleValue* accValue = nsnull;
-     accWrap->QueryInterface(NS_GET_IID(nsIAccessibleValue),
--                            getter_AddRefs(accValue));
-+                            (void**)&accValue);
-     if (!accValue)
-         return;
- 
-@@ -82,9 +82,9 @@ getMaximumValueCB(AtkValue *obj, GValue 
-     if (!accWrap)
-         return;
- 
--    nsCOMPtr<nsIAccessibleValue> accValue;
-+    nsIAccessibleValue* accValue = nsnull;
-     accWrap->QueryInterface(NS_GET_IID(nsIAccessibleValue),
--                            getter_AddRefs(accValue));
-+                            (void**)&accValue);
-     if (!accValue)
-         return;
- 
-@@ -103,9 +103,9 @@ getMinimumValueCB(AtkValue *obj, GValue 
-     if (!accWrap)
-         return;
- 
--    nsCOMPtr<nsIAccessibleValue> accValue;
-+    nsIAccessibleValue* accValue = nsnull;
-     accWrap->QueryInterface(NS_GET_IID(nsIAccessibleValue),
--                            getter_AddRefs(accValue));
-+                            (void**)&accValue);
-     if (!accValue)
-         return;
- 
-@@ -124,9 +124,9 @@ getMinimumIncrementCB(AtkValue *obj, GVa
-     if (!accWrap)
-         return;
- 
--    nsCOMPtr<nsIAccessibleValue> accValue;
-+    nsIAccessibleValue* accValue = nsnull;
-     accWrap->QueryInterface(NS_GET_IID(nsIAccessibleValue),
--                            getter_AddRefs(accValue));
-+                            (void**)&accValue);
-     if (!accValue)
-         return;
- 
-@@ -145,9 +145,9 @@ setCurrentValueCB(AtkValue *obj, const G
-     if (!accWrap)
-         return FALSE;
- 
--    nsCOMPtr<nsIAccessibleValue> accValue;
-+    nsIAccessibleValue* accValue = nsnull;
-     accWrap->QueryInterface(NS_GET_IID(nsIAccessibleValue),
--                            getter_AddRefs(accValue));
-+                            (void**)&accValue);
-     NS_ENSURE_TRUE(accValue, FALSE);
- 
-     double accDouble =g_value_get_double (value);
-diff --git a/accessible/src/atk/nsXULTreeAccessibleWrap.cpp b/accessible/src/atk/nsXULTreeAccessibleWrap.cpp
---- a/accessible/src/atk/nsXULTreeAccessibleWrap.cpp
-+++ b/accessible/src/atk/nsXULTreeAccessibleWrap.cpp
-@@ -92,7 +92,7 @@ NS_IMETHODIMP nsXULTreeAccessibleWrap::G
-   NS_ENSURE_ARG_POINTER(aColumnCount);
-   *aColumnCount = 0;
- 
--  nsCOMPtr<nsITreeColumn> column;
-+  nsITreeColumn* column = nsnull;
-   column = GetFirstVisibleColumn(mTree);
-   if (!column)
-     return NS_ERROR_FAILURE;
-@@ -108,11 +108,11 @@ NS_IMETHODIMP nsXULTreeAccessibleWrap::G
- {
-   nsresult rv = NS_OK;
- 
--  nsCOMPtr<nsIAccessible> acc;
--  nsAccessible::GetFirstChild(getter_AddRefs(acc));
-+  nsIAccessible* acc = nsnull;
-+  nsAccessible::GetFirstChild(&acc);
-   NS_ENSURE_TRUE(acc, NS_ERROR_FAILURE);
- 
--  nsCOMPtr<nsIAccessibleTable> accTable(do_QueryInterface(acc, &rv));
-+  nsIAccessibleTable* accTable(do_QueryInterface(acc, &rv));
-   NS_ENSURE_SUCCESS(rv, rv);
- 
-   *aColumnHeader = accTable;
-@@ -211,12 +211,12 @@ NS_IMETHODIMP nsXULTreeAccessibleWrap::G
-   PRInt32 *outArray = (PRInt32 *)nsMemory::Alloc((*aNumRows) * sizeof(PRInt32));
-   NS_ENSURE_TRUE(outArray, NS_ERROR_OUT_OF_MEMORY);
- 
--  nsCOMPtr<nsITreeView> view;
--  rv = mTree->GetView(getter_AddRefs(view));
-+  nsITreeView* view = nsnull;
-+  rv = mTree->GetView(&view);
-   NS_ENSURE_SUCCESS(rv, rv);
- 
--  nsCOMPtr<nsITreeSelection> selection;
--  rv = view->GetSelection(getter_AddRefs(selection));
-+  nsITreeSelection* selection = nsnull;
-+  rv = view->GetSelection(&selection);
-   NS_ENSURE_SUCCESS(rv, rv);
- 
-   PRInt32 rowCount;
-@@ -326,8 +326,8 @@ NS_IMETHODIMP nsXULTreeAccessibleWrap::G
- 
- NS_IMETHODIMP nsXULTreeAccessibleWrap::GetColumnDescription(PRInt32 aColumn, nsAString & _retval)
- {
--  nsCOMPtr<nsIAccessibleTable> columnHeader;
--  nsresult rv = GetColumnHeader(getter_AddRefs(columnHeader));
-+  nsIAccessibleTable* columnHeader = nsnull;
-+  nsresult rv = GetColumnHeader(&columnHeader);
-   if (NS_SUCCEEDED(rv) && columnHeader) {
-     return columnHeader->GetColumnDescription(aColumn, _retval);
-   }
-@@ -366,12 +366,12 @@ NS_IMETHODIMP nsXULTreeAccessibleWrap::I
- 
-   nsresult rv = NS_OK;
- 
--  nsCOMPtr<nsITreeView> view;
--  rv = mTree->GetView(getter_AddRefs(view));
-+  nsITreeView* view = nsnull;
-+  rv = mTree->GetView(&view);
-   NS_ENSURE_SUCCESS(rv, rv);
- 
--  nsCOMPtr<nsITreeSelection> selection;
--  rv = view->GetSelection(getter_AddRefs(selection));
-+  nsITreeSelection* selection = nsnull;
-+  rv = view->GetSelection(&selection);
-   NS_ENSURE_SUCCESS(rv, rv);
- 
-   return selection->IsSelected(aRow, _retval);
-@@ -413,8 +413,8 @@ NS_IMETHODIMP nsXULTreeAccessibleWrap::C
-   PRInt32 rowIndex;
-   nsresult rv = GetRowAtIndex(aIndex, &rowIndex);
- 
--  nsCOMPtr<nsITreeSelection> selection;
--  rv = mTreeView->GetSelection(getter_AddRefs(selection));
-+  nsITreeSelection* selection = nsnull;
-+  rv = mTreeView->GetSelection(&selection);
-   NS_ASSERTION(selection, "Can't get selection from mTreeView");
- 
-   if (selection) {
-@@ -527,12 +527,12 @@ NS_IMETHODIMP nsXULTreeColumnsAccessible
- 
- NS_IMETHODIMP nsXULTreeColumnsAccessibleWrap::CellRefAt(PRInt32 aRow, PRInt32 aColumn, nsIAccessible **_retval)
- {
--  nsCOMPtr<nsIAccessible> next, temp;
--  GetFirstChild(getter_AddRefs(next));
-+  nsIAccessible* next = nsnull, *temp = nsnull;
-+  GetFirstChild(&next);
-   NS_ENSURE_TRUE(next, NS_ERROR_FAILURE);
- 
-   for (PRInt32 col = 0; col < aColumn; col++) {
--    next->GetNextSibling(getter_AddRefs(temp));
-+    next->GetNextSibling(&temp);
-     NS_ENSURE_TRUE(temp, NS_ERROR_FAILURE);
- 
-     next = temp;
-@@ -586,8 +586,8 @@ NS_IMETHODIMP nsXULTreeColumnsAccessible
- 
- NS_IMETHODIMP nsXULTreeColumnsAccessibleWrap::GetColumnDescription(PRInt32 aColumn, nsAString & _retval)
- {
--  nsCOMPtr<nsIAccessible> column;  
--  nsresult rv = CellRefAt(0, aColumn, getter_AddRefs(column));
-+  nsIAccessible* column = nsnull;  
-+  nsresult rv = CellRefAt(0, aColumn, &column);
-   if (NS_SUCCEEDED(rv) && column) {
-     return column->GetName(_retval);
-   }
-diff --git a/accessible/src/base/nsAccessNode.cpp b/accessible/src/base/nsAccessNode.cpp
---- a/accessible/src/base/nsAccessNode.cpp
-+++ b/accessible/src/base/nsAccessNode.cpp
-@@ -146,21 +146,21 @@ NS_IMETHODIMP nsAccessNode::Init()
- #ifdef DEBUG_A11Y
-   NS_ASSERTION(!mIsInitialized, "Initialized twice!");
- #endif
--  nsCOMPtr<nsIAccessibleDocument> docAccessible(GetDocAccessible());
-+  nsIAccessibleDocument* docAccessible(GetDocAccessible());
-   if (!docAccessible) {
-     // No doc accessible yet for this node's document. 
-     // There was probably an accessible event fired before the 
-     // current document was ever asked for by the assistive technology.
-     // Create a doc accessible so we can cache this node
--    nsCOMPtr<nsIPresShell> presShell(do_QueryReferent(mWeakShell));
-+    nsIPresShell* presShell(do_QueryReferent(mWeakShell));
-     if (presShell) {
--      nsCOMPtr<nsIDOMNode> docNode(do_QueryInterface(presShell->GetDocument()));
-+      nsIDOMNode* docNode(do_QueryInterface(presShell->GetDocument()));
-       if (docNode) {
-         nsIAccessibilityService *accService = GetAccService();
-         if (accService) {
--          nsCOMPtr<nsIAccessible> accessible;
-+          nsIAccessible* accessible = nsnull;
-           accService->GetAccessibleInShell(docNode, presShell,
--                                           getter_AddRefs(accessible));
-+                                           &accessible);
-           docAccessible = do_QueryInterface(accessible);
-         }
-       }
-@@ -173,7 +173,7 @@ NS_IMETHODIMP nsAccessNode::Init()
- 
-   void* uniqueID;
-   GetUniqueID(&uniqueID);
--  nsCOMPtr<nsPIAccessibleDocument> privateDocAccessible =
-+  nsPIAccessibleDocument* privateDocAccessible =
-     do_QueryInterface(docAccessible);
-   NS_ASSERTION(privateDocAccessible, "No private docaccessible for docaccessible");
-   privateDocAccessible->CacheAccessNode(uniqueID, this);
-@@ -181,12 +181,12 @@ NS_IMETHODIMP nsAccessNode::Init()
-   // Make sure an ancestor in real content is cached
-   // so that nsDocAccessible::RefreshNodes() can find the anonymous subtree to release when
-   // the root node goes away
--  nsCOMPtr<nsIContent> content = do_QueryInterface(mDOMNode);
-+  nsIContent* content = do_QueryInterface(mDOMNode);
-   if (content && (content->IsNativeAnonymous() ||
-                   content->GetBindingParent())) {
-     // Specific examples of where this is used: <input type="file"> and <xul:findbar>
--    nsCOMPtr<nsIAccessible> parentAccessible;
--    docAccessible->GetAccessibleInParentChain(mDOMNode, PR_TRUE, getter_AddRefs(parentAccessible));
-+    nsIAccessible* parentAccessible = nsnull;
-+    docAccessible->GetAccessibleInParentChain(mDOMNode, PR_TRUE, &parentAccessible);
-     if (parentAccessible) {
-       PRInt32 childCountUnused;
-       parentAccessible->GetChildCount(&childCountUnused);
-@@ -218,13 +218,13 @@ NS_IMETHODIMP nsAccessNode::GetOwnerWind
- NS_IMETHODIMP nsAccessNode::GetOwnerWindow(void **aWindow)
- {
-   *aWindow = nsnull;
--  nsCOMPtr<nsIAccessibleDocument> docAccessible(GetDocAccessible());
-+  nsIAccessibleDocument* docAccessible(GetDocAccessible());
-   if (!docAccessible)
-     return NS_ERROR_FAILURE; // This node or doc accessible is shut down
-   return docAccessible->GetWindowHandle(aWindow);
- }
- 
--already_AddRefed<nsApplicationAccessibleWrap>
-+nsApplicationAccessibleWrap*
- nsAccessNode::GetApplicationAccessible()
- {
-   if (!gIsAccessibilityActive) {
-@@ -259,7 +259,7 @@ void nsAccessNode::InitXPAccessibility()
-     return;
-   }
- 
--  nsCOMPtr<nsIStringBundleService> stringBundleService =
-+  nsIStringBundleService* stringBundleService =
-     do_GetService(NS_STRINGBUNDLE_CONTRACTID);
-   if (stringBundleService) {
-     // Static variables are released in ShutdownAllXPAccessibility();
-@@ -273,7 +273,7 @@ void nsAccessNode::InitXPAccessibility()
- 
-   gGlobalDocAccessibleCache.Init(4);
- 
--  nsCOMPtr<nsIPrefBranch> prefBranch(do_GetService(NS_PREFSERVICE_CONTRACTID));
-+  nsIPrefBranch* prefBranch(do_GetService(NS_PREFSERVICE_CONTRACTID));
-   if (prefBranch) {
-     prefBranch->GetBoolPref("accessibility.disablecache", &gIsCacheDisabled);
-     prefBranch->GetBoolPref("browser.formfill.enable", &gIsFormFillEnabled);
-@@ -285,7 +285,7 @@ void nsAccessNode::InitXPAccessibility()
- 
- void nsAccessNode::NotifyA11yInitOrShutdown()
- {
--  nsCOMPtr<nsIObserverService> obsService =
-+  nsIObserverService* obsService =
-     do_GetService("@mozilla.org/observer-service;1");
-   NS_ASSERTION(obsService, "No observer service to notify of a11y init/shutdown");
-   if (obsService) {
-@@ -325,7 +325,7 @@ void nsAccessNode::ShutdownXPAccessibili
-   NotifyA11yInitOrShutdown();
- }
- 
--already_AddRefed<nsIPresShell> nsAccessNode::GetPresShell()
-+nsIPresShell* nsAccessNode::GetPresShell()
- {
-   nsIPresShell *presShell = nsnull;
-   if (mWeakShell)
-@@ -344,34 +344,34 @@ already_AddRefed<nsIPresShell> nsAccessN
- 
- nsPresContext* nsAccessNode::GetPresContext()
- {
--  nsCOMPtr<nsIPresShell> presShell(GetPresShell());
-+  nsIPresShell* presShell(GetPresShell());
-   if (!presShell) {
-     return nsnull;
-   }
-   return presShell->GetPresContext();
- }
- 
--already_AddRefed<nsIAccessibleDocument> nsAccessNode::GetDocAccessible()
-+nsIAccessibleDocument* nsAccessNode::GetDocAccessible()
- {
-   return GetDocAccessibleFor(mWeakShell); // Addref'd
- }
- 
--already_AddRefed<nsRootAccessible> nsAccessNode::GetRootAccessible()
-+nsRootAccessible* nsAccessNode::GetRootAccessible()
- {
--  nsCOMPtr<nsIDocShellTreeItem> docShellTreeItem =
-+  nsIDocShellTreeItem* docShellTreeItem =
-     nsAccUtils::GetDocShellTreeItemFor(mDOMNode);
-   NS_ASSERTION(docShellTreeItem, "No docshell tree item for mDOMNode");
-   if (!docShellTreeItem) {
-     return nsnull;
-   }
--  nsCOMPtr<nsIDocShellTreeItem> root;
--  docShellTreeItem->GetRootTreeItem(getter_AddRefs(root));
-+  nsIDocShellTreeItem* root = nsnull;
-+  docShellTreeItem->GetRootTreeItem(&root);
-   NS_ASSERTION(root, "No root content tree item");
-   if (!root) {
-     return nsnull;
-   }
- 
--  nsCOMPtr<nsIAccessibleDocument> accDoc = GetDocAccessibleFor(root);
-+  nsIAccessibleDocument* accDoc = GetDocAccessibleFor(root);
-   if (!accDoc) {
-     return nsnull;
-   }
-@@ -385,11 +385,11 @@ already_AddRefed<nsRootAccessible> nsAcc
- 
- nsIFrame* nsAccessNode::GetFrame()
- {
--  nsCOMPtr<nsIPresShell> shell(do_QueryReferent(mWeakShell));
-+  nsIPresShell* shell(do_QueryReferent(mWeakShell));
-   if (!shell) 
-     return nsnull;  
- 
--  nsCOMPtr<nsIContent> content(do_QueryInterface(mDOMNode));
-+  nsIContent* content(do_QueryInterface(mDOMNode));
-   return content ? shell->GetPrimaryFrameFor(content) : nsnull;
- }
- 
-@@ -403,7 +403,7 @@ NS_IMETHODIMP
- NS_IMETHODIMP
- nsAccessNode::GetNumChildren(PRInt32 *aNumChildren)
- {
--  nsCOMPtr<nsIContent> content(do_QueryInterface(mDOMNode));
-+  nsIContent* content(do_QueryInterface(mDOMNode));
- 
-   if (!content) {
-     *aNumChildren = 0;
-@@ -419,7 +419,7 @@ NS_IMETHODIMP
- NS_IMETHODIMP
- nsAccessNode::GetAccessibleDocument(nsIAccessibleDocument **aDocAccessible)
- {
--  *aDocAccessible = GetDocAccessibleFor(mWeakShell).get();
-+  *aDocAccessible = GetDocAccessibleFor(mWeakShell);
-   return NS_OK;
- }
- 
-@@ -428,7 +428,7 @@ nsAccessNode::GetInnerHTML(nsAString& aI
- {
-   aInnerHTML.Truncate();
- 
--  nsCOMPtr<nsIDOMNSHTMLElement> domNSElement(do_QueryInterface(mDOMNode));
-+  nsIDOMNSHTMLElement* domNSElement(do_QueryInterface(mDOMNode));
-   NS_ENSURE_TRUE(domNSElement, NS_ERROR_NULL_POINTER);
- 
-   return domNSElement->GetInnerHTML(aInnerHTML);
-@@ -440,13 +440,13 @@ nsAccessNode::ScrollTo(PRUint32 aScrollT
-   if (IsDefunct())
-     return NS_ERROR_FAILURE;
- 
--  nsCOMPtr<nsIPresShell> shell(GetPresShell());
-+  nsIPresShell* shell(GetPresShell());
-   NS_ENSURE_TRUE(shell, NS_ERROR_FAILURE);
- 
-   nsIFrame *frame = GetFrame();
-   NS_ENSURE_TRUE(frame, NS_ERROR_FAILURE);
- 
--  nsCOMPtr<nsIContent> content = frame->GetContent();
-+  nsIContent* content = frame->GetContent();
-   NS_ENSURE_TRUE(content, NS_ERROR_FAILURE);
- 
-   PRInt16 vPercent, hPercent;
-@@ -481,13 +481,13 @@ nsAccessNode::MakeAccessNode(nsIDOMNode 
-   nsIAccessibilityService *accService = GetAccService();
-   NS_ENSURE_TRUE(accService, NS_ERROR_FAILURE);
- 
--  nsCOMPtr<nsIAccessNode> accessNode;
--  accService->GetCachedAccessNode(aNode, mWeakShell, getter_AddRefs(accessNode));
-+  nsIAccessNode* accessNode = nsnull;
-+  accService->GetCachedAccessNode(aNode, mWeakShell, &accessNode);
- 
-   if (!accessNode) {
--    nsCOMPtr<nsIAccessible> accessible;
-+    nsIAccessible* accessible = nsnull;
-     accService->GetAccessibleInWeakShell(aNode, mWeakShell,
--                                         getter_AddRefs(accessible));
-+                                         &accessible);
- 
-     accessNode = do_QueryInterface(accessible);
-   }
-@@ -515,8 +515,8 @@ nsAccessNode::GetFirstChildNode(nsIAcces
-   *aAccessNode = nsnull;
-   NS_ENSURE_TRUE(mDOMNode, NS_ERROR_NULL_POINTER);
- 
--  nsCOMPtr<nsIDOMNode> domNode;
--  mDOMNode->GetFirstChild(getter_AddRefs(domNode));
-+  nsIDOMNode* domNode = nsnull;
-+  mDOMNode->GetFirstChild(&domNode);
- 
-   return domNode ? MakeAccessNode(domNode, aAccessNode) : NS_OK;
- }
-@@ -528,8 +528,8 @@ nsAccessNode::GetLastChildNode(nsIAccess
-   *aAccessNode = nsnull;
-   NS_ENSURE_TRUE(mDOMNode, NS_ERROR_NULL_POINTER);
- 
--  nsCOMPtr<nsIDOMNode> domNode;
--  mDOMNode->GetLastChild(getter_AddRefs(domNode));
-+  nsIDOMNode* domNode = nsnull;
-+  mDOMNode->GetLastChild(&domNode);
- 
-   return domNode ? MakeAccessNode(domNode, aAccessNode) : NS_OK;
- }
-@@ -541,8 +541,8 @@ nsAccessNode::GetParentNode(nsIAccessNod
-   *aAccessNode = nsnull;
-   NS_ENSURE_TRUE(mDOMNode, NS_ERROR_NULL_POINTER);
- 
--  nsCOMPtr<nsIDOMNode> domNode;
--  mDOMNode->GetParentNode(getter_AddRefs(domNode));
-+  nsIDOMNode* domNode = nsnull;
-+  mDOMNode->GetParentNode(&domNode);
- 
-   return domNode ? MakeAccessNode(domNode, aAccessNode) : NS_OK;
- }
-@@ -554,8 +554,8 @@ nsAccessNode::GetPreviousSiblingNode(nsI
-   *aAccessNode = nsnull;
-   NS_ENSURE_TRUE(mDOMNode, NS_ERROR_NULL_POINTER);
- 
--  nsCOMPtr<nsIDOMNode> domNode;
--  mDOMNode->GetPreviousSibling(getter_AddRefs(domNode));
-+  nsIDOMNode* domNode = nsnull;
-+  mDOMNode->GetPreviousSibling(&domNode);
- 
-   return domNode ? MakeAccessNode(domNode, aAccessNode) : NS_OK;
- }
-@@ -567,8 +567,8 @@ nsAccessNode::GetNextSiblingNode(nsIAcce
-   *aAccessNode = nsnull;
-   NS_ENSURE_TRUE(mDOMNode, NS_ERROR_NULL_POINTER);
- 
--  nsCOMPtr<nsIDOMNode> domNode;
--  mDOMNode->GetNextSibling(getter_AddRefs(domNode));
-+  nsIDOMNode* domNode = nsnull;
-+  mDOMNode->GetNextSibling(&domNode);
- 
-   return domNode ? MakeAccessNode(domNode, aAccessNode) : NS_OK;
- }
-@@ -579,10 +579,10 @@ nsAccessNode::GetChildNodeAt(PRInt32 aCh
-   NS_ENSURE_ARG_POINTER(aAccessNode);
-   *aAccessNode = nsnull;
- 
--  nsCOMPtr<nsIContent> content(do_QueryInterface(mDOMNode));
-+  nsIContent* content(do_QueryInterface(mDOMNode));
-   NS_ENSURE_TRUE(content, NS_ERROR_NULL_POINTER);
- 
--  nsCOMPtr<nsIDOMNode> domNode =
-+  nsIDOMNode* domNode =
-     do_QueryInterface(content->GetChildAt(aChildNum));
- 
-   return domNode ? MakeAccessNode(domNode, aAccessNode) : NS_OK;
-@@ -591,12 +591,12 @@ NS_IMETHODIMP
- NS_IMETHODIMP
- nsAccessNode::GetComputedStyleValue(const nsAString& aPseudoElt, const nsAString& aPropertyName, nsAString& aValue)
- {
--  nsCOMPtr<nsIDOMElement> domElement(do_QueryInterface(mDOMNode));
-+  nsIDOMElement* domElement(do_QueryInterface(mDOMNode));
-   if (!domElement) {
-     return NS_ERROR_FAILURE;
-   }
--  nsCOMPtr<nsIDOMCSSStyleDeclaration> styleDecl;
--  GetComputedStyleDeclaration(aPseudoElt, domElement, getter_AddRefs(styleDecl));
-+  nsIDOMCSSStyleDeclaration* styleDecl = nsnull;
-+  GetComputedStyleDeclaration(aPseudoElt, domElement, &styleDecl);
-   NS_ENSURE_TRUE(styleDecl, NS_ERROR_FAILURE);
-   
-   return styleDecl->GetPropertyValue(aPropertyName, aValue);
-@@ -611,17 +611,17 @@ nsAccessNode::GetComputedStyleCSSValue(c
- 
-   *aCSSValue = nsnull;
- 
--  nsCOMPtr<nsIDOMElement> domElement(do_QueryInterface(mDOMNode));
-+  nsIDOMElement* domElement(do_QueryInterface(mDOMNode));
-   if (!domElement)
-     return NS_ERROR_FAILURE;
- 
--  nsCOMPtr<nsIDOMCSSStyleDeclaration> styleDecl;
-+  nsIDOMCSSStyleDeclaration* styleDecl = nsnull;
-   GetComputedStyleDeclaration(aPseudoElt, domElement,
--                              getter_AddRefs(styleDecl));
-+                              &styleDecl);
-   NS_ENSURE_STATE(styleDecl);
- 
--  nsCOMPtr<nsIDOMCSSValue> cssValue;
--  styleDecl->GetPropertyCSSValue(aPropertyName, getter_AddRefs(cssValue));
-+  nsIDOMCSSValue* cssValue = nsnull;
-+  styleDecl->GetPropertyCSSValue(aPropertyName, &cssValue);
-   NS_ENSURE_TRUE(cssValue, NS_ERROR_FAILURE);
- 
-   return CallQueryInterface(cssValue, aCSSValue);
-@@ -633,28 +633,28 @@ void nsAccessNode::GetComputedStyleDecla
- {
-   *aCssDecl = nsnull;
-   // Returns number of items in style declaration
--  nsCOMPtr<nsIContent> content = do_QueryInterface(aElement);
-+  nsIContent* content = do_QueryInterface(aElement);
-   if (!content) {
-     return;
-   }
--  nsCOMPtr<nsIDocument> doc = content->GetDocument();
-+  nsIDocument* doc = content->GetDocument();
-   if (!doc) {
-     return;
-   }
- 
--  nsCOMPtr<nsIDOMViewCSS> viewCSS(do_QueryInterface(doc->GetWindow()));
-+  nsIDOMViewCSS* viewCSS(do_QueryInterface(doc->GetWindow()));
-   if (!viewCSS) {
-     return;
-   }
- 
--  nsCOMPtr<nsIDOMCSSStyleDeclaration> cssDecl;
--  viewCSS->GetComputedStyle(aElement, aPseudoElt, getter_AddRefs(cssDecl));
-+  nsIDOMCSSStyleDeclaration* cssDecl = nsnull;
-+  viewCSS->GetComputedStyle(aElement, aPseudoElt, &cssDecl);
-   NS_IF_ADDREF(*aCssDecl = cssDecl);
- }
- 
- /***************** Hashtable of nsIAccessNode's *****************/
- 
--already_AddRefed<nsIAccessibleDocument>
-+nsIAccessibleDocument*
- nsAccessNode::GetDocAccessibleFor(nsIDocument *aDocument)
- {
-   if (!aDocument) {
-@@ -662,19 +662,19 @@ nsAccessNode::GetDocAccessibleFor(nsIDoc
-   }
- 
-   nsIAccessibleDocument *docAccessible = nsnull;
--  nsCOMPtr<nsIAccessNode> accessNode;
-+  nsIAccessNode* accessNode = nsnull;
-   gGlobalDocAccessibleCache.Get(static_cast<void*>(aDocument),
--                                getter_AddRefs(accessNode));
-+                                &accessNode);
-   if (accessNode) {
-     CallQueryInterface(accessNode, &docAccessible);
-   }
-   return docAccessible;
- }
-  
--already_AddRefed<nsIAccessibleDocument>
-+nsIAccessibleDocument*
- nsAccessNode::GetDocAccessibleFor(nsIWeakReference *aWeakShell)
- {
--  nsCOMPtr<nsIPresShell> presShell(do_QueryReferent(aWeakShell));
-+  nsIPresShell* presShell(do_QueryReferent(aWeakShell));
-   if (!presShell) {
-     return nsnull;
-   }
-@@ -682,25 +682,25 @@ nsAccessNode::GetDocAccessibleFor(nsIWea
-   return nsAccessNode::GetDocAccessibleFor(presShell->GetDocument());
- }
- 
--already_AddRefed<nsIAccessibleDocument>
-+nsIAccessibleDocument*
- nsAccessNode::GetDocAccessibleFor(nsIDocShellTreeItem *aContainer,
-                                   PRBool aCanCreate)
- {
-   if (!aCanCreate) {
--    nsCOMPtr<nsIDocShell> docShell(do_QueryInterface(aContainer));
-+    nsIDocShell* docShell(do_QueryInterface(aContainer));
-     NS_ASSERTION(docShell, "This method currently only supports docshells");
--    nsCOMPtr<nsIPresShell> presShell;
--    docShell->GetPresShell(getter_AddRefs(presShell));
-+    nsIPresShell* presShell = nsnull;
-+    docShell->GetPresShell(&presShell);
-     return presShell ? GetDocAccessibleFor(presShell->GetDocument()) : nsnull;
-   }
- 
--  nsCOMPtr<nsIDOMNode> node = GetDOMNodeForContainer(aContainer);
-+  nsIDOMNode* node = GetDOMNodeForContainer(aContainer);
-   if (!node) {
-     return nsnull;
-   }
- 
--  nsCOMPtr<nsIAccessible> accessible;
--  GetAccService()->GetAccessibleFor(node, getter_AddRefs(accessible));
-+  nsIAccessible* accessible = nsnull;
-+  GetAccService()->GetAccessibleFor(node, &accessible);
-   nsIAccessibleDocument *docAccessible = nsnull;
-   if (accessible) {
-     CallQueryInterface(accessible, &docAccessible);
-@@ -708,15 +708,15 @@ nsAccessNode::GetDocAccessibleFor(nsIDoc
-   return docAccessible;
- }
-  
--already_AddRefed<nsIAccessibleDocument>
-+nsIAccessibleDocument*
- nsAccessNode::GetDocAccessibleFor(nsIDOMNode *aNode)
- {
--  nsCOMPtr<nsIPresShell> eventShell = GetPresShellFor(aNode);
-+  nsIPresShell* eventShell = GetPresShellFor(aNode);
-   if (eventShell) {
-     return GetDocAccessibleFor(eventShell->GetDocument());
-   }
- 
--  nsCOMPtr<nsIDocument> doc(do_QueryInterface(aNode));
-+  nsIDocument* doc(do_QueryInterface(aNode));
-   if (doc) {
-     return GetDocAccessibleFor(doc);
-   }
-@@ -724,12 +724,12 @@ nsAccessNode::GetDocAccessibleFor(nsIDOM
-   return nsnull;
- }
- 
--already_AddRefed<nsIPresShell>
-+nsIPresShell*
- nsAccessNode::GetPresShellFor(nsIDOMNode *aNode)
- {
--  nsCOMPtr<nsIDOMDocument> domDocument;
--  aNode->GetOwnerDocument(getter_AddRefs(domDocument));
--  nsCOMPtr<nsIDocument> doc(do_QueryInterface(domDocument));
-+  nsIDOMDocument* domDocument = nsnull;
-+  aNode->GetOwnerDocument(&domDocument);
-+  nsIDocument* doc(do_QueryInterface(domDocument));
-   if (!doc) {   // This is necessary when the node is the document node
-     doc = do_QueryInterface(aNode);
-   }
-@@ -741,20 +741,20 @@ nsAccessNode::GetPresShellFor(nsIDOMNode
-   return presShell;
- }
- 
--already_AddRefed<nsIDOMNode>
-+nsIDOMNode*
- nsAccessNode::GetDOMNodeForContainer(nsISupports *aContainer)
- {
-   nsIDOMNode* node = nsnull;
--  nsCOMPtr<nsIDocShell> shell = do_QueryInterface(aContainer);
--  nsCOMPtr<nsIContentViewer> cv;
--  shell->GetContentViewer(getter_AddRefs(cv));
-+  nsIDocShell* shell = do_QueryInterface(aContainer);
-+  nsIContentViewer* cv = nsnull;
-+  shell->GetContentViewer(&cv);
-   if (cv) {
--    nsCOMPtr<nsIDocumentViewer> docv(do_QueryInterface(cv));
-+    nsIDocumentViewer* docv(do_QueryInterface(cv));
-     if (docv) {
--      nsCOMPtr<nsIDocument> doc;
--      docv->GetDocument(getter_AddRefs(doc));
-+      nsIDocument* doc = nsnull;
-+      docv->GetDocument(&doc);
-       if (doc) {
--        CallQueryInterface(doc.get(), &node);
-+        CallQueryInterface(doc, &node);
-       }
-     }
-   }
-@@ -787,7 +787,7 @@ PLDHashOperator nsAccessNode::ClearCache
- {
-   NS_ASSERTION(aAccessNode, "Calling ClearCacheEntry with a NULL pointer!");
-   if (aAccessNode) {
--    nsCOMPtr<nsPIAccessNode> privateAccessNode(do_QueryInterface(aAccessNode));
-+    nsPIAccessNode* privateAccessNode(do_QueryInterface(aAccessNode));
-     privateAccessNode->Shutdown();
-   }
- 
-@@ -800,14 +800,14 @@ nsAccessNode::ClearCache(nsAccessNodeHas
-   aCache.Enumerate(ClearCacheEntry, nsnull);
- }
- 
--already_AddRefed<nsIDOMNode> nsAccessNode::GetCurrentFocus()
-+nsIDOMNode* nsAccessNode::GetCurrentFocus()
- {
--  nsCOMPtr<nsIPresShell> shell = GetPresShellFor(mDOMNode);
-+  nsIPresShell* shell = GetPresShellFor(mDOMNode);
-   NS_ENSURE_TRUE(shell, nsnull);
--  nsCOMPtr<nsIDocument> doc = shell->GetDocument();
-+  nsIDocument* doc = shell->GetDocument();
-   NS_ENSURE_TRUE(doc, nsnull);
- 
--  nsCOMPtr<nsPIDOMWindow> privateDOMWindow(do_QueryInterface(doc->GetWindow()));
-+  nsPIDOMWindow* privateDOMWindow(do_QueryInterface(doc->GetWindow()));
-   if (!privateDOMWindow) {
-     return nsnull;
-   }
-@@ -815,18 +815,18 @@ already_AddRefed<nsIDOMNode> nsAccessNod
-   if (!focusController) {
-     return nsnull;
-   }
--  nsCOMPtr<nsIDOMElement> focusedElement;
--  focusController->GetFocusedElement(getter_AddRefs(focusedElement));
-+  nsIDOMElement* focusedElement = nsnull;
-+  focusController->GetFocusedElement(&focusedElement);
-   nsIDOMNode *focusedNode = nsnull;
-   if (!focusedElement) {
-     // Document itself has focus
--    nsCOMPtr<nsIDOMWindowInternal> focusedWinInternal;
--    focusController->GetFocusedWindow(getter_AddRefs(focusedWinInternal));
-+    nsIDOMWindowInternal* focusedWinInternal = nsnull;
-+    focusController->GetFocusedWindow(&focusedWinInternal);
-     if (!focusedWinInternal) {
-       return nsnull;
-     }
--    nsCOMPtr<nsIDOMDocument> focusedDOMDocument;
--    focusedWinInternal->GetDocument(getter_AddRefs(focusedDOMDocument));
-+    nsIDOMDocument* focusedDOMDocument = nsnull;
-+    focusedWinInternal->GetDocument(&focusedDOMDocument);
-     if (!focusedDOMDocument) {
-       return nsnull;
-     }
-@@ -843,22 +843,22 @@ nsAccessNode::GetLanguage(nsAString& aLa
- nsAccessNode::GetLanguage(nsAString& aLanguage)
- {
-   aLanguage.Truncate();
--  nsCOMPtr<nsIContent> content(do_QueryInterface(mDOMNode));
-+  nsIContent* content(do_QueryInterface(mDOMNode));
-   if (!content) {
-     // For documents make sure we look for lang attribute on
-     // document element
--    nsCOMPtr<nsIDOMDocument> domDoc(do_QueryInterface(mDOMNode));
-+    nsIDOMDocument* domDoc(do_QueryInterface(mDOMNode));
-     if (domDoc) {
--      nsCOMPtr<nsIDOMHTMLDocument> htmlDoc(do_QueryInterface(mDOMNode));
-+      nsIDOMHTMLDocument* htmlDoc(do_QueryInterface(mDOMNode));
-       if (htmlDoc) {
-         // Make sure we look for lang attribute on HTML <body>
--        nsCOMPtr<nsIDOMHTMLElement> bodyElement;
--        htmlDoc->GetBody(getter_AddRefs(bodyElement));
-+        nsIDOMHTMLElement* bodyElement = nsnull;
-+        htmlDoc->GetBody(&bodyElement);
-         content = do_QueryInterface(bodyElement);
-       }
-       if (!content) {
--        nsCOMPtr<nsIDOMElement> docElement;
--        domDoc->GetDocumentElement(getter_AddRefs(docElement));
-+        nsIDOMElement* docElement = nsnull;
-+        domDoc->GetDocumentElement(&docElement);
-         content = do_QueryInterface(docElement);
-       }
-     }
-diff --git a/accessible/src/base/nsAccessNode.h b/accessible/src/base/nsAccessNode.h
---- a/accessible/src/base/nsAccessNode.h
-+++ b/accessible/src/base/nsAccessNode.h
-@@ -88,7 +88,7 @@ class nsAccessNode: public nsIAccessNode
-     /**
-      * Return an application accessible.
-      */
--    static already_AddRefed<nsApplicationAccessibleWrap> GetApplicationAccessible();
-+    static nsApplicationAccessibleWrap* GetApplicationAccessible();
- 
-     // Static methods for handling per-document cache
-     static void PutCacheEntry(nsAccessNodeHashtable& aCache,
-@@ -101,23 +101,23 @@ class nsAccessNode: public nsIAccessNode
-     HIDE_FROM_GARBURATOR(static PLDHashOperator PR_CALLBACK ClearCacheEntry(const void* aKey, nsCOMPtr<nsIAccessNode>& aAccessNode, void* aUserArg))
- 
-     // Static cache methods for global document cache
--    static already_AddRefed<nsIAccessibleDocument> GetDocAccessibleFor(nsIDocument *aDocument);
--    static already_AddRefed<nsIAccessibleDocument> GetDocAccessibleFor(nsIWeakReference *aWeakShell);
--    static already_AddRefed<nsIAccessibleDocument> GetDocAccessibleFor(nsIDocShellTreeItem *aContainer, PRBool aCanCreate = PR_FALSE);
--    static already_AddRefed<nsIAccessibleDocument> GetDocAccessibleFor(nsIDOMNode *aNode);
-+    static nsIAccessibleDocument* GetDocAccessibleFor(nsIDocument *aDocument);
-+    static nsIAccessibleDocument* GetDocAccessibleFor(nsIWeakReference *aWeakShell);
-+    static nsIAccessibleDocument* GetDocAccessibleFor(nsIDocShellTreeItem *aContainer, PRBool aCanCreate = PR_FALSE);
-+    static nsIAccessibleDocument* GetDocAccessibleFor(nsIDOMNode *aNode);
- 
--    static already_AddRefed<nsIDOMNode> GetDOMNodeForContainer(nsISupports *aContainer);
--    static already_AddRefed<nsIPresShell> GetPresShellFor(nsIDOMNode *aStartNode);
-+    static nsIDOMNode* GetDOMNodeForContainer(nsISupports *aContainer);
-+    static nsIPresShell* GetPresShellFor(nsIDOMNode *aStartNode);
-     
-     static void GetComputedStyleDeclaration(const nsAString& aPseudoElt,
-                                             nsIDOMElement *aElement,
-                                             nsIDOMCSSStyleDeclaration **aCssDecl);
- 
--    already_AddRefed<nsRootAccessible> GetRootAccessible();
-+    nsRootAccessible* GetRootAccessible();
- 
-     static nsIDOMNode *gLastFocusedNode;
-     static nsIAccessibilityService* GetAccService();
--    already_AddRefed<nsIDOMNode> GetCurrentFocus();
-+    nsIDOMNode* GetCurrentFocus();
- 
-     /**
-      * Returns true when the accessible is defunct.
-@@ -126,9 +126,9 @@ class nsAccessNode: public nsIAccessNode
- 
- protected:
-     nsresult MakeAccessNode(nsIDOMNode *aNode, nsIAccessNode **aAccessNode);
--    already_AddRefed<nsIPresShell> GetPresShell();
-+    nsIPresShell* GetPresShell();
-     nsPresContext* GetPresContext();
--    already_AddRefed<nsIAccessibleDocument> GetDocAccessible();
-+    nsIAccessibleDocument* GetDocAccessible();
-     void LastRelease();
- 
-     nsCOMPtr<nsIDOMNode> mDOMNode;
-diff --git a/accessible/src/base/nsAccessibilityService.cpp b/accessible/src/base/nsAccessibilityService.cpp
---- a/accessible/src/base/nsAccessibilityService.cpp
-+++ b/accessible/src/base/nsAccessibilityService.cpp
-@@ -119,13 +119,13 @@ nsAccessibilityService *nsAccessibilityS
- 
- nsAccessibilityService::nsAccessibilityService()
- {
--  nsCOMPtr<nsIObserverService> observerService = 
-+  nsIObserverService* observerService = 
-     do_GetService("@mozilla.org/observer-service;1");
-   if (!observerService)
-     return;
- 
-   observerService->AddObserver(this, NS_XPCOM_SHUTDOWN_OBSERVER_ID, PR_FALSE);
--  nsCOMPtr<nsIWebProgress> progress(do_GetService(NS_DOCUMENTLOADER_SERVICE_CONTRACTID));
-+  nsIWebProgress* progress(do_GetService(NS_DOCUMENTLOADER_SERVICE_CONTRACTID));
-   if (progress) {
-     progress->AddProgressListener(static_cast<nsIWebProgressListener*>(this),
-                                   nsIWebProgress::NOTIFY_STATE_DOCUMENT |
-@@ -150,18 +150,18 @@ nsAccessibilityService::Observe(nsISuppo
-                          const PRUnichar *aData)
- {
-   if (!nsCRT::strcmp(aTopic, NS_XPCOM_SHUTDOWN_OBSERVER_ID)) {
--    nsCOMPtr<nsIObserverService> observerService = 
-+    nsIObserverService* observerService = 
-       do_GetService("@mozilla.org/observer-service;1");
-     if (observerService) {
-       observerService->RemoveObserver(this, NS_XPCOM_SHUTDOWN_OBSERVER_ID);
-     }
--    nsCOMPtr<nsIWebProgress> progress(do_GetService(NS_DOCUMENTLOADER_SERVICE_CONTRACTID));
-+    nsIWebProgress* progress(do_GetService(NS_DOCUMENTLOADER_SERVICE_CONTRACTID));
-     if (progress)
-       progress->RemoveProgressListener(static_cast<nsIWebProgressListener*>(this));
-     nsAccessNodeWrap::ShutdownAccessibility();
-     // Cancel and release load timers
-     while (mLoadTimers.Count() > 0 ) {
--      nsCOMPtr<nsITimer> timer = mLoadTimers.ObjectAt(0);
-+      nsITimer* timer = mLoadTimers.ObjectAt(0);
-       void *closure = nsnull;
-       timer->GetClosure(&closure);
-       if (closure) {
-@@ -193,7 +193,7 @@ NS_IMETHODIMP nsAccessibilityService::On
-   if (NS_FAILED(aStatus) && (aStateFlags & STATE_START))
-     return NS_OK;
-  
--  nsCOMPtr<nsITimer> timer = do_CreateInstance("@mozilla.org/timer;1");
-+  nsITimer* timer = do_CreateInstance("@mozilla.org/timer;1");
-   if (!timer)
-     return NS_OK;
-   mLoadTimers.AppendObject(timer);
-@@ -213,16 +213,16 @@ NS_IMETHODIMP nsAccessibilityService::On
- 
- NS_IMETHODIMP nsAccessibilityService::ProcessDocLoadEvent(nsITimer *aTimer, void *aClosure, PRUint32 aEventType)
- {
--  nsCOMPtr<nsIDOMWindow> domWindow;
-+  nsIDOMWindow* domWindow = nsnull;
-   nsIWebProgress *webProgress = static_cast<nsIWebProgress*>(aClosure);
--  webProgress->GetDOMWindow(getter_AddRefs(domWindow));
-+  webProgress->GetDOMWindow(&domWindow);
-   NS_RELEASE(webProgress);
-   mLoadTimers.RemoveObject(aTimer);
-   NS_ENSURE_STATE(domWindow);
- 
-   if (aEventType == nsIAccessibleEvent::EVENT_DOCUMENT_LOAD_START) {
--    nsCOMPtr<nsIWebNavigation> webNav(do_GetInterface(domWindow));
--    nsCOMPtr<nsIDocShell> docShell(do_QueryInterface(webNav));
-+    nsIWebNavigation* webNav(do_GetInterface(domWindow));
-+    nsIDocShell* docShell(do_QueryInterface(webNav));
-     NS_ENSURE_STATE(docShell);
-     PRUint32 loadType;
-     docShell->GetLoadType(&loadType);
-@@ -234,14 +234,14 @@ NS_IMETHODIMP nsAccessibilityService::Pr
-     }
-   }
-       
--  nsCOMPtr<nsIDOMDocument> domDoc;
--  domWindow->GetDocument(getter_AddRefs(domDoc));
--  nsCOMPtr<nsIDOMNode> docNode = do_QueryInterface(domDoc);
-+  nsIDOMDocument* domDoc = nsnull;
-+  domWindow->GetDocument(&domDoc);
-+  nsIDOMNode* docNode = do_QueryInterface(domDoc);
-   NS_ENSURE_STATE(docNode);
- 
--  nsCOMPtr<nsIAccessible> accessible;
--  GetAccessibleFor(docNode, getter_AddRefs(accessible));
--  nsCOMPtr<nsPIAccessibleDocument> privDocAccessible = do_QueryInterface(accessible);
-+  nsIAccessible* accessible = nsnull;
-+  GetAccessibleFor(docNode, &accessible);
-+  nsPIAccessibleDocument* privDocAccessible = do_QueryInterface(accessible);
-   NS_ENSURE_STATE(privDocAccessible);
-   privDocAccessible->FireDocLoadEvents(aEventType);
- 
-@@ -287,19 +287,19 @@ NS_IMETHODIMP nsAccessibilityService::On
-   // If there is no accessible for the document, we will ignore
-   // this and the anchor jump event will be fired via OnStateChange
-   // and nsIAccessibleStates::STATE_STOP
--  nsCOMPtr<nsIDOMWindow> domWindow;
--  aWebProgress->GetDOMWindow(getter_AddRefs(domWindow));
-+  nsIDOMWindow* domWindow = nsnull;
-+  aWebProgress->GetDOMWindow(&domWindow);
-   NS_ASSERTION(domWindow, "DOM Window for state change is null");
-   NS_ENSURE_TRUE(domWindow, NS_ERROR_FAILURE);
- 
--  nsCOMPtr<nsIDOMDocument> domDoc;
--  domWindow->GetDocument(getter_AddRefs(domDoc));
--  nsCOMPtr<nsIDOMNode> domDocRootNode(do_QueryInterface(domDoc));
-+  nsIDOMDocument* domDoc = nsnull;
-+  domWindow->GetDocument(&domDoc);
-+  nsIDOMNode* domDocRootNode(do_QueryInterface(domDoc));
-   NS_ENSURE_TRUE(domDocRootNode, NS_ERROR_FAILURE);
- 
--  nsCOMPtr<nsIAccessibleDocument> accessibleDoc =
-+  nsIAccessibleDocument* accessibleDoc =
-     nsAccessNode::GetDocAccessibleFor(domDocRootNode);
--  nsCOMPtr<nsPIAccessibleDocument> privateAccessibleDoc =
-+  nsPIAccessibleDocument* privateAccessibleDoc =
-     do_QueryInterface(accessibleDoc);
-   if (!privateAccessibleDoc) {
-     return NS_OK;
-@@ -329,21 +329,21 @@ nsAccessibilityService::GetInfo(nsISuppo
- {
-   NS_ASSERTION(aFrame,"Error -- 1st argument (aFrame) is null!!");
-   *aRealFrame = static_cast<nsIFrame*>(aFrame);
--  nsCOMPtr<nsIContent> content = (*aRealFrame)->GetContent();
--  nsCOMPtr<nsIDOMNode> node(do_QueryInterface(content));
-+  nsIContent* content = (*aRealFrame)->GetContent();
-+  nsIDOMNode* node(do_QueryInterface(content));
-   if (!content || !node)
-     return NS_ERROR_FAILURE;
-   *aNode = node;
-   NS_IF_ADDREF(*aNode);
- 
--  nsCOMPtr<nsIDocument> document = content->GetDocument();
-+  nsIDocument* document = content->GetDocument();
-   if (!document)
-     return NS_ERROR_FAILURE;
- 
-   NS_ASSERTION(document->GetPrimaryShell(),"Error no shells!");
- 
-   // do_GetWR only works into a |nsCOMPtr| :-(
--  nsCOMPtr<nsIWeakReference> weakShell =
-+  nsIWeakReference* weakShell =
-     do_GetWeakReference(document->GetPrimaryShell());
-   NS_IF_ADDREF(*aShell = weakShell);
- 
-@@ -353,9 +353,9 @@ nsresult
- nsresult
- nsAccessibilityService::GetShellFromNode(nsIDOMNode *aNode, nsIWeakReference **aWeakShell)
- {
--  nsCOMPtr<nsIDOMDocument> domDoc;
--  aNode->GetOwnerDocument(getter_AddRefs(domDoc));
--  nsCOMPtr<nsIDocument> doc(do_QueryInterface(domDoc));
-+  nsIDOMDocument* domDoc = nsnull;
-+  aNode->GetOwnerDocument(&domDoc);
-+  nsIDocument* doc(do_QueryInterface(domDoc));
-   if (!doc)
-     return NS_ERROR_INVALID_ARG;
- 
-@@ -364,7 +364,7 @@ nsAccessibilityService::GetShellFromNode
-   if (!shell)
-     return NS_ERROR_FAILURE;
- 
--  nsCOMPtr<nsIWeakReference> weakRef(do_GetWeakReference(shell));
-+  nsIWeakReference* weakRef(do_GetWeakReference(shell));
-   
-   *aWeakShell = weakRef;
-   NS_IF_ADDREF(*aWeakShell);
-@@ -384,8 +384,8 @@ nsAccessibilityService::CreateOuterDocAc
-   
-   *aOuterDocAccessible = nsnull;
- 
--  nsCOMPtr<nsIWeakReference> outerWeakShell;
--  GetShellFromNode(aDOMNode, getter_AddRefs(outerWeakShell));
-+  nsIWeakReference* outerWeakShell = nsnull;
-+  GetShellFromNode(aDOMNode, &outerWeakShell);
-   NS_ENSURE_TRUE(outerWeakShell, NS_ERROR_FAILURE);
- 
-   nsOuterDocAccessible *outerDocAccessible =
-@@ -404,27 +404,27 @@ nsAccessibilityService::CreateRootAccess
- {
-   *aRootAcc = nsnull;
- 
--  nsCOMPtr<nsIDOMNode> rootNode(do_QueryInterface(aDocument));
-+  nsIDOMNode* rootNode(do_QueryInterface(aDocument));
-   NS_ENSURE_TRUE(rootNode, NS_ERROR_FAILURE);
- 
-   nsIPresShell *presShell = aShell;
-   if (!presShell) {
-     presShell = aDocument->GetPrimaryShell();
-   }
--  nsCOMPtr<nsIWeakReference> weakShell(do_GetWeakReference(presShell));
-+  nsIWeakReference* weakShell(do_GetWeakReference(presShell));
- 
--  nsCOMPtr<nsISupports> container = aDocument->GetContainer();
--  nsCOMPtr<nsIDocShell> docShell = do_QueryInterface(container);
-+  nsISupports* container = aDocument->GetContainer();
-+  nsIDocShell* docShell = do_QueryInterface(container);
-   NS_ENSURE_TRUE(docShell, NS_ERROR_FAILURE);
--  nsCOMPtr<nsIContentViewer> contentViewer;
--  docShell->GetContentViewer(getter_AddRefs(contentViewer));
-+  nsIContentViewer* contentViewer = nsnull;
-+  docShell->GetContentViewer(&contentViewer);
-   NS_ENSURE_TRUE(contentViewer, NS_ERROR_FAILURE); // Doc was already shut down
-   PRUint32 busyFlags;
-   docShell->GetBusyFlags(&busyFlags);
-   if (busyFlags != nsIDocShell::BUSY_FLAGS_NONE) {
--    nsCOMPtr<nsIWebNavigation> webNav(do_GetInterface(docShell));
--    nsCOMPtr<nsIURI> uri;
--    webNav->GetCurrentURI(getter_AddRefs(uri));
-+    nsIWebNavigation* webNav(do_GetInterface(docShell));
-+    nsIURI* uri = nsnull;
-+    webNav->GetCurrentURI(&uri);
-     NS_ENSURE_STATE(uri);
-     nsCAutoString url;
-     uri->GetSpec(url);
-@@ -433,12 +433,12 @@ nsAccessibilityService::CreateRootAccess
-     }
-   }
- 
--  nsCOMPtr<nsIDocShellTreeItem> docShellTreeItem =
-+  nsIDocShellTreeItem* docShellTreeItem =
-     do_QueryInterface(container);
-   NS_ENSURE_TRUE(docShellTreeItem, NS_ERROR_FAILURE);
-   
--  nsCOMPtr<nsIDocShellTreeItem> parentTreeItem;
--  docShellTreeItem->GetParent(getter_AddRefs(parentTreeItem));
-+  nsIDocShellTreeItem* parentTreeItem = nsnull;
-+  docShellTreeItem->GetParent(&parentTreeItem);
- 
-   if (parentTreeItem) {
-     // We only create root accessibles for the true root, othewise create a
-@@ -451,10 +451,10 @@ nsAccessibilityService::CreateRootAccess
-   if (!*aRootAcc)
-     return NS_ERROR_OUT_OF_MEMORY;
- 
--  nsCOMPtr<nsPIAccessNode> privateAccessNode(do_QueryInterface(*aRootAcc));
-+  nsPIAccessNode* privateAccessNode(do_QueryInterface(*aRootAcc));
-   privateAccessNode->Init();
-   nsRoleMapEntry *roleMapEntry = nsAccUtils::GetRoleMapEntry(rootNode);
--  nsCOMPtr<nsPIAccessible> privateAccessible =
-+  nsPIAccessible* privateAccessible =
-     do_QueryInterface(privateAccessNode);
-   privateAccessible->SetRoleMapEntry(roleMapEntry);
- 
-@@ -470,9 +470,9 @@ nsAccessibilityService::CreateHTML4Butto
- nsAccessibilityService::CreateHTML4ButtonAccessible(nsISupports *aFrame, nsIAccessible **_retval)
- {
-   nsIFrame* frame;
--  nsCOMPtr<nsIDOMNode> node;
--  nsCOMPtr<nsIWeakReference> weakShell;
--  nsresult rv = GetInfo(aFrame, &frame, getter_AddRefs(weakShell), getter_AddRefs(node));
-+  nsIDOMNode* node = nsnull;
-+  nsIWeakReference* weakShell = nsnull;
-+  nsresult rv = GetInfo(aFrame, &frame, &weakShell, &node);
-   if (NS_FAILED(rv))
-     return rv;
- 
-@@ -488,9 +488,9 @@ nsAccessibilityService::CreateHTMLButton
- nsAccessibilityService::CreateHTMLButtonAccessible(nsISupports *aFrame, nsIAccessible **_retval)
- {
-   nsIFrame* frame;
--  nsCOMPtr<nsIDOMNode> node;
--  nsCOMPtr<nsIWeakReference> weakShell;
--  nsresult rv = GetInfo(aFrame, &frame, getter_AddRefs(weakShell), getter_AddRefs(node));
-+  nsIDOMNode* node = nsnull;
-+  nsIWeakReference* weakShell = nsnull;
-+  nsresult rv = GetInfo(aFrame, &frame, &weakShell, &node);
-   if (NS_FAILED(rv))
-     return rv;
- 
-@@ -510,7 +510,7 @@ nsAccessibilityService::CreateHTMLAccess
- {
-   // This method assumes we're in an HTML namespace.
-   *aAccessible = nsnull;
--  nsCOMPtr<nsIContent> content(do_QueryInterface(aNode));
-+  nsIContent* content(do_QueryInterface(aNode));
-   nsIAtom *tag = content->Tag();
-   if (tag == nsAccessibilityAtoms::legend) {
-     *aAccessible = new nsHTMLLegendAccessible(aNode, aWeakShell);
-@@ -564,9 +564,9 @@ nsAccessibilityService::CreateHTMLLIAcce
-                                                nsIAccessible **_retval)
- {
-   nsIFrame* frame;
--  nsCOMPtr<nsIDOMNode> node;
--  nsCOMPtr<nsIWeakReference> weakShell;
--  nsresult rv = GetInfo(aFrame, &frame, getter_AddRefs(weakShell), getter_AddRefs(node));
-+  nsIDOMNode* node = nsnull;
-+  nsIWeakReference* weakShell = nsnull;
-+  nsresult rv = GetInfo(aFrame, &frame, &weakShell, &node);
-   if (NS_FAILED(rv))
-     return rv;
- 
-@@ -582,13 +582,13 @@ nsAccessibilityService::CreateHyperTextA
- nsAccessibilityService::CreateHyperTextAccessible(nsISupports *aFrame, nsIAccessible **aAccessible)
- {
-   nsIFrame* frame;
--  nsCOMPtr<nsIDOMNode> node;
--  nsCOMPtr<nsIWeakReference> weakShell;
--  nsresult rv = GetInfo(aFrame, &frame, getter_AddRefs(weakShell), getter_AddRefs(node));
-+  nsIDOMNode* node = nsnull;
-+  nsIWeakReference* weakShell = nsnull;
-+  nsresult rv = GetInfo(aFrame, &frame, &weakShell, &node);
-   if (NS_FAILED(rv))
-     return rv;
- 
--  nsCOMPtr<nsIContent> content(do_QueryInterface(node));
-+  nsIContent* content(do_QueryInterface(node));
-   NS_ENSURE_TRUE(content, NS_ERROR_FAILURE);
-   
-   if (nsAccUtils::HasListener(content, NS_LITERAL_STRING("click"))) {
-@@ -610,9 +610,9 @@ nsAccessibilityService::CreateHTMLCheckb
- nsAccessibilityService::CreateHTMLCheckboxAccessible(nsISupports *aFrame, nsIAccessible **_retval)
- {
-   nsIFrame* frame;
--  nsCOMPtr<nsIDOMNode> node;
--  nsCOMPtr<nsIWeakReference> weakShell;
--  nsresult rv = GetInfo(aFrame, &frame, getter_AddRefs(weakShell), getter_AddRefs(node));
-+  nsIDOMNode* node = nsnull;
-+  nsIWeakReference* weakShell = nsnull;
-+  nsresult rv = GetInfo(aFrame, &frame, &weakShell, &node);
-   if (NS_FAILED(rv))
-     return rv;
- 
-@@ -639,14 +639,14 @@ nsAccessibilityService::CreateHTMLImageA
- nsAccessibilityService::CreateHTMLImageAccessible(nsISupports *aFrame, nsIAccessible **_retval)
- {
-   nsIFrame* frame;
--  nsCOMPtr<nsIDOMNode> node;
--  nsCOMPtr<nsIWeakReference> weakShell;
--  nsresult rv = GetInfo(aFrame, &frame, getter_AddRefs(weakShell), getter_AddRefs(node));
-+  nsIDOMNode* node = nsnull;
-+  nsIWeakReference* weakShell = nsnull;
-+  nsresult rv = GetInfo(aFrame, &frame, &weakShell, &node);
-   if (NS_FAILED(rv))
-     return rv;
- 
-   *_retval = nsnull;
--  nsCOMPtr<nsIDOMElement> domElement(do_QueryInterface(node));
-+  nsIDOMElement* domElement(do_QueryInterface(node));
-   if (domElement) {
-       *_retval = new nsHTMLImageAccessibleWrap(node, weakShell);
-   }
-@@ -668,9 +668,9 @@ nsAccessibilityService::CreateHTMLGroupb
- nsAccessibilityService::CreateHTMLGroupboxAccessible(nsISupports *aFrame, nsIAccessible **_retval)
- {
-   nsIFrame* frame;
--  nsCOMPtr<nsIDOMNode> node;
--  nsCOMPtr<nsIWeakReference> weakShell;
--  nsresult rv = GetInfo(aFrame, &frame, getter_AddRefs(weakShell), getter_AddRefs(node));
-+  nsIDOMNode* node = nsnull;
-+  nsIWeakReference* weakShell = nsnull;
-+  nsresult rv = GetInfo(aFrame, &frame, &weakShell, &node);
-   if (NS_FAILED(rv))
-     return rv;
- 
-@@ -706,20 +706,20 @@ nsAccessibilityService::CreateHTMLObject
- nsAccessibilityService::CreateHTMLObjectFrameAccessible(nsObjectFrame *aFrame,
-                                                         nsIAccessible **aAccessible)
- {
--  nsCOMPtr<nsIDOMNode> node;
--  nsCOMPtr<nsIWeakReference> weakShell;
-+  nsIDOMNode* node = nsnull;
-+  nsIWeakReference* weakShell = nsnull;
-   nsIFrame *frame;
--  GetInfo(static_cast<nsIFrame*>(aFrame), &frame, getter_AddRefs(weakShell), getter_AddRefs(node));
-+  GetInfo(static_cast<nsIFrame*>(aFrame), &frame, &weakShell, &node);
- 
-   *aAccessible = nsnull;
-   if (!frame || frame->GetRect().IsEmpty()) {
-     return NS_ERROR_FAILURE;
-   }
-   // 1) for object elements containing either HTML or TXT documents
--  nsCOMPtr<nsIDOMDocument> domDoc;
--  nsCOMPtr<nsIDOMHTMLObjectElement> obj(do_QueryInterface(node));
-+  nsIDOMDocument* domDoc = nsnull;
-+  nsIDOMHTMLObjectElement* obj(do_QueryInterface(node));
-   if (obj)
--    obj->GetContentDocument(getter_AddRefs(domDoc));
-+    obj->GetContentDocument(&domDoc);
-   else
-     domDoc = do_QueryInterface(node);
-   if (domDoc)
-@@ -755,9 +755,9 @@ nsAccessibilityService::CreateHTMLRadioB
- nsAccessibilityService::CreateHTMLRadioButtonAccessible(nsISupports *aFrame, nsIAccessible **_retval)
- {
-   nsIFrame* frame;
--  nsCOMPtr<nsIDOMNode> node;
--  nsCOMPtr<nsIWeakReference> weakShell;
--  nsresult rv = GetInfo(aFrame, &frame, getter_AddRefs(weakShell), getter_AddRefs(node));
-+  nsIDOMNode* node = nsnull;
-+  nsIWeakReference* weakShell = nsnull;
-+  nsresult rv = GetInfo(aFrame, &frame, &weakShell, &node);
-   if (NS_FAILED(rv))
-     return rv;
- 
-@@ -787,9 +787,9 @@ nsAccessibilityService::CreateHTMLTableA
- nsAccessibilityService::CreateHTMLTableAccessible(nsISupports *aFrame, nsIAccessible **_retval)
- {
-   nsIFrame* frame;
--  nsCOMPtr<nsIDOMNode> node;
--  nsCOMPtr<nsIWeakReference> weakShell;
--  nsresult rv = GetInfo(aFrame, &frame, getter_AddRefs(weakShell), getter_AddRefs(node));
-+  nsIDOMNode* node = nsnull;
-+  nsIWeakReference* weakShell = nsnull;
-+  nsresult rv = GetInfo(aFrame, &frame, &weakShell, &node);
-   if (NS_FAILED(rv))
-     return rv;
- 
-@@ -812,8 +812,8 @@ nsAccessibilityService::CreateHTMLTableH
- 
-   nsresult rv = NS_OK;
- 
--  nsCOMPtr<nsIWeakReference> weakShell;
--  rv = GetShellFromNode(aDOMNode, getter_AddRefs(weakShell));
-+  nsIWeakReference* weakShell = nsnull;
-+  rv = GetShellFromNode(aDOMNode, &weakShell);
-   NS_ENSURE_SUCCESS(rv, rv);
- 
-   nsHTMLTableHeadAccessibleWrap* accTableHead =
-@@ -832,9 +832,9 @@ nsAccessibilityService::CreateHTMLTableC
- nsAccessibilityService::CreateHTMLTableCellAccessible(nsISupports *aFrame, nsIAccessible **_retval)
- {
-   nsIFrame* frame;
--  nsCOMPtr<nsIDOMNode> node;
--  nsCOMPtr<nsIWeakReference> weakShell;
--  nsresult rv = GetInfo(aFrame, &frame, getter_AddRefs(weakShell), getter_AddRefs(node));
-+  nsIDOMNode* node = nsnull;
-+  nsIWeakReference* weakShell = nsnull;
-+  nsresult rv = GetInfo(aFrame, &frame, &weakShell, &node);
-   if (NS_FAILED(rv))
-     return rv;
- 
-@@ -852,9 +852,9 @@ nsAccessibilityService::CreateHTMLTextAc
-   *_retval = nsnull;
- 
-   nsIFrame* frame;
--  nsCOMPtr<nsIDOMNode> node;
--  nsCOMPtr<nsIWeakReference> weakShell;
--  nsresult rv = GetInfo(aFrame, &frame, getter_AddRefs(weakShell), getter_AddRefs(node));
-+  nsIDOMNode* node = nsnull;
-+  nsIWeakReference* weakShell = nsnull;
-+  nsresult rv = GetInfo(aFrame, &frame, &weakShell, &node);
-   if (NS_FAILED(rv))
-     return rv;
- 
-@@ -871,9 +871,9 @@ nsAccessibilityService::CreateHTMLTextFi
- nsAccessibilityService::CreateHTMLTextFieldAccessible(nsISupports *aFrame, nsIAccessible **_retval)
- {
-   nsIFrame* frame;
--  nsCOMPtr<nsIDOMNode> node;
--  nsCOMPtr<nsIWeakReference> weakShell;
--  nsresult rv = GetInfo(aFrame, &frame, getter_AddRefs(weakShell), getter_AddRefs(node));
-+  nsIDOMNode* node = nsnull;
-+  nsIWeakReference* weakShell = nsnull;
-+  nsresult rv = GetInfo(aFrame, &frame, &weakShell, &node);
-   if (NS_FAILED(rv))
-     return rv;
- 
-@@ -889,9 +889,9 @@ nsAccessibilityService::CreateHTMLLabelA
- nsAccessibilityService::CreateHTMLLabelAccessible(nsISupports *aFrame, nsIAccessible **_retval)
- {
-   nsIFrame* frame;
--  nsCOMPtr<nsIDOMNode> node;
--  nsCOMPtr<nsIWeakReference> weakShell;
--  nsresult rv = GetInfo(aFrame, &frame, getter_AddRefs(weakShell), getter_AddRefs(node));
-+  nsIDOMNode* node = nsnull;
-+  nsIWeakReference* weakShell = nsnull;
-+  nsresult rv = GetInfo(aFrame, &frame, &weakShell, &node);
-   if (NS_FAILED(rv))
-     return rv;
- 
-@@ -907,9 +907,9 @@ nsAccessibilityService::CreateHTMLHRAcce
- nsAccessibilityService::CreateHTMLHRAccessible(nsISupports *aFrame, nsIAccessible **_retval)
- {
-   nsIFrame* frame;
--  nsCOMPtr<nsIDOMNode> node;
--  nsCOMPtr<nsIWeakReference> weakShell;
--  nsresult rv = GetInfo(aFrame, &frame, getter_AddRefs(weakShell), getter_AddRefs(node));
-+  nsIDOMNode* node = nsnull;
-+  nsIWeakReference* weakShell = nsnull;
-+  nsresult rv = GetInfo(aFrame, &frame, &weakShell, &node);
-   if (NS_FAILED(rv))
-     return rv;
- 
-@@ -925,9 +925,9 @@ nsAccessibilityService::CreateHTMLBRAcce
- nsAccessibilityService::CreateHTMLBRAccessible(nsISupports *aFrame, nsIAccessible **_retval)
- {
-   nsIFrame* frame;
--  nsCOMPtr<nsIDOMNode> node;
--  nsCOMPtr<nsIWeakReference> weakShell;
--  nsresult rv = GetInfo(aFrame, &frame, getter_AddRefs(weakShell), getter_AddRefs(node));
-+  nsIDOMNode* node = nsnull;
-+  nsIWeakReference* weakShell = nsnull;
-+  nsresult rv = GetInfo(aFrame, &frame, &weakShell, &node);
-   if (NS_FAILED(rv))
-     return rv;
- 
-@@ -943,9 +943,9 @@ nsAccessibilityService::CreateHTMLCaptio
- nsAccessibilityService::CreateHTMLCaptionAccessible(nsISupports *aFrame, nsIAccessible **_retval)
- {
-   nsIFrame* frame;
--  nsCOMPtr<nsIDOMNode> node;
--  nsCOMPtr<nsIWeakReference> weakShell;
--  nsresult rv = GetInfo(aFrame, &frame, getter_AddRefs(weakShell), getter_AddRefs(node));
-+  nsIDOMNode* node = nsnull;
-+  nsIWeakReference* weakShell = nsnull;
-+  nsresult rv = GetInfo(aFrame, &frame, &weakShell, &node);
-   if (NS_FAILED(rv))
-     return rv;
- 
-@@ -961,9 +961,9 @@ NS_IMETHODIMP nsAccessibilityService::Ge
-                                                           nsIWeakReference *aWeakShell,
-                                                           nsIAccessible **aAccessible)
- {
--  nsCOMPtr<nsIAccessNode> accessNode;
--  nsresult rv = GetCachedAccessNode(aNode, aWeakShell, getter_AddRefs(accessNode));
--  nsCOMPtr<nsIAccessible> accessible(do_QueryInterface(accessNode));
-+  nsIAccessNode* accessNode = nsnull;
-+  nsresult rv = GetCachedAccessNode(aNode, aWeakShell, &accessNode);
-+  nsIAccessible* accessible(do_QueryInterface(accessNode));
-   NS_IF_ADDREF(*aAccessible = accessible);
-   return rv;
- }
-@@ -972,7 +972,7 @@ NS_IMETHODIMP nsAccessibilityService::Ge
-                                                           nsIWeakReference *aWeakShell,
-                                                           nsIAccessNode **aAccessNode)
- {
--  nsCOMPtr<nsIAccessibleDocument> accessibleDoc =
-+  nsIAccessibleDocument* accessibleDoc =
-     nsAccessNode::GetDocAccessibleFor(aWeakShell);
- 
-   if (!accessibleDoc) {
-@@ -1158,8 +1158,8 @@ nsAccessibilityService::GetAccessibleFor
- 
-   // We use presentation shell #0 because we assume that is presentation of
-   // given node window.
--  nsCOMPtr<nsIContent> content(do_QueryInterface(aNode));
--  nsCOMPtr<nsIDocument> doc;
-+  nsIContent* content(do_QueryInterface(aNode));
-+  nsIDocument* doc = nsnull;
-   if (content) {
-     doc = content->GetDocument();
-   }
-@@ -1182,8 +1182,8 @@ nsAccessibilityService::GetAttachedAcces
- 
-   *aAccessible = nsnull;
- 
--  nsCOMPtr<nsIDOMNode> relevantNode;
--  nsresult rv = GetRelevantContentNodeFor(aNode, getter_AddRefs(relevantNode));
-+  nsIDOMNode* relevantNode = nsnull;
-+  nsresult rv = GetRelevantContentNodeFor(aNode, &relevantNode);
-   NS_ENSURE_SUCCESS(rv, rv);
- 
-   if (relevantNode != aNode)
-@@ -1202,13 +1202,13 @@ NS_IMETHODIMP nsAccessibilityService::Ge
-   NS_ENSURE_ARG(aNode);
-   NS_ENSURE_ARG(aWin);
- 
--  nsCOMPtr<nsIWebNavigation> webNav(do_GetInterface(aWin));
--  nsCOMPtr<nsIDocShell> docShell(do_QueryInterface(webNav));
-+  nsIWebNavigation* webNav(do_GetInterface(aWin));
-+  nsIDocShell* docShell(do_QueryInterface(webNav));
-   if (!docShell)
-     return NS_ERROR_FAILURE;
- 
--  nsCOMPtr<nsIPresShell> presShell;
--  docShell->GetPresShell(getter_AddRefs(presShell));
-+  nsIPresShell* presShell = nsnull;
-+  docShell->GetPresShell(&presShell);
-   return GetAccessibleInShell(aNode, presShell, aAccessible);
- }
- 
-@@ -1222,7 +1222,7 @@ NS_IMETHODIMP nsAccessibilityService::Ge
-   NS_ENSURE_ARG(aNode);
-   NS_ENSURE_ARG(aPresShell);
- 
--  nsCOMPtr<nsIWeakReference> weakShell(do_GetWeakReference(aPresShell));
-+  nsIWeakReference* weakShell(do_GetWeakReference(aPresShell));
-   nsIFrame *outFrameUnused = NULL;
-   PRBool isHiddenUnused = false;
-   return GetAccessible(aNode, aPresShell, weakShell, 
-@@ -1239,7 +1239,7 @@ NS_IMETHODIMP nsAccessibilityService::Ge
-   NS_ENSURE_ARG(aNode);
-   NS_ENSURE_ARG(aWeakShell);
- 
--  nsCOMPtr<nsIPresShell> presShell(do_QueryReferent(aWeakShell));
-+  nsIPresShell* presShell(do_QueryReferent(aWeakShell));
-   nsIFrame *outFrameUnused = NULL;
-   PRBool isHiddenUnused = false;
-   return GetAccessible(aNode, presShell, aWeakShell, 
-@@ -1255,11 +1255,11 @@ nsresult nsAccessibilityService::InitAcc
-   }
-   NS_ASSERTION(aAccessibleOut && !*aAccessibleOut, "Out param should already be cleared out");
- 
--  nsCOMPtr<nsPIAccessNode> privateAccessNode = do_QueryInterface(aAccessibleIn);
-+  nsPIAccessNode* privateAccessNode = do_QueryInterface(aAccessibleIn);
-   NS_ASSERTION(privateAccessNode, "All accessibles must support nsPIAccessNode");
-   nsresult rv = privateAccessNode->Init(); // Add to cache, etc.
-   if (NS_SUCCEEDED(rv)) {
--    nsCOMPtr<nsPIAccessible> privateAccessible =
-+    nsPIAccessible* privateAccessible =
-       do_QueryInterface(privateAccessNode);
-     privateAccessible->SetRoleMapEntry(aRoleMapEntry);
-     NS_ADDREF(*aAccessibleOut = aAccessibleIn);
-@@ -1330,10 +1330,10 @@ NS_IMETHODIMP nsAccessibilityService::Ge
- 
-   // Check to see if we already have an accessible for this
-   // node in the cache
--  nsCOMPtr<nsIAccessNode> accessNode;
--  GetCachedAccessNode(aNode, aWeakShell, getter_AddRefs(accessNode));
-+  nsIAccessNode* accessNode = nsnull;
-+  GetCachedAccessNode(aNode, aWeakShell, &accessNode);
- 
--  nsCOMPtr<nsIAccessible> newAcc;
-+  nsIAccessible* newAcc = nsnull;
-   if (accessNode) {
-     // Retrieved from cache. QI might not succeed if it's a node that's not
-     // accessible. In this case try to create new accessible because one and
-@@ -1346,25 +1346,25 @@ NS_IMETHODIMP nsAccessibilityService::Ge
-     }
-   }
- 
--  nsCOMPtr<nsIContent> content(do_QueryInterface(aNode));
-+  nsIContent* content(do_QueryInterface(aNode));
- 
-   // No cache entry, so we must create the accessible
-   // Check to see if hidden first
--  nsCOMPtr<nsIDocument> nodeIsDoc;
-+  nsIDocument* nodeIsDoc = nsnull;
-   if (!content) {
-     // This happens when we're on the document node, which will not QI to an
-     // nsIContent.
-     nodeIsDoc = do_QueryInterface(aNode);
-     NS_ENSURE_TRUE(nodeIsDoc, NS_ERROR_FAILURE); // No content, and not doc node
- 
--    nsCOMPtr<nsIAccessibleDocument> accessibleDoc =
-+    nsIAccessibleDocument* accessibleDoc =
-       nsAccessNode::GetDocAccessibleFor(aWeakShell);
-     if (accessibleDoc) {
-       newAcc = do_QueryInterface(accessibleDoc);
-       NS_ASSERTION(newAcc, "nsIAccessibleDocument is not an nsIAccessible");
-     }
-     else {
--      CreateRootAccessible(aPresShell, nodeIsDoc, getter_AddRefs(newAcc)); // Does Init() for us
-+      CreateRootAccessible(aPresShell, nodeIsDoc, &newAcc); // Does Init() for us
-       NS_WARN_IF_FALSE(newAcc, "No root/doc accessible created");
-     }
- 
-@@ -1413,10 +1413,10 @@ NS_IMETHODIMP nsAccessibilityService::Ge
-         // Check if frame is an image frame, and content is <area>
-         nsIImageFrame *imageFrame;
-         CallQueryInterface(frame, &imageFrame);
--        nsCOMPtr<nsIDOMHTMLAreaElement> areaElmt = do_QueryInterface(content);
-+        nsIDOMHTMLAreaElement* areaElmt = do_QueryInterface(content);
-         if (imageFrame && areaElmt) {
--          nsCOMPtr<nsIAccessible> imageAcc;
--          CreateHTMLImageAccessible(frame, getter_AddRefs(imageAcc));
-+          nsIAccessible* imageAcc = nsnull;
-+          CreateHTMLImageAccessible(frame, &imageAcc);
-           if (imageAcc) {
-             // cache children
-             PRInt32 childCount;
-@@ -1454,7 +1454,7 @@ NS_IMETHODIMP nsAccessibilityService::Ge
-         return NS_OK;
-       }
-     }
--    frame->GetAccessible(getter_AddRefs(newAcc));
-+    frame->GetAccessible(&newAcc);
-     return InitAccessible(newAcc, aAccessible, nsnull);
-   }
- 
-@@ -1475,7 +1475,7 @@ NS_IMETHODIMP nsAccessibilityService::Ge
-       return NS_OK;
-     }
-     
--    nsresult rv = CreateHyperTextAccessible(frame, getter_AddRefs(newAcc));
-+    nsresult rv = CreateHyperTextAccessible(frame, &newAcc);
-     NS_ENSURE_SUCCESS(rv, rv);
-   }
- 
-@@ -1490,7 +1490,7 @@ NS_IMETHODIMP nsAccessibilityService::Ge
- 
-   // Elements may implement nsIAccessibleProvider via XBL. This allows them to
-   // say what kind of accessible to create.
--  nsresult rv = GetAccessibleByType(aNode, getter_AddRefs(newAcc));
-+  nsresult rv = GetAccessibleByType(aNode, &newAcc);
-   NS_ENSURE_SUCCESS(rv, rv);
- 
-   if (!newAcc && !isHTML) {
-@@ -1522,9 +1522,9 @@ NS_IMETHODIMP nsAccessibilityService::Ge
-         if (!tableFrame)
-           continue;
-         if (tableFrame->GetType() == nsAccessibilityAtoms::tableOuterFrame) {
--          nsCOMPtr<nsIDOMNode> tableNode(do_QueryInterface(tableContent));
--          nsCOMPtr<nsIAccessible> tableAccessible;
--          GetAccessibleInShell(tableNode, aPresShell, getter_AddRefs(tableAccessible));
-+          nsIDOMNode* tableNode(do_QueryInterface(tableContent));
-+          nsIAccessible* tableAccessible = nsnull;
-+          GetAccessibleInShell(tableNode, aPresShell, &tableAccessible);
-           if (!tableAccessible && !content->IsFocusable()) {
- #ifdef DEBUG
-             nsRoleMapEntry *tableRoleMapEntry = nsAccUtils::GetRoleMapEntry(tableNode);
-@@ -1562,7 +1562,7 @@ NS_IMETHODIMP nsAccessibilityService::Ge
-       // we do not call it if accessibles for table related content are
-       // prevented above.
-       rv = CreateHTMLAccessibleByMarkup(frame, aWeakShell, aNode,
--                                        getter_AddRefs(newAcc));
-+                                        &newAcc);
-       NS_ENSURE_SUCCESS(rv, rv);
- 
-       if (!newAcc) {
-@@ -1579,13 +1579,13 @@ NS_IMETHODIMP nsAccessibilityService::Ge
-           *aIsHidden = PR_TRUE;
-           return NS_OK;
-         }
--        frame->GetAccessible(getter_AddRefs(newAcc)); // Try using frame to do it
-+        frame->GetAccessible(&newAcc); // Try using frame to do it
-       }
-     }
-   }
- 
-   if (!newAcc) {
--    GetAccessibleForDeckChildren(aNode, getter_AddRefs(newAcc));
-+    GetAccessibleForDeckChildren(aNode, &newAcc);
-   }
- 
-   // If no accessible, see if we need to create a generic accessible because
-@@ -1602,7 +1602,7 @@ NS_IMETHODIMP nsAccessibilityService::Ge
-     // other accessibles can point to it, or so that it can hold a state, etc.
-     if (isHTML) {
-       // Interesting HTML container which may have selectable text and/or embedded objects
--      CreateHyperTextAccessible(frame, getter_AddRefs(newAcc));
-+      CreateHyperTextAccessible(frame, &newAcc);
-     }
-     else {  // XUL, SVG, MathML etc.
-       // Interesting generic non-HTML container
-@@ -1663,7 +1663,7 @@ nsAccessibilityService::GetRelevantConte
-   NS_ENSURE_ARG_POINTER(aRelevantNode);
- 
-   nsresult rv;
--  nsCOMPtr<nsIContent> content(do_QueryInterface(aNode));
-+  nsIContent* content(do_QueryInterface(aNode));
-   if (content) {
-     // Build stack of binding parents so we can walk it in reverse.
-     nsIContent *bindingParent;
-@@ -1678,15 +1678,15 @@ nsAccessibilityService::GetRelevantConte
-     PRInt32 bindingsCount = bindingsStack.Count();
-     for (PRInt32 index = bindingsCount - 1; index >= 0 ; index--) {
-       bindingParent = bindingsStack[index];
--      nsCOMPtr<nsIDOMNode> bindingNode(do_QueryInterface(bindingParent));
-+      nsIDOMNode* bindingNode(do_QueryInterface(bindingParent));
-       if (bindingNode) {
-         // Try to get an accessible by type since XBL widget can be accessible
-         // only if it implements nsIAccessibleProvider interface.
--        nsCOMPtr<nsIAccessible> accessible;
--        rv = GetAccessibleByType(bindingNode, getter_AddRefs(accessible));
-+        nsIAccessible* accessible = nsnull;
-+        rv = GetAccessibleByType(bindingNode, &accessible);
- 
-         if (NS_SUCCEEDED(rv)) {
--          nsCOMPtr<nsPIAccessible> paccessible(do_QueryInterface(accessible));
-+          nsPIAccessible* paccessible(do_QueryInterface(accessible));
-           if (paccessible) {
-             PRBool allowsAnonChildren = PR_FALSE;
-             paccessible->GetAllowsAnonChildAccessibles(&allowsAnonChildren);
-@@ -1712,7 +1712,7 @@ nsresult nsAccessibilityService::GetAcce
- 
-   *aAccessible = nsnull;
- 
--  nsCOMPtr<nsIAccessibleProvider> accessibleProvider(do_QueryInterface(aNode));
-+  nsIAccessibleProvider* accessibleProvider(do_QueryInterface(aNode));
-   if (!accessibleProvider)
-     return NS_OK;
- 
-@@ -1723,8 +1723,8 @@ nsresult nsAccessibilityService::GetAcce
-   if (type == nsIAccessibleProvider::OuterDoc)
-     return CreateOuterDocAccessible(aNode, aAccessible);
- 
--  nsCOMPtr<nsIWeakReference> weakShell;
--  GetShellFromNode(aNode, getter_AddRefs(weakShell));
-+  nsIWeakReference* weakShell = nsnull;
-+  GetShellFromNode(aNode, &weakShell);
- 
-   switch (type)
-   {
-@@ -1759,7 +1759,7 @@ nsresult nsAccessibilityService::GetAcce
-     case nsIAccessibleProvider::XULImage:
-     {
-       // Don't include nameless images in accessible tree
--      nsCOMPtr<nsIDOMElement> elt(do_QueryInterface(aNode));
-+      nsIDOMElement* elt(do_QueryInterface(aNode));
-       if (!elt)
-         return NS_ERROR_FAILURE;
- 
-@@ -1804,7 +1804,7 @@ nsresult nsAccessibilityService::GetAcce
-       // XXX In the future we will should this for consistency across the nsIAccessible
-       // implementations on each platform for a consistent scripting environment, but
-       // then strip out redundant accessibles in the nsAccessibleWrap class for each platform.
--      nsCOMPtr<nsIContent> content = do_QueryInterface(aNode);
-+      nsIContent* content = do_QueryInterface(aNode);
-       if (content) {
-         nsIContent *parent = content->GetParent();
-         if (parent && parent->NodeInfo()->Equals(nsAccessibilityAtoms::menu, kNameSpaceID_XUL)) {
-@@ -1960,7 +1960,7 @@ NS_IMETHODIMP nsAccessibilityService::Ad
-   *aRootAccessible = static_cast<nsIAccessible*>(rootAccWrap);
-   NS_ADDREF(*aRootAccessible);
- 
--  nsRefPtr<nsApplicationAccessibleWrap> appRoot =
-+  nsApplicationAccessibleWrap* appRoot =
-     nsAccessNode::GetApplicationAccessible();
-   NS_ENSURE_STATE(appRoot);
- 
-@@ -1978,7 +1978,7 @@ NS_IMETHODIMP nsAccessibilityService::Re
-   void* atkAccessible;
-   aRootAccessible->GetNativeInterface(&atkAccessible);
- 
--  nsRefPtr<nsApplicationAccessibleWrap> appRoot =
-+  nsApplicationAccessibleWrap* appRoot =
-     nsAccessNode::GetApplicationAccessible();
-   NS_ENSURE_STATE(appRoot);
- 
-@@ -2004,9 +2004,9 @@ NS_IMETHODIMP nsAccessibilityService::In
-                "Incorrect aEvent passed in");
- 
-   NS_ENSURE_ARG_POINTER(aShell);
--  nsCOMPtr<nsIAccessibleDocument> accessibleDoc =
-+  nsIAccessibleDocument* accessibleDoc =
-     nsAccessNode::GetDocAccessibleFor(aShell->GetDocument());
--  nsCOMPtr<nsPIAccessibleDocument> privateAccessibleDoc =
-+  nsPIAccessibleDocument* privateAccessibleDoc =
-     do_QueryInterface(accessibleDoc);
-   if (!privateAccessibleDoc) {
-     return NS_OK;
-@@ -2045,15 +2045,15 @@ nsresult
- nsresult
- nsAccessibilityService::GetAccessibleForDeckChildren(nsIDOMNode *aNode, nsIAccessible** aAccessible)
- {
--  nsCOMPtr<nsIWeakReference> weakShell;
--  GetShellFromNode(aNode, getter_AddRefs(weakShell));
-+  nsIWeakReference* weakShell = nsnull;
-+  GetShellFromNode(aNode, &weakShell);
-   NS_ENSURE_TRUE(weakShell, NS_ERROR_FAILURE);
--  nsCOMPtr<nsIPresShell> shell(do_QueryReferent(weakShell));
-+  nsIPresShell* shell(do_QueryReferent(weakShell));
-   NS_ENSURE_TRUE(shell, NS_ERROR_FAILURE);
-   
-   nsIFrame* frame = nsnull;
-   nsIFrame* parentFrame = nsnull;
--  nsCOMPtr<nsIContent> content(do_QueryInterface(aNode));
-+  nsIContent* content(do_QueryInterface(aNode));
- 
-   if (content) {
-     frame = shell->GetPrimaryFrameFor(content);
-@@ -2065,7 +2065,7 @@ nsAccessibilityService::GetAccessibleFor
-     if (parentFrame && parentFrame->GetType() == nsAccessibilityAtoms::deckFrame) {
-       // If deck frame is for xul:tabpanels element then the given node has
-       // tabpanel accessible.
--      nsCOMPtr<nsIContent> parentContent = parentFrame->GetContent();
-+      nsIContent* parentContent = parentFrame->GetContent();
-       if (parentContent->NodeInfo()->Equals(nsAccessibilityAtoms::tabpanels,
-                                             kNameSpaceID_XUL)) {
-         *aAccessible = new nsXULTabpanelAccessible(aNode, weakShell);
-diff --git a/accessible/src/base/nsAccessibilityUtils.cpp b/accessible/src/base/nsAccessibilityUtils.cpp
---- a/accessible/src/base/nsAccessibilityUtils.cpp
-+++ b/accessible/src/base/nsAccessibilityUtils.cpp
-@@ -170,12 +170,12 @@ nsAccUtils::SetAccAttrsForXULSelectContr
- nsAccUtils::SetAccAttrsForXULSelectControlItem(nsIDOMNode *aNode,
-                                                nsIPersistentProperties *aAttributes)
- {
--  nsCOMPtr<nsIDOMXULSelectControlItemElement> item(do_QueryInterface(aNode));
-+  nsIDOMXULSelectControlItemElement* item(do_QueryInterface(aNode));
-   if (!item)
-     return;
- 
--  nsCOMPtr<nsIDOMXULSelectControlElement> control;
--  item->GetControl(getter_AddRefs(control));
-+  nsIDOMXULSelectControlElement* control = nsnull;
-+  item->GetControl(&control);
-   if (!control)
-     return;
- 
-@@ -187,13 +187,13 @@ nsAccUtils::SetAccAttrsForXULSelectContr
- 
-   PRUint32 setSize = itemsCount, posInSet = indexOf;
-   for (PRUint32 index = 0; index < itemsCount; index++) {
--    nsCOMPtr<nsIDOMXULSelectControlItemElement> currItem;
--    control->GetItemAtIndex(index, getter_AddRefs(currItem));
--    nsCOMPtr<nsIDOMNode> currNode(do_QueryInterface(currItem));
-+    nsIDOMXULSelectControlItemElement* currItem = nsnull;
-+    control->GetItemAtIndex(index, &currItem);
-+    nsIDOMNode* currNode(do_QueryInterface(currItem));
- 
--    nsCOMPtr<nsIAccessible> itemAcc;
-+    nsIAccessible* itemAcc = nsnull;
-     nsAccessNode::GetAccService()->GetAccessibleFor(currNode,
--                                                    getter_AddRefs(itemAcc));
-+                                                    &itemAcc);
-     if (!itemAcc ||
-         nsAccessible::State(itemAcc) & nsIAccessibleStates::STATE_INVISIBLE) {
-       setSize--;
-@@ -209,12 +209,12 @@ nsAccUtils::SetAccAttrsForXULContainerIt
- nsAccUtils::SetAccAttrsForXULContainerItem(nsIDOMNode *aNode,
-                                            nsIPersistentProperties *aAttributes)
- {
--  nsCOMPtr<nsIDOMXULContainerItemElement> item(do_QueryInterface(aNode));
-+  nsIDOMXULContainerItemElement* item(do_QueryInterface(aNode));
-   if (!item)
-     return;
- 
--  nsCOMPtr<nsIDOMXULContainerElement> container;
--  item->GetParentContainer(getter_AddRefs(container));
-+  nsIDOMXULContainerElement* container = nsnull;
-+  item->GetParentContainer(&container);
-   if (!container)
-     return;
- 
-@@ -229,12 +229,12 @@ nsAccUtils::SetAccAttrsForXULContainerIt
-   // Calculate set size and position in the set.
-   PRUint32 setSize = 0, posInSet = 0;
-   for (PRInt32 index = indexOf; index >= 0; index--) {
--    nsCOMPtr<nsIDOMXULElement> item;
--    container->GetItemAtIndex(index, getter_AddRefs(item));
-+    nsIDOMXULElement* item = nsnull;
-+    container->GetItemAtIndex(index, &item);
- 
--    nsCOMPtr<nsIAccessible> itemAcc;
-+    nsIAccessible* itemAcc = nsnull;
-     nsAccessNode::GetAccService()->GetAccessibleFor(item,
--                                                    getter_AddRefs(itemAcc));
-+                                                    &itemAcc);
- 
-     if (itemAcc) {
-       PRUint32 itemRole = nsAccessible::Role(itemAcc);
-@@ -250,12 +250,12 @@ nsAccUtils::SetAccAttrsForXULContainerIt
-   }
- 
-   for (PRInt32 index = indexOf + 1; index < itemsCount; index++) {
--    nsCOMPtr<nsIDOMXULElement> item;
--    container->GetItemAtIndex(index, getter_AddRefs(item));
-+    nsIDOMXULElement* item = nsnull;
-+    container->GetItemAtIndex(index, &item);
-     
--    nsCOMPtr<nsIAccessible> itemAcc;
-+    nsIAccessible* itemAcc = nsnull;
-     nsAccessNode::GetAccService()->GetAccessibleFor(item,
--                                                    getter_AddRefs(itemAcc));
-+                                                    &itemAcc);
- 
-     if (itemAcc) {
-       PRUint32 itemRole = nsAccessible::Role(itemAcc);
-@@ -273,9 +273,9 @@ nsAccUtils::SetAccAttrsForXULContainerIt
-   while (container) {
-     level++;
- 
--    nsCOMPtr<nsIDOMXULContainerElement> parentContainer;
--    container->GetParentContainer(getter_AddRefs(parentContainer));
--    parentContainer.swap(container);
-+    nsIDOMXULContainerElement* parentContainer = nsnull;
-+    container->GetParentContainer(&parentContainer);
-+    swap(parentContainer, container);
-   }
-   
-   SetAccGroupAttrs(aAttributes, level, posInSet, setSize);
-@@ -285,8 +285,8 @@ nsAccUtils::HasListener(nsIContent *aCon
- nsAccUtils::HasListener(nsIContent *aContent, const nsAString& aEventType)
- {
-   NS_ENSURE_TRUE(aContent, PR_FALSE);
--  nsCOMPtr<nsIEventListenerManager> listenerManager;
--  aContent->GetListenerManager(PR_FALSE, getter_AddRefs(listenerManager));
-+  nsIEventListenerManager* listenerManager = nsnull;
-+  aContent->GetListenerManager(PR_FALSE, &listenerManager);
- 
-   return listenerManager && listenerManager->HasListenersFor(aEventType);  
- }
-@@ -303,11 +303,11 @@ nsAccUtils::GetAccessKeyFor(nsIContent *
-   if (!aContent->HasAttr(kNameSpaceID_None, nsAccessibilityAtoms::accesskey))
-     return 0;
- 
--  nsCOMPtr<nsIDocument> doc = aContent->GetOwnerDoc();
-+  nsIDocument* doc = aContent->GetOwnerDoc();
-   if (!doc)
-     return 0;
- 
--  nsCOMPtr<nsIPresShell> presShell = doc->GetPrimaryShell();
-+  nsIPresShell* presShell = doc->GetPrimaryShell();
-   if (!presShell)
-     return 0;
- 
-@@ -330,10 +330,10 @@ nsAccUtils::FireAccEvent(PRUint32 aEvent
- {
-   NS_ENSURE_ARG(aAccessible);
- 
--  nsCOMPtr<nsPIAccessible> pAccessible(do_QueryInterface(aAccessible));
-+  nsPIAccessible* pAccessible(do_QueryInterface(aAccessible));
-   NS_ASSERTION(pAccessible, "Accessible doesn't implement nsPIAccessible");
- 
--  nsCOMPtr<nsIAccessibleEvent> event =
-+  nsIAccessibleEvent* event =
-     new nsAccEvent(aEventType, aAccessible, aIsAsynch);
-   NS_ENSURE_TRUE(event, NS_ERROR_OUT_OF_MEMORY);
- 
-@@ -346,14 +346,14 @@ nsAccUtils::IsAncestorOf(nsIDOMNode *aPo
- {
-   NS_ENSURE_TRUE(aPossibleAncestorNode && aPossibleDescendantNode, PR_FALSE);
- 
--  nsCOMPtr<nsIDOMNode> loopNode = aPossibleDescendantNode;
--  nsCOMPtr<nsIDOMNode> parentNode;
--  while (NS_SUCCEEDED(loopNode->GetParentNode(getter_AddRefs(parentNode))) &&
-+  nsIDOMNode* loopNode = aPossibleDescendantNode;
-+  nsIDOMNode* parentNode = nsnull;
-+  while (NS_SUCCEEDED(loopNode->GetParentNode(&parentNode)) &&
-          parentNode) {
-     if (parentNode == aPossibleAncestorNode) {
-       return PR_TRUE;
-     }
--    loopNode.swap(parentNode);
-+    swap(loopNode, parentNode);
-   }
-   return PR_FALSE;
- }
-@@ -364,20 +364,20 @@ nsAccUtils::AreSiblings(nsIDOMNode *aDOM
- {
-   NS_ENSURE_TRUE(aDOMNode1 && aDOMNode2, PR_FALSE);
- 
--  nsCOMPtr<nsIDOMNode> parentNode1, parentNode2;
--  if (NS_SUCCEEDED(aDOMNode1->GetParentNode(getter_AddRefs(parentNode1))) &&
--      NS_SUCCEEDED(aDOMNode2->GetParentNode(getter_AddRefs(parentNode2))) &&
-+  nsIDOMNode* parentNode1 = nsnull, *parentNode2 = nsnull;
-+  if (NS_SUCCEEDED(aDOMNode1->GetParentNode(&parentNode1)) &&
-+      NS_SUCCEEDED(aDOMNode2->GetParentNode(&parentNode2)) &&
-       parentNode1 == parentNode2) {
-     return PR_TRUE;
-   }
-   return PR_FALSE;
- }
- 
--already_AddRefed<nsIAccessible>
-+nsIAccessible*
- nsAccUtils::GetAncestorWithRole(nsIAccessible *aDescendant, PRUint32 aRole)
- {
--  nsCOMPtr<nsIAccessible> parentAccessible = aDescendant, testRoleAccessible;
--  while (NS_SUCCEEDED(parentAccessible->GetParent(getter_AddRefs(testRoleAccessible))) &&
-+  nsIAccessible* parentAccessible = aDescendant, *testRoleAccessible = nsnull;
-+  while (NS_SUCCEEDED(parentAccessible->GetParent(&testRoleAccessible)) &&
-          testRoleAccessible) {
-     PRUint32 testRole;
-     testRoleAccessible->GetFinalRole(&testRole);
-@@ -386,11 +386,11 @@ nsAccUtils::GetAncestorWithRole(nsIAcces
-       NS_ADDREF(returnAccessible);
-       return returnAccessible;
-     }
--    nsCOMPtr<nsIAccessibleDocument> docAccessible = do_QueryInterface(testRoleAccessible);
-+    nsIAccessibleDocument* docAccessible = do_QueryInterface(testRoleAccessible);
-     if (docAccessible) {
-       break;
-     }
--    parentAccessible.swap(testRoleAccessible);
-+    swap(parentAccessible, testRoleAccessible);
-   }
-   return nsnull;
- }
-@@ -408,11 +408,11 @@ nsAccUtils::GetARIATreeItemParent(nsIAcc
-     PRInt32 success;
-     level = levelStr.ToInteger(&success);
-     if (level > 1 && NS_SUCCEEDED(success)) {
--      nsCOMPtr<nsIAccessible> currentAccessible = aStartTreeItem, prevAccessible;
-+      nsIAccessible* currentAccessible = aStartTreeItem, *prevAccessible = nsnull;
-       while (PR_TRUE) {
--        currentAccessible->GetPreviousSibling(getter_AddRefs(prevAccessible));
--        currentAccessible.swap(prevAccessible);
--        nsCOMPtr<nsIAccessNode> accessNode = do_QueryInterface(currentAccessible);
-+        currentAccessible->GetPreviousSibling(&prevAccessible);
-+        swap(currentAccessible, prevAccessible);
-+        nsIAccessNode* accessNode = do_QueryInterface(currentAccessible);
-         if (!accessNode) {
-           break; // Reached top of tree, no higher level found
-         }
-@@ -420,9 +420,9 @@ nsAccUtils::GetARIATreeItemParent(nsIAcc
-         currentAccessible->GetFinalRole(&role);
-         if (role != nsIAccessibleRole::ROLE_OUTLINEITEM)
-           continue;
--        nsCOMPtr<nsIDOMNode> treeItemNode;
--        accessNode->GetDOMNode(getter_AddRefs(treeItemNode));
--        nsCOMPtr<nsIContent> treeItemContent = do_QueryInterface(treeItemNode);
-+        nsIDOMNode* treeItemNode = nsnull;
-+        accessNode->GetDOMNode(&treeItemNode);
-+        nsIContent* treeItemContent = do_QueryInterface(treeItemNode);
-         if (treeItemContent &&
-             treeItemContent->GetAttr(kNameSpaceID_None,
-                                      nsAccessibilityAtoms::aria_level, levelStr)) {
-@@ -439,8 +439,8 @@ nsAccUtils::GetARIATreeItemParent(nsIAcc
-   // In this case the parent of the tree item will be a group and the
-   // previous sibling of that should be the tree item parent.
-   // Or, if the parent is something other than a tree we will return that.
--  nsCOMPtr<nsIAccessible> parentAccessible;
--  aStartTreeItem->GetParent(getter_AddRefs(parentAccessible));
-+  nsIAccessible* parentAccessible = nsnull;
-+  aStartTreeItem->GetParent(&parentAccessible);
-   if (!parentAccessible)
-     return;
-   PRUint32 role;
-@@ -449,8 +449,8 @@ nsAccUtils::GetARIATreeItemParent(nsIAcc
-     NS_ADDREF(*aTreeItemParentResult = parentAccessible);
-     return; // The container for the tree items
-   }
--  nsCOMPtr<nsIAccessible> prevAccessible;
--  parentAccessible->GetPreviousSibling(getter_AddRefs(prevAccessible));
-+  nsIAccessible* prevAccessible = nsnull;
-+  parentAccessible->GetPreviousSibling(&prevAccessible);
-   if (!prevAccessible)
-     return;
-   prevAccessible->GetFinalRole(&role);
-@@ -458,8 +458,8 @@ nsAccUtils::GetARIATreeItemParent(nsIAcc
-     // XXX Sometimes an empty text accessible is in the hierarchy here,
-     // although the text does not appear to be rendered, GetRenderedText() says that it is
-     // so we need to skip past it to find the true previous sibling
--    nsCOMPtr<nsIAccessible> tempAccessible = prevAccessible;
--    tempAccessible->GetPreviousSibling(getter_AddRefs(prevAccessible));
-+    nsIAccessible* tempAccessible = prevAccessible;
-+    tempAccessible->GetPreviousSibling(&prevAccessible);
-     if (!prevAccessible)
-       return;
-     prevAccessible->GetFinalRole(&role);
-@@ -494,21 +494,21 @@ nsAccUtils::ScrollSubstringTo(nsIFrame *
- 
-   nsPresContext *presContext = aFrame->PresContext();
- 
--  nsCOMPtr<nsIDOMRange> scrollToRange = do_CreateInstance(kRangeCID);
-+  nsIDOMRange* scrollToRange = do_CreateInstance(kRangeCID);
-   NS_ENSURE_TRUE(scrollToRange, NS_ERROR_FAILURE);
- 
--  nsCOMPtr<nsISelectionController> selCon;
--  aFrame->GetSelectionController(presContext, getter_AddRefs(selCon));
-+  nsISelectionController* selCon = nsnull;
-+  aFrame->GetSelectionController(presContext, &selCon);
-   NS_ENSURE_TRUE(selCon, NS_ERROR_FAILURE);
- 
-   scrollToRange->SetStart(aStartNode, aStartIndex);
-   scrollToRange->SetEnd(aEndNode, aEndIndex);
- 
--  nsCOMPtr<nsISelection> selection1;
-+  nsISelection* selection1 = nsnull;
-   selCon->GetSelection(nsISelectionController::SELECTION_ACCESSIBILITY,
--                       getter_AddRefs(selection1));
-+                       &selection1);
- 
--  nsCOMPtr<nsISelection2> selection(do_QueryInterface(selection1));
-+  nsISelection2* selection(do_QueryInterface(selection1));
-   if (selection) {
-     selection->RemoveAllRanges();
-     selection->AddRange(scrollToRange);
-@@ -658,20 +658,20 @@ nsAccUtils::GetScreenCoordsForWindow(nsI
- nsAccUtils::GetScreenCoordsForWindow(nsIDOMNode *aNode)
- {
-   nsIntPoint coords(0, 0);
--  nsCOMPtr<nsIDocShellTreeItem> treeItem(GetDocShellTreeItemFor(aNode));
-+  nsIDocShellTreeItem* treeItem(GetDocShellTreeItemFor(aNode));
-   if (!treeItem)
-     return coords;
- 
--  nsCOMPtr<nsIDocShellTreeItem> rootTreeItem;
--  treeItem->GetRootTreeItem(getter_AddRefs(rootTreeItem));
--  nsCOMPtr<nsIDOMDocument> domDoc = do_GetInterface(rootTreeItem);
--  nsCOMPtr<nsIDOMDocumentView> docView(do_QueryInterface(domDoc));
-+  nsIDocShellTreeItem* rootTreeItem = nsnull;
-+  treeItem->GetRootTreeItem(&rootTreeItem);
-+  nsIDOMDocument* domDoc = do_GetInterface(rootTreeItem);
-+  nsIDOMDocumentView* docView(do_QueryInterface(domDoc));
-   if (!docView)
-     return coords;
- 
--  nsCOMPtr<nsIDOMAbstractView> abstractView;
--  docView->GetDefaultView(getter_AddRefs(abstractView));
--  nsCOMPtr<nsIDOMWindowInternal> windowInter(do_QueryInterface(abstractView));
-+  nsIDOMAbstractView* abstractView = nsnull;
-+  docView->GetDefaultView(&abstractView);
-+  nsIDOMWindowInternal* windowInter(do_QueryInterface(abstractView));
-   if (!windowInter)
-     return coords;
- 
-@@ -683,8 +683,8 @@ nsIntPoint
- nsIntPoint
- nsAccUtils::GetScreenCoordsForWindow(nsIAccessNode *aAccessNode)
- {
--  nsCOMPtr<nsIDOMNode> DOMNode;
--  aAccessNode->GetDOMNode(getter_AddRefs(DOMNode));
-+  nsIDOMNode* DOMNode = nsnull;
-+  aAccessNode->GetDOMNode(&DOMNode);
-   if (DOMNode)
-     return GetScreenCoordsForWindow(DOMNode);
- 
-@@ -694,15 +694,15 @@ nsIntPoint
- nsIntPoint
- nsAccUtils::GetScreenCoordsForParent(nsIAccessNode *aAccessNode)
- {
--  nsCOMPtr<nsPIAccessNode> parent;
--  nsCOMPtr<nsIAccessible> accessible(do_QueryInterface(aAccessNode));
-+  nsPIAccessNode* parent = nsnull;
-+  nsIAccessible* accessible(do_QueryInterface(aAccessNode));
-   if (accessible) {
--    nsCOMPtr<nsIAccessible> parentAccessible;
--    accessible->GetParent(getter_AddRefs(parentAccessible));
-+    nsIAccessible* parentAccessible = nsnull;
-+    accessible->GetParent(&parentAccessible);
-     parent = do_QueryInterface(parentAccessible);
-   } else {
--    nsCOMPtr<nsIAccessNode> parentAccessNode;
--    aAccessNode->GetParentNode(getter_AddRefs(parentAccessNode));
-+    nsIAccessNode* parentAccessNode = nsnull;
-+    aAccessNode->GetParentNode(&parentAccessNode);
-     parent = do_QueryInterface(parentAccessNode);
-   }
- 
-@@ -717,22 +717,22 @@ nsAccUtils::GetScreenCoordsForParent(nsI
-   return nsIntPoint(parentRect.x, parentRect.y);
- }
- 
--already_AddRefed<nsIDocShellTreeItem>
-+nsIDocShellTreeItem*
- nsAccUtils::GetDocShellTreeItemFor(nsIDOMNode *aNode)
- {
-   if (!aNode)
-     return nsnull;
- 
--  nsCOMPtr<nsIDOMDocument> domDoc;
--  aNode->GetOwnerDocument(getter_AddRefs(domDoc));
--  nsCOMPtr<nsIDocument> doc(do_QueryInterface(domDoc));
-+  nsIDOMDocument* domDoc = nsnull;
-+  aNode->GetOwnerDocument(&domDoc);
-+  nsIDocument* doc(do_QueryInterface(domDoc));
-   if (!doc)
-     doc = do_QueryInterface(aNode);
- 
-   NS_ASSERTION(doc, "No document for node passed in");
-   NS_ENSURE_TRUE(doc, nsnull);
- 
--  nsCOMPtr<nsISupports> container = doc->GetContainer();
-+  nsISupports* container = doc->GetContainer();
-   nsIDocShellTreeItem *docShellTreeItem = nsnull;
-   if (container)
-     CallQueryInterface(container, &docShellTreeItem);
-@@ -774,7 +774,7 @@ nsAccUtils::FindNeighbourPointingToNode(
-                                         nsIAtom *aTagName,
-                                         PRUint32 aAncestorLevelsToSearch)
- {
--  nsCOMPtr<nsIContent> binding;
-+  nsIContent* binding = nsnull;
-   nsAutoString controlID;
-   if (!nsAccUtils::GetID(aForNode, controlID)) {
-     binding = aForNode->GetBindingParent();
-@@ -797,14 +797,14 @@ nsAccUtils::FindNeighbourPointingToNode(
-     if (aForNode == binding) {
-       // When we reach the binding parent, make sure to check
-       // all of its anonymous child subtrees
--      nsCOMPtr<nsIDocument> doc = aForNode->GetCurrentDoc();
--      nsCOMPtr<nsIDOMDocumentXBL> xblDoc(do_QueryInterface(doc));
-+      nsIDocument* doc = aForNode->GetCurrentDoc();
-+      nsIDOMDocumentXBL* xblDoc(do_QueryInterface(doc));
-       if (!xblDoc)
-         return nsnull;
- 
--      nsCOMPtr<nsIDOMNodeList> nodes;
--      nsCOMPtr<nsIDOMElement> forElm(do_QueryInterface(aForNode));
--      xblDoc->GetAnonymousNodes(forElm, getter_AddRefs(nodes));
-+      nsIDOMNodeList* nodes = nsnull;
-+      nsIDOMElement* forElm(do_QueryInterface(aForNode));
-+      xblDoc->GetAnonymousNodes(forElm, &nodes);
-       if (!nodes)
-         return nsnull;
- 
-@@ -814,12 +814,12 @@ nsAccUtils::FindNeighbourPointingToNode(
-         return nsnull;
- 
-       for (PRUint32 index = 0; index < length && !labelContent; index++) {
--        nsCOMPtr<nsIDOMNode> node;
--        rv = nodes->Item(index, getter_AddRefs(node));
-+        nsIDOMNode* node = nsnull;
-+        rv = nodes->Item(index, &node);
-         if (NS_FAILED(rv))
-           return nsnull;
- 
--        nsCOMPtr<nsIContent> content = do_QueryInterface(node);
-+        nsIContent* content = do_QueryInterface(node);
-         if (!content)
-           return nsnull;
- 
-diff --git a/accessible/src/base/nsAccessibilityUtils.h b/accessible/src/base/nsAccessibilityUtils.h
---- a/accessible/src/base/nsAccessibilityUtils.h
-+++ b/accessible/src/base/nsAccessibilityUtils.h
-@@ -161,7 +161,7 @@ public:
-     * @param aRole Role to find matching ancestor for
-     * @return The ancestor accessible with the given role, or nsnull if no match is found
-     */
--   static already_AddRefed<nsIAccessible>
-+   static nsIAccessible*
-      GetAncestorWithRole(nsIAccessible *aDescendant, PRUint32 aRole);
- 
-    /**
-@@ -283,7 +283,7 @@ public:
-   /**
-    * Return document shell tree item for the given DOM node.
-    */
--  static already_AddRefed<nsIDocShellTreeItem>
-+  static nsIDocShellTreeItem*
-     GetDocShellTreeItemFor(nsIDOMNode *aNode);
- 
-   /**
-diff --git a/accessible/src/base/nsAccessible.cpp b/accessible/src/base/nsAccessible.cpp
---- a/accessible/src/base/nsAccessible.cpp
-+++ b/accessible/src/base/nsAccessible.cpp
-@@ -202,7 +202,7 @@ nsresult nsAccessible::QueryInterface(RE
-   }
- 
-   if (aIID.Equals(NS_GET_IID(nsIAccessibleSelectable))) {
--    nsCOMPtr<nsIContent> content(do_QueryInterface(mDOMNode));
-+    nsIContent* content(do_QueryInterface(mDOMNode));
-     if (!content) {
-       return NS_ERROR_FAILURE; // This accessible has been shut down
-     }
-@@ -231,8 +231,8 @@ nsresult nsAccessible::QueryInterface(RE
-   }                       
- 
-   if (aIID.Equals(NS_GET_IID(nsIAccessibleHyperLink))) {
--    nsCOMPtr<nsIAccessible> parent(GetParent());
--    nsCOMPtr<nsIAccessibleHyperText> hyperTextParent(do_QueryInterface(parent));
-+    nsIAccessible* parent(GetParent());
-+    nsIAccessibleHyperText* hyperTextParent(do_QueryInterface(parent));
-     if (hyperTextParent) {
-       *aInstancePtr = static_cast<nsIAccessibleHyperLink*>(this);
-       NS_ADDREF_THIS();
-@@ -285,7 +285,7 @@ NS_IMETHODIMP nsAccessible::GetName(nsAS
- NS_IMETHODIMP nsAccessible::GetName(nsAString& aName)
- {
-   aName.Truncate();
--  nsCOMPtr<nsIContent> content(do_QueryInterface(mDOMNode));
-+  nsIContent* content(do_QueryInterface(mDOMNode));
-   if (!content) {
-     return NS_ERROR_FAILURE;  // Node shut down
-   }
-@@ -311,7 +311,7 @@ NS_IMETHODIMP nsAccessible::GetDescripti
-   // 2. It has no DHTML describedby property
-   // 3. it doesn't have an accName; or
-   // 4. its title attribute already equals to its accName nsAutoString name; 
--  nsCOMPtr<nsIContent> content(do_QueryInterface(mDOMNode));
-+  nsIContent* content(do_QueryInterface(mDOMNode));
-   if (!content) {
-     return NS_ERROR_FAILURE;  // Node shut down
-   }
-@@ -363,7 +363,7 @@ static PRInt32
- static PRInt32
- GetAccessModifierMask(nsIContent* aContent)
- {
--  nsCOMPtr<nsIPrefBranch> prefBranch =
-+  nsIPrefBranch* prefBranch =
-     do_GetService(NS_PREFSERVICE_CONTRACTID);
-   if (!prefBranch)
-     return 0;
-@@ -382,13 +382,13 @@ GetAccessModifierMask(nsIContent* aConte
-   }
- 
-   // get the docShell to this DOMNode, return 0 on failure
--  nsCOMPtr<nsIDocument> document = aContent->GetCurrentDoc();
-+  nsIDocument* document = aContent->GetCurrentDoc();
-   if (!document)
-     return 0;
--  nsCOMPtr<nsISupports> container = document->GetContainer();
-+  nsISupports* container = document->GetContainer();
-   if (!container)
-     return 0;
--  nsCOMPtr<nsIDocShellTreeItem> treeItem(do_QueryInterface(container));
-+  nsIDocShellTreeItem* treeItem(do_QueryInterface(container));
-   if (!treeItem)
-     return 0;
- 
-@@ -414,7 +414,7 @@ nsAccessible::GetKeyboardShortcut(nsAStr
- {
-   aAccessKey.Truncate();
- 
--  nsCOMPtr<nsIContent> content(do_QueryInterface(mDOMNode));
-+  nsIContent* content(do_QueryInterface(mDOMNode));
-   if (!content)
-     return NS_ERROR_FAILURE;
- 
-@@ -422,8 +422,8 @@ nsAccessible::GetKeyboardShortcut(nsAStr
-   if (!key && content->IsNodeOfType(nsIContent::eELEMENT)) {
-     // Copy access key from label node unless it is labeled
-     // via an ancestor <label>, in which case that would be redundant
--    nsCOMPtr<nsIContent> labelContent(GetLabelContent(content));
--    nsCOMPtr<nsIDOMNode> labelNode = do_QueryInterface(labelContent);
-+    nsIContent* labelContent(GetLabelContent(content));
-+    nsIDOMNode* labelNode = do_QueryInterface(labelContent);
-     if (labelNode && !nsAccUtils::IsAncestorOf(labelNode, mDOMNode))
-       key = nsAccUtils::GetAccessKeyFor(labelContent);
-   }
-@@ -464,7 +464,7 @@ NS_IMETHODIMP nsAccessible::SetParent(ns
-     // may be a dom node which wasn't previously accessible but now is.
-     // The old parent's children now need to be invalidated, since 
-     // it no longer owns the child, the new parent does
--    nsCOMPtr<nsPIAccessible> privOldParent = do_QueryInterface(mParent);
-+    nsPIAccessible* privOldParent = do_QueryInterface(mParent);
-     if (privOldParent) {
-       privOldParent->InvalidateChildren();
-     }
-@@ -494,19 +494,19 @@ nsIContent *nsAccessible::GetRoleContent
-   // For non-document accessibles, this is the associated content node.
-   // For doc accessibles, use the <body>/<frameset> if it's HTML.
-   // For any other doc accessible , this is the document element.
--  nsCOMPtr<nsIContent> content(do_QueryInterface(aDOMNode));
-+  nsIContent* content(do_QueryInterface(aDOMNode));
-   if (!content) {
--    nsCOMPtr<nsIDOMDocument> domDoc(do_QueryInterface(aDOMNode));
-+    nsIDOMDocument* domDoc(do_QueryInterface(aDOMNode));
-     if (domDoc) {
--      nsCOMPtr<nsIDOMHTMLDocument> htmlDoc(do_QueryInterface(aDOMNode));
-+      nsIDOMHTMLDocument* htmlDoc(do_QueryInterface(aDOMNode));
-       if (htmlDoc) {
--        nsCOMPtr<nsIDOMHTMLElement> bodyElement;
--        htmlDoc->GetBody(getter_AddRefs(bodyElement));
-+        nsIDOMHTMLElement* bodyElement = nsnull;
-+        htmlDoc->GetBody(&bodyElement);
-         content = do_QueryInterface(bodyElement);
-       }
-       else {
--        nsCOMPtr<nsIDOMElement> docElement;
--        domDoc->GetDocumentElement(getter_AddRefs(docElement));
-+        nsIDOMElement* docElement = nsnull;
-+        domDoc->GetDocumentElement(&docElement);
-         content = do_QueryInterface(docElement);
-       }
-     }
-@@ -522,7 +522,7 @@ NS_IMETHODIMP nsAccessible::Shutdown()
-   // sure none of it's children point to this parent
-   InvalidateChildren();
-   if (mParent) {
--    nsCOMPtr<nsPIAccessible> privateParent(do_QueryInterface(mParent));
-+    nsPIAccessible* privateParent(do_QueryInterface(mParent));
-     privateParent->InvalidateChildren();
-     mParent = nsnull;
-   }
-@@ -561,7 +561,7 @@ NS_IMETHODIMP nsAccessible::GetParent(ns
-     return rv;
-   }
- 
--  nsCOMPtr<nsIAccessibleDocument> docAccessible(GetDocAccessible());
-+  nsIAccessibleDocument* docAccessible(GetDocAccessible());
-   NS_ENSURE_TRUE(docAccessible, NS_ERROR_FAILURE);
- 
-   return docAccessible->GetAccessibleInParentChain(mDOMNode, PR_TRUE, aParent);
-@@ -598,7 +598,7 @@ NS_IMETHODIMP nsAccessible::GetNextSibli
-     return NS_ERROR_FAILURE;
-   }
-   if (!mParent) {
--    nsCOMPtr<nsIAccessible> parent(GetParent());
-+    nsIAccessible* parent(GetParent());
-     if (parent) {
-       PRInt32 numChildren;
-       parent->GetChildCount(&numChildren);  // Make sure we cache all of the children
-@@ -627,16 +627,16 @@ NS_IMETHODIMP nsAccessible::GetPreviousS
-     return NS_ERROR_FAILURE;
-   }
- 
--  nsCOMPtr<nsIAccessible> parent;
--  if (NS_FAILED(GetParent(getter_AddRefs(parent))) || !parent) {
-+  nsIAccessible* parent = nsnull;
-+  if (NS_FAILED(GetParent(&parent)) || !parent) {
-     return NS_ERROR_FAILURE;
-   }
- 
--  nsCOMPtr<nsIAccessible> testAccessible, prevSibling;
--  parent->GetFirstChild(getter_AddRefs(testAccessible));
-+  nsIAccessible* testAccessible = nsnull, *prevSibling = nsnull;
-+  parent->GetFirstChild(&testAccessible);
-   while (testAccessible && this != testAccessible) {
-     prevSibling = testAccessible;
--    prevSibling->GetNextSibling(getter_AddRefs(testAccessible));
-+    prevSibling->GetNextSibling(&testAccessible);
-   }
- 
-   if (!prevSibling) {
-@@ -657,10 +657,10 @@ NS_IMETHODIMP nsAccessible::GetFirstChil
-   GetChildCount(&numChildren);  // Make sure we cache all of the children
- 
- #ifdef DEBUG
--  nsCOMPtr<nsPIAccessible> firstChild(do_QueryInterface(mFirstChild));
-+  nsPIAccessible* firstChild(do_QueryInterface(mFirstChild));
-   if (firstChild) {
--    nsCOMPtr<nsIAccessible> realParent;
--    firstChild->GetCachedParent(getter_AddRefs(realParent));
-+    nsIAccessible* realParent = nsnull;
-+    firstChild->GetCachedParent(&realParent);
-     NS_ASSERTION(!realParent || realParent == this,
-                  "Two accessibles have the same first child accessible.");
-   }
-@@ -694,7 +694,7 @@ NS_IMETHODIMP nsAccessible::GetChildAt(P
-     aChildNum = numChildren - 1;
-   }
- 
--  nsCOMPtr<nsIAccessible> current(mFirstChild), nextSibling;
-+  nsIAccessible* current(mFirstChild), *nextSibling = nsnull;
-   PRInt32 index = 0;
- 
-   while (current) {
-@@ -702,7 +702,7 @@ NS_IMETHODIMP nsAccessible::GetChildAt(P
-     if (++index > aChildNum) {
-       break;
-     }
--    nextSibling->GetNextSibling(getter_AddRefs(current));
-+    nextSibling->GetNextSibling(&current);
-   }
- 
-   NS_IF_ADDREF(*aChild = nextSibling);
-@@ -714,11 +714,11 @@ NS_IMETHODIMP nsAccessible::GetChildren(
- NS_IMETHODIMP nsAccessible::GetChildren(nsIArray **aOutChildren)
- {
-   *aOutChildren = nsnull;
--  nsCOMPtr<nsIMutableArray> children = do_CreateInstance(NS_ARRAY_CONTRACTID);
-+  nsIMutableArray* children = do_CreateInstance(NS_ARRAY_CONTRACTID);
-   if (!children)
-     return NS_ERROR_FAILURE;
- 
--  nsCOMPtr<nsIAccessible> curChild;
-+  nsIAccessible* curChild = nsnull;
-   while (NextChild(curChild)) {
-     children->AppendElement(curChild, PR_FALSE);
-   }
-@@ -727,14 +727,14 @@ NS_IMETHODIMP nsAccessible::GetChildren(
-   return NS_OK;
- }
- 
--nsIAccessible *nsAccessible::NextChild(nsCOMPtr<nsIAccessible>& aAccessible)
-+nsIAccessible *nsAccessible::NextChild(nsIAccessible*& aAccessible)
- {
--  nsCOMPtr<nsIAccessible> nextChild;
-+  nsIAccessible* nextChild = nsnull;
-   if (!aAccessible) {
--    GetFirstChild(getter_AddRefs(nextChild));
-+    GetFirstChild(&nextChild);
-   }
-   else {
--    aAccessible->GetNextSibling(getter_AddRefs(nextChild));
-+    aAccessible->GetNextSibling(&nextChild);
-   }
-   return (aAccessible = nextChild);
- }
-@@ -757,7 +757,7 @@ void nsAccessible::CacheChildren()
-     // a text node, because text nodes aren't in the frame map.
-     walker.mState.frame = GetFrame();
- 
--    nsCOMPtr<nsPIAccessible> privatePrevAccessible;
-+    nsPIAccessible* privatePrevAccessible = nsnull;
-     PRInt32 childCount = 0;
-     walker.GetFirstChild();
-     SetFirstChild(walker.mState.accessible);
-@@ -795,14 +795,14 @@ NS_IMETHODIMP nsAccessible::GetIndexInPa
-     return NS_ERROR_FAILURE;
-   }
- 
--  nsCOMPtr<nsIAccessible> parent;
--  GetParent(getter_AddRefs(parent));
-+  nsIAccessible* parent = nsnull;
-+  GetParent(&parent);
-   if (!parent) {
-     return NS_ERROR_FAILURE;
-   }
- 
--  nsCOMPtr<nsIAccessible> sibling;
--  parent->GetFirstChild(getter_AddRefs(sibling));
-+  nsIAccessible* sibling = nsnull;
-+  parent->GetFirstChild(&sibling);
-   if (!sibling) {
-     return NS_ERROR_FAILURE;
-   }
-@@ -815,8 +815,8 @@ NS_IMETHODIMP nsAccessible::GetIndexInPa
-       return NS_ERROR_FAILURE;
- 
-     ++*aIndexInParent;
--    nsCOMPtr<nsIAccessible> tempAccessible;
--    sibling->GetNextSibling(getter_AddRefs(tempAccessible));
-+    nsIAccessible* tempAccessible = nsnull;
-+    sibling->GetNextSibling(&tempAccessible);
-     sibling = tempAccessible;
-   }
- 
-@@ -891,7 +891,7 @@ PRBool nsAccessible::IsVisible(PRBool *a
- 
-   const PRUint16 kMinPixels  = 12;
-    // Set up the variables we need, return false if we can't get at them all
--  nsCOMPtr<nsIPresShell> shell(GetPresShell());
-+  nsIPresShell* shell(GetPresShell());
-   if (!shell) 
-     return PR_FALSE;
- 
-@@ -976,9 +976,9 @@ PRBool nsAccessible::IsVisible(PRBool *a
-   // nsRectVisibility_kLeftOfViewport, 
-   // nsRectVisibility_kRightOfViewport
-   // This view says it is visible, but we need to check the parent view chain :(
--  nsCOMPtr<nsIDOMDocument> domDoc;
--  mDOMNode->GetOwnerDocument(getter_AddRefs(domDoc));
--  nsCOMPtr<nsIDocument> doc(do_QueryInterface(domDoc));
-+  nsIDOMDocument* domDoc = nsnull;
-+  mDOMNode->GetOwnerDocument(&domDoc);
-+  nsIDocument* doc(do_QueryInterface(domDoc));
-   if (!doc)  {
-     return PR_FALSE;
-   }
-@@ -1005,7 +1005,7 @@ nsAccessible::GetState(PRUint32 *aState,
-   if (aExtraState)
-     *aExtraState = 0;
- 
--  nsCOMPtr<nsIContent> content(do_QueryInterface(mDOMNode));
-+  nsIContent* content(do_QueryInterface(mDOMNode));
-   if (!content) {
-     return NS_OK;  // On document, this is not an error
-   }
-@@ -1064,20 +1064,20 @@ nsAccessible::GetState(PRUint32 *aState,
-   /* readonly attribute boolean focusedChild; */
- NS_IMETHODIMP nsAccessible::GetFocusedChild(nsIAccessible **aFocusedChild) 
- { 
--  nsCOMPtr<nsIAccessible> focusedChild;
-+  nsIAccessible* focusedChild = nsnull;
-   if (gLastFocusedNode == mDOMNode) {
-     focusedChild = this;
-   }
-   else if (gLastFocusedNode) {
--    nsCOMPtr<nsIAccessibilityService> accService =
-+    nsIAccessibilityService* accService =
-       do_GetService("@mozilla.org/accessibilityService;1");
-     NS_ENSURE_TRUE(accService, NS_ERROR_FAILURE);
- 
-     accService->GetAccessibleFor(gLastFocusedNode,
--                                 getter_AddRefs(focusedChild));
-+                                 &focusedChild);
-     if (focusedChild) {
--      nsCOMPtr<nsIAccessible> focusedParentAccessible;
--      focusedChild->GetParent(getter_AddRefs(focusedParentAccessible));
-+      nsIAccessible* focusedParentAccessible = nsnull;
-+      focusedChild->GetParent(&focusedParentAccessible);
-       if (focusedParentAccessible != this) {
-         focusedChild = nsnull;
-       }
-@@ -1102,7 +1102,7 @@ nsAccessible::GetChildAtPoint(PRInt32 aX
- 
-   // If we can't find the point in a child, we will return the fallback answer:
-   // we return |this| if the point is within it, otherwise nsnull
--  nsCOMPtr<nsIAccessible> fallbackAnswer;
-+  nsIAccessible* fallbackAnswer = nsnull;
-   PRInt32 x, y, width, height;
-   GetBounds(&x, &y, &width, &height);
-   if (aX >= x && aX < x + width &&
-@@ -1120,12 +1120,12 @@ nsAccessible::GetChildAtPoint(PRInt32 aX
-   // therefore accessible for containing block may be different from accessible
-   // for DOM parent but GetFrameForPoint() should be called for containing block
-   // to get an out of flow element.
--  nsCOMPtr<nsIAccessibleDocument> accDocument;
--  nsresult rv = GetAccessibleDocument(getter_AddRefs(accDocument));
-+  nsIAccessibleDocument* accDocument = nsnull;
-+  nsresult rv = GetAccessibleDocument(&accDocument);
-   NS_ENSURE_SUCCESS(rv, rv);
-   NS_ENSURE_TRUE(accDocument, NS_ERROR_FAILURE);
- 
--  nsCOMPtr<nsPIAccessNode> accessNodeDocument(do_QueryInterface(accDocument));
-+  nsPIAccessNode* accessNodeDocument(do_QueryInterface(accDocument));
-   NS_ASSERTION(accessNodeDocument,
-                "nsIAccessibleDocument doesn't implement nsPIAccessNode");
- 
-@@ -1138,31 +1138,31 @@ nsAccessible::GetChildAtPoint(PRInt32 aX
-   nsPoint offset(presContext->DevPixelsToAppUnits(aX - screenRect.x),
-                  presContext->DevPixelsToAppUnits(aY - screenRect.y));
- 
--  nsCOMPtr<nsIPresShell> presShell = presContext->PresShell();
-+  nsIPresShell* presShell = presContext->PresShell();
-   nsIFrame *foundFrame = presShell->GetFrameForPoint(frame, offset);
--  nsCOMPtr<nsIContent> content;
-+  nsIContent* content = nsnull;
-   if (!foundFrame || !(content = foundFrame->GetContent())) {
-     NS_IF_ADDREF(*aAccessible = fallbackAnswer);
-     return NS_OK;
-   }
- 
--  nsCOMPtr<nsIDOMNode> node(do_QueryInterface(content));
--  nsCOMPtr<nsIAccessibilityService> accService = GetAccService();
-+  nsIDOMNode* node(do_QueryInterface(content));
-+  nsIAccessibilityService* accService = GetAccService();
- 
--  nsCOMPtr<nsIDOMNode> relevantNode;
--  accService->GetRelevantContentNodeFor(node, getter_AddRefs(relevantNode));
-+  nsIDOMNode* relevantNode = nsnull;
-+  accService->GetRelevantContentNodeFor(node, &relevantNode);
-   if (!relevantNode) {
-     NS_IF_ADDREF(*aAccessible = fallbackAnswer);
-     return NS_OK;
-   }
- 
--  nsCOMPtr<nsIAccessible> accessible;
--  accService->GetAccessibleFor(relevantNode, getter_AddRefs(accessible));
-+  nsIAccessible* accessible = nsnull;
-+  accService->GetAccessibleFor(relevantNode, &accessible);
-   if (!accessible) {
-     // No accessible for the node with the point, so find the first
-     // accessible in the DOM parent chain
-     accDocument->GetAccessibleInParentChain(relevantNode, PR_TRUE,
--                                            getter_AddRefs(accessible));
-+                                            &accessible);
-     if (!accessible) {
-       NS_IF_ADDREF(*aAccessible = fallbackAnswer);
-       return NS_OK;
-@@ -1174,7 +1174,7 @@ nsAccessible::GetChildAtPoint(PRInt32 aX
-     // the are within this point.
-     // This takes care of cases where layout won't walk into
-     // things for us, such as image map areas and sub documents
--    nsCOMPtr<nsIAccessible> child;
-+    nsIAccessible* child = nsnull;
-     while (NextChild(child)) {
-       PRInt32 childX, childY, childWidth, childHeight;
-       child->GetBounds(&childX, &childY, &childWidth, &childHeight);
-@@ -1190,9 +1190,9 @@ nsAccessible::GetChildAtPoint(PRInt32 aX
-     // We are allowed to return |this| as the answer
-   }
-   else {
--    nsCOMPtr<nsIAccessible> parent;
-+    nsIAccessible* parent = nsnull;
-     while (PR_TRUE) {
--      accessible->GetParent(getter_AddRefs(parent));
-+      accessible->GetParent(&parent);
-       if (!parent) {
-         // Reached the top of the hierarchy
-         // these bounds were inside an accessible that is not a descendant of this one
-@@ -1204,7 +1204,7 @@ nsAccessible::GetChildAtPoint(PRInt32 aX
-         // child we want to return
-         break;
-       }
--      accessible.swap(parent);
-+      swap(accessible, parent);
-     }
-   }
- 
-@@ -1247,7 +1247,7 @@ void nsAccessible::GetBoundsRect(nsRect&
-   }
- 
-   nsIFrame *iterFrame = firstFrame;
--  nsCOMPtr<nsIContent> firstContent(do_QueryInterface(mDOMNode));
-+  nsIContent* firstContent(do_QueryInterface(mDOMNode));
-   nsIContent* iterContent = firstContent;
-   PRInt32 depth = 0;
- 
-@@ -1356,15 +1356,15 @@ nsIFrame* nsAccessible::GetBoundsFrame()
-   return GetFrame();
- }
- 
--already_AddRefed<nsIAccessible>
-+nsIAccessible*
- nsAccessible::GetMultiSelectFor(nsIDOMNode *aNode)
- {
-   NS_ENSURE_TRUE(aNode, nsnull);
--  nsCOMPtr<nsIAccessibilityService> accService =
-+  nsIAccessibilityService* accService =
-     do_GetService("@mozilla.org/accessibilityService;1");
-   NS_ENSURE_TRUE(accService, nsnull);
--  nsCOMPtr<nsIAccessible> accessible;
--  accService->GetAccessibleFor(aNode, getter_AddRefs(accessible));
-+  nsIAccessible* accessible = nsnull;
-+  accService->GetAccessibleFor(aNode, &accessible);
-   if (!accessible) {
-     return nsnull;
-   }
-@@ -1377,7 +1377,7 @@ nsAccessible::GetMultiSelectFor(nsIDOMNo
-   PRUint32 containerRole;
-   while (0 == (state & nsIAccessibleStates::STATE_MULTISELECTABLE)) {
-     nsIAccessible *current = accessible;
--    current->GetParent(getter_AddRefs(accessible));
-+    current->GetParent(&accessible);
-     if (!accessible || (NS_SUCCEEDED(accessible->GetFinalRole(&containerRole)) &&
-                         containerRole == nsIAccessibleRole::ROLE_PANE)) {
-       return nsnull;
-@@ -1385,7 +1385,7 @@ nsAccessible::GetMultiSelectFor(nsIDOMNo
-     state = State(accessible);
-   }
-   nsIAccessible *returnAccessible = nsnull;
--  accessible.swap(returnAccessible);
-+  swap(accessible, returnAccessible);
-   return returnAccessible;
- }
- 
-@@ -1399,11 +1399,11 @@ NS_IMETHODIMP nsAccessible::SetSelected(
- 
-   PRUint32 state = State(this);
-   if (state & nsIAccessibleStates::STATE_SELECTABLE) {
--    nsCOMPtr<nsIAccessible> multiSelect = GetMultiSelectFor(mDOMNode);
-+    nsIAccessible* multiSelect = GetMultiSelectFor(mDOMNode);
-     if (!multiSelect) {
-       return aSelect ? TakeFocus() : NS_ERROR_FAILURE;
-     }
--    nsCOMPtr<nsIContent> content(do_QueryInterface(mDOMNode));
-+    nsIContent* content(do_QueryInterface(mDOMNode));
-     NS_ASSERTION(content, "Called for dead accessible");
- 
-     if (mRoleMapEntry) {
-@@ -1428,9 +1428,9 @@ NS_IMETHODIMP nsAccessible::TakeSelectio
- 
-   PRUint32 state = State(this);
-   if (state & nsIAccessibleStates::STATE_SELECTABLE) {
--    nsCOMPtr<nsIAccessible> multiSelect = GetMultiSelectFor(mDOMNode);
-+    nsIAccessible* multiSelect = GetMultiSelectFor(mDOMNode);
-     if (multiSelect) {
--      nsCOMPtr<nsIAccessibleSelectable> selectable = do_QueryInterface(multiSelect);
-+      nsIAccessibleSelectable* selectable = do_QueryInterface(multiSelect);
-       selectable->ClearSelection();
-     }
-     return SetSelected(PR_TRUE);
-@@ -1446,7 +1446,7 @@ nsAccessible::TakeFocus()
-   if (IsDefunct())
-     return NS_ERROR_FAILURE;
- 
--  nsCOMPtr<nsIContent> content(do_QueryInterface(mDOMNode));
-+  nsIContent* content(do_QueryInterface(mDOMNode));
- 
-   nsIFrame *frame = GetFrame();
-   NS_ENSURE_STATE(frame);
-@@ -1459,13 +1459,13 @@ nsAccessible::TakeFocus()
-     nsAutoString id;
-     if (content && nsAccUtils::GetID(content, id)) {
- 
--      nsCOMPtr<nsIContent> ancestorContent = content;
-+      nsIContent* ancestorContent = content;
-       while ((ancestorContent = ancestorContent->GetParent()) &&
-              !ancestorContent->HasAttr(kNameSpaceID_None,
-                                        nsAccessibilityAtoms::aria_activedescendant));
- 
-       if (ancestorContent) {
--        nsCOMPtr<nsIPresShell> presShell(do_QueryReferent(mWeakShell));
-+        nsIPresShell* presShell(do_QueryReferent(mWeakShell));
-         if (presShell) {
-           nsIFrame *frame = presShell->GetPrimaryFrameFor(ancestorContent);
-           if (frame && frame->IsFocusable()) {
-@@ -1480,7 +1480,7 @@ nsAccessible::TakeFocus()
-     }
-   }
- 
--  nsCOMPtr<nsIDOMNSHTMLElement> htmlElement(do_QueryInterface(content));
-+  nsIDOMNSHTMLElement* htmlElement(do_QueryInterface(content));
-   if (htmlElement) {
-     // HTML Elements also set the caret position
-     // in order to affect tabbing order
-@@ -1509,8 +1509,8 @@ nsresult nsAccessible::AppendNameFromAcc
- {
-   nsAutoString textEquivalent, value;
- 
--  nsCOMPtr<nsIDOMNode> domNode(do_QueryInterface(aContent));
--  nsCOMPtr<nsIAccessible> accessible;
-+  nsIDOMNode* domNode(do_QueryInterface(aContent));
-+  nsIAccessible* accessible = nsnull;
-   if (domNode == mDOMNode) {
-     accessible = this;
-     if (!aFromValue) {
-@@ -1519,10 +1519,10 @@ nsresult nsAccessible::AppendNameFromAcc
-     }
-   }
-   else {
--    nsCOMPtr<nsIAccessibilityService> accService =
-+    nsIAccessibilityService* accService =
-       do_GetService("@mozilla.org/accessibilityService;1");
-     NS_ENSURE_TRUE(accService, NS_ERROR_FAILURE);
--    accService->GetAccessibleInWeakShell(domNode, mWeakShell, getter_AddRefs(accessible));
-+    accService->GetAccessibleInWeakShell(domNode, mWeakShell, &accessible);
-   }
-   if (accessible) {
-     if (aFromValue) {
-@@ -1551,13 +1551,13 @@ nsresult nsAccessible::AppendFlatStringF
-   if (aContent->IsNodeOfType(nsINode::eTEXT)) {
-     // If it's a text node, append the text
-     PRBool isHTMLBlock = PR_FALSE;
--    nsCOMPtr<nsIPresShell> shell = GetPresShell();
-+    nsIPresShell* shell = GetPresShell();
-     if (!shell) {
-       return NS_ERROR_FAILURE;  
-     }
- 
-     nsIContent *parentContent = aContent->GetParent();
--    nsCOMPtr<nsIContent> appendedSubtreeStart(do_QueryInterface(mDOMNode));
-+    nsIContent* appendedSubtreeStart(do_QueryInterface(mDOMNode));
-     if (parentContent && parentContent != appendedSubtreeStart) {
-       nsIFrame *frame = shell->GetPrimaryFrameFor(parentContent);
-       if (frame) {
-@@ -1593,7 +1593,7 @@ nsresult nsAccessible::AppendFlatStringF
-   nsAutoString textEquivalent;
-   if (!aContent->IsNodeOfType(nsINode::eHTML)) {
-     if (aContent->IsNodeOfType(nsINode::eXUL)) {
--      nsCOMPtr<nsIPresShell> shell = GetPresShell();
-+      nsIPresShell* shell = GetPresShell();
-       if (!shell) {
-         return NS_ERROR_FAILURE;  
-       }
-@@ -1602,7 +1602,7 @@ nsresult nsAccessible::AppendFlatStringF
-         return NS_OK;
-       }
- 
--      nsCOMPtr<nsIDOMXULLabeledControlElement> labeledEl(do_QueryInterface(aContent));
-+      nsIDOMXULLabeledControlElement* labeledEl(do_QueryInterface(aContent));
-       if (labeledEl) {
-         labeledEl->GetLabel(textEquivalent);
-       }
-@@ -1622,7 +1622,7 @@ nsresult nsAccessible::AppendFlatStringF
-     return NS_OK; // Not HTML and not XUL -- we don't handle it yet
-   }
- 
--  nsCOMPtr<nsIAtom> tag = aContent->Tag();
-+  nsIAtom* tag = aContent->Tag();
-   if (tag == nsAccessibilityAtoms::img) {
-     return AppendNameFromAccessibleFor(aContent, aFlatString);
-   }
-@@ -1686,7 +1686,7 @@ nsresult nsAccessible::AppendFlatStringF
-   // Depth first search for all text nodes that are decendants of content node.
-   // Append all the text into one flat string
-   PRUint32 numChildren = 0;
--  nsCOMPtr<nsIDOMXULSelectControlElement> selectControlEl(do_QueryInterface(aContent));
-+  nsIDOMXULSelectControlElement* selectControlEl(do_QueryInterface(aContent));
-   if (!selectControlEl) {  // Don't walk children of elements with options, just get label directly
-     numChildren = aContent->GetChildCount();
-   }
-@@ -1750,7 +1750,7 @@ nsresult nsAccessible::GetTextFromRelati
-   // Get DHTML name from content subtree pointed to by ID attribute
-   aName.Truncate();
-   NS_ASSERTION(mDOMNode, "Called from shutdown accessible");
--  nsCOMPtr<nsIContent> content = GetRoleContent(mDOMNode);
-+  nsIContent* content = GetRoleContent(mDOMNode);
-   if (!content)
-     return NS_OK;
- 
-@@ -1760,7 +1760,7 @@ nsresult nsAccessible::GetTextFromRelati
-   }
-   ids.CompressWhitespace(PR_TRUE, PR_TRUE);
- 
--  nsCOMPtr<nsIDOMDocument> domDoc = do_QueryInterface(content->GetOwnerDoc());
-+  nsIDOMDocument* domDoc = do_QueryInterface(content->GetOwnerDoc());
-   NS_ENSURE_TRUE(domDoc, NS_ERROR_FAILURE);
-   
-   nsresult rv = NS_ERROR_FAILURE;
-@@ -1781,8 +1781,8 @@ nsresult nsAccessible::GetTextFromRelati
-     if (!aName.IsEmpty()) {
-       aName += ' '; // Need whitespace between multiple labels or descriptions
-     }
--    nsCOMPtr<nsIDOMElement> labelElement;
--    domDoc->GetElementById(id, getter_AddRefs(labelElement));
-+    nsIDOMElement* labelElement = nsnull;
-+    domDoc->GetElementById(id, &labelElement);
-     content = do_QueryInterface(labelElement);
-     if (!content) {
-       return NS_OK;
-@@ -1804,7 +1804,7 @@ nsresult nsAccessible::GetTextFromRelati
-   */
- nsresult nsAccessible::GetHTMLName(nsAString& aLabel, PRBool aCanAggregateSubtree)
- {
--  nsCOMPtr<nsIContent> content(do_QueryInterface(mDOMNode));
-+  nsIContent* content(do_QueryInterface(mDOMNode));
-   if (!content) {
-     return NS_ERROR_FAILURE;   // Node shut down
-   }
-@@ -1857,7 +1857,7 @@ nsresult nsAccessible::GetHTMLName(nsASt
-   */
- nsresult nsAccessible::GetXULName(nsAString& aLabel, PRBool aCanAggregateSubtree)
- {
--  nsCOMPtr<nsIContent> content(do_QueryInterface(mDOMNode));
-+  nsIContent* content(do_QueryInterface(mDOMNode));
-   NS_ASSERTION(content, "No nsIContent for DOM node");
- 
-   // First check for label override via accessibility labelledby relationship
-@@ -1869,21 +1869,21 @@ nsresult nsAccessible::GetXULName(nsAStr
-   }
- 
-   // CASE #1 (via label attribute) -- great majority of the cases
--  nsCOMPtr<nsIDOMXULLabeledControlElement> labeledEl(do_QueryInterface(mDOMNode));
-+  nsIDOMXULLabeledControlElement* labeledEl(do_QueryInterface(mDOMNode));
-   if (labeledEl) {
-     rv = labeledEl->GetLabel(label);
-   }
-   else {
--    nsCOMPtr<nsIDOMXULSelectControlItemElement> itemEl(do_QueryInterface(mDOMNode));
-+    nsIDOMXULSelectControlItemElement* itemEl(do_QueryInterface(mDOMNode));
-     if (itemEl) {
-       rv = itemEl->GetLabel(label);
-     }
-     else {
--      nsCOMPtr<nsIDOMXULSelectControlElement> select(do_QueryInterface(mDOMNode));
-+      nsIDOMXULSelectControlElement* select(do_QueryInterface(mDOMNode));
-       // Use label if this is not a select control element which 
-       // uses label attribute to indicate which option is selected
-       if (!select) {
--        nsCOMPtr<nsIDOMXULElement> xulEl(do_QueryInterface(mDOMNode));
-+        nsIDOMXULElement* xulEl(do_QueryInterface(mDOMNode));
-         if (xulEl) {
-           rv = xulEl->GetAttribute(NS_LITERAL_STRING("label"), label);
-         }
-@@ -1898,7 +1898,7 @@ nsresult nsAccessible::GetXULName(nsAStr
-       nsAccUtils::FindNeighbourPointingToNode(content, nsAccessibilityAtoms::control,
-                                               nsAccessibilityAtoms::label);
- 
--    nsCOMPtr<nsIDOMXULLabelElement> xulLabel(do_QueryInterface(labelContent));
-+    nsIDOMXULLabelElement* xulLabel(do_QueryInterface(labelContent));
-     // Check if label's value attribute is used
-     if (xulLabel && NS_SUCCEEDED(xulLabel->GetValue(label)) && label.IsEmpty()) {
-       // If no value attribute, a non-empty label must contain
-@@ -1943,11 +1943,11 @@ PRBool nsAccessible::IsNodeRelevant(nsID
- {
-   // Can this node be accessible and attached to
-   // the document's accessible tree?
--  nsCOMPtr<nsIAccessibilityService> accService =
-+  nsIAccessibilityService* accService =
-     do_GetService("@mozilla.org/accessibilityService;1");
-   NS_ENSURE_TRUE(accService, PR_FALSE);
--  nsCOMPtr<nsIDOMNode> relevantNode;
--  accService->GetRelevantContentNodeFor(aNode, getter_AddRefs(relevantNode));
-+  nsIDOMNode* relevantNode = nsnull;
-+  accService->GetRelevantContentNodeFor(aNode, &relevantNode);
-   return aNode == relevantNode;
- }
- 
-@@ -1958,7 +1958,7 @@ nsAccessible::FireToolkitEvent(PRUint32 
-   if (!mWeakShell)
-     return NS_ERROR_FAILURE;
- 
--  nsCOMPtr<nsIAccessibleEvent> accEvent =
-+  nsIAccessibleEvent* accEvent =
-     new nsAccEvent(aEvent, aTarget);
-   NS_ENSURE_TRUE(accEvent, NS_ERROR_OUT_OF_MEMORY);
- 
-@@ -1969,11 +1969,11 @@ nsAccessible::FireAccessibleEvent(nsIAcc
- nsAccessible::FireAccessibleEvent(nsIAccessibleEvent *aEvent)
- {
-   NS_ENSURE_ARG_POINTER(aEvent);
--  nsCOMPtr<nsIDOMNode> eventNode;
--  aEvent->GetDOMNode(getter_AddRefs(eventNode));
-+  nsIDOMNode* eventNode = nsnull;
-+  aEvent->GetDOMNode(&eventNode);
-   NS_ENSURE_TRUE(IsNodeRelevant(eventNode), NS_ERROR_FAILURE);
- 
--  nsCOMPtr<nsIObserverService> obsService =
-+  nsIObserverService* obsService =
-     do_GetService("@mozilla.org/observer-service;1");
-   NS_ENSURE_TRUE(obsService, NS_ERROR_FAILURE);
- 
-@@ -1991,7 +1991,7 @@ NS_IMETHODIMP nsAccessible::GetFinalRole
-     // These unfortunate exceptions don't fit into the ARIA table
-     // This is where the nsIAccessible role depends on both the role and ARIA state
-     if (*aRole == nsIAccessibleRole::ROLE_PUSHBUTTON) {
--      nsCOMPtr<nsIContent> content = do_QueryInterface(mDOMNode);
-+      nsIContent* content = do_QueryInterface(mDOMNode);
-       if (content) {
-         if (content->HasAttr(kNameSpaceID_None, nsAccessibilityAtoms::aria_pressed)) {
-           // For aria-pressed="false" or aria-pressed="true"
-@@ -2007,21 +2007,21 @@ NS_IMETHODIMP nsAccessible::GetFinalRole
-     }
-     else if (*aRole == nsIAccessibleRole::ROLE_LISTBOX) {
-       // A listbox inside of a combo box needs a special role because of ATK mapping to menu
--      nsCOMPtr<nsIAccessible> possibleCombo;
--      GetParent(getter_AddRefs(possibleCombo));
-+      nsIAccessible* possibleCombo = nsnull;
-+      GetParent(&possibleCombo);
-       if (possibleCombo && Role(possibleCombo) == nsIAccessibleRole::ROLE_COMBOBOX) {
-         *aRole = nsIAccessibleRole::ROLE_COMBOBOX_LIST;
-       }
-       else {   // Check to see if combo owns the listbox instead
--        GetAccessibleRelated(nsIAccessibleRelation::RELATION_NODE_CHILD_OF, getter_AddRefs(possibleCombo));
-+        GetAccessibleRelated(nsIAccessibleRelation::RELATION_NODE_CHILD_OF, &possibleCombo);
-         if (possibleCombo && Role(possibleCombo) == nsIAccessibleRole::ROLE_COMBOBOX) {
-           *aRole = nsIAccessibleRole::ROLE_COMBOBOX_LIST;
-         }
-       }
-     }
-     else if (*aRole == nsIAccessibleRole::ROLE_OPTION) {
--      nsCOMPtr<nsIAccessible> parent;
--      GetParent(getter_AddRefs(parent));
-+      nsIAccessible* parent = nsnull;
-+      GetParent(&parent);
-       if (parent && Role(parent) == nsIAccessibleRole::ROLE_COMBOBOX_LIST) {
-         *aRole = nsIAccessibleRole::ROLE_COMBOBOX_OPTION;
-       }
-@@ -2048,12 +2048,12 @@ nsAccessible::GetAttributes(nsIPersisten
-   if (IsDefunct())
-     return NS_ERROR_FAILURE;
- 
--  nsCOMPtr<nsIContent> content = GetRoleContent(mDOMNode);
-+  nsIContent* content = GetRoleContent(mDOMNode);
-   if (!content) {
-     return NS_ERROR_FAILURE;
-   }
- 
--  nsCOMPtr<nsIPersistentProperties> attributes = *aAttributes;
-+  nsIPersistentProperties* attributes = *aAttributes;
-   if (!attributes) {
-     // Create only if an array wasn't already passed in
-     attributes = do_CreateInstance(NS_PERSISTENTPROPERTIES_CONTRACTID);
-@@ -2077,7 +2077,7 @@ nsAccessible::GetAttributes(nsIPersisten
-     attributes->SetStringProperty(NS_LITERAL_CSTRING("xml-roles"),  xmlRoles, oldValueUnused);          
-   }
- 
--  nsCOMPtr<nsIAccessibleValue> supportsValue = do_QueryInterface(static_cast<nsIAccessible*>(this));
-+  nsIAccessibleValue* supportsValue = do_QueryInterface(static_cast<nsIAccessible*>(this));
-   if (supportsValue) {
-     // We support values, so expose the string value as well, via the valuetext object attribute
-     // We test for the value interface because we don't want to expose traditional get_accValue()
-@@ -2132,14 +2132,14 @@ nsAccessible::GetAttributes(nsIPersisten
-           role == nsIAccessibleRole::ROLE_RADIO_MENU_ITEM)
-         baseRole = nsIAccessibleRole::ROLE_MENUITEM;
- 
--      nsCOMPtr<nsIAccessible> parent = GetParent();
-+      nsIAccessible* parent = GetParent();
-       NS_ENSURE_TRUE(parent, NS_ERROR_FAILURE);
- 
-       PRInt32 positionInGroup = 0;
-       PRInt32 setSize = 0;
- 
--      nsCOMPtr<nsIAccessible> sibling, nextSibling;
--      parent->GetFirstChild(getter_AddRefs(sibling));
-+      nsIAccessible* sibling = nsnull, *nextSibling = nsnull;
-+      parent->GetFirstChild(&sibling);
-       NS_ENSURE_TRUE(sibling, NS_ERROR_FAILURE);
- 
-       PRBool foundCurrent = PR_FALSE;
-@@ -2173,14 +2173,14 @@ nsAccessible::GetAttributes(nsIPersisten
-           setSize = 0;
-         }
- 
--        sibling->GetNextSibling(getter_AddRefs(nextSibling));
-+        sibling->GetNextSibling(&nextSibling);
-         sibling = nextSibling;
-       }
- 
-       PRInt32 groupLevel = 0;
-       if (role == nsIAccessibleRole::ROLE_OUTLINEITEM) {
-         groupLevel = 1;
--        nsCOMPtr<nsIAccessible> nextParent;
-+        nsIAccessible* nextParent = nsnull;
-         while (parent) {
-           parent->GetFinalRole(&role);
- 
-@@ -2189,8 +2189,8 @@ nsAccessible::GetAttributes(nsIPersisten
-           if (role == nsIAccessibleRole::ROLE_GROUPING)
-             ++ groupLevel;
- 
--          parent->GetParent(getter_AddRefs(nextParent));
--          parent.swap(nextParent);
-+          parent->GetParent(&nextParent);
-+          swap(parent, nextParent);
-         }
-       }
- 
-@@ -2227,7 +2227,7 @@ nsAccessible::GetAttributesInternal(nsIP
-   // Attributes set by this method will not be used to override attributes on a sub-document accessible
-   // when there is a <frame>/<iframe> element that spawned the sub-document
-   nsIContent *content = GetRoleContent(mDOMNode);
--  nsCOMPtr<nsIDOMElement> element(do_QueryInterface(content));
-+  nsIDOMElement* element(do_QueryInterface(content));
-   NS_ENSURE_TRUE(element, NS_ERROR_UNEXPECTED);
- 
-   nsAutoString tagName;
-@@ -2252,18 +2252,18 @@ nsAccessible::GetAttributesInternal(nsIP
-   //   The inner nodes can be used to override live region behavior on more general outer nodes
-   // However, nodes in outer documents override nodes in inner documents:
-   //   Outer doc author may want to override properties on a widget they used in an iframe
--  nsCOMPtr<nsIDOMNode> startNode = mDOMNode;
-+  nsIDOMNode* startNode = mDOMNode;
-   nsIContent *startContent = content;
-   while (PR_TRUE) {
-     NS_ENSURE_STATE(startContent);
-     nsIDocument *doc = startContent->GetDocument();
--    nsCOMPtr<nsIDOMNode> docNode = do_QueryInterface(doc);
-+    nsIDOMNode* docNode = do_QueryInterface(doc);
-     NS_ENSURE_STATE(docNode);
-     nsIContent *topContent = GetRoleContent(docNode);
-     NS_ENSURE_STATE(topContent);
-     nsAccUtils::GetLiveContainerAttributes(aAttributes, startContent, topContent);
-     // Allow ARIA live region markup from outer documents to override
--    nsCOMPtr<nsISupports> container = doc->GetContainer();
-+    nsISupports* container = doc->GetContainer();
-     nsIDocShellTreeItem *docShellTreeItem = nsnull;
-     if (container)
-       CallQueryInterface(container, &docShellTreeItem);
-@@ -2310,8 +2310,8 @@ nsAccessible::GroupPosition(PRInt32 *aGr
-   *aSimilarItemsInGroup = 0;
-   *aPositionInGroup = 0;
- 
--  nsCOMPtr<nsIPersistentProperties> attributes;
--  nsresult rv = GetAttributes(getter_AddRefs(attributes));
-+  nsIPersistentProperties* attributes = nsnull;
-+  nsresult rv = GetAttributes(&attributes);
-   NS_ENSURE_SUCCESS(rv, rv);
-   if (!attributes) {
-     return NS_ERROR_FAILURE;
-@@ -2374,15 +2374,15 @@ nsAccessible::GetFinalState(PRUint32 *aS
-     } else {
-       // Expose 'selected' state on ARIA tab if the focus is on internal element
-       // of related tabpanel.
--      nsCOMPtr<nsIAccessible> tabPanel;
-+      nsIAccessible* tabPanel = nsnull;
-       rv = GetAccessibleRelated(nsIAccessibleRelation::RELATION_LABEL_FOR,
--                                getter_AddRefs(tabPanel));
-+                                &tabPanel);
-       NS_ENSURE_SUCCESS(rv, rv);
- 
-       if (tabPanel && Role(tabPanel) == nsIAccessibleRole::ROLE_PROPERTYPAGE) {
--        nsCOMPtr<nsIAccessNode> tabPanelAccessNode(do_QueryInterface(tabPanel));
--        nsCOMPtr<nsIDOMNode> tabPanelNode;
--        tabPanelAccessNode->GetDOMNode(getter_AddRefs(tabPanelNode));
-+        nsIAccessNode* tabPanelAccessNode(do_QueryInterface(tabPanel));
-+        nsIDOMNode* tabPanelNode = nsnull;
-+        tabPanelAccessNode->GetDOMNode(&tabPanelNode);
-         NS_ENSURE_STATE(tabPanelNode);
- 
-         if (nsAccUtils::IsAncestorOf(tabPanelNode, gLastFocusedNode))
-@@ -2419,7 +2419,7 @@ nsAccessible::GetFinalState(PRUint32 *aS
-     // pointing at it, we mark it as ACTIVE even if it's not currently focused.
-     // This allows screen reader virtual buffer modes to know which descendant
-     // is the current one that would get focus if the user navigates to the container widget.
--    nsCOMPtr<nsIContent> content = do_QueryInterface(mDOMNode);
-+    nsIContent* content = do_QueryInterface(mDOMNode);
-     nsAutoString id;
-     if (content && nsAccUtils::GetID(content, id)) {
-       nsIContent *ancestorContent = content;
-@@ -2442,7 +2442,7 @@ nsAccessible::GetFinalState(PRUint32 *aS
-   if (role == nsIAccessibleRole::ROLE_ENTRY ||
-       role == nsIAccessibleRole::ROLE_COMBOBOX) {
- 
--    nsCOMPtr<nsIContent> content(do_QueryInterface(mDOMNode));
-+    nsIContent* content(do_QueryInterface(mDOMNode));
-     NS_ENSURE_STATE(content);
- 
-     nsAutoString autocomplete;
-@@ -2561,7 +2561,7 @@ nsAccessible::GetValue(nsAString& aValue
-   if (IsDefunct())
-     return NS_ERROR_FAILURE;
- 
--  nsCOMPtr<nsIContent> content(do_QueryInterface(mDOMNode));
-+  nsIContent* content(do_QueryInterface(mDOMNode));
-   if (!content)
-     return NS_OK;
- 
-@@ -2582,7 +2582,7 @@ nsAccessible::GetValue(nsAString& aValue
- 
-   // Check if it's an simple xlink.
-   if (nsAccUtils::IsXLink(content)) {
--    nsCOMPtr<nsIPresShell> presShell(do_QueryReferent(mWeakShell));
-+    nsIPresShell* presShell(do_QueryReferent(mWeakShell));
-     if (presShell)
-       return presShell->GetLinkLocation(mDOMNode, aValue);
-   }
-@@ -2642,7 +2642,7 @@ nsAccessible::SetCurrentValue(double aVa
-   if (NS_SUCCEEDED(GetMaximumValue(&maxValue)) && aValue > maxValue)
-     return NS_ERROR_INVALID_ARG;
- 
--  nsCOMPtr<nsIContent> content(do_QueryInterface(mDOMNode));
-+  nsIContent* content(do_QueryInterface(mDOMNode));
-   NS_ENSURE_STATE(content);
- 
-   nsAutoString newValue;
-@@ -2694,7 +2694,7 @@ NS_IMETHODIMP nsAccessible::GetRole(PRUi
-   if (IsDefunct())
-     return NS_ERROR_FAILURE;
- 
--  nsCOMPtr<nsIContent> content(do_QueryInterface(mDOMNode));
-+  nsIContent* content(do_QueryInterface(mDOMNode));
-   if (nsAccUtils::IsXLink(content))
-     *aRole = nsIAccessibleRole::ROLE_LINK;
- 
-@@ -2711,7 +2711,7 @@ nsAccessible::GetNumActions(PRUint8 *aNu
-   if (IsDefunct())
-     return NS_ERROR_FAILURE;
- 
--  nsCOMPtr<nsIContent> content = GetRoleContent(mDOMNode);
-+  nsIContent* content = GetRoleContent(mDOMNode);
-   if (!content)
-     return NS_OK;
- 
-@@ -2744,7 +2744,7 @@ nsAccessible::GetActionName(PRUint8 aInd
-     return NS_ERROR_FAILURE;
- 
-   // Check if it's simple xlink.
--  nsCOMPtr<nsIContent> content(do_QueryInterface(mDOMNode));
-+  nsIContent* content(do_QueryInterface(mDOMNode));
-   if (nsAccUtils::IsXLink(content)) {
-     aName.AssignLiteral("jump");
-     return NS_OK;
-@@ -2787,7 +2787,7 @@ nsAccessible::DoAction(PRUint8 aIndex)
-   PRBool doAction = PR_FALSE;
- 
-   // Check if it's simple xlink.
--  nsCOMPtr<nsIContent> content(do_QueryInterface(mDOMNode));
-+  nsIContent* content(do_QueryInterface(mDOMNode));
-   if (nsAccUtils::IsXLink(content))
-     doAction = PR_TRUE;
- 
-@@ -2833,14 +2833,14 @@ NS_IMETHODIMP nsAccessible::GetAccessibl
- 
- nsIDOMNode* nsAccessible::GetAtomicRegion()
- {
--  nsCOMPtr<nsIContent> content = GetRoleContent(mDOMNode);
-+  nsIContent* content = GetRoleContent(mDOMNode);
-   nsIContent *loopContent = content;
-   nsAutoString atomic;
-   while (loopContent && !loopContent->GetAttr(kNameSpaceID_None, nsAccessibilityAtoms::aria_atomic, atomic)) {
-     loopContent = loopContent->GetParent();
-   }
- 
--  nsCOMPtr<nsIDOMNode> atomicRegion;
-+  nsIDOMNode* atomicRegion = nsnull;
-   if (atomic.EqualsLiteral("true")) {
-     atomicRegion = do_QueryInterface(loopContent);
-   }
-@@ -2861,7 +2861,7 @@ NS_IMETHODIMP nsAccessible::GetAccessibl
-     return NS_ERROR_FAILURE;  // Node already shut down
-   }
- 
--  nsCOMPtr<nsIDOMNode> relatedNode;
-+  nsIDOMNode* relatedNode = nsnull;
-   nsAutoString relatedID;
- 
-   // Search for the related DOM node according to the specified "relation type"
-@@ -2962,47 +2962,47 @@ NS_IMETHODIMP nsAccessible::GetAccessibl
-     {
-       if (content->IsNodeOfType(nsINode::eHTML)) {
-         // HTML form controls implements nsIFormControl interface.
--        nsCOMPtr<nsIFormControl> control(do_QueryInterface(content));
-+        nsIFormControl* control(do_QueryInterface(content));
-         if (control) {
--          nsCOMPtr<nsIDOMHTMLFormElement> htmlform;
--          control->GetForm(getter_AddRefs(htmlform));
--          nsCOMPtr<nsIForm> form(do_QueryInterface(htmlform));
-+          nsIDOMHTMLFormElement* htmlform = nsnull;
-+          control->GetForm(&htmlform);
-+          nsIForm* form(do_QueryInterface(htmlform));
-           if (form)
-             relatedNode = do_QueryInterface(form->GetDefaultSubmitElement());
-         }
-       }
-       else {
-         // In XUL, use first <button default="true" .../> in the document
--        nsCOMPtr<nsIDOMXULDocument> xulDoc = do_QueryInterface(content->GetDocument());
--        nsCOMPtr<nsIDOMXULButtonElement> buttonEl;
-+        nsIDOMXULDocument* xulDoc = do_QueryInterface(content->GetDocument());
-+        nsIDOMXULButtonElement* buttonEl = nsnull;
-         if (xulDoc) {
--          nsCOMPtr<nsIDOMNodeList> possibleDefaultButtons;
-+          nsIDOMNodeList* possibleDefaultButtons = nsnull;
-           xulDoc->GetElementsByAttribute(NS_LITERAL_STRING("default"),
-                                          NS_LITERAL_STRING("true"),
--                                         getter_AddRefs(possibleDefaultButtons));
-+                                         &possibleDefaultButtons);
-           if (possibleDefaultButtons) {
-             PRUint32 length;
-             possibleDefaultButtons->GetLength(&length);
--            nsCOMPtr<nsIDOMNode> possibleButton;
-+            nsIDOMNode* possibleButton = nsnull;
-             // Check for button in list of default="true" elements
-             for (PRUint32 count = 0; count < length && !buttonEl; count ++) {
--              possibleDefaultButtons->Item(count, getter_AddRefs(possibleButton));
-+              possibleDefaultButtons->Item(count, &possibleButton);
-               buttonEl = do_QueryInterface(possibleButton);
-             }
-           }
-           if (!buttonEl) { // Check for anonymous accept button in <dialog>
--            nsCOMPtr<nsIDOMDocumentXBL> xblDoc(do_QueryInterface(xulDoc));
-+            nsIDOMDocumentXBL* xblDoc(do_QueryInterface(xulDoc));
-             if (xblDoc) {
--              nsCOMPtr<nsIDOMDocument> domDoc = do_QueryInterface(xulDoc);
-+              nsIDOMDocument* domDoc = do_QueryInterface(xulDoc);
-               NS_ASSERTION(domDoc, "No DOM document");
--              nsCOMPtr<nsIDOMElement> rootEl;
--              domDoc->GetDocumentElement(getter_AddRefs(rootEl));
-+              nsIDOMElement* rootEl = nsnull;
-+              domDoc->GetDocumentElement(&rootEl);
-               if (rootEl) {
--                nsCOMPtr<nsIDOMElement> possibleButtonEl;
-+                nsIDOMElement* possibleButtonEl = nsnull;
-                 xblDoc->GetAnonymousElementByAttribute(rootEl,
-                                                       NS_LITERAL_STRING("default"),
-                                                       NS_LITERAL_STRING("true"),
--                                                      getter_AddRefs(possibleButtonEl));
-+                                                      &possibleButtonEl);
-                 buttonEl = do_QueryInterface(possibleButtonEl);
-               }
-             }
-@@ -3023,17 +3023,17 @@ NS_IMETHODIMP nsAccessible::GetAccessibl
- 
-   if (!relatedID.IsEmpty()) {
-     // In some cases we need to get the relatedNode from an ID-style attribute
--    nsCOMPtr<nsIDOMDocument> domDoc;
--    mDOMNode->GetOwnerDocument(getter_AddRefs(domDoc));
-+    nsIDOMDocument* domDoc = nsnull;
-+    mDOMNode->GetOwnerDocument(&domDoc);
-     NS_ENSURE_TRUE(domDoc, NS_ERROR_FAILURE);
--    nsCOMPtr<nsIDOMElement> relatedEl;
--    domDoc->GetElementById(relatedID, getter_AddRefs(relatedEl));
-+    nsIDOMElement* relatedEl = nsnull;
-+    domDoc->GetElementById(relatedID, &relatedEl);
-     relatedNode = do_QueryInterface(relatedEl);
-   }
- 
-   // Return the corresponding accessible if the related DOM node is found
-   if (relatedNode) {
--    nsCOMPtr<nsIAccessibilityService> accService = GetAccService();
-+    nsIAccessibilityService* accService = GetAccService();
-     NS_ENSURE_TRUE(accService, NS_ERROR_FAILURE);
-     accService->GetAccessibleInWeakShell(relatedNode, mWeakShell, aRelated);
-   }
-@@ -3046,8 +3046,8 @@ nsAccessible::GetRelationsCount(PRUint32
-   NS_ENSURE_ARG_POINTER(aCount);
-   *aCount = 0;
- 
--  nsCOMPtr<nsIArray> relations;
--  nsresult rv = GetRelations(getter_AddRefs(relations));
-+  nsIArray* relations = nsnull;
-+  nsresult rv = GetRelations(&relations);
-   NS_ENSURE_SUCCESS(rv, rv);
- 
-   return relations->GetLength(aCount);
-@@ -3059,13 +3059,13 @@ nsAccessible::GetRelation(PRUint32 aInde
-   NS_ENSURE_ARG_POINTER(aRelation);
-   *aRelation = nsnull;
- 
--  nsCOMPtr<nsIArray> relations;
--  nsresult rv = GetRelations(getter_AddRefs(relations));
-+  nsIArray* relations = nsnull;
-+  nsresult rv = GetRelations(&relations);
-   NS_ENSURE_SUCCESS(rv, rv);
- 
--  nsCOMPtr<nsIAccessibleRelation> relation;
-+  nsIAccessibleRelation* relation = nsnull;
-   rv = relations->QueryElementAt(aIndex, NS_GET_IID(nsIAccessibleRelation),
--                                 getter_AddRefs(relation));
-+                                 (void**)&relation);
- 
-   // nsIArray::QueryElementAt() returns NS_ERROR_ILLEGAL_VALUE on invalid index.
-   if (rv == NS_ERROR_ILLEGAL_VALUE)
-@@ -3082,17 +3082,17 @@ nsAccessible::GetRelations(nsIArray **aR
- {
-   NS_ENSURE_ARG_POINTER(aRelations);
- 
--  nsCOMPtr<nsIMutableArray> relations = do_CreateInstance(NS_ARRAY_CONTRACTID);
-+  nsIMutableArray* relations = do_CreateInstance(NS_ARRAY_CONTRACTID);
-   NS_ENSURE_TRUE(relations, NS_ERROR_OUT_OF_MEMORY);
- 
-   for (PRUint32 relType = nsIAccessibleRelation::RELATION_FIRST;
-        relType < nsIAccessibleRelation::RELATION_LAST;
-        ++relType) {
--    nsCOMPtr<nsIAccessible> accessible;
--    GetAccessibleRelated(relType, getter_AddRefs(accessible));
-+    nsIAccessible* accessible = nsnull;
-+    GetAccessibleRelated(relType, &accessible);
- 
-     if (accessible) {
--      nsCOMPtr<nsIAccessibleRelation> relation =
-+      nsIAccessibleRelation* relation =
-         new nsAccessibleRelationWrap(relType, accessible);
-       NS_ENSURE_TRUE(relation, NS_ERROR_OUT_OF_MEMORY);
- 
-@@ -3123,7 +3123,7 @@ void nsAccessible::DoCommandCallback(nsI
-   NS_RELEASE(gDoCommandTimer);
- 
-   nsIContent *content = reinterpret_cast<nsIContent*>(aClosure);
--  nsCOMPtr<nsIDOMXULElement> xulElement(do_QueryInterface(content));
-+  nsIDOMXULElement* xulElement(do_QueryInterface(content));
-   if (xulElement) {
-     xulElement->Click();
-   }
-@@ -3132,7 +3132,7 @@ void nsAccessible::DoCommandCallback(nsI
-     if (!doc) {
-       return;
-     }
--    nsCOMPtr<nsIPresShell> presShell = doc->GetPrimaryShell();
-+    nsIPresShell* presShell = doc->GetPrimaryShell();
-     nsPIDOMWindow *outerWindow = doc->GetWindow();
-     if (presShell && outerWindow) {
-       nsAutoPopupStatePusher popupStatePusher(outerWindow, openAllowed);
-@@ -3165,7 +3165,7 @@ void nsAccessible::DoCommandCallback(nsI
-  */
- nsresult nsAccessible::DoCommand(nsIContent *aContent)
- {
--  nsCOMPtr<nsIContent> content = aContent;
-+  nsIContent* content = aContent;
-   if (!content) {
-     content = do_QueryInterface(mDOMNode);
-   }
-@@ -3175,7 +3175,7 @@ nsresult nsAccessible::DoCommand(nsICont
-     return NS_ERROR_FAILURE;
-   }
- 
--  nsCOMPtr<nsITimer> timer = do_CreateInstance("@mozilla.org/timer;1");
-+  nsITimer* timer = do_CreateInstance("@mozilla.org/timer;1");
-   if (!timer) {
-     return NS_ERROR_OUT_OF_MEMORY;
-   } 
-@@ -3186,35 +3186,35 @@ nsresult nsAccessible::DoCommand(nsICont
-                                                nsITimer::TYPE_ONE_SHOT);
- }
- 
--already_AddRefed<nsIAccessible>
-+nsIAccessible*
- nsAccessible::GetNextWithState(nsIAccessible *aStart, PRUint32 matchState)
- {
-   // Return the next descendant that matches one of the states in matchState
-   // Uses depth first search
-   NS_ASSERTION(matchState, "GetNextWithState() not called with a state to match");
-   NS_ASSERTION(aStart, "GetNextWithState() not called with an accessible to start with");
--  nsCOMPtr<nsIAccessible> look, current = aStart;
-+  nsIAccessible* look = nsnull, *current = aStart;
-   PRUint32 state = 0;
-   while (0 == (state & matchState)) {
--    current->GetFirstChild(getter_AddRefs(look));
-+    current->GetFirstChild(&look);
-     while (!look) {
-       if (current == this) {
-         return nsnull; // At top of subtree
-       }
--      current->GetNextSibling(getter_AddRefs(look));
-+      current->GetNextSibling(&look);
-       if (!look) {
--        current->GetParent(getter_AddRefs(look));
-+        current->GetParent(&look);
-         current = look;
-         look = nsnull;
-         continue;
-       }
-     }
--    current.swap(look);
-+    swap(current, look);
-     state = State(current);
-   }
- 
-   nsIAccessible *returnAccessible = nsnull;
--  current.swap(returnAccessible);
-+  swap(current, returnAccessible);
- 
-   return returnAccessible;
- }
-@@ -3224,11 +3224,11 @@ NS_IMETHODIMP nsAccessible::GetSelectedC
- {
-   *aSelectedAccessibles = nsnull;
- 
--  nsCOMPtr<nsIMutableArray> selectedAccessibles =
-+  nsIMutableArray* selectedAccessibles =
-     do_CreateInstance(NS_ARRAY_CONTRACTID);
-   NS_ENSURE_STATE(selectedAccessibles);
- 
--  nsCOMPtr<nsIAccessible> selected = this;
-+  nsIAccessible* selected = this;
-   while ((selected = GetNextWithState(selected, nsIAccessibleStates::STATE_SELECTED)) != nsnull) {
-     selectedAccessibles->AppendElement(selected, PR_FALSE);
-   }
-@@ -3250,7 +3250,7 @@ NS_IMETHODIMP nsAccessible::RefSelection
-   if (aIndex < 0) {
-     return NS_ERROR_FAILURE;
-   }
--  nsCOMPtr<nsIAccessible> selected = this;
-+  nsIAccessible* selected = this;
-   PRInt32 count = 0;
-   while (count ++ <= aIndex) {
-     selected = GetNextWithState(selected, nsIAccessibleStates::STATE_SELECTED);
-@@ -3265,7 +3265,7 @@ NS_IMETHODIMP nsAccessible::GetSelection
- NS_IMETHODIMP nsAccessible::GetSelectionCount(PRInt32 *aSelectionCount)
- {
-   *aSelectionCount = 0;
--  nsCOMPtr<nsIAccessible> selected = this;
-+  nsIAccessible* selected = this;
-   while ((selected = GetNextWithState(selected, nsIAccessibleStates::STATE_SELECTED)) != nsnull) {
-     ++ *aSelectionCount;
-   }
-@@ -3281,8 +3281,8 @@ NS_IMETHODIMP nsAccessible::AddChildToSe
- 
-   NS_ENSURE_TRUE(aIndex >= 0, NS_ERROR_FAILURE);
- 
--  nsCOMPtr<nsIAccessible> child;
--  GetChildAt(aIndex, getter_AddRefs(child));
-+  nsIAccessible* child = nsnull;
-+  GetChildAt(aIndex, &child);
- 
-   PRUint32 state = State(child);
-   if (!(state & nsIAccessibleStates::STATE_SELECTABLE)) {
-@@ -3300,8 +3300,8 @@ NS_IMETHODIMP nsAccessible::RemoveChildF
- 
-   NS_ENSURE_TRUE(aIndex >= 0, NS_ERROR_FAILURE);
- 
--  nsCOMPtr<nsIAccessible> child;
--  GetChildAt(aIndex, getter_AddRefs(child));
-+  nsIAccessible* child = nsnull;
-+  GetChildAt(aIndex, &child);
- 
-   PRUint32 state = State(child);
-   if (!(state & nsIAccessibleStates::STATE_SELECTED)) {
-@@ -3320,8 +3320,8 @@ NS_IMETHODIMP nsAccessible::IsChildSelec
-   *aIsSelected = PR_FALSE;
-   NS_ENSURE_TRUE(aIndex >= 0, NS_ERROR_FAILURE);
- 
--  nsCOMPtr<nsIAccessible> child;
--  GetChildAt(aIndex, getter_AddRefs(child));
-+  nsIAccessible* child = nsnull;
-+  GetChildAt(aIndex, &child);
- 
-   PRUint32 state = State(child);
-   if (state & nsIAccessibleStates::STATE_SELECTED) {
-@@ -3332,7 +3332,7 @@ NS_IMETHODIMP nsAccessible::IsChildSelec
- 
- NS_IMETHODIMP nsAccessible::ClearSelection()
- {
--  nsCOMPtr<nsIAccessible> selected = this;
-+  nsIAccessible* selected = this;
-   while ((selected = GetNextWithState(selected, nsIAccessibleStates::STATE_SELECTED)) != nsnull) {
-     selected->SetSelected(PR_FALSE);
-   }
-@@ -3341,7 +3341,7 @@ NS_IMETHODIMP nsAccessible::ClearSelecti
- 
- NS_IMETHODIMP nsAccessible::SelectAllSelection(PRBool *_retval)
- {
--  nsCOMPtr<nsIAccessible> selectable = this;
-+  nsIAccessible* selectable = this;
-   while ((selectable = GetNextWithState(selectable, nsIAccessibleStates::STATE_SELECTED)) != nsnull) {
-     selectable->SetSelected(PR_TRUE);
-   }
-@@ -3392,13 +3392,13 @@ nsAccessible::GetURI(PRInt32 aIndex, nsI
-     return NS_ERROR_INVALID_ARG;
- 
-   // Check if it's simple xlink.
--  nsCOMPtr<nsIContent> content(do_QueryInterface(mDOMNode));
-+  nsIContent* content(do_QueryInterface(mDOMNode));
-   if (nsAccUtils::IsXLink(content)) {
-     nsAutoString href;
-     content->GetAttr(kNameSpaceID_XLink, nsAccessibilityAtoms::href, href);
- 
--    nsCOMPtr<nsIURI> baseURI = content->GetBaseURI();
--    nsCOMPtr<nsIDocument> document = content->GetOwnerDoc();
-+    nsIURI* baseURI = content->GetBaseURI();
-+    nsIDocument* document = content->GetOwnerDoc();
-     return NS_NewURI(aURI, href,
-                      document ? document->GetDocumentCharacterSet().get() : nsnull,
-                      baseURI);
-@@ -3449,14 +3449,14 @@ nsresult nsAccessible::GetLinkOffset(PRI
- nsresult nsAccessible::GetLinkOffset(PRInt32* aStartOffset, PRInt32* aEndOffset)
- {
-   *aStartOffset = *aEndOffset = 0;
--  nsCOMPtr<nsIAccessible> parent(GetParent());
-+  nsIAccessible* parent(GetParent());
-   if (!parent) {
-     return NS_ERROR_FAILURE;
-   }
- 
--  nsCOMPtr<nsIAccessible> accessible, nextSibling;
-+  nsIAccessible* accessible = nsnull, *nextSibling = nsnull;
-   PRInt32 characterCount = 0;
--  parent->GetFirstChild(getter_AddRefs(accessible));
-+  parent->GetFirstChild(&accessible);
- 
-   while (accessible) {
-     if (IsText(accessible)) {
-@@ -3470,8 +3470,8 @@ nsresult nsAccessible::GetLinkOffset(PRI
-     else {
-       ++ characterCount;
-     }
--    accessible->GetNextSibling(getter_AddRefs(nextSibling));
--    accessible.swap(nextSibling);
-+    accessible->GetNextSibling(&nextSibling);
-+    swap(accessible, nextSibling);
-   }
- 
-   return NS_ERROR_FAILURE;
-@@ -3482,7 +3482,7 @@ PRInt32 nsAccessible::TextLength(nsIAcce
-   if (!IsText(aAccessible))
-     return 1;
- 
--  nsCOMPtr<nsPIAccessNode> pAccNode(do_QueryInterface(aAccessible));
-+  nsPIAccessNode* pAccNode(do_QueryInterface(aAccessible));
-   NS_ASSERTION(pAccNode, "QI to nsPIAccessNode failed");
- 
-   nsIFrame *frame = pAccNode->GetFrame();
-@@ -3500,7 +3500,7 @@ PRInt32 nsAccessible::TextLength(nsIAcce
-   // They don't have their own frame.
-   // XXX In the future, list bullets may have frame and anon content, so 
-   // we should be able to remove this at that point
--  nsCOMPtr<nsPIAccessible> pAcc(do_QueryInterface(aAccessible));
-+  nsPIAccessible* pAcc(do_QueryInterface(aAccessible));
-   NS_ASSERTION(pAcc, "QI to nsPIAccessible failed");
- 
-   nsAutoString text;
-@@ -3514,16 +3514,16 @@ nsAccessible::AppendTextTo(nsAString& aT
-   return NS_OK;
- }
- 
--already_AddRefed<nsIAccessible>
-+nsIAccessible*
- nsAccessible::GetFirstAvailableAccessible(nsIDOMNode *aStartNode, PRBool aRequireLeaf)
- {
-   nsIAccessibilityService *accService = GetAccService();
--  nsCOMPtr<nsIAccessible> accessible;
--  nsCOMPtr<nsIDOMTreeWalker> walker; 
--  nsCOMPtr<nsIDOMNode> currentNode(aStartNode);
-+  nsIAccessible* accessible = nsnull;
-+  nsIDOMTreeWalker* walker = nsnull; 
-+  nsIDOMNode* currentNode(aStartNode);
- 
-   while (currentNode) {
--    accService->GetAccessibleInWeakShell(currentNode, mWeakShell, getter_AddRefs(accessible)); // AddRef'd
-+    accService->GetAccessibleInWeakShell(currentNode, mWeakShell, &accessible); // AddRef'd
-     if (accessible && (!aRequireLeaf || IsLeaf(accessible))) {
-       nsIAccessible *retAccessible = accessible;
-       NS_ADDREF(retAccessible);
-@@ -3532,18 +3532,18 @@ nsAccessible::GetFirstAvailableAccessibl
-     if (!walker) {
-       // Instantiate walker lazily since we won't need it in 90% of the cases
-       // where the first DOM node we're given provides an accessible
--      nsCOMPtr<nsIDOMDocument> document;
--      currentNode->GetOwnerDocument(getter_AddRefs(document));
--      nsCOMPtr<nsIDOMDocumentTraversal> trav = do_QueryInterface(document);
-+      nsIDOMDocument* document = nsnull;
-+      currentNode->GetOwnerDocument(&document);
-+      nsIDOMDocumentTraversal* trav = do_QueryInterface(document);
-       NS_ASSERTION(trav, "No DOM document traversal for document");
-       NS_ENSURE_TRUE(trav, nsnull);
-       trav->CreateTreeWalker(mDOMNode, nsIDOMNodeFilter::SHOW_ELEMENT | nsIDOMNodeFilter::SHOW_TEXT,
--                            nsnull, PR_FALSE, getter_AddRefs(walker));
-+                            nsnull, PR_FALSE, &walker);
-       NS_ENSURE_TRUE(walker, nsnull);
-       walker->SetCurrentNode(currentNode);
-     }
- 
--    walker->NextNode(getter_AddRefs(currentNode));
-+    walker->NextNode(&currentNode);
-   }
- 
-   return nsnull;
-@@ -3599,7 +3599,7 @@ nsAccessible::GetAttrValue(nsIAtom *aPro
-  if (!mRoleMapEntry || mRoleMapEntry->valueRule == eNoValue)
-     return NS_OK_NO_ARIA_VALUE;
- 
--  nsCOMPtr<nsIContent> content(do_QueryInterface(mDOMNode));
-+  nsIContent* content(do_QueryInterface(mDOMNode));
-   NS_ENSURE_STATE(content);
- 
-   PRInt32 result = NS_OK;
-diff --git a/accessible/src/base/nsAccessible.h b/accessible/src/base/nsAccessible.h
---- a/accessible/src/base/nsAccessible.h
-+++ b/accessible/src/base/nsAccessible.h
-@@ -147,7 +147,7 @@ public:
-    */
-   static PRBool MustPrune(nsIAccessible *aAccessible);
-   
--  already_AddRefed<nsIAccessible> GetParent() {
-+  nsIAccessible* GetParent() {
-     nsIAccessible *parent = nsnull;
-     GetParent(&parent);
-     return parent;
-@@ -204,9 +204,9 @@ protected:
-   
-   // nsCOMPtr<>& is useful here, because getter_AddRefs() nulls the comptr's value, and NextChild
-   // depends on the passed-in comptr being null or already set to a child (finding the next sibling).
--  nsIAccessible *NextChild(nsCOMPtr<nsIAccessible>& aAccessible);
-+  nsIAccessible *NextChild(nsIAccessible*& aAccessible);
-     
--  already_AddRefed<nsIAccessible> GetNextWithState(nsIAccessible *aStart, PRUint32 matchState);
-+  nsIAccessible* GetNextWithState(nsIAccessible *aStart, PRUint32 matchState);
- 
-   /**
-    * Return an accessible for the given DOM node, or if that node isn't accessible, return the
-@@ -215,10 +215,10 @@ protected:
-    * @param aRequireLeaf, only accept leaf accessible nodes
-    * @return the resulting accessible
-    */   
--  already_AddRefed<nsIAccessible> GetFirstAvailableAccessible(nsIDOMNode *aStartNode, PRBool aRequireLeaf = PR_FALSE);
-+  nsIAccessible* GetFirstAvailableAccessible(nsIDOMNode *aStartNode, PRBool aRequireLeaf = PR_FALSE);
- 
-   // Selection helpers
--  static already_AddRefed<nsIAccessible> GetMultiSelectFor(nsIDOMNode *aNode);
-+  static nsIAccessible* GetMultiSelectFor(nsIDOMNode *aNode);
- 
-   // Hyperlink helpers
-   virtual nsresult GetLinkOffset(PRInt32* aStartOffset, PRInt32* aEndOffset);
-diff --git a/accessible/src/base/nsAccessibleEventData.cpp b/accessible/src/base/nsAccessibleEventData.cpp
---- a/accessible/src/base/nsAccessibleEventData.cpp
-+++ b/accessible/src/base/nsAccessibleEventData.cpp
-@@ -88,8 +88,8 @@ void nsAccEvent::GetLastEventAttributes(
- 
- void nsAccEvent::CaptureIsFromUserInput(PRBool aIsAsynch)
- {
--  nsCOMPtr<nsIDOMNode> eventNode;
--  GetDOMNode(getter_AddRefs(eventNode));
-+  nsIDOMNode* eventNode = nsnull;
-+  GetDOMNode(&eventNode);
-   if (!eventNode) {
-     NS_NOTREACHED("There should always be a DOM node for an event");
-     return;
-@@ -124,8 +124,8 @@ void nsAccEvent::PrepareForEvent(nsIAcce
-                                  PRBool aForceIsFromUserInput)
- {
-   gLastEventFromUserInput = aForceIsFromUserInput;
--  nsCOMPtr<nsIDOMNode> eventNode;
--  aEvent->GetDOMNode(getter_AddRefs(eventNode));
-+  nsIDOMNode* eventNode = nsnull;
-+  aEvent->GetDOMNode(&eventNode);
-   if (!gLastEventFromUserInput) {  // Caller is not forcing user input flag
-     aEvent->GetIsFromUserInput(&gLastEventFromUserInput);
-     if (!gLastEventFromUserInput) {
-@@ -152,18 +152,18 @@ void nsAccEvent::PrepareForEvent(nsIDOMN
-     return;
-   }
- 
--  nsCOMPtr<nsIDOMDocument> domDoc;
--  aEventNode->GetOwnerDocument(getter_AddRefs(domDoc));
-+  nsIDOMDocument* domDoc = nsnull;
-+  aEventNode->GetOwnerDocument(&domDoc);
-   if (!domDoc) {  // IF the node is a document itself
-     domDoc = do_QueryInterface(aEventNode);
-   }
--  nsCOMPtr<nsIDocument> doc = do_QueryInterface(domDoc);
-+  nsIDocument* doc = do_QueryInterface(domDoc);
-   if (!doc) {
-     NS_NOTREACHED("There should always be a document for an event");
-     return;
-   }
- 
--  nsCOMPtr<nsIPresShell> presShell = doc->GetPrimaryShell();
-+  nsIPresShell* presShell = doc->GetPrimaryShell();
-   if (!presShell) {
-     NS_NOTREACHED("Threre should always be an pres shell for an event");
-     return;
-@@ -205,7 +205,7 @@ nsAccEvent::GetDOMNode(nsIDOMNode **aDOM
-   *aDOMNode = nsnull;
- 
-   if (!mDOMNode) {
--    nsCOMPtr<nsIAccessNode> accessNode(do_QueryInterface(mAccessible));
-+    nsIAccessNode* accessNode(do_QueryInterface(mAccessible));
-     NS_ENSURE_TRUE(accessNode, NS_ERROR_FAILURE);
-     accessNode->GetDOMNode(getter_AddRefs(mDOMNode));
-   }
-@@ -222,11 +222,11 @@ nsAccEvent::GetAccessibleDocument(nsIAcc
- 
-   if (!mDocAccessible) {
-     if (!mAccessible) {
--      nsCOMPtr<nsIAccessible> accessible;
--      GetAccessible(getter_AddRefs(accessible));
-+      nsIAccessible* accessible = nsnull;
-+      GetAccessible(&accessible);
-     }
- 
--    nsCOMPtr<nsIAccessNode> accessNode(do_QueryInterface(mAccessible));
-+    nsIAccessNode* accessNode(do_QueryInterface(mAccessible));
-     NS_ENSURE_TRUE(accessNode, NS_ERROR_FAILURE);
-     accessNode->GetAccessibleDocument(getter_AddRefs(mDocAccessible));
-   }
-@@ -235,13 +235,13 @@ nsAccEvent::GetAccessibleDocument(nsIAcc
-   return NS_OK;
- }
- 
--already_AddRefed<nsIAccessible>
-+nsIAccessible*
- nsAccEvent::GetAccessibleByNode()
- {
-   if (!mDOMNode)
-     return nsnull;
- 
--  nsCOMPtr<nsIAccessibilityService> accService = 
-+  nsIAccessibilityService* accService = 
-     do_GetService("@mozilla.org/accessibilityService;1");
-   if (!accService)
-     return nsnull;
-@@ -256,20 +256,20 @@ nsAccEvent::GetAccessibleByNode()
-   nsAutoString localName;
-   mDOMNode->GetLocalName(localName);
-   if (localName.EqualsLiteral("tree")) {
--    nsCOMPtr<nsIDOMXULMultiSelectControlElement> multiSelect =
-+    nsIDOMXULMultiSelectControlElement* multiSelect =
-       do_QueryInterface(mDOMNode);
-     if (multiSelect) {
-       PRInt32 treeIndex = -1;
-       multiSelect->GetCurrentIndex(&treeIndex);
-       if (treeIndex >= 0) {
--        nsCOMPtr<nsIAccessibleTreeCache> treeCache(do_QueryInterface(accessible));
-+        nsIAccessibleTreeCache* treeCache(do_QueryInterface(accessible));
-         NS_IF_RELEASE(accessible);
--        nsCOMPtr<nsIAccessible> treeItemAccessible;
-+        nsIAccessible* treeItemAccessible = nsnull;
-         if (!treeCache ||
-             NS_FAILED(treeCache->GetCachedTreeitemAccessible(
-                       treeIndex,
-                       nsnull,
--                      getter_AddRefs(treeItemAccessible))) ||
-+                      &treeItemAccessible)) ||
-                       !treeItemAccessible) {
-           return nsnull;
-         }
-@@ -288,12 +288,12 @@ nsAccEvent::ApplyEventRules(nsCOMArray<n
- {
-   PRUint32 numQueuedEvents = aEventsToFire.Count();
-   for (PRInt32 tail = numQueuedEvents - 1; tail >= 0; tail --) {
--    nsRefPtr<nsAccEvent> tailEvent = GetAccEventPtr(aEventsToFire[tail]);
-+    nsAccEvent* tailEvent = GetAccEventPtr(aEventsToFire[tail]);
-     switch(tailEvent->mEventRule) {
-       case nsAccEvent::eCoalesceFromSameSubtree:
-       {
-         for (PRInt32 index = 0; index < tail; index ++) {
--          nsRefPtr<nsAccEvent> thisEvent = GetAccEventPtr(aEventsToFire[index]);
-+          nsAccEvent* thisEvent = GetAccEventPtr(aEventsToFire[index]);
-           if (thisEvent->mEventType != tailEvent->mEventType)
-             continue; // Different type
- 
-@@ -342,7 +342,7 @@ nsAccEvent::ApplyEventRules(nsCOMArray<n
-       {
-         // Check for repeat events.
-         for (PRInt32 index = 0; index < tail; index ++) {
--          nsRefPtr<nsAccEvent> accEvent = GetAccEventPtr(aEventsToFire[index]);
-+          nsAccEvent* accEvent = GetAccEventPtr(aEventsToFire[index]);
-           if (accEvent->mEventType == tailEvent->mEventType &&
-               accEvent->mEventRule == tailEvent->mEventRule &&
-               accEvent->mDOMNode == tailEvent->mDOMNode) {
-@@ -362,7 +362,7 @@ nsAccEvent::ApplyToSiblings(nsCOMArray<n
-                              EEventRule aEventRule)
- {
-   for (PRUint32 index = aStart; index < aEnd; index ++) {
--    nsRefPtr<nsAccEvent> accEvent = GetAccEventPtr(aEventsToFire[index]);
-+    nsAccEvent* accEvent = GetAccEventPtr(aEventsToFire[index]);
-     if (accEvent->mEventType == aEventType &&
-         accEvent->mEventRule != nsAccEvent::eDoNotEmit &&
-         nsAccUtils::AreSiblings(accEvent->mDOMNode, aDOMNode)) {
-@@ -402,7 +402,7 @@ nsAccStateChangeEvent::
-   // Use GetAccessibleByNode() because we do not want to store an accessible
-   // since it leads to problems with delayed events in the case when
-   // an accessible gets reorder event before delayed event is processed.
--  nsCOMPtr<nsIAccessible> accessible(GetAccessibleByNode());
-+  nsIAccessible* accessible(GetAccessibleByNode());
-   if (accessible) {
-     PRUint32 state = 0, extraState = 0;
-     accessible->GetFinalState(&state, mIsExtraState ? &extraState : nsnull);
-@@ -445,7 +445,7 @@ nsAccTextChangeEvent::
-              aAccessible, aIsAsynch),
-   mStart(aStart), mLength(aLength), mIsInserted(aIsInserted)
- {
--  nsCOMPtr<nsIAccessibleText> textAccessible = do_QueryInterface(aAccessible);
-+  nsIAccessibleText* textAccessible = do_QueryInterface(aAccessible);
-   NS_ASSERTION(textAccessible, "Should not be firing test change event for non-text accessible!!!");
-   if (textAccessible) {
-     textAccessible->GetText(aStart, aStart + aLength, mModifiedText);
-diff --git a/accessible/src/base/nsAccessibleEventData.h b/accessible/src/base/nsAccessibleEventData.h
---- a/accessible/src/base/nsAccessibleEventData.h
-+++ b/accessible/src/base/nsAccessibleEventData.h
-@@ -100,7 +100,7 @@ public:
-                                      nsIPersistentProperties *aAttributes);
- 
- protected:
--  already_AddRefed<nsIAccessible> GetAccessibleByNode();
-+  nsIAccessible* GetAccessibleByNode();
- 
-   void CaptureIsFromUserInput(PRBool aIsAsynch);
-   PRBool mIsFromUserInput;
-@@ -122,7 +122,7 @@ public:
-     return eventType;
-   }
-   static EEventRule EventRule(nsIAccessibleEvent *aAccEvent) {
--    nsRefPtr<nsAccEvent> accEvent = GetAccEventPtr(aAccEvent);
-+    nsAccEvent* accEvent = GetAccEventPtr(aAccEvent);
-     return accEvent->mEventRule;
-   }
-   static PRBool IsFromUserInput(nsIAccessibleEvent *aAccEvent) {
-@@ -164,7 +164,7 @@ public:
-   static void ApplyEventRules(nsCOMArray<nsIAccessibleEvent> &aEventsToFire);
- 
- private:
--  static already_AddRefed<nsAccEvent> GetAccEventPtr(nsIAccessibleEvent *aAccEvent) {
-+  static nsAccEvent* GetAccEventPtr(nsIAccessibleEvent *aAccEvent) {
-     nsAccEvent* accEvent = nsnull;
-     aAccEvent->QueryInterface(NS_GET_IID(nsAccEvent), (void**)&accEvent);
-     return accEvent;
-diff --git a/accessible/src/base/nsAccessibleRelation.cpp b/accessible/src/base/nsAccessibleRelation.cpp
---- a/accessible/src/base/nsAccessibleRelation.cpp
-+++ b/accessible/src/base/nsAccessibleRelation.cpp
-@@ -86,7 +86,7 @@ nsAccessibleRelation::GetTargets(nsIArra
- {
-   NS_ENSURE_ARG_POINTER(aRelations);
- 
--  nsCOMPtr<nsIMutableArray> relations = do_CreateInstance(NS_ARRAY_CONTRACTID);
-+  nsIMutableArray* relations = do_CreateInstance(NS_ARRAY_CONTRACTID);
-   NS_ENSURE_TRUE(relations, NS_ERROR_OUT_OF_MEMORY);
- 
-   relations->AppendElement(mTarget, PR_FALSE);
-diff --git a/accessible/src/base/nsAccessibleTreeWalker.cpp b/accessible/src/base/nsAccessibleTreeWalker.cpp
---- a/accessible/src/base/nsAccessibleTreeWalker.cpp
-+++ b/accessible/src/base/nsAccessibleTreeWalker.cpp
-@@ -71,7 +71,7 @@ nsAccessibleTreeWalker::~nsAccessibleTre
- 
- void nsAccessibleTreeWalker::GetKids(nsIDOMNode *aParentNode)
- {
--  nsCOMPtr<nsIContent> parentContent(do_QueryInterface(aParentNode));
-+  nsIContent* parentContent(do_QueryInterface(aParentNode));
-   if (!parentContent || !parentContent->IsNodeOfType(nsINode::eHTML)) {
-     mState.frame = nsnull;  // Don't walk frames in non-HTML content, just walk the DOM.
-   }
-@@ -209,7 +209,7 @@ NS_IMETHODIMP nsAccessibleTreeWalker::Ge
-     return NS_ERROR_FAILURE;
-   }
- 
--  nsCOMPtr<nsIDOMNode> parent(mState.domNode);
-+  nsIDOMNode* parent(mState.domNode);
-   GetKids(parent); // Side effects change our state (mState)
- 
-   // Recursive loop: depth first search for first accessible child
-@@ -282,7 +282,7 @@ PRBool nsAccessibleTreeWalker::GetAccess
-   }
- 
-   mState.accessible = nsnull;
--  nsCOMPtr<nsIPresShell> presShell(do_QueryReferent(mWeakShell));
-+  nsIPresShell* presShell(do_QueryReferent(mWeakShell));
- 
-   mAccService->GetAccessible(mState.domNode, presShell, mWeakShell,
-                              &mState.frame, &mState.isHidden,
-diff --git a/accessible/src/base/nsAccessibleTreeWalker.h b/accessible/src/base/nsAccessibleTreeWalker.h
---- a/accessible/src/base/nsAccessibleTreeWalker.h
-+++ b/accessible/src/base/nsAccessibleTreeWalker.h
-@@ -89,8 +89,8 @@ protected:
-   void UpdateFrame(PRBool aTryFirstChild);
-   void GetNextDOMNode();
- 
--  nsCOMPtr<nsIWeakReference> mWeakShell;
--  nsCOMPtr<nsIAccessibilityService> mAccService;
-+  nsIWeakReference* mWeakShell;
-+  nsIAccessibilityService* mAccService;
-   PRBool mWalkAnonContent;
- };
- 
-diff --git a/accessible/src/base/nsApplicationAccessible.cpp b/accessible/src/base/nsApplicationAccessible.cpp
---- a/accessible/src/base/nsApplicationAccessible.cpp
-+++ b/accessible/src/base/nsApplicationAccessible.cpp
-@@ -68,15 +68,15 @@ NS_IMETHODIMP
- NS_IMETHODIMP
- nsApplicationAccessible::GetName(nsAString& aName)
- {
--  nsCOMPtr<nsIStringBundleService> bundleService =
-+  nsIStringBundleService* bundleService =
-     do_GetService(NS_STRINGBUNDLE_CONTRACTID);
- 
-   NS_ASSERTION(bundleService, "String bundle service must be present!");
-   NS_ENSURE_STATE(bundleService);
- 
--  nsCOMPtr<nsIStringBundle> bundle;
-+  nsIStringBundle* bundle = nsnull;
-   bundleService->CreateBundle("chrome://branding/locale/brand.properties",
--                              getter_AddRefs(bundle));
-+                              &bundle);
- 
-   nsXPIDLString appName;
-   if (bundle) {
-@@ -141,13 +141,13 @@ nsApplicationAccessible::GetChildAt(PRIn
-   if (aChildNum < 0)
-     aChildNum = count - 1;
- 
--  nsCOMPtr<nsIWeakReference> childWeakRef;
-+  nsIWeakReference* childWeakRef = nsnull;
-   rv = mChildren->QueryElementAt(aChildNum, NS_GET_IID(nsIWeakReference),
--                                 getter_AddRefs(childWeakRef));
-+                                 (void**)&childWeakRef);
-   NS_ENSURE_SUCCESS(rv, rv);
- 
-   if (childWeakRef) {
--    nsCOMPtr<nsIAccessible> childAcc(do_QueryReferent(childWeakRef));
-+    nsIAccessible* childAcc(do_QueryReferent(childWeakRef));
-     NS_IF_ADDREF(*aChild = childAcc);
-   }
- 
-@@ -191,16 +191,16 @@ nsApplicationAccessible::CacheChildren()
- 
-   if (mAccChildCount == eChildCountUninitialized) {
-     mAccChildCount = 0;// Prevent reentry
--    nsCOMPtr<nsISimpleEnumerator> enumerator;
--    mChildren->Enumerate(getter_AddRefs(enumerator));
-+    nsISimpleEnumerator* enumerator = nsnull;
-+    mChildren->Enumerate(&enumerator);
- 
--    nsCOMPtr<nsIWeakReference> childWeakRef;
--    nsCOMPtr<nsIAccessible> accessible;
--    nsCOMPtr<nsPIAccessible> previousAccessible;
-+    nsIWeakReference* childWeakRef = nsnull;
-+    nsIAccessible* accessible = nsnull;
-+    nsPIAccessible* previousAccessible = nsnull;
-     PRBool hasMoreElements;
-     while(NS_SUCCEEDED(enumerator->HasMoreElements(&hasMoreElements))
-           && hasMoreElements) {
--      enumerator->GetNext(getter_AddRefs(childWeakRef));
-+      enumerator->GetNext((nsISupports**)&childWeakRef);
-       accessible = do_QueryReferent(childWeakRef);
-       if (accessible) {
-         if (previousAccessible)
-@@ -242,7 +242,7 @@ nsApplicationAccessible::RemoveRootAcces
-   PRUint32 index = 0;
- 
-   // we must use weak ref to get the index
--  nsCOMPtr<nsIWeakReference> weakPtr = do_GetWeakReference(aRootAccessible);
-+  nsIWeakReference* weakPtr = do_GetWeakReference(aRootAccessible);
-   nsresult rv = mChildren->IndexOf(0, weakPtr, &index);
-   NS_ENSURE_SUCCESS(rv, rv);
- 
-diff --git a/accessible/src/base/nsBaseWidgetAccessible.cpp b/accessible/src/base/nsBaseWidgetAccessible.cpp
---- a/accessible/src/base/nsBaseWidgetAccessible.cpp
-+++ b/accessible/src/base/nsBaseWidgetAccessible.cpp
-@@ -114,7 +114,7 @@ NS_IMETHODIMP
- NS_IMETHODIMP
- nsLinkableAccessible::TakeFocus()
- {
--  nsCOMPtr<nsIAccessible> actionAcc = GetActionAccessible();
-+  nsIAccessible* actionAcc = GetActionAccessible();
-   if (actionAcc)
-     return actionAcc->TakeFocus();
- 
-@@ -129,7 +129,7 @@ nsLinkableAccessible::GetState(PRUint32 
- 
-   if (mIsLink) {
-     *aState |= nsIAccessibleStates::STATE_LINKED;
--    nsCOMPtr<nsIAccessible> actionAcc = GetActionAccessible();
-+    nsIAccessible* actionAcc = GetActionAccessible();
-     if (actionAcc && (State(actionAcc) & nsIAccessibleStates::STATE_TRAVERSED))
-       *aState |= nsIAccessibleStates::STATE_TRAVERSED;
-   }
-@@ -147,7 +147,7 @@ nsLinkableAccessible::GetValue(nsAString
-     return NS_OK;
- 
-   if (mIsLink) {
--    nsCOMPtr<nsIAccessible> actionAcc = GetActionAccessible();
-+    nsIAccessible* actionAcc = GetActionAccessible();
-     if (actionAcc)
-       return actionAcc->GetValue(aValue);
-   }
-@@ -188,7 +188,7 @@ NS_IMETHODIMP
- NS_IMETHODIMP
- nsLinkableAccessible::DoAction(PRUint8 aIndex)
- {
--  nsCOMPtr<nsIAccessible> actionAcc = GetActionAccessible();
-+  nsIAccessible* actionAcc = GetActionAccessible();
-   if (actionAcc)
-     return actionAcc->DoAction(aIndex);
- 
-@@ -200,7 +200,7 @@ nsLinkableAccessible::GetKeyboardShortcu
- {
-   aKeyboardShortcut.Truncate();
- 
--  nsCOMPtr<nsIAccessible> actionAcc = GetActionAccessible();
-+  nsIAccessible* actionAcc = GetActionAccessible();
-   if (actionAcc)
-     return actionAcc->GetKeyboardShortcut(aKeyboardShortcut);
- 
-@@ -214,9 +214,9 @@ nsLinkableAccessible::GetURI(PRInt32 aIn
- nsLinkableAccessible::GetURI(PRInt32 aIndex, nsIURI **aURI)
- {
-   if (mIsLink) {
--    nsCOMPtr<nsIAccessible> actionAcc = GetActionAccessible();
-+    nsIAccessible* actionAcc = GetActionAccessible();
-     if (actionAcc) {
--      nsCOMPtr<nsIAccessibleHyperLink> hyperLinkAcc =
-+      nsIAccessibleHyperLink* hyperLinkAcc =
-         do_QueryInterface(actionAcc);
-       NS_ASSERTION(hyperLinkAcc,
-                    "nsIAccessibleHyperLink isn't implemented.");
-@@ -252,7 +252,7 @@ void
- void
- nsLinkableAccessible::CacheActionContent()
- {
--  nsCOMPtr<nsIContent> walkUpContent(do_QueryInterface(mDOMNode));
-+  nsIContent* walkUpContent(do_QueryInterface(mDOMNode));
-   PRBool isOnclick = nsAccUtils::HasListener(walkUpContent,
-                                              NS_LITERAL_STRING("click"));
- 
-@@ -266,11 +266,11 @@ nsLinkableAccessible::CacheActionContent
-     isOnclick = nsAccUtils::HasListener(walkUpContent,
-                                         NS_LITERAL_STRING("click"));
-   
--    nsCOMPtr<nsIDOMNode> walkUpNode(do_QueryInterface(walkUpContent));
-+    nsIDOMNode* walkUpNode(do_QueryInterface(walkUpContent));
- 
--    nsCOMPtr<nsIAccessible> walkUpAcc;
-+    nsIAccessible* walkUpAcc = nsnull;
-     GetAccService()->GetAccessibleInWeakShell(walkUpNode, mWeakShell,
--                                              getter_AddRefs(walkUpAcc));
-+                                              &walkUpAcc);
- 
-     if (walkUpAcc && Role(walkUpAcc) == nsIAccessibleRole::ROLE_LINK &&
-         (State(walkUpAcc) & nsIAccessibleStates::STATE_LINKED)) {
-@@ -287,14 +287,14 @@ nsLinkableAccessible::CacheActionContent
-   }
- }
- 
--already_AddRefed<nsIAccessible>
-+nsIAccessible*
- nsLinkableAccessible::GetActionAccessible()
- {
-   // Return accessible for the action content if it's different from node of
-   // this accessible. If the action accessible is not null then it is used to
-   // redirect methods calls otherwise we use method implementation from the
-   // base class.
--  nsCOMPtr<nsIDOMNode> actionNode(do_QueryInterface(mActionContent));
-+  nsIDOMNode* actionNode(do_QueryInterface(mActionContent));
-   if (!actionNode || mDOMNode == actionNode)
-     return nsnull;
- 
-diff --git a/accessible/src/base/nsBaseWidgetAccessible.h b/accessible/src/base/nsBaseWidgetAccessible.h
---- a/accessible/src/base/nsBaseWidgetAccessible.h
-+++ b/accessible/src/base/nsBaseWidgetAccessible.h
-@@ -101,7 +101,7 @@ protected:
-   /**
-    * Return an accessible for cached action node.
-    */
--  already_AddRefed<nsIAccessible> GetActionAccessible();
-+  nsIAccessible* GetActionAccessible();
- 
-   /**
-    * Cache action node.
-diff --git a/accessible/src/base/nsCaretAccessible.cpp b/accessible/src/base/nsCaretAccessible.cpp
---- a/accessible/src/base/nsCaretAccessible.cpp
-+++ b/accessible/src/base/nsCaretAccessible.cpp
-@@ -81,7 +81,7 @@ nsresult nsCaretAccessible::ClearControl
-   mCurrentControl = nsnull;
-   mCurrentControlSelection = nsnull;
- 
--  nsCOMPtr<nsISelectionPrivate> selPrivate(do_QueryReferent(mCurrentControlSelection));
-+  nsISelectionPrivate* selPrivate(do_QueryReferent(mCurrentControlSelection));
-   if (!selPrivate) {
-     return NS_OK;
-   }
-@@ -100,15 +100,15 @@ nsresult nsCaretAccessible::SetControlSe
- 
-   // When focus moves such that the caret is part of a new frame selection
-   // this removes the old selection listener and attaches a new one for the current focus
--  nsCOMPtr<nsIPresShell> presShell = 
-+  nsIPresShell* presShell = 
-     mRootAccessible->GetPresShellFor(aCurrentNode);
-   if (!presShell)
-     return NS_ERROR_FAILURE;
- 
--  nsCOMPtr<nsIDocument> doc = presShell->GetDocument();
-+  nsIDocument* doc = presShell->GetDocument();
-   NS_ENSURE_TRUE(doc, NS_ERROR_FAILURE);
- 
--  nsCOMPtr<nsIContent> content(do_QueryInterface(aCurrentNode));
-+  nsIContent* content(do_QueryInterface(aCurrentNode));
-   // The control selection listener is only for form controls, not for the document
-   // When there is no document, the content will be null
-   if (!content) {
-@@ -121,14 +121,14 @@ nsresult nsCaretAccessible::SetControlSe
-   nsPresContext *presContext = presShell->GetPresContext();
-   NS_ENSURE_TRUE(presContext, NS_ERROR_FAILURE);
- 
--  nsCOMPtr<nsISelectionController> selCon;
--  frame->GetSelectionController(presContext, getter_AddRefs(selCon));
-+  nsISelectionController* selCon = nsnull;
-+  frame->GetSelectionController(presContext, &selCon);
-   NS_ENSURE_TRUE(selCon, NS_ERROR_FAILURE);
-   
--  nsCOMPtr<nsISelection> domSel;
--  selCon->GetSelection(nsISelectionController::SELECTION_NORMAL, getter_AddRefs(domSel));
-+  nsISelection* domSel = nsnull;
-+  selCon->GetSelection(nsISelectionController::SELECTION_NORMAL, &domSel);
- 
--  nsCOMPtr<nsISelectionPrivate> selPrivate(do_QueryInterface(domSel));
-+  nsISelectionPrivate* selPrivate(do_QueryInterface(domSel));
-   NS_ENSURE_TRUE(selPrivate, NS_ERROR_FAILURE);
- 
-   mCurrentControlSelection = do_GetWeakReference(domSel);
-@@ -140,12 +140,12 @@ nsCaretAccessible::AddDocSelectionListen
- {
-   NS_ENSURE_TRUE(mRootAccessible, NS_ERROR_FAILURE);
- 
--  nsCOMPtr<nsISelectionController> selCon = do_QueryInterface(aShell);
-+  nsISelectionController* selCon = do_QueryInterface(aShell);
-   NS_ENSURE_TRUE(selCon, NS_ERROR_FAILURE);
- 
--  nsCOMPtr<nsISelection> domSel;
--  selCon->GetSelection(nsISelectionController::SELECTION_NORMAL, getter_AddRefs(domSel));
--  nsCOMPtr<nsISelectionPrivate> selPrivate = do_QueryInterface(domSel);
-+  nsISelection* domSel = nsnull;
-+  selCon->GetSelection(nsISelectionController::SELECTION_NORMAL, &domSel);
-+  nsISelectionPrivate* selPrivate = do_QueryInterface(domSel);
-   NS_ENSURE_TRUE(selPrivate, NS_ERROR_FAILURE);
- 
-   return selPrivate->AddSelectionListener(this);
-@@ -154,12 +154,12 @@ nsresult
- nsresult
- nsCaretAccessible::RemoveDocSelectionListener(nsIPresShell *aShell)
- {
--  nsCOMPtr<nsISelectionController> selCon = do_QueryInterface(aShell);
-+  nsISelectionController* selCon = do_QueryInterface(aShell);
-   NS_ENSURE_TRUE(selCon, NS_ERROR_FAILURE);
- 
--  nsCOMPtr<nsISelection> domSel;
--  selCon->GetSelection(nsISelectionController::SELECTION_NORMAL, getter_AddRefs(domSel));
--  nsCOMPtr<nsISelectionPrivate> selPrivate = do_QueryInterface(domSel);
-+  nsISelection* domSel = nsnull;
-+  selCon->GetSelection(nsISelectionController::SELECTION_NORMAL, &domSel);
-+  nsISelectionPrivate* selPrivate = do_QueryInterface(domSel);
-   NS_ENSURE_TRUE(selPrivate, NS_ERROR_FAILURE);
- 
-   return selPrivate->RemoveSelectionListener(this);
-@@ -171,26 +171,26 @@ NS_IMETHODIMP nsCaretAccessible::NotifyS
- 
-   mLastUsedSelection = do_GetWeakReference(aSel);
- 
--  nsCOMPtr<nsIDocument> doc = do_QueryInterface(aDoc);
-+  nsIDocument* doc = do_QueryInterface(aDoc);
-   NS_ENSURE_TRUE(doc, NS_OK);
-   nsIPresShell *presShell = doc->GetPrimaryShell();
-   NS_ENSURE_TRUE(presShell, NS_OK);
- 
-   // Get first nsIAccessibleText in parent chain and fire caret-move, selection-change event for it
--  nsCOMPtr<nsIAccessible> accessible;
-+  nsIAccessible* accessible = nsnull;
-   nsIAccessibilityService *accService = mRootAccessible->GetAccService();
-   NS_ENSURE_TRUE(accService, NS_ERROR_FAILURE);
-   // Get accessible from selection's focus node or its parent
--  nsCOMPtr<nsIDOMNode> focusNode;
--  aSel->GetFocusNode(getter_AddRefs(focusNode));
-+  nsIDOMNode* focusNode = nsnull;
-+  aSel->GetFocusNode(&focusNode);
-   if (!focusNode) {
-     mLastTextAccessible = nsnull;
-     return NS_OK; // No selection
-   }
- 
--  nsCOMPtr<nsIAccessibleDocument> docAccessible =
-+  nsIAccessibleDocument* docAccessible =
-     nsAccessNode::GetDocAccessibleFor(focusNode);
--  nsCOMPtr<nsIAccessible> accessibleForDoc =
-+  nsIAccessible* accessibleForDoc =
-     do_QueryInterface(docAccessible);
-   if (!accessibleForDoc) {
-     return NS_OK;
-@@ -201,27 +201,27 @@ NS_IMETHODIMP nsCaretAccessible::NotifyS
-     return NS_OK;  // Don't fire caret moves until doc loaded
-   }
- 
--  nsCOMPtr<nsIDOMNode> nodeWithCaret = focusNode;
-+  nsIDOMNode* nodeWithCaret = focusNode;
- 
--  nsCOMPtr<nsIAccessibleText> textAcc;
-+  nsIAccessibleText* textAcc = nsnull;
-   while (focusNode) {
-     // Make sure to get the correct starting node for selection events inside XBL content trees
--    nsCOMPtr<nsIDOMNode> relevantNode;
--    if (NS_SUCCEEDED(accService->GetRelevantContentNodeFor(focusNode, getter_AddRefs(relevantNode))) && relevantNode) {
-+    nsIDOMNode* relevantNode = nsnull;
-+    if (NS_SUCCEEDED(accService->GetRelevantContentNodeFor(focusNode, &relevantNode)) && relevantNode) {
-       focusNode  = relevantNode;
-     }
- 
--    nsCOMPtr<nsIContent> content = do_QueryInterface(focusNode);
-+    nsIContent* content = do_QueryInterface(focusNode);
-     if (!content || !content->IsNodeOfType(nsINode::eTEXT)) {
--      accService->GetAccessibleInShell(focusNode, presShell,  getter_AddRefs(accessible));
-+      accService->GetAccessibleInShell(focusNode, presShell,  &accessible);
-       textAcc = do_QueryInterface(accessible);
-       if (textAcc) {
-         break;
-       }
-     }
--    nsCOMPtr<nsIDOMNode> parentNode;
--    focusNode->GetParentNode(getter_AddRefs(parentNode));
--    focusNode.swap(parentNode);
-+    nsIDOMNode* parentNode = nsnull;
-+    focusNode->GetParentNode(&parentNode);
-+    swap(focusNode, parentNode);
-   }
-   NS_ASSERTION(textAcc, "No nsIAccessibleText for caret move event!"); // No nsIAccessibleText for caret move event!
-   NS_ENSURE_TRUE(textAcc, NS_ERROR_FAILURE);
-@@ -240,7 +240,7 @@ NS_IMETHODIMP nsCaretAccessible::NotifyS
-   mLastCaretOffset = caretOffset;
-   mLastTextAccessible = textAcc;
- 
--  nsCOMPtr<nsIAccessibleCaretMoveEvent> event =
-+  nsIAccessibleCaretMoveEvent* event =
-     new nsAccCaretMoveEvent(focusNode);
-   NS_ENSURE_TRUE(event, NS_ERROR_OUT_OF_MEMORY);
- 
-@@ -259,23 +259,23 @@ nsCaretAccessible::GetCaretRect(nsIWidge
-     return caretRect;    // Return empty rect
-   }
- 
--  nsCOMPtr<nsIAccessNode> lastAccessNode(do_QueryInterface(mLastTextAccessible));
-+  nsIAccessNode* lastAccessNode(do_QueryInterface(mLastTextAccessible));
-   NS_ENSURE_TRUE(lastAccessNode, caretRect);
- 
--  nsCOMPtr<nsIDOMNode> lastNodeWithCaret;
--  lastAccessNode->GetDOMNode(getter_AddRefs(lastNodeWithCaret));
-+  nsIDOMNode* lastNodeWithCaret = nsnull;
-+  lastAccessNode->GetDOMNode(&lastNodeWithCaret);
-   NS_ENSURE_TRUE(lastNodeWithCaret, caretRect);
- 
--  nsCOMPtr<nsIPresShell> presShell = mRootAccessible->GetPresShellFor(lastNodeWithCaret);
-+  nsIPresShell* presShell = mRootAccessible->GetPresShellFor(lastNodeWithCaret);
-   NS_ENSURE_TRUE(presShell, caretRect);
- 
--  nsCOMPtr<nsICaret> caret;
--  presShell->GetCaret(getter_AddRefs(caret));
-+  nsICaret* caret = nsnull;
-+  presShell->GetCaret(&caret);
-   NS_ENSURE_TRUE(caret, caretRect);
- 
-   PRBool isCollapsed;
-   nsIView *view;
--  nsCOMPtr<nsISelection> caretSelection(do_QueryReferent(mLastUsedSelection));
-+  nsISelection* caretSelection(do_QueryReferent(mLastUsedSelection));
-   NS_ENSURE_TRUE(caretSelection, caretRect);
-   
-   caret->GetCaretCoordinates(nsICaret::eRenderingViewCoordinates, caretSelection,
-diff --git a/accessible/src/base/nsDocAccessible.cpp b/accessible/src/base/nsDocAccessible.cpp
---- a/accessible/src/base/nsDocAccessible.cpp
-+++ b/accessible/src/base/nsDocAccessible.cpp
-@@ -97,7 +97,7 @@ nsDocAccessible::nsDocAccessible(nsIDOMN
-   // there can be 2 nsDocAccessible's for the content area, although for 2 different
-   // pres shells.
- 
--  nsCOMPtr<nsIPresShell> shell(do_QueryReferent(mWeakShell));
-+  nsIPresShell* shell(do_QueryReferent(mWeakShell));
-   if (shell) {
-     // Find mDocument
-     mDocument = shell->GetDocument();
-@@ -105,8 +105,8 @@ nsDocAccessible::nsDocAccessible(nsIDOMN
-     // Find mWnd
-     nsIViewManager* vm = shell->GetViewManager();
-     if (vm) {
--      nsCOMPtr<nsIWidget> widget;
--      vm->GetWidget(getter_AddRefs(widget));
-+      nsIWidget* widget = nsnull;
-+      vm->GetWidget(&widget);
-       if (widget) {
-         mWnd = widget->GetNativeData(NS_NATIVE_WINDOW);
-       }
-@@ -116,9 +116,9 @@ nsDocAccessible::nsDocAccessible(nsIDOMN
-   // XXX aaronl should we use an algorithm for the initial cache size?
-   mAccessNodeCache.Init(kDefaultCacheSize);
- 
--  nsCOMPtr<nsIDocShellTreeItem> docShellTreeItem =
-+  nsIDocShellTreeItem* docShellTreeItem =
-     nsAccUtils::GetDocShellTreeItemFor(mDOMNode);
--  nsCOMPtr<nsIDocShell> docShell = do_QueryInterface(docShellTreeItem);
-+  nsIDocShell* docShell = do_QueryInterface(docShellTreeItem);
-   if (docShell) {
-     PRUint32 busyFlags;
-     docShell->GetBusyFlags(&busyFlags);
-@@ -173,11 +173,11 @@ NS_IMETHODIMP nsDocAccessible::GetRole(P
- {
-   *aRole = nsIAccessibleRole::ROLE_PANE; // Fall back
- 
--  nsCOMPtr<nsIDocShellTreeItem> docShellTreeItem =
-+  nsIDocShellTreeItem* docShellTreeItem =
-     nsAccUtils::GetDocShellTreeItemFor(mDOMNode);
-   if (docShellTreeItem) {
--    nsCOMPtr<nsIDocShellTreeItem> sameTypeRoot;
--    docShellTreeItem->GetSameTypeRootTreeItem(getter_AddRefs(sameTypeRoot));
-+    nsIDocShellTreeItem* sameTypeRoot = nsnull;
-+    docShellTreeItem->GetSameTypeRootTreeItem(&sameTypeRoot);
-     PRInt32 itemType;
-     docShellTreeItem->GetItemType(&itemType);
-     if (sameTypeRoot == docShellTreeItem) {
-@@ -187,7 +187,7 @@ NS_IMETHODIMP nsDocAccessible::GetRole(P
-       }
-       else if (itemType == nsIDocShellTreeItem::typeContent) {
- #ifdef MOZ_XUL
--        nsCOMPtr<nsIXULDocument> xulDoc(do_QueryInterface(mDocument));
-+        nsIXULDocument* xulDoc(do_QueryInterface(mDocument));
-         if (xulDoc) {
-           *aRole = nsIAccessibleRole::ROLE_APPLICATION;
-         } else {
-@@ -216,7 +216,7 @@ NS_IMETHODIMP nsDocAccessible::SetRoleMa
-   nsIDocument *parentDoc = mDocument->GetParentDocument();
-   NS_ENSURE_TRUE(parentDoc, NS_ERROR_FAILURE);
-   nsIContent *ownerContent = parentDoc->FindContentForSubDocument(mDocument);
--  nsCOMPtr<nsIDOMNode> ownerNode(do_QueryInterface(ownerContent));
-+  nsIDOMNode* ownerNode(do_QueryInterface(ownerContent));
-   if (ownerNode) {
-     nsRoleMapEntry *roleMapEntry = nsAccUtils::GetRoleMapEntry(ownerNode);
-     if (roleMapEntry)
-@@ -250,7 +250,7 @@ nsDocAccessible::GetState(PRUint32 *aSta
-     return NS_OK;
- 
- #ifdef MOZ_XUL
--  nsCOMPtr<nsIXULDocument> xulDoc(do_QueryInterface(mDocument));
-+  nsIXULDocument* xulDoc(do_QueryInterface(mDocument));
-   if (!xulDoc)
- #endif
-   {
-@@ -281,8 +281,8 @@ nsDocAccessible::GetState(PRUint32 *aSta
-                nsIAccessibleStates::STATE_OFFSCREEN;
-   }
- 
--  nsCOMPtr<nsIEditor> editor;
--  GetAssociatedEditor(getter_AddRefs(editor));
-+  nsIEditor* editor = nsnull;
-+  GetAssociatedEditor(&editor);
-   if (!editor) {
-     *aState |= nsIAccessibleStates::STATE_READONLY;
-   }
-@@ -301,7 +301,7 @@ nsDocAccessible::GetARIAState(PRUint32 *
-   nsresult rv = nsAccessible::GetARIAState(aState);
-   NS_ENSURE_SUCCESS(rv, rv);
- 
--  nsCOMPtr<nsPIAccessible> privateParentAccessible = do_QueryInterface(mParent);
-+  nsPIAccessible* privateParentAccessible = do_QueryInterface(mParent);
-   if (privateParentAccessible)  // Allow iframe/frame etc. to have final state override via ARIA
-     return privateParentAccessible->GetARIAState(aState);
- 
-@@ -327,7 +327,7 @@ NS_IMETHODIMP nsDocAccessible::GetFocuse
- 
-   // Return an accessible for the current global focus, which does not have to
-   // be contained within the current document.
--  nsCOMPtr<nsIAccessibilityService> accService =
-+  nsIAccessibilityService* accService =
-     do_GetService("@mozilla.org/accessibilityService;1");
-   return accService->GetAccessibleFor(gLastFocusedNode, aFocusedChild);
- }
-@@ -341,12 +341,12 @@ NS_IMETHODIMP nsDocAccessible::TakeFocus
-     return NS_ERROR_FAILURE; // Not focusable
-   }
- 
--  nsCOMPtr<nsIDocShellTreeItem> treeItem =
-+  nsIDocShellTreeItem* treeItem =
-     nsAccUtils::GetDocShellTreeItemFor(mDOMNode);
--  nsCOMPtr<nsIDocShell> docShell = do_QueryInterface(treeItem);
-+  nsIDocShell* docShell = do_QueryInterface(treeItem);
-   NS_ENSURE_TRUE(docShell, NS_ERROR_FAILURE);
- 
--  nsCOMPtr<nsIPresShell> shell(GetPresShell());
-+  nsIPresShell* shell(GetPresShell());
-   if (!shell) {
-     NS_WARNING("Was not shutdown properly via InvalidateCacheSubtree()");
-     return NS_ERROR_FAILURE;
-@@ -369,12 +369,12 @@ NS_IMETHODIMP nsDocAccessible::GetURL(ns
-   if (!mDocument) {
-     return NS_ERROR_FAILURE; // Document has been shut down
-   }
--  nsCOMPtr<nsISupports> container = mDocument->GetContainer();
--  nsCOMPtr<nsIWebNavigation> webNav(do_GetInterface(container));
-+  nsISupports* container = mDocument->GetContainer();
-+  nsIWebNavigation* webNav(do_GetInterface(container));
-   nsCAutoString theURL;
-   if (webNav) {
--    nsCOMPtr<nsIURI> pURI;
--    webNav->GetCurrentURI(getter_AddRefs(pURI));
-+    nsIURI* pURI = nsnull;
-+    webNav->GetCurrentURI(&pURI);
-     if (pURI)
-       pURI->GetSpec(theURL);
-   }
-@@ -394,7 +394,7 @@ NS_IMETHODIMP nsDocAccessible::GetTitle(
- 
- NS_IMETHODIMP nsDocAccessible::GetMimeType(nsAString& aMimeType)
- {
--  nsCOMPtr<nsIDOMNSDocument> domnsDocument(do_QueryInterface(mDocument));
-+  nsIDOMNSDocument* domnsDocument(do_QueryInterface(mDocument));
-   if (domnsDocument) {
-     return domnsDocument->GetContentType(aMimeType);
-   }
-@@ -403,17 +403,17 @@ NS_IMETHODIMP nsDocAccessible::GetMimeTy
- 
- NS_IMETHODIMP nsDocAccessible::GetDocType(nsAString& aDocType)
- {
--  nsCOMPtr<nsIDOMDocument> domDoc(do_QueryInterface(mDocument));
--  nsCOMPtr<nsIDOMDocumentType> docType;
-+  nsIDOMDocument* domDoc(do_QueryInterface(mDocument));
-+  nsIDOMDocumentType* docType = nsnull;
- 
- #ifdef MOZ_XUL
--  nsCOMPtr<nsIXULDocument> xulDoc(do_QueryInterface(mDocument));
-+  nsIXULDocument* xulDoc(do_QueryInterface(mDocument));
-   if (xulDoc) {
-     aDocType.AssignLiteral("window"); // doctype not implemented for XUL at time of writing - causes assertion
-     return NS_OK;
-   } else
- #endif
--  if (domDoc && NS_SUCCEEDED(domDoc->GetDoctype(getter_AddRefs(docType))) && docType) {
-+  if (domDoc && NS_SUCCEEDED(domDoc->GetDoctype(&docType)) && docType) {
-     return docType->GetPublicId(aDocType);
-   }
- 
-@@ -423,7 +423,7 @@ NS_IMETHODIMP nsDocAccessible::GetNameSp
- NS_IMETHODIMP nsDocAccessible::GetNameSpaceURIForID(PRInt16 aNameSpaceID, nsAString& aNameSpaceURI)
- {
-   if (mDocument) {
--    nsCOMPtr<nsINameSpaceManager> nameSpaceManager =
-+    nsINameSpaceManager* nameSpaceManager =
-         do_GetService(NS_NAMESPACEMANAGER_CONTRACTID);
-     if (nameSpaceManager)
-       return nameSpaceManager->GetNameSpaceURI(aNameSpaceID, aNameSpaceURI);
-@@ -453,7 +453,7 @@ NS_IMETHODIMP nsDocAccessible::GetWindow
- 
- NS_IMETHODIMP nsDocAccessible::GetDocument(nsIDOMDocument **aDOMDoc)
- {
--  nsCOMPtr<nsIDOMDocument> domDoc(do_QueryInterface(mDocument));
-+  nsIDOMDocument* domDoc(do_QueryInterface(mDocument));
-   *aDOMDoc = domDoc;
- 
-   if (domDoc) {
-@@ -475,13 +475,13 @@ NS_IMETHODIMP nsDocAccessible::GetAssoci
-     return NS_OK; // Document not editable
-   }
- 
--  nsCOMPtr<nsISupports> container = mDocument->GetContainer();
--  nsCOMPtr<nsIEditingSession> editingSession(do_GetInterface(container));
-+  nsISupports* container = mDocument->GetContainer();
-+  nsIEditingSession* editingSession(do_GetInterface(container));
-   if (!editingSession)
-     return NS_OK; // No editing session interface
- 
--  nsCOMPtr<nsIEditor> editor;
--  editingSession->GetEditorForWindow(mDocument->GetWindow(), getter_AddRefs(editor));
-+  nsIEditor* editor = nsnull;
-+  editingSession->GetEditorForWindow(mDocument->GetWindow(), &editor);
-   if (!editor) {
-     return NS_OK;
-   }
-@@ -522,10 +522,10 @@ nsDocAccessible::CacheAccessNode(void *a
-   // The unique ID may be presented in the cache if originally we created
-   // access node object and then we want to create accessible object when
-   // DOM node is changed.
--  nsCOMPtr<nsIAccessNode> accessNode;
--  GetCacheEntry(mAccessNodeCache, aUniqueID, getter_AddRefs(accessNode));
-+  nsIAccessNode* accessNode = nsnull;
-+  GetCacheEntry(mAccessNodeCache, aUniqueID, &accessNode);
-   if (accessNode) {
--    nsCOMPtr<nsPIAccessNode> prAccessNode = do_QueryInterface(accessNode);
-+    nsPIAccessNode* prAccessNode = do_QueryInterface(accessNode);
-     prAccessNode->Shutdown();
-   }
- 
-@@ -542,9 +542,9 @@ NS_IMETHODIMP nsDocAccessible::GetParent
-     nsIDocument *parentDoc = mDocument->GetParentDocument();
-     NS_ENSURE_TRUE(parentDoc, NS_ERROR_FAILURE);
-     nsIContent *ownerContent = parentDoc->FindContentForSubDocument(mDocument);
--    nsCOMPtr<nsIDOMNode> ownerNode(do_QueryInterface(ownerContent));
-+    nsIDOMNode* ownerNode(do_QueryInterface(ownerContent));
-     if (ownerNode) {
--      nsCOMPtr<nsIAccessibilityService> accService =
-+      nsIAccessibilityService* accService =
-         do_GetService("@mozilla.org/accessibilityService;1");
-       if (accService) {
-         // XXX aaronl: ideally we would traverse the presshell chain
-@@ -565,8 +565,8 @@ NS_IMETHODIMP nsDocAccessible::Init()
- 
-   AddEventListeners();
- 
--  nsCOMPtr<nsIAccessible> parentAccessible;  // Ensure outer doc mParent accessible
--  GetParent(getter_AddRefs(parentAccessible));
-+  nsIAccessible* parentAccessible = nsnull;  // Ensure outer doc mParent accessible
-+  GetParent(&parentAccessible);
- 
-   return nsHyperTextAccessibleWrap::Init();
- }
-@@ -577,7 +577,7 @@ NS_IMETHODIMP nsDocAccessible::Shutdown(
-     return NS_OK;  // Already shutdown
-   }
- 
--  nsCOMPtr<nsIDocShellTreeItem> treeItem =
-+  nsIDocShellTreeItem* treeItem =
-     nsAccUtils::GetDocShellTreeItemFor(mDOMNode);
-   ShutdownChildDocuments(treeItem);
- 
-@@ -587,7 +587,7 @@ NS_IMETHODIMP nsDocAccessible::Shutdown(
- 
-   ClearCache(mAccessNodeCache);
- 
--  nsCOMPtr<nsIDocument> kungFuDeathGripDoc = mDocument;
-+  nsIDocument* kungFuDeathGripDoc = mDocument;
-   mDocument = nsnull;
- 
-   nsHyperTextAccessibleWrap::Shutdown();
-@@ -618,20 +618,20 @@ NS_IMETHODIMP nsDocAccessible::Shutdown(
- 
- void nsDocAccessible::ShutdownChildDocuments(nsIDocShellTreeItem *aStart)
- {
--  nsCOMPtr<nsIDocShellTreeNode> treeNode(do_QueryInterface(aStart));
-+  nsIDocShellTreeNode* treeNode(do_QueryInterface(aStart));
-   if (treeNode) {
-     PRInt32 subDocuments;
-     treeNode->GetChildCount(&subDocuments);
-     for (PRInt32 count = 0; count < subDocuments; count ++) {
--      nsCOMPtr<nsIDocShellTreeItem> treeItemChild;
--      treeNode->GetChildAt(count, getter_AddRefs(treeItemChild));
-+      nsIDocShellTreeItem* treeItemChild = nsnull;
-+      treeNode->GetChildAt(count, &treeItemChild);
-       NS_ASSERTION(treeItemChild, "No tree item when there should be");
-       if (!treeItemChild) {
-         continue;
-       }
--      nsCOMPtr<nsIAccessibleDocument> docAccessible =
-+      nsIAccessibleDocument* docAccessible =
-         GetDocAccessibleFor(treeItemChild);
--      nsCOMPtr<nsPIAccessNode> accessNode = do_QueryInterface(docAccessible);
-+      nsPIAccessNode* accessNode = do_QueryInterface(docAccessible);
-       if (accessNode) {
-         accessNode->Shutdown();
-       }
-@@ -641,7 +641,7 @@ void nsDocAccessible::ShutdownChildDocum
- 
- nsIFrame* nsDocAccessible::GetFrame()
- {
--  nsCOMPtr<nsIPresShell> shell(do_QueryReferent(mWeakShell));
-+  nsIPresShell* shell(do_QueryReferent(mWeakShell));
- 
-   nsIFrame* root = nsnull;
-   if (shell)
-@@ -699,11 +699,11 @@ nsresult nsDocAccessible::AddEventListen
-   // 1) Set up scroll position listener
-   // 2) Check for editor and listen for changes to editor
- 
--  nsCOMPtr<nsIPresShell> presShell(GetPresShell());
-+  nsIPresShell* presShell(GetPresShell());
-   NS_ENSURE_TRUE(presShell, NS_ERROR_FAILURE);
- 
--  nsCOMPtr<nsISupports> container = mDocument->GetContainer();
--  nsCOMPtr<nsIDocShellTreeItem> docShellTreeItem(do_QueryInterface(container));
-+  nsISupports* container = mDocument->GetContainer();
-+  nsIDocShellTreeItem* docShellTreeItem(do_QueryInterface(container));
-   NS_ENSURE_TRUE(docShellTreeItem, NS_ERROR_FAILURE);
- 
-   // Make sure we're a content docshell
-@@ -715,20 +715,20 @@ nsresult nsDocAccessible::AddEventListen
- 
-   if (isContent) {
-     // We're not an editor yet, but we might become one
--    nsCOMPtr<nsICommandManager> commandManager = do_GetInterface(docShellTreeItem);
-+    nsICommandManager* commandManager = do_GetInterface(docShellTreeItem);
-     if (commandManager) {
-       commandManager->AddCommandObserver(this, "obs_documentCreated");
-     }
-   }
- 
--  nsCOMPtr<nsIDocShellTreeItem> rootTreeItem;
--  docShellTreeItem->GetRootTreeItem(getter_AddRefs(rootTreeItem));
-+  nsIDocShellTreeItem* rootTreeItem = nsnull;
-+  docShellTreeItem->GetRootTreeItem(&rootTreeItem);
-   if (rootTreeItem) {
--    nsCOMPtr<nsIAccessibleDocument> rootAccDoc =
-+    nsIAccessibleDocument* rootAccDoc =
-       GetDocAccessibleFor(rootTreeItem, PR_TRUE); // Ensure root accessible is created;
--    nsRefPtr<nsRootAccessible> rootAccessible = GetRootAccessible(); // Then get it as ref ptr
-+    nsRootAccessible* rootAccessible = GetRootAccessible(); // Then get it as ref ptr
-     NS_ENSURE_TRUE(rootAccessible, NS_ERROR_FAILURE);
--    nsRefPtr<nsCaretAccessible> caretAccessible = rootAccessible->GetCaretAccessible();
-+    nsCaretAccessible* caretAccessible = rootAccessible->GetCaretAccessible();
-     if (caretAccessible) {
-       caretAccessible->AddDocSelectionListener(presShell);
-     }
-@@ -754,24 +754,24 @@ nsresult nsDocAccessible::RemoveEventLis
-     NS_RELEASE_THIS(); // Kung fu death grip
-   }
- 
--  nsRefPtr<nsRootAccessible> rootAccessible(GetRootAccessible());
-+  nsRootAccessible* rootAccessible(GetRootAccessible());
-   if (rootAccessible) {
--    nsRefPtr<nsCaretAccessible> caretAccessible = rootAccessible->GetCaretAccessible();
-+    nsCaretAccessible* caretAccessible = rootAccessible->GetCaretAccessible();
-     if (caretAccessible) {
-       // Don't use GetPresShell() which can call Shutdown() if it sees dead pres shell
--      nsCOMPtr<nsIPresShell> presShell(do_QueryReferent(mWeakShell));
-+      nsIPresShell* presShell(do_QueryReferent(mWeakShell));
-       caretAccessible->RemoveDocSelectionListener(presShell);
-     }
-   }
- 
--  nsCOMPtr<nsISupports> container = mDocument->GetContainer();
--  nsCOMPtr<nsIDocShellTreeItem> docShellTreeItem(do_QueryInterface(container));
-+  nsISupports* container = mDocument->GetContainer();
-+  nsIDocShellTreeItem* docShellTreeItem(do_QueryInterface(container));
-   NS_ENSURE_TRUE(docShellTreeItem, NS_ERROR_FAILURE);
- 
-   PRInt32 itemType;
-   docShellTreeItem->GetItemType(&itemType);
-   if (itemType == nsIDocShellTreeItem::typeContent) {
--    nsCOMPtr<nsICommandManager> commandManager = do_GetInterface(docShellTreeItem);
-+    nsICommandManager* commandManager = do_GetInterface(docShellTreeItem);
-     if (commandManager) {
-       commandManager->RemoveCommandObserver(this, "obs_documentCreated");
-     }
-@@ -785,12 +785,12 @@ NS_IMETHODIMP nsDocAccessible::FireAncho
-   if (!mIsContentLoaded || !mDocument) {
-     return NS_OK;
-   }
--  nsCOMPtr<nsISupports> container = mDocument->GetContainer();
--  nsCOMPtr<nsIWebNavigation> webNav(do_GetInterface(container));
-+  nsISupports* container = mDocument->GetContainer();
-+  nsIWebNavigation* webNav(do_GetInterface(container));
-   nsCAutoString theURL;
-   if (webNav) {
--    nsCOMPtr<nsIURI> pURI;
--    webNav->GetCurrentURI(getter_AddRefs(pURI));
-+    nsIURI* pURI = nsnull;
-+    webNav->GetCurrentURI(&pURI);
-     if (pURI) {
-       pURI->GetSpec(theURL);
-     }
-@@ -833,19 +833,19 @@ NS_IMETHODIMP nsDocAccessible::FireDocLo
-     mIsLoadCompleteFired = PR_TRUE;
-   }
- 
--  nsCOMPtr<nsIDocShellTreeItem> treeItem =
-+  nsIDocShellTreeItem* treeItem =
-     nsAccUtils::GetDocShellTreeItemFor(mDOMNode);
-   if (!treeItem) {
-     return NS_OK;
-   }
--  nsCOMPtr<nsIDocShellTreeItem> sameTypeRoot;
--  treeItem->GetSameTypeRootTreeItem(getter_AddRefs(sameTypeRoot));
-+  nsIDocShellTreeItem* sameTypeRoot = nsnull;
-+  treeItem->GetSameTypeRootTreeItem(&sameTypeRoot);
- 
-   if (isFinished) {
-     // Need to wait until scrollable view is available
-     AddScrollListener();
--    nsCOMPtr<nsIAccessible> parent(nsAccessible::GetParent());
--    nsCOMPtr<nsPIAccessible> privateAccessible(do_QueryInterface(parent));
-+    nsIAccessible* parent(nsAccessible::GetParent());
-+    nsPIAccessible* privateAccessible(do_QueryInterface(parent));
-     if (privateAccessible) {
-       // Make the parent forget about the old document as a child
-       privateAccessible->InvalidateChildren();
-@@ -857,13 +857,13 @@ NS_IMETHODIMP nsDocAccessible::FireDocLo
-     }
-     // Fire STATE_CHANGE event for doc load finish if focus is in same doc tree
-     if (gLastFocusedNode) {
--      nsCOMPtr<nsIDocShellTreeItem> focusedTreeItem =
-+      nsIDocShellTreeItem* focusedTreeItem =
-         nsAccUtils::GetDocShellTreeItemFor(gLastFocusedNode);
-       if (focusedTreeItem) {
--        nsCOMPtr<nsIDocShellTreeItem> sameTypeRootOfFocus;
--        focusedTreeItem->GetSameTypeRootTreeItem(getter_AddRefs(sameTypeRootOfFocus));
-+        nsIDocShellTreeItem* sameTypeRootOfFocus = nsnull;
-+        focusedTreeItem->GetSameTypeRootTreeItem(&sameTypeRootOfFocus);
-         if (sameTypeRoot == sameTypeRootOfFocus) {
--          nsCOMPtr<nsIAccessibleStateChangeEvent> accEvent =
-+          nsIAccessibleStateChangeEvent* accEvent =
-             new nsAccStateChangeEvent(this, nsIAccessibleStates::STATE_BUSY, PR_FALSE, PR_FALSE);
-           FireAccessibleEvent(accEvent);
-           FireAnchorJumpEvent();
-@@ -877,7 +877,7 @@ NS_IMETHODIMP nsDocAccessible::FireDocLo
-     if (!isFinished) {
-       // Fire state change event to set STATE_BUSY when document is loading. For
-       // example, Window-Eyes expects to get it.
--      nsCOMPtr<nsIAccessibleStateChangeEvent> accEvent =
-+      nsIAccessibleStateChangeEvent* accEvent =
-         new nsAccStateChangeEvent(this, nsIAccessibleStates::STATE_BUSY,
-                                   PR_FALSE, PR_TRUE);
-       FireAccessibleEvent(accEvent);
-@@ -911,7 +911,7 @@ void nsDocAccessible::ScrollTimerCallbac
- 
- void nsDocAccessible::AddScrollListener()
- {
--  nsCOMPtr<nsIPresShell> presShell(do_QueryReferent(mWeakShell));
-+  nsIPresShell* presShell(do_QueryReferent(mWeakShell));
- 
-   nsIViewManager* vm = nsnull;
-   if (presShell)
-@@ -927,7 +927,7 @@ void nsDocAccessible::AddScrollListener(
- 
- void nsDocAccessible::RemoveScrollListener()
- {
--  nsCOMPtr<nsIPresShell> presShell(do_QueryReferent(mWeakShell));
-+  nsIPresShell* presShell(do_QueryReferent(mWeakShell));
- 
-   nsIViewManager* vm = nsnull;
-   if (presShell)
-@@ -972,7 +972,7 @@ NS_IMETHODIMP nsDocAccessible::Observe(n
- {
-   if (!nsCRT::strcmp(aTopic,"obs_documentCreated")) {    
-     // State editable will now be set, readonly is now clear
--    nsCOMPtr<nsIAccessibleStateChangeEvent> event =
-+    nsIAccessibleStateChangeEvent* event =
-       new nsAccStateChangeEvent(this, nsIAccessibleStates::EXT_STATE_EDITABLE,
-                                 PR_TRUE, PR_TRUE);
-     FireAccessibleEvent(event);
-@@ -996,10 +996,10 @@ nsDocAccessible::AttributeChanged(nsIDoc
-   AttributeChangedImpl(aContent, aNameSpaceID, aAttribute);
- 
-   // If it was the focused node, cache the new state
--  nsCOMPtr<nsIDOMNode> targetNode = do_QueryInterface(aContent);
-+  nsIDOMNode* targetNode = do_QueryInterface(aContent);
-   if (targetNode == gLastFocusedNode) {
--    nsCOMPtr<nsIAccessible> focusedAccessible;
--    GetAccService()->GetAccessibleFor(targetNode, getter_AddRefs(focusedAccessible));
-+    nsIAccessible* focusedAccessible = nsnull;
-+    GetAccService()->GetAccessibleFor(targetNode, &focusedAccessible);
-     if (focusedAccessible) {
-       gLastFocusedAccessiblesState = State(focusedAccessible);
-     }
-@@ -1020,8 +1020,8 @@ nsDocAccessible::AttributeChangedImpl(ns
-   // Otherwise it may just be a state change, for example an object changing
-   // its visibility
- 
--  nsCOMPtr<nsISupports> container = mDocument->GetContainer();
--  nsCOMPtr<nsIDocShell> docShell = do_QueryInterface(container);
-+  nsISupports* container = mDocument->GetContainer();
-+  nsIDocShell* docShell = do_QueryInterface(container);
-   if (!docShell) {
-     return;
-   }
-@@ -1032,12 +1032,12 @@ nsDocAccessible::AttributeChangedImpl(ns
-     return; // Still loading, ignore setting of initial attributes
-   }
- 
--  nsCOMPtr<nsIPresShell> shell = GetPresShell();
-+  nsIPresShell* shell = GetPresShell();
-   if (!shell) {
-     return; // Document has been shut down
-   }
- 
--  nsCOMPtr<nsIDOMNode> targetNode(do_QueryInterface(aContent));
-+  nsIDOMNode* targetNode(do_QueryInterface(aContent));
-   NS_ASSERTION(targetNode, "No node for attr modified");
-   if (!targetNode || !IsNodeRelevant(targetNode)) {
-     return;
-@@ -1057,12 +1057,12 @@ nsDocAccessible::AttributeChangedImpl(ns
-     // disabled really is going to mean the same thing in any namespace.
-     // We use the attribute instead of the disabled state bit because
-     // ARIA's aria-disabled does not affect the disabled state bit
--    nsCOMPtr<nsIAccessibleStateChangeEvent> enabledChangeEvent =
-+    nsIAccessibleStateChangeEvent* enabledChangeEvent =
-       new nsAccStateChangeEvent(targetNode,
-                                 nsIAccessibleStates::EXT_STATE_ENABLED,
-                                 PR_TRUE);
-     FireDelayedAccessibleEvent(enabledChangeEvent);
--    nsCOMPtr<nsIAccessibleStateChangeEvent> sensitiveChangeEvent =
-+    nsIAccessibleStateChangeEvent* sensitiveChangeEvent =
-       new nsAccStateChangeEvent(targetNode,
-                                 nsIAccessibleStates::EXT_STATE_SENSITIVE,
-                                 PR_TRUE);
-@@ -1101,7 +1101,7 @@ nsDocAccessible::AttributeChangedImpl(ns
-   if (aAttribute == nsAccessibilityAtoms::selected ||
-       aAttribute == nsAccessibilityAtoms::aria_selected) {
-     // ARIA or XUL selection
--    nsCOMPtr<nsIAccessible> multiSelect = GetMultiSelectFor(targetNode);
-+    nsIAccessible* multiSelect = GetMultiSelectFor(targetNode);
-     // Multi selects use selection_add and selection_remove
-     // Single select widgets just mirror event_selection for
-     // whatever gets event_focus, which is done in
-@@ -1110,10 +1110,10 @@ nsDocAccessible::AttributeChangedImpl(ns
-     if (multiSelect) {
-       // Need to find the right event to use here, SELECTION_WITHIN would
-       // seem right but we had started using it for something else
--      nsCOMPtr<nsIAccessNode> multiSelectAccessNode =
-+      nsIAccessNode* multiSelectAccessNode =
-         do_QueryInterface(multiSelect);
--      nsCOMPtr<nsIDOMNode> multiSelectDOMNode;
--      multiSelectAccessNode->GetDOMNode(getter_AddRefs(multiSelectDOMNode));
-+      nsIDOMNode* multiSelectDOMNode = nsnull;
-+      multiSelectAccessNode->GetDOMNode(&multiSelectDOMNode);
-       NS_ASSERTION(multiSelectDOMNode, "A new accessible without a DOM node!");
-       FireDelayedToolkitEvent(nsIAccessibleEvent::EVENT_SELECTION_WITHIN,
-                               multiSelectDOMNode,
-@@ -1134,7 +1134,7 @@ nsDocAccessible::AttributeChangedImpl(ns
-   }
- 
-   if (aAttribute == nsAccessibilityAtoms::contenteditable) {
--    nsCOMPtr<nsIAccessibleStateChangeEvent> editableChangeEvent =
-+    nsIAccessibleStateChangeEvent* editableChangeEvent =
-       new nsAccStateChangeEvent(targetNode,
-                                 nsIAccessibleStates::EXT_STATE_EDITABLE,
-                                 PR_TRUE);
-@@ -1146,12 +1146,12 @@ void
- void
- nsDocAccessible::ARIAAttributeChanged(nsIContent* aContent, nsIAtom* aAttribute)
- {
--  nsCOMPtr<nsIDOMNode> targetNode(do_QueryInterface(aContent));
-+  nsIDOMNode* targetNode(do_QueryInterface(aContent));
-   if (!targetNode)
-     return;
- 
-   if (aAttribute == nsAccessibilityAtoms::aria_required) {
--    nsCOMPtr<nsIAccessibleStateChangeEvent> event =
-+    nsIAccessibleStateChangeEvent* event =
-       new nsAccStateChangeEvent(targetNode,
-                                 nsIAccessibleStates::STATE_REQUIRED,
-                                 PR_FALSE);
-@@ -1160,7 +1160,7 @@ nsDocAccessible::ARIAAttributeChanged(ns
-   }
- 
-   if (aAttribute == nsAccessibilityAtoms::aria_invalid) {
--    nsCOMPtr<nsIAccessibleStateChangeEvent> event =
-+    nsIAccessibleStateChangeEvent* event =
-       new nsAccStateChangeEvent(targetNode,
-                                 nsIAccessibleStates::STATE_INVALID,
-                                 PR_FALSE);
-@@ -1171,9 +1171,9 @@ nsDocAccessible::ARIAAttributeChanged(ns
-   if (aAttribute == nsAccessibilityAtoms::aria_activedescendant) {
-     // The activedescendant universal property redirects accessible focus events
-     // to the element with the id that activedescendant points to
--    nsCOMPtr<nsIDOMNode> currentFocus = GetCurrentFocus();
-+    nsIDOMNode* currentFocus = GetCurrentFocus();
-     if (SameCOMIdentity(GetRoleContent(currentFocus), targetNode)) {
--      nsRefPtr<nsRootAccessible> rootAcc = GetRootAccessible();
-+      nsRootAccessible* rootAcc = GetRootAccessible();
-       if (rootAcc)
-         rootAcc->FireAccessibleFocusEvent(nsnull, currentFocus, nsnull, PR_TRUE);
-     }
-@@ -1194,7 +1194,7 @@ nsDocAccessible::ARIAAttributeChanged(ns
-     const PRUint32 kState = (aAttribute == nsAccessibilityAtoms::aria_checked) ?
-                             nsIAccessibleStates::STATE_CHECKED : 
-                             nsIAccessibleStates::STATE_PRESSED;
--    nsCOMPtr<nsIAccessibleStateChangeEvent> event =
-+    nsIAccessibleStateChangeEvent* event =
-       new nsAccStateChangeEvent(targetNode, kState, PR_FALSE);
-     FireDelayedAccessibleEvent(event);
-     if (targetNode == gLastFocusedNode) {
-@@ -1202,13 +1202,13 @@ nsDocAccessible::ARIAAttributeChanged(ns
-       // otherwise we would need access to the old attribute value in this listener.
-       // This is because we don't know if the previous value of aria-checked or aria-pressed was "mixed"
-       // without caching that info.
--      nsCOMPtr<nsIAccessible> accessible;
--      event->GetAccessible(getter_AddRefs(accessible));
-+      nsIAccessible* accessible = nsnull;
-+      event->GetAccessible(&accessible);
-       if (accessible) {
-         PRBool wasMixed = (gLastFocusedAccessiblesState & nsIAccessibleStates::STATE_MIXED) != 0;
-         PRBool isMixed  = (State(accessible) & nsIAccessibleStates::STATE_MIXED) != 0;
-         if (wasMixed != isMixed) {
--          nsCOMPtr<nsIAccessibleStateChangeEvent> event =
-+          nsIAccessibleStateChangeEvent* event =
-             new nsAccStateChangeEvent(targetNode,
-                                       nsIAccessibleStates::STATE_MIXED,
-                                       PR_FALSE, isMixed);
-@@ -1220,7 +1220,7 @@ nsDocAccessible::ARIAAttributeChanged(ns
-   }
- 
-   if (aAttribute == nsAccessibilityAtoms::aria_expanded) {
--    nsCOMPtr<nsIAccessibleStateChangeEvent> event =
-+    nsIAccessibleStateChangeEvent* event =
-       new nsAccStateChangeEvent(targetNode,
-                                 nsIAccessibleStates::STATE_EXPANDED,
-                                 PR_FALSE);
-@@ -1229,7 +1229,7 @@ nsDocAccessible::ARIAAttributeChanged(ns
-   }
- 
-   if (aAttribute == nsAccessibilityAtoms::aria_readonly) {
--    nsCOMPtr<nsIAccessibleStateChangeEvent> event =
-+    nsIAccessibleStateChangeEvent* event =
-       new nsAccStateChangeEvent(targetNode,
-                                 nsIAccessibleStates::STATE_READONLY,
-                                 PR_FALSE);
-@@ -1264,7 +1264,7 @@ void nsDocAccessible::ContentAppended(ns
- 
-   PRUint32 childCount = aContainer->GetChildCount();
-   for (PRUint32 index = aNewIndexInContainer; index < childCount; index ++) {
--    nsCOMPtr<nsIContent> child(aContainer->GetChildAt(index));
-+    nsIContent* child(aContainer->GetChildAt(index));
-     // InvalidateCacheSubtree will not fire the EVENT_SHOW for the new node
-     // unless an accessible can be created for the passed in node, which it
-     // can't do unless the node is visible. The right thing happens there so
-@@ -1334,7 +1334,7 @@ nsDocAccessible::FireValueChangeForTextF
-     return;
- 
-   // Dependent value change event for text changes in textfields
--  nsCOMPtr<nsIAccessibleEvent> valueChangeEvent =
-+  nsIAccessibleEvent* valueChangeEvent =
-     new nsAccEvent(nsIAccessibleEvent::EVENT_VALUE_CHANGE, aPossibleTextFieldAccessible,
-                    PR_FALSE, nsAccEvent::eRemoveDupes);
-   FireDelayedAccessibleEvent(valueChangeEvent );
-@@ -1349,18 +1349,18 @@ nsDocAccessible::FireTextChangeEventForT
-     return;
-   }
- 
--  nsCOMPtr<nsIDOMNode> node(do_QueryInterface(aContent));
-+  nsIDOMNode* node(do_QueryInterface(aContent));
-   if (!node)
-     return;
- 
--  nsCOMPtr<nsIAccessible> accessible;
--  nsresult rv = GetAccessibleInParentChain(node, PR_TRUE, getter_AddRefs(accessible));
-+  nsIAccessible* accessible = nsnull;
-+  nsresult rv = GetAccessibleInParentChain(node, PR_TRUE, &accessible);
-   if (NS_FAILED(rv) || !accessible)
-     return;
- 
--  nsRefPtr<nsHyperTextAccessible> textAccessible;
-+  nsHyperTextAccessible* textAccessible = nsnull;
-   rv = accessible->QueryInterface(NS_GET_IID(nsHyperTextAccessible),
--                                  getter_AddRefs(textAccessible));
-+                                  (void**)&textAccessible);
-   if (NS_FAILED(rv) || !textAccessible)
-     return;
- 
-@@ -1376,7 +1376,7 @@ nsDocAccessible::FireTextChangeEventForT
-     aInfo->mChangeEnd - start; // text has been removed
- 
-   if (length > 0) {
--    nsCOMPtr<nsIPresShell> shell(do_QueryReferent(mWeakShell));
-+    nsIPresShell* shell(do_QueryReferent(mWeakShell));
-     if (!shell)
-       return;
- 
-@@ -1395,7 +1395,7 @@ nsDocAccessible::FireTextChangeEventForT
-     if (NS_FAILED(rv))
-       return;
- 
--    nsCOMPtr<nsIAccessibleTextChangeEvent> event =
-+    nsIAccessibleTextChangeEvent* event =
-       new nsAccTextChangeEvent(accessible, offset,
-                                renderedEndOffset - renderedStartOffset,
-                                aIsInserted, PR_FALSE);
-@@ -1405,25 +1405,25 @@ nsDocAccessible::FireTextChangeEventForT
-   }
- }
- 
--already_AddRefed<nsIAccessibleTextChangeEvent>
-+nsIAccessibleTextChangeEvent*
- nsDocAccessible::CreateTextChangeEventForNode(nsIAccessible *aContainerAccessible,
-                                               nsIDOMNode *aChangeNode,
-                                               nsIAccessible *aAccessibleForChangeNode,
-                                               PRBool aIsInserting,
-                                               PRBool aIsAsynch)
- {
--  nsRefPtr<nsHyperTextAccessible> textAccessible;
-+  nsHyperTextAccessible* textAccessible = nsnull;
-   aContainerAccessible->QueryInterface(NS_GET_IID(nsHyperTextAccessible),
--                                       getter_AddRefs(textAccessible));
-+                                       (void**)&textAccessible);
-   if (!textAccessible) {
-     return nsnull;
-   }
- 
-   PRInt32 offset;
-   PRInt32 length = 0;
--  nsCOMPtr<nsIAccessible> changeAccessible;
-+  nsIAccessible* changeAccessible = nsnull;
-   nsresult rv = textAccessible->DOMPointToHypertextOffset(aChangeNode, -1, &offset,
--                                                          getter_AddRefs(changeAccessible));
-+                                                          &changeAccessible);
-   NS_ENSURE_SUCCESS(rv, nsnull);
- 
-   if (!aAccessibleForChangeNode) {
-@@ -1435,21 +1435,21 @@ nsDocAccessible::CreateTextChangeEventFo
-     if (!changeAccessible) {
-       return nsnull; // No descendant content that represents any text in the hypertext parent
-     }
--    nsCOMPtr<nsIAccessible> child = changeAccessible;
-+    nsIAccessible* child = changeAccessible;
-     while (PR_TRUE) {
--      nsCOMPtr<nsIAccessNode> childAccessNode =
-+      nsIAccessNode* childAccessNode =
-         do_QueryInterface(changeAccessible);
--      nsCOMPtr<nsIDOMNode> childNode;
--      childAccessNode->GetDOMNode(getter_AddRefs(childNode));
-+      nsIDOMNode* childNode = nsnull;
-+      childAccessNode->GetDOMNode(&childNode);
-       if (!nsAccUtils::IsAncestorOf(aChangeNode, childNode)) {
-         break;  // We only want accessibles with DOM nodes as children of this node
-       }
-       length += TextLength(child);
--      child->GetNextSibling(getter_AddRefs(changeAccessible));
-+      child->GetNextSibling(&changeAccessible);
-       if (!changeAccessible) {
-         break;
-       }
--      child.swap(changeAccessible);
-+      swap(child, changeAccessible);
-     }
-   }
-   else {
-@@ -1458,8 +1458,8 @@ nsDocAccessible::CreateTextChangeEventFo
-     length = TextLength(aAccessibleForChangeNode);
-     if (Role(aAccessibleForChangeNode) == nsIAccessibleRole::ROLE_WHITESPACE) {  // newline
-       // Don't fire event for the first html:br in an editor.
--      nsCOMPtr<nsIEditor> editor;
--      textAccessible->GetAssociatedEditor(getter_AddRefs(editor));
-+      nsIEditor* editor = nsnull;
-+      textAccessible->GetAssociatedEditor(&editor);
-       if (editor) {
-         PRBool isEmpty = PR_FALSE;
-         editor->GetDocumentIsEmpty(&isEmpty);
-@@ -1486,7 +1486,7 @@ nsresult nsDocAccessible::FireDelayedToo
-                                                   nsAccEvent::EEventRule aAllowDupes,
-                                                   PRBool aIsAsynch)
- {
--  nsCOMPtr<nsIAccessibleEvent> event =
-+  nsIAccessibleEvent* event =
-     new nsAccEvent(aEvent, aDOMNode, aIsAsynch, aAllowDupes);
-   NS_ENSURE_TRUE(event, NS_ERROR_OUT_OF_MEMORY);
- 
-@@ -1522,23 +1522,23 @@ NS_IMETHODIMP nsDocAccessible::FlushPend
-   mInFlushPendingEvents = PR_TRUE;
-   PRUint32 length = mEventsToFire.Count();
-   NS_ASSERTION(length, "How did we get here without events to fire?");
--  nsCOMPtr<nsIPresShell> presShell = GetPresShell();
-+  nsIPresShell* presShell = GetPresShell();
-   if (!presShell)
-     length = 0; // The doc is now shut down, don't fire events in it anymore
-   else
-     nsAccEvent::ApplyEventRules(mEventsToFire);
-   
-   for (PRUint32 index = 0; index < length; index ++) {
--    nsCOMPtr<nsIAccessibleEvent> accessibleEvent(
-+    nsIAccessibleEvent* accessibleEvent(
-       do_QueryInterface(mEventsToFire[index]));
- 
-     if (nsAccEvent::EventRule(accessibleEvent) == nsAccEvent::eDoNotEmit)
-       continue;
- 
--    nsCOMPtr<nsIAccessible> accessible;
--    accessibleEvent->GetAccessible(getter_AddRefs(accessible));
--    nsCOMPtr<nsIDOMNode> domNode;
--    accessibleEvent->GetDOMNode(getter_AddRefs(domNode));
-+    nsIAccessible* accessible = nsnull;
-+    accessibleEvent->GetAccessible(&accessible);
-+    nsIDOMNode* domNode = nsnull;
-+    accessibleEvent->GetDOMNode(&domNode);
-     PRUint32 eventType = nsAccEvent::EventType(accessibleEvent);
-     PRBool isFromUserInput = nsAccEvent::IsFromUserInput(accessibleEvent);
- 
-@@ -1549,7 +1549,7 @@ NS_IMETHODIMP nsDocAccessible::FlushPend
-       // However, we only keep track of the old frame type for the focus, where it's very
-       // important not to destroy and recreate the accessible for minor style changes,
-       // such as a:focus { overflow: scroll; }
--      nsCOMPtr<nsIContent> focusContent(do_QueryInterface(domNode));
-+      nsIContent* focusContent(do_QueryInterface(domNode));
-       if (focusContent) {
-         nsIFrame *focusFrame = presShell->GetRealPrimaryFrameFor(focusContent);
-         nsIAtom *newFrameType =
-@@ -1568,12 +1568,12 @@ NS_IMETHODIMP nsDocAccessible::FlushPend
- 
-     if (eventType == nsIAccessibleEvent::EVENT_DOM_CREATE || 
-         eventType == nsIAccessibleEvent::EVENT_ASYNCH_SHOW) {
--      nsCOMPtr<nsIAccessible> containerAccessible;
-+      nsIAccessible* containerAccessible = nsnull;
-       if (eventType == nsIAccessibleEvent::EVENT_ASYNCH_SHOW) {
-         if (accessible) {
-           // For asynch show, delayed invalidatation of parent's children
--          accessible->GetParent(getter_AddRefs(containerAccessible));
--          nsCOMPtr<nsPIAccessible> privateContainerAccessible =
-+          accessible->GetParent(&containerAccessible);
-+          nsPIAccessible* privateContainerAccessible =
-             do_QueryInterface(containerAccessible);
-           if (privateContainerAccessible)
-             privateContainerAccessible->InvalidateChildren();
-@@ -1592,12 +1592,12 @@ NS_IMETHODIMP nsDocAccessible::FlushPend
-       if (domNode && domNode != mDOMNode) {
-         if (!containerAccessible) {
-           GetAccessibleInParentChain(domNode, PR_TRUE,
--                                     getter_AddRefs(containerAccessible));
-+                                     &containerAccessible);
-           if (!containerAccessible)
-             containerAccessible = this;
-         }
- 
--        nsCOMPtr<nsIAccessibleTextChangeEvent> textChangeEvent =
-+        nsIAccessibleTextChangeEvent* textChangeEvent =
-           CreateTextChangeEventForNode(containerAccessible, domNode, accessible, PR_TRUE, PR_TRUE);
-         if (textChangeEvent) {
-           nsAccEvent::PrepareForEvent(textChangeEvent, isFromUserInput);
-@@ -1615,7 +1615,7 @@ NS_IMETHODIMP nsDocAccessible::FlushPend
- 
-     if (accessible) {
-       if (eventType == nsIAccessibleEvent::EVENT_INTERNAL_LOAD) {
--        nsCOMPtr<nsPIAccessibleDocument> docAccessible =
-+        nsPIAccessibleDocument* docAccessible =
-           do_QueryInterface(accessible);
-         NS_ASSERTION(docAccessible, "No doc accessible for doc load event");
-         if (docAccessible) {
-@@ -1623,7 +1623,7 @@ NS_IMETHODIMP nsDocAccessible::FlushPend
-         }
-       }
-       else if (eventType == nsIAccessibleEvent::EVENT_TEXT_CARET_MOVED) {
--        nsCOMPtr<nsIAccessibleText> accessibleText = do_QueryInterface(accessible);
-+        nsIAccessibleText* accessibleText = do_QueryInterface(accessible);
-         PRInt32 caretOffset;
-         if (accessibleText && NS_SUCCEEDED(accessibleText->GetCaretOffset(&caretOffset))) {
- #ifdef DEBUG_A11Y
-@@ -1638,7 +1638,7 @@ NS_IMETHODIMP nsDocAccessible::FlushPend
-           GetAccService()->GetAccessibleFor(gLastFocusedNode, getter_AddRefs(accForFocus));
-           nsAccUtils::FireAccEvent(nsIAccessibleEvent::EVENT_ALERT, accForFocus);
- #endif
--          nsCOMPtr<nsIAccessibleCaretMoveEvent> caretMoveEvent =
-+          nsIAccessibleCaretMoveEvent* caretMoveEvent =
-             new nsAccCaretMoveEvent(accessible, caretOffset);
-           if (!caretMoveEvent)
-             break; // Out of memory, break out to release kung fu death grip
-@@ -1662,8 +1662,8 @@ NS_IMETHODIMP nsDocAccessible::FlushPend
-         if (eventType == nsIAccessibleEvent::EVENT_ASYNCH_HIDE ||
-             eventType == nsIAccessibleEvent::EVENT_DOM_DESTROY) {
-           // Shutdown nsIAccessNode's or nsIAccessibles for any DOM nodes in this subtree
--          nsCOMPtr<nsIDOMNode> hidingNode;
--          accessibleEvent->GetDOMNode(getter_AddRefs(hidingNode));
-+          nsIDOMNode* hidingNode = nsnull;
-+          accessibleEvent->GetDOMNode(&hidingNode);
-           if (hidingNode) {
-             RefreshNodes(hidingNode); // Will this bite us with asynch events
-           }
-@@ -1694,17 +1694,17 @@ void nsDocAccessible::FlushEventsCallbac
- 
- void nsDocAccessible::InvalidateChildrenInSubtree(nsIDOMNode *aStartNode)
- {
--  nsCOMPtr<nsIAccessNode> accessNode;
--  GetCachedAccessNode(aStartNode, getter_AddRefs(accessNode));
--  nsCOMPtr<nsPIAccessible> accessible(do_QueryInterface(accessNode));
-+  nsIAccessNode* accessNode = nsnull;
-+  GetCachedAccessNode(aStartNode, &accessNode);
-+  nsPIAccessible* accessible(do_QueryInterface(accessNode));
-   if (accessible)
-     accessible->InvalidateChildren();
- 
-   // Invalidate accessible children in the DOM subtree 
--  nsCOMPtr<nsINode> node = do_QueryInterface(aStartNode);
-+  nsINode* node = do_QueryInterface(aStartNode);
-   PRInt32 index, numChildren = node->GetChildCount();
-   for (index = 0; index < numChildren; index ++) {
--    nsCOMPtr<nsIDOMNode> childNode = do_QueryInterface(node->GetChildAt(index));
-+    nsIDOMNode* childNode = do_QueryInterface(node->GetChildAt(index));
-     if (childNode)
-       InvalidateChildrenInSubtree(childNode);
-   }
-@@ -1716,19 +1716,19 @@ void nsDocAccessible::RefreshNodes(nsIDO
-     return; // All we have is a doc accessible. There is nothing to invalidate, quit early
-   }
- 
--  nsCOMPtr<nsIAccessNode> accessNode;
--  GetCachedAccessNode(aStartNode, getter_AddRefs(accessNode));
-+  nsIAccessNode* accessNode = nsnull;
-+  GetCachedAccessNode(aStartNode, &accessNode);
- 
-   // Shut down accessible subtree, which may have been created for
-   // anonymous content subtree
--  nsCOMPtr<nsIAccessible> accessible(do_QueryInterface(accessNode));
-+  nsIAccessible* accessible(do_QueryInterface(accessNode));
-   if (accessible) {
-     // Fire menupopup end if a menu goes away
-     PRUint32 role = Role(accessible);
-     if (role == nsIAccessibleRole::ROLE_MENUPOPUP) {
--      nsCOMPtr<nsIDOMNode> domNode;
--      accessNode->GetDOMNode(getter_AddRefs(domNode));
--      nsCOMPtr<nsIDOMXULPopupElement> popup(do_QueryInterface(domNode));
-+      nsIDOMNode* domNode = nsnull;
-+      accessNode->GetDOMNode(&domNode);
-+      nsIDOMXULPopupElement* popup(do_QueryInterface(domNode));
-       if (!popup) {
-         // Popup elements already fire these via DOMMenuInactive
-         // handling in nsRootAccessible::HandleEvent
-@@ -1736,28 +1736,28 @@ void nsDocAccessible::RefreshNodes(nsIDO
-                                  accessible);
-       }
-     }
--    nsCOMPtr<nsPIAccessible> privateAccessible = do_QueryInterface(accessible);
-+    nsPIAccessible* privateAccessible = do_QueryInterface(accessible);
-     NS_ASSERTION(privateAccessible, "No nsPIAccessible for nsIAccessible");
- 
--    nsCOMPtr<nsIAccessible> childAccessible;
-+    nsIAccessible* childAccessible = nsnull;
-     // we only need to shutdown the accessibles here if one of them has been created
--    privateAccessible->GetCachedFirstChild(getter_AddRefs(childAccessible));
-+    privateAccessible->GetCachedFirstChild(&childAccessible);
-     if (childAccessible) {
--      nsCOMPtr<nsIArray> children;
-+      nsIArray* children = nsnull;
-       // use GetChildren() to fetch children at one time, instead of using
-       // GetNextSibling(), because after we shutdown the first child,
-       // mNextSibling will be set null.
--      accessible->GetChildren(getter_AddRefs(children));
-+      accessible->GetChildren(&children);
-       PRUint32 childCount =0;
-       if (children)
-         children->GetLength(&childCount);
--      nsCOMPtr<nsIDOMNode> possibleAnonNode;
-+      nsIDOMNode* possibleAnonNode = nsnull;
-       for (PRUint32 index = 0; index < childCount; index++) {
--        nsCOMPtr<nsIAccessNode> childAccessNode;
-+        nsIAccessNode* childAccessNode = nsnull;
-         children->QueryElementAt(index, NS_GET_IID(nsIAccessNode),
--                                 getter_AddRefs(childAccessNode));
--        childAccessNode->GetDOMNode(getter_AddRefs(possibleAnonNode));
--        nsCOMPtr<nsIContent> iterContent = do_QueryInterface(possibleAnonNode);
-+                                 (void**)&childAccessNode);
-+        childAccessNode->GetDOMNode(&possibleAnonNode);
-+        nsIContent* iterContent = do_QueryInterface(possibleAnonNode);
-         if (iterContent && (iterContent->IsNativeAnonymous() ||
-                             iterContent->GetBindingParent())) {
-           // GetBindingParent() check is a perf win -- make sure we don't
-@@ -1771,12 +1771,12 @@ void nsDocAccessible::RefreshNodes(nsIDO
- 
-   // Shutdown ordinary content subtree as well -- there may be
-   // access node children which are not full accessible objects
--  nsCOMPtr<nsIDOMNode> nextNode, iterNode;
--  aStartNode->GetFirstChild(getter_AddRefs(nextNode));
-+  nsIDOMNode* nextNode = nsnull, *iterNode = nsnull;
-+  aStartNode->GetFirstChild(&nextNode);
-   while (nextNode) {
--    nextNode.swap(iterNode);
-+    swap(nextNode, iterNode);
-     RefreshNodes(iterNode);
--    iterNode->GetNextSibling(getter_AddRefs(nextNode));
-+    iterNode->GetNextSibling(&nextNode);
-   }
- 
-   if (!accessNode)
-@@ -1794,7 +1794,7 @@ void nsDocAccessible::RefreshNodes(nsIDO
-   // Shut down the actual accessible or access node
-   void *uniqueID;
-   accessNode->GetUniqueID(&uniqueID);
--  nsCOMPtr<nsPIAccessNode> privateAccessNode(do_QueryInterface(accessNode));
-+  nsPIAccessNode* privateAccessNode(do_QueryInterface(accessNode));
-   privateAccessNode->Shutdown();
- 
-   // Remove from hash table as well
-@@ -1830,9 +1830,9 @@ NS_IMETHODIMP nsDocAccessible::Invalidat
-   // Otherwise we might miss the nsAccessNode's that are not nsAccessible's.
- 
-   NS_ENSURE_TRUE(mDOMNode, NS_ERROR_FAILURE);
--  nsCOMPtr<nsIDOMNode> childNode = aChild ? do_QueryInterface(aChild) : mDOMNode;
-+  nsIDOMNode* childNode = aChild ? do_QueryInterface(aChild) : mDOMNode;
- 
--  nsCOMPtr<nsIPresShell> presShell = GetPresShell();
-+  nsIPresShell* presShell = GetPresShell();
-   NS_ENSURE_TRUE(presShell, NS_ERROR_FAILURE);
-   
-   if (!mIsContentLoaded) {
-@@ -1853,12 +1853,12 @@ NS_IMETHODIMP nsDocAccessible::Invalidat
-       // Changes during page load, but not caused by user input
-       // Just invalidate accessible hierarchy and return,
-       // otherwise the page load time slows down way too much
--      nsCOMPtr<nsIAccessible> containerAccessible;
--      GetAccessibleInParentChain(childNode, PR_FALSE, getter_AddRefs(containerAccessible));
-+      nsIAccessible* containerAccessible = nsnull;
-+      GetAccessibleInParentChain(childNode, PR_FALSE, &containerAccessible);
-       if (!containerAccessible) {
-         containerAccessible = this;
-       }
--      nsCOMPtr<nsPIAccessible> privateContainer = do_QueryInterface(containerAccessible);
-+      nsPIAccessible* privateContainer = do_QueryInterface(containerAccessible);
-       return privateContainer->InvalidateChildren();
-     }     
-     // else: user input, so we must fall through and for full handling,
-@@ -1867,9 +1867,9 @@ NS_IMETHODIMP nsDocAccessible::Invalidat
-   }
- 
-   // Update last change state information
--  nsCOMPtr<nsIAccessNode> childAccessNode;
--  GetCachedAccessNode(childNode, getter_AddRefs(childAccessNode));
--  nsCOMPtr<nsIAccessible> childAccessible = do_QueryInterface(childAccessNode);
-+  nsIAccessNode* childAccessNode = nsnull;
-+  GetCachedAccessNode(childNode, &childAccessNode);
-+  nsIAccessible* childAccessible = do_QueryInterface(childAccessNode);
- 
- #ifdef DEBUG_A11Y
-   nsAutoString localName;
-@@ -1895,8 +1895,8 @@ NS_IMETHODIMP nsDocAccessible::Invalidat
-   }
- #endif
- 
--  nsCOMPtr<nsIAccessible> containerAccessible;
--  GetAccessibleInParentChain(childNode, PR_TRUE, getter_AddRefs(containerAccessible));
-+  nsIAccessible* containerAccessible = nsnull;
-+  GetAccessibleInParentChain(childNode, PR_TRUE, &containerAccessible);
-   if (!containerAccessible) {
-     containerAccessible = this;
-   }
-@@ -1904,7 +1904,7 @@ NS_IMETHODIMP nsDocAccessible::Invalidat
-   if (!isShowing) {
-     // Fire EVENT_ASYNCH_HIDE or EVENT_DOM_DESTROY
-     if (isHiding) {
--      nsCOMPtr<nsIContent> content(do_QueryInterface(childNode));
-+      nsIContent* content(do_QueryInterface(childNode));
-       if (content) {
-         nsIFrame *frame = presShell->GetPrimaryFrameFor(content);
-         if (frame) {
-@@ -1934,7 +1934,7 @@ NS_IMETHODIMP nsDocAccessible::Invalidat
-       // XXX Collate events when a range is deleted
-       // XXX We need a way to ignore SplitNode and JoinNode() when they
-       // do not affect the text within the hypertext
--      nsCOMPtr<nsIAccessibleTextChangeEvent> textChangeEvent =
-+      nsIAccessibleTextChangeEvent* textChangeEvent =
-         CreateTextChangeEventForNode(containerAccessible, childNode, childAccessible,
-                                      PR_FALSE, isAsynch);
-       if (textChangeEvent) {
-@@ -1954,7 +1954,7 @@ NS_IMETHODIMP nsDocAccessible::Invalidat
-     if (!isAsynch) {
-       // DOM already updated with new objects -- invalidate parent's children now
-       // For asynch we must wait until layout updates before we invalidate the children
--      nsCOMPtr<nsPIAccessible> privateContainerAccessible =
-+      nsPIAccessible* privateContainerAccessible =
-         do_QueryInterface(containerAccessible);
-       if (privateContainerAccessible) {
-         privateContainerAccessible->InvalidateChildren();
-@@ -1984,13 +1984,13 @@ NS_IMETHODIMP nsDocAccessible::Invalidat
-     nsIContent *ancestor = aChild;
-     while (PR_TRUE) {
-       if (roleMapEntry && roleMapEntry->role == nsIAccessibleRole::ROLE_ALERT) {
--        nsCOMPtr<nsIDOMNode> alertNode(do_QueryInterface(ancestor));
-+        nsIDOMNode* alertNode(do_QueryInterface(ancestor));
-         FireDelayedToolkitEvent(nsIAccessibleEvent::EVENT_ALERT, alertNode,
-                                 nsAccEvent::eRemoveDupes, isAsynch);
-         break;
-       }
-       ancestor = ancestor->GetParent();
--      nsCOMPtr<nsIDOMNode> ancestorNode = do_QueryInterface(ancestor);
-+      nsIDOMNode* ancestorNode = do_QueryInterface(ancestor);
-       if (!ancestorNode) {
-         break;
-       }
-@@ -2003,7 +2003,7 @@ NS_IMETHODIMP nsDocAccessible::Invalidat
-   if (childAccessible) {
-     // Fire an event so the MSAA clients know the children have changed. Also
-     // the event is used internally by MSAA part.
--    nsCOMPtr<nsIAccessibleEvent> reorderEvent =
-+    nsIAccessibleEvent* reorderEvent =
-       new nsAccEvent(nsIAccessibleEvent::EVENT_REORDER, containerAccessible,
-                      isAsynch, nsAccEvent::eCoalesceFromSameSubtree);
-     NS_ENSURE_TRUE(reorderEvent, NS_ERROR_OUT_OF_MEMORY);
-@@ -2020,14 +2020,14 @@ nsDocAccessible::GetAccessibleInParentCh
- {
-   // Find accessible in parent chain of DOM nodes, or return null
-   *aAccessible = nsnull;
--  nsCOMPtr<nsIDOMNode> currentNode(aNode), parentNode;
--  nsCOMPtr<nsIAccessNode> accessNode;
-+  nsIDOMNode* currentNode(aNode), *parentNode = nsnull;
-+  nsIAccessNode* accessNode = nsnull;
- 
-   nsIAccessibilityService *accService = GetAccService();
-   NS_ENSURE_TRUE(accService, NS_ERROR_FAILURE);
- 
-   do {
--    currentNode->GetParentNode(getter_AddRefs(parentNode));
-+    currentNode->GetParentNode(&parentNode);
-     currentNode = parentNode;
-     if (!currentNode) {
-       NS_ADDREF_THIS();
-@@ -2035,16 +2035,16 @@ nsDocAccessible::GetAccessibleInParentCh
-       break;
-     }
- 
--    nsCOMPtr<nsIDOMNode> relevantNode;
--    if (NS_SUCCEEDED(accService->GetRelevantContentNodeFor(currentNode, getter_AddRefs(relevantNode))) && relevantNode) {
-+    nsIDOMNode* relevantNode = nsnull;
-+    if (NS_SUCCEEDED(accService->GetRelevantContentNodeFor(currentNode, &relevantNode)) && relevantNode) {
-       currentNode = relevantNode;
-     }
-     if (aCanCreate) {
-       accService->GetAccessibleInWeakShell(currentNode, mWeakShell, aAccessible);
-     }
-     else { // Only return cached accessibles, don't create anything
--      nsCOMPtr<nsIAccessNode> accessNode;
--      GetCachedAccessNode(currentNode, getter_AddRefs(accessNode)); // AddRefs
-+      nsIAccessNode* accessNode = nsnull;
-+      GetCachedAccessNode(currentNode, &accessNode); // AddRefs
-       if (accessNode) {
-         CallQueryInterface(accessNode, aAccessible); // AddRefs
-       }
-@@ -2060,18 +2060,18 @@ nsDocAccessible::FireShowHideEvents(nsID
- {
-   NS_ENSURE_ARG(aDOMNode);
- 
--  nsCOMPtr<nsIAccessible> accessible;
-+  nsIAccessible* accessible = nsnull;
-   if (!aAvoidOnThisNode) {
-     if (aEventType == nsIAccessibleEvent::EVENT_ASYNCH_HIDE ||
-         aEventType == nsIAccessibleEvent::EVENT_DOM_DESTROY) {
-       // Don't allow creation for accessibles when nodes going away
--      nsCOMPtr<nsIAccessNode> accessNode;
--      GetCachedAccessNode(aDOMNode, getter_AddRefs(accessNode));
-+      nsIAccessNode* accessNode = nsnull;
-+      GetCachedAccessNode(aDOMNode, &accessNode);
-       accessible = do_QueryInterface(accessNode);
-     } else {
-       // Allow creation of new accessibles for show events
-       GetAccService()->GetAttachedAccessibleFor(aDOMNode,
--                                                getter_AddRefs(accessible));
-+                                                &accessible);
-     }
-   }
- 
-@@ -2081,7 +2081,7 @@ nsDocAccessible::FireShowHideEvents(nsID
-     PRBool isAsynch = aEventType == nsIAccessibleEvent::EVENT_ASYNCH_HIDE ||
-                       aEventType == nsIAccessibleEvent::EVENT_ASYNCH_SHOW;
- 
--    nsCOMPtr<nsIAccessibleEvent> event =
-+    nsIAccessibleEvent* event =
-       new nsAccEvent(aEventType, accessible, isAsynch,
-                      nsAccEvent::eCoalesceFromSameSubtree);
-     NS_ENSURE_TRUE(event, NS_ERROR_OUT_OF_MEMORY);
-@@ -2096,10 +2096,10 @@ nsDocAccessible::FireShowHideEvents(nsID
- 
-   // Could not find accessible to show hide yet, so fire on any
-   // accessible descendants in this subtree
--  nsCOMPtr<nsINode> node(do_QueryInterface(aDOMNode));
-+  nsINode* node(do_QueryInterface(aDOMNode));
-   PRUint32 count = node->GetChildCount();
-   for (PRUint32 index = 0; index < count; index++) {
--    nsCOMPtr<nsIDOMNode> childNode = do_QueryInterface(node->GetChildAt(index));
-+    nsIDOMNode* childNode = do_QueryInterface(node->GetChildAt(index));
-     nsresult rv = FireShowHideEvents(childNode, PR_FALSE, aEventType,
-                                      aDelay, aForceIsFromUserInput);
-     NS_ENSURE_SUCCESS(rv, rv);
-diff --git a/accessible/src/base/nsDocAccessible.h b/accessible/src/base/nsDocAccessible.h
---- a/accessible/src/base/nsDocAccessible.h
-+++ b/accessible/src/base/nsDocAccessible.h
-@@ -183,7 +183,7 @@ class nsDocAccessible : public nsHyperTe
-      * @param aAccessibleForChangeNode, the accessible for that node, or nsnull if none exists
-      * @param aIsInserting, is aChangeNode being created or shown (vs. removed or hidden)
-      */
--    already_AddRefed<nsIAccessibleTextChangeEvent>
-+    nsIAccessibleTextChangeEvent*
-     CreateTextChangeEventForNode(nsIAccessible *aContainerAccessible,
-                                  nsIDOMNode *aChangeNode,
-                                  nsIAccessible *aAccessibleForNode,
-diff --git a/accessible/src/base/nsOuterDocAccessible.cpp b/accessible/src/base/nsOuterDocAccessible.cpp
---- a/accessible/src/base/nsOuterDocAccessible.cpp
-+++ b/accessible/src/base/nsOuterDocAccessible.cpp
-@@ -105,25 +105,25 @@ void nsOuterDocAccessible::CacheChildren
-   // The outer node is a something like a <browser>, <frame>, <iframe>, <page> or
-   // <editor> tag, whereas the inner node corresponds to the inner document root.
- 
--  nsCOMPtr<nsIContent> content(do_QueryInterface(mDOMNode));
-+  nsIContent* content(do_QueryInterface(mDOMNode));
-   NS_ASSERTION(content, "No nsIContent for <browser>/<iframe>/<editor> dom node");
- 
--  nsCOMPtr<nsIDocument> outerDoc = content->GetDocument();
-+  nsIDocument* outerDoc = content->GetDocument();
-   if (!outerDoc) {
-     return;
-   }
- 
-   nsIDocument *innerDoc = outerDoc->GetSubDocumentFor(content);
--  nsCOMPtr<nsIDOMNode> innerNode(do_QueryInterface(innerDoc));
-+  nsIDOMNode* innerNode(do_QueryInterface(innerDoc));
-   if (!innerNode) {
-     return;
-   }
- 
--  nsCOMPtr<nsIAccessible> innerAccessible;
--  nsCOMPtr<nsIAccessibilityService> accService = 
-+  nsIAccessible* innerAccessible = nsnull;
-+  nsIAccessibilityService* accService = 
-     do_GetService("@mozilla.org/accessibilityService;1");
--  accService->GetAccessibleFor(innerNode, getter_AddRefs(innerAccessible));
--  nsCOMPtr<nsPIAccessible> privateInnerAccessible = 
-+  accService->GetAccessibleFor(innerNode, &innerAccessible);
-+  nsPIAccessible* privateInnerAccessible = 
-     do_QueryInterface(innerAccessible);
-   if (!privateInnerAccessible) {
-     return;
-diff --git a/accessible/src/base/nsRootAccessible.cpp b/accessible/src/base/nsRootAccessible.cpp
---- a/accessible/src/base/nsRootAccessible.cpp
-+++ b/accessible/src/base/nsRootAccessible.cpp
-@@ -132,14 +132,14 @@ NS_IMETHODIMP nsRootAccessible::GetName(
-     }
-   }
- 
--  nsCOMPtr<nsIDocShellTreeItem> docShellAsItem =
-+  nsIDocShellTreeItem* docShellAsItem =
-     nsAccUtils::GetDocShellTreeItemFor(mDOMNode);
-   NS_ENSURE_TRUE(docShellAsItem, NS_ERROR_FAILURE);
- 
--  nsCOMPtr<nsIDocShellTreeOwner> treeOwner;
--  docShellAsItem->GetTreeOwner(getter_AddRefs(treeOwner));
-+  nsIDocShellTreeOwner* treeOwner = nsnull;
-+  docShellAsItem->GetTreeOwner(&treeOwner);
- 
--  nsCOMPtr<nsIBaseWindow> baseWindow(do_QueryInterface(treeOwner));
-+  nsIBaseWindow* baseWindow(do_QueryInterface(treeOwner));
-   if (baseWindow) {
-     nsXPIDLString title;
-     baseWindow->GetTitle(getter_Copies(title));
-@@ -156,7 +156,7 @@ NS_IMETHODIMP nsRootAccessible::GetParen
-   NS_ENSURE_ARG_POINTER(aParent);
-   *aParent = nsnull;
- 
--  nsRefPtr<nsApplicationAccessibleWrap> root = GetApplicationAccessible();
-+  nsApplicationAccessibleWrap* root = GetApplicationAccessible();
-   NS_IF_ADDREF(*aParent = root);
- 
-   return NS_OK;
-@@ -172,7 +172,7 @@ NS_IMETHODIMP nsRootAccessible::GetRole(
-   // If it's a <dialog> or <wizard>, use nsIAccessibleRole::ROLE_DIALOG instead
-   nsIContent *rootContent = mDocument->GetRootContent();
-   if (rootContent) {
--    nsCOMPtr<nsIDOMElement> rootElement(do_QueryInterface(rootContent));
-+    nsIDOMElement* rootElement(do_QueryInterface(rootContent));
-     if (rootElement) {
-       nsAutoString name;
-       rootElement->GetLocalName(name);
-@@ -192,13 +192,13 @@ PRUint32 nsRootAccessible::GetChromeFlag
-   // Return the flag set for the top level window as defined 
-   // by nsIWebBrowserChrome::CHROME_WINDOW_[FLAGNAME]
-   // Not simple: nsIXULWindow is not just a QI from nsIDOMWindow
--  nsCOMPtr<nsIDocShellTreeItem> treeItem =
-+  nsIDocShellTreeItem* treeItem =
-     nsAccUtils::GetDocShellTreeItemFor(mDOMNode);
-   NS_ENSURE_TRUE(treeItem, 0);
--  nsCOMPtr<nsIDocShellTreeOwner> treeOwner;
--  treeItem->GetTreeOwner(getter_AddRefs(treeOwner));
-+  nsIDocShellTreeOwner* treeOwner = nsnull;
-+  treeItem->GetTreeOwner(&treeOwner);
-   NS_ENSURE_TRUE(treeOwner, 0);
--  nsCOMPtr<nsIXULWindow> xulWin(do_GetInterface(treeOwner));
-+  nsIXULWindow* xulWin(do_GetInterface(treeOwner));
-   if (!xulWin) {
-     return 0;
-   }
-@@ -232,9 +232,9 @@ nsRootAccessible::GetState(PRUint32 *aSt
-   if (!aExtraState)
-     return NS_OK;
- 
--  nsCOMPtr<nsIDOMWindow> domWin;
--  GetWindow(getter_AddRefs(domWin));
--  nsCOMPtr<nsPIDOMWindow> privateDOMWindow(do_QueryInterface(domWin));
-+  nsIDOMWindow* domWin = nsnull;
-+  GetWindow(&domWin);
-+  nsPIDOMWindow* privateDOMWindow(do_QueryInterface(domWin));
-   if (privateDOMWindow) {
-     nsIFocusController *focusController =
-       privateDOMWindow->GetRootFocusController();
-@@ -258,15 +258,15 @@ void
- void
- nsRootAccessible::GetChromeEventHandler(nsIDOMEventTarget **aChromeTarget)
- {
--  nsCOMPtr<nsIDOMWindow> domWin;
--  GetWindow(getter_AddRefs(domWin));
--  nsCOMPtr<nsPIDOMWindow> privateDOMWindow(do_QueryInterface(domWin));
--  nsCOMPtr<nsPIDOMEventTarget> chromeEventHandler;
-+  nsIDOMWindow* domWin = nsnull;
-+  GetWindow(&domWin);
-+  nsPIDOMWindow* privateDOMWindow(do_QueryInterface(domWin));
-+  nsPIDOMEventTarget* chromeEventHandler = nsnull;
-   if (privateDOMWindow) {
-     chromeEventHandler = privateDOMWindow->GetChromeEventHandler();
-   }
- 
--  nsCOMPtr<nsIDOMEventTarget> target(do_QueryInterface(chromeEventHandler));
-+  nsIDOMEventTarget* target(do_QueryInterface(chromeEventHandler));
- 
-   *aChromeTarget = target;
-   NS_IF_ADDREF(*aChromeTarget);
-@@ -311,7 +311,7 @@ nsresult nsRootAccessible::AddEventListe
-   // receive untrusted events (synthetic events generated by untrusted code).
-   // For example, XBL bindings implementations for elements that are hosted in
-   // non chrome document fire untrusted events.
--  nsCOMPtr<nsIDOMNSEventTarget> nstarget(do_QueryInterface(mDocument));
-+  nsIDOMNSEventTarget* nstarget(do_QueryInterface(mDocument));
- 
-   if (nstarget) {
-     for (const char* const* e = docEvents,
-@@ -323,8 +323,8 @@ nsresult nsRootAccessible::AddEventListe
-     }
-   }
- 
--  nsCOMPtr<nsIDOMEventTarget> target;
--  GetChromeEventHandler(getter_AddRefs(target));
-+  nsIDOMEventTarget* target = nsnull;
-+  GetChromeEventHandler(&target);
-   if (target) {
-     target->AddEventListener(NS_LITERAL_STRING("pagehide"), this, PR_TRUE);
-   }
-@@ -338,7 +338,7 @@ nsresult nsRootAccessible::AddEventListe
- 
- nsresult nsRootAccessible::RemoveEventListeners()
- {
--  nsCOMPtr<nsIDOMEventTarget> target(do_QueryInterface(mDocument));
-+  nsIDOMEventTarget* target(do_QueryInterface(mDocument));
-   if (target) { 
-     for (const char* const* e = docEvents,
-                    * const* e_end = docEvents + NS_ARRAY_LENGTH(docEvents);
-@@ -348,7 +348,7 @@ nsresult nsRootAccessible::RemoveEventLi
-     }
-   }
- 
--  GetChromeEventHandler(getter_AddRefs(target));
-+  GetChromeEventHandler(&target);
-   if (target) {
-     target->RemoveEventListener(NS_LITERAL_STRING("pagehide"), this, PR_TRUE);
-   }
-@@ -383,7 +383,7 @@ void nsRootAccessible::TryFireEarlyLoadE
- 
-   // This also works for firing events for error pages
- 
--  nsCOMPtr<nsIDocShellTreeItem> treeItem =
-+  nsIDocShellTreeItem* treeItem =
-     nsAccUtils::GetDocShellTreeItemFor(aDocNode);
-   NS_ASSERTION(treeItem, "No docshelltreeitem for aDocNode");
-   if (!treeItem) {
-@@ -397,7 +397,7 @@ void nsRootAccessible::TryFireEarlyLoadE
- 
-   // The doc accessible should already be created as a result of the
-   // OnStateChange() for the initiation of page loading
--  nsCOMPtr<nsIDocShellTreeNode> treeNode(do_QueryInterface(treeItem));
-+  nsIDocShellTreeNode* treeNode(do_QueryInterface(treeItem));
-   if (treeNode) {
-     PRInt32 subDocuments;
-     treeNode->GetChildCount(&subDocuments);
-@@ -405,8 +405,8 @@ void nsRootAccessible::TryFireEarlyLoadE
-       return;
-     }
-   }
--  nsCOMPtr<nsIDocShellTreeItem> rootContentTreeItem;
--  treeItem->GetSameTypeRootTreeItem(getter_AddRefs(rootContentTreeItem));
-+  nsIDocShellTreeItem* rootContentTreeItem = nsnull;
-+  treeItem->GetSameTypeRootTreeItem(&rootContentTreeItem);
-   NS_ASSERTION(rootContentTreeItem, "No root content tree item");
-   if (rootContentTreeItem == treeItem) {
-     // No frames or iframes, so we can fire the doc load finished event early
-@@ -421,7 +421,7 @@ PRBool nsRootAccessible::FireAccessibleF
-                                                   PRBool aIsAsynch)
- {
-   if (mCaretAccessible) {
--    nsCOMPtr<nsIDOMNSEvent> nsevent(do_QueryInterface(aFocusEvent));
-+    nsIDOMNSEvent* nsevent(do_QueryInterface(aFocusEvent));
-     if (nsevent) {
-       // Use the originally focused node where the selection lives.
-       // For example, use the anonymous HTML:input instead of the containing
-@@ -431,9 +431,9 @@ PRBool nsRootAccessible::FireAccessibleF
-       // This happens because when some bindings handle focus, they retarget
-       // focus to the appropriate child inside of themselves, but DOM focus
-       // stays outside on that binding parent.
--      nsCOMPtr<nsIDOMEventTarget> domEventTarget;
--      nsevent->GetOriginalTarget(getter_AddRefs(domEventTarget));
--      nsCOMPtr<nsIDOMNode> realFocusedNode(do_QueryInterface(domEventTarget));
-+      nsIDOMEventTarget* domEventTarget = nsnull;
-+      nsevent->GetOriginalTarget(&domEventTarget);
-+      nsIDOMNode* realFocusedNode(do_QueryInterface(domEventTarget));
-       if (!realFocusedNode) {
-         // When FireCurrentFocusEvent() synthesizes a focus event,
-         // the orignal target does not exist, so use the passed-in node
-@@ -447,22 +447,22 @@ PRBool nsRootAccessible::FireAccessibleF
-   }
- 
-   // Check for aria-activedescendant, which changes which element has focus
--  nsCOMPtr<nsIDOMNode> finalFocusNode = aNode;
--  nsCOMPtr<nsIAccessible> finalFocusAccessible = aAccessible;
--  nsCOMPtr<nsIContent> finalFocusContent = GetRoleContent(finalFocusNode);
-+  nsIDOMNode* finalFocusNode = aNode;
-+  nsIAccessible* finalFocusAccessible = aAccessible;
-+  nsIContent* finalFocusContent = GetRoleContent(finalFocusNode);
-   if (finalFocusContent) {
-     nsAutoString id;
-     if (finalFocusContent->GetAttr(kNameSpaceID_None, nsAccessibilityAtoms::aria_activedescendant, id)) {
--      nsCOMPtr<nsIDOMDocument> domDoc;
--      aNode->GetOwnerDocument(getter_AddRefs(domDoc));
-+      nsIDOMDocument* domDoc = nsnull;
-+      aNode->GetOwnerDocument(&domDoc);
-       if (!domDoc) {  // Maybe the passed-in node actually is a doc
-         domDoc = do_QueryInterface(aNode);
-       }
-       if (!domDoc) {
-         return PR_FALSE;
-       }
--      nsCOMPtr<nsIDOMElement> relatedEl;
--      domDoc->GetElementById(id, getter_AddRefs(relatedEl));
-+      nsIDOMElement* relatedEl = nsnull;
-+      domDoc->GetElementById(id, &relatedEl);
-       finalFocusNode = do_QueryInterface(relatedEl);
-       if (!finalFocusNode) {
-         // If aria-activedescendant is set to nonextistant ID, then treat as focus
-@@ -479,7 +479,7 @@ PRBool nsRootAccessible::FireAccessibleF
-   }
- 
-   if (!finalFocusAccessible) {
--    GetAccService()->GetAccessibleFor(finalFocusNode, getter_AddRefs(finalFocusAccessible));      
-+    GetAccService()->GetAccessibleFor(finalFocusNode, &finalFocusAccessible);      
-     // For activedescendant, the ARIA spec does not require that the user agent
-     // checks whether finalFocusNode is actually a descendant of the element with
-     // the activedescendant attribute.
-@@ -495,9 +495,9 @@ PRBool nsRootAccessible::FireAccessibleF
-       PRUint32 naturalRole; // The natural role is the role that this type of element normally has
-       finalFocusAccessible->GetRole(&naturalRole);
-       if (role != naturalRole) { // Must be a DHTML menuitem
--        nsCOMPtr<nsIAccessible> menuBarAccessible =
-+        nsIAccessible* menuBarAccessible =
-           nsAccUtils::GetAncestorWithRole(finalFocusAccessible, nsIAccessibleRole::ROLE_MENUBAR);
--        nsCOMPtr<nsIAccessNode> menuBarAccessNode = do_QueryInterface(menuBarAccessible);
-+        nsIAccessNode* menuBarAccessNode = do_QueryInterface(menuBarAccessible);
-         if (menuBarAccessNode) {
-           menuBarAccessNode->GetDOMNode(getter_AddRefs(mCurrentARIAMenubar));
-           if (mCurrentARIAMenubar) {
-@@ -508,7 +508,7 @@ PRBool nsRootAccessible::FireAccessibleF
-     }
-   }
-   else if (mCurrentARIAMenubar) {
--    nsCOMPtr<nsIAccessibleEvent> menuEndEvent =
-+    nsIAccessibleEvent* menuEndEvent =
-       new nsAccEvent(nsIAccessibleEvent::EVENT_MENU_END, mCurrentARIAMenubar,
-                      PR_FALSE, nsAccEvent::eAllowDupes);
-     if (menuEndEvent) {
-@@ -521,18 +521,18 @@ PRBool nsRootAccessible::FireAccessibleF
-   gLastFocusedNode = finalFocusNode;
-   NS_IF_ADDREF(gLastFocusedNode);
- 
--  nsCOMPtr<nsIContent> focusContent = do_QueryInterface(gLastFocusedNode);
-+  nsIContent* focusContent = do_QueryInterface(gLastFocusedNode);
-   nsIFrame *focusFrame = nsnull;
-   if (focusContent) {
--    nsCOMPtr<nsIPresShell> shell = nsAccessNode::GetPresShellFor(gLastFocusedNode);
-+    nsIPresShell* shell = nsAccessNode::GetPresShellFor(gLastFocusedNode);
-     focusFrame = shell->GetRealPrimaryFrameFor(focusContent);
-   }
-   gLastFocusedFrameType = (focusFrame && focusFrame->GetStyleVisibility()->IsVisible()) ? focusFrame->GetType() : 0;
- 
--  nsCOMPtr<nsIAccessibleDocument> docAccessible = do_QueryInterface(finalFocusAccessible);
-+  nsIAccessibleDocument* docAccessible = do_QueryInterface(finalFocusAccessible);
-   if (docAccessible) {
-     // Doc is gaining focus, but actual focus may be on an element within document
--    nsCOMPtr<nsIDOMNode> realFocusedNode = GetCurrentFocus();
-+    nsIDOMNode* realFocusedNode = GetCurrentFocus();
-     if (realFocusedNode != aNode || realFocusedNode == mDOMNode) {
-       // Suppress document focus, because real DOM focus will be fired next,
-       // and that's what we care about
-@@ -551,24 +551,24 @@ return PR_FALSE;
- 
- void nsRootAccessible::FireCurrentFocusEvent()
- {
--  nsCOMPtr<nsIDOMNode> focusedNode = GetCurrentFocus();
-+  nsIDOMNode* focusedNode = GetCurrentFocus();
-   if (!focusedNode) {
-     return; // No current focus
-   }
- 
-   // Simulate a focus event so that we can reuse code that fires focus for container children like treeitems
--  nsCOMPtr<nsIDOMDocumentEvent> docEvent = do_QueryInterface(mDocument);
-+  nsIDOMDocumentEvent* docEvent = do_QueryInterface(mDocument);
-   if (docEvent) {
--    nsCOMPtr<nsIDOMEvent> event;
-+    nsIDOMEvent* event = nsnull;
-     if (NS_SUCCEEDED(docEvent->CreateEvent(NS_LITERAL_STRING("Events"),
--                                           getter_AddRefs(event))) &&
-+                                           &event)) &&
-         NS_SUCCEEDED(event->InitEvent(NS_LITERAL_STRING("focus"), PR_TRUE, PR_TRUE))) {
-       // Get the target node we really want for the event.
-       nsIAccessibilityService* accService = GetAccService();
-       if (accService) {
--        nsCOMPtr<nsIDOMNode> targetNode;
-+        nsIDOMNode* targetNode = nsnull;
-         accService->GetRelevantContentNodeFor(focusedNode,
--                                            getter_AddRefs(targetNode));
-+                                            &targetNode);
-         if (targetNode) {
-           HandleEventWithTarget(event, targetNode);
-         }
-@@ -583,8 +583,8 @@ NS_IMETHODIMP nsRootAccessible::HandleEv
- {
-   // Turn DOM events in accessibility events
-   // Get info about event and target
--  nsCOMPtr<nsIDOMNode> targetNode;
--  GetTargetNode(aEvent, getter_AddRefs(targetNode));
-+  nsIDOMNode* targetNode = nsnull;
-+  GetTargetNode(aEvent, &targetNode);
-   if (!targetNode)
-     return NS_ERROR_FAILURE;
-   
-@@ -621,16 +621,16 @@ nsresult nsRootAccessible::HandleEventWi
-     // so that we don't destroy something still in use, like wizard page. 
-     // And we only get cached document accessible to destroy, so that we don't
-     // create it just to destroy it.
--    nsCOMPtr<nsIDocument> doc(do_QueryInterface(aTargetNode));
--    nsCOMPtr<nsIAccessibleDocument> accDoc = GetDocAccessibleFor(doc);
--    nsCOMPtr<nsPIAccessNode> privateAcc = do_QueryInterface(accDoc);
-+    nsIDocument* doc(do_QueryInterface(aTargetNode));
-+    nsIAccessibleDocument* accDoc = GetDocAccessibleFor(doc);
-+    nsPIAccessNode* privateAcc = do_QueryInterface(accDoc);
-     if (privateAcc) {
-       privateAcc->Shutdown();
-     }
-     return NS_OK;
-   }
- 
--  nsCOMPtr<nsIPresShell> eventShell = GetPresShellFor(aTargetNode);
-+  nsIPresShell* eventShell = GetPresShellFor(aTargetNode);
-   if (!eventShell) {
-     return NS_OK;
-   }
-@@ -658,16 +658,16 @@ nsresult nsRootAccessible::HandleEventWi
-     FireCurrentFocusEvent();
-   }
- 
--  nsCOMPtr<nsIAccessible> accessible;
-+  nsIAccessible* accessible = nsnull;
-   accService->GetAccessibleInShell(aTargetNode, eventShell,
--                                   getter_AddRefs(accessible));
--  nsCOMPtr<nsPIAccessible> privAcc(do_QueryInterface(accessible));
-+                                   &accessible);
-+  nsPIAccessible* privAcc(do_QueryInterface(accessible));
-   if (!privAcc)
-     return NS_OK;
- 
- #ifdef MOZ_XUL
-   if (isTree) {
--    nsCOMPtr<nsIAccessibleTreeCache> treeAcc(do_QueryInterface(accessible));
-+    nsIAccessibleTreeCache* treeAcc(do_QueryInterface(accessible));
-     NS_ASSERTION(treeAcc,
-                  "Accessible for xul:tree doesn't implement nsIAccessibleTreeCache interface.");
- 
-@@ -694,7 +694,7 @@ nsresult nsRootAccessible::HandleEventWi
-     PRBool isEnabled = (state & (nsIAccessibleStates::STATE_CHECKED |
-                         nsIAccessibleStates::STATE_SELECTED)) != 0;
- 
--    nsCOMPtr<nsIAccessibleStateChangeEvent> accEvent =
-+    nsIAccessibleStateChangeEvent* accEvent =
-       new nsAccStateChangeEvent(accessible, nsIAccessibleStates::STATE_CHECKED,
-                                 PR_FALSE, isEnabled);
-     privAcc->FireAccessibleEvent(accEvent);
-@@ -710,7 +710,7 @@ nsresult nsRootAccessible::HandleEventWi
- 
-     PRBool isEnabled = !!(state & nsIAccessibleStates::STATE_CHECKED);
- 
--    nsCOMPtr<nsIAccessibleStateChangeEvent> accEvent =
-+    nsIAccessibleStateChangeEvent* accEvent =
-       new nsAccStateChangeEvent(accessible,
-                                 nsIAccessibleStates::STATE_CHECKED,
-                                 PR_FALSE, isEnabled);
-@@ -718,22 +718,22 @@ nsresult nsRootAccessible::HandleEventWi
-     return privAcc->FireAccessibleEvent(accEvent);
-   }
- 
--  nsCOMPtr<nsIAccessible> treeItemAccessible;
-+  nsIAccessible* treeItemAccessible = nsnull;
- #ifdef MOZ_XUL
-   // If it's a tree element, need the currently selected item
-   if (isTree) {
--    nsCOMPtr<nsIDOMXULMultiSelectControlElement> multiSelect =
-+    nsIDOMXULMultiSelectControlElement* multiSelect =
-       do_QueryInterface(aTargetNode);
-     if (multiSelect) {
-       PRInt32 treeIndex = -1;
-       multiSelect->GetCurrentIndex(&treeIndex);
-       if (treeIndex >= 0) {
--        nsCOMPtr<nsIAccessibleTreeCache> treeCache(do_QueryInterface(accessible));
-+        nsIAccessibleTreeCache* treeCache(do_QueryInterface(accessible));
-         if (!treeCache ||
-             NS_FAILED(treeCache->GetCachedTreeitemAccessible(
-                       treeIndex,
-                       nsnull,
--                      getter_AddRefs(treeItemAccessible))) ||
-+                      &treeItemAccessible)) ||
-                       !treeItemAccessible) {
-           return NS_ERROR_OUT_OF_MEMORY;
-         }
-@@ -748,7 +748,7 @@ nsresult nsRootAccessible::HandleEventWi
-     PRUint32 state = State(accessible); // collapsed/expanded changed
-     PRBool isEnabled = (state & nsIAccessibleStates::STATE_EXPANDED) != 0;
- 
--    nsCOMPtr<nsIAccessibleStateChangeEvent> accEvent =
-+    nsIAccessibleStateChangeEvent* accEvent =
-       new nsAccStateChangeEvent(accessible, nsIAccessibleStates::STATE_EXPANDED,
-                                 PR_FALSE, isEnabled);
-     return FireAccessibleEvent(accEvent);
-@@ -757,7 +757,7 @@ nsresult nsRootAccessible::HandleEventWi
-   if (treeItemAccessible && eventType.EqualsLiteral("select")) {
-     // If multiselect tree, we should fire selectionadd or selection removed
-     if (gLastFocusedNode == aTargetNode) {
--      nsCOMPtr<nsIDOMXULMultiSelectControlElement> multiSel =
-+      nsIDOMXULMultiSelectControlElement* multiSel =
-         do_QueryInterface(aTargetNode);
-       nsAutoString selType;
-       multiSel->GetSelType(selType);
-@@ -793,19 +793,19 @@ nsresult nsRootAccessible::HandleEventWi
-     // Keep a reference to the target node. We might want to change
-     // it to the individual radio button or selected item, and send
-     // the focus event to that.
--    nsCOMPtr<nsIDOMNode> focusedItem(aTargetNode);
-+    nsIDOMNode* focusedItem(aTargetNode);
- 
-     if (!treeItemAccessible) {
--      nsCOMPtr<nsIDOMXULSelectControlElement> selectControl =
-+      nsIDOMXULSelectControlElement* selectControl =
-         do_QueryInterface(aTargetNode);
-       if (selectControl) {
--        nsCOMPtr<nsIDOMXULMenuListElement> menuList =
-+        nsIDOMXULMenuListElement* menuList =
-           do_QueryInterface(aTargetNode);
-         if (!menuList) {
-           // Don't do this for menu lists, the items only get focused
-           // when the list is open, based on DOMMenuitemActive events
--          nsCOMPtr<nsIDOMXULSelectControlItemElement> selectedItem;
--          selectControl->GetSelectedItem(getter_AddRefs(selectedItem));
-+          nsIDOMXULSelectControlItemElement* selectedItem = nsnull;
-+          selectControl->GetSelectedItem(&selectedItem);
-           if (selectedItem)
-             focusedItem = do_QueryInterface(selectedItem);
- 
-@@ -813,7 +813,7 @@ nsresult nsRootAccessible::HandleEventWi
-             return NS_OK;
- 
-           accService->GetAccessibleInShell(focusedItem, eventShell,
--                                           getter_AddRefs(accessible));
-+                                           &accessible);
-           if (!accessible)
-             return NS_OK;
-         }
-@@ -856,7 +856,7 @@ nsresult nsRootAccessible::HandleEventWi
-         return NS_OK; // Tree with nothing selected
-       }
- #endif
--      nsCOMPtr<nsPIAccessNode> menuAccessNode = do_QueryInterface(accessible);
-+      nsPIAccessNode* menuAccessNode = do_QueryInterface(accessible);
-       NS_ENSURE_TRUE(menuAccessNode, NS_ERROR_FAILURE);
-       nsIFrame* menuFrame = menuAccessNode->GetFrame();
-       NS_ENSURE_TRUE(menuFrame, NS_ERROR_FAILURE);
-@@ -871,15 +871,15 @@ nsresult nsRootAccessible::HandleEventWi
-         // is active.
-         return NS_OK;
-       } else {
--        nsCOMPtr<nsIAccessible> containerAccessible;
--        accessible->GetParent(getter_AddRefs(containerAccessible));
-+        nsIAccessible* containerAccessible = nsnull;
-+        accessible->GetParent(&containerAccessible);
-         NS_ENSURE_TRUE(containerAccessible, NS_ERROR_FAILURE);
-         // It is not top level menuitem
-         // Only fire focus event if it is not inside collapsed popup
-         // and not a listitem of a combo box
-         if (State(containerAccessible) & nsIAccessibleStates::STATE_COLLAPSED) {
--          nsCOMPtr<nsIAccessible> containerParent;
--          containerAccessible->GetParent(getter_AddRefs(containerParent));
-+          nsIAccessible* containerParent = nsnull;
-+          containerAccessible->GetParent(&containerParent);
-           NS_ENSURE_TRUE(containerParent, NS_ERROR_FAILURE);
-           if (Role(containerParent) != nsIAccessibleRole::ROLE_COMBOBOX) {
-             return NS_OK;
-@@ -888,12 +888,12 @@ nsresult nsRootAccessible::HandleEventWi
-       }
-     }
-     if (!fireFocus) {
--      nsCOMPtr<nsIDOMNode> realFocusedNode = GetCurrentFocus();
--      nsCOMPtr<nsIContent> realFocusedContent = do_QueryInterface(realFocusedNode);
--      nsCOMPtr<nsIContent> targetContent = do_QueryInterface(aTargetNode);
-+      nsIDOMNode* realFocusedNode = GetCurrentFocus();
-+      nsIContent* realFocusedContent = do_QueryInterface(realFocusedNode);
-+      nsIContent* targetContent = do_QueryInterface(aTargetNode);
-       nsIContent *containerContent = targetContent;
-       while (containerContent) {
--        nsCOMPtr<nsIDOMXULPopupElement> popup = do_QueryInterface(containerContent);
-+        nsIDOMXULPopupElement* popup = do_QueryInterface(containerContent);
-         if (popup || containerContent == realFocusedContent) { 
-           // If we're inside the focus or a popup we can fire focus events
-           // for the changed active item
-@@ -932,14 +932,14 @@ void nsRootAccessible::GetTargetNode(nsI
- {
-   *aTargetNode = nsnull;
- 
--  nsCOMPtr<nsIDOMNSEvent> nsevent(do_QueryInterface(aEvent));
-+  nsIDOMNSEvent* nsevent(do_QueryInterface(aEvent));
- 
-   if (!nsevent)
-     return;
- 
--  nsCOMPtr<nsIDOMEventTarget> domEventTarget;
--  nsevent->GetOriginalTarget(getter_AddRefs(domEventTarget));
--  nsCOMPtr<nsIDOMNode> eventTarget(do_QueryInterface(domEventTarget));
-+  nsIDOMEventTarget* domEventTarget = nsnull;
-+  nsevent->GetOriginalTarget(&domEventTarget);
-+  nsIDOMNode* eventTarget(do_QueryInterface(domEventTarget));
-   if (!eventTarget)
-     return;
- 
-@@ -967,7 +967,7 @@ nsRootAccessible::Init()
-   nsresult rv = nsDocAccessibleWrap::Init();
-   NS_ENSURE_SUCCESS(rv, rv);
- 
--  nsRefPtr<nsApplicationAccessibleWrap> root = GetApplicationAccessible();
-+  nsApplicationAccessibleWrap* root = GetApplicationAccessible();
-   NS_ENSURE_STATE(root);
- 
-   root->AddRootAccessible(this);
-@@ -981,7 +981,7 @@ NS_IMETHODIMP nsRootAccessible::Shutdown
-     return NS_OK;  // Already shutdown
-   }
- 
--  nsRefPtr<nsApplicationAccessibleWrap> root = GetApplicationAccessible();
-+  nsApplicationAccessibleWrap* root = GetApplicationAccessible();
-   NS_ENSURE_STATE(root);
- 
-   root->RemoveRootAccessible(this);
-@@ -996,7 +996,7 @@ NS_IMETHODIMP nsRootAccessible::Shutdown
-   return nsDocAccessibleWrap::Shutdown();
- }
- 
--already_AddRefed<nsIDocShellTreeItem>
-+nsIDocShellTreeItem*
- nsRootAccessible::GetContentDocShell(nsIDocShellTreeItem *aStart)
- {
-   if (!aStart) {
-@@ -1006,9 +1006,9 @@ nsRootAccessible::GetContentDocShell(nsI
-   PRInt32 itemType;
-   aStart->GetItemType(&itemType);
-   if (itemType == nsIDocShellTreeItem::typeContent) {
--    nsCOMPtr<nsIAccessibleDocument> accDoc =
-+    nsIAccessibleDocument* accDoc =
-       GetDocAccessibleFor(aStart, PR_TRUE);
--    nsCOMPtr<nsIAccessible> accessible = do_QueryInterface(accDoc);
-+    nsIAccessible* accessible = do_QueryInterface(accDoc);
-     // If ancestor chain of accessibles is not completely visible,
-     // don't use this one. This happens for example if it's inside
-     // a background tab (tabbed browsing)
-@@ -1016,24 +1016,24 @@ nsRootAccessible::GetContentDocShell(nsI
-       if (State(accessible) & nsIAccessibleStates::STATE_INVISIBLE) {
-         return nsnull;
-       }
--      nsCOMPtr<nsIAccessible> ancestor;
--      accessible->GetParent(getter_AddRefs(ancestor));
-+      nsIAccessible* ancestor = nsnull;
-+      accessible->GetParent(&ancestor);
-       if (ancestor == this) {
-         break; // Don't check past original root accessible we started with
-       }
--      accessible.swap(ancestor);
-+      swap(accessible, ancestor);
-     }
- 
-     NS_ADDREF(aStart);
-     return aStart;
-   }
--  nsCOMPtr<nsIDocShellTreeNode> treeNode(do_QueryInterface(aStart));
-+  nsIDocShellTreeNode* treeNode(do_QueryInterface(aStart));
-   if (treeNode) {
-     PRInt32 subDocuments;
-     treeNode->GetChildCount(&subDocuments);
-     for (PRInt32 count = 0; count < subDocuments; count ++) {
--      nsCOMPtr<nsIDocShellTreeItem> treeItemChild, contentTreeItem;
--      treeNode->GetChildAt(count, getter_AddRefs(treeItemChild));
-+      nsIDocShellTreeItem* treeItemChild = nsnull, *contentTreeItem = nsnull;
-+      treeNode->GetChildAt(count, &treeItemChild);
-       NS_ENSURE_TRUE(treeItemChild, nsnull);
-       contentTreeItem = GetContentDocShell(treeItemChild);
-       if (contentTreeItem) {
-@@ -1054,12 +1054,12 @@ NS_IMETHODIMP nsRootAccessible::GetAcces
-     return nsDocAccessibleWrap::GetAccessibleRelated(aRelationType, aRelated);
-   }
- 
--  nsCOMPtr<nsIDocShellTreeItem> treeItem =
-+  nsIDocShellTreeItem* treeItem =
-     nsAccUtils::GetDocShellTreeItemFor(mDOMNode);
--  nsCOMPtr<nsIDocShellTreeItem> contentTreeItem = GetContentDocShell(treeItem);
-+  nsIDocShellTreeItem* contentTreeItem = GetContentDocShell(treeItem);
-   // there may be no content area, so we need a null check
-   if (contentTreeItem) {
--    nsCOMPtr<nsIAccessibleDocument> accDoc =
-+    nsIAccessibleDocument* accDoc =
-       GetDocAccessibleFor(contentTreeItem, PR_TRUE);
-     NS_ASSERTION(accDoc, "No EMBEDS document");
-     if (accDoc) {
-@@ -1075,7 +1075,7 @@ NS_IMETHODIMP nsRootAccessible::FireDocL
-     return NS_OK;  // Document has been shut down
-   }
- 
--  nsCOMPtr<nsIDocShellTreeItem> docShellTreeItem =
-+  nsIDocShellTreeItem* docShellTreeItem =
-     nsAccUtils::GetDocShellTreeItemFor(mDOMNode);
-   NS_ASSERTION(docShellTreeItem, "No doc shell tree item for document");
-   NS_ENSURE_TRUE(docShellTreeItem, NS_ERROR_FAILURE);
-@@ -1096,19 +1096,19 @@ nsRootAccessible::HandleTreeRowCountChan
- nsRootAccessible::HandleTreeRowCountChangedEvent(nsIDOMEvent *aEvent,
-                                                  nsIAccessibleTreeCache *aAccessible)
- {
--  nsCOMPtr<nsIDOMDataContainerEvent> dataEvent(do_QueryInterface(aEvent));
-+  nsIDOMDataContainerEvent* dataEvent(do_QueryInterface(aEvent));
-   if (!dataEvent)
-     return NS_OK;
- 
--  nsCOMPtr<nsIVariant> indexVariant;
-+  nsIVariant* indexVariant = nsnull;
-   dataEvent->GetData(NS_LITERAL_STRING("index"),
--                     getter_AddRefs(indexVariant));
-+                     &indexVariant);
-   if (!indexVariant)
-     return NS_OK;
- 
--  nsCOMPtr<nsIVariant> countVariant;
-+  nsIVariant* countVariant = nsnull;
-   dataEvent->GetData(NS_LITERAL_STRING("count"),
--                     getter_AddRefs(countVariant));
-+                     &countVariant);
-   if (!countVariant)
-     return NS_OK;
- 
-@@ -1123,33 +1123,33 @@ nsRootAccessible::HandleTreeInvalidatedE
- nsRootAccessible::HandleTreeInvalidatedEvent(nsIDOMEvent *aEvent,
-                                              nsIAccessibleTreeCache *aAccessible)
- {
--  nsCOMPtr<nsIDOMDataContainerEvent> dataEvent(do_QueryInterface(aEvent));
-+  nsIDOMDataContainerEvent* dataEvent(do_QueryInterface(aEvent));
-   if (!dataEvent)
-     return NS_OK;
- 
-   PRInt32 startRow = 0, endRow = -1, startCol = 0, endCol = -1;
- 
--  nsCOMPtr<nsIVariant> startRowVariant;
-+  nsIVariant* startRowVariant = nsnull;
-   dataEvent->GetData(NS_LITERAL_STRING("startrow"),
--                     getter_AddRefs(startRowVariant));
-+                     &startRowVariant);
-   if (startRowVariant)
-     startRowVariant->GetAsInt32(&startRow);
- 
--  nsCOMPtr<nsIVariant> endRowVariant;
-+  nsIVariant* endRowVariant = nsnull;
-   dataEvent->GetData(NS_LITERAL_STRING("endrow"),
--                     getter_AddRefs(endRowVariant));
-+                     &endRowVariant);
-   if (endRowVariant)
-     endRowVariant->GetAsInt32(&endRow);
- 
--  nsCOMPtr<nsIVariant> startColVariant;
-+  nsIVariant* startColVariant = nsnull;
-   dataEvent->GetData(NS_LITERAL_STRING("startcolumn"),
--                     getter_AddRefs(startColVariant));
-+                     &startColVariant);
-   if (startColVariant)
-     startColVariant->GetAsInt32(&startCol);
- 
--  nsCOMPtr<nsIVariant> endColVariant;
-+  nsIVariant* endColVariant = nsnull;
-   dataEvent->GetData(NS_LITERAL_STRING("endcolumn"),
--                     getter_AddRefs(endColVariant));
-+                     &endColVariant);
-   if (endColVariant)
-     endColVariant->GetAsInt32(&endCol);
- 
-diff --git a/accessible/src/base/nsRootAccessible.h b/accessible/src/base/nsRootAccessible.h
---- a/accessible/src/base/nsRootAccessible.h
-+++ b/accessible/src/base/nsRootAccessible.h
-@@ -143,7 +143,7 @@ class nsRootAccessible : public nsDocAcc
- #ifdef MOZ_XUL
-     PRUint32 GetChromeFlags();
- #endif
--    already_AddRefed<nsIDocShellTreeItem>
-+    nsIDocShellTreeItem*
-            GetContentDocShell(nsIDocShellTreeItem *aStart);
-     nsRefPtr<nsCaretAccessible> mCaretAccessible;
-     nsCOMPtr<nsIDOMNode> mCurrentARIAMenubar;
-diff --git a/accessible/src/html/nsHTMLAreaAccessible.cpp b/accessible/src/html/nsHTMLAreaAccessible.cpp
---- a/accessible/src/html/nsHTMLAreaAccessible.cpp
-+++ b/accessible/src/html/nsHTMLAreaAccessible.cpp
-@@ -74,7 +74,7 @@ nsHTMLAreaAccessible::GetName(nsAString 
-       return NS_OK;
-   }
- 
--  nsCOMPtr<nsIContent> content(do_QueryInterface(mDOMNode));
-+  nsIContent* content(do_QueryInterface(mDOMNode));
-   if (!content->GetAttr(kNameSpaceID_None, nsAccessibilityAtoms::alt,
-                         aName) &&  
-       !content->GetAttr(kNameSpaceID_None, nsAccessibilityAtoms::title,
-@@ -91,7 +91,7 @@ nsHTMLAreaAccessible::GetDescription(nsA
-   aDescription.Truncate();
- 
-   // Still to do - follow IE's standard here
--  nsCOMPtr<nsIDOMHTMLAreaElement> area(do_QueryInterface(mDOMNode));
-+  nsIDOMHTMLAreaElement* area(do_QueryInterface(mDOMNode));
-   if (area) 
-     area->GetShape(aDescription);
- 
-@@ -136,7 +136,7 @@ nsHTMLAreaAccessible::GetBounds(PRInt32 
-   nsPresContext *presContext = GetPresContext();
-   NS_ENSURE_TRUE(presContext, NS_ERROR_FAILURE);
- 
--  nsCOMPtr<nsIContent> ourContent(do_QueryInterface(mDOMNode));
-+  nsIContent* ourContent(do_QueryInterface(mDOMNode));
-   NS_ENSURE_TRUE(ourContent, NS_ERROR_FAILURE);
- 
-   nsIFrame *frame = GetFrame();
-@@ -145,8 +145,8 @@ nsHTMLAreaAccessible::GetBounds(PRInt32 
-   nsresult rv = frame->QueryInterface(NS_GET_IID(nsIImageFrame), (void**)&imageFrame);
-   NS_ENSURE_SUCCESS(rv, rv);
- 
--  nsCOMPtr<nsIImageMap> map;
--  imageFrame->GetImageMap(presContext, getter_AddRefs(map));
-+  nsIImageMap* map = nsnull;
-+  imageFrame->GetImageMap(presContext, &map);
-   NS_ENSURE_TRUE(map, NS_ERROR_FAILURE);
- 
-   nsRect rect, orgRectPixels;
-diff --git a/accessible/src/html/nsHTMLFormControlAccessible.cpp b/accessible/src/html/nsHTMLFormControlAccessible.cpp
---- a/accessible/src/html/nsHTMLFormControlAccessible.cpp
-+++ b/accessible/src/html/nsHTMLFormControlAccessible.cpp
-@@ -113,7 +113,7 @@ nsHTMLCheckboxAccessible::GetState(PRUin
- 
-   PRBool checked = PR_FALSE;   // Radio buttons and check boxes can be checked
- 
--  nsCOMPtr<nsIDOMHTMLInputElement> htmlCheckboxElement(do_QueryInterface(mDOMNode));
-+  nsIDOMHTMLInputElement* htmlCheckboxElement(do_QueryInterface(mDOMNode));
-   if (htmlCheckboxElement)
-     htmlCheckboxElement->GetChecked(&checked);
- 
-@@ -142,7 +142,7 @@ nsHTMLRadioButtonAccessible::GetState(PR
-   
-   PRBool checked = PR_FALSE;   // Radio buttons and check boxes can be checked
- 
--  nsCOMPtr<nsIDOMHTMLInputElement> htmlRadioElement(do_QueryInterface(mDOMNode));
-+  nsIDOMHTMLInputElement* htmlRadioElement(do_QueryInterface(mDOMNode));
-   if (htmlRadioElement)
-     htmlRadioElement->GetChecked(&checked);
- 
-@@ -166,7 +166,7 @@ nsHTMLRadioButtonAccessible::GetAttribut
-   nsAutoString tagName;
-   mDOMNode->GetLocalName(tagName);
- 
--  nsCOMPtr<nsIContent> content(do_QueryInterface(mDOMNode));
-+  nsIContent* content(do_QueryInterface(mDOMNode));
-   NS_ENSURE_STATE(content);
- 
-   nsAutoString type;
-@@ -174,18 +174,18 @@ nsHTMLRadioButtonAccessible::GetAttribut
-   nsAutoString name;
-   content->GetAttr(kNameSpaceID_None, nsAccessibilityAtoms::name, name);
- 
--  nsCOMPtr<nsIDOMNodeList> inputs;
-+  nsIDOMNodeList* inputs = nsnull;
- 
--  nsCOMPtr<nsIDOMHTMLInputElement> radio(do_QueryInterface(mDOMNode));
--  nsCOMPtr<nsIDOMHTMLFormElement> form;
--  radio->GetForm(getter_AddRefs(form));
-+  nsIDOMHTMLInputElement* radio(do_QueryInterface(mDOMNode));
-+  nsIDOMHTMLFormElement* form = nsnull;
-+  radio->GetForm(&form);
-   if (form) {
--    form->GetElementsByTagNameNS(nsURI, tagName, getter_AddRefs(inputs));
-+    form->GetElementsByTagNameNS(nsURI, tagName, &inputs);
-   } else {
--    nsCOMPtr<nsIDOMDocument> document;
--    mDOMNode->GetOwnerDocument(getter_AddRefs(document));
-+    nsIDOMDocument* document = nsnull;
-+    mDOMNode->GetOwnerDocument(&document);
-     if (document)
--      document->GetElementsByTagNameNS(nsURI, tagName, getter_AddRefs(inputs));
-+      document->GetElementsByTagNameNS(nsURI, tagName, &inputs);
-   }
- 
-   NS_ENSURE_TRUE(inputs, NS_OK);
-@@ -198,10 +198,10 @@ nsHTMLRadioButtonAccessible::GetAttribut
-   PRInt32 count = 0;
- 
-   for (PRUint32 index = 0; index < inputsCount; index++) {
--    nsCOMPtr<nsIDOMNode> itemNode;
--    inputs->Item(index, getter_AddRefs(itemNode));
-+    nsIDOMNode* itemNode = nsnull;
-+    inputs->Item(index, &itemNode);
- 
--    nsCOMPtr<nsIContent> item(do_QueryInterface(itemNode));
-+    nsIContent* item(do_QueryInterface(itemNode));
-     if (item &&
-         item->AttrValueIs(kNameSpaceID_None, nsAccessibilityAtoms::type,
-                           type, eCaseMatters) &&
-@@ -258,7 +258,7 @@ nsHTMLButtonAccessible::GetState(PRUint3
-   if (!mDOMNode)
-     return NS_OK;
- 
--  nsCOMPtr<nsIDOMElement> element(do_QueryInterface(mDOMNode));
-+  nsIDOMElement* element(do_QueryInterface(mDOMNode));
-   NS_ENSURE_TRUE(element, NS_ERROR_FAILURE);
- 
-   nsAutoString buttonType;
-@@ -277,7 +277,7 @@ NS_IMETHODIMP nsHTMLButtonAccessible::Ge
- 
- NS_IMETHODIMP nsHTMLButtonAccessible::GetName(nsAString& aName)
- {
--  nsCOMPtr<nsIContent> content(do_QueryInterface(mDOMNode));
-+  nsIContent* content(do_QueryInterface(mDOMNode));
-   if (!content) {
-     return NS_ERROR_FAILURE; // Node shut down
-   }
-@@ -364,7 +364,7 @@ nsHTML4ButtonAccessible::GetState(PRUint
-   if (!mDOMNode)
-     return NS_OK;
- 
--  nsCOMPtr<nsIDOMElement> element(do_QueryInterface(mDOMNode));
-+  nsIDOMElement* element(do_QueryInterface(mDOMNode));
-   NS_ASSERTION(element, "No element for button's dom node!");
- 
-   *aState |= nsIAccessibleStates::STATE_FOCUSABLE;
-@@ -389,7 +389,7 @@ NS_IMETHODIMP nsHTMLTextFieldAccessible:
- NS_IMETHODIMP nsHTMLTextFieldAccessible::GetRole(PRUint32 *aRole)
- {
-   *aRole = nsIAccessibleRole::ROLE_ENTRY;
--  nsCOMPtr<nsIContent> content(do_QueryInterface(mDOMNode));
-+  nsIContent* content(do_QueryInterface(mDOMNode));
-   if (content &&
-       content->AttrValueIs(kNameSpaceID_None, nsAccessibilityAtoms::type,
-                            nsAccessibilityAtoms::password, eIgnoreCase)) {
-@@ -400,7 +400,7 @@ NS_IMETHODIMP nsHTMLTextFieldAccessible:
- 
- NS_IMETHODIMP nsHTMLTextFieldAccessible::GetName(nsAString& aName)
- {
--  nsCOMPtr<nsIContent> content = do_QueryInterface(mDOMNode);
-+  nsIContent* content = do_QueryInterface(mDOMNode);
-   if (!content) {
-     return NS_ERROR_FAILURE;
-   }
-@@ -413,8 +413,8 @@ NS_IMETHODIMP nsHTMLTextFieldAccessible:
-   // This means we're part of another control, so use parent accessible for name.
-   // This ensures that a textbox inside of a XUL widget gets
-   // an accessible name.
--  nsCOMPtr<nsIAccessible> parent;
--  rv = GetParent(getter_AddRefs(parent));
-+  nsIAccessible* parent = nsnull;
-+  rv = GetParent(&parent);
-   return parent ? parent->GetName(aName) : rv;
- }
- 
-@@ -425,12 +425,12 @@ NS_IMETHODIMP nsHTMLTextFieldAccessible:
-   if (state & nsIAccessibleStates::STATE_PROTECTED)    // Don't return password text!
-     return NS_ERROR_FAILURE;
- 
--  nsCOMPtr<nsIDOMHTMLTextAreaElement> textArea(do_QueryInterface(mDOMNode));
-+  nsIDOMHTMLTextAreaElement* textArea(do_QueryInterface(mDOMNode));
-   if (textArea) {
-     return textArea->GetValue(_retval);
-   }
-   
--  nsCOMPtr<nsIDOMHTMLInputElement> inputElement(do_QueryInterface(mDOMNode));
-+  nsIDOMHTMLInputElement* inputElement(do_QueryInterface(mDOMNode));
-   if (inputElement) {
-     return inputElement->GetValue(_retval);
-   }
-@@ -447,7 +447,7 @@ nsHTMLTextFieldAccessible::GetState(PRUi
-     return NS_OK;
- 
-   // can be focusable, focused, protected. readonly, unavailable, selected
--  nsCOMPtr<nsIContent> content(do_QueryInterface(mDOMNode));
-+  nsIContent* content(do_QueryInterface(mDOMNode));
-   NS_ASSERTION(content, "Should not have gotten here if upcalled GetExtState() succeeded");
- 
-   if (content->AttrValueIs(kNameSpaceID_None, nsAccessibilityAtoms::type,
-@@ -455,8 +455,8 @@ nsHTMLTextFieldAccessible::GetState(PRUi
-     *aState |= nsIAccessibleStates::STATE_PROTECTED;
-   }
-   else {
--    nsCOMPtr<nsIAccessible> parent;
--    GetParent(getter_AddRefs(parent));
-+    nsIAccessible* parent = nsnull;
-+    GetParent(&parent);
-     if (parent && Role(parent) == nsIAccessibleRole::ROLE_AUTOCOMPLETE) {
-       *aState |= nsIAccessibleStates::STATE_HASPOPUP;
-     }
-@@ -469,7 +469,7 @@ nsHTMLTextFieldAccessible::GetState(PRUi
-   if (!aExtraState)
-     return NS_OK;
- 
--  nsCOMPtr<nsIDOMHTMLInputElement> htmlInput(do_QueryInterface(mDOMNode));
-+  nsIDOMHTMLInputElement* htmlInput(do_QueryInterface(mDOMNode));
-   // Is it an <input> or a <textarea> ?
-   if (htmlInput) {
-     *aExtraState |= nsIAccessibleStates::EXT_STATE_SINGLE_LINE;
-@@ -481,7 +481,7 @@ nsHTMLTextFieldAccessible::GetState(PRUi
-   if (!(*aExtraState & nsIAccessibleStates::EXT_STATE_EDITABLE))
-     return NS_OK;
- 
--  nsCOMPtr<nsIContent> bindingContent = content->GetBindingParent();
-+  nsIContent* bindingContent = content->GetBindingParent();
-   if (bindingContent &&
-       bindingContent->NodeInfo()->Equals(nsAccessibilityAtoms::textbox,
-                                          kNameSpaceID_XUL) &&
-@@ -503,9 +503,9 @@ nsHTMLTextFieldAccessible::GetState(PRUi
-                      autocomplete);
- 
-     if (!autocomplete.LowerCaseEqualsLiteral("off")) {
--      nsCOMPtr<nsIDOMHTMLFormElement> form;
--      htmlInput->GetForm(getter_AddRefs(form));
--      nsCOMPtr<nsIContent> formContent(do_QueryInterface(form));
-+      nsIDOMHTMLFormElement* form = nsnull;
-+      htmlInput->GetForm(&form);
-+      nsIContent* formContent(do_QueryInterface(form));
-       if (formContent) {
-         formContent->GetAttr(kNameSpaceID_None,
-                              nsAccessibilityAtoms::autocomplete, autocomplete);
-@@ -537,7 +537,7 @@ NS_IMETHODIMP nsHTMLTextFieldAccessible:
- NS_IMETHODIMP nsHTMLTextFieldAccessible::DoAction(PRUint8 index)
- {
-   if (index == 0) {
--    nsCOMPtr<nsIDOMNSHTMLElement> element(do_QueryInterface(mDOMNode));
-+    nsIDOMNSHTMLElement* element(do_QueryInterface(mDOMNode));
-     if ( element ) {
-       return element->Focus();
-     }
-@@ -549,17 +549,17 @@ NS_IMETHODIMP nsHTMLTextFieldAccessible:
- NS_IMETHODIMP nsHTMLTextFieldAccessible::GetAssociatedEditor(nsIEditor **aEditor)
- {
-   *aEditor = nsnull;
--  nsCOMPtr<nsIDOMNSEditableElement> editableElt(do_QueryInterface(mDOMNode));
-+  nsIDOMNSEditableElement* editableElt(do_QueryInterface(mDOMNode));
-   NS_ENSURE_TRUE(editableElt, NS_ERROR_FAILURE);
- 
-   // nsGenericHTMLElement::GetEditor has a security check.
-   // Make sure we're not restricted by the permissions of
-   // whatever script is currently running.
--  nsCOMPtr<nsIJSContextStack> stack =
-+  nsIJSContextStack* stack =
-     do_GetService("@mozilla.org/js/xpc/ContextStack;1");
-   PRBool pushed = stack && NS_SUCCEEDED(stack->Push(nsnull));
- 
--  nsCOMPtr<nsIEditor> editor;
-+  nsIEditor* editor = nsnull;
-   nsresult rv = editableElt->GetEditor(aEditor);
- 
-   if (pushed) {
-@@ -590,7 +590,7 @@ NS_IMETHODIMP nsHTMLGroupboxAccessible::
- 
- nsIContent* nsHTMLGroupboxAccessible::GetLegend()
- {
--  nsCOMPtr<nsIContent> content = do_QueryInterface(mDOMNode);
-+  nsIContent* content = do_QueryInterface(mDOMNode);
-   NS_ENSURE_TRUE(content, nsnull);
- 
-   nsresult count = 0;
-@@ -646,7 +646,7 @@ nsHTMLGroupboxAccessible::GetAccessibleR
- 
-   if (aRelationType == nsIAccessibleRelation::RELATION_LABELLED_BY) {
-     // No override for label, so use <legend> for this <fieldset>
--    nsCOMPtr<nsIDOMNode> legendNode = do_QueryInterface(GetLegend());
-+    nsIDOMNode* legendNode = do_QueryInterface(GetLegend());
-     if (legendNode) {
-       GetAccService()->GetAccessibleInWeakShell(legendNode, mWeakShell, aRelated);
-     }
-@@ -674,16 +674,16 @@ nsHTMLLegendAccessible::GetAccessibleRel
- 
-   if (aRelationType == nsIAccessibleRelation::RELATION_LABEL_FOR) {
-     // Look for groupbox parent
--    nsCOMPtr<nsIContent> content = do_QueryInterface(mDOMNode);
-+    nsIContent* content = do_QueryInterface(mDOMNode);
-     if (!content) {
-       return NS_ERROR_FAILURE;  // Node already shut down
-     }
--    nsCOMPtr<nsIAccessible> groupboxAccessible = GetParent();
-+    nsIAccessible* groupboxAccessible = GetParent();
-     if (groupboxAccessible &&
-         Role(groupboxAccessible) == nsIAccessibleRole::ROLE_GROUPING) {
--      nsCOMPtr<nsIAccessible> testLabelAccessible;
-+      nsIAccessible* testLabelAccessible = nsnull;
-       groupboxAccessible->GetAccessibleRelated(nsIAccessibleRelation::RELATION_LABELLED_BY,
--                                               getter_AddRefs(testLabelAccessible));
-+                                               &testLabelAccessible);
-       if (testLabelAccessible == this) {
-         // We're the first child of the parent groupbox
-         NS_ADDREF(*aRelated = groupboxAccessible);
-diff --git a/accessible/src/html/nsHTMLImageAccessible.cpp b/accessible/src/html/nsHTMLImageAccessible.cpp
---- a/accessible/src/html/nsHTMLImageAccessible.cpp
-+++ b/accessible/src/html/nsHTMLImageAccessible.cpp
-@@ -64,8 +64,8 @@ nsHTMLImageAccessible::nsHTMLImageAccess
- nsHTMLImageAccessible::nsHTMLImageAccessible(nsIDOMNode* aDOMNode, nsIWeakReference* aShell):
- nsLinkableAccessible(aDOMNode, aShell), mAccessNodeCache(nsnull)
- { 
--  nsCOMPtr<nsIDOMElement> element(do_QueryInterface(aDOMNode));
--  nsCOMPtr<nsIPresShell> shell(do_QueryReferent(mWeakShell));
-+  nsIDOMElement* element(do_QueryInterface(aDOMNode));
-+  nsIPresShell* shell(do_QueryReferent(mWeakShell));
-   if (!shell)
-     return;
- 
-@@ -73,7 +73,7 @@ nsLinkableAccessible(aDOMNode, aShell), 
-   nsAutoString mapElementName;
- 
-   if (doc && element) {
--    nsCOMPtr<nsIHTMLDocument> htmlDoc(do_QueryInterface(doc));
-+    nsIHTMLDocument* htmlDoc(do_QueryInterface(doc));
-     element->GetAttribute(NS_LITERAL_STRING("usemap"),mapElementName);
-     if (htmlDoc && !mapElementName.IsEmpty()) {
-       if (mapElementName.CharAt(0) == '#')
-@@ -105,16 +105,16 @@ nsHTMLImageAccessible::GetState(PRUint32
-   if (!mDOMNode)
-     return NS_OK;
- 
--  nsCOMPtr<nsIImageLoadingContent> content(do_QueryInterface(mDOMNode));
--  nsCOMPtr<imgIRequest> imageRequest;
-+  nsIImageLoadingContent* content(do_QueryInterface(mDOMNode));
-+  imgIRequest* imageRequest = nsnull;
- 
-   if (content)
-     content->GetRequest(nsIImageLoadingContent::CURRENT_REQUEST,
--                        getter_AddRefs(imageRequest));
-+                        &imageRequest);
- 
--  nsCOMPtr<imgIContainer> imgContainer;
-+  imgIContainer* imgContainer = nsnull;
-   if (imageRequest)
--    imageRequest->GetImage(getter_AddRefs(imgContainer));
-+    imageRequest->GetImage(&imgContainer);
- 
-   if (imgContainer) {
-     PRUint32 numFrames;
-@@ -134,7 +134,7 @@ NS_IMETHODIMP nsHTMLImageAccessible::Get
-   if (IsDefunct())
-     return NS_ERROR_FAILURE;
-   
--  nsCOMPtr<nsIContent> content(do_QueryInterface(mDOMNode));
-+  nsIContent* content(do_QueryInterface(mDOMNode));
-   NS_ASSERTION(content, "Image node always supports nsIContent");
-     
-   // No alt attribute means AT can repair if there is no accessible name
-@@ -182,7 +182,7 @@ void nsHTMLImageAccessible::CacheChildre
-   }
- 
-   mAccChildCount = 0;
--  nsCOMPtr<nsIDOMHTMLCollection> mapAreas = GetAreaCollection();
-+  nsIDOMHTMLCollection* mapAreas = GetAreaCollection();
-   if (!mapAreas)
-     return;
- 
-@@ -190,8 +190,8 @@ void nsHTMLImageAccessible::CacheChildre
-   mapAreas->GetLength(&numMapAreas);
-   PRInt32 childCount = 0;
-   
--  nsCOMPtr<nsIAccessible> areaAccessible;
--  nsCOMPtr<nsPIAccessible> privatePrevAccessible;
-+  nsIAccessible* areaAccessible = nsnull;
-+  nsPIAccessible* privatePrevAccessible = nsnull;
-   while (childCount < (PRInt32)numMapAreas && 
-          (areaAccessible = GetAreaAccessible(mapAreas, childCount)) != nsnull) {
-     if (privatePrevAccessible) {
-@@ -214,21 +214,21 @@ NS_IMETHODIMP nsHTMLImageAccessible::DoA
- {
-   if (index == eAction_ShowLongDescription) {
-     //get the long description uri and open in a new window
--    nsCOMPtr<nsIDOMHTMLImageElement> element(do_QueryInterface(mDOMNode));
-+    nsIDOMHTMLImageElement* element(do_QueryInterface(mDOMNode));
-     NS_ENSURE_TRUE(element, NS_ERROR_FAILURE);
-     nsAutoString longDesc;
-     nsresult rv = element->GetLongDesc(longDesc);
-     NS_ENSURE_SUCCESS(rv, rv);
--    nsCOMPtr<nsIDOMDocument> domDocument;
--    rv = mDOMNode->GetOwnerDocument(getter_AddRefs(domDocument));
-+    nsIDOMDocument* domDocument = nsnull;
-+    rv = mDOMNode->GetOwnerDocument(&domDocument);
-     NS_ENSURE_SUCCESS(rv, rv);
--    nsCOMPtr<nsIDocument> document(do_QueryInterface(domDocument));
--    nsCOMPtr<nsPIDOMWindow> piWindow = document->GetWindow();
--    nsCOMPtr<nsIDOMWindowInternal> win(do_QueryInterface(piWindow));
-+    nsIDocument* document(do_QueryInterface(domDocument));
-+    nsPIDOMWindow* piWindow = document->GetWindow();
-+    nsIDOMWindowInternal* win(do_QueryInterface(piWindow));
-     NS_ENSURE_TRUE(win, NS_ERROR_FAILURE);
--    nsCOMPtr<nsIDOMWindow> tmp;
-+    nsIDOMWindow* tmp = nsnull;
-     return win->Open(longDesc, NS_LITERAL_STRING(""), NS_LITERAL_STRING(""),
--                     getter_AddRefs(tmp));
-+                     &tmp);
-   }
-   return nsLinkableAccessible::DoAction(index);
- }
-@@ -255,16 +255,16 @@ nsHTMLImageAccessible::GetURI(PRInt32 aI
-   if (!mMapElement)
-     return nsLinkableAccessible::GetURI(aIndex, aURI);
- 
--  nsCOMPtr<nsIDOMHTMLCollection> mapAreas = GetAreaCollection();
-+  nsIDOMHTMLCollection* mapAreas = GetAreaCollection();
-   if (!mapAreas)
-     return NS_OK;
-   
--  nsCOMPtr<nsIDOMNode> domNode;
--  mapAreas->Item(aIndex, getter_AddRefs(domNode));
-+  nsIDOMNode* domNode = nsnull;
-+  mapAreas->Item(aIndex, &domNode);
-   if (!domNode)
-     return NS_ERROR_INVALID_ARG;
- 
--  nsCOMPtr<nsILink> link(do_QueryInterface(domNode));
-+  nsILink* link(do_QueryInterface(domNode));
-   if (link)
-     link->GetHrefURI(aURI);
- 
-@@ -280,9 +280,9 @@ nsHTMLImageAccessible::GetAnchor(PRInt32
-   if (!mMapElement)
-     return nsLinkableAccessible::GetAnchor(aIndex, aAccessible);
- 
--  nsCOMPtr<nsIDOMHTMLCollection> mapAreas = GetAreaCollection();
-+  nsIDOMHTMLCollection* mapAreas = GetAreaCollection();
-   if (mapAreas) {
--    nsCOMPtr<nsIAccessible> accessible;
-+    nsIAccessible* accessible = nsnull;
-     accessible = GetAreaAccessible(mapAreas, aIndex);
-     if (!accessible)
-       return NS_ERROR_INVALID_ARG;
-@@ -344,7 +344,7 @@ nsHTMLImageAccessible::GetAttributesInte
-   nsresult rv = nsLinkableAccessible::GetAttributesInternal(aAttributes);
-   NS_ENSURE_SUCCESS(rv, rv);
- 
--  nsCOMPtr<nsIContent> content(do_QueryInterface(mDOMNode));
-+  nsIContent* content(do_QueryInterface(mDOMNode));
- 
-   nsAutoString src;
-   content->GetAttr(kNameSpaceID_None, nsAccessibilityAtoms::src, src);
-@@ -354,7 +354,7 @@ nsHTMLImageAccessible::GetAttributesInte
-   return NS_OK;
- }
- 
--already_AddRefed<nsIDOMHTMLCollection>
-+nsIDOMHTMLCollection*
- nsHTMLImageAccessible::GetAreaCollection()
- {
-   if (!mMapElement)
-@@ -368,28 +368,28 @@ nsHTMLImageAccessible::GetAreaCollection
-   return mapAreas;
- }
- 
--already_AddRefed<nsIAccessible>
-+nsIAccessible*
- nsHTMLImageAccessible::GetAreaAccessible(nsIDOMHTMLCollection *aAreaCollection,
-                                          PRInt32 aAreaNum)
- {
-   if (!aAreaCollection)
-     return nsnull;
- 
--  nsCOMPtr<nsIDOMNode> domNode;
--  aAreaCollection->Item(aAreaNum,getter_AddRefs(domNode));
-+  nsIDOMNode* domNode = nsnull;
-+  aAreaCollection->Item(aAreaNum,&domNode);
-   if (!domNode)
-     return nsnull;
-   
--  nsCOMPtr<nsIAccessNode> accessNode;
-+  nsIAccessNode* accessNode = nsnull;
-   GetCacheEntry(*mAccessNodeCache, (void*)(aAreaNum),
--                getter_AddRefs(accessNode));
-+                &accessNode);
-   
-   if (!accessNode) {
-     accessNode = new nsHTMLAreaAccessible(domNode, this, mWeakShell);
-     if (!accessNode)
-       return nsnull;
-     
--    nsCOMPtr<nsPIAccessNode> privateAccessNode(do_QueryInterface(accessNode));
-+    nsPIAccessNode* privateAccessNode(do_QueryInterface(accessNode));
-     NS_ASSERTION(privateAccessNode,
-                  "Accessible doesn't implement nsPIAccessNode");
-     
-diff --git a/accessible/src/html/nsHTMLImageAccessible.h b/accessible/src/html/nsHTMLImageAccessible.h
---- a/accessible/src/html/nsHTMLImageAccessible.h
-+++ b/accessible/src/html/nsHTMLImageAccessible.h
-@@ -84,8 +84,8 @@ protected:
-   // nsAccessible
-   virtual void CacheChildren();
- 
--  already_AddRefed<nsIDOMHTMLCollection> GetAreaCollection();
--  already_AddRefed<nsIAccessible>
-+  nsIDOMHTMLCollection* GetAreaCollection();
-+  nsIAccessible*
-     GetAreaAccessible(nsIDOMHTMLCollection* aAreaNodes, PRInt32 aAreaNum);
- 
-   // Reference on linked map element if any.
-diff --git a/accessible/src/html/nsHTMLLinkAccessible.cpp b/accessible/src/html/nsHTMLLinkAccessible.cpp
---- a/accessible/src/html/nsHTMLLinkAccessible.cpp
-+++ b/accessible/src/html/nsHTMLLinkAccessible.cpp
-@@ -65,7 +65,7 @@ nsHTMLLinkAccessible::GetName(nsAString&
-   if (IsDefunct())
-     return NS_ERROR_FAILURE;
- 
--  nsCOMPtr<nsIContent> content(do_QueryInterface(mDOMNode));
-+  nsIContent* content(do_QueryInterface(mDOMNode));
-   nsresult rv = AppendFlatStringFromSubtree(content, &aName);
-   NS_ENSURE_SUCCESS(rv, rv);
- 
-@@ -97,7 +97,7 @@ nsHTMLLinkAccessible::GetState(PRUint32 
- 
-   *aState  &= ~nsIAccessibleStates::STATE_READONLY;
- 
--  nsCOMPtr<nsIContent> content(do_QueryInterface(mDOMNode));
-+  nsIContent* content(do_QueryInterface(mDOMNode));
-   if (content && content->HasAttr(kNameSpaceID_None,
-                                   nsAccessibilityAtoms::name)) {
-     // This is how we indicate it is a named anchor
-@@ -106,7 +106,7 @@ nsHTMLLinkAccessible::GetState(PRUint32 
-     *aState |= nsIAccessibleStates::STATE_SELECTABLE;
-   }
- 
--  nsCOMPtr<nsILink> link = do_QueryInterface(mDOMNode);
-+  nsILink* link = do_QueryInterface(mDOMNode);
-   NS_ENSURE_STATE(link);
- 
-   nsLinkState linkState;
-@@ -140,7 +140,7 @@ nsHTMLLinkAccessible::GetValue(nsAString
-   if (!aValue.IsEmpty())
-     return NS_OK;
-   
--  nsCOMPtr<nsIPresShell> presShell(do_QueryReferent(mWeakShell));
-+  nsIPresShell* presShell(do_QueryReferent(mWeakShell));
-   if (mDOMNode && presShell)
-     return presShell->GetLinkLocation(mDOMNode, aValue);
- 
-@@ -188,7 +188,7 @@ nsHTMLLinkAccessible::DoAction(PRUint8 a
-   if (IsDefunct())
-     return NS_ERROR_FAILURE;
- 
--  nsCOMPtr<nsIContent> content(do_QueryInterface(mDOMNode));
-+  nsIContent* content(do_QueryInterface(mDOMNode));
-   return DoCommand(content);
- }
- 
-@@ -204,7 +204,7 @@ nsHTMLLinkAccessible::GetURI(PRInt32 aIn
-   if (aIndex != 0)
-     return NS_ERROR_INVALID_ARG;
- 
--  nsCOMPtr<nsILink> link(do_QueryInterface(mDOMNode));
-+  nsILink* link(do_QueryInterface(mDOMNode));
-   NS_ENSURE_STATE(link);
- 
-   return link->GetHrefURI(aURI);
-@@ -216,7 +216,7 @@ PRBool
- PRBool
- nsHTMLLinkAccessible::IsLinked()
- {
--  nsCOMPtr<nsILink> link(do_QueryInterface(mDOMNode));
-+  nsILink* link(do_QueryInterface(mDOMNode));
-   if (!link)
-     return PR_FALSE;
- 
-diff --git a/accessible/src/html/nsHTMLSelectAccessible.cpp b/accessible/src/html/nsHTMLSelectAccessible.cpp
---- a/accessible/src/html/nsHTMLSelectAccessible.cpp
-+++ b/accessible/src/html/nsHTMLSelectAccessible.cpp
-@@ -83,9 +83,9 @@ nsHTMLSelectableAccessible::iterator::it
-   mLength = mIndex = 0;
-   mSelCount = 0;
- 
--  nsCOMPtr<nsIDOMHTMLSelectElement> htmlSelect(do_QueryInterface(mParentSelect->mDOMNode));
-+  nsIDOMHTMLSelectElement* htmlSelect(do_QueryInterface(mParentSelect->mDOMNode));
-   if (htmlSelect) {
--    htmlSelect->GetOptions(getter_AddRefs(mOptions));
-+    htmlSelect->GetOptions(&mOptions);
-     if (mOptions)
-       mOptions->GetLength(&mLength);
-   }
-@@ -94,9 +94,9 @@ PRBool nsHTMLSelectableAccessible::itera
- PRBool nsHTMLSelectableAccessible::iterator::Advance() 
- {
-   if (mIndex < mLength) {
--    nsCOMPtr<nsIDOMNode> tempNode;
-+    nsIDOMNode* tempNode = nsnull;
-     if (mOptions) {
--      mOptions->Item(mIndex, getter_AddRefs(tempNode));
-+      mOptions->Item(mIndex, &tempNode);
-       mOption = do_QueryInterface(tempNode);
-     }
-     mIndex++;
-@@ -121,13 +121,13 @@ void nsHTMLSelectableAccessible::iterato
-                                                                    nsPresContext *aContext)
- {
-   PRBool isSelected = PR_FALSE;
--  nsCOMPtr<nsIAccessible> tempAccess;
-+  nsIAccessible* tempAccess = nsnull;
- 
-   if (mOption) {
-     mOption->GetSelected(&isSelected);
-     if (isSelected) {
--      nsCOMPtr<nsIDOMNode> optionNode(do_QueryInterface(mOption));
--      aAccService->GetAccessibleInWeakShell(optionNode, mWeakShell, getter_AddRefs(tempAccess));
-+      nsIDOMNode* optionNode(do_QueryInterface(mOption));
-+      aAccService->GetAccessibleInWeakShell(optionNode, mWeakShell, &tempAccess);
-     }
-   }
- 
-@@ -148,7 +148,7 @@ PRBool nsHTMLSelectableAccessible::itera
-     mOption->GetSelected(&isSelected);
-     if (isSelected) {
-       if (mSelCount == aIndex) {
--        nsCOMPtr<nsIDOMNode> optionNode(do_QueryInterface(mOption));
-+        nsIDOMNode* optionNode(do_QueryInterface(mOption));
-         aAccService->GetAccessibleInWeakShell(optionNode, mWeakShell, aAccessible);
-         return PR_TRUE;
-       }
-@@ -178,18 +178,18 @@ NS_IMETHODIMP nsHTMLSelectableAccessible
- {
-   *aSelState = PR_FALSE;
- 
--  nsCOMPtr<nsIDOMHTMLSelectElement> htmlSelect(do_QueryInterface(mDOMNode));
-+  nsIDOMHTMLSelectElement* htmlSelect(do_QueryInterface(mDOMNode));
-   if (!htmlSelect)
-     return NS_ERROR_FAILURE;
- 
--  nsCOMPtr<nsIDOMHTMLOptionsCollection> options;
--  htmlSelect->GetOptions(getter_AddRefs(options));
-+  nsIDOMHTMLOptionsCollection* options = nsnull;
-+  htmlSelect->GetOptions(&options);
-   if (!options)
-     return NS_ERROR_FAILURE;
- 
--  nsCOMPtr<nsIDOMNode> tempNode;
--  options->Item(aIndex, getter_AddRefs(tempNode));
--  nsCOMPtr<nsIDOMHTMLOptionElement> tempOption(do_QueryInterface(tempNode));
-+  nsIDOMNode* tempNode = nsnull;
-+  options->Item(aIndex, &tempNode);
-+  nsIDOMHTMLOptionElement* tempOption(do_QueryInterface(tempNode));
-   if (!tempOption)
-     return NS_ERROR_FAILURE;
- 
-@@ -207,11 +207,11 @@ NS_IMETHODIMP nsHTMLSelectableAccessible
- {
-   *_retval = nsnull;
- 
--  nsCOMPtr<nsIAccessibilityService> accService(do_GetService("@mozilla.org/accessibilityService;1"));
-+  nsIAccessibilityService* accService(do_GetService("@mozilla.org/accessibilityService;1"));
-   if (!accService)
-     return NS_ERROR_FAILURE;
- 
--  nsCOMPtr<nsIMutableArray> selectedAccessibles =
-+  nsIMutableArray* selectedAccessibles =
-     do_CreateInstance(NS_ARRAY_CONTRACTID);
-   NS_ENSURE_STATE(selectedAccessibles);
-   
-@@ -237,7 +237,7 @@ NS_IMETHODIMP nsHTMLSelectableAccessible
- {
-   *_retval = nsnull;
- 
--  nsCOMPtr<nsIAccessibilityService> accService(do_GetService("@mozilla.org/accessibilityService;1"));
-+  nsIAccessibilityService* accService(do_GetService("@mozilla.org/accessibilityService;1"));
-   if (!accService)
-     return NS_ERROR_FAILURE;
- 
-@@ -294,7 +294,7 @@ NS_IMETHODIMP nsHTMLSelectableAccessible
- {
-   *_retval = PR_FALSE;
-   
--  nsCOMPtr<nsIDOMHTMLSelectElement> htmlSelect(do_QueryInterface(mDOMNode));
-+  nsIDOMHTMLSelectElement* htmlSelect(do_QueryInterface(mDOMNode));
-   if (!htmlSelect)
-     return NS_ERROR_FAILURE;
- 
-@@ -333,14 +333,14 @@ nsHTMLSelectListAccessible::GetState(PRU
-   if (!mDOMNode)
-     return NS_OK;
- 
--  nsCOMPtr<nsIDOMHTMLSelectElement> select (do_QueryInterface(mDOMNode));
-+  nsIDOMHTMLSelectElement* select (do_QueryInterface(mDOMNode));
-   if (select) {
-     if (*aState & nsIAccessibleStates::STATE_FOCUSED) {
-       // Treat first focusable option node as actual focus, in order
-       // to avoid confusing JAWS, which needs focus on the option
--      nsCOMPtr<nsIDOMNode> focusedOption;
-+      nsIDOMNode* focusedOption = nsnull;
-       nsHTMLSelectOptionAccessible::GetFocusedOptionNode(mDOMNode, 
--                                                         getter_AddRefs(focusedOption));
-+                                                         &focusedOption);
-       if (focusedOption) { // Clear focused state since it is on option
-         *aState &= ~nsIAccessibleStates::STATE_FOCUSED;
-       }
-@@ -366,25 +366,25 @@ NS_IMETHODIMP nsHTMLSelectListAccessible
-   return NS_OK;
- }
- 
--already_AddRefed<nsIAccessible>
-+nsIAccessible*
- nsHTMLSelectListAccessible::AccessibleForOption(nsIAccessibilityService *aAccService,
-                                                 nsIContent *aContent,
-                                                 nsIAccessible *aLastGoodAccessible,
-                                                 PRInt32 *aChildCount)
- {
--  nsCOMPtr<nsIDOMNode> domNode(do_QueryInterface(aContent));
-+  nsIDOMNode* domNode(do_QueryInterface(aContent));
-   NS_ASSERTION(domNode, "DOM node is null");
-   // Accessibility service will initialize & cache any accessibles created
--  nsCOMPtr<nsIAccessible> accessible;
--  aAccService->GetAccessibleInWeakShell(domNode, mWeakShell, getter_AddRefs(accessible));
--  nsCOMPtr<nsPIAccessible> privateAccessible(do_QueryInterface(accessible));
-+  nsIAccessible* accessible = nsnull;
-+  aAccService->GetAccessibleInWeakShell(domNode, mWeakShell, &accessible);
-+  nsPIAccessible* privateAccessible(do_QueryInterface(accessible));
-   if (!privateAccessible) {
-     return nsnull;
-   }
- 
-   ++ *aChildCount;
-   privateAccessible->SetParent(this);
--  nsCOMPtr<nsPIAccessible> privatePrevAccessible(do_QueryInterface(aLastGoodAccessible));
-+  nsPIAccessible* privatePrevAccessible(do_QueryInterface(aLastGoodAccessible));
-   if (privatePrevAccessible) {
-     privatePrevAccessible->SetNextSibling(accessible);
-   }
-@@ -396,7 +396,7 @@ nsHTMLSelectListAccessible::AccessibleFo
-   return returnAccessible;
- }
- 
--already_AddRefed<nsIAccessible>
-+nsIAccessible*
- nsHTMLSelectListAccessible::CacheOptSiblings(nsIAccessibilityService *aAccService,
-                                              nsIContent *aParentContent,
-                                              nsIAccessible *aLastGoodAccessible,
-@@ -405,15 +405,15 @@ nsHTMLSelectListAccessible::CacheOptSibl
-   // Recursive helper for CacheChildren()
- 
-   PRUint32 numChildren = aParentContent->GetChildCount();
--  nsCOMPtr<nsIAccessible> lastGoodAccessible(aLastGoodAccessible);
--  nsCOMPtr<nsIAccessible> newAccessible;
-+  nsIAccessible* lastGoodAccessible(aLastGoodAccessible);
-+  nsIAccessible* newAccessible = nsnull;
- 
-   for (PRUint32 count = 0; count < numChildren; count ++) {
-     nsIContent *childContent = aParentContent->GetChildAt(count);
-     if (!childContent->IsNodeOfType(nsINode::eHTML)) {
-       continue;
-     }
--    nsCOMPtr<nsIAtom> tag = childContent->Tag();
-+    nsIAtom* tag = childContent->Tag();
-     if (tag == nsAccessibilityAtoms::option || tag == nsAccessibilityAtoms::optgroup) {
-       newAccessible = AccessibleForOption(aAccService,
-                                            childContent,
-@@ -432,7 +432,7 @@ nsHTMLSelectListAccessible::CacheOptSibl
-     }
-   }
-   if (lastGoodAccessible) {
--    nsCOMPtr<nsPIAccessible> privateLastAcc =
-+    nsPIAccessible* privateLastAcc =
-       do_QueryInterface(lastGoodAccessible);
-     privateLastAcc->SetNextSibling(nsnull);
-     NS_ADDREF(aLastGoodAccessible = lastGoodAccessible);
-@@ -451,8 +451,8 @@ void nsHTMLSelectListAccessible::CacheCh
-   // Cache the number of <optgroup> and <option> DOM decendents,
-   // as well as the accessibles for them. Avoid whitespace text nodes.
- 
--  nsCOMPtr<nsIContent> selectContent(do_QueryInterface(mDOMNode));
--  nsCOMPtr<nsIAccessibilityService> accService(do_GetService("@mozilla.org/accessibilityService;1"));
-+  nsIContent* selectContent(do_QueryInterface(mDOMNode));
-+  nsIAccessibilityService* accService(do_GetService("@mozilla.org/accessibilityService;1"));
-   if (!selectContent || !accService) {
-     mAccChildCount = eChildCountUninitialized;
-     return;
-@@ -464,7 +464,7 @@ void nsHTMLSelectListAccessible::CacheCh
- 
-   mAccChildCount = 0; // Avoid reentry
-   PRInt32 childCount = 0;
--  nsCOMPtr<nsIAccessible> lastGoodAccessible =
-+  nsIAccessible* lastGoodAccessible =
-     CacheOptSiblings(accService, selectContent, nsnull, &childCount);
-   mAccChildCount = childCount;
- }
-@@ -475,23 +475,23 @@ nsHTMLSelectOptionAccessible::nsHTMLSele
- nsHTMLSelectOptionAccessible::nsHTMLSelectOptionAccessible(nsIDOMNode* aDOMNode, nsIWeakReference* aShell):
- nsHyperTextAccessibleWrap(aDOMNode, aShell)
- {
--  nsCOMPtr<nsIAccessibilityService> accService(do_GetService("@mozilla.org/accessibilityService;1"));
--  nsCOMPtr<nsIDOMNode> parentNode;
--  aDOMNode->GetParentNode(getter_AddRefs(parentNode));
--  nsCOMPtr<nsIAccessible> parentAccessible;
-+  nsIAccessibilityService* accService(do_GetService("@mozilla.org/accessibilityService;1"));
-+  nsIDOMNode* parentNode = nsnull;
-+  aDOMNode->GetParentNode(&parentNode);
-+  nsIAccessible* parentAccessible = nsnull;
-   if (parentNode) {
-     // If the parent node is a Combobox, then the option's accessible parent
-     // is nsHTMLComboboxListAccessible, not the nsHTMLComboboxAccessible that
-     // GetParent would normally return. This is because the 
-     // nsHTMLComboboxListAccessible is inserted into the accessible hierarchy
-     // where there is no DOM node for it.
--    accService->GetAccessibleInWeakShell(parentNode, mWeakShell, getter_AddRefs(parentAccessible));
-+    accService->GetAccessibleInWeakShell(parentNode, mWeakShell, &parentAccessible);
-     if (parentAccessible) {
-       PRUint32 role;
-       parentAccessible->GetRole(&role);
-       if (role == nsIAccessibleRole::ROLE_COMBOBOX) {
--        nsCOMPtr<nsIAccessible> comboAccessible(parentAccessible);
--        comboAccessible->GetLastChild(getter_AddRefs(parentAccessible));
-+        nsIAccessible* comboAccessible(parentAccessible);
-+        comboAccessible->GetLastChild(&parentAccessible);
-       }
-     }
-   }
-@@ -517,7 +517,7 @@ NS_IMETHODIMP nsHTMLSelectOptionAccessib
- {
-   // CASE #1 -- great majority of the cases
-   // find the label attribute - this is what the W3C says we should use
--  nsCOMPtr<nsIDOMElement> domElement(do_QueryInterface(mDOMNode));
-+  nsIDOMElement* domElement(do_QueryInterface(mDOMNode));
-   if (!domElement)
-     return NS_ERROR_FAILURE;
- 
-@@ -528,11 +528,11 @@ NS_IMETHODIMP nsHTMLSelectOptionAccessib
-   
-   // CASE #2 -- no label parameter, get the first child, 
-   // use it if it is a text node
--  nsCOMPtr<nsIDOMNode> child;
--  mDOMNode->GetFirstChild(getter_AddRefs(child));
-+  nsIDOMNode* child = nsnull;
-+  mDOMNode->GetFirstChild(&child);
- 
-   if (child) {
--    nsCOMPtr<nsIContent> text = do_QueryInterface(child);
-+    nsIContent* text = do_QueryInterface(child);
-     if (text && text->IsNodeOfType(nsINode::eTEXT)) {
-       nsAutoString txtValue;
-       rv = AppendFlatStringFromContentNode(text, &txtValue);
-@@ -560,9 +560,9 @@ nsHTMLSelectOptionAccessible::GetAttribu
-   nsresult rv = nsHyperTextAccessibleWrap::GetAttributesInternal(aAttributes);
-   NS_ENSURE_SUCCESS(rv, rv);
- 
--  nsCOMPtr<nsIDOMNode> parentNode;
--  mDOMNode->GetParentNode(getter_AddRefs(parentNode));
--  nsCOMPtr<nsIDOMElement> parentElement(do_QueryInterface(parentNode));
-+  nsIDOMNode* parentNode = nsnull;
-+  mDOMNode->GetParentNode(&parentNode);
-+  nsIDOMElement* parentElement(do_QueryInterface(parentNode));
-   NS_ENSURE_TRUE(parentElement, NS_ERROR_FAILURE);
-   nsAutoString parentTagName;
-   parentNode->GetLocalName(parentTagName);
-@@ -574,14 +574,14 @@ nsHTMLSelectOptionAccessible::GetAttribu
- 
-   nsAutoString tagName;
-   mDOMNode->GetLocalName(tagName);  // Will be looking for similar DOM siblings
--  nsCOMPtr<nsIDOMNodeList> siblings;
--  parentElement->GetElementsByTagName(tagName, getter_AddRefs(siblings));
-+  nsIDOMNodeList* siblings = nsnull;
-+  parentElement->GetElementsByTagName(tagName, &siblings);
-   PRInt32 posInSet = 0;
-   PRUint32 setSize = 0;
-   if (siblings) {
-     siblings->GetLength(&setSize);
--    nsCOMPtr<nsIDOMNode> itemNode;
--    while (NS_SUCCEEDED(siblings->Item(posInSet ++, getter_AddRefs(itemNode))) &&
-+    nsIDOMNode* itemNode = nsnull;
-+    while (NS_SUCCEEDED(siblings->Item(posInSet ++, &itemNode)) &&
-            itemNode != mDOMNode) {
-       // Keep looping, to increment posInSet
-     }
-@@ -595,9 +595,9 @@ nsIFrame* nsHTMLSelectOptionAccessible::
- nsIFrame* nsHTMLSelectOptionAccessible::GetBoundsFrame()
- {
-   PRUint32 state;
--  nsCOMPtr<nsIContent> content = GetSelectState(&state);
-+  nsIContent* content = GetSelectState(&state);
-   if (state & nsIAccessibleStates::STATE_COLLAPSED) {
--    nsCOMPtr<nsIPresShell> presShell(GetPresShell());
-+    nsIPresShell* presShell(GetPresShell());
-     if (!presShell) {
-       return nsnull;
-     }
-@@ -626,13 +626,13 @@ nsHTMLSelectOptionAccessible::GetState(P
-     return NS_OK;
- 
-   PRUint32 selectState, selectExtState;
--  nsCOMPtr<nsIContent> selectContent = GetSelectState(&selectState,
-+  nsIContent* selectContent = GetSelectState(&selectState,
-                                                       &selectExtState);
-   if (selectState & nsIAccessibleStates::STATE_INVISIBLE) {
-     return NS_OK;
-   }
- 
--  nsCOMPtr<nsIDOMNode> selectNode = do_QueryInterface(selectContent); 
-+  nsIDOMNode* selectNode = do_QueryInterface(selectContent); 
-   NS_ENSURE_TRUE(selectNode, NS_ERROR_FAILURE);
- 
-   // Is disabled?
-@@ -646,8 +646,8 @@ nsHTMLSelectOptionAccessible::GetState(P
-     // GetFocusedOptionNode() ensures that an option node is 
-     // returned in this case, as long as some focusable option exists
-     // in the listbox
--    nsCOMPtr<nsIDOMNode> focusedOptionNode;
--    GetFocusedOptionNode(selectNode, getter_AddRefs(focusedOptionNode));
-+    nsIDOMNode* focusedOptionNode = nsnull;
-+    GetFocusedOptionNode(selectNode, &focusedOptionNode);
-     if (focusedOptionNode == mDOMNode) {
-       *aState |= nsIAccessibleStates::STATE_FOCUSED;
-     }
-@@ -655,7 +655,7 @@ nsHTMLSelectOptionAccessible::GetState(P
- 
-   // Are we selected?
-   PRBool isSelected = PR_FALSE;
--  nsCOMPtr<nsIDOMHTMLOptionElement> option (do_QueryInterface(mDOMNode));
-+  nsIDOMHTMLOptionElement* option (do_QueryInterface(mDOMNode));
-   if (option) {
-     option->GetSelected(&isSelected);
-     if ( isSelected ) 
-@@ -685,7 +685,7 @@ nsHTMLSelectOptionAccessible::GetState(P
-     // visibility implementation unless they get reimplemented in layout
-     *aState &= ~nsIAccessibleStates::STATE_OFFSCREEN;
-     // <select> is not collapsed: compare bounds to calculate STATE_OFFSCREEN
--    nsCOMPtr<nsIAccessible> listAccessible = GetParent();
-+    nsIAccessible* listAccessible = GetParent();
-     if (listAccessible) {
-       PRInt32 optionX, optionY, optionWidth, optionHeight;
-       PRInt32 listX, listY, listWidth, listHeight;
-@@ -719,17 +719,17 @@ NS_IMETHODIMP nsHTMLSelectOptionAccessib
- NS_IMETHODIMP nsHTMLSelectOptionAccessible::DoAction(PRUint8 index)
- {
-   if (index == eAction_Select) {   // default action
--    nsCOMPtr<nsIDOMHTMLOptionElement> newHTMLOption(do_QueryInterface(mDOMNode));
-+    nsIDOMHTMLOptionElement* newHTMLOption(do_QueryInterface(mDOMNode));
-     if (!newHTMLOption) 
-       return NS_ERROR_FAILURE;
-     // Clear old selection
--    nsCOMPtr<nsIDOMNode> oldHTMLOptionNode, selectNode;
--    nsCOMPtr<nsIAccessible> parent(GetParent());
--    nsCOMPtr<nsIAccessNode> accessNode(do_QueryInterface(parent));
-+    nsIDOMNode* oldHTMLOptionNode = nsnull, *selectNode = nsnull;
-+    nsIAccessible* parent(GetParent());
-+    nsIAccessNode* accessNode(do_QueryInterface(parent));
-     NS_ASSERTION(accessNode, "Unable to QI to nsIAccessNode");
--    accessNode->GetDOMNode(getter_AddRefs(selectNode));
--    GetFocusedOptionNode(selectNode, getter_AddRefs(oldHTMLOptionNode));
--    nsCOMPtr<nsIDOMHTMLOptionElement> oldHTMLOption(do_QueryInterface(oldHTMLOptionNode));
-+    accessNode->GetDOMNode(&selectNode);
-+    GetFocusedOptionNode(selectNode, &oldHTMLOptionNode);
-+    nsIDOMHTMLOptionElement* oldHTMLOption(do_QueryInterface(oldHTMLOptionNode));
-     if (oldHTMLOption)
-       oldHTMLOption->SetSelected(PR_FALSE);
-     // Set new selection
-@@ -737,19 +737,19 @@ NS_IMETHODIMP nsHTMLSelectOptionAccessib
- 
-     // If combo box, and open, close it
-     // First, get the <select> widgets list control frame
--    nsCOMPtr<nsIDOMNode> testSelectNode;
--    nsCOMPtr<nsIDOMNode> thisNode(do_QueryInterface(mDOMNode));
-+    nsIDOMNode* testSelectNode = nsnull;
-+    nsIDOMNode* thisNode(do_QueryInterface(mDOMNode));
-     do {
--      thisNode->GetParentNode(getter_AddRefs(testSelectNode));
--      nsCOMPtr<nsIDOMHTMLSelectElement> selectControl(do_QueryInterface(testSelectNode));
-+      thisNode->GetParentNode(&testSelectNode);
-+      nsIDOMHTMLSelectElement* selectControl(do_QueryInterface(testSelectNode));
-       if (selectControl)
-         break;
-       thisNode = testSelectNode;
-     } while (testSelectNode);
- 
--    nsCOMPtr<nsIPresShell> presShell(do_QueryReferent(mWeakShell));
--    nsCOMPtr<nsIContent> selectContent(do_QueryInterface(testSelectNode));
--    nsCOMPtr<nsIDOMHTMLOptionElement> option(do_QueryInterface(mDOMNode));
-+    nsIPresShell* presShell(do_QueryReferent(mWeakShell));
-+    nsIContent* selectContent(do_QueryInterface(testSelectNode));
-+    nsIDOMHTMLOptionElement* option(do_QueryInterface(mDOMNode));
- 
-     if (!testSelectNode || !selectContent || !presShell || !option) 
-       return NS_ERROR_FAILURE;
-@@ -787,8 +787,8 @@ nsresult nsHTMLSelectOptionAccessible::G
-   *aFocusedOptionNode = nsnull;
-   NS_ASSERTION(aListNode, "Called GetFocusedOptionNode without a valid list node");
- 
--  nsCOMPtr<nsIContent> content(do_QueryInterface(aListNode));
--  nsCOMPtr<nsIDocument> document = content->GetDocument();
-+  nsIContent* content(do_QueryInterface(aListNode));
-+  nsIDocument* document = content->GetDocument();
-   nsIPresShell *shell = nsnull;
-   if (document)
-     shell = document->GetPrimaryShell();
-@@ -802,11 +802,11 @@ nsresult nsHTMLSelectOptionAccessible::G
-   PRInt32 focusedOptionIndex = 0;
- 
-   // Get options
--  nsCOMPtr<nsIDOMHTMLSelectElement> selectElement(do_QueryInterface(aListNode));
-+  nsIDOMHTMLSelectElement* selectElement(do_QueryInterface(aListNode));
-   NS_ASSERTION(selectElement, "No select element where it should be");
- 
--  nsCOMPtr<nsIDOMHTMLOptionsCollection> options;
--  nsresult rv = selectElement->GetOptions(getter_AddRefs(options));
-+  nsIDOMHTMLOptionsCollection* options = nsnull;
-+  nsresult rv = selectElement->GetOptions(&options);
-   
-   if (NS_SUCCEEDED(rv)) {
-     nsIListControlFrame *listFrame = nsnull;
-@@ -818,11 +818,11 @@ nsresult nsHTMLSelectOptionAccessible::G
-       // the first selected item.
-       focusedOptionIndex = listFrame->GetSelectedIndex();
-       if (focusedOptionIndex == -1) {
--        nsCOMPtr<nsIDOMNode> nextOption;
-+        nsIDOMNode* nextOption = nsnull;
-         while (PR_TRUE) {
-           ++ focusedOptionIndex;
--          options->Item(focusedOptionIndex, getter_AddRefs(nextOption));
--          nsCOMPtr<nsIDOMHTMLOptionElement> optionElement = do_QueryInterface(nextOption);
-+          options->Item(focusedOptionIndex, &nextOption);
-+          nsIDOMHTMLOptionElement* optionElement = do_QueryInterface(nextOption);
-           if (!optionElement) {
-             break;
-           }
-@@ -853,19 +853,19 @@ void nsHTMLSelectOptionAccessible::Selec
-     return;
-   }
- 
--  nsCOMPtr<nsIDOMNode> optionNode(do_QueryInterface(aPossibleOption));
-+  nsIDOMNode* optionNode(do_QueryInterface(aPossibleOption));
-   NS_ASSERTION(optionNode, "No option node for nsIContent with option tag!");
- 
--  nsCOMPtr<nsIAccessible> multiSelect = GetMultiSelectFor(optionNode);
--  nsCOMPtr<nsPIAccessible> privateMultiSelect = do_QueryInterface(multiSelect);
-+  nsIAccessible* multiSelect = GetMultiSelectFor(optionNode);
-+  nsPIAccessible* privateMultiSelect = do_QueryInterface(multiSelect);
-   if (!privateMultiSelect) {
-     return;
-   }
- 
--  nsCOMPtr<nsIAccessibilityService> accService = 
-+  nsIAccessibilityService* accService = 
-     do_GetService("@mozilla.org/accessibilityService;1");
--  nsCOMPtr<nsIAccessible> optionAccessible;
--  accService->GetAccessibleFor(optionNode, getter_AddRefs(optionAccessible));
-+  nsIAccessible* optionAccessible = nsnull;
-+  accService->GetAccessibleFor(optionNode, &optionAccessible);
-   if (!optionAccessible) {
-     return;
-   }
-@@ -888,17 +888,17 @@ nsIContent* nsHTMLSelectOptionAccessible
- nsIContent* nsHTMLSelectOptionAccessible::GetSelectState(PRUint32* aState,
-                                                          PRUint32* aExtraState)
- {
--  nsCOMPtr<nsIContent> content(do_QueryInterface(mDOMNode));
-+  nsIContent* content(do_QueryInterface(mDOMNode));
-   while (content && content->Tag() != nsAccessibilityAtoms::select) {
-     content = content->GetParent();
-   }
- 
--  nsCOMPtr<nsIDOMNode> selectNode(do_QueryInterface(content));
-+  nsIDOMNode* selectNode(do_QueryInterface(content));
-   if (selectNode) {
--    nsCOMPtr<nsIAccessibilityService> accService = GetAccService();
-+    nsIAccessibilityService* accService = GetAccService();
-     if (accService) {
--      nsCOMPtr<nsIAccessible> selAcc;
--      accService->GetAccessibleFor(selectNode, getter_AddRefs(selAcc));
-+      nsIAccessible* selAcc = nsnull;
-+      accService->GetAccessibleFor(selectNode, &selAcc);
-       if (selAcc) {
-         selAcc->GetFinalState(aState, aExtraState);
-         return content;
-@@ -1114,18 +1114,18 @@ NS_IMETHODIMP nsHTMLComboboxAccessible::
-     return NS_OK;
-   }
-   // Use description of currently focused option
--  nsCOMPtr<nsIAccessible> optionAccessible = GetFocusedOptionAccessible();
-+  nsIAccessible* optionAccessible = GetFocusedOptionAccessible();
-   return optionAccessible ? optionAccessible->GetDescription(aDescription) : NS_OK;
- }
- 
--already_AddRefed<nsIAccessible>
-+nsIAccessible*
- nsHTMLComboboxAccessible::GetFocusedOptionAccessible()
- {
-   if (!mWeakShell) {
-     return nsnull;  // Shut down
-   }
--  nsCOMPtr<nsIDOMNode> focusedOptionNode;
--  nsHTMLSelectOptionAccessible::GetFocusedOptionNode(mDOMNode, getter_AddRefs(focusedOptionNode));
-+  nsIDOMNode* focusedOptionNode = nsnull;
-+  nsHTMLSelectOptionAccessible::GetFocusedOptionNode(mDOMNode, &focusedOptionNode);
-   nsIAccessibilityService *accService = GetAccService();
-   if (!focusedOptionNode || !accService) {
-     return nsnull;
-@@ -1145,7 +1145,7 @@ NS_IMETHODIMP nsHTMLComboboxAccessible::
- NS_IMETHODIMP nsHTMLComboboxAccessible::GetValue(nsAString& aValue)
- {
-   // Use label of currently focused option
--  nsCOMPtr<nsIAccessible> optionAccessible = GetFocusedOptionAccessible();
-+  nsIAccessible* optionAccessible = GetFocusedOptionAccessible();
-   NS_ENSURE_TRUE(optionAccessible, NS_ERROR_FAILURE);
-   return optionAccessible->GetName(aValue);
- }
-@@ -1498,8 +1498,8 @@ void nsHTMLComboboxListAccessible::GetBo
- {
-   *aBoundingFrame = nsnull;
- 
--  nsCOMPtr<nsIAccessible> comboAccessible;
--  GetParent(getter_AddRefs(comboAccessible));
-+  nsIAccessible* comboAccessible = nsnull;
-+  GetParent(&comboAccessible);
-   if (!comboAccessible) {
-     return;
-   }
-@@ -1508,16 +1508,16 @@ void nsHTMLComboboxListAccessible::GetBo
-     return;
-   }
-    // get our first option
--  nsCOMPtr<nsIDOMNode> child;
--  mDOMNode->GetFirstChild(getter_AddRefs(child));
-+  nsIDOMNode* child = nsnull;
-+  mDOMNode->GetFirstChild(&child);
- 
-   // now get its frame
--  nsCOMPtr<nsIPresShell> shell = GetPresShell();
-+  nsIPresShell* shell = GetPresShell();
-   if (!shell) {
-     return;
-   }
- 
--  nsCOMPtr<nsIContent> content(do_QueryInterface(child));
-+  nsIContent* content(do_QueryInterface(child));
-   if (!content) {
-     return;
-   }
-diff --git a/accessible/src/html/nsHTMLSelectAccessible.h b/accessible/src/html/nsHTMLSelectAccessible.h
---- a/accessible/src/html/nsHTMLSelectAccessible.h
-+++ b/accessible/src/html/nsHTMLSelectAccessible.h
-@@ -96,9 +96,9 @@ protected:
-     PRUint32 mLength;
-     PRUint32 mIndex;
-     PRInt32 mSelCount;
--    nsCOMPtr<nsIDOMHTMLOptionsCollection> mOptions;
--    nsCOMPtr<nsIDOMHTMLOptionElement> mOption;
--    nsCOMPtr<nsIWeakReference> mWeakShell;
-+    nsIDOMHTMLOptionsCollection* mOptions;
-+    nsIDOMHTMLOptionElement* mOption;
-+    nsIWeakReference* mWeakShell;
-     nsHTMLSelectableAccessible *mParentSelect;
- 
-   public:
-@@ -133,12 +133,12 @@ public:
-   void CacheChildren();
- 
- protected:
--  already_AddRefed<nsIAccessible>
-+  nsIAccessible*
-     AccessibleForOption(nsIAccessibilityService *aAccService,
-                         nsIContent *aContent,
-                         nsIAccessible *aLastGoodAccessible,
-                         PRInt32 *aChildCount);
--  already_AddRefed<nsIAccessible>
-+  nsIAccessible*
-     CacheOptSiblings(nsIAccessibilityService *aAccService,
-                      nsIContent *aParentContent,
-                      nsIAccessible *aLastGoodAccessible,
-@@ -229,7 +229,7 @@ public:
-   NS_IMETHOD Shutdown();
- 
- protected:
--  already_AddRefed<nsIAccessible> GetFocusedOptionAccessible();
-+  nsIAccessible* GetFocusedOptionAccessible();
- 
- private:
-   nsRefPtr<nsHTMLComboboxListAccessible> mListAccessible;
-diff --git a/accessible/src/html/nsHTMLTableAccessible.cpp b/accessible/src/html/nsHTMLTableAccessible.cpp
---- a/accessible/src/html/nsHTMLTableAccessible.cpp
-+++ b/accessible/src/html/nsHTMLTableAccessible.cpp
-@@ -86,9 +86,9 @@ nsHTMLTableCellAccessible::GetAttributes
-   nsresult rv = nsHyperTextAccessibleWrap::GetAttributesInternal(aAttributes);
-   NS_ENSURE_SUCCESS(rv, rv);
- 
--  nsCOMPtr<nsIContent> content(do_QueryInterface(mDOMNode));
-+  nsIContent* content(do_QueryInterface(mDOMNode));
- 
--  nsCOMPtr<nsIPresShell> shell = GetPresShell();
-+  nsIPresShell* shell = GetPresShell();
-   NS_ENSURE_STATE(shell);
-   
-   nsIFrame *frame = shell->GetPrimaryFrameFor(content);
-@@ -103,10 +103,10 @@ nsHTMLTableCellAccessible::GetAttributes
-   rv = cellLayout->GetCellIndexes(rowIdx, cellIdx);
-   NS_ENSURE_SUCCESS(rv, rv);
- 
--  nsCOMPtr<nsIAccessible> childAcc(this);
-+  nsIAccessible* childAcc(this);
- 
--  nsCOMPtr<nsIAccessible> parentAcc;
--  rv = childAcc->GetParent(getter_AddRefs(parentAcc));
-+  nsIAccessible* parentAcc = nsnull;
-+  rv = childAcc->GetParent(&parentAcc);
-   NS_ENSURE_SUCCESS(rv, rv);
- 
-   while (parentAcc) {
-@@ -114,7 +114,7 @@ nsHTMLTableCellAccessible::GetAttributes
-       // Table accessible must implement nsIAccessibleTable interface but if
-       // it isn't happen (for example because of ARIA usage) we shouldn't fail
-       // on getting other attributes.
--      nsCOMPtr<nsIAccessibleTable> tableAcc(do_QueryInterface(parentAcc));
-+      nsIAccessibleTable* tableAcc(do_QueryInterface(parentAcc));
-       if (!tableAcc)
-         return NS_OK;
- 
-@@ -129,8 +129,8 @@ nsHTMLTableCellAccessible::GetAttributes
-       return NS_OK;
-     }
- 
--    parentAcc.swap(childAcc);
--    rv = childAcc->GetParent(getter_AddRefs(parentAcc));
-+    swap(parentAcc, childAcc);
-+    rv = childAcc->GetParent(&parentAcc);
-     NS_ENSURE_SUCCESS(rv, rv);
-   }
- 
-@@ -157,24 +157,24 @@ void nsHTMLTableAccessible::CacheChildre
-   
-   if (mAccChildCount == eChildCountUninitialized) {
-     nsAccessible::CacheChildren();
--    nsCOMPtr<nsIAccessible> captionAccessible;
-+    nsIAccessible* captionAccessible = nsnull;
-     while (NextChild(captionAccessible)) {
-       if (Role(captionAccessible) == nsIAccessibleRole::ROLE_CAPTION) {
--        nsCOMPtr<nsIAccessible> captionParentAccessible;
--        captionAccessible->GetParent(getter_AddRefs(captionParentAccessible));
-+        nsIAccessible* captionParentAccessible = nsnull;
-+        captionAccessible->GetParent(&captionParentAccessible);
-         if (captionParentAccessible != this) {
-           NS_WARNING("Should not happen: parser ensures caption is the table's child, not the tbody's");
-           return;
-         }
--        nsCOMPtr<nsIAccessible> beforeCaptionAccessible;
--        captionAccessible->GetPreviousSibling(getter_AddRefs(beforeCaptionAccessible));
-+        nsIAccessible* beforeCaptionAccessible = nsnull;
-+        captionAccessible->GetPreviousSibling(&beforeCaptionAccessible);
-         if (beforeCaptionAccessible) {
-           // Move caption accessible so that it's the first child
--          nsCOMPtr<nsIAccessible> afterCaptionAccessible;
--          captionAccessible->GetNextSibling(getter_AddRefs(afterCaptionAccessible));
--          nsCOMPtr<nsPIAccessible> privateAcc = do_QueryInterface(beforeCaptionAccessible);
-+          nsIAccessible* afterCaptionAccessible = nsnull;
-+          captionAccessible->GetNextSibling(&afterCaptionAccessible);
-+          nsPIAccessible* privateAcc = do_QueryInterface(beforeCaptionAccessible);
-           privateAcc->SetNextSibling(afterCaptionAccessible);
--          GetFirstChild(getter_AddRefs(afterCaptionAccessible));
-+          GetFirstChild(&afterCaptionAccessible);
-           SetFirstChild(captionAccessible);
-           privateAcc = do_QueryInterface(captionAccessible);
-           privateAcc->SetNextSibling(afterCaptionAccessible);        
-@@ -210,7 +210,7 @@ NS_IMETHODIMP nsHTMLTableAccessible::Get
- 
-   nsAccessible::GetName(aName);
-   if (aName.IsEmpty()) {
--    nsCOMPtr<nsIContent> content(do_QueryInterface(mDOMNode));
-+    nsIContent* content(do_QueryInterface(mDOMNode));
-     if (content) { 
-       content->GetAttr(kNameSpaceID_None, nsAccessibilityAtoms::summary, aName);
-     }
-@@ -268,8 +268,8 @@ NS_IMETHODIMP
- NS_IMETHODIMP
- nsHTMLTableAccessible::GetCaption(nsIAccessible **aCaption)
- {
--  nsCOMPtr<nsIAccessible> firstChild;
--  GetFirstChild(getter_AddRefs(firstChild));
-+  nsIAccessible* firstChild = nsnull;
-+  GetFirstChild(&firstChild);
-   if (firstChild && Role(firstChild) == nsIAccessibleRole::ROLE_CAPTION) {
-     NS_ADDREF(*aCaption = firstChild);
-   }
-@@ -279,7 +279,7 @@ NS_IMETHODIMP
- NS_IMETHODIMP
- nsHTMLTableAccessible::GetSummary(nsAString &aSummary)
- {
--  nsCOMPtr<nsIDOMHTMLTableElement> table(do_QueryInterface(mDOMNode));
-+  nsIDOMHTMLTableElement* table(do_QueryInterface(mDOMNode));
-   NS_ENSURE_TRUE(table, NS_ERROR_FAILURE);
- 
-   return table->GetSummary(aSummary);
-@@ -301,36 +301,36 @@ nsHTMLTableAccessible::GetColumnHeader(n
- {
-   nsresult rv = NS_OK;
- 
--  nsCOMPtr<nsIDOMHTMLTableElement> table(do_QueryInterface(mDOMNode));
-+  nsIDOMHTMLTableElement* table(do_QueryInterface(mDOMNode));
-   NS_ENSURE_TRUE(table, NS_ERROR_FAILURE);
- 
--  nsCOMPtr<nsIDOMHTMLTableSectionElement> section;
--  rv = table->GetTHead(getter_AddRefs(section));
-+  nsIDOMHTMLTableSectionElement* section = nsnull;
-+  rv = table->GetTHead(&section);
-   NS_ENSURE_SUCCESS(rv, rv);
- 
--  nsCOMPtr<nsIAccessibilityService>
-+  nsIAccessibilityService*
-     accService(do_GetService("@mozilla.org/accessibilityService;1"));
-   NS_ENSURE_TRUE(accService, NS_ERROR_FAILURE);
- 
--  nsCOMPtr<nsIAccessible> accHead;
--  nsCOMPtr<nsIDOMNode> sectionNode(do_QueryInterface(section));
-+  nsIAccessible* accHead = nsnull;
-+  nsIDOMNode* sectionNode(do_QueryInterface(section));
-   if (sectionNode) {
-     rv = accService->GetCachedAccessible(sectionNode, mWeakShell,
--                                         getter_AddRefs(accHead));
-+                                         &accHead);
-     NS_ENSURE_SUCCESS(rv, rv);
-   }
- 
-   if (!accHead) {
-      accService->CreateHTMLTableHeadAccessible(section,
--                                               getter_AddRefs(accHead));
-+                                               &accHead);
-                                                    
--    nsCOMPtr<nsPIAccessNode> accessNode(do_QueryInterface(accHead));
-+    nsPIAccessNode* accessNode(do_QueryInterface(accHead));
-     NS_ENSURE_TRUE(accHead, NS_ERROR_FAILURE);
-     rv = accessNode->Init();
-     NS_ENSURE_SUCCESS(rv, rv);
-   }
- 
--  nsCOMPtr<nsIAccessibleTable> accTableHead(do_QueryInterface(accHead));
-+  nsIAccessibleTable* accTableHead(do_QueryInterface(accHead));
-   NS_ENSURE_TRUE(accTableHead, NS_ERROR_FAILURE);
- 
-   *aColumnHeader = accTableHead;
-@@ -577,11 +577,11 @@ nsHTMLTableAccessible::CellRefAt(PRInt32
- 
-   nsresult rv = NS_OK;
- 
--  nsCOMPtr<nsIDOMElement> cellElement;
--  rv = GetCellAt(aRow, aColumn, *getter_AddRefs(cellElement));
-+  nsIDOMElement* cellElement = nsnull;
-+  rv = GetCellAt(aRow, aColumn, *&cellElement);
-   NS_ENSURE_SUCCESS(rv, rv);
- 
--  nsCOMPtr<nsIAccessibilityService>
-+  nsIAccessibilityService*
-     accService(do_GetService("@mozilla.org/accessibilityService;1"));
-   NS_ENSURE_TRUE(accService, NS_ERROR_FAILURE);
- 
-@@ -638,11 +638,11 @@ nsHTMLTableAccessible::GetColumnExtentAt
- 
-   nsresult rv = NS_OK;
- 
--  nsCOMPtr<nsIDOMElement> domElement;
--  rv = GetCellAt(aRow, aColumn, *getter_AddRefs(domElement));
-+  nsIDOMElement* domElement = nsnull;
-+  rv = GetCellAt(aRow, aColumn, *&domElement);
-   NS_ENSURE_SUCCESS(rv, rv);
- 
--  nsCOMPtr<nsIDOMHTMLTableCellElement> cell(do_QueryInterface(domElement));
-+  nsIDOMHTMLTableCellElement* cell(do_QueryInterface(domElement));
-   NS_ENSURE_TRUE(cell, NS_ERROR_FAILURE);
- 
-   return cell->GetColSpan(_retval);
-@@ -656,11 +656,11 @@ nsHTMLTableAccessible::GetRowExtentAt(PR
- 
-   nsresult rv = NS_OK;
- 
--  nsCOMPtr<nsIDOMElement> domElement;
--  rv = GetCellAt(aRow, aColumn, *getter_AddRefs(domElement));
-+  nsIDOMElement* domElement = nsnull;
-+  rv = GetCellAt(aRow, aColumn, *&domElement);
-   NS_ENSURE_SUCCESS(rv, rv);
- 
--  nsCOMPtr<nsIDOMHTMLTableCellElement> cell(do_QueryInterface(domElement));
-+  nsIDOMHTMLTableCellElement* cell(do_QueryInterface(domElement));
-   NS_ENSURE_TRUE(cell, NS_ERROR_FAILURE);
- 
-   return cell->GetRowSpan(_retval);
-@@ -740,11 +740,11 @@ nsHTMLTableAccessible::IsCellSelected(PR
-   nsresult rv = GetTableLayout(&tableLayout);
-   NS_ENSURE_SUCCESS(rv, rv);
- 
--  nsCOMPtr<nsIDOMElement> domElement;
-+  nsIDOMElement* domElement = nsnull;
-   PRInt32 startRowIndex = 0, startColIndex = 0,
-           rowSpan, colSpan, actualRowSpan, actualColSpan;
- 
--  rv = tableLayout->GetCellDataAt(aRow, aColumn, *getter_AddRefs(domElement),
-+  rv = tableLayout->GetCellDataAt(aRow, aColumn, *&domElement,
-                                   startRowIndex, startColIndex,
-                                   rowSpan, colSpan,
-                                   actualRowSpan, actualColSpan, *aIsSelected);
-@@ -804,20 +804,20 @@ nsHTMLTableAccessible::SelectRowOrColumn
- {
-   PRBool doSelectRow = (aTarget == nsISelectionPrivate::TABLESELECTION_ROW);
- 
--  nsCOMPtr<nsIContent> content(do_QueryInterface(mDOMNode));
-+  nsIContent* content(do_QueryInterface(mDOMNode));
-   if (!content)
-     return NS_OK;
- 
--  nsCOMPtr<nsIDocument> document = content->GetCurrentDoc();
-+  nsIDocument* document = content->GetCurrentDoc();
-   NS_ENSURE_STATE(document);
- 
--  nsCOMPtr<nsISelectionController> selController(
-+  nsISelectionController* selController(
-     do_QueryInterface(document->GetPrimaryShell()));
-   NS_ENSURE_STATE(selController);
- 
--  nsCOMPtr<nsISelection> selection;
-+  nsISelection* selection = nsnull;
-   selController->GetSelection(nsISelectionController::SELECTION_NORMAL,
--                              getter_AddRefs(selection));
-+                              &selection);
-   NS_ENSURE_STATE(selection);
- 
-   PRInt32 count = 0;
-@@ -825,11 +825,11 @@ nsHTMLTableAccessible::SelectRowOrColumn
-   NS_ENSURE_SUCCESS(rv, rv);
- 
-   for (PRInt32 index = 0; index < count; index++) {
--    nsCOMPtr<nsIDOMElement> cellElm;
-+    nsIDOMElement* cellElm = nsnull;
-     PRInt32 column = doSelectRow ? index : aIndex;
-     PRInt32 row = doSelectRow ? aIndex : index;
- 
--    rv = GetCellAt(row, column, *getter_AddRefs(cellElm));
-+    rv = GetCellAt(row, column, *&cellElm);
-     NS_ENSURE_SUCCESS(rv, rv);
- 
-     rv = SelectCell(selection, document, cellElm, aDoSelect);
-@@ -846,32 +846,32 @@ nsHTMLTableAccessible::SelectCell(nsISel
-                                   PRBool aDoSelect)
- {
-   if (aDoSelect) {
--    nsCOMPtr<nsIDOMDocumentRange> documentRange(do_QueryInterface(aDocument));
-+    nsIDOMDocumentRange* documentRange(do_QueryInterface(aDocument));
-     NS_ENSURE_STATE(documentRange);
- 
--    nsCOMPtr<nsIDOMRange> range;
--    documentRange->CreateRange(getter_AddRefs(range));
-+    nsIDOMRange* range = nsnull;
-+    documentRange->CreateRange(&range);
- 
--    nsCOMPtr<nsIDOMNode> cellNode(do_QueryInterface(aCellElement));
-+    nsIDOMNode* cellNode(do_QueryInterface(aCellElement));
-     NS_ENSURE_STATE(cellNode);
- 
-     range->SelectNode(cellNode);
-     return aSelection->AddRange(range);
-   }
- 
--  nsCOMPtr<nsIContent> cell(do_QueryInterface(aCellElement));
-+  nsIContent* cell(do_QueryInterface(aCellElement));
-   NS_ENSURE_STATE(cell);
- 
--  nsCOMPtr<nsIContent> cellParent = cell->GetParent();
-+  nsIContent* cellParent = cell->GetParent();
-   NS_ENSURE_STATE(cellParent);
- 
-   PRInt32 offset = cellParent->IndexOf(cell);
-   NS_ENSURE_STATE(offset != -1);
- 
--  nsCOMPtr<nsIDOMNode> parent(do_QueryInterface(cellParent));
-+  nsIDOMNode* parent(do_QueryInterface(cellParent));
-   NS_ENSURE_STATE(parent);
- 
--  nsCOMPtr<nsISelection2> selection2(do_QueryInterface(aSelection));
-+  nsISelection2* selection2(do_QueryInterface(aSelection));
-   NS_ENSURE_STATE(selection2);
- 
-   nsCOMArray<nsIDOMRange> ranges;
-@@ -891,17 +891,17 @@ nsHTMLTableAccessible::GetTableNode(nsID
- {
-   nsresult rv = NS_OK;
- 
--  nsCOMPtr<nsIDOMHTMLTableElement> table(do_QueryInterface(mDOMNode));
-+  nsIDOMHTMLTableElement* table(do_QueryInterface(mDOMNode));
-   if (table) {
-     *_retval = table;
-     NS_IF_ADDREF(*_retval);
-     return rv;
-   }
- 
--  nsCOMPtr<nsIDOMHTMLTableSectionElement> section(do_QueryInterface(mDOMNode));
-+  nsIDOMHTMLTableSectionElement* section(do_QueryInterface(mDOMNode));
-   if (section) {
--    nsCOMPtr<nsIDOMNode> parent;
--    rv = section->GetParentNode(getter_AddRefs(parent));
-+    nsIDOMNode* parent = nsnull;
-+    rv = section->GetParentNode(&parent);
-     NS_ENSURE_SUCCESS(rv, rv);
- 
-     *_retval = parent;
-@@ -917,14 +917,14 @@ nsHTMLTableAccessible::GetTableLayout(ns
- {
-   *aTableLayout = nsnull;
- 
--  nsCOMPtr<nsIDOMNode> tableNode;
--  GetTableNode(getter_AddRefs(tableNode));
--  nsCOMPtr<nsIContent> tableContent(do_QueryInterface(tableNode));
-+  nsIDOMNode* tableNode = nsnull;
-+  GetTableNode(&tableNode);
-+  nsIContent* tableContent(do_QueryInterface(tableNode));
-   if (!tableContent) {
-     return NS_ERROR_FAILURE; // Table shut down
-   }
- 
--  nsCOMPtr<nsIPresShell> shell = GetPresShell();
-+  nsIPresShell* shell = GetPresShell();
-   NS_ENSURE_TRUE(shell, NS_ERROR_FAILURE);
- 
-   nsIFrame *frame = shell->GetPrimaryFrameFor(tableContent);
-@@ -963,13 +963,13 @@ NS_IMETHODIMP nsHTMLTableAccessible::Get
-     return NS_OK;
-   }
- 
--  nsCOMPtr<nsIAccessible> captionAccessible;
--  GetCaption(getter_AddRefs(captionAccessible));
--  nsCOMPtr<nsIAccessNode> captionAccessNode = do_QueryInterface(captionAccessible);
-+  nsIAccessible* captionAccessible = nsnull;
-+  GetCaption(&captionAccessible);
-+  nsIAccessNode* captionAccessNode = do_QueryInterface(captionAccessible);
-   if (captionAccessNode) {
--    nsCOMPtr<nsIDOMNode> captionNode;
--    captionAccessNode->GetDOMNode(getter_AddRefs(captionNode));
--    nsCOMPtr<nsIContent> captionContent = do_QueryInterface(captionNode);
-+    nsIDOMNode* captionNode = nsnull;
-+    captionAccessNode->GetDOMNode(&captionNode);
-+    nsIContent* captionContent = do_QueryInterface(captionNode);
-     if (captionContent) {
-       AppendFlatStringFromSubtree(captionContent, &aDescription);
-     }
-@@ -990,21 +990,21 @@ NS_IMETHODIMP nsHTMLTableAccessible::Get
- 
- PRBool nsHTMLTableAccessible::HasDescendant(char *aTagName, PRBool aAllowEmpty)
- {
--  nsCOMPtr<nsIDOMElement> tableElt(do_QueryInterface(mDOMNode));